commit 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 Author: Linus Torvalds Date: Sun Nov 30 14:42:10 2025 -0800 Linux 6.18 commit e69c7c175115c51c7f95394fc55425a395b3af59 Merge: 6bda50f4333fa6 c7418164b46305 Author: Linus Torvalds Date: Sun Nov 30 08:47:10 2025 -0800 Merge tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Have timekeeping aux clocks sysfs interface setup function return an error code on failure instead of success * tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix error code in tk_aux_sysfs_init() commit 6bda50f4333fa61c07f04f790fdd4e2c9f4ca610 Merge: 19eef1d98eeda3 841ecc979b18d3 Author: Linus Torvalds Date: Sat Nov 29 15:15:14 2025 -0800 Merge tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Fix TLB unification for cores with more than 64 TLB entries" * tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 Author: Thomas Bogendoerfer Date: Fri Nov 28 16:53:46 2025 +0000 MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+ cores can have more than 64 TLB entries. Therefore allocate an array for uniquification instead of placing too an small array on the stack. Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") Co-developed-by: Maciej W. Rozycki Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification Cc: stable@vger.kernel.org # v6.17+ Tested-by: Gregory CLEMENT Tested-by: Klara Modin Signed-off-by: Thomas Bogendoerfer commit 19eef1d98eeda3745df35839190b7d4a4adea656 Author: David Howells Date: Sat Nov 29 00:40:11 2025 +0000 afs: Fix uninit var in afs_alloc_anon_key() Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it to cell->anonymous_key. Without this change, the error check may return a false failure with a bad error number. Most of the time this is unlikely to happen because the first encounter with afs_alloc_anon_key() will usually be from (auto)mount, for which all subsequent operations must wait - apart from other (auto)mounts. Once the call->anonymous_key is allocated, all further calls to afs_request_key() will skip the call to afs_alloc_anon_key() for that cell. Fixes: d27c71257825 ("afs: Fix delayed allocation of a cell's anonymous key") Reported-by: Paulo Alcantra Signed-off-by: David Howells Reviewed-by: Paulo Alcantara cc: Marc Dionne cc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Linus Torvalds commit e6640487845061255af9614ec0a192e4fafa486e Merge: 82ebd4e32029f2 40ad64ac25bb73 Author: Linus Torvalds Date: Fri Nov 28 14:08:09 2025 -0800 Merge tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A disappointingly large set of device specific fixes that have built up since I've been a bit tardy with sending a pull requests as people kept sending me new new fixes. The bcm63xx and lpspi issues could lead to corruption so the fixes are fairly important for the affected parts, the other issues should all be relatively minor" * tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: nxp-fspi: Propagate fwnode in ACPI case as well spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors spi: spi-fsl-lpspi: fix watermark truncation caused by type cast spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm spi: bcm63xx: fix premature CS deassertion on RX-only transactions spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance commit 82ebd4e32029f299011a6ef68d96f5ddcea0723a Merge: 9917bf8e7f5a9e 8684229e19c418 Author: Linus Torvalds Date: Fri Nov 28 14:06:05 2025 -0800 Merge tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes for incorrect device descriptions in the rtq2208 driver" * tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: rtq2208: Correct LDO2 logic judgment bits regulator: rtq2208: Correct buck group2 phase mapping logic commit 9917bf8e7f5a9efbab844cf06cfd8da8eb7e13b6 Merge: f3b17337b94394 f6dc5a36195d3f Author: Linus Torvalds Date: Fri Nov 28 12:42:11 2025 -0800 Merge tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Ensure that vectored registered buffer imports ties the lifetime of those to the zero-copy send notification, not the parent request - Fix a bug introduced in this merge window, with the introduction of mixed sized CQE support * tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix mixed cqe overflow handling io_uring/net: ensure vectored buffer node import is tied to notification commit f3b17337b943949d0f3d12835d10d866210aeee8 Merge: 7fa0d7744c2826 d27c71257825dc Author: Linus Torvalds Date: Fri Nov 28 10:01:24 2025 -0800 Merge tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. The normal key lookup tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set, causing an oops - ovl: fail ovl_lock_rename_workdir() if either target is unhashed As well as checking that the parent hasn't changed after getting the lock, the code needs to check that the dentry hasn't been unhashed. Otherwise overlayfs might try to rename something that has been removed - namespace: fix a reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns, and so grab_requested_mnt_ns() doesn't need to take an extra reference * tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: afs: Fix delayed allocation of a cell's anonymous key ovl: fail ovl_lock_rename_workdir() if either target is unhashed fs/namespace: fix reference leak in grab_requested_mnt_ns commit 7fa0d7744c28267142287a75134de58790999e72 Merge: 6cf62f0174de64 3ecfcf34f0992d Author: Linus Torvalds Date: Fri Nov 28 09:57:31 2025 -0800 Merge tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "A few last minute fixes came in this week: - interrupt and gpio numbers in foud separate i.MX8 specific devicetree files were wrong - The vector length property in the C906 CPU description used the wrong unit - Two bugs with uninitialized stack variables in the tee subsystem - Alexander Stein now maintains additional devicetree files" * tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: dts: allwinner: d1: fix vlenb property MAINTAINERS: Add entry for TQ-Systems AM335 device trees tee: qcomtee: initialize result before use in release worker arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity tee: qcomtee: fix uninitialized pointers with free attribute ARM: dts: nxp: imx6ul: correct SAI3 interrupt line arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos arm64: dts: imx8dxl: Correct pcie-ep interrupt number commit 6cf62f0174de64e4161e301bb0ed52e198ce25dc Merge: dabf127d641e43 03bc4831ef064e Author: Linus Torvalds Date: Fri Nov 28 09:44:48 2025 -0800 Merge tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO fixes from Greg KH: "Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8. Fixes in here include: - lots of iio driver bugfixes for reported issues. - counter driver bugfix - slimbus driver bugfix - mei tiny bugfix - nvmem layout uevent bugfix All of these have been in linux-next for a while, but due to travel on my side, I haven't had a chance to get them to you" * tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits) nvmem: layouts: fix nvmem_layout_bus_uevent iio: accel: bmc150: Fix irq assumption regression most: usb: fix double free on late probe failure slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves firmware: stratix10-svc: fix bug in saving controller data mei: fix error flow in probe iio: st_lsm6dsx: Fixed calibrated timestamp calculation iio: humditiy: hdc3020: fix units for thresholds and hysteresis iio: humditiy: hdc3020: fix units for temperature and humidity measurement iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields iio: accel: fix ADXL355 startup race condition iio: adc: ad7124: fix temperature channel iio:common:ssp_sensors: Fix an error handling path ssp_probe() iio: adc: ad7280a: fix ad7280_store_balance_timer() iio: buffer-dmaengine: enable .get_dma_dev() iio: buffer-dma: support getting the DMA channel iio: buffer: support getting dma channel from the buffer iio: pressure: bmp280: correct meas_time_us calculation iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling iio: adc: ad7380: fix SPI offload trigger rate ... commit dabf127d641e43d5fbb72a1f48209818349db7ef Merge: 5d324e5159d9e6 2bf95a9bcb5000 Author: Linus Torvalds Date: Fri Nov 28 09:16:20 2025 -0800 Merge tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two serial driver fixes for reported issues for 6.18-rc8. These are: - fix for a much reported symbol build loop that broke the build for some kernel configurations - amba-pl011 driver bugfix for a reported issue Both have been in linux next (the last for weeks, the first for a shorter amount of time), with no reported issues" * tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250: Fix 8250_rsa symbol loop serial: amba-pl011: prefer dma_mapping_error() over explicit address checking commit 5d324e5159d9e6a1e6678007ce3f24e569650db6 Merge: 24a84ea4eef6ec 74851fbb6d6473 Author: Linus Torvalds Date: Fri Nov 28 09:12:40 2025 -0800 Merge tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are some last-minutes USB and Thunderbolt driver fixes and new device ids for 6.18-rc8. Included in here are: - usb storage quirk fixup - xhci driver fixes for reported issues - usb gadget driver fixes - dwc3 driver fixes - UAS driver fixup - thunderbolt new device ids - usb-serial driver new ids All of these have been in linux-next with no reported issues, many for many weeks" * tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits) usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors USB: storage: Remove subclass and protocol overrides from Novatek quirk usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths xhci: dbgtty: fix device unregister usb: storage: sddr55: Reject out-of-bound new_pba USB: serial: option: add support for Rolling RW101R-GL usb: typec: ucsi: psy: Set max current to zero when disconnected usb: gadget: f_eem: Fix memory leak in eem_unwrap usb: dwc3: pci: Sort out the Intel device IDs usb: dwc3: pci: add support for the Intel Nova Lake -S drivers/usb/dwc3: fix PCI parent check usb: storage: Fix memory leak in USB bulk transport xhci: sideband: Fix race condition in sideband unregister xhci: dbgtty: Fix data corruption when transmitting data form DbC to host xhci: fix stale flag preventig URBs after link state error is cleared USB: serial: ftdi_sio: add support for u-blox EVK-M101 usb: cdns3: Fix double resource release in cdns3_pci_probe usb: gadget: udc: fix use-after-free in usb_gadget_state_work usb: renesas_usbhs: Fix synchronous external abort on unbind ... commit 24a84ea4eef6ec6245e1efdc64764d60d17321bb Merge: 4331989728da4e e3cee98f2fcc22 Author: Linus Torvalds Date: Fri Nov 28 09:09:33 2025 -0800 Merge tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox fixes from Jassi Brar: - omap: check for pending msgs only when mbox is exclusive - mailbox-test: debugfs_create_dir error checking - mtk: - cmdq: fix DMA address handling - gpueb: Add missing 'static' to mailbox ops struct - pcc: don't zero error register - th1520: fix clock imbalance on probe failure * tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: th1520: fix clock imbalance on probe failure mailbox: pcc: don't zero error register mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct mailbox: mtk-cmdq: Refine DMA address handling for the command buffer mailbox: mailbox-test: Fix debugfs_create_dir error checking mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive commit 3ecfcf34f0992d11e5eb2458a2108b3320c61ba4 Merge: a6737fe620315d 9f393d8e757f79 Author: Arnd Bergmann Date: Fri Nov 28 17:37:13 2025 +0100 Merge tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner fixes for 6.18 Just one fix to correct the "thead,vlenb" property for the RISC-V based D1 SoC family. * tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: riscv: dts: allwinner: d1: fix vlenb property commit a6737fe620315db4a47d577703d516cdea960991 Merge: fe7cdcd1bacec3 517d066dc080fc Author: Arnd Bergmann Date: Fri Nov 21 22:14:04 2025 +0100 Merge tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes MAINTAINERS: Add entry for TQ-Systems AM335 device trees * tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: MAINTAINERS: Add entry for TQ-Systems AM335 device trees commit 4331989728da4e868fcda75bde872d032f5ce6ac Merge: f849f26f77205e 747528729c9b67 Author: Linus Torvalds Date: Fri Nov 28 08:20:14 2025 -0800 Merge tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: - sdhci-of-dwcmshc: Fix reset handling for some variants * tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level commit f849f26f77205e25f6ad0b9011b1b68a560d35ff Merge: e538109ac71d80 c98c99d5dbdf9f Author: Linus Torvalds Date: Fri Nov 28 08:08:02 2025 -0800 Merge tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - mediatek: Fix spinlock recursion in probe - tegra: Use GENPD_FLAG_NO_STAY_ON to restore old behaviour * tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag pmdomains: mtk-pm-domains: Fix spinlock recursion in probe commit e3cee98f2fcc2234be7813c0e55a7f7a5e77aaf2 Author: Johan Hovold Date: Fri Oct 17 07:54:14 2025 +0200 mailbox: th1520: fix clock imbalance on probe failure The purpose of the devm_add_action_or_reset() helper is to call the action function in case adding an action ever fails so drop the clock disable from the error path to avoid disabling the clocks twice. Fixes: 5d4d263e1c6b ("mailbox: Introduce support for T-head TH1520 Mailbox driver") Cc: Michal Wilczynski Signed-off-by: Johan Hovold Reviewed-by: Michal Wilczynski Signed-off-by: Jassi Brar commit ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0 Author: Jamie Iles Date: Wed Nov 5 14:42:29 2025 +0000 mailbox: pcc: don't zero error register The error status mask for a type 3/4 subspace is used for reading the error status, and the bitwise inverse is used for clearing the error with the intent being to preserve any of the non-error bits. However, we were previously applying the mask to extract the status and then applying the inverse to the result which ended up clearing all bits. Instead, store the inverse mask in the preserve mask and then use that on the original value read from the error status so that only the error is cleared. Fixes: c45ded7e1135 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)") Signed-off-by: Jamie Iles Signed-off-by: Punit Agrawal Signed-off-by: Jassi Brar commit 094b53ecaa3ef227f9c800f8de90a9b44f1c1bb4 Author: Nicolas Frattaroli Date: Mon Oct 13 10:09:01 2025 +0200 mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct mtk_gpueb_mbox_ops should be declared static. However, due to its const nature, this specifier was missed, as it compiled fine without it and with no warning by the compiler. arc-linux-gcc (GCC) 12.5.0 doesn't seem to like it however, so add the static to fix that. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510100629.3nGvrhEU-lkp@intel.com/ Fixes: dbca0eabb821 ("mailbox: add MediaTek GPUEB IPI mailbox") Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit a195c7ccfb7a21b8118139835e25936ec8722596 Author: Jason-JH Lin Date: Thu Oct 23 01:16:30 2025 +0800 mailbox: mtk-cmdq: Refine DMA address handling for the command buffer GCE can only fetch the command buffer address from a 32-bit register. Some SoCs support a 35-bit command buffer address for GCE, which requires a right shift of 3 bits before setting the address into the 32-bit register. A comment has been added to the header of cmdq_get_shift_pa() to explain this requirement. To prevent the GCE command buffer address from being DMA mapped beyond its supported bit range, the DMA bit mask for the device is set during initialization. Additionally, to ensure the correct shift is applied when setting or reading the register that stores the GCE command buffer address, new APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have been introduced for consistent operations on this register. The variable type for the command buffer address has been standardized to dma_addr_t to prevent handling issues caused by type mismatches. Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform") Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit 3acf1028f5003731977f750a7070f3321a9cb740 Author: Haotian Zhang Date: Thu Nov 20 10:40:39 2025 +0800 mailbox: mailbox-test: Fix debugfs_create_dir error checking The debugfs_create_dir() function returns ERR_PTR() on error, not NULL. The current null-check fails to catch errors. Use IS_ERR() to correctly check for errors. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Haotian Zhang Signed-off-by: Jassi Brar commit 060e4e835f9394816584942511f22d771f05100c Author: Beleswar Padhi Date: Tue Nov 4 01:41:11 2025 +0530 mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive On TI K3 devices, the mailbox resides in the Always-On power domain (LPSC_main_alwayson) and is shared among multiple processors. The mailbox is not solely exclusive to Linux. Currently, the suspend path checks all FIFO queues for pending messages and blocks suspend if any are present. This behavior is unnecessary for K3 devices, since some of the FIFOs are used for RTOS<->RTOS communication and are independent of Linux. For FIFOs used in Linux<->RTOS communication, any pending message would trigger an interrupt, which naturally prevents suspend from completing. Hence, there is no need for the mailbox driver to explicitly check for pending messages on K3 platforms. Introduce a device match flag to indicate whether the mailbox instance is exclusive to Linux, and skip the pending message check for non-exclusive instances (such as in K3). Fixes: a49f991e740f ("arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware") Closes: https://lore.kernel.org/all/sid7gtg5vay5qgicsl6smnzwg5mnneoa35cempt5ddwjvedaio@hzsgcx6oo74l/ Signed-off-by: Beleswar Padhi Tested-by: Hiago De Franco Reviewed-by: Andrew Davis Signed-off-by: Jassi Brar commit d27c71257825dced46104eefe42e4d9964bd032e Author: David Howells Date: Fri Nov 28 10:19:05 2025 +0000 afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with "afs@" as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead. Fixes: 330e2c514823 ("afs: Fix dynamic lookup to fail on cell lookup failure") Reported-by: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com Signed-off-by: David Howells Link: https://patch.msgid.link/800328.1764325145@warthog.procyon.org.uk cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit e9c70084a64e51b65bb68f810692a03dc8bedffa Author: NeilBrown Date: Fri Nov 28 12:22:35 2025 +1100 ovl: fail ovl_lock_rename_workdir() if either target is unhashed As well as checking that the parent hasn't changed after getting the lock we need to check that the dentry hasn't been unhashed. Otherwise we might try to rename something that has been removed. Reported-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.") Signed-off-by: NeilBrown Link: https://patch.msgid.link/176429295510.634289.1552337113663461690@noble.neil.brown.name Tested-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit e538109ac71d801d26776af5f3c54f548296c29c Merge: aa7243aaf1947a 6dbcb801e1eb1b Author: Linus Torvalds Date: Thu Nov 27 21:06:27 2025 -0800 Merge tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Last one for this round hopefully, mostly the usual suspects, xe/amdgpu, with some single fixes otherwise. There is one amdgpu HDMI blackscreen bug that came in late in the cycle, but it was bisected and the revert is in here. i915: - Reject async flips when PSR's selective fetch is enabled xe: - Fix resource leak in xe_guc_ct_init_noalloc()'s error path - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT - Fix overflow in conversion from clock tics to msec amdgpu: - Unified MES fix - HDMI fix - Cursor fix - Bightness fix - EDID reading improvement - UserQ fix - Cyan Skillfish IP discovery fix bridge: - sil902x: Fix HDMI detection imagination: - Update documentation sti: - Fix leaks in probe vga_switcheroo: - Avoid race condition during fbcon initialization" * tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel: drm/amdgpu: fix cyan_skillfish2 gpu info fw handling drm/amdgpu: attach tlb fence to the PTs update drm/amd/display: Increase EDID read retries drm/amd/display: Don't change brightness for disabled connectors drm/amd/display: Check NULL before accessing Revert "drm/amd/display: Move setup_stream_attribute" drm/xe: Fix conversion from clock ticks to milliseconds drm/xe/guc: Fix stack_depot usage drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc() drm/i915/psr: Reject async flips when selective fetch is enabled drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup drm/amd/amdgpu: reserve vm invalidation engine for uni_mes drm: sti: fix device leaks at component probe drm/imagination: Document pvr_device.power member drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR commit 6dbcb801e1eb1b1764fd0012918225b60dd7916c Merge: 26c7a181fdb873 7276878b069c57 Author: Dave Airlie Date: Fri Nov 28 12:10:19 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix resource leak in xe_guc_ct_init_noalloc()'s error path (Shuicheng Lin) - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT (Lucas) - Fix overflow in conversion from clock tics to msec (Harish Chegondi) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/7ejiqjgthpqybg5svmkind2pszk4fqadxuq7rngchaaw76iept@5pn6sngqj6lk commit 26c7a181fdb873297d3424794762e5c4f4ef7227 Merge: 4fc3ad63dd31e9 eb76d0f5553575 Author: Dave Airlie Date: Fri Nov 28 12:00:07 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bridge: - sil902x: Fix HDMI detection imagination: - Update documentation sti: - Fix leaks in probe vga_switcheroo: - Avoid race condition during fbcon initialization Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251127081007.GA13578@2a02-2454-fd5e-fd00-689d-32c0-780c-bb87.dyn6.pyur.net commit 4fc3ad63dd31e9ecd44211a4cd331acebb077551 Merge: b31e2e3bb744c8 7fa666ab07ba9e Author: Dave Airlie Date: Fri Nov 28 11:56:37 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-26: amdgpu: - Unified MES fix - HDMI fix - Cursor fix - Bightness fix - EDID reading improvement - UserQ fix - Cyan Skillfish IP discovery fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251126204925.3316684-1-alexander.deucher@amd.com commit aa7243aaf1947a0cb54c44337795d6759493fe02 Merge: 3fa77874b4a7ae d0d08f4bd7f667 Author: Linus Torvalds Date: Thu Nov 27 17:29:15 2025 -0800 Merge tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two last minute fixes for the recently modified DMA API infrastructure: - proper handling of DMA_ATTR_MMIO in dma_iova_unlink() function (me) - regression fix for the code refactoring related to P2PDMA (Pranjal Shrivastava)" * tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink() commit 3fa77874b4a7ae96d4ad40623d449cef6265ae4a Merge: e1afacb68573c3 fbf04215d9966d Author: Linus Torvalds Date: Thu Nov 27 17:25:46 2025 -0800 Merge tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "One more urgent ACPI support fix for 6.18 There is one more commit that needs to be reverted after reverting problematic commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration"), so revert it" * tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" commit b31e2e3bb744c8fa852ad2a70712db97147071c9 Merge: ac3fd01e4c1efc 7c373b3bd03c77 Author: Dave Airlie Date: Fri Nov 28 11:08:54 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Reject async flips when PSR's selective fetch is enabled (Ville) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aScgY8QMjmyJRBX2@intel.com commit fbf04215d9966da61feee3f4ec24dbf4544cfd0f Author: Rafael J. Wysocki Date: Thu Nov 27 20:52:55 2025 +0100 Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" Revert commit 8a1b5d412cb4 ("ACPI: processor: Update cpuidle driver check in __acpi_processor_start()") which depends on commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") that got reverted. Signed-off-by: Rafael J. Wysocki commit e1afacb68573c3cd0a3785c6b0508876cd3423bc Merge: 1f5e808aa63af6 7fce830ecd0a02 Author: Linus Torvalds Date: Thu Nov 27 11:11:03 2025 -0800 Merge tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A patch to make sparse read handling work in msgr2 secure mode from Slava and a couple of fixes from Ziming and myself to avoid operating on potentially invalid memory, all marked for stable" * tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd ceph: fix crash in process_v2_sparse_read() for encrypted directories libceph: drop started parameter of __ceph_open_session() libceph: fix potential use-after-free in have_mon_and_osd_map() commit 1f5e808aa63af61ec0d6a14909056d6668813e86 Merge: a76dce0e540915 f07f4ea53e2242 Author: Linus Torvalds Date: Thu Nov 27 09:18:40 2025 -0800 Merge tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth and CAN. No known outstanding regressions. Current release - regressions: - mptcp: initialize rcv_mss before calling tcp_send_active_reset() - eth: mlx5e: fix validation logic in rate limiting Previous releases - regressions: - xsk: avoid data corruption on cq descriptor number - bluetooth: - prevent race in socket write iter and sock bind - fix not generating mackey and ltk when repairing - can: - kvaser_usb: fix potential infinite loop in command parsers - rcar_canfd: fix CAN-FD mode as default - eth: - veth: reduce XDP no_direct return section to fix race - virtio-net: avoid unnecessary checksum calculation on guest RX Previous releases - always broken: - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - bluetooth: mediatek: fix kernel crash when releasing iso interface - vhost: rewind next_avail_head while discarding descriptors - eth: - r8169: fix RTL8127 hang on suspend/shutdown - aquantia: add missing descriptor cache invalidation on ATL2 - dsa: microchip: fix resource releases in error path" * tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). net: fec: do not register PPS event for PEROUT net: fec: do not allow enabling PPS and PEROUT simultaneously net: fec: do not update PEROUT if it is enabled net: fec: cancel perout_timer when PEROUT is disabled net: mctp: unconditionally set skb->dev on dst output net: atlantic: fix fragment overflow handling in RX path MAINTAINERS: separate VIRTIO NET DRIVER and add netdev virtio-net: avoid unnecessary checksum calculation on guest RX eth: fbnic: Fix counter roll-over issue mptcp: clear scheduled subflows on retransmit net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic s390/net: list Aswin Karuvally as maintainer net: wwan: mhi: Keep modem name match with Foxconn T99W640 vhost: rewind next_avail_head while discarding descriptors net/sched: em_canid: fix uninit-value in em_canid_match can: rcar_canfd: Fix CAN-FD mode as default xsk: avoid data corruption on cq descriptor number r8169: fix RTL8127 hang on suspend/shutdown net: sxgbe: fix potential NULL dereference in sxgbe_rx() ... commit a76dce0e54091556c0981375859d6cb60d2f7bfa Merge: 765e56e41a5af2 9b9c0adbc3f8a5 Author: Linus Torvalds Date: Thu Nov 27 08:51:36 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull platform driver fixes from Ilpo Järvinen: - arm64/thinkpad-t14s-ec: - Fix IRQ race condition - Sleep after EC access - intel/punit_ipc: Fix memory corruption * tag 'platform-drivers-x86-v6.18-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: intel: punit_ipc: fix memory corruption platform: arm64: thinkpad-t14s-ec: sleep after EC access platform: arm64: thinkpad-t14s-ec: fix IRQ race condition commit f07f4ea53e22429c84b20832fa098b5ecc0d4e35 Author: Kuniyuki Iwashima Date: Tue Nov 25 19:53:29 2025 +0000 mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 Fixes: ae155060247b ("mptcp: fix duplicate reset on fastclose") Reported-by: syzbot+3a92d359bc2ec6255a33@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69260882.a70a0220.d98e3.00b4.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Matthieu Baerts (NGI0) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251125195331.309558-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit 40ad64ac25bb736740f895d99a4aebbda9b80991 Author: Andy Shevchenko Date: Wed Nov 26 21:25:01 2025 +0100 spi: nxp-fspi: Propagate fwnode in ACPI case as well Propagate fwnode of the ACPI device to the SPI controller Linux device. Currently only OF case propagates fwnode to the controller. While at it, replace several calls to dev_fwnode() with a single one cached in a local variable, and unify checks for fwnode type by using is_*_node() APIs. Fixes: 55ab8487e01d ("spi: spi-nxp-fspi: Add ACPI support") Signed-off-by: Andy Shevchenko Reviewed-by: Haibo Chen Link: https://patch.msgid.link/20251126202501.2319679-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 8684229e19c4185d53d6fb7004d733907c865a91 Author: ChiYuan Huang Date: Thu Nov 27 10:25:51 2025 +0800 regulator: rtq2208: Correct LDO2 logic judgment bits The LDO2 judgement bit position should be 7, not 6. Cc: stable@vger.kernel.org Reported-by: Yoon Dong Min Fixes: b65439d90150 ("regulator: rtq2208: Fix the LDO DVS capability") Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/faadb009f84b88bfcabe39fc5009c7357b00bbe2.1764209258.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 45cc214152bc1f6b1cc135532cd7cdbe08716aaf Author: ChiYuan Huang Date: Thu Nov 27 10:25:50 2025 +0800 regulator: rtq2208: Correct buck group2 phase mapping logic Correct buck group2 H and F mapping logic. Cc: stable@vger.kernel.org Reported-by: Yoon Dong Min Fixes: 1742e7e978ba ("regulator: rtq2208: Fix incorrect buck converter phase mapping") Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/8527ae02a72b754d89b7580a5fe7474d6f80f5c3.1764209258.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 36d747866445a362d486028792e56dbe04fc16fb Merge: b3e528a5811bbc 9a060d0fac9e75 Author: Paolo Abeni Date: Thu Nov 27 11:57:47 2025 +0100 Merge branch 'net-fec-fix-some-ptp-related-issues' Wei Fang says: ==================== net: fec: fix some PTP related issues There are some issues which were introduced by the commit 350749b909bf ("net: fec: Add support for periodic output signal of PPS"). See each patch for more details. ==================== Link: https://patch.msgid.link/20251125085210.1094306-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 9a060d0fac9e75524f72864adec6d8cdb70a5bca Author: Wei Fang Date: Tue Nov 25 16:52:10 2025 +0800 net: fec: do not register PPS event for PEROUT There are currently two situations that can trigger the PTP interrupt, one is the PPS event, the other is the PEROUT event. However, the irq handler fec_pps_interrupt() does not check the irq event type and directly registers a PPS event into the system, but the event may be a PEROUT event. This is incorrect because PEROUT is an output signal, while PPS is the input of the kernel PPS system. Therefore, add a check for the event type, if pps_enable is true, it means that the current event is a PPS event, and then the PPS event is registered. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8 Author: Wei Fang Date: Tue Nov 25 16:52:09 2025 +0800 net: fec: do not allow enabling PPS and PEROUT simultaneously In the current driver, PPS and PEROUT use the same channel to generate the events, so they cannot be enabled at the same time. Otherwise, the later configuration will overwrite the earlier configuration. Therefore, when configuring PPS, the driver will check whether PEROUT is enabled. Similarly, when configuring PEROUT, the driver will check whether PPS is enabled. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit e97faa0c20ea8840f45569ba434e30538fff8fc9 Author: Wei Fang Date: Tue Nov 25 16:52:08 2025 +0800 net: fec: do not update PEROUT if it is enabled If the previously set PEROUT is already active, updating it will cause the new PEROUT to start immediately instead of at the specified time. This is because fep->reload_period is updated whithout check whether the PEROUT is enabled, and the old PEROUT is not disabled. Therefore, the pulse period will be updated immediately in the pulse interrupt handler fec_pps_interrupt(). Currently, the driver does not support directly updating PEROUT and it will make the logic be more complicated. To fix the current issue, add a check before enabling the PEROUT, the driver will return an error if PEROUT is enabled. If users wants to update a new PEROUT, they should disable the old PEROUT first. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 50caa744689e505414673c20359b04aa918439e3 Author: Wei Fang Date: Tue Nov 25 16:52:07 2025 +0800 net: fec: cancel perout_timer when PEROUT is disabled The PEROUT allows the user to set a specified future time to output the periodic signal. If the future time is far from the current time, the FEC driver will use hrtimer to configure PEROUT one second before the future time. However, the hrtimer will not be canceled if the PEROUT is disabled before the hrtimer expires. So the PEROUT will be configured when the hrtimer expires, which is not as expected. Therefore, cancel the hrtimer in fec_ptp_pps_disable() to fix this issue. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit b3e528a5811bbc8246dbdb962f0812dc9b721681 Author: Jeremy Kerr Date: Tue Nov 25 14:48:54 2025 +0800 net: mctp: unconditionally set skb->dev on dst output On transmit, we are currently relying on skb->dev being set by mctp_local_output() when we first set up the skb destination fields. However, forwarded skbs do not use the local_output path, so will retain their incoming netdev as their ->dev on tx. This does not work when we're forwarding between interfaces. Set skb->dev unconditionally in the transmit path, to allow for proper forwarding. We keep the skb->dev initialisation in mctp_local_output(), as we use it for fragmentation. Fixes: 269936db5eb3 ("net: mctp: separate routing database from routing operations") Suggested-by: Vince Chang Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20251125-dev-forward-v1-1-54ecffcd0616@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc Author: ziming zhang Date: Fri Nov 14 16:56:10 2025 +0800 libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets. [ idryomov: changelog ] Cc: stable@vger.kernel.org Signed-off-by: ziming zhang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit ec3797f043756a94ea2d0f106022e14ac4946c02 Author: ziming zhang Date: Mon Nov 17 18:07:41 2025 +0800 libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ] Cc: stable@vger.kernel.org Signed-off-by: ziming zhang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 43962db4a6f593903340c85591056a0cef812dfd Author: Viacheslav Dubeyko Date: Thu Nov 13 14:36:24 2025 -0800 ceph: fix crash in process_v2_sparse_read() for encrypted directories The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msgr2 protocol in secure mode. It can be reproduced by the steps: sudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure (1) mkdir /mnt/cephfs/fscrypt-test-3 (2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3 (3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3 (4) fscrypt lock /mnt/cephfs/fscrypt-test-3 (5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3 (6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar (7) Issue has been triggered [ 408.072247] ------------[ cut here ]------------ [ 408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865 ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072267] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+ [ 408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.072310] Workqueue: ceph-msgr ceph_con_workfn [ 408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8 8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff <0f> 0b e9 06 fe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85 [ 408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246 [ 408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38 [ 408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8 [ 408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8 [ 408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000 [ 408.072329] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.072331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.072336] PKRU: 55555554 [ 408.072337] Call Trace: [ 408.072338] [ 408.072340] ? sched_clock_noinstr+0x9/0x10 [ 408.072344] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.072347] ? _raw_spin_unlock+0xe/0x40 [ 408.072349] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.072353] ? __kasan_check_write+0x14/0x30 [ 408.072357] ? mutex_lock+0x84/0xe0 [ 408.072359] ? __pfx_mutex_lock+0x10/0x10 [ 408.072361] ceph_con_workfn+0x27e/0x10e0 [ 408.072364] ? metric_delayed_work+0x311/0x2c50 [ 408.072367] process_one_work+0x611/0xe20 [ 408.072371] ? __kasan_check_write+0x14/0x30 [ 408.072373] worker_thread+0x7e3/0x1580 [ 408.072375] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.072378] ? __pfx_worker_thread+0x10/0x10 [ 408.072381] kthread+0x381/0x7a0 [ 408.072383] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.072385] ? __pfx_kthread+0x10/0x10 [ 408.072387] ? __kasan_check_write+0x14/0x30 [ 408.072389] ? recalc_sigpending+0x160/0x220 [ 408.072392] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.072394] ? calculate_sigpending+0x78/0xb0 [ 408.072395] ? __pfx_kthread+0x10/0x10 [ 408.072397] ret_from_fork+0x2b6/0x380 [ 408.072400] ? __pfx_kthread+0x10/0x10 [ 408.072402] ret_from_fork_asm+0x1a/0x30 [ 408.072406] [ 408.072407] ---[ end trace 0000000000000000 ]--- [ 408.072418] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 408.072984] KASAN: null-ptr-deref in range [0x0000000000000000- 0x0000000000000007] [ 408.073350] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Tainted: G W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 408.073886] Tainted: [W]=WARN [ 408.074042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.074468] Workqueue: ceph-msgr ceph_con_workfn [ 408.074694] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.074976] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.075884] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.076305] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.076909] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.077466] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.078034] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.078575] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.079159] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.079736] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.080039] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.080376] PKRU: 55555554 [ 408.080513] Call Trace: [ 408.080630] [ 408.080729] ceph_con_v2_try_read+0x49b9/0x72f0 [ 408.081115] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.081348] ? _raw_spin_unlock+0xe/0x40 [ 408.081538] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.081768] ? __kasan_check_write+0x14/0x30 [ 408.081986] ? mutex_lock+0x84/0xe0 [ 408.082160] ? __pfx_mutex_lock+0x10/0x10 [ 408.082343] ceph_con_workfn+0x27e/0x10e0 [ 408.082529] ? metric_delayed_work+0x311/0x2c50 [ 408.082737] process_one_work+0x611/0xe20 [ 408.082948] ? __kasan_check_write+0x14/0x30 [ 408.083156] worker_thread+0x7e3/0x1580 [ 408.083331] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.083557] ? __pfx_worker_thread+0x10/0x10 [ 408.083751] kthread+0x381/0x7a0 [ 408.083922] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.084139] ? __pfx_kthread+0x10/0x10 [ 408.084310] ? __kasan_check_write+0x14/0x30 [ 408.084510] ? recalc_sigpending+0x160/0x220 [ 408.084708] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.084917] ? calculate_sigpending+0x78/0xb0 [ 408.085138] ? __pfx_kthread+0x10/0x10 [ 408.085335] ret_from_fork+0x2b6/0x380 [ 408.085525] ? __pfx_kthread+0x10/0x10 [ 408.085720] ret_from_fork_asm+0x1a/0x30 [ 408.085922] [ 408.086036] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 408.087778] ---[ end trace 0000000000000000 ]--- [ 408.088007] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.088260] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.089118] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.089357] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.089678] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.090020] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.090360] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.090687] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.091035] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.091452] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.092015] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.092530] PKRU: 55555554 [ 417.112915] ================================================================== [ 417.113491] BUG: KASAN: slab-use-after-free in __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114014] Read of size 4 at addr ffff888124870034 by task kworker/2:0/4951 [ 417.114587] CPU: 2 UID: 0 PID: 4951 Comm: kworker/2:0 Tainted: G D W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 417.114592] Tainted: [D]=DIE, [W]=WARN [ 417.114593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 417.114596] Workqueue: events handle_timeout [ 417.114601] Call Trace: [ 417.114602] [ 417.114604] dump_stack_lvl+0x5c/0x90 [ 417.114610] print_report+0x171/0x4dc [ 417.114613] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114617] ? kasan_complete_mode_report_info+0x80/0x220 [ 417.114621] kasan_report+0xbd/0x100 [ 417.114625] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114628] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114630] __asan_report_load4_noabort+0x14/0x30 [ 417.114633] __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114635] ? queue_con_delay+0x8d/0x200 [ 417.114638] ? __pfx___mutex_lock.constprop.0+0x10/0x10 [ 417.114641] ? __send_subscribe+0x529/0xb20 [ 417.114644] __mutex_lock_slowpath+0x13/0x20 [ 417.114646] mutex_lock+0xd4/0xe0 [ 417.114649] ? __pfx_mutex_lock+0x10/0x10 [ 417.114652] ? ceph_monc_renew_subs+0x2a/0x40 [ 417.114654] ceph_con_keepalive+0x22/0x110 [ 417.114656] handle_timeout+0x6b3/0x11d0 [ 417.114659] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114662] ? __pfx_handle_timeout+0x10/0x10 [ 417.114664] ? queue_delayed_work_on+0x8e/0xa0 [ 417.114669] process_one_work+0x611/0xe20 [ 417.114672] ? __kasan_check_write+0x14/0x30 [ 417.114676] worker_thread+0x7e3/0x1580 [ 417.114678] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114682] ? __pfx_sched_setscheduler_nocheck+0x10/0x10 [ 417.114687] ? __pfx_worker_thread+0x10/0x10 [ 417.114689] kthread+0x381/0x7a0 [ 417.114692] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 417.114694] ? __pfx_kthread+0x10/0x10 [ 417.114697] ? __kasan_check_write+0x14/0x30 [ 417.114699] ? recalc_sigpending+0x160/0x220 [ 417.114703] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114705] ? calculate_sigpending+0x78/0xb0 [ 417.114707] ? __pfx_kthread+0x10/0x10 [ 417.114710] ret_from_fork+0x2b6/0x380 [ 417.114713] ? __pfx_kthread+0x10/0x10 [ 417.114715] ret_from_fork_asm+0x1a/0x30 [ 417.114720] [ 417.125171] Allocated by task 2: [ 417.125333] kasan_save_stack+0x26/0x60 [ 417.125522] kasan_save_track+0x14/0x40 [ 417.125742] kasan_save_alloc_info+0x39/0x60 [ 417.125945] __kasan_slab_alloc+0x8b/0xb0 [ 417.126133] kmem_cache_alloc_node_noprof+0x13b/0x460 [ 417.126381] copy_process+0x320/0x6250 [ 417.126595] kernel_clone+0xb7/0x840 [ 417.126792] kernel_thread+0xd6/0x120 [ 417.126995] kthreadd+0x85c/0xbe0 [ 417.127176] ret_from_fork+0x2b6/0x380 [ 417.127378] ret_from_fork_asm+0x1a/0x30 [ 417.127692] Freed by task 0: [ 417.127851] kasan_save_stack+0x26/0x60 [ 417.128057] kasan_save_track+0x14/0x40 [ 417.128267] kasan_save_free_info+0x3b/0x60 [ 417.128491] __kasan_slab_free+0x6c/0xa0 [ 417.128708] kmem_cache_free+0x182/0x550 [ 417.128906] free_task+0xeb/0x140 [ 417.129070] __put_task_struct+0x1d2/0x4f0 [ 417.129259] __put_task_struct_rcu_cb+0x15/0x20 [ 417.129480] rcu_do_batch+0x3d3/0xe70 [ 417.129681] rcu_core+0x549/0xb30 [ 417.129839] rcu_core_si+0xe/0x20 [ 417.130005] handle_softirqs+0x160/0x570 [ 417.130190] __irq_exit_rcu+0x189/0x1e0 [ 417.130369] irq_exit_rcu+0xe/0x20 [ 417.130531] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.130768] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 417.131082] Last potentially related work creation: [ 417.131305] kasan_save_stack+0x26/0x60 [ 417.131484] kasan_record_aux_stack+0xae/0xd0 [ 417.131695] __call_rcu_common+0xcd/0x14b0 [ 417.131909] call_rcu+0x31/0x50 [ 417.132071] delayed_put_task_struct+0x128/0x190 [ 417.132295] rcu_do_batch+0x3d3/0xe70 [ 417.132478] rcu_core+0x549/0xb30 [ 417.132658] rcu_core_si+0xe/0x20 [ 417.132808] handle_softirqs+0x160/0x570 [ 417.132993] __irq_exit_rcu+0x189/0x1e0 [ 417.133181] irq_exit_rcu+0xe/0x20 [ 417.133353] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.133584] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 417.133921] Second to last potentially related work creation: [ 417.134183] kasan_save_stack+0x26/0x60 [ 417.134362] kasan_record_aux_stack+0xae/0xd0 [ 417.134566] __call_rcu_common+0xcd/0x14b0 [ 417.134782] call_rcu+0x31/0x50 [ 417.134929] put_task_struct_rcu_user+0x58/0xb0 [ 417.135143] finish_task_switch.isra.0+0x5d3/0x830 [ 417.135366] __schedule+0xd30/0x5100 [ 417.135534] schedule_idle+0x5a/0x90 [ 417.135712] do_idle+0x25f/0x410 [ 417.135871] cpu_startup_entry+0x53/0x70 [ 417.136053] start_secondary+0x216/0x2c0 [ 417.136233] common_startup_64+0x13e/0x141 [ 417.136894] The buggy address belongs to the object at ffff888124870000 which belongs to the cache task_struct of size 10504 [ 417.138122] The buggy address is located 52 bytes inside of freed 10504-byte region [ffff888124870000, ffff888124872908) [ 417.139465] The buggy address belongs to the physical page: [ 417.140016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124870 [ 417.140789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 417.141519] memcg:ffff88811aa20e01 [ 417.141874] anon flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 417.142600] page_type: f5(slab) [ 417.142922] raw: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.143554] raw: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.143954] head: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.144329] head: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.144710] head: 0017ffffc0000003 ffffea0004921c01 00000000ffffffff 00000000ffffffff [ 417.145106] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 417.145485] page dumped because: kasan: bad access detected [ 417.145859] Memory state around the buggy address: [ 417.146094] ffff88812486ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146439] ffff88812486ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146791] >ffff888124870000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147145] ^ [ 417.147387] ffff888124870080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147751] ffff888124870100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.148123] ================================================================== First of all, we have warning in get_bvec_at() because cursor->total_resid contains zero value. And, finally, we have crash in ceph_msg_data_advance() because cursor->data is NULL. It means that get_bvec_at() receives not initialized ceph_msg_data_cursor structure because data is NULL and total_resid contains zero. Moreover, we don't have likewise issue for the case of Ceph msgr1 protocol because ceph_msg_data_cursor_init() has been called before reading sparse data. This patch adds calling of ceph_msg_data_cursor_init() in the beginning of process_v2_sparse_read() with the goal to guarantee that logic of reading sparse data works correctly for the case of Ceph msgr2 protocol. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/73152 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 765e56e41a5af2d456ddda6cbd617b9d3295ab4e Merge: 4941a17751c99e 3184b6a5a24ec9 Author: Linus Torvalds Date: Wed Nov 26 20:22:20 2025 -0800 Merge tag 'v6.18rc7-SMB-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: "smb client multiuser (with cifscreds) mount fix" * tag 'v6.18rc7-SMB-client-fix' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix memory leak in cifs_construct_tcon() commit 8ec205e8797046b79d02a6359ebd57091b594cd8 Merge: 5ffcb7b890f615 0c922106d7a58d Author: Jakub Kicinski Date: Wed Nov 26 19:56:00 2025 -0800 Merge tag 'linux-can-fixes-for-6.18-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-11-26 this is a pull request of 8 patches for net/main. Seungjin Bae provides a patch for the kvaser_usb driver to fix a potential infinite loop in the USB data stream command parser. Thomas Mühlbacher's patch for the sja1000 driver IRQ handler's max loop handling, that might lead to unhandled interrupts. 3 patches by me for the gs_usb driver fix handling of failed transmit URBs and add checking of the actual length of received URBs before accessing the data. The next patch is by me and is a port of Thomas Mühlbacher's patch (fix IRQ handler's max loop handling, that might lead to unhandled interrupts.) to the sun4i_can driver. Biju Das provides a patch for the rcar_canfd driver to fix the CAN-FD mode setting. The last patch is by Shaurya Rane for the em_canid filter to ensure that the complete CAN frame is present in the linear data buffer before accessing it. * tag 'linux-can-fixes-for-6.18-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: net/sched: em_canid: fix uninit-value in em_canid_match can: rcar_canfd: Fix CAN-FD mode as default can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs can: sja1000: fix max irq loop handling can: kvaser_usb: leaf: Fix potential infinite loop in command parsers ==================== Link: https://patch.msgid.link/20251126155713.217105-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 5ffcb7b890f61541201461580bb6622ace405aec Author: Jiefeng Zhang Date: Wed Nov 26 11:22:49 2025 +0800 net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS") Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. Signed-off-by: Jiefeng Zhang Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com Signed-off-by: Jakub Kicinski commit 384c1a4e2722b43f26b55cc041562ff8b229b536 Author: Jon Kohler Date: Tue Nov 25 18:57:48 2025 -0700 MAINTAINERS: separate VIRTIO NET DRIVER and add netdev Changes to virtio network stack should be cc'd to netdev DL, separate it into its own group to add netdev in addition to virtualization DL. Signed-off-by: Jon Kohler Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251126015750.2200267-1-jon@nutanix.com Signed-off-by: Jakub Kicinski commit 1cd1c472343b06d6d32038636ce51bfa2251e3cf Author: Jon Kohler Date: Tue Nov 25 15:27:53 2025 -0700 virtio-net: avoid unnecessary checksum calculation on guest RX Commit a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") inadvertently altered checksum offload behavior for guests not using UDP GSO tunneling. Before, tun_put_user called tun_vnet_hdr_from_skb, which passed has_data_valid = true to virtio_net_hdr_from_skb. After, tun_put_user began calling tun_vnet_hdr_tnl_from_skb instead, which passes has_data_valid = false into both call sites. This caused virtio hdr flags to not include VIRTIO_NET_HDR_F_DATA_VALID for SKBs where skb->ip_summed == CHECKSUM_UNNECESSARY. As a result, guests are forced to recalculate checksums unnecessarily. Restore the previous behavior by ensuring has_data_valid = true is passed in the !tnl_gso_type case, but only from tun side, as virtio_net_hdr_tnl_from_skb() is used also by the virtio_net driver, which in turn must not use VIRTIO_NET_HDR_F_DATA_VALID on tx. cc: stable@vger.kernel.org Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") Signed-off-by: Jon Kohler Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/20251125222754.1737443-1-jon@nutanix.com Signed-off-by: Jakub Kicinski commit 6d66e093e0740d39a36ef742c60eec247df26f41 Author: Mohsin Bashir Date: Tue Nov 25 13:17:04 2025 -0800 eth: fbnic: Fix counter roll-over issue Fix a potential counter roll-over issue in fbnic_mbx_alloc_rx_msgs() when calculating descriptor slots. The issue occurs when head - tail results in a large positive value (unsigned) and the compiler interprets head - tail - 1 as a signed value. Since FBNIC_IPC_MBX_DESC_LEN is a power of two, use a masking operation, which is a common way of avoiding this problem when dealing with these sort of ring space calculations. Fixes: da3cde08209e ("eth: fbnic: Add FW communication mechanism") Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20251125211704.3222413-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 27fd02860164bfa78cec2640dfad630d832e302c Author: Paolo Abeni Date: Tue Nov 25 17:59:11 2025 +0100 mptcp: clear scheduled subflows on retransmit When __mptcp_retrans() kicks-in, it schedules one or more subflows for retransmission, but such subflows could be actually left alone if there is no more data to retransmit and/or in case of concurrent fallback. Scheduled subflows could be processed much later in time, i.e. when new data will be transmitted, leading to bad subflow selection. Explicitly clear all scheduled subflows before leaving the retransmission function. Fixes: ee2708aedad0 ("mptcp: use get_retrans wrapper") Cc: stable@vger.kernel.org Reported-by: Filip Pokryvka Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251125-net-mptcp-clear-sched-rtx-v1-1-1cea4ad2165f@kernel.org Signed-off-by: Jakub Kicinski commit da62abaaa268357b1aa66b372ace562189a05df1 Author: Vladimir Oltean Date: Sat Nov 22 13:13:24 2025 +0200 net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic When using the SGMII PCS as a fixed-link chip-to-chip connection, it is easy to miss the fact that traffic passes only at 1G, since that's what any normal such connection would use. When using the SGMII PCS connected towards an on-board PHY or an SFP module, it is immediately noticeable that when the link resolves to a speed other than 1G, traffic from the MAC fails to pass: TX counters increase, but nothing gets decoded by the other end, and no local RX counters increase either. Artificially lowering a fixed-link rate to speed = <100> makes us able to see the same issue as in the case of having an SGMII PHY. Some debugging shows that the XPCS configuration is A-OK, but that the MAC Configuration Table entry for the port has the SPEED bits still set to 1000Mbps, due to a special condition in the driver. Deleting that condition, and letting the resolved link speed be programmed directly into the MAC speed field, results in a functional link at all 3 speeds. This piece of evidence, based on testing on both generations with SGMII support (SJA1105S and SJA1110A) directly contradicts the statement from the blamed commit that "the MAC is fixed at 1 Gbps and we need to configure the PCS only (if even that)". Worse, that statement is not backed by any documentation, and no one from NXP knows what it might refer to. I am unable to recall sufficient context regarding my testing from March 2020 to understand what led me to draw such a braindead and factually incorrect conclusion. Yet, there is nothing of value regarding forcing the MAC speed, either for SGMII or 2500Base-X (introduced at a later stage), so remove all such logic. Fixes: ffe10e679cec ("net: dsa: sja1105: Add support for the SGMII port") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251122111324.136761-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b9ba6338bc6e0e97dee30fa705f40950ed556729 Author: Alexandra Winter Date: Tue Nov 25 09:58:29 2025 +0100 s390/net: list Aswin Karuvally as maintainer Thank you Aswin for taking this responsibility. Signed-off-by: Alexandra Winter Acked-by: Aswin Karuvally Link: https://patch.msgid.link/20251125085829.3679506-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 4fcb8ab4a09b1855dbfd7062605dd13abd64c086 Author: Slark Xiao Date: Tue Nov 25 15:09:00 2025 +0800 net: wwan: mhi: Keep modem name match with Foxconn T99W640 Correct it since M.2 device T99W640 has updated from T99W515. We need to align it with MHI side otherwise this modem can't get the network. Fixes: ae5a34264354 ("bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640") Signed-off-by: Slark Xiao Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20251125070900.33324-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 779bcdd4b9ae6566f309043c53c946e8ac0015fd Author: Jason Wang Date: Thu Nov 20 10:29:50 2025 +0800 vhost: rewind next_avail_head while discarding descriptors When discarding descriptors with IN_ORDER, we should rewind next_avail_head otherwise it would run out of sync with last_avail_idx. This would cause driver to report "id X is not a head". Fixing this by returning the number of descriptors that is used for each buffer via vhost_get_vq_desc_n() so caller can use the value while discarding descriptors. Fixes: 67a873df0c41 ("vhost: basic in order support") Cc: stable@vger.kernel.org Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251120022950.10117-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 85f5491d9c6e9662653c8e6e7b70637b98537ecc Author: Ilya Dryomov Date: Mon Nov 3 21:34:01 2025 +0100 libceph: drop started parameter of __ceph_open_session() With the previous commit revamping the timeout handling, started isn't used anymore. It could be taken into account by adjusting the initial value of the timeout, but there is little point as both callers capture the timestamp shortly before calling __ceph_open_session() -- the only thing of note that happens in the interim is taking client->mount_mutex and that isn't expected to take multiple seconds. Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit 076381c261374c587700b3accf410bdd2dba334e Author: Ilya Dryomov Date: Mon Nov 3 21:34:01 2025 +0100 libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. Cc: stable@vger.kernel.org Reported-by: David Howells Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit 4941a17751c99e17422be743c02c923ad706f888 Merge: 9eb220edddb20a b042fdf18e89a3 Author: Linus Torvalds Date: Wed Nov 26 13:16:22 2025 -0800 Merge tag 'trace-ringbuffer-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer fix from Steven Rostedt: - Do not allow mmapped ring buffer to be split When the ring buffer VMA is split by a partial munmap or a MAP_FIXED, the kernel calls vm_ops->close() on each portion. This causes the ring_buffer_unmap() to be called multiple times. This causes subsequent calls to return -ENODEV and triggers a warning. There's no reason to allow user space to split up memory mapping of the ring buffer. Have it return -EINVAL when that happens. * tag 'trace-ringbuffer-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs commit d0d08f4bd7f667dc7a65cd7133c0a94a6f02aca3 Author: Pranjal Shrivastava Date: Wed Nov 26 11:41:12 2025 +0000 dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers"), P2P segments were mapped using the pci_p2pdma_map_segment() helper. This helper was responsible for populating sg->dma_address, marking the bus address, and also setting sg_dma_len(sg). The refactor[1] removed this helper and moved the mapping logic directly into the callers. While iommu_dma_map_sg() was correctly updated to set the length in the new flow, it was missed in dma_direct_map_sg(). Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the dma_address and marks the segment, but immediately executes 'continue', which causes the loop to skip the standard assignment logic at the end: sg_dma_len(sg) = sg->length; As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length field remains uninitialized (zero) for P2P bus address mappings. This breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len() to determine the transfer size. Fix this by explicitly setting the DMA length in the PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist entry. Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers") Reported-by: Jacob Moroni Signed-off-by: Pranjal Shrivastava [1] https://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/ Reviewed-by: Logan Gunthorpe Reviewed-by: Leon Romanovsky Reviewed-by: Shivaji Kant Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251126114112.3694469-1-praan@google.com commit 9eb220edddb20a019d1630347555bc4ae1514e61 Merge: ad8cccc2488765 7c9580f44f90f7 Author: Linus Torvalds Date: Wed Nov 26 12:38:05 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-26-11-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "8 hotfixes. 4 are cc:stable, 7 are against mm/. All are singletons - please see the respective changelogs for details" * tag 'mm-hotfixes-stable-2025-11-26-11-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/filemap: fix logic around SIGBUS in filemap_map_pages() mm/huge_memory: fix NULL pointer deference when splitting folio MAINTAINERS: add test_kho to KHO's entry mailmap: add entry for Sam Protsenko selftests/mm: fix division-by-zero in uffd-unit-tests mm/mmap_lock: reset maple state on lock_vma_under_rcu() retry mm/memfd: fix information leak in hugetlb folios mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type() commit ad8cccc24887655ebf0a3f459d38d1fb683df46a Author: Linus Torvalds Date: Wed Nov 26 12:31:48 2025 -0800 Fix Intel Dollar Cove TI battery driver 32-bit build error The driver is doing a 64-bit divide, rather than using the proper helpers, causing link errors on i386 allyesconfig builds: x86_64-linux-ld: drivers/power/supply/intel_dc_ti_battery.o: in function `dc_ti_battery_get_voltage_and_current_now': intel_dc_ti_battery.c:(.text+0x5c): undefined reference to `__udivdi3' x86_64-linux-ld: intel_dc_ti_battery.c:(.text+0x96): undefined reference to `__udivdi3' and while fixing that, fix the double rounding: keep the timing difference in nanoseconds ('ktime'), and then just convert to usecs at the end. Not because the timing precision is likely to matter, but because doing it right also makes the code simpler. Reported-by: Guenter Roeck Cc: Hans de Goede Cc: Sebastian Reichel Signed-off-by: Linus Torvalds commit 32115734c0ed8b463d1020e8da47968735f882c0 Author: Linus Torvalds Date: Wed Nov 26 12:11:28 2025 -0800 Increase the default 32-bit build frame size warning limit to 1280 bytes That was already the limit with KASAN enabled, and the 32-bit x86 build ends up having a couple of drm cases that have stack frames _just_ over 1kB on my allmodconfig test. So the minimal fix for this build issue for now is to just bump the limit and make it independent of KASAN. [ Side note: XTENSA already used 1.5k and PARISC uses 2k, so 1280 is still relatively conservative ] Signed-off-by: Linus Torvalds commit 430c89fe3a523fe24faaad25ccc76cc9ff8034d6 Merge: a10d15a08f62bf d041e5e748f926 Author: Linus Torvalds Date: Wed Nov 26 10:33:32 2025 -0800 Merge tag 'sound-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are device-specific and trivial, mostly HD-audio and USB-audio quirks and fixups" * tag 'sound-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 ALSA: usb-audio: fix uac2 clock source at terminal parser ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 ALSA: au88x0: Fix incorrect error handling for PCI config reads commit a10d15a08f62bf97c707ef3c2a7493604c1bcc89 Merge: 30f09200cc4aef 43ff36c4a5a574 Author: Linus Torvalds Date: Wed Nov 26 10:17:10 2025 -0800 Merge tag 'acpi-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a commit that attempted to make the code in the ACPI processor driver more straightforward, but it turned out to cause the kernel to crash on at least one system, along with some further cleanups on top of it" * tag 'acpi-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: processor: idle: Optimize ACPI idle driver registration" Revert "ACPI: processor: Remove unused empty stubs of some functions" Revert "ACPI: processor: idle: Rearrange declarations in header file" Revert "ACPI: processor: idle: Redefine two functions as void" Revert "ACPI: processor: Do not expose global variable acpi_idle_driver" commit 7fa666ab07ba9e08f52f357cb8e1aad753e83ac6 Author: Alex Deucher Date: Wed Nov 26 09:40:31 2025 -0500 drm/amdgpu: fix cyan_skillfish2 gpu info fw handling If the board supports IP discovery, we don't need to parse the gpu info firmware. Backport to 6.18. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4721 Fixes: fa819e3a7c1e ("drm/amdgpu: add support for cyan skillfish gpu_info") Signed-off-by: Alex Deucher (cherry picked from commit 5427e32fa3a0ba9a016db83877851ed277b065fb) commit b4a7f4e7ad2b120a94f3111f92a11520052c762d Author: Prike Liang Date: Fri Oct 31 17:02:51 2025 +0800 drm/amdgpu: attach tlb fence to the PTs update Ensure the userq TLB flush is emitted only after the VM update finishes and the PT BOs have been annotated with bookkeeping fences. Suggested-by: Christian König Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit f3854e04b708d73276c4488231a8bd66d30b4671) Cc: stable@vger.kernel.org commit 8ea902361734c87b82122f9c17830f168ebfc65a Author: Mario Limonciello (AMD) Date: Wed Nov 5 23:04:54 2025 -0600 drm/amd/display: Increase EDID read retries [WHY] When monitor is still booting EDID read can fail while DPCD read is successful. In this case no EDID data will be returned, and this could happen for a while. [HOW] Increase number of attempts to read EDID in dm_helpers_read_local_edid() to 25. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit a76d6f2c76c3abac519ba753e2723e6ffe8e461c) Cc: stable@vger.kernel.org commit 81f4d4ba509522596143fd5d7dc2fc3495296b0a Author: Mario Limonciello (AMD) Date: Mon Nov 3 16:02:11 2025 -0600 drm/amd/display: Don't change brightness for disabled connectors [WHY] When a laptop lid is closed the connector is disabled but userspace can still try to change brightness. This doesn't work because the panel is turned off. It will eventually time out, but there is a lot of stutter along the way. [How] Iterate all connectors to check whether the matching one for the backlight index is enabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4675 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Ray Wu Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit f6eeab30323d1174a4cc022e769d248fe8241304) Cc: stable@vger.kernel.org commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 Author: Alex Hung Date: Fri Nov 7 15:35:58 2025 -0700 drm/amd/display: Check NULL before accessing [WHAT] IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic fails with NULL pointer dereference. This can be reproduced with both an eDP panel and a DP monitors connected. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted 6.16.0-99-custom #8 PREEMPT(voluntary) Hardware name: AMD ........ RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu] Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30 c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02 RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668 RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000 RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760 R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000 R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu] amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu] ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu] amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu] drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400 drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30 drm_crtc_get_last_vbltimestamp+0x55/0x90 drm_crtc_next_vblank_start+0x45/0xa0 drm_atomic_helper_wait_for_fences+0x81/0x1f0 ... Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c) Cc: stable@vger.kernel.org commit 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d Author: Alex Deucher Date: Tue Nov 25 09:08:45 2025 -0500 Revert "drm/amd/display: Move setup_stream_attribute" This reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414. This results in a blank screen on the HDMI port on some systems. Revert for now so as not to regress 6.18, can be addressed in 6.19 once the issue is root caused. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4652 Cc: Sunpeng.Li@amd.com Cc: ivan.lipski@amd.com Signed-off-by: Alex Deucher (cherry picked from commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb) commit 0c922106d7a58d106c6a5c52a741ae101cfaf088 Author: Shaurya Rane Date: Wed Nov 26 14:27:18 2025 +0530 net/sched: em_canid: fix uninit-value in em_canid_match Use pskb_may_pull() to ensure a complete CAN frame is present in the linear data buffer before reading the CAN ID. A simple skb->len check is insufficient because it only verifies the total data length but does not guarantee the data is present in skb->data (it could be in fragments). pskb_may_pull() both validates the length and pulls fragmented data into the linear buffer if necessary, making it safe to directly access skb->data. Reported-by: syzbot+5d8269a1e099279152bc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5d8269a1e099279152bc Fixes: f057bbb6f9ed ("net: em_canid: Ematch rule to match CAN frames according to their identifiers") Signed-off-by: Shaurya Rane Link: https://patch.msgid.link/20251126085718.50808-1-ssranevjti@gmail.com Signed-off-by: Marc Kleine-Budde commit 6d849ff573722afcf5508d2800017bdd40f27eb9 Author: Biju Das Date: Tue Nov 18 12:39:25 2025 +0000 can: rcar_canfd: Fix CAN-FD mode as default The commit 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting") has aligned with the flow mentioned in the hardware manual for all SoCs except R-Car Gen3 and RZ/G2L SoCs. On R-Car Gen4 and RZ/G3E SoCs, due to the wrong logic in the commit[1] sets the default mode to FD-Only mode instead of CAN-FD mode. This patch sets the CAN-FD mode as the default for all SoCs by dropping the rcar_canfd_set_mode() as some SoC requires mode setting in global reset mode, and the rest of the SoCs in channel reset mode and update the rcar_canfd_reset_controller() to take care of these constraints. Moreover, the RZ/G3E and R-Car Gen4 SoCs support 3 modes compared to 2 modes on the R-Car Gen3. Use inverted logic in rcar_canfd_reset_controller() to simplify the code later to support FD-only mode. [1] commit 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC") Fixes: 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting") Cc: stable@vger.kernel.org Signed-off-by: Biju Das Link: https://patch.msgid.link/20251118123926.193445-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 3dcf44ab56e1d3ca3532083c0d5390b758e45b45 Author: Francesco Lavra Date: Wed Nov 26 10:50:27 2025 +0100 spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA This driver runs also on Tegra SoCs without a Tegra20 APB DMA controller (e.g. Tegra234). Remove the Kconfig dependency on TEGRA20_APB_DMA; in addition, amend the help text to reflect the fact that this driver works on SoCs different from Tegra114. Fixes: bb9667d8187b ("arm64: tegra: Add SPI device tree nodes for Tegra234") Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20251126095027.4102004-1-flavra@baylibre.com Signed-off-by: Mark Brown commit 2bf95a9bcb50002ca9d47403d60aedaeb2e19abe Author: Ilpo Järvinen Date: Mon Nov 10 12:50:43 2025 +0200 serial: 8250: Fix 8250_rsa symbol loop Depmod fails for a kernel made with: make allnoconfig echo -e "CONFIG_MODULES=y\nCONFIG_SERIAL_8250=m\nCONFIG_SERIAL_8250_EXTENDED=y\nCONFIG_SERIAL_8250_RSA=y" >> .config make olddefconfig ...due to a dependency loop: depmod: ERROR: Cycle detected: 8250 -> 8250_base -> 8250 depmod: ERROR: Found 2 modules in dependency cycles! This is caused by the move of 8250 RSA code from 8250_port.c (in 8250_base.ko) into 8250_rsa.c (in 8250.ko) by the commit 5a128fb475fb ("serial: 8250: move RSA functions to 8250_rsa.c"). The commit b20d6576cdb3 ("serial: 8250: export RSA functions") tried to fix a missing symbol issue with EXPORTs but those then cause this dependency cycle. Break dependency loop by moving 8250_rsa.o from 8250.ko to 8250_base.ko and by passing univ8250_port_base_ops to univ8250_rsa_support() that can make a local copy of it. Reported-by: Stephen Rothwell Reported-by: Alex Davis Fixes: 5a128fb475fb ("serial: 8250: move RSA functions to 8250_rsa.c") Fixes: b20d6576cdb3 ("serial: 8250: export RSA functions") Cc: stable Link: https://lore.kernel.org/all/87frc3sd8d.fsf@posteo.net/ Link: https://lore.kernel.org/all/CADiockCvM6v+d+UoFZpJSMoLAdpy99_h-hJdzUsdfaWGn3W7-g@mail.gmail.com/ Reviewed-by: Andy Shevchenko Reviewed-by: Jiri Slaby Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20251110105043.4062-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d041e5e748f926398ad96436a86667dea8b591e0 Author: Ilyas Gasanov Date: Wed Nov 26 03:54:41 2025 +0400 ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 My laptop, HP ProBook 450 G8 (32M40EA), has Realtek ALC236 codec on its integrated sound card, and uses GPIO pins 0x2 and 0x1 for speaker mute and mic mute LEDs correspondingly, as found out by me through hda-verb invocations. This matches the GPIO masks used by the alc236_fixup_hp_gpio_led() function. PCI subsystem vendor and device IDs happen to be 0x103c and 0x8a75, which has not been covered in the ALC2xx driver code yet. Signed-off-by: Ilyas Gasanov Link: https://patch.msgid.link/20251125235441.53629-1-public@gsnoff.com Signed-off-by: Takashi Iwai commit 0ebc27a4c67d44e5ce88d21cdad8201862b78837 Author: Fernando Fernandez Mancera Date: Mon Nov 24 18:14:09 2025 +0100 xsk: avoid data corruption on cq descriptor number Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_submit_addr_locked() relies on it to put the umem addrs onto pool's completion queue. skb control block shouldn't be used for this purpose as after transmit xsk doesn't have control over it and other subsystems could use it. This leads to the following kernel panic due to a NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy) Debian 6.16.12-1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:xsk_destruct_skb+0xd0/0x180 [...] Call Trace: ? napi_complete_done+0x7a/0x1a0 ip_rcv_core+0x1bb/0x340 ip_rcv+0x30/0x1f0 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x87/0x130 __napi_poll+0x28/0x180 net_rx_action+0x339/0x420 handle_softirqs+0xdc/0x320 ? handle_edge_irq+0x90/0x1e0 do_softirq.part.0+0x3b/0x60 __local_bh_enable_ip+0x60/0x70 __dev_direct_xmit+0x14e/0x1f0 __xsk_generic_xmit+0x482/0xb70 ? __remove_hrtimer+0x41/0xa0 ? __xsk_generic_xmit+0x51/0xb70 ? _raw_spin_unlock_irqrestore+0xe/0x40 xsk_sendmsg+0xda/0x1c0 __sys_sendto+0x1ee/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x84/0x2f0 ? __pfx_pollwake+0x10/0x10 ? __rseq_handle_notify_resume+0xad/0x4c0 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Instead use the skb destructor_arg pointer along with pointer tagging. As pointers are always aligned to 8B, use the bottom bit to indicate whether this a single address or an allocated struct containing several addresses. Fixes: 30f241fcf52a ("xsk: Fix immature cq descriptor production") Closes: https://lore.kernel.org/netdev/0435b904-f44f-48f8-afb0-68868474bf1c@nop.hu/ Suggested-by: Jakub Kicinski Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Maciej Fijalkowski Reviewed-by: Jason Xing Link: https://patch.msgid.link/20251124171409.3845-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit ae1737e7339b513f8c2fc21b500a0fc215d155c3 Author: Heiner Kallweit Date: Sat Nov 22 15:23:02 2025 +0100 r8169: fix RTL8127 hang on suspend/shutdown There have been reports that RTL8127 hangs on suspend and shutdown, partially disappearing from lspci until power-cycling. According to Realtek disabling PLL's when switching to D3 should be avoided on that chip version. Fix this by aligning disabling PLL's with the vendor drivers, what in addition results in PLL's not being disabled when switching to D3hot on other chip versions. Fixes: f24f7b2f3af9 ("r8169: add support for RTL8127A") Tested-by: Fabio Baltieri Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/d7faae7e-66bc-404a-a432-3a496600575f@gmail.com Signed-off-by: Jakub Kicinski commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 Author: Alexey Kodanev Date: Fri Nov 21 12:38:34 2025 +0000 net: sxgbe: fix potential NULL dereference in sxgbe_rx() Currently, when skb is null, the driver prints an error and then dereferences skb on the next line. To fix this, let's add a 'break' after the error message to switch to sxgbe_rx_refill(), which is similar to the approach taken by the other drivers in this particular case, e.g. calxeda with xgmac_rx(). Found during a code review. Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver") Signed-off-by: Alexey Kodanev Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com Signed-off-by: Jakub Kicinski commit 0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef Author: Nikola Z. Ivanov Date: Sat Nov 22 02:20:27 2025 +0200 team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev This is done by adding a conditional before the call to dev_set_mtu to prevent it from assigning port_dev->mtu = dev->mtu and instead letting team_dev_type_check_change assign dev->mtu = port_dev->mtu. The conditional is needed because the patch moves the call to team_dev_type_check_change past dev_set_mtu. Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a2a3b519de727b0f7903 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Nikola Z. Ivanov Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251122002027.695151-1-zlatistiv@gmail.com Signed-off-by: Jakub Kicinski commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 Author: Danielle Costantino Date: Mon Nov 24 10:00:43 2025 -0800 net/mlx5e: Fix validation logic in rate limiting The rate limiting validation condition currently checks the output variable max_bw_value[i] instead of the input value maxrate->tc_maxrate[i]. This causes the validation to compare an uninitialized or stale value rather than the actual requested rate. The condition should check the input rate to properly validate against the upper limit: } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { This aligns with the pattern used in the first branch, which correctly checks maxrate->tc_maxrate[i] against upper_limit_mbps. The current implementation can lead to unreliable validation behavior: - For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0 from initialization, the GBPS path may be taken regardless of whether the actual rate is within bounds - When processing multiple TCs (i > 0), max_bw_value[i] contains the value computed for the previous TC, affecting the validation logic - The overflow check for rates exceeding 255 Gbps may not trigger consistently depending on previous array values This patch ensures the validation correctly examines the requested rate value for proper bounds checking. Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps") Signed-off-by: Danielle Costantino Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com Signed-off-by: Jakub Kicinski commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 Author: Paulo Alcantara Date: Mon Nov 24 17:00:36 2025 -0300 smb: client: fix memory leak in cifs_construct_tcon() When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so it needs to be freed before leaving cifs_construct_tcon(). This fixes the following memory leak reported by kmemleak: mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,... su - testuser cifscreds add -d ZELDA -u testuser ... ls /mnt/1 ... umount /mnt echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak unreferenced object 0xffff8881203c3f08 (size 8): comm "ls", pid 5060, jiffies 4307222943 hex dump (first 8 bytes): 5a 45 4c 44 41 00 cc cc ZELDA... backtrace (crc d109a8cf): __kmalloc_node_track_caller_noprof+0x572/0x710 kstrdup+0x3a/0x70 cifs_sb_tlink+0x1209/0x1770 [cifs] cifs_get_fattr+0xe1/0xf50 [cifs] cifs_get_inode_info+0xb5/0x240 [cifs] cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs] cifs_getattr+0x28e/0x450 [cifs] vfs_getattr_nosec+0x126/0x180 vfs_statx+0xf6/0x220 do_statx+0xab/0x110 __x64_sys_statx+0xd5/0x130 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: f2aee329a68f ("cifs: set domainName when a domain-key is used in multiuser") Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Jay Shin Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit b042fdf18e89a347177a49e795d8e5184778b5b6 Author: Deepanshu Kartikey Date: Wed Nov 19 12:10:19 2025 +0530 tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once. This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON. Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page. Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely. Cc: stable@vger.kernel.org Fixes: cf9f0f7c4c5bb ("tracing: Allow user-space mapping of the ring-buffer") Link: https://patch.msgid.link/20251119064019.25904-1-kartikey406@gmail.com Closes: https://syzkaller.appspot.com/bug?extid=a72c325b042aae6403c7 Tested-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com Reported-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Signed-off-by: Steven Rostedt (Google) commit 7276878b069c57d9a9cca5db01d2f7a427b73456 Author: Harish Chegondi Date: Mon Nov 17 11:48:43 2025 -0800 drm/xe: Fix conversion from clock ticks to milliseconds When tick counts are large and multiplication by MSEC_PER_SEC is larger than 64 bits, the conversion from clock ticks to milliseconds can go bad. Use mul_u64_u32_div() instead. Cc: Ashutosh Dixit Signed-off-by: Harish Chegondi Suggested-by: Umesh Nerlige Ramappa Fixes: 49cc215aad7f ("drm/xe: Add xe_gt_clock_interval_to_ms helper") Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/1562f1b62d5be3fbaee100f09107f3cc49e40dd1.1763408584.git.harish.chegondi@intel.com (cherry picked from commit 96b93ac214f9dd66294d975d86c5dee256faef91) Signed-off-by: Lucas De Marchi commit 0e234632e39bd21dd28ffc9ba3ae8eec4deb949c Author: Lucas De Marchi Date: Tue Nov 18 11:08:11 2025 -0800 drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is enabled to fix the following call stack: [] BUG: kernel NULL pointer dereference, address: 0000000000000000 [] Workqueue: drm_sched_run_job_work [gpu_sched] [] RIP: 0010:stack_depot_save_flags+0x172/0x870 [] Call Trace: [] [] fast_req_track+0x58/0xb0 [xe] Fixes: 16b7e65d299d ("drm/xe/guc: Track FAST_REQ H2Gs to report where errors came from") Tested-by: Sagar Ghuge Cc: stable@vger.kernel.org # v6.17+ Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20251118-fix-debug-guc-v1-1-9f780c6bedf8@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f) Signed-off-by: Lucas De Marchi commit 76555b1eb278da420b6e4d26714319a7a4460e7b Author: Shuicheng Lin Date: Mon Nov 10 18:45:23 2025 +0000 drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc() xe_guc_ct_init_noalloc() allocates the CT workqueue and other helpers before it tries to initialize ct->lock. If drmm_mutex_init() fails we currently bail out without releasing those resources because the guc_ct_fini() hasn’t been registered yet. Since destroy_workqueue() in guc_ct_fini() may flush the workqueue, which in turn can take the ct lock, the initialization sequence is restructured to first initialize the ct->lock, then set up all CT state, and finally register guc_ct_fini(). v2: guc_ct_fini() does take ct lock. (Matt) v3: move primelockdep() together with drmm_mutex_init(). (Lucas) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Lucas De Marchi Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251110184522.1581001-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 2e4ad5b0667244f496783c58de0995b9562d3344) Signed-off-by: Lucas De Marchi commit c7418164b463056bf4327b6a2abe638b78250f13 Author: Dan Carpenter Date: Tue Nov 25 16:55:19 2025 +0300 timekeeping: Fix error code in tk_aux_sysfs_init() If kobject_create_and_add() fails on the first iteration, then the error code is set to -ENOMEM which is correct. But if it fails in subsequent iterations then "ret" is zero, which means success, but it should be -ENOMEM. Set the error code to -ENOMEM correctly. Fixes: 7b5ab04f035f ("timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Malaya Kumar Rout Link: https://patch.msgid.link/aSW1R8q5zoY_DgQE@stanley.mountain commit 30f09200cc4aefbd8385b01e41bde2e4565a6f0e Merge: 5f8a6c70afc58d 165eb13e485c5c Author: Linus Torvalds Date: Tue Nov 25 08:36:03 2025 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "We've got a revert due to one of the recent CCA commits breaking ACPI firmware-based error reporting, a fix for a hard-lockup introduced by a prior fix affecting non-default (CONFIG_EXPERT) configurations and another ACPI fix for systems using MMIO-based timers. Other than that, we're looking pretty good. - Avoid hardlockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=n - Fix regression in APEI/GHES error handling - Fix MMIO timers when probed via ACPI" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY ACPI: GTDT: Correctly number platform devices for MMIO timers Revert "arm64: acpi: Enable ACPI CCEL support" commit 5f8a6c70afc58d4be849407658f27f47f006a3c7 Merge: 8a2bcda5e13906 b07bf253ef8e48 Author: Linus Torvalds Date: Tue Nov 25 08:31:28 2025 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Two build fixes, no functional change: - Fix a possible compiler error around counted_by() due to wrong initialization order - Fix a -Wflex-array-member-not-at-end" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning iommufd/driver: Fix counter initialization for counted_by annotation commit 43ff36c4a5a574ee83b4b0d3f3d74f09a3a8c2d3 Author: Rafael J. Wysocki Date: Tue Nov 25 15:06:12 2025 +0100 Revert "ACPI: processor: idle: Optimize ACPI idle driver registration" Revert commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") because it is reported to introduce a cpuidle regression leading to a kernel crash on a platform using the ACPI idle driver. Signed-off-by: Rafael J. Wysocki Reported-by: Borislav Petkov Tested-by: Borislav Petkov (AMD) Closes: https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/ commit d26e9f669cc0a6a85cf17180c09a6686db9f4002 Author: René Rebe Date: Tue Nov 25 15:41:49 2025 +0100 ALSA: usb-audio: fix uac2 clock source at terminal parser Since 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values") usb-audio is using UAC3_CLOCK_SOURCE instead of bDescriptorSubtype, later refactored with e0ccdef9265 ("ALSA: usb-audio: Clean up check_input_term()") into parse_term_uac2_clock_source(). This breaks the clock source selection for at least my 1397:0003 BEHRINGER International GmbH FCA610 Pro. Fix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source(). Fixes: 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values") Signed-off-by: René Rebe Link: https://patch.msgid.link/20251125.154149.1121389544970412061.rene@exactco.de Signed-off-by: Takashi Iwai commit 9780f535f8e0f20b4632b5a173ead71aa8f095d2 Author: Horatiu Vultur Date: Fri Nov 21 07:14:11 2025 +0100 net: lan966x: Fix the initialization of taprio To initialize the taprio block in lan966x, it is required to configure the register REVISIT_DLY. The purpose of this register is to set the delay before revisit the next gate and the value of this register depends on the system clock. The problem is that the we calculated wrong the value of the system clock period in picoseconds. The actual system clock is ~165.617754MHZ and this correspond to a period of 6038 pico seconds and not 15125 as currently set. Fixes: e462b2717380b4 ("net: lan966x: Add offload support for taprio") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251121061411.810571-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 1a8b3501821b608383f7c7aa0f24e2006681e2b5 Author: Rafael J. Wysocki Date: Tue Nov 25 15:05:01 2025 +0100 Revert "ACPI: processor: Remove unused empty stubs of some functions" Revert commit 5020d05b3476 ("ACPI: processor: Remove unused empty stubs of some functions") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit f6dc5a36195d3f5be769f60d6987150192dfb099 Author: Pavel Begunkov Date: Tue Nov 25 12:33:06 2025 +0000 io_uring: fix mixed cqe overflow handling I started to see zcrx data corruptions. That turned out to be due to CQ tail pointing to a stale entry which happened to be from a zcrx request. I.e. the tail is incremented without the CQE memory being changed. The culprit is __io_cqring_overflow_flush() passing "cqe32=true" to io_get_cqe_overflow() for non-mixed CQE32 setups, which only expects it to be set for mixed 32B CQEs and not for SETUP_CQE32. The fix is slightly hacky, long term it's better to unify mixed and CQE32 handling. Fixes: e26dca67fde19 ("io_uring: add support for IORING_SETUP_CQE_MIXED") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e6889323c2184c700428dd4b90a1c2c06b8ae51f Author: Rafael J. Wysocki Date: Tue Nov 25 15:03:24 2025 +0100 Revert "ACPI: processor: idle: Rearrange declarations in header file" Revert commit bdf780fbcef5 ("ACPI: processor: idle: Rearrange declarations in header file") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 66e600a26ee7d845d9434c3d60cef4bbf7dd3eb4 Author: Rafael J. Wysocki Date: Tue Nov 25 14:53:33 2025 +0100 Revert "ACPI: processor: idle: Redefine two functions as void" Revert commit fbd401e95e56 ("ACPI: processor: idle: Redefine two functions as void") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 34fa09c698d626b09f7824fe2c520a0a21a072b9 Author: Rafael J. Wysocki Date: Tue Nov 25 14:50:25 2025 +0100 Revert "ACPI: processor: Do not expose global variable acpi_idle_driver" Revert commit 559f2eacc8a2 ACPI: processor: Do not expose global variable acpi_idle_driver" because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 7c373b3bd03c77fe8f6ea206ed49375eb4d43d13 Author: Ville Syrjälä Date: Wed Nov 5 19:10:15 2025 +0200 drm/i915/psr: Reject async flips when selective fetch is enabled The selective fetch code doesn't handle asycn flips correctly. There is a nonsense check for async flips in intel_psr2_sel_fetch_config_valid() but that only gets called for modesets/fastsets and thus does nothing for async flips. Currently intel_async_flip_check_hw() is very unhappy as the selective fetch code pulls in planes that are not even async flips capable. Reject async flips when selective fetch is enabled, until someone fixes this properly (ie. disable selective fetch while async flips are being issued). Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251105171015.22234-1-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander (cherry picked from commit a5f0cc8e0cd4007370af6985cb152001310cf20c) Signed-off-by: Rodrigo Vivi commit 747528729c9b6733839f9c95f300d5bef95ee52c Author: Jisheng Zhang Date: Mon Nov 17 08:01:32 2025 +0800 mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level Commit 27e8fe0da3b7 ("mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling") clears pending interrupts when resetting host->pending_reset to ensure no pending stale interrupts after sdhci_threaded_irq restores interrupts. But this fix is only added for th1520 platforms, in fact per my test, this issue exists on all dwcmshc users, such as cv1800b, sg2002, and synaptics platforms. So promote the above reset handling from th1520 to ip level. And keep reset handling on rk, sg2042 and bf3 as is, until it's confirmed that the same issue exists on these platforms too. Fixes: 017199c2849c ("mmc: sdhci-of-dwcmshc: Add support for Sophgo CV1800B and SG2002") Signed-off-by: Jisheng Zhang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 081156ce13f8fa4e97b5148dc54d8c0ddf02117b Author: Daniel Golle Date: Thu Nov 20 15:02:19 2025 +0000 net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs gpy_update_interface() returns early in case the PHY is internal or connected via USXGMII. In this case the gigabit master/slave property as well as MDI/MDI-X status also won't be read which seems wrong. Always read those properties by moving the logic to retrieve them to gpy_read_status(). Fixes: fd8825cd8c6fc ("net: phy: mxl-gpy: Add PHY Auto/MDI/MDI-X set driver for GPY211 chips") Fixes: 311abcdddc00a ("net: phy: add support to get Master-Slave configuration") Suggested-by: "Russell King (Oracle)" Signed-off-by: Daniel Golle Link: https://patch.msgid.link/71fccf3f56742116eb18cc070d2a9810479ea7f9.1763650701.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 82fca3d8a4a34667f01ec2351a607135249c9cff Author: Gui-Dong Han Date: Thu Nov 20 20:06:57 2025 +0800 atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race. The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos(). In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock. This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs. Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com Signed-off-by: Paolo Abeni commit f98e3ca2e4306a0c9deba1769248b25859db8a3d Merge: 7526183cfdbe35 d0b8fec8ae5052 Author: Paolo Abeni Date: Tue Nov 25 12:32:42 2025 +0100 Merge branch 'net-dsa-microchip-fix-resource-releases-in-error-path' Bastien Curutchet says: ==================== net: dsa: microchip: Fix resource releases in error path I worked on adding PTP support for the KSZ8463. While doing so, I ran into a few bugs in the resource release process that occur when things go wrong arount IRQ initialization. This small series fixes those bugs. The next series, which will add the PTP support, depend on this one. Signed-off-by: Bastien Curutchet (Schneider Electric) --- Bastien Curutchet (Schneider Electric) (5): net: dsa: microchip: common: Fix checks on irq_find_mapping() net: dsa: microchip: ptp: Fix checks on irq_find_mapping() net: dsa: microchip: Don't free uninitialized ksz_irq net: dsa: microchip: Free previously initialized ports on init failures net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() drivers/net/dsa/microchip/ksz_common.c | 31 +++++++++++++++---------------- drivers/net/dsa/microchip/ksz_ptp.c | 22 +++++++++------------- 2 files changed, 24 insertions(+), 29 deletions(-) --- base-commit: 09652e543e809c2369dca142fee5d9b05be9bdc7 change-id: 20251031-ksz-fix-db345df7635f Best regards, ==================== Link: https://patch.msgid.link/20251120-ksz-fix-v6-0-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit d0b8fec8ae50525b57139393d0bb1f446e82ff7e Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:04 2025 +0100 net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() The IRQ numbers created through irq_create_mapping() are only assigned to ptpmsg_irq[n].num at the end of the IRQ setup. So if an error occurs between their creation and their assignment (for instance during the request_threaded_irq() step), we enter the error path and fail to release the newly created virtual IRQs because they aren't yet assigned to ptpmsg_irq[n].num. Move the mapping creation to ksz_ptp_msg_irq_setup() to ensure symetry with what's released by ksz_ptp_msg_irq_free(). In the error path, move the irq_dispose_mapping to the out_ptp_msg label so it will be called only on created IRQs. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-5-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 0f80e21bf6229637e193248fbd284c0ec44bc0fd Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:03 2025 +0100 net: dsa: microchip: Free previously initialized ports on init failures If a port interrupt setup fails after at least one port has already been successfully initialized, the gotos miss some resource releasing: - the already initialized PTP IRQs aren't released - the already initialized port IRQs aren't released if the failure occurs in ksz_pirq_setup(). Merge 'out_girq' and 'out_ptpirq' into a single 'port_release' label. Behind this label, use the reverse loop to release all IRQ resources for all initialized ports. Jump in the middle of the reverse loop if an error occurs in ksz_ptp_irq_setup() to only release the port IRQ of the current iteration. Cc: stable@vger.kernel.org Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link") Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-4-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 25b62cc5b22c45face094ae3e8717258e46d1d19 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:02 2025 +0100 net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains. Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-3-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 9e059305be41a5bd27e03458d8333cf30d70be34 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:01 2025 +0100 net: dsa: microchip: ptp: Fix checks on irq_find_mapping() irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, during the PTP IRQ setup, we verify that its returned value isn't negative. Fix the irq_find_mapping() check to enter the error path when 0 is returned. Return -EINVAL in such case. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-2-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 7b3c09e1667977edee11de94a85e2593a7c15e87 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:00 2025 +0100 net: dsa: microchip: common: Fix checks on irq_find_mapping() irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, on each irq_find_mapping() call, we verify that the returned value isn't negative. Fix the irq_find_mapping() checks to enter error paths when 0 is returned. Return -EINVAL in such cases. CC: stable@vger.kernel.org Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-1-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 7526183cfdbe352c51c285762f0e15b7c428ea06 Author: Kai-Heng Feng Date: Thu Nov 20 12:15:33 2025 +0800 net: aquantia: Add missing descriptor cache invalidation on ATL2 ATL2 hardware was missing descriptor cache invalidation in hw_stop(), causing SMMU translation faults during device shutdown and module removal: [ 70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received: [ 70.361893] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0002060000000010 [ 70.367948] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000020000000000 [ 70.374002] arm-smmu-v3 arm-smmu-v3.5.auto: 0x00000000ff9bc000 [ 70.380055] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000000000000000 [ 70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0 [ 70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0 Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning hw cache it should be toggled") fixed cache invalidation for ATL B0, but ATL2 was left with only interrupt disabling. This allowed hardware to write to cached descriptors after DMA memory was unmapped, triggering SMMU faults. Once cache invalidation is applied to ATL2, the translation fault can't be observed anymore. Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both ATL B0 and ATL2 hw_stop() implementations for consistent behavior. Fixes: e54dcf4bba3e ("net: atlantic: basic A2 init/deinit hw_ops") Tested-by: Carol Soto Signed-off-by: Kai-Heng Feng Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251120041537.62184-1-kaihengf@nvidia.com Signed-off-by: Paolo Abeni commit 7b6dcd9bfd869eee7693e45b1817dac8c56e5f86 Author: Andrei Vagin Date: Sat Nov 22 07:19:53 2025 +0000 fs/namespace: fix reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns. grab_requested_mnt_ns() doesn't need to take an extra reference. Fixes: 78f0e33cd6c93 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns") Signed-off-by: Andrei Vagin Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com Signed-off-by: Christian Brauner commit eb76d0f5553575599561010f24c277cc5b31d003 Author: Thomas Zimmermann Date: Wed Nov 5 17:14:49 2025 +0100 drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs. VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array. Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly. Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer(). Serializes the helper with VGA switcheroo's call to fbcon_remap_all(). Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing. Signed-off-by: Thomas Zimmermann Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1] Fixes: 6a9ee8af344e ("vga_switcheroo: initial implementation (v15)") Acked-by: Javier Martinez Canillas Acked-by: Alex Deucher Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Cc: # v2.6.34+ Link: https://patch.msgid.link/20251105161549.98836-1-tzimmermann@suse.de commit 4fe5a00ec70717a7f1002d8913ec6143582b3c8e Author: Eric Dumazet Date: Fri Nov 21 15:41:00 2025 +0000 net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() syzbot reported that tcf_get_base_ptr() can be called while transport header is not set [1]. Instead of returning a dangling pointer, return NULL. Fix tcf_get_base_ptr() callers to handle this NULL value. [1] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 skb_transport_header include/linux/skbuff.h:3071 [inline] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 tcf_get_base_ptr include/net/pkt_cls.h:539 [inline] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 em_nbyte_match+0x2d8/0x3f0 net/sched/em_nbyte.c:43 Modules linked in: CPU: 1 UID: 0 PID: 6019 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Call Trace: tcf_em_match net/sched/ematch.c:494 [inline] __tcf_em_tree_match+0x1ac/0x770 net/sched/ematch.c:520 tcf_em_tree_match include/net/pkt_cls.h:512 [inline] basic_classify+0x115/0x2d0 net/sched/cls_basic.c:50 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x4cf/0x1140 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xfd/0x4c0 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x4e/0x260 net/core/dev.c:4118 __dev_xmit_skb net/core/dev.c:4214 [inline] __dev_queue_xmit+0xe83/0x3b50 net/core/dev.c:4729 packet_snd net/packet/af_packet.c:3076 [inline] packet_sendmsg+0x3e33/0x5080 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x830 net/socket.c:2630 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+f3a497f02c389d86ef16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6920855a.a70a0220.2ea503.0058.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251121154100.1616228-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7c9580f44f90f7a4c11fc7831efe323ebe446091 Author: Kiryl Shutsemau Date: Thu Nov 20 16:14:11 2025 +0000 mm/filemap: fix logic around SIGBUS in filemap_map_pages() Chris noticed that filemap_map_pages() calculates can_map_large only once for the first page in the fault around range. The value is not valid for the following pages in the range and must be recalculated. Instead of recalculating can_map_large on each iteration, pass down file_end to filemap_map_folio_range() and let it make the decision on what can be mapped. Link: https://lkml.kernel.org/r/20251120161411.859078-1-kirill@shutemov.name Fixes: 74207de2ba10 ("mm/memory: do not populate page table entries beyond i_size")h Signed-off-by: Kiryl Shutsemau Reported-by: Chris Mason Reviewed-by: Matthew Wilcox (Oracle) Cc: Al Viro Cc: Baolin Wang Cc: Chris Mason Cc: Christian Brauner Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cff47b9e39a6abf03dde5f4f156f841b0c54bba0 Author: Wei Yang Date: Wed Nov 19 23:53:02 2025 +0000 mm/huge_memory: fix NULL pointer deference when splitting folio Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via mapping->flags before proceeding with the split work. This check introduced a bug: for shmem folios in the swap cache and truncated folios, the mapping pointer can be NULL. Accessing mapping->flags in this state leads directly to a NULL pointer dereference. This commit fixes the issue by moving the check for mapping != NULL before any attempt to access mapping->flags. Link: https://lkml.kernel.org/r/20251119235302.24773-1-richard.weiyang@gmail.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Wei Yang Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Baolin Wang Cc: Signed-off-by: Andrew Morton commit 6c96c6bd2c71fc7ee08580388a3a4a459019c320 Author: Pratyush Yadav Date: Tue Nov 18 19:24:15 2025 +0100 MAINTAINERS: add test_kho to KHO's entry Commit b753522bed0b7 ("kho: add test for kexec handover") introduced the KHO test but missed adding it to KHO's MAINTAINERS entry. Add it so the KHO maintainers can get patches for its test. Link: https://lkml.kernel.org/r/20251118182416.70660-1-pratyush@kernel.org Fixes: b753522bed0b7 ("kho: add test for kexec handover") Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 52ac3f5829eea40cbcb74994e075ad4d7db7c88f Author: Sam Protsenko Date: Mon Nov 17 21:31:11 2025 -0600 mailmap: add entry for Sam Protsenko Use 'Sam Protsenko' as my name consistently in git-shortlog. Also map my old GlobalLogic email address to my current email to stay reachable. Link: https://lkml.kernel.org/r/20251118033111.23382-1-semen.protsenko@linaro.org Signed-off-by: Sam Protsenko Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit f0bb6dba3df32ecb4a7038ca549b21e9812aec5e Author: Carlos Llamas Date: Thu Nov 13 03:46:22 2025 +0000 selftests/mm: fix division-by-zero in uffd-unit-tests Commit 4dfd4bba8578 ("selftests/mm/uffd: refactor non-composite global vars into struct") moved some of the operations previously implemented in uffd_setup_environment() earlier in the main test loop. The calculation of nr_pages, which involves a division by page_size, now occurs before checking that default_huge_page_size() returns a non-zero This leads to a division-by-zero error on systems with !CONFIG_HUGETLB. Fix this by relocating the non-zero page_size check before the nr_pages calculation, as it was originally implemented. Link: https://lkml.kernel.org/r/20251113034623.3127012-1-cmllamas@google.com Fixes: 4dfd4bba8578 ("selftests/mm/uffd: refactor non-composite global vars into struct") Signed-off-by: Carlos Llamas Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Ujwal Kundur Cc: Brendan Jackman Cc: Liam Howlett Cc: Michal Hocko Cc: Peter Xu Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 270065f514c5da7b3deb4f6a96cf93e96551cf35 Author: Liam R. Howlett Date: Tue Nov 11 16:56:05 2025 -0500 mm/mmap_lock: reset maple state on lock_vma_under_rcu() retry The retry in lock_vma_under_rcu() drops the rcu read lock before reacquiring the lock and trying again. This may cause a use-after-free if the maple node the maple state was using was freed. The maple state is protected by the rcu read lock. When the lock is dropped, the state cannot be reused as it tracks pointers to objects that may be freed during the time where the lock was not held. Any time the rcu read lock is dropped, the maple state must be invalidated. Resetting the address and state to MA_START is the safest course of action, which will result in the next operation starting from the top of the tree. Prior to commit 0b16f8bed19c ("mm: change vma_start_read() to drop RCU lock on failure"), vma_start_read() would drop rcu read lock and return NULL, so the retry would not have happened. However, now that vma_start_read() drops rcu read lock on failure followed by a retry, we may end up using a freed maple tree node cached in the maple state. [surenb@google.com: changelog alteration] Link: https://lkml.kernel.org/r/CAJuCfpEWMD-Z1j=nPYHcQW4F7E2Wka09KTXzGv7VE7oW1S8hcw@mail.gmail.com Link: https://lkml.kernel.org/r/20251111215605.1721380-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Fixes: 0b16f8bed19c ("mm: change vma_start_read() to drop RCU lock on failure") Reported-by: syzbot+131f9eb2b5807573275c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=131f9eb2b5807573275c Acked-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Shakeel Butt Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit de8798965fd0d9a6c47fc2ac57767ec32de12b49 Author: Deepanshu Kartikey Date: Wed Nov 12 20:20:34 2025 +0530 mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosure to userspace 2. Folios are not marked uptodate before adding to page cache 3. hugetlb_fault_mutex is not taken before hugetlb_add_to_page_cache() The memfd allocation path bypasses the normal page fault handler (hugetlb_no_page) which would handle all of these initialization steps. This is problematic especially for udmabuf use cases where folios are pinned and directly accessed by userspace via DMA. Fix by matching the initialization pattern used in hugetlb_no_page(): - Zero the folio using folio_zero_user() which is optimized for huge pages - Mark it uptodate with folio_mark_uptodate() - Take hugetlb_fault_mutex before adding to page cache to prevent races The folio_zero_user() change also fixes a potential security issue where uninitialized kernel memory could be disclosed to userspace through read() or mmap() operations on the memfd. Link: https://lkml.kernel.org/r/20251112145034.2320452-1-kartikey406@gmail.com Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20251112031631.2315651-1-kartikey406@gmail.com/ [v1] Closes: https://syzkaller.appspot.com/bug?extid=f64019ba229e3a5c411b Suggested-by: Oscar Salvador Suggested-by: David Hildenbrand Tested-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Red Hat) Acked-by: Hugh Dickins Cc: Vivek Kasireddy Cc: Jason Gunthorpe Cc: Jason Gunthorpe (v2) Cc: Christoph Hellwig (v6) Cc: Dave Airlie Cc: Gerd Hoffmann Cc: Signed-off-by: Andrew Morton commit f5e31a196edcd1f1bb44f26b6f9299b9a5b9b3c4 Author: Youngjun Park Date: Sun Nov 2 17:24:56 2025 +0900 mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type() After commit 4f78252da887, nr_swap_pages is decremented in swap_range_alloc(). Since cluster_alloc_swap_entry() calls swap_range_alloc() internally, the decrement in get_swap_page_of_type() causes double-decrementing. As a representative userspace-visible runtime example of the impact, /proc/meminfo reports increasingly inaccurate SwapFree values. The discrepancy grows with each swap allocation, and during hibernation when large amounts of memory are written to swap, the reported value can deviate significantly from actual available swap space, misleading users and monitoring tools. Remove the duplicate decrement. Link: https://lkml.kernel.org/r/20251102082456.79807-1-youngjun.park@lge.com Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()") Signed-off-by: Youngjun Park Acked-by: Chris Li Reviewed-by: Barry Song Reviewed-by: Kairui Song Acked-by: Nhat Pham Cc: Baoquan He Cc: Kemeng Shi Cc: [6.17+] Signed-off-by: Andrew Morton commit 1a96f3a22fd88b8ea217233d359e0334981b0384 Author: Marek Szyprowski Date: Mon Nov 24 18:09:55 2025 +0100 iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink() Commit c288d657dd51 added support for DMA_ATTR_MMIO attribute in the dma_iova_link() code path, but missed that the CPU cache is being also touched in the dma_iova_unlink() path. Fix this. Fixes: c288d657dd51 ("iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link().") Signed-off-by: Marek Szyprowski Reviewed-by: Jason Gunthorpe Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20251124170955.3884351-1-m.szyprowski@samsung.com commit 971fb57429df5aa4e6efc796f7841e0d10b1e83c Author: Michael Chen Date: Thu Nov 13 12:56:43 2025 -0500 drm/amd/amdgpu: reserve vm invalidation engine for uni_mes Reserve vm invalidation engine 6 when uni_mes enabled. It is used in processing tlb flush request from host. Signed-off-by: Michael Chen Acked-by: Alex Deucher Reviewed-by: Shaoyun liu Signed-off-by: Alex Deucher (cherry picked from commit 873373739b9b150720ea2c5390b4e904a4d21505) Cc: stable@vger.kernel.org commit f6041803a831266a2a5a5b5af66f7de0845bcbf3 Author: Jens Axboe Date: Mon Nov 24 10:59:02 2025 -0700 io_uring/net: ensure vectored buffer node import is tied to notification When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct io_kiocb for the vectored buffer import. Cc: stable@vger.kernel.org Fixes: 23371eac7d9a ("io_uring/net: implement vectored reg bufs for zctx") Reported-by: Google Big Sleep Signed-off-by: Jens Axboe commit 8a2bcda5e139064b255531eb5889ff826a8b6995 Merge: ac3fd01e4c1efc fe680d8c747f4e Author: Linus Torvalds Date: Mon Nov 24 09:46:41 2025 -0800 Merge tag 'for-6.18/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - dm-pcache fixes - fix a regression with empty flush bios - dm-verity: fix unreliable memory allocation with GFP_NOWAIT * tag 'for-6.18/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-verity: fix unreliable memory allocation dm: fix failure when empty flush's bi_sector points beyond the device end dm-pcache: zero cache_info before default init dm-pcache: reuse meta_addr in pcache_meta_find_latest dm-pcache: allow built-in build and rename flush helper commit 03bc4831ef064e114328dea906101cff7c6fb8b3 Author: Wentao Guan Date: Fri Nov 14 11:05:39 2025 +0000 nvmem: layouts: fix nvmem_layout_bus_uevent correctly check the ENODEV return value. Fixes: 810b790033cc ("nvmem: layouts: fix automatic module loading") CC: stable@vger.kernel.org Co-developed-by: WangYuli Signed-off-by: WangYuli Signed-off-by: Wentao Guan Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110539.143154-1-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 74851fbb6d647304f8a7dc491434d3a335ef4b8d Author: Haotian Zhang Date: Mon Nov 24 10:22:15 2025 +0800 usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing pm_runtime_resume_and_get() to operate on uninitialized runtime PM state. Check the return value of devm_pm_runtime_enable() and return on failure. Fixes: 3e6e14ffdea4 ("usb: gadget: udc: add Renesas RZ/N1 USBF controller support") Signed-off-by: Haotian Zhang Acked-by: Herve Codina Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251124022215.1619-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 165eb13e485c5c25c7cb276ac85f788a2bd200cb Author: Jonathan Marek Date: Mon Nov 17 00:12:08 2025 -0500 arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY The "drop print" commit removed the whole branch and not just the print. For some ARM64 cpus, this leads to hard lockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not enabled. Fixes: 62e72463ca71 ("arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY") Signed-off-by: Jonathan Marek Signed-off-by: Will Deacon commit 7c16c02e86081355a54c50c045b0caa172e72028 Author: Marc Zyngier Date: Thu Oct 30 11:01:15 2025 +0000 ACPI: GTDT: Correctly number platform devices for MMIO timers Use the actual timer counter instead of the watchdog counter. Fixes: 5669d92f3efa ("ACPI: GTDT: Generate platform devices for MMIO timers") Reported-by: Pavan Kondeti Signed-off-by: Marc Zyngier Cc: Hanjun Guo Cc: Sudeep Holla Cc: Rafael J. Wysocki Cc: Daniel Lezcano Cc: Thomas Gleixner Cc: Mark Rutland Acked-by: Hanjun Guo Signed-off-by: Will Deacon commit 9238fa35a3c04835a77988a14e1397763cf0eabe Author: Will Deacon Date: Mon Nov 24 13:08:43 2025 +0000 Revert "arm64: acpi: Enable ACPI CCEL support" This reverts commit d02c2e45b1e7767b177f6854026e4ad0d70b4a4d. Mauro reports that this breaks APEI notifications on his QEMU setup because the "reserved for firmware" region still needs to be writable by Linux in order to signal _back_ to the firmware after processing the reported error: | {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 | ... | [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error | Unable to handle kernel write to read-only memory at virtual address ffff800080035018 | Mem abort info: | ESR = 0x000000009600004f | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x0f: level 3 permission fault | Data abort info: | ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000505d7000 | pgd=10000000510bc003, p4d=1000000100229403, pud=100000010022a403, pmd=100000010022b403, pte=0060000139b90483 | Internal error: Oops: 000000009600004f [#1] SMP For now, revert the offending commit. We can presumably switch back to PAGE_KERNEL when bringing this back in the future. Link: https://lore.kernel.org/r/20251121224611.07efa95a@foz.lan Reported-by: Mauro Carvalho Chehab Signed-off-by: Will Deacon commit 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 Author: Dan Carpenter Date: Fri Nov 21 20:51:28 2025 +0300 platform/x86: intel: punit_ipc: fix memory corruption This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the: complete(&ipcdev->cmd_complete); in intel_punit_ioc() will write to a wrong memory address corrupting it. Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 620a8f131154250f6a64a07d049a4f235d6451a5 Author: Johan Hovold Date: Mon Sep 22 14:20:12 2025 +0200 drm: sti: fix device leaks at component probe Make sure to drop the references taken to the vtg devices by of_find_device_by_node() when looking up their driver data during component probe. Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns. Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure") Cc: stable@vger.kernel.org # 4.16 Cc: Benjamin Gaignard Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org Signed-off-by: Raphael Gallais-Pou commit a90903c2a3c38bce475f46ea3f93dbf6a9971553 Author: Haotian Zhang Date: Mon Nov 24 09:58:52 2025 +0800 spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing runtime PM operations to fail silently after autosuspend configuration. Check the return value of devm_pm_runtime_enable() and return on failure. Fixes: 909fac05b926 ("spi: add support for Amlogic A1 SPI Flash Controller") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251124015852.937-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit c98c99d5dbdf9fb0063650594edfd7d49b5f4e29 Author: Jon Hunter Date: Fri Nov 21 14:10:03 2025 +0000 pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag Commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") kept power-domains on longer during boot which is causing some GPU related tests to fail on Tegra234. While this is being investigated, add the flag GENPD_FLAG_NO_STAY_ON for Tegra devices to restore the previous behaviour to fix this. Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Signed-off-by: Jon Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c1bac49fe91f7c10fec95e6ef8304062202d5263 Author: AngeloGioacchino Del Regno Date: Fri Nov 21 13:52:12 2025 +0100 pmdomains: mtk-pm-domains: Fix spinlock recursion in probe For some reason, of_find_node_with_property() is creating a spinlock recursion issue along with fwnode_count_parents(), and this issue is making all MediaTek boards unbootable. As of kernel v6.18-rc6, there are only three users of this function, one of which is this driver. Migrate away from of_find_node_with_property() by adding a local scpsys_get_legacy_regmap_node() function, which acts similarly to of_find_node_with_property(), and calling the former in place of the latter. This resolves the following spinlock recursion issue: [ 1.773979] BUG: spinlock recursion on CPU#2, kworker/u24:1/60 [ 1.790485] lock: devtree_lock+0x0/0x40, .magic: dead4ead, .owner: kworker/u24:1/60, .owner_cpu: 2 [ 1.791644] CPU: 2 UID: 0 PID: 60 Comm: kworker/u24:1 Tainted: G W 6.18.0-rc6 #3 PREEMPT [ 1.791649] Tainted: [W]=WARN [ 1.791650] Hardware name: MediaTek Genio-510 EVK (DT) [ 1.791653] Workqueue: events_unbound deferred_probe_work_func [ 1.791658] Call trace: [ 1.791659] show_stack+0x18/0x30 (C) [ 1.791664] dump_stack_lvl+0x68/0x94 [ 1.791668] dump_stack+0x18/0x24 [ 1.791672] spin_dump+0x78/0x88 [ 1.791678] do_raw_spin_lock+0x110/0x140 [ 1.791684] _raw_spin_lock_irqsave+0x58/0x6c [ 1.791690] of_get_parent+0x28/0x74 [ 1.791694] of_fwnode_get_parent+0x38/0x7c [ 1.791700] fwnode_count_parents+0x34/0xf0 [ 1.791705] fwnode_full_name_string+0x28/0x120 [ 1.791710] device_node_string+0x3e4/0x50c [ 1.791715] pointer+0x294/0x430 [ 1.791718] vsnprintf+0x21c/0x5bc [ 1.791722] vprintk_store+0x108/0x47c [ 1.791728] vprintk_emit+0xc4/0x350 [ 1.791732] vprintk_default+0x34/0x40 [ 1.791736] vprintk+0x24/0x30 [ 1.791740] _printk+0x60/0x8c [ 1.791744] of_node_release+0x154/0x194 [ 1.791749] kobject_put+0xa0/0x120 [ 1.791753] of_node_put+0x18/0x28 [ 1.791756] of_find_node_with_property+0x74/0x100 [ 1.791761] scpsys_probe+0x338/0x5e0 [ 1.791765] platform_probe+0x5c/0xa4 [ 1.791770] really_probe+0xbc/0x2ac [ 1.791774] __driver_probe_device+0x78/0x118 [ 1.791779] driver_probe_device+0x3c/0x170 [ 1.791783] __device_attach_driver+0xb8/0x150 [ 1.791788] bus_for_each_drv+0x88/0xe8 [ 1.791792] __device_attach+0x9c/0x1a0 [ 1.791796] device_initial_probe+0x14/0x20 [ 1.791801] bus_probe_device+0xa0/0xa4 [ 1.791805] deferred_probe_work_func+0x88/0xd0 [ 1.791809] process_one_work+0x1e8/0x448 [ 1.791813] worker_thread+0x1ac/0x340 [ 1.791816] kthread+0x138/0x220 [ 1.791821] ret_from_fork+0x10/0x20 Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval") Signed-off-by: AngeloGioacchino Del Regno Tested-by: Louis-Alexis Eyraud Tested-by: Macpaul Lin Reviewed-by: Macpaul Lin Signed-off-by: Ulf Hansson commit ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d Author: Linus Torvalds Date: Sun Nov 23 14:53:16 2025 -0800 Linux 6.18-rc7 commit d0e88704d96ca0df77717320fec4ebabe42c8a94 Merge: 1af5c1d3a90246 3c493b524ffdb3 Author: Linus Torvalds Date: Sun Nov 23 12:03:28 2025 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Fixes for the Allwinner A523 clk driver: - Lower the minimum rate for the A523 audio PLL to support frequencies required by audio devices - Mark a couple clks critical on A523 so that Linux doesn't turn them off when they're used by other code like TF-A" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical commit 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 Merge: e624f7377599d1 20739af07383e6 Author: Linus Torvalds Date: Sun Nov 23 08:23:30 2025 -0800 Merge tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix a race in timer->function clearing in timer_shutdown_sync() - Fix a timekeeper sysfs-setup resource leak in error paths - Fix the NOHZ report_idle_softirq() syslog rate-limiting logic to have no side effects on the return value * tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers: Fix NULL function pointer race in timer_shutdown_sync() timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths tick/sched: Fix bogus condition in report_idle_softirq() commit e624f7377599d1f82190b17bdf7d8e735c0576ee Merge: d13f3ac64efb86 f1f96511b1c4c3 Author: Linus Torvalds Date: Sun Nov 23 08:20:15 2025 -0800 Merge tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Fix perf CPU-clock counters, and address a static checker warning" * tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix 0 count issue of cpu-clock perf/x86/intel/uncore: Remove superfluous check commit 20739af07383e6eb1ec59dcd70b72ebfa9ac362c Author: Yipeng Zou Date: Sat Nov 22 09:39:42 2025 +0000 timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running. Fixes: 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions") Signed-off-by: Yipeng Zou Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com commit d13f3ac64efb868d09cb2726b1e84929afe90235 Merge: 0629dcf772e66f 14b46ba92bf547 Author: Linus Torvalds Date: Sat Nov 22 12:55:18 2025 -0800 Merge tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fix CPU type in DT for econet - Fix for Malta PCI MMIO breakage for SOC-it - Fix TLB shutdown caused by iniital uniquification - Fix random seg faults due to missed vdso storage requirement * tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: kernel: Fix random segmentation faults MIPS: mm: Prevent a TLB shutdown on initial uniquification mips: dts: econet: fix EN751221 core type MIPS: Malta: Fix !EVA SOC-it PCI MMIO commit 0629dcf772e66ff9b81822af0e29ae2c7d03068f Merge: 89edd36fd801ef 141fbbecec0e71 Author: Linus Torvalds Date: Sat Nov 22 11:53:53 2025 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix another KMSAN warning that made it in while KMSAN wasn't working reliably" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x() commit 89edd36fd801efdb3d2f38bbf7791a293c24bb45 Merge: 7e29f077609413 678e1cc2f482e0 Author: Linus Torvalds Date: Sat Nov 22 10:23:34 2025 -0800 Merge tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Carlos Maiolino: "A single out-of-bounds fix, nothing special" * tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix out of bounds memory read error in symlink repair commit 7e29f077609413f94f70d4da4d7602a59abad991 Merge: ebd975458deada 90449f2d1e1f02 Author: Linus Torvalds Date: Sat Nov 22 10:16:21 2025 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "One target driver fix and one scsi-generic one. The latter is 10 lines because the problem lock has to be dropped and re-taken around the call causing the sleep in atomic" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sg: Do not sleep in atomic context scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() commit ebd975458deada5eadcc9f4e0f63fc4ce6aa90ea Merge: a6ff0d85ebf0d4 ae8966b7b5bd69 Author: Linus Torvalds Date: Sat Nov 22 09:58:41 2025 -0800 Merge tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of devices it is supposed to be set for - a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver - Goodix driver no longer tries to set reset pin as "input" as it causes issues when there is no pull up resistor installed on the board - fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to deal with potential out-of-bounds access and memory corruption issues * tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD Input: cros_ec_keyb - fix an invalid memory access Input: imx_sc_key - fix memory corruption on unload Input: pegasus-notetaker - fix potential out-of-bounds access Input: goodix - remove setting of RST pin to input Input: goodix - add support for ACPI ID GDIX1003 commit a6ff0d85ebf0d4033c9850bf7f77fdaf472191a1 Merge: 5703357ede59ce e2cb69263e797c Author: Linus Torvalds Date: Sat Nov 22 09:44:50 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Correct the MIPS RISC-V/JEDEC vendor ID - Fix the system shutdown behavior in the legacy case where CONFIG_RISCV_SBI_V01 is set, but the firmware implementation doesn't support the older v0.1 system shutdown method - Align some tools/ macro definitions with the corresponding kernel headers * tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: tools: riscv: Fixed misalignment of CSR related definitions riscv: sbi: Prefer SRST shutdown over legacy riscv: Update MIPS vendor id to 0x127 commit 5703357ede59ce8b0af11e02c374a3db73c55ee8 Merge: 2eba5e05d9bcf4 3ded250b97c3ae Author: Linus Torvalds Date: Sat Nov 22 09:24:36 2025 -0800 Merge tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: "Three SELinux patches for v6.18 to fix issues around accessing the per-task decision cache that we introduced in v6.16 to help reduce SELinux overhead on path walks. The problem was that despite the cache being located in the SELinux "task_security_struct", the parent struct wasn't actually tied to the task, it was tied to a cred. Historically SELinux did locate the task_security_struct in the task_struct's security blob, but it was later relocated to the cred struct when the cred work happened, as it made the most sense at the time. Unfortunately we never did the task_security_struct to cred_security_struct rename work (avoid code churn maybe? who knows) because it didn't really matter at the time. However, it suddenly became a problem when we added a per-task cache to a per-cred object and didn't notice because of the old, no-longer-correct struct naming. Thanks to KCSAN for flagging this, as the silly humans running things forgot that the task_security_struct was a big lie. This contains three patches, only one of which actually fixes the problem described above and moves the SELinux decision cache from the per-cred struct to a newly (re)created per-task struct. The other two patches, which form the bulk of the diffstat, take care of the associated renaming tasks so we can hopefully avoid making the same stupid mistake in the future. For the record, I did contemplate sending just a fix for the cache, leaving the renaming patches for the upcoming merge window, but the type/variable naming ended up being pretty awful and would have made v6.18 an outlier stuck between the "old" names and the "new" names in v6.19. The renaming patches are also fairly mechanical/trivial and shouldn't pose much risk despite their size. TLDR; naming things may be hard, but if you mess it up bad things happen" * tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: rename the cred_security_struct variables to "crsec" selinux: move avdcache to per-task security struct selinux: rename task_security_struct to cred_security_struct commit df5fde297e617041449f603ed5f646861c80000b Author: Alan Stern Date: Fri Nov 21 16:29:34 2025 -0500 USB: storage: Remove subclass and protocol overrides from Novatek quirk A report from Oleg Smirnov indicates that the unusual_devs quirks entry for the Novatek camera does not need to override the subclass and protocol parameters: [3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd [3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00 [3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [3266355.333043] usb 1-3: Product: YICARCAM [3266355.333045] usb 1-3: Manufacturer: XIAO-YI [3266355.333047] usb 1-3: SerialNumber: 966110000000100 [3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected [3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000 [3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1) Please send a copy of this message to and The overrides are harmless but they do provoke the driver into logging this annoying message. Update the entry to remove the unneeded entries. Reported-by: stealth Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/ Fixes: 6ca8af3c8fb5 ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera") Signed-off-by: Alan Stern Cc: stable Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 8a4dfa8fa6b5ed35659ffeed6bcc10dd98ad36e9 Merge: ec3803b5917b6f 545d7827b2cd5d Author: Jakub Kicinski Date: Fri Nov 21 18:18:47 2025 -0800 Merge tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sock: Prevent race in socket write iter and sock bind - hci_core: Fix triggering cmd_timer for HCI_OP_NOP - hci_core: lookup hci_conn on RX path on protocol side - SMP: Fix not generating mackey and ltk when repairing - btusb: mediatek: Fix kernel crash when releasing mtk iso interface - btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref * tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: SMP: Fix not generating mackey and ltk when repairing Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref Bluetooth: hci_core: lookup hci_conn on RX path on protocol side Bluetooth: hci_sock: Prevent race in socket write iter and sock bind Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface ==================== Link: https://patch.msgid.link/20251121145332.177015-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ec3803b5917b6ff2f86ea965d0985c95d8a85119 Author: Daniel Golle Date: Thu Nov 20 14:17:13 2025 +0000 net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY As the interface mode doesn't need to be updated on PHYs connected with USXGMII and integrated PHYs, gpy_update_interface() should just return 0 in these cases rather than -EINVAL which has wrongly been introduced by commit 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type"), as this breaks support for those PHYs. Fixes: 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type") Signed-off-by: Daniel Golle Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/f744f721a1fcc5e2e936428c62ff2c7d94d2a293.1763648168.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 9f393d8e757f79060baf4b2e703bd6b2d0d8d323 Author: Sergey Matyukevich Date: Wed Nov 19 23:35:06 2025 +0300 riscv: dts: allwinner: d1: fix vlenb property According to [1], the C906 vector registers are 128 bits wide. The 'thead,vlenb' property specifies the vector register length in bytes, so its value must be set to 16. [1] https://dl.linux-sunxi.org/D1/Xuantie_C906_R1S0_User_Manual.pdf Fixes: ce1daeeba600 ("riscv: dts: allwinner: Add xtheadvector to the D1/D1s devicetree") Signed-off-by: Sergey Matyukevich Link: https://patch.msgid.link/20251119203508.1032716-1-geomatsi@gmail.com Signed-off-by: Chen-Yu Tsai commit fe7cdcd1bacec3a54ec94131292b5c883cec50cf Merge: 65c4ba832d0952 e19d7f7e92e061 Author: Arnd Bergmann Date: Fri Nov 21 21:27:20 2025 +0100 Merge tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes QCOMTEE fixes2 for v6.18 - initialize result before use in in error path - fix uninitialized pointers with free attribute * tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: initialize result before use in release worker tee: qcomtee: fix uninitialized pointers with free attribute Signed-off-by: Arnd Bergmann commit 65c4ba832d09529eebafde527d18092b69ab1938 Merge: 2eba5e05d9bcf4 e89ee35567d3d4 Author: Arnd Bergmann Date: Fri Nov 21 21:26:38 2025 +0100 Merge tag 'imx-fixes-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.18, 2nd round: - Correct i.MX8DXL's pcie-ep interrupt number (Frank Li) - Swap interrupt numbers of eqos for imx8dxl-ss-conn (Frank Li) - Correct SAI3 interrupt line for i.MX6UL (Maarten Zanders) - Correct mux-controller select/enable-gpios polarity for imx8qm-mek board (Xu Yang) * tag 'imx-fixes-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity ARM: dts: nxp: imx6ul: correct SAI3 interrupt line arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos arm64: dts: imx8dxl: Correct pcie-ep interrupt number Signed-off-by: Arnd Bergmann commit b07bf253ef8e48e7ff0b378f441a180a8ad37124 Author: Gustavo A. R. Silva Date: Mon Nov 10 20:35:31 2025 +0900 iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that struct iommufd_vevent is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: drivers/iommu/iommufd/iommufd_private.h:621:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Link: https://patch.msgid.link/r/aRHOAwpATIE0oajj@kspp Signed-off-by: "Gustavo A. R. Silva" Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC") Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit ac84ff453305d12bc799074a9f9af30ff97fff70 Author: Gustavo A. R. Silva Date: Tue Nov 11 18:01:24 2025 +0900 iommufd/driver: Fix counter initialization for counted_by annotation One of the requirements for counted_by annotations is that the counter member must be initialized before the first reference to the flexible-array member. Move the vevent->data_len = data_len; initialization to before the first access to flexible array vevent->event_data. Link: https://patch.msgid.link/r/aRL7ZFFqM5bRTd2D@kspp Cc: stable@vger.kernel.org Fixes: e8e1ef9b77a7 ("iommufd/viommu: Add iommufd_viommu_report_event helper") Signed-off-by: "Gustavo A. R. Silva" Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 2eba5e05d9bcf4cdea995ed51b0f07ba0275794a Merge: e3fe48f9bdf47e 677e6123e3d24a Author: Linus Torvalds Date: Fri Nov 21 11:16:14 2025 -0800 Merge tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Use UAPI types in ptrace UAPI header to fix nolibc ptrace. Fix CPU name display, NUMA node parsing, kexec/kdump, PCI init and BPF trampoline" * tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: BPF: Disable trampoline for kernel module function trace LoongArch: Don't panic if no valid cache info for PCI LoongArch: Mask all interrupts during kexec/kdump LoongArch: Fix NUMA node parsing with numa_memblks LoongArch: Consolidate CPU names in /proc/cpuinfo LoongArch: Use UAPI types in ptrace UAPI header commit e3fe48f9bdf47e0de91ffb7ba10d94a6a7598e8f Merge: a07a003ce6d475 d5227c88174c38 Author: Linus Torvalds Date: Fri Nov 21 11:14:21 2025 -0800 Merge tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix potential memory leak in mount - Add some missing read tracepoints - Fix locking issue with directory leases * tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Add the smb3_read_* tracepoints to SMB1 cifs: fix memory leak in smb3_fs_context_parse_param error path smb: client: introduce close_cached_dir_locked() commit a07a003ce6d475014e71e1c4f52f4ed7146dd35e Merge: a4165ffc835fcf 46447367a52965 Author: Linus Torvalds Date: Fri Nov 21 11:09:57 2025 -0800 Merge tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a mixup of arguments for the skb_queue_splice() call, in the io_uring timestamp retrieval code" * tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cmd_net: fix wrong argument types for skb_queue_splice() commit a4165ffc835fcf738c2ff41ce8305b04454c07d0 Merge: 317c4d8a2a320a 49c2d5941c8906 Author: Linus Torvalds Date: Fri Nov 21 10:59:35 2025 -0800 Merge tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: "NVMe pull request via Keith: - Admin queue use-after-free fix (Keith) - Target authentication fix (Alistar) - Multipath lockdeup fix (Shin'ichiro) - FC transport teardown fixes (Ewan)" * tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() nvme-multipath: fix lockdep WARN due to partition scan work nvmet-auth: update sc_c in target host hash calculation nvme: fix admin request_queue lifetime commit 317c4d8a2a320a58997f30a5b2a8eca57e0990fc Merge: 68d804c64a595d 91842ed844a068 Author: Linus Torvalds Date: Fri Nov 21 10:53:23 2025 -0800 Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - Add a missing refcount decrement in ata_scsi_dev_rescan() when the device or its queue is not running. In the case where the device is running, the recount is already decremented properly (Yihang Li) - Generate the proper sense code for a Security locked device. There was a regression caused by a recent change of how sense data is generated for commands that did not provide any sense data. This broke system suspend for Security locked devices. Generate the sense data that the SCSI disk driver expects for a Security locked device so that system suspend works again (me) - Set capacity to zero for a Security locked device. All I/O commands will be aborted by a Security locked device. Thus, the block layer disk partition scanning will result in a bunch of, for the user, confusing I/O errors in dmesg during boot. Since a Security locked device is unusable anyway, set the capacity to zero, to avoid the disk partition scanning during boot. We still create the block device in /dev such that the user may unlock the device using e.g. hdparm (me) * tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Set capacity to zero for a security locked drive ata: libata-scsi: Fix system suspend for a security locked drive ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() commit 68d804c64a595dd7f885759f3c3bd51ca893deb4 Merge: 2c26574cc4ea41 79afd3c5edac93 Author: Linus Torvalds Date: Fri Nov 21 10:47:24 2025 -0800 Merge tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fix register naming in the Mediatek mt8189 driver - Select REGMAP_MMIO for the Realtek RTD driver - Fix the number of items in groups in the Toshiba Visconti driver - Fix a memory leak in the Cirrus CS42L43 driver - Fix a deadlock (!) in Qualcomm pinmux configuration - Fix use of uninitialized memory and list initialization in the S32CC pin controller * tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc pinctrl: qcom: msm: Fix deadlock in pinmux configuration pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups pinctrl: realtek: Select REGMAP_MMIO for RTD driver pinctrl: mediatek: mt8189: align register base names to dt-bindings ones pinctrl: mediatek: mt8196: align register base names to dt-bindings ones commit 2c26574cc4ea41266d9a09441d0e05a9f09192de Merge: c6d732c3bd4137 2b6d546ba83e83 Author: Linus Torvalds Date: Fri Nov 21 10:43:58 2025 -0800 Merge tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a use-after-free bug in GPIO character device code - update MAINTAINERS * tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: update my email address gpio: cdev: make sure the cdev fd is still active before emitting events commit 141fbbecec0e71fa6b35d08c7d3dba2f9853a4ee Author: Eric Biggers Date: Thu Nov 20 19:34:31 2025 -0800 lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x() Fully initialize *ctx, including the buf field which sha256_init() doesn't initialize, to avoid a KMSAN warning when comparing *ctx to orig_ctx. This KMSAN warning slipped in while KMSAN was not working reliably due to a stackdepot bug, which has now been fixed. Fixes: 6733968be7cb ("lib/crypto: tests: Add tests and benchmark for sha256_finup_2x()") Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251121033431.34406-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c6d732c3bd41375d176447b043274396268aa6ab Merge: a48f8229089823 40b53db87c998b Author: Linus Torvalds Date: Fri Nov 21 09:55:55 2025 -0800 Merge tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "A range of small fixes across the board, the i915 display disambiguation is probably the biggest otherwise amdgpu and xe as usual with tegra, nouveau, radeon and a core atomic fix. Looks mostly normal. atomic: - Return error codes on failed blob creation for planes nouveau: - Fix memory leak tegra: - Fix device ref counting - Fix pid ref counting - Revert booting on Pixel C xe: - Fix out-of-bounds access with BIT() - Fix kunit test checking wrong condition - Drop duplicate kconfig select - Fix guc2host irq handler with MSI-X i915: - Wildcat Lake and Panther Lake detangled for display fixes amdgpu: - DTBCLK gating fix - EDID fetching retry improvements - HDMI HPD debounce filtering - DCN 2.0 cursor fix - DP MST PBN fix - VPE fix - GC 11 fix - PRT fix - MMIO remap page fix - SR-IOV fix radeon: - Fence deadlock fix" * tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) drm/amdgpu: Add sriov vf check for VCN per queue reset support. drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled drm/amd: Skip power ungate during suspend for VPE drm/plane: Fix create_in_format_blob() return value drm/xe/irq: Handle msix vector0 interrupt drm/xe: Remove duplicate DRM_EXEC selection from Kconfig drm/xe/kunit: Fix forcewake assertion in mocs test drm/xe: Prevent BIT() overflow when handling invalid prefetch region drm/radeon: delete radeon_fence_process in is_signaled, no deadlock drm/amd/display: Fix pbn to kbps Conversion drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 drm/amd/display: Add an HPD filter for HDMI drm/amd/display: Increase DPCD read retries drm/amd/display: Move sleep into each retry for retrieve_link_cap() drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A drm/i915/display: Add definition for wcl as subplatform drm/pcids: Split PTL pciids group to make wcl subplatform ... commit a48f822908982353c3256e35a089e9e7d0d61580 Author: Linus Torvalds Date: Fri Nov 21 09:29:02 2025 -0800 samples: work around glibc redefining some of our defines wrong Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in . Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things. Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid. Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values. It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does #define AT_RENAME_NOREPLACE 0x0001 while glibc does # define RENAME_NOREPLACE (1 << 0) # define AT_RENAME_NOREPLACE RENAME_NOREPLACE instead. Same value in the end, but very different macro definition. For absolutely no reason. This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions. Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes. Signed-off-by: Linus Torvalds commit 83c53f1a2d6c4c8c19354b926367d0e82dcd6386 Author: Matt Coster Date: Fri Nov 21 15:20:31 2025 +0000 drm/imagination: Document pvr_device.power member Automated testing caught this missing doc comment; add something suitable (and useful). Fixes: 330e76d31697 ("drm/imagination: Add power domain control") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20251106152448.453b53ad@canb.auug.org.au/ Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20251121-device-power-doc-fix-v2-1-3417779f36c7@imgtec.com Signed-off-by: Matt Coster commit 752630cb8c62abca0407f96cc7baa2e13335cd15 Author: Sebastian Reichel Date: Wed Nov 19 01:41:41 2025 +0100 platform: arm64: thinkpad-t14s-ec: sleep after EC access The ACPI ECRD and ECWR functions have a 10ms sleep at the end. It turns out, that this is sometimes needed to avoid I2C transmission failures, especially for functions doing regmap_update_bits (and thus read + write shortly after each other). This fixes problems like the following appearing in the kernel log: leds platform::micmute: Setting an LED's brightness failed (-6) leds platform::kbd_backlight: Setting an LED's brightness failed (-6) The ACPI QEVT function used to read the interrupt status register also has a 10ms sleep at the end. Without that there are problems with reading multiple events following directly after each other resulting in the following error message being logged: thinkpad-t14s-ec 4-0028: Failed to read event Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-2-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 29be646f75c4406bdd8322572a6054ebd22bf63b Author: Sebastian Reichel Date: Wed Nov 19 01:41:40 2025 +0100 platform: arm64: thinkpad-t14s-ec: fix IRQ race condition Fix a race condition, that an input key related interrupt might be triggered before the input handler has been registered, which results in a NULL pointer dereference. This can happen if the user enables the keyboard backlight shortly before the driver is being probed. This fixes the following backtrace visible in dmesg: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e0 ... Call trace: sparse_keymap_report_event+0x2c/0x978 [sparse_keymap] (P) t14s_ec_irq_handler+0x190/0x3e8 [lenovo_thinkpad_t14s] irq_thread_fn+0x30/0xb8 irq_thread+0x18c/0x3b0 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Reviewed-by: Bryan O'Donoghue Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-1-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d6732ef4ab252e5753be7acad87b0a91cfd06953 Author: Devarsh Thakkar Date: Thu Oct 30 20:46:35 2025 +0530 drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR The sii902x driver was caching HDMI detection state in a sink_is_hdmi field and checking it in mode_set() to determine whether to set HDMI or DVI output mode. This approach had two problems: 1. With DRM_BRIDGE_ATTACH_NO_CONNECTOR (used by modern display drivers like TIDSS), the bridge's get_modes() is never called. Instead, the drm_bridge_connector helper calls the bridge's edid_read() and updates the connector itself. This meant sink_is_hdmi was never populated, causing the driver to default to DVI mode and breaking HDMI audio. 2. The mode_set() callback doesn't receive atomic state or connector pointer, making it impossible to check connector->display_info.is_hdmi directly at that point. Fix this by moving the HDMI vs DVI decision from mode_set() to atomic_enable(), where we can access the connector via drm_atomic_get_new_connector_for_encoder(). This works for both connector models: - With DRM_BRIDGE_ATTACH_NO_CONNECTOR: Returns the drm_bridge_connector created by the display driver, which has already been updated by the helper's call to drm_edid_connector_update() - Without DRM_BRIDGE_ATTACH_NO_CONNECTOR (legacy): Returns the connector embedded in sii902x struct, which gets updated by the bridge's own get_modes() Fixes: 3de47e1309c2 ("drm/bridge: sii902x: use display info is_hdmi") Signed-off-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251030151635.3019864-1-devarsht@ti.com commit 9f0c21bac5a8089e74b21d007e26fb4594b10d73 Author: Carlos Song Date: Mon Nov 17 11:03:55 2025 +0800 spi: spi-fsl-lpspi: fix watermark truncation caused by type cast 't->len' is an unsigned integer, while 'watermark' and 'txfifosize' are u8. Using min_t with typeof(watermark) forces both values to be cast to u8, which truncates len when it exceeds 255. For example, len = 4096 becomes 0 after casting, resulting in an incorrect watermark value. Use a wider type in min_t to avoid truncation and ensure the correct minimum value is applied. Fixes: a750050349ea ("spi: spi-fsl-lpspi: use min_t() to improve code") Signed-off-by: Carlos Song Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20251117030355.1359081-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 26d56a9fcb2014b99e654127960aa0a48a391e3c Author: Owen Gu Date: Thu Nov 20 20:33:36 2025 +0800 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed. The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed. This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs(). The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete(). Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub") Cc: stable Signed-off-by: Yu Chen Signed-off-by: Owen Gu Acked-by: Oliver Neukum Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com Signed-off-by: Greg Kroah-Hartman commit e4037689a366743c4233966f0e74bc455820d316 Author: Manish Nagar Date: Thu Nov 20 13:14:35 2025 +0530 usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable Suggested-by: Thinh Nguyen Acked-by: Thinh Nguyen Signed-off-by: Manish Nagar Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1f73b8b56cf35de29a433aee7bfff26cea98be3f Author: Łukasz Bartosik Date: Wed Nov 19 21:29:09 2025 +0000 xhci: dbgtty: fix device unregister When DbC is disconnected then xhci_dbc_tty_unregister_device() is called. However if there is any user space process blocked on write to DbC terminal device then it will never be signalled and thus stay blocked indifinitely. This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device(). The tty_vhangup() wakes up any blocked writers and causes subsequent write attempts to DbC terminal device to fail. Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Łukasz Bartosik Link: https://patch.msgid.link/20251119212910.1245694-1-ukaszb@google.com Signed-off-by: Greg Kroah-Hartman commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 Author: Tianchu Chen Date: Sun Nov 16 12:46:18 2025 +0800 usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries. Signed-off-by: Tianchu Chen Cc: stable Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com Signed-off-by: Greg Kroah-Hartman commit 14b46ba92bf547508b4a49370c99aba76cb53b53 Author: Thomas Bogendoerfer Date: Thu Nov 20 13:10:29 2025 +0100 MIPS: kernel: Fix random segmentation faults Commit 69896119dc9d ("MIPS: vdso: Switch to generic storage implementation") switches to a generic vdso storage, which increases the number of data pages from 1 to 4. But there is only one page reserved, which causes segementation faults depending where the VDSO area is randomized to. To fix this use the same size of reservation and allocation of the VDSO data pages. Fixes: 69896119dc9d ("MIPS: vdso: Switch to generic storage implementation") Reviewed-by: Thomas Weißschuh Reviewed-by: Huacai Chen Reviewed-by: Thomas Gleixner Signed-off-by: Thomas Bogendoerfer commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 Author: Maciej W. Rozycki Date: Thu Nov 13 05:21:10 2025 +0000 MIPS: mm: Prevent a TLB shutdown on initial uniquification Depending on the particular CPU implementation a TLB shutdown may occur if multiple matching entries are detected upon the execution of a TLBP or the TLBWI/TLBWR instructions. Given that we don't know what entries we have been handed we need to be very careful with the initial TLB setup and avoid all these instructions. Therefore read all the TLB entries one by one with the TLBR instruction, bypassing the content addressing logic, and truncate any large pages in place so as to avoid a case in the second step where an incoming entry for a large page at a lower address overlaps with a replacement entry chosen at another index. Then preinitialize the TLB using addresses outside our usual unique range and avoiding clashes with any entries received, before making the usual call to local_flush_tlb_all(). This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual address). Signed-off-by: Maciej W. Rozycki Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") Cc: stable@vger.kernel.org Reviewed-by: Jiaxun Yang Tested-by: Jiaxun Yang # Boston I6400, M5150 sim Signed-off-by: Thomas Bogendoerfer commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 Author: Mikulas Patocka Date: Mon Nov 17 21:42:02 2025 +0100 dm-verity: fix unreliable memory allocation GFP_NOWAIT allocation may fail anytime. It needs to be changed to GFP_NOIO. There's no need to handle an error because mempool_alloc with GFP_NOIO can't fail. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Reviewed-by: Eric Biggers commit be4c9abdf04b86bb33f4a2ce59fd7cb64a739c51 Author: Jacob Zhong Date: Fri Nov 21 09:57:12 2025 +0800 ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 The laptop uses ALC287 chip (as shown in /proc/asound/card1/codec#0). It seems that every HP pavilion laptop in the table uses the same quirk, so I just copied them. I have verified that the mute LED on my laptop works with this patch. For reference, here's the alsa-info of my laptop: https://alsa-project.org/db/?f=2d5f297087708610bc01816ab12052abdd4a17c0 Signed-off-by: Jacob Zhong Link: https://patch.msgid.link/tencent_E2DFA33EFDF39E0517A94FA8FF06C05C0709@qq.com Signed-off-by: Takashi Iwai commit 40b53db87c998b36649292a3b0daff4fa65cf481 Merge: 4e9fd472d1b951 5b38c22687d928 Author: Dave Airlie Date: Fri Nov 21 18:33:01 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix out-of-bounds access with BIT() (Shuicheng Lin) - Fix kunit test checking wrong condition (Matt Roper) - Drop duplicate kconfig select (Shuicheng Lin) - Fix guc2host irq handler with MSI-X (Venkata Ramana Nayana) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/uadbrmftcud3wg32c6tje7mmfcr7wgmpnkzxwubk6fletahje2@coek2ciunkvz commit 4e9fd472d1b951abda236cd4099088f8a97a05ac Merge: 201a32e61b5171 c156c7f27ecdb7 Author: Dave Airlie Date: Fri Nov 21 18:19:33 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-20: amdgpu: - DTBCLK gating fix - EDID fetching retry improvements - HDMI HPD debounce filtering - DCN 2.0 cursor fix - DP MST PBN fix - VPE fix - GC 11 fix - PRT fix - MMIO remap page fix - SR-IOV fix radeon: - Fence deadlock fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251120164110.1077973-1-alexander.deucher@amd.com commit 201a32e61b5171e41e6e2839e5053e3ed0192b34 Merge: 9b571b32313f01 cead55e24cf9e0 Author: Dave Airlie Date: Fri Nov 21 17:51:14 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: atomic: - Return error codes on failed blob creation for planes nouveau: - Fix memory leak tegra: - Fix device ref counting - Fix pid ref counting - Revert booting on Pixel C Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251120151308.GA589436@linux.fritz.box commit 9b571b32313f01dd7017562a79df59ef2cdb4ba6 Merge: 6a23ae0a96a600 5474560381775b Author: Dave Airlie Date: Fri Nov 21 17:10:00 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Wildcat Lake and Panther Lake detangled for display fixes (Dnyaneshwar) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aR8jByCwjIThpnpk@intel.com commit a14602fcae17a3f1cb8a8521bedf31728f9e7e39 Author: Jesper Dangaard Brouer Date: Wed Nov 19 17:28:36 2025 +0100 veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance. The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested. Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context. Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct(). Fixes: 401cb7dae8130 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/176356963888.337072.4805242001928705046.stgit@firesoul Signed-off-by: Jakub Kicinski commit 4b4749b7b4b3badabd0fa26f454782842db6ae53 Author: Sayooj K Karun Date: Wed Nov 19 14:27:47 2025 +0530 net: atm: fix incorrect cleanup function call in error path In atm_init(), if atmsvc_init() fails, the code jumps to out_atmpvc_exit label which incorrectly calls atmsvc_exit() instead of atmpvc_exit(). This results in calling the wrong cleanup function and failing to properly clean up atmpvc_init(). Fix this by calling atmpvc_exit() in the out_atmpvc_exit error path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Sayooj K Karun Link: https://patch.msgid.link/20251119085747.67139-1-sayooj@aerlync.com Signed-off-by: Jakub Kicinski commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 Author: Luiz Augusto von Dentz Date: Mon Nov 17 13:45:13 2025 -0500 Bluetooth: SMP: Fix not generating mackey and ltk when repairing The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used") introduced a goto that bypasses the creation of temporary mackey and ltk which are later used by the likes of DHKey Check step. Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for Just Works (LE SC)") which means confirm_hint is always set in case JUST_WORKS so the branch checking for an existing LTK becomes pointless as confirm_hint will always be set, so this just merge both cases of malicious or legitimate devices to be confirmed before continuing with the pairing procedure. Link: https://github.com/bluez/bluez/issues/1622 Fixes: eed467b517e8 ("Bluetooth: fix passkey uninitialized when used") Signed-off-by: Luiz Augusto von Dentz commit c884a0b27b4586e607431d86a1aa0bb4fb39169c Author: Douglas Anderson Date: Thu Nov 20 08:12:28 2025 -0800 Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to: usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM) That function can return NULL in some cases. Even when it returns NULL, though, we still go on to call btusb_mtk_claim_iso_intf(). As of commit e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()"), calling btusb_mtk_claim_iso_intf() when `btmtk_data->isopkt_intf` is NULL will cause a crash because we'll end up passing a bad pointer to device_lock(). Prior to that commit we'd pass the NULL pointer directly to usb_driver_claim_interface() which would detect it and return an error, which was handled. Resolve the crash in btusb_mtk_claim_iso_intf() by adding a NULL check at the start of the function. This makes the code handle a NULL `btmtk_data->isopkt_intf` the same way it did before the problematic commit (just with a slight change to the error message printed). Reported-by: IncogCyberpunk Closes: http://lore.kernel.org/r/a380d061-479e-4713-bddd-1d6571ca7e86@leemhuis.info Fixes: e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()") Cc: stable@vger.kernel.org Tested-by: IncogCyberpunk Signed-off-by: Douglas Anderson Signed-off-by: Luiz Augusto von Dentz commit 79a2d4678ba90bdba577dc3af88cc900d6dcd5ee Author: Pauli Virtanen Date: Sat Nov 15 18:43:55 2025 +0200 Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b ("Bluetooth: convert conn hash to RCU") and not clear if it had purpose since then. Currently, there are code paths that delete hci_conn* from elsewhere than the ordered hdev->workqueue where the RX work runs in. E.g. commit 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync") introduced some of these, and there probably were a few others before it. It's better to do the locking so that even if these run concurrently no UAF is possible. Move the lookup of hci_conn and associated socket-specific conn to protocol recv handlers, and do them within a single critical section to cover hci_conn* usage and lookup. syzkaller has reported a crash that appears to be this issue: [Task hdev->workqueue] [Task 2] hci_disconnect_all_sync l2cap_recv_acldata(hcon) hci_conn_get(hcon) hci_abort_conn_sync(hcon) hci_dev_lock hci_dev_lock hci_conn_del(hcon) v-------------------------------- hci_dev_unlock hci_conn_put(hcon) conn = hcon->l2cap_data (UAF) Fixes: 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync") Reported-by: syzbot+d32d77220b92eddd89ad@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d32d77220b92eddd89ad Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392 Author: Edward Adam Davis Date: Sun Nov 16 17:04:43 2025 +0800 Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314 Fixes: 6fe26f694c82 ("Bluetooth: MGMT: Protect mgmt_pending list with its own lock") Reported-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9aa47cd4633a3cf92a80 Tested-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Luiz Augusto von Dentz commit 275ddfeb3fdc274050c2173ffd985b1e80a9aa37 Author: Luiz Augusto von Dentz Date: Thu Nov 13 09:49:27 2025 -0500 Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP HCI_OP_NOP means no command was actually sent so there is no point in triggering cmd_timer which may cause a hdev->reset in the process since it is assumed that the controller is stuck processing a command. Fixes: e2d471b7806b ("Bluetooth: ISO: Fix not using SID from adv report") Signed-off-by: Luiz Augusto von Dentz commit 4015b979767125cf8a2233a145a3b3af78bfd8fb Author: Chris Lu Date: Wed Nov 12 15:53:34 2025 +0800 Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface When performing reset tests and encountering abnormal card drop issues that lead to a kernel crash, it is necessary to perform a null check before releasing resources to avoid attempting to release a null pointer. <4>[ 29.158070] Hardware name: Google Quigon sku196612/196613 board (DT) <4>[ 29.158076] Workqueue: hci0 hci_cmd_sync_work [bluetooth] <4>[ 29.158154] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) <4>[ 29.158162] pc : klist_remove+0x90/0x158 <4>[ 29.158174] lr : klist_remove+0x88/0x158 <4>[ 29.158180] sp : ffffffc0846b3c00 <4>[ 29.158185] pmr_save: 000000e0 <4>[ 29.158188] x29: ffffffc0846b3c30 x28: ffffff80cd31f880 x27: ffffff80c1bdc058 <4>[ 29.158199] x26: dead000000000100 x25: ffffffdbdc624ea3 x24: ffffff80c1bdc4c0 <4>[ 29.158209] x23: ffffffdbdc62a3e6 x22: ffffff80c6c07000 x21: ffffffdbdc829290 <4>[ 29.158219] x20: 0000000000000000 x19: ffffff80cd3e0648 x18: 000000031ec97781 <4>[ 29.158229] x17: ffffff80c1bdc4a8 x16: ffffffdc10576548 x15: ffffff80c1180428 <4>[ 29.158238] x14: 0000000000000000 x13: 000000000000e380 x12: 0000000000000018 <4>[ 29.158248] x11: ffffff80c2a7fd10 x10: 0000000000000000 x9 : 0000000100000000 <4>[ 29.158257] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 : 2d7223ff6364626d <4>[ 29.158266] x5 : 0000008000000000 x4 : 0000000000000020 x3 : 2e7325006465636e <4>[ 29.158275] x2 : ffffffdc11afeff8 x1 : 0000000000000000 x0 : ffffffdc11be4d0c <4>[ 29.158285] Call trace: <4>[ 29.158290] klist_remove+0x90/0x158 <4>[ 29.158298] device_release_driver_internal+0x20c/0x268 <4>[ 29.158308] device_release_driver+0x1c/0x30 <4>[ 29.158316] usb_driver_release_interface+0x70/0x88 <4>[ 29.158325] btusb_mtk_release_iso_intf+0x68/0xd8 [btusb (HASH:e8b6 5)] <4>[ 29.158347] btusb_mtk_reset+0x5c/0x480 [btusb (HASH:e8b6 5)] <4>[ 29.158361] hci_cmd_sync_work+0x10c/0x188 [bluetooth (HASH:a4fa 6)] <4>[ 29.158430] process_scheduled_works+0x258/0x4e8 <4>[ 29.158441] worker_thread+0x300/0x428 <4>[ 29.158448] kthread+0x108/0x1d0 <4>[ 29.158455] ret_from_fork+0x10/0x20 <0>[ 29.158467] Code: 91343000 940139d1 f9400268 927ff914 (f9401297) <4>[ 29.158474] ---[ end trace 0000000000000000 ]--- <0>[ 29.167129] Kernel panic - not syncing: Oops: Fatal exception <2>[ 29.167144] SMP: stopping secondary CPUs <4>[ 29.167158] ------------[ cut here ]------------ Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 3ded250b97c3ae94a642bc2e710a95700e72dfb0 Author: Paul Moore Date: Tue Nov 18 17:27:58 2025 -0500 selinux: rename the cred_security_struct variables to "crsec" Along with the renaming from task_security_struct to cred_security_struct, rename the local variables to "crsec" from "tsec". This both fits with existing conventions and helps distinguish between task and cred related variables. No functional changes. Acked-by: Stephen Smalley Signed-off-by: Paul Moore commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b Author: Stephen Smalley Date: Thu Nov 13 15:23:14 2025 -0500 selinux: move avdcache to per-task security struct The avdcache is meant to be per-task; move it to a new task_security_struct that is duplicated per-task. Cc: stable@vger.kernel.org Fixes: 5d7ddc59b3d89b724a5aa8f30d0db94ff8d2d93f ("selinux: reduce path walk overhead") Signed-off-by: Stephen Smalley [PM: line length fixes] Signed-off-by: Paul Moore commit 75f72fe289a7f76204a728668edcf20e4a2a6097 Author: Stephen Smalley Date: Thu Nov 13 15:23:13 2025 -0500 selinux: rename task_security_struct to cred_security_struct Before Linux had cred structures, the SELinux task_security_struct was per-task and although the structure was switched to being per-cred long ago, the name was never updated. This change renames it to cred_security_struct to avoid confusion and pave the way for the introduction of an actual per-task security structure for SELinux. No functional change. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit fd95357fd8c6778ac7dea6c57a19b8b182b6e91f Merge: c966813ea1206a 7b6216baae7513 Author: Linus Torvalds Date: Thu Nov 20 11:04:37 2025 -0800 Merge tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fix from Tejun Heo: "One low risk and obvious fix: scx_enable() was dereferencing an error pointer on helper kthread creation failure. Fixed" * tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix scx_enable() crash on helper kthread creation failure commit a612d24e850b28c16384cf071636034935447e43 Author: Mikulas Patocka Date: Thu Nov 20 12:08:47 2025 +0100 dm: fix failure when empty flush's bi_sector points beyond the device end An empty flush bio can have arbitrary bi_sector. The commit 2b1c6d7a890a introduced a regression that device mapper would fail an empty flush bio with -EIO if the sector pointed beyond the end of the device. The commit introduced an optimization, that optimization would pass flushes to __split_and_process_bio and __split_and_process_bio is not prepared to handle empty bios. Fix this bug by passing only non-empty flushes to __split_and_process_bio - non-empty flushes must have valid bi_sector. Empty bios will go through __send_empty_flush, as they did before the optimization. This problem can be reproduced by running the lvm2 test: make check_local T=lvconvert-thin.sh LVM_TEST_PREFER_BRD=0 Signed-off-by: Mikulas Patocka Fixes: 2b1c6d7a890a ("dm: optimize REQ_PREFLUSH with data when using the linear target") Reported-by: Zdenek Kabelac Reviewed-by: Bart Van Assche commit c966813ea1206abc50a4447cb05cd7419e506806 Merge: 07e09c32330c5a ec33b59542d968 Author: Linus Torvalds Date: Thu Nov 20 10:49:12 2025 -0800 Merge tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix mempool poisoning order>0 pages with CONFIG_HIGHMEM (Vlastimil Babka) * tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/mempool: fix poisoning order>0 pages with HIGHMEM commit 7b6216baae751369195fa3c83d434d23bcda406a Author: Saket Kumar Bhaskar Date: Wed Nov 19 16:07:22 2025 +0530 sched_ext: Fix scx_enable() crash on helper kthread creation failure A crash was observed when the sched_ext selftests runner was terminated with Ctrl+\ while test 15 was running: NIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0 LR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0 Call Trace: scx_enable.constprop.0+0x32c/0x12b0 (unreliable) bpf_struct_ops_link_create+0x18c/0x22c __sys_bpf+0x23f8/0x3044 sys_bpf+0x2c/0x6c system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec kthread_run_worker() returns an ERR_PTR() on failure rather than NULL, but the current code in scx_alloc_and_add_sched() only checks for a NULL helper. Incase of failure on SIGQUIT, the error is not handled in scx_alloc_and_add_sched() and scx_enable() ends up dereferencing an error pointer. Error handling is fixed in scx_alloc_and_add_sched() to propagate PTR_ERR() into ret, so that scx_enable() jumps to the existing error path, avoiding random dereference on failure. Fixes: bff3b5aec1b7 ("sched_ext: Move disable machinery into scx_sched") Cc: stable@vger.kernel.org # v6.16+ Reported-and-tested-by: Samir Mulani Signed-off-by: Saket Kumar Bhaskar Reviewed-by: Emil Tsalapatis Reviewed-by: Andrea Righi Reviewed-by: Vishal Chourasia Signed-off-by: Tejun Heo commit 46447367a52965e9d35f112f5b26fc8ff8ec443d Author: Jens Axboe Date: Thu Nov 20 11:40:15 2025 -0700 io_uring/cmd_net: fix wrong argument types for skb_queue_splice() If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the socket queue. However, the arguments for the splice helper are transposed, causing exactly the wrong direction of splicing into the on-stack list. Fix that up. Cc: stable@vger.kernel.org Reported-by: Google Big Sleep Fixes: 9e4ed359b8ef ("io_uring/netcmd: add tx timestamping cmd support") Signed-off-by: Jens Axboe commit 07e09c32330c5ad2864b2d52ce6a33e1963ebfcb Merge: 1753d40dce2023 f384497a76ed95 Author: Linus Torvalds Date: Thu Nov 20 09:46:52 2025 -0800 Merge tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a regression introduced during the 6.16 development cycle that may cause runtime PM to be enabled by mistake for devices that do not support it (which may lead to some serious trouble) if there is a system wakeup event during the "late suspend" phase of system suspend" * tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: core: Fix runtime PM enabling in device_resume_early() commit 1753d40dce2023405cafd9e3bec169674ed99e2d Merge: 6ba3bb334835ee d2932a59c2d4fb Author: Linus Torvalds Date: Thu Nov 20 09:44:27 2025 -0800 Merge tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "This fixes EINJV2 support introduced during the 6.17 cycle by unbreaking the initialization broken by a previous attempted fix, adding sanity checks for data coming from the platform firmware, and updating the code to handle injecting legacy error types on an EINJV2 capable systems properly (Tony Luck)" * tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: APEI: EINJ: Fix EINJV2 initialization and injection commit 6ba3bb334835eeca7e2bd2db4c9dbb0343ebff4f Merge: 8e621c9a337555 db30233361f94e Author: Linus Torvalds Date: Thu Nov 20 09:39:34 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "This one has lots of new HW entries which adds to the size in diffstat but the individual changes are simple. Fixes - acer-wmi: Ignore backlight event - alienware-wmi-wmax: Fix quirk match table order & drop redundant entries - amd/pmc: - Add Xbox Ally to spurious 8042 quirk list - Quirk list Lenovo Legion Go 2 NVMe resume - msi-wmi-platform: - Correct GUID to uppercase - GUID is uncleverly copy-pasted from an example so add a DMI whitelist - intel/speed_select_if: PCIBIOS_* return code conversion - intel-uncore-freq & ISST: Fix kernel doc warnings New HW support - alienware-wmi-wmax: - Alienware 16 Aurora support - Alienware M support - Alienware X support - Dell G support - amd/pmc: - ROG Xbox Ally (non-X) support - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys - hp-wmi: - Omen 16-wf1xxx fan support - Omen MAX 16-ah0xx fan + thermal profile support - Victus 16-r0 and 16-s0 fan + thermal profile support - intel/hid: Intel Nova Lake support - intel-uncore-freq: - Intel Panther Lake support - Intel Wildcat Lake support - Intel Nova Lake support" * tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits) platform/x86: intel-uncore-freq: fix all header kernel-doc warnings platform/x86: acer-wmi: Ignore backlight event platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos platform/x86/intel/hid: Add Nova Lake support platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile platform/x86: msi-wmi-platform: Fix typo in WMI GUID platform/x86: msi-wmi-platform: Only load on MSI devices platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally platform/x86/amd/pmc: Add support for Van Gogh SoC platform/x86: alienware-wmi-wmax: Add support for the whole "G" family platform/x86: alienware-wmi-wmax: Add support for the whole "X" family platform/x86: alienware-wmi-wmax: Add support for the whole "M" family platform/x86: alienware-wmi-wmax: Drop redundant DMI entries platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order platform/x86: ISST: isst_if.h: fix all kernel-doc warnings platform/x86: intel-uncore-freq: Add additional client processors platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support platform/x86: huawei-wmi: add keys for HONOR models ... commit 8e621c9a337555c914cf1664605edfaa6f839774 Merge: 23cb64fb762573 002541ef650b74 Author: Linus Torvalds Date: Thu Nov 20 08:52:07 2025 -0800 Merge tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from IPsec and wireless. Previous releases - regressions: - prevent NULL deref in generic_hwtstamp_ioctl_lower(), newer APIs don't populate all the pointers in the request - phylink: add missing supported link modes for the fixed-link - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr Previous releases - always broken: - openvswitch: remove never-working support for setting NSH fields - xfrm: number of fixes for error paths of xfrm_state creation/ modification/deletion - xfrm: fixes for offload - fix the determination of the protocol of the inner packet - don't push locally generated packets directly to L2 tunnel mode offloading, they still need processing from the standard xfrm path - mptcp: fix a couple of corner cases in fallback and fastclose handling - wifi: rtw89: hw_scan: prevent connections from getting stuck, work around apparent bug in FW by tweaking messages we send - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait - veth: more robust handing of race to avoid txq getting stuck - eth: ps3_gelic_net: handle skb allocation failures" * tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) vsock: Ignore signal/timeout on connect() if already established be2net: pass wrb_params in case of OS2BMC l2tp: reset skb control buffer on xmit net: dsa: microchip: lan937x: Fix RGMII delay tuning selftests: mptcp: add a check for 'add_addr_accepted' mptcp: fix address removal logic in mptcp_pm_nl_rm_addr selftests: mptcp: join: userspace: longer timeout selftests: mptcp: join: endpoints: longer timeout selftests: mptcp: join: fastclose: remove flaky marks mptcp: fix duplicate reset on fastclose mptcp: decouple mptcp fastclose from tcp close mptcp: do not fallback when OoO is present mptcp: fix premature close in case of fallback mptcp: avoid unneeded subflow-level drops mptcp: fix ack generation for fallback msk wifi: rtw89: hw_scan: Don't let the operating channel be last net: phylink: add missing supported link modes for the fixed-link selftest: af_unix: Add test for SO_PEEK_OFF. af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). net/mlx5: Clean up only new IRQ glue on request_irq() failure ... commit 7b5ab04f035f829ed6008e4685501ec00b3e73c9 Author: Malaya Kumar Rout Date: Thu Nov 20 20:32:13 2025 +0530 timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths tk_aux_sysfs_init() returns immediately on error during the auxiliary clock initialization loop without cleaning up previously allocated kobjects and sysfs groups. If kobject_create_and_add() or sysfs_create_group() fails during loop iteration, the parent kobjects (tko and auxo) and any previously created child kobjects are leaked. Fix this by adding proper error handling with goto labels to ensure all allocated resources are cleaned up on failure. kobject_put() on the parent kobjects will handle cleanup of their children. Fixes: 7b95663a3d96 ("timekeeping: Provide interface to control auxiliary clocks") Signed-off-by: Malaya Kumar Rout Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251120150213.246777-1-mrout@redhat.com commit 002541ef650b742a198e4be363881439bb9d86b4 Author: Michal Luczaj Date: Wed Nov 19 15:02:59 2025 +0100 vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/ Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251119-vsock-interrupted-connect-v2-1-70734cf1233f@rbox.co Signed-off-by: Jakub Kicinski commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 Author: Andrey Vatoropin Date: Wed Nov 19 10:51:12 2025 +0000 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states. The correct way would be to pass the wrb_params from be_xmit(). Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru Signed-off-by: Jakub Kicinski commit 49c2d5941c89060342c65997de91859e5830dee5 Merge: 8f05967b022d25 0a2c5495b6d1ec Author: Jens Axboe Date: Thu Nov 20 08:39:17 2025 -0700 Merge tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.18 - Admin queue use-after-free fix (Keith) - Target authentication fix (Alistar) - Multipath lockdeup fix (Shin'ichiro) - FC transport teardown fixes (Ewan)" * tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() nvme-multipath: fix lockdep WARN due to partition scan work nvmet-auth: update sc_c in target host hash calculation nvme: fix admin request_queue lifetime commit 91842ed844a068a41a38f97a1ac5535b909279cd Author: Niklas Cassel Date: Wed Nov 19 15:13:15 2025 +0100 ata: libata-core: Set capacity to zero for a security locked drive For Security locked drives (drives that have Security enabled, and have not been Security unlocked by boot firmware), the automatic partition scanning will result in the user being spammed with errors such as: ata5.00: failed command: READ DMA ata5.00: cmd c8/00:08:00:00:00/00:00:00:00:00/e0 tag 7 dma 4096 in res 51/04:08:00:00:00/00:00:00:00:00/e0 Emask 0x1 (device error) ata5.00: status: { DRDY ERR } ata5.00: error: { ABRT } sd 4:0:0:0: [sda] tag#7 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 4:0:0:0: [sda] tag#7 Sense Key : Aborted Command [current] sd 4:0:0:0: [sda] tag#7 Add. Sense: No additional sense information during boot, because most commands except for IDENTIFY will be aborted by a Security locked drive. For a Security locked drive, set capacity to zero, so that no automatic partition scanning will happen. If the user later unlocks the drive using e.g. hdparm, the close() by the user space application should trigger a revalidation of the drive. Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit b11890683380a36b8488229f818d5e76e8204587 Author: Niklas Cassel Date: Wed Nov 19 15:13:14 2025 +0100 ata: libata-scsi: Fix system suspend for a security locked drive Commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") fixed ata_to_sense_error() to properly generate sense key ABORTED COMMAND (without any additional sense code), instead of the previous bogus sense key ILLEGAL REQUEST with the additional sense code UNALIGNED WRITE COMMAND, for a failed command. However, this broke suspend for Security locked drives (drives that have Security enabled, and have not been Security unlocked by boot firmware). The reason for this is that the SCSI disk driver, for the Synchronize Cache command only, treats any sense data with sense key ILLEGAL REQUEST as a successful command (regardless of ASC / ASCQ). After commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") the code that treats any sense data with sense key ILLEGAL REQUEST as a successful command is no longer applicable, so the command fails, which causes the system suspend to be aborted: sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5 sd 1:0:0:0: PM: failed to suspend async: error -5 PM: Some devices failed to suspend, or early wake event detected To make suspend work once again, for a Security locked device only, return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense data which a real SCSI device would have returned if locked. The SCSI disk driver treats this sense data as a successful command. Cc: stable@vger.kernel.org Reported-by: Ilia Baryshnikov Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704 Fixes: cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit b32cc17d607e8ae7af037303fe101368cb4dc44c Author: Yihang Li Date: Thu Nov 20 11:50:23 2025 +0800 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its queue are not running. Fixes: 0c76106cb975 ("scsi: sd: Fix TCG OPAL unlock on system resume") Cc: stable@vger.kernel.org Signed-off-by: Yihang Li Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit dc9e7e652f8d9220aaae35ecf2f71931d9e0fdc9 Merge: d70b592551ff23 0ff8eeafba5c57 Author: Paolo Abeni Date: Thu Nov 20 13:02:00 2025 +0100 Merge tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== wireless-2025-11-20 A single fix for scanning on some rtw89 devices. * tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: rtw89: hw_scan: Don't let the operating channel be last ==================== Link: https://patch.msgid.link/20251120085433.8601-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit d70b592551ff23747e26e74081205babf8dba9b6 Author: David Bauer Date: Tue Nov 18 01:16:18 2025 +0100 l2tp: reset skb control buffer on xmit The L2TP stack did not reset the skb control buffer before sending the encapsulated package. In a setup with an ath10k radio and batman-adv over an L2TP tunnel massive fragmentations happen sporadically if the L2TP tunnel is established over IPv4. L2TP might reset some of the fields in the IP control buffer, but L2TP assumes the type of the control buffer to be of an IPv4 packet. In case the L2TP interface is used as a batadv hardif or the packet is an IPv6 packet, this assumption breaks. Clear the entire control buffer to avoid such mishaps altogether. Fixes: f77ae9390438 ("[PPPOL2TP]: Reset meta-data in xmit function") Signed-off-by: David Bauer Link: https://patch.msgid.link/20251118001619.242107-1-mail@david-bauer.net Signed-off-by: Paolo Abeni commit 3ceb6ac2116ecda1c5d779bb73271479e70fccb4 Author: Oleksij Rempel Date: Fri Nov 14 10:09:51 2025 +0100 net: dsa: microchip: lan937x: Fix RGMII delay tuning Correct RGMII delay application logic in lan937x_set_tune_adj(). The function was missing `data16 &= ~PORT_TUNE_ADJ` before setting the new delay value. This caused the new value to be bitwise-OR'd with the existing PORT_TUNE_ADJ field instead of replacing it. For example, when setting the RGMII 2 TX delay on port 4, the intended TUNE_ADJUST value of 0 (RGMII_2_TX_DELAY_2NS) was incorrectly OR'd with the default 0x1B (from register value 0xDA3), leaving the delay at the wrong setting. This patch adds the missing mask to clear the field, ensuring the correct delay value is written. Physical measurements on the RGMII TX lines confirm the fix, showing the delay changing from ~1ns (before change) to ~2ns. While testing on i.MX 8MP showed this was within the platform's timing tolerance, it did not match the intended hardware-characterized value. Fixes: b19ac41faa3f ("net: dsa: microchip: apply rgmii tx and rx delay in phylink mac config") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20251114090951.4057261-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 678e1cc2f482e0985a0613ab4a5bf89c497e5acc Author: Darrick J. Wong Date: Wed Nov 12 08:35:18 2025 -0800 xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110 Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpy_orig+0x54/0x110 xrep_symlink_salvage_inline+0xb3/0xf0 [xfs] xrep_symlink_salvage+0x100/0x110 [xfs] xrep_symlink+0x2e/0x80 [xfs] xrep_attempt+0x61/0x1f0 [xfs] xfs_scrub_metadata+0x34f/0x5c0 [xfs] xfs_ioc_scrubv_metadata+0x387/0x560 [xfs] xfs_file_ioctl+0xe23/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128 allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfs_init_local_fork+0x79/0xe0 [xfs] xfs_iformat_local+0xa4/0x170 [xfs] xfs_iformat_data_fork+0x148/0x180 [xfs] xfs_inode_from_disk+0x2cd/0x480 [xfs] xfs_iget+0x450/0xd60 [xfs] xfs_bulkstat_one_int+0x6b/0x510 [xfs] xfs_bulkstat_iwalk+0x1e/0x30 [xfs] xfs_iwalk_ag_recs+0xdf/0x150 [xfs] xfs_iwalk_run_callbacks+0xb9/0x190 [xfs] xfs_iwalk_ag+0x1dc/0x2f0 [xfs] xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs] xfs_iwalk+0xa4/0xd0 [xfs] xfs_bulkstat+0xfa/0x170 [xfs] xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs] xfs_file_ioctl+0xbf2/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ================================================================== On further analysis, I realized that the second parameter to min() is not correct. xfs_ifork::if_bytes is the size of the xfs_ifork::if_data buffer. if_bytes can be smaller than the data fork size because: (a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, if_bytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8. Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long. In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that. Cc: stable@vger.kernel.org # v6.10 Fixes: 2651923d8d8db0 ("xfs: online repair of symbolic links") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit f1f96511b1c4c33e53f05909dd267878e0643a9a Author: Dapeng Mi Date: Wed Nov 12 16:05:26 2025 +0800 perf: Fix 0 count issue of cpu-clock Currently cpu-clock event always returns 0 count, e.g., perf stat -e cpu-clock -- sleep 1 Performance counter stats for 'sleep 1': 0 cpu-clock # 0.000 CPUs utilized 1.002308394 seconds time elapsed The root cause is the commit 'bc4394e5e79c ("perf: Fix the throttle error of some clock events")' adds PERF_EF_UPDATE flag check before calling cpu_clock_event_update() to update the count, however the PERF_EF_UPDATE flag is never set when the cpu-clock event is stopped in counting mode (pmu->dev() -> cpu_clock_event_del() -> cpu_clock_event_stop()). This leads to the cpu-clock event count is never updated. To fix this issue, force to set PERF_EF_UPDATE flag for cpu-clock event just like what task-clock does. Fixes: bc4394e5e79c ("perf: Fix the throttle error of some clock events") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Link: https://patch.msgid.link/20251112080526.3971392-1-dapeng1.mi@linux.intel.com commit d5227c88174c384d83d9176bd4315ef13dce306c Author: David Howells Date: Fri Oct 24 16:33:43 2025 +0100 cifs: Add the smb3_read_* tracepoints to SMB1 Add the smb3_read_* tracepoints to SMB1's cifs_async_readv() and cifs_readv_callback(). Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 7e4d9120cfa413dd34f4f434befc5dbe6c38b2e5 Author: Shaurya Rane Date: Tue Nov 18 20:32:57 2025 +0530 cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents(). Pointers are also set to NULL after freeing to prevent potential double-free issues. This change fixes a memory leak originally detected by syzbot. The leak occurred when processing Opt_source mount options if an error happened after ctx->source and fc->source were successfully allocated but before the function completed. The specific leak sequence was: 1. ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory 2. fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory 3. A subsequent error jumps to cifs_parse_mount_err 4. The old error handler freed passwords but not the source strings, causing the memory to leak. This issue was not addressed by commit e8c73eb7db0a ("cifs: client: fix memory leak in smb3_fs_context_parse_param"), which only fixed leaks from repeated fsconfig() calls but not this error path. Patch updated with minor change suggested by kernel test robot Reported-by: syzbot+87be6809ed9bf6d718e3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=87be6809ed9bf6d718e3 Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") Reviewed-by: David Howells Signed-off-by: Shaurya Rane Signed-off-by: Steve French commit a9d1f38df7ecd0e21233447c9cc6fa1799eddaf3 Author: Henrique Carvalho Date: Thu Nov 13 15:09:13 2025 -0300 smb: client: introduce close_cached_dir_locked() Replace close_cached_dir() calls under cfid_list_lock with a new close_cached_dir_locked() variant that uses kref_put() instead of kref_put_lock() to avoid recursive locking when dropping references. While the existing code works if the refcount >= 2 invariant holds, this area has proven error-prone. Make deadlocks impossible and WARN on invariant violations. Cc: stable@vger.kernel.org Reviewed-by: David Howells Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 0ff8eeafba5c5742effb9e2cfdb52daa17b1b7d7 Merge: d0309c054362a2 e837b9091b277a Author: Johannes Berg Date: Thu Nov 20 09:43:24 2025 +0100 Merge tag 'rtw-2025-11-20' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw patches for v6.18-rc7 Fix firmware goes wrong and causes device unusable after scanning. This issue presents under certain regulatory domain reported from end users. ================== Link: https://patch.msgid.link/8217bee0-96c4-44c1-9593-2e9ca12eccc5@RTKEXHMBS03.realtek.com.tw Signed-off-by: Johannes Berg commit 677e6123e3d24adaa252697dc89740f2ac07664e Author: Vincent Li Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: BPF: Disable trampoline for kernel module function trace The current LoongArch BPF trampoline implementation is incompatible with tracing functions in kernel modules. This causes several severe and user-visible problems: * The `bpf_selftests/module_attach` test fails consistently. * Kernel lockup when a BPF program is attached to a module function [1]. * Critical kernel modules like WireGuard experience traffic disruption when their functions are traced with fentry [2]. Given the severity and the potential for other unknown side-effects, it is safest to disable the feature entirely for now. This patch prevents the BPF subsystem from allowing trampoline attachments to kernel module functions on LoongArch. This is a temporary mitigation until the core issues in the trampoline code for kernel module handling can be identified and fixed. [root@fedora bpf]# ./test_progs -a module_attach -v bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_module_attach:PASS:skel_open 0 nsec test_module_attach:PASS:set_attach_target 0 nsec test_module_attach:PASS:set_attach_target_explicit 0 nsec test_module_attach:PASS:skel_load 0 nsec libbpf: prog 'handle_fentry': failed to attach: -ENOTSUPP libbpf: prog 'handle_fentry': failed to auto-attach: -ENOTSUPP test_module_attach:FAIL:skel_attach skeleton attach failed: -524 Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED Successfully unloaded bpf_testmod.ko. [1]: https://lore.kernel.org/loongarch/CAK3+h2wDmpC-hP4u4pJY8T-yfKyk4yRzpu2LMO+C13FMT58oqQ@mail.gmail.com/ [2]: https://lore.kernel.org/loongarch/CAK3+h2wYcpc+OwdLDUBvg2rF9rvvyc5amfHT-KcFaK93uoELPg@mail.gmail.com/ Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Acked-by: Hengqi Chen Signed-off-by: Vincent Li Signed-off-by: Huacai Chen commit a6b533adfc05ba15360631e019d3e18275080275 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Don't panic if no valid cache info for PCI If there is no valid cache info detected (may happen in virtual machine) for pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI core it will be evaluated to (L1_CACHE_BYTES >> 2). Cc: Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Mask all interrupts during kexec/kdump If the default state of the interrupt controllers in the first kernel don't mask any interrupts, it may cause the second kernel to potentially receive interrupts (which were previously allocated by the first kernel) immediately after a CPU becomes online during its boot process. These interrupts cannot be properly routed, leading to bad IRQ issues. This patch calls machine_kexec_mask_interrupts() to mask all interrupts during the kexec/kdump process. Signed-off-by: Tianyang Zhang Signed-off-by: Huacai Chen commit acf5de1b23b0275eb69f235c8e9f2cef19fa39a1 Author: Bibo Mao Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Fix NUMA node parsing with numa_memblks On physical machine, NUMA node id comes from high bit 44:48 of physical address. However it is not true on virt machine. With general method, it comes from ACPI SRAT table. Here the common function numa_memblks_init() is used to parse NUMA node information with numa_memblks. Cc: Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1c004609fdefb48888ef98bc6e3b8fe78ae4e088 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Consolidate CPU names in /proc/cpuinfo Some processors have no IOCSR.VENDOR and IOCSR.CPUNAME, some processors have these registers but there is no valid information. Consolidate CPU names in /proc/cpuinfo: 1. Add "PRID" to display the PRID & Core-Name; 2. Let "Model Name" display "Unknown" if no valid name. Signed-off-by: Huacai Chen commit 20d7338f2d3bcb570068dd6d39b16f1a909fe976 Author: Thomas Weißschuh Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Use UAPI types in ptrace UAPI header The kernel UAPI headers already contain fixed-width integer types, there is no need to rely on the libc types. There may not be a libc available or the libc may not provides the , like for example on nolibc. This also aligns the header with the rest of the LoongArch UAPI headers. Fixes: 803b0fc5c3f2 ("LoongArch: Add process management") Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit f170b1dc26535d64442416babf380c17d967a5b2 Merge: 4026310a042c6e 23a5b9b12de9dc Author: Jakub Kicinski Date: Wed Nov 19 20:10:53 2025 -0800 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-11-18 (idpf, ice) This series contains updates to idpf and ice drivers. Emil adds a check for NULL vport_config during removal to avoid NULL pointer dereference in idpf. Grzegorz fixes PTP teardown paths to account for some missed cleanups for ice driver. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: fix PTP cleanup on driver removal in error path idpf: fix possible vport_config NULL pointer deref in remove ==================== Link: https://patch.msgid.link/20251118235207.2165495-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4026310a042c6ea501db745b7f0f676687967045 Merge: e31a11be41cd13 0eee0fdf9b7b0b Author: Jakub Kicinski Date: Wed Nov 19 20:07:18 2025 -0800 Merge branch 'mptcp-misc-fixes-for-v6-18-rc7' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.18-rc7 Here are various unrelated fixes: - Patch 1: Fix window space computation for fallback connections which can affect ACK generation. A fix for v5.11. - Patch 2: Avoid unneeded subflow-level drops due to unsynced received window. A fix for v5.11. - Patch 3: Avoid premature close for fallback connections with PREEMPT kernels. A fix for v5.12. - Patch 4: Reset instead of fallback in case of data in the MPTCP out-of-order queue. A fix for v5.7. - Patches 5-7: Avoid also sending "plain" TCP reset when closing with an MP_FASTCLOSE. A fix for v6.1. - Patches 8-9: Longer timeout for background connections in MPTCP Join selftests. An additional fix for recent patches for v5.13/v6.1. - Patches 10-11: Fix typo in a check introduce in a recent refactoring. A fix for v6.15. ==================== Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-0-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 0eee0fdf9b7b0baf698f9b426384aa9714d76a51 Author: Gang Yan Date: Tue Nov 18 08:20:29 2025 +0100 selftests: mptcp: add a check for 'add_addr_accepted' The previous patch fixed an issue with the 'add_addr_accepted' counter. This was not spot by the test suite. Check this counter and 'add_addr_signal' in MPTCP Join 'delete re-add signal' test. This should help spotting similar regressions later on. These counters are crucial for ensuring the MPTCP path manager correctly handles the subflow creation via 'ADD_ADDR'. Signed-off-by: Gang Yan Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-11-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 92e239e36d600002559074994a545fcfac9afd2d Author: Gang Yan Date: Tue Nov 18 08:20:28 2025 +0100 mptcp: fix address removal logic in mptcp_pm_nl_rm_addr Fix inverted WARN_ON_ONCE condition that prevented normal address removal counter updates. The current code only executes decrement logic when the counter is already 0 (abnormal state), while normal removals (counter > 0) are ignored. Signed-off-by: Gang Yan Fixes: 636113918508 ("mptcp: pm: remove '_nl' from mptcp_pm_nl_rm_addr_received") Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-10-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 0e4ec14dc1ee4b1ec347729c225c3ca950f2bcf6 Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:27 2025 +0100 selftests: mptcp: join: userspace: longer timeout In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications. To play it safe, all userspace tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes. The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments. Fixes: 290493078b96 ("selftests: mptcp: join: userspace: longer transfer") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Geliang Tang Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-9-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit fb13c6bb810ca871964e062cf91882d1c83db509 Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:26 2025 +0100 selftests: mptcp: join: endpoints: longer timeout In rare cases, when the test environment is very slow, some endpoints tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications. To play it safe, all endpoints tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes. The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments. Fixes: 6457595db987 ("selftests: mptcp: join: endpoints: longer transfer") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Geliang Tang Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-8-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit efff6cd53ac52827948298043270bb81ff17fdff Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:25 2025 +0100 selftests: mptcp: join: fastclose: remove flaky marks After recent fixes like the parent commit, and "selftests: mptcp: connect: trunc: read all recv data", the two fastclose subtests no longer look flaky any more. It then feels fine to remove these flaky marks, to no longer ignore these subtests in case of errors. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-7-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit ae155060247be8dcae3802a95bd1bdf93ab3215d Author: Paolo Abeni Date: Tue Nov 18 08:20:24 2025 +0100 mptcp: fix duplicate reset on fastclose The CI reports sporadic failures of the fastclose self-tests. The root cause is a duplicate reset, not carrying the relevant MPTCP option. In the failing scenario the bad reset is received by the peer before the fastclose one, preventing the reception of the latter. Indeed there is window of opportunity at fastclose time for the following race: mptcp_do_fastclose __mptcp_close_ssk __tcp_close() tcp_set_state() [1] tcp_send_active_reset() [2] After [1] the stack will send reset to in-flight data reaching the now closed port. Such reset may race with [2]. Address the issue explicitly sending a single reset on fastclose before explicitly moving the subflow to close status. Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/596 Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-6-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit fff0c87996672816a84c3386797a5e69751c5888 Author: Paolo Abeni Date: Tue Nov 18 08:20:23 2025 +0100 mptcp: decouple mptcp fastclose from tcp close With the current fastclose implementation, the mptcp_do_fastclose() helper is in charge of two distinct actions: send the fastclose reset and cleanup the subflows. Formally decouple the two steps, ensuring that mptcp explicitly closes all the subflows after the mentioned helper. This will make the upcoming fix simpler, and allows dropping the 2nd argument from mptcp_destroy_common(). The Fixes tag is then the same as in the next commit to help with the backports. Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-5-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 Author: Paolo Abeni Date: Tue Nov 18 08:20:22 2025 +0100 mptcp: do not fallback when OoO is present In case of DSS corruption, the MPTCP protocol tries to avoid the subflow reset if fallback is possible. Such corruptions happen in the receive path; to ensure fallback is possible the stack additionally needs to check for OoO data, otherwise the fallback will break the data stream. Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 Author: Paolo Abeni Date: Tue Nov 18 08:20:21 2025 +0100 mptcp: fix premature close in case of fallback I'm observing very frequent self-tests failures in case of fallback when running on a CONFIG_PREEMPT kernel. The root cause is that subflow_sched_work_if_closed() closes any subflow as soon as it is half-closed and has no incoming data pending. That works well for regular subflows - MPTCP needs bi-directional connectivity to operate on a given subflow - but for fallback socket is race prone. When TCP peer closes the connection before the MPTCP one, subflow_sched_work_if_closed() will schedule the MPTCP worker to gracefully close the subflow, and shortly after will do another schedule to inject and process a dummy incoming DATA_FIN. On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the fallback subflow before subflow_sched_work_if_closed() is able to create the dummy DATA_FIN, unexpectedly interrupting the transfer. Address the issue explicitly avoiding closing fallback subflows on when the peer is only half-closed. Note that, when the subflow is able to create the DATA_FIN before the worker invocation, the worker will change the msk state before trying to close the subflow and will skip the latter operation as the msk will not match anymore the precondition in __mptcp_close_subflow(). Fixes: f09b0ad55a11 ("mptcp: close subflow when receiving TCP+FIN") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-3-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 Author: Paolo Abeni Date: Tue Nov 18 08:20:20 2025 +0100 mptcp: avoid unneeded subflow-level drops The rcv window is shared among all the subflows. Currently, MPTCP sync the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time. The above means that incoming data may sporadically observe outdated TCP-level rcv window and being wrongly dropped by TCP. Address the issue checking for the edge condition before queuing the data at TCP level, and eventually syncing the rcv window as needed. Note that the issue is actually present from the very first MPTCP implementation, but backports older than the blamed commit below will range from impossible to useless. Before: $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 14 0.0 After: $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 0 0.0 Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-2-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b Author: Paolo Abeni Date: Tue Nov 18 08:20:19 2025 +0100 mptcp: fix ack generation for fallback msk mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level rcv_wnd sent, and such information is tracked into the msk->old_wspace field, updated at ack transmission time by mptcp_write_options(). Fallback socket do not add any mptcp options, such helper is never invoked, and msk->old_wspace value remain stale. That in turn makes ack generation at recvmsg() time quite random. Address the issue ensuring mptcp_write_options() is invoked even for fallback sockets, and just update the needed info in such a case. The issue went unnoticed for a long time, as mptcp currently overshots the fallback socket receive buffer autotune significantly. It is going to change in the near future. Fixes: e3859603ba13 ("mptcp: better msk receive window updates") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/594 Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-1-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 90449f2d1e1f020835cba5417234636937dd657e Author: Bart Van Assche Date: Thu Nov 13 10:16:43 2025 -0800 scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled. Reported-by: syzbot+c01f8e6e73f20459912e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google.com/ Cc: Hannes Reinecke Cc: stable@vger.kernel.org Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit e837b9091b277ae6f309d7e9fc93cb0308cf461f Author: Bitterblue Smith Date: Fri Nov 14 00:54:48 2025 +0200 wifi: rtw89: hw_scan: Don't let the operating channel be last Scanning can be offloaded to the firmware. To that end, the driver prepares a list of channels to scan, including periodic visits back to the operating channel, and sends the list to the firmware. When the channel list is too long to fit in a single H2C message, the driver splits the list, sends the first part, and tells the firmware to scan. When the scan is complete, the driver sends the next part of the list and tells the firmware to scan. When the last channel that fit in the H2C message is the operating channel something seems to go wrong in the firmware. It will acknowledge receiving the list of channels but apparently it will not do anything more. The AP can't be pinged anymore. The driver still receives beacons, though. One way to avoid this is to split the list of channels before the operating channel. Affected devices: * RTL8851BU with firmware 0.29.41.3 * RTL8832BU with firmware 0.29.29.8 * RTL8852BE with firmware 0.29.29.8 The commit 57a5fbe39a18 ("wifi: rtw89: refactor flow that hw scan handles channel list") is found by git blame, but it is actually to refine the scan flow, but not a culprit, so skip Fixes tag. Reported-by: Bitterblue Smith Closes: https://lore.kernel.org/linux-wireless/0abbda91-c5c2-4007-84c8-215679e652e1@gmail.com/ Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c1e61744-8db4-4646-867f-241b47d30386@gmail.com commit 295fe8406a357bc0abb901a21d1a554fd4dd1d05 Author: Siddharth Vadapalli Date: Wed Nov 19 20:53:53 2025 +0530 spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm Commit f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") relocated code but missed updating the error handling path associated with it. Prior to the relocation, runtime pm was enabled after the code-block associated with 'cqspi_request_mmap_dma()', due to which, the error handling for the same didn't require invoking 'pm_runtime_disable()'. Post refactoring, runtime pm has been enabled before the code-block and when an error is encountered, jumping to 'probe_dma_failed' doesn't invoke 'pm_runtime_disable()'. This leads to a race condition wherein 'cqspi_runtime_suspend()' is invoked while the error handling path executes in parallel. The resulting error is the following: clk:103:0 already disabled WARNING: drivers/clk/clk.c:1188 at clk_core_disable+0x80/0xa0, CPU#1: kworker/u8:0/12 [TRIMMED] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : clk_core_disable+0x80/0xa0 lr : clk_core_disable+0x80/0xa0 [TRIMMED] Call trace: clk_core_disable+0x80/0xa0 (P) clk_core_disable_lock+0x88/0x10c clk_disable+0x24/0x30 cqspi_probe+0xa3c/0xae8 [TRIMMED] The error is due to the second invocation of 'clk_disable_unprepare()' on 'cqspi->clk' in the error handling within 'cqspi_probe()', with the first invocation being within 'cqspi_runtime_suspend()'. Fix this by correcting the error handling. Fixes: f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251119152545.2591651-1-s-vadapalli@ti.com Signed-off-by: Mark Brown commit c156c7f27ecdb7b89dbbeaaa1f40d9fadc3c1680 Author: Shikang Fan Date: Wed Nov 19 18:05:10 2025 +0800 drm/amdgpu: Add sriov vf check for VCN per queue reset support. Add SRIOV check when setting VCN ring's supported reset mask. Signed-off-by: Shikang Fan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit ee9b603ad43f9870eb75184f9fb0a84f8c3cc852) Cc: stable@vger.kernel.org commit 21f46f54769c45ac8ca0dbaa977bc1b436ffdee2 Author: Srinivasan Shanmugam Date: Tue Nov 18 14:28:33 2025 +0530 drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags The MMIO_REMAP BO is a special 4K IO page that does not have a ttm_tt behind it. However, amdgpu_ttm_tt_pde_flags() was treating it like normal TT/doorbell/preempt memory and unconditionally accessed ttm->caching. For the MMIO_REMAP BO, ttm is NULL, so this leads to a NULL pointer dereference when computing PDE flags. Fix this by checking that ttm is non-NULL before reading ttm->caching. This prevents the crash for MMIO_REMAP and also makes the code more defensive if other BOs ever come through without a ttm_tt. Fixes: fb5a52dbe9fe ("drm/amdgpu: Implement TTM handling for MMIO_REMAP placement") Suggested-by: Jesse Zhang Suggested-by: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Jesse Zhang Tested-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 0db94da5a0a1cacda080b9ec8425fcbe4babc141) commit a44592339397bc6715917997c6869bdedd1a7256 Author: Timur Kristóf Date: Wed Nov 19 10:25:42 2025 +0100 drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag This fixes sparse mappings (aka. partially resident textures). Check the correct flags. Since a recent refactor, the code works with uAPI flags (for mapping buffer objects), and not PTE (page table entry) flags. Fixes: 6716a823d18d ("drm/amdgpu: rework how PTE flags are generated v3") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8feeab26c80635b802f72b3ed986c693ff8f3212) commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 Author: Yifan Zha Date: Fri Nov 14 17:48:58 2025 +0800 drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled [Why] Accoreding to CP updated to RS64 on gfx11, WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW. That packet is used for MCBP on F32 based system. So it would lead to incorrect GRBM write and FW is not handling that extra case correctly. [How] With gfx11 rs64 enabled, skip emit de meta data. Signed-off-by: Yifan Zha Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 8366cd442d226463e673bed5d199df916f4ecbcf) Cc: stable@vger.kernel.org commit 31ab31433c9bd2f255c48dc6cb9a99845c58b1e4 Author: Mario Limonciello Date: Tue Nov 18 07:18:10 2025 -0600 drm/amd: Skip power ungate during suspend for VPE During the suspend sequence VPE is already going to be power gated as part of vpe_suspend(). It's unnecessary to call during calls to amdgpu_device_set_pg_state(). It actually can expose a race condition with the firmware if s0i3 sequence starts as well. Drop these calls. Cc: Peyton.Lee@amd.com Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 2a6c826cfeedd7714611ac115371a959ead55bda) Cc: stable@vger.kernel.org commit 807e0d187da4c0b22036b5e34000f7a8c52f6e50 Author: Wen Yang Date: Thu Nov 20 01:45:25 2025 +0800 tick/sched: Fix bogus condition in report_idle_softirq() In commit 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") the new function report_idle_softirq() was created by breaking code out of the existing can_stop_idle_tick() for kernels v5.18 and newer. In doing so, the code essentially went from this form: if (A) { static int ratelimit; if (ratelimit < 10 && !C && A&D) { pr_warn("NOHZ tick-stop error: ..."); ratelimit++; } return false; } to a new function: static bool report_idle_softirq(void) { static int ratelimit; if (likely(!A)) return false; if (ratelimit < 10) return false; ... pr_warn("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n", pending); ratelimit++; return true; } commit a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition") realized ratelimit was essentially set to zero instead of ten, and hence *no* softirq pending messages would ever be issued, but "fixed" it as: - if (ratelimit < 10) + if (ratelimit >= 10) return false; However, this fix introduced another issue: When ratelimit is greater than or equal 10, even if A is true, it will directly return false. While ratelimit in the original code was only used to control printing and will not affect the return value. Restore the original logic and restrict ratelimit to control the printk and not the return value. Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") Fixes: a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition") Signed-off-by: Wen Yang Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251119174525.29470-1-wen.yang@linux.dev commit 3c493b524ffdb3fae7f0d9dc6b887359ce13cd34 Merge: 3a8660878839fa 2050280a4bb660 Author: Stephen Boyd Date: Wed Nov 19 10:59:21 2025 -0700 Merge tag 'sunxi-clk-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clk driver fixes from Chen-Yu Tsai: Just a couple fixes for the A523 family. A couple clocks are marked as critical, and the lower bound of the audio PLL was lowered to match the datasheet. * tag 'sunxi-clk-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical commit cead55e24cf9e092890cf51c0548eccd7569defa Author: Ville Syrjälä Date: Thu Nov 13 01:30:28 2025 +0200 drm/plane: Fix create_in_format_blob() return value create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases. Cc: stable@vger.kernel.org Cc: Arun R Murthy Fixes: 0d6dcd741c26 ("drm/plane: modify create_in_formats to acommodate async") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251112233030.24117-2-ville.syrjala@linux.intel.com Reviewed-by: Arun R Murthy commit 23cb64fb76257309e396ea4cec8396d4a1dbae68 Merge: fdeee1cc7f3568 7a601324ac9828 Author: Linus Torvalds Date: Wed Nov 19 09:36:04 2025 -0800 Merge tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are mainly devicetree fixes for the arm platforms from Rockchips NXP, ASpeed and Broadcom, addressing issues with accidental overclocking, pinctrl, network and dtc warnings. There are additional fixes for regressions with the i.MX reset and memory controller drivers as well as the Tegra memory controller driver. Minor updates to the MAINTAINERS file, tee documentation and defconfigs bring those up to date with recent changes elsewhere" * tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (29 commits) MAINTAINERS: sync omap devicetree maintainers with omap platform MAINTAINERS: Update Krzysztof Kozlowski's email arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 arm64: dts: rockchip: disable HS400 on RK3588 Tiger arm64: dts: rockchip: drop reset from rk3576 i2c9 node tee: Date: Wed Nov 19 09:26:09 2025 -0800 Merge tag 'pwm/for-6.18-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fix from Uwe Kleine-König: "Correct mismatched pwm chip info for adp5585. Luke Wang found a problem in the pwm-adp5585 driver about how register information is mapped to the different device variants. This effectively made the driver non-functional. That didn't pop up before because the driver change was developed as part of a bigger mfd series and the original author didn't retest PWM functionality after it was tested in an earlier revision but then reworked" * tag 'pwm/for-6.18-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: adp5585: Correct mismatched pwm chip info commit 0678f5630429a5049d7663703b897e1bf8d13cd1 Merge: 2df79e4d729cc6 a78eb69d60ce89 Author: Linus Torvalds Date: Wed Nov 19 08:54:58 2025 -0800 Merge tag 'hid-for-linus-2025111901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - memory leak fixes in hid-uclogic, hid-ntrig and hid-playstation drivers (Abdun Nihaal, Masami Ichikawa) - regression fix for playback handling in hid-pidff (Tomasz Pakuła) - initialization fix for some amd_sfh platforms (Mario Limonciello) - a few assorted device-specific ID additions and quirks * tag 'hid-for-linus-2025111901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: uclogic: Fix potential memory leak in error path HID: playstation: Fix memory leak in dualshock4_get_calibration_data() HID: pidff: Fix needs_playback check HID: corsair-void: Use %pe for printing PTR_ERR HID: elecom: Add support for ELECOM M-XT3URBK (018F) HID: hid-input: Extend Elan ignore battery quirk to USB HID: hid-ntrig: Prevent memory leak in ntrig_report_version() HID: amd_sfh: Stop sensor before starting HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 commit e31a11be41cd134f245c01d1329e7bc89aba78fb Author: Wei Fang Date: Mon Nov 17 18:29:43 2025 +0800 net: phylink: add missing supported link modes for the fixed-link Pause, Asym_Pause and Autoneg bits are not set when pl->supported is initialized, so these link modes will not work for the fixed-link. This leads to a TCP performance degradation issue observed on the i.MX943 platform. The switch CPU port of i.MX943 is connected to an ENETC MAC, this link is a fixed link and the link speed is 2.5Gbps. And one of the switch user ports is the RGMII interface, and its link speed is 1Gbps. If the flow-control of the fixed link is not enabled, we can easily observe the iperf performance of TCP packets is very low. Because the inbound rate on the CPU port is greater than the outbound rate on the user port, the switch is prone to congestion, leading to the loss of some TCP packets and requiring multiple retransmissions. Solving this problem should be as simple as setting the Asym_Pause and Pause bits. The reason why the Autoneg bit needs to be set, Russell has gave a very good explanation in the thread [1], see below. "As the advertising and lp_advertising bitmasks have to be non-empty, and the swphy reports aneg capable, aneg complete, and AN enabled, then for consistency with that state, Autoneg should be set. This is how it was prior to the blamed commit." Fixes: de7d3f87be3c ("net: phylink: Use phy_caps_lookup for fixed-link configuration") Link: https://lore.kernel.org/aRjqLN8eQDIQfBjS@shell.armlinux.org.uk # [1] Signed-off-by: Wei Fang Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251117102943.1862680-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 2df79e4d729cc67395db2fd6965148fea0851898 Merge: 8b690556d8fe07 c42af83c59b65d Author: Linus Torvalds Date: Wed Nov 19 08:27:05 2025 -0800 Merge tag 'fixes-2025-11-19' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "Fix memblock_estimated_nr_free_pages() for soft-reserved memory The "soft-reserved" memory regions (EFI_MEMORY_SP) are added to the memblock.reserved, but not to the memblock.memory. It causes memblock_estimated_nr_free_pages() to return a value smaller value than expected, or if it underflows, an extremely large value. Calculate the number of estimated free pages using memblock_reserved_kern_size() instead of memblock_reserved_size() to fix the issue" * tag 'fixes-2025-11-19' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: fix memblock_estimated_nr_free_pages() for soft-reserved memory commit d4f14fa5c6c4d39b5187e1f410d59e38d76f283f Merge: 949f1fd2225bae 6a23ae0a96a600 Author: Thomas Zimmermann Date: Wed Nov 19 15:26:25 2025 +0100 Merge drm/drm-fixes into drm-misc-fixes Backmerging to get fixes from v6.18-rc6. Signed-off-by: Thomas Zimmermann commit 79afd3c5edac93b684393ec84185b2776d0630ef Author: Rob Herring (Arm) Date: Tue Nov 18 15:34:27 2025 -0600 dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes Add the missing unevaluatedProperties to disallow extra properties on the '^conf' nodes. Signed-off-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit d2932a59c2d4fb364396f21df58431c44918dd47 Author: Tony Luck Date: Tue Nov 18 17:27:12 2025 -0800 ACPI: APEI: EINJ: Fix EINJV2 initialization and injection ACPI 6.6 specification for EINJV2 appends an extra structure to the end of the existing struct set_error_type_with_address. Several issues showed up in testing. 1) Initialization was broken by an earlier fix [1] since is_v2 is only set while performing an injection, not during initialization. 2) A buggy BIOS provided invalid "revision" and "length" for the extension structure. Add several sanity checks. 3) When injecting legacy error types on an EINJV2 capable system, don't copy the component arrays. Fixes: 6c7058514991 ("ACPI: APEI: EINJ: Check if user asked for EINJV2 injection") # [1] Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Signed-off-by: Tony Luck [ rjw: Changelog edits ] Cc: 6.17+ # 6.17+ Link: https://patch.msgid.link/20251119012712.178715-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit 2b6d546ba83e8332870741eca469aed662d819ff Author: Bartosz Golaszewski Date: Tue Nov 18 13:18:16 2025 +0100 MAINTAINERS: update my email address Due to an upcoming change in my professional situation, I will need to start using my kernel.org address. Update all my MAINTAINERS entries. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20251118121816.23018-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 Author: Bartosz Golaszewski Date: Mon Nov 17 16:08:42 2025 +0100 gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released. Fixes: 40b7c49950bd ("gpio: cdev: put emitting the line state events on a workqueue") Reported-by: Alexander Sverdlin Closes: https://lore.kernel.org/all/5d605f7fc99456804911403102a4fe999a14cc85.camel@siemens.com/ Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20251117-gpio-cdev-get-file-v1-1-28a16b5985b8@linaro.org Signed-off-by: Bartosz Golaszewski commit a24074ca8840cf28fa50c40e957fdc50f29971b3 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:15:38 2025 +0100 perf/x86/intel/uncore: Remove superfluous check The 'pmu' pointer cannot be NULL, as it is taken as a pointer to an array. Remove the superfluous NULL check. Found by Coverity: CID#1497507. Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Ingo Molnar Cc: Liang Kan Cc: Peter Zijlstra Link: https://patch.msgid.link/20251119091538.825307-1-jirislaby@kernel.org commit 106a67494c53c56f55a2bd0757be0edb6eaa5407 Merge: d47515af6cccd7 e1bb28bf13f41a Author: Jakub Kicinski Date: Tue Nov 18 19:19:28 2025 -0800 Merge branch 'af_unix-fix-so_peek_off-bug-in-unix_stream_read_generic' Kuniyuki Iwashima says: ==================== af_unix: Fix SO_PEEK_OFF bug in unix_stream_read_generic(). Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket. Patch 1 fixes the bug and Patch 2 adds a new selftest to cover the case. ==================== Link: https://patch.msgid.link/20251117174740.3684604-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e1bb28bf13f41af5d7cc48359d1755cbcda4d502 Author: Kuniyuki Iwashima Date: Mon Nov 17 17:47:11 2025 +0000 selftest: af_unix: Add test for SO_PEEK_OFF. The test covers various cases to verify SO_PEEK_OFF behaviour for all AF_UNIX socket types. two_chunks_blocking and two_chunks_overlap_blocking reproduce the issue mentioned in the previous patch. Without the patch, the two tests fail: # RUN so_peek_off.stream.two_chunks_blocking ... # so_peek_off.c:121:two_chunks_blocking:Expected 'bbbb' == 'aaaabbbb'. # two_chunks_blocking: Test terminated by assertion # FAIL so_peek_off.stream.two_chunks_blocking not ok 3 so_peek_off.stream.two_chunks_blocking # RUN so_peek_off.stream.two_chunks_overlap_blocking ... # so_peek_off.c:159:two_chunks_overlap_blocking:Expected 'bbbb' == 'aaaabbbb'. # two_chunks_overlap_blocking: Test terminated by assertion # FAIL so_peek_off.stream.two_chunks_overlap_blocking not ok 5 so_peek_off.stream.two_chunks_overlap_blocking With the patch, all tests pass: # PASSED: 15 / 15 tests passed. # Totals: pass:15 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251117174740.3684604-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7bf3a476ce43833c49fceddbe94ff3472e04e9bc Author: Kuniyuki Iwashima Date: Mon Nov 17 17:47:10 2025 +0000 af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket. The unexpected behaviour is triggered when the peek offset is larger than the recv queue and the thread is unblocked by new data. Let's assume a socket which has "aaaa" in the recv queue and the peek offset is 4. First, unix_stream_read_generic() reads the offset 4 and skips the skb(s) of "aaaa" with the code below: skip = max(sk_peek_offset(sk, flags), 0); /* @skip is 4. */ do { ... while (skip >= unix_skb_len(skb)) { skip -= unix_skb_len(skb); ... skb = skb_peek_next(skb, &sk->sk_receive_queue); if (!skb) goto again; /* @skip is 0. */ } The thread jumps to the 'again' label and goes to sleep since new data has not arrived yet. Later, new data "bbbb" unblocks the thread, and the thread jumps to the 'redo:' label to restart the entire process from the first skb in the recv queue. do { ... redo: ... last = skb = skb_peek(&sk->sk_receive_queue); ... again: if (skb == NULL) { ... timeo = unix_stream_data_wait(sk, timeo, last, last_len, freezable); ... goto redo; /* @skip is 0 !! */ However, the peek offset is not reset in the path. If the buffer size is 8, recv() will return "aaaabbbb" without skipping any data, and the final offset will be 12 (the original offset 4 + peeked skbs' length 8). After sleeping in unix_stream_read_generic(), we have to fetch the peek offset again. Let's move the redo label before mutex_lock(&u->iolock). Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") Reported-by: Miao Wang Closes: https://lore.kernel.org/netdev/3B969F90-F51F-4B9D-AB1A-994D9A54D460@gmail.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251117174740.3684604-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d47515af6cccd7484d8b0870376858c9848a18ec Author: Pradyumn Rahar Date: Mon Nov 17 14:16:08 2025 +0200 net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to access this, when request_irq() fails due to exhausted IRQ vectors. This commit modifies the cleanup to remove only the specific IRQ mapping that was just added. This prevents removal of other valid mappings and ensures precise cleanup of the failed IRQ allocation's associated glue object. Note: This error is observed when both fwctl and rds configs are enabled. [1] mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:06:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 general protection fault, probably for non-canonical address 0xe277a58fde16f291: 0000 [#1] SMP NOPTI RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Call Trace: ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] ? __die_body.cold+0x8/0xa ? die_addr+0x39/0x53 ? exc_general_protection+0x1c4/0x3e9 ? dev_vprintk_emit+0x5f/0x90 ? asm_exc_general_protection+0x22/0x27 ? free_irq_cpu_rmap+0x23/0x7d mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] irq_pool_request_vector+0x7d/0x90 [mlx5_core] mlx5_irq_request+0x2e/0xe0 [mlx5_core] mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] comp_irq_request_pci+0x64/0xf0 [mlx5_core] create_comp_eq+0x71/0x385 [mlx5_core] ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] ? xas_load+0x8/0x91 mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] mlx5e_open_channels+0xad/0x250 [mlx5_core] mlx5e_open_locked+0x3e/0x110 [mlx5_core] mlx5e_open+0x23/0x70 [mlx5_core] __dev_open+0xf1/0x1a5 __dev_change_flags+0x1e1/0x249 dev_change_flags+0x21/0x5c do_setlink+0x28b/0xcc4 ? __nla_parse+0x22/0x3d ? inet6_validate_link_af+0x6b/0x108 ? cpumask_next+0x1f/0x35 ? __snmp6_fill_stats64.constprop.0+0x66/0x107 ? __nla_validate_parse+0x48/0x1e6 __rtnl_newlink+0x5ff/0xa57 ? kmem_cache_alloc_trace+0x164/0x2ce rtnl_newlink+0x44/0x6e rtnetlink_rcv_msg+0x2bb/0x362 ? __netlink_sendskb+0x4c/0x6c ? netlink_unicast+0x28f/0x2ce ? rtnl_calcit.isra.0+0x150/0x146 netlink_rcv_skb+0x5f/0x112 netlink_unicast+0x213/0x2ce netlink_sendmsg+0x24f/0x4d9 __sock_sendmsg+0x65/0x6a ____sys_sendmsg+0x28f/0x2c9 ? import_iovec+0x17/0x2b ___sys_sendmsg+0x97/0xe0 __sys_sendmsg+0x81/0xd8 do_syscall_64+0x35/0x87 entry_SYSCALL_64_after_hwframe+0x6e/0x0 RIP: 0033:0x7fc328603727 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48 RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727 RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffe8eb3f3c8 R15: 00007ffe8eb3f3bc ---[ end trace f43ce73c3c2b13a2 ]--- RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Code: 0f 1f 80 00 00 00 00 48 85 ff 74 6b 55 48 89 fd 53 66 83 7f 06 00 74 24 31 db 48 8b 55 08 0f b7 c3 48 8b 04 c2 48 85 c0 74 09 <8b> 38 31 f6 e8 c4 0a b8 ff 83 c3 01 66 3b 5d 06 72 de b8 ff ff ff RSP: 0018:ff384881640eaca0 EFLAGS: 00010282 RAX: e277a58fde16f291 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ff2335e2e20b3600 RSI: 0000000000000000 RDI: ff2335e2e20b3400 RBP: ff2335e2e20b3400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 00000000ffffffe4 R12: ff384881640ead88 R13: ff2335c3760751e0 R14: ff2335e2e1672200 R15: ff2335c3760751f8 FS: 00007fc32ac22480(0000) GS:ff2335e2d6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f651ab54000 CR3: 00000029f1206003 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1dc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) kvm-guest: disable async PF for cpu 0 Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Signed-off-by: Mohith Kumar Thummaluru Tested-by: Mohith Kumar Thummaluru Reviewed-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Pradyumn Rahar Reviewed-by: Jacob Keller Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763381768-1234998-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 426358d9be7ce3518966422f87b96f1bad27295f Author: Eric Dumazet Date: Mon Nov 17 10:07:44 2025 +0000 mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events mptcp_worker Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631 mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362 mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174 tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361 tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441 tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931 tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6079 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6192 process_backlog+0x31e/0x900 net/core/dev.c:6544 __napi_poll+0xb6/0x540 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xda0 net/core/dev.c:7784 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline] mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1 mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 44: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385 mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline] __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529 mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 6630: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2523 [inline] slab_free mm/slub.c:6611 [inline] kfree+0x197/0x950 mm/slub.c:6818 mptcp_remove_anno_list_by_saddr+0x2d/0x40 net/mptcp/pm.c:158 mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1209 [inline] mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1240 [inline] mptcp_pm_nl_flush_addrs_doit+0x593/0xbb0 net/mptcp/pm_kernel.c:1281 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x508/0x820 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: stable@vger.kernel.org Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Reported-by: syzbot+2a6fbf0f0530375968df@syzkaller.appspotmail.com Closes: https://lore.kernel.org/691ad3c3.a70a0220.f6df1.0004.GAE@google.com Signed-off-by: Eric Dumazet Cc: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251117100745.1913963-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c3995fc1a89cc716bfe914c829b84da879c11db4 Merge: f94c1a114ac209 a55ef3bff84f11 Author: Jakub Kicinski Date: Tue Nov 18 17:58:44 2025 -0800 Merge tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2025-11-18 1) Misc fixes for xfrm_state creation/modification/deletion. Patchset from Sabrina Dubroca. 2) Fix inner packet family determination for xfrm offloads. From Jianbo Liu. 3) Don't push locally generated packets directly to L2 tunnel mode offloading, they still need processing from the standard xfrm path. From Jianbo Liu. 4) Fix memory leaks in xfrm_add_acquire for policy offloads and policy security contexts. From Zilin Guan. * tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: fix memory leak in xfrm_add_acquire() xfrm: Prevent locally generated packets from direct output in tunnel mode xfrm: Determine inner GSO type from packet inner protocol xfrm: Check inner packet family directly from skb_dst xfrm: check all hash buckets for leftover states during netns deletion xfrm: set err and extack on failure to create pcpu SA xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state xfrm: make state as DEAD before final put when migrate fails xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added xfrm: drop SA reference in xfrm_state_update if dir doesn't match ==================== Link: https://patch.msgid.link/20251118085344.2199815-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit f94c1a114ac209977bdf5ca841b98424295ab1f0 Author: Shay Drory Date: Mon Nov 17 14:05:49 2025 +0200 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: d75559845078 ("devlink: Allow setting parent node of rate objects") Signed-off-by: Shay Drory Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763381149-1234377-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6010d4d8b55b5d3ae1efb5502c54312e15c14f21 Author: Jared Kangas Date: Tue Nov 11 13:54:12 2025 -0800 pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() s32_pmx_gpio_request_enable() does not initialize the newly-allocated gpio_pin_config::list before adding it to s32_pinctrl::gpio_configs. This could result in a linked list corruption. Initialize the new list_head with INIT_LIST_HEAD() to fix this. Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support") Signed-off-by: Jared Kangas Signed-off-by: Linus Walleij commit 97ea34defbb57bfaf71ce487b1b0865ffd186e81 Author: Jared Kangas Date: Tue Nov 11 13:54:11 2025 -0800 pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its fields are initialized. Notably, num_custom_params is used in pinconf_generic_parse_dt_config(), resulting in intermittent allocation errors, such as the following splat when probing i2c-imx: WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300 [...] Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT) [...] Call trace: __alloc_pages_noprof+0x290/0x300 (P) ___kmalloc_large_node+0x84/0x168 __kmalloc_large_node_noprof+0x34/0x120 __kmalloc_noprof+0x2ac/0x378 pinconf_generic_parse_dt_config+0x68/0x1a0 s32_dt_node_to_map+0x104/0x248 dt_to_map_one_config+0x154/0x1d8 pinctrl_dt_to_map+0x12c/0x280 create_pinctrl+0x6c/0x270 pinctrl_get+0xc0/0x170 devm_pinctrl_get+0x50/0xa0 pinctrl_bind_pins+0x60/0x2a0 really_probe+0x60/0x3a0 [...] __platform_driver_register+0x2c/0x40 i2c_adap_imx_init+0x28/0xff8 [i2c_imx] [...] This results in later parse failures that can cause issues in dependent drivers: s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property [...] pca953x 0-0022: failed writing register: -6 i2c i2c-0: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property i2c i2c-1: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property i2c i2c-2: IMX I2C adapter registered Fix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of devm_kmalloc() in s32_pinctrl_probe(), which sets the previously uninitialized fields to zero. Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support") Signed-off-by: Jared Kangas Tested-by: Jan Petrous (OSS) Signed-off-by: Linus Walleij commit 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0 Author: Grzegorz Nitka Date: Mon Oct 20 12:02:16 2025 +0200 ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case. Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal. The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage): [ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded Fixes: e800654e85b5 ("ice: Use ice_adapter for PTP shared data instead of auxdev") Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7a601324ac9828468291151d220edb47a6a82449 Author: Andreas Kemnade Date: Tue Nov 18 11:26:52 2025 -0800 MAINTAINERS: sync omap devicetree maintainers with omap platform Both used to go through Tony's branches, so lets keep things together. This was missed at the time when Co-Maintainers were added. Signed-off-by: Andreas Kemnade Acked-by: Aaro Koskinen Acked-by: Tony Lindgren Reviewed-by: Roger Quadros Acked-by: Kevin Hilman Link: https://patch.msgid.link/20240915195321.1071967-1-andreas@kemnade.info Signed-off-by: Kevin Hilman Link: https://lore.kernel.org/r/20251118192652.316198-1-khilman@baylibre.com Signed-off-by: Arnd Bergmann commit c10519c8c88629e3e0e7f822c67e5286eb97c836 Merge: 124c98b10001a3 b5414520793e68 Author: Arnd Bergmann Date: Tue Nov 18 22:45:25 2025 +0100 Merge tag 'v6.18-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Regulator/supply fixes for a number of boards, removed too fast cpu OPPs from rk3576 (not supported in newer vendor TF-A and never supported in upstream TF-A). As well as some DTS validation fixes and one pinctrl fix for the odroid-m1. * tag 'v6.18-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 arm64: dts: rockchip: disable HS400 on RK3588 Tiger arm64: dts: rockchip: drop reset from rk3576 i2c9 node arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2 arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic arm64: dts: rockchip: Drop 'rockchip,grf' prop from tsadc on rk3328 arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576 arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2 arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 Signed-off-by: Arnd Bergmann commit 118082368c2b6ddefe6cb607efc312285148f044 Author: Emil Tantilov Date: Mon Oct 13 08:08:24 2025 -0700 idpf: fix possible vport_config NULL pointer deref in remove Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF: [ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0 Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce. Fixes: e1e3fec3e34b ("idpf: preserve coalescing settings across resets") Signed-off-by: Emil Tantilov Reviewed-by: Chittim Madhu Reviewed-by: Simon Horman Tested-by: Samuel Salin Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 5b38c22687d9287d85dd3bef2fa708bf62cf3895 Author: Venkata Ramana Nayana Date: Fri Nov 7 14:01:41 2025 +0530 drm/xe/irq: Handle msix vector0 interrupt Current gu2host handler registered as MSI-X vector 0 and as per bspec for a msix vector 0 interrupt, the driver must check the legacy registers 190008(TILE_INT_REG), 190060h (GT INTR Identity Reg 0) and other registers mentioned in "Interrupt Service Routine Pseudocode" otherwise it will block the next interrupts. To overcome this issue replacing guc2host handler with legacy xe_irq_handler. Fixes: da889070be7b2 ("drm/xe/irq: Separate MSI and MSI-X flows") Bspec: 62357 Signed-off-by: Venkata Ramana Nayana Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20251107083141.2080189-1-venkata.ramana.nayana@intel.com Signed-off-by: Matt Roper (cherry picked from commit c34a14bce7090862ebe5a64abe8d85df75e62737) Signed-off-by: Lucas De Marchi commit 27c0a54e48c658eb12fa3bcbb2892a3fa17b72af Author: Shuicheng Lin Date: Mon Nov 10 23:26:58 2025 +0000 drm/xe: Remove duplicate DRM_EXEC selection from Kconfig There are 2 identical "select DRM_EXEC" lines for DRM_XE. Remove one to clean up the configuration. Fixes: d490ecf57790 ("drm/xe: Rework xe_exec and the VM rebind worker to use the drm_exec helper") Cc: Thomas Hellström Cc: Lucas De Marchi Signed-off-by: Shuicheng Lin Reviewed-by: Nitin Gote Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251110232657.1807998-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit b1aa02acd03bfef3ed39c511d33c4a4303d2f9b1) Signed-off-by: Lucas De Marchi commit 905a3468ec679293949438393de7e61310432662 Author: Matt Roper Date: Thu Nov 13 15:40:39 2025 -0800 drm/xe/kunit: Fix forcewake assertion in mocs test The MOCS kunit test calls KUNIT_ASSERT_TRUE_MSG() with a condition of 'true;' this prevents the assertion from ever failing. Replace KUNIT_ASSERT_TRUE_MSG with KUNIT_FAIL_AND_ABORT to get the intended failure behavior in cases where forcewake was not acquired successfully. Fixes: 51c0ee84e4dc ("drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs") Cc: Tejas Upadhyay Cc: Gustavo Sousa Reviewed-by: Lucas De Marchi Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20251113234038.2256106-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 9be4f0f687048ba77428ceca11994676736507b7) Signed-off-by: Lucas De Marchi commit d52dea485cd3c98cfeeb474cf66cf95df2ab142f Author: Shuicheng Lin Date: Wed Nov 12 18:10:06 2025 +0000 drm/xe: Prevent BIT() overflow when handling invalid prefetch region If user provides a large value (such as 0x80) for parameter prefetch_mem_region_instance in vm_bind ioctl, it will cause BIT(prefetch_region) overflow as below: " ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/gpu/drm/xe/xe_vm.c:3414:7 shift exponent 128 is too large for 64-bit type 'long unsigned int' CPU: 8 UID: 0 PID: 53120 Comm: xe_exec_system_ Tainted: G W 6.18.0-rc1-lgci-xe-kernel+ #200 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 Call Trace: dump_stack_lvl+0xa0/0xc0 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_shift_out_of_bounds+0x10e/0x170 ? mutex_unlock+0x12/0x20 xe_vm_bind_ioctl.cold+0x20/0x3c [xe] ... " Fix it by validating prefetch_region before the BIT() usage. v2: Add Closes and Cc stable kernels. (Matt) Reported-by: Koen Koning Reported-by: Peter Senna Tschudin Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6478 Cc: # v6.8+ Reviewed-by: Matthew Auld Signed-off-by: Shuicheng Lin Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20251112181005.2120521-2-shuicheng.lin@intel.com (cherry picked from commit 8f565bdd14eec5611cc041dba4650e42ccdf71d9) Signed-off-by: Lucas De Marchi commit 8b690556d8fe074b4f9835075050fba3fb180e93 Merge: 5bebe8de192649 3fa05f96fc08df Author: Linus Torvalds Date: Tue Nov 18 10:02:22 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Arm: - Only adjust the ID registers when no irqchip has been created once per VM run, instead of doing it once per vcpu, as this otherwise triggers a pretty bad conbsistency check failure in the sysreg code - Make sure the per-vcpu Fine Grain Traps are computed before we load the system registers on the HW, as we otherwise start running without anything set until the first preemption of the vcpu x86: - Fix selftests failure on AMD, checking for an optimization that was not happening anymore" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Fix redundant updates of LBR MSR intercepts KVM: arm64: VHE: Compute fgt traps before activating them KVM: arm64: Finalize ID registers only once per VM commit a6ee8422b4f2a591de010f4e60471060b13d4170 Author: Li Chen Date: Tue Nov 11 20:13:36 2025 +0800 dm-pcache: zero cache_info before default init pcache_meta_find_latest() leaves whatever it last copied into the caller’s buffer even when it returns NULL. For cache_info_init(), that meant cache->cache_info could still contain CRC-bad garbage when no valid metadata exists, leading later initialization paths to read bogus flags. Explicitly memset cache->cache_info in cache_info_init_default() so new-cache paths start from a clean slate. The default sequence number assignment becomes redundant with this reset, so it drops out. Signed-off-by: Li Chen Reviewed-by: Zheng Gu Signed-off-by: Mikulas Patocka commit 840b80af74fda9672f111023ca17ad7875427f13 Author: Li Chen Date: Tue Nov 11 20:13:35 2025 +0800 dm-pcache: reuse meta_addr in pcache_meta_find_latest pcache_meta_find_latest() already computes the metadata address as meta_addr. Reuse that instead of recomputing. Signed-off-by: Li Chen Signed-off-by: Mikulas Patocka commit 341d14bd69d05b1c30bd83c5056730ba6d78b83d Author: Li Chen Date: Tue Nov 11 20:13:34 2025 +0800 dm-pcache: allow built-in build and rename flush helper CONFIG_BCACHE is tristate, so dm-pcache can also be built-in. Switch the Makefile to use obj-$(CONFIG_DM_PCACHE) so the target can be linked into vmlinux instead of always being a loadable module. Also rename cache_flush() to pcache_cache_flush() to avoid a global symbol clash with sunrpc/cache.c's cache_flush(). Signed-off-by: Li Chen Signed-off-by: Mikulas Patocka commit 9eb00b5f5697bd56baa3222c7a1426fa15bacfb5 Author: Robert McClinton Date: Sun Nov 16 12:33:21 2025 -0500 drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because incorrectly returning false from signaled() is perfectly acceptable. Link: https://github.com/brave/brave-browser/issues/49182 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4641 Cc: Alex Deucher Signed-off-by: Robert McClinton Signed-off-by: Alex Deucher (cherry picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db) Cc: stable@vger.kernel.org commit 1788ef30725da53face7e311cdf62ad65fababcd Author: Fangzhi Zuo Date: Fri Nov 7 15:01:30 2025 -0500 drm/amd/display: Fix pbn to kbps Conversion [Why] Existing routine has two conversion sequence, pbn_to_kbps and kbps_to_pbn with margin. Non of those has without-margin calculation. kbps_to_pbn with margin conversion includes fec overhead which has already been included in pbn_div calculation with 0.994 factor considered. It is a double counted fec overhead factor that causes potential bw loss. [How] Add without-margin calculation. Fix fec overhead double counted issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3735 Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit e0dec00f3d05e8c0eceaaebfdca217f8d10d380c) Cc: stable@vger.kernel.org commit a78eb69d60ce893de48dd75f725ba21309131fc2 Author: Abdun Nihaal Date: Mon Nov 10 22:59:41 2025 +0530 HID: uclogic: Fix potential memory leak in error path In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for event_hook is not freed in the next error path. Fix that by freeing it. Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection") Signed-off-by: Abdun Nihaal Signed-off-by: Jiri Kosina commit 5bab4c89390f32b2f491f49a151948cd226dd909 Author: Ivan Lipski Date: Wed Nov 5 15:27:42 2025 -0500 drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 [Why] On DCN20 & DCN30, the 6th DPP's & HUBP's are powered on permanently and cannot be power gated. Thus, when dpp_reset() is invoked for the DPP5, while it's still powered on, the cached cursor_state (dpp_base->pos.cur0_ctl.bits.cur0_enable) and the actual state (CUR0_ENABLE) bit are unsycned. This can cause a double cursor in full screen with non-native scaling. [How] Force disable cursor on DPP5 on plane powerdown for ASICs w/ 6 DPPs/HUBPs. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4673 Reviewed-by: Aric Cyr Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 79b3c037f972dcb13e325a8eabfb8da835764e15) Cc: stable@vger.kernel.org commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 Author: Abdun Nihaal Date: Mon Nov 10 22:45:50 2025 +0530 HID: playstation: Fix memory leak in dualshock4_get_calibration_data() The memory allocated for buf is not freed in the error paths when ps_get_report() fails. Free buf before jumping to transfer_failed label Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices") Signed-off-by: Abdun Nihaal Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina commit c97da4785b3bbc60c24cfd1ffea1d7c8b90ed743 Author: Ivan Lipski Date: Thu Oct 30 11:25:33 2025 -0400 drm/amd/display: Add an HPD filter for HDMI [Why] Some monitors perform rapid “autoscan” HPD re‑assertions right after a disconnect or powersaving mode enablement. These appear as a quick disconnect→reconnect with an identical EDID. Since Linux has no HDMI hotplug detection (HPD) filter, these quick reconnects are seen as hotplug events, which can unintentionally wake a system with DPMS off. An example: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Such 'fake reconnects' are considered when the interval between a disconnect and a connect is within 1500ms (experimentally chosen using several monitors), and the two connections have the same EDID. [How] Implement a time-based debounce mechanism: 1. On HDMI disconnect detection, instead of immediately processing the HPD event, save the current sink and schedule delayed work (default 1500ms) 2. If another HDMI disconnect HPD event arrives during the debounce period, it reschedules the pending work, ensuring only the final state is processed. 3. When the debounce timer expires, re-detect the display and compare the new sink with the cached one using EDID comparison. 4. If sinks match (same EDID), this was a spontaneous HPD toggle: - Update connector state internally - Skip hotplug event to prevent desktop rearrangement If sinks differ, this was a real display change: - Process normally with the hotplug event The debounce delay is configurable via module parameter 'hdmi_hpd_debounce_delay_ms'. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Reviewed-by: Sun peng (Leo) Li Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit c918e75e1ed95be76f8e3156a411188f650fe03f) commit 8612badc331bcab2068baefa69e1458085ed89e3 Author: Mario Limonciello (AMD) Date: Mon Nov 3 12:11:31 2025 -0600 drm/amd/display: Increase DPCD read retries [Why] Empirical measurement of some monitors that fail to read EDID while booting shows that the number of retries with a 30ms delay between tries is as high as 16. [How] Increase number of retries to 20. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit ad1c59ad7cf74ec06e32fe2c330ac1e957222288) Cc: stable@vger.kernel.org commit 9d7b89a1028230315a8999cfea7795fbe84f62cc Author: Tomasz Pakuła Date: Mon Nov 3 21:02:43 2025 +0100 HID: pidff: Fix needs_playback check A small bug made it's way here when rewriting code to Linux quality. Currently, if an effect is not infinite and a program requests it's playback with the same number of loops, the play command won't be fired and if an effect is infinite, the spam will continue. We want every playback update for non-infinite effects and only some for infinite (detecting when a program requests stop with 0 which will be different than previous value which is usually 1 or 255). Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 4e127a74786fa9573a32c8aa4bbf69ef78c3232a Author: Stuart Hayhurst Date: Mon Nov 3 14:21:13 2025 +0000 HID: corsair-void: Use %pe for printing PTR_ERR Use %pe to print a PTR_ERR to silence a cocci warning Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510300342.WtPn2jF3-lkp@intel.com/ Signed-off-by: Stuart Hayhurst Signed-off-by: Jiri Kosina commit 71ad9054c1f241be63f9d11df8cbd0aa0352fe16 Author: Mario Limonciello (AMD) Date: Mon Nov 3 11:17:44 2025 -0600 drm/amd/display: Move sleep into each retry for retrieve_link_cap() [Why] When a monitor is booting it's possible that it isn't ready to retrieve link caps and this can lead to an EDID read failure: ``` [drm:retrieve_link_cap [amdgpu]] *ERROR* retrieve_link_cap: Read receiver caps dpcd data failed. amdgpu 0000:c5:00.0: [drm] *ERROR* No EDID read. ``` [How] Rather than msleep once and try a few times, msleep each time. Should be no changes for existing working monitors, but should correct reading caps on a monitor that is slow to boot. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 669dca37b3348a447db04bbdcbb3def94d5997cc) Cc: stable@vger.kernel.org commit cdcbb8e8d10f656642380ee13516290437b52b36 Author: Naoki Ueki Date: Mon Nov 3 21:16:45 2025 +0900 HID: elecom: Add support for ELECOM M-XT3URBK (018F) The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which shares the same report descriptor as the existing device (0x00FB). However, the driver does not currently recognize this new ID, resulting in only five buttons being functional. This patch adds the new device ID so that all six buttons work properly. Signed-off-by: Naoki Ueki Signed-off-by: Jiri Kosina commit 3fa05f96fc08dff5e846c2cc283a249c1bf029a1 Author: Yosry Ahmed Date: Wed Nov 12 01:30:17 2025 +0000 KVM: SVM: Fix redundant updates of LBR MSR intercepts Don't update the LBR MSR intercept bitmaps if they're already up-to-date, as unconditionally updating the intercepts forces KVM to recalculate the MSR bitmaps for vmcb02 on every nested VMRUN. The redundant updates are functionally okay; however, they neuter an optimization in Hyper-V nested virtualization enlightenments and this manifests as a self-test failure. In particular, Hyper-V lets L1 mark "nested enlightenments" as clean, i.e. tell KVM that no changes were made to the MSR bitmap since the last VMRUN. The hyperv_svm_test KVM selftest intentionally changes the MSR bitmap "without telling KVM about it" to verify that KVM honors the clean hint, correctly fails because KVM notices the changed bitmap anyway: ==== Test Assertion Failure ==== x86/hyperv_svm_test.c:120: vmcb->control.exit_code == 0x081 pid=193558 tid=193558 errno=4 - Interrupted system call 1 0x0000000000411361: assert_on_unhandled_exception at processor.c:659 2 0x0000000000406186: _vcpu_run at kvm_util.c:1699 3 (inlined by) vcpu_run at kvm_util.c:1710 4 0x0000000000401f2a: main at hyperv_svm_test.c:175 5 0x000000000041d0d3: __libc_start_call_main at libc-start.o:? 6 0x000000000041f27c: __libc_start_main_impl at ??:? 7 0x00000000004021a0: _start at ??:? vmcb->control.exit_code == SVM_EXIT_VMMCALL Do *not* fix this by skipping svm_hv_vmcb_dirty_nested_enlightenments() when svm_set_intercept_for_msr() performs a no-op change. changes to the L0 MSR interception bitmap are only triggered by full CPUID updates and MSR filter updates, both of which should be rare. Changing svm_set_intercept_for_msr() risks hiding unintended pessimizations like this one, and is actually more complex than this change. Fixes: fbe5e5f030c2 ("KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv()") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251112013017.1836863-1-yosry.ahmed@linux.dev [Rewritten commit message based on mailing list discussion. - Paolo] Reviewed-by: Sean Christopherson Tested-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit cfa0904a35fd0231f4d05da0190f0a22ed881cce Author: Fangzhi Zuo Date: Thu Sep 18 16:25:45 2025 -0400 drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched [why] 1. With allow_0_dtb_clk enabled, the time required to latch DTBCLK to 600 MHz depends on the SMU. If DTBCLK is not latched to 600 MHz before set_mode completes, gating DTBCLK causes the DP2 sink to lose its clock source. 2. The existing DTBCLK gating sequence ungates DTBCLK based on both pix_clk and ref_dtbclk, but gates DTBCLK when either pix_clk or ref_dtbclk is zero. pix_clk can be zero outside the set_mode sequence before DTBCLK is properly latched, which can lead to DTBCLK being gated by mistake. [how] Consider both pixel_clk and ref_dtbclk when determining when it is safe to gate DTBCLK; this is more accurate. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4701 Fixes: 5949e7c4890c ("drm/amd/display: Enable Dynamic DTBCLK Switch") Reviewed-by: Charlene Liu Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d04eb0c402780ca037b62a6aecf23b863545ebca) Cc: stable@vger.kernel.org commit b82ebaf298643cad497ef8daf263c0652d486eec Merge: 6a23ae0a96a600 85592114ffda56 Author: Paolo Bonzini Date: Tue Nov 18 17:38:01 2025 +0100 Merge tag 'kvmarm-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.18, take #3 - Only adjust the ID registers when no irqchip has been created once per VM run, instead of doing it once per vcpu, as this otherwise triggers a pretty bad conbsistency check failure in the sysreg code. - Make sure the per-vcpu Fine Grain Traps are computed before we load the system registers on the HW, as we otherwise start running without anything set until the first preemption of the vcpu. commit 5bebe8de19264946d398ead4e6c20c229454a552 Author: Linus Torvalds Date: Tue Nov 18 08:21:27 2025 -0800 mm/huge_memory: Fix initialization of huge zero folio The recent fix to properly initialize the tags of the huge zero folio had an unfortunate not-so-subtle side effect: it caused the actual *contents* of the huge zero folio to not be initialized at all when the hardware didn't support the memory tagging. The reason was the unfortunate semantics of tag_clear_highpage(): on hardware that didn't do the tagging, it would silently just not do anything at all. And since this is done only on arm64 with MTE support, that basically meant most hardware. It wasn't necessarily immediately obvious since the huge zero page isn't necessarily very heavily used - or because it might already be zero because all-zeroes is the most common pattern. But it ends up causing random odd user space failures when you do hit it. The unfortunate semantics have been around for a while, but became a real bug only when we started actively using __GFP_ZEROTAGS in the generic get_huge_zero_folio() function - before that, it had only ever been used in code that checked that the hardware supported it. Fix this by simply changing the semantics of tag_clear_highpage() to return whether it actually successfully did something or not. While at it, also make it initialize multiple pages in one go, since that's actually what the only caller wants it to do and it simplifies the whole logic. Fixes: adfb6609c680 ("mm/huge_memory: initialise the tags of the huge zero folio") Link: https://lore.kernel.org/all/20251117082023.90176-1-00107082@163.com/ Reviewed-by: David Hildenbrand (Red Hat) Reported-and-tested-by: David Wang <00107082@163.com> Reported-and-tested-by: Carlos Llamas Signed-off-by: Linus Torvalds commit f384497a76ed9539f70f6e8fe81a193441c943d2 Author: Rafael J. Wysocki Date: Tue Nov 18 15:16:04 2025 +0100 PM: sleep: core: Fix runtime PM enabling in device_resume_early() Runtime PM should only be enabled in device_resume_early() if it has been disabled for the given device by device_suspend_late(). Otherwise, it may cause runtime PM callbacks to run prematurely in some cases which leads to further functional issues. Make two changes to address this problem. First, reorder device_suspend_late() to only disable runtime PM for a device when it is going to look for the device's callback or if the device is a "syscore" one. In all of the other cases, disabling runtime PM for the device is not in fact necessary. However, if the device's callback returns an error and the power.is_late_suspended flag is not going to be set, enable runtime PM so it only remains disabled when power.is_late_suspended is set. Second, make device_resume_early() only enable runtime PM for the devices with the power.is_late_suspended flag set. Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") Reported-by: Rose Wu Closes: https://lore.kernel.org/linux-pm/70b25dca6f8c2756d78f076f4a7dee7edaaffc33.camel@mediatek.com/ Cc: 6.16+ # 6.16+ Reviewed-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12784270.O9o76ZdvQC@rafael.j.wysocki commit 5474560381775bc70cc90ed2acefad48ffd6ee07 Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:17 2025 +0530 drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A On PTL, no combo PHY is connected to PORT B. However, PORT B can still be used for Type-C and will utilize the C20 PHY for eDP over Type-C. In such configurations, VBTs also enumerate PORT B. This leads to issues where PORT B is incorrectly identified as using the C10 PHY, due to the assumption that returning true for PORT B in intel_encoder_is_c10phy() would not cause problems. From PTL's perspective, only PORT A/PHY A uses the C10 PHY. Update the helper intel_encoder_is_c10phy() to return true only for PORT A/PHY on PTL. v2: Change the condition code style for ptl/wcl Bspec: 72571,73944 Fixes: 9d10de78a37f ("drm/i915/wcl: C10 phy connected to port A and B") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-4-dnyaneshwar.bhadane@intel.com (cherry picked from commit 8147f7a1c083fd565fb958824f7c552de3b2dc46) Signed-off-by: Rodrigo Vivi commit 913253ed47b9925454cbb17faa3e350015b3d67a Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:16 2025 +0530 drm/i915/display: Add definition for wcl as subplatform We will need to differentiate between WCL and PTL in intel_encoder_is_c10phy(). Since WCL and PTL use the same display architecture, let's define WCL as a subplatform of PTL to allow the differentiation. v2: Update commit message and reorder wcl define (Gustavo) Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-3-dnyaneshwar.bhadane@intel.com (cherry picked from commit 4dfaae643e59cf3ab71b88689dce1b874f036f00) Signed-off-by: Rodrigo Vivi [Rodrigo added Fixes tag when porting it to fixes] commit 6eb2e056b0e418718fc5a3cfe79bdb41d9a2851d Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:15 2025 +0530 drm/pcids: Split PTL pciids group to make wcl subplatform To form the WCL platform as a subplatform of PTL in definition, WCL pci ids are splited into saparate group from PTL. So update the pciidlist struct to cover all the pci ids. v2: - Squash wcl description in single patch for display and xe.(jani,gustavo) Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-2-dnyaneshwar.bhadane@intel.com (cherry picked from commit 32620e176443bf23ec81bfe8f177c6721a904864) Signed-off-by: Rodrigo Vivi [Rodrigo added the Fixes tag when porting it to fixes] commit 0f08f0b0fb5e674b48f30e86c103760204a1d3f3 Author: Florian Fuchs Date: Thu Nov 13 19:10:00 2025 +0100 net: ps3_gelic_net: handle skb allocation failures Handle skb allocation failures in RX path, to avoid NULL pointer dereference and RX stalls under memory pressure. If the refill fails with -ENOMEM, complete napi polling and wake up later to retry via timer. Also explicitly re-enable RX DMA after oom, so the dmac doesn't remain stopped in this situation. Previously, memory pressure could lead to skb allocation failures and subsequent Oops like: Oops: Kernel access of bad area, sig: 11 [#2] Hardware name: SonyPS3 Cell Broadband Engine 0x701000 PS3 NIP [c0003d0000065900] gelic_net_poll+0x6c/0x2d0 [ps3_gelic] (unreliable) LR [c0003d00000659c4] gelic_net_poll+0x130/0x2d0 [ps3_gelic] Call Trace: gelic_net_poll+0x130/0x2d0 [ps3_gelic] (unreliable) __napi_poll+0x44/0x168 net_rx_action+0x178/0x290 Steps to reproduce the issue: 1. Start a continuous network traffic, like scp of a 20GB file 2. Inject failslab errors using the kernel fault injection: echo -1 > /sys/kernel/debug/failslab/times echo 30 > /sys/kernel/debug/failslab/interval echo 100 > /sys/kernel/debug/failslab/probability 3. After some time, traces start to appear, kernel Oopses and the system stops Step 2 is not always necessary, as it is usually already triggered by the transfer of a big enough file. Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") Signed-off-by: Florian Fuchs Link: https://patch.msgid.link/20251113181000.3914980-1-fuchsfl@gmail.com Signed-off-by: Paolo Abeni commit 896f1a2493b59beb2b5ccdf990503dbb16cb2256 Author: Pavel Zhigulin Date: Thu Nov 13 14:27:56 2025 +0300 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 55482edc25f0 ("qede: Add slowpath/fastpath support and enable hardware GRO") Signed-off-by: Pavel Zhigulin Link: https://patch.msgid.link/20251113112757.4166625-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Paolo Abeni commit db30233361f94e1a84450c607989bdb671100fb6 Author: Randy Dunlap Date: Mon Nov 10 22:09:34 2025 -0800 platform/x86: intel-uncore-freq: fix all header kernel-doc warnings In file uncore-frequency/uncore-frequency-common.h, correct all kernel-doc warnings by adding missing leading " *" to some lines, adding a missing kernel-doc entry, and fixing a name typo. Warning: uncore-frequency-common.h:50 bad line: Storage for kobject attribute elc_low_threshold_percent Warning: uncore-frequency-common.h:52 bad line: Storage for kobject attribute elc_high_threshold_percent Warning: uncore-frequency-common.h:54 bad line: Storage for kobject attribute elc_high_threshold_enable Warning: uncore-frequency-common.h:92 struct member 'min_freq_khz_kobj_attr' not described in 'uncore_data' Warning: uncore-frequency-common.h:92 struct member 'die_id_kobj_attr' not described in 'uncore_data' Fixes: 24b6616355f7 ("platform/x86/intel-uncore-freq: Add efficiency latency control to sysfs interface") Fixes: 416de0246f35 ("platform/x86: intel-uncore-freq: Fix types in sysfs callbacks") Fixes: 247b43fcd872 ("platform/x86/intel-uncore-freq: Add attributes to show die_id") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251111060938.1998542-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba Author: Armin Wolf Date: Mon Nov 17 16:59:38 2025 +0100 platform/x86: acer-wmi: Ignore backlight event On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events. Reported-by: Bugaddr Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues Tested-by: Bugaddr Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d8bb447efc5622577994287dc77c684fa8840b30 Author: Haotian Zhang Date: Mon Nov 17 11:33:54 2025 +0800 platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos isst_if_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The return code is returned from the probe function as is but probe functions should return normal errnos. A proper implementation can be found in drivers/leds/leds-ss4200.c. Convert PCIBIOS_* return codes using pcibios_err_to_errno() into normal errno before returning. Fixes: d3a23584294c ("platform/x86: ISST: Add Intel Speed Select mmio interface") Signed-off-by: Haotian Zhang Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251117033354.132-1-vulab@iscas.ac.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ddf5ffff3a5fe95bed178f5554596b93c52afbc9 Author: Srinivas Pandruvada Date: Mon Nov 10 15:50:41 2025 -0800 platform/x86/intel/hid: Add Nova Lake support Add ACPI ID for Nova Lake. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251110235041.123685-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6f91ad24c6639220f2edb0ad8edb199b43cc3b22 Author: Anthony Wong Date: Mon Nov 17 02:53:11 2025 +0800 platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora Add AWCC support to Alienware 16 Aurora Cc: stable@vger.kernel.org Signed-off-by: Anthony Wong Reviewed-by: Kurt Borja Link: https://patch.msgid.link/20251116185311.18074-1-anthony.wong@canonical.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ae8966b7b5bd69b86209cc34bcca1ba9f18b68e6 Author: Peter Hutterer Date: Thu Nov 6 21:45:34 2025 +1000 Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD And expand it to encompass all pressure pads. Definition: "pressure pad" as used here as includes all touchpads that use physical pressure to convert to click, without physical hinges. Also called haptic touchpads in general parlance, Synaptics calls them ForcePads. Most (all?) pressure pads are currently advertised as INPUT_PROP_BUTTONPAD. The suggestion to identify them as pressure pads by defining the resolution on ABS_MT_PRESSURE has been in the docs since commit 20ccc8dd38a3 ("Documentation: input: define ABS_PRESSURE/ABS_MT_PRESSURE resolution as grams") but few devices provide this information. In userspace it's thus impossible to determine whether a device is a true pressure pad (pressure equals pressure) or a normal clickpad with (pressure equals finger size). Commit 7075ae4ac9db ("Input: add INPUT_PROP_HAPTIC_TOUCHPAD") introduces INPUT_PROP_HAPTIC_TOUCHPAD but restricted it to those touchpads that have support for userspace-controlled effects. Let's expand and rename that definition to include all pressure pad touchpads since those that do support FF effects can be identified by the presence of the FF_HAPTIC bit. This means: - clickpad: INPUT_PROP_BUTTONPAD - pressurepad: INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD - pressurepad with configurable haptics: INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD + FF_HAPTIC Signed-off-by: Peter Hutterer Acked-by: Benjamin Tissoires Link: https://patch.msgid.link/20251106114534.GA405512@tassie Signed-off-by: Dmitry Torokhov commit f39b6c468c52745dbca9a842d91c8373fda208ab Merge: e08969c4d65ac3 6a23ae0a96a600 Author: Dmitry Torokhov Date: Mon Nov 17 23:16:55 2025 -0800 Merge tag 'v6.18-rc6' into for-linus Sync up with the mainline to bring in definition of INPUT_PROP_HAPTIC_TOUCHPAD. commit 5719a189c9345977c16f10874fd5102f70094d8f Author: René Rebe Date: Mon Nov 17 18:23:51 2025 +0100 ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection Turns out the Apple MacPro 6,1 trashcan also needs the inverted jack detection like Mac mini patched, too. Signed-off-by: René Rebe Cc: Link: https://patch.msgid.link/20251117.182351.1595411649664739497.rene@exactco.de Signed-off-by: Takashi Iwai commit 8e0a754b0836d996802713bbebc87bc1cc17925c Author: Lorenzo Bianconi Date: Thu Nov 13 18:19:38 2025 +0100 net: airoha: Do not loopback traffic to GDM2 if it is available on the device Airoha_eth driver forwards offloaded uplink traffic (packets received on GDM1 and forwarded to GDM{3,4}) to GDM2 in order to apply hw QoS. This is correct if the device does not support a dedicated GDM2 port. In this case, in order to enable hw offloading for uplink traffic, the packets should be sent to GDM{3,4} directly. Fixes: 9cd451d414f6 ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251113-airoha-hw-offload-gdm2-fix-v1-1-7e4ca300872f@kernel.org Signed-off-by: Jakub Kicinski commit bed22c7b90af732978715a1789bca1c3cfa245a6 Author: Ido Schimmel Date: Sun Nov 16 10:10:29 2025 +0200 selftests: net: lib: Do not overwrite error messages ret_set_ksft_status() calls ksft_status_merge() with the current return status and the last one. It treats a non-zero return code from ksft_status_merge() as an indication that the return status was overwritten by the last one and therefore overwrites the return message with the last one. Currently, ksft_status_merge() returns a non-zero return code even if the current return status and the last one are equal. This results in return messages being overwritten which is counter-productive since we are more interested in the first failure message and not the last one. Fix by changing ksft_status_merge() to only return a non-zero return code if the current return status was actually changed. Add a test case which checks that the first error message is not overwritten. Before: # ./lib_sh_test.sh [...] TEST: RET tfail2 tfail -> fail [FAIL] retmsg=tfail expected tfail2 [...] # echo $? 1 After: # ./lib_sh_test.sh [...] TEST: RET tfail2 tfail -> fail [ OK ] [...] # echo $? 0 Fixes: 596c8819cb78 ("selftests: forwarding: Have RET track kselftest framework constants") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20251116081029.69112-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit da02a1824884d6c84c5e5b5ac373b0c9e3288ec2 Author: Aleksei Nikiforov Date: Wed Nov 12 19:27:24 2025 +0100 s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer. Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak") Reviewed-by: Aswin Karuvally Signed-off-by: Aleksei Nikiforov Signed-off-by: Aswin Karuvally Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251112182724.1109474-1-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski commit 949f1fd2225baefbea2995afa807dba5cbdb6bd3 Author: Nam Cao Date: Mon Nov 17 08:42:31 2025 +0000 nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a kmemleak warning. Make sure this data is deallocated. Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251117084231.2910561-1-namcao@linutronix.de commit fa766e759ff7b128ab77323d9d9c232434621bb6 Author: Dnyaneshwar Bhadane Date: Thu Oct 16 18:45:17 2025 +0530 drm/i915/xe3lpd: Load DMC for Xe3_LPD version 30.02 Load the DMC for Xe3_LPD version 30.02. Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Reviewed-by: Chaitanya Kumar Borah Link: https://lore.kernel.org/r/20251016131517.2032684-1-dnyaneshwar.bhadane@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit a63db39a578b543f5e5719b9f14dd82d3b8648d1) Signed-off-by: Rodrigo Vivi [Rodrigo added the Fixes tag while cherry-picking to fixes] commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 Author: Hang Zhou <929513338@qq.com> Date: Mon Nov 17 01:08:35 2025 +1100 spi: bcm63xx: fix premature CS deassertion on RX-only transactions On BCM6358 (and also observed on BCM6368) the controller appears to only generate as many SPI clocks as bytes that have been written into the TX FIFO. For RX-only transfers the driver programs the transfer length in SPI_MSG_CTL but does not write anything into the FIFO, so chip select is deasserted early and the RX transfer segment is never fully clocked in. A concrete failing case is a three-transfer MAC address read from SPI-NOR: - TX 0x03 (read command) - TX 3-byte address - RX 6 bytes (MAC) In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works because the driver uses prepend_len and writes dummy bytes into the TX FIFO for the RX part. Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only segments so that the number of bytes written to the FIFO matches the total message length seen by the controller. Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up") Signed-off-by: Hang Zhou <929513338@qq.com> Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com Signed-off-by: Mark Brown commit e7c375b181600caf135cfd03eadbc45eb530f2cb Merge: 418592a04021ba e9d50b78fdfe67 Author: Linus Torvalds Date: Mon Nov 17 09:11:27 2025 -0800 Merge tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix unitialized variable in statmount_string() - Fix hostfs mounting when passing host root during boot - Fix dynamic lookup to fail on cell lookup failure - Fix missing file type when reading bfs inodes from disk - Enforce checking of sb_min_blocksize() calls and update all callers accordingly - Restore write access before closing files opened by open_exec() in binfmt_misc - Always freeze efivarfs during suspend/hibernate cycles - Fix statmount()'s and listmount()'s grab_requested_mnt_ns() helper to actually allow mount namespace file descriptor in addition to mount namespace ids - Fix tmpfs remount when noswap is specified - Switch Landlock to iput_not_last() to remove false-positives from might_sleep() annotations in iput() - Remove dead node_to_mnt_ns() code - Ensure that per-queue kobjects are successfully created * tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: landlock: fix splats from iput() after it started calling might_sleep() fs: add iput_not_last() shmem: fix tmpfs reconfiguration (remount) when noswap is set fs/namespace: correctly handle errors returned by grab_requested_mnt_ns power: always freeze efivarfs binfmt_misc: restore write access before closing files opened by open_exec() block: add __must_check attribute to sb_min_blocksize() virtio-fs: fix incorrect check for fsvq->kobj xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super isofs: check the return value of sb_min_blocksize() in isofs_fill_super exfat: check return value of sb_min_blocksize in exfat_read_boot_sector vfat: fix missing sb_min_blocksize() return value checks mnt: Remove dead code which might prevent from building bfs: Reconstruct file type when loading from disk afs: Fix dynamic lookup to fail on cell lookup failure hostfs: Fix only passing host root in boot stage with new mount fs: Fix uninitialized 'offp' in statmount_string() commit 418592a04021baf5fcfbd0b7b7c5330bb135d10f Merge: e97c61885bfe39 36c6f3c03d104f Author: Linus Torvalds Date: Mon Nov 17 09:01:22 2025 -0800 Merge tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "Five fixes addressing PREEMPT_RT compatibility and locking issues. Three commits fix potential deadlocks and sleeps in atomic contexts on RT kernels by converting locks to raw spinlocks and ensuring IRQ work runs in hard-irq context. The remaining two fix unsafe locking in the debug dump path and a variable dereference typo" * tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work sched_ext: Fix possible deadlock in the deferred_irq_workfn() sched/ext: convert scx_tasks_lock to raw spinlock sched_ext: Fix unsafe locking in the scx_dump_state() sched_ext: Fix use of uninitialized variable in scx_bpf_cpuperf_set() commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 Author: Ewan D. Milne Date: Mon Nov 10 16:20:01 2025 -0500 nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915] Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context") Cc: stable@vger.kernel.org Tested-by: Marco Patalano Reviewed-by: Justin Tee Signed-off-by: Ewan D. Milne Signed-off-by: Keith Busch commit ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 Author: Ewan D. Milne Date: Mon Nov 10 16:20:00 2025 -0500 nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() Now target is removed from nvme_fc_ctrl_free() which is the ctrl->ref release handler. And even admin queue is unquiesced there, this way is definitely wrong because the ctr->ref is grabbed when submitting command. And Marco observed that nvme_fc_ctrl_free() can be called from request completion code path, and trigger kernel warning since request completes from softirq context. Fix the issue by moveing target removal into nvme_fc_delete_ctrl(), which is also aligned with nvme-tcp and nvme-rdma. Patch originally proposed by Ming Lei, then modified to move the tagset removal down to after nvme_fc_delete_association() after further testing. Cc: Marco Patalano Cc: Ewan Milne Cc: James Smart Cc: Sagi Grimberg Signed-off-by: Ming Lei Cc: stable@vger.kernel.org Tested-by: Marco Patalano Reviewed-by: Justin Tee Signed-off-by: Ewan D. Milne Signed-off-by: Keith Busch commit e97c61885bfe3919ed1f7d56bf05d3ffef392ccb Merge: 6a23ae0a96a600 97315e7c901a1d Author: Linus Torvalds Date: Mon Nov 17 08:57:21 2025 -0800 Merge tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "Mostly small misc fixes, here they are sorted by sub-subsystem: ECC fixes: - Realtek Kconfig fix SPI NAND fixes: - Remove nonexistent QE bit on FMSH FM25S01A Raw NAND fixes: - Prevent DMA device NULL pointer dereference in Cadence driver MTD device fixes: - Possible integer overflow in read/write ioctls - Fix the IRQ handler pointer in the onenand driver, even if in practice it is never dereferenced. * tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: onenand: Pass correct pointer to IRQ handler mtd: spinand: fmsh: remove QE bit for FM25S01A flash mtd: rawnand: cadence: fix DMA device NULL pointer dereference mtd: rawnand: realtek: Make rtl_ecc_engine_ops const mtd: nand: MTD_NAND_ECC_REALTEK should depend on HAS_DMA mtd: nand: realtek-ecc: Fix a IS_ERR() vs NULL bug in probe mtdchar: fix integer overflow in read/write ioctls commit 517d066dc080fc297f1ab5e8c6fda7c59d48ef8d Author: Alexander Stein Date: Tue Aug 26 16:08:50 2025 +0200 MAINTAINERS: Add entry for TQ-Systems AM335 device trees This includes the TQMa335x series and the corresponding mainboard MBa335x. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250826140853.2570528-5-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit c83fc13960643c4429cd9dfef1321e6430a81b47 Author: Ivan Zhaldak Date: Mon Nov 17 15:58:35 2025 +0300 ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 Integrated amplifier LEAK Stereo 230 by IAG Limited has built-in ESS9038Q2M DAC served by XMOS controller. It supports both DSD Native and DSD-over-PCM (DoP) operational modes. But it doesn't work properly by default and tries DSD-to-PCM conversion. USB quirks below allow it to operate as designed. Add DSD_RAW quirk flag for IAG Limited devices (vendor ID 0x2622) Add DSD format quirk for LEAK Stereo 230 (USB ID 0x2622:0x0061) Signed-off-by: Ivan Zhaldak Cc: Link: https://patch.msgid.link/20251117125848.30769-1-i.v.zhaldak@gmail.com Signed-off-by: Takashi Iwai commit d4371c266ba3d708cd760d5dbfec960c399d3552 Author: Haotian Zhang Date: Mon Nov 17 14:55:59 2025 +0800 ALSA: au88x0: Fix incorrect error handling for PCI config reads __snd_vortex_probe() uses pci_read_config_word() that returns PCIBIOS_* codes (positive values on error). However, the function checks 'err < 0' which can never be true for PCIBIOS_* codes, causing errors to be silently ignored. Check for non-zero return value and convert PCIBIOS_* codes using pcibios_err_to_errno() into normal errno before returning them. Signed-off-by: Haotian Zhang Reviewed-by: Philipp Stanner Link: https://patch.msgid.link/20251117065559.1138-1-vulab@iscas.ac.cn Signed-off-by: Takashi Iwai commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 Author: Marc Kleine-Budde Date: Sun Nov 16 16:55:26 2025 +0100 can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits to be reset. If we ever reach the condition of handling more than `SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body. This may, among other issues, cause us to never `netif_wake_queue()` again after a transmission interrupt. Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module") Cc: stable@vger.kernel.org Co-developed-by: Thomas Mühlbacher Signed-off-by: Thomas Mühlbacher Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 6d5479953270f60ac064d154a76cb7ba64fb81f8 Merge: 30db4451c7f6aa 395d988f938611 Author: Marc Kleine-Budde Date: Mon Nov 17 17:22:04 2025 +0100 Merge patch series "can: gs_usb: fix USB bulk in and out callbacks" Marc Kleine-Budde says: The bulk-out callback gs_usb_xmit_callback() does not take care of the cleanup of failed transfers of URBs. The 1st patch adds the missing cleanup. The bulk-in callback gs_usb_receive_bulk_callback() accesses the buffer of the URB without checking how much data has actually been received. The last 2 patches fix this problem. Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-0-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 395d988f93861101ec89d0dd9e3b876ae9392a5b Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:03 2025 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping). Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de [mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()] Signed-off-by: Marc Kleine-Budde commit 6d87cd5335784351280f82c47cc8a657271929c3 Author: Shin'ichiro Kawasaki Date: Mon Nov 17 11:23:39 2025 +0900 nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion. To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq. Reported-by: Yi Zhang Closes: https://lore.kernel.org/linux-block/CAHj4cs8mJ+R_GmQm9R8ebResKAWUE8kF5+_WVg0v8zndmqd6BQ@mail.gmail.com/ Link: https://lore.kernel.org/linux-block/oeyzci6ffshpukpfqgztsdeke5ost5hzsuz4rrsjfmvpqcevax@5nhnwbkzbrpa/ Fixes: 1f021341eef4 ("nvme-multipath: defer partition scanning") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 159de7a825aea4242d3f8d32de5853d269dbe72f Author: Alistair Francis Date: Fri Nov 7 09:17:11 2025 +1000 nvmet-auth: update sc_c in target host hash calculation Commit 7e091add9c43 "nvme-auth: update sc_c in host response" added the sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response. This breaks secure concat connections with a Linux target as the target code wasn't updated at the same time. This patch fixes this by adding a new sc_c variable to the host hash calculations. Fixes: 7e091add9c43 ("nvme-auth: update sc_c in host response") Tested-by: Shin'ichiro Kawasaki Tested-by: Yi Zhang Reviewed-by: Martin George Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit 36c6f3c03d104faf1aa90922f2310549c175420f Author: Zqiang Date: Mon Nov 17 20:53:10 2025 +0800 sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work For PREEMPT_RT kernels, the kick_cpus_irq_workfn() be invoked in the per-cpu irq_work/* task context and there is no rcu-read critical section to protect. this commit therefore use IRQ_WORK_INIT_HARD() to initialize the per-cpu rq->scx.kick_cpus_irq_work in the init_sched_ext_class(). Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit e19d7f7e92e061707252eab2b71d2c3be09b2e96 Author: Amirreza Zarrabi Date: Thu Nov 13 19:38:42 2025 -0800 tee: qcomtee: initialize result before use in release worker Initialize result to 0 so the error path doesn't read it uninitialized when the invoke fails. Fixes a Smatch warning. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/op-tee/7c1e0de2-7d42-4c6b-92fe-0e4fe5d650b5@oss.qualcomm.com/ Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Amirreza Zarrabi Reviewed-by: Sumit Garg Reviewed-by: Konrad Dybcio Signed-off-by: Jens Wiklander commit 6a23ae0a96a600d1d12557add110e0bb6e32730c Author: Linus Torvalds Date: Sun Nov 16 14:25:38 2025 -0800 Linux 6.18-rc6 commit 998ccc327b14c03861247540ff6f8135a5283621 Merge: 7ba45f15049b44 b72b8132d8fd2d Author: Linus Torvalds Date: Sun Nov 16 13:45:03 2025 -0800 Merge tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix writing bpf_prog (infos|btfs)_cnt to data file, to not generate invalid perf.data files in some corner cases. - Fix 'perf top' segfault by ensuring libbfd is initialized. This is an opt-in feature due to license incompatibilities. - Fix segfault in 'perf lock' due to missing kernel map. - Fix 'perf lock contention' test. - Don't fail fast path detection if binutils-devel isn't available. - Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason. * tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf libbfd: Ensure libbfd is initialized prior to use perf test: Fix lock contention test perf lock: Fix segfault due to missing kernel map tools headers UAPI: Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason perf build: Don't fail fast path feature detection when binutils-devel is not available perf header: Write bpf_prog (infos|btfs)_cnt to data file commit 7ba45f15049b4442c932ca2499aec739bb6bdbcf Merge: 7254a2b5227909 1c2a936edd71e1 Author: Linus Torvalds Date: Sun Nov 16 13:31:14 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "7 hotfixes. 5 are cc:stable, 4 are against mm/ All are singletons - please see the respective changelogs for details" * tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm, swap: fix potential UAF issue for VMA readahead selftests/user_events: fix type cast for write_index packed member in perf_test lib/test_kho: check if KHO is enabled mm/huge_memory: fix folio split check for anon folios in swapcache MAINTAINERS: update David Hildenbrand's email address crash: fix crashkernel resource shrink mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb commit e2cb69263e797c0aa6676bcef23e9e27e44c83b0 Author: Chen Pei Date: Fri Nov 14 15:12:15 2025 +0800 tools: riscv: Fixed misalignment of CSR related definitions The file tools/arch/riscv/include/asm/csr.h borrows from arch/riscv/include/asm/csr.h, and subsequent modifications related to CSR should maintain consistency. Signed-off-by: Chen Pei Link: https://patch.msgid.link/20251114071215.816-1-cp0613@linux.alibaba.com [pjw@kernel.org: dropped Fixes: lines for patches that weren't broken; removed superfluous blank line] Signed-off-by: Paul Walmsley commit 7b090e7b910cafd245f23e56f3257a151ca0a289 Author: Mayuresh Chitale Date: Fri Nov 14 06:58:06 2025 +0000 riscv: sbi: Prefer SRST shutdown over legacy Currently, the sbi_init() always attempts to register the legacy shutdown function as the sys-off handler which is fine when RISCV_SBI_V01 is not enabled. However, if RISCV_SBI_V01 is enabled in the kernel and the SBI v0.1 is not supported by the underlying SBI implementation then the legacy shutdown fails. Fix this by not registering the legacy shutdown when SRST shutdown is available. Fixes: 70ddf86d76c1 ("riscv: sbi: Switch to new sys-off handler API") Signed-off-by: Mayuresh Chitale Reviewed-by: Anup Patel Link: https://patch.msgid.link/20251114065808.304430-1-mchitale@ventanamicro.com Signed-off-by: Paul Walmsley commit 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:02 2025 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-2-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 516a0cd1c03fa266bb67dd87940a209fd4e53ce7 Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:01 2025 +0100 can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs The driver lacks the cleanup of failed transfers of URBs. This reduces the number of available URBs per error by 1. This leads to reduced performance and ultimately to a complete stop of the transmission. If the sending of a bulk URB fails do proper cleanup: - increase netdev stats - mark the echo_sbk as free - free the driver's context and do accounting - wake the send queue Closes: https://github.com/candle-usb/candleLight_fw/issues/187 Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-1-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 30db4451c7f6aabcada029b15859a76962ec0cf8 Author: Thomas Mühlbacher Date: Sat Nov 15 15:34:56 2025 +0000 can: sja1000: fix max irq loop handling Reading the interrupt register `SJA1000_IR` causes all of its bits to be reset. If we ever reach the condition of handling more than `SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body. This may, among other issues, cause us to never `netif_wake_queue()` again after a transmission interrupt. Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller") Cc: stable@vger.kernel.org Signed-off-by: Thomas Mühlbacher Acked-by: Oliver Hartkopp Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net Signed-off-by: Marc Kleine-Budde commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec Author: Seungjin Bae Date: Thu Oct 23 12:27:09 2025 -0400 can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position `pos` to the next packet boundary using `round_up()` function. However, if zero-length command is found exactly on a packet boundary (i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up` function will return the unchanged value of `pos`. This prevents `pos` to be increased, causing an infinite loop in the parsing logic. This patch fixes this in the function by using `pos + 1` instead. This ensures that even if `pos` is on a boundary, the calculation is based on `pos + 1`, forcing `round_up()` to always return the next aligned boundary. Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") Signed-off-by: Seungjin Bae Reviewed-by: Jimmy Assarsson Tested-by: Jimmy Assarsson Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com Signed-off-by: Marc Kleine-Budde commit 7254a2b52279091683e0228095118ee69ce9742f Merge: 87751e715e23ed 1107aac1ad7f44 Author: Linus Torvalds Date: Sun Nov 16 07:08:28 2025 -0800 Merge tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "This includes some fixes for the topology map, newly introduced in v6.18 kernel" * tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix to update generation field in topology map firewire: core: Initialize topology_map.lock commit 87751e715e23ede7386fb57a1a8593aa9830b21f Merge: f824272b6e3fe2 281326be67252a Author: Linus Torvalds Date: Sun Nov 16 07:05:24 2025 -0800 Merge tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - In Versalnet, handle the reporting of non-standard hw errors whose information can come in more than one remote processor message. - Explicitly reenable ECC checking after a warm reset in Altera OCRAM as those registers are reset to default otherwise - Fix single-bit error injection in Altera EDAC to not inject errors directly in ECC RAM and thus lead to false double-bit errors due to same ECC RAM being in concurrent use * tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection EDAC/altera: Handle OCRAM ECC enable after warm reset EDAC/versalnet: Handle split messages for non-standard errors commit e89ee35567d3d465ef0715953170be72f5ef1d4c Author: Xu Yang Date: Thu Nov 13 19:14:44 2025 +0800 arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity According to the board design, set SEL to high means flipped connection (TX2/RX2). And the TCPM will output logical 1 if it needs flipped connection. So switch to active high for select-gpios. The EN pin on mux chip is low active, so switch to active low for enable-gpios too. Fixes: b237975b2cd5 ("arm64: dts: imx8qm-mek: add usb 3.0 and related type C nodes") Cc: stable@vger.kernel.org Reviewed-by: Jun Li Signed-off-by: Xu Yang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 1107aac1ad7f445a83604b14af7be47f1a795c66 Author: Takashi Sakamoto Date: Fri Nov 14 23:44:21 2025 +0900 firewire: core: fix to update generation field in topology map The generation field of topology map is updated after initialized by zero. The updated value of generation field is always zero, and is against specification. This commit fixes the bug. Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map") Link: https://lore.kernel.org/r/20251114144421.415278-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 91f815b7073d8f1abb5f3a3a7bf6b9466a6e5e8f Author: Chao-ying Fu Date: Thu Nov 13 17:10:32 2025 +0100 riscv: Update MIPS vendor id to 0x127 [1] defines MIPS vendor id as 0x127. All previous MIPS RISC-V patches were tested on QEMU, also modified to use 0x722 as MIPS_VENDOR_ID. This new value should reflect real hardware. [1] https://mips.com/wp-content/uploads/2025/06/P8700_Programmers_Reference_Manual_Rev1.84_5-31-2025.pdf Fixes: a8fed1bc03ac ("riscv: Add xmipsexectl as a vendor extension") Signed-off-by: Chao-ying Fu Signed-off-by: Aleksa Paunovic Link: https://patch.msgid.link/20251113-mips-vendorid-v2-1-3279489b7f84@htecgroup.com Cc: Signed-off-by: Paul WAlmsley commit 1c2a936edd71e133f2806e68324ec81a4eb07588 Author: Kairui Song Date: Tue Nov 11 21:36:08 2025 +0800 mm, swap: fix potential UAF issue for VMA readahead Since commit 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning"), the common helper for allocating and preparing a folio in the swap cache layer no longer tries to get a swap device reference internally, because all callers of __read_swap_cache_async are already holding a swap entry reference. The repeated swap device pinning isn't needed on the same swap device. Caller of VMA readahead is also holding a reference to the target entry's swap device, but VMA readahead walks the page table, so it might encounter swap entries from other devices, and call __read_swap_cache_async on another device without holding a reference to it. So it is possible to cause a UAF when swapoff of device A raced with swapin on device B, and VMA readahead tries to read swap entries from device A. It's not easy to trigger, but in theory, it could cause real issues. Make VMA readahead try to get the device reference first if the swap device is a different one from the target entry. Link: https://lkml.kernel.org/r/20251111-swap-fix-vma-uaf-v1-1-41c660e58562@tencent.com Fixes: 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning") Suggested-by: Huang Ying Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: Kemeng Shi Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton commit 216158f063fe24fb003bd7da0cd92cd6e2c4d48b Author: Ankit Khushwaha Date: Thu Nov 6 15:25:32 2025 +0530 selftests/user_events: fix type cast for write_index packed member in perf_test Accessing 'reg.write_index' directly triggers a -Waddress-of-packed-member warning due to potential unaligned pointer access: perf_test.c:239:38: warning: taking address of packed member 'write_index' of class or structure 'user_reg' may result in an unaligned pointer value [-Waddress-of-packed-member] 239 | ASSERT_NE(-1, write(self->data_fd, ®.write_index, | ^~~~~~~~~~~~~~~ Since write(2) works with any alignment. Casting '®.write_index' explicitly to 'void *' to suppress this warning. Link: https://lkml.kernel.org/r/20251106095532.15185-1-ankitkhushwaha.linux@gmail.com Fixes: 42187bdc3ca4 ("selftests/user_events: Add perf self-test for empty arguments events") Signed-off-by: Ankit Khushwaha Cc: Beau Belgrave Cc: "Masami Hiramatsu (Google)" Cc: Steven Rostedt Cc: sunliming Cc: Wei Yang Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit a26ec8f3d4e56d4a7ffa301e8032dca9df0bbc05 Author: Pasha Tatashin Date: Thu Nov 6 17:06:35 2025 -0500 lib/test_kho: check if KHO is enabled We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized. Link: https://lkml.kernel.org/r/20251106220635.2608494-1-pasha.tatashin@soleen.com Fixes: b753522bed0b ("kho: add test for kexec handover") Signed-off-by: Pasha Tatashin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511061629.e242724-lkp@intel.com Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Signed-off-by: Andrew Morton commit f1d47cafe513b5552a5b20a7af0936d9070a8a78 Author: Zi Yan Date: Wed Nov 5 11:29:10 2025 -0500 mm/huge_memory: fix folio split check for anon folios in swapcache Both uniform and non uniform split check missed the check to prevent splitting anon folios in swapcache to non-zero order. Splitting anon folios in swapcache to non-zero order can cause data corruption since swapcache only support PMD order and order-0 entries. This can happen when one use split_huge_pages under debugfs to split anon folios in swapcache. In-tree callers do not perform such an illegal operation. Only debugfs interface could trigger it. I will put adding a test case on my TODO list. Fix the check. Link: https://lkml.kernel.org/r/20251105162910.752266-1-ziy@nvidia.com Fixes: 58729c04cf10 ("mm/huge_memory: add buddy allocator like (non-uniform) folio_split()") Signed-off-by: Zi Yan Reported-by: "David Hildenbrand (Red Hat)" Closes: https://lore.kernel.org/all/dc0ecc2c-4089-484f-917f-920fdca4c898@kernel.org/ Acked-by: David Hildenbrand (Red Hat) Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Cc: Wei Yang Cc: Signed-off-by: Andrew Morton commit 3470715e5c22578c6ea4098b256d5a904e12eef2 Author: David Hildenbrand (Red Hat) Date: Mon Nov 3 11:36:59 2025 +0100 MAINTAINERS: update David Hildenbrand's email address Switch to kernel.org email address as I will be leaving Red Hat. The old address will remain active until end of January 2026, so performing the change now should make sure that most mails will reach me. Link: https://lkml.kernel.org/r/20251103103659.379335-1-david@kernel.org Signed-off-by: David Hildenbrand Signed-off-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 00fbff75c5acb4755f06f08bd1071879c63940c5 Author: Sourabh Jain Date: Sun Nov 2 01:07:41 2025 +0530 crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Call Trace: ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40 __crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0 This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated. Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory. Link: https://lkml.kernel.org/r/20251101193741.289252-1-sourabhjain@linux.ibm.com Fixes: 16c6006af4d4 ("kexec: enable kexec_crash_size to support two crash kernel regions") Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Zhen Lei Cc: Signed-off-by: Andrew Morton commit 39231e8d6ba7f794b566fd91ebd88c0834a23b98 Author: David Hildenbrand (Red Hat) Date: Fri Nov 14 22:49:20 2025 +0100 mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb In the past, CONFIG_ARCH_HAS_GIGANTIC_PAGE indicated that we support runtime allocation of gigantic hugetlb folios. In the meantime it evolved into a generic way for the architecture to state that it supports gigantic hugetlb folios. In commit fae7d834c43c ("mm: add __dump_folio()") we started using CONFIG_ARCH_HAS_GIGANTIC_PAGE to decide MAX_FOLIO_ORDER: whether we could have folios larger than what the buddy can handle. In the context of that commit, we started using MAX_FOLIO_ORDER to detect page corruptions when dumping tail pages of folios. Before that commit, we assumed that we cannot have folios larger than the highest buddy order, which was obviously wrong. In commit 7b4f21f5e038 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate"), we used MAX_FOLIO_ORDER to detect inconsistencies, and in fact, we found some now. Powerpc allows for configs that can allocate gigantic folio during boot (not at runtime), that do not set CONFIG_ARCH_HAS_GIGANTIC_PAGE and can exceed PUD_ORDER. To fix it, let's make powerpc select CONFIG_ARCH_HAS_GIGANTIC_PAGE with hugetlb on powerpc, and increase the maximum folio size with hugetlb to 16 GiB on 64bit (possible on arm64 and powerpc) and 1 GiB on 32 bit (powerpc). Note that on some powerpc configurations, whether we actually have gigantic pages depends on the setting of CONFIG_ARCH_FORCE_MAX_ORDER, but there is nothing really problematic about setting it unconditionally: we just try to keep the value small so we can better detect problems in __dump_folio() and inconsistencies around the expected largest folio in the system. Ideally, we'd have a better way to obtain the maximum hugetlb folio size and detect ourselves whether we really end up with gigantic folios. Let's defer bigger changes and fix the warnings first. While at it, handle gigantic DAX folios more clearly: DAX can only end up creating gigantic folios with HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD. Add a new Kconfig option HAVE_GIGANTIC_FOLIOS to make both cases clearer. In particular, worry about ARCH_HAS_GIGANTIC_PAGE only with HUGETLB_PAGE. Note: with enabling CONFIG_ARCH_HAS_GIGANTIC_PAGE on powerpc, we will now also allow for runtime allocations of folios in some more powerpc configs. I don't think this is a problem, but if it is we could handle it through __HAVE_ARCH_GIGANTIC_PAGE_RUNTIME_SUPPORTED. While __dump_page()/__dump_folio was also problematic (not handling dumping of tail pages of such gigantic folios correctly), it doesn't seem critical enough to mark it as a fix. Link: https://lkml.kernel.org/r/20251114214920.2550676-1-david@kernel.org Fixes: 7b4f21f5e038 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate") Reported-by: Christophe Leroy Closes: https://lore.kernel.org/r/3e043453-3f27-48ad-b987-cc39f523060a@csgroup.eu/ Reported-by: Sourabh Jain Closes: https://lore.kernel.org/r/94377f5c-d4f0-4c0f-b0f6-5bf1cd7305b1@linux.ibm.com/ Signed-off-by: David Hildenbrand (Red Hat) Cc: Ritesh Harjani (IBM) Cc: Madhavan Srinivasan Cc: Donet Tom Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit f824272b6e3fe24950abc527136e8140f67b0b23 Merge: b8a2c32b22de69 31475b88110c47 Author: Linus Torvalds Date: Sat Nov 15 09:01:00 2025 -0800 Merge tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Heiko Carstens: - Fix a bug in the __ptep_rdp() inline assembly which may lead to missing TLB flushes * tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: Fix __ptep_rdp() inline assembly commit b8a2c32b22de691cceb835f1de306f2a8c1dd0c8 Merge: bb1a6ddcfaa54b dd14022a7ce969 Author: Linus Torvalds Date: Sat Nov 15 08:55:29 2025 -0800 Merge tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Update the list of AMD microcode minimum Entrysign revisions - Add additional fixed AMD RDSEED microcode revisions - Update the language transliteration for Kiryl Shutsemau's name in the MAINTAINERS entry * tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev x86/CPU/AMD: Add additional fixed RDSEED microcode revisions MAINTAINERS: Update name spelling commit bb1a6ddcfaa54b156e6e2ac61a986c4f5f8cb841 Merge: fa3ade5e8e247e e0fd4d42e27f76 Author: Linus Torvalds Date: Sat Nov 15 08:51:43 2025 -0800 Merge tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a memory leak in the posix timer creation logic" * tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-timers: Plug potential memory leak in do_timer_create() commit fa3ade5e8e247e39bd192c92f9d1c1d08e0e61a4 Merge: e256f7b4e57d9f 14473a1f88596f Author: Linus Torvalds Date: Sat Nov 15 08:48:51 2025 -0800 Merge tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix an irqchip driver release bug in the riscv-intc irqchip driver" * tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops commit e256f7b4e57d9f1149efd0e7745f77d8e615177b Merge: 7a0892d2836e12 ebd4469e7af610 Author: Linus Torvalds Date: Sat Nov 15 08:46:18 2025 -0800 Merge tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fix from Ingo Molnar: "Fix a broken #ifndef in the header. It hasn't caused problems upstream yet because no arch overrides arch_xfer_to_guest_mode_handle_work() at this moment" * tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub commit 5442a9da69789741bfda39f34ee7f69552bf0c56 Author: Jesper Dangaard Brouer Date: Wed Nov 12 14:13:52 2025 +0100 veth: more robust handing of race to avoid txq getting stuck Commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max). The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a "lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts. This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring->consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy. This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer: (1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely responsible for re-waking the TXQ. This handles the race where veth_poll() consumes all packets and completes NAPI *before* veth_xmit() on the producer side has called netif_tx_stop_queue. The __veth_xdp_flush(rq) will observe rx_notify_masked is false and schedule NAPI. (2) On the consumer side, the logic for waking the peer TXQ is moved out of veth_xdp_rcv() and placed at the end of the veth_poll() function. This placement is part of fixing the race, as the netif_tx_queue_stopped() check must occur after rx_notify_masked is potentially set to false during NAPI completion. This handles the race where veth_poll() consumes all packets, but haven't finished (rx_notify_masked is still true). The producer veth_xmit() stops the TXQ and __veth_xdp_flush(rq) will observe rx_notify_masked is true, meaning not starting NAPI. Then veth_poll() change rx_notify_masked to false and stops NAPI. Before exiting veth_poll() will observe TXQ is stopped and wake it up. Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") Reviewed-by: Toshiaki Makita Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/176295323282.307447.14790015927673763094.stgit@firesoul Signed-off-by: Jakub Kicinski commit dfe28c4167a9259fc0c372d9f9473e1ac95cff67 Author: Ilya Maximets Date: Wed Nov 12 12:14:03 2025 +0100 net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible. There is also confusion in the code between the 'masked' flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation code. Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang Signed-off-by: Ilya Maximets Acked-by: Eelco Chaudron Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20251112112246.95064-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 035bca3f017ee9dea3a5a756e77a6f7138cc6eea Author: Eric Dumazet Date: Thu Nov 13 10:39:24 2025 +0000 mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Cc: stable@vger.kernel.org Fixes: 3b1d6210a957 ("mptcp: implement and use MPTCP-level retransmission") Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b0c959fec18f4595a6a6317ffc30615cfa37bf69 Author: Pavel Zhigulin Date: Thu Nov 13 19:19:21 2025 +0300 net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() The call to devlink_info_version_fixed_put() in mlxsw_linecard_devlink_info_get() did not check for errors, although it is checked everywhere in the code. Add missed 'err' check to the mlxsw_linecard_devlink_info_get() Fixes: 3fc0c51905fb ("mlxsw: core_linecards: Expose device PSID over device info") Signed-off-by: Pavel Zhigulin Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251113161922.813828-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit e6751b0b19a6baab219a62e1e302b8aa6b5a55b2 Author: Pavel Zhigulin Date: Thu Nov 13 16:57:44 2025 +0300 net: dsa: hellcreek: fix missing error handling in LED registration The LED setup routine registered both led_sync_good and led_is_gm devices without checking the return values of led_classdev_register(). If either registration failed, the function continued silently, leaving the driver in a partially-initialized state and leaking a registered LED classdev. Add proper error handling Fixes: 7d9ee2e8ff15 ("net: dsa: hellcreek: Add PTP status LEDs") Signed-off-by: Pavel Zhigulin Reviewed-by: Andrew Lunn Acked-by: Kurt Kanzenbach Link: https://patch.msgid.link/20251113135745.92375-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit 7a0892d2836e12cc61b6823f888629a3eb64e268 Merge: cbba5d1b53fb82 921b3f59b7b00c Author: Linus Torvalds Date: Fri Nov 14 15:45:31 2025 -0800 Merge tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Cache the ASPM L0s/L1 Supported bits early so quirks can override them if necessary (Bjorn Helgaas) - Add quirks for PA Semi and Freescale Root Ports and a HiSilicon Wi-Fi device that are reported to have broken L0s and L1 (Shawn Lin, Bjorn Helgaas) * tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports PCI/ASPM: Convert quirks to override advertised link states PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden commit cbba5d1b53fb82209feacb459edecb1ef8427119 Merge: a752782a284332 6c762611fed736 Author: Linus Torvalds Date: Fri Nov 14 15:39:39 2025 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix interaction between livepatch and BPF fexit programs (Song Liu) With Steven and Masami acks. - Fix stack ORC unwind from BPF kprobe_multi (Jiri Olsa) With Steven and Masami acks. - Fix out of bounds access in widen_imprecise_scalars() in the verifier (Eduard Zingerman) - Fix conflicts between MPTCP and BPF sockmap (Jiayuan Chen) - Fix net_sched storage collision with BPF data_meta/data_end (Eric Dumazet) - Add _impl suffix to BPF kfuncs with implicit args to avoid breaking them in bpf-next when KF_IMPLICIT_ARGS is added (Mykyta Yatsenko) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Test widen_imprecise_scalars() with different stack depth bpf: account for current allocated stack depth in widen_imprecise_scalars() bpf: Add bpf_prog_run_data_pointers() selftests/bpf: Add mptcp test with sockmap mptcp: Fix proto fallback detection with BPF mptcp: Disallow MPTCP subflows from sockmap selftests/bpf: Add stacktrace ips test for raw_tp selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" bpf: add _impl suffix for bpf_stream_vprintk() kfunc bpf:add _impl suffix for bpf_task_work_schedule* kfuncs selftests/bpf: Add tests for livepatch + bpf trampoline ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() ftrace: Fix BPF fexit with livepatch commit a752782a2843323d2c04ee6ab79531d027072e88 Merge: 1cc41c88ef00de fdf302e6bea182 Author: Linus Torvalds Date: Fri Nov 14 15:36:15 2025 -0800 Merge tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fix from Miguel Ojeda: - Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing DWARF debug information anymore by teaching gendwarfksyms to skip object files without exports * tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: gendwarfksyms: Skip files with no exports commit 1cc41c88ef00de0f3216c5f4b9cfab47de1c49d3 Merge: d5c1b4b43249bf b623390045a81f Author: Linus Torvalds Date: Fri Nov 14 13:44:23 2025 -0800 Merge tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Various fixes when using NFS with TLS - Localio direct-IO fixes - Fix error handling in nfs_atomic_open_v23() - Fix sysfs memory leak when nfs_client kobject add fails - Fix an incorrect parameter when calling nfs4_call_sync() - Fix a failing LTP test when using delegated timestamps * tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Fix LTP test failures when timestamps are delegated NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() NFS: sysfs: fix leak when nfs_client kobject add fails NFSv2/v3: Fix error handling in nfs_atomic_open_v23() nfs/localio: do not issue misaligned DIO out-of-order nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion nfs/localio: backfill missing partial read support for misaligned DIO nfs/localio: add refcounting for each iocb IO associated with NFS pgio header nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support NFS: Check the TLS certificate fields in nfs_match_client() pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect() commit d5c1b4b43249bfa038df2f63e2d506bbf6e07df9 Merge: ccc0011804d406 362a7d4fd5c473 Author: Linus Torvalds Date: Fri Nov 14 13:39:15 2025 -0800 Merge tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, amdgpu and vmwgfx making up the most of it, along with panthor and i915/xe. Seems about right for this time of development, nothing major outstanding. client: - Fix description of module parameter panthor: - Flush writes before mapping buffers vmwgfx: - Improve command validation - Improve ref counting - Fix cursor-plane support amdgpu: - Disallow P2P DMA for GC 12 DCC surfaces - ctx error handling fix - UserQ fixes - VRR fix - ISP fix - JPEG 5.0.1 fix amdkfd: - Save area check fix - Fix GPU mappings for APU after prefetch i915: - Fix PSR's pipe to vblank conversion - Disable Panel Replay on MST links xe: - New HW workarounds affecting PTL and WCL platforms * tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel: drm/client: fix MODULE_PARM_DESC string for "active" drm/i915/dp_mst: Disable Panel Replay drm/amdkfd: Fix GPU mappings for APU after prefetch drm/amdkfd: relax checks for over allocation of save area drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO drm/amd/display: Allow VRR params change if unsynced with the stream drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process drm/amdgpu: jump to the correct label on failure drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg drm/xe/xe3: Extend wa_14023061436 drm/xe/xe3: Add WA_14024681466 for Xe3_LPG drm/i915/psr: fix pipe to vblank conversion drm/panthor: Flush shmem writes before mapping buffers CPU-uncached drm/vmwgfx: Restore Guest-Backed only cursor plane support drm/vmwgfx: Use kref in vmw_bo_dirty drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE commit ccc0011804d406493da6d97f913c43de842f1abb Merge: 241e99dbdcdfa7 739f04f4a46237 Author: Linus Torvalds Date: Fri Nov 14 13:34:36 2025 -0800 Merge tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - dw_mmc-rockchip: Fix internal phase calculation - pxamci: Simplify and fix ->probe() error handling - sdhci-of-dwcmshc: Fix strbin signal delay - wmt-sdmmc: Fix compile test default * tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: dw_mmc-rockchip: Fix wrong internal phase calculate mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 mmc: wmt-sdmmc: fix compile test default commit 241e99dbdcdfa715989555fa1d83025a8ce95775 Merge: 6014e75e87562a bbde14682eba21 Author: Linus Torvalds Date: Fri Nov 14 13:29:15 2025 -0800 Merge tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Fix reference count leak in ->remove() - samsung: Rework legacy splash-screen handover workaround - samsung: Fix potential memleak during ->probe() - arm: Fix genpd leak on provider registration failure for scmi * tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: samsung: Rework legacy splash-screen handover workaround pmdomain: arm: scmi: Fix genpd leak on provider registration failure pmdomain: samsung: plug potential memleak during probe commit 6014e75e87562abd3c55a7b6d361bbe66beb0b07 Merge: de90cc610eb613 214291cbaaceeb Author: Linus Torvalds Date: Fri Nov 14 13:25:00 2025 -0800 Merge tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dave Jiang: - Fix incorrect device handle check for Generic Initiator - Fix offset calculation for extended linear cache poison injection - Fix lockdep warning for hmem_register_resource() * tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: acpi/hmat: Fix lockdep warning for hmem_register_resource() cxl: Adjust offset calculation for poison injection acpi,srat: Fix incorrect device handle check for Generic Initiator commit 124c98b10001a35928a379593c7aacb3cbef6659 Merge: 4e08ec0054a968 aaf46c6a6df605 Author: Arnd Bergmann Date: Fri Nov 14 22:21:45 2025 +0100 Merge tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE kernel-doc fixes for v6.18 * tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: commit 4e08ec0054a96875f74dd32631575e5778bede03 Merge: c3216f1d62e17c 5e44c5a2cc84be Author: Arnd Bergmann Date: Fri Nov 14 22:20:06 2025 +0100 Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 6.18, please pull the following: - Andrea assigns clocks rates for the Ethernet controller for the Raspberry Pi 5 systems - Laurent adds an ethernet0 alias to allow client programs consuming that alias to populate the correct Ethernet address for the Raspberry Pi 5 systems * tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias arm64: dts: broadcom: Assign clock rates in eth node for RPi5 Signed-off-by: Arnd Bergmann commit c3216f1d62e17c60d323aaa39e57ce9e5226def7 Merge: 7b52117eea0c58 997c06330fd5c2 Author: Arnd Bergmann Date: Fri Nov 14 22:18:11 2025 +0100 Merge tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v6.18 * Fix incorrect EARC reset masks in the reset-imx8mp-audiomix driver, introduced in commit a83bc87cd30a. * tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux: reset: imx8mp-audiomix: Fix bad mask values Signed-off-by: Arnd Bergmann commit 7b52117eea0c58e53d973429b25414985d70fb1b Merge: 020e792ca39b51 3d1c795bdef433 Author: Arnd Bergmann Date: Fri Nov 14 22:14:49 2025 +0100 Merge tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree files updates for 6.18, please pull the following: - Rafal fixes the Ethernet PHY address on the Luxul XAP-1440 * tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY Signed-off-by: Arnd Bergmann commit 020e792ca39b516ab1cbec757641491735d7d696 Merge: f4f012b0ee1d40 9c16e4d216d810 Author: Arnd Bergmann Date: Fri Nov 14 22:13:21 2025 +0100 Merge tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64 defconfig updates for 6.18, please pull the following: - Stefan ensures that the clk-raspberrypi driver which is now the clock provider is built into the kernel image to satisfy root over NFS * tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: defconfig: Fix V3D deferred probe timeout Signed-off-by: Arnd Bergmann commit f4f012b0ee1d401adfc85cbd5dacd6adf35004c4 Merge: ec0ca4be116ad7 6504297872c7a5 Author: Arnd Bergmann Date: Fri Nov 14 22:10:14 2025 +0100 Merge tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.18: - Enable ext4 support explicitly in imx_v6_v7_defconfig to fix a regression caused by commit d6ace46c82fd ("ext4: remove obsolete EXT3 config options") - Correct report-rate-hz setting for imx6ull-engicam-microgea-rmm board - Fix MSI mapping for i.MX95 PCIe endpoint device nodes - Fix USB OTG role switching for imx8mp-kontron board - Fix a dt-schema warning caused by audmux node for imx51-zii-rdu1 board - Avoid gpio0_mipi_csi GPIOs being deferred for i.MX8 img subsystem * tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mp-kontron: Fix USB OTG role switching arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred arm: imx_v6_v7_defconfig: enable ext4 directly ARM: dts: imx51-zii-rdu1: Fix audmux node names ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value Signed-off-by: Arnd Bergmann commit ec0ca4be116ad7efb08cd23acc1ff29b04d9cf52 Author: Krzysztof Kozlowski Date: Fri Oct 31 14:50:39 2025 +0100 MAINTAINERS: Update Krzysztof Kozlowski's email Update Krzysztof Kozlowski's email address in mailmap to stay reachable. Link: https://patch.msgid.link/20251021095426.86549-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251031135041.78789-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 64bdb49f2dc928d20b48b19380354d885bbc9de7 Merge: dc00a9fea282d3 6f37469a933030 Author: Arnd Bergmann Date: Fri Nov 14 22:05:41 2025 +0100 Merge tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v6.18 Correct incorrect ID used for the memory controller client IDs in Tegra210 Memory Controller driver, introduced in v6.18-rc1. * tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra210: Fix incorrect client ids Signed-off-by: Arnd Bergmann commit de90cc610eb61341662fc23919dd823573ef9a41 Merge: 809bd274521537 66e9feb03e7cf8 Author: Linus Torvalds Date: Fri Nov 14 13:04:35 2025 -0800 Merge tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few standard fixes here, plus one more interesting one from Hans which addresses an issue where a move in when we requested GPIOs on ACPI systems caused us to stop doing pinmuxing and leave things floating that we'd really rather not have floating" * tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Add TODO comment about ACPI GPIO setup spi: xilinx: increase number of retries before declaring stall spi: imx: keep dma request disabled before dma transfer setup spi: Try to get ACPI GPIO IRQ earlier commit dc00a9fea282d325edb58977062f043c94e23c7d Merge: 3e40c919816d56 85893094535cce Author: Arnd Bergmann Date: Fri Nov 14 22:03:52 2025 +0100 Merge tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes First batch of ASPEED fixes for 6.18 This time it's just the one fix addressing a PHY configuration regression in the Fuji (Meta) platform's mac3 devicetree node. * tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: fuji-data64: Enable mac3 controller Signed-off-by: Arnd Bergmann commit 3e40c919816d56ec877c90f61522d6bc2d34c398 Merge: e9a6fb0bcdd760 ce121914f38aaa Author: Arnd Bergmann Date: Fri Nov 14 22:01:00 2025 +0100 Merge tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes arm64: tegra: Fixes for v6.18 This contains a simple fix to mark the Ethernet PHY on Jetson Xavier NX as a wakeup source so the device can support WoL. * tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Mark Jetson Xavier NX's PHY as a wakeup source Signed-off-by: Arnd Bergmann commit 809bd274521537a550306f96b06c0585fd723bbf Merge: 27f518609e585d 636f4618b1cd96 Author: Linus Torvalds Date: Fri Nov 14 13:01:23 2025 -0800 Merge tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One simple fix for a GPIO descriptor leak in the probe error handling for the fixed regulator" * tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fixed: fix GPIO descriptor leak on register failure commit 27f518609e585d28a82119ce77f6c7085b61da50 Merge: d4f8cccc6230bd 21a9ab5b90b371 Author: Linus Torvalds Date: Fri Nov 14 12:50:08 2025 -0800 Merge tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are device-specific, and nothing stands out. - A regression fix for HD-audio HDMI probe - USB-audio hardening patches for issues spotted by fuzzers - ASoC fixes for TAS278x, SoundWire and Cirrus - Usual HD-audio and USB-audio quirks" * tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe() ALSA: hda/tas2781: Correct the wrong project ID ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list ALSA: usb-audio: Fix potential overflow of PCM transfer buffer ALSA: hda/tas2781: Add new quirk for HP new projects ASoC: tas2781: fix getting the wrong device number ASoC: codecs: va-macro: fix resource leak in probe error path ASoC: tas2783A: Fix issues in firmware parsing ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() ASoC: cs4271: Fix regulator leak on probe failure ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver ASoC: da7213: Use component driver suspend/resume ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis ASoC: doc: cs35l56: Update firmware filename description for B0 silicon commit d4f8cccc6230bd2f3aa28348a4c71f0dc3e89788 Merge: ac9f4f306d943c 8f05967b022d25 Author: Linus Torvalds Date: Fri Nov 14 10:18:45 2025 -0800 Merge tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixlet from Jens Axboe: "Been sitting on this one for a week or two, planning on sending it out when there were other block changes for 6.18. But as that hasn't materialized in the second week of sitting on it, let's flush it out. A previous commit updated my git tree locations, but one was missed as it was already set to the git.kernel.org one. But the git location swap also renamed the actual tree from linux-block to just linux, let's get that last one updated too" * tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: correct git location for block layer tree commit ac9f4f306d943c1c551280977ae5321167835088 Merge: b86caedd0b2c6e 2d0e88f3fd1dcb Author: Linus Torvalds Date: Fri Nov 14 09:57:30 2025 -0800 Merge tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Use the actual segments in a request when for bvec based buffers - Fix an odd case where the iovec might get leaked for a read/write request, if it was newly allocated, overflowed the alloc cache, and hit an early error - Minor tweak to the query API added in this release, returning the number of available entries * tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs io_uring/query: return number of available queries io_uring/rw: ensure allocated iovec gets cleared for early failure commit 6c762611fed7365790000925f3d14f20037d0061 Author: Eduard Zingerman Date: Thu Nov 13 18:57:30 2025 -0800 selftests/bpf: Test widen_imprecise_scalars() with different stack depth A test case for a situation when widen_imprecise_scalars() is called with old->allocated_stack > cur->allocated_stack. Test structure: def widening_stack_size_bug(): r1 = 0 for r6 in 0..1: iterator_with_diff_stack_depth(r1) r1 = 42 def iterator_with_diff_stack_depth(r1): if r1 != 42: use 128 bytes of stack iterator based loop iterator_with_diff_stack_depth() is verified with r1 == 0 first and r1 == 42 next. Causing stack usage of 128 bytes on a first visit and 8 bytes on a second. Such arrangement triggered a KASAN error in widen_imprecise_scalars(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114025730.772723-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b0c8e6d3d866b6a7f73877f71968dbffd27b7785 Author: Eduard Zingerman Date: Thu Nov 13 18:57:29 2025 -0800 bpf: account for current allocated stack depth in widen_imprecise_scalars() The usage pattern for widen_imprecise_scalars() looks as follows: prev_st = find_prev_entry(env, ...); queued_st = push_stack(...); widen_imprecise_scalars(env, prev_st, queued_st); Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case: def main(): for i in 1..2: foo(i) // same callsite, differnt param def foo(i): if i == 1: use 128 bytes of stack iterator based loop Here, for a second 'foo' call prev_st->allocated_stack is 128, while queued_st->allocated_stack is much smaller. widen_imprecise_scalars() needs to take this into account and avoid accessing bpf_verifier_state->frame[*]->stack out of bounds. Fixes: 2793a8b015f7 ("bpf: exact states comparison for iterator convergence checks") Reported-by: Emil Tsalapatis Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114025730.772723-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 660b299bed2a2a55a1f9102d029549d0235f881c Author: Diogo Ivo Date: Mon Nov 3 14:14:15 2025 +0000 Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" Commit b6bcbce33596 ("soc/tegra: pmc: Ensure power-domains are in a known state") was introduced so that all power domains get initialized to a known working state when booting and it does this by shutting them down (including asserting resets and disabling clocks) before registering each power domain with the genpd framework, leaving it to each driver to later on power its needed domains. This caused the Google Pixel C to hang when booting due to a workaround in the DSI driver introduced in commit b22fd0b9639e ("drm/tegra: dsi: Clear enable register if powered by bootloader") meant to handle the case where the bootloader enabled the DSI hardware module. The workaround relies on reading a hardware register to determine the current status and after b6bcbce33596 that now happens in a powered down state thus leading to the boot hang. Fix this by reverting b22fd0b9639e since currently we are guaranteed that the hardware will be fully reset by the time we start enabling the DSI module. Fixes: b6bcbce33596 ("soc/tegra: pmc: Ensure power-domains are in a known state") Cc: stable@vger.kernel.org Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20251103-diogo-smaug_ec_typec-v1-1-be656ccda391@tecnico.ulisboa.pt commit 6cbab9f0da72b4dc3c3f9161197aa3b9daa1fa3a Author: Prateek Agarwal Date: Fri Sep 19 13:25:40 2025 +0900 drm/tegra: Add call to put_pid() Add a call to put_pid() corresponding to get_task_pid(). host1x_memory_context_alloc() does not take ownership of the PID so we need to free it here to avoid leaking. Signed-off-by: Prateek Agarwal Fixes: e09db97889ec ("drm/tegra: Support context isolation") [mperttunen@nvidia.com: reword commit message] Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250919-host1x-put-pid-v1-1-19c2163dfa87@nvidia.com commit 4c5376b4b143c4834ebd392aef2215847752b16a Author: Ma Ke Date: Wed Oct 22 19:47:20 2025 +0800 drm/tegra: dc: Fix reference leak in tegra_dc_couple() driver_find_device() calls get_device() to increment the reference count once a matching device is found, but there is no put_device() to balance the reference count. To avoid reference count leakage, add put_device() to decrease the reference count. Found by code review. Cc: stable@vger.kernel.org Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers") Signed-off-by: Ma Ke Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn commit 4ef92743625818932b9c320152b58274c05e5053 Author: Eric Dumazet Date: Wed Nov 12 12:55:16 2025 +0000 bpf: Add bpf_prog_run_data_pointers() syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop(). WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214 struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf"). drop_reason was added later. Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end. Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") Reported-by: syzbot Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/ Signed-off-by: Eric Dumazet Signed-off-by: Martin KaFai Lau Reviewed-by: Victor Nogueira Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com commit ec33b59542d96830e3c89845ff833cf7b25ef172 Author: Vlastimil Babka Date: Thu Nov 13 19:54:35 2025 +0100 mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283) Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed. We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com Analyzed-by: Christoph Hellwig Fixes: bdfedb76f4f5 ("mm, mempool: poison elements backed by slab allocator") Cc: stable@vger.kernel.org Tested-by: kernel test robot Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz Signed-off-by: Vlastimil Babka commit b86caedd0b2c6e86c3fbaf5a04e5f9161b5688fd Merge: 95baf63fe81e5f 59b0afd01b2ce3 Author: Linus Torvalds Date: Fri Nov 14 08:32:58 2025 -0800 Merge tag 'v6.18-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix device reference leak in hisilicon * tag 'v6.18-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value commit 95baf63fe81e5fc91d194019f5aec8ecd9c50bb6 Merge: 6da43bbeb69181 d93a89684dce94 Author: Linus Torvalds Date: Fri Nov 14 08:30:48 2025 -0800 Merge tag 'v6.18-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Multichannel reconnect channel selection fix - Fix for smbdirect (RDMA) disconnect bug - Fix for incorrect username length check - Fix memory leak in mount parm processing * tag 'v6.18-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: let smbd_disconnect_rdma_connection() turn CREATED into DISCONNECTED smb: fix invalid username check in smb3_fs_context_parse_param() cifs: client: fix memory leak in smb3_fs_context_parse_param smb: client: fix cifs_pick_channel when channel needs reconnect commit e0fd4d42e27f761e9cc82801b3f183e658dc749d Author: Eslam Khafagy Date: Fri Nov 14 14:27:39 2025 +0200 posix-timers: Plug potential memory leak in do_timer_create() When posix timer creation is set to allocate a given timer ID and the access to the user space value faults, the function terminates without freeing the already allocated posix timer structure. Move the allocation after the user space access to cure that. [ tglx: Massaged change log ] Fixes: ec2d0c04624b3 ("posix-timers: Provide a mechanism to allocate a given timer ID") Reported-by: syzbot+9c47ad18f978d4394986@syzkaller.appspotmail.com Suggested-by: Cyrill Gorcunov Signed-off-by: Eslam Khafagy Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251114122739.994326-1-eslam.medhat1993@gmail.com Closes: https://lore.kernel.org/all/69155df4.a70a0220.3124cb.0017.GAE@google.com/T/ commit 14473a1f88596fd729e892782efc267c0097dd1d Author: Nick Hu Date: Fri Nov 14 15:28:44 2025 +0800 irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops The irq_domain_free_irqs() helper requires that the irq_domain_ops->free callback is implemented. Otherwise, the kernel reports the warning message "NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to release the per-HART local interrupts. Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that. Fixes: 832f15f42646 ("RISC-V: Treat IPIs as normal Linux IRQs") Signed-off-by: Nick Hu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251114-rv-intc-fix-v1-1-a3edd1c1a868@sifive.com commit 31475b88110c4725b4f9a79c3a0d9bbf97e69e1c Author: Heiko Carstens Date: Thu Nov 13 13:21:47 2025 +0100 s390/mm: Fix __ptep_rdp() inline assembly When a zero ASCE is passed to the __ptep_rdp() inline assembly, the generated instruction should have the R3 field of the instruction set to zero. However the inline assembly is written incorrectly: for such cases a zero is loaded into a register allocated by the compiler and this register is then used by the instruction. This means that selected TLB entries may not be flushed since the specified ASCE does not match the one which was used when the selected TLB entries were created. Fix this by removing the asce and opt parameters of __ptep_rdp(), since all callers always pass zero, and use a hard-coded register zero for the R3 field. Fixes: 0807b856521f ("s390/mm: add support for RDP (Reset DAT-Protection)") Cc: stable@vger.kernel.org Reviewed-by: Gerald Schaefer Signed-off-by: Heiko Carstens commit 37339122a7801660dce11abd817af82cc4bef163 Author: Ville Syrjälä Date: Fri Nov 14 23:18:50 2025 +0900 firewire: core: Initialize topology_map.lock Lockdep barfs on the new uninitialized spinlock. Initialize it. protip: enable lockdep (CONFIG_PROVE_LOCKING=y) when doing locking changes firewire_ohci 0000:02:01.1: added OHCI v1.10 device as card 0, 4 IR + 4 IT contexts, quirks 0x11 INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 UID: 0 PID: 1042 Comm: irq/17-firewire Not tainted 6.17.0-rc2-cl-bisect2-00026-g7d138cb269db #136 PREEMPT Hardware name: Dell Inc. Latitude E5400 /0D695C, BIOS A19 06/13/2013 Call Trace: dump_stack_lvl+0x6d/0xa0 register_lock_class+0x783/0x790 ? find_held_lock+0x2b/0x80 ? __mod_timer+0x110/0x320 ? __mod_timer+0x110/0x320 __lock_acquire+0x405/0x2600 lock_acquire+0xca/0x2e0 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core] ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core] _raw_spin_lock+0x2e/0x40 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] handle_selfid_complete_event+0x35c/0x7a0 [firewire_ohci] ? irq_thread+0x8d/0x280 irq_thread_fn+0x18/0x50 irq_thread+0x15a/0x280 ? irq_check_status_bit+0x100/0x100 ? lockdep_hardirqs_on+0x78/0x100 ? irq_finalize_oneshot.part.0+0xc0/0xc0 ? irq_forced_thread_fn+0x60/0x60 kthread+0x114/0x200 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x158/0x1e0 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 Reported-by: Erhard Furtner Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map") Signed-off-by: Ville Syrjälä Signed-off-by: Takashi Sakamoto commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 Author: Lushih Hsieh Date: Fri Nov 14 13:20:53 2025 +0800 ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series The PureAudio APA DAC and Lotus DAC5 series are USB Audio 2.0 Class devices that support native Direct Stream Digital (DSD) playback via specific vendor protocols. Without these quirks, the devices may only function in standard PCM mode, or fail to correctly report their DSD format capabilities to the ALSA framework, preventing native DSD playback under Linux. This commit adds new quirk entries for the mentioned DAC models based on their respective Vendor/Product IDs (VID:PID), for example: 0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. The quirk ensures correct DSD format handling by setting the required SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA DSD API to correctly address the device for high-bitrate DSD streams, bypassing the need for DoP (DSD over PCM). Test on APA DAC and Lotus DAC5 SE under Arch Linux. Tested-by: Lushih Hsieh Signed-off-by: Lushih Hsieh Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw Signed-off-by: Takashi Iwai commit dd14022a7ce96963aa923e35cf4bcc8c32f95840 Author: Borislav Petkov (AMD) Date: Fri Nov 14 14:01:14 2025 +0100 x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev Add the minimum Entrysign revision for that model+stepping to the list of minimum revisions. Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Reported-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/e94dd76b-4911-482f-8500-5c848a3df026@citrix.com commit e1a97a627cd01d73fac5dd054d8f3de601ef2781 Author: Mario Limonciello Date: Thu Nov 13 16:35:50 2025 -0600 x86/CPU/AMD: Add additional fixed RDSEED microcode revisions Microcode that resolves the RDSEED failure (SB-7055 [1]) has been released for additional Zen5 models to linux-firmware [2]. Update the zen5_rdseed_microcode array to cover these new models. Fixes: 607b9fb2ce24 ("x86/CPU/AMD: Add RDSEED fix for Zen5") Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html [1] Link: https://gitlab.com/kernel-firmware/linux-firmware/-/commit/6167e5566900cf236f7a69704e8f4c441bc7212a [2] Link: https://patch.msgid.link/20251113223608.1495655-1-mario.limonciello@amd.com commit f84fd5bec502447df145f31734793714690ce27f Author: Luke Wang Date: Fri Nov 14 14:53:08 2025 +0800 pwm: adp5585: Correct mismatched pwm chip info The register addresses of ADP5585 and ADP5589 are swapped. Fixes: 75024f97e82e ("pwm: adp5585: add support for adp5589") Signed-off-by: Luke Wang Acked-by: Nuno Sá Tested-by: Liu Ying # ADP5585 PWM Link: https://patch.msgid.link/20251114065308.2074893-1-ziniu.wang_1@nxp.com Signed-off-by: Uwe Kleine-König commit a55ef3bff84f11ee8c84a1ae29b071ffd4ccbbd9 Author: Zilin Guan Date: Mon Nov 10 06:41:25 2025 +0000 xfrm: fix memory leak in xfrm_add_acquire() The xfrm_add_acquire() function constructs an xfrm policy by calling xfrm_policy_construct(). This allocates the policy structure and potentially associates a security context and a device policy with it. However, at the end of the function, the policy object is freed using only kfree() . This skips the necessary cleanup for the security context and device policy, leading to a memory leak. To fix this, invoke the proper cleanup functions xfrm_dev_policy_delete(), xfrm_dev_policy_free(), and security_xfrm_policy_free() before freeing the policy object. This approach mirrors the error handling path in xfrm_add_policy(), ensuring that all associated resources are correctly released. Fixes: 980ebd25794f ("[IPSEC]: Sync series - acquire insert") Signed-off-by: Zilin Guan Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit fa3c727e05996811a2a57c5114e88200c05b6161 Merge: f6fdd77b3e0d51 360b3730f8eab6 Author: Takashi Iwai Date: Fri Nov 14 09:47:28 2025 +0100 Merge tag 'asoc-fix-v6.18-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A small collection of fixes, all driver specific and none especially remarkable unless you have the hardware (many not even then). commit 362a7d4fd5c473d43c498e68e13ff7acf8ca4ccf Merge: 538e0110fedc6d 240372edaf854c Author: Dave Airlie Date: Fri Nov 14 17:51:09 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - New HW workarounds affecting PTL and WCL platforms (Nitin Gote, Tangudu Tilak Tirumalesh) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/ay2qztgonodwson6tuzcv5napjmqbgwzv27so4ybfola34guux@xgufrrmbzyws commit 538e0110fedc6d7321fbd79594395469bf2749e3 Merge: 15ebea1bdff2f9 f2687d3cc9f905 Author: Dave Airlie Date: Fri Nov 14 17:50:36 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix PSR's pipe to vblank conversion (Jani) - Disable Panel Replay on MST links (Imre) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aRXdQnitzyFcokhF@intel.com commit ac5ae0a5ce22640f73677d40730a37f43df442d1 Author: Ally Heev Date: Tue Nov 11 13:26:42 2025 +0530 tee: qcomtee: fix uninitialized pointers with free attribute Uninitialized pointers with `__free` attribute can cause undefined behavior as the memory assigned randomly to the pointer is freed automatically when the pointer goes out of scope. qcomtee doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attribute in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 15ebea1bdff2f9740fc6f0af1c08454916bd5d2f Merge: 63444b4ca4bbe0 0a4a18e888ae8c Author: Dave Airlie Date: Fri Nov 14 17:24:51 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: client: - Fix description of module parameter panthor: - Flush writes before mapping buffers vmwgfx: - Improve command validation - Improve ref counting - Fix cursor-plane support Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251113132317.GA451885@linux.fritz.box commit 63444b4ca4bbe0df7e870ca8893496b80c9bb73b Merge: e9a6fb0bcdd760 eac32ff42393ef Author: Dave Airlie Date: Fri Nov 14 17:09:50 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-12: amdgpu: - Disallow P2P DMA for GC 12 DCC surfaces - ctx error handling fix - UserQ fixes - VRR fix - ISP fix - JPEG 5.0.1 fix amdkfd: - Save area check fix - Fix GPU mappings for APU after prefetch Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251112200930.8788-1-alexander.deucher@amd.com commit 407a06507c2358554958e8164dc97176feddcafc Author: Zilin Guan Date: Wed Nov 12 05:21:14 2025 +0000 mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() The function mlxsw_sp_flower_stats() calls mlxsw_sp_acl_ruleset_get() to obtain a ruleset reference. If the subsequent call to mlxsw_sp_acl_rule_lookup() fails to find a rule, the function returns an error without releasing the ruleset reference, causing a memory leak. Fix this by using a goto to the existing error handling label, which calls mlxsw_sp_acl_ruleset_put() to properly release the reference. Fixes: 7c1b8eb175b69 ("mlxsw: spectrum: Add support for TC flower offload statistics") Signed-off-by: Zilin Guan Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251112052114.1591695-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit f796a8dec9beafcc0f6f0d3478ed685a15c5e062 Author: Jiaming Zhang Date: Wed Nov 12 01:36:52 2025 +0800 net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() -> generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Closes: https://lore.kernel.org/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev Signed-off-by: Jiaming Zhang Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20251111173652.749159-2-r772577952@gmail.com Signed-off-by: Jakub Kicinski commit 6da43bbeb6918164f7287269881a5f861ae09d7e Merge: 01814e11e5e987 d323ad73966676 Author: Linus Torvalds Date: Thu Nov 13 17:00:40 2025 -0800 Merge tag 'vfio-v6.18-rc6' of https://github.com/awilliam/linux-vfio Pull VFIO seftest fixes from Alex Williamson: - Fix vfio selftests to remove the expectation that the IOMMU supports a 64-bit IOVA space. These manifest both in the original set of tests introduced this development cycle in identity mapping the IOVA to buffer virtual address space, as well as the more recent boundary testing. Implement facilities for collecting the valid IOVA ranges from the backend, implement a simple IOVA allocator, and use the information for determining extents (Alex Mastro) * tag 'vfio-v6.18-rc6' of https://github.com/awilliam/linux-vfio: vfio: selftests: replace iova=vaddr with allocated iovas vfio: selftests: add iova allocator vfio: selftests: fix map limit tests to use last available iova vfio: selftests: add iova range query helpers commit 01814e11e5e9878f26cfeb4ad4be791525757e30 Merge: aecba2e013ab79 c55a8e24cd129b Author: Linus Torvalds Date: Thu Nov 13 16:54:36 2025 -0800 Merge tag 'hwmon-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - gpd-fan: Fix compilation error for non-ACPI builds, and initialize EC when loading the driver * tag 'hwmon-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (gpd-fan) initialize EC on driver load for Win 4 hwmon: (gpd-fan) Fix compilation error in non-ACPI builds commit aecba2e013ab79dde441dfc81a32792ced229539 Merge: 6a3cc1b749c080 161284b26fb170 Author: Linus Torvalds Date: Thu Nov 13 16:31:07 2025 -0800 Merge tag 'pm-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix issues related to the handling of compressed hibernation images and a recent intel_pstate driver regression: - Fix issues related to using inadequate data types and incorrect use of atomic variables in the compressed hibernation images handling code that were introduced during the 6.9 development cycle (Mario Limonciello) - Move a X86_FEATURE_IDA check from turbo_is_disabled() to the places where a new value for MSR_IA32_PERF_CTL is computed in intel_pstate to address a regression preventing users from enabling turbo frequencies post-boot (Srinivas Pandruvada)" * tag 'pm-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes PM: hibernate: Fix style issues in save_compressed_image() PM: hibernate: Use atomic64_t for compressed_size variable PM: hibernate: Emit an error when image writing fails commit 7410c86fc05b1423466c1a579bcc994f87822566 Author: Baruch Siach Date: Wed Nov 12 13:17:03 2025 +0200 MAINTAINERS: Remove eth bridge website Ethernet bridge website URL shows "This page isn’t available". Signed-off-by: Baruch Siach Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/0a32aaf7fa4473e7574f7327480e8fbc4fef2741.1762946223.git.baruch@tkos.co.il Signed-off-by: Jakub Kicinski commit 6a3cc1b749c0808011424c80a0ba5497fdcd5f9c Merge: 9b9e43704d2b05 7564f3543cf19b Author: Linus Torvalds Date: Thu Nov 13 16:22:36 2025 -0800 Merge tag 'acpi-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix issues in the ACPI CPPC library and in the recently added parser for the ACPI MRRM table: - Limit some checks in the ACPI CPPC library to online CPUs to avoid accessing uninitialized per-CPU variables when some CPUs are offline to start with, like during boot with 'nosmt=force' (Gautham Shenoy) - Rework add_boot_memory_ranges() in the ACPI MRRM table parser to fix memory leaks and improve error handling (Kaushlendra Kumar)" * tag 'acpi-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: MRRM: Fix memory leaks and improve error handling ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs ACPI: CPPC: Perform fast check switch only for online CPUs ACPI: CPPC: Check _CPC validity for only the online CPUs ACPI: CPPC: Detect preferred core availability on online CPUs commit b5414520793e68d266fdd97a84989d9831156aad Author: Mykola Kvach Date: Mon Nov 3 12:27:40 2025 +0200 arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 The vcc3v3_pcie20 fixed regulator powers the PCIe device-side 3.3V rail for pcie2x1l2 via vpcie3v3-supply. The DTS mistakenly set its regulator-min/max-microvolt to 1800000 (1.8 V). Correct both to 3300000 (3.3 V) to match the rail name, the PCIe/M.2 power requirement, and the actual hardware wiring on Orange Pi 5. Fixes: b6bc755d806e ("arm64: dts: rockchip: Add Orange Pi 5") Cc: stable@vger.kernel.org Signed-off-by: Mykola Kvach Reviewed-by: Michael Riesch Link: https://patch.msgid.link/cf6e08dfdfbf1c540685d12388baab1326f95d2c.1762165324.git.xakep.amatop@gmail.com Signed-off-by: Heiko Stuebner commit baa18d577cd445145039e731d3de0fa49ca57204 Author: Quentin Schulz Date: Wed Nov 12 16:01:53 2025 +0100 arm64: dts: rockchip: disable HS400 on RK3588 Tiger We've had reports from the field that some RK3588 Tiger have random issues with eMMC errors. Applying commit a28352cf2d2f ("mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4") didn't help and seemed to have made things worse for our board. Our HW department checked the eMMC lines and reported that they are too long and don't look great so signal integrity is probably not the best. Note that not all Tigers with the same eMMC chip have errors, so the suspicion is that we're really on the edge in terms of signal integrity and only a handful devices are failing. Additionally, we have RK3588 Jaguars with the same eMMC chip but the layout is different and we also haven't received reports about those so far. Lowering the max-frequency to 150MHz from 200MHz instead of simply disabling HS400 was briefly tested and seem to work as well. We've disabled HS400 downstream and haven't received reports since so we'll go with that instead of lowering the max-frequency. Signed-off-by: Quentin Schulz Fixes: 6173ef24b35b ("arm64: dts: rockchip: add RK3588-Q7 (Tiger) SoM") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251112-tiger-hs200-v1-1-b50adac107c0@cherry.de [added Fixes tag and stable-cc from 2nd mail] Signed-off-by: Heiko Stuebner commit 264152a97edf9f1b7ed5372e4033e46108e41422 Author: Chukun Pan Date: Sat Nov 1 22:01:01 2025 +0800 arm64: dts: rockchip: drop reset from rk3576 i2c9 node The reset property is not part of the binding, so drop it. It is also not used by the driver, so it was likely copied from some vendor-kernel node. Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101140101.302229-1-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit d6b9ce75e87c5f4bfbc0f7bba4f4f7cbf942f98a Merge: 8d422b8beb76bf d0fcf70c680e4d Author: Greg Kroah-Hartman Date: Thu Nov 13 17:36:35 2025 -0500 Merge tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc: fix saving contoller data for v6.18 - Fix the incorrect use of platform_set_drvdata and dev_set_drvdata * tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: (237 commits) firmware: stratix10-svc: fix bug in saving controller data Linux 6.18-rc4 objtool: Fix skip_alt_group() for non-alternative STAC/CLAC kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols PCI: Do not size non-existing prefetchable window Revert "PCI: qcom: Remove custom ASPM enablement code" bpf/arm64: Fix BPF_ST into arena memory bpf: Make migrate_disable always inline to avoid partial inlining null_blk: set dma alignment to logical block size xfs: document another racy GC case in xfs_zoned_map_extent xfs: prevent gc from picking the same zone twice drm/ast: Clear preserved bits from register output value s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP drm/imx: parallel-display: add the bridge before attaching it drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API blk-crypto: use BLK_STS_INVAL for alignment errors regulator: bd718x7: Fix voltages scaled by resistor divider x86/cpu: Add/fix core comments for {Panther,Nova} Lake ... commit 8d422b8beb76bfc57f0fe4b03082f3823eccd150 Merge: baadf2a5c26e80 3aa385a9c75c09 Author: Greg Kroah-Hartman Date: Thu Nov 13 17:34:22 2025 -0500 Merge tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: Fixes for 6.18 (set 1) The usual mixed back of brand new and ancient bugs. dmaengine buffer / core - Add new callback to allow fetching the providing device for a DMA channel. Use this to get the right device for the dmaengine buffer implementation. adi,ad4030 - Fix incorrect _scale value for common-mode channels. adi,ad7124 - Fix gain and offset for temperature channel. adi,ad7280a - Fix a factor of 10 error when setting the balance timer. adi,ad7380 - Fix sampling frequency to account for need to trigger twice per scan for some supported chips. adi,adxl355 - Ensure a long enough wait after SW reset. bosch,bmc150 - Fix wrong assumption that interrupts are always available. bosch,bmp280 - Fix the measurement time calculation. richtek,rtq6056 - Fix wrong sign bit when sign extending. samsung,ssp - Fix cleanup of registered mfd devices on error. st,lsm6dsx - Fix wrong sized array for register information. - Fix a wrong time stamp calculation for some devices. st,stm32-dfsdm - Update handling of st,adc-alt-channel to reflect binding change as part of moving to iio-backend framework. ti,hdc3020 - Fix wrong units for temperature and humidity. Also the thresholds and hysteresis. * tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: accel: bmc150: Fix irq assumption regression iio: st_lsm6dsx: Fixed calibrated timestamp calculation iio: humditiy: hdc3020: fix units for thresholds and hysteresis iio: humditiy: hdc3020: fix units for temperature and humidity measurement iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields iio: accel: fix ADXL355 startup race condition iio: adc: ad7124: fix temperature channel iio:common:ssp_sensors: Fix an error handling path ssp_probe() iio: adc: ad7280a: fix ad7280_store_balance_timer() iio: buffer-dmaengine: enable .get_dma_dev() iio: buffer-dma: support getting the DMA channel iio: buffer: support getting dma channel from the buffer iio: pressure: bmp280: correct meas_time_us calculation iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling iio: adc: ad7380: fix SPI offload trigger rate iio: adc: rtq6056: Correct the sign bit index iio: adc: ad4030: Fix _scale value for common-mode channels commit 91a78ce994e710f2e983071ccf6d0e60fc9c1ac5 Merge: e427054ae7bc8b cb730e4ac1b4dc Author: Martin KaFai Lau Date: Thu Nov 13 09:15:42 2025 -0800 Merge branch 'mptcp-fix-conflicts-between-mptcp-and-sockmap' Jiayuan Chen says: ==================== mptcp: Fix conflicts between MPTCP and sockmap Overall, we encountered a warning [1] that can be triggered by running the selftest I provided. sockmap works by replacing sk_data_ready, recvmsg, sendmsg operations and implementing fast socket-level forwarding logic: 1. Users can obtain file descriptors through userspace socket()/accept() interfaces, then call BPF syscall to perform these replacements. 2. Users can also use the bpf_sock_hash_update helper (in sockops programs) to replace handlers when TCP connections enter ESTABLISHED state (BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB/BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) However, when combined with MPTCP, an issue arises: MPTCP creates subflow sk's and performs TCP handshakes, so the BPF program obtains subflow sk's and may incorrectly replace their sk_prot. We need to reject such operations. In patch 1, we set psock_update_sk_prot to NULL in the subflow's custom sk_prot. Additionally, if the server's listening socket has MPTCP enabled and the client's TCP also uses MPTCP, we should allow the combination of subflow and sockmap. This is because the latest Golang programs have enabled MPTCP for listening sockets by default [2]. For programs already using sockmap, upgrading Golang should not cause sockmap functionality to fail. Patch 2 prevents the WARNING from occurring. Despite these patches fixing stream corruption, users of sockmap must set GODEBUG=multipathtcp=0 to disable MPTCP until sockmap fully supports it. [1] truncated warning: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 388 at net/mptcp/protocol.c:68 mptcp_stream_accept+0x34c/0x380 Modules linked in: RIP: 0010:mptcp_stream_accept+0x34c/0x380 RSP: 0018:ffffc90000cf3cf8 EFLAGS: 00010202 PKRU: 55555554 Call Trace: do_accept+0xeb/0x190 ? __x64_sys_pselect6+0x61/0x80 ? _raw_spin_unlock+0x12/0x30 ? alloc_fd+0x11e/0x190 __sys_accept4+0x8c/0x100 __x64_sys_accept+0x1f/0x30 x64_sys_call+0x202f/0x20f0 do_syscall_64+0x72/0x9a0 ? switch_fpu_return+0x60/0xf0 ? irqentry_exit_to_user_mode+0xdb/0x1e0 ? irqentry_exit+0x3f/0x50 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- [2]: https://go-review.googlesource.com/c/go/+/607715 ==================== Link: https://patch.msgid.link/20251111060307.194196-1-jiayuan.chen@linux.dev Signed-off-by: Martin KaFai Lau commit cb730e4ac1b4dca09d364fd83464ebd29547a4ef Author: Jiayuan Chen Date: Tue Nov 11 14:02:52 2025 +0800 selftests/bpf: Add mptcp test with sockmap Add test cases to verify that when MPTCP falls back to plain TCP sockets, they can properly work with sockmap. Additionally, add test cases to ensure that sockmap correctly rejects MPTCP sockets as expected. Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Acked-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251111060307.194196-4-jiayuan.chen@linux.dev commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f Author: Jiayuan Chen Date: Tue Nov 11 14:02:51 2025 +0800 mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() syn_recv_sock()/subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. ''' subflow_syn_recv_sock() subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() ''' Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops. This fix uses the more generic sk_family for the comparison instead. Additionally, this also prevents a WARNING from occurring: result from ./scripts/decode_stacktrace.sh: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ (net/mptcp/protocol.c:4005) Modules linked in: ... PKRU: 55555554 Call Trace: do_accept (net/socket.c:1989) __sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067) x64_sys_call (arch/x86/entry/syscall_64.c:41) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f87ac92b83d ---[ end trace 0000000000000000 ]--- Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash") Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Sitnicki Reviewed-by: Matthieu Baerts (NGI0) Cc: Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev commit b72b8132d8fd2d6bf5b420a03d4fc553980c3a92 Author: Ian Rogers Date: Tue Nov 11 23:43:11 2025 -0800 perf libbfd: Ensure libbfd is initialized prior to use Multiple threads may be creating and destroying BFD objects in situations like `perf top`. Without appropriate initialization crashes may occur during libbfd's cache management. BFD's locks require recursive mutexes, add support for these. Committer testing: This happens only when building with 'make BUILD_NONDISTRO=1' and having the binutils-devel package (or equivalent) installed, i.e. linking with binutils devel files, an opt-in perf build. Before: root@x1:~# perf top perf: Segmentation fault -------- backtrace -------- root@x1:~# After this patch it works as before. Closes: https://lore.kernel.org/lkml/aQt66zhfxSA80xwt@gentoo.org/ Fixes: 95931d9a594dd0b5 ("perf libbfd: Move libbfd functionality to its own file") Reported-by: Guilherme Amadio Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 3c723f449723db2dc2b75b7efe03c2a76e4c09f0 Author: Ravi Bangoria Date: Thu Nov 13 16:01:24 2025 +0000 perf test: Fix lock contention test Couple of independent fixes: 1. Wire in SIGSEGV handler that terminates the test with a failure code. 2. Use "--lock-cgroup" instead of "-g"; "-g" was proposed but never merged. See commit 4d1792d0a2564caf ("perf lock contention: Add --lock-cgroup option") 3. Call cleanup() on every normal exit so trap_cleanup() doesn't mistake it for an unexpected signal and emit a false-negative "Unexpected signal in main" message. Before patch: # ./perf test -vv "lock contention" 85: kernel lock contention analysis test: --- start --- test child forked, pid 610711 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --lock-cgroup Unexpected signal in test_aggr_cgroup ---- end(0) ---- 85: kernel lock contention analysis test : Ok After patch: # ./perf test -vv "lock contention" 85: kernel lock contention analysis test: --- start --- test child forked, pid 602637 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --lock-cgroup Testing perf lock contention --type-filter (w/ spinlock) Testing perf lock contention --lock-filter (w/ tasklist_lock) Testing perf lock contention --callstack-filter (w/ unix_stream) [Skip] Could not find 'unix_stream' Testing perf lock contention --callstack-filter with task aggregation [Skip] Could not find 'unix_stream' Testing perf lock contention --cgroup-filter Testing perf lock contention CSV output ---- end(0) ---- 85: kernel lock contention analysis test : Ok Reviewed-by: Ian Rogers Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Cc: Tycho Andersen Signed-off-by: Arnaldo Carvalho de Melo commit d0206db94b36c998c11458cfdae2f45ba20bc4fb Author: Ravi Bangoria Date: Thu Nov 13 16:01:23 2025 +0000 perf lock: Fix segfault due to missing kernel map Kernel maps are encoded in PERF_RECORD_MMAP2 samples but "perf lock report" and "perf lock contention" do not process MMAP2 samples. Because of that, machine->vmlinux_map stays NULL and any later access triggers a segmentation fault. Fix it by adding ->mmap2() callbacks. Fixes: 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default") Reported-by: Tycho Andersen (AMD) Reviewed-by: Ian Rogers Signed-off-by: Ravi Bangoria Tested-by: Tycho Andersen (AMD) Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Signed-off-by: Arnaldo Carvalho de Melo commit 84003ab3d0ca3717e4b36071c3c5f8b3c70e317c Author: Arnaldo Carvalho de Melo Date: Thu Nov 13 15:03:07 2025 -0300 tools headers UAPI: Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason To pick the changes in: 9d7dfb95da2cb5c1 ("KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL") The 'perf kvm-stat' tool uses the exit reasons that are included in the VMX_EXIT_REASONS define, this new SEAMCALL isn't included there (TDCALL is), so shouldn't be causing any change in behaviour, this patch ends up being just addressess the following perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit a09e5967ad6819379fd31894634d7aed29c18409 Author: Arnaldo Carvalho de Melo Date: Wed Nov 12 21:57:08 2025 -0300 perf build: Don't fail fast path feature detection when binutils-devel is not available This is one more remnant of the BUILD_NONDISTRO series to make building with binutils-devel opt-in due to license incompatibility. In this case just the references at link time were still in place, which make building the test-all.bin file fail, which wasn't detected before probably because the last test was done with binutils-devel available, doh. Now: $ rpm -q binutils-devel package binutils-devel is not installed $ file /tmp/build/perf-tools/feature/test-all.bin /tmp/build/perf-tools/feature/test-all.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4b5388a346b51f1b993f0b0dbd49f4570769b03c, for GNU/Linux 3.2.0, not stripped $ Fixes: 970ae86307718c34 ("perf build: The bfd features are opt-in, stop testing for them by default") Reviewed-by: Ian Rogers Cc: Adrian Hunter Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 85c894a80ac46aa177df04e0a33bcad409b7d64f Author: Thomas Falcon Date: Fri Nov 7 11:31:50 2025 -0600 perf header: Write bpf_prog (infos|btfs)_cnt to data file With commit f0d0f978f3f5830a ("perf header: Don't write empty BPF/BTF info"), the write_bpf_( prog_info() | btf() ) functions exit without writing anything if env->bpf_prog.(infos| btfs)_cnt is zero. process_bpf_( prog_info() | btf() ), however, still expect a "count" value to exist in the data file. If btf information is empty, for example, process_bpf_btf will read garbage or some other data as the number of btf nodes in the data file. As a result, the data file will not be processed correctly. Instead, write the count to the data file and exit if it is zero. Fixes: f0d0f978f3f5830a ("perf header: Don't write empty BPF/BTF info") Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 161284b26fb17093bad3c7b25d76459e11d3142f Merge: 4b747cc628d8f5 0b6c10cb8479d0 Author: Rafael J. Wysocki Date: Thu Nov 13 21:05:46 2025 +0100 Merge branch 'pm-sleep' Merge fixes for issues related to the handling of compressed hibernation images that were introduced during the 6.9 development cycle. * pm-sleep: PM: hibernate: Fix style issues in save_compressed_image() PM: hibernate: Use atomic64_t for compressed_size variable PM: hibernate: Emit an error when image writing fails commit 9b9e43704d2b05514aeeaea36311addba2c72408 Merge: 8b4a014e2865a9 cbcff934fa7deb Author: Linus Torvalds Date: Thu Nov 13 11:42:44 2025 -0800 Merge tag 'slab-for-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix memory leak of objects from remote NUMA node when bulk freeing to a cache with sheaves (Harry Yoo) * tag 'slab-for-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: fix memory leak in free_to_pcs_bulk() commit 7564f3543cf19b1232553ab10399c9fbf514b5f3 Merge: e9a6fb0bcdd760 0fce75870666b4 4b93d211bbffd3 Author: Rafael J. Wysocki Date: Thu Nov 13 20:40:51 2025 +0100 Merge branches 'acpi-cppc' and 'acpi-tables' Merge ACPI CPPC library fixes and an ACPI MRRM table parser fix for 6.18-rc6. * acpi-cppc: ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs ACPI: CPPC: Perform fast check switch only for online CPUs ACPI: CPPC: Check _CPC validity for only the online CPUs ACPI: CPPC: Detect preferred core availability on online CPUs * acpi-tables: ACPI: MRRM: Fix memory leaks and improve error handling commit 8b4a014e2865a970c18c1e9bba2b5c5a7322045f Merge: d0309c054362a2 dd4adb986a8672 Author: Linus Torvalds Date: Thu Nov 13 11:37:40 2025 -0800 Merge tag 'linux_kselftest-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "Fixes event-filter-function.tc tracing test failure caused when a first run to sample events triggers kmem_cache_free which interferes with the rest of the test. Fix this by calling sample_events twice to eliminate the kmem_cache_free related noise from the sampling" * tag 'linux_kselftest-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Run sample events to clear page cache events commit d0309c054362a235077327b46f727bc48878a3bc Merge: 2ccec5944606ee 94909c53e44247 Author: Linus Torvalds Date: Thu Nov 13 11:20:25 2025 -0800 Merge tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth and Wireless. No known outstanding regressions. Current release - regressions: - eth: - bonding: fix mii_status when slave is down - mlx5e: fix missing error assignment in mlx5e_xfrm_add_state() Previous releases - regressions: - sched: limit try_bulk_dequeue_skb() batches - ipv4: route: prevent rt_bind_exception() from rebinding stale fnhe - af_unix: initialise scc_index in unix_add_edge() - netpoll: fix incorrect refcount handling causing incorrect cleanup - bluetooth: don't hold spin lock over sleeping functions - hsr: Fix supervision frame sending on HSRv0 - sctp: prevent possible shift out-of-bounds - tipc: fix use-after-free in tipc_mon_reinit_self(). - dsa: tag_brcm: do not mark link local traffic as offloaded - eth: virtio-net: fix incorrect flags recording in big mode Previous releases - always broken: - sched: initialize struct tc_ife to fix kernel-infoleak - wifi: - mac80211: reject address change while connecting - iwlwifi: avoid toggling links due to wrong element use - bluetooth: cancel mesh send timer when hdev removed - strparser: fix signed/unsigned mismatch bug - handshake: fix memory leak in tls_handshake_accept() Misc: - selftests: mptcp: fix some flaky tests" * tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits) hsr: Follow standard for HSRv0 supervision frames hsr: Fix supervision frame sending on HSRv0 virtio-net: fix incorrect flags recording in big mode ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe wifi: iwlwifi: mld: always take beacon ies in link grading wifi: iwlwifi: mvm: fix beacon template/fixed rate wifi: iwlwifi: fix aux ROC time event iterator usage net_sched: limit try_bulk_dequeue_skb() batches selftests: mptcp: join: properly kill background tasks selftests: mptcp: connect: trunc: read all recv data selftests: mptcp: join: userspace: longer transfer selftests: mptcp: join: endpoints: longer transfer selftests: mptcp: join: rm: set backup flag selftests: mptcp: connect: fix fallback note due to OoO ethtool: fix incorrect kernel-doc style comment in ethtool.h mlx5: Fix default values in create CQ Bluetooth: btrtl: Avoid loading the config file on security chips net/mlx5e: Fix potentially misleading debug message net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net/mlx5e: Fix maxrate wraparound in threshold between units ... commit cbcff934fa7deb670d9545a3aad4d07e8f1e4f3c Author: Harry Yoo Date: Tue Nov 11 21:53:31 2025 +0900 mm/slub: fix memory leak in free_to_pcs_bulk() The commit 989b09b73978 ("slab: skip percpu sheaves for remote object freeing") introduced the remote_objects array in free_to_pcs_bulk() to skip sheaves when objects from a remote node are freed. However, the array is flushed only when: 1) the array becomes full (++remote_nr >= PCS_BATCH_MAX), or 2) slab_free_hook() returns false and size becomes zero. When neither of the conditions is met, objects in the array are leaked. This resulted in a memory leak [1], where 82 GiB of memory was allocated for the maple_node cache. Flush the array after successfully freeing objects to sheaves in the do_free: path. In the meantime, move the snippet if (!size) goto flush_remote; outside the while loop for readability. Let's say all objects in the array are from a remote node: then we acquire s->cpu_sheaves->lock and try to free an object even when size is zero. This doesn't appear to be harmful, but isn't really readable. Reported-by: Tytus Rogalewski Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220765 [1] Closes: https://lore.kernel.org/linux-mm/20251107094809.12e9d705b7bf4815783eb184@linux-foundation.org Closes: https://lore.kernel.org/all/aRGDTwbt2EIz2CYn@hyeyoo Fixes: 989b09b73978 ("slab: skip percpu sheaves for remote object freeing") Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20251111125331.12246-1-harry.yoo@oracle.com Acked-by: Liam R. Howlett Tested-by: Darrick J. Wong Tested-by: Tytus Rogalewski Signed-off-by: Vlastimil Babka commit 10eaa4c4a257944e9b30d13fda7d09164a70866d Author: Anurag Dutta Date: Wed Nov 5 21:41:46 2025 +0530 spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call Fix runtime PM usage count underflow caused by calling pm_runtime_put_autosuspend() twice with only one corresponding pm_runtime_get_noresume() call. This triggers the warning: "Runtime PM usage count underflow!" Remove the duplicate put call to balance the runtime PM reference counting. Fixes: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") Signed-off-by: Anurag Dutta Link: https://patch.msgid.link/20251105161146.2019090-3-a-dutta@ti.com Signed-off-by: Mark Brown commit f1eb4e792bb1ee3dcdffa66f8a83a4867cda2dd3 Author: Anurag Dutta Date: Wed Nov 5 21:41:45 2025 +0530 spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance The "probe_setup_failed" label calls pm_runtime_disable(), but pm_runtime_enable() was placed after a possible jump to this label. When cqspi_setup_flash() fails, control jumps to the label without pm_runtime_enable() being called, leading to unbalanced PM runtime reference counting. Move pm_runtime_enable() and associated calls above the first possible branch to "probe_setup_failed" to ensure balanced enable/disable calls across all error paths. Fixes: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") Signed-off-by: Anurag Dutta Link: https://patch.msgid.link/20251105161146.2019090-2-a-dutta@ti.com Signed-off-by: Mark Brown commit a257e974210320ede524f340ffe16bf4bf0dda1e Author: Zqiang Date: Thu Nov 13 19:43:55 2025 +0800 sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the following scenarios may occur: lock(&rq->__lock); lock(&rq->__lock); This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn() is always invoked in hard-irq context. Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit fbade4bd08ba52cbc74a71c4e86e736f059f99f7 Author: Jiayuan Chen Date: Tue Nov 11 14:02:50 2025 +0800 mptcp: Disallow MPTCP subflows from sockmap The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' Consider two scenarios: 1. When the server has MPTCP enabled and the client also requests MPTCP, the sk passed to the BPF program is a subflow sk. Since subflows only handle partial data, replacing their sk_prot is meaningless and will cause traffic disruption. 2. When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. ''' subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() ''' Subsequently, accept::mptcp_stream_accept::mptcp_fallback_tcp_ops() converts the subflow to plain TCP. For the first case, we should prevent it from being combined with sockmap by setting sk_prot->psock_update_sk_prot to NULL, which will be blocked by sockmap's own flow. For the second case, since subflow_syn_recv_sock() has already restored sk_prot to native tcp_prot/tcpv6_prot, no further action is needed. Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections") Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Reviewed-by: Matthieu Baerts (NGI0) Cc: Link: https://patch.msgid.link/20251111060307.194196-2-jiayuan.chen@linux.dev commit 0a8fb03fe7b0abab0ff16522e2625163183e7ae4 Author: Kiryl Shutsemau Date: Thu Nov 13 12:10:06 2025 +0000 MAINTAINERS: Update name spelling Use transliteration from the Belarusian language instead of Russian. Signed-off-by: Kiryl Shutsemau Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251113121006.651992-1-kas%40kernel.org commit ebd4469e7af61019daaf904fdcba07a9ecd18440 Author: Andrew Donnellan Date: Wed Nov 5 14:40:32 2025 +1100 entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub The stub implementation of arch_xfer_to_guest_mode_handle_work() is guarded by an #ifndef that incorrectly checks for the name arch_xfer_to_guest_mode_work instead. It seems the function was renamed to add "_handle" as a late change to the original patch, and the #ifndef wasn't updated to go with it. Change the #ifndef to match the name of the function. No users right now, so no need to update any architecture code. Fixes: 935ace2fb5cc4 ("entry: Provide infrastructure for work before transitioning to guest mode") Signed-off-by: Andrew Donnellan Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251105-entry-fix-ifndef-v1-1-d8d28045b627@linux.ibm.com commit 94909c53e442474a432c57c96b99d99357ac3593 Merge: 0eff2eaa5322b5 b2c26c82f7a94e Author: Paolo Abeni Date: Thu Nov 13 15:55:06 2025 +0100 Merge branch 'hsr-send-correct-hsrv0-supervision-frames' Felix Maurer says: ==================== hsr: Send correct HSRv0 supervision frames Hangbin recently reported that the hsr selftests were failing and noted that the entries in the node table were not merged, i.e., had 00:00:00:00:00:00 as MacAddressB forever [1]. This failure only occured with HSRv0 because it was not sending supervision frames anymore. While debugging this I found that we were not really following the HSRv0 standard for the supervision frames we sent, so I additionally made a few changes to get closer to the standard and restore a more correct behavior we had a while ago. The selftests can still fail because they take a while and run into the timeout. I did not include a change of the timeout because I have more improvements to the selftests mostly ready that change the test duration but are net-next material. [1]: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/ ==================== Link: https://patch.msgid.link/cover.1762876095.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit b2c26c82f7a94ec4da096f370e3612ee14424450 Author: Felix Maurer Date: Tue Nov 11 17:29:33 2025 +0100 hsr: Follow standard for HSRv0 supervision frames For HSRv0, the path_id has the following meaning: - 0000: PRP supervision frame - 0001-1001: HSR ring identifier - 1010-1011: Frames from PRP network (A/B, with RedBoxes) - 1111: HSR supervision frame Follow the IEC 62439-3:2010 standard more closely by setting the right path_id for HSRv0 supervision frames (actually, it is correctly set when the frame is constructed, but hsr_set_path_id() overwrites it) and set a fixed HSR ring identifier of 1. The ring identifier seems to be generally unused and we ignore it anyways on reception, but some fixed identifier is definitely better than using one identifier in one direction and a wrong identifier in the other. This was also the behavior before commit f266a683a480 ("net/hsr: Better frame dispatch") which introduced the alternating path_id. This was later moved to hsr_set_path_id() in commit 451d8123f897 ("net: prp: add packet handling support"). The IEC 62439-3:2010 also contains 6 unused bytes after the MacAddressA in the HSRv0 supervision frames. Adjust a TODO comment accordingly. Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Fixes: 451d8123f897 ("net: prp: add packet handling support") Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/ea0d5133cd593856b2fa673d6e2067bf1d4d1794.1762876095.git.fmaurer@redhat.com Tested-by: Hangbin Liu Signed-off-by: Paolo Abeni commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f Author: Felix Maurer Date: Tue Nov 11 17:29:32 2025 +0100 hsr: Fix supervision frame sending on HSRv0 On HSRv0, no supervision frames were sent. The supervison frames were generated successfully, but failed the check for a sufficiently long mac header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info() because the mac header only contained the ethernet header. Fix this by including the HSR header in the mac header when generating HSR supervision frames. Note that the mac header now also includes the TLV fields. This matches how we set the headers on rx and also the size of struct hsrv0_ethhdr_sp. Reported-by: Hangbin Liu Closes: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/ Fixes: 9cfb5e7f0ded ("net: hsr: fix hsr_init_sk() vs network/transport headers.") Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Tested-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/4354114fea9a642fe71f49aeeb6c6159d1d61840.1762876095.git.fmaurer@redhat.com Tested-by: Hangbin Liu Signed-off-by: Paolo Abeni commit 0a4a18e888ae8c8004582f665c5792c84a681668 Author: Randy Dunlap Date: Tue Nov 11 17:09:20 2025 -0800 drm/client: fix MODULE_PARM_DESC string for "active" The MODULE_PARM_DESC string for the "active" parameter is missing a space and has an extraneous trailing ']' character. Correct these. Before patch: $ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default isfbdev] (string) After patch: $ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default is fbdev (string) Fixes: f7b42442c4ac ("drm/log: Introduce a new boot logger to draw the kmsg on the screen") Signed-off-by: Randy Dunlap Reviewed-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251112010920.2355712-1-rdunlap@infradead.org commit 2ccec5944606ee1389abc7ee41986825c6ceb574 Merge: 967a72fa7f6b77 f2a12cc3b97f06 Author: Linus Torvalds Date: Thu Nov 13 05:02:59 2025 -0800 Merge tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Add Chunhai Guo as a EROFS reviewer to get more eyes from interested industry vendors - Fix infinite loop caused by incomplete crafted zstd-compressed data (thanks to Robert again!) * tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: avoid infinite loop due to incomplete zstd-compressed data MAINTAINERS: erofs: add myself as reviewer commit 967a72fa7f6b77eb9f65c7365487662a4d04dbe4 Merge: 6fa9041b7177f6 55286b1e1bf4ce Author: Linus Torvalds Date: Thu Nov 13 04:57:38 2025 -0800 Merge tag 'v6.18-rc5-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix smbdirect (RDMA) disconnect hang bug - Fix potential Denial of Service when connection limit exceeded - Fix smbdirect (RDMA) connection (potentially accessing freed memory) bug * tag 'v6.18-rc5-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let smb_direct_disconnect_rdma_connection() turn CREATED into DISCONNECTED ksmbd: close accepted socket when per-IP limit rejects connection smb: server: rdma: avoid unmapping posted recv on accept failure commit 921b3f59b7b00cd7067ab775b0e0ca4eca436c2f Author: Shawn Lin Date: Wed Nov 12 18:53:18 2025 -0600 PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi This Wi-Fi advertises the L0s and L1 capabilities but actually it doesn't support them. This is confirmed by HiSilicon team in actual productization. Signed-off-by: Shawn Lin Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1762916319-139532-1-git-send-email-shawn.lin@rock-chips.com commit 0eff2eaa5322b5b141ff5d5ded26fac4a52b5f7b Author: Xuan Zhuo Date: Tue Nov 11 17:08:28 2025 +0800 virtio-net: fix incorrect flags recording in big mode The purpose of commit 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") is to record the flags in advance, as their value may be overwritten in the XDP case. However, the flags recorded under big mode are incorrect, because in big mode, the passed buf does not point to the rx buffer, but rather to the page of the submitted buffer. This commit fixes this issue. For the small mode, the commit c11a49d58ad2 ("virtio_net: Fix mismatched buf address when unmapping for small packets") fixed it. Tested-by: Alyssa Ross Fixes: 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251111090828.23186-1-xuanzhuo@linux.alibaba.com Signed-off-by: Paolo Abeni commit 6fa9041b7177f6771817b95e83f6df17b147c8c6 Merge: 92385a075a0112 324be6dcbf0913 Author: Linus Torvalds Date: Wed Nov 12 18:41:01 2025 -0800 Merge tag 'nfsd-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Address recently reported issues or issues found at the recent NFS bake-a-thon held in Raleigh, NC. Issues reported with v6.18-rc: - Address a kernel build issue - Reorder SEQUENCE processing to avoid spurious NFS4ERR_SEQ_MISORDERED Issues that need expedient stable backports: - Close a refcount leak exposure - Report support for NFSv4.2 CLONE correctly - Fix oops during COPY_NOTIFY processing - Prevent rare crash after XDR encoding failure - Prevent crash due to confused or malicious NFSv4.1 client" * tag 'nfsd-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: Revert "SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it" nfsd: ensure SEQUENCE replay sends a valid reply. NFSD: Never cache a COMPOUND when the SEQUENCE operation fails NFSD: Skip close replay processing if XDR encoding fails NFSD: free copynotify stateid in nfs4_free_ol_stateid() nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes nfsd: fix refcount leak in nfsd_set_fh_dentry() commit 92385a075a01124100edc581e3b8285268d8591e Merge: e927c520e1ba6b a50f7456f853ec Author: Linus Torvalds Date: Wed Nov 12 18:31:22 2025 -0800 Merge tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - two minor fixes for DMA API infrastructure: restoring proper structure padding used in benchmark tests (Qinxin Xia) and global DMA_BIT_MASK macro rework to make it a bit more clang friendly (James Clark) * tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope dma-mapping: benchmark: Restore padding to ensure uABI remained consistent commit e927c520e1ba6b6a0b2022adf5ba455ee1553fc1 Merge: 89ee862a4dd30c 237e74bfa261fb Author: Linus Torvalds Date: Wed Nov 12 18:21:30 2025 -0800 Merge tag 'loongarch-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - Fix a Rust build error - Fix exception/interrupt, memory management, perf event, hardware breakpoint, kexec and KVM bugs * tag 'loongarch-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix max supported vCPUs set with EIOINTC LoongArch: KVM: Skip PMU checking on vCPU context switch LoongArch: KVM: Restore guest PMU if it is enabled LoongArch: KVM: Add delay until timer interrupt injected LoongArch: KVM: Set page with write attribute if dirty track disabled LoongArch: kexec: Print out debugging message if required LoongArch: kexec: Initialize the kexec_buf structure LoongArch: Use correct accessor to read FWPC/MWPC LoongArch: Refine the init_hw_perf_events() function LoongArch: Remove __GFP_HIGHMEM masking in pud_alloc_one() LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY LoongArch: Consolidate max_pfn & max_low_pfn calculation LoongArch: Consolidate early_ioremap()/ioremap_prot() LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY LoongArch: Clarify 3 MSG interrupt features rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags commit 89ee862a4dd30c3f00e1aedbca5ce0d8bc3c1ddc Merge: 24172e0d799009 d58041d2c63e09 Author: Linus Torvalds Date: Wed Nov 12 18:18:12 2025 -0800 Merge tag 'alpha-fixes-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha fix from Matt Turner: "Add Magnus as a maintainer of the alpha port" * tag 'alpha-fixes-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: MAINTAINERS: Add Magnus Lindholm as maintainer for alpha port commit 823576c894d73255d35c0d0dabbb6ffecf1f2667 Author: Bjorn Helgaas Date: Wed Nov 12 18:36:24 2025 -0600 PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports Christian reported that f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") broke booting on the A-EON AmigaOne X1000. Override the L0s and L1 Support advertised in Link Capabilities by the X1000 Root Ports ([1959:a002]) so we don't try to enable those states. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/a41d2ca1-fcd9-c416-b111-a958e92e94bf@xenosoft.de Signed-off-by: Bjorn Helgaas commit 5b40a5080c39933e7ce28bcb63cd4c1818d6c873 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:28 2025 -0600 PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports Christian reported that f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") broke booting on the A-EON X5000. Override the L0s and L1 Support advertised in Link Capabilities by the X5000 Root Ports ([1957:0451]) so we don't try to enable those states. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/db5c95a1-cf3e-46f9-8045-a1b04908051a@xenosoft.de Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-5-helgaas@kernel.org commit 30579eebba6ae52dc7441479aec9dd8d782256d3 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:27 2025 -0600 PCI/ASPM: Convert quirks to override advertised link states Existing quirks to disable ASPM L0s and L1 use pci_disable_link_state(), which disables ASPM states and prevents their use in the future. But since they are FINAL quirks, they happen after ASPM has already been enabled. Here's a typical call path: pci_host_probe pci_scan_root_bus_bridge pci_scan_child_bus pci_scan_slot pci_scan_single_device pci_device_add pci_fixup_device(pci_fixup_header) # HEADER quirks pcie_aspm_init_link_state pcie_config_aspm_path pcie_config_aspm_link pcie_config_aspm_dev # ASPM may be enabled pci_bus_add_devices pci_bus_add_devices pci_fixup_device(pci_fixup_final) # FINAL quirks quirk_disable_aspm_l0s pci_disable_link_state(dev, PCIE_LINK_STATE_L0S) Sometimes enabling ASPM can make the link non-functional, so if we know ASPM is broken on a device, we shouldn't enable it at all, even temporarily. Convert the existing quirks to use pcie_aspm_remove_cap() instead, which overrides the ASPM Support advertised in PCIe Link Capabilities, and make them HEADER quirks so they run before pcie_aspm_init_link_state() has a chance to enable ASPM. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-4-helgaas@kernel.org commit 575b98e39d817537afdc6c39d35c1de484a64d42 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:26 2025 -0600 PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states Add pcie_aspm_remove_cap(). A quirk can use this to prevent use of ASPM L0s or L1 link states, even if the device advertised support for them. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-3-helgaas@kernel.org commit 4495bffd86ba0fdabfaef0c41d12f68ec2a1e05b Author: Bjorn Helgaas Date: Mon Nov 10 16:22:25 2025 -0600 PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden Defective devices sometimes advertise support for ASPM L0s or L1 states even if they don't work correctly. Cache the L0s Supported and L1 Supported bits early in enumeration so HEADER quirks can override the ASPM states advertised in Link Capabilities before pcie_aspm_cap_init() enables ASPM. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-2-helgaas@kernel.org commit 360b3730f8eab6c4467c6cca4cb0e30902174a63 Author: Haotian Zhang Date: Wed Nov 12 14:57:09 2025 +0800 ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe() rsnd_ssiu_probe() leaks an OF node reference obtained by rsnd_ssiu_of_node(). The node reference is acquired but never released across all return paths. Fix it by declaring the device node with the __free(device_node) cleanup construct to ensure automatic release when the variable goes out of scope. Fixes: 4e7788fb8018 ("ASoC: rsnd: add SSIU BUSIF support") Signed-off-by: Haotian Zhang Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20251112065709.1522-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 214291cbaaceeb28debd773336642b1fca393ae0 Author: Dave Jiang Date: Wed Nov 5 16:51:15 2025 -0700 acpi/hmat: Fix lockdep warning for hmem_register_resource() The following lockdep splat was observed while kernel auto-online a CXL memory region: ====================================================== WARNING: possible circular locking dependency detected 6.17.0djtest+ #53 Tainted: G W ------------------------------------------------------ systemd-udevd/3334 is trying to acquire lock: ffffffff90346188 (hmem_resource_lock){+.+.}-{4:4}, at: hmem_register_resource+0x31/0x50 but task is already holding lock: ffffffff90338890 ((node_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x2e/0x70 which lock already depends on the new lock. [..] Chain exists of: hmem_resource_lock --> mem_hotplug_lock --> (node_chain).rwsem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock((node_chain).rwsem); lock(mem_hotplug_lock); lock((node_chain).rwsem); lock(hmem_resource_lock); The lock ordering can cause potential deadlock. There are instances where hmem_resource_lock is taken after (node_chain).rwsem, and vice versa. Split out the target update section of hmat_register_target() so that hmat_callback() only envokes that section instead of attempt to register hmem devices that it does not need to. [ dj: Fix up comment to be closer to 80cols. (Jonathan) ] Fixes: cf8741ac57ed ("ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device") Reviewed-by: Jonathan Cameron Tested-by: Smita Koralahalli Reviewed-by: Smita Koralahalli Reviewed-by: Dan Williams Link: https://patch.msgid.link/20251105235115.85062-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit c55a8e24cd129b6d8fed20e3d63c10c2263e2fc8 Author: Cryolitia PukNgae Date: Thu Oct 30 22:30:06 2025 +0800 hwmon: (gpd-fan) initialize EC on driver load for Win 4 The original implement will re-init the EC when it reports a zero value, and it's a workaround for the black box buggy firmware. Now a contributer test and report that, the bug is that, the firmware won't initialize the EC on boot, so the EC ramains in unusable status. And it won't need to re-init it during runtime. The original implement is not perfect, any write command will be ignored until we first read it. Just re-init it unconditionally when the driver load could work. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Co-developed-by: kylon <3252255+kylon@users.noreply.github.com> Signed-off-by: kylon <3252255+kylon@users.noreply.github.com> Link: https://github.com/Cryolitia/gpd-fan-driver/pull/20 Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20251030-win4-v1-1-c374dcb86985@uniontech.com Signed-off-by: Guenter Roeck commit 9efb297c520f392ab04bc45544a03770c98c3798 Author: Gopi Krishna Menon Date: Sat Oct 25 01:50:40 2025 +0530 hwmon: (gpd-fan) Fix compilation error in non-ACPI builds Building gpd-fan driver without CONFIG_ACPI results in the following build errors: drivers/hwmon/gpd-fan.c: In function ‘gpd_ecram_read’: drivers/hwmon/gpd-fan.c:228:9: error: implicit declaration of function ‘outb’ [-Werror=implicit-function-declaration] 228 | outb(0x2E, addr_port); | ^~~~ drivers/hwmon/gpd-fan.c:241:16: error: implicit declaration of function ‘inb’ [-Werror=implicit-function-declaration] 241 | *val = inb(data_port); The definitions for inb() and outb() come from (specifically through ), which is implicitly included via . When CONFIG_ACPI is not set, is not included resulting in to be omitted as well. Since the driver does not depend on ACPI, remove and add directly to fix the compilation errors. Signed-off-by: Gopi Krishna Menon Link: https://lore.kernel.org/r/20251024202042.752160-1-krishnagopi487@gmail.com Signed-off-by: Guenter Roeck commit c87488a12393a23f8a1b9850b989b386c58cac3f Author: Emil Tsalapatis Date: Wed Nov 12 08:42:02 2025 -1000 sched/ext: convert scx_tasks_lock to raw spinlock Update scx_task_locks so that it's safe to lock/unlock in a non-sleepable context in PREEMPT_RT kernels. scx_task_locks is (non-raw) spinlock used to protect the list of tasks under SCX. This list is updated during from finish_task_switch(), which cannot sleep. Regular spinlocks can be locked in such a context in non-RT kernels, but are sleepable under when CONFIG_PREEMPT_RT=y. Convert scx_task_locks into a raw spinlock, which is not sleepable even on RT kernels. Sample backtrace: dump_stack_lvl+0x83/0xa0 __might_resched+0x14a/0x200 rt_spin_lock+0x61/0x1c0 ? sched_ext_dead+0x2d/0xf0 ? lock_release+0xc6/0x280 sched_ext_dead+0x2d/0xf0 ? srso_alias_return_thunk+0x5/0xfbef5 finish_task_switch.isra.0+0x254/0x360 __schedule+0x584/0x11d0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? tick_nohz_idle_exit+0x7e/0x120 schedule_idle+0x23/0x40 cpu_startup_entry+0x29/0x30 start_secondary+0xf8/0x100 common_startup_64+0x13e/0x148 Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit fe82c4f8a228d3b3ec2462ea2d43fa532a20ac67 Merge: ac1499fcd40fe0 a35f64a216ca1c Author: Jakub Kicinski Date: Wed Nov 12 09:33:09 2025 -0800 Merge tag 'wireless-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple more fixes: - mwl8k: work around FW expecting a DSSS element in beacons - ath11k: report correct TX status - iwlwifi: avoid toggling links due to wrong element use - iwlwifi: fix beacon template rate on older devices - iwlwifi: fix loop iterator being used after loop - mac80211: disallow address changes while using the address - mac80211: avoid bad rate warning in monitor/sniffer mode - hwsim: fix potential NULL deref (on monitor injection) * tag 'wireless-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: mld: always take beacon ies in link grading wifi: iwlwifi: mvm: fix beacon template/fixed rate wifi: iwlwifi: fix aux ROC time event iterator usage wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing wifi: mac80211_hwsim: Fix possible NULL dereference wifi: mac80211: skip rate verification for not captured PSDUs wifi: mac80211: reject address change while connecting wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() ==================== Link: https://patch.msgid.link/20251112114621.15716-5-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 4b747cc628d8f500d56cf1338280eacc66362ff3 Author: Srinivas Pandruvada Date: Mon Nov 10 17:08:40 2025 -0800 cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes Commit ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") introduced a check for feature X86_FEATURE_IDA to verify turbo mode support. Although this is the correct way to check for turbo mode support, it causes issues on some platforms that disable turbo during OS boot, but enable it later [1]. Before adding this feature check, users were able to get turbo mode frequencies by writing 0 to /sys/devices/system/cpu/intel_pstate/no_turbo post-boot. To restore the old behavior on the affected systems while still addressing the unchecked MSR issue on some Skylake-X systems, check X86_FEATURE_IDA only immediately before updates of MSR_IA32_PERF_CTL that may involve setting the Turbo Engage Bit (bit 32). Fixes: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") Reported-by: Aaron Rainbolt Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2122531 [1] Tested-by: Aaron Rainbolt Signed-off-by: Srinivas Pandruvada [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20251111010840.141490-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5f02151c411dda46efcc5dc57b0845efcdcfc26d Author: Zqiang Date: Wed Nov 12 15:33:28 2025 +0800 sched_ext: Fix unsafe locking in the scx_dump_state() For built with CONFIG_PREEMPT_RT=y kernels, the dump_lock will be converted sleepable spinlock and not disable-irq, so the following scenarios occur: inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. irq_work/0/27 [HC0[0]:SC0[0]:HE1:SE1] takes: (&rq->__lock){?...}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x40 {IN-HARDIRQ-W} state was registered at: lock_acquire+0x1e1/0x510 _raw_spin_lock_nested+0x42/0x80 raw_spin_rq_lock_nested+0x2b/0x40 sched_tick+0xae/0x7b0 update_process_times+0x14c/0x1b0 tick_periodic+0x62/0x1f0 tick_handle_periodic+0x48/0xf0 timer_interrupt+0x55/0x80 __handle_irq_event_percpu+0x20a/0x5c0 handle_irq_event_percpu+0x18/0xc0 handle_irq_event+0xb5/0x150 handle_level_irq+0x220/0x460 __common_interrupt+0xa2/0x1e0 common_interrupt+0xb0/0xd0 asm_common_interrupt+0x2b/0x40 _raw_spin_unlock_irqrestore+0x45/0x80 __setup_irq+0xc34/0x1a30 request_threaded_irq+0x214/0x2f0 hpet_time_init+0x3e/0x60 x86_late_time_init+0x5b/0xb0 start_kernel+0x308/0x410 x86_64_start_reservations+0x1c/0x30 x86_64_start_kernel+0x96/0xa0 common_startup_64+0x13e/0x148 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rq->__lock); lock(&rq->__lock); *** DEADLOCK *** stack backtrace: CPU: 0 UID: 0 PID: 27 Comm: irq_work/0 Call Trace: dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 print_usage_bug+0x42e/0x690 mark_lock.part.44+0x867/0xa70 ? __pfx_mark_lock.part.44+0x10/0x10 ? string_nocheck+0x19c/0x310 ? number+0x739/0x9f0 ? __pfx_string_nocheck+0x10/0x10 ? __pfx_check_pointer+0x10/0x10 ? kvm_sched_clock_read+0x15/0x30 ? sched_clock_noinstr+0xd/0x20 ? local_clock_noinstr+0x1c/0xe0 __lock_acquire+0xc4b/0x62b0 ? __pfx_format_decode+0x10/0x10 ? __pfx_string+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 lock_acquire+0x1e1/0x510 ? raw_spin_rq_lock_nested+0x2b/0x40 ? __pfx_lock_acquire+0x10/0x10 ? dump_line+0x12e/0x270 ? raw_spin_rq_lock_nested+0x20/0x40 _raw_spin_lock_nested+0x42/0x80 ? raw_spin_rq_lock_nested+0x2b/0x40 raw_spin_rq_lock_nested+0x2b/0x40 scx_dump_state+0x3b3/0x1270 ? finish_task_switch+0x27e/0x840 scx_ops_error_irq_workfn+0x67/0x80 irq_work_single+0x113/0x260 irq_work_run_list.part.3+0x44/0x70 run_irq_workd+0x6b/0x90 ? __pfx_run_irq_workd+0x10/0x10 smpboot_thread_fn+0x529/0x870 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x305/0x3f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x40/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 This commit therefore use rq_lock_irqsave/irqrestore() to replace rq_lock/unlock() in the scx_dump_state(). Fixes: 07814a9439a3 ("sched_ext: Print debug dump after an error exit") Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit 2d0e88f3fd1dcb37072d499c36162baf5b009d41 Author: Caleb Sander Mateos Date: Tue Nov 11 12:15:29 2025 -0700 io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs io_buffer_register_bvec() currently uses blk_rq_nr_phys_segments() as the number of bvecs in the request. However, bvecs may be split into multiple segments depending on the queue limits. Thus, the number of segments may overestimate the number of bvecs. For ublk devices, the only current users of io_buffer_register_bvec(), virt_boundary_mask, seg_boundary_mask, max_segments, and max_segment_size can all be set arbitrarily by the ublk server process. Set imu->nr_bvecs based on the number of bvecs the rq_for_each_bvec() loop actually yields. However, continue using blk_rq_nr_phys_segments() as an upper bound on the number of bvecs when allocating imu to avoid needing to iterate the bvecs a second time. Link: https://lore.kernel.org/io-uring/20251111191530.1268875-1-csander@purestorage.com/ Signed-off-by: Caleb Sander Mateos Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs") Reviewed-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit d323ad739666761646048fca587734f4ae64f2c8 Author: Alex Mastro Date: Tue Nov 11 10:48:27 2025 -0800 vfio: selftests: replace iova=vaddr with allocated iovas vfio_dma_mapping_test and vfio_pci_driver_test currently use iova=vaddr as part of DMA mapping operations. However, not all IOMMUs support the same virtual address width as the processor. For instance, older Intel consumer platforms only support 39-bits of IOMMU address space. On such platforms, using the virtual address as the IOVA fails. Make the tests more robust by using iova_allocator to vend IOVAs, which queries legally accessible IOVAs from the underlying IOMMUFD or VFIO container. Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-4-7960244642c5@fb.com Signed-off-by: Alex Williamson commit ce0e3c403e00e9e03e80aca6570bf936a44279e2 Author: Alex Mastro Date: Tue Nov 11 10:48:26 2025 -0800 vfio: selftests: add iova allocator Add struct iova_allocator, which gives tests a convenient way to generate legally-accessible IOVAs to map. This allocator traverses the sorted available IOVA ranges linearly, requires power-of-two size allocations, and does not support freeing iova allocations. The assumption is that tests are not IOVA space-bounded, and will not need to recycle IOVAs. This is based on Alex Williamson's patch series for adding an IOVA allocator [1]. [1] https://lore.kernel.org/all/20251108212954.26477-1-alex@shazbot.org/ Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-3-7960244642c5@fb.com Signed-off-by: Alex Williamson commit a77fa0b9222d2f23a764061a3be18e6bc738672e Author: Alex Mastro Date: Tue Nov 11 10:48:25 2025 -0800 vfio: selftests: fix map limit tests to use last available iova Use the newly available vfio_pci_iova_ranges() to determine the last legal IOVA, and use this as the basis for vfio_dma_map_limit_test tests. Fixes: de8d1f2fd5a5 ("vfio: selftests: add end of address space DMA map/unmap tests") Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-2-7960244642c5@fb.com Signed-off-by: Alex Williamson commit 7c44656ab3ea6f8429027ed14c23b314502e2541 Author: Alex Mastro Date: Tue Nov 11 10:48:24 2025 -0800 vfio: selftests: add iova range query helpers VFIO selftests need to map IOVAs from legally accessible ranges, which could vary between hardware. Tests in vfio_dma_mapping_test.c are making excessively strong assumptions about which IOVAs can be mapped. Add vfio_iommu_iova_ranges(), which queries IOVA ranges from the IOMMUFD or VFIO container associated with the device. The queried ranges are normalized to IOMMUFD's iommu_iova_range representation so that handling of IOVA ranges up the stack can be implementation-agnostic. iommu_iova_range and vfio_iova_range are equivalent, so bias to using the new interface's struct. Query IOMMUFD's ranges with IOMMU_IOAS_IOVA_RANGES. Query VFIO container's ranges with VFIO_IOMMU_GET_INFO and VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE. The underlying vfio_iommu_type1_info buffer-related functionality has been kept generic so the same helpers can be used to query other capability chain information, if needed. Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-1-7960244642c5@fb.com Signed-off-by: Alex Williamson commit ac1499fcd40fe06479e9b933347b837ccabc2a40 Author: Chuang Wang Date: Tue Nov 11 14:43:24 2025 +0800 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random. The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked. CPU 0 CPU 1 __mkroute_output() find_exception() [fnheX] update_or_create_fnhe() fnhe_remove_oldest() [fnheX] rt_bind_exception() [bind dst] RCU callback [fnheX freed, dst leak] This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device: unregister_netdevice: waiting for sitX to become free. Usage count = N Ido Schimmel provided the simple test validation method [1]. The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed. [1] ip netns add ns1 ip -n ns1 link set dev lo up ip -n ns1 address add 192.0.2.1/32 dev lo ip -n ns1 link add name dummy1 up type dummy ip -n ns1 route add 192.0.2.2/32 dev dummy1 ip -n ns1 link add name gretap1 up arp off type gretap \ local 192.0.2.1 remote 192.0.2.2 ip -n ns1 route add 198.51.0.0/16 dev gretap1 taskset -c 0 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & taskset -c 2 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & sleep 10 ip netns pids ns1 | xargs kill ip netns del ns1 Cc: stable@vger.kernel.org Fixes: 67d6d681e15b ("ipv4: make exception cache less predictible") Signed-off-by: Chuang Wang Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com Signed-off-by: Jakub Kicinski commit f2687d3cc9f905505d7b510c50970176115066a2 Author: Imre Deak Date: Fri Nov 7 14:41:41 2025 +0200 drm/i915/dp_mst: Disable Panel Replay Disable Panel Replay on MST links until it's properly implemented. For instance the required VSC SDP is not programmed on MST and FEC is not enabled if Panel Replay is enabled. Fixes: 3257e55d3ea7 ("drm/i915/panelreplay: enable/disable panel replay") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15174 Cc: Jouni Högander Cc: Animesh Manna Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20251107124141.911895-1-imre.deak@intel.com (cherry picked from commit e109f644b871df8440c886a69cdce971ed533088) Signed-off-by: Rodrigo Vivi commit 1c2e70397b4125022dba80f6111271a37fb36bae Author: Praveen Talari Date: Mon Nov 10 15:40:41 2025 +0530 pinctrl: qcom: msm: Fix deadlock in pinmux configuration Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured. The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock. Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration. Suggested-by: Prasad Sodagudi Signed-off-by: Praveen Talari Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit fa0498f8047536b877819ce4ab154d332b243d43 Author: Marcos Vega Date: Sat Nov 8 12:47:41 2025 +0100 platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile New HP Omen laptops follow the same WMI thermal profile as Victus 16-r1000 and 16-s1000. Add DMI board 8D41 to victus_s_thermal_profile_boards. Signed-off-by: Marcos Vega Link: https://patch.msgid.link/20251108114739.9255-3-marcosmola2@gmail.com [ij: changelog taken partially from v1] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2e558d86e0975fdfb048bd600e253993edc068fe Merge: 23379a17334fc2 523bf0a59e674b Author: Greg Kroah-Hartman Date: Wed Nov 12 06:17:12 2025 -0500 Merge tag 'usb-serial-6.18-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial devices ids for 6.18-rc6 Here are some more modem and ftdi device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add support for Rolling RW101R-GL USB: serial: ftdi_sio: add support for u-blox EVK-M101 commit 85592114ffda568b507bc2b04f5e9afbe7c13b62 Author: Alexandru Elisei Date: Wed Nov 12 10:28:53 2025 +0000 KVM: arm64: VHE: Compute fgt traps before activating them On VHE, the Fine Grain Traps registers are written to hardware in kvm_arch_vcpu_load()->..->__activate_traps_hfgxtr(), but the fgt array is computed later, in kvm_vcpu_load_fgt(). This can lead to zero being written to the FGT registers the first time a VCPU is loaded. Also, any changes to the fgt array will be visible only after the VCPU is scheduled out, and then back in, which is not the intended behaviour. Fix it by computing the fgt array just before the fgt traps are written to hardware. Fixes: fb10ddf35c1c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()") Signed-off-by: Alexandru Elisei Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251112102853.47759-1-alexandru.elisei@arm.com Signed-off-by: Marc Zyngier commit e9d50b78fdfe675b038ddaec7a139dbe3082174c Merge: 3cd1548a278c7d 56325e8c68c072 Author: Christian Brauner Date: Wed Nov 12 10:47:52 2025 +0100 Merge patch series "fs: add iput_not_last()" Add iput_not_last() and switch landlock over to it to remove false-positives from might_sleep() annotations in iput(). Link: https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com * patches from https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com: landlock: fix splats from iput() after it started calling might_sleep() fs: add iput_not_last() Signed-off-by: Christian Brauner commit 56325e8c68c0724d626f665773a5005dcf44e329 Author: Mateusz Guzik Date: Wed Nov 5 22:20:25 2025 +0100 landlock: fix splats from iput() after it started calling might_sleep() At this point it is guaranteed this is not the last reference. However, a recent addition of might_sleep() at top of iput() started generating false-positives as it was executing for all values. Remedy the problem by using the newly introduced iput_not_last(). Reported-by: syzbot+12479ae15958fc3f54ec@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/ Fixes: 2ef435a872ab ("fs: add might_sleep() annotation to iput() and more") Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105212025.807549-2-mjguzik@gmail.com Reviewed-by: Mickaël Salaün Signed-off-by: Christian Brauner commit 12741624645e098b2234a5ae341045a97473caf1 Author: Mateusz Guzik Date: Wed Nov 5 22:20:24 2025 +0100 fs: add iput_not_last() Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3cd1548a278c7d6a9bdef1f1866e7cf66bfd3518 Author: Mike Yuan Date: Sat Nov 8 19:09:47 2025 +0000 shmem: fix tmpfs reconfiguration (remount) when noswap is set In systemd we're trying to switch the internal credentials setup logic to new mount API [1], and I noticed fsconfig(FSCONFIG_CMD_RECONFIGURE) consistently fails on tmpfs with noswap option. This can be trivially reproduced with the following: ``` int fs_fd = fsopen("tmpfs", 0); fsconfig(fs_fd, FSCONFIG_SET_FLAG, "noswap", NULL, 0); fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0); fsmount(fs_fd, 0, 0); fsconfig(fs_fd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0); <------ EINVAL ``` After some digging the culprit is shmem_reconfigure() rejecting !(ctx->seen & SHMEM_SEEN_NOSWAP) && sbinfo->noswap, which is bogus as ctx->seen serves as a mask for whether certain options are touched at all. On top of that, noswap option doesn't use fsparam_flag_no, hence it's not really possible to "reenable" swap to begin with. Drop the check and redundant SHMEM_SEEN_NOSWAP flag. [1] https://github.com/systemd/systemd/pull/39637 Fixes: 2c6efe9cf2d7 ("shmem: add support to ignore swap") Signed-off-by: Mike Yuan Link: https://patch.msgid.link/20251108190930.440685-1-me@yhndnzj.com Cc: Luis Chamberlain Cc: Christian Brauner Cc: Hugh Dickins Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 78f0e33cd6c939a555aa80dbed2fec6b333a7660 Author: Andrei Vagin Date: Tue Nov 11 06:28:15 2025 +0000 fs/namespace: correctly handle errors returned by grab_requested_mnt_ns grab_requested_mnt_ns was changed to return error codes on failure, but its callers were not updated to check for error pointers, still checking only for a NULL return value. This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and PTR_ERR() to correctly check for and propagate errors. This also makes sure that the logic actually works and mount namespace file descriptors can be used to refere to mounts. Christian Brauner says: Rework the patch to be more ergonomic and in line with our overall error handling patterns. Fixes: 7b9d14af8777 ("fs: allow mount namespace fd") Cc: Christian Brauner Signed-off-by: Andrei Vagin Link: https://patch.msgid.link/20251111062815.2546189-1-avagin@google.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f6fdd77b3e0d519a2535a1e923558cd07d9acda9 Author: Baojun Xu Date: Wed Nov 12 17:26:09 2025 +0800 ALSA: hda/tas2781: Correct the wrong project ID The project hardware ID should be ALC287_FIXUP_TXNW2781_I2C, not ALC287_FIXUP_TAS2781_I2C for HP Lampass projects. Fixes: 7a39c723b747 ("ALSA: hda/tas2781: Add new quirk for HP new projects") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251112092609.15865-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit a3f8f8662771285511ae26c4c8d3ba1cd22159b9 Author: Christian Brauner Date: Wed Nov 5 14:39:45 2025 +0100 power: always freeze efivarfs The efivarfs filesystems must always be frozen and thawed to resync variable state. Make it so. Link: https://patch.msgid.link/20251105-vorbild-zutreffen-fe00d1dd98db@brauner Signed-off-by: Christian Brauner commit a35f64a216ca1c9e3c3f0f91fdb54ef9515a7fe7 Merge: c4e1ac09ee1c75 1a222625b468ef Author: Johannes Berg Date: Wed Nov 12 09:50:45 2025 +0100 Merge tag 'iwlwifi-fixes-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fixes: - avoid link toggling - fix beacon template rate - don't use iterator outside the loop ==================== Link: https://patch.msgid.link/DM3PPF63A6024A9E52FF4A7B23F283B7FC7A3CCA@DM3PPF63A6024A9.namprd11.prod.outlook.com Signed-off-by: Johannes Berg commit 1a222625b468effd13d1ebb662c36a41c28a835a Author: Miri Korenblit Date: Mon Nov 10 14:57:00 2025 +0200 wifi: iwlwifi: mld: always take beacon ies in link grading One of the factors of a link's grade is the channel load, which is calculated from the AP's bss load element. The current code takes this element from the beacon for an active link, and from bss->ies for an inactive link. bss->ies is set to either the beacon's ies or to the probe response ones, with preference to the probe response (meaning that if there was even one probe response, the ies of it will be stored in bss->ies and won't be overiden by the beacon ies). The probe response can be very old, i.e. from the connection time, where a beacon is updated before each link selection (which is triggered only after a passive scan). In such case, the bss load element in the probe response will not include the channel load caused by the STA, where the beacon will. This will cause the inactive link to always have a lower channel load, and therefore an higher grade than the active link's one. This causes repeated link switches, causing the throughput to drop. Fix this by always taking the ies from the beacon, as those are for sure new. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110145652.b493dbb1853a.I058ba7309c84159f640cc9682d1bda56dd56a536@changeid Signed-off-by: Miri Korenblit commit 3592c0083fb29cca13cd9978b8844d58b4eff548 Author: Johannes Berg Date: Wed Oct 8 11:20:44 2025 +0200 wifi: iwlwifi: mvm: fix beacon template/fixed rate During the development of the rate changes, I evidently made some changes that shouldn't have been there; beacon templates with rate_n_flags are only in old versions, so no changes to them should have been necessary, and evidently broke on some devices. This also would have broken fixed (injection) rates, it would seem. Restore the old handling of this. Fixes: dabc88cb3b78 ("wifi: iwlwifi: handle v3 rates") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220558 Reviewed-by: Benjamin Berg Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20251008112044.3bb8ea849d8d.I90f4d2b2c1f62eaedaf304a61d2ab9e50c491c2d@changeid Signed-off-by: Miri Korenblit commit f4c737d44969c38dac2478039d353edddffd120d Author: Junjie Cao Date: Thu Oct 16 09:49:19 2025 +0800 wifi: iwlwifi: fix aux ROC time event iterator usage The list_for_each_entry() iterator must not be used outside the loop. Even though we break and check for NULL, doing so still violates kernel iteration rules and triggers Coccinelle's use_after_iter.cocci warning. Cache the matched entry in aux_roc_te and use it consistently after the loop. This follows iterator best practices, resolves the warning, and makes the code more maintainable. Signed-off-by: Junjie Cao Link: https://patch.msgid.link/20251016014919.383565-1-junjie.cao@intel.com Signed-off-by: Miri Korenblit commit eac32ff42393efa6657efc821231b8d802c1d485 Author: Harish Kasiviswanathan Date: Tue Oct 28 14:37:07 2025 -0400 drm/amdkfd: Fix GPU mappings for APU after prefetch Fix the following corner case:- Consider a 2M huge page SVM allocation, followed by prefetch call for the first 4K page. The whole range is initially mapped with single PTE. After the prefetch, this range gets split to first page + rest of the pages. Currently, the first page mapping is not updated on MI300A (APU) since page hasn't migrated. However, after range split PTE mapping it not valid. Fix this by forcing page table update for the whole range when prefetch is called. Calling prefetch on APU doesn't improve performance. If all it deteriotes. However, functionality has to be supported. v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout VRAM v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU v4: Remove v2 and v3 changes. Force update_mapping when range is split at a size that is not aligned to prange granularity Suggested-by: Philip Yang Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7) commit d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 Author: Jonathan Kim Date: Thu Nov 6 10:17:06 2025 -0500 drm/amdkfd: relax checks for over allocation of save area Over allocation of save area is not fatal, only under allocation is. ROCm has various components that independently claim authority over save area size. Unless KFD decides to claim single authority, relax size checks. Signed-off-by: Jonathan Kim Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 15bd4958fe38e763bc17b607ba55155254a01f55) Cc: stable@vger.kernel.org commit bbe3c115030da431c9ec843c18d5583e59482dd2 Author: Sathishkumar S Date: Tue Oct 7 13:17:51 2025 +0530 drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1 enable parse_cs callback for JPEG5_0_1. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit 547985579932c1de13f57f8bcf62cd9361b9d3d3) Cc: stable@vger.kernel.org commit 7132f7e025f9382157543dd86a62d161335b48b9 Author: Sultan Alsawaf Date: Fri Nov 7 13:07:13 2025 -0500 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO When the BO pointer provided to amdgpu_bo_create_kernel() points to non-NULL, amdgpu_bo_create_kernel() takes it as a hint to pin that address rather than allocate a new BO. This functionality is never desired for allocating ISP buffers. A new BO should always be created when isp_kernel_buffer_alloc() is called, per the description for isp_kernel_buffer_alloc(). Ensure this by zeroing *bo right before the amdgpu_bo_create_kernel() call. Fixes: 55d42f616976 ("drm/amd/amdgpu: Add helper functions for isp buffers") Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Pratap Nirujogi Signed-off-by: Sultan Alsawaf Signed-off-by: Alex Deucher (cherry picked from commit 73c8c29baac7f0c7e703d92eba009008cbb5228e) commit 33c995709121a3a29d4567a08c943bf7a5b24b78 Author: Ivan Lipski Date: Thu Oct 23 10:03:59 2025 -0400 drm/amd/display: Allow VRR params change if unsynced with the stream [Why] When changing resolution (e.g., 4K → FHD) in mirror/clone mode with certain monitors, the monitor blanks and loses connection due to an early exit in vrr_settings_require_update(). The function only checks if VRR state, fixed refresh target, or min/max refresh rate range has changed. During mode changes, if the calculated min/max refresh values remain the same even though the stream's v_total changed, the function returns early without updating vrr_params.adjust.v_total_min/max, leaving the monitor's VRR timing parameters unsynced with the new mode, causing it to blank out. [How] Explicitly adjust VRR parameters to the stream's nominal v_total when VRR is supported, but inactive. Fixes: 6d31602a9f57 ("drm/amd/display: more liberal vmin/vmax update for freesync") Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 607df8248a011524211ee34850345305a1913f9e) commit 6623c5f9fd877868fba133b4ae4dab0052e82dad Author: Jesse.Zhang Date: Fri Oct 24 16:09:25 2025 +0800 drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process Fix a potential deadlock caused by inconsistent spinlock usage between interrupt and process contexts in the userq fence driver. The issue occurs when amdgpu_userq_fence_driver_process() is called from both: - Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process() - Process context: amdgpu_eviction_fence_suspend_worker() -> amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process() In interrupt context, the spinlock was acquired without disabling interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock is acquired in process context, the kernel detects inconsistent locking since the process context acquisition would enable interrupts while holding a lock previously acquired in interrupt context. Kernel log shows: [ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3}, [ 4039.310993] {IN-HARDIRQ-W} state was registered at: [ 4039.311004] lock_acquire+0xc6/0x300 [ 4039.311018] _raw_spin_lock+0x39/0x80 [ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu] [ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu] [ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu] Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly manage interrupt state regardless of calling context. Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2) Cc: stable@vger.kernel.org commit 9f8fd538e244b87e4556833da51ddd986f50cc81 Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 4 10:42:45 2025 +0100 drm/amdgpu: jump to the correct label on failure drm_sched_entity_init wasn't called yet, so the only thing to do is to release allocated memory. This doesn't fix any bug since entity is zero allocated and drm_sched_entity_fini does nothing in this case. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Acked-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit ec49374ccb8da86b465beaf09c367f3dfd648d8f) commit 22a36e660d014925114feb09a2680bb3c2d1e279 Author: Vitaly Prosyak Date: Thu Nov 6 12:35:53 2025 -0500 drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces Certain multi-GPU configurations (especially GFX12) may hit data corruption when a DCC-compressed VRAM surface is shared across GPUs using peer-to-peer (P2P) DMA transfers. Such surfaces rely on device-local metadata and cannot be safely accessed through a remote GPU’s page tables. Attempting to import a DCC-enabled surface through P2P leads to incorrect rendering or GPU faults. This change disables P2P for DCC-enabled VRAM buffers that are contiguous and allocated on GFX12+ hardware. In these cases, the importer falls back to the standard system-memory path, avoiding invalid access to compressed surfaces. Future work could consider optional migration (VRAM→System→VRAM) if a performance regression is observed when `attach->peer2peer = false`. Tested on: - Dual RX 9700 XT (Navi4x) setup - GNOME and Wayland compositor scenarios - Confirmed no corruption after disabling P2P under these conditions v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS. v3: simplify for upsteam and fix ip version check (Alex) Suggested-by: Christian König Signed-off-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf) Cc: stable@vger.kernel.org commit 0345552a653ce5542affeb69ac5aa52177a5199b Author: Eric Dumazet Date: Sun Nov 9 16:12:15 2025 +0000 net_sched: limit try_bulk_dequeue_skb() batches After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption") I started seeing many qdisc requeues on IDPF under high TX workload. $ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1: qdisc mq 1: root Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114) backlog 1056Kb 6675p requeues 3532840114 qdisc mq 1: root Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653) backlog 781164b 4822p requeues 3537737653 This is caused by try_bulk_dequeue_skb() being only limited by BQL budget. perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script ... netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200 netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500 netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100 netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00 netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300 netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00 netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000 ... This is bad because : 1) Large batches hold one victim cpu for a very long time. 2) Driver often hit their own TX ring limit (all slots are used). 3) We call dev_requeue_skb() 4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to implement FQ or priority scheduling. 5) dequeue_skb() gets packets from q->gso_skb one skb at a time with no xmit_more support. This is causing many spinlock games between the qdisc and the device driver. Requeues were supposed to be very rare, lets keep them this way. Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as __qdisc_run() was designed to use. Fixes: 5772e9a3463b ("qdisc: bulk dequeue support for qdiscs with TCQ_F_ONETXQUEUE") Signed-off-by: Eric Dumazet Reviewed-by: Toke Høiland-Jørgensen Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20251109161215.2574081-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d58041d2c63e09a1c9083e0e9f4151e487c4e16a Author: Magnus Lindholm Date: Tue Nov 4 11:33:43 2025 +0100 MAINTAINERS: Add Magnus Lindholm as maintainer for alpha port Acked-by: John Paul Adrian Glaubitz Acked-by: Matt Turner Signed-off-by: Magnus Lindholm Signed-off-by: Matt Turner commit 7a6fa4f89e8d13b36a6259fd963aecfedf8726ba Merge: 27bcc05b886952 852b644acbce15 Author: Jakub Kicinski Date: Tue Nov 11 17:49:52 2025 -0800 Merge branch 'selftests-mptcp-join-fix-some-flaky-tests' Matthieu Baerts says: ==================== selftests: mptcp: join: fix some flaky tests When looking at the recent CI results on NIPA and MPTCP CIs, a few MPTCP Join tests are marked as unstable. Here are some fixes for that. - Patch 1: a small fix for mptcp_connect.sh, printing a note as initially intended. For >=v5.13. - Patch 2: avoid unexpected reset when closing subflows. For >= 5.13. - Patches 3-4: longer transfer when not waiting for the end. For >=5.18. - Patch 5: read all received data when expecting a reset. For >= v6.1. - Patch 6: a fix to properly kill background tasks. For >= v6.5. ==================== Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-0-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 852b644acbce1529307a4bb283752c4e77b5cda7 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:45 2025 +0100 selftests: mptcp: join: properly kill background tasks The 'run_tests' function is executed in the background, but killing its associated PID would not kill the children tasks running in the background. To properly kill all background tasks, 'kill -- -PID' could be used, but this requires kill from procps-ng. Instead, all children tasks are listed using 'ps', and 'kill' is called with all PIDs of this group. Fixes: 31ee4ad86afd ("selftests: mptcp: join: stop transfer when check is done (part 1)") Cc: stable@vger.kernel.org Fixes: 04b57c9e096a ("selftests: mptcp: join: stop transfer when check is done (part 2)") Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit ee79980f7a428ec299f6261bea4c1084dcbc9631 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:44 2025 +0100 selftests: mptcp: connect: trunc: read all recv data MPTCP Join "fastclose server" selftest is sometimes failing because the client output file doesn't have the expected size, e.g. 296B instead of 1024B. When looking at a packet trace when this happens, the server sent the expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE. It is then strange to see the client only receiving 296B, which would mean it only got a part of the second packet. The problem is then not on the networking side, but rather on the data reception side. When mptcp_connect is launched with '-f -1', it means the connection might stop before having sent everything, because a reset has been received. When this happens, the program was directly stopped. But it is also possible there are still some data to read, simply because the previous 'read' step was done with a buffer smaller than the pending data, see do_rnd_read(). In this case, it is important to read what's left in the kernel buffers before stopping without error like before. SIGPIPE is now ignored, not to quit the app before having read everything. Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 290493078b96ce2ce3e60f55c23654acb678042a Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:43 2025 +0100 selftests: mptcp: join: userspace: longer transfer In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to make the connection longer. This connection will be killed at the end, after the verifications, so making it longer doesn't change anything, apart from avoid it to end before the end of the verifications To play it safe, all userspace tests not waiting for the end of the transfer are now sharing a longer file (128KB) at slow speed. Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") Cc: stable@vger.kernel.org Fixes: b2e2248f365a ("selftests: mptcp: userspace pm create id 0 subflow") Fixes: e3b47e460b4b ("selftests: mptcp: userspace pm remove initial subflow") Fixes: b9fb176081fb ("selftests: mptcp: userspace pm send RM_ADDR for ID 0") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-4-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 6457595db9870298ee30b6d75287b8548e33fe19 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:42 2025 +0100 selftests: mptcp: join: endpoints: longer transfer In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to make the connection longer. This connection will be killed at the end, after the verifications, so making it longer doesn't change anything, apart from avoid it to end before the end of the verifications To play it safe, all endpoints tests not waiting for the end of the transfer are now sharing a longer file (128KB) at slow speed. Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case") Cc: stable@vger.kernel.org Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases") Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit aea73bae662a0e184393d6d7d0feb18d2577b9b9 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:41 2025 +0100 selftests: mptcp: join: rm: set backup flag Some of these 'remove' tests rarely fail because a subflow has been reset instead of cleanly removed. This can happen when one extra subflow which has never carried data is being closed (FIN) on one side, while the other is sending data for the first time. To avoid such subflows to be used right at the end, the backup flag has been added. With that, data will be only carried on the initial subflow. Fixes: d2c4333a801c ("selftests: mptcp: add testcases for removing addrs") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 63c643aa7b7287fdbb0167063785f89ece3f000f Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:40 2025 +0100 selftests: mptcp: connect: fix fallback note due to OoO The "fallback due to TCP OoO" was never printed because the stat_ooo_now variable was checked twice: once in the parent if-statement, and one in the child one. The second condition was then always true then, and the 'else' branch was never taken. The idea is that when there are more ACK + MP_CAPABLE than expected, the test either fails if there was no out of order packets, or a notice is printed. Fixes: 69ca3d29a755 ("mptcp: update selftest for fallback due to OoO") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 27bcc05b886952b52a3f368ffb374e6e55076d15 Merge: bb8336a5163a58 cd8dbd9ef60043 Author: Jakub Kicinski Date: Tue Nov 11 17:43:32 2025 -0800 Merge tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_conn: Fix not cleaning up PA_LINK connections - hci_event: Fix not handling PA Sync Lost event - MGMT: cancel mesh send timer when hdev removed - 6lowpan: reset link-local header on ipv6 recv path - 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - L2CAP: export l2cap_chan_hold for modules - 6lowpan: Don't hold spin lock over sleeping functions - 6lowpan: add missing l2cap_chan_lock() - btusb: reorder cleanup in btusb_disconnect to avoid UAF - btrtl: Avoid loading the config file on security chips * tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btrtl: Avoid loading the config file on security chips Bluetooth: hci_event: Fix not handling PA Sync Lost event Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections Bluetooth: 6lowpan: add missing l2cap_chan_lock() Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions Bluetooth: L2CAP: export l2cap_chan_hold for modules Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Bluetooth: MGMT: cancel mesh send timer when hdev removed ==================== Link: https://patch.msgid.link/20251111141357.1983153-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit bb8336a5163a5839476f27ed1ad69df4a19e13ca Author: Kriish Sharma Date: Mon Nov 10 18:25:45 2025 +0000 ethtool: fix incorrect kernel-doc style comment in ethtool.h Building documentation produced the following warning: WARNING: ./include/linux/ethtool.h:495 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * IEEE 802.3ck/df defines 16 bins for FEC histogram plus one more for This comment was not intended to be parsed as kernel-doc, so replace the '/**' with '/*' to silence the warning and align with normal comment style in header files. No functional changes. Signed-off-by: Kriish Sharma Link: https://patch.msgid.link/20251110182545.2112596-1-kriish.sharma2006@gmail.com Signed-off-by: Jakub Kicinski commit 3aa385a9c75c09b59dcab2ff76423439d23673ab Author: Linus Walleij Date: Mon Nov 3 10:36:18 2025 +0100 iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts: Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4 This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why. Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not. Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit fdf302e6bea1822a9144a0cc2e8e17527e746162 Author: Sami Tolvanen Date: Mon Nov 10 14:19:13 2025 +0100 gendwarfksyms: Skip files with no exports Starting with Rust 1.91.0 (released 2025-10-30), in upstream commit ab91a63d403b ("Ignore intrinsic calls in cross-crate-inlining cost model") [1][2], `bindings.o` stops containing DWARF debug information because the `Default` implementations contained `write_bytes()` calls which are now ignored in that cost model (note that `CLIPPY=1` does not reproduce it). This means `gendwarfksyms` complains: RUSTC L rust/bindings.o error: gendwarfksyms: process_module: dwarf_get_units failed: no debugging information? There are several alternatives that would work here: conditionally skipping in the cases needed (but that is subtle and brittle), forcing DWARF generation with e.g. a dummy `static` (ugly and we may need to do it in several crates), skipping the call to the tool in the Kbuild command when there are no exports (fine) or teaching the tool to do so itself (simple and clean). Thus do the last one: don't attempt to process files if we have no symbol versions to calculate. [ I used the commit log of my patch linked below since it explained the root issue and expanded it a bit more to summarize the alternatives. - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.17.y. Reported-by: Haiyue Wang Closes: https://lore.kernel.org/rust-for-linux/b8c1c73d-bf8b-4bf2-beb1-84ffdcd60547@163.com/ Suggested-by: Miguel Ojeda Link: https://lore.kernel.org/rust-for-linux/CANiq72nKC5r24VHAp9oUPR1HVPqT+=0ab9N0w6GqTF-kJOeiSw@mail.gmail.com/ Link: https://github.com/rust-lang/rust/commit/ab91a63d403b0105cacd72809cd292a72984ed99 [1] Link: https://github.com/rust-lang/rust/pull/145910 [2] Signed-off-by: Sami Tolvanen Tested-by: Haiyue Wang Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251110131913.1789896-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 24172e0d79900908cf5ebf366600616d29c9b417 Merge: 8341374f67f6e6 8e8ae788964aa2 Author: Linus Torvalds Date: Tue Nov 11 10:31:17 2025 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's more here than I would ideally like at this stage, but there's been a steady trickle of fixes and some of them took a few rounds of review. The bulk of the changes are fixing some fallout from the recent BBM level two support which allows the linear map to be split from block to page mappings at runtime, but inadvertently led to sleeping in atomic context on some paths where the linear map was already mapped with page granularity. The fix is simply to avoid splitting in those cases but the implementation of that is a little involved. The other interesting fix is addressing a catastophic performance issue with our per-cpu atomics discovered by Paul in the SRCU locking code but which took some interactions with the hardware folks to resolve. Summary: - Avoid sleeping in atomic context when changing linear map permissions for DEBUG_PAGEALLOC or KFENCE - Rework printing of Spectre mitigation status to avoid hardlockup when enabling per-task mitigations on the context-switch path - Reject kernel modules when instruction patching fails either due to the DWARF-based SCS patching or because of an alternatives callback residing outside of the core kernel text - Propagate error when updating kernel memory permissions in kprobes - Drop pointless, incorrect message when enabling the ACPI SPCR console - Use value-returning LSE instructions for per-cpu atomics to reduce latency in SRCU locking routines" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Reject modules with internal alternative callbacks arm64: Fail module loading if dynamic SCS patching fails arm64: proton-pack: Fix hard lockup due to print in scheduler context arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY arm64: mm: Tidy up force_pte_mapping() arm64: mm: Optimize range_split_to_ptes() arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: kprobes: check the return value of set_memory_rox() arm64: acpi: Drop message logging SPCR default console Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" arm64: Use load LSE atomics for the non-return per-CPU atomic operations commit 8341374f67f6e6350de98baaf5b05bca88f4ad81 Merge: 537d196186e0a0 c367af440e03eb Author: Linus Torvalds Date: Tue Nov 11 10:13:17 2025 -0800 Merge tag 'for-6.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix new inode name tracking in tree-log - fix conventional zone and stripe calculations in zoned mode - fix bio reference counts on error paths in relocation and scrub * tag 'for-6.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: release root after error in data_reloc_print_warning_inode() btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() btrfs: do not update last_log_commit when logging inode due to a new name btrfs: zoned: fix stripe width calculation btrfs: zoned: fix conventional zone capacity calculation commit 537d196186e0a0ce28e494ca1881885accc35a12 Merge: 4427259cc7f757 b05addf6f0596e Author: Linus Torvalds Date: Tue Nov 11 09:49:56 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "26 hotfixes. 22(!) are cc:stable, 22 are MM. - address some Kexec Handover issues (Pasha Tatashin) - fix handling of large folios which are mapped outside i_size (Kiryl Shutsemau) - fix some DAMON time issues on 32-bit machines (Quanmin Yan) Plus the usual shower of singletons" * tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (26 commits) kho: warn and exit when unpreserved page wasn't preserved kho: fix unpreservation of higher-order vmalloc preservations kho: fix out-of-bounds access of vmalloc chunk MAINTAINERS: add Chris and Kairui as the swap maintainer mm/secretmem: fix use-after-free race in fault handler mm/huge_memory: initialise the tags of the huge zero folio nilfs2: avoid having an active sc_timer before freeing sci scripts/decode_stacktrace.sh: fix build ID and PC source parsing mm/damon/sysfs: change next_update_jiffies to a global variable mm/damon/stat: change last_refresh_jiffies to a global variable maple_tree: fix tracepoint string pointers codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext mm/mremap: honour writable bit in mremap pte batching gcov: add support for GCC 15 mm/mm_init: fix hash table order logging in alloc_large_system_hash() mm/truncate: unmap large folio on split failure mm/memory: do not populate page table entries beyond i_size fs/proc: fix uaf in proc_readdir_de() mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order ksm: use range-walk function to jump over holes in scan_get_next_rmap_item ... commit d93a89684dce949c2ea817b6f07feee9a45241a7 Author: Stefan Metzmacher Date: Mon Nov 10 16:23:52 2025 +0100 smb: client: let smbd_disconnect_rdma_connection() turn CREATED into DISCONNECTED When smbd_disconnect_rdma_connection() turns SMBDIRECT_SOCKET_CREATED into SMBDIRECT_SOCKET_ERROR, we'll have the situation that smbd_disconnect_rdma_work() will set SMBDIRECT_SOCKET_DISCONNECTING and call rdma_disconnect(), which likely fails as we never reached the RDMA_CM_EVENT_ESTABLISHED. it means that wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED) in smbd_destroy() will hang forever in SMBDIRECT_SOCKET_DISCONNECTING never reaching SMBDIRECT_SOCKET_DISCONNECTED. So we directly go from SMBDIRECT_SOCKET_CREATED to SMBDIRECT_SOCKET_DISCONNECTED. Fixes: ffbfc73e84eb ("smb: client: let smbd_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR...") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 Author: Haein Lee Date: Wed Nov 12 00:37:54 2025 +0900 ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor. This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference. This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor. Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support") Signed-off-by: Haein Lee Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com Signed-off-by: Takashi Iwai commit 739f04f4a46237536aff07ff223c231da53ed8ce Author: Shawn Lin Date: Tue Nov 4 11:51:23 2025 +0800 mmc: dw_mmc-rockchip: Fix wrong internal phase calculate ciu clock is 2 times of io clock, but the sample clk used is derived from io clock provided to the card. So we should use io clock to calculate the phase. Fixes: 59903441f5e4 ("mmc: dw_mmc-rockchip: Add internal phase support") Signed-off-by: Shawn Lin Acked-by: Heiko Stuebner Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 9e805625218b70d865fcee2105dbf835d473c074 Author: Rakuram Eswaran Date: Thu Oct 23 20:24:32 2025 +0530 mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs This patch refactors pxamci_probe() to use devm-managed resource allocation (e.g. devm_dma_request_chan) and dev_err_probe() for improved readability and automatic cleanup on probe failure. It also removes redundant NULL assignments and manual resource release logic from pxamci_probe(), and eliminates the corresponding release calls from pxamci_remove(). Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510041841.pRlunIfl-lkp@intel.com/ Fixes: 58c40f3faf742c ("mmc: pxamci: Use devm_mmc_alloc_host() helper") Suggested-by: Uwe Kleine-König Signed-off-by: Rakuram Eswaran Reviewed-by: Khalid Aziz Acked-by: Uwe Kleine-König Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c42af83c59b65d01c0f7a074e450bbbb43b22f0d Author: Akinobu Mita Date: Tue Nov 11 10:00:10 2025 +0900 memblock: fix memblock_estimated_nr_free_pages() for soft-reserved memory memblock_estimated_nr_free_pages() returns the difference between the total size of the "memory" memblock type and the "reserved" memblock type. The "soft-reserved" memory regions are added to the "reserved" memblock type, but not to the "memory" memblock type. Therefore, memblock_estimated_nr_free_pages() may return a smaller value than expected, or if it underflows, an extremely large value. /proc/sys/kernel/threads-max is determined by the value of memblock_estimated_nr_free_pages(). This issue was discovered on machines with CXL memory because kernel.threads-max was either smaller than expected or extremely large for the installed DRAM size. This fixes the issue by replacing memblock_reserved_size() with memblock_reserved_kern_size() that tells how much memory was reserved from the actual RAM. Suggested-by: Mike Rapoport Signed-off-by: Akinobu Mita Link: https://patch.msgid.link/20251111010010.7800-1-akinobu.mita@gmail.com Signed-off-by: Mike Rapoport (Microsoft) commit ed6612165b74f09db00ef0abaf9831895ab28b7f Author: Yiqi Sun Date: Tue Nov 11 15:05:39 2025 +0800 smb: fix invalid username check in smb3_fs_context_parse_param() Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid. Fix the comparison in if statement. Signed-off-by: Yiqi Sun Signed-off-by: Steve French commit 55286b1e1bf4ce55f61ad2816d4ff8a7861a8cbb Author: Stefan Metzmacher Date: Mon Nov 10 16:24:20 2025 +0100 smb: server: let smb_direct_disconnect_rdma_connection() turn CREATED into DISCONNECTED When smb_direct_disconnect_rdma_connection() turns SMBDIRECT_SOCKET_CREATED into SMBDIRECT_SOCKET_ERROR, we'll have the situation that smb_direct_disconnect_rdma_work() will set SMBDIRECT_SOCKET_DISCONNECTING and call rdma_disconnect(), which likely fails as we never reached the RDMA_CM_EVENT_ESTABLISHED. it means that wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED) in free_transport() will hang forever in SMBDIRECT_SOCKET_DISCONNECTING never reaching SMBDIRECT_SOCKET_DISCONNECTED. So we directly go from SMBDIRECT_SOCKET_CREATED to SMBDIRECT_SOCKET_DISCONNECTED. Fixes: b3fd52a0d85c ("smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR...") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e5eba42f01340f73888dfe560be2806057c25913 Author: Akiva Goldberger Date: Sun Nov 9 11:49:03 2025 +0200 mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, allowing FW to send interrupts to polling-only CQs in certain corner cases. These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception. Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause. This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values. Callers of mlx5_core_create_cq are responsible for changing the completion function and arming the CQ per their needs. Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") Signed-off-by: Akiva Goldberger Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Acked-by: Leon Romanovsky Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb Author: Max Chou Date: Wed Nov 5 20:02:04 2025 +0800 Bluetooth: btrtl: Avoid loading the config file on security chips For chips with security enabled, it's only possible to load firmware with a valid signature pattern. If key_id is not zero, it indicates a security chip, and the driver will not load the config file. - Example log for a security chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 1 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 Bluetooth: hci0: RTL: fw version 0x41c0c905 - Example log for a normal chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 0 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 Bluetooth: hci0: RTL: fw version 0x41c0c905 Tested-by: Hilda Wu Signed-off-by: Nial Ni Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit ed6b5632e0acc247cf483da1ba40201258af46ff Merge: 02e9578c3e47f2 9fcc2b6c10523f Author: Paolo Abeni Date: Tue Nov 11 15:05:45 2025 +0100 Merge branch 'mlx5e-misc-fixes-2025-11-09' Tariq Toukan says: ==================== mlx5e misc fixes 2025-11-09 This patchset provides misc bug fixes from the team to the mlx5 Eth driver. ==================== Link: https://patch.msgid.link/1762681073-1084058-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e Author: Gal Pressman Date: Sun Nov 9 11:37:53 2025 +0200 net/mlx5e: Fix potentially misleading debug message Change the debug message to print the correct units instead of always assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units. Fixes: 5da8bc3effb6 ("net/mlx5e: DCBNL, Add debug messages log") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-6-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e Author: Gal Pressman Date: Sun Nov 9 11:37:52 2025 +0200 net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit a7bf4d5063c7837096aab2853224eb23628514d9 Author: Gal Pressman Date: Sun Nov 9 11:37:51 2025 +0200 net/mlx5e: Fix maxrate wraparound in threshold between units The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps. For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field. Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 2dc768c05217e667f987907a3404926e7ba89ff3 Author: Cosmin Ratiu Date: Sun Nov 9 11:37:50 2025 +0200 net/mlx5e: Trim the length of the num_doorbell error When trying to set num_doorbells to a value greater than the max number of channels, the error message was going over the netlink limit of 80 chars, truncating the most important part of the message, the number of channels. Fix that by trimming the length a bit. Fixes: 11bbcfb7668c ("net/mlx5e: Use the 'num_doorbells' devlink param") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 0bcd5b3b50cc1fcbf775479322cc37c15d35a489 Author: Carolina Jubran Date: Sun Nov 9 11:37:49 2025 +0200 net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() Assign the return value of mlx5_eswitch_block_mode() to 'err' before checking it to avoid returning an uninitialized error code. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510271649.uwsIxD6O-lkp@intel.com/ Closes: http://lore.kernel.org/linux-rdma/aPIEK4rLB586FdDt@stanley.mountain/ Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 02e9578c3e47f2e1b8a12c66b42fe2f287c7f66d Merge: 60e6489f8e3b08 ce50039be49eea Author: Paolo Abeni Date: Tue Nov 11 15:00:10 2025 +0100 Merge branch 'net-sched-initialize-struct-tc_ife-to-fix-kernel-infoleak' Ranganath says: ==================== net: sched: initialize struct tc_ife to fix kernel-infoleak This series addresses the uninitialization of the struct which has 2 bytes of padding. And copying this uninitialized data to userspace can leak info from kernel memory. This series ensures all members and padding are cleared prior to begin copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. v3: https://lore.kernel.org/lkml/20251106195635.2438-1-vnranganath.20@gmail.com/#t v2: https://lore.kernel.org/r/20251101-infoleak-v2-0-01a501d41c09@gmail.com v1: https://lore.kernel.org/r/20251031-infoleak-v1-1-9f7250ee33aa@gmail.com Signed-off-by: Ranganath V N Acked-by: Cong Wang ==================== Link: https://patch.msgid.link/20251109091336.9277-1-vnranganath.20@gmail.com Signed-off-by: Paolo Abeni commit ce50039be49eea9b4cd8873ca6eccded1b4a130a Author: Ranganath V N Date: Sun Nov 9 14:43:36 2025 +0530 net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: ef6980b6becb ("introduce IFE action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni commit 62b656e43eaeae445a39cd8021a4f47065af4389 Author: Ranganath V N Date: Sun Nov 9 14:43:35 2025 +0530 net: sched: act_connmark: initialize struct tc_ife to fix kernel leak In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: 22a5dc0e5e3e ("net: sched: Introduce connmark action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-2-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni commit 281326be67252ac5794d1383f67526606b1d6b13 Author: Niravkumar L Rabara Date: Tue Nov 11 16:13:33 2025 +0800 EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection The current single-bit error injection mechanism flips bits directly in ECC RAM by performing write and read operations. When the ECC RAM is actively used by the Ethernet or USB controller, this approach sometimes trigger a false double-bit error. Switch both Ethernet and USB EDAC devices to use the INTTEST register (altr_edac_a10_device_inject_fops) for single-bit error injection, similar to the existing double-bit error injection method. Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support") Signed-off-by: Niravkumar L Rabara Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com commit 485e0626e58768f3c53ba61ab9e09d6b60a455f4 Author: Luiz Augusto von Dentz Date: Thu Nov 6 13:05:35 2025 -0500 Bluetooth: hci_event: Fix not handling PA Sync Lost event This handles PA Sync Lost event which previously was assumed to be handled with BIG Sync Lost but their lifetime are not the same thus why there are 2 different events to inform when each sync is lost. Fixes: b2a5f2e1c127 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event") Signed-off-by: Luiz Augusto von Dentz commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 Author: Niravkumar L Rabara Date: Tue Nov 11 16:08:01 2025 +0800 EDAC/altera: Handle OCRAM ECC enable after warm reset The OCRAM ECC is always enabled either by the BootROM or by the Secure Device Manager (SDM) during a power-on reset on SoCFPGA. However, during a warm reset, the OCRAM content is retained to preserve data, while the control and status registers are reset to their default values. As a result, ECC must be explicitly re-enabled after a warm reset. Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support") Signed-off-by: Niravkumar L Rabara Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com commit 60e6489f8e3b086bd1130ad4450a2c112e863791 Author: Kuniyuki Iwashima Date: Sun Nov 9 02:52:22 2025 +0000 af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments. Fixes: ad081928a8b0 ("af_unix: Avoid Tarjan's algorithm if unnecessary.") Reported-by: Quang Le Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit 0f559cd91e37b7978e4198ca2fbf7eb95df11361 Author: Marc Zyngier Date: Mon Nov 10 17:30:10 2025 +0000 KVM: arm64: Finalize ID registers only once per VM Owing to the ID registers being global to the VM, there is no point in computing them more than once. However, recent changes making use of kvm_set_vm_id_reg() outlined that we repeatedly hammer the ID registers when we shouldn't. Gate the ID reg update on the VM having never run. Fixes: 50e7cce81b9b2 ("KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip") Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Closes: https://lore.kernel.org/r/aRHf6x5umkTYhYJ3@finisterre.sirena.org.uk Reported-by: Mark Brown Tested-by: Mark Brown Link: https://patch.msgid.link/20251110173010.1918424-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 09782e72eec451fa14d327595f86cdc338ebe53c Author: Aleksander Jan Bajkowski Date: Fri Oct 17 20:01:19 2025 +0200 mips: dts: econet: fix EN751221 core type In fact, it is a multi-threaded MIPS34Kc, not a single-threaded MIPS24Kc. Fixes: 0ec488700972 ("mips: dts: Add EcoNet DTS with EN751221 and SmartFiber XP8421-B board") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit ebd729fef31620e0bf74cbf8a4c7fda73a2a4e7e Author: Maciej W. Rozycki Date: Mon Oct 20 02:11:49 2025 +0100 MIPS: Malta: Fix !EVA SOC-it PCI MMIO Fix a regression that has caused accesses to the PCI MMIO window to complete unclaimed in non-EVA configurations with the SOC-it family of system controllers, preventing PCI devices from working that use MMIO. In the non-EVA case PHYS_OFFSET is set to 0, meaning that PCI_BAR0 is set with an empty mask (and PCI_HEAD4 matches addresses starting from 0 accordingly). Consequently all addresses are matched for incoming DMA accesses from PCI. This seems to confuse the system controller's logic and outgoing bus cycles targeting the PCI MMIO window seem not to make it to the intended devices. This happens as well when a wider mask is used with PCI_BAR0, such as 0x80000000 or 0xe0000000, that makes addresses match that overlap with the PCI MMIO window, which starts at 0x10000000 in our configuration. Set the mask in PCI_BAR0 to 0xf0000000 for non-EVA then, covering the non-EVA maximum 256 MiB of RAM, which is what YAMON does and which used to work correctly up to the offending commit. Set PCI_P2SCMSKL to match PCI_BAR0 as required by the system controller's specification, and match PCI_P2SCMAPL to PCI_HEAD4 for identity mapping. Verified with: Core board type/revision = 0x0d (Core74K) / 0x01 System controller/revision = MIPS SOC-it 101 OCP / 1.3 SDR-FW-4:1 Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x1c Processor ID/revision = 0x97 (MIPS 74Kf) / 0x4c for non-EVA and with: Core board type/revision = 0x0c (CoreFPGA-5) / 0x00 System controller/revision = MIPS ROC-it2 / 0.0 FW-1:1 (CLK_unknown) GIC Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x00 Processor ID/revision = 0xa0 (MIPS interAptiv UP) / 0x20 for EVA/non-EVA, fixing: defxx 0000:00:12.0: assign IRQ: got 10 defxx: v1.12 2021/03/10 Lawrence V. Stefani and others 0000:00:12.0: Could not read adapter factory MAC address! vs: defxx 0000:00:12.0: assign IRQ: got 10 defxx: v1.12 2021/03/10 Lawrence V. Stefani and others 0000:00:12.0: DEFPA at MMIO addr = 0x10142000, IRQ = 10, Hardware addr = 00-00-f8-xx-xx-xx 0000:00:12.0: registered as fddi0 for non-EVA and causing no change for EVA. Signed-off-by: Maciej W. Rozycki Fixes: 422dd256642b ("MIPS: Malta: Allow PCI devices DMA to lower 2GB physical") Cc: stable@vger.kernel.org # v4.9+ Signed-off-by: Thomas Bogendoerfer commit c4e1ac09ee1c750890e36cb1f841f25518f23589 Author: Pawel Dembicki Date: Tue Nov 11 11:07:29 2025 +0100 wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing Some Marvell AP firmware used with mwl8k misbehaves when beacon frames do not contain a WLAN_EID_DS_PARAMS element with the current channel. It was reported on OpenWrt Github issues [0]. When hostapd/mac80211 omits DSSS Parameter Set from the beacon (which is valid on some bands), the firmware stops transmitting sane frames and RX status starts reporting bogus channel information. This makes AP mode unusable. Newer Marvell drivers (mwlwifi [1]) hard-code DSSS Parameter Set into AP beacons for all chips, which suggests this is a firmware requirement rather than a mwl8k-specific quirk. Mirror that behaviour in mwl8k: when setting the beacon, check if WLAN_EID_DS_PARAMS is present, and if not, extend the beacon and inject a DSSS Parameter Set element, using the current channel from hw->conf.chandef.chan. Tested on Linksys EA4500 (88W8366). [0] https://github.com/openwrt/openwrt/issues/19088 [1] https://github.com/kaloz/mwlwifi/blob/db97edf20fadea2617805006f5230665fadc6a8c/hif/fwcmd.c#L675 Fixes: b64fe619e371 ("mwl8k: basic AP interface support") Tested-by: Antony Kolitsos Signed-off-by: Pawel Dembicki Link: https://patch.msgid.link/20251111100733.2825970-3-paweldembicki@gmail.com Signed-off-by: Johannes Berg commit 1b03346314b791ad966d3c6d59253328226a2b2d Author: Maarten Zanders Date: Fri Oct 24 16:21:06 2025 +0200 ARM: dts: nxp: imx6ul: correct SAI3 interrupt line The i.MX6UL reference manual lists two possible interrupt lines for SAI3 (56 and 57, offset +32). The current device tree entry uses the first one (24), which prevents IRQs from being handled properly. Use the second interrupt line (25), which does allow interrupts to work as expected. Fixes: 36e2edf6ac07 ("ARM: dts: imx6ul: add sai support") Signed-off-by: Maarten Zanders Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit eaa7ce66c3e2ccda035022b5e8af09caabecd635 Author: Ilan Peer Date: Mon Nov 10 14:01:54 2025 +0200 wifi: mac80211_hwsim: Fix possible NULL dereference The 'vif' pointer in the Tx information might be NULL, e.g., in case of injected frames etc. and is not checked in all paths. Fix it. While at it, also directly use the local 'vif' pointer. Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Ilan Peer Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aNJUlyIiSTW9zZdr@stanley.mountain Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110140128.ec00ae795a32.I9c65659b52434189d8b2ba06710d482669a3887a@changeid Signed-off-by: Johannes Berg commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 Author: Benjamin Berg Date: Mon Nov 10 14:26:18 2025 +0200 wifi: mac80211: skip rate verification for not captured PSDUs If for example the sniffer did not follow any AIDs in an MU frame, then some of the information may not be filled in or is even expected to be invalid. As an example, in that case it is expected that Nss is zero. Fixes: 2ff5e52e7836 ("radiotap: add 0-length PSDU "not captured" type") Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110142554.83a2858ee15b.I9f78ce7984872f474722f9278691ae16378f0a3e@changeid Signed-off-by: Johannes Berg commit 2027e3bcbf00e24560bc9d2a14f62b49364a9236 Merge: a9da90e618cd06 9065b968752334 Author: Johannes Berg Date: Tue Nov 11 09:18:06 2025 +0100 Merge tag 'ath-current-20251110' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc6 Fix an ath11k transmit status reporting issue. This issue has always been present, but not reported until recently. Bringing this through the current release since there is now a userspace entity that wants to leverage this. ================== Signed-off-by: Johannes Berg commit 5b6677d6451bbbac3b6ab93fae6506b59e2c19bd Author: Frank Li Date: Wed Oct 22 12:50:22 2025 -0400 arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos Swap interrupt numbers of eqos because the below commit just swap interrupt-names and missed swap interrupts also. The driver (drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c) use interrupt-names to get irq numbers. Fixes: f29c19a6e488 ("arm64: dts: imx8dxl-ss-conn: Fix Ethernet interrupt-names order") Signed-off-by: Frank Li Tested-by: Alexander Dahl Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit f10a788e4b6a0ebe8629177894ca779b2dc6203d Author: Frank Li Date: Wed Oct 22 12:50:21 2025 -0400 arm64: dts: imx8dxl: Correct pcie-ep interrupt number Correct i.MX8DXL's pcie-ep interrupt number. Fixes: d03743c5659a9 ("arm64: dts: imx8q: add PCIe EP for i.MX8QM and i.MX8QXP") Signed-off-by: Frank Li Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit 8c0726e861f3920bac958d76cf134b5a3aa14ce4 Merge: e6ca8f533ed411 236682db3b6fe7 Author: Jakub Kicinski Date: Mon Nov 10 18:34:46 2025 -0800 Merge branch 'net-netpoll-fix-memory-leak-and-add-comprehensive-selftests' Breno Leitao says: ==================== net: netpoll: fix memory leak and add comprehensive selftests Fix a memory leak in netpoll and introduce netconsole selftests that expose the issue when running with kmemleak detection enabled. This patchset includes a selftest for netpoll with multiple concurrent users (netconsole + bonding), which simulates the scenario from test[1] that originally demonstrated the issue allegedly fixed by commit efa95b01da18 ("netpoll: fix use after free") - a commit that is now being reverted. Sending this to "net" branch because this is a fix, and the selftest might help with the backports validation. Link: https://lore.kernel.org/lkml/96b940137a50e5c387687bb4f57de8b0435a653f.1404857349.git.decot@googlers.com/ [1] ==================== Link: https://patch.msgid.link/20251107-netconsole_torture-v10-0-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 236682db3b6fe71cad76ac5e920ea4c14a33178e Author: Breno Leitao Date: Fri Nov 7 06:03:40 2025 -0800 selftest: netcons: add test for netconsole over bonded interfaces This patch adds a selftest that verifies netconsole functionality over bonded network interfaces using netdevsim. It sets up two bonded interfaces acting as transmit (TX) and receive (RX) ends, placed in separate network namespaces. The test sends kernel log messages and verifies that they are properly received on the bonded RX interfaces with both IPv4 and IPv6, and using basic and extended netconsole formats. This patchset aims to test a long-standing netpoll subsystem where netpoll has multiple users. (in this case netconsole and bonding). A similar selftest has been discussed in [1] and [2]. This test also tries to enable bonding and netpoll in different order, just to guarantee that all the possibilities are exercised. Link: https://lore.kernel.org/all/20250905-netconsole_torture-v3-0-875c7febd316@debian.org/ [1] Link: https://lore.kernel.org/lkml/96b940137a50e5c387687bb4f57de8b0435a653f.1404857349.git.decot@googlers.com/ [2] Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-4-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 6701896eb90998ff16338f199144bd9deefb79ba Author: Breno Leitao Date: Fri Nov 7 06:03:39 2025 -0800 selftest: netcons: create a torture test Create a netconsole test that puts a lot of pressure on the netconsole list manipulation. Do it by creating dynamic targets and deleting targets while messages are being sent. Also put interface down while the messages are being sent, as creating parallel targets. The code launches three background jobs on distinct schedules: * Toggle netcons target every 30 iterations * create and delete random_target every 50 iterations * toggle iface every 70 iterations This creates multiple concurrency sources that interact with netconsole states. This is good practice to simulate stress, and exercise netpoll and netconsole locks. This test already found an issue as reported in [1] Link: https://lore.kernel.org/all/20250901-netpoll_memleak-v1-1-34a181977dfc@debian.org/ [1] Signed-off-by: Breno Leitao Reviewed-by: Andre Carvalho Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-3-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 39acc6a95eefcf814efa226d8813f89e7e03496e Author: Breno Leitao Date: Fri Nov 7 06:03:38 2025 -0800 selftest: netcons: refactor target creation Extract the netconsole target creation from create_dynamic_target(), by moving it from create_dynamic_target() into a new helper function. This enables other tests to use the creation of netconsole targets with arbitrary parameters and no sleep. The new helper will be utilized by forthcoming torture-type selftests that require dynamic target management. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-2-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 49c8d2c1f94cc2f4d1a108530d7ba52614b874c2 Author: Breno Leitao Date: Fri Nov 7 06:03:37 2025 -0800 net: netpoll: fix incorrect refcount handling causing incorrect cleanup commit efa95b01da18 ("netpoll: fix use after free") incorrectly ignored the refcount and prematurely set dev->npinfo to NULL during netpoll cleanup, leading to improper behavior and memory leaks. Scenario causing lack of proper cleanup: 1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is allocated, and refcnt = 1 - Keep in mind that npinfo is shared among all netpoll instances. In this case, there is just one. 2) Another netpoll is also associated with the same NIC and npinfo->refcnt += 1. - Now dev->npinfo->refcnt = 2; - There is just one npinfo associated to the netdev. 3) When the first netpolls goes to clean up: - The first cleanup succeeds and clears np->dev->npinfo, ignoring refcnt. - It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);` - Set dev->npinfo = NULL, without proper cleanup - No ->ndo_netpoll_cleanup() is either called 4) Now the second target tries to clean up - The second cleanup fails because np->dev->npinfo is already NULL. * In this case, ops->ndo_netpoll_cleanup() was never called, and the skb pool is not cleaned as well (for the second netpoll instance) - This leaks npinfo and skbpool skbs, which is clearly reported by kmemleak. Revert commit efa95b01da18 ("netpoll: fix use after free") and adds clarifying comments emphasizing that npinfo cleanup should only happen once the refcount reaches zero, ensuring stable and correct netpoll behavior. Cc: # 3.17.x Cc: Jay Vosburgh Fixes: efa95b01da18 ("netpoll: fix use after free") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-1-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit e6ca8f533ed41129fcf052297718f417f021cc7d Author: Buday Csaba Date: Sat Nov 8 07:49:22 2025 +0100 net: mdio: fix resource leak in mdiobus_register_device() Fix a possible leak in mdiobus_register_device() when both a reset-gpio and a reset-controller are present. Clean up the already claimed reset-gpio, when the registration of the reset-controller fails, so when an error code is returned, the device retains its state before the registration attempt. Link: https://lore.kernel.org/all/20251106144603.39053c81@kernel.org/ Fixes: 71dd6c0dff51 ("net: phy: add support for reset-controller") Signed-off-by: Buday Csaba Link: https://patch.msgid.link/4b419377f8dd7d2f63f919d0f74a336c734f8fff.1762584481.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 0725e6afb55128be21a2ca36e9674f573ccec173 Author: Kuniyuki Iwashima Date: Fri Nov 7 06:40:25 2025 +0000 tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6088: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kfree+0x195/0x550 mm/slub.c:4894 tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166 unregister_netdevice_many net/core/dev.c:12229 [inline] unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073 unregister_netdevice include/linux/netdevice.h:3385 [inline] __tun_detach+0xe4d/0x1620 drivers/net/tun.c:621 tun_detach drivers/net/tun.c:637 [inline] tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433 __fput+0x458/0xa80 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated") Reported-by: syzbot+d7dad7fd4b3921104957@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690c323a.050a0220.baf87.007f.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107064038.2361188-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 142b02cc48dff2c0a33b1fa509902f3dc3d181b2 Merge: 3072f00bba7640 d4b00d132d7cb7 Author: Jakub Kicinski Date: Mon Nov 10 18:00:44 2025 -0800 Merge branch 'fix-iet-verification-implementation-for-cpsw-driver' Aksh Garg says: ==================== Fix IET verification implementation for CPSW driver The CPSW module supports Intersperse Express Traffic (IET) and allows the MAC layer to verify whether the peer supports IET through its MAC merge sublayer, by sending a verification packet and waiting for its response until the timeout. As defined in IEEE 802.3 Clause 99, the verification process involves up to 3 verification attempts to establish support. This patch series fixes issues in the implementation of this IET verification process. ==================== Link: https://patch.msgid.link/20251106092305.1437347-1-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit d4b00d132d7cb70a74bc039c91c1d6120943c71b Author: Aksh Garg Date: Thu Nov 6 14:53:05 2025 +0530 net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism The am65_cpsw_iet_verify_wait() function attempts verification 20 times, toggling the AM65_CPSW_PN_IET_MAC_LINKFAIL bit in each iteration. When the LINKFAIL bit transitions from 1 to 0, the MAC merge layer initiates the verification process and waits for the timeout configured in MAC_VERIFY_CNT before automatically retransmitting. The MAC_VERIFY_CNT register is configured according to the user-defined verify/response timeout in am65_cpsw_iet_set_verify_timeout_count(). As per IEEE 802.3 Clause 99, the hardware performs this automatic retry up to 3 times. Current implementation toggles LINKFAIL after the user-configured verify/response timeout in each iteration, forcing the hardware to restart verification instead of respecting the MAC_VERIFY_CNT timeout. This bypasses the hardware's automatic retry mechanism. Fix this by moving the LINKFAIL bit toggle outside the retry loop and reducing the retry count from 20 to 3. The software now only monitors the status register while the hardware autonomously handles the 3 verification attempts at proper MAC_VERIFY_CNT intervals. Fixes: 49a2eb9068246 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support") Signed-off-by: Aksh Garg Link: https://patch.msgid.link/20251106092305.1437347-3-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit 49b3916465176a5abcb29a0e464825f553d55d58 Author: Aksh Garg Date: Thu Nov 6 14:53:04 2025 +0530 net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout The CPSW module uses the MAC_VERIFY_CNT bit field in the CPSW_PN_IET_VERIFY_REG_k register to set the verify/response timeout count. This register specifies the number of clock cycles to wait before resending a verify packet if the verification fails. The verify/response timeout count, as being set by the function am65_cpsw_iet_set_verify_timeout_count() is hardcoded for 125MHz clock frequency, which varies based on PHY mode and link speed. The respective clock frequencies are as follows: - RGMII mode: * 1000 Mbps: 125 MHz * 100 Mbps: 25 MHz * 10 Mbps: 2.5 MHz - QSGMII/SGMII mode: 125 MHz (all speeds) Fix this by adding logic to calculate the correct timeout counts based on the actual PHY interface mode and link speed. Fixes: 49a2eb9068246 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support") Signed-off-by: Aksh Garg Link: https://patch.msgid.link/20251106092305.1437347-2-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit 3072f00bba764082fa41b3c3a2a7b013335353d2 Author: Zilin Guan Date: Thu Nov 6 14:45:11 2025 +0000 net/handshake: Fix memory leak in tls_handshake_accept() In tls_handshake_accept(), a netlink message is allocated using genlmsg_new(). In the error handling path, genlmsg_cancel() is called to cancel the message construction, but the message itself is not freed. This leads to a memory leak. Fix this by calling nlmsg_free() in the error path after genlmsg_cancel() to release the allocated memory. Fixes: 2fd5532044a89 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake") Signed-off-by: Zilin Guan Reviewed-by: Chuck Lever Link: https://patch.msgid.link/20251106144511.3859535-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 Author: D. Wythe Date: Fri Nov 7 10:40:29 2025 +0800 net/smc: fix mismatch between CLC header and proposal The current CLC proposal message construction uses a mix of `ini->smc_type_v1/v2` and `pclc_base->hdr.typev1/v2` to decide whether to include optional extensions (IPv6 prefix extension for v1, and v2 extension). This leads to a critical inconsistency: when `smc_clc_prfx_set()` fails - for example, in IPv6-only environments with only link-local addresses, or when the local IP address and the outgoing interface’s network address are not in the same subnet. As a result, the proposal message is assembled using the stale `ini->smc_type_v1` value—causing the IPv6 prefix extension to be included even though the header indicates v1 is not supported. The peer then receives a malformed CLC proposal where the header type does not match the payload, and immediately resets the connection. The fix ensures consistency between the CLC header flags and the actual payload by synchronizing `ini->smc_type_v1` with `pclc_base->hdr.typev1` when prefix setup fails. Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal") Signed-off-by: D. Wythe Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/20251107024029.88753-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 2554559aba883803475e4ca4fae22eaad6d33d86 Author: Nicolas Dichtel Date: Thu Nov 6 19:02:52 2025 +0100 bonding: fix mii_status when slave is down netif_carrier_ok() doesn't check if the slave is up. Before the below commit, netif_running() was also checked. Fixes: 23a6037ce76c ("bonding: Remove support for use_carrier") Signed-off-by: Nicolas Dichtel Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251106180252.3974772-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit 41d0c31be29fdee2535028ce70a6661e3a67bb25 Author: Zahari Doychev Date: Thu Nov 6 16:15:28 2025 +0100 tools: ynl: call nested attribute free function for indexed arrays When freeing indexed arrays, the corresponding free function should be called for each entry of the indexed array. For example, for for 'struct tc_act_attrs' 'tc_act_attrs_free(...)' needs to be called for each entry. Previously, memory leaks were reported when enabling the ASAN analyzer. ================================================================= ==874==ERROR: LeakSanitizer: detected memory leaks Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db048af in tc_act_attrs_set_options_vlan_parms ../generated/tc-user.h:2813 #2 0x55c98db048af in main ./linux/tools/net/ynl/samples/tc-filter-add.c:71 Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db04a93 in tc_act_attrs_set_options_vlan_parms ../generated/tc-user.h:2813 #2 0x55c98db04a93 in main ./linux/tools/net/ynl/samples/tc-filter-add.c:74 Direct leak of 10 byte(s) in 2 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db0527d in tc_act_attrs_set_kind ../generated/tc-user.h:1622 SUMMARY: AddressSanitizer: 58 byte(s) leaked in 4 allocation(s). The following diff illustrates the changes introduced compared to the previous version of the code. void tc_flower_attrs_free(struct tc_flower_attrs *obj) { + unsigned int i; + free(obj->indev); + for (i = 0; i < obj->_count.act; i++) + tc_act_attrs_free(&obj->act[i]); free(obj->act); free(obj->key_eth_dst); free(obj->key_eth_dst_mask); Signed-off-by: Zahari Doychev Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20251106151529.453026-3-zahari.doychev@linux.com Signed-off-by: Jakub Kicinski commit 762e7e174da91cf4babfe77e45bc6b67334b1503 Author: Jonas Gorski Date: Sun Nov 9 14:46:35 2025 +0100 net: dsa: tag_brcm: do not mark link local traffic as offloaded Broadcom switches locally terminate link local traffic and do not forward it, so we should not mark it as offloaded. In some situations we still want/need to flood this traffic, e.g. if STP is disabled, or it is explicitly enabled via the group_fwd_mask. But if the skb is marked as offloaded, the kernel will assume this was already done in hardware, and the packets never reach other bridge ports. So ensure that link local traffic is never marked as offloaded, so that the kernel can forward/flood these packets in software if needed. Since the local termination in not configurable, check the destination MAC, and never mark packets as offloaded if it is a link local ether address. While modern switches set the tag reason code to BRCM_EG_RC_PROT_TERM for trapped link local traffic, they also set it for link local traffic that is flooded (01:80:c2:00:00:10 to 01:80:c2:00:00:2f), so we cannot use it and need to look at the destination address for them as well. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Fixes: 0e62f543bed0 ("net: dsa: Fix duplicate frames flooded by learning") Signed-off-by: Jonas Gorski Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251109134635.243951-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit dd4adb986a86727ed8f56c48b6d0695f1e211e65 Author: Steven Rostedt Date: Tue Oct 28 12:27:24 2025 -0400 selftests/tracing: Run sample events to clear page cache events The tracing selftest "event-filter-function.tc" was failing because it first runs the "sample_events" function that triggers the kmem_cache_free event and it looks at what function was used during a call to "ls". But the first time it calls this, it could trigger events that are used to pull pages into the page cache. The rest of the test uses the function it finds during that call to see if it will be called in subsequent "sample_events" calls. But if there's no need to pull pages into the page cache, it will not trigger that function and the test will fail. Call the "sample_events" twice to trigger all the page cache work before it calls it to find a function to use in subsequent checks. Cc: stable@vger.kernel.org Fixes: eb50d0f250e96 ("selftests/ftrace: Choose target function for filter test from samples") Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Shuah Khan commit 60260ad935861f6b8db7c65c23faa41c98d8fb15 Author: Victor Nogueira Date: Thu Nov 6 17:56:21 2025 -0300 selftests/tc-testing: Create tests trying to add children to clsact/ingress qdiscs In response to Wang's bug report [1], add the following test cases: - Try and fail to add an fq child to an ingress qdisc - Try and fail to add an fq child to a clsact qdisc [1] https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Reviewed-by: Pedro Tammela Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Cong Wang Link: https://patch.msgid.link/20251106205621.3307639-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit e781122d76f018ad17752ab1018b3ffbf7fad84e Author: Victor Nogueira Date: Thu Nov 6 17:56:20 2025 -0300 net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc Wang reported an illegal configuration [1] where the user attempts to add a child qdisc to the ingress qdisc as follows: tc qdisc add dev eth0 handle ffff:0 ingress tc qdisc add dev eth0 handle ffe0:0 parent ffff:a fq To solve this, we reject any configuration attempt to add a child qdisc to ingress or clsact. [1] https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: Wang Liang Closes: https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Reviewed-by: Pedro Tammela Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Cong Wang Link: https://patch.msgid.link/20251106205621.3307639-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa Author: Eric Dumazet Date: Thu Nov 6 11:10:54 2025 +0000 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline] Fixes: b58537a1f562 ("net: sctp: fix permissions for rto_alpha and rto_beta knobs") Reported-by: syzbot+f8c46c8b2b7f6e076e99@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690c81ae.050a0220.3d0d33.014e.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Daniel Borkmann Acked-by: Xin Long Link: https://patch.msgid.link/20251106111054.3288127-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4427259cc7f7571a157fbc9b5011e1ef6fe0a4a8 Merge: 4ea7c1717f3f23 dc20452e6caf96 Author: Linus Torvalds Date: Mon Nov 10 15:35:45 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - fix broken clang build on versions earlier than 19 and binutils versions earlier than 2.38. (This exposed that we're not properly testing earlier toolchain versions in our linux-next builds and PR submissions. This was fixed for this PR, and is being addressed more generally for -next builds.) - remove some redundant Makefile code - avoid building Canaan Kendryte K210-specific code on targets that don't build for the K210 * tag 'riscv-for-linus-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix CONFIG_AS_HAS_INSN for new .insn usage riscv: Remove redundant judgment for the default build target riscv: Build loader.bin exclusively for Canaan K210 commit 6a77267d97b5b6cd0e35099ab4eb054e5f965ee6 Author: Pavel Begunkov Date: Mon Nov 10 13:03:53 2025 +0000 io_uring/query: return number of available queries It's useful to know which query opcodes are available. Extend the structure and return that. It's a trivial change, and even though it can be painlessly extended later, it'd still require adding a v2 of the structure. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d3c9c213c0b86ac5dd8fe2c53c24db20f1f510bc Author: Jens Axboe Date: Mon Nov 10 14:30:41 2025 -0700 io_uring/rw: ensure allocated iovec gets cleared for early failure A previous commit reused the recyling infrastructure for early cleanup, but this is not enough for the case where our internal caches have overflowed. If this happens, then the allocated iovec can get leaked if the request is also aborted early. Reinstate the previous forced free of the iovec for that situation. Cc: stable@vger.kernel.org Reported-by: syzbot+3c93637d7648c24e1fd0@syzkaller.appspotmail.com Tested-by: syzbot+3c93637d7648c24e1fd0@syzkaller.appspotmail.com Fixes: 9ac273ae3dc2 ("io_uring/rw: use io_rw_recycle() from cleanup path") Link: https://lore.kernel.org/io-uring/69122a59.a70a0220.22f260.00fd.GAE@google.com/ Signed-off-by: Jens Axboe commit b623390045a81fc559decb9bfeb79319721d3dfb Author: Dai Ngo Date: Sun Nov 9 09:05:08 2025 -0800 NFS: Fix LTP test failures when timestamps are delegated The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID. The problem can be reproduced as follow: # echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06 This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode. This patch adds the UID check and if it does not match then the request is sent to the server for permission checking. Fixes: e12912d94137 ("NFSv4: Add support for delegated atime and mtime attributes") Signed-off-by: Dai Ngo Signed-off-by: Anna Schumaker commit 41bf23338a501e745c398e0faee948dd05d0be98 Author: Luiz Augusto von Dentz Date: Tue Nov 4 17:02:04 2025 -0500 Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does in fact needs to run bis_cleanup in order to terminate the PA Sync, since that is bond to the listening socket which is the entity that controls the lifetime of PA Sync, so if it is closed/released the PA Sync shall be terminated, terminating the PA Sync shall not result in the BIG Sync being terminated since once the later is established it doesn't depend on the former anymore. If the use user wants to reconnect/rebind a number of BIS(s) it shall keep the socket open until it no longer needs the PA Sync, which means it retains full control of the lifetime of both PA and BIG Syncs. Fixes: d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit 15f32cabf426143ec1d2c8faf2bbca40c0fbd61b Author: Pauli Virtanen Date: Mon Nov 3 20:29:50 2025 +0200 Bluetooth: 6lowpan: add missing l2cap_chan_lock() l2cap_chan_close() needs to be called in l2cap_chan_lock(), otherwise l2cap_le_sig_cmd() etc. may run concurrently. Add missing locks around l2cap_chan_close(). Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 98454bc812f3611551e4b1f81732da4aa7b9597e Author: Pauli Virtanen Date: Mon Nov 3 20:29:49 2025 +0200 Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions disconnect_all_peers() calls sleeping function (l2cap_chan_close) under spinlock. Holding the lock doesn't actually do any good -- we work on a local copy of the list, and the lock doesn't protect against peer->chan having already been freed. Fix by taking refcounts of peer->chan instead. Clean up the code and old comments a bit. Take devices_lock instead of RCU, because the kfree_rcu(); l2cap_chan_put(); construct in chan_close_cb() does not guarantee peer->chan is necessarily valid in RCU. Also take l2cap_chan_lock() which is required for l2cap_chan_close(). Log: (bluez 6lowpan-tester Client Connect - Disable) ------ BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 ... ... l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495) ... ? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809) do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068) ------ Fixes: 90305829635d ("Bluetooth: 6lowpan: Converting rwlocks to use RCU") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c Author: Pauli Virtanen Date: Mon Nov 3 20:29:48 2025 +0200 Bluetooth: L2CAP: export l2cap_chan_hold for modules l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules. l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit b454505bf57a2e4f5d49951d4deb03730a9348d9 Author: Pauli Virtanen Date: Mon Nov 3 20:29:47 2025 +0200 Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types, e.g. debugfs "connect" command takes the former, and "disconnect" and "connect" to already connected device take the latter. This is due to using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le which take different dst_type values. Fix address type passed to hci_conn_hash_lookup_le(). Retain the debugfs API difference between "connect" and "disconnect" commands since it's been like this since 2015 and nobody apparently complained. Fixes: f5ad4ffceba0 ("Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible") Reviewed-by: Paul Menzel Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 3b78f50918276ab28fb22eac9aa49401ac436a3b Author: Pauli Virtanen Date: Mon Nov 3 20:29:46 2025 +0200 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW Add missing skb_reset_mac_header() for uncompressed ipv6 RX path. For the compressed one, it is done in lowpan_header_decompress(). Log: (BlueZ 6lowpan-tester Client Recv Raw - Success) ------ kernel BUG at net/core/skbuff.c:212! Call Trace: ... packet_rcv (net/packet/af_packet.c:2152) ... __local_bh_enable_ip (kernel/softirq.c:407) netif_rx (net/core/dev.c:5648) chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359) ------ Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices") Reviewed-by: Paul Menzel Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 23d22f2f71768034d6ef86168213843fc49bf550 Author: Raphael Pinsonneault-Thibeault Date: Wed Nov 5 14:28:41 2025 -0500 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd. Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com Fixes: fd913ef7ce619 ("Bluetooth: btusb: Add out-of-band wakeup support") Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Luiz Augusto von Dentz commit 55fb52ffdd62850d667ebed842815e072d3c9961 Author: Pauli Virtanen Date: Sun Nov 2 20:16:12 2025 +0200 Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone. Cancel the timer when MGMT removes the hdev, like other MGMT timers. Should fix the BUG: sporadically seen by BlueZ test bot (in "Mesh - Send cancel - 1" test). Log: ------ BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240 ------ Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Link: https://lore.kernel.org/linux-bluetooth/67364c09.0c0a0220.113cba.39ff@mx.google.com/ Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 1f214e9c3aef2d0936be971072e991d78a174d71 Author: Trond Myklebust Date: Fri Oct 31 10:51:42 2025 -0400 NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(), which is clearly incorrect. Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs to be passed down to the RPC layer. Reported-by: Dan Carpenter Reported-by: Harshit Mogalapalli Fixes: 76998ebb9158 ("NFSv4: Observe the NFS_MOUNT_SOFTREVAL flag in _nfs4_proc_lookupp") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 7a7a3456520b309a0bffa1d9d62bd6c9dcab89b3 Author: Yang Xiuwei Date: Thu Oct 30 11:03:25 2025 +0800 NFS: sysfs: fix leak when nfs_client kobject add fails If adding the second kobject fails, drop both references to avoid sysfs residue and memory leak. Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique") Signed-off-by: Yang Xiuwei Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 85d2c2392ac6348e1171d627497034a341a250c1 Author: Trond Myklebust Date: Tue Oct 28 17:27:43 2025 -0400 NFSv2/v3: Fix error handling in nfs_atomic_open_v23() When nfs_do_create() returns an EEXIST error, it means that a regular file could not be created. That could mean that a symlink needs to be resolved. If that's the case, a lookup needs to be kicked off. Reported-by: Stephen Abbene Link: https://bugzilla.kernel.org/show_bug.cgi?id=220710 Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Signed-off-by: Trond Myklebust Reviewed-by: NeilBrown Signed-off-by: Anna Schumaker commit 6a218b9c3183ed19d5703130025282cf20463d87 Author: Mike Snitzer Date: Wed Nov 5 22:03:04 2025 -0500 nfs/localio: do not issue misaligned DIO out-of-order From https://lore.kernel.org/linux-nfs/aQHASIumLJyOoZGH@infradead.org/ On Wed, Oct 29, 2025 at 12:20:40AM -0700, Christoph Hellwig wrote: > On Mon, Oct 27, 2025 at 12:18:30PM -0400, Mike Snitzer wrote: > > LOCALIO's misaligned DIO will issue head/tail followed by O_DIRECT > > middle (via AIO completion of that aligned middle). So out of order > > relative to file offset. > > That's in general a really bad idea. It will obviously work, but > both on SSDs and out of place write file systems it is a sure way > to increase your garbage collection overhead a lot down the line. Fix this by never issuing misaligned DIO out of order. This fix means the DIO-aligned middle will only use AIO completion if there is no misaligned end segment. Otherwise, all 3 segments of a misaligned DIO will be issued without AIO completion to ensure file offset increases properly for all partial READ or WRITE situations. Factoring out nfs_local_iter_setup() helps standardize repetitive nfs_local_iters_setup_dio() code and is inspired by cleanup work that Chuck Lever did on the NFSD Direct code. Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Reported-by: Christoph Hellwig Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 240372edaf854c9136f5ead45f2d8cd9496a9cb3 Author: Nitin Gote Date: Thu Nov 6 15:35:17 2025 +0530 drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg Wa_15016589081 applies to Xe3_LPG renderCS Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20251106100516.318863-2-nitin.r.gote@intel.com Signed-off-by: Matt Roper (cherry picked from commit 715974499a2199bd199fb4630501f55545342ea4) Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Lucas De Marchi commit fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc Author: Tangudu Tilak Tirumalesh Date: Thu Oct 30 21:16:26 2025 +0530 drm/xe/xe3: Extend wa_14023061436 Extend wa_14023061436 to Graphics Versions 30.03, 30.04 and 30.05. Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251030154626.3124565-1-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper (cherry picked from commit 0dd656d06f50ae4cedf160634cf13fd9e0944cf7) Cc: stable@vger.kernel.org # v6.17+ Signed-off-by: Lucas De Marchi commit 0b2f7be548006b0651e1e8320790f49723265cbc Author: Nitin Gote Date: Mon Oct 27 14:56:43 2025 +0530 drm/xe/xe3: Add WA_14024681466 for Xe3_LPG Apply WA_14024681466 to Xe3_LPG graphics IP versions from 30.00 to 30.05. v2: (Matthew Roper) - Remove stepping filter as workaround applies to all steppings. - Add an engine class filter so it only applies to the RENDER engine. Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20251027092643.335904-1-nitin.r.gote@intel.com Reviewed-by: Matt Roper Signed-off-by: Matt Roper (cherry picked from commit 071089a69e199bd810ff31c4c933bd528e502743) Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Lucas De Marchi commit 97b726eb1dc2b4a2532544eb3da72bb6acbd39a3 Author: Armin Wolf Date: Mon Nov 10 12:12:53 2025 +0100 platform/x86: msi-wmi-platform: Fix typo in WMI GUID The WMI driver core only supports GUID strings containing only uppercase characters, however the GUID string used by the msi-wmi-platform driver contains a single lowercase character. This prevents the WMI driver core from matching said driver to its WMI device. Fix this by turning the lowercase character into a uppercase character. Also update the WMI driver development guide to warn about this. Reported-by: Antheas Kapenekakis Fixes: 9c0beb6b29e7 ("platform/x86: wmi: Add MSI WMI Platform driver") Tested-by: Antheas Kapenekakis Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251110111253.16204-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c93433fd4e2bbbe7caa67b53d808b4a084852ff3 Author: Armin Wolf Date: Mon Nov 10 12:12:52 2025 +0100 platform/x86: msi-wmi-platform: Only load on MSI devices It turns out that the GUID used by the msi-wmi-platform driver (ABBC0F60-8EA1-11D1-00A0-C90629100000) is not unique, but was instead copied from the WIndows Driver Samples. This means that this driver could load on devices from other manufacturers that also copied this GUID, potentially causing hardware errors. Prevent this by only loading on devices whitelisted via DMI. The DMI matches where taken from the msi-ec driver. Reported-by: Antheas Kapenekakis Fixes: 9c0beb6b29e7 ("platform/x86: wmi: Add MSI WMI Platform driver") Tested-by: Antheas Kapenekakis Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251110111253.16204-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ea7c1717f3f2344f7a1cdab4f5875cfa89c87a9 Merge: e9a6fb0bcdd760 8a4821412cf2c1 Author: Linus Torvalds Date: Mon Nov 10 08:54:36 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Arm: - Fix trapping regression when no in-kernel irqchip is present - Check host-provided, untrusted ranges and offsets in pKVM - Fix regression restoring the ID_PFR1_EL1 register - Fix vgic ITS locking issues when LPIs are not directly injected Arm selftests: - Correct target CPU programming in vgic_lpi_stress selftest - Fix exposure of SCTLR2_EL2 and ZCR_EL2 in get-reg-list selftest RISC-V: - Fix check for local interrupts on riscv32 - Read HGEIP CSR on the correct cpu when checking for IMSIC interrupts - Remove automatic I/O mapping from kvm_arch_prepare_memory_region() x86: - Inject #UD if the guest attempts to execute SEAMCALL or TDCALL as KVM doesn't support virtualization the instructions, but the instructions are gated only by VMXON. That is, they will VM-Exit instead of taking a #UD and until now this resulted in KVM exiting to userspace with an emulation error. - Unload the "FPU" when emulating INIT of XSTATE features if and only if the FPU is actually loaded, instead of trying to predict when KVM will emulate an INIT (CET support missed the MP_STATE path). Add sanity checks to detect and harden against similar bugs in the future. - Unregister KVM's GALog notifier (for AVIC) when kvm-amd.ko is unloaded. - Use a raw spinlock for svm->ir_list_lock as the lock is taken during schedule(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. - Remove guest_memfd bindings on memslot deletion when a gmem file is dying to fix a use-after-free race found by syzkaller. - Fix a goof in the EPT Violation handler where KVM checks the wrong variable when determining if the reported GVA is valid. - Fix and simplify the handling of LBR virtualization on AMD, which was made buggy and unnecessarily complicated by nested VM support Misc: - Update Oliver's email address" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (28 commits) KVM: nSVM: Fix and simplify LBR virtualization handling with nested KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated MAINTAINERS: Switch myself to using kernel.org address KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock KVM: arm64: vgic-v3: Reinstate IRQ lock ordering for LPI xarray KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured KVM: arm64: Make all 32bit ID registers fully writable KVM: VMX: Fix check for valid GVA on an EPT violation KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying KVM: SVM: switch to raw spinlock for svm->ir_list_lock KVM: SVM: Make avic_ga_log_notifier() local to avic.c KVM: SVM: Unregister KVM's GALog notifier on kvm-amd.ko exit KVM: SVM: Initialize per-CPU svm_data at the end of hardware setup KVM: x86: Call out MSR_IA32_S_CET is not handled by XSAVES KVM: x86: Harden KVM against imbalanced load/put of guest FPU state KVM: x86: Unload "FPU" state on INIT if and only if its currently in-use KVM: arm64: Check the untrusted offset in FF-A memory share KVM: arm64: Check range args for pKVM mem transitions ... commit eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 Author: Niranjan H Y Date: Mon Nov 10 20:56:46 2025 +0530 ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list "struct sdca_control" declares "values" field as integer array. But the memory allocated to it is of char array. This causes crash for sdca_parse_function API. This patch addresses the issue by allocating correct data size. Signed-off-by: Niranjan H Y Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251110152646.192-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit d32ddfeb559342e89a4d06b1df4e7e5e96df3762 Author: Mike Snitzer Date: Mon Oct 27 13:52:28 2025 -0400 nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion LOCALIO's misaligned DIO WRITE support requires synchronous IO for any misaligned head and/or tail that are issued using buffered IO. In addition, it is important that the O_DIRECT middle be on stable storage upon its completion via AIO. Otherwise, a misaligned DIO WRITE could mix buffered IO for the head/tail and direct IO for the DIO-aligned middle -- which could lead to problems associated with deferred writes to stable storage (such as out of order partial completions causing incorrect advancement of the file's offset, etc). Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit d0497dd27452c79a48414df813a16cd12d274b3b Author: Mike Snitzer Date: Mon Oct 27 09:08:33 2025 -0400 nfs/localio: backfill missing partial read support for misaligned DIO Misaligned DIO read can be split into 3 IOs, must handle potential for short read from each component IO (follows same pattern used for handling partial writes, except upper layer read code handles advancing offset before retry). Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit f2060bdc21d70f3d8a4753a9fd3b0b02cb48c0bc Author: Mike Snitzer Date: Mon Oct 27 09:08:32 2025 -0400 nfs/localio: add refcounting for each iocb IO associated with NFS pgio header Improve completion handling of as many as 3 IOs associated with each misaligned DIO by using a atomic_t to track completion of each IO. Update nfs_local_pgio_done() to use precise atomic_t accounting for remaining iov_iter (up to 3) associated with each iocb, so that each NFS LOCALIO pgio header is only released after all IOs have completed. But also allow early return if/when a short read or write occurs. Fixes reported BUG: KASAN: slab-use-after-free in nfs_local_call_read: https://lore.kernel.org/linux-nfs/aPSvi5Yr2lGOh5Jh@dell-per750-06-vm-07.rhts.eng.pek2.redhat.com/ Reported-by: Yongcheng Yang Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 51a491f2708de79da76791523d40926921823b7e Author: Mike Snitzer Date: Mon Oct 27 09:08:31 2025 -0400 nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support Each filesystem is meant to fallback to retrying DIO in terms buffered IO when it might encounter -ENOTBLK when issuing DIO (which can happen if the VFS cannot invalidate the page cache). So NFS doesn't need special handling for -ENOTBLK. Also, explicitly initialize a couple DIO related iocb members rather than simply rely on data structure zeroing. Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Reported-by: Christoph Hellwig Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit fb2cba0854a7f315c8100a807a6959b99d72479e Author: Trond Myklebust Date: Sat Oct 18 20:10:36 2025 -0400 NFS: Check the TLS certificate fields in nfs_match_client() If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the cert_serial and privkey_serial fields need to match as well since they define the client's identity, as presented to the server. Fixes: 90c9550a8d65 ("NFS: support the kernel keyring for TLS") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 8ab523ce78d4ca13add6b4ecbacff0f84c274603 Author: Trond Myklebust Date: Sat Oct 18 20:10:35 2025 -0400 pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS The default setting for the transport security policy must be RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS. Conversely, when using TLS, the security policy needs to be set. Fixes: 6c0a8c5fcf71 ("NFS: Have struct nfs_client carry a TLS policy field") Signed-off-by: Trond Myklebust Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker commit 28e19737e1570c7c71890547c2e43c3e0da79df9 Author: Trond Myklebust Date: Sat Oct 18 20:10:34 2025 -0400 pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport. Fixes: a35518cae4b3 ("NFSv4.1/pnfs: fix NFS with TLS in pnfs") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 7aca00d950e782e66c34fbd045c9605eca343a36 Author: Trond Myklebust Date: Sat Oct 18 20:10:33 2025 -0400 pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect() Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport. Fixes: 04a15263662a ("pnfs/flexfiles: connect to NFSv3 DS using TLS if MDS connection uses TLS") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 994dec10991b53beac3e16109d876ae363e8a329 Author: Jani Nikula Date: Thu Nov 6 22:00:00 2025 +0200 drm/i915/psr: fix pipe to vblank conversion First, we can't assume pipe == crtc index. If a pipe is fused off in between, it no longer holds. intel_crtc_for_pipe() is the only proper way to get from a pipe to the corresponding crtc. Second, drivers aren't supposed to access or index drm->vblank[] directly. There's drm_crtc_vblank_crtc() for this. Use both functions to fix the pipe to vblank conversion. Fixes: f02658c46cf7 ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable") Cc: Jouni Högander Cc: stable@vger.kernel.org # v6.16+ Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd) Signed-off-by: Rodrigo Vivi commit 576c930e5e7dcb937648490611a83f1bf0171048 Author: Boris Brezillon Date: Fri Nov 7 18:12:14 2025 +0100 drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted. Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block") Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Signed-off-by: Steven Price Link: https://patch.msgid.link/20251107171214.1186299-1-boris.brezillon@collabora.com commit 324be6dcbf09133a322db16977a84fbb45c16129 Author: Chuck Lever Date: Thu Oct 16 11:09:13 2025 -0400 Revert "SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it" Geert reports: > This is now commit d8e97cc476e33037 ("SUNRPC: Make RPCSEC_GSS_KRB5 > select CRYPTO instead of depending on it") in v6.18-rc1. > As RPCSEC_GSS_KRB5 defaults to "y", CRYPTO is now auto-enabled in > defconfigs that didn't enable it before. Revert while we work out a proper solution and then test it. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-nfs/b97cea29-4ab7-4fb6-85ba-83f9830e524f@kernel.org/T/#t Signed-off-by: Chuck Lever commit 1cff14b7fc7f31363c39d0269563ce75c714f7ae Author: NeilBrown Date: Thu Oct 16 09:49:57 2025 -0400 nfsd: ensure SEQUENCE replay sends a valid reply. nfsd4_enc_sequence_replay() uses nfsd4_encode_operation() to encode a new SEQUENCE reply when replaying a request from the slot cache - only ops after the SEQUENCE are replayed from the cache in ->sl_data. However it does this in nfsd4_replay_cache_entry() which is called *before* nfsd4_sequence() has filled in reply fields. This means that in the replayed SEQUENCE reply: maxslots will be whatever the client sent target_maxslots will be -1 (assuming init to zero, and nfsd4_encode_sequence() subtracts 1) status_flags will be zero The incorrect maxslots value, in particular, can cause the client to think the slot table has been reduced in size so it can discard its knowledge of current sequence number of the later slots, though the server has not discarded those slots. When the client later wants to use a later slot, it can get NFS4ERR_SEQ_MISORDERED from the server. This patch moves the setup of the reply into a new helper function and call it *before* nfsd4_replay_cache_entry() is called. Only one of the updated fields was used after this point - maxslots. So the nfsd4_sequence struct has been extended to have separate maxslots for the request and the response. Reported-by: Olga Kornievskaia Closes: https://lore.kernel.org/linux-nfs/20251010194449.10281-1-okorniev@redhat.com/ Tested-by: Olga Kornievskaia Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c96573c0d75db3f8478000d0d392a9cdb95adbed Author: Chuck Lever Date: Thu Oct 16 09:49:56 2025 -0400 NFSD: Never cache a COMPOUND when the SEQUENCE operation fails RFC 8881 normatively mandates that operations where the initial SEQUENCE operation in a compound fails must not modify the slot's replay cache. nfsd4_cache_this() doesn't prevent such caching. So when SEQUENCE fails, cstate.data_offset is not set, allowing read_bytes_from_xdr_buf() to access uninitialized memory. Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/c3628d57-94ae-48cf-8c9e-49087a28cec9@oracle.com/T/#t Fixes: 468de9e54a90 ("nfsd41: expand solo sequence check") Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit ff8141e49cf70d2d093a5228f5299ce188de6142 Author: Chuck Lever Date: Thu Oct 16 09:49:55 2025 -0400 NFSD: Skip close replay processing if XDR encoding fails The replay logic added by commit 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") cannot be done if encoding failed due to a short send buffer; there's no guarantee that the operation encoder has actually encoded the data that is being copied to the replay cache. Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/c3628d57-94ae-48cf-8c9e-49087a28cec9@oracle.com/T/#t Fixes: 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 4aa17144d5abc3c756883e3a010246f0dba8b468 Author: Olga Kornievskaia Date: Tue Oct 14 13:59:59 2025 -0400 NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@oracle.com/T/#t Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 66e9feb03e7cf8983b1d0c540e2dad90d5146d48 Author: Hans de Goede Date: Sun Nov 9 16:53:39 2025 +0100 spi: Add TODO comment about ACPI GPIO setup Add a TODO comment that ideally the ACPI/gpiolib core code should take care of setting GPIO direction and/or bias according to ACPI GPIO resources. If this TODO gets implemented then the acpi_dev_gpio_irq_get() call in acpi_register_spi_device() can be dropped. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251109155340.26199-1-johannes.goede@oss.qualcomm.com Signed-off-by: Mark Brown commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 Author: Vanillan Wang Date: Mon Nov 10 12:20:41 2025 +0800 USB: serial: option: add support for Rolling RW101R-GL - VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x0301: mbim, pipe T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0301 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x01a8: mbim, diag, AT, ADB, pipe1, pipe2 T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=01a8 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x0302: mbim, pipe T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0302 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x01a9: mbim, diag, AT, ADB, pipe1, pipe2 T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a9 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Vanillan Wang Cc: stable@vger.kernel.org [ johan: sort vendor entries, edit commit message slightly ] Signed-off-by: Johan Hovold commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf Author: Takashi Iwai Date: Sun Nov 9 10:12:07 2025 +0100 ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it's always equal or greater than ep->packsize[0]. Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7 Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com Cc: Lizhi Xu Cc: Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit aaf46c6a6df6052881c2e75cba65aeb6f1cfa88a Author: Randy Dunlap Date: Thu Oct 23 22:21:02 2025 -0700 tee: : - add ending ':' to some struct members as needed for kernel-doc - change struct name in kernel-doc to match the actual struct name (2x) - add a @params: kernel-doc entry multiple times Warning: tee.h:265 struct member 'ret_origin' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'num_params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:351 struct member 'num_params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:351 struct member 'params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:372 struct member 'num_params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:372 struct member 'params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:298: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_invoke_arg instead Warning: tee.h:473: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_object_invoke_arg instead Signed-off-by: Randy Dunlap Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit b05addf6f0596edb1f82ab4059438c7ef2d2686d Author: Pratyush Yadav Date: Mon Nov 3 19:02:32 2025 +0100 kho: warn and exit when unpreserved page wasn't preserved Calling __kho_unpreserve() on a pair of (pfn, end_pfn) that wasn't preserved is a bug. Currently, if that is done, the physxa or bits can be NULL. This results in a soft lockup since a NULL physxa or bits results in redoing the loop without ever making any progress. Return when physxa or bits are not found, but WARN first to loudly indicate invalid behaviour. Link: https://lkml.kernel.org/r/20251103180235.71409-3-pratyush@kernel.org Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit 7ecd2e439d1272ac02d798b0033a426e3b00dff5 Author: Pratyush Yadav Date: Mon Nov 3 19:02:31 2025 +0100 kho: fix unpreservation of higher-order vmalloc preservations kho_vmalloc_unpreserve_chunk() calls __kho_unpreserve() with end_pfn as pfn + 1. This happens to work for 0-order pages, but leaks higher order pages. For example, say order 2 pages back the allocation. During preservation, they get preserved in the order 2 bitmaps, but kho_vmalloc_unpreserve_chunk() would try to unpreserve them from the order 0 bitmaps, which should not have these bits set anyway, leaving the order 2 bitmaps untouched. This results in the pages being carried over to the next kernel. Nothing will free those pages in the next boot, leaking them. Fix this by taking the order into account when calculating the end PFN for __kho_unpreserve(). Link: https://lkml.kernel.org/r/20251103180235.71409-2-pratyush@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 0b07092d09e54e49b85379a9c60f82d54a881514 Author: Pratyush Yadav Date: Mon Nov 3 12:01:57 2025 +0100 kho: fix out-of-bounds access of vmalloc chunk The list of pages in a vmalloc chunk is NULL-terminated. So when looping through the pages in a vmalloc chunk, both kho_restore_vmalloc() and kho_vmalloc_unpreserve_chunk() rightly make sure to stop when encountering a NULL page. But when the chunk is full, the loops do not stop and go past the bounds of chunk->phys, resulting in out-of-bounds memory access, and possibly the restoration or unpreservation of an invalid page. Fix this by making sure the processing of chunk stops at the end of the array. Link: https://lkml.kernel.org/r/20251103110159.8399-1-pratyush@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit bba717bbc466ab24d25964034f5e16ead1720512 Author: Chris Li Date: Sun Nov 2 07:11:07 2025 -0800 MAINTAINERS: add Chris and Kairui as the swap maintainer We have been collaborating on a systematic effort to clean up and improve the Linux swap system, and might as well take responsibility for it. Link: https://lkml.kernel.org/r/20251102-swap-m-v1-1-582f275d5bce@kernel.org Signed-off-by: Chris Li Acked-by: Kairui Song Acked-by: Barry Song Acked-by: Baoquan He Cc: Johannes Weiner Cc: Kemeng Shi Cc: Michal Hocko Cc: Minchan Kim Cc: Nhat Pham Cc: Roman Gushchin Cc: SeongJae Park Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 6f86d0534fddfbd08687fa0f01479d4226bc3c3d Author: Lance Yang Date: Fri Oct 31 20:09:55 2025 +0800 mm/secretmem: fix use-after-free race in fault handler When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the underlying page as not-present in the direct map, and add it to the file mapping. If two tasks cause a fault in the same page concurrently, both could end up allocating a folio and removing the page from the direct map, but only one would succeed in adding the folio to the file mapping. The task that failed undoes the effects of its attempt by (a) freeing the folio again and (b) putting the page back into the direct map. However, by doing these two operations in this order, the page becomes available to the allocator again before it is placed back in the direct mapping. If another task attempts to allocate the page between (a) and (b), and the kernel tries to access it via the direct map, it would result in a supervisor not-present page fault. Fix the ordering to restore the direct map before the folio is freed. Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Lance Yang Reported-by: Google Big Sleep Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWKrdQJ-ATdg@mail.gmail.com/ Acked-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit adfb6609c6809e107ded9a1cd46f519c882e64ea Author: Catalin Marinas Date: Fri Oct 31 16:57:50 2025 +0000 mm/huge_memory: initialise the tags of the huge zero folio On arm64 with MTE enabled, a page mapped as Normal Tagged (PROT_MTE) in user space will need to have its allocation tags initialised. This is normally done in the arm64 set_pte_at() after checking the memory attributes. Such page is also marked with the PG_mte_tagged flag to avoid subsequent clearing. Since this relies on having a struct page, pte_special() mappings are ignored. Commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special") maps the huge zero folio special and the arm64 set_pmd_at() will no longer zero the tags. There is no guarantee that the tags are zero, especially if parts of this huge page have been previously tagged. It's fairly easy to detect this by regularly dropping the caches to force the reallocation of the huge zero folio. Allocate the huge zero folio with the __GFP_ZEROTAGS flag. In addition, do not warn in the arm64 __access_remote_tags() when reading tags from the huge zero page. I bundled the arm64 change in here as well since they are both related to the commit mapping the huge zero folio as special. [catalin.marinas@arm.com: handle arch mte_zero_clear_page_tags() code issuing MTE instructions] Link: https://lkml.kernel.org/r/aQi8dA_QpXM8XqrE@arm.com Link: https://lkml.kernel.org/r/20251031170133.280742-1-catalin.marinas@arm.com Fixes: d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special") Signed-off-by: Catalin Marinas Acked-by: David Hildenbrand Reviewed-by: Lance Yang Tested-by: Beleswar Padhi Cc: Will Deacon Cc: Mark Brown Cc: Aishwarya TCV Cc: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 9a6b60cb147d53968753a34805211d2e5e08c027 Author: Edward Adam Davis Date: Thu Oct 30 07:51:52 2025 +0900 nilfs2: avoid having an active sc_timer before freeing sci Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed. Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer. We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned. [1] ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509 Link: https://lkml.kernel.org/r/20251029225226.16044-1-konishi.ryusuke@gmail.com Fixes: 3f66cc261ccb ("nilfs2: use kthread_create and kthread_stop for the log writer thread") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24d8b70f039151f65590 Tested-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Cc: [6.12+] Signed-off-by: Andrew Morton commit 7d9f7d390f6af3a29614e81e802e2b9c238eb7b2 Author: Carlos Llamas Date: Thu Oct 30 01:03:33 2025 +0000 scripts/decode_stacktrace.sh: fix build ID and PC source parsing Support for parsing PC source info in stacktraces (e.g. '(P)') was added in commit 2bff77c665ed ("scripts/decode_stacktrace.sh: fix decoding of lines with an additional info"). However, this logic was placed after the build ID processing. This incorrect order fails to parse lines containing both elements, e.g.: drm_gem_mmap_obj+0x114/0x200 [drm 03d0564e0529947d67bb2008c3548be77279fd27] (P) This patch fixes the problem by extracting the PC source info first and then processing the module build ID. With this change, the line above is now properly parsed as such: drm_gem_mmap_obj (./include/linux/mmap_lock.h:212 ./include/linux/mm.h:811 drivers/gpu/drm/drm_gem.c:1177) drm (P) While here, also add a brief explanation the build ID section. Link: https://lkml.kernel.org/r/20251030010347.2731925-1-cmllamas@google.com Fixes: 2bff77c665ed ("scripts/decode_stacktrace.sh: fix decoding of lines with an additional info") Signed-off-by: Carlos Llamas Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Luca Ceresoli Cc: Breno Leitao Cc: Catalin Marinas Cc: Marc Rutland Cc: Mark Brown Cc: Matthieu Baerts Cc: Miroslav Benes Cc: Puranjay Mohan Cc: Signed-off-by: Andrew Morton commit 9fd7bb5083d1e1027b8ac1e365c29921ab88b177 Author: Quanmin Yan Date: Thu Oct 30 10:07:46 2025 +0800 mm/damon/sysfs: change next_update_jiffies to a global variable In DAMON's damon_sysfs_repeat_call_fn(), time_before() is used to compare the current jiffies with next_update_jiffies to determine whether to update the sysfs files at this moment. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this causes time_before() in damon_sysfs_repeat_call_fn() to unexpectedly return true during the first 5 minutes after boot on 32-bit systems (see [1] for more explanation, which fixes another jiffies-related issue before). As a result, DAMON does not update sysfs files during that period. There is also an issue unrelated to the system's word size[2]: if the user stops DAMON just after next_update_jiffies is updated and restarts it after 'refresh_ms' or a longer delay, next_update_jiffies will retain an older value, causing time_before() to return false and the update to happen earlier than expected. Fix these issues by making next_update_jiffies a global variable and initializing it each time DAMON is started. Link: https://lkml.kernel.org/r/20251030020746.967174-3-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1] Link: https://lore.kernel.org/all/20251029013038.66625-1-sj@kernel.org/ [2] Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Signed-off-by: Quanmin Yan Cc: Kefeng Wang Cc: ze zuo Cc: Signed-off-by: Andrew Morton commit 2f6ce7e714ef842e43120ecd6a7ed287b502026d Author: Quanmin Yan Date: Thu Oct 30 10:07:45 2025 +0800 mm/damon/stat: change last_refresh_jiffies to a global variable Patch series "mm/damon: fixes for the jiffies-related issues", v2. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this may cause the time_before() series of functions to return unexpected values, resulting in DAMON not functioning as intended. Meanwhile, similar issues exist in some specific user operation scenarios. This patchset addresses these issues. The first patch is about the DAMON_STAT module, and the second patch is about the core layer's sysfs. This patch (of 2): In DAMON_STAT's damon_stat_damon_call_fn(), time_before_eq() is used to avoid unnecessarily frequent stat update. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this causes time_before_eq() in DAMON_STAT to unexpectedly return true during the first 5 minutes after boot on 32-bit systems (see [1] for more explanation, which fixes another jiffies-related issue before). As a result, DAMON_STAT does not update any monitoring results during that period, which becomes more confusing when DAMON_STAT_ENABLED_DEFAULT is enabled. There is also an issue unrelated to the system's word size[2]: if the user stops DAMON_STAT just after last_refresh_jiffies is updated and restarts it after 5 seconds or a longer delay, last_refresh_jiffies will retain an older value, causing time_before_eq() to return false and the update to happen earlier than expected. Fix these issues by making last_refresh_jiffies a global variable and initializing it each time DAMON_STAT is started. Link: https://lkml.kernel.org/r/20251030020746.967174-2-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1] Link: https://lore.kernel.org/all/20251028143250.50144-1-sj@kernel.org/ [2] Fixes: fabdd1e911da ("mm/damon/stat: calculate and expose estimated memory bandwidth") Signed-off-by: Quanmin Yan Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Cc: Signed-off-by: Andrew Morton commit 91a54090026f84ceffaa12ac53c99b9f162946f6 Author: Martin Kaiser Date: Thu Oct 30 16:55:05 2025 +0100 maple_tree: fix tracepoint string pointers maple_tree tracepoints contain pointers to function names. Such a pointer is saved when a tracepoint logs an event. There's no guarantee that it's still valid when the event is parsed later and the pointer is dereferenced. The kernel warns about these unsafe pointers. event 'ma_read' has unsafe pointer field 'fn' WARNING: kernel/trace/trace.c:3779 at ignore_event+0x1da/0x1e4 Mark the function names as tracepoint_string() to fix the events. One case that doesn't work without my patch would be trace-cmd record to save the binary ringbuffer and trace-cmd report to parse it in userspace. The address of __func__ can't be dereferenced from userspace but tracepoint_string will add an entry to /sys/kernel/tracing/printk_formats Link: https://lkml.kernel.org/r/20251030155537.87972-1-martin@kaiser.cx Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Martin Kaiser Acked-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 1abbdf3d57aa964e572940d67c9ec5dc87710738 Author: Hao Ge Date: Wed Oct 29 09:43:17 2025 +0800 codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls handle_failed_objexts_alloc() to mark all objects in the vector as empty. As a result all objects in this slab (slabA) will have their extensions set to CODETAG_EMPTY. Later on if this slabA is used to allocate a slabobj_ext vector for another slab (slabB), we end up with the slabB->obj_exts pointing to a slabobj_ext vector that itself has a non-NULL slabobj_ext equal to CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to free slabB->obj_exts vector. free_slab_obj_exts() calls mark_objexts_empty(slabB->obj_exts) which will generate a warning because it expects slabobj_ext vectors to have a NULL obj_ext, not CODETAG_EMPTY. Modify mark_objexts_empty() to skip the warning and setting the obj_ext value if it's already set to CODETAG_EMPTY. To quickly detect this WARN, I modified the code from WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1); We then obtained this message: [21630.898561] ------------[ cut here ]------------ [21630.898596] kernel BUG at mm/slub.c:2050! [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1 vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi net_failover virtio_console failover virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary) [21630.910495] Tainted: [W]=WARN [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [21630.912392] pc : __free_slab+0x228/0x250 [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : ffff8000a02f73e0 [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: ffff0000c0011c40 [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: ffff000102199b40 [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: ffff0000c0011c40 [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: 0000000000000000 [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: ffff70001405ee66 [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : ffff800080a295dc [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : 0000000000003000 [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : 0000000000000007 [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : 0000000000000001 [21630.921810] Call trace: [21630.922130]  __free_slab+0x228/0x250 (P) [21630.922669]  free_slab+0x38/0x118 [21630.923079]  free_to_partial_list+0x1d4/0x340 [21630.923591]  __slab_free+0x24c/0x348 [21630.924024]  ___cache_free+0xf0/0x110 [21630.924468]  qlist_free_all+0x78/0x130 [21630.924922]  kasan_quarantine_reduce+0x114/0x148 [21630.925525]  __kasan_slab_alloc+0x7c/0xb0 [21630.926006]  kmem_cache_alloc_noprof+0x164/0x5c8 [21630.926699]  __alloc_object+0x44/0x1f8 [21630.927153]  __create_object+0x34/0xc8 [21630.927604]  kmemleak_alloc+0xb8/0xd8 [21630.928052]  kmem_cache_alloc_noprof+0x368/0x5c8 [21630.928606]  getname_flags.part.0+0xa4/0x610 [21630.929112]  getname_flags+0x80/0xd8 [21630.929557]  vfs_fstatat+0xc8/0xe0 [21630.929975]  __do_sys_newfstatat+0xa0/0x100 [21630.930469]  __arm64_sys_newfstatat+0x90/0xd8 [21630.931046]  invoke_syscall+0xd4/0x258 [21630.931685]  el0_svc_common.constprop.0+0xb4/0x240 [21630.932467]  do_el0_svc+0x48/0x68 [21630.932972]  el0_svc+0x40/0xe0 [21630.933472]  el0t_64_sync_handler+0xa0/0xe8 [21630.934151]  el0t_64_sync+0x1ac/0x1b0 [21630.934923] Code: aa1803e0 97ffef2b a9446bf9 17ffff9c (d4210000) [21630.936461] SMP: stopping secondary CPUs [21630.939550] Starting crashdump kernel... [21630.940108] Bye! Link: https://lkml.kernel.org/r/20251029014317.1533488-1-hao.ge@linux.dev Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Signed-off-by: Hao Ge Reviewed-by: Suren Baghdasaryan Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: gehao Cc: Roman Gushchin Cc: Shakeel Butt Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 04d1c9d60c6ec4c0003d433572eaa45f8b217788 Author: Dev Jain Date: Tue Oct 28 12:09:52 2025 +0530 mm/mremap: honour writable bit in mremap pte batching Currently mremap folio pte batch ignores the writable bit during figuring out a set of similar ptes mapping the same folio. Suppose that the first pte of the batch is writable while the others are not - set_ptes will end up setting the writable bit on the other ptes, which is a violation of mremap semantics. Therefore, use FPB_RESPECT_WRITE to check the writable bit while determining the pte batch. Link: https://lkml.kernel.org/r/20251028063952.90313-1-dev.jain@arm.com Signed-off-by: Dev Jain Fixes: f822a9a81a31 ("mm: optimize mremap() by PTE batching") Reported-by: David Hildenbrand Debugged-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes Cc: Barry Song Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Cc: [6.17+] Signed-off-by: Andrew Morton commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 Author: Peter Oberparleiter Date: Tue Oct 28 12:51:25 2025 +0100 gcov: add support for GCC 15 Using gcov on kernels compiled with GCC 15 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 15. Tested with GCC 14.3.0 and GCC 15.2.0. Link: https://lkml.kernel.org/r/20251028115125.1319410-1-oberpar@linux.ibm.com Signed-off-by: Peter Oberparleiter Reported-by: Matthieu Baerts Closes: https://github.com/linux-test-project/lcov/issues/445 Tested-by: Matthieu Baerts Cc: Signed-off-by: Andrew Morton commit 0d6c356dd6547adac2b06b461528e3573f52d953 Author: Isaac J. Manjarres Date: Tue Oct 28 12:10:12 2025 -0700 mm/mm_init: fix hash table order logging in alloc_large_system_hash() When emitting the order of the allocation for a hash table, alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log base 2 of the allocation size. This is not correct if the allocation size is smaller than a page, and yields a negative value for the order as seen below: TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP bind hash table entries: 32 (order: -2, 1024 bytes, linear) Use get_order() to compute the order when emitting the hash table information to correctly handle cases where the allocation size is smaller than a page: TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP bind hash table entries: 32 (order: 0, 1024 bytes, linear) Link: https://lkml.kernel.org/r/20251028191020.413002-1-isaacmanjarres@google.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Isaac J. Manjarres Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: David Hildenbrand Cc: Signed-off-by: Andrew Morton commit fa04f5b60fda62c98a53a60de3a1e763f11feb41 Author: Kiryl Shutsemau Date: Mon Oct 27 11:56:36 2025 +0000 mm/truncate: unmap large folio on split failure Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS. This behavior might not be respected on truncation. During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved. However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD. Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics. Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size. Link: https://lkml.kernel.org/r/20251027115636.82382-3-kirill@shutemov.name Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios") Signed-off-by: Kiryl Shutsemau Cc: Al Viro Cc: Baolin Wang Cc: Christian Brauner Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 74207de2ba10c2973334906822dc94d2e859ffc5 Author: Kiryl Shutsemau Date: Mon Oct 27 11:56:35 2025 +0000 mm/memory: do not populate page table entries beyond i_size Patch series "Fix SIGBUS semantics with large folios", v3. Accessing memory within a VMA, but beyond i_size rounded up to the next page size, is supposed to generate SIGBUS. Darrick reported[1] an xfstests regression in v6.18-rc1. generic/749 failed due to missing SIGBUS. This was caused by my recent changes that try to fault in the whole folio where possible: 19773df031bc ("mm/fault: try to map the entire file folio in finish_fault()") 357b92761d94 ("mm/filemap: map entire large folio faultaround") These changes did not consider i_size when setting up PTEs, leading to xfstest breakage. However, the problem has been present in the kernel for a long time - since huge tmpfs was introduced in 2016. The kernel happily maps PMD-sized folios as PMD without checking i_size. And huge=always tmpfs allocates PMD-size folios on any writes. I considered this corner case when I implemented a large tmpfs, and my conclusion was that no one in their right mind should rely on receiving a SIGBUS signal when accessing beyond i_size. I cannot imagine how it could be useful for the workload. But apparently filesystem folks care a lot about preserving strict SIGBUS semantics. Generic/749 was introduced last year with reference to POSIX, but no real workloads were mentioned. It also acknowledged the tmpfs deviation from the test case. POSIX indeed says[3]: References within the address range starting at pa and continuing for len bytes to whole pages following the end of an object shall result in delivery of a SIGBUS signal. The patchset fixes the regression introduced by recent changes as well as more subtle SIGBUS breakage due to split failure on truncation. This patch (of 2): Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS. Recent changes attempted to fault in full folio where possible. They did not respect i_size, which led to populating PTEs beyond i_size and breaking SIGBUS semantics. Darrick reported generic/749 breakage because of this. However, the problem existed before the recent changes. With huge=always tmpfs, any write to a file leads to PMD-size allocation. Following the fault-in of the folio will install PMD mapping regardless of i_size. Fix filemap_map_pages() and finish_fault() to not install: - PTEs beyond i_size; - PMD mappings across i_size; Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size. Link: https://lkml.kernel.org/r/20251027115636.82382-1-kirill@shutemov.name Link: https://lkml.kernel.org/r/20251027115636.82382-2-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Fixes: 6795801366da ("xfs: Support large folios") Reported-by: "Darrick J. Wong" Cc: Al Viro Cc: Baolin Wang Cc: Christian Brauner Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 895b4c0c79b092d732544011c3cecaf7322c36a1 Author: Wei Yang Date: Sat Oct 25 10:42:33 2025 +0800 fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang Cc: Al Viro Cc: Christian Brauner Cc: wangzijie Cc: Alexey Dobriyan Cc: Signed-off-by: Andrew Morton commit fa5a061700364bc28ee1cb1095372f8033645dcb Author: Zi Yan Date: Wed Oct 22 23:05:21 2025 -0400 mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order folio split clears PG_has_hwpoisoned, but the flag should be preserved in after-split folios containing pages with PG_hwpoisoned flag if the folio is split to >0 order folios. Scan all pages in a to-be-split folio to determine which after-split folios need the flag. An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to avoid the scan and set it on all after-split folios, but resulting false positive has undesirable negative impact. To remove false positive, caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page() needs to do the scan. That might be causing a hassle for current and future callers and more costly than doing the scan in the split code. More details are discussed in [1]. This issue can be exposed via: 1. splitting a has_hwpoisoned folio to >0 order from debugfs interface; 2. truncating part of a has_hwpoisoned folio in truncate_inode_partial_folio(). And later accesses to a hwpoisoned page could be possible due to the missing has_hwpoisoned folio flag. This will lead to MCE errors. Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Yang Shi Reviewed-by: Lorenzo Stoakes Reviewed-by: Lance Yang Reviewed-by: Miaohe Lin Reviewed-by: Baolin Wang Reviewed-by: Wei Yang Cc: Pankaj Raghav Cc: Barry Song Cc: Dev Jain Cc: Jane Chu Cc: Liam Howlett Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit f5548c318d6520d4fa3c5ed6003eeb710763cbc5 Author: Pedro Demarchi Gomes Date: Wed Oct 22 12:30:59 2025 -0300 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: #include #include #include /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu. Link: https://lkml.kernel.org/r/20251023035841.41406-1-pedrodemargomes@gmail.com Link: https://lkml.kernel.org/r/20251022153059.22763-1-pedrodemargomes@gmail.com Link: https://lore.kernel.org/linux-mm/423de7a3-1c62-4e72-8e79-19a6413e420c@redhat.com/ [1] Fixes: 31dbd01f3143 ("ksm: Kernel SamePage Merging") Signed-off-by: Pedro Demarchi Gomes Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Reported-by: craftfever Closes: https://lkml.kernel.org/r/020cf8de6e773bb78ba7614ef250129f11a63781@murena.io Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Chengming Zhou Cc: xu xin Cc: Signed-off-by: Andrew Morton commit 7e76b75e5ab3339bebab3a4738226cd9b27d8c42 Author: Aleksei Nikiforov Date: Tue Sep 30 13:56:01 2025 +0200 mm/kmsan: fix kmsan kmalloc hook when no stack depots are allocated yet If no stack depot is allocated yet, due to masking out __GFP_RECLAIM flags kmsan called from kmalloc cannot allocate stack depot. kmsan fails to record origin and report issues. This may result in KMSAN failing to report issues. Reusing flags from kmalloc without modifying them should be safe for kmsan. For example, such chain of calls is possible: test_uninit_kmalloc -> kmalloc -> __kmalloc_cache_noprof -> slab_alloc_node -> slab_post_alloc_hook -> kmsan_slab_alloc -> kmsan_internal_poison_memory. Only when it is called in a context without flags present should __GFP_RECLAIM flags be masked. With this change all kmsan tests start working reliably. Eric reported: : Yes, KMSAN seems to be at least partially broken currently. Besides the : fact that the kmsan KUnit test is currently failing (which I reported at : https://lore.kernel.org/r/20250911175145.GA1376@sol), I've confirmed that : the poly1305 KUnit test causes a KMSAN warning with Aleksei's patch : applied but does not cause a warning without it. The warning did get : reached via syzbot somehow : (https://lore.kernel.org/r/751b3d80293a6f599bb07770afcef24f623c7da0.1761026343.git.xiaopei01@kylinos.cn/), : so KMSAN must still work in some cases. But it didn't work for me. Link: https://lkml.kernel.org/r/20250930115600.709776-2-aleksei.nikiforov@linux.ibm.com Link: https://lkml.kernel.org/r/20251022030213.GA35717@sol Fixes: 97769a53f117 ("mm, bpf: Introduce try_alloc_pages() for opportunistic page allocation") Signed-off-by: Aleksei Nikiforov Reviewed-by: Alexander Potapenko Tested-by: Eric Biggers Cc: Alexei Starovoitov Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit fc745ff317566ec299e16346ebb9eacc8fe5b9d2 Author: Kairui Song Date: Wed Oct 22 18:57:19 2025 +0800 mm/shmem: fix THP allocation and fallback loop The order check and fallback loop is updating the index value on every loop. This will cause the index to be wrongly aligned by a larger value while the loop shrinks the order. This may result in inserting and returning a folio of the wrong index and cause data corruption with some userspace workloads [1]. [kasong@tencent.com: introduce a temporary variable to improve code] Link: https://lkml.kernel.org/r/20251023065913.36925-1-ryncsn@gmail.com Link: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20251022105719.18321-1-ryncsn@gmail.com Link: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ [1] Fixes: e7a2ab7b3bb5 ("mm: shmem: add mTHP support for anonymous shmem") Closes: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ Signed-off-by: Kairui Song Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Barry Song Reviewed-by: Lorenzo Stoakes Cc: Dev Jain Cc: Hugh Dickins Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit fa759cd75bce5489eed34596daa53f721849a86f Author: Pasha Tatashin Date: Mon Oct 20 20:08:52 2025 -0400 kho: allocate metadata directly from the buddy allocator KHO allocates metadata for its preserved memory map using the slab allocator via kzalloc(). This metadata is temporary and is used by the next kernel during early boot to find preserved memory. A problem arises when KFENCE is enabled. kzalloc() calls can be randomly intercepted by kfence_alloc(), which services the allocation from a dedicated KFENCE memory pool. This pool is allocated early in boot via memblock. When booting via KHO, the memblock allocator is restricted to a "scratch area", forcing the KFENCE pool to be allocated within it. This creates a conflict, as the scratch area is expected to be ephemeral and overwriteable by a subsequent kexec. If KHO metadata is placed in this KFENCE pool, it leads to memory corruption when the next kernel is loaded. To fix this, modify KHO to allocate its metadata directly from the buddy allocator instead of slab. Link: https://lkml.kernel.org/r/20251021000852.2924827-4-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: David Matlack Cc: Alexander Graf Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit a2fff99f92dae9c0eaf0d75de3def70ec68dad92 Author: Pasha Tatashin Date: Mon Oct 20 20:08:51 2025 -0400 kho: increase metadata bitmap size to PAGE_SIZE KHO memory preservation metadata is preserved in 512 byte chunks which requires their allocation from slab allocator. Slabs are not safe to be used with KHO because of kfence, and because partial slabs may lead leaks to the next kernel. Change the size to be PAGE_SIZE. The kfence specifically may cause memory corruption, where it randomly provides slab objects that can be within the scratch area. The reason for that is that kfence allocates its objects prior to KHO scratch is marked as CMA region. While this change could potentially increase metadata overhead on systems with sparsely preserved memory, this is being mitigated by ongoing work to reduce sparseness during preservation via 1G guest pages. Furthermore, this change aligns with future work on a stateless KHO, which will also use page-sized bitmaps for its radix tree metadata. Link: https://lkml.kernel.org/r/20251021000852.2924827-3-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Christian Brauner Cc: David Matlack Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit e38f65d317df1fd2dcafe614d9c537475ecf9992 Author: Pasha Tatashin Date: Mon Oct 20 20:08:50 2025 -0400 kho: warn and fail on metadata or preserved memory in scratch area Patch series "KHO: kfence + KHO memory corruption fix", v3. This series fixes a memory corruption bug in KHO that occurs when KFENCE is enabled. The root cause is that KHO metadata, allocated via kzalloc(), can be randomly serviced by kfence_alloc(). When a kernel boots via KHO, the early memblock allocator is restricted to a "scratch area". This forces the KFENCE pool to be allocated within this scratch area, creating a conflict. If KHO metadata is subsequently placed in this pool, it gets corrupted during the next kexec operation. Google is using KHO and have had obscure crashes due to this memory corruption, with stacks all over the place. I would prefer this fix to be properly backported to stable so we can also automatically consume it once we switch to the upstream KHO. Patch 1/3 introduces a debug-only feature (CONFIG_KEXEC_HANDOVER_DEBUG) that adds checks to detect and fail any operation that attempts to place KHO metadata or preserved memory within the scratch area. This serves as a validation and diagnostic tool to confirm the problem without affecting production builds. Patch 2/3 Increases bitmap to PAGE_SIZE, so buddy allocator can be used. Patch 3/3 Provides the fix by modifying KHO to allocate its metadata directly from the buddy allocator instead of slab. This bypasses the KFENCE interception entirely. This patch (of 3): It is invalid for KHO metadata or preserved memory regions to be located within the KHO scratch area, as this area is overwritten when the next kernel is loaded, and used early in boot by the next kernel. This can lead to memory corruption. Add checks to kho_preserve_* and KHO's internal metadata allocators (xa_load_or_alloc, new_chunk) to verify that the physical address of the memory does not overlap with any defined scratch region. If an overlap is detected, the operation will fail and a WARN_ON is triggered. To avoid performance overhead in production kernels, these checks are enabled only when CONFIG_KEXEC_HANDOVER_DEBUG is selected. [rppt@kernel.org: fix KEXEC_HANDOVER_DEBUG Kconfig dependency] Link: https://lkml.kernel.org/r/aQHUyyFtiNZhx8jo@kernel.org [pasha.tatashin@soleen.com: build fix] Link: https://lkml.kernel.org/r/CA+CK2bBnorfsTymKtv4rKvqGBHs=y=MjEMMRg_tE-RME6n-zUw@mail.gmail.com Link: https://lkml.kernel.org/r/20251021000852.2924827-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20251021000852.2924827-2-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Signed-off-by: Mike Rapoport Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Christian Brauner Cc: David Matlack Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 77008e1b2ef73249bceb078a321a3ff6bc087afb Author: Zi Yan Date: Thu Oct 16 21:36:30 2025 -0400 mm/huge_memory: do not change split_huge_page*() target order silently Page cache folios from a file system that support large block size (LBS) can have minimal folio order greater than 0, thus a high order folio might not be able to be split down to order-0. Commit e220917fa507 ("mm: split a folio in minimum folio order chunks") bumps the target order of split_huge_page*() to the minimum allowed order when splitting a LBS folio. This causes confusion for some split_huge_page*() callers like memory failure handling code, since they expect after-split folios all have order-0 when split succeeds but in reality get min_order_for_split() order folios and give warnings. Fix it by failing a split if the folio cannot be split to the target order. Rename try_folio_split() to try_folio_split_to_order() to reflect the added new_order parameter. Remove its unused list parameter. [The test poisons LBS folios, which cannot be split to order-0 folios, and also tries to poison all memory. The non split LBS folios take more memory than the test anticipated, leading to OOM. The patch fixed the kernel warning and the test needs some change to avoid OOM.] Link: https://lkml.kernel.org/r/20251017013630.139907-1-ziy@nvidia.com Fixes: e220917fa507 ("mm: split a folio in minimum folio order chunks") Signed-off-by: Zi Yan Reported-by: syzbot+e6367ea2fdab6ed46056@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d2c943.a70a0220.1b52b.02b3.GAE@google.com/ Reviewed-by: Luis Chamberlain Reviewed-by: Pankaj Raghav Reviewed-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Miaohe Lin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jane Chu Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Ryan Roberts Cc: Christian Brauner Cc: Signed-off-by: Andrew Morton commit 237e74bfa261fb0cf75bd08c9be0c5094018ee20 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Fix max supported vCPUs set with EIOINTC VM fails to boot with 256 vCPUs, the detailed command is qemu-system-loongarch64 -smp 256 and there is an error reported as follows: KVM_LOONGARCH_EXTIOI_INIT_NUM_CPU failed: Invalid argument There is typo issue in function kvm_eiointc_ctrl_access() when set max supported vCPUs. Cc: stable@vger.kernel.org Fixes: 47256c4c8b1b ("LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access()") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 11f340ece403e71aa2b643a2562a58ed3ac12e2c Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Skip PMU checking on vCPU context switch PMU hardware about VM is switched on VM exit to host rather than vCPU context sched off, PMU is checked and restored on return to VM. It is not necessary to check PMU on vCPU context sched on callback, since the request is made on the VM exit entry or VM PMU CSR access abort routine already. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 5001bcf86edf2de02f025a0f789bcac37fa040e6 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Restore guest PMU if it is enabled On LoongArch system, guest PMU hardware is shared by guest and host but PMU interrupt is separated. PMU is pass-through to VM, and there is PMU context switch when exit to host and return to guest. There is optimiation to check whether PMU is enabled by guest. If not, it is not necessary to return to guest. However, if it is enabled, PMU context for guest need switch on. Now KVM_REQ_PMU notification is set on vCPU context switch, but it is missing if there is no vCPU context switch while PMU is used by guest VM, so fix it. Cc: Fixes: f4e40ea9f78f ("LoongArch: KVM: Add PMU support for guest") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit d3c9515e4f9d10ccb113adb4809db5cc31e7ef65 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Add delay until timer interrupt injected When timer is fired in oneshot mode, CSR.TVAL will stop with value -1 rather than 0. However when the register CSR.TVAL is restored, it will continue to count down rather than stop there. Now the method is to write 0 to CSR.TVAL, wait to count down for 1 cycle at least, which is 10ns with a timer freq 100MHz, and then retore timer interrupt status. Here add 2 cycles delay to assure that timer interrupt is injected. With this patch, timer selftest case passes to run always. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 37e9d1a91382661c2d1f656b54c5d22dfe7a8606 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Set page with write attribute if dirty track disabled With secondary MMU page table, if there is a read page fault, the page's write attribute will not set even if it is writable from master MMU page table. This logic only works if dirty tracking is enabled, so page table should be set with _PAGE_WRITE if dirty tracking is disabled. It reduces extra page fault on secondary MMU page table if a VM finishes migration, when the master MMU page table is ready and the secondary MMU page is fresh. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 62cda5e54f7c5e773911b458dd4d10ee8c91b60b Author: Qiang Ma Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: kexec: Print out debugging message if required When specifying '-d' for kexec_file_load interface, loaded locations of kernel/initrd/cmdline etc can be printed out to help debug. Commit eb7622d908a0 ("kexec_file, riscv: print out debugging message if required") fixes the same issue on RISC-V. So, remove kexec_image_info() because the content has been printed out in generic code. And on Loongson-3A5000, the printed messages look like below: kexec_file: kernel: 00000000d9aad283 kernel_size: 0x2e77f30 kexec_file(EFI): No LoongArch PE image header. kexec_file: Loaded initrd at 0x80000000 bufsz=0x1637cd0 memsz=0x1638000 kexec_file(ELF): Loaded kernel at 0x9c20000 bufsz=0x27f1800 memsz=0x2950000 kexec_file: nr_segments = 2 kexec_file: segment[0]: buf=0x00000000cc3e6c33 bufsz=0x27f1800 mem=0x9c20000 memsz=0x2950000 kexec_file: segment[1]: buf=0x00000000bb75a541 bufsz=0x1637cd0 mem=0x80000000 memsz=0x1638000 kexec_file: kexec_file_load: type:0, start:0xb15d000 head:0x18db60002 flags:0x8 Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit df16b8956cae970027f4be4a1500272201e2d5c1 Author: Youling Tang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: kexec: Initialize the kexec_buf structure The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data is accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Link: https://lore.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit eeeeaafa62ea0cd4b86390f657dc0aea73bff4f5 Author: Huacai Chen Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Use correct accessor to read FWPC/MWPC CSR.FWPC and CSR.MWPC are 32bit registers, so use csr_read32() rather than csr_read64() to read the values of FWPC/MWPC. Cc: stable@vger.kernel.org Fixes: edffa33c7bb5a73 ("LoongArch: Add hardware breakpoints/watchpoints support") Signed-off-by: Huacai Chen commit 4c8a7c9827726f6e987b7a04af8ef58f1c7fe8d3 Author: Tiezhu Yang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Refine the init_hw_perf_events() function (1) Use the existing CPUCFG6_PMNUM_SHIFT macro definition instead of the magic value 4 to get the PMU number. (2) Detect the value of PMU bits via CPUCFG instruction according to the ISA manual instead of hard-coded as 64, because the value may be different for various micro-architectures. Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#_cpucfg Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 17f838512ae50203ae2e3ce9b9f2689cc67beaa3 Author: Vishal Moola (Oracle) Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Remove __GFP_HIGHMEM masking in pud_alloc_one() Remove the unnecessary __GFP_HIGHMEM masking in pud_alloc_one(), which was introduced with commit 382739797f79ec2 ("loongarch: convert various functions to use ptdescs"). GFP_KERNEL doesn't contain __GFP_HIGHMEM. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Huacai Chen commit a073d637c8cfbfbab39b7272226a3fbf3b887580 Author: Tianyang Zhang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY Now if the PTE/PMD is dirty with _PAGE_DIRTY but without _PAGE_MODIFIED, after {pte,pmd}_modify() we lose _PAGE_DIRTY, then {pte,pmd}_dirty() return false and lead to data loss. This can happen in certain scenarios such as HW PTW doesn't set _PAGE_MODIFIED automatically, so here we need _PAGE_MODIFIED to record the dirty status (_PAGE_DIRTY). The new modification involves checking whether the original PTE/PMD has the _PAGE_DIRTY flag. If it exists, the _PAGE_MODIFIED bit is also set, ensuring that the {pte,pmd}_dirty() interface can always return accurate information. Cc: stable@vger.kernel.org Co-developed-by: Liupu Wang Signed-off-by: Liupu Wang Signed-off-by: Tianyang Zhang commit ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 Author: Huacai Chen Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Consolidate max_pfn & max_low_pfn calculation Now there 5 places which calculate max_pfn & max_low_pfn: 1. in fdt_setup() for FDT systems; 2. in memblock_init() for ACPI systems; 3. in init_numa_memory() for NUMA systems; 4. in arch_mem_init() to recalculate for "mem=" cmdline; 5. in paging_init() to recalculate for NUMA systems. Since memblock_init() is called both for ACPI and FDT systems, move the calculation out of the for_each_efi_memory_desc() loop can eliminate the first case. The last case is very questionable (may be derived from the MIPS/Loongson code) and breaks the "mem=" cmdline, so should be removed. And then the NUMA version of paging_init() can be also eliminated. After consolidation there are 3 places of calculation: 1. in memblock_init() for both ACPI and FDT systems; 2. in init_numa_memory() to recalculate for NUMA systems; 3. in arch_mem_init() to recalculate for the "mem=" cmdline. For all cases the calculation is: max_pfn = PFN_DOWN(memblock_end_of_DRAM()); max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 43a9e6a10bdde32445ad2725f568e08a94e51dc9 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Consolidate early_ioremap()/ioremap_prot() 1. Use phys_addr_t instead of u64, which can work for both 32/64 bits. 2. Check whether the input physical address is above TO_PHYS_MASK (and return NULL if yes) for the DMW version. Note: In theory early_ioremap() also need the TO_PHYS_MASK checking, but the UEFI BIOS pass some DMW virtual addresses. Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 4e67526840fc55917581b90f6a4b65849a616dd8 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but hardware hope physical addresses. Now it works well because the high bits are ignored above PA_BITS (48 bits), but explicitly use physical addresses can avoid potential bugs. So fix it. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit f28abb9f96e65a28d46885afd6b70cfc4d5df5a2 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Clarify 3 MSG interrupt features LoongArch's MSG interrupt features are used across multiple subsystems. Clarify these features to avoid misuse, existing users will be adjusted if necessary. MSGINT: Infrastructure, means the CPU core supports message interupts. Indicated by CPUCFG1.MSGINT. AVECINT: AVEC interrupt controller based on MSGINT, means the CPU chip supports direct message interrupts. Indicated by IOCSR.FEATURES.DMSI. REDIRECTINT: REDIRECT interrupt controller based on MSGINT and AVECINT, means the CPU chip supports redirect message interrupts. Indicated by IOCSR.FEATURES.RMSI. For example: Loongson-3A5000/3C5000 doesn't support MSGINT/AVECINT/REDIRECTINT; Loongson-3A6000 supports MSGINT but doesn't support AVECINT/REDIRECTINT; Loongson-3C6000 supports MSGINT/AVECINT/REDIRECTINT. Signed-off-by: Huacai Chen commit fe4b3a34e9a9654d98d274218dac0270779db0ae Author: Xi Ruoyao Date: Sun Nov 9 16:01:50 2025 +0800 rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags It's used to work around an objtool issue since commit abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference"), but it's then passed to bindgen and cause an error because Clang does not have this option. Fixes: abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference") Acked-by: Miguel Ojeda Tested-by: Mingcong Bai Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9 Author: Joshua Rogers Date: Sat Nov 8 22:59:23 2025 +0800 ksmbd: close accepted socket when per-IP limit rejects connection When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS. Release client_sk before continuing. This bug was found with ZeroPath. Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Acked-by: Namjae Jeon Signed-off-by: Steve French commit e904d81ad1c04394e1cda4610de799a006cc141c Author: Joshua Rogers Date: Fri Nov 7 00:15:37 2025 +0800 smb: server: rdma: avoid unmapping posted recv on accept failure smb_direct_prepare_negotiation() posts a recv and then, if smb_direct_accept_client() fails, calls put_recvmsg() on the same buffer. That unmaps and recycles a buffer that is still posted on the QP., which can lead to device DMA into unmapped or reused memory. Track whether the recv was posted and only return it if it was never posted. If accept fails after a post, leave it for teardown to drain and complete safely. Signed-off-by: Joshua Rogers Acked-by: Namjae Jeon Signed-off-by: Steve French commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 Author: Edward Adam Davis Date: Fri Nov 7 22:01:39 2025 +0800 cifs: client: fix memory leak in smb3_fs_context_parse_param The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 Reported-by: syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Edward Adam Davis Signed-off-by: Steve French commit 79280191c2fd7f24899bbd640003b5389d3c109c Author: Henrique Carvalho Date: Fri Nov 7 18:59:53 2025 -0300 smb: client: fix cifs_pick_channel when channel needs reconnect cifs_pick_channel iterates candidate channels using cur. The reconnect-state test mistakenly used a different variable. This checked the wrong slot and would cause us to skip a healthy channel and to dispatch on one that needs reconnect, occasionally failing operations when a channel was down. Fix by replacing for the correct variable. Fixes: fc43a8ac396d ("cifs: cifs_pick_channel should try selecting active channels") Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit e9a6fb0bcdd7609be6969112f3fbfcce3b1d4a7c Author: Linus Torvalds Date: Sun Nov 9 15:10:19 2025 -0800 Linux 6.18-rc5 commit 9b07cdf86a0b90556f5b68a6b20b35833b558df3 Author: Haotian Zhang Date: Tue Oct 28 11:05:09 2025 +0800 pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() The driver calls fwnode_get_named_child_node() which takes a reference on the child node, but never releases it, which causes a reference leak. Fix by using devm_add_action_or_reset() to automatically release the reference when the device is removed. Fixes: d5282a539297 ("pinctrl: cs42l43: Add support for the cs42l43") Suggested-by: Charles Keepax Signed-off-by: Haotian Zhang Signed-off-by: Linus Walleij commit f850568efe3a7a9ec4df357cfad1f997f0058924 Merge: 3461e958c10521 6a0dddc53f6f04 Author: Linus Torvalds Date: Sun Nov 9 09:29:44 2025 -0800 Merge tag 'i2c-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "Two reverts merged into one commit to handle a regression caused by a wrong cleanup because the underlying implications were unclear" * tag 'i2c-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: muxes: pca954x: Fix broken reset-gpio usage commit 3461e958c1052111f9729d74861cdf44fa2eda61 Merge: 439fc29dfd3b9c 002621a4df3c16 Author: Linus Torvalds Date: Sun Nov 9 09:22:08 2025 -0800 Merge tag 'kbuild-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Strip trailing padding bytes from modules.builtin.modinfo to fix error during modules_install with certain versions of kmod - Drop unused static inline function warning in .c files with clang from W=1 to W=2 - Ensure kernel-doc.py invocations use the PYTHON3 make variable to ensure user's choice of Python interpreter is always respected * tag 'kbuild-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Let kernel-doc.py use PYTHON3 override compiler_types: Move unused static inline functions warning to W=2 kbuild: Strip trailing padding bytes from modules.builtin.modinfo commit 7a39c723b7472b8aaa2e0a67d2b6c7cf1c45cafb Author: Baojun Xu Date: Sat Nov 8 22:23:25 2025 +0800 ALSA: hda/tas2781: Add new quirk for HP new projects Add new vendor_id and subsystem_id in quirk for HP new projects. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251108142325.2563-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 8a4821412cf2c1429fffa07c012dd150f2edf78c Author: Yosry Ahmed Date: Sat Nov 8 00:45:21 2025 +0000 KVM: nSVM: Fix and simplify LBR virtualization handling with nested The current scheme for handling LBRV when nested is used is very complicated, especially when L1 does not enable LBRV (i.e. does not set LBR_CTL_ENABLE_MASK). To avoid copying LBRs between VMCB01 and VMCB02 on every nested transition, the current implementation switches between using VMCB01 or VMCB02 as the source of truth for the LBRs while L2 is running. If L2 enables LBR, VMCB02 is used as the source of truth. When L2 disables LBR, the LBRs are copied to VMCB01 and VMCB01 is used as the source of truth. This introduces significant complexity, and incorrect behavior in some cases. For example, on a nested #VMEXIT, the LBRs are only copied from VMCB02 to VMCB01 if LBRV is enabled in VMCB01. This is because L2's writes to MSR_IA32_DEBUGCTLMSR to enable LBR are intercepted and propagated to VMCB01 instead of VMCB02. However, LBRV is only enabled in VMCB02 when L2 is running. This means that if L2 enables LBR and exits to L1, the LBRs will not be propagated from VMCB02 to VMCB01, because LBRV is disabled in VMCB01. There is no meaningful difference in CPUID rate in L2 when copying LBRs on every nested transition vs. the current approach, so do the simple and correct thing and always copy LBRs between VMCB01 and VMCB02 on nested transitions (when LBRV is disabled by L1). Drop the conditional LBRs copying in __svm_{enable/disable}_lbrv() as it is now unnecessary. VMCB02 becomes the only source of truth for LBRs when L2 is running, regardless of LBRV being enabled by L1, drop svm_get_lbr_vmcb() and use svm->vmcb directly in its place. Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-4-yosry.ahmed@linux.dev Signed-off-by: Paolo Bonzini commit fbe5e5f030c22ae717ee422aaab0e00ea84fab5e Author: Yosry Ahmed Date: Sat Nov 8 00:45:20 2025 +0000 KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() svm_update_lbrv() is called when MSR_IA32_DEBUGCTLMSR is updated, and on nested transitions where LBRV is used. It checks whether LBRV enablement needs to be changed in the current VMCB, and if it does, it also recalculate intercepts to LBR MSRs. However, there are cases where intercepts need to be updated even when LBRV enablement doesn't. Example scenario: - L1 has MSR_IA32_DEBUGCTLMSR cleared. - L1 runs L2 without LBR_CTL_ENABLE (no LBRV). - L2 sets DEBUGCTLMSR_LBR in MSR_IA32_DEBUGCTLMSR, svm_update_lbrv() sets LBR_CTL_ENABLE in VMCB02 and disables intercepts to LBR MSRs. - L2 exits to L1, svm_update_lbrv() is not called on this transition. - L1 clears MSR_IA32_DEBUGCTLMSR, svm_update_lbrv() finds that LBR_CTL_ENABLE is already cleared in VMCB01 and does nothing. - Intercepts remain disabled, L1 reads to LBR MSRs read the host MSRs. Fix it by always recalculating intercepts in svm_update_lbrv(). Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-3-yosry.ahmed@linux.dev Signed-off-by: Paolo Bonzini commit dc55b3c3f61246e483e50c85d8d5366f9567e188 Author: Yosry Ahmed Date: Sat Nov 8 00:45:19 2025 +0000 KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated. The history is complicated, it was correctly cleared for L1 before commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running"). At that point svm_set_msr() started to rely on svm_update_lbrv() to clear the bit, but when nested virtualization is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR changed. Go back to clearing it directly in svm_set_msr(). Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Reported-by: Matteo Rizzo Reported-by: evn@google.com Co-developed-by: Jim Mattson Signed-off-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-2-yosry.ahmed@linux.dev Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit ca00c3af8ede65d16097d322be330146d9231bd2 Merge: 0e5ba55750c1f7 4af235bf645516 Author: Paolo Bonzini Date: Sun Nov 9 08:07:55 2025 +0100 Merge tag 'kvmarm-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm654 fixes for 6.18, take #2 * Core fixes - Fix trapping regression when no in-kernel irqchip is present (20251021094358.1963807-1-sascha.bischoff@arm.com) - Check host-provided, untrusted ranges and offsets in pKVM (20251016164541.3771235-1-vdonnefort@google.com) (20251017075710.2605118-1-sebastianene@google.com) - Fix regression restoring the ID_PFR1_EL1 register (20251030122707.2033690-1-maz@kernel.org - Fix vgic ITS locking issues when LPIs are not directly injected (20251107184847.1784820-1-oupton@kernel.org) * Test fixes - Correct target CPU programming in vgic_lpi_stress selftest (20251020145946.48288-1-mdittgen@amazon.de) - Fix exposure of SCTLR2_EL2 and ZCR_EL2 in get-reg-list selftest (20251023-b4-kvm-arm64-get-reg-list-sctlr-el2-v1-1-088f88ff992a@kernel.org) (20251024-kvm-arm64-get-reg-list-zcr-el2-v1-1-0cd0ff75e22f@kernel.org) * Misc - Update Oliver's email address (20251107012830.1708225-1-oupton@kernel.org) commit 0e5ba55750c1f7fb194a0022b8c887e6413da9b1 Merge: 36567f1de1b332 d0164c161923ac Author: Paolo Bonzini Date: Sun Nov 9 08:07:32 2025 +0100 Merge tag 'kvm-x86-fixes-6.18-rc5' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.18: - Inject #UD if the guest attempts to execute SEAMCALL or TDCALL as KVM doesn't support virtualization the instructions, but the instructions are gated only by VMXON, i.e. will VM-Exit instead of taking a #UD and thus result in KVM exiting to userspace with an emulation error. - Unload the "FPU" when emulating INIT of XSTATE features if and only if the FPU is actually loaded, instead of trying to predict when KVM will emulate an INIT (CET support missed the MP_STATE path). Add sanity checks to detect and harden against similar bugs in the future. - Unregister KVM's GALog notifier (for AVIC) when kvm-amd.ko is unloaded. - Use a raw spinlock for svm->ir_list_lock as the lock is taken during schedule(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. - Remove guest_memfd bindings on memslot deletion when a gmem file is dying to fix a use-after-free race found by syzkaller. - Fix a goof in the EPT Violation handler where KVM checks the wrong variable when determining if the reported GVA is valid. commit 36567f1de1b3324ab0cfef313882842dd3d75524 Merge: 6146a0f1dfae5d 8c5fa3764facaa Author: Paolo Bonzini Date: Sun Nov 9 08:07:03 2025 +0100 Merge tag 'kvm-riscv-fixes-6.18-2' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.18, take #2 - Fix check for local interrupts on riscv32 - Read HGEIP CSR on the correct cpu when checking for IMSIC interrupts - Remove automatic I/O mapping from kvm_arch_prepare_memory_region() commit 002621a4df3c166fab1427e8e502bc15acc26b13 Author: Jean Delvare Date: Fri Nov 7 19:29:33 2025 +0100 kbuild: Let kernel-doc.py use PYTHON3 override It is possible to force a specific version of python to be used when building the kernel by passing PYTHON3= on the make command line. However kernel-doc.py is currently called with python3 hard-coded and thus ignores this setting. Use $(PYTHON3) to run $(KERNELDOC) so that the desired version of python is used. Signed-off-by: Jean Delvare Reviewed-by: Nicolas Schier Reviewed-by: Mauro Carvalho Chehab Link: https://patch.msgid.link/20251107192933.2bfe9e57@endymion Signed-off-by: Nathan Chancellor commit baadf2a5c26e802a46573eaad331b427b49aaa36 Author: Johan Hovold Date: Wed Oct 29 10:30:29 2025 +0100 most: usb: fix double free on late probe failure The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures. Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect") Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization") Cc: stable@vger.kernel.org Cc: Christian Gromm Cc: Victoria Votokina Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e Author: Miaoqian Lin Date: Mon Oct 27 14:06:01 2025 +0800 slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which internally uses device_find_child() to obtain a device reference. According to the device_find_child() documentation, the caller must drop the reference with put_device() after use. Found via static analysis and this is similar to commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable Signed-off-by: Miaoqian Lin Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c Author: Jameson Thies Date: Thu Nov 6 01:14:46 2025 +0000 usb: typec: ucsi: psy: Set max current to zero when disconnected The ucsi_psy_get_current_max function defaults to 0.1A when it is not clear how much current the partner device can support. But this does not check the port is connected, and will report 0.1A max current when nothing is connected. Update ucsi_psy_get_current_max to report 0A when there is no connection. Fixes: af833e7f7db3 ("usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default") Cc: stable@vger.kernel.org Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Reviewed-by: Sebastian Reichel Tested-by: Kenneth R. Crudup Rule: add Link: https://lore.kernel.org/stable/20251017000051.2094101-1-jthies%40google.com Link: https://patch.msgid.link/20251106011446.2052583-1-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 Author: Kuen-Han Tsai Date: Mon Nov 3 20:17:59 2025 +0800 usb: gadget: f_eem: Fix memory leak in eem_unwrap The existing code did not handle the failure case of usb_ep_queue in the command path, potentially leading to memory leaks. Improve error handling to free all allocated resources on usb_ep_queue failure. This patch continues to use goto logic for error handling, as the existing error handling is complex and not easily adaptable to auto-cleanup helpers. kmemleak results: unreferenced object 0xffffff895a512300 (size 240): backtrace: slab_post_alloc_hook+0xbc/0x3a4 kmem_cache_alloc+0x1b4/0x358 skb_clone+0x90/0xd8 eem_unwrap+0x1cc/0x36c unreferenced object 0xffffff8a157f4000 (size 256): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc kmalloc_trace+0x48/0x140 dwc3_gadget_ep_alloc_request+0x58/0x11c usb_ep_alloc_request+0x40/0xe4 eem_unwrap+0x204/0x36c unreferenced object 0xffffff8aadbaac00 (size 128): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc __kmalloc+0x64/0x1a8 eem_unwrap+0x218/0x36c unreferenced object 0xffffff89ccef3500 (size 64): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc kmalloc_trace+0x48/0x140 eem_unwrap+0x238/0x36c Fixes: 4249d6fbc10f ("usb: gadget: eem: fix echo command packet response issue") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20251103121814.1559719-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 46b28d2fbd13148981d91246bc0e13f4fc055987 Author: Heikki Krogerus Date: Fri Nov 7 13:15:47 2025 +0100 usb: dwc3: pci: Sort out the Intel device IDs The PCI device IDs were organised based on the Intel architecture generation in most cases, but not with every ID. That left the device ID table with no real order. Sorting the table based on the device ID. Suggested-by: Thinh Nguyen Cc: stable Signed-off-by: Heikki Krogerus Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251107121548.2702900-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c57ce99ec6cb55b53910b6b3d7437f80159ff9d8 Author: Heikki Krogerus Date: Thu Nov 6 12:59:26 2025 +0100 usb: dwc3: pci: add support for the Intel Nova Lake -S This patch adds the necessary PCI ID for Intel Nova Lake -S devices. Signed-off-by: Heikki Krogerus Cc: stable Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251106115926.2317877-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 40f8d17eed7533ed2bbb5e3cc680049b19411b2e Author: Jamie Iles Date: Fri Nov 7 10:44:37 2025 +0000 drivers/usb/dwc3: fix PCI parent check The sysdev_is_parent check was being used to infer PCI devices that have the DMA mask set from the PCI capabilities, but sysdev_is_parent is also used for non-PCI ACPI devices in which case the DMA mask would be the bus default or as set by the _DMA method. Without this fix the DMA mask would default to 32-bits and so allocation would fail if there was no DRAM below 4GB. Fixes: 47ce45906ca9 ("usb: dwc3: leave default DMA for PCI devices") Cc: stable Signed-off-by: Jamie Iles Signed-off-by: Punit Agrawal Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251107104437.1602509-1-punit.agrawal@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 41e99fe2005182139b1058db71f0d241f8f0078c Author: Desnes Nunes Date: Fri Oct 31 01:34:36 2025 -0300 usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355. When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb's transfer buffer, such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB. Fix the leak by zeroing the CSW data in srb's transfer buffer immediately after the validation of devices that skip data phase. Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages. Fixes: a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") Cc: stable Signed-off-by: Desnes Nunes Reviewed-by: Alan Stern Link: https://patch.msgid.link/20251031043436.55929-1-desnesn@redhat.com Signed-off-by: Greg Kroah-Hartman commit 8c13a7323b847c0370aec66f655e2596a2174a17 Author: Mathias Nyman Date: Fri Nov 7 18:28:18 2025 +0200 xhci: sideband: Fix race condition in sideband unregister Uttkarsh Aggarwal observed a kernel panic during sideband un-register and found it was caused by a race condition between sideband unregister, and creating sideband interrupters. The issue occurrs when thread T1 runs uaudio_disconnect() and released sb->xhci via sideband_unregister, while thread T2 simultaneously accessed the now-NULL sb->xhci in xhci_sideband_create_interrupter() resulting in a crash. Ensure new endpoints or interrupter can't be added to a sidenband after xhci_sideband_unregister() cleared the existing ones, and unlocked the sideband mutex. Reorganize code so that mutex is only taken and released once in xhci_sideband_unregister(), and clear sb->vdev while mutex is taken. Use mutex guards to reduce human unlock errors in code Refuse to add endpoints or interrupter if sb->vdev is not set. sb->vdev is set when sideband is created and registered. Reported-by: Uttkarsh Aggarwal Closes: https://lore.kernel.org/linux-usb/20251028080043.27760-1-uttkarsh.aggarwal@oss.qualcomm.com Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f6bb3b67be9af0cfb90075c60850b6af5338a508 Author: Mathias Nyman Date: Fri Nov 7 18:28:17 2025 +0200 xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Data read from a DbC device may be corrupted due to a race between ongoing write and write request completion handler both queuing new transfer blocks (TRBs) if there are remining data in the kfifo. TRBs may be in incorrct order compared to the data in the kfifo. Driver fails to keep lock between reading data from kfifo into a dbc request buffer, and queuing the request to the transfer ring. This allows completed request to re-queue itself in the middle of an ongoing transfer loop, forcing itself between a kfifo read and request TRB write of another request cpu0 cpu1 (re-queue completed req2) lock(port_lock) dbc_start_tx() kfifo_out(fifo, req1->buffer) unlock(port_lock) lock(port_lock) dbc_write_complete(req2) dbc_start_tx() kfifo_out(fifo, req2->buffer) unlock(port_lock) lock(port_lock) req2->trb = ring->enqueue; ring->enqueue++ unlock(port_lock) lock(port_lock) req1->trb = ring->enqueue; ring->enqueue++ unlock(port_lock) In the above scenario a kfifo containing "12345678" would read "1234" to req1 and "5678" to req2, but req2 is queued before req1 leading to data being transmitted as "56781234" Solve this by adding a flag that prevents starting a new tx if we are already mid dbc_start_tx() during the unlocked part. The already running dbc_do_start_tx() will make sure the newly completed request gets re-queued as it is added to the request write_pool while holding the lock. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b69dfcab6894b1fed5362a364411502a7469fce3 Author: Mathias Nyman Date: Fri Nov 7 18:28:16 2025 +0200 xhci: fix stale flag preventig URBs after link state error is cleared A usb device caught behind a link in ss.Inactive error state needs to be reset to recover. A VDEV_PORT_ERROR flag is used to track this state, preventing new transfers from being queued until error is cleared. This flag may be left uncleared if link goes to error state between two resets, and print the following message: "xhci_hcd 0000:00:14.0: Can't queue urb, port error, link inactive" Fix setting and clearing the flag. The flag is cleared after hub driver has successfully reset the device when hcd->reset_device is called. xhci-hcd issues an internal "reset device" command in this callback, and clear all flags once the command completes successfully. This command may complete with a context state error if slot was recently reset and is already in the defauilt state. This is treated as a success but flag was left uncleared. The link state field is also unreliable if port is currently in reset, so don't set the flag in active reset cases. Also clear the flag immediately when link is no longer in ss.Inactive state and port event handler detects a completed reset. This issue was discovered while debugging kernel bugzilla issue 220491. It is likely one small part of the problem, causing some of the failures, but root cause remains unknown Link: https://bugzilla.kernel.org/show_bug.cgi?id=220491 Fixes: b8c3b718087b ("usb: xhci: Don't try to recover an endpoint if port is in error state.") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 439fc29dfd3b9c072dfff292d91cfa2f6cfb702b Merge: 41d318c47fa209 411336159064c5 Author: Linus Torvalds Date: Sat Nov 8 15:37:03 2025 -0800 Merge tag 'drm-fixes-2025-11-09' of https://gitlab.freedesktop.org/drm/kernel Pull drm fix from Dave Airlie: "Brown paper bag, the dma mask fix which I applied and actually looked through for bad things, actually broke newer GPUs, there might be some latent part in the boot path that is assuming 32-bit still, but we will figure that out elsewhere. nouveau: - revert DMA mask change" * tag 'drm-fixes-2025-11-09' of https://gitlab.freedesktop.org/drm/kernel: Revert "drm/nouveau: set DMA mask before creating the flush page" commit 41d318c47fa2090dbca7329037e5d63abeddebdf Merge: 7bb4d6512545a7 162f24cbb0f6ec Author: Linus Torvalds Date: Sat Nov 8 15:34:23 2025 -0800 Merge tag 'rtc-6.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "The two reverts are for patches that I shouldn't have applied. The rx8025 patch fixes an issue present since 2022: - cpcap, tps6586x: revert incorrect irq enable/disable balance fix - rx8025: fix incorrect register reference" * tag 'rtc-6.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: rx8025: fix incorrect register reference Revert "rtc: cpcap: Fix initial enable_irq/disable_irq balance" Revert "rtc: tps6586x: Fix initial enable_irq/disable_irq balance" commit 162f24cbb0f6ec596e7e9f3e91610d79dc805229 Author: Yuta Hayama Date: Wed Oct 15 12:07:05 2025 +0900 rtc: rx8025: fix incorrect register reference This code is intended to operate on the CTRL1 register, but ctrl[1] is actually CTRL2. Correctly, ctrl[0] is CTRL1. Signed-off-by: Yuta Hayama Fixes: 71af91565052 ("rtc: rx8025: fix 12/24 hour mode detection on RX-8035") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/eae5f479-5d28-4a37-859d-d54794e7628c@lineo.co.jp Signed-off-by: Alexandre Belloni commit 7bb4d6512545a792a6cd8d6c8be5718920b9b11a Merge: 0d7bee10beeb59 4012abe8a78fbb Author: Linus Torvalds Date: Sat Nov 8 10:17:30 2025 -0800 Merge tag 'v6.18rc4-SMB-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix change notify packet validation check - Refcount fix (e.g. rename error paths) - Fix potential UAF due to missing locks on directory lease refcount * tag 'v6.18rc4-SMB-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: validate change notify buffer before copy smb: client: fix refcount leak in smb2_set_path_attr smb: client: fix potential UAF in smb2_close_cached_fid() commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc Author: Hamza Mahfooz Date: Wed Nov 5 11:25:46 2025 -0800 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it. Unable to allocate struct scsi_host BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0 ... Cc: stable@vger.kernel.org Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs") Signed-off-by: Hamza Mahfooz Reviewed-by: Chaitanya Kulkarni Reviewed-by: Allen Pais Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com Signed-off-by: Martin K. Petersen commit 0d7bee10beeb59b1133bf5a4749b17a4ef3bbb01 Merge: b5c0946029200d d23550efc68008 Author: Linus Torvalds Date: Sat Nov 8 09:01:11 2025 -0800 Merge tag 'x86-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix AMD PCI root device caching regression that triggers on certain firmware variants - Fix the zen5_rdseed_microcode[] array to be NULL-terminated - Add more AMD models to microcode signature checking * tag 'x86-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Add more known models to entry sign checking x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode x86/amd_node: Fix AMD root device caching commit b5c0946029200d93f1239d3f310efa3f075abf79 Merge: 133262cae98fcc 956dfda6a70885 Author: Linus Torvalds Date: Sat Nov 8 08:59:05 2025 -0800 Merge tag 'sched-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a group-throttling bug in the fair scheduler" * tag 'sched-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Prevent cfs_rq from being unthrottled with zero runtime_remaining commit 133262cae98fcc0d36fec97213b69268eb166fd5 Merge: e6f55fe790a698 eb3182ef0405ff Author: Linus Torvalds Date: Sat Nov 8 08:54:13 2025 -0800 Merge tag 'perf-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix a system hang caused by cpu-clock events deadlock" * tag 'perf-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix system hang caused by cpu-clock usage commit e6f55fe790a698aba6f98bf6ae4f1c04246c5040 Merge: 3636cfa745e6a4 4cb5ac2626b570 Author: Linus Torvalds Date: Sat Nov 8 08:51:22 2025 -0800 Merge tag 'locking-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix (well, cut in half) a futex performance regression on PowerPC" * tag 'locking-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Optimize per-cpu reference counting commit 3636cfa745e6a4ff0142e29068750439059867b0 Merge: e284d5118ac3e4 146eb58629f45f Author: Linus Torvalds Date: Sat Nov 8 08:47:31 2025 -0800 Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Single fix in there, fixing an overflow in calculating the needed segments for converting into a bvec array" * tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix regbuf vector size truncation commit e284d5118ac3e430da32820215c08b2787de8eef Merge: e811c33b1f137b d8a823c6f04ef0 Author: Linus Torvalds Date: Sat Nov 8 08:43:01 2025 -0800 Merge tag 'xfs-fixes-6.18-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This contain fixes for the RT and zoned allocator, and a few fixes for atomic writes" * tag 'xfs-fixes-6.18-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: free xfs_busy_extents structure when no RT extents are queued xfs: fix zone selection in xfs_select_open_zone_mru xfs: fix a rtgroup leak when xfs_init_zone fails xfs: fix various problems in xfs_atomic_write_cow_iomap_begin xfs: fix delalloc write failures in software-provided atomic writes commit 4af235bf645516481a82227d82d1352b9788903a Author: Oliver Upton Date: Thu Nov 6 17:28:25 2025 -0800 MAINTAINERS: Switch myself to using kernel.org address I've been running into issues with the linux.dev email semi-periodically, switching to my kernel.org address while I go figure out a better home for my inbox. Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107012830.1708225-1-oupton@kernel.org Signed-off-by: Marc Zyngier commit 66768669f27d98b45b20ed401cca913c387a9934 Author: Oliver Upton Date: Fri Nov 7 10:48:47 2025 -0800 KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock xa_release() expects to be called outside of the xa_lock. Fix vgic_add_lpi() to drop the lock before calling and restructure to get rid of the goto label. Reported-by: Zenghui Yu Closes: https://lore.kernel.org/kvmarm/d0853e82-7d95-5025-7abf-c6f1e0cdf7b5@huawei.com/ Fixes: 481c9ee846d2 ("KVM: arm64: vgic-its: Get rid of the lpi_list_lock") Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107184847.1784820-3-oupton@kernel.org Signed-off-by: Marc Zyngier commit 75360a9a338580990c1ee188d40a838c025bbd30 Author: Oliver Upton Date: Fri Nov 7 10:48:46 2025 -0800 KVM: arm64: vgic-v3: Reinstate IRQ lock ordering for LPI xarray Zenghui reports that running a KVM guest with an assigned device and lockdep enabled produces an unfriendly splat due to an inconsistent irq context when taking the lpi_xa's spinlock. This is no good as in rare cases the last reference to an LPI can get dropped after injection of a cached LPI translation. In this case, vgic_put_irq() will release the IRQ struct and take the lpi_xa's spinlock to erase it from the xarray. Reinstate the IRQ ordering and update the lockdep hint accordingly. Note that there is no irqsave equivalent of might_lock(), so just explictly grab and release the spinlock on lockdep kernels. Reported-by: Zenghui Yu Closes: https://lore.kernel.org/kvmarm/b4d7cb0f-f007-0b81-46d1-998b15cc14bc@huawei.com/ Fixes: 982f31bbb5b0 ("KVM: arm64: vgic-v3: Don't require IRQs be disabled for LPI xarray lock") Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107184847.1784820-2-oupton@kernel.org Signed-off-by: Marc Zyngier commit 50e7cce81b9b2fbd6f0104c1698959d45ce3cf58 Author: Marc Zyngier Date: Thu Oct 30 12:27:07 2025 +0000 KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip Now that the idreg's GIC field is in sync with the irqchip, limit the runtime clearing of these fields to the pathological case where we do not have an in-kernel GIC. While we're at it, use the existing API instead of open-coded accessors to access the ID regs. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 8a9866ff860052efc5f9766f3f87fae30c983156 Author: Marc Zyngier Date: Thu Oct 30 12:27:06 2025 +0000 KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured Drive the idreg fields indicating the presence of GICv3 directly from the vgic code. This avoids having to do any sort of runtime clearing of the idreg. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-3-maz@kernel.org Signed-off-by: Marc Zyngier commit 3f9eacf4f0705876a5d6526d7d320ca91d7d7a16 Author: Marc Zyngier Date: Thu Oct 30 12:27:05 2025 +0000 KVM: arm64: Make all 32bit ID registers fully writable 32bit ID registers aren't getting much love these days, and are often missed in updates. One of these updates broke restoring a GICv2 guest on a GICv3 machine. Instead of performing a piecemeal fix, just bite the bullet and make all 32bit ID regs fully writable. KVM itself never relies on them for anything, and if the VMM wants to mess up the guest, so be it. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reported-by: Peter Maydell Cc: stable@vger.kernel.org Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-2-maz@kernel.org Signed-off-by: Marc Zyngier commit 411336159064c5e89e8b89d30c6855db4bb92814 Author: Dave Airlie Date: Sat Nov 8 19:41:09 2025 +1000 Revert "drm/nouveau: set DMA mask before creating the flush page" This reverts commit ebe755605082eddff80eafe0c50915b1366ee98f. Tested the latest kernel on my GB203 and this seems to break it somehow. Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: gsp: GSP-FMC boot failed (mbox: 0x0000000b) Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: gsp: init failed, -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: init failed with -5 Nov 09 04:16:14 bighp kernel: nouveau: drm:00000000:00000080: init failed with -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: drm: Device allocation failed: -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: probe with driver nouveau failed with error -5 Not sure why, I went over the patch and thought it should have worked, but there must be some 32-bit problem maybe in the FMC boot path. Signed-off-by: Dave Airlie commit 96a9178a29a6b84bb632ebeb4e84cf61191c73d5 Author: Horatiu Vultur Date: Thu Nov 6 10:06:37 2025 +0100 net: phy: micrel: lan8814 fix reset of the QSGMII interface The lan8814 is a quad-phy and it is using QSGMII towards the MAC. The problem is that everytime when one of the ports is configured then the PCS is reseted for all the PHYs. Meaning that the other ports can loose traffic until the link is establish again. To fix this, do the reset one time for the entire PHY package. Fixes: ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Reviewed-by: Divya Koppera Link: https://patch.msgid.link/20251106090637.2030625-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit ad17e7e92a7c52ce70bb764813fcf99464f96903 Author: Wei Fang Date: Thu Nov 6 10:14:21 2025 +0800 net: fec: correct rx_bytes statistic for the case SHIFT16 is set Two additional bytes in front of each frame received into the RX FIFO if SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len to correct the statistic of rx_bytes. Fixes: 3ac72b7b63d5 ("net: fec: align IP header in hardware") Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251106021421.2096585-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 57531b3416448d1ced36a2a974a4085ec43d57b0 Author: Alexander Sverdlin Date: Thu Nov 6 17:12:09 2025 +0100 selftests: net: local_termination: Wait for interfaces to come up It seems that most of the tests prepare the interfaces once before the test run (setup_prepare()), rely on setup_wait() to wait for link and only then run the test(s). local_termination brings the physical interfaces down and up during test run but never wait for them to come up. If the auto-negotiation takes some seconds, first test packets are being lost, which leads to false-negative test results. Use setup_wait() in run_test() to make sure auto-negotiation has been completed after all simple_if_init() calls on physical interfaces and test packets will not be lost because of the race against link establishment. Fixes: 90b9566aa5cd3f ("selftests: forwarding: add a test for local_termination.sh") Reviewed-by: Vladimir Oltean Signed-off-by: Alexander Sverdlin Link: https://patch.msgid.link/20251106161213.459501-1-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee Author: Nate Karstens Date: Thu Nov 6 16:28:33 2025 -0600 strparser: Fix signed/unsigned mismatch bug The `len` member of the sk_buff is an unsigned int. This is cast to `ssize_t` (a signed type) for the first sk_buff in the comparison, but not the second sk_buff. On 32-bit systems, this can result in an integer underflow for certain values because unsigned arithmetic is being used. This appears to be an oversight: if the intention was to use unsigned arithmetic, then the first cast would have been omitted. The change ensures both len values are cast to `ssize_t`. The underflow causes an issue with ktls when multiple TLS PDUs are included in a single TCP segment. The mainline kernel does not use strparser for ktls anymore, but this is still useful for other features that still use strparser, and for backporting. Signed-off-by: Nate Karstens Cc: stable@vger.kernel.org Fixes: 43a0c6751a32 ("strparser: Stream parser for messages") Reviewed-by: Jacob Keller Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com Signed-off-by: Jakub Kicinski commit dc20452e6caf962f04ede7f364267b0c37784ab4 Author: Nathan Chancellor Date: Fri Nov 7 14:56:59 2025 -0700 riscv: Fix CONFIG_AS_HAS_INSN for new .insn usage After commit 44aa25c000b4 ("riscv: asm: use .insn for making custom instructions"), builds using LLVM older that 19 or binutils older than 2.38 fail with: arch/riscv/include/asm/vdso/processor.h: Assembler messages: arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' make[4]: *** [scripts/Makefile.build:287: arch/riscv/kernel/vdso/vgettimeofday.o] Error 1 In file included from :4: In file included from lib/vdso/gettimeofday.c:6: In file included from include/vdso/datapage.h:21: In file included from include/vdso/processor.h:10: arch/riscv/include/asm/vdso/processor.h:23:2: error: expected instruction format 23 | ALT_RISCV_PAUSE(); | ^ arch/riscv/include/asm/errata_list.h:47:3: note: expanded from macro 'ALT_RISCV_PAUSE' 47 | RISCV_PAUSE, /* Original RISC‑V pause insn */ \ | ^ arch/riscv/include/asm/insn-def.h:259:21: note: expanded from macro 'RISCV_PAUSE' 259 | #define RISCV_PAUSE ASM_INSN_I("0x100000f") | ^ arch/riscv/include/asm/asm.h:16:26: note: expanded from macro 'ASM_INSN_I' 16 | #define ASM_INSN_I(__x) ".insn " __x | ^ :5:7: note: instantiated into assembly here 5 | .insn 0x100000f | ^ binutils gained support for '.insn ' in 2.38 [1] and LLVM gained support in 19 [2]. Adjust the test for CONFIG_AS_HAS_INSN to ensure that all versions of .insn are supported before being used. Fixes: 44aa25c000b4 ("riscv: asm: use .insn for making custom instructions") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=a262b82fdbf4cda3b0648b1adc32245ca3f78b7a [1] Link: https://github.com/llvm/llvm-project/commit/2a086dce691e3cc34a2fc27f4fb255bb2cbbfac9 [2] Suggested-by: Andrew Jones Signed-off-by: Nathan Chancellor Reviewed-by: Andrew Jones Link: https://patch.msgid.link/20251107-riscv-fix-new-insn-usage-v1-1-9a186c5928a0@kernel.org Signed-off-by: Paul Walmsley commit 5e8632987dd1882ed4d1e1039032ab1b0c1ec12b Author: Feng Jiang Date: Wed Oct 29 17:44:29 2025 +0800 riscv: Remove redundant judgment for the default build target The value of KBUILD_IMAGE is derived from $(boot-image-y), so there's no need for redundant checks before this. Signed-off-by: Feng Jiang Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20251029094429.553842-2-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 3ad1b71fdc5707d14332d9ae710a237de936be9b Author: Feng Jiang Date: Wed Oct 29 17:44:28 2025 +0800 riscv: Build loader.bin exclusively for Canaan K210 According to the explanation in commit ef10bdf9c3e6 ("riscv: Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), loader.bin is a special feature of the Canaan K210 and is not applicable to other SoCs. Fixes: e79dfcbfb902 ("riscv: make image compression configurable") Signed-off-by: Feng Jiang Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 146eb58629f45f8297e83d69e64d4eea4b28d972 Author: Pavel Begunkov Date: Fri Nov 7 18:41:26 2025 +0000 io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top. Cc: stable@vger.kernel.org Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers") Reported-by: Google Big Sleep Signed-off-by: Pavel Begunkov Reviewed-by: Günther Noack Tested-by: Günther Noack Signed-off-by: Jens Axboe commit e811c33b1f137be26a20444b79db8cbc1fca1c89 Merge: 38a2c275c3d3f7 d439acbbfb9a98 Author: Linus Torvalds Date: Fri Nov 7 14:51:11 2025 -0800 Merge tag 'drm-fixes-2025-11-08' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Back from travel, thanks to Simona for handling things. regular fixes, seems about the right size, but spread out a bit. amdgpu has the usual range of fixes, xe has a few fixes, and nouveau has a couple of fixes, one for blackwell modifiers on 8/16 bit surfaces. Otherwise a few small fixes for mediatek, sched, imagination and pixpaper. sched: - Fix deadlock amdgpu: - Reset fixes - Misc fixes - Panel scaling fixes - HDMI fix - S0ix fixes - Hibernation fix - Secure display fix - Suspend fix - MST fix amdkfd: - Process cleanup fix xe: - Fix missing synchronization on unbind - Fix device shutdown when doing FLR - Fix user fence signaling order i915: - Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - Fix conversion between clock ticks and nanoseconds mediatek: - Disable AFBC support on Mediatek DRM driver - Add pm_runtime support for GCE power control imagination: - kconfig: Fix dependencies nouveau: - Set DMA mask earlier - Advertize correct modifiers for GB20x pixpaper: - kconfig: Fix dependencies" * tag 'drm-fixes-2025-11-08' of https://gitlab.freedesktop.org/drm/kernel: (26 commits) drm/xe: Enforce correct user fence signaling order using drm/xe: Do clean shutdown also when using flr drm/xe: Move declarations under conditional branch drm/xe/guc: Synchronize Dead CT worker with unbind drm/amd/display: Enable mst when it's detected but yet to be initialized drm/amdgpu: Fix wait after reset sequence in S3 drm/amd: Fix suspend failure with secure display TA drm/amdgpu: fix gpu page fault after hibernation on PF passthrough drm/tiny: pixpaper: add explicit dependency on MMU drm/nouveau: Advertise correct modifiers on GB20x drm: define NVIDIA DRM format modifiers for GB20x drm/nouveau: set DMA mask before creating the flush page drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb drm/amd/display: Fix NULL deref in debugfs odm_combine_segments drm/amdkfd: Don't clear PT after process killed drm/amdgpu/smu: Handle S0ix for vangogh drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() drm/amd/display: Fix black screen with HDMI outputs drm/amd/display: Don't stretch non-native images by default in eDP drm/amd/pm: fix missing device_attr cleanup in amdgpu_pm_sysfs_init() ... commit d439acbbfb9a982f152c5f806b4592431a80c4fd Merge: a18033f1309cdf 0995c2fc39b0f9 Author: Dave Airlie Date: Sat Nov 8 07:39:11 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-07' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix missing synchronization on unbind (Balasubramani Vivekanandan) - Fix device shutdown when doing FLR (Jouni Högander) - Fix user fence signaling order (Matthew Brost) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/mvfyflloncy76a7nmkatpj6f2afddavwsibz3y4u4wo6gznro5@rdulkuh5wvje commit 38a2c275c3d3f7d7180d012386cd6fcf87854400 Merge: a2e33fb92649f4 fd9f30d1038ee1 Author: Linus Torvalds Date: Fri Nov 7 13:19:18 2025 -0800 Merge tag 'parisc-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: - fix crash triggered by unaligned access in parisc unwinder * tag 'parisc-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Avoid crash due to unaligned access in unwinder commit a2e33fb92649f4efcc9e81c1d1a1905ca2a76d03 Merge: da32d155f4a893 afb47765f92351 Author: Linus Torvalds Date: Fri Nov 7 13:13:09 2025 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: - Syzkaller found a case where maths overflows can cause divide by 0 - Typo in a compiler bug warning fix in the selftests broke the selftests - type1 compatability had a mismatch when unmapping an already unmapped range, it should succeed * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Make vfio_compat's unmap succeed if the range is already empty iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents() iommufd: Don't overflow during division for dirty tracking commit 4b93d211bbffd3dce76664d95f2306d23e7215ce Author: Kaushlendra Kumar Date: Thu Oct 30 08:02:28 2025 +0530 ACPI: MRRM: Fix memory leaks and improve error handling Add proper error handling and resource cleanup to prevent memory leaks in add_boot_memory_ranges(). The function now checks for NULL return from kobject_create_and_add(), uses local buffer for range names to avoid dynamic allocation, and implements a cleanup path that removes previously created sysfs groups and kobjects on failure. This prevents resource leaks when kobject creation or sysfs group creation fails during boot memory range initialization. Signed-off-by: Kaushlendra Kumar Reviewed-by: Tony Luck Link: https://patch.msgid.link/20251030023228.3956296-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 2cf95b9baa52262bfb645cb3c04f902dd50c29e2 Author: Shubhrajyoti Datta Date: Thu Oct 23 17:01:08 2025 +0530 EDAC/versalnet: Handle split messages for non-standard errors The current code assumes that only DDR errors have split messages. Ensure proper logging of non-standard event errors that may be split across multiple messages too. [ bp: Massage, move comment too, fix it up. ] Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251023113108.3467132-1-shubhrajyoti.datta@amd.com commit 9818af18db4bfefd320d0fef41390a616365e6f7 Author: Peter Zijlstra Date: Thu Nov 6 11:50:00 2025 +0100 compiler_types: Move unused static inline functions warning to W=2 Per Nathan, clang catches unused "static inline" functions in C files since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build"). Linus said: > So I entirely ignore W=1 issues, because I think so many of the extra > warnings are bogus. > > But if this one in particular is causing more problems than most - > some teams do seem to use W=1 as part of their test builds - it's fine > to send me a patch that just moves bad warnings to W=2. > > And if anybody uses W=2 for their test builds, that's THEIR problem.. Here is the change to bump the warning from W=1 to W=2. Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") Signed-off-by: Peter Zijlstra Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com [nathan: Adjust comment as well] Signed-off-by: Nathan Chancellor commit 0fce75870666b46b700cfbd3216380b422f975da Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:44 2025 +0530 ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPU via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function cppc_perf_ctrs_in_pcc() checks if the CPPC perf-ctrs are in a PCC region for all the present CPUs, which breaks when the kernel is booted with "nosmt=force". Hence, limit the check only to the online CPUs. Fixes: ae2df912d1a5 ("ACPI: CPPC: Disable FIE if registers in PCC regions") Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-5-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 8821c8e80a65bc4eb73daf63b34aac6b8ad69461 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:43 2025 +0530 ACPI: CPPC: Perform fast check switch only for online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function cppc_allow_fast_switch() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force". Check fast_switch capability only on online CPUs Fixes: 15eece6c5b05 ("ACPI: CPPC: Fix NULL pointer dereference when nosmp is used") Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-4-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 6dd3b8a709a130a4d55c866af9804c81b8486d28 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:42 2025 +0530 ACPI: CPPC: Check _CPC validity for only the online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function acpi_cpc_valid() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force". Hence check the validity of the _CPC objects of only the online CPUs. Fixes: 2aeca6bd0277 ("ACPI: CPPC: Check present CPUs for determining _CPC is valid") Reported-by: Christopher Harris Closes: https://lore.kernel.org/lkml/CAM+eXpdDT7KjLV0AxEwOLkSJ2QtrsvGvjA2cCHvt1d0k2_C4Cw@mail.gmail.com/ Suggested-by: Mario Limonciello Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Tested-by: Chrisopher Harris Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-3-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 4fe5934db4a7187d358f1af1b3ef9b6dd59bce58 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:41 2025 +0530 ACPI: CPPC: Detect preferred core availability on online CPUs Commit 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") introduced the ability to detect the preferred core on AMD platforms by checking if there at least two distinct highest_perf values. However, it uses for_each_present_cpu() to iterate through all the CPUs in the platform, which is problematic when the kernel is booted with "nosmt=force" commandline option. Hence limit the search to only the online CPUs. Fixes: 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") Reported-by: Christopher Harris Closes: https://lore.kernel.org/lkml/CAM+eXpdDT7KjLV0AxEwOLkSJ2QtrsvGvjA2cCHvt1d0k2_C4Cw@mail.gmail.com/ Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Tested-by: Chrisopher Harris Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-2-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit b6cfddd26ec55e865b4715f73e9bbb17a15091ed Author: Dave Jiang Date: Fri Oct 31 10:32:24 2025 -0700 cxl: Adjust offset calculation for poison injection The HPA to DPA translation for poison injection assumes that the base address starts from where the CXL region begins. When the extended linear cache is active, the offset can be within the DRAM region. Adjust the offset so that it correctly reflects the offset within the CXL region. [ dj: Add fixes tag from Alison ] Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset") Link: https://patch.msgid.link/20251031173224.3537030-5-dave.jiang@intel.com Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 4012abe8a78fbb8869634130024266eaef7081fe Author: Joshua Rogers Date: Fri Nov 7 00:09:37 2025 +0800 smb: client: validate change notify buffer before copy SMB2_change_notify called smb2_validate_iov() but ignored the return code, then kmemdup()ed using server provided OutputBufferOffset/Length. Check the return of smb2_validate_iov() and bail out on error. Discovered with help from the ZeroPath security tooling. Signed-off-by: Joshua Rogers Reviewed-by: Paulo Alcantara (Red Hat) Cc: stable@vger.kernel.org Fixes: e3e9463414f61 ("smb3: improve SMB3 change notification support") Signed-off-by: Steve French commit da32d155f4a8937952ca6fd55d3270fec1c3799f Merge: 5b95a50001f1fb 4436f484cb437b Author: Linus Torvalds Date: Fri Nov 7 08:10:55 2025 -0800 Merge tag 'gpio-fixes-for-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use the firmware node of the GPIO chip, not its label for software node lookup - fix invalid pointer access in GPIO debugfs - drop unused functions from gpio-tb10x - fix a regression in gpio-aggregator: restore the set_config() callback in the driver - correct schema $id path in ti,twl4030 DT bindings * tag 'gpio-fixes-for-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: tb10x: Drop unused tb10x_set_bits() function gpio: aggregator: restore the set_config operation gpiolib: fix invalid pointer access in debugfs gpio: swnode: don't use the swnode's name as the key for GPIO lookup dt-bindings: gpio: ti,twl4030: Correct the schema $id path commit 5b95a50001f1fbcae6b7fe211a02f37a04dd9a4b Merge: a80abfbb1013ff 53afec2c8fb2a5 Author: Linus Torvalds Date: Fri Nov 7 08:07:11 2025 -0800 Merge tag 'trace-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Check for reader catching up in ring_buffer_map_get_reader() If the reader catches up to the writer in the memory mapped ring buffer then calling rb_get_reader_page() will return NULL as there's no pages left. But this isn't checked for before calling rb_get_reader_page() and the return of NULL causes a warning. If it is detected that the reader caught up to the writer, then simply exit the routine - Fix memory leak in histogram create_field_var() The couple of the error paths in create_field_var() did not properly clean up what was allocated. Make sure everything is freed properly on error - Fix help message of tools latency_collector The help message incorrectly stated that "-t" was the same as "--threads" whereas "--threads" is actually represented by "-e" * tag 'trace-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/tools: Fix incorrcet short option in usage text for --threads tracing: Fix memory leaks in create_field_var() ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up commit a80abfbb1013ffec7aa7e574b5ba9bcf02bd5462 Merge: 9dc520632a0dd3 c379b745e12a99 Author: Linus Torvalds Date: Fri Nov 7 08:01:58 2025 -0800 Merge tag 'slab-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix for potential infinite loop in kmalloc_nolock() when debugging is enabled for the cache (Vlastimil Babka) * tag 'slab-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: prevent infinite loop in kmalloc_nolock() with debugging commit 0b6c10cb8479d0d1b7b208277df2e2afe082d4bd Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:07 2025 -0600 PM: hibernate: Fix style issues in save_compressed_image() Address two issues indicated by checkpatch: - Trailing statements should be on next line. - Prefer 'unsigned int' to bare use of 'unsigned'. Signed-off-by: Mario Limonciello (AMD) [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251106045158.3198061-4-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:06 2025 -0600 PM: hibernate: Use atomic64_t for compressed_size variable `compressed_size` can overflow, showing nonsensical values. Change from `atomic_t` to `atomic64_t` to prevent overflow. Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ Signed-off-by: Mario Limonciello (AMD) Tested-by: Askar Safin Cc: 6.9+ # 6.9+ Link: https://patch.msgid.link/20251106045158.3198061-3-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:05 2025 -0600 PM: hibernate: Emit an error when image writing fails If image writing fails, a return code is passed up to the caller, but none of the callers log anything to the log and so the only record of it is the return code that userspace gets. Adjust the logging so that the image size and speed of writing is only emitted on success and if there is an error, it's saved to the logs. Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ Signed-off-by: Mario Limonciello (AMD) Tested-by: Askar Safin Cc: 6.9+ # 6.9+ [ rjw: Added missing braces after "else", changelog edits ] Link: https://patch.msgid.link/20251106045158.3198061-2-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 9dc520632a0dd3bdc37540528040771a96bdc8ff Merge: 11a6afabb4b38e 1fd5367391bf0e Author: Linus Torvalds Date: Fri Nov 7 07:52:45 2025 -0800 Merge tag 'io_uring-6.18-20251106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Remove the sync refill API that was added in this release, in anticipation of doing it in a better way for the next release - Fix type extension for calculating size off nr_pages, like we do in other spots * tag 'io_uring-6.18-20251106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix types for region size calulation io_uring/zcrx: remove sync refill uapi commit 11a6afabb4b38e70b6d697fd90fddedb9ad0ec43 Merge: cff0a1be08ae4e a2b32bc1d9e359 Author: Linus Torvalds Date: Fri Nov 7 07:47:08 2025 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes in the UFS driver. The big contributor to the diffstats is the Intel controller S0ix/S3 fix which has to special case the suspend/resume patch for intel controllers in ufshcd-pci.c" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix invalid probe error return value scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL scsi: ufs: core: Add a quirk to suppress link_startup_again scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers scsi: ufs: core: Revert "Make HID attributes visible" scsi: ufs: core: Reduce link startup failure logging scsi: ufs: core: Fix a race condition related to the "hid" attribute group scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) commit cff0a1be08ae4ee609362fc6500cec4724e79e18 Merge: 4a0c9b33919998 e6187655acfa2d Author: Linus Torvalds Date: Fri Nov 7 07:39:57 2025 -0800 Merge tag 'v6.18-rc4-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - More safely detect RDMA capable devices correctly * tag 'v6.18-rc4-smb-server-fixes' of git://git.samba.org/ksmbd: ksmbd: detect RDMA capable netdevs include IPoIB ksmbd: detect RDMA capable lower devices when bridge and vlan netdev is used commit 8e8ae788964aa2573b4335026db4068540fa6a86 Author: Adrian Barnaś Date: Mon Sep 22 13:04:27 2025 +0000 arm64: Reject modules with internal alternative callbacks During module loading, check if a callback function used by the alternatives specified in the '.altinstruction' ELF section (if present) is located in core kernel .text. If not fail module loading before callback is called. Reported-by: Fanqin Cui Closes: https://lore.kernel.org/all/20250807072700.348514-1-fanqincui@163.com/ Signed-off-by: Adrian Barnaś Reviewed-by: Ard Biesheuvel [will: Folded in 'noinstr' tweak from Mark] Signed-off-by: Will Deacon commit 6d4a0fbd34a40c9f877b136de874dc3498031309 Author: Adrian Barnaś Date: Mon Sep 22 13:04:26 2025 +0000 arm64: Fail module loading if dynamic SCS patching fails Disallow a module to load if SCS dynamic patching fails for its code. For module loading, instead of running a dry-run to check for patching errors, try to run patching in the first run and propagate any errors so module loading will fail. Signed-off-by: Adrian Barnaś Reviewed-by: Ard Biesheuvel Signed-off-by: Will Deacon commit 7f1635737823a6c0c412ccf3767a12bec642c10f Author: shechenglong Date: Fri Oct 31 17:15:06 2025 +0800 arm64: proton-pack: Fix hard lockup due to print in scheduler context Relocate the printk() calls from spectre_v4_mitigations_off() and spectre_v2_mitigations_off() into setup_system_capabilities() function, preventing hard lockups caused by printk calls in scheduler context: | _raw_spin_lock_nested+168 | ttwu_queue+180 （rq_lock(rq, &rf); 2nd acquiring the rq->__lock） | try_to_wake_up+548 | wake_up_process+32 | __up+88 | up+100 | __up_console_sem+96 | console_unlock+696 | vprintk_emit+428 | vprintk_default+64 | vprintk_func+220 | printk+104 | spectre_v4_enable_task_mitigation+344 | __switch_to+100 | __schedule+1028 (rq_lock(rq, &rf); 1st acquiring the rq->__lock) | schedule_idle+48 | do_idle+388 | cpu_startup_entry+44 | secondary_start_kernel+352 Suggested-by: Mark Rutland Suggested-by: Catalin Marinas Suggested-by: Will Deacon Signed-off-by: shechenglong Signed-off-by: Will Deacon commit 62e72463ca714073962eda450e80c5d71dfb0dcb Author: shechenglong Date: Fri Oct 31 17:15:05 2025 +0800 arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY Following the pattern established with other Spectre mitigations, do not print a message when the CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY Kconfig option is disabled. Suggested-by: Will Deacon Signed-off-by: shechenglong Signed-off-by: Will Deacon commit 53357f14f924a06cced46069755bb10c2a6891c1 Author: Ryan Roberts Date: Thu Nov 6 16:09:43 2025 +0000 arm64: mm: Tidy up force_pte_mapping() Tidy up the implementation of force_pte_mapping() to make it easier to read and introduce the split_leaf_mapping_possible() helper to reduce code duplication in split_kernel_leaf_mapping() and arch_kfence_init_pool(). Suggested-by: David Hildenbrand (Red Hat) Signed-off-by: Ryan Roberts Reviewed-by: David Hildenbrand (Red Hat) Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit 40a292f701474f7c21b27911677485efa233e94e Author: Ryan Roberts Date: Thu Nov 6 16:09:42 2025 +0000 arm64: mm: Optimize range_split_to_ptes() Enter lazy_mmu mode while splitting a range of memory to pte mappings. This causes barriers, which would otherwise be emitted after every pte (and pmd/pud) write, to be deferred until exiting lazy_mmu mode. For large systems, this is expected to significantly speed up fallback to pte-mapping the linear map for the case where the boot CPU has BBML2_NOABORT, but secondary CPUs do not. I haven't directly measured it, but this is equivalent to commit 1fcb7cea8a5f ("arm64: mm: Batch dsb and isb when populating pgtables"). Note that for the path from arch_kfence_init_pool(), we may sleep while allocating memory inside the lazy_mmu mode. Sleeping is not allowed by generic code inside lazy_mmu, but we know that the arm64 implementation is sleep-safe. So this is ok and follows the same pattern already used by split_kernel_leaf_mapping(). Signed-off-by: Ryan Roberts Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit ce2b3a50ad922abbba36425343a1bcec46903a26 Author: Ryan Roberts Date: Thu Nov 6 16:09:41 2025 +0000 arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context It has been reported that split_kernel_leaf_mapping() is trying to sleep in non-sleepable context. It does this when acquiring the pgtable_split_lock mutex, when either CONFIG_DEBUG_PAGEALLOC or CONFIG_KFENCE are enabled, which change linear map permissions within softirq context during memory allocation and/or freeing. All other paths into this function are called from sleepable context and so are safe. But it turns out that the memory for which these 2 features may attempt to modify the permissions is always mapped by pte, so there is no need to attempt to split the mapping. So let's exit early in these cases and avoid attempting to take the mutex. There is one wrinkle to this approach; late-initialized kfence allocates it's pool from the buddy which may be block mapped. So we must hook that allocation and convert it to pte-mappings up front. Previously this was done as a side-effect of kfence protecting all the individual pages in its pool at init-time, but this no longer works due to the added early exit path in split_kernel_leaf_mapping(). So instead, do this via the existing arch_kfence_init_pool() arch hook, and reuse the existing linear_map_split_to_ptes() infrastructure. Closes: https://lore.kernel.org/all/f24b9032-0ec9-47b1-8b95-c0eeac7a31c5@roeck-us.net/ Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Ryan Roberts Reviewed-by: David Hildenbrand (Red Hat) Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c Author: Yang Shi Date: Tue Nov 4 13:49:47 2025 -0800 arm64: kprobes: check the return value of set_memory_rox() Since commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full"), __change_memory_common has more chance to fail due to memory allocation failure when splitting page table. So check the return value of set_memory_rox(), then bail out if it fails otherwise we may have RW memory mapping for kprobes insn page. Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page") Reviewed-by: Ryan Roberts Reviewed-by: Dev Jain Signed-off-by: Yang Shi Signed-off-by: Will Deacon commit 7991fda619f7251994ab364f03f3e6fc0aa143d9 Author: Punit Agrawal Date: Fri Oct 31 11:11:38 2025 +0000 arm64: acpi: Drop message logging SPCR default console Commit f5a4af3c7527 ("ACPI: Add acpi=nospcr to disable ACPI SPCR as default console on ARM64") introduced a command line parameter to prevent using SPCR provided console as default. It also introduced a message to log this choice. Drop the message as it is not particularly useful and can be incorrect in situations where no SPCR is provided by the firmware. Link: https://lore.kernel.org/all/aQN0YWUYaPYWpgJM@willie-the-truck/ Signed-off-by: Punit Agrawal Signed-off-by: Will Deacon commit eeb8c19896952e18fb538ec76e603884070a6c6a Author: Punit Agrawal Date: Fri Oct 31 11:11:37 2025 +0000 Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" This reverts commit bad3fa2fb9206f4dcec6ddef094ec2fbf6e8dcb2. Commit bad3fa2fb920 ("ACPI: Suppress misleading SPCR console message when SPCR table is absent") mistakenly assumes acpi_parse_spcr() returning 0 to indicate a failure to parse SPCR. While addressing the resultant incorrect logging it was deemed that dropping the message is a better approach as it is not particularly useful. Roll back the commit introducing the bug as a step towards dropping the log message. Link: https://lore.kernel.org/all/aQN0YWUYaPYWpgJM@willie-the-truck/ Signed-off-by: Punit Agrawal Signed-off-by: Will Deacon commit 535fdfc5a228524552ee8810c9175e877e127c27 Author: Catalin Marinas Date: Thu Nov 6 15:52:13 2025 +0000 arm64: Use load LSE atomics for the non-return per-CPU atomic operations The non-return per-CPU this_cpu_*() atomic operations are implemented as STADD/STCLR/STSET when FEAT_LSE is available. On many microarchitecture implementations, these instructions tend to be executed "far" in the interconnect or memory subsystem (unless the data is already in the L1 cache). This is in general more efficient when there is contention as it avoids bouncing cache lines between CPUs. The load atomics (e.g. LDADD without XZR as destination), OTOH, tend to be executed "near" with the data loaded into the L1 cache. STADD executed back to back as in srcu_read_{lock,unlock}*() incur an additional overhead due to the default posting behaviour on several CPU implementations. Since the per-CPU atomics are unlikely to be used concurrently on the same memory location, encourage the hardware to to execute them "near" by issuing load atomics - LDADD/LDCLR/LDSET - with the destination register unused (but not XZR). Signed-off-by: Catalin Marinas Link: https://lore.kernel.org/r/e7d539ed-ced0-4b96-8ecd-048a5b803b85@paulmck-laptop Reported-by: Paul E. McKenney Tested-by: Paul E. McKenney Cc: Will Deacon Reviewed-by: Palmer Dabbelt [will: Add comment and link to the discussion thread] Signed-off-by: Will Deacon commit 53afec2c8fb2a562222948cb1c2aac48598578c9 Author: Zhang Chujun Date: Thu Nov 6 11:10:40 2025 +0800 tracing/tools: Fix incorrcet short option in usage text for --threads The help message incorrectly listed '-t' as the short option for --threads, but the actual getopt_long configuration uses '-e'. This mismatch can confuse users and lead to incorrect command-line usage. This patch updates the usage string to correctly show: "-e, --threads NRTHR" to match the implementation. Note: checkpatch.pl reports a false-positive spelling warning on 'Run', which is intentional. Link: https://patch.msgid.link/20251106031040.1869-1-zhangchujun@cmss.chinamobile.com Signed-off-by: Zhang Chujun Signed-off-by: Steven Rostedt (Google) commit 0995c2fc39b0f998d40f5d276f67ae22fc1c37c3 Author: Matthew Brost Date: Fri Oct 31 16:40:45 2025 -0700 drm/xe: Enforce correct user fence signaling order using Prevent application hangs caused by out-of-order fence signaling when user fences are attached. Use drm_syncobj (via dma-fence-chain) to guarantee that each user fence signals in order, regardless of the signaling order of the attached fences. Ensure user fence writebacks to user space occur in the correct sequence. v7: - Skip drm_syncbj create of error (CI) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com (cherry picked from commit adda4e855ab6409a3edaa585293f1f2069ab7299) Signed-off-by: Lucas De Marchi commit d23550efc6800841b4d1639784afaebdea946ae0 Author: Mario Limonciello (AMD) Date: Thu Nov 6 12:28:54 2025 -0600 x86/microcode/AMD: Add more known models to entry sign checking Two Zen5 systems are missing from need_sha_check(). Add them. Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://patch.msgid.link/20251106182904.4143757-1-superm1@kernel.org commit b11a020d914c3b7628f56a9ea476a5b03679489b Author: Jouni Högander Date: Fri Oct 31 14:23:11 2025 +0200 drm/xe: Do clean shutdown also when using flr Currently Xe driver is triggering flr without any clean-up on shutdown. This is causing random warnings from pending related works as the underlying hardware is reset in the middle of their execution. Fix this by performing clean shutdown also when using flr. Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler") Cc: Maarten Lankhorst Signed-off-by: Jouni Högander Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com Signed-off-by: Maarten Lankhorst (cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4) Signed-off-by: Lucas De Marchi commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 Author: Tejas Upadhyay Date: Tue Oct 7 15:32:08 2025 +0530 drm/xe: Move declarations under conditional branch The xe_device_shutdown() function was needing a few declarations that were only required under a specific condition. This change moves those declarations to be within that conditional branch to avoid unnecessary declarations. Reviewed-by: Nitin Gote Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay (cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b) Signed-off-by: Lucas De Marchi commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea Author: Balasubramani Vivekanandan Date: Mon Nov 3 18:01:47 2025 +0530 drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. Cc: Zhanjun Dong Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper") Signed-off-by: Balasubramani Vivekanandan Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 492671339114e376aaa38626d637a2751cdef263) Signed-off-by: Lucas De Marchi commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 Author: Alvaro Gamez Machado Date: Thu Nov 6 14:45:35 2025 +0100 spi: xilinx: increase number of retries before declaring stall SPI devices using a (relative) slow frequency need a larger time. For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin. Signed-off-by: Alvaro Gamez Machado Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com Signed-off-by: Mark Brown commit 29528c8e643bb0c54da01237a35010c6438423d2 Author: Shenghao Ding Date: Fri Nov 7 13:49:59 2025 +0800 ASoC: tas2781: fix getting the wrong device number The return value of device_property_read_u32_array used for getting the property is the status instead of the number of the property. Fixes: ef3bcde75d06 ("ASoC: tas2781: Add tas2781 driver") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20251107054959.950-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit eef295a8508202e750e4f103a97447f3c9d5e3d0 Author: Ian Forbes Date: Mon Nov 3 14:19:20 2025 -0600 drm/vmwgfx: Restore Guest-Backed only cursor plane support The referenced fixes commit broke the cursor plane for configurations which have Guest-Backed surfaces but no cursor MOB support. Fixes: 965544150d1c ("drm/vmwgfx: Refactor cursor handling") Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251103201920.381503-1-ian.forbes@broadcom.com commit c1962742ffff7e245f935903a4658eb6f94f6058 Author: Ian Forbes Date: Thu Oct 30 14:36:40 2025 -0500 drm/vmwgfx: Use kref in vmw_bo_dirty Rather than using an ad hoc reference count use kref which is atomic and has underflow warnings. Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af Author: Ian Forbes Date: Tue Oct 21 14:01:28 2025 -0500 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality") Reported-by: Rohit Keshri Signed-off-by: Ian Forbes Reviewed-by: Maaz Mombasawala Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com commit a18033f1309cdfd6772799a9b9e72a098c52268b Merge: b57b47741ec15a afcfb6c8474d9e Author: Dave Airlie Date: Fri Nov 7 12:41:23 2025 +1000 Merge tag 'mediatek-drm-fixes-20251105' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20251105 1. Disable AFBC support on Mediatek DRM driver 2. Add pm_runtime support for GCE power control Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20251105151443.3909-1-chunkuang.hu@kernel.org commit 80f0d631dcc76ee1b7755bfca1d8417d91d71414 Author: Zilin Guan Date: Thu Nov 6 12:01:32 2025 +0000 tracing: Fix memory leaks in create_field_var() The function create_field_var() allocates memory for 'val' through create_hist_field() inside parse_atom(), and for 'var' through create_var(), which in turn allocates var->type and var->var.name internally. Simply calling kfree() to release these structures will result in memory leaks. Use destroy_hist_field() to properly free 'val', and explicitly release the memory of var->type and var->var.name before freeing 'var' itself. Link: https://patch.msgid.link/20251106120132.3639920-1-zilin@seu.edu.cn Fixes: 02205a6752f22 ("tracing: Add support for 'field variables'") Signed-off-by: Zilin Guan Signed-off-by: Steven Rostedt (Google) commit aa997d2d2a0b2e76f4df0f1f12829f02acb4fb6b Author: Steven Rostedt Date: Thu Oct 16 13:28:48 2025 -0400 ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up The function ring_buffer_map_get_reader() is a bit more strict than the other get reader functions, and except for certain situations the rb_get_reader_page() should not return NULL. If it does, it triggers a warning. This warning was triggering but after looking at why, it was because another acceptable situation was happening and it wasn't checked for. If the reader catches up to the writer and there's still data to be read on the reader page, then the rb_get_reader_page() will return NULL as there's no new page to get. In this situation, the reader page should not be updated and no warning should trigger. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Reported-by: syzbot+92a3745cea5ec6360309@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/690babec.050a0220.baf87.0064.GAE@google.com/ Link: https://lore.kernel.org/20251016132848.1b11bb37@gandalf.local.home Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions") Signed-off-by: Steven Rostedt (Google) commit 4a0c9b3391999818e2c5b93719699b255be1f682 Merge: f5f2e20b1cbc5f c91afa7610235f Author: Linus Torvalds Date: Thu Nov 6 16:24:12 2025 -0800 Merge tag 'probes-fixes-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fixes from Masami Hiramatsu: - tprobe-events: Fix to register tracepoint correctly tprobe-events missed to set tracepoint data structure before registering callback when enabling it. This sets it correctly. - tprobe-events: Fix to put tracepoint_user when disable the event tprobe-events missed to unregister tracepoint callback when the event is disabled. This ensures to unregister it. * tag 'probes-fixes-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe tracing: tprobe-events: Fix to register tracepoint correctly commit f5f2e20b1cbc5f9ea20b372d15967b24921ede19 Merge: 225a97d6d45456 7f17ef0d47b9aa Author: Linus Torvalds Date: Thu Nov 6 16:05:33 2025 -0800 Merge tag 'perf-tools-fixes-for-v6.18-1-2025-11-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Add James Clark as a perf tools reviewer - Handle '1' type symbols in /proc/kallsyms, related to anonymous Rust closures in the DRM panic QR encoder, caught by 'perf test' - Sync kernel header copies: MSRs, uprobe syscall, DRM_IOCTL_GEM_CHANGE_HANDLE, KVM exit reasons, etc * tag 'perf-tools-fixes-for-v6.18-1-2025-11-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf symbols: Handle '1' symbols in /proc/kallsyms tools headers asm: Sync fls headers header with the kernel sources tools headers UAPI: Sync KVM's vmx.h header with the kernel sources to handle new exit reasons tools headers svm: Sync svm headers with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources MAINTAINERS: Add James Clark as a perf tools reviewer tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers UAPI: Update tools's copy of drm.h to pick DRM_IOCTL_GEM_CHANGE_HANDLE tools headers x86 cpufeatures: Sync with the kernel sources tools headers x86: Sync table due to introducion of uprobe syscall tools headers: Sync uapi/linux/fcntl.h with the kernel sources tools headers: Sync uapi/linux/prctl.h with the kernel source tools headers uapi: Update fs.h with the kernel sources tools arch x86: Sync msr-index.h to pick AMD64_{PERF_CNTR_GLOBAL_STATUS_SET,SAVIC_CONTROL}, IA32_L3_QOS_{ABMC,EXT}_CFG commit 225a97d6d45456a7627633da09cb842a43ef1b85 Merge: 3a157bdfc8d23c 2e448567839c65 Author: Linus Torvalds Date: Thu Nov 6 15:44:18 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - A fix to disable KASAN checks while walking a non-current task's stackframe (following x86) - A fix for a kvrealloc()-related memory leak in module_frob_arch_sections() - Two replacements of strcpy() with strscpy() - A change to use the RISC-V .insn assembler directive when possible to assemble instructions from hex opcodes - Some low-impact fixes in the ptdump code and kprobes test code * tag 'riscv-for-linus-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: cpuidle: riscv-sbi: Replace deprecated strcpy in sbi_cpuidle_init_cpu riscv: KGDB: Replace deprecated strcpy in kgdb_arch_handle_qxfer_pkt riscv: asm: use .insn for making custom instructions riscv: tests: Make RISCV_KPROBES_KUNIT tristate riscv: tests: Rename kprobes_test_riscv to kprobes_riscv riscv: Fix memory leak in module_frob_arch_sections() riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro riscv: stacktrace: Disable KASAN checks for non-current tasks commit 3a157bdfc8d23c3fbfbeea47ff721fe9ef254b25 Merge: a1388fcb52fcad 771e8f48358372 Author: Linus Torvalds Date: Thu Nov 6 15:40:14 2025 -0800 Merge tag 'acpi-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix a coding mistake in the ACPI Smart Battery Subsystem (SBS) driver and two documentation issues: - Fix computation of the battery->present value in acpi_battery_read() to work when battery->id is not zero (Dan Carpenter) - Fix comment typo in the ACPI CPPC library (Chu Guangqing) - Fix I2C device references in two ASL examples in the firmware guide that were broken by a previous update (Jonas Gorski)" * tag 'acpi-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: SBS: Fix present test in acpi_battery_read() ACPI: CPPC: Fix typo in a comment Documentation: ACPI: i2c-muxes: fix I2C device references commit b57b47741ec15a7e15190c93ce5aa3198bd3cba4 Merge: 6ec8a47c553007 3c6a743c6961cc Author: Dave Airlie Date: Fri Nov 7 09:20:30 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-06: amdgpu: - Reset fixes - Misc fixes - Panel scaling fixes - HDMI fix - S0ix fixes - Hibernation fix - Secure display fix - Suspend fix - MST fix amdkfd: - Process cleanup fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251106201326.807230-1-alexander.deucher@amd.com commit 6ec8a47c553007aa97afb357bc24112effbabe5e Merge: faf66a71079b5d 7d44ad6b43d0be Author: Dave Airlie Date: Fri Nov 7 09:14:55 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-06' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz) - Fix conversion between clock ticks and nanoseconds (Umesh) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aQyxT1D8IW-xcDbM@intel.com commit faf66a71079b5d916028fab51a9b537df7b28b9f Merge: 6146a0f1dfae5d b750f5a9d64df6 Author: Dave Airlie Date: Fri Nov 7 08:21:15 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: imagination: - kconfig: Fix dependencies nouveau: - Set DMA mask earlier - Advertize correct modifiers for GB20x pixpaper: - kconfig: Fix dependencies sched: - Fix deadlock Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251106131244.GA155679@2a02-2454-fd5e-fd00-d540-1fd5-75b4-d5e2.dyn6.pyur.net commit 74d4432421a3e2669fbccc08c0f4fc2980bf0e39 Author: Gal Pressman Date: Wed Nov 5 21:29:08 2025 +0200 docs: netlink: Couple of intro-specs documentation fixes Fix typo "handul" to "handful" and remove outdated limitation stating only generic netlink is supported (we have netlink-raw). Reviewed-by: Carolina Jubran Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20251105192908.686458-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit c91afa7610235f89a5e8f5686aac23892ab227ed Author: Masami Hiramatsu (Google) Date: Fri Nov 7 01:52:24 2025 +0900 tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe __unregister_trace_fprobe() checks tf->tuser to put it when removing tprobe. However, disable_trace_fprobe() does not use it and only calls unregister_fprobe(). Thus it forgets to disable tracepoint_user. If the trace_fprobe has tuser, put it for unregistering the tracepoint callbacks when disabling tprobe correctly. Link: https://lore.kernel.org/all/176244794466.155515.3971904050506100243.stgit@devnote2/ Fixes: 2867495dea86 ("tracing: tprobe-events: Register tracepoint when enable tprobe event") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Tested-by: Beau Belgrave Reviewed-by: Beau Belgrave commit 10d9dda426d684e98b17161f02f77894c6de9b60 Author: Masami Hiramatsu (Google) Date: Fri Nov 7 01:52:15 2025 +0900 tracing: tprobe-events: Fix to register tracepoint correctly Since __tracepoint_user_init() calls tracepoint_user_register() without initializing tuser->tpoint with given tracpoint, it does not register tracepoint stub function as callback correctly, and tprobe does not work. Initializing tuser->tpoint correctly before tracepoint_user_register() so that it sets up tracepoint callback. I confirmed below example works fine again. echo "t sched_switch preempt prev_pid=prev->pid next_pid=next->pid" > /sys/kernel/tracing/dynamic_events echo 1 > /sys/kernel/tracing/events/tracepoints/sched_switch/enable cat /sys/kernel/tracing/trace_pipe Link: https://lore.kernel.org/all/176244793514.155515.6466348656998627773.stgit@devnote2/ Fixes: 2867495dea86 ("tracing: tprobe-events: Register tracepoint when enable tprobe event") Reported-by: Beau Belgrave Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Tested-by: Beau Belgrave Reviewed-by: Beau Belgrave commit a59e927ff46a967f84ddf94e89cbb045810e8974 Author: Andrey Leonchikov Date: Wed Nov 5 22:07:33 2025 +0100 arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2 Fix typo into regulator GPIO definition. With current definition - USB powered off. Valid definition can be found on "pinctrl" section: vcc5v0_usb2t_en: vcc5v0-usb2t-en { rockchip,pins = <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_none>; }; vcc5v0_usb2b_en: vcc5v0-usb2b-en { rockchip,pins = <4 RK_PC4 RK_FUNC_GPIO &pcfg_pull_none>; }; Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Andrey Leonchikov Link: https://patch.msgid.link/20251105210741.850031-1-andreil499@gmail.com Signed-off-by: Heiko Stuebner commit 771e8f483583728cd2ef164f7c2256c4bf2adf4c Merge: 01e11d18da818e 1642fabff19f76 bd9e119951b527 Author: Rafael J. Wysocki Date: Thu Nov 6 22:10:27 2025 +0100 Merge branches 'acpi-cppc' and 'acpi-docs' Merge two documentation fixes for 6.18-rc5, a commet typo fix in the ACPI CPPC library (Chu Guangqing) and fixes for two ASL examples in the firmware guide (Jonas Gorski). * acpi-cppc: ACPI: CPPC: Fix typo in a comment * acpi-docs: Documentation: ACPI: i2c-muxes: fix I2C device references commit a1388fcb52fcad3e0b06e2cdd0ed757a82a5be30 Merge: c668da99b923bc 44e8241c51f762 Author: Linus Torvalds Date: Thu Nov 6 12:48:18 2025 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Two Curve25519 related fixes: - Re-enable KASAN support on curve25519-hacl64.c with gcc. - Disable the arm optimized Curve25519 code on CPU_BIG_ENDIAN kernels. It has always been broken in that configuration" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC commit c668da99b923bc0527f19e361bb8496be087970f Merge: c90841db352465 1e39da974ce621 Author: Linus Torvalds Date: Thu Nov 6 12:45:15 2025 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt fix from Eric Biggers: "Fix an UBSAN warning that started occurring when the block layer started supporting logical_block_size > PAGE_SIZE" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT commit f2a12cc3b97f062186568a7b94ddb7aa2ef68140 Author: Gao Xiang Date: Fri Oct 31 13:47:39 2025 +0800 erofs: avoid infinite loop due to incomplete zstd-compressed data Currently, the decompression logic incorrectly spins if compressed data is truncated in crafted (deliberately corrupted) images. Fixes: 7c35de4df105 ("erofs: Zstandard compression support") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/50958.1761605413@localhost Signed-off-by: Gao Xiang Reviewed-by: Chunhai Guo Reviewed-by: Chao Yu commit c90841db3524657204c096fd47283817cfdbd2f9 Merge: c2c2ccfd4ba727 c57f5fee54dfc8 Author: Linus Torvalds Date: Thu Nov 6 11:54:59 2025 -0800 Merge tag 'hardening-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: "This is a work-around for a (now fixed) corner case in the arm32 build with Clang KCFI enabled. - Introduce __nocfi_generic for arm32 Clang (Nathan Chancellor)" * tag 'hardening-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: libeth: xdp: Disable generic kCFI pass for libeth_xdp_tx_xmit_bulk() ARM: Select ARCH_USES_CFI_GENERIC_LLVM_PASS compiler_types: Introduce __nocfi_generic commit a9da90e618cd0669a22bcc06a96209db5dd96e9b Author: Johannes Berg Date: Wed Nov 5 15:41:19 2025 +0100 wifi: mac80211: reject address change while connecting While connecting, the MAC address can already no longer be changed. The change is already rejected if netif_carrier_ok(), but of course that's not true yet while connecting. Check for auth_data or assoc_data, so the MAC address cannot be changed. Also more comprehensively check that there are no stations on the interface being changed - if any peer station is added it will know about our address already, so we cannot change it. Cc: stable@vger.kernel.org Fixes: 3c06e91b40db ("wifi: mac80211: Support POWERED_ADDR_CHANGE feature") Link: https://patch.msgid.link/20251105154119.f9f6c1df81bb.I9bb3760ede650fb96588be0d09a5a7bdec21b217@changeid Signed-off-by: Johannes Berg commit 4436f484cb437ba28dc58b7f787a6f80a65aa5c3 Author: Krzysztof Kozlowski Date: Thu Nov 6 17:16:25 2025 +0100 gpio: tb10x: Drop unused tb10x_set_bits() function tb10x_set_bits() is not referenced anywhere leading to W=1 warning: gpio-tb10x.c:59:20: error: unused function 'tb10x_set_bits' [-Werror,-Wunused-function] After its removal, tb10x_reg_write() becomes unused as well. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251106-gpio-of-match-v1-1-50c7115a045e@linaro.org Signed-off-by: Bartosz Golaszewski commit 3dc8c73365d3ca25c99e7e1a0f493039d7291df5 Author: Haotian Zhang Date: Thu Nov 6 22:31:14 2025 +0800 ASoC: codecs: va-macro: fix resource leak in probe error path In the commit referenced by the Fixes tag, clk_hw_get_clk() was added in va_macro_probe() to get the fsgen clock, but forgot to add the corresponding clk_put() in va_macro_remove(). This leads to a clock reference leak when the driver is unloaded. Switch to devm_clk_hw_get_clk() to automatically manage the clock resource. Fixes: 30097967e056 ("ASoC: codecs: va-macro: use fsgen as clock") Suggested-by: Konrad Dybcio Signed-off-by: Haotian Zhang Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20251106143114.729-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 3c6a743c6961cc2cab453b343bb157d6bbbf8120 Author: Wayne Lin Date: Wed Nov 5 10:36:31 2025 +0800 drm/amd/display: Enable mst when it's detected but yet to be initialized [Why] drm_dp_mst_topology_queue_probe() is used under the assumption that mst is already initialized. If we connect system with SST first then switch to the mst branch during suspend, we will fail probing topology by calling the wrong API since the mst manager is yet to be initialized. [How] At dm_resume(), once it's detected as mst branc connected, check if the mst is initialized already. If not, call dm_helpers_dp_mst_start_top_mgr() instead to initialize mst V2: Adjust the commit msg a bit Fixes: bc068194f548 ("drm/amd/display: Don't write DP_MSTM_CTRL after LT") Cc: Fangzhi Zuo Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Tom Chung Signed-off-by: Wayne Lin Signed-off-by: Alex Deucher (cherry picked from commit 62320fb8d91a0bddc44a228203cfa9bfbb5395bd) Cc: stable@vger.kernel.org commit 570a66b48c22214851949fcd71816fee280aa096 Author: Lijo Lazar Date: Mon Nov 3 16:21:50 2025 +0530 drm/amdgpu: Fix wait after reset sequence in S3 For a mode-1 reset done at the end of S3 on PSPv11 dGPUs, only check if TOS is unloaded. Fixes: 32f73741d6ee ("drm/amdgpu: Wait for bootloader after PSPv11 reset") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4649 Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 1ad25fd272753db14c5d1cc8c68e20ce01f3f888) commit b09cb2996cdf50cd1ab4020e002c95d742c81313 Author: Mario Limonciello Date: Tue Nov 4 13:38:02 2025 -0600 drm/amd: Fix suspend failure with secure display TA commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded successfully") attempted to fix extra messages, but failed to port the cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable secure display TA multiple times") to prevent multiple tries. Add that to the failure handling path even on a quick failure. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) commit eb6e7f520d6efa4d4ebf1671455abe4a681f7a05 Author: Samuel Zhang Date: Wed Nov 5 03:04:08 2025 +0000 drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens during hibernate, but partition mode is not restored on resume, register mmCP_HYP_XCP_CTL and mmCP_PSP_XCP_CTL is not right after resume. When CP access the MQD BO, wrong stride size is used, this will cause out of bound access on the MQD BO, resulting page fault. The fix is to ensure gfx_v9_4_3_switch_compute_partition() is called when resume from a hibernation. KFD resume is called separately during a reset recovery or resume from suspend sequence. Hence it's not required to be called as part of partition switch. Signed-off-by: Samuel Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 5d1b32cfe4a676fe552416cb5ae847b215463a1a) commit c2c2ccfd4ba72718266a56f3ecc34c989cb5b7a0 Merge: dc77806cf3b478 3534e03e0ec2e0 Author: Linus Torvalds Date: Thu Nov 6 08:52:30 2025 -0800 Merge tag 'net-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: Including fixes from bluetooth and wireless. Current release - new code bugs: - ptp: expose raw cycles only for clocks with free-running counter - bonding: fix null-deref in actor_port_prio setting - mdio: ERR_PTR-check regmap pointer returned by device_node_to_regmap() - eth: libie: depend on DEBUG_FS when building LIBIE_FWLOG Previous releases - regressions: - virtio_net: fix perf regression due to bad alignment of virtio_net_hdr_v1_hash - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" caused regressions for QCA988x and QCA9984 - Revert "wifi: ath12k: Fix missing station power save configuration" caused regressions for WCN7850 - eth: bnxt_en: shutdown FW DMA in bnxt_shutdown(), fix memory corruptions after kexec Previous releases - always broken: - virtio-net: fix received packet length check for big packets - sctp: fix races in socket diag handling - wifi: add an hrtimer-based delayed work item to avoid low granularity of timers set relatively far in the future, and use it where it matters (e.g. when performing AP-scheduled channel switch) - eth: mlx5e: - correctly propagate error in case of module EEPROM read failure - fix HW-GRO on systems with PAGE_SIZE == 64kB - dsa: b53: fixes for tagging, link configuration / RMII, FDB, multicast - phy: lan8842: implement latest errata" * tag 'net-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (63 commits) selftests/vsock: avoid false-positives when checking dmesg net: bridge: fix MST static key usage net: bridge: fix use-after-free due to MST port state bypass lan966x: Fix sleeping in atomic context bonding: fix NULL pointer dereference in actor_port_prio setting net: dsa: microchip: Fix reserved multicast address table programming net: wan: framer: pef2256: Switch to devm_mfd_add_devices() net: libwx: fix device bus LAN ID net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages net/mlx5e: SHAMPO, Fix skb size check for 64K pages net/mlx5e: SHAMPO, Fix header mapping for 64K pages net: ti: icssg-prueth: Fix fdb hash size configuration net/mlx5e: Fix return value in case of module EEPROM read error net: gro_cells: Reduce lock scope in gro_cell_poll libie: depend on DEBUG_FS when building LIBIE_FWLOG wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup netpoll: Fix deadlock in memory allocation under spinlock net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error virtio-net: fix received length check in big packets bnxt_en: Fix warning in bnxt_dl_reload_down() ... commit a26a6c93edfeee82cb73f55e87d995eea59ddfe8 Author: Nathan Chancellor Date: Wed Nov 5 15:30:27 2025 -0700 kbuild: Strip trailing padding bytes from modules.builtin.modinfo After commit d50f21091358 ("kbuild: align modinfo section for Secureboot Authenticode EDK2 compat"), running modules_install with certain versions of kmod (such as 29.1 in Ubuntu Jammy) in certain configurations may fail with: depmod: ERROR: kmod_builtin_iter_next: unexpected string without modname prefix The additional padding bytes to ensure .modinfo is aligned within vmlinux.unstripped are unexpected by kmod, as this section has always just been null-terminated strings. Strip the trailing padding bytes from modules.builtin.modinfo after it has been extracted from vmlinux.unstripped to restore the format that kmod expects while keeping .modinfo aligned within vmlinux.unstripped to avoid regressing the Authenticode calculation fix for EDK2. Cc: stable@vger.kernel.org Fixes: d50f21091358 ("kbuild: align modinfo section for Secureboot Authenticode EDK2 compat") Reported-by: Omar Sandoval Reported-by: Samir M Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/7fef7507-ad64-4e51-9bb8-c9fb6532e51e@linux.ibm.com/ Tested-by: Omar Sandoval Tested-by: Samir M Tested-by: Venkat Rao Bagalkote Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251105-kbuild-fix-builtin-modinfo-for-kmod-v1-1-b419d8ad4606@kernel.org Signed-off-by: Nathan Chancellor commit 3534e03e0ec2e00908765549828a69df5ebefb91 Author: Bobby Eshleman Date: Wed Nov 5 07:59:19 2025 -0800 selftests/vsock: avoid false-positives when checking dmesg Sometimes VMs will have some intermittent dmesg warnings that are unrelated to vsock. Change the dmesg parsing to filter on strings containing 'vsock' to avoid false positive failures that are unrelated to vsock. The downside is that it is possible for some vsock related warnings to not contain the substring 'vsock', so those will be missed. Fixes: a4a65c6fe08b ("selftests/vsock: add initial vmtest.sh for vsock") Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251105-vsock-vmtest-dmesg-fix-v2-1-1a042a14892c@meta.com Signed-off-by: Jakub Kicinski commit 13fef4fb0536c80e8c4a77e69fe0b5deeb7c331b Merge: 0216721ce71252 ee87c63f9b2a41 Author: Jakub Kicinski Date: Thu Nov 6 07:32:19 2025 -0800 Merge branch 'net-bridge-fix-two-mst-bugs' Nikolay Aleksandrov says: ==================== net: bridge: fix two MST bugs Patch 01 fixes a race condition that exists between expired fdb deletion and port deletion when MST is enabled. Learning can happen after the port's state has been changed to disabled which could lead to that port's memory being used after it's been freed. The issue was reported by syzbot, more information in patch 01. Patch 02 fixes an issue with MST's static key which Ido spotted, we can have multiple bridges with MST and a single bridge can erroneously disable it for all. ==================== Link: https://patch.msgid.link/20251105111919.1499702-1-razor@blackwall.org Signed-off-by: Jakub Kicinski commit ee87c63f9b2a418f698d79c2991347e31a7d2c27 Author: Nikolay Aleksandrov Date: Wed Nov 5 13:19:19 2025 +0200 net: bridge: fix MST static key usage As Ido pointed out, the static key usage in MST is buggy and should use inc/dec instead of enable/disable because we can have multiple bridges with MST enabled which means a single bridge can disable MST for all. Use static_branch_inc/dec to avoid that. When destroying a bridge decrement the key if MST was enabled. Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: Ido Schimmel Closes: https://lore.kernel.org/netdev/20251104120313.1306566-1-razor@blackwall.org/T/#m6888d87658f94ed1725433940f4f4ebb00b5a68b Signed-off-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251105111919.1499702-3-razor@blackwall.org Signed-off-by: Jakub Kicinski commit 8dca36978aa80bab9d4da130c211db75c9e00048 Author: Nikolay Aleksandrov Date: Wed Nov 5 13:19:18 2025 +0200 net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: syzbot+dd280197f0f7ab3917be@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69088ffa.050a0220.29fc44.003d.GAE@google.com/ Signed-off-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251105111919.1499702-2-razor@blackwall.org Signed-off-by: Jakub Kicinski commit 0216721ce71252f60d89af49c8dff613358058d3 Author: Horatiu Vultur Date: Wed Nov 5 08:49:55 2025 +0100 lan966x: Fix sleeping in atomic context The following warning was seen when we try to connect using ssh to the device. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8 It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock. Fixes: 12c2d0a5b8e2 ("net: lan966x: add ethtool configuration and statistics") Signed-off-by: Horatiu Vultur Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251105074955.1766792-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 9065b968752334f972e0d48e50c4463a172fc2a7 Author: Nicolas Escande Date: Tue Nov 4 09:39:57 2025 +0100 wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() When reporting tx completion using ieee80211_tx_status_xxx() family of functions, the status part of the struct ieee80211_tx_info nested in the skb is used to report things like transmit rates & retry count to mac80211 On the TX data path, this is correctly memset to 0 before calling ieee80211_tx_status_ext(), but on the tx mgmt path this was not done. This leads to mac80211 treating garbage values as valid transmit counters (like tx retries for example) and accounting them as real statistics that makes their way to userland via station dump. The same issue was resolved in ath12k by commit 9903c0986f78 ("wifi: ath12k: Add memset and update default rate value in wmi tx completion") Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Nicolas Escande Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251104083957.717825-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit 067bf016e99ad72aa4ff869d6dec1fd62a9c6202 Author: Hangbin Liu Date: Wed Nov 5 07:26:20 2025 +0000 bonding: fix NULL pointer dereference in actor_port_prio setting Liang reported an issue where setting a slave’s actor_port_prio to predefined values such as 0, 255, or 65535 would cause a system crash. The problem occurs because in bond_opt_parse(), when the provided value matches a predefined table entry, the function returns that table entry, which does not contain slave information. Later, in bond_option_actor_port_prio_set(), calling bond_slave_get_rtnl() leads to a NULL pointer dereference. Since actor_port_prio is defined as a u16 and initialized to the default value of 255 in ad_initialize_port(), there is no need for the bond_actor_port_prio_tbl. Using the BOND_OPTFLAG_RAWVAL flag is sufficient. Fixes: 6b6dc81ee7e8 ("bonding: add support for per-port LACP actor priority") Reported-by: Liang Li Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251105072620.164841-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 96baf482ca1f69f0da9d10a5bd8422c87ea9039e Author: Tristram Ha Date: Tue Nov 4 19:37:41 2025 -0800 net: dsa: microchip: Fix reserved multicast address table programming KSZ9477/KSZ9897 and LAN937X families of switches use a reserved multicast address table for some specific forwarding with some multicast addresses, like the one used in STP. The hardware assumes the host port is the last port in KSZ9897 family and port 5 in LAN937X family. Most of the time this assumption is correct but not in other cases like KSZ9477. Originally the function just setups the first entry, but the others still need update, especially for one common multicast address that is used by PTP operation. LAN937x also uses different register bits when accessing the reserved table. Fixes: 457c182af597 ("net: dsa: microchip: generic access to ksz9477 static and reserved table") Signed-off-by: Tristram Ha Tested-by: Łukasz Majewski Link: https://patch.msgid.link/20251105033741.6455-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit d0164c161923ac303bd843e04ebe95cfd03c6e19 Author: Sukrit Bhatnagar Date: Thu Nov 6 14:28:51 2025 +0900 KVM: VMX: Fix check for valid GVA on an EPT violation On an EPT violation, bit 7 of the exit qualification is set if the guest linear-address is valid. The derived page fault error code should not be checked for this bit. Fixes: f3009482512e ("KVM: VMX: Set PFERR_GUEST_{FINAL,PAGE}_MASK if and only if the GVA is valid") Cc: stable@vger.kernel.org Signed-off-by: Sukrit Bhatnagar Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20251106052853.3071088-1-Sukrit.Bhatnagar@sony.com Signed-off-by: Sean Christopherson commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 Author: Robin Gong Date: Fri Oct 24 13:53:20 2025 +0800 spi: imx: keep dma request disabled before dma transfer setup Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below: "It is thus essential for the Arm platform to program them before any DMA request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started." Signed-off-by: Carlos Song Signed-off-by: Robin Gong Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 84f5526e4dce0a44d050ceb1b1bf21d43016d91b Author: Niranjan H Y Date: Thu Oct 30 20:46:37 2025 +0530 ASoC: tas2783A: Fix issues in firmware parsing During firmware download, if the size of the firmware is too small, it wrongly assumes the firmware download is successful. If there is size mismatch with chunk's header, invalid memory is accessed. Fix these issues by throwing error during these cases. Fixes: 4cc9bd8d7b32 (ASoc: tas2783A: Add soundwire based codec driver) Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510291226.2R3fbYNh-lkp@intel.com/ Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20251030151637.566-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 1a58d865f423f4339edf59053e496089075fa950 Author: Miaoqian Lin Date: Wed Oct 29 15:17:58 2025 +0800 ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() The bus_find_device_by_name() function returns a device pointer with an incremented reference count, but the original code was missing put_device() calls in some return paths, leading to reference count leaks. Fix this by ensuring put_device() is called before function exit after bus_find_device_by_name() succeeds This follows the same pattern used elsewhere in the kernel where bus_find_device_by_name() is properly paired with put_device(). Found via static analysis and code review. Fixes: 4f8ef33dd44a ("ASoC: soc_sdw_utils: skip the endpoint that doesn't present") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://patch.msgid.link/20251029071804.8425-1-linmq006@gmail.com Signed-off-by: Mark Brown commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 Author: Haotian Zhang Date: Wed Nov 5 14:22:46 2025 +0800 ASoC: cs4271: Fix regulator leak on probe failure The probe function enables regulators at the beginning but fails to disable them in its error handling path. If any operation after enabling the regulators fails, the probe will exit with an error, leaving the regulators permanently enabled, which could lead to a resource leak. Add a proper error handling path to call regulator_bulk_disable() before returning an error. Fixes: 9a397f473657 ("ASoC: cs4271: add regulator consumer support") Signed-off-by: Haotian Zhang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251105062246.1955-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit b750f5a9d64df6cfe9103c7feb7314694318818d Author: LiangCheng Wang Date: Tue Oct 28 10:55:38 2025 +0800 drm/tiny: pixpaper: add explicit dependency on MMU The DRM_GEM_SHMEM_HELPER helper requires MMU enabled because it uses vmf_insert_pfn() in its mmap implementation. On NOMMU configurations (e.g. some RISC-V randconfig builds), this symbol is unavailable and selecting DRM_GEM_SHMEM_HELPER causes a modpost undefined reference: ERROR: modpost: "vmf_insert_pfn" [drivers/gpu/drm/drm_shmem_helper.ko] undefined! Normally, Kconfig prevents this helper from being selected when CONFIG_MMU=n. However, in some randconfig builds (such as those used by 0day CI), select statements can override unmet dependencies, triggering the issue. Add an explicit dependency on MMU to DRM_PIXPAPER to prevent this. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510280213.0rlYA4T3-lkp@intel.com/ Fixes: 0c4932f6ddf8 ("drm/tiny: pixpaper: Fix missing dependency on DRM_GEM_SHMEM_HELPER") Acked-by: Thomas Zimmermann Signed-off-by: LiangCheng Wang Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251028-bar-v1-1-edfbd13fafff@gmail.com commit f945afe01c6768dcfed7868c671a26e1164c2284 Author: Antheas Kapenekakis Date: Wed Oct 8 15:50:57 2025 +0200 platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list The Lenovo Legion Go 2 takes a long time to resume from suspend. This is due to it having an nvme resume handler that interferes with IOMMU mappings. It is a common issue with older Lenovo laptops. Adding it to that quirk list fixes this issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618 Suggested-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 Author: Antheas Kapenekakis Date: Fri Oct 24 17:21:51 2025 +0200 platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally The Xbox Ally features a Van Gogh SoC that has spurious interrupts during resume. We get the following logs: atkbd_receive_byte: 20 callbacks suppressed atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly. So, add the spurious_8042 quirk for it. It does not have a keyboard, so this does not result in any functional loss. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb Author: Antheas Kapenekakis Date: Fri Oct 24 17:21:50 2025 +0200 platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Acked-by: Shyam Sundar S K Link: https://patch.msgid.link/20251024152152.3981721-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a6003d90f02863898babbcb3f55b1cd33f7867c2 Author: Kurt Borja Date: Mon Nov 3 14:01:48 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "G" family Add support for the whole "Dell G" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-5-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 21ebfff1cf4727bc325c89b94ed93741f870744f Author: Kurt Borja Date: Mon Nov 3 14:01:47 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "X" family Add support for the whole "Alienware X" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-4-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e8c3c875e1017c04c594f0e6127ba82095b1cb87 Author: Kurt Borja Date: Mon Nov 3 14:01:46 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "M" family Add support for the whole "Alienware M" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-3-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 173b23808768ce5a9210d7783b06dce8a0cb3c2e Author: Kurt Borja Date: Mon Nov 3 14:01:45 2025 -0500 platform/x86: alienware-wmi-wmax: Drop redundant DMI entries The awcc_dmi_table[] uses DMI_MATCH() that supports partial matches. As there is already "Alienware Area-51m" entry, "Alienware Area-51m R2" entry is redundant. Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-2-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bd4f9f113dda07293ed4002a17d14f62121d324f Author: Kurt Borja Date: Mon Nov 3 14:01:44 2025 -0500 platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order Quirks are matched using dmi_first_match(), therefore move the "Alienware m16 R1 AMD" entry above other m16 entries. Reported-by: Cihan Ozakca Fixes: e2468dc70074 ("Revert "platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1"") Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-1-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5f20bc206beb902e32b77216cb7935b46ca00b0a Author: Randy Dunlap Date: Thu Oct 23 12:46:14 2025 -0700 platform/x86: ISST: isst_if.h: fix all kernel-doc warnings Fix all kernel-doc warnings in : - don't use "[]" in the variable name in kernel-doc - add a few missing entries - change "power_domain" to "power_domain_id" in kernel-doc to match the struct member name - add a leading '@' on a few existing kernel-doc lines - use '_' instead of '-' in struct member names Examples (but not all 27 warnings): Warning: include/uapi/linux/isst_if.h:63 struct member 'cpu_map' not described in 'isst_if_cpu_maps' Warning: ../include/uapi/linux/isst_if.h:95 struct member 'req_count' not described in 'isst_if_io_regs' Warning: include/uapi/linux/isst_if.h:132 struct member 'mbox_cmd' not described in 'isst_if_mbox_cmds' Warning: ../include/uapi/linux/isst_if.h:183 struct member 'supported' not described in 'isst_core_power' Warning: ../include/uapi/linux/isst_if.h:206 struct member 'power_domain_id' not described in 'isst_clos_param' Warning: ../include/uapi/linux/isst_if.h:239 struct member 'assoc_info' not described in 'isst_if_clos_assoc_cmds' Warning: ../include/uapi/linux/isst_if.h:286 struct member 'sst_tf_support' not described in 'isst_perf_level_info' Warning: ../include/uapi/linux/isst_if.h:375 struct member 'trl_freq_mhz' not described in 'isst_perf_level_data_info' Warning: ../include/uapi/linux/isst_if.h:475 struct member 'max_buckets' not described in 'isst_turbo_freq_info' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251023194615.180824-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a229809c18926e79aeca232d5b502157beb0dec3 Author: Kuppuswamy Sathyanarayanan Date: Wed Oct 22 14:17:33 2025 -0700 platform/x86: intel-uncore-freq: Add additional client processors Add Intel uncore frequency driver support for Pantherlake, Wildcatlake and Novalake processors. Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20251022211733.3565526-1-sathyanarayanan.kuppuswamy@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fb146a38cb119c8d69633851c7a2ce2c8d34861a Author: Krishna Chomal Date: Sat Oct 18 16:40:01 2025 +0530 platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support The newer HP Omen laptops, such as Omen 16-wf1xxx, use the same WMI-based thermal profile interface as Victus 16-r1000 and 16-s1000 models. Add the DMI board name "8C78" to the victus_s_thermal_profile_boards list to enable proper fan and thermal mode control. Tested on: HP Omen 16-wf1xxx (board 8C78) Result: * Fan RPMs are readable * echo 0 | sudo tee /sys/devices/platform/hp-wmi/hwmon/*/pwm1_enable allows the fans to run on max RPM. Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20251018111001.56625-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5c72329716d0858621021193330594d5d26bf44d Author: Jia Ston Date: Wed Oct 29 05:18:38 2025 +0000 platform/x86: huawei-wmi: add keys for HONOR models HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e). To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models. Signed-off-by: Ston Jia Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 54afb047cd7eb40149f3fc42d69fd4ddde2be9f0 Author: Edip Hazuri Date: Wed Oct 15 21:10:44 2025 +0300 platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support This patch adds Victus 16-r0 (8bbe) and Victus 16-s0(8bd4, 8bd5) laptop DMI board name into existing list Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20251015181042.23961-3-edip@medip.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4cb5ac2626b5704ed712ac1d46b9d89fdfc12c5d Author: Peter Zijlstra Date: Wed Jul 16 16:29:46 2025 +0200 futex: Optimize per-cpu reference counting Shrikanth noted that the per-cpu reference counter was still some 10% slower than the old immutable option (which removes the reference counting entirely). Further optimize the per-cpu reference counter by: - switching from RCU to preempt; - using __this_cpu_*() since we now have preempt disabled; - switching from smp_load_acquire() to READ_ONCE(). This is all safe because disabling preemption inhibits the RCU grace period exactly like rcu_read_lock(). Having preemption disabled allows using __this_cpu_*() provided the only access to the variable is in task context -- which is the case here. Furthermore, since we know changing fph->state to FR_ATOMIC demands a full RCU grace period we can rely on the implied smp_mb() from that to replace the acquire barrier(). This is very similar to the percpu_down_read_internal() fast-path. The reason this is significant for PowerPC is that it uses the generic this_cpu_*() implementation which relies on local_irq_disable() (the x86 implementation relies on it being a single memop instruction to be IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE barrier, not having to use explicit barriers safes a bunch. Combined this reduces the performance gap by half, down to some 5%. Fixes: 760e6f7befba ("futex: Remove support for IMMUTABLE") Reported-by: Shrikanth Hegde Tested-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251106092929.GR4067720@noisy.programming.kicks-ass.net commit 956dfda6a70885f18c0f8236a461aa2bc4f556ad Author: Aaron Lu Date: Thu Oct 30 11:27:55 2025 +0800 sched/fair: Prevent cfs_rq from being unthrottled with zero runtime_remaining When a cfs_rq is to be throttled, its limbo list should be empty and that's why there is a warn in tg_throttle_down() for non empty cfs_rq->throttled_limbo_list. When running a test with the following hierarchy: root / \ A* ... / | \ ... B / \ C* where both A and C have quota settings, that warn on non empty limbo list is triggered for a cfs_rq of C, let's call it cfs_rq_c(and ignore the cpu part of the cfs_rq for the sake of simpler representation). Debug showed it happened like this: Task group C is created and quota is set, so in tg_set_cfs_bandwidth(), cfs_rq_c is initialized with runtime_enabled set, runtime_remaining equals to 0 and *unthrottled*. Before any tasks are enqueued to cfs_rq_c, *multiple* throttled tasks can migrate to cfs_rq_c (e.g., due to task group changes). When enqueue_task_fair(cfs_rq_c, throttled_task) is called and cfs_rq_c is in a throttled hierarchy (e.g., A is throttled), these throttled tasks are directly placed into cfs_rq_c's limbo list by enqueue_throttled_task(). Later, when A is unthrottled, tg_unthrottle_up(cfs_rq_c) enqueues these tasks. The first enqueue triggers check_enqueue_throttle(), and with zero runtime_remaining, cfs_rq_c can be throttled in throttle_cfs_rq() if it can't get more runtime and enters tg_throttle_down(), where the warning is hit due to remaining tasks in the limbo list. I think it's a chaos to trigger throttle on unthrottle path, the status of a being unthrottled cfs_rq can be in a mixed state in the end, so fix this by granting 1ns to cfs_rq in tg_set_cfs_bandwidth(). This ensures cfs_rq_c has a positive runtime_remaining when initialized as unthrottled and cannot enter tg_unthrottle_up() with zero runtime_remaining. Also, update outdated comments in tg_throttle_down() since unthrottle_cfs_rq() is no longer called with zero runtime_remaining. While at it, remove a redundant assignment to se in tg_throttle_down(). Fixes: e1fad12dcb66 ("sched/fair: Switch to task based throttle model") Reviewed-By: Benjamin Segall Suggested-by: Benjamin Segall Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Tested-by: Hao Jia Link: https://patch.msgid.link/20251030032755.560-1-ziqianlu@bytedance.com commit 82420bd4e17bdaba8453fbf9e10c58c9ed0c9727 Author: Takashi Iwai Date: Thu Nov 6 11:46:45 2025 +0100 ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own build_controls and build_pcms ops. A copy-n-paste error put the wrong entries for nvhdmi-mcp driver; both build_controls and build_pcms are swapped. Unfortunately both callbacks have the very same form, and the compiler didn't complain it, either. This resulted in a NULL dereference because the PCM instance hasn't been initialized at calling the build_controls callback. Fix it by passing the proper entries. Fixes: ad781b550f9a ("ALSA: hda/hdmi: Rewrite to new probe method") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=220743 Link: https://patch.msgid.link/20251106104647.25805-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d8a823c6f04ef03e3bd7249d2e796da903e7238d Author: Christoph Hellwig Date: Tue Nov 4 05:43:01 2025 -0500 xfs: free xfs_busy_extents structure when no RT extents are queued kmemleak occasionally reports leaking xfs_busy_extents structure from xfs_scrub calls after running xfs/528 (but attributed to following tests), which seems to be caused by not freeing the xfs_busy_extents structure when tr.queued is 0 and xfs_trim_rtgroup_extents breaks out of the main loop. Free the structure in this case. Fixes: a3315d11305f ("xfs: use rtgroup busy extent list for FITRIM") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c379b745e12a99f0a54bafaaf75fc710614511ce Author: Vlastimil Babka Date: Mon Nov 3 13:24:15 2025 +0100 slab: prevent infinite loop in kmalloc_nolock() with debugging In review of a followup work, Harry noticed a potential infinite loop. Upon closed inspection, it already exists for kmalloc_nolock() on a cache with debugging enabled, since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") When alloc_single_from_new_slab() fails to trylock node list_lock, we keep retrying to get partial slab or allocate a new slab. If we indeed interrupted somebody holding the list_lock, the trylock fill fail deterministically and we end up allocating and defer-freeing slabs indefinitely with no progress. To fix it, fail the allocation if spinning is not allowed. This is acceptable in the restricted context of kmalloc_nolock(), especially with debugging enabled. Reported-by: Harry Yoo Closes: https://lore.kernel.org/all/aQLqZjjq1SPD3Fml@hyeyoo/ Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Acked-by: Alexei Starovoitov Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251103-fix-nolock-loop-v1-1-6e2b3e82b9da@suse.cz Signed-off-by: Vlastimil Babka commit 59b0afd01b2ce353ab422ea9c8375b03db313a21 Author: Miaoqian Lin Date: Mon Oct 27 23:09:34 2025 +0800 crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value The qm_get_qos_value() function calls bus_find_device_by_name() which increases the device reference count, but fails to call put_device() to balance the reference count and lead to a device reference leak. Add put_device() calls in both the error path and success path to properly balance the reference count. Found via static analysis. Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Longfang Liu Signed-off-by: Herbert Xu commit 7d1988a943850c584e8e2e4bcc7a3b5275024072 Merge: 4d6ec3a7932ca5 4c740c4d8bac55 Author: Jakub Kicinski Date: Wed Nov 5 18:04:54 2025 -0800 Merge tag 'wireless-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just two small fixes: - ath12k: revert a change that caused performance regressions - hwsim: don't ignore netns on netlink socket matching * tag 'wireless-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup Revert "wifi: ath12k: Fix missing station power save configuration" ==================== Link: https://patch.msgid.link/20251105152827.53254-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 4d6ec3a7932ca5b168426f7b5b40abab2b41d2da Author: Haotian Zhang Date: Wed Nov 5 11:47:16 2025 +0800 net: wan: framer: pef2256: Switch to devm_mfd_add_devices() The driver calls mfd_add_devices() but fails to call mfd_remove_devices() in error paths after successful MFD device registration and in the remove function. This leads to resource leaks where MFD child devices are not properly unregistered. Replace mfd_add_devices with devm_mfd_add_devices to automatically manage the device resources. Fixes: c96e976d9a05 ("net: wan: framer: Add support for the Lantiq PEF2256 framer") Suggested-by: Herve Codina Signed-off-by: Haotian Zhang Acked-by: Herve Codina Link: https://patch.msgid.link/20251105034716.662-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski commit a04ea57aae375bdda1cb57034d8bcbb351e1f973 Author: Jiawen Wu Date: Tue Nov 4 14:23:21 2025 +0800 net: libwx: fix device bus LAN ID The device bus LAN ID was obtained from PCI_FUNC(), but when a PF port is passthrough to a virtual machine, the function number may not match the actual port index on the device. This could cause the driver to perform operations such as LAN reset on the wrong port. Fix this by reading the LAN ID from port status register. Fixes: a34b3e6ed8fb ("net: txgbe: Store PCI info") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/B60A670C1F52CB8E+20251104062321.40059-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit b1d9154878ce310d46dde5a8545366d807179b28 Merge: ae4789affd1e18 d8a7ed9586c757 Author: Jakub Kicinski Date: Wed Nov 5 17:48:40 2025 -0800 Merge branch 'net-mlx5e-shampo-fixes-for-64kb-page-size' Tariq Toukan says: ==================== net/mlx5e: SHAMPO fixes for 64KB page size This series by Dragos contains fixes for HW-GRO issues found on systems with 64KB page size. ==================== Link: https://patch.msgid.link/1762238915-1027590-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d8a7ed9586c7579a99e9e2d90988c9eceeee61ff Author: Dragos Tatulea Date: Tue Nov 4 08:48:35 2025 +0200 net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages The MLX5E_SHAMPO_WQ_HEADER_PER_PAGE and MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE macros are used directly in several places under the assumption that there will always be more headers per WQE than headers per page. However, this assumption doesn't hold for 64K page sizes and higher MTUs (> 4K). This can be first observed during header page allocation: ksm_entries will become 0 during alignment to MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. This patch introduces 2 additional members to the mlx5e_shampo_hd struct which are meant to be used instead of the macrose mentioned above. When the number of headers per WQE goes below MLX5E_SHAMPO_WQ_HEADER_PER_PAGE, clamp the number of headers per page and expand the header size accordingly so that the headers for one WQE cover a full page. All the formulas are adapted to use these two new members. Fixes: 945ca432bfd0 ("net/mlx5e: SHAMPO, Drop info array") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bacd8d80181ebe34b599a39aa26bf73a44c91e55 Author: Dragos Tatulea Date: Tue Nov 4 08:48:34 2025 +0200 net/mlx5e: SHAMPO, Fix skb size check for 64K pages mlx5e_hw_gro_skb_has_enough_space() uses a formula to check if there is enough space in the skb frags to store more data. This formula is incorrect for 64K page sizes and it triggers early GRO session termination because the first fragment will blow up beyond GRO_LEGACY_MAX_SIZE. This patch adds a special case for page sizes >= GRO_LEGACY_MAX_SIZE (64K) which uses the skb->len instead. Within this context, the check is safe from fragment overflow because the hardware will continuously fill the data up to the reservation size of 64K and the driver will coalesce all data from the same page to the same fragment. This means that the data will span one fragment or at most two for such a large page size. It is expected that the if statement will be optimized out as the check is done with constants. Fixes: 92552d3abd32 ("net/mlx5e: HW_GRO cqe handler implementation") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 665a7e13c220bbde55531a24bd5524320648df10 Author: Dragos Tatulea Date: Tue Nov 4 08:48:33 2025 +0200 net/mlx5e: SHAMPO, Fix header mapping for 64K pages HW-GRO is broken on mlx5 for 64K page sizes. The patch in the fixes tag didn't take into account larger page sizes when doing an align down of max_ksm_entries. For 64K page size, max_ksm_entries is 0 which will skip mapping header pages via WQE UMR. This breaks header-data split and will result in the following syndrome: mlx5_core 0000:00:08.0 eth2: Error cqe on cqn 0x4c9, ci 0x0, qn 0x1133, opcode 0xe, syndrome 0x4, vendor syndrome 0x32 00000000: 00 00 00 00 04 4a 00 00 00 00 00 00 20 00 93 32 00000010: 55 00 00 00 fb cc 00 00 00 00 00 00 07 18 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a 00000030: 00 00 3b c7 93 01 32 04 00 00 00 00 00 00 bf e0 mlx5_core 0000:00:08.0 eth2: ERR CQE on RQ: 0x1133 Furthermore, the function that fills in WQE UMRs for the headers (mlx5e_build_shampo_hd_umr()) only supports mapping page sizes that fit in a single UMR WQE. This patch goes back to the old non-aligned max_ksm_entries value and it changes mlx5e_build_shampo_hd_umr() to support mapping a large page over multiple UMR WQEs. This means that mlx5e_build_shampo_hd_umr() can now leave a page only partially mapped. The caller, mlx5e_alloc_rx_hd_mpwqe(), ensures that there are enough UMR WQEs to cover complete pages by working on ksm_entries that are multiples of MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. Fixes: 8a0ee54027b1 ("net/mlx5e: SHAMPO, Simplify UMR allocation for headers") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ae4789affd1e181ae46e72e2b5fbe2d6d7b6616a Author: Meghana Malladi Date: Tue Nov 4 16:14:15 2025 +0530 net: ti: icssg-prueth: Fix fdb hash size configuration The ICSSG driver does the initial FDB configuration which includes setting the control registers. Other run time management like learning is managed by the PRU's. The default FDB hash size used by the firmware is 512 slots, which is currently missing in the current driver. Update the driver FDB config to include FDB hash size as well. Please refer trm [1] 6.4.14.12.17 section on how the FDB config register gets configured. From the table 6-1404, there is a reset field for FDB_HAS_SIZE which is 4, meaning 1024 slots. Currently the driver is not updating this reset value from 4(1024 slots) to 3(512 slots). This patch fixes this by updating the reset value to 512 slots. [1]: https://www.ti.com/lit/pdf/spruim2 Fixes: abd5576b9c57f ("net: ti: icssg-prueth: Add support for ICSSG switch firmware") Signed-off-by: Meghana Malladi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251104104415.3110537-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski commit d1c94bc5b90c21b65469d30d4a6bc8ed715c1bfe Author: Gal Pressman Date: Tue Nov 4 16:15:36 2025 +0200 net/mlx5e: Fix return value in case of module EEPROM read error mlx5e_get_module_eeprom_by_page() has weird error handling. First, it is treating -EINVAL as a special case, but it is unclear why. Second, it tries to fail "gracefully" by returning the number of bytes read even in case of an error. This results in wrongly returning success (0 return value) if the error occurs before any bytes were read. Simplify the error handling by returning an error when such occurs. This also aligns with the error handling we have in mlx5e_get_module_eeprom() for the old API. This fixes the following case where the query fails, but userspace ethtool wrongly treats it as success and dumps an output: # ethtool -m eth2 netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 Offset Values ------ ------ 0x0000: 00 00 00 00 05 00 04 00 00 00 00 00 05 00 05 00 0x0010: 00 00 00 00 05 00 06 00 50 00 00 00 67 65 20 66 0x0020: 61 69 6c 65 64 2c 20 72 65 61 64 20 30 20 62 79 0x0030: 74 65 73 2c 20 65 72 72 20 2d 35 00 14 00 03 00 0x0040: 08 00 01 00 03 00 00 00 08 00 02 00 1a 00 00 00 0x0050: 14 00 04 00 08 00 01 00 04 00 00 00 08 00 02 00 0x0060: 0e 00 00 00 14 00 05 00 08 00 01 00 05 00 00 00 0x0070: 08 00 02 00 1a 00 00 00 14 00 06 00 08 00 01 00 Fixes: e109d2b204da ("net/mlx5: Implement get_module_eeprom_by_page()") Signed-off-by: Gal Pressman Reviewed-by: Alex Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762265736-1028868-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d917c217b612971ea05ae1582e8740b747e0e7e8 Author: Sebastian Andrzej Siewior Date: Tue Nov 4 16:34:35 2025 +0100 net: gro_cells: Reduce lock scope in gro_cell_poll One GRO-cell device's NAPI callback can nest into the GRO-cell of another device if the underlying device is also using GRO-cell. This is the case for IPsec over vxlan. These two GRO-cells are separate devices. From lockdep's point of view it is the same because each device is sharing the same lock class and so it reports a possible deadlock assuming one device is nesting into itself. Hold the bh_lock only while accessing gro_cell::napi_skbs in gro_cell_poll(). This reduces the locking scope and avoids acquiring the same lock class multiple times. Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell") Reported-by: Gal Pressman Closes: https://lore.kernel.org/all/66664116-edb8-48dc-ad72-d5223696dd19@nvidia.com/ Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251104153435.ty88xDQt@linutronix.de Signed-off-by: Jakub Kicinski commit b1d16f7c0063b7209fd3251ce40c77d37b477b83 Author: Michal Swiatkowski Date: Tue Nov 4 09:23:31 2025 -0800 libie: depend on DEBUG_FS when building LIBIE_FWLOG LIBIE_FWLOG is unusable without DEBUG_FS. Mark it in Kconfig. Fix build error on ixgbe when DEBUG_FS is not set. To not add another layer of #if IS_ENABLED(LIBIE_FWLOG) in ixgbe fwlog code define debugfs dentry even when DEBUG_FS isn't enabled. In this case the dummy functions of LIBIE_FWLOG will be used, so not initialized dentry isn't a problem. Fixes: 641585bc978e ("ixgbe: fwlog support for e610") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/lkml/f594c621-f9e1-49f2-af31-23fbcb176058@roeck-us.net/ Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251104172333.752445-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e427054ae7bc8b1268cf1989381a43885795616f Merge: 44e8f13f07cfaa 3490d29964bdd5 Author: Alexei Starovoitov Date: Wed Nov 5 17:05:19 2025 -0800 Merge branch 'x86-fgraph-bpf-fix-orc-stack-unwind-from-return-probe' Jiri Olsa says: ==================== x86/fgraph,bpf: Fix ORC stack unwind from return probe sending fix for ORC stack unwind issue reported in here [1], where the ORC unwinder won't go pass the return_to_handler function and we get no stacktrace. Sending fix for that together with unrelated stacktrace fix (patch 1), so the attached test can work properly. It's based on: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git probes/for-next v1: https://lore.kernel.org/bpf/20251027131354.1984006-1-jolsa@kernel.org/ v2: https://lore.kernel.org/bpf/20251103220924.36371-3-jolsa@kernel.org/ v3 changes: - fix assert condition in test thanks, jirka [1] https://lore.kernel.org/bpf/aObSyt3qOnS_BMcy@krava/ ==================== Acked-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20251104215405.168643-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 3490d29964bdd524366d266b655112cb549c7460 Author: Jiri Olsa Date: Tue Nov 4 22:54:05 2025 +0100 selftests/bpf: Add stacktrace ips test for raw_tp Adding test that verifies we get expected initial 2 entries from stacktrace for rawtp probe via ORC unwind. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit c9e208fa93cd66f8077ee15df0728e62b105a687 Author: Jiri Olsa Date: Tue Nov 4 22:54:04 2025 +0100 selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi Adding test that attaches kprobe/kretprobe multi and verifies the ORC stacktrace matches expected functions. Adding bpf_testmod_stacktrace_test function to bpf_testmod kernel module which is called through several functions so we get reliable call path for stacktrace. The test is only for ORC unwinder to keep it simple. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 20a0bc10272fa17a44fc857c31574a8306f60d20 Author: Jiri Olsa Date: Tue Nov 4 22:54:03 2025 +0100 x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe Currently we don't get stack trace via ORC unwinder on top of fgraph exit handler. We can see that when generating stacktrace from kretprobe_multi bpf program which is based on fprobe/fgraph. The reason is that the ORC unwind code won't get pass the return_to_handler callback installed by fgraph return probe machinery. Solving this by creating stack frame in return_to_handler expected by ftrace_graph_ret_addr function to recover original return address and continue with the unwind. Also updating the pt_regs data with cs/flags/rsp which are needed for successful stack retrieval from ebpf bpf_get_stackid helper. - in get_perf_callchain we check user_mode(regs) so CS has to be set - in perf_callchain_kernel we call perf_hw_regs(regs), so EFLAGS/FIXED has to be unset Acked-by: Masami Hiramatsu (Google) Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed Author: Jiri Olsa Date: Tue Nov 4 22:54:02 2025 +0100 Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3. Currently we store initial stacktrace entry twice for non-HW ot_regs, which means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel. It's easy to reproduce this bpftrace: # bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }' Attaching 1 probe... bprm_execve+1767 bprm_execve+1767 do_execveat_common.isra.0+425 __x64_sys_execve+56 do_syscall_64+133 entry_SYSCALL_64_after_hwframe+118 When perf_callchain_kernel calls unwind_start with first_frame, AFAICS we do not skip regs->ip, but it's added as part of the unwind process. Hence reverting the extra perf_callchain_store for non-hw regs leg. I was not able to bisect this, so I'm not really sure why this was needed in v5.2 and why it's not working anymore, but I could see double entries as far as v5.10. I did the test for both ORC and framepointer unwind with and without the this fix and except for the initial entry the stacktraces are the same. Acked-by: Song Liu Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 664ce10246ba00746af94a08b7fbda8ccaacd930 Author: James Jones Date: Thu Oct 30 11:11:53 2025 -0700 drm/nouveau: Advertise correct modifiers on GB20x 8 and 16 bit formats use a different layout on GB20x than they did on prior chips. Add the corresponding DRM format modifiers to the list of modifiers supported by the display engine on such chips, and filter the supported modifiers for each format based on its bytes per pixel in nv50_plane_format_mod_supported(). Note this logic will need to be updated when GB10 support is added, since it is a GB20x chip that uses the pre-GB20x sector layout for all formats. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Signed-off-by: James Jones Reviewed-by: Faith Ekstrand Signed-off-by: Dave Airlie Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030181153.1208-3-jajones@nvidia.com commit 1cf52a0d4ba079fb354fa1339f5fb34142228dae Author: James Jones Date: Thu Oct 30 11:11:52 2025 -0700 drm: define NVIDIA DRM format modifiers for GB20x The layout of bits within the individual tiles (referred to as sectors in the DRM_FORMAT_MOD_NVIDIA_BLOCK_LINEAR_2D() macro) changed for 8 and 16-bit surfaces starting in Blackwell 2 GPUs (With the exception of GB10). To denote the difference, extend the sector field in the parametric format modifier definition used to generate modifier values for NVIDIA hardware. Without this change, it would be impossible to differentiate the two layouts based on modifiers, and as a result software could attempt to share surfaces directly between pre-GB20x and GB20x cards, resulting in corruption when the surface was accessed on one of the GPUs after being populated with content by the other. Of note: This change causes the DRM_FORMAT_MOD_NVIDIA_BLOCK_LINEAR_2D() macro to evaluate its "s" parameter twice, with the side effects that entails. I surveyed all usage of the modifier in the kernel and Mesa code, and that does not appear to be problematic in any current usage, but I thought it was worth calling out. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Signed-off-by: James Jones Reviewed-by: Faith Ekstrand Signed-off-by: Dave Airlie Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030181153.1208-2-jajones@nvidia.com commit ebe755605082eddff80eafe0c50915b1366ee98f Author: Timur Tabi Date: Tue Oct 14 12:45:12 2025 -0500 drm/nouveau: set DMA mask before creating the flush page Set the DMA mask before calling nvkm_device_ctor(), so that when the flush page is created in nvkm_fb_ctor(), the allocation will not fail if the page is outside of DMA address space, which can easily happen if IOMMU is disable. In such situations, you will get an error like this: nouveau 0000:65:00.0: DMA addr 0x0000000107c56000+4096 overflow (mask ffffffff, bus limit 0). Commit 38f5359354d4 ("rm/nouveau/pci: set streaming DMA mask early") set the mask after calling nvkm_device_ctor(), but back then there was no flush page being created, which might explain why the mask wasn't set earlier. Flush page allocation was added in commit 5728d064190e ("drm/nouveau/fb: handle sysmem flush page from common code"). nvkm_fb_ctor() calls alloc_page(), which can allocate a page anywhere in system memory, but then calls dma_map_page() on that page. But since the DMA mask is still set to 32, the map can fail if the page is allocated above 4GB. This is easy to reproduce on systems with a lot of memory and IOMMU disabled. An alternative approach would be to force the allocation of the flush page to low memory, by specifying __GFP_DMA32. However, this would always allocate the page in low memory, even though the hardware can access high memory. Signed-off-by: Timur Tabi Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20251014174512.3172102-1-ttabi@nvidia.com commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 Author: Keith Busch Date: Tue Nov 4 14:48:30 2025 -0800 nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug: BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 Reported-by: Casey Chen Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit dc77806cf3b4788d328fddf245e86c5b529f31a2 Merge: 5624d4c3781673 789521b4717fd6 Author: Linus Torvalds Date: Wed Nov 5 11:15:36 2025 -0800 Merge tag 'rust-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: - Fix/workaround a couple Rust 1.91.0 build issues when sanitizers are enabled due to extra checking performed by the compiler and an upstream issue already fixed for Rust 1.93.0 - Fix future Rust 1.93.0 builds by supporting the stabilized name for the 'no-jump-tables' flag - Fix a couple private/broken intra-doc links uncovered by the future move of pin-init to 'syn' * tag 'rust-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 rust: kbuild: workaround `rustdoc` doctests modifier bug rust: kbuild: treat `build_error` and `rustdoc` as kernel objects rust: condvar: fix broken intra-doc link rust: devres: fix private intra-doc link commit afb47765f9235181fddc61c8633b5a8cfae29fd2 Author: Jason Gunthorpe Date: Tue Nov 4 14:11:49 2025 -0400 iommufd: Make vfio_compat's unmap succeed if the range is already empty iommufd returns ENOENT when attempting to unmap a range that is already empty, while vfio type1 returns success. Fix vfio_compat to match. Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Alex Mastro Reported-by: Alex Mastro Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com Signed-off-by: Jason Gunthorpe commit 5624d4c3781673da84e6144c359803ca31b66214 Merge: 1c353dc8d962de bd34bf518a5ffe Author: Linus Torvalds Date: Wed Nov 5 11:08:10 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes and New Hotkey Support: - input + dell-wmi-base: Electronic privacy screen on/off hotkey support - int3472: Fix unregister double free - wireless-hotkey: Fix Kconfig typo" * tag 'platform-drivers-x86-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform: x86: Kconfig: fix minor typo in help for WIRELESS_HOTKEY platform/x86: dell-wmi-base: Handle electronic privacy screen on/off events Input: Add keycodes for electronic privacy screen on/off hotkeys MAINTAINERS: Update int3472 maintainers platform/x86: int3472: Fix double free of GPIO device during unregister commit c367af440e03eba7beb0c9f3fe540f9bcb69134a Author: Zilin Guan Date: Wed Nov 5 02:37:22 2025 +0000 btrfs: release root after error in data_reloc_print_warning_inode() data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain local_root, but fails to release its reference when paths_from_inode() returns an error. This causes a potential memory leak. Add a missing btrfs_put_root() call in the error path to properly decrease the reference count of local_root. Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Qu Wenruo Signed-off-by: Zilin Guan Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd Author: Zilin Guan Date: Wed Nov 5 03:53:21 2025 +0000 btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but fails to release it on some error paths, leading to a potential memory leak. Add the missing bio_put() calls to properly drop the bio reference in those error cases. Fixes: 1009254bf22a3 ("btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Qu Wenruo Signed-off-by: Zilin Guan Reviewed-by: David Sterba Signed-off-by: David Sterba commit bfe3d755ef7cec71aac6ecda34a107624735aac7 Author: Filipe Manana Date: Wed Oct 29 13:05:32 2025 +0000 btrfs: do not update last_log_commit when logging inode due to a new name When logging that a new name exists, we skip updating the inode's last_log_commit field to prevent a later explicit fsync against the inode from doing nothing (as updating last_log_commit makes btrfs_inode_in_log() return true). We are detecting, at btrfs_log_inode(), that logging a new name is happening by checking the logging mode is not LOG_INODE_EXISTS, but that is not enough because we may log parent directories when logging a new name of a file in LOG_INODE_ALL mode - we need to check that the logging_new_name field of the log context too. An example scenario where this results in an explicit fsync against a directory not persisting changes to the directory is the following: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt $ touch /mnt/foo $ sync $ mkdir /mnt/dir # Write some data to our file and fsync it. $ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo # Add a new link to our file. Since the file was logged before, we # update it in the log tree by calling btrfs_log_new_name(). $ ln /mnt/foo /mnt/dir/bar # fsync the root directory - we expect it to persist the dentry for # the new directory "dir". $ xfs_io -c "fsync" /mnt After mounting the fs the entry for directory "dir" does not exists, despite the explicit fsync on the root directory. Here's why this happens: 1) When we fsync the file we log the inode, so that it's present in the log tree; 2) When adding the new link we enter btrfs_log_new_name(), and since the inode is in the log tree we proceed to updating the inode in the log tree; 3) We first set the inode's last_unlink_trans to the current transaction (early in btrfs_log_new_name()); 4) We then eventually enter btrfs_log_inode_parent(), and after logging the file's inode, we call btrfs_log_all_parents() because the inode's last_unlink_trans matches the current transaction's ID (updated in the previous step); 5) So btrfs_log_all_parents() logs the root directory by calling btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL so that new dentries are logged; 6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we update root inode's last_log_commit to the last transaction that changed the inode (->last_sub_trans field of the inode), which corresponds to the current transaction's ID; 7) Then later when user space explicitly calls fsync against the root directory, we enter btrfs_sync_file(), which calls skip_inode_logging() and that returns true, since its call to btrfs_inode_in_log() returns true and there are no ordered extents (it's a directory, never has ordered extents). This results in btrfs_sync_file() returning without syncing the log or committing the current transaction, so all the updates we did when logging the new name, including logging the root directory, are not persisted. So fix this by but updating the inode's last_log_commit if we are sure we are not logging a new name (if ctx->logging_new_name is false). A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/ Fixes: 130341be7ffa ("btrfs: always update the logged transaction when logging new names") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6a1ab50135ce829b834b448ce49867b5210a1641 Author: Naohiro Aota Date: Tue Sep 16 11:46:11 2025 +0900 btrfs: zoned: fix stripe width calculation The stripe offset calculation in the zoned code for raid0 and raid10 wrongly uses map->stripe_size to calculate it. In fact, map->stripe_size is the size of the device extent composing the block group, which always is the zone_size on the zoned setup. Fix it by using BTRFS_STRIPE_LEN and BTRFS_STRIPE_LEN_SHIFT. Also, optimize the calculation a bit by doing the common calculation only once. Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups") CC: stable@vger.kernel.org # 6.17+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 94f54924b96d3565c6b559294b3401b5496c21ac Author: Naohiro Aota Date: Fri Sep 12 15:43:21 2025 +0900 btrfs: zoned: fix conventional zone capacity calculation When a block group contains both conventional zone and sequential zone, the capacity of the block group is wrongly set to the block group's full length. The capacity should be calculated in btrfs_load_block_group_* using the last allocation offset. Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") CC: stable@vger.kernel.org # v6.12+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 1fd5367391bf0eeb09e624c4ab45121b54eaab96 Author: Pavel Begunkov Date: Wed Nov 5 15:47:01 2025 +0000 io_uring: fix types for region size calulation ->nr_pages is int, it needs type extension before calculating the region size. Fixes: a90558b36ccee ("io_uring/memmap: helper for pinning region pages") Signed-off-by: Pavel Begunkov [axboe: style fixup] Signed-off-by: Jens Axboe commit 5e44c5a2cc84bed6b92cdfd9c567fcdb9f792604 Author: Laurent Pinchart Date: Sun Nov 2 13:14:42 2025 +0200 arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias The RP1 ethernet controller DT node contains a local-mac-address property to pass the MAC address from the boot loader to the kernel. The boot loader does not fill the MAC address as the ethernet0 alias is missing. Add it. Signed-off-by: Laurent Pinchart Reviewed-by: Andrea della Porta Link: https://lore.kernel.org/r/20251102111443.18206-1-laurent.pinchart@ideasonboard.com Fixes: 43456fdfc014 ("arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5") Signed-off-by: Florian Fainelli commit a7da9c6a2fc08b6ad1a2e9aebbb14bcc59320374 Author: Andrea della Porta Date: Tue Oct 21 15:55:33 2025 +0200 arm64: dts: broadcom: Assign clock rates in eth node for RPi5 In Raspberry Pi 5 DTS, the Ethernet clock rates must be assigned as the default clock register values are not valid for the Ethernet interface to function. This can be done either in rp1_clocks node or in rp1_eth node. Define the rates in rp1_eth node, as those clocks are 'leaf' clocks used specifically by the Ethernet device only. Fixes: 43456fdfc014 ("arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5") Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/20251021135533.5517-1-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 21ab5179aafa2ded7f3851bfe7e043f8a3b6199d Author: Christoph Hellwig Date: Mon Nov 3 05:15:13 2025 -0500 xfs: fix zone selection in xfs_select_open_zone_mru xfs_select_open_zone_mru needs to pass XFS_ZONE_ALLOC_OK to xfs_try_use_zone because we only want to tightly pack into zones of the same or a compatible temperature instead of any available zone. This got broken in commit 0301dae732a5 ("xfs: refactor hint based zone allocation"), which failed to update this particular caller when switching to an enum. xfs/638 sometimes, but not reliably fails due to this change. Fixes: 0301dae732a5 ("xfs: refactor hint based zone allocation") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit f5714a3c1a5658251360603231efe1bee21f9c2c Author: Christoph Hellwig Date: Tue Nov 4 08:50:53 2025 -0500 xfs: fix a rtgroup leak when xfs_init_zone fails Drop the rtgrop reference when xfs_init_zone fails for a conventional device. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 8d7bba1e8314013ecc817a91624104ceb9352ddc Author: Darrick J. Wong Date: Tue Nov 4 16:15:38 2025 -0800 xfs: fix various problems in xfs_atomic_write_cow_iomap_begin I think there are several things wrong with this function: A) xfs_bmapi_write can return a much larger unwritten mapping than what the caller asked for. We convert part of that range to written, but return the entire written mapping to iomap even though that's inaccurate. B) The arguments to xfs_reflink_convert_cow_locked are wrong -- an unwritten mapping could be *smaller* than the write range (or even the hole range). In this case, we convert too much file range to written state because we then return a smaller mapping to iomap. C) It doesn't handle delalloc mappings. This I covered in the patch that I already sent to the list. D) Reassigning count_fsb to handle the hole means that if the second cmap lookup attempt succeeds (due to racing with someone else) we trim the mapping more than is strictly necessary. The changing meaning of count_fsb makes this harder to notice. E) The tracepoint is kinda wrong because @length is mutated. That makes it harder to chase the data flows through this function because you can't just grep on the pos/bytecount strings. F) We don't actually check that the br_state = XFS_EXT_NORM assignment is accurate, i.e that the cow fork actually contains a written mapping for the range we're interested in G) Somewhat inadequate documentation of why we need to xfs_trim_extent so aggressively in this function. H) Not sure why xfs_iomap_end_fsb is used here, the vfs already clamped the write range to s_maxbytes. Fix these issues, and then the atomic writes regressions in generic/760, generic/617, generic/091, generic/263, and generic/521 all go away for me. Cc: stable@vger.kernel.org # v6.16 Fixes: bd1d2c21d5d249 ("xfs: add xfs_atomic_write_cow_iomap_begin()") Signed-off-by: Darrick J. Wong Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit 8d54eacd82a0623a963e0c150ad3b02970638b0d Author: Darrick J. Wong Date: Tue Nov 4 16:12:00 2025 -0800 xfs: fix delalloc write failures in software-provided atomic writes With the 20 Oct 2025 release of fstests, generic/521 fails for me on regular (aka non-block-atomic-writes) storage: QA output created by 521 dowrite: write: Input/output error LOG DUMP (8553 total operations): 1( 1 mod 256): SKIPPED (no operation) 2( 2 mod 256): WRITE 0x7e000 thru 0x8dfff (0x10000 bytes) HOLE 3( 3 mod 256): READ 0x69000 thru 0x79fff (0x11000 bytes) 4( 4 mod 256): FALLOC 0x53c38 thru 0x5e853 (0xac1b bytes) INTERIOR 5( 5 mod 256): COPY 0x55000 thru 0x59fff (0x5000 bytes) to 0x25000 thru 0x29fff 6( 6 mod 256): WRITE 0x74000 thru 0x88fff (0x15000 bytes) 7( 7 mod 256): ZERO 0xedb1 thru 0x11693 (0x28e3 bytes) with a warning in dmesg from iomap about XFS trying to give it a delalloc mapping for a directio write. Fix the software atomic write iomap_begin code to convert the reservation into a written mapping. This doesn't fix the data corruption problems reported by generic/760, but it's a start. Cc: stable@vger.kernel.org # v6.16 Fixes: bd1d2c21d5d249 ("xfs: add xfs_atomic_write_cow_iomap_begin()") Signed-off-by: Darrick J. Wong Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit 4c740c4d8bac5569c5bf5f86db65ce779178f9a2 Merge: c74619e7602e88 9222582ec52470 Author: Johannes Berg Date: Wed Nov 5 16:18:29 2025 +0100 Merge tag 'ath-current-20251103' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc5 Revert an ath12k change which resulted in a significance performance impact on WCN7850. ================== Signed-off-by: Johannes Berg commit c74619e7602e88a0239cd4999571dd31081e9adf Author: Martin Willi Date: Mon Nov 3 09:24:36 2025 +0100 wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup hwsim radios marked destroy_on_close are removed when the Netlink socket that created them is closed. As the portid is not unique across network namespaces, closing a socket in one namespace may remove radios in another if it has the destroy_on_close flag set. Instead of matching the network namespace, match the netgroup of the radio to limit radio removal to those that have been created by the closing Netlink socket. The netgroup of a radio identifies the network namespace it was created in, and matching on it removes a destroy_on_close radio even if it has been moved to another namespace. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Signed-off-by: Martin Willi Link: https://patch.msgid.link/20251103082436.30483-1-martin@strongswan.org Signed-off-by: Johannes Berg commit 997c06330fd5c2e220b692f2a358986c6c8fd5a2 Author: Laurentiu Mihalcea Date: Tue Nov 4 04:02:54 2025 -0800 reset: imx8mp-audiomix: Fix bad mask values As per the i.MX8MP TRM, section 14.2 "AUDIO_BLK_CTRL", table 14.2.3.1.1 "memory map", the definition of the EARC control register shows that the EARC controller software reset is controlled via bit 0, while the EARC PHY software reset is controlled via bit 1. This means that the current definitions of IMX8MP_AUDIOMIX_EARC_RESET_MASK and IMX8MP_AUDIOMIX_EARC_PHY_RESET_MASK are wrong since their values would imply that the EARC controller software reset is controlled via bit 1 and the EARC PHY software reset is controlled via bit 2. Fix them. Fixes: a83bc87cd30a ("reset: imx8mp-audiomix: Prepare the code for more reset bits") Cc: stable@vger.kernel.org Reviewed-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Signed-off-by: Philipp Zabel commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f Author: Hans de Goede Date: Sun Nov 2 20:09:21 2025 +0100 spi: Try to get ACPI GPIO IRQ earlier Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called on the SPI device. If there is no driver for the SPI device then the move to spi_probe() results in acpi_dev_gpio_irq_get() never getting called. This may cause problems by leaving the GPIO pin floating because this call is responsible for setting up the GPIO pin direction and/or bias according to the values from the ACPI tables. Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device() to ensure the GPIO pin is always correctly setup, while keeping the acpi_dev_gpio_irq_get() call added to spi_probe() to deal with -EPROBE_DEFER returns caused by the GPIO controller not having a driver yet. Link: https://bbs.archlinux.org/viewtopic.php?id=302348 Fixes: d24cfee7f63d ("spi: Fix acpi deferred irq probe") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20251102190921.30068-1-hansg@kernel.org Signed-off-by: Mark Brown commit 75fdd57499a392e97fc0cff8df64e44472c07f2f Merge: 90f601b497d76f 8637fa89e67842 Author: Christian Brauner Date: Wed Nov 5 12:16:54 2025 +0100 Merge patch series "sb_min_blocksize() fixes" Enforce checking of sb_min_blocksize() calls and update all callers accordingly. * patches from https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com: block: add __must_check attribute to sb_min_blocksize() xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super isofs: check the return value of sb_min_blocksize() in isofs_fill_super exfat: check return value of sb_min_blocksize in exfat_read_boot_sector vfat: fix missing sb_min_blocksize() return value checks Link: https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit 90f601b497d76f40fa66795c3ecf625b6aced9fd Author: Zilin Guan Date: Wed Nov 5 02:29:23 2025 +0000 binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail. Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly. Fixes: e7850f4d844e ("binfmt_misc: fix possible deadlock in bm_register_write") Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20251105022923.1813587-1-zilin@seu.edu.cn Signed-off-by: Christian Brauner commit 8637fa89e678422995301ddb20b74190dffcccee Author: Yongpeng Yang Date: Tue Nov 4 20:50:10 2025 +0800 block: add __must_check attribute to sb_min_blocksize() When sb_min_blocksize() returns 0 and the return value is not checked, it may lead to a situation where sb->s_blocksize is 0 when accessing the filesystem super block. After commit a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()"), this becomes more likely to happen when the block device’s logical_block_size is larger than PAGE_SIZE and the filesystem is unformatted. Add the __must_check attribute to ensure callers always check the return value. Cc: stable@vger.kernel.org # v6.15 Suggested-by: Matthew Wilcox Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-6-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit c014021253d77cd89b2d8788ce522283d83fbd40 Author: Alok Tiwari Date: Mon Oct 27 03:46:47 2025 -0700 virtio-fs: fix incorrect check for fsvq->kobj In virtio_fs_add_queues_sysfs(), the code incorrectly checks fs->mqs_kobj after calling kobject_create_and_add(). Change the check to fsvq->kobj (fs->mqs_kobj -> fsvq->kobj) to ensure the per-queue kobject is successfully created. Fixes: 87cbdc396a31 ("virtio_fs: add sysfs entries for queue information") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251027104658.1668537-1-alok.a.tiwari@oracle.com Reviewed-by: Stefan Hajnoczi Signed-off-by: Christian Brauner commit 124af0868ec6929ba838fb76d25f00c06ba8fc0d Author: Yongpeng Yang Date: Tue Nov 4 20:50:09 2025 +0800 xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super sb_min_blocksize() may return 0. Check its return value to avoid the filesystem super block when sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()") Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-5-yangyongpeng.storage@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit e106e269c5cb38315eb0a0e7e38f71e9b20c8c66 Author: Yongpeng Yang Date: Tue Nov 4 20:50:08 2025 +0800 isofs: check the return value of sb_min_blocksize() in isofs_fill_super sb_min_blocksize() may return 0. Check its return value to avoid opt->blocksize and sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: 1b17a46c9243e9 ("isofs: convert isofs to use the new mount API") Reviewed-by: Jan Kara Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-4-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit f2c1f631630e01821fe4c3fdf6077bc7a8284f82 Author: Yongpeng Yang Date: Tue Nov 4 20:50:07 2025 +0800 exfat: check return value of sb_min_blocksize in exfat_read_boot_sector sb_min_blocksize() may return 0. Check its return value to avoid accessing the filesystem super block when sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: 719c1e1829166d ("exfat: add super block operations") Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-3-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit 63b5aa01da0f38cdbd97d021477258e511631497 Author: Yongpeng Yang Date: Tue Nov 4 20:50:06 2025 +0800 vfat: fix missing sb_min_blocksize() return value checks When emulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, but without format, a kernel panic was triggered during the early boot stage while attempting to mount a vfat filesystem. [95553.682035] EXT4-fs (nvme0n1): unable to set blocksize [95553.684326] EXT4-fs (nvme0n1): unable to set blocksize [95553.686501] EXT4-fs (nvme0n1): unable to set blocksize [95553.696448] ISOFS: unsupported/invalid hardware sector size 8192 [95553.697117] ------------[ cut here ]------------ [95553.697567] kernel BUG at fs/buffer.c:1582! [95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI [95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary) [95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0 [95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f [95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246 [95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001 [95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000 [95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000 [95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000 [95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000 [95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0 [95553.708439] PKRU: 55555554 [95553.708734] Call Trace: [95553.709015] [95553.709266] __getblk_slow+0xd2/0x230 [95553.709641] ? find_get_block_common+0x8b/0x530 [95553.710084] bdev_getblk+0x77/0xa0 [95553.710449] __bread_gfp+0x22/0x140 [95553.710810] fat_fill_super+0x23a/0xfc0 [95553.711216] ? __pfx_setup+0x10/0x10 [95553.711580] ? __pfx_vfat_fill_super+0x10/0x10 [95553.712014] vfat_fill_super+0x15/0x30 [95553.712401] get_tree_bdev_flags+0x141/0x1e0 [95553.712817] get_tree_bdev+0x10/0x20 [95553.713177] vfat_get_tree+0x15/0x20 [95553.713550] vfs_get_tree+0x2a/0x100 [95553.713910] vfs_cmd_create+0x62/0xf0 [95553.714273] __do_sys_fsconfig+0x4e7/0x660 [95553.714669] __x64_sys_fsconfig+0x20/0x40 [95553.715062] x64_sys_call+0x21ee/0x26a0 [95553.715453] do_syscall_64+0x80/0x670 [95553.715816] ? __fs_parse+0x65/0x1e0 [95553.716172] ? fat_parse_param+0x103/0x4b0 [95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0 [95553.717034] ? __do_sys_fsconfig+0x3d9/0x660 [95553.717548] ? __x64_sys_fsconfig+0x20/0x40 [95553.717957] ? x64_sys_call+0x21ee/0x26a0 [95553.718360] ? do_syscall_64+0xb8/0x670 [95553.718734] ? __x64_sys_fsconfig+0x20/0x40 [95553.719141] ? x64_sys_call+0x21ee/0x26a0 [95553.719545] ? do_syscall_64+0xb8/0x670 [95553.719922] ? x64_sys_call+0x1405/0x26a0 [95553.720317] ? do_syscall_64+0xb8/0x670 [95553.720702] ? __x64_sys_close+0x3e/0x90 [95553.721080] ? x64_sys_call+0x1b5e/0x26a0 [95553.721478] ? do_syscall_64+0xb8/0x670 [95553.721841] ? irqentry_exit+0x43/0x50 [95553.722211] ? exc_page_fault+0x90/0x1b0 [95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e [95553.723166] RIP: 0033:0x72ee774f3afe [95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48 [95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe [95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0 [95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28 [95553.729086] The panic occurs as follows: 1. logical_block_size is 8KiB, causing {struct super_block *sb}->s_blocksize is initialized to 0. vfat_fill_super - fat_fill_super - sb_min_blocksize - sb_set_blocksize //return 0 when size is 8KiB. 2. __bread_gfp is called with size == 0, causing folio_alloc_buffers() to compute an offset equal to folio_size(folio), which triggers a BUG_ON. fat_fill_super - sb_bread - __bread_gfp // size == {struct super_block *sb}->s_blocksize == 0 - bdev_getblk - __getblk_slow - grow_buffers - grow_dev_folio - folio_alloc_buffers // size == 0 - folio_set_bh //offset == folio_size(folio) and panic To fix this issue, add proper return value checks for sb_min_blocksize(). Cc: stable@vger.kernel.org # v6.15 Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()") Reviewed-by: Matthew Wilcox Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Reviewed-by: OGAWA Hirofumi Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com Acked-by: OGAWA Hirofumi Signed-off-by: Christian Brauner commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 Author: James Clark Date: Thu Oct 30 14:05:27 2025 +0000 dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope Clang doesn't like that (1ULL<<(64)) overflows when initializing a global scope variable, even if that part of the ternary isn't used when n = 64. The same initialization can be done without warnings in function scopes, and GCC doesn't mind either way. The build failure that highlighted this was already fixed in a different way [1], which also has detailed links to the Clang issues. However it's not going to be long before the same thing happens again, so it's better to fix the root cause. Fix it by using GENMASK_ULL() which does exactly the same thing, is much more readable anyway, and doesn't have a shift that overflows. [1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ Signed-off-by: James Clark Reviewed-by: Nathan Chancellor Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 Author: Haotian Zhang Date: Wed Oct 29 01:28:28 2025 +0800 regulator: fixed: fix GPIO descriptor leak on register failure In the commit referenced by the Fixes tag, devm_gpiod_get_optional() was replaced by manual GPIO management, relying on the regulator core to release the GPIO descriptor. However, this approach does not account for the error path: when regulator registration fails, the core never takes over the GPIO, resulting in a resource leak. Add gpiod_put() before returning on regulator registration failure. Fixes: 5e6f3ae5c13b ("regulator: fixed: Let core handle GPIO descriptor") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251028172828.625-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 487df8b698345dd5a91346335f05170ed5f29d4e Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 4 10:53:57 2025 +0100 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xa_lock#17); [ 1231.611038] local_irq_disable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xa_lock#17); [ 1231.611044] [ 1231.611045] lock(&fence->lock); [ 1231.611047] *** DEADLOCK *** In this example, CPU0 would be any function accessing job->dependencies through the xa_* functions that don't disable interrupts (eg: drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()). CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xa_lock which is already held by CPU0. Replacing all xa_* usage by their xa_*_irq counterparts would fix this issue, but Christian pointed out another issue: dma_fence_signal takes fence.lock and so does dma_fence_add_callback. dma_fence_signal() // locks f1.lock -> drm_sched_entity_kill_jobs_cb() -> foreach dependencies -> dma_fence_add_callback() // locks f2.lock This will deadlock if f1 and f2 share the same spinlock. To fix both issues, the code iterating on dependencies and re-arming them is moved out to drm_sched_entity_kill_jobs_work(). Cc: stable@vger.kernel.org # v6.2+ Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13908 Reported-by: Mikhail Gavrilov Suggested-by: Christian König Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer [phasta: commit message nits] Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251104095358.15092-1-pierre-eric.pelloux-prayer@amd.com commit 5232334baec371a3c9d9192ba7d2da2d88a85333 Author: Thomas Richard Date: Mon Sep 29 12:03:13 2025 +0200 gpio: aggregator: restore the set_config operation Restore the set_config operation, as it was lost during the refactoring of the gpio-aggregator driver while creating the gpio forwarder library. Fixes: b31c68fd851e7 ("gpio: aggregator: handle runtime registration of gpio_desc in gpiochip_fwd") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509281206.a7334ae8-lkp@intel.com Signed-off-by: Thomas Richard Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250929-gpio-aggregator-fix-set-config-callback-v1-1-39046e1da609@bootlin.com Signed-off-by: Bartosz Golaszewski commit 1c353dc8d962de652bc7ad2ba2e63f553331391c Merge: 284922f4c563aa 27afd6e066cfd8 Author: Linus Torvalds Date: Wed Nov 5 18:56:15 2025 +0900 Merge tag 'media/v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - honour privacy led with pdx86/int3472 - fix invalid file access on cx18 and ivtv - forbid remove_bufs when legacy fileio is active on videbuf2 - add an heuristic to find stream entity on uvcvideo * tag 'media/v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: videobuf2: forbid remove_bufs when legacy fileio is active media: uvcvideo: Use heuristic to find stream entity media: v4l2-subdev / pdx86: int3472: Use "privacy" as con_id for the privacy LED media: ivtv: Fix invalid access to file * media: cx18: Fix invalid access to file * commit 327c20c21d80e0d87834b392d83ae73c955ad8ff Author: Breno Leitao Date: Mon Nov 3 08:38:17 2025 -0800 netpoll: Fix deadlock in memory allocation under spinlock Fix a AA deadlock in refill_skbs() where memory allocation while holding skb_pool->lock can trigger a recursive lock acquisition attempt. The deadlock scenario occurs when the system is under severe memory pressure: 1. refill_skbs() acquires skb_pool->lock (spinlock) 2. alloc_skb() is called while holding the lock 3. Memory allocator fails and calls slab_out_of_memory() 4. This triggers printk() for the OOM warning 5. The console output path calls netpoll_send_udp() 6. netpoll_send_udp() attempts to acquire the same skb_pool->lock 7. Deadlock: the lock is already held by the same CPU Call stack: refill_skbs() spin_lock_irqsave(&skb_pool->lock) <- lock acquired __alloc_skb() kmem_cache_alloc_node_noprof() slab_out_of_memory() printk() console_flush_all() netpoll_send_udp() skb_dequeue() spin_lock_irqsave(&skb_pool->lock) <- deadlock attempt This bug was exposed by commit 248f6571fd4c51 ("netpoll: Optimize skb refilling on critical path") which removed refill_skbs() from the critical path (where nested printk was being deferred), letting nested printk being called from inside refill_skbs() Refactor refill_skbs() to never allocate memory while holding the spinlock. Another possible solution to fix this problem is protecting the refill_skbs() from nested printks, basically calling printk_deferred_{enter,exit}() in refill_skbs(), then, any nested pr_warn() would be deferred. I prefer this approach, given I _think_ it might be a good idea to move the alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having the alloc_skb() outside of the lock will be necessary step. There is a possible TOCTOU issue when checking for the pool length, and queueing the new allocated skb, but, this is not an issue, given that an extra SKB in the pool is harmless and it will be eventually used. Signed-off-by: Breno Leitao Fixes: 248f6571fd4c51 ("netpoll: Optimize skb refilling on critical path") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251103-fix_netpoll_aa-v4-1-4cfecdf6da7c@debian.org Signed-off-by: Jakub Kicinski commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5 Author: Nishanth Menon Date: Mon Nov 3 10:28:11 2025 -0600 net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Make knav_dma_open_channel consistently return NULL on error instead of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h returns NULL when the driver is disabled, but the driver implementation does not even return NULL or ERR_PTR on failure, causing inconsistency in the users. This results in a crash in netcp_free_navigator_resources as followed (trimmed): Unhandled fault: alignment exception (0x221) at 0xfffffff2 [fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000 Internal error: : 221 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE Hardware name: Keystone PC is at knav_dma_close_channel+0x30/0x19c LR is at netcp_free_navigator_resources+0x2c/0x28c [... TRIM...] Call trace: knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c netcp_ndo_open from __dev_open+0x114/0x29c __dev_open from __dev_change_flags+0x190/0x208 __dev_change_flags from netif_change_flags+0x1c/0x58 netif_change_flags from dev_change_flags+0x38/0xa0 dev_change_flags from ip_auto_config+0x2c4/0x11f0 ip_auto_config from do_one_initcall+0x58/0x200 do_one_initcall from kernel_init_freeable+0x1cc/0x238 kernel_init_freeable from kernel_init+0x1c/0x12c kernel_init from ret_from_fork+0x14/0x38 [... TRIM...] Standardize the error handling by making the function return NULL on all error conditions. The API is used in just the netcp_core.c so the impact is limited. Note, this change, in effect reverts commit 5b6cb43b4d62 ("net: ethernet: ti: netcp_core: return error while dma channel open issue"), but provides a less error prone implementation. Suggested-by: Simon Horman Suggested-by: Jacob Keller Signed-off-by: Nishanth Menon Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251103162811.3730055-1-nm@ti.com Signed-off-by: Jakub Kicinski commit 0c716703965ffc5ef4311b65cb5d84a703784717 Author: Bui Quang Minh Date: Thu Oct 30 21:44:38 2025 +0700 virtio-net: fix received length check in big packets Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags. Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in virtio_net receive path. Currently, the check is not adapted to the new change which can lead to NULL page pointer dereference in the below while loop when receiving length that is larger than the allocated one. This commit fixes the received length check corresponding to the new change. Fixes: 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets") Cc: stable@vger.kernel.org Signed-off-by: Bui Quang Minh Reviewed-by: Xuan Zhuo Tested-by: Lei Yang Link: https://patch.msgid.link/20251030144438.7582-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 44e8f13f07cfaa978c19fb4d66904f65905c7259 Merge: 156c75f596c988 137cc92ffe2e71 Author: Alexei Starovoitov Date: Tue Nov 4 17:50:26 2025 -0800 Merge branch 'bpf-add-_impl-suffix-for-kfuncs-with-implicit-args' Mykyta Yatsenko says: ==================== bpf: Add _impl suffix for kfuncs with implicit args We have established a pattern of function naming win "_impl" suffix; those functions accept verifier-provided bpf_prog_aux argument. Following uniform convention will allow for transparent backwards compatibility with the upcoming KF_IMPLICIT_ARGS feature. This patch set aims to fix current deviation from the convention to eliminate unnecessary backwards incompatibility in the future. Three kfuncs added in 6.18 don’t follow this *_impl convention and therefore won’t participate in the new KF_IMPLICIT_ARGS mechanism: * bpf_task_work_schedule_resume() * bpf_task_work_schedule_signal() * bpf_stream_vprintk() Rename them to align with the implicit-arg flow: bpf_task_work_schedule_resume() -> bpf_task_work_schedule_resume_impl() bpf_task_work_schedule_signal() -> bpf_task_work_schedule_signal_impl() bpf_stream_vprintk() -> bpf_stream_vprintk_impl() The KF_IMPLICIT_ARGS mechanism is not in tree yet, so callers must switch to the *_impl names for now. Once the new mechanism lands, the plain names (without _impl) will be reintroduced. Signed-off-by: Mykyta Yatsenko Acked-by: Ihor Solodrai --- Changes in v3: - Fix commit messages - Link to v2: https://lore.kernel.org/r/20251104-implv2-v2-0-6dbc35f39f28@meta.com Changes in v1: - Split commit into 2 - Rebase on the correct branch - Link to v1: https://lore.kernel.org/all/20251103232319.122965-1-mykyta.yatsenko5@gmail.com/ ==================== Link: https://patch.msgid.link/20251104-implv2-v3-0-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov commit 137cc92ffe2e71705fce112656a460d924934ebe Author: Mykyta Yatsenko Date: Tue Nov 4 22:54:26 2025 +0000 bpf: add _impl suffix for bpf_stream_vprintk() kfunc Rename bpf_stream_vprintk() to bpf_stream_vprintk_impl(). This makes bpf_stream_vprintk() follow the already established "_impl" suffix-based naming convention for kfuncs with the bpf_prog_aux argument provided by the verifier implicitly. This convention will be taken advantage of with the upcoming KF_IMPLICIT_ARGS feature to preserve backwards compatibility to BPF programs. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251104-implv2-v3-2-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov Acked-by: Ihor Solodrai commit ea0714d61dea6e00b853a0116d0afe2b2fe70ef3 Author: Mykyta Yatsenko Date: Tue Nov 4 22:54:25 2025 +0000 bpf:add _impl suffix for bpf_task_work_schedule* kfuncs Rename: bpf_task_work_schedule_resume()->bpf_task_work_schedule_resume_impl() bpf_task_work_schedule_signal()->bpf_task_work_schedule_signal_impl() This aligns task work scheduling kfuncs with the established naming scheme for kfuncs with the bpf_prog_aux argument provided by the verifier implicitly. This convention will be taken advantage of with the upcoming KF_IMPLICIT_ARGS feature to preserve backwards compatibility to BPF programs. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251104-implv2-v3-1-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov Acked-by: Ihor Solodrai commit a30297d31b665e759806bc3635aab50780473ad9 Merge: c3838262b824c7 5204943a4c6efc Author: Jakub Kicinski Date: Tue Nov 4 17:25:21 2025 -0800 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes Patches 1, 3, and 4 are bug fixes related to the FW log tracing driver coredump feature recently added in 6.13. Patch #1 adds the necessary call to shutdown the FW logging DMA during PCI shutdown. Patch #3 fixes a possible null pointer derefernce when using early versions of the FW with this feature. Patch #4 adds the coredump header information unconditionally to make it more robust. Patch #2 fixes a possible memory leak during PTP shutdown. Patch #5 eliminates a dmesg warning when doing devlink reload. ==================== Link: https://patch.msgid.link/20251104005700.542174-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5204943a4c6efc832993c0fa17dec275071eeccc Author: Shantiprasad Shettar Date: Mon Nov 3 16:56:59 2025 -0800 bnxt_en: Fix warning in bnxt_dl_reload_down() The existing code calls bnxt_cancel_reservations() after bnxt_hwrm_func_drv_unrgtr() in bnxt_dl_reload_down(). bnxt_cancel_reservations() calls the FW and it will always fail since the driver has already unregistered, triggering this warning: bnxt_en 0000:0a:00.0 ens2np0: resc_qcaps failed Fix it by calling bnxt_clear_reservations() which will skip the unnecessary FW call since we have unregistered. Fixes: 228ea8c187d8 ("bnxt_en: implement devlink dev reload driver_reinit") Reviewed-by: Mohammad Shuab Siddique Reviewed-by: Somnath Kotur Reviewed-by: Kalesh AP Signed-off-by: Shantiprasad Shettar Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-6-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 28d9a84ef0ce56cc623da2a1ebf7583c00d52b31 Author: Kashyap Desai Date: Mon Nov 3 16:56:58 2025 -0800 bnxt_en: Always provide max entry and entry size in coredump segments While populating firmware host logging segments for the coredump, it is possible for the FW command that flushes the segment to fail. When that happens, the existing code will not update the max entry and entry size in the segment header and this causes software that decodes the coredump to skip the segment. The segment most likely has already collected some DMA data, so always update these 2 segment fields in the header to allow the decoder to decode any data in the segment. Fixes: 3c2179e66355 ("bnxt_en: Add FW trace coredump segments to the coredump") Reviewed-by: Shruti Parab Signed-off-by: Kashyap Desai Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit ff02be05f78399c766be68ab0b2285ff90b2aaa8 Author: Gautam R A Date: Mon Nov 3 16:56:57 2025 -0800 bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() With older FW, we may get the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER for FW trace data type that has not been initialized. This will result in a crash in bnxt_bs_trace_type_wrap(). Add a guard to check for a valid magic_byte pointer before proceeding. Fixes: 84fcd9449fd7 ("bnxt_en: Manage the FW trace context memory") Reviewed-by: Somnath Kotur Reviewed-by: Shruti Parab Signed-off-by: Gautam R A Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit deb8eb39164382f1f67ef8e8af9176baf5e10f2d Author: Kalesh AP Date: Mon Nov 3 16:56:56 2025 -0800 bnxt_en: Fix a possible memory leak in bnxt_ptp_init In bnxt_ptp_init(), when ptp_clock_register() fails, the driver is not freeing the memory allocated for ptp_info->pin_config. Fix it to unconditionally free ptp_info->pin_config in bnxt_ptp_free(). Fixes: caf3eedbcd8d ("bnxt_en: 1PPS support for 5750X family chips") Reviewed-by: Pavan Chebbi Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit bc7208ca805ae6062f353a4753467d913d963bc6 Author: Michael Chan Date: Mon Nov 3 16:56:55 2025 -0800 bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we kexec to a new kernel, the DMA will corrupt memory in the new kernel. Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW. This will stop the FW DMA. In case the call fails, call pcie_flr() to reset the function and stop the DMA. Fixes: 24d694aec139 ("bnxt_en: Allocate backing store memory for FW trace logs") Reported-by: Jakub Kicinski Reviewed-by: Damodharam Ammepalli Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 284922f4c563aa3a8558a00f2a05722133237fe8 Author: Linus Torvalds Date: Tue Nov 4 15:25:20 2025 +0900 x86: uaccess: don't use runtime-const rewriting in modules The runtime-const infrastructure was never designed to handle the modular case, because the constant fixup is only done at boot time for core kernel code. But by the time I used it for the x86-64 user space limit handling in commit 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue"), I had completely repressed that fact. And it all happens to work because the only code that currently actually gets inlined by modules is for the access_ok() limit check, where the default constant value works even when not fixed up. Because at least I had intentionally made it be something that is in the non-canonical address space region. But it's technically very wrong, and it does mean that at least in theory, the use of 'access_ok()' + '__get_user()' can trigger the same speculation issue with non-canonical addresses that the original commit was all about. The pattern is unusual enough that this probably doesn't matter in practice, but very wrong is still very wrong. Also, let's fix it before the nice optimized scoped user accessor helpers that Thomas Gleixner is working on cause this pseudo-constant to then be more widely used. This all came up due to an unrelated discussion with Mateusz Guzik about using the runtime const infrastructure for names_cachep accesses too. There the modular case was much more obviously broken, and Mateusz noted it in his 'v2' of the patch series. That then made me notice how broken 'access_ok()' had been in modules all along. Mea culpa, mea maxima culpa. Fix it by simply not using the runtime-const code in modules, and just using the USER_PTR_MAX variable value instead. This is not performance-critical like the core user accessor functions (get_user() and friends) are. Also make sure this doesn't get forgotten the next time somebody wants to do runtime constant optimizations by having the x86 runtime-const.h header file error out if included by modules. Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue") Acked-by: Borislav Petkov Acked-by: Sean Christopherson Cc: Thomas Gleixner Triggered-by: Mateusz Guzik Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/ Signed-off-by: Linus Torvalds commit c3838262b824c71c145cd3668722e99a69bc9cd9 Author: Michael S. Tsirkin Date: Fri Oct 31 14:05:51 2025 +0800 virtio_net: fix alignment for virtio_net_hdr_v1_hash Changing alignment of header would mean it's no longer safe to cast a 2 byte aligned pointer between formats. Use two 16 bit fields to make it 2 byte aligned as previously. This fixes the performance regression since commit ("virtio_net: enable gso over UDP tunnel support.") as it uses virtio_net_hdr_v1_hash_tunnel which embeds virtio_net_hdr_v1_hash. Pktgen in guest + XDP_DROP on TAP + vhost_net shows the TX PPS is recovered from 2.4Mpps to 4.45Mpps. Fixes: 56a06bd40fab ("virtio_net: enable gso over UDP tunnel support.") Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Jason Wang Tested-by: Lei Yang Link: https://patch.msgid.link/20251031060551.126-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 1e39da974ce621ed874c6d3aaf65ad14848c9f0d Author: Yongpeng Yang Date: Tue Nov 4 16:36:42 2025 -0800 fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT When simulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, an error trace appears during partition table reading at boot time. The issue is caused by inode->i_blkbits being larger than PAGE_SHIFT, which leads to a left shift of -1 and triggering a UBSAN warning. [ 2.697306] ------------[ cut here ]------------ [ 2.697309] UBSAN: shift-out-of-bounds in fs/crypto/inline_crypt.c:336:37 [ 2.697311] shift exponent -1 is negative [ 2.697315] CPU: 3 UID: 0 PID: 274 Comm: (udev-worker) Not tainted 6.18.0-rc2+ #34 PREEMPT(voluntary) [ 2.697317] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 2.697320] Call Trace: [ 2.697324] [ 2.697325] dump_stack_lvl+0x76/0xa0 [ 2.697340] dump_stack+0x10/0x20 [ 2.697342] __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 [ 2.697351] bh_get_inode_and_lblk_num.cold+0x12/0x94 [ 2.697359] fscrypt_set_bio_crypt_ctx_bh+0x44/0x90 [ 2.697365] submit_bh_wbc+0xb6/0x190 [ 2.697370] block_read_full_folio+0x194/0x270 [ 2.697371] ? __pfx_blkdev_get_block+0x10/0x10 [ 2.697375] ? __pfx_blkdev_read_folio+0x10/0x10 [ 2.697377] blkdev_read_folio+0x18/0x30 [ 2.697379] filemap_read_folio+0x40/0xe0 [ 2.697382] filemap_get_pages+0x5ef/0x7a0 [ 2.697385] ? mmap_region+0x63/0xd0 [ 2.697389] filemap_read+0x11d/0x520 [ 2.697392] blkdev_read_iter+0x7c/0x180 [ 2.697393] vfs_read+0x261/0x390 [ 2.697397] ksys_read+0x71/0xf0 [ 2.697398] __x64_sys_read+0x19/0x30 [ 2.697399] x64_sys_call+0x1e88/0x26a0 [ 2.697405] do_syscall_64+0x80/0x670 [ 2.697410] ? __x64_sys_newfstat+0x15/0x20 [ 2.697414] ? x64_sys_call+0x204a/0x26a0 [ 2.697415] ? do_syscall_64+0xb8/0x670 [ 2.697417] ? irqentry_exit_to_user_mode+0x2e/0x2a0 [ 2.697420] ? irqentry_exit+0x43/0x50 [ 2.697421] ? exc_page_fault+0x90/0x1b0 [ 2.697422] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 2.697425] RIP: 0033:0x75054cba4a06 [ 2.697426] Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 [ 2.697427] RSP: 002b:00007fff973723a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 2.697430] RAX: ffffffffffffffda RBX: 00005ea9a2c02760 RCX: 000075054cba4a06 [ 2.697432] RDX: 0000000000002000 RSI: 000075054c190000 RDI: 000000000000001b [ 2.697433] RBP: 00007fff973723c0 R08: 0000000000000000 R09: 0000000000000000 [ 2.697434] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2.697434] R13: 00005ea9a2c027c0 R14: 00005ea9a2be5608 R15: 00005ea9a2be55f0 [ 2.697436] [ 2.697436] ---[ end trace ]--- This situation can happen for block devices because when CONFIG_TRANSPARENT_HUGEPAGE is enabled, the maximum logical_block_size is 64 KiB. set_init_blocksize() then sets the block device inode->i_blkbits to 13, which is within this limit. File I/O does not trigger this problem because for filesystems that do not support the FS_LBS feature, sb_set_blocksize() prevents sb->s_blocksize_bits from being larger than PAGE_SHIFT. During inode allocation, alloc_inode()->inode_init_always() assigns inode->i_blkbits from sb->s_blocksize_bits. Currently, only xfs_fs_type has the FS_LBS flag, and since xfs I/O paths do not reach submit_bh_wbc(), it does not hit the left-shift underflow issue. Signed-off-by: Yongpeng Yang Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k") Cc: stable@vger.kernel.org [EB: use folio_pos() and consolidate the two shifts by i_blkbits] Link: https://lore.kernel.org/r/20251105003642.42796-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e08969c4d65ac31297fcb4d31d4808c789152f68 Author: Tzung-Bi Shih Date: Tue Nov 4 07:03:10 2025 +0000 Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case. Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access `ckdev->idev` and friends if the driver doesn't intend to initialize them. Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20251104070310.3212712-1-tzungbi@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b Author: Rafał Miłecki Date: Thu Oct 2 21:48:52 2025 +0200 ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY Luxul XAP-1440 has BCM54210E PHY at address 25. Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices") Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com Signed-off-by: Florian Fainelli commit 9c16e4d216d8103a8178bbe070eb21f779f190c0 Author: Stefan Wahren Date: Tue Nov 4 18:45:18 2025 +0100 arm64: defconfig: Fix V3D deferred probe timeout The commit 4adc20ba95d4 ("ARM: dts: broadcom: rpi: Switch to V3D firmware clock") causes a regression in arm64 developer setups, which stores the kernel modules via NFS. Before this change the involved V3D clock provider was builtin, but after this DT change the clk-raspberrypi is responsible for V3D and for arm64/defconfig this driver is build as a kernel module. In case these kernel modules are provided via NFS this takes too long and the PM domain core give up before the clock driver could be loaded: v3d fec00000.gpu: deferred probe timeout, ignoring dependency So resolve this issue by making this critical driver builtin. Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-arm-kernel/9ebda74e-e700-4fbe-bca5-382f92417a9c@sirena.org.uk/ Fixes: 4adc20ba95d4 ("ARM: dts: broadcom: rpi: Switch to V3D firmware clock") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20251104174518.11783-1-wahrenst@gmx.net Signed-off-by: Florian Fainelli commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 Author: Shuhao Fu Date: Tue Nov 4 23:13:15 2025 +0800 smb: client: fix refcount leak in smb2_set_path_attr Fix refcount leak in `smb2_set_path_attr` when path conversion fails. Function `cifs_get_writable_path` returns `cfile` with its reference counter `cfile->count` increased on success. Function `smb2_compound_op` would decrease the reference counter for `cfile`, as stated in its comment. By calling `smb2_rename_path`, the reference counter of `cfile` would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") Acked-by: Henrique Carvalho Signed-off-by: Shuhao Fu Signed-off-by: Steve French commit 17d85f33a83b84e7d36bc3356614ae06c90e7a08 Merge: c9cfc122f03711 b8126205dbe01e Author: Linus Torvalds Date: Wed Nov 5 04:08:55 2025 +0900 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Memory leak in bnxt GSI qp path - Failure in irdma registering large MRs - Failure to clean out the right CQ table entry in irdma - Invalid vf_id in some cases - Incorrect error unwind in EFA CQ create - hns doesn't use the optimal cq/qp relationships for it's HW banks - hns reports the wrong SGE size to userspace for its QPs - Corruption of the hns work queue entries in some cases * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: MAINTAINERS: Update irdma maintainers RDMA/irdma: Fix vf_id size to u16 to avoid overflow RDMA/hns: Remove an extra blank line RDMA/hns: Fix wrong WQE data when QP wraps around RDMA/hns: Fix the modification of max_send_sge RDMA/hns: Fix recv CQ and QP cache affinity RDMA/uverbs: Fix umem release in UVERBS_METHOD_CQ_CREATE RDMA/irdma: Set irdma_cq cq_num field during CQ create RDMA/irdma: Fix SD index calculation RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp commit d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4 Author: Dan Carpenter Date: Sat Nov 1 16:25:27 2025 +0300 Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &. Fixes: 768062fd1284 ("Input: imx_sc_key - use devm_add_action_or_reset() to handle all cleanups") Signed-off-by: Dan Carpenter Reviewed-by: Peng Fan Reviewed-by: Frank Li Link: https://patch.msgid.link/aQYKR75r2VMFJutT@stanley.mountain Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 6dd97ceb645c08aca9fc871a3006e47fe699f0ac Author: Rong Zhang Date: Tue Oct 14 00:47:35 2025 +0800 drm/amd/display: Fix NULL deref in debugfs odm_combine_segments When a connector is connected but inactive (e.g., disabled by desktop environments), pipe_ctx->stream_res.tg will be destroyed. Then, reading odm_combine_segments causes kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6 Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025 RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: seq_read_iter+0x125/0x490 ? __alloc_frozen_pages_noprof+0x18f/0x350 seq_read+0x12c/0x170 full_proxy_read+0x51/0x80 vfs_read+0xbc/0x390 ? __handle_mm_fault+0xa46/0xef0 ? do_syscall_64+0x71/0x900 ksys_read+0x73/0xf0 do_syscall_64+0x71/0x900 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f44d4031687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687 RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003 RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000 Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp> CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Fix this by checking pipe_ctx->stream_res.tg before dereferencing. Fixes: 07926ba8a44f ("drm/amd/display: Add debugfs interface for ODM combine info") Signed-off-by: Rong Zhang Reviewed-by: Mario Limoncello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit f19bbecd34e3c15eed7e5e593db2ac0fc7a0e6d8) Cc: stable@vger.kernel.org commit 597eb70f7ff7551ff795cd51754b81aabedab67b Author: Philip Yang Date: Fri Oct 31 10:50:02 2025 -0400 drm/amdkfd: Don't clear PT after process killed If process is killed. the vm entity is stopped, submit pt update job will trigger the error message "*ERROR* Trying to push to a killed entity", job will not execute. Suggested-by: Christian König Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 10c382ec6c6d1e11975a11962bec21cba6360391) Cc: stable@vger.kernel.org commit 7c5609b72bfe57d8c601d9561e0d2551b605c017 Author: Alex Deucher Date: Fri Oct 24 13:08:11 2025 -0400 drm/amdgpu/smu: Handle S0ix for vangogh Fix the flows for S0ix. There is no need to stop rlc or reintialize PMFW in S0ix. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Reviewed-by: Mario Limonciello Reported-by: Antheas Kapenekakis Tested-by: Antheas Kapenekakis Signed-off-by: Alex Deucher (cherry picked from commit fd39b5a5830d8f2553e0c09d4d50bdff28b10080) Cc: # c81f5cebe849: drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() Cc: commit c81f5cebe849a2beeed4c8f2b06a58dfc02d5350 Author: Alex Deucher Date: Sat Oct 25 23:29:36 2025 -0500 drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() For S3 on vangogh, PMFW needs to be notified before the driver powers down RLC. This already happens in smu_disable_dpms() so drop the superfluous call in amdgpu_device_suspend(). Co-developed-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 960e30a61e1a7ca5341a6cf9481e770e1cda24aa) commit fdc93beeadc2439e5e85d056a8fe681dcced09da Author: Alex Hung Date: Wed Oct 22 16:19:34 2025 -0600 drm/amd/display: Fix black screen with HDMI outputs [Why & How] This fixes the black screen issue on certain APUs with HDMI, accompanied by the following messages: amdgpu 0000:c4:00.0: amdgpu: [drm] Failed to setup vendor info frame on connector DP-1: -22 amdgpu 0000:c4:00.0: [drm] Cannot find any crtc or sizes [drm] Cannot find any crtc or sizes Fixes: 489f0f600ce2 ("drm/amd/display: Fix DVI-D/HDMI adapters") Suggested-by: Timur Kristóf Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 678c901443a6d2e909e3b51331a20f9d8f84ce82) commit 3362692fea915ce56345366364a501c629c9ff17 Author: Mario Limonciello (AMD) Date: Thu Oct 30 14:39:43 2025 -0500 drm/amd/display: Don't stretch non-native images by default in eDP commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") started using the GPU scaler hardware to scale when a non-native resolution was picked on eDP. This scaling was done to fill the screen instead of maintain aspect ratio. The idea was supposed to be that if a different scaling behavior is preferred then the compositor would request it. The not following aspect ratio behavior however isn't desirable, so adjust it to follow aspect ratio and still try to fill screen. Note: This will lead to black bars in some cases for non-native resolutions. Compositors can request the previous behavior if desired. Fixes: 978fa2f6d0b1 ("drm/amd/display: Use scaling for non-native resolutions on eDP") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 825df7ff4bb1a383ad4827545e09aec60d230770) commit 37e3567dee273f68726373b342b38234bafe4cf9 Author: Yang Wang Date: Thu Oct 30 13:06:24 2025 +0800 drm/amd/pm: fix missing device_attr cleanup in amdgpu_pm_sysfs_init() Use the correct label to complete all cleanup work. Fixes: 4d154b1ca580 ("drm/amd/pm: Add support for DPM policies") Fixes: 25e82f2e2c59 ("drm/amd/pm: Add temperature metrics sysfs entry") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 4c4c138a1c86775c4d47e24f26357a1f8b64d0a3) commit 90b75e12a6e831c8516498f690058d4165d5a5d6 Author: Alex Deucher Date: Tue Oct 14 16:45:17 2025 -0400 drm/amdgpu: set default gfx reset masks for gfx6-8 These were not set so soft recovery was inadvertantly disabled. Fixes: 6ac55eab4fc4 ("drm/amdgpu: move reset support type checks into the caller") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 1972763505d728c604b537180727ec8132e619df) commit 789521b4717fd6bd85164ba5c131f621a79c9736 Author: Miguel Ojeda Date: Sat Nov 1 10:40:11 2025 +0100 rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 Rust 1.93.0 (expected 2026-01-22) is stabilizing `-Zno-jump-tables` [1][2] as `-Cjump-tables=n` [3]. Without this change, one would eventually see: RUSTC L rust/core.o error: unknown unstable option: `no-jump-tables` Thus support the upcoming version. Link: https://github.com/rust-lang/rust/issues/116592 [1] Link: https://github.com/rust-lang/rust/pull/105812 [2] Link: https://github.com/rust-lang/rust/pull/145974 [3] Reviewed-by: Alice Ryhl Reviewed-by: Trevor Gross Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251101094011.1024534-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 Author: Eric Biggers Date: Mon Nov 3 21:49:06 2025 -0800 lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN On big endian arm kernels, the arm optimized Curve25519 code produces incorrect outputs and fails the Curve25519 test. This has been true ever since this code was added. It seems that hardly anyone (or even no one?) actually uses big endian arm kernels. But as long as they're ostensibly supported, we should disable this code on them so that it's not accidentally used. Note: for future-proofing, use !CPU_BIG_ENDIAN instead of CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could get removed in the future if big endian support gets dropped. Fixes: d8f1308a025f ("crypto: arm/curve25519 - wire up NEON implementation") Cc: stable@vger.kernel.org Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251104054906.716914-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2b81082ad37cc3f28355fb73a6a69b91ff7dbf20 Author: Nathan Chancellor Date: Mon Nov 3 12:11:24 2025 -0700 lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Commit 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older") inadvertently disabled KASAN in curve25519-hacl64.o for GCC unconditionally because clang-min-version will always evaluate to nothing for GCC. Add a check for CONFIG_CC_IS_CLANG to avoid applying the workaround for GCC, which is only needed for clang-17 and older. Cc: stable@vger.kernel.org Fixes: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older") Signed-off-by: Nathan Chancellor Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251103-curve25519-hacl64-fix-kasan-workaround-v2-1-ab581cbd8035@kernel.org Signed-off-by: Eric Biggers commit ae431059e75d36170a5ae6b44cc4d06d43613215 Author: Sean Christopherson Date: Mon Nov 3 17:12:05 2025 -0800 KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying When unbinding a memslot from a guest_memfd instance, remove the bindings even if the guest_memfd file is dying, i.e. even if its file refcount has gone to zero. If the memslot is freed before the file is fully released, nullifying the memslot side of the binding in kvm_gmem_release() will write to freed memory, as detected by syzbot+KASAN: ================================================================== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353 Write of size 8 at addr ffff88807befa508 by task syz.0.17/6022 CPU: 0 UID: 0 PID: 6022 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbeeff8efc9 Allocated by task 6023: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x3e2/0x700 mm/slub.c:5758 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] kvm_set_memory_region+0x747/0xb90 virt/kvm/kvm_main.c:2104 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6023: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2533 [inline] slab_free mm/slub.c:6622 [inline] kfree+0x19a/0x6d0 mm/slub.c:6829 kvm_set_memory_region+0x9c4/0xb90 virt/kvm/kvm_main.c:2130 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Deliberately don't acquire filemap invalid lock when the file is dying as the lifecycle of f_mapping is outside the purview of KVM. Dereferencing the mapping is *probably* fine, but there's no need to invalidate anything as memslot deletion is responsible for zapping SPTEs, and the only code that can access the dying file is kvm_gmem_release(), whose core code is mutually exclusive with unbinding. Note, the mutual exclusivity is also what makes it safe to access the bindings on a dying gmem instance. Unbinding either runs with slots_lock held, or after the last reference to the owning "struct kvm" is put, and kvm_gmem_release() nullifies the slot pointer under slots_lock, and puts its reference to the VM after that is done. Reported-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68fa7a22.a70a0220.3bf6c6.008b.GAE@google.com Tested-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Cc: stable@vger.kernel.org Cc: Hillf Danton Reviewed-By: Vishal Annapurve Link: https://patch.msgid.link/20251104011205.3853541-1-seanjc@google.com Signed-off-by: Sean Christopherson commit fd92bd3b4445342e55f2c541c577796e0c3f1b8a Author: Maxim Levitsky Date: Thu Oct 30 15:41:30 2025 -0400 KVM: SVM: switch to raw spinlock for svm->ir_list_lock Use a raw spinlock for vcpu_svm.ir_list_lock as the lock can be taken during schedule() via kvm_sched_out() => __avic_vcpu_put(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. This fixes the following lockdep warning: ============================= [ BUG: Invalid wait context ] 6.12.0-146.1640_2124176644.el10.x86_64+debug #1 Not tainted ----------------------------- qemu-kvm/38299 is trying to lock: ff11000239725600 (&svm->ir_list_lock){....}-{3:3}, at: __avic_vcpu_put+0xfd/0x300 [kvm_amd] other info that might help us debug this: context-{5:5} 2 locks held by qemu-kvm/38299: #0: ff11000239723ba8 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x240/0xe00 [kvm] #1: ff11000b906056d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2e/0x130 stack backtrace: CPU: 1 UID: 0 PID: 38299 Comm: qemu-kvm Kdump: loaded Not tainted 6.12.0-146.1640_2124176644.el10.x86_64+debug #1 PREEMPT(voluntary) Hardware name: AMD Corporation QUARTZ/QUARTZ, BIOS RQZ100AB 09/14/2023 Call Trace: dump_stack_lvl+0x6f/0xb0 __lock_acquire+0x921/0xb80 lock_acquire.part.0+0xbe/0x270 _raw_spin_lock_irqsave+0x46/0x90 __avic_vcpu_put+0xfd/0x300 [kvm_amd] svm_vcpu_put+0xfa/0x130 [kvm_amd] kvm_arch_vcpu_put+0x48c/0x790 [kvm] kvm_sched_out+0x161/0x1c0 [kvm] prepare_task_switch+0x36b/0xf60 __schedule+0x4f7/0x1890 schedule+0xd4/0x260 xfer_to_guest_mode_handle_work+0x54/0xc0 vcpu_run+0x69a/0xa70 [kvm] kvm_arch_vcpu_ioctl_run+0xdc0/0x17e0 [kvm] kvm_vcpu_ioctl+0x39f/0xe00 [kvm] Signed-off-by: Maxim Levitsky Link: https://patch.msgid.link/20251030194130.307900-1-mlevitsk@redhat.com [sean: massage changelog] Signed-off-by: Sean Christopherson commit aaac099459f932b9dbaf85ca2a7251633cc213d0 Author: Sean Christopherson Date: Thu Oct 16 12:06:43 2025 -0700 KVM: SVM: Make avic_ga_log_notifier() local to avic.c Make amd_iommu_register_ga_log_notifier() a local symbol now that it's defined and used purely within avic.c. No functional change intended. Fixes: 4bdec12aa8d6 ("KVM: SVM: Detect X2APIC virtualization (x2AVIC) support") Link: https://patch.msgid.link/20251016190643.80529-4-seanjc@google.com Signed-off-by: Sean Christopherson commit adc6ae9729719be5e74219aaafb95e60a9e9950e Author: Sean Christopherson Date: Thu Oct 16 12:06:42 2025 -0700 KVM: SVM: Unregister KVM's GALog notifier on kvm-amd.ko exit Unregister the GALog notifier (used to get notified of wake events for blocking vCPUs) on kvm-amd.ko exit so that a KVM or IOMMU driver bug that results in a spurious GALog event "only" results in a spurious IRQ, and doesn't trigger a use-after-free due to executing unloaded module code. Fixes: 5881f73757cc ("svm: Introduce AMD IOMMU avic_ga_log_notifier") Reported-by: Hou Wenlong Closes: https://lore.kernel.org/all/20250918130320.GA119526@k08j02272.eu95sqa Link: https://patch.msgid.link/20251016190643.80529-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 59a217ced3e7af849cc84fce36d8bfe225976e27 Author: Sean Christopherson Date: Thu Oct 16 12:06:41 2025 -0700 KVM: SVM: Initialize per-CPU svm_data at the end of hardware setup Setup the per-CPU SVM data structures at the very end of hardware setup so that svm_hardware_unsetup() can be used in svm_hardware_setup() to unwind AVIC setup (for the GALog notifier). Alternatively, the error path could do an explicit, manual unwind, e.g. by adding a helper to free the per-CPU structures. But the per-CPU allocations have no interactions or dependencies, i.e. can comfortably live at the end, and so converting to a manual unwind would introduce churn and code without providing any immediate advantage. Link: https://patch.msgid.link/20251016190643.80529-2-seanjc@google.com Signed-off-by: Sean Christopherson commit cab4098be41826a91b55cdc851196d73d7057f9c Author: Chao Gao Date: Mon Oct 27 23:01:41 2025 -0700 KVM: x86: Call out MSR_IA32_S_CET is not handled by XSAVES Update the comment above is_xstate_managed_msr() to note that MSR_IA32_S_CET isn't saved/restored by XSAVES/XRSTORS. MSR_IA32_S_CET isn't part of CET_U/S state as the SDM states: The register state used by Control-Flow Enforcement Technology (CET) comprises the two 64-bit MSRs (IA32_U_CET and IA32_PL3_SSP) that manage CET when CPL = 3 (CET_U state); and the three 64-bit MSRs (IA32_PL0_SSP–IA32_PL2_SSP) that manage CET when CPL < 3 (CET_S state). Opportunistically shift the snippet about the safety of loading certain MSRs to the function comment for kvm_access_xstate_msr(), which is where the MSRs are actually loaded into hardware. Fixes: e44eb58334bb ("KVM: x86: Load guest FPU state when access XSAVE-managed MSRs") Signed-off-by: Chao Gao Link: https://patch.msgid.link/20251028060142.29830-1-chao.gao@intel.com [sean: shift snippet about safety to kvm_access_xstate_msr()] Signed-off-by: Sean Christopherson commit 9bc610b6a2a71d1a6acac27e82a0bc8ca861c7ac Author: Sean Christopherson Date: Thu Oct 30 11:58:02 2025 -0700 KVM: x86: Harden KVM against imbalanced load/put of guest FPU state Assert, via KVM_BUG_ON(), that guest FPU state isn't/is in use when loading/putting the FPU to help detect KVM bugs without needing an assist from KASAN. If an imbalanced load/put is detected, skip the redundant load/put to avoid clobbering guest state and/or crashing the host. Note, kvm_access_xstate_msr() already provides a similar assertion. Reviewed-by: Yao Yuan Reviewed-by: Chao Gao Link: https://patch.msgid.link/20251030185802.3375059-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 8819a49f9ff8953475ba09d978d66b50368c095b Author: Sean Christopherson Date: Thu Oct 30 11:58:01 2025 -0700 KVM: x86: Unload "FPU" state on INIT if and only if its currently in-use Replace the hack added by commit f958bd2314d1 ("KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform") with a more robust approach of unloading+reloading guest FPU state based on whether or not the vCPU's FPU is currently in-use, i.e. currently loaded. This fixes a bug on hosts that support CET but not MPX, where kvm_arch_vcpu_ioctl_get_mpstate() neglects to load FPU state (it only checks for MPX support) and leads to KVM attempting to put FPU state due to kvm_apic_accept_events() triggering INIT emulation. E.g. on a host with CET but not MPX, syzkaller+KASAN generates: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 211 UID: 0 PID: 20451 Comm: syz.9.26 Tainted: G S 6.18.0-smp-DEV #7 NONE Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Google Izumi/izumi, BIOS 0.20250729.1-0 07/29/2025 RIP: 0010:fpu_swap_kvm_fpstate+0x3ce/0x610 ../arch/x86/kernel/fpu/core.c:377 RSP: 0018:ff1100410c167cc0 EFLAGS: 00010202 RAX: 0000000000000004 RBX: 0000000000000020 RCX: 00000000000001aa RDX: 00000000000001ab RSI: ffffffff817bb960 RDI: 0000000022600000 RBP: dffffc0000000000 R08: ff110040d23c8007 R09: 1fe220081a479000 R10: dffffc0000000000 R11: ffe21c081a479001 R12: ff110040d23c8d98 R13: 00000000fffdc578 R14: 0000000000000000 R15: ff110040d23c8d90 FS: 00007f86dd1876c0(0000) GS:ff11007fc969b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f86dd186fa8 CR3: 00000040d1dfa003 CR4: 0000000000f73ef0 PKRU: 80000000 Call Trace: kvm_vcpu_reset+0x80d/0x12c0 ../arch/x86/kvm/x86.c:11818 kvm_apic_accept_events+0x1cb/0x500 ../arch/x86/kvm/lapic.c:3489 kvm_arch_vcpu_ioctl_get_mpstate+0xd0/0x4e0 ../arch/x86/kvm/x86.c:12145 kvm_vcpu_ioctl+0x5e2/0xed0 ../virt/kvm/kvm_main.c:4539 __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:51 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x6e/0x940 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f86de71d9c9 with a very simple reproducer: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, ...) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f00000000c0)) Alternatively, the MPX hack in GET_MP_STATE could be extended to cover CET, but from a "don't break existing functionality" perspective, that isn't any less risky than peeking at the state of in_use, and it's far less robust for a long term solution (as evidenced by this bug). Reported-by: Alexander Potapenko Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER") Reviewed-by: Yao Yuan Reviewed-by: Chao Gao Link: https://patch.msgid.link/20251030185802.3375059-2-seanjc@google.com Signed-off-by: Sean Christopherson commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 Author: Miaoqian Lin Date: Tue Oct 28 11:16:20 2025 +0800 pmdomain: imx: Fix reference count leak in imx_gpc_remove of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add the missing of_node_put() to avoid refcount leak. Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Ulf Hansson commit f1fdffe0afea02ba783acfe815b6a60e7180df40 Author: Mario Limonciello Date: Tue Nov 4 10:10:06 2025 -0600 x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode Running x86_match_min_microcode_rev() on a Zen5 CPU trips up KASAN for an out of bounds access. Fixes: 607b9fb2ce248 ("x86/CPU/AMD: Add RDSEED fix for Zen5") Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251104161007.269885-1-mario.limonciello@amd.com commit fccac54b0d3d0602f177bb79f203ae6fbea0e32a Author: Marek Szyprowski Date: Mon Oct 27 13:55:15 2025 +0100 pmdomain: samsung: Rework legacy splash-screen handover workaround Limit the workaround for the lack of the proper splash-screen handover handling to the legacy ARM 32bit systems and replace forcing a sync_state by explicite power domain shutdown. This approach lets compiler to optimize it out on newer ARM 64bit systems. Suggested-by: Ulf Hansson Fixes: 0745658aebbe ("pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state") Signed-off-by: Marek Szyprowski Acked-by: Krzysztof Kozlowski Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 4d3dbc2386fe051e44efad663e0ec828b98ab53f Author: Olga Kornievskaia Date: Thu Oct 9 16:37:59 2025 -0400 nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes RFC 7862 Section 4.1.2 says that if the server supports CLONE it MUST support clone_blksize attribute. Fixes: d6ca7d2643ee ("NFSD: Implement FATTR4_CLONE_BLKSIZE attribute") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c Author: NeilBrown Date: Wed Oct 8 09:52:25 2025 -0400 nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected. Reported-and-tested-by: tianshuo han Fixes: ef7f6c4904d0 ("nfsd: move V4ROOT version check to nfsd_set_fh_dentry()") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever commit 734e99623c5b65bf2c03e35978a0b980ebc3c2f8 Author: Henrique Carvalho Date: Mon Nov 3 19:52:55 2025 -0300 smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap. Fixes: ebe98f1447bb ("cifs: enable caching of directories for which a lease is held") Cc: stable@vger.kernel.org Reported-by: Jay Shin Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit e6187655acfa2dd566ea2aed4522083f0bb940c3 Author: Namjae Jeon Date: Mon Oct 27 15:46:39 2025 +0900 ksmbd: detect RDMA capable netdevs include IPoIB Current ksmbd_rdma_capable_netdev fails to mark certain RDMA-capable inerfaces such as IPoIB as RDMA capable after reverting GUID matching code due to layer violation. This patch check the ARPHRD_INFINIBAND type safely identifies an IPoIB interface without introducing a layer violation, ensuring RDMA functionality is correctly enabled for these interfaces. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d24822e1471d68a6eceee67809b5956d59482cb5 Author: Namjae Jeon Date: Mon Oct 27 15:24:17 2025 +0900 ksmbd: detect RDMA capable lower devices when bridge and vlan netdev is used If user set bridge interface as actual RDMA-capable NICs are lower devices, ksmbd can not detect as RDMA capable. This patch can detect the RDMA capable lower devices from bridge master or VLAN. With this change, ksmbd can accept both TCP and RDMA connections through the same bridge IP address, allowing mixed transport operation without requiring separate interfaces. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 249d96b492efb7a773296ab2c62179918301c146 Author: Claudiu Beznea Date: Tue Nov 4 13:49:14 2025 +0200 ASoC: da7213: Use component driver suspend/resume Since snd_soc_suspend() is invoked through snd_soc_pm_ops->suspend(), and snd_soc_pm_ops is associated with the soc_driver (defined in sound/soc/soc-core.c), and there is no parent-child relationship between the soc_driver and the DA7213 codec driver, the power management subsystem does not enforce a specific suspend/resume order between the DA7213 driver and the soc_driver. Because of this, the different codec component functionalities, called from snd_soc_resume() to reconfigure various functions, can race with the DA7213 struct dev_pm_ops::resume function, leading to misapplied configuration. This occasionally results in clipped sound. Fix this by dropping the struct dev_pm_ops::{suspend, resume} and use instead struct snd_soc_component_driver::{suspend, resume}. This ensures the proper configuration sequence is handled by the ASoC subsystem. Cc: stable@vger.kernel.org Fixes: 431e040065c8 ("ASoC: da7213: Add suspend to RAM support") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251104114914.2060603-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit fd9f30d1038ee1624baa17a6ff11effe5f7617cb Author: Helge Deller Date: Mon Nov 3 22:38:26 2025 +0100 parisc: Avoid crash due to unaligned access in unwinder Guenter Roeck reported this kernel crash on his emulated B160L machine: Starting network: udhcpc: started, v1.36.1 Backtrace: [<104320d4>] unwind_once+0x1c/0x5c [<10434a00>] walk_stackframe.isra.0+0x74/0xb8 [<10434a6c>] arch_stack_walk+0x28/0x38 [<104e5efc>] stack_trace_save+0x48/0x5c [<105d1bdc>] set_track_prepare+0x44/0x6c [<105d9c80>] ___slab_alloc+0xfc4/0x1024 [<105d9d38>] __slab_alloc.isra.0+0x58/0x90 [<105dc80c>] kmem_cache_alloc_noprof+0x2ac/0x4a0 [<105b8e54>] __anon_vma_prepare+0x60/0x280 [<105a823c>] __vmf_anon_prepare+0x68/0x94 [<105a8b34>] do_wp_page+0x8cc/0xf10 [<105aad88>] handle_mm_fault+0x6c0/0xf08 [<10425568>] do_page_fault+0x110/0x440 [<10427938>] handle_interruption+0x184/0x748 [<11178398>] schedule+0x4c/0x190 BUG: spinlock recursion on CPU#0, ifconfig/2420 lock: terminate_lock.2+0x0/0x1c, .magic: dead4ead, .owner: ifconfig/2420, .owner_cpu: 0 While creating the stack trace, the unwinder uses the stack pointer to guess the previous frame to read the previous stack pointer from memory. The crash happens, because the unwinder tries to read from unaligned memory and as such triggers the unalignment trap handler which then leads to the spinlock recursion and finally to a deadlock. Fix it by checking the alignment before accessing the memory. Reported-by: Guenter Roeck Signed-off-by: Helge Deller Tested-by: Guenter Roeck Cc: stable@vger.kernel.org # v6.12+ commit b98b69c38512c3a8277c83b2d07674fd1ff59625 Author: Pauli Virtanen Date: Sun Nov 2 21:10:15 2025 +0200 ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis ID 1038:1294 SteelSeries ApS Arctis Pro Wireless is reported to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4229#note_3174448 Signed-off-by: Pauli Virtanen Link: https://patch.msgid.link/a83f2694b1f8c37e4667a3cf057ffdc408b0f70d.1762108507.git.pav@iki.fi Signed-off-by: Takashi Iwai commit c9cfc122f03711a5124b4aafab3211cf4d35a2ac Merge: 8bb886cb8f3a28 3b1a4a59a2086b Author: Linus Torvalds Date: Tue Nov 4 14:25:38 2025 +0900 Merge tag 'for-6.18-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix memory leak in qgroup relation ioctl when qgroup levels are invalid - don't write back dirty metadata on filesystem with errors - properly log renamed links - properly mark prealloc extent range beyond inode size as dirty (when no-noles is not enabled) * tag 'for-6.18-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: mark dirty extent range for out of bound prealloc extents btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation btrfs: ensure no dirty metadata is written back for an fs with errors commit 156c75f596c98852c30981baea6c2cc8a7a411fc Merge: 6146a0f1dfae5d 62d2d0a33839c2 Author: Alexei Starovoitov Date: Mon Nov 3 17:22:06 2025 -0800 Merge branch 'fix-ftrace-for-livepatch-bpf-fexit-programs' Song Liu says: ==================== Fix ftrace for livepatch + BPF fexit programs livepatch and BPF trampoline are two special users of ftrace. livepatch uses ftrace with IPMODIFY flag and BPF trampoline uses ftrace direct functions. When livepatch and BPF trampoline with fexit programs attach to the same kernel function, BPF trampoline needs to call into the patched version of the kernel function. 1/3 and 2/3 of this patchset fix two issues with livepatch + fexit cases, one in the register_ftrace_direct path, the other in the modify_ftrace_direct path. 3/3 adds selftests for both cases. Acked-by: Steven Rostedt (Google) --- v4: https://patch.msgid.link/20251027175023.1521602-1-song@kernel.org Changes v3 => v4: 1. Add helper reset_direct. (Steven) 2. Add Reviewed-by from Jiri. 3. Fix minor typo in comments. v3: https://lore.kernel.org/bpf/20251026205445.1639632-1-song@kernel.org/ Changes v2 => v3: 1. Incorporate feedback by AI, which also fixes build error reported by Steven and kernel test robot. v2: https://lore.kernel.org/bpf/20251024182901.3247573-1-song@kernel.org/ Changes v1 => v2: 1. Target bpf tree. (Alexei) 2. Bring back the FTRACE_WARN_ON in __ftrace_hash_update_ipmodify for valid code paths. (Steven) 3. Update selftests with cleaner way to find livepatch-sample.ko. (offlline discussion with Ihor) v1: https://lore.kernel.org/bpf/20251024071257.3956031-1-song@kernel.org/ ==================== Signed-off-by: Alexei Starovoitov commit e120f46768d98151ece8756ebd688b0e43dc8b29 Author: Qendrim Maxhuni Date: Wed Oct 29 08:57:44 2025 +0100 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks. Initialize the MAC header to prevent such crashes. This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface. Example trace: Internal error: Oops: 000000009600004f [#1] SMP CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1 Hardware name: LS1028A RDB Board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : xfrm_input+0xde8/0x1318 lr : xfrm_input+0x61c/0x1318 sp : ffff800080003b20 Call trace: xfrm_input+0xde8/0x1318 xfrm6_rcv+0x38/0x44 xfrm6_esp_rcv+0x48/0xa8 ip6_protocol_deliver_rcu+0x94/0x4b0 ip6_input_finish+0x44/0x70 ip6_input+0x44/0xc0 ipv6_rcv+0x6c/0x114 __netif_receive_skb_one_core+0x5c/0x8c __netif_receive_skb+0x18/0x60 process_backlog+0x78/0x17c __napi_poll+0x38/0x180 net_rx_action+0x168/0x2f0 Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Qendrim Maxhuni Link: https://patch.msgid.link/20251029075744.105113-1-qendrim.maxhuni@garderos.com Signed-off-by: Jakub Kicinski commit 59b20b15c112867f28a12a24aa25f14549db02e4 Author: Huiwen He Date: Mon Nov 3 10:36:19 2025 +0800 sctp: make sctp_transport_init() void sctp_transport_init() is static and never returns NULL. It is only called by sctp_transport_new(), so change it to void and remove the redundant return value check. Signed-off-by: Huiwen He Acked-by: Xin Long Link: https://patch.msgid.link/20251103023619.1025622-1-hehuiwen@kylinos.cn Signed-off-by: Jakub Kicinski commit 5556f23478e6eb5d6a0321d4135e2c37a3c78a1e Author: Vivian Wang Date: Mon Nov 3 10:02:49 2025 +0800 net: spacemit: Check netif_running() in emac_set_pauseparam() Currently, emac_set_pauseparam() will oops if userspace calls it while the interface is not up, because phydev is NULL, but it is still accessed in emac_set_fc() and emac_set_fc_autoneg(). Check for netif_running(dev) in emac_set_pauseparam() before proceeding. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Signed-off-by: Vivian Wang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251103-k1-ethernet-remove-fc-v3-1-2083770cd282@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 2e25935ed24daee37c4c2e8e29e478ce6e1f72c7 Author: Dan Carpenter Date: Sat Nov 1 16:26:42 2025 +0300 octeontx2-pf: Fix devm_kcalloc() error checking The devm_kcalloc() function never return error pointers, it returns NULL on failure. Also delete the netdev_err() printk. These allocation functions already have debug output built-in some the extra error message is not required. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQYKkrGA12REb2sj@stanley.mountain Signed-off-by: Jakub Kicinski commit 62d2d0a33839c28173909616db2ef16e1a4a5071 Author: Song Liu Date: Mon Oct 27 10:50:23 2025 -0700 selftests/bpf: Add tests for livepatch + bpf trampoline Both livepatch and BPF trampoline use ftrace. Special attention is needed when livepatch and fexit program touch the same function at the same time, because livepatch updates a kernel function and the BPF trampoline need to call into the right version of the kernel function. Use samples/livepatch/livepatch-sample.ko for the test. The test covers two cases: 1) When a fentry program is loaded first. This exercises the modify_ftrace_direct code path. 2) When a fentry program is loaded first. This exercises the register_ftrace_direct code path. Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-4-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 Author: Song Liu Date: Mon Oct 27 10:50:22 2025 -0700 ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on the same kernel function. When needed, ftrace_hash_ipmodify_enable() calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to share the same function as the IPMODIFY ftrace (livepatch). ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, but not called in modify_ftrace_direct() path. As a result, the following operations will break livepatch: 1. Load livepatch to a kernel function; 2. Attach fentry program to the kernel function; 3. Attach fexit program to the kernel function. After 3, the kernel function being used will not be the livepatched version, but the original version. Fix this by adding __ftrace_hash_update_ipmodify() to __modify_ftrace_direct() and adjust some logic around the call. Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 56b3c85e153b84f27e6cff39623ba40a1ad299d3 Author: Song Liu Date: Mon Oct 27 10:50:21 2025 -0700 ftrace: Fix BPF fexit with livepatch When livepatch is attached to the same function as bpf trampoline with a fexit program, bpf trampoline code calls register_ftrace_direct() twice. The first time will fail with -EAGAIN, and the second time it will succeed. This requires register_ftrace_direct() to unregister the address on the first attempt. Otherwise, the bpf trampoline cannot attach. Here is an easy way to reproduce this issue: insmod samples/livepatch/livepatch-sample.ko bpftrace -e 'fexit:cmdline_proc_show {}' ERROR: Unable to attach probe: fexit:vmlinux:cmdline_proc_show... Fix this by cleaning up the hash when register_ftrace_function_nolock hits errors. Also, move the code that resets ops->func and ops->trampoline to the error path of register_ftrace_direct(); and add a helper function reset_direct() in register_ftrace_direct() and unregister_ftrace_direct(). Fixes: d05cb470663a ("ftrace: Fix modification of direct_function hash while in use") Cc: stable@vger.kernel.org # v6.6+ Reported-by: Andrey Grodzovsky Closes: https://lore.kernel.org/live-patching/c5058315a39d4615b333e485893345be@crowdstrike.com/ Cc: Steven Rostedt (Google) Cc: Masami Hiramatsu (Google) Acked-and-tested-by: Andrey Grodzovsky Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-2-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit de0337d641bfa5b6d6b489e479792f1039274e84 Author: Mohammad Heib Date: Fri Oct 31 17:52:03 2025 +0200 net: ionic: map SKB after pseudo-header checksum prep The TSO path called ionic_tx_map_skb() before preparing the TCP pseudo checksum (ionic_tx_tcp_[inner_]pseudo_csum()), which may perform skb_cow_head() and might modifies bytes in the linear header area. Mapping first and then mutating the header risks: - Using a stale DMA address if skb_cow_head() relocates the head, and/or - Device reading stale header bytes on weakly-ordered systems (CPU writes after mapping are not guaranteed visible without an explicit dma_sync_single_for_device()). Reorder the TX path to perform all header mutations (including skb_cow_head()) *before* DMA mapping. Mapping is now done only after the skb layout and header contents are final. This removes the need for any post-mapping dma_sync and prevents on-wire corruption observed under VLAN+TSO load after repeated runs. This change is purely an ordering fix; no functional behavior change otherwise. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Mohammad Heib Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20251031155203.203031-2-mheib@redhat.com Signed-off-by: Jakub Kicinski commit d261f5b09c28850dc63ca1d3018596f829f402d5 Author: Mohammad Heib Date: Fri Oct 31 17:52:02 2025 +0200 net: ionic: add dma_wmb() before ringing TX doorbell The TX path currently writes descriptors and then immediately writes to the MMIO doorbell register to notify the NIC. On weakly ordered architectures, descriptor writes may still be pending in CPU or DMA write buffers when the doorbell is issued, leading to the device fetching stale or incomplete descriptors. Add a dma_wmb() in ionic_txq_post() to ensure all descriptor writes are visible to the device before the doorbell MMIO write. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Mohammad Heib Link: https://patch.msgid.link/20251031155203.203031-1-mheib@redhat.com Signed-off-by: Jakub Kicinski commit 7172c8cd65a09915a8bc4b8dc3f8719f0ca20e71 Merge: 99ae0675d73bd8 f1fc201148c7e6 Author: Jakub Kicinski Date: Mon Nov 3 17:09:38 2025 -0800 Merge branch 'fix-sctp-diag-locking-issues' Stefan Wiehler says: ==================== Fix SCTP diag locking issues - Hold RCU read lock while iterating over address list in inet_diag_msg_sctpaddrs_fill() - Prevent TOCTOU out-of-bounds write - Hold sock lock while iterating over address list in sctp_sock_dump_one() ==================== Link: https://patch.msgid.link/20251028161506.3294376-1-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit f1fc201148c7e684c10a72b6a3375597f28d1ef6 Author: Stefan Wiehler Date: Tue Oct 28 17:12:28 2025 +0100 sctp: Hold sock lock while iterating over address list Move address list traversal in inet_assoc_attr_size() under the sock lock to avoid holding the RCU read lock. Suggested-by: Xin Long Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-4-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 95aef86ab231f047bb8085c70666059b58f53c09 Author: Stefan Wiehler Date: Tue Oct 28 17:12:27 2025 +0100 sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use). Suggested-by: Kuniyuki Iwashima Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Reviewed-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 38f50242bf0f237cdc262308d624d333286ec3c5 Author: Stefan Wiehler Date: Tue Oct 28 17:12:26 2025 +0100 sctp: Hold RCU read lock while iterating over address list With CONFIG_PROVE_RCU_LIST=y and by executing $ netcat -l --sctp & $ netcat --sctp localhost & $ ss --sctp one can trigger the following Lockdep-RCU splat(s): WARNING: suspicious RCU usage 6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted ----------------------------- net/sctp/diag.c:76 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by ss/215: #0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0 #1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200 stack backtrace: CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5d/0x90 lockdep_rcu_suspicious.cold+0x4e/0xa3 inet_sctp_diag_fill.isra.0+0x4b1/0x5d0 sctp_sock_dump+0x131/0x200 sctp_transport_traverse_process+0x170/0x1b0 ? __pfx_sctp_sock_filter+0x10/0x10 ? __pfx_sctp_sock_dump+0x10/0x10 sctp_diag_dump+0x103/0x140 __inet_diag_dump+0x70/0xb0 netlink_dump+0x148/0x490 __netlink_dump_start+0x1f3/0x2b0 inet_diag_handler_cmd+0xcd/0x100 ? __pfx_inet_diag_dump_start+0x10/0x10 ? __pfx_inet_diag_dump+0x10/0x10 ? __pfx_inet_diag_dump_done+0x10/0x10 sock_diag_rcv_msg+0x18e/0x320 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x4d/0x100 netlink_unicast+0x1d7/0x2b0 netlink_sendmsg+0x203/0x450 ____sys_sendmsg+0x30c/0x340 ___sys_sendmsg+0x94/0xf0 __sys_sendmsg+0x83/0xf0 do_syscall_64+0xbb/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Reviewed-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-2-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 99ae0675d73bd88c8ff4d15a6b0f310d49cad84c Merge: 7942602b09497f 65bd9a262644b6 Author: Jakub Kicinski Date: Mon Nov 3 16:48:53 2025 -0800 Merge branch 'net-phy-micrel-lan8842-erratas' Horatiu Vultur says: ==================== net: phy: micrel: lan8842 erratas Add two erratas to the lan8842. The errata document can be found here [1] The two erratas are: - module 2 ("Analog front-end not optimized for PHY-side shorted center taps"). - module 7 ("1000BASE-T PMA EEE TX wake timer is non-compliant") ==================== Link: https://patch.msgid.link/20251031121629.814935-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 65bd9a262644b67490dddd93a2b842ac94ccbe36 Author: Horatiu Vultur Date: Fri Oct 31 13:16:29 2025 +0100 net: phy: micrel: lan8842 errata Add errata for lan8842. The errata document can be found here [1]. This is fixing the module 7 ("1000BASE-T PMA EEE TX wake timer is non-compliant") [1] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/LAN8842-Errata-DS80001172.pdf Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Reviewed-by: Andrew Lunn Signed-off-by: Horatiu Vultur Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit c8732e933925e188cbb1d9bc3a5e1ae9affe6869 Author: Horatiu Vultur Date: Fri Oct 31 13:16:28 2025 +0100 net: phy: micrel: lan8842 errata Add errata for lan8842. The errata document can be found here [1]. This is fixing the module 2 ("Analog front-end not optimized for PHY-side shorted center taps"). [1] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/LAN8842-Errata-DS80001172.pdf Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Reviewed-by: Andrew Lunn Signed-off-by: Horatiu Vultur Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 7942602b09497ff1505c9385aefd38c69e16235e Merge: c7321193bcd7dd e57723fe536f04 Author: Jakub Kicinski Date: Mon Nov 3 16:42:45 2025 -0800 Merge branch 'net-dsa-b53-minor-fdb-related-fixes' Jonas Gorski says: ==================== net: dsa: b53: minor fdb related fixes While investigating and fixing/implenting proper ARL support for bcm63xx, I encountered multiple minor issues in the current ARL implementation: * The ARL multicast support was not properly enabled for older chips, and instead a potentially reserved bit was toggled. * While traversing the ARL table, "Search done" triggered one final entry which will be invalid for 4 ARL bin chips, and failed to stop the search on chips with only one result register. * For chips where we have only one result register, we only traversed at most half the maximum entries. I also had a fix for IVL_SVL_SELECT which is only valid for some chips, but since this would only have an effect for !vlan_enabled, and we always have that enabled, it isn't really worth fixing (and rather drop the !vlan_enabled paths). ==================== Link: https://patch.msgid.link/20251102100758.28352-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit e57723fe536f040cc2635ec1545dd0a7919a321e Author: Jonas Gorski Date: Sun Nov 2 11:07:58 2025 +0100 net: dsa: b53: properly bound ARL searches for < 4 ARL bin chips When iterating over the ARL table we stop at max ARL entries / 2, but this is only valid if the chip actually returns 2 results at once. For chips with only one result register we will stop before reaching the end of the table if it is more than half full. Fix this by only dividing the maximum results by two if we have a chip with more than one result register (i.e. those with 4 ARL bins). Fixes: cd169d799bee ("net: dsa: b53: Bound check ARL searches") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-4-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da Author: Jonas Gorski Date: Sun Nov 2 11:07:57 2025 +0100 net: dsa: b53: stop reading ARL entries if search is done The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it finished traversing the ARL table. This means that there will be no valid result, so we should not attempt to read and process any further entries. We only ever check the validity of the entries for 4 ARL bin chips, and only after having passed the first entry to the b53_fdb_copy(). This means that we always pass an invalid entry at the end to the b53_fdb_copy(). b53_fdb_copy() does check the validity though before passing on the entry, so it never gets passed on. On < 4 ARL bin chips, we will even continue reading invalid entries until we reach the result limit. Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit c264294624e956a967a9e2e5fa41e3273340b089 Author: Jonas Gorski Date: Sun Nov 2 11:07:56 2025 +0100 net: dsa: b53: fix enabling ip multicast In the New Control register bit 1 is either reserved, or has a different function: Out of Range Error Discard When enabled, the ingress port discards any frames if the Length field is between 1500 and 1536 (excluding 1500 and 1536) and with good CRC. The actual bit for enabling IP multicast is bit 0, which was only explicitly enabled for BCM5325 so far. For older switch chips, this bit defaults to 0, so we want to enable it as well, while newer switch chips default to 1, and their documentation says "It is illegal to set this bit to zero." So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit also for other switch chips. While at it, rename it to (B53_)IP_MC as that is how it is called in Broadcom code. Fixes: 63cc54a6f073 ("net: dsa: b53: Fix egress flooding settings") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit c7321193bcd7ddb22fdd9ae26516c8963e31e134 Merge: 7ed8b63ddc9a95 3e4ebdc1606adf Author: Jakub Kicinski Date: Mon Nov 3 16:40:37 2025 -0800 Merge branch 'net-dsa-b53-fix-bcm63xx-rgmii-user-ports-with-speed-1g' Jonas Gorski says: ==================== net: dsa: b53: fix bcm63xx rgmii user ports with speed < 1g It seems that the integrated switch in bcm63xx does not support polling external PHYs for link configuration. While the appropriate registers seem to exist with expected content, changing them does nothing. This results in user ports with external PHYs only working in 1000/fd, and not in other modes, despite linking up. Fix this by writing the link result into the port state override register, like we already do for fixed links. With this, ports with lower speeds can successfully transmit and receive packets. This also aligns the behaviour with the old bcm63xx_enetsw driver for those ports. ==================== Link: https://patch.msgid.link/20251101132807.50419-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 3e4ebdc1606adf77744cf8ed7a433d279fdc57ba Author: Jonas Gorski Date: Sat Nov 1 14:28:07 2025 +0100 net: dsa: b53: fix bcm63xx RGMII port link adjustment BCM63XX's switch does not support MDIO scanning of external phys, so its MACs needs to be manually configured for autonegotiated link speeds. So b53_force_port_config() and b53_force_link() accordingly also when mode is MLO_AN_PHY for those ports. Fixes lower speeds than 1000/full on rgmii ports 4 - 7. This aligns the behaviour with the old bcm63xx_enetsw driver for those ports. Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101132807.50419-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 Author: Jonas Gorski Date: Sat Nov 1 14:28:06 2025 +0100 net: dsa: b53: fix resetting speed and pause on forced link There is no guarantee that the port state override registers have their default values, as not all switches support being reset via register or have a reset GPIO. So when forcing port config, we need to make sure to clear all fields, which we currently do not do for the speed and flow control configuration. This can cause flow control stay enabled, or in the case of speed becoming an illegal value, e.g. configured for 1G (0x2), then setting 100M (0x1), results in 0x3 which is invalid. For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on supported chips, as the bit can have different meanings on other chips, e.g. for BCM5389 this controls scanning PHYs for link/speed configuration. Fixes: 5e004460f874 ("net: dsa: b53: Add helper to set link parameters") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101132807.50419-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 7ed8b63ddc9a9578eae81f4da32761568a25efad Author: Jonas Gorski Date: Sat Nov 1 11:39:54 2025 +0100 MAINTAINERS: add brcm tag driver to b53 The b53 entry was missing the brcm tag driver, so add it. Reported-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20251029181216.3f35f8ba@kernel.org/ Signed-off-by: Jonas Gorski Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101103954.29816-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit b2b526c2cf57d14ee269e012ed179081871f45a1 Author: Alok Tiwari Date: Fri Oct 31 09:15:53 2025 -0700 net: mdio: Check regmap pointer returned by device_node_to_regmap() The call to device_node_to_regmap() in airoha_mdio_probe() can return an ERR_PTR() if regmap initialization fails. Currently, the driver stores the pointer without validation, which could lead to a crash if it is later dereferenced. Add an IS_ERR() check and return the corresponding error code to make the probe path more robust. Fixes: 67e3ba978361 ("net: mdio: Add MDIO bus controller for Airoha AN7583") Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251031161607.58581-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 8bb886cb8f3a2811430ddb7d9838e245c57e7f7c Merge: 6146a0f1dfae5d 79c0a2b7abc906 Author: Linus Torvalds Date: Tue Nov 4 08:05:05 2025 +0900 Merge tag 'edac_urgent_for_v6.18_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix an off-by-one error in versalnet_edac * tag 'edac_urgent_for_v6.18_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versalnet: Fix off by one in handle_error() commit fad472efab0a805dd939f017c5b8669a786a4bcf Author: Miguel Ojeda Date: Sun Nov 2 22:28:53 2025 +0100 rust: kbuild: workaround `rustdoc` doctests modifier bug The `rustdoc` modifiers bug [1] was fixed in Rust 1.90.0 [2], for which we added a workaround in commit abbf9a449441 ("rust: workaround `rustdoc` target modifiers bug"). However, `rustdoc`'s doctest generation still has a similar issue [3], being fixed at [4], which does not affect us because we apply the workaround to both, and now, starting with Rust 1.91.0 (released 2025-10-30), `-Zsanitizer` is a target modifier too [5], which means we fail with: RUSTDOC TK rust/kernel/lib.rs error: mixing `-Zsanitizer` will cause an ABI mismatch in crate `kernel` --> rust/kernel/lib.rs:3:1 | 3 | //! The `kernel` crate. | ^ | = help: the `-Zsanitizer` flag modifies the ABI so Rust crates compiled with different values of this flag cannot be used together safely = note: unset `-Zsanitizer` in this crate is incompatible with `-Zsanitizer=kernel-address` in dependency `core` = help: set `-Zsanitizer=kernel-address` in this crate or unset `-Zsanitizer` in `core` = help: if you are sure this will not cause problems, you may use `-Cunsafe-allow-abi-mismatch=sanitizer` to silence this error A simple way around is to add the sanitizer to the list in the existing workaround (especially if we had not started to pass the sanitizer flags in the previous commit, since in that case that would not be necessary). However, that still applies the workaround in more cases than necessary. Instead, only modify the doctests flags to ignore the check for sanitizers, so that it is more local (and thus the compiler keeps checking it for us in the normal `rustdoc` calls). Since the previous commit already treated the `rustdoc` calls as kernel objects, this should allow us in the future to easily remove this workaround when the time comes. By the way, the `-Cunsafe-allow-abi-mismatch` flag overwrites previous ones rather than appending, so it needs to be all done in the same flag. Moreover, unknown modifiers are rejected, and thus we have to gate based on the version too. Finally, `-Zsanitizer-cfi-normalize-integers` is not affected (in Rust 1.91.0), so it is not needed in the workaround for the moment. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/issues/144521 [1] Link: https://github.com/rust-lang/rust/pull/144523 [2] Link: https://github.com/rust-lang/rust/issues/146465 [3] Link: https://github.com/rust-lang/rust/pull/148068 [4] Link: https://github.com/rust-lang/rust/pull/138736 [5] Reviewed-by: Alice Ryhl Tested-by: Justin M. Forbes Link: https://patch.msgid.link/20251102212853.1505384-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 16c43a56b79e2c3220b043236369a129d508c65a Author: Miguel Ojeda Date: Sun Nov 2 22:28:52 2025 +0100 rust: kbuild: treat `build_error` and `rustdoc` as kernel objects Even if normally `build_error` isn't a kernel object, it should still be treated as such so that we pass the same flags. Similarly, `rustdoc` targets are never kernel objects, but we need to treat them as such. Otherwise, starting with Rust 1.91.0 (released 2025-10-30), `rustc` will complain about missing sanitizer flags since `-Zsanitizer` is a target modifier too [1]: error: mixing `-Zsanitizer` will cause an ABI mismatch in crate `build_error` --> rust/build_error.rs:3:1 | 3 | //! Build-time error. | ^ | = help: the `-Zsanitizer` flag modifies the ABI so Rust crates compiled with different values of this flag cannot be used together safely = note: unset `-Zsanitizer` in this crate is incompatible with `-Zsanitizer=kernel-address` in dependency `core` = help: set `-Zsanitizer=kernel-address` in this crate or unset `-Zsanitizer` in `core` = help: if you are sure this will not cause problems, you may use `-Cunsafe-allow-abi-mismatch=sanitizer` to silence this error Thus explicitly mark them as kernel objects. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/138736 [1] Reviewed-by: Alice Ryhl Tested-by: Justin M. Forbes Link: https://patch.msgid.link/20251102212853.1505384-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 7f17ef0d47b9aa01b89a92b2514fbfe800d8aeca Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 14:54:31 2025 -0300 perf symbols: Handle '1' symbols in /proc/kallsyms I started seeing this in recent Fedora 42 kernels: root@x1:~# uname -a Linux x1 6.17.4-200.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Oct 19 18:47:49 UTC 2025 x86_64 GNU/Linux root@x1:~# root@x1:~# perf test 1 1: vmlinux symtab matches kallsyms : FAILED! root@x1:~# Related to: root@x1:~# grep ' 1 ' /proc/kallsyms ffffffffb098bc00 1 __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ ffffffffb098bc10 1 _RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ root@x1:~# That is found in: root@x1:~# pahole --running_kernel_vmlinux /usr/lib/debug/lib/modules/6.17.4-200.fc42.x86_64/vmlinux root@x1:~# root@x1:~# readelf -sW /usr/lib/debug/lib/modules/6.17.4-200.fc42.x86_64/vmlinux | grep __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ 150649: ffffffff81f8bc00 16 FUNC LOCAL DEFAULT 1 __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ root@x1:~# But was being filtered out when reading /proc/kallsyms, as the '1' symbol type was not being handled, do it, there are just two of them at this point. Cc: Alex Gaynor Cc: Alice Ryhl Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Arnaldo Carvalho de Melo commit 6a0dddc53f6f04281b27254a7d940fb9bb2d5a3b Author: Krzysztof Kozlowski Date: Mon Nov 3 16:19:06 2025 +0100 i2c: muxes: pca954x: Fix broken reset-gpio usage Revert commit 690de2902dca ("i2c: muxes: pca954x: Use reset controller only") and its dependent commit 94c296776403 ("i2c: muxes: pca954x: Reset if (de)select fails") because the first breaks all users of the driver, by requiring a completely optional reset-gpio driver. These commits cause that mux driver simply stops working when optional reset-gpio is not included, but that reset-gpio is not pulled anyhow. Driver cannot remove legacy reset-gpios handling. Fixes: 690de2902dca ("i2c: muxes: pca954x: Use reset controller only") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 549042f16716b4c72bfa9813d9e38f352c539dad Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 13:35:06 2025 -0300 tools headers asm: Sync fls headers header with the kernel sources To pick the changes in: 6606c8c7e8188656 ("bitops: Add __attribute_const__ to generic ffs()-family implementations") This addresses these tools build warnings: Warning: Kernel ABI header differences: diff -u tools/include/asm-generic/bitops/__fls.h include/asm-generic/bitops/__fls.h diff -u tools/include/asm-generic/bitops/fls.h include/asm-generic/bitops/fls.h diff -u tools/include/asm-generic/bitops/fls64.h include/asm-generic/bitops/fls64.h Please see tools/include/uapi/README for further details. Cc: Kees Cook Signed-off-by: Arnaldo Carvalho de Melo commit fc9ef9118d8a6c6250273aae14b48dd8f91bee1f Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 13:24:47 2025 -0300 tools headers UAPI: Sync KVM's vmx.h header with the kernel sources to handle new exit reasons To pick the changes in: 885df2d2109a60f8 ("KVM: x86: Add support for RDMSR/WRMSRNS w/ immediate on Intel") c42856af8f70d983 ("KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL)") That makes 'perf kvm-stat' aware of these new TDCALL and MSR_{READ,WRITE}_IMM exit reasons, thus addressing the following perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Xin Li Cc: Isaku Yamahata Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit 649a0cc96ed1170cea5686f11229e07014b3d18f Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 12:18:17 2025 -0300 tools headers svm: Sync svm headers with the kernel sources To pick the changes in: b8c3c9f5d0505905 ("x86/apic: Initialize Secure AVIC APIC backing page") That triggers: CC /tmp/build/perf-tools/arch/x86/util/kvm-stat.o LD /tmp/build/perf-tools/arch/x86/util/perf-util-in.o LD /tmp/build/perf-tools/arch/x86/perf-util-in.o LD /tmp/build/perf-tools/arch/perf-util-in.o LD /tmp/build/perf-tools/perf-util-in.o AR /tmp/build/perf-tools/libperf-util.a LINK /tmp/build/perf-tools/perf But this time causes no changes in tooling results, as the introduced SVM_VMGEXIT_SAVIC exit reason wasn't added to SVM_EXIT_REASONS, that is used in kvm-stat.c. And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h Please see tools/include/uapi/README for further details. Cc: Borislav Petkov (AMD) Cc: Neeraj Upadhyay Signed-off-by: Arnaldo Carvalho de Melo commit b1d46bc10ff2e6241f331e2935acd05d3d025816 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 12:10:17 2025 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: fddd07626baa419c ("KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors") f2f5519aa4e3ec4e ("KVM: x86: Define Control Protection Exception (#CP) vector") 9d6812d415358372 ("KVM: x86: Enable guest SSP read/write interface with new uAPIs") 06f2969c6a1237f0 ("KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Yang Weijiang Signed-off-by: Arnaldo Carvalho de Melo commit 01e11d18da818eabdb3769081e7123ed8bfe863c Author: Dan Carpenter Date: Fri Oct 31 16:03:43 2025 +0300 ACPI: SBS: Fix present test in acpi_battery_read() The battery->present variable is a 1 bit bitfield in a u8. This means that the "state & (1 << battery->id)" test will only work when "battery->id" is zero, otherwise ->present is zero. Fix this by adding a !!. Fixes: db1c291af7ad ("ACPI: SBS: Make SBS reads table-driven.") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQSzr4NynN2mpEvG@stanley.mountain Signed-off-by: Rafael J. Wysocki commit fde7f626423295eeebcd0305c3ee4b7f2f45b655 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 11:45:29 2025 -0300 MAINTAINERS: Add James Clark as a perf tools reviewer James Clark has been actively reviewing patches and contributing to perf tools. Reflect this by adding him as a reviewer in the MAINTAINERS file. Reviewed-by: James Clark Acked-by: Ian Rogers Acked-by: Ingo Molnar Acked-by: Namhyung Kim Acked-by: Peter Zijlstra (Intel) Signed-off-by: Arnaldo Carvalho de Melo commit 1642fabff19f768e9a8fea85d55a2d6d43ecffe3 Author: Chu Guangqing Date: Fri Oct 31 13:52:40 2025 +0800 ACPI: CPPC: Fix typo in a comment Fix spelling from "pachage" to "package". Signed-off-by: Chu Guangqing [ rjw: Changelog and subject edits ] Link: https://patch.msgid.link/20251031055240.2791-1-chuguangqing@inspur.com Signed-off-by: Rafael J. Wysocki commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 Author: Umesh Nerlige Ramappa Date: Wed Oct 15 17:03:51 2025 -0700 drm/i915: Fix conversion between clock ticks and nanoseconds When tick values are large, the multiplication by NSEC_PER_SEC is larger than 64 bits and results in bad conversions. The issue is seen in PMU busyness counters that look like they have wrapped around due to bad conversion. i915 PMU implementation returns monotonically increasing counters. If a count is lesser than previous one, it will only return the larger value until the smaller value catches up. The user will see this as zero delta between two measurements even though the engines are busy. Fix it by using mul_u64_u32_div() Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com (cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) Signed-off-by: Rodrigo Vivi [Rodrigo: Added the Fixes tag while cherry-picking to fixes] commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b Author: Janusz Krzysztofik Date: Thu Oct 23 10:25:19 2025 +0200 drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT address space on a Cherry View family processor, or on a Broxton generation SoC with VTD enabled, i.e., when stop_machine() is then called from intel_ggtt_bind_vma(), that can potentially lead to lock inversion among reservation_ww and cpu_hotplug locks. [86.861179] ====================================================== [86.861193] WARNING: possible circular locking dependency detected [86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U [86.861226] ------------------------------------------------------ [86.861238] i915_module_loa/1432 is trying to acquire lock: [86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 [86.861290] but task is already holding lock: [86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.862233] which lock already depends on the new lock. [86.862251] the existing dependency chain (in reverse order) is: [86.862265] -> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: [86.862292] dma_resv_lockdep+0x19a/0x390 [86.862315] do_one_initcall+0x60/0x3f0 [86.862334] kernel_init_freeable+0x3cd/0x680 [86.862353] kernel_init+0x1b/0x200 [86.862369] ret_from_fork+0x47/0x70 [86.862383] ret_from_fork_asm+0x1a/0x30 [86.862399] -> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: [86.862425] dma_resv_lockdep+0x178/0x390 [86.862440] do_one_initcall+0x60/0x3f0 [86.862454] kernel_init_freeable+0x3cd/0x680 [86.862470] kernel_init+0x1b/0x200 [86.862482] ret_from_fork+0x47/0x70 [86.862495] ret_from_fork_asm+0x1a/0x30 [86.862509] -> #3 (&mm->mmap_lock){++++}-{3:3}: [86.862531] down_read_killable+0x46/0x1e0 [86.862546] lock_mm_and_find_vma+0xa2/0x280 [86.862561] do_user_addr_fault+0x266/0x8e0 [86.862578] exc_page_fault+0x8a/0x2f0 [86.862593] asm_exc_page_fault+0x27/0x30 [86.862607] filldir64+0xeb/0x180 [86.862620] kernfs_fop_readdir+0x118/0x480 [86.862635] iterate_dir+0xcf/0x2b0 [86.862648] __x64_sys_getdents64+0x84/0x140 [86.862661] x64_sys_call+0x1058/0x2660 [86.862675] do_syscall_64+0x91/0xe90 [86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.862703] -> #2 (&root->kernfs_rwsem){++++}-{3:3}: [86.862725] down_write+0x3e/0xf0 [86.862738] kernfs_add_one+0x30/0x3c0 [86.862751] kernfs_create_dir_ns+0x53/0xb0 [86.862765] internal_create_group+0x134/0x4c0 [86.862779] sysfs_create_group+0x13/0x20 [86.862792] topology_add_dev+0x1d/0x30 [86.862806] cpuhp_invoke_callback+0x4b5/0x850 [86.862822] cpuhp_issue_call+0xbf/0x1f0 [86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 [86.862852] __cpuhp_setup_state+0xb0/0x220 [86.862866] topology_sysfs_init+0x30/0x50 [86.862879] do_one_initcall+0x60/0x3f0 [86.862893] kernel_init_freeable+0x3cd/0x680 [86.862908] kernel_init+0x1b/0x200 [86.862921] ret_from_fork+0x47/0x70 [86.862934] ret_from_fork_asm+0x1a/0x30 [86.862947] -> #1 (cpuhp_state_mutex){+.+.}-{3:3}: [86.862969] __mutex_lock+0xaa/0xed0 [86.862982] mutex_lock_nested+0x1b/0x30 [86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 [86.863012] __cpuhp_setup_state+0xb0/0x220 [86.863026] page_alloc_init_cpuhp+0x2d/0x60 [86.863041] mm_core_init+0x22/0x2d0 [86.863054] start_kernel+0x576/0xbd0 [86.863068] x86_64_start_reservations+0x18/0x30 [86.863084] x86_64_start_kernel+0xbf/0x110 [86.863098] common_startup_64+0x13e/0x141 [86.863114] -> #0 (cpu_hotplug_lock){++++}-{0:0}: [86.863135] __lock_acquire+0x1635/0x2810 [86.863152] lock_acquire+0xc4/0x2f0 [86.863166] cpus_read_lock+0x41/0x100 [86.863180] stop_machine+0x1c/0x50 [86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] [86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] [86.864735] __vma_bind+0x55/0x70 [i915] [86.865510] fence_work+0x26/0xa0 [i915] [86.866248] fence_notify+0xa1/0x140 [i915] [86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] [86.867719] i915_sw_fence_commit+0x39/0x60 [i915] [86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] [86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] [86.870001] initial_plane_vma+0x307/0x840 [i915] [86.870774] intel_initial_plane_config+0x33f/0x670 [i915] [86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] [86.872330] i915_driver_probe+0x7fa/0xe80 [i915] [86.873057] i915_pci_probe+0xe6/0x220 [i915] [86.873782] local_pci_probe+0x47/0xb0 [86.873802] pci_device_probe+0xf3/0x260 [86.873817] really_probe+0xf1/0x3c0 [86.873833] __driver_probe_device+0x8c/0x180 [86.873848] driver_probe_device+0x24/0xd0 [86.873862] __driver_attach+0x10f/0x220 [86.873876] bus_for_each_dev+0x7f/0xe0 [86.873892] driver_attach+0x1e/0x30 [86.873904] bus_add_driver+0x151/0x290 [86.873917] driver_register+0x5e/0x130 [86.873931] __pci_register_driver+0x7d/0x90 [86.873945] i915_pci_register_driver+0x23/0x30 [i915] [86.874678] i915_init+0x37/0x120 [i915] [86.875347] do_one_initcall+0x60/0x3f0 [86.875369] do_init_module+0x97/0x2a0 [86.875385] load_module+0x2c54/0x2d80 [86.875398] init_module_from_file+0x96/0xe0 [86.875413] idempotent_init_module+0x117/0x330 [86.875426] __x64_sys_finit_module+0x77/0x100 [86.875440] x64_sys_call+0x24de/0x2660 [86.875454] do_syscall_64+0x91/0xe90 [86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.875486] other info that might help us debug this: [86.875502] Chain exists of: cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex [86.875539] Possible unsafe locking scenario: [86.875552] CPU0 CPU1 [86.875563] ---- ---- [86.875573] lock(reservation_ww_class_mutex); [86.875588] lock(reservation_ww_class_acquire); [86.875606] lock(reservation_ww_class_mutex); [86.875624] rlock(cpu_hotplug_lock); [86.875637] *** DEADLOCK *** [86.875650] 3 locks held by i915_module_loa/1432: [86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 [86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.877305] stack backtrace: [86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) [86.877334] Tainted: [U]=USER [86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 [86.877339] Call Trace: [86.877344] [86.877353] dump_stack_lvl+0x91/0xf0 [86.877364] dump_stack+0x10/0x20 [86.877369] print_circular_bug+0x285/0x360 [86.877379] check_noncircular+0x135/0x150 [86.877390] __lock_acquire+0x1635/0x2810 [86.877403] lock_acquire+0xc4/0x2f0 [86.877408] ? stop_machine+0x1c/0x50 [86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] [86.878173] cpus_read_lock+0x41/0x100 [86.878182] ? stop_machine+0x1c/0x50 [86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] [86.878916] stop_machine+0x1c/0x50 [86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] [86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] [86.880375] __vma_bind+0x55/0x70 [i915] [86.881133] fence_work+0x26/0xa0 [i915] [86.881851] fence_notify+0xa1/0x140 [i915] [86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] [86.883286] i915_sw_fence_commit+0x39/0x60 [i915] [86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] [86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] [86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] [86.886281] initial_plane_vma+0x307/0x840 [i915] [86.887049] intel_initial_plane_config+0x33f/0x670 [i915] [86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] [86.888587] i915_driver_probe+0x7fa/0xe80 [i915] [86.889293] ? mutex_unlock+0x12/0x20 [86.889301] ? drm_privacy_screen_get+0x171/0x190 [86.889308] ? acpi_dev_found+0x66/0x80 [86.889321] i915_pci_probe+0xe6/0x220 [i915] [86.890038] local_pci_probe+0x47/0xb0 [86.890049] pci_device_probe+0xf3/0x260 [86.890058] really_probe+0xf1/0x3c0 [86.890067] __driver_probe_device+0x8c/0x180 [86.890072] driver_probe_device+0x24/0xd0 [86.890078] __driver_attach+0x10f/0x220 [86.890083] ? __pfx___driver_attach+0x10/0x10 [86.890088] bus_for_each_dev+0x7f/0xe0 [86.890097] driver_attach+0x1e/0x30 [86.890101] bus_add_driver+0x151/0x290 [86.890107] driver_register+0x5e/0x130 [86.890113] __pci_register_driver+0x7d/0x90 [86.890119] i915_pci_register_driver+0x23/0x30 [i915] [86.890833] i915_init+0x37/0x120 [i915] [86.891482] ? __pfx_i915_init+0x10/0x10 [i915] [86.892135] do_one_initcall+0x60/0x3f0 [86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 [86.892157] do_init_module+0x97/0x2a0 [86.892164] load_module+0x2c54/0x2d80 [86.892168] ? __kernel_read+0x15c/0x300 [86.892185] ? kernel_read_file+0x2b1/0x320 [86.892195] init_module_from_file+0x96/0xe0 [86.892199] ? init_module_from_file+0x96/0xe0 [86.892211] idempotent_init_module+0x117/0x330 [86.892224] __x64_sys_finit_module+0x77/0x100 [86.892230] x64_sys_call+0x24de/0x2660 [86.892236] do_syscall_64+0x91/0xe90 [86.892243] ? irqentry_exit+0x77/0xb0 [86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 [86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.892261] RIP: 0033:0x7303e1b2725d [86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 [86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d [86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c [86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 [86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 [86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 [86.892304] Call asynchronous variant of dma_fence_work_commit() in that case. v3: Provide more verbose in-line comment (Andi), - mention target environments in commit message. Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 Cc: Andi Shyti Signed-off-by: Janusz Krzysztofik Reviewed-by: Sebastian Brzezinka Reviewed-by: Krzysztof Karas Acked-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com (cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) Signed-off-by: Rodrigo Vivi commit 29e4d12a2957e4e7dcad2418c7251f36285d99d8 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 10:53:46 2025 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: fe2bf6234e947bf5 ("KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set") d2042d8f96ddefde ("KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS") 3d3a04fad25a6621 ("KVM: Allow and advertise support for host mmap() on guest_memfd files") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the 'perf trace' ioctl syscall argument beautifiers. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Fuad Tabba Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit bd9e119951b527724938ff55fb0ca3daa54f5c18 Author: Jonas Gorski Date: Mon Oct 27 20:26:28 2025 +0100 Documentation: ACPI: i2c-muxes: fix I2C device references When the device references were changed from relative to absolute in commit e65cb011349e ("Documentation: ACPI: Fix parent device references"), the MUX0 device was omitted from the paths. So add it to fix the references. Fixes: e65cb011349e ("Documentation: ACPI: Fix parent device references") Closes: https://lore.kernel.org/all/48d0fb45-096c-4caa-b51c-753c2f17f018@gmail.com/ Signed-off-by: Jonas Gorski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251027192628.130998-1-jonas.gorski@gmail.com Signed-off-by: Rafael J. Wysocki commit 819630bd6f86ac8998c7df9deddb6cee50e9e22d Author: Pavel Begunkov Date: Mon Nov 3 13:53:13 2025 +0000 io_uring/zcrx: remove sync refill uapi There is a better way to handle the problem IORING_REGISTER_ZCRX_REFILL solves. The uapi can also be slightly adjusted to accommodate future extensions. Remove the feature for now, it'll be reworked for the next release. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8f05967b022d255412640670915475ac4cdc10e9 Author: Jens Axboe Date: Mon Nov 3 08:49:32 2025 -0700 MAINTAINERS: correct git location for block layer tree As part of a recent move go exclusively listing git.kernel.org trees for the block and io_uring development, the "BLOCK LAYER" entry wasn't updated as it already used git.kernel.org. However, outside of just moving from git.kernel.dk to git.kernel.org, the "block" part of the trees was also dropped, as the tree serves both block and io_uring development trees. Fix up the "BLOCK LAYER" entry so they all use the same tree. Reported-by: John Garry Reviewed-by: John Garry Signed-off-by: Jens Axboe commit f8950b47db707565543d6c4a9fdb7e36b3329722 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 10:33:26 2025 -0300 tools headers UAPI: Update tools's copy of drm.h to pick DRM_IOCTL_GEM_CHANGE_HANDLE Picking the changes from: 0864197382fa7c8c ("drm: Move drm_gem ioctl kerneldoc to uapi file") 53096728b8910c69 ("drm: Add DRM prime interface to reassign GEM handle") Addressing these perf build warnings: Warning: Kernel ABI header differences: Now 'perf trace' and other code that might use the tools/perf/trace/beauty autogenerated tables will be able to translate this new ioctl command into a string: $ tools/perf/trace/beauty/drm_ioctl.sh > before $ cp include/uapi/drm/drm.h tools/include/uapi/drm/drm.h $ tools/perf/trace/beauty/drm_ioctl.sh > after $ diff -u before after --- before 2025-11-03 09:57:34.832553174 -0300 +++ after 2025-11-03 09:57:47.969409428 -0300 @@ -111,6 +111,7 @@ [0xCF] = "SYNCOBJ_EVENTFD", [0xD0] = "MODE_CLOSEFB", [0xD1] = "SET_CLIENT_NAME", + [0xD2] = "GEM_CHANGE_HANDLE", [DRM_COMMAND_BASE + 0x00] = "I915_INIT", [DRM_COMMAND_BASE + 0x01] = "I915_FLUSH", [DRM_COMMAND_BASE + 0x02] = "I915_FLIP", $ Please see tools/include/uapi/README for further details. Cc: Christian König Cc: David Francis Signed-off-by: Arnaldo Carvalho de Melo commit 2f6115ad8864cf3f48598f26c74c7c8e5c391919 Author: Bartosz Golaszewski Date: Mon Nov 3 15:11:32 2025 +0100 gpiolib: fix invalid pointer access in debugfs If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it. Fixes: e348544f7994 ("gpio: protect the list of GPIO devices with SRCU") Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251103141132.53471-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit e5d527be7e6984882306b49c067f1fec18920735 Author: Bartosz Golaszewski Date: Mon Nov 3 10:35:24 2025 +0100 gpio: swnode: don't use the swnode's name as the key for GPIO lookup Looking up a GPIO controller by label that is the name of the software node is wonky at best - the GPIO controller driver is free to set a different label than the name of its firmware node. We're already being passed a firmware node handle attached to the GPIO device to swnode_get_gpio_device() so use it instead for a more precise lookup. Acked-by: Linus Walleij Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes") Link: https://lore.kernel.org/r/20251103-reset-gpios-swnodes-v4-4-6461800b6775@linaro.org Signed-off-by: Bartosz Golaszewski commit b4cd8f94ae7e5b0d83041b186258eba0c8f7c5f7 Author: Matt Coster Date: Tue Oct 14 12:57:31 2025 +0100 drm/imagination: Optionally depend on POWER_SEQUENCING When the change using pwrseq was added, I nixed the dependency on POWER_SEQUENCING since we didn't want it pulled in on platforms where it's not needed [1]. I hadn't, however, considered the link-time implications of this for configs with POWER_SEQUENCING=m. [1]: https://lore.kernel.org/r/a265a20e-8908-40d8-b4e0-2c8b8f773742@imgtec.com/ Fixes: e38e8391f30b ("drm/imagination: Use pwrseq for TH1520 GPU power management") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510111806.CMulNMKW-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511011739.SONHjSfR-lkp@intel.com/ Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20251014-pwrseq-dep-v1-1-49aabd9d8fa1@imgtec.com Signed-off-by: Matt Coster commit 8da0efc3da9312b65f5cbf06e57d284f69222b2e Author: Richard Fitzgerald Date: Mon Nov 3 11:58:09 2025 +0000 ASoC: doc: cs35l56: Update firmware filename description for B0 silicon Update the text for firmware file naming to show that the l?u? suffix is supported on CS35L56 B0 silicon and ampN was only used on early firmware. The previous version of this text only said that B0 silicon used the ampN suffix. Since kernel 6.16 the driver supports both the old ampN and new l?u? suffix for B0 silicon. New firmwares will use the l?u? suffix. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251103115809.33953-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 Author: Khairul Anuar Romli Date: Mon Nov 3 07:21:28 2025 +0800 firmware: stratix10-svc: fix bug in saving controller data Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They both are of the same data and overrides each other. This resulted in the rmmod of the svc driver to fail and throw a kernel panic for kthread_stop and fifo free. Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features") Cc: stable@vger.kernel.org # 6.6+ Signed-off-by: Ang Tien Sung Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb Author: Yazen Ghannam Date: Tue Oct 28 21:35:42 2025 +0000 x86/amd_node: Fix AMD root device caching Recent AMD node rework removed the "search and count" method of caching AMD root devices. This depended on the value from a Data Fabric register that was expected to hold the PCI bus of one of the root devices attached to that fabric. However, this expectation is incorrect. The register, when read from PCI config space, returns the bitwise-OR of the buses of all attached root devices. This behavior is benign on AMD reference design boards, since the bus numbers are aligned. This results in a bitwise-OR value matching one of the buses. For example, 0x00 | 0x40 | 0xA0 | 0xE0 = 0xE0. This behavior breaks on boards where the bus numbers are not exactly aligned. For example, 0x00 | 0x07 | 0xE0 | 0x15 = 0x1F. The examples above are for AMD node 0. The first root device on other nodes will not be 0x00. The first root device for other nodes will depend on the total number of root devices, the system topology, and the specific PCI bus number assignment. For example, a system with 2 AMD nodes could have this: Node 0 : 0x00 0x07 0x0e 0x15 Node 1 : 0x1c 0x23 0x2a 0x31 The bus numbering style in the reference boards is not a requirement. The numbering found in other boards is not incorrect. Therefore, the root device caching method needs to be adjusted. Go back to the "search and count" method used before the recent rework. Search for root devices using PCI class code rather than fixed PCI IDs. This keeps the goal of the rework (remove dependency on PCI IDs) while being able to support various board designs. Merge helper functions to reduce code duplication. [ bp: Reflow comment. ] Fixes: 40a5f6ffdfc8 ("x86/amd_nb: Simplify root device search") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/all/20251028-fix-amd-root-v2-1-843e38f8be2c@amd.com commit 4a372798e12cc777918db90c06e11c80e90bd001 Author: Jihed Chaibi Date: Thu Aug 21 21:47:10 2025 +0200 dt-bindings: gpio: ti,twl4030: Correct the schema $id path The $id for a binding should match its file path. The ti,twl4030-gpio binding is located in the gpio/ subdirectory but was missing this from its $id. Correct the path to follow the standard convention. Fixes: 842dcff8e2d6 ("dt-bindings: gpio: Convert ti,twl4030-gpio to DT schema") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jihed Chaibi Fixes: 842dcff8e2d6 ("dt-bindings: gpio: Convert ti,twl4030-gpio to DT schema") Link: https://lore.kernel.org/r/20250821194710.16043-1-jihed.chaibi.dev@gmail.com Signed-off-by: Bartosz Golaszewski commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 Author: Dan Carpenter Date: Sat Nov 1 16:25:48 2025 +0300 mtd: onenand: Pass correct pointer to IRQ handler This was supposed to pass "onenand" instead of "&onenand" with the ampersand. Passing a random stack address which will be gone when the function ends makes no sense. However the good thing is that the pointer is never used, so this doesn't cause a problem at run time. Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method") Signed-off-by: Dan Carpenter Signed-off-by: Miquel Raynal commit a1d3bc606bf5c3b3ea811cc2019df6285d75b00f Author: Mikhail Kshevetskiy Date: Mon Nov 3 04:01:48 2025 +0300 mtd: spinand: fmsh: remove QE bit for FM25S01A flash According to datasheet (http://eng.fmsh.com/nvm/FM25S01A_ds_eng.pdf) there is no QE (Quad Enable) bit for FM25S01A flash, so remove it. Fixes: 5f284dc15ca86 ("mtd: spinand: add support for FudanMicro FM25S01A") Signed-off-by: Mikhail Kshevetskiy Tested-by: Tianling Shen Signed-off-by: Miquel Raynal commit eb3182ef0405ff2f6668fd3e5ff9883f60ce8801 Author: Dapeng Mi Date: Wed Oct 15 13:18:28 2025 +0800 perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ] Closes: https://lore.kernel.org/all/CAHPNGSQpXEopYreir+uDDEbtXTBvBvi8c6fYXJvceqtgTPao3Q@mail.gmail.com/ Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") Reported-by: Octavia Togami Suggested-by: Peter Zijlstra Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Octavia Togami Cc: stable@vger.kernel.org Link: https://github.com/lucko/spark/issues/530 Link: https://patch.msgid.link/20251015051828.12809-1-dapeng1.mi@linux.intel.com commit 083d7af3350e04c428256a3bd10003f63151b6b1 Author: Chunhai Guo Date: Mon Oct 27 10:52:06 2025 +0800 MAINTAINERS: erofs: add myself as reviewer In the past two years, I have focused on EROFS and contributed features including the reserved buffer pool, configurable global buffer pool, and the ongoing direct I/O support for compressed data. I would like to continue contributing to EROFS and help with code reviews. Please CC me on EROFS-related changes. Signed-off-by: Chunhai Guo Acked-by: Gao Xiang Acked-by: Chao Yu Acked-by: Hongbo Li Signed-off-by: Gao Xiang commit 1ebc180d2b9066043226299cecc42c1ea146ac8e Author: Alexander Usyskin Date: Sun Nov 2 20:08:36 2025 +0200 mei: fix error flow in probe Dismantle class device last in probe error flow to avoid accessing freed memory like: [ 87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234 __flush_work+0x340/0x390 ... [ 87.926912] Workqueue: async async_run_entry_fn [ 87.926918] RIP: e030:__flush_work+0x340/0x390 [ 87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b 04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de [ 87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246 [ 87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000 [ 87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60 [ 87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8 [ 87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000 [ 87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000 [ 87.926962] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000 [ 87.926967] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660 [ 87.926977] Call Trace: [ 87.926981] [ 87.926987] ? __call_rcu_common.constprop.0+0x11e/0x310 [ 87.926993] cancel_work_sync+0x5e/0x80 [ 87.926999] mei_cancel_work+0x19/0x40 [mei] [ 87.927051] mei_me_probe+0x273/0x2b0 [mei_me] [ 87.927060] local_pci_probe+0x45/0x90 [ 87.927066] pci_call_probe+0x5b/0x180 [ 87.927070] pci_device_probe+0x95/0x140 [ 87.927074] ? driver_sysfs_add+0x57/0xc0 [ 87.927079] really_probe+0xde/0x340 [ 87.927083] ? pm_runtime_barrier+0x54/0x90 [ 87.927087] __driver_probe_device+0x78/0x110 [ 87.927092] driver_probe_device+0x1f/0xa0 [ 87.927095] __driver_attach_async_helper+0x5e/0xe0 [ 87.927100] async_run_entry_fn+0x34/0x130 [ 87.927104] process_one_work+0x18d/0x340 [ 87.927108] worker_thread+0x256/0x3a0 [ 87.927111] ? __pfx_worker_thread+0x10/0x10 [ 87.927115] kthread+0xfc/0x240 [ 87.927120] ? __pfx_kthread+0x10/0x10 [ 87.927124] ? __pfx_kthread+0x10/0x10 [ 87.927127] ret_from_fork+0xf5/0x110 [ 87.927132] ? __pfx_kthread+0x10/0x10 [ 87.927136] ret_from_fork_asm+0x1a/0x30 [ 87.927141] Tested-by: Guenter Roeck Reported-by: Marek Marczykowski-Górecki Closes: https://lore.kernel.org/lkml/aQbYAXPADqfiXUYO@mail-itl/ Reported-by: Guenter Roeck Closes: https://lore.kernel.org/lkml/8deef7c4-ac75-4db8-91b7-02cf0e39e371@roeck-us.net/ Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Alexander Usyskin Tested-by: Marek Marczykowski-Górecki Link: https://patch.msgid.link/20251102180836.1203314-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 09b1704f5b02c18dd02b21343530463fcfc92c54 Author: Miguel Ojeda Date: Wed Oct 29 08:33:44 2025 +0100 rust: condvar: fix broken intra-doc link The future move of pin-init to `syn` uncovers the following broken intra-doc link: error: unresolved link to `crate::pin_init` --> rust/kernel/sync/condvar.rs:39:40 | 39 | /// instances is with the [`pin_init`](crate::pin_init!) and [`new_condvar`] macros. | ^^^^^^^^^^^^^^^^ no item named `pin_init` in module `kernel` | = note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::broken_intra_doc_links)]` Currently, when rendered, the link points to a literal `crate::pin_init!` URL. Thus fix it. Cc: stable@vger.kernel.org Fixes: 129e97be8e28 ("rust: pin-init: fix documentation links") Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251029073344.349341-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit ff4d2ef3874773c9c6173b0f099372bf62252aaf Author: Miguel Ojeda Date: Wed Oct 29 08:14:06 2025 +0100 rust: devres: fix private intra-doc link The future move of pin-init to `syn` uncovers the following private intra-doc link: error: public documentation for `Devres` links to private item `Self::inner` --> rust/kernel/devres.rs:106:7 | 106 | /// [`Self::inner`] is guaranteed to be initialized and is always accessed read-only. | ^^^^^^^^^^^ this item is private | = note: this link will resolve properly if you pass `--document-private-items` = note: `-D rustdoc::private-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::private_intra_doc_links)]` Currently, when rendered, the link points to "nowhere" (an inexistent anchor for a "method"). Thus fix it. Cc: stable@vger.kernel.org Fixes: f5d3ef25d238 ("rust: devres: get rid of Devres' inner Arc") Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251029071406.324511-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 Author: Linus Torvalds Date: Sun Nov 2 11:28:02 2025 -0800 Linux 6.18-rc4 commit b8126205dbe01e22b0d10c8be132bb53bf3399c1 Author: Krzysztof Czurylo Date: Thu Oct 30 21:17:20 2025 -0500 MAINTAINERS: Update irdma maintainers Adds Krzysztof Czurylo as co-maintainer for irdma driver. Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 320258783765316d2baae99c26e461ee634054fe Author: Jay Bhat Date: Thu Oct 30 21:17:25 2025 -0500 RDMA/irdma: Fix vf_id size to u16 to avoid overflow Correctly size the vf_id to u16 to avoid overflow. Signed-off-by: Jay Bhat Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251031021726.1003-6-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 691d401c7e0e5ea34ac6f8151bc0696db1b2500a Merge: bfeeb4a1bdf5d2 e7dbfe6f15b4df Author: Linus Torvalds Date: Sat Nov 1 10:50:43 2025 -0700 Merge tag 'spi-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One new device ID for an Intel SoC" * tag 'spi-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: intel: Add support for Oak Stream SPI serial flash commit bfeeb4a1bdf5d255ea885f16be80968d1f31281b Merge: 963bf1619472d9 47a0925ee4bd26 Author: Linus Torvalds Date: Sat Nov 1 10:49:12 2025 -0700 Merge tag 'regulator-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A simple fix for a missed part of an API conversion in the bd718x7 driver" * tag 'regulator-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: bd718x7: Fix voltages scaled by resistor divider commit 963bf1619472d954d04ed8851be17df633c6afd6 Merge: e3e0141d3dc55e 48cbf50531d8ec Author: Linus Torvalds Date: Sat Nov 1 10:45:39 2025 -0700 Merge tag 'regmap-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "One documentation fix and a fix for a problem with the slimbus regmap which was uncovered by some changes in one of the drivers" * tag 'regmap-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: irq: Correct documentation of wake_invert flag regmap: slimbus: fix bus_context pointer in regmap init calls commit e3e0141d3dc55eb71792dd703e3f726cc29a6430 Merge: f9bc8e0912b8f6 9b041a4b66b3b6 Author: Linus Torvalds Date: Sat Nov 1 10:20:07 2025 -0700 Merge tag 'x86-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Limit AMD microcode Entrysign sha256 signature checking to known CPU generations - Disable AMD RDSEED32 on certain Zen5 CPUs that have a microcode version before when the microcode-based fix was issued for the AMD-SB-7055 erratum - Fix FPU AMD XFD state synchronization on signal delivery - Fix (work around) a SSE4a-disassembly related build failure on X86_NATIVE_CPU=y builds - Extend the AMD Zen6 model space with a new range of models - Fix CPU model comments - Fix the CONFIG_CFI=y and CONFIG_LTO_CLANG_FULL=y build, which was unhappy due to missing kCFI type annotations of clear_page() variants * tag 'x86-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols x86/cpu: Add/fix core comments for {Panther,Nova} Lake x86/CPU/AMD: Extend Zen6 model range x86/build: Disable SSE4a x86/fpu: Ensure XFD state on signal delivery x86/CPU/AMD: Add RDSEED fix for Zen5 x86/microcode/AMD: Limit Entrysign signature checking to known generations commit f9bc8e0912b8f6b1d60608a715a1da575670e038 Merge: 74131a0f1b9efc f4c12e5cefc8ec Author: Linus Torvalds Date: Sat Nov 1 10:17:40 2025 -0700 Merge tag 'perf-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fixes from Ingo Molnar: "Miscellaneous fixes and CPU model updates: - Fix an out-of-bounds access on non-hybrid platforms in the Intel PMU DS code, reported by KASAN - Add WildcatLake PMU and uncore support: it's identical to the PantherLake version" * tag 'perf-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake perf/x86/intel: Add PMU support for WildcatLake perf/x86/intel: Fix KASAN global-out-of-bounds warning commit 74131a0f1b9efc1364871a04b704e54309861668 Merge: 9db0d7c5a5be25 c44b4b9eeb71f5 Author: Linus Torvalds Date: Sat Nov 1 10:07:35 2025 -0700 Merge tag 'objtool-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Ingo Molnar: "Fix objtool warning when faced with raw STAC/CLAC instructions" * tag 'objtool-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix skip_alt_group() for non-alternative STAC/CLAC commit 9db0d7c5a5be25e56c3eacc1f03d296b7b0b960f Merge: cb7f9fc3725a11 0db22d7ee462c4 Author: Linus Torvalds Date: Sat Nov 1 10:04:35 2025 -0700 Merge tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "Just a single bug fix (and documentation for the issue)" * tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: document another racy GC case in xfs_zoned_map_extent xfs: prevent gc from picking the same zone twice commit cb7f9fc3725a11447a4af69dfe8d648e4320acdc Merge: ba36dd5ee6fd46 43c2931a95e6b2 Author: Linus Torvalds Date: Sat Nov 1 10:00:53 2025 -0700 Merge tag 'kbuild-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Formally adopt Kconfig in MAINTAINERS - Fix install-extmod-build for more O= paths - Align end of .modinfo to fix Authenticode calculation in EDK2 - Restore dynamic check for '-fsanitize=kernel-memory' in CONFIG_HAVE_KMSAN_COMPILER to ensure backend target has support for it - Initialize locale in menuconfig and nconfig to fix UTF-8 terminals that may not support VT100 ACS by default like PuTTY * tag 'kbuild-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' kbuild: align modinfo section for Secureboot Authenticode EDK2 compat kbuild: install-extmod-build: Fix when given dir outside the build dir MAINTAINERS: Update Kconfig section commit ccaba800e78f2ac1e3a407b623653149bf9c0763 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:16:47 2025 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: e19c06219985f2be ("x86/cpufeatures: Add support for Assignable Bandwidth Monitoring Counters (ABMC)") 7b59c73fd611eae8 ("x86/cpufeatures: Add SNP Secure TSC") 3c7cb84145336721 ("x86/cpufeatures: Add a CPU feature bit for MSR immediate form instructions") 2f8f173413f1cbf5 ("x86/vmscape: Add conditional IBPB mitigation") a508cec6e5215a3f ("x86/vmscape: Enumerate VMSCAPE bug") This causes these perf files to be rebuilt and brings some X86_FEATURE that may be used by: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Please see tools/include/uapi/README for further details. Cc: Babu Moger Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Nikunj A Dadhania Cc: Pawan Gupta Cc: Sean Christopherson Cc: Xin Li Signed-off-by: Arnaldo Carvalho de Melo commit e0acec3369ca7071d14196c33e7bef35f61f9cde Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:04:20 2025 -0300 tools headers x86: Sync table due to introducion of uprobe syscall To pick the changes in this cset: 56101b69c9190667 ("uprobes/x86: Add uprobe syscall to speed up uprobe") That add support for this new 'uprobe' syscall in tools such as 'perf trace'. Now it is possible to do a system wide 'perf trace' to look if this new syscall is being used: root@number:~# perf trace -v -e uprobe event qualifier tracepoint filter: (common_pid != 33989) && (id == 336) ^C root@number# $ grep -w uprobe tools/perf/arch/x86/entry/syscalls/syscall_64.tbl 336 common uprobe sys_uprobe $ This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl Please see tools/include/uapi/README for further details. Cc: Jiri Olsa Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 5466858a70827d6ceaf4a9d292a317bf420593d7 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:01:13 2025 -0300 tools headers: Sync uapi/linux/fcntl.h with the kernel sources To pick up the changes in this cset: e83f0b5d10dcf628 ("nsfs: support exhaustive file handles") That doesn't introduce anything of interest for tools/, just addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Please see tools/include/uapi/README for further details. Cc: Christian Brauner Signed-off-by: Arnaldo Carvalho de Melo commit 5be93389f3e5ce552b21f84fb28926f90a0dcd53 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 12:53:56 2025 -0300 tools headers: Sync uapi/linux/prctl.h with the kernel source To pick up the changes in these csets: 8cdc4d27019356b0 ("mm/huge_memory: respect MADV_COLLAPSE with PR_THP_DISABLE_EXCEPT_ADVISED") 9dc21bbd62edeae6 ("prctl: extend PR_SET_THP_DISABLE to optionally exclude VM_HUGEPAGE") That don't introduce anything of interest for the tools/, just addressing these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Please see tools/include/uapi/README for further details. Cc: Andrew Morton Cc: David Hildenbrand Signed-off-by: Arnaldo Carvalho de Melo commit 76977baa83a747f7b405d61f66775e3f0316f4b5 Author: Arnaldo Carvalho de Melo Date: Thu Oct 30 17:04:47 2025 -0300 tools headers uapi: Update fs.h with the kernel sources To pick up changes from: db2ab24a341ce893 ("Add RWF_NOSIGNAL flag for pwritev2") These are used to beautify fs syscall arguments, albeit the changes in this update are not affecting those beautifiers. This addresses these tools/ build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Adrian Hunter Cc: Christian Brauner Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Lauri Vasama Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 3f673559795b2f556b8a9272c2724b79eee7a976 Author: Arnaldo Carvalho de Melo Date: Thu Oct 30 09:37:57 2025 -0300 tools arch x86: Sync msr-index.h to pick AMD64_{PERF_CNTR_GLOBAL_STATUS_SET,SAVIC_CONTROL}, IA32_L3_QOS_{ABMC,EXT}_CFG To pick up the changes in: cdfed9370b96aaba ("KVM: x86/pmu: Move PMU_CAP_{FW_WRITES,LBR_FMT} into msr-index.h header") bc6397cf0bc4f2b7 ("x86/cpu/topology: Define AMD64_CPUID_EXT_FEAT MSR") 84ecefb766748916 ("x86/resctrl: Add data structures and definitions for ABMC assignment") faebbc58cde9d8f6 ("x86/resctrl: Add support to enable/disable AMD ABMC feature") c4074ab87f3483de ("x86/apic: Enable Secure AVIC in the control MSR") 869e36b9660dd72a ("x86/apic: Allow NMI to be injected from hypervisor for Secure AVIC") 30c2b98aa84c76f2 ("x86/apic: Add new driver for Secure AVIC") 0c5caea762de31a8 ("perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag") 68e61f6fd65610e7 ("KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2") a3c4f3396b82849a ("x86/msr-index: Add AMD workload classification MSRs") 65f55a30176662ee ("x86/CPU/AMD: Add CPUID faulting support") 17ec2f965344ee3f ("KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported") Addressing this tools/perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2025-10-30 09:34:49.283533597 -0300 +++ after 2025-10-30 09:35:00.971426811 -0300 @@ -272,6 +272,9 @@ [0xc0000300 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS", [0xc0000301 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_CTL", [0xc0000302 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_CLR", + [0xc0000303 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_SET", + [0xc00003fd - x86_64_specific_MSRs_offset] = "IA32_L3_QOS_ABMC_CFG", + [0xc00003ff - x86_64_specific_MSRs_offset] = "IA32_L3_QOS_EXT_CFG", [0xc0000400 - x86_64_specific_MSRs_offset] = "IA32_EVT_CFG_BASE", [0xc0000500 - x86_64_specific_MSRs_offset] = "AMD_WORKLOAD_CLASS_CONFIG", [0xc0000501 - x86_64_specific_MSRs_offset] = "AMD_WORKLOAD_CLASS_ID", @@ -319,6 +322,7 @@ [0xc0010133 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_RMP_END", [0xc0010134 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_GUEST_TSC_FREQ", [0xc0010136 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_RMP_CFG", + [0xc0010138 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_SAVIC_CONTROL", [0xc0010140 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_OSVW_ID_LENGTH", [0xc0010141 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_OSVW_STATUS", [0xc0010200 - x86_AMD_V_KVM_MSRs_offset] = "F15H_PERF_CTL", $ Now one can trace systemwide asking to see backtraces to where that MSR is being read/written: root@x1:~# perf trace -e msr:*_msr/max-stack=32/ --filter="msr==IA32_L3_QOS_ABMC_CFG" ^Croot@x1:~# If we use -v (verbose mode) we can see what it does behind the scenes: root@x1:~# perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_L3_QOS_ABMC_CFG" 0xc00003fd New filter for msr:write_msr: (msr==0xc00003fd) && (common_pid != 449842 && common_pid != 433756) 0xc00003fd New filter for msr:read_msr: (msr==0xc00003fd) && (common_pid != 449842 && common_pid != 433756) mmap size 528384B ^Croot@x1:~# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Please see tools/include/uapi/README for further details. Cc: Adrian Hunter Cc: Babu Moger Cc: Dapeng Mi Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: K Prateek Nayak Cc: Namhyung Kim Cc: Neeraj Upadhyay Cc: Perry Yuan Cc: Peter Zijlstra Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit afcfb6c8474d9e750880aaa77952cc588f859613 Author: Jason-JH Lin Date: Fri Aug 29 17:15:59 2025 +0800 drm/mediatek: Add pm_runtime support for GCE power control Call pm_runtime_resume_and_get() before accessing GCE hardware in mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the cmdq callback to release the PM reference and start autosuspend for GCE. This ensures correct power management for the GCE device. Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") Signed-off-by: Jason-JH Lin Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit 9882a40640036d5bbc590426a78981526d4f2345 Author: Ariel D'Alessandro Date: Fri Oct 24 17:27:56 2025 -0300 drm/mediatek: Disable AFBC support on Mediatek DRM driver Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") added AFBC support to Mediatek DRM and enabled the 32x8/split/sparse modifier. However, this is currently broken on Mediatek MT8188 (Genio 700 EVK platform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by default since Mesa v25.0. Kernel trace reports vblank timeouts constantly, and the render is garbled: ``` [CRTC:62:crtc-0] vblank wait timed out WARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c [...] Hardware name: MediaTek Genio-700 EVK (DT) Workqueue: events_unbound commit_work pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c lr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c sp : ffff80008337bca0 x29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000 x26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000 x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80 x20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000 x14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b x11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70 x8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70 x5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480 Call trace: drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P) drm_atomic_helper_commit_tail_rpm+0x64/0x80 commit_tail+0xa4/0x1a4 commit_work+0x14/0x20 process_one_work+0x150/0x290 worker_thread+0x2d0/0x3ec kthread+0x12c/0x210 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ``` Until this gets fixed upstream, disable AFBC support on this platform, as it's currently broken with upstream Mesa. Fixes: c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") Cc: stable@vger.kernel.org Signed-off-by: Ariel D'Alessandro Reviewed-by: Daniel Stone Reviewed-by: CK Hu Reviewed-by: Macpaul Lin Link: https://patchwork.kernel.org/project/dri-devel/patch/20251024202756.811425-1-ariel.dalessandro@collabora.com/ Signed-off-by: Chun-Kuang Hu commit c44b4b9eeb71f5b0b617abf6fd66d1ef0aab6200 Author: Josh Poimboeuf Date: Wed Oct 29 12:54:08 2025 -0700 objtool: Fix skip_alt_group() for non-alternative STAC/CLAC If an insn->alt points to a STAC/CLAC instruction, skip_alt_group() assumes it's part of an alternative ("alt group") as opposed to some other kind of "alt" such as an exception fixup. While that assumption may hold true in the current code base, Linus has an out-of-tree patch which breaks that assumption by replacing the STAC/CLAC alternatives with raw STAC/CLAC instructions. Make skip_alt_group() more robust by making sure it's actually an alt group before continuing. Reported-by: Linus Torvalds Fixes: 2d12c6fb7875 ("objtool: Remove ANNOTATE_IGNORE_ALTERNATIVE from CLAC/STAC") Closes: https://lore.kernel.org/CAHk-=wi6goUT36sR8GE47_P-aVrd5g38=VTRHpktWARbyE-0ow@mail.gmail.com Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Tested-by: Linus Torvalds Link: https://patch.msgid.link/3d22415f7b8e06a64e0873b21f48389290eeaa49.1761767616.git.jpoimboe@kernel.org commit 43c2931a95e6b295bfe9e3b90dbe0f7596933e91 Author: Jakub Horký Date: Tue Oct 14 16:44:06 2025 +0200 kconfig/nconf: Initialize the default locale at startup Fix bug where make nconfig doesn't initialize the default locale, which causes ncurses menu borders to be displayed incorrectly (lqqqqk) in UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY. Signed-off-by: Jakub Horký Link: https://patch.msgid.link/20251014144405.3975275-2-jakub.git@horky.net [nathan: Alphabetize locale.h include] Signed-off-by: Nathan Chancellor commit 3927c4a1084c48ef97f11281a0a43ecb2cb4d6f1 Author: Jakub Horký Date: Tue Oct 14 17:49:32 2025 +0200 kconfig/mconf: Initialize the default locale at startup Fix bug where make menuconfig doesn't initialize the default locale, which causes ncurses menu borders to be displayed incorrectly (lqqqqk) in UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY. Signed-off-by: Jakub Horký Link: https://patch.msgid.link/20251014154933.3990990-1-jakub.git@horky.net [nathan: Alphabetize locale.h include] Signed-off-by: Nathan Chancellor commit ba36dd5ee6fd4643ebbf6ee6eefcecf0b07e35c7 Merge: ec0b62ccc986c0 be708ed300e1eb Author: Linus Torvalds Date: Fri Oct 31 18:22:26 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Mark migrate_disable/enable() as always_inline to avoid issues with partial inlining (Yonghong Song) - Fix powerpc stack register definition in libbpf bpf_tracing.h (Andrii Nakryiko) - Reject negative head_room in __bpf_skb_change_head (Daniel Borkmann) - Conditionally include dynptr copy kfuncs (Malin Jonsson) - Sync pending IRQ work before freeing BPF ring buffer (Noorain Eqbal) - Do not audit capability check in x86 do_jit() (Ondrej Mosnacek) - Fix arm64 JIT of BPF_ST insn when it writes into arena memory (Puranjay Mohan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf/arm64: Fix BPF_ST into arena memory bpf: Make migrate_disable always inline to avoid partial inlining bpf: Reject negative head_room in __bpf_skb_change_head bpf: Conditionally include dynptr copy kfuncs libbpf: Fix powerpc's stack register definition in bpf_tracing.h bpf: Do not audit capability check in do_jit() bpf: Sync pending IRQ work before freeing ring buffer commit d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b Author: Gustavo Luiz Duarte Date: Wed Oct 29 13:50:24 2025 -0700 netconsole: Acquire su_mutex before navigating configs hierarchy There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt->userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes. Quoting from Documentation/filesystems/configfs.rst: > A subsystem can navigate the cg_children list and the ci_parent pointer > to see the tree created by the subsystem. This can race with configfs' > management of the hierarchy, so configfs uses the subsystem mutex to > protect modifications. Whenever a subsystem wants to navigate the > hierarchy, it must do so under the protection of the subsystem > mutex. Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes' .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ). Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata_*_enabled_store() functions which call count_extradata_entries() to iterate over cg_children The su_mutex must be acquired before dynamic_netconsole_mutex to avoid potential lock ordering issues, as configfs operations may already hold su_mutex when calling into our code. Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target") Signed-off-by: Gustavo Luiz Duarte Link: https://patch.msgid.link/20251029-netconsole-fix-warn-v1-1-0d0dd4622f48@gmail.com Signed-off-by: Jakub Kicinski commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee Author: Hangbin Liu Date: Thu Oct 30 07:35:39 2025 +0000 net: vlan: sync VLAN features with lower device After registering a VLAN device and setting its feature flags, we need to synchronize the VLAN features with the lower device. For example, the VLAN device does not have the NETIF_F_LRO flag, it should be synchronized with the lower device based on the NETIF_F_UPPER_DISABLES definition. As the dev->vlan_features has changed, we need to call netdev_update_features(). The caller must run after netdev_upper_dev_link() links the lower devices, so this patch adds the netdev_update_features() call in register_vlan_dev(). Fixes: fd867d51f889 ("net/core: generic support for disabling netdev features down stack") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251030073539.133779-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit d01f8136d46b925798abcf86b35a4021e4cfb8bb Author: Wang Liang Date: Thu Oct 30 12:03:40 2025 +0800 selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh The script "ethtool-common.sh" is not installed in INSTALL_PATH, and triggers some errors when I try to run the test 'drivers/net/netdevsim/ethtool-coalesce.sh': TAP version 13 1..1 # timeout set to 600 # selftests: drivers/net/netdevsim: ethtool-coalesce.sh # ./ethtool-coalesce.sh: line 4: ethtool-common.sh: No such file or directory # ./ethtool-coalesce.sh: line 25: make_netdev: command not found # ethtool: bad command line argument(s) # ./ethtool-coalesce.sh: line 124: check: command not found # ./ethtool-coalesce.sh: line 126: [: -eq: unary operator expected # FAILED /0 checks not ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh # exit=1 Install this file to avoid this error. After this patch: TAP version 13 1..1 # timeout set to 600 # selftests: drivers/net/netdevsim: ethtool-coalesce.sh # PASSED all 22 checks ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh Fixes: fbb8531e58bd ("selftests: extract common functions in ethtool-common.sh") Signed-off-by: Wang Liang Link: https://patch.msgid.link/20251030040340.3258110-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 3f978e3f1570155a1327ffa25f60968bc7b9398f Author: Abdun Nihaal Date: Thu Oct 30 09:55:22 2025 +0530 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when setup_instance() fails with an error code. Fix that by freeing the urb before freeing the hw structure. Also change the error paths to use the goto ladder style. Compile tested only. Issue found using a prototype static analysis tool. Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit f8e8486702abb05b8c734093aab1606af0eac068 Author: Anubhav Singh Date: Thu Oct 30 06:04:36 2025 +0000 selftests/net: use destination options instead of hop-by-hop The GRO self-test, gro.c, currently constructs IPv6 packets containing a Hop-by-Hop Options header (IPPROTO_HOPOPTS) to ensure the GRO path correctly handles IPv6 extension headers. However, network elements may be configured to drop packets with the Hop-by-Hop Options header (HBH). This causes the self-test to fail in environments where such network elements are present. To improve the robustness and reliability of this test in diverse network environments, switch from using IPPROTO_HOPOPTS to IPPROTO_DSTOPTS (Destination Options). The Destination Options header is less likely to be dropped by intermediate routers and still serves the core purpose of the test: validating GRO's handling of an IPv6 extension header. This change ensures the test can execute successfully without being incorrectly failed by network policies outside the kernel's control. Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test") Reviewed-by: Willem de Bruijn Signed-off-by: Anubhav Singh Link: https://patch.msgid.link/20251030060436.1556664-1-anubhavsinggh@google.com Signed-off-by: Jakub Kicinski commit 02d064de05b1fcca769391fa82d205bed8bb9bf0 Author: Anubhav Singh Date: Thu Oct 30 06:28:18 2025 +0000 selftests/net: fix out-of-order delivery of FIN in gro:tcp test Due to the gro_sender sending data packets and FIN packets in very quick succession, these are received almost simultaneously by the gro_receiver. FIN packets are sometimes processed before the data packets leading to intermittent (~1/100) test failures. This change adds a delay of 100ms before sending FIN packets in gro:tcp test to avoid the out-of-order delivery. The same mitigation already exists for the gro:ip test. Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test") Reviewed-by: Willem de Bruijn Signed-off-by: Anubhav Singh Link: https://patch.msgid.link/20251030062818.1562228-1-anubhavsinggh@google.com Signed-off-by: Jakub Kicinski commit 3d18a84eddde169d6dbf3c72cc5358b988c347d0 Author: Jonas Gorski Date: Mon Oct 27 20:46:21 2025 +0100 net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx The internal switch on BCM63XX SoCs will unconditionally add 802.1Q VLAN tags on egress to CPU when 802.1Q mode is enabled. We do this unconditionally since commit ed409f3bbaa5 ("net: dsa: b53: Configure VLANs while not filtering"). This is fine for VLAN aware bridges, but for standalone ports and vlan unaware bridges this means all packets are tagged with the default VID, which is 0. While the kernel will treat that like untagged, this can break userspace applications processing raw packets, expecting untagged traffic, like STP daemons. This also breaks several bridge tests, where the tcpdump output then does not match the expected output anymore. Since 0 isn't a valid VID, just strip out the VLAN tag if we encounter it, unless the priority field is set, since that would be a valid tag again. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Signed-off-by: Jonas Gorski Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251027194621.133301-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 5a89b27afd3d010680f9355f7ff5b048cfe89333 Author: Carolina Jubran Date: Wed Oct 29 10:38:13 2025 +0200 ptp: Allow exposing cycles only for clocks with free-running counter The PTP core falls back to gettimex64 and getcrosststamp when getcycles64 or getcyclesx64 are not implemented. This causes the CYCLES ioctls to retrieve PHC real time instead of free-running cycles. Reject PTP_SYS_OFFSET_{PRECISE,EXTENDED}_CYCLES for clocks without free-running counter support since the result would represent PHC real time and system time rather than cycles and system time. Fixes: faf23f54d366 ("ptp: Add ioctl commands to expose raw cycle counter values") Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Pavan Chebbi Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251029083813.2276997-1-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 01534d73c58b3d03ae487836958fa8cb25fb77bb Merge: 284987ab6c974c 329d050bbe63c2 Author: Jakub Kicinski Date: Fri Oct 31 15:55:34 2025 -0700 Merge branch 'gve-fix-null-dereferencing-with-ptp-clock' Tim Hostetler says: ==================== gve: Fix NULL dereferencing with PTP clock This patch series fixes NULL dereferences that are possible with gve's PTP clock due to not stubbing certain ptp_clock_info callbacks. ==================== Link: https://patch.msgid.link/20251029184555.3852952-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit 329d050bbe63c2999f657cf2d3855be11a473745 Author: Tim Hostetler Date: Wed Oct 29 11:45:40 2025 -0700 gve: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. Fixes: acd16380523b ("gve: Add initial PTP device support") Reported-by: syzbot+a546141ca6d53b90aba3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a546141ca6d53b90aba3 Signed-off-by: Tim Hostetler Reviewed-by: Kuniyuki Iwashima Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251029184555.3852952-3-joshwash@google.com Signed-off-by: Jakub Kicinski commit 6ab753b5d8e521616cd9bd10b09891cbeb7e0235 Author: Tim Hostetler Date: Wed Oct 29 11:45:39 2025 -0700 gve: Implement gettimex64 with -EOPNOTSUPP gve implemented a ptp_clock for sole use of do_aux_work at this time. ptp_clock_gettime() and ptp_sys_offset() assume every ptp_clock has implemented either gettimex64 or gettime64. Stub gettimex64 and return -EOPNOTSUPP to prevent NULL dereferencing. Fixes: acd16380523b ("gve: Add initial PTP device support") Reported-by: syzbot+c8c0e7ccabd456541612@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8c0e7ccabd456541612 Signed-off-by: Tim Hostetler Reviewed-by: Harshitha Ramamurthy Reviewed-by: Kuniyuki Iwashima Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251029184555.3852952-2-joshwash@google.com Signed-off-by: Jakub Kicinski commit 03c7e964a02e388ee168c804add7404eda23908c Author: Diederik de Haas Date: Mon Oct 27 16:54:28 2025 +0100 arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 Page 13 of the PineTab2 v2 schematic dd 20230417 shows VCCIO4's power source is VCCIO_WL. Page 19 shows that VCCIO_WL is connected to VCCA1V8_PMU, so fix the PineTab2 dtsi to reflect that. Fixes: 1b7e19448f8f ("arm64: dts: rockchip: Add devicetree for Pine64 PineTab2") Cc: stable@vger.kernel.org Reviewed-by: Dragan Simic Signed-off-by: Diederik de Haas Link: https://patch.msgid.link/20251027155724.138096-1-diederik@cknow-tech.com Signed-off-by: Heiko Stuebner commit 08d70143e3033d267507deb98a5fd187df3e6640 Author: Quentin Schulz Date: Wed Oct 29 14:50:59 2025 +0100 arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 In commit 296602b8e5f7 ("arm64: dts: rockchip: Move RK3399 OPPs to dtsi files for SoC variants"), everything shared between variants of RK3399 was put into rk3399-base.dtsi and the rest in variant-specific DTSI, such as rk3399-t, rk3399-op1, rk3399, etc. Therefore, the variant-specific DTSI should include rk3399-base.dtsi and not another variant's DTSI. rk3399-op1 wrongly includes rk3399 (a variant) DTSI instead of rk3399-base DTSI, let's fix this oversight by including the intended DTSI. Fortunately, this had no impact on the resulting DTB since all nodes were named the same and all node properties were overridden in rk3399-op1.dtsi. This was checked by doing a checksum of rk3399-op1 DTBs before and after this commit. No intended change in behavior. Fixes: 296602b8e5f7 ("arm64: dts: rockchip: Move RK3399 OPPs to dtsi files for SoC variants") Cc: stable@vger.kernel.org Signed-off-by: Quentin Schulz Reviewed-by: Dragan Simic Link: https://patch.msgid.link/20251029-rk3399-op1-include-v1-1-2472ee60e7f8@cherry.de Signed-off-by: Heiko Stuebner commit 9b041a4b66b3b62c30251e700b5688324cf66625 Author: Nathan Chancellor Date: Mon Oct 13 14:27:36 2025 -0700 x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols When building with CONFIG_CFI=y and CONFIG_LTO_CLANG_FULL=y, there is a series of errors from the various versions of clear_page() not having __kcfi_typeid_ symbols. $ cat kernel/configs/repro.config CONFIG_CFI=y # CONFIG_LTO_NONE is not set CONFIG_LTO_CLANG_FULL=y $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 clean defconfig repro.config bzImage ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_rep >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_rep) ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_orig >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_orig) ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_erms >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_erms) With full LTO, it is possible for LLVM to realize that these functions never have their address taken (as they are only used within an alternative, which will make them a direct call) across the whole kernel and either drop or skip generating their kCFI type identification symbols. clear_page_{rep,orig,erms}() are defined in clear_page_64.S with SYM_TYPED_FUNC_START as a result of 2981557cb040 ("x86,kcfi: Fix EXPORT_SYMBOL vs kCFI"), as exported functions are free to be called indirectly thus need kCFI type identifiers. Use KCFI_REFERENCE with these clear_page() functions to force LLVM to see these functions as address-taken and generate then keep the kCFI type identifiers. Fixes: 2981557cb040 ("x86,kcfi: Fix EXPORT_SYMBOL vs kCFI") Closes: https://github.com/ClangBuiltLinux/linux/issues/2128 Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sami Tolvanen Link: https://patch.msgid.link/20251013-x86-fix-clear_page-cfi-full-lto-errors-v1-1-d69534c0be61@kernel.org commit ec0b62ccc986c06552c57f54116171cfd186ef92 Merge: f414f9fd687971 41dacb39fe79cd Author: Linus Torvalds Date: Fri Oct 31 14:47:02 2025 -0700 Merge tag 'drm-fixes-2025-10-31' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "Looks like stochastics conspired to make this one a bit bigger, but nothing scary at all. Also first examples of the new Link: tags, yay! Next week Dave should be back. Drivers: - mediatek: uaf in unbind, fixes -rc2 boot regression - radeon: devm conversion fixes - amdgpu: VPE idle handler, re-enable DM idle optimization, DCN3, SMU, vblank, HDP eDP, powerplay fixes for fiji/iceland - msm: bunch of gem error path fixes, gmu fw parsing fix, dpu fixes - intel: fix dmc/dc6 asserts on ADL-S - xe: fix xe_validation_guard(), wake device handling around gt reset - ast: fix display output on AST2300 - etnaviv: fix gpu flush - imx: fix parallel bridge handling - nouveau: scheduler locking fix - panel: fixes for kingdisplay-kd097d04 and sitronix-st7789v Core Changes: - CI: disable broken sanity job - sysfb: fix NULL pointer access - sched: fix SIGKILL handling, locking for race condition - dma_fence: better timeline name for signalled fences" * tag 'drm-fixes-2025-10-31' of https://gitlab.freedesktop.org/drm/kernel: (44 commits) drm/ast: Clear preserved bits from register output value drm/imx: parallel-display: add the bridge before attaching it drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API drm/panel: kingdisplay-kd097d04: Disable EoTp drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 drm/xe: Do not wake device during a GT reset drm/xe: Fix uninitialized return value from xe_validation_guard() drm/msm/dpu: Fix adjusted mode clock check for 3d merge drm/msm/dpu: Disable broken YUV on QSEED2 hardware drm/msm/dpu: Require linear modifier for writeback framebuffers drm/msm/dpu: Fix pixel extension sub-sampling drm/msm/dpu: Disable scaling for unsupported scaler types drm/msm/dpu: Propagate error from dpu_assign_plane_resources drm/msm/dpu: Fix allocation of RGB SSPPs without scaling drm/msm: dsi: fix PLL init in bonded mode drm/i915/dmc: Clear HRR EVT_CTL/HTP to zero on ADL-S drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc drm/amd/display: Add HDR workaround for a specific eDP drm/amdgpu: fix SPDX header on cyan_skillfish_reg_init.c drm/amdgpu: fix SPDX header on irqsrcs_vcn_5_0.h ... commit f414f9fd68797182f8de4e1cd9855b6b28abde99 Merge: 39bcf0f7d415fe 437aa64c8e32b7 Author: Linus Torvalds Date: Fri Oct 31 14:24:32 2025 -0700 Merge tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Restore custom qcom ASPM enablement code so L1 PM Substates are enabled as they were in v6.17 even though the PCI core now enables just L0s and L1 by default (Bjorn Helgaas) - Size prefetchable bridge windows only when they actually exist, to avoid a WARN_ON() regression (Ilpo Järvinen) * tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Do not size non-existing prefetchable window Revert "PCI: qcom: Remove custom ASPM enablement code" commit 39bcf0f7d415fee440d2eba877b9b618cbd6d824 Merge: a5beb58e53092f de8d1f2fd5a510 Author: Linus Torvalds Date: Fri Oct 31 14:20:09 2025 -0700 Merge tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Fix overflows in vfio type1 backend for mappings at the end of the 64-bit address space, resulting in leaked pinned memory. New selftest support included to avoid such issues in the future (Alex Mastro) * tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio: vfio: selftests: add end of address space DMA map/unmap tests vfio: selftests: update DMA map/unmap helpers to support more test kinds vfio/type1: handle DMA map/unmap up to the addressable limit vfio/type1: move iova increment to unmap_unpin_*() caller vfio/type1: sanitize for overflow using check_*_overflow() commit 437aa64c8e32b724fc6d60100ef0eb313d32c88f Author: Ilpo Järvinen Date: Mon Oct 27 15:24:23 2025 +0200 PCI: Do not size non-existing prefetchable window pbus_size_mem() should only be called for bridge windows that exist but __pci_bus_size_bridges() may point 'pref' to a resource that does not exist (has zero flags) in case of non-root buses. When prefetchable bridge window does not exist, the same non-prefetchable bridge window is sized more than once which may result in duplicating entries into the realloc_head list. Duplicated entries are shown in this log and trigger a WARN_ON() because realloc_head had residual entries after the resource assignment algorithm: pci 0000:00:03.0: [11ab:6820] type 01 class 0x060400 PCIe Root Port pci 0000:00:03.0: PCI bridge to [bus 00] pci 0000:00:03.0: bridge window [io 0x0000-0x0fff] pci 0000:00:03.0: bridge window [mem 0x00000000-0x000fffff] pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000 pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000 pci 0000:00:03.0: bridge window [mem 0xe0000000-0xe03fffff]: assigned pci 0000:00:03.0: PCI bridge to [bus 02] pci 0000:00:03.0: bridge window [mem 0xe0000000-0xe03fffff] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at drivers/pci/setup-bus.c:2373 pci_assign_unassigned_root_bus_resources+0x1bc/0x234 Check resource flags of 'pref' and only size the prefetchable window if the resource has the IORESOURCE_PREFETCH flag. Fixes: ae88d0b9c57f ("PCI: Use pbus_select_window_for_type() during mem window sizing") Reported-by: Klaus Kudielka Closes: https://lore.kernel.org/r/51e8cf1c62b8318882257d6b5a9de7fdaaecc343.camel@gmail.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Klaus Kudielka Link: https://patch.msgid.link/20251027132423.8841-1-ilpo.jarvinen@linux.intel.com commit 057f1652feb9be78587dae53866371e7fcce81e9 Author: Bjorn Helgaas Date: Fri Oct 24 14:41:40 2025 -0500 Revert "PCI: qcom: Remove custom ASPM enablement code" This reverts commit a729c16646198872e345bf6c48dbe540ad8a9753. Prior to a729c1664619 ("PCI: qcom: Remove custom ASPM enablement code"), the qcom controller driver enabled ASPM, including L0s, L1, and L1 PM Substates, for all devices powered on at the time the controller driver enumerates them. ASPM was *not* enabled for devices powered on later by pwrctrl (unless the kernel was built with PCIEASPM_POWERSAVE or PCIEASPM_POWER_SUPERSAVE, or the user enabled ASPM via module parameter or sysfs). After f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms"), the PCI core enabled all ASPM states for all devices whether powered on initially or by pwrctrl, so a729c1664619 was unnecessary and reverted. But f3ac2ff14834 was too aggressive and broke platforms that didn't support CLKREQ# or required device-specific configuration for L1 Substates, so df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") enabled only L0s and L1. On Qualcomm platforms, this left L1 Substates disabled, which was a regression. Revert a729c1664619 so L1 Substates will be enabled on devices that are initially powered on. Devices powered on by pwrctrl will be addressed later. Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Johan Hovold Closes: https://lore.kernel.org/lkml/aPuXZlaawFmmsLmX@hovoldconsulting.com/ Signed-off-by: Bjorn Helgaas Tested-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251024210514.1365996-1-helgaas@kernel.org commit a5beb58e53092f77b89181bec9d30c8bdced3103 Merge: b4f7f01ea14fe3 0d92a3eaa6726e Author: Linus Torvalds Date: Fri Oct 31 12:57:19 2025 -0700 Merge tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix blk-crypto reporting EIO when EINVAL is the correct error code - Two bug fixes for the block zone support - NVME pull request via Keith: - Target side authentication fixup - Peer-to-peer metadata fixup - null_blk DMA alignment fix * tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: null_blk: set dma alignment to logical block size blk-crypto: use BLK_STS_INVAL for alignment errors block: make REQ_OP_ZONE_OPEN a write operation block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL nvme-pci: use blk_map_iter for p2p metadata nvmet-auth: update sc_c in host response commit b4f7f01ea14fe3654a0f7b7152ded7c15acd5e5f Merge: b909d77359b828 64e2f60f355e55 Author: Linus Torvalds Date: Fri Oct 31 12:50:35 2025 -0700 Merge tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Use correct locking in zPCI event code to avoid deadlock - Get rid of irqs_registered flag in zpci_dev structure and restore IRQ unconditionally for zPCI devices. This fixes sit uations where the flag was not correctly updated - Fix potential memory leak kernel page table dumper code - Disable (revert) ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP for s390 again. The optimized hugetlb vmemmap code modifies kernel page tables in a way which does not work on s390 and leads to reproducible kernel crashes due to stale TLB entries. This needs to be addressed with some larger changes. For now simply disable the feature - Update defconfigs * tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP s390/mm: Fix memory leak in add_marker() when kvrealloc() fails s390/pci: Restore IRQ unconditionally for the zPCI device s390: Update defconfigs s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump commit 284987ab6c974c338e54852abcfaf2ed69b852d3 Merge: b7904323e76b07 8d59fba49362c6 Author: Jakub Kicinski Date: Fri Oct 31 12:33:07 2025 -0700 Merge tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - MGMT: Fix OOB access in parse_adv_monitor_pattern() - hci_event: validate skb length for unknown CC opcode * tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() Bluetooth: hci_event: validate skb length for unknown CC opcode ==================== Link: https://patch.msgid.link/20251031170959.590470-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit b7904323e76b074c59f113ca423e76d90da26875 Merge: e5763491237ffe 70e8335485966d Author: Jakub Kicinski Date: Fri Oct 31 12:30:32 2025 -0700 Merge tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of new fixes: - ath10k: revert a patch that had caused issues on some devices - cfg80211/mac80211: use hrtimers for some things where the precise timing matters - zd1211rw: fix a long-standing potential leak * tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work wifi: mac80211: use wiphy_hrtimer_work for ttlm_work wifi: cfg80211: add an hrtimer based delayed work item Revert "wifi: ath10k: avoid unnecessary wait for service ready message" ==================== Link: https://patch.msgid.link/20251030104919.12871-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit be708ed300e1ebd32978b4092b909f0d9be0958f Author: Puranjay Mohan Date: Thu Oct 30 12:17:14 2025 +0000 bpf/arm64: Fix BPF_ST into arena memory The arm64 JIT supports BPF_ST with BPF_PROBE_MEM32 (arena) by using the tmp2 register to hold the dst + arena_vm_base value and using tmp2 as the new dst register. But this is broken because in case is_lsi_offset() returns false the tmp2 will be clobbered by emit_a64_mov_i(1, tmp2, off, ctx); and hence the emitted store instruction will be of the form: strb w10, [x11, x11] Fix this by using the third temporary register to hold the dst + arena_vm_base. Fixes: 339af577ec05 ("bpf: Add arm64 JIT support for PROBE_MEM32 pseudo instructions.") Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20251030121715.55214-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 14a7f2392f42bbb71c1a5ea68930006221fcd80a Author: Yonghong Song Date: Wed Oct 29 11:36:46 2025 -0700 bpf: Make migrate_disable always inline to avoid partial inlining The build fails with llvm 21/22: $ make LLVM=1 -j ... LD vmlinux.o GEN .vmlinux.objs ... BTF .tmp_vmlinux1.btf.o ... AS .tmp_vmlinux2.kallsyms.o LD vmlinux.unstripped BTFIDS vmlinux.unstripped WARN: resolve_btfids: unresolved symbol migrate_enable WARN: resolve_btfids: unresolved symbol migrate_disable make[2]: *** [vmlinux.unstripped] Error 255 make[2]: *** Deleting file 'vmlinux.unstripped' make[1]: *** [Makefile:1242: vmlinux] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Two functions with identical names but different addresses are considered ambiguous and removed by "pahole" from vmlinux BTF. Later resolve_btfids warns since it cannot find them. Commit 378b7708194f ("sched: Make migrate_{en,dis}able() inline") made them inlineable in most places, but in vmlinux built with llvm 21 and 22 there are four symbols for migrate_{enable,disable}: three static functions and one global function. Fix the issue by marking migrate_{enable,disable} as always inline. The alternative is to mark them as notrace/nokprobe which is more drastic. Only bpf programs are prevented from attaching to these functions. The rest of the tracing shouldn't be affected. [note: Peter ok-ed the patch, Alexei rewrote commit log] Fixes: 378b7708194f ("sched: Make migrate_{en,dis}able() inline") Signed-off-by: Yonghong Song Acked-by: Menglong Dong Link: https://lore.kernel.org/r/20251029183646.3811774-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 41dacb39fe79cd2fce42d31fa6658d926489a548 Merge: b0953985861810 b3fbda1a630a94 Author: Simona Vetter Date: Fri Oct 31 19:11:16 2025 +0100 Merge tag 'drm-xe-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix xe_validation_guard() not guarding (Thomas Hellström) - Do not wake device during a GT reset (Matthew Brost) Signed-off-by: Simona Vetter From: Lucas De Marchi Link: https://patch.msgid.link/o2b3lucyitafbbcd5bewpfqnslavtnnpc6ck4qatnou2wwukix@rz6seyfw75uy commit b095398586181010d3cfad4ec2cea723f2c1d582 Merge: e28e383da32a63 a9fb41b5def8e1 Author: Simona Vetter Date: Fri Oct 31 19:10:04 2025 +0100 Merge tag 'drm-misc-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: ast: - Preserve correct bits on register I/O dma-fence: - Use correct timeline name etnaviv: - Use correct GPU adress space for flush imx: - parallel-display: Fix bridge handling nouveau: - Fix locking in scheduler panel: - kingdisplay-kd097d04: Disable EOT packet - sitronix-st7789v: Use correct SYNC flags sched: - Fix locking to avoid race condition - Fix SIGKILL handling sysfb: - Avoid NULL-pointer access Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://patch.msgid.link/20251030195644.GA188441@localhost.localdomain commit e28e383da32a6396e37c3f68964dc92eb9b6f0ed Merge: 3d8d35bf8dc889 dc8aa0cb87a783 Author: Simona Vetter Date: Fri Oct 31 19:08:36 2025 +0100 Merge tag 'drm-intel-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix DMC/DC6 asserts on ADL-S (Ville) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://patch.msgid.link/aQNtTV75vPaDhnXh@intel.com commit 3d8d35bf8dc8893e34d92212d413d7cfd89c560e Merge: 3a9f6bd54e20d0 f5d079564c44ba Author: Simona Vetter Date: Fri Oct 31 19:07:39 2025 +0100 Merge tag 'drm-msm-fixes-2025-10-29' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.18-rc4 CI - Disable broken sanity job GEM - Fix vm_bind prealloc error path - Fix dma-buf import free - Fix last-fence update - Reject MAP_NULL if PRR is unsupported - Ensure vm is created in VM_BIND ioctl GPU - GMU fw parsing fix DPU: - Fixed mode_valid callback - Fixed planes on DPU 1.x devices. Signed-off-by: Simona Vetter From: Rob Clark Link: https://patch.msgid.link/CACSVV03kUm1ms7FBg0m9U4ZcyickSWbnayAWqYqs0XH4UjWf+A@mail.gmail.com commit 3a9f6bd54e20d0eaf89ca3ec6d82e5263cac93e8 Merge: ef54548455190f b3656b355b5522 Author: Simona Vetter Date: Fri Oct 31 19:00:01 2025 +0100 Merge tag 'amd-drm-fixes-6.18-2025-10-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-29: amdgpu: - VPE idle handler fix - Re-enable DM idle optimizations - DCN3.0 fix - SMU fix - Powerplay fixes for fiji/iceland - License fixes - HDP eDP panel fix - Vblank fix radeon: - devm migration fixes Signed-off-by: Simona Vetter From: Alex Deucher Link: https://patch.msgid.link/20251029201342.8813-1-alexander.deucher@amd.com commit ef54548455190f3d28462787eb33d08c3cfadc4e Merge: dcb6fa37fd7bc9 926d002e6d7e2f Author: Simona Vetter Date: Fri Oct 31 18:54:21 2025 +0100 Merge tag 'mediatek-drm-fixes-20251028' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20251028 1. Fix device use-after-free on unbind Signed-off-by: Simona Vetter From: Chun-Kuang Hu Link: https://patch.msgid.link/20251028151548.3944-1-chunkuang.hu@kernel.org commit 8d59fba49362c65332395789fd82771f1028d87e Author: Ilia Gavrilov Date: Mon Oct 20 15:12:55 2025 +0000 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the 'value' array in the mgmt_adv_pattern structure is 31. If the value of 'pattern[i].length' is set in the user space and exceeds 31, the 'patterns[i].value' array can be accessed out of bound when copied. Increasing the size of the 'value' array in the 'mgmt_adv_pattern' structure will break the userspace. Considering this, and to avoid OOB access revert the limits for 'offset' and 'length' back to the value of HCI_MAX_AD_LENGTH. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: db08722fc7d4 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH") Cc: stable@vger.kernel.org Signed-off-by: Ilia Gavrilov Signed-off-by: Luiz Augusto von Dentz commit 1c21cf89a66413eb04b2d22c955b7a50edc14dfa Author: Abdun Nihaal Date: Tue Oct 28 23:26:30 2025 +0530 Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() The memory allocated for ptr using kvmalloc() is not freed on the last error path. Fix that by freeing it on that error path. Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support") Signed-off-by: Abdun Nihaal Signed-off-by: Luiz Augusto von Dentz commit 5c5f1f64681cc889d9b13e4a61285e9e029d6ab5 Author: Raphael Pinsonneault-Thibeault Date: Fri Oct 24 12:29:10 2025 -0400 Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory. The fix is to check skb->len before using skb->data. Reported-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a9a4bedfca6aa9d7fa24 Tested-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com Fixes: afcb3369f46ed ("Bluetooth: hci_event: Fix vendor (unknown) opcode status handling") Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Luiz Augusto von Dentz commit b909d77359b82821e1c6b6a3a8a51b355b06fdb5 Merge: 58fdd8484c05a1 895ad6f7083b0c Author: Linus Torvalds Date: Fri Oct 31 09:34:21 2025 -0700 Merge tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix potential UAF in statfs - DFS fix for expired referrals - fix minor modinfo typo - small improvement to reconnect for smbdirect * tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release() smb: client: handle lack of IPC in dfs_cache_refresh() smb: client: fix potential cfid UAF in smb2_query_info_compound cifs: fix typo in enable_gcm_256 module parameter commit 0d92a3eaa6726e64a18db74ece806c2c021aaac3 Author: Hans Holmberg Date: Fri Oct 31 10:48:26 2025 +0100 null_blk: set dma alignment to logical block size This driver assumes that bio vectors are memory aligned to the logical block size, so set the queue limit to reflect that. Unless we set up the limit based on the logical block size, we will go out of page bounds in copy_to_nullb / copy_from_nullb. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since commit 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr") xfstests generates unaligned I/O, which now lead to memory corruption when using null_blk devices with 4k block size. Fixes: bf8d08532bc1 ("iomap: add support for dma aligned direct-io") Fixes: b1a000d3b8ec ("block: relax direct io memory alignment") Reviewed-by: Christoph Hellwig Reviewed-by: Keith Busch Signed-off-by: Hans Holmberg Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 58fdd8484c05a19942690008304228ad784771e9 Merge: 3ad81aa52085a7 390db60f8e2bd2 Author: Linus Torvalds Date: Fri Oct 31 07:29:09 2025 -0700 Merge tag 'sound-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. It became slightly bigger than usual due to timing issues (holidays, etc), but all changes are rather device-specific fixes, so not really worrisome. - ASoC Cirrus codec fixes for AMD - Various fixes for ASoC Intel AVS, Qualcomm, SoundWire, FSL, Mediatek, Renesas - A few HD-audio quirks, and USB-audio regression fixes for Presonus" * tag 'sound-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ALSA: hda/realtek: Enable mic on Vaio RPL ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports ASoC: renesas: rz-ssi: Use proper dma_buffer_pos after resume ASoC: soc_sdw_utils: remove cs42l43 component_name ASoC: fsl_sai: Fix sync error in consumer mode ASoC: Fix build for sdw_utils ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) ASoC: rt721: fix prepare clock stop failed ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c ASoC: mediatek: Fix double pm_runtime_disable in remove functions ASoC: fsl_micfil: correct the endian format for DSD ASoC: fsl_sai: fix bit order for DSD format ASoC: Intel: avs: Use snd_codec format when initializing probe ASoC: Intel: avs: Disable periods-elapsed work when closing PCM ASoC: Intel: avs: Unprepare a stream when XRUN occurs ASoC: sdw_utils: add name_prefix for rt1321 part id ASoC: qdsp6: q6asm: do not sleep while atomic ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 ... commit 3ad81aa52085a7e67edfa4bc8f518e5962196bb3 Merge: 2d51cb1792c7b1 3c9bf72cc1ced1 Author: Linus Torvalds Date: Fri Oct 31 07:25:10 2025 -0700 Merge tag 'v6.18-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix double free in aspeed - Fix req->nbytes clobbering in s390/phmac * tag 'v6.18-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: aspeed - fix double free caused by devm crypto: s390/phmac - Do not modify the req->nbytes value commit 2d51cb1792c7b1d8d5daf55cc3eecf19ddc4500c Merge: d127176862a93c d54c676d4fe054 Author: Linus Torvalds Date: Fri Oct 31 07:08:47 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "ufs driver plus two core fixes. One core fix makes the unit attention counters atomic (just in case multiple commands detect them) and the other is fixing a merge window regression caused by changes in the block tree" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: core: Fix the unit attention counter implementation scsi: ufs: core: Declare tx_lanes witout initialization scsi: ufs: core: Initialize value of an attribute returned by uic cmd scsi: ufs: core: Fix error handler host_sem issue scsi: core: Fix a regression triggered by scsi_host_busy() commit 0d510778c2f4913b5ca062b8a538929bff94e0be Author: Jon Hunter Date: Fri Oct 31 10:37:41 2025 +0000 Revert "rtc: cpcap: Fix initial enable_irq/disable_irq balance" Commit e0762fd26ad6 ("rtc: cpcap: Fix initial enable_irq/disable_irq balance") set 'alarm_enabled' prior to calling the function devm_request_threaded_irq() because this enables the IRQ. However, right after calling devm_request_threaded_irq(), the driver calls disable_irq() to disable the IRQ and so now 'alarm_enabled' will be true but the IRQ is actually disabled. Revert this commit to fix the 'alarm_enabled' state. Fixes: e0762fd26ad6 ("rtc: cpcap: Fix initial enable_irq/disable_irq balance") Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20251031103741.945460-2-jonathanh@nvidia.com Signed-off-by: Alexandre Belloni commit b1c9390f0a44566f7cbd2db979e2ca5393767d49 Author: Jon Hunter Date: Fri Oct 31 10:37:40 2025 +0000 Revert "rtc: tps6586x: Fix initial enable_irq/disable_irq balance" Commit 1502fe0e97be ("rtc: tps6586x: Fix initial enable_irq/disable_irq balance") breaks the wake-up alarm for the tps6586x. After this commit was added RTC wake ups from suspend stopped working on the Tegra20 Ventana platform. The problem is that this change set the 'irq_en' variable to true prior to calling devm_request_threaded_irq() to indicate that the IRQ is enabled, however, it was over looked that the flag IRQ_NOAUTOEN is already set meaning that the IRQ is not enabled by default. This prevents the IRQ from being enabled as expected. Revert this change to fix this. Fixes: 1502fe0e97be ("rtc: tps6586x: Fix initial enable_irq/disable_irq balance") Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20251031103741.945460-1-jonathanh@nvidia.com Signed-off-by: Alexandre Belloni commit 0db22d7ee462c42c1284e98d47840932792c1adb Author: Christoph Hellwig Date: Thu Oct 23 17:17:03 2025 +0200 xfs: document another racy GC case in xfs_zoned_map_extent Besides blocks being invalidated, there is another case when the original mapping could have changed between querying the rmap for GC and calling xfs_zoned_map_extent. Document it there as it took us quite some time to figure out what is going on while developing the multiple-GC protection fix. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 83bac569c762651ac6dff9a86f54ecc13d911f7d Author: Christoph Hellwig Date: Thu Oct 23 17:17:02 2025 +0200 xfs: prevent gc from picking the same zone twice When we are picking a zone for gc it might already be in the pipeline which can lead to us moving the same data twice resulting in in write amplification and a very unfortunate case where we keep on garbage collecting the zone we just filled with migrated data stopping all forward progress. Fix this by introducing a count of on-going GC operations on a zone, and skip any zone with ongoing GC when picking a new victim. Fixes: 080d01c41 ("xfs: implement zoned garbage collection") Signed-off-by: Hans Holmberg Co-developed-by: Hans Holmberg Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Tested-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a Author: Mario Limonciello (AMD) Date: Thu Oct 30 11:06:25 2025 -0500 HID: hid-input: Extend Elan ignore battery quirk to USB USB Elan devices have the same problem as the I2C ones with a fake battery device showing up. Reviewed-by: Hans de Goede Reported-by: André Barata Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722 Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e Author: Masami Ichikawa Date: Sun Sep 21 14:31:02 2025 +0900 HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Use a scope-based cleanup helper for the buffer allocated with kmalloc() in ntrig_report_version() to simplify the cleanup logic and prevent memory leaks (specifically the !hid_is_usb()-case one). [jkosina@suse.com: elaborate on the actual existing leak] Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") Signed-off-by: Masami Ichikawa Signed-off-by: Jiri Kosina commit d127176862a93c4b3216bda533d2bee170af5e71 Merge: 1806838686ef74 920aa3a7705a06 Author: Linus Torvalds Date: Thu Oct 30 19:48:13 2025 -0700 Merge tag 'linux_kselftest-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Fix build warning in cachestat found during clang build and add tmpshmcstat to .gitignore" * tag 'linux_kselftest-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: cachestat: Fix warning on declaration under label selftests/cachestat: add tmpshmcstat file to .gitignore commit 1806838686ef74cde74e590d13984dec7c0233d6 Merge: a5355e98accb20 f3903ec76ae6af Author: Linus Torvalds Date: Thu Oct 30 19:11:27 2025 -0700 Merge tag 'linux_kselftest-kunit-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fixes from Shuah Khan: "Fix log overwrite in param_tests and fixes incorrect cast of priv pointer in test_dev_action(). Update email address for Rae Moar in MAINTAINERS KUnit entry" * tag 'linux_kselftest-kunit-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: MAINTAINERS: Update KUnit email address for Rae Moar kunit: prevent log overwrite in param_tests kunit: test_dev_action: Correctly cast 'priv' pointer to long* commit a5355e98accb20d8ea06008fd8fb5755cc52e8c0 Merge: a5dbbb39e11d50 8907226bed1ebd Author: Linus Torvalds Date: Thu Oct 30 19:05:46 2025 -0700 Merge tag 'acpi-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix three ACPI driver issues and add version checks to two ACPI table parsers: - Call input_free_device() on failing input device registration as necessary (and mentioned in the input subsystem documentation) in the ACPI button driver (Kaushlendra Kumar) - Fix use-after-free in acpi_video_switch_brightness() by canceling a delayed work during tear-down (Yuhao Jiang) - Use platform device for devres-related actions in the ACPI fan driver to allow device-managed resources to be cleaned up properly (Armin Wolf) - Add version checks to the MRRM and SPCR table parsers (Tony Luck and Punit Agrawal)" * tag 'acpi-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: SPCR: Check for table version when using precise baudrate ACPI: MRRM: Check revision of MRRM table ACPI: fan: Use platform device for devres-related actions ACPI: fan: Use ACPI handle when retrieving _FST ACPI: video: Fix use-after-free in acpi_video_switch_brightness() ACPI: button: Call input_free_device() on failing input device registration commit a5dbbb39e11d50a8c426b8d88f5b12031fee49f3 Merge: a4819ac1913e78 590c5cd10675a6 Author: Linus Torvalds Date: Thu Oct 30 19:02:16 2025 -0700 Merge tag 'pm-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix three regressions, two recent ones and one introduced during the 6.17 development cycle: - Add an exit latency check to the menu cpuidle governor in the case when it considers using a real idle state instead of a polling one to address a performance regression (Rafael Wysocki) - Revert an attempted cleanup of a system suspend code path that introduced a regression elsewhere (Samuel Wu) - Allow pm_restrict_gfp_mask() to be called multiple times in a row and adjust pm_restore_gfp_mask() accordingly to avoid having to play nasty games with these calls during hibernation (Rafael Wysocki)" * tag 'pm-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Allow pm_restrict_gfp_mask() stacking cpuidle: governors: menu: Select polling state in some more cases Revert "PM: sleep: Make pm_wakeup_clear() call more clear" commit a4819ac1913e78e41c8406df481a661d9469c350 Merge: e5763491237ffe 7073c7fc8d8ba4 Author: Linus Torvalds Date: Thu Oct 30 18:58:49 2025 -0700 Merge tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - atyfb: Avoid hard lock up when PLL not initialized (Daniel Palmer) - pvr2fb: Fix build error when CONFIG_PVR2_DMA enabled (Florian Fuchs) - bitblit: Fix out-of-bounds read in bit_putcs* (Junjie Cao) - valkyriefb: Fix reference count leak (Miaoqian Lin) - fbcon: Fix slab-use-after-free in fb_mode_is_equal (Quanmin Yan) - fb.h: Fix typo in "vertical" (Piyush Choudhary) * tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: atyfb: Check if pll_ops->init_pll failed fbcon: Set fb_display[i]->mode to NULL when the mode is released fbdev: bitblit: bound-check glyph index in bit_putcs* fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: valkyriefb: Fix reference count leak in valkyriefb_init video: fb: Fix typo in comment in fb.h commit e5763491237ffee22d9b554febc2d00669f81dee Merge: e53642b87a4f4b 51e5ad549c43b5 Author: Linus Torvalds Date: Thu Oct 30 18:35:35 2025 -0700 Merge tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wireless, Bluetooth and netfilter. Current release - regressions: - tcp: fix too slow tcp_rcvbuf_grow() action - bluetooth: fix corruption in h4_recv_buf() after cleanup Previous releases - regressions: - mptcp: restore window probe - bluetooth: - fix connection cleanup with BIG with 2 or more BIS - fix crash in set_mesh_sync and set_mesh_complete - batman-adv: release references to inactive interfaces - nic: - ice: fix usage of logical PF id - sfc: fix potential memory leak in efx_mae_process_mport() Previous releases - always broken: - devmem: refresh devmem TX dst in case of route invalidation - netfilter: add seqadj extension for natted connections - wifi: - iwlwifi: fix potential use after free in iwl_mld_remove_link() - brcmfmac: fix crash while sending action frames in standalone AP Mode - eth: - mlx5e: cancel tls RX async resync request in error flows - ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() - hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue - cxgb4: fix potential use-after-free in ipsec callback - nfp: fix memory leak in nfp_net_alloc()" * tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (75 commits) net: sctp: fix KMSAN uninit-value in sctp_inq_pop net: devmem: refresh devmem TX dst in case of route invalidation net: stmmac: est: Fix GCL bounds checks net: stmmac: Consider Tx VLAN offload tag length for maxSDU net: stmmac: vlan: Disable 802.1AD tag insertion offload net/mlx5e: kTLS, Cancel RX async resync request in error flows net: tls: Cancel RX async resync request on rcd_delta overflow net: tls: Change async resync helpers argument net: phy: dp83869: fix STRAP_OPMODE bitmask selftests: net: use BASH for bareudp testing net: mctp: Fix tx queue stall net/mlx5: Don't zero user_count when destroying FDB tables net: usb: asix_devices: Check return value of usbnet_get_endpoints mptcp: zero window probe mib mptcp: restore window probe mptcp: fix MSG_PEEK stream corruption mptcp: drop bogus optimization in __mptcp_check_push() netconsole: Fix race condition in between reader and writer of userdata Documentation: netconsole: Remove obsolete contact people nfp: xsk: fix memory leak in nfp_net_alloc() ... commit 08d33390248f9e248bca970afc731a16aad4e348 Merge: 0b39ca457241ae 0194b65ab57143 Author: Jens Axboe Date: Thu Oct 30 19:26:19 2025 -0600 Merge tag 'nvme-6.18-2025-10-30' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "- Target side authentication fixup (Hannes) - Peer-to-peer metadata fixup (Keith)" * tag 'nvme-6.18-2025-10-30' of git://git.infradead.org/nvme: nvme-pci: use blk_map_iter for p2p metadata nvmet-auth: update sc_c in host response commit a9fb41b5def8e1e0103d5fd1453787993587281e Author: Thomas Zimmermann Date: Fri Oct 24 09:35:53 2025 +0200 drm/ast: Clear preserved bits from register output value Preserve the I/O register bits in __ast_write8_i_masked() as specified by preserve_mask. Accidentally OR-ing the output value into these will overwrite the register's previous settings. Fixes display output on the AST2300, where the screen can go blank at boot. The driver's original commit 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") already added the broken code. Commit 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") triggered the bug. Signed-off-by: Thomas Zimmermann Reported-by: Peter Schneider Closes: https://lore.kernel.org/dri-devel/a40caf8e-58ad-4f9c-af7f-54f6f69c29bb@googlemail.com/ Tested-by: Peter Schneider Reviewed-by: Jocelyn Falempe Fixes: 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") Cc: Thomas Zimmermann Cc: Nick Bowler Cc: Douglas Anderson Cc: Dave Airlie Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v3.5+ Link: https://patch.msgid.link/20251024073626.129032-1-tzimmermann@suse.de commit 8907226bed1ebd10d069f6f70ff0aaa8840f3267 Merge: 543d35004007a0 20594cd104abaa 8f067aa5943026 d91a1d129b6361 Author: Rafael J. Wysocki Date: Thu Oct 30 20:40:49 2025 +0100 Merge branches 'acpi-button', 'acpi-video' and 'acpi-fan' Merge ACPI button, ACPI backlight (video), and ACPI fan driver fixes for 6.18-rc4: - Call input_free_device() on failing input device registration as necessary (and mentioned in the input subsystem documentation) in the ACPI button driver (Kaushlendra Kumar) - Fix use-after-free in acpi_video_switch_brightness() by canceling a delayed work during tear-down (Yuhao Jiang) - Use platform device for devres-related actions in the ACPI fan driver to allow device-managed resources to be cleaned up properly (Armin Wolf) * acpi-button: ACPI: button: Call input_free_device() on failing input device registration * acpi-video: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() * acpi-fan: ACPI: fan: Use platform device for devres-related actions ACPI: fan: Use ACPI handle when retrieving _FST commit 590c5cd10675a6ae49f6019502dec5c87aba07e4 Merge: db86f55bf81a3a 35e4a69b2003f2 Author: Rafael J. Wysocki Date: Thu Oct 30 20:25:18 2025 +0100 Merge branches 'pm-cpuidle' and 'pm-sleep' Merge a cpuidle fix and two fixes related to system sleep for 6.18-rc4: - Add an exit latency check to the menu cpuidle governor in the case when it considers using a real idle state instead of a polling one to address a performance regression (Rafael Wysocki) - Revert an attempted cleanup of a system suspend code path that introduced a regression elsewhere (Samuel Wu) - Allow pm_restrict_gfp_mask() to be called multiple times in a row and adjust pm_restore_gfp_mask() accordingly to avoid having to play nasty games with these calls during hibernation (Rafael Wysocki) * pm-cpuidle: cpuidle: governors: menu: Select polling state in some more cases * pm-sleep: PM: sleep: Allow pm_restrict_gfp_mask() stacking Revert "PM: sleep: Make pm_wakeup_clear() call more clear" commit 3b1a4a59a2086badab391687a6a0b86e03048393 Author: austinchang Date: Wed Oct 29 09:35:27 2025 +0000 btrfs: mark dirty extent range for out of bound prealloc extents In btrfs_fallocate(), when the allocated range overlaps with a prealloc extent and the extent starts after i_size, the range doesn't get marked dirty in file_extent_tree. This results in persisting an incorrect disk_i_size for the inode when not using the no-holes feature. This is reproducible since commit 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree"), then became hidden since commit 3d7db6e8bd22 ("btrfs: don't allocate file extent tree for non regular files") and then visible again after commit 8679d2687c35 ("btrfs: initialize inode::file_extent_tree after i_mode has been set"), which fixes the previous commit. The following reproducer triggers the problem: $ cat test.sh MNT=/mnt/test DEV=/dev/vdb mkdir -p $MNT mkfs.btrfs -f -O ^no-holes $DEV mount $DEV $MNT touch $MNT/file1 fallocate -n -o 1M -l 2M $MNT/file1 umount $MNT mount $DEV $MNT len=$((1 * 1024 * 1024)) fallocate -o 1M -l $len $MNT/file1 du --bytes $MNT/file1 umount $MNT mount $DEV $MNT du --bytes $MNT/file1 umount $MNT Running the reproducer gives the following result: $ ./test.sh (...) 2097152 /mnt/test/file1 1048576 /mnt/test/file1 The difference is exactly 1048576 as we assigned. Fix by adding a call to btrfs_inode_set_file_extent_range() in btrfs_fallocate_update_isize(). Fixes: 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree") Signed-off-by: austinchang Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 953902e4fb4c373c81a977f78e40f9f93a79e20f Author: Filipe Manana Date: Fri Oct 24 12:30:56 2025 +0100 btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name If we are logging a new name make sure our inode has the runtime flag BTRFS_INODE_COPY_EVERYTHING set so that at btrfs_log_inode() we will find new inode refs/extrefs in the subvolume tree and copy them into the log tree. We are currently doing it when adding a new link but we are missing it when renaming. An example where this makes a new name not persisted: 1) create symlink with name foo in directory A 2) fsync directory A, which persists the symlink 3) rename the symlink from foo to bar 4) fsync directory A to persist the new symlink name Step 4 isn't working correctly as it's not logging the new name and also leaving the old inode ref in the log tree, so after a power failure the symlink still has the old name of "foo". This is because when we first fsync directoy A we log the symlink's inode (as it's a new entry) and at btrfs_log_inode() we set the log mode to LOG_INODE_ALL and then because we are using that mode and the inode has the runtime flag BTRFS_INODE_NEEDS_FULL_SYNC set, we clear that flag as well as the flag BTRFS_INODE_COPY_EVERYTHING. That means the next time we log the inode, during the rename through the call to btrfs_log_new_name() (calling btrfs_log_inode_parent() and then btrfs_log_inode()), we will not search the subvolume tree for new refs/extrefs and jump directory to the 'log_extents' label. Fix this by making sure we set BTRFS_INODE_COPY_EVERYTHING on an inode when we are about to log a new name. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/ac949c74-90c2-4b9a-b7fd-1ffc5c3175c7@gmail.com/ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f260c6aff0b8af236084012d14f9f1bf792ea883 Author: Shardul Bankar Date: Sun Oct 26 01:30:21 2025 +0530 btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because the level validation check happens before the mutex is acquired and before any error handling path that would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all error paths. Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation") Reviewed-by: Qu Wenruo Signed-off-by: Shardul Bankar Signed-off-by: David Sterba commit 2618849f31e7cf51fadd4a5242458501a6d5b315 Author: Qu Wenruo Date: Thu Oct 23 19:44:04 2025 +1030 btrfs: ensure no dirty metadata is written back for an fs with errors [BUG] During development of a minor feature (make sure all btrfs_bio::end_io() is called in task context), I noticed a crash in generic/388, where metadata writes triggered new works after btrfs_stop_all_workers(). It turns out that it can even happen without any code modification, just using RAID5 for metadata and the same workload from generic/388 is going to trigger the use-after-free. [CAUSE] If btrfs hits an error, the fs is marked as error, no new transaction is allowed thus metadata is in a frozen state. But there are some metadata modifications before that error, and they are still in the btree inode page cache. Since there will be no real transaction commit, all those dirty folios are just kept as is in the page cache, and they can not be invalidated by invalidate_inode_pages2() call inside close_ctree(), because they are dirty. And finally after btrfs_stop_all_workers(), we call iput() on btree inode, which triggers writeback of those dirty metadata. And if the fs is using RAID56 metadata, this will trigger RMW and queue new works into rmw_workers, which is already stopped, causing warning from queue_work() and use-after-free. [FIX] Add a special handling for write_one_eb(), that if the fs is already in an error state, immediately mark the bbio as failure, instead of really submitting them. Then during close_ctree(), iput() will just discard all those dirty tree blocks without really writing them back, thus no more new jobs for already stopped-and-freed workqueues. The extra discard in write_one_eb() also acts as an extra safenet. E.g. the transaction abort is triggered by some extent/free space tree corruptions, and since extent/free space tree is already corrupted some tree blocks may be allocated where they shouldn't be (overwriting existing tree blocks). In that case writing them back will further corrupting the fs. CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b Author: Oleksandr Suvorov Date: Thu Oct 30 17:42:54 2025 +0200 USB: serial: ftdi_sio: add support for u-blox EVK-M101 The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces: - EVK-M101 current sensors - EVK-M101 I2C - EVK-M101 UART - EVK-M101 port D Only the third USB interface is a UART. This change lets ftdi_sio probe the VID/PID and registers only interface #3 as a TTY, leaving the rest available for other drivers. [1] usb 5-1.3: new high-speed USB device number 11 using xhci_hcd usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00 usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 5-1.3: Product: EVK-M101 usb 5-1.3: Manufacturer: u-blox AG Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf Signed-off-by: Oleksandr Suvorov Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 103e17aac09cdd358133f9e00998b75d6c1f1518 Author: Sebastian Ene Date: Fri Oct 17 07:57:10 2025 +0000 KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. Signed-off-by: Sebastian Ene Acked-by: Will Deacon Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com Signed-off-by: Marc Zyngier commit f71f7afd0a0cd3f044cd2f8aba71a1a7229df762 Author: Vincent Donnefort Date: Thu Oct 16 17:45:41 2025 +0100 KVM: arm64: Check range args for pKVM mem transitions There's currently no verification for host issued ranges in most of the pKVM memory transitions. The end boundary might therefore be subject to overflow and later checks could be evaded. Close this loophole with an additional pfn_range_is_valid() check on a per public function basis. Once this check has passed, it is safe to convert pfn and nr_pages into a phys_addr_t and a size. host_unshare_guest transition is already protected via __check_host_shared_guest(), while assert_host_shared_guest() callers are already ignoring host checks. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20251016164541.3771235-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit a186fbcfd845699d51809f7c7e54cf997fe32820 Author: Mark Brown Date: Fri Oct 24 00:43:39 2025 +0100 KVM: arm64: selftests: Filter ZCR_EL2 in get-reg-list get-reg-list includes ZCR_EL2 in the list of EL2 registers that it looks for when NV is enabled but does not have any feature gate for this register, meaning that testing any combination of features that includes EL2 but does not include SVE will result in a test failure due to a missing register being reported: | The following lines are missing registers: | | ARM64_SYS_REG(3, 4, 1, 2, 0), Add ZCR_EL2 to feat_id_regs so that the test knows not to expect to see it without SVE being enabled. Fixes: 3a90b6f27964 ("KVM: arm64: selftests: get-reg-list: Add base EL2 registers") Signed-off-by: Mark Brown Link: https://patch.msgid.link/20251024-kvm-arm64-get-reg-list-zcr-el2-v1-1-0cd0ff75e22f@kernel.org Signed-off-by: Marc Zyngier commit 92e781c93ebe75e39ecdf78fb8ef1fdf1b63a9f8 Author: Mark Brown Date: Thu Oct 23 22:19:29 2025 +0100 KVM: arm64: selftests: Add SCTLR2_EL2 to get-reg-list We recently added support for SCTLR2_EL2 to the kernel but did not add it to get-reg-list, resulting in it reporting the missing register when it is available. Add it. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20251023-b4-kvm-arm64-get-reg-list-sctlr-el2-v1-1-088f88ff992a@kernel.org Signed-off-by: Marc Zyngier commit a24f7afce048e724be072bd063ed864f124daf81 Author: Maximilian Dittgen Date: Mon Oct 20 16:59:46 2025 +0200 KVM: selftests: fix MAPC RDbase target formatting in vgic_lpi_stress Since GITS_TYPER.PTA == 0, the ITS MAPC command demands a CPU ID, rather than a physical redistributor address, for its RDbase command argument. As such, when MAPC-ing guest ITS collections, vgic_lpi_stress iterates over CPU IDs in the range [0, nr_cpus), passing them as the RDbase vcpu_id argument to its_send_mapc_cmd(). However, its_encode_target() in the its_send_mapc_cmd() selftest handler expects RDbase arguments to be formatted with a 16 bit offset, as shown by the 16-bit target_addr right shift its implementation: its_mask_encode(&cmd->raw_cmd[2], target_addr >> 16, 51, 16) At the moment, all CPU IDs passed into its_send_mapc_cmd() have no offset, therefore becoming 0x0 after the bit shift. Thus, when vgic_its_cmd_handle_mapc() receives the ITS command in vgic-its.c, it always interprets the RDbase target CPU as CPU 0. All interrupts sent to collections will be processed by vCPU 0, which defeats the purpose of this multi-vCPU test. Fix by creating procnum_to_rdbase() helper function, which left-shifts the vCPU parameter received by its_send_mapc_cmd 16 bits before passing it to its_encode_target for encoding. Signed-off-by: Maximilian Dittgen Link: https://patch.msgid.link/20251020145946.48288-1-mdittgen@amazon.de Signed-off-by: Marc Zyngier commit da888524c393b4a14727e1a821bdd51313d0a2d3 Author: Sascha Bischoff Date: Tue Oct 21 09:44:09 2025 +0000 KVM: arm64: vgic-v3: Trap all if no in-kernel irqchip If there is no in-kernel irqchip for a GICv3 host set all of the trap bits to block all accesses. This fixes the no-vgic-v3 selftest again. Fixes: 3193287ddffb ("KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests") Reported-by: Mark Brown Closes: https://lore.kernel.org/all/23072856-6b8c-41e2-93d1-ea8a240a7079@sirena.org.uk Signed-off-by: Sascha Bischoff Reviewed-by: Sebastian Ott Tested-by: Mark Brown Link: https://patch.msgid.link/20251021094358.1963807-1-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 64e2f60f355e556337fcffe80b9bcff1b22c9c42 Author: Heiko Carstens Date: Thu Oct 30 15:55:05 2025 +0100 s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes. The problem is that kernel page tables are modified without flushing corresponding TLB entries. Even if it looks like the empty flush_tlb_all() implementation on s390 is the problem, it is actually a different problem: on s390 it is not allowed to replace an active/valid page table entry with another valid page table entry without the detour over an invalid entry. A direct replacement may lead to random crashes and/or data corruption. In order to invalidate an entry special instructions have to be used (e.g. ipte or idte). Alternatively there are also special instructions available which allow to replace a valid entry with a different valid entry (e.g. crdte or cspg). Given that the HVO code currently does not provide the hooks to allow for an implementation which is compliant with the s390 architecture requirements, disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP again, which is basically a revert of the original patch which enabled it. Reported-by: Luiz Capitulino Closes: https://lore.kernel.org/all/20251028153930.37107-1-luizcap@redhat.com/ Fixes: 00a34d5a99c0 ("s390: select ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Cc: stable@vger.kernel.org Tested-by: Luiz Capitulino Reviewed-by: Gerald Schaefer Reviewed-by: David Hildenbrand Signed-off-by: Heiko Carstens commit bf7e97910b9f4d9679e075a39be371a4ed65dbd4 Author: Luca Ceresoli Date: Tue Oct 14 13:30:52 2025 +0200 drm/imx: parallel-display: add the bridge before attaching it Invoking drm_bridge_add() is good practice, so add it to this driver. Link: https://lore.kernel.org/all/DDHZ5GO9MPF0.CGYTVBI74FOZ@bootlin.com Signed-off-by: Luca Ceresoli Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-2-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel commit 3257bd193fa1702791978d8418c9a96e3def082c Author: Luca Ceresoli Date: Tue Oct 14 13:30:51 2025 +0200 drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. This conversion was missed during the initial conversion of all bridges to the new API. Thus all kernels with commit 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") and using this driver now warn due to drm_bridge_attach() incrementing the refcount, which is not initialized without using devm_drm_bridge_alloc() for allocation. To make the conversion simple and straightforward without messing up with the drmm_simple_encoder_alloc(), move the struct drm_bridge from struct imx_parallel_display_encoder to struct imx_parallel_display. Also remove the 'struct imx_parallel_display *pd' from struct imx_parallel_display_encoder, not needed anymore. Fixes: 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") Reported-by: Ernest Van Hoecke Closes: https://lore.kernel.org/all/hlf4wdopapxnh4rekl5s3kvoi6egaga3lrjfbx6r223ar3txri@3ik53xw5idyh/ Signed-off-by: Luca Ceresoli Reviewed-by: Louis Chauvet Tested-by: Ernest Van Hoecke Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-1-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel commit 0b39ca457241aeca07a613002512573e8804f93a Author: Carlos Llamas Date: Thu Oct 30 04:39:18 2025 +0000 blk-crypto: use BLK_STS_INVAL for alignment errors Make __blk_crypto_bio_prep() propagate BLK_STS_INVAL when IO segments fail the data unit alignment check. This was flagged by an LTP test that expects EINVAL when performing an O_DIRECT read with a misaligned buffer [1]. Cc: Eric Biggers Cc: Christoph Hellwig Link: https://lore.kernel.org/all/aP-c5gPjrpsn0vJA@google.com/ [1] Signed-off-by: Carlos Llamas Reviewed-by: Eric Biggers Signed-off-by: Jens Axboe commit 390db60f8e2bd21fae544917eb3a8618265c058c Merge: 4f4c654f5a0f65 5e5c8aa73d99f1 Author: Takashi Iwai Date: Thu Oct 30 13:08:08 2025 +0100 Merge tag 'asoc-fix-v6.18-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A bigger batch of fixes than I'd like, things built up due to holidays and some last minute issues which caused me to hold off on sending a pul request. None of these are super remarkable, and there's a few new device IDs in here too including a relatively big block of AMD devices. The Cirrus Logic CS530x support subject line is actually a fix that was on the start of that series and got pulled in here, I forgot to fix the subject up when merging. commit 47a0925ee4bd2689f0aef4dbd67dd46442fe1ca2 Author: Maud Spierings Date: Thu Oct 30 07:35:38 2025 +0100 regulator: bd718x7: Fix voltages scaled by resistor divider The .min_sel and .max_sel fields remained uninitialized in the new linear_range, causing an error further down the line. Copy the old values of these fields to the new one as they represent the range of register values, which does not change. Fixes: d2ad981151b3a ("regulator: bd718x7: Support external connection to scale voltages") Signed-off-by: Maud Spierings Reviewed-by: Matti Vaittinen Link: https://patch.msgid.link/20251030-mini_iv-v3-2-ef56c4d9f219@gocontroll.com Signed-off-by: Mark Brown commit 4d3a13afa8b64dc49293b3eab3e7beac11072c12 Author: Mario Limonciello (AMD) Date: Mon Oct 20 10:50:42 2025 -0500 HID: amd_sfh: Stop sensor before starting Titas reports that the accelerometer sensor on their laptop only works after a warm boot or unloading/reloading the amd-sfh kernel module. Presumably the sensor is in a bad state on cold boot and failing to start, so explicitly stop it before starting. Cc: stable@vger.kernel.org Fixes: 93ce5e0231d79 ("HID: amd_sfh: Implement SFH1.1 functionality") Reported-by: Titas Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220670 Tested-by: Titas Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 Author: April Grimoire Date: Thu Oct 23 00:37:26 2025 +0800 HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, rendering function keys not treated properly. Despite being a SONiX USB DEVICE, it uses a different name, so adding it to the list. Signed-off-by: April Grimoire Signed-off-by: Jiri Kosina commit 59630e2ccd728703cc826e3a3515d70f8c7a766c Author: Jianbo Liu Date: Wed Oct 29 11:50:25 2025 +0200 xfrm: Prevent locally generated packets from direct output in tunnel mode Add a check to ensure locally generated packets (skb->sk != NULL) do not use direct output in tunnel mode, as these packets require proper L2 header setup that is handled by the normal XFRM processing path. Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 61fafbee6cfed283c02a320896089f658fa67e56 Author: Jianbo Liu Date: Tue Oct 28 04:22:48 2025 +0200 xfrm: Determine inner GSO type from packet inner protocol The GSO segmentation functions for ESP tunnel mode (xfrm4_tunnel_gso_segment and xfrm6_tunnel_gso_segment) were determining the inner packet's L2 protocol type by checking the static x->inner_mode.family field from the xfrm state. This is unreliable. In tunnel mode, the state's actual inner family could be defined by x->inner_mode.family or by x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed, causing GSO to create segments with the wrong L2 header type. This patch fixes the bug by deriving the inner mode directly from the packet's inner protocol stored in XFRM_MODE_SKB_CB(skb)->protocol. Instead of replicating the code, this patch modifies the xfrm_ip2inner_mode helper function. It now correctly returns &x->inner_mode if the selector family (x->sel.family) is already specified, thereby handling both specific and AF_UNSPEC cases appropriately. With this change, ESP GSO can use xfrm_ip2inner_mode to get the correct inner mode. It doesn't affect existing callers, as the updated logic now mirrors the checks they were already performing externally. Fixes: 26dbd66eab80 ("esp: choose the correct inner protocol for GSO on inter address family tunnels") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 082ef944e55da8a9a8df92e3842ca82a626d359a Author: Jianbo Liu Date: Tue Oct 28 04:22:47 2025 +0200 xfrm: Check inner packet family directly from skb_dst In the output path, xfrm_dev_offload_ok and xfrm_get_inner_ipproto need to determine the protocol family of the inner packet (skb) before it gets encapsulated. In xfrm_dev_offload_ok, the code checked x->inner_mode.family. This is unreliable because, for states handling both IPv4 and IPv6, the relevant inner family could be either x->inner_mode.family or x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed. In xfrm_get_inner_ipproto, the code checked x->outer_mode.family. This is also incorrect for tunnel mode, as the inner packet's family can be different from the outer header's family. At both of these call sites, the skb variable holds the original inner packet. The most direct and reliable source of truth for its protocol family is its destination entry. This patch fixes the issue by using skb_dst(skb)->ops->family to ensure protocol-specific headers are only accessed for the correct packet type. Fixes: 91d8a53db219 ("xfrm: fix offloading of cross-family tunnels") Fixes: 45a98ef4922d ("net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Zhu Yanjun Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit a45f15808fb753a14c6041fd1e5bef5d552bd2e3 Author: Lauri Tirkkonen Date: Sat Oct 18 15:35:15 2025 +0900 HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc The keyboard of this device has the following in its report description for Usage (Keyboard) in Collection (Application): # 0x15, 0x00, // Logical Minimum (0) 52 # 0x25, 0x65, // Logical Maximum (101) 54 # 0x05, 0x07, // Usage Page (Keyboard) 56 # 0x19, 0x00, // Usage Minimum (0) 58 # 0x29, 0xdd, // Usage Maximum (221) 60 # 0x81, 0x00, // Input (Data,Arr,Abs) 62 Since the Usage Min/Max range exceeds the Logical Min/Max range, keypresses outside the Logical range are not recognized. This includes, for example, the Japanese language keyboard variant's keys for |, _ and \. Fixup the report description to make the Logical range match the Usage range, fixing the interpretation of keypresses above 101 on this device. Signed-off-by: Lauri Tirkkonen Signed-off-by: Jiri Kosina commit 89216c9051ef6635f1514f8e0d2f9cd63b37a3b6 Author: Tony Luck Date: Tue Oct 28 10:29:48 2025 -0700 x86/cpu: Add/fix core comments for {Panther,Nova} Lake The E-core in Panther Lake is Darkmont, not Crestmont. Nova Lake is built from Coyote Cove (P-core) and Arctic Wolf (E-core). Fixes: 43bb700cff6b ("x86/cpu: Update Intel Family comments") Signed-off-by: Tony Luck Signed-off-by: Ingo Molnar Acked-by: Dave Hansen Cc: Peter Zijlstra Link: https://patch.msgid.link/20251028172948.6721-1-tony.luck@intel.com commit 847ebc4476714f81d7dea73e5ea69448d7fe9d3a Author: Borislav Petkov (AMD) Date: Wed Oct 29 12:34:31 2025 +0100 x86/CPU/AMD: Extend Zen6 model range Add some more Zen6 models. Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251029123056.19987-1-bp@kernel.org commit beab067dbcff642243291fd528355d64c41dc3b2 Author: Zhang Heng Date: Fri Sep 12 20:38:18 2025 +0800 HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Based on available evidence, the USB ID 4c4a:4155 used by multiple devices has been attributed to Jieli. The commit 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen functionality. Added checks for manufacturer and serial number to maintain microphone compatibility, enabling both devices to function properly. [jkosina@suse.com: edit shortlog] Fixes: 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") Cc: stable@vger.kernel.org Tested-by: staffan.melin@oscillator.se Reviewed-by: Terry Junge Signed-off-by: Zhang Heng Signed-off-by: Jiri Kosina commit 51e5ad549c43b557c7da1e4d1a1dcf061b4a5f6c Author: Ranganath V N Date: Sun Oct 26 22:03:12 2025 +0530 net: sctp: fix KMSAN uninit-value in sctp_inq_pop Fix an issue detected by syzbot: KMSAN reported an uninitialized-value access in sctp_inq_pop BUG: KMSAN: uninit-value in sctp_inq_pop The issue is actually caused by skb trimming via sk_filter() in sctp_rcv(). In the reproducer, skb->len becomes 1 after sk_filter(), which bypassed the original check: if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) + skb_transport_offset(skb)) To handle this safely, a new check should be performed after sk_filter(). Reported-by: syzbot+d101e12bccd4095460e7@syzkaller.appspotmail.com Tested-by: syzbot+d101e12bccd4095460e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d101e12bccd4095460e7 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Xin Long Signed-off-by: Ranganath V N Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251026-kmsan_fix-v3-1-2634a409fa5f@gmail.com Signed-off-by: Paolo Abeni commit ad8415a85703a0cc415aef5682c99ed2d9facaf5 Merge: 1ec39d2cd88dac 3575254546a272 Author: Greg Kroah-Hartman Date: Thu Oct 30 10:06:36 2025 +0100 Merge tag 'thunderbolt-for-v6.18-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.18-rc4 This adds PCI ID for Intel Wildcat Lake Thunderbolt/USB4 host controller. This has been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.18-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Add support for Intel Wildcat Lake commit 70e8335485966d7d4ed85976dceab52803b151a2 Author: Abdun Nihaal Date: Tue Oct 28 23:13:39 2025 +0530 wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() The memory allocated for urbs with kcalloc() is not freed on any error path. Fix that by freeing it in the error path. Fixes: e85d0918b54f ("[PATCH] ZyDAS ZD1211 USB-WLAN driver") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251028174341.139134-1-nihaal@cse.iitm.ac.in Signed-off-by: Johannes Berg commit 4f4c654f5a0f6560b938a5ab05ec5940aa6c1c29 Author: Edson Juliano Drosdeck Date: Wed Oct 29 15:11:52 2025 -0300 ALSA: hda/realtek: Enable mic on Vaio RPL Vaio RPL is equipped with ACL256, and needs a fix to make the internal mic and headphone mic to work. Also must to limits the internal microphone boost. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20251029181152.389302-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit a2b32bc1d9e359a9f90d0de6af16699facb10935 Author: Adrian Hunter Date: Fri Oct 24 11:59:18 2025 +0300 scsi: ufs: core: Fix invalid probe error return value After DME Link Startup, the error return value is set to the MIPI UniPro GenericErrorCode which can be 0 (SUCCESS) or 1 (FAILURE). Upon failure during driver probe, the error code 1 is propagated back to the driver probe function which must return a negative value to indicate an error, but 1 is not negative, so the probe is considered to be successful even though it failed. Subsequently, removing the driver results in an oops because it is not in a valid state. This happens because none of the callers of ufshcd_init() expect a non-negative error code. Fix the return value and documentation to match actual usage. Fixes: 69f5eb78d4b0 ("scsi: ufs: core: Move the ufshcd_device_init(hba, true) call") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-5-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit d968e99488c4b08259a324a89e4ed17bf36561a4 Author: Adrian Hunter Date: Fri Oct 24 11:59:17 2025 +0300 scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL Link startup becomes unreliable for Intel Alder Lake based host controllers when a 2nd DME_LINKSTARTUP is issued unnecessarily. Employ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress that from happening. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-4-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit d34caa89a132cd69efc48361d4772251546fdb88 Author: Adrian Hunter Date: Fri Oct 24 11:59:16 2025 +0300 scsi: ufs: core: Add a quirk to suppress link_startup_again ufshcd_link_startup() has a facility (link_startup_again) to issue DME_LINKSTARTUP a 2nd time even though the 1st time was successful. Some older hardware benefits from that, however the behaviour is non-standard, and has been found to cause link startup to be unreliable for some Intel Alder Lake based host controllers. Add UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress link_startup_again, in preparation for setting the quirk for affected controllers. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-3-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit bb44826c3bdbf1fa3957008a04908f45e5666463 Author: Adrian Hunter Date: Fri Oct 24 11:59:15 2025 +0300 scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers Intel platforms with UFS, can support Suspend-to-Idle (S0ix) and Suspend-to-RAM (S3). For S0ix the link state should be HIBERNATE. For S3, state is lost, so the link state must be OFF. Driver policy, expressed by spm_lvl, can be 3 (link HIBERNATE, device SLEEP) for S0ix but must be changed to 5 (link OFF, device POWEROFF) for S3. Fix support for S0ix/S3 by switching spm_lvl as needed. During suspend ->prepare(), if the suspend target state is not Suspend-to-Idle, ensure the spm_lvl is at least 5 to ensure that resume will be possible from deep sleep states. During suspend ->complete(), restore the spm_lvl to its original value that is suitable for S0ix. This fix is first needed in Intel Alder Lake based controllers. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-2-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit f838d624fd1183e07db86f3138bcd05fd7630a1e Author: Bart Van Assche Date: Tue Oct 28 15:24:24 2025 -0700 scsi: ufs: core: Revert "Make HID attributes visible" Patch "Make HID attributes visible" is needed for older kernel versions (e.g. 6.12) where ufs_get_device_desc() is called from ufshcd_probe_hba(). In these older kernel versions ufshcd_get_device_desc() may be called after the sysfs attributes have been added. In the upstream kernel however ufshcd_get_device_desc() is called before ufs_sysfs_add_nodes(). See also the ufshcd_device_params_init() call from ufshcd_init(). Hence, calling sysfs_update_group() is not necessary. See also commit 69f5eb78d4b0 ("scsi: ufs: core: Move the ufshcd_device_init(hba, true) call") in kernel v6.13. This patch fixes the following kernel warning: sysfs: cannot create duplicate filename '/devices/platform/3c2d0000.ufs/hid' Workqueue: async async_run_entry_fn Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0x104 dump_stack+0x18/0x3c sysfs_warn_dup+0x6c/0xc8 internal_create_group+0x1c8/0x504 sysfs_create_groups+0x38/0x9c ufs_sysfs_add_nodes+0x20/0x58 ufshcd_init+0x1114/0x134c ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __device_attach_driver+0x15c/0x1f4 bus_for_each_drv+0x10c/0x168 __device_attach_async_helper+0x80/0xf8 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 ufshcd 3c2d0000.ufs: ufs_sysfs_add_nodes: sysfs groups creation failed (err = -17) Cc: Daniel Lee Cc: Peter Wang Cc: Bjorn Andersson Cc: Neil Armstrong Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Signed-off-by: Bart Van Assche Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Acked-by: Neil Armstrong Reviewed-by: Peter Wang Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251028222433.1108299-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit c57f5fee54dfc83ee1d7f70f7beb9410b8466e9e Author: Nathan Chancellor Date: Sat Oct 25 21:53:20 2025 +0100 libeth: xdp: Disable generic kCFI pass for libeth_xdp_tx_xmit_bulk() When building drivers/net/ethernet/intel/idpf/xsk.c for ARCH=arm with CONFIG_CFI=y using a version of LLVM prior to 22.0.0, there is a BUILD_BUG_ON failure: $ cat arch/arm/configs/repro.config CONFIG_BPF_SYSCALL=y CONFIG_CFI=y CONFIG_IDPF=y CONFIG_XDP_SOCKETS=y $ make -skj"$(nproc)" ARCH=arm LLVM=1 clean defconfig repro.config drivers/net/ethernet/intel/idpf/xsk.o In file included from drivers/net/ethernet/intel/idpf/xsk.c:4: include/net/libeth/xsk.h:205:2: error: call to '__compiletime_assert_728' declared with 'error' attribute: BUILD_BUG_ON failed: !__builtin_constant_p(tmo == libeth_xsktmo) 205 | BUILD_BUG_ON(!__builtin_constant_p(tmo == libeth_xsktmo)); | ^ ... libeth_xdp_tx_xmit_bulk() indirectly calls libeth_xsk_xmit_fill_buf() but these functions are marked as __always_inline so that the compiler can turn these indirect calls into direct ones and see that the tmo parameter to __libeth_xsk_xmit_fill_buf_md() is ultimately libeth_xsktmo from idpf_xsk_xmit(). Unfortunately, the generic kCFI pass in LLVM expands the kCFI bundles from the indirect calls in libeth_xdp_tx_xmit_bulk() in such a way that later optimizations cannot turn these calls into direct ones, making the BUILD_BUG_ON fail because it cannot be proved at compile time that tmo is libeth_xsktmo. Disable the generic kCFI pass for libeth_xdp_tx_xmit_bulk() to ensure these indirect calls can always be turned into direct calls to avoid this error. Closes: https://github.com/ClangBuiltLinux/linux/issues/2124 Fixes: 9705d6552f58 ("idpf: implement Rx path for AF_XDP") Signed-off-by: Nathan Chancellor Reviewed-by: Aleksandr Loktionov Acked-by: Alexander Lobakin Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-3-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 1ed9e6b1004f786d036eaabffb4ee6db9405e117 Author: Nathan Chancellor Date: Sat Oct 25 21:53:19 2025 +0100 ARM: Select ARCH_USES_CFI_GENERIC_LLVM_PASS Prior to clang 22.0.0 [1], ARM did not have an architecture specific kCFI bundle lowering in the backend, which may cause issues. Select CONFIG_ARCH_USES_CFI_GENERIC_LLVM_PASS to enable use of __nocfi_generic. Link: https://github.com/llvm/llvm-project/commit/d130f402642fba3d065aacb506cb061c899558de [1] Link: https://github.com/ClangBuiltLinux/linux/issues/2124 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-2-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 39c89ee6e9c4464eb366f4e594379454a6c4db39 Author: Nathan Chancellor Date: Sat Oct 25 21:53:18 2025 +0100 compiler_types: Introduce __nocfi_generic There are two different ways that LLVM can expand kCFI operand bundles in LLVM IR: generically in the middle end or using an architecture specific sequence when lowering LLVM IR to machine code in the backend. The generic pass allows any architecture to take advantage of kCFI but the expansion of these bundles in the middle end can mess with optimizations that may turn indirect calls into direct calls when the call target is known at compile time, such as after inlining. Add __nocfi_generic, dependent on an architecture selecting CONFIG_ARCH_USES_CFI_GENERIC_LLVM_PASS, to disable kCFI bundle generation in functions where only the generic kCFI pass may cause problems. Link: https://github.com/ClangBuiltLinux/linux/issues/2124 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-1-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 6a2108c78069fda000729b88c97b1eba0405e6d7 Author: Shivaji Kant Date: Wed Oct 29 06:54:19 2025 +0000 net: devmem: refresh devmem TX dst in case of route invalidation The zero-copy Device Memory (Devmem) transmit path relies on the socket's route cache (`dst_entry`) to validate that the packet is being sent via the network device to which the DMA buffer was bound. However, this check incorrectly fails and returns `-ENODEV` if the socket's route cache entry (`dst`) is merely missing or expired (`dst == NULL`). This scenario is observed during network events, such as when flow steering rules are deleted, leading to a temporary route cache invalidation. This patch fixes -ENODEV error for `net_devmem_get_binding()` by doing the following: 1. It attempts to rebuild the route via `rebuild_header()` if the route is initially missing (`dst == NULL`). This allows the TCP/IP stack to recover from transient route cache misses. 2. It uses `rcu_read_lock()` and `dst_dev_rcu()` to safely access the network device pointer (`dst_dev`) from the route, preventing use-after-free conditions if the device is concurrently removed. 3. It maintains the critical safety check by validating that the retrieved destination device (`dst_dev`) is exactly the device registered in the Devmem binding (`binding->dev`). These changes prevent unnecessary ENODEV failures while maintaining the critical safety requirement that the Devmem resources are only used on the bound network device. Reviewed-by: Bobby Eshleman Reported-by: Eric Dumazet Reported-by: Vedant Mathur Suggested-by: Eric Dumazet Fixes: bd61848900bf ("net: devmem: Implement TX path") Signed-off-by: Shivaji Kant Link: https://patch.msgid.link/20251029065420.3489943-1-shivajikant@google.com Signed-off-by: Jakub Kicinski commit a38eeecfe3232283c0ae34d0f4302e5a3e60f3ee Merge: 0dd1be4fe06a1f 48b2e323c018c4 Author: Jakub Kicinski Date: Wed Oct 29 18:49:26 2025 -0700 Merge branch 'net-stmmac-fixes-for-stmmac-tx-vlan-insert-and-est' Rohan G Thomas says: ==================== net: stmmac: Fixes for stmmac Tx VLAN insert and EST This patchset includes following fixes for stmmac Tx VLAN insert and EST implementations: 1. Disable STAG insertion offloading, as DWMAC IPs doesn't support offload of STAG for double VLAN packets and CTAG for single VLAN packets when using the same register configuration. The current configuration in the driver is undocumented and is adding an additional 802.1Q tag with VLAN ID 0 for double VLAN packets. 2. Consider Tx VLAN offload tag length for maxSDU estimation. 3. Fix GCL bounds check ==================== Link: https://patch.msgid.link/20251028-qbv-fixes-v4-0-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit 48b2e323c018c4c908ae5acabff326647bab5240 Author: Rohan G Thomas Date: Tue Oct 28 11:18:45 2025 +0800 net: stmmac: est: Fix GCL bounds checks Fix the bounds checks for the hw supported maximum GCL entry count and gate interval time. Fixes: b60189e0392f ("net: stmmac: Integrate EST with TAPRIO scheduler API") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20251028-qbv-fixes-v4-3-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit ded9813d17d3dd50a08e7a2ca1495769ef9c6673 Author: Rohan G Thomas Date: Tue Oct 28 11:18:44 2025 +0800 net: stmmac: Consider Tx VLAN offload tag length for maxSDU Queue maxSDU requirement of 802.1 Qbv standard requires mac to drop packets that exceeds maxSDU length and maxSDU doesn't include preamble, destination and source address, or FCS but includes ethernet type and VLAN header. On hardware with Tx VLAN offload enabled, VLAN header length is not included in the skb->len, when Tx VLAN offload is requested. This leads to incorrect length checks and allows transmission of oversized packets. Add the VLAN_HLEN to the skb->len before checking the Qbv maxSDU if Tx VLAN offload is requested for the packet. Fixes: c5c3e1bfc9e0 ("net: stmmac: Offload queueMaxSDU from tc-taprio") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20251028-qbv-fixes-v4-2-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit c657f86106c8729240e1f50a62c6606b578ecf20 Author: Rohan G Thomas Date: Tue Oct 28 11:18:43 2025 +0800 net: stmmac: vlan: Disable 802.1AD tag insertion offload The DWMAC IP's VLAN tag insertion offload does not support inserting STAG (802.1AD) and CTAG (802.1Q) types in bytes 13 and 14 using the same MAC_VLAN_Incl and MAC_VLAN_Inner_Incl register configurations. Currently, MAC_VLAN_Incl is configured to offload only STAG type insertion. However, the DWMAC IP inserts a CTAG type when the inner VLAN ID field of the descriptor is not configured, and a STAG type when it is configured. This behavior is not documented and leads to inconsistent double VLAN tagging. Additionally, an unexpected CTAG with VLAN ID 0 is inserted, resulting in frames like: Frame 1: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) Ethernet II, Src: (), Dst: () IEEE 802.1ad, ID: 100 802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 0 (unexpected) 802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 200 Internet Protocol Version 4, Src: 192.168.4.10, Dst: 192.168.4.11 Internet Control Message Protocol To avoid this undocumented and incorrect behavior, disable 802.1AD tag insertion offload. Also, don't set CSVL bit. As per the data book, when this bit is set, S-VLAN type (0x88A8) is inserted in the 13th and 14th bytes of transmitted packets and when this bit is reset, C-VLAN type (0x8100) is inserted in the 13th and 14th bytes of transmitted packets. Fixes: 30d932279dc2 ("net: stmmac: Add support for VLAN Insertion Offload") Fixes: e94e3f3b51ce ("net: stmmac: Add support for VLAN Insertion Offload in GMAC4+") Fixes: 1d2c7a5fee31 ("net: stmmac: Refactor VLAN implementation") Signed-off-by: Rohan G Thomas Reviewed-by: Boon Khai Ng Link: https://patch.msgid.link/20251028-qbv-fixes-v4-1-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit 0dd1be4fe06a1f3a14a517446b49afaa6ac5fa94 Merge: e98cda764aa9c2 426e9da3b28404 Author: Jakub Kicinski Date: Wed Oct 29 18:32:23 2025 -0700 Merge branch 'tls-introduce-and-use-rx-async-resync-request-cancel-function' Tariq Toukan says: ==================== tls: Introduce and use RX async resync request cancel function This series by Shahar introduces RX async resync request cancel function in tls module, and uses it in mlx5e driver. For a device-offloaded TLS RX connection, the TLS module increments rcd_delta each time a new TLS record is received, tracking the distance from the original resync request. In the meanwhile, the device is queried and is expected to respond, asynchronously. However, if the device response is delayed or fails (e.g due to unstable connection and device getting out of tracking, hardware errors, resource exhaustion etc.), the TLS module keeps logging and incrementing rcd_delta, which can lead to a WARN() when rcd_delta exceeds the threshold. This series improves this code area by canceling the resync request when spotting an issue with the device response. ==================== Link: https://patch.msgid.link/1761508983-937977-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 426e9da3b28404b1edcbae401231fb378150d99d Author: Shahar Shitrit Date: Sun Oct 26 22:03:03 2025 +0200 net/mlx5e: kTLS, Cancel RX async resync request in error flows When device loses track of TLS records, it attempts to resync by monitoring records and requests an asynchronous resynchronization from software for this TLS connection. The TLS module handles such device RX resync requests by logging record headers and comparing them with the record tcp_sn when provided by the device. It also increments rcd_delta to track how far the current record tcp_sn is from the tcp_sn of the original resync request. If the device later responds with a matching tcp_sn, the TLS module approves the tcp_sn for resync. However, the device response may be delayed or never arrive, particularly due to traffic-related issues such as packet drops or reordering. In such cases, the TLS module remains unaware that resync will not complete, and continues performing unnecessary work by logging headers and incrementing rcd_delta, which can eventually exceed the threshold and trigger a WARN(). For example, this was observed when the device got out of tracking, causing mlx5e_ktls_handle_get_psv_completion() to fail and ultimately leading to the rcd_delta warning. To address this, call tls_offload_rx_resync_async_request_cancel() to cancel the resync request and stop resync tracking in such error cases. Also, increment the tls_resync_req_skip counter to track these cancellations. Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support") Signed-off-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c15d5c62ab313c19121f10e25d4fec852bd1c40c Author: Shahar Shitrit Date: Sun Oct 26 22:03:02 2025 +0200 net: tls: Cancel RX async resync request on rcd_delta overflow When a netdev issues a RX async resync request for a TLS connection, the TLS module handles it by logging record headers and attempting to match them to the tcp_sn provided by the device. If a match is found, the TLS module approves the tcp_sn for resynchronization. While waiting for a device response, the TLS module also increments rcd_delta each time a new TLS record is received, tracking the distance from the original resync request. However, if the device response is delayed or fails (e.g due to unstable connection and device getting out of tracking, hardware errors, resource exhaustion etc.), the TLS module keeps logging and incrementing, which can lead to a WARN() when rcd_delta exceeds the threshold. To address this, introduce tls_offload_rx_resync_async_request_cancel() to explicitly cancel resync requests when a device response failure is detected. Call this helper also as a final safeguard when rcd_delta crosses its threshold, as reaching this point implies that earlier cancellation did not occur. Signed-off-by: Shahar Shitrit Reviewed-by: Sabrina Dubroca Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 34892cfec0c2d96787c4be7bda0d5f18d7dacf85 Author: Shahar Shitrit Date: Sun Oct 26 22:03:01 2025 +0200 net: tls: Change async resync helpers argument Update tls_offload_rx_resync_async_request_start() and tls_offload_rx_resync_async_request_end() to get a struct tls_offload_resync_async parameter directly, rather than extracting it from struct sock. This change aligns the function signatures with the upcoming tls_offload_rx_resync_async_request_cancel() helper, which will be introduced in a subsequent patch. Signed-off-by: Shahar Shitrit Reviewed-by: Sabrina Dubroca Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e98cda764aa9c27f6810d08bd7bf2e8071535990 Merge: 298574936a6c4e 90918e3b6404c2 Author: Jakub Kicinski Date: Wed Oct 29 18:25:12 2025 -0700 Merge tag 'nf-25-10-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net 1) its not possible to attach conntrack labels via ctnetlink unless one creates a dummy 'ct labels set' rule in nftables. This is an oversight, the 'ruleset tests presence, userspace (netlink) sets' use-case is valid and should 'just work'. Always broken since this got added in Linux 4.7. 2) nft_connlimit reads count value without holding the relevant lock, add a READ_ONCE annotation. From Fernando Fernandez Mancera. 3) There is a long-standing bug (since 4.12) in nftables helper infra when NAT is in use: if the helper gets assigned after the nat binding was set up, we fail to initialise the 'seqadj' extension, which is needed in case NAT payload rewrites need to add (or remove) from the packet payload. Fix from Andrii Melnychenko. * tag 'nf-25-10-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_ct: add seqadj extension for natted connections netfilter: nft_connlimit: fix possible data race on connection count netfilter: nft_ct: enable labels for get case too ==================== Link: https://patch.msgid.link/20251029135617.18274-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 895ad6f7083b0c9f1902b23b84136298a492cbeb Author: Stefan Metzmacher Date: Tue Oct 28 18:43:46 2025 +0100 smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release() With commit b0432201a11b ("smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered") the changes from commit 214bab448476 ("cifs: Call MID callback before destroying transport") and commit 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called") are no longer needed. And it's better to use the same logic flow, so that the chance of smbdirect related problems is smaller. Fixes: 214bab448476 ("cifs: Call MID callback before destroying transport") Fixes: 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit fac56c4651ae95f3f2b468c2cf1884cf0e6d18c1 Author: Paulo Alcantara Date: Thu Oct 23 18:59:47 2025 -0300 smb: client: handle lack of IPC in dfs_cache_refresh() In very rare cases, DFS mounts could end up with SMB sessions without any IPC connections. These mounts are only possible when having unexpired cached DFS referrals, hence not requiring any IPC connections during the mount process. Try to establish those missing IPC connections when refreshing DFS referrals. If the server is still rejecting it, then simply ignore and leave expired cached DFS referral for any potential DFS failovers. Reported-by: Jay Shin Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 298574936a6c4ebbe655e15d971ddb1a96c7dc0b Author: Thanh Quan Date: Mon Oct 27 15:02:43 2025 +0100 net: phy: dp83869: fix STRAP_OPMODE bitmask According to the TI DP83869HM datasheet Revision D (June 2025), section 7.6.1.41 STRAP_STS Register, the STRAP_OPMODE bitmask is bit [11:9]. Fix this. In case the PHY is auto-detected via PHY ID registers, or not described in DT, or, in case the PHY is described in DT but the optional DT property "ti,op-mode" is not present, then the driver reads out the PHY functional mode (RGMII, SGMII, ...) from hardware straps. Currently, all upstream users of this PHY specify both DT compatible string "ethernet-phy-id2000.a0f1" and ti,op-mode = property, therefore it seems no upstream users are affected by this bug. The driver currently interprets bits [2:0] of STRAP_STS register as PHY functional mode. Those bits are controlled by ANEG_DIS, ANEGSEL_0 straps and an always-zero reserved bit. Systems that use RGMII-to-Copper functional mode are unlikely to disable auto-negotiation via ANEG_DIS strap, or change auto-negotiation behavior via ANEGSEL_0 strap. Therefore, even with this bug in place, the STRAP_STS register content is likely going to be interpreted by the driver as RGMII-to-Copper mode. However, for a system with PHY functional mode strapping set to other mode than RGMII-to-Copper, the driver is likely to misinterpret the strapping as RGMII-to-Copper and misconfigure the PHY. For example, on a system with SGMII-to-Copper strapping, the STRAP_STS register reads as 0x0c20, but the PHY ends up being configured for incompatible RGMII-to-Copper mode. Fixes: 0eaf8ccf2047 ("net: phy: dp83869: Set opmode from straps") Reviewed-by: Andrew Lunn Signed-off-by: Thanh Quan Signed-off-by: Hai Pham Signed-off-by: Marek Vasut # Port from U-Boot to Linux Link: https://patch.msgid.link/20251027140320.8996-1-marek.vasut+renesas@mailbox.org Signed-off-by: Jakub Kicinski commit 9311e9540a8b406d9f028aa87fb072a3819d4c82 Author: Po-Hsu Lin Date: Mon Oct 27 17:57:10 2025 +0800 selftests: net: use BASH for bareudp testing In bareudp.sh, this script uses /bin/sh and it will load another lib.sh BASH script at the very beginning. But on some operating systems like Ubuntu, /bin/sh is actually pointed to DASH, thus it will try to run BASH commands with DASH and consequently leads to syntax issues: # ./bareudp.sh: 4: ./lib.sh: Bad substitution # ./bareudp.sh: 5: ./lib.sh: source: not found # ./bareudp.sh: 24: ./lib.sh: Syntax error: "(" unexpected Fix this by explicitly using BASH for bareudp.sh. This fixes test execution failures on systems where /bin/sh is not BASH. Reported-by: Edoardo Canepa Link: https://bugs.launchpad.net/bugs/2129812 Signed-off-by: Po-Hsu Lin Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20251027095710.2036108-2-po-hsu.lin@canonical.com Signed-off-by: Jakub Kicinski commit da2522df3fcc6f57068470cbdcd6516d9eb76b37 Author: Jinliang Wang Date: Sun Oct 26 23:55:30 2025 -0700 net: mctp: Fix tx queue stall The tx queue can become permanently stuck in a stopped state due to a race condition between the URB submission path and its completion callback. The URB completion callback can run immediately after usb_submit_urb() returns, before the submitting function calls netif_stop_queue(). If this occurs, the queue state management becomes desynchronized, leading to a stall where the queue is never woken. Fix this by moving the netif_stop_queue() call to before submitting the URB. This closes the race window by ensuring the network stack is aware the queue is stopped before the URB completion can possibly run. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jinliang Wang Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20251027065530.2045724-1-jinliangw@google.com Signed-off-by: Jakub Kicinski commit 53110232c95ff56067fd96c75a1a1c53d10dcd98 Author: Cosmin Ratiu Date: Sun Oct 26 22:20:19 2025 +0200 net/mlx5: Don't zero user_count when destroying FDB tables esw->user_count tracks how many TC rules are added on an esw via mlx5e_configure_flower -> mlx5_esw_get -> atomic64_inc(&esw->user_count) esw.user_count was unconditionally set to 0 in esw_destroy_legacy_fdb_table and esw_destroy_offloads_fdb_tables. These two together can lead to the following sequence of events: 1. echo 1 > /sys/class/net/eth2/device/sriov_numvfs - mlx5_core_sriov_configure -...-> esw_create_legacy_table -> atomic64_set(&esw->user_count, 0) 2. tc qdisc add dev eth2 ingress && \ tc filter replace dev eth2 pref 1 protocol ip chain 0 ingress \ handle 1 flower action ct nat zone 64000 pipe - mlx5e_configure_flower -> mlx5_esw_get -> atomic64_inc(&esw->user_count) 3. echo 0 > /sys/class/net/eth2/device/sriov_numvfs - mlx5_core_sriov_configure -..-> esw_destroy_legacy_fdb_table -> atomic64_set(&esw->user_count, 0) 4. devlink dev eswitch set pci/0000:08:00.0 mode switchdev - mlx5_devlink_eswitch_mode_set -> mlx5_esw_try_lock -> atomic64_read(&esw->user_count) == 0 - then proceed to a WARN_ON in: esw_offloads_start -> mlx5_eswitch_enable_locke -> esw_offloads_enable -> mlx5_esw_offloads_rep_load -> mlx5e_vport_rep_load -> mlx5e_netdev_change_profile -> mlx5e_detach_netdev -> mlx5e_cleanup_nic_rx -> mlx5e_tc_nic_cleanup -> mlx5e_mod_hdr_tbl_destroy Fix this by not clearing out the user_count when destroying FDB tables, so that the check in mlx5_esw_try_lock can prevent the mode change when there are TC rules configured, as originally intended. Fixes: 2318b8bb94a3 ("net/mlx5: E-switch, Destroy legacy fdb table when needed") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761510019-938772-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit dc89548c6926d68dfdda11bebc1a5258bc41d887 Author: Miaoqian Lin Date: Mon Oct 27 00:43:16 2025 +0800 net: usb: asix_devices: Check return value of usbnet_get_endpoints The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error. Found via static anlaysis and this is similar to commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints"). Fixes: 933a27d39e0e ("USB: asix - Add AX88178 support and many other changes") Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://patch.msgid.link/20251026164318.57624-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit ac345c5fff55262a51dad43bf8724c3d5d1fb006 Merge: 00764aa5c9bbb2 fe11dfa10919ce Author: Jakub Kicinski Date: Wed Oct 29 17:44:30 2025 -0700 Merge branch 'mptcp-various-rare-sending-issues' Matthieu Baerts says: ==================== mptcp: various rare sending issues Here are various fixes from Paolo, addressing very occasional issues on the sending side: - Patch 1: drop an optimisation that could lead to timeout in case of race conditions. A fix for up to v5.11. - Patch 2: fix stream corruption under very specific conditions. A fix for up to v5.13. - Patch 3: restore MPTCP-level zero window probe after a recent fix. A fix for up to v5.16. - Patch 4: new MIB counter to track MPTCP-level zero windows probe to help catching issues similar to the one fixed by the previous patch. ==================== Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit fe11dfa10919ce594682c76f5f648a0840d80a2b Author: Paolo Abeni Date: Tue Oct 28 09:16:55 2025 +0100 mptcp: zero window probe mib Explicitly account for MPTCP-level zero windows probe, to catch hopefully earlier issues alike the one addressed by the previous patch. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-4-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 Author: Paolo Abeni Date: Tue Oct 28 09:16:54 2025 +0100 mptcp: restore window probe Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb. Refine the relevant check tacking in account that the above condition and that such skb can have zero length. Fixes: 72377ab2d671 ("mptcp: more conservative check for zero probes") Cc: stable@vger.kernel.org Reported-by: Geliang Tang Closes: https://lore.kernel.org/d0a814c364e744ca6b836ccd5b6e9146882e8d42.camel@kernel.org Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-3-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 8e04ce45a8db7a080220e86e249198fa676b83dc Author: Paolo Abeni Date: Tue Oct 28 09:16:53 2025 +0100 mptcp: fix MSG_PEEK stream corruption If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the receive queue and recvmsg() need to waits for more data - i.e. it's a blocking one - upon arrival of the next packet the MPTCP protocol will start again copying the oldest data present in the receive queue, corrupting the data stream. Address the issue explicitly tracking the peeked sequence number, restarting from the last peeked byte. Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-2-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b Author: Paolo Abeni Date: Tue Oct 28 09:16:52 2025 +0100 mptcp: drop bogus optimization in __mptcp_check_push() Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data. That in turn could cause unexpected tx lock and timeout. Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses. Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 00764aa5c9bbb2044eb04d6d78584a436666b231 Author: Gustavo Luiz Duarte Date: Tue Oct 28 15:06:32 2025 -0700 netconsole: Fix race condition in between reader and writer of userdata The update_userdata() function constructs the complete userdata string in nt->extradata_complete and updates nt->userdata_length. This data is then read by write_msg() and write_ext_msg() when sending netconsole messages. However, update_userdata() was not holding target_list_lock during this process, allowing concurrent message transmission to read partially updated userdata. This race condition could result in netconsole messages containing incomplete or inconsistent userdata - for example, reading the old userdata_length with new extradata_complete content, or vice versa, leading to truncated or corrupted output. Fix this by acquiring target_list_lock with spin_lock_irqsave() before updating extradata_complete and userdata_length, and releasing it after both fields are fully updated. This ensures that readers see a consistent view of the userdata, preventing corruption during concurrent access. The fix aligns with the existing locking pattern used throughout the netconsole code, where target_list_lock protects access to target fields including buf[] and msgcounter that are accessed during message transmission. Also get rid of the unnecessary variable complete_idx, which makes it easier to bail out of update_userdata(). Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target") Signed-off-by: Gustavo Luiz Duarte Link: https://patch.msgid.link/20251028-netconsole-fix-race-v4-1-63560b0ae1a0@meta.com Signed-off-by: Jakub Kicinski commit a43303809868b22bd1303739ba334e982b234d45 Author: Bagas Sanjaya Date: Tue Oct 28 20:20:27 2025 +0700 Documentation: netconsole: Remove obsolete contact people Breno Leitao has been listed in MAINTAINERS as netconsole maintainer since 7c938e438c56db ("MAINTAINERS: make Breno the netconsole maintainer"), but the documentation says otherwise that bug reports should be sent to original netconsole authors. Remove obsolate contact info. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20251028132027.48102-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit a4384d786e38d5ff172f0908aae01c2c30719245 Author: Abdun Nihaal Date: Tue Oct 28 21:38:41 2025 +0530 nfp: xsk: fix memory leak in nfp_net_alloc() In nfp_net_alloc(), the memory allocated for xsk_pools is not freed in the subsequent error paths, leading to a memory leak. Fix that by freeing it in the error path. Fixes: 6402528b7a0b ("nfp: xsk: add AF_XDP zero-copy Rx and Tx support") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251028160845.126919-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit bcc843bb0e7468de7f2de8bc2e3fa5a54dd1f3d0 Merge: f99c579211f5c7 aa251c84636c32 Author: Jakub Kicinski Date: Wed Oct 29 17:30:45 2025 -0700 Merge branch 'tcp-fix-receive-autotune-again' Matthieu Baerts says: ==================== tcp: fix receive autotune again Neal Cardwell found that recent kernels were having RWIN limited issues, even when net.ipv4.tcp_rmem[2] was set to a very big value like 512MB. He suspected that tcp_stream default buffer size (64KB) was triggering heuristic added in ea33537d8292 ("tcp: add receive queue awareness in tcp_rcv_space_adjust()"). After more testing, it turns out the bug was added earlier with commit 65c5287892e9 ("tcp: fix sk_rcvbuf overshoot"). I forgot once again that DRS has one RTT latency. MPTCP also got the same issue. This series : - Prevents calling tcp_rcvbuf_grow() on some MPTCP subflows. - adds rcv_ssthresh, window_clamp and rcv_wnd to trace_tcp_rcvbuf_grow(). - Refactors code in a patch with no functional changes. - Fixes the issue in the final patch. ==================== Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-0-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit aa251c84636c326471ca9d53723816ba8fffe2bf Author: Eric Dumazet Date: Tue Oct 28 12:58:02 2025 +0100 tcp: fix too slow tcp_rcvbuf_grow() action While the blamed commits apparently avoided an overshoot, they also limited how fast a sender can increase BDP at each RTT. This is not exactly a revert, we do not add the 16 * tp->advmss cushion we had, and we are keeping the out_of_order_queue contribution. Do the same in mptcp_rcvbuf_grow(). Tested: emulated 50ms rtt (tcp_stream --tcp-tx-delay 50000), cubic 20 second flow. net.ipv4.tcp_rmem set to "4096 131072 67000000" perf record -a -e tcp:tcp_rcvbuf_grow sleep 20 perf script Before: We can see we fail to roughly double RWIN at each RTT. Sender is RWIN limited while CWND is ramping up (before getting tcp_wmem limited). tcp_stream 33793 [010] 825.717525: tcp:tcp_rcvbuf_grow: time=100869 rtt_us=50428 copied=49152 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=103970 window_clamp=112128 rcv_wnd=106496 tcp_stream 33793 [010] 825.768966: tcp:tcp_rcvbuf_grow: time=51447 rtt_us=50362 copied=86016 inq=0 space=49152 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=107474 window_clamp=112128 rcv_wnd=106496 tcp_stream 33793 [010] 825.821539: tcp:tcp_rcvbuf_grow: time=52577 rtt_us=50243 copied=114688 inq=0 space=86016 ooo=0 scaling_ratio=219 rcvbuf=201096 rcv_ssthresh=167377 window_clamp=172031 rcv_wnd=167936 tcp_stream 33793 [010] 825.871781: tcp:tcp_rcvbuf_grow: time=50248 rtt_us=50237 copied=167936 inq=0 space=114688 ooo=0 scaling_ratio=219 rcvbuf=268129 rcv_ssthresh=224722 window_clamp=229375 rcv_wnd=225280 tcp_stream 33793 [010] 825.922475: tcp:tcp_rcvbuf_grow: time=50698 rtt_us=50183 copied=241664 inq=0 space=167936 ooo=0 scaling_ratio=219 rcvbuf=392617 rcv_ssthresh=331217 window_clamp=335871 rcv_wnd=323584 tcp_stream 33793 [010] 825.973326: tcp:tcp_rcvbuf_grow: time=50855 rtt_us=50213 copied=339968 inq=0 space=241664 ooo=0 scaling_ratio=219 rcvbuf=564986 rcv_ssthresh=478674 window_clamp=483327 rcv_wnd=462848 tcp_stream 33793 [010] 826.023970: tcp:tcp_rcvbuf_grow: time=50647 rtt_us=50248 copied=491520 inq=0 space=339968 ooo=0 scaling_ratio=219 rcvbuf=794811 rcv_ssthresh=671778 window_clamp=679935 rcv_wnd=651264 tcp_stream 33793 [010] 826.074612: tcp:tcp_rcvbuf_grow: time=50648 rtt_us=50227 copied=700416 inq=0 space=491520 ooo=0 scaling_ratio=219 rcvbuf=1149124 rcv_ssthresh=974881 window_clamp=983039 rcv_wnd=942080 tcp_stream 33793 [010] 826.125452: tcp:tcp_rcvbuf_grow: time=50845 rtt_us=50225 copied=987136 inq=8192 space=700416 ooo=0 scaling_ratio=219 rcvbuf=1637502 rcv_ssthresh=1392674 window_clamp=1400831 rcv_wnd=1339392 tcp_stream 33793 [010] 826.175698: tcp:tcp_rcvbuf_grow: time=50250 rtt_us=50198 copied=1347584 inq=0 space=978944 ooo=0 scaling_ratio=219 rcvbuf=2288672 rcv_ssthresh=1949729 window_clamp=1957887 rcv_wnd=1945600 tcp_stream 33793 [010] 826.225947: tcp:tcp_rcvbuf_grow: time=50252 rtt_us=50240 copied=1945600 inq=0 space=1347584 ooo=0 scaling_ratio=219 rcvbuf=3150516 rcv_ssthresh=2687010 window_clamp=2695167 rcv_wnd=2691072 tcp_stream 33793 [010] 826.276175: tcp:tcp_rcvbuf_grow: time=50233 rtt_us=50224 copied=2691072 inq=0 space=1945600 ooo=0 scaling_ratio=219 rcvbuf=4548617 rcv_ssthresh=3883041 window_clamp=3891199 rcv_wnd=3887104 tcp_stream 33793 [010] 826.326403: tcp:tcp_rcvbuf_grow: time=50233 rtt_us=50229 copied=3887104 inq=0 space=2691072 ooo=0 scaling_ratio=219 rcvbuf=6291456 rcv_ssthresh=5370482 window_clamp=5382144 rcv_wnd=5373952 tcp_stream 33793 [010] 826.376723: tcp:tcp_rcvbuf_grow: time=50323 rtt_us=50218 copied=5373952 inq=0 space=3887104 ooo=0 scaling_ratio=219 rcvbuf=9087658 rcv_ssthresh=7755537 window_clamp=7774207 rcv_wnd=7757824 tcp_stream 33793 [010] 826.426991: tcp:tcp_rcvbuf_grow: time=50274 rtt_us=50196 copied=7757824 inq=180224 space=5373952 ooo=0 scaling_ratio=219 rcvbuf=12563759 rcv_ssthresh=10729233 window_clamp=10747903 rcv_wnd=10575872 tcp_stream 33793 [010] 826.477229: tcp:tcp_rcvbuf_grow: time=50241 rtt_us=50078 copied=10731520 inq=180224 space=7577600 ooo=0 scaling_ratio=219 rcvbuf=17715667 rcv_ssthresh=15136529 window_clamp=15155199 rcv_wnd=14983168 tcp_stream 33793 [010] 826.527482: tcp:tcp_rcvbuf_grow: time=50258 rtt_us=50153 copied=15138816 inq=360448 space=10551296 ooo=0 scaling_ratio=219 rcvbuf=24667870 rcv_ssthresh=21073410 window_clamp=21102591 rcv_wnd=20766720 tcp_stream 33793 [010] 826.577712: tcp:tcp_rcvbuf_grow: time=50234 rtt_us=50228 copied=21073920 inq=0 space=14778368 ooo=0 scaling_ratio=219 rcvbuf=34550339 rcv_ssthresh=29517041 window_clamp=29556735 rcv_wnd=29519872 tcp_stream 33793 [010] 826.627982: tcp:tcp_rcvbuf_grow: time=50275 rtt_us=50220 copied=29519872 inq=540672 space=21073920 ooo=0 scaling_ratio=219 rcvbuf=49268707 rcv_ssthresh=42090625 window_clamp=42147839 rcv_wnd=41627648 tcp_stream 33793 [010] 826.678274: tcp:tcp_rcvbuf_grow: time=50296 rtt_us=50185 copied=42053632 inq=761856 space=28979200 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57238168 window_clamp=57316406 rcv_wnd=56606720 tcp_stream 33793 [010] 826.728627: tcp:tcp_rcvbuf_grow: time=50357 rtt_us=50128 copied=43913216 inq=851968 space=41291776 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56524800 tcp_stream 33793 [010] 827.131364: tcp:tcp_rcvbuf_grow: time=50239 rtt_us=50127 copied=43843584 inq=655360 space=43061248 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56696832 tcp_stream 33793 [010] 827.181613: tcp:tcp_rcvbuf_grow: time=50254 rtt_us=50115 copied=43843584 inq=524288 space=43188224 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56807424 tcp_stream 33793 [010] 828.339635: tcp:tcp_rcvbuf_grow: time=50283 rtt_us=50110 copied=43843584 inq=458752 space=43319296 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56864768 tcp_stream 33793 [010] 828.440350: tcp:tcp_rcvbuf_grow: time=50404 rtt_us=50099 copied=43843584 inq=393216 space=43384832 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56922112 tcp_stream 33793 [010] 829.195106: tcp:tcp_rcvbuf_grow: time=50154 rtt_us=50077 copied=43843584 inq=196608 space=43450368 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=57090048 After: It takes few steps to increase RWIN. Sender is no longer RWIN limited. tcp_stream 50826 [010] 935.634212: tcp:tcp_rcvbuf_grow: time=100788 rtt_us=50315 copied=49152 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=103970 window_clamp=112128 rcv_wnd=106496 tcp_stream 50826 [010] 935.685642: tcp:tcp_rcvbuf_grow: time=51437 rtt_us=50361 copied=86016 inq=0 space=49152 ooo=0 scaling_ratio=219 rcvbuf=160875 rcv_ssthresh=132969 window_clamp=137623 rcv_wnd=131072 tcp_stream 50826 [010] 935.738299: tcp:tcp_rcvbuf_grow: time=52660 rtt_us=50256 copied=139264 inq=0 space=86016 ooo=0 scaling_ratio=219 rcvbuf=502741 rcv_ssthresh=411497 window_clamp=430079 rcv_wnd=413696 tcp_stream 50826 [010] 935.788544: tcp:tcp_rcvbuf_grow: time=50249 rtt_us=50233 copied=307200 inq=0 space=139264 ooo=0 scaling_ratio=219 rcvbuf=728690 rcv_ssthresh=618717 window_clamp=623371 rcv_wnd=618496 tcp_stream 50826 [010] 935.838796: tcp:tcp_rcvbuf_grow: time=50258 rtt_us=50202 copied=618496 inq=0 space=307200 ooo=0 scaling_ratio=219 rcvbuf=2450338 rcv_ssthresh=1855709 window_clamp=2096187 rcv_wnd=1859584 tcp_stream 50826 [010] 935.889140: tcp:tcp_rcvbuf_grow: time=50347 rtt_us=50166 copied=1261568 inq=0 space=618496 ooo=0 scaling_ratio=219 rcvbuf=4376503 rcv_ssthresh=3725291 window_clamp=3743961 rcv_wnd=3706880 tcp_stream 50826 [010] 935.939435: tcp:tcp_rcvbuf_grow: time=50300 rtt_us=50185 copied=2478080 inq=24576 space=1261568 ooo=0 scaling_ratio=219 rcvbuf=9082648 rcv_ssthresh=7733731 window_clamp=7769921 rcv_wnd=7692288 tcp_stream 50826 [010] 935.989681: tcp:tcp_rcvbuf_grow: time=50251 rtt_us=50221 copied=4915200 inq=114688 space=2453504 ooo=0 scaling_ratio=219 rcvbuf=16574936 rcv_ssthresh=14108110 window_clamp=14179339 rcv_wnd=14024704 tcp_stream 50826 [010] 936.039967: tcp:tcp_rcvbuf_grow: time=50289 rtt_us=50279 copied=9830400 inq=114688 space=4800512 ooo=0 scaling_ratio=219 rcvbuf=32695050 rcv_ssthresh=27896187 window_clamp=27969593 rcv_wnd=27815936 tcp_stream 50826 [010] 936.090172: tcp:tcp_rcvbuf_grow: time=50211 rtt_us=50200 copied=19841024 inq=114688 space=9715712 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57245176 window_clamp=57316406 rcv_wnd=57163776 tcp_stream 50826 [010] 936.140430: tcp:tcp_rcvbuf_grow: time=50262 rtt_us=50197 copied=39501824 inq=114688 space=19726336 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57245176 window_clamp=57316406 rcv_wnd=57163776 tcp_stream 50826 [010] 936.190527: tcp:tcp_rcvbuf_grow: time=50101 rtt_us=50071 copied=43655168 inq=262144 space=39387136 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57032704 tcp_stream 50826 [010] 936.240719: tcp:tcp_rcvbuf_grow: time=50197 rtt_us=50057 copied=43843584 inq=262144 space=43393024 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57032704 tcp_stream 50826 [010] 936.341271: tcp:tcp_rcvbuf_grow: time=50297 rtt_us=50123 copied=43843584 inq=131072 space=43581440 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57147392 tcp_stream 50826 [010] 936.642503: tcp:tcp_rcvbuf_grow: time=50131 rtt_us=50084 copied=43843584 inq=0 space=43712512 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57262080 Fixes: 65c5287892e9 ("tcp: fix sk_rcvbuf overshoot") Fixes: e118cdc34dd1 ("mptcp: rcvbuf auto-tuning improvement") Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/589 Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-4-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit b1e014a1f3275a6f3d0f2b30b8117447fc3915f5 Author: Eric Dumazet Date: Tue Oct 28 12:58:01 2025 +0100 tcp: add newval parameter to tcp_rcvbuf_grow() This patch has no functional change, and prepares the following one. tcp_rcvbuf_grow() will need to have access to tp->rcvq_space.space old and new values. Change mptcp_rcvbuf_grow() in a similar way. Signed-off-by: Eric Dumazet [ Moved 'oldval' declaration to the next patch to avoid warnings at build time. ] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-3-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit 24990d89c23de4dbef6b0b3d58383cafefdd6983 Author: Eric Dumazet Date: Tue Oct 28 12:58:00 2025 +0100 trace: tcp: add three metrics to trace_tcp_rcvbuf_grow() While chasing yet another receive autotuning bug, I found useful to add rcv_ssthresh, window_clamp and rcv_wnd. tcp_stream 40597 [068] 2172.978198: tcp:tcp_rcvbuf_grow: time=50307 rtt_us=50179 copied=77824 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=107474 window_clamp=112128 rcv_wnd=110592 tcp_stream 40597 [068] 2173.028528: tcp:tcp_rcvbuf_grow: time=50336 rtt_us=50206 copied=110592 inq=0 space=77824 ooo=0 scaling_ratio=219 rcvbuf=509444 rcv_ssthresh=328658 window_clamp=435813 rcv_wnd=331776 tcp_stream 40597 [068] 2173.078830: tcp:tcp_rcvbuf_grow: time=50305 rtt_us=50070 copied=270336 inq=0 space=110592 ooo=0 scaling_ratio=219 rcvbuf=509444 rcv_ssthresh=431159 window_clamp=435813 rcv_wnd=434176 tcp_stream 40597 [068] 2173.129137: tcp:tcp_rcvbuf_grow: time=50313 rtt_us=50118 copied=434176 inq=0 space=270336 ooo=0 scaling_ratio=219 rcvbuf=2457847 rcv_ssthresh=1299511 window_clamp=2102611 rcv_wnd=1302528 tcp_stream 40597 [068] 2173.179451: tcp:tcp_rcvbuf_grow: time=50318 rtt_us=50041 copied=1019904 inq=0 space=434176 ooo=0 scaling_ratio=219 rcvbuf=2457847 rcv_ssthresh=2087445 window_clamp=2102611 rcv_wnd=2088960 Signed-off-by: Eric Dumazet Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-2-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit a6f0459aadf1b41a9b9fae02006b1db024d60856 Author: Paolo Abeni Date: Tue Oct 28 12:57:59 2025 +0100 mptcp: fix subflow rcvbuf adjust The mptcp PM can add subflow to the conn_list before tcp_init_transfer(). Calling tcp_rcvbuf_grow() on such subflow is not correct as later init will overwrite the update. Fix the issue calling tcp_rcvbuf_grow() only after init buffer initialization. Fixes: e118cdc34dd1 ("mptcp: rcvbuf auto-tuning improvement") Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-1-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit f99c579211f5c77da6750b90c6bec9b264188120 Merge: 8df206f7b63611 f82acf6fb42115 Author: Jakub Kicinski Date: Wed Oct 29 17:23:11 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-10-28 (ice, ixgbe, igb, igc) For ice, Grzegorz fixes setting of PHY lane number and logical PF ID for E82x devices. He also corrects access of CGU (Clock Generation Unit) on dual complex devices. Kohei Enju resolves issues with error path cleanup for probe when in recovery mode on ixgbe and ensures PHY is powered on for link testing on igc. Lastly, he converts incorrect use of -ENOTSUPP to -EOPNOTSUPP on igb, igc, and ixgbe. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: use EOPNOTSUPP instead of ENOTSUPP in ixgbe_ptp_feature_enable() igc: use EOPNOTSUPP instead of ENOTSUPP in igc_ethtool_get_sset_count() igb: use EOPNOTSUPP instead of ENOTSUPP in igb_get_sset_count() igc: power up the PHY before the link test ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() ice: fix usage of logical PF id ice: fix destination CGU for dual complex E825 ice: fix lane number calculation ==================== Link: https://patch.msgid.link/20251028202515.675129-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f3903ec76ae6afcdba0347681d1dda005fb145cd Author: Rae Moar Date: Tue Oct 28 19:40:10 2025 +0000 MAINTAINERS: Update KUnit email address for Rae Moar Update Rae's email address for the KUnit entry. Also add an entry to .mailmap to map former google email to current gmail address. Signed-off-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Shuah Khan commit d8eb00bbc628c8916ab0da2bb80059d48aa4512e Author: Sebastian Fleer Date: Wed Oct 29 13:35:28 2025 +0100 drm/panel: kingdisplay-kd097d04: Disable EoTp Since commit d97e71e44937 ("drm/bridge: synopsys: dw-mipi-dsi: enable EoTp by default") panel output on an Acer Chromebook Tab 10 (google-dru) is corrupted. The tablet I use is equipped with a kingdisplay-kd097d04 panel, disabling EoTp restores the correct functionality. Fixes: 2a994cbed6b2 ("drm/panel: Add Kingdisplay KD097D04 panel driver") Suggested-by: Jens Reidel Signed-off-by: Sebastian Fleer Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20251029124007.232333-1-dev@dwurp.de commit 056d76f7cb9fa68c8bbf85b4055aeb84af6139d5 Author: Sebastian Reichel Date: Wed Oct 1 01:59:42 2025 +0200 drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 I planned to set the polarity of horizontal and vertical sync, but accidentally described vertical sync twice with different polarity instead. Note, that there is no functional change, because the driver only makes use of DRM_MODE_FLAG_P[HV]SYNC to divert from the default active-low polarity. Reported-by: Laurent Pinchart Closes: https://lore.kernel.org/all/20250923132616.GH20765@pendragon.ideasonboard.com/ Fixes: a411558cc143 ("drm/panel: sitronix-st7789v: add Inanbo T28CP45TN89 support") Reviewed-by: Laurent Pinchart Reviewed-by: Marek Vasut Signed-off-by: Sebastian Reichel Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20251001-t28cp45tn89-fix-v2-1-67fe8e3046ca@collabora.com commit b3fbda1a630a9439c885b2a5dc5230cc49a87e9e Author: Matthew Brost Date: Tue Oct 21 17:55:37 2025 -0700 drm/xe: Do not wake device during a GT reset Waking the device during a GT reset can lead to unintended memory allocation, which is not allowed since GT resets occur in the reclaim path. Prevent this by holding a PM reference while a reset is in flight. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20251022005538.828980-3-matthew.brost@intel.com (cherry picked from commit 480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4) Signed-off-by: Lucas De Marchi commit 35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d Author: Rafael J. Wysocki Date: Tue Oct 28 21:52:31 2025 +0100 PM: sleep: Allow pm_restrict_gfp_mask() stacking Allow pm_restrict_gfp_mask() to be called many times in a row to avoid issues with calling dpm_suspend_start() when the GFP mask has been already restricted. Only the first invocation of pm_restrict_gfp_mask() will actually restrict the GFP mask and the subsequent calls will warn if there is a mismatch between the expected allowed GFP mask and the actual one. Moreover, if pm_restrict_gfp_mask() is called many times in a row, pm_restore_gfp_mask() needs to be called matching number of times in a row to actually restore the GFP mask. Calling it when the GFP mask has not been restricted will cause it to warn. This is necessary for the GFP mask restriction starting in hibernation_snapshot() to continue throughout the entire hibernation flow until it completes or it is aborted (either by a wakeup event or by an error). Fixes: 449c9c02537a1 ("PM: hibernate: Restrict GFP mask in hibernation_snapshot()") Fixes: 469d80a3712c ("PM: hibernate: Fix hybrid-sleep") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251025050812.421905-1-safinaskar@gmail.com/ Link: https://lore.kernel.org/linux-pm/20251028111730.2261404-1-safinaskar@gmail.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Tested-by: Mario Limonciello (AMD) Cc: 6.16+ # 6.16+ Link: https://patch.msgid.link/5935682.DvuYhMxLoT@rafael.j.wysocki commit edce042da7984586ea5c7ed18ea5f58002afb969 Author: Thomas Hellström Date: Mon Oct 27 14:12:28 2025 +0100 drm/xe: Fix uninitialized return value from xe_validation_guard() the DEFINE_CLASS() macro creates an inline function and the init args are passed down to it; since _ret is passed as an int, whatever value is set inside the function is not visible to the caller. Pass _ret as a pointer so its value propagates to the caller. Fixes: c460bc2311df ("drm/xe: Introduce an xe_validation wrapper around drm_exec") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6220 Cc: Maarten Lankhorst Cc: Matthew Brost Cc: intel-xe@lists.freedesktop.org Signed-off-by: Thomas Hellström Reviewed-by: Lucas De Marchi Reviewed-by: Maarten Lankhorst Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251027131228.12098-1-thomas.hellstrom@linux.intel.com (cherry picked from commit fcb8c304f4673747d535c74b340b5b8a4823727b) Signed-off-by: Lucas De Marchi commit f4fa7c25f632cd925352b4d46f245653a23b1d1a Author: Andrea Righi Date: Wed Oct 29 14:08:43 2025 +0100 sched_ext: Fix use of uninitialized variable in scx_bpf_cpuperf_set() scx_bpf_cpuperf_set() has a typo where it dereferences the local variable @sch, instead of the global @scx_root pointer. Fix by dereferencing the correct variable. Fixes: 956f2b11a8a4f ("sched_ext: Drop kf_cpu_valid()") Signed-off-by: Andrea Righi Reviewed-by: Christian Loehle Signed-off-by: Tejun Heo commit 9222582ec524707fbb9d076febead5b6a07611ed Author: Miaoqing Pan Date: Tue Oct 28 14:07:44 2025 +0800 Revert "wifi: ath12k: Fix missing station power save configuration" This reverts commit 4b66d18918f8e4d85e51974a9e3ce9abad5c7c3d. In [1], Ross Brown reports poor performance of WCN7850 after enabling power save. Temporarily revert the fix; it will be re-enabled once the issue is resolved. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: 4b66d18918f8 ("wifi: ath12k: Fix missing station power save configuration") Reported-by: Ross Brown Closes: https://lore.kernel.org/all/CAMn66qZENLhDOcVJuwUZ3ir89PVtVnQRq9DkV5xjJn1p6BKB9w@mail.gmail.com/ # [1] Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251028060744.897198-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 9db8d46712d274a27d1d22c38e70211f20d508c2 Author: Andy Shevchenko Date: Fri Oct 24 15:23:36 2025 +0200 mnt: Remove dead code which might prevent from building Clang, in particular, is not happy about dead code: fs/namespace.c:135:37: error: unused function 'node_to_mnt_ns' [-Werror,-Wunused-function] 135 | static inline struct mnt_namespace *node_to_mnt_ns(const struct rb_node *node) | ^~~~~~~~~~~~~~ 1 error generated. Remove a leftover from the previous cleanup. Fixes: 7d7d16498958 ("mnt: support ns lookup") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251024132336.1666382-1-andriy.shevchenko@linux.intel.com Signed-off-by: Christian Brauner commit 5e5c8aa73d99f1daa9f2ec1474b7fc1a6952764b Author: Srinivas Kandagatla Date: Wed Oct 29 14:46:36 2025 +0000 ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports For some reason we ended up limiting the number of soundwire ports to 2 in the bindings, the actual codec supports 4 rx and 5 tx ports. Fixes: 88d0d17192c5 ("ASoC: dt-bindings: add bindings for pm4125 audio codec") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251029144636.357203-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 22897e568646de5907d4981eae6cc895be2978d1 Author: Claudiu Beznea Date: Wed Oct 29 16:11:34 2025 +0200 ASoC: renesas: rz-ssi: Use proper dma_buffer_pos after resume When the driver supports DMA, it enqueues four DMA descriptors per substream before the substream is started. New descriptors are enqueued in the DMA completion callback, and each time a new descriptor is queued, the dma_buffer_pos is incremented. During suspend, the DMA transactions are terminated. There might be cases where the four extra enqueued DMA descriptors are not completed and are instead canceled on suspend. However, the cancel operation does not take into account that the dma_buffer_pos was already incremented. Previously, the suspend code reinitialized dma_buffer_pos to zero, but this is not always correct. To avoid losing any audio periods during suspend/resume and to prevent clip sound, save the completed DMA buffer position in the DMA callback and reinitialize dma_buffer_pos on resume. Cc: stable@vger.kernel.org Fixes: 1fc778f7c833a ("ASoC: renesas: rz-ssi: Add suspend to RAM support") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251029141134.2556926-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 90918e3b6404c2a37837b8f11692471b4c512de2 Author: Andrii Melnychenko Date: Fri Oct 24 18:22:16 2025 +0200 netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq. The easiest way to reproduce this issue is with PASV mode. Example ruleset: table inet ftp_nat { ct helper ftp_helper { type "ftp" protocol tcp l3proto inet } chain prerouting { type filter hook prerouting priority 0; policy accept; tcp dport 21 ct state new ct helper set "ftp_helper" } } table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; tcp dport 21 dnat ip prefix to ip daddr map { 192.168.100.1 : 192.168.13.2/32 } } chain postrouting { type nat hook postrouting priority 100 ; policy accept; tcp sport 21 snat ip prefix to ip saddr map { 192.168.13.2 : 192.168.100.1/32 } } } Note that the ftp helper gets assigned *after* the dnat setup. The inverse (nat after helper assign) is handled by an existing check in nf_nat_setup_info() and will not show the problem. Topoloy: +-------------------+ +----------------------------------+ | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 | +-------------------+ +----------------------------------+ | +-----------------------+ | Client: 192.168.100.2 | +-----------------------+ ftp nat changes do not work as expected in this case: Connected to 192.168.100.1. [..] ftp> epsv EPSV/EPRT on IPv4 off. ftp> ls 227 Entering passive mode (192,168,100,1,209,129). 421 Service not available, remote server has closed connection. Kernel logs: Missing nfct_seqadj_ext_add() setup call WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41 [..] __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat] nf_nat_ftp+0x142/0x280 [nf_nat_ftp] help+0x4d1/0x880 [nf_conntrack_ftp] nf_confirm+0x122/0x2e0 [nf_conntrack] nf_hook_slow+0x3c/0xb0 .. Fix this by adding the required extension when a conntrack helper is assigned to a connection that has a nat binding. Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support") Signed-off-by: Andrii Melnychenko Signed-off-by: Florian Westphal commit 8d96dfdcabef00e28f0c851b1502adb679dfc6d9 Author: Fernando Fernandez Mancera Date: Fri Oct 24 17:54:39 2025 +0200 netfilter: nft_connlimit: fix possible data race on connection count nft_connlimit_eval() reads priv->list->count to check if the connection limit has been exceeded. This value is being read without a lock and can be modified by a different process. Use READ_ONCE() for correctness. Fixes: df4a90250976 ("netfilter: nf_conncount: merge lookup and add functions") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 514f1dc8f2ca3101e04cdf452e53baca3a76e544 Author: Florian Westphal Date: Wed Oct 22 17:18:10 2025 +0200 netfilter: nft_ct: enable labels for get case too conntrack labels can only be set when the conntrack has been created with the "ctlabel" extension. For older iptables (connlabel match), adding an "-m connlabel" rule turns on the ctlabel extension allocation for all future conntrack entries. For nftables, its only enabled for 'ct label set foo', but not for 'ct label foo' (i.e. check). But users could have a ruleset that only checks for presence, and rely on userspace to set a label bit via ctnetlink infrastructure. This doesn't work without adding a dummy 'ct label set' rule. We could also enable extension infra for the first (failing) ctnetlink request, but unlike ruleset we would not be able to disable the extension again. Therefore turn on ctlabel extension allocation if an nftables ruleset checks for a connlabel too. Fixes: 1ad8f48df6f6 ("netfilter: nftables: add connlabel set support") Reported-by: Antonio Ojea Closes: https://lore.kernel.org/netfilter-devel/aPi_VdZpVjWujZ29@strlen.de/ Signed-off-by: Florian Westphal commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 Author: Tetsuo Handa Date: Thu Oct 23 22:25:49 2025 +0900 bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory). Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp Reviewed-by: Tigran Aivazian Signed-off-by: Christian Brauner commit 07ad45e06b4039adf96882aefcb1d3299fb7c305 Author: Miaoqian Lin Date: Mon Oct 27 23:08:38 2025 +0800 s390/mm: Fix memory leak in add_marker() when kvrealloc() fails The function has a memory leak when kvrealloc() fails. The function directly assigns NULL to the markers pointer, losing the reference to the previously allocated memory. This causes kvfree() in pt_dump_init() to free NULL instead of the leaked memory. Fix by: 1. Using kvrealloc() uniformly for all allocations 2. Using a temporary variable to preserve the original pointer until allocation succeeds 3. Removing the error path that sets markers_cnt=0 to keep consistency between markers and markers_cnt Found via static analysis and this is similar to commit 42378a9ca553 ("bpf, verifier: Fix memory leak in array reallocation for stack state") Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Heiko Carstens commit e7dbfe6f15b4df34bb169d180bd10f1a3c043814 Author: Heikki Krogerus Date: Wed Oct 29 07:50:20 2025 +0100 spi: intel: Add support for Oak Stream SPI serial flash Add Oak Stream PCI ID to the driver list of supported devices. This patch was originally written by Zeng Guang. Signed-off-by: Heikki Krogerus Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251029065020.2920213-1-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 330e2c514823008b22e6afd2055715bc46dd8d55 Author: David Howells Date: Wed Oct 22 19:48:32 2025 +0100 afs: Fix dynamic lookup to fail on cell lookup failure When a process tries to access an entry in /afs, normally what happens is that an automount dentry is created by ->lookup() and then triggered, which jumps through the ->d_automount() op. Currently, afs_dynroot_lookup() does not do cell DNS lookup, leaving that to afs_d_automount() to perform - however, it is possible to use access() or stat() on the automount point, which will always return successfully, have briefly created an afs_cell record if one did not already exist. This means that something like: test -d "/afs/.west" && echo Directory exists will print "Directory exists" even though no such cell is configured. This breaks the "west" python module available on PIP as it expects this access to fail. Now, it could be possible to make afs_dynroot_lookup() perform the DNS[*] lookup, but that would make "ls --color /afs" do this for each cell in /afs that is listed but not yet probed. kafs-client, probably wrongly, preloads the entire cell database and all the known cells are then listed in /afs - and doing ls /afs would be very, very slow, especially if any cell supplied addresses but was wholly inaccessible. [*] When I say "DNS", actually read getaddrinfo(), which could use any one of a host of mechanisms. Could also use static configuration. To fix this, make the following changes: (1) Create an enum to specify the origination point of a call to afs_lookup_cell() and pass this value into that function in place of the "excl" parameter (which can be derived from it). There are six points of origination: - Cell preload through /proc/net/afs/cells - Root cell config through /proc/net/afs/rootcell - Lookup in dynamic root - Automount trigger - Direct mount with mount() syscall - Alias check where YFS tells us the cell name is different (2) Add an extra state into the afs_cell state machine to indicate a cell that's been initialised, but not yet looked up. This is separate from one that can be considered active and has been looked up at least once. (3) Make afs_lookup_cell() vary its behaviour more, depending on where it was called from: If called from preload or root cell config, DNS lookup will not happen until we definitely want to use the cell (dynroot mount, automount, direct mount or alias check). The cell will appear in /afs but stat() won't trigger DNS lookup. If the cell already exists, dynroot will not wait for the DNS lookup to complete. If the cell did not already exist, dynroot will wait. If called from automount, direct mount or alias check, it will wait for the DNS lookup to complete. (4) Make afs_lookup_cell() return an error if lookup failed in one way or another. We try to return -ENOENT if the DNS says the cell does not exist and -EDESTADDRREQ if we couldn't access the DNS. Reported-by: Markus Suvanto Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220685 Signed-off-by: David Howells Link: https://patch.msgid.link/1784747.1761158912@warthog.procyon.org.uk Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand") Tested-by: Markus Suvanto cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner commit f4c12e5cefc8ec2eda93bc17ea734407228449ab Author: dongsheng Date: Mon Sep 8 14:16:39 2025 +0800 perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake WildcatLake (WCL) is a variant of PantherLake (PTL) and shares the same uncore PMU features with PTL. Therefore, directly reuse Pantherlake's uncore PMU enabling code for WildcatLake. Signed-off-by: dongsheng Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20250908061639.938105-2-dapeng1.mi@linux.intel.com commit b796a8feb7cb094ee998931a96cd6152a9d3022e Author: Dapeng Mi Date: Mon Sep 8 14:16:38 2025 +0800 perf/x86/intel: Add PMU support for WildcatLake WildcatLake is a variant of PantherLake and shares same PMU features, so directly reuse Pantherlake's code to enable PMU features for WildcatLake. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zide Chen Link: https://patch.msgid.link/20250908061639.938105-1-dapeng1.mi@linux.intel.com commit 0ba6502ce167fc3d598c08c2cc3b4ed7ca5aa251 Author: Dapeng Mi Date: Tue Oct 28 14:42:14 2025 +0800 perf/x86/intel: Fix KASAN global-out-of-bounds warning When running "perf mem record" command on CWF, the below KASAN global-out-of-bounds warning is seen. ================================================================== BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 Call Trace: kasan_report+0xb8/0xf0 cmt_latency_data+0x176/0x1b0 setup_arch_pebs_sample_data+0xf49/0x2560 intel_pmu_drain_arch_pebs+0x577/0xb00 handle_pmi_common+0x6c4/0xc80 The issue is caused by below code in __grt_latency_data(). The code tries to access x86_hybrid_pmu structure which doesn't exist on non-hybrid platform like CWF. WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big) So add is_hybrid() check before calling this WARN_ON_ONCE to fix the global-out-of-bounds access issue. Fixes: 090262439f66 ("perf/x86/intel: Rename model-specific pebs_latency_data functions") Reported-by: Xudong Hao Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zide Chen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251028064214.1451968-1-dapeng1.mi@linux.intel.com commit 23ee8a2563a0f24cf4964685ced23c32be444ab8 Author: Qinxin Xia Date: Tue Oct 28 20:08:59 2025 +0800 dma-mapping: benchmark: Restore padding to ensure uABI remained consistent The padding field in the structure was previously reserved to maintain a stable interface for potential new fields, ensuring compatibility with user-space shared data structures. However,it was accidentally removed by tiantao in a prior commit, which may lead to incompatibility between user space and the kernel. This patch reinstates the padding to restore the original structure layout and preserve compatibility. Fixes: 8ddde07a3d28 ("dma-mapping: benchmark: extract a common header file for map_benchmark definition") Cc: stable@vger.kernel.org Acked-by: Barry Song Signed-off-by: Qinxin Xia Reported-by: Barry Song Closes: https://lore.kernel.org/lkml/CAGsJ_4waiZ2+NBJG+SCnbNk+nQ_ZF13_Q5FHJqZyxyJTcEop2A@mail.gmail.com/ Reviewed-by: Jonathan Cameron Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251028120900.2265511-2-xiaqinxin@huawei.com commit 8df206f7b63611dbaeb8628661d87fe994dcdf71 Merge: 40c17a02de41f1 7e2958aee59ceb Author: Jakub Kicinski Date: Tue Oct 28 19:11:07 2025 -0700 Merge branch 'bug-fixes-for-the-hibmcge-ethernet-driver' Jijie Shao says: ==================== bug fixes for the hibmcge ethernet driver This patch set is intended to fix several issues for hibmcge driver: 1. Patch1 fixes the issue where buf avl irq is disabled after irq_handle. 2. Patch2 eliminates the error logs in scenarios without phy. 3. Patch3 fixes the issue where the network port becomes unusable after a PCIe RAS event. ==================== Link: https://patch.msgid.link/20251025014642.265259-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 7e2958aee59ceb30ef153387741d12385b712250 Author: Jijie Shao Date: Sat Oct 25 09:46:42 2025 +0800 net: hibmcge: fix the inappropriate netif_device_detach() current, driver will call netif_device_detach() in pci_error_handlers.error_detected() and do reset in pci_error_handlers.slot_reset(). However, if pci_error_handlers.slot_reset() is not called after pci_error_handlers.error_detected(), driver will be detached and unable to recover. drivers/pci/pcie/err.c/report_error_detected() says: If any device in the subtree does not have an error_detected callback, PCI_ERS_RESULT_NO_AER_DRIVER prevents subsequent error callbacks of any device in the subtree, and will exit in the disconnected error state. Therefore, when the hibmcge device and other devices that do not support the error_detected callback are under the same subtree, hibmcge will be unable to do slot_reset even for non-fatal errors. This path move netif_device_detach() from error_detected() to slot_reset(), ensuring that detach and reset are always executed together. Fixes: fd394a334b1c ("net: hibmcge: Add support for abnormal irq handling feature") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251025014642.265259-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 71eb8d1e07562b43bebc0c2721699814b43fd83d Author: Jijie Shao Date: Sat Oct 25 09:46:41 2025 +0800 net: hibmcge: remove unnecessary check for np_link_fail in scenarios without phy. hibmcge driver uses fixed_phy to configure scenarios without PHY, where the driver is always in a linked state. However, there might be no link in hardware, so the np_link error is detected in hbg_hw_adjust_link(), which can cause abnormal logs. Therefore, in scenarios without a PHY, the driver no longer checks the np_link status. Fixes: 1d7cd7a9c69c ("net: hibmcge: support scenario without PHY") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251025014642.265259-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 12d2303db892d397373e2af40758cbd97309ec37 Author: Jijie Shao Date: Sat Oct 25 09:46:40 2025 +0800 net: hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue irq initialized with the macro HBG_ERR_IRQ_I will automatically be re-enabled, whereas those initialized with the macro HBG_IRQ_I will not be re-enabled. Since the rx buf avl irq is initialized using the macro HBG_IRQ_I, it needs to be actively re-enabled; otherwise priv->stats.rx_fifo_less_empty_thrsld_cnt cannot be correctly incremented. Fixes: fd394a334b1c ("net: hibmcge: Add support for abnormal irq handling feature") Signed-off-by: Jijie Shao Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251025014642.265259-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 40c17a02de41f12dd713309c7d2546117c577d29 Author: Ivan Vecera Date: Mon Oct 27 15:09:12 2025 +0100 dpll: zl3073x: Fix output pin registration Currently, the signal format of an associated output is not considered during output pin registration. As a result, the driver registers output pins that are disabled by the signal format configuration. Fix this by calling zl3073x_output_pin_is_enabled() to check whether a given output pin should be registered or not. Fixes: 75a71ecc2412 ("dpll: zl3073x: Register DPLL devices and pins") Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251027140912.233152-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit d8d2b1f81530988abe2e2bfaceec1c5d30b9a0b4 Author: Pavel Zhigulin Date: Fri Oct 24 19:13:02 2025 +0300 net: cxgb4/ch_ipsec: fix potential use-after-free in ch_ipsec_xfrm_add_state() callback In ch_ipsec_xfrm_add_state() there is not check of try_module_get return value. It is very unlikely, but try_module_get() could return false value, which could cause use-after-free error. Conditions: The module count must be zero, and a module unload in progress. The thread doing the unload is blocked somewhere. Another thread makes a callback into the module for some request that (for instance) would need to create a kernel thread. It tries to get a reference for the thread. So try_module_get(THIS_MODULE) is the right call - and will fail here. This fix adds checking the result of try_module_get call Fixes: 6dad4e8ab3ec ("chcr: Add support for Inline IPSec") Signed-off-by: Pavel Zhigulin Link: https://patch.msgid.link/20251024161304.724436-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit e53642b87a4f4b03a8d7e5f8507fc3cd0c595ea6 Merge: 8eefed8f65cc17 f574069c5c55eb Author: Linus Torvalds Date: Tue Oct 28 18:00:40 2025 -0700 Merge tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Improve check for malformed payload - Fix free transport smbdirect potential race - Fix potential race in credit allocation during smbdirect negotiation * tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work() smb: server: call smb_direct_post_recv_credits() when the negotiation is done ksmbd: transport_ipc: validate payload size before reading handle commit 36fedc44e37e811f25666c600bce4bc027290226 Author: Petr Oros Date: Fri Oct 24 21:07:33 2025 +0200 dpll: fix device-id-get and pin-id-get to return errors properly The device-id-get and pin-id-get handlers were ignoring errors from the find functions and sending empty replies instead of returning error codes to userspace. When dpll_device_find_from_nlattr() or dpll_pin_find_from_nlattr() returned an error (e.g., -EINVAL for "multiple matches" or -ENODEV for "not found"), the handlers checked `if (!IS_ERR(ptr))` and skipped adding the device/pin handle to the message, but then still sent the empty message as a successful reply. This caused userspace tools to receive empty responses with id=0 instead of proper netlink errors with extack messages like "multiple matches". The bug is visible via strace, which shows the kernel sending TWO netlink messages in response to a single request: 1. Empty reply (20 bytes, just header, no attributes): recvfrom(3, [{nlmsg_len=20, nlmsg_type=dpll, nlmsg_flags=0, ...}, {cmd=0x7, version=1}], ...) 2. NLMSG_ERROR ACK with extack (because of NLM_F_ACK flag): recvfrom(3, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED|NLM_F_ACK_TLVS, ...}, [{error=0, msg={...}}, [{nla_type=NLMSGERR_ATTR_MSG}, "multiple matches"]]], ...) The C YNL library parses the first message, sees an empty response, and creates a result object with calloc() which zero-initializes all fields, resulting in id=0. The Python YNL library parses both messages and displays the extack from the second NLMSG_ERROR message. Fix by checking `if (IS_ERR(ptr))` first and returning the error code immediately, so that netlink properly sends only NLMSG_ERROR with the extack message to userspace. After this fix, both C and Python YNL tools receive only the NLMSG_ERROR and behave consistently. This affects: - DPLL_CMD_DEVICE_ID_GET: now properly returns error when multiple devices match the criteria (e.g., same module-name + clock-id) - DPLL_CMD_PIN_ID_GET: now properly returns error when multiple pins match the criteria (e.g., same module-name) Before fix: $ dpll pin id-get module-name ice 0 (wrong - should be error, there are 17 pins with module-name "ice") After fix: $ dpll pin id-get module-name ice Error: multiple matches (correct - kernel reports the ambiguity via extack) Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Link: https://patch.msgid.link/20251024190733.364101-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit f5d079564c44baaeedf5e25f4b943aa042ea0eb1 Author: Jessica Zhang Date: Tue Sep 23 16:03:50 2025 -0700 drm/msm/dpu: Fix adjusted mode clock check for 3d merge Since 3D merge allows for larger modes to be supported across 2 layer mixers, filter modes based on adjusted mode clock / 2 when 3d merge is supported. Reported-by: Abel Vesa Fixes: 62b7d6835288 ("drm/msm/dpu: Filter modes based on adjusted mode clock") Signed-off-by: Jessica Zhang Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Tested-by: Abel Vesa Tested-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/676353/ Link: https://lore.kernel.org/r/20250923-modeclk-fix-v2-1-01fcd0b2465a@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit bbc65d1bde821750c48ac075057be548e38d77cc Author: Vladimir Lypak Date: Sat Oct 18 14:33:43 2025 +0000 drm/msm/dpu: Disable broken YUV on QSEED2 hardware YUV formats on this hardware needs scaling for chroma planes. However it is not implemented for QSEED2 which breaks display pipeline if YUV format is used (causing partial and corrupted output with PPDONE timeouts). This patch temporarily disables YUV by switching affected sub-block to RGB only format list. Fixes: daf9a92daeb8 ("drm/msm/dpu: Add support for MSM8996") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/682061/ Link: https://lore.kernel.org/r/20251018-b4-dpu-fixes-v1-6-1852278064d0@gmail.com Signed-off-by: Dmitry Baryshkov commit 5e0656b125346d9a1ef65e72c6d3196b8ea6b1e1 Author: Vladimir Lypak Date: Fri Oct 17 19:58:39 2025 +0000 drm/msm/dpu: Require linear modifier for writeback framebuffers UBWC-related register configuration for writeback is not implemented in the driver yet but there aren't any checks for non-linear modifiers in atomic_check. Thus when compressed framebuffer is attached to writeback connector it will be filled with linear image data. This patch forbids non-linear modifiers for writeback framebuffers until UBWC support for writeback is properly implemented. Fixes: 71174f362d67 ("drm/msm/dpu: move writeback's atomic_check to dpu_writeback.c") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681922/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-5-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 2f8bed9175429294860276b897de53d49ed647d8 Author: Vladimir Lypak Date: Fri Oct 17 19:58:38 2025 +0000 drm/msm/dpu: Fix pixel extension sub-sampling In _dpu_plane_setup_pixel_ext function instead of dividing just chroma source resolution once (component 1 and 2), second component is divided once more because src_w and src_h variable is reused between iterations. Third component receives wrong source resolution too (from component 2). To fix this introduce temporary variables for each iteration. Fixes: dabfdd89eaa9 ("drm/msm/disp/dpu1: add inline rotation support for sc7280") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681921/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-4-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 425da3305972a7bab9812770d44e2f7f97f8bfd6 Author: Vladimir Lypak Date: Fri Oct 17 19:58:37 2025 +0000 drm/msm/dpu: Disable scaling for unsupported scaler types Scaling is not implemented for some type of scalers (QSEED2 and RGB) but it was unintentionally re-enabled with change below. The remaining condition in dpu_plane_atomic_check_pipe is not enough because it only checks for length of scaler block (which is present). This patch adds a additional check for setup_scaler operation. Fixes: 8f15005783b8 ("drm/msm/dpu: move scaling limitations out of the hw_catalog") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681918/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-3-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 23ab0d6228bf9de6cf69db330f95a1938b276693 Author: Vladimir Lypak Date: Fri Oct 17 19:58:36 2025 +0000 drm/msm/dpu: Propagate error from dpu_assign_plane_resources The dpu_plane_virtual_assign_resources function might fail if there is no suitable SSPP(s) for the plane. This leaves sspp field in plane state uninitialized and later leads to NULL dereference during commit: Call trace: _dpu_crtc_blend_setup+0x194/0x620 [msm] (P) dpu_crtc_atomic_begin+0xe4/0x240 [msm] drm_atomic_helper_commit_planes+0x88/0x358 msm_atomic_commit_tail+0x1b4/0x8b8 [msm] commit_tail+0xa8/0x1b0 drm_atomic_helper_commit+0x180/0x1a0 drm_atomic_commit+0x94/0xe0 drm_mode_atomic_ioctl+0xa88/0xd60 drm_ioctl_kernel+0xc4/0x138 drm_ioctl+0x364/0x4f0 __arm64_sys_ioctl+0xac/0x108 invoke_syscall.constprop.0+0x48/0x100 el0_svc_common.constprop.0+0x40/0xe8 do_el0_svc+0x24/0x38 el0_svc+0x30/0xe0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Fixes: 3ed12a3664b3 ("drm/msm/dpu: allow sharing SSPP between planes") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681916/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-2-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 2319551e97f0cd9b4a7b78c1a6970aa4b785000b Author: Vladimir Lypak Date: Fri Oct 17 19:58:35 2025 +0000 drm/msm/dpu: Fix allocation of RGB SSPPs without scaling Due to condition in dpu_rm_reserve_sspp, RGB SSPPs are only tried when scaling is requested, which prevents those SSPPs from being reserved if we don't need scaling at all. Instead we should check if YUV support is requested, since scaling on RGB SSPPs is optional and is not implemented in driver yet. Fixes: 774bcfb73176 ("drm/msm/dpu: add support for virtual planes") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681914/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-1-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 93c97bc8d85d5742d6f000d8bf3eeeb705bc6082 Author: Neil Armstrong Date: Mon Oct 27 14:09:48 2025 +0100 drm/msm: dsi: fix PLL init in bonded mode When in bonded DSI mode, only one PLL in one DSI PHY is used for both DSI PHYs, meaning that parents of the secondary DSI PHY will use the primary DSI PHY PLL as parent. In this case the primary DSI PHY PLL will be set even if the primary DSI PHY is not yet enabled. The DSI PHY code has support for this particular use-case and will handle the fact the PLL was already set when initializing the primary DSI PHY. By introducing a protected variable pll_enable_cnt in the commit cb55f39bf7b1 ("drm/msm/dsi/phy: Fix reading zero as PLL rates when unprepared"), this variable is only initially set to 1 when the DSI PHY is initialized making it impossible to set the PLL before, breaking the bonded DSI use case by returning 0 when setting the PLL from the secondary DSI PHY driver and skipping the correct clocks initialization. But since it was already possible to set the PLL without enabling the DSI PHY, just drop the pll_enable_cnt setting from the PHY enable/disable and simply increment/decrement the pll_enable_cnt variable from the dsi_pll_enable/disable_pll_bias to make sure any PLL operation is done with the PLL BIAS enabled. Fixes: cb55f39bf7b1 ("drm/msm/dsi/phy: Fix reading zero as PLL rates when unprepared") Closes: https://lore.kernel.org/all/50a49d72-2b1e-471d-b0c4-d5a0b38b2a21@linaro.org/ Tested-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/683688/ Link: https://lore.kernel.org/r/20251027-topic-sm8x50-fix-dsi-bonded-v1-1-a477cd3f907d@linaro.org Signed-off-by: Dmitry Baryshkov commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b Author: Daniel Palmer Date: Fri Oct 24 18:37:15 2025 +0900 fbdev: atyfb: Check if pll_ops->init_pll failed Actually check the return value from pll_ops->init_pll() as it can return an error. If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up. [ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Daniel Palmer Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 Author: Quanmin Yan Date: Fri Oct 10 16:16:59 2025 +0800 fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL. Signed-off-by: Quanmin Yan Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 18c4ef4e765a798b47980555ed665d78b71aeadf Author: Junjie Cao Date: Mon Oct 20 21:47:01 2025 +0800 fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2 Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Signed-off-by: Junjie Cao Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 Author: Florian Fuchs Date: Sun Oct 26 00:38:50 2025 +0200 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled. Signed-off-by: Florian Fuchs Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 Author: Miaoqian Lin Date: Mon Oct 27 16:43:37 2025 +0800 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done. Found via static analysis. Fixes: cc5d0189b9ba ("[PATCH] powerpc: Remove device_node addrs/n_addr") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller commit 18cd0a9c7aaf880502e4aff3ea30022f97d6c103 Author: PIYUSH CHOUDHARY Date: Mon Oct 20 00:05:08 2025 +0530 video: fb: Fix typo in comment in fb.h Fix typo: "verical" -> "vertical" in macro description Signed-off-by: PIYUSH CHOUDHARY Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 2cbb259ec4f8e12dade80b388b81d41fa22187d2 Author: Daniel Borkmann Date: Thu Oct 23 14:55:32 2025 +0200 bpf: Reject negative head_room in __bpf_skb_change_head Yinhao et al. recently reported: Our fuzzing tool was able to create a BPF program which triggered the below BUG condition inside pskb_expand_head. [ 23.016047][T10006] kernel BUG at net/core/skbuff.c:2232! [...] [ 23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530 [...] [ 23.021249][T10006] Call Trace: [ 23.021387][T10006] [ 23.021507][T10006] ? __pfx_pskb_expand_head+0x10/0x10 [ 23.021725][T10006] __bpf_skb_change_head+0x22a/0x520 [ 23.021939][T10006] bpf_skb_change_head+0x34/0x1b0 [ 23.022143][T10006] ___bpf_prog_run+0xf70/0xb670 [ 23.022342][T10006] __bpf_prog_run32+0xed/0x140 [...] The problem is that in __bpf_skb_change_head() we need to reject a negative head_room as otherwise this propagates all the way to the pskb_expand_head() from skb_cow(). For example, if the BPF test infra passes a skb with gso_skb:1 to the BPF helper with a negative head_room of -22, then this gets passed into skb_cow(). __skb_cow() in this example calculates a delta of -86 which gets aligned to -64, and then triggers BUG_ON(nhead < 0). Thus, reject malformed negative input. Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: Daniel Borkmann Signed-off-by: Martin KaFai Lau Reviewed-by: Dongliang Mu Link: https://patch.msgid.link/20251023125532.182262-1-daniel@iogearbox.net commit de8d1f2fd5a510bf2c1c25b84e1a718a0f0af105 Author: Alex Mastro Date: Tue Oct 28 09:15:04 2025 -0700 vfio: selftests: add end of address space DMA map/unmap tests Add tests which validate dma map/unmap at the end of address space. Add negative test cases for checking that overflowing ioctl args fail with the expected errno. Reviewed-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-5-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 16950b60c19b9137eb8bfeb298621e803e98dcc7 Author: Alex Mastro Date: Tue Oct 28 09:15:03 2025 -0700 vfio: selftests: update DMA map/unmap helpers to support more test kinds Add __vfio_pci_dma_*() helpers which return -errno from the underlying ioctls. Add __vfio_pci_dma_unmap_all() to test more unmapping code paths. Add an out unmapped arg to report the unmapped byte size. The existing vfio_pci_dma_*() functions, which are intended for happy-path usage (assert on failure) are now thin wrappers on top of the double-underscore helpers. Reviewed-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-4-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit ef270ec44637d464126bd4ade483c4a1887e06bc Author: Alex Mastro Date: Tue Oct 28 09:15:02 2025 -0700 vfio/type1: handle DMA map/unmap up to the addressable limit Before this commit, it was possible to create end of address space mappings, but unmapping them via VFIO_IOMMU_UNMAP_DMA, replaying them for newly added iommu domains, and querying their dirty pages via VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP was broken due to bugs caused by comparisons against (iova + size) expressions, which overflow to zero. Additionally, there appears to be a page pinning leak in the vfio_iommu_type1_release() path, since vfio_unmap_unpin()'s loop body where unmap_unpin_*() are called will never be entered due to overflow of (iova + size) to zero. This commit handles DMA map/unmap operations up to the addressable limit by comparing against inclusive end-of-range limits, and changing iteration to perform relative traversals across range sizes, rather than absolute traversals across addresses. vfio_link_dma() inserts a zero-sized vfio_dma into the rb-tree, and is only used for that purpose, so discard the size from consideration for the insertion point. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-3-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 1196f1f897d4ee64d8844e8cfa97c8f93e4d158c Author: Alex Mastro Date: Tue Oct 28 09:15:01 2025 -0700 vfio/type1: move iova increment to unmap_unpin_*() caller Move incrementing iova to the caller of these functions as part of preparing to handle end of address space map/unmap. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-2-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 6012379ede6aa7477db6276bb9876fe7d67c4312 Author: Alex Mastro Date: Tue Oct 28 09:15:00 2025 -0700 vfio/type1: sanitize for overflow using check_*_overflow() Adopt check_*_overflow() functions to clearly express overflow check intent. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-1-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit dc8aa0cb87a7836b59422cc02d969c8df849ee39 Author: Ville Syrjälä Date: Wed Oct 22 13:07:16 2025 +0300 drm/i915/dmc: Clear HRR EVT_CTL/HTP to zero on ADL-S On ADL-S the main DMC HRR event DMC_EVT_CTL/HTP are never restored to their previous values during DC6 exit. This angers assert_dmc_loaded(), and basically makes the HRR handler unusable because we don't rewrite EVT_HTP when enabling DMC events. Let's just clear the HRR EVT_CTL/HTP to zero from the beginnning so that the expected value matches the post-DC6 reality. I suppose if we ever had actual use for HRR we'd have to both, reject HRR+PSR, and reprogram EVT_HTP when enabling the event. But for now we don't care about HRR so keeping both registers zeroed is fine. Cc: stable@vger.kernel.org Tested-by: Petr Vorel Fixes: 43175c92d403 ("drm/i915/dmc: Assert DMC is loaded harder") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15153 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251022100718.24803-2-ville.syrjala@linux.intel.com Reviewed-by: Petr Vorel Reviewed-by: Imre Deak Tested-by: Imre Deak (cherry picked from commit 4df3b340ff6e9f499735d8b52b96a9257fde3918) Signed-off-by: Rodrigo Vivi commit f82acf6fb42115c87d3809968a2e0ab2fedba15b Author: Kohei Enju Date: Mon Oct 6 21:35:23 2025 +0900 ixgbe: use EOPNOTSUPP instead of ENOTSUPP in ixgbe_ptp_feature_enable() When the requested PTP feature is not supported, ixgbe_ptp_feature_enable() returns -ENOTSUPP, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 3a6a4edaa592 ("ixgbe: Hardware Timestamping + PTP Hardware Clock (PHC)") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 21d08d1c4c29f9795fbc678011c85f72931e22c1 Author: Kohei Enju Date: Mon Oct 6 21:35:22 2025 +0900 igc: use EOPNOTSUPP instead of ENOTSUPP in igc_ethtool_get_sset_count() igc_ethtool_get_sset_count() returns -ENOTSUPP when a given stringset is not supported, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 36b9fea60961 ("igc: Add support for statistics") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit bc73c5885c606f5e48dd4222eba0361fa0f146ca Author: Kohei Enju Date: Mon Oct 6 21:35:21 2025 +0900 igb: use EOPNOTSUPP instead of ENOTSUPP in igb_get_sset_count() igb_get_sset_count() returns -ENOTSUPP when a given stringset is not supported, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 81fb1fe75c672db905b54f4ab744552121099a24 Author: Kohei Enju Date: Sat Sep 20 15:39:18 2025 +0900 igc: power up the PHY before the link test The current implementation of the igc driver doesn't power up the PHY before the link test in igc_ethtool_diag_test(), causing the link test to always report FAIL when admin state is down and the PHY is consequently powered down. To test the link state regardless of admin state, power up the PHY before the link test in the offline test path. After the link test, the original PHY state is restored by igc_reset(), so additional code which explicitly restores the original state is not necessary. Note that this change is applied only for the offline test path. This is because in the online path we shouldn't interrupt normal networking operation and powering up the PHY and restoring the original state would interrupt that. This implementation also uses igc_power_up_phy_copper() without checking the media type, since igc devices are currently only copper devices and the function is called in other places without checking the media type. Furthermore, the powering up is on a best-effort basis, that is, we don't handle failures of powering up (e.g. bus error) and just let the test report FAIL. Tested on Intel Corporation Ethernet Controller I226-V (rev 04) with cable connected and link available. Set device down and do ethtool test. # ip link set dev enp0s5 down Without patch: # ethtool --test enp0s5 The test result is FAIL The test extra info: Register test (offline) 0 Eeprom test (offline) 0 Interrupt test (offline) 0 Loopback test (offline) 0 Link test (on/offline) 1 With patch: # ethtool --test enp0s5 The test result is PASS The test extra info: Register test (offline) 0 Eeprom test (offline) 0 Interrupt test (offline) 0 Loopback test (offline) 0 Link test (on/offline) 0 Fixes: f026d8ca2904 ("igc: add support to eeprom, registers and link self-tests") Signed-off-by: Kohei Enju Reviewed-by: Vitaly Lifshits Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 85308d999c4b4162a742c9ec5ef954226c3b48d9 Author: Kohei Enju Date: Mon Sep 1 05:33:11 2025 +0900 ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() The error path of ixgbe_recovery_probe() has two memory bugs. For non-E610 adapters, the function jumps to clean_up_probe without calling devlink_free(), leaking the devlink instance and its embedded adapter structure. For E610 adapters, devlink_free() is called at shutdown_aci, but clean_up_probe then accesses adapter->state, sometimes triggering use-after-free because adapter is embedded in devlink. This UAF is similar to the one recently reported in ixgbe_remove(). (Link) Fix both issues by moving devlink_free() after adapter->state access, aligning with the cleanup order in ixgbe_probe(). Link: https://lore.kernel.org/intel-wired-lan/20250828020558.1450422-1-den@valinux.co.jp/ Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Jedrzej Jagielski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 9a0f81fc64b2ba80ce768cd6e680c0f440723464 Author: Grzegorz Nitka Date: Wed Oct 8 12:28:53 2025 +0200 ice: fix usage of logical PF id In some devices, the function numbers used are non-contiguous. For example, here is such configuration for E825 device: root@/home/root# lspci -v | grep Eth 0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04) 0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04) 0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04) 0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04) When distributing RSS and FDIR masks, which are global resources across the active devices, it is required to have a contiguous PF id, which can be described as a logical PF id. In the case above, function 0 would have a logical PF id of 0, function 1 would have a logical PF id of 1, and functions 4 and 5 would have a logical PF ids 2 and 3 respectively. Using logical PF id can properly describe which slice of resources can be used by a particular PF. The 'function id' to 'logical id' mapping has been introduced with the commit 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration"). However, the usage of 'logical_pf_id' field was unintentionally skipped for profile mask configuration. Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring masks. Without that patch, wrong indexes, i.e. out of range for given PF, can be used while configuring resources masks, which might lead to memory corruption and undefined driver behavior. The call trace below is one of the examples of such error: [ +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095 devm_kfree+0x70/0xa0 [ +0.000002] RIP: 0010:devm_kfree+0x70/0xa0 [ +0.000001] Call Trace: [ +0.000002] [ +0.000002] ice_free_hw_tbls+0x183/0x710 [ice] [ +0.000106] ice_deinit_hw+0x67/0x90 [ice] [ +0.000091] ice_deinit+0x20d/0x2f0 [ice] [ +0.000076] ice_remove+0x1fa/0x6a0 [ice] [ +0.000075] pci_device_remove+0xa7/0x1d0 [ +0.000010] device_release_driver_internal+0x365/0x530 [ +0.000006] driver_detach+0xbb/0x170 [ +0.000003] bus_remove_driver+0x117/0x290 [ +0.000007] pci_unregister_driver+0x26/0x250 Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration") Suggested-by: Dan Nowlin Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 45076413063cf5e0e25fd3f7f89fc90338b161c8 Author: Grzegorz Nitka Date: Mon Sep 29 17:29:05 2025 +0200 ice: fix destination CGU for dual complex E825 On dual complex E825, only complex 0 has functional CGU (Clock Generation Unit), powering all the PHYs. SBQ (Side Band Queue) destination device 'cgu' in current implementation points to CGU on current complex and, in order to access primary CGU from the secondary complex, the driver should use 'cgu_peer' as a destination device in read/write CGU registers operations. Define new 'cgu_peer' (15) as RDA (Remote Device Access) client over SB-IOSF interface and use it as device target when accessing CGU from secondary complex. This problem has been identified when working on recovery clock enablement [1]. In existing implementation for E825 devices, only PF0, which is clock owner, is involved in CGU configuration, thus the problem was not exposed to the user. [1] https://lore.kernel.org/intel-wired-lan/20250905150947.871566-1-grzegorz.nitka@intel.com/ Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices") Signed-off-by: Grzegorz Nitka Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e9840461317e1bf0628b164de54632754d5f6a44 Author: Grzegorz Nitka Date: Fri Feb 21 10:39:49 2025 +0100 ice: fix lane number calculation E82X adapters do not have sequential IDs, lane number is PF ID. Add check for ICE_MAC_GENERIC and skip checking port options. Also, adjust logical port number for specific E825 device with external PHY support (PCI device id 0x579F). For this particular device, with 2x25G (PHY0) and 2x10G (PHY1) port configuration, modification of pf_id -> lane_number mapping is required. PF IDs on the 2nd PHY start from 4 in such scenario. Otherwise, the lane number cannot be determined correctly, leading to PTP init errors during PF initialization. Fixes: 258f5f9058159 ("ice: Add correct PHY lane assignment") Co-developed-by: Karol Kolacinski Signed-off-by: Karol Kolacinski Signed-off-by: Grzegorz Nitka Reviewed-by: Przemek Kitszel Reviewed-by: Milena Olech Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0d6e9ec80cebf9b378a1d3a01144e576d731c397 Author: Peter Zijlstra Date: Mon Oct 27 12:40:59 2025 +0100 x86/build: Disable SSE4a Leyvi Rose reported that his X86_NATIVE_CPU=y build is failing because our instruction decoder doesn't support SSE4a and the AMDGPU code seems to be generating those with his compiler of choice (CLANG+LTO). Now, our normal build flags disable SSE MMX SSE2 3DNOW AVX, but then CC_FLAGS_FPU re-enable SSE SSE2. Since nothing mentions SSE3 or SSE4, I'm assuming that -msse (or its negative) control all SSE variants -- but why then explicitly enumerate SSE2 ? Anyway, until the instruction decoder gets fixed, explicitly disallow SSE4a (an AMD specific SSE4 extension). Fixes: ea1dcca1de12 ("x86/kbuild/64: Add the CONFIG_X86_NATIVE_CPU option to locally optimize the kernel with '-march=native'") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Acked-by: Borislav Petkov (AMD) Acked-by: Arisu Tachibana Acked-by: Christian König Acked-by: Harry Wentland Cc: commit 8eefed8f65cc17c31fdf4ab32292b794b34893ad Merge: fd57572253bc35 3e7f011c255582 Author: Linus Torvalds Date: Tue Oct 28 12:13:20 2025 -0700 Merge tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Regression fixes: - Revert the patch that removed the cap on MAX_OPS_PER_COMPOUND - Address a kernel build issue Stable fixes: - Fix crash when a client queries new attributes on forechannel - Fix rare NFSD crash when tracing is enabled" * tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" nfsd: Avoid strlen conflict in nfsd4_encode_components_esc() NFSD: Fix crash in nfsd4_read_release() NFSD: Define actions for the new time_deleg FATTR4 attributes commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 Author: Chang S. Bae Date: Mon Jun 9 17:16:59 2025 -0700 x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when running KVM tests: WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR. When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption. Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature. This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible. [ dhansen: minor changelog munging ] Closes: https://lore.kernel.org/lkml/aDCo_SczQOUaB2rS@google.com [1] Fixes: 672365477ae8a ("x86/fpu: Update XFD state where required") Reported-by: Sean Christopherson Signed-off-by: Chang S. Bae Signed-off-by: Dave Hansen Reviewed-by: Chao Gao Tested-by: Chao Gao Link: https://lore.kernel.org/all/aDWbctO%2FRfTGiCg3@intel.com [2] Cc:stable@vger.kernel.org Link: https://patch.msgid.link/20250610001700.4097-1-chang.seok.bae%40intel.com commit bd34bf518a5ffeb8eb7c8b9907ba97b606166f7b Author: Lazar Aleksic Date: Tue Oct 28 19:09:05 2025 +0100 platform: x86: Kconfig: fix minor typo in help for WIRELESS_HOTKEY Fixed a misspelling of Xiaomi. Signed-off-by: Lazar Aleksic Link: https://patch.msgid.link/20251028180956.10753-1-kripticni.dev@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 48cbf50531d8eca15b8a811717afdebb8677de9b Author: Shawn Guo Date: Fri Oct 24 16:23:44 2025 +0800 regmap: irq: Correct documentation of wake_invert flag Per commit 9442490a0286 ("regmap: irq: Support wake IRQ mask inversion") the wake_invert flag is to support enable register, so cleared bits are wake disabled. Fixes: 68622bdfefb9 ("regmap: irq: document mask/wake_invert flags") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Link: https://patch.msgid.link/20251024082344.2188895-1-shawnguo2@yeah.net Signed-off-by: Mark Brown commit 4173edb076b3ae30d734d55fce0ebac63139b656 Author: Hans de Goede Date: Mon Oct 20 17:23:31 2025 +0200 platform/x86: dell-wmi-base: Handle electronic privacy screen on/off events Add handling for events for the electronic privacy screen found on some models (e.g. Dell Latitude 7300) being toggled on/off. Emit KEY_EPRIVACY_SCREEN_OFF / KEY_EPRIVACY_SCREEN_ON events for this so that userspace can show the usual on-screen-display (OSD) notification for eprivacy screen on/off to the user. Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20251020152331.52870-3-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8f3eaad9812f62e7006ad08602444b32c3101824 Author: Hans de Goede Date: Mon Oct 20 17:23:30 2025 +0200 Input: Add keycodes for electronic privacy screen on/off hotkeys Add keycodes for hotkeys toggling the electronic privacy screen found on some laptops on/off. There already is an API for eprivacy screens as kernel-mode-setting drm connector object properties: https://www.kernel.org/doc/html/latest/gpu/drm-kms.html#standard-connector-properties this API also supports reporting when the eprivacy screen is turned on/off by the embedded-controller (EC) in response to hotkey presses. But on some laptops (e.g. the Dell Latitude 7300) the firmware does not allow querying the presence nor the status of the eprivacy screen at boot. This makes it impossible to implement the drm connector properties API since drm objects do not allow adding new properties after creation and the presence of the eprivacy cannot be detected at boot. The first notice of the presence of an eprivacy screen on these laptops is an EC generated (WMI) event when the eprivacy screen hotkeys are pressed. In this case the new keycodes this change adds can be generated to notify userspace of the eprivacy screen on/off hotkeys being pressed, so that userspace can show the usual on-screen-display (OSD) notification for eprivacy screen on/off to the user. This is similar to how e.g. touchpad on/off keycodes are used to show the touchpad on/off OSD. Signed-off-by: Hans de Goede Acked-by: Dmitry Torokhov Link: https://patch.msgid.link/20251020152331.52870-2-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7f7d28c69eda3692bcf102b7096b93fd45c75b1d Author: Sakari Ailus Date: Tue Oct 28 10:49:59 2025 +0200 MAINTAINERS: Update int3472 maintainers Add myself as the maintainer of the int3472 driver. Also update Daniel's e-mail address while at it. Signed-off-by: Sakari Ailus Acked-by: Daniel Scally Link: https://patch.msgid.link/20251028084959.394795-1-sakari.ailus@linux.intel.com Signed-off-by: Ilpo Järvinen commit f0f7a3f542c1698edb69075f25a3f846207facba Author: Qiu Wenbo Date: Tue Oct 28 14:30:09 2025 +0800 platform/x86: int3472: Fix double free of GPIO device during unregister regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration. Cc: stable@vger.kernel.org Fixes: 1e5d088a52c2 ("platform/x86: int3472: Stop using devm_gpiod_get()") Signed-off-by: Qiu Wenbo Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Reviewed-by: Hans de Goede Reviewed-by: Daniel Scally Link: https://patch.msgid.link/20251028063009.289414-1-qiuwenbo@gnome.org Signed-off-by: Ilpo Järvinen commit b3656b355b5522cef1b52a7469010009c98156db Author: Ivan Lipski Date: Wed Sep 17 11:00:02 2025 -0400 drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc [Why&How] Return -EINVAL when userspace asks us to enable vblank on a crtc that is not yet enabled. Suggested-by: Aurabindo Pillai Reviewed-by: Aurabindo Pillai Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1856 Signed-off-by: Ivan Lipski Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit cb57b8cdb072dc37723b6906da1c37ff9cbc2da4) Cc: stable@vger.kernel.org commit 7d08c3b1731014dd1cfd0bf8b0cb1cef9dfd191e Author: Alex Hung Date: Thu Oct 16 20:08:10 2025 -0600 drm/amd/display: Add HDR workaround for a specific eDP [WHY & HOW] Some eDP panels suffer from flicking when HDR is enabled in KDE or Gnome. This add another quirk to worksaround to skip VSC that is incompatible with an eDP panel. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4452 Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 99441824bec63549a076cd86631d138ec9a0c71c) Cc: stable@vger.kernel.org commit 4f2cd64510e7ae0b3a6ec1c10826cb6baf04edfa Author: Alex Deucher Date: Wed Oct 22 09:19:55 2025 -0400 drm/amdgpu: fix SPDX header on cyan_skillfish_reg_init.c This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: e8529dbc75ca ("drm/amdgpu: add ip offset support for cyan skillfish") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 102c4f7c554ac5a5ecf0023fa0612beb58e3b0bd) commit 8284a9e91722d3214aac5d54b4e0d2c91af0fdfc Author: Alex Deucher Date: Wed Oct 22 09:17:37 2025 -0400 drm/amdgpu: fix SPDX header on irqsrcs_vcn_5_0.h This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: d1bb64651095 ("drm/amdgpu: add irq source ids for VCN5_0/JPEG5_0") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 68c20d7b1779f97d600e61b9e95726c0cd609e2a) commit 964f8ff276a54ad7fb09168141fb6a8d891d548a Author: Alex Deucher Date: Wed Oct 22 09:14:55 2025 -0400 drm/amdgpu: fix SPDX header on amd_cper.h This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: 523b69c65445 ("drm/amd/include: Add amd cper header") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 72c5482cb0f3d3c772c9de50e5a4265258a53f81) commit f3b37ebf2c94e3a3d7bbf5e3788ad86cf30fc7be Author: Alex Deucher Date: Wed Oct 22 09:12:54 2025 -0400 drm/amdgpu: fix SPDX headers on amdgpu_cper.c/h These should be MIT. The driver in general is MIT and the license text at the top of the files is MIT so fix it. Fixes: 92d5d2a09de1 ("drm/amdgpu: Introduce funcs for populating CPER") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit abd3f876404cafb107cb34bacb74706bfee11cbe) commit 501672e3c1576aa9a8364144213c77b98a31a42c Author: John Smith Date: Tue Oct 21 11:09:09 2025 +0200 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the maximum value from the speed table which is the behaviour of all other smumgr implementations. Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.") Signed-off-by: John Smith Signed-off-by: Alex Deucher (cherry picked from commit 92b0a6ae6672857ddeabf892223943d2f0e06c97) commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 Author: John Smith Date: Tue Oct 21 11:08:13 2025 +0200 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the maximum value from the speed table which is the behaviour of all other smumgr implementations. Fixes: 18edef19ea44 ("drm/amd/powerplay: implement fw image related smu interface for Fiji.") Signed-off-by: John Smith Signed-off-by: Alex Deucher (cherry picked from commit c52238c9fb414555c68340cd80e487d982c1921c) commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 Author: Yang Wang Date: Wed Oct 22 14:12:21 2025 +0800 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() 'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw) This code should use table_index as a bounds check. Fixes: caad2613dc4bd ("drm/amd/powerplay: move table setting common code to smu_cmn.c") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit fca0c66b22303de0d1d6313059baf4dc960a4753) commit 382bd6a792836875da555fe9a2b51222b813fed1 Author: Matthew Schwartz Date: Mon Oct 20 16:09:34 2025 -0700 drm/amd/display: Don't program BLNDGAM_MEM_PWR_FORCE when CM low-power is disabled on DCN30 Before commit 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`"), dpp3_program_blnd_lut(NULL) checked the low-power debug flag before calling dpp3_power_on_blnd_lut(false). After commit 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`"), dpp3_program_blnd_lut(NULL) unconditionally calls dpp3_power_on_blnd_lut(false). The BLNDGAM power helper writes BLNDGAM_MEM_PWR_FORCE when CM low-power is disabled, causing immediate SRAM power toggles instead of deferring at vupdate. This can disrupt atomic color/LUT sequencing during transitions between direct scanout and composition within gamescope's DRM backend on Steam Deck OLED. To fix this, leave the BLNDGAM power state unchanged when low-power is disabled, matching dpp3_power_on_hdr3dlut and dpp3_power_on_shaper. Fixes: 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`") Signed-off-by: Matthew Schwartz Reviewed-by: Harry Wentland Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 13ff4f63fcddfc84ec8632f1443936b00aa26725) Cc: stable@vger.kernel.org commit 5d7b36d1bffce8340b37cbba95ef743ed3adaefd Author: Kenneth Feng Date: Fri Mar 28 10:34:57 2025 +0800 drm/amd/display: pause the workload setting in dm v1: Pause the workload setting in dm when doinn idle optimization v2: Rebase patch to latest kernel code base (kernel 6.16) Reviewed-by: Alex Deucher Signed-off-by: Kenneth Feng Signed-off-by: Alex Deucher Signed-off-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit bc6d54ac7e7436721a19443265f971f890c13cc5) commit 745bae76acdd71709773c129a69deca01036250b Author: Daniel Palmer Date: Sat Oct 18 14:44:51 2025 +0900 drm/radeon: Remove calls to drm_put_dev() Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd should be done by devres. However, drm_put_dev() is still in the probe error and device remove paths. When the driver fails to probe warnings like the following are shown because devres is trying to drm_put_dev() after the driver already did it. [ 5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22 [ 5.649605] ------------[ cut here ]------------ [ 5.649607] refcount_t: underflow; use-after-free. [ 5.649620] WARNING: CPU: 0 PID: 357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 Fixes: a9ed2f052c5c ("drm/radeon: change drm_dev_alloc to devm_drm_dev_alloc") Signed-off-by: Daniel Palmer Signed-off-by: Alex Deucher (cherry picked from commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4) commit 3328443363a0895fd9c096edfe8ecd372ca9145e Author: Daniel Palmer Date: Sat Oct 18 14:44:50 2025 +0900 drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it. Fixes: a9ed2f052c5c ("drm/radeon: change drm_dev_alloc to devm_drm_dev_alloc") Signed-off-by: Daniel Palmer Signed-off-by: Alex Deucher (cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b) commit ba10f8d92a2c026b1052b4c0fa2cd7538838c965 Author: Mario Limonciello Date: Thu Oct 16 13:55:27 2025 -0500 drm/amd: Check that VPE has reached DPM0 in idle handler [Why] Newer VPE microcode has functionality that will decrease DPM level only when a workload has run for 2 or more seconds. If VPE is turned off before this DPM decrease and the PMFW doesn't reset it when power gating VPE, the SOC can get stuck with a higher DPM level. This can happen from amdgpu's ring buffer test because it's a short quick workload for VPE and VPE is turned off after 1s. [How] In idle handler besides checking fences are drained check PMFW version to determine if it will reset DPM when power gating VPE. If PMFW will not do this, then check VPE DPM level. If it is not DPM0 reschedule delayed work again until it is. v2: squash in return fix (Alex) Cc: Peyton.Lee@amd.com Reported-by: Sultan Alsawaf Reviewed-by: Sultan Alsawaf Tested-by: Sultan Alsawaf Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4615 Reviewed-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 3ac635367eb589bee8edcc722f812a89970e14b7) Cc: stable@vger.kernel.org commit 926d002e6d7e2f1fd5c1b53cf6208153ee7d380d Author: Johan Hovold Date: Mon Oct 6 11:39:37 2025 +0200 drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers"). This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free. Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv") Reported-by: Sjoerd Simons Closes: https://lore.kernel.org/r/20251003-mtk-drm-refcount-v1-1-3b3f2813b0db@collabora.com Cc: stable@vger.kernel.org Cc: Ma Ke Cc: AngeloGioacchino Del Regno Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Sjoerd Simons Tested-by: Sjoerd Simons Tested-by: Ritesh Raj Sarraf Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20251006093937.27869-1-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d Author: Miaoqian Lin Date: Sun Oct 26 17:08:59 2025 +0800 usb: cdns3: Fix double resource release in cdns3_pci_probe The driver uses pcim_enable_device() to enable the PCI device, the device will be automatically disabled on driver detach through the managed device framework. The manual pci_disable_device() calls in the error paths are therefore redundant and should be removed. Found via static anlaysis and this is similar to commit 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload"). Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Signed-off-by: Miaoqian Lin Acked-by: Peter Chen Link: https://patch.msgid.link/20251026090859.33107-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit baeb66fbd4201d1c4325074e78b1f557dff89b5b Author: Jimmy Hu Date: Thu Oct 23 05:49:45 2025 +0000 usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window. Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue") Cc: stable Signed-off-by: Jimmy Hu Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman commit eb9ac779830b2235847b72cb15cf07c7e3333c5e Author: Claudiu Beznea Date: Mon Oct 27 16:07:41 2025 +0200 usb: renesas_usbhs: Fix synchronous external abort on unbind A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is executed after the configuration sequence described above: modprobe usb_f_ecm modprobe libcomposite modprobe configfs cd /sys/kernel/config/usb_gadget mkdir -p g1 cd g1 echo "0x1d6b" > idVendor echo "0x0104" > idProduct mkdir -p strings/0x409 echo "0123456789" > strings/0x409/serialnumber echo "Renesas." > strings/0x409/manufacturer echo "Ethernet Gadget" > strings/0x409/product mkdir -p functions/ecm.usb0 mkdir -p configs/c.1 mkdir -p configs/c.1/strings/0x409 echo "ECM" > configs/c.1/strings/0x409/configuration if [ ! -L configs/c.1/ecm.usb0 ]; then ln -s functions/ecm.usb0 configs/c.1 fi echo 11e20000.usb > UDC echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind The displayed trace is as follows: Internal error: synchronous external abort: 0000000096000010 [#1] SMP CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs] sp : ffff8000838b3920 x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810 x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000 x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020 x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344 x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000 x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80 Call trace: usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P) usbhsg_pullup+0x4c/0x7c [renesas_usbhs] usb_gadget_disconnect_locked+0x48/0xd4 gadget_unbind_driver+0x44/0x114 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_release_driver+0x18/0x24 bus_remove_device+0xcc/0x10c device_del+0x14c/0x404 usb_del_gadget+0x88/0xc0 usb_del_gadget_udc+0x18/0x30 usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs] usbhs_mod_remove+0x20/0x30 [renesas_usbhs] usbhs_remove+0x98/0xdc [renesas_usbhs] platform_remove+0x20/0x30 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_driver_detach+0x18/0x24 unbind_store+0xb4/0xb8 drv_attr_store+0x24/0x38 sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x128/0x1b8 vfs_write+0x2ac/0x350 ksys_write+0x68/0xfc __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021) ---[ end trace 0000000000000000 ]--- note: sh[188] exited with irqs disabled note: sh[188] exited with preempt_count 1 The issue occurs because usbhs_sys_function_pullup(), which accesses the IP registers, is executed after the USBHS clocks have been disabled. The problem is reproducible on the Renesas RZ/G3S SoC starting with the addition of module stop in the clock enable/disable APIs. With module stop functionality enabled, a bus error is expected if a master accesses a module whose clock has been stopped and module stop activated. Disable the IP clocks at the end of remove. Cc: stable Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251027140741.557198-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a Author: Miaoqian Lin Date: Mon Oct 27 17:20:50 2025 +0800 serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Check for returned DMA addresses using specialized dma_mapping_error() helper which is generally recommended for this purpose by Documentation/core-api/dma-api.rst: "In some circumstances dma_map_single(), ... will fail to create a mapping. A driver can check for these errors by testing the returned DMA address with dma_mapping_error()." Found via static analysis and this is similar to commit fa0308134d26 ("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking") Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support") Cc: stable Signed-off-by: Miaoqian Lin Reviewed-by: Gregory CLEMENT Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit fbc1cc6973099f45e4c30b86f12b4435c7cb7d24 Author: Benjamin Berg Date: Tue Oct 28 12:58:40 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. To make this work, use the same clock to store the timestamp. CC: stable@vger.kernel.org Fixes: ec3252bff7b6 ("wifi: mac80211: use wiphy work for channel switch") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.68258c7e4ac4.I4ff2b2cdffbbf858bf5f08baccc7a88c4f9efe6f@changeid Signed-off-by: Johannes Berg commit 3f654d53dff565095d83a84e3b6187526dadf4c8 Author: Benjamin Berg Date: Tue Oct 28 12:58:39 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. CC: stable@vger.kernel.org Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.24a7b54e9e37.I063c5c15bf7672f94cea75f83e486a3ca52d098f@changeid Signed-off-by: Johannes Berg commit dfa865d490b1bd252045463588a91a4d3c82f3c8 Author: Benjamin Berg Date: Tue Oct 28 12:58:38 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for ttlm_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. CC: stable@vger.kernel.org Fixes: 702e80470a33 ("wifi: mac80211: support handling of advertised TID-to-link mapping") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.83c2c611545e.I35498a6d883ea24b0dc4910cf521aa768d2a0e90@changeid Signed-off-by: Johannes Berg commit 7ceba45a6658ce637da334cd0ebf27f4ede6c0fe Author: Benjamin Berg Date: Tue Oct 28 12:58:37 2025 +0200 wifi: cfg80211: add an hrtimer based delayed work item The normal timer mechanism assume that timeout further in the future need a lower accuracy. As an example, the granularity for a timer scheduled 4096 ms in the future on a 1000 Hz system is already 512 ms. This granularity is perfectly sufficient for e.g. timeouts, but there are other types of events that will happen at a future point in time and require a higher accuracy. Add a new wiphy_hrtimer_work type that uses an hrtimer internally. The API is almost identical to the existing wiphy_delayed_work and it can be used as a drop-in replacement after minor adjustments. The work will be scheduled relative to the current time with a slack of 1 millisecond. CC: stable@vger.kernel.org # 6.4+ Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.7f13a2adc5eb.I01b5af0363869864b0580d9c2a1770bafab69566@changeid Signed-off-by: Johannes Berg commit 3b8694e56f6b69aaba1cffdf0c0760cd76712422 Merge: a83155cc4ec5dd 2469bb6a6af944 Author: Johannes Berg Date: Tue Oct 28 14:54:09 2025 +0100 Merge tag 'ath-current-20251027' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc4 Revert an ath10k change which improved QCA6174 but completely broke QCA988x and QCA9984. ================== Link: https://patch.msgid.link/e7e3ab9f-f477-4e84-8a5c-609fa1834624@oss.qualcomm.com Signed-off-by: Johannes Berg commit 19de03b312d69a7e9bacb51c806c6e3f4207376c Author: Damien Le Moal Date: Mon Oct 27 09:27:33 2025 +0900 block: make REQ_OP_ZONE_OPEN a write operation A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation. Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact. No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device. Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 Author: Damien Le Moal Date: Mon Oct 27 09:27:32 2025 +0900 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET. While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device. Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 76992675d7bca5560d3708488529924eb1743a03 Merge: dcb6fa37fd7bc9 109ff654934a47 Author: Greg Kroah-Hartman Date: Tue Oct 28 14:41:55 2025 +0100 Merge tag 'counter-fixes-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next William writes: Counter fixes for 6.18 A fix to permit multiple counter channels to share the same TCB IRQ line for microchip-tcb-cpature. * tag 'counter-fixes-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: microchip-tcb-capture: Allow shared IRQ for multi-channel TCBs commit 5c76f9961c170552c1d07c830b5e145475151600 Author: Henrique Carvalho Date: Mon Oct 27 18:29:19 2025 -0300 smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free. Reinitialize cfid to NULL under the replay label. Example trace (trimmed): refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80 Cc: stable@kernel.org Fixes: 4f1fffa237692 ("cifs: commands that are retried should have replay flag set") Reviewed-by: Paulo Alcantara (Red Hat) Acked-by: Shyam Prasad N Reviewed-by: Enzo Matsumiya Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 9e8b3201c7302d5b522ba3535630bed21cc03c27 Author: David Rosca Date: Wed Oct 15 16:01:28 2025 +0200 drm/sched: avoid killing parent entity on child SIGKILL The DRM scheduler tracks who last uses an entity and when that process is killed blocks all further submissions to that entity. The problem is that we didn't track who initially created an entity, so when a process accidently leaked its file descriptor to a child and that child got killed, we killed the parent's entities. Avoid that and instead initialize the entities last user on entity creation. This also allows to drop the extra NULL check. Signed-off-by: David Rosca Signed-off-by: Christian König Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4568 Reviewed-by: Alex Deucher CC: stable@vger.kernel.org Acked-by: Philipp Stanner Link: https://lore.kernel.org/r/20251015140128.1470-1-christian.koenig@amd.com Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251015140128.1470-1-christian.koenig@amd.com commit 607b9fb2ce248cc5b633c5949e0153838992c152 Author: Gregory Price Date: Mon Oct 20 11:13:55 2025 +0200 x86/CPU/AMD: Add RDSEED fix for Zen5 There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable@vger.kernel.org Signed-off-by: Gregory Price Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net commit 45f5c9eec43a9bf448f46562f146810831916cc9 Author: Bard Liao Date: Mon Oct 27 22:00:12 2025 +0800 ASoC: soc_sdw_utils: remove cs42l43 component_name "spk:cs42l43-spk" component string will be added conditionally by asoc_sdw_cs42l43_spk_rtd_init(). We should not add "spk:cs42l43" unconditionally. Fixes: c61da55412a0 ("ASoC: sdw_utils: Add missed component_name strings for speaker amps") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251027140012.966306-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit b2dd1d0d322dce5f331961c927e775b84014d5ab Author: Maarten Zanders Date: Fri Oct 24 15:57:15 2025 +0200 ASoC: fsl_sai: Fix sync error in consumer mode When configured for default synchronisation (Rx syncs to Tx) and the SAI operates in consumer mode (clocks provided externally to Tx), a synchronisation error occurs on Tx on the first attempt after device initialisation when the playback stream is started while a capture stream is already active. This results in channel shift/swap on the playback stream. Subsequent streams (ie after that first failing one) always work correctly, no matter the order, with or without the other stream active. This issue was observed (and fix tested) on an i.MX6UL board connected to an ADAU1761 codec, where the codec provides both frame and bit clock (connected to TX pins). To fix this, always initialize the 'other' xCR4 and xCR5 registers when we're starting a stream which is synced to the opposite one, irregardless of the producer/consumer status. Fixes: 51659ca069ce ("ASoC: fsl-sai: set xCR4/xCR5/xMR for SAI master mode") Signed-off-by: Maarten Zanders Reviewed-by: Shengjiu Wang Link: https://patch.msgid.link/20251024135716.584265-1-maarten@zanders.be Signed-off-by: Mark Brown commit c8b8804760eb0c4c0c7c2b500380ab3fa9f92b5a Author: Mark Brown Date: Tue Oct 28 10:20:30 2025 +0000 ASoC: Fix build for sdw_utils Revert 3293d3d7b0 ("ASoC: sdw_utils: add name_prefix for rt1321 part id") due to dependencies on -next which for some reason don't show up in my builds. Signed-off-by: Mark Brown commit 6504297872c7a5d0d06247970d32940eba26b8b3 Author: Frieder Schrempf Date: Mon Oct 20 15:21:51 2025 +0200 arm64: dts: imx8mp-kontron: Fix USB OTG role switching The VBUS supply regulator is currently assigned to the PHY node. This causes the VBUS to be always on, even when the controller needs to be switched to peripheral mode. Fix the OTG role switching by adding a connector node and moving the VBUS supply regulator to that node. This way the VBUS gets correctly switched according to the current role. Fixes: 946ab10e3f40 ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 2e448567839c65768486d56612c88cb327d26050 Author: Thorsten Blum Date: Tue Oct 21 15:51:54 2025 +0200 cpuidle: riscv-sbi: Replace deprecated strcpy in sbi_cpuidle_init_cpu strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20251021135155.1409-2-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley commit 5228ed2c624449d1a53d1c84ba01c021d2df95c0 Author: Thorsten Blum Date: Sat Oct 11 02:47:47 2025 +0200 riscv: KGDB: Replace deprecated strcpy in kgdb_arch_handle_qxfer_pkt strcpy() is deprecated because it can cause a buffer overflow when the sizes of the source and the destination are not known at compile time. Use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20251011004750.461954-1-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley commit 210b35d6a7ea415494ce75490c4b43b4e717d935 Author: Krzysztof Kozlowski Date: Sun Oct 26 11:17:42 2025 +0100 dt-bindings: net: sparx5: Narrow properly LAN969x register space windows Commit 267bca002c50 ("dt-bindings: net: sparx5: correct LAN969x register space windows") said that LAN969x has exactly two address spaces ("reg" property) but implemented it as 2 or more. Narrow the constraint to properly express that only two items are allowed, which also matches Linux driver. Fixes: 267bca002c50 ("dt-bindings: net: sparx5: correct LAN969x register space windows") Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251026101741.20507-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 520ad9e96937e825a117e9f00dd35a3e199d67b5 Author: Petr Oros Date: Fri Oct 24 20:55:12 2025 +0200 dpll: spec: add missing module-name and clock-id to pin-get reply The dpll.yaml spec incorrectly omitted module-name and clock-id from the pin-get operation reply specification, even though the kernel DPLL implementation has always included these attributes in pin-get responses since the initial implementation. This spec inconsistency caused issues with the C YNL code generator. The generated dpll_pin_get_rsp structure was missing these fields. Fix the spec by adding module-name and clock-id to the pin-attrs reply specification to match the actual kernel behavior. Fixes: 3badff3a25d8 ("dpll: spec: Add Netlink spec in YAML") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Link: https://patch.msgid.link/20251024185512.363376-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit e3966940559d52aa1800a008dcfeec218dd31f88 Author: Hangbin Liu Date: Fri Oct 24 12:58:53 2025 +0000 tools: ynl: avoid print_field when there is no reply When request a none support device operation, there will be no reply. In this case, the len(desc) check will always be true, causing print_field to enter an infinite loop and crash the program. Example reproducer: # ethtool.py -c veth0 To fix this, return immediately if there is no reply. Fixes: f3d07b02b2b8 ("tools: ynl: ethtool testing tool") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251024125853.102916-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 855e43164e95bf6559ab2b53b28e0f95887ff099 Merge: 46a499aaf8c274 f12b69d8f22824 Author: Jakub Kicinski Date: Mon Oct 27 18:00:53 2025 -0700 Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - release references to inactive interfaces, by Sven Eckelmann * tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge: batman-adv: Release references to inactive interfaces ==================== Link: https://patch.msgid.link/20251024091150.231141-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 44aa25c000b41d7afcb030ac1b8a38f06dabef0a Author: Ben Dooks Date: Fri Oct 24 18:16:40 2025 +0100 riscv: asm: use .insn for making custom instructions The assembler has .insn for building custom instructions now, so change the .4byte to .insn. This ensures the output is marked as an instruction and not as data which may confuse both debuggers and anything else that relies on this sort of marking. Add an ASM_INSN_I() wrapper in asm.h to allow the selecting of how this is output so older assemblers are still good. Reviewed-by: Andrew Jones Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20251024171640.65232-1-ben.dooks@codethink.co.uk Signed-off-by: Paul Walmsley commit 46a499aaf8c27476fd05e800f3e947bfd71aa724 Author: Abdun Nihaal Date: Thu Oct 23 19:48:42 2025 +0530 sfc: fix potential memory leak in efx_mae_process_mport() In efx_mae_enumerate_mports(), memory allocated for mae_mport_desc is passed as a argument to efx_mae_process_mport(), but when the error path in efx_mae_process_mport() gets executed, the memory allocated for desc gets leaked. Fix that by freeing the memory allocation before returning error. Fixes: a6a15aca4207 ("sfc: enumerate mports in ef100") Acked-by: Edward Cree Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251023141844.25847-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit 03ca7c8c42be913529eb9f188278114430c6abbd Author: Jijie Shao Date: Thu Oct 23 21:13:37 2025 +0800 net: hns3: return error code when function fails Currently, in hclge_mii_ioctl(), the operation to read the PHY register (SIOCGMIIREG) always returns 0. This patch changes the return type of hclge_read_phy_reg(), returning an error code when the function fails. Fixes: 024712f51e57 ("net: hns3: add ioctl support for imp-controlled PHYs") Signed-off-by: Jijie Shao Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251023131338.2642520-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit e3a0ca09acbe697245f944ee92b956db58a0ed09 Author: Bagas Sanjaya Date: Thu Oct 23 16:24:06 2025 +0700 MAINTAINERS: mark ISDN subsystem as orphan We have not heard any activities from Karsten in years: - Last review tag was nine years ago in commit a921e9bd4e22a7 ("isdn: i4l: move active-isdn drivers to staging") - Last message on lore was in October 2020 [1]. Furthermore, messages to isdn mailing list bounce. Mark the subsystem as orphan to reflect these. [1]: https://lore.kernel.org/all/0ee243a9-9937-ad26-0684-44b18e772662@linux-pingi.de/ Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251023092406.56699-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 5fada1605733a427feff45147cef9455ce29620f Author: Vivian Wang Date: Mon Oct 20 20:23:56 2025 +0800 riscv: tests: Make RISCV_KPROBES_KUNIT tristate This disallows KUNIT=m and RISCV_KPROBES_KUNIT=y, which produces these relocs_check.sh warnings when RELOCATABLE=y: WARNING: 3 bad relocations ffffffff81e24118 R_RISCV_64 kunit_unary_assert_format ffffffff81e24a60 R_RISCV_64 kunit_binary_assert_format ffffffff81e269d0 R_RISCV_JUMP_SLOT __kunit_do_failed_assertion This fixes allmodconfig build. Reported-by: Inochi Amaoto Fixes: f2fab612824f ("riscv: Add kprobes KUnit test") Signed-off-by: Vivian Wang Tested-by: Inochi Amaoto Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20251020-riscv-kunit-kconfig-fix-6-18-v1-2-d773b5d5ce48@iscas.ac.cn Signed-off-by: Paul Walmsley commit 217660325580d51c350726159703b2fcec2b95e3 Author: Vivian Wang Date: Mon Oct 20 20:23:55 2025 +0800 riscv: tests: Rename kprobes_test_riscv to kprobes_riscv According to Documentation/dev-tools/kunit/style.rst a KUnit test suite normally should not have "test" in the name. Rename it to follow the style guide. Signed-off-by: Vivian Wang Tested-by: Inochi Amaoto Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20251020-riscv-kunit-kconfig-fix-6-18-v1-1-d773b5d5ce48@iscas.ac.cn Signed-off-by: Paul Walmsley commit b3cf2d14cff5587a250f3b65ee0d36f556d23074 Merge: 65f9c4c5888913 91d35ec9b3956d Author: Jakub Kicinski Date: Mon Oct 27 17:44:35 2025 -0700 Merge tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - fix corruption in h4_recv_buf() after cleanupCen Zhang (1): - hci_sync: fix race in hci_cmd_sync_dequeue_once - btmtksdio: Add pmctrl handling for BT closed state during reset - Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" - rfcomm: fix modem control handling - btintel_pcie: Fix event packet loss issue - ISO: Fix BIS connection dst_type handling - HCI: Fix tracking of advertisement set/instance 0x00 - ISO: Fix another instance of dst_type handling - hci_conn: Fix connection cleanup with BIG with 2 or more BIS - hci_core: Fix tracking of periodic advertisement - MGMT: fix crash in set_mesh_sync and set_mesh_complete * tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: rfcomm: fix modem control handling Bluetooth: hci_core: Fix tracking of periodic advertisement Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS Bluetooth: fix corruption in h4_recv_buf() after cleanup Bluetooth: btintel_pcie: Fix event packet loss issue Bluetooth: ISO: Fix another instance of dst_type handling Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset Bluetooth: ISO: Fix BIS connection dst_type handling Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once ==================== Link: https://patch.msgid.link/20251024144033.355820-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 65f9c4c5888913c2cf5d2fc9454c83f9930d537d Author: Petr Oros Date: Fri Oct 24 15:24:38 2025 +0200 tools: ynl: fix string attribute length to include null terminator The ynl_attr_put_str() function was not including the null terminator in the attribute length calculation. This caused kernel to reject CTRL_CMD_GETFAMILY requests with EINVAL: "Attribute failed policy validation". For a 4-character family name like "dpll": - Sent: nla_len=8 (4 byte header + 4 byte string without null) - Expected: nla_len=9 (4 byte header + 5 byte string with null) The bug was introduced in commit 15d2540e0d62 ("tools: ynl: check for overflow of constructed messages") when refactoring from stpcpy() to strlen(). The original code correctly included the null terminator: end = stpcpy(ynl_attr_data(attr), str); attr->nla_len = NLA_HDRLEN + NLA_ALIGN(end - (char *)ynl_attr_data(attr)); Since stpcpy() returns a pointer past the null terminator, the length included it. The refactored version using strlen() omitted the +1. The fix also removes NLA_ALIGN() from nla_len calculation, since nla_len should contain actual attribute length, not aligned length. Alignment is only for calculating next attribute position. This makes the code consistent with ynl_attr_put(). CTRL_ATTR_FAMILY_NAME uses NLA_NUL_STRING policy which requires null terminator. Kernel validates with memchr() and rejects if not found. Fixes: 15d2540e0d62 ("tools: ynl: check for overflow of constructed messages") Signed-off-by: Petr Oros Tested-by: Ivan Vecera Reviewed-by: Ivan Vecera Link: https://lore.kernel.org/20251018151737.365485-3-zahari.doychev@linux.com Link: https://patch.msgid.link/20251024132438.351290-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit cf20852500d2895d1db22b69d87281aca2e7b5d0 Author: Nathan Chancellor Date: Thu Oct 23 21:01:29 2025 +0200 KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' Commit 5ff8c11775c7 ("KMSAN: Remove tautological checks") changed CONFIG_HAVE_KMSAN_COMPILER from a dynamic check for '-fsanitize=kernel-memory' to just being true for CONFIG_CC_IS_CLANG. This missed the fact that not all architectures supported '-fsanitize=kernel-memory' at the same time. For example, SystemZ / s390 gained support for KMSAN in clang-18 [1], so builds with clang-15 through clang-17 can select KMSAN but they error with: clang-16: error: unsupported option '-fsanitize=kernel-memory' for target 's390x-unknown-linux-gnu' Restore the cc-option check for '-fsanitize=kernel-memory' to make sure the compiler target properly supports '-fsanitize=kernel-memory'. The check for '-msan-disable-checks=1' does not need to be restored because all supported clang versions for building the kernel support it. Fixes: 5ff8c11775c7 ("KMSAN: Remove tautological checks") Link: https://github.com/llvm/llvm-project/commit/a3e56a8792ffaf3a3d3538736e1042b8db45ab89 [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202510220236.AVuXXCYy-lkp@intel.com/ Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251023-fix-kmsan-check-s390-clang-v1-1-4e6df477a4cc@kernel.org Signed-off-by: Nathan Chancellor commit d50f21091358b2b29dc06c2061106cdb0f030d03 Author: Dimitri John Ledkov Date: Sun Oct 26 20:21:00 2025 +0000 kbuild: align modinfo section for Secureboot Authenticode EDK2 compat Previously linker scripts would always generate vmlinuz that has sections aligned. And thus padded (correct Authenticode calculation) and unpadded calculation would be same. As in https://github.com/rhboot/pesign userspace tool would produce the same authenticode digest for both of the following commands: pesign --padding --hash --in ./arch/x86_64/boot/bzImage pesign --nopadding --hash --in ./arch/x86_64/boot/bzImage The commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") added .modinfo section of variable length. Depending on kernel configuration it may or may not be aligned. All userspace signing tooling correctly pads such section to calculation spec compliant authenticode digest. However, if bzImage is not further processed and is attempted to be loaded directly by EDK2 firmware, it calculates unpadded Authenticode digest and fails to correct accept/reject such kernel builds even when propoer Authenticode values are enrolled in db/dbx. One can say EDK2 requires aligned/padded kernels in Secureboot. Thus add ALIGN(8) to the .modinfo section, to esure kernels irrespective of modinfo contents can be loaded by all existing EDK2 firmware builds. Fixes: 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") Cc: stable@vger.kernel.org Signed-off-by: Dimitri John Ledkov Link: https://patch.msgid.link/20251026202100.679989-1-dimitri.ledkov@surgut.co.uk Signed-off-by: Nathan Chancellor commit a042beac6e6f8ac1e923784cfff98b47cbabb185 Author: Tomeu Vizoso Date: Tue Oct 21 11:37:23 2025 +0200 drm/etnaviv: fix flush sequence logic The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional. However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors. Fixes: 27b67278e007 ("drm/etnaviv: rework MMU handling") Signed-off-by: Tomeu Vizoso Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner Link: https://lore.kernel.org/r/20251021093723.3887980-1-l.stach@pengutronix.de commit 543d35004007a06ef247acf2fc55efa8388aa741 Author: Punit Agrawal Date: Fri Oct 24 13:31:25 2025 +0100 ACPI: SPCR: Check for table version when using precise baudrate Commit 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field") added support to use the precise baud rate available since SPCR 1.09 (revision 4) but failed to check the version of the table provided by the firmware. Accessing an older version of SPCR table causes accesses beyond the end of the table and can lead to garbage data to be used for the baud rate. Check the version of the firmware provided SPCR to ensure that the precise baudrate is vaild before using it. Fixes: 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field") Signed-off-by: Punit Agrawal Link: https://patch.msgid.link/20251024123125.1081612-1-punit.agrawal@oss.qualcomm.com Signed-off-by: Rafael J. Wysocki commit dc131bcd8d9219f7da533918abcb0d32951b7702 Author: Tony Luck Date: Wed Oct 22 13:45:23 2025 -0700 ACPI: MRRM: Check revision of MRRM table Before trying to parse the MRRM table, check that the table revision is the one that is expected. Fixes: b9020bdb9f76 ("ACPI: MRRM: Minimal parse of ACPI MRRM table") Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251022204523.10752-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit fd57572253bc356330dbe5b233c2e1d8426c66fd Merge: dcb6fa37fd7bc9 a3c4a0a42e61aa Author: Linus Torvalds Date: Mon Oct 27 10:52:18 2025 -0700 Merge tag 'sched_ext-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix scx_kick_pseqs corruption when multiple schedulers are loaded concurrently - Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() to handle systems with large CPU counts - Defer queue_balance_callback() until after ops.dispatch to fix callback ordering issues - Sync error_irq_work before freeing scx_sched to prevent use-after-free - Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU for proper RCU protection - Fix flag check for deferred callbacks * tag 'sched_ext-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: fix flag check for deferred callbacks sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() sched_ext: defer queue_balance_callback() until after ops.dispatch sched_ext: Sync error_irq_work before freeing scx_sched sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU commit c42458fcf54b3d0bc2ac06667c98dceb43831889 Author: Miaoqian Lin Date: Mon Oct 27 11:40:44 2025 -0600 riscv: Fix memory leak in module_frob_arch_sections() The current code directly overwrites the scratch pointer with the return value of kvrealloc(). If kvrealloc() fails and returns NULL, the original buffer becomes unreachable, causing a memory leak. Fix this by using a temporary variable to store kvrealloc()'s return value and only update the scratch pointer on success. Found via static anlaysis and this is similar to commit 42378a9ca553 ("bpf, verifier: Fix memory leak in array reallocation for stack state") Fixes: be17c0df6795 ("riscv: module: Optimize PLT/GOT entry counting") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20251026091912.39727-1-linmq006@gmail.com Signed-off-by: Paul Walmsley commit a74f038fa50e0d33b740f44f862fe856f16de6a8 Author: Josephine Pfeiffer Date: Mon Oct 27 11:40:43 2025 -0600 riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro The pt_dump_seq_puts() macro incorrectly uses seq_printf() instead of seq_puts(). This is both a performance issue and conceptually wrong, as the macro name suggests plain string output (puts) but the implementation uses formatted output (printf). The macro is used in ptdump.c:301 to output a newline character. Using seq_printf() adds unnecessary overhead for format string parsing when outputting this constant string. This bug was introduced in commit 59c4da8640cc ("riscv: Add support to dump the kernel page tables") in 2020, which copied the implementation pattern from other architectures that had the same bug. Fixes: 59c4da8640cc ("riscv: Add support to dump the kernel page tables") Signed-off-by: Josephine Pfeiffer Link: https://lore.kernel.org/r/20251018170451.3355496-1-hi@josie.lol Signed-off-by: Paul Walmsley commit 060ea84a484e852b52b938f234bf9b5503a6c910 Author: Chunyan Zhang Date: Mon Oct 27 11:40:43 2025 -0600 riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460" There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks") The solution could be applied to RISC-V too. This patch also can solve the issue: https://seclists.org/oss-sec/2025/q4/23 Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") Co-developed-by: Jiakai Xu Signed-off-by: Jiakai Xu Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20251022072608.743484-1-zhangchunyan@iscas.ac.cn [pjw@kernel.org: clean up checkpatch issues] Signed-off-by: Paul Walmsley commit 8080c67dd57cb968150b668ecbd4a4e4afd56ad4 Author: Carlos Llamas Date: Fri Oct 24 19:01:00 2025 +0000 kunit: prevent log overwrite in param_tests When running parameterized tests, each test case is initialized with kunit_init_test(). This function takes the test_case->log as a parameter but it clears it via string_stream_clear() on each iteration. This results in only the log from the last parameter being preserved in the test_case->log and the results from the previous parameters are lost from the debugfs entry. Fix this by manually setting the param_test.log to the test_case->log after it has been initialized. This prevents kunit_init_test() from clearing the log on each iteration. Link: https://lore.kernel.org/r/20251024190101.2091549-1-cmllamas@google.com Fixes: 4b59300ba4d2 ("kunit: Add parent kunit for parameterized test context") Signed-off-by: Carlos Llamas Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 Author: Borislav Petkov (AMD) Date: Thu Oct 23 14:46:29 2025 +0200 x86/microcode/AMD: Limit Entrysign signature checking to known generations Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5. X86_BUG cannot be used here because the loading on the BSP happens way too early, before the cpufeatures machinery has been set up. Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org commit 2469bb6a6af944755a7d7daf66be90f3b8decbf9 Author: Baochen Qiang Date: Mon Oct 27 09:49:12 2025 +0800 Revert "wifi: ath10k: avoid unnecessary wait for service ready message" This reverts commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a. Although this commit benefits QCA6174, it breaks QCA988x and QCA9984 [1][2]. Since it is not likely to root cause/fix this issue in a short time, revert it to get those chips back. Compile tested only. Fixes: 51a73f1b2e56 ("wifi: ath10k: avoid unnecessary wait for service ready message") Link: https://lore.kernel.org/ath10k/6d41bc00602c33ffbf68781f563ff2e6c6915a3e.camel@gmail.com # [1] Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220671 # [2] Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251027-ath10k-revert-polling-first-change-v1-1-89aaf3bcbfa1@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 28935ee5e4789ad86c08ba9f2426edd6203d13fa Author: Eren Demir Date: Mon Oct 27 13:58:10 2025 +0300 ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) The quirk for Victus 15-fa1xxx wasn't working on Victus 15-fa1031nt due to a different board id. This patch enables the existing quirk for the board id 8BC8. Tested on HP Victus 15-fa1031nt (MB 8C2D). The LED behaviour works as intended. Signed-off-by: Eren Demir Link: https://patch.msgid.link/20251027110208.6481-1-eren.demir2479090@gmail.com Signed-off-by: Takashi Iwai commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 Author: Rafael J. Wysocki Date: Thu Oct 23 19:12:57 2025 +0200 cpuidle: governors: menu: Select polling state in some more cases A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency") has been reported and it is related to the case when the menu governor checks if selecting a proper idle state instead of a polling one makes sense. In particular, it is questionable to do so if the exit latency of the idle state in question exceeds the predicted idle duration, so add a check for that, which is sufficient to make the reported regression go away, and update the related code comment accordingly. Fixes: 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency") Closes: https://lore.kernel.org/linux-pm/004501dc43c9$ec8aa930$c59ffb90$@telus.net/ Reported-by: Doug Smythies Tested-by: Doug Smythies Cc: All applicable Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/12786727.O9o76ZdvQC@rafael.j.wysocki commit 8abbf45fcda028c2c05ba38eb14ede9fa9e7341b Author: Mario Tesi Date: Wed Oct 15 18:16:19 2025 +0200 iio: st_lsm6dsx: Fixed calibrated timestamp calculation The calibrated timestamp is calculated from the nominal value using the formula: ts_gain[ns] ≈ ts_sensitivity - (ts_trim_coeff * val) / 1000. The values of ts_sensitivity and ts_trim_coeff are not the same for all devices, so it is necessary to differentiate them based on the part name. For the correct values please consult the relevant AN. Fixes: cb3b6b8e1bc0 ("iio: imu: st_lsm6dsx: add odr calibration feature") Signed-off-by: Mario Tesi Acked-by: Lorenzo Bianconi Signed-off-by: Jonathan Cameron commit e0023c8a74028739643aa14bd201c41a99866ca4 Author: Philipp Stanner Date: Fri Oct 24 18:12:22 2025 +0200 drm/nouveau: Fix race in nouveau_sched_fini() nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check. Replace the barrier with a function which takes the spinlock. Cc: stable@vger.kernel.org # v6.8+ Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship") Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251024161221.196155-2-phasta@kernel.org commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 Author: Philipp Stanner Date: Wed Oct 22 08:34:03 2025 +0200 drm/sched: Fix race in drm_sched_entity_select_rq() In a past bug fix it was forgotten that entity access must be protected by the entity lock. That's a data race and potentially UB. Move the spin_unlock() to the appropriate position. Cc: stable@vger.kernel.org # v5.13+ Fixes: ac4eb83ab255 ("drm/sched: select new rq even if there is only one v3") Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251022063402.87318-2-phasta@kernel.org commit d914ec6f07548f7c13a231a4f526e043e736e82e Author: Shuming Fan Date: Mon Oct 27 18:33:33 2025 +0800 ASoC: rt721: fix prepare clock stop failed This patch adds settings to prevent the 'prepare clock stop failed' error. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251027103333.38353-1-shumingf@realtek.com Signed-off-by: Mark Brown commit b8c9aab4c738e5e9814915768ac6c184fe36ab93 Author: Guofeng Yue Date: Thu Oct 16 19:40:51 2025 +0800 RDMA/hns: Remove an extra blank line Remove an extra blank line. Signed-off-by: Guofeng Yue Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-5-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit fe9622011f955e35ba84d3af7b2f2fed31cf8ca1 Author: Junxian Huang Date: Thu Oct 16 19:40:50 2025 +0800 RDMA/hns: Fix wrong WQE data when QP wraps around When QP wraps around, WQE data from the previous use at the same position still remains as driver does not clear it. The WQE field layout differs across different opcodes, causing that the fields that are not explicitly assigned for the current opcode retain stale values, and are issued to HW by mistake. Such fields are as follows: * MSG_START_SGE_IDX field in ATOMIC WQE * BLOCK_SIZE and ZBVA fields in FRMR WQE * DirectWQE fields when DirectWQE not used For ATOMIC WQE, always set the latest sge index in MSG_START_SGE_IDX as required by HW. For FRMR WQE and DirectWQE, clear only those unassigned fields instead of the entire WQE to avoid performance penalty. Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit f5a7cbea5411668d429eb4ffe96c4063fe8dac9e Author: wenglianfa Date: Thu Oct 16 19:40:49 2025 +0800 RDMA/hns: Fix the modification of max_send_sge The actual sge number may exceed the value specified in init_attr->cap when HW needs extra sge to enable inline feature. Since these extra sges are not expected by ULP, return the user-specified value to ULP instead of the expanded sge number. Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation") Signed-off-by: wenglianfa Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit c4b67b514af8c2d73c64b36e0cd99e9b26b9ac82 Author: Chengchang Tang Date: Thu Oct 16 19:40:48 2025 +0800 RDMA/hns: Fix recv CQ and QP cache affinity Currently driver enforces affinity between QP cache and send CQ cache, which helps improve the performance of sending, but doesn't set affinity with recv CQ cache, resulting in suboptimal performance of receiving. Use one CQ bank per context to ensure the affinity among QP, send CQ and recv CQ. For kernel ULP, CQ bank is fixed to 0. Fixes: 9e03dbea2b06 ("RDMA/hns: Fix CQ and QP cache affinity") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 75cdae446ddffe0a6a991bbb146dee51d9d4c865 Author: Roy Vegard Ovesen Date: Mon Oct 20 22:15:08 2025 +0200 ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c The log messages for the PreSonus STUDIO 1810c about device_setup are not applicable to the 1824c, and should not be logged when 1824c initializes. Refactor from if statement to switch statement as there might be more STUDIO series devices added later. Fixes: 080564558eb1 ("ALSA: usb-audio: enable support for Presonus Studio 1824c within 1810c file") Signed-off-by: Roy Vegard Ovesen Link: https://patch.msgid.link/aPaYTP7ceuABf8c7@ark Signed-off-by: Takashi Iwai commit 1eb42bacd7cebede5d317569e4b874b54e5c41d6 Author: Frank Li Date: Fri Oct 17 16:39:46 2025 -0400 arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes The msi-map property was incorrectly applied to pcie0-ep instead of pcie1-ep. Correct the msi-map for both pcie0-ep and pcie1-ep nodes. Fixes: bbe4b2f7d6533 ("arm64: dts: imx95: Add msi-map for pci-ep device") Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit ec4daace64a44b53df76f0629e82684ef09ce869 Author: João Paulo Gonçalves Date: Tue Oct 14 09:56:43 2025 -0300 arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred The gpio0_mipi_csi DT nodes are enabled by default, but they are dependent on the irqsteer_csi nodes, which are not enabled. This causes the gpio0_mipi_csi GPIOs to be probe deferred. Since these GPIOs can be used independently of the CSI controller, enable irqsteer_csi by default too to prevent them from being deferred and to ensure they work out of the box. Fixes: 2217f8243714 ("arm64: dts: imx8: add capture controller for i.MX8's img subsystem") Signed-off-by: João Paulo Gonçalves Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ff7b5a27438275e4fd8c4809d815638c829fe520 Author: Andreas Kemnade Date: Mon Oct 13 14:17:09 2025 +0200 arm: imx_v6_v7_defconfig: enable ext4 directly In former times, ext4 was enabled implicitely by enabling ext3 but with the ext3 fs gone, it does not get enabled, which lets devices fail to mount root on non-initrd based boots with an ext4 root. Fixes: d6ace46c82fd ("ext4: remove obsolete EXT3 config options") Signed-off-by: Andreas Kemnade Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit f574069c5c55ebe642f899a01c8f127d845fd562 Author: Stefan Metzmacher Date: Mon Oct 20 16:07:53 2025 +0200 smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work() All handlers triggered by ib_drain_qp() should already see the broken connection. smb_direct_cm_handler() is called under a mutex of the rdma_cm, we should make sure ib_drain_qp() and all rdma layer logic completes and unlocks the mutex. It means free_transport() will also already see the connection as SMBDIRECT_SOCKET_DISCONNECTED, so we need to call crdma_[un]lock_handler(sc->rdma.cm_id) around ib_drain_qp(), rdma_destroy_qp(), ib_free_cq() and ib_dealloc_pd(). Otherwise we free resources while the ib_drain_qp() within smb_direct_cm_handler() is still running. We have to unlock before rdma_destroy_id() as it locks again. Fixes: 141fa9824c0f ("ksmbd: call ib_drain_qp when disconnected") Fixes: 4c564f03e23b ("smb: server: make use of common smbdirect_socket") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 975f05a7647720b6a82dac73463eaeca3067de71 Author: Stefan Metzmacher Date: Mon Oct 20 16:07:13 2025 +0200 smb: server: call smb_direct_post_recv_credits() when the negotiation is done We now activate sc->recv_io.posted.refill_work and sc->idle.immediate_work only after a successful negotiation, before sending the negotiation response. It means the queue_work(sc->workqueue, &sc->recv_io.posted.refill_work) in put_recvmsg() of the negotiate request, is a no-op now. It also means our explicit smb_direct_post_recv_credits() will have queue_work(sc->workqueue, &sc->idle.immediate_work) as no-op. This should make sure we don't have races and post any immediate data_transfer message that tries to grant credits to the peer, before we send the negotiation response, as that will grant the initial credits to the peer. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Fixes: 1cde0a74a7a8 ("smb: server: don't use delayed_work for post_recv_credits_work") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0 Author: Qianchang Zhao Date: Wed Oct 22 15:27:47 2025 +0900 ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing. This is a minimal fix to guard the initial handle read. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reported-by: Qianchang Zhao Signed-off-by: Qianchang Zhao Acked-by: Namjae Jeon Signed-off-by: Steve French commit f765fdfcd8b5bce92c6aa1a517ff549529ddf590 Author: Steve French Date: Fri Oct 24 21:17:01 2025 -0500 cifs: fix typo in enable_gcm_256 module parameter Fix typo in description of enable_gcm_256 module parameter Suggested-by: Thomas Spear Signed-off-by: Steve French commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa Author: Linus Torvalds Date: Sun Oct 26 15:59:49 2025 -0700 Linux 6.18-rc3 commit 4bb1f7e19c4a1d6eeb52b80acff5ac63edd1b91d Merge: 40282418e17e19 a8cc9e5fcb0e2e Author: Linus Torvalds Date: Sun Oct 26 10:33:46 2025 -0700 Merge tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc/android driver fixes for 6.18-rc3 for reported issues. Included in here are: - rust binder fixes for reported issues - mei device id addition - mei driver fixes - comedi bugfix - most usb driver bugfixes - fastrpc memory leak fix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: most: usb: hdm_probe: Fix calling put_device() before device initialization most: usb: Fix use-after-free in hdm_disconnect binder: remove "invalid inc weak" check mei: txe: fix initialization order comedi: fix divide-by-zero in comedi_buf_munge() mei: late_bind: Fix -Wincompatible-function-pointer-types-strict misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup mei: me: add wildcat lake P DID misc: amd-sbi: Clarify that this is a BMC driver nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE binder: Fix missing kernel-doc entries in binder.c rust_binder: report freeze notification only when fully frozen rust_binder: don't delete FreezeListener if there are pending duplicates rust_binder: freeze_notif_done should resend if wrong state rust_binder: remove warning about orphan mappings rust_binder: clean `clippy::mem_replace_with_default` warning commit 40282418e17e194fe70478025387cf89f8cfaf8e Merge: aa6085a06716db b1aabb8ef09b4c Author: Linus Torvalds Date: Sun Oct 26 10:29:45 2025 -0700 Merge tag 'staging-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for the gpib subsystem to resolve some reported issues. Included in here are: - memory leak fixes - error code fixes - proper protocol fixes All of these have been in linux-next for almost 2 weeks now with no reported issues" * tag 'staging-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: gpib: Fix device reference leak in fmh_gpib driver staging: gpib: Return -EINTR on device clear staging: gpib: Fix sending clear and trigger events staging: gpib: Fix no EOI on 1 and 2 byte writes commit aa6085a06716dbfa9b01c0235cc36f1e9b3e1e3e Merge: 6190d0fa18995b d518314a1fa4e9 Author: Linus Torvalds Date: Sun Oct 26 10:24:39 2025 -0700 Merge tag 'tty-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for reported issues. Included in here are: - sh-sci serial driver fixes - 8250_dw and _mtk driver fixes - sc16is7xx driver bugfix - new 8250_exar device ids added All of these have been in linux-next this past week with no reported issues" * tag 'tty-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250_mtk: Enable baud clock and manage in runtime PM serial: 8250_dw: handle reset control deassert error dt-bindings: serial: sh-sci: Fix r8a78000 interrupts serial: sc16is7xx: remove useless enable of enhanced features serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 tty: serial: sh-sci: fix RSCI FIFO overrun handling commit 6190d0fa18995b8bcc6b9a26913bb8390bda8396 Merge: dbfc6422a34d6c a1b866f2018748 Author: Linus Torvalds Date: Sun Oct 26 10:21:13 2025 -0700 Merge tag 'usb-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 6.18-rc3. Included in here are: - new option serial driver device ids added - dt bindings fixes for numerous platforms - xhci bugfixes for many reported regressions - usbio dependency bugfix - dwc3 driver fix - raw-gadget bugfix All of these have been in linux-next this week with no reported issues" * tag 'usb-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C tcpm: switch check for role_sw device with fw_node usb/core/quirks: Add Huawei ME906S to wakeup quirk usb: raw-gadget: do not limit transfer length USB: serial: option: add UNISOC UIS7720 xhci: dbc: enable back DbC in resume if it was enabled before suspend xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event usb: xhci-pci: Fix USB2-only root hub registration dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100 usb: misc: Add x86 dependency for Intel USBIO driver dt-bindings: usb: switch: split out ports definition usb: dwc3: Don't call clk_bulk_disable_unprepare() twice dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp commit dbfc6422a34d6cb28e5c0432af309b24f66ef27e Merge: 5fee0dafba0a52 84dfce65a7ae7b Author: Linus Torvalds Date: Sun Oct 26 09:57:18 2025 -0700 Merge tag 'x86_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Remove dead code leftovers after a recent mitigations cleanup which fail a Clang build - Make sure a Retbleed mitigation message is printed only when necessary - Correct the last Zen1 microcode revision for which Entrysign sha256 check is needed - Fix a NULL ptr deref when mounting the resctrl fs on a system which supports assignable counters but where L3 total and local bandwidth monitoring has been disabled at boot * tag 'x86_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Remove dead code which might prevent from building x86/bugs: Qualify RETBLEED_INTEL_MSG x86/microcode: Fix Entrysign revision check for Zen1/Naples x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode commit 5fee0dafba0a5223fa1c1f0dd99af71256449d38 Merge: af8159515fe160 ef3330b99c01bd Author: Linus Torvalds Date: Sun Oct 26 09:54:36 2025 -0700 Merge tag 'irq_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Restore the original buslock locking in a couple of places in the irq core subsystem after a rework * tag 'irq_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/manage: Add buslock back in to enable_irq() genirq/manage: Add buslock back in to __disable_irq_nosync() genirq/chip: Add buslock back in to irq_set_handler() commit af8159515fe16070aefa3ff56a44a5e7fb179dd2 Merge: 1bc9743b6452cb 49c98f30f4021b Author: Linus Torvalds Date: Sun Oct 26 09:44:36 2025 -0700 Merge tag 'objtool_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Borislav Petkov: - Fix x32 build due to wrong format specifier on that sub-arch - Add one more Rust noreturn function to objtool's list * tag 'objtool_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix failure when being compiled on x32 system objtool/rust: add one more `noreturn` Rust function commit 1bc9743b6452cb5a4d09944bd3d6e33b074bb22d Merge: 7ea5092f5208d1 0e4a169d1a2b63 Author: Linus Torvalds Date: Sun Oct 26 09:42:19 2025 -0700 Merge tag 'sched_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Make sure a CFS runqueue on a throttled hierarchy has its PELT clock throttled otherwise task movement and manipulation would lead to dangling cfs_rq references and an eventual crash * tag 'sched_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Start a cfs_rq on throttled hierarchy with PELT clock throttled commit 7ea5092f5208d1758926ca54941f8a8ad49736b5 Merge: 72761a7e312259 39a9ed0fb6dac5 Author: Linus Torvalds Date: Sun Oct 26 09:40:16 2025 -0700 Merge tag 'timers_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Do not create more than eight (max supported) AUX clocks sysfs hierarchies * tag 'timers_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix aux clocks sysfs initialization loop bound commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 Author: Thomas Zimmermann Date: Fri Oct 17 11:13:36 2025 +0200 drm/sysfb: Do not dereference NULL pointer in plane reset The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL. v2: - fix typo in commit description (Javier) Signed-off-by: Thomas Zimmermann Fixes: b71565022031 ("drm/gem: Export implementation of shadow-plane helpers") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/aPIDAsHIUHp_qSW4@stanley.mountain/ Cc: Thomas Zimmermann Cc: Melissa Wen Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Simona Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v5.15+ Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20251017091407.58488-1-tzimmermann@suse.de commit 5ff90d427ef841fa48608d0c19a81c48d6126d46 Author: James Le Cuirot Date: Thu Oct 16 10:14:17 2025 +0100 kbuild: install-extmod-build: Fix when given dir outside the build dir Commit b5e395653546 ("kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT") tried to address the "build" variable expecting a relative path by using `realpath --relative-base=.`, but this only works when the given directory is below the current directory. `realpath --relative-to=.` will return a relative path in all cases. Fixes: b5e395653546 ("kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT") Signed-off-by: James Le Cuirot Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251016091417.9985-1-chewi@gentoo.org Signed-off-by: Nathan Chancellor commit 72761a7e31225971d0b29d9195e0ffa986b77867 Merge: 818444a61bd87d 2eead19334516c Author: Linus Torvalds Date: Sat Oct 25 11:03:46 2025 -0700 Merge tag 'driver-core-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - In Device::parent(), do not make any assumptions on the device context of the parent device - Check visibility before changing ownership of a sysfs attribute group - In topology_parse_cpu_capacity(), replace an incorrect usage of PTR_ERR_OR_ZERO() with IS_ERR_OR_NULL() - In devcoredump, fix a circular locking dependency between struct devcd_entry::mutex and kernfs - Do not warn about a pending fw_devlink sync state * tag 'driver-core-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() rust: device: fix device context of Device::parent() sysfs: check visibility before changing group attribute ownership devcoredump: Fix circular locking dependency with devcd->mutex. driver core: fw_devlink: Don't warn about sync_state() pending commit 818444a61bd87d8b72c93448a62be2406b92ec33 Merge: 9bb956508c9d94 73ba88fb040813 Author: Linus Torvalds Date: Sat Oct 25 10:58:32 2025 -0700 Merge tag 'firewire-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "A small collection of FireWire fixes. This includes corrections to sparse and API documentation" * tag 'firewire-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: init_ohci1394_dma: add missing function parameter documentation firewire: core: fix __must_hold() annotation commit 00d5f09719aa6c37545be5c05d25a1eaf8f3da7e Author: Rob Clark Date: Wed Oct 22 15:20:38 2025 -0700 drm/msm: Ensure vm is created in VM_BIND ioctl Since the vm is lazily created, to allow userspace to opt-in to a VM_BIND context, we can't assume it is already created. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/682939/ Message-ID: <20251022222039.9937-1-robin.clark@oss.qualcomm.com> commit 73b7e48a87c79fd6df40aeafcd3994287e31e25f Author: Rob Clark Date: Wed Oct 22 15:20:51 2025 -0700 drm/msm: Reject MAP_NULL op if no PRR We need PRR support in order to implement MAP_NULL. Userspace shouldn't be trying to use this if it is unsupported. Reported-by: Valentine Burley Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37935#note_3153730 Signed-off-by: Rob Clark Tested-by: Valentine Burley Patchwork: https://patchwork.freedesktop.org/patch/682941/ Message-ID: <20251022222051.10030-1-robin.clark@oss.qualcomm.com> commit 9bb956508c9d94935bedba4f13901fb2b7468e91 Merge: 27c0b5c4f67aeb b7776a802f2f80 Author: Linus Torvalds Date: Sat Oct 25 09:35:26 2025 -0700 Merge tag 'riscv-for-linus-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Close a race during boot between userspace vDSO usage and some late-initialized vDSO data - Improve performance on systems with non-CPU-cache-coherent DMA-capable peripherals by enabling write combining on pgprot_dmacoherent() allocations - Add human-readable detail for RISC-V IPI tracing - Provide more information to zsmalloc on 64-bit RISC-V to improve allocation - Silence useless boot messages about CPUs that have been disabled in DT - Resolve some compiler and smatch warnings and remove a redundant macro * tag 'riscv-for-linus-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb() riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot riscv: add a forward declaration for cpuinfo_op RISC-V: Don't print details of CPUs disabled in DT riscv: Remove the PER_CPU_OFFSET_SHIFT macro riscv: mm: Define MAX_POSSIBLE_PHYSMEM_BITS for zsmalloc riscv: Register IPI IRQs with unique names ACPI: RIMT: Fix unused function warnings when CONFIG_IOMMU_API is disabled RISC-V: Define pgprot_dmacoherent() for non-coherent devices commit 27c0b5c4f67aeb73edd515200bd1e0c82a3ee892 Merge: 566771afc7a81e f477af0cfa0487 Author: Linus Torvalds Date: Sat Oct 25 09:31:13 2025 -0700 Merge tag 'xfs-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "The main highlight here is a fix for a bug brought in by the removal of attr2 mount option, where some installations might actually have 'attr2' explicitly configured in fstab preventing system to boot by not being able to remount the rootfs as RW. Besides that there are a couple fix to the zonefs implementation, changing XFS_ONLINE_SCRUB_STATS to depend on DEBUG_FS (was select before), and some other minor changes" * tag 'xfs-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix locking in xchk_nlinks_collect_dir xfs: loudly complain about defunct mount options xfs: always warn about deprecated mount options xfs: don't set bt_nr_sectors to a negative number xfs: don't use __GFP_NOFAIL in xfs_init_fs_context xfs: cache open zone in inode->i_private xfs: avoid busy loops in GCD xfs: XFS_ONLINE_SCRUB_STATS should depend on DEBUG_FS xfs: do not tightly pack-write large files xfs: Improve CONFIG_XFS_RT Kconfig help commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f Author: Emanuele Ghidoli Date: Thu Oct 23 16:48:53 2025 +0200 net: phy: dp83867: Disable EEE support as not implemented While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures. The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY. Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs. Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") Cc: stable@vger.kernel.org Signed-off-by: Emanuele Ghidoli Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com Signed-off-by: Jakub Kicinski commit 566771afc7a81e343da9939f0bd848d3622e2501 Merge: 53abe3e1c15462 dd6940f5c7dbee Author: Linus Torvalds Date: Fri Oct 24 18:50:15 2025 -0700 Merge tag 'v6.18-rc2-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "smbdirect (RDMA) fixes in order avoid potential submission queue overflows: - free transport teardown fix - credit related fixes (five server related, one client related)" * tag 'v6.18-rc2-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let free_transport() wait for SMBDIRECT_SOCKET_DISCONNECTED smb: client: make use of smbdirect_socket.send_io.lcredits.* smb: server: make use of smbdirect_socket.send_io.lcredits.* smb: server: simplify sibling_list handling in smb_direct_flush_send_list/send_done smb: server: smb_direct_disconnect_rdma_connection() already wakes all waiters on error smb: smbdirect: introduce smbdirect_socket.send_io.lcredits.* smb: server: allocate enough space for RW WRs and ib_drain_qp() commit 53abe3e1c154628cc74e33a1bfcd865656e433a5 Author: Andy Shevchenko Date: Wed Oct 15 11:19:34 2025 +0200 sched: Remove never used code in mm_cid_get() Clang is not happy with set but unused variable (this is visible with `make W=1` build: kernel/sched/sched.h:3744:18: error: variable 'cpumask' set but not used [-Werror,-Wunused-but-set-variable] It seems like the variable was never used along with the assignment that does not have side effects as far as I can see. Remove those altogether. Fixes: 223baf9d17f2 ("sched: Fix performance regression introduced by mm_cid") Signed-off-by: Andy Shevchenko Tested-by: Eric Biggers Reviewed-by: Breno Leitao Signed-off-by: Linus Torvalds commit 3d08a425d2f667edf9ab7f9c3d999c218a96ba6f Merge: 31009296f8ff7f 18b1ce0b29c418 Author: Linus Torvalds Date: Fri Oct 24 16:49:16 2025 -0700 Merge tag 'drm-fixes-2025-10-24' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "Very quiet, all just small stuff and nothing scary pending to my knowledge: - drm_panic: bunch of size calculation fixes - pantor: fix kernel panic on partial gpu va unmap - rockchip: hdmi hotplug setup fix - amdgpu: dp mst, dc/display fixes - i915: fix panic structure leak - xe: madvise uapi fix, wq alloc error, vma flag handling fix" * tag 'drm-fixes-2025-10-24' of https://gitlab.freedesktop.org/drm/kernel: drm/xe: Check return value of GGTT workqueue allocation drm/amd/display: use GFP_NOWAIT for allocation in interrupt handler drm/amd/display: increase max link count and fix link->enc NULL pointer access drm/amd/display: Fix NULL pointer dereference drm/panic: Fix 24bit pixel crossing page boundaries drm/panic: Fix divide by 0 if the screen width < font width drm/panic: Fix kmsg text drawing rectangle drm/panic: Fix qr_code, ensure vmargin is positive drm/panic: Fix overlap between qr code and logo drm/panic: Fix drawing the logo on a small narrow screen drm/xe/uapi: Hide the madvise autoreset behind a VM_BIND flag drm/xe: Retain vma flags when recreating and splitting vmas for madvise drm/i915/panic: fix panic structure allocation memory leak drm/panthor: Fix kernel panic on partial unmap of a GPU VA region drm/rockchip: dw_hdmi: use correct SCLIN mask for RK3228 commit 31009296f8ff7f4cc8feec9bc02b87573b2aceeb Merge: 7083bb6060a99a df5192d9bb0e38 Author: Linus Torvalds Date: Fri Oct 24 16:43:08 2025 -0700 Merge tag 'pci-v6.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Add DWC custom pci_ops for the root bus instead of overwriting the DBI base address, which broke drivers that rely on the DBI address for iATU programming; fixes an FU740 probe regression (Krishna Chaitanya Chundru) - Revert qcom ECAM enablement, which is rendered unnecessary by the DWC custom pci_ops (Krishna Chaitanya Chundru) - Fix longstanding MIPS Malta resource registration issues to avoid exposing them when the next commit fixes the boot failure (Maciej W. Rozycki) - Use pcibios_align_resource() on MIPS Malta to fix boot failure caused by using the generic pci_enable_resources() (Ilpo Järvinen) - Enable only ASPM L0s and L1, not L1 PM Substates, for devicetree platforms because we lack information required to configure L1 Substates; fixes regressions on powerpc and rockchip. A qcom regression (L1 Substates no longer enabled) remains and will be addressed next (Bjorn Helgaas) * tag 'pci-v6.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/ASPM: Enable only L0s and L1 for devicetree platforms MIPS: Malta: Use pcibios_align_resource() to block io range MIPS: Malta: Fix PCI southbridge legacy resource reservations MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering Revert "PCI: qcom: Prepare for the DWC ECAM enablement" PCI: dwc: Use custom pci_ops for root bus DBI vs ECAM config access commit 73ba88fb04081372a69f0395958ac6b65d53d134 Author: Nirbhay Sharma Date: Sat Oct 25 02:02:19 2025 +0530 firewire: init_ohci1394_dma: add missing function parameter documentation Add missing kernel-doc parameter descriptions for five functions in init_ohci1394_dma.c to fix documentation warnings when building with W=1. This patch addresses the following warnings: - init_ohci1394_wait_for_busresets: missing @ohci description - init_ohci1394_enable_physical_dma: missing @ohci description - init_ohci1394_reset_and_init_dma: missing @ohci description - init_ohci1394_controller: missing @num, @slot, @func descriptions - setup_ohci1394_dma: missing @opt description Tested with GCC 13.2.0 and W=1 flag. All documentation warnings for these functions have been resolved. Signed-off-by: Nirbhay Sharma Link: https://lore.kernel.org/r/20251024203219.101990-2-nirbhay.lkd@gmail.com Signed-off-by: Takashi Sakamoto commit 7083bb6060a99a4c7e60e710b70a2ea8fb2d524c Merge: f2b246572699a6 1af424b15401d2 Author: Linus Torvalds Date: Fri Oct 24 15:51:24 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Avoid some false-positive KMSAN warnings by restoring the dependency of the architecture-optimized Poly1305 code on !KMSAN" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: poly1305: Restore dependency of arch code on !KMSAN commit f2b246572699a66eded2cf7afc46f53837878f14 Merge: d2818517e3486d 64c9471aa9ded2 Author: Linus Torvalds Date: Fri Oct 24 15:48:08 2025 -0700 Merge tag '6.18-rc2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - add missing tracepoints - smbdirect (RDMA) fix - fix potential issue with credits underflow - rename fix - improvement to calc_signature and additional cleanup patch * tag '6.18-rc2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: #include cifsglob.h before trace.h to allow structs in tracepoints cifs: Call the calc_signature functions directly smb: client: get rid of d_drop() in cifs_do_rename() cifs: Fix TCP_Server_Info::credits to be signed cifs: Add a couple of missing smb3_rw_credits tracepoints smb: client: allocate enough space for MR WRs and ib_drain_qp() commit d2818517e3486d11c9bd55aca3e14059e4c69886 Merge: 812e7eb2b0741b 4c8cf6bd28d6fe Author: Linus Torvalds Date: Fri Oct 24 12:48:19 2025 -0700 Merge tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix dma alignment for PI - Fix selinux bogosity with nbd, where sendmsg would get rejected * tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: require LBA dma_alignment when using PI nbd: override creds to kernel when calling sock_{send,recv}msg() commit 812e7eb2b0741bb4a94f2b8c9b789ba5d693eedf Merge: 66cd8e9cb81015 6f1cbf6d6fd13f Author: Linus Torvalds Date: Fri Oct 24 12:44:31 2025 -0700 Merge tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Add MAINTAINERS entry for zcrx, mostly so that netdev gets automatically CC'ed by default on any changes there too. - Fix for the SQPOLL busy vs work time accounting. It was using getrusage(), which was both broken from a thread point of view (we only care about the SQPOLL thread itself), and vastly overkill as only the systime was used. On top of that, also be a bit smarter in when it's queried. It used excessive CPU before this change. Marked for stable as well. - Fix provided ring buffer auto commit for uring_cmd. - Fix a few style issues and sparse annotation for a lock. * tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix buffer auto-commit for multishot uring_cmd io_uring: correct __must_hold annotation in io_install_fixed_file io_uring zcrx: add MAINTAINERS entry io_uring: Fix code indentation error io_uring/sqpoll: be smarter on when to update the stime usage io_uring/sqpoll: switch away from getrusage() for CPU accounting io_uring: fix incorrect unlikely() usage in io_waitid_prep() commit 66cd8e9cb81015a2ec7f9dfb83db7d7915587eef Merge: 2e590d67c2d803 7f434e1d9a17ca Author: Linus Torvalds Date: Fri Oct 24 12:40:51 2025 -0700 Merge tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Two fixes for race conditions in obj_exts allocation (Hao Ge) - Fix for slab accounting imbalance due to deferred slab decativation (Vlastimil Babka) * tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: Fix obj_ext mistakenly considered NULL due to race condition slab: fix slab accounting imbalance due to defer_deactivate_slab() slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts commit 2e590d67c2d803d603ac00b85f2fab235df52a1b Merge: 9b9b6e71ee23da 7209ff31008331 Author: Linus Torvalds Date: Fri Oct 24 11:17:38 2025 -0700 Merge tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix handling of GICv5 ITS MSI properties on platforms with 'msi-parent' as well as a of_node refcounting fix. This is also preparation for further refactoring in 6.19 to use common DT parsing of MSI properties. * tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/irq: Export of_msi_xlate() for module usage of/irq: Fix OF node refcount in of_msi_get_domain() of/irq: Add msi-parent check to of_msi_xlate() commit 9b9b6e71ee23da4ac5191dd9c5ba8dfe778cde36 Merge: 7bd29bf1fda493 b2a578f3127ab9 Author: Linus Torvalds Date: Fri Oct 24 11:15:17 2025 -0700 Merge tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The main change this time is an update to the MAINTAINERS file, listing Krzysztof Kozlowski, Alexandre Belloni, and Linus Walleij as additional maintainers for the SoC tree, in order to go back to a group maintainership. Drew Fustini joins as an additional reviewer for the SoC tree. Thanks to all of you for volunteering to help out. On the actual bugfixes, we have a few correctness changes for firmware drivers (qtee, arm-ffa, scmi) and two devicetree fixes for Raspberry Pi" * tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: soc: officially expand maintainership team firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode firmware: arm_scmi: Skip RAW initialization on failure include: trace: Fix inflight count helper on failed initialization firmware: arm_scmi: Account for failed debug initialization ARM: dts: broadcom: rpi: Switch to V3D firmware clock arm64: dts: broadcom: bcm2712: Define VGIC interrupt firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor tee: QCOMTEE should depend on ARCH_QCOM tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails tee: qcom: prevent potential off by one read commit 7bd29bf1fda493fd122924b158869a3b43e14887 Merge: 58834e2d3ed49d 8dcc66ad379ec0 Author: Linus Torvalds Date: Fri Oct 24 11:11:35 2025 -0700 Merge tag 'hwmon-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - cgbc-hwmon: Add missing NULL check after devm_kzalloc - gpd-fan: Fix error handling - pmbus/isl68137: Fix child node reference leak - pmbus/max34440: Update adpm12160 coefficients to match latest FW - sht3x: Fix error handling * tag 'hwmon-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (sht3x) Fix error handling hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() hwmon: (pmbus/isl68137) Fix child node reference leak on early return hwmon: (gpd-fan) Fix error handling in gpd_fan_probe() hwmon: (gpd-fan) Fix return value when platform_get_resource() fails hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW commit 58834e2d3ed49d4424821d75b7eac90795212acb Merge: c1a1c0d32d5b6d 1b824134261d2d Author: Linus Torvalds Date: Fri Oct 24 11:01:40 2025 -0700 Merge tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A moderately large collection of device specific changes here, mostly fixes but also including a few new quirks and device IDs. This is all fairly routine even for the affected devices" * tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spi-rockchip: Add RK3506 compatible spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash spi: intel-pci: Add support for Arrow Lake-H SPI serial flash spi: intel: Add support for 128M component density spi: airoha: fix reading/writing of flashes with more than one plane per lun spi: airoha: switch back to non-dma mode in the case of error spi: airoha: add support of dual/quad wires spi modes to exec_op() handler spi: airoha: return an error for continuous mode dirmap creation cases spi: amlogic: fix spifc build error spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection spi: spi-nxp-fspi: add extra delay after dll locked spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate spi: dw-mmio: add error handling for reset_control_deassert() spi: rockchip-sfc: Fix DMA-API usage spi: dt-bindings: cadence: add soc-specific compatible strings for zynqmp and versal-net commit c1a1c0d32d5b6dd219f9b9e7c51ed4c69882fe62 Merge: 6fab32bb6508ab 4c4e6ea4a120cc Author: Linus Torvalds Date: Fri Oct 24 10:45:29 2025 -0700 Merge tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix regressions in regmap cache initialization in gpio-104-idio-16 and gpio-pci-idio-16 - configure first 16 GPIO lines of the IDIO-16 as fixed outputs - fix duplicated IRQ mapping that can lead to an RCU stall in gpio-ljca - fix printf formatters passed to dev_err() and make failure to set debounce period non fatal * tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: ljca: Fix duplicated IRQ mapping gpiolib: acpi: Use %pe when passing an error pointer to dev_err() gpiolib: acpi: Make set debounce errors non fatal gpio: idio-16: Define fixed direction of the GPIO lines gpio: regmap: add the .fixed_direction_output configuration parameter gpio: pci-idio-16: Define maximum valid register address offset gpio: 104-idio-16: Define maximum valid register address offset commit b2a578f3127ab9ef80114cef9b20a2b42a8ee77a Author: Arnd Bergmann Date: Fri Oct 17 16:08:24 2025 +0200 soc: officially expand maintainership team Since Olof moved on from the soc tree maintenance, Arnd has mainly taken care of the day-to-day activities around the SoC tree by himself, which is generally not a good setup. Krzysztof, Linus and Alexandre have volunteered to become co-maintainers of the SoC tree, with the plan of taking turns to do merges and reviews to spread the workload. In addition, Drew joins as another reviewer. Acked-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Linus Walleij Acked-by: Drew Fustini Signed-off-by: Arnd Bergmann commit 8ce93aabbf75171470e3d1be56bf1a6937dc5db8 Author: Malin Jonsson Date: Fri Oct 24 17:14:36 2025 +0200 bpf: Conditionally include dynptr copy kfuncs Since commit a498ee7576de ("bpf: Implement dynptr copy kfuncs"), if CONFIG_BPF_EVENTS is not enabled, but BPF_SYSCALL and DEBUG_INFO_BTF are, the build will break like so: BTFIDS vmlinux.unstripped WARN: resolve_btfids: unresolved symbol bpf_probe_read_user_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_user_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_kernel_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_kernel_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_task_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_task_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_dynptr make[2]: *** [scripts/Makefile.vmlinux:72: vmlinux.unstripped] Error 255 make[2]: *** Deleting file 'vmlinux.unstripped' make[1]: *** [/repo/malin/upstream/linux/Makefile:1242: vmlinux] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Guard these symbols with #ifdef CONFIG_BPF_EVENTS to resolve the problem. Fixes: a498ee7576de ("bpf: Implement dynptr copy kfuncs") Reported-by: Yong Gu Acked-by: Mykyta Yatsenko Signed-off-by: Malin Jonsson Link: https://lore.kernel.org/r/20251024151436.139131-1-malin.jonsson@est.tech Signed-off-by: Alexei Starovoitov commit 84dfce65a7ae7b11c7b13285a1b23e9a94ad37b7 Author: Andy Shevchenko Date: Fri Oct 24 14:59:59 2025 +0200 x86/bugs: Remove dead code which might prevent from building Clang, in particular, is not happy about dead code: arch/x86/kernel/cpu/bugs.c:1830:20: error: unused function 'match_option' [-Werror,-Wunused-function] 1830 | static inline bool match_option(const char *arg, int arglen, const char *opt) | ^~~~~~~~~~~~ 1 error generated. Remove a leftover from the previous cleanup. Fixes: 02ac6cc8c5a1 ("x86/bugs: Simplify SSB cmdline parsing") Signed-off-by: Andy Shevchenko Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251024125959.1526277-1-andriy.shevchenko%40linux.intel.com commit 033559473dd3b55558b535aa37b8848c207b5cbb Author: Akash Goel Date: Tue Oct 21 17:09:51 2025 +0100 dma-fence: Fix safe access wrapper to call timeline name method This commit fixes the wrapper function dma_fence_timeline_name(), that was added for safe access, to actually call the timeline name method of dma_fence_ops. Cc: # v6.17+ Signed-off-by: Akash Goel Fixes: 506aa8b02a8d ("dma-fence: Add safe access helpers and document the rules") Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251021160951.1415603-1-akash.goel@arm.com commit 8c5fa3764facaad6d38336e90f406c2c11d69733 Author: Fangyu Yu Date: Tue Oct 21 22:21:31 2025 +0800 RISC-V: KVM: Remove automatic I/O mapping for VM_PFNMAP As of commit aac6db75a9fc ("vfio/pci: Use unmap_mapping_range()"), vm_pgoff may no longer guaranteed to hold the PFN for VM_PFNMAP regions. Using vma->vm_pgoff to derive the HPA here may therefore produce incorrect mappings. Instead, I/O mappings for such regions can be established on-demand during g-stage page faults, making the upfront ioremap in this path is unnecessary. Fixes: aac6db75a9fc ("vfio/pci: Use unmap_mapping_range()") Signed-off-by: Fangyu Yu Tested-by: Daniel Henrique Barboza Reviewed-by: Guo Ren Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251021142131.78796-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit 91d35ec9b3956d6b3cf789c1593467e58855b03a Author: Johan Hovold Date: Thu Oct 23 14:05:30 2025 +0200 Bluetooth: rfcomm: fix modem control handling The RFCOMM driver confuses the local and remote modem control signals, which specifically means that the reported DTR and RTS state will instead reflect the remote end (i.e. DSR and CTS). This issue dates back to the original driver (and a follow-on update) merged in 2002, which resulted in a non-standard implementation of TIOCMSET that allowed controlling also the TS07.10 IC and DV signals by mapping them to the RI and DCD input flags, while TIOCMGET failed to return the actual state of DTR and RTS. Note that the bogus control of input signals in tiocmset() is just dead code as those flags will have been masked out by the tty layer since 2003. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit 751463ceefc3397566d03c8b64ef4a77f5fd88ac Author: Luiz Augusto von Dentz Date: Wed Oct 22 16:03:19 2025 -0400 Bluetooth: hci_core: Fix tracking of periodic advertisement Periodic advertising enabled flag cannot be tracked by the enabled flag since advertising and periodic advertising each can be enabled/disabled separately from one another causing the states to be inconsistent when for example an advertising set is disabled its enabled flag is set to false which is then used for periodic which has not being disabled. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Luiz Augusto von Dentz commit 857eb0fabc389be5159e0e17d84bc122614b5b98 Author: Luiz Augusto von Dentz Date: Wed Oct 22 16:29:41 2025 -0400 Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS This fixes bis_cleanup not considering connections in BT_OPEN state before attempting to remove the BIG causing the following error: btproxy[20110]: < HCI Command: LE Terminate Broadcast Isochronous Group (0x08|0x006a) plen 2 BIG Handle: 0x01 Reason: Connection Terminated By Local Host (0x16) > HCI Event: Command Status (0x0f) plen 4 LE Terminate Broadcast Isochronous Group (0x08|0x006a) ncmd 1 Status: Unknown Advertising Identifier (0x42) Fixes: fa224d0c094a ("Bluetooth: ISO: Reassociate a socket with an active BIS") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit b489556a856d31f1eb73972150f371d2e4ce1de8 Author: Calvin Owens Date: Thu Oct 23 11:47:19 2025 -0700 Bluetooth: fix corruption in h4_recv_buf() after cleanup A different structure is stored in drvdata for the drivers which used that duplicate function, but h4_recv_buf() assumes drvdata is always an hci_uart structure. Consequently, alignment and padding are now randomly corrupted for btmtkuart, btnxpuart, and bpa10x in h4_recv_buf(), causing erratic breakage. Fix this by making the hci_uart structure the explicit argument to h4_recv_buf(). Every caller already has a reference to hci_uart, and already obtains the hci_hdev reference through it, so this actually eliminates a redundant pointer indirection for all existing callers. Fixes: 93f06f8f0daf ("Bluetooth: remove duplicate h4_recv_buf() in header") Reported-by: Francesco Valla Closes: https://lore.kernel.org/lkml/6837167.ZASKD2KPVS@fedora.fritz.box/ Signed-off-by: Calvin Owens Signed-off-by: Luiz Augusto von Dentz commit 057b6ca5961203f16a2a02fb0592661a7a959a84 Author: Kiran K Date: Thu Oct 16 10:00:43 2025 +0530 Bluetooth: btintel_pcie: Fix event packet loss issue In the current btintel_pcie driver implementation, when an interrupt is received, the driver checks for the alive cause before the TX/RX cause. Handling the alive cause involves resetting the TX/RX queue indices. This flow works correctly when the causes are mutually exclusive. However, if both cause bits are set simultaneously, the alive cause resets the queue indices, resulting in an event packet drop and a command timeout. To fix this issue, the driver is modified to handle all other causes before checking for the alive cause. Test case: Issue is seen with stress reboot scenario - 50x run [20.337589] Bluetooth: hci0: Device revision is 0 [20.346750] Bluetooth: hci0: Secure boot is enabled [20.346752] Bluetooth: hci0: OTP lock is disabled [20.346752] Bluetooth: hci0: API lock is enabled [20.346752] Bluetooth: hci0: Debug lock is disabled [20.346753] Bluetooth: hci0: Minimum firmware build 1 week 10 2014 [20.346754] Bluetooth: hci0: Bootloader timestamp 2023.43 buildtype 1 build 11631 [20.359070] Bluetooth: hci0: Found device firmware: intel/ibt-00a0-00a1-iml.sfi [20.371499] Bluetooth: hci0: Boot Address: 0xb02ff800 [20.385769] Bluetooth: hci0: Firmware Version: 166-34.25 [20.538257] Bluetooth: hci0: Waiting for firmware download to complete [20.554424] Bluetooth: hci0: Firmware loaded in 178651 usecs [21.081588] Bluetooth: hci0: Timeout (500 ms) on tx completion [21.096541] Bluetooth: hci0: Failed to send frame (-62) [21.110240] Bluetooth: hci0: sending frame failed (-62) [21.138551] Bluetooth: hci0: Failed to send Intel Reset command [21.170153] Bluetooth: hci0: Intel Soft Reset failed (-62) Signed-off-by: Kiran K Signed-off-by: Sai Teja Aluvala Reviewed-by: Paul Menzel Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Luiz Augusto von Dentz commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 Author: Luiz Augusto von Dentz Date: Tue Oct 7 13:29:15 2025 -0400 Bluetooth: ISO: Fix another instance of dst_type handling Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used. Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") Signed-off-by: Luiz Augusto von Dentz commit 76e20da0bd00c556ed0a1e7250bdb6ac3e808ea8 Author: Frédéric Danis Date: Mon Oct 6 10:35:44 2025 +0200 Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" This reverts commit c9d84da18d1e0d28a7e16ca6df8e6d47570501d4. It replaces in L2CAP calls to msecs_to_jiffies() to secs_to_jiffies() and updates the constants accordingly. But the constants are also used in LCAP Configure Request and L2CAP Configure Response which expect values in milliseconds. This may prevent correct usage of L2CAP channel. To fix it, keep those constants in milliseconds and so revert this change. Fixes: c9d84da18d1e ("Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()") Signed-off-by: Frédéric Danis Signed-off-by: Luiz Augusto von Dentz commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 Author: Pauli Virtanen Date: Fri Oct 3 22:07:32 2025 +0300 Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error. Fixes: 302a1f674c00d ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 0d92808024b4e9868cef68d16f121d509843e80e Author: Luiz Augusto von Dentz Date: Wed Oct 1 10:55:58 2025 -0400 Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 This fixes the state tracking of advertisement set/instance 0x00 which is considered a legacy instance and is not tracked individually by adv_instances list, previously it was assumed that hci_dev itself would track it via HCI_LE_ADV but that is a global state not specifc to instance 0x00, so to fix it a new flag is introduced that only tracks the state of instance 0x00. Fixes: 1488af7b8b5f ("Bluetooth: hci_sync: Fix hci_resume_advertising_sync") Signed-off-by: Luiz Augusto von Dentz commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 Author: Chris Lu Date: Tue Sep 30 13:39:33 2025 +0800 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset This patch adds logic to handle power management control when the Bluetooth function is closed during the SDIO reset sequence. Specifically, if BT is closed before reset, the driver enables the SDIO function and sets driver pmctrl. After reset, if BT remains closed, the driver sets firmware pmctrl and disables the SDIO function. These changes ensure proper power management and device state consistency across the reset flow. Fixes: 8fafe702253d ("Bluetooth: mt7921s: support bluetooth reset mechanism") Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit f0c200a4a537f8f374584a974518b0ce69eda76c Author: Luiz Augusto von Dentz Date: Fri Sep 26 11:48:50 2025 -0400 Bluetooth: ISO: Fix BIS connection dst_type handling Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used. Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") Signed-off-by: Luiz Augusto von Dentz commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 Author: Cen Zhang Date: Mon Sep 29 05:30:17 2025 +0000 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently. Fixes: 505ea2b29592 ("Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue") Reported-by: Cen Zhang Signed-off-by: Cen Zhang Signed-off-by: Luiz Augusto von Dentz commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea Author: Farhan Ali Date: Wed Oct 22 09:47:26 2025 -0700 s390/pci: Restore IRQ unconditionally for the zPCI device Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device. Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag. However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant. Fixes: c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()") Cc: stable@vger.kernnel.org Reviewed-by: Niklas Schnelle Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Signed-off-by: Heiko Carstens commit 840bc67cf01399b756e7714dc2f80eb9d40a0541 Author: Heiko Carstens Date: Wed Oct 22 14:25:58 2025 +0200 s390: Update defconfigs Signed-off-by: Heiko Carstens commit 7209ff310083315386570bf8d001a0845fe7ab8c Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:01 2025 +0200 of/irq: Export of_msi_xlate() for module usage of_msi_xlate() is required by drivers that can be configured as modular, export the symbol. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Rob Herring Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251021124103.198419-4-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit a1b866f2018748282fa026eb4c92d032dfda11a9 Merge: 2d8713f807a49b 622865c73ae30f Author: Greg Kroah-Hartman Date: Fri Oct 24 13:52:58 2025 +0200 Merge tag 'usb-serial-6.18-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 6.18-rc3 Here are some new modem device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C USB: serial: option: add UNISOC UIS7720 commit 18b1ce0b29c41833363b58ad030b76dabf984899 Merge: adb0971a1acd46 ce29214ada6d08 Author: Simona Vetter Date: Fri Oct 24 13:39:21 2025 +0200 Merge tag 'drm-xe-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Make madvise autoreset an explicit behavior requested by userspace (Thomas Hellström) Driver Changes: - Drop XE_VMA flag conversion and ensure GPUVA flags are passed around (homas Hellström) - Fix missing wq allocation error checking (Matthew Brost) Signed-off-by: Simona Vetter From: Lucas De Marchi Link: https://lore.kernel.org/r/4p2glnvgifc6osjlvzv23xhsyqhw4diqlfxz54lmg7robv44bi@nwd37zpqfa2l commit adb0971a1acd462078f159059cc7380338e41cce Merge: 0cdf7f6fa67146 789e46fbfca187 Author: Simona Vetter Date: Fri Oct 24 13:36:47 2025 +0200 Merge tag 'drm-intel-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix panic structure allocation memory leak (Jani) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://lore.kernel.org/r/aPojgsvNYOU0tN4U@intel.com commit 0cdf7f6fa671460004952707bc52715a53dda113 Merge: 6ced10611e9713 23437509a69476 Author: Simona Vetter Date: Fri Oct 24 13:35:26 2025 +0200 Merge tag 'drm-misc-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: panic: - Fix several issues in size calculations panthor: - Fix kernel panic on partial unmap of GPU VA region rockchip: - hdmi: Fix HDP setup Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251023083449.GA13190@linux-2.fritz.box commit 6ced10611e971308632335f53772108c9e4976ec Merge: 211ddde0823f14 72a1eb3cf573ab Author: Simona Vetter Date: Fri Oct 24 13:28:44 2025 +0200 Merge tag 'amd-drm-fixes-6.18-2025-10-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-22: amdgpu: - DP MST fix - Fix DC max link count - DC interrupt atomic context fix Signed-off-by: Simona Vetter From: Alex Deucher Link: https://lore.kernel.org/r/20251022222005.1787211-1-alexander.deucher@amd.com commit 7f434e1d9a17ca5f567c9796c9c105a65c18db9a Author: Hao Ge Date: Thu Oct 23 22:33:13 2025 +0800 slab: Fix obj_ext mistakenly considered NULL due to race condition If two competing threads enter alloc_slab_obj_exts(), and the one that allocates the vector wins the cmpxchg(), the other thread that failed allocation mistakenly assumes that slab->obj_exts is still empty due to its own allocation failure. This will then trigger warnings with CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path. Therefore, let's check the result of cmpxchg() to see if marking the allocation as failed was successful. If it wasn't, check whether the winning side has succeeded its allocation (it might have been also marking it as failed) and if yes, return success. Suggested-by: Harry Yoo Fixes: f7381b911640 ("slab: mark slab->obj_exts allocation failures unconditionally") Cc: Signed-off-by: Hao Ge Link: https://patch.msgid.link/20251023143313.1327968-1-hao.ge@linux.dev Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit ad68c0536cfc28c161593ca4c896a6e74435394b Merge: a35551a32d8686 ba3a5e1aeaa01e Author: Mark Brown Date: Fri Oct 24 11:36:32 2025 +0100 ASoC: fsl: correct the bit order issue for DSD Merge series from Shengjiu Wang : The DSD little endian format requires the msb first, the previous understanding is not correct. The issue is found by testing with pipewire. commit a35551a32d8686c0a33a580ebb8c8d6652b7971f Merge: 79a6f2da168543 64007ad3e2a0e0 Author: Mark Brown Date: Fri Oct 24 11:36:28 2025 +0100 ASoC: Intel: avs: Set of streaming fixes Merge series from Cezary Rojewski : Small set of patches two of which fix problems observed during shutdown and XRUN scenarios for PCM streaming. These ensure HDAudio HOST stream is reset and re-setup during XRUNs and synchronize avs_dai_fe_shutdown() and period-elapsed work (thread) so that no slab-use-after-free panics occur. The last change makes the 'format' parameter provided by a compress-application taken into account - currently its ignored. Such approach helps us increase the coverage of data probing (debug) functionality. commit ef3330b99c01bda53f2a189b58bed8f6b7397f28 Author: Charles Keepax Date: Thu Oct 23 16:49:01 2025 +0100 genirq/manage: Add buslock back in to enable_irq() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: bddd10c55407 ("genirq/manage: Rework enable_irq()") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-4-ckeepax@opensource.cirrus.com commit 56363e25f79fe83e63039c5595b8cd9814173d37 Author: Charles Keepax Date: Thu Oct 23 16:49:00 2025 +0100 genirq/manage: Add buslock back in to __disable_irq_nosync() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: 1b7444446724 ("genirq/manage: Rework __disable_irq_nosync()") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-3-ckeepax@opensource.cirrus.com commit 5d7e45dd670e42df4836afeaa9baf9d41ca4b434 Author: Charles Keepax Date: Thu Oct 23 16:48:59 2025 +0100 genirq/chip: Add buslock back in to irq_set_handler() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: 5cd05f3e2315 ("genirq/chip: Rework irq_set_handler() variants") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-2-ckeepax@opensource.cirrus.com commit 27afd6e066cfd80ddbe22a4a11b99174ac89cced Author: Marek Szyprowski Date: Thu Oct 23 16:26:34 2025 +0200 media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls. CC: stable@vger.kernel.org Fixes: a3293a85381e ("media: v4l2: Add REMOVE_BUFS ioctl") Reported-by: Shuangpeng Bai Closes: https://lore.kernel.org/linux-media/5317B590-AAB4-4F17-8EA1-621965886D49@psu.edu/ Signed-off-by: Marek Szyprowski Signed-off-by: Hans Verkuil commit 758dbc756aad429da11c569c0d067f7fd032bcf7 Author: Ricardo Ribalda Date: Tue Oct 21 10:36:17 2025 +0000 media: uvcvideo: Use heuristic to find stream entity Some devices, like the Grandstream GUV3100 webcam, have an invalid UVC descriptor where multiple entities share the same ID, this is invalid and makes it impossible to make a proper entity tree without heuristics. We have recently introduced a change in the way that we handle invalid entities that has caused a regression on broken devices. Implement a new heuristic to handle these devices properly. Reported-by: Angel4005 Closes: https://lore.kernel.org/linux-media/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=DaA@mail.gmail.com/ Fixes: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID") Cc: stable@vger.kernel.org Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans Verkuil commit 7df699c2132f36359f8f79e6a163c3b3fe0b0e3d Author: Hans de Goede Date: Wed Sep 10 12:47:02 2025 +0200 media: v4l2-subdev / pdx86: int3472: Use "privacy" as con_id for the privacy LED During DT-binding review for extending the V4L2 camera sensor privacy LED support to systems using devicetree, it has come up that having a "-led" suffix for the LED name / con_id is undesirable since it already is clear that it is a LED. Drop the "-led" suffix from the con_id in both the lookup table in the int3472 code, as well as from the con_id led_get() argument in the v4l2-subdev code. Signed-off-by: Hans de Goede Acked-by: Ilpo Järvinen Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d91a1d129b63614fa4c2e45e60918409ce36db7e Author: Armin Wolf Date: Wed Oct 8 01:41:46 2025 +0200 ACPI: fan: Use platform device for devres-related actions Device-managed resources are cleaned up when the driver unbinds from the underlying device. In our case this is the platform device as this driver is a platform driver. Registering device-managed resources on the associated ACPI device will thus result in a resource leak when this driver unbinds. Ensure that any device-managed resources are only registered on the platform device to ensure that they are cleaned up during removal. Fixes: 35c50d853adc ("ACPI: fan: Add hwmon support") Signed-off-by: Armin Wolf Cc: 6.11+ # 6.11+ Link: https://patch.msgid.link/20251007234149.2769-4-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit 58764259ebe0c9efd569194444629f6b26f86583 Author: Armin Wolf Date: Wed Oct 8 01:41:44 2025 +0200 ACPI: fan: Use ACPI handle when retrieving _FST Usage of the ACPI device should be phased out in the future, as the driver itself is now using the platform bus. Replace any usage of struct acpi_device in acpi_fan_get_fst() to allow users to drop usage of struct acpi_device. Also extend the integer check to all three package elements. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251007234149.2769-2-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit ce29214ada6d08dbde1eeb5a69c3b09ddf3da146 Author: Matthew Brost Date: Tue Oct 21 17:55:36 2025 -0700 drm/xe: Check return value of GGTT workqueue allocation Workqueue allocation can fail, so check the return value of the GGTT workqueue allocation and fail driver initialization if the allocation fails. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20251022005538.828980-2-matthew.brost@intel.com (cherry picked from commit 1f1314e8e71385bae319e43082b798c11f6648bc) Signed-off-by: Lucas De Marchi commit c0e37ac6a5d4c4bc33b9c4408d22714fe370a1b0 Author: Bart Van Assche Date: Tue Oct 14 13:00:54 2025 -0700 scsi: ufs: core: Reduce link startup failure logging Some systems, e.g. Rock 4D, have a pluggable UFS module. Link startup fails systematically on these systems. If no UFS module has been plugged in, more than fourty lines are logged after the "link startup failed" message. Avoid this by reducing link startup failure logging. An intended side effect of this patch is that scsi_host_busy() is not called before scsi_add_host() is called. Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") introduced a regression - the warning shown below is triggered during every boot. This patch fixes that regression. Call trace: __srcu_read_lock+0x30/0x80 (P) blk_mq_tagset_busy_iter+0x44/0x300 scsi_host_busy+0x38/0x70 ufshcd_print_host_state+0x34/0x1bc ufshcd_link_startup.constprop.0+0xe4/0x2e0 ufshcd_init+0x944/0xf80 ufshcd_pltfrm_init+0x504/0x820 ufs_rockchip_probe+0x2c/0x88 platform_probe+0x5c/0xa4 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x150 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1e0 bus_for_each_dev+0x7c/0xdc driver_attach+0x24/0x30 bus_add_driver+0x110/0x230 driver_register+0x68/0x130 __platform_driver_register+0x20/0x2c ufs_rockchip_pltform_init+0x1c/0x28 do_one_initcall+0x60/0x1e0 kernel_init_freeable+0x248/0x2c4 kernel_init+0x20/0x140 ret_from_fork+0x10/0x20 Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/ Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251014200118.3390839-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit c74dc8ab47c1ec3927f63ca83b542c363249b3d8 Author: Bart Van Assche Date: Tue Oct 14 13:00:53 2025 -0700 scsi: ufs: core: Fix a race condition related to the "hid" attribute group ufs_sysfs_add_nodes() is called concurrently with ufs_get_device_desc(). This may cause the following code to be called before ufs_sysfs_add_nodes(): sysfs_update_group(&hba->dev->kobj, &ufs_sysfs_hid_group); If this happens, ufs_sysfs_add_nodes() triggers a kernel warning and fails. Fix this by calling ufs_sysfs_add_nodes() before SCSI LUNs are scanned since the sysfs_update_group() call happens from the context of thread that executes ufshcd_async_scan(). This patch fixes the following kernel warning: sysfs: cannot create duplicate filename '/devices/platform/3c2d0000.ufs/hid' Workqueue: async async_run_entry_fn Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0x104 dump_stack+0x18/0x3c sysfs_warn_dup+0x6c/0xc8 internal_create_group+0x1c8/0x504 sysfs_create_groups+0x38/0x9c ufs_sysfs_add_nodes+0x20/0x58 ufshcd_init+0x1114/0x134c ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __device_attach_driver+0x15c/0x1f4 bus_for_each_drv+0x10c/0x168 __device_attach_async_helper+0x80/0xf8 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 ufshcd 3c2d0000.ufs: ufs_sysfs_add_nodes: sysfs groups creation failed (err = -17) Cc: Daniel Lee Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251014200118.3390839-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 5127be409c6c3815c4a7d8f6d88043e44f9b9543 Author: Nitin Rawat Date: Sun Oct 12 23:08:28 2025 +0530 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ2. As part of ufs shutdown, after the SSU command completion, asserting hardware reset (HWRST) triggers the device firmware to wake up and execute its reset routine. This routine initializes hardware blocks and takes a few milliseconds to complete. During this time, the ICCQ draws a large current. This large ICCQ current may cause issues for the regulator which is supplying power to UFS, because the turn off request from UFS driver to the regulator framework will be immediately followed by low power mode(LPM) request by regulator framework. This is done by framework because UFS which is the only client is requesting for disable. So if the rail is still in the process of shutting down while ICCQ exceeds LPM current thresholds, and LPM mode is activated in hardware during this state, it may trigger an overcurrent protection (OCP) fault in the regulator. To prevent this, a 10ms delay is added after asserting HWRST. This allows the reset operation to complete while power rails remain active and in high-power mode. Currently there is no way for Host to query whether the reset is completed or not and hence this the delay is based on experiments with Qualcomm UFS controllers across multiple UFS vendors. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251012173828.9880-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit dd6940f5c7dbee7ae70708f4c8967c3c8cb1d965 Author: Stefan Metzmacher Date: Wed Oct 15 17:05:27 2025 +0200 smb: server: let free_transport() wait for SMBDIRECT_SOCKET_DISCONNECTED We should wait for the rdma_cm to become SMBDIRECT_SOCKET_DISCONNECTED! At least on the client side (with similar code) wait_event_interruptible() often returns with -ERESTARTSYS instead of waiting for SMBDIRECT_SOCKET_DISCONNECTED. We should use wait_event() here too, which makes the code be identical in client and server, which will help when moving to common functions. Fixes: b31606097de8 ("smb: server: move smb_direct_disconnect_rdma_work() into free_transport()") Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6f1cbf6d6fd13fc169dde14e865897924cdc4bbd Author: Ming Lei Date: Fri Oct 24 09:34:59 2025 +0800 io_uring: fix buffer auto-commit for multishot uring_cmd Commit 620a50c92700 ("io_uring: uring_cmd: add multishot support") added multishot uring_cmd support with explicit buffer upfront commit via io_uring_mshot_cmd_post_cqe(). However, the buffer selection path in io_ring_buffer_select() was auto-committing buffers for non-pollable files, which conflicts with uring_cmd's explicit upfront commit model. This way consumes the whole selected buffer immediately, and causes failure on the following buffer selection. Fix this by checking uring_cmd to identify operations that handle buffer commit explicitly, and skip auto-commit for these operations. Cc: Caleb Sander Mateos Fixes: 620a50c92700 ("io_uring: uring_cmd: add multishot support") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit df5192d9bb0e38bf831fb93e8026e346aa017ca8 Author: Bjorn Helgaas Date: Thu Oct 23 13:06:26 2025 -0500 PCI/ASPM: Enable only L0s and L1 for devicetree platforms f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") enabled Clock Power Management and L1 PM Substates, but those features depend on CLKREQ# and possibly other device-specific configuration. We don't know whether CLKREQ# is supported, so we shouldn't blindly enable Clock PM and L1 PM Substates. Enable only ASPM L0s and L1, and only when both ends of the link advertise support for them. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/db5c95a1-cf3e-46f9-8045-a1b04908051a@xenosoft.de/ Reported-by: FUKAUMI Naoki Closes: https://lore.kernel.org/r/22594781424C5C98+22cb5d61-19b1-4353-9818-3bb2b311da0b@radxa.com/ Reported-by: Herve Codina Link: https://lore.kernel.org/r/20251015101304.3ec03e6b@bootlin.com/ Reported-by: Diederik de Haas Closes: https://lore.kernel.org/r/DDJXHRIRGTW9.GYC2ULZ5WQAL@cknow-tech.com/ Signed-off-by: Bjorn Helgaas Tested-by: FUKAUMI Naoki Tested-by: Diederik de Haas Acked-by: Dragan Simic Link: https://patch.msgid.link/20251023180645.1304701-1-helgaas@kernel.org commit 246aca5b2a2c4ad3e75c2eff616f5532019a92d2 Author: Takashi Sakamoto Date: Thu Oct 23 19:43:49 2025 +0900 firewire: core: fix __must_hold() annotation The variable name passed to __must_hold() annotation is invalid. This commit fixes it. Fixes: 420bd7068cbf ("firewire: core: use spin lock specific to transaction") Link: https://lore.kernel.org/r/20251023104349.415310-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 1ab665817448c31f4758dce43c455bd4c5e460aa Author: Bui Quang Minh Date: Wed Oct 22 22:56:30 2025 +0700 virtio-net: drop the multi-buffer XDP packet in zerocopy In virtio-net, we have not yet supported multi-buffer XDP packet in zerocopy mode when there is a binding XDP program. However, in that case, when receiving multi-buffer XDP packet, we skip the XDP program and return XDP_PASS. As a result, the packet is passed to normal network stack which is an incorrect behavior (e.g. a XDP program for packet count is installed, multi-buffer XDP packet arrives and does go through XDP program. As a result, the packet count does not increase but the packet is still received from network stack).This commit instead returns XDP_ABORTED in that case. Fixes: 99c861b44eb1 ("virtio_net: xsk: rx: support recv merge mode") Cc: stable@vger.kernel.org Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20251022155630.49272-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 420c84c330d1688b8c764479e5738bbdbf0a33de Author: Lizhi Xu Date: Wed Oct 22 10:40:07 2025 +0800 usbnet: Prevents free active kevent The root cause of this issue are: 1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here. 2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed. The solution to this problem is to cancel the kevent before executing free_netdev(). Fixes: a69e617e533e ("usbnet: Fix linkwatch use-after-free on disconnect") Reported-by: Sam Sun Closes: https://syzkaller.appspot.com/bug?extid=8bfd7bcc98f7300afb84 Signed-off-by: Lizhi Xu Link: https://patch.msgid.link/20251022024007.1831898-1-lizhi.xu@windriver.com Signed-off-by: Jakub Kicinski commit a83155cc4ec5dd8c99edb541dc12d3bd8e97eae9 Merge: ab431bc39741e9 69e4b75a5b90ef Author: Jakub Kicinski Date: Thu Oct 23 17:15:47 2025 -0700 Merge tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== First set of fixes: - brcmfmac: long-standing crash when used w/o P2P - iwlwifi: fix for a use-after-free bug - mac80211: key tailroom accounting bug could leave allocation overhead and cause a warning - ath11k: add a missing platform, fix key flag operations - bcma: skip devices disabled in OF/DT - various (potential) memory leaks * tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: nl80211: call kfree without a NULL check wifi: mac80211: fix key tailroom accounting leak wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode MAINTAINERS: wcn36xx: Add linux-wireless list bcma: don't register devices disabled in OF wifi: mac80211: reset FILS discovery and unsol probe resp intervals wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() wifi: ath11k: avoid bit operation on key flags wifi: ath12k: free skb during idr cleanup callback wifi: ath11k: Add missing platform IDs for quirk table wifi: ath10k: Fix memory leak on unsupported WMI command ==================== Link: https://patch.msgid.link/20251023180604.626946-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 6fab32bb6508abbb8b7b1c5498e44f0c32320ed5 Author: Stephen Rothwell Date: Wed Oct 22 16:36:25 2025 +1100 MAINTAINERS: add Mark Brown as a linux-next maintainer Mark has been kindly helping fill in when I have been unavailable over the past several years. He has also put his hand up to take over linux-next maintenance when I finally decide to stop (which may be some time yet ;-) ). Signed-off-by: Stephen Rothwell Acked-by: Mark Brown Signed-off-by: Linus Torvalds commit 79a6f2da168543c0431ade57428f673c19c5b72f Author: Haotian Zhang Date: Tue Oct 21 01:04:40 2025 +0800 ASoC: mediatek: Fix double pm_runtime_disable in remove functions Both mt8195-afe-pcm and mt8365-afe-pcm drivers use devm_pm_runtime_enable() in probe function, which automatically calls pm_runtime_disable() on device removal via devres mechanism. However, the remove callbacks explicitly call pm_runtime_disable() again, resulting in double pm_runtime_disable() calls. Fix by removing the redundant pm_runtime_disable() calls from remove functions, letting the devres framework handle it automatically. Fixes: 2ca0ec01d49c ("ASoC: mediatek: mt8195-afe-pcm: Simplify runtime PM during probe") Fixes: e1991d102bc2 ("ASoC: mediatek: mt8365: Add the AFE driver support") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251020170440.585-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 5121062e83453221cca7bb1163fe9234757c1697 Merge: 266ee584e55eed 3d62f95bd8450c Author: Linus Torvalds Date: Thu Oct 23 16:50:25 2025 -0700 Merge tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "A couple of fixes for Runtime Verification: - A bug caused a kernel panic when reading enabled_monitors was reported. Change callback functions to always use list_head iterators and by doing so, fix the wrong pointer that was leading to the panic. - The rtapp/pagefault monitor relies on the MMU to be present (pagefaults exist) but that was not enforced via kconfig, leading to potential build errors on systems without an MMU. Add that kconfig dependency" * tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Make rtapp/pagefault monitor depends on CONFIG_MMU rv: Fully convert enabled_monitors to use list_head as iterator commit dfab67879bed6800cc512e320167b969ebc6d5a9 Author: Nathan Chancellor Date: Thu Oct 23 23:56:30 2025 +0100 MAINTAINERS: Update Kconfig section Masahiro Yamada stepped down as Kbuild and Kconfig maintainer in commit 8d6841d5cb20 ("MAINTAINERS: hand over Kbuild maintenance"), leaving Kconfig officially orphaned and handing Kbuild over to Nicolas and myself. Since then, there have been a few simple patches to Kconfig that have ended up on the linux-kbuild mailing list without clear direction on who will take them, as they are not really sent to anybody officially, although the list is obviously watched by the Kbuild maintainers. Make Nicolas and I official maintainers of Kconfig in "Odd Fixes" status, similar to Kbuild, so that the subsystem has clear points of contact for contributors, even if significant contributions may not be accepted. Additionally, add the Kbuild tree to this section. Acked-by: Nicolas Schier Acked-by: Randy Dunlap Link: https://patch.msgid.link/20251023-update-kconfig-maintainers-v1-1-0ebd5b4ecced@kernel.org Signed-off-by: Nathan Chancellor commit e58794dbf7706af931153ef402c03d61de6ba714 Merge: 65627d4a629aaf aa960b597600be Author: Arnd Bergmann Date: Thu Oct 23 22:30:41 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 6.18, please pull the following: - Peter describes the VGIC interrupt line such that KVM can be used on Raspberry Pi 5 systems. * tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm2712: Define VGIC interrupt Signed-off-by: Arnd Bergmann commit 65627d4a629aaf7cfe3b40be468adbb888098960 Merge: 71a5970259c3f2 4adc20ba95d472 Author: Arnd Bergmann Date: Thu Oct 23 22:30:29 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 6.18, please pull the following: - Stefan switches the V3D block to use the firmware clock, rather than the bare metal clock. This fixes hangs on boot after recent changes to the V3D driver clocking went in. * tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: broadcom: rpi: Switch to V3D firmware clock Signed-off-by: Arnd Bergmann commit 71a5970259c3f2426e8600aae3e924a00d801ad3 Merge: f4cb02832060ff 20b93a0088a595 Author: Arnd Bergmann Date: Thu Oct 23 22:30:01 2025 +0200 Merge tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v6.18 This series contains a set of small, focused fixes that address robustness and lifecycle issues in the Arm SCMI core and debug support, ensuring safer handling of debug initialization failures, correct flag management in raw mode, and consistent inflight counter tracking. Brief summary: - Fix raw xfer flag clearing - Skip RAW debug initialization on failure - Make inflight counter helpers null-safe, preventing crashes if debug initialization fails - Account for failed debug initialization globally There is no functional change for standard SCMI operation, but these fixes improve stability in debug and raw modes, particularly in error paths. * tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode firmware: arm_scmi: Skip RAW initialization on failure include: trace: Fix inflight count helper on failed initialization firmware: arm_scmi: Account for failed debug initialization Signed-off-by: Arnd Bergmann commit f4cb02832060ffece6f2f49133592ce7054ac057 Merge: 1d4e7d9f6b7e4e 11fb1a82aefa6f Author: Arnd Bergmann Date: Thu Oct 23 22:29:39 2025 +0200 Merge tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fix for v6.18 The FF-A driver was updated to support specification version 1.2 but omitted support for the 16-byte implementation-defined (IMPDEF) field introduced in FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission breaks all memory interfaces. This change updates the EMAD sizing and offset logic to correctly handle the FF-A v1.2 layout while preserving backward compatibility with older versions. * tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor Signed-off-by: Arnd Bergmann commit 266ee584e55eed108583ab4f45b5de734522502d Merge: ab431bc39741e9 b98c94eed4a975 Author: Linus Torvalds Date: Thu Oct 23 09:26:47 2025 -1000 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Do not make a clean PTE dirty in pte_mkwrite() The Arm architecture, for backwards compatibility reasons (ARMv8.0 before in-hardware dirty bit management - DBM), uses the PTE_RDONLY bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE writable also invoke pte_mkdirty() but do_swap_page() does not and we end up with dirty, freshly swapped in, writeable pages. - Do not warn if the destination page is already MTE-tagged in copy_highpage() In the majority of the cases, a destination page copied into is freshly allocated without the PG_mte_tagged flag set. However, the folio migration may be restarted if __folio_migrate_mapping() failed, triggering the benign WARN_ON_ONCE(). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Do not warn if the page is already tagged in copy_highpage() arm64, mm: avoid always making PTE dirty in pte_mkwrite() commit 8f067aa59430266386b83c18b983ca583faa6a11 Author: Yuhao Jiang Date: Wed Oct 22 15:07:04 2025 -0500 ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable Signed-off-by: Yuhao Jiang Reviewed-by: Hans de Goede [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki commit 7221b9caf84b3294688228a19273d74ea19a2ee4 Author: Andrii Nakryiko Date: Mon Oct 20 13:36:43 2025 -0700 libbpf: Fix powerpc's stack register definition in bpf_tracing.h retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to wrong definition of PT_REGS_SP() macro. Looking at powerpc's implementation of stack unwinding in perf_callchain_user_64() clearly shows that stack pointer register is gpr[1]. Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this. [0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log Fixes: 138d6153a139 ("samples/bpf: Enable powerpc support") Signed-off-by: Andrii Nakryiko Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20251020203643.989467-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit ab431bc39741e9d9bd3102688439e1864c857a74 Merge: a0b12d7b040493 cb68d1e5c51870 Author: Linus Torvalds Date: Thu Oct 23 07:03:18 2025 -1000 Merge tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from can. Slim pickings, I'm guessing people haven't really started testing. Current release - new code bugs: - eth: mlx5e: - psp: avoid 'accel' NULL pointer dereference - skip PPHCR register query for FEC histogram if not supported Previous releases - regressions: - bonding: update the slave array for broadcast mode - rtnetlink: re-allow deleting FDB entries in user namespace - eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path Previous releases - always broken: - can: drop skb on xmit if device is in listen-only mode - gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb() - eth: mlx5e - RX, fix generating skb from non-linear xdp_buff if program trims frags - make devcom init failures non-fatal, fix races with IPSec Misc: - some documentation formatting 'fixes'" * tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) net/mlx5: Fix IPsec cleanup over MPV device net/mlx5: Refactor devcom to return NULL on failure net/mlx5e: Skip PPHCR register query if not supported by the device net/mlx5: Add PPHCR to PCAM supported registers mask virtio-net: zero unused hash fields net: phy: micrel: always set shared->phydev for LAN8814 vsock: fix lock inversion in vsock_assign_transport() ovpn: use datagram_poll_queue for socket readiness in TCP espintcp: use datagram_poll_queue for socket readiness net: datagram: introduce datagram_poll_queue for custom receive queues net: bonding: fix possible peer notify event loss or dup issue net: hsr: prevent creation of HSR device with slaves from another netns sctp: avoid NULL dereference when chunk data buffer is missing ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop net: ravb: Ensure memory write completes before ringing TX doorbell net: ravb: Enforce descriptor type ordering net: hibmcge: select FIXED_PHY net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb Documentation: networking: ax25: update the mailing list info. net: gro_cells: fix lock imbalance in gro_cells_receive() ... commit a0b12d7b04049343d544ac92c8eeb5a2271235c3 Merge: 85db0c0a971f8b 114cbd67db825b Author: Linus Torvalds Date: Thu Oct 23 06:53:12 2025 -1000 Merge tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix a fallout of a recent ACPI properties management update and work around a compiler bug in ACPICA: - Fix a recent coding mistake causing __acpi_node_get_property_reference() arguments to be put in an incorrect order (Sunil V L) - Work around bogus -Wstringop-overread warning on LoongArch since GCC 11 in ACPICA (Xi Ruoyao)" * tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 ACPI: property: Fix argument order in __acpi_node_get_property_reference() commit 85db0c0a971f8bb009452f1dc4267001f2cc7e86 Merge: 942048d46abac0 b62bd2cf7e991e Author: Linus Torvalds Date: Thu Oct 23 06:48:32 2025 -1000 Merge tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These revert a cpuidle menu governor commit leading to a performance regression, fix an amd-pstate driver regression introduced recently, and fix new conditional guard definitions for runtime PM. - Add missing _RET == 0 condition to recently introduced conditional guard definitions for runtime PM (Rafael Wysocki) - Revert a cpuidle menu governor change that introduced a serious performance regression on Chromebooks with Intel Jasper Lake processors (Rafael Wysocki) - Fix an amd-pstate driver regression leading to EPP=0 after hibernation (Mario Limonciello)" * tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: runtime: Fix conditional guard definitions Revert "cpuidle: menu: Avoid discarding useful information" cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit 942048d46abac01e1219c5833701ff5b0cb52e7f Merge: 43e9ad0c55a369 ada7d45b568abe Author: Linus Torvalds Date: Thu Oct 23 06:44:43 2025 -1000 Merge tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - in send, fix duplicated rmdir operations when using extrefs (hardlinks), receive can fail with ENOENT - fixup of error check when reading extent root in ref-verify and damaged roots are allowed by mount option (found by smatch) - fix freeing partially initialized fs info (found by syzkaller) - fix use-after-free when printing ref_tracking status of delayed inodes * tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree() btrfs: fix delayed_node ref_tracker use after free btrfs: send: fix duplicated rmdir operations when using extrefs btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() commit b98c94eed4a975e0c80b7e90a649a46967376f58 Author: Catalin Marinas Date: Wed Oct 22 11:09:14 2025 +0100 arm64: mte: Do not warn if the page is already tagged in copy_highpage() The arm64 copy_highpage() assumes that the destination page is newly allocated and not MTE-tagged (PG_mte_tagged unset) and warns accordingly. However, following commit 060913999d7a ("mm: migrate: support poisoned recover from migrate folio"), folio_mc_copy() is called before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the copy will be done again to the same destination page. Since copy_highpage() already set the PG_mte_tagged flag, this second copy will warn. Replace the WARN_ON_ONCE(page already tagged) in the arm64 copy_highpage() with a comment. Reported-by: syzbot+d1974fc28545a3e6218b@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/68dda1ae.a00a0220.102ee.0065.GAE@google.com Reviewed-by: David Hildenbrand Cc: Will Deacon Cc: Kefeng Wang Cc: stable@vger.kernel.org # 6.12.x Reviewed-by: Yang Shi Signed-off-by: Catalin Marinas commit eecd7cb64178efb35f89aa5134cf6ce36c0c66db Author: Vlastimil Babka Date: Thu Oct 23 14:01:07 2025 +0200 slab: fix slab accounting imbalance due to defer_deactivate_slab() Since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") there's a possibility in alloc_single_from_new_slab() that we discard the newly allocated slab if we can't spin and we fail to trylock. As a result we don't perform inc_slabs_node() later in the function. Instead we perform a deferred deactivate_slab() which can either put the unacounted slab on partial list, or discard it immediately while performing dec_slabs_node(). Either way will cause an accounting imbalance. Fix this by not marking the slab as frozen, and using free_slab() instead of deactivate_slab() for non-frozen slabs in free_deferred_objects(). For CONFIG_SLUB_TINY, that's the only possible case. By not using discard_slab() we avoid dec_slabs_node(). Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Link: https://patch.msgid.link/20251023-fix-slab-accounting-v2-1-0e62d50986ea@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 434f7349a1f00618a620b316f091bd13a12bc8d2 Author: Alexey Klimov Date: Wed Oct 22 21:10:12 2025 +0100 regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board: Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags. While at this, also correct the same argument in __regmap_init_slimbus(). Fixes: 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") Fixes: 7d6f7fb053ad ("regmap: add SLIMbus support") Cc: stable@vger.kernel.org Cc: Dmitry Baryshkov Cc: Ma Ke Cc: Steev Klimaszewski Cc: Srinivas Kandagatla Reviewed-by: Abel Vesa Signed-off-by: Alexey Klimov Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251022201013.1740211-1-alexey.klimov@linaro.org Signed-off-by: Mark Brown commit cb68d1e5c51870601be9394fbb5751fc6532c78e Merge: b2284768c6b32a 664f76be38a18c Author: Jakub Kicinski Date: Thu Oct 23 07:14:38 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-10-22' Tariq Toukan says: ==================== mlx5 misc fixes 2025-10-22 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1761136182-918470-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 Author: Patrisious Haddad Date: Wed Oct 22 15:29:42 2025 +0300 net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core. So before disabling those blocking events, make sure to also unregister the devcom device and mark all this device operations as complete, in order to prevent the other device from using invalid netdev during future devcom events which could cause the trace below. BUG: kernel NULL pointer dereference, address: 0000000000000010 PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 7735 Comm: devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 R13: ffff88810d6f0a00 R14: 0000000000000000 R15: ffff8881034bda80 FS: 00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core] mlx5_devcom_send_event+0x8c/0x170 [mlx5_core] blocking_event+0x17b/0x230 [mlx5_core] notifier_call_chain+0x35/0xa0 blocking_notifier_call_chain+0x3d/0x60 mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core] mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib] mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib] ? idr_alloc_cyclic+0x50/0xb0 ? __kmalloc_cache_noprof+0x167/0x340 ? __kmalloc_noprof+0x1a7/0x430 __mlx5_ib_add+0x34/0xd0 [mlx5_ib] mlx5r_probe+0xe9/0x310 [mlx5_ib] ? kernfs_add_one+0x107/0x150 ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] auxiliary_bus_probe+0x3e/0x90 really_probe+0xc5/0x3a0 ? driver_probe_device+0x90/0x90 __driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 bus_probe_device+0x86/0xa0 device_add+0x62d/0x830 __auxiliary_device_add+0x3b/0xa0 ? auxiliary_device_init+0x41/0x90 add_adev+0xd1/0x150 [mlx5_core] mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core] esw_mode_change+0x6c/0xc0 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xe0 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x180/0x2b0 ? devlink_get_from_attrs_lock+0x170/0x170 ? devlink_nl_eswitch_get_doit+0x290/0x290 ? devlink_nl_pre_doit_port_optional+0x50/0x50 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1fc/0x2d0 netlink_sendmsg+0x1e4/0x410 __sock_sendmsg+0x38/0x60 ? sockfd_lookup_light+0x12/0x60 __sys_sendto+0x105/0x160 ? __sys_recvmsg+0x4e/0x90 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f27bc91b13a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 RSP: 002b:00007fff369557e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000009c54b10 RCX: 00007f27bc91b13a RDX: 0000000000000038 RSI: 0000000009c54b10 RDI: 0000000000000006 RBP: 0000000009c54920 R08: 00007f27bd0030e0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi ib_umad scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_fwctl mlx5_ib ib_uverbs ib_core mlx5_core CR2: 0000000000000010 Fixes: 82f9378c443c ("net/mlx5: Handle IPsec steering upon master unbind/bind") Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8f82f89550daafc8ca3ba74c389ae1b4afdd75c8 Author: Patrisious Haddad Date: Wed Oct 22 15:29:41 2025 +0300 net/mlx5: Refactor devcom to return NULL on failure Devcom device and component registration isn't always critical to the functionality of the caller, hence the registration can fail and we can continue working with an ERR_PTR value saved inside a variable. In order to avoid that make sure all devcom failures return NULL. Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d58a9a917aa39b10250ec16cb9c24e942cbc77d3 Author: Alexei Lazar Date: Wed Oct 22 15:29:40 2025 +0300 net/mlx5e: Skip PPHCR register query if not supported by the device Check the PCAM supported registers mask before querying the PPHCR register, as it is not supported in older devices. Fixes: 44907e7c8fd0 ("net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR") Signed-off-by: Alexei Lazar Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bb65e0c141f879cdf54db11ae446ee3605fb54d5 Author: Alexei Lazar Date: Wed Oct 22 15:29:39 2025 +0300 net/mlx5: Add PPHCR to PCAM supported registers mask Add the PPHCR bit to the port_access_reg_cap_mask field of PCAM register to indicate that the device supports the PPHCR register and the RS-FEC histogram feature. Signed-off-by: Alexei Lazar Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b2284768c6b32aa224ca7d0ef0741beb434f03aa Author: Jason Wang Date: Wed Oct 22 11:44:21 2025 +0800 virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields. Acked-by: Michael S. Tsirkin Fixes: a2fb4bc4e2a6a ("net: implement virtio helpers to handle UDP GSO tunneling") Cc: Signed-off-by: Jason Wang Reviewed-by: Xuan Zhuo Link: https://patch.msgid.link/20251022034421.70244-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 399d10934740ae8cdaa4e3245f7c5f6c332da844 Author: Robert Marko Date: Tue Oct 21 15:20:26 2025 +0200 net: phy: micrel: always set shared->phydev for LAN8814 Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP clock gets actually set, otherwise the function will return before setting it. This is an issue as shared->phydev is unconditionally being used when IRQ is being handled, especially in lan8814_gpio_process_cap and since it was not set it will cause a NULL pointer exception and crash the kernel. So, simply always set shared->phydev to avoid the NULL pointer exception. Fixes: b3f1a08fcf0d ("net: phy: micrel: Add support for PTP_PF_EXTTS for lan8814") Signed-off-by: Robert Marko Tested-by: Horatiu Vultur Link: https://patch.msgid.link/20251021132034.983936-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 0fd20f65df6aa430454a0deed8f43efa91c54835 Author: Gerd Bayer Date: Thu Oct 16 11:27:03 2025 +0200 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do. During error recovery testing a pair of tasks was reported to be hung: mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO: task kmcheck:72 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 [<0000000652513212>] devlink_health_report+0x19a/0x230 [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too: - task: kmcheck mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock() - task: kworker mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock. A similar deadlock situation can be reproduced by requesting a crdump with > devlink health dump show pci/ reporter fw_fatal while PCI error recovery is executed on the same physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with > zpcictl --reset-fw Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of: mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 because the config read of VSC_SEMAPHORE is rejected by the underlying hardware. Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space. Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/ Cc: stable@vger.kernel.org Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") Reviewed-by: Niklas Schnelle Signed-off-by: Gerd Bayer Signed-off-by: Heiko Carstens commit f7c877e7535260cc7a21484c994e8ce7e8cb6780 Author: Stefano Garzarella Date: Tue Oct 21 14:17:18 2025 +0200 vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get(). Reported-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com Tested-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com Fixes: 687aa0c5581b ("vsock: Fix transport_* TOCTOU") Cc: mhal@rbox.co Cc: stable@vger.kernel.org Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20251021121718.137668-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit df890ceeb2e51af4c31c7b8c1c4c855dbbeba1e5 Merge: 10843e1492e474 efd729408bc7d5 Author: Paolo Abeni Date: Thu Oct 23 15:46:10 2025 +0200 Merge branch 'fix-poll-behaviour-for-tcp-based-tunnel-protocols' Ralf Lici says: ==================== fix poll behaviour for TCP-based tunnel protocols This patch series introduces a polling function for datagram-style sockets that operates on custom skb queues, and updates ovpn (the OpenVPN data-channel offload module) and espintcp (the TCP Encapsulation of IKE and IPsec Packets implementation) to use it accordingly. Protocols like the aforementioned one decapsulate packets received over TCP and deliver userspace-bound data through a separate skb queue, not the standard sk_receive_queue. Previously, both relied on datagram_poll(), which would signal readiness based on non-userspace packets, leading to misleading poll results and unnecessary recv attempts in userspace. Patch 1 introduces datagram_poll_queue(), a variant of datagram_poll() that accepts an explicit receive queue. This builds on the approach introduced in commit b50b058, which extended other skb-related functions to support custom queues. Patch 2 and 3 update espintcp_poll() and ovpn_tcp_poll() respectively to use this helper, ensuring readiness is only signaled when userspace data is available. Each patch is self-contained and the ovpn one includes rationale and lifecycle enforcement where appropriate. ==================== Link: https://patch.msgid.link/20251021100942.195010-1-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit efd729408bc7d57e0c8d027b9ff514187fc1a05b Author: Ralf Lici Date: Tue Oct 21 12:09:42 2025 +0200 ovpn: use datagram_poll_queue for socket readiness in TCP openvpn TCP encapsulation uses a custom queue to deliver packets to userspace. Currently it relies on datagram_poll, which checks sk_receive_queue, leading to false readiness signals when that queue contains non-userspace packets. Switch ovpn_tcp_poll to use datagram_poll_queue with the peer's user_queue, ensuring poll only signals readiness when userspace data is actually available. Also refactor ovpn_tcp_poll in order to enforce the assumption we can make on the lifetime of ovpn_sock and peer. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Antonio Quartulli Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251021100942.195010-4-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit 0fc3e32c2c069f541f2724d91f5e98480b640326 Author: Ralf Lici Date: Tue Oct 21 12:09:41 2025 +0200 espintcp: use datagram_poll_queue for socket readiness espintcp uses a custom queue (ike_queue) to deliver packets to userspace. The polling logic relies on datagram_poll, which checks sk_receive_queue, which can lead to false readiness signals when that queue contains non-userspace packets. Switch espintcp_poll to use datagram_poll_queue with ike_queue, ensuring poll only signals readiness when userspace data is actually available. Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251021100942.195010-3-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit f6ceec6434b5efff62cecbaa2ff74fc29b96c0c6 Author: Ralf Lici Date: Tue Oct 21 12:09:40 2025 +0200 net: datagram: introduce datagram_poll_queue for custom receive queues Some protocols using TCP encapsulation (e.g., espintcp, openvpn) deliver userspace-bound packets through a custom skb queue rather than the standard sk_receive_queue. Introduce datagram_poll_queue that accepts an explicit receive queue, and convert datagram_poll into a wrapper around datagram_poll_queue. This allows protocols with custom skb queues to reuse the core polling logic without relying on sk_receive_queue. Cc: Sabrina Dubroca Cc: Antonio Quartulli Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Reviewed-by: Antonio Quartulli Link: https://patch.msgid.link/20251021100942.195010-2-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit 6f37469a933030692741710db809722076f71973 Author: Aaron Kling Date: Tue Oct 21 14:47:06 2025 -0500 memory: tegra210: Fix incorrect client ids The original commit had typos for two of the memory client ids. Fix them to reference the correct bindings. Fixes: 3804cef4c597 ("memory: tegra210: Use bindings for client ids") Signed-off-by: Aaron Kling Link: https://patch.msgid.link/20251021-t210-mem-clientid-fixup-v1-1-5094946faa31@gmail.com Signed-off-by: Krzysztof Kozlowski commit c5efc6a0b3940381d67887302ddb87a5cf623685 Author: Alok Tiwari Date: Thu Oct 23 04:55:24 2025 -0700 io_uring: correct __must_hold annotation in io_install_fixed_file The __must_hold annotation references &req->ctx->uring_lock, but req is not in scope in io_install_fixed_file. This change updates the annotation to reference the correct ctx->uring_lock. improving code clarity. Fixes: f110ed8498af ("io_uring: split out fixed file installation and removal") Signed-off-by: Alok Tiwari Signed-off-by: Jens Axboe commit 316e361b5d2cdeb8d778983794a1c6eadcb26814 Author: Krzysztof Kozlowski Date: Wed Oct 22 15:34:26 2025 +0200 dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups The "groups" property can hold multiple entries (e.g. toshiba/tmpv7708-rm-mbrc.dts file), so allow that by dropping incorrect type (pinmux-node.yaml schema already defines that as string-array) and adding constraints for items. This fixes dtbs_check warnings like: toshiba/tmpv7708-rm-mbrc.dtb: pinctrl@24190000 (toshiba,tmpv7708-pinctrl): pwm-pins:groups: ['pwm0_gpio16_grp', 'pwm1_gpio17_grp', 'pwm2_gpio18_grp', 'pwm3_gpio19_grp'] is too long Fixes: 1825c1fe0057 ("pinctrl: Add DT bindings for Toshiba Visconti TMPV7700 SoC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Signed-off-by: Linus Walleij commit 369f772299821f93f872bf1b4d7d7ed2fc50243b Author: Yu-Chun Lin Date: Thu Oct 23 15:55:29 2025 +0800 pinctrl: realtek: Select REGMAP_MMIO for RTD driver The pinctrl-rtd driver uses 'devm_regmap_init_mmio', which requires 'REGMAP_MMIO' to be enabled. Without this selection, the build fails with an undefined reference: aarch64-none-linux-gnu-ld: drivers/pinctrl/realtek/pinctrl-rtd.o: in function rtd_pinctrl_probe': pinctrl-rtd.c:(.text+0x5a0): undefined reference to __devm_regmap_init_mmio_clk' Fix this by selecting 'REGMAP_MMIO' in the Kconfig. Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs") Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit ba3a5e1aeaa01ea67067d725710a839114214fc6 Author: Shengjiu Wang Date: Thu Oct 23 14:45:38 2025 +0800 ASoC: fsl_micfil: correct the endian format for DSD The DSD format supported by micfil is that oldest bit is in bit 31, so the format should be DSD little endian format. Fixes: 21aa330fec31 ("ASoC: fsl_micfil: Add decimation filter bypass mode support") Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20251023064538.368850-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 Author: Shengjiu Wang Date: Thu Oct 23 14:45:37 2025 +0800 ASoC: fsl_sai: fix bit order for DSD format The DSD little endian format requires the msb first, because oldest bit is in msb. found this issue by testing with pipewire. Fixes: c111c2ddb3fd ("ASoC: fsl_sai: Add PDM daifmt support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251023064538.368850-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 64007ad3e2a0e0a0ded8b2c6a72c0bb7883d3a33 Author: Cezary Rojewski Date: Thu Oct 23 11:23:48 2025 +0200 ASoC: Intel: avs: Use snd_codec format when initializing probe The data probing is a debug feature. Currently parameters channels and rate specified by the application are read while the format is ignored. More robust approach is to read all of them. Audio format, while not used by the Probe module for PCM streaming, takes part in the gateway initialization on the DSP side. With full parametrization we gain better coverage with the data probing feature. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 845f716dc5f354c719f6fda35048b6c2eca99331 Author: Cezary Rojewski Date: Thu Oct 23 11:23:47 2025 +0200 ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors. Fixes: 0dbb186c3510 ("ASoC: Intel: avs: Update stream status in a separate thread") Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 Author: Cezary Rojewski Date: Thu Oct 23 11:23:46 2025 +0200 ASoC: Intel: avs: Unprepare a stream when XRUN occurs The pcm->prepare() function may be called multiple times in a row by the userspace, as mentioned in the documentation. The driver shall take that into account and prevent redundancy. However, the exact same function is called during XRUNs and in such case, the particular stream shall be reset and setup anew. Fixes: 9114700b496c ("ASoC: Intel: avs: Generic PCM FE operations") Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 4c4e6ea4a120cc5ab58e437c6ba123cbfc357d45 Author: Haotian Zhang Date: Thu Oct 23 15:02:30 2025 +0800 gpio: ljca: Fix duplicated IRQ mapping The generic_handle_domain_irq() function resolves the hardware IRQ internally. The driver performed a duplicative mapping by calling irq_find_mapping() first, which could lead to an RCU stall. Delete the redundant irq_find_mapping() call and pass the hardware IRQ directly to generic_handle_domain_irq(). Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver") Signed-off-by: Haotian Zhang Link: https://lore.kernel.org/r/20251023070231.1305-1-vulab@iscas.ac.cn [Bartosz: remove unused variable] Signed-off-by: Bartosz Golaszewski commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 Author: LI Qingwu Date: Thu Oct 23 03:44:22 2025 +0000 USB: serial: option: add Telit FN920C04 ECM compositions Add support for the Telit Cinterion FN920C04 module when operating in ECM (Ethernet Control Model) mode. The following USB product IDs are used by the module when AT#USBCFG is set to 3 or 7. 0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)] T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a3 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)] T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a8 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Adding these IDs allows the option driver to automatically create the corresponding /dev/ttyUSB* ports under ECM mode. Tested with FN920C04 under ECM configuration (USBCFG=3 and 7). Signed-off-by: LI Qingwu Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 114cbd67db825bfa42bc6c34875fc8409e5bba72 Merge: 6e3a4754717a74 f3f313c5114866 Author: Rafael J. Wysocki Date: Thu Oct 23 13:25:02 2025 +0200 Merge branch 'acpi-property' Merge an ACPI device properties handling change fixing the order of __acpi_node_get_property_reference() arguments broken by a recent update (Sunil V L) * 'acpi-property': ACPI: property: Fix argument order in __acpi_node_get_property_reference() commit b62bd2cf7e991efbc823665e54dd7d7d8372c33b Merge: db82b8dbf5f06d 10fad4012234a7 673e75ea55df5f Author: Rafael J. Wysocki Date: Thu Oct 23 13:12:24 2025 +0200 Merge branches 'pm-cpuidle' and 'pm-cpufreq' Merge cpuidle and cpufreq fixes for 6.18-rc3: - Revert a cpuidle menu governor change that introduced a serious performance regression on Chromebooks with Intel Jasper Lake processors (Rafael Wysocki) - Fix an amd-pstate driver regression leading to EPP=0 after hibernation (Mario Limonciello) * pm-cpuidle: Revert "cpuidle: menu: Avoid discarding useful information" * pm-cpufreq: cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit 10843e1492e474c02b91314963161731fa92af91 Author: Tonghao Zhang Date: Tue Oct 21 13:09:33 2025 +0800 net: bonding: fix possible peer notify event loss or dup issue If the send_peer_notif counter and the peer event notify are not synchronized. It may cause problems such as the loss or dup of peer notify event. Before this patch: - If should_notify_peers is true and the lock for send_peer_notif-- fails, peer event may be sent again in next mii_monitor loop, because should_notify_peers is still true. - If should_notify_peers is true and the lock for send_peer_notif-- succeeded, but the lock for peer event fails, the peer event will be lost. This patch locks the RTNL for send_peer_notif, events, and commit simultaneously. Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Cc: Jay Vosburgh Cc: Andrew Lunn Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Hangbin Liu Cc: Nikolay Aleksandrov Cc: Vincent Bernat Cc: Signed-off-by: Tonghao Zhang Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251021050933.46412-1-tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 79816d4b9e9b9bb03d5d871c04c97b1bce102b14 Author: Samuel Wu Date: Wed Oct 22 22:28:30 2025 +0000 Revert "PM: sleep: Make pm_wakeup_clear() call more clear" This reverts commit 56a232d93cea0ba14da5e3157830330756a45b4c. The above commit changed the position of pm_wakeup_clear() for the suspend call path, but other call paths with references to freeze_processes() were not updated. This means that other call paths, such as hibernate(), will not have pm_wakeup_clear() called. Suggested-by: Saravana Kannan Signed-off-by: Samuel Wu [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251022222830.634086-1-wusamuel@google.com Signed-off-by: Rafael J. Wysocki commit 5f4bfd03bc9deec480bf9f8cb37e63e590fd8212 Merge: 2ba5772e530f73 b1055678a0160b Author: Bartosz Golaszewski Date: Thu Oct 23 10:06:59 2025 +0200 Merge tag 'intel-gpio-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio fixes for v6.18-1 * Make set debounce errors non-fatal in GPIO ACPI case * Use human readable error when printing a message in GPIO ACPI code commit 64c9471aa9ded2440bf182b1c71d3f93f80b2f85 Author: David Howells Date: Mon Oct 20 10:16:07 2025 +0100 cifs: #include cifsglob.h before trace.h to allow structs in tracepoints Make cifs #include cifsglob.h in advance of #including trace.h so that the structures defined in cifsglob.h can be accessed directly by the cifs tracepoints rather than the callers having to manually pass in the bits and pieces. This should allow the tracepoints to be made more efficient to use as well as easier to read in the code. Signed-off-by: David Howells cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 4b1d7f62225a2fd024b2df5675515557169f17e7 Author: David Howells Date: Tue Oct 14 18:10:08 2025 +0100 cifs: Call the calc_signature functions directly As the SMB1 and SMB2/3 calc_signature functions are called from separate sign and verify paths, just call them directly rather than using a function pointer. The SMB3 calc_signature then jumps to the SMB2 variant if necessary. Signed-off-by: David Howells Acked-by: Enzo Matsumiya cc: Paulo Alcantara cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 72ed55b4c335703c203b942972558173e1e5ddee Author: Paulo Alcantara Date: Wed Oct 22 21:11:01 2025 -0300 smb: client: get rid of d_drop() in cifs_do_rename() There is no need to force a lookup by unhashing the moved dentry after successfully renaming the file on server. The file metadata will be re-fetched from server, if necessary, in the next call to ->d_revalidate() anyways. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 5c56bf214af85ca042bf97f8584aab2151035840 Author: Niravkumar L Rabara Date: Thu Oct 23 11:32:01 2025 +0800 mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer `dma_dev` was being dereferenced before ensuring that `cdns_ctrl->dmac` is properly initialized. Move the assignment of `dma_dev` after successfully acquiring the DMA channel to ensure the pointer is valid before use. Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address") Cc: stable@vger.kernel.org Signed-off-by: Niravkumar L Rabara Signed-off-by: Miquel Raynal commit b1055678a0160b2952c322ad1b61805562698f99 Author: Andy Shevchenko Date: Thu Oct 23 08:39:58 2025 +0200 gpiolib: acpi: Use %pe when passing an error pointer to dev_err() One of the coccinelle recipe suggests to use %pe when we deal with an error pointer. Do it so. Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510231350.calxvXIm-lkp@intel.com/ Signed-off-by: Andy Shevchenko commit e4a77f9c85a528b3289c1d9570d6d73a7b5f847b Author: Hans de Goede Date: Wed Oct 22 15:37:15 2025 +0200 gpiolib: acpi: Make set debounce errors non fatal Commit 16c07342b542 ("gpiolib: acpi: Program debounce when finding GPIO") adds a gpio_set_debounce_timeout() call to acpi_find_gpio() and makes acpi_find_gpio() fail if this fails. But gpio_set_debounce_timeout() failing is a somewhat normal occurrence, since not all debounce values are supported on all GPIO/pinctrl chips. Making this an error for example break getting the card-detect GPIO for the micro-sd slot found on many Bay Trail tablets, breaking support for the micro-sd slot on these tablets. acpi_request_own_gpiod() already treats gpio_set_debounce_timeout() failures as non-fatal, just warning about them. Add a acpi_gpio_set_debounce_timeout() helper which wraps gpio_set_debounce_timeout() and warns on failures and replace both existing gpio_set_debounce_timeout() calls with the helper. Since the helper only warns on failures this fixes the card-detect issue. Fixes: 16c07342b542 ("gpiolib: acpi: Program debounce when finding GPIO") Cc: stable@vger.kernel.org Cc: Mario Limonciello Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Link: https://lore.kernel.org/stable/20250920201200.20611-1-hansg%40kernel.org Signed-off-by: Andy Shevchenko commit 3c9bf72cc1ced1297b235f9422d62b613a3fdae9 Author: Haotian Zhang Date: Mon Oct 20 18:11:09 2025 +0800 crypto: aspeed - fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove(). Fixes: 2f1cf4e50c95 ("crypto: aspeed - Add ACRY RSA driver") Signed-off-by: Haotian Zhang Signed-off-by: Herbert Xu commit 3ac2939bc4341ac28700a2ed0c345ba7e7bdb6fd Author: Harald Freudenberger Date: Fri Oct 17 14:32:54 2025 +0200 crypto: s390/phmac - Do not modify the req->nbytes value The phmac implementation used the req->nbytes field on combined operations (finup, digest) to track the state: with req->nbytes > 0 the update needs to be processed, while req->nbytes == 0 means to do the final operation. For this purpose the req->nbytes field was set to 0 after successful update operation. However, aead uses the req->nbytes field after a successful hash operation to determine the amount of data to en/decrypt. So an implementation must not modify the nbytes field. Fixed by a slight rework on the phmac implementation. There is now a new field async_op in the request context which tracks the (asynch) operation to process. So the 'state' via req->nbytes is not needed any more and now this field is untouched and may be evaluated even after a request is processed by the phmac implementation. Fixes: cbbc675506cc ("crypto: s390 - New s390 specific protected key hash phmac") Reported-by: Ingo Franzki Signed-off-by: Harald Freudenberger Tested-by: Ingo Franzki Reviewed-by: Ingo Franzki Reviewed-by: Holger Dengler Signed-off-by: Herbert Xu commit 0194b65ab571430130a11f8500894bb88f7af2c0 Author: Keith Busch Date: Tue Oct 21 08:15:05 2025 -0700 nvme-pci: use blk_map_iter for p2p metadata The dma_map_bvec helper doesn't work for p2p data, so use the same blk_map_iter method that sgl uses for this memory type. Reported-by: Leon Romanovsky Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit c0178eec8884231a5ae0592b9fce827bccb77e86 Author: Fernando Fernandez Mancera Date: Mon Oct 20 15:55:33 2025 +0200 net: hsr: prevent creation of HSR device with slaves from another netns HSR/PRP driver does not handle correctly having slaves/interlink devices in a different net namespace. Currently, it is possible to create a HSR link in a different net namespace than the slaves/interlink with the following command: ip link add hsr0 netns hsr-ns type hsr slave1 eth1 slave2 eth2 As there is no use-case on supporting this scenario, enforce that HSR device link matches netns defined by IFLA_LINK_NETNSID. The iproute2 command mentioned above will throw the following error: Error: hsr: HSR slaves/interlink must be on the same net namespace than HSR link. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20251020135533.9373-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 441f0647f7673e0e64d4910ef61a5fb8f16bfb82 Author: Alexey Simakov Date: Tue Oct 21 16:00:36 2025 +0300 sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition. Fixes: 90017accff61 ("sctp: Add GSO support") Signed-off-by: Alexey Simakov Acked-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com Signed-off-by: Jakub Kicinski commit a767957e7a83f9e742be196aa52a48de8ac5a7e4 Author: Jiasheng Jiang Date: Tue Oct 21 18:24:56 2025 +0000 ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop In ptp_ocp_sma_fb_init(), the code mistakenly used bp->sma[1] instead of bp->sma[i] inside a for-loop, which caused only SMA[1] to have its DIRECTION_CAN_CHANGE capability cleared. This led to inconsistent capability flags across SMA pins. Fixes: 09eeb3aecc6c ("ptp_ocp: implement DPLL ops") Signed-off-by: Jiasheng Jiang Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251021182456.9729-1-jiashengjiangcool@gmail.com Signed-off-by: Jakub Kicinski commit 5b2ff4873aeab972f919d5aea11c51393322bf58 Author: David Howells Date: Mon Oct 20 09:40:02 2025 +0100 cifs: Fix TCP_Server_Info::credits to be signed Fix TCP_Server_Info::credits to be signed, just as echo_credits and oplock_credits are. This also fixes what ought to get at least a compilation warning if not an outright error in *get_credits_field() as a pointer to the unsigned server->credits field is passed back as a pointer to a signed int. Signed-off-by: David Howells cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Acked-by: Pavel Shilovskiy Signed-off-by: Steve French commit 4c3aa496a2faac77069ea041e886edff01639610 Merge: d63f0391d6c7b7 706136c5723626 Author: Jakub Kicinski Date: Wed Oct 22 18:08:06 2025 -0700 Merge branch 'net-ravb-fix-soc-specific-configuration-and-descriptor-handling-issues' Lad Prabhakar says: ==================== net: ravb: Fix SoC-specific configuration and descriptor handling issues [part] This series addresses several issues in the Renesas Ethernet AVB (ravb) driver related descriptor ordering. A potential ordering hazard in descriptor setup could cause the DMA engine to start prematurely, leading to TX stalls on some platforms. The series includes the following changes: Enforce descriptor type ordering to prevent early DMA start Ensure proper write ordering of TX descriptor type fields to prevent the DMA engine from observing an incomplete descriptor chain. This fixes observed TX stalls on RZ/G2L platforms running RT kernels. Tested on R/G1x Gen2, RZ/G2x Gen3 and RZ/G2L family hardware. ==================== Link: https://patch.msgid.link/20251017151830.171062-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 706136c5723626fcde8dd8f598a4dcd251e24927 Author: Lad Prabhakar Date: Fri Oct 17 16:18:30 2025 +0100 net: ravb: Ensure memory write completes before ringing TX doorbell Add a final dma_wmb() barrier before triggering the transmit request (TCCR_TSRQ) to ensure all descriptor and buffer writes are visible to the DMA engine. According to the hardware manual, a read-back operation is required before writing to the doorbell register to guarantee completion of previous writes. Instead of performing a dummy read, a dma_wmb() is used to both enforce the same ordering semantics on the CPU side and also to ensure completion of writes. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Cc: stable@vger.kernel.org Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20251017151830.171062-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 5370c31e84b0e0999c7b5ff949f4e104def35584 Author: Lad Prabhakar Date: Fri Oct 17 16:18:29 2025 +0100 net: ravb: Enforce descriptor type ordering Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised. For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen. This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets. Fixes: 2f45d1902acf ("ravb: minimize TX data copying") Cc: stable@vger.kernel.org Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20251017151830.171062-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 123111ea6226c5302cc192028e7ae923c44e1382 Author: Stefan Metzmacher Date: Mon Oct 20 20:36:02 2025 +0200 smb: client: make use of smbdirect_socket.send_io.lcredits.* This makes the logic to prevent on overflow of the send submission queue with ib_post_send() easier. As we first get a local credit and then a remote credit before we mark us as pending. For now we'll keep the logic around smbdirect_socket.send_io.pending.*, but that will likely change or be removed completely. The server will get a similar logic soon, so we'll be able to share the send code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0158e864cca0c98bdc2866f1eb30c66fa21e250c Author: Stefan Metzmacher Date: Mon Oct 20 20:36:01 2025 +0200 smb: server: make use of smbdirect_socket.send_io.lcredits.* This introduces logic to prevent on overflow of the send submission queue with ib_post_send() easier. As we first get a local credit and then a remote credit before we mark us as pending. From reading the git history of the linux smbdirect implementations in client and server) it was seen that a peer granted more credits than we requested. I guess that only happened because of bugs in our implementation which was active as client and server. I guess Windows won't do that. So the local credits make sure we only use the amount of credits we asked for. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a90227462a14f5bdf7dfd4b73c2b75c54834efce Author: Stefan Metzmacher Date: Mon Oct 20 20:36:00 2025 +0200 smb: server: simplify sibling_list handling in smb_direct_flush_send_list/send_done We have a list handling that is much easier to understand: 1. Before smb_direct_flush_send_list() is called all struct smbdirect_send_io messages are part of send_ctx->msg_list 2. Before smb_direct_flush_send_list() calls smb_direct_post_send() we remove the last element in send_ctx->msg_list and move all others into last->sibling_list. As only last has IB_SEND_SIGNALED and gets a completion vis send_done(). 3. send_done() has an easy way to free all others in sendmsg->sibling_list (if there are any). And use list_for_each_entry_safe() instead of a complex custom logic. This will help us to share send_done() in common code soon, as it will work fine for the client too, where last->sibling_list is currently always an empty list. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8059c64049587dac8af37ad82e2034b64c2d9fee Author: Stefan Metzmacher Date: Mon Oct 20 20:35:59 2025 +0200 smb: server: smb_direct_disconnect_rdma_connection() already wakes all waiters on error There's no need to care about pending or credit counters when we already disconnecting. And all related wait_event conditions already check for broken connections too. This will simplify the code and makes the following changes simpler. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 68335cbcddcd586b59820e6d484652ad62343112 Author: Stefan Metzmacher Date: Mon Oct 20 20:35:58 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.lcredits.* This will be used to implement a logic in order to make sure we don't overflow the send submission queue for ib_post_send(). We will initialize the local credits with the fixed sp->send_credit_target value, which matches the reserved slots in the submission queue for ib_post_send(). We will be a local credit first and then wait for a remote credit, if we managed to get both we are allowed to post an IB_WR_SEND[_WITH_INV]. The local credit is given back to the pool when we get the local ib_post_send() completion, while remote credits are granted by the peer. From reading the git history of the linux smbdirect implementations in client and server) it was seen that a peer granted more credits than we requested. I guess that only happened because of bugs in our implementation which was active as client and server. I guess Windows won't do that. So the local credits make sure we only use the amount of credits we asked for. The client already has some logic for this based on smbdirect_socket.send_io.pending.count, but that counts in the order direction and makes it complex it share common logic for various credits classes. That logic will be replaced soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0bd73ae09ba1b73137d0830b21820d24700e09b1 Author: Stefan Metzmacher Date: Fri Oct 17 11:55:02 2025 +0200 smb: server: allocate enough space for RW WRs and ib_drain_qp() Make use of rdma_rw_mr_factor() to calculate the number of rw credits and the number of pages per RDMA RW operation. We get the same numbers for iWarp connections, tested with siw.ko and irdma.ko (in iWarp mode). siw: CIFS: max_qp_rd_atom=128, max_fast_reg_page_list_len = 256 CIFS: max_sgl_rd=0, max_sge_rd=1 CIFS: responder_resources=32 max_frmr_depth=256 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 3276800 max_qp_wr 32768 ksmbd: max_fast_reg_page_list_len = 256, max_sgl_rd=0, max_sge_rd=1 ksmbd: device reporting max_cqe 3276800 max_qp_wr 32768 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 9, num_pages = 256, maxpages=2048 ksmbd: Info: rdma_send_wr 27 + max_send_wr 256 = 283 irdma (in iWarp mode): CIFS: max_qp_rd_atom=127, max_fast_reg_page_list_len = 262144 CIFS: max_sgl_rd=0, max_sge_rd=13 CIFS: responder_resources=32 max_frmr_depth=2048 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: max_fast_reg_page_list_len = 262144, max_sgl_rd=0, max_sge_rd=13 ksmbd: device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 9, num_pages = 256, maxpages=2048 ksmbd: rdma_send_wr 27 + max_send_wr 256 = 283 This means that we get the different correct numbers for ROCE, tested with rdma_rxe.ko and irdma.ko (in RoCEv2 mode). rxe: CIFS: max_qp_rd_atom=128, max_fast_reg_page_list_len = 512 CIFS: max_sgl_rd=0, max_sge_rd=32 CIFS: responder_resources=32 max_frmr_depth=512 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 32767 max_qp_wr 1048576 ksmbd: max_fast_reg_page_list_len = 512, max_sgl_rd=0, max_sge_rd=32 ksmbd: device reporting max_cqe 32767 max_qp_wr 1048576 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 65, num_pages = 32, maxpages=2048 ksmbd: rdma_send_wr 65 + max_send_wr 256 = 321 irdma (in RoCEv2 mode): CIFS: max_qp_rd_atom=127, max_fast_reg_page_list_len = 262144, CIFS: max_sgl_rd=0, max_sge_rd=13 CIFS: responder_resources=32 max_frmr_depth=2048 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: max_fast_reg_page_list_len = 262144, max_sgl_rd=0, max_sge_rd=13 ksmbd: device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256, ksmbd: New sc->rw_io.credits: max = 159, num_pages = 13, maxpages=2048 ksmbd: rdma_send_wr 159 + max_send_wr 256 = 415 And rely on rdma_rw_init_qp() to setup ib_mr_pool_init() for RW MRs. ib_mr_pool_destroy() will be called by rdma_rw_cleanup_mrs(). It seems the code was implemented before the rdma_rw_* layer was fully established in the kernel. While there also add additional space for ib_drain_qp(). This should make sure ib_post_send() will never fail because the submission queue is full. Fixes: ddbdc861e37c ("ksmbd: smbd: introduce read/write credits for RDMA read/write") Fixes: 4c564f03e23b ("smb: server: make use of common smbdirect_socket") Fixes: 177368b99243 ("smb: server: make use of common smbdirect_socket_parameters") Fixes: 95475d8886bd ("smb: server: make use smbdirect_socket.rw_io.credits") Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 43e9ad0c55a369ecc84a4788d06a8a6bfa634f1c Merge: 0f3ad9c6105f32 48277906603528 Author: Linus Torvalds Date: Wed Oct 22 15:00:34 2025 -1000 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All driver fixes. The big change is the storvsc one to rejig the hyper-v channel handling to be more efficient for SMP virtual machines" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: phy: dt-bindings: Add QMP UFS PHY compatible for Kaanapali scsi: ufs: qcom: dt-bindings: Document the Kaanapali UFS controller scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() scsi: qla4xxx: Fix typos in comments scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU commit 0f3ad9c6105f32d1755c0bd54a7f98c892f3ceb7 Merge: dd72c8fcf6d35d 9aa12167ef1149 Author: Linus Torvalds Date: Wed Oct 22 14:57:35 2025 -1000 Merge tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "17 hotfixes. 12 are cc:stable and 14 are for MM. There's a two-patch DAMON series from SeongJae Park which addresses a missed check and possible memory leak. Apart from that it's all singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: csky: abiv2: adapt to new folio flags field mm/damon/core: use damos_commit_quota_goal() for new goal commit mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme hugetlbfs: move lock assertions after early returns in huge_pmd_unshare() vmw_balloon: indicate success when effectively deflating during migration mm/damon/core: fix list_add_tail() call on damon_call() mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap mm: prevent poison consumption when splitting THP ocfs2: clear extent cache after moving/defragmenting extents mm: don't spin in add_stack_record when gfp flags don't allow dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC mm/damon/sysfs: dealloc commit test ctx always mm/damon/sysfs: catch commit test ctx alloc failure hung_task: fix warnings caused by unaligned lock pointers commit 60ad1de8e59278656092f56e87189ec82f078d12 Author: Hannes Reinecke Date: Wed Oct 22 09:59:24 2025 +0200 nvmet-auth: update sc_c in host response The target code should set the sc_c bit in calculating the host response based on the status of the 'concat' setting, otherwise we'll get an authentication mismatch for hosts setting that bit correctly. Fixes: 7e091add9c43 ("nvme-auth: update sc_c in host response") Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 20594cd104abaaabb676c7a2915b150ae5ff093d Author: Kaushlendra Kumar Date: Mon Oct 6 14:17:06 2025 +0530 ACPI: button: Call input_free_device() on failing input device registration Make acpi_button_add() call input_free_device() when input_register_device() fails as required according to the documentation of the latter. Fixes: 0d51157dfaac ("ACPI: button: Eliminate the driver notify callback") Signed-off-by: Kaushlendra Kumar Cc: 6.5+ # 6.5+ [ rjw: Subject and changelog rewrite, Fixes: tag ] Link: https://patch.msgid.link/20251006084706.971855-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 2050280a4bb660b47f8cccf75a69293ae7cbb087 Author: Chen-Yu Tsai Date: Tue Oct 21 01:10:52 2025 +0800 clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate While the user manual states that the PLL's rate should be between 180 MHz and 3 GHz in the register defninition section, it also says the actual operating frequency is 22.5792*4 MHz in the PLL features table. 22.5792*4 MHz is one of the actual clock rates that we want and is is available in the SDM table. Lower the minimum clock rate to 90 MHz so that both rates in the SDM table can be used. Fixes: 7cae1e2b5544 ("clk: sunxi-ng: Add support for the A523/T527 CCU PLLs") Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20251020171059.2786070-7-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 5888533c6011de319c5f23ae147f1f291ce81582 Author: Chen-Yu Tsai Date: Tue Oct 21 01:10:51 2025 +0800 clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical The "bus-r-dma" clock in the A523's PRCM clock controller is also referred to as "DMA_CLKEN_SW" or "DMA ADB400 gating". It is unclear how this ties into the DMA controller MBUS clock gate; however if the clock is not enabled, the DMA controller in the MCU block will fail to access DRAM, even failing to retrieve the DMA descriptors. Mark this clock as critical. This sort of mirrors what is done for the main DMA controller's MBUS clock, which has a separate toggle that is currently left out of the main clock controller driver. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251020171059.2786070-6-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 1af424b15401d2be789c4dc2279889514e7c5c94 Author: Eric Biggers Date: Tue Oct 21 20:34:05 2025 -0700 lib/crypto: poly1305: Restore dependency of arch code on !KMSAN Restore the dependency of the architecture-optimized Poly1305 code on !KMSAN. It was dropped by commit b646b782e522 ("lib/crypto: poly1305: Consolidate into single module"). Unlike the other hash algorithms in lib/crypto/ (e.g., SHA-512), the way the architecture-optimized Poly1305 code is integrated results in assembly code initializing memory, for several different architectures. Thus, it generates false positive KMSAN warnings. These could be suppressed with kmsan_unpoison_memory(), but it would be needed in quite a few places. For now let's just restore the dependency on !KMSAN. Note: this should have been caught by running poly1305_kunit with CONFIG_KMSAN=y, which I did. However, due to an unrelated KMSAN bug (https://lore.kernel.org/r/20251022030213.GA35717@sol/), KMSAN currently isn't working reliably. Thus, the warning wasn't noticed until later. Fixes: b646b782e522 ("lib/crypto: poly1305: Consolidate into single module") Reported-by: syzbot+01fcd39a0d90cdb0e3df@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68f6a48f.050a0220.91a22.0452.GAE@google.com/ Reported-by: Pei Xiao Closes: https://lore.kernel.org/r/751b3d80293a6f599bb07770afcef24f623c7da0.1761026343.git.xiaopei01@kylinos.cn/ Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251022033405.64761-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 060aa0b0c26c9e88cfc1433fab3d0145700e8247 Author: David Wei Date: Tue Oct 21 13:29:44 2025 -0700 io_uring zcrx: add MAINTAINERS entry Same as [1] but also with netdev@ as an additional mailing list. io_uring zero copy receive is of particular interest to netdev participants too, given its tight integration to netdev core. With this updated entry, folks running get_maintainer.pl on patches that touch io_uring/zcrx.* will know to send it to netdev@ as well. Note that this doesn't mean all changes require explicit acks from netdev; this is purely for wider visibility and for other contributors to know where to send patches. [1]: https://lore.kernel.org/io-uring/989528e611b51d71fb712691ebfb76d2059ba561.1755461246.git.asml.silence@gmail.com/ Signed-off-by: David Wei Acked-by: Jakub Kicinski Reviewed-by: Mina Almasry [axboe: use correct io_uring tree URL] Signed-off-by: Jens Axboe commit 915651b7c9473fd23d0e56fe227a97eda483cf7c Author: Ranganath V N Date: Tue Oct 21 22:59:30 2025 +0530 io_uring: Fix code indentation error Fix the indentation to ensure consistent code style and improve readability and to fix the errors: ERROR: code indent should use tabs where possible + return io_net_import_vec(req, kmsg, sr->buf, sr->len, ITER_SOURCE);$ ERROR: code indent should use tabs where possible +^I^I^I struct io_big_cqe *big_cqe)$ Tested by running the /scripts/checkpatch.pl Signed-off-by: Ranganath V N Signed-off-by: Jens Axboe commit a94e0657269c5b8e1a90b17aa2c048b3d276e16d Author: Jens Axboe Date: Tue Oct 21 11:44:39 2025 -0600 io_uring/sqpoll: be smarter on when to update the stime usage The current approach is a bit naive, and hence calls the time querying way too often. Only start the "doing work" timer when there's actual work to do, and then use that information to terminate (and account) the work time once done. This greatly reduces the frequency of these calls, when they cannot have changed anyway. Running a basic random reader that is setup to use SQPOLL, a profile before this change shows these as the top cycle consumers: + 32.60% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime_adjusted + 19.97% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime + 12.20% io_uring io_uring [.] submitter_uring_fn + 4.13% iou-sqp-1074 [kernel.kallsyms] [k] getrusage + 2.45% iou-sqp-1074 [kernel.kallsyms] [k] io_submit_sqes + 2.18% iou-sqp-1074 [kernel.kallsyms] [k] __pi_memset_generic + 2.09% iou-sqp-1074 [kernel.kallsyms] [k] cputime_adjust and after this change, top of profile looks as follows: + 36.23% io_uring io_uring [.] submitter_uring_fn + 23.26% iou-sqp-819 [kernel.kallsyms] [k] io_sq_thread + 10.14% iou-sqp-819 [kernel.kallsyms] [k] io_sq_tw + 6.52% iou-sqp-819 [kernel.kallsyms] [k] tctx_task_work_run + 4.82% iou-sqp-819 [kernel.kallsyms] [k] nvme_submit_cmds.part.0 + 2.91% iou-sqp-819 [kernel.kallsyms] [k] io_submit_sqes [...] 0.02% iou-sqp-819 [kernel.kallsyms] [k] cputime_adjust where it's spending the cycles on things that actually matter. Reported-by: Fengnan Chang Cc: stable@vger.kernel.org Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") Signed-off-by: Jens Axboe commit 8ac9b0d33e5c0a995338ee5f25fe1b6ff7d97f65 Author: Jens Axboe Date: Tue Oct 21 07:16:08 2025 -0600 io_uring/sqpoll: switch away from getrusage() for CPU accounting getrusage() does a lot more than what the SQPOLL accounting needs, the latter only cares about (and uses) the stime. Rather than do a full RUSAGE_SELF summation, just query the used stime instead. Cc: stable@vger.kernel.org Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit f294a5fd34db564108a16166d891634a3cb25c68 Author: Ilpo Järvinen Date: Fri Oct 17 14:09:03 2025 +0300 MIPS: Malta: Use pcibios_align_resource() to block io range According to Maciej W. Rozycki , the mips_pcibios_init() for malta adjusts root bus IO resource start address to prevent interfering with PIIX4 I/O cycle decoding. Adjusting lower bound leaves PIIX4 IO resources outside of the root bus resource and assign_fixed_resource_on_bus() does not link the resources into the resource tree. Prior to commit ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") the arch specific pcibios_enable_resources() did not check if the resources were assigned which diverges from what PCI core checks, effectively hiding the PIIX4 IO resources were not properly within the resource tree. After starting to use pcibios_enable_resources() from PCI core, enabling PIIX4 fails: ata_piix 0000:00:0a.1: BAR 0 [io 0x01f0-0x01f7]: not claimed; can't enable device ata_piix 0000:00:0a.1: probe with driver ata_piix failed with error -22 MIPS PCI code already has support for enforcing lower bounds using PCIBIOS_MIN_IO in pcibios_align_resource() without altering the IO window start address itself. Make malta PCI code too to use PCIBIOS_MIN_IO. Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Reported-by: Guenter Roeck Link: https://lore.kernel.org/linux-pci/9085ab12-1559-4462-9b18-f03dcb9a4088@roeck-us.net/ Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/linux-pci/alpine.DEB.2.21.2510132229120.39634@angie.orcam.me.uk/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Guenter Roeck Tested-by: Maciej W. Rozycki Acked-by: Thomas Bogendoerfer Link: https://patch.msgid.link/20251017110903.1973-1-ilpo.jarvinen@linux.intel.com commit 1d5d1663619d5a367be538f6a1be1cf5bd2cf494 Author: Maciej W. Rozycki Date: Tue Oct 21 20:38:29 2025 +0100 MIPS: Malta: Fix PCI southbridge legacy resource reservations Covering the PCI southbridge legacy port I/O range with a northbridge resource reservation prevents MIPS Malta platform code from claiming its standard legacy resources. This is because request_resource() calls cause a clash with the previous reservation and consequently fail. Change to using insert_resource() so as to prevent the clash, switching the legacy reservations from: 00000000-00ffffff : MSC PCI I/O 00000020-00000021 : pic1 00000070-00000077 : rtc0 000000a0-000000a1 : pic2 [...] to: 00000000-00ffffff : MSC PCI I/O 00000000-0000001f : dma1 00000020-00000021 : pic1 00000040-0000005f : timer 00000060-0000006f : keyboard 00000070-00000077 : rtc0 00000080-0000008f : dma page reg 000000a0-000000a1 : pic2 000000c0-000000df : dma2 [...] Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Thomas Bogendoerfer Cc: stable@vger.kernel.org # v6.18+ Link: https://patch.msgid.link/alpine.DEB.2.21.2510212001250.8377@angie.orcam.me.uk commit bf5570590a981d0659d0808d2d4bcda21b27a2a5 Author: Maciej W. Rozycki Date: Tue Oct 21 20:38:22 2025 +0100 MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering MIPS Malta platform code registers the PCI southbridge legacy port I/O PS/2 keyboard range as a standard resource marked as busy. It prevents the i8042 driver from registering as it fails to claim the resource in a call to i8042_platform_init(). Consequently PS/2 keyboard and mouse devices cannot be used with this platform. Fix the issue by removing the busy marker from the standard reservation, making the driver register successfully: serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 and the resource show up as expected among the legacy devices: 00000000-00ffffff : MSC PCI I/O 00000000-0000001f : dma1 00000020-00000021 : pic1 00000040-0000005f : timer 00000060-0000006f : keyboard 00000060-0000006f : i8042 00000070-00000077 : rtc0 00000080-0000008f : dma page reg 000000a0-000000a1 : pic2 000000c0-000000df : dma2 [...] If the i8042 driver has not been configured, then the standard resource will remain there preventing any conflicting dynamic assignment of this PCI port I/O address range. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Thomas Bogendoerfer Cc: stable@vger.kernel.org Link: https://patch.msgid.link/alpine.DEB.2.21.2510211919240.8377@angie.orcam.me.uk commit 4c8cf6bd28d6fea23819f082ddc8063fd6fa963a Author: Christoph Hellwig Date: Wed Oct 22 10:33:31 2025 +0200 block: require LBA dma_alignment when using PI The block layer PI generation / verification code expects the bio_vecs to have at least LBA size (or more correctly integrity internal) granularity. With the direct I/O alignment relaxation in 2022, user space can now feed bios with less alignment than that, leading to scribbling outside the PI buffers. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr"), xfstests generic/013 by default generates such I/O now that the relaxed alignment is advertised by the XFS_IOC_DIOINFO ioctl. Fix this by increasing the required alignment when using PI, although handling arbitrary alignment in the long run would be even nicer. Fixes: bf8d08532bc1 ("iomap: add support for dma aligned direct-io") Fixes: b1a000d3b8ec ("block: relax direct io memory alignment") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 Author: Reinhard Speyerer Date: Wed Oct 22 16:17:26 2025 +0200 USB: serial: option: add Quectel RG255C Add support for Quectel RG255C devices to complement commit 5c964c8a97c1 ("net: usb: qmi_wwan: add Quectel RG255C"). The composition is DM / NMEA / AT / QMI. T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0316 Rev= 5.15 S: Manufacturer=Quectel S: Product=RG255C-GL S: SerialNumber=xxxxxxxx C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Reinhard Speyerer Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 920aa3a7705a061cb3004572d8b7932b54463dbf Author: Sidharth Seela Date: Mon Sep 29 17:24:06 2025 +0530 selftests: cachestat: Fix warning on declaration under label Fix warning caused from declaration under a case label. The proper way is to declare variable at the beginning of the function. The warning came from running clang using LLVM=1; and is as follows: -test_cachestat.c:260:3: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 260 | char *map = mmap(NULL, filesize, PROT_READ | PROT_WRITE, | Link: https://lore.kernel.org/r/20250929115405.25695-2-sidharthseela@gmail.com Signed-off-by: Sidharth Seela Reviewed-by: SeongJae Park Reviewed-by: wang lian Reviewed-by: Dev Jain Acked-by: Shuah Khan Acked-by: Nhat Pham Signed-off-by: Shuah Khan commit b90cafb438874e1419c14dfbcaf60ec7fc6ea353 Author: Madhur Kumar Date: Mon Oct 13 15:21:49 2025 +0530 selftests/cachestat: add tmpshmcstat file to .gitignore Add the tmpshmcstat file to .gitignore to avoid accidentally staging the build artifact Link: https://lore.kernel.org/r/20251013095149.1386628-1-madhurkumar004@gmail.com Signed-off-by: Madhur Kumar Signed-off-by: Shuah Khan commit dd72c8fcf6d35de5d6d976f20dc1ae84ce7af08b Merge: 250a17e8f9555f 34cbd6e07fddf3 Author: Linus Torvalds Date: Wed Oct 22 05:17:32 2025 -1000 Merge tag 'platform-drivers-x86-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - alienware-wmi-wmax: - Fix NULL pointer dereference in sleep handlers - Add AWCC support to Dell G15 5530 - mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init * tag 'platform-drivers-x86-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530 MAINTAINERS: add Denis Benato as maintainer for asus notebooks platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers commit 250a17e8f9555f5c5207581068ebfa2aa1f540a2 Merge: 9ea7460217423f 2a13fc417f493e Author: Linus Torvalds Date: Wed Oct 22 04:58:00 2025 -1000 Merge tag 'erofs-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Just three small fixes to address fuzzed images in relatively new features, as reported by Robert. - Hardening against fuzzed encoded extents - Fix infinite loops due to crafted subpage compact indexes - Improve z_erofs_extent_lookback()" * tag 'erofs-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: consolidate z_erofs_extent_lookback() erofs: avoid infinite loops due to corrupted subpage compact indexes erofs: fix crafted invalid cases for encoded extents commit 9ea7460217423f07febe273307a5f3b6b1303b29 Merge: 552c50713f273b 43c36a56ccf6d9 Author: Linus Torvalds Date: Wed Oct 22 04:53:34 2025 -1000 Merge tag '9p-for-6.18-rc3-v2' of https://github.com/martinetd/linux Pull 9pfs fix from Dominique Martinet: "Fix 9p cache=mmap regression by revert This reverts the problematic commit instead of trying to fix it in a rush" * tag '9p-for-6.18-rc3-v2' of https://github.com/martinetd/linux: Revert "fs/9p: Refresh metadata in d_revalidate for uncached mode too" commit 7458f72cc28f9eb0de811effcb5376d0ec19094a Author: Sudeep Holla Date: Fri Oct 17 12:03:20 2025 +0100 pmdomain: arm: scmi: Fix genpd leak on provider registration failure If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20 Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") Signed-off-by: Sudeep Holla Reviewed-by: Peng Fan Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c71af4d6d56665e04634babfc45dce3d9ab58285 Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:00 2025 +0200 of/irq: Fix OF node refcount in of_msi_get_domain() In of_msi_get_domain() if the iterator loop stops early because an irq_domain match is detected, an of_node_put() on the iterator node is needed to keep the OF node refcount in sync. Add it. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Rob Herring Link: https://patch.msgid.link/20251021124103.198419-3-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit 119aaeed0b6729293f41ea33be05ecd27a947d48 Author: Lorenzo Pieralisi Date: Tue Oct 21 14:40:59 2025 +0200 of/irq: Add msi-parent check to of_msi_xlate() In some legacy platforms the MSI controller for a PCI host bridge is identified by an msi-parent property whose phandle points at an MSI controller node with no #msi-cells property, that implicitly means #msi-cells == 0. For such platforms, mapping a device ID and retrieving the MSI controller node becomes simply a matter of checking whether in the device hierarchy there is an msi-parent property pointing at an MSI controller node with such characteristics. Add a helper function to of_msi_xlate() to check the msi-parent property in addition to msi-map and retrieve the MSI controller node (with a 1:1 ID deviceID-IN<->deviceID-OUT mapping) to provide support for deviceID mapping and MSI controller node retrieval for such platforms. Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Sascha Bischoff Cc: Rob Herring Cc: Marc Zyngier Link: https://patch.msgid.link/20251021124103.198419-2-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit 1b824134261d2db08fb6583ccbd05cb71861bd53 Author: Heiko Stuebner Date: Wed Oct 22 02:41:59 2025 +0200 spi: dt-bindings: spi-rockchip: Add RK3506 compatible The SPI controller found in the RK3506 SoC is still compatible to the original one introduced with the RK3066, so add the RK3506 compatible to the list of its variants. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251022004200.204276-1-heiko@sntech.de Signed-off-by: Mark Brown commit 3293d3d7b08872cf174bb768b890655f1b22526a Author: Shuming Fan Date: Wed Oct 22 15:39:52 2025 +0800 ASoC: sdw_utils: add name_prefix for rt1321 part id This patch adds name_prefix for rt1321 part id in the codec_info_list. Signed-off-by: Shuming Fan Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251022073952.327451-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 49c98f30f4021b560676a336f8a46a4f642eee2b Author: Mikulas Patocka Date: Mon Oct 20 14:23:58 2025 +0200 objtool: Fix failure when being compiled on x32 system Fix compilation failure when compiling the kernel with the x32 toolchain. In file included from check.c:16: check.c: In function ¡check_abs_references¢: /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:47:17: error: format ¡%lx¢ expects argument of type ¡long unsigned int¢, but argument 7 has type ¡u64¢ {aka ¡long long unsigned int¢} [-Werror=format=] 47 | "%s%s%s: objtool" extra ": " format "\n", \ | ^~~~~~~~~~~~~~~~~ /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:54:9: note: in expansion of macro ¡___WARN¢ 54 | ___WARN(severity, "", format, ##__VA_ARGS__) | ^~~~~~~ /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:74:27: note: in expansion of macro ¡__WARN¢ 74 | #define WARN(format, ...) __WARN(WARN_STR, format, ##__VA_ARGS__) | ^~~~~~ check.c:4713:33: note: in expansion of macro ¡WARN¢ 4713 | WARN("section %s has absolute relocation at offset 0x%lx", | ^~~~ Fixes: 0d6e4563fc03 ("objtool: Add action to check for absence of absolute relocations") Signed-off-by: Mikulas Patocka Signed-off-by: Peter Zijlstra (Intel) Acked-by: Ard Biesheuvel Link: https://patch.msgid.link/1ac32fff-2e67-5155-f570-69aad5bf5412@redhat.com commit dbdf2a7feb422f9bacfd12774e624cf26f503eb0 Author: Miguel Ojeda Date: Mon Oct 20 04:07:14 2025 +0200 objtool/rust: add one more `noreturn` Rust function Between Rust 1.79 and 1.86, under `CONFIG_RUST_KERNEL_DOCTESTS=y`, `objtool` may report: rust/doctests_kernel_generated.o: warning: objtool: rust_doctest_kernel_alloc_kbox_rs_13() falls through to next function rust_doctest_kernel_alloc_kvec_rs_0() (as well as in rust_doctest_kernel_alloc_kvec_rs_0) due to calls to the `noreturn` symbol: core::option::expect_failed from code added in commits 779db37373a3 ("rust: alloc: kvec: implement AsPageIter for VVec") and 671618432f46 ("rust: alloc: kbox: implement AsPageIter for VBox"). Thus add the mangled one to the list so that `objtool` knows it is actually `noreturn`. This can be reproduced as well in other versions by tweaking the code, such as the latest stable Rust (1.90.0). Stable does not have code that triggers this, but it could have it in the future. Downstream forks could too. Thus tag it for backport. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Signed-off-by: Miguel Ojeda Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Cc: stable@vger.kernel.org # Needed in 6.12.y and later. Link: https://patch.msgid.link/20251020020714.2511718-1-ojeda@kernel.org commit 0e4a169d1a2b630c607416d9e3739d80e176ed67 Author: K Prateek Nayak Date: Tue Oct 21 05:35:22 2025 +0000 sched/fair: Start a cfs_rq on throttled hierarchy with PELT clock throttled Matteo reported hitting the assert_list_leaf_cfs_rq() warning from enqueue_task_fair() post commit fe8d238e646e ("sched/fair: Propagate load for throttled cfs_rq") which transitioned to using cfs_rq_pelt_clock_throttled() check for leaf cfs_rq insertions in propagate_entity_cfs_rq(). The "cfs_rq->pelt_clock_throttled" flag is used to indicate if the hierarchy has its PELT frozen. If a cfs_rq's PELT is marked frozen, all its descendants should have their PELT frozen too or weird things can happen as a result of children accumulating PELT signals when the parents have their PELT clock stopped. Another side effect of this is the loss of integrity of the leaf cfs_rq list. As debugged by Aaron, consider the following hierarchy: root(#) / \ A(#) B(*) | C <--- new cgroup | D <--- new cgroup # - Already on leaf cfs_rq list * - Throttled with PELT frozen The newly created cgroups don't have their "pelt_clock_throttled" signal synced with cgroup B. Next, the following series of events occur: 1. online_fair_sched_group() for cgroup D will call propagate_entity_cfs_rq(). (Same can happen if a throttled task is moved to cgroup C and enqueue_task_fair() returns early.) propagate_entity_cfs_rq() adds the cfs_rq of cgroup C to "rq->tmp_alone_branch" since its PELT clock is not marked throttled and cfs_rq of cgroup B is not on the list. cfs_rq of cgroup B is skipped since its PELT is throttled. root cfs_rq already exists on cfs_rq leading to list_add_leaf_cfs_rq() returning early. The cfs_rq of cgroup C is left dangling on the "rq->tmp_alone_branch". 2. A new task wakes up on cgroup A. Since the whole hierarchy is already on the leaf cfs_rq list, list_add_leaf_cfs_rq() keeps returning early without any modifications to "rq->tmp_alone_branch". The final assert_list_leaf_cfs_rq() in enqueue_task_fair() sees the dangling reference to cgroup C's cfs_rq in "rq->tmp_alone_branch". !!! Splat !!! Syncing the "pelt_clock_throttled" indicator with parent cfs_rq is not enough since the new cfs_rq is not yet enqueued on the hierarchy. A dequeue on other subtree on the throttled hierarchy can freeze the PELT clock for the parent hierarchy without setting the indicators for this newly added cfs_rq which was never enqueued. Since there are no tasks on the new hierarchy, start a cfs_rq on a throttled hierarchy with its PELT clock throttled. The first enqueue, or the distribution (whichever happens first) will unfreeze the PELT clock and queue the cfs_rq on the leaf cfs_rq list. While at it, add an assert_list_leaf_cfs_rq() in propagate_entity_cfs_rq() to catch such cases in the future. Closes: https://lore.kernel.org/lkml/58a587d694f33c2ea487c700b0d046fa@codethink.co.uk/ Fixes: e1fad12dcb66 ("sched/fair: Switch to task based throttle model") Reported-by: Matteo Martelli Suggested-by: Aaron Lu Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Aaron Lu Tested-by: Aaron Lu Tested-by: Matteo Martelli Link: https://patch.msgid.link/20251021053522.37583-1-kprateek.nayak@amd.com commit d518314a1fa4e980a227d1b2bda1badf433cb932 Author: Daniel Golle Date: Tue Sep 16 22:37:27 2025 +0100 serial: 8250_mtk: Enable baud clock and manage in runtime PM Some MediaTek SoCs got a gated UART baud clock, which currently gets disabled as the clk subsystem believes it would be unused. This results in the uart freezing right after "clk: Disabling unused clocks" on those platforms. Request the baud clock to be prepared and enabled during probe, and to restore run-time power management capabilities to what it was before commit e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management") disable and unprepare the baud clock when suspending the UART, prepare and enable it again when resuming it. Fixes: e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management") Fixes: b6c7ff2693ddc ("serial: 8250_mtk: Simplify clock sequencing and runtime PM") Cc: stable Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Golle Link: https://patch.msgid.link/de5197ccc31e1dab0965cabcc11ca92e67246cf6.1758058441.git.daniel@makrotopia.org Signed-off-by: Greg Kroah-Hartman commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b Author: Artem Shimko Date: Sun Oct 19 12:51:31 2025 +0300 serial: 8250_dw: handle reset control deassert error Check the return value of reset_control_deassert() in the probe function to prevent continuing probe when reset deassertion fails. Previously, reset_control_deassert() was called without checking its return value, which could lead to probe continuing even when the device reset wasn't properly deasserted. The fix checks the return value and returns an error with dev_err_probe() if reset deassertion fails, providing better error handling and diagnostics. Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling") Cc: stable Signed-off-by: Artem Shimko Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit ea9f6d316782bf36141df764634a53d085061091 Author: Geert Uytterhoeven Date: Wed Oct 8 12:50:36 2025 +0200 dt-bindings: serial: sh-sci: Fix r8a78000 interrupts The SCIF instances on R-Car Gen5 have a single interrupt, just like on other R-Car SoCs. Fixes: 6ac1d60473727931 ("dt-bindings: serial: sh-sci: Document r8a78000 bindings") Cc: stable Signed-off-by: Geert Uytterhoeven Acked-by: Kuninori Morimoto Acked-by: Conor Dooley Link: https://patch.msgid.link/09bc9881b31bdb948ce8b69a2b5acf633f5505a4.1759920441.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 1c05bf6c0262f946571a37678250193e46b1ff0f Author: Hugo Villeneuve Date: Mon Oct 6 10:20:02 2025 -0400 serial: sc16is7xx: remove useless enable of enhanced features Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") permanently enabled access to the enhanced features in sc16is7xx_probe(), and it is never disabled after that. Therefore, remove re-enable of enhanced features in sc16is7xx_set_baud(). This eliminates a potential useless read + write cycle each time the baud rate is reconfigured. Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") Cc: stable Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20251006142002.177475-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 Author: Florian Eckert Date: Wed Sep 24 15:41:15 2025 +0200 serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018 has a 'XR17V35X' chip installed on the circuit board. Therefore, this driver can be used instead of theu outdated out-of-tree driver from the manufacturer. Signed-off-by: Florian Eckert Cc: stable Link: https://patch.msgid.link/20250924134115.2667650-1-fe@dev.tdt.de Signed-off-by: Greg Kroah-Hartman commit ef8fef45c74b5a0059488fda2df65fa133f7d7d0 Author: Cosmin Tanislav Date: Tue Sep 23 18:47:06 2025 +0300 tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is shared between RSCI and all other SCIF port types, but the RSCI overrun_reg is specified as a memory offset, while for other SCIF types it is an enum value used to index into the sci_port_params->regs array, as mentioned above the sci_serial_in() function. For RSCI, the overrun_reg is CSR (0x48), causing the sci_getreg() call inside the sci_handle_fifo_overrun() function to index outside the bounds of the regs array, which currently has a size of 20, as specified by SCI_NR_REGS. Because of this, we end up accessing memory outside of RSCI's rsci_port_params structure, which, when interpreted as a plat_sci_reg, happens to have a non-zero size, causing the following WARN when sci_serial_in() is called, as the accidental size does not match the supported register sizes. The existence of the overrun_reg needs to be checked because SCIx_SH3_SCIF_REGTYPE has overrun_reg set to SCLSR, but SCLSR is not present in the regs array. Avoid calling sci_getreg() for port types which don't use standard register handling. Use the ops->read_reg() and ops->write_reg() functions to properly read and write registers for RSCI, and change the type of the status variable to accommodate the 32-bit CSR register. sci_getreg() and sci_serial_in() are also called with overrun_reg in the sci_mpxed_interrupt() interrupt handler, but that code path is not used for RSCI, as it does not have a muxed interrupt. ------------[ cut here ]------------ Invalid register access WARNING: CPU: 0 PID: 0 at drivers/tty/serial/sh-sci.c:522 sci_serial_in+0x38/0xac Modules linked in: renesas_usbhs at24 rzt2h_adc industrialio_adc sha256 cfg80211 bluetooth ecdh_generic ecc rfkill fuse drm backlight ipv6 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.17.0-rc1+ #30 PREEMPT Hardware name: Renesas RZ/T2H EVK Board based on r9a09g077m44 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sci_serial_in+0x38/0xac lr : sci_serial_in+0x38/0xac sp : ffff800080003e80 x29: ffff800080003e80 x28: ffff800082195b80 x27: 000000000000000d x26: ffff8000821956d0 x25: 0000000000000000 x24: ffff800082195b80 x23: ffff000180e0d800 x22: 0000000000000010 x21: 0000000000000000 x20: 0000000000000010 x19: ffff000180e72000 x18: 000000000000000a x17: ffff8002bcee7000 x16: ffff800080000000 x15: 0720072007200720 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0000000000000058 x10: 0000000000000018 x9 : ffff8000821a6a48 x8 : 0000000000057fa8 x7 : 0000000000000406 x6 : ffff8000821fea48 x5 : ffff00033ef88408 x4 : ffff8002bcee7000 x3 : ffff800082195b80 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800082195b80 Call trace: sci_serial_in+0x38/0xac (P) sci_handle_fifo_overrun.isra.0+0x70/0x134 sci_er_interrupt+0x50/0x39c __handle_irq_event_percpu+0x48/0x140 handle_irq_event+0x44/0xb0 handle_fasteoi_irq+0xf4/0x1a0 handle_irq_desc+0x34/0x58 generic_handle_domain_irq+0x1c/0x28 gic_handle_irq+0x4c/0x140 call_on_irq_stack+0x30/0x48 do_interrupt_handler+0x80/0x84 el1_interrupt+0x34/0x68 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70 default_idle_call+0x28/0x58 (P) do_idle+0x1f8/0x250 cpu_startup_entry+0x34/0x3c rest_init+0xd8/0xe0 console_on_rootfs+0x0/0x6c __primary_switched+0x88/0x90 ---[ end trace 0000000000000000 ]--- Cc: stable Fixes: 0666e3fe95ab ("serial: sh-sci: Add support for RZ/T2H SCI") Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20250923154707.1089900-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Greg Kroah-Hartman commit 9631350885929819d4e46c6521df35960b472ef3 Author: Li Qiang Date: Mon Oct 20 20:53:33 2025 +0800 mtd: rawnand: realtek: Make rtl_ecc_engine_ops const The rtl_ecc_engine_ops structure is only used to provide a set of callback functions and is never modified after initialization. Mark it as const so it can be placed in the read-only section, which improves safety and allows better compiler optimization. Signed-off-by: Li Qiang Signed-off-by: Miquel Raynal commit 0d9c80aa572182d4b1464826cd77aa8973213216 Author: Geert Uytterhoeven Date: Wed Oct 8 11:47:15 2025 +0200 mtd: nand: MTD_NAND_ECC_REALTEK should depend on HAS_DMA If CONFIG_NO_DMA=y: ERROR: modpost: "dma_free_pages" [drivers/mtd/nand/ecc-realtek.ko] undefined! ERROR: modpost: "dma_alloc_pages" [drivers/mtd/nand/ecc-realtek.ko] undefined! The driver cannot function without DMA, hence fix this by adding a dependency on HAS_DMA. Fixes: 3148d0e5b1c5733d ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support") Signed-off-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit 9225f02ff201837e1443076f37a3c008140d1835 Author: Dan Carpenter Date: Fri Oct 3 12:30:10 2025 +0300 mtd: nand: realtek-ecc: Fix a IS_ERR() vs NULL bug in probe The dma_alloc_noncoherent() function doesn't return error pointers, it returns NULL on error. Fix the error checking to match. Fixes: 3148d0e5b1c5 ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support") Signed-off-by: Dan Carpenter Reviewed-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit e4185bed738da755b191aa3f2e16e8b48450e1b8 Author: Dan Carpenter Date: Tue Sep 30 15:32:34 2025 +0300 mtdchar: fix integer overflow in read/write ioctls The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits of "req.len" so that's capped at U32_MAX but the "req.start" variable can go up to U64_MAX which means that the addition can still integer overflow. Use check_add_overflow() to fix this bug. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Fixes: 6420ac0af95d ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Miquel Raynal commit a28352cf2d2f8380e7aca8cb61682396dca7a991 Author: Shawn Lin Date: Mon Oct 20 09:49:41 2025 +0800 mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 strbin signal delay under 0x8 configuration is not stable after massive test. The recommandation of it should be 0x4. Signed-off-by: Shawn Lin Tested-by: Alexey Charkov Tested-by: Hugh Cole-Baker Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit db82b8dbf5f06d7b1abec4e1326ed8c02fa16897 Author: Rafael J. Wysocki Date: Mon Oct 20 17:03:28 2025 +0200 PM: runtime: Fix conditional guard definitions Since pm_runtime_get_active() returns 0 on success, all of the DEFINE_GUARD_COND() macros in pm_runtime.h need the "_RET == 0" condition at the end of the argument list or they would not work correctly. Fixes: 9a0abc39450a ("PM: runtime: Add auto-cleanup macros for "resume and get" operations") Reported-by: kernel test robot Link: https://lore.kernel.org/linux-pm/202510191529.BCyjKlLQ-lkp@intel.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Tested-by: Farhan Ali Link: https://patch.msgid.link/5943878.DvuYhMxLoT@rafael.j.wysocki commit f477af0cfa0487eddec66ffe10fd9df628ba6f52 Author: Darrick J. Wong Date: Tue Oct 21 11:30:43 2025 -0700 xfs: fix locking in xchk_nlinks_collect_dir On a filesystem with parent pointers, xchk_nlinks_collect_dir walks both the directory entries (data fork) and the parent pointers (attr fork) to determine the correct link count. Unfortunately I forgot to update the lock mode logic to handle the case of a directory whose attr fork is in btree format and has not yet been loaded *and* whose data fork doesn't need loading. This leads to a bunch of assertions from xfs/286 in xfs_iread_extents because we only took ILOCK_SHARED, not ILOCK_EXCL. You'd need the rare happenstance of a directory with a large number of non-pptr extended attributes set and enough memory pressure to cause the directory to be evicted and partially reloaded from disk. I /think/ this only started in 6.18-rc1 because I've started seeing OOM errors with the maple tree slab using 70% of memory, and this didn't happen in 6.17. Yay dynamic systems! Cc: stable@vger.kernel.org # v6.10 Fixes: 77ede5f44b0d86 ("xfs: walk directory parent pointers to determine backref count") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 3e7ec343f066cb3b6916239680ab6ad44537b453 Author: Darrick J. Wong Date: Tue Oct 21 11:30:27 2025 -0700 xfs: loudly complain about defunct mount options Apparently we can never deprecate mount options in this project, because it will invariably turn out that some foolish userspace depends on some behavior and break. From Oleksandr Natalenko: In v6.18, the attr2 XFS mount option is removed. This may silently break system boot if the attr2 option is still present in /etc/fstab for rootfs. Consider Arch Linux that is being set up from scratch with / being formatted as XFS. The genfstab command that is used to generate /etc/fstab produces something like this by default: /dev/sda2 on / type xfs (rw,relatime,attr2,discard,inode64,logbufs=8,logbsize=32k,noquota) Once the system is set up and rebooted, there's no deprecation warning seen in the kernel log: # cat /proc/cmdline root=UUID=77b42de2-397e-47ee-a1ef-4dfd430e47e9 rootflags=discard rd.luks.options=discard quiet # dmesg | grep -i xfs [ 2.409818] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled [ 2.415341] XFS (sda2): Mounting V5 Filesystem 77b42de2-397e-47ee-a1ef-4dfd430e47e9 [ 2.442546] XFS (sda2): Ending clean mount Although as per the deprecation intention, it should be there. Vlastimil (in Cc) suggests this is because xfs_fs_warn_deprecated() doesn't produce any warning by design if the XFS FS is set to be rootfs and gets remounted read-write during boot. This imposes two problems: 1) a user doesn't see the deprecation warning; and 2) with v6.18 kernel, the read-write remount fails because of unknown attr2 option rendering system unusable: systemd[1]: Switching root. systemd-remount-fs[225]: /usr/bin/mount for / exited with exit status 32. # mount -o rw / mount: /: fsconfig() failed: xfs: Unknown parameter 'attr2'. Thorsten (in Cc) suggested reporting this as a user-visible regression. From my PoV, although the deprecation is in place for 5 years already, it may not be visible enough as the warning is not emitted for rootfs. Considering the amount of systems set up with XFS on /, this may impose a mass problem for users. Vlastimil suggested making attr2 option a complete noop instead of removing it. IOWs, the initrd mounts the root fs with (I assume) no mount options, and mount -a remounts with whatever options are in fstab. However, XFS doesn't complain about deprecated mount options during a remount, so technically speaking we were not warning all users in all combinations that they were heading for a cliff. Gotcha!! Now, how did 'attr2' get slurped up on so many systems? The old code would put that in /proc/mounts if the filesystem happened to be in attr2 mode, even if user hadn't mounted with any such option. IOWs, this is because someone thought it would be a good idea to advertise system state via /proc/mounts. The easy way to fix this is to reintroduce the four mount options but map them to a no-op option that ignores them, and hope that nobody's depending on attr2 to appear in /proc/mounts. (Hint: use the fsgeometry ioctl). But we've learned our lesson, so complain as LOUDLY as possible about the deprecation. Lessons learned: 1. Don't expose system state via /proc/mounts; the only strings that ought to be there are options *explicitly* provided by the user. 2. Never tidy, it's not worth the stress and irritation. Reported-by: Vlastimil Babka Reported-by: Oleksandr Natalenko Cc: stable@vger.kernel.org # v6.18-rc1 Fixes: b9a176e54162f8 ("xfs: remove deprecated mount options") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 630785bfbe12c3ee3ebccd8b530a98d632b7e39d Author: Darrick J. Wong Date: Tue Oct 21 11:30:12 2025 -0700 xfs: always warn about deprecated mount options The deprecation of the 'attr2' mount option in 6.18 wasn't entirely successful because nobody noticed that the kernel never printed a warning about attr2 being set in fstab if the only xfs filesystem is the root fs; the initramfs mounts the root fs with no mount options; and the init scripts only conveyed the fstab options by remounting the root fs. Fix this by making it complain all the time. Cc: stable@vger.kernel.org # v5.13 Fixes: 92cf7d36384b99 ("xfs: Skip repetitive warnings about mount options") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit bd721ec7dedcc24ced51559e42a39140b59dfd08 Author: Darrick J. Wong Date: Tue Oct 21 11:29:56 2025 -0700 xfs: don't set bt_nr_sectors to a negative number xfs_daddr_t is a signed type, which means that xfs_buf_map_verify is using a signed comparison. This causes problems if bt_nr_sectors is never overridden (e.g. in the case of an xfbtree for rmap btree repairs) because even daddr 0 can't pass the verifier test in that case. Define an explicit max constant and set the initial bt_nr_sectors to a positive value. Found by xfs/422. Cc: stable@vger.kernel.org # v6.18-rc1 Fixes: 42852fe57c6d2a ("xfs: track the number of blocks in each buftarg") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 2d8713f807a49b8a67c221670e50ae04967e915d Author: Michael Grzeschik Date: Mon Oct 13 11:43:40 2025 +0200 tcpm: switch check for role_sw device with fw_node When there is no port entry in the tcpci entry itself, the driver will trigger an error message "OF: graph: no port node found in /...../typec" . It is documented that the dts node should contain an connector entry with ports and several port pointing to devices with usb-role-switch property set. Only when those connector entry is missing, it should check for port entries in the main node. We switch the search order for looking after ports, which will avoid the failure message while there are explicit connector entries. Fixes: d56de8c9a17d ("usb: typec: tcpm: try to get role switch from tcpc fwnode") Cc: stable Signed-off-by: Michael Grzeschik Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/20251013-b4-ml-topic-tcpm-v2-1-63c9b2ab8a0b@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab Author: Tim Guttzeit Date: Mon Oct 20 15:39:04 2025 +0200 usb/core/quirks: Add Huawei ME906S to wakeup quirk The list of Huawei LTE modules needing the quirk fixing spurious wakeups was missing the IDs of the Huawei ME906S module, therefore suspend did not work. Cc: stable Signed-off-by: Tim Guttzeit Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20251020134304.35079-1-wse@tuxedocomputers.com Signed-off-by: Greg Kroah-Hartman commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 Author: Andrey Konovalov Date: Wed Oct 22 00:25:45 2025 +0200 usb: raw-gadget: do not limit transfer length Drop the check on the maximum transfer length in Raw Gadget for both control and non-control transfers. Limiting the transfer length causes a problem with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length. Overall, there does not appear to be any reason to enforce any kind of transfer length limit on the Raw Gadget side for either control or non-control transfers, so let's just drop the related check. Cc: stable Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface") Signed-off-by: Andrey Konovalov Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com Signed-off-by: Greg Kroah-Hartman commit ada7d45b568abe4f1fd9c53d66e05fbea300674b Author: Amit Dhingra Date: Tue Oct 21 07:07:20 2025 -0500 btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree() btrfs_extent_root()/btrfs_global_root() does not return error pointers, it returns NULL on error. Reported-by: Dan Carpenter Link: https://lore.kernel.org/all/aNJfvxj0anEnk9Dm@stanley.mountain/ Fixes : ed4e6b5d644c ("btrfs: ref-verify: handle damaged extent root tree") CC: stable@vger.kernel.org # 6.17+ Signed-off-by: Amit Dhingra Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0fd7e7a1ad7c5fb8801a9c1661fc4e1ae4d9b655 Author: Leo Martins Date: Mon Oct 20 16:16:15 2025 -0700 btrfs: fix delayed_node ref_tracker use after free Move the print before releasing the delayed node. In my initial testing there was a bug that was causing delayed_nodes to not get freed which is why I put the print after the release. This obviously neglects the case where the delayed node is properly freed. Add condition to make sure we only print if we have more than one reference to the delayed_node to prevent printing when we only have the reference taken in btrfs_kill_all_delayed_nodes(). Fixes: b767a28d6154 ("btrfs: print leaked references in kill_all_delayed_nodes()") Tested-by: Christoph Hellwig Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2ba5772e530f73eb847fb96ce6c4017894869552 Author: William Breathitt Gray Date: Mon Oct 20 17:51:46 2025 +0900 gpio: idio-16: Define fixed direction of the GPIO lines The direction of the IDIO-16 GPIO lines is fixed with the first 16 lines as output and the remaining 16 lines as input. Set the gpio_config fixed_direction_output member to represent the fixed direction of the GPIO lines. Fixes: db02247827ef ("gpio: idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Michael Walle Cc: stable@vger.kernel.org # ae495810cffe: gpio: regmap: add the .fixed_direction_output configuration parameter Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-3-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit 00aaae60faf554c27c95e93d47f200a93ff266ef Author: Ioana Ciornei Date: Tue Oct 14 18:53:53 2025 +0300 gpio: regmap: add the .fixed_direction_output configuration parameter There are GPIO controllers such as the one present in the LX2160ARDB QIXIS FPGA which have fixed-direction input and output GPIO lines mixed together in a single register. This cannot be modeled using the gpio-regmap as-is since there is no way to present the true direction of a GPIO line. In order to make this use case possible, add a new configuration parameter - fixed_direction_output - into the gpio_regmap_config structure. This will enable user drivers to provide a bitmap that represents the fixed direction of the GPIO lines. Signed-off-by: Ioana Ciornei Acked-by: Bartosz Golaszewski Reviewed-by: Michael Walle Signed-off-by: Bartosz Golaszewski commit 2eead19334516c8e9927c11b448fbe512b1f18a1 Author: Kaushlendra Kumar Date: Tue Sep 23 23:13:08 2025 +0530 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: "The error code within @ptr if it is an error pointer; 0 otherwise." This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate(). Cc: stable Signed-off-by: Kaushlendra Kumar Reviewed-by: Sudeep Holla Fixes: b8fe128dad8f ("arch_topology: Adjust initial CPU capacities with current freq") Link: https://patch.msgid.link/20250923174308.1771906-1-kaushlendra.kumar@intel.com Signed-off-by: Greg Kroah-Hartman commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 Author: Victoria Votokina Date: Fri Oct 10 13:52:41 2025 +0300 most: usb: hdm_probe: Fix calling put_device() before device initialization The early error path in hdm_probe() can jump to err_free_mdev before &mdev->dev has been initialized with device_initialize(). Calling put_device(&mdev->dev) there triggers a device core WARN and ends up invoking kref_put(&kobj->kref, kobject_release) on an uninitialized kobject. In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device. This removes the WARNING and fixes the pre-initialization error path. Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Cc: stable Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 Author: Victoria Votokina Date: Fri Oct 10 13:52:40 2025 +0300 most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below. Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761 Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 Author: Alice Ryhl Date: Wed Oct 15 14:26:55 2025 +0000 binder: remove "invalid inc weak" check There are no scenarios where a weak increment is invalid on binder_node. The only possible case where it could be invalid is if the kernel delivers BR_DECREFS to the process that owns the node, and then increments the weak refcount again, effectively "reviving" a dead node. However, that is not possible: when the BR_DECREFS command is delivered, the kernel removes and frees the binder_node. The fact that you were able to call binder_inc_node_nilocked() implies that the node is not yet destroyed, which implies that BR_DECREFS has not been delivered to userspace, so incrementing the weak refcount is valid. Note that it's currently possible to trigger this condition if the owner calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes BC_INCREFS on binder_ref instances to fail when they should not. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Yu-Ting Tseng Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com Signed-off-by: Greg Kroah-Hartman commit 2463ae285e5c162686fb19e822fb6b535e6e728a Author: Alexander Usyskin Date: Sun Oct 19 10:36:59 2025 +0300 mei: txe: fix initialization order The mei_register() should move before the mei_start() for hook on class device to work. Same change was implemented in mei-me, missed from mei-txe. Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251019073659.2646791-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 Author: Deepanshu Kartikey Date: Wed Sep 24 15:56:39 2025 +0530 comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands. Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com Signed-off-by: Greg Kroah-Hartman commit 98718e80af0bb1cd80f4bfe565dd60c57debad51 Author: Nathan Chancellor Date: Sat Sep 20 16:17:50 2025 -0700 mei: late_bind: Fix -Wincompatible-function-pointer-types-strict When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance in the new mei late binding code originating from the type parameter of mei_lb_push_payload(): drivers/misc/mei/mei_lb.c:211:18: error: incompatible function pointer types initializing 'int (*)(struct device *, u32, u32, const void *, size_t)' (aka 'int (*)(struct device *, unsigned int, unsigned int, const void *, unsigned long)') with an expression of type 'int (struct device *, enum intel_lb_type, u32, const void *, size_t)' (aka 'int (struct device *, enum intel_lb_type, unsigned int, const void *, unsigned long)') [-Werror,-Wincompatible-function-pointer-types-strict] 211 | .push_payload = mei_lb_push_payload, | ^~~~~~~~~~~~~~~~~~~ While 'unsigned int' and 'enum intel_lb_type' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when mei_lb_push_payload() is called indirectly. Update the type parameter of mei_lb_push_payload() to be 'u32' to match the prototype in 'struct intel_lb_component_ops', clearing up the warning and kCFI violation. Fixes: 741eeabb7c78 ("mei: late_bind: add late binding component driver") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20250920-drm-xe-fix-wifpts-v1-1-c89b5357c7ba@kernel.org Signed-off-by: Greg Kroah-Hartman commit fff111bf45cbeeb659324316d68554e35d350092 Author: Junhao Xie Date: Fri Oct 17 16:39:06 2025 +0800 misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup In fastrpc_map_lookup, dma_buf_get is called to obtain a reference to the dma_buf for comparison purposes. However, this reference is never released when the function returns, leading to a dma_buf memory leak. Fix this by adding dma_buf_put before returning from the function, ensuring that the temporarily acquired reference is properly released regardless of whether a matching map is found. Fixes: 9031626ade38 ("misc: fastrpc: Fix fastrpc_map_lookup operation") Cc: stable@kernel.org Signed-off-by: Junhao Xie Tested-by: Xilin Wu Rule: add Link: https://lore.kernel.org/stable/48B368FB4C7007A7%2B20251017083906.3259343-1-bigfoot%40radxa.com Link: https://patch.msgid.link/48B368FB4C7007A7+20251017083906.3259343-1-bigfoot@radxa.com Signed-off-by: Greg Kroah-Hartman commit 410d6c2ad4d1a88efa0acbb9966693725b564933 Author: Alexander Usyskin Date: Thu Oct 16 15:59:12 2025 +0300 mei: me: add wildcat lake P DID Add Wildcat Lake P device id. Cc: stable@vger.kernel.org Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 70ad06df73a9796026b197d84ead751e096618c7 Author: Jean Delvare Date: Thu Oct 16 15:50:40 2025 +0200 misc: amd-sbi: Clarify that this is a BMC driver Add a sentence to the driver description to clarify that the sbrmi-i2c driver is intended to run on the BMC and not on the managed node. Add platform dependencies accordingly. Signed-off-by: Jean Delvare Link: https://lore.kernel.org/r/5c9f7100-0e59-4237-a252-43c3ee4802a2@amd.com Link: https://patch.msgid.link/20251016155040.0e86c102@endymion Signed-off-by: Greg Kroah-Hartman commit 7959ffbec062c35bda02aa635d21ac45dbfacd80 Author: Cosmin Tanislav Date: Fri Sep 19 17:28:53 2025 +0300 nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE The nvmem-rcar-efuse driver can be compiled as a module. Add missing MODULE_DEVICE_TABLE so it can be matched by modalias and automatically loaded by udev. Cc: stable@vger.kernel.org Fixes: 1530b923a514 ("nvmem: Add R-Car E-FUSE driver") Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250919142856.2313927-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Greg Kroah-Hartman commit 43c36a56ccf6d9b07b4b3f4f614756e687dcdc01 Author: Dominique Martinet Date: Wed Oct 22 06:33:42 2025 +0900 Revert "fs/9p: Refresh metadata in d_revalidate for uncached mode too" This reverts commit 290434474c332a2ba9c8499fe699c7f2e1153280. That commit broke cache=mmap, a mode that doesn't cache metadata, but still has writeback cache. In commit 290434474c33 ("fs/9p: Refresh metadata in d_revalidate for uncached mode too") we considered metadata cache to be enough to not look at the server, but in writeback cache too looking at the server size would make the vfs consider the file has been truncated before the data has been flushed out, making the following repro fail (nothing is ever read back, the resulting file ends up with no data written) ``` #include #include #include #include char buf[4096]; int main(int argc, char *argv[]) { int ret, i; int fdw, fdr; if (argc < 2) return 1; fdw = openat(AT_FDCWD, argv[1], O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0600); if (fdw < 0) { fprintf(stderr, "cannot open fdw\n"); return 1; } write(fdw, buf, sizeof(buf)); fdr = openat(AT_FDCWD, argv[1], O_RDONLY|O_CLOEXEC); if (fdr < 0) { fprintf(stderr, "cannot open fdr\n"); close(fdw); return 1; } for (i = 0; i < 10; i++) { ret = read(fdr, buf, sizeof(buf)); fprintf(stderr, "i: %d, read returns %d\n", i, ret); } close(fdr); close(fdw); return 0; } ``` There is a fix for this particular reproducer but it looks like there are other problems around metadata refresh (e.g. around file rename), so revert this to avoid d_revalidate in uncached mode for now. Reported-by: Song Liu Link: https://lkml.kernel.org/r/CAHzjS_u_SYdt5=2gYO_dxzMKXzGMt-TfdE_ueowg-Hq5tRCAiw@mail.gmail.com Reported-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/CAEf4BzZbCE4tLoDZyUf_aASpgAGFj75QMfSXX4a4dLYixnOiLg@mail.gmail.com/ Fixes: 290434474c33 ("fs/9p: Refresh metadata in d_revalidate for uncached mode too") Signed-off-by: Dominique Martinet commit d63f0391d6c7b75e1a847e1a26349fa8cad0004d Author: Heiner Kallweit Date: Mon Oct 20 08:54:54 2025 +0200 net: hibmcge: select FIXED_PHY hibmcge uses fixed_phy_register() et al, but doesn't cater for the case that hibmcge is built-in and fixed_phy is a module. To solve this select FIXED_PHY. Fixes: 1d7cd7a9c69c ("net: hibmcge: support scenario without PHY") Signed-off-by: Heiner Kallweit Reviewed-by: Jijie Shao Link: https://patch.msgid.link/c4fc061f-b6d5-418b-a0dc-6b238cdbedce@gmail.com Signed-off-by: Jakub Kicinski commit 5523508258d390fd55b25c1c0f99c092f23a39e9 Author: Yeounsu Moon Date: Sun Oct 19 16:55:40 2025 +0900 net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb Replace `dev_kfree_skb()` with `dev_kfree_skb_any()` in `start_xmit()` which can be called from netpoll (hard IRQ) and from other contexts. Also, `np->link_status` can be changed at any time by interrupt handler. -0 [011] dNh4. 4541.754603: start_xmit <-netpoll_start_xmit -0 [011] dNh4. 4541.754622: => [FTRACE TRAMPOLINE] => start_xmit => netpoll_start_xmit => netpoll_send_skb => write_msg => console_flush_all => console_unlock => vprintk_emit => _printk => rio_interrupt => __handle_irq_event_percpu => handle_irq_event => handle_fasteoi_irq => __common_interrupt => common_interrupt => asm_common_interrupt => mwait_idle => default_idle_call => do_idle => cpu_startup_entry => start_secondary => common_startup_64 This issue can occur when the link state changes from off to on (e.g., plugging or unplugging the LAN cable) while transmitting a packet. If the skb has a destructor, a warning message may be printed in this situation. -> consume_skb (dev_kfree_skb()) -> __kfree_skb() -> skb_release_all() -> skb_release_head_state(skb) if (skb->destructor) { DEBUG_NET_WARN_ON_ONCE(in_hardirq()); skb->destructor(skb); } Found by inspection. Signed-off-by: Yeounsu Moon Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-on: D-Link DGE-550T Rev-A3 Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251019075540.55697-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 Author: Ondrej Mosnacek Date: Tue Oct 21 14:27:58 2025 +0200 bpf: Do not audit capability check in do_jit() The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder. Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2369326 Fixes: d4e89d212d40 ("x86/bpf: Call branch history clearing sequence on exit") Signed-off-by: Ondrej Mosnacek Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20251021122758.2659513-1-omosnace@redhat.com Signed-off-by: Alexei Starovoitov commit d54c676d4fe0543d1642ab7a68ffdd31e8639a5d Author: Bart Van Assche Date: Tue Oct 14 15:02:43 2025 -0700 scsi: core: Fix the unit attention counter implementation scsi_decide_disposition() may call scsi_check_sense(). scsi_decide_disposition() calls are not serialized. Hence, counter updates by scsi_check_sense() must be serialized. Hence this patch that makes the counters updated by scsi_check_sense() atomic. Cc: Kai Mäkisara Fixes: a5d518cd4e3e ("scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs") Signed-off-by: Bart Van Assche Reviewed-by: Ewan D. Milne Link: https://patch.msgid.link/20251014220244.3689508-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 35bc3c8ee319083333b758355ffd739a96af5c00 Author: Wonkon Kim Date: Mon Oct 20 15:15:39 2025 +0900 scsi: ufs: core: Declare tx_lanes witout initialization A value of an attribute will be initialized at ufshcd_dme_get_attr(). There is no need to initialize a tx_lanes. Signed-off-by: Wonkon Kim Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251020061539.28661-3-wkon.kim@samsung.com Signed-off-by: Martin K. Petersen commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a Author: Wonkon Kim Date: Mon Oct 20 15:15:38 2025 +0900 scsi: ufs: core: Initialize value of an attribute returned by uic cmd If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can get an unintended value of an attribute. Make ufshcd_dme_get_attr() always initialize *mib_val. Fixes: 12b4fdb4f6bc ("[SCSI] ufs: add dme configuration primitives") Signed-off-by: Wonkon Kim Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251020061539.28661-2-wkon.kim@samsung.com Signed-off-by: Martin K. Petersen commit e23ef4f22db30a1e49c8b060e4ebc9dc9ca99c49 Author: Peter Wang Date: Wed Oct 8 14:55:43 2025 +0800 scsi: ufs: core: Fix error handler host_sem issue Fix the issue where host_sem is not released due to a new return path in commit f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock"). Check pm_op_in_progress before acquiring hba->host_sem to prevent deadlocks and ensure proper resource management during error handling. Add comment for use ufshcd_rpm_get_noresume() to safely perform link recovery without interfering with ongoing PM operations. Fixes: f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock") Reported-by: Dan Carpenter Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251008065651.1589614-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 2653e9c5dda5a320310aae8f0abba6fc1be40eec Merge: 86c48f50bababb 8e93ac51e4c6dc Author: Jakub Kicinski Date: Tue Oct 21 17:42:54 2025 -0700 Merge tag 'linux-can-fixes-for-6.18-20251020' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-10-20 All patches are by me. The first 3 update the bxcan, esd and rockchip driver to drop skbs in xmit of the device is in listen only mode. The last patch targets the CAN netlink implementation to allow the disabling of automatic restart after Bus-Off, even if the a driver doesn't implement that callback. * tag 'linux-can-fixes-for-6.18-20251020' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: netlink: can_changelink(): allow disabling of automatic restart can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() ==================== Link: https://patch.msgid.link/20251020152516.1590553-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 86c48f50bababbb45622616b48385aa94bfadf5f Author: Randy Dunlap Date: Sun Oct 19 22:27:16 2025 -0700 Documentation: networking: ax25: update the mailing list info. Update the mailing list subscription information for the linux-hams mailing list. Signed-off-by: Randy Dunlap Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251020052716.3136773-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit c5394b8b7a92c5013d2917591e28e938fe7ff2a2 Author: Eric Dumazet Date: Mon Oct 20 16:11:14 2025 +0000 net: gro_cells: fix lock imbalance in gro_cells_receive() syzbot found that the local_unlock_nested_bh() call was missing in some cases. WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.2.329/7421 is trying to acquire lock: ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline] ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30 but task is already holding lock: ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline] ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((&cell->bh_lock)); lock((&cell->bh_lock)); *** DEADLOCK *** Given the introduction of @have_bh_lock variable, it seems the author intent was to have the local_unlock_nested_bh() after the @unlock label. Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell") Reported-by: syzbot+f9651b9a8212e1c8906f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68f65eb9.a70a0220.205af.0034.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Sebastian Andrzej Siewior Reviewed-by: David Ahern Link: https://patch.msgid.link/20251020161114.1891141-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9ab614bc818a93810c27f3e1b4c072e087f8500a Merge: 49d34f3dd85195 a9649dfbe552a4 Author: Jakub Kicinski Date: Tue Oct 21 17:36:49 2025 -0700 Merge branch 'mptcp-handle-late-add_addr-selftests-skip' Matthieu Baerts says: ==================== mptcp: handle late ADD_ADDR + selftests skip Here are a few independent fixes related to MPTCP and its selftests: - Patch 1: correctly handle ADD_ADDR being received after the switch to 'fully-established'. A fix for another recent fix backported up to v5.14. - Patches 2-5: properly mark some MPTCP Join subtests as 'skipped' if the tested kernel doesn't support the feature being validated. Some fixes for up to v5.13, v5.18, v6.11 and v6.18-rc1 respectively. ==================== Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-0-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit a9649dfbe552a42a3781fb681d93a2f510565954 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:30 2025 +0200 selftests: mptcp: join: mark laminar tests as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: c912f935a5c7 ("selftests: mptcp: join: validate new laminar endp") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-5-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:29 2025 +0200 selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit 973f80d715bd2504b4db6e049f292e694145cd79 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:28 2025 +0200 selftests: mptcp: join: mark implicit tests as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: 36c4127ae8dd ("selftests: mptcp: join: skip implicit tests if not supported") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-3-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit d68460bc31f9c8c6fc81fbb56ec952bec18409f1 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:27 2025 +0200 selftests: mptcp: join: mark 'flush re-add' as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-2-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:26 2025 +0200 mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR The special C-flag case expects the ADD_ADDR to be received when switching to 'fully-established'. But for various reasons, the ADD_ADDR could be sent after the "4th ACK", and the special case doesn't work. On NIPA, the new test validating this special case for the C-flag failed a few times, e.g. 102 default limits, server deny join id 0 syn rx [FAIL] got 0 JOIN[s] syn rx expected 2 Server ns stats (...) MPTcpExtAddAddrTx 1 MPTcpExtEchoAdd 1 Client ns stats (...) MPTcpExtAddAddr 1 MPTcpExtEchoAddTx 1 synack rx [FAIL] got 0 JOIN[s] synack rx expected 2 ack rx [FAIL] got 0 JOIN[s] ack rx expected 2 join Rx [FAIL] see above syn tx [FAIL] got 0 JOIN[s] syn tx expected 2 join Tx [FAIL] see above I had a suspicion about what the issue could be: the ADD_ADDR might have been received after the switch to the 'fully-established' state. The issue was not easy to reproduce. The packet capture shown that the ADD_ADDR can indeed be sent with a delay, and the client would not try to establish subflows to it as expected. A simple fix is not to mark the endpoints as 'used' in the C-flag case, when looking at creating subflows to the remote initial IP address and port. In this case, there is no need to try. Note: newly added fullmesh endpoints will still continue to be used as expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case. Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit 2a13fc417f493e28bdd368785320dd4c2b3d732e Author: Gao Xiang Date: Fri Oct 17 15:05:39 2025 +0800 erofs: consolidate z_erofs_extent_lookback() The initial m.delta[0] also needs to be checked against zero. In addition, also drop the redundant logic that errors out for lcn == 0 / m.delta[0] == 1 case. Signed-off-by: Gao Xiang commit e13d315ae077bb7c3c6027cc292401bc0f4ec683 Author: Gao Xiang Date: Fri Oct 17 15:05:38 2025 +0800 erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`. Fixes: 8d2517aaeea3 ("erofs: fix up compacted indexes for block size < 4096") Fixes: 1a5223c182fd ("erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/35167.1760645886@localhost Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 9aa12167ef1149d9980713b120ddcb31cf17222d Author: Thomas Weißschuh Date: Mon Oct 6 14:13:37 2025 +0200 csky: abiv2: adapt to new folio flags field Recent changes require the raw folio flags to be accessed via ".f". The merge commit introducing this change adapted most architecture code but forgot the csky abiv2. [rppt@kernel.org: add fix for arch/csky/abiv2/cacheflush.c] Link: https://lkml.kernel.org/r/aPCE238oxAB9QcZa@kernel.org Fixes: 53fbef56e07d ("mm: introduce memdesc_flags_t") Signed-off-by: Thomas Weißschuh Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Guo Ren Acked-by: Zi Yan Cc: Guo Ren Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 7eca961dd7188f20fdf8ce9ed5018280f79b2438 Author: SeongJae Park Date: Mon Oct 13 17:18:44 2025 -0700 mm/damon/core: use damos_commit_quota_goal() for new goal commit When damos_commit_quota_goals() is called for adding new DAMOS quota goals of DAMOS_QUOTA_USER_INPUT metric, current_value fields of the new goals should be also set as requested. However, damos_commit_quota_goals() is not updating the field for the case, since it is setting only metrics and target values using damos_new_quota_goal(), and metric-optional union fields using damos_commit_quota_goal_union(). As a result, users could see the first current_value parameter that committed online with a new quota goal is ignored. Users are assumed to commit the current_value for DAMOS_QUOTA_USER_INPUT quota goals, since it is being used as a feedback. Hence the real impact would be subtle. That said, this is obviously not intended behavior. Fix the issue by using damos_commit_quota_goal() which sets all quota goal parameters, instead of damos_commit_quota_goal_union(), which sets only the union fields. Link: https://lkml.kernel.org/r/20251014001846.279282-1-sj@kernel.org Fixes: 1aef9df0ee90 ("mm/damon/core: commit damos_quota_goal->nid") Signed-off-by: SeongJae Park Cc: [6.16+] Signed-off-by: Andrew Morton commit 7071537159be845a5c4ed5fb7d3db25aa4bd04a3 Author: Enze Li Date: Tue Oct 14 16:42:25 2025 +0800 mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme Currently, damon_destroy_scheme() only cleans up the filter list but leaves ops_filter untouched, which could lead to memory leaks when a scheme is destroyed. This patch ensures both filter and ops_filter are properly freed in damon_destroy_scheme(), preventing potential memory leaks. Link: https://lkml.kernel.org/r/20251014084225.313313-1-lienze@kylinos.cn Fixes: ab82e57981d0 ("mm/damon/core: introduce damos->ops_filters") Signed-off-by: Enze Li Reviewed-by: SeongJae Park Tested-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit cec944dd329fbefee907da95c298719d900d4787 Author: Deepanshu Kartikey Date: Tue Oct 14 17:03:44 2025 +0530 hugetlbfs: move lock assertions after early returns in huge_pmd_unshare() When hugetlb_vmdelete_list() processes VMAs during truncate operations, it may encounter VMAs where huge_pmd_unshare() is called without the required shareable lock. This triggers an assertion failure in hugetlb_vma_assert_locked(). The previous fix in commit dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") skipped entire VMAs without shareable locks to avoid the assertion. However, this prevented pages from being unmapped and freed, causing a regression in fallocate(PUNCH_HOLE) operations where pages were not freed immediately, as reported by Mark Brown. Instead of checking locks in the caller or skipping VMAs, move the lock assertions in huge_pmd_unshare() to after the early return checks. The assertions are only needed when actual PMD unsharing work will be performed. If the function returns early because sz != PMD_SIZE or the PMD is not shared, no locks are required and assertions should not fire. This approach reverts the VMA skipping logic from commit dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") while moving the assertions to avoid the assertion failure, keeping all the logic within huge_pmd_unshare() itself and allowing page unmapping and freeing to proceed for all VMAs. Link: https://lkml.kernel.org/r/20251014113344.21194-1-kartikey406@gmail.com Fixes: dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") Signed-off-by: Deepanshu Kartikey Reported-by: Reported-by: Mark Brown Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 Suggested-by: David Hildenbrand Suggested-by: Oscar Salvador Tested-by: Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 4ba5a8a7faa647ada8eae61a36517cf369f5bbe4 Author: David Hildenbrand Date: Tue Oct 14 14:44:55 2025 +0200 vmw_balloon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively deflated the old page, reducing the balloon size. In that case, the migration actually worked: similar to migrating+ immediately deflating the new page. The old page will be freed back to the buddy. Right now, the core will leave the page be marked as isolated (as we returned an error). When later trying to putback that page, we will run into the WARN_ON_ONCE() in balloon_page_putback(). That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()"); before that change, we would have tolerated that way of handling it. To fix it, let's just return 0 in that case, making the core effectively just clear the "isolated" flag + freeing it back to the buddy as if the migration succeeded. Note that the new page will also get freed when the core puts the last reference. Note that this also makes it all be more consistent: we will no longer unisolate the page in the balloon driver while keeping it marked as being isolated in migration core. This was found by code inspection. Link: https://lkml.kernel.org/r/20251014124455.478345-1-david@redhat.com Fixes: 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()") Signed-off-by: David Hildenbrand Cc: Jerrin Shaji George Cc: Broadcom internal kernel review list Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton commit c3fa5b1bfd8380d935fa961f2ac166bdf000f418 Author: SeongJae Park Date: Tue Oct 14 13:59:36 2025 -0700 mm/damon/core: fix list_add_tail() call on damon_call() Each damon_ctx maintains callback requests using a linked list (damon_ctx->call_controls). When a new callback request is received via damon_call(), the new request should be added to the list. However, the function is making a mistake at list_add_tail() invocation: putting the new item to add and the list head to add it before, in the opposite order. Because of the linked list manipulation implementation, the new request can still be reached from the context's list head. But the list items that were added before the new request are dropped from the list. As a result, the callbacks are unexpectedly not invocated. Worse yet, if the dropped callback requests were dynamically allocated, the memory is leaked. Actually DAMON sysfs interface is using a dynamically allocated repeat-mode callback request for automatic essential stats update. And because the online DAMON parameters commit is using a non-repeat-mode callback request, the issue can easily be reproduced, like below. # damo start --damos_action stat --refresh_stat 1s # damo tune --damos_action stat --refresh_stat 1s The first command dynamically allocates the repeat-mode callback request for automatic essential stat update. Users can see the essential stats are automatically updated for every second, using the sysfs interface. The second command calls damon_commit() with a new callback request that was made for the commit. As a result, the previously added repeat-mode callback request is dropped from the list. The automatic stats refresh stops working, and the memory for the repeat-mode callback request is leaked. It can be confirmed using kmemleak. Fix the mistake on the list_add_tail() call. Link: https://lkml.kernel.org/r/20251014205939.1206-1-sj@kernel.org Fixes: 004ded6bee11 ("mm/damon: accept parallel damon_call() requests") Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit 0e59f47c15cec4cd88c51c5cda749607b719c82b Author: Lorenzo Stoakes Date: Mon Oct 13 17:58:36 2025 +0100 mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap Commit b714ccb02a76 ("mm/mremap: complete refactor of move_vma()") mistakenly introduced a new behaviour - clearing the VM_ACCOUNT flag of the old mapping when a mapping is mremap()'d with the MREMAP_DONTUNMAP flag set. While we always clear the VM_LOCKED and VM_LOCKONFAULT flags for the old mapping (the page tables have been moved, so there is no data that could possibly be locked in memory), there is no reason to touch any other VMA flags. This is because after the move the old mapping is in a state as if it were freshly mapped. This implies that the attributes of the mapping ought to remain the same, including whether or not the mapping is accounted. Link: https://lkml.kernel.org/r/20251013165836.273113-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Fixes: b714ccb02a76 ("mm/mremap: complete refactor of move_vma()") Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 552c50713f273b494ac6c77052032a49bc9255e2 Merge: 6548d364a3e850 b2c37c1168f537 Author: Linus Torvalds Date: Tue Oct 21 12:33:29 2025 -1000 Merge tag 'vfio-v6.18-rc3' of https://github.com/awilliam/linux-vfio Pull VFIO fixlet from Alex Williamson: "A tiny update as I'm changing jobs. Different email, same signing key for now. - Update VFIO maintainers entry (Alex Williamson)" * tag 'vfio-v6.18-rc3' of https://github.com/awilliam/linux-vfio: MAINTAINERS: Update Alex Williamson's email address commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c Author: Noorain Eqbal Date: Mon Oct 20 23:33:01 2025 +0530 bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2 Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Signed-off-by: Noorain Eqbal Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com Signed-off-by: Alexei Starovoitov commit 1dba74abf3e2fa4484b924d8ba6e54e64ebb8c82 Author: Jernej Skrabec Date: Mon Oct 20 17:27:04 2025 +0200 clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical bus-r-cpucfg clock is important for peripheral which takes care of powering CPU cores on and off. Since this operation is done by firmware (TF-A), mark it as critical. That way Linux won't interfere with that clock. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Signed-off-by: Jernej Skrabec Reviewed-by: Andre Przywara Tested-by: Andre Przywara Link: https://patch.msgid.link/20251020152704.4804-1-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 3e7f011c255582d7c914133785bbba1990441713 Author: Chuck Lever Date: Thu Oct 2 10:00:51 2025 -0400 Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now. Reported-by: tianshuo han Reviewed-by: Jeff Layton Cc: stable@vger.kernel.org Tested-by: Tianshuo Han Signed-off-by: Chuck Lever commit 29cdfb4950702bb849f70f7e3b58b4eeb5c1441c Author: Nathan Chancellor Date: Tue Sep 30 11:31:34 2025 -0700 nfsd: Avoid strlen conflict in nfsd4_encode_components_esc() There is an error building nfs4xdr.c with CONFIG_SUNRPC_DEBUG_TRACE=y and CONFIG_FORTIFY_SOURCE=n due to the local variable strlen conflicting with the function strlen(): In file included from include/linux/cpumask.h:11, from arch/x86/include/asm/paravirt.h:21, from arch/x86/include/asm/irqflags.h:102, from include/linux/irqflags.h:18, from include/linux/spinlock.h:59, from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/slab.h:16, from fs/nfsd/nfs4xdr.c:37: fs/nfsd/nfs4xdr.c: In function 'nfsd4_encode_components_esc': include/linux/kernel.h:321:46: error: called object 'strlen' is not a function or function pointer 321 | __trace_puts(_THIS_IP_, str, strlen(str)); \ | ^~~~~~ include/linux/kernel.h:265:17: note: in expansion of macro 'trace_puts' 265 | trace_puts(fmt); \ | ^~~~~~~~~~ include/linux/sunrpc/debug.h:34:41: note: in expansion of macro 'trace_printk' 34 | # define __sunrpc_printk(fmt, ...) trace_printk(fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~ include/linux/sunrpc/debug.h:42:17: note: in expansion of macro '__sunrpc_printk' 42 | __sunrpc_printk(fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~~~~~ include/linux/sunrpc/debug.h:25:9: note: in expansion of macro 'dfprintk' 25 | dfprintk(FACILITY, fmt, ##__VA_ARGS__) | ^~~~~~~~ fs/nfsd/nfs4xdr.c:2646:9: note: in expansion of macro 'dprintk' 2646 | dprintk("nfsd4_encode_components(%s)\n", components); | ^~~~~~~ fs/nfsd/nfs4xdr.c:2643:13: note: declared here 2643 | int strlen, count=0; | ^~~~~~ This dprintk() instance is not particularly useful, so just remove it altogether to get rid of the immediate strlen() conflict. At the same time, eliminate the local strlen variable to avoid potential conflicts with strlen() in the future. Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer") Signed-off-by: Nathan Chancellor Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit abb1f08a2121dd270193746e43b2a9373db9ad84 Author: Chuck Lever Date: Tue Sep 30 10:05:20 2025 -0400 NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4f76435fd517981f01608678c06ad9718a86ee98 Author: Chuck Lever Date: Mon Sep 29 12:53:40 2025 -0400 NFSD: Define actions for the new time_deleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_GETATTR and SETATTR. But NFSD has to do something besides crashing if it ever sees a GETATTR request that queries these attributes. RFC 8881 Section 18.7.3 states: > The server MUST return a value for each attribute that the client > requests if the attribute is supported by the server for the > target file system. If the server does not support a particular > attribute on the target file system, then it MUST NOT return the > attribute value and MUST NOT set the attribute bit in the result > bitmap. The server MUST return an error if it supports an > attribute on the target but cannot obtain its value. In that case, > no attribute values will be returned. Further, RFC 9754 Section 5 states: > These new attributes are invalid to be used with GETATTR, VERIFY, > and NVERIFY, and they can only be used with CB_GETATTR and SETATTR > by a client holding an appropriate delegation. Thus there does not appear to be a specific server response mandated by specification. Taking the guidance that querying these attributes via GETATTR is "invalid", NFSD will return nfserr_inval, failing the request entirely. Reported-by: Robert Morris Closes: https://lore.kernel.org/linux-nfs/7819419cf0cb50d8130dc6b747765d2b8febc88a.camel@kernel.org/T/#t Fixes: 51c0d4f7e317 ("nfsd: add support for FATTR4_OPEN_ARGUMENTS") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc Author: Shuai Xue Date: Sat Sep 13 10:32:24 2025 +0800 acpi,srat: Fix incorrect device handle check for Generic Initiator The Generic Initiator Affinity Structure in SRAT table uses device handle type field to indicate the device type. According to ACPI specification, the device handle type value of 1 represents PCI device, not 0. Fixes: 894c26a1c274 ("ACPI: Support Generic Initiator only domains") Reported-by: Wu Zongyong Signed-off-by: Shuai Xue Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250913023224.39281-1-xueshuai@linux.alibaba.com Signed-off-by: Dave Jiang commit 143937ca51cc6ae2fccc61a1cb916abb24cd34f5 Author: Huang Ying Date: Wed Oct 15 10:37:12 2025 +0800 arm64, mm: avoid always making PTE dirty in pte_mkwrite() Current pte_mkwrite_novma() makes PTE dirty unconditionally. This may mark some pages that are never written dirty wrongly. For example, do_swap_page() may map the exclusive pages with writable and clean PTEs if the VMA is writable and the page fault is for read access. However, current pte_mkwrite_novma() implementation always dirties the PTE. This may cause unnecessary disk writing if the pages are never written before being reclaimed. So, change pte_mkwrite_novma() to clear the PTE_RDONLY bit only if the PTE_DIRTY bit is set to make it possible to make the PTE writable and clean. The current behavior was introduced in commit 73e86cb03cf2 ("arm64: Move PTE_RDONLY bit handling out of set_pte_at()"). Before that, pte_mkwrite() only sets the PTE_WRITE bit, while set_pte_at() only clears the PTE_RDONLY bit if both the PTE_WRITE and the PTE_DIRTY bits are set. To test the performance impact of the patch, on an arm64 server machine, run 16 redis-server processes on socket 1 and 16 memtier_benchmark processes on socket 0 with mostly get transactions (that is, redis-server will mostly read memory only). The memory footprint of redis-server is larger than the available memory, so swap out/in will be triggered. Test results show that the patch can avoid most swapping out because the pages are mostly clean. And the benchmark throughput improves ~23.9% in the test. Fixes: 73e86cb03cf2 ("arm64: Move PTE_RDONLY bit handling out of set_pte_at()") Signed-off-by: Huang Ying Cc: Will Deacon Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Gavin Shan Cc: Ard Biesheuvel Cc: Matthew Wilcox (Oracle) Cc: Yicong Yang Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 6e3a4754717a74e931a9f00b5f953be708e07acb Author: Xi Ruoyao Date: Tue Oct 21 17:28:25 2025 +0800 ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 When ACPI_MISALIGNMENT_NOT_SUPPORTED is set, GCC can produce a bogus -Wstringop-overread warning, see [1]. To me, it's very clear that we have a compiler bug here, thus just disable the warning. Fixes: a9d13433fe17 ("LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled") Link: https://lore.kernel.org/all/899f2dec-e8b9-44f4-ab8d-001e160a2aed@roeck-us.net/ Link: https://github.com/acpica/acpica/commit/abf5b573 Link: https://gcc.gnu.org/PR122073 [1] Co-developed-by: Saket Dumbre Signed-off-by: Saket Dumbre Signed-off-by: Xi Ruoyao Acked-by: Huacai Chen Cc: All applicable [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251021092825.822007-1-xry111@xry111.site Signed-off-by: Rafael J. Wysocki commit 90c82941adf1986364e0f82c35cf59f2bf5f6a1d Author: André Draszik Date: Thu Oct 16 16:58:37 2025 +0100 pmdomain: samsung: plug potential memleak during probe of_genpd_add_provider_simple() could fail, in which case this code leaks the domain name, pd->pd.name. Use devm_kstrdup_const() to plug this leak. As a side-effect, we can simplify existing error handling. Fixes: c09a3e6c97f0 ("soc: samsung: pm_domains: Convert to regular platform driver") Cc: stable@vger.kernel.org Reviewed-by: Peter Griffin Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Tested-by: Marek Szyprowski Signed-off-by: Ulf Hansson commit 72a1eb3cf573ab957ae412f0efb0cf6ff0876234 Author: Aurabindo Pillai Date: Thu Sep 25 10:23:59 2025 -0400 drm/amd/display: use GFP_NOWAIT for allocation in interrupt handler schedule_dc_vmin_vmax() is called by dm_crtc_high_irq(). Hence, we cannot have the former sleep. Use GFP_NOWAIT for allocation in this function. Fixes: c210b757b400 ("drm/amd/display: fix dmub access race condition") Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Sun peng (Leo) Li Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit c04812cbe2f247a1c1e53a9b6c5e659963fe4065) Cc: stable@vger.kernel.org commit bec947cbe9a65783adb475a5fb47980d7b4f4796 Author: Charlene Liu Date: Mon Sep 29 20:29:30 2025 -0400 drm/amd/display: increase max link count and fix link->enc NULL pointer access [why] 1.) dc->links[MAX_LINKS] array size smaller than actual requested. max_connector + max_dpia + 4 virtual = 14. increase from 12 to 14. 2.) hw_init() access null LINK_ENC for dpia non display_endpoint. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Meenakshikumar Somasundaram Reviewed-by: Chris Park Signed-off-by: Charlene Liu Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45) Cc: stable@vger.kernel.org commit 89939cf252d80237ed380c1d20575ecfe56ff894 Author: Meenakshikumar Somasundaram Date: Mon Sep 29 14:28:34 2025 -0400 drm/amd/display: Fix NULL pointer dereference [Why] On a mst branch with multi display setup, dc context is obselete after updating the first stream. Referencing the same dc context for the next stream update to fetch dc pointer leads to NULL pointer dereference. [How] Get the dc pointer from the link rather than context. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Charlene Liu Signed-off-by: Meenakshikumar Somasundaram Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit dc69b48988b171d6ccb3a083607e4dff015e2c0d) Cc: stable@vger.kernel.org commit 6ed8bfd24ce1cb31742b09a3eb557cd008533eec Author: Hao Ge Date: Tue Oct 21 09:03:53 2025 +0800 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two competing threads enter alloc_slab_obj_exts() and one of them fails to allocate the object extension vector, it might override the valid slab->obj_exts allocated by the other thread with OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and expects a valid pointer to dereference a NULL pointer later on. Update slab->obj_exts atomically using cmpxchg() to avoid slab->obj_exts overrides by racing threads. Thanks for Vlastimil and Suren's help with debugging. Fixes: f7381b911640 ("slab: mark slab->obj_exts allocation failures unconditionally") Cc: Suggested-by: Suren Baghdasaryan Signed-off-by: Hao Ge Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Link: https://patch.msgid.link/20251021010353.1187193-1-hao.ge@linux.dev Signed-off-by: Vlastimil Babka commit 2c2b67af5f5f77fc68261a137ad65dcfb8e52506 Author: Hongbo Li Date: Sat Oct 11 09:22:35 2025 +0000 hostfs: Fix only passing host root in boot stage with new mount In the old mount proceedure, hostfs could only pass root directory during boot. This is because it constructed the root directory using the @root_ino event without any mount options. However, when using it with the new mount API, this step is no longer triggered. As a result, if users mounts without specifying any mount options, the @host_root_path remains uninitialized. To prevent this issue, the @host_root_path should be initialized at the time of allocation. Reported-by: Geoffrey Thorpe Closes: https://lore.kernel.org/all/643333a0-f434-42fb-82ac-d25a0b56f3b7@geoffthorpe.net/ Fixes: cd140ce9f611 ("hostfs: convert hostfs to use the new mount API") Signed-off-by: Hongbo Li Link: https://patch.msgid.link/20251011092235.29880-1-lihongbo22@huawei.com Signed-off-by: Christian Brauner commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b Author: Zhen Ni Date: Mon Oct 13 19:41:51 2025 +0800 fs: Fix uninitialized 'offp' in statmount_string() In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the struct fields instead of using offp. This leaves offp uninitialized, leading to a possible uninitialized dereference when *offp is updated. Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code path consistent. Fixes: 37c4a9590e1e ("statmount: allow to retrieve idmappings") Fixes: e52e97f09fb6 ("statmount: let unset strings be empty") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://patch.msgid.link/20251013114151.664341-1-zhen.ni@easystack.cn Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 6b03360fe9f4e6fd43419487d659c9bd26215953 Merge: fdbb53d318aa94 248adfe32bfd75 Author: Mark Brown Date: Tue Oct 21 12:37:34 2025 +0100 Add support for Cirrus Logic CS530x DAC and CODEC Merge series from Vitaly Rodionov : This patch series introduces DAC, CODEC, and SPI control bus support for Cirrus Logic CS530x variants, along with general code cleanup and resolution of checkpatch.pl warnings. Changes since v1,v2,v3: - Signed off all patches - Splitted "tidy up" pach in 3 separate simple patches - Fixed commit subject to much preferred subject prefix for binding patches. - Moved dt-bindings related patch down the chain - Added all relevant maintainers to CC list Simon Trimmer (4): ASoC: cs530x: Correct log message with expected variable ASoC: cs530x: Add CODEC and DAC support ASoC: cs530x: Check the DEVID matches the devtype ASoC: cs530x: Rename i2c related structures Vitaly Rodionov (7): ASoC: cs530x: Update the copyright headers ASoC: cs530x: Sort #include directives and tidy up whitespaces ASoC: cs530x: Remove unused struct members and constants ASoC: cs530x: Correct constant naming ASoC: dt-bindings: sound: cirrus: cs530x: Add cs530x variants ASoC: cs530x: Correct MCLK reference frequency values ASoC: cs530x: Add SPI bus support for cs530x parts .../bindings/sound/cirrus,cs530x.yaml | 4 + sound/soc/codecs/Kconfig | 10 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/cs530x-i2c.c | 24 +- sound/soc/codecs/cs530x-spi.c | 92 ++++ sound/soc/codecs/cs530x.c | 516 +++++++++++++++--- sound/soc/codecs/cs530x.h | 120 ++-- 7 files changed, 634 insertions(+), 134 deletions(-) create mode 100644 sound/soc/codecs/cs530x-spi.c -- 2.43.0 commit a7b17ece4032dd86bb411297f2169dda395cdc3c Author: Johan Hovold Date: Fri Oct 10 15:38:56 2025 +0200 mmc: wmt-sdmmc: fix compile test default Enabling compile testing should not enable every individual driver (we have "allyesconfig" for that). Fixes: 7cd8db0fb0b2 ("mmc: add COMPILE_TEST to multiple drivers") Cc: Mikko Rapeli Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit 204ced4108f5d38f6804968fd9543cc69c3f8da6 Author: David Kaplan Date: Fri Oct 3 12:19:36 2025 -0500 x86/bugs: Qualify RETBLEED_INTEL_MSG When retbleed mitigation is disabled, the kernel already prints an info message that the system is vulnerable. Recent code restructuring also inadvertently led to RETBLEED_INTEL_MSG being printed as an error, which is unnecessary as retbleed mitigation was already explicitly disabled (by config option, cmdline, etc.). Qualify this print statement so the warning is not printed unless an actual retbleed mitigation was selected and is being disabled due to incompatibility with spectre_v2. Fixes: e3b78a7ad5ea ("x86/bugs: Restructure retbleed mitigation") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220624 Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251003171936.155391-1-david.kaplan@amd.com commit 49d34f3dd8519581030547eb7543a62f9ab5fa08 Author: Aksh Garg Date: Thu Oct 16 17:27:55 2025 +0530 net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions Resolve race conditions in timestamp events list handling between TX and RX paths causing missed timestamps. The current implementation uses a single events list for both TX and RX timestamps. The am65_cpts_find_ts() function acquires the lock, splices all events (TX as well as RX events) to a temporary list, and releases the lock. This function performs matching of timestamps for TX packets only. Before it acquires the lock again to put the non-TX events back to the main events list, a concurrent RX processing thread could acquire the lock (as observed in practice), find an empty events list, and fail to attach timestamp to it, even though a relevant event exists in the spliced list which is yet to be restored to the main list. Fix this by creating separate events lists to handle TX and RX timestamps independently. Fixes: c459f606f66df ("net: ethernet: ti: am65-cpts: Enable RX HW timestamp for PTP packets using CPTS FIFO") Signed-off-by: Aksh Garg Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251016115755.1123646-1-a-garg7@ti.com Signed-off-by: Paolo Abeni commit 876f0d43af78639790bee0e57b39d498ae35adcf Author: Andrew Cooper Date: Mon Oct 20 15:41:24 2025 +0100 x86/microcode: Fix Entrysign revision check for Zen1/Naples ... to match AMD's statement here: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Signed-off-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://patch.msgid.link/20251020144124.2930784-1-andrew.cooper3@citrix.com commit d37623132a6347b4ab9e2179eb3f2fa77863c364 Author: William Breathitt Gray Date: Mon Oct 20 17:51:45 2025 +0900 gpio: pci-idio-16: Define maximum valid register address offset Attempting to load the pci-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure. Fixes: 73d8f3efc5c2 ("gpio: pci-idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Mark Cave-Ayland Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-2-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit c4d35e635f3a65aec291a6045cae8c99cede5bba Author: William Breathitt Gray Date: Mon Oct 20 17:51:44 2025 +0900 gpio: 104-idio-16: Define maximum valid register address offset Attempting to load the 104-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure. Fixes: 2c210c9a34a3 ("gpio: 104-idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Mark Cave-Ayland Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-1-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit 0f41997b1b2b769b73415512d2afaae80630e4fe Author: Christoph Hellwig Date: Fri Oct 3 12:12:48 2025 +0200 xfs: don't use __GFP_NOFAIL in xfs_init_fs_context With enough debug options enabled, struct xfs_mount is larger than 4k and thus NOFAIL allocations won't work for it. xfs_init_fs_context is early in the mount process, and if we really are out of memory there we'd better give up ASAP anyway. Fixes: 7b77b46a6137 ("xfs: use kmem functions for struct xfs_mount") Reported-by: syzbot+359a67b608de1ef72f65@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ca3d643a970139f5456f90dd555a0955752d70cb Author: Christoph Hellwig Date: Fri Oct 17 05:55:41 2025 +0200 xfs: cache open zone in inode->i_private The MRU cache for open zones is unfortunately still not ideal, as it can time out pretty easily when doing heavy I/O to hard disks using up most or all open zones. One option would be to just increase the timeout, but while looking into that I realized we're just better off caching it indefinitely as there is no real downside to that once we don't hold a reference to the cache open zone. So switch the open zone to RCU freeing, and then stash the last used open zone into inode->i_private. This helps to significantly reduce fragmentation by keeping I/O localized to zones for workloads that write using many open files to HDD. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit a8c861f401b4b2f8feda282abff929fa91c1f73a Author: Christoph Hellwig Date: Wed Oct 15 15:29:30 2025 +0900 xfs: avoid busy loops in GCD When GCD has no new work to handle, but read, write or reset commands are outstanding, it currently busy loops, which is a bit suboptimal, and can lead to softlockup warnings in case of stuck commands. Change the code so that the task state is only set to running when work is performed, which looks a bit tricky due to the design of the reading/writing/resetting lists that contain both in-flight and finished commands. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 23437509a69476d4f896891032d62ac868731668 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:53 2025 +0200 drm/panic: Fix 24bit pixel crossing page boundaries When using page list framebuffer, and using RGB888 format, some pixels can cross the page boundaries, and this case was not handled, leading to writing 1 or 2 bytes on the next virtual address. Add a check and a specific function to handle this case. Fixes: c9ff2808790f0 ("drm/panic: Add support to scanout buffer as array of pages") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-7-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 2e337dd278c6c38982b520c309f36e0f88696e6e Author: Jocelyn Falempe Date: Thu Oct 9 14:24:52 2025 +0200 drm/panic: Fix divide by 0 if the screen width < font width In the unlikely case that the screen is tiny, and smaller than the font width, it leads to a divide by 0: draw_line_with_wrap() chars_per_row = sb->width / font->width = 0 line_wrap.len = line->len % chars_per_row; This will trigger a divide by 0 Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-6-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit e9b36fe0630046e61224216dc92513a69f72b5f0 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:51 2025 +0200 drm/panic: Fix kmsg text drawing rectangle The rectangle height was larger than the screen size. This has no real impact. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-5-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 4fcffb5e5c8c0c8e2ad9c99a22305a0afbecc294 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:50 2025 +0200 drm/panic: Fix qr_code, ensure vmargin is positive Depending on qr_code size and screen size, the vertical margin can be negative, that means there is not enough room to draw the qr_code. So abort early, to avoid a segfault by trying to draw at negative coordinates. Fixes: cb5164ac43d0f ("drm/panic: Add a QR code panic screen") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-4-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit cfa56e0a0e9b259077b0cb88b431e37dc9a67dee Author: Jocelyn Falempe Date: Thu Oct 9 14:24:49 2025 +0200 drm/panic: Fix overlap between qr code and logo The borders of the qr code was not taken into account to check if it overlap with the logo, leading to the logo being partially covered. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-3-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 179753aa5b7890b311968c033d08f558f0a7be21 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:48 2025 +0200 drm/panic: Fix drawing the logo on a small narrow screen If the logo width is bigger than the framebuffer width, and the height is big enough to hold the logo and the message, it will draw at x coordinate that are higher than the width, and ends up in a corrupted image. Fixes: 4b570ac2eb54 ("drm/rect: Add drm_rect_overlap()") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-2-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit f2bc8231fd43a02f9d97252b3435869727054d60 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:17 2025 +0200 xfrm: check all hash buckets for leftover states during netns deletion The current hlist_empty checks only test the first bucket of each hashtable, ignoring any other bucket. They should be caught by the WARN_ON for state_all, but better to make all the checks accurate. Fixes: 73d189dce486 ("netns xfrm: per-netns xfrm_state_bydst hash") Fixes: d320bbb306f2 ("netns xfrm: per-netns xfrm_state_bysrc hash") Fixes: b754a4fd8f58 ("netns xfrm: per-netns xfrm_state_byspi hash") Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 1dcf617bec5cb85f68ca19969e7537ef6f6931d3 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:16 2025 +0200 xfrm: set err and extack on failure to create pcpu SA xfrm_state_construct can fail without setting an error if the requested pcpu_num value is too big. Set err and add an extack message to avoid confusing userspace. Fixes: 1ddf9916ac09 ("xfrm: Add support for per cpu xfrm state handling.") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 7f02285764790e0ff1a731b4187fa3e389ed02c7 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:15 2025 +0200 xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state In case xfrm_state_migrate fails after calling xfrm_dev_state_add, we directly release the last reference and destroy the new state, without calling xfrm_dev_state_delete (this only happens in __xfrm_state_delete, which we're not calling on this path, since the state was never added). Call xfrm_dev_state_delete on error when an offload configuration was provided. Fixes: ab244a394c7f ("xfrm: Migrate offload configuration") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 5502bc4746e86bfe91ecbe0ed1ad53cb17673920 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:14 2025 +0200 xfrm: make state as DEAD before final put when migrate fails xfrm_state_migrate/xfrm_state_clone_and_setup create a new state, and call xfrm_state_put to destroy it in case of failure. __xfrm_state_destroy expects the state to be in XFRM_STATE_DEAD, but we currently don't do that. Reported-by: syzbot+5cd6299ede4d4f70987b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5cd6299ede4d4f70987b Fixes: 78347c8c6b2d ("xfrm: Fix xfrm_state_migrate leak") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:13 2025 +0200 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work). Reported-by: syzbot+999eb23467f83f9bf9bf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=999eb23467f83f9bf9bf Fixes: b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 8d2a2a49c30f67a480fa9ed25e08436a446f057e Author: Sabrina Dubroca Date: Thu Oct 16 12:39:12 2025 +0200 xfrm: drop SA reference in xfrm_state_update if dir doesn't match We're not updating x1, but we still need to put() it. Fixes: a4a87fa4e96c ("xfrm: Add Direction to the SA in or out") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit f5caeb3689ea2d8a8c0790d9eea68b63e8f15496 Author: Geert Uytterhoeven Date: Mon Oct 13 10:48:46 2025 +0200 xfs: XFS_ONLINE_SCRUB_STATS should depend on DEBUG_FS Currently, XFS_ONLINE_SCRUB_STATS selects DEBUG_FS. However, DEBUG_FS is meant for debugging, and people may want to disable it on production systems. Since commit 0ff51a1fd786f47b ("xfs: enable online fsck by default in Kconfig")), XFS_ONLINE_SCRUB_STATS is enabled by default, forcing DEBUG_FS enabled too. Fix this by replacing the selection of DEBUG_FS by a dependency on DEBUG_FS, which is what most other options controlling the gathering and exposing of statistics do. Signed-off-by: Geert Uytterhoeven Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b00bcb190eef35ae4da3c424b8a72f287e69f650 Author: Damien Le Moal Date: Tue Oct 14 13:19:45 2025 +0900 xfs: do not tightly pack-write large files When using a zoned realtime device, tightly packing of data blocks belonging to multiple closed files into the same realtime group (RTG) is very efficient at improving write performance. This is especially true with SMR HDDs as this can reduce, and even suppress, disk head seeks. However, such tight packing does not make sense for large files that require at least a full RTG. If tight packing placement is applied for such files, the VM writeback thread switching between inodes result in the large files to be fragmented, thus increasing the garbage collection penalty later when the RTG needs to be reclaimed. This problem can be avoided with a simple heuristic: if the size of the inode being written back is at least equal to the RTG size, do not use tight-packing. Modify xfs_zoned_pack_tight() to always return false in this case. With this change, a multi-writer workload writing files of 256 MB on a file system backed by an SMR HDD with 256 MB zone size as a realtime device sees all files occupying exactly one RTG (i.e. one device zone), thus completely removing the heavy fragmentation observed without this change. Signed-off-by: Damien Le Moal Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 914f377075d646b4695a7868ba090f4c714dfd4b Author: Damien Le Moal Date: Mon Oct 13 12:08:29 2025 +0900 xfs: Improve CONFIG_XFS_RT Kconfig help Improve the description of the XFS_RT configuration option to document that this option is required for zoned block devices. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 26f0f122f92f2e8c384c08a05956417bfb5f6fbe Author: Heiko Stuebner Date: Mon Oct 20 11:11:39 2025 +0200 arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso The regulator-cam-dovdd-1v8 uses spaces for indentation, where it should use tabs. Fix this. Fixes: 066a69db9db3 ("arm64: dts: rockchip: add overlay for RK3399 Puma Haikou Video Demo adapter") Signed-off-by: Heiko Stuebner Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/20251020091139.3652738-1-heiko@sntech.de Signed-off-by: Heiko Stuebner commit f584239a9ed25057496bf397c370cc5163dde419 Author: Wang Liang Date: Fri Oct 17 10:48:27 2025 +0800 net/smc: fix general protection fault in __smc_diag_dump The syzbot report a crash: Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f] CPU: 1 UID: 0 PID: 6949 Comm: syz.0.335 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89 Call Trace: smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217 smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234 netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442 netlink_dump_start include/linux/netlink.h:341 [inline] smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251 __sock_diag_cmd net/core/sock_diag.c:249 [inline] sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668 __sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The process like this: (CPU1) | (CPU2) ---------------------------------|------------------------------- inet_create() | // init clcsock to NULL | sk = sk_alloc() | | // unexpectedly change clcsock | inet_init_csk_locks() | | // add sk to hash table | smc_inet_init_sock() | smc_sk_init() | smc_hash_sk() | | // traverse the hash table | smc_diag_dump_proto | __smc_diag_dump() | // visit wrong clcsock | smc_diag_msg_common_fill() // alloc clcsock | smc_create_clcsk | sock_create_kern | With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc, just remove it. After removing the INET_PROTOSW_ICSK flag, this patch alse revert commit 6fd27ea183c2 ("net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC") to avoid casting smc_sock to inet_connection_sock. Reported-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f775be4458668f7d220e Tested-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") Signed-off-by: Wang Liang Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: D. Wythe Link: https://patch.msgid.link/20251017024827.3137512-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit bbca8678466032fa32453cebfb9194c8d15c3f1a Merge: a73ca0449bcb7c 87bcef158ac1fa Author: Jakub Kicinski Date: Mon Oct 20 17:39:15 2025 -0700 Merge branch 'fix-generating-skb-from-non-linear-xdp_buff-for-mlx5' Tariq Toukan says: ==================== Fix generating skb from non-linear xdp_buff for mlx5 Link: https://lore.kernel.org/20250915225857.3024997-1-ameryhung@gmail.com ==================== Link: https://patch.msgid.link/1760644540-899148-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 87bcef158ac1faca1bd7e0104588e8e2956d10be Author: Amery Hung Date: Thu Oct 16 22:55:40 2025 +0300 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run. Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it. To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff. Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes. Fixes: f52ac7028bec ("net/mlx5e: RX, Add XDP multi-buffer support in Striding RQ") Signed-off-by: Amery Hung Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1760644540-899148-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit afd5ba577c10639f62e8120df67dc70ea4b61176 Author: Amery Hung Date: Thu Oct 16 22:55:39 2025 +0300 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ XDP programs can release xdp_buff fragments when calling bpf_xdp_adjust_tail(). The driver currently assumes the number of fragments to be unchanged and may generate skb with wrong truesize or containing invalid frags. Fix the bug by generating skb according to xdp_buff after the XDP program runs. Fixes: ea5d49bdae8b ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ") Reviewed-by: Dragos Tatulea Signed-off-by: Amery Hung Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1760644540-899148-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ce831bffcef3d8f9691b5537d74ffa1b1256c017 Author: Thomas Hellström Date: Wed Oct 15 19:07:26 2025 +0200 drm/xe/uapi: Hide the madvise autoreset behind a VM_BIND flag The madvise implementation currently resets the SVM madvise if the underlying CPU map is unmapped. This is in an attempt to mimic the CPU madvise behaviour. However, it's not clear that this is a desired behaviour since if the end app user relies on it for malloc()ed objects or stack objects, it may not work as intended. Instead of having the autoreset functionality being a direct application-facing implicit UAPI, make the UMD explicitly choose this behaviour if it wants to expose it by introducing DRM_XE_VM_BIND_FLAG_MADVISE_AUTORESET, and add a semantics description. v2: - Kerneldoc fixes. Fix a commit log message. Fixes: a2eb8aec3ebe ("drm/xe: Reset VMA attributes to default in SVM garbage collector") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: "Falkowski, John" Cc: "Mrozek, Michal" Signed-off-by: Thomas Hellström Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251015170726.178685-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 59a2d3f38ab23cce4cd9f0c4a5e08fdfe9e67ae7) Signed-off-by: Lucas De Marchi commit 9a3c0d6834194b6e3cce4ffbb55f800c6cb58c86 Author: Thomas Hellström Date: Wed Oct 15 19:07:25 2025 +0200 drm/xe: Retain vma flags when recreating and splitting vmas for madvise When splitting and restoring vmas for madvise, we only copied the XE_VMA_SYSTEM_ALLOCATOR flag. That meant we lost flags for read_only, dumpable and sparse (in case anyone would call madvise for the latter). Instead, define a mask of relevant flags and ensure all are replicated, To simplify this and make the code a bit less fragile, remove the conversion to VMA_CREATE flags and instead just pass around the gpuva flags after initial conversion from user-space. Fixes: a2eb8aec3ebe ("drm/xe: Reset VMA attributes to default in SVM garbage collector") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20251015170726.178685-1-thomas.hellstrom@linux.intel.com (cherry picked from commit b3af8658ec70f2196190c66103478352286aba3b) Signed-off-by: Lucas De Marchi commit a73ca0449bcb7c238097cc6a1bf3fd82a78374df Author: Xin Long Date: Fri Oct 17 16:06:14 2025 -0400 selftests: net: fix server bind failure in sctp_vrf.sh sctp_vrf.sh could fail: TEST 12: bind vrf-2 & 1 in server, connect from client 1 & 2, N [FAIL] not ok 1 selftests: net: sctp_vrf.sh # exit=3 The failure happens when the server bind in a new run conflicts with an existing association from the previous run: [1] ip netns exec $SERVER_NS ./sctp_hello server ... [2] ip netns exec $CLIENT_NS ./sctp_hello client ... [3] ip netns exec $SERVER_NS pkill sctp_hello ... [4] ip netns exec $SERVER_NS ./sctp_hello server ... It occurs if the client in [2] sends a message and closes immediately. With the message unacked, no SHUTDOWN is sent. Killing the server in [3] triggers a SHUTDOWN the client also ignores due to the unacked message, leaving the old association alive. This causes the bind at [4] to fail until the message is acked and the client responds to a second SHUTDOWN after the server’s T2 timer expires (3s). This patch fixes the issue by preventing the client from sending data. Instead, the client blocks on recv() and waits for the server to close. It also waits until both the server and the client sockets are fully released in stop_server and wait_client before restarting. Additionally, replace 2>&1 >/dev/null with -q in sysctl and grep, and drop other redundant 2>&1 >/dev/null redirections, and fix a typo from N to Y (connect successfully) in the description of the last test. Fixes: a61bd7b9fef3 ("selftests: add a selftest for sctp vrf") Reported-by: Hangbin Liu Tested-by: Jakub Kicinski Signed-off-by: Xin Long Link: https://patch.msgid.link/be2dacf52d0917c4ba5e2e8c5a9cb640740ad2b6.1760731574.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit b09ed52db1e688eb8205b1939ca1345179ecd515 Author: Nicolin Chen Date: Tue Oct 14 14:48:46 2025 -0700 iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents() The ioctl returns 0 upon success, so !0 returning -1 breaks the selftest. Drop the '!' to fix it. Fixes: 1d235d849425 ("iommu/selftest: prevent use of uninitialized variable") Link: https://patch.msgid.link/r/20251014214847.1113759-1-nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit cb30dfa75d55eced379a42fd67bd5fb7ec38555e Author: Jason Gunthorpe Date: Wed Oct 8 15:17:18 2025 -0300 iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows. Link: https://patch.msgid.link/r/0-v1-663679b57226+172-iommufd_dirty_div0_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Reviewed-by: Joao Martins Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257 Signed-off-by: Jason Gunthorpe commit 5da6fb6356362c7eb40ed931b27abc31b3582950 Author: David Howells Date: Mon Oct 20 10:33:06 2025 +0100 cifs: Add a couple of missing smb3_rw_credits tracepoints Add missing smb3_rw_credits tracepoints to cifs_readv_callback() (for SMB1) to match those of SMB2/3. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit b2c37c1168f537900158c860174001d055d8d583 Author: Alex Williamson Date: Mon Oct 13 09:26:11 2025 -0600 MAINTAINERS: Update Alex Williamson's email address Switch to a personal email account as I'll be leaving Red Hat soon. Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20251013152613.3088777-1-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit f3f313c51148668d3c44f1119762325ce2c0715b Author: Sunil V L Date: Fri Oct 17 15:37:44 2025 +0530 ACPI: property: Fix argument order in __acpi_node_get_property_reference() A refactoring bug introduced an argument order mistake in the call to acpi_fwnode_get_reference_args() from __acpi_node_get_property_reference(). This caused incorrect behavior when resolving ACPI property references. Fix the issue by correcting the argument order. Fixes: e121be784d35 ("ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop") Reported-by: Thomas Richard Closes: https://lore.kernel.org/all/1241f2b6-9b4e-4623-8a83-77db8774ac32@bootlin.com/ Tested-by: Thomas Richard Signed-off-by: Sunil V L Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251017100744.71871-1-sunilvl@ventanamicro.com Signed-off-by: Rafael J. Wysocki commit 6548d364a3e850326831799d7e3ea2d7bb97ba08 Merge: 380cb5d3533cdd 0fbbcab7f9082c Author: Linus Torvalds Date: Mon Oct 20 09:41:27 2025 -1000 Merge tag 'cgroup-for-6.18-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix seqcount lockdep assertion failure in cgroup freezer on PREEMPT_RT. Plain seqcount_t expects preemption disabled, but PREEMPT_RT spinlocks don't disable preemption. Switch to seqcount_spinlock_t to properly associate css_set_lock with the freeze timing seqcount. - Misc changes including kernel-doc warning fix for misc_res_type enum and improved selftest diagnostics. * tag 'cgroup-for-6.18-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/misc: fix misc_res_type kernel-doc warning selftests: cgroup: Use values_close_report in test_cpu selftests: cgroup: add values_close_report helper cgroup: Fix seqcount lockdep assertion in cgroup freezer commit 380cb5d3533cddd93050d72d65f7b1fc997823f7 Merge: 211ddde0823f14 a7c4bb43bfdc2b Author: Linus Torvalds Date: Mon Oct 20 09:35:13 2025 -1000 Merge tag 'fsnotify_for_v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fixes from Jan Kara: - Stop-gap solution for a race between unmount of a filesystem with fsnotify marks and someone inspecting fdinfo of fsnotify group with those marks in procfs. A proper solution is in the works but it will get a while to settle. - Fix for non-decodable file handles (used by unprivileged apps using fanotify) * tag 'fsnotify_for_v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs/notify: call exportfs_encode_fid with s_umount expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID commit 10fad4012234a7dea621ae17c0c9486824f645a0 Author: Rafael J. Wysocki Date: Sat Oct 18 14:27:15 2025 +0200 Revert "cpuidle: menu: Avoid discarding useful information" It is reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") led to a performance regression on Intel Jasper Lake systems because it reduced the time spent by CPUs in idle state C7 which is correlated to the maximum frequency the CPUs can get to because of an average running power limit [1]. Before that commit, get_typical_interval() would have returned UINT_MAX whenever it had been unable to make a high-confidence prediction which had led to selecting the deepest available idle state too often and both power and performance had been inadequate as a result of that on some systems. However, this had not been a problem on systems with relatively aggressive average running power limits, like the Jasper Lake systems in question, because on those systems it was compensated by the ability to run CPUs faster. It was addressed by causing get_typical_interval() to return a number based on the recent idle duration information available to it even if it could not make a high-confidence prediction, but that clearly did not take the possible correlation between idle power and available CPU capacity into account. For this reason, revert most of the changes made by commit 85975daeaa4d, except for one cosmetic cleanup, and add a comment explaining the rationale for returning UINT_MAX from get_typical_interval() when it is unable to make a high-confidence prediction. Fixes: 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") Closes: https://lore.kernel.org/linux-pm/36iykr223vmcfsoysexug6s274nq2oimcu55ybn6ww4il3g3cv@cohflgdbpnq7/ [1] Reported-by: Sergey Senozhatsky Cc: All applicable Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3663603.iIbC2pHGDl@rafael.j.wysocki commit 2551a1eedc09f5a86f94b038dc1bb16855c256f1 Author: Florian Schmaus Date: Fri Oct 17 11:28:14 2025 +0200 kunit: test_dev_action: Correctly cast 'priv' pointer to long* The previous implementation incorrectly assumed the original type of 'priv' was void**, leading to an unnecessary and misleading cast. Correct the cast of the 'priv' pointer in test_dev_action() to its actual type, long*, removing an unnecessary cast. As an additional benefit, this fixes an out-of-bounds CHERI fault on hardware with architectural capabilities. The original implementation tried to store a capability-sized pointer using the priv pointer. However, the priv pointer's capability only granted access to the memory region of its original long type, leading to a bounds violation since the size of a long is smaller than the size of a capability. This change ensures that the pointer usage respects the capabilities' bounds. Link: https://lore.kernel.org/r/20251017092814.80022-1-florian.schmaus@codasip.com Fixes: d03c720e03bd ("kunit: Add APIs for managing devices") Reviewed-by: David Gow Signed-off-by: Florian Schmaus Signed-off-by: Shuah Khan commit 39a9ed0fb6dac58547afdf9b6cb032d326a3698f Author: Haofeng Li Date: Wed Oct 15 14:17:53 2025 +0800 timekeeping: Fix aux clocks sysfs initialization loop bound The loop in tk_aux_sysfs_init() uses `i <= MAX_AUX_CLOCKS` as the termination condition, which results in 9 iterations (i=0 to 8) when MAX_AUX_CLOCKS is defined as 8. However, the kernel is designed to support only up to 8 auxiliary clocks. This off-by-one error causes the creation of a 9th sysfs entry that exceeds the intended auxiliary clock range. Fix the loop bound to use `i < MAX_AUX_CLOCKS` to ensure exactly 8 auxiliary clock entries are created, matching the design specification. Fixes: 7b95663a3d96 ("timekeeping: Provide interface to control auxiliary clocks") Signed-off-by: Haofeng Li Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/tencent_2376993D9FC06A3616A4F981B3DE1C599607@qq.com commit 789e46fbfca1875671717a20a916ca1a920268e4 Author: Jani Nikula Date: Wed Oct 15 12:51:35 2025 +0300 drm/i915/panic: fix panic structure allocation memory leak Separating the panic allocation from framebuffer allocation in commit 729c5f7ffa83 ("drm/{i915,xe}/panic: move framebuffer allocation where it belongs") failed to deallocate the panic structure anywhere. The fix is two-fold. First, free the panic structure in intel_user_framebuffer_destroy() in the general case. Second, move the panic allocation later to intel_framebuffer_init() to not leak the panic structure in error paths (if any, now or later) between intel_framebuffer_alloc() and intel_framebuffer_init(). v2: Rebase Fixes: 729c5f7ffa83 ("drm/{i915,xe}/panic: move framebuffer allocation where it belongs") Cc: Jocelyn Falempe Cc: Maarten Lankhorst Reported-by: Michał Grzelak Suggested-by: Ville Syrjälä Tested-by: Michał Grzelak # v1 Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251015095135.2183415-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 8f8ef09fcf6a3b00369bfc704e8f68d7474eca94) Signed-off-by: Rodrigo Vivi commit 9d7dfb95da2cb5c1287df2f3468bcb70d8b31087 Author: Sean Christopherson Date: Thu Oct 16 11:21:47 2025 -0700 KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL Add VMX exit handlers for SEAMCALL and TDCALL to inject a #UD if a non-TD guest attempts to execute SEAMCALL or TDCALL. Neither SEAMCALL nor TDCALL is gated by any software enablement other than VMXON, and so will generate a VM-Exit instead of e.g. a native #UD when executed from the guest kernel. Note! No unprivileged DoS of the L1 kernel is possible as TDCALL and SEAMCALL #GP at CPL > 0, and the CPL check is performed prior to the VMX non-root (VM-Exit) check, i.e. userspace can't crash the VM. And for a nested guest, KVM forwards unknown exits to L1, i.e. an L2 kernel can crash itself, but not L1. Note #2! The Intel® Trust Domain CPU Architectural Extensions spec's pseudocode shows the CPL > 0 check for SEAMCALL coming _after_ the VM-Exit, but that appears to be a documentation bug (likely because the CPL > 0 check was incorrectly bundled with other lower-priority #GP checks). Testing on SPR and EMR shows that the CPL > 0 check is performed before the VMX non-root check, i.e. SEAMCALL #GPs when executed in usermode. Note #3! The aforementioned Trust Domain spec uses confusing pseudocode that says that SEAMCALL will #UD if executed "inSEAM", but "inSEAM" specifically means in SEAM Root Mode, i.e. in the TDX-Module. The long- form description explicitly states that SEAMCALL generates an exit when executed in "SEAM VMX non-root operation". But that's a moot point as the TDX-Module injects #UD if the guest attempts to execute SEAMCALL, as documented in the "Unconditionally Blocked Instructions" section of the TDX-Module base specification. Cc: stable@vger.kernel.org Cc: Kai Huang Cc: Xiaoyao Li Cc: Rick Edgecombe Cc: Dan Williams Cc: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20251016182148.69085-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 19de7113bfac33ba92c004a9b510612bb745cfa0 Author: Babu Moger Date: Thu Oct 16 08:34:19 2025 -0500 x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode The following NULL pointer dereference is encountered on mount of resctrl fs after booting a system that supports assignable counters with the "rdt=!mbmtotal,!mbmlocal" kernel parameters: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:mbm_cntr_get Call Trace: rdtgroup_assign_cntr_event rdtgroup_assign_cntrs rdt_get_tree Specifying the kernel parameter "rdt=!mbmtotal,!mbmlocal" effectively disables the legacy X86_FEATURE_CQM_MBM_TOTAL and X86_FEATURE_CQM_MBM_LOCAL features and the MBM events they represent. This results in the per-domain MBM event related data structures to not be allocated during early initialization. resctrl fs initialization follows by implicitly enabling both MBM total and local events on a system that supports assignable counters (mbm_event mode), but this enabling occurs after the per-domain data structures have been created. After booting, resctrl fs assumes that an enabled event can access all its state. This results in NULL pointer dereference when resctrl attempts to access the un-allocated structures of an enabled event. Remove the late MBM event enabling from resctrl fs. This leaves a problem where the X86_FEATURE_CQM_MBM_TOTAL and X86_FEATURE_CQM_MBM_LOCAL features may be disabled while assignable counter (mbm_event) mode is enabled without any events to support. Switching between the "default" and "mbm_event" mode without any events is not practical. Create a dependency between the X86_FEATURE_{CQM_MBM_TOTAL,CQM_MBM_LOCAL} and X86_FEATURE_ABMC (assignable counter) hardware features. An x86 system that supports assignable counters now requires support of X86_FEATURE_CQM_MBM_TOTAL or X86_FEATURE_CQM_MBM_LOCAL. This ensures all needed MBM related data structures are created before use and that it is only possible to switch between "default" and "mbm_event" mode when the same events are available in both modes. This dependency does not exist in the hardware but this usage of these feature settings work for known systems. [ bp: Massage commit message. ] Fixes: 13390861b426e ("x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details") Co-developed-by: Reinette Chatre Signed-off-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/a62e6ac063d0693475615edd213d5be5e55443e6.1760560934.git.babu.moger@amd.com commit a0b7780602b1b196f47e527fec82166a7e67c4d0 Author: Bart Van Assche Date: Tue Oct 7 14:48:00 2025 -0700 scsi: core: Fix a regression triggered by scsi_host_busy() Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") introduced the following regression: Call trace: __srcu_read_lock+0x30/0x80 (P) blk_mq_tagset_busy_iter+0x44/0x300 scsi_host_busy+0x38/0x70 ufshcd_print_host_state+0x34/0x1bc ufshcd_link_startup.constprop.0+0xe4/0x2e0 ufshcd_init+0x944/0xf80 ufshcd_pltfrm_init+0x504/0x820 ufs_rockchip_probe+0x2c/0x88 platform_probe+0x5c/0xa4 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x150 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1e0 bus_for_each_dev+0x7c/0xdc driver_attach+0x24/0x30 bus_add_driver+0x110/0x230 driver_register+0x68/0x130 __platform_driver_register+0x20/0x2c ufs_rockchip_pltform_init+0x1c/0x28 do_one_initcall+0x60/0x1e0 kernel_init_freeable+0x248/0x2c4 kernel_init+0x20/0x140 ret_from_fork+0x10/0x20 Fix this regression by making scsi_host_busy() check whether the SCSI host tag set has already been initialized. tag_set->ops is set by scsi_mq_setup_tags() just before blk_mq_alloc_tag_set() is called. This fix is based on the assumption that scsi_host_busy() and scsi_mq_setup_tags() calls are serialized. This is the case in the UFS driver. Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/ Cc: Ming Lei Cc: Jens Axboe Signed-off-by: Bart Van Assche Reviewed-by: Ming Lei Tested-by: Sebastian Reichel Link: https://patch.msgid.link/20251007214800.1678255-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit fc2bc2623e3a099165b02d13567d21fabb5ea54d Author: Krishna Chaitanya Chundru Date: Fri Oct 17 17:10:54 2025 +0530 Revert "PCI: qcom: Prepare for the DWC ECAM enablement" This reverts commit 4660e50cf81800f82eeecf743ad1e3e97ab72190. Commit f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") enabled ECAM access by using the config space start as DBI address. However, this approach breaks vendor drivers that rely on the DBI address for internal accesses, especially when the vendor config space is 256MB aligned. To resolve this, avoid using the DBI as the start of config space and instead introduce a custom ECAM PCI ops implementation. Revert the qcom specific ECAM preparation logic in 4660e50cf818 ("PCI: qcom: Prepare for the DWC ECAM enablement") since it's no longer necessary. Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251017-ecam_fix-v1-2-f6faa3d0edf3@oss.qualcomm.com commit a1978b692a3953241842a89eaa0026158f306cf1 Author: Krishna Chaitanya Chundru Date: Fri Oct 17 17:10:53 2025 +0530 PCI: dwc: Use custom pci_ops for root bus DBI vs ECAM config access When the vendor configuration space is 256MB aligned, the DesignWare PCIe host driver enables ECAM access and sets the DBI base to the start of the config space. This causes vendor drivers to incorrectly program iATU regions, as they rely on the DBI address for internal accesses. To fix this, avoid overwriting the DBI base when ECAM is enabled. Instead, introduce a custom pci_ops that accesses the DBI region directly for the root bus and uses ECAM for other buses. Fixes: f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") Reported-by: Ron Economos Closes: https://lore.kernel.org/all/eac81c57-1164-4d74-a1b4-6f353c577731@w6rz.net/ Suggested-by: Manivannan Sadhasivam Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Ron Economos Link: https://patch.msgid.link/20251017-ecam_fix-v1-1-f6faa3d0edf3@oss.qualcomm.com commit 81ccca31214e11ea2b537fd35d4f66d7cf46268e Author: Ondrej Mosnacek Date: Fri Oct 10 10:09:00 2025 +0200 nbd: override creds to kernel when calling sock_{send,recv}msg() sock_{send,recv}msg() internally calls security_socket_{send,recv}msg(), which does security checks (e.g. SELinux) for socket access against the current task. However, _sock_xmit() in drivers/block/nbd.c may be called indirectly from a userspace syscall, where the NBD socket access would be incorrectly checked against the calling userspace task (which simply tries to read/write a file that happens to reside on an NBD device). To fix this, temporarily override creds to kernel ones before calling the sock_*() functions. This allows the security modules to recognize this as internal access by the kernel, which will normally be allowed. A way to trigger the issue is to do the following (on a system with SELinux set to enforcing): ### Create nbd device: truncate -s 256M /tmp/testfile nbd-server localhost:10809 /tmp/testfile ### Connect to the nbd server: nbd-client localhost ### Create mdraid array mdadm --create -l 1 -n 2 /dev/md/testarray /dev/nbd0 missing After these steps, assuming the SELinux policy doesn't allow the unexpected access pattern, errors will be visible on the kernel console: [ 142.204243] nbd0: detected capacity change from 0 to 524288 [ 165.189967] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 165.252299] md/raid1:md127: active with 1 out of 2 mirrors [ 165.252725] md127: detected capacity change from 0 to 522240 [ 165.255434] block nbd0: Send control failed (result -13) [ 165.255718] block nbd0: Request send failed, requeueing [ 165.256006] block nbd0: Dead connection, failed to find a fallback [ 165.256041] block nbd0: Receive control failed (result -32) [ 165.256423] block nbd0: shutting down sockets [ 165.257196] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.257736] Buffer I/O error on dev md127, logical block 0, async page read [ 165.258263] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.259376] Buffer I/O error on dev md127, logical block 0, async page read [ 165.259920] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.260628] Buffer I/O error on dev md127, logical block 0, async page read [ 165.261661] ldm_validate_partition_table(): Disk read failed. [ 165.262108] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.262769] Buffer I/O error on dev md127, logical block 0, async page read [ 165.263697] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.264412] Buffer I/O error on dev md127, logical block 0, async page read [ 165.265412] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.265872] Buffer I/O error on dev md127, logical block 0, async page read [ 165.266378] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.267168] Buffer I/O error on dev md127, logical block 0, async page read [ 165.267564] md127: unable to read partition table [ 165.269581] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.269960] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.270316] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.270913] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.271253] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.271809] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.272074] ldm_validate_partition_table(): Disk read failed. [ 165.272360] nbd0: unable to read partition table [ 165.289004] ldm_validate_partition_table(): Disk read failed. [ 165.289614] nbd0: unable to read partition table The corresponding SELinux denial on Fedora/RHEL will look like this (assuming it's not silenced): type=AVC msg=audit(1758104872.510:116): avc: denied { write } for pid=1908 comm="mdadm" laddr=::1 lport=32772 faddr=::1 fport=10809 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0 The respective backtrace looks like this: @security[mdadm, -13, handshake_exit+221615650 handshake_exit+221615650 handshake_exit+221616465 security_socket_sendmsg+5 sock_sendmsg+106 handshake_exit+221616150 sock_sendmsg+5 __sock_xmit+162 nbd_send_cmd+597 nbd_handle_cmd+377 nbd_queue_rq+63 blk_mq_dispatch_rq_list+653 __blk_mq_do_dispatch_sched+184 __blk_mq_sched_dispatch_requests+333 blk_mq_sched_dispatch_requests+38 blk_mq_run_hw_queue+239 blk_mq_dispatch_plug_list+382 blk_mq_flush_plug_list.part.0+55 __blk_flush_plug+241 __submit_bio+353 submit_bio_noacct_nocheck+364 submit_bio_wait+84 __blkdev_direct_IO_simple+232 blkdev_read_iter+162 vfs_read+591 ksys_read+95 do_syscall_64+92 entry_SYSCALL_64_after_hwframe+120 ]: 1 The issue has started to appear since commit 060406c61c7c ("block: add plug while submitting IO"). Cc: Ming Lei Link: https://bugzilla.redhat.com/show_bug.cgi?id=2348878 Fixes: 060406c61c7c ("block: add plug while submitting IO") Signed-off-by: Ondrej Mosnacek Acked-by: Paul Moore Acked-by: Stephen Smalley Reviewed-by: Ming Lei Tested-by: Ming Lei Signed-off-by: Jens Axboe commit 4ec703ec0c384a2199808c4eb2e9037236285a8d Author: Alok Tiwari Date: Sat Oct 18 12:32:54 2025 -0700 io_uring: fix incorrect unlikely() usage in io_waitid_prep() The negation operator is incorrectly placed outside the unlikely() macro: if (!unlikely(iwa)) This inverts the compiler branch prediction hint, marking the NULL case as likely instead of unlikely. The intent is to indicate that allocation failures are rare, consistent with common kernel patterns. Moving the negation inside unlikely(): if (unlikely(!iwa)) Fixes: 2b4fc4cd43f2 ("io_uring/waitid: setup async data in the prep handler") Signed-off-by: Alok Tiwari Reviewed-by: Gabriel Krisman Bertazi Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 8e93ac51e4c6dc399fad59ec21f55f2cfb46d27c Author: Marc Kleine-Budde Date: Mon Oct 20 11:51:03 2025 +0200 can: netlink: can_changelink(): allow disabling of automatic restart Since the commit c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode"), the automatic restart delay can only be set for devices that implement the restart handler struct can_priv::do_set_mode. As it makes no sense to configure a automatic restart for devices that doesn't support it. However, since systemd commit 13ce5d4632e3 ("network/can: properly handle CAN.RestartSec=0") [1], systemd-networkd correctly handles a restart delay of "0" (i.e. the restart is disabled). Which means that a disabled restart is always configured in the kernel. On systems with both changes active this causes that CAN interfaces that don't implement a restart handler cannot be brought up by systemd-networkd. Solve this problem by allowing a delay of "0" to be configured, even if the device does not implement a restart handler. [1] https://github.com/systemd/systemd/commit/13ce5d4632e395521e6205c954493c7fc1c4c6e0 Cc: stable@vger.kernel.org Cc: Andrei Lalaev Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251020-certain-arrogant-vole-of-sunshine-141841-mkl@pengutronix.de Fixes: c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode") Link: https://patch.msgid.link/20251020-netlink-fix-restart-v1-1-3f53c7f8520b@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 942b3c611067385849a912135175a66f25b7b1cb Merge: ffff5c8fc2af22 3a3bc9bbb3a028 Author: Marc Kleine-Budde Date: Mon Oct 20 17:18:39 2025 +0200 Merge patch series "can: drivers: drop skb in xmit if device is in listen only mode" Marc Kleine-Budde says: I notived that 3 drivers (bxcan, esd and rockchip) use the function can_dropped_invalid_skb(), that doesn't check if the device is in listen only mode. This series converts these driver to use the new can_dev_dropped_skb() function. Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-0-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3a3bc9bbb3a0287164a595787df0c70d91e77cfd Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-3-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 0bee15a5caf36fe513fdeee07fd4f0331e61c064 Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: 9721866f07e1 ("can: esd: add support for esd GmbH PCIe/402 CAN interface family") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-2-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3a20c444cd123e820e10ae22eeaf00e189315aa1 Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: f00647d8127b ("can: bxcan: add support for ST bxCAN controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-1-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f7e37affbc9085f2b77ccb6596521a44eabf7505 Author: Mika Westerberg Date: Mon Oct 20 16:54:15 2025 +0200 spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash Add Intel Wildcat Lake SPI serial flash PCI ID to the list of supported devices. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-4-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit bc25c6e0a4880b5ad70c31fe1466f30c9e4c8f52 Author: Mika Westerberg Date: Mon Oct 20 16:54:14 2025 +0200 spi: intel-pci: Add support for Arrow Lake-H SPI serial flash Add Intel Arrow Lake-H PCI ID to the driver list of supported devices. This is the same controller found in previous generations. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-3-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit e46ee2f07e5848d7ec7aec38b72476dc7941b048 Author: Mika Westerberg Date: Mon Oct 20 16:54:13 2025 +0200 spi: intel: Add support for 128M component density With the recent hardware the flash component density can be increased to 128M. Update the driver to support this. While there log a warning if we encounter an unsupported value in this field. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-2-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 Author: Renjun Wang Date: Sun Oct 19 18:44:38 2025 +0800 USB: serial: option: add UNISOC UIS7720 Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module. T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4064 Rev=04.04 S: Manufacturer=Unisoc-phone S: Product=Unisoc-phone S: SerialNumber=0123456789ABCDEF C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB Signed-off-by: Renjun Wang Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f31e261712a0d107f09fb1d3dc8f094806149c83 Author: Jihed Chaibi Date: Tue Sep 16 00:06:55 2025 +0200 ARM: dts: imx51-zii-rdu1: Fix audmux node names Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the audmux configuration of imx51-zii-rdu1.dts to comply with the naming convention in imx-audmux.yaml. This fixes the following dt-schema warning: imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$' Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board") Signed-off-by: Jihed Chaibi Signed-off-by: Shawn Guo commit 62bf7708fe80ec0db14b9179c25eeeda9f81e9d0 Author: Dario Binacchi Date: Sat Sep 13 11:16:31 2025 +0200 ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value The 'report-rate-hz' property for the edt-ft5x06 driver was added and handled in the Linux kernel by me with patches [1] and [2] for this specific board. The v1 upstream version, which was the one applied to the customer's kernel, used the 'report-rate' property, which was written directly to the controller register. During review, the 'hz' suffix was added, changing its handling so that writing the value directly to the register was no longer possible for the M06 controller. Once the patches were accepted in mainline, I did not reapply them to the customer's kernel, and when upstreaming the DTS for this board, I forgot to correct the 'report-rate-hz' property value. The property must be set to 60 because this board uses the M06 controller, which expects the report rate in units of 10 Hz, meaning the actual value written to the register is 6. [1] 625f829586ea ("dt-bindings: input: touchscreen: edt-ft5x06: add report-rate-hz") [2] 5bcee83a406c ("Input: edt-ft5x06 - set report rate by dts property") Fixes: ffea3cac94ba ("ARM: dts: imx6ul: support Engicam MicroGEA RMM board") Co-developed-by: Michael Trimarchi Signed-off-by: Michael Trimarchi Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit 69e4b75a5b90ef74300c283c0aafe8d41daf13a8 Merge: 249e1443e3d57e 77e67d5daaf155 Author: Johannes Berg Date: Mon Oct 20 13:57:51 2025 +0200 Merge tag 'iwlwifi-fixes-2025-10-19' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix avoid use after free ==================== Signed-off-by: Johannes Berg commit 249e1443e3d57e059925bdb698f53e4d008fc106 Author: Emmanuel Grumbach Date: Mon Oct 20 10:57:45 2025 +0300 wifi: nl80211: call kfree without a NULL check Coverity is unhappy because we may leak old_radio_rts_threshold. Since this pointer is only valid in the context of the function and kfree is NULL pointer safe, don't check and just call kfree. Note that somehow, we were checking old_rts_threshold to free old_radio_rts_threshold which is a bit odd. Fixes: 264637941cf4 ("wifi: cfg80211: Add Support to Set RTS Threshold for each Radio") Reviewed-by: Johannes Berg Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20251020075745.44168-1-emmanuel.grumbach@intel.com Signed-off-by: Johannes Berg commit ed6a47346ec69e7f1659e0a1a3558293f60d5dd7 Author: Johannes Berg Date: Sun Oct 19 11:54:27 2025 +0300 wifi: mac80211: fix key tailroom accounting leak For keys added by ieee80211_gtk_rekey_add(), we assume that they're already present in the hardware and set the flag KEY_FLAG_UPLOADED_TO_HARDWARE. However, setting this flag needs to be paired with decrementing the tailroom needed, which was missed. Fixes: f52a0b408ed1 ("wifi: mac80211: mark keys as uploaded when added by the driver") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251019115358.c88eafb4083e.I69e9d4d78a756a133668c55b5570cf15a4b0e6a4@changeid Signed-off-by: Johannes Berg commit 3776c685ebe5f43e9060af06872661de55e80b9a Author: Gokul Sivakumar Date: Mon Oct 13 15:58:19 2025 +0530 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. Cc: stable@vger.kernel.org Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx") Signed-off-by: Gokul Sivakumar Acked-by: Arend van Spriel Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com [Cc stable] Signed-off-by: Johannes Berg commit 1e1801cab6c7f302baec2a0fe3afe25458d0be7e Author: Dr. David Alan Gilbert Date: Sat Oct 11 00:57:35 2025 +0100 MAINTAINERS: wcn36xx: Add linux-wireless list The wcn36xx is a wireless device but doesn't have the wireless list in its MAINTAINERS entry. Add it. Signed-off-by: Dr. David Alan Gilbert Acked-by: Jeff Johnson Link: https://patch.msgid.link/20251010235735.350638-1-linux@treblig.org Signed-off-by: Johannes Berg commit d3697884672887ced9127be877c9d3d831fb1110 Merge: a2a69add80411d 9c78e747dd4fee Author: Johannes Berg Date: Mon Oct 20 13:54:45 2025 +0200 Merge tag 'ath-current-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc1 Fix memory leaks in both ath10k and ath12k. Fix a sparse issue in ath11k. Allow ath11k suspend/resume to work on more Lenovo laptops. ================== Signed-off-by: Johannes Berg commit a2a69add80411dd295c9088c1bcf925b1f4e53d7 Author: Rafał Miłecki Date: Fri Oct 3 14:51:26 2025 +0200 bcma: don't register devices disabled in OF Some bus devices can be marked as disabled for specific SoCs or models. Those should not be registered to avoid probing them. Signed-off-by: Rafał Miłecki Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251003125126.27950-1-zajec5@gmail.com Signed-off-by: Johannes Berg commit 607844761454e3c17e928002e126ccf21c83f6aa Author: Aloka Dixit Date: Wed Sep 24 18:30:14 2025 +0530 wifi: mac80211: reset FILS discovery and unsol probe resp intervals When ieee80211_stop_ap() deletes the FILS discovery and unsolicited broadcast probe response templates, the associated interval values are not reset. This can lead to drivers subsequently operating with the non-zero values, leading to unexpected behavior. Trigger repeated retrieval attempts of the FILS discovery template in ath12k, resulting in excessive log messages such as: mac vdev 0 failed to retrieve FILS discovery template mac vdev 4 failed to retrieve FILS discovery template Fix this by resetting the intervals in ieee80211_stop_ap() to ensure proper cleanup of FILS discovery and unsolicited broadcast probe response templates. Fixes: 295b02c4be74 ("mac80211: Add FILS discovery support") Fixes: 632189a0180f ("mac80211: Unsolicited broadcast probe response support") Signed-off-by: Aloka Dixit Signed-off-by: Aaradhana Sahu Link: https://patch.msgid.link/20250924130014.2575533-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Johannes Berg commit 3d62f95bd8450cebb4a4741bf83949cd54edd4a3 Author: Nam Cao Date: Thu Oct 2 08:23:17 2025 +0000 rv: Make rtapp/pagefault monitor depends on CONFIG_MMU There is no page fault without MMU. Compiling the rtapp/pagefault monitor without CONFIG_MMU fails as page fault tracepoints' definitions are not available. Make rtapp/pagefault monitor depends on CONFIG_MMU. Fixes: 9162620eb604 ("rv: Add rtapp_pagefault monitor") Signed-off-by: Nam Cao Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509260455.6Z9Vkty4-lkp@intel.com/ Cc: stable@vger.kernel.org Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20251002082317.973839-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 103541e6a5854b08a25e4caa61e990af1009a52e Author: Nam Cao Date: Thu Oct 2 08:22:35 2025 +0000 rv: Fully convert enabled_monitors to use list_head as iterator The callbacks in enabled_monitors_seq_ops are inconsistent. Some treat the iterator as struct rv_monitor *, while others treat the iterator as struct list_head *. This causes a wrong type cast and crashes the system as reported by Nathan. Convert everything to use struct list_head * as iterator. This also makes enabled_monitors consistent with available_monitors. Fixes: de090d1ccae1 ("rv: Fix wrong type cast in enabled_monitors_next()") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-trace-kernel/20250923002004.GA2836051@ax162/ Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20251002082235.973099-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 3575254546a27210a4b661ea37fbbfb836c0815d Author: Alan Borzeszkowski Date: Thu Nov 14 10:55:44 2024 +0100 thunderbolt: Add support for Intel Wildcat Lake Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar Lake platform. Add Wildcat Lake PCI ID to the driver list of supported devices. Signed-off-by: Alan Borzeszkowski Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit e607ef686ab95fbcb0dfd16f49aea7918be626e1 Author: Stefan Metzmacher Date: Thu Oct 16 12:54:21 2025 +0200 smb: client: allocate enough space for MR WRs and ib_drain_qp() The IB_WR_REG_MR and IB_WR_LOCAL_INV operations for smbdirect_mr_io structures should never fail because the submission or completion queues are too small. So we allocate more send_wr depending on the (local) max number of MRs. While there also add additional space for ib_drain_qp(). This should make sure ib_post_send() will never fail because the submission queue is full. Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Fixes: cc55f65dd352 ("smb: client: make use of common smbdirect_socket_parameters") Cc: stable@vger.kernel.org Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8dcc66ad379ec0642fb281c45ccfd7d2d366e53f Author: Guenter Roeck Date: Sat Oct 18 06:04:57 2025 -0700 hwmon: (sht3x) Fix error handling Handling of errors when reading status, temperature, and humidity returns the error number as negative attribute value. Fix it up by returning the error as return value. Fixes: a0ac418c6007c ("hwmon: (sht3x) convert some of sysfs interface to hwmon") Cc: JuenKit Yip Signed-off-by: Guenter Roeck commit a09a5aa8bf258ddc99a22c30f17fe304b96b5350 Author: Li Qiang Date: Fri Oct 17 14:34:14 2025 +0800 hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() The driver allocates memory for sensor data using devm_kzalloc(), but did not check if the allocation succeeded. In case of memory allocation failure, dereferencing the NULL pointer would lead to a kernel crash. Add a NULL pointer check and return -ENOMEM to handle allocation failure properly. Signed-off-by: Li Qiang Fixes: 08ebc9def79fc ("hwmon: Add Congatec Board Controller monitoring driver") Reviewed-by: Thomas Richard Link: https://lore.kernel.org/r/20251017063414.1557447-1-liqiang01@kylinos.cn Signed-off-by: Guenter Roeck commit 57f6f47920ef2f598c46d0a04bd9c8984c98e6df Author: Erick Karanja Date: Sun Oct 12 21:12:49 2025 +0300 hwmon: (pmbus/isl68137) Fix child node reference leak on early return In the case of an early return, the reference to the child node needs to be released. Use for_each_child_of_node_scoped to fix the issue. Fixes: 3996187f80a0e ("hwmon: (pmbus/isl68137) add support for voltage divider on Vout") Signed-off-by: Erick Karanja Link: https://lore.kernel.org/r/20251012181249.359401-1-karanja99erick@gmail.com [groeck: Updated subject/description] Signed-off-by: Guenter Roeck commit 72ac14851012d45dcbb9d3533e372e33001b873e Author: Harshit Mogalapalli Date: Fri Oct 10 13:44:46 2025 -0700 hwmon: (gpd-fan) Fix error handling in gpd_fan_probe() devm_request_region() returns a NULL pointer on error, not an ERR_PTR(). Handle it accordingly. Also fix error return from the call to devm_hwmon_device_register_with_info(). Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Harshit Mogalapalli Reviewed-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20251010204447.94343-1-harshit.m.mogalapalli@oracle.com [groeck: Updated subject to improve readability] Signed-off-by: Guenter Roeck commit ab0fd09d25e1d706e1ffc240f5cf66dcc89eeb49 Author: Harshit Mogalapalli Date: Fri Oct 10 13:43:59 2025 -0700 hwmon: (gpd-fan) Fix return value when platform_get_resource() fails When platform_get_resource() fails it returns NULL and not an error pointer, accordingly change the error handling. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20251010204359.94300-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Guenter Roeck commit 41de7440e6a00b8e70a068c50e3fba2f56302e8a Author: Alexis Czezar Torreno Date: Wed Oct 1 08:37:07 2025 +0800 hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW adpm12160 is a dc-dc power module. The firmware was updated and the coeeficients in the pmbus_driver_info needs to be updated. Since the part has not yet released with older FW, this permanent change to reflect the latest should be ok. Signed-off-by: Alexis Czezar Torreno Link: https://lore.kernel.org/r/20251001-hwmon-next-v1-1-f8ca6a648203@analog.com Fixes: 629cf8f6c23a ("hwmon: (pmbus/max34440) Add support for ADPM12160") Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Guenter Roeck commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 Author: Srinivas Kandagatla Date: Fri Oct 17 09:52:56 2025 +0100 ASoC: qdsp6: q6asm: do not sleep while atomic For some reason we ended up kfree between spinlock lock and unlock, which can sleep. move the kfree out of spinlock section. Fixes: a2a5d30218fd ("ASoC: qdsp6: q6asm: Add support to memory map and unmap") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251017085307.4325-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 3bcdbc221d676f871e23da30fd485a76728f55c7 Author: Simon Trimmer Date: Thu Oct 16 11:26:01 2025 +0000 ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 Removing this match entry ensures that a PTL system comprising of a cs42l43 codec on link3 will use function topologies. Previously the behaviour would be use the monolithic topology associated with this codec match table entry in preference to function topologies and if the system had a number of smart amplifiers then they would not be instantiated. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20251016112601.187020-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit bf6fb4a272739e0d1b2c570276324142517d1905 Author: Sharique Mohammad Date: Thu Oct 16 17:11:52 2025 +0200 ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added The filter configuration register(0x26) has AHPF(bit6) for primary record path, which is common in max98090 and max98091 and has been defined as DAPM suppy widget as "AHPF" in "struct snd_soc_dapm_widget max98090_dapm_widget[]". It is the DC-Blocking filter for the primary record path. But the same functionality for secondary record path in the configuration register(0x26) is DMIC2_HPF(bit2). It is not present as a DAPM supply widget in the current code. With this patch adding it as a DAPM supply widget. In the current code, the mics on secondary record path in code are named as "DMIC3" and "DMIC4", so accordingly naming DMIC2_HPF(bit2) as "DMIC34_HPF", and declaring it as a DAPM supply widget in "struct snd_soc_dapm_widget max98091_dapm_widget[]". Also it is specific to max98091, and should be visible or working only when max98091 codec chip is used. Therefore, written in "max98091_dapm_widget[]". As "AHPF" is not part of secondary record path, replacing it with "DMIC34_HPF" in the ALSA routes to "DMIC3" and "DMIC4" in "max98091_dapm_routes[]". Signed-off-by: Sharique Mohammad Link: https://patch.msgid.link/20251016151152.1107083-1-sharq0406@gmail.com Signed-off-by: Mark Brown commit ef30cb1304f033eaee3b46e22b8f523446db8f53 Author: Simon Trimmer Date: Thu Oct 16 15:08:37 2025 +0000 ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 This adds some match entries for a few system configurations: cs42l43 link 0 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs42l43 link 1 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20251016150837.320886-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit ec20584f25233bfe292c8e18f9a429dfaff58a49 Author: Richard Fitzgerald Date: Thu Oct 16 10:48:44 2025 +0100 ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h cs-amp-lib-test uses functions from kunit/test-bug.h but wasn't including it. This error was found by smatch. Fixes: 177862317a98 ("ASoC: cs-amp-lib: Add KUnit test for calibration helpers") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251016094844.92796-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 248adfe32bfd75afbcb8f6d4b68f7e0a9fb2c438 Author: Simon Trimmer Date: Fri Oct 17 17:15:28 2025 +0100 ASoC: cs530x: Correct log message with expected variable The function used one parameter for the switch statement, but logged a different parameter when it defaulted. Signed-off-by: Simon Trimmer Signed-off-by: Vitaly Rodionov Link: https://patch.msgid.link/20251017161543.214235-2-vitalyr@opensource.cirrus.com Signed-off-by: Mark Brown commit 211ddde0823f1442e4ad052a2f30f050145ccada Author: Linus Torvalds Date: Sun Oct 19 15:19:16 2025 -1000 Linux 6.18-rc2 commit d9043c79ba68a089f95bb4344ab0232c3585f9f1 Merge: 343b4b44a10f6e 17e3e88ed0b631 Author: Linus Torvalds Date: Sun Oct 19 04:59:43 2025 -1000 Merge tag 'sched_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Make sure the check for lost pelt idle time is done unconditionally to have correct lost idle time accounting - Stop the deadline server task before a CPU goes offline * tag 'sched_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix pelt lost idle time detection sched/deadline: Stop dl_server before CPU goes offline commit 343b4b44a10f6e383bd829ba130024cfde2a08d4 Merge: c7864eeaa4b743 fa4f4bae893fbc Author: Linus Torvalds Date: Sun Oct 19 04:54:08 2025 -1000 Merge tag 'perf_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Make sure perf reporting works correctly in setups using overlayfs or FUSE - Move the uprobe optimization to a better location logically * tag 'perf_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix MMAP2 event device with backing files perf/core: Fix MMAP event path names with backing files perf/core: Fix address filter match with backing files uprobe: Move arch_uprobe_optimize right after handlers execution commit c7864eeaa4b743bffe4abb396a03b9d4730195fe Merge: 1c64efcb083c48 e6416c2dfe23c9 Author: Linus Torvalds Date: Sun Oct 19 04:41:27 2025 -1000 Merge tag 'x86_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Reset the why-the-system-rebooted register on AMD to avoid stale bits remaining from previous boots - Add a missing barrier in the TLB flushing code to prevent erroneously not flushing a TLB generation - Make sure cpa_flush() does not overshoot when computing the end range of a flush region - Fix resctrl bandwidth counting on AMD systems when the amount of monitoring groups created exceeds the number the hardware can track * tag 'x86_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Prevent reset reasons from being retained across reboot x86/mm: Fix SMP ordering in switch_mm_irqs_off() x86/mm: Fix overflow in __cpa_addr() x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID commit 77e67d5daaf155f7d0f99f4e797c4842169ec19e Author: Dan Carpenter Date: Tue Sep 23 14:20:16 2025 +0300 wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() This code frees "link" by calling kfree_rcu(link, rcu_head) and then it dereferences "link" to get the "link->fw_id". Save the "link->fw_id" first to avoid a potential use after free. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aNKCcKlbSkkS4_gO@stanley.mountain Signed-off-by: Miri Korenblit commit d8713158faad0fd4418cb2f4e432c3876ad53a1f Author: Shuhao Fu Date: Fri Oct 10 10:55:17 2025 +0800 RDMA/uverbs: Fix umem release in UVERBS_METHOD_CQ_CREATE In `UVERBS_METHOD_CQ_CREATE`, umem should be released if anything goes wrong. Currently, if `create_cq_umem` fails, umem would not be released or referenced, causing a possible leak. In this patch, we release umem at `UVERBS_METHOD_CQ_CREATE`, the driver should not release umem if it returns an error code. Fixes: 1a40c362ae26 ("RDMA/uverbs: Add a common way to create CQ with umem") Signed-off-by: Shuhao Fu Link: https://patch.msgid.link/aOh1le4YqtYwj-hH@osx.local Signed-off-by: Leon Romanovsky commit 5575b7646b94c0afb0f4c0d86e00e13cf3397a62 Author: Jacob Moroni Date: Tue Sep 23 14:24:39 2025 +0000 RDMA/irdma: Set irdma_cq cq_num field during CQ create The driver maintains a CQ table that is used to ensure that a CQ is still valid when processing CQ related AEs. When a CQ is destroyed, the table entry is cleared, using irdma_cq.cq_num as the index. This field was never being set, so it was just always clearing out entry 0. Additionally, the cq_num field size was increased to accommodate HW supporting more than 64K CQs. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20250923142439.943930-1-jmoroni@google.com Acked-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 8d158f47f1f33d8747e80c3afbea5aa337e59d41 Author: Jacob Moroni Date: Tue Sep 23 19:08:50 2025 +0000 RDMA/irdma: Fix SD index calculation In some cases, it is possible for pble_rsrc->next_fpm_addr to be larger than u32, so remove the u32 cast to avoid unintentional truncation. This fixes the following error that can be observed when registering massive memory regions: [ 447.227494] (NULL ib_device): cqp opcode = 0x1f maj_err_code = 0xffff min_err_code = 0x800c [ 447.227505] (NULL ib_device): [Update PE SDs Cmd Error][op_code=21] status=-5 waiting=1 completion_err=1 maj=0xffff min=0x800c Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20250923190850.1022773-1-jmoroni@google.com Acked-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 88de89f184661ebb946804a5abdf2bdec7f0a7ab Author: YanLong Dai Date: Wed Sep 24 14:14:44 2025 +0800 RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp The current error handling path in bnxt_re_destroy_gsi_sqp() could lead to a resource leak. When bnxt_qplib_destroy_qp() fails, the function jumps to the 'fail' label and returns immediately, skipping the call to bnxt_qplib_free_qp_res(). Continue the resource teardown even if bnxt_qplib_destroy_qp() fails, which aligns with the driver's general error handling strategy and prevents the potential leak. Fixes: 8dae419f9ec73 ("RDMA/bnxt_re: Refactor queue pair creation code") Signed-off-by: YanLong Dai Link: https://patch.msgid.link/20250924061444.11288-1-daiyanlong@kylinos.cn Signed-off-by: Leon Romanovsky commit cb372b4f46d4285e5d2c07ba734374151b8e34e7 Author: Dimitri Fedrau Date: Thu Oct 16 07:20:39 2025 +0200 iio: humditiy: hdc3020: fix units for thresholds and hysteresis According to the ABI the units after application of scale and offset are milli degree celsius for temperature thresholds and milli percent for relative humidity thresholds. Currently the resulting units are degree celsius for temperature thresholds and hysteresis and percent for relative humidity thresholds and hysteresis. Change scale factor to fix this issue. Fixes: 3ad0e7e5f0cb ("iio: humidity: hdc3020: add threshold events support") Reported-by: Chris Lesiak Reviewed-by: Javier Carrasco Signed-off-by: Dimitri Fedrau Cc: Signed-off-by: Jonathan Cameron commit 7b8dc11c0a830caa0d890c603d597161c6c26095 Author: Dimitri Fedrau Date: Thu Oct 16 07:20:38 2025 +0200 iio: humditiy: hdc3020: fix units for temperature and humidity measurement According to the ABI the units after application of scale and offset are milli degrees for temperature measurements and milli percent for relative humidity measurements. Currently the resulting units are degree celsius for temperature measurements and percent for relative humidity measurements. Change scale factor to fix this issue. Fixes: c9180b8e39be ("iio: humidity: Add driver for ti HDC302x humidity sensors") Reported-by: Chris Lesiak Suggested-by: Chris Lesiak Reviewed-by: Javier Carrasco Signed-off-by: Dimitri Fedrau Cc: Signed-off-by: Jonathan Cameron commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a Author: Francesco Lavra Date: Fri Oct 17 19:32:08 2025 +0200 iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields The `decimator` and `batch` fields of struct st_lsm6dsx_settings are arrays indexed by sensor type, not by sensor hardware identifier; moreover, the `batch` field is only used for the accelerometer and gyroscope. Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to ST_LSM6DSX_ID_MAX, and change the array size for `batch` from ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id definition so that the ST_LSM6DSX_ID_MAX value is usable within the struct st_lsm6dsx_settings definition. Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO") Signed-off-by: Francesco Lavra Acked-by: Lorenzo Bianconi Cc: Signed-off-by: Jonathan Cameron commit 1c64efcb083c48c85227cb4d72ab137feef2cdac Merge: 648937f64a09ae 1f1d3e1d094db7 Author: Linus Torvalds Date: Sat Oct 18 10:05:13 2025 -1000 Merge tag 'rust-rustfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rustfmt fixes from Miguel Ojeda: "Rust 'rustfmt' cleanup 'rustfmt', by default, formats imports in a way that is prone to conflicts while merging and rebasing, since in some cases it condenses several items into the same line. Document in our guidelines that we will handle this for the moment with the trailing empty comment workaround and make the tree 'rustfmt'-clean again" * tag 'rust-rustfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: bitmap: fix formatting rust: cpufreq: fix formatting rust: alloc: employ a trailing comment to keep vertical layout docs: rust: add section on imports formatting commit 648937f64a09ae4a938a6793f95207d955098038 Merge: e67bb0da332c60 dbfdaeb381a49a Author: Linus Torvalds Date: Sat Oct 18 08:38:28 2025 -1000 Merge tag 'tpmdd-next-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "Correct the state transitions for ARM FF-A to match the spec and how tpm_crb behaves on other platforms" * tag 'tpmdd-next-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_crb: Add idle support for the Arm FF-A start method commit e67bb0da332c6058b29a9c46cc4035647d049a0c Merge: ea0bdf2b945e91 a78835b86a4414 Author: Linus Torvalds Date: Sat Oct 18 08:35:09 2025 -1000 Merge tag 'pci-v6.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Search for MSI Capability with correct ID to fix an MSI regression on platforms with Cadence IP (Hans Zhang) - Revert early bridge resource set up to fix resource assignment failures that broke at least alpha boot and Snapdragon ath12k WiFi (Ilpo Järvinen) - Implement VMD .irq_startup()/.irq_shutdown() to fix IRQ issues that caused boot crashes and broken devices below VMD (Inochi Amaoto) - Select CONFIG_SCREEN_INFO on X86 to fix black screen on boot when SCREEN_INFO not selected (Mario Limonciello) * tag 'pci-v6.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/VGA: Select SCREEN_INFO on X86 PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() PCI: Revert early bridge resource set up PCI: cadence: Search for MSI Capability with correct ID commit ea0bdf2b945e91137cc465d3833aeb659ba93d79 Merge: 2953fb65481b26 a4bbb493a3247e Author: Linus Torvalds Date: Sat Oct 18 08:22:07 2025 -1000 Merge tag 'cxl-fixes-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link fixes from Dave Jiang: "A small collection of CXL fixes. In addition to some misc fixes for the CXL subsystem, a number of fixes for CXL extended linear cache support are included to make it functional again. - Avoid missing port component registers setup due to dport enumeration failure - Add check for no entries in cxl_feature_info to address accessing invalid pointer. - Use %pa printk format to emit resource_size_t in validate_region_offset() CXL extended linear cache support fixes: - Fix setup of memory resource in cxl_acpi_set_cache_size() - Set range param for region_res_match_cxl_range() as const (addresses a compile warning for match_region_by_range() fix) - Fix match_region_by_range() to use region_res_match_cxl_range() - Subtract to find an hpa_alias0 in cxl_poison events to correct the alias math calculation" * tag 'cxl-fixes-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events cxl/region: Use %pa printk format to emit resource_size_t cxl: Fix match_region_by_range() to use region_res_match_cxl_range() cxl: Set range param for region_res_match_cxl_range() as const cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size() cxl/features: Add check for no entries in cxl_feature_info cxl/port: Avoid missing port component registers setup commit 2953fb65481b262514ac13f24ffbc70eeace68c6 Merge: d303caf5caf453 ed80cc4667ac99 Author: Linus Torvalds Date: Sat Oct 18 08:18:18 2025 -1000 Merge tag 'hid-for-linus-2025101701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for sticky fingers handling in hid-multitouch (Benjamin Tissoires) - fix for reporting of 0 battery levels (Dmitry Torokhov) - build fix for hid-haptic in certain configurations (Jonathan Denose) - improved probe and avoiding spamming kernel log by hid-nintendo (Vicki Pfau) - fix for OOB in hid-cp2112 (Deepak Sharma) - interrupt handling fix for intel-thc-hid (Even Xu) - a couple of new device IDs and device-specific quirks * tag 'hid-for-linus-2025101701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL selftests/hid: add tests for missing release on the Dell Synaptics HID: multitouch: fix sticky fingers HID: multitouch: fix name of Stylus input devices HID: hid-input: only ignore 0 battery events for digitizers HID: hid-debug: Fix spelling mistake "Rechargable" -> "Rechargeable" HID: Kconfig: Fix build error from CONFIG_HID_HAPTIC HID: nintendo: Rate limit IMU compensation message HID: nintendo: Wait longer for initial probe HID: core: Add printk_ratelimited variants to hid_warn() etc HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel HID: quirks: avoid Cooler Master MM712 dongle wakeup bug HID: cp2112: Add parameter validation to data length HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection HID: intel-thc-hid: intel-quicki2c: Fix wrong type casting commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 Author: Roy Vegard Ovesen Date: Sat Oct 18 19:18:22 2025 +0200 ALSA: usb-audio: fix control pipe direction Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe(). Fixes: 8dc5efe3d17c ("ALSA: usb-audio: Add support for Presonus Studio 1810c") Signed-off-by: Roy Vegard Ovesen Link: https://patch.msgid.link/aPPL3tBFE_oU-JHv@ark Signed-off-by: Takashi Iwai commit d303caf5caf453da2abfd84d249d210aaffe9873 Merge: 847f242f7a44fb a1e83d4c0361f4 Author: Linus Torvalds Date: Sat Oct 18 08:00:43 2025 -1000 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Replace bpf_map_kmalloc_node() with kmalloc_nolock() to fix kmemleak imbalance in tracking of bpf_async_cb structures (Alexei Starovoitov) - Make selftests/bpf arg_parsing.c more robust to errors (Andrii Nakryiko) - Fix redefinition of 'off' as different kind of symbol when I40E driver is builtin (Brahmajit Das) - Do not disable preemption in bpf_test_run (Sahil Chandna) - Fix memory leak in __lookup_instance error path (Shardul Bankar) - Ensure test data is flushed to disk before reading it (Xing Guo) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Fix redefinition of 'off' as different kind of symbol bpf: Do not disable preemption in bpf_test_run(). bpf: Fix memory leak in __lookup_instance error path selftests: arg_parsing: Ensure data is flushed to disk before reading. bpf: Replace bpf_map_kmalloc_node() with kmalloc_nolock() to allocate bpf_async_cb structures. selftests/bpf: make arg_parsing.c more robust to crashes bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path commit 847f242f7a44fba5aab474534fc498033e48fd72 Merge: 2d07c6c2098805 2d8636119b9297 Author: Linus Torvalds Date: Sat Oct 18 07:23:59 2025 -1000 Merge tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat fixes from Namjae Jeon: - Fix out-of-bounds in FS_IOC_SETFSLABEL - Add validation for stream entry size to prevent infinite loop * tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix out-of-bounds in exfat_nls_to_ucs2() exfat: fix improper check of dentry.stream.valid_size commit 2d07c6c2098805054f84ce642587093bb8feaf8c Merge: 4ccb3a80002875 9bb3baa9d1604c Author: Linus Torvalds Date: Sat Oct 18 07:18:48 2025 -1000 Merge tag 'nfs-for-6.18-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix for FlexFiles mirror->dss allocation - Apply delay_retrans to async operations - Check if suid/sgid is cleared after a write when needed - Fix setting the state renewal timer for early mounts after a reboot * tag 'nfs-for-6.18-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS4: Fix state renewals missing after boot NFS: check if suid/sgid was cleared after a write as needed NFS4: Apply delay_retrans to async operations NFSv4/flexfiles: fix to allocate mirror->dss before use commit 4ccb3a800028759b2ba39857cb180589575d7445 Merge: 02e5f74ef08d3e 3c15a6df61bab0 Author: Linus Torvalds Date: Sat Oct 18 07:11:32 2025 -1000 Merge tag '6.18-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "smb client fixes, security and smbdirect improvements, and some minor cleanup: - Important OOB DFS fix - Fix various potential tcon refcount leaks - smbdirect (RDMA) fixes (following up from test event a few weeks ago): - Fixes to improve and simplify handling of memory lifetime of smbdirect_mr_io structures, when a connection gets disconnected - Make sure we really wait to reach SMBDIRECT_SOCKET_DISCONNECTED before destroying resources - Make sure the send/recv submission/completion queues are large enough to avoid ib_post_send() from failing under pressure - convert cifs.ko to use the recommended crypto libraries (instead of crypto_shash), this also can improve performance - Three small cleanup patches" * tag '6.18-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (24 commits) smb: client: Consolidate cmac(aes) shash allocation smb: client: Remove obsolete crypto_shash allocations smb: client: Use HMAC-MD5 library for NTLMv2 smb: client: Use MD5 library for SMB1 signature calculation smb: client: Use MD5 library for M-F symlink hashing smb: client: Use HMAC-SHA256 library for SMB2 signature calculation smb: client: Use HMAC-SHA256 library for key generation smb: client: Use SHA-512 library for SMB3.1.1 preauth hash cifs: parse_dfs_referrals: prevent oob on malformed input smb: client: Fix refcount leak for cifs_sb_tlink smb: client: let smbd_destroy() wait for SMBDIRECT_SOCKET_DISCONNECTED smb: move some duplicate definitions to common/cifsglob.h smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered smb: client: let destroy_mr_list() call ib_dereg_mr() before ib_dma_unmap_sg() smb: client: call ib_dma_unmap_sg if mr->sgt.nents is not 0 smb: client: improve logic in smbd_deregister_mr() smb: client: improve logic in smbd_register_mr() smb: client: improve logic in allocate_mr_list() smb: client: let destroy_mr_list() remove locked from the list smb: client: let destroy_mr_list() call list_del(&mr->list) ... commit 02e5f74ef08d3e6afec438d571487d0d0cec3c48 Merge: 0e622c4b0e02ca 4361f5aa8bfcec Author: Linus Torvalds Date: Sat Oct 18 07:07:14 2025 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix the handling of ZCR_EL2 in NV VMs - Pick the correct translation regime when doing a PTW on the back of a SEA - Prevent userspace from injecting an event into a vcpu that isn't initialised yet - Move timer save/restore to the sysreg handling code, fixing EL2 timer access in the process - Add FGT-based trapping of MDSCR_EL1 to reduce the overhead of debug - Fix trapping configuration when the host isn't GICv3 - Improve the detection of HCR_EL2.E2H being RES1 - Drop a spurious 'break' statement in the S1 PTW - Don't try to access SPE when owned by EL3 Documentation updates: - Document the failure modes of event injection - Document that a GICv3 guest can be created on a GICv5 host with FEAT_GCIE_LEGACY Selftest improvements: - Add a selftest for the effective value of HCR_EL2.AMO - Address build warning in the timer selftest when building with clang - Teach irqfd selftests about non-x86 architectures - Add missing sysregs to the set_id_regs selftest - Fix vcpu allocation in the vgic_lpi_stress selftest - Correctly enable interrupts in the vgic_lpi_stress selftest x86: - Expand the KVM_PRE_FAULT_MEMORY selftest to add a regression test for the bug fixed by commit 3ccbf6f47098 ("KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault") - Don't try to get PMU capabilities from perf when running a CPU with hybrid CPUs/PMUs, as perf will rightly WARN. guest_memfd: - Rework KVM_CAP_GUEST_MEMFD_MMAP (newly introduced in 6.18) into a more generic KVM_CAP_GUEST_MEMFD_FLAGS - Add a guest_memfd INIT_SHARED flag and require userspace to explicitly set said flag to initialize memory as SHARED, irrespective of MMAP. The behavior merged in 6.18 is that enabling mmap() implicitly initializes memory as SHARED, which would result in an ABI collision for x86 CoCo VMs as their memory is currently always initialized PRIVATE. - Allow mmap() on guest_memfd for x86 CoCo VMs, i.e. on VMs with private memory, to enable testing such setups, i.e. to hopefully flush out any other lurking ABI issues before 6.18 is officially released. - Add testcases to the guest_memfd selftest to cover guest_memfd without MMAP, and host userspace accesses to mmap()'d private memory" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (46 commits) arm64: Revamp HCR_EL2.E2H RES1 detection KVM: arm64: nv: Use FGT write trap of MDSCR_EL1 when available KVM: arm64: Compute per-vCPU FGTs at vcpu_load() KVM: arm64: selftests: Fix misleading comment about virtual timer encoding KVM: arm64: selftests: Add an E2H=0-specific configuration to get_reg_list KVM: arm64: selftests: Make dependencies on VHE-specific registers explicit KVM: arm64: Kill leftovers of ad-hoc timer userspace access KVM: arm64: Fix WFxT handling of nested virt KVM: arm64: Move CNT*CT_EL0 userspace accessors to generic infrastructure KVM: arm64: Move CNT*_CVAL_EL0 userspace accessors to generic infrastructure KVM: arm64: Move CNT*_CTL_EL0 userspace accessors to generic infrastructure KVM: arm64: Add timer UAPI workaround to sysreg infrastructure KVM: arm64: Make timer_set_offset() generally accessible KVM: arm64: Replace timer context vcpu pointer with timer_id KVM: arm64: Introduce timer_context_to_vcpu() helper KVM: arm64: Hide CNTHV_*_EL2 from userspace for nVHE guests Documentation: KVM: Update GICv3 docs for GICv5 hosts KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests KVM: arm64: selftests: Actually enable IRQs in vgic_lpi_stress KVM: arm64: selftests: Allocate vcpus with correct size ... commit 0e622c4b0e02ca1946a9fadb63f00ef733e8ba28 Merge: 959f018f97e63f 0843ba458439f3 Author: Linus Torvalds Date: Sat Oct 18 07:02:28 2025 -1000 Merge tag 'powerpc-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix to handle NULL pointer dereference at irq domain teardown - Fix for handling extraction of struct xive_irq_data - Fix to skip parameter area allocation when fadump disabled Thanks to Ganesh Goudar, Hari Bathini, Nam Cao, Ritesh Harjani (IBM), Sourabh Jain, and Venkat Rao Bagalkote, * tag 'powerpc-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/fadump: skip parameter area allocation when fadump is disabled powerpc, ocxl: Fix extraction of struct xive_irq_data powerpc/pseries/msi: Fix NULL pointer dereference at irq domain teardown commit 959f018f97e63fc188c6a7519baa6dc2d1248828 Merge: f406055cb18c6e 86f54f9b6c17d6 Author: Linus Torvalds Date: Sat Oct 18 06:59:25 2025 -1000 Merge tag 'slab-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fixes for two bugs that can be triggered when debugging options are enabled (Hao Ge, Vlastimil Babka) * tag 'slab-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL slab: fix clearing freelist in free_deferred_objects() commit 1386d16761c0b569efedb998f56c1ae048a086e2 Author: J-Donald Tournier Date: Sat Oct 18 15:52:26 2025 +0100 ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10 This laptop requires the same quirk as Lenovo Yoga9 14IAP7 for fixing the bass speaker problems. Use HDA_CODEC_QUIRK to match on the codec SSID to avoid conflict with the Lenovo Legion Slim 7 16IRH8, which has the same PCI SSID. Signed-off-by: J-Donald Tournier Link: https://patch.msgid.link/20251018145322.39119-1-jdournier@gmail.com Signed-off-by: Takashi Iwai commit b7776a802f2f80139f96530a489dd00fd7089eda Author: Paul Walmsley Date: Sat Oct 18 09:32:12 2025 -0600 riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() Resolve this smatch warning: arch/riscv/kernel/sys_hwprobe.c:50 hwprobe_arch_id() error: uninitialized symbol 'cpu_id'. This could happen if hwprobe_arch_id() was called with a key ID of something other than MVENDORID, MIMPID, and MARCHID. This does not happen in the current codebase. The only caller of hwprobe_arch_id() is a function that only passes one of those three key IDs. For the sake of reducing static analyzer warning noise, and in the unlikely event that hwprobe_arch_id() is someday called with some other key ID, validate hwprobe_arch_id()'s input to ensure that 'cpu_id' is always initialized before use. Fixes: ea3de9ce8aa280 ("RISC-V: Add a syscall for HW probing") Cc: Evan Green Signed-off-by: Paul Walmsley Link: https://lore.kernel.org/r/cf5a13ec-19d0-9862-059b-943f36107bf3@kernel.org commit 2dc99ea2727640b2fe12f9aa0e38ea2fc3cbb92d Author: Paul Walmsley Date: Sat Oct 18 00:31:11 2025 -0600 riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb() In has_thead_homogeneous_vlenb(), smatch detected that the vlenb variable could be used while uninitialized. It appears that this could happen if no CPUs described in DT have the "thead,vlenb" property. Fix by initializing vlenb to 0, which will keep thead_vlenb_of set to 0 (as it was statically initialized). This in turn will cause riscv_v_setup_vsize() to fall back to CSR probing - the desired result if thead,vlenb isn't provided in the DT data. While here, fix a nearby comment typo. Cc: stable@vger.kernel.org Cc: Charlie Jenkins Fixes: 377be47f90e41 ("riscv: vector: Use vlenb from DT for thead") Signed-off-by: Paul Walmsley Link: https://lore.kernel.org/r/22674afb-2fe8-2a83-1818-4c37bd554579@kernel.org commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 Author: Valek Andrej Date: Tue Oct 14 09:13:44 2025 +0200 iio: accel: fix ADXL355 startup race condition There is an race-condition where device is not full working after SW reset. Therefore it's necessary to wait some time after reset and verify shadow registers values by reading and comparing the values before/after reset. This mechanism is described in datasheet at least from revision D. Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355") Signed-off-by: Valek Andrej Signed-off-by: Kessler Markus Cc: Signed-off-by: Jonathan Cameron commit 673e75ea55df5f437471371a970b31df9d0b852c Merge: 3a8660878839fa 85d7dda5a9f665 Author: Rafael J. Wysocki Date: Sat Oct 18 14:42:39 2025 +0200 Merge tag 'amd-pstate-v6.18-2025-10-15' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate 6.18 content (10/15/25) from Mario Limonciello: "Fix for EPP value in wrong state after S4" * tag 'amd-pstate-v6.18-2025-10-15' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit dbfdaeb381a49a7bc753d18e2876bc56a15e01cc Author: Stuart Yoder Date: Sat Oct 18 14:25:18 2025 +0300 tpm_crb: Add idle support for the Arm FF-A start method According to the CRB over FF-A specification [1], a TPM that implements the ABI must comply with the TCG PTP specification. This requires support for the Idle and Ready states. This patch implements CRB control area requests for goIdle and cmdReady on FF-A based TPMs. The FF-A message used to notify the TPM of CRB updates includes a locality parameter, which provides a hint to the TPM about which locality modified the CRB. This patch adds a locality parameter to __crb_go_idle() and __crb_cmd_ready() to support this. [1] https://developer.arm.com/documentation/den0138/latest/ Signed-off-by: Stuart Yoder Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4361f5aa8bfcecbab3fc8db987482b9e08115a6a Merge: 5d26eaae15fb5c 505f5224b197b7 Author: Paolo Bonzini Date: Sat Oct 18 10:25:43 2025 +0200 Merge tag 'kvm-x86-fixes-6.18-rc2' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.18: - Expand the KVM_PRE_FAULT_MEMORY selftest to add a regression test for the bug fixed by commit 3ccbf6f47098 ("KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault") - Don't try to get PMU capabbilities from perf when running a CPU with hybrid CPUs/PMUs, as perf will rightly WARN. - Rework KVM_CAP_GUEST_MEMFD_MMAP (newly introduced in 6.18) into a more generic KVM_CAP_GUEST_MEMFD_FLAGS - Add a guest_memfd INIT_SHARED flag and require userspace to explicitly set said flag to initialize memory as SHARED, irrespective of MMAP. The behavior merged in 6.18 is that enabling mmap() implicitly initializes memory as SHARED, which would result in an ABI collision for x86 CoCo VMs as their memory is currently always initialized PRIVATE. - Allow mmap() on guest_memfd for x86 CoCo VMs, i.e. on VMs with private memory, to enable testing such setups, i.e. to hopefully flush out any other lurking ABI issues before 6.18 is officially released. - Add testcases to the guest_memfd selftest to cover guest_memfd without MMAP, and host userspace accesses to mmap()'d private memory. commit 5d26eaae15fb5c190164362a3e19081935574efc Merge: 3a8660878839fa ca88ecdce5f518 Author: Paolo Bonzini Date: Sat Oct 18 10:25:31 2025 +0200 Merge tag 'kvmarm-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.18, take #1 Improvements and bug fixes: - Fix the handling of ZCR_EL2 in NV VMs (20250926194108.84093-1-oliver.upton@linux.dev) - Pick the correct translation regime when doing a PTW on the back of a SEA (20250926224246.731748-1-oliver.upton@linux.dev) - Prevent userspace from injecting an event into a vcpu that isn't initialised yet (20250930085237.108326-1-oliver.upton@linux.dev) - Move timer save/restore to the sysreg handling code, fixing EL2 timer access in the process (20250929160458.3351788-1-maz@kernel.org) - Add FGT-based trapping of MDSCR_EL1 to reduce the overhead of debug (20250924235150.617451-1-oliver.upton@linux.dev) - Fix trapping configuration when the host isn't GICv3 (20251007160704.1673584-1-sascha.bischoff@arm.com) - Improve the detection of HCR_EL2.E2H being RES1 (20251009121239.29370-1-maz@kernel.org) - Drop a spurious 'break' statement in the S1 PTW (20250930135621.162050-1-osama.abdelkader@gmail.com) - Don't try to access SPE when owned by EL3 (20251010174707.1684200-1-mukesh.ojha@oss.qualcomm.com) Documentation updates: - Document the failure modes of event injection (20250930233620.124607-1-oliver.upton@linux.dev) - Document that a GICv3 guest can be created on a GICv5 host with FEAT_GCIE_LEGACY (20251007154848.1640444-1-sascha.bischoff@arm.com) Selftest improvements: - Add a selftest for the effective value of HCR_EL2.AMO (20250926224454.734066-1-oliver.upton@linux.dev) - Address build warning in the timer selftest when building with clang (20250926155838.2612205-1-seanjc@google.com) - Teach irq_fd selftests about non-x86 architectures (20250930193301.119859-1-oliver.upton@linux.dev) - Add missing sysregs to the set_id_regs selftest (20251012154352.61133-1-zenghui.yu@linux.dev) - Fix vcpu allocation in the vgic_lpi_stress selftest (20251008154520.54801-1-zenghui.yu@linux.dev) - Correctly enable interrupts in the vgic_lpi_stress selftest (20251007195254.260539-1-oliver.upton@linux.dev) commit 5d15d2ad36b0f7afab83ca9fc8a2a6e60cbe54c4 Author: Jingwei Wang Date: Mon Aug 11 22:20:06 2025 +0800 riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot The hwprobe vDSO data for some keys, like MISALIGNED_VECTOR_PERF, is determined by an asynchronous kthread. This can create a race condition where the kthread finishes after the vDSO data has already been populated, causing userspace to read stale values. To fix this race, a new 'ready' flag is added to the vDSO data, initialized to 'false' during arch_initcall_sync. This flag is checked by both the vDSO's user-space code and the riscv_hwprobe syscall. The syscall serves as a one-time gate, using a completion to wait for any pending probes before populating the data and setting the flag to 'true', thus ensuring userspace reads fresh values on its first request. Reported-by: Tsukasa OI Closes: https://lore.kernel.org/linux-riscv/760d637b-b13b-4518-b6bf-883d55d44e7f@irq.a4lg.com/ Fixes: e7c9d66e313b ("RISC-V: Report vector unaligned access speed hwprobe") Cc: Palmer Dabbelt Cc: Alexandre Ghiti Cc: Olof Johansson Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti Co-developed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt Signed-off-by: Jingwei Wang Link: https://lore.kernel.org/r/20250811142035.105820-1-wangjingwei@iscas.ac.cn [pjw@kernel.org: fix checkpatch issues] Signed-off-by: Paul Walmsley commit 492c513ec6de1ce51b5f033bd6c708e4b8e46ae4 Author: Paul Walmsley Date: Tue Oct 14 17:25:26 2025 -0600 riscv: add a forward declaration for cpuinfo_op Add a forward declaration for cpuinfo_op to resolve a sparse warning. Link: https://lore.kernel.org/r/b831f349-5d0c-f7ac-8362-acb20bc6221a@kernel.org Signed-off-by: Paul Walmsley commit d2721bb165b3ee00dd23525885381af07fec852a Author: Anup Patel Date: Tue Oct 14 22:00:09 2025 +0530 RISC-V: Don't print details of CPUs disabled in DT Early boot stages may disable CPU DT nodes for unavailable CPUs based on SKU, pinstraps, eFuse, etc. Currently, the riscv_early_of_processor_hartid() prints details of a CPU if it is disabled in DT which has no value and gives a false impression to the users that there some issue with the CPU. Fixes: e3d794d555cd ("riscv: treat cpu devicetree nodes without status as enabled") Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20251014163009.182381-1-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 768e054de01bef8701c24ec49309e57e0167af44 Author: Samuel Holland Date: Wed Oct 15 15:56:00 2025 -0700 riscv: Remove the PER_CPU_OFFSET_SHIFT macro __per_cpu_offset is an array of unsigned long, so we can reuse the existing RISCV_LGPTR macro. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251015225604.3860409-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit 5898fc01ff344075e4332aa9abeb0841c85e7e51 Author: Samuel Holland Date: Wed Oct 15 16:33:24 2025 -0700 riscv: mm: Define MAX_POSSIBLE_PHYSMEM_BITS for zsmalloc This definition is used by zsmalloc to optimize memory allocation. On riscv64, it is the same as MAX_PHYSMEM_BITS from asm/sparsemem.h, but that definition depends on CONFIG_SPARSEMEM. The correct definition is already provided for riscv32. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251015233327.3885003-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit 223bfc4d403c5e4841f9d2b5be88a6e236942e4e Author: Samuel Holland Date: Wed Oct 15 17:32:05 2025 -0700 riscv: Register IPI IRQs with unique names This allows different IPIs to be distinguished in tracing output. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251016003244.3910332-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit e7b969cbe302d49032d4c2bb36c57c9c623ebfdc Author: Sunil V L Date: Mon Oct 13 23:49:47 2025 +0530 ACPI: RIMT: Fix unused function warnings when CONFIG_IOMMU_API is disabled When CONFIG_IOMMU_API is disabled, some functions defined outside its conditional scope become unused, triggering compiler warnings reported by the kernel test robot. Move these function definitions inside the #ifdef CONFIG_IOMMU_API block to prevent unused function warnings when the configuration is disabled. Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280031.8Sjkr4bh-lkp@intel.com/ Signed-off-by: Sunil V L Link: https://lore.kernel.org/r/20251013181947.261759-1-sunilvl@ventanamicro.com commit ca525d53f994d45c8140968b571372c45f555ac1 Author: Anup Patel Date: Fri Oct 17 21:30:05 2025 -0600 RISC-V: Define pgprot_dmacoherent() for non-coherent devices The pgprot_dmacoherent() is used when allocating memory for non-coherent devices and by default pgprot_dmacoherent() is same as pgprot_noncached() unless architecture overrides it. Currently, there is no pgprot_dmacoherent() definition for RISC-V hence non-coherent device memory is being mapped as IO thereby making CPU access to such memory slow. Define pgprot_dmacoherent() to be same as pgprot_writecombine() for RISC-V so that CPU access non-coherent device memory as NOCACHE which is better than accessing it as IO. Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Signed-off-by: Anup Patel Tested-by: Han Gao Tested-by: Guo Ren (Alibaba DAMO Academy) Link: https://lore.kernel.org/r/20250820152316.1012757-1-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 69aeb507312306f73495598a055293fa749d454e Author: Seungjin Bae Date: Fri Oct 17 15:36:31 2025 -0700 Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Seungjin Bae Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ffff5c8fc2af2218a3332b3d5b97654599d50cde Author: Aleksander Jan Bajkowski Date: Thu Oct 16 21:22:52 2025 +0200 net: phy: realtek: fix rtl8221b-vm-cg name When splitting the RTL8221B-VM-CG into C22 and C45 variants, the name was accidentally changed to RTL8221B-VN-CG. This patch brings back the previous part number. Fixes: ad5ce743a6b0 ("net: phy: realtek: Add driver instances for rtl8221b via Clause 45") Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016192325.2306757-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit 902e81e679d86846a2404630d349709ad9372d0d Author: Ioana Ciornei Date: Thu Oct 16 16:58:07 2025 +0300 dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path The blamed commit increased the needed headroom to account for alignment. This means that the size required to always align a Tx buffer was added inside the dpaa2_eth_needed_headroom() function. By doing that, a manual adjustment of the pointer passed to PTR_ALIGN() was no longer correct since the 'buffer_start' variable was already pointing to the start of the skb's memory. The behavior of the dpaa2-eth driver without this patch was to drop frames on Tx even when the headroom was matching the 128 bytes necessary. Fix this by removing the manual adjust of 'buffer_start' from the PTR_MODE call. Closes: https://lore.kernel.org/netdev/70f0dcd9-1906-4d13-82df-7bbbbe7194c6@app.fastmail.com/T/#u Fixes: f422abe3f23d ("dpaa2-eth: increase the needed headroom to account for alignment") Signed-off-by: Ioana Ciornei Tested-by: Mathew McBride Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016135807.360978-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski commit e0caeb24f538c3c9c94f471882ceeb43d9dc2739 Author: Tonghao Zhang Date: Thu Oct 16 20:51:36 2025 +0800 net: bonding: update the slave array for broadcast mode This patch fixes ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad"). Before this commit, on the broadcast mode, all devices were traversed using the bond_for_each_slave_rcu. This patch supports traversing devices by using all_slaves. Therefore, we need to update the slave array when enslave or release slave. Fixes: ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad") Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Reported-by: Jiri Slaby Tested-by: Jiri Slaby Link: https://lore.kernel.org/all/a97e6e1e-81bc-4a79-8352-9e4794b0d2ca@kernel.org/ Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Reviewed-by: Nikolay Aleksandrov Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251016125136.16568-1-tonghao@bamaicloud.com Signed-off-by: Jakub Kicinski commit cb74f8c952508bc85ec9583fa7da31c9b1440f26 Author: Bagas Sanjaya Date: Thu Oct 16 16:39:37 2025 +0700 Documentation: net: net_failover: Separate cloud-ifupdown-helper and reattach-vf.sh code blocks marker cloud-ifupdown-helper patch and reattach-vf.sh script are rendered in htmldocs output as normal paragraphs instead of literal code blocks due to missing separator from respective code block marker. Add it. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016093936.29442-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit e59bc32df2e989f034623a580e30a2a72af33b3f Author: Wei Fang Date: Thu Oct 16 16:01:31 2025 +0800 net: enetc: correct the value of ENETC_RXB_TRUESIZE The ENETC RX ring uses the page halves flipping mechanism, each page is split into two halves for the RX ring to use. And ENETC_RXB_TRUESIZE is defined to 2048 to indicate the size of half a page. However, the page size is configurable, for ARM64 platform, PAGE_SIZE is default to 4K, but it could be configured to 16K or 64K. When PAGE_SIZE is set to 16K or 64K, ENETC_RXB_TRUESIZE is not correct, and the RX ring will always use the first half of the page. This is not consistent with the description in the relevant kernel doc and commit messages. This issue is invisible in most cases, but if users want to increase PAGE_SIZE to receive a Jumbo frame with a single buffer for some use cases, it will not work as expected, because the buffer size of each RX BD is fixed to 2048 bytes. Based on the above two points, we expect to correct ENETC_RXB_TRUESIZE to (PAGE_SIZE >> 1), as described in the comment. Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20251016080131.3127122-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 50bd33f6b3922a6b760aa30d409cae891cec8fb5 Author: Jianpeng Chang Date: Wed Oct 15 10:14:27 2025 +0800 net: enetc: fix the deadlock of enetc_mdio_lock After applying the workaround for err050089, the LS1028A platform experiences RCU stalls on RT kernel. This issue is caused by the recursive acquisition of the read lock enetc_mdio_lock. Here list some of the call stacks identified under the enetc_poll path that may lead to a deadlock: enetc_poll -> enetc_lock_mdio -> enetc_clean_rx_ring OR napi_complete_done -> napi_gro_receive -> enetc_start_xmit -> enetc_lock_mdio -> enetc_map_tx_buffs -> enetc_unlock_mdio -> enetc_unlock_mdio After enetc_poll acquires the read lock, a higher-priority writer attempts to acquire the lock, causing preemption. The writer detects that a read lock is already held and is scheduled out. However, readers under enetc_poll cannot acquire the read lock again because a writer is already waiting, leading to a thread hang. Currently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent recursive lock acquisition. Fixes: 6d36ecdbc441 ("net: enetc: take the MDIO lock only once per NAPI poll cycle") Signed-off-by: Jianpeng Chang Acked-by: Wei Fang Link: https://patch.msgid.link/20251015021427.180757-1-jianpeng.chang.cn@windriver.com Signed-off-by: Jakub Kicinski commit f406055cb18c6e299c4a783fc1effeb16be41803 Merge: fe69107ec7d8b9 ea0d55ae4b3207 Author: Linus Torvalds Date: Fri Oct 17 13:04:21 2025 -1000 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Explicitly encode the XZR register if the value passed to write_sysreg_s() is 0. The GIC CDEOI instruction is encoded as a system register write with XZR as the source register. However, clang does not honour the "Z" register constraint, leading to incorrect code generation - Ensure the interrupts (DAIF.IF) are unmasked when completing single-step of a suspended breakpoint before calling exit_to_user_mode(). With pseudo-NMIs, interrupts are (additionally) masked at the PMR_EL1 register, handled by local_irq_*() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: debug: always unmask interrupts in el0_softstp() arm64/sysreg: Fix GIC CDEOI instruction encoding commit fe69107ec7d8b946ab413cfe118984dac8f1a0d8 Merge: 6f3b6e91f7201e 852947be66b826 Author: Linus Torvalds Date: Fri Oct 17 12:59:31 2025 -1000 Merge tag 'riscv-for-linux-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Disable CFI with Rust for any platform other than x86 and ARM64 - Keep task mm_cpumasks up-to-date to avoid triggering M-mode firmware warnings if the kernel tries to send an IPI to an offline CPU - Improve kprobe address validation performance and avoid desyncs (following x86) - Avoid duplicate device probes by avoiding DT hardware probing when ACPI is enabled in early boot - Use the correct set of dependencies for CONFIG_ARCH_HAS_ELF_CORE_EFLAGS, avoiding an allnoconfig warning - Fix a few other minor issues * tag 'riscv-for-linux-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: kprobes: convert one final __ASSEMBLY__ to __ASSEMBLER__ riscv: Respect dependencies of ARCH_HAS_ELF_CORE_EFLAGS riscv: acpi: avoid errors caused by probing DT devices when ACPI is used riscv: kprobes: Fix probe address validation riscv: entry: fix typo in comment 'instruciton' -> 'instruction' RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors riscv: kgdb: Ensure that BUFMAX > NUMREGBYTES rust: cfi: only 64-bit arm and x86 support CFI_CLANG commit cfec502b3d091ff7c24df6ccf8079470584315a0 Author: Danilo Krummrich Date: Thu Oct 16 15:31:44 2025 +0200 rust: device: fix device context of Device::parent() Regardless of the DeviceContext of a device, we can't give any guarantees about the DeviceContext of its parent device. This is very subtle, since it's only caused by a simple typo, i.e. Self::from_raw(parent) which preserves the DeviceContext in this case, vs. Device::from_raw(parent) which discards the DeviceContext. (I should have noticed it doing the correct thing in auxiliary::Device subsequently, but somehow missed it.) Hence, fix both Device::parent() and auxiliary::Device::parent(). Cc: stable@vger.kernel.org Fixes: a4c9f71e3440 ("rust: device: implement Device::parent()") Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Acked-by: Greg Kroah-Hartman Signed-off-by: Danilo Krummrich commit a1e83d4c0361f4b0e3b7ef8b603bf5e5ef60af86 Author: Brahmajit Das Date: Fri Oct 17 22:45:51 2025 +0530 selftests/bpf: Fix redefinition of 'off' as different kind of symbol This fixes the following build error CLNG-BPF [test_progs] verifier_global_ptr_args.bpf.o progs/verifier_global_ptr_args.c:228:5: error: redefinition of 'off' as different kind of symbol 228 | u32 off; | ^ The symbol 'off' was previously defined in tools/testing/selftests/bpf/tools/include/vmlinux.h, which includes an enum i40e_ptp_gpio_pin_state from drivers/net/ethernet/intel/i40e/i40e_ptp.c: enum i40e_ptp_gpio_pin_state { end = -2, invalid = -1, off = 0, in_A = 1, in_B = 2, out_A = 3, out_B = 4, }; This enum is included when CONFIG_I40E is enabled. As of commit 032676ff8217 ("LoongArch: Update Loongson-3 default config file"), CONFIG_I40E is set in the defconfig, which leads to the conflict. Renaming the local variable avoids the redefinition and allows the build to succeed. Suggested-by: Yonghong Song Signed-off-by: Brahmajit Das Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251017171551.53142-1-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 7c33e97a6ef5d84e98b892c3e00c6d1678d20395 Author: Sahil Chandna Date: Wed Oct 15 00:26:35 2025 +0530 bpf: Do not disable preemption in bpf_test_run(). The timer mode is initialized to NO_PREEMPT mode by default, this disables preemption and force execution in atomic context causing issue on PREEMPT_RT configurations when invoking spin_lock_bh(), leading to the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6107, name: syz.0.17 preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 Preemption disabled at: [] bpf_test_timer_enter+0xf8/0x140 net/bpf/test_run.c:42 Fix this, by removing NO_PREEMPT/NO_MIGRATE mode check. Also, the test timer context no longer needs explicit calls to migrate_disable()/migrate_enable() with rcu_read_lock()/rcu_read_unlock(). Use helpers rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() instead. Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1f1fbecb9413cdbfbef8 Suggested-by: Yonghong Song Suggested-by: Menglong Dong Acked-by: Yonghong Song Tested-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com Co-developed-by: Brahmajit Das Signed-off-by: Brahmajit Das Signed-off-by: Sahil Chandna Link: https://lore.kernel.org/r/20251014185635.10300-1-chandna.sahil@gmail.com Signed-off-by: Alexei Starovoitov commit ea0d55ae4b3207c33691a73da3443b1fd379f1d2 Author: Ada Couprie Diaz Date: Tue Oct 14 10:25:36 2025 +0100 arm64: debug: always unmask interrupts in el0_softstp() We intend that EL0 exception handlers unmask all DAIF exceptions before calling exit_to_user_mode(). When completing single-step of a suspended breakpoint, we do not call local_daif_restore(DAIF_PROCCTX) before calling exit_to_user_mode(), leaving all DAIF exceptions masked. When pseudo-NMIs are not in use this is benign. When pseudo-NMIs are in use, this is unsound. At this point interrupts are masked by both DAIF.IF and PMR_EL1, and subsequent irq flag manipulation may not work correctly. For example, a subsequent local_irq_enable() within exit_to_user_mode_loop() will only unmask interrupts via PMR_EL1 (leaving those masked via DAIF.IF), and anything depending on interrupts being unmasked (e.g. delivery of signals) will not work correctly. This was detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING. Move the call to `try_step_suspended_breakpoints()` outside of the check so that interrupts can be unmasked even if we don't call the step handler. Fixes: 0ac7584c08ce ("arm64: debug: split single stepping exception entry") Cc: # 6.17 Signed-off-by: Ada Couprie Diaz Acked-by: Mark Rutland [catalin.marinas@arm.com: added Mark's rewritten commit log and some whitespace] Signed-off-by: Catalin Marinas commit e9ad390a4812fd60c1da46823f7a6f84f2411f0c Author: Lorenzo Pieralisi Date: Tue Oct 7 12:26:00 2025 +0200 arm64/sysreg: Fix GIC CDEOI instruction encoding The GIC CDEOI system instruction requires the Rt field to be set to 0b11111 otherwise the instruction behaviour becomes CONSTRAINED UNPREDICTABLE. Currenly, its usage is encoded as a system register write, with a constant 0 value: write_sysreg_s(0, GICV5_OP_GIC_CDEOI) While compiling with GCC, the 0 constant value, through these asm constraints and modifiers ('x' modifier and 'Z' constraint combo): asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); forces the compiler to issue the XZR register for the MSR operation (ie that corresponds to Rt == 0b11111) issuing the right instruction encoding. Unfortunately LLVM does not yet understand that modifier/constraint combo so it ends up issuing a different register from XZR for the MSR source, which in turns means that it encodes the GIC CDEOI instruction wrongly and the instruction behaviour becomes CONSTRAINED UNPREDICTABLE that we must prevent. Add a conditional to write_sysreg_s() macro that detects whether it is passed a constant 0 value and issues an MSR write with XZR as source register - explicitly doing what the asm modifier/constraint is meant to achieve through constraints/modifiers, fixing the LLVM compilation issue. Fixes: 7ec80fb3f025 ("irqchip/gic-v5: Add GICv5 PPI support") Suggested-by: Catalin Marinas Signed-off-by: Lorenzo Pieralisi Acked-by: Marc Zyngier Cc: stable@vger.kernel.org Cc: Sascha Bischoff Cc: Will Deacon Cc: Mark Rutland Cc: Marc Zyngier Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 1fabe43b4e1a97597ec5d5ffcd2b7cf96e654b8f Author: Ting-Chang Hou Date: Thu Oct 16 15:53:51 2025 +0800 btrfs: send: fix duplicated rmdir operations when using extrefs Commit 29d6d30f5c8a ("Btrfs: send, don't send rmdir for same target multiple times") has fixed an issue that a send stream contained a rmdir operation for the same directory multiple times. After that fix we keep track of the last directory for which we sent a rmdir operation and compare with it before sending a rmdir for the parent inode of a deleted hardlink we are processing. But there is still a corner case that in between rmdir dir operations for the same inode we find deleted hardlinks for other parent inodes, so tracking just the last inode for which we sent a rmdir operation is not enough. Hardlinks of a file in the same directory are stored in the same INODE_REF item, but if the number of hardlinks is too large and can not fit in a leaf, we use INODE_EXTREF items to store them. The key of an INODE_EXTREF item is (inode_id, INODE_EXTREF, hash[name, parent ino]), so between two hardlinks for the same parent directory, we can find others for other parent directories. For example for the reproducer below we get the following (from a btrfs inspect-internal dump-tree output): item 0 key (259 INODE_EXTREF 2309449) itemoff 16257 itemsize 26 index 6925 parent 257 namelen 8 name: foo.6923 item 1 key (259 INODE_EXTREF 2311350) itemoff 16231 itemsize 26 index 6588 parent 258 namelen 8 name: foo.6587 item 2 key (259 INODE_EXTREF 2457395) itemoff 16205 itemsize 26 index 6611 parent 257 namelen 8 name: foo.6609 (...) So tracking the last directory's inode number does not work in this case since we process a link for parent inode 257, then for 258 and then back again for 257, and that second time we process a deleted link for 257 we think we have not yet sent a rmdir operation. Fix this by using a rbtree to keep track of all the directories for which we have already sent rmdir operations, and add those directories to the 'check_dirs' ref list in process_recorded_refs() only if the directory is not yet in the rbtree, otherwise skip it since it means we have already sent a rmdir operation for that directory. The following test script reproduces the problem: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT mkdir $MNT/a $MNT/b echo 123 > $MNT/a/foo for ((i = 1; i <= 1000; i++)); do ln $MNT/a/foo $MNT/a/foo.$i ln $MNT/a/foo $MNT/b/foo.$i done btrfs subvolume snapshot -r $MNT $MNT/snap1 btrfs send $MNT/snap1 -f /tmp/base.send rm -r $MNT/a $MNT/b btrfs subvolume snapshot -r $MNT $MNT/snap2 btrfs send -p $MNT/snap1 $MNT/snap2 -f /tmp/incremental.send umount $MNT mkfs.btrfs -f $DEV mount $DEV $MNT btrfs receive $MNT -f /tmp/base.send btrfs receive $MNT -f /tmp/incremental.send rm -f /tmp/base.send /tmp/incremental.send umount $MNT When running it, it fails like this: $ ./test.sh (...) At subvol snap1 At snapshot snap2 ERROR: rmdir o257-9-0 failed: No such file or directory CC: Reviewed-by: Filipe Manana Signed-off-by: Ting-Chang Hou [ Updated changelog ] Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 17679ac6df6c4830ba711835aa8cf961be36cfa1 Author: Dewei Meng Date: Thu Oct 16 14:10:11 2025 +0800 btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() If fs_info->super_copy or fs_info->super_for_commit allocated failed in btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info(). Otherwise btrfs_check_leaked_roots() would access NULL pointer because fs_info->allocated_roots had not been initialised. syzkaller reported the following information: ------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcount_read include/linux/refcount.h:170 [inline] RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace: btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097 vfs_get_tree+0x98/0x320 fs/super.c:1759 do_new_mount+0x357/0x660 fs/namespace.c:3899 path_mount+0x716/0x19c0 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount fs/namespace.c:4427 [inline] __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...] Fixes: 3bb17a25bcb0 ("btrfs: add get_tree callback for new mount API") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Dewei Meng Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f3b6e91f7201e248d83232538db14d30100e9c7 Merge: 0c8df15f758a69 18d6b1743eafeb Author: Linus Torvalds Date: Fri Oct 17 08:45:54 2025 -0700 Merge tag 'io_uring-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Revert of a change that went into an older kernel, and which has been reported to cause a regression for some write workloads on LVM while a snapshop is being created - Fix a regression from this merge window, where some compilers (and/or certain .config options) would cause an earlier evaluations of a dereference which would then cause a NULL pointer dereference. I was only able to reproduce this with OPTIMIZE_FOR_SIZE=y, but David Howells hit it with just KASAN enabled. Depending on how things inlined, this makes sense - Fix for a missing lock around a mem region unregistration - Fix for ring resizing with the same placement after resize * tag 'io_uring-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rw: check for NULL io_br_sel when putting a buffer io_uring: fix unexpected placement on same size resizing io_uring: protect mem region deregistration Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" commit 0fbbcab7f9082cdc233da5e5e353f69830f11956 Author: Randy Dunlap Date: Fri Oct 17 00:07:42 2025 -0700 cgroup/misc: fix misc_res_type kernel-doc warning Format the kernel-doc for SCALE_HW_CALIB_INVALID correctly to avoid a kernel-doc warning: Warning: include/linux/misc_cgroup.h:26 Enum value 'MISC_CG_RES_TDX' not described in enum 'misc_res_type' Fixes: 7c035bea9407 ("KVM: TDX: Register TDX host key IDs to cgroup misc controller") Signed-off-by: Randy Dunlap Signed-off-by: Tejun Heo commit 0c8df15f758a69a7bf88ecf9b7f95dc7db2c463c Merge: cf1ea8854e4fb1 f0624c6646435c Author: Linus Torvalds Date: Fri Oct 17 08:31:26 2025 -0700 Merge tag 'block-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - iostats accounting fixed on multipath retries (Amit) - secure concatenation response fixup (Martin) - tls partial record fixup (Wilfred) - Fix for a lockdep reported issue with the elevator lock and blk group frozen operations - Fix for a regression in this merge window, where updating 'nr_requests' would not do the right thing for queues with shared tags * tag 'block-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme/tcp: handle tls partially sent records in write_space() block: Remove elevator_lock usage from blkg_conf frozen operations blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests() nvme-auth: update sc_c in host response nvme-multipath: Skip nr_active increments in RETRY disposition commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a Merge: 1422424187a548 7e8242405b94ce Author: Linus Torvalds Date: Fri Oct 17 08:22:20 2025 -0700 Merge tag 'mmc-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc cleanup from Ulf Hansson: "Move rpmb_frame struct and constants to rpmb common header This helps us to avoid sharing an immutable branch between our git trees. I was planning to send it before rc1, but I didn't make it" * tag 'mmc-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: rpmb: move rpmb_frame struct and constants to common header commit 1422424187a548c24825645410fb7f691c2df47f Merge: e96687c6d3b781 2a786348004b34 Author: Linus Torvalds Date: Fri Oct 17 08:20:10 2025 -0700 Merge tag 'sound-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are rather boring device-specific fixes and quirks: - A few fixes for missing NULL checks - ASoC NAU8821 fixes for jack and irq handling - Various fixes for ASoC TAS2781, IDT821034, sc8280xp, max9809x, wcd938x, and SoundWire - Usual HD-audio and USB-audio quirks" * tag 'sound-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (27 commits) ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx ALSA: usb-audio: fix vendor quirk for Logitech H390 ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails ASoC: max98090/91: fixed max98091 ALSA widget powering up/down ASoC: dt-bindings: Add compatible string fsl,imx-audio-tlv320 ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls ASoC: sdw_utils: add rt1321 part id to codec_info_list ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 ASoC: nau8821: Avoid unnecessary blocking in IRQ handler ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit ASoC: nau8821: Consistently clear interrupts before unmasking ASoC: nau8821: Generalize helper to clear IRQ status ASoC: nau8821: Cancel jdet_work before handling jack ejection ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver ASoC: qcom: sc8280xp: Add support for QCS615 ... commit e96687c6d3b7814e6516dfa732946d3f40142819 Merge: 389dfd9db63840 62cab426d0e340 Author: Linus Torvalds Date: Fri Oct 17 08:16:58 2025 -0700 Merge tag 'drm-fixes-2025-10-17' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "As per usual xe/amdgpu are the leaders, with some i915 and then a bunch of scattered fixes. There are a bunch of stability fixes for some older amdgpu cards. draw: - Avoid color truncation gpuvm: - Avoid kernel-doc warning sched: - Avoid double free i915: - Skip GuC communication warning if reset is in progress - Couple frontbuffer related fixes - Deactivate PSR only on LNL and when selective fetch enabled xe: - Increase global invalidation timeout to handle some workloads - Fix NPD while evicting BOs in an array of VM binds - Fix resizable BAR to account for possibly needing to move BARs other than the LMEMBAR - Fix error handling in xe_migrate_init() - Fix atomic fault handling with mixed mappings or if the page is already in VRAM - Enable media samplers power gating for platforms before Xe2 - Fix de-registering exec queue from GuC when unbinding - Ensure data migration to system if indicated by madvise with SVM - Fix kerneldoc for kunit change - Always account for cacheline alignment on migration - Drop bogus assertion on eviction amdgpu: - Backlight fix - SI fixes - CIK fix - Make CE support debug only - IP discovery fix - Ring reset fixes - GPUVM fault memory barrier fix - Drop unused structures in amdgpu_drm.h - JPEG debugfs fix - VRAM handling fixes for GPUs without VRAM - GC 12 MES fixes amdkfd: - MES fix ast: - Fix display output after reboot bridge: - lt9211: Fix version check panthor: - Fix MCU suspend qaic: - Init bootlog in correct order - Treat remaining == 0 as error in find_and_map_user_pages() - Lock access to DBC request queue rockchip: - vop2: Fix destination size in atomic check" * tag 'drm-fixes-2025-10-17' of https://gitlab.freedesktop.org/drm/kernel: (44 commits) drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies drm/xe/evict: drop bogus assert drm/xe/migrate: don't misalign current bytes drm/xe/kunit: Fix kerneldoc for parameterized tests drm/xe/svm: Ensure data will be migrated to system if indicated by madvise. drm/gpuvm: Fix kernel-doc warning for drm_gpuvm_map_req.map drm/i915/psr: Deactivate PSR only on LNL and when selective fetch enabled drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off accel/qaic: Synchronize access to DBC request queue head & tail pointer accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() accel/qaic: Fix bootlog initialization ordering drm/rockchip: vop2: use correct destination rectangle height check drm/draw: fix color truncation in drm_draw_fill24 drm/xe/guc: Check GuC running state before deregistering exec queue drm/xe: Enable media sampler power gating drm/xe: Handle mixed mappings and existing VRAM on atomic faults drm/xe/migrate: Fix an error path drm/xe: Move rebar to be done earlier drm/xe: Don't allow evicting of BOs in same VM in array of VM binds drm/xe: Increase global invalidation timeout to 1000us ... commit 389dfd9db6384026fef50afdbf91bcc41446e032 Merge: 98ac9cc4b4452e 867537094124b0 Author: Linus Torvalds Date: Fri Oct 17 08:12:19 2025 -0700 Merge tag 'i2c-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - PM cleanup after all prerequisites are merged with rc1 - usbio: missing addition after all dependencies are in - slimpro: DT binding schema conversion * tag 'i2c-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: Convert apm,xgene-slimpro-i2c to DT schema i2c: usbio: Add ACPI device-id for MTL-CVF devices i2c: Remove redundant pm_runtime_mark_last_busy() calls commit 2a786348004b34c5f61235d51c40c1c718b1f8f9 Author: Dawn Gardner Date: Thu Oct 16 15:42:06 2025 -0300 ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx This laptop uses the ALC285 codec, fixed by enabling the ALC285_FIXUP_HP_MUTE_LED quirk Signed-off-by: Dawn Gardner Link: https://patch.msgid.link/20251016184218.31508-3-dawn.auroali@gmail.com Signed-off-by: Takashi Iwai commit a78835b86a4414230e4cf9a9f16d22302cdb8388 Author: Mario Limonciello (AMD) Date: Mon Oct 13 17:08:26 2025 -0500 PCI/VGA: Select SCREEN_INFO on X86 commit 337bf13aa9dda ("PCI/VGA: Replace vga_is_firmware_default() with a screen info check") introduced an implicit dependency upon SCREEN_INFO by removing the open coded implementation. If a user didn't have CONFIG_SCREEN_INFO set, vga_is_firmware_default() would now return false. SCREEN_INFO is only used on X86 so add a conditional select for SCREEN_INFO to ensure that the VGA arbiter works as intended. Fixes: 337bf13aa9dda ("PCI/VGA: Replace vga_is_firmware_default() with a screen info check") Reported-by: Eric Biggers Closes: https://lore.kernel.org/linux-pci/20251012182302.GA3412@sol/ Suggested-by: Thomas Zimmermann Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Zimmermann Reviewed-by: Ilpo Järvinen Tested-by: Eric Biggers Link: https://patch.msgid.link/20251013220829.1536292-1-superm1@kernel.org commit e433110eb5bf067f74d3d15c5fb252206c66ae0b Author: Inochi Amaoto Date: Tue Oct 14 09:46:07 2025 +0800 PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() Since commit 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") set callback irq_startup() and irq_shutdown() of the struct pci_msi[x]_template, __irq_startup() will always invokes irq_startup() callback instead of irq_enable() callback overridden in vmd_init_dev_msi_info(). This will not start the IRQ correctly. Also override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info(), so the irq_startup() can invoke the real logic. Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") Reported-by: Kenneth Crudup Closes: https://lore.kernel.org/r/8a923590-5b3a-406f-a324-7bd1cf894d8f@panix.com/ Reported-by: Genes Lists Closes: https://lore.kernel.org/r/4b392af8847cc19720ffcd53865f60ab3edc56b3.camel@sapience.com Reported-by: Todd Brandt Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220658 Reported-by: Oliver Hartkopp Closes: https://lore.kernel.org/r/8d6887a5-60bc-423c-8f7a-87b4ab739f6a@hartkopp.net Reported-by: Hervé Signed-off-by: Inochi Amaoto Signed-off-by: Bjorn Helgaas Tested-by: Kenneth R. Crudup Tested-by: Genes Lists Tested-by: Oliver Hartkopp Tested-by: Todd Brandt Tested-by: Hervé Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251014014607.612586-1-inochiama@gmail.com commit 1d4e7d9f6b7e4e45ec8ca03ae1bbc6ae7165b6f0 Merge: 3a8660878839fa 3b63efa21bc6ac Author: Arnd Bergmann Date: Fri Oct 17 15:26:23 2025 +0200 Merge tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE QTEE fixes for v6.18 - Adds ARCH_QCOM dependency for the QTEE driver - Fixing return values for copy_from_user() failures - Guarding against potential off by one read * tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: QCOMTEE should depend on ARCH_QCOM tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails tee: qcom: prevent potential off by one read commit 4eabd0d8791eaf9a7b114ccbf56eb488aefe7b1f Author: Akash Goel Date: Fri Oct 17 11:29:22 2025 +0100 drm/panthor: Fix kernel panic on partial unmap of a GPU VA region This commit address a kernel panic issue that can happen if Userspace tries to partially unmap a GPU virtual region (aka drm_gpuva). The VM_BIND interface allows partial unmapping of a BO. Panthor driver pre-allocates memory for the new drm_gpuva structures that would be needed for the map/unmap operation, done using drm_gpuvm layer. It expected that only one new drm_gpuva would be needed on umap but a partial unmap can require 2 new drm_gpuva and that's why it ended up doing a NULL pointer dereference causing a kernel panic. Following dump was seen when partial unmap was exercised. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078 Mem abort info: ESR = 0x0000000096000046 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000088a863000 [000000000000078] pgd=080000088a842003, p4d=080000088a842003, pud=0800000884bf5003, pmd=0000000000000000 Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] lr : panthor_gpuva_sm_step_remap+0x6c/0x330 [panthor] sp : ffff800085d43970 x29: ffff800085d43970 x28: ffff00080363e440 x27: ffff0008090c6000 x26: 0000000000000030 x25: ffff800085d439f8 x24: ffff00080d402000 x23: ffff800085d43b60 x22: ffff800085d439e0 x21: ffff00080abdb180 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000010 x17: 6e656c202c303030 x16: 3666666666646466 x15: 393d61766f69202c x14: 312d3d7361203a70 x13: 303030323d6e656c x12: ffff80008324bf58 x11: 0000000000000003 x10: 0000000000000002 x9 : ffff8000801a6a9c x8 : ffff00080360b300 x7 : 0000000000000000 x6 : 000000088aa35fc7 x5 : fff1000080000000 x4 : ffff8000842ddd30 x3 : 0000000000000001 x2 : 0000000100000000 x1 : 0000000000000001 x0 : 0000000000000078 Call trace: panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] op_remap_cb.isra.22+0x50/0x80 __drm_gpuvm_sm_unmap+0x10c/0x1c8 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xb4/0x3d0 [panthor] panthor_vm_bind_exec_sync_op+0x154/0x278 [panthor] panthor_ioctl_vm_bind+0x160/0x4a0 [panthor] drm_ioctl_kernel+0xbc/0x138 drm_ioctl+0x240/0x500 __arm64_sys_ioctl+0xb0/0xf8 invoke_syscall+0x4c/0x110 el0_svc_common.constprop.1+0x98/0xf8 do_el0_svc+0x24/0x38 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xc8 el0t_64_sync+0x174/0x178 Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20251017102922.670084-1-akash.goel@arm.com commit 1f1d3e1d094db732d22b892227bf1e1ac3a8ca04 Author: Miguel Ojeda Date: Fri Oct 17 00:57:54 2025 +0200 rust: bitmap: fix formatting We do our best to keep the repository `rustfmt`-clean, thus run the tool to fix the formatting issue. Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting Link: https://rust-for-linux.com/contributing#submit-checklist-addendum Fixes: 0f5878834d6c ("rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning") Reviewed-by: Burak Emir Signed-off-by: Miguel Ojeda commit c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33 Author: Fernando Fernandez Mancera Date: Thu Oct 16 12:14:56 2025 +0200 sysfs: check visibility before changing group attribute ownership Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below: WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] Fix this by checking is_visible() before trying to touch the attribute. Fixes: 303a42769c4c ("sysfs: add sysfs_group{s}_change_owner()") Fixes: 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)") Reported-by: Cynthia Closes: https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab-d3f1-46d9-b9a0-048ab05eb09b-000000@eu-central-1.amazonses.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20251016101456.4087-1-fmancera@suse.de Signed-off-by: Greg Kroah-Hartman commit a91c8096590bd7801a26454789f2992094fe36da Author: Maarten Lankhorst Date: Wed Jul 23 16:24:16 2025 +0200 devcoredump: Fix circular locking dependency with devcd->mutex. The original code causes a circular locking dependency found by lockdep. ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U ------------------------------------------------------ xe_fault_inject/5091 is trying to acquire lock: ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660 but task is already holding lock: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&devcd->mutex){+.+.}-{3:3}: mutex_lock_nested+0x4e/0xc0 devcd_data_write+0x27/0x90 sysfs_kf_bin_write+0x80/0xf0 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (kn->active#236){++++}-{0:0}: kernfs_drain+0x1e2/0x200 __kernfs_remove+0xae/0x400 kernfs_remove_by_name_ns+0x5d/0xc0 remove_files+0x54/0x70 sysfs_remove_group+0x3d/0xa0 sysfs_remove_groups+0x2e/0x60 device_remove_attrs+0xc7/0x100 device_del+0x15d/0x3b0 devcd_del+0x19/0x30 process_one_work+0x22b/0x6f0 worker_thread+0x1e8/0x3d0 kthread+0x11c/0x250 ret_from_fork+0x26c/0x2e0 ret_from_fork_asm+0x1a/0x30 -> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}: __lock_acquire+0x1661/0x2860 lock_acquire+0xc4/0x2f0 __flush_work+0x27a/0x660 flush_delayed_work+0x5d/0xa0 dev_coredump_put+0x63/0xa0 xe_driver_devcoredump_fini+0x12/0x20 [xe] devm_action_release+0x12/0x30 release_nodes+0x3a/0x120 devres_release_all+0x8a/0xd0 device_unbind_cleanup+0x12/0x80 device_release_driver_internal+0x23a/0x280 device_driver_detach+0x14/0x20 unbind_store+0xaf/0xc0 drv_attr_store+0x21/0x50 sysfs_kf_write+0x4a/0x80 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&devcd->mutex); lock(kn->active#236); lock(&devcd->mutex); lock((work_completion)(&(&devcd->del_wk)->work)); *** DEADLOCK *** 5 locks held by xe_fault_inject/5091: #0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0 #1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220 #2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280 #3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 #4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660 stack backtrace: CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)} Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021 Call Trace: dump_stack_lvl+0x91/0xf0 dump_stack+0x10/0x20 print_circular_bug+0x285/0x360 check_noncircular+0x135/0x150 ? register_lock_class+0x48/0x4a0 __lock_acquire+0x1661/0x2860 lock_acquire+0xc4/0x2f0 ? __flush_work+0x25d/0x660 ? mark_held_locks+0x46/0x90 ? __flush_work+0x25d/0x660 __flush_work+0x27a/0x660 ? __flush_work+0x25d/0x660 ? trace_hardirqs_on+0x1e/0xd0 ? __pfx_wq_barrier_func+0x10/0x10 flush_delayed_work+0x5d/0xa0 dev_coredump_put+0x63/0xa0 xe_driver_devcoredump_fini+0x12/0x20 [xe] devm_action_release+0x12/0x30 release_nodes+0x3a/0x120 devres_release_all+0x8a/0xd0 device_unbind_cleanup+0x12/0x80 device_release_driver_internal+0x23a/0x280 ? bus_find_device+0xa8/0xe0 device_driver_detach+0x14/0x20 unbind_store+0xaf/0xc0 drv_attr_store+0x21/0x50 sysfs_kf_write+0x4a/0x80 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 ? __f_unlock_pos+0x15/0x20 ? __x64_sys_getdents64+0x9b/0x130 ? __pfx_filldir64+0x10/0x10 ? do_syscall_64+0x1a2/0xb60 ? clear_bhb_loop+0x30/0x80 ? clear_bhb_loop+0x30/0x80 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x76e292edd574 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574 RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063 R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000 xe 0000:03:00.0: [drm] Xe device coredump has been deleted. Fixes: 01daccf74832 ("devcoredump : Serialize devcd_del work") Cc: Mukesh Ojha Cc: Greg Kroah-Hartman Cc: Johannes Berg Cc: Rafael J. Wysocki Cc: Danilo Krummrich Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Maarten Lankhorst Cc: Matthew Brost Acked-by: Mukesh Ojha Link: https://lore.kernel.org/r/20250723142416.1020423-1-dev@lankhorst.se Signed-off-by: Greg Kroah-Hartman commit 74b84d1be0220b99405c16a4a3e1e503e3bd8387 Author: Ulf Hansson Date: Tue Oct 7 11:43:12 2025 +0200 driver core: fw_devlink: Don't warn about sync_state() pending Due to the wider deployment of the ->sync_state() support, for PM domains for example, we are receiving reports about the sync_state() pending message that is being logged in fw_devlink_dev_sync_state(). In particular as it's printed at the warning level, which is questionable. Even if it certainly is useful to know that the ->sync_state() condition could not be met, there may be nothing wrong with it. For example, a driver may be built as module and are still waiting to be initialized/probed. For this reason let's move to the info level for now. Reported-by: Geert Uytterhoeven Reported-by: Sebin Francis Reported-by: Diederik de Haas Reported-by: Jon Hunter Reviewed-by: Tomi Valkeinen Signed-off-by: Ulf Hansson Reviewed-by: Dhruva Gole Reviewed-by: Sebastian Reichel Reviewed-by: Kevin Hilman Acked-by: Saravana Kannan Reviewed-by: Sebin Francis Tested-by: Sebin Francis Signed-off-by: Greg Kroah-Hartman commit 873f10cf8e4d59605bc38fa1051dea8ee56fe3be Author: Fangyu Yu Date: Thu Oct 16 09:26:59 2025 +0800 RISC-V: KVM: Read HGEIP CSR on the correct cpu When executing kvm_riscv_vcpu_aia_has_interrupts, the vCPU may have migrated and the IMSIC VS-file have not been updated yet, currently the HGEIP CSR should be read from the imsic->vsfile_cpu ( the pCPU before migration ) via on_each_cpu_mask, but this will trigger an IPI call and repeated IPI within a period of time is expensive in a many-core systems. Just let the vCPU execute and update the correct IMSIC VS-file via kvm_riscv_vcpu_aia_imsic_update may be a simple solution. Fixes: 4cec89db80ba ("RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization") Signed-off-by: Fangyu Yu Reviewed-by: Guo Ren Reviewed-by: Anup Patel Tested-by: Anup Patel Link: https://lore.kernel.org/r/20251016012659.82998-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit a429b76114aaca3ef1aff4cd469dcf025431bd11 Author: Gao Xiang Date: Sun Oct 12 21:59:25 2025 +0800 erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupted images that can cause system crashes, which are related to the new encoded extents introduced in Linux 6.15: - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent special extents such as sparse extents (!EROFS_MAP_MAPPED), but previously only plen == 0 was handled; - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000, then "cur [0xfffffffffffff000] += bvec.bv_len [0x1000]" in "} while ((cur += bvec.bv_len) < end);" wraps around, causing an out-of-bound access of pcl->compressed_bvecs[] in z_erofs_submit_queue(). EROFS only supports 48-bit physical block addresses (up to 1EiB for 4k blocks), so add a sanity check to enforce this. Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/75022.1759355830@localhost [1] Closes: https://lore.kernel.org/r/80524.1760131149@localhost [2] Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 85893094535cced32b33766e283240164a5b11f8 Author: Tao Ren Date: Wed Oct 15 13:48:37 2025 -0700 ARM: dts: aspeed: fuji-data64: Enable mac3 controller "mac3" controller was removed from the initial version of fuji-data64 dts because the rgmii setting is incorrect, but dropping mac3 leads to regression in the existing fuji platform, because fuji.dts simply includes fuji-data64.dts. This patch adds mac3 back to fuji-data64.dts to fix the fuji regression[1], and rgmii settings need to be fixed later. Fixes: b0f294fdfc3e ("ARM: dts: aspeed: facebook-fuji: Include facebook-fuji-data64.dts") Link: https://lore.kernel.org/all/79ddc7b9-ef26-4959-9a16-aa4e006eb145@roeck-us.net/ [1] Signed-off-by: Tao Ren Reviewed-by: Andrew Lunn Signed-off-by: Andrew Jeffery commit 7f864458e9a6d2000b726d14b3d3a706ac92a3b0 Author: Sebastian Reichel Date: Tue Oct 14 17:49:34 2025 +0200 net: stmmac: dwmac-rk: Fix disabling set_clock_selection On all platforms set_clock_selection() writes to a GRF register. This requires certain clocks running and thus should happen before the clocks are disabled. This has been noticed on RK3576 Sige5, which hangs during system suspend when trying to suspend the second network interface. Note, that suspending the first interface works, because the second device ensures that the necessary clocks for the GRF are enabled. Cc: stable@vger.kernel.org Fixes: 2f2b60a0ec28 ("net: ethernet: stmmac: dwmac-rk: Add gmac support for rk3588") Signed-off-by: Sebastian Reichel Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251014-rockchip-network-clock-fix-v1-1-c257b4afdf75@collabora.com Signed-off-by: Jakub Kicinski commit 62cab426d0e340cd38893227c279705cc9e8416a Merge: d6dd930a6b3d17 225bc03d85427e Author: Dave Airlie Date: Fri Oct 17 09:39:34 2025 +1000 Merge tag 'drm-xe-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Increase global invalidation timeout to handle some workloads (Kenneth Graunke) - Fix NPD while evicting BOs in an array of VM binds (Matthew Brost) - Fix resizable BAR to account for possibly needing to move BARs other than the LMEMBAR (Lucas De Marchi) - Fix error handling in xe_migrate_init() (Thomas Hellström) - Fix atomic fault handling with mixed mappings or if the page is already in VRAM (Matthew Brost) - Enable media samplers power gating for platforms before Xe2 (Vinay Belgaumkar) - Fix de-registering exec queue from GuC when unbinding (Matthew Brost) - Ensure data migration to system if indicated by madvise with SVM (Thomas Hellström) - Fix kerneldoc for kunit change (Matt Roper) - Always account for cacheline alignment on migration (Matthew Auld) - Drop bogus assertion on eviction (Matthew Auld) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/rch735eqkmprfyutk3ux2fsqa3e5ve4p77w7a5j66qdpgyquxr@ao3wzcqtpn6s commit d6dd930a6b3d177cda9aa8dfdcc6b2c7dda4d78a Merge: 520133b0ba97fb 5801e65206b065 Author: Dave Airlie Date: Fri Oct 17 07:10:24 2025 +1000 Merge tag 'drm-misc-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: ast: - Fix display output after reboot bridge: - lt9211: Fix version check core: - draw: Avoid color truncation - gpuvm: Avoid kernel-doc warning - sched: Avoid double free panthor: - Fix MCU suspend qaic: - Init bootlog in correct order - Treat remaining == 0 as error in find_and_map_user_pages() - Lock access to DBC request queue rockchip: - vop2: Fix destination size in atomic check Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251016141607.GA73919@linux.fritz.box commit bf29555f5bdc017bac22ca66fcb6c9f46ec8788f Author: Johannes Wiesböck Date: Wed Oct 15 22:15:43 2025 +0200 rtnetlink: Allow deleting FDB entries in user namespace Creating FDB entries is possible from a non-initial user namespace when having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive an EPERM because the capability is always checked against the initial user namespace. This restricts the FDB management from unprivileged containers. Drop the netlink_capable check in rtnl_fdb_del as it was originally dropped in c5c351088ae7 and reintroduced in 1690be63a27b without intention. This patch was tested using a container on GyroidOS, where it was possible to delete FDB entries from an unprivileged user namespace and private network namespace. Fixes: 1690be63a27b ("bridge: Add vlan support to static neighbors") Reviewed-by: Michael Weiß Tested-by: Harshal Gohel Signed-off-by: Johannes Wiesböck Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251015201548.319871-1-johannes.wiesboeck@aisec.fraunhofer.de Signed-off-by: Jakub Kicinski commit 32f072d9eaf9c31c2b0527a4a3370570a731e3cc Author: Miguel Ojeda Date: Fri Oct 10 19:43:51 2025 +0200 rust: cpufreq: fix formatting We do our best to keep the repository `rustfmt`-clean, thus run the tool to fix the formatting issue. Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting Link: https://rust-for-linux.com/contributing#submit-checklist-addendum Fixes: f97aef092e19 ("cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency") Acked-by: Viresh Kumar Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 8a7c601e14576a22c2bbf7f67455ccf3f3d2737f Author: Miguel Ojeda Date: Fri Oct 10 19:43:50 2025 +0200 rust: alloc: employ a trailing comment to keep vertical layout Apply the formatting guidelines introduced in the previous commit to make the file `rustfmt`-clean again. Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 4a9cb2eecc78fa9d388481762dd798fa770e1971 Author: Miguel Ojeda Date: Fri Oct 10 19:43:49 2025 +0200 docs: rust: add section on imports formatting `rustfmt`, by default, formats imports in a way that is prone to conflicts while merging and rebasing, since in some cases it condenses several items into the same line. For instance, Linus mentioned [1] that the following case: use crate::{ fmt, page::AsPageIter, }; is compressed by `rustfmt` into: use crate::{fmt, page::AsPageIter}; which is undesirable. Similarly, `rustfmt` may put several items in the same line even if the braces span already multiple lines, e.g.: use kernel::{ acpi, c_str, device::{property, Core}, of, platform, }; The options that control the formatting behavior around imports are generally unstable, and `rustfmt` releases do not allow to use nightly features, unlike the compiler and other Rust tooling [2]. For the moment, we can introduce a workaround to prevent `rustfmt` from compressing the example above -- the "trailing empty comment": use crate::{ fmt, page::AsPageIter, // }; which is reminiscent of the trailing comma behavior in other formatters. We already used empty comments for formatting purposes in the past, e.g. in commit b9b701fce49a ("rust: clarify the language unstable features in use"). In addition, `rustfmt` actually reformats with a vertical layout (i.e. it does not put two items in the same line) when seeing such a comment, i.e. it doesn't just preserve the formatting, which is good in the sense that we can use it to easily reformat some imports, since it matches the style we generally want to have. A Git merge driver would help (suggested by Gary and Wedson), though maintainers would need to set it up, the diffs would still be larger and the formatting rules for imports would remain hard to predict. Thus document the style that we will follow in the coding guidelines by introducing a new section and explain how the trailing empty comment works there too. We discussed the issue with upstream Rust in our usual Rust <-> Rust for Linux meeting [3], and there have also been a few other discussions in parallel in issues [4][5] and Zulip [6]. We will see what happens, but upstream Rust has already created a subteam of `rustfmt` to try to overcome the bandwidth issue [7], which is a good signal, and some organization work has already started (e.g. tracking issues). We will continue our discussions with them about it. Cc: Caleb Cartwright Cc: Yacin Tmimi Cc: Manish Goregaokar Cc: Deadbeef Cc: Cameron Steffen Cc: Jieyou Xu Link: https://lore.kernel.org/all/CAHk-=wgO7S_FZUSBbngG5vtejWOpzDfTTBkVvP3_yjJmFddbzA@mail.gmail.com/ [1] Link: https://github.com/rust-lang/rustfmt/issues/4884 [2] Link: https://hackmd.io/iSCyY3JTTz-g8YM-nnzTTA [3] Link: https://github.com/rust-lang/rustfmt/issues/4991 [4] Link: https://github.com/rust-lang/rustfmt/issues/3361 [5] Link: https://rust-lang.zulipchat.com/#narrow/channel/392734-council/topic/rustfmt.20maintenance/near/543815381 [6] Link: https://github.com/rust-lang/team/pull/2017 [7] Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 1b0124ad5039678a9dfafb6aafef6f430a246b91 Author: Bagas Sanjaya Date: Wed Oct 15 16:25:41 2025 +0700 net: rmnet: Fix checksum offload header v5 and aggregation packet formatting Packet format for checksum offload header v5 and aggregation, and header type table for the former, are shown in normal paragraphs instead. Use appropriate markup. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251015092540.32282-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 5348d6312446929edabced02bd6438bfe5220e31 Author: Cosmin Ratiu Date: Wed Oct 15 10:05:23 2025 +0300 net/mlx5e: psp, avoid 'accel' NULL pointer dereference The 'accel' parameter of mlx5e_txwqe_build_eseg_csum() and the similar 'state' parameter of mlx5e_accel_tx_ids_len() were NULL when called from mlx5i_sq_xmit() and were causing kernel panics from that context. Fix that by passing in a local empty mlx5e_accel_tx_state variable, thus guaranteeing that 'accel' is never NULL. Also remove an unnecessary check from mlx5e_tx_wqe_inline_mode(). Fixes: e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1760511923-890650-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d0d3e9c2867b32c9c70e39e74b9425871cf0042a Author: Eric Dumazet Date: Wed Oct 15 06:32:21 2025 +0000 net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb() Some network drivers assume this field is zero after napi_get_frags(). We must clear it in napi_reuse_skb() otherwise the following can happen: 1) A packet is received, and skb_shinfo(skb)->hwtstamps is populated because a bit in the receive descriptor announced hwtstamp availability for this packet. 2) Packet is given to gro layer via napi_gro_frags(). 3) Packet is merged to a prior one held in GRO queues. 4) skb is saved after some cleanup in napi->skb via a call to napi_reuse_skb(). 5) Next packet is received 10 seconds later, gets the recycled skb from napi_get_frags(). 6) The receive descriptor does not announce hwtstamp availability. Driver does not clear shinfo->hwtstamps. 7) We have in shinfo->hwtstamps an old timestamp. Fixes: ac45f602ee3d ("net: infrastructure for hardware time stamping") Signed-off-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251015063221.4171986-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit aaf043a5688114703ae2c1482b92e7e0754d684e Author: Nathan Chancellor Date: Tue Oct 14 13:46:49 2025 -0700 net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() When building with Clang 20 or newer, there are some objtool warnings from unexpected fallthroughs to other functions: vmlinux.o: warning: objtool: mlx5e_mpwrq_mtts_per_wqe() falls through to next function mlx5e_mpwrq_max_num_entries() vmlinux.o: warning: objtool: mlx5e_mpwrq_max_log_rq_size() falls through to next function mlx5e_get_linear_rq_headroom() LLVM 20 contains an (admittedly problematic [1]) optimization [2] to convert divide by zero into the equivalent of __builtin_unreachable(), which invokes undefined behavior and destroys code generation when it is encountered in a control flow graph. mlx5e_mpwrq_umr_entry_size() returns 0 in the default case of an unrecognized mlx5e_mpwrq_umr_mode value. mlx5e_mpwrq_mtts_per_wqe(), which is inlined into mlx5e_mpwrq_max_log_rq_size(), uses the result of mlx5e_mpwrq_umr_entry_size() in a divide operation without checking for zero, so LLVM is able to infer there will be a divide by zero in this case and invokes undefined behavior. While there is some proposed work to isolate this undefined behavior and avoid the destructive code generation that results in these objtool warnings, code should still be defensive against divide by zero. As the WARN_ONCE() implies that an invalid value should be handled gracefully, return 1 instead of 0 in the default case so that the results of this division operation is always valid. Fixes: 168723c1f8d6 ("net/mlx5e: xsk: Use umr_mode to calculate striding RQ parameters") Link: https://lore.kernel.org/CAGG=3QUk8-Ak7YKnRziO4=0z=1C_7+4jF+6ZeDQ9yF+kuTOHOQ@mail.gmail.com/ [1] Link: https://github.com/llvm/llvm-project/commit/37932643abab699e8bb1def08b7eb4eae7ff1448 [2] Closes: https://github.com/ClangBuiltLinux/linux/issues/2131 Closes: https://github.com/ClangBuiltLinux/linux/issues/2132 Signed-off-by: Nathan Chancellor Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20251014-mlx5e-avoid-zero-div-from-mlx5e_mpwrq_umr_entry_size-v1-1-dc186b8819ef@kernel.org Signed-off-by: Jakub Kicinski commit 75cea9860aa6b2350d90a8d78fed114d27c7eca2 Author: Michal Pecio Date: Tue Oct 14 20:35:28 2025 +0200 net: usb: rtl8150: Fix frame padding TX frames aren't padded and unknown memory is sent into the ether. Theoretically, it isn't even guaranteed that the extra memory exists and can be sent out, which could cause further problems. In practice, I found that plenty of tailroom exists in the skb itself (in my test with ping at least) and skb_padto() easily succeeds, so use it here. In the event of -ENOMEM drop the frame like other drivers do. The use of one more padding byte instead of a USB zero-length packet is retained to avoid regression. I have a dodgy Etron xHCI controller which doesn't seem to support sending ZLPs at all. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Michal Pecio Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251014203528.3f9783c4.michal.pecio@gmail.com Signed-off-by: Jakub Kicinski commit 520133b0ba97fbc4b2b92daa66fed9b279550021 Merge: f69f31e5a7b885 079ae5118e1f0d Author: Dave Airlie Date: Fri Oct 17 06:57:44 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-10-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-16: amdgpu: - Backlight fix - SI fixes - CIK fix - Make CE support debug only - IP discovery fix - Ring reset fixes - GPUVM fault memory barrier fix - Drop unused structures in amdgpu_drm.h - JPEG debugfs fix - VRAM handling fixes for GPUs without VRAM - GC 12 MES fixes amdkfd: - MES fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20251016132224.2534946-1-alexander.deucher@amd.com commit f69f31e5a7b885c7953a165a56f351e7b4e9e613 Merge: 3a8660878839fa 95355766e5871e Author: Dave Airlie Date: Fri Oct 17 06:46:14 2025 +1000 Merge tag 'drm-intel-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Skip GuC communication warning if reset is in progress (Zhanjun) - Couple frontbuffer related fixes (Ville) - Deactivate PSR only on LNL and when selective fetch enabled (Jouni) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aPDoguxlhXlvjNAi@intel.com commit f0624c6646435c1b56652193cce3e34062d50e3f Merge: 08823e89e3e269 5a869d01779339 Author: Jens Axboe Date: Thu Oct 16 13:25:40 2025 -0600 Merge tag 'nvme-6.18-2025-10-16' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "- iostats accounting fixed on multipath retries (Amit) - secure concatenation response fixup (Martin) - tls partial record fixup (Wilfred)" * tag 'nvme-6.18-2025-10-16' of git://git.infradead.org/nvme: nvme/tcp: handle tls partially sent records in write_space() nvme-auth: update sc_c in host response nvme-multipath: Skip nr_active increments in RETRY disposition commit a3c4a0a42e61aad1056a3d33fd603c1ae66d4288 Author: Emil Tsalapatis Date: Thu Oct 16 11:11:26 2025 -0700 sched_ext: fix flag check for deferred callbacks When scheduling the deferred balance callbacks, check SCX_RQ_BAL_CB_PENDING instead of SCX_RQ_BAL_PENDING. This way schedule_deferred() properly tests whether there is already a pending request for queue_balance_callback() to be invoked at the end of .balance(). Fixes: a8ad873113d3 ("sched_ext: defer queue_balance_callback() until after ops.dispatch") Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 5a869d017793399fd1d2609ff27e900534173eb3 Author: Wilfred Mallawa Date: Fri Oct 10 17:19:42 2025 +1000 nvme/tcp: handle tls partially sent records in write_space() With TLS enabled, records that are encrypted and appended to TLS TX list can fail to see a retry if the underlying TCP socket is busy, for example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known to the NVMe TCP driver, as the TLS layer successfully generated a record. Typically, the TLS write_space() callback would ensure such records are retried, but in the NVMe TCP Host driver, write_space() invokes nvme_tcp_write_space(). This causes a partially sent record in the TLS TX list to timeout after not being retried. This patch fixes the above by calling queue->write_space(), which calls into the TLS layer to retry any pending records. Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") Signed-off-by: Wilfred Mallawa Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit ec2e0fb07d789976c601bec19ecced7a501c3705 Merge: c6fceaf166479c f1a450f9e17d34 Author: Takashi Iwai Date: Thu Oct 16 20:14:24 2025 +0200 Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A moderately large collection of driver specific fixes, plus a few new quirks and device IDs. The NAU8821 changes are a little large but more in mechanical ways than in ways that are complex. commit 98ac9cc4b4452ed7e714eddc8c90ac4ae5da1a09 Merge: 9f388a653c8a48 9d5c4f5c7a2c76 Author: Linus Torvalds Date: Thu Oct 16 10:58:49 2025 -0700 Merge tag 'f2fs-fix-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: - fix soft lockupg caused by iput() added in bc986b1d756482a ("fs: stop accessing ->i_count directly in f2fs and gfs2") - fix a wrong block address map on multiple devices Link: https://lore.kernel.org/oe-lkp/202509301450.138b448f-lkp@intel.com [1] * tag 'f2fs-fix-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: fix wrong block mapping for multi-devices f2fs: don't call iput() from f2fs_drop_inode() commit f6fddc6df3fc0cffce329b87927db4eb5989728d Author: Shardul Bankar Date: Thu Oct 16 12:03:30 2025 +0530 bpf: Fix memory leak in __lookup_instance error path When __lookup_instance() allocates a func_instance structure but fails to allocate the must_write_set array, it returns an error without freeing the previously allocated func_instance. This causes a memory leak of 192 bytes (sizeof(struct func_instance)) each time this error path is triggered. Fix by freeing 'result' on must_write_set allocation failure. Fixes: b3698c356ad9 ("bpf: callchain sensitive stack liveness tracking using CFG") Reported-by: BPF Runtime Fuzzer (BRF) Signed-off-by: Shardul Bankar Signed-off-by: Martin KaFai Lau Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20251016063330.4107547-1-shardulsb08@gmail.com commit 9f388a653c8a481cbdbdedca081a1f9f3ba204a2 Merge: 05de41f3e26237 8aec9dbf2db2e9 Author: Linus Torvalds Date: Thu Oct 16 10:22:38 2025 -0700 Merge tag 'for-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - in tree-checker fix extref bounds check - reorder send context structure to avoid -Wflex-array-member-not-at-end warning - fix extent readahead length for compressed extents - fix memory leaks on error paths (qgroup assign ioctl, zone loading with raid stripe tree enabled) - fix how device specific mount options are applied, in particular the 'ssd' option will be set unexpectedly - fix tracking of relocation state when tasks are running and cancellation is attempted - adjust assertion condition for folios allocated for scrub - remove incorrect assertion checking for block group when populating free space tree * tag 'for-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: send: fix -Wflex-array-member-not-at-end warning in struct send_ctx btrfs: tree-checker: fix bounds check in check_inode_extref() btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST btrfs: fix incorrect readahead expansion length btrfs: do not assert we found block group item when creating free space tree btrfs: do not use folio_test_partial_kmap() in ASSERT()s btrfs: only set the device specific options after devices are opened btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running commit 05de41f3e26237bc34822268f958be1820bf968b Merge: 634ec1fc7982ef 88f170814fea74 Author: Linus Torvalds Date: Thu Oct 16 10:16:41 2025 -0700 Merge tag 'v6.18-rc1-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix RPC hang due to locking bug - Fix for memory leak in read and refcount leak (in session setup) - Minor cleanup * tag 'v6.18-rc1-smb-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix recursive locking in RPC handle list access smb/server: fix possible refcount leak in smb2_sess_setup() smb/server: fix possible memory leak in smb2_read() smb: server: Use common error handling code in smb_direct_rdma_xmit() commit 634ec1fc7982efeeeeed4a7688b0004827b43a21 Merge: ef25485516b09d 6de1dec1c166c7 Author: Linus Torvalds Date: Thu Oct 16 09:41:21 2025 -0700 Merge tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from CAN Current release - regressions: - udp: do not use skb_release_head_state() before skb_attempt_defer_free() - gro_cells: use nested-BH locking for gro_cell - dpll: zl3073x: increase maximum size of flash utility Previous releases - regressions: - core: fix lockdep splat on device unregister - tcp: fix tcp_tso_should_defer() vs large RTT - tls: - don't rely on tx_work during send() - wait for pending async decryptions if tls_strp_msg_hold fails - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler - eth: lan78xx: fix lost EEPROM write timeout in lan78xx_write_raw_eeprom Previous releases - always broken: - ip6_tunnel: prevent perpetual tunnel growth - dpll: zl3073x: handle missing or corrupted flash configuration - can: m_can: fix pm_runtime and CAN state handling - eth: - ixgbe: fix too early devlink_free() in ixgbe_remove() - ixgbevf: fix mailbox API compatibility - gve: Check valid ts bit on RX descriptor before hw timestamping - idpf: cleanup remaining SKBs in PTP flows - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H" * tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits) udp: do not use skb_release_head_state() before skb_attempt_defer_free() net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset netdevsim: set the carrier when the device goes up selftests: tls: add test for short splice due to full skmsg selftests: net: tls: add tests for cmsg vs MSG_MORE tls: don't rely on tx_work during send() tls: wait for pending async decryptions if tls_strp_msg_hold fails tls: always set record_type in tls_process_cmsg tls: wait for async encrypt in case of error during latter iterations of sendmsg tls: trim encrypted message to match the plaintext on short splice tg3: prevent use of uninitialized remote_adv and local_adv variables MAINTAINERS: new entry for IPv6 IOAM gve: Check valid ts bit on RX descriptor before hw timestamping net: core: fix lockdep splat on device unregister MAINTAINERS: add myself as maintainer for b53 selftests: net: check jq command is supported net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit() tcp: fix tcp_tso_should_defer() vs large RTT r8152: add error handling in rtl8152_driver_init usbnet: Fix using smp_processor_id() in preemptible code warnings ... commit ef25485516b09db57493f5e78b3358db7cbdcaa0 Merge: 7ea30958b3054f 12d724f2852d09 Author: Linus Torvalds Date: Thu Oct 16 09:39:29 2025 -0700 Merge tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Do not print an error message (and assume that the General Purpose Log Directory log page is not supported) for a device that reports a bogus General Purpose Logging Version. Unsurprisingly, many vendors fail to report the only valid General Purpose Logging Version (Damien) * tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: relax checks in ata_read_log_directory() commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a Author: Xing Guo Date: Thu Oct 16 11:53:30 2025 +0800 selftests: arg_parsing: Ensure data is flushed to disk before reading. test_parse_test_list_file writes some data to /tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read the data back. However, after writing data to that file, we forget to call fsync() and it's causing testing failure in my laptop. This patch helps fix it by adding the missing fsync() call. Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") Signed-off-by: Xing Guo Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com commit ed80cc4667ac997b84546e6d35f0a0ae525d239c Author: Stuart Hayhurst Date: Mon Oct 6 02:05:49 2025 +0100 HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL The Logitech G502 Hero Wireless's high resolution scrolling resets after being unplugged without notifying the driver, causing extremely slow scrolling. The only indication of this is a battery update packet, so add a quirk to detect when the device is unplugged and re-enable the scrolling. Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037 Signed-off-by: Stuart Hayhurst Signed-off-by: Jiri Kosina commit c700e7279b29948f5d2aee30df2dbd3124df3b9c Author: Alok Tiwari Date: Fri Oct 10 10:31:41 2025 -0700 drm/rockchip: dw_hdmi: use correct SCLIN mask for RK3228 In dw_hdmi_rk3228_setup_hpd(), the SCLIN mask incorrectly references the RK3328 variant. This change updates it to the RK3228-specific mask RK3228_HDMI_SCLIN_MSK using FIELD_PREP_WM16, ensuring proper HPD and I2C pin configuration for RK3228. Change: RK3328_HDMI_SCLIN_MSK -> RK3228_HDMI_SCLIN_MSK Fixes: 63df37f3fc71 ("drm/rockchip: dw_hdmi: switch to FIELD_PREP_WM16* macros") Signed-off-by: Alok Tiwari Reviewed-by: Nicolas Frattaroli Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251010173143.72733-1-alok.a.tiwari@oracle.com commit 7f9335f2d99815199d9d8d8e6687e68989728ce3 Author: Vignesh Raman Date: Mon Oct 13 11:32:10 2025 +0530 drm/ci: disable broken MR check in sanity job GitLab recently changed the required permissions for the are-developers-allowed-to-push-to-my-MR check: https://gitlab.freedesktop.org/freedesktop/ci-templates/-/issues/81 Until that’s resolved, disable the check - it’s mostly obsolete anyway. Based on https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37782 Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Patchwork: https://patchwork.freedesktop.org/patch/680263/ Message-ID: <20251013060212.14583-1-vignesh.raman@collabora.com> Signed-off-by: Rob Clark commit 86404a9e3013d814a772ac407573be5d3cd4ee0d Author: Anna Maniscalco Date: Sat Oct 11 15:45:10 2025 +0200 drm/msm: make sure last_fence is always updated Update last_fence in the vm-bind path instead of kernel managed path. last_fence is used to wait for work to finish in vm_bind contexts but not used for kernel managed contexts. This fixes a bug where last_fence is not waited on context close leading to faults as resources are freed while in use. Fixes: 92395af63a99 ("drm/msm: Add VM_BIND submitqueue") Signed-off-by: Anna Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/680080/ Message-ID: <20251011-close_fence_wait_fix-v3-1-5134787755ff@gmail.com> Signed-off-by: Rob Clark commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 Author: Akhil P Oommen Date: Thu Sep 11 02:14:05 2025 +0530 drm/msm/a6xx: Fix GMU firmware parser Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header. Fixes: c6ed04f856a4 ("drm/msm/a6xx: A640/A650 GMU firmware path") Signed-off-by: Akhil P Oommen Acked-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/674040/ Message-ID: <20250911-assorted-sept-1-v2-2-a8bf1ee20792@oss.qualcomm.com> Signed-off-by: Rob Clark commit 830d68f2cb8ab6fb798bb9555016709a9e012af0 Author: Rob Clark Date: Mon Oct 6 08:35:41 2025 -0700 drm/msm: Fix pgtable prealloc error path The following splat was reported: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S 6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT) pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : build_detached_freelist+0x28/0x224 lr : kmem_cache_free_bulk.part.0+0x38/0x244 sp : ffff000a508c7a20 x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350 x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000 x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000 x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8 x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640 x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30 x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940 x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000 x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8 x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00 Call trace: build_detached_freelist+0x28/0x224 (P) kmem_cache_free_bulk.part.0+0x38/0x244 kmem_cache_free_bulk+0x10/0x1c msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0 msm_vma_job_free+0x30/0x240 msm_ioctl_vm_bind+0x1d0/0x9a0 drm_ioctl_kernel+0x84/0x104 drm_ioctl+0x358/0x4d4 __arm64_sys_ioctl+0x8c/0xe0 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x3c/0xe0 do_el0_svc+0x18/0x20 el0_svc+0x30/0x100 el0t_64_sync_handler+0x104/0x130 el0t_64_sync+0x170/0x174 Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6) ---[ end trace 0000000000000000 ]--- Since msm_vma_job_free() is called directly from the ioctl, this looks like an error path cleanup issue. Which I think results from prealloc_cleanup() called without a preceding successful prealloc_allocate() call. So handle that case better. Reported-by: Connor Abbott Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/678677/ Message-ID: <20251006153542.419998-1-robin.clark@oss.qualcomm.com> commit 6de1dec1c166c7f7324ce52ccfdf43e2fa743b19 Author: Eric Dumazet Date: Wed Oct 15 05:27:15 2025 +0000 udp: do not use skb_release_head_state() before skb_attempt_defer_free() Michal reported and bisected an issue after recent adoption of skb_attempt_defer_free() in UDP. The issue here is that skb_release_head_state() is called twice per skb, one time from skb_consume_udp(), then a second time from skb_defer_free_flush() and napi_consume_skb(). As Sabrina suggested, remove skb_release_head_state() call from skb_consume_udp(). Add a DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb)) in skb_attempt_defer_free() Many thanks to Michal, Sabrina, Paolo and Florian for their help. Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()") Reported-and-bisected-by: Michal Kubecek Closes: https://lore.kernel.org/netdev/gpjh4lrotyephiqpuldtxxizrsg6job7cvhiqrw72saz2ubs3h@g6fgbvexgl3r/ Signed-off-by: Eric Dumazet Tested-by: Michal Kubecek Cc: Sabrina Dubroca Cc: Florian Westphal Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251015052715.4140493-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 0b7d9b25e4bc2e478c9d06281a65f930769fca09 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:57 2025 +0300 spi: airoha: fix reading/writing of flashes with more than one plane per lun Attaching UBI on the flash with more than one plane per lun will lead to the following error: [ 2.980989] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986309] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994978] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001350] Creating 2 MTD partitions on "spi0.0": [ 3.006159] 0x000000000000-0x000000020000 : "bl2" [ 3.011663] 0x000000020000-0x000010000000 : "ubi" ... [ 6.391748] ubi0: attaching mtd1 [ 6.412545] ubi0 error: ubi_attach: PEB 0 contains corrupted VID header, and the data does not contain all 0xFF [ 6.422677] ubi0 error: ubi_attach: this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection [ 6.434249] Volume identifier header dump: [ 6.438349] magic 55424923 [ 6.441482] version 1 [ 6.444007] vol_type 0 [ 6.446539] copy_flag 0 [ 6.449068] compat 0 [ 6.451594] vol_id 0 [ 6.454120] lnum 1 [ 6.456651] data_size 4096 [ 6.459442] used_ebs 1061644134 [ 6.462748] data_pad 0 [ 6.465274] sqnum 0 [ 6.467805] hdr_crc 61169820 [ 6.470943] Volume identifier header hexdump: [ 6.475308] hexdump of PEB 0 offset 4096, length 126976 [ 6.507391] ubi0 warning: ubi_attach: valid VID header but corrupted EC header at PEB 4 [ 6.515415] ubi0 error: ubi_compare_lebs: unsupported on-flash UBI format [ 6.522222] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 6.529294] UBI error: cannot attach mtd1 Non dirmap reading works good. Looking to spi_mem_no_dirmap_read() code we'll see: static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc, u64 offs, size_t len, void *buf) { struct spi_mem_op op = desc->info.op_tmpl; int ret; // --- see here --- op.addr.val = desc->info.offset + offs; //----------------- op.data.buf.in = buf; op.data.nbytes = len; ret = spi_mem_adjust_op_size(desc->mem, &op); if (ret) return ret; ret = spi_mem_exec_op(desc->mem, &op); if (ret) return ret; return op.data.nbytes; } The similar happens for spi_mem_no_dirmap_write(). Thus the address passed to the flash should take in the account the value of desc->info.offset. This patch fix dirmap reading/writing of flashes with more than one plane per lun. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-7-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 20d7b236b78c7ec685a22db5689b9c829975e0c3 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:56 2025 +0300 spi: airoha: switch back to non-dma mode in the case of error Current dirmap code does not switch back to non-dma mode in the case of error. This is wrong. This patch fixes dirmap read/write error path. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Acked-by: Lorenzo Bianconi Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-6-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit edd2e261b1babb92213089b5feadca12e3459322 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:54 2025 +0300 spi: airoha: add support of dual/quad wires spi modes to exec_op() handler Booting without this patch and disabled dirmap support results in [ 2.980719] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986040] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994709] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001075] Creating 2 MTD partitions on "spi0.0": [ 3.005862] 0x000000000000-0x000000020000 : "bl2" [ 3.011272] 0x000000020000-0x000010000000 : "ubi" ... [ 6.195594] ubi0: attaching mtd1 [ 13.338398] ubi0: scanning is finished [ 13.342188] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 13.349784] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 13.356897] UBI error: cannot attach mtd1 If dirmap is disabled or not supported in the spi driver, the dirmap requests will be executed via exec_op() handler. Thus, if the hardware supports dual/quad spi modes, then corresponding requests will be sent to exec_op() handler. Current driver does not support such requests, so error is arrised. As result the flash can't be read/write. This patch adds support of dual and quad wires spi modes to exec_op() handler. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-4-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 4314ffce4eb81a6c18700af1b6e29b6e0c6b9e37 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:52 2025 +0300 spi: airoha: return an error for continuous mode dirmap creation cases This driver can accelerate single page operations only, thus continuous reading mode should not be used. Continuous reading will use sizes up to the size of one erase block. This size is much larger than the size of single flash page. Use this difference to identify continuous reading and return an error. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Frieder Schrempf Reviewed-by: AngeloGioacchino Del Regno Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Link: https://patch.msgid.link/20251012121707.2296160-2-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 86f54f9b6c17d6567c69e3a6fed52fdf5d7dbe93 Author: Hao Ge Date: Wed Oct 15 22:16:42 2025 +0800 slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL If obj_exts allocation failed, slab->obj_exts is set to OBJEXTS_ALLOC_FAIL, But we do not clear it when freeing the slab. Since OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS currently share the same bit position, during the release of the associated folio, a VM_BUG_ON_FOLIO() check in folio_memcg_kmem() is triggered because the OBJEXTS_ALLOC_FAIL flag was not cleared, causing it to be interpreted as a kmem folio (non-slab) with MEMCG_OBJEXTS_DATA flag set, which is invalid because MEMCG_OBJEXTS_DATA is supposed to be set only on slabs. Another problem that predates sharing the OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS bits is that on configurations with is_check_pages_enabled(), the non-cleared bit in page->memcg_data will trigger a free_page_is_bad() failure "page still charged to cgroup" When freeing a slab, we clear slab->obj_exts if the obj_ext array has been successfully allocated. So let's clear it also when the allocation has failed. Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Fixes: 7612833192d5 ("slab: Reuse first bit for OBJEXTS_ALLOC_FAIL") Link: https://lore.kernel.org/all/20251015141642.700170-1-hao.ge@linux.dev/ Cc: Signed-off-by: Hao Ge Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 5801e65206b065b0b2af032f7f1eef222aa2fd83 Author: Tvrtko Ursulin Date: Wed Oct 15 09:40:15 2025 +0100 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it. Signed-off-by: Tvrtko Ursulin Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/aNFbXq8OeYl3QSdm@stanley.mountain/ Cc: Christian König Cc: Rob Clark Cc: Daniel Vetter Cc: Matthew Brost Cc: Danilo Krummrich Cc: Philipp Stanner Cc: Christian König Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v5.16+ Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20251015084015.6273-1-tvrtko.ursulin@igalia.com commit ea138a607709bf72c162f62d2a670fe899d73daa Author: Samuel Holland Date: Wed Oct 15 17:17:09 2025 -0700 RISC-V: KVM: Fix check for local interrupts on riscv32 To set all 64 bits in the mask on a 32-bit system, the constant must have type `unsigned long long`. Fixes: 6b1e8ba4bac4 ("RISC-V: KVM: Use bitmap for irqs_pending and irqs_pending_mask") Signed-off-by: Samuel Holland Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251016001714.3889380-1-samuel.holland@sifive.com Signed-off-by: Anup Patel commit f1a450f9e17d341f69f8fb19f6d13ef9f1aa508b Merge: 62ef9b2a01a0af ee70bacef1c605 Author: Mark Brown Date: Thu Oct 16 12:41:35 2025 +0100 ASoC: nau8821: Fix IRQ handling and improve jack Merge series from Cristian Ciocaltea : This patch series addresses a set of issues in the Nuvoton NAU88L21 audio codec driver related to interrupt handling and jack hotplug detection reliability. The changes focus on: * Eliminating race conditions between jack insertion and ejection events * Ensuring interrupts are consistently and correctly cleared before unmasking * Introducing a DMI-based quirk to bypass the jack debounce circuit on Valve Steam Deck, improving detection accuracy under stress * Improving robustness of the IRQ handler by avoiding unnecessary blocking operations The series has been tested on affected hardware to verify correct behavior during repeated and rapid jack hotplug cycles. commit 62ef9b2a01a0af5199986a2466dace54b8703b3e Merge: 5726b68473f715 dee4ef0ebe4dee Author: Mark Brown Date: Thu Oct 16 12:41:30 2025 +0100 ASoC: Add QCS615 sound card support Merge series from Le Qi : This patch series adds support for the QCS615 sound card: - Updates device tree bindings for SM8250 to include QCS615. - Adds QCS615 support in the SC8280XP ASoC driver. commit ce121914f38aaa59504e20a1a625e5988fc6ead4 Author: Russell King (Oracle) Date: Wed Oct 15 16:52:26 2025 +0100 arm64: tegra: Mark Jetson Xavier NX's PHY as a wakeup source Mark the RTL8211F PHY as a wakeup source for the Jetson Xavier NX. This allows the reworked RTL8211F driver to know that the PHY is wired to wakeup capable hardware, and thus to expose WoL capabilities. Signed-off-by: Russell King (Oracle) Acked-by: Jon Hunter Signed-off-by: Thierry Reding commit c6fceaf166479c05f7d3158ef08e78ae3e3dfa23 Author: Pauli Virtanen Date: Thu Oct 16 00:11:30 2025 +0300 ALSA: usb-audio: fix vendor quirk for Logitech H390 Vendor quirk QUIRK_FLAG_CTL_MSG_DELAY_1M was inadvertently missing when adding quirk for Logitech H390. Add it back. Fixes: 2b929b6eec0c ("ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390") Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 9af61fc91486c7ba93cf1ec3bd381978cac8308c Author: Pauli Virtanen Date: Wed Oct 15 22:47:10 2025 +0300 ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 ID 045e:070f Microsoft Corp. LifeChat LX-3000 Headset has muted minimum Speaker Playback Volume, and 4 amixer steps were observed to produce 1 actual volume step. Apply min_mute quirk and correct res=48 -> 4*48. Tested with the device. Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 225bc03d85427e7e3821d6f99f4f2d4a09350dda Author: Matthew Auld Date: Fri Oct 10 16:24:58 2025 +0100 drm/xe/evict: drop bogus assert This assert can trigger here with non pin_map users that select LATE_RESTORE, since the vmap is allowed to be NULL given that save/restore can now use the blitter instead. The check here doesn't seem to have much value anymore given that we no longer move pinned memory, so any existing vmap is left well alone, and doesn't need to be recreated upon restore, so just drop the assert here. Fixes: 86f69c26113c ("drm/xe: use backup object for pinned save/restore") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6213 Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20251010152457.177884-2-matthew.auld@intel.com (cherry picked from commit a10b4a69c7f8f596d2c5218fbe84430734fab3b2) Signed-off-by: Lucas De Marchi commit 6a91af25cdbce2086d85cc4994cf791bda3a2c90 Author: Matthew Auld Date: Fri Oct 10 17:20:21 2025 +0100 drm/xe/migrate: don't misalign current bytes If current bytes exceeds the max copy size, ensure the clamped size still accounts for the XE_CACHELINE_BYTES alignment, otherwise we trigger the assert in xe_migrate_vram with the size now being out of alignment. Fixes: 8c2d61e0e916 ("drm/xe/migrate: don't overflow max copy size") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6212 Signed-off-by: Matthew Auld Cc: Stuart Summers Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20251010162020.190962-2-matthew.auld@intel.com (cherry picked from commit 641bcf8731d21b56760e3646a39a65f471e9efd1) Signed-off-by: Lucas De Marchi commit 6d36f65ba551d28710c3e1aaceecacf19df0cd8f Author: Matt Roper Date: Mon Oct 13 08:30:15 2025 -0700 drm/xe/kunit: Fix kerneldoc for parameterized tests Kunit's generate_params() was recently updated to take an additional test context parameter. Xe's IP and platform parameter generators were updated accordingly at the same time, but the new parameter was not added to the functions' kerneldoc, resulting in the following warnings: Warning: drivers/gpu/drm/xe/tests/xe_pci.c:78 function parameter 'test' not described in 'xe_pci_fake_data_gen_params' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:254 function parameter 'test' not described in 'xe_pci_graphics_ip_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:278 function parameter 'test' not described in 'xe_pci_media_ip_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:302 function parameter 'test' not described in 'xe_pci_id_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:390 function parameter 'test' not described in 'xe_pci_live_device_gen_param' 5 warnings as errors Document the new parameter to eliminate the warnings and make CI happy. Fixes: b9a214b5f6aa ("kunit: Pass parameterized test context to generate_params()") Reviewed-by: Shuicheng Lin Link: https://lore.kernel.org/r/20251013153014.2362879-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 89e347f8a70165d1e8d88a93d875da7742c902ce) Signed-off-by: Lucas De Marchi commit 7987b93e3a11a7a95ddf2b21563d3286661b999c Author: Thomas Hellström Date: Fri Oct 10 12:41:48 2025 +0200 drm/xe/svm: Ensure data will be migrated to system if indicated by madvise. If the location madvise() is set to DRM_XE_PREFERRED_LOC_DEFAULT_SYSTEM, the drm_pagemap in the SVM gpu fault handler will be set to NULL. However there is nothing that explicitly migrates the data to system if it is already present in device memory. In that case, set the device memory owner to NULL to ensure data gets properly migrated to system on page-fault. v2: - Remove redundant dpagemap assignment (Himal Prasad Ghimiray) Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost #v1 Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251010104149.72783-2-thomas.hellstrom@linux.intel.com Fixes: 10aa5c806030 ("drm/gpusvm, drm/xe: Fix userptr to not allow device private pages") (cherry picked from commit 2cfcea7a745794f9b8e265a309717ca6ba335fc4) Signed-off-by: Lucas De Marchi commit 3c15a6df61bab034b087f00181408b1537a535bb Author: Eric Biggers Date: Sat Oct 11 18:57:38 2025 -0700 smb: client: Consolidate cmac(aes) shash allocation Now that smb3_crypto_shash_allocate() and smb311_crypto_shash_allocate() are identical and only allocate "cmac(aes)", delete the latter and replace the call to it with the former. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 2c09630d09c64b6b46e3d59a0031bc1807f742c4 Author: Eric Biggers Date: Sat Oct 11 18:57:37 2025 -0700 smb: client: Remove obsolete crypto_shash allocations Now that the SMB client accesses MD5, HMAC-MD5, HMAC-SHA256, and SHA-512 only via the library API and not via crypto_shash, allocating crypto_shash objects for these algorithms is no longer necessary. Remove all these allocations, their corresponding kconfig selections, and their corresponding module soft dependencies. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 395a77b030a878a353465386e8618b5272a480ca Author: Eric Biggers Date: Sat Oct 11 18:57:36 2025 -0700 smb: client: Use HMAC-MD5 library for NTLMv2 For the HMAC-MD5 computations in NTLMv2, use the HMAC-MD5 library instead of a "hmac(md5)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To preserve the existing behavior of NTLMv2 support being disabled when the kernel is booted with "fips=1", make setup_ntlmv2_rsp() check fips_enabled itself. Previously it relied on the error from cifs_alloc_hash("hmac(md5)", &hmacmd5). Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit c04e55b257b42f5eb5a2c5e92ebd043fd75fe3ab Author: Eric Biggers Date: Sat Oct 11 18:57:35 2025 -0700 smb: client: Use MD5 library for SMB1 signature calculation Convert cifs_calc_signature() to use the MD5 library instead of a "md5" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To preserve the existing behavior of MD5 signature support being disabled when the kernel is booted with "fips=1", make cifs_calc_signature() check fips_enabled itself. Previously it relied on the error from cifs_alloc_hash("md5", &server->secmech.md5). Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit ae04b1bb06f8c1738d01dc2f9b9391c4480544e4 Author: Eric Biggers Date: Sat Oct 11 18:57:34 2025 -0700 smb: client: Use MD5 library for M-F symlink hashing Convert parse_mf_symlink() and format_mf_symlink() to use the MD5 library instead of a "md5" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. This also fixes an issue where these functions did not work on kernels booted in FIPS mode. The use of MD5 here is for data integrity rather than a security purpose, so it can use a non-FIPS-approved algorithm. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit e05b3115e75381369be84abe5d46565ce0fcedc8 Author: Eric Biggers Date: Sat Oct 11 18:57:33 2025 -0700 smb: client: Use HMAC-SHA256 library for SMB2 signature calculation Convert smb2_calc_signature() to use the HMAC-SHA256 library instead of a "hmac(sha256)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-SHA256 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To make this possible, make __cifs_calc_signature() support both the HMAC-SHA256 library and crypto_shash. (crypto_shash is still needed for HMAC-MD5 and AES-CMAC. A later commit will switch HMAC-MD5 from shash to the library. I'd like to eventually do the same for AES-CMAC, but it doesn't have a library API yet. So for now, shash is still needed.) Also remove the unnecessary 'sigptr' variable. For now smb3_crypto_shash_allocate() still allocates a "hmac(sha256)" crypto_shash. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 4b4c6fdb25de4edc0a34b1b93cccb439e00e1f35 Author: Eric Biggers Date: Sat Oct 11 18:57:32 2025 -0700 smb: client: Use HMAC-SHA256 library for key generation Convert generate_key() to use the HMAC-SHA256 library instead of a "hmac(sha256)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-SHA256 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Also remove the unnecessary 'hashptr' variable. For now smb3_crypto_shash_allocate() still allocates a "hmac(sha256)" crypto_shash. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit af5fea51411224cae61d54064a55fe22020bd2b7 Author: Eric Biggers Date: Sat Oct 11 18:57:31 2025 -0700 smb: client: Use SHA-512 library for SMB3.1.1 preauth hash Convert smb311_update_preauth_hash() to use the SHA-512 library instead of a "sha512" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the SHA-512 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Remove the call to smb311_crypto_shash_allocate() from smb311_update_preauth_hash(), since it appears to have been needed only to allocate the "sha512" crypto_shash. (It also had the side effect of allocating the "cmac(aes)" crypto_shash, but that's also done in generate_key() which is where the AES-CMAC key is initialized.) For now the "sha512" crypto_shash is still being allocated elsewhere. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9 Author: Eugene Korenevsky Date: Mon Oct 13 21:39:30 2025 +0300 cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s. Signed-off-by: Eugene Korenevsky Cc: stable@vger.kernel.org Suggested-by: Nathan Chancellor Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit c2b77f42205ef485a647f62082c442c1cd69d3fc Author: Shuhao Fu Date: Thu Oct 16 02:52:55 2025 +0000 smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks. Fixes: 8ceb98437946 ("CIFS: Move rename to ops struct") Fixes: 2f1afe25997f ("cifs: Use smb 2 - 3 and cifsacl mount options getacl functions") Fixes: 366ed846df60 ("cifs: Use smb 2 - 3 and cifsacl mount options setacl function") Cc: stable@vger.kernel.org Signed-off-by: Shuhao Fu Signed-off-by: Steve French commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 Author: I Viswanath Date: Mon Oct 13 23:46:48 2025 +0530 net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset dev->chipid is used in lan78xx_init_mac_address before it's initialized: lan78xx_reset() { lan78xx_init_mac_address() lan78xx_read_eeprom() lan78xx_read_raw_eeprom() <- dev->chipid is used here dev->chipid = ... <- dev->chipid is initialized correctly here } Reorder initialization so that dev->chipid is set before calling lan78xx_init_mac_address(). Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") Signed-off-by: I Viswanath Reviewed-by: Vadim Fedorenko Reviewed-by: Khalid Aziz Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 5e655aaddaa37e6c5a103d2854cb561552d710be Merge: 1a8fed52f7be14 93a27b5891b819 Author: Jakub Kicinski Date: Wed Oct 15 17:56:20 2025 -0700 Merge tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-10-14 The first 2 paches are by Celeste Liu and target the gS_usb driver. The first patch remove the limitation to 3 CAN interface per USB device. The second patch adds the missing population of net_device->dev_port. The next 4 patches are by me and fix the m_can driver. They add a missing pm_runtime_disable(), fix the CAN state transition back to Error Active and fix the state after ifup and suspend/resume. Another patch by me targets the m_can driver, too and replaces Dong Aisheng's old email address. The next 2 patches are by Vincent Mailhol and update the CAN networking Documentation. Tetsuo Handa contributes the last patch that add missing cleanup calls in the NETDEV_UNREGISTER notification handler. * tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: j1939: add missing calls in NETDEV_UNREGISTER notification handler can: add Transmitter Delay Compensation (TDC) documentation can: remove false statement about 1:1 mapping between DLC and length can: m_can: replace Dong Aisheng's old email address can: m_can: fix CAN state in system PM can: m_can: m_can_chip_config(): bring up interface in correct state can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() can: gs_usb: gs_make_candev(): populate net_device->dev_port can: gs_usb: increase max interface to U8_MAX ==================== Link: https://patch.msgid.link/20251014122140.990472-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 Author: Breno Leitao Date: Tue Oct 14 02:17:25 2025 -0700 netdevsim: set the carrier when the device goes up Bringing a linked netdevsim device down and then up causes communication failure because both interfaces lack carrier. Basically a ifdown/ifup on the interface make the link broken. Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported for NAPI, calling netif_carrier_off() in nsim_stop(). This patch re-enables the carrier symmetrically on nsim_open(), in case the device is linked and the peer is up. Signed-off-by: Breno Leitao Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support") Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org Signed-off-by: Jakub Kicinski commit cf51d617c3829bd85666380be348aed71a1c44df Merge: 0c3f2e62815a43 3667e9b442b95b Author: Jakub Kicinski Date: Wed Oct 15 17:41:47 2025 -0700 Merge branch 'tls-misc-bugfixes' Sabrina Dubroca says: ==================== tls: misc bugfixes Jann Horn reported multiple bugs in kTLS. This series addresses them, and adds some corresponding selftests for those that are reproducible (and without failure injection). ==================== Link: https://patch.msgid.link/cover.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 3667e9b442b95b021189db793b9156552f918e99 Author: Sabrina Dubroca Date: Tue Oct 14 11:17:02 2025 +0200 selftests: tls: add test for short splice due to full skmsg We don't have a test triggering a partial splice caused by a full skmsg. Add one, based on a program by Jann Horn. Use MAX_FRAGS=48 to make sure the skmsg will be full for any allowed value of CONFIG_MAX_SKB_FRAGS (17..45). Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/1d129a15f526ea3602f3a2b368aa0b6f7e0d35d5.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit f95fce1e953b8a7af3fbad84aaffe92804196e2d Author: Sabrina Dubroca Date: Tue Oct 14 11:17:01 2025 +0200 selftests: net: tls: add tests for cmsg vs MSG_MORE We don't have a test to check that MSG_MORE won't let us merge records of different types across sendmsg calls. Add new tests that check: - MSG_MORE is only allowed for DATA records - a pending DATA record gets closed and pushed before a non-DATA record is processed Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/b34feeadefe8a997f068d5ed5617afd0072df3c0.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 7f846c65ca11e63d2409868ff039081f80e42ae4 Author: Sabrina Dubroca Date: Tue Oct 14 11:17:00 2025 +0200 tls: don't rely on tx_work during send() With async crypto, we rely on tx_work to actually transmit records once encryption completes. But while send() is running, both the tx_lock and socket lock are held, so tx_work_handler cannot process the queue of encrypted records, and simply reschedules itself. During a large send(), this could last a long time, and use a lot of memory. Transmit any pending encrypted records before restarting the main loop of tls_sw_sendmsg_locked. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b8a6ff84abbcbbc445463de58704686011edc8e1 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:59 2025 +0200 tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption requests. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:58 2025 +0200 tls: always set record_type in tls_process_cmsg When userspace wants to send a non-DATA record (via the TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a previous MSG_MORE send() as a separate DATA record. If that DATA record is encrypted asynchronously, tls_handle_open_record will return -EINPROGRESS. This is currently treated as an error by tls_process_cmsg, and it will skip setting record_type to the correct value, but the caller (tls_sw_sendmsg_locked) handles that return value correctly and proceeds with sending the new message with an incorrect record_type (DATA instead of whatever was requested in the cmsg). Always set record_type before handling the open record. If tls_handle_open_record returns an error, record_type will be ignored. If it succeeds, whether with synchronous crypto (returning 0) or asynchronous (returning -EINPROGRESS), the caller will proceed correctly. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b014a4e066c555185b7c367efacdc33f16695495 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:57 2025 +0200 tls: wait for async encrypt in case of error during latter iterations of sendmsg If we hit an error during the main loop of tls_sw_sendmsg_locked (eg failed allocation), we jump to send_end and immediately return. Previous iterations may have queued async encryption requests that are still pending. We should wait for those before returning, as we could otherwise be reading from memory that userspace believes we're not using anymore, which would be a sort of use-after-free. This is similar to what tls_sw_recvmsg already does: failures during the main loop jump to the "wait for async" code, not straight to the unlock/return. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit ce5af41e3234425a40974696682163edfd21128c Author: Sabrina Dubroca Date: Tue Oct 14 11:16:56 2025 +0200 tls: trim encrypted message to match the plaintext on short splice During tls_sw_sendmsg_locked, we pre-allocate the encrypted message for the size we're expecting to send during the current iteration, but we may end up sending less, for example when splicing: if we're getting the data from small fragments of memory, we may fill up all the slots in the skmsg with less data than expected. In this case, we need to trim the encrypted message to only the length we actually need, to avoid pushing uninitialized bytes down the underlying TCP socket. Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 Author: Alexey Simakov Date: Tue Oct 14 19:47:38 2025 +0300 tg3: prevent use of uninitialized remote_adv and local_adv variables Some execution paths that jump to the fiber_setup_done label could leave the remote_adv and local_adv variables uninitialized and then use it. Initialize this variables at the point of definition to avoid this. Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") Co-developed-by: Alexandr Sapozhnikov Signed-off-by: Alexandr Sapozhnikov Signed-off-by: Alexey Simakov Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com Signed-off-by: Jakub Kicinski commit bc384963bc18e4f21cf8615b57cbbc9c5e0d309a Author: Justin Iurman Date: Tue Oct 14 19:06:50 2025 +0200 MAINTAINERS: new entry for IPv6 IOAM Create a maintainer entry for IPv6 IOAM. Add myself as I authored most if not all of the IPv6 IOAM code in the kernel and actively participate in the related IETF groups. Signed-off-by: Justin Iurman Link: https://patch.msgid.link/20251014170650.27679-1-justin.iurman@uliege.be Signed-off-by: Jakub Kicinski commit 7ea30958b3054f5e488fa0b33c352723f7ab3a2a Merge: 5a6f65d1502551 7933a585d70ee4 Author: Linus Torvalds Date: Wed Oct 15 15:12:58 2025 -0700 Merge tag 'vfs-6.18-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Handle inode number mismatches in nsfs file handles - Update the comment to init_file() - Add documentation link for EBADF in the rust file code - Skip read lock assertion for read-only filesystems when using dax - Don't leak disconnected dentries during umount - Fix new coredump input pattern validation - Handle ENOIOCTLCMD conversion in vfs_fileattr_{g,s}et() correctly - Remove redundant IOCB_DIO_CALLER_COMP clearing in overlayfs * tag 'vfs-6.18-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ovl: remove redundant IOCB_DIO_CALLER_COMP clearing fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" coredump: fix core_pattern input validation vfs: Don't leak disconnected dentries on umount dax: skip read lock assertion for read-only filesystems rust: file: add intra-doc link for 'EBADF' fs: update comment in init_file() nsfs: handle inode number mismatches gracefully in file handles commit 841a8bfcbad94bb1ba60f59ce34f75259074ae0d Author: Qiuxu Zhuo Date: Sat Oct 11 15:55:19 2025 +0800 mm: prevent poison consumption when splitting THP When performing memory error injection on a THP (Transparent Huge Page) mapped to userspace on an x86 server, the kernel panics with the following trace. The expected behavior is to terminate the affected process instead of panicking the kernel, as the x86 Machine Check code can recover from an in-userspace #MC. mce: [Hardware Error]: CPU 0: Machine Check Exception: f Bank 3: bd80000000070134 mce: [Hardware Error]: RIP 10: {memchr_inv+0x4c/0xf0} mce: [Hardware Error]: TSC afff7bbff88a ADDR 1d301b000 MISC 80 PPIN 1e741e77539027db mce: [Hardware Error]: PROCESSOR 0:d06d0 TIME 1758093249 SOCKET 0 APIC 0 microcode 80000320 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel Kernel panic - not syncing: Fatal local machine check The root cause of this panic is that handling a memory failure triggered by an in-userspace #MC necessitates splitting the THP. The splitting process employs a mechanism, implemented in try_to_map_unused_to_zeropage(), which reads the pages in the THP to identify zero-filled pages. However, reading the pages in the THP results in a second in-kernel #MC, occurring before the initial memory_failure() completes, ultimately leading to a kernel panic. See the kernel panic call trace on the two #MCs. First Machine Check occurs // [1] memory_failure() // [2] try_to_split_thp_page() split_huge_page() split_huge_page_to_list_to_order() __folio_split() // [3] remap_page() remove_migration_ptes() remove_migration_pte() try_to_map_unused_to_zeropage() // [4] memchr_inv() // [5] Second Machine Check occurs // [6] Kernel panic [1] Triggered by accessing a hardware-poisoned THP in userspace, which is typically recoverable by terminating the affected process. [2] Call folio_set_has_hwpoisoned() before try_to_split_thp_page(). [3] Pass the RMP_USE_SHARED_ZEROPAGE remap flag to remap_page(). [4] Try to map the unused THP to zeropage. [5] Re-access pages in the hw-poisoned THP in the kernel. [6] Triggered in-kernel, leading to a panic kernel. In Step[2], memory_failure() sets the poisoned flag on the page in the THP by TestSetPageHWPoison() before calling try_to_split_thp_page(). As suggested by David Hildenbrand, fix this panic by not accessing to the poisoned page in the THP during zeropage identification, while continuing to scan unaffected pages in the THP for possible zeropage mapping. This prevents a second in-kernel #MC that would cause kernel panic in Step[4]. Thanks to Andrew Zaborowski for his initial work on fixing this issue. Link: https://lkml.kernel.org/r/20251015064926.1887643-1-qiuxu.zhuo@intel.com Link: https://lkml.kernel.org/r/20251011075520.320862-1-qiuxu.zhuo@intel.com Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Qiuxu Zhuo Reported-by: Farrah Chen Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Tested-by: Farrah Chen Tested-by: Qiuxu Zhuo Acked-by: Lance Yang Reviewed-by: Wei Yang Acked-by: Zi Yan Reviewed-by: Miaohe Lin Cc: Barry Song Cc: Dev Jain Cc: Jiaqi Yan Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Mariano Pache Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit 78a63493f8e352296dbc7cb7b3f4973105e8679e Author: Deepanshu Kartikey Date: Thu Oct 9 21:19:03 2025 +0530 ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters(). The problem occurs when: 1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED 2. ioctl(FITRIM) triggers ocfs2_move_extents() 3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2) 4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0) 5. The extent map cache is not invalidated after the move 6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch 7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk. Link: https://lore.kernel.org/all/20251009142917.517229-1-kartikey406@gmail.com/T/ Link: https://lkml.kernel.org/r/20251009154903.522339-1-kartikey406@gmail.com Fixes: 53069d4e7695 ("Ocfs2/move_extents: move/defrag extents within a certain range.") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com Tested-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=2959889e1f6e216585ce522f7e8bc002b46ad9e7 Reviewed-by: Mark Fasheh Reviewed-by: Joseph Qi Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit c83aab85e18103a6dc066b4939e2c92a02bb1b05 Author: Alexei Starovoitov Date: Thu Oct 9 17:15:13 2025 -0700 mm: don't spin in add_stack_record when gfp flags don't allow syzbot was able to find the following path: add_stack_record_to_list mm/page_owner.c:182 [inline] inc_stack_record_count mm/page_owner.c:214 [inline] __set_page_owner+0x2c3/0x4a0 mm/page_owner.c:333 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 alloc_pages_nolock_noprof+0x94/0x120 mm/page_alloc.c:7554 Don't spin in add_stack_record_to_list() when it is called from *_nolock() context. Link: https://lkml.kernel.org/r/CAADnVQK_8bNYEA7TJYgwTYR57=TTFagsvRxp62pFzS_z129eTg@mail.gmail.com Fixes: 97769a53f117 ("mm, bpf: Introduce try_alloc_pages() for opportunistic page allocation") Signed-off-by: Alexei Starovoitov Reported-by: syzbot+8259e1d0e3ae8ed0c490@syzkaller.appspotmail.com Reported-by: syzbot+665739f456b28f32b23d@syzkaller.appspotmail.com Acked-by: Vlastimil Babka Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 03521c892bb8d0712c23e158ae9bdf8705897df8 Author: Marek Szyprowski Date: Thu Oct 9 16:15:08 2025 +0200 dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC Commit 370645f41e6e ("dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned") introduced DMA_BOUNCE_UNALIGNED_KMALLOC feature and permitted architecture specific code configure kmalloc slabs with sizes smaller than the value of dma_get_cache_alignment(). When that feature is enabled, the physical address of some small kmalloc()-ed buffers might be not aligned to the CPU cachelines, thus not really suitable for typical DMA. To properly handle that case a SWIOTLB buffer bouncing is used, so no CPU cache corruption occurs. When that happens, there is no point reporting a false-positive DMA-API warning that the buffer is not properly aligned, as this is not a client driver fault. [m.szyprowski@samsung.com: replace is_swiotlb_allocated() with is_swiotlb_active(), per Catalin] Link: https://lkml.kernel.org/r/20251010173009.3916215-1-m.szyprowski@samsung.com Link: https://lkml.kernel.org/r/20251009141508.2342138-1-m.szyprowski@samsung.com Fixes: 370645f41e6e ("dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned") Signed-off-by: Marek Szyprowski Reviewed-by: Catalin Marinas Cc: Christoph Hellwig Cc: Inki Dae Cc: Robin Murohy Cc: "Isaac J. Manjarres" Cc: Signed-off-by: Andrew Morton commit 139e7a572af0b45f558b5e502121a768dc328ba8 Author: SeongJae Park Date: Fri Oct 3 13:14:55 2025 -0700 mm/damon/sysfs: dealloc commit test ctx always The damon_ctx for testing online DAMON parameters commit inputs is deallocated only when the test fails. This means memory is leaked for every successful online DAMON parameters commit. Fix the leak by always deallocating it. Link: https://lkml.kernel.org/r/20251003201455.41448-3-sj@kernel.org Fixes: 4c9ea539ad59 ("mm/damon/sysfs: validate user inputs from damon_sysfs_commit_input()") Signed-off-by: SeongJae Park Cc: [6.15+] Signed-off-by: Andrew Morton commit f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f Author: SeongJae Park Date: Fri Oct 3 13:14:54 2025 -0700 mm/damon/sysfs: catch commit test ctx alloc failure Patch series "mm/damon/sysfs: fix commit test damon_ctx [de]allocation". DAMON sysfs interface dynamically allocates and uses a damon_ctx object for testing if given inputs for online DAMON parameters update is valid. The object is being used without an allocation failure check, and leaked when the test succeeds. Fix the two bugs. This patch (of 2): The damon_ctx for testing online DAMON parameters commit inputs is used without its allocation failure check. This could result in an invalid memory access. Fix it by directly returning an error when the allocation failed. Link: https://lkml.kernel.org/r/20251003201455.41448-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251003201455.41448-2-sj@kernel.org Fixes: 4c9ea539ad59 ("mm/damon/sysfs: validate user inputs from damon_sysfs_commit_input()") Signed-off-by: SeongJae Park Cc: [6.15+] Signed-off-by: Andrew Morton commit c97513cddcfc235f2522617980838e500af21d01 Author: Lance Yang Date: Tue Sep 9 22:52:43 2025 +0800 hung_task: fix warnings caused by unaligned lock pointers The blocker tracking mechanism assumes that lock pointers are at least 4-byte aligned to use their lower bits for type encoding. However, as reported by Eero Tamminen, some architectures like m68k only guarantee 2-byte alignment of 32-bit values. This breaks the assumption and causes two related WARN_ON_ONCE checks to trigger. To fix this, the runtime checks are adjusted to silently ignore any lock that is not 4-byte aligned, effectively disabling the feature in such cases and avoiding the related warnings. Thanks to Geert Uytterhoeven for bisecting! Link: https://lkml.kernel.org/r/20250909145243.17119-1-lance.yang@linux.dev Fixes: e711faaafbe5 ("hung_task: replace blocker_mutex with encoded blocker") Signed-off-by: Lance Yang Reported-by: Eero Tamminen Closes: https://lore.kernel.org/lkml/CAMuHMdW7Ab13DdGs2acMQcix5ObJK0O2dG_Fxzr8_g58Rc1_0g@mail.gmail.com Reviewed-by: Masami Hiramatsu (Google) Cc: John Paul Adrian Glaubitz Cc: Anna Schumaker Cc: Boqun Feng Cc: Finn Thain Cc: Geert Uytterhoeven Cc: Ingo Molnar Cc: Joel Granados Cc: John Stultz Cc: Kent Overstreet Cc: Lance Yang Cc: Mingzhe Yang Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Tomasz Figa Cc: Waiman Long Cc: Will Deacon Cc: Yongliang Gao Cc: Signed-off-by: Andrew Morton commit 18d6b1743eafeb3fb1e0ea5a2b7fd0a773d525a8 Author: Jens Axboe Date: Wed Oct 15 13:38:53 2025 -0600 io_uring/rw: check for NULL io_br_sel when putting a buffer Both the read and write side use kiocb_done() to finish a request, and kiocb_done() will call io_put_kbuf() in case a provided buffer was used for the request. Provided buffers are not supported for writes, hence NULL is being passed in. This normally works fine, as io_put_kbuf() won't actually use the value unless REQ_F_BUFFER_RING or REQ_F_BUFFER_SELECTED is set in the request flags. But depending on compiler (or whether or not CONFIG_CC_OPTIMIZE_FOR_SIZE is set), that may be done even though the value is never used. This will then cause a NULL pointer dereference. Make it a bit more obvious and check for a NULL io_br_sel, and don't even bother calling io_put_kbuf() for that case. Fixes: 5fda51255439 ("io_uring/kbuf: switch to storing struct io_buffer_list locally") Reported-by: David Howells Tested-by: David Howells Signed-off-by: Jens Axboe commit e6416c2dfe23c9a6fec881fda22ebb9ae486cfc5 Author: Rong Zhang Date: Sat Oct 11 00:59:58 2025 +0800 x86/CPU/AMD: Prevent reset reasons from being retained across reboot The S5_RESET_STATUS register is parsed on boot and printed to kmsg. However, this could sometimes be misleading and lead to users wasting a lot of time on meaningless debugging for two reasons: * Some bits are never cleared by hardware. It's the software's responsibility to clear them as per the Processor Programming Reference (see [1]). * Some rare hardware-initiated platform resets do not update the register at all. In both cases, a previous reboot could leave its trace in the register, resulting in users seeing unrelated reboot reasons while debugging random reboots afterward. Write the read value back to the register in order to clear all reason bits since they are write-1-to-clear while the others must be preserved. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=206537#attach_303991 [ bp: Massage commit message. ] Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") Signed-off-by: Rong Zhang Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Yazen Ghannam Cc: Link: https://lore.kernel.org/all/20250913144245.23237-1-i@rong.moe/ commit 5726b68473f7153a7f6294185e5998b7e2a230a2 Author: Li Qiang Date: Wed Oct 15 15:55:30 2025 +0800 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent potential NULL pointer dereference. Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver") Signed-off-by: Li Qiang Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn Signed-off-by: Mark Brown commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 Author: Sharique Mohammad Date: Wed Oct 15 15:42:15 2025 +0200 ASoC: max98090/91: fixed max98091 ALSA widget powering up/down The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they are turned on or off, the required startup or shutdown sequences must be taken care by the max98090_shdn_event. Signed-off-by: Sharique Mohammad Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com Signed-off-by: Mark Brown commit fcd298fdc2a32f1d90cdf9a452c5c5fdc6e8d137 Author: Frank Li Date: Fri Oct 10 12:03:20 2025 -0400 ASoC: dt-bindings: Add compatible string fsl,imx-audio-tlv320 Add compatible string fsl,imx-audio-tlv320 to fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/imx/imx6dl-gw5903.dtb: /sound: failed to match any schema with compatible: ['fsl,imx-audio-tlv320'] Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251010160321.2130093-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit 760951dd19c2ebf55214e0cb259e4494098dfc9b Merge: 6b6e0310616345 f43579ef350052 Author: Mark Brown Date: Wed Oct 15 19:40:46 2025 +0100 spi: spi-nxp-fspi: few fix for flexspi Merge series from Haibo Chen : PATCH 1: different operations maybe require different max frequency, so add flexspi to handle such case, re-config the clock rate when new coming operation require new clock frequency. Patch 2: add workaround for erratum ERR050272. Since only add 4us dealy in nxp_fspi_dll_calibration(), so do not distinguish different platforms. Patch 3: add max frequency limitation for different sample clock source selection. Datasheet give max 66MHz for mode 0 and 166MHz for mode 3. And IC suggest to add this limitation on all SoCs for safety and stability. commit 2aab1f993c8cb753ccb3d5b848cd758e2e87d965 Author: Ankan Biswas Date: Wed Oct 15 20:50:57 2025 +0530 drm/gpuvm: Fix kernel-doc warning for drm_gpuvm_map_req.map The kernel-doc for struct drm_gpuvm_map_req.map was added as '@op_map' instead of '@map', leading to this warning during htmldocs build: WARNING: include/drm/drm_gpuvm.h:1083 struct member 'map' not described in 'drm_gpuvm_map_req' Fixes: 000a45dce7ad ("drm/gpuvm: Pass map arguments through a struct") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250821133539.03aa298e@canb.auug.org.au/ Signed-off-by: Ankan Biswas Signed-off-by: Danilo Krummrich commit d451a0e88e9fa710df33f8dd5dc7ca63e22ef211 Author: Stefan Metzmacher Date: Wed Oct 15 17:05:04 2025 +0200 smb: client: let smbd_destroy() wait for SMBDIRECT_SOCKET_DISCONNECTED We should wait for the rdma_cm to become SMBDIRECT_SOCKET_DISCONNECTED, it turns out that (at least running some xfstests e.g. cifs/001) often triggers the case where wait_event_interruptible() returns with -ERESTARTSYS instead of waiting for SMBDIRECT_SOCKET_DISCONNECTED to be reached. Or we are already in SMBDIRECT_SOCKET_DISCONNECTING and never wait for SMBDIRECT_SOCKET_DISCONNECTED. Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") Fixes: e8b3bfe9bc65 ("cifs: smbd: Don't destroy transport on RDMA disconnect") Fixes: b0aa92a229ab ("smb: client: make sure smbd_disconnect_rdma_work() doesn't run after smbd_destroy() took over") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bfdd74166a639930baaba27a8d729edaacd46907 Author: Tim Hostetler Date: Tue Oct 14 00:47:39 2025 +0000 gve: Check valid ts bit on RX descriptor before hw timestamping The device returns a valid bit in the LSB of the low timestamp byte in the completion descriptor that the driver should check before setting the SKB's hardware timestamp. If the timestamp is not valid, do not hardware timestamp the SKB. Cc: stable@vger.kernel.org Fixes: b2c7aeb49056 ("gve: Implement ndo_hwtstamp_get/set for RX timestamping") Reviewed-by: Joshua Washington Signed-off-by: Tim Hostetler Signed-off-by: Harshitha Ramamurthy Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251014004740.2775957-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 5a6f65d1502551f84c158789e5d89299c78907c7 Merge: 1f4a222b0e3345 7e85ac9da1acc5 Author: Linus Torvalds Date: Wed Oct 15 08:48:17 2025 -0700 Merge tag 'bitmap-for-v6.18-rc2' of https://github.com/norov/linux Pull bitmap fixes from Yury Norov: "A "unnecessary `unsafe`" warning fix for bitmap/rust, and one leftover patch for FIELD_PREP_WM16() conversion. - rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning (Miguel) - FIELD_PREP_WM16() rework leftover (Nicolas)" * tag 'bitmap-for-v6.18-rc2' of https://github.com/norov/linux: PM / devfreq: rockchip-dfi: switch to FIELD_PREP_WM16 macro rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning commit d9b3014a7f1425011909ad358dc0c8f187853a12 Author: Benjamin Tissoires Date: Wed Oct 8 16:06:59 2025 +0200 selftests/hid: add tests for missing release on the Dell Synaptics Add a simple test for the corner case not currently covered by the sticky fingers quirk. Because it's a corner case test, we only test this on a couple of devices, not on all of them because the value of adding the same test over and over is rather moot. Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 46f781e0d151844589dc2125c8cce3300546f92a Author: Benjamin Tissoires Date: Wed Oct 8 16:06:58 2025 +0200 HID: multitouch: fix sticky fingers The sticky fingers quirk (MT_QUIRK_STICKY_FINGERS) was only considering the case when slots were not released during the last report. This can be problematic if the firmware forgets to release a finger while others are still present. This was observed on the Synaptics DLL0945 touchpad found on the Dell XPS 9310 and the Dell Inspiron 5406. Fixes: 4f4001bc76fd ("HID: multitouch: fix rare Win 8 cases when the touch up event gets missing") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit aa4daea418ee4215dca5c8636090660c545cb233 Author: Thadeu Lima de Souza Cascardo Date: Wed Oct 8 09:40:33 2025 -0300 HID: multitouch: fix name of Stylus input devices HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). However, on multitouch devices, these suffixes may be overridden. Before that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after that, multitouch would override them to have an "UNKNOWN" suffix. Just add HID_DG_PEN to the list of non-overriden suffixes in multitouch. Before this fix: [ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 ELAN9008:00 04F3:2E14 UNKNOWN After this fix: [ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 ELAN9008:00 04F3:2E14 Stylus Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Mika Westerberg Signed-off-by: Jiri Kosina commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 Author: Dmitry Torokhov Date: Tue Oct 14 21:28:44 2025 -0700 HID: hid-input: only ignore 0 battery events for digitizers Commit 581c4484769e ("HID: input: map digitizer battery usage") added handling of battery events for digitizers (typically for batteries presented in stylii). Digitizers typically report correct battery levels only when stylus is actively touching the surface, and in other cases they may report battery level of 0. To avoid confusing consumers of the battery information the code was added to filer out reports with 0 battery levels. However there exist other kinds of devices that may legitimately report 0 battery levels. Fix this by filtering out 0-level reports only for digitizer usages, and continue reporting them for other kinds of devices (Smart Batteries, etc). Reported-by: 卢国宏 Fixes: 581c4484769e ("HID: input: map digitizer battery usage") Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit 4cdde87d723a0552f475c8c6b0db472a6945125f Author: Sebastian Chlad Date: Wed Oct 15 12:33:57 2025 +0200 selftests: cgroup: Use values_close_report in test_cpu Convert test_cpu to use the newly added values_close_report() helper to print detailed diagnostics when a tolerance check fails. This provides clearer insight into deviations while run in the CI. Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 3f9c60f4d3cc3e7f4dd7cac05011ea06d512050f Author: Sebastian Chlad Date: Wed Oct 15 12:33:56 2025 +0200 selftests: cgroup: add values_close_report helper Some cgroup selftests, such as test_cpu, occasionally fail by a very small margin and if run in the CI context, it is useful to have detailed diagnostic output to understand the deviation. Introduce a values_close_report() helper which performs the same comparison as values_close(), but prints detailed information when the values differ beyond the allowed tolerance. Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 1f4a222b0e334540343fbb5d3eac4584a6bfe180 Author: Linus Torvalds Date: Wed Oct 15 07:57:28 2025 -0700 Remove long-stale ext3 defconfig option Inspired by commit c065b6046b34 ("Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs") I looked around for any other left-over EXT3 config options, and found some old defconfig files still mentioned CONFIG_EXT3_DEFAULTS_TO_ORDERED. That config option was removed a decade ago in commit c290ea01abb7 ("fs: Remove ext3 filesystem driver"). It had a good run, but let's remove it for good. Signed-off-by: Linus Torvalds commit 66f8e4df003e61b72fdc794ed0ec8378d74a9a4a Merge: 9b332cece987ee c065b6046b3493 Author: Linus Torvalds Date: Wed Oct 15 07:51:57 2025 -0700 Merge tag 'ext4_for_linus-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 bug fixes from Ted Ts'o: - Fix regression caused by removing CONFIG_EXT3_FS when testing some very old defconfigs - Avoid a BUG_ON when opening a file on a maliciously corrupted file system - Avoid mm warnings when freeing a very large orphan file metadata - Avoid a theoretical races between metadata writeback and checkpoints (it's very hard to hit in practice, since the race requires that the writeback take a very long time) * tag 'ext4_for_linus-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs ext4: free orphan info with kvfree ext4: detect invalid INLINE_DATA + EXTENTS flag combination ext4, doc: fix and improve directory hash tree description ext4: wait for ongoing I/O to complete before freeing blocks jbd2: ensure that all ongoing I/O complete before freeing blocks commit 7e85ac9da1acc591bd5269f2b890ed1994c42e96 Author: Nicolas Frattaroli Date: Mon Oct 13 09:34:04 2025 +0200 PM / devfreq: rockchip-dfi: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Like many other Rockchip drivers, rockchip-dfi brings with it its own HIWORD_UPDATE macro. This variant doesn't shift the value (and like the others, doesn't do any checking). Remove it, and replace instances of it with hw_bitfield.h's FIELD_PREP_WM16. Since FIELD_PREP_WM16 requires contiguous masks and shifts the value for us, some reshuffling of definitions needs to happen. This gives us better compile-time error checking, and in my opinion, nicer code. Tested on an RK3568 ODROID-M1 board (LPDDR4X at 1560 MHz, an RK3588 Radxa ROCK 5B board (LPDDR4X at 2112 MHz) and an RK3588 Radxa ROCK 5T board (LPDDR5 at 2400 MHz). perf measurements were consistent with the measurements of stress-ng --stream in all cases. Signed-off-by: Nicolas Frattaroli Signed-off-by: Yury Norov (NVIDIA) commit 0f5878834d6ce97426219b64c02a2c4081419d53 Author: Miguel Ojeda Date: Mon Oct 13 02:14:22 2025 +0200 rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning Starting with Rust 1.92.0 (expected 2025-12-11), Rust allows to safely take the address of a union field [1][2]: CLIPPY L rust/kernel.o error: unnecessary `unsafe` block --> rust/kernel/bitmap.rs:169:13 | 169 | unsafe { core::ptr::addr_of!(self.repr.bitmap) } | ^^^^^^ unnecessary `unsafe` block | = note: `-D unused-unsafe` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unused_unsafe)]` error: unnecessary `unsafe` block --> rust/kernel/bitmap.rs:185:13 | 185 | unsafe { core::ptr::addr_of_mut!(self.repr.bitmap) } | ^^^^^^ unnecessary `unsafe` block Thus allow both instances to clean the warning in newer compilers. Link: https://github.com/rust-lang/rust/issues/141264 [1] Link: https://github.com/rust-lang/rust/pull/141469 [2] Signed-off-by: Miguel Ojeda Reviewed-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit 20b93a0088a595bceed4a026d527cbbac4e876c5 Author: Artem Shimko Date: Wed Oct 8 12:10:57 2025 +0300 firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode The SCMI_XFER_FLAG_IS_RAW flag was being cleared prematurely in scmi_xfer_raw_put() before the transfer completion was properly acknowledged by the raw message handlers. Move the clearing of SCMI_XFER_FLAG_IS_RAW and SCMI_XFER_FLAG_CHAN_SET from scmi_xfer_raw_put() to __scmi_xfer_put() to ensure the flags remain set throughout the entire raw message processing pipeline until the transfer is returned to the free pool. Fixes: 3095a3e25d8f ("firmware: arm_scmi: Add xfer helpers to provide raw access") Suggested-by: Cristian Marussi Signed-off-by: Artem Shimko Reviewed-by: Cristian Marussi Message-Id: <20251008091057.1969260-1-a.shimko.dev@gmail.com> Signed-off-by: Sudeep Holla commit 092b9e2ce6dd63d2f36822751a51957412706986 Author: Cristian Marussi Date: Tue Oct 14 12:53:46 2025 +0100 firmware: arm_scmi: Skip RAW initialization on failure Avoid attempting to initialize RAW mode when the debug subsystem itself has failed to initialize, since doing so is pointless and emits misleading error messages. Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-3-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 289ce7e9a5e1a52ac7e522a3e389dc16be08d7a4 Author: Cristian Marussi Date: Tue Oct 14 12:53:45 2025 +0100 include: trace: Fix inflight count helper on failed initialization Add a check to the scmi_inflight_count() helper to handle the case when the SCMI debug subsystem fails to initialize. Fixes: f8e656382b4a ("include: trace: Add tracepoint support for inflight xfer count") Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-2-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 2290ab43b9d8eafb8046387f10a8dfa2b030ba46 Author: Cristian Marussi Date: Tue Oct 14 12:53:44 2025 +0100 firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the SCMI debug helpers that maintain metrics counters. Fixes: 0b3d48c4726e ("firmware: arm_scmi: Track basic SCMI communication debug metrics") Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-1-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 95355766e5871e9cdc574be5a3b115392ad33aea Author: Jouni Högander Date: Mon Sep 22 13:27:25 2025 +0300 drm/i915/psr: Deactivate PSR only on LNL and when selective fetch enabled Using intel_psr_exit in frontbuffer flush on older platforms seems to be causing problems. Sending single full frame update using intel_psr_force_update is anyways more optimal compared to psr deactivate/activate -> move back to this approach on PSR1, PSR HW tracking and Panel Replay full frame update and use deactivate/activate only on LunarLake and only when selective fetch is enabled. Tested-by: Lemen Tested-by: Koos Vriezen Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14946 Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250922102725.2752742-1-jouni.hogander@intel.com (cherry picked from commit 924adb0bbdd8fef25fd229c76e3f602c3e8752ee) Signed-off-by: Rodrigo Vivi commit 437c23357d897f5b5b7d297c477da44b56654d46 Author: Pavel Begunkov Date: Wed Oct 15 13:10:31 2025 +0100 io_uring: fix unexpected placement on same size resizing There might be many reasons why a user is resizing a ring, e.g. moving to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP. Don't bypass resizing, the user will definitely be surprised seeing 0 while the rings weren't actually moved to a new place. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit be7cab44ed099566c605a8dac686c3254db01b35 Author: Pavel Begunkov Date: Wed Oct 15 13:07:23 2025 +0100 io_uring: protect mem region deregistration io_create_region_mmap_safe() protects publishing of a region against concurrent mmap calls, however we should also protect against it when removing a region. There is a gap io_register_mem_region() where it safely publishes a region, but then copy_to_user goes wrong and it unsafely frees the region. Cc: stable@vger.kernel.org Fixes: 087f997870a94 ("io_uring/memmap: implement mmap for regions") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 08823e89e3e269bf4c4a20b4c24a8119920cc7a4 Author: Ming Lei Date: Wed Oct 15 18:30:39 2025 +0800 block: Remove elevator_lock usage from blkg_conf frozen operations Remove the acquisition and release of q->elevator_lock in the blkg_conf_open_bdev_frozen() and blkg_conf_exit_frozen() functions. The elevator lock is no longer needed in these code paths since commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") which introduces `disk->rqos_state_mutex` for protecting wbt state change, and not necessary to abuse elevator_lock for this purpose. This change helps to solve the lockdep warning reported from Yu Kuai[1]. Pass blktests/throtl with lockdep enabled. Links: https://lore.kernel.org/linux-block/e5e7ac3f-2063-473a-aafb-4d8d43e5576e@yukuai.org.cn/ [1] Fixes: commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") Signed-off-by: Ming Lei Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit dc96cefef0d3032c69e46a21b345c60e56b18934 Author: Yu Kuai Date: Wed Oct 15 09:48:27 2025 +0800 blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests() Commit 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") moves blk_mq_tag_update_sched_shared_tags() before q->nr_requests is updated, however, it's still using the old q->nr_requests to resize tag depth. Fix this problem by passing in expected new tag depth. Fixes: 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Nilay Shroff Reported-by: Chris Mason Link: https://lore.kernel.org/linux-block/20251014130507.4187235-2-clm@meta.com/ Signed-off-by: Jens Axboe commit 85d7dda5a9f665ea579741ec873a8841f37e8943 Author: Mario Limonciello (AMD) Date: Tue Sep 23 10:29:29 2025 -0500 cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate After resuming from S4, all CPUs except the boot CPU have the wrong EPP hint programmed. This is because when the CPUs were offlined the EPP value was reset to 0. This is a similar problem as fixed by commit ba3319e590571 ("cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume") and the solution is also similar. When offlining rather than reset the values to zero, reset them to match those chosen by the policy. When the CPUs are onlined again these values will be restored. Closes: https://community.frame.work/t/increased-power-usage-after-resuming-from-suspend-on-ryzen-7040-kernel-6-15-regression/74531/20?u=mario_limonciello Fixes: 608a76b65288 ("cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option") Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 6b6e03106163458716c47df2baa9ad08ed4ddb0e Author: Xianwei Zhao Date: Wed Oct 15 15:36:59 2025 +0800 spi: amlogic: fix spifc build error There is an error building when Compiler version: gcc (GCC) 14.3.0 Assembler version: GNU assembler (GNU Binutils) 2.44 " Error log: WARNING: modpost: missing MODULE_DESCRIPTION() in arch/arm/probes/kprobes/test-kprobes.o ERROR: modpost: "__ffsdi2" [drivers/spi/spi-amlogic-spifc-a4.ko] undefined! " Use __ffs API instead of __bf_shf to be safer. Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/f594c621-f9e1-49f2-af31-23fbcb176058@roeck-us.net/ Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251015-fix-spifc-a4-v1-1-08e0900e5b7e@amlogic.com Signed-off-by: Mark Brown commit d877470b59910b5c50383d634dda3782386bba51 Author: ZhangGuoDong Date: Mon Oct 13 00:17:30 2025 +0800 smb: move some duplicate definitions to common/cifsglob.h In order to maintain the code more easily, move duplicate definitions to new common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Signed-off-by: Steve French commit b0432201a11b3caaeca6c03f2b3e399275b2e489 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:30 2025 +0200 smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered If a smbdirect_mr_io structure if still visible to callers of smbd_register_mr() we can't free the related memory when the connection is disconnected! Otherwise smbd_deregister_mr() will crash. Now we use a mutex and refcounting in order to keep the memory around if the connection is disconnected. It means smbd_deregister_mr() can be called at any later time to free the memory, which is no longer referenced by nor referencing the connection. It also means smbd_destroy() no longer needs to wait for mr_io.used.count to become 0. Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 88f170814fea74911ceab798a43cbd7c5599bed4 Author: Marios Makassikis Date: Wed Oct 15 09:25:46 2025 +0200 ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool: $ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8) The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock Adjust ksmbd_session_rpc_method() callers to take the lock when necessary. Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access") Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit 379510a815cb2e64eb0a379cb62295d6ade65df0 Author: ZhangGuoDong Date: Sun Oct 12 00:51:36 2025 +0800 smb/server: fix possible refcount leak in smb2_sess_setup() Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put(). Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 Author: ZhangGuoDong Date: Sun Oct 12 00:47:59 2025 +0800 smb/server: fix possible memory leak in smb2_read() Memory leak occurs when ksmbd_vfs_read() fails. Fix this by adding the missing kvfree(). Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5fb750e8a9ae123b2034771b864b8a21dbef65cd Author: Alexei Starovoitov Date: Tue Oct 14 17:07:00 2025 -0700 bpf: Replace bpf_map_kmalloc_node() with kmalloc_nolock() to allocate bpf_async_cb structures. The following kmemleak splat: [ 8.105530] kmemleak: Trying to color unknown object at 0xff11000100e918c0 as Black [ 8.106521] Call Trace: [ 8.106521] [ 8.106521] dump_stack_lvl+0x4b/0x70 [ 8.106521] kvfree_call_rcu+0xcb/0x3b0 [ 8.106521] ? hrtimer_cancel+0x21/0x40 [ 8.106521] bpf_obj_free_fields+0x193/0x200 [ 8.106521] htab_map_update_elem+0x29c/0x410 [ 8.106521] bpf_prog_cfc8cd0f42c04044_overwrite_cb+0x47/0x4b [ 8.106521] bpf_prog_8c30cd7c4db2e963_overwrite_timer+0x65/0x86 [ 8.106521] bpf_prog_test_run_syscall+0xe1/0x2a0 happens due to the combination of features and fixes, but mainly due to commit 6d78b4473cdb ("bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()") It's using __GFP_HIGH, which instructs slub/kmemleak internals to skip kmemleak_alloc_recursive() on allocation, so subsequent kfree_rcu()-> kvfree_call_rcu()->kmemleak_ignore() complains with the above splat. To fix this imbalance, replace bpf_map_kmalloc_node() with kmalloc_nolock() and kfree_rcu() with call_rcu() + kfree_nolock() to make sure that the objects allocated with kmalloc_nolock() are freed with kfree_nolock() rather than the implicit kfree() that kfree_rcu() uses internally. Note, the kmalloc_nolock() happens under bpf_spin_lock_irqsave(), so it will always fail in PREEMPT_RT. This is not an issue at the moment, since bpf_timers are disabled in PREEMPT_RT. In the future bpf_spin_lock will be replaced with state machine similar to bpf_task_work. Fixes: 6d78b4473cdb ("bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Reviewed-by: Shakeel Butt Acked-by: Harry Yoo Acked-by: Vlastimil Babka Cc: linux-mm@kvack.org Link: https://lore.kernel.org/bpf/20251015000700.28988-1-alexei.starovoitov@gmail.com commit d5cda96d0130effd4255f7c5e720a58760a032a4 Author: Srinivas Kandagatla Date: Wed Oct 8 15:58:01 2025 +0100 ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls Component bind callbacks already does runtime pm calls, soundwire codec also tries to do the exactly same thing resulting in Unbalanced pm_runtime_enable and disable calls. Remove the redundant calls from wcd938x-sdw driver. Reported-by: Konrad Dybcio Fixes: ebaf88c0546d ("ASoC: codecs: wcd-common: move component ops to common") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251008145801.3479-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 57b00ab3d33d2b177bf45d568fa1e6203cd099b6 Author: Shuming Fan Date: Tue Oct 14 17:21:57 2025 +0800 ASoC: sdw_utils: add rt1321 part id to codec_info_list The SdW machine driver supports the part id rt1321 amplifier. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251014092157.2789054-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 2d8636119b92970ba135c3c4da87d24dbfdeb8ca Author: Jeongjun Park Date: Wed Oct 15 16:34:54 2025 +0900 exfat: fix out-of-bounds in exfat_nls_to_ucs2() Since the len argument value passed to exfat_ioctl_set_volume_label() from exfat_nls_to_utf16() is passed 1 too large, an out-of-bounds read occurs when dereferencing p_cstring in exfat_nls_to_ucs2() later. And because of the NLS_NAME_OVERLEN macro, another error occurs when creating a file with a period at the end using utf8 and other iocharsets. So to avoid this, you should remove the code that uses NLS_NAME_OVERLEN macro and make the len argument value be the length of the label string, but with a maximum length of FSLABEL_MAX - 1. Reported-by: syzbot+98cc76a76de46b3714d4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=98cc76a76de46b3714d4 Fixes: d01579d590f7 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL") Suggested-by: Pali Rohár Signed-off-by: Jeongjun Park Signed-off-by: Namjae Jeon commit 34cbd6e07fddf36e186c8bf26a456fb7f50af44e Author: tr1x_em Date: Thu Sep 25 09:10:03 2025 +0530 platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530 Makes alienware-wmi load on G15 5530 by default Cc: stable@vger.kernel.org Signed-off-by: Saumya Reviewed-by: Kurt Borja Link: https://patch.msgid.link/20250925034010.31414-1-admin@trix.is-a.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 28412b489b088fb88dff488305fd4e56bd47f6e4 Author: Jiaming Zhang Date: Wed Oct 15 13:16:45 2025 +0800 ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed(). Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ Signed-off-by: Jiaming Zhang Signed-off-by: Takashi Iwai commit f4f868baf292550acbfc35839213de9da0d9e8ab Author: Denis Benato Date: Fri Oct 3 20:49:49 2025 +0200 MAINTAINERS: add Denis Benato as maintainer for asus notebooks Add myself as maintainer for "ASUS NOTEBOOKS AND EEEPC ACPI/WMI EXTRAS DRIVERS" as suggested by Hans de Goede and Armin Wolf. Signed-off-by: Denis Benato Link: https://lore.kernel.org/all/8128cd6b-50e3-464c-90c2-781f61c3963e@gmail.com Reviewed-by: Hans de Goede Acked-by: Luke Jones Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251003184949.1083030-1-benato.denis96@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a7b4747d8e0e7871c3d4971cded1dcc9af6af9e9 Author: David Thompson Date: Mon Oct 13 15:56:05 2025 +0000 platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init The lock-related debug logic (CONFIG_LOCK_STAT) in the kernel is noting the following warning when the BlueField-3 SOC is booted: BUG: key ffff00008a3402a8 has not been registered! ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 4 PID: 592 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x1d4/0x2a0 Call trace: lockdep_init_map_type+0x1d4/0x2a0 __kernfs_create_file+0x84/0x140 sysfs_add_file_mode_ns+0xcc/0x1cc internal_create_group+0x110/0x3d4 internal_create_groups.part.0+0x54/0xcc sysfs_create_groups+0x24/0x40 device_add+0x6e8/0x93c device_register+0x28/0x40 __hwmon_device_register+0x4b0/0x8a0 devm_hwmon_device_register_with_groups+0x7c/0xe0 mlxbf_pmc_probe+0x1e8/0x3e0 [mlxbf_pmc] platform_probe+0x70/0x110 The mlxbf_pmc driver must call sysfs_attr_init() during the initialization of the "count_clock" data structure to avoid this warning. Fixes: 5efc800975d9 ("platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count") Reviewed-by: Shravan Kumar Ramani Signed-off-by: David Thompson Link: https://patch.msgid.link/20251013155605.3589770-1-davthompson@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a49c4d48c3b60926e6a8cec217bf95aa65388ecc Author: Kurt Borja Date: Tue Oct 14 05:07:27 2025 -0500 platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers Devices without the AWCC interface don't initialize `awcc`. Add a check before dereferencing it in sleep handlers. Cc: stable@vger.kernel.org Reported-by: Gal Hammer Tested-by: Gal Hammer Fixes: 07ac275981b1 ("platform/x86: alienware-wmi-wmax: Add support for manual fan control") Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251014-sleep-fix-v3-1-b5cb58da4638@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6f719373b943a955fee6fc2012aed207b65e2854 Author: Thomas Zimmermann Date: Tue Oct 14 10:46:34 2025 +0200 drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware. Ast currently blanks via sync-off bits in VGACRB6. Not all BMCs handle VGACRB6 correctly. After disabling sync during a reboot, some BMCs do not reenable it after the soft reset. The display output remains dark. When the display is off during boot, some BMCs set the sync-off bits in VGACRB6, so the display remains dark. Observed with Blackbird AST2500 BMCs. Clearing the sync-off bits unconditionally fixes these issues. Also do not modify VGASR1's SD bit for blanking, as it only disables GPU access to video memory. v2: - init vgacrb6 correctly (Jocelyn) Signed-off-by: Thomas Zimmermann Fixes: ce3d99c83495 ("drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers") Tested-by: Nick Bowler Reported-by: Nick Bowler Closes: https://lore.kernel.org/dri-devel/wpwd7rit6t4mnu6kdqbtsnk5bhftgslio6e2jgkz6kgw6cuvvr@xbfswsczfqsi/ Cc: Douglas Anderson Cc: Dave Airlie Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v6.7+ Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251014084743.18242-1-tzimmermann@suse.de commit 82ebecdc74ff555daf70b811d854b1f32a296bea Author: Jaehun Gou Date: Tue Oct 14 22:01:46 2025 +0900 exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang. Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue. This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability. Co-developed-by: Seunghun Han Signed-off-by: Seunghun Han Co-developed-by: Jihoon Kwon Signed-off-by: Jihoon Kwon Signed-off-by: Jaehun Gou Signed-off-by: Namjae Jeon commit 7f0fddd817ba6daebea1445ae9fab4b6d2294fa8 Author: Florian Westphal Date: Mon Oct 13 20:50:52 2025 +0200 net: core: fix lockdep splat on device unregister Since blamed commit, unregister_netdevice_many_notify() takes the netdev mutex if the device needs it. If the device list is too long, this will lock more device mutexes than lockdep can handle: unshare -n \ bash -c 'for i in $(seq 1 100);do ip link add foo$i type dummy;done' BUG: MAX_LOCK_DEPTH too low! turning off the locking correctness validator. depth: 48 max: 48! 48 locks held by kworker/u16:1/69: #0: ..148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work #1: ..d40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work #2: ..bd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net #3: ..aa8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch #4: ..cb0 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify [..] Add a helper to close and then unlock a list of net_devices. Devices that are not up have to be skipped - netif_close_many always removes them from the list without any other actions taken, so they'd remain in locked state. Close devices whenever we've used up half of the tracking slots or we processed entire list without hitting the limit. Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20251013185052.14021-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 Author: Andrii Nakryiko Date: Tue Oct 14 13:20:37 2025 -0700 selftests/bpf: make arg_parsing.c more robust to crashes We started getting a crash in BPF CI, which seems to originate from test_parse_test_list_file() test and is happening at this line: ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); One way we can crash there is if set.cnt zero, which is checked for with ASSERT_EQ() above, but we proceed after this regardless of the outcome. Instead of crashing, we should bail out with test failure early. Similarly, if parse_test_list_file() fails, we shouldn't be even looking at set, so bail even earlier if ASSERT_OK() fails. Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") Signed-off-by: Andrii Nakryiko Tested-by: Ihor Solodrai Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit a4bbb493a3247ef32f6191fd8b2a0657139f8e08 Author: Alison Schofield Date: Tue Oct 14 14:38:49 2025 -0700 cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events Traces of cxl_poison events include an hpa_alias0 field if the poison address is in a region configured with an ELC, Extended Linear Cache. Since the ELC always comes first in the region, the calculation needs to subtract the ELC size from the calculated HPA address. Fixes: 8c520c5f1e76 ("cxl: Add extended linear cache address alias emission for cxl events") Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Signed-off-by: Dave Jiang commit df5a1f4aeb6ff5e7c5ac47d16a347f03509dd441 Author: Jonas Gorski Date: Mon Oct 13 20:03:47 2025 +0200 MAINTAINERS: add myself as maintainer for b53 I wrote the original OpenWrt driver that Florian used as the base for the dsa driver, I might as well take responsibility for it. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251013180347.133246-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 469276c06affdfd2d9e88c9f228bb81119ec1a20 Author: Ilpo Järvinen Date: Tue Oct 14 19:36:02 2025 +0300 PCI: Revert early bridge resource set up The commit a43ac325c7cb ("PCI: Set up bridge resources earlier") moved bridge window resources set up earlier than before. The change was necessary to support another change that got pulled on the last minute due to breaking s390 and other systems. The presence of valid bridge window resources earlier than before allows pci_assign_unassigned_root_bus_resources() call from pci_host_probe() assign the bridge windows. Some host bridges, however, have to wait first for the link up event before they can enumerate successfully (see e.g. qcom_pcie_global_irq_thread()) and thus the bus has not been enumerated yet while calling pci_host_probe(). Calling pci_assign_unassigned_root_bus_resources() without results from enumeration can result in sizing bridge windows with too small sizes which cannot be later corrected after the enumeration has completed because bridge windows have become pinned in place by the other resources. Interestingly, it seems pci_read_bridge_bases() is not called at all in the problematic case and the bridge window resource type setup is done by pci_bridge_check_ranges() and sizing by the usual resource fitting logic. The root problem behind all this looks pretty generic. If resource fitting is called too early, the hotplug reservation and old size lower bounding cause the bridge windows to be assigned without children but with non-zero size, which leads to these pinning problems. As such, this can likely be solved on the general level but the solution does not look trivial. As the commit a43ac325c7cb ("PCI: Set up bridge resources earlier") was prequisite for other change that did not end up into kernel yet, revert it to resolve the resource assignment failures and give time to code and test a generic solution. Fixes: a43ac325c7cb ("PCI: Set up bridge resources earlier") Reported-by: Val Packett Link: https://lore.kernel.org/r/017ff8df-511c-4da8-b3cf-edf2cb7f1a67@packett.cool Reported-by: Guenter Roeck Link: https://lore.kernel.org/r/df266709-a9b3-4fd8-af3a-c22eb3c9523a@roeck-us.net Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251014163602.17138-1-ilpo.jarvinen@linux.intel.com commit 05e63305c85c88141500f0a2fb02afcfba9396e1 Author: Andrea Righi Date: Mon Oct 13 22:36:34 2025 +0200 sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads If we load a BPF scheduler while another scheduler is already running, alloc_kick_pseqs() would be called again, overwriting the previously allocated arrays. Fix by moving the alloc_kick_pseqs() call after the scx_enable_state() check, ensuring that the arrays are only allocated when a scheduler can actually be loaded. Fixes: 14c1da3895a11 ("sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc()") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 257c4b03a2f7d8c15f79c79b09a561af9734f6c4 Author: Alison Schofield Date: Tue Oct 14 00:31:04 2025 -0700 cxl/region: Use %pa printk format to emit resource_size_t KASAN reports a stack-out-of-bounds access in validate_region_offset() while running the cxl-poison.sh unit test because the printk format specifier, %pr format, is not a match for the resource_size_t type of the variables. %pr expects struct resource pointers and attempts to dereference the structure fields, reading beyond the bounds of the stack variables. Since these messages emit an 'A exceeds B' type of message, keep the resource_size_t's and use the %pa specifier to be architecture safe. BUG: KASAN: stack-out-of-bounds in resource_string.isra.0+0xe9a/0x1690 [] Read of size 8 at addr ffff88800a7afb40 by task bash/1397 ... [] The buggy address belongs to stack of task bash/1397 [] and is located at offset 56 in frame: [] validate_region_offset+0x0/0x1c0 [cxl_core] Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset") Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Signed-off-by: Dave Jiang commit f4d027921c811ff7fc16e4d03c6bbbf4347cf37a Author: Dave Jiang Date: Fri Oct 10 13:57:55 2025 -0700 cxl: Fix match_region_by_range() to use region_res_match_cxl_range() match_region_by_range() is not using the helper function that also takes extended linear cache size into account when comparing regions. This causes a x2 region to show up as 2 partial incomplete regions rather than a single CXL region with extended linear cache support. Replace the open coded compare logic with the proper helper function for comparison. User visible impact is that when 'cxl list' is issued, no activa CXL region(s) are shown. There may be multiple idle regions present. No actual active CXL region is present in the kernel. [dj: Fix stable address] Fixes: 0ec9849b6333 ("acpi/hmat / cxl: Add extended linear cache support for CXL") Cc: stable@vger.kernel.org Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Signed-off-by: Dave Jiang commit 0f6f1982cb28abf1b8a3a8ba906e2c6ade6a70e8 Author: Dave Jiang Date: Fri Oct 10 13:57:54 2025 -0700 cxl: Set range param for region_res_match_cxl_range() as const The function takes two parameters and compares them. The second parameter should be const since no modification should be done to it. Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 2e41e5a91a37202ff6743c3ae5329e106aeb1c6c Author: Dave Jiang Date: Fri Oct 10 13:57:53 2025 -0700 cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size() In order to compare the resource against the HMAT memory target, the resource needs to be memory type. Change the DEFINE_RES() macro to DEFINE_RES_MEM() in order to set the correct resource type. hmat_get_extended_linear_cache_size() uses resource_contains() internally. This causes a regression for platforms with the extended linear cache enabled as the comparison always fails and the cache size is not set. User visible impact is that when 'cxl list' is issued, a CXL region with extended linear cache support will only report half the size of the actual size. And this also breaks MCE reporting of the memory region due to incorrect offset calculation for the memory. [dj: Fixup commit log suggested by djbw] [dj: Fixup stable address for cc] Fixes: 12b3d697c812 ("cxl: Remove core/acpi.c and cxl core dependency on ACPI") Cc: stable@vger.kernel.org Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Signed-off-by: Dave Jiang commit 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 Author: Shardul Bankar Date: Tue Oct 14 17:30:37 2025 +0530 bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path Fix a memory leak in bpf_prog_test_run_xdp() where the context buffer allocated by bpf_ctx_init() is not freed when the function returns early due to a data size check. On the failing path: ctx = bpf_ctx_init(...); if (kattr->test.data_size_in - meta_sz < ETH_HLEN) return -EINVAL; The early return bypasses the cleanup label that kfree()s ctx, leading to a leak detectable by kmemleak under fuzzing. Change the return to jump to the existing free_ctx label. Fixes: fe9544ed1a2e ("bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN") Reported-by: BPF Runtime Fuzzer (BRF) Signed-off-by: Shardul Bankar Signed-off-by: Martin KaFai Lau Acked-by: Jiri Olsa Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20251014120037.1981316-1-shardulsb08@gmail.com commit df90f6cd29d8c77be6de4f9adf9cbe42ce2f0016 Author: Vlastimil Babka Date: Tue Oct 14 10:40:57 2025 +0200 slab: fix clearing freelist in free_deferred_objects() defer_free() links pending objects using the slab's freelist offset which is fine as they are not free yet. free_deferred_objects() then clears this pointer to avoid confusing the debugging consistency checks that may be enabled for the cache. However, with CONFIG_SLAB_FREELIST_HARDENED, even the NULL pointer needs to be encoded appropriately using set_freepointer(), otherwise it's decoded as something else and triggers the consistency checks, as found by the kernel test robot. Use set_freepointer() to prevent the issue. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Reported-and-tested-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202510101652.7921fdc6-lkp@intel.com Acked-by: Alexei Starovoitov Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 Author: Dragan Simic Date: Sat Sep 6 12:01:22 2025 +0200 arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic Unify the naming of the existing GPU OPP table nodes found in the RK3588 and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following the more "modern" node naming scheme. Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j") Signed-off-by: Dragan Simic [opp-table also is way too generic on systems with like 4-5 opp-tables] Signed-off-by: Heiko Stuebner commit 9b332cece987ee1790b2ed4c989e28162fa47860 Merge: 5bd0116d92a784 4b47a8601b71ad Author: Linus Torvalds Date: Tue Oct 14 09:28:12 2025 -0700 Merge tag 'nfsd-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix a crasher reported by rtm@csail.mit.edu * tag 'nfsd-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Define a proc_layoutcommit for the FlexFiles layout type commit afb5f84b216d14a71e2962ed569edcea30cf9763 Author: Diederik de Haas Date: Wed Oct 8 10:21:22 2025 +0200 arm64: dts: rockchip: Drop 'rockchip,grf' prop from tsadc on rk3328 The 'rockchip,grf' property for tsadc in rk3328 wasn't actually used in the driver and is no longer allowed in the DT since commit e881662aa06a ("dt-bindings: thermal: rockchip: Tighten grf requirements") So remove that property which fixes the following DT validation issue tsadc@ff250000 (rockchip,rk3328-tsadc): rockchip,grf: False schema does not allow [[58]] Signed-off-by: Diederik de Haas Signed-off-by: Heiko Stuebner commit 05b80cd1f37db042e074ecc7ee0d39869fed2f52 Author: Alexey Charkov Date: Thu Oct 9 16:34:01 2025 +0400 arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576 Drop the top-frequency OPPs from both the LITTLE and big CPU clusters on RK3576, as neither the opensource TF-A [1] nor the recent (after v1.08) binary BL31 images provided by Rockchip expose those. This fixes the problem [2] when the cpufreq governor tries to jump directly to the highest-frequency OPP, which results in a failed SCMI call leaving the system stuck at the previous OPP before the attempted change. [1] https://github.com/ARM-software/arm-trusted-firmware/blob/master/plat/rockchip/rk3576/scmi/rk3576_clk.c#L264-L304 [2] https://lore.kernel.org/linux-rockchip/CABjd4Yz4NbqzZH4Qsed3ias56gcga9K6CmYA+BLDBxtbG915Ag@mail.gmail.com/ Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") Cc: stable@vger.kernel.org Signed-off-by: Alexey Charkov Signed-off-by: Heiko Stuebner commit e179de737d13ad99bd19ea0fafab759d4074a425 Author: Andrey Leonchikov Date: Sun Oct 12 14:33:36 2025 +0200 arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2 Fix typo into regulator GPIO definition. With current definition, PCIe doesn't start up. Valid definition is already used in "pinctrl" section, "pcie_drv" (gpio4, RK_PB1). Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Andrey Leonchikov Signed-off-by: Heiko Stuebner commit 5bd0116d92a7849b12f0b4c8199d53aa80e449bc Merge: 3a8660878839fa e2c69490dda5d4 Author: Linus Torvalds Date: Tue Oct 14 09:15:45 2025 -0700 Merge tag 'for-linus-6.18-2' of https://github.com/cminyard/linux-ipmi Pull IPMI fixes from Corey Minyard: "A few bug fixes for patches that went in this release: a refcount error and some missing or incorrect error checks" * tag 'for-linus-6.18-2' of https://github.com/cminyard/linux-ipmi: ipmi: Fix handling of messages with provided receive message pointer mfd: ls2kbmc: check for devm_mfd_add_devices() failure mfd: ls2kbmc: Fix an IS_ERR() vs NULL check in probe() commit d425aef66e62221fa6bb0ccb94296df29e4cc107 Author: Anand Moon Date: Mon Oct 13 20:50:03 2025 +0530 arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 Enable proper pin multiplexing for the I2S1 8-channel transmit interface by adding the default pinctrl configuration which esures correct signal routing and avoids pinmux conflicts during audio playback. Changes fix the error [ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s [ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) [ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl [ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 and SDO0 signals, so limit the claimed pins to those. With this change audio output works as expected: $ aplay -l **** List of PLAYBACK Hardware Devices **** card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0 card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0 Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1") Cc: Aurelien Jarno Signed-off-by: Anand Moon [adapted the commit message a bit] Signed-off-by: Heiko Stuebner commit 7e091add9c433bab6912228799bf508e2414acc3 Author: Martin George Date: Mon Sep 8 22:54:57 2025 +0530 nvme-auth: update sc_c in host response The sc_c field is currently not updated in the host response to the controller challenge leading to failures while attempting secure channel concatenation. Fix this by adding a new sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response. Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") Signed-off-by: Martin George Signed-off-by: Prashanth Adurthi Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 52e59f7740ba23bbb664914967df9a00208ca10c Author: Pranjal Ramajor Asha Kanojiya Date: Tue Oct 7 08:18:37 2025 +0200 accel/qaic: Synchronize access to DBC request queue head & tail pointer Two threads of the same process can potential read and write parallelly to head and tail pointers of the same DBC request queue. This could lead to a race condition and corrupt the DBC request queue. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip [jhugo: Add fixes tag] Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca Author: Youssef Samir Date: Tue Oct 7 14:23:20 2025 +0200 accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dma_xfer struct. In that case, encode_addr_size_pairs() will try to access the sgt which will lead to a general protection fault. Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred. Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") Signed-off-by: Youssef Samir Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com commit fd6e385528d8f85993b7bfc6430576136bb14c65 Author: Jeff Hugo Date: Tue Oct 7 13:57:50 2025 +0200 accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to queuing the buffers. We currently initialize some of the resources after queuing the buffers which creates a race between the probe() and any data that comes back from the device. If the uninitialized resources are accessed, we could see page faults. Fix the init ordering to close the race. Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs") Signed-off-by: Jeffrey Hugo Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com commit c90fad3e4157f943b6d5842d3ceb20b32e566986 Author: Jacopo Mondi Date: Tue Oct 14 15:19:34 2025 +0200 media: ivtv: Fix invalid access to file * Since commit 9ba9d11544f9 ("media: ivtv: Access v4l2_fh from file") all ioctl handlers have been ported to operate on the file * first function argument. The ivtv DVB layer calls ivtv_init_on_first_open() when the driver needs to start streaming. This function calls the s_input() and s_frequency() ioctl handlers directly, but being called from the driver context, it doesn't have a valid file * to pass them. This causes the ioctl handlers to deference an invalid pointer. Fix this by moving the implementation of those ioctls to two helper functions. The ivtv_do_s_input() helper accepts a struct ivtv * as first argument, which is easily accessible in ivtv_init_on_first_open() as well as from the file * argument of the ioctl handler. The ivtv_s_frequency() takes an ivtv_stream * instead. The stream * can safely be accessed in ivtv_init_on_first_open() where it is hard-coded to the IVTV_ENC_STREAM_TYPE_MPG stream type, as well as from the ioctl handler as a valid stream type is associated to each open file handle depending on which video device node has been opened in the ivtv_open() file operation. The bug has been reported by Smatch. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aKL4OMWsESUdX8KQ@stanley.mountain/ Fixes: 9ba9d11544f9 ("media: ivtv: Access v4l2_fh from file") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Tested-by: Hans Verkuil Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 512f0b7ebbc79d97d9485cd055902d439237e91f Author: Jacopo Mondi Date: Tue Oct 14 15:19:33 2025 +0200 media: cx18: Fix invalid access to file * Sice commit 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file") all ioctl handlers have been ported to operate on the file * first function argument. The cx18 DVB layer calls cx18_init_on_first_open() when the driver needs to start streaming. This function calls the s_input(), s_std() and s_frequency() ioctl handlers directly, but being called from the driver context, it doesn't have a valid file * to pass them. This causes the ioctl handlers to deference an invalid pointer. Fix this by moving the implementation of those ioctls to functions that take a cx18 pointer instead of a file pointer, and turn the V4L2 ioctl handlers into wrappers that get the cx18 from the file. When calling from cx18_init_on_first_open(), pass the cx18 pointer directly. This allows removing the fake fh in cx18_init_on_first_open(). The bug has been reported by Smatch: --> 1223 cx18_s_input(NULL, &fh, video_input); The patch adds a new dereference of "file" but some of the callers pass a NULL pointer. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aKL4OMWsESUdX8KQ@stanley.mountain/ Fixes: 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Tested-by: Hans Verkuil Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d41f68dff783d181a8fd462e612bda0fbab7f735 Author: Randy Dunlap Date: Mon Oct 13 20:05:52 2025 -0700 ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") Signed-off-by: Randy Dunlap Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 4f86eb0a38bc719ba966f155071a6f0594327f34 Author: Wang Liang Date: Mon Oct 13 16:00:39 2025 +0800 selftests: net: check jq command is supported The jq command is used in vlan_bridge_binding.sh, if it is not supported, the test will spam the following log. # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # TEST: Test bridge_binding on->off when lower down [FAIL] # Got operstate of , expected 0 The rtnetlink.sh has the same problem. It makes sense to check if jq is installed before running these tests. After this patch, the vlan_bridge_binding.sh skipped if jq is not supported: # timeout set to 3600 # selftests: net: vlan_bridge_binding.sh # TEST: jq not installed [SKIP] Fixes: dca12e9ab760 ("selftests: net: Add a VLAN bridge binding selftest") Fixes: 6a414fd77f61 ("selftests: rtnetlink: Add an address proto test") Signed-off-by: Wang Liang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20251013080039.3035898-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit 867537094124b0736ca2a40193de94fc5dc0b8d3 Author: Rob Herring (Arm) Date: Mon Oct 13 16:31:18 2025 -0500 dt-bindings: i2c: Convert apm,xgene-slimpro-i2c to DT schema Convert APM X-Gene slimpro-i2c binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 72f437e674e54f1c143dccc67e5556d8d5acb241 Author: Hans de Goede Date: Wed Oct 1 23:23:10 2025 +0200 i2c: usbio: Add ACPI device-id for MTL-CVF devices Add "INTC10D2" ACPI device-id for MTL-CVF devices, like the Dell Latitude 7450. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2368506 Signed-off-by: Hans de Goede Acked-by: Sakari Ailus Acked-by: Israel Cepeda Signed-off-by: Wolfram Sang commit ae11e08c3d0c78d08dac4cea30bf39ede2130b03 Author: Sakari Ailus Date: Fri Jul 4 10:54:15 2025 +0300 i2c: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Andi Shyti Signed-off-by: Wolfram Sang commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 Author: Vincent Guittot Date: Wed Oct 8 15:12:14 2025 +0200 sched/fair: Fix pelt lost idle time detection The check for some lost idle pelt time should be always done when pick_next_task_fair() fails to pick a task and not only when we call it from the fair fast-path. The case happens when the last running task on rq is a RT or DL task. When the latter goes to sleep and the /Sum of util_sum of the rq is at the max value, we don't account the lost of idle time whereas we should. Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) commit ee6e44dfe6e50b4a5df853d933a96bdff5309e6e Author: Peter Zijlstra (Intel) Date: Fri Oct 10 00:17:27 2025 +0530 sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1" WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170 NIP [c0000000002b6ed8] cpudl_set+0x58/0x170 LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 Call Trace: [c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable) [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 [c00000000034df84] __hrtimer_run_queues+0x1a4/0x390 [c00000000034f624] hrtimer_interrupt+0x124/0x300 [c00000000002a230] timer_interrupt+0x140/0x320 Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") This happens since: - dl_server hrtimer gets enqueued close to cpu offline, when kthread_park enqueues a fair task. - CPU goes offline and drmgr removes it from cpu_present_mask. - hrtimer fires and warning is hit. Fix it by stopping the dl_server before CPU is marked dead. [1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/ [2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr [sshegde: wrote the changelog and tested it] Fixes: 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") Closes: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Reported-by: Venkat Rao Bagalkote Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marek Szyprowski Tested-by: Shrikanth Hegde commit a7cdc2086c19e435d4cec3f9393b5f46899c0468 Author: Colin Ian King Date: Sun Sep 28 22:01:18 2025 +0100 HID: hid-debug: Fix spelling mistake "Rechargable" -> "Rechargeable" There is a spelling mistake in HID description. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Jiri Kosina commit bd5afca115f181c85f992d42a57cd497bc823ccb Author: Lorenzo Bianconi Date: Sun Oct 12 11:19:44 2025 +0200 net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit() Completion napi can free out-of-order tx descriptors if hw QoS is enabled and packets with different priority are queued to same DMA ring. Take into account possible out-of-order reports checking if the tx queue is full using circular buffer head/tail pointer instead of the number of queued packets. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Suggested-by: Simon Horman Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251012-airoha-tx-busy-queue-v2-1-a600b08bab2d@kernel.org Signed-off-by: Paolo Abeni commit 295ce1eb36ae47dc862d6c8a1012618a25516208 Author: Eric Dumazet Date: Sat Oct 11 11:57:42 2025 +0000 tcp: fix tcp_tso_should_defer() vs large RTT Neal reported that using neper tcp_stream with TCP_TX_DELAY set to 50ms would often lead to flows stuck in a small cwnd mode, regardless of the congestion control. While tcp_stream sets TCP_TX_DELAY too late after the connect(), it highlighted two kernel bugs. The following heuristic in tcp_tso_should_defer() seems wrong for large RTT: delta = tp->tcp_clock_cache - head->tstamp; /* If next ACK is likely to come too late (half srtt), do not defer */ if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) goto send_now; If next ACK is expected to come in more than 1 ms, we should not defer because we prefer a smooth ACK clocking. While blamed commit was a step in the good direction, it was not generic enough. Another patch fixing TCP_TX_DELAY for established flows will be proposed when net-next reopens. Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Tested-by: Neal Cardwell Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com [pabeni@redhat.com: fixed whitespace issue] Signed-off-by: Paolo Abeni commit 083a4f3f3cc7d107728c8f297e4f6276f0876b2d Author: Jonathan Denose Date: Mon Oct 13 20:54:57 2025 +0000 HID: Kconfig: Fix build error from CONFIG_HID_HAPTIC Temporarily change CONFIG_HID_HAPTIC to be bool instead of tristate, until we implement a permanent solution. Recently the CONFIG_HID_HAPTIC Kconfig option was reported as causing the following build errors: MODPOST Module.symvers ERROR: modpost: "hid_haptic_init" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_pressure_increase" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_check_pressure_unit" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_input_configured" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_input_mapping" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_feature_mapping" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_pressure_reset" [drivers/hid/hid-multitouch.ko] undefined! make[3]: *** [/home/thl/var/linux.dev/scripts/Makefile.modpost:147: Module.symvers] Error 1 when the kernel is compiled with the following configuration: CONFIG_HID=y CONFIG_HID_MULTITOUCH=m CONFIG_HID_HAPTIC=m To resolve this, temporarily change the CONFIG_HID_HAPTIC option to be bool, until we arrive at a permanent solution to enable CONFIG_HID_HAPTIC to be tristate. For a more detailed discussion, see [1]. [1]: https://lore.kernel.org/linux-input/auypydfkhx2eg7vp764way4batdilzc35inqda3exwzs3tk3ff@oagat6g46zto/ Signed-off-by: Jonathan Denose Signed-off-by: Jiri Kosina commit 75527d61d60d493d1eb064f335071a20ca581f54 Author: Yi Cong Date: Sat Oct 11 16:24:15 2025 +0800 r8152: add error handling in rtl8152_driver_init rtl8152_driver_init() is missing the error handling. When rtl8152_driver registration fails, rtl8152_cfgselector_driver should be deregistered. Fixes: ec51fbd1b8a2 ("r8152: add USB device driver for config selection") Cc: stable@vger.kernel.org Signed-off-by: Yi Cong Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251011082415.580740-1-yicongsrfy@163.com [pabeni@redhat.com: clarified the commit message] Signed-off-by: Paolo Abeni commit b8874720b2f33a06ff1d4cf3827e7ec1195cb360 Author: Vicki Pfau Date: Mon Oct 6 18:05:33 2025 -0700 HID: nintendo: Rate limit IMU compensation message Some controllers are very bad at updating the IMU, leading to these messages spamming the syslog. Rate-limiting them helps with this a bit. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit b73bc6a51f0c0066912c7e181acee41091c70fe6 Author: Vicki Pfau Date: Mon Oct 6 18:05:32 2025 -0700 HID: nintendo: Wait longer for initial probe Some third-party controllers, such as the PB Tails CHOC, won't always respond quickly on startup. Since this packet is needed for probe, and only once during probe, let's just wait an extra second, which makes connecting consistent. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit 1d64624243af8329b4b219d8c39e28ea448f9929 Author: Vicki Pfau Date: Mon Oct 6 18:05:31 2025 -0700 HID: core: Add printk_ratelimited variants to hid_warn() etc hid_warn_ratelimited() is needed. Add the others as part of the block. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 Author: Zqiang Date: Sat Oct 11 15:05:18 2025 +0800 usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx(). Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change") Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1e1 Suggested-by: Jakub Kicinski Signed-off-by: Zqiang Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev Signed-off-by: Paolo Abeni commit 1141ed52348d3df82d3fd2316128b3fc6203a68c Author: Oleg Makarenko Date: Mon Sep 29 18:46:11 2025 +0300 HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. This device reboots itself every 8-10 seconds if it is not polled. Signed-off-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 Author: Tristan Lobb Date: Sun Sep 28 18:25:43 2025 +0200 HID: quirks: avoid Cooler Master MM712 dongle wakeup bug The Cooler Master Mice Dongle includes a vendor defined HID interface alongside its mouse interface. Not polling it will cause the mouse to stop responding to polls on any interface once woken up again after going into power saving mode. Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and the Dongle's PID. Signed-off-by: Tristan Lobb Signed-off-by: Jiri Kosina commit c5705a2a4aa35350e504b72a94b5c71c3754833c Author: Harshit Mogalapalli Date: Fri Oct 10 13:42:39 2025 -0700 Octeontx2-af: Fix missing error code in cgx_probe() When CGX fails mapping to NIX, set the error code to -ENODEV, currently err is zero and that is treated as success path. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aLAdlCg2_Yv7Y-3h@stanley.mountain/ Fixes: d280233fc866 ("Octeontx2-af: Fix NIX X2P calibration failures") Signed-off-by: Harshit Mogalapalli Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251010204239.94237-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Paolo Abeni commit 362f21536966d7039da1de762f28f4ad44565acc Author: Deepak Sharma Date: Fri Sep 26 20:28:11 2025 +0530 HID: cp2112: Add parameter validation to data length Syzkaller reported a stack OOB access in cp2112_write_req caused by lack of parameter validation for the user input in I2C SMBUS ioctl in cp2112 driver Add the parameter validation for the data->block[0] to be bounded by I2C_SMBUS_BLOCK_MAX + the additional compatibility padding [jkosina@suse.com: fix whitespace damage] Reported-by: syzbot+7617e19c8a59edfbd879@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7617e19c8a59edfbd879 Tested-by: syzbot+7617e19c8a59edfbd879@syzkaller.appspotmail.com Signed-off-by: Deepak Sharma Signed-off-by: Jiri Kosina commit 50f1f782f8d621a90108340c632bcb6ab4307d2e Author: Abhishek Tamboli Date: Wed Sep 24 10:07:20 2025 +0530 HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's Add the missing PCI ID for the quickspi device used on the Lenovo Yoga Pro 9i 16IAH10. Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=220567 Signed-off-by: Abhishek Tamboli Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 8fe2cd8ec84b3592b57f40b080f9d5aeebd553af Author: Even Xu Date: Fri Sep 19 15:09:39 2025 +0800 HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection The original implementation used level detection for the first interrupt after device reset to avoid potential interrupt line noise and missed interrupts during the initialization phase. However, this approach introduced unintended side effects when tested with certain touch panels, including: - Delayed hardware interrupt response - Multiple spurious interrupt triggers Switching back to edge detection for the first interrupt resolves these issues while maintaining reliable interrupt handling. Extensive testing across multiple platforms with touch panels from various vendors confirms this change introduces no regressions. [jkosina@suse.com: properly capitalize shortlog] Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation") Tested-by: Rui Zhang Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit 6c26c055523d915afb8d18e7277848eff66a3085 Author: Xinpeng Sun Date: Thu Oct 9 11:31:08 2025 +0800 HID: intel-thc-hid: intel-quicki2c: Fix wrong type casting The type definition of qcdev->i2c_max_frame_size is already u32, so remove the unnecessary type casting le16_to_cpu. Signed-off-by: Xinpeng Sun Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280841.pxmgBzKW-lkp@intel.com/ Signed-off-by: Jiri Kosina commit 48a710760e10a4f36e11233a21860796ba204b1e Merge: 7f38a148755560 3a8660878839fa Author: Thomas Zimmermann Date: Tue Oct 14 10:59:58 2025 +0200 Merge drm/drm-fixes into drm-misc-fixes Updating drm-misc-fixes to the state of v6.18-rc1. Signed-off-by: Thomas Zimmermann commit fa4f4bae893fbce8a3edfff1ab7ece0c01dc1328 Author: Adrian Hunter Date: Mon Oct 13 10:22:44 2025 +0300 perf/core: Fix MMAP2 event device with backing files Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. That causes perf to misreport the device major/minor numbers of the file system of the file, and the generation of the file, and potentially other inode details. There is an existing helper file_user_inode() for that situation. Use file_user_inode() instead of file_inode() to get the inode for MMAP2 events. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record -e cycles:u -- /root/test/merged/cat /proc/self/maps ... 55b2c91d0000-55b2c926b000 r-xp 00018000 00:1a 3419 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.004 MB perf.data (5 samples) ] # # stat /root/test/merged/cat File: /root/test/merged/cat Size: 1127792 Blocks: 2208 IO Block: 4096 regular file Device: 0,26 Inode: 3419 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-09-08 12:23:59.453309624 +0000 Modify: 2025-09-08 12:23:59.454309624 +0000 Change: 2025-09-08 12:23:59.454309624 +0000 Birth: 2025-09-08 12:23:59.453309624 +0000 Before: Device reported 00:02 differs from stat output and /proc/self/maps # perf script --show-mmap-events | grep /root/test/merged/cat cat 377 [-01] 243.078558: PERF_RECORD_MMAP2 377/377: [0x55b2c91d0000(0x9b000) @ 0x18000 00:02 3419 2068525940]: r-xp /root/test/merged/cat After: Device reported 00:1a is the same as stat output and /proc/self/maps # perf script --show-mmap-events | grep /root/test/merged/cat cat 362 [-01] 127.755167: PERF_RECORD_MMAP2 362/362: [0x55ba6e781000(0x9b000) @ 0x18000 00:1a 3419 0]: r-xp /root/test/merged/cat With respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12. Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org # 6.8 commit 8818f507a9391019a3ec7c57b1a32e4b386e48a5 Author: Adrian Hunter Date: Mon Oct 13 10:22:43 2025 +0300 perf/core: Fix MMAP event path names with backing files Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. Since commit def3ae83da02f ("fs: store real path instead of fake path in backing file f_path"), file_path() no longer returns the user file path when applied to a backing file. There is an existing helper file_user_path() for that situation. Use file_user_path() instead of file_path() to get the path for MMAP and MMAP2 events. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps ... 55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.060 MB perf.data ] # Before: File name is wrong (/cat), so decoding fails: # perf script --no-itrace --show-mmap-events cat 367 [016] 100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat ... # perf script --itrace=e | wc -l Warning: 19 instruction trace errors 19 # After: File name is correct (/root/test/merged/cat), so decoding is ok: # perf script --no-itrace --show-mmap-events cat 364 [016] 72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat # perf script --itrace=e # perf script --itrace=e | wc -l 0 # Fixes: def3ae83da02f ("fs: store real path instead of fake path in backing file f_path") Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org commit ebfc8542ad62d066771e46c8aa30f5624b89cad8 Author: Adrian Hunter Date: Mon Oct 13 10:22:42 2025 +0300 perf/core: Fix address filter match with backing files It was reported that Intel PT address filters do not work in Docker containers. That relates to the use of overlayfs. overlayfs records the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. In order for an address filter to match, it must compare to the user file inode. There is an existing helper file_user_inode() for that situation. Use file_user_inode() instead of file_inode() to get the inode for address filter matching. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record --buildid-mmap -e intel_pt//u --filter 'filter * @ /root/test/merged/cat' -- /root/test/merged/cat /proc/self/maps ... 55d61d246000-55d61d2e1000 r-xp 00018000 00:1a 3418 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.015 MB perf.data ] # perf buildid-cache --add /root/test/merged/cat Before: Address filter does not match so there are no control flow packets # perf script --itrace=e # perf script --itrace=b | wc -l 0 # perf script -D | grep 'TIP.PGE' | wc -l 0 # After: Address filter does match so there are control flow packets # perf script --itrace=e # perf script --itrace=b | wc -l 235 # perf script -D | grep 'TIP.PGE' | wc -l 57 # With respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12. Closes: https://lore.kernel.org/linux-perf-users/aBCwoq7w8ohBRQCh@fremen.lan Reported-by: Edd Barrett Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org # 6.8 commit 62685ab071de7c39499212bff19f1b5bc0148bc7 Author: Jiri Olsa Date: Wed Oct 1 15:24:49 2025 +0200 uprobe: Move arch_uprobe_optimize right after handlers execution It's less confusing to optimize uprobe right after handlers execution and before we do the check for changed ip register to avoid situations where changed ip register would skip uprobe optimization. Suggested-by: Linus Torvalds Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Masami Hiramatsu (Google) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e Author: Alok Tiwari Date: Sun Oct 12 07:20:01 2025 -0700 drm/rockchip: vop2: use correct destination rectangle height check The vop2_plane_atomic_check() function incorrectly checks drm_rect_width(dest) twice instead of verifying both width and height. Fix the second condition to use drm_rect_height(dest) so that invalid destination rectangles with height < 4 are correctly rejected. Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") Signed-off-by: Alok Tiwari Reviewed-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 Author: Raju Rangoju Date: Fri Oct 10 12:21:42 2025 +0530 amd-xgbe: Avoid spurious link down messages during interface toggle During interface toggle operations (ifdown/ifup), the driver currently resets the local helper variable 'phy_link' to -1. This causes the link state machine to incorrectly interpret the state as a link change event, resulting in spurious "Link is down" messages being logged when the interface is brought back up. Preserve the phy_link state across interface toggles to avoid treating the -1 sentinel value as a legitimate link state transition. Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") Signed-off-by: Raju Rangoju Reviewed-by: Dawid Osuchowski Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a Author: Mathias Nyman Date: Tue Oct 14 01:55:42 2025 +0300 xhci: dbc: enable back DbC in resume if it was enabled before suspend DbC is currently only enabled back if it's in configured state during suspend. If system is suspended after DbC is enabled, but before the device is properly enumerated by the host, then DbC would not be enabled back in resume. Always enable DbC back in resume if it's suspended in enabled, connected, or configured state Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit f3d12ec847b945d5d65846c85f062d07d5e73164 Author: Mathias Nyman Date: Tue Oct 14 01:55:41 2025 +0300 xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for incoming data are queued, but driver handles the event after it queued the TRBs. This is possible as xHCI DbC hardware may trigger spurious STALL transfer events even if endpoint is empty. The STALL event contains a pointer to the stalled TRB, and "remaining" untransferred data length. As there are no TRBs queued yet the STALL event will just point to first TRB position of the empty ring, with '0' bytes remaining untransferred. DbC driver is polling for events, and may not handle the STALL event before /dev/ttyDBC0 is opened and incoming data TRBs are queued. The DbC event handler will now assume the first queued TRB (length 1024) has stalled with '0' bytes remaining untransferred, and copies the data This race situation can be practically mitigated by making sure the event handler handles all pending transfer events when DbC reaches configured state, and only then create dev/ttyDbC0, and start queueing transfers. The event handler can this way detect the STALL events on empty rings and discard them before any transfers are queued. This does in practice solve the issue, but still leaves a small possible gap for the race to trigger. We still need a way to distinguish spurious STALLs on empty rings with '0' bytes remaing, from actual STALL events with all bytes transmitted. Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 8607edcd1748503f4f58e66ca0216170f260c79b Author: Michal Pecio Date: Tue Oct 14 01:55:40 2025 +0300 usb: xhci-pci: Fix USB2-only root hub registration A recent change to hide USB3 root hubs of USB2-only controllers broke registration of USB2 root hubs - allow_single_roothub is set too late, and by this time xhci_run() has already deferred root hub registration until after the shared HCD is added, which will never happen. This makes such controllers unusable, but testers didn't notice since they were only bothered by warnings about empty USB3 root hubs. The bug causes problems to other people who actually use such HCs and I was able to confirm it on an ordinary HC by patching to ignore USB3 ports. Setting allow_single_roothub during early setup fixes things. Reported-by: Arisa Snowbell Closes: https://lore.kernel.org/linux-usb/CABpa4MA9unucCoKtSdzJyOLjHNVy+Cwgz5AnAxPkKw6vuox1Nw@mail.gmail.com/ Reported-by: Michal Kubecek Closes: https://lore.kernel.org/linux-usb/lnb5bum7dnzkn3fc7gq6hwigslebo7o4ccflcvsc3lvdgnu7el@fvqpobbdoapl/ Fixes: 719de070f764 ("usb: xhci-pci: add support for hosts with zero USB3 ports") Tested-by: Arisa Snowbell Tested-by: Michal Kubecek Suggested-by: Mathias Nyman Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 095232711f23179053ca26bcf046ca121a91a465 Author: Francesco Valla Date: Fri Oct 3 12:33:03 2025 +0200 drm/draw: fix color truncation in drm_draw_fill24 The color parameter passed to drm_draw_fill24() was truncated to 16 bits, leading to an incorrect color drawn to the target iosys_map. Fix this behavior, widening the parameter to 32 bits. Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw") Signed-off-by: Francesco Valla Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it Signed-off-by: Jocelyn Falempe commit ca88ecdce5f51874a7c151809bd2c936ee0d3805 Author: Marc Zyngier Date: Wed Oct 8 22:35:15 2025 +0100 arm64: Revamp HCR_EL2.E2H RES1 detection We currently have two ways to identify CPUs that only implement FEAT_VHE and not FEAT_E2H0: - either they advertise it via ID_AA64MMFR4_EL1.E2H0, - or the HCR_EL2.E2H bit is RAO/WI However, there is a third category of "cpus" that fall between these two cases: on CPUs that do not implement FEAT_FGT, it is IMPDEF whether an access to ID_AA64MMFR4_EL1 can trap to EL2 when the register value is zero. A consequence of this is that on systems such as Neoverse V2, a NV guest cannot reliably detect that it is in a VHE-only configuration (E2H is writable, and ID_AA64MMFR0_EL1 is 0), despite the hypervisor's best effort to repaint the id register. Replace the RAO/WI test by a sequence that makes use of the VHE register remnapping between EL1 and EL2 to detect this situation, and work out whether we get the VHE behaviour even after having set HCR_EL2.E2H to 0. This solves the NV problem, and provides a more reliable acid test for CPUs that do not completely follow the letter of the architecture while providing a RES1 behaviour for HCR_EL2.E2H. Suggested-by: Mark Rutland Acked-by: Mark Rutland Acked-by: Catalin Marinas Reviewed-by: Oliver Upton Tested-by: Jan Kotas Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/15A85F2B-1A0C-4FA7-9FE4-EEC2203CC09E@global.cadence.com commit c065b6046b3493a878c2ceb810aed845431badb4 Author: Theodore Ts'o Date: Mon Oct 13 21:50:40 2025 -0400 Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs Commit d6ace46c82fd ("ext4: remove obsolete EXT3 config options") removed the obsolete EXT3_CONFIG options, since it had been over a decade since fs/ext3 had been removed. Unfortunately, there were a number of defconfigs that still used CONFIG_EXT3_FS which the cleanup commit didn't fix up. This led to a large number of defconfig test builds to fail. Oops. Fixes: d6ace46c82fd ("ext4: remove obsolete EXT3 config options") Signed-off-by: Theodore Ts'o commit 2c67301584f2671e320236df6bbe75ae09feb4d0 Author: Marek Vasut Date: Sat Oct 11 13:02:49 2025 +0200 net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present The driver is currently checking for PHYCR2 register presence in rtl8211f_config_init(), but it does so after accessing PHYCR2 to disable EEE. This was introduced in commit bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE"). Move the PHYCR2 presence test before the EEE disablement and simplify the code. Fixes: bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE") Signed-off-by: Marek Vasut Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251011110309.12664-1-marek.vasut@mailbox.org Signed-off-by: Jakub Kicinski commit d1d5df4691e4322656024fc374d0faec4387aa0f Merge: 21f4d45eba0b2d 5feef67b646d8f Author: Jakub Kicinski Date: Mon Oct 13 17:44:51 2025 -0700 Merge branch 'intel-wired-lan-driver-updates-2025-10-01-idpf-ixgbe-ixgbevf' Jacob Keller says: ==================== Intel Wired LAN Driver Updates 2025-10-01 (idpf, ixgbe, ixgbevf) For idpf: Milena fixes a memory leak in the idpf reset logic when the driver resets with an outstanding Tx timestamp. For ixgbe and ixgbevf: Jedrzej fixes an issue with reporting link speed on E610 VFs. Jedrzej also fixes the VF mailbox API incompatibilities caused by the confusion with API v1.4, v1.5, and v1.6. The v1.4 API introduced IPSEC offload, but this was only supported on Linux hosts. The v1.5 API introduced a new mailbox API which is necessary to resolve issues on ESX hosts. The v1.6 API introduced a new link management API for E610. Jedrzej introduces a new v1.7 API with a feature negotiation which enables properly checking if features such as IPSEC or the ESX mailbox APIs are supported. This resolves issues with compatibility on different hosts, and aligns the API across hosts instead of having Linux require custom mailbox API versions for IPSEC offload. Koichiro fixes a KASAN use-after-free bug in ixgbe_remove(). ==================== Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-0-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 5feef67b646d8f5064bac288e22204ffba2b9a4a Author: Koichiro Den Date: Thu Oct 9 17:03:51 2025 -0700 ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end. KASAN report: BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: show_stack+0x30/0x90 (C) dump_stack_lvl+0x9c/0xd0 print_address_description.constprop.0+0x90/0x310 print_report+0x104/0x1f0 kasan_report+0x88/0x180 __asan_report_load8_noabort+0x20/0x30 ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] ixgbe_remove+0x2d0/0x8c0 [ixgbe] pci_device_remove+0xa0/0x220 device_remove+0xb8/0x170 device_release_driver_internal+0x318/0x490 device_driver_detach+0x40/0x68 unbind_store+0xec/0x118 drv_attr_store+0x64/0xb8 sysfs_kf_write+0xcc/0x138 kernfs_fop_write_iter+0x294/0x440 new_sync_write+0x1fc/0x588 vfs_write+0x480/0x6a0 ksys_write+0xf0/0x1e0 __arm64_sys_write+0x70/0xc0 invoke_syscall.constprop.0+0xcc/0x280 el0_svc_common.constprop.0+0xa8/0x248 do_el0_svc+0x44/0x68 el0_svc+0x54/0x160 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 Fixes: a0285236ab93 ("ixgbe: add initial devlink support") Signed-off-by: Koichiro Den Tested-by: Rinitha S Reviewed-by: Jedrzej Jagielski Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-6-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 823be089f9c8ab136ba382b516aedd3f7ac854bd Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:50 2025 -0700 ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd Send to VF information about features supported by the PF driver. Increase API version to 1.7. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-5-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit a7075f501bd33c93570af759b6f4302ef0175168 Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:49 2025 -0700 ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API. This convention has been broken since introducing API 1.4. Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support for IPSec which is specific only for the kernel ixgbe driver. None of the rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature was introduced along with introduction of the feature itself. Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") increasing API version to 1.5 did the same - it introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in the same time not touching the version defined for the PF ixgbe driver. It led to additional discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes crashes. The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5"). As a result we have regression for IPsec support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX. To fix this mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether to set support for IPSec and ESX-specific enhanced mailbox. New mailbox op, for compatibility purposes, must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6 and doesn't incorporate features negotiate op. Features negotiation mechanism gives possibility to be extended with new features when needed in the future. Reported-by: Jacob Keller Closes: https://lore.kernel.org/intel-wired-lan/20241101-jk-ixgbevf-mailbox-v1-5-fixes-v1-0-f556dc9a66ed@intel.com/ Fixes: 0062e7cc955e ("ixgbevf: add VF IPsec offload code") Fixes: 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") Reviewed-by: Jacob Keller Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Cc: stable@vger.kernel.org Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-4-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit f7f97cbc03a470ce405d48dedb7f135713caa0fa Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:48 2025 -0700 ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation Update supported API version and provide handler for IXGBE_VF_GET_PF_LINK_STATE cmd. Simply put stored values of link speed and link_up from adapter context. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Link: https://lore.kernel.org/stable/20250828095227.1857066-3-jedrzej.jagielski%40intel.com Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-3-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 53f0eb62b4d23d40686f2dd51776b8220f2887bb Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:47 2025 -0700 ixgbevf: fix getting link speed data for E610 devices E610 adapters no longer use the VFLINKS register to read PF's link speed and linkup state. As a result VF driver cannot get actual link state and it incorrectly reports 10G which is the default option. It leads to a situation where even 1G adapters print 10G as actual link speed. The same happens when PF driver set speed different than 10G. Add new mailbox operation to let the VF driver request a PF driver to provide actual link data. Update the mailbox api to v1.6. Incorporate both ways of getting link status within the legacy ixgbe_check_mac_link_vf() function. Fixes: 4c44b450c69b ("ixgbevf: Add support for Intel(R) E610 device") Co-developed-by: Andrzej Wilczynski Signed-off-by: Andrzej Wilczynski Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Cc: stable@vger.kernel.org Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-2-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit a3f8c0a273120fd2638f03403e786c3de2382e72 Author: Milena Olech Date: Thu Oct 9 17:03:46 2025 -0700 idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps. Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs. Fixes: 4901e83a94ef ("idpf: add Tx timestamp capabilities negotiation") Signed-off-by: Milena Olech Signed-off-by: Anton Nadezhdin Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-1-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Thu Oct 9 16:02:19 2025 +0100 net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling. Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer. Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") Cc: Florian Westphal Cc: Francesco Ruggeri Signed-off-by: Dmitry Safonov Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com Signed-off-by: Jakub Kicinski commit e4d0c909bf8328d986bf3aadba0c33a72b5ae30d Author: Kamil Horák - 2N Date: Thu Oct 9 15:06:56 2025 +0200 net: phy: bcm54811: Fix GMII/MII/MII-Lite selection The Broadcom bcm54811 is hardware-strapped to select among RGMII and GMII/MII/MII-Lite modes. However, the corresponding bit, RGMII Enable in Miscellaneous Control Register must be also set to select desired RGMII or MII(-lite)/GMII mode. Fixes: 3117a11fff5af9e7 ("net: phy: bcm54811: PHY initialization") Signed-off-by: Kamil Horák - 2N Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251009130656.1308237-2-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 Author: Linmao Li Date: Thu Oct 9 20:25:49 2025 +0800 r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming packets. Packet captures show messages like "IP truncated-ip - 146 bytes missing!". The issue is caused by RxConfig not being properly re-initialized after resume. Re-initializing the RxConfig register before the chip re-initialization sequence avoids the truncation and restores correct packet reception. This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data corruption issue on RTL8402"). Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") Signed-off-by: Linmao Li Reviewed-by: Jacob Keller Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn Signed-off-by: Jakub Kicinski commit 25718fdcbdd2dadd15fc8b684df59b43970b91ed Author: Sebastian Andrzej Siewior Date: Thu Oct 9 11:43:38 2025 +0200 net: gro_cells: Use nested-BH locking for gro_cell The gro_cell data structure is per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Add a local_lock_t to the data structure and use local_lock_nested_bh() for locking. This change adds only lockdep coverage and does not alter the functional behaviour for !PREEMPT_RT. Reported-by: syzbot+8715dd783e9b0bef43b1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c6c3b1.050a0220.2ff435.0382.GAE@google.com/ Fixes: 3253cb49cbad ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251009094338.j1jyKfjR@linutronix.de Signed-off-by: Jakub Kicinski commit fcb8b32a68fd40b0440cb9468cf6f6ab9de9f3c5 Author: Ivan Vecera Date: Wed Oct 8 16:14:45 2025 +0200 dpll: zl3073x: Handle missing or corrupted flash configuration If the internal flash contains missing or corrupted configuration, basic communication over the bus still functions, but the device is not capable of normal operation (for example, using mailboxes). This condition is indicated in the info register by the ready bit. If this bit is cleared, the probe procedure times out while fetching the device state. Handle this case by checking the ready bit value in zl3073x_dev_start() and skipping DPLL device and pin registration if it is cleared. Do not report this condition as an error, allowing the devlink device to be registered and enabling the user to flash the correct configuration. Prior this patch: [ 31.112299] zl3073x-i2c 1-0070: Failed to fetch input state: -ETIMEDOUT [ 31.116332] zl3073x-i2c 1-0070: error -ETIMEDOUT: Failed to start device [ 31.136881] zl3073x-i2c 1-0070: probe with driver zl3073x-i2c failed with error -110 After this patch: [ 41.011438] zl3073x-i2c 1-0070: FW not fully ready - missing or corrupted config Fixes: 75a71ecc24125 ("dpll: zl3073x: Register DPLL devices and pins") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251008141445.841113-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9d5c4f5c7a2c7677e1b3942772122b032c265aae Author: Jaegeuk Kim Date: Tue Oct 7 03:32:30 2025 +0000 f2fs: fix wrong block mapping for multi-devices Assuming the disk layout as below, disk0: 0 --- 0x00035abfff disk1: 0x00035ac000 --- 0x00037abfff disk2: 0x00037ac000 --- 0x00037ebfff and we want to read data from offset=13568 having len=128 across the block devices, we can illustrate the block addresses like below. 0 .. 0x00037ac000 ------------------- 0x00037ebfff, 0x00037ec000 ------- | ^ ^ ^ | fofs 0 13568 13568+128 | ------------------------------------------------------ | LBA 0x37e8aa9 0x37ebfa9 0x37ec029 --- map 0x3caa9 0x3ffa9 In this example, we should give the relative map of the target block device ranging from 0x3caa9 to 0x3ffa9 where the length should be calculated by 0x37ebfff + 1 - 0x37ebfa9. In the below equation, however, map->m_pblk was supposed to be the original address instead of the one from the target block address. - map->m_len = min(map->m_len, dev->end_blk + 1 - map->m_pblk); Cc: stable@vger.kernel.org Fixes: 71f2c8206202 ("f2fs: multidevice: support direct IO") Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1ee889fdf409ce68c1e3b62912333a5cc69acaa0 Author: Mateusz Guzik Date: Wed Oct 1 01:29:57 2025 +0200 f2fs: don't call iput() from f2fs_drop_inode() iput() calls the problematic routine, which does a ->i_count inc/dec cycle. Undoing it with iput() recurses into the problem. Note f2fs should not be playing games with the refcount to begin with, but that will be handled later. Right now solve the immediate regression. Fixes: bc986b1d756482a ("fs: stop accessing ->i_count directly in f2fs and gfs2") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509301450.138b448f-lkp@intel.com Signed-off-by: Mateusz Guzik Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d6fc45100aa8c02be3ddd16fae569b84086c15a9 Author: Hans Zhang <18255117159@163.com> Date: Fri Oct 10 22:43:07 2025 +0800 PCI: cadence: Search for MSI Capability with correct ID 907912c1daa7 ("PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets") incorrectly searched for the MSI-X Capability ID instead of the MSI Capability ID in cdns_pcie_ep_get_msi(). Search for PCI_CAP_ID_MSI, not PCI_CAP_ID_MSIX, to fix this problem. Fixes: 907912c1daa7 ("PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets") Reported-by: Sasha Levin Closes: https://lore.kernel.org/r/aOfMk9BW8BH2P30V@laps/ Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251010144307.12979-1-18255117159@163.com commit 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 Author: Ingo Molnar Date: Fri May 16 15:43:04 2025 +0200 x86/mm: Fix SMP ordering in switch_mm_irqs_off() Stephen noted that it is possible to not have an smp_mb() between the loaded_mm store and the tlb_gen load in switch_mm(), meaning the ordering against flush_tlb_mm_range() goes out the window, and it becomes possible for switch_mm() to not observe a recent tlb_gen update and fail to flush the TLBs. [ dhansen: merge conflict fixed by Ingo ] Fixes: 209954cbc7d0 ("x86/mm/tlb: Update mm_cpumask lazily") Reported-by: Stephen Dolan Closes: https://lore.kernel.org/all/CAHDw0oGd0B4=uuv8NGqbUQ_ZVmSheU2bN70e4QhFXWvuAZdt2w@mail.gmail.com/ Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Signed-off-by: Dave Hansen commit f25785f9b088ed65089dd0d0034da52858417839 Author: Rik van Riel Date: Sun Oct 5 23:48:05 2025 -0400 x86/mm: Fix overflow in __cpa_addr() The change to have cpa_flush() call flush_kernel_pages() introduced a bug where __cpa_addr() can access an address one larger than the largest one in the cpa->pages array. KASAN reports the issue like this: BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline] BUG: KASAN: slab-out-of-bounds in __cpa_addr+0x1d3/0x220 arch/x86/mm/pat/set_memory.c:306 Read of size 8 at addr ffff88801f75e8f8 by task syz.0.17/5978 This bug could cause cpa_flush() to not properly flush memory, which somehow never showed any symptoms in my tests, possibly because cpa_flush() is called so rarely, but could potentially cause issues for other people. Fix the issue by directly calculating the flush end address from the start address. Fixes: 86e6815b316e ("x86/mm: Change cpa_flush() to call flush_kernel_range() directly") Reported-by: syzbot+afec6555eef563c66c97@syzkaller.appspotmail.com Signed-off-by: Rik van Riel Signed-off-by: Dave Hansen Reviewed-by: Kiryl Shutsemau Link: https://lore.kernel.org/all/68e2ff90.050a0220.2c17c1.0038.GAE@google.com/ commit a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e Author: Dave Jiang Date: Thu Oct 9 08:40:01 2025 -0700 cxl/features: Add check for no entries in cxl_feature_info cxl EDAC calls cxl_feature_info() to get the feature information and if the hardware has no Features support, cxlfs may be passed in as NULL. [ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 51.965571] #PF: supervisor read access in kernel mode [ 51.971559] #PF: error_code(0x0000) - not-present page [ 51.977542] PGD 17e4f6067 P4D 0 [ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI [ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj test+ #64 PREEMPT(voluntary) [ 51.997355] Hardware name: [ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core] Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if there is no cxlfs created due to no hardware support. Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") Reviewed-by: Davidlohr Bueso Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 8aec9dbf2db2e958de5bd20e23b8fbb8f2aa1fa6 Author: Gustavo A. R. Silva Date: Fri Oct 3 15:11:06 2025 +0100 btrfs: send: fix -Wflex-array-member-not-at-end warning in struct send_ctx The warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Fix the following warning: fs/btrfs/send.c:181:24: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] and move the declaration of send_ctx::cur_inode_path to the end. Notice that struct fs_path contains a flexible array member inline_buf, but also a padding array and a limit calculated for the usable space of inline_buf (FS_PATH_INLINE_SIZE). It is not the pattern where flexible array is in the middle of a structure and could potentially overwrite other members. Signed-off-by: Gustavo A. R. Silva Reviewed-by: David Sterba Signed-off-by: David Sterba commit e92c2941204de7b62e9c2deecfeb9eaefe54a22a Author: Dan Carpenter Date: Wed Oct 8 18:08:58 2025 +0300 btrfs: tree-checker: fix bounds check in check_inode_extref() The parentheses for the unlikely() annotation were put in the wrong place so it means that the condition is basically never true and the bounds checking is skipped. Fixes: aab9458b9f00 ("btrfs: tree-checker: add inode extref checks") Signed-off-by: Dan Carpenter Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit fec9b9d3ced39f16be8d7afdf81f4dd2653da319 Author: Miquel Sabaté Solà Date: Wed Oct 8 14:18:59 2025 +0200 btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one and there is no RAID stripe tree, then we return early with an error. Doing that, though, prevents the code from running the last calls from this function which are about freeing memory allocated during its run. Hence, in this case, instead of returning early, we set the ret value and fall through the rest of the cleanup code. Fixes: 5906333cc4af ("btrfs: zoned: don't skip block group profile checks on conventional zones") CC: stable@vger.kernel.org # 6.8+ Reviewed-by: Johannes Thumshirn Signed-off-by: Miquel Sabaté Solà Signed-off-by: David Sterba commit 8ab2fa69691b2913a67f3c54fbb991247b3755be Author: Boris Burkov Date: Tue Sep 30 21:05:17 2025 -0700 btrfs: fix incorrect readahead expansion length The intent of btrfs_readahead_expand() was to expand to the length of the current compressed extent being read. However, "ram_bytes" is *not* that, in the case where a single physical compressed extent is used for multiple file extents. Consider this case with a large compressed extent C and then later two non-compressed extents N1 and N2 written over C, leaving C1 and C2 pointing to offset/len pairs of C: [ C ] [ N1 ][ C1 ][ N2 ][ C2 ] In such a case, ram_bytes for both C1 and C2 is the full uncompressed length of C. So starting readahead in C1 will expand the readahead past the end of C1, past N2, and into C2. This will then expand readahead again, to C2_start + ram_bytes, way past EOF. First of all, this is totally undesirable, we don't want to read the whole file in arbitrary chunks of the large underlying extent if it happens to exist. Secondly, it results in zeroing the range past the end of C2 up to ram_bytes. This is particularly unpleasant with fs-verity as it can zero and set uptodate pages in the verity virtual space past EOF. This incorrect readahead behavior can lead to verity verification errors, if we iterate in a way that happens to do the wrong readahead. Fix this by using em->len for readahead expansion, not em->ram_bytes, resulting in the expected behavior of stopping readahead at the extent boundary. Reported-by: Max Chernoff Link: https://bugzilla.redhat.com/show_bug.cgi?id=2399898 Fixes: 9e9ff875e417 ("btrfs: use readahead_expand() on compressed extents") CC: stable@vger.kernel.org # 6.17 Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit a5a51bf4e9b7354ce7cd697e610d72c1b33fd949 Author: Filipe Manana Date: Wed Oct 1 11:08:13 2025 +0100 btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always expect to find block group items (either extent items or a block group item with key type BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with btrfs_search_slot_for_read(), so we assert that we found an item. However this expectation is wrong since we can have a new block group created in the current transaction which is still empty and for which we still have not added the block group's item to the extent tree, in which case we do not have any items in the extent tree associated to the block group. The insertion of a new block group's block group item in the extent tree happens at btrfs_create_pending_block_groups() when it calls the helper insert_block_group_item(). This typically is done when a transaction handle is released, committed or when running delayed refs (either as part of a transaction commit or when serving tickets for space reservation if we are low on free space). So remove the assertion at populate_free_space_tree() even when the block group tree feature is not enabled and update the comment to mention this case. Syzbot reported this with the following stack trace: BTRFS info (device loop3 state M): rebuilding free space tree assertion failed: ret == 0 :: 0, in fs/btrfs/free-space-tree.c:1115 ------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1115! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6352 Comm: syz.3.25 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:populate_free_space_tree+0x700/0x710 fs/btrfs/free-space-tree.c:1115 Code: ff ff e8 d3 (...) RSP: 0018:ffffc9000430f780 EFLAGS: 00010246 RAX: 0000000000000043 RBX: ffff88805b709630 RCX: fea61d0e2e79d000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc9000430f8b0 R08: ffffc9000430f4a7 R09: 1ffff92000861e94 R10: dffffc0000000000 R11: fffff52000861e95 R12: 0000000000000001 R13: 1ffff92000861f00 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f424d9fe6c0(0000) GS:ffff888125afc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd78ad212c0 CR3: 0000000076d68000 CR4: 00000000003526f0 Call Trace: btrfs_rebuild_free_space_tree+0x1ba/0x6d0 fs/btrfs/free-space-tree.c:1364 btrfs_start_pre_rw_mount+0x128f/0x1bf0 fs/btrfs/disk-io.c:3062 btrfs_remount_rw fs/btrfs/super.c:1334 [inline] btrfs_reconfigure+0xaed/0x2160 fs/btrfs/super.c:1559 reconfigure_super+0x227/0x890 fs/super.c:1076 do_remount fs/namespace.c:3279 [inline] path_mount+0xd1a/0xfe0 fs/namespace.c:4027 do_mount fs/namespace.c:4048 [inline] __do_sys_mount fs/namespace.c:4236 [inline] __se_sys_mount+0x313/0x410 fs/namespace.c:4213 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f424e39066a Code: d8 64 89 02 (...) RSP: 002b:00007f424d9fde68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f424d9fdef0 RCX: 00007f424e39066a RDX: 0000200000000180 RSI: 0000200000000380 RDI: 0000000000000000 RBP: 0000200000000180 R08: 00007f424d9fdef0 R09: 0000000000000020 R10: 0000000000000020 R11: 0000000000000246 R12: 0000200000000380 R13: 00007f424d9fdeb0 R14: 0000000000000000 R15: 00002000000002c0 Modules linked in: ---[ end trace 0000000000000000 ]--- Reported-by: syzbot+884dc4621377ba579a6f@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/68dc3dab.a00a0220.102ee.004e.GAE@google.com/ Fixes: a5ed91828518 ("Btrfs: implement the free space B-tree") CC: # 6.1.x: 1961d20f6fa8: btrfs: fix assertion when building free space tree CC: # 6.1.x Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 42d3a055d946878a327ee030f0e0c7df0f0f15c8 Author: Qu Wenruo Date: Tue Sep 30 07:54:30 2025 +0930 btrfs: do not use folio_test_partial_kmap() in ASSERT()s [BUG] Syzbot reported an ASSERT() triggered inside scrub: BTRFS info (device loop0): scrub: started on devid 1 assertion failed: !folio_test_partial_kmap(folio) :: 0, in fs/btrfs/scrub.c:697 ------------[ cut here ]------------ kernel BUG at fs/btrfs/scrub.c:697! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6077 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:scrub_stripe_get_kaddr+0x1bb/0x1c0 fs/btrfs/scrub.c:697 Call Trace: scrub_bio_add_sector fs/btrfs/scrub.c:932 [inline] scrub_submit_initial_read+0xf21/0x1120 fs/btrfs/scrub.c:1897 submit_initial_group_read+0x423/0x5b0 fs/btrfs/scrub.c:1952 flush_scrub_stripes+0x18f/0x1150 fs/btrfs/scrub.c:1973 scrub_stripe+0xbea/0x2a30 fs/btrfs/scrub.c:2516 scrub_chunk+0x2a3/0x430 fs/btrfs/scrub.c:2575 scrub_enumerate_chunks+0xa70/0x1350 fs/btrfs/scrub.c:2839 btrfs_scrub_dev+0x6e7/0x10e0 fs/btrfs/scrub.c:3153 btrfs_ioctl_scrub+0x249/0x4b0 fs/btrfs/ioctl.c:3163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- Which doesn't make much sense, as all the folios we allocated for scrub should not be highmem. [CAUSE] Thankfully syzbot has a detailed kernel config file, showing that CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is set to y. And that debug option will force all folio_test_partial_kmap() to return true, to improve coverage on highmem tests. But in our case we really just want to make sure the folios we allocated are not highmem (and they are indeed not). Such incorrect result from folio_test_partial_kmap() is just screwing up everything. [FIX] Replace folio_test_partial_kmap() to folio_test_highmem() so that we won't bother those highmem specific debuging options. Fixes: 5fbaae4b8567 ("btrfs: prepare scrub to support bs > ps cases") Reported-by: syzbot+bde59221318c592e6346@syzkaller.appspotmail.com Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7fdfd29a136a17c5c8ad9e9bbf89c48919c3d19 Author: Qu Wenruo Date: Fri Sep 26 14:20:11 2025 +0930 btrfs: only set the device specific options after devices are opened [BUG] With v6.17-rc kernels, btrfs will always set 'ssd' mount option even if the block device is not a rotating one: # cat /sys/block/sdd/queue/rotational 1 # cat /etc/fstab: LABEL=DATA2 /data2 btrfs rw,relatime,space_cache=v2,subvolid=5,subvol=/,nofail,nosuid,nodev 0 0 # mount [...] /dev/sdd on /data2 type btrfs (rw,nosuid,nodev,relatime,ssd,space_cache=v2,subvolid=5,subvol=/) [CAUSE] The 'ssd' mount option is set by set_device_specific_options(), and it expects that if there is any rotating device in the btrfs, it will set fs_devices::rotating. However after commit bddf57a70781 ("btrfs: delay btrfs_open_devices() until super block is created"), the device opening is delayed until the super block is created. But the timing of set_device_specific_options() is still left as is, this makes the function be called without any device opened. Since no device is opened, thus fs_devices::rotating will never be set, making btrfs incorrectly set 'ssd' mount option. [FIX] Only call set_device_specific_options() after btrfs_open_devices(). Also only call set_device_specific_options() after a new mount, if we're mounting a mounted btrfs, there is no need to set the device specific mount options again. Reported-by: HAN Yuwei Link: https://lore.kernel.org/linux-btrfs/C8FF75669DFFC3C5+5f93bf8a-80a0-48a6-81bf-4ec890abc99a@bupt.moe/ Fixes: bddf57a70781 ("btrfs: delay btrfs_open_devices() until super block is created") CC: stable@vger.kernel.org # 6.17 Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 53a4acbfc1de85fa637521ffab4f4e2ee03cbeeb Author: Miquel Sabaté Solà Date: Thu Sep 25 20:41:39 2025 +0200 btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as provided by the user, which is kfree'd in the end. But this was not the case when allocating memory for 'prealloc'. In this case, if it somehow failed, then the previous code would go directly into calling 'mnt_drop_write_file', without freeing the string duplicated from the user space. Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Boris Burkov Reviewed-by: Filipe Manana Signed-off-by: Miquel Sabaté Solà Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7e5a5983edda664e8e4bb20af17b80f5135c655c Author: Filipe Manana Date: Wed Sep 24 16:10:38 2025 +0100 btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running When starting relocation, at reloc_chunk_start(), if we happen to find the flag BTRFS_FS_RELOC_RUNNING is already set we return an error (-EINPROGRESS) to the callers, however the callers call reloc_chunk_end() which will clear the flag BTRFS_FS_RELOC_RUNNING, which is wrong since relocation was started by another task and still running. Finding the BTRFS_FS_RELOC_RUNNING flag already set is an unexpected scenario, but still our current behaviour is not correct. Fix this by never calling reloc_chunk_end() if reloc_chunk_start() has returned an error, which is what logically makes sense, since the general widespread pattern is to have end functions called only if the counterpart start functions succeeded. This requires changing reloc_chunk_start() to clear BTRFS_FS_RELOC_RUNNING if there's a pending cancel request. Fixes: 907d2710d727 ("btrfs: add cancellable chunk relocation support") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9f64b3cd051b825de0a2a9f145c8e003200cedd5 Author: Shuicheng Lin Date: Fri Oct 10 17:25:29 2025 +0000 drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled. In this case, the driver cannot receive a response from the GuC, preventing proper cleanup of exec queue resources. Fix this by directly releasing the resources when GuC is not running. Here is the failure dmesg log: " [ 468.089581] ---[ end trace 0000000000000000 ]--- [ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535) [ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535 [ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1 [ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1) [ 468.092716] ------------[ cut here ]------------ [ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe] " v2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled(). As CT may go down and come back during VF migration. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20251010172529.2967639-2-shuicheng.lin@intel.com (cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea) Signed-off-by: Lucas De Marchi commit 1852d27aa998272696680607b65a2ceac966104e Author: Vinay Belgaumkar Date: Thu Oct 9 18:10:47 2025 -0700 drm/xe: Enable media sampler power gating Where applicable, enable media sampler power gating. Also, add it to the powergate_info debugfs. v2: Remove the sampler powergate status since it is cleared quickly anyway. v3: Use vcs mask (Rodrigo) and fix the version check for media v4: Remove extra spaces v5: Media samplers are independent of vcs mask, use Media version 1255 (Matt Roper) Fixes: 38e8c4184ea0 ("drm/xe: Enable Coarse Power Gating") Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20251010011047.2047584-1-vinay.belgaumkar@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 4cbc08649a54c3d533df9832342d52d409dfbbf0) Signed-off-by: Lucas De Marchi commit 7413e9f2be6b2b0caff9c517efa123d988914bba Author: Matthew Brost Date: Thu Oct 9 06:06:29 2025 -0700 drm/xe: Handle mixed mappings and existing VRAM on atomic faults Moving to VRAM will fail if mixed mappings are present or if the page is already located in VRAM. Atomic faults that require a move to VRAM currently retry without attempting to evict mixed mappings or locate existing VRAM mappings. This patch fixes the issue by attempting to evict mixed mappings or find existing VRAM pages when a move to VRAM fails during atomic fault handling. Fixes: a9ac0fa455b0 ("drm/xe: Strict migration policy for atomic SVM faults") Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251009130629.3531962-1-matthew.brost@intel.com (cherry picked from commit 75188605c56d10c1bd3b1cd94f4872f349c3a9c8) Signed-off-by: Lucas De Marchi commit 1117e7d1e8e66bf7e40291178b829a8513f83a7a Author: Thomas Hellström Date: Wed Sep 10 18:09:39 2025 +0200 drm/xe/migrate: Fix an error path The exhaustive eviction accidently changed an error path goto to a return. Fix this. Fixes: 59eabff2a352 ("drm/xe: Convert xe_bo_create_pin_map() for exhaustive eviction") Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250910160939.103473-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 381f1ed15159c4b3f00dd37cc70924dedebeb111) Signed-off-by: Lucas De Marchi commit d30203739be798d3de5c84db3060e96f00c54e82 Author: Lucas De Marchi Date: Thu Sep 18 13:58:57 2025 -0700 drm/xe: Move rebar to be done earlier There may be cases in which the BAR0 also needs to move to accommodate the bigger BAR2. However if it's not released, the BAR2 resize fails. During the vram probe it can't be released as it's already in use by xe_mmio for early register access. Add a new function in xe_vram and let xe_pci call it directly before even early device probe. This allows the BAR2 to resize in cases BAR0 also needs to move, assuming there aren't other reasons to hold that move: [] xe 0000:03:00.0: vgaarb: deactivate vga console [] xe 0000:03:00.0: [drm] Attempting to resize bar from 8192MiB -> 16384MiB [] xe 0000:03:00.0: BAR 0 [mem 0x83000000-0x83ffffff 64bit]: releasing [] xe 0000:03:00.0: BAR 2 [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] xe 0000:03:00.0: BAR 2 [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] xe 0000:03:00.0: BAR 0 [mem 0x83000000-0x83ffffff 64bit]: assigned [] pcieport 0000:00:01.0: PCI bridge to [bus 01-04] [] pcieport 0000:00:01.0: bridge window [mem 0x83000000-0x840fffff] [] pcieport 0000:00:01.0: bridge window [mem 0x4000000000-0x44007fffff 64bit pref] [] pcieport 0000:01:00.0: PCI bridge to [bus 02-04] [] pcieport 0000:01:00.0: bridge window [mem 0x83000000-0x840fffff] [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref] [] pcieport 0000:02:01.0: PCI bridge to [bus 03] [] pcieport 0000:02:01.0: bridge window [mem 0x83000000-0x83ffffff] [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref] [] xe 0000:03:00.0: [drm] BAR2 resized to 16384M [] xe 0000:03:00.0: [drm:xe_pci_probe [xe]] BATTLEMAGE e221:0000 dgfx:1 gfx:Xe2_HPG (20.02) ... For BMG there are additional fix needed in the PCI side, but this helps getting it to a working resize. All the rebar logic is more pci-specific than xe-specific and can be done very early in the probe sequence. In future it would be good to move it out of xe_vram.c, but this refactor is left for later. Cc: Ilpo Järvinen Cc: stable@vger.kernel.org # 6.12+ Link: https://lore.kernel.org/intel-xe/fafda2a3-fc63-ce97-d22b-803f771a4d19@linux.intel.com Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250918-xe-pci-rebar-2-v1-2-6c094702a074@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 45e33f220fd625492c11e15733d8e9b4f9db82a4) Signed-off-by: Lucas De Marchi commit 7ac74613e5f2ef3450f44fd2127198662c2563a9 Author: Matthew Brost Date: Thu Oct 9 04:06:18 2025 -0700 drm/xe: Don't allow evicting of BOs in same VM in array of VM binds An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allow_res_evict flag in the xe_bo_validate call. v2: - Invert polarity of no_res_evict (Thomas) - Add comment in code explaining issue (Thomas) Cc: stable@vger.kernel.org Reported-by: Paulo Zanoni Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6268 Fixes: 774b5fa509a9 ("drm/xe: Avoid evicting object of the same vm in none fault mode") Fixes: 77f2ef3f16f5 ("drm/xe: Lock all gpuva ops during VM bind IOCTL") Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Tested-by: Paulo Zanoni Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20251009110618.3481870-1-matthew.brost@intel.com (cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08) Signed-off-by: Lucas De Marchi commit e5ae8d1eb08a3e27fff4ae264af4c8056d908639 Author: Kenneth Graunke Date: Fri Sep 12 15:31:45 2025 -0700 drm/xe: Increase global invalidation timeout to 1000us The previous timeout of 500us seems to be too small; panning the map in the Roll20 VTT in Firefox on a KDE/Wayland desktop reliably triggered timeouts within a few seconds of usage, causing the monitor to freeze and the following to be printed to dmesg: [Jul30 13:44] xe 0000:03:00.0: [drm] *ERROR* GT0: Global invalidation timeout [Jul30 13:48] xe 0000:03:00.0: [drm] *ERROR* [CRTC:82:pipe A] flip_done timed out I haven't hit a single timeout since increasing it to 1000us even after several multi-hour testing sessions. Fixes: 0dd2dd0182bc ("drm/xe: Move DSB l2 flush to a more sensible place") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5710 Signed-off-by: Kenneth Graunke Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Reviewed-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250912223254.147940-1-kenneth@whitecape.org Signed-off-by: Lucas De Marchi (cherry picked from commit 146046907b56578263434107f5a7d5051847c459) Signed-off-by: Lucas De Marchi commit 48277906603528a1fd1946bf0f141b2fd4f84e46 Merge: 3a8660878839fa 7c3321f3d279ed Author: Martin K. Petersen Date: Mon Oct 13 15:54:13 2025 -0400 Merge branch '6.18/scsi-queue' into 6.18/scsi-fixes Pull in outstanding SCSI fixes for 6.18. Signed-off-by: Martin K. Petersen commit 93a27b5891b8194a8c083c9a80d2141d4bf47ba8 Author: Tetsuo Handa Date: Sat Sep 27 21:11:16 2025 +0900 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Currently NETDEV_UNREGISTER event handler is not calling j1939_cancel_active_session() and j1939_sk_queue_drop_all(). This will result in these calls being skipped when j1939_sk_release() is called. And I guess that the reason syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 is caused by lack of these calls. Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can be covered by calling j1939_cancel_active_session(priv, NULL) from j1939_netdev_notify(). Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify(). Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler. Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler") Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://patch.msgid.link/3ad3c7f8-5a74-4b07-a193-cb0725823558@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit a3c35f8270c175f164dd74960c437d1edc8a291a Merge: 49836ff2f37dd6 b5746b3e8ea4a8 Author: Marc Kleine-Budde Date: Mon Oct 13 21:26:08 2025 +0200 Merge patch series "can: add Transmitter Delay Compensation (TDC) documentation" Vincent Mailhol says: TDC was added to the kernel in 2021 but I never took time to update the documentation. The year is now 2025... As we say: "better late than never"! The first patch is a small clean up which fixes an incorrect statement concerning the CAN DLC, the second patch is the real thing and adds the documentation of how to use the ip tool to configure the TDC. Link: https://patch.msgid.link/20251013-can-fd-doc-v2-0-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit b5746b3e8ea4a8a4df776e0864322028d4f5e4b1 Author: Vincent Mailhol Date: Mon Oct 13 19:10:23 2025 +0900 can: add Transmitter Delay Compensation (TDC) documentation Back in 2021, support for CAN TDC was added to the kernel in series [1] and in iproute2 in series [2]. However, the documentation was never updated. Add a new sub-section under CAN-FD driver support to document how to configure the TDC using the "ip tool". [1] add the netlink interface for CAN-FD Transmitter Delay Compensation (TDC) Link: https://lore.kernel.org/all/20210918095637.20108-1-mailhol.vincent@wanadoo.fr/ [2] iplink_can: cleaning, fixes and adding TDC support Link: https://lore.kernel.org/all/20211103164428.692722-1-mailhol.vincent@wanadoo.fr/ Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20251013-can-fd-doc-v2-2-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit c282993ccd97ad627d213645dc485086de034647 Author: Vincent Mailhol Date: Mon Oct 13 19:10:22 2025 +0900 can: remove false statement about 1:1 mapping between DLC and length The CAN-FD section of can.rst still states that there is a 1:1 mapping between the Classical CAN DLC and its length. This is only true for the DLC values up to 8. Beyond that point, the length remains at 8. For reference, the mapping between the CAN DLC and the length is given in below table [1]: DLC value CBFF and CEFF FBFF and FEFF [decimal] [byte] [byte] ---------------------------------------------- 0 0 0 1 1 1 2 2 2 3 3 3 4 4 4 5 5 5 6 6 6 7 7 7 8 8 8 9 8 12 10 8 16 11 8 20 12 8 24 13 8 32 14 8 48 15 8 64 Remove the erroneous statement. Instead just state that the length of a Classical CAN frame ranges from 0 to 8. [1] ISO 11898-1:2024, Table 5 -- DLC: coding of the four LSB Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20251013-can-fd-doc-v2-1-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 Author: Babu Moger Date: Fri Oct 10 12:08:35 2025 -0500 x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID Users can create as many monitoring groups as the number of RMIDs supported by the hardware. However, on AMD systems, only a limited number of RMIDs are guaranteed to be actively tracked by the hardware. RMIDs that exceed this limit are placed in an "Unavailable" state. When a bandwidth counter is read for such an RMID, the hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable remains set on first read after tracking re-starts and is clear on all subsequent reads as long as the RMID is tracked. resctrl miscounts the bandwidth events after an RMID transitions from the "Unavailable" state back to being tracked. This happens because when the hardware starts counting again after resetting the counter to zero, resctrl in turn compares the new count against the counter value stored from the previous time the RMID was tracked. This results in resctrl computing an event value that is either undercounting (when new counter is more than stored counter) or a mistaken overflow (when new counter is less than stored counter). Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to zero whenever the RMID is in the "Unavailable" state to ensure accurate counting after the RMID resets to zero when it starts to be tracked again. Example scenario that results in mistaken overflow ================================================== 1. The resctrl filesystem is mounted, and a task is assigned to a monitoring group. $mount -t resctrl resctrl /sys/fs/resctrl $mkdir /sys/fs/resctrl/mon_groups/test1/ $echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 21323 <- Total bytes on domain 0 "Unavailable" <- Total bytes on domain 1 Task is running on domain 0. Counter on domain 1 is "Unavailable". 2. The task runs on domain 0 for a while and then moves to domain 1. The counter starts incrementing on domain 1. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 7345357 <- Total bytes on domain 0 4545 <- Total bytes on domain 1 3. At some point, the RMID in domain 0 transitions to the "Unavailable" state because the task is no longer executing in that domain. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes "Unavailable" <- Total bytes on domain 0 434341 <- Total bytes on domain 1 4. Since the task continues to migrate between domains, it may eventually return to domain 0. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 17592178699059 <- Overflow on domain 0 3232332 <- Total bytes on domain 1 In this case, the RMID on domain 0 transitions from "Unavailable" state to active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when the counter is read and begins tracking the RMID counting from 0. Subsequent reads succeed but return a value smaller than the previously saved MSR value (7345357). Consequently, the resctrl's overflow logic is triggered, it compares the previous value (7345357) with the new, smaller value and incorrectly interprets this as a counter overflow, adding a large delta. In reality, this is a false positive: the counter did not overflow but was simply reset when the RMID transitioned from "Unavailable" back to active state. Here is the text from APM [1] available from [2]. "In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the first QM_CTR read when it begins tracking an RMID that it was not previously tracking. The U bit will be zero for all subsequent reads from that RMID while it is still tracked by the hardware. Therefore, a QM_CTR read with the U bit set when that RMID is in use by a processor can be considered 0 when calculating the difference with a subsequent read." [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory Bandwidth (MBM). [ bp: Split commit message into smaller paragraph chunks for better consumption. ] Fixes: 4d05bf71f157d ("x86/resctrl: Introduce AMD QOS feature") Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Tested-by: Reinette Chatre Cc: stable@vger.kernel.org # needs adjustments for <= v6.17 Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit 2b929b6eec0c7c45eb554256d349c16c0ba1df3c Author: Pauli Virtanen Date: Mon Oct 13 20:33:06 2025 +0300 ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 ID 046d:0a8f Logitech, Inc. H390 headset with microphone is reported to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4929 Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 02e7567f5da023524476053a38c54f4f19130959 Author: Li Ming Date: Wed Oct 1 14:03:37 2025 +0800 cxl/port: Avoid missing port component registers setup port->nr_dports is used to represent how many dports added to the cxl port, it will increase in add_dport() when a new dport is being added to the cxl port, but it will not be reduced when a dport is removed from the cxl port. Currently, when the first dport is added to a cxl port, it will trigger component registers setup on the cxl port, the implementation is using port->nr_dports to confirm if the dport is the first dport. A corner case here is that adding dport could fail after port->nr_dports updating and before checking port->nr_dports for component registers setup. If the failure happens during the first dport attaching, it will cause that CXL subsystem has not chance to execute component registers setup for the cxl port. the failure flow like below: port->nr_dports = 0 dport 1 adding to the port: add_dport() # port->nr_dports: 1 failed on devm_add_action_or_reset() or sysfs_create_link() return error # port->nr_dports: 1 dport 2 adding to the port: add_dport() # port->nr_dports: 2 no failure skip component registers setup because of port->nr_dports is 2 The solution here is that moving component registers setup closer to add_dport(), so if add_dport() is executed correctly for the first dport, component registers setup on the port will be executed immediately after that. Fixes: f6ee24913de2 ("cxl: Move port register setup to when first dport appear") Signed-off-by: Li Ming Reviewed-by: Dave Jiang Reviewed-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang commit 14c1da3895a116f4e32c20487046655f26d3999b Author: Tejun Heo Date: Wed Oct 8 13:43:26 2025 -1000 sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() On systems with >4096 CPUs, scx_kick_cpus_pnt_seqs allocation fails during boot because it exceeds the 32,768 byte percpu allocator limit. Restructure to use DEFINE_PER_CPU() for the per-CPU pointers, with each CPU pointing to its own kvzalloc'd array. Move allocation from boot time to scx_enable() and free in scx_disable(), so the O(nr_cpu_ids^2) memory is only consumed when sched_ext is active. Use RCU to guard against racing with free. Arrays are freed via call_rcu() and kick_cpus_irq_workfn() uses rcu_dereference_bh() with a NULL check. While at it, rename to scx_kick_pseqs for brevity and update comments to clarify these are pick_task sequence numbers. v2: RCU protect scx_kick_seqs to manage kick_cpus_irq_workfn() racing against disable as per Andrea. v3: Fix bugs notcied by Andrea. Reported-by: Phil Auld Link: http://lkml.kernel.org/r/20251007133523.GA93086@pauld.westford.csb Cc: Andrea Righi Reviewed-by: Emil Tsalapatis Reviewed-by: Phil Auld Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit a8ad873113d3fe01f9b5d737d4b0570fa36826b0 Author: Emil Tsalapatis Date: Fri Oct 10 12:12:50 2025 -0700 sched_ext: defer queue_balance_callback() until after ops.dispatch The sched_ext code calls queue_balance_callback() during enqueue_task() to defer operations that drop multiple locks until we can unpin them. The call assumes that the rq lock is held until the callbacks are invoked, and the pending callbacks will not be visible to any other threads. This is enforced by a WARN_ON_ONCE() in rq_pin_lock(). However, balance_one() may actually drop the lock during a BPF dispatch call. Another thread may win the race to get the rq lock and see the pending callback. To avoid this, sched_ext must only queue the callback after the dispatch calls have completed. CPU 0 CPU 1 CPU 2 scx_balance() rq_unpin_lock() scx_balance_one() |= IN_BALANCE scx_enqueue() ops.dispatch() rq_unlock() rq_lock() queue_balance_callback() rq_unlock() [WARN] rq_pin_lock() rq_lock() &= ~IN_BALANCE rq_repin_lock() Changelog v2-> v1 (https://lore.kernel.org/sched-ext/aOgOxtHCeyRT_7jn@gpd4) - Fixed explanation in patch description (Andrea) - Fixed scx_rq mask state updates (Andrea) - Added Reviewed-by tag from Andrea Reported-by: Jakub Kicinski Signed-off-by: Emil Tsalapatis (Meta) Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a Author: Joshua Watt Date: Thu Oct 9 15:48:04 2025 -0600 NFS4: Fix state renewals missing after boot Since the last renewal time was initialized to 0 and jiffies start counting at -5 minutes, any clients connected in the first 5 minutes after a reboot would have their renewal timer set to a very long interval. If the connection was idle, this would result in the client state timing out on the server and the next call to the server would return NFS4ERR_BADSESSION. Fix this by initializing the last renewal time to the current jiffies instead of 0. Signed-off-by: Joshua Watt Signed-off-by: Anna Schumaker commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 Author: Scott Mayhew Date: Thu Oct 9 16:42:12 2025 -0400 NFS: check if suid/sgid was cleared after a write as needed I noticed xfstests generic/193 and generic/355 started failing against knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE"). I ran those same tests against ONTAP (which has had write delegation support for a lot longer than knfsd) and they fail there too... so while it's a new failure against knfsd, it isn't an entirely new failure. Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation doesn't keep the inode from being revalidated to fetch the updated mode. Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 Author: Joshua Watt Date: Tue Oct 7 15:22:58 2025 -0600 NFS4: Apply delay_retrans to async operations The setting of delay_retrans is applied to synchronous RPC operations because the retransmit count is stored in same struct nfs4_exception that is passed each time an error is checked. However, for asynchronous operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct nfs4_exception is made on the stack each time the task callback is invoked. This means that the retransmit count is always zero and thus delay_retrans never takes effect. Apply delay_retrans to these operations by tracking and updating their retransmit count. Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9 Signed-off-by: Joshua Watt Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 8db4a1d146f83c6bdb0f5b98c50c509ae8549827 Author: Mike Snitzer Date: Tue Oct 7 13:39:05 2025 -0400 NFSv4/flexfiles: fix to allocate mirror->dss before use Move mirror_array's dss_count initialization and dss allocation to ff_layout_alloc_mirror(), just before the loop that initializes each nfs4_ff_layout_ds_stripe's nfs_file_localio. Also handle NULL return from kcalloc() and remove one level of indent in ff_layout_alloc_mirror(). This commit fixes dangling nfsd_serv refcount issues seen when using NFS LOCALIO and then attempting to stop the NFSD service. Fixes: 20b1d75fb840 ("NFSv4/flexfiles: Add support for striped layouts") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit efeeaac9ae9763f9c953e69633c86bc3031e39b5 Author: Tejun Heo Date: Thu Oct 9 13:56:23 2025 -1000 sched_ext: Sync error_irq_work before freeing scx_sched By the time scx_sched_free_rcu_work() runs, the scx_sched is no longer reachable. However, a previously queued error_irq_work may still be pending or running. Ensure it completes before proceeding with teardown. Fixes: bff3b5aec1b7 ("sched_ext: Move disable machinery into scx_sched") Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 927069c4ac2cd1a37efa468596fb5b8f86db9df0 Author: Jens Axboe Date: Mon Oct 13 12:05:31 2025 -0600 Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" This reverts commit 90bfb28d5fa8127a113a140c9791ea0b40ab156a. Kevin reports that this commit causes an issue for him with LVM snapshots, most likely because of turning off NOWAIT support while a snapshot is being created. This makes -EOPNOTSUPP bubble back through the completion handler, where io_uring read/write handling should just retry it. Reinstate the previous check removed by the referenced commit. Cc: stable@vger.kernel.org Fixes: 90bfb28d5fa8 ("io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()") Reported-by: Salvatore Bonaccorso Reported-by: Kevin Lumik Link: https://lore.kernel.org/io-uring/cceb723c-051b-4de2-9a4c-4aa82e1619ee@kernel.dk/ Signed-off-by: Jens Axboe commit 079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2 Author: Jonathan Kim Date: Wed Jun 18 10:31:15 2025 -0400 drm/amdkfd: fix suspend/resume all calls in mes based eviction path Suspend/resume all gangs should be done with the device lock is held. Signed-off-by: Jonathan Kim Acked-by: Alex Deucher Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 277bb0f83e98261018ddd82b7ab8154bb9b93237 Author: Jonathan Kim Date: Thu Jun 5 10:18:37 2025 -0400 drm/amdgpu: enable suspend/resume all for gfx 12 Suspend/resume all gangs has been available for GFX12 for a while now so enable it. Signed-off-by: Jonathan Kim Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 0ef930e1faca6418316e5b9a3b4d1f6ae9e5b240 Author: Jonathan Kim Date: Thu Oct 9 11:28:19 2025 -0400 drm/amdgpu: fix hung reset queue array memory allocation By design the MES will return an array result that is twice the number of hung doorbells it can report. i.e. if up k reported doorbells are supported, then the second half of the array, also of length k, holds the HQD information (type/queue/pipe) where queue 1 corresponds to index 0 and k, queue 2 corresponds to index 1 and k + 1 etc ... The driver will use the HDQ info to target queue/pipe reset for hardware scheduled user compute queues. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8745ca5efb2aad0b6591d9b8cd48573ea49c929d Author: Jonathan Kim Date: Thu Oct 9 10:48:09 2025 -0400 drm/amdgpu: fix initialization of doorbell array for detect and hang Initialized doorbells should be set to invalid rather than 0 to prevent driver from over counting hung doorbells since it checks against the invalid value to begin with. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d0de79f66a80eeb849033fae34bd07a69ce72235 Author: Jonathan Kim Date: Thu Oct 9 10:45:42 2025 -0400 drm/amdgpu: fix gfx12 mes packet status return check GFX12 MES uses low 32 bits of status return for success (1 or 0) and high bits for debug information if low bits are 0. GFX11 MES doesn't do this so checking full 64-bit status return for 1 or 0 is still valid. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 883f309add55060233bf11c1ea6947140372920f Author: Jesse.Zhang Date: Mon Oct 13 13:46:12 2025 +0800 drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices Previously, APU platforms (and other scenarios with uninitialized VRAM managers) triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, but that `man->bdev` (the backing device pointer within the manager) remains uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to a kernel OOPS. 1. **amdgpu_cs.c**: Extend the existing bandwidth control check in `amdgpu_cs_get_threshold_for_moves()` to include a check for `ttm_resource_manager_used()`. If the manager is not used (uninitialized `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific logic that would trigger the NULL dereference. 2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info reporting to use a conditional: if the manager is used, return the real VRAM usage; otherwise, return 0. This avoids accessing `man->bdev` when it is NULL. 3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) data write path. Use `ttm_resource_manager_used()` to check validity: if the manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set `fb_usage` to 0 (APUs have no discrete framebuffer to report). This approach is more robust than APU-specific checks because it: - Works for all scenarios where the VRAM manager is uninitialized (not just APUs), - Aligns with TTM's design by using its native helper function, - Preserves correct behavior for discrete GPUs (which have fully initialized `man->bdev` and pass the `ttm_resource_manager_used()` check). v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) Reviewed-by: Christian König Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 33cc891b56b93cad1a83263eaf2e417436f70c82 Author: Christian König Date: Tue Oct 7 10:10:52 2025 +0200 drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM Otherwise accessing them can cause a crash. Signed-off-by: Christian König Tested-by: Mangesh Gadre Acked-by: Alex Deucher Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Alex Deucher commit 74de0eaa00eac2e0cbad1dda6dcf8f44ab27629e Author: Sathishkumar S Date: Fri Oct 10 23:32:40 2025 +0530 drm/amdgpu: fix bit shift logic BIT_ULL(n) sets nth bit, remove explicit shift and set the position Fixes: a7a411e24626 ("drm/amdgpu: fix shift-out-of-bounds in amdgpu_debugfs_jpeg_sched_mask_set") Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf Author: Timur Kristóf Date: Mon Oct 13 08:06:42 2025 +0200 drm/amd/powerplay: Fix CIK shutdown temperature Remove extra multiplication. CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case the shutdown temperature is hardcoded in smu7_init_dpm_defaults and is already multiplied by 1000. The value was mistakenly multiplied another time by smu7_get_thermal_temperature_range. Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit ef38b4eab146715bc68d45029257f5e69ea3f2cd Author: Alex Deucher Date: Fri Oct 10 16:40:57 2025 -0400 drm/amdgpu: drop unused structures in amdgpu_drm.h These were never used and are duplicated with the interface that is used. Maybe leftovers from a previous revision of the patch that added them. Fixes: 90c448fef312 ("drm/amdgpu: add new AMDGPU_INFO subquery for userq objects") Reviewed-by: Prike Liang Signed-off-by: Alex Deucher commit 6df8e84aa6b5b1812cc2cacd6b3f5ccbb18cda2b Author: Gui-Dong Han Date: Wed Oct 8 03:43:27 2025 +0000 drm/amdgpu: use atomic functions with memory barriers for vm fault info The atomic variable vm_fault_info_updated is used to synchronize access to adev->gmc.vm_fault_info between the interrupt handler and get_vm_fault_info(). The default atomic functions like atomic_set() and atomic_read() do not provide memory barriers. This allows for CPU instruction reordering, meaning the memory accesses to vm_fault_info and the vm_fault_info_updated flag are not guaranteed to occur in the intended order. This creates a race condition that can lead to inconsistent or stale data being used. The previous implementation, which used an explicit mb(), was incomplete and inefficient. It failed to account for all potential CPU reorderings, such as the access of vm_fault_info being reordered before the atomic_read of the flag. This approach is also more verbose and less performant than using the proper atomic functions with acquire/release semantics. Fix this by switching to atomic_set_release() and atomic_read_acquire(). These functions provide the necessary acquire and release semantics, which act as memory barriers to ensure the correct order of operations. It is also more efficient and idiomatic than using explicit full memory barriers. Fixes: b97dfa27ef3a ("drm/amdgpu: save vm fault information for amdkfd") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit ff780f4f80323148d43198f2052c14160c8428d3 Author: Alex Deucher Date: Wed Sep 3 13:48:23 2025 -0400 drm/amdgpu: set an error on all fences from a bad context When we backup ring contents to reemit after a queue reset, we don't backup ring contents from the bad context. When we signal the fences, we should set an error on those fences as well. v2: misc cleanups v3: add locking for fence error, fix comment (Christian) v4: fix wrap around, locking (Christian) Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1f22fcb88bfef26a966e9eb242c692c6bf253d47 Author: Alex Deucher Date: Mon Sep 15 12:37:32 2025 -0400 drm/amdgpu: handle wrap around in reemit handling Compare the sequence numbers directly. Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 Author: Alex Deucher Date: Fri Sep 26 17:31:32 2025 -0400 drm/amdgpu: fix handling of harvesting for ip_discovery firmware Chips which use the IP discovery firmware loaded by the driver reported incorrect harvesting information in the ip discovery table in sysfs because the driver only uses the ip discovery firmware for populating sysfs and not for direct parsing for the driver itself as such, the fields that are used to print the harvesting info in sysfs report incorrect data for some IPs. Populate the relevant fields for this case as well. Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery") Acked-by: Tom St Denis Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8f74c70be57527d7b79e2ecf6de1a154d148254d Author: Christian König Date: Mon Sep 22 14:18:16 2025 +0200 drm/amdgpu: block CE CS if not explicitely allowed by module option The Constant Engine found on gfx6-gfx10 HW has been a notorious source of problems. RADV never used it in the first place, radeonsi only used it for a few releases around 2017 for gfx6-gfx9 before dropping support for it as well. While investigating another problem I just recently found that submitting to the CE seems to be completely broken on gfx9 for quite a while. Since nobody complained about that problem it most likely means that nobody is using any of the affected radeonsi versions on current Linux kernels any more. So to potentially phase out the support for the CE and eliminate another source of problems block submitting CE IBs unless it is enabled again using a debug flag. Signed-off-by: Christian König Reviewed-by: Alex Deucher Acked-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 Author: Christian König Date: Wed Aug 27 14:47:23 2025 +0200 drm/amdgpu: remove two invalid BUG_ON()s Those can be triggered trivially by userspace. Signed-off-by: Christian König Reviewed-by: Alex Deucher Acked-by: Timur Kristóf Signed-off-by: Alex Deucher commit 7bdd91abf0cb3ea78160e2e78fb58b12f6a38d55 Author: Timur Kristóf Date: Fri Sep 26 20:26:13 2025 +0200 drm/amd: Disable ASPM on SI Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. It's unclear if this is a platform-specific or GPU-specific issue. Disable ASPM on SI for the time being. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a Author: Timur Kristóf Date: Fri Sep 26 20:26:12 2025 +0200 drm/amd/pm: Disable MCLK switching on SI at high pixel clocks On various SI GPUs, a flickering can be observed near the bottom edge of the screen when using a single 4K 60Hz monitor over DP. Disabling MCLK switching works around this problem. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9858ea4c29c283f0a8a3cdbb42108d464ece90a8 Author: Matthew Schwartz Date: Thu Oct 9 14:19:00 2025 +0200 Revert "drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume" This fix regressed the original issue that commit 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") solved, so revert it until a different approach to solve the regression that it caused with AMD_PRIVATE_COLOR is found. Fixes: a490c8d77d50 ("drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4620 Cc: stable@vger.kernel.org Signed-off-by: Matthew Schwartz Signed-off-by: Alex Deucher commit 54e96258a6930909b690fd7e8889749231ba8085 Author: Tejun Heo Date: Mon Oct 6 15:35:36 2025 -1000 sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU scx_bpf_dsq_move_set_slice() and scx_bpf_dsq_move_set_vtime() take a DSQ iterator argument which has to be valid. Mark them with KF_RCU. Fixes: 4c30f5ce4f7a ("sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()") Cc: stable@vger.kernel.org # v6.12+ Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 86af6b90e0556fcefbc6e98eb78bdce90327ee76 Author: Ville Syrjälä Date: Fri Oct 3 17:57:31 2025 +0300 drm/i915/fb: Fix the set_tiling vs. addfb race, again intel_frontbuffer_get() is what locks out subsequent set_tiling changes to the bo. Thus the fence vs. modifier check must be done after intel_frontbuffer_get(), or else a concurrent set_tiling ioctl might sneak in and change the fence after the check has been done. Close the race again. See commit dd689287b977 ("drm/i915: Prevent concurrent tiling/framebuffer modifications") for the previous instance. v2: Reorder intel_user_framebuffer_destroy() to match the unwind (Jani) Cc: Jouni Högander Reviewed-by: Jani Nikula Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-3-ville.syrjala@linux.intel.com (cherry picked from commit 1d1e4ded216017f8febd91332ee337f0e0e79285) Signed-off-by: Rodrigo Vivi commit 760039c95c78490c5c66ef584fcd536797ed6a2f Author: Ville Syrjälä Date: Fri Oct 3 17:57:30 2025 +0300 drm/i915/frontbuffer: Move bo refcounting intel_frontbuffer_{get,release}() Currently xe's intel_frontbuffer implementation forgets to hold a reference on the bo. This makes the entire thing extremely fragile as the cleanup order now depends on bo references held by other things (namely intel_fb_bo_framebuffer_fini()). Move the bo refcounting to intel_frontbuffer_{get,release}() so that both i915 and xe do this the same way. I first tried to fix this by having xe do the refcounting from its intel_bo_set_frontbuffer() implementation (which is what i915 does currently), but turns out xe's drm_gem_object_free() can sleep and thus drm_gem_object_put() isn't safe to call while we hold fb_tracking.lock. Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit eb4d490729a5fd8dc5a76d334f8d01fec7c14bbe) Signed-off-by: Rodrigo Vivi commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 Author: Zhanjun Dong Date: Mon Sep 29 11:29:04 2025 -0400 drm/i915/guc: Skip communication warning on reset in progress GuC IRQ and tasklet handler receive just single G2H message, and let other messages to be received from next tasklet. During this chained tasklet process, if reset process started, communication will be disabled. Skip warning for this condition. Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018 Signed-off-by: Zhanjun Dong Reviewed-by: Vinay Belgaumkar Signed-off-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com (cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf) Signed-off-by: Rodrigo Vivi commit 4adc20ba95d472a919f54d441663924e33c92279 Author: Stefan Wahren Date: Sun Oct 5 13:38:16 2025 +0200 ARM: dts: broadcom: rpi: Switch to V3D firmware clock Until commit 919d6924ae9b ("clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing") the clk-raspberrypi driver wasn't able to change the state of the V3D clock. Only the clk-bcm2835 was able to do this before. After this commit both drivers were able to work against each other, which could result in a system freeze. One step to avoid this conflict is to switch all V3D consumer to the firmware clock. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/linux-arm-kernel/727aa0c8-2981-4662-adf3-69cac2da956d@samsung.com/ Fixes: 919d6924ae9b ("clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing") Signed-off-by: Stefan Wahren Co-developed-by: Melissa Wen Signed-off-by: Melissa Wen Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251005113816.6721-1-wahrenst@gmx.net Signed-off-by: Florian Fainelli commit aa960b597600bed80fe171729057dd6aa188b5b5 Author: Peter Robinson Date: Wed Sep 24 09:56:05 2025 +0100 arm64: dts: broadcom: bcm2712: Define VGIC interrupt Define the interrupt in the GICv2 for vGIC so KVM can be used, it was missed from the original upstream DTB for some reason. Signed-off-by: Peter Robinson Cc: Andrea della Porta Cc: Phil Elwell Fixes: faa3381267d0 ("arm64: dts: broadcom: Add minimal support for Raspberry Pi 5") Link: https://lore.kernel.org/r/20250924085612.1039247-1-pbrobinson@gmail.com Signed-off-by: Florian Fainelli commit 7363096a5a08f8740c9075ecfc51945375c304bc Author: Martyn Welch Date: Thu Oct 9 14:41:32 2025 +0100 Input: goodix - remove setting of RST pin to input The reset line is being set to input on non-ACPI devices apparently to save power. This isn't being done on ACPI devices as it's been found that some ACPI devices don't have a pull-up resistor fitted. This can also be the case for non-ACPI devices, resulting in: [ 941.672207] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 [ 942.696168] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 [ 945.832208] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 This behaviour appears to have been initialing introduced in ec6e1b4082d9. This doesn't seem to be based on information in either the GT911 or GT9271 datasheets cited as sources of information for this change. Thus it seems likely that it is based on functionality in the Android driver which it also lists. This behaviour may be viable in very specific instances where the hardware is well known, but seems unwise in the upstream kernel where such hardware requirements can't be guaranteed. Remove this over optimisation to improve reliability on non-ACPI devices. Signed-off-by: Martyn Welch Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20251009134138.686215-1-martyn.welch@collabora.com Signed-off-by: Dmitry Torokhov commit c6d99e488117201c63efd747ce17b80687c3f5a9 Author: Hans de Goede Date: Mon Oct 13 09:15:25 2025 -0700 Input: goodix - add support for ACPI ID GDIX1003 Some newer devices use an ACPI hardware ID of GDIX1003 for their Goodix touchscreen controller, instead of GDIX1001 / GDIX1002. Add GDIX1003 to the goodix_acpi_match[] table. Reported-by: Weikang Guo Closes: https://lore.kernel.org/linux-input/20250225024409.1467040-1-guoweikang.kernel@gmail.com/ Tested-by: Weikang Guo Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20251013121022.44333-1-hansg@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 79c0a2b7abc906c7cf3c793256c6b638d7dc477f Author: Dan Carpenter Date: Sat Sep 27 15:26:34 2025 +0300 EDAC/versalnet: Fix off by one in handle_error() The priv->mci[] array has NUM_CONTROLLERS so this > comparison needs to be >= to prevent an out of bounds access. Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Dan Carpenter Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam commit e0b5a7967dec05144bc98125f98c47f74fd1152b Author: Oliver Upton Date: Wed Sep 24 16:51:50 2025 -0700 KVM: arm64: nv: Use FGT write trap of MDSCR_EL1 when available Marc reports that the performance of running an L3 guest has regressed by 60% as a result of setting MDCR_EL2.TDA to hide bad architecture. That's of course terrible for the single user of recursive NV ;-) While there's nothing to be done on non-FGT systems, take advantage of the precise write trap of MDSCR_EL1 and leave the rest of the debug registers untrapped. Reported-by: Marc Zyngier Signed-off-by: Oliver Upton Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit fb10ddf35c1cc3b2888a944c0a3b1aa3baea585e Author: Oliver Upton Date: Wed Sep 24 16:51:49 2025 -0700 KVM: arm64: Compute per-vCPU FGTs at vcpu_load() To date KVM has used the fine-grained traps for the sake of UNDEF enforcement (so-called FGUs), meaning the constituent parts could be computed on a per-VM basis and folded into the effective value when programmed. Prepare for traps changing based on the vCPU context by computing the whole mess of them at vcpu_load(). Aggressively inline all the helpers to preserve the build-time checks that were there before. Signed-off-by: Oliver Upton Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit 5c7cf1e44e94a5408b1b5277810502b0f82b77fe Author: Marc Zyngier Date: Mon Sep 29 17:04:57 2025 +0100 KVM: arm64: selftests: Fix misleading comment about virtual timer encoding The userspace-visible encoding for CNTV_CVAL_EL0 and CNTVCNT_EL0 have been swapped for as long as usersapce has had access to the registers. This is documented in arch/arm64/include/uapi/asm/kvm.h. Despite that, the get_reg_list test has unhelpful comments indicating the wrong register for the encoding. Replace this with definitions exposed in the include file, and a comment explaining again the brokenness. Signed-off-by: Marc Zyngier commit 4da5a9af78b74fb771a4d25dc794296d10e170b1 Author: Marc Zyngier Date: Mon Sep 29 17:04:56 2025 +0100 KVM: arm64: selftests: Add an E2H=0-specific configuration to get_reg_list Add yet another configuration, this time dealing E2H=0. Signed-off-by: Marc Zyngier commit 6418330c8478735f625398bc4e96d3ac6ce1e055 Author: Marc Zyngier Date: Mon Sep 29 17:04:55 2025 +0100 KVM: arm64: selftests: Make dependencies on VHE-specific registers explicit The hyp virtual timer registers only exist when VHE is present, Similarly, VNCR_EL2 only exists when NV2 is present. Make these dependencies explicit. Signed-off-by: Marc Zyngier commit 386aac77da112651a5cdadc4a6b29181592f5aa0 Author: Marc Zyngier Date: Mon Sep 29 17:04:54 2025 +0100 KVM: arm64: Kill leftovers of ad-hoc timer userspace access Now that the whole timer infrastructure is handled as system register accesses, get rid of the now unused ad-hoc infrastructure. Signed-off-by: Marc Zyngier commit 892f7c38ba3b7de19b3dffb8e148d5fbf1228f20 Author: Marc Zyngier Date: Mon Sep 29 17:04:53 2025 +0100 KVM: arm64: Fix WFxT handling of nested virt The spec for WFxT indicates that the parameter to the WFxT instruction is relative to the reading of CNTVCT_EL0. This means that the implementation needs to take the execution context into account, as CNTVOFF_EL2 does not always affect readings of CNTVCT_EL0 (such as when HCR_EL2.E2H is 1 and that we're in host context). This also rids us of the last instance of KVM_REG_ARM_TIMER_CNT outside of the userspace interaction code. Signed-off-by: Marc Zyngier commit c3be3a48fb18f9d243fac452e0be41469bb246b4 Author: Marc Zyngier Date: Mon Sep 29 17:04:52 2025 +0100 KVM: arm64: Move CNT*CT_EL0 userspace accessors to generic infrastructure Moving the counter registers is a bit more involved than for the control and comparator (there is no shadow data for the counter), but still pretty manageable. Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit 8af198980eff2ed2a5df3d2ee39f8c9d61f40559 Author: Marc Zyngier Date: Mon Sep 29 17:04:51 2025 +0100 KVM: arm64: Move CNT*_CVAL_EL0 userspace accessors to generic infrastructure As for the control registers, move the comparator registers to the common infrastructure. Signed-off-by: Marc Zyngier commit 09424d5d7d4e8b427ee4a737fb7765103789e08a Author: Marc Zyngier Date: Mon Sep 29 17:04:50 2025 +0100 KVM: arm64: Move CNT*_CTL_EL0 userspace accessors to generic infrastructure Remove the handling of CNT*_CTL_EL0 from guest.c, and move it to sys_regs.c, using a new TIMER_REG() definition to encapsulate it. Signed-off-by: Marc Zyngier commit 77a0c42eaf03c66936429d190bb2ea1a214bd528 Author: Marc Zyngier Date: Mon Sep 29 17:04:49 2025 +0100 KVM: arm64: Add timer UAPI workaround to sysreg infrastructure Amongst the numerous bugs that plague the KVM/arm64 UAPI, one of the most annoying thing is that the userspace view of the virtual timer has its CVAL and CNT encodings swapped. In order to reduce the amount of code that has to know about this, start by adding handling for this bug in the sys_reg code. Nothing is making use of it yet, as the code responsible for userspace interaction is catching the accesses early. Signed-off-by: Marc Zyngier commit a92d552266890f83126fdef4f777a985cc1302bd Author: Marc Zyngier Date: Mon Sep 29 17:04:48 2025 +0100 KVM: arm64: Make timer_set_offset() generally accessible Move the timer_set_offset() helper to arm_arch_timer.h, so that it is next to timer_get_offset(), and accessible by the rest of KVM. Signed-off-by: Marc Zyngier commit 8625a670afb05f1e1d69d50a74dbcc9d1b855efe Author: Marc Zyngier Date: Mon Sep 29 17:04:47 2025 +0100 KVM: arm64: Replace timer context vcpu pointer with timer_id Having to follow a pointer to a vcpu is pretty dumb, when the timers are are a fixed offset in the vcpu structure itself. Trade the vcpu pointer for a timer_id, which can then be used to compute the vcpu address as needed. Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit aa68975c973ed3b0bd4ff513113495588afb855c Author: Marc Zyngier Date: Mon Sep 29 17:04:46 2025 +0100 KVM: arm64: Introduce timer_context_to_vcpu() helper We currently have a vcpu pointer nested into each timer context. As we are about to remove this pointer, introduce a helper (aptly named timer_context_to_vcpu()) that returns this pointer, at least until we repaint the data structure. Signed-off-by: Marc Zyngier commit 4cab5c857d1f92b4b322e30349fdc5e2e38e7a2f Author: Marc Zyngier Date: Mon Sep 29 17:04:45 2025 +0100 KVM: arm64: Hide CNTHV_*_EL2 from userspace for nVHE guests Although we correctly UNDEF any CNTHV_*_EL2 access from the guest when E2H==0, we still expose these registers to userspace, which is a bad idea. Drop the ad-hoc UNDEF injection and switch to a .visibility() callback which will also hide the register from userspace. Fixes: 0e45981028550 ("KVM: arm64: timer: Don't adjust the EL2 virtual timer offset") Signed-off-by: Marc Zyngier commit 164ecbf73c3ea61455e07eefdad8050a7b569558 Author: Sascha Bischoff Date: Tue Oct 7 15:48:54 2025 +0000 Documentation: KVM: Update GICv3 docs for GICv5 hosts GICv5 hosts optionally include FEAT_GCIE_LEGACY, which allows them to execute GICv3-based VMs on GICv5 hardware. Update the GICv3 documentation to reflect this now that GICv3 guests are supports on compatible GICv5 hosts. Signed-off-by: Sascha Bischoff Signed-off-by: Marc Zyngier commit 3193287ddffbce29fd1a79d812f543c0fe4861d1 Author: Sascha Bischoff Date: Tue Oct 7 16:07:13 2025 +0000 KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests The ICH_HCR_EL2 traps are used when running on GICv3 hardware, or when running a GICv3-based guest using FEAT_GCIE_LEGACY on GICv5 hardware. When running a GICv2 guest on GICv3 hardware the traps are used to ensure that the guest never sees any part of GICv3 (only GICv2 is visible to the guest), and when running a GICv3 guest they are used to trap in specific scenarios. They are not applicable for a GICv2-native guest, and won't be applicable for a(n upcoming) GICv5 guest. The traps themselves are configured in the vGIC CPU IF state, which is stored as a union. Updating the wrong aperture of the union risks corrupting state, and therefore needs to be avoided at all costs. Bail early if we're not running a compatible guest (GICv2 on GICv3 hardware, GICv3 native, GICv3 on GICv5 hardware). Trap everything unconditionally if we're running a GICv2 guest on GICv3 hardware. Otherwise, conditionally set up GICv3-native trapping. Signed-off-by: Sascha Bischoff Signed-off-by: Marc Zyngier commit d5e6310a0d996493b1af9f3eeec418350523388b Author: Oliver Upton Date: Tue Oct 7 12:52:55 2025 -0700 KVM: arm64: selftests: Actually enable IRQs in vgic_lpi_stress vgic_lpi_stress rather hilariously leaves IRQs disabled for the duration of the test. While the ITS translation of MSIs happens regardless of this, for completeness the guest should actually handle the LPIs. Signed-off-by: Oliver Upton Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 2192d348c0aa0cc2e7249dc3709f21bfe0a0170c Author: Zenghui Yu Date: Wed Oct 8 23:45:20 2025 +0800 KVM: arm64: selftests: Allocate vcpus with correct size vcpus array contains pointers to struct kvm_vcpu {}. It is way overkill to allocate the array with (nr_cpus * sizeof(struct kvm_vcpu)). Fix the allocation by using the correct size. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier commit c35dd838666d47de2848639234ec32e3ba22b49f Author: Mukesh Ojha Date: Fri Oct 10 23:17:07 2025 +0530 KVM: arm64: Guard PMSCR_EL1 initialization with SPE presence check Commit efad60e46057 ("KVM: arm64: Initialize PMSCR_EL1 when in VHE") does not perform sufficient check before initializing PMSCR_EL1 to 0 when running in VHE mode. On some platforms, this causes the system to hang during boot, as EL3 has not delegated access to the Profiling Buffer to the Non-secure world, nor does it reinject an UNDEF on sysreg trap. To avoid this issue, restrict the PMSCR_EL1 initialization to CPUs that support Statistical Profiling Extension (FEAT_SPE) and have the Profiling Buffer accessible in Non-secure EL1. This is determined via a new helper `cpu_has_spe()` which checks both PMSVer and PMBIDR_EL1.P. This ensures the initialization only affects CPUs where SPE is implemented and usable, preventing boot failures on platforms where SPE is not properly configured. Fixes: efad60e46057 ("KVM: arm64: Initialize PMSCR_EL1 when in VHE") Signed-off-by: Mukesh Ojha Signed-off-by: Marc Zyngier commit 1ef0e16c3d7ca07432987840d8eef1a9ffb67dec Author: Stefan Metzmacher Date: Sun Oct 12 21:10:29 2025 +0200 smb: client: let destroy_mr_list() call ib_dereg_mr() before ib_dma_unmap_sg() This is more consistent as we call ib_dma_unmap_sg() only when the memory is no longer registered. This is the same pattern as calling ib_dma_unmap_sg() after IB_WR_LOCAL_INV. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b9c0becc2fceb53e4a958575344e92c0e4f812bb Author: Stefan Metzmacher Date: Sun Oct 12 21:10:28 2025 +0200 smb: client: call ib_dma_unmap_sg if mr->sgt.nents is not 0 This seems to be the more reliable way to check if we need to call ib_dma_unmap_sg(). Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 56c817e31acedc8a9041b181a15755e5a7b55f2b Author: Stefan Metzmacher Date: Sun Oct 12 21:10:27 2025 +0200 smb: client: improve logic in smbd_deregister_mr() - use 'mr' as variable name - style fixes This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c8478502960eb8fb9847b36a66380adf421cdc62 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:26 2025 +0200 smb: client: improve logic in smbd_register_mr() - use 'mr' as variable name - style fixes This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9bebb8924b27f06e7072f0b18a5f78cef561c810 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:25 2025 +0200 smb: client: improve logic in allocate_mr_list() - use 'mr' as variable name - use goto lables for easier cleanup - use destroy_mr_list() - style fixes - INIT_WORK(&sc->mr_io.recovery_work, smbd_mr_recovery_work) on success This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8e128b293e2b08d4ecca7c63ed1cb5b97f30af9 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:24 2025 +0200 smb: client: let destroy_mr_list() remove locked from the list This should make sure get_mr() can't see the removed entries. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 19421ec198981f60373080af67e67b6a6fcf191e Author: Stefan Metzmacher Date: Sun Oct 12 21:10:23 2025 +0200 smb: client: let destroy_mr_list() call list_del(&mr->list) This makes the code clearer and will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit abe5b71c391352127925bf951f3169d205c5caa7 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:22 2025 +0200 smb: client: change smbd_deregister_mr() to return void No callers checks the return value and this makes further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit e487f13cc94fa80c71f217d7b176e48fbb5d6c46 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:21 2025 +0200 smb: smbdirect: introduce smbdirect_mr_io.{kref,mutex} and SMBDIRECT_MR_DISABLED This will be used in the next commits in order to improve the client code. A broken connection can just disable the smbdirect_mr_io while keeping the memory arround for the caller. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 911063b590ce77d473e92716f05f34712f97ef95 Author: Markus Elfring Date: Fri Oct 10 14:48:13 2025 +0200 smb: client: Omit one redundant variable assignment in cifs_xattr_set() The local variable “rc” is assigned a value in an if branch without using it before it is reassigned there. Thus delete this assignment statement. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit b9ce79887e270ed64ed499aa69f903cdca401c2f Author: Markus Elfring Date: Fri Oct 10 21:04:16 2025 +0200 smb: client: Return a status code only as a constant in sid_to_id() Return a status code without storing it in an intermediate variable. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit 9a7f87eb587da49993f47f44c4c5535d8de76750 Author: Zenghui Yu Date: Sun Oct 12 23:43:52 2025 +0800 KVM: arm64: selftests: Sync ID_AA64PFR1, MPIDR, CLIDR in guest We forgot to sync several registers (ID_AA64PFR1, MPIDR, CLIDR) in guest to make sure that the guest had seen the written value. Add them to the list. Signed-off-by: Zenghui Yu Reviewed-By: Ben Horgan Signed-off-by: Marc Zyngier commit 05a02490faeb952f1c8d2f5c38346fa0a717a483 Author: Osama Abdelkader Date: Tue Sep 30 16:56:21 2025 +0300 KVM: arm64: Remove unreachable break after return Remove an unnecessary 'break' statement that follows a 'return' in arch/arm64/kvm/at.c. The break is unreachable. Signed-off-by: Osama Abdelkader Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit a133052666bed0dc0b169952e9d3f9e6b2125f9a Author: Oliver Upton Date: Tue Sep 30 12:33:02 2025 -0700 KVM: selftests: Fix irqfd_test for non-x86 architectures The KVM_IRQFD ioctl fails if no irqchip is present in-kernel, which isn't too surprising as there's not much KVM can do for an IRQ if it cannot resolve a destination. As written the irqfd_test assumes that a 'default' VM created in selftests has an in-kernel irqchip created implicitly. That may be the case on x86 but it isn't necessarily true on other architectures. Add an arch predicate indicating if 'default' VMs get an irqchip and make the irqfd_test depend on it. Work around arm64 VGIC initialization requirements by using vm_create_with_one_vcpu(), ignoring the created vCPU as it isn't used for the test. Reported-by: Sebastian Ott Reported-by: Naresh Kamboju Acked-by: Sean Christopherson Fixes: 7e9b231c402a ("KVM: selftests: Add a KVM_IRQFD test to verify uniqueness requirements") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit cc4309324dc695f62d25d56c0b29805e9724170c Author: Oliver Upton Date: Tue Sep 30 16:36:20 2025 -0700 KVM: arm64: Document vCPU event ioctls as requiring init'ed vCPU KVM rejects calls to KVM_{GET,SET}_VCPU_EVENTS for an uninitialized vCPU as of commit cc96679f3c03 ("KVM: arm64: Prevent access to vCPU events before init"). Update the corresponding API documentation. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0aa1b76fe1429629215a7c79820e4b96233ac4a3 Author: Oliver Upton Date: Tue Sep 30 01:52:37 2025 -0700 KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state. Cc: stable@vger.kernel.org # 6.17 Fixes: b7b27facc7b5 ("arm/arm64: KVM: Add KVM_GET/SET_VCPU_EVENTS") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit cb49b7b8622e914171e9eb7197c006320889e0fc Author: Sean Christopherson Date: Fri Sep 26 08:58:38 2025 -0700 KVM: arm64: selftests: Track width of timer counter as "int", not "uint64_t" Store the width of arm64's timer counter as an "int", not a "uint64_t". ilog2() returns an "int", and more importantly using what is an "unsigned long" under the hood makes clang unhappy due to a type mismatch when clamping the width to a sane value. arm64/arch_timer_edge_cases.c:1032:10: error: comparison of distinct pointer types ('typeof (width) *' (aka 'unsigned long *') and 'typeof (56) *' (aka 'int *')) [-Werror,-Wcompare-distinct-pointer-types] 1032 | width = clamp(width, 56, 64); | ^~~~~~~~~~~~~~~~~~~~ tools/include/linux/kernel.h:47:45: note: expanded from macro 'clamp' 47 | #define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi) | ^~~~~~~~~~~~ tools/include/linux/kernel.h:33:17: note: expanded from macro 'max' 33 | (void) (&_max1 == &_max2); \ | ~~~~~~ ^ ~~~~~~ tools/include/linux/kernel.h:39:9: note: expanded from macro 'min' 39 | typeof(x) _min1 = (x); \ | ^ Fixes: fad4cf944839 ("KVM: arm64: selftests: Determine effective counter width in arch_timer_edge_cases") Cc: Sebastian Ott Signed-off-by: Sean Christopherson Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 890c608b4d5e6a616693da92a2d4e7de4ab9e6c5 Author: Oliver Upton Date: Fri Sep 26 15:44:54 2025 -0700 KVM: arm64: selftests: Test effective value of HCR_EL2.AMO A defect against the architecture now allows an implementation to treat AMO as 1 when HCR_EL2.{E2H, TGE} = {1, 0}. KVM now takes advantage of this interpretation to address a quality of emulation issue w.r.t. SError injection. Add a corresponding test case and expect a pending SError to be taken. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a46c09b382eea3f9e3d16576096b987a2171fcca Author: Oliver Upton Date: Fri Sep 26 15:42:46 2025 -0700 KVM: arm64: Use the in-context stage-1 in __kvm_find_s1_desc_level() Running the external_aborts selftest at EL2 leads to an ugly splat due to the stage-1 MMU being disabled for the walked context, owing to the fact that __kvm_find_s1_desc_level() is hardcoded to the EL1&0 regime. Select the appropriate translation regime for the stage-1 walk based on the current vCPU context. Fixes: b8e625167a32 ("KVM: arm64: Add S1 IPA to page table level walker") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 9a1950f97741a23fc68a7b2cfd487e059d389be5 Author: Marc Zyngier Date: Fri Sep 26 12:41:08 2025 -0700 KVM: arm64: nv: Don't advance PC when pending an SVE exception Jan reports that running a nested guest on Neoverse-V2 leads to a WARN in the host due to simultaneously pending an exception and PC increment after an access to ZCR_EL2. Returning true from a sysreg accessor is an indication that the sysreg instruction has been retired. Of course this isn't the case when we've pended a synchronous SVE exception for the guest. Fix the return value and let the exception propagate to the guest as usual. Reported-by: Jan Kotas Closes: https://lore.kernel.org/kvmarm/865xd61tt5.wl-maz@kernel.org/ Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit ed25dcfbc4327570b28f0328a8e17d121434c0ea Author: Oliver Upton Date: Fri Sep 26 12:41:07 2025 -0700 KVM: arm64: nv: Don't treat ZCR_EL2 as a 'mapped' register Unlike the other mapped EL2 sysregs ZCR_EL2 isn't guaranteed to be resident when a vCPU is loaded as it actually follows the SVE context. As such, the contents of ZCR_EL1 may belong to another guest if the vCPU has been preempted before reaching sysreg emulation. Unconditionally use the in-memory value of ZCR_EL2 and switch to the memory-only accessors. The in-memory value is guaranteed to be valid as fpsimd_lazy_switch_to_{guest,host}() will restore/save the register appropriately. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 8735696acea24ac1f9d4490992418c71941ca68c Author: Mattijs Korpershoek Date: Thu Oct 9 09:10:38 2025 +0200 spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER In csqspi_probe(), when cqspi_request_mmap_dma() returns -EPROBE_DEFER, we handle the error by jumping to probe_setup_failed. In that label, we call pm_runtime_disable(), even if we never called pm_runtime_enable() before. Because of this, the driver cannot probe: [ 2.690018] cadence-qspi 47040000.spi: No Rx DMA available [ 2.699735] spi-nor spi0.0: resume failed with -13 [ 2.699741] spi-nor: probe of spi0.0 failed with error -13 Only call pm_runtime_disable() if it was enabled by adding a new label to handle cqspi_request_mmap_dma() failures. Fixes: b07f349d1864 ("spi: spi-cadence-quadspi: Fix pm runtime unbalance") Signed-off-by: Mattijs Korpershoek Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251009-cadence-quadspi-fix-pm-runtime-v2-1-8bdfefc43902@kernel.org Signed-off-by: Mark Brown commit f43579ef3500527649b1c233be7cf633806353aa Author: Haibo Chen Date: Mon Sep 22 16:47:15 2025 +0800 spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection For different sample clock source selection, the max frequency flexspi supported are different. For mode 0, max frequency is 66MHz. For mode 3, the max frequency is 166MHz. Refer to 3.9.9 FlexSPI timing parameters on page 65. https://www.nxp.com/docs/en/data-sheet/IMX8MNCEC.pdf Though flexspi maybe still work under higher frequency, but can't guarantee the stability. IC suggest to add this limitation on all SoCs which contain flexspi. Fixes: c07f27032317 ("spi: spi-nxp-fspi: add the support for sample data from DQS pad") Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-3-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit b93b4269791fdebbac2a9ad26f324dc2abb9e60f Author: Han Xu Date: Mon Sep 22 16:47:14 2025 +0800 spi: spi-nxp-fspi: add extra delay after dll locked Due to the erratum ERR050272, the DLL lock status register STS2 [xREFLOCK, xSLVLOCK] bit may indicate DLL is locked before DLL is actually locked. Add an extra 4us delay as a workaround. refer to ERR050272, on Page 20. https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf Fixes: 99d822b3adc4 ("spi: spi-nxp-fspi: use DLL calibration when clock rate > 100MHz") Signed-off-by: Han Xu Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-2-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit a89103f67112453fa36c9513e951c19eed9d2d92 Author: Haibo Chen Date: Mon Sep 22 16:47:13 2025 +0800 spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate Current operation contain the max_freq, so new coming operation may use new clock rate, need to re-config the clock rate to match the requirement. Fixes: 26851cf65ffc ("spi: nxp-fspi: Support per spi-mem operation frequency switches") Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-1-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit 4f38da1f027ea2c9f01bb71daa7a299c191b6940 Merge: 18a5f1af596e6b 3a8660878839fa Author: Mark Brown Date: Mon Oct 13 13:32:13 2025 +0100 spi: Merge up v6.18-rc1 Ensure my CI has a sensible baseline. commit ee70bacef1c6050e4836409927294d744dbcfa72 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:27 2025 +0300 ASoC: nau8821: Avoid unnecessary blocking in IRQ handler The interrupt handler offloads the microphone detection logic to nau8821_jdet_work(), which implies a sleep operation. However, before being able to process any subsequent hotplug event, the interrupt handler needs to wait for any prior scheduled work to complete. Move the sleep out of jdet_work by converting it to a delayed work. This eliminates the undesired blocking in the interrupt handler when attempting to cancel a recently scheduled work item and should help reducing transient input reports that might confuse user-space. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-5-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:26 2025 +0300 ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit Stress testing the audio jack hotplug handling on a few Steam Deck units revealed that the debounce circuit is responsible for having a negative impact on the detection reliability, e.g. in some cases the ejection interrupt is not fired, while in other instances it goes into a kind of invalid state and generates a flood of misleading interrupts. Add new entries to the DMI table introduced via commit 1bc40efdaf4a ("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") and extend the quirk logic to allow bypassing the debounce circuit used for jack detection on Valve Steam Deck LCD and OLED models. While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability by differentiating from similarly named register bits. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit a698679fe8b0fec41d1fb9547a53127a85c1be92 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:25 2025 +0300 ASoC: nau8821: Consistently clear interrupts before unmasking The interrupt handler attempts to perform some IRQ status clear operations *after* rather than *before* unmasking and enabling interrupts. This is a rather fragile approach since it may generally lead to missing IRQ requests or causing spurious interrupts. Make use of the nau8821_irq_status_clear() helper instead of manipulating the related register directly and ensure any interrupt clearing is performed *after* the target interrupts are disabled/masked and *before* proceeding with additional interrupt unmasking/enablement operations. This also implicitly drops the redundant clear operation of the ejection IRQ in the interrupt handler, since nau8821_eject_jack() has been already responsible for clearing all active interrupts. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Fixes: 2551b6e89936 ("ASoC: nau8821: Add headset button detection") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-3-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:24 2025 +0300 ASoC: nau8821: Generalize helper to clear IRQ status Instead of adding yet another utility function for dealing with the interrupt clearing register, generalize nau8821_int_status_clear_all() by renaming it to nau8821_irq_status_clear(), whilst introducing a second parameter to allow restricting the operation scope to a single interrupt instead of the whole range of active IRQs. While at it, also fix a spelling typo in the comment block. Note this is mainly a prerequisite for subsequent patches aiming to address some deficiencies in the implementation of the interrupt handler. Thus the presence of the Fixes tag below is intentional, to facilitate backporting. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:23 2025 +0300 ASoC: nau8821: Cancel jdet_work before handling jack ejection The microphone detection work scheduled by a prior jack insertion interrupt may still be in a pending state or under execution when a jack ejection interrupt has been fired. This might lead to a racing condition or nau8821_jdet_work() completing after nau8821_eject_jack(), which will override the currently disconnected state of the jack and incorrectly report the headphone or the headset as being connected. Cancel any pending jdet_work or wait for its execution to finish before attempting to handle the ejection interrupt. Proceed similarly before launching the eject handler as a consequence of detecting an invalid insert interrupt. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 7e8242405b94ceac6db820de7d4fd9318cbc1219 Author: Bean Huo Date: Wed Oct 1 08:08:03 2025 +0200 rpmb: move rpmb_frame struct and constants to common header Move struct rpmb_frame and RPMB operation constants from MMC block driver to include/linux/rpmb.h for reuse across different RPMB implementations (UFS, NVMe, etc.). Signed-off-by: Bean Huo Reviewed-by: Avri Altman Acked-by: Jens Wiklander Reviewed-by: Bart Van Assche Signed-off-by: Ulf Hansson commit 518919276c4119e34e24334003af70ab12477f00 Author: Louis-Alexis Eyraud Date: Fri Oct 3 15:48:49 2025 +0200 pinctrl: mediatek: mt8189: align register base names to dt-bindings ones The mt8189-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8189_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8189-pinctrl" dt-bindings, leading to possible dtbs check issues. The mt8189_pinctrl_register_base_names entry order is also different. So, align all mt8189_pinctrl_register_base_names entry names and order on dt-bindings. Fixes: a3fe1324c3c5 ("pinctrl: mediatek: Add pinctrl driver for mt8189") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Linus Walleij commit 404ee89b4008cf2130554dac2c64cd8412601356 Author: Louis-Alexis Eyraud Date: Fri Oct 3 16:00:28 2025 +0200 pinctrl: mediatek: mt8196: align register base names to dt-bindings ones The mt8196-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8196_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8196-pinctrl" dt-bindings, leading to possible dtbs check issues. So, align all mt8196_pinctrl_register_base_names entries on dt-bindings ones. Fixes: f7a29377c253 ("pinctrl: mediatek: Add pinctrl driver on mt8196") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Linus Walleij commit 6370a996f308ea3276030769b7482b346e7cc7c1 Author: Christophe Leroy Date: Thu Oct 9 19:03:13 2025 +0200 ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec The gain ranges specified in Renesas IDT821034 codec documentation are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the receive path (DAC). Allthough the registers allow programming values outside those ranges, the signal S/N and distorsion are only guaranteed in the specified ranges. Set ranges to the specified ones. Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec") Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit 7e6cfa3e94cf8278ee3170dc0b81fc6db1287e28 Author: Baojun Xu Date: Thu Oct 2 15:29:25 2025 +0800 ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx Update ti,tas2781.yaml for adding TAS5802/TAS5815/TAS5828. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251002072925.26242-2-baojun.xu@ti.com Signed-off-by: Mark Brown commit 53a3c6e222836a23e8e0693395584aefc456dca6 Author: Baojun Xu Date: Thu Oct 2 15:29:24 2025 +0800 ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver TAS5802/TAS5815/TAS5828 has on-chip DSP without current/voltage feedback. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251002072925.26242-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit dee4ef0ebe4dee655657ead30892aeca16462823 Author: Le Qi Date: Thu Oct 9 17:06:19 2025 +0800 ASoC: qcom: sc8280xp: Add support for QCS615 Add compatible for sound card on QCS615 boards. Signed-off-by: Le Qi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251009090619.1097388-3-le.qi@oss.qualcomm.com Signed-off-by: Mark Brown commit 6079165e6e027c03e06556ff3df0ed03a34d68f0 Author: Le Qi Date: Thu Oct 9 17:06:18 2025 +0800 ASoC: dt-bindings: qcom,sm8250: Add QCS615 sound card Add bindings for QCS615 sound card, which looks fully compatible with existing SM8250. Signed-off-by: Le Qi Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251009090619.1097388-2-le.qi@oss.qualcomm.com Signed-off-by: Mark Brown commit 11fb1a82aefa6f7fea6ac82334edb5639b9927df Author: Sudeep Holla Date: Tue Sep 23 16:09:27 2025 +0100 firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor FF-A v1.2 introduced 16 byte IMPLEMENTATION DEFINED value in the endpoint memory access descriptor to allow any sender could to specify an its any custom value for each receiver. Also this value must be specified by the receiver when retrieving the memory region. The sender must ensure it informs the receiver of this value via an IMPLEMENTATION DEFINED mechanism such as a partition message. So the FF-A driver can use the message interfaces to communicate the value and set the same in the ffa_mem_region_attributes structures when using the memory interfaces. The driver ensure that the size of the endpoint memory access descriptors is set correctly based on the FF-A version. Fixes: 9fac08d9d985 ("firmware: arm_ffa: Upgrade FF-A version to v1.2 in the driver") Reported-by: Lixiang Mao Tested-by: Lixiang Mao Message-Id: <20250923150927.1218364-1-sudeep.holla@arm.com> Signed-off-by: Sudeep Holla commit 7557f189942571821a09879edfcdfdafefe4d67f Author: Kriish Sharma Date: Fri Oct 3 18:08:49 2025 +0000 binder: Fix missing kernel-doc entries in binder.c Fix several kernel-doc warnings in `drivers/android/binder.c` caused by undocumented struct members and function parameters. In particular, add missing documentation for the `@thread` parameter in binder_free_buf_locked(). Signed-off-by: Kriish Sharma Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit b5ce7a5cc50f4c283d0bfa5cc24fe864cb9a3400 Author: Alice Ryhl Date: Tue Oct 7 09:39:53 2025 +0000 rust_binder: report freeze notification only when fully frozen Binder only sends out freeze notifications when ioctl_freeze() completes and the process has become fully frozen. However, if a freeze notification is registered during the freeze operation, then it registers an initial state of 'frozen'. This is a problem because if the freeze operation fails, then the listener is not told about that state change, leading to lost updates. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit 99559e5bb4c6795824b6531ad61519c1d9500079 Author: Alice Ryhl Date: Tue Oct 7 09:39:52 2025 +0000 rust_binder: don't delete FreezeListener if there are pending duplicates When userspace issues commands to a freeze listener, it identifies it using a cookie. Normally this cookie uniquely identifies a freeze listener, but when userspace clears a listener with the intent of deleting it, it's allowed to "regret" clearing it and create a new freeze listener for the same node using the same cookie. (IMO this was an API mistake, but userspace relies on it.) Currently if the active freeze listener gets fully deleted while there are still pending duplicates, then the code incorrectly deletes the pending duplicates too. To fix this, do not delete the entry if there are still pending duplicates. Since the current data structure requires a main freeze listener, we convert one pending duplicate into the primary listener in this scenario. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit bfe144da06b002cccf314769c45ecccb69501c48 Author: Alice Ryhl Date: Tue Oct 7 09:39:51 2025 +0000 rust_binder: freeze_notif_done should resend if wrong state Consider the following scenario: 1. A freeze notification is delivered to thread 1. 2. The process becomes frozen or unfrozen. 3. The message for step 2 is delivered to thread 2 and ignored because there is already a pending notification from step 1. 4. Thread 1 acknowledges the notification from step 1. In this case, step 4 should ensure that the message ignored in step 3 is resent as it can now be delivered. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit c7c090af371775106360c9e7a7c35b718311c3f9 Author: Alice Ryhl Date: Thu Oct 2 09:25:29 2025 +0000 rust_binder: remove warning about orphan mappings This condition occurs if a thread dies while processing a transaction. We should not print anything in this scenario. Signed-off-by: Alice Ryhl Reviewed-by: Joel Fernandes Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit 7e69a24b6b35d4ffd54dd702047a01f5858b3e45 Author: Miguel Ojeda Date: Wed Sep 24 15:05:10 2025 +0200 rust_binder: clean `clippy::mem_replace_with_default` warning Clippy reports: error: replacing a value of type `T` with `T::default()` is better expressed using `core::mem::take` --> drivers/android/binder/node.rs:690:32 | 690 | _unused_capacity = mem::replace(&mut inner.freeze_list, KVVec::new()); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: consider using: `core::mem::take(&mut inner.freeze_list)` | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#mem_replace_with_default = note: `-D clippy::mem-replace-with-default` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::mem_replace_with_default)]` The suggestion seems fine, thus apply it. Signed-off-by: Miguel Ojeda Signed-off-by: Greg Kroah-Hartman commit b1aabb8ef09b4cf0cc0c92ca9dfd19482f3192c1 Author: Ma Ke Date: Tue Sep 23 09:36:03 2025 +0800 staging: gpib: Fix device reference leak in fmh_gpib driver The fmh_gpib driver contains a device reference count leak in fmh_gpib_attach_impl() where driver_find_device() increases the reference count of the device by get_device() when matching but this reference is not properly decreased. Add put_device() in fmh_gpib_detach(), which ensures that the reference count of the device is correctly managed. Found by code review. Cc: stable Fixes: 8e4841a0888c ("staging: gpib: Add Frank Mori Hess FPGA PCI GPIB driver") Signed-off-by: Ma Ke Reviewed-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit aaf2af1ed147ef49be65afb541a67255e9f60d15 Author: Dave Penkler Date: Sun Sep 28 13:33:59 2025 +0200 staging: gpib: Return -EINTR on device clear When the ATN (Attention) line is asserted during a read we get a NIUSB_ATN_STATE_ERROR during a read. For the controller to send a device clear it asserts ATN. Normally this is an error but in the case of a device clear it should be regarded as an interrupt. Return -EINTR when the Device Clear Active State (DCAS) is entered else signal an error with dev_dbg with status instead of just dev_err. Signed-off-by: Dave Penkler Cc: stable Signed-off-by: Greg Kroah-Hartman commit 92a2b74a6b5a5d9b076cd9aa75e63c6461cbd073 Author: Dave Penkler Date: Sun Sep 28 13:33:58 2025 +0200 staging: gpib: Fix sending clear and trigger events This driver was not sending device clear or trigger events when the board entered the DCAS or DTAS state respectively in device mode. DCAS is the Device Clear Active State which is entered on receiving a selective device clear message (SDC) or universal device clear message (DCL) from the controller in charge. DTAS is the Device Trigger Active State which is entered on receiving a group execute trigger (GET) message from the controller. In order for an application, implementing a particular device, to detect when one of these states is entered the driver needs to send the appropriate event. Send the appropriate gpib_event when DCAS or DTAS is set in the reported status word. This sets the DCAS or DTAS bits in the board's status word which can be monitored by the application. Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver") Cc: stable Tested-by: Dave Penkler Signed-off-by: Dave Penkler Signed-off-by: Greg Kroah-Hartman commit d3c4c1f29aadccf2f43530bfa1e60a6d8030fd4a Author: Dave Penkler Date: Sun Sep 28 11:18:18 2025 +0200 staging: gpib: Fix no EOI on 1 and 2 byte writes EOI (End Or Identify) is a hardware line on the GPIB bus that can be asserted with the last byte of a message to indicate the end of the transfer to the receiving device. In this driver, a write with send_eoi true is done in 3 parts: Send first byte directly Send remaining but 1 bytes using the fifo Send the last byte directly with EOI asserted The first byte in a write is always sent by writing to the tms9914 chip directly to setup for the subsequent fifo transfer. We were not checking for a 1 byte write with send_eoi true resulting in EOI not being asserted. Since the fifo transfer was not executed (fifotransfersize == 0) the retval in the test after the fifo transfer code was still 1 from the preceding direct write. This caused it to return without executing the final direct write which would have sent an unsollicited extra byte. For a 2 byte message the first byte was sent directly. But since the fifo transfer was not executed (fifotransfersize == 1) and the retval in the test after the fifo transfer code was still 1 from the preceding first byte write it returned before the final direct byte write with send_eoi true. The second byte was then sent as a separate 1 byte write to complete the 2 byte write count again without EOI being asserted as above. Only send the first byte directly if more than 1 byte is to be transferred with send_eoi true. Also check for retval < 0 for the error return in case the fifo code is not used (1 or 2 byte message with send_eoi true). Fixes: 09a4655ee1eb ("staging: gpib: Add HP/Agilent/Keysight 8235xx PCI GPIB driver") Cc: stable Tested-by: Dave Penkler Signed-off-by: Dave Penkler Signed-off-by: Greg Kroah-Hartman commit 66233e583d1e00b1742d1ba36ae31568109ba6bd Author: Shenghao Ding Date: Mon Oct 13 12:35:55 2025 +0800 ALSA: hda/tas2781: Set tas2781_hda::tasdevice_priv::chip_id as TAS5825 in case of tas5825 The software reset for TAS5825 is different form other chips, as it will set as 0x11 instead of 0x1 during reset in the tasdevice_reset(). So set tas2781_hda::tasdevice_priv::chip_id as TAS5825, tasdevice_reset() can work correctly. Fixes: 7ceb69ca82b1 ("ASoC: tas2781: Add tas2118, tas2x20, tas5825 support") Signed-off-by: Shenghao Ding Signed-off-by: Takashi Iwai commit e2cc390a6629c76924a2740c54b144b9b28fca59 Author: David Lechner Date: Fri Oct 10 15:24:31 2025 -0500 iio: adc: ad7124: fix temperature channel Fix temperature channel not working due to gain and offset not being initialized. For channels other than the voltage ones calibration is skipped (which is OK). However that results in the calibration register values tracked in st->channels[i].cfg all being zero. These zeros are later written to hardware before a measurement is made which caused the raw temperature readings to be always 8388608 (0x800000). To fix it, we just make sure the gain and offset values are set to the default values and still return early without doing an internal calibration. While here, add a comment explaining why we don't bother calibrating the temperature channel. Fixes: 47036a03a303 ("iio: adc: ad7124: Implement internal calibration at probe time") Reviewed-by: Marcelo Schmitt Signed-off-by: David Lechner Reviewed-by: Uwe Kleine-König Cc: Signed-off-by: Jonathan Cameron commit 21553258b94861a73d7f2cf15469d69240e1170d Author: Christophe JAILLET Date: Fri Oct 10 20:58:48 2025 +0200 iio:common:ssp_sensors: Fix an error handling path ssp_probe() If an error occurs after a successful mfd_add_devices() call, it should be undone by a corresponding mfd_remove_devices() call, as already done in the remove function. Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") Signed-off-by: Christophe JAILLET Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit bd886cdcbf9e746f61c74035a3acd42e9108e115 Author: David Lechner Date: Fri Oct 10 10:44:45 2025 -0500 iio: adc: ad7280a: fix ad7280_store_balance_timer() Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places. iio_str_to_fixpoint() has a bit of an unintuitive API where the fract_mult parameter is the multiplier of the first decimal place as if it was already an integer. So to get 3 decimal places, fract_mult must be 100 rather than 1000. Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 3db847df994d475db7812dde90376f2848bcd30a Author: Nuno Sá Date: Tue Oct 7 10:15:23 2025 +0100 iio: buffer-dmaengine: enable .get_dma_dev() Wire up the .get_dma_dev() callback to use the DMA buffer infrastructure's implementation. This ensures that DMABUF operations use the correct DMA device for mapping, which is essential for proper operation on systems where memory is mapped above the 32-bit range. Without this callback, the core would fall back to using the IIO device's parent, which may not have the appropriate DMA mask configuration for high memory access. Fixes: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API") Reviewed-by: David Lechner Signed-off-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 Author: Nuno Sá Date: Tue Oct 7 10:15:22 2025 +0100 iio: buffer-dma: support getting the DMA channel Implement the .get_dma_dev() callback for DMA buffers by returning the device that owns the DMA channel. This allows the core DMABUF infrastructure to properly map DMA buffers using the correct device, avoiding the need for bounce buffers on systems where memory is mapped above the 32-bit range. The function returns the DMA queue's device, which is the actual device responsible for DMA operations in buffer-dma implementations. Cc: stable@vger.kernel.org Reviewed-by: David Lechner Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron commit a514bb109eada64f798f1c86c17182229cc20fe7 Author: Nuno Sá Date: Tue Oct 7 10:15:21 2025 +0100 iio: buffer: support getting dma channel from the buffer Add a new buffer accessor .get_dma_dev() in order to get the struct device responsible for actually providing the dma channel. We cannot assume that we can use the parent of the IIO device for mapping the DMA buffer. This becomes important on systems (like the Xilinx/AMD zynqMP Ultrascale) where memory (or part of it) is mapped above the 32 bit range. On such systems and given that a device by default has a dma mask of 32 bits we would then need to rely on bounce buffers (to swiotlb) for mapping memory above the dma mask limit. In the process, add an iio_buffer_get_dma_dev() helper function to get the proper DMA device. Cc: stable@vger.kernel.org Reviewed-by: David Lechner Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 0bf1bfde53b30da7fd7f4a6c3db5b8e77888958d Author: Achim Gratz Date: Sun Sep 28 19:26:28 2025 +0200 iio: pressure: bmp280: correct meas_time_us calculation Correction of meas_time_us initialization based on an observation and partial patch by David Lechner. The constant part of the measurement time (as described in the datasheet and implemented in the BM(P/E)2 Sensor API) was apparently forgotten (it was already correctly applied for the BMP380) and is now used. There was also another thinko in bmp280_wait_conv: data->oversampling_humid can actually have a value of 0 (for an oversampling_ratio of 1), so it can not be used to detect the presence of the humidity measurement capability. Use data->chip_info->oversampling_humid_avail instead, which is NULL for chips that cannot measure humidity and therefore must skip that part of the calculation. Closes: https://lore.kernel.org/linux-iio/875xgfg0wz.fsf@Gerda.invalid/ Fixes: 26ccfaa9ddaa ("iio: pressure: bmp280: Use sleep and forced mode for oneshot captures") Suggested-by: David Lechner Tested-by: Achim Gratz Signed-off-by: Achim Gratz Cc: Signed-off-by: Jonathan Cameron commit 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de Author: Olivier Moysan Date: Thu Oct 2 13:22:49 2025 +0200 iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling Initially st,adc-alt-channel property was defined as an enum in the DFSDM binding. The DFSDM binding has been changed to use the new IIO backend framework, along with the adoption of IIO generic channels. In this new binding st,adc-alt-channel is defined as a boolean property, but it is still handled has an enum in DFSDM driver. Fix st,adc-alt-channel property handling in DFSDM driver. Fixes: 3208fa0cd919 ("iio: adc: stm32-dfsdm: adopt generic channels bindings") Signed-off-by: Olivier Moysan Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 632757312d7eb320b66ca60e0cfe098ec53cee08 Author: David Lechner Date: Fri Sep 19 15:50:34 2025 -0500 iio: adc: ad7380: fix SPI offload trigger rate Add a special case to double the SPI offload trigger rate when all channels of a single-ended chip are enabled in a buffered read. The single-ended chips in the AD738x family can only do simultaneous sampling of half their channels and have a multiplexer to allow reading the other half. To comply with the IIO definition of sampling_frequency, we need to trigger twice as often when the sequencer is enabled to so that both banks can be read in a single sample period. Fixes: bbeaec81a03e ("iio: ad7380: add support for SPI offload") Signed-off-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 9b45744bf09fc2a3287e05287141d6e123c125a7 Author: ChiYuan Huang Date: Thu Sep 18 11:10:59 2025 +0800 iio: adc: rtq6056: Correct the sign bit index The vshunt/current reported register is a signed 16bit integer. The sign bit index should be '15', not '16'. Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support") Reported-by: Andy Hsu Signed-off-by: ChiYuan Huang Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit ffc74ad539136ae9e16f7b5f2e4582e88018cd49 Author: Marcelo Schmitt Date: Thu Sep 18 14:37:27 2025 -0300 iio: adc: ad4030: Fix _scale value for common-mode channels Previously, the driver always used the amount of precision bits of differential input channels to provide the scale to mV. Though, differential and common-mode voltage channels have different amount of precision bits and the correct number of precision bits must be considered to get to a proper mV scale factor for each one. Use channel specific number of precision bits to provide the correct scale value for each channel. Fixes: de67f28abe58 ("iio: adc: ad4030: check scan_type for error") Fixes: 949abd1ca5a4 ("iio: adc: ad4030: add averaging support") Signed-off-by: Marcelo Schmitt Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 51cb04abd39097209b871e95ffa7e8584ce7dcba Author: Krishna Kurapati Date: Mon Oct 13 09:29:20 2025 +0530 dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100 Add the missing multiport controller binding to target list. Fix minItems for interrupt-names to avoid the following error on High Speed controller: usb@a200000: interrupt-names: ['dwc_usb3', 'pwr_event', 'dp_hs_phy_irq', 'dm_hs_phy_irq'] is too short Fixes: 6e762f7b8edc ("dt-bindings: usb: Introduce qcom,snps-dwc3") Cc: stable@vger.kernel.org Signed-off-by: Krishna Kurapati Reviewed-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman commit dddc0f71485f1f29f236e387632181bcc09019a0 Author: Peter Robinson Date: Mon Oct 6 22:39:52 2025 +0100 usb: misc: Add x86 dependency for Intel USBIO driver The Intel USBIO driver is x86 only, other architectures have ACPI so add an appropriate depenecy plus compile test. Fixes: 121a0f839dbb3 ("usb: misc: Add Intel USBIO bridge driver") Signed-off-by: Peter Robinson Reviewed-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit bd8c3ce6d7a205b3ba3ef9815db4c6932290ec59 Author: Neil Armstrong Date: Tue Sep 30 19:17:21 2025 +0200 dt-bindings: usb: switch: split out ports definition The ports definition currently defined in the usb-switch.yaml fits standards devices which are either recipient of altmode muxing and orientation switching events or an element of the USB Super Speed data lanes. This doesn't necessarely fit combo PHYs like the Qualcomm USB3/DP Combo which has a different ports representation. Move the ports definition to a separate usb-switch-ports.yaml and reference it next to the usb-switch.yaml, except for the Qualcomm USB3/DP Combo PHY bindings. Reported-by: Rob Herring Closes: https://lore.kernel.org/all/175462129176.394940.16810637795278334342.robh@kernel.org/ Fixes: 3bad7fe22796 ("dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp: Reference usb-switch.yaml to allow mode-switch") Signed-off-by: Neil Armstrong Reviewed-by: Rob Herring (Arm) Signed-off-by: Greg Kroah-Hartman commit 2758246d287549e1088eae350654160cbf4d424f Author: Christophe JAILLET Date: Mon Sep 29 20:28:50 2025 +0200 usb: dwc3: Don't call clk_bulk_disable_unprepare() twice devm_clk_bulk_get_all_enabled() is used in the probe, so clk_bulk_disable_unprepare() should not be called explicitly in the remove function. Fixes: e0b6dc00c701 ("usb: dwc3: add generic driver to support flattened") Signed-off-by: Christophe JAILLET Acked-by: Thinh Nguyen Signed-off-by: Greg Kroah-Hartman commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c Author: Xu Yang Date: Fri Sep 19 14:25:34 2025 +0800 dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp Only i.MX8MP need dma-range property to let USB controller work properly. Remove dma-range from required list and add limitation for imx8mp. Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Greg Kroah-Hartman commit 5ec6f9434225e18496a393f920b03eb46d67d71d Author: Takashi Iwai Date: Mon Oct 13 09:26:49 2025 +0200 ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6 HP ZBook 17 G6 with SSID 103c:860c requires a similar workaround as its 15-inch model in order to make the speaker and mute LED working. Add the corresponding quirk entry to address it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220372 Cc: Signed-off-by: Takashi Iwai commit 12d724f2852d094d68dccaf5101e0ef89a971cde Author: Damien Le Moal Date: Thu Oct 9 19:46:00 2025 +0900 ata: libata-core: relax checks in ata_read_log_directory() Commit 6d4405b16d37 ("ata: libata-core: Cache the general purpose log directory") introduced caching of a device general purpose log directory to avoid repeated access to this log page during device scan. This change also added a check on this log page to verify that the log page version is 0x0001 as mandated by the ACS specifications. And it turns out that some devices do not bother reporting this version, instead reporting a version 0, resulting in error messages such as: ata6.00: Invalid log directory version 0x0000 and to the device being marked as not supporting the general purpose log directory log page. Since before commit 6d4405b16d37 the log page version check did not exist and things were still working correctly for these devices, relax ata_read_log_directory() version check and only warn about the invalid log page version number without disabling access to the log directory page. Fixes: 6d4405b16d37 ("ata: libata-core: Cache the general purpose log directory") Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220635 Signed-off-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 109ff654934a4752f8875ded672efd1fbfe4d31d Author: Dharma Balasubiramani Date: Mon Oct 6 16:21:50 2025 +0530 counter: microchip-tcb-capture: Allow shared IRQ for multi-channel TCBs Mark the interrupt as IRQF_SHARED to permit multiple counter channels to share the same TCB IRQ line. Each Timer/Counter Block (TCB) instance shares a single IRQ line among its three internal channels. When multiple counter channels (e.g., counter@0 and counter@1) within the same TCB are enabled, the second call to devm_request_irq() fails because the IRQ line is already requested by the first channel. Cc: stable@vger.kernel.org Fixes: e5d581396821 ("counter: microchip-tcb-capture: Add IRQ handling") Signed-off-by: Dharma Balasubiramani Reviewed-by: Kamel Bouhara Reviewed-by: Bence Csókás Link: https://lore.kernel.org/r/20251006-microchip-tcb-v1-1-09c19181bb4a@microchip.com Signed-off-by: William Breathitt Gray commit 0843ba458439f38efdc14aa359c14ad0127edb01 Author: Sourabh Jain Date: Wed Oct 8 08:59:34 2025 +0530 powerpc/fadump: skip parameter area allocation when fadump is disabled Fadump allocates memory to pass additional kernel command-line argument to the fadump kernel. However, this allocation is not needed when fadump is disabled. So avoid allocating memory for the additional parameter area in such cases. Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") Reviewed-by: Hari Bathini Signed-off-by: Sourabh Jain Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251008032934.262683-1-sourabhjain@linux.ibm.com commit 2743cf75f7c92d2a0a4acabd7aef1c17d98fe123 Author: Nam Cao Date: Wed Oct 8 08:13:59 2025 +0000 powerpc, ocxl: Fix extraction of struct xive_irq_data Commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers") changed xive_irq_data to be stashed to chip_data instead of handler_data. However, multiple places are still attempting to read xive_irq_data from handler_data and get a NULL pointer deference bug. Update them to read xive_irq_data from chip_data. Non-XIVE files which touch xive_irq_data seem quite strange to me, especially the ocxl driver. I think there ought to be an alternative platform-independent solution, instead of touching XIVE's data directly. Therefore, I think this whole thing should be cleaned up. But perhaps I just misunderstand something. In any case, this cleanup would not be trivial; for now, just get things working again. Fixes: cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers") Reported-by: Ritesh Harjani (IBM) Closes: https://lore.kernel.org/linuxppc-dev/68e48df8.170a0220.4b4b0.217d@mx.google.com/ Signed-off-by: Nam Cao Reviewed-by: Ganesh Goudar Acked-by: Andrew Donnellan # ocxl Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251008081359.1382699-1-namcao@linutronix.de commit ef3e73a917ec7d080e0fb0e4015098a4fb0f1cff Author: Nam Cao Date: Fri Oct 10 12:03:07 2025 +0000 powerpc/pseries/msi: Fix NULL pointer dereference at irq domain teardown pseries_msi_ops_teardown() reads pci_dev* from msi_alloc_info_t. However, pseries_msi_ops_prepare() does not populate this structure, thus it is all zeros. Consequently, pseries_msi_ops_teardown() triggers a NULL pointer dereference crash. struct pci_dev is available in struct irq_domain. Read it there instead. Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/linuxppc-dev/878d7651-433a-46fe-a28b-1b7e893fcbe0@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote Signed-off-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251010120307.3281720-1-namcao@linutronix.de commit 39dec6cd888bde4171bd4b8fcf45f73ab684404d Author: Markus Elfring Date: Wed Oct 1 21:09:00 2025 +0200 smb: server: Use common error handling code in smb_direct_rdma_xmit() Add two jump targets so that a bit of exception handling can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Reviewed-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 Author: Nicolas Dichtel Date: Fri Oct 10 16:18:59 2025 +0200 doc: fix seg6_flowlabel path This sysctl is not per interface; it's global per netns. Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") Reported-by: Philippe Guibert Signed-off-by: Nicolas Dichtel Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3a8660878839faadb4f1a6dd72c3179c1df56787 Author: Linus Torvalds Date: Sun Oct 12 13:42:36 2025 -0700 Linux 6.18-rc1 commit 3dd7b8123544402be76bea82af43d2de4b9226d8 Merge: 8765f467912ff0 a8482d2c9071d7 Author: Linus Torvalds Date: Sun Oct 12 13:27:56 2025 -0700 Merge tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "One revert because of a regression in the I2C core which has sadly not showed up during its time in -next" * tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: Revert "i2c: boardinfo: Annotate code used in init phase only" commit 68a052239fc4b351e961f698b824f7654a346091 Author: Jakub Kicinski Date: Thu Oct 9 13:56:29 2025 -0700 selftests: drv-net: update remaining Python init files Convert remaining __init__ files similar to what we did in commit b615879dbfea ("selftests: drv-net: make linters happy with our imports") Signed-off-by: Jakub Kicinski Signed-off-by: Stanislav Fomichev Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 Author: Yeounsu Moon Date: Fri Oct 10 00:57:16 2025 +0900 net: dlink: handle dma_map_single() failure properly There is no error handling for `dma_map_single()` failures. Add error handling by checking `dma_mapping_error()` and freeing the `skb` using `dev_kfree_skb()` (process context) when it fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yeounsu Moon Tested-on: D-Link DGE-550T Rev-A3 Suggested-by: Simon Horman Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3abc0e55ea1fa2250e52bc860e8f24b2b9a2093a Author: Rex Lu Date: Thu Oct 9 08:29:34 2025 +0200 net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with more than 4GB DRAM Limit tx/rx buffer address to 32-bit address space for board with more than 4GB DRAM. Fixes: 804775dfc2885 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") Fixes: 6757d345dd7db ("net: ethernet: mtk_wed: introduce hw_rro support for MT7988") Tested-by: Daniel Pawlik Tested-by: Matteo Croce Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit d5d790ba1558dbb8d179054f514476e2ee970b8e Author: Bhanu Seshu Kumar Valluri Date: Thu Oct 9 11:00:09 2025 +0530 net: usb: lan78xx: Fix lost EEPROM write timeout error(-ETIMEDOUT) in lan78xx_write_raw_eeprom The function lan78xx_write_raw_eeprom failed to properly propagate EEPROM write timeout errors (-ETIMEDOUT). In the timeout fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error saved in ret. As a result, callers could mistakenly treat EEPROM write operation as successful even though the EEPROM write had actually timed out with no or partial data write. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM write timeout error saved in ret to the caller. Suggested-by: Oleksij Rempel Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") cc: stable@vger.kernel.org Signed-off-by: Bhanu Seshu Kumar Valluri Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8765f467912ff0d4832eeaf26ae573792da877e7 Merge: 67029a49db6c1f f75e07bf5226da Author: Linus Torvalds Date: Sun Oct 12 08:45:52 2025 -0700 Merge tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Skip interrupt ID 0 in sifive-plic during suspend/resume because ID 0 is reserved and accessing reserved register space could result in undefined behavior - Fix a function's retval check in aspeed-scu-ic * tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume irqchip/aspeed-scu-ic: Fix an IS_ERR() vs NULL check commit 67029a49db6c1f21106a1b5fcdd0ea234a6e0711 Merge: c04022dccb2f9c 54b91e54b113d4 Author: Linus Torvalds Date: Sat Oct 11 16:06:04 2025 -0700 Merge tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "The previous fix to trace_marker required updating trace_marker_raw as well. The difference between trace_marker_raw from trace_marker is that the raw version is for applications to write binary structures directly into the ring buffer instead of writing ASCII strings. This is for applications that will read the raw data from the ring buffer and get the data structures directly. It's a bit quicker than using the ASCII version. Unfortunately, it appears that our test suite has several tests that test writes to the trace_marker file, but lacks any tests to the trace_marker_raw file (this needs to be remedied). Two issues came about the update to the trace_marker_raw file that syzbot found: - Fix tracing_mark_raw_write() to use per CPU buffer The fix to use the per CPU buffer to copy from user space was needed for both the trace_maker and trace_maker_raw file. The fix for reading from user space into per CPU buffers properly fixed the trace_marker write function, but the trace_marker_raw file wasn't fixed properly. The user space data was correctly written into the per CPU buffer, but the code that wrote into the ring buffer still used the user space pointer and not the per CPU buffer that had the user space data already written. - Stop the fortify string warning from writing into trace_marker_raw After converting the copy_from_user_nofault() into a memcpy(), another issue appeared. As writes to the trace_marker_raw expects binary data, the first entry is a 4 byte identifier. The entry structure is defined as: struct { struct trace_entry ent; int id; char buf[]; }; The size of this structure is reserved on the ring buffer with: size = sizeof(*entry) + cnt; Then it is copied from the buffer into the ring buffer with: memcpy(&entry->id, buf, cnt); This use to be a copy_from_user_nofault(), but now converting it to a memcpy() triggers the fortify-string code, and causes a warning. The allocated space is actually more than what is copied, as the cnt used also includes the entry->id portion. Allocating sizeof(*entry) plus cnt is actually allocating 4 bytes more than what is needed. Change the size function to: size = struct_size(entry, buf, cnt - sizeof(entry->id)); And update the memcpy() to unsafe_memcpy()" * tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Stop fortify-string from warning in tracing_mark_raw_write() tracing: Fix tracing_mark_raw_write() to use buf and not ubuf commit c04022dccb2f9cf2b1cfe65807149500d1fc080a Merge: 98906f9d850e48 b0f2942a16017f Author: Linus Torvalds Date: Sat Oct 11 15:47:12 2025 -0700 Merge tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix UAPI types check in headers_check.pl - Only enable -Werror for hostprogs with CONFIG_WERROR / W=e - Ignore fsync() error when output of gen_init_cpio is a pipe - Several little build fixes for recent modules.builtin.modinfo series * tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Use '--strip-unneeded-symbol' for removing module device table symbols s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections kbuild: Add '.rel.*' strip pattern for vmlinux kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux gen_init_cpio: Ignore fsync() returning EINVAL on pipes scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs kbuild: uapi: Strip comments before size type check commit a8482d2c9071d75c920eba0db36428898250ea57 Author: Wolfram Sang Date: Sat Oct 11 12:31:53 2025 +0200 Revert "i2c: boardinfo: Annotate code used in init phase only" This reverts commit 1a2b423be6a89dd07d5fc27ea042be68697a6a49 because we got a regression report and need time to find out the details. Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/r/29ec0082-4dd4-4120-acd2-44b35b4b9487@oss.qualcomm.com Signed-off-by: Wolfram Sang commit 98906f9d850e4882004749eccb8920649dc98456 Merge: 2a6edd867b155c 9db26d5855d037 Author: Linus Torvalds Date: Sat Oct 11 11:56:47 2025 -0700 Merge tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "This cycle, we have a new RTC driver, for the SpacemiT P1. The optee driver gets alarm support. We also get a fix for a race condition that was fairly rare unless while stress testing the alarms. Subsystem: - Fix race when setting alarm - Ensure alarm irq is enabled when UIE is enabled - remove unneeded 'fast_io' parameter in regmap_config New driver: - SpacemiT P1 RTC Drivers: - efi: Remove wakeup functionality - optee: add alarms support - s3c: Drop support for S3C2410 - zynqmp: Restore alarm functionality after kexec transition" * tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (29 commits) rtc: interface: Ensure alarm irq is enabled when UIE is enabled rtc: tps6586x: Fix initial enable_irq/disable_irq balance rtc: cpcap: Fix initial enable_irq/disable_irq balance rtc: isl12022: Fix initial enable_irq/disable_irq balance rtc: interface: Fix long-standing race when setting alarm rtc: pcf2127: fix watchdog interrupt mask on pcf2131 rtc: zynqmp: Restore alarm functionality after kexec transition rtc: amlogic-a4: Optimize global variables rtc: sd2405al: Add I2C address. rtc: Kconfig: move symbols to proper section rtc: optee: make optee_rtc_pm_ops static rtc: optee: Fix error code in optee_rtc_read_alarm() rtc: optee: fix error code in probe() dt-bindings: rtc: Convert apm,xgene-rtc to DT schema rtc: spacemit: support the SpacemiT P1 RTC rtc: optee: add alarm related rtc ops to optee rtc driver rtc: optee: remove unnecessary memory operations rtc: optee: fix memory leak on driver removal rtc: x1205: Fix Xicor X1205 vendor prefix dt-bindings: rtc: Fix Xicor X1205 vendor prefix ... commit 2a6edd867b155cb5c391a32a66ce7e5d2cdcb531 Merge: 9591fdb0611dcc 558ae4579810fa Author: Linus Torvalds Date: Sat Oct 11 11:49:00 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Fixes only in drivers (ufs, mvsas, qla2xxx, target) that came in just before or during the merge window. The most important one is the qla2xxx which reverts a conversion to fix flexible array member warnings, that went up in this merge window but which turned out on further testing to be causing data corruption" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS scsi: ufs: sysfs: Make HID attributes visible scsi: mvsas: Fix use-after-free bugs in mvs_work_queue scsi: ufs: core: Fix PM QoS mutex initialization scsi: ufs: core: Fix runtime suspend error deadlock Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue" scsi: target: target_core_configfs: Add length check to avoid buffer overflow commit 9591fdb0611dccdeeeeacb99d89f0098737d209b Merge: 2f0a7504530c24 4a1e02b15ac174 Author: Linus Torvalds Date: Sat Oct 11 11:19:16 2025 -0700 Merge tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull more x86 updates from Borislav Petkov: - Remove a bunch of asm implementing condition flags testing in KVM's emulator in favor of int3_emulate_jcc() which is written in C - Replace KVM fastops with C-based stubs which avoids problems with the fastop infra related to latter not adhering to the C ABI due to their special calling convention and, more importantly, bypassing compiler control-flow integrity checking because they're written in asm - Remove wrongly used static branches and other ugliness accumulated over time in hyperv's hypercall implementation with a proper static function call to the correct hypervisor call variant - Add some fixes and modifications to allow running FRED-enabled kernels in KVM even on non-FRED hardware - Add kCFI improvements like validating indirect calls and prepare for enabling kCFI with GCC. Add cmdline params documentation and other code cleanups - Use the single-byte 0xd6 insn as the official #UD single-byte undefined opcode instruction as agreed upon by both x86 vendors - Other smaller cleanups and touchups all over the place * tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) x86,retpoline: Optimize patch_retpoline() x86,ibt: Use UDB instead of 0xEA x86/cfi: Remove __noinitretpoline and __noretpoline x86/cfi: Add "debug" option to "cfi=" bootparam x86/cfi: Standardize on common "CFI:" prefix for CFI reports x86/cfi: Document the "cfi=" bootparam options x86/traps: Clarify KCFI instruction layout compiler_types.h: Move __nocfi out of compiler-specific header objtool: Validate kCFI calls x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y x86/fred: Play nice with invoking asm_fred_entry_from_kvm() on non-FRED hardware x86/fred: Install system vector handlers even if FRED isn't fully enabled x86/hyperv: Use direct call to hypercall-page x86/hyperv: Clean up hv_do_hypercall() KVM: x86: Remove fastops KVM: x86: Convert em_salc() to C KVM: x86: Introduce EM_ASM_3WCL KVM: x86: Introduce EM_ASM_1SRC2 KVM: x86: Introduce EM_ASM_2CL KVM: x86: Introduce EM_ASM_2W ... commit 2f0a7504530c24f55daec7d2364d933bb1a1fa68 Merge: 6bb71f0fe57bb7 c6c973dbfa5e34 Author: Linus Torvalds Date: Sat Oct 11 10:51:14 2025 -0700 Merge tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - Simplify inline asm flag output operands now that the minimum compiler version supports the =@ccCOND syntax - Remove a bunch of AS_* Kconfig symbols which detect assembler support for various instruction mnemonics now that the minimum assembler version supports them all - The usual cleanups all over the place * tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/asm: Remove code depending on __GCC_ASM_FLAG_OUTPUTS__ x86/sgx: Use ENCLS mnemonic in x86/mtrr: Remove license boilerplate text with bad FSF address x86/asm: Use RDPKRU and WRPKRU mnemonics in x86/idle: Use MONITORX and MWAITX mnemonics in x86/entry/fred: Push __KERNEL_CS directly x86/kconfig: Remove CONFIG_AS_AVX512 crypto: x86 - Remove CONFIG_AS_VPCLMULQDQ crypto: X86 - Remove CONFIG_AS_VAES crypto: x86 - Remove CONFIG_AS_GFNI x86/kconfig: Drop unused and needless config X86_64_SMP commit 6bb71f0fe57bb77ca484352a66aeb02e3a8ce697 Merge: fbde105f132f30 fd6db58867924d Author: Linus Torvalds Date: Sat Oct 11 10:40:24 2025 -0700 Merge tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "A NULL pointer deref hotfix" * tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: fix barn NULL pointer dereference on memoryless nodes commit fbde105f132f30aff25f3acb1c287e95d5452c9c Merge: ae13bd23102805 ffce84bccb4d95 Author: Linus Torvalds Date: Sat Oct 11 10:31:38 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Finish constification of 1st parameter of bpf_d_path() (Rong Tao) - Harden userspace-supplied xdp_desc validation (Alexander Lobakin) - Fix metadata_dst leak in __bpf_redirect_neigh_v{4,6}() (Daniel Borkmann) - Fix undefined behavior in {get,put}_unaligned_be32() (Eric Biggers) - Use correct context to unpin bpf hash map with special types (KaFai Wan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add test for unpinning htab with internal timer struct bpf: Avoid RCU context warning when unpinning htab with internal structs xsk: Harden userspace-supplied xdp_desc validation bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} libbpf: Fix undefined behavior in {get,put}_unaligned_be32() bpf: Finish constification of 1st parameter of bpf_d_path() commit ae13bd23102805383bf04f26e0b043f3d02c9b15 Merge: 971370a88c3b1b 90eb9ae35727a6 Author: Linus Torvalds Date: Sat Oct 11 10:27:52 2025 -0700 Merge tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more updates from Andrew Morton: "Just one series here - Mike Rappoport has taught KEXEC handover to preserve vmalloc allocations across handover" * tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt kho: add support for preserving vmalloc allocations kho: replace kho_preserve_phys() with kho_preserve_pages() kho: check if kho is finalized in __kho_preserve_order() MAINTAINERS, .mailmap: update Umang's email address commit 971370a88c3b1be1144c11468b4c84e3ed17af6d Merge: 0739473694c487 f52ce0ea90c83a Author: Linus Torvalds Date: Sat Oct 11 10:14:55 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "7 hotfixes. All 7 are cc:stable and all 7 are for MM. All singletons, please see the changelogs for details" * tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: hugetlb: avoid soft lockup when mprotect to large memory area fsnotify: pass correct offset to fsnotify_mmap_perm() mm/ksm: fix flag-dropping behavior in ksm_madvise mm/damon/vaddr: do not repeat pte_offset_map_lock() until success mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage mm/thp: fix MTE tag mismatch when replacing zero-filled subpages memcg: skip cgroup_file_notify if spinning is not allowed commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 Author: Marek Vasut Date: Sat Oct 11 12:59:53 2025 +0200 drm/bridge: lt9211: Drop check for last nibble of version register There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the driver checks for right now. Since there is a possibility there will be yet another revision of the LT9211 in the future, drop the last version nibble check to allow all future revisions of the chip to work with this driver. This fix makes LT9211 rev. U5 work with this driver. Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") Signed-off-by: Marek Vasut Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org Signed-off-by: Dmitry Baryshkov commit 54b91e54b113d4f15ab023a44f508251db6e22e7 Author: Steven Rostedt Date: Sat Oct 11 11:20:32 2025 -0400 tracing: Stop fortify-string from warning in tracing_mark_raw_write() The way tracing_mark_raw_write() records its data is that it has the following structure: struct { struct trace_entry; int id; char buf[]; }; But memcpy(&entry->id, buf, size) triggers the following warning when the size is greater than the id: ------------[ cut here ]------------ memcpy: detected field-spanning write (size 6) of single field "&entry->id" at kernel/trace/trace.c:7458 (size 4) WARNING: CPU: 7 PID: 995 at kernel/trace/trace.c:7458 write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0 Modules linked in: CPU: 7 UID: 0 PID: 995 Comm: bash Not tainted 6.17.0-test-00007-g60b82183e78a-dirty #211 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0 Code: 04 00 75 a7 b9 04 00 00 00 48 89 de 48 89 04 24 48 c7 c2 e0 b1 d1 b2 48 c7 c7 40 b2 d1 b2 c6 05 2d 88 6a 04 01 e8 f7 e8 bd ff <0f> 0b 48 8b 04 24 e9 76 ff ff ff 49 8d 7c 24 04 49 8d 5c 24 08 48 RSP: 0018:ffff888104c3fc78 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 1ffffffff6b363b4 RDI: 0000000000000001 RBP: ffff888100058a00 R08: ffffffffb041d459 R09: ffffed1020987f40 R10: 0000000000000007 R11: 0000000000000001 R12: ffff888100bb9010 R13: 0000000000000000 R14: 00000000000003e3 R15: ffff888134800000 FS: 00007fa61d286740(0000) GS:ffff888286cad000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560d28d509f1 CR3: 00000001047a4006 CR4: 0000000000172ef0 Call Trace: tracing_mark_raw_write+0x1fe/0x290 ? __pfx_tracing_mark_raw_write+0x10/0x10 ? security_file_permission+0x50/0xf0 ? rw_verify_area+0x6f/0x4b0 vfs_write+0x1d8/0xdd0 ? __pfx_vfs_write+0x10/0x10 ? __pfx_css_rstat_updated+0x10/0x10 ? count_memcg_events+0xd9/0x410 ? fdget_pos+0x53/0x5e0 ksys_write+0x182/0x200 ? __pfx_ksys_write+0x10/0x10 ? do_user_addr_fault+0x4af/0xa30 do_syscall_64+0x63/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa61d318687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd87fe0120 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa61d286740 RCX: 00007fa61d318687 RDX: 0000000000000006 RSI: 0000560d28d509f0 RDI: 0000000000000001 RBP: 0000560d28d509f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000006 R13: 00007fa61d4715c0 R14: 00007fa61d46ee80 R15: 0000000000000000 ---[ end trace 0000000000000000 ]--- This is because fortify string sees that the size of entry->id is only 4 bytes, but it is writing more than that. But this is OK as the dynamic_array is allocated to handle that copy. The size allocated on the ring buffer was actually a bit too big: size = sizeof(*entry) + cnt; But cnt includes the 'id' and the buffer data, so adding cnt to the size of *entry actually allocates too much on the ring buffer. Change the allocation to: size = struct_size(entry, buf, cnt - sizeof(entry->id)); and the memcpy() to unsafe_memcpy() with an added justification. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20251011112032.77be18e4@gandalf.local.home Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) commit 77908b81766781dfcd086878aefc29f5db8dae6a Author: Cryolitia PukNgae Date: Sat Oct 11 17:51:18 2025 +0800 ALSA: usb-audio: apply quirk for Huawei Technologies Co., Ltd. CM-Q3 There're several different actual hardwares sold by Huawei, using the same USB ID 12d1:3a07. The first one we found, having a volume control named "Headset Playback Volume", reports a min value -15360, and will mute iff setting it to -15360. It can be simply fixed by quirk flag MIXER_PLAYBACK_MIN_MUTE, which we have already submitted previously.[1] The second one we found today, having a volume control named "PCM Playback Volume", reports its min -11520 and res 256, and will mute when less than -11008. Because of the already existing quirk flag, we can just set its min to -11264, and the new minimum value will still not be available to userspace, so that userspace's minimum will be the correct -11008. 1. https://lore.kernel.org/all/20250903-sound-v1-3-d4ca777b8512@uniontech.com/ Tested-by: Guoli An Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit fd6db58867924d2bfbc4ece4b0092f697f9fc31c Author: Vlastimil Babka Date: Sat Oct 11 10:45:41 2025 +0200 slab: fix barn NULL pointer dereference on memoryless nodes Phil reported a boot failure once sheaves become used in commits 59faa4da7cd4 ("maple_tree: use percpu sheaves for maple_node_cache") and 3accabda4da1 ("mm, vma: use percpu sheaves for vm_area_struct cache"): BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 21 UID: 0 PID: 818 Comm: kworker/u398:0 Not tainted 6.17.0-rc3.slab+ #5 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.26.0 07/30/2025 RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0 Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 <4c> 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89 RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300 RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388 R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0 R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0 FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0 Call Trace: ? srso_return_thunk+0x5/0x5f ? vm_area_alloc+0x1e/0x60 kmem_cache_alloc_noprof+0x4ec/0x5b0 vm_area_alloc+0x1e/0x60 create_init_stack_vma+0x26/0x210 alloc_bprm+0x139/0x200 kernel_execve+0x4a/0x140 call_usermodehelper_exec_async+0xd0/0x190 ? __pfx_call_usermodehelper_exec_async+0x10/0x10 ret_from_fork+0xf0/0x110 ? __pfx_call_usermodehelper_exec_async+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Modules linked in: CR2: 0000000000000040 ---[ end trace 0000000000000000 ]--- RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0 Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 <4c> 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89 RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300 RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388 R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0 R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0 FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x36a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- And noted "this is an AMD EPYC 7401 with 8 NUMA nodes configured such that memory is only on 2 of them." # numactl --hardware available: 8 nodes (0-7) node 0 cpus: 0 8 16 24 32 40 48 56 64 72 80 88 node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 2 10 18 26 34 42 50 58 66 74 82 90 node 1 size: 31584 MB node 1 free: 30397 MB node 2 cpus: 4 12 20 28 36 44 52 60 68 76 84 92 node 2 size: 0 MB node 2 free: 0 MB node 3 cpus: 6 14 22 30 38 46 54 62 70 78 86 94 node 3 size: 0 MB node 3 free: 0 MB node 4 cpus: 1 9 17 25 33 41 49 57 65 73 81 89 node 4 size: 0 MB node 4 free: 0 MB node 5 cpus: 3 11 19 27 35 43 51 59 67 75 83 91 node 5 size: 32214 MB node 5 free: 31625 MB node 6 cpus: 5 13 21 29 37 45 53 61 69 77 85 93 node 6 size: 0 MB node 6 free: 0 MB node 7 cpus: 7 15 23 31 39 47 55 63 71 79 87 95 node 7 size: 0 MB node 7 free: 0 MB Linus decoded the stacktrace to get_barn() and get_node() and determined that kmem_cache->node[numa_mem_id()] is NULL. The problem is due to a wrong assumption that memoryless nodes only exist on systems with CONFIG_HAVE_MEMORYLESS_NODES, where numa_mem_id() points to the nearest node that has memory. SLUB has been allocating its kmem_cache_node structures only on nodes with memory and so it does with struct node_barn. For kmem_cache_node, get_partial_node() checks if get_node() result is not NULL, which I assumed was for protection from a bogus node id passed to kmalloc_node() but apparently it's also for systems where numa_mem_id() (used when no specific node is given) might return a memoryless node. Fix the sheaves code the same way by checking the result of get_node() and bailing out if it's NULL. Note that cpus on such memoryless nodes will have degraded sheaves performance, which can be improved later, preferably by making numa_mem_id() work properly on such systems. Fixes: 2d517aa09bbc ("slab: add opt-in caching layer of percpu sheaves") Reported-and-tested-by: Phil Auld Closes: https://lore.kernel.org/all/20251010151116.GA436967@pauld.westford.csb/ Analyzed-by: Linus Torvalds Link: https://lore.kernel.org/all/CAHk-%3Dwg1xK%2BBr%3DFJ5QipVhzCvq7uQVPt5Prze6HDhQQ%3DQD_BcQ@mail.gmail.com/ Signed-off-by: Vlastimil Babka commit 30b3211aa24161856134b2c2ea2ab1c6eb534b36 Author: Stuart Hayhurst Date: Sat Oct 11 00:28:29 2025 +0100 ALSA: hda/intel: Add MSI X870E Tomahawk to denylist This motherboard uses USB audio instead, causing this driver to complain about "no codecs found!". Add it to the denylist to silence the warning. Signed-off-by: Stuart Hayhurst Cc: Signed-off-by: Takashi Iwai commit 1cf11d80db5df805b538c942269e05a65bcaf5bc Author: Denis Arefev Date: Thu Oct 9 13:50:47 2025 +0300 ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced. The call stack leading to the error looks like this: hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference Add IS_ERR() check to prevent the crash. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ae7abe36e352 ("ALSA: hda/realtek: Add CS35L41 support for Thinkpad laptops") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Signed-off-by: Takashi Iwai commit 8527bbb33936340525a3504a00932b2f8fd75754 Author: Denis Arefev Date: Tue Oct 7 10:38:31 2025 +0300 ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 447106e92a0c ("ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Signed-off-by: Takashi Iwai commit bda745ee8fbb63330d8f2f2ea4157229a5df959e Author: Steven Rostedt Date: Fri Oct 10 23:51:42 2025 -0400 tracing: Fix tracing_mark_raw_write() to use buf and not ubuf The fix to use a per CPU buffer to read user space tested only the writes to trace_marker. But it appears that the selftests are missing tests to the trace_maker_raw file. The trace_maker_raw file is used by applications that writes data structures and not strings into the file, and the tools read the raw ring buffer to process the structures it writes. The fix that reads the per CPU buffers passes the new per CPU buffer to the trace_marker file writes, but the update to the trace_marker_raw write read the data from user space into the per CPU buffer, but then still used then passed the user space address to the function that records the data. Pass in the per CPU buffer and not the user space address. TODO: Add a test to better test trace_marker_raw. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20251011035243.386098147@kernel.org Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) commit 852947be66b826c3d0ba328e19a3559fdf7ac726 Author: Paul Walmsley Date: Fri Oct 10 15:50:24 2025 -0600 riscv: kprobes: convert one final __ASSEMBLY__ to __ASSEMBLER__ Per the reasoning in commit f811f58597ac ("riscv: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers"), convert one last remaining instance of __ASSEMBLY__ in the arch/riscv kprobes code. This entered the tree from patches that were sent before Thomas' changes; and when I reviewed the kprobes patches before queuing them, I missed this instance. Cc: Nam Cao Cc: Thomas Huth Link: https://lore.kernel.org/linux-riscv/16b74b63-f223-4f0b-b6e5-31cea5e620b4@redhat.com/ Link: https://lore.kernel.org/linux-riscv/20250606070952.498274-1-thuth@redhat.com/ Signed-off-by: Paul Walmsley commit b0f2942a16017f88395d768afedd7373860968ce Author: Nathan Chancellor Date: Fri Oct 10 14:49:27 2025 -0700 kbuild: Use '--strip-unneeded-symbol' for removing module device table symbols After commit 5ab23c7923a1 ("modpost: Create modalias for builtin modules"), relocatable RISC-V kernels with CONFIG_KASAN=y start failing when attempting to strip the module device table symbols: riscv64-linux-objcopy: not stripping symbol `__mod_device_table__kmod_irq_starfive_jh8100_intc__of__starfive_intc_irqchip_match_table' because it is named in a relocation make[4]: *** [scripts/Makefile.vmlinux:97: vmlinux] Error 1 The relocation appears to come from .LASANLOC5 in .data.rel.local: $ llvm-objdump --disassemble-symbols=.LASANLOC5 --disassemble-all -r drivers/irqchip/irq-starfive-jh8100-intc.o drivers/irqchip/irq-starfive-jh8100-intc.o: file format elf64-littleriscv Disassembly of section .data.rel.local: 0000000000000180 <.LASANLOC5>: ... 1d0: 0000 unimp 00000000000001d0: R_RISCV_64 __mod_device_table__kmod_irq_starfive_jh8100_intc__of__starfive_intc_irqchip_match_table ... This section appears to come from GCC for including additional information about global variables that may be protected by KASAN. There appears to be no way to opt out of the generation of these symbols through either a flag or attribute. Attempting to remove '.LASANLOC*' with '--strip-symbol' results in the same error as above because these symbols may refer to (thus have relocation between) each other. Avoid this build breakage by switching to '--strip-unneeded-symbol' for removing __mod_device_table__ symbols, as it will only remove the symbol when there is no relocation pointing to it. While this may result in a little more bloat in the symbol table in certain configurations, it is not as bad as outright build failures. Fixes: 5ab23c7923a1 ("modpost: Create modalias for builtin modules") Reported-by: Charles Mirabile Closes: https://lore.kernel.org/20251007011637.2512413-1-cmirabil@redhat.com/ Suggested-by: Alexey Gladkov Tested-by: Nicolas Schier Signed-off-by: Nathan Chancellor commit 505f5224b197b77169c977e747cbc18b222f85f9 Author: Sean Christopherson Date: Fri Oct 3 16:26:06 2025 -0700 KVM: selftests: Verify that reads to inaccessible guest_memfd VMAs SIGBUS Expand the guest_memfd negative testcases for overflow and MAP_PRIVATE to verify that reads to inaccessible memory also get a SIGBUS. Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: Lisa Wang Tested-by: Lisa Wang Link: https://lore.kernel.org/r/20251003232606.4070510-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 19942d4fd9cf022b28a9afb432a6338dcf96fc2f Author: Sean Christopherson Date: Fri Oct 3 16:26:05 2025 -0700 KVM: selftests: Verify that faulting in private guest_memfd memory fails Add a guest_memfd testcase to verify that faulting in private memory gets a SIGBUS. For now, test only the case where memory is private by default since KVM doesn't yet support in-place conversion. Deliberately run the CoW test with and without INIT_SHARED set as KVM should disallow MAP_PRIVATE regardless of whether the memory itself is private from a CoCo perspective. Cc: Ackerley Tng Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-13-seanjc@google.com Signed-off-by: Sean Christopherson commit f91187c0ecc6358ccecf533c5fcc6b7dbb4735cb Author: Sean Christopherson Date: Fri Oct 3 16:26:04 2025 -0700 KVM: selftests: Add wrapper macro to handle and assert on expected SIGBUS Extract the guest_memfd test's SIGBUS handling functionality into a common TEST_EXPECT_SIGBUS() macro in anticipation of adding more SIGBUS testcases. Eating a SIGBUS isn't terrible difficult, but it requires a non-trivial amount of boilerplate code, and using a macro allows selftests to print out the exact action that failed to generate a SIGBUS without the developer needing to remember to add a useful error message. Explicitly mark the SIGBUS handler as "used", as gcc-14 at least likes to discard the function before linking. Opportunistically use TEST_FAIL(...) instead of TEST_ASSERT(false, ...), and fix the write path of the guest_memfd test to use the local "val" instead of hardcoding the literal value a second time. Suggested-by: Ackerley Tng Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: Lisa Wang Tested-by: Lisa Wang Link: https://lore.kernel.org/r/20251003232606.4070510-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 505c953009ec8260870d41ef8109bb4c7e208e6f Author: Sean Christopherson Date: Fri Oct 3 16:26:03 2025 -0700 KVM: selftests: Isolate the guest_memfd Copy-on-Write negative testcase Move the guest_memfd Copy-on-Write (CoW) testcase to its own function to better separate positive testcases from negative testcases. No functional change intended. Suggested-by: Ackerley Tng Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 61cee97f40180312dcca9580a5be0b0aa2217f6e Author: Sean Christopherson Date: Fri Oct 3 16:26:02 2025 -0700 KVM: selftests: Add wrappers for mmap() and munmap() to assert success Add and use wrappers for mmap() and munmap() that assert success to reduce a significant amount of boilerplate code, to ensure all tests assert on failure, and to provide consistent error messages on failure. No functional change intended. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-10-seanjc@google.com Signed-off-by: Sean Christopherson commit df0d9923f7055169cb01b050236e5a9a2b36db02 Author: Ackerley Tng Date: Fri Oct 3 16:26:01 2025 -0700 KVM: selftests: Add test coverage for guest_memfd without GUEST_MEMFD_FLAG_MMAP If a VM type supports KVM_CAP_GUEST_MEMFD_MMAP, the guest_memfd test will run all test cases with GUEST_MEMFD_FLAG_MMAP set. This leaves the code path for creating a non-mmap()-able guest_memfd on a VM that supports mappable guest memfds untested. Refactor the test to run the main test suite with a given set of flags. Then, for VM types that support the mappable capability, invoke the test suite twice: once with no flags, and once with GUEST_MEMFD_FLAG_MMAP set. This ensures both creation paths are properly exercised on capable VMs. Run test_guest_memfd_flags() only once per VM type since it depends only on the set of valid/supported flags, i.e. iterating over an arbitrary set of flags is both unnecessary and wrong. Signed-off-by: Ackerley Tng [sean: use double-underscores for the inner helper] Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 21d602ed616aebae4de568be55db65a1f5a3be10 Author: Sean Christopherson Date: Fri Oct 3 16:26:00 2025 -0700 KVM: selftests: Create a new guest_memfd for each testcase Refactor the guest_memfd selftest to improve test isolation by creating a a new guest_memfd for each testcase. Currently, the test reuses a single guest_memfd instance for all testcases, and thus creates dependencies between tests, e.g. not truncating folios from the guest_memfd instance at the end of a test could lead to unexpected results (see the PUNCH_HOLE purging that needs to done by in-flight the NUMA testcases[1]). Invoke each test via a macro wrapper to create and close a guest_memfd to cut down on the boilerplate copy+paste needed to create a test. Link: https://lore.kernel.org/all/20250827175247.83322-10-shivankg@amd.com Reported-by: Ackerley Tng Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 3a6c08538c742624c60cb6a53dd61eb025e0d1e1 Author: Sean Christopherson Date: Fri Oct 3 16:25:59 2025 -0700 KVM: selftests: Stash the host page size in a global in the guest_memfd test Use a global variable to track the host page size in the guest_memfd test so that the information doesn't need to be constantly passed around. The state is purely a reflection of the underlying system, i.e. can't be set by the test and is constant for a given invocation of the test, and thus explicitly passing the host page size to individual testcases adds no value, e.g. doesn't allow testing different combinations. Making page_size a global will simplify an upcoming change to create a new guest_memfd instance per testcase. No functional change intended. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 44c6cb9fe9888b371e31165b2854bd0f4e2787d4 Author: Sean Christopherson Date: Fri Oct 3 16:25:58 2025 -0700 KVM: guest_memfd: Allow mmap() on guest_memfd for x86 VMs with private memory Allow mmap() on guest_memfd instances for x86 VMs with private memory as the need to track private vs. shared state in the guest_memfd instance is only pertinent to INIT_SHARED. Doing mmap() on private memory isn't terrible useful (yet!), but it's now possible, and will be desirable when guest_memfd gains support for other VMA-based syscalls, e.g. mbind() to set NUMA policy. Lift the restriction now, before MMAP support is officially released, so that KVM doesn't need to add another capability to enumerate support for mmap() on private memory. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 9aef71c892a55e004419923ba7129abe3e58d9f1 Author: Sean Christopherson Date: Fri Oct 3 16:25:57 2025 -0700 KVM: Explicitly mark KVM_GUEST_MEMFD as depending on KVM_GENERIC_MMU_NOTIFIER Add KVM_GENERIC_MMU_NOTIFIER as a dependency for selecting KVM_GUEST_MEMFD, as guest_memfd relies on kvm_mmu_invalidate_{begin,end}(), which are defined if and only if the generic mmu_notifier implementation is enabled. The missing dependency is currently benign as s390 is the only KVM arch that doesn't utilize the generic mmu_notifier infrastructure, and s390 doesn't currently support guest_memfd. Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5d3341d684be80892d8f6f9812f90f9274b81177 Author: Sean Christopherson Date: Fri Oct 3 16:25:56 2025 -0700 KVM: guest_memfd: Invalidate SHARED GPAs if gmem supports INIT_SHARED When invalidating gmem ranges, e.g. in response to PUNCH_HOLE, process all possible range types (PRIVATE vs. SHARED) for the gmem instance. Since since guest_memfd doesn't yet support in-place conversions, simply pivot on INIT_SHARED as a gmem instance can currently only have private or shared memory, not both. Failure to mark shared GPAs for invalidation is benign in the current code base, as only x86's TDX consumes KVM_FILTER_{PRIVATE,SHARED}, and TDX doesn't yet support INIT_SHARED with guest_memfd. However, invalidating only private GPAs is conceptually wrong and a lurking bug, e.g. could result in missed invalidations if ARM starts filtering invalidations based on attributes. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Reviewed-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-4-seanjc@google.com Signed-off-by: Sean Christopherson commit fe2bf6234e947bf5544db6d386af1df2a8db80f3 Author: Sean Christopherson Date: Fri Oct 3 16:25:55 2025 -0700 KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set Add a guest_memfd flag to allow userspace to state that the underlying memory should be configured to be initialized as shared, and reject user page faults if the guest_memfd instance's memory isn't shared. Because KVM doesn't yet support in-place private<=>shared conversions, all guest_memfd memory effectively follows the initial state. Alternatively, KVM could deduce the initial state based on MMAP, which for all intents and purposes is what KVM currently does. However, implicitly deriving the default state based on MMAP will result in a messy ABI when support for in-place conversions is added. For x86 CoCo VMs, which don't yet support MMAP, memory is currently private by default (otherwise the memory would be unusable). If MMAP implies memory is shared by default, then the default state for CoCo VMs will vary based on MMAP, and from userspace's perspective, will change when in-place conversion support is added. I.e. to maintain guest<=>host ABI, userspace would need to immediately convert all memory from shared=>private, which is both ugly and inefficient. The inefficiency could be avoided by adding a flag to state that memory is _private_ by default, irrespective of MMAP, but that would lead to an equally messy and hard to document ABI. Bite the bullet and immediately add a flag to control the default state so that the effective behavior is explicit and straightforward. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Cc: David Hildenbrand Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-3-seanjc@google.com Signed-off-by: Sean Christopherson commit d2042d8f96ddefdeee823737f813efe3ab4b4e8d Author: Sean Christopherson Date: Fri Oct 3 16:25:54 2025 -0700 KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS Rework the not-yet-released KVM_CAP_GUEST_MEMFD_MMAP into a more generic KVM_CAP_GUEST_MEMFD_FLAGS capability so that adding new flags doesn't require a new capability, and so that developers aren't tempted to bundle multiple flags into a single capability. Note, kvm_vm_ioctl_check_extension_generic() can only return a 32-bit value, but that limitation can be easily circumvented by adding e.g. KVM_CAP_GUEST_MEMFD_FLAGS2 in the unlikely event guest_memfd supports more than 32 flags. Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 034417c1439a533a315562a57bd340d963eaac6b Author: Dapeng Mi Date: Fri Oct 10 08:52:39 2025 +0800 KVM: x86/pmu: Don't try to get perf capabilities for hybrid CPUs Explicitly zero kvm_host_pmu instead of attempting to get the perf PMU capabilities when running on a hybrid CPU to avoid running afoul of perf's sanity check. ------------[ cut here ]------------ WARNING: arch/x86/events/core.c:3089 at perf_get_x86_pmu_capability+0xd/0xc0, Call Trace: kvm_x86_vendor_init+0x1b0/0x1a40 [kvm] vmx_init+0xdb/0x260 [kvm_intel] vt_init+0x12/0x9d0 [kvm_intel] do_one_initcall+0x60/0x3f0 do_init_module+0x97/0x2b0 load_module+0x2d08/0x2e30 init_module_from_file+0x96/0xe0 idempotent_init_module+0x117/0x330 __x64_sys_finit_module+0x73/0xe0 Always read the capabilities for non-hybrid CPUs, i.e. don't entirely revert to reading capabilities if and only if KVM wants to use a PMU, as it may be useful to have the host PMU capabilities available, e.g. if only or debug. Reported-by: Chaitanya Kumar Borah Closes: https://lore.kernel.org/all/70b64347-2aca-4511-af78-a767d5fa8226@intel.com/ Fixes: 51f34b1e650f ("KVM: x86/pmu: Snapshot host (i.e. perf's) reported PMU capabilities") Suggested-by: Sean Christopherson Signed-off-by: Dapeng Mi Link: https://lore.kernel.org/r/20251010005239.146953-1-dapeng1.mi@linux.intel.com [sean: rework changelog, call out hybrid CPUs in shortlog] Signed-off-by: Sean Christopherson commit 0739473694c4878513031006829f1030ec850bc2 Merge: 284fc30e66e602 32058c38d3b79a Author: Linus Torvalds Date: Fri Oct 10 14:06:02 2025 -0700 Merge tag 'for-6.18/hpfs-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull hpfs updates from Mikulas Patocka: - Avoid -Wflex-array-member-not-at-end warnings - Replace simple_strtoul with kstrtoint - Fix error code for new_inode() failure * tag 'for-6.18/hpfs-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink hpfs: Replace simple_strtoul with kstrtoint in hpfs_parse_param fs: hpfs: Avoid multiple -Wflex-array-member-not-at-end warnings commit 284fc30e66e602a5df58393860f67477d6a79339 Merge: 1e5d41b981bc55 c4b6ddcf01f63a Author: Linus Torvalds Date: Fri Oct 10 14:02:14 2025 -0700 Merge tag 'drm-next-2025-10-11-1' of https://gitlab.freedesktop.org/drm/kernel Pull more drm fixes from Dave Airlie: "Just the follow up fixes for rc1 from the next branch, amdgpu and xe mostly with a single v3d fix in there. amdgpu: - DC DCE6 fixes - GPU reset fixes - Secure diplay messaging cleanup - MES fix - GPUVM locking fixes - PMFW messaging cleanup - PCI US/DS switch handling fix - VCN queue reset fix - DC FPU handling fix - DCN 3.5 fix - DC mirroring fix amdkfd: - Fix kfd process ref leak - mmap write lock handling fix - Fix comments in IOCTL xe: - Fix build with clang 16 - Fix handling of invalid configfs syntax usage and spell out the expected syntax in the documentation - Do not try late bind firmware when running as VF since it shouldn't handle firmware loading - Fix idle assertion for local BOs - Fix uninitialized variable for late binding - Do not require perfmon_capable to expose free memory at page granularity. Handle it like other drm drivers do - Fix lock handling on suspend error path - Fix I2C controller resume after S3 v3d: - fix fence locking" * tag 'drm-next-2025-10-11-1' of https://gitlab.freedesktop.org/drm/kernel: (34 commits) drm/amd/display: Incorrect Mirror Cositing drm/amd/display: Enable Dynamic DTBCLK Switch drm/amdgpu: Report individual reset error drm/amdgpu: partially revert "revert to old status lock handling v3" drm/amd/display: Fix unsafe uses of kernel mode FPU drm/amd/pm: Disable VCN queue reset on SMU v13.0.6 due to regression drm/amdgpu: Fix general protection fault in amdgpu_vm_bo_reset_state_machine drm/amdgpu: Check swus/ds for switch state save drm/amdkfd: Fix two comments in kfd_ioctl.h drm/amd/pm: Avoid interface mismatch messaging drm/amdgpu: Merge amdgpu_vm_set_pasid into amdgpu_vm_init drm/amd/amdgpu: Fix the mes version that support inv_tlbs drm/amd: Check whether secure display TA loaded successfully drm/amdkfd: Fix mmap write lock not release drm/amdkfd: Fix kfd process ref leaking when userptr unmapping drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O. drm/amd/display: Disable scaling on DCE6 for now drm/amd/display: Properly disable scaling on DCE6 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs ... commit 1e5d41b981bc550f41b198706e259a45686f3b5a Merge: f76b1683d16dcd 5ca5f00a167cdd Author: Linus Torvalds Date: Fri Oct 10 13:59:38 2025 -0700 Merge tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Some fixes leftover from our fixes branch, just nouveau and vmwgfx: nouveau: - Return errno code from TTM move helper vmwgfx: - Fix null-ptr access in cursor code - Fix UAF in validation - Use correct iterator in validation" * tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel: drm/nouveau: fix bad ret code in nouveau_bo_move_prep drm/vmwgfx: Fix copy-paste typo in validation drm/vmwgfx: Fix Use-after-free in validation drm/vmwgfx: Fix a null-ptr access in the cursor snooper commit 971843c511c3c2f6eda96c6b03442913bfee6148 Author: Jan Kara Date: Tue Oct 7 15:49:37 2025 +0200 ext4: free orphan info with kvfree Orphan info is now getting allocated with kvmalloc_array(). Free it with kvfree() instead of kfree() to avoid complaints from mm. Reported-by: Chris Mason Fixes: 0a6ce20c1564 ("ext4: verify orphan file size is not too big") Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Message-ID: <20251007134936.7291-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b Author: Deepanshu Kartikey Date: Tue Sep 30 16:58:10 2025 +0530 ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set: EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15: comm syz.0.17: corrupted extent tree: lblk 0 < prev 66 Investigation revealed that the inode has both flags set: DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1 This is an invalid combination since an inode should have either: - INLINE_DATA: data stored directly in the inode - EXTENTS: data stored in extent-mapped blocks Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode. Cc: stable@kernel.org Reported-and-tested-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308 Suggested-by: Zhang Yi Signed-off-by: Deepanshu Kartikey Reviewed-by: Zhang Yi Message-ID: <20250930112810.315095-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o commit 5ca5f00a167cdd28bcfeeae6ddd370b13ac00a2a Merge: e5f0a698b34ed7 e4bea919584ff2 Author: Dave Airlie Date: Sat Oct 11 06:17:06 2025 +1000 Merge tag 'drm-misc-fixes-2025-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: nouveau: - Return errno code from TTM move helper vmwgfx: - Fix null-ptr access in cursor code - Fix UAF in validation - Use correct iterator in validation Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251009120004.GA17570@linux.fritz.box commit f76b1683d16dcd5299a9b67d8ef45fe8d29cb2e6 Merge: 8bd9238e511d02 ce740955b23876 Author: Linus Torvalds Date: Fri Oct 10 13:05:40 2025 -0700 Merge tag 'devicetree-fixes-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Allow child nodes on renesas-bsc bus binding - Drop node name pattern on allwinner,sun50i-a64-de2 bus binding - Switch DT patchwork to kernel.org from ozlabs.org - Fix some typos in docs and bindings - Fix reference count in PCI node unittest * tag 'devicetree-fixes-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: bus: renesas-bsc: allow additional properties dt-bindings: bus: allwinner,sun50i-a64-de2: don't check node names MAINTAINERS: Move DT patchwork to kernel.org of: unittest: Fix device reference count leak in of_unittest_pci_node_verify of: doc: Fix typo in doc comments. dt-bindings: mmc: Correct typo "upto" to "up to" commit ce740955b238761ec1d8cf0590d7e6802d3a813a Author: Wolfram Sang Date: Thu Oct 9 20:34:53 2025 +0200 dt-bindings: bus: renesas-bsc: allow additional properties Allow additional properties to enable devices attached to the bus. Fixes warnings like these: arch/arm/boot/dts/renesas/sh73a0-kzm9g.dtb: bus@fec10000 (renesas,bsc-sh73a0): Unevaluated properties are not allowed ('ethernet@10000000' was unexpected) arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dtb: bus@fec10000 (renesas,bsc-r8a73a4): Unevaluated properties are not allowed ('ethernet@8000000', 'flash@0' were unexpected) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Rob Herring (Arm) commit f7045387a6816d51d462447af4522785e1c7251c Author: Wolfram Sang Date: Thu Oct 9 20:37:43 2025 +0200 dt-bindings: bus: allwinner,sun50i-a64-de2: don't check node names Node names are already and properly checked by the core schema. No need to do it again. Signed-off-by: Wolfram Sang [robh: Also drop [A-F] in unit address] Signed-off-by: Rob Herring (Arm) commit 8bd9238e511d02831022ff0270865c54ccc482d6 Merge: 91b436fc925ca5 d74d6c0e98958a Author: Linus Torvalds Date: Fri Oct 10 11:30:19 2025 -0700 Merge tag 'ceph-for-6.18-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: - some messenger improvements (Eric and Max) - address an issue (also affected userspace) of incorrect permissions being granted to users who have access to multiple different CephFS instances within the same cluster (Kotresh) - a bunch of assorted CephFS fixes (Slava) * tag 'ceph-for-6.18-rc1' of https://github.com/ceph/ceph-client: ceph: add bug tracking system info to MAINTAINERS ceph: fix multifs mds auth caps issue ceph: cleanup in ceph_alloc_readdir_reply_buffer() ceph: fix potential NULL dereference issue in ceph_fill_trace() libceph: add empty check to ceph_con_get_out_msg() libceph: pass the message pointer instead of loading con->out_msg libceph: make ceph_con_get_out_msg() return the message pointer ceph: fix potential race condition on operations with CEPH_I_ODIRECT flag ceph: refactor wake_up_bit() pattern of calling ceph: fix potential race condition in ceph_ioctl_lazyio() ceph: fix overflowed constant issue in ceph_do_objects_copy() ceph: fix wrong sizeof argument issue in register_session() ceph: add checking of wait_for_completion_killable() return value ceph: make ceph_start_io_*() killable libceph: Use HMAC-SHA256 library instead of crypto_shash commit 91b436fc925ca58625e4230f53238e955223c385 Merge: 917167ed1211b7 b30c32c784bf29 Author: Linus Torvalds Date: Fri Oct 10 11:23:57 2025 -0700 Merge tag 'v6.18-rc-part2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: - fix i_size in fallocate - two truncate fixes - utime fix - minor cleanups - SMB1 fixes - improve error check in read - improve perf of copy file_range (copy_chunk) * tag 'v6.18-rc-part2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal version number cifs: Add comments for DeletePending assignments in open functions cifs: Add fallback code path for cifs_mkdir_setinfo() cifs: Allow fallback code in smb_set_file_info() also for directories cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points smb: client: remove cfids_invalidation_worker smb: client: remove redudant assignment in cifs_strict_fsync() smb: client: fix race with fallocate(2) and AIO+DIO smb: client: fix missing timestamp updates after utime(2) smb: client: fix missing timestamp updates after ftruncate(2) smb: client: fix missing timestamp updates with O_TRUNC cifs: Fix copy_to_iter return value check smb: client: batch SRV_COPYCHUNK entries to cut round trips smb: client: Omit an if branch in smb2_find_smb_tcon() smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message() smb: client: Use common code in cifs_do_create() smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() smb: client: Return a status code only as a constant in cifs_spnego_key_instantiate() smb: client: Use common code in cifs_lookup() smb: client: Reduce the scopes for a few variables in two functions commit 917167ed1211b7037534b6e6d7815778b57d310b Merge: 1b1391b9c4bfad 4c8bad3ed035ab Author: Linus Torvalds Date: Fri Oct 10 11:20:19 2025 -0700 Merge tag 'xtensa-20251010' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - minor cleanups * tag 'xtensa-20251010' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: use HZ_PER_MHZ in platform_calibrate_ccount xtensa: simdisk: add input size check in proc_write_simdisk commit 1b1391b9c4bfadcaeb89a87edf6c3520dd349e35 Merge: eba41c0173c8c2 455281c0ef4e2c Author: Linus Torvalds Date: Fri Oct 10 10:37:13 2025 -0700 Merge tag 'block-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Don't include __GFP_NOWARN for loop worker allocation, as it already uses GFP_NOWAIT which has __GFP_NOWARN set already - Small series cleaning up the recent bio_iov_iter_get_pages() changes - loop fix for leaking the backing reference file, if validation fails - Update of a comment pertaining to disk/partition stat locking * tag 'block-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: loop: remove redundant __GFP_NOWARN flag block: move bio_iov_iter_get_bdev_pages to block/fops.c iomap: open code bio_iov_iter_get_bdev_pages block: rename bio_iov_iter_get_pages_aligned to bio_iov_iter_get_pages block: remove bio_iov_iter_get_pages block: Update a comment of disk statistics loop: fix backing file reference leak on validation error commit 4b471b736ea1ce08113a12bd7dcdaea621b0f65f Author: Zeno Endemann Date: Thu Sep 25 17:24:33 2025 +0200 ext4, doc: fix and improve directory hash tree description Some of the details about how directory hash trees work were confusing or outright wrong, this patch should fix those. A note on dx_tail's dt_reserved member, as far as I can tell the kernel never sets this explicitly, so its content is apparently left-overs from what was there before (for the dx_root I've seen remnants of a ext4_dir_entry_tail struct from when the dir was not yet a hash dir). Signed-off-by: Zeno Endemann Message-ID: <20250925152435.22749-1-zeno.endemann@mailbox.org> Signed-off-by: Theodore Ts'o commit 328a782cb138029182e521c08f50eb1587db955d Author: Zhang Yi Date: Tue Sep 16 17:33:37 2025 +0800 ext4: wait for ongoing I/O to complete before freeing blocks When freeing metadata blocks in nojournal mode, ext4_forget() calls bforget() to clear the dirty flag on the buffer_head and remvoe associated mappings. This is acceptable if the metadata has not yet begun to be written back. However, if the write-back has already started but is not yet completed, ext4_forget() will have no effect. Subsequently, ext4_mb_clear_bb() will immediately return the block to the mb allocator. This block can then be reallocated immediately, potentially causing an data corruption issue. Fix this by clearing the buffer's dirty flag and waiting for the ongoing I/O to complete, ensuring that no further writes to stale data will occur. Fixes: 16e08b14a455 ("ext4: cleanup clean_bdev_aliases() calls") Cc: stable@kernel.org Reported-by: Gao Xiang Closes: https://lore.kernel.org/linux-ext4/a9417096-9549-4441-9878-b1955b899b4e@huaweicloud.com/ Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250916093337.3161016-3-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit eba41c0173c8c27702b720730ed9d399088409f0 Merge: 8cc8ea228c4199 e9a9dcb4ccb324 Author: Linus Torvalds Date: Fri Oct 10 10:25:24 2025 -0700 Merge tag 'io_uring-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fixup indentation in the UAPI header - Two fixes for zcrx. One fixes receiving too much in some cases, and the other deals with not correctly incrementing the source in the fallback copy loop - Fix for a race in the IORING_OP_WAITID command, where there was a small window where the request would be left on the wait_queue_head list even though it was being canceled/completed - Update liburing git URL in the kernel tree * tag 'io_uring-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: increment fallback loop src offset io_uring/zcrx: fix overshooting recv limit io_uring: use tab indentation for IORING_SEND_VECTORIZED comment io_uring/waitid: always prune wait queue entry in io_waitid_wait() io_uring: update liburing git URL commit cfc584537150484874e10ec4e59ad2ecbae46bfe Merge: 38492c5743f8b7 9338d660b79a0d Author: Nathan Chancellor Date: Fri Oct 10 10:22:28 2025 -0700 Merge patch series "kbuild: Fixes for fallout from recent modules.builtin.modinfo series" This is a series to address some problems that were exposed by the recent modules.builtin.modinfo series that landed in commit c7d3dd9163e6 ("Merge patch series "Add generated modalias to modules.builtin.modinfo""). The third patch is not directly related to the aforementioned series, as the warning it fixes happens prior to the series but commit 8d18ef04f940 ("s390: vmlinux.lds.S: Reorder sections") from the series creates conflicts in this area, so I included it here. Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-0-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f Author: Nathan Chancellor Date: Wed Oct 8 15:46:46 2025 -0700 s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections When building s390 defconfig with binutils older than 2.32, there are several warnings during the final linking stage: s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment binutils commit afca762f598 ("S/390: Improve partial relro support for 64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the warning. The :NONE in the .vmlinux.info output section description changes the segment for subsequent allocated sections. Move .vmlinux.info right above the discards section to place all other sections in the previously defined segment, .data. Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1] Acked-by: Alexander Gordeev Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 8ec3af916fe3954381cf3555ea03dc5adf4d0e8e Author: Nathan Chancellor Date: Wed Oct 8 15:46:45 2025 -0700 kbuild: Add '.rel.*' strip pattern for vmlinux Prior to binutils commit c12d9fa2afe ("Support objcopy --remove-section=.relaFOO") [1] in 2.32, stripping relocation sections required the trailing period (i.e., '.rel.*') to work properly. After commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped"), there is an error with binutils 2.31.1 or earlier because these sections are not properly removed: s390-linux-objcopy: st6tO8Ev: symbol `.modinfo' required but not present s390-linux-objcopy:st6tO8Ev: no symbols Add the old pattern to resolve this issue (along with a comment to allow cleaning this when binutils 2.32 or newer is the minimum supported version). While the aforementioned kbuild change exposes this, the pattern was originally changed by commit 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly"), where it would still be incorrect with binutils older than 2.32. Fixes: 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7 [1] Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/CA+G9fYvVktRhFtZXdNgVOL8j+ArsJDpvMLgCitaQvQmCx=hwOQ@mail.gmail.com/ Acked-by: Ard Biesheuvel Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-2-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 4b47a3aefb29c523ca66f0d28de8db15a10f9352 Author: Nathan Chancellor Date: Wed Oct 8 15:46:44 2025 -0700 kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux Commit 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped") removed the pattern to avoid stripping .rela.dyn sections added by commit e9d86b8e17e7 ("scripts: Do not strip .rela.dyn section"). Restore it so that .rela.dyn sections remain in the final vmlinux. Fixes: 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped") Acked-by: Ard Biesheuvel Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-1-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit ffce84bccb4d95c7922b44897b6f0ffcda5061b7 Merge: 07ca98f906a403 accb9a7e87f096 Author: Alexei Starovoitov Date: Fri Oct 10 10:10:09 2025 -0700 Merge branch 'bpf-avoid-rcu-context-warning-when-unpinning-htab-with-internal-structs' KaFai Wan says: ==================== bpf: Avoid RCU context warning when unpinning htab with internal structs This small patchset is about avoid RCU context warning when unpinning htab with internal structs (timer, workqueue, or task_work). v3: - fix nit (Yonghong Song) - add Acked-by: Yonghong Song v2: - rename bpf_free_inode() to bpf_destroy_inode() (Andrii) https://lore.kernel.org/all/20251007012235.755853-1-kafai.wan@linux.dev/ v1: https://lore.kernel.org/all/20251003084528.502518-1-kafai.wan@linux.dev/ --- ==================== Link: https://patch.msgid.link/20251008102628.808045-1-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit accb9a7e87f096a12eb21256107b9c8e343f8019 Author: KaFai Wan Date: Wed Oct 8 18:26:27 2025 +0800 selftests/bpf: Add test for unpinning htab with internal timer struct Add test to verify that unpinning hash tables containing internal timer structures does not trigger context warnings. Each subtest (timer_prealloc and timer_no_prealloc) can trigger the context warning when unpinning, but the warning cannot be triggered twice within a short time interval (a HZ), which is expected behavior. Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251008102628.808045-3-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 4f375ade6aa9f37fd72d7a78682f639772089eed Author: KaFai Wan Date: Wed Oct 8 18:26:26 2025 +0800 bpf: Avoid RCU context warning when unpinning htab with internal structs When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered: BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ... The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms: 1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context. 2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations. However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule. Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning. Reported-by: Le Chen Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Suggested-by: Alexei Starovoitov Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 3c652c3a71de1d30d72dc82c3bead8deb48eb749 Author: Zhang Yi Date: Tue Sep 16 17:33:36 2025 +0800 jbd2: ensure that all ongoing I/O complete before freeing blocks When releasing file system metadata blocks in jbd2_journal_forget(), if this buffer has not yet been checkpointed, it may have already been written back, currently be in the process of being written back, or has not yet written back. jbd2_journal_forget() calls jbd2_journal_try_remove_checkpoint() to check the buffer's status and add it to the current transaction if it has not been written back. This buffer can only be reallocated after the transaction is committed. jbd2_journal_try_remove_checkpoint() attempts to lock the buffer and check its dirty status while holding the buffer lock. If the buffer has already been written back, everything proceeds normally. However, there are two issues. First, the function returns immediately if the buffer is locked by the write-back process. It does not wait for the write-back to complete. Consequently, until the current transaction is committed and the block is reallocated, there is no guarantee that the I/O will complete. This means that ongoing I/O could write stale metadata to the newly allocated block, potentially corrupting data. Second, the function unlocks the buffer as soon as it detects that the buffer is still dirty. If a concurrent write-back occurs immediately after this unlocking and before clear_buffer_dirty() is called in jbd2_journal_forget(), data corruption can theoretically still occur. Although these two issues are unlikely to occur in practice since the undergoing metadata writeback I/O does not take this long to complete, it's better to explicitly ensure that all ongoing I/O operations are completed. Fixes: 597599268e3b ("jbd2: discard dirty data when forgetting an un-journalled buffer") Cc: stable@kernel.org Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250916093337.3161016-2-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 07ca98f906a403637fc5e513a872a50ef1247f3b Author: Alexander Lobakin Date: Wed Oct 8 18:56:59 2025 +0200 xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit. desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->tx_metadata_len can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks. Always promote desc->len to ``u64`` first to exclude positive overflows of it. Use explicit check_{add,sub}_overflow() when validating desc->addr (which is ``u64`` already). bloat-o-meter reports a little growth of the code size: add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskq_cons_peek_desc 299 330 +31 xsk_tx_peek_release_desc_batch 973 1002 +29 xsk_generic_xmit 3148 3132 -16 but hopefully this doesn't hurt the performance much. Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len") Cc: stable@vger.kernel.org # 6.8+ Signed-off-by: Alexander Lobakin Reviewed-by: Jason Xing Reviewed-by: Maciej Fijalkowski Link: https://lore.kernel.org/r/20251008165659.4141318-1-aleksander.lobakin@intel.com Signed-off-by: Alexei Starovoitov commit 8cc8ea228c4199482cf087fc6ed2d6e31b7a49e2 Merge: fdfa38e95e1229 f4edb5c52c93b1 Author: Linus Torvalds Date: Fri Oct 10 10:01:55 2025 -0700 Merge tag 'parisc-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Minor enhancements and fixes, specifically: - report emulation and alignment faults via perf - add initial kernel-side support for perf_events - small initialization fixes in the parisc firmware layer - adjust TC* constants and avoid referencing termio structs to avoid userspace build errors" * tag 'parisc-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix iodc and device path return values on old machines parisc: Firmware: Fix returned path for PDC_MODULE_FIND on older machines parisc: Add initial kernel-side perf_event support parisc: Report software alignment faults via perf parisc: Report emulation faults via perf parisc: don't reference obsolete termio struct for TC* constants parisc: Remove spurious if statement from raw_copy_from_user() commit fdfa38e95e1229ec2fb2f18540987c97f861d470 Merge: 06a88f47990974 ca7a2317993efa Author: Linus Torvalds Date: Fri Oct 10 09:55:19 2025 -0700 Merge tag 'sound-fix-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few more small fixes for 6.18-rc1. Most of changes are about ASoC Intel and SOF drivers, while a few other device-specific fixes are found for HD-audio, USB-audio, ASoC RT722VB and Meson" * tag 'sound-fix-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: rt722: add settings for rt722VB ASoC: meson: aiu-encoder-i2s: fix bit clock polarity ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user ALSA: hda/tas2781: Enable init_profile_id for device initialization ALSA: emu10k1: Fix typo in docs ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel ASoC: SOF: ipc4-pcm: do not report invalid delay values ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down ALSA: hda/hdmi: Add pin fix for HP ProDesk model commit 4b47a8601b71ad98833b447d465592d847b4dc77 Author: Chuck Lever Date: Thu Sep 11 11:12:06 2025 -0400 NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout. Reported-by: Robert Morris Closes: https://lore.kernel.org/linux-nfs/152f99b2-ba35-4dec-93a9-4690e625dccd@oracle.com/T/#t Cc: Thomas Haynes Cc: stable@vger.kernel.org Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server") Signed-off-by: Chuck Lever commit 06a88f47990974f1322c2bf2e8c5125f8a2f69fe Merge: 9976831f401eeb 15df28699b28d6 Author: Linus Torvalds Date: Fri Oct 10 09:36:23 2025 -0700 Merge tag 'fbdev-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Beside the usual bunch of smaller bug fixes, the majority of changes were by Zsolt Kajtar to improve the s3fb driver. Bug fixes: - Bounds checking to fix vmalloc-out-of-bounds (Albin Babu Varghese) - Fix logic error in "offb" name match (Finn Thain) - simplefb: Fix use after free in (Janne Grunau) - s3fb: Various fixes and powersave improvements (Zsolt Kajtar) Enhancements & code cleanups: - Various fixes in the documentation (Bagas Sanjaya) - Use string choices helpers (Chelsy Ratnawat) - xenfb: Use vmalloc_array to simplify code (Qianfeng Rong) - mb862xxfb: use signed type for error codes (Qianfeng Rong) - Make drivers depend on LCD_CLASS_DEVICE (Thomas Zimmermann) - radeonfb: Remove stale product link in Kconfig (Sukrut Heroorkar)" * tag 'fbdev-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Fix logic error in "offb" name match fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds fbdev: Make drivers depend on LCD_CLASS_DEVICE fbdev: radeonfb: Remove stale product link in Kconfig Documentation: fb: Retitle driver docs Documentation: fb: ep93xx: Demote section headings Documentation: fb: Split toctree fbdev: simplefb: Fix use after free in simplefb_detach_genpds() fbdev: s3fb: Revert mclk stop in suspend fbdev: mb862xxfb: Use int type to store negative error codes fbdev: Use string choices helpers fbdev: core: Fix ubsan warning in pixel_to_pat fbdev: s3fb: Implement 1 and 2 BPP modes, improve 4 BPP fbdev: s3fb: Implement powersave for S3 FB fbdev: xenfb: Use vmalloc_array to simplify code commit 9976831f401eeb302d699b2d37624153d7cd2892 Merge: dcf50ca7823506 b5f8aa8d4bde0c Author: Linus Torvalds Date: Fri Oct 10 09:22:39 2025 -0700 Merge tag 'gpio-fixes-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - add a missing ACPI ID for MTL-CVF devices in gpio-usbio - mark the gpio-wcd934x controller as "sleeping" as it uses a mutex for locking internally * tag 'gpio-fixes-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: wcd934x: mark the GPIO controller as sleeping gpio: usbio: Add ACPI device-id for MTL-CVF devices commit dcf50ca7823506fb3f20b8ffd3f928003cddaeed Merge: aac31903329ba7 006824a1cb3bd4 Author: Linus Torvalds Date: Fri Oct 10 09:18:19 2025 -0700 Merge tag 'ntb-6.18' of https://github.com/jonmason/ntb Pull NTB updates from Jon Mason: - Add support for Renesas R-Car and allow arbitrary BAR mapping in EPF - Update ntb_hw_amd to support the latest generation secondary topology and add a new maintainer - Fix a bug by adding a mutex to ensure `link_event_callback` executes sequentially * tag 'ntb-6.18' of https://github.com/jonmason/ntb: NTB: epf: Add Renesas rcar support NTB: epf: Allow arbitrary BAR mapping ntb: Add mutex to make link_event_callback executed linearly. MAINTAINERS: Update for the NTB AMD driver maintainer ntb_hw_amd: Update amd_ntb_get_link_status to support latest generation secondary topology commit aac31903329ba73ef24674df78252b6610cc9d60 Merge: 0ae452440cb9fe eb4faf6343889f Author: Linus Torvalds Date: Fri Oct 10 09:13:11 2025 -0700 Merge tag 'i2c-for-6.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: - Second part of rtl9300 updates since dependencies are in now: - general cleanups - implement block read/write support - add RTL9310 support - DT schema conversion of hix5hd2 binding - namespace cleanup for i2c-algo-pca - minor simplification for mt65xx * tag 'i2c-for-6.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: hisilicon,hix5hd2: convert to DT schema i2c: mt65xx: convert set_speed function to void i2c: rename wait_for_completion callback to wait_for_completion_cb i2c: rtl9300: add support for RTL9310 I2C controller dt-bindings: i2c: realtek,rtl9301-i2c: extend for RTL9310 support i2c: rtl9300: use scoped guard instead of explicit lock/unlock i2c: rtl9300: separate xfer configuration and execution i2c: rtl9300: do not set read mode on every transfer i2c: rtl9300: move setting SCL frequency to config_io i2c: rtl9300: rename internal sda_pin to sda_num dt-bindings: i2c: realtek,rtl9301-i2c: fix wording and typos i2c: rtl9300: use regmap fields and API for registers i2c: rtl9300: Implement I2C block read and write commit b30c32c784bf29735dabff15443a5feeafd26d1c Author: Steve French Date: Sat Oct 4 19:50:31 2025 -0500 cifs: update internal version number to 2.57 Signed-off-by: Steve French commit 0ae452440cb9fee9079dc925f40cd824c1a9de2a Merge: 84d4e8b613e073 6bb73db6948c2d Author: Linus Torvalds Date: Fri Oct 10 08:56:16 2025 -0700 Merge tag 'v6.18-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix bug in crypto_skcipher that breaks the new ti driver - Check for invalid assoclen in essiv * tag 'v6.18-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: essiv - Check ssize for decryption and in-place encryption crypto: skcipher - Fix reqsize handling commit 84d4e8b613e073d9dfde782c471aedbcefdede6c Merge: 5472d60c129f75 a29ad21b988652 Author: Linus Torvalds Date: Fri Oct 10 08:34:11 2025 -0700 Merge tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: - Disable TCG_TPM2_HMAC from defconfig It causes performance issues, and breaks some atypical configurations. - simplify code using the new crypto library - misc fixes and cleanups * tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Prevent local DOS via tpm/tpm0/ppi/*operations tpm: use a map for tpm2_calc_ordinal_duration() tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single tpm: Use HMAC-SHA256 library instead of open-coded HMAC tpm: Compare HMAC values in constant time tpm: Disable TPM2_TCG_HMAC by default commit dc6b724974018c1b3b6fd704899782da3f12f145 Author: Rob Herring (Arm) Date: Fri Oct 10 08:04:46 2025 -0500 MAINTAINERS: Move DT patchwork to kernel.org The ozlabs.org PW instance is slow due to being geographically far away from any of the maintainers and seems to have gotten slower as of late (AI scrapers perhaps). The kernel.org PW also has some additional features (i.e. pwbot) we want to use. DT core patches also go into PW, so add the PW link for it. Signed-off-by: Rob Herring (Arm) commit 7933a585d70ee496fa341b50b8b0a95b131867ff Author: Seong-Gwang Heo Date: Thu Oct 9 13:41:48 2025 +0800 ovl: remove redundant IOCB_DIO_CALLER_COMP clearing The backing_file_write_iter() function, which is called immediately after this code, already contains identical logic to clear the IOCB_DIO_CALLER_COMP flag along with the same explanatory comment. There is no need to duplicate this operation in the overlayfs code. Signed-off-by: Seong-Gwang Heo Fixes: a6293b3e285c ("fs: factor out backing_file_{read,write}_iter() helpers") Acked-by: Miklos Szeredi Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b2796286a6d5f47bf271739c9e589f3a98835a25 Merge: a779e27f24aeb6 d90ad28e8aa482 Author: Christian Brauner Date: Fri Oct 10 13:44:09 2025 +0200 Merge patch series "Fix to EOPNOTSUPP double conversion in ioctl_setflags()" Andrey Albershteyn says: Revert original double conversion patch from ENOIOCTLCMD to EOPNOSUPP for vfs_fileattr_get and vfs_fileattr_set. Instead, convert ENOIOCTLCMD only where necessary. To: linux-api@vger.kernel.org To: linux-fsdevel@vger.kernel.org To: linux-kernel@vger.kernel.org To: linux-xfs@vger.kernel.org, Cc: "Jan Kara" Cc: "Jiri Slaby" Cc: "Christian Brauner" Cc: "Arnd Bergmann" * patches from https://lore.kernel.org/20251008-eopnosupp-fix-v1-0-5990de009c9f@kernel.org: fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" Signed-off-by: Christian Brauner commit d90ad28e8aa482e397150e22f3762173d918a724 Author: Andrey Albershteyn Date: Wed Oct 8 14:44:18 2025 +0200 fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls These syscalls call to vfs_fileattr_get/set functions which return ENOIOCTLCMD if filesystem doesn't support setting file attribute on an inode. For syscalls EOPNOTSUPP would be more appropriate return error. Signed-off-by: Andrey Albershteyn Reviewed-by: Jan Kara Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 4dd5b5ac089bb6ea719b7ffb748707ac9cbce4e4 Author: Andrey Albershteyn Date: Wed Oct 8 14:44:17 2025 +0200 Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" This reverts commit 474b155adf3927d2c944423045757b54aa1ca4de. This patch caused regression in ioctl_setflags(). Underlying filesystems use EOPNOTSUPP to indicate that flag is not supported. This error is also gets converted in ioctl_setflags(). Therefore, for unsupported flags error changed from EOPNOSUPP to ENOIOCTLCMD. Link: https://lore.kernel.org/linux-xfs/a622643f-1585-40b0-9441-cf7ece176e83@kernel.org/ Signed-off-by: Andrey Albershteyn Signed-off-by: Christian Brauner commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 Author: Bartosz Golaszewski Date: Wed Sep 24 16:51:29 2025 +0200 gpio: wcd934x: mark the GPIO controller as sleeping The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true. Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") Signed-off-by: Bartosz Golaszewski commit f3426ac54c42c3260096ddc50b5470eb179fb06a Author: Ivan Vecera Date: Wed Oct 8 16:14:18 2025 +0200 dpll: zl3073x: Increase maximum size of flash utility Newer firmware bundles contain a flash utility whose size exceeds the currently allowed limit. Increase the maximum allowed size to accommodate the newer utility version. Without this patch: # devlink dev flash i2c/1-0070 file fw_nosplit_v3.hex Failed to load firmware Flashing failed Error: zl3073x: FW load failed: [utility] component is too big (11000 bytes) Fixes: ca017409da694 ("dpll: zl3073x: Add firmware loading functionality") Suggested-by: Prathosh Satish Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251008141418.841053-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit a29ad21b988652dc60aa99c6d3b1e3d52dc69c30 Author: Denis Aleksandrov Date: Mon Sep 15 17:08:29 2025 -0400 tpm: Prevent local DOS via tpm/tpm0/ppi/*operations Reads on tpm/tpm0/ppi/*operations can become very long on misconfigured systems. Reading the TPM is a blocking operation, thus a user could effectively trigger a DOS. Resolve this by caching the results and avoiding the blocking operations after the first read. [ jarkko: fixed atomic sleep: sed -i 's/spin_/mutex_/g' drivers/char/tpm/tpm_ppi.c sed -i 's/DEFINE_SPINLOCK/DEFINE_MUTEX/g' drivers/char/tpm/tpm_ppi.c ] Signed-off-by: Denis Aleksandrov Reported-by: Jan Stancek Closes: https://lore.kernel.org/linux-integrity/20250915210829.6661-1-daleksan@redhat.com/T/#u Suggested-by: Jarkko Sakkinen Reviewed-by: Paul Menzel Signed-off-by: Jarkko Sakkinen commit 207696b17f38e869e59889b44d395ab24bb678d3 Author: Jarkko Sakkinen Date: Thu Sep 18 22:30:18 2025 +0300 tpm: use a map for tpm2_calc_ordinal_duration() The current shenanigans for duration calculation introduce too much complexity for a trivial problem, and further the code is hard to patch and maintain. Address these issues with a flat look-up table, which is easy to understand and patch. If leaf driver specific patching is required in future, it is easy enough to make a copy of this table during driver initialization and add the chip parameter back. 'chip->duration' is retained for TPM 1.x. As the first entry for this new behavior address TCG spec update mentioned in this issue: https://github.com/raspberrypi/linux/issues/7054 Therefore, for TPM_SelfTest the duration is set to 3000 ms. This does not categorize a as bug, given that this is introduced to the spec after the feature was originally made. Reviewed-by: Serge Hallyn Signed-off-by: Jarkko Sakkinen commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 Author: Gunnar Kudrjavets Date: Thu Sep 18 18:49:40 2025 +0300 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split. Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") Signed-off-by: Gunnar Kudrjavets Reviewed-by: Justinien Bouron Reviewed-by: Jarkko Sakkinen Reviewed-by: Paul Menzel Signed-off-by: Jarkko Sakkinen commit 64a7cfbcf548bb955220c15c39531befe0611475 Author: Eric Biggers Date: Fri Aug 1 14:24:22 2025 -0700 tpm: Use HMAC-SHA256 library instead of open-coded HMAC Now that there are easy-to-use HMAC-SHA256 library functions, use these in tpm2-sessions.c instead of open-coding the HMAC algorithm. Note that the new implementation correctly handles keys longer than 64 bytes (SHA256_BLOCK_SIZE), whereas the old implementation handled such keys incorrectly. But it doesn't appear that such keys were being used. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2c2615c8423890b5ef8e0a186b65607ef5fdeda1 Author: Eric Biggers Date: Fri Aug 1 14:24:21 2025 -0700 tpm: Compare HMAC values in constant time In tpm_buf_check_hmac_response(), compare the HMAC values in constant time using crypto_memneq() instead of in variable time using memcmp(). This is worthwhile to follow best practices and to be consistent with MAC comparisons elsewhere in the kernel. However, in this driver the side channel seems to have been benign: the HMAC input data is guaranteed to always be unique, which makes the usual MAC forgery via timing side channel not possible. Specifically, the HMAC input data in tpm_buf_check_hmac_response() includes the "our_nonce" field, which was generated by the kernel earlier, remains under the control of the kernel, and is unique for each call to tpm_buf_check_hmac_response(). Signed-off-by: Eric Biggers Signed-off-by: Jarkko Sakkinen commit 4bddf4587c131d7b8ce8952cd32b284dcda0dd1f Author: Jarkko Sakkinen Date: Mon Aug 25 23:32:23 2025 +0300 tpm: Disable TPM2_TCG_HMAC by default After reading all the feedback, right now disabling the TPM2_TCG_HMAC is the right call. Other views discussed: A. Having a kernel command-line parameter or refining the feature otherwise. This goes to the area of improvements. E.g., one example is my own idea where the null key specific code would be replaced with a persistent handle parameter (which can be *unambigously* defined as part of attestation process when done correctly). B. Removing the code. I don't buy this because that is same as saying that HMAC encryption cannot work at all (if really nitpicking) in any form. Also I disagree on the view that the feature could not be refined to something more reasoable. Also, both A and B are worst options in terms of backporting. Thuss, this is the best possible choice. Cc: stable@vger.kernel.or # v6.10+ Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation") Suggested-by: Chris Fenner Signed-off-by: Jarkko Sakkinen commit fa9fe8715055f8b9bcee38904065b2f1eb9197f0 Author: Pali Rohár Date: Sun Jun 1 18:01:54 2025 +0200 cifs: Add comments for DeletePending assignments in open functions On more places is set DeletePending member to 0. Add comments why is 0 the correct value. Paths in DELETE_PENDING state cannot be opened by new calls. So if the newly issued open for that path succeed then it means that the path cannot be in DELETE_PENDING state. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 92210ccd877ba577585e420c99cff2b51c4c9fe2 Author: Pali Rohár Date: Mon Dec 30 22:18:53 2024 +0100 cifs: Add fallback code path for cifs_mkdir_setinfo() Use SMBSetInformation() as a fallback function (when CIFSSMBSetPathInfo() fails) which can set attribudes on the directory, including changing read-only attribute. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 88cae132dc0539ad188b787d32a7df4e16b5c1af Author: Pali Rohár Date: Mon Dec 30 21:21:31 2024 +0100 cifs: Allow fallback code in smb_set_file_info() also for directories On NT systems, it is possible to do SMB open call also for directories. Open argument CREATE_NOT_DIR disallows opening directories. So in fallback code path in smb_set_file_info() remove CREATE_NOT_DIR restriction to allow it also for directories. Similar fallback is implemented also in CIFSSMBSetPathInfoFB() function and this function already allows to call operation for directories. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 Author: Pali Rohár Date: Sat Jun 7 18:11:10 2025 +0200 cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points EA $LXMOD is required for WSL non-symlink reparse points. Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1") Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 7882d2c45ccba538cddb0615a893a008dd2efcde Author: Thomas Weißschuh Date: Thu Oct 9 11:18:48 2025 +0200 riscv: Respect dependencies of ARCH_HAS_ELF_CORE_EFLAGS This kconfig symbol has dependencies and is only selectable if those dependencies are also enabled. Respect the dependencies. Fixes the following warning when configuring an 'allnoconfig': WARNING: unmet direct dependencies detected for ARCH_HAS_ELF_CORE_EFLAGS Depends on [n]: BINFMT_ELF [=n] && ELF_CORE [=y] Selected by [y]: - RISCV [=y] Fixes: 8c94db0ae97c ("binfmt_elf: preserve original ELF e_flags for core dumps") Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20251009-riscv-elf-core-eflags-v1-1-e9b45ab6b36d@linutronix.de Signed-off-by: Paul Walmsley commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e Author: Han Gao Date: Wed Sep 10 19:24:01 2025 +0800 riscv: acpi: avoid errors caused by probing DT devices when ACPI is used Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose to boot from acpi then disable FDT"), let's not do DT hardware probing if ACPI is enabled in early boot. This avoids errors caused by repeated driver probing. Signed-off-by: Han Gao Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com [pjw@kernel.org: cleaned up patch description and subject] Signed-off-by: Paul Walmsley commit 9e68bd803fac49274fde914466fd3b07c4d602c8 Author: Fabian Vogt Date: Wed Sep 10 17:25:13 2025 +0200 riscv: kprobes: Fix probe address validation When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", arch_check_kprobe would start iterating all instructions starting from _text until the probed address. Not only is this very inefficient, but literal values in there (e.g. left by function patching) are misinterpreted in a way that causes a desync. Fix this by doing it like x86: start the iteration at the closest preceding symbol instead of the given starting point. Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") Signed-off-by: Fabian Vogt Signed-off-by: Marvin Friedrich Acked-by: Guo Ren Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad Signed-off-by: Paul Walmsley commit c199745d3ac3f836515a5734a6ca5c6f55a8809b Author: Florian Schmaus Date: Mon Oct 6 11:37:42 2025 +0200 riscv: entry: fix typo in comment 'instruciton' -> 'instruction' Fix a typo in a comment in the RISC-V entry.S. Signed-off-by: Florian Schmaus Link: https://lore.kernel.org/r/20251006093742.53925-1-flo@geekplace.eu [pjw@kernel.org: wrote a basic patch description] Signed-off-by: Paul Walmsley commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb Author: Danil Skrebenkov Date: Fri Sep 19 16:28:46 2025 +0300 RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors openSBI v1.7 adds harts checks for ipi operations. Especially it adds comparison between hmask passed as an argument from linux and mask of online harts (from openSBI side). If they don't fit each other the error occurs. When cpu is offline, cpu_online_mask is explicitly cleared in __cpu_disable. However, there is no explicit clearing of mm_cpumask. mm_cpumask is used for rfence operations that call openSBI RFENCE extension which uses ipi to remote harts. If hart is offline there may be error if mask of linux is not as mask of online harts in openSBI. this patch adds explicit clearing of mm_cpumask for offline hart. Signed-off-by: Danil Skrebenkov Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru [pjw@kernel.org: rewrote subject line for clarity] Signed-off-by: Paul Walmsley commit 781380d2cdef34559a0125ca6464b90bfc01594f Author: Miquel Sabaté Solà Date: Mon Sep 15 16:32:52 2025 +0200 riscv: kgdb: Ensure that BUFMAX > NUMREGBYTES The current value of BUFMAX is similar as in other architectures, but as per documentation on KGDB (see 'Documentation/process/debugging/kgdb.rst'), BUFMAX has to be larger than NUMREGBYTES. Some NUMREGBYTES architectures (e.g. powerpc or hexagon) actually define BUFMAX in relation to NUMREGBYTES, and thus this condition is always guaranteed. Since 2048 is a value that is generally accepted on all architectures, and that is larger than the current value of NUMREGBYTES, we can keep this value in arch/riscv, but we can at least add an 'static_assert' as an extra measure just in case NUMREGBYTES changes in the future for some unforseen reason. Signed-off-by: Miquel Sabaté Solà Link: https://lore.kernel.org/r/20250915143252.154955-1-mikisabate@gmail.com Signed-off-by: Paul Walmsley commit 812258ff4166bcd41c7d44707e0591f9ae32ac8c Author: Conor Dooley Date: Mon Sep 8 14:12:35 2025 +0100 rust: cfi: only 64-bit arm and x86 support CFI_CLANG The kernel uses the standard rustc targets for non-x86 targets, and out of those only 64-bit arm's target has kcfi support enabled. For x86, the custom 64-bit target enables kcfi. The HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC config option that allows CFI_CLANG to be used in combination with RUST does not check whether the rustc target supports kcfi. This breaks the build on riscv (and presumably 32-bit arm) when CFI_CLANG and RUST are enabled at the same time. Ordinarily, a rustc-option check would be used to detect target support but unfortunately rustc-option filters out the target for reasons given in commit 46e24a545cdb4 ("rust: kasan/kbuild: fix missing flags on first build"). As a result, if the host supports kcfi but the target does not, e.g. when building for riscv on x86_64, the build would remain broken. Instead, make HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC depend on the only two architectures where the target used supports it to fix the build. CC: stable@vger.kernel.org Fixes: ca627e636551e ("rust: cfi: add support for CFI_CLANG with Rust") Signed-off-by: Conor Dooley Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250908-distill-lint-1ae78bcf777c@spud Signed-off-by: Paul Walmsley commit 15df28699b28d6b49dc305040c4e26a9553df07a Author: Finn Thain Date: Thu Oct 9 09:56:25 2025 +1100 fbdev: Fix logic error in "offb" name match A regression was reported to me recently whereby /dev/fb0 had disappeared from a PowerBook G3 Series "Wallstreet". The problem shows up when the "video=ofonly" parameter is passed to the kernel, which is what the bootloader does when "no video driver" is selected. The cause of the problem is the "offb" string comparison, which got mangled when it got refactored. Fix it. Cc: stable@vger.kernel.org Fixes: 93604a5ade3a ("fbdev: Handle video= parameter in video/cmdline.c") Reported-and-tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: Helge Deller commit f4edb5c52c93b1bc676064472fb517566a3e2129 Author: Helge Deller Date: Thu Oct 9 23:37:28 2025 +0200 parisc: Fix iodc and device path return values on old machines Older machines may not fully initialize the return values when asking for IODC and device path data when building the inventory. Work around possible firmware leaks by proper initialization of the variables. Signed-off-by: Helge Deller commit 44ac7f5c6d4c7fd62784bb2700245dbc4ac7e102 Author: Helge Deller Date: Thu Oct 9 23:33:34 2025 +0200 parisc: Firmware: Fix returned path for PDC_MODULE_FIND on older machines Older machines (like my 715/64) don't correctly initialize the device path when returning from the PDC_MODULE_FIND firmware call. Work around that shortcoming by initializing the path with the known values. Signed-off-by: Helge Deller commit 9db26d5855d0374d4652487bfb5aacf40821c469 Author: Esben Haabendal Date: Fri May 16 09:23:39 2025 +0200 rtc: interface: Ensure alarm irq is enabled when UIE is enabled When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled. But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated. When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that. Signed-off-by: Esben Haabendal Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-5-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 1502fe0e97be01d18f2b30fd7fe29bb39def0e7d Author: Esben Haabendal Date: Fri May 16 09:23:38 2025 +0200 rtc: tps6586x: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize irq_en accordingly to avoid causing an unbalanced enable warning. Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-4-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit e0762fd26ad68f0232979e742e080d73a1388ead Author: Esben Haabendal Date: Fri May 16 09:23:37 2025 +0200 rtc: cpcap: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize alarm_enabled accordingly to avoid causing an unbalanced enable warning. Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-3-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 9ffe06b6ccd7a8eaa31d31625db009ea26a22a3c Author: Esben Haabendal Date: Fri May 16 09:23:36 2025 +0200 rtc: isl12022: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize irq_enabled accordingly to avoid causing an unbalanced enable warning. Fixes: c62d658e5253 ("rtc: isl12022: Add alarm support") Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-2-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 795cda8338eab036013314dbc0b04aae728880ab Author: Esben Haabendal Date: Fri May 16 09:23:35 2025 +0200 rtc: interface: Fix long-standing race when setting alarm As described in the old comment dating back to commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second). With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this). With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop. For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future. I haven't been able to reproduce the problem with this check in place. Cc: stable@vger.kernel.org Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-1-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit c4b6ddcf01f63a710c24a128d134d3fa51978d6c Merge: 73bc073d4270b6 d07e142641417e Author: Dave Airlie Date: Fri Oct 10 06:57:28 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-10-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-10-09: amdgpu: - DC DCE6 fixes - GPU reset fixes - Secure diplay messaging cleanup - MES fix - GPUVM locking fixes - PMFW messaging cleanup - PCI US/DS switch handling fix - VCN queue reset fix - DC FPU handling fix - DCN 3.5 fix - DC mirroring fix amdkfd: - Fix kfd process ref leak - mmap write lock handling fix - Fix comments in IOCTL Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20251009162915.981503-1-alexander.deucher@amd.com commit 5472d60c129f75282d94ae5ad072ee6dfb7c7246 Merge: 80b7065ec19485 64cf7d058a005c Author: Linus Torvalds Date: Thu Oct 9 12:18:22 2025 -0700 Merge tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing clean up and fixes from Steven Rostedt: - Have osnoise tracer use memdup_user_nul() The function osnoise_cpus_write() open codes a kmalloc() and then a copy_from_user() and then adds a nul byte at the end which is the same as simply using memdup_user_nul(). - Fix wakeup and irq tracers when failing to acquire calltime When the wakeup and irq tracers use the function graph tracer for tracing function times, it saves a timestamp into the fgraph shadow stack. It is possible that this could fail to be stored. If that happens, it exits the routine early. These functions also disable nesting of the operations by incremeting the data "disable" counter. But if the calltime exits out early, it never increments the counter back to what it needs to be. Since there's only a couple of lines of code that does work after acquiring the calltime, instead of exiting out early, reverse the if statement to be true if calltime is acquired, and place the code that is to be done within that if block. The clean up will always be done after that. - Fix ring_buffer_map() return value on failure of __rb_map_vma() If __rb_map_vma() fails in ring_buffer_map(), it does not return an error. This means the caller will be working against a bad vma mapping. Have ring_buffer_map() return an error when __rb_map_vma() fails. - Fix regression of writing to the trace_marker file A bug fix was made to change __copy_from_user_inatomic() to copy_from_user_nofault() in the trace_marker write function. The trace_marker file is used by applications to write into it (usually with a file descriptor opened at the start of the program) to record into the tracing system. It's usually used in critical sections so the write to trace_marker is highly optimized. The reason for copying in an atomic section is that the write reserves space on the ring buffer and then writes directly into it. After it writes, it commits the event. The time between reserve and commit must have preemption disabled. The trace marker write does not have any locking nor can it allocate due to the nature of it being a critical path. Unfortunately, converting __copy_from_user_inatomic() to copy_from_user_nofault() caused a regression in Android. Now all the writes from its applications trigger the fault that is rejected by the _nofault() version that wasn't rejected by the _inatomic() version. Instead of getting data, it now just gets a trace buffer filled with: tracing_mark_write: To fix this, on opening of the trace_marker file, allocate per CPU buffers that can be used by the write call. Then when entering the write call, do the following: preempt_disable(); cpu = smp_processor_id(); buffer = per_cpu_ptr(cpu_buffers, cpu); do { cnt = nr_context_switches_cpu(cpu); migrate_disable(); preempt_enable(); ret = copy_from_user(buffer, ptr, size); preempt_disable(); migrate_enable(); } while (!ret && cnt != nr_context_switches_cpu(cpu)); if (!ret) ring_buffer_write(buffer); preempt_enable(); This works similarly to seqcount. As it must enabled preemption to do a copy_from_user() into a per CPU buffer, if it gets preempted, the buffer could be corrupted by another task. To handle this, read the number of context switches of the current CPU, disable migration, enable preemption, copy the data from user space, then immediately disable preemption again. If the number of context switches is the same, the buffer is still valid. Otherwise it must be assumed that the buffer may have been corrupted and it needs to try again. Now the trace_marker write can get the user data even if it has to fault it in, and still not grab any locks of its own. * tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Have trace_marker use per-cpu data to read user space ring buffer: Propagate __rb_map_vma return value to caller tracing: Fix irqoff tracers on failure of acquiring calltime tracing: Fix wakeup tracers on failure of acquiring calltime tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul commit 80b7065ec19485943fa00d60f27b447c3f17069c Merge: 18a7e218cfcdca 528f218b31aac4 Author: Linus Torvalds Date: Thu Oct 9 11:56:59 2025 -0700 Merge tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "A bunch of unrelated fixes: - polling fix for trans fd that ought to have been fixed otherwise back in March, but apparently came back somewhere else... - USB transport buffer overflow fix - Some dentry lifetime rework to handle metadata update for currently opened files in uncached mode, or inode type change in cached mode - a double-put on invalid flush found by syzbot - and finally /sys/fs/9p/caches not advancing buffer and overwriting itself for large contents Thanks to everyone involved!" * tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux: 9p: sysfs_init: don't hardcode error to ENOMEM 9p: fix /sys/fs/9p/caches overwriting itself 9p: clean up comment typos 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN net/9p: fix double req put in p9_fd_cancelled net/9p: Fix buffer overflow in USB transport layer fs/9p: Add p9_debug(VFS) in d_revalidate fs/9p: Invalidate dentry if inode type change detected in cached mode fs/9p: Refresh metadata in d_revalidate for uncached mode too commit 18a7e218cfcdca6666e1f7356533e4c988780b57 Merge: 9361cace0d0795 fea8cdf6738a8b Author: Linus Torvalds Date: Thu Oct 9 11:13:08 2025 -0700 Merge tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Current release - regressions: - mlx5: fix pre-2.40 binutils assembler error Current release - new code bugs: - net: psp: don't assume reply skbs will have a socket - eth: fbnic: fix missing programming of the default descriptor Previous releases - regressions: - page_pool: fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches - tcp: - take care of zero tp->window_clamp in tcp_set_rcvlowat() - don't call reqsk_fastopen_remove() in tcp_conn_request() - eth: - ice: release xa entry on adapter allocation failure - usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Previous releases - always broken: - netfilter: validate objref and objrefmap expressions - sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - eth: - mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - mlx5: prevent tunnel mode conflicts between FDB and NIC IPsec tables - ocelot: fix use-after-free caused by cyclic delayed work Misc: - add support for MediaTek PCIe 5G HP DRMR-H01" * tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits) net: airoha: Fix loopback mode configuration for GDM2 port selftests: drv-net: pp_alloc_fail: add necessary optoins to config selftests: drv-net: pp_alloc_fail: lower traffic expectations selftests: drv-net: fix linter warnings in pp_alloc_fail eth: fbnic: fix reporting of alloc_failed qstats selftests: drv-net: xdp: add test for interface level qstats selftests: drv-net: xdp: rename netnl to ethnl eth: fbnic: fix saving stats from XDP_TX rings on close eth: fbnic: fix accounting of XDP packets eth: fbnic: fix missing programming of the default descriptor selftests: netfilter: query conntrack state to check for port clash resolution selftests: netfilter: nft_fib.sh: fix spurious test failures bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() netfilter: nft_objref: validate objref and objrefmap expressions net: pse-pd: tps23881: Fix current measurement scaling net/mlx5: fix pre-2.40 binutils assembler error net/mlx5e: Do not fail PSP init on missing caps net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock ... commit 9361cace0d07954ad8f2345c057976ab1bf44488 Merge: f6db358deaeafd deabb34b66b96c Author: Linus Torvalds Date: Thu Oct 9 10:51:43 2025 -0700 Merge tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Alexander Gordeev: - Compile the decompressor with -Wno-pointer-sign flag to avoid a clang warning - Fix incomplete conversion to flag output macros in __xsch(), to avoid always zero return value instead of the expected condition code - Remove superfluous newlines from inline assemblies to improve compiler inlining decisions - Expose firmware provided UID Checking state in sysfs regardless of the device presence or state - CIO does not unregister subchannels when the attached device is invalid or unavailable. Update the purge function to remove I/O subchannels if the device number is found on cio_ignore list - Consolidate PAI crypto allocation and cleanup paths - The uv_get_secret_metadata() function has been removed some few months ago, remove also the function mention it in a comment * tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/uv: Fix comment of uv_find_secret() function s390/pai_crypto: Consolidate PAI crypto allocation and cleanup paths s390/cio: Update purge function to unregister the unused subchannels s390/pci: Expose firmware provided UID Checking state in sysfs s390: Remove superfluous newlines from inline assemblies s390/cio/ioasm: Fix __xsch() condition code handling s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR commit f6db358deaeafd9830c8bcba8f76f55f8a14b059 Merge: ec714e371f22f7 f7dfa0f31b13ee Author: Linus Torvalds Date: Thu Oct 9 10:33:50 2025 -0700 Merge tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fixes for several corner cases in error paths and debugging options, related to the new kmalloc_nolock() functionality (Kuniyuki Iwashima, Ran Xiaokai) * tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slub: Don't call lockdep_unregister_key() for immature kmem_cache. slab: Fix using this_cpu_ptr() in preemptible context slab: Add allow_spin check to eliminate kmemleak warnings commit 7ae6152b78316319b9c935eb17c863fbebf54ea6 Author: Enzo Matsumiya Date: Sat Oct 4 19:56:36 2025 -0500 smb: client: remove cfids_invalidation_worker We can do the same cleanup on laundromat. On invalidate_all_cached_dirs(), run laundromat worker with 0 timeout and flush it for immediate + sync cleanup. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit be3898a395f830ef7eaff70df557f57315c61c81 Author: Paulo Alcantara Date: Thu Oct 9 12:41:16 2025 -0300 smb: client: remove redudant assignment in cifs_strict_fsync() Remove redudant assignment of @rc as it will be overwritten by the following cifs_file_flush() call. Reported-by: Steve French Addresses-Coverity: 1665925 Fixes: 210627b0aca9 ("smb: client: fix missing timestamp updates with O_TRUNC") Signed-off-by: Paulo Alcantara (Red Hat) Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit dba9f997c9d9a1cade05d006ed0429a63a4eed32 Author: Paulo Alcantara Date: Tue Oct 7 16:23:25 2025 -0300 smb: client: fix race with fallocate(2) and AIO+DIO AIO+DIO may extend the file size, hence we need to make sure ->i_size is stable across the entire fallocate(2) operation, otherwise it would become a truncate and then inode size reduced back down when it finishes. Fix this by calling netfs_wait_for_outstanding_io() right after acquiring ->i_rwsem exclusively in cifs_fallocate() and then guarantee a stable ->i_size across fallocate(2). Also call netfs_wait_for_outstanding_io() after truncating pagecache to avoid any potential races with writeback. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Fixes: 210627b0aca9 ("smb: client: fix missing timestamp updates with O_TRUNC") Cc: Frank Sorenson Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 Author: Paulo Alcantara Date: Tue Oct 7 16:23:24 2025 -0300 smb: client: fix missing timestamp updates after utime(2) Don't reuse open handle when changing timestamps to prevent the server from disabling automatic timestamp updates as per MS-FSA 2.1.4.17. ---8<--- import os import time filename = '/mnt/foo' def print_stat(prefix): st = os.stat(filename) print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old') os.utime(fd, None) time.sleep(2) os.write(fd, b'foo') os.close(fd) time.sleep(2) print_stat('new') ---8<--- Before patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 After patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025 Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible") Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 57ce9f7793b714fb14a97d502ce926162c3b96b1 Author: Paulo Alcantara Date: Tue Oct 7 16:23:23 2025 -0300 smb: client: fix missing timestamp updates after ftruncate(2) Mask off ATTR_MTIME|ATTR_CTIME bits on ATTR_SIZE (e.g. ftruncate(2)) to prevent the client from sending set info calls and then disabling automatic timestamp updates on server side as per MS-FSA 2.1.4.17. ---8<--- import os import time filename = '/mnt/foo' def print_stat(prefix): st = os.stat(filename) print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old') os.ftruncate(fd, 10) time.sleep(2) os.write(fd, b'foo') os.close(fd) time.sleep(2) print_stat('new') ---8<--- Before patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 13:47:03 2025 Fri Oct 3 13:47:03 2025 new : Fri Oct 3 13:47:00 2025 Fri Oct 3 13:47:03 2025 After patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 13:48:39 2025 Fri Oct 3 13:48:39 2025 new : Fri Oct 3 13:48:41 2025 Fri Oct 3 13:48:41 2025 Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 110fee6b9bb58a5c50047fc2594d415f741b591e Author: Paulo Alcantara Date: Tue Oct 7 16:23:22 2025 -0300 smb: client: fix missing timestamp updates with O_TRUNC Don't call ->set_file_info() on open handle to prevent the server from stopping [cm]time updates automatically as per MS-FSA 2.1.4.17. Fix this by checking for ATTR_OPEN bit earlier in cifs_setattr() to prevent ->set_file_info() from being called when opening a file with O_TRUNC. Do the truncation in ->open() instead. This also saves two roundtrips when opening a file with O_TRUNC and there are currently no open handles to be reused. Before patch: $ mount.cifs //srv/share /mnt -o ... $ cd /mnt $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo old: 2025-10-03 13:26:23.151030500 -0300 2025-10-03 13:26:23.151030500 -0300 new: 2025-10-03 13:26:23.151030500 -0300 2025-10-03 13:26:23.151030500 -0300 After patch: $ mount.cifs //srv/share /mnt -o ... $ cd /mnt $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo old: 2025-10-03 13:28:13.911933800 -0300 2025-10-03 13:28:13.911933800 -0300 new: 2025-10-03 13:28:26.647492700 -0300 2025-10-03 13:28:26.647492700 -0300 Reported-by: Frank Sorenson Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 Author: Fushuai Wang Date: Tue Oct 7 16:26:03 2025 +0800 cifs: Fix copy_to_iter return value check The return value of copy_to_iter() function will never be negative, it is the number of bytes copied, or zero if nothing was copied. Update the check to treat 0 as an error, and return -1 in that case. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Acked-by: Tom Talpey Reviewed-by: David Howells Signed-off-by: Fushuai Wang Signed-off-by: Steve French commit 68d2e2ca1cba9259e943bcd188671b619b9770b4 Author: Henrique Carvalho Date: Fri Oct 3 23:11:43 2025 -0300 smb: client: batch SRV_COPYCHUNK entries to cut round trips smb2_copychunk_range() used to send a single SRV_COPYCHUNK per SRV_COPYCHUNK_COPY IOCTL. Implement variable Chunks[] array in struct copychunk_ioctl and fill it with struct copychunk (MS-SMB2 2.2.31.1.1), bounded by server-advertised limits. This reduces the number of IOCTL requests for large copies. While we are at it, rename a couple variables to follow the terminology used in the specification. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 1643cd51ba975f484a09bed42d1a2014c42c9e6d Author: Markus Elfring Date: Thu Oct 9 17:00:13 2025 +0200 smb: client: Omit an if branch in smb2_find_smb_tcon() Statements from an if branch and the end of this function implementation were equivalent. Thus delete duplicate source code. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 Author: Amit Chaudhary Date: Fri Sep 26 12:08:22 2025 -0700 nvme-multipath: Skip nr_active increments in RETRY disposition For queue-depth I/O policy, this patch fixes unbalanced I/Os across nvme multipaths. Issue Description: The RETRY disposition incorrectly increments ns->ctrl->nr_active counter and reinitializes iostat start-time. In such cases nr_active counter never goes back to zero until that path disconnects and reconnects. Such a path is not chosen for new I/Os if multiple RETRY cases on a given a path cause its queue-depth counter to be artificially higher compared to other paths. This leads to unbalanced I/Os across paths. The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set. base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device") Signed-off-by: Amit Chaudhary Reviewed-by: Randy Jennings Signed-off-by: Keith Busch commit e07e10ae83bdf429f59c8c149173a8c4f29c481e Author: Ketil Johnsen Date: Wed Oct 8 12:51:11 2025 +0200 drm/panthor: Ensure MCU is disabled on suspend Currently the Panthor driver needs the GPU to be powered down between suspend and resume. If this is not done, then the MCU_CONTROL register will be preserved as AUTO, which again will cause a premature FW boot on resume. The FW will go directly into fatal state in this case. This case needs to be handled as there is no guarantee that the GPU will be powered down after the suspend callback on all platforms. The fix is to call panthor_fw_stop() in "pre-reset" path to ensure the MCU_CONTROL register is cleared (set DISABLE). This matches well with the already existing call to panthor_fw_start() from the "post-reset" path. Signed-off-by: Ketil Johnsen Acked-by: Boris Brezillon Reviewed-by: Steven Price Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com commit eb4faf6343889fcd7edba3deeae49fc5a06531fd Author: Kael D'Alcamo Date: Wed Oct 8 22:04:27 2025 +0200 dt-bindings: i2c: hisilicon,hix5hd2: convert to DT schema Convert the Devicetree binding documentation for hisilicon,hix5hd2-i2c from plain text to DT binding schema. Signed-off-by: Kael D'Alcamo Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 434689e971955f487355b3f01e84ee269032bc87 Author: Hans de Goede Date: Wed Oct 1 23:24:16 2025 +0200 gpio: usbio: Add ACPI device-id for MTL-CVF devices Add "INTC10D1" ACPI device-id for MTL-CVF devices, like the Dell Latitude 7450. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2368506 Signed-off-by: Hans de Goede Acked-by: Israel Cepeda Acked-by: Sakari Ailus Signed-off-by: Bartosz Golaszewski commit fea8cdf6738a8b25fccbb7b109b440795a0892cb Author: Lorenzo Bianconi Date: Wed Oct 8 11:27:43 2025 +0200 net: airoha: Fix loopback mode configuration for GDM2 port Add missing configuration for loopback mode in airhoha_set_gdm2_loopback routine. Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251008-airoha-loopback-mode-fix-v2-1-045694fe7f60@kernel.org Signed-off-by: Paolo Abeni commit e6cc7ac0d420a7782cdb6d926245abf40f943f24 Merge: 2854378a00e887 5d683e550540b7 Author: Paolo Abeni Date: Thu Oct 9 11:10:03 2025 +0200 Merge branch 'eth-fbnic-fix-xdp_tx-and-xdp-vs-qstats' Jakub Kicinski says: ==================== eth: fbnic: fix XDP_TX and XDP vs qstats Fix XDP_TX hangs and adjust the XDP statistics to match the definition of qstats. The three problems are somewhat distinct. XDP_TX hangs is a simple coding bug (patch 1). The accounting of XDP packets is all over the place. Fix it to obey qstat rules (packets seen by XDP always counted as Rx packets). Patch 2 fixes the basic accounting, patch 3 touches up saving the stats when rings are freed. Patch 6 corrects reporting of alloc_fail stats which prevented the pp_alloc_fail test from passing. Patches 4, 5, 7, 8, 9 add or fix related test cases. v2: - [patch 2] remove now unnecessary byte adjustment - [patch 8] use seen_fails more v1: https://lore.kernel.org/20251003233025.1157158-1-kuba@kernel.org Testing on fbnic below: $ ./tools/testing/selftests/drivers/net/hw/pp_alloc_fail.py TAP version 13 1..1 fbnic-err: bad MMIO read address 0x80074 fbnic-err: bad MMIO read address 0x80074 # Seen: pkts:20605 fails:40 (pass thrs:12) # ethtool -G change retval: success ok 1 pp_alloc_fail.test_pp_alloc # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 $ ./tools/testing/selftests/drivers/net/xdp.py TAP version 13 1..13 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_sb ok 6 xdp.test_xdp_native_tx_mb # Failed run: pkt_sz 2048, offset 1. Last successful run: pkt_sz 1024, offset 256. Reason: Adjustment failed ok 7 xdp.test_xdp_native_adjst_tail_grow_data ok 8 xdp.test_xdp_native_adjst_tail_shrnk_data # Failed run: pkt_sz 512, offset -256. Last successful run: pkt_sz 512, offset -128. Reason: Adjustment failed ok 9 xdp.test_xdp_native_adjst_head_grow_data # Failed run: pkt_sz (2048) > HDS threshold (1536) and offset 64 > 48 ok 10 xdp.test_xdp_native_adjst_head_shrnk_data ok 11 xdp.test_xdp_native_qstats_pass ok 12 xdp.test_xdp_native_qstats_drop ok 13 xdp.test_xdp_native_qstats_tx # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0 ==================== Link: https://patch.msgid.link/20251007232653.2099376-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 5d683e550540b7afd813ae45e9f727245bd26fe3 Author: Jakub Kicinski Date: Tue Oct 7 16:26:53 2025 -0700 selftests: drv-net: pp_alloc_fail: add necessary optoins to config Add kernel config for error injection as needed by pp_alloc_fail.py Reviewed-by: Simon Horman Fixes: 9da271f825e4 ("selftests: drv-net-hw: add test for memory allocation failures with page pool") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-10-kuba@kernel.org Signed-off-by: Paolo Abeni commit fbb467f0ed95853ff0f1a20f8d53e8c0eccc2ddb Author: Jakub Kicinski Date: Tue Oct 7 16:26:52 2025 -0700 selftests: drv-net: pp_alloc_fail: lower traffic expectations Lower the expected level of traffic in the pp_alloc_fail test and calculate failure counter thresholds based on the traffic rather than using a fixed constant. We only have "QEMU HW" in NIPA right now, and the test (due to debug dependencies) only works on debug kernels in the first place. We need some place for it to pass otherwise it seems to be bit rotting. So lower the traffic threshold so that it passes on QEMU and with a debug kernel... Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-9-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0be740fb22da998bfc61b932796ee39099694a81 Author: Jakub Kicinski Date: Tue Oct 7 16:26:51 2025 -0700 selftests: drv-net: fix linter warnings in pp_alloc_fail Fix linter warnings, it's a bit hard to check for new ones otherwise. W0311: Bad indentation. Found 16 spaces, expected 12 (bad-indentation) C0114: Missing module docstring (missing-module-docstring) W1514: Using open without explicitly specifying an encoding (unspecified-encoding) C0116: Missing function or method docstring (missing-function-docstring) Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-8-kuba@kernel.org Signed-off-by: Paolo Abeni commit 2eecd3a41e67c03e52905c42a1e19cc6266a608a Author: Jakub Kicinski Date: Tue Oct 7 16:26:50 2025 -0700 eth: fbnic: fix reporting of alloc_failed qstats Rx processing under normal circumstances has 3 rings - 2 buffer rings (heads, payloads) and a completion ring. All the rings have a struct fbnic_ring. Make sure we expose alloc_failed counter from the buffer rings, previously only the alloc_failed from the completion ring was reported, even tho all ring types may increment this counter (buffer rings in __fbnic_fill_bdq()). This makes the pp_alloc_fail.py test pass, it expects the qstat to be incrementing as page pool injections happen. Reviewed-by: Simon Horman Fixes: 67dc4eb5fc92 ("eth: fbnic: report software Rx queue stats") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-7-kuba@kernel.org Signed-off-by: Paolo Abeni commit 27ba92560bcc8a121214a22a55217ba54696495c Author: Jakub Kicinski Date: Tue Oct 7 16:26:49 2025 -0700 selftests: drv-net: xdp: add test for interface level qstats Send a non-trivial number of packets and make sure that they are counted correctly in qstats. Per qstats specification XDP is the first layer of the stack so we should see Rx and Tx counters go up for packets which went thru XDP. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 1ad3f62089af2bae95f7c49909c4065f8b1dc4b6 Author: Jakub Kicinski Date: Tue Oct 7 16:26:48 2025 -0700 selftests: drv-net: xdp: rename netnl to ethnl Test uses "netnl" for the ethtool family which is quite confusing (one would expect netdev family would use this name). No functional changes. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit 858b78b24af288bd1143f73aed4e29803ebe8d15 Author: Jakub Kicinski Date: Tue Oct 7 16:26:47 2025 -0700 eth: fbnic: fix saving stats from XDP_TX rings on close When rings are freed - stats get added to the device level stat structs. Save the stats from the XDP_TX ring just as Tx stats. Previously they would be saved to Rx and Tx stats. So we'd not see XDP_TX packets as Rx during runtime but after an down/up cycle the packets would appear in stats. Correct the helper used by ethtool code which does a runtime config switch. Reviewed-by: Simon Horman Fixes: 5213ff086344 ("eth: fbnic: Collect packet statistics for XDP") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 613e9e8dcb7e2523943d3cf965f3183c54b32adb Author: Jakub Kicinski Date: Tue Oct 7 16:26:46 2025 -0700 eth: fbnic: fix accounting of XDP packets Make XDP-handled packets appear in the Rx stats. The driver has been counting XDP_TX packets on the Tx ring, but there wasn't much accounting on the Rx side (the Rx bytes appear to be incremented on XDP_TX but XDP_DROP / XDP_ABORT are only counted as Rx drops). Counting XDP_TX packets (not just bytes) in Rx stats looks like a simple bug of omission. The XDP_DROP handling appears to be intentional. Whether XDP_DROP packets should be counted in interface-level Rx stats is a bit unclear historically. When we were defining qstats, however, we clarified based on operational experience that in this context: name: rx-packets doc: | Number of wire packets successfully received and passed to the stack. For drivers supporting XDP, XDP is considered the first layer of the stack, so packets consumed by XDP are still counted here. fbnic does not obey this requirement. Since XDP support has been added in current release cycle, instead of splitting interface and qstat handling - make them both follow the qstat definition. Another small tweak here is that we count bytes as received on the wire rather than post-XDP bytes (xdp_get_buff_len() vs skb->len). Reviewed-by: Simon Horman Fixes: 5213ff086344 ("eth: fbnic: Collect packet statistics for XDP") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit 7e617d57f2a2f0cc3c5d91b5594df7fd1f2e4459 Author: Jakub Kicinski Date: Tue Oct 7 16:26:45 2025 -0700 eth: fbnic: fix missing programming of the default descriptor XDP_TX typically uses no offloads. To optimize XDP we added a "default descriptor" feature to the chip, which allows us to send XDP frames with just the buffer descriptors (DMA address + length). All the metadata descriptors are derived from the queue config. Commit under Fixes missed adding setting the defaults up when transplanting the code from the prototype driver. Importantly after reset the "request completion" bit is not set. Packets still get sent but there's no completion, so ring is not cleaned up. We can send one ring's worth of packets and then will start dropping all frames that got the XDP_TX action from the XDP prog. Reviewed-by: Simon Horman Fixes: 168deb7b31b2 ("eth: fbnic: Add support for XDP_TX action") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 49836ff2f37dd6d52bfe3153c0bcbd96025a6100 Author: Marc Kleine-Budde Date: Thu Oct 9 08:25:36 2025 +0200 can: m_can: replace Dong Aisheng's old email address Dong Aisheng's old Freescale email is not valid anymore and bounces, replace it by the new NXP one. Reviewed-by: Dong Aisheng Link: https://patch.msgid.link/20251009-m_can-update-email-address-v1-1-30a268587f69@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 2854378a00e8872507a19cb1eb88517fc9584bc5 Merge: 2c95a756e0cfc1 e84945bdc619ed Author: Paolo Abeni Date: Thu Oct 9 10:07:44 2025 +0200 Merge tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Fix crash (call recursion) when nftables synproxy extension is used in an object map. When this feature was added in v5.4 the required hook call validation was forgotten. Fix from Fernando Fernandez Mancera. 2) bridge br_vlan_fill_forward_path_pvid uses incorrect rcu_dereference_protected(); we only have rcu read lock but not RTNL. Fix from Eric Woudstra. Last two patches address flakes in two existing selftests. netfilter pull request nf-25-10-08 * tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: query conntrack state to check for port clash resolution selftests: netfilter: nft_fib.sh: fix spurious test failures bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() netfilter: nft_objref: validate objref and objrefmap expressions ==================== Link: https://patch.msgid.link/20251008125942.25056-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f Author: Herbert Xu Date: Wed Oct 8 15:54:20 2025 +0800 crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. Reported-by: Muhammad Alifa Ramdhan Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") Signed-off-by: Herbert Xu commit ec714e371f22f716a04e6ecb2a24988c92b26911 Merge: 37bfdbc11b2451 f3b601f900902a Author: Linus Torvalds Date: Wed Oct 8 19:24:24 2025 -0700 Merge tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Arnaldo Carvalho de Melo: - Extended 'perf annotate' with DWARF type information (--code-with-type) integration in the TUI, including a 'T' hotkey to toggle it - Enhanced 'perf bench mem' with new mmap() workloads and control over page/chunk sizes - Fix 'perf stat' error handling to correctly display unsupported events - Improved support for Clang cross-compilation - Refactored LLVM and Capstone disasm for modularity - Introduced the :X modifier to exclude an event from automatic regrouping - Adjusted KVM sampling defaults to use the "cycles" event to prevent failures - Added comprehensive support for decoding PowerPC Dispatch Trace Log (DTL) - Updated Arm SPE tracing logic for better analysis of memory and snoop details - Synchronized Intel PMU events and metrics with TMA 5.1 across multiple processor generations - Converted dependencies like libperl and libtracefs to be opt-in - Handle more Rust symbols in kallsyms ('N', debugging) - Improve the python binding to allow for python based tools to use more of the libraries, add a 'ilist' utility to test those new bindings - Various 'perf test' fixes - Kan Liang no longer a perf tools reviewer * tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (192 commits) perf tools: Fix arm64 libjvmti build by generating unistd_64.h perf tests: Don't retest sections in "Object code reading" perf docs: Document building with Clang perf build: Support build with clang perf test coresight: Dismiss clang warning for unroll loop thread perf test coresight: Dismiss clang warning for thread loop perf test coresight: Dismiss clang warning for memcpy thread perf build: Disable thread safety analysis for perl header perf build: Correct CROSS_ARCH for clang perf python: split Clang options when invoking Popen tools build: Align warning options with perf perf disasm: Remove unused evsel from 'struct annotate_args' perf srcline: Fallback between addr2line implementations perf disasm: Make ins__scnprintf() and ins__is_nop() static perf dso: Clean up read_symbol() error handling perf dso: Support BPF programs in dso__read_symbol() perf dso: Move read_symbol() from llvm/capstone to dso perf llvm: Reduce LLVM initialization perf check: Add libLLVM feature perf parse-events: Fix parsing of >30kb event strings ... commit 37bfdbc11b245119210ac9924a192aec8bd07d16 Merge: cd5a0afbdf8033 a154f141604aca Author: Linus Torvalds Date: Wed Oct 8 18:51:00 2025 -0700 Merge tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Fix a resource lookup regression that broke enumeration of hotplugged Thunderbolt devices on several platforms (Yangyu Chen) * tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Fix regression in pci_bus_distribute_available_resources() commit 64cf7d058a005c5c31eb8a0b741f35dc12915d18 Author: Steven Rostedt Date: Wed Oct 8 12:45:10 2025 -0400 tracing: Have trace_marker use per-cpu data to read user space It was reported that using __copy_from_user_inatomic() can actually schedule. Which is bad when preemption is disabled. Even though there's logic to check in_atomic() is set, but this is a nop when the kernel is configured with PREEMPT_NONE. This is due to page faulting and the code could schedule with preemption disabled. Link: https://lore.kernel.org/all/20250819105152.2766363-1-luogengkun@huaweicloud.com/ The solution was to change the __copy_from_user_inatomic() to copy_from_user_nofault(). But then it was reported that this caused a regression in Android. There's several applications writing into trace_marker() in Android, but now instead of showing the expected data, it is showing: tracing_mark_write: After reverting the conversion to copy_from_user_nofault(), Android was able to get the data again. Writes to the trace_marker is a way to efficiently and quickly enter data into the Linux tracing buffer. It takes no locks and was designed to be as non-intrusive as possible. This means it cannot allocate memory, and must use pre-allocated data. A method that is actively being worked on to have faultable system call tracepoints read user space data is to allocate per CPU buffers, and use them in the callback. The method uses a technique similar to seqcount. That is something like this: preempt_disable(); cpu = smp_processor_id(); buffer = this_cpu_ptr(&pre_allocated_cpu_buffers, cpu); do { cnt = nr_context_switches_cpu(cpu); migrate_disable(); preempt_enable(); ret = copy_from_user(buffer, ptr, size); preempt_disable(); migrate_enable(); } while (!ret && cnt != nr_context_switches_cpu(cpu)); if (!ret) ring_buffer_write(buffer); preempt_enable(); It's a little more involved than that, but the above is the basic logic. The idea is to acquire the current CPU buffer, disable migration, and then enable preemption. At this moment, it can safely use copy_from_user(). After reading the data from user space, it disables preemption again. It then checks to see if there was any new scheduling on this CPU. If there was, it must assume that the buffer was corrupted by another task. If there wasn't, then the buffer is still valid as only tasks in preemptable context can write to this buffer and only those that are running on the CPU. By using this method, where trace_marker open allocates the per CPU buffers, trace_marker writes can access user space and even fault it in, without having to allocate or take any locks of its own. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Luo Gengkun Cc: Wattson CI Cc: Linus Torvalds Link: https://lore.kernel.org/20251008124510.6dba541a@gandalf.local.home Fixes: 3d62ab32df065 ("tracing: Fix tracing_marker may trigger page fault during preempt_disable") Reported-by: Runping Lai Tested-by: Runping Lai Closes: https://lore.kernel.org/linux-trace-kernel/20251007003417.3470979-2-runpinglai@google.com/ Signed-off-by: Steven Rostedt (Google) commit de4cbd704731778a2dc833ce5a24b38e5d672c05 Author: Ankit Khushwaha Date: Wed Oct 8 22:55:16 2025 +0530 ring buffer: Propagate __rb_map_vma return value to caller The return value from `__rb_map_vma()`, which rejects writable or executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being ignored. As a result the caller of `__rb_map_vma` always returned 0 even when the mapping had actually failed, allowing it to proceed with an invalid VMA. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008172516.20697-1-ankitkhushwaha.linux@gmail.com Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions") Reported-by: syzbot+ddc001b92c083dbf2b97@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb Signed-off-by: Ankit Khushwaha Signed-off-by: Steven Rostedt (Google) commit d74d6c0e98958aa0bdb6f0a93258a856bda58b97 Author: Viacheslav Dubeyko Date: Tue Sep 2 13:09:58 2025 -0700 ceph: add bug tracking system info to MAINTAINERS This patch adds information about Ceph bug tracking system. [ idryomov: add the same for RBD, don't mention include/linux/ceph/ again ] Signed-off-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit a154f141604acacc0ec64a445d8058a045c308ef Author: Yangyu Chen Date: Wed Oct 8 22:36:52 2025 +0800 PCI: Fix regression in pci_bus_distribute_available_resources() The refactoring in 4292a1e45fd4 ("PCI: Refactor distributing available memory to use loops") switched pci_bus_distribute_available_resources() to operate on an array of bridge windows. That accidentally looked up bus resources via pci_bus_resource_n() and then passed those pointers to helper routines that expect the resource to belong to the device. As soon as we execute that code, pci_resource_num() warned because the resource wasn't in the bridge's resource array. This happens on my AMD Strix Halo machine with Thunderbolt device; the error message is shown below: WARNING: CPU: 6 PID: 272 at drivers/pci/pci.h:471 pci_bus_distribute_available_resources+0x6ad/0x6d0 CPU: 6 UID: 0 PID: 272 Comm: irq/33-pciehp Not tainted 6.17.0+ #1 PREEMPT(voluntary) Hardware name: PELADN YO Series/YO1, BIOS 1.04 05/15/2025 RIP: 0010:pci_bus_distribute_available_resources+0x6ad/0x6d0 Call Trace: pci_bus_distribute_available_resources+0x590/0x6d0 pci_bridge_distribute_available_resources+0x62/0xb0 pci_assign_unassigned_bridge_resources+0x65/0x1b0 pciehp_configure_device+0x92/0x160 pciehp_handle_presence_or_link_change+0x1b5/0x350 pciehp_ist+0x147/0x1c0 Fix the regression by always fetching the resource directly from the bridge with pci_resource_n(bridge, PCI_BRIDGE_RESOURCES + i). This restores the original behaviour while keeping the refactored structure. Then we can successfully assign resources to the Thunderbolt device. Fixes: 4292a1e45fd4 ("PCI: Refactor distributing available memory to use loops") Reported-by: Kenneth R. Crudup Closes: https://lore.kernel.org/r/dd551b81-9e81-480b-aab3-7cf8b8bbc1d0@panix.com Signed-off-by: Yangyu Chen [bhelgaas: trim timestamps, etc from commit log] Signed-off-by: Bjorn Helgaas Tested-By: Kenneth R. Crudup Link: https://lore.kernel.org/r/F833CC81-7C60-48FC-A31C-B9999DCC6FA2@icloud.com Link: https://patch.msgid.link/tencent_8C54420E1B0FF8D804C1B4651DF970716309@qq.com commit 22c73d52a6d05c5a2053385c0d6cd9984732799d Author: Kotresh HR Date: Thu Sep 11 15:02:35 2025 +0530 ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'. But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below. 5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin $echo "data" > /kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1 For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below. v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning [ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ] Link: https://tracker.ceph.com/issues/72167 Signed-off-by: Kotresh HR Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit c66120c84295a0495eb46dcfba829457acd6ef7d Author: Viacheslav Dubeyko Date: Tue Sep 2 12:08:45 2025 -0700 ceph: cleanup in ceph_alloc_readdir_reply_buffer() The Coverity Scan service has reported potential issue in ceph_alloc_readdir_reply_buffer() [1]. If order could be negative one, then it expects the issue in the logic: num_entries = (PAGE_SIZE << order) / size; Technically speaking, this logic [2] should prevent from making the order variable negative: if (!rinfo->dir_entries) return -ENOMEM; However, the allocation logic requires some cleanup. This patch makes sure that calculated bytes count will never exceed ULONG_MAX before get_order() calculation. And it adds the checking of order variable on negative value to guarantee that second half of the function's code will never operate by negative value of order variable even if something will be wrong or to be changed in the first half of the function's logic. v2 Alex Markuze suggested to add unlikely() macro for introduced condition checks. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1198252 [2] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/mds_client.c#L2553 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 98a2850de49c10a1a09642e17978b925f95e6029 Author: Viacheslav Dubeyko Date: Thu Aug 28 11:44:42 2025 -0700 ceph: fix potential NULL dereference issue in ceph_fill_trace() The Coverity Scan service has detected a potential dereference of an explicit NULL value in ceph_fill_trace() [1]. The variable in is declared in the beggining of ceph_fill_trace() [2]: struct inode *in = NULL; However, the initialization of the variable is happening under condition [3]: if (rinfo->head->is_target) { in = req->r_target_inode; } Potentially, if rinfo->head->is_target == FALSE, then in variable continues to be NULL and later the dereference of NULL value could happen in ceph_fill_trace() logic [4,5]: else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP || req->r_op == CEPH_MDS_OP_MKSNAP) && test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) && !test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) { ihold(in); err = splice_dentry(&req->r_dentry, in); if (err < 0) goto done; } This patch adds the checking of in variable for NULL value and it returns -EINVAL error code if it has NULL value. v2 Alex Markuze suggested to add unlikely macro in the checking condition. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1141197 [2] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1522 [3] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1629 [4] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1745 [5] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1777 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 6140f1d43ba9425dc55b12bdfd8877b0c5118d9a Author: Max Kellermann Date: Wed Aug 6 11:48:55 2025 +0200 libceph: add empty check to ceph_con_get_out_msg() This moves the list_empty() checks from the two callers (v1 and v2) into the base messenger.c library. Now the v1/v2 specializations do not need to know about con->out_queue; that implementation detail is now hidden behind the ceph_con_get_out_msg() function. [ idryomov: instead of changing prepare_write_message() to return a bool, move ceph_con_get_out_msg() call out to arrive to the same pattern as in messenger_v2.c ] Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 7399212dcf64d90a6ab239bdd98bd325d922fc7e Author: Max Kellermann Date: Wed Aug 6 11:48:54 2025 +0200 libceph: pass the message pointer instead of loading con->out_msg This pointer is in a register anyway, so let's use that instead of reloading from memory everywhere. [ idryomov: formatting ] Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 59699a5a7114f09f890e86c09a6b32afb5eaa64c Author: Max Kellermann Date: Wed Aug 6 11:48:53 2025 +0200 libceph: make ceph_con_get_out_msg() return the message pointer The caller in messenger_v1.c loads it anyway, so let's keep the pointer in the register instead of reloading it from memory. This eliminates a tiny bit of unnecessary overhead. Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit fbeafe782bd986bf75544526fb9c0284e045e0a4 Author: Viacheslav Dubeyko Date: Wed Jul 16 11:40:49 2025 -0700 ceph: fix potential race condition on operations with CEPH_I_ODIRECT flag The Coverity Scan service has detected potential race conditions in ceph_block_o_direct(), ceph_start_io_read(), ceph_block_buffered(), and ceph_start_io_direct() [1 - 4]. The CID 1590942, 1590665, 1589664, 1590377 contain explanation: "The value of the shared data will be determined by the interleaving of thread execution. Thread shared data is accessed without holding an appropriate lock, possibly causing a race condition (CWE-366)". This patch reworks the pattern of accessing/modification of CEPH_I_ODIRECT flag by means of adding smp_mb__before_atomic() before reading the status of CEPH_I_ODIRECT flag and smp_mb__after_atomic() after clearing set/clear this flag. Also, it was reworked the pattern of using of ci->i_ceph_lock in ceph_block_o_direct(), ceph_start_io_read(), ceph_block_buffered(), and ceph_start_io_direct() methods. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590942 [2] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590665 [3] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1589664 [4] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590377 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 53db6f25ee47cb1265141d31562604e56146919a Author: Viacheslav Dubeyko Date: Tue Jul 8 12:20:57 2025 -0700 ceph: refactor wake_up_bit() pattern of calling The wake_up_bit() is called in ceph_async_unlink_cb(), wake_async_create_waiters(), and ceph_finish_async_create(). It makes sense to switch on clear_bit() function, because it makes the code much cleaner and easier to understand. More important rework is the adding of smp_mb__after_atomic() memory barrier after the bit modification and before wake_up_bit() call. It can prevent potential race condition of accessing the modified bit in other threads. Luckily, clear_and_wake_up_bit() already implements the required functionality pattern: static inline void clear_and_wake_up_bit(int bit, unsigned long *word) { clear_bit_unlock(bit, word); /* See wake_up_bit() for which memory barrier you need to use. */ smp_mb__after_atomic(); wake_up_bit(word, bit); } Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 Author: Viacheslav Dubeyko Date: Fri Jun 13 11:31:08 2025 -0700 ceph: fix potential race condition in ceph_ioctl_lazyio() The Coverity Scan service has detected potential race condition in ceph_ioctl_lazyio() [1]. The CID 1591046 contains explanation: "Check of thread-shared field evades lock acquisition (LOCK_EVASION). Thread1 sets fmode to a new value. Now the two threads have an inconsistent view of fmode and updates to fields correlated with fmode may be lost. The data guarded by this critical section may be read while in an inconsistent state or modified by multiple racing threads. In ceph_ioctl_lazyio: Checking the value of a thread-shared field outside of a locked region to determine if a locked operation involving that thread shared field has completed. (CWE-543)". The patch places fi->fmode field access under ci->i_ceph_lock protection. Also, it introduces the is_file_already_lazy variable that is set under the lock and it is checked later out of scope of critical section. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 5b2d1377d6cc4147492780b0bd95fb9c4cb28d1b Author: Viacheslav Dubeyko Date: Fri Jun 6 12:05:45 2025 -0700 ceph: fix overflowed constant issue in ceph_do_objects_copy() The Coverity Scan service has detected overflowed constant issue in ceph_do_objects_copy() [1]. The CID 1624308 defect contains explanation: "The overflowed value due to arithmetic on constants is too small or unexpectedly negative, causing incorrect computations. Expression bytes, which is equal to -95, where ret is known to be equal to -95, underflows the type that receives it, an unsigned integer 64 bits wide. In ceph_do_objects_copy: Integer overflow occurs in arithmetic on constant operands (CWE-190)". The patch changes the type of bytes variable from size_t to ssize_t with the goal of to be capable to receive negative values. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1624308 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 1ed4471a4ee6cfa902467332042158ca5ef8ad24 Author: Viacheslav Dubeyko Date: Fri Jun 6 12:05:21 2025 -0700 ceph: fix wrong sizeof argument issue in register_session() The Coverity Scan service has detected the wrong sizeof argument in register_session() [1]. The CID 1598909 defect contains explanation: "The wrong sizeof value is used in an expression or as argument to a function. The result is an incorrect value that may cause unexpected program behaviors. In register_session: The sizeof operator is invoked on the wrong argument (CWE-569)". The patch introduces a ptr_size variable that is initialized by sizeof(struct ceph_mds_session *). And this variable is used instead of sizeof(void *) in the code. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1598909 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit b7ed1e29cfe773d648ca09895b92856bd3a2092d Author: Viacheslav Dubeyko Date: Fri Jun 6 12:04:32 2025 -0700 ceph: add checking of wait_for_completion_killable() return value The Coverity Scan service has detected the calling of wait_for_completion_killable() without checking the return value in ceph_lock_wait_for_completion() [1]. The CID 1636232 defect contains explanation: "If the function returns an error value, the error value may be mistaken for a normal value. In ceph_lock_wait_for_completion(): Value returned from a function is not checked for errors before being used. (CWE-252)". The patch adds the checking of wait_for_completion_killable() return value and return the error code from ceph_lock_wait_for_completion(). [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit fa073039466f16141807a0f32840ecdceb00e22a Author: Max Kellermann Date: Fri Dec 6 17:50:14 2024 +0100 ceph: make ceph_start_io_*() killable This allows killing processes that wait for a lock when one process is stuck waiting for the Ceph server. This is similar to the NFS commit 38a125b31504 ("fs/nfs/io: make nfs_start_io_*() killable"). [ idryomov: drop comment on include, formatting ] Signed-off-by: Max Kellermann Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 27c0a7b05d13a0dc54ed0b95fc12218210fdea1a Author: Eric Biggers Date: Thu Jul 31 12:02:27 2025 -0700 libceph: Use HMAC-SHA256 library instead of crypto_shash Use the HMAC-SHA256 library functions instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit cd5a0afbdf8033dc83786315d63f8b325bdba2fd Merge: ed4d6e92463e8d 3f39f56520374c Author: Linus Torvalds Date: Wed Oct 8 11:44:21 2025 -0700 Merge tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - Qualcomm: add Glymur CPUCP mailbox binding - Xilinx Zynq: misc cleanup - MediaTek: - add new GPUEB mailbox driver - cmdq: remove pm_runtime calls from send_data - gce: make clock-names optional - misc: - change mailbox-altera maintainer - remove redundant 'fast_io' in regmap_config - mhuv3: Remove no_free_ptr * tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() mailbox: add MediaTek GPUEB IPI mailbox dt-bindings: mailbox: Add MT8196 GPUEB Mailbox mailbox: zynqmp-ipi: Fix SGI cleanup on unbind mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call mailbox: remove unneeded 'fast_io' parameter in regmap_config dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding MAINTAINERS: Change mailbox-altera maintainer mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer commit ed4d6e92463e8dfe6dfb971f8edc6b5d9ea18722 Merge: 99cedb6b8f4101 451bb963289818 Author: Linus Torvalds Date: Wed Oct 8 11:22:27 2025 -0700 Merge tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio Pull more VFIO updates from Alex Williamson: - Optimizations for DMA map and unmap opertions through the type1 vfio IOMMU backend. This uses various means of batching and hints from the mm structures to improve efficiency and therefore performance, resulting in a significant speedup for huge page use cases (Li Zhe) - Expose supported device migration features through debugfs (Cédric Le Goater) * tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio: vfio: Dump migration features under debugfs vfio/type1: optimize vfio_unpin_pages_remote() vfio/type1: introduce a new member has_rsvd for struct vfio_dma vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() vfio/type1: optimize vfio_pin_pages_remote() mm: introduce num_pages_contiguous() commit 99cedb6b8f4101e2780f10b9e76d2f346a1e4316 Merge: 7c8dcac8d72da9 8b87f67b4c8745 Author: Linus Torvalds Date: Wed Oct 8 09:44:38 2025 -0700 Merge tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Conversions to yaml/json schema and fixes for input-related device tree bindings - New drivers: - Awinic AW86927 haptic chip - Hynitron CST816x series controller - Himax HX852x(ES) touchscreen controller - Fix uinput to not leak kernel memory via a gap in uinput_ff_upload_compat structure - Prevent overflow in pressure calculation in tsc2007 driver causing phantom touches - Make the Atmel maxTouch driver support generic touchscreen configuration (flip, rotate, etc) - Drop support for platform data in tca8418_keypad, pxa27x-keypad, spear-keyboard and twl4030_keypad drivers, they all now rely on generic device properties for configuration - Other assorted changes and fixes * tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits) Input: atmel_mxt_ts - allow reset GPIO to sleep Input: aw86927 - fix error code in probe() Input: psxpad-spi - add a check for the return value of spi_setup() Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Input: aw86927 - add driver for Awinic AW86927 dt-bindings: input: Add Awinic AW86927 dt-bindings: touchscreen: remove touchscreen.txt dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node dt-bindings: touchscreen: convert eeti bindings to json schema Input: pm8941-pwrkey - disable wakeup for resin by default dt-bindings: input: pm8941-pwrkey: Document wakeup-source property Input: add driver for Hynitron CST816x series dt-bindings: input: touchscreen: add hynitron cst816x series Input: imx6ul_tsc - set glitch threshold by DTS property dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold dt-bindings: touchscreen: add debounce-delay-us property Input: ps2-gpio - fix typo Input: atmel_mxt_ts - add support for generic touchscreen configurations dt-bindings: input: maxtouch: add common touchscreen properties dt-bindings: touchscreen: convert zet6223 bindings to json schema ... commit 7c8dcac8d72da94328f4de7bf98320b75710da1f Merge: 0d97f2067c166e c0d36727bf39bb Author: Linus Torvalds Date: Wed Oct 8 09:38:31 2025 -0700 Merge tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix zstd regression - Ensure ti driver algorithm are set as async - Revert patch disabling SHA1 in FIPS mode - Fix RNG set_ent null-pointer dereference * tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: rng - Ensure set_ent is always present Revert "crypto: testmgr - desupport SHA-1 for FIPS 140" crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos crypto: zstd - Fix compression bug caused by truncation commit c834a97962c708ff5bb8582ca76b0e1225feb675 Author: Steven Rostedt Date: Wed Oct 8 11:49:43 2025 -0400 tracing: Fix irqoff tracers on failure of acquiring calltime The functions irqsoff_graph_entry() and irqsoff_graph_return() both call func_prolog_dec() that will test if the data->disable is already set and if not, increment it and return. If it was set, it returns false and the caller exits. The caller of this function must decrement the disable counter, but misses doing so if the calltime fails to be acquired. Instead of exiting out when calltime is NULL, change the logic to do the work if it is not NULL and still do the clean up at the end of the function if it is NULL. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008114943.6f60f30f@gandalf.local.home Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph") Reported-by: Sasha Levin Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-2-sashal@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit 4f7bf54b07e5acf79edd58dafede4096854776cd Author: Steven Rostedt Date: Wed Oct 8 11:48:35 2025 -0400 tracing: Fix wakeup tracers on failure of acquiring calltime The functions wakeup_graph_entry() and wakeup_graph_return() both call func_prolog_preempt_disable() that will test if the data->disable is already set and if not, increment it and disable preemption. If it was set, it returns false and the caller exits. The caller of this function must decrement the disable counter, but misses doing so if the calltime fails to be acquired. Instead of exiting out when calltime is NULL, change the logic to do the work if it is not NULL and still do the clean up at the end of the function if it is NULL. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008114835.027b878a@gandalf.local.home Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph") Reported-by: Sasha Levin Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-1-sashal@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit f0c029d2ff42499a62c873c14428f02bf94c28af Author: Thorsten Blum Date: Wed Oct 1 15:09:07 2025 +0200 tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to simplify and improve osnoise_cpus_write(). Remove the manual NUL-termination. No functional changes intended. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251001130907.364673-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Signed-off-by: Steven Rostedt (Google) commit e9a9dcb4ccb32446165800a9d83058e95c4833d2 Author: Pavel Begunkov Date: Wed Oct 8 13:39:01 2025 +0100 io_uring/zcrx: increment fallback loop src offset Don't forget to adjust the source offset in io_copy_page(), otherwise it'll be copying into the same location in some cases for highmem setups. Fixes: e67645bb7f3f4 ("io_uring/zcrx: prepare fallback for larger pages") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 Author: Pavel Begunkov Date: Wed Oct 8 13:38:06 2025 +0100 io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow. Reported-and-tested-by: Matthias Jasny Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests") Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 455281c0ef4e2cabdfe2e8b83fa6010d5210811c Author: Pedro Demarchi Gomes Date: Tue Oct 7 15:12:05 2025 -0300 loop: remove redundant __GFP_NOWARN flag GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Pedro Demarchi Gomes Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit deabb34b66b96c941ac0b3d01a6a6804c3274a78 Author: Thomas Huth Date: Thu Oct 2 17:54:23 2025 +0200 s390/uv: Fix comment of uv_find_secret() function The uv_get_secret_metadata() function has been removed some months ago, so we should not mention it in the comment anymore. Fixes: a42831f0b74dc ("s390/uv: Remove uv_get_secret_metadata function") Signed-off-by: Thomas Huth Acked-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit ca7a2317993efa26eb2100a1523548f1b3a07af0 Merge: f4ace70faa8ff2 a27539810e1e61 Author: Takashi Iwai Date: Wed Oct 8 13:52:14 2025 +0200 Merge tag 'asoc-fix-v6.18-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A small pile of fixes, almost all for the Intel and SOF code surrounding management of the host buffer. We've also got one fix for Meson and new device IDs and quirk supporting the RT722VB. commit e84945bdc619ed4243ba4298dbb8ca2062026474 Author: Florian Westphal Date: Thu Oct 2 15:05:41 2025 +0200 selftests: netfilter: query conntrack state to check for port clash resolution Jakub reported this self test flaking occasionally (fails, but passes on re-run) on debug kernels. This is because the test checks for elapsed time to determine if both connections were established in parallel. Rework this to no longer depend on timing. Use busywait helper to check that both sockets have moved to established state and then query the conntrack engine for the two entries. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/ Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux") Signed-off-by: Florian Westphal commit a126ab6b26f107f4eb100c8c77e9f10b706f26e6 Author: Florian Westphal Date: Thu Oct 2 15:00:06 2025 +0200 selftests: netfilter: nft_fib.sh: fix spurious test failures Jakub reports spurious failure of nft_fib.sh test. This is caused by a subtle bug inherited when i moved faulty ping from one test case to another. nft_fib.sh not only checks that the fib expression matched, it also records the number of matches and then validates we have the expected count. When I did this it was under the assumption that we would have 0 to n matching packets. In case of the failure, the entry has n+1 matching packets. This happens because ping_unreachable helper uses "ping -c 1 -w 1", instead of the intended "-W". -w alters the meaning of -c (count), namely, its then treated as number of wanted *replies* instead of "number of packets to send". So, in some cases, ping -c 1 -w 1 ends up sending two packets which then makes the test fail due to the higher-than-expected packet count. Fix the actual bug (s/-w/-W) and also change the error handling: 1. Show the number of expected packets in the error message 2. Always try to delete the key from the set. Else, later test that makes sure we don't have unexpected keys in there will always fail as well. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netfilter-devel/20250927090709.0b3cd783@kernel.org/ Fixes: 98287045c979 ("selftests: netfilter: move fib vrf test to nft_fib.sh") Signed-off-by: Florian Westphal commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 Author: Eric Woudstra Date: Tue Oct 7 10:15:01 2025 +0200 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 7 locks held by socat/410: #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..] #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge] Use to correct helper, non _rcu variant requires RTNL mutex. Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") Signed-off-by: Eric Woudstra Signed-off-by: Florian Westphal commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 Author: Fernando Fernandez Mancera Date: Wed Oct 8 12:08:16 2025 +0200 netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error: synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") Reported-by: Georg Pfuetzenreuter Closes: https://bugzilla.suse.com/1250237 Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit ca965a70ea57cd12f19a422a28a97aab5e1d031b Merge: a12f0bc764da37 a9e30a22d6f23a Author: Marc Kleine-Budde Date: Wed Oct 8 10:19:46 2025 +0200 Merge patch series "can: m_can: fix pm_runtime and CAN state handling" Marc Kleine-Budde says: The first patch fixes a pm_runtime imbalance in the m_can_platform driver. The rest of this series fixes the CAN state handling in the m_can driver: - add the missing state transition from "Error Warning" back to "Error Active" (patch 2) - address the fact that in some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the CAN state and CAN error counters over an internal reset cycle. Set the correct CAN state during ifup and system resume (patches 3+4) Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-0-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a9e30a22d6f23a2684c248871cad4c3061181639 Author: Marc Kleine-Budde Date: Tue Aug 12 16:58:31 2025 +0200 can: m_can: fix CAN state in system PM A suspend/resume cycle on a down interface results in the interface coming up in Error Active state. A suspend/resume cycle on an Up interface will always result in Error Active state, regardless of the actual CAN state. During suspend, only set running interfaces to CAN_STATE_SLEEPING. During resume only touch the CAN state of running interfaces. For wakeup sources, set the CAN state depending on the Protocol Status Regitser (PSR), for non wakeup source interfaces m_can_start() will do the same. Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 Author: Marc Kleine-Budde Date: Wed Aug 6 18:24:12 2025 +0200 can: m_can: m_can_chip_config(): bring up interface in correct state In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the CAN state and CAN error counters over an internal reset cycle. An external reset is not always possible, due to the shared reset with the other CAN core. This caused the core not always be in Error Active state when bringing up the controller. Instead of always setting the CAN state to Error Active in m_can_chip_config(), fix this by reading and decoding the Protocol Status Regitser (PSR) and set the CAN state accordingly. Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3d9db29b45f970d81acf61cf91a65442efbeb997 Author: Marc Kleine-Budde Date: Wed Aug 6 16:56:15 2025 +0200 can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active The CAN Error State is determined by the receive and transmit error counters. The CAN error counters decrease when reception/transmission is successful, so that a status transition back to the Error Active status is possible. This transition is not handled by m_can_handle_state_errors(). Add the missing detection of the Error Active state to m_can_handle_state_errors() and extend the handling of this state in m_can_handle_state_change(). Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 Author: Marc Kleine-Budde Date: Wed Aug 6 17:46:32 2025 +0200 can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") moved the PM runtime enable from the m_can core driver into the m_can_platform. That patch forgot to move the pm_runtime_disable() to m_can_plat_remove(), so that unloading the m_can_platform driver causes an "Unbalanced pm_runtime_enable!" error message. Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the problem. Cc: Patrik Flykt Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a12f0bc764da3781da2019c60826f47a6d7ed64f Author: Celeste Liu Date: Tue Sep 30 14:53:39 2025 +0800 can: gs_usb: gs_make_candev(): populate net_device->dev_port The gs_usb driver supports USB devices with more than 1 CAN channel. In old kernel before 3.15, it uses net_device->dev_id to distinguish different channel in userspace, which was done in commit acff76fa45b4 ("can: gs_usb: gs_make_candev(): set netdev->dev_id"). But since 3.15, the correct way is populating net_device->dev_port. And according to documentation, if network device support multiple interface, lack of net_device->dev_port SHALL be treated as a bug. Fixes: acff76fa45b4 ("can: gs_usb: gs_make_candev(): set netdev->dev_id") Cc: stable@vger.kernel.org Signed-off-by: Celeste Liu Link: https://patch.msgid.link/20250930-gs-usb-populate-net_device-dev_port-v1-1-68a065de6937@coelacanthus.name Signed-off-by: Marc Kleine-Budde commit 2a27f6a8fb5722223d526843040f747e9b0e8060 Author: Celeste Liu Date: Tue Sep 30 19:34:28 2025 +0800 can: gs_usb: increase max interface to U8_MAX This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change. During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device. [1]: https://github.com/cherry-embedded/HSCanT-hardware Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Reported-by: Runcheng Lu Cc: stable@vger.kernel.org Reviewed-by: Vincent Mailhol Signed-off-by: Celeste Liu Link: https://patch.msgid.link/20250930-gs-usb-max-if-v5-1-863330bf6666@coelacanthus.name Signed-off-by: Marc Kleine-Budde commit 229c586b5e86979badb7cb0d38717b88a9e95ddd Author: T Pratham Date: Tue Oct 7 19:27:51 2025 +0530 crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent commits add necessary changes in these alg frameworks. However, this is being recommended for use in all crypto algs [1] instead of setting reqsize using crypto_*_set_reqsize(). Using cra_reqsize in skcipher algorithms, hence, causes memory corruptions and crashes as the underlying functions in the algorithm framework have not been updated to set the reqsize properly from cra_reqsize. [2] Add proper set_reqsize calls in the skcipher init function to properly initialize reqsize for these algorithms in the framework. [1]: https://lore.kernel.org/linux-crypto/aCL8BxpHr5OpT04k@gondor.apana.org.au/ [2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b Fixes: afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)") Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 8b87f67b4c87452e21721887fa8dec1f4c6b2b7c Merge: 30989f67650cbf c7866ee0a9ddd9 Author: Dmitry Torokhov Date: Tue Oct 7 21:53:13 2025 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.18 merge window. commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 Author: Marek Vasut Date: Sun Oct 5 04:33:10 2025 +0200 Input: atmel_mxt_ts - allow reset GPIO to sleep The reset GPIO is not toggled in any critical section where it couldn't sleep, allow the reset GPIO to sleep. This allows the driver to operate reset GPIOs connected to I2C GPIO expanders. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20251005023335.166483-1-marek.vasut@mailbox.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 2c95a756e0cfc19af6d0b32b0c6cf3bada334998 Author: Thomas Wismer Date: Mon Oct 6 22:40:29 2025 +0200 net: pse-pd: tps23881: Fix current measurement scaling The TPS23881 improves on the TPS23880 with current sense resistors reduced from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the current measurement. However, the latest TPS23881 data sheet from May 2023 still shows the scaling of the TPS23880 model. Fixes: 7f076ce3f1733 ("net: pse-pd: tps23881: Add support for power limit and measurement features") Signed-off-by: Thomas Wismer Acked-by: Kory Maincent Link: https://patch.msgid.link/20251006204029.7169-2-thomas@wismer.xyz Signed-off-by: Jakub Kicinski commit e475fa420e6c53a5023e89dbf0d51bd027b5a776 Author: Arnd Bergmann Date: Mon Oct 6 13:56:34 2025 +0200 net/mlx5: fix pre-2.40 binutils assembler error Old binutils versions require a slightly stricter syntax for the .arch_extension directive and fail with the extra semicolon: /tmp/cclfMnj9.s:656: Error: unknown architectural extension `simd;' Drop the semicolon to make it work with all supported toolchain version. Link: https://lore.kernel.org/all/20251001163655.GA370262@ax162/ Reported-by: Paolo Abeni Reported-by: Naresh Kamboju Suggested-by: Nathan Chancellor Fixes: fd8c8216648c ("net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs") Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Reviewed-by: Patrisious Haddad Link: https://patch.msgid.link/20251006115640.497169-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 0d97f2067c166eb495771fede9f7b73999c67f66 Merge: a8cdf51cda30f7 9aa791c8d7bfc4 Author: Linus Torvalds Date: Tue Oct 7 16:20:19 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM development updates from Russell King: - Use string choices helpers - Add support for HAVE_FUNCTION_GRAPH_FREGS * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9457/1: ftrace: Implement HAVE_FUNCTION_GRAPH_FREGS ARM: 9456/1: mm: fault: use string choices helper ARM: 9454/1: kernel: bios32: use string choices helper ARM: 9451/1: mm: l2x0: use string choices helper commit f52ce0ea90c83a28904c7cc203a70e6434adfecb Author: Yang Shi Date: Mon Sep 29 13:24:02 2025 -0700 mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace:   mte_clear_page_tags+0x14/0x24   set_huge_pte_at+0x25c/0x280   hugetlb_change_protection+0x220/0x430   change_protection+0x5c/0x8c   mprotect_fixup+0x10c/0x294   do_mprotect_pkey.constprop.0+0x2e0/0x3d4   __arm64_sys_mprotect+0x24/0x44   invoke_syscall+0x50/0x160   el0_svc_common+0x48/0x144   do_el0_svc+0x30/0xe0   el0_svc+0x30/0xf0   el0t_64_sync_handler+0xc4/0x148   el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup. Link: https://lkml.kernel.org/r/20250929202402.1663290-1-yang@os.amperecomputing.com Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages") Signed-off-by: Yang Shi Tested-by: Carl Worth Reviewed-by: Christoph Lameter (Ampere) Reviewed-by: Catalin Marinas Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Anshuman Khandual Reviewed-by: Dev Jain Cc: Muchun Song Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 28bba2c2935e219d6cb6946e16b9a0b7c47913be Author: Ryan Roberts Date: Fri Oct 3 16:52:36 2025 +0100 fsnotify: pass correct offset to fsnotify_mmap_perm() fsnotify_mmap_perm() requires a byte offset for the file about to be mmap'ed. But it is called from vm_mmap_pgoff(), which has a page offset. Previously the conversion was done incorrectly so let's fix it, being careful not to overflow on 32-bit platforms. Discovered during code review. Link: https://lkml.kernel.org/r/20251003155238.2147410-1-ryan.roberts@arm.com Fixes: 066e053fe208 ("fsnotify: add pre-content hooks on mmap()") Signed-off-by: Ryan Roberts Reviewed-by: Kiryl Shutsemau Cc: Amir Goldstein Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Author: Jakub Acs Date: Wed Oct 1 09:03:52 2025 +0000 mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 [ 44.617726] Call Trace: [ 44.617926] [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro. Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel] Link: https://lore.kernel.org/oe-kbuild-all/202510030449.VfSaAjvd-lkp@intel.com/ Link: https://lkml.kernel.org/r/20251001090353.57523-2-acsjakub@amazon.de Fixes: 7677f7fd8be7 ("userfaultfd: add minor fault registration mode") Signed-off-by: Jakub Acs Signed-off-by: Miguel Ojeda Acked-by: David Hildenbrand Acked-by: SeongJae Park Tested-by: Alice Ryhl Tested-by: Miguel Ojeda Cc: Xu Xin Cc: Chengming Zhou Cc: Peter Xu Cc: Axel Rasmussen Cc: Signed-off-by: Andrew Morton commit b93af2cc8e036754c0d9970d9ddc47f43cc94b9f Author: SeongJae Park Date: Mon Sep 29 17:44:09 2025 -0700 mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address space operation set implementation (vaddr) calls pte_offset_map_lock() inside the page table walk callback function. This is for reading and writing page table accessed bits. If pte_offset_map_lock() fails, it retries by returning the page table walk callback function with ACTION_AGAIN. pte_offset_map_lock() can continuously fail if the target is a pmd migration entry, though. Hence it could cause an infinite page table walk if the migration cannot be done until the page table walk is finished. This indeed caused a soft lockup when CPU hotplugging and DAMON were running in parallel. Avoid the infinite loop by simply not retrying the page table walk. DAMON is promising only a best-effort accuracy, so missing access to such pages is no problem. Link: https://lkml.kernel.org/r/20250930004410.55228-1-sj@kernel.org Fixes: 7780d04046a2 ("mm/pagewalkers: ACTION_AGAIN if pte_offset_map_lock() fails") Signed-off-by: SeongJae Park Reported-by: Xinyu Zheng Closes: https://lore.kernel.org/20250918030029.2652607-1-zhengxinyu6@huawei.com Acked-by: Hugh Dickins Cc: [6.5+] Signed-off-by: Andrew Morton commit 9658d698a8a83540bf6a6c80d13c9a61590ee985 Author: Lance Yang Date: Tue Sep 30 16:10:40 2025 +0800 mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage When splitting an mTHP and replacing a zero-filled subpage with the shared zeropage, try_to_map_unused_to_zeropage() currently drops several important PTE bits. For userspace tools like CRIU, which rely on the soft-dirty mechanism for incremental snapshots, losing the soft-dirty bit means modified pages are missed, leading to inconsistent memory state after restore. As pointed out by David, the more critical uffd-wp bit is also dropped. This breaks the userfaultfd write-protection mechanism, causing writes to be silently missed by monitoring applications, which can lead to data corruption. Preserve both the soft-dirty and uffd-wp bits from the old PTE when creating the new zeropage mapping to ensure they are correctly tracked. Link: https://lkml.kernel.org/r/20250930081040.80926-1-lance.yang@linux.dev Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Lance Yang Suggested-by: David Hildenbrand Suggested-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Dev Jain Acked-by: Zi Yan Reviewed-by: Liam R. Howlett Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Mathew Brost Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Usama Arif Cc: Vlastimil Babka Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 1ce6473d17e78e3cb9a40147658231731a551828 Author: Lance Yang Date: Mon Sep 22 10:14:58 2025 +0800 mm/thp: fix MTE tag mismatch when replacing zero-filled subpages When both THP and MTE are enabled, splitting a THP and replacing its zero-filled subpages with the shared zeropage can cause MTE tag mismatch faults in userspace. Remapping zero-filled subpages to the shared zeropage is unsafe, as the zeropage has a fixed tag of zero, which may not match the tag expected by the userspace pointer. KSM already avoids this problem by using memcmp_pages(), which on arm64 intentionally reports MTE-tagged pages as non-identical to prevent unsafe merging. As suggested by David[1], this patch adopts the same pattern, replacing the memchr_inv() byte-level check with a call to pages_identical(). This leverages existing architecture-specific logic to determine if a page is truly identical to the shared zeropage. Having both the THP shrinker and KSM rely on pages_identical() makes the design more future-proof, IMO. Instead of handling quirks in generic code, we just let the architecture decide what makes two pages identical. [1] https://lore.kernel.org/all/ca2106a3-4bb2-4457-81af-301fd99fbef4@redhat.com Link: https://lkml.kernel.org/r/20250922021458.68123-1-lance.yang@linux.dev Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Lance Yang Reported-by: Qun-wei Lin Closes: https://lore.kernel.org/all/a7944523fcc3634607691c35311a5d59d1a3f8d4.camel@mediatek.com Suggested-by: David Hildenbrand Acked-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Usama Arif Reviewed-by: Catalin Marinas Reviewed-by: Wei Yang Cc: Alistair Popple Cc: andrew.yang Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: Charlie Jenkins Cc: Chinwen Chang Cc: Dev Jain Cc: Domenico Cerasuolo Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Joshua Hahn Cc: Kairui Song Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Rakie Kim Cc: Rik van Riel Cc: Roman Gushchin Cc: Ryan Roberts Cc: Samuel Holland Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit fcc0669c5aa681994c507b50f1c706c969d99730 Author: Shakeel Butt Date: Mon Sep 22 15:02:03 2025 -0700 memcg: skip cgroup_file_notify if spinning is not allowed Generally memcg charging is allowed from all the contexts including NMI where even spinning on spinlock can cause locking issues. However one call chain was missed during the addition of memcg charging from any context support. That is try_charge_memcg() -> memcg_memory_event() -> cgroup_file_notify(). The possible function call tree under cgroup_file_notify() can acquire many different spin locks in spinning mode. Some of them are cgroup_file_kn_lock, kernfs_notify_lock, pool_workqeue's lock. So, let's just skip cgroup_file_notify() from memcg charging if the context does not allow spinning. Alternative approach was also explored where instead of skipping cgroup_file_notify(), we defer the memcg event processing to irq_work [1]. However it adds complexity and it was decided to keep things simple until we need more memcg events with !allow_spinning requirement. Link: https://lore.kernel.org/all/5qi2llyzf7gklncflo6gxoozljbm4h3tpnuv4u4ej4ztysvi6f@x44v7nz2wdzd/ [1] Link: https://lkml.kernel.org/r/20250922220203.261714-1-shakeel.butt@linux.dev Fixes: 3ac4638a734a ("memcg: make memcg_rstat_updated nmi safe") Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Closes: https://lore.kernel.org/all/20250905061919.439648-1-yepeilin@google.com/ Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Kumar Kartikeya Dwivedi Cc: Muchun Song Cc: Peilin Ye Cc: Roman Gushchin Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 90eb9ae35727a662789c850efaf225ffe5511fae Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:58 2025 +0300 lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt KHO test stores physical addresses of the preserved folios directly in fdt. Use kho_preserve_vmalloc() instead of it and kho_restore_vmalloc() to retrieve the addresses after kexec. This makes the test more scalable from one side and adds tests coverage for kho_preserve_vmalloc() from the other. Link: https://lkml.kernel.org/r/20250921054458.4043761-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit a667300bd53f272a3055238bcefe108f88836270 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:57 2025 +0300 kho: add support for preserving vmalloc allocations A vmalloc allocation is preserved using binary structure similar to global KHO memory tracker. It's a linked list of pages where each page is an array of physical address of pages in vmalloc area. kho_preserve_vmalloc() hands out the physical address of the head page to the caller. This address is used as the argument to kho_vmalloc_restore() to restore the mapping in the vmalloc address space and populate it with the preserved pages. [pasha.tatashin@soleen.com: free chunks using free_page() not kfree()] Link: https://lkml.kernel.org/r/mafs0a52idbeg.fsf@kernel.org [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20250921054458.4043761-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Signed-off-by: Andrew Morton commit 8375b76517cb52bac0903071feedc218c45d74d2 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:56 2025 +0300 kho: replace kho_preserve_phys() with kho_preserve_pages() to make it clear that KHO operates on pages rather than on a random physical address. The kho_preserve_pages() will be also used in upcoming support for vmalloc preservation. Link: https://lkml.kernel.org/r/20250921054458.4043761-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Reviewed-by: Jason Gunthorpe Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 469661d0d3a55a7ba1e7cb847c26baf78cace086 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:55 2025 +0300 kho: check if kho is finalized in __kho_preserve_order() Patch series "kho: add support for preserving vmalloc allocations", v5. Following the discussion about preservation of memfd with LUO [1] these patches add support for preserving vmalloc allocations. Any KHO uses case presumes that there's a data structure that lists physical addresses of preserved folios (and potentially some additional metadata). Allowing vmalloc preservations with KHO allows scalable preservation of such data structures. For instance, instead of allocating array describing preserved folios in the fdt, memfd preservation can use vmalloc: preserved_folios = vmalloc_array(nr_folios, sizeof(*preserved_folios)); memfd_luo_preserve_folios(preserved_folios, folios, nr_folios); kho_preserve_vmalloc(preserved_folios, &folios_info); This patch (of 4): Instead of checking if kho is finalized in each caller of __kho_preserve_order(), do it in the core function itself. Link: https://lkml.kernel.org/r/20250921054458.4043761-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20250921054458.4043761-2-rppt@kernel.org Link: https://lore.kernel.org/all/20250807014442.3829950-30-pasha.tatashin@soleen.com [1] Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit fa02d505a3ef7c5c55b7b2aee1df2bdc178ce1ad Author: Umang Jain Date: Mon Sep 29 13:10:24 2025 +0530 MAINTAINERS, .mailmap: update Umang's email address Map my new professional email address in .mailmap and also update the IMX283 driver entry with the same. At the same time, update my role to a reviewer for the IMX283 driver. Link: https://lkml.kernel.org/r/20250929074025.84407-1-uajain@igalia.com Signed-off-by: Umang Jain Signed-off-by: Andrew Morton commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 Author: Shuhao Fu Date: Wed Oct 8 00:17:09 2025 +0800 drm/nouveau: fix bad ret code in nouveau_bo_move_prep In `nouveau_bo_move_prep`, if `nouveau_mem_map` fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped. Cc: stable@vger.kernel.org Reviewed-by: Petr Vorel Signed-off-by: Shuhao Fu Fixes: 9ce523cc3bf2 ("drm/nouveau: separate buffer object backing memory from nvkm structures") Signed-off-by: Danilo Krummrich commit a8cdf51cda30f7461a98af821e8a28c5cb5f8878 Merge: 16d1ba7c9675ee b157dd228cf0ee Author: Linus Torvalds Date: Tue Oct 7 13:04:44 2025 -0700 Merge tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - tools headers: rename missed CONFIG_CFI_CLANG in merge (Carlos Llamas) - kconfig: Avoid prompting for transitional symbols * tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: tools headers: kcfi: rename missed CONFIG_CFI_CLANG kconfig: Avoid prompting for transitional symbols commit 16d1ba7c9675ee16e0f7fb22d51cd2898aab625d Merge: fdb8d00af919d2 16abbabc004bed Author: Linus Torvalds Date: Tue Oct 7 12:48:06 2025 -0700 Merge tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two small fixes for the recently performed code refactoring (Shigeru Yoshida) and missing handling of direction parameter in DMA debug code (Petr Tesarik)" * tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: fix direction in dma_alloc direction traces kmsan: fix kmsan_handle_dma() to avoid false positives commit 4468490251c0392e0c87a3f1c1c1585a89f6ffa6 Author: Markus Elfring Date: Tue Oct 7 18:25:27 2025 +0200 smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Return directly after a call of the function “genlmsg_new” failed at the beginning. * Delete the label “fail” which became unnecessary with this refactoring. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit fdb8d00af919d2403a9e40261cf3f78f0fd75212 Merge: fbd2e22716d30d 10df039834f84a Author: Linus Torvalds Date: Tue Oct 7 12:13:26 2025 -0700 Merge tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small nvmem and fastrpc fixes that missed the cut-off to get into 6.17-final, due to me being slow in getting them out, my fault, not the maintainers of these subsystems :( Anyway, better late than never. Changes included in here are: - nvmem fix for automatic module loading - fastrpc driver fixes for reported issues All of these have been in linux-next for weeks (4?) with no reported issues" * tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: fastrpc: Skip reference for DMA handles misc: fastrpc: fix possible map leak in fastrpc_put_args misc: fastrpc: Fix fastrpc_map_lookup operation misc: fastrpc: Save actual DMA size in fastrpc_map structure nvmem: layouts: fix automatic module loading commit fbd2e22716d30d77a35affd6493f4bd74fe2e961 Merge: 3d15d6c1b3dd9e 82a051e2553b9e Author: Linus Torvalds Date: Tue Oct 7 11:41:06 2025 -0700 Merge tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some staging driver fixes that missed 6.17-final due to my travel schedule. They fix a number of reported issues in the axis-fifo driver, one of which was just independently discovered by someone else today so someone is looking at this code. All of these fixes have been in linux-next for many weeks with no reported issues" * tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: axis-fifo: flush RX FIFO on read errors staging: axis-fifo: fix TX handling on copy_from_user() failure staging: axis-fifo: fix maximum TX packet length check commit 3d15d6c1b3dd9eda173d474db82daf093afa4562 Merge: 56019d4ff8dd5e a699213d4e6ef4 Author: Linus Torvalds Date: Tue Oct 7 11:36:01 2025 -0700 Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty driver fix from Greg KH: "Here is a single driver fix for the qcom_geni_serial driver. It has been in my tree for weeks, but missed being sent to you for 6.17-final due to travel on my side. This fixes a reported regression for this driver that prevents 6.17 from working properly on this platform. It has been in linux-next for many weeks with no reported issues" * tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: qcom-geni: Fix blocked task commit ce47f7498598f4cf8729a6b93722c98814385e78 Author: Markus Elfring Date: Sun Oct 5 20:36:33 2025 +0200 smb: client: Use common code in cifs_do_create() Use a label once more so that a bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Acked-by: Enzo Matsumiya Reviewed-by: David Howells Signed-off-by: Steve French commit 56019d4ff8dd5ef16915c2605988c4022a46019c Merge: 89b59f0979926f dea00c204e7e99 Author: Linus Torvalds Date: Tue Oct 7 11:18:54 2025 -0700 Merge tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "Fix RZ/G3E driver introduction fall-out (Geert Uytterhoeven) and improve the compilation and installation of the thermal library for user space (Emil Dahl Juhl and Sascha Hauer)" * tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: tools: lib: thermal: expose thermal_exit symbols tools: lib: thermal: don't preserve owner in install tools: lib: thermal: use pkg-config to locate libnl3 thermal: renesas: Fix RZ/G3E fall-out commit d07e142641417e67f3bfc9d8ba3da8a69c39cfcd Author: Jesse Agate Date: Fri Jun 13 14:20:53 2025 -0400 drm/amd/display: Incorrect Mirror Cositing [WHY] hinit/vinit are incorrect in the case of mirroring. [HOW] Cositing sign must be flipped when image is mirrored in the vertical or horizontal direction. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Samson Tam Signed-off-by: Jesse Agate Signed-off-by: Brendan Leder Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 5949e7c4890c3cf65e783c83c355b95e21f10dba Author: Fangzhi Zuo Date: Wed Sep 24 14:37:01 2025 -0400 drm/amd/display: Enable Dynamic DTBCLK Switch [WHAT] Since dcn35, DTBCLK can be disabled when no DP2 sink connected for power saving purpose. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 2e97663760e5fb7ee14f399c68e57b894f01e505 Author: Lijo Lazar Date: Mon Oct 6 10:39:03 2025 +0530 drm/amdgpu: Report individual reset error If reinitialization of one of the GPUs fails after reset, it logs failure on all subsequent GPUs eventhough they have resumed successfully. A sample log where only device at 0000:95:00.0 had a failure - amdgpu 0000:15:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:65:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:75:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:85:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:95:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:e5:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:f5:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:05:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:15:00.0: amdgpu: GPU reset end with ret = -5 To avoid confusion, report the error for each device separately and return the first error as the overall result. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a107aeb6a2150dd552673caefc771e2222d584de Author: Christian König Date: Mon Oct 6 12:45:25 2025 +0200 drm/amdgpu: partially revert "revert to old status lock handling v3" The CI systems are pointing out list corruptions, so we still need to fix something here. Keep the asserts, but revert the lock changes for now. Fixes: 59e4405e9ee2 ("drm/amdgpu: revert to old status lock handling v3") Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ddbfac152830e38d488ff8e45ab7eaf5d72f8527 Author: Ard Biesheuvel Date: Thu Oct 2 23:00:45 2025 +0200 drm/amd/display: Fix unsafe uses of kernel mode FPU The point of isolating code that uses kernel mode FPU in separate compilation units is to ensure that even implicit uses of, e.g., SIMD registers for spilling occur only in a context where this is permitted, i.e., from inside a kernel_fpu_begin/end block. This is important on arm64, which uses -mgeneral-regs-only to build all kernel code, with the exception of such compilation units where FP or SIMD registers are expected to be used. Given that the compiler may invent uses of FP/SIMD anywhere in such a unit, none of its code may be accessible from outside a kernel_fpu_begin/end block. This means that all callers into such compilation units must use the DC_FP start/end macros, which must not occur there themselves. For robustness, all functions with external linkage that reside there should call dc_assert_fp_enabled() to assert that the FPU context was set up correctly. Fix this for the DCN35, DCN351 and DCN36 implementations. Cc: Austin Zheng Cc: Jun Lei Cc: Harry Wentland Cc: Leo Li Cc: Rodrigo Siqueira Cc: Alex Deucher Cc: "Christian König" Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Ard Biesheuvel Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher commit bd8acfcfce7d711372c2c45f4c5e24ea650c26bf Author: Jesse.Zhang Date: Sat Oct 4 22:39:24 2025 +0800 drm/amd/pm: Disable VCN queue reset on SMU v13.0.6 due to regression Disable VCN reset capability for the program 4 as it's causing regressions. Fixes: 9d20f37a106f ("drm/amd/pm: Add VCN reset support for SMU v13.0.6") Reviewed-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8d557eab3a396c5c0068d7b4ad920f2bf261e484 Author: Jesse.Zhang Date: Mon Sep 29 16:44:28 2025 +0800 drm/amdgpu: Fix general protection fault in amdgpu_vm_bo_reset_state_machine After GPU reset with VRAM loss, a general protection fault occurs during user queue restoration when accessing vm_bo->vm after spinlock release in amdgpu_vm_bo_reset_state_machine. The root cause is that vm_bo points to the last entry from the list_for_each_entry loop, but this becomes invalid after the spinlock is released. Accessing vm_bo->vm at this point leads to memory corruption. Crash log shows: [ 326.981811] Oops: general protection fault, probably for non-canonical address 0x4156415741e58ac8: 0000 [#1] SMP NOPTI [ 326.981820] CPU: 13 UID: 0 PID: 1035 Comm: kworker/13:3 Tainted: G E 6.16.0+ #25 PREEMPT(voluntary) [ 326.981826] Tainted: [E]=UNSIGNED_MODULE [ 326.981827] Hardware name: Gigabyte Technology Co., Ltd. X870E AORUS PRO ICE/X870E AORUS PRO ICE, BIOS F3i 12/19/2024 [ 326.981831] Workqueue: events amdgpu_userq_restore_worker [amdgpu] [ 326.981999] RIP: 0010:amdgpu_vm_assert_locked+0x16/0x70 [amdgpu] [ 326.982094] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 ff 74 45 48 8b 87 80 03 00 00 48 85 c0 74 40 <48> 8b b8 80 01 00 00 48 85 ff 74 3b 8b 05 0c b7 0e f0 85 c0 75 05 [ 326.982098] RSP: 0018:ffffaa91c2a6bc20 EFLAGS: 00010206 [ 326.982100] RAX: 4156415741e58948 RBX: ffff9e8f013e8330 RCX: 0000000000000000 [ 326.982102] RDX: 0000000000000005 RSI: 000000001d254e88 RDI: ffffffffc144814a [ 326.982104] RBP: ffffaa91c2a6bc68 R08: 0000004c21a25674 R09: 0000000000000001 [ 326.982106] R10: 0000000000000001 R11: dccaf3f2f82863fc R12: ffff9e8f013e8000 [ 326.982108] R13: ffff9e8f013e8000 R14: 0000000000000000 R15: ffff9e8f09980000 [ 326.982110] FS: 0000000000000000(0000) GS:ffff9e9e79995000(0000) knlGS:0000000000000000 [ 326.982112] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 326.982114] CR2: 000055ed6c9caa80 CR3: 0000000797060000 CR4: 0000000000750ef0 [ 326.982116] PKRU: 55555554 Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 9b608fe94870fe46bd2c41fcda99e74dabd6bbc6 Author: Lijo Lazar Date: Mon Sep 29 17:59:26 2025 +0530 drm/amdgpu: Check swus/ds for switch state save For saving switch state, check if the GPU is having SWUS/DS architecture. Otherwise, skip saving. Reported-by: Roman Elshin Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4602 Fixes: 1dd2fa0e00f1 ("drm/amdgpu: Save and restore switch state") Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1f086d2508ebe494d13fd587d1f5e2b908379efc Author: Felix Kuehling Date: Fri Oct 3 16:05:46 2025 -0400 drm/amdkfd: Fix two comments in kfd_ioctl.h Queue read and write pointers are "to KFD", not "from KFD". Suggested-by: Robert Liu Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Reviewed-by: Robert Liu Signed-off-by: Alex Deucher commit 4538a93bbbf104d7b7ce769bec48ff360bce583b Author: Lijo Lazar Date: Fri Sep 19 11:04:44 2025 +0530 drm/amd/pm: Avoid interface mismatch messaging PMFW interface version is not used by some IP implementations like SMU v13.0.6/12, instead rely on PMFW version checks. Avoid the log if interface version is not used. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit b809ca91a5b7eccba065460200512f83cc87987a Author: Jesse.Zhang Date: Thu Sep 25 18:02:18 2025 +0800 drm/amdgpu: Merge amdgpu_vm_set_pasid into amdgpu_vm_init As KFD no longer uses a separate PASID, the global amdgpu_vm_set_pasid()function is no longer necessary. Merge its functionality directly intoamdgpu_vm_init() to simplify code flow and eliminate redundant locking. v2: remove superflous check adjust amdgpu_vm_fin and remove amdgpu_vm_set_pasid (Chritian) v3: drop amdgpu_vm_assert_locked (Chritian) Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4614 Fixes: 59e4405e9ee2 ("drm/amdgpu: revert to old status lock handling v3") Reviewed-by: Christian König Suggested-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8dbac5cf8bd55a01a8a0e792a6ed866856506f60 Author: Shaoyun Liu Date: Wed Sep 24 21:40:57 2025 -0400 drm/amd/amdgpu: Fix the mes version that support inv_tlbs MES version 0x83 is not stable to use the inv_tlbs API. Defer it to 0x84 vertsion. Fixes: 85442bac8466 ("drm/amd/amdgpu: Fix the mes version that support inv_tlbs") Signed-off-by: Shaoyun Liu Reviewed-by: Michael Chen Signed-off-by: Alex Deucher commit c760bcda83571e07b72c10d9da175db5051ed971 Author: Mario Limonciello Date: Thu Sep 25 14:10:57 2025 -0500 drm/amd: Check whether secure display TA loaded successfully [Why] Not all renoir hardware supports secure display. If the TA is present but the feature isn't supported it will fail to load or send commands. This shows ERR messages to the user that make it seems like there is a problem. [How] Check the resp_status of the context to see if there was an error before trying to send any secure display commands. Reviewed-by: Alex Deucher Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1415 Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 7574f30337e19045f03126b4c51f525b84e5049e Author: Philip Yang Date: Mon Sep 15 15:57:32 2025 -0400 drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svm_range_restore_pages calls mmap_read_unlock then returns. This causes deadlock and system hangs later because mmap read or write lock cannot be taken. Downgrade mmap write lock to read lock if draining retry fault fix this bug. Signed-off-by: Philip Yang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 58e6fc2fb94f0f409447e5d46cf6a417b6397fbc Author: Philip Yang Date: Tue May 27 11:09:53 2025 -0400 drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid hold the kfd process reference to ensure it doesn't get destroyed while sending the segfault event to user space. Calling kfd_lookup_process_by_pid as function parameter leaks the kfd process refcount and miss the NULL pointer check if app process is already destroyed. Fixes: 2d274bf7099b ("amd/amdkfd: Trigger segfault for early userptr unmmapping") Signed-off-by: Philip Yang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 0c6734288566f9642037882c4cb1684d5ecc6b57 Author: Heng Zhou Date: Fri Sep 26 11:07:44 2025 +0800 drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O. There is some probability that reset workqueue is blocked by KIQ I/O for 10+ seconds after gpu hangs. So we need to add a in_reset check during each KIQ register poll. Signed-off-by: Heng Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0e190a0446ec517666dab4691b296a9b758e590f Author: Timur Kristóf Date: Thu Sep 25 20:45:25 2025 +0200 drm/amd/display: Disable scaling on DCE6 for now Scaling doesn't work on DCE6 at the moment, the current register programming produces incorrect output when using fractional scaling (between 100-200%) on resolutions higher than 1080p. Disable it until we figure out how to program it properly. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit a7dc87f3448bea5ebe054f14e861074b9c289c65 Author: Timur Kristóf Date: Thu Sep 25 20:45:24 2025 +0200 drm/amd/display: Properly disable scaling on DCE6 SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended. This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up. Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c Author: Timur Kristóf Date: Thu Sep 25 20:45:23 2025 +0200 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op. Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c Author: Timur Kristóf Date: Thu Sep 25 20:45:22 2025 +0200 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs Without these, it's impossible to program these registers. Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 Author: Alex Deucher Date: Thu Sep 25 20:45:21 2025 +0200 drm/amdgpu: Add additional DCE6 SCL registers Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") Signed-off-by: Alex Deucher commit f7dfa0f31b13ee5f2ba598cdfcab9a831ed8a6b8 Author: Kuniyuki Iwashima Date: Tue Oct 7 05:25:33 2025 +0000 slub: Don't call lockdep_unregister_key() for immature kmem_cache. syzbot reported the lockdep splat below in __kmem_cache_release(). [0] The problem is that __kmem_cache_release() could be called from do_kmem_cache_create() before init_kmem_cache_cpus() registers the lockdep key. Let's perform lockdep_unregister_key() only when init_kmem_cache_cpus() has been done, which we can determine by checking s->cpu_slab [0]: WARNING: CPU: 1 PID: 6128 at kernel/locking/lockdep.c:6606 lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Modules linked in: CPU: 1 UID: 0 PID: 6128 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Code: 50 e4 0f 48 3b 44 24 10 0f 84 26 fe ff ff e8 bd cd 17 09 e8 e8 ce 17 09 41 f7 c7 00 02 00 00 74 bd fb 40 84 ed 75 bc eb cd 90 <0f> 0b 90 e9 19 ff ff ff 90 0f 0b 90 e9 2a ff ff ff 48 c7 c7 d0 ac RSP: 0018:ffffc90003e870d0 EFLAGS: 00010002 RAX: eb1525397f5bdf00 RBX: ffff88803c121148 RCX: 1ffff920007d0dfc RDX: 0000000000000000 RSI: ffffffff8acb1500 RDI: ffffffff8b1dd0e0 RBP: 00000000ffffffea R08: ffffffff8eb5aa37 R09: 1ffffffff1d6b546 R10: dffffc0000000000 R11: fffffbfff1d6b547 R12: 0000000000000000 R13: ffff88814d1b8900 R14: 0000000000000000 R15: 0000000000000203 FS: 00007f773f75e6c0(0000) GS:ffff88812712f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdaea3af52 CR3: 000000003a5ca000 CR4: 00000000003526f0 Call Trace: __kmem_cache_release+0xe3/0x1e0 mm/slub.c:7696 do_kmem_cache_create+0x74e/0x790 mm/slub.c:8575 create_cache mm/slab_common.c:242 [inline] __kmem_cache_create_args+0x1ce/0x330 mm/slab_common.c:340 nfsd_file_cache_init+0x1d6/0x530 fs/nfsd/filecache.c:816 nfsd_startup_generic fs/nfsd/nfssvc.c:282 [inline] nfsd_startup_net fs/nfsd/nfssvc.c:377 [inline] nfsd_svc+0x393/0x900 fs/nfsd/nfssvc.c:786 nfsd_nl_threads_set_doit+0x84a/0x960 fs/nfsd/nfsctl.c:1639 genl_family_rcv_msg_doit+0x212/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:742 ____sys_sendmsg+0x508/0x820 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f77400eeec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f773f75e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f7740345fa0 RCX: 00007f77400eeec9 RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000006 RBP: 00007f7740171f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7740346038 R14: 00007f7740345fa0 R15: 00007ffce616f8d8 [alexei.starovoitov@gmail.com: simplify the fix] Link: https://lore.kernel.org/all/20251007052534.2776661-1-kuniyu@google.com/ Fixes: 83382af9ddc3 ("slab: Make slub local_(try)lock more precise for LOCKDEP") Reported-by: syzbot+a6f4d69b9b23404bbabf@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e4a3d1.a00a0220.298cc0.0471.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Vlastimil Babka commit 610cb23bcc75bcd9fead3e41cbd867cccd0eb229 Author: Helge Deller Date: Tue Oct 7 17:08:16 2025 +0200 parisc: Add initial kernel-side perf_event support Signed-off-by: Helge Deller commit 38492c5743f8b7213ca86f0cd72ea625af35d5ef Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Oct 7 04:46:47 2025 +0100 gen_init_cpio: Ignore fsync() returning EINVAL on pipes The reproducer: echo | ./usr/gen_init_cpio /dev/stdin > /dev/null fsync() on a pipe fd returns -EINVAL, which makes gen_init_cpio fail. Ignore -EINVAL from fsync(). Fixes: ae18b94099b0 ("gen_init_cpio: support -o parameter") Cc: David Disseldorp Cc: Nicolas Schier Signed-off-by: Dmitry Safonov Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20251007-gen_init_cpio-pipe-v2-1-b098ab94b58a@arista.com Signed-off-by: Nathan Chancellor commit 7ded7d37e5f5b36b4acd74380156cf07b6640c5b Author: Nathan Chancellor Date: Mon Oct 6 14:39:56 2025 -0700 scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs Commit 27758d8c2583 ("kbuild: enable -Werror for hostprogs") unconditionally enabled -Werror for the compiler, assembler, and linker when building the host programs, as the build footprint of the host programs is small (thus risk of build failures from warnings are low) and that stage of the build may not have Kconfig values (thus CONFIG_WERROR could not be used as a precondition). While turning warnings into errors unconditionally happens in a few places within the kernel, it can be disruptive to people who may be building with newer compilers, such as while doing a bisect. While it is possible to avoid this behavior by passing HOSTCFLAGS=-w or HOSTCFLAGS=-Wno-error, it may not be the most intuitive for regular users not intimately familiar with Kbuild. Avoid being disruptive to the entire build by depending on the explicit opt-in of CONFIG_WERROR or W=e to enable -Werror and the like while building the host programs. While this means there is a small portion of the build that does not have -Werror enabled (namely scripts/kconfig/* and scripts/basic/fixdep), it is better than not having it altogether. Fixes: 27758d8c2583 ("kbuild: enable -Werror for hostprogs") Acked-by: Miguel Ojeda Reported-by: Askar Safin Closes: https://lore.kernel.org/20251005011100.1035272-1-safinaskar@gmail.com/ Reviewed-by: Thomas Weißschuh Tested-by: Miguel Ojeda # Rust Link: https://patch.msgid.link/20251006-kbuild-hostprogs-werror-fix-v1-1-23cf1ffced5c@kernel.org Signed-off-by: Nathan Chancellor commit 89b59f0979926fb22ae7ecb8f4a1b5ecdb04b3d4 Merge: abdf766d149c51 dd68fd72e516d5 Author: Linus Torvalds Date: Tue Oct 7 09:45:07 2025 -0700 Merge tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These fix a driver bug, clean up two pieces of code and improve the fwnode API consistency: - Add missing synchronization between interface updates in the ACPI battery driver (Rafael Wysocki) - Remove open coded check for cpu_feature_enabled() from acpi_processor_power_init_bm_check() (Mario Limonciello) - Remove redundant rcu_read_lock/unlock() under spinlock from ghes_notify_hed() in the ACPI APEI support code (pengdonglin) - Make the .get_next_child_node() callback in the ACPI fwnode backend skip ACPI devices that are not present for consistency with the analogous callback in the OF fwnode backend (Sakari Ailus)" * tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: property: Return present device nodes only on fwnode interface ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock ACPI: battery: Add synchronization between interface updates x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() commit abdf766d149c51fb256118f73be947d7a82f702e Merge: 522ba450b56fff 53d4d315d4f7f1 Author: Linus Torvalds Date: Tue Oct 7 09:39:51 2025 -0700 Merge tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are cpufreq fixes and cleanups on top of the material merged previously, a power management core code fix and updates of the runtime PM framework including unit tests, documentation updates and introduction of auto-cleanup macros for runtime PM "resume and get" and "get without resuming" operations. Specifics: - Make cpufreq drivers setting the default CPU transition latency to CPUFREQ_ETERNAL specify a proper default transition latency value instead which addresses a regression introduced during the 6.6 cycle that broke CPUFREQ_ETERNAL handling (Rafael Wysocki) - Make the cpufreq CPPC driver use a proper transition delay value when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency() to indicate an error condition (Rafael Wysocki) - Make cppc_get_transition_latency() return a negative error code to indicate error conditions instead of using CPUFREQ_ETERNAL for this purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael Wysocki, Gopi Krishna Menon) - Fix device leak in the mediatek cpufreq driver (Johan Hovold) - Set target frequency on all CPUs sharing a policy during frequency updates in the tegra186 cpufreq driver and make it initialize all cores to max frequencies (Aaron Kling) - Rust cpufreq helper cleanup (Thorsten Blum) - Make pm_runtime_put*() family of functions return 1 when the given device is already suspended which is consistent with the documentation (Brian Norris) - Add basic kunit tests for runtime PM API contracts and update return values in kerneldoc comments for the runtime PM API (Brian Norris, Dan Carpenter) - Add auto-cleanup macros for runtime PM "resume and get" and "get without resume" operations, use one of them in the PCI core and drop the existing "free" macro introduced for similar purpose, but somewhat cumbersome to use (Rafael Wysocki) - Make the core power management code avoid waiting on device links marked as SYNC_STATE_ONLY which is consistent with the handling of those device links elsewhere (Pin-yen Lin)" * tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: docs/zh_CN: Fix malformed table docs/zh_TW: Fix malformed table PM: runtime: Fix error checking for kunit_device_register() PM: runtime: Introduce one more usage counter guard cpufreq: Drop unused symbol CPUFREQ_ETERNAL ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() PCI/sysfs: Use runtime PM guard macro for auto-cleanup PM: runtime: Add auto-cleanup macros for "resume and get" operations cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure PM: sleep: Do not wait on SYNC_STATE_ONLY device links PM: runtime: Update kerneldoc return codes PM: runtime: Make put{,_sync}() return 1 when already suspended PM: runtime: Add basic kunit tests for API contracts commit 522ba450b56fff29f868b1552bdc2965f55de7ed Merge: 971199ad2a0f1b 112104e2b72c5c Author: Linus Torvalds Date: Tue Oct 7 09:28:37 2025 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "There's a bunch of patches here across drivers/clk/ to migrate drivers to use struct clk_ops::determine_rate() instead of the round_rate() one so that we can remove the round_rate clk_op entirely. Brian has taken up that task which nobody else has wanted to do for close to a decade. Thanks Brian! This is all prerequisite work to get to the real task of improving the clk rate setting process. Once we have determine_rate() used everywhere, we'll be able to do things like chain the rate request structs in linked lists to order the rate setting operations or add more parameters without having to change every clk driver in existence. It's also nice to not have multiple ways to do something which just causes confusion for clk driver authors. Overall I'm glad this is getting done. Beyond this change we also have a tweak to the clk_lookup() function in the core framework to use hashing on the clk name instead of a clk tree walk with string comparisons. We _still_ rely on the clk name to be unique, because historically we've used globally unique strings to describe the clk tree topology. This tree walk becomes increasingly slow as more clks are added to the system. Searching from the roots for a duplicate is simple but pretty dumb and it wastes boot time so we're using a hash table as an improvement. Ideally we wouldn't rely on the strings to be unique at all, relegating them to simply debug information, but that is future work that will likely require some sort of Kconfig knob indicating strings aren't used for topology description. Outside of the core framework changes we have the usual new SoC support and fixes to clk drivers for things that were discovered once the clks were used by consumer drivers. Nothing in particular is jumping out at me in the "misc" pile, except maybe the Amlogic driver that has gone through a refactoring. That series got a fix from testing in -next though so it seems likely that things have been getting good test coverage for a couple weeks already" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (299 commits) clk: microchip: core: remove duplicate roclk_determine_rate() reset: aspeed: register AST2700 reset auxiliary bus device dt-bindings: clock: ast2700: modify soc0/1 clock define clk: tegra: do not overallocate memory for bpmp clocks clk: ep93xx: Use int type to store negative error codes clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: loongson2: Add clock definitions for Loongson-2K0300 SoC clk: loongson2: Avoid hardcoding firmware name of the reference clock clk: loongson2: Allow zero divisors for dividers clk: loongson2: Support scale clocks with an alternative mode clk: loongson2: Allow specifying clock flags for gate clock dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible clk: clocking-wizard: Fix output clock register offset for Versal platforms clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() clk: mmp: pxa1908: Instantiate power driver through auxiliary bus clk: s2mps11: add support for S2MPG10 PMIC clock dt-bindings: clock: samsung,s2mps11: add s2mpg10 dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings clk: stm32: introduce clocks for STM32MP21 platform dt-bindings: stm32: add STM32MP21 clocks and reset bindings ... commit 1bcc3f87912779f66cdf1789a066046536ca6ccc Author: Yan Zhao Date: Wed Sep 24 10:42:55 2025 -0700 KVM: selftests: Test prefault memory during concurrent memslot removal Expand the prefault memory selftest to add a regression test for a KVM bug where KVM's retry logic would result in (breakable) deadlock due to the memslot deletion waiting on prefaulting to release SRCU, and prefaulting waiting on the memslot to fully disappear (KVM uses a two-step process to delete memslots, and KVM x86 retries page faults if a to-be-deleted, a.k.a. INVALID, memslot is encountered). To exercise concurrent memslot remove, spawn a second thread to initiate memslot removal at roughly the same time as prefaulting. Test memslot removal for all testcases, i.e. don't limit concurrent removal to only the success case. There are essentially three prefault scenarios (so far) that are of interest: 1. Success 2. ENOENT due to no memslot 3. EAGAIN due to INVALID memslot For all intents and purposes, #1 and #2 are mutually exclusive, or rather, easier to test via separate testcases since writing to non-existent memory is trivial. But for #3, making it mutually exclusive with #1 _or_ #2 is actually more complex than testing memslot removal for all scenarios. The only requirement to let memslot removal coexist with other scenarios is a way to guarantee a stable result, e.g. that the "no memslot" test observes ENOENT, not EAGAIN, for the final checks. So, rather than make memslot removal mutually exclusive with the ENOENT scenario, simply restore the memslot and retry prefaulting. For the "no memslot" case, KVM_PRE_FAULT_MEMORY should be idempotent, i.e. should always fail with ENOENT regardless of how many times userspace attempts prefaulting. Pass in both the base GPA and the offset (instead of the "full" GPA) so that the worker can recreate the memslot. Signed-off-by: Yan Zhao Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250924174255.2141847-1-seanjc@google.com Signed-off-by: Sean Christopherson commit e2080b70c5851a132547bec3bd7dde847e649678 Author: Markus Elfring Date: Tue Oct 7 17:45:28 2025 +0200 smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() Use two additional labels so that another bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit 0a98b40b8fe1bdebf3cb78924cef60af322c4437 Author: Markus Elfring Date: Tue Oct 7 16:32:25 2025 +0200 smb: client: Return a status code only as a constant in cifs_spnego_key_instantiate() * Return a status code without storing it in an intermediate variable. * Delete the local variable “ret” and the label “error” which became unnecessary with this refactoring. Signed-off-by: Markus Elfring Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 912b9fd7c7775060900ad315f0ceb616f9381bc3 Author: Helge Deller Date: Tue Oct 7 16:57:33 2025 +0200 parisc: Report software alignment faults via perf Signed-off-by: Helge Deller commit 6fb2e09c3abca500ad3ef88afdd291515323d668 Author: Helge Deller Date: Tue Oct 7 16:56:48 2025 +0200 parisc: Report emulation faults via perf Signed-off-by: Helge Deller commit 971199ad2a0f1b2fbe14af13369704aff2999988 Merge: 221533629550e9 f620d66af31658 Author: Linus Torvalds Date: Tue Oct 7 08:59:25 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Preserve old 'tt_core' UAPI for Hisilicon L3C PMU driver - Ensure linear alias of kprobes instruction page is not writable - Fix kernel stack unwinding from BPF - Fix build warnings from the Fujitsu uncore PMU documentation - Fix hang with deferred 'struct page' initialisation and MTE - Consolidate KPTI page-table re-writing code * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Do not flag the zero page as PG_mte_tagged docs: perf: Fujitsu: Fix htmldocs build warnings and errors arm64: mm: Move KPTI helpers to mmu.c tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 arm64: kprobes: call set_memory_rox() for kprobe page drivers/perf: hisi: Add tt_core_deprecated for compatibility commit 221533629550e920580ab428f13ffebf54063b95 Merge: c746c3b5169831 b595edcb24727e Author: Linus Torvalds Date: Tue Oct 7 08:40:15 2025 -0700 Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Unify guest entry code for KVM and MSHV (Sean Christopherson) - Switch Hyper-V MSI domain to use msi_create_parent_irq_domain() (Nam Cao) - Add CONFIG_HYPERV_VMBUS and limit the semantics of CONFIG_HYPERV (Mukesh Rathor) - Add kexec/kdump support on Azure CVMs (Vitaly Kuznetsov) - Deprecate hyperv_fb in favor of Hyper-V DRM driver (Prasanna Kumar T S M) - Miscellaneous enhancements, fixes and cleanups (Abhishek Tiwari, Alok Tiwari, Nuno Das Neves, Wei Liu, Roman Kisel, Michael Kelley) * tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hyperv: Remove the spurious null directive line MAINTAINERS: Mark hyperv_fb driver Obsolete fbdev/hyperv_fb: deprecate this in favor of Hyper-V DRM driver Drivers: hv: Make CONFIG_HYPERV bool Drivers: hv: Add CONFIG_HYPERV_VMBUS option Drivers: hv: vmbus: Fix typos in vmbus_drv.c Drivers: hv: vmbus: Fix sysfs output format for ring buffer index Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() x86/hyperv: Switch to msi_create_parent_irq_domain() mshv: Use common "entry virt" APIs to do work in root before running guest entry: Rename "kvm" entry code assets to "virt" to genericize APIs entry/kvm: KVM: Move KVM details related to signal/-EINTR into KVM proper mshv: Handle NEED_RESCHED_LAZY before transferring to guest x86/hyperv: Add kexec/kdump support on Azure CVMs Drivers: hv: Simplify data structures for VMBus channel close message Drivers: hv: util: Cosmetic changes for hv_utils_transport.c mshv: Add support for a new parent partition configuration clocksource: hyper-v: Skip unnecessary checks for the root partition hyperv: Add missing field to hv_output_map_device_interrupt commit 3f39f56520374cf56872644acf9afcc618a4b674 Author: Jason-JH Lin Date: Fri Aug 29 17:15:58 2025 +0800 mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() (mailbox.c). This caused lockdep warnings such as "sleeping function called from invalid context" when running with lockdebug enabled. The BUG report: BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1 Hardware name: Google Ciri sku0/unprovisioned board (DT) Workqueue: imgsys_runner imgsys_runner_func Call trace: dump_backtrace+0x100/0x120 show_stack+0x20/0x2c dump_stack_lvl+0x84/0xb4 dump_stack+0x18/0x48 __might_resched+0x354/0x4c0 __might_sleep+0x98/0xe4 __pm_runtime_resume+0x70/0x124 cmdq_mbox_send_data+0xe4/0xb1c msg_submit+0x194/0x2dc mbox_send_message+0x190/0x330 imgsys_cmdq_sendtask+0x1618/0x2224 imgsys_runner_func+0xac/0x11c process_one_work+0x638/0xf84 worker_thread+0x808/0xcd0 kthread+0x24c/0x324 ret_from_fork+0x10/0x20 Additionally, pm_runtime_put_autosuspend() should be invoked from the GCE IRQ handler to ensure the hardware has actually completed its work. To resolve these issues, remove the pm_runtime calls from cmdq_mbox_send_data() and delegate power management responsibilities to the client driver. Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") Signed-off-by: Jason-JH Lin Signed-off-by: Jassi Brar commit b157dd228cf0ee24b2414712abd82bd3a8d5b009 Author: Carlos Llamas Date: Mon Oct 6 22:51:32 2025 +0000 tools headers: kcfi: rename missed CONFIG_CFI_CLANG Commit 23ef9d439769 ("kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI") missed one instance of CONFIG_CFI_CLANG. Rename it to match the original kernel header. This addresses the following build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/cfi_types.h include/linux/cfi_types.h Cc: Kees Cook Fixes: a5ba183bdeee ("Merge tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux") Reviewed-by: Nathan Chancellor Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20251006225148.1636486-1-cmllamas@google.com Signed-off-by: Kees Cook commit 0902b3cb23ce7f436bddbdf6ba7b1ed427b36bd9 Author: Kees Cook Date: Tue Sep 30 08:45:19 2025 -0700 kconfig: Avoid prompting for transitional symbols The "transitional" symbol keyword, while working with the "olddefconfig" target, was prompting during "oldconfig". This occurred because these symbols were not being marked as user-defined when they received values from transitional symbols that had user values. The "olddefconfig" target explicitly doesn't prompt for anything, so this deficiency wasn't noticed. The issue manifested when a symbol's value came from a transitional symbol's user value but the receiving symbol wasn't marked with SYMBOL_DEF_USER. Thus the "oldconfig" logic would then prompt for these symbols unnecessarily. Check after value calculation whether a symbol without a user value gets its value from a single transitional symbol that does have a user value. In such cases, mark the receiving symbol as user-defined to prevent prompting. Update regression tests to verify that symbols with transitional defaults are not prompted in "oldconfig", except when conditional defaults evaluate to 'no' and should legitimately be prompted. Build tested with "make testconfig". Reported-by: Linus Torvalds Closes: https://lore.kernel.org/lkml/CAHk-=wgZjUk4Cy2XgNkTrQoO8XCmNUHrTe5D519Fij1POK+3qw@mail.gmail.com/ Fixes: f9afce4f32e9 ("kconfig: Add transitional symbol attribute for migration support") Cc: Vegard Nossum Link: https://lore.kernel.org/r/20250930154514.it.623-kees@kernel.org Signed-off-by: Kees Cook commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a Author: Sam James Date: Wed Oct 1 23:58:40 2025 +0100 parisc: don't reference obsolete termio struct for TC* constants Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead. This fixes building Python for example, which falls over like: ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' Link: https://bugs.gentoo.org/961769 Link: https://bugs.gentoo.org/962600 Co-authored-by: Stian Halseth Cc: stable@vger.kernel.org Signed-off-by: Sam James Signed-off-by: Helge Deller commit 16794e524d310780163fdd49d0bf7fac30f8dbc8 Author: John David Anglin Date: Tue Aug 5 11:35:30 2025 -0400 parisc: Remove spurious if statement from raw_copy_from_user() Accidently introduced in commit 91428ca9320e. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Fixes: 91428ca9320e ("parisc: Check region is readable by user in raw_copy_from_user()") Cc: stable@vger.kernel.org # v5.12+ commit 506aa235f6e0baa00bf792df82a5e9f618b7a5d8 Author: Christoph Hellwig Date: Tue Oct 7 11:06:28 2025 +0200 block: move bio_iov_iter_get_bdev_pages to block/fops.c Keep bio_iov_iter_get_bdev_pages local with the callers, as blindly looking at the bdev logical block size is often not the best idea unless on a block device. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit cb6d51a4115781fd9de6108932e866a332e38406 Author: Christoph Hellwig Date: Tue Oct 7 11:06:27 2025 +0200 iomap: open code bio_iov_iter_get_bdev_pages Prepare for passing different alignments, and to retired bio_iov_iter_get_bdev_pages as a global helper. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit 82dd5d763c9b718e2d655b9565e0a06a91bb83dc Author: Christoph Hellwig Date: Tue Oct 7 11:06:26 2025 +0200 block: rename bio_iov_iter_get_pages_aligned to bio_iov_iter_get_pages Now that the bio_iov_iter_get_pages is free again, use it instead of the more complicated now. Also drop the unused export. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit 1ed06c83506ecaaf1836ddeb7c65772ff86d8d53 Author: Christoph Hellwig Date: Tue Oct 7 11:06:25 2025 +0200 block: remove bio_iov_iter_get_pages Switch the only caller to bio_iov_iter_get_pages, and explain why it does not have any alignment requirements. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit beb97995b97532e1f215e3295e6843e59862f94b Author: Haiyue Wang Date: Tue Oct 7 14:18:18 2025 +0800 io_uring: use tab indentation for IORING_SEND_VECTORIZED comment Be consistent with tab style of "liburing/src/include/liburing/io_uring.h". Signed-off-by: Haiyue Wang Signed-off-by: Jens Axboe commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f Author: Jens Axboe Date: Tue Oct 7 07:46:00 2025 -0600 io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback. Cc: stable@vger.kernel.org Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/ Signed-off-by: Jens Axboe commit 18a5f1af596e6ba22cd40ada449063041f3ce6d4 Author: Artem Shimko Date: Tue Oct 7 13:11:33 2025 +0300 spi: dw-mmio: add error handling for reset_control_deassert() Currently reset_control_deassert() is called without checking its return value. This can lead to silent failures when reset deassertion fails. Add proper error handling to: 1. Check the return value of reset_control_deassert() 2. Return the error to the caller 3. Provide meaningful error message using dev_err_probe() This ensures that reset-related failures are properly reported during probe and helps with debugging reset issues. Signed-off-by: Artem Shimko Link: https://patch.msgid.link/20251007101134.1912895-1-a.shimko.dev@gmail.com Signed-off-by: Mark Brown commit a27539810e1e61efcfdeb51777ed875dc61e9d49 Author: Shuming Fan Date: Tue Oct 7 16:09:50 2025 +0800 ASoC: rt722: add settings for rt722VB This patch adds settings for RT722VB. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251007080950.1999411-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 Author: Valerio Setti Date: Tue Oct 7 00:12:19 2025 +0200 ASoC: meson: aiu-encoder-i2s: fix bit clock polarity According to I2S specs audio data is sampled on the rising edge of the clock and it can change on the falling one. When operating in normal mode this SoC behaves the opposite so a clock polarity inversion is required in this case. This was tested on an OdroidC2 (Amlogic S905 SoC) board. Signed-off-by: Valerio Setti Reviewed-by: Jerome Brunet Tested-by: Jerome Brunet Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com Signed-off-by: Mark Brown commit f4ace70faa8ff2890774bac86762e036a3651066 Author: Pedro Demarchi Gomes Date: Tue Oct 7 09:00:57 2025 -0300 ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user Replace kmalloc_array() followed by copy_from_user() with memdup_array_user() to improve and simplify fcp_ioctl_set_meter_map(). No functional changes intended. Signed-off-by: Pedro Demarchi Gomes Signed-off-by: Takashi Iwai commit 7ddb711b6e0d33e0a673b49f69dff0d950ed60b9 Author: Shenghao Ding Date: Tue Oct 7 18:37:08 2025 +0800 ALSA: hda/tas2781: Enable init_profile_id for device initialization Optimize the time consumption of profile switching, init_profile saves the common settings of different profiles, such as the dsp coefficients, etc, which can greatly reduce the profile switching time comsumption and remove the repetitive settings. Fixes: e83dcd139e77 ("ASoC: tas2781: Add keyword "init" in profile section") Signed-off-by: Shenghao Ding Signed-off-by: Takashi Iwai commit e2c69490dda5d4c9f1bfbb2898989c8f3530e354 Author: Guenter Roeck Date: Mon Oct 6 13:18:57 2025 -0700 ipmi: Fix handling of messages with provided receive message pointer Prior to commit b52da4054ee0 ("ipmi: Rework user message limit handling"), i_ipmi_request() used to increase the user reference counter if the receive message is provided by the caller of IPMI API functions. This is no longer the case. However, ipmi_free_recv_msg() is still called and decreases the reference counter. This results in the reference counter reaching zero, the user data pointer is released, and all kinds of interesting crashes are seen. Fix the problem by increasing user reference counter if the receive message has been provided by the caller. Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling") Reported-by: Eric Dumazet Cc: Eric Dumazet Cc: Greg Thelen Signed-off-by: Guenter Roeck Message-ID: <20251006201857.3433837-1-linux@roeck-us.net> Signed-off-by: Corey Minyard commit a779e27f24aeb679969ddd1fdd7f636e22ddbc1e Author: Christian Brauner Date: Tue Oct 7 11:32:42 2025 +0200 coredump: fix core_pattern input validation In be1e0283021e ("coredump: don't pointlessly check and spew warnings") we tried to fix input validation so it only happens during a write to core_pattern. This would avoid needlessly logging a lot of warnings during a read operation. However the logic accidently got inverted in this commit. Fix it so the input validation only happens on write and is skipped on read. Fixes: be1e0283021e ("coredump: don't pointlessly check and spew warnings") Fixes: 16195d2c7dd2 ("coredump: validate socket name as it is written") Reviewed-by: Jan Kara Reported-by: Yu Watanabe Signed-off-by: Christian Brauner commit 56094ad3eaa21e6621396cc33811d8f72847a834 Author: Jan Kara Date: Thu Oct 2 17:55:07 2025 +0200 vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. Reported-by: syzbot+1d79ebe5383fc016cf07@syzkaller.appspotmail.com Fixes: f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Christian Brauner commit 943af6478807fc8dc37196e4fd080b98aa61aeec Merge: 3d3c4cd5c62f24 8e87b3edd0784e Author: Paolo Abeni Date: Tue Oct 7 13:00:00 2025 +0200 Merge branch 'mlx5-misc-fixes-2025-10-05' Tariq Toukan says: ==================== mlx5 misc fixes 2025-10-05 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1759652999-858513-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 8e87b3edd0784e534d9ad1e0a24577b759045cbe Author: Cosmin Ratiu Date: Sun Oct 5 11:29:59 2025 +0300 net/mlx5e: Do not fail PSP init on missing caps PSP support requires a set of cap bits to be set, otherwise an init error is logged. But logging an error when PSP cannot be initialized is too much, and not in line with other features. If a feature cannot be initialized because it is not supported, that's not an error. An error should only be printed when the feature cannot be initialized because of an actual error. Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality") Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 Author: Carolina Jubran Date: Sun Oct 5 11:29:58 2025 +0300 net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed When configuring IPsec packet offload in tunnel mode, the driver tries to create tunnel reformat objects unconditionally. This is incorrect, because tunnel mode is only permitted under specific encapsulation settings, and that decision is already made when the flow table is created. The offending commit attempted to block this case in the state add path, but the check there happens too late and does not prevent the reformat from being configured. Fix by taking short reservations for both the eswitch mode and the encap at the start of state setup. This preserves the block ordering (mode --> encap) used later: the mode is blocked during RX/TX get, and the encap is blocked during flow-table creation. This lets us fail early if either reservation cannot be obtained, it means a mode transition is underway or a conflicting configuration already owns encap. If both succeed, the flow-table path later takes the ownership and the reservations are released on exit. Fixes: 146c196b60e4 ("net/mlx5e: Create IPsec table with tunnel support only when encap is disabled") Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 7593439c13933164f701eed9c83d89358f203469 Author: Carolina Jubran Date: Sun Oct 5 11:29:57 2025 +0300 net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables When creating IPsec flow tables with tunnel mode enabled, the driver uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation conflicts across different domains (NIC_RX/NIC_TX and FDB), since the firmware doesn’t allow both at the same time. Currently, the driver attempts to reserve tunnel mode unconditionally for both NIC and FDB IPsec tables. This can lead to conflicting tunnel mode setups, for example, if a flow table was created in the FDB domain with tunnel offload enabled, and we later try to create another one in the NIC, or vice versa. To resolve this, adjust the blocking logic so that tunnel mode is only reserved by NIC flows. This ensures that tunnel offload is exclusively used in either the NIC or the FDB, and avoids unintended offload conflicts. Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode") Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit dd68fd72e516d57e7f2e502113c9345a3bc277db Merge: 679a16399af080 5b87014e999903 399dbcadc01ebf c7bc7e9070d6bd d9f866b2bb3eec Author: Rafael J. Wysocki Date: Tue Oct 7 12:59:50 2025 +0200 Merge branches 'acpi-x86', 'acpi-battery', 'acpi-apei' and 'acpi-property' Merge an x86 cleanup related to ACPI, an ACPI battery driver fix, an ACPI APEI cleanup, and an ACPI device properties handling update for 6.18-rc1: - Remove open coded check for cpu_feature_enabled() from acpi_processor_power_init_bm_check() (Mario Limonciello) - Add missing synchronization between interface updates in the ACPI battery driver (Rafael Wysocki) - Remove redundant rcu_read_lock/unlock() under spinlock from ghes_notify_hed() in the ACPI APEI support code (pengdonglin) - Make the .get_next_child_node() callback in the ACPI fwnode backend skip ACPI devices that are not present for consistency with the analogous callback in the OF fwnode backend (Sakari Ailus) * acpi-x86: x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() * acpi-battery: ACPI: battery: Add synchronization between interface updates * acpi-apei: ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock * acpi-property: ACPI: property: Return present device nodes only on fwnode interface commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d Author: Yuezhang Mo Date: Tue Sep 30 13:42:57 2025 +0800 dax: skip read lock assertion for read-only filesystems The commit 168316db3583("dax: assert that i_rwsem is held exclusive for writes") added lock assertions to ensure proper locking in DAX operations. However, these assertions trigger false-positive lockdep warnings since read lock is unnecessary on read-only filesystems(e.g., erofs). This patch skips the read lock assertion for read-only filesystems, eliminating the spurious warnings while maintaining the integrity checks for writable filesystems. Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") Signed-off-by: Yuezhang Mo Reviewed-by: Friendy Su Reviewed-by: Daniel Palmer Reviewed-by: Gao Xiang Signed-off-by: Christian Brauner commit d68a29a6a229f8b4f3b19dbcd0bb02881316d642 Author: Tong Li Date: Tue Sep 30 19:02:58 2025 +0800 rust: file: add intra-doc link for 'EBADF' The `BadFdError` doc comment mentions the `EBADF` constant but does not currently provide a navigation target for readers of the generated docs. Turning the references into intra-doc links matches the rest of the module and makes the documentation easier to explore. Suggested-by: Onur Özkan Link: https://github.com/Rust-for-Linux/linux/issues/1186 Signed-off-by: Tong Li Reviewed-by: Onur Özkan Signed-off-by: Christian Brauner commit deafd21efdd106f9744e2339e0c70c0f4ba565c3 Author: Zhou Yuhang Date: Wed Sep 24 20:21:39 2025 +0800 fs: update comment in init_file() The f_count member in struct file has been replaced by f_ref, so update f_count to f_ref in the comment. Signed-off-by: Zhou Yuhang Signed-off-by: Christian Brauner commit 15623c860c93aac71d22e7bedb7661ff2d3418de Author: Deepanshu Kartikey Date: Mon Sep 29 11:02:05 2025 +0200 nsfs: handle inode number mismatches gracefully in file handles Replace VFS_WARN_ON_ONCE() with graceful error handling when file handles contain inode numbers that don't match the actual namespace inode. This prevents userspace from triggering kernel warnings by providing malformed file handles to open_by_handle_at(). The issue occurs when userspace provides a file handle with valid namespace type and ID that successfully locates a namespace, but specifies an incorrect inode number. Previously, this would trigger VFS_WARN_ON_ONCE() when comparing the real inode number against the provided value. Since file handle data is user-controllable, inode number mismatches should be treated as invalid input rather than kernel consistency errors. Handle this case by returning NULL to indicate the file handle is invalid, rather than warning about what is essentially user input validation. Reported-by: syzbot+9eefe09bedd093f156c2@syzkaller.appspotmail.com Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Deepanshu Kartikey Signed-off-by: Christian Brauner commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a Author: Oleksij Rempel Date: Sun Oct 5 10:12:03 2025 +0200 net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before. Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC") Reported-by: Hubert Wiśniewski Closes: https://lore.kernel.org/all/DCGHG5UJT9G3.2K1GHFZ3H87T0@gmail.com Tested-by: Hubert Wiśniewski Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20251005081203.3067982-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 53d4d315d4f7f17882ef11db49b06ca6b0be8ff7 Merge: 05f084d24e098d 7e8f305a081e22 Author: Rafael J. Wysocki Date: Tue Oct 7 12:31:46 2025 +0200 Merge branch 'pm-cpufreq' Merge cpufreq fixes and cleanups, mostly on top of those fixes, for 6.18-rc1: - Make cpufreq drivers setting the default CPU transition latency to CPUFREQ_ETERNAL specify a proper default transition latency value instead which addresses a regression introduced during the 6.6 cycle that broke CPUFREQ_ETERNAL handling (Rafael Wysocki) - Make the cpufreq CPPC driver use a proper transition delay value when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency() to indicate an error condition (Rafael Wysocki) - Make cppc_get_transition_latency() return a negative error code to indicate error conditions instead of using CPUFREQ_ETERNAL for this purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael Wysocki, Gopi Krishna Menon) - Fix device leak in the mediatek cpufreq driver (Johan Hovold) - Set target frequency on all CPUs sharing a policy during frequency updates in the tegra186 cpufreq driver and make it initialize all cores to max frequencies (Aaron Kling) - Rust cpufreq helper cleanup (Thorsten Blum) * pm-cpufreq: docs/zh_CN: Fix malformed table docs/zh_TW: Fix malformed table cpufreq: Drop unused symbol CPUFREQ_ETERNAL ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure commit 05f084d24e098d93c7b0803e32b9be9fff6ef490 Merge: 991053178e08fb 632d31067be2f4 92158fae2ed986 Author: Rafael J. Wysocki Date: Tue Oct 7 12:20:36 2025 +0200 Merge branches 'pm-core' and 'pm-runtime' Merge runtime PM framework updates and a core power management code fix for 6.18-rc1: - Make pm_runtime_put*() family of functions return 1 when the given device is already suspended which is consistent with the documentation (Brian Norris) - Add basic kunit tests for runtime PM API contracts and update return values in kerneldoc coments for the runtime PM API (Brian Norris, Dan Carpenter) - Add auto-cleanup macros for runtime PM "resume and get" and "get without resume" operations, use one of them in the PCI core and drop the existing "free" macro introduced for similar purpose, but somewhat cumbersome to use (Rafael Wysocki) - Make the core power management code avoid waiting on device links marked as SYNC_STATE_ONLY which is consistent with the handling of those device links elsewhere (Pin-yen Lin) * pm-core: PM: sleep: Do not wait on SYNC_STATE_ONLY device links * pm-runtime: PM: runtime: Fix error checking for kunit_device_register() PM: runtime: Introduce one more usage counter guard PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() PCI/sysfs: Use runtime PM guard macro for auto-cleanup PM: runtime: Add auto-cleanup macros for "resume and get" operations PM: runtime: Update kerneldoc return codes PM: runtime: Make put{,_sync}() return 1 when already suspended PM: runtime: Add basic kunit tests for API contracts commit b615879dbfea6cf1236acbc3f2fb25ae84e07071 Author: Jakub Kicinski Date: Fri Oct 3 09:47:48 2025 -0700 selftests: drv-net: make linters happy with our imports Linters are still not very happy with our __init__ files, which was pointed out in recent review (see Link). We have previously started importing things one by one to make linters happy with the test files (which import from __init__). But __init__ file itself still makes linters unhappy. To clean it up I believe we must completely remove the wildcard imports, and assign the imported modules to __all__. hds.py needs to be fixed because it seems to be importing the Python standard random from lib.net. We can't use ksft_pr() / ktap_result() in case importing from net.lib fails. Linters complain that those helpers themselves may not have been imported. Link: https://lore.kernel.org/9d215979-6c6d-4e9b-9cdd-39cff595866e@redhat.com Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251003164748.860042-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit c9d1b0b54258ba13b567dd116ead3c7c30cba7d8 Author: Daniel Machon Date: Fri Oct 3 14:35:59 2025 +0200 net: sparx5/lan969x: fix flooding configuration on bridge join/leave The sparx5 driver programs UC/MC/BC flooding in sparx5_update_fwd() by unconditionally applying bridge_fwd_mask to all flood PGIDs. Any bridge topology change that triggers sparx5_update_fwd() (for example enslaving another port) therefore reinstalls flooding in hardware for already bridged ports, regardless of their per-port flood flags. This results in clobbering of the flood masks, and desynchronization between software and hardware: the bridge still reports “flood off” for the port, but hardware has flooding enabled due to unconditional PGID reprogramming. Steps to reproduce: $ ip link add br0 type bridge $ ip link set br0 up $ ip link set eth0 master br0 $ ip link set eth0 up $ bridge link set dev eth0 flood off $ ip link set eth1 master br0 $ ip link set eth1 up At this point, flooding is silently re-enabled for eth0. Software still shows “flood off” for eth0, but hardware has flooding enabled. To fix this, flooding is now set explicitly during bridge join/leave, through sparx5_port_attr_bridge_flags(): On bridge join, UC/MC/BC flooding is enabled by default. On bridge leave, UC/MC/BC flooding is disabled. sparx5_update_fwd() no longer touches the flood PGIDs, clobbering the flood masks, and desynchronizing software and hardware. Initialization of the flooding PGIDs have been moved to sparx5_start(). This is required as flooding PGIDs defaults to 0x3fffffff in hardware and the initialization was previously handled in sparx5_update_fwd(), which was removed. With this change, user-configured flooding flags persist across bridge updates and are no longer overridden by sparx5_update_fwd(). Fixes: d6fce5141929 ("net: sparx5: add switching support") Signed-off-by: Daniel Machon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251003-fix-flood-fwd-v1-1-48eb478b2904@microchip.com Signed-off-by: Paolo Abeni commit 4dc8b26a3ac2cb79f19f252d9077696d3ef0823a Author: Maxime Chevallier Date: Fri Oct 3 09:03:06 2025 +0200 net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions When accessing an MDIO register using single-byte smbus accesses, we have to perform 2 consecutive operations targeting the same address, first accessing the MSB then the LSB of the 16 bit register: read_1_byte(addr); <- returns MSB of register at address 'addr' read_1_byte(addr); <- returns LSB Some PHY devices present in SFP such as the Broadcom 5461 don't like seeing foreign i2c transactions in-between these 2 smbus accesses, and will return the MSB a second time when trying to read the LSB : read_1_byte(addr); <- returns MSB i2c_transaction_for_other_device_on_the_bus(); read_1_byte(addr); <- returns MSB again Given the already fragile nature of accessing PHYs/SFPs with single-byte smbus accesses, it's safe to say that this Broadcom PHY may not be the only one acting like this. Let's therefore hold the i2c bus lock while performing our smbus transactions to avoid interleaved accesses. Fixes: d4bd3aca33c2 ("net: mdio: mdio-i2c: Add support for single-byte SMBus operations") Signed-off-by: Maxime Chevallier Reviewed-by: Kory Maincent Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251003070311.861135-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni commit f75e07bf5226da640fa99a0594687c780d9bace4 Author: Lucas Zampieri Date: Tue Sep 23 15:43:19 2025 +0100 irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume According to the PLIC specification[1], global interrupt sources are assigned small unsigned integer identifiers beginning at the value 1. An interrupt ID of 0 is reserved to mean "no interrupt". The current plic_irq_resume() and plic_irq_suspend() functions incorrectly start the loop from index 0, which accesses the register space for the reserved interrupt ID 0. Change the loop to start from index 1, skipping the reserved interrupt ID 0 as per the PLIC specification. This prevents potential undefined behavior when accessing the reserved register space during suspend/resume cycles. Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation") Co-developed-by: Jia Wang Signed-off-by: Jia Wang Co-developed-by: Charles Mirabile Signed-off-by: Charles Mirabile Signed-off-by: Lucas Zampieri Signed-off-by: Thomas Gleixner Link: https://github.com/riscv/riscv-plic-spec/releases/tag/1.0.0 commit 196754c2a04a8ba682b00ea7c818897295c98967 Author: Dan Carpenter Date: Sat Sep 27 15:26:05 2025 +0300 irqchip/aspeed-scu-ic: Fix an IS_ERR() vs NULL check of_iomap() doesn't return error pointers, it returns NULL. Fix the error checking to check for NULL pointers. Fixes: 86cd4301c285 ("irqchip/aspeed-scu-ic: Refactor driver to support variant-based initialization") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner commit 23f3770e1a53e6c7a553135011f547209e141e72 Author: Daniel Borkmann Date: Fri Oct 3 09:34:18 2025 +0200 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Reported-by: Yusuke Suzuki Reported-by: Julian Wiedmann Signed-off-by: Daniel Borkmann Cc: Martin KaFai Lau Cc: Jakub Kicinski Cc: Jordan Rife Reviewed-by: Simon Horman Reviewed-by: Jordan Rife Reviewed-by: Jakub Kicinski Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 7c3321f3d279eda7f7d622312ffdbb889f3bec97 Author: Jingyi Wang Date: Wed Sep 24 16:29:01 2025 -0700 scsi: ufs: phy: dt-bindings: Add QMP UFS PHY compatible for Kaanapali Document the QMP UFS PHY compatible for Qualcomm Kaanapali to support physical layer functionality for UFS found on the SoC. Use fallback to indicate the compatibility of the QMP UFS PHY on the Kaanapali with that on the SM8750. Signed-off-by: Jingyi Wang Acked-by: Konrad Dybcio Signed-off-by: Martin K. Petersen commit 6dfc353af575e33c94f5d740f7b0569fa9b784d9 Author: Nitin Rawat Date: Wed Sep 24 16:29:00 2025 -0700 scsi: ufs: qcom: dt-bindings: Document the Kaanapali UFS controller Document the UFS Controller on the Kaanapali Platform. Signed-off-by: Nitin Rawat Signed-off-by: Jingyi Wang Message-Id: <20250924-knp-ufs-v1-1-42e0955a1f7c@oss.qualcomm.com> Signed-off-by: Martin K. Petersen commit 120642726ecb1b7a266f5c21bec90821e1154509 Author: Dan Carpenter Date: Tue Sep 30 15:38:09 2025 +0300 scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() The "offset" comes from the skb->data that we received. Here the code is verifying that "offset + len" is within bounds however it does not take integer overflows into account. Use size_add() to be safe. This would only be an issue on 32bit systems which are probably a very small percent of the users. Still, it's worth fixing just for correctness sake. Fixes: 42e9a92fe6a9 ("[SCSI] libfc: A modular Fibre Channel library") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Martin K. Petersen commit 987da233b2982c686a8ea5cd4c76f0bd5e957ee3 Author: Alok Tiwari Date: Mon Sep 29 02:25:54 2025 -0700 scsi: qla4xxx: Fix typos in comments Fix several spelling mistakes in qla4xxx driver comments: "Unfortunely" -> "Unfortunately" "becase" -> "because" "funcions" -> "functions" "targer_id" -> "target_id" Signed-off-by: Alok Tiwari Signed-off-by: Martin K. Petersen commit b69ffeaa0ae43892683113b3f4ddf156398738b9 Author: Long Li Date: Wed Oct 1 22:05:30 2025 -0700 scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU When selecting an outgoing channel for I/O, storvsc tries to select a channel with a returning CPU that is not the same as issuing CPU. This worked well in the past, however it doesn't work well when the Hyper-V exposes a large number of channels (up to the number of all CPUs). Use a different CPU for returning channel is not efficient on Hyper-V. Change this behavior by preferring to the channel with the same CPU as the current I/O issuing CPU whenever possible. Tests have shown improvements in newer Hyper-V/Azure environment, and no regression with older Hyper-V/Azure environments. Tested-by: Raheel Abdul Faizy Signed-off-by: Long Li Message-Id: <1759381530-7414-1-git-send-email-longli@linux.microsoft.com> Signed-off-by: Martin K. Petersen commit 73bc073d4270b6b227d5545fc277c1f09a26a77a Merge: bae04c9658fc8e 1af59cd5cc2b65 Author: Dave Airlie Date: Tue Oct 7 11:50:02 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-10-03' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - Fix userptr to not allow device private pages with SVM (Thomas Hellström) Driver Changes: - Fix build with clang 16 (Michal Wajdeczko) - Fix handling of invalid configfs syntax usage and spell out the expected syntax in the documentation (Lucas De Marchi) - Do not try late bind firmware when running as VF since it shouldn't handle firmware loading (Michal Wajdeczko) - Fix idle assertion for local BOs (Thomas Hellström) - Fix uninitialized variable for late binding (Colin Ian King, Mallesh Koujalagi) - Do not require perfmon_capable to expose free memory at page granularity. Handle it like other drm drivers do (Matthew Auld) - Fix lock handling on suspend error path (Shuicheng Lin) - Fix I2C controller resume after S3 (Raag Jadav) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/q6yeyb7n2eqo5megxjqayooajirx5hhsntfo65m3y4myscz7oz@25qbabbbr4hj commit bae04c9658fc8ec1429a64636ff14b09c31ba1d8 Merge: b2ec5ca9d5c2c0 adefb2ccea1e96 Author: Dave Airlie Date: Tue Oct 7 11:35:38 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-10-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: v3d: - Fix fence locking Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251002122303.GA21323@linux.fritz.box commit dbca0eabb821a6278925712a7bb263d0997e9c8f Author: Nicolas Frattaroli Date: Fri Oct 3 22:15:06 2025 +0200 mailbox: add MediaTek GPUEB IPI mailbox The MT8196 SoC uses an embedded MCU to control frequencies and power of the GPU. This controller is referred to as "GPUEB". It communicates to the application processor, among other ways, through a mailbox. The mailbox exposes one interrupt, which appears to only be fired when a response is received, rather than a transaction is completed. For us, this means we unfortunately need to poll for txdone. The mailbox also requires the EB clock to be on when touching any of the mailbox registers. Add a simple driver for it based on the common mailbox framework. Reviewed-by: Chia-I Wu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Jassi Brar commit d3e35a151a84ee607c817c08692dfd71568b3e0c Author: Nicolas Frattaroli Date: Fri Oct 3 22:15:05 2025 +0200 dt-bindings: mailbox: Add MT8196 GPUEB Mailbox The MediaTek MT8196 SoC includes an embedded MCU referred to as "GPUEB", acting as glue logic to control power and frequency of the Mali GPU. This MCU runs special-purpose firmware for this use, and the main application processor communicates with it through a mailbox. Add a binding that describes this mailbox. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Signed-off-by: Nicolas Frattaroli Signed-off-by: Jassi Brar commit bb160e791ab15b89188a7a19589b8e11f681bef3 Author: Harini T Date: Mon Sep 29 13:07:23 2025 +0530 mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash. Add explicit irq_type field to pdata for reliable identification of SGI interrupts (type-2) and only clean up SGI resources when appropriate. Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 0aead8197fc1a85b0a89646e418feb49a564b029 Author: Harini T Date: Mon Sep 29 13:07:22 2025 +0530 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd Author: Harini T Date: Mon Sep 29 13:07:21 2025 +0530 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes. device_is_registered() is the canonical and robust method to verify the registration status. Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 Author: Harini T Date: Mon Sep 29 13:07:20 2025 +0530 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary. Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 60d7416d8eb46ef2e71bf3dc13cd0c5eefc2ef89 Author: Wolfram Sang Date: Wed Aug 13 18:14:53 2025 +0200 mailbox: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 426f4e9414df5d51e7bc6519edb82bccf07ce52f Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:39 2025 +0200 dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional The GCE Mailbox needs only one clock and the clock-names can be used only by the driver (which, for instance, does not use it), and this is true for all of the currently supported MediaTek SoCs. Stop requiring to specify clock-names on all non-MT8195 GCEs. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Acked-by: Rob Herring (Arm) Reviewed-by: Matthias Brugger Signed-off-by: Jassi Brar commit 526ce9eb455e03a6dcdbf9a6c57c777c06d1ddf2 Author: Sibi Sankar Date: Wed Sep 24 20:18:31 2025 +0530 dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding Document CPU Control Processor (CPUCP) mailbox controller for Qualcomm Glymur SoCs. It is software compatible with X1E80100 CPUCP mailbox controller hence fallback to it. Signed-off-by: Sibi Sankar Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 8ac2a8c4b3b5058be211f740f41e6da5380a3963 Author: Ang Tien Sung Date: Mon Aug 25 16:36:43 2025 +0800 MAINTAINERS: Change mailbox-altera maintainer Update the mailbox-alters maintainer from to as Tham mun yew is no longer with Altera. Signed-off-by: Ang Tien Sung Acked-by: Mun Yew Tham Signed-off-by: Jassi Brar commit d30352829667b92809ed4cb55844ea1841d146a6 Author: Liao Yuanhong Date: Mon Aug 11 16:25:36 2025 +0800 mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer Remove no_free_ptr() to ensure PTR_ERR() consistently retrieves the correct error code. Signed-off-by: Liao Yuanhong Acked-by: Cristian Marussi Signed-off-by: Jassi Brar commit 61da08ecb55264fa1e2c7b8c8a630bed716edbdb Author: Markus Elfring Date: Mon Oct 6 16:39:35 2025 -0500 smb: client: Use common code in cifs_lookup() Use three additional labels so that another bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit e7933f5b019c1daef0a138661d6e504f0259de98 Author: Markus Elfring Date: Sun Oct 5 19:01:48 2025 +0200 smb: client: Reduce the scopes for a few variables in two functions * cifs_lookup(): Move the definition for the local variable “cfid” into an else branch so that the corresponding setting will only be performed if a NULL inode was detected during lookup by this function. * cifs_d_revalidate(): Move the definition for the local variables “inode” and “rc” into an if branch so that the corresponding setting will only be performed after a d_really_is_positive() call. Move the definition for the local variable “cfid” into an else branch so that the corresponding setting will only be performed if further data processing will be needed for an open_cached_dir_by_dentry() call. Signed-off-by: Markus Elfring Acked-by: Henrique Carvalho Signed-off-by: Steve French commit c746c3b5169831d7fb032a1051d8b45592ae8d78 Merge: 81538c8e42806e 4335c4496b1bcf Author: Linus Torvalds Date: Mon Oct 6 13:53:19 2025 -0700 Merge tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two short fixes that would be good to have before rc1" * tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix PAGE_SIZE format specifier in open_ctree() btrfs: avoid potential out-of-bounds in btrfs_encode_fh() commit 81538c8e42806eed71ce125723877a7c2307370c Merge: 256e3417065b27 73cc6ec1a89a6c Author: Linus Torvalds Date: Mon Oct 6 13:22:21 2025 -0700 Merge tag 'nfsd-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Mike Snitzer has prototyped a mechanism for disabling I/O caching in NFSD. This is introduced in v6.18 as an experimental feature. This enables scaling NFSD in /both/ directions: - NFS service can be supported on systems with small memory footprints, such as low-cost cloud instances - Large NFS workloads will be less likely to force the eviction of server-local activity, helping it avoid thrashing Jeff Layton contributed a number of fixes to the new attribute delegation implementation (based on a pending Internet RFC) that we hope will make attribute delegation reliable enough to enable by default, as it is on the Linux NFS client. The remaining patches in this pull request are clean-ups and minor optimizations. Many thanks to the contributors, reviewers, testers, and bug reporters who participated during the v6.18 NFSD development cycle" * tag 'nfsd-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (42 commits) nfsd: discard nfserr_dropit SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it NFSD: Add io_cache_{read,write} controls to debugfs NFSD: Do the grace period check in ->proc_layoutget nfsd: delete unnecessary NULL check in __fh_verify() NFSD: Allow layoutcommit during grace period NFSD: Disallow layoutget during grace period sunrpc: fix "occurence"->"occurrence" nfsd: Don't force CRYPTO_LIB_SHA256 to be built-in nfsd: nfserr_jukebox in nlm_fopen should lead to a retry NFSD: Reduce DRC bucket size NFSD: Delay adding new entries to LRU SUNRPC: Move the svc_rpcb_cleanup() call sites NFS: Remove rpcbind cleanup for NFSv4.0 callback nfsd: unregister with rpcbind when deleting a transport NFSD: Drop redundant conversion to bool sunrpc: eliminate return pointer in svc_tcp_sendmsg() sunrpc: fix pr_notice in svc_tcp_sendto() to show correct length nfsd: decouple the xprtsec policy check from check_nfsd_access() NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() ... commit f3b601f900902ab80902c44f820a8985384ac021 Author: Vincent Minet Date: Mon Sep 22 07:37:02 2025 +0200 perf tools: Fix arm64 libjvmti build by generating unistd_64.h Since commit 22f72088ffe6 ("tools headers: Update the syscall table with the kernel sources") the arm64 syscall header is generated at build time. Later, commit bfb713ea53c7 ("perf tools: Fix arm64 build by generating unistd_64.h") added a dependency to libperf to guarantee that this header was created before building libperf or perf itself. However, libjvmti also requires this header but does not depend on libperf, leading to build failures such as: In file included from /usr/include/sys/syscall.h:24, from /usr/include/syscall.h:1, from jvmti/jvmti_agent.c:36: tools/arch/arm64/include/uapi/asm/unistd.h:2:10: fatal error: asm/unistd_64.h: No such file or directory 2 | #include Fix this by ensuring that libperf is built before libjvmti, so that unistd_64.h is always available. Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") Cc: Namhyung Kim Cc: Vincent Minet Link: https://lore.kernel.org/r/20250922053702.2688374-1-v.minet@criteo.com Signed-off-by: Arnaldo Carvalho de Melo commit f07f91a36090b54076e89b46f159ea3a4b77fb2b Author: Jakub Kicinski Date: Fri Oct 3 14:01:27 2025 -0700 selftests: net: unify the Makefile formats We get a significant number of conflicts between net and net-next because of selftests Makefile changes. People tend to append new test cases at the end of the Makefile when there's no clear sort order. Sort all networking selftests Makefiles, use the following format: VAR_NAME := \ entry1 \ entry2 \ entry3 \ # end of VAR_NAME Some Makefiles are already pretty close to this. Acked-by: Antonio Quartulli Acked-by: Matthieu Baerts (NGI0) Acked-by: Allison Henderson Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251003210127.1021918-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2aa74c62589737054a6a8ba3c5b3d8cb10656737 Author: Jakub Kicinski Date: Fri Oct 3 13:57:36 2025 -0700 selftests: net: sort configs Sort config files for networking selftests. This should help us avoid merge conflicts between net and net-next. patchwork check will be added to prevent new issues. Acked-by: Phil Sutter Acked-by: Matthieu Baerts (NGI0) Acked-by: Florian Westphal Acked-by: Antonio Quartulli Link: https://patch.msgid.link/20251003205736.1019673-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b Author: Eric Dumazet Date: Fri Oct 3 18:41:19 2025 +0000 tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT on their listener, before accept(). This has an unfortunate effect on wscale selection in tcp_select_initial_window() during 3WHS. For instance, tcp_mmap was negotiating wscale 4, regardless of tcp_rmem[2] and sysctl_rmem_max. Do not change tp->window_clamp if it is zero or bigger than our computed value. Zero value is special, it allows tcp_select_initial_window() to enable autotuning. Note that SO_RCVLOWAT use on listener is probably not wise, because tp->scaling_ratio has a default value, possibly wrong. Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5205c3d002662093150fdcfd2a236ab897ffb5a5 Author: James Clark Date: Mon Oct 6 14:11:07 2025 +0100 perf tests: Don't retest sections in "Object code reading" We already only test each kcore map once, but on slow systems (particularly with network filesystems) even the non-kcore maps are slow. The test can test the same objdump output over and over which only wastes time. Generalize the skipping mechanism to track all DSOs and addresses so that each section is only tested once. On a fully loaded ARM Juno (simulating a parallel 'perf test' run) with a network filesystem, the original runtime is: real 1m51.126s user 0m19.445s sys 1m15.431s And the new runtime is: real 0m48.873s user 0m8.031s sys 0m32.353s Committer testing: # perf test "code read" 22: Object code reading : Ok # Reviewed-by: Ian Rogers Signed-off-by: James Clark Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 0a75ba3e842c73f60767333b349cf456dca74e1f Author: Leo Yan Date: Mon Oct 6 17:21:31 2025 +0100 perf docs: Document building with Clang Add example commands for building perf with Clang. Since recent Android NDK releases use Clang as the default compiler, a separate Android specific document is no longer needed; point to the general build documentation instead. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-9-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4772e66cb45e0dd2c3c9ac649532756c523afd1e Author: Leo Yan Date: Mon Oct 6 17:21:30 2025 +0100 perf build: Support build with clang Add support for building perf with clang. For cross compilation, the Makefile dynamically selects target flag for corresponding arch. This patch has been verified on x86_64 machine with Ubuntu distro, it can build successfully for native target, and for cross building Arm64 and s390. Example: native build on x86_64 / Ubuntu machine: $ HOSTCC=clang CC=clang CXX=clang++ make -C tools/perf Example: cross building s390 target on x86_64 / Ubuntu machine: # Install x390x cross toolchain and headers $ sudo apt-get install gcc-s390x-linux-gnu g++-s390x-linux-gnu \ libc6-dev-s390x-cross linux-libc-dev-s390x-cross # Build with clang $ HOSTCC=clang CC=clang CXX=clang++ \ ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- \ make -C tools/perf NO_LIBELF=1 NO_LIBTRACEEVENT=1 NO_LIBPYTHON=1 Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-8-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9ec46fc9380329de9dfd70de521e9da97cb4dfa8 Author: Leo Yan Date: Mon Oct 6 17:21:29 2025 +0100 perf test coresight: Dismiss clang warning for unroll loop thread clang-18.1.3 on Ubuntu 24.04.2 reports warning: unroll_loop_thread.c:35:25: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 35 | : /* in */ [in] "r" (in) | ^ unroll_loop_thread.c:39:1: warning: non-void function does not return a value [-Wreturn-type] 39 | } | ^ Use the modifier "w" for 32-bit register access and return NULL at the end of thread function. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-7-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 244a1ac76a671f100321ac2563b002b0354cbf42 Author: Leo Yan Date: Mon Oct 6 17:21:28 2025 +0100 perf test coresight: Dismiss clang warning for thread loop clang-18.1.3 on Ubuntu 24.04.2 reports warning: thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:37:8: note: use constraint modifier "w" 37 | "add %[i], %[i], #1\n" | ^~~~ | %w[i] thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:37:14: note: use constraint modifier "w" 37 | "add %[i], %[i], #1\n" | ^~~~ | %w[i] thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:38:8: note: use constraint modifier "w" 38 | "cmp %[i], %[len]\n" | ^~~~ | %w[i] thread_loop.c:41:38: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:38:14: note: use constraint modifier "w" 38 | "cmp %[i], %[len]\n" | ^~~~~~ | %w[len] Use the modifier "w" for 32-bit register access. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-6-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 50b7e7082a3dde5bdba14a4e40a2e2279fd08a7b Author: Leo Yan Date: Mon Oct 6 17:21:27 2025 +0100 perf test coresight: Dismiss clang warning for memcpy thread clang-18.1.3 on Ubuntu 24.04.2 reports warning: memcpy_thread.c:30:1: warning: non-void function does not return a value in all control paths [-Wreturn-type] 30 | } | ^ Dismiss the warning with returning NULL from the thread function. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-5-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e7e86d7697c6ed1dbbde18d7185c35b6967945ed Author: Leo Yan Date: Mon Oct 6 17:21:26 2025 +0100 perf build: Disable thread safety analysis for perl header When build with perl5, it reports error: In file included from /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:7933: /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/inline.h:298:5: error: mutex 'PL_env_mutex.lock' is not held on every path through here [-Werror,-Wthread-safety-analysis] 298 | ENV_UNLOCK; | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:7091:31: note: expanded from macro 'ENV_UNLOCK' 7091 | # define ENV_UNLOCK PERL_REENTRANT_UNLOCK("env"... | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:6465:7: note: expanded from macro 'PERL_REENTRANT_UNLOCK' 6465 | } STMT_END | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:865:28: note: expanded from macro 'STMT_END' 865 | # define STMT_END while (0) | ^ The error is caused by perl header but not perf code, disable thread safety analysis if including the header. Though GCC does not support the thread safety analysis option, this negative warning flag is silently ignored by it. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-4-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ed33e5e43c1e2b336fc172c8f7218520739ebd52 Author: Leo Yan Date: Mon Oct 6 17:21:25 2025 +0100 perf build: Correct CROSS_ARCH for clang Clang's -dumpmachine outputs "aarch64-unknown-linux-gnu", which does not match the MultiArch convention. This prevents the build system from detecting installed packages. Fix by stripping the trailing '-' from CROSS_COMPILE when setting CROSS_ARCH. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-3-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb Author: Leo Yan Date: Mon Oct 6 17:21:24 2025 +0100 perf python: split Clang options when invoking Popen When passing a list to subprocess.Popen, each element maps to one argv token. Current code bundles multiple Clang flags into a single element, something like: cmd = ['clang', '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', 'test-hello.c'] So Clang only sees one long, invalid option instead of separate flags, as a result, the script cannot capture any log via PIPE. Fix this by using shlex.split() to separate the string so each option becomes its own argv element. The fixed list will be: cmd = ['clang', '--target=x86_64-linux-gnu', '-fintegrated-as', '-Wno-cast-function-type-mismatch', 'test-hello.c'] Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f Author: Leo Yan Date: Mon Oct 6 17:21:23 2025 +0100 tools build: Align warning options with perf The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks. Make the feature test program use the same warning options as perf. Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e3b08a0664057bd89c72ee1ec312462ed3e37ca0 Author: Ian Rogers Date: Sun Oct 5 14:22:09 2025 -0700 perf disasm: Remove unused evsel from 'struct annotate_args' Set in symbol__annotate() but never used. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 257046a36750a6db6e0bab4612d7c8f9774b6b83 Author: Ian Rogers Date: Sun Oct 5 14:22:08 2025 -0700 perf srcline: Fallback between addr2line implementations Factor the addr2line function implementation into separate source files (addr2line.[ch]) and rename the addr2line function cmd__addr2line. In srcline replace the ifdef-ed addr2line implementations with one that first tries the llvm__addr2line implementation, then the deprecated libbfd__addr2line function and on failure uses cmd__addr2line. If HAVE_LIBLLVM_SUPPORT is enabled the llvm__addr2line will execute against the libLLVM.so it is linked against. If HAVE_LIBLLVM_DYNAMIC is enabled then libperf-llvm.so (that links against libLLVM.so) will be dlopened. If the dlopen succeeds then the behavior should match HAVE_LIBLLVM_SUPPORT. On failure cmd__addr2line is used. The dlopen is only tried once. If HAVE_LIBLLVM_DYNAMIC isn't enabled then llvm__addr2line immediately fails and cmd__addr2line is used. Clean up the dso__free_a2l logic, which is only needed in the non-LLVM version and moved to addr2line.c. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 256e3417065b2721f77bcd37331796b59483ef3b Merge: fb5bc347311b1d 6b36119b94d0b2 Author: Linus Torvalds Date: Mon Oct 6 12:37:34 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull x86 kvm updates from Paolo Bonzini: "Generic: - Rework almost all of KVM's exports to expose symbols only to KVM's x86 vendor modules (kvm-{amd,intel}.ko and PPC's kvm-{pr,hv}.ko x86: - Rework almost all of KVM x86's exports to expose symbols only to KVM's vendor modules, i.e. to kvm-{amd,intel}.ko - Add support for virtualizing Control-flow Enforcement Technology (CET) on Intel (Shadow Stacks and Indirect Branch Tracking) and AMD (Shadow Stacks). It is worth noting that while SHSTK and IBT can be enabled separately in CPUID, it is not really possible to virtualize them separately. Therefore, Intel processors will really allow both SHSTK and IBT under the hood if either is made visible in the guest's CPUID. The alternative would be to intercept XSAVES/XRSTORS, which is not feasible for performance reasons - Fix a variety of fuzzing WARNs all caused by checking L1 intercepts when completing userspace I/O. KVM has already committed to allowing L2 to to perform I/O at that point - Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 guests, as the MSR is supposed to exist for v2 PMUs - Allow Centaur CPU leaves (base 0xC000_0000) for Zhaoxin CPUs - Add support for the immediate forms of RDMSR and WRMSRNS, sans full emulator support (KVM should never need to emulate the MSRs outside of forced emulation and other contrived testing scenarios) - Clean up the MSR APIs in preparation for CET and FRED virtualization, as well as mediated vPMU support - Clean up a pile of PMU code in anticipation of adding support for mediated vPMUs - Reject in-kernel IOAPIC/PIT for TDX VMs, as KVM can't obtain EOI vmexits needed to faithfully emulate an I/O APIC for such guests - Many cleanups and minor fixes - Recover possible NX huge pages within the TDP MMU under read lock to reduce guest jitter when restoring NX huge pages - Return -EAGAIN during prefault if userspace concurrently deletes/moves the relevant memslot, to fix an issue where prefaulting could deadlock with the memslot update x86 (AMD): - Enable AVIC by default for Zen4+ if x2AVIC (and other prereqs) is supported - Require a minimum GHCB version of 2 when starting SEV-SNP guests via KVM_SEV_INIT2 so that invalid GHCB versions result in immediate errors instead of latent guest failures - Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents unauthorized CPU accesses from reading the ciphertext of SNP guest private memory, e.g. to attempt an offline attack. This feature splits the shared SEV-ES/SEV-SNP ASID space into separate ranges for SEV-ES and SEV-SNP guests, therefore a new module parameter is needed to control the number of ASIDs that can be used for VMs with CipherText Hiding vs. how many can be used to run SEV-ES guests - Add support for Secure TSC for SEV-SNP guests, which prevents the untrusted host from tampering with the guest's TSC frequency, while still allowing the the VMM to configure the guest's TSC frequency prior to launch - Validate the XCR0 provided by the guest (via the GHCB) to avoid bugs resulting from bogus XCR0 values - Save an SEV guest's policy if and only if LAUNCH_START fully succeeds to avoid leaving behind stale state (thankfully not consumed in KVM) - Explicitly reject non-positive effective lengths during SNP's LAUNCH_UPDATE instead of subtly relying on guest_memfd to deal with them - Reload the pre-VMRUN TSC_AUX on #VMEXIT for SEV-ES guests, not the host's desired TSC_AUX, to fix a bug where KVM was keeping a different vCPU's TSC_AUX in the host MSR until return to userspace KVM (Intel): - Preparation for FRED support - Don't retry in TDX's anti-zero-step mitigation if the target memslot is invalid, i.e. is being deleted or moved, to fix a deadlock scenario similar to the aforementioned prefaulting case - Misc bugfixes and minor cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (142 commits) KVM: x86: Export KVM-internal symbols for sub-modules only KVM: x86: Drop pointless exports of kvm_arch_xxx() hooks KVM: x86: Move kvm_intr_is_single_vcpu() to lapic.c KVM: Export KVM-internal symbols for sub-modules only KVM: s390/vfio-ap: Use kvm_is_gpa_in_memslot() instead of open coded equivalent KVM: VMX: Make CR4.CET a guest owned bit KVM: selftests: Verify MSRs are (not) in save/restore list when (un)supported KVM: selftests: Add coverage for KVM-defined registers in MSRs test KVM: selftests: Add KVM_{G,S}ET_ONE_REG coverage to MSRs test KVM: selftests: Extend MSRs test to validate vCPUs without supported features KVM: selftests: Add support for MSR_IA32_{S,U}_CET to MSRs test KVM: selftests: Add an MSR test to exercise guest/host and read/write KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors KVM: x86: Define Control Protection Exception (#CP) vector KVM: x86: Add human friendly formatting for #XM, and #VE KVM: SVM: Enable shadow stack virtualization for SVM KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid KVM: SVM: Pass through shadow stack MSRs as appropriate KVM: SVM: Update dump_vmcb with shadow stack save area additions KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02 ... commit fa770f1a9d40c99be4e7404c4a4bf77f50b0c892 Author: Ian Rogers Date: Sun Oct 5 14:22:07 2025 -0700 perf disasm: Make ins__scnprintf() and ins__is_nop() static Reduce the scope of ins__scnprintf() and ins__is_nop() that aren't used outside of disasm.c. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit bca753204e9eab3bd56907ec5f5ed151094d7742 Author: Ian Rogers Date: Sun Oct 5 14:22:06 2025 -0700 perf dso: Clean up read_symbol() error handling Ensure errno is set and return to caller for error handling. Unusually for perf the value isn't negated as expected by symbol__strerror_disassemble(). Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit aa04707f507e0f8161d1d8a4cef748a3d66b189a Author: Ian Rogers Date: Sun Oct 5 14:22:05 2025 -0700 perf dso: Support BPF programs in dso__read_symbol() Set the buffer to the code in the BPF linear info. This enables BPF JIT code disassembly by LLVM and capstone. Move the common but minimal disassmble_bpf_image call to disassemble_objdump so that it is only called after falling back to the objdump option. Similarly move the disassmble_bpf function to disassemble_objdump and rename to disassmble_bpf_libbfd to make it clearer that this support relies on libbfd. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 9518e10c2b399cb97eb527f2a67a8d97f11c1910 Author: Ian Rogers Date: Sun Oct 5 14:22:04 2025 -0700 perf dso: Move read_symbol() from llvm/capstone to dso Move the read_symbol function to dso.h, make the return type const and add a mutable out_buf out parameter. In future changes this will allow a code pointer to be returned without necessary allocating memory. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 0e52f3f9f15fdf914247f514f46d14b4fa4b2cbb Author: Ian Rogers Date: Sun Oct 5 14:22:03 2025 -0700 perf llvm: Reduce LLVM initialization Move the 3 LLVM initialization routines to be called in a single init_llvm function that has its own bool to avoid repeated initialization. Reduce the scope of triplet and avoid copying strings for x86. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan [ Move init_llvm() under HAVE_LIBLLVM_SUPPORT to fix the build ] Signed-off-by: Arnaldo Carvalho de Melo commit fb5bc347311b1d78dc608c91c2d68327b0a1d1d4 Merge: fc282d1731ec46 032676ff8217ca Author: Linus Torvalds Date: Mon Oct 6 12:18:56 2025 -0700 Merge tag 'loongarch-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Initialize acpi_gbl_use_global_lock to false - Allow specify SIMD width via kernel parameters - Add kexec_file (both EFI & ELF format) support - Add PER_VMA_LOCK for page fault handling support - Improve BPF trampoline support - Update the default config file - Some bug fixes and other small changes * tag 'loongarch-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (23 commits) LoongArch: Update Loongson-3 default config file LoongArch: BPF: Sign-extend struct ops return values properly LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() LoongArch: BPF: Make trampoline size stable LoongArch: BPF: Don't align trampoline size LoongArch: BPF: No support of struct argument in trampoline programs LoongArch: BPF: No text_poke() for kernel text LoongArch: BPF: Remove duplicated bpf_flush_icache() LoongArch: BPF: Remove duplicated flags check LoongArch: BPF: Fix uninitialized symbol 'retval_off' LoongArch: BPF: Optimize sign-extention mov instructions LoongArch: Handle new atomic instructions for probes LoongArch: Try VMA lock-based page fault handling first LoongArch: Automatically disable kaslr if boot from kexec_file LoongArch: Add crash dump support for kexec_file LoongArch: Add ELF binary support for kexec_file LoongArch: Add EFI binary support for kexec_file LoongArch: Add preparatory infrastructure for kexec_file LoongArch: Add struct loongarch_image_header for kernel LoongArch: Allow specify SIMD width via kernel parameters ... commit 95920c2ed02bde551ab654e9749c2ca7bc3100e0 Author: Toke Høiland-Jørgensen Date: Tue Sep 30 13:43:29 2025 +0200 page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine. Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages. The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives. Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages. v2: - Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap Link: https://lore.kernel.org/all/aMNJMFa5fDalFmtn@p100/ Fixes: ee62ce7a1d90 ("page_pool: Track DMA-mapped pages and unmap them when destroying the pool") Cc: stable@vger.kernel.org # 6.15+ Tested-by: Helge Deller Signed-off-by: Toke Høiland-Jørgensen Reviewed-by: Mina Almasry Tested-by: Helge Deller Link: https://patch.msgid.link/20250930114331.675412-1-toke@redhat.com Signed-off-by: Jakub Kicinski commit fc282d1731ec4686c1a84f8aca50c0c421e593b5 Merge: ba9dac987319d4 e66ae377fe219c Author: Linus Torvalds Date: Mon Oct 6 12:10:55 2025 -0700 Merge tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull uml updates from Johannes Berg: - minor preparations for SMP support - SPARSE_IRQ support for kunit - help output cleanups * tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Remove unused ipi_pipe field from cpuinfo_um um: Remove unused cpu_data and current_cpu_data macros um: Stop tracking virtual CPUs via mm_cpumask() um: Centralize stub size calculations um: Remove outdated comment about STUB_DATA_PAGES um: Remove unused offset and child_err fields from stub_data um: Indent time-travel help messages um: Fix help message for ssl-non-raw um: vector: Fix indentation for help message um: Add missing trailing newline to help messages um: virtio-pci: implement .shutdown() um: Support SPARSE_IRQ commit 66128f4287b04aef4d4db9bf5035985ab51487d5 Author: Geert Uytterhoeven Date: Mon Oct 6 14:33:42 2025 +0200 kbuild: uapi: Strip comments before size type check On m68k, check_sizetypes in headers_check reports: ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include This header file does not use any of the Linux-specific integer types, but merely refers to them from comments, so this is a false positive. As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() warning to error"), this check was promoted to an error, breaking m68k all{mod,yes}config builds. Fix this by stripping simple comments before looking for Linux-specific integer types. Signed-off-by: Geert Uytterhoeven Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org [nathan: Adjust comment and remove unnecessary escaping from slashes in regex] Signed-off-by: Nathan Chancellor commit e444c2d4a2b5fe65759ba826d7444bb83fc4fc16 Author: Ian Rogers Date: Sun Oct 5 14:22:02 2025 -0700 perf check: Add libLLVM feature Advertise when perf is built with the HAVE_LIBLLVM_SUPPORT option. Committer testing: $ perf -vv | grep LLVM libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT $ And the form to use in scripts, notably the tools/perf/tests/shell/ 'perf test' ones: $ perf check feature libllvm libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT $ perf check -q feature libllvm && echo LLVM is present LLVM is present $ perf check -q feature liballvm && echo ALLVM is present $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a Author: Erick Karanja Date: Thu Oct 2 20:46:17 2025 +0300 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node. Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") Signed-off-by: Erick Karanja Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com Signed-off-by: Jakub Kicinski commit ba9dac987319d4f3969691dcf366ef19c9ed8281 Merge: 169c9d06a26567 5c34f2b6f89ad4 Author: Linus Torvalds Date: Mon Oct 6 11:17:18 2025 -0700 Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: "Primarily bug fixes. Dave introduced the usage of cleanup.h a bit late in the cycle to help with the new label work required within CXL [1] nvdimm: - Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - Clean up __nd_ioctl() and remove gotos - Remove duplicate linux/slab.h header - Introduce guard() for nvdimm_bus_lock - Use str_plural() to simplify the code ACPI: - NFIT: Fix incorrect ndr_desc being reportedin dev_err message" Link: https://lore.kernel.org/all/20250917134116.1623730-1-s.neeraj@samsung.com/ [1] * tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Remove duplicate linux/slab.h header nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() nvdimm: Clean up __nd_ioctl() and remove gotos nvdimm: Introduce guard() for nvdimm_bus_lock ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message nvdimm: Use str_plural() to simplify the code commit 2db687f3469dbc5c59bc53d55acafd75d530b497 Author: Haotian Zhang Date: Wed Oct 1 19:53:36 2025 +0800 ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same index to return -EBUSY, potentially leading to NULL pointer dereferences. Reorder the operations as suggested by Przemek Kitszel: 1. Check if adapter already exists (xa_load) 2. Reserve the XArray slot (xa_reserve) 3. Allocate the adapter (ice_adapter_new) 4. Store the adapter (xa_store) Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed") Suggested-by: Przemek Kitszel Suggested-by: Jacob Keller Signed-off-by: Haotian Zhang Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 7fc25c5a5ae6230d14b4c088fc94dbd58b2a9f3a Author: Sidharth Seela Date: Wed Oct 1 18:01:08 2025 +0530 selftest: net: ovpn: Fix uninit return values Fix functions that return undefined values. These issues were caught by running clang using LLVM=1 option. Clang warnings are as follows: ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 1587 | if (!sock) { | ^~~~~ ovpn-cli.c:1635:9: note: uninitialized use occurs here 1635 | return ret; | ^~~ ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false 1587 | if (!sock) { | ^~~~~~~~~~~~ 1588 | fprintf(stderr, "cannot allocate netlink socket\n"); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1589 | goto err_free; | ~~~~~~~~~~~~~~ 1590 | } | ~ ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning 1584 | int mcid, ret; | ^ | = 0 ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 2107 | case CMD_INVALID: | ^~~~~~~~~~~ ovpn-cli.c:2111:9: note: uninitialized use occurs here 2111 | return ret; | ^~~ ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning 1939 | int n, ret; | ^ | Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") Signed-off-by: Sidharth Seela Link: https://patch.msgid.link/20251001123107.96244-2-sidharthseela@gmail.com Signed-off-by: Jakub Kicinski commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 Author: Duoming Zhou Date: Wed Oct 1 09:11:49 2025 +0800 net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workqueue() does wait for all pending work items in the work queue to complete before destroying the work queue, it cannot prevent the delayed work item from being rescheduled within the ocelot_check_stats_work() function. This limitation exists because the delayed work item is only enqueued into the work queue after its timer expires. Before the timer expiration, destroy_workqueue() has no visibility of this pending work item. Once the work queue appears empty, destroy_workqueue() proceeds with destruction. When the timer eventually expires, the delayed work item gets queued again, leading to the following warning: workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 ... RIP: 0010:__queue_work+0x875/0xaf0 ... RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 Call Trace: ? kasan_report+0xc6/0xf0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? __pfx_delayed_work_timer_fn+0x10/0x10 call_timer_fn+0x25/0x1c0 __run_timer_base.part.0+0x3be/0x8c0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x1c0/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... The following diagram reveals the cause of the above warning: CPU 0 (remove) | CPU 1 (delayed work callback) mscc_ocelot_remove() | ocelot_deinit() | ocelot_check_stats_work() ocelot_stats_deinit() | cancel_delayed_work()| ... | queue_delayed_work() destroy_workqueue() | (wait a time) | __queue_work() //UAF The above scenario actually constitutes a UAF vulnerability. The ocelot_stats_deinit() is only invoked when initialization failure or resource destruction, so we must ensure that any delayed work items cannot be rescheduled. Replace cancel_delayed_work() with disable_delayed_work_sync() to guarantee proper cancellation of the delayed work item and ensure completion of any currently executing work before the workqueue is deallocated. A deadlock concern was considered: ocelot_stats_deinit() is called in a process context and is not holding any locks that the delayed work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated ocelot-switch device by writing a kernel module and prepared the necessary resources for the virtual ocelot-switch device's probe process. Then, removing the virtual device will trigger the mscc_ocelot_remove() function, which in turn destroys the workqueue. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c Author: Kuniyuki Iwashima Date: Wed Oct 1 23:37:54 2025 +0000 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c Author: Sammy Hsu Date: Thu Oct 2 10:48:41 2025 +0800 net: wwan: t7xx: add support for HP DRMR-H01 add support for HP DRMR-H01 (0x03f0, 0x09c8) Signed-off-by: Sammy Hsu Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw Signed-off-by: Jakub Kicinski commit 2f3119686ef50319490ccaec81a575973da98815 Author: Alexandr Sapozhnikov Date: Thu Oct 2 12:14:47 2025 +0300 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function. Signed-off-by: Alexandr Sapozhnikov Acked-by: Xin Long Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com Signed-off-by: Jakub Kicinski commit 112104e2b72c5c7ba1590e3a5614b2ff76474f14 Merge: f35f83208c7735 7d85cd8730ab77 Author: Stephen Boyd Date: Mon Oct 6 13:00:55 2025 -0500 Merge branch 'clk-determine-rate' into clk-next * clk-determine-rate: (120 commits) clk: microchip: core: remove duplicate roclk_determine_rate() clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: scmi: migrate round_rate() to determine_rate() clk: ti: fapll: convert from round_rate() to determine_rate() clk: ti: dra7-atl: convert from round_rate() to determine_rate() clk: ti: divider: convert from round_rate() to determine_rate() clk: ti: composite: convert from round_rate() to determine_rate() clk: ti: dpll: convert from round_rate() to determine_rate() clk: ti: dpll: change error return from ~0 to -EINVAL clk: ti: dpll: remove round_rate() in favor of determine_rate() clk: tegra: tegra210-emc: convert from round_rate() to determine_rate() clk: tegra: super: convert from round_rate() to determine_rate() clk: tegra: pll: convert from round_rate() to determine_rate() clk: tegra: periph: divider: convert from round_rate() to determine_rate() clk: tegra: divider: convert from round_rate() to determine_rate() clk: tegra: audio-sync: convert from round_rate() to determine_rate() clk: fixed-factor: drop round_rate() clk ops clk: divider: remove round_rate() in favor of determine_rate() clk: visconti: pll: convert from round_rate() to determine_rate() clk: versatile: vexpress-osc: convert from round_rate() to determine_rate() ... commit f35f83208c7735a3ed03629f934bb7ebbcf2ddf9 Merge: 8397c58ea73ebd decdff7db9d18a 383c4ff4987f65 Author: Stephen Boyd Date: Mon Oct 6 13:00:50 2025 -0500 Merge branches 'clk-aspeed' and 'clk-rockchip' into clk-next * clk-aspeed: reset: aspeed: register AST2700 reset auxiliary bus device dt-bindings: clock: ast2700: modify soc0/1 clock define * clk-rockchip: clk: rockchip: rk3368: use clock ids for SCLK_MIPIDSI_24M dt-bindings: clock: rk3368: Add SCLK_MIPIDSI_24M commit 169c9d06a2656772285d3dd2c387e338b2e2b915 Merge: 2f2c7254931f41 c64c2a50cdd487 Author: Linus Torvalds Date: Mon Oct 6 11:00:30 2025 -0700 Merge tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - renesas,wdt: Add support for RZ/T2H and RZ/N2H - Add SMARC-sAM67 support - Several small fixes and improvements * tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog/hpwdt New maintianer dt-bindings: watchdog: add SMARC-sAM67 support watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog watchdog: visconti: don't print superfluous errors watchdog: rzv2h_wdt: don't print superfluous errors watchdog: rzg2l_wdt: don't print superfluous errors watchdog: s3c2410_wdt: exynosautov9: Enable supported features watchdog: s3c2410_wdt: exynosautov920: Enable QUIRK_HAS_32BIT_CNT watchdog: s3c2410_wdt: Increase max timeout value of watchdog watchdog: s3c2410_wdt: Fix max_timeout being calculated larger watchdog: s3c2410_wdt: Replace hardcoded values with macro definitions watchdog: rzv2h: Improve error strings and add newlines watchdog: rzv2h: Add support for RZ/T2H watchdog: rzv2h: Add support for configurable count clock source watchdog: rzv2h: Make "oscclk" and reset controller optional watchdog: rzv2h: Obtain clock-divider and timeout values from OF match data dt-bindings: watchdog: renesas,wdt: Add support for RZ/T2H and RZ/N2H watchdog: intel_oc_wdt: Do not try to write into const memory commit 8397c58ea73ebd1236820093b57ea4664f4d21b4 Merge: b91217d9124f7c a787ab591c38ef 7c2e86f7b5af93 2f66f069999dda 74743c53a19fb7 Author: Stephen Boyd Date: Mon Oct 6 13:00:22 2025 -0500 Merge branches 'clk-marvell', 'clk-xilinx', 'clk-mediatek' and 'clk-loongson' into clk-next - Add Mediatek MT8196 clk drivers * clk-marvell: clk: mmp: pxa1908: Instantiate power driver through auxiliary bus * clk-xilinx: clk: clocking-wizard: Fix output clock register offset for Versal platforms clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() * clk-mediatek: (31 commits) clk: mediatek: Add MT8196 vencsys clock support clk: mediatek: Add MT8196 vdecsys clock support clk: mediatek: Add MT8196 ovl1 clock support clk: mediatek: Add MT8196 ovl0 clock support clk: mediatek: Add MT8196 disp-ao clock support clk: mediatek: Add MT8196 disp1 clock support clk: mediatek: Add MT8196 disp0 clock support clk: mediatek: Add MT8196 mfg clock support clk: mediatek: Add MT8196 mdpsys clock support clk: mediatek: Add MT8196 mcu clock support clk: mediatek: Add MT8196 I2C clock support clk: mediatek: Add MT8196 pextpsys clock support clk: mediatek: Add MT8196 ufssys clock support clk: mediatek: Add MT8196 peripheral clock support clk: mediatek: Add MT8196 vlpckgen clock support clk: mediatek: Add MT8196 topckgen2 clock support clk: mediatek: Add MT8196 topckgen clock support clk: mediatek: Add MT8196 apmixedsys clock support dt-bindings: clock: mediatek: Describe MT8196 clock controllers clk: mediatek: clk-mtk: Add MUX_DIV_GATE macro ... * clk-loongson: clk: loongson2: Add clock definitions for Loongson-2K0300 SoC clk: loongson2: Avoid hardcoding firmware name of the reference clock clk: loongson2: Allow zero divisors for dividers clk: loongson2: Support scale clocks with an alternative mode clk: loongson2: Allow specifying clock flags for gate clock dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible commit b91217d9124f7cef7d0f699f7ff6ea96423f29f8 Merge: f0fd24820436d2 1803012a892921 4bf2d2744e6418 099760708aa377 Author: Stephen Boyd Date: Mon Oct 6 13:00:12 2025 -0500 Merge branches 'clk-microchip', 'clk-lookup' and 'clk-st' into clk-next - Speed up clk_core_lookup() by using a hashtable * clk-microchip: ARM: at91: remove default values for PMC_PLL_ACR clk: at91: add ACR in all PLL settings clk: at91: sam9x7: Add peripheral clock id for pmecc clk: at91: clk-master: Add check for divide by 3 clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register ARM: at91: pm: save and restore ACR during PLL disable/enable * clk-lookup: clk: Use hashtable for global clk lookups clk: Sort include statements * clk-st: dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings clk: stm32: introduce clocks for STM32MP21 platform dt-bindings: stm32: add STM32MP21 clocks and reset bindings commit f0fd24820436d2ee4d622080216ac563f7aa59cd Merge: c1e102f349bee5 18db1ff2dea0f9 575e9a62b8cace 6526402b9bac87 Author: Stephen Boyd Date: Mon Oct 6 12:57:03 2025 -0500 Merge branches 'clk-scmi', 'clk-qcom' and 'clk-broadcom' into clk-next * clk-scmi: clk: scmi: Add duty cycle ops only when duty cycle is supported * clk-qcom: (27 commits) clk: qcom: gcc-sc8280xp: drop obsolete PCIe GDSC comment clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk clk: qcom: dispcc-glymur: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock controller found on MSM8937 dt-bindings: clock: qcom: Add MSM8937 Global Clock Controller clk: qcom: Select the intended config in QCS_DISPCC_615 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() clk: qcom: alpha-pll: convert from round_rate() to determine_rate() clk: qcom: milos: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock Controller dt-bindings: clock: qcom: document the Glymur Global Clock Controller clk: qcom: clk-alpha-pll: Add support for Taycan EKO_T PLL clk: qcom: rpmh: Add support for Glymur rpmh clocks clk: qcom: Add TCSR clock driver for Glymur SoC dt-bindings: clock: qcom: Document the Glymur SoC TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Glymur SoCs clk: qcom: dispcc-glymur: Add support for Display Clock Controller dt-bindings: clock: Add DISPCC and reset controller for GLYMUR SoC clk: qcom: gcc-sdm660: Add missing LPASS/CDSP vote clocks dt-bindings: clock: gcc-sdm660: Add LPASS/CDSP vote clocks/GDSCs ... * clk-broadcom: clk: bcm: rpi: Maximize V3D clock clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing clk: bcm: rpi: Add missing logs if firmware fails commit c1e102f349bee5ae73e326339ea45daff4847b71 Merge: 3aae991cc2ce76 acf800c8fc567b 597fe80ba3fc55 048546931339b3 Author: Stephen Boyd Date: Mon Oct 6 12:56:54 2025 -0500 Merge branches 'clk-imx', 'clk-allwinner' and 'clk-ti' into clk-next * clk-imx: clk: imx95-blk-ctl: Save/restore registers when RPM routines are called clk: imx95-blk-ctl: Save platform data in imx95_blk_ctl structure * clk-allwinner: clk: sunxi-ng: add support for the A523/T527 MCU CCU clk: sunxi-ng: div: support power-of-two dividers clk: sunxi-ng: sun55i-a523-ccu: Add missing NPU module clock dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock clk: sunxi-ng: sun6i-rtc: Add A523 specifics * clk-ti: clk: keystone: sci-clk: use devm_kmemdup_array() clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled commit 3aae991cc2ce76deb1034d37021e3ab511c02b3a Merge: ec7336475d5257 823699ccbf0f37 ccd74beccdacda 7e2e4e32cd47a4 Author: Stephen Boyd Date: Mon Oct 6 12:56:46 2025 -0500 Merge branches 'clk-samsung', 'clk-tegra' and 'clk-amlogic' into clk-next * clk-samsung: clk: s2mps11: add support for S2MPG10 PMIC clock dt-bindings: clock: samsung,s2mps11: add s2mpg10 clk: samsung: exynos990: Add PERIC0 and PERIC1 clock support dt-bindings: clock: exynos990: Add PERIC0 and PERIC1 clock units clk: samsung: exynos990: Add missing USB clock registers to HSI0 clk: samsung: exynos990: Add LHS_ACEL gate clock for HSI0 and update CLK_NR_TOP dt-bindings: clock: exynos990: Add LHS_ACEL clock ID for HSI0 block clk: samsung: artpec-8: Add initial clock support for ARTPEC-8 SoC clk: samsung: Add clock PLL support for ARTPEC-8 SoC dt-bindings: clock: Add ARTPEC-8 clock controller clk: samsung: exynos990: Add DPU_BUS and CMUREF mux/div and update CLKS_NR_TOP dt-bindings: clock: exynos990: Extend clocks IDs clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes clk: samsung: pll: convert from round_rate() to determine_rate() clk: samsung: cpu: convert from round_rate() to determine_rate() clk: samsung: fsd: Add clk id for PCLK and PLL in CAM_CSI block dt-bindings: clock: Add CAM_CSI clock macro for FSD * clk-tegra: clk: tegra: dfll: Add CVB tables for Tegra114 clk: tegra: Add DFLL DVCO reset control for Tegra114 dt-bindings: arm: tegra: Add ASUS TF101G and SL101 dt-bindings: reset: Add Tegra114 CAR header dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) dt-bindings: clock: tegra30: Add IDs for CSI pad clocks dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C * clk-amlogic: clk: amlogic: fix recent code refactoring clk: amlogic: c3-peripherals: use helper for basic composite clocks clk: amlogic: align s4 and c3 pwm clock descriptions clk: amlogic: add composite clock helpers clk: amlogic: use the common pclk definition clk: amlogic: introduce a common pclk definition clk: amlogic: pclk explicitly use CLK_IGNORE_UNUSED clk: amlogic: drop CLK_SET_RATE_PARENT from peripheral clocks clk: amlogic: move PCLK definition to clkc-utils clk: amlogic: aoclk: use clkc-utils syscon probe clk: amlogic: use probe helper in mmio based controllers clk: amlogic: add probe helper for mmio based controllers clk: amlogic: drop meson-clkcee clk: amlogic: naming consistency alignment commit ec7336475d52575381149aa67f9526c2f6d45e0d Merge: ac28c7598611df 49ef6491106209 1ef1b8b9666d96 73e6f3ae8044f2 519cff1d85694c Author: Stephen Boyd Date: Mon Oct 6 12:56:23 2025 -0500 Merge branches 'clk-bindings', 'clk-cleanup', 'clk-renesas', 'clk-thead' and 'clk-spacemit' into clk-next * clk-bindings: dt-bindings: clock: mediatek: Add power-domains property dt-bindings: clock: silabs,si5341: Add missing properties dt-bindings: clock: adi,axi-clkgen: add clock-output-names property dt-bindings: clock: Remove unused fujitsu,mb86s70-crg11 binding dt-bindings: clock: Convert silabs,si570 to DT schema dt-bindings: clock: Convert silabs,si5341 to DT schema dt-bindings: clock: Convert silabs,si514/544 to DT schema * clk-cleanup: clk: tegra: do not overallocate memory for bpmp clocks clk: ep93xx: Use int type to store negative error codes dt-bindings: clock: st: flexgen: remove deprecated compatibles clk: st: flexgen: remove unused compatible clk: clk-axi-clkgen: remove unneeded semicolon clk: tegra: Remove redundant semicolons clk: npcm: select CONFIG_AUXILIARY_BUS clk: remove unneeded 'fast_io' parameter in regmap_config * clk-renesas: (27 commits) clk: renesas: r9a09g05[67]: Reduce differences clk: renesas: r9a09g047: Add USB3.0 clocks/resets clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() clk: renesas: r9a09g056: Add clock and reset entries for I3C clk: renesas: r9a09g057: Add clock and reset entries for I3C dt-bindings: clock: renesas,r9a09g047-cpg: Add USB3.0 core clocks clk: renesas: r9a09g077: Add Ethernet Subsystem core and module clocks clk: renesas: rzv2h: Simplify polling condition in __rzv2h_cpg_assert() clk: renesas: rzv2h: Re-assert reset on deassert timeout clk: renesas: rzg2l: Re-assert reset on deassert timeout clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert() dt-bindings: clock: renesas,r9a09g077/87: Add Ethernet clock IDs clk: renesas: r9a09g047: Add GPT clocks and resets clk: renesas: r9a09g077: Add module clocks for SCI1-SCI5 clk: renesas: rzv2h: remove round_rate() in favor of determine_rate() clk: renesas: rzg2l: convert from round_rate() to determine_rate() clk: renesas: r9a07g04[34]: Use tabs instead of spaces clk: renesas: r9a07g043: Add MSTOP for RZ/G2UL clk: renesas: r9a07g044: Add MSTOP for RZ/G2L clk: renesas: r9a08g045: Add MSTOP for GPIO ... * clk-thead: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL clk: thead: support changing DPU pixel clock rate clk: thead: add support for enabling/disabling PLLs clk: thead: Correct parent for DPU pixel clocks clk: thead: th1520-ap: fix parent of padctrl0 clock clk: thead: th1520-ap: describe gate clocks with clk_gate * clk-spacemit: clk: spacemit: fix i2s clock clk: spacemit: introduce pre-div for ddn clock dt-bindings: clock: spacemit: introduce i2s pre-clock to fix i2s clock clk: spacemit: ccu_pll: convert from round_rate() to determine_rate() clk: spacemit: ccu_mix: convert from round_rate() to determine_rate() clk: spacemit: ccu_ddn: convert from round_rate() to determine_rate() clk: spacemit: fix sspax_clk dt-bindings: clock: spacemit: CLK_SSPA_I2S_BCLK for SSPA commit c34e08ba6c0037a72a7433741225b020c989e4ae Author: Rob Clark Date: Tue Sep 23 07:04:40 2025 -0700 drm/msm: Fix GEM free for imported dma-bufs Imported dma-bufs also have obj->resv != &obj->_resv. So we should check both this condition in addition to flags for handling the _NO_SHARE case. Fixes this splat that was reported with IRIS video playback: ------------[ cut here ]------------ WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm] CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : msm_gem_free_object+0x1f8/0x264 [msm] lr : msm_gem_free_object+0x138/0x264 [msm] sp : ffff800092a1bb30 x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08 x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6 x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200 x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020 x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032 x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8 Call trace: msm_gem_free_object+0x1f8/0x264 [msm] (P) drm_gem_object_free+0x1c/0x30 [drm] drm_gem_object_handle_put_unlocked+0x138/0x150 [drm] drm_gem_object_release_handle+0x5c/0xcc [drm] drm_gem_handle_delete+0x68/0xbc [drm] drm_gem_close_ioctl+0x34/0x40 [drm] drm_ioctl_kernel+0xc0/0x130 [drm] drm_ioctl+0x360/0x4e0 [drm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ Reported-by: Stephan Gerhold Fixes: de651b6e040b ("drm/msm: Fix refcnt underflow in error path") Signed-off-by: Rob Clark Tested-by: Stephan Gerhold Tested-by: Luca Weiss Tested-by: Bryan O'Donoghue # qrb5165-rb5 Patchwork: https://patchwork.freedesktop.org/patch/676273/ Message-ID: <20250923140441.746081-1-robin.clark@oss.qualcomm.com> commit 2f2c7254931f41b5736e3ba12aaa9ac1bbeeeb92 Merge: e4c0fdd5af4c59 51204faa4273a6 Author: Linus Torvalds Date: Mon Oct 6 10:41:03 2025 -0700 Merge tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Add PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros that take config space accessor functions. Implement pci_find_capability(), pci_find_ext_capability(), and dwc, dwc endpoint, and cadence capability search interfaces with them (Hans Zhang) - Leave parent unit address 0 in 'interrupt-map' so that when we build devicetree nodes to describe PCI functions that contain multiple peripherals, we can build this property even when interrupt controllers lack 'reg' properties (Lorenzo Pieralisi) - Add a Xeon 6 quirk to disable Extended Tags and limit Max Read Request Size to 128B to avoid a performance issue (Ilpo Järvinen) - Add sysfs 'serial_number' file to expose the Device Serial Number (Matthew Wood) - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das) Resource management: - Align m68k pcibios_enable_device() with other arches (Ilpo Järvinen) - Remove sparc pcibios_enable_device() implementations that don't do anything beyond what pci_enable_resources() does (Ilpo Järvinen) - Remove mips pcibios_enable_resources() and use pci_enable_resources() instead (Ilpo Järvinen) - Clean up bridge window sizing and assignment (Ilpo Järvinen), including: - Leave non-claimed bridge windows disabled - Enable bridges even if a window wasn't assigned because not all windows are required by downstream devices - Preserve bridge window type when releasing the resource, since the type is needed for reassignment - Consolidate selection of bridge windows into two new interfaces, pbus_select_window() and pbus_select_window_for_type(), so this is done consistently - Compute bridge window start and end earlier to avoid logging stale information MSI: - Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) Error handling: - Align AER with EEH by allowing drivers to request a Bus Reset on Non-Fatal Errors (in addition to the reset on Fatal Errors that we already do) (Lukas Wunner) - If error recovery fails, emit FAILED_RECOVERY uevents for the devices, not for the bridge leading to them. This makes them correspond to BEGIN_RECOVERY uevents (Lukas Wunner) - Align AER with EEH by calling err_handler.error_detected() callbacks to notify drivers if error recovery fails (Lukas Wunner) - Align AER with EEH by restoring device error_state to pci_channel_io_normal before the err_handler.slot_reset() callback. This is earlier than before the err_handler.resume() callback (Lukas Wunner) - Emit a BEGIN_RECOVERY uevent when driver's err_handler.error_detected() requests a reset, as well as when it says recovery is complete or can be done without a reset (Niklas Schnelle) - Align s390 with AER and EEH by emitting uevents during error recovery (Niklas Schnelle) - Align EEH with AER and s390 by emitting BEGIN_RECOVERY, SUCCESSFUL_RECOVERY, or FAILED_RECOVERY uevents depending on the result of err_handler.error_detected() (Niklas Schnelle) - Fix a NULL pointer dereference in aer_ratelimit() when ACPI GHES error information identifies a device without an AER Capability (Breno Leitao) - Update error decoding and TLP Log printing for new errors in current PCIe base spec (Lukas Wunner) - Update error recovery documentation to match the current code and use consistent nomenclature (Lukas Wunner) ASPM: - Enable all ClockPM and ASPM states for devicetree platforms, since there's typically no firmware that enables ASPM This is a risky change that may uncover hardware or configuration defects at boot-time rather than when users enable ASPM via sysfs later. Booting with "pcie_aspm=off" prevents this enabling (Manivannan Sadhasivam) - Remove the qcom code that enabled ASPM (Manivannan Sadhasivam) Power management: - If a device has already been disconnected, e.g., by a hotplug removal, don't bother trying to resume it to D0 when detaching the driver. This avoids annoying "Unable to change power state from D3cold to D0" messages (Mario Limonciello) - Ensure devices are powered up before config reads for 'max_link_width', 'current_link_speed', 'current_link_width', 'secondary_bus_number', and 'subordinate_bus_number' sysfs files. This prevents using invalid data (~0) in drivers or lspci and, depending on how the PCIe controller reports errors, may avoid error interrupts or crashes (Brian Norris) Virtualization: - Add rescan/remove locking when enabling/disabling SR-IOV, which avoids list corruption on s390, where disabling SR-IOV also generates hotplug events (Niklas Schnelle) Peer-to-peer DMA: - Free struct p2p_pgmap, not a member within it, in the pci_p2pdma_add_resource() error path (Sungho Kim) Endpoint framework: - Document sysfs interface for BAR assignment of vNTB endpoint functions (Jerome Brunet) - Fix array underflow in endpoint BAR test case (Dan Carpenter) - Skip endpoint IRQ test if the IRQ is out of range to avoid false errors (Christian Bruel) - Fix endpoint test case for controllers with fixed-size BARs smaller than requested by the test (Marek Vasut) - Restore inbound translation when disabling doorbell so the endpoint doorbell test case can be run more than once (Niklas Cassel) - Avoid a NULL pointer dereference when releasing DMA channels in endpoint DMA test case (Shin'ichiro Kawasaki) - Convert tegra194 interrupt number to MSI vector to fix endpoint Kselftest MSI_TEST test case (Niklas Cassel) - Reset tegra194 BARs when running in endpoint mode so the BAR tests don't overwrite the ATU settings in BAR4 (Niklas Cassel) - Handle errors in tegra194 BPMP transactions so we don't mistakenly skip future PERST# assertion (Vidya Sagar) AMD MDB PCIe controller driver: - Update DT binding example to separate PERST# to a Root Port stanza to make multiple Root Ports possible in the future (Sai Krishna Musham) - Add driver support for PERST# being described in a Root Port stanza, falling back to the host bridge if not found there (Sai Krishna Musham) Freescale i.MX6 PCIe controller driver: - Enable the 3.3V Vaux supply if available so devices can request wakeup with either Beacon or WAKE# (Richard Zhu) MediaTek PCIe Gen3 controller driver: - Add optional sys clock ready time setting to avoid sys_clk_rdy signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno) - Add DT binding and driver support for MT6991 and MT8196 (AngeloGioacchino Del Regno) NVIDIA Tegra PCIe controller driver: - When asserting PERST#, disable the controller instead of mistakenly disabling the PLL twice (Nagarjuna Kristam) - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) Qualcomm PCIe controller driver: - Select PCI Power Control Slot driver so slot voltage rails can be turned on/off if described in Root Port devicetree node (Qiang Yu) - Parse only PCI bridge child nodes in devicetree, skipping unrelated nodes such as OPP (Operating Performance Points), which caused probe failures (Krishna Chaitanya Chundru) - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang) - Consolidate Root Port 'phy' and 'reset' properties in struct qcom_pcie_port, regardless of whether we got them from the Root Port node or the host bridge node (Manivannan Sadhasivam) - Fetch and map the ELBI register space in the DWC core rather than in each driver individually (Krishna Chaitanya Chundru) - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG Shift Feature' and use this in the qcom driver (Krishna Chaitanya Chundru) - Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya Chundru) - Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm Glymur, which is compatible with X1E80100 but doesn't have the cnoc_sf_axi clock (Qiang Yu) Renesas R-Car PCIe controller driver: - Fix a typo that prevented correct PHY initialization (Marek Vasut) - Add a missing 1ms delay after PWR reset assertion as required by the V4H manual (Marek Vasut) - Assure reset has completed before DBI access to avoid SError (Marek Vasut) - Fix inverted PHY initialization check, which sometimes led to timeouts and failure to start the controller (Marek Vasut) - Pass the correct IRQ domain to generic_handle_domain_irq() to fix a regression when converting to msi_create_parent_irq_domain() (Claudiu Beznea) - Drop the spinlock protecting the PMSR register - it's no longer required since pci_lock already serializes accesses (Marek Vasut) - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) SOPHGO PCIe controller driver: - Check for existence of struct cdns_pcie.ops before using it to allow Cadence drivers that don't need to supply ops (Chen Wang) - Add DT binding and driver for the SOPHGO SG2042 PCIe controller (Chen Wang) STMicroelectronics STM32MP25 PCIe controller driver: - Update pinctrl documentation of initial states and use in runtime suspend/resume (Christian Bruel) - Add pinctrl_pm_select_init_state() for use by stm32 driver, which needs it during resume (Christian Bruel) - Add devicetree bindings and drivers for the STMicroelectronics STM32MP25 in host and endpoint modes (Christian Bruel) Synopsys DesignWare PCIe controller driver: - Add support for x16 in devicetree 'num-lanes' property (Konrad Dybcio) - Verify that if DT specifies a single IRQ for all eDMA channels, it is named 'dma' (Niklas Cassel) TI J721E PCIe driver: - Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth Vadapalli) - Power controller off before configuring the glue layer so the controller latches the correct values on power-on (Siddharth Vadapalli) TI Keystone PCIe controller driver: - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver exits with error (Siddharth Vadapalli) - Add Peripheral Virtualization Unit (PVU), which restricts DMA from PCIe devices to specific regions of host memory, to the ti,am65 binding (Jan Kiszka) Xilinx NWL PCIe controller driver: - Clear bootloader E_ECAM_CONTROL before merging in the new driver value to avoid writing invalid values (Jani Nurminen)" * tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (141 commits) PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings PCI: stm32: Add PCIe host support for STM32MP25 PCI: xilinx-nwl: Fix ECAM programming PCI: j721e: Fix incorrect error message in probe() PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller PCI: dwc: Support 16-lane operation PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock PCI: rcar-gen4: Fix inverted break condition in PHY initialization PCI: rcar-gen4: Assure reset occurs before DBI access PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion PCI: Set up bridge resources earlier PCI: rcar-host: Drop PMSR spinlock ... commit e4c0fdd5af4c590ca07880b97e286c6532437658 Merge: 1d1ba4d390141d cc0bacac6de776 Author: Linus Torvalds Date: Mon Oct 6 10:37:06 2025 -0700 Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "A couple of new device support and small driver updates for this round. New support: - Intel idxd Wildcat Lake family support - SpacemiT K1 PDMA controller support - Renesas RZ/G3E family support Updates: - Xilinx shutdown support and dma client properties update - Designware edma callback_result support" * tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing dmaengine: mmp_pdma: Add operations structure for controller abstraction dmaengine: mmp_pdma: Add reset controller support dmaengine: mmp_pdma: Add clock support dt-bindings: dma: Add SpacemiT K1 PDMA controller dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation dmaengine: xilinx_dma: Support descriptor setup from dma_vecs dmaengine: sh: setup_xref error handling dmaengine: Replace zero-length array with flexible-array dmaengine: ppc4xx: Remove space before newline dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" dmaengine: zynqmp_dma: Add shutdown operation support commit 1d1ba4d390141d602dbce8f5f0ac19a384d10a64 Merge: 58b65f6dccb049 bdb978979ed133 Author: Linus Torvalds Date: Mon Oct 6 10:34:22 2025 -0700 Merge tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "The usual bunch of device support and update to drivers. New Support - Qualcomm SM8750 QMP PCIe PHY dual lane support, PMIV0104 eusb2 repeater support, QCS8300 eDP PHY support - Renesas RZ/T2H and RZ/N2H support and updates to driver for that - TI TCAN1051 phy support - Rockchip rk3588 dphy support, RK3528 combphy support Updates: - cadence updates for calibration and polling for ready and enabling of lower resolutions, runtime pm support, - Rockchip: enable U3 otg port - Renesas USXGMII mode support - Qualcomm UFS PHY and PLL regulator load support" * tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (64 commits) phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3588 variant phy: rockchip: phy-rockchip-inno-csidphy: allow for different reset lines phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 dt-bindings: phy: rockchip-inno-csi-dphy: add rk3588 variant dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required phy: cadence: cdns-dphy: Enable lower resolutions in dphy phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet phy: renesas: r8a779f0-ether-serdes: add USXGMII mode phy: sophgo: Add USB 2.0 PHY driver for Sophgo CV18XX/SG200X dt-bindings: phy: Add Sophgo CV1800 USB phy phy: cadence: cdns-dphy: Update calibration wait time for startup state machine phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling phy: renesas: rcar-gen3-usb2: Fix ID check logic with VBUS valid dt-bindings: phy: ti,tcan104x-can: Document TI TCAN1051 phy: lynx-28g: check return value when calling lynx_28g_pll_get phy: qcom: m31-eusb2: Fix the error log while enabling clock phy: rockchip: usbdp: Remove redundant ternary operators phy: renesas: rcar-gen3-usb2: Remove redundant ternary operators phy: hisilicon: Remove redundant ternary operators phy: qcom-qmp-ufs: Add PHY and PLL regulator load ... commit 58b65f6dccb0497802fad938e479df6ec8684c1f Merge: fd94619c43360e 88f5d2a477ec64 Author: Linus Torvalds Date: Mon Oct 6 10:32:22 2025 -0700 Merge tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "A very small update this time - add few registers to debugfs - core: drop dev_pm_domain_detach() call and use min() to improve code" * tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: Use min() to improve code soundwire: bus: Drop dev_pm_domain_detach() call soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers commit 451bb96328981808463405d436bd58de16dd967d Author: Cédric Le Goater Date: Thu Sep 18 14:19:28 2025 +0200 vfio: Dump migration features under debugfs A debugfs directory was recently added for VFIO devices. Add a new "features" file under the migration sub-directory to expose which features the device supports. Signed-off-by: Cédric Le Goater Link: https://lore.kernel.org/r/20250918121928.1921871-1-clg@redhat.com Signed-off-by: Alex Williamson commit d14de5b92578c769e12d84c9bdeee5627c042270 Author: Li Zhe Date: Thu Aug 14 14:47:14 2025 +0800 vfio/type1: optimize vfio_unpin_pages_remote() When vfio_unpin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual put_pfn() operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. It would be very rare for reserved PFNs and non reserved will to be mixed within the same range. So this patch utilizes the has_rsvd variable introduced in the previous patch to determine whether batch put_pfn() operations can be performed. Moreover, compared to put_pfn(), unpin_user_page_range_dirty_lock() is capable of handling large folio scenarios more efficiently. The performance test results for completing the 16G VFIO IOMMU DMA unmapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.141 s (113.7 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.307 s (52.2 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.135 s (118.6 GB/s) With this patchset: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.044 s (363.2 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.289 s (55.3 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.044 s (361.3 GB/s) For large folio, we achieve an over 67% performance improvement in the VFIO UNMAP DMA item. For small folios, the performance test results appear to show a slight improvement. Suggested-by: Jason Gunthorpe Signed-off-by: Li Zhe Reviewed-by: David Hildenbrand Acked-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-6-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 089722e8939e580c9ccc64678ba22f563fdf3bb5 Author: Li Zhe Date: Thu Aug 14 14:47:13 2025 +0800 vfio/type1: introduce a new member has_rsvd for struct vfio_dma Introduce a new member has_rsvd for struct vfio_dma. This member is used to indicate whether there are any reserved or invalid pfns in the region represented by this vfio_dma. If it is true, it indicates that there is at least one pfn in this region that is either reserved or invalid. Signed-off-by: Li Zhe Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-5-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit d10872050ffeda8c3bdc08f3376bb49b34b4e643 Author: Li Zhe Date: Thu Aug 14 14:47:12 2025 +0800 vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() The function vpfn_pages() can help us determine the number of vpfn nodes on the vpfn rb tree within a specified range. This allows us to avoid searching for each vpfn individually in the function vfio_unpin_pages_remote(). This patch batches the vfio_find_vpfn() calls in function vfio_unpin_pages_remote(). Signed-off-by: Li Zhe Link: https://lore.kernel.org/r/20250814064714.56485-4-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit f6c84a52cc41e2aaed0d956d0a1c1802513a239c Author: Li Zhe Date: Thu Aug 14 14:47:11 2025 +0800 vfio/type1: optimize vfio_pin_pages_remote() When vfio_pin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual statistics counting operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. Batch processing of statistical counting operations can effectively enhance performance. In addition, the pages obtained through longterm GUP are neither invalid nor reserved. Therefore, we can reduce the overhead associated with some calls to function is_invalid_reserved_pfn(). The performance test results for completing the 16G VFIO IOMMU DMA mapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.049 s (328.5 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.268 s (59.6 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.051 s (310.9 GB/s) With this patch: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.025 s (629.8 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.253 s (63.1 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.030 s (530.5 GB/s) For large folio, we achieve an over 40% performance improvement. For small folios, the performance test results indicate a slight improvement. Signed-off-by: Li Zhe Co-developed-by: Alex Williamson Acked-by: David Hildenbrand Tested-by: Eric Farman Link: https://lore.kernel.org/r/20250814064714.56485-3-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 929bf010e0599ddef6b640cd314f1de65dd1ca3e Author: Li Zhe Date: Thu Aug 14 14:47:10 2025 +0800 mm: introduce num_pages_contiguous() Let's add a simple helper for determining the number of contiguous pages that represent contiguous PFNs. In an ideal world, this helper would be simpler or not even required. Unfortunately, on some configs we still have to maintain (SPARSEMEM without VMEMMAP), the memmap is allocated per memory section, and we might run into weird corner cases of false positives when blindly testing for contiguous pages only. One example of such false positives would be a memory section-sized hole that does not have a memmap. The surrounding memory sections might get "struct pages" that are contiguous, but the PFNs are actually not. This helper will, for example, be useful for determining contiguous PFNs in a GUP result, to batch further operations across returned "struct page"s. VFIO will utilize this interface to accelerate the VFIO DMA map process. Implementation based on Linus' suggestions to avoid new usage of nth_page() where avoidable. Suggested-by: Linus Torvalds Suggested-by: Jason Gunthorpe Signed-off-by: Li Zhe Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-2-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 9c78e747dd4fee6c36fcc926212e20032055cf9d Author: Rameshkumar Sundaram Date: Fri Oct 3 14:51:58 2025 +0530 wifi: ath11k: avoid bit operation on key flags Bitwise operations with WMI_KEY_PAIRWISE (defined as 0) are ineffective and misleading. This results in pairwise key validations added in commit 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") to always evaluate false and clear key commands for pairwise keys are not honored. Since firmware supports overwriting the new key without explicitly clearing the previous one, there is no visible impact currently. However, to restore consistency with the previous behavior and improve clarity, replace bitwise operations with direct assignments and comparisons for key flags. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aLlaetkalDvWcB7b@stanley.mountain Fixes: 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20251003092158.1080637-1-rameshkumar.sundaram@oss.qualcomm.com [update copyright per current guidance] Signed-off-by: Jeff Johnson commit 92282074e1d2e7b6da5c05fe38a7cc974187fe14 Author: Karthik M Date: Tue Sep 23 15:03:16 2025 -0700 wifi: ath12k: free skb during idr cleanup callback ath12k just like ath11k [1] did not handle skb cleanup during idr cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed skb. As a result, during vdev deletion a memory leak occurs. Refactor all clean up steps into a new function. New function ath12k_mac_tx_mgmt_free() creates a centralized area where idr cleanup, DMA unmapping for skb and freeing skb is performed. Utilize skb pointer given by idr_remove(), instead of passed as a function argument because IDR will be protected by locking. This will prevent concurrent modification of the same IDR. Now ath12k_mac_tx_mgmt_pending_free() and ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Link: https://lore.kernel.org/r/1637832614-13831-1-git-send-email-quic_srirrama@quicinc.com > # [1] Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Karthik M Signed-off-by: Muna Sinada Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250923220316.1595758-1-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0eb002c93c3b47f88244cecb1e356eaeab61a6bf Author: Mark Pearson Date: Mon Sep 29 15:21:35 2025 -0400 wifi: ath11k: Add missing platform IDs for quirk table Lenovo platforms can come with one of two different IDs. The pm_quirk table was missing the second ID for each platform. Add missing ID and some extra platform identification comments. Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196 Tested-on: P14s G4 AMD. Fixes: ce8669a27016 ("wifi: ath11k: determine PM policy based on machine model") Signed-off-by: Mark Pearson Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219196 Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250929192146.1789648-1-mpearson-lenovo@squebb.ca Signed-off-by: Jeff Johnson commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b Author: Loic Poulain Date: Fri Sep 26 21:56:56 2025 +0200 wifi: ath10k: Fix memory leak on unsupported WMI command ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID. Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1 Fixes: 553215592f14 ("ath10k: warn if give WMI command is not supported") Suggested-by: Jeff Johnson Signed-off-by: Loic Poulain Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250926195656.187970-1-loic.poulain@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 4d920ed684392ae064af62957d6f5a90312dfaf6 Author: Eric Biggers Date: Sun Oct 5 18:20:37 2025 -0700 libbpf: Fix undefined behavior in {get,put}_unaligned_be32() These violate aliasing rules and may be miscompiled unless -fno-strict-aliasing is used. Replace them with the standard memcpy() solution. Note that compilers know how to optimize this properly. Fixes: 4a1c9e544b8d ("libbpf: remove linux/unaligned.h dependency for libbpf_sha256()") Signed-off-by: Eric Biggers Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20251006012037.159295-1-ebiggers@kernel.org commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 Author: Ian Forbes Date: Fri Sep 26 14:54:26 2025 -0500 drm/vmwgfx: Fix copy-paste typo in validation 'entry' should be 'val' which is the loop iterator. Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a Author: Ian Forbes Date: Fri Sep 26 14:54:25 2025 -0500 drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 Author: Zack Rusin Date: Wed Sep 17 11:36:55 2025 -0400 drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. Signed-off-by: Zack Rusin Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") Reported-by: Kuzey Arda Bulut Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Reviewed-by: Ian Forbes Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com commit a7c4bb43bfdc2b9f06ee9d036028ed13a83df42a Author: Jakub Acs Date: Wed Oct 1 10:09:55 2025 +0000 fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was found by syzkaller. Race Condition Diagram: Thread 1 Thread 2 -------- -------- generic_shutdown_super() shrink_dcache_for_umount sb->s_root = NULL | | vfs_read() | inotify_fdinfo() | * inode get from mark * | show_mark_fhandle(m, inode) | exportfs_encode_fid(inode, ..) | ovl_encode_fh(inode, ..) | ovl_check_encode_origin(inode) | * deref i_sb->s_root * | | v fsnotify_sb_delete(sb) Which then leads to: [ 32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none) [ 32.143353] Call Trace: [ 32.143732] ovl_encode_fh+0xd5/0x170 [ 32.144031] exportfs_encode_inode_fh+0x12f/0x300 [ 32.144425] show_mark_fhandle+0xbe/0x1f0 [ 32.145805] inotify_fdinfo+0x226/0x2d0 [ 32.146442] inotify_show_fdinfo+0x1c5/0x350 [ 32.147168] seq_show+0x530/0x6f0 [ 32.147449] seq_read_iter+0x503/0x12a0 [ 32.148419] seq_read+0x31f/0x410 [ 32.150714] vfs_read+0x1f0/0x9e0 [ 32.152297] ksys_read+0x125/0x240 IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set to NULL in the unmount path. Fix it by protecting calling exportfs_encode_fid() from show_mark_fhandle() with s_umount lock. This form of fix was suggested by Amir in [1]. [1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/ Fixes: c45beebfde34 ("ovl: support encoding fid from inode with no alias") Signed-off-by: Jakub Acs Cc: Jan Kara Cc: Amir Goldstein Cc: Miklos Szeredi Cc: Christian Brauner Cc: linux-unionfs@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Jan Kara commit ee795e82e10197c070efd380dc9615c73dffad6c Author: Marek Szyprowski Date: Fri Oct 3 13:42:39 2025 +0200 spi: rockchip-sfc: Fix DMA-API usage Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys(). This fixes the following DMA-API debug warning: ------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ... Fixes: b69386fcbc60 ("spi: rockchip-sfc: Using normal memory for dma") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251003114239.431114-1-m.szyprowski@samsung.com Signed-off-by: Mark Brown commit 48b77733d0dbaf8cd0a122712072f92b2d95d894 Author: Jan Kara Date: Wed Oct 1 15:19:07 2025 +0200 expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID After commit 5402c4d4d200 ("exportfs: require ->fh_to_parent() to encode connectable file handles") we will fail to create non-decodable file handles for filesystems without export operations. Fix it. Fixes: 5402c4d4d200 ("exportfs: require ->fh_to_parent() to encode connectable file handles") Reviewed-by: Christian Brauner Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara commit 83d59d81b20c09c256099d1c15d7da21969581bd Author: Ran Xiaokai Date: Tue Sep 30 08:34:02 2025 +0000 slab: Fix using this_cpu_ptr() in preemptible context defer_free() maybe called in preemptible context, this will trigger the below warning message: BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 caller is defer_free+0x1b/0x60 Call Trace: dump_stack_lvl+0xac/0xc0 check_preemption_disabled+0xbe/0xe0 defer_free+0x1b/0x60 kfree_nolock+0x1eb/0x2b0 alloc_slab_obj_exts+0x356/0x390 __alloc_tagging_slab_alloc_hook+0xa0/0x300 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 __kmalloc_noprof+0x3dc/0x6d0 __list_lru_init+0x6c/0x210 alloc_super+0x3b6/0x470 sget_fc+0x5f/0x3a0 get_tree_nodev+0x27/0x90 vfs_get_tree+0x26/0xc0 vfs_kern_mount.part.0+0xb6/0x140 kern_mount+0x24/0x40 init_pipe_fs+0x4f/0x70 do_one_initcall+0x62/0x2e0 kernel_init_freeable+0x25b/0x4b0 kernel_init+0x1a/0x1c0 ret_from_fork+0x290/0x2e0 ret_from_fork_asm+0x11/0x20 Disable preemption in defer_free() and also defer_deactivate_slab() to make it safe. [vbabka@suse.cz: disable preemption instead of using raw_cpu_ptr() per the discussion ] Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Link: https://lore.kernel.org/r/20250930083402.782927-1-ranxiaokai627@163.com Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit fd94619c43360eb44d28bd3ef326a4f85c600a07 Merge: 4b616669d1d8e9 a42938e80357a1 Author: Linus Torvalds Date: Sun Oct 5 20:45:49 2025 -0700 Merge tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs update from Damien Le Moal: - Some comment spelling fixes (Xichao) * tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: correct some spelling mistakes commit 4b616669d1d8e91d0964b0861b51a3bca5f678c1 Merge: 7a405dbb0f036f f145845d8348c9 Author: Linus Torvalds Date: Sun Oct 5 20:43:01 2025 -0700 Merge tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Damien Le Moal: - Improve the DT bindings documentation for the highbanck, imx and xgene-ahci controllers (Krzysztof, Fabio, Rob) * tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: dt-bindings: ata: apm,xgene-ahci: Add apm,xgene-ahci-v2 support dt-bindings: ata: imx: Document 'target-supply' dt-bindings: ata: highbank: Minor whitespace cleanup in example commit c0d36727bf39bb16ef0a67ed608e279535ebf0da Author: Herbert Xu Date: Thu Oct 2 17:45:39 2025 +0800 crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it. Fixes: 77ebdabe8de7 ("crypto: af_alg - add extra parameters for DRBG interface") Reported-by: Yiqi Sun Signed-off-by: Herbert Xu commit ca1354f7999d30cf565e810b56cba688927107c6 Author: Herbert Xu Date: Mon Oct 6 10:07:53 2025 +0800 Revert "crypto: testmgr - desupport SHA-1 for FIPS 140" This reverts commit 9d50a25eeb05c45fef46120f4527885a14c84fb2. Reported-by: Jiri Slaby Reported-by: Jon Kohler Link: https://lore.kernel.org/all/05b7ef65-37bb-4391-9ec9-c382d51bae4d@kernel.org/ Link: https://lore.kernel.org/all/26F8FCC9-B448-4A89-81DF-6BAADA03E174@nutanix.com/ Signed-off-by: Herbert Xu commit 87064da2db7be537a7da20a25c18ba912c4db9e1 Author: Bruno Thomsen Date: Tue Sep 2 20:22:35 2025 +0200 rtc: pcf2127: fix watchdog interrupt mask on pcf2131 When using interrupt pin (INT A) as watchdog output all other interrupt sources need to be disabled to avoid additional resets. Resulting INT_A_MASK1 value is 55 (0x37). Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com Signed-off-by: Alexandre Belloni commit e22f4d1321e0055065f274e20bf6d1dbf4b500f5 Author: Harini T Date: Wed Jul 30 19:51:10 2025 +0530 rtc: zynqmp: Restore alarm functionality after kexec transition During kexec reboots, RTC alarms that are fired during the kernel transition experience delayed execution. The new kernel would eventually honor these alarms, but the interrupt handlers would only execute after the driver probe is completed rather than at the intended alarm time. This is because pending alarm interrupt status from the previous kernel is not properly cleared during driver initialization, causing timing discrepancies in alarm delivery. To ensure precise alarm timing across kexec transitions, enhance the probe function to: 1. Clear any pending alarm interrupt status from previous boot. 2. Detect existing valid alarms and preserve their state. 3. Re-enable alarm interrupts for future alarms. Signed-off-by: Harini T Link: https://lore.kernel.org/r/20250730142110.2354507-1-harini.t@amd.com Signed-off-by: Alexandre Belloni commit f38bdd730914be1fcd63240af89a2dc802148c8a Author: Xianwei Zhao Date: Tue Jul 22 19:30:48 2025 +0800 rtc: amlogic-a4: Optimize global variables Convert a global variable into a local one of aml_rtc_probe(). Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250722-rtc-regmap-v2-1-58bc17187a11@amlogic.com Signed-off-by: Alexandre Belloni commit 75b002a38d4f740d51f0e09dcd778541f61a2797 Author: Tóth János Date: Mon Apr 7 13:48:49 2025 +0200 rtc: sd2405al: Add I2C address. It is common to include the I2C address of the device in the source file. Signed-off-by: Tóth János Signed-off-by: Alexandre Belloni commit a5a19e80b235ed2c456dbab59c85ca43e87e01bf Author: Alexandre Belloni Date: Sun Oct 5 22:30:48 2025 +0200 rtc: Kconfig: move symbols to proper section There is only one HID RTC, the following symbols are for on-SoC RTCs Link: https://lore.kernel.org/r/20251005203048.3759240-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit b650cf9108efea71e51f1287f2e5ccd2144979af Author: Alexandre Belloni Date: Sun Oct 5 22:19:24 2025 +0200 rtc: optee: make optee_rtc_pm_ops static Fix sparse warningg: drivers/rtc/rtc-optee.c:714:1: sparse: sparse: symbol 'optee_rtc_pm_ops' was not declared. Should it be static? Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509230549.L26lw7UZ-lkp@intel.com/ Link: https://lore.kernel.org/r/20251005201925.3757345-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 7a405dbb0f036f8d1713ab9e7df0cd3137987b07 Merge: cf0e371d2b0e25 c14bdcc9f27462 Author: Linus Torvalds Date: Sun Oct 5 12:11:07 2025 -0700 Merge tag 'mm-stable-2025-10-03-16-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: "Only two patch series in this pull request: - "mm/memory_hotplug: fixup crash during uevent handling" from Hannes Reinecke fixes a race that was causing udev to trigger a crash in the memory hotplug code - "mm_slot: following fixup for usage of mm_slot_entry()" from Wei Yang adds some touchups to the just-merged mm_slot changes" * tag 'mm-stable-2025-10-03-16-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/khugepaged: use KMEM_CACHE() mm/ksm: cleanup mm_slot_entry() invocation Documentation/mm: drop pxx_mkdevmap() descriptions from page table helpers mm: clean up is_guard_pte_marker() drivers/base: move memory_block_add_nid() into the caller mm/memory_hotplug: activate node before adding new memory blocks drivers/base/memory: add node id parameter to add_memory_block() commit cf0e371d2b0e25d115442a281a232922a6dc0d6a Merge: 678074f1a8e035 99da5bf3dd6a8c Author: Linus Torvalds Date: Sun Oct 5 12:08:14 2025 -0700 Merge tag 'efi-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Document what OVMF stands for (Open Virtual Machine Firmware) - Clear NX restrictions also from 'more reliable' type memory when using the DXE service API * tag 'efi-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/x86: Memory protection on EfiGcdMemoryTypeMoreReliable efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text commit eb7392a019642f0ef5b9acd5e56a3f051d64a5ef Author: Dan Carpenter Date: Thu Sep 18 12:49:48 2025 +0300 rtc: optee: Fix error code in optee_rtc_read_alarm() Return "optee_alarm" instead of "alarm". The "alarm" pointer is a valid pointer and not an error pointer. Fixes: 6266aea864fa ("rtc: optee: add alarm related rtc ops to optee rtc driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/9e3718fe1128964907619ad325c0c5f5c1354ace.1758182509.git.dan.carpenter@linaro.org Signed-off-by: Alexandre Belloni commit 8bbd727453b497722b3e31b5d634c35faa953fbd Author: Dan Carpenter Date: Thu Sep 18 12:49:31 2025 +0300 rtc: optee: fix error code in probe() Return an error code if kthread_create() fails. Currently the code returns success. Fixes: 6266aea864fa ("rtc: optee: add alarm related rtc ops to optee rtc driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/21f1a18008f1bbc8f70d0bd5c05b72fbf5fc9c7d.1758182509.git.dan.carpenter@linaro.org Signed-off-by: Alexandre Belloni commit a6b4f791cdc56655b2dee8ac793f5b28dc4e542d Author: Rob Herring (Arm) Date: Wed Sep 24 17:28:46 2025 -0500 dt-bindings: rtc: Convert apm,xgene-rtc to DT schema Convert the APM XGene RTC binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250924222848.2949235-1-robh@kernel.org Signed-off-by: Alexandre Belloni commit 678074f1a8e03598977bdeea10a4ce51c4f4a0c4 Merge: 6a74422b9710e9 88b4cbcf6b041a Author: Linus Torvalds Date: Sun Oct 5 10:48:33 2025 -0700 Merge tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Just a couple of changes: crypto code cleanup and a IMA xattr bug fix" * tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr lib/digsig: Use SHA-1 library instead of crypto_shash integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS commit 6a74422b9710e987c7d6b85a1ade7330b1e61626 Merge: 742adaa16db994 c662a6fef10aff Author: Linus Torvalds Date: Sun Oct 5 10:09:55 2025 -0700 Merge tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - switch longson32 platform to DT and use MIPS_GENERIC framework - cleanups/fixes for lantiq DTs - other cleanups and fixes * tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) mips: math-emu: replace deprecated strcpy() in me-debugfs MIPS: configs: Consolidate Loongson1 defconfigs MIPS: Unify Loongson1 PRID_REV MIPS: loongson32: Switch to generic core MIPS: loongson: Add built-in DTB support MIPS: dts: loongson: Add CQ-T300B board MIPS: dts: loongson: Add Smartloong-1C board MIPS: dts: loongson: Add LSGZ_1B_DEV board MIPS: dts: loongson: Add LS1B-DEMO board dt-bindings: mips: loongson: Add LS1B-DEMO and CQ-T300B mips: lantiq: danube: rename stp node on EASY50712 reference board mips: lantiq: xway: sysctrl: rename stp clock MIPS: RB532: Replace deprecated strcpy() with memcpy() and strscpy() MIPS: Loongson64: Replace deprecated strcpy() with strscpy_pad() MIPS: generic: Replace deprecated strcpy() in ocelot_detect() MIPS: octeon: Replace deprecated strcpy() in octeon_model_get_string_buffer() MIPS: octeon: Replace memset(0) + deprecated strcpy() with strscpy_pad() MIPS: arc: Replace deprecated strcpy() with memcpy() MIPS: txx9: Replace deprecated strcpy() with strscpy() MIPS: sni: Replace deprecated strcpy() in sni_console_setup() ... commit 742adaa16db994ba1748465b95548e2f28aa18ca Merge: 21fbefc5886cc3 8c30b0018f9d93 Author: Linus Torvalds Date: Sun Oct 5 10:02:54 2025 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "I picked up one series from Chen Miao, our Google Summer of Code contributor, which adds OpenRISC support for static keys" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Add jump label support openrisc: Regenerate defconfigs. openrisc: Add R_OR1K_32_PCREL relocation type module support openrisc: Add text patching API support commit 21fbefc5886cc38cf7b57b28c35bd619efbce914 Merge: d9f24f8e60798c 61e19cd2e5c523 Author: Linus Torvalds Date: Sun Oct 5 09:43:36 2025 -0700 Merge tag 'trace-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Use READ_ONCE() and WRITE_ONCE() instead of RCU for syscall tracepoints Individual system call trace events are pseudo events attached to the raw_syscall trace events that just trace the entry and exit of all system calls. When any of these individual system call trace events get enabled, an element in an array indexed by the system call number is assigned to the trace file that defines how to trace it. When the trace event triggers, it reads this array and if the array has an element, it uses that trace file to know what to write it (the trace file defines the output format of the corresponding system call). The issue is that it uses rcu_dereference_ptr() and marks the elements of the array as using RCU. This is incorrect. There is no RCU synchronization here. The event file that is pointed to has a completely different way to make sure its freed properly. The reading of the array during the system call trace event is only to know if there is a value or not. If not, it does nothing (it means this system call isn't being traced). If it does, it uses the information to store the system call data. The RCU usage here can simply be replaced by READ_ONCE() and WRITE_ONCE() macros. - Have the system call trace events use "0x" for hex values Some system call trace events display hex values but do not have "0x" in front of it. Seeing "count: 44" can be assumed that it is 44 decimal when in actuality it is 44 hex (68 decimal). Display "0x44" instead. - Use vmalloc_array() in tracing_map_sort_entries() The function tracing_map_sort_entries() used array_size() and vmalloc() when it could have simply used vmalloc_array(). - Use for_each_online_cpu() in trace_osnoise.c() Instead of open coding for_each_cpu(cpu, cpu_online_mask), use for_each_online_cpu(). - Move the buffer field in struct trace_seq to the end The buffer field in struct trace_seq is architecture dependent in size, and caused padding for the fields after it. By moving the buffer to the end of the structure, it compacts the trace_seq structure better. - Remove redundant zeroing of cmdline_idx field in saved_cmdlines_buffer() The structure that contains cmdline_idx is zeroed by memset(), no need to explicitly zero any of its fields after that. - Use system_percpu_wq instead of system_wq in user_event_mm_remove() As system_wq is being deprecated, use the new wq. - Add cond_resched() is ftrace_module_enable() Some modules have a lot of functions (thousands of them), and the enabling of those functions can take some time. On non preemtable kernels, it was triggering a watchdog timeout. Add a cond_resched() to prevent that. - Add a BUILD_BUG_ON() to make sure PID_MAX_DEFAULT is always a power of 2 There's code that depends on PID_MAX_DEFAULT being a power of 2 or it will break. If in the future that changes, make sure the build fails to ensure that the code is fixed that depends on this. - Grab mutex_lock() before ever exiting s_start() The s_start() function is a seq_file start routine. As s_stop() is always called even if s_start() fails, and s_stop() expects the event_mutex to be held as it will always release it. That mutex must always be taken in s_start() even if that function fails. * tag 'trace-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix lock imbalance in s_start() memory allocation failure path tracing: Ensure optimized hashing works ftrace: Fix softlockup in ftrace_module_enable tracing: replace use of system_wq with system_percpu_wq tracing: Remove redundant 0 value initialization tracing: Move buffer in trace_seq to end of struct tracing/osnoise: Use for_each_online_cpu() instead of for_each_cpu() tracing: Use vmalloc_array() to improve code tracing: Have syscall trace events show "0x" for values greater than 10 tracing: Replace syscall RCU pointer assignment with READ/WRITE_ONCE() commit d9f24f8e60798c066ead61f77e67ee6a5a204514 Merge: 2cd14dff1660f8 05b7e10687c69e Author: Linus Torvalds Date: Sun Oct 5 09:38:26 2025 -0700 Merge tag 'trace-tools-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt - This is mostly just consolidating code between osnoise/timerlat and top/hist for easier maintenance and less future divergence * tag 'trace-tools-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/rtla: Add remaining support for osnoise actions tools/rtla: Add test engine support for unexpected output tools/rtla: Fix -A option name in test comment tools/rtla: Consolidate code between osnoise/timerlat and hist/top tools/rtla: Create common_apply_config() tools/rtla: Move top/hist params into common struct tools/rtla: Consolidate common parameters into shared structure commit 2cd14dff1660f80e81ad914317872686ebcdccc0 Merge: 6093a688a07da0 9cf9aa7b0acfde Author: Linus Torvalds Date: Sun Oct 5 08:16:20 2025 -0700 Merge tag 'probes-fixes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fix from Masami Hiramatsu: - Fix race condition in kprobe initialization causing NULL pointer dereference. This happens on weak memory model, which does not correctly manage the flags access with appropriate memory barriers. Use RELEASE-ACQUIRE to fix it. * tag 'probes-fixes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference commit 032676ff8217cab3273da56ee774b64c46b56b5e Author: Huacai Chen Date: Sun Oct 5 11:52:43 2025 +0800 LoongArch: Update Loongson-3 default config file 1. Increase NR_CPUS to 2048. 2. Enable KEXEC_FILE options. 3. Enable some EXT4/XFS options. 4. Enable Loongson PWM/MMC/BMC/SE drivers. 5. Enable simple DRM driver. 6. Enable some Intel ethernet drivers. 7. Enable some gpio drivers. 8. Enable some network options. 9. Enable SM3/SM4 cryptographic algorithms. Signed-off-by: Huacai Chen commit 6093a688a07da07808f0122f9aa2a3eed250d853 Merge: 59697e061f6aec 22d693e45d4a45 Author: Linus Torvalds Date: Sat Oct 4 16:26:32 2025 -0700 Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull Char/Misc/IIO/Binder updates from Greg KH: "Here is the big set of char/misc/iio and other driver subsystem changes for 6.18-rc1. Loads of different stuff in here, it was a busy development cycle in lots of different subsystems, with over 27k new lines added to the tree. Included in here are: - IIO updates including new drivers, reworking of existing apis, and other goodness in the sensor subsystems - MEI driver updates and additions - NVMEM driver updates - slimbus removal for an unused driver and some other minor updates - coresight driver updates and additions - MHI driver updates - comedi driver updates and fixes - extcon driver updates - interconnect driver additions - eeprom driver updates and fixes - minor UIO driver updates - tiny W1 driver updates But the majority of new code is in the rust bindings and additions, which includes: - misc driver rust binding updates for read/write support, we can now write "normal" misc drivers in rust fully, and the sample driver shows how this can be done. - Initial framework for USB driver rust bindings, which are disabled for now in the build, due to limited support, but coming in through this tree due to dependencies on other rust binding changes that were in here. I'll be enabling these back on in the build in the usb.git tree after -rc1 is out so that developers can continue to work on these in linux-next over the next development cycle. - Android Binder driver implemented in Rust. This is the big one, and was driving a huge majority of the rust binding work over the past years. Right now there are two binder drivers in the kernel, selected only at build time as to which one to use as binder wants to be included in the system at boot time. The binder C maintainers all agreed on this, as eventually, they want the C code to be removed from the tree, but it will take a few releases to get there while both are maintained to ensure that the rust implementation is fully stable and compliant with the existing userspace apis. All of these have been in linux-next for a while" * tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (320 commits) rust: usb: keep usb::Device private for now rust: usb: don't retain device context for the interface parent USB: disable rust bindings from the build for now samples: rust: add a USB driver sample rust: usb: add basic USB abstractions coresight: Add label sysfs node support dt-bindings: arm: Add label in the coresight components coresight: tnoc: add new AMBA ID to support Trace Noc V2 coresight: Fix incorrect handling for return value of devm_kzalloc coresight: tpda: fix the logic to setup the element size coresight: trbe: Return NULL pointer for allocation failures coresight: Refactor runtime PM coresight: Make clock sequence consistent coresight: Refactor driver data allocation coresight: Consolidate clock enabling coresight: Avoid enable programming clock duplicately coresight: Appropriately disable trace bus clocks coresight: Appropriately disable programming clocks coresight: etm4x: Support atclk coresight: catu: Support atclk ... commit 59697e061f6aec86d5738cd4752e16520f1d60dc Merge: c6006b8ca14dcc b76029bdd71054 Author: Linus Torvalds Date: Sat Oct 4 16:17:14 2025 -0700 Merge tag 'staging-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the 'big' set of staging driver changes for 6.18-rc1. Nothing really exciting in here they pretty much consist of: - minor coding style changes and cleanups - some api layer removals where not needed Overall a quiet development cycle. All have been in linux-next for a while with no reported issues" * tag 'staging-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (63 commits) staging: rtl8723bs: xmit: rephrase comment and drop extra space staging: sm750fb: rename camel case variable staging: rtl8723bs: hal: put return type and function name on one line staging: rtl8723bs: fix typo in comment staging: sm750fb: rename snake case variables staging: sm750fb: remove unnecessary volatile qualifiers staging: rtl8723bs: rtw_efuse.h: simplify copyright banner staging: rtl8723bs: remove unused tables staging: rtl8723bs: Hal_EfuseParseAntennaDiversity_8723B is empty staging: rtl8723bs: remove REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723 staging: rtl8723bs: remove bWrite from Hal_EfusePowerSwitch staging: rtl8723bs: remove wrapper Efuse_PowerSwitch staging: octeon: Clean up dead code in ethernet-tx.c staging: rtl8723bs: fix fortify warnings by using struct_group staging: gpib: use int type to store negative error codes staging: rtl8723bs: remove include/recv_osdep.h staging: rtl8723bs: remove os_dep/recv_linux.c staging: rtl8723bs: rename rtw_os_recv_indicate_pkt staging: rtl8723bs: move rtw_os_recv_indicate_pkt to rtw_recv.c staging: rtl8723bs: rename rtw_os_alloc_msdu_pkt ... commit c6006b8ca14dcc604567be99fc4863e6e11ab6e3 Merge: 5d2f4730bb7550 e40b984b6c4ce3 Author: Linus Torvalds Date: Sat Oct 4 16:07:08 2025 -0700 Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and thunderbolt drivers for 6.18-rc1. It was another normal development cycle, with lots of the usual drivers getting updates: - Thunderbolt driver cleanups and additions - dwc3 driver updates - dwc2 driver updates - typec driver updates - xhci driver updates and additions - offload USB engine updates for better power management - unused tracepoint removals - usb gadget fixes and updates as more users start to rely on these drivers instead of the "old" function gadget drivers - new USB device ids - other minor driver USB driver updates - new USB I/O driver framework and driver additions" The last item, the usb i/o driver, has an i2c and gpio driver added through this tree. Those drivers were acked by the respective subsystem maintainers. All of these have been in linux-next for a while" * tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (132 commits) usb: vhci-hcd: Prevent suspending virtually attached devices USB: serial: option: add SIMCom 8230C compositions thunderbolt: Fix use-after-free in tb_dp_dprx_work usb: xhci: align PORTSC trace with one-based port numbering usb: xhci: correct indentation for PORTSC tracing function usb: xhci: improve TR Dequeue Pointer mask usb: xhci-pci: add support for hosts with zero USB3 ports usb: xhci: Update a comment about Stop Endpoint retries Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" usb: gadget: f_rndis: Refactor bind path to use __free() usb: gadget: f_ecm: Refactor bind path to use __free() usb: gadget: f_acm: Refactor bind path to use __free() usb: gadget: f_ncm: Refactor bind path to use __free() usb: gadget: Introduce free_usb_request helper usb: gadget: Store endpoint pointer in usb_request usb: host: xhci-rcar: Add Renesas RZ/G3E USB3 Host driver support usb: host: xhci-plat: Add .post_resume_quirk for struct xhci_plat_priv usb: host: xhci-rcar: Move R-Car reg definitions dt-bindings: usb: Document Renesas RZ/G3E USB3HOST usb: gadget: f_fs: Fix epfile null pointer access after ep enable. ... commit 5d2f4730bb7550d64c87785f1035d0e641dbc979 Merge: cc07b0a3afc8c1 f4abab350840d5 Author: Linus Torvalds Date: Sat Oct 4 15:57:44 2025 -0700 Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here are some small updates for tty/serial drivers for 6.18-rc1. Not many changes overall, just the usual: - abi cleanups and reworking of the tty functions by Jiri by adding console lock guard logic - 8250_platform driver updates - qcom-geni driver updates - other minor serial driver updates - some more vt escape codes added All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (43 commits) tty: serial: fix help message for SERIAL_CPM serial: 8250: omap: Support wakeup pinctrl state on suspend dt-bindings: serial: 8250_omap: Add wakeup pinctrl state serial: max310x: improve interrupt handling vt: move vc_saved_screen to within tty allocated judgment Revert "m68k: make HPDCA and HPAPCI bools" tty: remove redundant condition checks tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() vt: remove redundant check on vc_mode in con_font_set() serial: qcom-geni: Add DFS clock mode support to GENI UART driver m68k: make HPDCA and HPAPCI bools tty: n_gsm: Don't block input queue by waiting MSC serial: qcom-geni: Fix off-by-one error in ida_alloc_range() serdev: Drop dev_pm_domain_detach() call serial: sc16is7xx: drop redundant conversion to bool vt: add support for smput/rmput escape codes serial: stm32: allow selecting console when the driver is module serial: 8250_core: fix coding style issue tty: serial: Modify the use of dev_err_probe() s390/char/con3270: use tty_port_tty guard() ... commit cc07b0a3afc8c15c1308497033453b44f7ccfc49 Merge: 20f868da2cc6c2 efebdf4b722143 Author: Linus Torvalds Date: Sat Oct 4 15:50:37 2025 -0700 Merge tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD core: - Bad blocks increment is skipped if the block is already known bad (improves user statistics relevance) - Expose the OOB layout via debugfs Raw NAND: - Add support for Loongson-2K1000 and Loongson-2K0500 NAND controllers, including extra features, such as chip select and 6-byte NAND ID reading support - Drop the s3c2410 driver SPI NAND: - Important SPI NAND continuous read improvements and fixes - Add support for FudanMicro FM25S01A - Add support for continuous reads in Gigadevice vendor driver ECC: - Add support for the Realtek ECC engine SPI NOR: - Some flashes can't perform reads or writes with start or end being an odd number in Octal DTR mode. File systems like UBIFS can request such reads or writes, causing the transaction to error out. Pad the read or write transactions with extra bytes to avoid this problem. And the usual amount of various miscellaneous fixes" * tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (46 commits) mtd: rawnand: sunxi: drop unused module alias mtd: rawnand: stm32_fmc2: drop unused module alias mtd: rawnand: rockchip: drop unused module alias mtd: rawnand: pl353: drop unused module alias mtd: rawnand: omap2: drop unused module alias mtd: rawnand: atmel: drop unused module alias mtd: onenand: omap2: drop unused module alias mtd: hyperbus: hbmc-am654: drop unused module alias mtd: jedec_probe: use struct_size() helper for cfiq allocation mtd: cfi: use struct_size() helper for cfiq allocation mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N mtd: rawnand: omap2: fix device leak on probe failure mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands mtd: nand: realtek-ecc: Add Realtek external ECC engine support dt-bindings: mtd: Add realtek,rtl9301-ecc mtd: spinand: repeat reading in regular mode if continuous reading fails mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails mtd: spinand: fix direct mapping creation sizes mtd: rawnand: fsmc: Default to autodetect buswidth mtd: nand: move nand_check_erased_ecc_chunk() to nand/core ... commit 20f868da2cc6c2d53e8a3c7a2a4d1edf5c730eae Merge: c35f902cb31dad 09390ed9af37ed Author: Linus Torvalds Date: Sat Oct 4 15:46:51 2025 -0700 Merge tag 'rpmsg-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Clean up the dev_pm_domain integration in rpmsg core. Correct module aliases for the rpmsg char driver. - Transition Qualcomm SMD and GLINK drivers to strscpy() and fix the regression in legacy code for acquiring outgoing interrupts using the non-mailbox based mechanism. * tag 'rpmsg-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse rpmsg: Use strscpy() instead of strscpy_pad() rpmsg: core: Drop dev_pm_domain_detach() call rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table commit c35f902cb31dad551dcc1c79540a58145cb19479 Merge: 54ba6d9b1393a0 d41e075b077142 Author: Linus Torvalds Date: Sat Oct 4 15:45:17 2025 -0700 Merge tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Enable coredump support for the i.MX HiFi core remoteproc, and clean up the i.MX remoteproc driver. - Introduce remoteprocs on the Qualcomm Milos platform. Gracefully shut own the ADSP remoteproc when bootloader has loaded the "Lite" firmware on X Elite. Improve the resource handover procedure to avoid possibly duplicate handling. - Transition the TI DA8xx, TI Keystone, and TI Wakeup M3 remoteproc drivers to handle resources using devres. * tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (29 commits) remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() remoteproc: qcom: pas: Drop redundant assignment to ret remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E remoteproc: qcom: q6v5: Avoid handling handover twice remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice remoteproc: qcom: pas: Add Milos remoteproc support dt-bindings: remoteproc: qcom,milos-pas: Document remoteprocs remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 remoteproc: imx_rproc: Clean up after ops introduction remoteproc: imx_rproc: Simplify IMX_RPROC_SMC switch case remoteproc: imx_rproc: Simplify IMX_RPROC_SCU_API switch case remoteproc: imx_rproc: Simplify IMX_RPROC_MMIO switch case remoteproc: imx_rproc: Move imx_rproc_dcfg closer to imx_rproc_of_match remoteproc: imx_rproc: Introduce start/stop/detect_mode ops for imx_rproc_dcfg remoteproc: k3: Correctly release some resources allocated in k3_rproc_request_mbox() remoteproc: wkup_m3: Use devm_rproc_add() helper remoteproc: wkup_m3: Use devm_rproc_alloc() helper remoteproc: wkup_m3: Use devm action to call PM runtime put sync remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper remoteproc: keystone: Use devm_rproc_add() helper ... commit 54ba6d9b1393a0061600c0e49c8ebef65d60a8b2 Merge: b66451723c45b7 cd3770675874ae Author: Linus Torvalds Date: Sat Oct 4 15:38:04 2025 -0700 Merge tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - haptic touchpad support (Angela Czubak and Jonathan Denose) - support for audio jack handling on DualSense Playstation controllers (Cristian Ciocaltea) - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin Tissoires) - rework hidraw ioctls to make them safer (and tested) (Benjamin Tissoires) - various PIDFF and universal-PIDFF fixes/improvements (Tomasz Pakuła) - better configuration of Intel QuickI2C through ACPI (Xinpeng Sun) - other assorted cleanups and fixes * tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (58 commits) HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker() HID: playstation: Silence sparse warnings for locking context imbalances HID: playstation: Update SP preamp gain comment line HID: intel-thc-hid: intel-quicki2c: support ACPI config for advanced features HID: core: Change hid_driver to use a const char* for name HID: hidraw: tighten ioctl command parsing selftests/hid: hidraw: forge wrong ioctls and tests them selftests/hid: hidraw: add more coverage for hidraw ioctls selftests/hid: update vmtest.sh for virtme-ng HID: playstation: Support DualSense audio jack event reporting HID: playstation: Support DualSense audio jack hotplug detection HID: playstation: Redefine DualSense input report status field HID: playstation: Prefer kzalloc(sizeof(*buf)...) HID: playstation: Document spinlock_t usage HID: playstation: Fix all alignment and line length issues HID: playstation: Correct spelling in comment sections HID: playstation: Replace uint{32,16,8}_t with u{32,16,8} HID: playstation: Simplify locking with guard() and scoped_guard() HID: playstation: Add spaces around arithmetic operators HID: playstation: Make use of bitfield macros ... commit b66451723c45b791fd2824d1b8f62fe498989e23 Merge: b4e5bb55559482 b8754092dfed4f Author: Linus Torvalds Date: Sat Oct 4 15:28:18 2025 -0700 Merge tag 'platform-drivers-x86-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: - amd/pmf: - Add support for adjusting PMF PPT and PPT APU thresholds - Extend custom BIOS inputs for more policies - Update ta_pmf_action structure to the latest PMF TA - arm64: - thinkpad-t14s-ec: Add EC driver for ThinkPad T14s Gen6 Snapdragon - int3472: - Increase handshake GPIO delay - intel/pmc: - SSRAM support for Lunar Lake and Panther Lake - Support reading substate requirements data from S0ix blockers (for platforms starting from Panther Lake) - Wildcat Lake support - intel-uncore-freq: - Solve duplicate sysfs entry warnings - Present unique domain ID per package - portwell-ec: - Support suspend/resume - Add hwmon support for voltage and temperature - redmi-wmi: - Add WMI driver for Redmibook keyboard - think-lmi: - Certificate support for ThinkCenter - x86-android-tables + others: - Convert away from legacy GPIO APIs - x86-android-tables: - Add support for Acer A1-840 tablet - Fix modules list for Lenovo devices - Stop using EPROBE_DEFER - Miscellaneous cleanups / refactoring / improvements * tag 'platform-drivers-x86-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (63 commits) platform/x86: pcengines-apuv2: Use static device properties platform/x86: meraki-mx100: Use static device properties platform/x86: barco-p50-gpio: use software nodes for gpio-leds/keys platform/x86: x86-android-tablets: Stop using EPROBE_DEFER platform/x86: x86-android-tablets: Fix modules lists for Lenovo devices platform/x86: x86-android-tablets: Simplify lenovo_yoga_tab2_830_1050_exit() platform/x86: x86-android-tablets: Add support for Acer A1-840 tablet platform/x86: x86-android-tablets: Move Acer info to its own file platform/x86: x86-android-tablets: Update my email address platform/x86: x86-android-tablets: Simplify node-group [un]registration platform/x86: x86-android-tablets: use swnode_group instead of manual registering platform/x86: x86-android-tablets: replace bat_swnode with swnode_group platform/x86: x86-android-tablets: convert gpio_keys devices to GPIO references platform/x86: x86-android-tablets: remove support for GPIO lookup tables platform/x86: x86-android-tablets: convert Yoga Tab2 fast charger to GPIO references platform/x86: x86-android-tablets: convert HID-I2C devices to GPIO references platform/x86: x86-android-tablets: convert wm1502 devices to GPIO references platform/x86: x86-android-tablets: convert int3496 devices to GPIO references platform/x86: x86-android-tablets: convert EDT devices to GPIO references platform/x86: x86-android-tablets: convert Novatek devices to GPIO references ... commit b4e5bb555594826bb98aaf8bcd9f957f0428cb07 Merge: 908057d185a415 8be70a8fc667c3 Author: Linus Torvalds Date: Sat Oct 4 15:23:29 2025 -0700 Merge tag 'keys-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys updates from Jarkko Sakkinen: "A few minor updates/fixes for keys" * tag 'keys-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: security: keys: use menuconfig for KEYS symbol KEYS: encrypted: Use SHA-256 library instead of crypto_shash KEYS: trusted_tpm1: Move private functionality out of public header KEYS: trusted_tpm1: Use SHA-1 library instead of crypto_shash KEYS: trusted_tpm1: Compare HMAC values in constant time commit 908057d185a41560a55890afa69c9676fc63e55c Merge: d104e3d17f7bfc 166c83f7789ed0 Author: Linus Torvalds Date: Sat Oct 4 14:59:29 2025 -0700 Merge tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "Drivers: - Add ciphertext hiding support to ccp - Add hashjoin, gather and UDMA data move features to hisilicon - Add lz4 and lz77_only to hisilicon - Add xilinx hwrng driver - Add ti driver with ecb/cbc aes support - Add ring buffer idle and command queue telemetry for GEN6 in qat Others: - Use rcu_dereference_all to stop false alarms in rhashtable - Fix CPU number wraparound in padata" * tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (78 commits) dt-bindings: rng: hisi-rng: convert to DT schema crypto: doc - Add explicit title heading to API docs hwrng: ks-sa - fix division by zero in ks_sa_rng_init KEYS: X.509: Fix Basic Constraints CA flag parsing crypto: anubis - simplify return statement in anubis_mod_init crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs crypto: hisilicon/qm - clear all VF configurations in the hardware crypto: hisilicon - enable error reporting again crypto: hisilicon/qm - mask axi error before memory init crypto: hisilicon/qm - invalidate queues in use crypto: qat - Return pointer directly in adf_ctl_alloc_resources crypto: aspeed - Fix dma_unmap_sg() direction rhashtable: Use rcu_dereference_all and rcu_dereference_all_check crypto: comp - Use same definition of context alloc and free ops crypto: omap - convert from tasklet to BH workqueue crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() crypto: caam - double the entropy delay interval for retry padata: WQ_PERCPU added to alloc_workqueue users padata: replace use of system_unbound_wq with system_dfl_wq crypto: cryptd - WQ_PERCPU added to alloc_workqueue users ... commit d104e3d17f7bfc505281f57f8c1a5589fca6ffe4 Merge: 67da125e30ab17 46037455cbb748 Author: Linus Torvalds Date: Sat Oct 4 12:02:50 2025 -0700 Merge tag 'cxl-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "The changes include adding poison injection support, fixing CXL access coordinates when onlining CXL memory, and delaing the enumeration of downstream switch ports for CXL hierarchy to ensure that the CXL link is established at the time of enumeration to address a few issues observed on AMD and Intel platforms. Misc changes: - Use str_plural() instead of open code for emitting strings. - Use str_enabled_disabled() instead of ternary operator - Fix emit of type resource_size_t argument for validate_region_offset() - Typo fixup in CXL driver-api documentation - Rename CFMWS coherency restriction defines - Add convention doc describe dealing with x86 low memory hole and CXL Poison Inject support: - Move hpa_to_spa callback to new reoot decoder ops structure - Define a SPA to HPA callback for interleave calculation with XOR math - Add support for SPA to DPA address translation with XOR - Add locked variants of poison inject and clear functions - Add inject and clear poison support by region offset CXL access coordinates update fix: - A comment update for hotplug memory callback prority defines - Add node_update_perf_attrs() for updating perf attrs on a node - Update cxl_access_coordinates() to use the new node update function - Remove hmat_update_target_coordinates() and related code CXL delayed downstream port enumeration and initialization: - Add helper to detect top of CXL device topology and remove open coding - Add helper to delete single dport - Add a cached copy of target_map to cxl_decoder - Refactor decoder setup to reduce cxl_test burden - Defer dport allocation for switch ports - Add mock version of devm_cxl_add_dport_by_dev() for cxl_test - Adjust the mock version of devm_cxl_switch_port_decoders_setup() due to cxl core usage - Setup target_map for cxl_test decoder initialization - Change SSLBIS handler to handle single dport - Move port register setup to when first dport appears" * tag 'cxl-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (25 commits) cxl: Move port register setup to when first dport appear cxl: Change sslbis handler to only handle single dport cxl/test: Setup target_map for cxl_test decoder initialization cxl/test: Adjust the mock version of devm_cxl_switch_port_decoders_setup() cxl/test: Add mock version of devm_cxl_add_dport_by_dev() cxl: Defer dport allocation for switch ports cxl/test: Refactor decoder setup to reduce cxl_test burden cxl: Add a cached copy of target_map to cxl_decoder cxl: Add helper to delete dport cxl: Add helper to detect top of CXL device topology cxl: Documentation/driver-api/cxl: Describe the x86 Low Memory Hole solution cxl/acpi: Rename CFMW coherency restrictions Documentation/driver-api: Fix typo error in cxl acpi/hmat: Remove now unused hmat_update_target_coordinates() cxl, acpi/hmat: Update CXL access coordinates directly instead of through HMAT drivers/base/node: Add a helper function node_update_perf_attrs() mm/memory_hotplug: Update comment for hotplug memory callback priorities cxl: Fix emit of type resource_size_t argument for validate_region_offset() cxl/region: Add inject and clear poison by region offset cxl/core: Add locked variants of the poison inject and clear funcs ... commit 67da125e30ab17b5b8874eb32882e81cdec17ec8 Merge: 48e3694ae7fae3 1d289fc5691c7a Author: Linus Torvalds Date: Sat Oct 4 11:28:45 2025 -0700 Merge tag 'rcu.2025.09.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Paul McKenney: "Documentation updates: - Update whatisRCU.rst and checklist.rst for recent RCU API additions - Fix RCU documentation formatting and typos - Replace dead Ottawa Linux Symposium links in RTFP.txt Miscellaneous RCU updates: - Document that rcu_barrier() hurries RCU_LAZY callbacks - Remove redundant interrupt disabling from rcu_preempt_deferred_qs_handler() - Move list_for_each_rcu from list.h to rculist.h, and adjust the include directive in kernel/cgroup/dmem.c accordingly - Make initial set of changes to accommodate upcoming system_percpu_wq changes SRCU updates: - Create an srcu_read_lock_fast_notrace() for eventual use in tracing, including adding guards - Document the reliance on per-CPU operations as implicit RCU readers in __srcu_read_{,un}lock_fast() - Document the srcu_flip() function's memory-barrier D's relationship to SRCU-fast readers - Remove a redundant preempt_disable() and preempt_enable() pair from srcu_gp_start_if_needed() Torture-test updates: - Fix jitter.sh spin time so that it actually varies as advertised. It is still quite coarse-grained, but at least it does now vary - Update torture.sh help text to include the not-so-new --do-normal parameter, which permits (for example) testing KCSAN kernels without doing non-debug kernels - Fix a number of false-positive diagnostics that were being triggered by rcutorture starting before boot completed. Running multiple near-CPU-bound rcutorture processes when there is only the boot CPU is after all a bit excessive - Substitute kcalloc() for kzalloc() - Remove a redundant kfree() and NULL out kfree()ed objects" * tag 'rcu.2025.09.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (31 commits) rcu: WQ_UNBOUND added to sync_wq workqueue rcu: WQ_PERCPU added to alloc_workqueue users rcu: replace use of system_wq with system_percpu_wq refperf: Set reader_tasks to NULL after kfree() refperf: Remove redundant kfree() after torture_stop_kthread() srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed() srcu: Document srcu_flip() memory-barrier D relation to SRCU-fast srcu: Document __srcu_read_{,un}lock_fast() implicit RCU readers rculist: move list_for_each_rcu() to where it belongs refscale: Use kcalloc() instead of kzalloc() rcutorture: Use kcalloc() instead of kzalloc() docs: rcu: Replace multiple dead OLS links in RTFP.txt doc: Fix typo in RCU's torture.rst documentation Documentation: RCU: Retitle toctree index Documentation: RCU: Reduce toctree depth Documentation: RCU: Wrap kvm-remote.sh rerun snippet in literal code block rcu: docs: Requirements.rst: Abide by conventions of kernel documentation doc: Add RCU guards to checklist.rst doc: Update whatisRCU.rst for recent RCU API additions rcutorture: Delay forward-progress testing until boot completes ... commit 48e3694ae7fae347c1193c84f384f4ea41086075 Merge: b41048485ee395 7a75a5da79ef90 Author: Linus Torvalds Date: Sat Oct 4 11:13:11 2025 -0700 Merge tag 'printk-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Add KUnit test for the printk ring buffer - Fix the check of the maximal record size which is allowed to be stored into the printk ring buffer. It prevents corruptions of the ring buffer. Note that printk() is on the safe side. The messages are limited by 1kB buffer and are always small enough for the minimal log buffer size 4kB, see CONFIG_LOG_BUF_SHIFT definition. * tag 'printk-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: ringbuffer: Fix data block max size check printk: kunit: support offstack cpumask printk: kunit: Fix __counted_by() in struct prbtest_rbdata printk: ringbuffer: Explain why the KUnit test ignores failed writes printk: ringbuffer: Add KUnit test commit b41048485ee395edbbb69fc83491d314268f7bdb Merge: c4c8bcab18821e e68f150bc11d0a Author: Linus Torvalds Date: Sat Oct 4 11:03:10 2025 -0700 Merge tag 'memblock-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull mm-init update from Mike Rapoport: "Simplify deferred initialization of struct pages Refactor and simplify deferred initialization of the memory map. Beside the negative diffstat it gives 3ms (55ms vs 58ms) reduction in the initialization of deferred pages on single node system with 64GiB of RAM" * tag 'memblock-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: drop for_each_free_mem_pfn_range_in_zone_from() mm/mm_init: drop deferred_init_maxorder() mm/mm_init: deferred_init_memmap: use a job per zone mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone() commit c4c8bcab18821e0c2852c38dece918512c60c732 Merge: 86bcf7be1e26f2 fe0126702a40b2 Author: Linus Torvalds Date: Sat Oct 4 10:59:06 2025 -0700 Merge tag 'sparc-for-6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc Pull sparc updates from Andreas Larsson: - Add relocation handling for R_SPARC_UA64 for sparc64 that is generated by llvm and clarify printout on missing relocation handler - Fix missing hugetlb tte initialization for sun4u - Code cleanup for redundant use of __GPF_NOWARN for sparc64 - Fix prototypes of reads[bwl]() for sparc64 by adding missing const and volatile pointer qualifiers - Fix bugs in accurate exception reporting in multiple machine specific sparc64 variants of copy_{from,to}_user() for sparc64 - Fix memory leak in error handling for sparc32 - Drop -ansi from asflags and replace __ASSEMBLY__ with __ASSEMBLER__ in headers for all arch/sparc - Replace strcpy() with strscpy() for all arch/sparc * tag 'sparc-for-6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc: (22 commits) sparc: Replace deprecated strcpy() with strscpy() in handle_nextprop_quirks() sparc64: Replace deprecated strcpy() with strscpy() in build_path_component() sparc: Replace deprecated strcpy() with strscpy() in prom_32.c sparc: Replace deprecated strcpy() with strscpy() in domain services driver sparc64: Replace deprecated strcpy() with strscpy() in prom_nextprop() sparc: floppy: Replace deprecated strcpy() with strscpy() in sun_floppy_init() sparc: parport: Replace deprecated strcpy() with strscpy() in ecpp_probe() sparc: PCI: Replace deprecated strcpy() with strscpy() sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers sparc: Drop the "-ansi" from the asflags sparc: fix error handling in scan_one_device() sparc: fix accurate exception reporting in copy_{from,to}_user for M7 sparc: fix accurate exception reporting in copy_to_user for Niagara 4 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC sparc64: fix prototypes of reads[bwl]() sparc64: Remove redundant __GFP_NOWARN sparc64: fix hugetlb for sun4u ... commit 86bcf7be1e26f2d7277df90857d93ce0ebc11370 Merge: 7c738cb4ca678e 68247d45c045bb Author: Linus Torvalds Date: Sat Oct 4 10:36:22 2025 -0700 Merge tag 'riscv-for-linus-6.18-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Paul Walmsley: - Support for the RISC-V-standardized RPMI interface. RPMI is a platform management communication mechanism between OSes running on application processors, and a remote platform management processor. Similar to ARM SCMI, TI SCI, etc. This includes irqchip, mailbox, and clk changes. - Support for the RISC-V-standardized MPXY SBI extension. MPXY is a RISC-V-specific standard implementing a shared memory mailbox between S-mode operating systems (e.g., Linux) and M-mode firmware (e.g., OpenSBI). It is part of this PR since one of its use cases is to enable M-mode firmware to act as a single RPMI client for all RPMI activity on a core (including S-mode RPMI activity). Includes a mailbox driver. - Some ACPI-related updates to enable the use of RPMI and MPXY. - The addition of Linux-wide memcpy_{from,to}_le32() static inline functions, for RPMI use. - An ACPI Kconfig change to enable boot logos on any ACPI-using architecture (including RISC-V) - A RISC-V defconfig change to add GPIO keyboard and event device support, for front panel shutdown or reboot buttons * tag 'riscv-for-linus-6.18-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (26 commits) clk: COMMON_CLK_RPMI should depend on RISCV ACPI: support BGRT table on RISC-V MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers RISC-V: Enable GPIO keyboard and event device in RV64 defconfig irqchip/riscv-rpmi-sysmsi: Add ACPI support mailbox/riscv-sbi-mpxy: Add ACPI support irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode() ACPI: RISC-V: Add RPMI System MSI to GSI mapping ACPI: RISC-V: Add support to update gsi range ACPI: RISC-V: Create interrupt controller list in sorted order ACPI: scan: Update honor list for RPMI System MSI ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop irqchip: Add driver for the RPMI system MSI service group dt-bindings: Add RPMI system MSI interrupt controller bindings dt-bindings: Add RPMI system MSI message proxy bindings clk: Add clock driver for the RISC-V RPMI clock service group dt-bindings: clock: Add RPMI clock service controller bindings dt-bindings: clock: Add RPMI clock service message proxy bindings mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver ... commit 7c738cb4ca678e70c4583ab35587f30bfae823e5 Merge: be786eba12c87d 3da01ffe1aeaa0 Author: Linus Torvalds Date: Sat Oct 4 10:25:22 2025 -0700 Merge tag 'x86_entry_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry updates from Dave Hansen: "A pair of x86/entry updates. The FRED one adjusts the kernel to the latest spec. The spec change prevents attackers from abusing kernel entry points. The second one came about because of the LASS work[1]. It moves the vsyscall emulation code away from depending on X86_PF_INSTR which is not available on some CPUs. Those CPUs are pretty obscure these days, but this still seems like the right thing to do. It also makes this code consistent with some things that the LASS code is going to do. - Use RIP instead of X86_PF_INSTR for vsyscall emulation - Remove ENDBR64 from FRED entry points" Link: https://lore.kernel.org/lkml/20250620135325.3300848-1-kirill.shutemov@linux.intel.com/ [1] * tag 'x86_entry_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fred: Remove ENDBR64 from FRED entry points x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall commit be786eba12c87dc04ad8eac408dc17369c04ad47 Merge: 50ac57c3b156e8 86e6815b316ec0 Author: Linus Torvalds Date: Sat Oct 4 10:20:26 2025 -0700 Merge tag 'x86_mm_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm update from Dave Hansen: "A single change to remove an open-coded TLB flush operation by using an existing helper. This came out of Rik van Riel's work to get the INVLPGB instruction working. - Change cpa_flush() to call flush_kernel_range() directly" * tag 'x86_mm_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Change cpa_flush() to call flush_kernel_range() directly commit 50ac57c3b156e893e34310f0be340a130f36f6db Merge: 5b7ce9385441cf e414b1005891d7 Author: Linus Torvalds Date: Sat Oct 4 10:01:30 2025 -0700 Merge tag 'x86_tdx_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "The biggest change here is making TDX and kexec play nicely together. Before this, the memory encryption hardware (which doesn't respect cache coherency) could write back old cachelines on top of data in the new kernel, so kexec and TDX were made mutually exclusive. This removes the limitation. There is also some work to tighten up a hardware bug workaround and some MAINTAINERS updates. - Make TDX and kexec work together - Skip TDX bug workaround when the bug is not present - Update maintainers entries" * tag 'x86_tdx_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/virt/tdx: Use precalculated TDVPR page physical address KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs x86/virt/tdx: Update the kexec section in the TDX documentation x86/virt/tdx: Remove the !KEXEC_CORE dependency x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL x86/sme: Use percpu boolean to control WBINVD during kexec x86/kexec: Consolidate relocate_kernel() function parameters x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present x86/tdx: Tidy reset_pamt functions x86/tdx: Eliminate duplicate code in tdx_clear_page() MAINTAINERS: Add KVM mail list to the TDX entry MAINTAINERS: Add Rick Edgecombe as a TDX reviewer MAINTAINERS: Update the file list in the TDX entry. commit 5b7ce9385441cfce92e6b7324216cc38614f86ef Merge: f3826aa9962b45 fdbdd0ccb30af1 Author: Linus Torvalds Date: Sat Oct 4 09:59:05 2025 -0700 Merge tag 'kgdb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "A collection of small cleanups this cycle. Thorsten Blum has replaced a number strcpy() calls with safer alternatives (fixing a pointer aliasing bug in the process). Colin Ian King has simplified things by removing some unreachable code" * tag 'kgdb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: remove redundant check for scancode 0xe0 kdb: Replace deprecated strcpy() with helper function in kdb_defcmd() kdb: Replace deprecated strcpy() with memcpy() in parse_grep() kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() kdb: Replace deprecated strcpy() with memcpy() in kdb_strdup() kernel: debug: gdbstub: Replace deprecated strcpy() with strscpy() commit d51e7cfca3fe5540466322c33d665674530148dd Author: Wolfram Sang Date: Thu Sep 25 23:05:18 2025 +0200 i2c: mt65xx: convert set_speed function to void cppcheck rightfully reports: drivers/i2c/busses/i2c-mt65xx.c:1464:6: warning: Condition 'ret' is always false [knownConditionTrueFalse] Make the function void and simplify the code. Signed-off-by: Wolfram Sang Reviewed-by: AngeloGioacchino Del Regno commit b71a6e2a1b710ea31c363a72c75f510ef35d8e69 Author: Byungchul Park Date: Thu Oct 2 17:12:35 2025 +0900 i2c: rename wait_for_completion callback to wait_for_completion_cb Functionally no change. Remove the ambiguity of 'wait_for_completion'. It helps development of the DEPT dependency tracker, but seems favorable in any case. Signed-off-by: Byungchul Park [wsa: reworded commit message] Signed-off-by: Wolfram Sang commit 09dc3972be3f6191ab021ac01932bf5279f961f0 Author: Thomas Richter Date: Thu Oct 2 09:36:20 2025 +0200 s390/pai_crypto: Consolidate PAI crypto allocation and cleanup paths Introduce paicrypt_free() to centralize memory release for per-CPU maps and remove duplicated free logic. Replace paicrypt_busy() with paicrypt_alloc_cpu() returning int error codes instead of ERR_PTR, and adjust callers accordingly. System-wide allocation now uses paicrypt_alloc() with consistent error handling. Memory allocation and free management is now identical to PMU pai_ext. Reference counting and root anchor management remain unchanged. Debug output in the destroy path is dropped. Signed-off-by: Thomas Richter Tested-by: Jan Polensky Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 Author: Vineeth Vijayan Date: Wed Oct 1 15:38:17 2025 +0200 s390/cio: Update purge function to unregister the unused subchannels Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable. As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list. Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") Suggested-by: Peter Oberparleiter Reviewed-by: Peter Oberparleiter Signed-off-by: Vineeth Vijayan Signed-off-by: Heiko Carstens commit b043a81ce3ee3aa1d4adc63eb77203a652cfc94e Author: Ramesh Errabolu Date: Sun Sep 28 23:38:27 2025 -0500 s390/pci: Expose firmware provided UID Checking state in sysfs The sysfs file /sys/bus/pci/devices//uid_is_unique provides the UID Checking state as a per device attribute, highlighting its effect of providing the guarantee that a device's UID is unique. As a device attribute, this parameter is however unavailable if no device is configured. Expose the UID Checking state as: - A platform-level parameter - Available regardless of device presence or state Signed-off-by: Ramesh Errabolu Reviewed-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 1884f54e48da54a16b6f03b6b1ea6b88f096c28e Merge: cbf33b8e0b360f 1e33137d47105a Author: Wolfram Sang Date: Sat Oct 4 18:29:16 2025 +0200 Merge tag 'i2c-host-6.18-pt2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.18, part 2 rtl9300 updates: - general cleanups - implemented block read/write support - added RTL9310 support commit de7342228b7343774d6a9981c2ddbfb5e201044b Author: Rong Tao Date: Sat Oct 4 22:23:29 2025 +0800 bpf: Finish constification of 1st parameter of bpf_d_path() The commit 1b8abbb12128 ("bpf...d_path(): constify path argument") constified the first parameter of the bpf_d_path(), but failed to update it in all places. Finish constification. Otherwise the selftest fail to build: .../selftests/bpf/bpf_experimental.h:222:12: error: conflicting types for 'bpf_path_d_path' 222 | extern int bpf_path_d_path(const struct path *path, char *buf, size_t buf__sz) __ksym; | ^ .../selftests/bpf/tools/include/vmlinux.h:153922:12: note: previous declaration is here 153922 | extern int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz) __weak __ksym; Fixes: 1b8abbb12128 ("bpf...d_path(): constify path argument") Signed-off-by: Rong Tao Signed-off-by: Alexei Starovoitov commit f3826aa9962b4572d01083c84ac0f8345f121168 Merge: bf897d2626abe4 99cab80208809c Author: Linus Torvalds Date: Sat Oct 4 08:52:16 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "This excludes the bulk of the x86 changes, which I will send separately. They have two not complex but relatively unusual conflicts so I will wait for other dust to settle. guest_memfd: - Add support for host userspace mapping of guest_memfd-backed memory for VM types that do NOT use support KVM_MEMORY_ATTRIBUTE_PRIVATE (which isn't precisely the same thing as CoCo VMs, since x86's SEV-MEM and SEV-ES have no way to detect private vs. shared). This lays the groundwork for removal of guest memory from the kernel direct map, as well as for limited mmap() for guest_memfd-backed memory. For more information see: - commit a6ad54137af9 ("Merge branch 'guest-memfd-mmap' into HEAD") - guest_memfd in Firecracker: https://github.com/firecracker-microvm/firecracker/tree/feature/secret-hiding - direct map removal: https://lore.kernel.org/all/20250221160728.1584559-1-roypat@amazon.co.uk/ - mmap support: https://lore.kernel.org/all/20250328153133.3504118-1-tabba@google.com/ ARM: - Add support for FF-A 1.2 as the secure memory conduit for pKVM, allowing more registers to be used as part of the message payload. - Change the way pKVM allocates its VM handles, making sure that the privileged hypervisor is never tricked into using uninitialised data. - Speed up MMIO range registration by avoiding unnecessary RCU synchronisation, which results in VMs starting much quicker. - Add the dump of the instruction stream when panic-ing in the EL2 payload, just like the rest of the kernel has always done. This will hopefully help debugging non-VHE setups. - Add 52bit PA support to the stage-1 page-table walker, and make use of it to populate the fault level reported to the guest on failing to translate a stage-1 walk. - Add NV support to the GICv3-on-GICv5 emulation code, ensuring feature parity for guests, irrespective of the host platform. - Fix some really ugly architecture problems when dealing with debug in a nested VM. This has some bad performance impacts, but is at least correct. - Add enough infrastructure to be able to disable EL2 features and give effective values to the EL2 control registers. This then allows a bunch of features to be turned off, which helps cross-host migration. - Large rework of the selftest infrastructure to allow most tests to transparently run at EL2. This is the first step towards enabling NV testing. - Various fixes and improvements all over the map, including one BE fix, just in time for the removal of the feature. LoongArch: - Detect page table walk feature on new hardware - Add sign extension with kernel MMIO/IOCSR emulation - Improve in-kernel IPI emulation - Improve in-kernel PCH-PIC emulation - Move kvm_iocsr tracepoint out of generic code RISC-V: - Added SBI FWFT extension for Guest/VM with misaligned delegation and pointer masking PMLEN features - Added ONE_REG interface for SBI FWFT extension - Added Zicbop and bfloat16 extensions for Guest/VM - Enabled more common KVM selftests for RISC-V - Added SBI v3.0 PMU enhancements in KVM and perf driver s390: - Improve interrupt cpu for wakeup, in particular the heuristic to decide which vCPU to deliver a floating interrupt to. - Clear the PTE when discarding a swapped page because of CMMA; this bug was introduced in 6.16 when refactoring gmap code. x86 selftests: - Add #DE coverage in the fastops test (the only exception that's guest- triggerable in fastop-emulated instructions). - Fix PMU selftests errors encountered on Granite Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF). - Minor cleanups and improvements x86 (guest side): - For the legacy PCI hole (memory between TOLUD and 4GiB) to UC when overriding guest MTRR for TDX/SNP to fix an issue where ACPI auto-mapping could map devices as WB and prevent the device drivers from mapping their devices with UC/UC-. - Make kvm_async_pf_task_wake() a local static helper and remove its export. - Use native qspinlocks when running in a VM with dedicated vCPU=>pCPU bindings even when PV_UNHALT is unsupported. Generic: - Remove a redundant __GFP_NOWARN from kvm_setup_async_pf() as __GFP_NOWARN is now included in GFP_NOWAIT. * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (178 commits) KVM: s390: Fix to clear PTE when discarding a swapped page KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs KVM: arm64: selftests: Cope with arch silliness in EL2 selftest KVM: arm64: selftests: Add basic test for running in VHE EL2 KVM: arm64: selftests: Enable EL2 by default KVM: arm64: selftests: Initialize HCR_EL2 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 KVM: arm64: selftests: Select SMCCC conduit based on current EL KVM: arm64: selftests: Provide helper for getting default vCPU target KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts KVM: arm64: selftests: Create a VGICv3 for 'default' VMs KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation KVM: arm64: selftests: Add helper to check for VGICv3 support KVM: arm64: selftests: Initialize VGICv3 only once KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code KVM: selftests: Add ex_str() to print human friendly name of exception vectors selftests/kvm: remove stale TODO in xapic_state_test KVM: selftests: Handle Intel Atom errata that leads to PMU event overcount ... commit bf897d2626abe4559953342e2f7dda05d034c8c7 Merge: 55a42f78ffd386 ed9f3ab9f3d365 Author: Linus Torvalds Date: Sat Oct 4 08:48:16 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Just fixes and cleanups this time around. The mapping cleanups are preparing the ground for new features, though" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio-vdpa: Drop redundant conversion to bool vduse: Use fixed 4KB bounce pages for non-4KB page size vduse: switch to use virtio map API instead of DMA API vdpa: introduce map ops vdpa: support virtio_map virtio: introduce map ops in virtio core virtio_ring: rename dma_handle to map_handle virtio: introduce virtio_map container union virtio: rename dma helpers virtio_ring: switch to use dma_{map|unmap}_page() virtio_ring: constify virtqueue pointer for DMA helpers virtio_balloon: Remove redundant __GFP_NOWARN vhost: vringh: Fix copy_to_iter return value check vhost: vringh: Modify the return value check commit 55a42f78ffd386e01a5404419f8c5ded7db70a21 Merge: cbf33b8e0b360f 407aa63018d15c Author: Linus Torvalds Date: Sat Oct 4 08:24:54 2025 -0700 Merge tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Use fdinfo to expose the sysfs path of a device represented by a vfio device file (Alex Mastro) - Mark vfio-fsl-mc, vfio-amba, and the reset functions for vfio-platform for removal as these are either orphaned or believed to be unused (Alex Williamson) - Add reviewers for vfio-platform to save it from also being marked for removal (Mostafa Saleh, Pranjal Shrivastava) - VFIO selftests, including basic sanity testing and minimal userspace drivers for testing against real hardware. This is also expected to provide integration with KVM selftests for KVM-VFIO interfaces (David Matlack, Josh Hilke) - Fix drivers/cdx and vfio/cdx to build without CONFIG_GENERIC_MSI_IRQ (Nipun Gupta) - Fix reference leak in hisi_acc (Miaoqian Lin) - Use consistent return for unsupported device feature (Alex Mastro) - Unwind using the correct memory free callback in vfio/pds (Zilin Guan) - Use IRQ_DISABLE_LAZY flag to improve handling of pre-PCI2.3 INTx and resolve stalled interrupt on ppc64 (Timothy Pearson) - Enable GB300 in nvgrace-gpu vfio-pci variant driver (Tushar Dave) - Misc: - Drop unnecessary ternary conversion in vfio/pci (Xichao Zhao) - Grammatical fix in nvgrace-gpu (Morduan Zang) - Update Shameer's email address (Shameer Kolothum) - Fix document build warning (Alex Williamson) * tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio: (48 commits) vfio/nvgrace-gpu: Add GB300 SKU to the devid table vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices vfio/pds: replace bitmap_free with vfree vfio: return -ENOTTY for unsupported device feature hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init vfio/platform: Mark reset drivers for removal vfio/amba: Mark for removal MAINTAINERS: Add myself as VFIO-platform reviewer MAINTAINERS: Add myself as VFIO-platform reviewer docs: proc.rst: Fix VFIO Device title formatting vfio: selftests: Fix .gitignore for already tracked files vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ cdx: don't select CONFIG_GENERIC_MSI_IRQ MAINTAINERS: Update Shameer Kolothum's email address vfio: selftests: Add a script to help with running VFIO selftests vfio: selftests: Make iommufd the default iommu_mode vfio: selftests: Add iommufd mode vfio: selftests: Add iommufd_compat_type1{,v2} modes vfio: selftests: Add vfio_type1v2_mode vfio: selftests: Replicate tests across all iommu_modes ... commit 8be70a8fc667c33e69257a72e8092f07c828241e Author: Randy Dunlap Date: Sat Sep 27 21:14:20 2025 +0300 security: keys: use menuconfig for KEYS symbol Give the KEYS kconfig symbol and its associated symbols a separate menu space under Security options by using "menuconfig" instead of "config". This also makes it easier to find the security and LSM options. Signed-off-by: Randy Dunlap Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 9b8d24a49fe83787208479d51f320cead25e856c Author: Eric Biggers Date: Mon Sep 15 21:14:43 2025 +0300 KEYS: encrypted: Use SHA-256 library instead of crypto_shash Instead of the "sha256" crypto_shash, just use sha256(). Similarly, instead of the "hmac(sha256)" crypto_shash, just use hmac_sha256_usingrawkey(). This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Reviewed-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 7a6399e327f4d5607d984c336c9c6e1cfcd9194a Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 14:37:57 2025 +0530 ALSA: emu10k1: Fix typo in docs interally => internally Signed-off-by: Bhanu Seshu Kumar Valluri Signed-off-by: Takashi Iwai commit 328b80b29a6a165c47fcc04d2bef3e09ed1d28f9 Author: Adam Holliday Date: Tue Sep 30 11:09:14 2025 -0400 ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo The ASUS ROG Zephyrus Duo 15 SE (GX551QS) with ALC 289 codec requires specific pin configuration for proper volume control. Without this quirk, volume adjustments produce a muffled sound effect as only certain channels attenuate, leaving bass frequency at full volume. Testing with hdajackretask confirms these pin tweaks fix the issue: - Pin 0x17: Internal Speaker (LFE) - Pin 0x1e: Internal Speaker Signed-off-by: Adam Holliday Signed-off-by: Takashi Iwai commit 1e33137d47105a807262aa17e028374463876f85 Author: Jonas Jelonek Date: Sat Sep 27 10:19:31 2025 +0000 i2c: rtl9300: add support for RTL9310 I2C controller Add support for the internal I2C controllers of RTL9310 series based SoCs to the driver for RTL9300. Add register definitions, chip-specific functions and compatible strings for known RTL9310-based SoCs RTL9311, RTL9312 and RTL9313. Make use of a new device tree property 'realtek,scl' which needs to be specified in case both or only the second master is used. This is required due how the register layout changed in contrast to RTL9300, which has SCL selection in a global register instead of a master-specific one. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-10-jelonek.jonas@gmail.com commit 99fd09e01db2c6fc4c6ffe851b337f64ff93e1b5 Author: Jonas Jelonek Date: Sat Sep 27 10:19:30 2025 +0000 dt-bindings: i2c: realtek,rtl9301-i2c: extend for RTL9310 support Adjust the regex for child-node address to account for the fact that RTL9310 supports 12 instead of only 8 SDA lines. Also, narrow this per variant. Add a vendor-specific property to explicitly specify the SCL line number of the defined I2C controller/master. This is required, in particular for RTL9310, to operate on the correct SCL for each controller. Require this property to be specified for RTL9310. Add compatibles for known SoC variants RTL9311, RTL9312 and RTL9313. Signed-off-by: Jonas Jelonek Reviewed-by: Rob Herring (Arm) Reviewed-by: Chris Packham Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-9-jelonek.jonas@gmail.com commit 46fe8265685cb6003a0989b53e11e8afa4826572 Author: Jonas Jelonek Date: Sat Sep 27 10:19:29 2025 +0000 i2c: rtl9300: use scoped guard instead of explicit lock/unlock Use the scoped guard infrastructure which unlocks a mutex automatically when the guard goes out of scope, instead of explicit lock and unlock. This simplifies the code and control flow in rtl9300_i2c_smbus_xfer and removes the need of using goto in error cases to unlock before returning. Signed-off-by: Jonas Jelonek Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-8-jelonek.jonas@gmail.com commit 059374aa0ab11a758a9e2219e90361911397b03d Author: Jonas Jelonek Date: Sat Sep 27 10:19:28 2025 +0000 i2c: rtl9300: separate xfer configuration and execution So far, the rtl9300_i2c_smbus_xfer code is quite a mess with function calls distributed over the whole function setting different values in different cases. Calls to rtl9300_i2c_config_xfer and rtl9300_i2c_reg_addr_set are used in every case-block with varying values whose meaning is not instantly obvious. In some cases, there are additional calls within these case-blocks doing more things. This is in general a bad design and especially really bad for readability and maintainability because it distributes changes or issues to multiple locations due to the same function being called with different hardcoded values in different places. To have a good structure, setting different parameters based on the desired operation should not be interleaved with applying these parameters to the hardware registers. Or in different words, the parameter site should be mixed with the call site. Thus, separate configuration and execution of an SMBus xfer within rtl9300_i2c_smbus_xfer to improve readability and maintainability. Add a new 'struct rtl9300_i2c_xfer' to carry the required parameters for an xfer which are configured based on the input parameters within a single switch-case block, without having any function calls within this block. The function calls to actually apply these values to the hardware registers then appear below in a single place and just operate on the passed instance of 'struct rtl9300_i2c_xfer'. These are 'rtl9300_i2c_prepare_xfer' which combines applying all parameters of the xfer to the corresponding register, and 'rtl9300_i2c_do_xfer' which actually executes the xfer and does post-processing if needed. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-7-jelonek.jonas@gmail.com commit d5b4fd6ed8ea3eb5dc072285a5e4c0ee32e829b2 Author: Jonas Jelonek Date: Sat Sep 27 10:19:27 2025 +0000 i2c: rtl9300: do not set read mode on every transfer Move the operation to set the read mode from config_xfer to probe. The I2C controller of RTL9300 and RTL9310 support a legacy message mode for READs with 'Read Address Data' instead of the standard format 'Write Address ; Read Data'. There is no way to pass that via smbus_xfer, thus there is no point in supported this in the driver and moreover no point in setting this on every transaction. Setting this once in the probe call is sufficient. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-6-jelonek.jonas@gmail.com commit d1cef7afc3c79260d4d1a86f7a814de2a1bf3fe4 Author: Jonas Jelonek Date: Sat Sep 27 10:19:26 2025 +0000 i2c: rtl9300: move setting SCL frequency to config_io Move the register operation to set the SCL frequency to the rtl9300_i2c_config_io function instead of the rtl9300_i2c_config_xfer function. This rather belongs there next to selecting the current SDA output line. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-5-jelonek.jonas@gmail.com commit c840492ad7487dcb58b0f5f249793e7350114076 Author: Jonas Jelonek Date: Sat Sep 27 10:19:25 2025 +0000 i2c: rtl9300: rename internal sda_pin to sda_num Rename the internally used 'sda_pin' to 'sda_num' to make it clear that this is NOT the actual pin number of the GPIO pin but rather the logical SDA channel number. Although the alternate function SDA_Y is sometimes given with the GPIO number, this is not always the case. Thus, avoid any confusion or misconfiguration by giving the variable the correct name. This follows the description change in the devicetree bindings. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-4-jelonek.jonas@gmail.com commit 0395a5e8fd07645df6743fd2a6883708196d9d75 Author: Jonas Jelonek Date: Sat Sep 27 10:19:24 2025 +0000 dt-bindings: i2c: realtek,rtl9301-i2c: fix wording and typos Fix wording of binding description to use plural because there is not only a single RTL9300 SoC. RTL9300 describes a whole family of Realtek SoCs. Add missing word 'of' in description of reg property. Change 'SDA pin' to 'SDA line number' because the property must contain the SDA (channel) number ranging from 0-7 instead of a real pin number. Signed-off-by: Jonas Jelonek Reviewed-by: Rob Herring (Arm) Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-3-jelonek.jonas@gmail.com commit 85f1c01ce2f98a4925d2610d9d3f4c2749eb9331 Author: Jonas Jelonek Date: Sat Sep 27 10:19:23 2025 +0000 i2c: rtl9300: use regmap fields and API for registers Adapt the RTL9300 I2C controller driver to use more of the regmap API, especially make use of reg_field and regmap_field instead of macros to represent registers. Most register operations are performed through regmap_field_* API then. Handle SCL selection using separate chip-specific functions since this is already known to differ between the Realtek SoC families in such a way that this cannot be properly handled using just a different reg_field. This makes it easier to add support for newer generations or to handle differences between specific revisions within a series. Just by defining a separate driver data structure with the corresponding register field definitions and linking it to a new compatible. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-2-jelonek.jonas@gmail.com commit d3c2191d493a9a017ea816f3b38dfbcadb6cccb5 Author: Harshal Gohel Date: Sat Sep 27 11:52:17 2025 +0200 i2c: rtl9300: Implement I2C block read and write It was noticed that the original implementation of SMBus Block Write in the driver was actually an I2C Block Write. Both differ only in the Count byte before the actual data: S Addr Wr [A] Comm [A] Count [A] Data [A] Data [A] ... [A] Data [A] P The I2C Block Write is just skipping this Count byte and starts directly with the data: S Addr Wr [A] Comm [A] Data [A] Data [A] ... [A] Data [A] P The I2C controller of RTL93xx doesn't handle this Count byte special and it is simply another one of (16 possible) data bytes. Adding support for the I2C Block Write therefore only requires skipping the count byte (0) in data->block. It is similar for reads. The SMBUS Block read is having a Count byte before the data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Count] A [Data] A [Data] A ... A [Data] NA P And the I2C Block Read is directly starting with the actual data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Data] A [Data] A ... A [Data] NA P The I2C controller is also not handling this byte in a special way. It simply provides every byte after the Rd marker + Ack as part of the 16 byte receive buffer (registers). The content of this buffer just has to be copied to the right position in the receive data->block. Signed-off-by: Harshal Gohel Co-developed-by: Sven Eckelmann Signed-off-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham Reviewed-by: Jonas Jelonek Tested-by: Jonas Jelonek Signed-off-by: Andi Shyti Link: https://lore.kernel.org/all/20250927-i2c-rtl9300-multi-byte-v7-2-c0fd0e78b818@narfation.org commit cbf33b8e0b360f667b17106c15d9e2aac77a76a1 Merge: d955299b5c468f 63d2247e2e37d9 Author: Linus Torvalds Date: Fri Oct 3 19:38:19 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix selftests/bpf (typo, conflicts) and unbreak BPF CI (Jiri Olsa) - Remove linux/unaligned.h dependency for libbpf_sha256 (Andrii Nakryiko) and add a test (Eric Biggers) - Reject negative offsets for ALU operations in the verifier (Yazhou Tang) and add a test (Eduard Zingerman) - Skip scalar adjustment for BPF_NEG operation if destination register is a pointer (Brahmajit Das) and add a test (KaFai Wan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: libbpf: Fix missing #pragma in libbpf_utils.c selftests/bpf: Add tests for rejection of ALU ops with negative offsets selftests/bpf: Add test for libbpf_sha256() bpf: Reject negative offsets for ALU ops libbpf: remove linux/unaligned.h dependency for libbpf_sha256() libbpf: move libbpf_sha256() implementation into libbpf_utils.c libbpf: move libbpf_errstr() into libbpf_utils.c libbpf: remove unused libbpf_strerror_r and STRERR_BUFSIZE libbpf: make libbpf_errno.c into more generic libbpf_utils.c selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer selftests/bpf: Fix realloc size in bpf_get_addrs selftests/bpf: Fix typo in subtest_basic_usdt after merge conflict selftests/bpf: Fix open-coded gettid syscall in uprobe syscall tests commit d955299b5c468f805d75e0b92e7c1d2392bae921 Merge: 674b0ddb7586a1 91f98de42310c7 Author: Linus Torvalds Date: Fri Oct 3 19:36:39 2025 -0700 Merge tag 'soc-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC build fix from Arnd Bergmann: "One commit for the dt bindings was missing from the dt branch, this one is already pending in the clk tree that contains the corresponding device driver" * tag 'soc-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: dt-bindings: clock: Add ARTPEC-8 clock controller commit 674b0ddb7586a192612442c3aed9cf523faeed7a Merge: 7dbec0bbc3b468 fb641516a66878 Author: Linus Torvalds Date: Fri Oct 3 19:17:48 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Usual driver updates (ufs, mpi3mr, lpfc, pm80xx, mpt3sas) plus assorted cleanups and fixes. The only core update is to sd.c and is mostly cosmetic" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (105 commits) scsi: MAINTAINERS: Update FC element owners scsi: mpt3sas: Update driver version to 54.100.00.00 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGE scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() scsi: ufs: ufs-qcom: Add support for limiting HS gear and rate scsi: ufs: pltfrm: Add DT support to limit HS gear and gear rate scsi: ufs: ufs-qcom: Remove redundant re-assignment to hs_rate scsi: ufs: dt-bindings: Document gear and rate limit properties scsi: ufs: core: Fix data race in CPU latency PM QoS request handling scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() scsi: storvsc: Remove redundant ternary operators scsi: ufs: core: Change MCQ interrupt enable flow scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() scsi: lpfc: Copyright updates for 14.4.0.11 patches scsi: lpfc: Update lpfc version to 14.4.0.11 scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int scsi: lpfc: Clean up extraneous phba dentries ... commit 7dbec0bbc3b468310be172f1ce6ddc9411c84952 Merge: 2ccb4d203fe4be 55dcfdf8af9c38 Author: Linus Torvalds Date: Fri Oct 3 18:48:02 2025 -0700 Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - a new dm-pcache target for read/write caching on persistent memory - fix typos in docs - misc small refactoring - mark dm-error with DM_TARGET_PASSES_INTEGRITY - dm-request-based: fix NULL pointer dereference and quiesce_depth out of sync - dm-linear: optimize REQ_PREFLUSH - dm-vdo: return error on corrupted metadata - dm-integrity: support asynchronous hash interface * tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (27 commits) dm raid: use proper md_ro_state enumerators dm-integrity: prefer synchronous hash interface dm-integrity: enable asynchronous hash interface dm-integrity: rename internal_hash dm-integrity: add the "offset" argument dm-integrity: allocate the recalculate buffer with kmalloc dm-integrity: introduce integrity_kmap and integrity_kunmap dm-integrity: replace bvec_kmap_local with kmap_local_page dm-integrity: use internal variable for digestsize dm vdo: return error on corrupted metadata in start_restoring_volume functions dm vdo: Update code to use mem_is_zero dm: optimize REQ_PREFLUSH with data when using the linear target dm-pcache: use int type to store negative error codes dm: fix "writen"->"written" dm-pcache: cleanup: fix coding style report by checkpatch.pl dm-pcache: remove ctrl_lock for pcache_cache_segment dm: fix NULL pointer dereference in __dm_suspend() dm: fix queue start/stop imbalance under suspend/load/resume races dm-pcache: add persistent cache target in device-mapper dm error: mark as DM_TARGET_PASSES_INTEGRITY ... commit 2ccb4d203fe4bec72fb333ccc2feb71a462c188d Merge: e56ebe27a00dee e6d736bd08902b Author: Linus Torvalds Date: Fri Oct 3 18:35:22 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "A new Pensando ionic driver, a new Gen 3 HW support for Intel irdma, and lots of small bnxt_re improvements. - Small bug fixes and improves to hfi1, efa, mlx5, erdma, rdmarvt, siw - Allow userspace access to IB service records through the rdmacm - Optimize dma mapping for erdma - Fix shutdown of the GSI QP in mana - Support relaxed ordering MR and fix a corruption bug with mlx5 DMA Data Direct - Many improvement to bnxt_re: - Debugging features and counters - Improve performance of some commands - Change flow_label reporting in completions - Mirror vnic - RDMA flow support - New RDMA driver for Pensando Ethernet devices: ionic - Gen 3 hardware support for the Intel irdma driver - Fix rdma routing resolution with VRFs" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (85 commits) RDMA/ionic: Fix memory leak of admin q_wr RDMA/siw: Always report immediate post SQ errors RDMA/bnxt_re: improve clarity in ALLOC_PAGE handler RDMA/irdma: Remove unused struct irdma_cq fields RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() RDMA/bnxt_re: Remove non-statistics counters from hw_counters RDMA/bnxt_re: Add debugfs info entry for device and resource information RDMA/bnxt_re: Fix incorrect errno used in function comments RDMA: Use %pe format specifier for error pointers RDMA/ionic: Use ether_addr_copy instead of memcpy RDMA/ionic: Fix build failure on SPARC due to xchg() operand size RDMA/rxe: Fix race in do_task() when draining IB/sa: Fix sa_local_svc_timeout_ms read race IB/ipoib: Ignore L3 master device RDMA/core: Use route entry flag to decide on loopback traffic RDMA/core: Resolve MAC of next-hop device without ARP support RDMA/core: Squash a single user static function RDMA/irdma: Update Kconfig RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices RDMA/irdma: Add Atomic Operations support ... commit e56ebe27a00dee1e083621b67ec23310d8e0319a Merge: 8a44189f204695 2a918911ed3d08 Author: Linus Torvalds Date: Fri Oct 3 18:18:48 2025 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Two minor fixes: - Make the selftest work again on x86 platforms with iommus enabled - Fix a compiler warning in the userspace kselftest" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Register iommufd mock devices with fwspec iommu/selftest: prevent use of uninitialized variable commit 8a44189f204695637be0373c8ea8e3ea4c1a1926 Merge: bed0653fe2aacb 479bec4cb39a1b Author: Linus Torvalds Date: Fri Oct 3 18:15:39 2025 -0700 Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl Pull fwctl updates from Jason Gunthorpe: - Fix mismatched kvalloc() kfree() on error paths - Remove NOP dev_err_probe(), shouldn't print on error paths anyhow - For mlx5 permit: MLX5_CMD_OP_MODIFY_CONG_STATUS MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT MLX5_CMD_OP_QUERY_DELEGATED_VHCA - Use memdup_user in pds * tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl: pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc fwctl/mlx5: Add Adjacent function query commands and their scope fwctl/mlx5: Allow MODIFY_CONG_STATUS command pds_fwctl: Remove the use of dev_err_probe() fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() commit bed0653fe2aacb0ca8196075cffc9e7062e74927 Merge: a498d59c469bf1 5f4b8c03f41782 Author: Linus Torvalds Date: Fri Oct 3 18:00:11 2025 -0700 Merge tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: - Inte VT-d: - IOMMU driver updated to the latest VT-d specification - Don't enable PRS if PDS isn't supported - Replace snprintf with scnprintf - Fix legacy mode page table dump through debugfs - Miscellaneous cleanups - AMD-Vi: - Support kdump boot when SNP is enabled - Apple-DART: - 4-level page-table support - RISC-V IOMMU: - ACPI support - Small number of miscellaneous cleanups and fixes * tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (22 commits) iommu/vt-d: Disallow dirty tracking if incoherent page walk iommu/vt-d: debugfs: Avoid dumping context command register iommu/vt-d: Removal of Advanced Fault Logging iommu/vt-d: PRS isn't usable if PDS isn't supported iommu/vt-d: Remove LPIG from page group response descriptor iommu/vt-d: Drop unused cap_super_offset() iommu/vt-d: debugfs: Fix legacy mode page table dump logic iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() iommu/io-pgtable-dart: Fix off by one error in table index check iommu/riscv: Add ACPI support ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id() ACPI: RISC-V: Add support for RIMT iommu/omap: Use int type to store negative error codes iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs iommu/amd: Skip enabling command/event buffers for kdump crypto: ccp: Skip SEV and SNP INIT for kdump boot iommu/amd: Reuse device table for kdump iommu/amd: Add support to remap/unmap IOMMU buffers for kdump iommu/apple-dart: Add 4-level page table support iommu/io-pgtable-dart: Add 4-level page table support ... commit 3637d34b35b287ab830e66048841ace404382b67 Author: Albin Babu Varghese Date: Fri Oct 3 03:32:09 2025 -0400 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese Signed-off-by: Helge Deller commit a498d59c469bf1cab2710ffeb34050f475de28ce Merge: ee2fe81cdcd17f ef3d979b3e270b Author: Linus Torvalds Date: Fri Oct 3 17:41:12 2025 -0700 Merge tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - Refactoring of DMA mapping API to physical addresses as the primary interface instead of page+offset parameters This gets much closer to Matthew Wilcox's long term wish for struct-pageless IO to cacheable DRAM and is supporting memdesc project which seeks to substantially transform how struct page works. An advantage of this approach is the possibility of introducing DMA_ATTR_MMIO, which covers existing 'dma_map_resource' flow in the common paths, what in turn lets to use recently introduced dma_iova_link() API to map PCI P2P MMIO without creating struct page Developped by Leon Romanovsky and Jason Gunthorpe - Minor clean-up by Petr Tesarik and Qianfeng Rong * tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: kmsan: fix missed kmsan_handle_dma() signature conversion mm/hmm: properly take MMIO path mm/hmm: migrate to physical address-based DMA mapping API dma-mapping: export new dma_*map_phys() interface xen: swiotlb: Open code map_resource callback dma-mapping: implement DMA_ATTR_MMIO for dma_(un)map_page_attrs() kmsan: convert kmsan_handle_dma to use physical addresses dma-mapping: convert dma_direct_*map_page to be phys_addr_t based iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys() iommu/dma: rename iommu_dma_*map_page to iommu_dma_*map_phys dma-mapping: rename trace_dma_*map_page to trace_dma_*map_phys dma-debug: refactor to use physical addresses for page mapping iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link(). dma-mapping: introduce new DMA attribute to indicate MMIO memory swiotlb: Remove redundant __GFP_NOWARN dma-direct: clean up the logic in __dma_direct_alloc_pages() commit ee2fe81cdcd17f875aeca074afe64d7e8f57750f Merge: 50647a1176b7ab 99510c324e531a Author: Linus Torvalds Date: Fri Oct 3 17:16:13 2025 -0700 Merge tag 'docs-6.18' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It has been a relatively busy cycle in docsland, with changes all over: - Bring the kernel memory-model docs into the Sphinx build in the "literal include" mode. - Lots of build-infrastructure work, further cleaning up long-term kernel-doc technical debt. The sphinx-pre-install tool has been converted to Python and updated for current systems. - A new tool to detect when documents have been moved and generate HTML redirects; this can be used on kernel.org (or any other site hosting the rendered docs) to avoid breaking links. - Automated processing of the YAML files describing the netlink protocol. - A significant update of the maintainer's PGP guide. ... and a seemingly endless series of typo fixes, build-problem fixes, etc" * tag 'docs-6.18' of git://git.lwn.net/linux: (193 commits) Documentation/features: Update feature lists for 6.17-rc7 docs: remove cdomain.py Documentation/process: submitting-patches: fix typo in "were do" docs: dev-tools/lkmm: Fix typo of missing file extension Documentation: trace: histogram: Convert ftrace docs cross-reference Documentation: trace: histogram-design: Wrap introductory note in note:: directive Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram Documentation: trace: histogram-design: Trim trailing vertices in diagram explanation text Documentation: trace: histogram: Fix histogram trigger subsection number order docs: driver-api: fix spelling of "buses". Documentation: fbcon: Use admonition directives Documentation: fbcon: Reindent 8th step of attach/detach/unload Documentation: fbcon: Add boot options and attach/detach/unload section headings docs: filesystems: sysfs: add remaining top level sysfs directory descriptions docs: filesystems: sysfs: clarify symlink destinations in dev and bus/devices descriptions docs: filesystems: sysfs: remove top level sysfs net directory docs: maintainer: Fix ambiguous subheading formatting docs: kdoc: a few more dump_typedef() tweaks docs: kdoc: remove redundant comment stripping in dump_typedef() docs: kdoc: remove some dead code in dump_typedef() ... commit c14bdcc9f274620492aba7d920cc2641440cf1ba Author: Wei Yang Date: Wed Oct 1 09:19:00 2025 +0000 mm/khugepaged: use KMEM_CACHE() We got some late review commits during review of commit b4c9ffb54b32 ("mm/khugepaged: remove definition of struct khugepaged_mm_slot"). No need to keep the old cache name "khugepaged_mm_slot", let's simply use KMEM_CACHE(). Link: https://lkml.kernel.org/r/20251001091900.20041-3-richard.weiyang@gmail.com Fixes: b4c9ffb54b32 ("mm/khugepaged: remove definition of struct khugepaged_mm_slot") Signed-off-by: Wei Yang Acked-by: Lance Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Raghavendra K T Cc: Kiryl Shutsemau Cc: xu xin Cc: SeongJae Park Cc: Nico Pache Cc: Baolin Wang Cc: Barry Song Cc: Chengming Zhou Cc: Dan Carpenter Cc: Kiryl Shutsemau Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Signed-off-by: Andrew Morton commit df6879a7483e2372fcd70762660c546446f99006 Author: Wei Yang Date: Wed Oct 1 09:18:59 2025 +0000 mm/ksm: cleanup mm_slot_entry() invocation Patch series "mm_slot: following fixup for usage of mm_slot_entry()", v2. We got some late review commits during review of "mm_slot: fix the usage of mm_slot_entry()" in [1]. This patch (of 2): We got some late review commits during review of commit 08498be43ee6 ("mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL"). Let's reduce the indentation level and make the code easier to follow by using gotos to a new label. Link: https://lkml.kernel.org/r/20251001091900.20041-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251001091900.20041-2-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250927004539.19308-1-richard.weiyang@gmail.com [1] Fixes: 08498be43ee6 ("mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL") Signed-off-by: Wei Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Kiryl Shutsemau Acked-by: Zi Yan Cc: Lance Yang Cc: xu xin Cc: Dan Carpenter Cc: Chengming Zhou Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Raghavendra K T Cc: Ryan Roberts Cc: Kiryl Shutsemau Cc: SeongJae Park Signed-off-by: Andrew Morton commit a089461a5994204558096eff4e4e518614755463 Author: Anshuman Khandual Date: Mon Sep 29 13:00:45 2025 +0100 Documentation/mm: drop pxx_mkdevmap() descriptions from page table helpers Remove pxx_mkdevmap() descriptions, as these helper functions have already been dropped (including DEBUG_VM_PGTABLE test) via the commit d438d2734170 ("mm: remove devmap related functions and page table bits"). Link: https://lkml.kernel.org/r/20250929120045.1109707-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Dev Jain Cc: Lorenzo Stoakes Cc: Alistair Popple Signed-off-by: Andrew Morton commit 89be2815f465a8b167fbef09a8b664bad28713bb Author: Lance Yang Date: Wed Sep 24 12:58:30 2025 +0800 mm: clean up is_guard_pte_marker() Let's simplify the implementation. The current code is redundant as it effectively expands to: is_swap_pte(pte) && is_pte_marker_entry(...) && // from is_pte_marker() is_pte_marker_entry(...) // from is_guard_swp_entry() While a modern compiler could likely optimize this away, let's have clean code and not rely on it. Link: https://lkml.kernel.org/r/20250924045830.3817-1-lance.yang@linux.dev Signed-off-by: Lance Yang Reviewed-by: Wei Yang Reviewed-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Hugh Dickins Cc: Kairui Song Cc: "Kirill A. Shutemov" Cc: Liam Howlett Cc: Mariano Pache Cc: Mika Penttilä Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 0a947c14e48cbf9de222836170282e0167a9e096 Author: Hannes Reinecke Date: Tue Jul 29 08:46:36 2025 +0200 drivers/base: move memory_block_add_nid() into the caller Now the node id only needs to be set for early memory, so move memory_block_add_nid() into the caller and rename it into memory_block_add_nid_early(). This allows us to further simplify the code by dropping the 'context' argument to do_register_memory_block_under_node(). Link: https://lkml.kernel.org/r/20250729064637.51662-4-hare@kernel.org Suggested-by: David Hildenbrand Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit b8179af120943e2fc099ea87caa234039a709a66 Author: Hannes Reinecke Date: Tue Jul 29 08:46:35 2025 +0200 mm/memory_hotplug: activate node before adding new memory blocks The sysfs attributes for memory blocks require the node ID to be set and initialized, so move the node activation before adding new memory blocks. This also has the nice side effect that the BUG_ON() can be converted into a WARN_ON() as we now can handle registration errors. Link: https://lkml.kernel.org/r/20250729064637.51662-3-hare@kernel.org Fixes: b9ff036082cd ("mm/memory_hotplug.c: make add_memory_resource use __try_online_node") Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit c6a809363a66b8ff0f6a000b5f09408a1b33eeb5 Author: Hannes Reinecke Date: Tue Jul 29 08:46:34 2025 +0200 drivers/base/memory: add node id parameter to add_memory_block() Patch series "mm/memory_hotplug: fixup crash during uevent handling", v4. we have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): We have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): Add a 'nid' parameter to add_memory_block() to initialize the memory block with the correct node id. Link: https://lkml.kernel.org/r/20250729064637.51662-1-hare@kernel.org Link: https://lkml.kernel.org/r/20250729064637.51662-2-hare@kernel.org Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit 50647a1176b7abd1b4ae55b491eb2fbbeef89db9 Merge: 070a542f08acb7 2f7d98f10b8f64 Author: Linus Torvalds Date: Fri Oct 3 16:32:36 2025 -0700 Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull file->f_path constification from Al Viro: "Only one thing was modifying ->f_path of an opened file - acct(2). Massaging that away and constifying a bunch of struct path * arguments in functions that might be given &file->f_path ends up with the situation where we can turn ->f_path into an anon union of const struct path f_path and struct path __f_path, the latter modified only in a few places in fs/{file_table,open,namei}.c, all for struct file instances that are yet to be opened" * tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (23 commits) Have cc(1) catch attempts to modify ->f_path kernel/acct.c: saner struct file treatment configfs:get_target() - release path as soon as we grab configfs_item reference apparmor/af_unix: constify struct path * arguments ovl_is_real_file: constify realpath argument ovl_sync_file(): constify path argument ovl_lower_dir(): constify path argument ovl_get_verity_digest(): constify path argument ovl_validate_verity(): constify {meta,data}path arguments ovl_ensure_verity_loaded(): constify datapath argument ksmbd_vfs_set_init_posix_acl(): constify path argument ksmbd_vfs_inherit_posix_acl(): constify path argument ksmbd_vfs_kern_path_unlock(): constify path argument ksmbd_vfs_path_lookup_locked(): root_share_path can be const struct path * check_export(): constify path argument export_operations->open(): constify path argument rqst_exp_get_by_name(): constify path argument nfs: constify path argument of __vfs_getattr() bpf...d_path(): constify path argument done_path_create(): constify path argument ... commit a22d167ed82505f770340c3a7c257c04ba24dac9 Author: Ian Rogers Date: Thu Sep 4 21:26:43 2025 -0700 perf parse-events: Fix parsing of >30kb event strings Metrics may generate many particularly uncore event references. The resulting event string may then be >32kb. The parse events lex is using "%option reject" which stores backtracking state in a buffer sized at roughtly 30kb. If the event string is larger than this then a buffer overflow and typically a crash happens. The need for "%option reject" was for BPF events which were removed in commit 3d6dfae88917 ("perf parse-events: Remove BPF event support"). As "%option reject" is both a memory and performance cost let's remove it and fix the parsing case for event strings being over ~30kb. Whilst cleaning up "%option reject" make the header files accurately reflect functions used in the code and tidy up not requiring yywrap. Measuring on the "PMU JSON event tests" a modest reduction of 0.41% user time and 0.27% max resident size was observed. More importantly this change fixes parsing large metrics and event strings. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 7e8f305a081e22ce81aab7f7b9ce01437cbd38b3 Author: Gopi Krishna Menon Date: Fri Oct 3 23:05:59 2025 +0530 docs/zh_CN: Fix malformed table Running "make htmldocs" generates the following build error in zh_CN/cpu-freq/cpu-drivers.rst: Documentation/translations/zh_CN/cpu-freq/cpu-drivers.rst:109: ERROR: Malformed table. Fix the table formatting to resolve the error. Signed-off-by: Gopi Krishna Menon Signed-off-by: Rafael J. Wysocki commit 989ed3cad2fdb7921bf0f9f0f730e1bb065946c2 Author: Gopi Krishna Menon Date: Fri Oct 3 23:06:00 2025 +0530 docs/zh_TW: Fix malformed table Running "make htmldocs" generate the following build error in zh_TW/cpu-freq/cpu-drivers.rst: Documentation/translations/zh_TW/cpu-freq/cpu-drivers.rst:109: ERROR: Malformed table. Fix the table formatting to resolve the error. Signed-off-by: Gopi Krishna Menon Signed-off-by: Rafael J. Wysocki commit 070a542f08acb7e8cf197287f5c44658c715d2d1 Merge: 63e62baaa72e1a 1f0d4ab0f5326a Author: Linus Torvalds Date: Fri Oct 3 14:20:40 2025 -0700 Merge tag 'nfs-for-6.18-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Add a Kconfig option to redirect dfprintk() to the trace buffer - Enable use of the RWF_DONTCACHE flag on the NFS client - Add striped layout handling to pNFS flexfiles - Add proper localio handling for READ and WRITE O_DIRECT Bugfixes: - Handle NFS4ERR_GRACE errors during delegation recall - Fix NFSv4.1 backchannel max_resp_sz verification check - Fix mount hang after CREATE_SESSION failure - Fix d_parent->d_inode locking in nfs4_setup_readdir() Other Cleanups and Improvements: - Improvements to write handling tracepoints - Fix a few trivial spelling mistakes - Cleanups to the rpcbind cleanup call sites - Convert the SUNRPC xdr_buf to use a scratch folio instead of scratch page - Remove unused NFS_WBACK_BUSY() macro - Remove __GFP_NOWARN flags - Unexport rpc_malloc() and rpc_free()" * tag 'nfs-for-6.18-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (46 commits) NFS: add basic STATX_DIOALIGN and STATX_DIO_READ_ALIGN support nfs/localio: add tracepoints for misaligned DIO READ and WRITE support nfs/localio: add proper O_DIRECT support for READ and WRITE nfs/localio: refactor iocb initialization nfs/localio: refactor iocb and iov_iter_bvec initialization nfs/localio: avoid issuing misaligned IO using O_DIRECT nfs/localio: make trace_nfs_local_open_fh more useful NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support sunrpc: unexport rpc_malloc() and rpc_free() NFSv4/flexfiles: Add support for striped layouts NFSv4/flexfiles: Update layout stats & error paths for striped layouts NFSv4/flexfiles: Write path updates for striped layouts NFSv4/flexfiles: Commit path updates for striped layouts NFSv4/flexfiles: Read path updates for striped layouts NFSv4/flexfiles: Update low level helper functions to be DS stripe aware. NFSv4/flexfiles: Add data structure support for striped layouts NFSv4/flexfiles: Use ds_commit_idx when marking a write commit NFSv4/flexfiles: Remove cred local variable dependency nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing NFS: Enable use of the RWF_DONTCACHE flag on the NFS client ... commit 63e62baaa72e1aceb422f64a50408bc9b02a6022 Merge: b3fee71e667339 37e263e68c5e27 Author: Linus Torvalds Date: Fri Oct 3 14:13:23 2025 -0700 Merge tag '6.18-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Fix oops in crypt message - Remove duplicate arc4 code - Fix potential io_uring reconnect - Two important directory leases fixes and three perf improvements - Three minor cleanups - Four debug improvements (e.g. for showing more information on leases, and one for adding more helpful information on reconnect) * tag '6.18-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: client: force multichannel=off when max_channels=1 smb client: fix bug with newly created file in cached dir smb: client: short-circuit negative lookups when parent dir is fully cached smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry smb: client: remove pointless cfid->has_lease check smb: client: transport: minor indentation style fix smb: client: transport: avoid reconnects triggered by pending task work smb: client: remove unused fid_lock smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid smb: client: account smb directory cache usage and per-tcon totals smb: client: add drop_dir_cache module parameter to invalidate cached dirents smb: client: show lease state as R/H/W (or NONE) in open_files smb: client: fix crypto buffers in non-linear memory smb: Use arc4 library instead of duplicate arc4 code smb: client: add tcon information to smb2_reconnect() debug messages commit b3fee71e6673393d04476fbe0f4f03f97765e32d Merge: 86d563ac5fb0c6 e28c5bc45640bc Author: Linus Torvalds Date: Fri Oct 3 14:09:59 2025 -0700 Merge tag 'v6.18rc1-part1-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix potential UAFs and corruptions in rpc open and close - Fix copy_file_range when ranges overlap - Improve session, share, connection lookup performance - Fix potential hash collisions in share and session lists - Debugging improvement - making per-connection threads easier to identify - Improve socket creation - Fix return code mapping for posix query fs info - Add support for limiting the maximum number of connections per IP address, extending the existing connection limiting mechanism to enforce per-IP connection limits alongside the global connection limit * tag 'v6.18rc1-part1-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: increase session and share hash table bits ksmbd: replace connection list with hash table ksmbd: add an error print when maximum IP connections limit is reached ksmbd: add max ip connections parameter ksmbd: fix error code overwriting in smb2_get_info_filesystem() ksmbd: copy overlapped range within the same file ksmbd: use sock_create_kern interface to create kernel socket ksmbd: make ksmbd thread names distinct by client IP ksmbd: Fix race condition in RPC handle list access commit 86d563ac5fb0c6f404e82692581bb67a6f35e5de Merge: f0712c203862b0 4e715744bf7b4e Author: Linus Torvalds Date: Fri Oct 3 14:05:12 2025 -0700 Merge tag 'f2fs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "This focuses on two primary updates for Android devices. First, it sets hash-based file name lookup as the default method to improve performance, while retaining an option to fall back to a linear lookup. Second, it resolves a persistent issue with the 'checkpoint=enable' feature. The update further boosts performance by prefetching node blocks, merging FUA writes more efficiently, and optimizing block allocation policies. The release is rounded out by a comprehensive set of bug fixes that address memory safety, data integrity, and potential system hangs, along with minor documentation and code clean-ups. Enhancements: - add mount option and sysfs entry to tune the lookup mode - dump more information and add a timeout when enabling/disabling checkpoints - readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode - merge FUA command with the existing writes - allocate HOT_DATA for IPU writes - Use allocate_section_policy to control write priority in multi-devices setups - add reserved nodes for privileged users - Add bggc_io_aware to adjust the priority of BG_GC when issuing IO - show the list of donation files Bug fixes: - add missing dput() when printing the donation list - fix UAF issue in f2fs_merge_page_bio() - add sanity check on ei.len in __update_extent_tree_range() - fix infinite loop in __insert_extent_tree() - fix zero-sized extent for precache extents - fix to mitigate overhead of f2fs_zero_post_eof_page() - fix to avoid migrating empty section - fix to truncate first page in error path of f2fs_truncate() - fix to update map->m_next_extent correctly in f2fs_map_blocks() - fix wrong layout information on 16KB page - fix to do sanity check on node footer for non inode dnode - fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() - fix to detect potential corrupted nid in free_nid_list - fix to clear unusable_cap for checkpoint=enable - fix to zero data after EOF for compressed file correctly - fix to avoid overflow while left shift operation - fix condition in __allow_reserved_blocks()" * tag 'f2fs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (43 commits) f2fs: add missing dput() when printing the donation list f2fs: fix UAF issue in f2fs_merge_page_bio() f2fs: readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode f2fs: add sanity check on ei.len in __update_extent_tree_range() f2fs: fix infinite loop in __insert_extent_tree() f2fs: fix zero-sized extent for precache extents f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() f2fs: fix to avoid migrating empty section f2fs: fix to truncate first page in error path of f2fs_truncate() f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() f2fs: fix wrong layout information on 16KB page f2fs: clean up error handing of f2fs_submit_page_read() f2fs: avoid unnecessary folio_clear_uptodate() for cleanup f2fs: merge FUA command with the existing writes f2fs: allocate HOT_DATA for IPU writes f2fs: Use allocate_section_policy to control write priority in multi-devices setups Documentation: f2fs: Reword title Documentation: f2fs: Indent compression_mode option list Documentation: f2fs: Wrap snippets in literal code blocks Documentation: f2fs: Span write hint table section rows ... commit f0712c203862b00139b34fcbb1710b479af2b101 Merge: f2327dc8513d09 d01579d590f72d Author: Linus Torvalds Date: Fri Oct 3 14:02:53 2025 -0700 Merge tag 'exfat-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Add support for FS_IOC_{GET,SET}FSLABEL ioctl - Two small clean-up patches - Optimizes allocation bitmap loading time on large partitions with small cluster sizes - Allow changes for discard, zero_size_dir, and errors options via remount - Validate that the clusters used for the allocation bitmap are correctly marked as in-use during mount, preventing potential data corruption from reallocating the bitmap's own space - Uses ratelimit to avoid too many error prints on I/O error path * tag 'exfat-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: Add support for FS_IOC_{GET,SET}FSLABEL exfat: combine iocharset and utf8 option setup exfat: support modifying mount options via remount exfat: optimize allocation bitmap loading time exfat: Remove unnecessary parentheses exfat: drop redundant conversion to bool exfat: validate cluster allocation bits of the allocation bitmap exfat: limit log print for IO error commit f2327dc8513d0928a64b75656a6efe12b5c7c00a Merge: a9b38767c607e0 11f6bce77e27e8 Author: Linus Torvalds Date: Fri Oct 3 13:59:56 2025 -0700 Merge tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Two cleanups and a bug fix: - Remove unused type in macro fill_default_sys_attrs (Zhen Ni) - Replace kzalloc + copy_from_user with memdup_user_nul (Thorsten Blum) - Fix xattr related buffer overflow... A message was forwarded to me from Disclosure indicating a problem with a loop condition in our xattr code. When I fixed the problem it exposed a related memory leak problem, and I fixed that too" * tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul orangefs: fix xattr related buffer overflow... orangefs: Remove unused type in macro fill_default_sys_attrs commit a9b38767c607e0de219b66a2b1ba0cb37beaba08 Merge: 5cb08b62fb1eca 7d460636b64023 Author: Linus Torvalds Date: Fri Oct 3 13:57:33 2025 -0700 Merge tag 'ntfs3_for_6.18' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "Added: - support for FS_IOC_{GET,SET}FSLABEL ioctl - reject index allocation if $BITMAP is empty but blocks exist Fixed: - integer overflow in run_unpack() - resource leak bug in wnd_extend() Changed: - pretend $Extend records as regular files - stop using write_cache_pages" * tag 'ntfs3_for_6.18' of https://github.com/Paragon-Software-Group/linux-ntfs3: ntfs3: stop using write_cache_pages fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist fs/ntfs3: Fix a resource leak bug in wnd_extend() fs: ntfs3: Fix integer overflow in run_unpack() ntfs3: pretend $Extend records as regular files ntfs3: add FS_IOC_SETFSLABEL ioctl ntfs3: add FS_IOC_GETFSLABEL ioctl ntfs3: transition magic number to shared constant commit 5cb08b62fb1ecacf886fc0142316b17230e1b3a9 Merge: 65989db7f88456 cafc6679824a02 Author: Linus Torvalds Date: Fri Oct 3 13:54:23 2025 -0700 Merge tag 'jfs-6.18' of github.com:kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "A few fixes and cleanups for JFS" * tag 'jfs-6.18' of github.com:kleikamp/linux-shaggy: jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant JFS: Remove redundant 0 value initialization JFS: Remove unnecessary parentheses jfs: fix uninitialized waitqueue in transaction manager jfs: Verify inode mode when loading from disk commit 65989db7f88456273d0913d8d21f6097fa6aad19 Merge: a4eb9356480fa4 acf943e9768ec9 Author: Linus Torvalds Date: Fri Oct 3 13:47:10 2025 -0700 Merge tag 'ext4_for_linus-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "New ext4 features: - Add support so tune2fs can modify/update the superblock using an ioctl, without needing write access to the block device - Add support for 32-bit reserved uid's and gid's Bug fixes: - Fix potential warnings and other failures caused by corrupted / fuzzed file systems - Fail unaligned direct I/O write with EINVAL instead of silently falling back to buffered I/O - Correectly handle fsmap queries for metadata mappings - Avoid journal stalls caused by writeback throttling - Add some missing GFP_NOFAIL flags to avoid potential deadlocks under extremem memory pressure Cleanups: - Remove obsolete EXT3 Kconfigs" * tag 'ext4_for_linus-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix checks for orphan inodes ext4: validate ea_ino and size in check_xattrs ext4: guard against EA inode refcount underflow in xattr update ext4: implemet new ioctls to set and get superblock parameters ext4: add support for 32-bit default reserved uid and gid values ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() ext4: fix an off-by-one issue during moving extents ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() ext4: verify orphan file size is not too big ext4: fail unaligned direct IO write with EINVAL ext4: correctly handle queries for metadata mappings ext4: increase IO priority of fastcommit ext4: remove obsolete EXT3 config options jbd2: increase IO priority of checkpoint ext4: fix potential null deref in ext4_mb_init() ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() ext4: replace min/max nesting with clamp() fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock commit a4eb9356480fa47618e597a43284c52ac6023f28 Merge: 67f5f11cdf5081 3bd5e45c2ce30e Author: Linus Torvalds Date: Fri Oct 3 13:44:05 2025 -0700 Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf and quota updates from Jan Kara: "A fix for UDF and quota" * tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs: udf: fix OOB read in lengthAllocDescs handling fs: quota: create dedicated workqueue for quota_release_work commit 67f5f11cdf5081af9b592d8ab24d054a0d681b2f Merge: 2c1ef408c2bbad b8cf8fda522d5a Author: Linus Torvalds Date: Fri Oct 3 13:23:10 2025 -0700 Merge tag 'fsnotify_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: - a couple of small cleanups and fixes - implement fanotify watchdog that reports processes that fail to respond to fanotify permission events in a given time * tag 'fsnotify_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: add watchdog for permission events fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing fsnotify: fix "rewriten"->"rewritten" commit 2c1ef408c2bbadd814cc0b1d38d02da42f759584 Merge: 6238729bfce13f 462272dd734b56 Author: Linus Torvalds Date: Fri Oct 3 13:13:17 2025 -0700 Merge tag 'configfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs update from Andreas Hindborg: "Just a very small refactoring to use PTR_ERR_OR_ZERO()" * tag 'configfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: configfs: use PTR_ERR_OR_ZERO() to simplify code commit 56be0fe5f62c8d165b8c9c3d3bc1dab6e8443146 Author: Thomas Falcon Date: Thu Oct 2 18:43:06 2025 -0500 perf record: Add auto counter reload parse and regression tests Include event parsing and regression tests for auto counter reload and ratio-to-prev event term. Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6b9c0261b3fb298b1fd49621f0479518efdcf3dc Author: Thomas Falcon Date: Thu Oct 2 18:43:05 2025 -0500 perf record: Add ratio-to-prev term Provide ratio-to-prev term which allows the user to set the event sample period of two events corresponding to a desired ratio. If using on an Intel x86 platform with Auto Counter Reload support, also set corresponding event's config2 attribute with a bitmask which counters to reset and which counters to sample if the desired ratio is met or exceeded. On other platforms, only the sample period is affected by the ratio-to-prev term. Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 584754cbee6edf8495117e176427113b51a9bd7f Author: Ian Rogers Date: Thu Oct 2 18:23:49 2025 -0700 tools build: Remove libbpf-strings feature test The feature test is unnecessary as the LIBBPF_CURRENT_VERSION_GEQ(1,7) macro can be used instead. The only use was in perf and this is now removed. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Blake Jones Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 2bd597170f46610792c541814ac36d14618de459 Author: Ian Rogers Date: Thu Oct 2 18:23:48 2025 -0700 perf bpf-event: Use libbpf version rather than feature check The feature check guarded the -DHAVE_LIBBPF_STRINGS_SUPPORT is unnecessary as it is sufficient and easier to use the LIBBPF_CURRENT_VERSION_GEQ macro. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Blake Jones Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a90777bb03fc7b9bc5d668ed136d86c3971f48bf Author: Ian Rogers Date: Thu Oct 2 19:39:28 2025 -0700 perf build: Move libopcode disasm tests to BUILD_NONDISTRO The disasm feature tests feature-disassembler-four-args and feature-disassembler-init-styled link against libopcodes part of binutils which is license incompatible (GPLv3) with perf. Moving these tests out of the common config will help improve build time. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit c5b76ab525d3f6ad711ff07fd77de04ec1f0c9b0 Author: Ian Rogers Date: Thu Oct 2 19:27:33 2025 -0700 tools build: Remove feature-libslang-include-subdir Added in commit cbefd24f0aee3a5d ("tools build: Add test to check if slang.h is in /usr/include/slang/") this feature was to fix build support on now unsupported versions of RHEL 5 and 6. As 6 years has passed let's remove the workaround. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a5099d8143db7f44e82b1098b75c398e6abc7c54 Author: Zecheng Li Date: Wed Sep 17 19:58:00 2025 +0000 perf annotate: Rename TSR_KIND_POINTER to TSR_KIND_PERCPU_POINTER TSR_KIND_POINTER only represents percpu pointers currently. Rename it to TSR_KIND_PERCPU_POINTER so we can use the TSR_KIND_POINTER to represent pointer to a type. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Signed-off-by: Arnaldo Carvalho de Melo commit 2cc7aa995ce9ecd897c1df7ac04c624d542415ae Author: Ian Rogers Date: Thu Oct 2 15:07:27 2025 -0700 perf stat: Refactor retry/skip/fatal error handling For the sake of Intel topdown events commit 9eac5612da1c9102 ("perf stat: Don't skip failing group events") changed 'perf stat' error handling making it so that more errors were fatal and didn't report "" events. The change outside of topdown events was unintentional. The notion of "fatal" error handling was introduced in commit e0e6a6ca3ac211cc ("perf stat: Factor out open error handling") and refined in commits like commit cb5ef60067c11cc8 ("perf stat: Error out unsupported group leader immediately") to be an approach for avoiding later assertion failures in the code base. This change fixes those issues and removes the notion of a fatal error on an event. If all events fail to open then a fatal error occurs with the previous fatal error message. This seems to best match the notion of supported events and allowing some errors not to stop 'perf stat', while allowing the truly fatal no event case to terminate the tool early. The evsel->errored flag is only used in the stat code but always just meaning !evsel->supported although there is a comment about it being sticky. Force all evsels to be supported in evsel__init and then clear this when evsel__open fails. When an event is tried the supported is set to true again. This simplifies the notion of whether an evsel is broken. In the get_group_fd code, fail to get a group fd when the evsel isn't supported. If the leader isn't supported then it is also expected that there is no group_fd as the leader will have been skipped. Therefore change the BUG_ON test to be on supported rather than skippable. This corrects the assertion errors that were the reason for the previous fatal error handling. Fixes: 9eac5612da1c9102 ("perf stat: Don't skip failing group events") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Link: https://lore.kernel.org/r/20251002220727.1889799-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6026ab657a0e9e8b05f8d9fbf99a65151ce7a40b Author: Ian Rogers Date: Thu Oct 2 15:07:26 2025 -0700 perf stat: Move create_perf_stat_counter() to builtin-stat.c The function create_perf_stat_counter is only used in builtin-stat.c and contains logic about retrying events specific to builtin-stat.c. Move the code to builtin-stat.c to tidy this up. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 79cc9b4b2cc1e9a100f3bdab22c954f8541a8cc7 Author: Ian Rogers Date: Fri Oct 3 10:56:13 2025 -0700 tools build: Remove get_current_dir_name feature check As perf no longer tests for this feature, and it was the only user, remove the feature test. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra [ Remove the call to main_test_get_current_dir_name() from main() in test-all.c, otherwise it will always fail ] Signed-off-by: Arnaldo Carvalho de Melo commit 6238729bfce13f94b701766996a5d116d2df8bff Merge: cf06d791f840be cb403594701cd3 Author: Linus Torvalds Date: Fri Oct 3 12:48:18 2025 -0700 Merge tag 'fuse-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Extend copy_file_range interface to be fully 64bit capable (Miklos) - Add selftest for fusectl (Chen Linxuan) - Move fuse docs into a separate directory (Bagas Sanjaya) - Allow fuse to enter freezable state in some cases (Sergey Senozhatsky) - Clean up writeback accounting after removing tmp page copies (Joanne) - Optimize virtiofs request handling (Li RongQing) - Add synchronous FUSE_INIT support (Miklos) - Allow server to request prune of unused inodes (Miklos) - Fix deadlock with AIO/sync release (Darrick) - Add some prep patches for block/iomap support (Darrick) - Misc fixes and cleanups * tag 'fuse-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (26 commits) fuse: move CREATE_TRACE_POINTS to a separate file fuse: move the backing file idr and code into a new source file fuse: enable FUSE_SYNCFS for all fuseblk servers fuse: capture the unique id of fuse commands being sent fuse: fix livelock in synchronous file put from fuseblk workers mm: fix lockdep issues in writeback handling fuse: add prune notification fuse: remove redundant calls to fuse_copy_finish() in fuse_notify() fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() fuse: remove FUSE_NOTIFY_CODE_MAX from fuse: remove fuse_readpages_end() null mapping check fuse: fix references to fuse.rst -> fuse/fuse.rst fuse: allow synchronous FUSE_INIT fuse: zero initialize inode private data fuse: remove unused 'inode' parameter in fuse_passthrough_open virtio_fs: fix the hash table using in virtio_fs_enqueue_req() mm: remove BDI_CAP_WRITEBACK_ACCT fuse: use default writeback accounting virtio_fs: Remove redundant spinlock in virtio_fs_request_complete() fuse: remove unneeded offset assignment when filling write pages ... commit dea00c204e7e99aca9a4cb8603174c4cd0051728 Author: Emil Dahl Juhl Date: Wed Oct 1 13:40:57 2025 +0200 tools: lib: thermal: expose thermal_exit symbols Remove duplicate entry for thermal_init and add the missing entries for thermal_exit and their respectives in cmd, events, and sampling context. Signed-off-by: Emil Dahl Juhl Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 1375152bb02ab2a8435e87ea27034482dbc95f57 Author: Emil Dahl Juhl Date: Wed Oct 1 13:40:56 2025 +0200 tools: lib: thermal: don't preserve owner in install Instead of preserving mode, timestamp, and owner, for the object files during installation, just preserve the mode and timestamp. When installing as root, the installed files should be owned by root. When installing as user, --preserve=ownership doesn't work anyway. This makes --preserve=ownership rather pointless. Signed-off-by: Emil Dahl Juhl Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit b31f7f725cd932e2c2b41f3e4b66273653953687 Author: Sascha Hauer Date: Wed Oct 1 13:40:55 2025 +0200 tools: lib: thermal: use pkg-config to locate libnl3 To make libthermal more cross compile friendly use pkg-config to locate libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 1af59cd5cc2b65d7fc95165f056695ce3f171133 Author: Raag Jadav Date: Thu Sep 18 16:02:00 2025 +0530 drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM path In S3 and above sleep states, the device can loose power regardless of d3cold.allowed flag. Bring up I2C controller explicitly in system PM path to ensure its normal operation after losing power. v2: Cover S3 and above states (Rodrigo) Fixes: 0ea07b69517a ("drm/xe/pm: Wire up suspend/resume for I2C controller") Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250918103200.2952576-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit e4863f1159befcd70df24fcb5458afaf2feab043) Signed-off-by: Lucas De Marchi commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d Author: Shuicheng Lin Date: Thu Sep 25 02:31:46 2025 +0000 drm/xe/hw_engine_group: Fix double write lock release in error path In xe_hw_engine_group_get_mode(), a write lock is acquired before calling switch_mode(), which in turn invokes xe_hw_engine_group_suspend_faulting_lr_jobs(). On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), the write lock is released there, and then again in xe_hw_engine_group_get_mode(), leading to a double release. Fix this by keeping both acquire and release operation in xe_hw_engine_group_get_mode(). Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes") Cc: Francois Dugast Signed-off-by: Shuicheng Lin Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c) Signed-off-by: Lucas De Marchi commit 2d1684a077d62fddfac074052c162ec6573a34e1 Author: Matthew Auld Date: Fri Sep 19 13:20:53 2025 +0100 drm/xe/uapi: loosen used tracking restriction Currently this is hidden behind perfmon_capable() since this is technically an info leak, given that this is a system wide metric. However the granularity reported here is always PAGE_SIZE aligned, which matches what the core kernel is already willing to expose to userspace if querying how many free RAM pages there are on the system, and that doesn't need any special privileges. In addition other drm drivers seem happy to expose this. The motivation here if with oneAPI where they want to use the system wide 'used' reporting here, so not the per-client fdinfo stats. This has also come up with some perf overlay applications wanting this information. Fixes: 1105ac15d2a1 ("drm/xe/uapi: restrict system wide accounting") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Joshua Santosh Cc: José Roberto de Souza Cc: Matthew Brost Cc: Rodrigo Vivi Cc: # v6.8+ Acked-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250919122052.420979-2-matthew.auld@intel.com (cherry picked from commit 4d0b035fd6dae8ee48e9c928b10f14877e595356) Signed-off-by: Lucas De Marchi commit cf06d791f840be97f726ecaaea872a876ff62436 Merge: 9b0d551bcc05fa ad1423922781e6 Author: Linus Torvalds Date: Fri Oct 3 12:14:24 2025 -0700 Merge tag 'ovl-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs updates from Amir Goldstein: - Work by André Almeida to support case-insensitive overlayfs Underlying case-insensitive filesystems casefolding is per directory, but for overlayfs it is all-or-nothing. It supports layers where all directories are casefolded (with same encoding) or layers where no directories are casefolded. - A fix for a "bug" in Neil's ovl directory lock changes, which only manifested itself with casefold enabled layers which may return an unhashed negative dentry from lookup. * tag 'ovl-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: make sure that ovl_create_real() returns a hashed dentry ovl: Support mounting case-insensitive enabled layers ovl: Check for casefold consistency when creating new dentries ovl: Add S_CASEFOLD as part of the inode flag to be copied ovl: Set case-insensitive dentry operations for ovl sb ovl: Ensure that all layers have the same encoding ovl: Create ovl_casefold() to support casefolded strncmp() ovl: Prepare for mounting case-insensitive enabled layers fs: Create sb_same_encoding() helper fs: Create sb_encoding() helper commit 92158fae2ed986f44347fc5b9a269830862c1529 Author: Dan Carpenter Date: Fri Oct 3 12:29:31 2025 +0300 PM: runtime: Fix error checking for kunit_device_register() The kunit_device_register() function never returns NULL, it returns error pointers. Update the assertions to use KUNIT_ASSERT_NOT_ERR_OR_NULL() instead of checking for NULL. Fixes: 7f7acd193ba8 ("PM: runtime: Add basic kunit tests for API contracts") Signed-off-by: Dan Carpenter Reviewed-by: Brian Norris Signed-off-by: Rafael J. Wysocki commit 384b52ce32110db974d3b61d463af48347eb73fb Author: Rafael J. Wysocki Date: Wed Oct 1 19:34:29 2025 +0200 PM: runtime: Introduce one more usage counter guard Follow previous commit 9a0abc39450a ("PM: runtime: Add auto-cleanup macros for "resume and get" operations") and define a runtime PM usage counter guard in which pm_runtime_get_noresume() and pm_runtime_put_noidle() will be used for incrementing and decrementing it, respectively. Signed-off-by: Rafael J. Wysocki Reviewed-by: Jonathan Cameron commit 9b0d551bcc05fa4786689544a2845024db1d41b6 Merge: 33fc69a05c50f0 f037fd7fbca4d1 Author: Linus Torvalds Date: Fri Oct 3 11:37:50 2025 -0700 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc non-vfs updates from Al Viro: "Assorted dead code removal around asm/pgtable.h" * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: alpha: unobfuscate _PAGE_P() definition kill FIRST_USER_PGD_NR alpha: get rid of the remnants of BAD_PAGE and friends SET_PAGE_DIR() users had been gone since 2.3.12pre1 PAGE_PTR() had been last used outside of arch/* in 1.1.94 csky: remove BS check for FAULT_FLAG_ALLOW_RETRY commit 062d02a96d810d55afdc594ceeb52223d8b36b5c Author: Ian Rogers Date: Fri Oct 3 10:56:12 2025 -0700 perf namespaces: Avoid get_current_dir_name dependency get_current_dir_name is a GNU extension not supported on, for example, Android. There is only one use of it so let's just switch to getcwd to avoid build and other complexity. Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 33fc69a05c50f00f1218408a56348bcab95b831d Merge: 829745b75a1af2 180a9cc3fd6a02 Author: Linus Torvalds Date: Fri Oct 3 11:14:02 2025 -0700 Merge tag 'pull-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull d_name audit update from Al Viro: "Simplifying ->d_name audits, easy part. Turn dentry->d_name into an anon union of const struct qsrt (d_name itself) and a writable alias (__d_name). With constification of some struct qstr * arguments of functions that get &dentry->d_name passed to them, that ends up with all modifications provably done only in fs/dcache.c (and a fairly small part of it). Any new places doing modifications will be easy to find - grep for __d_name will suffice" * tag 'pull-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: make it easier to catch those who try to modify ->d_name generic_ci_validate_strict_name(): constify name argument afs_dir_search: constify qstr argument afs_edit_dir_{add,remove}(): constify qstr argument exfat_find(): constify qstr argument security_dentry_init_security(): constify qstr argument commit 829745b75a1af25bfb0c7dc36640548c98c57169 Merge: 867e4513fe4ba7 2944ebee9a96c9 Author: Linus Torvalds Date: Fri Oct 3 10:59:31 2025 -0700 Merge tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull finish_no_open updates from Al Viro: "finish_no_open calling conventions change to simplify callers" * tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: slightly simplify nfs_atomic_open() simplify gfs2_atomic_open() simplify fuse_atomic_open() simplify nfs_atomic_open_v23() simplify vboxsf_dir_atomic_open() simplify cifs_atomic_open() 9p: simplify v9fs_vfs_atomic_open_dotl() 9p: simplify v9fs_vfs_atomic_open() allow finish_no_open(file, ERR_PTR(-E...)) commit 867e4513fe4ba7e7a7ff6a59a1fbbc7d54f443c7 Merge: 51e9889ab120c2 92003056e5d45f Author: Linus Torvalds Date: Fri Oct 3 10:55:35 2025 -0700 Merge tag 'pull-nfsctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull nfsctl updates from Al Viro: "nfsctl cleanups and a fix" * tag 'pull-nfsctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: nfsd_get_inode(): lift setting ->i_{,f}op to callers. nfsdfs_create_files(): switch to simple_start_creating() _nfsd_symlink(): switch to simple_start_creating() nfsd_mkdir(): switch to simple_start_creating() nfsctl: symlink has no business bumping link count of parent directory commit 51e9889ab120c21de8a3ae447672e69aa4266103 Merge: e64aeecbbb0962 57e62089f8e9d0 Author: Linus Torvalds Date: Fri Oct 3 10:51:44 2025 -0700 Merge tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull fs_context updates from Al Viro: "Change vfs_parse_fs_string() calling conventions Get rid of the length argument (almost all callers pass strlen() of the string argument there), add vfs_parse_fs_qstr() for the cases that do want separate length" * tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_nfs4_mount(): switch to vfs_parse_fs_string() change the calling conventions for vfs_parse_fs_string() commit 1b54b0756f051c11f5a5d0fbc1581e0b9a18e2bc Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 16:27:15 2025 +0530 net: doc: Fix typos in docs Fix typos in doc comments. Signed-off-by: Bhanu Seshu Kumar Valluri Link: https://patch.msgid.link/20251001105715.50462-1-bhanuseshukumar@gmail.com Signed-off-by: Jakub Kicinski commit 7a0f94361ffd6e1d31c79023e8674b492bef05e3 Author: Jakub Kicinski Date: Tue Sep 30 19:24:26 2025 -0700 net: psp: don't assume reply skbs will have a socket Rx path may be passing around unreferenced sockets, which means that skb_set_owner_edemux() may not set skb->sk and PSP will crash: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287) tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979) tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1)) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912) Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange") Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251001022426.2592750-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c Author: Dan Carpenter Date: Tue Sep 30 15:25:01 2025 +0300 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it. Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") Signed-off-by: Dan Carpenter Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain Signed-off-by: Jakub Kicinski commit e64aeecbbb0962601bd2ac502a2f9c0d9be97502 Merge: e406d57be7bd2a a79765248649de Author: Linus Torvalds Date: Fri Oct 3 10:19:44 2025 -0700 Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount updates from Al Viro: "Several piles this cycle, this mount-related one being the largest and trickiest: - saner handling of guards in fs/namespace.c, getting rid of needlessly strong locking in some of the users - lock_mount() calling conventions change - have it set the environment for attaching to given location, storing the results in caller-supplied object, without altering the passed struct path. Make unlock_mount() called as __cleanup for those objects. It's not exactly guard(), but similar to it - MNT_WRITE_HOLD done right. mnt_hold_writers() does *not* mess with ->mnt_flags anymore, so insertion of a new mount into ->s_mounts of underlying superblock does not, in itself, expose ->mnt_flags of that mount to concurrent modifications - getting rid of pathological cases when umount() spends quadratic time removing the victims from propagation graph - part of that had been dealt with last cycle, this should finish it - a bunch of stuff constified - assorted cleanups * tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (64 commits) constify {__,}mnt_is_readonly() WRITE_HOLD machinery: no need for to bump mount_lock seqcount struct mount: relocate MNT_WRITE_HOLD bit preparations to taking MNT_WRITE_HOLD out of ->mnt_flags setup_mnt(): primitive for connecting a mount to filesystem simplify the callers of mnt_unhold_writers() copy_mnt_ns(): use guards copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure open_detached_copy(): separate creation of namespace into helper open_detached_copy(): don't bother with mount_lock_hash() path_has_submounts(): use guard(mount_locked_reader) fs/namespace.c: sanitize descriptions for {__,}lookup_mnt() ecryptfs: get rid of pointless mount references in ecryptfs dentries umount_tree(): take all victims out of propagation graph at once do_mount(): use __free(path_put) do_move_mount_old(): use __free(path_put) constify can_move_mount_beneath() arguments path_umount(): constify struct path argument may_copy_tree(), __do_loopback(): constify struct path argument path_mount(): constify struct path argument ... commit 49bdb63ff64469a6de8ea901aef123c75be9bbe7 Author: Bhanu Seshu Kumar Valluri Date: Tue Sep 30 14:19:02 2025 +0530 net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout ===================================================== BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 Local variable sig.i.i created at: lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error. As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller. Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9 Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") Signed-off-by: Bhanu Seshu Kumar Valluri Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250930084902.19062-1-bhanuseshukumar@gmail.com Signed-off-by: Jakub Kicinski commit 51204faa4273a64b7066b5c1b5383e9b20d58caa Merge: 43c59341487d53 cf6ee09b091330 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:25 2025 -0500 Merge branch 'pci/misc' - Fix whitespace issues (Li Jun) - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das) - Add sysfs 'serial_number' file to expose the Device Serial Number (Matthew Wood) * pci/misc: PCI/sysfs: Expose PCI device serial number PCI/ACPI: Fix pci_acpi_preserve_config() memory leak commit 43c59341487d53c782695d1b85b3bd1d69182931 Merge: 7fe17980cb4e55 98a4f5b7359205 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:25 2025 -0500 Merge branch 'pci/controller/xilinx-nwl' - Clear bootloader E_ECAM_CONTROL before merging in the new driver value (Jani Nurminen) * pci/controller/xilinx-nwl: PCI: xilinx-nwl: Fix ECAM programming commit 7fe17980cb4e55beb634e58085ac3a880786ca93 Merge: c4c50d8da88c38 b26fc701a25195 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:24 2025 -0500 Merge branch 'pci/controller/xgene' * pci/controller/xgene: PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() commit c4c50d8da88c383cc446e60fda8c2c317ebb93e5 Merge: 30eccd3b7d2f0c e1bd928479fb1f Author: Bjorn Helgaas Date: Fri Oct 3 12:13:23 2025 -0500 Merge branch 'pci/controller/tegra' - Correct the devm_kcalloc() argument order (Alok Tiwari) - When asserting PERST#, disable the controller instead of mistakenly disabling the PLL twice (Nagarjuna Kristam) - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) - Rename 'root_bus' to 'root_port_bus' for clarity (Manivannan Sadhasivam) * pci/controller/tegra: PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation commit 30eccd3b7d2f0cdd86929fc9a0f7d75493fb520e Merge: 0157e111db7d7a c86a24dfa902fc Author: Bjorn Helgaas Date: Fri Oct 3 12:13:23 2025 -0500 Merge branch 'pci/controller/stm32' - Update pinctrl documentation of initial states and use in runtime suspend/resume (Christian Bruel) - Add pinctrl_pm_select_init_state() for use by stm32 driver, which needs it during resume (Christian Bruel) - Add devicetree bindings and drivers for the STMicroelectronics STM32MP25 in host and endpoint modes (Christian Bruel) * pci/controller/stm32: MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings PCI: stm32: Add PCIe host support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Root Complex bindings pinctrl: Add pinctrl_pm_select_init_state helper function Documentation: pinctrl: Describe PM helper functions for standard states. commit 0157e111db7d7a2527a9387bca18b8e3855780dc Merge: 2ee6181ffdb8ca 1c72774df02842 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:22 2025 -0500 Merge branch 'pci/controller/sophgo' - Check for existence of struct cdns_pcie.ops before using it to allow Cadence drivers that don't need to supply ops (Chen Wang) - Add DT binding and driver for the Sophgo SG2042 PCIe controller (Chen Wang) * pci/controller/sophgo: PCI: sg2042: Add Sophgo SG2042 PCIe driver PCI: cadence: Check for the existence of cdns_pcie::ops before using it dt-bindings: pci: Add Sophgo SG2042 PCIe host commit 2ee6181ffdb8cad074a26465433fe8f9e9bef923 Merge: 86a3f3db9a0f4f 5ed35b4d490d87 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:22 2025 -0500 Merge branch 'pci/controller/rcar-host' - Pass the correct IRQ domain to generic_handle_domain_irq() to fix a regression when converting to msi_create_parent_irq_domain() (Claudiu Beznea) - Drop the spinlock protecting the PMSR register; it's no longer required since pci_lock already serializes accesses (Marek Vasut) - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) * pci/controller/rcar-host: PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock PCI: rcar-host: Drop PMSR spinlock PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() commit 86a3f3db9a0f4f5b9a6f77a63d063b57c146306b Merge: 531abff0fa53bc 2bdf1d428f48e1 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:21 2025 -0500 Merge branch 'pci/controller/rcar-gen4' - Fix a typo that prevented correct PHY initialization (Marek Vasut) - Add a missing 1ms delay after PWR reset assertion as required by the V4H manual (Marek Vasut) - Assure reset has completed before DBI access to avoid SError (Marek Vasut) - Fix inverted PHY initialization check, which sometimes led to timeouts and failure to start the controller (Marek Vasut) * pci/controller/rcar-gen4: PCI: rcar-gen4: Fix inverted break condition in PHY initialization PCI: rcar-gen4: Assure reset occurs before DBI access PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion PCI: rcar-gen4: Fix PHY initialization commit 531abff0fa53bc3a2f7f69b2693386eb6bda96e5 Merge: 93f32da3d409a2 0da48c5b2fa731 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:20 2025 -0500 Merge branch 'pci/controller/qcom' - Select PCI Power Control Slot driver so slot voltage rails can be turned on/off if described in Root Port device tree node (Qiang Yu) - Parse only PCI bridge child nodes in device tree, skipping unrelated nodes such as OPP (Operating Performance Points), which caused probe failures (Krishna Chaitanya Chundru) - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang) - Fix typo in CURSOR macro names (Ziyue Zhang) - Consolidate Root Port 'phy' and 'reset' properties in struct qcom_pcie_port, regardless of whether we got them from the Root Port node or the host bridge node (Manivannan Sadhasivam) - Fetch and map the ELBI register space in the DWC core rather than in each driver individually (Krishna Chaitanya Chundru) - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG Shift Feature' and use this in the qcom driver (Krishna Chaitanya Chundru) * pci/controller/qcom: PCI: dwc: Support ECAM mechanism by enabling iATU 'CFG Shift Feature' PCI: qcom: Prepare for the DWC ECAM enablement PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature' PCI: dwc: Add support for ELBI resource mapping PCI: qcom: Move host bridge 'phy' and 'reset' pointers to struct qcom_pcie_port PCI: qcom: Fix macro typo for CURSOR PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s PCI: qcom: Restrict port parsing only to PCIe bridge child nodes PCI: qcom: Select PCI Power Control Slot driver commit 93f32da3d409a29187e0bbc940a9ed619c754cce Merge: dde4b05e26c507 882569dca6646e Author: Bjorn Helgaas Date: Fri Oct 3 12:13:20 2025 -0500 Merge branch 'pci/controller/plda' - Return -ENOMEM directly instead of using dev_err_probe() (Xichao Zhao) * pci/controller/plda: PCI: plda: Remove dev_err_probe() when the errno is -ENOMEM commit dde4b05e26c5077d751ba1ca71aaf2d0bfa8a180 Merge: 836eec3a7c6fe2 81fedb39a9f0da Author: Bjorn Helgaas Date: Fri Oct 3 12:13:19 2025 -0500 Merge branch 'pci/controller/mediatek-gen3' - Add optional sys clock ready time setting to avoid sys_clk_rdy signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno) - Add DT binding and driver support for MT6991 and MT8196 (AngeloGioacchino Del Regno) * pci/controller/mediatek-gen3: PCI: mediatek-gen3: Add support for MediaTek MT8196 SoC dt-bindings: PCI: mediatek-gen3: Add support for MT6991/MT8196 PCI: mediatek-gen3: Implement sys clock ready time setting commit 836eec3a7c6fe2484bc8701546fe17e11c1b3fff Merge: da72dcc28eb757 e51d05f523e43c Author: Bjorn Helgaas Date: Fri Oct 3 12:13:19 2025 -0500 Merge branch 'pci/controller/keystone' - Use kcalloc() instead of kzalloc() to avoid potential integer overflow (Qianfeng Rong) - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver exits with error (Siddharth Vadapalli) * pci/controller/keystone: PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit PCI: keystone: Use kcalloc() instead of kzalloc() commit da72dcc28eb75758366da0167074911f71a8ead6 Merge: efe4466add2f23 cfcd6cab2f33c2 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:18 2025 -0500 Merge branch 'pci/controller/j721e' - Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth Vadapalli) - Power controller off before configuring the glue layer so the controller latches the correct values on power-on (Siddharth Vadapalli) - Correct the error message when j721e_pcie_ctrl_init() fails (Alok Tiwari) * pci/controller/j721e: PCI: j721e: Fix incorrect error message in probe() PCI: j721e: Fix programming sequence of "strap" settings PCI: j721e: Fix module autoloading commit efe4466add2f237fe17d053e2de71768e1141463 Merge: 5611712af3e645 c221cbf8dc547e Author: Bjorn Helgaas Date: Fri Oct 3 12:13:18 2025 -0500 Merge branch 'pci/controller/imx6' - Enable the 3.3V Vaux supply if available so devices can request wakeup with either Beacon or WAKE# (Richard Zhu) * pci/controller/imx6: PCI: imx6: Enable the Vaux supply if available commit 5611712af3e6450f826a5e9b7df022b995fb65c1 Merge: 0a09e23176beb4 ce47f81925ed73 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:17 2025 -0500 Merge branch 'pci/controller/hv' - Remove unused hv_msi_free() parameter (Nam Cao) * pci/controller/hv: PCI: hv: Remove unused parameter of hv_msi_free() commit 0a09e23176beb46879007257b678b6a59905109f Merge: f2b2fcf6d64e45 eea30c76012245 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:16 2025 -0500 Merge branch 'pci/controller/dwc-edma' - Verify that if DT specifies a single IRQ for all eDMA channels, it is named 'dma' (Niklas Cassel) - Remove qcom edma.nr_irqs initialization, which is redundant since dw_pcie_edma_irq_verify() initializes it based on whether the DT contains 'dma' (single IRQ) or 'dmaX' (multiple IRQs) (Niklas Cassel) * pci/controller/dwc-edma: PCI: qcom-ep: Remove redundant edma.nr_irqs initialization PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() commit f2b2fcf6d64e45f68e1730ac0a63fe896f06241e Merge: df1d435baafa18 cef730075cfe2b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:16 2025 -0500 Merge branch 'pci/controller/dwc' - Add support for x16 in devicetree 'num-lanes' property (Konrad Dybcio) * pci/controller/dwc: PCI: dwc: Support 16-lane operation commit df1d435baafa18b1b8a923dfaf663241cde54364 Merge: f26502c7b895ed 1d0156c8b230ca Author: Bjorn Helgaas Date: Fri Oct 3 12:13:15 2025 -0500 Merge branch 'pci/controller/amd-mdb' - Update DT binding example to separate PERST# to a Root Port stanza to make multiple Root Ports possible in the future (Sai Krishna Musham) - Add driver support for Root Port PERST# (Sai Krishna Musham) * pci/controller/amd-mdb: PCI: amd-mdb: Add support for PCIe RP PERST# signal handling dt-bindings: PCI: amd-mdb: Add example usage of reset-gpios for PCIe RP PERST# commit f26502c7b895ed33867824ac35e401d6641a9985 Merge: 94401068457e04 f8c9ad46b00453 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:15 2025 -0500 Merge branch 'pci/endpoint' - Check for errors returned from pci_epc_get(), which returns IS_ERR(), not NULL on error (Dan Carpenter) - Fix pci_endpoint_test_ioctl() array underflow (Dan Carpenter) - Document sysfs interface for BAR assignment of vNTB endpoint functions (Jerome Brunet) - Drop superfluous pci_epc_features initialization for unsupported features; we only have to mention features that *are* supported (Niklas Cassel) - Skip IRQ tests if the IRQ is out of range (Christian Bruel) - Fix pci-epf-test for controllers with fixed-size BARs smaller than requested by the test (Marek Vasut) - Restore inbound translation when disabling doorbell so the doorbell test case can be run more than once (Niklas Cassel) - Check for NULL before releasing DMA channels to avoid a NULL pointer dereference (Shin'ichiro Kawasaki) - Convert tegra194 interrupt number to MSI vector to fix endpoint Kselftest MSI_TEST test case (Niklas Cassel) - Set tegra_pcie_epc_features.msi_capable so the pci_endpoint_test can use the optimal IRQ type (Niklas Cassel) - Reset tegra194 BARs when running in endpoint mode so the BAR tests don't overwrite the ATU settings in BAR4 (Niklas Cassel) - Handle errors in tegra194 BPMP transactions so we don't mistakenly skip future PERST# assertion (Vidya Sagar) * pci/endpoint: PCI: tegra194: Handle errors in BPMP response PCI: tegra194: Reset BARs when running in PCIe endpoint mode PCI: tegra194: Set pci_epc_features::msi_capable to true PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release PCI: endpoint: pci-epf-test: Fix doorbell test support PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs selftests: pci_endpoint: Skip IRQ test if IRQ is out of range. misc: pci_endpoint_test: Cleanup extra 0 initialization misc: pci_endpoint_test: Skip IRQ tests if irq is out of range PCI: endpoint: Drop superfluous pci_epc_features initialization Documentation: PCI: endpoint: Document BAR assignment misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg() commit 94401068457e041fd2738c1ee23dc86ea4accdcc Merge: fef353037982e3 96a17ed17b3691 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:14 2025 -0500 Merge branch 'pci/dt-binding' - Correct indentation in qcom,pcie-sa8255p.yaml and amd,versal2-mdb-host.yaml so they indent with four spaces consistently (Krzysztof Kozlowski) - Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya Chundru) - Add Peripheral Virtualization Unit (PVU), which restricts DMA from PCIe devices to specific regions of host memory, to the ti,am65 binding (Jan Kiszka) - Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm Glymur, which is compatible with X1E80100 but doesn't have the cnoc_sf_axi clock (Qiang Yu) * pci/dt-binding: dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller dt-bindings: PCI: ti,am65: Extend for use with PVU dt-bindings: PCI: qcom,pcie-sm8550: Add SM8750 compatible dt-bindings: PCI: Correct example indentation commit fef353037982e3fd9aa38e2b8a7426768443777c Merge: 91553998f26abd 907912c1daa7d8 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:14 2025 -0500 Merge branch 'pci/capability-search' - Simplify __pci_find_next_cap_ttl() by replacing magic numbers with #defines, extracting fields with FIELD_GET(), etc (Hans Zhang) - Convert __pci_find_next_cap_ttl() to a PCI_FIND_NEXT_CAP() macro that takes a config space accessor function so we can also use it in cases where the usual config accessors aren't available (Hans Zhang) - Similarly convert pci_find_next_ext_capability() to a PCI_FIND_NEXT_EXT_CAP() macro (Hans Zhang) - Implement dwc, dwc endpoint, and cadence capability search interfaces on top of PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP(), replacing the previous duplicated code (Hans Zhang) - Search for capabilities in the cadence core instead of hard-coding their offsets, which are subject to change (Hans Zhang) * pci/capability-search: PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets PCI: cadence: Implement capability search using PCI core APIs PCI: dwc: ep: Implement capability search using PCI core APIs PCI: dwc: Implement capability search using PCI core APIs PCI: Refactor extended capability search into PCI_FIND_NEXT_EXT_CAP() PCI: Refactor capability search into PCI_FIND_NEXT_CAP() PCI: Clean up __pci_find_next_cap_ttl() readability commit 91553998f26abd1a06a7d7e971e6e2aa711111b5 Merge: 3d56c863189dcf f2543da14dc2b9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:13 2025 -0500 Merge branch 'pci/switchtec' - Replace manual locks with guard to simplify code (Erick Karanja) * pci/switchtec: PCI: switchtec: Replace manual locks with guard commit 3d56c863189dcf72118326bb4043f24907cc4f5c Merge: fead6a0b15bf3b 60e7b5aa85712f Author: Bjorn Helgaas Date: Fri Oct 3 12:13:12 2025 -0500 Merge branch 'pci/virtualization' - Add rescan/remove locking when enabling/disabling SR-IOV, which solves list corruption on s390, where disabling SR-IOV also generates hotplug events (Niklas Schnelle) - Add lockdep assertion in pci_stop_and_remove_bus_device() to catch device removal without appropriate locking (Niklas Schnelle) * pci/virtualization: PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV commit fead6a0b15bf3b33dba877efec6b4e7b4cc4abc3 Merge: b365c0a76946b3 a43ac325c7cbbf Author: Bjorn Helgaas Date: Fri Oct 3 12:13:12 2025 -0500 Merge branch 'pci/resource' - Ensure relaxed tail alignment does not increase min_align when computing bridge window size, to fix a regression (Ilpo Järvinen) - Fix bridge window size computation to fix a regression for devices with undefined PCI class, e.g., Samsung [144d:a5a5] (Ilpo Järvinen) - Fix error handling during resource resize to fix a regression in amdgpu (Ilpo Järvinen) - Align m68k pcibios_enable_device() with other arches (Ilpo Järvinen) - Remove several sparc pcibios_enable_device() implementations that don't do anything beyond what pci_enable_resources() does (Ilpo Järvinen) - Remove mips pcibios_enable_resources() and use pci_enable_resources() instead (Ilpo Järvinen) - Refactor and simplify find_bus_resource_of_type() (Ilpo Järvinen) - Claim bridge windows before setting them up (Ilpo Järvinen) - Disable non-claimed bridge windows so the kernel's view matches the hardware configuration (Ilpo Järvinen) - Use pci_release_resource() instead of release_resource() to reduce code duplication and increase consistency (Ilpo Järvinen) - Enable bridges even if bridge window assignment fails (Ilpo Järvinen) - Preserve bridge window resource type flags when assignment fails because we may need it later (Ilpo Järvinen) - Add bridge window selection functions to make the selection consistent across the several places that do this (Ilpo Järvinen) - Warn if bridge window cannot be released when resizing BAR (Ilpo Järvinen) - Set up bridge resources before enumerating children so we can check whether child resources are inside bridge windows (Ilpo Järvinen) * pci/resource: PCI: Set up bridge resources earlier PCI: Don't print stale information about resource PCI: Alter misleading recursion to pci_bus_release_bridge_resources() PCI: Pass bridge window to pci_bus_release_bridge_resources() PCI: Add pci_setup_one_bridge_window() PCI: Refactor remove_dev_resources() to use pbus_select_window() PCI: Refactor distributing available memory to use loops PCI: Use pbus_select_window_for_type() during mem window sizing PCI: Use pbus_select_window() in space available checker PCI: Rename resource variable from r to res PCI: Use pbus_select_window_for_type() during IO window sizing PCI: Use pbus_select_window() during BAR resize PCI: Warn if bridge window cannot be released when resizing BAR PCI: Fix finding bridge window in pci_reassign_bridge_resources() PCI: Add bridge window selection functions PCI: Add defines for bridge window indexing PCI: Preserve bridge window resource type flags PCI: Enable bridge even if bridge window fails to assign PCI: Use pci_release_resource() instead of release_resource() PCI: Disable non-claimed bridge window PCI: Always claim bridge window before its setup PCI: Refactor find_bus_resource_of_type() logic checks PCI: Move find_bus_resource_of_type() earlier MIPS: PCI: Use pci_enable_resources() sparc/PCI: Remove pcibios_enable_device() as they do nothing extra m68k/PCI: Use pci_enable_resources() in pcibios_enable_device() PCI: Fix failure detection during resource resize PCI: Fix pdev_resources_assignable() disparity PCI: Ensure relaxed tail alignment does not increase min_align commit b365c0a76946b3f18e835c1ee85a280753f9a9b0 Merge: 4c5cd8d64172de dc32e9346b26ba Author: Bjorn Helgaas Date: Fri Oct 3 12:13:11 2025 -0500 Merge branch 'pci/pwrctrl' - Fix a double cleanup of regulators if devm_add_action_or_reset() fails (Geert Uytterhoeven) * pci/pwrctrl: PCI/pwrctrl: Fix device leak at device stop PCI/pwrctrl: Fix device and OF node leak at bus scan PCI/pwrctrl: Fix device leak at registration PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure commit 4c5cd8d64172de3730056366dc61392a3f2f003a Merge: 0bb65e32495e62 48991e4935078b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:11 2025 -0500 Merge branch 'pci/pm' - If a device has already been disconnected, e.g., by a hotplug removal, don't bother trying to resume it to D0 when detaching the driver (Mario Limonciello) - Ensure devices are powered up before config reads for 'max_link_width', 'current_link_speed', 'current_link_width', 'secondary_bus_number', and 'subordinate_bus_number' sysfs files (Brian Norris) * pci/pm: PCI/sysfs: Ensure devices are powered for config reads PCI/PM: Skip resuming to D0 if device is disconnected commit 0bb65e32495e6235a069b60e787140da99e9c122 Merge: 3cde1c3ec9207e 54dbd2a8e974b9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:10 2025 -0500 Merge branch 'pci/p2pdma' - Free struct p2p_pgmap, not a member within it, in the pci_p2pdma_add_resource() error path (Sungho Kim) - Make pci_has_p2pmem() static (Leon Romanovsky) * pci/p2pdma: PCI/P2PDMA: Reduce scope of pci_has_p2pmem() PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call commit 3cde1c3ec9207eafccd56c3645ad7f0641407c78 Merge: 5c16adf2b95104 fad8e97854504b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:10 2025 -0500 Merge branch 'pci/of' - Leave parent unit address 0 in 'interrupt-map' so we can build this property even when interrupt controllers lack 'reg' properties (Lorenzo Pieralisi) * pci/of: PCI: of: Update parent unit address generation in of_pci_prop_intr_map() commit 5c16adf2b95104c1b2bfd3fff33d697a57f5ba0f Merge: 35dbfcb7dc0d3a ebc7086b39e5e4 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:09 2025 -0500 Merge branch 'pci/msi' - Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) * pci/msi: PCI: Disable MSI on RDC PCI to PCIe bridges commit 35dbfcb7dc0d3acad5e44749cbd49f418eaae2fa Merge: 31e04a46cefcd7 1d33d9e46c08e9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:08 2025 -0500 Merge branch 'pci/hotplug' - Clean up whitespace in messages (Colin Ian King) * pci/hotplug: PCI: hotplug: Clean up spaces in messages commit 31e04a46cefcd79976a57eaebbc174dbf7b2100f Merge: 7cc5e1e62bd20a a22250fe933dbd Author: Bjorn Helgaas Date: Fri Oct 3 12:13:08 2025 -0500 Merge branch 'pci/enumeration' - Use PCI_HEADER_TYPE_* defines, not hard-coded values (Ilpo Järvinen) - Clean up early_dump_pci_device() to avoid hard-coded values (Ilpo Järvinen) - Clean up pci_scan_child_bus_extend() loop to avoid hard-coded values (Ilpo Järvinen) - Add a Xeon 6 quirk to disable Extended Tags and limit Max Read Request Size to 128B to avoid a performance issue (Ilpo Järvinen) * pci/enumeration: PCI: Add Extended Tag + MRRS quirk for Xeon 6 PCI: Clean up pci_scan_child_bus_extend() loop PCI: Clean up early_dump_pci_device() PCI: Use header type defines in pci_setup_device() commit 7cc5e1e62bd20a6c24597a0d13bcf24f784e8b74 Merge: a0d0cad13f7173 a729c166461988 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:07 2025 -0500 Merge branch 'pci/aspm' - Enable all ClockPM and ASPM states for devicetree platforms, since there's typically no firmware that enables ASPM (Manivannan Sadhasivam) - Remove the qcom code that enabled ASPM (Manivannan Sadhasivam) * pci/aspm: PCI: qcom: Remove custom ASPM enablement code PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms commit a0d0cad13f7173a5a584fe3596c394cd987771f6 Merge: 8f5ae30d69d754 deb2f228388ff3 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:07 2025 -0500 Merge branch 'pci/aer' - Allow drivers to request a Bus Reset on Non-Fatal Errors (Lukas Wunner) - Send uevents for subordinate devices (not the bridge) on failure to recover from errors on the subordinate devices (Lukas Wunner) - Notify drivers by calling their err_handler.error_detected() callback on failure to recover (Lukas Wunner) - Update device error_state earlier after reset to align AER and EEH error recovery (Lukas Wunner) - Remove obsolete comments about .link_reset(), which was removed long ago (Lukas Wunner) - Emit a uevent for the beginning of error recovery if driver requests a reset (Niklas Schnelle) - Emit error recover uevents on s390 as is done by EEH and AER (Niklas Schnelle) - Include error_detected() result in AER uevent to align with corresponding uevents from EEH and s390 (Niklas Schnelle) - Decode new errors added in PCIe r6.0 (Lukas Wunner) - Print TLP Log for errors introduced since PCIe spec r1.1 (Lukas Wunner) - Check for allocation failure in pci_aer_init() (Vernon Yang) - Update error recovery documentation to match the current code and use consistent nomenclature (Lukas Wunner) - Avoid NULL pointer dereference in aer_ratelimit() when GHES error info points to a device with no AER Capability (Breno Leitao) * pci/aer: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() Documentation: PCI: Fix typos Documentation: PCI: Tidy error recovery doc's PCIe nomenclature Documentation: PCI: Amend error recovery doc with DPC/AER specifics Documentation: PCI: Sync error recovery doc with code Documentation: PCI: Sync AER doc with code PCI/AER: Fix NULL pointer access by aer_info PCI/AER: Print TLP Log for errors introduced since PCIe r1.1 PCI/AER: Support errors introduced by PCIe r6.0 powerpc/eeh: Use result of error_detected() in uevent s390/pci: Use pci_uevent_ers() in PCI recovery PCI/AER: Fix missing uevent on recovery when a reset is requested PCI/ERR: Remove remnants of .link_reset() callback PCI/ERR: Update device error_state already after reset PCI/ERR: Notify drivers on failure to recover PCI/ERR: Fix uevent on failure to recover PCI/AER: Allow drivers to opt in to Bus Reset on Non-Fatal Errors commit 61e19cd2e5c5235326a13a68df1a2f8ec4eeed7b Author: Sasha Levin Date: Mon Sep 29 07:32:38 2025 -0400 tracing: Fix lock imbalance in s_start() memory allocation failure path When s_start() fails to allocate memory for set_event_iter, it returns NULL before acquiring event_mutex. However, the corresponding s_stop() function always tries to unlock the mutex, causing a lock imbalance warning: WARNING: bad unlock balance detected! 6.17.0-rc7-00175-g2b2e0c04f78c #7 Not tainted ------------------------------------- syz.0.85611/376514 is trying to release lock (event_mutex) at: [] traverse.part.0.constprop.0+0x2c4/0x650 fs/seq_file.c:131 but there are no more locks to release! The issue was introduced by commit b355247df104 ("tracing: Cache ':mod:' events for modules not loaded yet") which added the kzalloc() allocation before the mutex lock, creating a path where s_start() could return without locking the mutex while s_stop() would still try to unlock it. Fix this by unconditionally acquiring the mutex immediately after allocation, regardless of whether the allocation succeeded. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250929113238.3722055-1-sashal@kernel.org Fixes: b355247df104 ("tracing: Cache ":mod:" events for modules not loaded yet") Signed-off-by: Sasha Levin Signed-off-by: Steven Rostedt (Google) commit 4af66c2bcab06e6e515b23139122e745d7619680 Author: Dan Carpenter Date: Fri Oct 3 12:29:18 2025 +0300 mfd: ls2kbmc: check for devm_mfd_add_devices() failure Call pci_disable_device() if devm_mfd_add_devices() fails. Fixes: 0d64f6d1ffe9 ("mfd: ls2kbmc: Introduce Loongson-2K BMC core driver") Signed-off-by: Dan Carpenter Message-ID: Signed-off-by: Corey Minyard commit 0892507f4a0b76eb897afc2bacca85e172512379 Author: Dan Carpenter Date: Fri Oct 3 12:29:09 2025 +0300 mfd: ls2kbmc: Fix an IS_ERR() vs NULL check in probe() The devm_kzalloc() function returns NULL on error so check for that instead of error pointers. Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support") Signed-off-by: Dan Carpenter Message-ID: Signed-off-by: Corey Minyard commit efebdf4b722143dc5073cee21276baf1673d451e Merge: 0473d5b964b755 1001cc1171248e Author: Miquel Raynal Date: Fri Oct 3 17:23:18 2025 +0200 Merge tag 'nand/for-6.18' into mtd/next * Raw NAND: - Add support for Loongson-2K1000 and Loongson-2K0500 NAND controllers, including extra features, such as chip select and 6-byte NAND ID reading support. - Drop the s3c2410 driver. * SPI NAND: - Important SPI NAND continuous read improvements and fixes. - Add support for FudanMicro FM25S01A. - Add support for continuous reads in Gigadevice vendor driver. * ECC: - Add support for the Realtek ECC engine. This PR comes with the usual amount of various miscellaneous fixes. Signed-off-by: Miquel Raynal commit 0473d5b964b755a55178f36cbcd832eb362cac03 Merge: 362f84c89e1365 17926cd770ec83 Author: Miquel Raynal Date: Fri Oct 3 17:23:08 2025 +0200 Merge tag 'spi-nor/for-6.18' into mtd/next SPI NOR changes for 6.18 Notable changes: - Some flashes can't perform reads or writes with start or end being an odd number in Octal DTR mode. File systems like UBIFS can request such reads or writes, causing the transaction to error out. Pad the read or write transactions with extra bytes to avoid this problem. Signed-off-by: Miquel Raynal commit 93a4b36ef3cf4ce5e6a7e7a7686181de76e246a1 Author: Nirbhay Sharma Date: Fri Oct 3 17:15:55 2025 +0530 cgroup: Fix seqcount lockdep assertion in cgroup freezer The commit afa3701c0e45 ("cgroup: cgroup.stat.local time accounting") introduced a seqcount to track freeze timing but initialized it as a plain seqcount_t using seqcount_init(). However, the write-side critical section in cgroup_do_freeze() holds the css_set_lock spinlock while calling write_seqcount_begin(). On PREEMPT_RT kernels, spinlocks do not disable preemption, causing the lockdep assertion for a plain seqcount_t, which checks for preemption being disabled, to fail. This triggers the following warning: WARNING: CPU: 0 PID: 9692 at include/linux/seqlock.h:221 Fix this by changing the type to seqcount_spinlock_t and initializing it with seqcount_spinlock_init() to associate css_set_lock with the seqcount. This allows lockdep to correctly validate that the spinlock is held during write operations, resolving the assertion failure on all kernel configurations. Reported-by: syzbot+27a2519eb4dad86d0156@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=27a2519eb4dad86d0156 Fixes: afa3701c0e45 ("cgroup: cgroup.stat.local time accounting") Signed-off-by: Nirbhay Sharma Link: https://lore.kernel.org/r/20251002165510.KtY3IT--@linutronix.de/ Acked-by: Michal Koutný Signed-off-by: Tejun Heo commit f620d66af3165838bfa845dcf9f5f9b4089bf508 Author: Catalin Marinas Date: Wed Sep 24 13:31:22 2025 +0100 arm64: mte: Do not flag the zero page as PG_mte_tagged Commit 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page") attempted to fix ptrace() reading of tags from the zero page by marking it as PG_mte_tagged during cpu_enable_mte(). The same commit also changed the ptrace() tag access permission check to the VM_MTE vma flag while turning the page flag test into a WARN_ON_ONCE(). Attempting to set the PG_mte_tagged flag early with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled may either hang (after commit d77e59a8fccd "arm64: mte: Lock a page for MTE tag initialisation") or have the flags cleared later during page_alloc_init_late(). In addition, pages_identical() -> memcmp_pages() will reject any comparison with the zero page as it is marked as tagged. Partially revert the above commit to avoid setting PG_mte_tagged on the zero page. Update the __access_remote_tags() warning on untagged pages to ignore the zero page since it is known to have the tags initialised. Note that all user mapping of the zero page are marked as pte_special(). The arm64 set_pte_at() will not call mte_sync_tags() on such pages, so PG_mte_tagged will remain cleared. Signed-off-by: Catalin Marinas Fixes: 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page") Reported-by: Gergely Kovacs Cc: stable@vger.kernel.org # 5.10.x Cc: Will Deacon Cc: David Hildenbrand Cc: Lance Yang Acked-by: Lance Yang Reviewed-by: David Hildenbrand Tested-by: Lance Yang Signed-off-by: Will Deacon commit 0ca286477b5e2dc9a00ccd3ab1eaceb9fda4be06 Author: Jens Axboe Date: Fri Oct 3 07:22:02 2025 -0600 io_uring: update liburing git URL Change the liburing git URL to point to the git.kernel.org servers, rather than my private git.kernel.dk server. Due to continued AI scraping of cgit etc, it's becoming quite the chore to maintain a private git server. Signed-off-by: Jens Axboe commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd Author: Coiby Xu Date: Mon Sep 15 13:55:23 2025 +0800 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include #include #include #include #include #include int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; } Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit 191cac349c8eeeb6d64453b8db194d3ad42ca9dc Author: Eric Biggers Date: Thu Aug 14 19:17:33 2025 -0700 lib/digsig: Use SHA-1 library instead of crypto_shash Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Paul Menzel Signed-off-by: Mimi Zohar commit 1376956c5e9e7871978153a483904dc3238e96fb Author: Eric Biggers Date: Thu Aug 14 19:17:32 2025 -0700 integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS, since INTEGRITY_ASYMMETRIC_KEYS selects several options that depend on CRYPTO. This unblocks the removal of the CRYPTO selection from SIGNATURE. SIGNATURE (lib/digsig.c) itself will no longer need CRYPTO, but INTEGRITY_ASYMMETRIC_KEYS was depending on it indirectly via the chain SIGNATURE => INTEGRITY_SIGNATURE => INTEGRITY_ASYMMETRIC_KEYS. Signed-off-by: Eric Biggers Reviewed-by: Paul Menzel Signed-off-by: Mimi Zohar commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 Author: Peter Ujfalusi Date: Thu Oct 2 10:47:19 2025 +0300 ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel It is allowed to mix Link and Host DMA channels in a way that their index is different. In this case we would read the LLP from a channel which is not used or used for other operation. Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire configuration: playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA used Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and Link channel 0 (stream_tag 1). In this case reading the LLP from channel 2 is incorrect as that is not the Link channel used for the HDMI playback. To correct this, we should look up the BE and get the channel used on the Link side. Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)") Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a4b8152c09a832b089864e5e209a479bb0fb5cc9 Author: Kai Vehmanen Date: Thu Oct 2 10:47:18 2025 +0300 ASoC: SOF: ipc4-pcm: do not report invalid delay values Add a sanity check for the calculated delay value before reporting it to the application. If the value is clearly invalid, emit a rate limited warning to kernel log and return a zero delay. This can occur e.g if the host or link DMA hits a buffer over/underrun condition. Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 18dbff48a1ea58100f9fa6886cfef286a96a5fb0 Author: Peter Ujfalusi Date: Thu Oct 2 10:47:17 2025 +0300 ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper Add dev_dbg_ratelimited() wrapper for snd_sof_pcm specific debug prints that needs rate limited. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002074719.2084-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit e95e2d3f34642d1bfd97c703c23c9c282a64d686 Author: Ran Xiaokai Date: Tue Sep 30 06:38:31 2025 +0000 slab: Add allow_spin check to eliminate kmemleak warnings In slab_post_alloc_hook(), kmemleak check is skipped when gfpflags_allow_spinning() returns false since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Therefore, unconditionally calling kmemleak_not_leak() in alloc_slab_obj_exts() would trigger the following warning: kmemleak: Trying to color unknown object at 0xffff8881057f5000 as Grey Call Trace: alloc_slab_obj_exts+0x1b5/0x370 __alloc_tagging_slab_alloc_hook+0x9f/0x2d0 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 Add the allow_spin check in alloc_slab_obj_exts() to eliminate the above warning. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Reviewed-by: Harry Yoo Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20250930063831.782815-1-ranxiaokai627@163.com Signed-off-by: Vlastimil Babka commit 16abbabc004bedeeaa702e11913da9d4fa70e63a Author: Petr Tesarik Date: Wed Oct 1 08:10:28 2025 +0200 dma-mapping: fix direction in dma_alloc direction traces Set __entry->dir to the actual "dir" parameter of all trace events in dma_alloc_class. This struct member was left uninitialized by mistake. Signed-off-by: Petr Tesarik Fixes: 3afff779a725 ("dma-mapping: trace dma_alloc/free direction") Cc: stable@vger.kernel.org Reviewed-by: Sean Anderson Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251001061028.412258-1-ptesarik@suse.com commit ab220548dbefa8f99636741924b6fdf33f3230a2 Author: Shigeru Yoshida Date: Thu Oct 2 14:10:24 2025 +0900 kmsan: fix kmsan_handle_dma() to avoid false positives KMSAN reports an uninitialized value issue in dma_map_phys()[1]. This is a false positive caused by the way the virtual address is handled in kmsan_handle_dma(). Fix it by translating the physical address to a virtual address using phys_to_virt(). [1] BUG: KMSAN: uninit-value in dma_map_phys+0xdc5/0x1060 dma_map_phys+0xdc5/0x1060 dma_map_page_attrs+0xcf/0x130 e1000_xmit_frame+0x3c51/0x78f0 dev_hard_start_xmit+0x22f/0xa30 sch_direct_xmit+0x3b2/0xcf0 __dev_queue_xmit+0x3588/0x5e60 neigh_resolve_output+0x9c5/0xaf0 ip6_finish_output2+0x24e0/0x2d30 ip6_finish_output+0x903/0x10d0 ip6_output+0x331/0x600 mld_sendpack+0xb4a/0x1770 mld_ifc_work+0x1328/0x19b0 process_scheduled_works+0xb91/0x1d80 worker_thread+0xedf/0x1590 kthread+0xd5c/0xf00 ret_from_fork+0x1f5/0x4c0 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __kmalloc_cache_noprof+0x8f5/0x16b0 syslog_print+0x9a/0xef0 do_syslog+0x849/0xfe0 __x64_sys_syslog+0x97/0x100 x64_sys_call+0x3cf8/0x3e30 do_syscall_64+0xd9/0xfa0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 0-89 of 90 are uninitialized Memory access of size 90 starts at ffff8880367ed000 CPU: 1 UID: 0 PID: 1552 Comm: kworker/1:2 Not tainted 6.17.0-next-20250929 #26 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 Workqueue: mld mld_ifc_work Fixes: 6eb1e769b2c1 ("kmsan: convert kmsan_handle_dma to use physical addresses") Signed-off-by: Shigeru Yoshida Reviewed-by: Jason Gunthorpe Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251002051024.3096061-1-syoshida@redhat.com commit 6982a462cb64c5f0a38cd8738398961ddfb883cf Author: Mallesh Koujalagi Date: Thu Oct 2 06:26:48 2025 +0530 drm/xe/xe_late_bind_fw: Initialize uval variable in xe_late_bind_fw_num_fans() Initialize the uval variable to 0 in xe_late_bind_fw_num_fans() to fix a potential use of uninitialized variable warning and ensure predictable behavior. The variable is passed by reference to xe_pcode_read() which should populate it on success, but initializing it to 0 provides a safe default value and follows kernel coding best practices. v2: - uval = 0 which serves as both a safe default and the fallback value when the pcode read operation fails. v3: - Handle MMIO failure (Rodrigo) - The function should probably return the error and make the uval as pointer-argument, like the pcode_read. - Change the caller of this function to propagate the error upwards if mmio failed. Fixes: 45832bf9c10f3 ("drm/xe/xe_late_bind_fw: Initialize late binding firmware") Signed-off-by: Mallesh Koujalagi Link: https://lore.kernel.org/r/20251002005648.3185636-1-mallesh.koujalagi@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 07abc16c14693df703763c45e9fc0abfefc927d5) Signed-off-by: Lucas De Marchi commit 10aa5c80603088d10c2cd5e7e27d561a8fb59c7e Author: Thomas Hellström Date: Tue Sep 30 14:27:52 2025 +0200 drm/gpusvm, drm/xe: Fix userptr to not allow device private pages When userptr is used on SVM-enabled VMs, a non-NULL hmm_range::dev_private_owner value might mean that hmm_range_fault() attempts to return device private pages. Either that will fail, or the userptr code will not know how to handle those. Use NULL for hmm_range::dev_private_owner to migrate such pages to system. In order to do that, move the struct drm_gpusvm::device_private_page_owner field to struct drm_gpusvm_ctx::device_private_page_owner so that it doesn't remain immutable over the drm_gpusvm lifetime. v2: - Don't conditionally compile xe_svm_devm_owner(). - Kerneldoc xe_svm_devm_owner(). Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250930122752.96034-1-thomas.hellstrom@linux.intel.com (cherry picked from commit ad298d9ec957414dbf3d51f3c8bca4b6d2416c0c) Signed-off-by: Lucas De Marchi commit 5b440a8bbafcc673bcff33438c68ea03993948b2 Author: Colin Ian King Date: Wed Sep 24 11:22:08 2025 +0100 drm/xe/xe_late_bind_fw: Fix missing initialization of variable offset The variable offset is not being initialized, and it is only set inside a for-loop if entry->name is the same as manifest_entry. In the case where it is not initialized a non-zero check on offset is potentialy checking a bogus uninitalized value. Fix this by initializing offset to zero. Fixes: efa29317a553 ("drm/xe/xe_late_bind_fw: Extract and print version info") Signed-off-by: Colin Ian King Reviewed-by: Badal Nilawar Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250924102208.9216-1-colin.i.king@gmail.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 20f3b28e2e07747fd27301f0f5deb3cb569ee15c) Signed-off-by: Lucas De Marchi commit 17f6f6f25a98f10e8ebe022b7412a030462e7d2e Author: Thomas Hellström Date: Mon Sep 29 13:26:49 2025 +0200 drm/xe/bo: Fix an idle assertion for local bos Before calling ttm_bo_populate() in the CPU fault path of a bo, we assert that the bo is not being migrated. However, for local bos we share the reservation object with other local bos that might be in the process of being migrated. Also some VM operations may attach USAGE_KERNEL fences to the common reservation object and trigger false positives from the assert. So remove the assert and instead wait for bo idle. This may unnecessarily wait for idle in some cases but since we're doing this wait later in the fault path anyway we might as well do it here as well. This fixes warnings like: Sep 25 14:56:23 desky kernel: ------------[ cut here ]------------ Sep 25 14:56:23 desky kernel: xe 0000:03:00.0: [drm] Assertion `dma_resv_test_signaled(tbo->base.resv, DMA_RESV_USAGE_KERNEL) || (tbo->ttm && ttm_tt_is_populated(tbo->ttm))` failed! platform: BATTLEMAGE subplatform: 1 graphics: Xe2_HPG 20.01 step A0 media: Xe2_HPM 13.01 step A1 Sep 25 14:56:23 desky kernel: WARNING: CPU: 6 PID: 24767 at drivers/gpu/drm/xe/xe_bo.c:1748 xe_bo_fault_migrate+0x1bb/0x300 [xe] Sep 25 14:56:23 desky kernel: Modules linked in: cpuid dm_crypt xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 bridge stp llc xfrm_user xfr> Sep 25 14:56:23 desky kernel: snd_soc_sdca snd_seq_midi prime_numbers coretemp snd_seq_midi_event drm_ttm_helper snd_hda_codec drm_buddy drm_exec snd_rawmidi snd_soc_core snd_hda_cor> Sep 25 14:56:23 desky kernel: CPU: 6 UID: 1000 PID: 24767 Comm: steamwebhelper Tainted: G U W 6.17.0-rc7+ #32 PREEMPT(voluntary) Sep 25 14:56:23 desky kernel: Tainted: [U]=USER, [W]=WARN Sep 25 14:56:23 desky kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D36/PRO Z690-P DDR4 (MS-7D36), BIOS A.A1 10/18/2022 Sep 25 14:56:23 desky kernel: RIP: 0010:xe_bo_fault_migrate+0x1bb/0x300 [xe] Sep 25 14:56:23 desky kernel: Code: fa 64 29 f9 48 c7 c7 40 e0 d3 c1 51 48 c7 c1 c0 e3 d3 c1 52 4c 8b 45 c0 41 50 44 8b 4d c8 4d 89 e0 48 8b 55 a8 e8 25 27 95 ef <0f> 0b 48 83 c4 40 4> Sep 25 14:56:23 desky kernel: RSP: 0000:ffffae1ca88c7b10 EFLAGS: 00010286 Sep 25 14:56:23 desky kernel: RAX: 0000000000000000 RBX: ffff8d7cfd7e6800 RCX: 0000000000000027 Sep 25 14:56:23 desky kernel: RDX: ffff8d845019cec8 RSI: 0000000000000001 RDI: ffff8d845019cec0 Sep 25 14:56:23 desky kernel: RBP: ffffae1ca88c7bc8 R08: 0000000000000000 R09: 0000000000000000 Sep 25 14:56:23 desky kernel: R10: 0000000000000000 R11: 0000000000000004 R12: ffffffffc1db1faa Sep 25 14:56:23 desky kernel: R13: ffffffffc1db2ab4 R14: 0000000000000001 R15: ffffae1ca88c7bd8 Sep 25 14:56:23 desky kernel: FS: 00007fb1baf31940(0000) GS:ffff8d849c870000(0000) knlGS:0000000000000000 Sep 25 14:56:23 desky kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Sep 25 14:56:23 desky kernel: CR2: 00007fb1b2860020 CR3: 00000001705a9004 CR4: 0000000000772ef0 Sep 25 14:56:23 desky kernel: PKRU: 55555558 Sep 25 14:56:23 desky kernel: Call Trace: Sep 25 14:56:23 desky kernel: Sep 25 14:56:23 desky kernel: xe_bo_cpu_fault_fastpath+0x11e/0x220 [xe] Sep 25 14:56:23 desky kernel: xe_bo_cpu_fault+0x84/0x410 [xe] Sep 25 14:56:23 desky kernel: ? __x64_sys_mmap+0x33/0x50 Sep 25 14:56:23 desky kernel: ? x64_sys_call+0x1b2e/0x20d0 Sep 25 14:56:23 desky kernel: ? do_syscall_64+0x9d/0x1f0 Sep 25 14:56:23 desky kernel: ? __check_object_size+0x4a/0x2e0 Sep 25 14:56:23 desky kernel: __do_fault+0x36/0x190 Sep 25 14:56:23 desky kernel: do_fault+0xcf/0x570 Sep 25 14:56:23 desky kernel: __handle_mm_fault+0x92b/0xfe0 Sep 25 14:56:23 desky kernel: ? ktime_get_mono_fast_ns+0x39/0xd0 Sep 25 14:56:23 desky kernel: handle_mm_fault+0x164/0x2c0 Sep 25 14:56:23 desky kernel: do_user_addr_fault+0x2cb/0x840 Sep 25 14:56:23 desky kernel: exc_page_fault+0x75/0x180 Sep 25 14:56:23 desky kernel: asm_exc_page_fault+0x27/0x30 Sep 25 14:56:23 desky kernel: RIP: 0033:0x7fb1bc388bb7 Sep 25 14:56:23 desky kernel: Code: 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 84 00 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7> Sep 25 14:56:23 desky kernel: RSP: 002b:00007ffd7814fad8 EFLAGS: 00010207 Sep 25 14:56:23 desky kernel: RAX: 00007fb1b2860000 RBX: 0000000000000690 RCX: 00007fb1b2860000 Sep 25 14:56:23 desky kernel: RDX: 00007fb1b2860610 RSI: 0000556eda79f4c0 RDI: 00007fb1b2860020 Sep 25 14:56:23 desky kernel: RBP: 00007ffd7814fb60 R08: 0000000000000000 R09: 000000012be0e000 Sep 25 14:56:23 desky kernel: R10: 00007fb1b2860000 R11: 0000000000000246 R12: 0000556edd39a240 Sep 25 14:56:23 desky kernel: R13: 00007fb1b2dcb010 R14: 0000556eda79f420 R15: 0000000000000000 Sep 25 14:56:23 desky kernel: Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5250 Fixes: c2ae94cf8cd8 ("drm/xe: Convert the CPU fault handler for exhaustive eviction") Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250929112649.6131-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 8f1756a7ea33b352a54e6f53d76c552b3a424187) Signed-off-by: Lucas De Marchi commit 3734c8184d71c946c4128ce44ca1767c084f2358 Author: Michal Wajdeczko Date: Sun Sep 28 19:48:11 2025 +0200 drm/xe/vf: Don't claim support for firmware late-bind if VF In general, the VFs can't load firmwares so attempt to initialize the firmware late-bind component leads to errors like: [] xe 0000:03:00.1: [drm] *ERROR* Late bind component not bound Fixes: 918bd789d62e ("drm/xe/xe_late_bind_fw: Introduce xe_late_bind_fw") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6190 Signed-off-by: Michal Wajdeczko Cc: Badal Nilawar Reviewed-by: Piotr Piórkowski Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250928174811.198933-3-michal.wajdeczko@intel.com (cherry picked from commit e35e288090f362be88d77b60d9846cea15df173e) Signed-off-by: Lucas De Marchi commit de61d5944c87d21e5692823f30fb61c95df300bf Author: Michal Wajdeczko Date: Sun Sep 28 19:48:10 2025 +0200 drm/xe/vf: Rename sriov_update_device_info This is a VF only function and its name should reflect that to avoid any confusion. Move the VF check to the caller side. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250928174811.198933-2-michal.wajdeczko@intel.com (cherry picked from commit b88bb1eefa88f0cefc00fe5e78b1186cd8f9db78) Signed-off-by: Lucas De Marchi commit 59b7ed0ba2e0fc18dda19a2c48eea2c3cef652f3 Author: Lucas De Marchi Date: Wed Sep 24 08:27:11 2025 -0700 drm/xe/configfs: Improve doc for ctx_restore* attributes Spell out the syntax instead of only using examples. Particularly important the part since that's different than engines_allowed and may confuse users. The same batch buffer is used for all engines of a certain class. Cc: Raag Jadav Reviewed-by: Raag Jadav Reviewed-by: Jonathan Cavitt Fixes: e2a9854d806e ("drm/xe/configfs: Allow to select by class only") Link: https://lore.kernel.org/r/20250924152709.659483-4-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 47ca7acff4011fa322853a3612f464b959e88210) Signed-off-by: Lucas De Marchi commit 7646423c7ff14156f5c163e995ba896ea9a0d559 Author: Lucas De Marchi Date: Wed Sep 24 08:27:10 2025 -0700 drm/xe/configfs: Fix engine class parsing If mask is NULL, only the engine class should be accepted, so the pattern string should be completely parsed. This should fix passing e.g. rcs0 to ctx_restore_post_bb when it's only expecting the engine class. Reported-by: Jonathan Cavitt Closes: https://lore.kernel.org/r/20250922155544.67712-1-jonathan.cavitt@intel.com Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aNJKnrCQmL9xS9Gv@stanley.mountain Fixes: e2a9854d806e ("drm/xe/configfs: Allow to select by class only") Reviewed-by: Jonathan Cavitt Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250924152709.659483-3-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit dd797967160b79cc0ca2d2eb05fc55436b66dce0) Signed-off-by: Lucas De Marchi commit 7bd03e3914f15720f8385d58bef0f1849df659e1 Author: Michal Wajdeczko Date: Mon Sep 22 12:12:07 2025 +0200 drm/xe/tests: Fix build break on clang 16.0.6 The following error was reported when building with clang 16.0.6: In file included from drivers/gpu/drm/xe/xe_pci.c:1104: >> drivers/gpu/drm/xe/tests/xe_pci.c:214:2: error: initializer \ element is not a compile-time constant graphics_ip_xelp, ^~~~~~~~~~~~~~~~ drivers/gpu/drm/xe/tests/xe_pci.c:221:2: error: initializer \ element is not a compile-time constant media_ip_xem, ^~~~~~~~~~~~ 2 errors generated. Fix that by explicit re-definition of pre-GMDID IPs, as there are not so many of them. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509192041.tQwdE4DS-lkp@intel.com/ Fixes: 5bb5258e357e ("drm/xe/tests: Add pre-GMDID IP descriptors to param generators") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Nathan Chancellor Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250922101207.192028-1-michal.wajdeczko@intel.com (cherry picked from commit 2de80e2da74b402a9d838b8e729cd01cf94cdcbc) Signed-off-by: Lucas De Marchi commit 4e715744bf7b4e5521cc3b77f310060f862cb719 Author: Jaegeuk Kim Date: Thu Oct 2 01:55:32 2025 +0000 f2fs: add missing dput() when printing the donation list We missed to call dput() on the grabbed dentry. Fixes: f1a49c1b112b ("f2fs: show the list of donation files") Reviewed-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e406d57be7bd2a4e73ea512c1ae36a40a44e499e Merge: 8804d970fab457 9f1c14c1de1bdd Author: Linus Torvalds Date: Thu Oct 2 18:44:54 2025 -0700 Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "ida: Remove the ida_simple_xxx() API" from Christophe Jaillet completes the removal of this legacy IDR API - "panic: introduce panic status function family" from Jinchao Wang provides a number of cleanups to the panic code and its various helpers, which were rather ad-hoc and scattered all over the place - "tools/delaytop: implement real-time keyboard interaction support" from Fan Yu adds a few nice user-facing usability changes to the delaytop monitoring tool - "efi: Fix EFI boot with kexec handover (KHO)" from Evangelos Petrongonas fixes a panic which was happening with the combination of EFI and KHO - "Squashfs: performance improvement and a sanity check" from Phillip Lougher teaches squashfs's lseek() about SEEK_DATA/SEEK_HOLE. A mere 150x speedup was measured for a well-chosen microbenchmark - plus another 50-odd singleton patches all over the place * tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (75 commits) Squashfs: reject negative file sizes in squashfs_read_inode() kallsyms: use kmalloc_array() instead of kmalloc() MAINTAINERS: update Sibi Sankar's email address Squashfs: add SEEK_DATA/SEEK_HOLE support Squashfs: add additional inode sanity checking lib/genalloc: fix device leak in of_gen_pool_get() panic: remove CONFIG_PANIC_ON_OOPS_VALUE ocfs2: fix double free in user_cluster_connect() checkpatch: suppress strscpy warnings for userspace tools cramfs: fix incorrect physical page address calculation kernel: prevent prctl(PR_SET_PDEATHSIG) from racing with parent process exit Squashfs: fix uninit-value in squashfs_get_parent kho: only fill kimage if KHO is finalized ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name() kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths sched/task.h: fix the wrong comment on task_lock() nesting with tasklist_lock coccinelle: platform_no_drv_owner: handle also built-in drivers coccinelle: of_table: handle SPI device ID tables lib/decompress: use designated initializers for struct compress_format efi: support booting with kexec handover (KHO) ... commit 8804d970fab45726b3c7cd7f240b31122aa94219 Merge: 24d9e8b3c9c8a6 1367da7eb875d0 Author: Linus Torvalds Date: Thu Oct 2 18:18:33 2025 -0700 Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "mm, swap: improve cluster scan strategy" from Kairui Song improves performance and reduces the failure rate of swap cluster allocation - "support large align and nid in Rust allocators" from Vitaly Wool permits Rust allocators to set NUMA node and large alignment when perforning slub and vmalloc reallocs - "mm/damon/vaddr: support stat-purpose DAMOS" from Yueyang Pan extend DAMOS_STAT's handling of the DAMON operations sets for virtual address spaces for ops-level DAMOS filters - "execute PROCMAP_QUERY ioctl under per-vma lock" from Suren Baghdasaryan reduces mmap_lock contention during reads of /proc/pid/maps - "mm/mincore: minor clean up for swap cache checking" from Kairui Song performs some cleanup in the swap code - "mm: vm_normal_page*() improvements" from David Hildenbrand provides code cleanup in the pagemap code - "add persistent huge zero folio support" from Pankaj Raghav provides a block layer speedup by optionalls making the huge_zero_pagepersistent, instead of releasing it when its refcount falls to zero - "kho: fixes and cleanups" from Mike Rapoport adds a few touchups to the recently added Kexec Handover feature - "mm: make mm->flags a bitmap and 64-bit on all arches" from Lorenzo Stoakes turns mm_struct.flags into a bitmap. To end the constant struggle with space shortage on 32-bit conflicting with 64-bit's needs - "mm/swapfile.c and swap.h cleanup" from Chris Li cleans up some swap code - "selftests/mm: Fix false positives and skip unsupported tests" from Donet Tom fixes a few things in our selftests code - "prctl: extend PR_SET_THP_DISABLE to only provide THPs when advised" from David Hildenbrand "allows individual processes to opt-out of THP=always into THP=madvise, without affecting other workloads on the system". It's a long story - the [1/N] changelog spells out the considerations - "Add and use memdesc_flags_t" from Matthew Wilcox gets us started on the memdesc project. Please see https://kernelnewbies.org/MatthewWilcox/Memdescs and https://blogs.oracle.com/linux/post/introducing-memdesc - "Tiny optimization for large read operations" from Chi Zhiling improves the efficiency of the pagecache read path - "Better split_huge_page_test result check" from Zi Yan improves our folio splitting selftest code - "test that rmap behaves as expected" from Wei Yang adds some rmap selftests - "remove write_cache_pages()" from Christoph Hellwig removes that function and converts its two remaining callers - "selftests/mm: uffd-stress fixes" from Dev Jain fixes some UFFD selftests issues - "introduce kernel file mapped folios" from Boris Burkov introduces the concept of "kernel file pages". Using these permits btrfs to account its metadata pages to the root cgroup, rather than to the cgroups of random inappropriate tasks - "mm/pageblock: improve readability of some pageblock handling" from Wei Yang provides some readability improvements to the page allocator code - "mm/damon: support ARM32 with LPAE" from SeongJae Park teaches DAMON to understand arm32 highmem - "tools: testing: Use existing atomic.h for vma/maple tests" from Brendan Jackman performs some code cleanups and deduplication under tools/testing/ - "maple_tree: Fix testing for 32bit compiles" from Liam Howlett fixes a couple of 32-bit issues in tools/testing/radix-tree.c - "kasan: unify kasan_enabled() and remove arch-specific implementations" from Sabyrzhan Tasbolatov moves KASAN arch-specific initialization code into a common arch-neutral implementation - "mm: remove zpool" from Johannes Weiner removes zspool - an indirection layer which now only redirects to a single thing (zsmalloc) - "mm: task_stack: Stack handling cleanups" from Pasha Tatashin makes a couple of cleanups in the fork code - "mm: remove nth_page()" from David Hildenbrand makes rather a lot of adjustments at various nth_page() callsites, eventually permitting the removal of that undesirable helper function - "introduce kasan.write_only option in hw-tags" from Yeoreum Yun creates a KASAN read-only mode for ARM, using that architecture's memory tagging feature. It is felt that a read-only mode KASAN is suitable for use in production systems rather than debug-only - "mm: hugetlb: cleanup hugetlb folio allocation" from Kefeng Wang does some tidying in the hugetlb folio allocation code - "mm: establish const-correctness for pointer parameters" from Max Kellermann makes quite a number of the MM API functions more accurate about the constness of their arguments. This was getting in the way of subsystems (in this case CEPH) when they attempt to improving their own const/non-const accuracy - "Cleanup free_pages() misuse" from Vishal Moola fixes a number of code sites which were confused over when to use free_pages() vs __free_pages() - "Add Rust abstraction for Maple Trees" from Alice Ryhl makes the mapletree code accessible to Rust. Required by nouveau and by its forthcoming successor: the new Rust Nova driver - "selftests/mm: split_huge_page_test: split_pte_mapped_thp improvements" from David Hildenbrand adds a fix and some cleanups to the thp selftesting code - "mm, swap: introduce swap table as swap cache (phase I)" from Chris Li and Kairui Song is the first step along the path to implementing "swap tables" - a new approach to swap allocation and state tracking which is expected to yield speed and space improvements. This patchset itself yields a 5-20% performance benefit in some situations - "Some ptdesc cleanups" from Matthew Wilcox utilizes the new memdesc layer to clean up the ptdesc code a little - "Fix va_high_addr_switch.sh test failure" from Chunyu Hu fixes some issues in our 5-level pagetable selftesting code - "Minor fixes for memory allocation profiling" from Suren Baghdasaryan addresses a couple of minor issues in relatively new memory allocation profiling feature - "Small cleanups" from Matthew Wilcox has a few cleanups in preparation for more memdesc work - "mm/damon: add addr_unit for DAMON_LRU_SORT and DAMON_RECLAIM" from Quanmin Yan makes some changes to DAMON in furtherance of supporting arm highmem - "selftests/mm: Add -Wunreachable-code and fix warnings" from Muhammad Anjum adds that compiler check to selftests code and fixes the fallout, by removing dead code - "Improvements to Victim Process Thawing and OOM Reaper Traversal Order" from zhongjinji makes a number of improvements in the OOM killer: mainly thawing a more appropriate group of victim threads so they can release resources - "mm/damon: misc fixups and improvements for 6.18" from SeongJae Park is a bunch of small and unrelated fixups for DAMON - "mm/damon: define and use DAMON initialization check function" from SeongJae Park implement reliability and maintainability improvements to a recently-added bug fix - "mm/damon/stat: expose auto-tuned intervals and non-idle ages" from SeongJae Park provides additional transparency to userspace clients of the DAMON_STAT information - "Expand scope of khugepaged anonymous collapse" from Dev Jain removes some constraints on khubepaged's collapsing of anon VMAs. It also increases the success rate of MADV_COLLAPSE against an anon vma - "mm: do not assume file == vma->vm_file in compat_vma_mmap_prepare()" from Lorenzo Stoakes moves us further towards removal of file_operations.mmap(). This patchset concentrates upon clearing up the treatment of stacked filesystems - "mm: Improve mlock tracking for large folios" from Kiryl Shutsemau provides some fixes and improvements to mlock's tracking of large folios. /proc/meminfo's "Mlocked" field became more accurate - "mm/ksm: Fix incorrect accounting of KSM counters during fork" from Donet Tom fixes several user-visible KSM stats inaccuracies across forks and adds selftest code to verify these counters - "mm_slot: fix the usage of mm_slot_entry" from Wei Yang addresses some potential but presently benign issues in KSM's mm_slot handling * tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (372 commits) mm: swap: check for stable address space before operating on the VMA mm: convert folio_page() back to a macro mm/khugepaged: use start_addr/addr for improved readability hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list alloc_tag: fix boot failure due to NULL pointer dereference mm: silence data-race in update_hiwater_rss mm/memory-failure: don't select MEMORY_ISOLATION mm/khugepaged: remove definition of struct khugepaged_mm_slot mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL hugetlb: increase number of reserving hugepages via cmdline selftests/mm: add fork inheritance test for ksm_merging_pages counter mm/ksm: fix incorrect KSM counter handling in mm_struct during fork drivers/base/node: fix double free in register_one_node() mm: remove PMD alignment constraint in execmem_vmalloc() mm/memory_hotplug: fix typo 'esecially' -> 'especially' mm/rmap: improve mlock tracking for large folios mm/filemap: map entire large folio faultaround mm/fault: try to map the entire file folio in finish_fault() mm/rmap: mlock large folios in try_to_unmap_one() mm/rmap: fix a mlock race condition in folio_referenced_one() ... commit 24d9e8b3c9c8a6f72c8b4c196a703e144928d919 Merge: 07fdad3a93756b ca74b8cadaad4b Author: Linus Torvalds Date: Thu Oct 2 15:58:05 2025 -0700 Merge tag 'slab-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - A new layer for caching objects for allocation and free via percpu arrays called sheaves. The aim is to combine the good parts of SLAB (lower-overhead and simpler percpu caching, compared to SLUB) without the past issues with arrays for freeing remote NUMA node objects and their flushing. It also allows more efficient kfree_rcu(), and cheaper object preallocations for cases where the exact number of objects is unknown, but an upper bound is. Currently VMAs and maple nodes are using this new caching, with a plan to enable it for all caches and remove the complex SLUB fastpath based on cpu (partial) slabs and this_cpu_cmpxchg_double(). (Vlastimil Babka, with Liam Howlett and Pedro Falcato for the maple tree changes) - Re-entrant kmalloc_nolock(), which allows opportunistic allocations from NMI and tracing/kprobe contexts. Building on prior page allocator and memcg changes, it will result in removing BPF-specific caches on top of slab (Alexei Starovoitov) - Various fixes and cleanups. (Kuan-Wei Chiu, Matthew Wilcox, Suren Baghdasaryan, Ye Liu) * tag 'slab-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (40 commits) slab: Introduce kmalloc_nolock() and kfree_nolock(). slab: Reuse first bit for OBJEXTS_ALLOC_FAIL slab: Make slub local_(try)lock more precise for LOCKDEP mm: Introduce alloc_frozen_pages_nolock() mm: Allow GFP_ACCOUNT to be used in alloc_pages_nolock(). locking/local_lock: Introduce local_lock_is_locked(). maple_tree: Convert forking to use the sheaf interface maple_tree: Add single node allocation support to maple state maple_tree: Prefilled sheaf conversion and testing tools/testing: Add support for prefilled slab sheafs maple_tree: Replace mt_free_one() with kfree() maple_tree: Use kfree_rcu in ma_free_rcu testing/radix-tree/maple: Hack around kfree_rcu not existing tools/testing: include maple-shim.c in maple.c maple_tree: use percpu sheaves for maple_node_cache mm, vma: use percpu sheaves for vm_area_struct cache tools/testing: Add support for changes to slab for sheaves slab: allow NUMA restricted allocations to use percpu sheaves tools/testing/vma: Implement vm_refcnt reset slab: skip percpu sheaves for remote object freeing ... commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 Merge: f79e772258df31 f1455695d2d998 Author: Linus Torvalds Date: Thu Oct 2 15:17:01 2025 -0700 Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core & protocols: - Improve drop account scalability on NUMA hosts for RAW and UDP sockets and the backlog, almost doubling the Pps capacity under DoS - Optimize the UDP RX performance under stress, reducing contention, revisiting the binary layout of the involved data structs and implementing NUMA-aware locking. This improves UDP RX performance by an additional 50%, even more under extreme conditions - Add support for PSP encryption of TCP connections; this mechanism has some similarities with IPsec and TLS, but offers superior HW offloads capabilities - Ongoing work to support Accurate ECN for TCP. AccECN allows more than one congestion notification signal per RTT and is a building block for Low Latency, Low Loss, and Scalable Throughput (L4S) - Reorganize the TCP socket binary layout for data locality, reducing the number of touched cachelines in the fastpath - Refactor skb deferral free to better scale on large multi-NUMA hosts, this improves TCP and UDP RX performances significantly on such HW - Increase the default socket memory buffer limits from 256K to 4M to better fit modern link speeds - Improve handling of setups with a large number of nexthop, making dump operating scaling linearly and avoiding unneeded synchronize_rcu() on delete - Improve bridge handling of VLAN FDB, storing a single entry per bridge instead of one entry per port; this makes the dump order of magnitude faster on large switches - Restore IP ID correctly for encapsulated packets at GSO segmentation time, allowing GRO to merge packets in more scenarios - Improve netfilter matching performance on large sets - Improve MPTCP receive path performance by leveraging recently introduced core infrastructure (skb deferral free) and adopting recent TCP autotuning changes - Allow bridges to redirect to a backup port when the bridge port is administratively down - Introduce MPTCP 'laminar' endpoint that con be used only once per connection and simplify common MPTCP setups - Add RCU safety to dst->dev, closing a lot of possible races - A significant crypto library API for SCTP, MPTCP and IPv6 SR, reducing code duplication - Supports pulling data from an skb frag into the linear area of an XDP buffer Things we sprinkled into general kernel code: - Generate netlink documentation from YAML using an integrated YAML parser Driver API: - Support using IPv6 Flow Label in Rx hash computation and RSS queue selection - Introduce API for fetching the DMA device for a given queue, allowing TCP zerocopy RX on more H/W setups - Make XDP helpers compatible with unreadable memory, allowing more easily building DevMem-enabled drivers with a unified XDP/skbs datapath - Add a new dedicated ethtool callback enabling drivers to provide the number of RX rings directly, improving efficiency and clarity in RX ring queries and RSS configuration - Introduce a burst period for the health reporter, allowing better handling of multiple errors due to the same root cause - Support for DPLL phase offset exponential moving average, controlling the average smoothing factor Device drivers: - Add a new Huawei driver for 3rd gen NIC (hinic3) - Add a new SpacemiT driver for K1 ethernet MAC - Add a generic abstraction for shared memory communication devices (dibps) - Ethernet high-speed NICs: - nVidia/Mellanox: - Use multiple per-queue doorbell, to avoid MMIO contention issues - support adjacent functions, allowing them to delegate their SR-IOV VFs to sibling PFs - support RSS for IPSec offload - support exposing raw cycle counters in PTP and mlx5 - support for disabling host PFs. - Intel (100G, ice, idpf): - ice: support for SRIOV VFs over an Active-Active link aggregate - ice: support for firmware logging via debugfs - ice: support for Earliest TxTime First (ETF) hardware offload - idpf: support basic XDP functionalities and XSk - Broadcom (bnxt): - support Hyper-V VF ID - dynamic SRIOV resource allocations for RoCE - Meta (fbnic): - support queue API, zero-copy Rx and Tx - support basic XDP functionalities - devlink health support for FW crashes and OTP mem corruptions - expand hardware stats coverage to FEC, PHY, and Pause - Wangxun: - support ethtool coalesce options - support for multiple RSS contexts - Ethernet virtual: - Macsec: - replace custom netlink attribute checks with policy-level checks - Bonding: - support aggregator selection based on port priority - Microsoft vNIC: - use page pool fragments for RX buffers instead of full pages to improve memory efficiency - Ethernet NICs consumer, and embedded: - Qualcomm: support Ethernet function for IPQ9574 SoC - Airoha: implement wlan offloading via NPU - Freescale - enetc: add NETC timer PTP driver and add PTP support - fec: enable the Jumbo frame support for i.MX8QM - Renesas (R-Car S4): - support HW offloading for layer 2 switching - support for RZ/{T2H, N2H} SoCs - Cadence (macb): support TAPRIO traffic scheduling - TI: - support for Gigabit ICSS ethernet SoC (icssm-prueth) - Synopsys (stmmac): a lot of cleanups - Ethernet PHYs: - Support 10g-qxgmi phy-mode for AQR412C, Felix DSA and Lynx PCS driver - Support bcm63268 GPHY power control - Support for Micrel lan8842 PHY and PTP - Support for Aquantia AQR412 and AQR115 - CAN: - a large CAN-XL preparation work - reorganize raw_sock and uniqframe struct to minimize memory usage - rcar_canfd: update the CAN-FD handling - WiFi: - extended Neighbor Awareness Networking (NAN) support - S1G channel representation cleanup - improve S1G support - WiFi drivers: - Intel (iwlwifi): - major refactor and cleanup - Broadcom (brcm80211): - support for AP isolation - RealTek (rtw88/89) rtw88/89: - preparation work for RTL8922DE support - MediaTek (mt76): - HW restart improvements - MLO support - Qualcomm/Atheros (ath10k): - GTK rekey fixes - Bluetooth drivers: - btusb: support for several new IDs for MT7925 - btintel: support for BlazarIW core - btintel_pcie: support for _suspend() / _resume() - btintel_pcie: support for Scorpious, Panther Lake-H484 IDs" * tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1536 commits) net: stmmac: Add support for Allwinner A523 GMAC200 dt-bindings: net: sun8i-emac: Add A523 GMAC200 compatible Revert "Documentation: net: add flow control guide and document ethtool API" octeontx2-pf: fix bitmap leak octeontx2-vf: fix bitmap leak net/mlx5e: Use extack in set rxfh callback net/mlx5e: Introduce mlx5e_rss_params for RSS configuration net/mlx5e: Introduce mlx5e_rss_init_params net/mlx5e: Remove unused mdev param from RSS indir init net/mlx5: Improve QoS error messages with actual depth values net/mlx5e: Prevent entering switchdev mode with inconsistent netns net/mlx5: HWS, Generalize complex matchers net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs selftests/net: add tcp_port_share to .gitignore Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" net: add NUMA awareness to skb_attempt_defer_free() net: use llist for sd->defer_list net: make softnet_data.defer_count an atomic selftests: drv-net: psp: add tests for destroying devices selftests: drv-net: psp: add test for auto-adjusting TCP MSS ... commit 63d2247e2e37d9c589a0a26aa4e684f736a45e29 Author: Tony Ambardar Date: Thu Oct 2 13:31:50 2025 -0700 libbpf: Fix missing #pragma in libbpf_utils.c The recent sha256 patch uses a GCC pragma to suppress compile errors for a packed struct, but omits a needed pragma (see related link) and thus still raises errors: (e.g. on GCC 12.3 armhf) libbpf_utils.c:153:29: error: packed attribute causes inefficient alignment for ‘__val’ [-Werror=attributes] 153 | struct __packed_u32 { __u32 __val; } __attribute__((packed)); | ^~~~~ Resolve by adding the GCC diagnostic pragma to ignore "-Wattributes". Link: https://lore.kernel.org/bpf/CAP-5=fXURWoZu2j6Y8xQy23i7=DfgThq3WC1RkGFBx-4moQKYQ@mail.gmail.com/ Fixes: 4a1c9e544b8d ("libbpf: remove linux/unaligned.h dependency for libbpf_sha256()") Signed-off-by: Tony Ambardar Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 510d76646a6a7beaa49fc0da7282e285a3dfce97 Author: Tang Yizhou Date: Tue Sep 23 19:21:36 2025 +0800 block: Update a comment of disk statistics >From commit 074a7aca7afa ("block: move stats from disk to part0"), we know that: * {disk|all}_stat_*() are gone. * disk_stat_lock/unlock() are renamed to part_stat_lock/unlock(). Therefore, outdated comments should be updated accordingly. Fixes: 074a7aca7afa ("block: move stats from disk to part0") Signed-off-by: Tang Yizhou Signed-off-by: Jens Axboe commit 98b7bf54338b797e3a11e8178ce0e806060d8fa3 Author: Li Chen Date: Tue Sep 30 08:35:59 2025 +0800 loop: fix backing file reference leak on validation error loop_change_fd() and loop_configure() call loop_check_backing_file() to validate the new backing file. If validation fails, the reference acquired by fget() was not dropped, leaking a file reference. Fix this by calling fput(file) before returning the error. Cc: stable@vger.kernel.org Cc: Markus Elfring CC: Yang Erkun Cc: Ming Lei Cc: Yu Kuai Fixes: f5c84eff634b ("loop: Add sanity check for read/write_iter") Signed-off-by: Li Chen Reviewed-by: Ming Lei Reviewed-by: Yang Erkun Signed-off-by: Jens Axboe commit b595edcb24727e7f93e7962c3f6f971cc16dd29e Author: Roman Kisel Date: Wed Oct 1 16:08:46 2025 -0700 hyperv: Remove the spurious null directive line The file contains a line that consists of the lone # symbol followed by a newline. While that is a valid syntax as defined by the C99+ grammar (6.10.7 "Null directive"), it serves no apparent purpose in this case. Remove the null preprocessor directive. No functional changes. Fixes: e68bda71a238 ("hyperv: Add new Hyper-V headers in include/hyperv") Signed-off-by: Roman Kisel Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu commit 020b4e86834f7a35e9986cacd10eb0202d8faa08 Author: Prasanna Kumar T S M Date: Wed Sep 17 07:03:24 2025 -0700 MAINTAINERS: Mark hyperv_fb driver Obsolete The hyperv_fb driver is deprecated in favor of Hyper-V DRM driver. Split the hyperv_fb entry from the hyperv drivers list, mark it obsolete. Signed-off-by: Prasanna Kumar T S M Reviewed-by: Saurabh Sengar Reviewed-by: Michael Kelley Acked-by: Thomas Zimmermann Signed-off-by: Wei Liu commit 34b4620349fe4776babf9c735e1c68e620784763 Author: Prasanna Kumar T S M Date: Thu Oct 2 21:10:36 2025 +0000 fbdev/hyperv_fb: deprecate this in favor of Hyper-V DRM driver The Hyper-V DRM driver is available since kernel version 5.14 and it provides full KMS support and fbdev emulation via the DRM fbdev helpers. Deprecate this driver in favor of Hyper-V DRM driver. Signed-off-by: Prasanna Kumar T S M Acked-by: Thomas Zimmermann Reviewed-by: Michael Kelley Reviewed-by: Saurabh Sengar Signed-off-by: Wei Liu commit 2ce61c63e7459058709f12f43a8a98c500382382 Author: Eduard Zingerman Date: Thu Oct 2 12:11:40 2025 -0700 selftests/bpf: Add tests for rejection of ALU ops with negative offsets Define a simple program using MOD, DIV, ADD instructions, make sure that the program is rejected if invalid offset field is used for instruction. These are test cases for commit 55c0ced59fe1 ("bpf: Reject negative offsets for ALU ops") Link: https://lore.kernel.org/all/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com/ Signed-off-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov commit f79e772258df311c2cb21594ca0996318e720d28 Merge: 58809f614e0e3f afb100a5ea7a13 Author: Linus Torvalds Date: Thu Oct 2 13:13:26 2025 -0700 Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Added a new V4L2 clock helper - New camera sensor drivers - iris: Enable H.264/H.265 encoder support and fixes in iris driver common code - camss: add support for new SoC flavors - venus: add new SoC support - tc358743: support more infoframe types - Various fixes, driver improvements and cleanups * tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (439 commits) media: venus: pm_helpers: add fallback for the opp-table media: qcom: camss: vfe: Fix BPL alignment for QCM2290 media: tuner: xc5000: Fix use-after-free in xc5000_release media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove media: vsp1: Export missing vsp1_isp_free_buffer symbol media: renesas: vsp1: Convert to SYSTEM_SLEEP/RUNTIME_PM_OPS() media: renesas: ceu: Convert to RUNTIME_PM_OPS() media: renesas: fdp1: Convert to RUNTIME_PM_OPS() media: renesas: rcar-vin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: renesas: rcar_drif: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls media: uvcvideo: Shorten the transfer size non compliance message media: uvcvideo: Do not re-reference dev->udev media: uvcvideo: Use intf instead of udev for printks media: uvcvideo: Move video_device under video_queue media: uvcvideo: Drop stream->mutex media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header ... commit c8fee6a7c5cbde4908804aafc469391c22e72be9 Author: Thomas Zimmermann Date: Wed Sep 24 10:33:40 2025 +0200 fbdev: Make drivers depend on LCD_CLASS_DEVICE LCD_CLASS_DEVICE is the user-controlled option that enables the LCD display subsystem. Do not select it from fbdev drivers. Selecting it from drivers can lead to cyclic dependencies within the config. Some guidelines for using select can be found in the kernel docs at [1]. Signed-off-by: Thomas Zimmermann Link: https://elixir.bootlin.com/linux/v6.16/source/Documentation/kbuild/kconfig-language.rst#L147 # [1] Signed-off-by: Helge Deller commit c3073f1da0517b63cf3e561d79c346e15bd8c5a8 Author: Sukrut Heroorkar Date: Tue Sep 23 19:14:04 2025 +0200 fbdev: radeonfb: Remove stale product link in Kconfig The product page referenced in the FB_RADEON is no longer valid. Remove it to avoid pointing to an invalid link. Signed-off-by: Sukrut Heroorkar Acked-by: Alex Deucher Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 9d079868ae4b519ab925296337050fd1f2a20720 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:15 2025 +0700 Documentation: fb: Retitle driver docs Many framebuffer driver docs are copied from vesafb docs as their template, including "What is " title. Such title implies the introductory section, however, and not the whole docs. Retitle them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 9070fbcb9af5dd351628d030973a143f9e1b0ed4 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:14 2025 +0700 Documentation: fb: ep93xx: Demote section headings Section headings are formatted the same as title heading, thus increasing number of entries in framebuffer toctree. Demote them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 7a6e249f90fd8d3fcaa8c497bc72c8e61b988bf0 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:16 2025 +0700 Documentation: fb: Split toctree Framebuffer docs toctree consists of driver-independent docs (e.g. API docs) and driver-specific docs. The latter has much more entries. Group the docs into separate toctrees. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 58809f614e0e3f4e12b489bddf680bfeb31c0a20 Merge: 05a54fa773284d b2ec5ca9d5c2c0 Author: Linus Torvalds Date: Thu Oct 2 12:47:25 2025 -0700 Merge tag 'drm-next-2025-10-01' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "cross-subsystem: - i2c-hid: Make elan touch controllers power on after panel is enabled - dt bindings for STM32MP25 SoC - pci vgaarb: use screen_info helpers - rust pin-init updates - add MEI driver for late binding firmware update/load uapi: - add ioctl for reassigning GEM handles - provide boot_display attribute on boot-up devices core: - document DRM_MODE_PAGE_FLIP_EVENT - add vendor specific recovery method to drm device wedged uevent gem: - Simplify gpuvm locking ttm: - add interface to populate buffers sched: - Fix race condition in trace code atomic: - Reallow no-op async page flips display: - dp: Fix command length video: - Improve pixel-format handling for struct screen_info rust: - drop Opaque<> from ioctl args - Alloc: - BorrowedPage type and AsPageIter traits - Implement Vmalloc::to_page() and VmallocPageIter - DMA/Scatterlist: - Add dma::DataDirection and type alias for dma_addr_t - Abstraction for struct scatterlist and sg_table - DRM: - simplify use of generics - add DriverFile type alias - drop Object::SIZE - Rust: - pin-init tree merge - Various methods for AsBytes and FromBytes traits gpuvm: - Support madvice in Xe driver gpusvm: - fix hmm_pfn_to_map_order usage in gpusvm bridge: - Improve and fix ref counting on bridge management - cdns-dsi: Various improvements to mode setting - Support Solomon SSD2825 plus DT bindings - Support Waveshare DSI2DPI plus DT bindings - Support Content Protection property - display-connector: Improve DP display detection - Add support for Radxa Ra620 plus DT bindings - adv7511: Provide SPD and HDMI infoframes - it6505: Replace crypto_shash with sha() - synopsys: Add support for DW DPTX Controller plus DT bindings - adv7511: Write full Audio infoframe - ite6263: Support vendor-specific infoframes - simple: Add support for Realtek RTD2171 DP-to-HDMI plus DT bindings panel: - panel-edp: Support mt8189 Chromebooks; Support BOE NV140WUM-N64; Support SHP LQ134Z1; Fixes - panel-simple: Support Olimex LCD-OLinuXino-5CTS plus DT bindings - Support Samsung AMS561RA01 - Support Hydis HV101HD1 plus DT bindings - ilitek-ili9881c: Refactor mode setting; Add support for Bestar BSD1218-A101KL68 LCD plus DT bindings - lvds: Add support for Ampire AMP19201200B5TZQW-T03 to DT bindings - edp: Add support for additonal mt8189 Chromebook panels - lvds: Add DT bindings for EDT ETML0700Z8DHA amdgpu: - add CRIU support for gem objects - RAS updates - VCN SRAM load fixes - EDID read fixes - eDP ALPM support - Documentation updates - Rework PTE flag generation - DCE6 fixes - VCN devcoredump cleanup - MMHUB client id fixes - VCN 5.0.1 RAS support - SMU 13.0.x updates - Expanded PCIe DPC support - Expanded VCN reset support - VPE per queue reset support - give kernel jobs unique id for tracing - pre-populate exported buffers - cyan skillfish updates - make vbios build number available in sysfs - userq updates - HDCP updates - support MMIO remap page as ttm pool - JPEG parser updates - DCE6 DC updates - use devm for i2c buses - GPUVM locking updates - Drop non-DC DCE11 code - improve fallback handling for pixel encoding amdkfd: - SVM/page migration fixes - debugfs fixes - add CRIO support for gem objects - SVM updates radeon: - use dev_warn_once in CS parsers xe: - add madvise interface - add DRM_IOCTL_XE_VM_QUERY_MEMORY_RANGE_ATTRS to query VMA count and memory attributes - drop L# bank mask reporting from media GT3 on Xe3+. - add SLPC power_profile sysfs interface - add configs attribs to add post/mid context-switch commands - handle firmware reported hardware errors notifying userspace with device wedged uevent - use same dir structure across sysfs/debugfs - cleanup and future proof vram region init - add G-states and PCI link states to debugfs - Add SRIOV support for CCS surfaces on Xe2+ - Enable SRIOV PF mode by default on supported platforms - move flush to common code - extended core workarounds for Xe2/3 - use DRM scheduler for delayed GT TLB invalidations - configs improvements and allow VF device enablement - prep work to expose mmio regions to userspace - VF migration support added - prepare GPU SVM for THP migration - start fixing XE_PAGE_SIZE vs PAGE_SIZE - add PSMI support for hw validation - resize VF bars to max possible size according to number of VFs - Ensure GT is in C0 during resume - pre-populate exported buffers - replace xe_hmm with gpusvm - add more SVM GT stats to debugfs - improve fake pci and WA kunnit handle for new platform testing - Test GuC to GuC comms to add debugging - use attribute groups to simplify sysfs registration - add Late Binding firmware code to interact with MEI i915: - apply multiple JSL/EHL/Gen7/Gen6 workarounds properly - protect against overflow in active_engine() - Use try_cmpxchg64() in __active_lookup() - include GuC registers in error state - get rid of dev->struct_mutex - iopoll: generalize read_poll_timout - lots more display refactoring - Reject HBR3 in any eDP Panel - Prune modes for YUV420 - Display Wa fix, additions, and updates - DP: Fix 2.7 Gbps link training on g4x - DP: Adjust the idle pattern handling - DP: Shuffle the link training code a bit - Don't set/read the DSI C clock divider on GLK - Enable_psr kernel parameter changes - Type-C enabled/disconnected dp-alt sink - Wildcat Lake enabling - DP HDR updates - DRAM detection - wait PSR idle on dsb commit - Remove FBC modulo 4 restriction for ADL-P+ - panic: refactor framebuffer allocation habanalabs: - debug/visibility improvements - vmalloc-backed coherent mmap support - HLDIO infrastructure nova-core: - various register!() macro improvements - minor vbios/firmware fixes/refactoring - advance firmware boot stages; process Booter and patch signatures - process GSP and GSP bootloader - Add r570.144 firmware bindings and update to it - Move GSP boot code to own module - Use new pin-init features to store driver's private data in a single allocation - Update ARef import from sync::aref nova-drm: - Update ARef import from sync::aref tyr: - initial driver skeleton for a rust driver for ARM Mali GPUs - capable of powering up, query metadata and provide it to userspace. msm: - GPU and Core: - in DT bindings describe clocks per GPU type - GMU bandwidth voting for x1-85 - a623/a663 speedbins - cleanup some remaining no-iommu leftovers after VM_BIND conversion - fix GEM obj 32b size truncation - add missing VM_BIND param validation - IFPC for x1-85 and a750 - register xml and gen_header.py sync from mesa - Display: - add missing bindings for display on SC8180X - added DisplayPort MST bindings - conversion from round_rate() to determine_rate() amdxdna: - add IOCTL_AMDXDNA_GET_ARRAY - support user space allocated buffers - streamline PM interfaces - Refactoring wrt. hardware contexts - improve error reporting nouveau: - use GSP firmware by default - improve error reporting - Pre-populate exported buffers ast: - Clean up detection of DRAM config exynos: - add DSIM bridge driver support for Exynos7870 - Document Exynos7870 DSIM compatible in dt-binding panthor: - Print task/pid on errors - Add support for Mali G710, G510, G310, Gx15, Gx20, Gx25 - Improve cache flushing - Fail VM bind if BO has offset renesas: - convert to RUNTIME_PM_OPS rcar-du: - Make number of lanes configurable - Use RUNTIME_PM_OPS - Add support for DSI commands rocket: - Add driver for Rockchip NPU plus DT bindings - Use kfree() and sizeof() correctly - Test DMA status rockchip: - dsi2: Add support for RK3576 plus DT bindings - Add support for RK3588 DPTX output tidss: - Use crtc_ fields for programming display mode - Remove other drivers from aperture pixpaper: - Add support for Mayqueen Pixpaper plus DT bindings v3d: - Support querying nubmer of GPU resets for KHR_robustness stm: - Clean up logging - ltdc: Add support support for STM32MP257F-EV1 plus DT bindings sitronix: - st7571-i2c: Add support for inverted displays and 2-bit grayscale tidss: - Convert to kernel's FIELD_ macros vesadrm: - Support 8-bit palette mode imagination: - Improve power management - Add support for TH1520 GPU - Support Risc-V architectures v3d: - Improve job management and locking vkms: - Support variants of ARGB8888, ARGB16161616, RGB565, RGB888 and P01x - Spport YUV with 16-bit components" * tag 'drm-next-2025-10-01' of https://gitlab.freedesktop.org/drm/kernel: (1455 commits) drm/amd: Add name to modes from amdgpu_connector_add_common_modes() drm/amd: Drop some common modes from amdgpu_connector_add_common_modes() drm/amdgpu: update MODULE_PARM_DESC for freesync_video drm/amd: Use dynamic array size declaration for amdgpu_connector_add_common_modes() drm/amd/display: Share dce100_validate_global with DCE6-8 drm/amd/display: Share dce100_validate_bandwidth with DCE6-8 drm/amdgpu: Fix fence signaling race condition in userqueue amd/amdkfd: enhance kfd process check in switch partition amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw drm/amd/display: Reject modes with too high pixel clock on DCE6-10 drm/amd: Drop unnecessary check in amdgpu_connector_add_common_modes() drm/amd/display: Only enable common modes for eDP and LVDS drm/amdgpu: remove the redeclaration of variable i drm/amdgpu/userq: assign an error code for invalid userq va drm/amdgpu: revert "rework reserved VMID handling" v2 drm/amdgpu: remove leftover from enforcing isolation by VMID drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails accel/habanalabs: add Infineon version check accel/habanalabs/gaudi2: read preboot status after recovering from dirty state accel/habanalabs: add HL_GET_P_STATE passthrough type ... commit 2836ed1748ccc567fddd51d4544a35f1e0f43136 Author: Ian Rogers Date: Mon Sep 29 12:07:55 2025 -0700 perf capstone: Remove open_capstone_handle open_capstone_handle is similar to capstone_init and used only by symbol__disassemble_capstone. symbol__disassemble_capstone_powerpc already uses capstone_init, transition symbol__disassemble_capstone and eliminate open_capstone_handle. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 95931d9a594dd0b5f2191a6a6340549b8f3b031b Author: Ian Rogers Date: Mon Sep 29 12:07:54 2025 -0700 perf libbfd: Move libbfd functionality to its own file Move symbolization and srcline libbfd dependencies to a separate libbfd.c. This mirrors moving llvm and capstone code. While this code is deprecated as it is part of BUILD_NONDISTRO license incompatible code, moving the code to its own file minimizes disruption in the main files. disasm_bpf.c is moved to libbfd.c also except for symbol__disassemble_bpf_image which is currently more of a placeholder function rather than something that provides disassembly support. demangle-cxx.cpp code isn't migrated as it is very limited. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit d9007afca0cf6c549c5049d5a75bce470453b024 Author: Ian Rogers Date: Mon Sep 29 12:07:53 2025 -0700 perf llvm: Move llvm functionality into its own file LLVM disassembly support was in disasm.c and addr2line support in srcline.c. Move support out of these files into llvm.[ch] and remove LLVM includes from those files. As disassembly routines can fail, make failure the only option without HAVE_LIBLLVM_SUPPORT. For simplicity's sake, duplicate the read_symbol utility function. The intent with moving LLVM support into a single file is that dynamic support, using dlopen for libllvm, can be added in later patches. This can potentially always succeed or fail, so relying on ifdefs isn't sufficient. Using dlopen is a useful option to minimize the perf tools dependencies and potentially size. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 05a54fa773284d1a7923cdfdd8f0c8dabb98bd26 Merge: e1b1d03ceec343 f65dc3b1ab145c Author: Linus Torvalds Date: Thu Oct 2 11:37:19 2025 -0700 Merge tag 'sound-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It's been relatively calm in this cycle from the feature POV, but there were lots of cleanup works in the wide-range of code for converting with the auto-cleanup macros like guard(). The mostly user-visible changes are the support of a couple of new compress-offload API extensions, and the support of new ASoC codec / platform drivers as well as USB-audio quirks. Here we go with some highlights: Core: - Compress-offload API extension for 64bit timestamp support - Compress-offload API extension for OPUS codec support - Workaround for PCM locking issue with PREEMPT_RT and softirq - KCSAN warning fix for ALSA sequencer core ASoC: - Continued cleanup works for ASoC core APIs - Lots of cleanups and conversions of DT bindings - Substantial maintainance work on the Intel AVS drivers - Support for Qualcomm Glymur and PM4125, Realtek RT1321, Shanghai FourSemi FS2104/5S, Texas Instruments PCM1754 and TAS2783A - Remove support for TI WL1273 for old Nokia systems USB-audio: - Support for Tascam US-144mkII, Presonus S1824c support - More flexible quirk option handling - Fix for USB MIDI timer bug triggered by fuzzer Others: - A large series of cleanups with guard() & co macros over (non-ASoC) sound drivers (PCI, ISA, HD-audio, USB-audio, drivers, etc) - TAS5825 HD-audio side-codec support" * tag 'sound-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (454 commits) ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio ALSA: usb-audio: add the initial mix for Presonus Studio 1824c ALSA: doc: improved docs about quirk_flags in snd-usb-audio ALSA: usb-audio: make param quirk_flags change-able in runtime ALSA: usb-audio: improve module param quirk_flags ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free ALSA: usb-audio: add mono main switch to Presonus S1824c ALSA: compress: document 'chan_map' member in snd_dec_opus ASoC: cs35l56: Add support for CS35L56 B2 silicon ASoC: cs35l56: Set fw_regs table after getting REVID ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 ASoc: tas2783A: Fix an error code in probe() ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 ASoC: stm32: sai: manage context in set_sysclk callback ASoC: renesas: msiof: ignore 1st FSERR ASoC: renesas: msiof: Add note for The possibility of R/L opposite Capture ASoC: renesas: msiof: setup both (Playback/Capture) in the same time ASoC: renesas: msiof: tidyup DMAC stop timing ... commit bbb99668b5b1c2411de2683e89f018be60a75dff Author: Ian Rogers Date: Mon Sep 29 12:07:52 2025 -0700 perf capstone: Move capstone functionality into its own file Capstone disassembly support was split between disasm.c and print_insn.c. Move support out of these files into capstone.[ch] and remove include capstone/capstone.h from those files. As disassembly routines can fail, make failure the only option without HAVE_LIBCAPSTONE_SUPPORT. For simplicity's sake, duplicate the read_symbol utility function. The intent with moving capstone support into a single file is that dynamic support, using dlopen for libcapstone, can be added in later patches. This can potentially always succeed or fail, so relying on ifdefs isn't sufficient. Using dlopen is a useful option to minimize the perf tools dependencies and potentially size. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit c0b8a55a1180274247f6081260cd854c2a309379 Author: Ian Rogers Date: Mon Sep 29 12:07:51 2025 -0700 perf map: Constify objdump offset/address conversion APIs Make the map argument const as the conversion act won't modify the map and this allows other callers to use a const struct map. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit cbeb3d4784d489d7e494313fb2ec4f6a7ae4609d Author: Dapeng Mi Date: Fri Sep 19 10:16:59 2025 +0800 perf tools kvm: Use "cycles" to sample guest for "kvm top" on Intel As same reason with previous patch, use "cyles" instead of "cycles:P" event by default to sample guest for "perf kvm top" command on Intel platforms. Fixes: cf8e55fe50df0c02 ("KVM: x86/pmu: Expose CPUIDs feature bits PDCM, DS, DTES64") Reported-by: Kevin Tian Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Like Xu Cc: Paolo Bonzini Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit c1afca106e16fbbf9508b3770e6ab1c2f7993ea1 Author: Dapeng Mi Date: Fri Sep 19 10:16:58 2025 +0800 perf tools kvm: Use "cycles" to sample guest for "kvm record" on Intel After KVM supports PEBS for guest on Intel platforms (https://lore.kernel.org/all/20220411101946.20262-1-likexu@tencent.com/), host loses the capability to sample guest with PEBS since all PEBS related MSRs are switched to guest value after vm-entry, like IA32_DS_AREA MSR is switched to guest GVA at vm-entry. This would lead to "perf kvm record" fails to sample guest on Intel platforms since "cycles:P" event is used to sample guest by default as below case shows. sudo perf kvm record -a ^C[ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.787 MB perf.data.guest ] So to ensure guest record can be sampled successfully, use "cycles" instead of "cycles:P" to sample guest record by default on Intel platforms. With this patch, the guest record can be sampled successfully. sudo perf kvm record -a ^C[ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.783 MB perf.data.guest (23 samples) ] Fixes: cf8e55fe50df0c02 ("KVM: x86/pmu: Expose CPUIDs feature bits PDCM, DS, DTES64") Reported-by: Kevin Tian Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Like Xu Cc: Paolo Bonzini Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 0f53264d714ae7db2a827b3483418f0288fa953f Author: Dapeng Mi Date: Fri Sep 19 10:16:57 2025 +0800 perf tools: Add helper x86__is_intel_cpu() Add helper x86__is_intel_cpu() to indicate if it's a x86 intel platform. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 45ff39f6e70aa55d0054fbc3508eba9ac03d7e29 Author: Dapeng Mi Date: Fri Sep 19 10:16:56 2025 +0800 perf tools kvm: Fix the potential out of range memory access issue kvm_add_default_arch_event() helper may add 2 extra options but it directly modifies the original argv[] array. This may cause out of range memory access. Fix this issue. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6f58cf10457f5868ef4cd98b4de6428787b3fb2c Author: Dapeng Mi Date: Fri Sep 19 10:16:55 2025 +0800 perf tools kwork: Add missed memory allocation check and free Same with previous builtin-kvm code, perf_kwork__record() doesn't check the memory allocation and explicitly free the allocated memory. Just fix it. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 9262fa242b73d32bd849cbcefb9b7311d2c04637 Author: Dapeng Mi Date: Fri Sep 19 10:16:54 2025 +0800 perf tools kvm: Add missed memory allocation check and free Current code allocates rec_argv[] array, but doesn't check if the allocation is successful and explicitly free the rec_argv[] array. Add them back. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit f0015d8149de3b54af04147527163422eb34ec00 Author: Ian Rogers Date: Fri Sep 5 15:47:08 2025 -0700 tools include: Add headers to make tools builds more hermetic tools/lib/bpf/netlink.c depends on rtnetlink.h and genetlink.h (via nlattr.h) which then depends on if_addr.h. tools/bpf/bpftool/link.c depends on netfilter_arp.h which then depends on netfilter.h. Update check-headers.sh to keep these in sync. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit 57a64919f21ef4bd620da7d2ed8c683d55413b16 Author: Ian Rogers Date: Fri Sep 5 15:47:07 2025 -0700 tools include: Replace tools linux/gfp_types.h with kernel version Previously the header gfp_types.h in tools points to the gfp_types.h in include/linux. This is a problem for tools like perf, since the tools header is supposed to be independent of the kernel headers. Therefore this patch copies the kernel header to the tools header and adds a header check. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit f38ce0209ab4553906b44bd1159e35c740a84161 Author: Ian Rogers Date: Fri Sep 5 15:47:06 2025 -0700 tools bitmap: Add missing asm-generic/bitsperlong.h include small_const_nbits is defined in asm-generic/bitsperlong.h which bitmap.h uses but doesn't include causing build failures in some build systems. Add the missing #include. Note the bitmap.h in tools has diverged from that of the kernel, so no changes are made there. Signed-off-by: Ian Rogers Acked-by: Yury Norov Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit 83fde0ee8f1608fc0925452a82a35aa3b4b37c4b Author: Ian Rogers Date: Fri Sep 5 15:47:05 2025 -0700 perf bench futex: Add missing stdbool.h futex.h uses bool but lacks stdbool.h which causes build failures in some build systems. Add the missing #include. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Link: https://lore.kernel.org/r/20250905224708.2469021-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a272195f1c69c928e206e907e139cc0e30e6dd45 Author: Ian Rogers Date: Sun Sep 14 11:21:40 2025 -0700 perf test: Stat std output don't fail metric only When running on a hypervisor the expected IPC metric may be missing as the events may fail to be read. Don't expect metric output for this test to avoid it failing. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Veronika Molnarova Signed-off-by: Arnaldo Carvalho de Melo commit 8dc364fa484df22d301a16148d1b356931d0cbb0 Author: Ian Rogers Date: Sun Sep 14 11:24:37 2025 -0700 libperf mmap: In user mmap rdpmc avoid undefined behavior A shift left of a signed 64-bit s64 may overflow and result in undefined behavior caught by ubsan. Switch to a u64 instead. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit de1111f91a7a681303265938c2ad32f5ec3f21b7 Author: Ian Rogers Date: Sun Sep 14 11:31:31 2025 -0700 perf symbol-minimal: Be more defensive when reading build IDs The note_data at ptr is read as a nhdr but this may yield out-of-bounds reads if there isn't nhdrs worth of data. Be more defensive before doing the reads. This is motivated by address sanitizer capturing out of bounds reads running "perf top". Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 4fc844347ec1c755c460be2c7aa684cc3580fea3 Author: Sam James Date: Wed Aug 6 01:03:01 2025 +0100 perf bpf: Use __builtin_preserve_field_info for GCC compatibility When exploring building bpf_skel with GCC's BPF support, there was a build failure because of bpf_core_field_exists vs the mem_hops bitfield: ``` In file included from util/bpf_skel/sample_filter.bpf.c:6: util/bpf_skel/sample_filter.bpf.c: In function 'perf_get_sample': tools/perf/libbpf/include/bpf/bpf_core_read.h:169:42: error: cannot take address of bit-field 'mem_hops' 169 | #define ___bpf_field_ref1(field) (&(field)) | ^ tools/perf/libbpf/include/bpf/bpf_helpers.h:222:29: note: in expansion of macro '___bpf_field_ref1' 222 | #define ___bpf_concat(a, b) a ## b | ^ tools/perf/libbpf/include/bpf/bpf_helpers.h:225:29: note: in expansion of macro '___bpf_concat' 225 | #define ___bpf_apply(fn, n) ___bpf_concat(fn, n) | ^~~~~~~~~~~~~ tools/perf/libbpf/include/bpf/bpf_core_read.h:173:9: note: in expansion of macro '___bpf_apply' 173 | ___bpf_apply(___bpf_field_ref, ___bpf_narg(args))(args) | ^~~~~~~~~~~~ tools/perf/libbpf/include/bpf/bpf_core_read.h:188:39: note: in expansion of macro '___bpf_field_ref' 188 | __builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_EXISTS) | ^~~~~~~~~~~~~~~~ util/bpf_skel/sample_filter.bpf.c:167:29: note: in expansion of macro 'bpf_core_field_exists' 167 | if (bpf_core_field_exists(data->mem_hops)) | ^~~~~~~~~~~~~~~~~~~~~ cc1: error: argument is not a field access ``` ___bpf_field_ref1 was adapted for GCC in 12bbcf8e840f40b82b02981e96e0a5fbb0703ea9 but the trick added for compatibility in 3a8b8fc3174891c4c12f5766d82184a82d4b2e3e isn't compatible with that as an address is used as an argument. Workaround this by calling __builtin_preserve_field_info directly as the bpf_core_field_exists macro does, but without the ___bpf_field_ref use. Co-developed-by: Andrew Pinski Signed-off-by: Andrew Pinski Signed-off-by: Sam James Acked-by: Yonghong Song Tested-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Peter Zijlstra Link: https://gcc.gnu.org/PR121420 Signed-off-by: Arnaldo Carvalho de Melo commit e1b1d03ceec343362524318c076b110066ffe305 Merge: 5832d26433f2bd 130e6de6210711 Author: Linus Torvalds Date: Thu Oct 2 10:16:56 2025 -0700 Merge tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: - NVMe pull request via Keith: - FC target fixes (Daniel) - Authentication fixes and updates (Martin, Chris) - Admin controller handling (Kamaljit) - Target lockdep assertions (Max) - Keep-alive updates for discovery (Alastair) - Suspend quirk (Georg) - MD pull request via Yu: - Add support for a lockless bitmap. A key feature for the new bitmap are that the IO fastpath is lockless. If a user issues lots of write IO to the same bitmap bit in a short time, only the first write has additional overhead to update bitmap bit, no additional overhead for the following writes. By supporting only resync or recover written data, means in the case creating new array or replacing with a new disk, there is no need to do a full disk resync/recovery. - Switch ->getgeo() and ->bios_param() to using struct gendisk rather than struct block_device. - Rust block changes via Andreas. This series adds configuration via configfs and remote completion to the rnull driver. The series also includes a set of changes to the rust block device driver API: a few cleanup patches, and a few features supporting the rnull changes. The series removes the raw buffer formatting logic from `kernel::block` and improves the logic available in `kernel::string` to support the same use as the removed logic. - floppy arch cleanups - Reduce the number of dereferencing needed for ublk commands - Restrict supported sockets for nbd. Mostly done to eliminate a class of issues perpetually reported by syzbot, by using nonsensical socket setups. - A few s390 dasd block fixes - Fix a few issues around atomic writes - Improve DMA interation for integrity requests - Improve how iovecs are treated with regards to O_DIRECT aligment constraints. We used to require each segment to adhere to the constraints, now only the request as a whole needs to. - Clean up and improve p2p support, enabling use of p2p for metadata payloads - Improve locking of request lookup, using SRCU where appropriate - Use page references properly for brd, avoiding very long RCU sections - Fix ordering of recursively submitted IOs - Clean up and improve updating nr_requests for a live device - Various fixes and cleanups * tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (164 commits) s390/dasd: enforce dma_alignment to ensure proper buffer validation s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request ublk: remove redundant zone op check in ublk_setup_iod() nvme: Use non zero KATO for persistent discovery connections nvmet: add safety check for subsys lock nvme-core: use nvme_is_io_ctrl() for I/O controller check nvme-core: do ioccsz/iorcsz validation only for I/O controllers nvme-core: add method to check for an I/O controller blk-cgroup: fix possible deadlock while configuring policy blk-mq: fix null-ptr-deref in blk_mq_free_tags() from error path blk-mq: Fix more tag iteration function documentation selftests: ublk: fix behavior when fio is not installed ublk: don't access ublk_queue in ublk_unmap_io() ublk: pass ublk_io to __ublk_complete_rq() ublk: don't access ublk_queue in ublk_need_complete_req() ublk: don't access ublk_queue in ublk_check_commit_and_fetch() ublk: don't pass ublk_queue to ublk_fetch() ublk: don't access ublk_queue in ublk_config_io_buf() ublk: don't access ublk_queue in ublk_check_fetch_buf() ublk: pass q_id and tag to __ublk_check_and_get_req() ... commit aefada95fbab74035aca62e3ab80f93fe91d2d58 Merge: bace10b59624e6 45ad27d9a6f7c6 Author: Mark Brown Date: Thu Oct 2 18:07:06 2025 +0100 ASoC: SOF: ipc4/Intel: Fix the host buffer Merge series from Peter Ujfalusi : The size of the DSP host buffer was incorrectly defined as 2ms while it is 4ms and the ChainDMA PCMs are using 5ms as host facing buffer. The constraint will be set against the period time rather than the buffer time to make sure that application will not face with xruns when the DMA bursts to refill the host buffer. The minimal period size will be also used by Pipewire in case of SOF cards to set the headroom to a length which will avoid the cases when the hw_ptr jumps over the appl_ptr because of a burst. Iow, it will make Pipewire to keep a safe distance from the hw_ptr. https://github.com/thesofproject/linux/issues/5284 https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/740 https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2548 commit 5832d26433f2bd0d28f8b12526e3c2fdb203507f Merge: 77633c77eee37d ef9f603fd3d4b7 Author: Linus Torvalds Date: Thu Oct 2 09:56:23 2025 -0700 Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Store ring provided buffers locally for the users, rather than stuff them into struct io_kiocb. These types of buffers must always be fully consumed or recycled in the current context, and leaving them in struct io_kiocb is hence not a good ideas as that struct has a vastly different life time. Basically just an architecture cleanup that can help prevent issues with ring provided buffers in the future. - Support for mixed CQE sizes in the same ring. Before this change, a CQ ring either used the default 16b CQEs, or it was setup with 32b CQE using IORING_SETUP_CQE32. For use cases where a few 32b CQEs were needed, this caused everything else to use big CQEs. This is wasteful both in terms of memory usage, but also memory bandwidth for the posted CQEs. With IORING_SETUP_CQE_MIXED, applications may use request types that post both normal 16b and big 32b CQEs on the same ring. - Add helpers for async data management, to make it harder for opcode handlers to mess it up. - Add support for multishot for uring_cmd, which ublk can use. This helps improve efficiency, by providing a persistent request type that can trigger multiple CQEs. - Add initial support for ring feature querying. We had basic support for probe operations, but the API isn't great. Rather than expand that, add support for QUERY which is easily expandable and can cover a lot more cases than the existing probe support. This will help applications get a better idea of what operations are supported on a given host. - zcrx improvements from Pavel: - Improve refill entry alignment for better caching - Various cleanups, especially around deduplicating normal memory vs dmabuf setup. - Generalisation of the niov size (Patch 12). It's still hard coded to PAGE_SIZE on init, but will let the user to specify the rx buffer length on setup. - Syscall / synchronous bufer return. It'll be used as a slow fallback path for returning buffers when the refill queue is full. Useful for tolerating slight queue size misconfiguration or with inconsistent load. - Accounting more memory to cgroups. - Additional independent cleanups that will also be useful for mutli-area support. - Various fixes and cleanups * tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (68 commits) io_uring/cmd: drop unused res2 param from io_uring_cmd_done() io_uring: fix nvme's 32b cqes on mixed cq io_uring/query: cap number of queries io_uring/query: prevent infinite loops io_uring/zcrx: account niov arrays to cgroup io_uring/zcrx: allow synchronous buffer return io_uring/zcrx: introduce io_parse_rqe() io_uring/zcrx: don't adjust free cache space io_uring/zcrx: use guards for the refill lock io_uring/zcrx: reduce netmem scope in refill io_uring/zcrx: protect netdev with pp_lock io_uring/zcrx: rename dma lock io_uring/zcrx: make niov size variable io_uring/zcrx: set sgt for umem area io_uring/zcrx: remove dmabuf_offset io_uring/zcrx: deduplicate area mapping io_uring/zcrx: pass ifq to io_zcrx_alloc_fallback() io_uring/zcrx: check all niovs filled with dma addresses io_uring/zcrx: move area reg checks into io_import_area io_uring/zcrx: don't pass slot to io_zcrx_create_area ... commit a39516805992d22d35fd044ab555303ad453456d Author: Arnaldo Carvalho de Melo Date: Thu Oct 2 09:52:11 2025 -0300 tools build: Don't assume libtracefs-devel is always available perf doesn't use libtracefs and so it doesn't make sense to assume it is always available when building test-all.bin, defeating the feature check speedup it provides. The other tools/build/ users such as rtla, rv, etc call $(feature_check libtracefs) to check its availability instead of using the test-all.bin mechanism, stopping the build and asking for libtracefs-devel to be installed. Remove it from FEATURE_TESTS_BASIC to not have it as available, as noted by Ian Rogers during review. Reviewed-by: Ian Rogers Acked-by: Tomas Glozar Cc: Adrian Hunter Cc: Gabriele Monaco Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Steven Rostedt Signed-off-by: Arnaldo Carvalho de Melo commit 77633c77eee37ddc160493a4cf6070c166f47dc0 Merge: d7a018eb761f44 2cdae413cd3ee6 Author: Linus Torvalds Date: Thu Oct 2 08:57:03 2025 -0700 Merge tag 'bitmap-for-6.18' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - FIELD_PREP_WM16() consolidation (Nicolas) - bitmaps for Rust (Burak) - __fls() fix for arc (Kees) * tag 'bitmap-for-6.18' of https://github.com/norov/linux: (25 commits) rust: add dynamic ID pool abstraction for bitmap rust: add find_bit_benchmark_rust module. rust: add bitmap API. rust: add bindings for bitops.h rust: add bindings for bitmap.h phy: rockchip-pcie: switch to FIELD_PREP_WM16 macro clk: sp7021: switch to FIELD_PREP_WM16 macro PCI: dw-rockchip: Switch to FIELD_PREP_WM16 macro PCI: rockchip: Switch to FIELD_PREP_WM16* macros net: stmmac: dwmac-rk: switch to FIELD_PREP_WM16 macro ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro drm/rockchip: dw_hdmi: switch to FIELD_PREP_WM16* macros phy: rockchip-usb: switch to FIELD_PREP_WM16 macro drm/rockchip: inno-hdmi: switch to FIELD_PREP_WM16 macro drm/rockchip: dw_hdmi_qp: switch to FIELD_PREP_WM16 macro phy: rockchip-samsung-dcphy: switch to FIELD_PREP_WM16 macro drm/rockchip: vop2: switch to FIELD_PREP_WM16 macro drm/rockchip: dsi: switch to FIELD_PREP_WM16* macros phy: rockchip-emmc: switch to FIELD_PREP_WM16 macro drm/rockchip: lvds: switch to FIELD_PREP_WM16 macro ... commit d7a018eb761f44f1f48667540185d025354f33b6 Merge: 7f7072574127c9 800348aa34b2bc Author: Linus Torvalds Date: Thu Oct 2 08:31:44 2025 -0700 Merge tag 'kcsan-20250929-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver: - Replace deprecated strcpy() with strscpy() * tag 'kcsan-20250929-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux: kcsan: test: Replace deprecated strcpy() with strscpy() commit 8b51b11b3d81c1ed48a52f87da9256d737b723a0 Author: Hengqi Chen Date: Thu Oct 2 22:39:53 2025 +0800 LoongArch: BPF: Sign-extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel panic: Oops[#1]: CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra == 90000000851b5aa4 CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G OE 6.16.0+ #3 PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880 s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000 ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA: 90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) BADV: 0000000000741d58 PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)] Process test_progs (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 ... Call Trace: [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit+0x304/0x858 [<90000000853c4438>] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [<90000000852e7738>] __inet_stream_connect+0x170/0x480 [<90000000852e7a98>] inet_stream_connect+0x50/0x88 [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28 [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires LoongArch ABI. So let's sign extend struct ops return values according to the LoongArch ABI ([1]) and return value spec in function model. [1]: https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html Cc: stable@vger.kernel.org Fixes: 6abf17d690d8 ("LoongArch: BPF: Add struct ops support for trampoline") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit de2c0b7788648850b68b75f7cc8698b2749dd31e Author: Hengqi Chen Date: Thu Oct 2 22:39:53 2025 +0800 LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() Bail out instead of trying to perform a bpf_arch_text_copy() if __arch_prepare_bpf_trampoline() failed. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit ea645cfd3d5f74a2bd40a60003f113b3c467975d Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Make trampoline size stable When attach fentry/fexit BPF programs, __arch_prepare_bpf_trampoline() is called twice with different `struct bpf_tramp_image *im`: bpf_trampoline_update() -> arch_bpf_trampoline_size() -> __arch_prepare_bpf_trampoline() -> arch_prepare_bpf_trampoline() -> __arch_prepare_bpf_trampoline() Use move_imm() will emit unstable instruction sequences, so let's use move_addr() instead to prevent subtle bugs. (I observed this while debugging other issues with printk.) Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit a04731cbee6e981afa4263289a0c0059c8b2e7b9 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Don't align trampoline size Currently, arch_alloc_bpf_trampoline() use bpf_prog_pack_alloc() which will pack multiple trampolines into a huge page. So, no need to assume the trampoline size is page aligned. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit e82406c7cbdd368c5459b8a45e118811d2ba0794 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: No support of struct argument in trampoline programs The current implementation does not support struct argument. This causes a oops when running bpf selftest: $ ./test_progs -a tracing_struct Oops[#1]: CPU -1 Unable to handle kernel paging request at virtual address 0000000000000018, era == 9000000085bef268, ra == 90000000844f3938 rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-...0: (19 ticks this GP) idle=1094/1/0x4000000000000000 softirq=1380/1382 fqs=801 rcu: (detected by 0, t=5252 jiffies, g=1197, q=52 ncpus=4) Sending NMI from CPU 0 to CPUs 1: rcu: rcu_preempt kthread starved for 2495 jiffies! g1197 f0x0 RCU_GP_DOING_FQS(6) ->state=0x0 ->cpu=2 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:0 pid:15 tgid:15 ppid:2 task_flags:0x208040 flags:0x00000800 Stack : 9000000100423e80 0000000000000402 0000000000000010 90000001003b0680 9000000085d88000 0000000000000000 0000000000000040 9000000087159350 9000000085c2b9b0 0000000000000001 900000008704a000 0000000000000005 00000000ffff355b 00000000ffff355b 0000000000000000 0000000000000004 9000000085d90510 0000000000000000 0000000000000002 7b5d998f8281e86e 00000000ffff355c 7b5d998f8281e86e 000000000000003f 9000000087159350 900000008715bf98 0000000000000005 9000000087036000 900000008704a000 9000000100407c98 90000001003aff80 900000008715c4c0 9000000085c2b9b0 00000000ffff355b 9000000085c33d3c 00000000000000b4 0000000000000000 9000000007002150 00000000ffff355b 9000000084615480 0000000007000002 ... Call Trace: [<9000000085c2a868>] __schedule+0x410/0x1520 [<9000000085c2b9ac>] schedule+0x34/0x190 [<9000000085c33d38>] schedule_timeout+0x98/0x140 [<90000000845e9120>] rcu_gp_fqs_loop+0x5f8/0x868 [<90000000845ed538>] rcu_gp_kthread+0x260/0x2e0 [<900000008454e8a4>] kthread+0x144/0x238 [<9000000085c26b60>] ret_from_kernel_thread+0x28/0xc8 [<90000000844f20e4>] ret_from_kernel_thread_asm+0xc/0x88 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 2: NMI backtrace for cpu 2 skipped: idling at idle_exit+0x0/0x4 Reject it for now. Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 3d770bd11b943066db11dba7be0b6f0d81cb5d50 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: No text_poke() for kernel text The current implementation of bpf_arch_text_poke() requires 5 nops at patch site which is not applicable for kernel/module functions. Because LoongArch reserves ONLY 2 nops at the function entry. With CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y, this can be done by ftrace instead. See the following commit for details: * commit b91e014f078e ("bpf: Make BPF trampoline use register_ftrace_direct() API") * commit 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support") Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit b0f50dc09bf008b2e581d5e6ad570d325725881c Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Remove duplicated bpf_flush_icache() The bpf_flush_icache() is called by bpf_arch_text_copy() already. So remove it. This has been done in arm64 and riscv. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 909d3e3f51b1bc00f33a484ce0d41b42fed01965 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Remove duplicated flags check The check for (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY) is duplicated in __arch_prepare_bpf_trampoline(). Remove it. While at it, make sure stack_size and nargs are initialized once. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 7b6c2d172d023d344527d3cb4516d0d6b29f4919 Author: Huacai Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Fix uninitialized symbol 'retval_off' In __arch_prepare_bpf_trampoline(), retval_off is meaningful only when save_ret is not 0, so the current logic is correct. But it may cause a build warning: arch/loongarch/net/bpf_jit.c:1547 __arch_prepare_bpf_trampoline() error: uninitialized symbol 'retval_off'. So initialize retval_off unconditionally to fix it. Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Closes: https://lore.kernel.org/r/202508191020.PBBh07cK-lkp@intel.com/ Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Huacai Chen commit 24ff0347bbfda1cee9b4aca29c8eeb1a2b7bd61e Author: Tiezhu Yang Date: Thu Oct 2 22:39:35 2025 +0800 LoongArch: BPF: Optimize sign-extention mov instructions For 8-bit and 16-bit sign-extention mov instructions, it can use the native instructions ext.w.b and ext.w.h directly, no need to use the temporary t1 register, just remove the redundant operations. Here are the test results: # modprobe test_bpf test_range=81,84 # dmesg -t | tail -5 test_bpf: #81 ALU_MOVSX | BPF_B jited:1 5 PASS test_bpf: #82 ALU_MOVSX | BPF_H jited:1 5 PASS test_bpf: #83 ALU64_MOVSX | BPF_B jited:1 5 PASS test_bpf: #84 ALU64_MOVSX | BPF_H jited:1 5 PASS test_bpf: Summary: 4 PASSED, 0 FAILED, [4/4 JIT'ed] Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 Author: Tiezhu Yang Date: Thu Oct 2 22:39:35 2025 +0800 LoongArch: Handle new atomic instructions for probes The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added in the LoongArch Reference Manual v1.10, it is necessary to handle them in insns_not_supported() to avoid putting a breakpoint in the middle of a ll/sc atomic sequence, otherwise it will loop forever for kprobes and uprobes. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 892979b0a97c5f3a5decfd6a33e7f902414bfc41 Author: Wentao Guan Date: Thu Oct 2 22:39:19 2025 +0800 LoongArch: Try VMA lock-based page fault handling first Attempt VMA lock-based page fault handling first, and fall back to the existing mmap_lock-based handling if that fails. The "ebizzy -mTRp" test on Loongson-3A6000 shows that PER_VMA_LOCK can improve the benchmark by about 17.9% (97837.7 to 115430.8). This is the LoongArch variant of "x86/mm: try VMA lock-based page fault handling first". Signed-off-by: Wentao Guan Signed-off-by: Huacai Chen commit c8168b4faf1d62cbb320a3e518ad31cdd567cb05 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Automatically disable kaslr if boot from kexec_file Automatically disable kaslr when the kernel loads from kexec_file. kexec_file loads the secondary kernel image to a non-linked address, inherently providing KASLR-like randomization. However, on LoongArch where System RAM may be non-contiguous, enabling KASLR for the second kernel may relocate it to an invalid memory region and cause a boot failure. Thus, we disable KASLR when "kexec_file" is detected in the command line. To ensure compatibility with older kernels loaded via kexec_file, this patch should be backported to stable branches. Cc: stable@vger.kernel.org Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 1bcca8620a915d2f98ad7641f82d799c17f04b93 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Add crash dump support for kexec_file Enabling crash dump (kdump) includes: - Prepare contents of ELF header of a core dump file, /proc/vmcore, using crash_prepare_elf64_headers(). - Add "mem=size@start" parameter to the command line and pass it to the capture kernel. Limit the runtime memory area of the captured kernel to avoid disrupting the production kernel's runtime state. - Add "elfcorehdr=size@start" parameter to the cmdline. The basic usage for kdump (add the cmdline parameter crashkernel=512M to grub.cfg for production kernel): 1) Load capture kernel image (vmlinux.efi or vmlinux can both be used): # kexec -s -p vmlinuz.efi --initrd=initrd.img --reuse-cmdline 2) Do something to crash, like: # echo c > /proc/sysrq-trigger Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit fc9c112f804abcd984a20a66a909332a147a23e8 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Add ELF binary support for kexec_file This patch creates kexec_elf_ops to load ELF binary file for kexec_file_load() syscall. However, for `kbuf->memsz` and `kbuf->buf_min`, special handling is required, and the generic `kexec_elf_load()` cannot be used directly. $ readelf -l vmlinux ... Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000010000 0x9000000000200000 0x9000000000200000 0x0000000002747a00 0x000000000287a0d8 RWE 0x10000 NOTE 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 R 0x8 phdr->p_paddr should have been a physical address, but it is a virtual address on the current LoongArch. This will cause kexec_file to fail when loading the kernel and need to be converted to a physical address. From the above MemSiz, it can be seen that 0x287a0d8 isn't page aligned. Although kexec_add_buffer() will perform PAGE_SIZE alignment on kbuf-> memsz, there is still a stampeding in the loaded kernel space and initrd space. The initrd resolution failed when starting the second kernel. It can be known from the link script vmlinux.lds.S that, BSS_SECTION(0, SZ_64K, 8) . = ALIGN(PECOFF_SEGMENT_ALIGN); It needs to be aligned according to SZ_64K, so that after alignment, its size is consistent with _kernel_asize. The basic usage (vmlinux): 1) Load second kernel image: # kexec -s -l vmlinux --initrd=initrd.img --reuse-cmdline 2) Startup second kernel: # kexec -e Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 55d990f0084c2b8ab9321dc59fc11dce855b4d61 Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add EFI binary support for kexec_file This patch creates kexec_efi_ops to load EFI binary file for kexec_file_load() syscall. The efi_kexec_load() as two parts: - the first part loads the kernel image (vmlinuz.efi or vmlinux.efi) - the second part loads other segments (e.g: initrd, cmdline, etc) Currently, pez (vmlinuz.efi) and pei (vmlinux.efi) format images are supported. The basic usage (vmlinuz.efi or vmlinux.efi): 1) Load second kernel image: # kexec -s -l vmlinuz.efi --initrd=initrd.img --reuse-cmdline 2) Startup second kernel: # kexec -e Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit d162feec6b6e7ed97986118450812fdd7e9ba202 Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add preparatory infrastructure for kexec_file Add some preparatory infrastructure: - Add command line processing. - Add support for loading other segments. - Other minor modifications. This initrd will be passed to the second kernel via the command line 'initrd=start,size'. The 'kexec_file' command line parameter indicates that the kernel is loaded via kexec_file. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 30ade4fef7ad95ab266a74a2f69544b02af7299d Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add struct loongarch_image_header for kernel Define a dedicated image header structure for LoongArch architecture to standardize kernel loading in bootloaders (primarily for kexec_file). This header includes critical metadata, such as PE/DOS signature, kernel entry points, kernel image size and load address offset, etc. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 5dcddd268a8d434e0ca562b7bbca3642226ba213 Author: Huacai Chen Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Allow specify SIMD width via kernel parameters For power saving or debugging purpose, we usually want to limit the SIMD (LSX/LASX) usage on a rich feature platform. So allow specify SIMD width via kernel parameters "simd=". Allowed values of "simd=" are any integers, and recommended values are: 0: Disable all SIMD features; 128: Enable at most 128bit SIMD features; 256: Enable at most 256bit SIMD features; -1(default): Enable as many as possible SIMD features automatically. Signed-off-by: Huacai Chen commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 Author: Huacai Chen Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Init acpi_gbl_use_global_lock to false Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase: ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") Signed-off-by: Huacai Chen commit 19baac378a5f4c34e61007023cfcb605cc64c76d Author: Huacai Chen Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Fix build error for LTO with LLVM-18 Commit b15212824a01 ("LoongArch: Make LTO case independent in Makefile") moves "KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump" out of CONFIG_CC_HAS_ANNOTATE_TABLEJUMP, which breaks the build for LLVM-18, as '--loongarch-annotate-tablejump' is unimplemented there: ld.lld: error: -mllvm: ld.lld: Unknown command line argument '--loongarch-annotate-tablejump'. Call ld-option to detect '--loongarch-annotate-tablejump' before use, so as to fix the build error. Fixes: b15212824a01 ("LoongArch: Make LTO case independent in Makefile") Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor # build Suggested-by: WANG Rui Signed-off-by: Huacai Chen commit abb2a5572264b425e6dd9c213b735a82ab0ca68a Author: Tiezhu Yang Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference Currently, when compiling with GCC, there is no "break 7" instruction for zero division due to using the option -mno-check-zero-division, but the compiler still generates "break 0" instruction for zero division. Here is a simple example: $ cat test.c int div(int a) { return a / 0; } $ gcc -O2 -S test.c -o test.s GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes "ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the objtool warnings for LoongArch, but this is not the intention. When decoding "break 0" as INSN_TRAP in the previous commit, the aim is to handle "break 0" as a trap. The generated "break 0" for zero division by GCC is not proper, it should generate a break instruction with proper bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference to avoid generating the unexpected "break 0" instruction for now. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/ Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code") Suggested-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit deb2f228388ff3a9d0623e3b59a053e9235c341d Author: Breno Leitao Date: Mon Sep 29 02:15:47 2025 -0700 PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn't advertise an AER Capability and therefore dev->aer_info, which contains AER stats and ratelimiting data, is NULL. pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but aer_ratelimit() did not, leading to NULL pointer dereferences like this one from the URL below: {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0 {1}[Hardware Error]: event severity: corrected {1}[Hardware Error]: device_id: 0000:00:00.0 {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2020 {1}[Hardware Error]: aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000 BUG: kernel NULL pointer dereference, address: 0000000000000264 RIP: 0010:___ratelimit+0xc/0x1b0 pci_print_aer+0x141/0x360 aer_recover_work_func+0xb5/0x130 [8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to be a Root Port but does not advertise an AER Capability. Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference. Note that this also prevents ratelimiting these events from GHES. Fixes: a57f2bfb4a5863 ("PCI/AER: Ratelimit correctable and non-fatal error logging") Link: https://lore.kernel.org/r/buduna6darbvwfg3aogl5kimyxkggu3n4romnmq6sozut6axeu@clnx7sfsy457/ Signed-off-by: Breno Leitao [bhelgaas: add crash details to commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250929-aer_crash_2-v1-1-68ec4f81c356@debian.org commit 2b5f6638204cc0e0f6ecd55b963ebb895ec61f3b Merge: e5f0a698b34ed7 c87072064bd482 Author: Huacai Chen Date: Thu Oct 2 22:29:26 2025 +0800 Merge tag 'acpi-6.18-rc1' into loongarch-next LoongArch architecture changes for 6.18 need acpica changes to handle global lock initialization, so merge 'acpi-6.18-rc1' to create a base. commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a Author: Peter Ujfalusi Date: Thu Oct 2 16:57:52 2025 +0300 ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time Instead of constraining the ALSA buffer time to be double of the firmware host buffer size, it is better to set it for the period time. This will implicitly constrain the buffer time to a safe value (num_periods is at least 2) and prohibits applications to set smaller period size than what will be covered by the initial DMA burst. Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a Author: Peter Ujfalusi Date: Thu Oct 2 16:57:51 2025 +0300 ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size For ChainDMA the firmware allocates 5ms host buffer instead of the standard 4ms which should be taken into account when setting the constraint on the buffer size. Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 Author: Peter Ujfalusi Date: Thu Oct 2 16:57:50 2025 +0300 ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size The firmware has changed the minimum host buffer size from 2 periods to 4 periods (1 period is 1ms) which was missed by the kernel side. Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware. Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7 Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b19a0f610088a1416d118b4f89b1e2fda9eeb7ca Author: Ian Rogers Date: Mon Sep 29 10:06:00 2025 -0700 perf build: Remove libtracefs configuration libtracefs isn't used by perf but not having it installed causes build warnings. Given the library isn't used, there is no need for the configuration or warnings so remove. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250929170600.59000-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4092fc5f35cecb01d59b2cdf7740b203eac6948a Author: Conor Dooley Date: Wed Oct 1 19:31:12 2025 +0100 spi: dt-bindings: cadence: add soc-specific compatible strings for zynqmp and versal-net When the binding for the Cadence spi controller was written, a dedicated compatible was added for the zynq device. Later when zynqmp and versal-net, which also use this spi controller IP, were added they did not receive soc-specific compatibles. Add them now, with a fallback to the existing compatible for the r1p6 version of the IP so that there will be no functional change. Retain the r1p6 in the string, to match what was done for zynq. Disallow the cdns,spi-r1p6 compatible in isolation to "encourage" people to actually add soc-specific compatible strings in the future. Signed-off-by: Conor Dooley Acked-by: Michal Simek Link: https://patch.msgid.link/20251001-basics-grafting-a1a214ef65ac@spud Signed-off-by: Mark Brown commit bace10b59624e6bd8d68bc9304357f292f1b3dcf Author: Kai Vehmanen Date: Thu Oct 2 10:47:16 2025 +0300 ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA Assumption that chain DMA module starts the link DMA when 1ms of data is available from host is not correct. Instead the firmware chain DMA module fills the link DMA with initial buffer of zeroes and the host and link DMAs are started at the same time. This results in a small error in delay calculation. This can become a more severe problem if host DMA has delays that exceed 1ms. This results in negative delay to be calculated and bogus values reported to applications. This can confuse some applications like alsa_conformance_test. Fix the issue by correctly calculating the firmware chain DMA preamble size and initializing the start offset to this value. Cc: stable@vger.kernel.org Fixes: a1d203d390e0 ("ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams") Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit bcd1383516bb5a6f72b2d1e7f7ad42c4a14837d1 Author: Kai Vehmanen Date: Thu Oct 2 10:47:15 2025 +0300 ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples When the sampling rates going in (host) and out (dai) from the DSP are different, the IPC4 delay reporting does not work correctly. Add support for this case by scaling the all raw position values to a common timebase before calculating real-time delay for the PCM. Cc: stable@vger.kernel.org Fixes: 0ea06680dfcb ("ASoC: SOF: ipc4-pcm: Correct the delay calculation") Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 59abe7bc7e7c70e9066b3e46874d1b7e6a13de14 Author: Ranjani Sridharan Date: Thu Oct 2 10:31:25 2025 +0300 ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down In the case of static pipelines, freeing the widgets in the pipelines that were not suspended after freeing the scheduler widgets results in errors because the secondary cores are powered off when the scheduler widgets are freed. Fix this by tearing down the leftover pipelines before powering off the secondary cores. Cc: stable@vger.kernel.org Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic") Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Kai Vehmanen Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002073125.32471-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ef2b6e0317d82731b4d083e53839d966059c5ddd Author: T Pratham Date: Tue Sep 30 15:40:26 2025 +0530 crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES-ECB and AES-CBC algorithms so as to properly indicate driver capabilities. Suggested-by: Herbert Xu Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)") Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit e649c3662b4fd9d4e01607c91a0facc7d9005570 Author: Geert Uytterhoeven Date: Tue Sep 30 15:47:11 2025 +0200 thermal: renesas: Fix RZ/G3E fall-out - Restore sort order in MAINTAINERS and Kconfig, - Remove empty trailing line from Makefile. Fixes: 19d3a401a617c68e ("thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC") Signed-off-by: Geert Uytterhoeven Signed-off-by: Rafael J. Wysocki commit 7a75a5da79ef9006e7f051341b768245c814efa0 Merge: 4d164e08cd8457 bf42df09b6aa4e Author: Petr Mladek Date: Thu Oct 2 10:33:08 2025 +0200 Merge branch 'rework/ringbuffer-kunit-test' into for-linus commit 9aa791c8d7bfc46d8e155cfd812674e8ffedf6b9 Author: Richard Weinberger Date: Wed Aug 20 09:12:46 2025 +0100 ARM: 9457/1: ftrace: Implement HAVE_FUNCTION_GRAPH_FREGS Enable support for ftrace's funcgraph-retval feature by capturing r0-r3 and fp. Since ARM does not provide its own __arch_ftrace_regs structure, we instead populate pt_regs with the registers required by ftrace. Cc: Donglin Peng Signed-off-by: Richard Weinberger Signed-off-by: Russell King (Oracle) commit fb0e5f266ebc86eb97e061ce5e3a74370c16de53 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:26 2025 +0100 ARM: 9456/1: mm: fault: use string choices helper We can use string choices helper, let's use it. It makes one line code. Signed-off-by: Kuninori Morimoto Signed-off-by: Russell King (Oracle) commit 2a295922a20b82f8713ae753705cdf6900d912f5 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:51 2025 +0100 ARM: 9454/1: kernel: bios32: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Signed-off-by: Russell King (Oracle) commit c085ddfd22da76ef64bfd3005c3fe0626324b285 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:18 2025 +0100 ARM: 9451/1: mm: l2x0: use string choices helper We can use string choices helper, let's use it. It updates format - ..."%sabled", ...? "en" : "dis", + ..."%s", ... str_enabled_disabled(...) ^^^^^ Signed-off-by: Kuninori Morimoto Signed-off-by: Russell King (Oracle) commit 81c1a15eb4a273eabedfcc28eb6afa4b50cb8a46 Author: Herbert Xu Date: Tue Sep 30 16:08:34 2025 +0800 crypto: zstd - Fix compression bug caused by truncation Use size_t for the return value of zstd_compress_cctx as otherwise negative errors will be truncated to a positive value. Reported-by: Han Xu Fixes: f5ad93ffb541 ("crypto: zstd - convert to acomp") Signed-off-by: Herbert Xu Reviewed-by: David Sterba Tested-by: Han Xu Signed-off-by: Herbert Xu commit 3b63efa21bc6acc1a0fadd1dd0f0e1988a4c0177 Author: Geert Uytterhoeven Date: Tue Sep 30 16:44:27 2025 +0200 tee: QCOMTEE should depend on ARCH_QCOM The Qualcomm Trusted Execution Environment (QTEE) is only available on Qualcomm SoCs. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm platform support. Fixes: d6e290837e50f73f ("tee: add Qualcomm TEE driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Konrad Dybcio Signed-off-by: Jens Wiklander commit 7f7072574127c9e971cad83a0274e86f6275c0d5 Merge: c0f53f0d2e761e 2ea77fca84f078 Author: Linus Torvalds Date: Wed Oct 1 20:58:51 2025 -0700 Merge tag 'kbuild-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild updates from Nathan Chancellor: - Extend modules.builtin.modinfo to include module aliases from MODULE_DEVICE_TABLE for builtin modules so that userspace tools (such as kmod) can verify that a particular module alias will be handled by a builtin module - Bump the minimum version of LLVM for building the kernel to 15.0.0 - Upgrade several userspace API checks in headers_check.pl to errors - Unify and consolidate CONFIG_WERROR / W=e handling - Turn assembler and linker warnings into errors with CONFIG_WERROR / W=e - Respect CONFIG_WERROR / W=e when building userspace programs (userprogs) - Enable -Werror unconditionally when building host programs (hostprogs) - Support copy_file_range() and data segment alignment in gen_init_cpio to improve performance on filesystems that support reflinks such as btrfs and XFS - Miscellaneous small changes to scripts and configuration files * tag 'kbuild-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (47 commits) modpost: Initialize builtin_modname to stop SIGSEGVs Documentation: kbuild: note CONFIG_DEBUG_EFI in reproducible builds kbuild: vmlinux.unstripped should always depend on .vmlinux.export.o modpost: Create modalias for builtin modules modpost: Add modname to mod_device_table alias scsi: Always define blogic_pci_tbl structure kbuild: extract modules.builtin.modinfo from vmlinux.unstripped kbuild: keep .modinfo section in vmlinux.unstripped kbuild: always create intermediate vmlinux.unstripped s390: vmlinux.lds.S: Reorder sections KMSAN: Remove tautological checks objtool: Drop noinstr hack for KCSAN_WEAK_MEMORY lib/Kconfig.debug: Drop CLANG_VERSION check from DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT riscv: Remove ld.lld version checks from many TOOLCHAIN_HAS configs riscv: Unconditionally use linker relaxation riscv: Remove version check for LTO_CLANG selects powerpc: Drop unnecessary initializations in __copy_inst_from_kernel_nofault() mips: Unconditionally select ARCH_HAS_CURRENT_STACK_POINTER arm64: Remove tautological LLVM Kconfig conditions ARM: Clean up definition of ARM_HAS_GROUP_RELOCS ... commit 37e263e68c5e27d5f1fbc1377f64f9373dc5bf15 Author: Rajasi Mandal Date: Mon Sep 22 08:24:16 2025 +0000 cifs: client: force multichannel=off when max_channels=1 Previously, specifying both multichannel and max_channels=1 as mount options would leave multichannel enabled, even though it is not meaningful when only one channel is allowed. This led to confusion and inconsistent behavior, as the client would advertise multichannel capability but never establish secondary channels. Fix this by forcing multichannel to false whenever max_channels=1, ensuring the mount configuration is consistent and matches user intent. This prevents the client from advertising or attempting multichannel support when it is not possible. Signed-off-by: Rajasi Mandal Signed-off-by: Steve French commit aa12118dbcfe659697567c9daa0eac2c71e3fd37 Author: Bharath SM Date: Fri Sep 26 10:13:50 2025 -0500 smb client: fix bug with newly created file in cached dir Test generic/637 spotted a problem with create of a new file in a cached directory (by the same client) could cause cases where the new file does not show up properly in ls on that client until the lease times out. Fixes: 037e1bae588e ("smb: client: use ParentLeaseKey in cifs_do_create") Cc: stable@vger.kernel.org Signed-off-by: Bharath SM Signed-off-by: Steve French commit 316025335a2d41dc71c47abf6eb9a41987e94c0a Author: Henrique Carvalho Date: Mon Sep 8 22:04:23 2025 -0300 smb: client: short-circuit negative lookups when parent dir is fully cached When the parent directory has a valid and complete cached enumeration we can assume that negative dentries are not present in the directory, thus we can return without issuing a request. This reduces traffic for common ENOENT when the directory entries are cached. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 55580ad027a6764b7b1ee75f537d67811a06307f Author: Henrique Carvalho Date: Thu Sep 18 18:39:51 2025 -0300 smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry When dentry is NULL, the current code acquires the spinlock and traverses the entire list, but the condition (dentry && cfid->dentry == dentry) ensures no match will ever be found. Return -ENOENT early in this case, avoiding unnecessary lock acquisition and list traversal. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 2f6a4af028dbb392d55b261cafcb922dd7b7ffea Author: Henrique Carvalho Date: Thu Sep 18 22:44:34 2025 -0300 smb: client: remove pointless cfid->has_lease check open_cached_dir() will only return a valid cfid, which has both has_lease = true and time != 0. Remove the pointless check of cfid->has_lease right after open_cached_dir() returns no error. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit c0f53f0d2e761e780608cf72737f93bc75539da4 Merge: 30bbcb44707a97 19692013415486 Author: Linus Torvalds Date: Wed Oct 1 20:41:10 2025 -0700 Merge tag 'linux_kselftest-next-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - Fix watchdog test to exit when device doesn't support keep-alive - Fix missing header build complaints during out of tree build - A few minor fixes to git ignore - MAINTAINERS file change to update dma_map_benchmark * tag 'linux_kselftest-next-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: MAINTAINERS: add myself and Barry to dma_map_benchmark maintainers selftests/kexec: Ignore selftest binary selftests: always install UAPI headers to the correct directory selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported commit 6c7fd184234336a3b998fdf8f8db51e970dd6071 Author: Fiona Ebner Date: Mon Sep 15 17:19:40 2025 +0200 smb: client: transport: minor indentation style fix Signed-off-by: Fiona Ebner Signed-off-by: Steve French commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a Author: Fiona Ebner Date: Mon Sep 15 17:19:39 2025 +0200 smb: client: transport: avoid reconnects triggered by pending task work When io_uring is used in the same task as CIFS, there might be unnecessary reconnects, causing issues in user-space applications like QEMU with a log like: > CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server Certain io_uring completions might be added to task_work with notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for the task. In __smb_send_rqst(), signals are masked before calling smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL. If sk_stream_wait_memory() is reached via sock_sendmsg() while TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to true there, and -EINTR will be propagated all the way from sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec(). Afterwards, __smb_send_rqst() will see that not everything was written and reconnect. Signed-off-by: Fiona Ebner Signed-off-by: Steve French commit 17ef15fa80cf3b60b6f82ea1d88fa499d5495994 Author: Henrique Carvalho Date: Mon Jun 2 17:45:17 2025 -0300 smb: client: remove unused fid_lock The fid_lock in struct cached_fid does not currently provide any real synchronization. Previously, it had the intention to prevent a double release of the dentry, but every change to cfid->dentry is already protected either by cfid_list_lock (while the entry is in the list) or happens after the cfid has been removed (so no other thread should find it). Since there is no scenario in which fid_lock prevents any race, it is vestigial and can be removed along with its associated spin_lock()/spin_unlock() calls. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 5676398315b73f21d6a4e2d36606ce94e8afc79e Author: Henrique Carvalho Date: Thu Sep 18 22:41:58 2025 -0300 smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() open_cached_dir_by_dentry() was missing an update of cfid->last_access_time to jiffies, similar to what open_cached_dir() has. Add it to the function. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit a365f2c049b3846640234bc25e4f8c46abea6c98 Author: Steve French Date: Wed Oct 1 21:49:59 2025 -0500 smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid open_cached_dir_by_dentry() was exposing an invalid cached directory to callers. The validity check outside the function was exclusively based on cfid->time. Add validity check before returning success and introduce is_valid_cached_dir() helper for consistent checks across the code. Signed-off-by: Henrique Carvalho Reviwed-by: Enzo Matsumiya Signed-off-by: Steve French commit 63eb8bd6c81d84a23fdc18fffd604e3ea38bb96c Author: Bharath SM Date: Mon Sep 29 15:57:46 2025 -0500 smb: client: account smb directory cache usage and per-tcon totals Add lightweight accounting for directory lease cache usage to aid debugging and limiting cache size in future. Track per-directory entry/byte counts and maintain per-tcon aggregates. Also expose the totals in /proc/fs/cifs/open_dirs. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 30bbcb44707a97fcb62246bebc8b413b5ab293f8 Merge: d2b2fea3503e5e 285cae57a51664 Author: Linus Torvalds Date: Wed Oct 1 19:15:11 2025 -0700 Merge tag 'linux_kselftest-kunit-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: - New parameterized test features KUnit parameterized tests supported two primary methods for getting parameters: - Defining custom logic within a generate_params() function. - Using the KUNIT_ARRAY_PARAM() and KUNIT_ARRAY_PARAM_DESC() macros with a pre-defined static array and passing the created *_gen_params() to KUNIT_CASE_PARAM(). These methods present limitations when dealing with dynamically generated parameter arrays, or in scenarios where populating parameters sequentially via generate_params() is inefficient or overly complex. These limitations are fixed with a parameterized test method - Fix issues in kunit build artifacts cleanup - Fix parsing skipped test problem in kselftest framework - Enable PCI on UML without triggering WARN() - a few other fixes and adds support for new configs such as MIPS * tag 'linux_kselftest-kunit-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Extend kconfig help text for KUNIT_UML_PCI rust: kunit: allow `cfg` on `test`s kunit: qemu_configs: Add MIPS configurations kunit: Enable PCI on UML without triggering WARN() Documentation: kunit: Document new parameterized test features kunit: Add example parameterized test with direct dynamic parameter array setup kunit: Add example parameterized test with shared resource management using the Resource API kunit: Enable direct registration of parameter arrays to a KUnit test kunit: Pass parameterized test context to generate_params() kunit: Introduce param_init/exit for parameterized test context management kunit: Add parent kunit for parameterized test context kunit: tool: Accept --raw_output=full as an alias of 'all' kunit: tool: Parse skipped tests from kselftest.h kunit: Always descend into kunit directory during build commit dde6667fa3c8f52ec4b8afd487749e47d032d833 Author: Bharath SM Date: Tue Sep 2 01:16:00 2025 +0530 smb: client: add drop_dir_cache module parameter to invalidate cached dirents Add write-only /sys/module/cifs/parameters/drop_dir_cache. Writing a non-zero value iterates all tcons and calls invalidate_all_cached_dirs() to drop cached directory entries. This is useful to force a dirent cache drop across mounts for debugging and testing purpose. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 68247d45c045bb7dda923cf2c8d0937ce0e16394 Author: Geert Uytterhoeven Date: Tue Sep 30 16:50:23 2025 +0200 clk: COMMON_CLK_RPMI should depend on RISCV The RISC-V platform management interface (RPMI) is only available on RISC-V platforms. Hence add a dependency on RISCV, to prevent asking the user about this driver when configuring a kernel for a different architecture. Fixes: 5ba9f520f41a33c9 ("clk: Add clock driver for the RISC-V RPMI clock service group") Signed-off-by: Geert Uytterhoeven Signed-off-by: Paul Walmsley commit d2b2fea3503e5e12b2e28784152937e48bcca6ff Merge: 42cbaeec987b9f edcc8a38b5ac1a Author: Linus Torvalds Date: Wed Oct 1 17:47:16 2025 -0700 Merge tag 'asm-generic-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "Two small patches for the asm-generic header files: Varad Gautam improves the MMIO tracing to be faster when the tracepoints are built into the kernel but disabled, while Qi Xi updates the DO_ONCE logic so that clearing the WARN_ONCE() flags does not change the other DO_ONCE users" * tag 'asm-generic-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: once: fix race by moving DO_ONCE to separate section asm-generic/io.h: Skip trace helpers if rwmmio events are disabled commit 42cbaeec987b9fb91045060f2e7ce3152458ead9 Merge: 38057e32365769 65d2419f931c08 Author: Linus Torvalds Date: Wed Oct 1 17:41:15 2025 -0700 Merge tag 'soc-arm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The at91 power management code and the TI AM33 platform each get a few updates for robustness, the other changes are just minor cleanups" * tag 'soc-arm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: versatile: clock: convert from round_rate() to determine_rate() ARM: rockchip: remove REGULATOR conditional to PM ARM: at91: pm: Remove 2.5V regulator ARM: OMAP2+: clock: convert from round_rate() to determine_rate() ARM: OMAP1: clock: convert from round_rate() to determine_rate() ARM: mach-hpe: Rework support and directory structure arm: omap2: use string choices helper ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init ARM: OMAP2+: use IS_ERR_OR_NULL() helper ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) ARM: at91: pm: save and restore ACR during PLL disable/enable ARM: at91: pm: fix MCKx restore routine ARM: at91: pm: fix .uhp_udp_mask specification for current SoCs ARM: shmobile: rcar-gen2: Use SZ_256K definition commit 38057e323657695ec8f814aff0cdd1c7e00d3e9b Merge: f8912147dba3e9 c4ebd661282df5 Author: Linus Torvalds Date: Wed Oct 1 17:32:51 2025 -0700 Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "Lots of platform specific updates for Qualcomm SoCs, including a new TEE subsystem driver for the Qualcomm QTEE firmware interface. Added support for the Apple A11 SoC in drivers that are shared with the M1/M2 series, among more updates for those. Smaller platform specific driver updates for Renesas, ASpeed, Broadcom, Nvidia, Mediatek, Amlogic, TI, Allwinner, and Freescale SoCs. Driver updates in the cache controller, memory controller and reset controller subsystems. SCMI firmware updates to add more features and improve robustness. This includes support for having multiple SCMI providers in a single system. TEE subsystem support for protected DMA-bufs, allowing hardware to access memory areas that managed by the kernel but remain inaccessible from the CPU in EL1/EL0" * tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (139 commits) soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu() soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver soc: fsl: qe: Change GPIO driver to a proper platform driver tee: fix register_shm_helper() pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" dt-bindings: spmi: Add Apple A11 and T2 compatible serial: qcom-geni: Load UART qup Firmware from linux side spi: geni-qcom: Load spi qup Firmware from linux side i2c: qcom-geni: Load i2c qup Firmware from linux side soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem soc: qcom: geni-se: Cleanup register defines and update copyright dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus Documentation: tee: Add Qualcomm TEE driver tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl tee: qcom: add primordial object tee: add Qualcomm TEE driver tee: increase TEE_MAX_ARG_SIZE to 4096 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF tee: add close_context to TEE driver operation ... commit f8912147dba3e9688b290aab0987bc9b0c6bb9a3 Merge: 0f048c878ee32a 1f76c941c29bff Author: Linus Torvalds Date: Wed Oct 1 17:25:57 2025 -0700 Merge tag 'soc-defconfig-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "Only a small set up updates, enabling a few drivers for Artpec, THead, Renesas and Broadcom chips, and cleaning out some Qualcomm options that were removed previously" * tag 'soc-defconfig-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: configs: u8500: Set NFC_SHDLC as built-in riscv: defconfig: Enable MMP_PDMA support for SpacemiT K1 SoC riscv: defconfig: run savedefconfig to reorder it ARM: defconfig: Remove obsolete CONFIG_USB_EHCI_MSM arm64: defconfig: Enable Marvell WiFi-Ex USB driver arm64: defconfig: Enable BCM2712 on-chip pin controller driver arm64: defconfig: Enable Axis ARTPEC SoC ARM: s3c6400_defconfig: Drop MTD_NAND_S3C2410 ARM: defconfig: pxa: Remove duplicate CONFIG_USB_GPIO_VBUS entry ARM: defconfig: cleanup orphaned CONFIGs arm64: defconfig: enable i.MX91 pinctrl arm64: defconfig: Enable X1P42100 GPUCC driver arm64: defconfig: Enable QCS615 clock controllers arm64: defconfig: Enable the RZ/V2H(P) RSPI driver arm64: defconfig: Enable Renesas RZ/T2H serial SCI commit 0f048c878ee32a4259dbf28e0ad8fd0b71ee0085 Merge: a8253f807760e9 8c0650e0cef283 Author: Linus Torvalds Date: Wed Oct 1 17:19:38 2025 -0700 Merge tag 'soc-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC dt updates from Arnd Bergmann: "There are five sets of new SoCs that get added in existing families, all of them being either upgrades or cut-down versions of the older chips: - Apple M2 Pro, M2 Max and M2 Ultra, used in the 2022/2023 generation of high-end workstations and laptops from Apple. Linux has been working on these for a while but stil requires patches. - Axis Artpec8 is an Armv8 chip based on Samsung Exynos design, unlike the earlier Armv7 Artpec6 from the same company that was part of a separate family of chips. - NXP i.MX91 is a cut-down version of i.MX93, using only a single Cortex-A55 core. - Qualcomm Lemans Auto is a variant of the Lemans SoC that was originally merged under the sa8775p name, the differences being mostly the firmware configuration of the platform. - Four new Renesas SoCs RZ/T2H (r9a09g077m44), RZ/N2H (r9a09g087m44), RZ/T2H (r9a09g077), and RZ/N2H (r9a09g087) are all industrial bedded SoCs based on Cortex-A55 cores In total, there are 65 new machines, including: - Industrial embedded system and single-board computers based on NXP, Allwinner, TI, Rockchips, Marvell, Xilinx Spacemit, Starfive chips. - Reference boards for the newly added Renesas, Qualcomm, NXP and Axis ARMv8 chips as well as Microchip's MPFS RISC-V SoC - Laptops and Workstations using Apple M2 and Qualcomm Snapdragon X1 chips. - Several Samsung phones using Qualcomm Snapdragon chips - Set-top boxes based on Allwinner H313 - Five BMC boards using 32-bit ASpeed SoCs - Three network routers using IXP4xx (ARMv5!) and Broadcom bcm4708 (ARMv7) SoCs Two machines get phased out because they were available only in small quantities but never made it into products: one STi407 based reference board, and a Snapdragon 845 based Chromebook. Aside from the newly added machines, a lot of work went into improving hardware support on the existing machines and cleaning up contents for validation" * tag 'soc-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (931 commits) arm64: dts: apm-shadowcat: Drop "apm,xgene2-pcie" compatible arm64: dts: apm-shadowcat: Move slimpro nodes out of "simple-bus" node ARM: dts: microchip: sam9x7: Add qspi controller arm64: dts: qcom: Add MST pixel streams for displayport arm64: dts: qcom: sm6350: correct DP compatibility strings arm64: dts: qcom: monaco-evk: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300-ride: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300: Add gpu and gmu nodes arm64: dts: allwinner: h313: Add Amediatech X96Q dt-bindings: arm: sunxi: Add Amediatech X96Q arm64: dts: apple: t8015: Add SPMI node arm64: dts: apple: t8012: Add SPMI node arm64: dts: apple: Add J180d (Mac Pro, M2 Ultra, 2023) device tree arm64: dts: rockchip: Add devicetree for the ROC-RK3588-RT dt-bindings: arm: rockchip: Add Firefly ROC-RK3588-RT arm64: dts: rockchip: update pinctrl names for Radxa E52C arm64: dts: rockchip: remove vcc_3v3_pmu regulator for Radxa E52C arm64: dts: apple: Add J474s, J475c and J475d device trees arm64: dts: apple: Add J414 and J416 Macbook Pro device trees arm64: dts: apple: Add initial t6020/t6021/t6022 DTs ... commit a8253f807760e9c80eada9e5354e1240ccf325f9 Merge: 9792d660a4e91d fee2f45def0379 Author: Linus Torvalds Date: Wed Oct 1 17:10:27 2025 -0700 Merge tag 'soc-newsoc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull new SoC support from Arnd Bergmann: "Pinkesh Vaghela adds support for the ESWIN EIC7700 SoC consisting of SiFive Quad-Core P550 CPU cluster and the first development board that uses it, the SiFive HiFive Premier P550 [1]. This adds initial device tree and also adds ESWIN architecture support. Boot-tested using intiramfs with Linux v6.17-rc3 on HiFive Premier P550 board using U-Boot 2024.01 and OpenSBI 1.4" Link: https://lore.kernel.org/linux-riscv/20250825132427.1618089-1-pinkesh.vaghela@einfochips.com/ [1] * tag 'soc-newsoc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: dts: eswin: add HiFive Premier P550 board device tree riscv: dts: add initial support for EIC7700 SoC dt-bindings: interrupt-controller: Add ESWIN EIC7700 PLIC dt-bindings: riscv: Add SiFive HiFive Premier P550 board riscv: Add Kconfig option for ESWIN platforms dt-bindings: riscv: Add SiFive P550 CPU compatible commit 9792d660a4e91d31a6b1af105ae3f1c29107e94b Merge: f13ee7cc2dca5e 129b91fc329604 Author: Linus Torvalds Date: Wed Oct 1 16:58:24 2025 -0700 Merge tag 'devicetree-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT core: - Update dtc to upstream version v1.7.2-35-g52f07dcca47c - Add stub for of_get_next_child_with_prefix() - Convert of_msi_map_id() callers to of_msi_xlate() DT bindings: - Convert multiple text board bindings to DT schema format - Add bindings for synaptics,synaptics_i2c touchscreen controller, innolux,n133hse-ea1 and nlt,nl12880bc20-spwg-24 displays, and NXP vf610 reboot controller - Add new Arm Cortex-A320/A520AE/A720AE and C1-Nano/Pro/Premium/Ultra CPUs. Add missing Applied Micro CPU compatibles. Add pu-supply and fsl,soc-operating-points properties for CPU nodes. - Add QCom Glymur PDC and tegra264-agic interrupt controllers - Add samsung,exynos8890-mali GPU to Arm Mali Midgard - Drop Samsung S3C2410 display related bindings - Allow separate DP lane and AUX connections in dp-connector - Add some missing, undocumented vendor prefixes - Add missing '#address-cells' properties in interrupt controller bindings which dtc now warns about - Drop duplicate socfpga-sdram-edac.txt, moxa,moxart-watchdog.txt, fsl/mpic.txt, ti,opa362.txt, and cavium-thunder2.txt legacy text bindings which are already covered by existing schemas. - Various binding fixes for Mediatek platforms in mailbox, regulator, pinctrl, timer, and display - Drop work-around for yamllint quoting of values containing ',' - Various spelling, typo, grammar, and duplicated words fixes in DT bindings and docs - Add binding guidelines for defining properties at top level of schemas, lack of node name ABI, and usage of simple-mfd" * tag 'devicetree-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (81 commits) dt-bindings: arm: altera: Drop socfpga-sdram-edac.txt dt-bindings: gpu: Convert nvidia,gk20a to DT schema dt-bindings: rng: sparc_sun_oracle_rng: convert to DT schema dt-bindings: vendor-prefixes: update regex for properties without a prefix dt-bindings: display: bridge: convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml scripts: dt_to_config: fix grammar and a typo in --help text dt-bindings: fix spelling, typos, grammar, duplicated words docs: dt: fix grammar and spelling of: base: Add of_get_next_child_with_prefix() stub dt-bindings: trivial-devices: Add compatible string synaptics,synaptics_i2c dt-bindings: soc: mediatek: pwrap: Add power-domains property dt-bindings: pinctrl: mt65xx: Allow gpio-line-names dt-bindings: media: Convert MediaTek mt8173-vpu bindings to DT schema dt-bindings: arm: mediatek: Support mt8183-audiosys variant dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional dt-bindings: regulator: mediatek,mt6331: Add missing compatible dt-bindings: regulator: mediatek,mt6331: Fix various regulator names dt-bindings: regulator: mediatek,mt6332-regulator: Add missing compatible dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing base reg dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing pwm_ch7_2 ... commit f13ee7cc2dca5ebbd7f01e14d6c8db1caabd863b Merge: 679a16399af080 2085f0f4697234 Author: Linus Torvalds Date: Wed Oct 1 16:33:14 2025 -0700 Merge tag 'thermal-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These are mostly thermal driver updates, including new thermal drivers for Renesas RZ/G3S and Renesas RZ/G3E SoCs, a new power slider platform feature support in the Intel int340x thermal driver, a new Tegra114- specific SOCTHERM driver and more. There is also a Step-wise thermal governor update allowing it to start reducing cooling somewhat earlier if the temperature of the given thermal zone is falling down and a thermal testing code cleanup. Specifics: - Add new thermal driver for the Renesas RZ/G3S SoC (Claudiu Beznea) - Add new thermal driver for the Renesas RZ/G3E SoC (John Madieu) - Add support for new platform power slider feature to the Intel int340x driver (Srinivas Pandruvada). - Add new Tegra114-specific SOCTHERM driver and document Tegra114 SOCTHERM Thermal Management System in DT bindings (Svyatoslav Ryhel) - Add temperature sensor channel to thermal-generic-adc (Svyatoslav Ryhel) - Add support for per-SoC default trim values to the Renesas rcar_gen3 thermal driver, use it for adding R-Car V4H default trim values, fix a comment typo in that driver and document Gen4 support in its Kconfig entry (Marek Vasut) - Fix mapping SoCs to generic Gen4 entry in the Renesas rcar_gen3 thermal driver (Wolfram Sang) - Document the TSU unit in the r9a08g045-tsu and r9a09g047-tsu DT bindings (Claudiu Beznea, John Madieu) - Make LMH select QCOM_SCM and add missing IRQ includes to the qcom/lmh thermal driver (Dmitry Baryshkov) - Fix incorrect error message in the qcom/lmh thermal driver (Sumeet Pawnikar) - Add QCS615 compatible to tsens thermal DT bindings (Gaurav Kohli) - Document the Glymur temperature sensor in qcom-tsens thermal DT bindings (Manaf Meethalavalappu Pallikunhi) - Make k3_j72xx_bandgap thermal driver register the thermal sensor with hwmon (Michael Walle) - Tighten GRF requirements in the rockchip thermal DT bindings, silence a GRF warning in the rockchip thermal driver and unify struct rockchip_tsadc_chip format in it (Sebastian Reichel) - Update the Step-wise thermal governor to allow it to reduce the cooling level earlier if thermal zone temperature is dropping and clean it up (Rafael Wysocki) - Clean up the thermal testing code (Rafael Wysocki) - Assorted cleanups of thermal drivers (Jiapeng Chong, Salah Triki, Osama Abdelkader)" * tag 'thermal-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (37 commits) thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit thermal/drivers/thermal-generic-adc: Add temperature sensor channel dt-bindings: thermal: rockchip: Tighten grf requirements thermal/drivers/rockchip: Shut up GRF warning thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver dt-bindings: thermal: add Tegra114 soctherm header thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry thermal/drivers/rcar_gen3: Fix comment typo drivers/thermal/qcom/lmh: Fix incorrect error message thermal/drivers/qcom/lmh: Add missing IRQ includes ... commit 679a16399af08088a83e1d30e01c31832f055ae7 Merge: 991053178e08fb c87072064bd482 Author: Linus Torvalds Date: Wed Oct 1 16:24:50 2025 -0700 Merge tag 'acpi-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These include an ACPICA update (upstream revision 20250807 with a few fixes on top), fixes and cleanups of the ACPI processor driver, fixes and cleanups of the ACPI properties management code, one more ACPI IRQ resource management quirk, one more ACPI backlight quirk, an ACPI device enumeration quirk related to _DEP, a power resource quirk related to WWAN modem for HP EliteBook 855 G7, ACPI SPCR table parser extensions, an ACPI APEI EINJ driver update allowing it to handle more address types, and several assorted cleanups of ACPI drivers and PNP code. Specifics: - Add SoundWire File Table (SWFT) signature to ACPICA (Maciej Strozek) - Rearrange local variable definition involving #ifdef in ACPICA to avoid using uninitialized variables (Zhe Qiao) - Allow ACPICA to skip Global Lock initialization (Huacai Chen) - Apply ACPI_NONSTRING in more places in ACPICA and fix two regressions related to incorrect ACPI_NONSTRING usage (Ahmed Salem) - Fix printing CDAT table header when dissasebling CDAT AML (Ahmed Salem) - Use acpi_ds_clear_operands() in acpi_ds_call_control_method() in ACPICA (Hans de Goede) - Update dsmethod.c in ACPICA to address unused variable warning (Saket Dumbre) - Print error messages in ACPICA for too few or too many control method arguments (Saket Dumbre) - Update ACPICA version to 20250807 (Saket Dumbre) - Fix largest possible resource descriptor index in ACPICA (Dmitry Antipov) - Add Back-Invalidate restriction to CXL Window for CEDT in ACPICA (Davidlohr Bueso) - Add the package type to acceptable Arg3 types for _DSM in ACPICA because ACPI_TYPE_ANY does not cover it (Saket Dumbre) - Fix return values in ap_is_valid_checksum() in the acpidump utility in ACPICA (Kaushlendra Kumar) - Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] so it is not regarded as real dependency (Hans de Goede) - Use ACPI_FREE() for freeing an ACPI object in description_show() in the ACPI sysfs-related code (Kaushlendra Kumar) - Fix memory leak in the ACPI processor idle driver registration error code path and optimize ACPI idle driver registration (Huisong Li, Rafael Wysocki) - Add module import namespace to the ACPI processor idle driver (Rafael Wysocki) - Eliminate static variable flat_state_cnt from the ACPI processor idle driver (Rafael Wysocki) - Release cpufreq policy references using __free() in the ACPI processor thremal driver (Zihuan Zhang) - Remove unused empty stubs of some functions and rearrange function declarations in a header file in the ACPI processor driver (Huisong Li) - Redefine two functions as void in the ACPI processor driver (Rafael Wysocki) - Stop exposing global variable acpi_idle_driver in the ACPI processor driver (Huisong Li) - Fix ACPI buffer properties extraction for data-only subnodes represented as _DSD-equivalent packages (Rafael Wysocki) - Fix handling of ACPI data-only subnodes represented as _DSD-equivalent packages in the case when they are embedded in larger _DSD-equivalent packages and clean up acpi_nondev_subnode_extract() (Rafael Wysocki) - Skip ACPI IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen) - Add power resource init function and use it for introducing an HP EliteBook 855 G7 WWAN modem power resource quirk (Maciej Szmigiero) - Add support for DBG2 RISC-V SBI port subtype and Precise Baud Rate field to the ACPI SPCR table parser (Chen Pei) - Eliminate a dummy local variable from the ACPI thermal driver (Rafael Wysocki) - Fold two simple functions into their only caller in the ACPI fan driver (Rafael Wysocki) - Force native backlight on Lenovo 82K8 in the ACPI backlight (video) driver (Mario Limonciello) - Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang) - Skip PRM handlers with NULL handler_address or NULL VA in the ACPI PRM driver (Shang song) - Remove redundant assignments in erst_dbg_{ioctl|write}() in the ACPI APEI driver (Thorsten Blum) - Allow the ACPI APEI EINJ to handle more types of addresses than just MMIO (Jiaqi Yan) - Use str_low_high() helper in two places in the ACPI code (Chelsy Ratnawat) - Use str_plural() to simplify the PNP code (Xichao Zhao) - Fix signedness issues in read/write helpers in the ACPI AML debugger interface (Amir Mohammad)" * tag 'acpi-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (50 commits) ACPI: debug: fix signedness issues in read/write helpers ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: SPCR: Support Precise Baud Rate field ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Remove unused empty stubs of some functions ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() ACPI: property: Do not pass NULL handles to acpi_attach_data() ACPI: property: Add code comments explaining what is going on ACPI: property: Disregard references in data-only subnode lists ACPI: property: Fix buffer properties extraction for subnodes ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype ACPI: APEI: EINJ: Allow more types of addresses except MMIO ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() ACPICA: acpidump: fix return values in ap_is_valid_checksum() ACPICA: ACPI_TYPE_ANY does not include the package type ACPICA: CEDT: Add Back-Invalidate restriction to CXL Window ACPICA: Fix largest possible resource descriptor index ACPICA: Update version to 20250807 ... commit 991053178e08fb4d1f80398367db05c2cc4f20b4 Merge: 080ffb4bec4d49 40d2cf9c3c1a5a Author: Linus Torvalds Date: Wed Oct 1 16:08:37 2025 -0700 Merge tag 'pm-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "The majority of these are cpufreq changes, which has been a recurring pattern for a few recent cycles. Those changes include new hardware support (AN7583 SoC support in the airoha cpufreq driver, ipq5424 support in the qcom-nvmem cpufreq driver, MT8196 support in the mediatek cpufreq driver, AM62D2 support in the ti cpufreq driver), DT bindings and Rust code updates, cleanups of the core and governors, and multiple driver fixes and cleanups. Beyond that, there are hibernation fixes (some remaining 6.16 cycle fallout and an issue related to hybrid suspend in the amdgpu driver), cleanups of the PM core code, runtime PM documentation update, cpuidle and power capping cleanups, and tooling updates. Specifics: - Rearrange variable declarations involving __free() in the cpufreq core and intel_pstate driver to follow common coding style (Rafael Wysocki) - Fix object lifecycle issue in update_qos_request(), rearrange freq QoS updates using __free(), and adjust frequency percentage computations in the intel_pstate driver (Rafael Wysocki) - Update intel_pstate to allow it to enable HWP without EPP if the new DEC (Dynamic Efficiency Control) HW feature is enabled (Rafael Wysocki) - Use on_each_cpu_mask() in drv_write() in the ACPI cpufreq driver to simplify the code (Rafael Wysocki) - Use likely() optimization in intel_pstate_sample() (Yaxiong Tian) - Remove dead EPB-related code from intel_pstate (Srinivas Pandruvada) - Use scope-based cleanup for cpufreq policy references in multiple cpufreq drivers (Zihuan Zhang) - Avoid calling get_governor() for the first policy in the cpufreq core to simplify the initial policy path (Zihuan Zhang) - Clean up the cpufreq core in multiple places (Zihuan Zhang) - Use int type to store negative error codes in the cpufreq core and update the speedstep-lib to use int for error codes (Qianfeng Rong) - Update the efficient idle check for Intel extended Families in the ondemand cpufreq governor (Sohil Mehta) - Replace sscanf() with kstrtouint() in the conservative cpufreq governor (Kaushlendra Kumar) - Rename CpumaskVar::as[_mut]_ref to from_raw[_mut] in the cpumask Rust code and mark CpumaskVar as transparent (Alice Ryhl, Baptiste Lepers) - Update ARef and AlwaysRefCounted imports from sync::aref in the OPP Rust code (Shankari Anand) - Add support for AN7583 SoC to the airoha cpufreq driver (Christian Marangi) - Enable cpufreq for ipq5424 in the qcom-nvmem cpufreq driver (Md Sadre Alam) - Add support for MT8196 to the mediatek-hw cpufreq driver, refactor that driver and add mediatek,mt8196-cpufreq-hw DT binding (Nicolas Frattaroli) - Avoid redundant conditions in the mediatek cpufreq driver (Liao Yuanhong) - Add support for AM62D2 to the ti cpufreq driver and blocklist ti,am62d2 SoC in dt-platdev (Paresh Bhagat) - Support more speed grades on AM62Px SoC in the ti cpufreq driver, allow all silicon revisions to support OPPs in it, and fix supported hardware for 1GHz OPP (Judith Mendez) - Add QCS615 compatible to DT bindings for cpufreq-qcom-hw (Taniya Das) - Minor assorted updates of the scmi, longhaul, CPPC, and armada-37xx cpufreq drivers (Akhilesh Patil, BowenYu, Dennis Beier, and Florian Fainelli) - Remove outdated cpufreq-dt.txt (Frank Li) - Fix python gnuplot package names in the amd_pstate_tracer utility (Kuan-Wei Chiu) - Saravana Kannan will maintain the virtual-cpufreq driver (Saravana Kannan) - Prevent CPU capacity updates after registering a perf domain from failing on a first CPU that is not present (Christian Loehle) - Add support for the cases in which frequency alone is not sufficient to uniquely identify an OPP (Krishna Chaitanya Chundru) - Use to_result() for OPP error handling in Rust (Onur Özkan) - Add support for LPDDR5 on Rockhip RK3588 SoC to rockchip-dfi devfreq driver (Nicolas Frattaroli) - Fix an issue where DDR cycle counts on RK3588/RK3528 with LPDDR4(X) are reported as half by adding a cycle multiplier to the DFI driver in rockchip-dfi devfreq-event driver (Nicolas Frattaroli) - Fix missing error pointer dereference check of regulator instance in the mtk-cci devfreq driver probe and remove a redundant condition from an if () statement in that driver (Dan Carpenter, Liao Yuanhong) - Fail cpuidle device registration if there is one already to avoid sysfs-related issues (Rafael Wysocki) - Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() in cpuidle (Vivek Yadav) - Fix device and OF node leaks at probe in the qcom-spm cpuidle driver and drop unnecessary initialisations from it (Johan Hovold) - Remove unnecessary address-of operators from the intel_idle cpuidle driver (Kaushlendra Kumar) - Rearrange main loop in menu_select() to make the code in that funtion easier to follow (Rafael Wysocki) - Convert values in microseconds to ktime using us_to_ktime() where applicable in the intel_idle power capping driver (Xichao Zhao) - Annotate loops walking device links in the power management core code as _srcu and add macros for walking device links to reduce the likelihood of coding mistakes related to them (Rafael Wysocki) - Document time units for *_time functions in the runtime PM API (Brian Norris) - Clear power.must_resume in noirq suspend error path to avoid resuming a dependant device under a suspended parent or supplier (Rafael Wysocki) - Fix GFP mask handling during hybrid suspend and make the amdgpu driver handle hybrid suspend correctly (Mario Limonciello, Rafael Wysocki) - Fix GFP mask handling after aborted hibernation in platform mode and combine exit paths in power_down() to avoid code duplication (Rafael Wysocki) - Use vmalloc_array() and vcalloc() in the hibernation core to avoid open-coded size computations (Qianfeng Rong) - Fix typo in hibernation core code comment (Li Jun) - Call pm_wakeup_clear() in the same place where other functions that do bookkeeping prior to suspend_prepare() are called (Samuel Wu) - Fix and clean up the x86_energy_perf_policy utility and update its documentation (Len Brown, Kaushlendra Kumar) - Fix incorrect sorting of PMT telemetry in turbostat (Kaushlendra Kumar) - Fix incorrect size in cpuidle_state_disable() and the error return value of cpupower_write_sysfs() in cpupower (Kaushlendra Kumar)" * tag 'pm-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (86 commits) PM: hibernate: Combine return paths in power_down() PM: hibernate: Restrict GFP mask in power_down() PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage PM: runtime: Documentation: ABI: Document time units for *_time tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry drm/amd: Fix hybrid sleep PM: hibernate: Add pm_hibernation_mode_is_suspend() PM: hibernate: Fix hybrid-sleep tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names cpufreq: Replace pointer subtraction with iteration macro cpuidle: Fail cpuidle device registration if there is one already ... commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f Author: Yuan Chen Date: Wed Oct 1 03:20:25 2025 +0100 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash. [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ... [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace: [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec : ldr x21, [x24,#120] include/linux/compiler.h: 294 0xffff3df8995039f0 : ldr x1, [x21,x0] kernel/trace/trace_kprobe.c 1308: head = this_cpu_ptr(call->perf_events); 1309: if (hlist_empty(head)) 1310: return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0 ... } Race Condition Analysis: The race occurs between kprobe activation and perf_events initialization: CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2)← KPROBE ACTIVE Debug exception triggers ... kprobe_dispatcher kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events is still NULL) Problem: 1. CPU0 executes (1) assigning tp_event->perf_events = list 2. CPU0 executes (2) enabling kprobe functionality via class->reg() 3. CPU1 triggers and reaches kprobe_dispatcher 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed) 5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned. Add pairing read and write memory barriers to guarantee that if CPU1 sees that kprobe functionality is enabled, it must also see that perf_events has been assigned. Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/ Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use") Cc: stable@vger.kernel.org Signed-off-by: Yuan Chen Signed-off-by: Masami Hiramatsu (Google) commit f09f57c7467710144e7522c7fa1abca87af8f7c6 Author: Eric Biggers Date: Mon Sep 29 12:27:21 2025 -0700 selftests/bpf: Add test for libbpf_sha256() Test that libbpf_sha256() calculates SHA-256 digests correctly. Tested with: make -C tools/testing/selftests/bpf/ ./tools/testing/selftests/bpf/test_progs -t sha256 -v Signed-off-by: Eric Biggers Signed-off-by: Alexei Starovoitov commit 080ffb4bec4d49cdedca11810395f8cad812471e Merge: cf8da11679ec4e d6ddd9beb1a5c3 Author: Linus Torvalds Date: Wed Oct 1 15:50:27 2025 -0700 Merge tag 'i3c/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "New driver: - Analog Devices I3C Controller Subsystem: - fix big-endian FIFO transfers - fix default I2C adapter timeout value Drivers: - dw: shutdown support - mipi-i3c-hci: Intel Wildcat Lake-U support, IOMMU support - renesas: RZ/V2H(P) and RZ/V2N support" * tag 'i3c/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (22 commits) i3c: fix big-endian FIFO transfers i3c: master: adi: fix number of bytes written to fifo i3c: Remove superfluous FIXME i3c: master: adi: fix header location i3c: dw: Add shutdown support to dw_i3c_master driver i3c: renesas: Simplify return statement in 'renesas_i3c_daa' dt-bindings: i3c: renesas,i3c: Add RZ/V2H(P) and RZ/V2N support i3c: master: svc: Recycle unused IBI slot i3c: master: svc: Use manual response for IBI events i3c: master: Add driver for Analog Devices I3C Controller IP dt-bindings: i3c: Add adi-i3c-master i3c: Fix default I2C adapter timeout value i3c: mipi-i3c-hci: Convert remaining DBG() prints to dev_dbg() i3c: mipi-i3c-hci: Remove function enter DBG() printouts i3c: mipi-i3c-hci: Uniform ring number printouts i3c: mipi-i3c-hci: Remove nonexistent ring interrupt i3c: mipi-i3c-hci: Change interrupt status prints to dev_dbg() i3c: mipi-i3c-hci: Use own DMA bounce buffer management for I2C transfers i3c: mipi-i3c-hci: Use physical device pointer with DMA API i3c: mipi-i3c-hci: Use core helpers for DMA mapping and bounce buffering ... commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 Author: Yazhou Tang Date: Tue Sep 30 23:04:33 2025 +0800 bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Signed-off-by: Yazhou Tang Acked-by: Yonghong Song Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov commit 1bd3773aad5411f3542aa2e5328df58454706ca6 Merge: a1aca22d264cdc 4a1c9e544b8dd0 Author: Alexei Starovoitov Date: Wed Oct 1 15:27:25 2025 -0700 Merge branch 'libbpf-fix-libbpf_sha256-for-github-compatibility' Andrii Nakryiko says: ==================== libbpf: fix libbpf_sha256() for Github compatibility Recent reimplementation of libbpf_sha256() introduced issues for libbpf's Github mirror due to reliance on linux/unaligned.h header. This patch set fixes those issues to make libbpf source code compatible with Github mirror setup. This patch set starts with a bit of organization: we introduce libbpf_utils.c as a place for generic internal helpers like libbpf_errstr() and libbpf_sha256(), and move a few existing helpers there. We also clean up libbpf_strerror_r(), which seems to be a leftover of some previous refactorings. And finally, we move libbpf_sha256() from huge libbpf.c into libbpf_utils.c, following up with fix ups to make its code more Github-friendly. v1->v2: - add missed cpu_to_be32() and be32_to_cpu() conversions inside {get/put}_unaligned_be32() macros; - target bpf tree (Alexei); - applied Eric's libbpf_sha256 selftest locally and verified it works; v1: https://lore.kernel.org/bpf/20250930212619.1645410-1-andrii@kernel.org/ ==================== Link: https://patch.msgid.link/20251001171326.3883055-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 4a1c9e544b8dd0c5456e0feb614f427dc46c4835 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:26 2025 -0700 libbpf: remove linux/unaligned.h dependency for libbpf_sha256() linux/unaligned.h include dependency is causing issues for libbpf's Github mirror due to {get,put}_unaligned_be32() usage. So get rid of it by implementing custom variants of those macros that will work both in kernel and Github mirror repos. Also switch round_up() to roundup(), as the former is not available in Github mirror (and is just a subtly more specific variant of roundup() anyways). Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-6-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit a7f36f81d0bde9e274606f771f7bfd59b2c8c083 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:25 2025 -0700 libbpf: move libbpf_sha256() implementation into libbpf_utils.c Move sha256 implementation out of already large and unwieldy libbpf.c into libbpf_utils.c where we'll keep reusable helpers. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-5-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit c68b6fdc3600466e3c265bad34d099eb8c5280f1 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:24 2025 -0700 libbpf: move libbpf_errstr() into libbpf_utils.c Get rid of str_err.{c,h} by moving implementation of libbpf_errstr() into libbpf_utils.c and declarations into libbpf_internal.h. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-4-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit d05ab6181be0060ca259a49e69de9bc95b19edb7 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:23 2025 -0700 libbpf: remove unused libbpf_strerror_r and STRERR_BUFSIZE libbpf_strerror_r() is not exposed as public API and neither is it used inside libbpf itself. Remove it altogether. Same for STRERR_BUFSIZE, it's just an orphaned leftover constant which we missed to clean up some time earlier. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit 44d42bd80804d117fd83b849820e26dafd25a5f9 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:22 2025 -0700 libbpf: make libbpf_errno.c into more generic libbpf_utils.c Libbpf is missing one convenient place to put common "utils"-like code that is generic and usable from multiple places. Use libbpf_errno.c as the base for more generic libbpf_utils.c. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit cf8da11679ec4e54e2dd3cb147fb310a2230be52 Merge: 5fb024931949f3 cb3005d4c490fe Author: Linus Torvalds Date: Wed Oct 1 15:11:00 2025 -0700 Merge tag 'i2c-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Mostly DT bindings additions this time because Andi was super busy and I also could only partly cover it. - new ids for qcom-cci, mt65xx, exynos5, apple, tegra20, k1, i801 - drop support for already removed S3C2410 - introduce and use fwnode_for_each_child_node_scoped() - mmt65xx: improve write-then-read transactions - k1: various fixes around bus errors and resets - usual share of cleanups, minor improvements, PM fixes... at24 updates: - add the compatible for Giantec GT24C256C to the device-tree bindings" * tag 'i2c-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (33 commits) i2c: i801: Add support for Intel Wildcat Lake-U dt-bindings: i2c: i2c-mt65xx: Add MediaTek MT8196/6991 compatibles i2c: designware: Add disabling clocks when probe fails i2c: designware: Fix clock issue when PM is disabled i2c: busses: Fix some spelling errors i2c: mux: Simplify boolean assignment in i2c_mux_alloc i2c: designware: use dev_err_probe() when probing platform device i2c: designware: convert to dev_err_probe() on request IRQ error i2c: spacemit: ensure SDA is released after bus reset i2c: spacemit: check SDA instead of SCL after bus reset i2c: spacemit: disable SDA glitch fix to avoid restart delay i2c: spacemit: remove stop function to avoid bus error i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD i2c: boardinfo: Annotate code used in init phase only dt-bindings: i2c: i2c-mt65xx: Document MediaTek MT6878 I2C dt-bindings: i2c: samsung,s3c2410-i2c: Drop S3C2410 i2c: s3c2410: Drop S3C2410 OF support dt-bindings: i2c: spacemit,k1-i2c: Minor whitespace cleanup in example dt-bindings: i2c: exynos5: add samsung,exynos8890-hsi2c compatible ... commit 65d2419f931c08ead6722fbb9d4bd8cecb25a7e3 Author: Brian Masney Date: Wed Oct 1 08:11:00 2025 +0200 ARM: versatile: clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Acked-by: Sudeep Holla Reviewed-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20251001061100.372737-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 1f76c941c29bffdc97212969115f1fd5f91a4aed Author: Jihed Chaibi Date: Tue Sep 30 14:27:09 2025 +0200 ARM: configs: u8500: Set NFC_SHDLC as built-in The CONFIG_NFC_SHDLC=m setting in u8500_defconfig causes a Kconfig warning because the NFC_SHDLC symbol does not support being built as a module. Change the selection from 'm' to 'y' to build the driver in-kernel. Fixes: 344cad0660ea0 ("ARM: configs: Update U8500 defconfig") Signed-off-by: Jihed Chaibi Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250930122709.28987-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit a1aca22d264cdca5b20934a2413951ea7d73c594 Merge: 0c342bfc9949df 8709c1685220e7 Author: Alexei Starovoitov Date: Wed Oct 1 13:53:20 2025 -0700 Merge branch 'bpf-fix-verifier-crash-on-bpf_neg-with-pointer-register' Brahmajit Das says: ==================== bpf: Fix verifier crash on BPF_NEG with pointer register This patch fixes a crash in the BPF verifier triggered when the BPF_NEG operation is applied to a pointer-typed register. The verifier now checks that the destination register is not a pointer before performing the operation. Tested with syzkaller reproducer and new BPF sefltest. Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58 Changes v4: Cleaning up, instead of using __is_pointer_value it's further simplified by checking if regs[insn->dst_reg].type of SCALAR_VALUE Link: Changes in v3: using __is_pointer_value to check if register if of pointer type Link: https://lore.kernel.org/all/20251001095613.267475-1-listout@listout.xyz/ Changes in v2: Checking if reg->map_ptr is NULL in bpf/log.c but with cleaner approach (wrong approach) Link: https://lore.kernel.org/all/20250923174738.1713751-1-listout@listout.xyz/ Changes in v1: Checking if reg->map_ptr is NULL in bpf/log.c (wrong approach) Link: https://lore.kernel.org/all/20250923164144.1573636-1-listout@listout.xyz/ ==================== Link: https://patch.msgid.link/20251001191739.2323644-1-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 8709c1685220e766d4d9420f96b1e8ed3175f526 Author: KaFai Wan Date: Thu Oct 2 00:47:39 2025 +0530 selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP Add a test case for BPF_NEG operation on CONST_PTR_TO_MAP. Tests if BPF_NEG operation on map_ptr is rejected in unprivileged mode and is a scalar value and do not trigger Oops in privileged mode. Signed-off-by: KaFai Wan Signed-off-by: Brahmajit Das Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251001191739.2323644-3-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 34904582b502a86fdb4d7984b12cacd2faabbe0d Author: Brahmajit Das Date: Thu Oct 2 00:47:38 2025 +0530 bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer In check_alu_op(), the verifier currently calls check_reg_arg() and adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations. However, if the destination register holds a pointer, these scalar adjustments are unnecessary and potentially incorrect. This patch adds a check to skip the adjustment logic when the destination register contains a pointer. Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58 Fixes: aced132599b3 ("bpf: Add range tracking for BPF_NEG") Suggested-by: KaFai Wan Suggested-by: Eduard Zingerman Signed-off-by: Brahmajit Das Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251001191739.2323644-2-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 0c342bfc9949dffeaa83ebdde3b4b0ce59009348 Author: Jiri Olsa Date: Wed Oct 1 14:22:23 2025 +0200 selftests/bpf: Fix realloc size in bpf_get_addrs We will segfault once we call realloc in bpf_get_addrs due to wrong size argument. Fixes: 6302bdeb91df ("selftests/bpf: Add a kprobe_multi subtest to use addrs instead of syms") Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov commit 4b2b38ea20567d842607b7bca6d618d154c78d84 Author: Jiri Olsa Date: Wed Oct 1 14:22:22 2025 +0200 selftests/bpf: Fix typo in subtest_basic_usdt after merge conflict Use proper 'called' variable name. Fixes: ae28ed4578e6 ("Merge tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/bpf/aN0JVRynHxqKy4lw@krava/ Signed-off-by: Alexei Starovoitov commit f83fcec7843dedf3fcfdef119ccca78e8f24ee63 Author: Jiri Olsa Date: Wed Oct 1 14:22:21 2025 +0200 selftests/bpf: Fix open-coded gettid syscall in uprobe syscall tests Commit 0e2fb011a0ba ("selftests/bpf: Clean up open-coded gettid syscall invocations") addressed the issue that older libc may not have a gettid() function call wrapper for the associated syscall. The uprobe syscall tests got in from tip tree, using sys_gettid in there. Fixes: 0e2fb011a0ba ("selftests/bpf: Clean up open-coded gettid syscall invocations") Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov commit 5fb024931949f3475260c84a0e4b0997af9c5530 Merge: 524c4a5daf9298 da3a88e9656c17 Author: Linus Torvalds Date: Wed Oct 1 13:14:48 2025 -0700 Merge tag 'pinctrl-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "We have GPIO awareness in the pin control core and an interesting AAEON driver. Core changes: - Allow pins to be identified/marked as GPIO mode with a special callback. The pin controller core is now "aware" if a pin is in GPIO mode if the callback is implemented in the driver, and can thus be marked as "strict", i.e. disallowing simultaneous use of a line as GPIO and another function such as I2C. This is enabled in the Qualcomm TLMM driver and also implemeted from day 1 in the new Broadcom STB driver - Rename the pin config option PIN_CONFIG_OUTPUT to PIN_CONFIG_LEVEL to better describe what the config is doing, as well as making it more intuitive what shall be returned when reading this property New drivers: - Qualcomm SDM660 LPASS LPI TLMM pin controller subdriver - Qualcomm Glymur family pin controller driver - Broadcom STB family pin controller driver - Tegra186 pin controller driver - AAEON UP pin controller support. This is some special pin controller that works as an external advanced line MUX and amplifier for signals from an Intel SoC. A cooperative effort with the GPIO maintainer was needed to reach a solution where we reuse code from the GPIO aggregator/forwarder driver - Renesas RZ/T2H and RZ/N2H pin controller support - Axis ARTPEC-8 subdriver for the Samsung pin controller driver Improvements: - Output enable (OEN) support in the Renesas RZG2L driver - Properly support bias pull up/down in the pinctrl-single driver - Move over all GPIO portions using generic MMIO GPIO to the new generic GPIO chip management which has a nice and separate API - Proper DT bindings for some older Broadcom SoCs - External GPIO (EGPIO) support in the Qualcomm SM8250 Deleted code: - Dropped the now unused Samsung S3C24xx drivers" * tag 'pinctrl-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (75 commits) pinctrl: use more common syntax for compound literals pinctrl: Simplify printks with pOF format pinctrl: qcom: Add SDM660 LPASS LPI TLMM dt-bindings: pinctrl: qcom: Add SDM660 LPI pinctrl pinctrl: qcom: lpass-lpi: Add ability to use custom pin offsets pinctrl: qcom: Add glymur pinctrl driver dt-bindings: pinctrl: qcom: Add Glymur pinctrl pinctrl: qcom: sm8250: Add egpio support pinctrl: generic: rename PIN_CONFIG_OUTPUT to LEVEL pinctrl: keembay: fix double free in keembay_build_functions() pinctrl: spacemit: fix typo in PRI_TDI pin name pinctrl: eswin: Fix regulator error check and Kconfig dependency pinctrl: bcm: Add STB family pin controller driver dt-bindings: pinctrl: Add support for Broadcom STB pin controller pinctrl: qcom: make the pinmuxing strict pinctrl: qcom: mark the `gpio` and `egpio` pins function as non-strict functions pinctrl: qcom: add infrastructure for marking pin functions as GPIOs pinctrl: allow to mark pin functions as requestable GPIOs pinctrl: qcom: use generic pin function helpers pinctrl: make struct pinfunction a pointer in struct function_desc ... commit 524c4a5daf92982cf16d9e6c8cdf8721abe35a11 Merge: 3ee22ad492a493 d46651d4e3c0ca Author: Linus Torvalds Date: Wed Oct 1 13:10:30 2025 -0700 Merge tag 'for-linus-6.18-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Bug fixes and enhancements for IPMI This fixes a number of small bugs, but has some more major changes: - Loongson-2K BMC support is added. This is an MFD device and is dependent on the changes coming from that tree. The way the driver handles BMCs that have become non-functional has been completely redone. A number of changes in the past have attempted to handle various issues around this, but nothing has been very good. After working with some people on this, the code has been reworked to disable the driver and fail all pending operations if the BMC becomes non functional. It will retry the BMC once a second to see if it's back up" * tag 'for-linus-6.18-1' of https://github.com/cminyard/linux-ipmi: ipmi: Add Loongson-2K BMC support ipmi:si: Gracefully handle if the BMC is non-functional ipmi: Rename "user_data" to "recv_msg" in an SMI message ipmi: Allow an SMI sender to return an error ipmi:si: Move flags get start to its own function ipmi:si: Merge some if statements ipmi: Set a timer for maintenance mode ipmi: Add a maintenance mode sysfs file ipmi: Disable sysfs access and requests in maintenance mode ipmi: Differentiate between reset and firmware update in maintenance dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: Add missing "clocks" property ipmi: Rework user message limit handling Revert "ipmi: fix msg stack when IPMI is disconnected" ipmi:msghandler:Change seq_lock to a mutex commit 3ee22ad492a49303f54d4e1c5168327742ac7aaf Merge: dba8acc3ef34ca 41307ec7df0572 Author: Linus Torvalds Date: Wed Oct 1 13:02:59 2025 -0700 Merge tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - introduce adc-battery-helper for capacity estimation based on simple ADC readings of battery voltage and current - add new properties for battery internal resistance and state of health Power-supply drivers: - ug3105_battery: convert to adc-battery-helper - intel_dc_ti_battery: New driver for Intel Dollar Cove TI batteries - rt9467-charger: add voltage and current ADC support - sbs-charger: support multiple instances - qcom_battmgr: - add charge control support - add support for state of health and internal resistance - max77705_charger: - big driver cleanup - add support for setting charge current - misc minor fixes and cleanups" * tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (38 commits) power: supply: qcom_battmgr: handle charging state change notifications power: supply: max77705_charger: use REGMAP_IRQ_REG_LINE macro power: supply: max77705_charger: rework interrupts power: supply: max77705_charger: add writable properties power: supply: max77705_charger: return error when config fails power: supply: max77705_charger: use regfields for config registers power: supply: max77705_charger: refactoring: rename charger to chg mfd: max77705: max77705_charger: move active discharge setting to mfd parent power: supply: max77976_charger: fix constant current reporting power: supply: qcom_battmgr: Add charge control support dt-bindings: soc: qcom,pmic-glink: Add charge limit nvmem properties power: supply: qcom_battmgr: update compats for SM8550 and X1E80100 power: supply: qcom_battmgr: Add state_of_health property power: supply: qcom_battmgr: Add resistance power supply property power: supply: core: Add state_of_health power supply property power: supply: core: Add resistance power supply property power: supply: rx51: remove redundant condition checks dt-bindings: power: supply: bq24190: document charge enable pin dt-bindings: power: supply: bq27xxx: document optional interrupt power: supply: intel_dc_ti_battery: Drop no longer relevant comment ... commit dba8acc3ef34ca5189d393b0dc4d3cdf0058fe49 Merge: f07c3695bf6522 ca50b295fd473e Author: Linus Torvalds Date: Wed Oct 1 13:00:33 2025 -0700 Merge tag 'hsi-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI update from Sebastian Reichel: - Remove redundant pm_runtime_mark_last_busy() calls * tag 'hsi-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: Remove redundant pm_runtime_mark_last_busy() calls commit d18020cf1e92c9f77819c49b61e2d558ed9fad70 Author: Ian Rogers Date: Wed Sep 3 11:42:48 2025 -0700 perf test: Remove C python_use test Removed in favor of the shell script version. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Collin Funk Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Signed-off-by: Arnaldo Carvalho de Melo commit 33706fb0aa6c2f7eb869a0a9ad569e414ff11375 Author: Ian Rogers Date: Wed Sep 3 11:42:47 2025 -0700 perf test: Add an 'import perf' test shell script The 'import perf' test needs to set up a path to the python module as well as to know the python command to invoke. These are hard coded at build time to be build a directory and the python used in the build, which is less than desirable. Avoid the hard coded values by reusing the existing shell script python setup and determine a potential built python module via the path of the perf executable. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Collin Funk Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Signed-off-by: Arnaldo Carvalho de Melo commit 73cc6ec1a89a6c443a77b9b93ddcea63b7cea223 Author: NeilBrown Date: Mon Sep 8 11:37:25 2025 +1000 nfsd: discard nfserr_dropit nfserr_dropit hasn't been used for over a decade, since rq_dropme and the RQ_DROPME were introduced. Time to get rid of it completely. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d8e97cc476e33037ac69c5b09b351f5cc8d0589d Author: Eric Biggers Date: Sat Sep 6 16:00:19 2025 -0700 SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it. This unblocks the eventual removal of the selection of CRYPTO from NFSD_V4, which will no longer be needed by nfsd itself due to switching to the crypto library functions. But NFSD_V4 selects RPCSEC_GSS_KRB5, which still needs CRYPTO. It makes more sense for RPCSEC_GSS_KRB5 to select CRYPTO itself, like most other kconfig options that need CRYPTO do. Signed-off-by: Eric Biggers Acked-by: Jeff Layton Signed-off-by: Chuck Lever commit 6304affe45648294229d18cab2b4ba6d40045570 Author: Mike Snitzer Date: Sat Sep 6 17:25:11 2025 -0400 NFSD: Add io_cache_{read,write} controls to debugfs Add 'io_cache_read' to NFSD's debugfs interface so that any data read by NFSD will either be: - cached using page cache (NFSD_IO_BUFFERED=0) - cached but removed from the page cache upon completion (NFSD_IO_DONTCACHE=1). io_cache_read may be set by writing to: /sys/kernel/debug/nfsd/io_cache_read Add 'io_cache_write' to NFSD's debugfs interface so that any data written by NFSD will either be: - cached using page cache (NFSD_IO_BUFFERED=0) - cached but removed from the page cache upon completion (NFSD_IO_DONTCACHE=1). io_cache_write may be set by writing to: /sys/kernel/debug/nfsd/io_cache_write The default value for both settings is NFSD_IO_BUFFERED, which is NFSD's existing behavior for both read and write. Changes to these settings take immediate effect for all exports and NFS versions. Currently only xfs and ext4 implement RWF_DONTCACHE. For file systems that do not implement RWF_DONTCACHE, NFSD use only buffered I/O when the io_cache setting is NFSD_IO_DONTCACHE. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d6e80d48f9c83fc766c1418c584dbba5a0bc9e8a Author: Chuck Lever Date: Fri Sep 5 10:30:37 2025 -0400 NFSD: Do the grace period check in ->proc_layoutget RFC 8881 Section 18.43.3 states: > If the metadata server is in a grace period, and does not persist > layouts and device ID to device address mappings, then it MUST > return NFS4ERR_GRACE (see Section 8.4.2.1). Jeff observed that this suggests the grace period check is better done by the individual layout type implementations, because checking for the server grace period is unnecessary for some layout types. Suggested-by: Jeff Layton Link: https://lore.kernel.org/linux-nfs/7h5p5ktyptyt37u6jhpbjfd5u6tg44lriqkdc7iz7czeeabrvo@ijgxz27dw4sg/T/#t Signed-off-by: Chuck Lever commit eafdd7e949bb412bb6daa1f8c71b61d11c23ca5f Author: Dan Carpenter Date: Thu Sep 4 21:59:30 2025 +0300 nfsd: delete unnecessary NULL check in __fh_verify() In commit 4a0de50a44bb ("nfsd: decouple the xprtsec policy check from check_nfsd_access()") we added a NULL check on "rqstp" to earlier in the function. This check is no longer required so delete it. Signed-off-by: Dan Carpenter Reviewed-by: Scott Mayhew Signed-off-by: Chuck Lever commit e0963ce53b0097a115ad35669b02cf5b87607ebf Author: Sergey Bashirov Date: Thu Sep 4 18:48:44 2025 +0300 NFSD: Allow layoutcommit during grace period If the loca_reclaim field is set to TRUE, this indicates that the client is attempting to commit changes to a layout after the restart of the metadata server during the metadata server's recovery grace period. This type of request may be necessary when the client has uncommitted writes to provisionally allocated byte-ranges of a file that were sent to the storage devices before the restart of the metadata server. See RFC 8881, section 18.42.3. Without this, the client is not able to increase the file size and commit preallocated extents when the block/scsi layout server is restarted during a write and is in a grace period. And when the grace period ends, the client also cannot perform layoutcommit because the old layout state becomes invalid, resulting in file corruption. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit f07c3695bf65220a69a848478bd9099bdeaafa78 Merge: d3479214c05dbd 40d4c761200b79 Author: Linus Torvalds Date: Wed Oct 1 12:52:43 2025 -0700 Merge tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This update includes the following changes: - Removal of the deprecated debug parameter from firewire-ohci module - Replacement of the module-local workqueue in 1394 OHCI PCI driver with a companion IRQ thread - Refactoring of bus management code - Additional minor code cleanup The existing tracepoints serve as an alternative to the removed debug parameter. The use of IRQ thread is experimental, as it handles 1394 OHCI SelfIDComplete event only. It may be replaced in the future releases with another approach; e.g. by providing workqueue from core functionality" * tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (43 commits) firewire: core: fix undefined reference error in ARM EABI Revert "firewire: core: disable bus management work temporarily during updating topology" Revert "firewire: core: shrink critical section of fw_card spinlock in bm_work" firewire: core: suppress overflow warning when computing jiffies from isochronous cycle firewire: core: minor code refactoring to delete useless local variable firewire: core; eliminate pick_me goto label firewire: core: code refactoring to split contention procedure for bus manager firewire: core: code refactoring for the case of generation mismatch firewire: core: use switch statement to evaluate transaction result to CSR_BUS_MANAGER_ID firewire: core: remove useless generation check firewire: core: use struct_size and flex_array_size in ioctl_add_descriptor firewire: core: shrink critical section of fw_card spinlock in bm_work firewire: core: disable bus management work temporarily during updating topology firewire: core: schedule bm_work item outside of spin lock firewire: core: annotate fw_destroy_nodes with must-hold-lock firewire: core: use spin lock specific to timer for split transaction firewire: core: use spin lock specific to transaction firewire: core: use spin lock specific to topology map firewire: core: maintain phy packet receivers locally in cdev layer firewire: core: use scoped_guard() to manage critical section to update topology ... commit d3479214c05dbd07bc56f8823e7bd8719fcd39a9 Merge: b386ef6286ace3 ba3b29a639fe51 Author: Linus Torvalds Date: Wed Oct 1 12:46:26 2025 -0700 Merge tag 'backlight-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "This set is comprised of a couple of small but important fixes and a number of clean-up and refactoring patches. The fixes correct an EPROM address for the LP8556 and improve memory allocation safety in the LED backlight driver. The remainder of the set is made up of refactoring work to the mp3309c driver and a series of patches to make a number of drivers more self-contained by including their own dependencies. Improvements & Fixes: - Correct the EPROM start address for the LP8556 to align with the device's datasheet. - Use devm_kcalloc() in the LED backlight driver for safer array allocation with overflow protection. Cleanups & Refactoring - Drop an unnecessary call to pwm_apply_args() in the mp3309c driver. - Modernize struct initialization in the mp3309c driver by using a compound literal instead of memset. - Make numerous drivers self-contained by including necessary headers directly rather than relying on transitive includes from the core backlight header" * tag 'backlight-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: rt4831: Include backlight: rave-sp: Include and backlight: led_bl: Include backlight: ktd2801: Include backlight: jornada720: Include backlight: da9052_bl: Include backlight: as3711_bl: Include backlight: apple_dwi_bl: Include backlight: Include video: backlight: lp855x_bl: Set correct EPROM start for LP8556 backlight: led_bl: Use devm_kcalloc() for array space allocation backlight: mp3309c: Initialize backlight properties without memset backlight: mp3309c: Drop pwm_apply_args() commit b386ef6286ace3b7546e641c2243f8d3d4dd3f28 Merge: b4918003cf54f9 64826db1e2e177 Author: Linus Torvalds Date: Wed Oct 1 12:42:13 2025 -0700 Merge tag 'leds-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "This submission is a mix of new features, a number of fixes, some clean-up/refactoring and a few Device Tree binding updates. The most significant changes include new device support for the IS31FL3236A and QNAP's status LEDs, a number of fixes for the Qualcomm flash, LP55xx, MAX77705 and QNAP MCU drivers, along with some generic LED consumer binding documentation and unification. New Support & Features: - Add support for the IS31FL3236A LED driver, including an optional 22kHz PWM frequency setting. - Add support for the red and green status LEDs on QNAP MCU devices. Improvements & Fixes: - Fix an issue in the MAX77705 driver where an error value was assigned but not returned. - Correctly update the torch current clamp setting in the Qualcomm flash LED driver to prevent unexpected clamping. - Add a separate register map for the PMI8998 to the Qualcomm flash LED driver to handle its unique register layout. - Fix the state numbering for the USB LED in the QNAP MCU driver to avoid command conflicts. - Correct the memory programming address calculation for non-paged devices like the LP5562 in the LP55xx driver. - Add Device Tree support to the generic led_get() function, allowing LEDs to be looked up by name. Cleanups & Refactoring: - Fix a spelling mistake in the Kconfig help text for the BD2606MVV driver. - Use devm_mutex_init() in the IS31FL319x driver to simplify code. Device Tree Bindings Updates: - Drop the redundant '-db' suffix from the IS31FL319x binding. - Introduce generic LED consumer bindings for referencing LEDs via phandles. - Unify the 'leds' property across several bindings to use the new generic consumer binding. - Convert the AMS AS3645A LED controller binding to the DT schema format" * tag 'leds-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: as3645: Convert to DT schema leds: led-class: Add Device Tree support to led_get() dt-bindings: leds: Unify 'leds' property dt-bindings: leds: Add generic LED consumer documentation leds: is31fl319x: Use devm_mutex_init() leds: leds-lp55xx: Use correct address for memory programming dt-bindings: leds: issi,is31fl319x: Drop 'db' suffix duplicating dtschema leds: qnap-mcu: Add support for the red and green status LEDs leds: qnap-mcu: Fix state numbering for USB LED leds: flash: leds-qcom-flash: Add a separate register map for PMI8998 leds: flash: leds-qcom-flash: Update torch current clamp setting leds: max77705: Function return instead of variable assignment leds: Kconfig: Fix spelling mistake "limitiation" -> "limitation" leds: leds-is31fl32xx: Add support for is31fl3236a commit b4918003cf54f99004c136c26f96b6df7ab49fac Merge: 2d274536245b58 b9d6cfe2ae699b Author: Linus Torvalds Date: Wed Oct 1 12:04:12 2025 -0700 Merge tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "This round of updates contains a fair amount of new device support, a couple of fixes and some refactoring. The most notable additions include new drivers for Loongson's Security Engine, RNG and TPM, new drivers for TI's TPS6594 Power Button and BQ257xx Charger ICs. The rest of the set provides a return value check fix and a refactoring to use a more modern GPIO API for the VEXPRESS sysreg driver, the removal of a deprecated IRQ ACK function from the MC13xxx RTC driver and a new DT binding for the aforementioned TI BQ257xx charger. New Support & Features: - Add a suite of drivers for the Loongson Security Engine, including the core controller, a Random Number Generator (RNG) and Trusted Platform Module (TPM) support. - Introduce support for the TI TPS6594 PMIC's power button, including the input driver, MFD cell registration, and a system power-off handler. - Add comprehensive support for the TI BQ257xx series of charger ICs, including the core MFD driver and a power supply driver for the charger functionality. Improvements & Fixes: - Check the return value of devm_gpiochip_add_data() in the VEXPRESS sysreg driver to prevent potential silent failures. Cleanups & Refactoring: - Add a MAINTAINERS entry for the new Loongson Security Engine drivers. - Convert the VEXPRESS sysreg driver to use the modern generic GPIO chip API. Removals: - Remove the deprecated and unused mc13xxx_irq_ack() function from the MC13xxx RTC, input and touchscreen drivers. Device Tree Bindings Updates: - Add device tree bindings for the TI BQ25703A charger" * tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (69 commits) mfd: simple-mfd-i2c: Add compatible string for LX2160ARDB mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order dt-bindings: mfd: twl: Add missing sub-nodes for TWL4030 & TWL603x dt-bindings: watchdog: Add SMARC-sAM67 support dt-bindings: mfd: tps6594: Allow gpio-line-names mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs mfd: 88pm886: Add GPADC cell mfd: vexpress-sysreg: Use more common syntax for compound literals mfd: rz-mtu3: Fix MTU5 NFCR register offset mfd: max77705: Setup the core driver as an interrupt controller mfd: cs42l43: Remove IRQ masking in suspend mfd: cs42l43: Move IRQ enable/disable to encompass force suspend mfd: ls2kbmc: Add Loongson-2K BMC reset function support mfd: ls2kbmc: Introduce Loongson-2K BMC core driver mfd: bd71828, bd71815: Prepare for power-supply support dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles dt-bindings: mfd: Convert aspeed,ast2400-p2a-ctrl to DT schema dt-bindings: mfd: fsl,mc13xxx: Add buttons node dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema mfd: macsmc: Add "apple,t8103-smc" compatible ... commit 2d274536245b58a43753a23d84dfadc9df1df489 Merge: e93bcbaa71f47b 7aada81cd75ad8 Author: Linus Torvalds Date: Wed Oct 1 11:54:40 2025 -0700 Merge tag 'mmc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Improve RPMB frame handling code - Add support for a new max-sd-hs-hz DT property to limit frequency - Add support to manage regulator-under-voltage events - Support regulator-under-voltage for eMMC to mitigate data corruptions - Add mmc_read_tuning() to allow a host to validate its tuning sequence - Add some helpers to align checks for CMD23 support - Read the CCCR register for SDIO over SPI rather than the unsupported CMD7 MMC host: - Add COMPILE_TEST option for a couple of drivers - Convert drivers to use the modern PM macros - dw_mmc-exynos: Enable support for the Exynos8890 variant - mmc_spi: Don't use crc ack during multiple block read - renesas_sdhi: Enable 64-bit polling mode for R-Car gen3 and RZ/G2L SoCs - rtsx_usb: Add support for over-current-protection - sdhci-cadence: Add support for multi-block read gap tuning - sdhci-msm: - Add support for tuning for SDR50 mode for SD cards - Enable support for the Lemans variant - sdhci-pci: Disable SD card clock before update for a few Intel platforms - sdhci-pxav3: Add support for UHS pinctrl settings - tmio: Add 64-bit read/write support in polling mode MEMSTICK: - Convert to use timeouts to prevent indefinite waiting - rtsx_usb: Add support for over-current-protection" * tag 'mmc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (77 commits) dt-bindings: mmc: samsung,exynos-dw-mshc: add specific compatible for exynos8890 mmc: select REGMAP_MMIO with MMC_LOONGSON2 mmc: add COMPILE_TEST to multiple drivers mmc: core: Improve RPMB frame handling code mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() mmc: core: Parse and use the new max-sd-hs-hz DT property dt-bindings: mmc: controller: Add max-sd-hs-hz property mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card dt-bindings: mmc: sdhci-msm: Document the Lemans compatible mmc: sh_mmcif: Remove dummy PM resume callback dt-bindings: mmc: sdhci-pxa: Add minItems to pinctrl-names mmc: sdio: Drop dev_pm_domain_detach() call mmc: dw_mmc-rockchip: use modern PM macros mmc: dw_mmc-pci: use modern PM macros mmc: dw_mmc-k3: use modern PM macros mmc: dw_mmc: exynos: use modern PM macros mmc: via-sdmmc: use modern PM macros mmc: sdhci-msm: use modern PM macros mmc: mtk-sd: use modern PM macros mmc: wmt-sdmmc: use modern PM macros ... commit e93bcbaa71f47bcee4972ae3b2ddb5964238bb96 Merge: ea1c6c59252220 bbc3110823eca2 Author: Linus Torvalds Date: Wed Oct 1 11:51:53 2025 -0700 Merge tag 'pmdomain-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: - amlogic: Add support for S6/S7/S7D power-domains controller - imx: Add support for i.MX91 power-domains - marvell: Add support for PXA1908 power-domains - mediatek: - Add support for modem power sequence - Add support for RTFF Hardware in MT8196/MT6991 - qcom: Align power-domain definitions for rpmpd - rockchip: Default to use power-domain support - thead: Create auxiliary device along with a corresponding reset driver - ti: Synchronize on/off state with HW-state for ti-sci power-domains * tag 'pmdomain-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (25 commits) pmdomain: thead: Fix error pointer vs NULL bug in th1520_pd_reboot_init() pmdomain: thead: create auxiliary device for rebooting driver: reset: th1520-aon: add driver for poweroff/reboot via AON FW pmdomain: mediatek: airoha: convert from round_rate() to determine_rate() pmdomain: rockchip: enable ROCKCHIP_PM_DOMAINS with ARCH_ROCKCHIP pmdomain: marvell: Add PXA1908 power domains dt-bindings: clock: marvell,pxa1908: Add syscon compatible to apmu pmdomain: ti-sci: Set PD on/off state according to the HW state pmdomain: amlogic: Add support for S6 S7 S7D power domains controller dt-bindings: power: add Amlogic S6 S7 S7D power domains pmdomain: mediatek: Convert all SoCs to new style regmap retrieval pmdomain: mediatek: Add support for RTFF Hardware in MT8196/MT6991 pmdomain: mediatek: Add support for modem power sequences pmdomain: mediatek: Move ctl sequences out of power_on/off functions pmdomain: mediatek: Handle SoCs with inverted SRAM power-down bits pmdomain: mediatek: Refactor bus protection regmaps retrieval dt-bindings: power: mediatek: Document access-controllers property pmdomain: remove unneeded 'fast_io' parameter in regmap_config pmdomain: imx93-blk-ctrl: mask DSI and PXP PD domain register on i.MX91 pmdomain: imx93-blk-ctrl: use ARRAY_SIZE() instead of hardcode number ... commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa Author: Sakari Ailus Date: Wed Oct 1 13:26:36 2025 +0300 ACPI: property: Return present device nodes only on fwnode interface fwnode_graph_get_next_subnode() may return fwnode backed by ACPI device nodes and there has been no check these devices are present in the system, unlike there has been on fwnode OF backend. In order to provide consistent behaviour towards callers, add a check for device presence by introducing a new function acpi_get_next_present_subnode(), used as the get_next_child_node() fwnode operation that also checks device node presence. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com [ rjw: Kerneldoc comment and changelog edits ] Signed-off-by: Rafael J. Wysocki commit ea1c6c592522208df1dcac9e8f1deb7cc56a51b7 Merge: ad6657804c10f7 2bfb20b65d9bc1 Author: Linus Torvalds Date: Wed Oct 1 11:46:31 2025 -0700 Merge tag 'spi-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "There's one big core change in this release, Jonas Gorski has addressed the issues with multiple chip selects which makes things more robust and stable. Otherwise there's quite a bit of driver work, as well as some new drivers several existing drivers have had quite a bit of work done on them. Possibly the most interesting thing is the VirtIO driver, this is apparently useful for some automotive applications which want to keep as small and robust a host system as they can, moving less critical functionality into guests. - James Clark has done some substantial updates on the Freescale DSPI driver, porting in code from the BSP and building onm top of that to fix some bugs and increase performance - Jonas Gorski has fixed the issues with handling multple chip selects, making things more robust and scalable - Support for higher performance modes in the NXP FSPI driver from Haibo Chen - Removal of the obsolete S3C2443 driver, the underlying SoC support has been removed from the kernel - Support for Amlogic AL113L2, Atmel SAMA7D65 and SAM9x7 and for VirtIO controllers" * tag 'spi-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (74 commits) spi: ljca: Remove Wentong's e-mail address spi: rename SPI_CS_CNT_MAX => SPI_DEVICE_CS_CNT_MAX spi: reduce device chip select limit again spi: don't check spi_controller::num_chipselect when parsing a dt device spi: drop check for validity of device chip selects spi: move unused device CS initialization to __spi_add_device() spi: keep track of number of chipselects in spi_device spi: fix return code when spi device has too many chipselects SPI: Add virtio SPI driver virtio-spi: Add virtio-spi.h virtio: Add ID for virtio SPI spi: rpc-if: Add resume support for RZ/G3E spi: rpc-if: Drop deprecated SIMPLE_DEV_PM_OPS spi: spi-qpic-snand: simplify clock handling by using devm_clk_get_enabled() spi: spi-nxp-fspi: Add OCT-DTR mode support spi: spi-nxp-fspi: add the support for sample data from DQS pad spi: spi-nxp-fspi: Add the DDR LUT command support spi: spi-nxp-fspi: set back to dll override mode when clock rate < 100MHz spi: spi-nxp-fspi: extract function nxp_fspi_dll_override() spi: atmel-quadspi: Add support for sama7d65 QSPI ... commit ad6657804c10f794228461683b6cf1585a313ac9 Merge: c252b8cf1228c7 e6094388519283 Author: Linus Torvalds Date: Wed Oct 1 11:43:54 2025 -0700 Merge tag 'regulator-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a very quiet release for regulator, almost all the changes are new drivers but we do also have some improvements for the Rust bindings. - Additional APIs added to the Rust bindings - Support for Maxim MAX77838, NXP PF0900 and PF5300, Richtek RT5133 and SpacemiT P1" * tag 'regulator-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (28 commits) regulator: dt-bindings: qcom,sdm845-refgen-regulator: document more platforms regulator: Fix MAX77838 selection regulator: spacemit: support SpacemiT P1 regulators regulator: max77838: add max77838 regulator driver dt-bindings: regulator: document max77838 pmic rust: regulator: add devm_enable and devm_enable_optional rust: regulator: remove Regulator regulator: dt-bindings: rpi-panel: Split 7" Raspberry Pi 720x1280 v2 binding regulator: pf530x: Add a driver for the NXP PF5300 Regulator regulator: dt-bindings: nxp,pf530x: Add NXP PF5300/PF5301/PF5302 PMICs regulator: scmi: Use int type to store negative error codes regulator: core: Remove redundant ternary operators rust: regulator: use `to_result` for error handling regulator: consumer.rst: document bulk operations regulator: rt5133: Fix IS_ERR() vs NULL bug in rt5133_validate_vendor_info() regulator: bd718x7: Use kcalloc() instead of kzalloc() regulator: rt5133: Fix spelling mistake "regualtor" -> "regulator" regulator: remove unneeded 'fast_io' parameter in regmap_config regulator: rt5133: Add RT5133 PMIC regulator Support regulator: dt-bindings: Add Richtek RT5133 Support ... commit c252b8cf1228c70f044b5706613950dc283017b7 Merge: d5f74114114cb2 f4672dc6e9c076 Author: Linus Torvalds Date: Wed Oct 1 11:41:51 2025 -0700 Merge tag 'regmap-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This just contains a few small fixes, there's been no substantial development on regmap this release cycle" * tag 'regmap-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: use int type to store negative error codes regmap: Remove superfluous check for !config in __regmap_init() regmap: mmio: Add missing MODULE_DESCRIPTION() commit d5f74114114cb2cdbed75b91ca2fa4482c1d5611 Merge: c050daf69f3edf bc061143637532 Author: Linus Torvalds Date: Wed Oct 1 11:34:12 2025 -0700 Merge tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "There are two new drivers and support for more models in existing ones. The generic GPIO API has been reworked and all users converted which allowed us to move the fields specific to the generic GPIO implementation out of the high-level struct gpio_chip into its own structure that wraps the gpio_chip. Other than that, there's nothing too exciting. Mostly minor tweaks and fixes all over the place, some refactoring and some small new features in helper modules. GPIO core: - add support for sparse pin ranges to the glue between GPIO and pinctrl - use a common prefix across all GPIO descriptor flags for improved namespacing New drivers: - add new GPIO driver for the Nuvoton NCT6694 - add new GPIO driver for MAX7360 Driver improvements: - add support for Tegra 256 to the gpio-tegra186 driver - add support for Loongson-2K0300 to the gpio-loongson-64bit driver - refactor the gpio-aggregator module to expose its GPIO forwarder API to other in-kernel users (to enable merging of a new pinctrl driver that uses it) - convert all remaining drivers to using the modernized generic GPIO chip API and remove the old interface - stop displaying global GPIO numbers in debugfs output of controller drivers - extend the gpio-regmap helper with a new config option and improve its support for GPIO interrupts - remove redundant fast_io parameter from regmap configs in GPIO drivers that already use MMIO regmaps which imply it - add support for a new model in gpio-mmio: ixp4xx expansion bus - order includes alphabetically in a few drivers for better readability - use generic device properties where applicable - use devm_mutex_init() where applicable - extend build coverage of drivers by enabling more to be compiled with COMPILE_TEST enabled - allow building gpio-stmpe as a module - use dev_err_probe() where it makes sense in drivers Late driver fixes: - fix setting GPIO direction to output in gpio-mpfs Documentation: - document the usage of software nodes with GPIO chips Device-tree bindings: - Add DT bindings documents for new hardware: Tegra256, MAX7360 - Document a new model in Loongson bindings: LS2K0300 - Document a new model using the generic GPIO binding: IXP4xx - Convert the DT binding for fsl,mxs-pinctrl to YAML - fix the schema ID in the "trivial" GPIO schema - describe GPIO hogs in the generic GPIO binding" * tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (122 commits) gpio: mpfs: fix setting gpio direction to output gpio: generic: move GPIO_GENERIC_ flags to the correct header gpio: generic: rename BGPIOF_ flags to GPIO_GENERIC_ gpio: nomadik: fix the debugfs helper stub MAINTAINERS: Add entry on MAX7360 driver input: misc: Add support for MAX7360 rotary input: keyboard: Add support for MAX7360 keypad gpio: max7360: Add MAX7360 gpio support gpio: regmap: Allow to provide init_valid_mask callback gpio: regmap: Allow to allocate regmap-irq device pwm: max7360: Add MAX7360 PWM support pinctrl: Add MAX7360 pinctrl driver mfd: Add max7360 support dt-bindings: mfd: gpio: Add MAX7360 rtc: Add Nuvoton NCT6694 RTC support hwmon: Add Nuvoton NCT6694 HWMON support watchdog: Add Nuvoton NCT6694 WDT support can: Add Nuvoton NCT6694 CANFD support i2c: Add Nuvoton NCT6694 I2C support gpio: Add Nuvoton NCT6694 GPIO support ... commit 9f0fa213790e3633d37e981386da99149573135b Author: James Clark Date: Wed Aug 13 14:38:51 2025 +0100 perf test: Extend branch stack sampling test for Arm64 BRBE BRBE emits IRQ and ERET branches for branching and returning from trapped instructions. Add a test that loops on a trapped instruction (MRS - Read special register) for this. Extend the expected 'any_call' branches to include FAULT_DATA and FAULT_INST as these are emitted by BRBE. Reviewed-by: Ian Rogers Co-developed-by: German Gomez Signed-off-by: German Gomez Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 11e59335b0d1c4bc259ee6f0533e04c4b3a9f1dd Author: James Clark Date: Wed Aug 13 14:38:50 2025 +0100 perf test: Add syscall and address tests to brstack test Test that SYSCALL type branches are emitted from the expected 'getppid' symbol. Test that when only 'k' is used, sources addresses are all in the kernel. Test that no kernel addresses leak by checking for them in the 'u' test. Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit f15548b277cc107d41b88b1a63bd4942b703666b Author: James Clark Date: Wed Aug 13 14:38:49 2025 +0100 perf test: Refactor brstack test check_branches() will be used by other tests in a later commit so make it a function. And the any_call filters are duplicated and will also be extended in a later commit, so move them to a variable. No functional changes intended. Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit b91917c0c6fa6df97ec0222d8d6285ab2d60c21b Author: Ian Rogers Date: Wed Oct 1 11:12:28 2025 -0700 perf bpf_counter: Fix handling of cpumap fixing hybrid Don't open evsels on all CPUs, open them just on the CPUs they support. This avoids opening say an e-core event on a p-core and getting a failure - achieve this by getting rid of the "all_cpu_map". In install_pe functions don't use the cpu_map_idx as a CPU number, translate the cpu_map_idx, which is a dense index into the cpu_map skipping holes at the beginning, to a proper CPU number. Before: ``` $ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 Performance counter stats for 'system wide': cpu_atom/cycles/ 566,270,672 cpu_core/cycles/ cpu_atom/instructions/ 572,792,836 cpu_core/instructions/ # 1.01 insn per cycle 1.001595384 seconds time elapsed ``` After: ``` $ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 Performance counter stats for 'system wide': 443,299,201 cpu_atom/cycles/ 1,233,919,737 cpu_core/cycles/ 213,634,112 cpu_atom/instructions/ # 0.48 insn per cycle 2,758,965,527 cpu_core/instructions/ # 2.24 insn per cycle 1.001699485 seconds time elapsed ``` Fixes: 7fac83aaf2eecc9e ("perf stat: Introduce 'bperf' to share hardware PMCs with BPF") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: bpf@vger.kernel.org Cc: Gabriele Monaco Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Tengda Wu Signed-off-by: Arnaldo Carvalho de Melo commit 8c519a825b4add85b63531869d4a813511e6234b Author: Ian Rogers Date: Wed Oct 1 11:12:27 2025 -0700 perf bpf_counter: Move header declarations into C code Reduce the API surface that is in bpf_counter.h, this helps compiler analysis like unused static function, makes it easier to set a breakpoint and just makes it easier to see the code is self contained. When code is shared between BPF C code, put it inside HAVE_BPF_SKEL. Move transitively found #includes into appropriate C files. No functional change. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Gabriele Monaco Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Tengda Wu Signed-off-by: Arnaldo Carvalho de Melo commit ac3ad9845b9faf9cf29a736eaac00703bc821ac1 Author: Bharath SM Date: Tue Sep 2 16:46:03 2025 +0530 smb: client: show lease state as R/H/W (or NONE) in open_files Print the lease/oplock caching state for each open file as a compact string of letters: R (read), H (handle), W (write). Signed-off-by: Bharath SM Signed-off-by: Steve French commit c050daf69f3edf72e274eaa321f663b1779c4391 Merge: 989253cc46ff3f 8f2689f194b8d1 Author: Linus Torvalds Date: Wed Oct 1 10:33:17 2025 -0700 Merge tag 'pwm/for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "The core highlights for this cycle are: - The pca9586 driver was converted to the waveform API - Waveform drivers automatically provide a gpio chip to make PWMs usable as GPIOs (The pca9586 driver did that in a driver specific implementation before) Otherwise it's the usual mix of fixes and device tree and driver changes to support new hardware variants" * tag 'pwm/for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (30 commits) pwm: cros-ec: Avoid -Wflex-array-member-not-at-end warnings dt-bindings: pwm: samsung: add exynos8890 compatible dt-bindings: pwm: apple,s5l-fpwm: Add t6020-fpwm compatible dt-bindings: pwm: nxp,lpc1850-sct-pwm: Minor whitespace cleanup in example pwm: pca9586: Convert to waveform API pwm: pca9685: Drop GPIO support pwm: pca9685: Make use of register caching in regmap pwm: pca9685: Use bulk write to atomicially update registers pwm: pca9685: Don't disable hardware in .free() pwm: Add the S32G support in the Freescale FTM driver dt-bindings: pwm: fsl,vf610-ftm-pwm: Add compatible for s32g2 and s32g3 pwm: mediatek: Lock and cache clock rate pwm: mediatek: Fix various issues in the .apply() callback pwm: mediatek: Implement .get_state() callback pwm: mediatek: Initialize clks when the hardware is enabled at probe time pwm: mediatek: Rework parameters for clk helper function pwm: mediatek: Introduce and use a few more register defines pwm: mediatek: Simplify representation of channel offsets pwm: tiecap: Document behaviour of hardware disable pwm: Provide a gpio device for waveform drivers ... commit 989253cc46ff3f4973495b58e02c7fcb1ffb713e Merge: 57cf7a603b6d25 76bb6969a8cfc5 Author: Linus Torvalds Date: Wed Oct 1 09:42:51 2025 -0700 Merge tag 'hwmon-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Kontron SMARC-sAM67 - GPD device sensors - MP29502 - MP2869, MP29608, MP29612 and MP29816 series Added chip support to existing drivers: - asus-ec-sensors: Add B650E-I Add PRIME Z270-A Add Pro WS WRX90E-SAGE SE Add ROG STRIX X670E-E GAMING WIFI Add ROG STRIX X870-I GAMING WIFI Add ROG STRIX X870E-E GAMING WIFI Add ROG STRIX Z690-E GAMING WIFI Add ROG STRIX Z790E GAMING WIFI II Add STRIX B850-I GAMING WIFI Add TUF GAMING X670E PLUS WIFI Add X670E-I GAMING WIFI Add Z790-I GAMING WIFI - dell-smm: Add support for Dell OptiPlex 7040 - ina238: Major cleanup, and Add support for INA700 Add support for INA780 - k10temp: Add device ID for Strix Halo Add support for AMD Family 1Ah-based models - lenovo-ec-sensors: Update P8 supprt - lm75: Add NXP P3T1750 support - pmbus/adm1275: Add sq24905c support - pmbus/isl68137: Add support for Renesas RAA228244 and RAA228246 - pmbus/mp5990: Add support for MP5998 - sht21: Add support for SHT20, SHT25 - sl28cpld: Add sa67mcu compatible Other notable changes: - core: Handle locking internally Introduce 64-bit energy attribute support - cros_ec: Register into thermal framework, improve PWM control - lm75: allow interrupt for ti,tmp75 - mlxreg-fan: Add support for new flavour of capability register - sbtsi_temp: AMD CPU extended temperature range support - sht21: Add devicetree support Various other minor improvements and fixes" * tag 'hwmon-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (86 commits) dt-bindings: hwmon: (lm75) allow interrupt for ti,tmp75 hwmon: (mlxreg-fan) Add support for new flavour of capability register hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems hwmon: (cros_ec) register fans into thermal framework cooling devices hwmon: (cros_ec) add PWM control over fans platform/chrome: update pwm fan control host commands hwmon: add SMARC-sAM67 support dt-bindings: hwmon: sl28cpld: add sa67mcu compatible hwmon: (asus-ec-sensors) add TUF GAMING X670E PLUS WIFI hwmon: (dell-smm) Add support for Dell OptiPlex 7040 hwmon: (dell-smm) Add support for automatic fan mode hwmon: (gpd-fan) complete Kconfig dependencies hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex hwmon: (asus-ec-sensors) add ROG STRIX X870E-E GAMING WIFI hwmon: (dell-smm) Move clamping of fan speed out of i8k_set_fan() hwmon: (dell-smm) Remove Dell Precision 490 custom config data hwmon: (asus-ec-sensors) add ROG STRIX X670E-E GAMING WIFI hwmon: (gpd-fan) Fix range check for pwm input hwmon: (pmbus/mp5990) add support for MP5998 dt-bindings: trivial-devices: add mps,mp5998 ... commit 57cf7a603b6d2524edffaa3068d9aa7a41641d93 Merge: eb3289fc474f74 48633acccf38d7 Author: Linus Torvalds Date: Wed Oct 1 09:16:28 2025 -0700 Merge tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New: - Add a new API cros_ec_device_registered() for checking if the cros_ec_deivce is ready Improvements: - Use TRAILING_OVERLAP() to fix -Wflex-array-member-not-at-end warning - Defer probe until parent EC device is ready in cros_ec_keyb Cleanups: - Remove redundant and simplify code in cros_ec_chardev - Centralize cros_ec_device allocation and initialization to remove duplicate code" * tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: Input: cros_ec_keyb - Defer probe until parent EC device is registered platform/chrome: cros_ec: Add a flag to track registration state platform/chrome: cros_ec: Separate initialization from cros_ec_register() platform/chrome: Centralize common cros_ec_device initialization platform/chrome: Centralize cros_ec_device allocation platform/chrome: wilco_ec: Remove redundant semicolons platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warning platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev platform/chrome: cros_ec_chardev: Remove redundant struct field commit eb3289fc474f74105e0627bf508e3f9742fd3b63 Merge: 50c19e20ed2ef3 6d97171ac6585d Author: Linus Torvalds Date: Wed Oct 1 08:39:23 2025 -0700 Merge tag 'driver-core-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Auxiliary: - Drop call to dev_pm_domain_detach() in auxiliary_bus_probe() - Optimize logic of auxiliary_match_id() Rust: - Auxiliary: - Use primitive C types from prelude - DebugFs: - Add debugfs support for simple read/write files and custom callbacks through a File-type-based and directory-scope-based API - Sample driver code for the File-type-based API - Sample module code for the directory-scope-based API - I/O: - Add io::poll module and implement Rust specific read_poll_timeout() helper - IRQ: - Implement support for threaded and non-threaded device IRQs based on (&Device, IRQ number) tuples (IrqRequest) - Provide &Device cookie in IRQ handlers - PCI: - Support IRQ requests from IRQ vectors for a specific pci::Device - Implement accessors for subsystem IDs, revision, devid and resource start - Provide dedicated pci::Vendor and pci::Class types for vendor and class ID numbers - Implement Display to print actual vendor and class names; Debug to print the raw ID numbers - Add pci::DeviceId::from_class_and_vendor() helper - Use primitive C types from prelude - Various minor inline and (safety) comment improvements - Platform: - Support IRQ requests from IRQ vectors for a specific platform::Device - Nova: - Use pci::DeviceId::from_class_and_vendor() to avoid probing non-display/compute PCI functions - Misc: - Add helper for cpu_relax() - Update ARef import from sync::aref sysfs: - Remove bin_attrs_new field from struct attribute_group - Remove read_new() and write_new() from struct bin_attribute Misc: - Document potential race condition in get_dev_from_fwnode() - Constify node_group argument in software node registration functions - Fix order of kernel-doc parameters in various functions - Set power.no_pm flag for faux devices - Set power.no_callbacks flag along with the power.no_pm flag - Constify the pmu_bus bus type - Minor spelling fixes" * tag 'driver-core-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (43 commits) rust: pci: display symbolic PCI vendor names rust: pci: display symbolic PCI class names rust: pci: fix incorrect platform reference in PCI driver probe doc comment rust: pci: fix incorrect platform reference in PCI driver unbind doc comment perf: make pmu_bus const samples: rust: Add scoped debugfs sample driver rust: debugfs: Add support for scoped directories samples: rust: Add debugfs sample driver rust: debugfs: Add support for callback-based files rust: debugfs: Add support for writable files rust: debugfs: Add support for read-only files rust: debugfs: Add initial support for directories driver core: auxiliary bus: Optimize logic of auxiliary_match_id() driver core: auxiliary bus: Drop dev_pm_domain_detach() call driver core: Fix order of the kernel-doc parameters driver core: get_dev_from_fwnode(): document potential race drivers: base: fix "publically"->"publicly" driver core/PM: Set power.no_callbacks along with power.no_pm driver core: faux: Set power.no_pm for faux devices rust: pci: inline several tiny functions ... commit c86a24dfa902fc27dd4d7ce138b25315f7241d47 Author: Christian Bruel Date: Wed Aug 20 09:54:07 2025 +0200 MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers Add myself as maintainer of STM32MP25 PCIe host and PCIe endpoint drivers. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-8-christian.bruel@foss.st.com commit 151f3d29baf405bc203f0a02beb4d33604410943 Author: Christian Bruel Date: Wed Aug 20 09:54:06 2025 +0200 PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 Add driver to configure the STM32MP25 SoC PCIe controller based on the DesignWare PCIe core in endpoint mode. Controller support 2.5 and 5 GT/s data rates and uses the common reference clock provided by the host. The PCIe core_clk receives the pipe0_clk from the ComboPHY as input, and the ComboPHY PLL must be locked for pipe0_clk to be ready. Consequently, PCIe core registers cannot be accessed until the ComboPHY is fully initialised and REFCLK is enabled and ready. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash in https://patch.msgid.link/20250902122641.269725-1-christian.bruel@foss.st.com to remove redundant link_status checks] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-7-christian.bruel@foss.st.com commit b8ef623f18da24ee9e1cf9bef66dacd2e8574902 Author: Christian Bruel Date: Wed Aug 20 09:54:05 2025 +0200 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings STM32MP25 PCIe Controller is based on the DesignWare core configured as endpoint mode from the SYSCFG register. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250820075411.1178729-6-christian.bruel@foss.st.com commit 63a562b33a9c6b4359bfb5a9c7f5d26a85c40fe1 Author: Christian Bruel Date: Wed Aug 20 09:54:04 2025 +0200 PCI: stm32: Add PCIe host support for STM32MP25 Add driver for the STM32MP25 SoC PCIe controller based on the DesignWare PCIe core. Controller supports 2.5 and 5 GT/s data rates, MSI via GICv2m, Single Virtual Channel, Single Function and WAKE# GPIO. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash error handling cleanup from Christophe JAILLET : https://patch.msgid.link/e69ade3edcec4da2d5bfc66e0d03bbcb5a857021.1759169956.git.christophe.jaillet@wanadoo.fr] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-5-christian.bruel@foss.st.com commit a8de554774ae48efbe48ace79f8badae2daa2bf1 Author: Ma Ke Date: Tue Sep 30 16:16:18 2025 +0800 of: unittest: Fix device reference count leak in of_unittest_pci_node_verify In of_unittest_pci_node_verify(), when the add parameter is false, device_find_any_child() obtains a reference to a child device. This function implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller fails to properly release this reference by calling put_device(), leading to a device reference count leak. Add put_device() in the else branch immediately after child_dev is no longer needed. As the comment of device_find_any_child states: "NOTE: you will need to drop the reference with put_device() after use". Found by code review. Cc: stable@vger.kernel.org Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Signed-off-by: Ma Ke Signed-off-by: Rob Herring (Arm) commit 4335c4496b1bcf8e85761af23550a180e937bac6 Author: Nathan Chancellor Date: Thu Sep 25 19:03:04 2025 -0400 btrfs: fix PAGE_SIZE format specifier in open_ctree() There is an instance of -Wformat when targeting 32-bit architectures due to using a 'size_t' specifier (which is 'unsigned int' for 32-bit platforms) to print PAGE_SIZE: In file included from fs/btrfs/compression.h:17, from fs/btrfs/extent_io.h:15, from fs/btrfs/locking.h:13, from fs/btrfs/ctree.h:19, from fs/btrfs/disk-io.c:22: fs/btrfs/disk-io.c: In function 'open_ctree': include/linux/kern_levels.h:5:25: error: format '%zu' expects argument of type 'size_t', but argument 4 has type 'long unsigned int' [-Werror=format=] ... fs/btrfs/disk-io.c:3398:17: note: in expansion of macro 'btrfs_warn' 3398 | btrfs_warn(fs_info, | ^~~~~~~~~~ PAGE_SIZE is consistently defined as an 'unsigned long' in include/vsdo/page.h so use '%lu' to clear up the warning. Fixes: 98077f7f2180 ("btrfs: enable experimental bs > ps support") Reviewed-by: Qu Wenruo Tested-by: Geert Uytterhoeven Signed-off-by: Nathan Chancellor Reviewed-by: David Sterba Signed-off-by: David Sterba commit 60c38a6d38053be24deca331f9f35cf368400352 Author: Suchit Karunakaran Date: Tue Sep 23 23:12:36 2025 +0530 perf annotate: Use architecture-agnostic register limit Remove the arch-specific guard around TYPE_STATE_MAX_REGS and define it as 32 for all architectures. The architecture that perf is built on may not match the architecture that produced the perf.data file, so relying on __powerpc__ or similar is fragile. Using 32 as a fixed upper bound is safe since it is greater than the previous maximum of 16. Add a comment to clarify that TYPE_STATE_MAX_REGS is an arch-independent maximum rather than a build-time choice. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Suchit Karunakaran Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shuah Khan Signed-off-by: Arnaldo Carvalho de Melo commit 6c153cc4684a13af86780cfe293db7b4b4d6739d Author: Kan Liang Date: Thu Sep 25 09:24:28 2025 -0700 MAINTAINERS: Remove myself from perf_events subsystem I'm stepping down as the Reviewer of perf_events subsystem. It has been an honor and a pleasure to work with everyone to improve the perf_events subsystem. However, due to personal reasons, I have to leave Intel. I believe it would be difficult for me to continue in this role any further. Signed-off-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dave Hansen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a0dfb18f7d20ae0b7b5f513fd65882af105bb771 Author: Athira Rajeev Date: Tue Sep 16 10:55:36 2025 +0530 perf script: Enable to present DTL entries The process_event() function in "builtin-script.c" invokes perf_sample__fprintf_synth() for displaying PERF_TYPE_SYNTH type events. if (attr->type == PERF_TYPE_SYNTH && PRINT_FIELD(SYNTH)) perf_sample__fprintf_synth(sample, evsel, fp); perf_sample__fprintf_synth() process the sample depending on the value in evsel->core.attr.config. Introduce perf_sample__fprintf_synth_vpadtl() and invoke this for PERF_SYNTH_POWERPC_VPA_DTL Sample output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf script perf 13322 [002] 233.835807: sched:sched_switch: perf:13322 [120] R ==> migration/2:27 [0] migration/2 27 [002] 233.835811: sched:sched_migrate_task: comm=perf pid=13322 prio=120 orig_cpu=2 dest_cpu=3 migration/2 27 [002] 233.835818: sched:sched_stat_runtime: comm=migration/2 pid=27 runtime=9214 [ns] migration/2 27 [002] 233.835819: sched:sched_switch: migration/2:27 [0] S ==> swapper/2:0 [120] swapper 0 [002] 233.835822: vpa-dtl: timebase: 338954486062657 dispatch_reason:decrementer_interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:435, ready_to_enqueue_time:0, waiting_to_ready_time:34775058, processor_id: 202 c0000000000f8094 plpar_hcall_norets_notrace+0x18 ([kernel.kallsyms]) swapper 0 [001] 233.835886: vpa-dtl: timebase: 338954486095398 dispatch_reason:priv_doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:542, ready_to_enqueue_time:0, waiting_to_ready_time:1245360, processor_id: 201 c0000000000f8094 plpar_hcall_norets_notrace+0x18 ([kernel.kallsyms]) Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 8644834a482a94e7da391a09af4d7f3672a5a400 Author: Athira Rajeev Date: Tue Sep 16 10:55:35 2025 +0530 perf powerpc: Process the DTL entries in queue and deliver samples Create samples from DTL entries for displaying in 'perf report' and 'perf script'. When the different PERF_RECORD_XX records are processed from perf session, powerpc_vpadtl_process_event() will be invoked. For each of the PERF_RECORD_XX record, compare the timestamp of perf record with timestamp of top element in the auxtrace heap. Process the auxtrace queue if the timestamp of element from heap is lower than timestamp from entry in perf record. Sometimes it could happen that one buffer is only partially processed. if the timestamp of occurrence of another event is more than currently processed element in the queue, it will move on to next perf record. So keep track of position of buffer to continue processing next time. Update the timestamp of the auxtrace heap with the timestamp of last processed entry from the auxtrace buffer. Generate perf sample for each entry in the dispatch trace log. Fill in the sample details: - sample ip is picked from srr0 field of dtl_entry - sample cpu is picked from processor_id of dtl_entry - sample id is from sample_id of powerpc_vpadtl - cpumode is set to PERF_RECORD_MISC_KERNEL - Additionally save the details in raw_data of sample. This is to print the relevant fields in perf_sample__fprintf_synth() when called from builtin-script The sample is processed by calling perf_session__deliver_synth_event() so that it gets included in perf report. Sample Output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf report # Samples: 321 of event 'vpa-dtl' # Event count (approx.): 321 # # Children Self Command Shared Object Symbol # ........ ........ ....... ................. .............................. # 100.00% 100.00% swapper [kernel.kallsyms] [k] plpar_hcall_norets_notrace Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit cd1c3b730a2a0455b405d7ecbd02a63b51cdc04b Author: Athira Rajeev Date: Tue Sep 16 10:55:34 2025 +0530 perf powerpc: Allocate and setup aux buffer queue to help co-relate with other events across CPU's When the Dispatch Trace Log data is collected along with other events like sched tracepoint events, it needs to be correlated and present interleaved along with these events. Perf events can be collected parallely across the CPUs. Hence it needs to be ensured events/dtl entries are processed in timestamp order. An auxtrace_queue is created for each CPU. Data within each queue is in increasing order of timestamp. Each auxtrace queue has a array/list of auxtrace buffers. When processing the auxtrace buffer, the data is mmapp'ed. All auxtrace queues is maintained in auxtrace heap. Each queue has a queue number and a timestamp. The queues are sorted/added to head based on the time stamp. So always the lowest timestamp (entries to be processed first) is on top of the heap. The auxtrace queue needs to be allocated and heap needs to be populated in the sorted order of timestamp. The queue needs to be filled with data only once via powerpc_vpadtl__update_queues() function. powerpc_vpadtl__setup_queues() iterates through all the entries to allocate and setup the auxtrace queue. To add to auxtrace heap, it is required to fetch the timebase of first entry for each of the queue. The first entry in the queue for VPA DTL PMU has the boot timebase, frequency details which are needed to get timestamp which is required to correlate with other events. The very next entry is the actual trace data that provides timestamp for occurrence of DTL event. Formula used to get the timestamp from dtl entry is: ((timbase from DTL entry - boot time) / frequency) * 1000000000 powerpc_vpadtl_decode() adds the boot time and frequency as part of powerpc_vpadtl_queue structure so that it can be reused. Each of the dtl_entry is of 48 bytes size. Sometimes it could happen that one buffer is only partially processed (if the timestamp of occurrence of another event is more than currently processed element in queue, it will move on to next event). In order to keep track of position of buffer, additional fields is added to powerpc_vpadtl_queue structure. Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 71feffa9c08675f65192a6b0d6ce168c620ba49a Author: Athira Rajeev Date: Tue Sep 16 10:55:33 2025 +0530 perf powerpc: Add event name as vpa-dtl of PERF_TYPE_SYNTH type to present DTL samples Dispatch Trace Log details are captured as-is in PERF_RECORD_AUXTRACE records. To present dtl entries as samples, create an event with name as "vpa-dtl" and type PERF_TYPE_SYNTH. Add perf_synth_id, "PERF_SYNTH_POWERPC_VPA_DTL" as config value for the event. Create a sample id to be a fixed offset from evsel id. To present the relevant fields from the "struct dtl_entry", prepare the entries as events of type PERF_TYPE_SYNTH. By defining as PERF_TYPE_SYNTH type, samples can be printed as part of perf_sample__fprintf_synth in builtin-script.c From powerpc_vpadtl_process_auxtrace_info(), invoke auxtrace_queues__process_index() function which will queue the auxtrace buffers by invoke auxtrace_queues__add_event(). Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit c4bbd4ec2e50a9ed7cc379556223977147c59278 Author: Athira Rajeev Date: Tue Sep 16 10:55:32 2025 +0530 perf powerpc: Process auxtrace events and display in 'perf report -D' Add VPA DTL PMU auxtrace process function for "perf report -D". The auxtrace event processing functions are defined in file "util/powerpc-vpadtl.c". Data structures used includes "struct powerpc_vpadtl_queue", "struct powerpc_vpadtl" to store the auxtrace buffers in queue. Different PERF_RECORD_XXX are generated during recording. PERF_RECORD_AUXTRACE_INFO is processed first since it is of type perf_user_event_type and perf session event delivers perf_session__process_user_event() first. Define function powerpc_vpadtl_process_auxtrace_info() to handle the processing of PERF_RECORD_AUXTRACE_INFO records. In this function, initialize the aux buffer queues using auxtrace_queues__init(). Setup the required infrastructure for aux data processing. The data is collected per CPU and auxtrace_queue is created for each CPU. Define powerpc_vpadtl_process_event() function to process PERF_RECORD_AUXTRACE records. In this, add the event to queue using auxtrace_queues__add_event() and process the buffer in powerpc_vpadtl_dump_event(). The first entry in the buffer with timebase as zero has boot timebase and frequency. Remaining data is of format for "struct powerpc_vpadtl_entry". Define the translation for dispatch_reasons and preempt_reasons, report this when dump trace is invoked via powerpc_vpadtl_dump() Sample output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf report -D 0 0 0x39b10 [0x30]: PERF_RECORD_AUXTRACE size: 0x690 offset: 0 ref: 0 idx: 0 tid: -1 cpu: 0 . . ... VPA DTL PMU data: size 1680 bytes, entries is 35 . 00000000: boot_tb: 21349649546353231, tb_freq: 512000000 . 00000030: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:7064, ready_to_enqueue_time:187, waiting_to_ready_time:6611773 . 00000060: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:146, ready_to_enqueue_time:0, waiting_to_ready_time:15359437 . 00000090: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:4868, ready_to_enqueue_time:232, waiting_to_ready_time:5100709 . 000000c0: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:179, ready_to_enqueue_time:0, waiting_to_ready_time:30714243 . 000000f0: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:197, ready_to_enqueue_time:0, waiting_to_ready_time:15350648 . 00000120: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:213, ready_to_enqueue_time:0, waiting_to_ready_time:15353446 . 00000150: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:212, ready_to_enqueue_time:0, waiting_to_ready_time:15355126 . 00000180: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:6368, ready_to_enqueue_time:164, waiting_to_ready_time:5104665 Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 1dbfaf94cf66ec4b19945aa4c76901e4af292a48 Author: Athira Rajeev Date: Tue Sep 16 10:55:31 2025 +0530 perf powerpc: Add basic CONFIG_AUXTRACE support for VPA pmu on powerpc The powerpc PMU collecting Dispatch Trace Log (DTL) entries makes use of AUX support in perf infrastructure. The PMU driver has the functionality to collect trace entries in the aux buffer. On the tools side, this data is made available as PERF_RECORD_AUXTRACE records. This record is generated by "perf record" command. To enable the creation of PERF_RECORD_AUXTRACE, add functions to initialize auxtrace records ie "auxtrace_record__init()". Fill in fields for other callbacks like info_priv_size, info_fill, free, recording options etc. Define auxtrace_type as PERF_AUXTRACE_VPA_DTL. Add header file to define vpa dtl pmu specific details. Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 58a606149c60d5da554302a7a08234cf3ca259f4 Author: Ian Rogers Date: Sun Sep 14 11:33:53 2025 -0700 perf sched: Avoid union type punning undefined behavior A union is used to set the priv value in thread (a void*) to a boolean value through type punning. Undefined behavior sanitizer fails on this. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 4e66293bb141df33d5eb1f922e16fe05913bf296 Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 14:27:16 2025 +0530 of: doc: Fix typo in doc comments. synthetized => synthesized definied => defined sucess => success Signed-off-by: Bhanu Seshu Kumar Valluri Signed-off-by: Rob Herring (Arm) commit f9a68cf7b9afeb1780527f840995fc4292a2202a Author: Akiyoshi Kurita Date: Tue Sep 30 22:45:47 2025 +0900 dt-bindings: mmc: Correct typo "upto" to "up to" The word "upto" is a typo for "up to". Correct this typo in the mmc-controller-common binding documentation. Signed-off-by: Akiyoshi Kurita Signed-off-by: Rob Herring (Arm) commit 241f21be7d0fdf3c1792ed7e61f90a9f5eecd03e Author: Veronika Molnarova Date: Tue Sep 30 18:09:17 2025 +0200 perf test perftool_testsuite: Use absolute paths Test cases from perftool_testsuite are affected by the current directory where the test are run. For this reason, the test driver has to change the directory to the base_dir for references to work correctly. Utilize absolute paths when sourcing and referencing other scripts so that the current working directory doesn't impact the test cases. Reviewed-by: Ian Rogers Signed-off-by: Jakub Brnak Signed-off-by: Michael Petlan Signed-off-by: Veronika Molnarova Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit a93b9ccb03a2b27c49bdadb0e2da036451794f92 Author: Markus Heidelberg Date: Thu Sep 25 13:26:13 2025 +0200 perf tools: Fix duplicated words in documentation and comments - "the the" - "in in" - "a a" Reviewed-by: Ian Rogers Signed-off-by: Markus Heidelberg Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit fa06c482790ce425dd090c051934023c0b49dcc2 Merge: 950c6451a5c38d ba6018929165fc Author: Rafael J. Wysocki Date: Wed Oct 1 13:59:28 2025 +0200 Merge tag 'cpufreq-arm-updates-6.18-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge CPUFreq fixes for 6.18 from Viresh Kumar: "- Update frequency for all tegra CPUs (Aaron Kling). - Fix device leak in mediatek driver (Johan Hovold). - Rust cpufreq helper cleanup (Thorsten Blum)." * tag 'cpufreq-arm-updates-6.18-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure commit 950c6451a5c38d375993c3b9da427e2e69b01c30 Author: Rafael J. Wysocki Date: Fri Sep 26 12:31:47 2025 +0200 cpufreq: Drop unused symbol CPUFREQ_ETERNAL Drop CPUFREQ_ETERNAL that has no users any more along with all references to it in the documentation. No functional impact. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit c28a280bd465690981099cd6e43dfcfa5c28b133 Author: Rafael J. Wysocki Date: Fri Sep 26 12:29:50 2025 +0200 ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value Instead of using CPUFREQ_ETERNAL for signaling an error condition in cppc_get_transition_latency(), change the return value type of that function to int and make it return a proper negative error code on failures. No intentional functional impact. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit f965d111e68f4a993cc44d487d416e3d954eea11 Author: Rafael J. Wysocki Date: Fri Sep 26 12:19:41 2025 +0200 cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay If cppc_get_transition_latency() returns CPUFREQ_ETERNAL to indicate a failure to retrieve the transition latency value from the platform firmware, the CPPC cpufreq driver will use that value (converted to microseconds) as the policy transition delay, but it is way too large for any practical use. Address this by making the driver use the cpufreq's default transition latency value (in microseconds) as the transition delay if CPUFREQ_ETERNAL is returned by cppc_get_transition_latency(). Fixes: d4f3388afd48 ("cpufreq / CPPC: Set platform specific transition_delay_us") Cc: 5.19+ # 5.19 Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit f97aef092e199c10a3da96ae79b571edd5362faa Author: Rafael J. Wysocki Date: Fri Sep 26 12:12:37 2025 +0200 cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency Commit a755d0e2d41b ("cpufreq: Honour transition_latency over transition_delay_us") caused platforms where cpuinfo.transition_latency is CPUFREQ_ETERNAL to get a very large transition latency whereas previously it had been capped at 10 ms (and later at 2 ms). This led to a user-observable regression between 6.6 and 6.12 as described by Shawn: "The dbs sampling_rate was 10000 us on 6.6 and suddently becomes 6442450 us (4294967295 / 1000 * 1.5) on 6.12 for these platforms because the default transition delay was dropped [...]. It slows down dbs governor's reacting to CPU loading change dramatically. Also, as transition_delay_us is used by schedutil governor as rate_limit_us, it shows a negative impact on device idle power consumption, because the device gets slightly less time in the lowest OPP." Evidently, the expectation of the drivers using CPUFREQ_ETERNAL as cpuinfo.transition_latency was that it would be capped by the core, but they may as well return a default transition latency value instead of CPUFREQ_ETERNAL and the core need not do anything with it. Accordingly, introduce CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS and make all of the drivers in question use it instead of CPUFREQ_ETERNAL. Also update the related Rust binding. Fixes: a755d0e2d41b ("cpufreq: Honour transition_latency over transition_delay_us") Closes: https://lore.kernel.org/linux-pm/20250922125929.453444-1-shawnguo2@yeah.net/ Reported-by: Shawn Guo Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Acked-by: Viresh Kumar Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2264949.irdbgypaU6@rafael.j.wysocki [ rjw: Fix typo in new symbol name, drop redundant type cast from Rust binding ] Tested-by: Shawn Guo # with cpufreq-dt driver Reviewed-by: Qais Yousef Signed-off-by: Rafael J. Wysocki commit ed9f3ab9f3d3655e7447239cac80e4e0388faea8 Author: Xichao Zhao Date: Mon Aug 18 18:28:48 2025 +0800 virtio-vdpa: Drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. Signed-off-by: Xichao Zhao Message-Id: <20250818102848.578875-1-zhao.xichao@vivo.com> Signed-off-by: Michael S. Tsirkin commit 3fc3068e7247c94dec08e93fea422a1bb649bfe5 Author: Sheng Zhao Date: Thu Sep 25 19:35:16 2025 +0800 vduse: Use fixed 4KB bounce pages for non-4KB page size The allocation granularity of bounce pages is PAGE_SIZE. This may cause even small IO requests to occupy an entire bounce page exclusively. The kind of memory waste will be more significant when PAGE_SIZE is larger than 4KB (e.g. arm64 with 64KB pages). So, optimize it by using fixed 4KB bounce maps and iova allocation granularity. A single IO request occupies at least a 4KB bounce page instead of the entire memory page of PAGE_SIZE. Signed-off-by: Sheng Zhao Message-Id: <20250925113516.60305-1-sheng.zhao@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 1c14b0e4ba988381e362ad8a9651eff0b21bd47f Author: Jason Wang Date: Wed Sep 24 15:00:45 2025 +0800 vduse: switch to use virtio map API instead of DMA API Lacking the support of device specific mapping supported in virtio, VDUSE must trick the DMA API in order to make virtio-vdpa transport work. This is done by advertising vDPA device as dma device with a VDUSE specific dma_ops even if it doesn't do DMA at all. This will be fixed by this patch. Thanks to the new mapping operations support by virtio and vDPA. VDUSE can simply switch to advertise its specific mappings operations to virtio via virtio-vdpa then DMA API is not needed for VDUSE any more and iova domain could be used as the mapping token instead. Signed-off-by: Jason Wang Message-Id: <20250924070045.10361-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Eugenio Pérez commit 0d16cc439f36355d04b17ac45c3001d90969aa44 Author: Jason Wang Date: Wed Sep 24 15:00:44 2025 +0800 vdpa: introduce map ops Virtio core allows the transport to provide device or transport specific mapping functions. This patch adds this support to vDPA. We can simply do this by allowing the vDPA parent to register a virtio_map_ops. Reviewed-by: Christoph Hellwig Signed-off-by: Jason Wang Message-Id: <20250924070045.10361-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Eugenio Pérez commit 58aca3dbc7d8891a016cb17d488af3002812793b Author: Jason Wang Date: Thu Aug 21 14:46:39 2025 +0800 vdpa: support virtio_map Virtio core switches from DMA device to virtio_map, let's do that as well for vDPA. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-8-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit bee8c7c24b737338216dc0f87d6c47a4abaf609a Author: Jason Wang Date: Thu Aug 21 14:46:38 2025 +0800 virtio: introduce map ops in virtio core This patch introduces map operations for virtio device. Virtio used to use DMA API which is not necessarily the case since some devices doesn't do DMA. Instead of using tricks and abusing DMA API, let's simply abstract the current mapping logic into a virtio specific mapping operations. For the device or transport that doesn't do DMA, they can implement their own mapping logic without the need to trick DMA core. In this case the mapping metadata is opaque to the virtio core that will be passed back to the transport or device specific map operations. For other devices, DMA API will still be used, so map token will still be the dma device to minimize the changeset and performance impact. The mapping operations are abstracted as a independent structure instead of reusing virtio_config_ops. This allows the transport can simply reuse the structure for lower layers like vDPA. A set of new mapping helpers were introduced for the device that want to do mapping by themselves. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-7-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 201e52ffe3349396303f741d098a9d285c52f44e Author: Jason Wang Date: Thu Aug 21 14:46:37 2025 +0800 virtio_ring: rename dma_handle to map_handle Following patch will introduce virtio map operations which means the address is not necessarily used for DMA. Let's rename the dma_handle to map_handle first. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-6-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit b16060c5c7d56455da3c3c50b4a20a83c2a30810 Author: Jason Wang Date: Thu Aug 21 14:46:36 2025 +0800 virtio: introduce virtio_map container union Following patch will introduce the mapping operations for virtio device. In order to achieve this, besides the dma device, virtio core needs to support a transport or device specific mapping metadata as well. So this patch introduces a union container of a dma device. The idea is the allow the transport layer to pass device specific mapping metadata which will be used as a parameter for the virtio mapping operations. For the transport or device that is using DMA, dma device is still being used. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-5-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit b41cb3bcf67fcb7b8297e5acc5bb3309c96c2ff2 Author: Jason Wang Date: Thu Aug 21 14:46:35 2025 +0800 virtio: rename dma helpers Following patch will introduce virtio mapping function to avoid abusing DMA API for device that doesn't do DMA. To ease the introduction, this patch rename "dma" to "map" for the current dma mapping helpers. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 447beec8065b7505c09d1c16257ff9057ec29672 Author: Jason Wang Date: Thu Aug 21 14:46:34 2025 +0800 virtio_ring: switch to use dma_{map|unmap}_page() This patch switches to use dma_{map|unmap}_page() to reduce the coverage of DMA operations. This would help for the following rework on the virtio map operations. Reviewed-by: Christoph Hellwig Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 7d096cb3e16f09d9762ae8cef897cdbc13a40029 Author: Jason Wang Date: Thu Aug 21 14:46:33 2025 +0800 virtio_ring: constify virtqueue pointer for DMA helpers This patch constifies the virtqueue pointer for DMA helpers. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Reviewed-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 642d82e3c3f0166a0742f65356c4358c4936a1ca Author: Qianfeng Rong Date: Thu Aug 7 21:26:42 2025 +0800 virtio_balloon: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Message-Id: <20250807132643.546237-1-rongqianfeng@vivo.com> Signed-off-by: Michael S. Tsirkin commit c0e1116189acfec74c8f5032da257b954d3f757f Author: Michael S. Tsirkin Date: Tue Sep 23 17:44:26 2025 -0400 vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values. Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Cc: "Stefano Garzarella" Cc: zhang jiao Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com Message-ID: Signed-off-by: Michael S. Tsirkin commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b Author: zhang jiao Date: Wed Sep 10 17:17:38 2025 +0800 vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal. Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Cc: "Stefano Garzarella" Signed-off-by: zhang jiao Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> Signed-off-by: Michael S. Tsirkin commit b9d6cfe2ae699bbf230a6c8e0e32212b04bff661 Author: Ioana Ciornei Date: Mon Sep 22 17:24:20 2025 +0300 mfd: simple-mfd-i2c: Add compatible string for LX2160ARDB Extend the list of supported devices with the QIXIS FPGA found on the LX2160ARDB board. Signed-off-by: Ioana Ciornei Signed-off-by: Lee Jones commit 3ed50d77924ff2e35918739df145dd429cee0ce4 Author: Ioana Ciornei Date: Mon Sep 22 17:24:19 2025 +0300 mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order Reorder the of_device_id structures so that they are in alphabetical order. Signed-off-by: Ioana Ciornei Signed-off-by: Lee Jones commit 02dde2c4c32e8c8404a890d6092a66dbe0f36564 Author: Jihed Chaibi Date: Sun Sep 14 21:25:14 2025 +0200 dt-bindings: mfd: twl: Add missing sub-nodes for TWL4030 & TWL603x Update the main TI TWL-family binding to be self-contained and to fix pre-existing validation errors. To ensure future patches are bisectable, child nodes whose bindings are in other patches (audio, keypad, usb, etc.) are now defined using a flexible 'additionalProperties: true' pattern. This removes hard dependencies between the MFD and subsystem bindings. The complete dtbs_check for this binding is clean except for two warnings originating from pre-existing bugs in the OMAP DTS files, for which fixes have already been submitted separately [1][2]. Reviewed-by: Rob Herring Acked-by: Uwe Kleine-König Signed-off-by: Jihed Chaibi Reviewed-by: Andreas Kemnade Signed-off-by: Lee Jones commit 354f31e9d2a3e4799d3d057a9e1c9f7ae7348bba Author: Michael Walle Date: Fri Sep 12 14:07:43 2025 +0200 dt-bindings: watchdog: Add SMARC-sAM67 support The SMARC-sAM67 board has an on-board uC which has the same register interface as the older CPLD implementation on the SMARC-sAL28 board. Although the MCU emulates the same behavior, be prepared for any quirks and add a board specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Lee Jones commit 59863239e09f435e4dd3393637adc4d657772de5 Author: Michael Walle Date: Fri Sep 12 14:07:40 2025 +0200 dt-bindings: mfd: tps6594: Allow gpio-line-names Setting the signal names in the device tree was already possible, but it will lead to a warning. Allow the gpio-line-names property to fix that. Signed-off-by: Michael Walle Acked-by: "Rob Herring (Arm)" Signed-off-by: Lee Jones commit c91a0e4e549d0457c61f2199fcd84d699400bee1 Author: Ilpo Järvinen Date: Mon Sep 15 14:29:36 2025 +0300 mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs Add Intel Wildcat Lake PCI IDs. Signed-off-by: Ilpo Järvinen Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Lee Jones commit 73ba00d86a9800d8f5ab1f2e1eb4b852da85aad4 Author: Duje Mihanović Date: Thu Sep 11 14:43:46 2025 +0200 mfd: 88pm886: Add GPADC cell Add a cell for the PMIC's onboard General Purpose ADC. Acked-by: Karel Balej # for the PMIC Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250911-88pm886-gpadc-v4-3-60452710d3a0@dujemihanovic.xyz Signed-off-by: Lee Jones commit 800d2c631c2496b676b2ffa969b4cab1d59d5a9b Author: Bartosz Golaszewski Date: Wed Sep 10 09:25:45 2025 +0200 mfd: vexpress-sysreg: Use more common syntax for compound literals The (typeof(foo)) construct is unusual in the kernel, use a more typical syntax by explicitly spelling out the type. Link: https://lore.kernel.org/all/20250909-gpio-mmio-gpio-conv-part4-v1-13-9f723dc3524a@linaro.org/ Suggested-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Acked-by: Sudeep Holla Link: https://lore.kernel.org/r/20250910-make-compound-literals-normal-again-v1-1-076ee7738a0b@linaro.org Signed-off-by: Lee Jones commit da32b0e82c523b76265ba1ad25d7ea74f0ece402 Author: Cosmin Tanislav Date: Wed Sep 10 20:59:06 2025 +0300 mfd: rz-mtu3: Fix MTU5 NFCR register offset The NFCR register for MTU5 is at 0x1a95 offset according to Datasheet Page 725, Table 16.4. The address of all registers is offset by 0x1200, making the proper address of MTU5 NFCR register be 0x895. Cc: stable@vger.kernel.org Fixes: 654c293e1687 ("mfd: Add Renesas RZ/G2L MTU3a core driver") Signed-off-by: Cosmin Tanislav Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20250910175914.12956-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones commit 605c9820e44de2da7d67acf66484136561da63a2 Author: Dzmitry Sankouski Date: Tue Sep 9 21:23:07 2025 +0300 mfd: max77705: Setup the core driver as an interrupt controller Current implementation describes only MFD's own topsys interrupts. However, max77705 has a register which indicates interrupt source, i.e. it acts as an interrupt controller. There's 4 interrupt sources in max77705: topsys, charger, fuelgauge, usb type-c manager. Setup max77705 MFD parent as an interrupt controller. Delete topsys interrupts because currently unused. Remove shared interrupt flag, because we're are an interrupt controller now, and subdevices should request interrupts from us. Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC") Signed-off-by: Dzmitry Sankouski Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com Signed-off-by: Lee Jones commit afe0f94992dbe6cc6a38fdb2c8ed2f0f265e3e6e Author: Charles Keepax Date: Wed Sep 3 10:45:49 2025 +0100 mfd: cs42l43: Remove IRQ masking in suspend Now the individual child drivers mask their own IRQs there is no need for the MFD code to do so anymore. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250903094549.271068-7-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones commit 62aec8a0a5b61f149bbe518c636e38e484812499 Author: Charles Keepax Date: Wed Sep 3 10:45:48 2025 +0100 mfd: cs42l43: Move IRQ enable/disable to encompass force suspend As pm_runtime_force_suspend() will force the device state to suspend, the driver needs to ensure no IRQ handlers are currently running. If not those handlers may find they are now running on suspended hardware despite holding a PM runtime reference. disable_irq() will sync any currently running handlers, so move the IRQ disabling to cover the whole of the forced suspend state to avoid such race conditions. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250903094549.271068-6-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones commit d952bba3fbb5d8a3c961e32bae3f7ff19a18762f Author: Binbin Zhou Date: Thu Sep 4 20:35:06 2025 +0800 mfd: ls2kbmc: Add Loongson-2K BMC reset function support Since the display is a sub-function of the Loongson-2K BMC, when the BMC reset, the entire BMC PCIe is disconnected, including the display which is interrupted. Quick overview of the entire LS2K BMC reset process: There are two types of reset methods: soft reset (BMC-initiated reboot of IPMI reset command) and BMC watchdog reset (watchdog timeout). First, regardless of the method, an interrupt is generated (PCIe interrupt for soft reset/GPIO interrupt for watchdog reset); Second, during the interrupt process, the system enters bmc_reset_work, clears the bus/IO/mem resources of the LS7A PCI-E bridge, waits for the BMC reset to begin, then restores the parent device's PCI configuration space, waits for the BMC reset to complete, and finally restores the BMC PCI configuration space. Display restoration occurs last. Co-developed-by: Chong Qiao Signed-off-by: Chong Qiao Reviewed-by: Huacai Chen Acked-by: Corey Minyard Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/de4e04b42ff9ee282f86f9bb9efbf959a9848205.1756987761.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones commit 0d64f6d1ffe96f59145481f7413344b1fa3ad1ce Author: Binbin Zhou Date: Thu Sep 4 20:35:05 2025 +0800 mfd: ls2kbmc: Introduce Loongson-2K BMC core driver The Loongson-2K Board Management Controller provides an PCIe interface to the host to access the feature implemented in the BMC. The BMC is assembled on a server similar to the server machine with Loongson-3 CPU. It supports multiple sub-devices like DRM and IPMI. Co-developed-by: Chong Qiao Signed-off-by: Chong Qiao Reviewed-by: Huacai Chen Acked-by: Corey Minyard Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/0dc1fd53020ce2562453961ffed2cd9eb8f359e1.1756987761.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones commit 719d02a25a24601c6fb8a7b1627e1abf015b6c2a Author: Matti Vaittinen Date: Thu Aug 21 20:23:34 2025 +0200 mfd: bd71828, bd71815: Prepare for power-supply support Add core support for ROHM BD718(15/28/78) PMIC's charger blocks. Signed-off-by: Matti Vaittinen Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20250821-bd71828-charger-v3-1-cc74ac4e0fb9@kemnade.info Signed-off-by: Lee Jones commit b445c14ac7eb39447a364c142aa85b6487b30c67 Author: Ryan Chen Date: Sun Aug 31 10:14:36 2025 +0800 dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles Add SCU interrupt controller compatible strings for the AST2700 SoC: scu-ic0 to 3. This extends the MFD binding to support AST2700-based platforms. Signed-off-by: Ryan Chen Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250831021438.976893-3-ryan_chen@aspeedtech.com Signed-off-by: Lee Jones commit 99e2f00cf418c2e12fc934ae2ba790870e98fd67 Author: Rob Herring (Arm) Date: Fri Aug 29 18:04:49 2025 -0500 dt-bindings: mfd: Convert aspeed,ast2400-p2a-ctrl to DT schema Convert the aspeed,ast2x00-p2a-ctrl binding to DT schema format. The schema is simple enough to just add it to the parent aspeed,ast2x00-scu binding. Signed-off-by: "Rob Herring (Arm)" Acked-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250829230450.1496151-1-robh@kernel.org Signed-off-by: Lee Jones commit 5872dcccc5ade97bc27aafe13e361bb8e7c73da1 Author: Alexander Kurz Date: Fri Aug 29 20:15:16 2025 +0000 dt-bindings: mfd: fsl,mc13xxx: Add buttons node Add a buttons node and properties describing the "ONOFD" (MC13783) and "PWRON" (MC13892/MC34708) buttons available in the fsl,mc13xxx PMIC ICs. Signed-off-by: Alexander Kurz Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250829201517.15374-7-akurz@blala.de Signed-off-by: Lee Jones commit 1160f9f88be2a911a8d7a27a896b24360a1763c9 Author: Alexander Kurz Date: Fri Aug 29 20:15:15 2025 +0000 dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema Convert the txt mc13xxx bindings to DT schema attempting to keep most information. The nodes codec and touchscreen are not part of the new schema since it was only briefly mentioned before. Following the convention, rename led-control to fsl,led-control. Signed-off-by: Alexander Kurz Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250829201517.15374-6-akurz@blala.de Signed-off-by: Lee Jones commit 9b959e525fa7e8518e57554b6e17849942938dfc Author: Janne Grunau Date: Thu Aug 28 16:01:37 2025 +0200 mfd: macsmc: Add "apple,t8103-smc" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,smc" anymore [1]. Use "apple,t8103-smc" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250828-dt-apple-t6020-v1-18-507ba4c4b98e@jannau.net Signed-off-by: Lee Jones commit 5f4bbee069836e51ed0b6d7e565a292f070ababc Author: Bastien Curutchet Date: Wed Aug 20 16:21:13 2025 +0200 mfd: core: Increment of_node's refcount before linking it to the platform device When an MFD device is added, a platform_device is allocated. If this device is linked to a DT description, the corresponding OF node is linked to the new platform device but the OF node's refcount isn't incremented. As of_node_put() is called during the platform device release, it leads to a refcount underflow. Call of_node_get() to increment the OF node's refcount when the node is linked to the newly created platform device. Signed-off-by: Bastien Curutchet Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com Signed-off-by: Lee Jones commit 8a498184e2e8aac24db0faf295b7d0fb62dfe90d Author: Conor Dooley Date: Mon Sep 1 12:04:13 2025 +0100 dt-bindings: mfd: syscon: Document the control-scb syscon on PolarFire SoC The "control-scb" region, contains the "tvs" temperature and voltage sensors and the control/status registers for the system controller's mailbox. The mailbox has a dedicated node, so there's no need for a child node describing it, looking the syscon up by compatible is sufficient. Acked-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20250901-shorten-yahoo-223aeaecd290@spud Signed-off-by: Lee Jones commit 6fc5d415c10e98ac1b31dd1d5653443e691cdcff Author: Alex Elder Date: Mon Aug 25 12:20:51 2025 -0500 mfd: simple-mfd-i2c: Add SpacemiT P1 support Enable support for the RTC and regulators found in the SpacemiT P1 PMIC. Support is implemented by the simple I2C MFD driver. The P1 PMIC is normally implemented with the SpacemiT K1 SoC. This PMIC provides 6 buck converters and 12 LDO regulators. It also implements a switch, watchdog timer, real-time clock, and more. Initially its RTC and regulators are supported. Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20250825172057.163883-3-elder@riscstar.com Signed-off-by: Lee Jones commit 8566de1cf6892647c034c576caec772e6cf2c952 Author: Alex Elder Date: Mon Aug 25 12:20:50 2025 -0500 dt-bindings: mfd: Add support the SpacemiT P1 PMIC Enable the SpacemiT P1, which is an I2C-controlled PMIC. Initially only the RTC and regulators will be supported. Signed-off-by: Alex Elder Reviewed-by: "Rob Herring (Arm)" Acked-by: Troy Mitchell Link: https://lore.kernel.org/r/20250825172057.163883-2-elder@riscstar.com Signed-off-by: Lee Jones commit a598ae45f48d7d5a17f8290f2f5bd46046fd0b9b Author: Michael Walle Date: Fri Aug 22 15:15:26 2025 +0200 dt-bindings: mfd: sl28cpld: Add sa67mcu compatible The Kontron SMARC-sAM67 module features an on-board house keeping uC. It's designed to be compatible with the older on-board CPLD used on the SMARC-sAL28 board. To be prepared for any board specific quirks, add a specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822131531.1366437-3-mwalle@kernel.org Signed-off-by: Lee Jones commit eca0259e3b9c0d532051727d3d85fd8a42138f71 Author: Arnd Bergmann Date: Fri Aug 8 17:17:58 2025 +0200 mfd: aat2870: Add GPIOLIB_LEGACY dependency This driver uses the legacy gpiolib interfaces to get gpio numbers from platform data. There are no in-tree users of this driver, so nothing defines the platform data. Add a dependency on GPIOLIB_LEGACY for the moment to avoid the build failure, and make sure the sound driver does not get built without the mfd portion either pass that dependency along. Alternatively, we could remove the mfd driver along with the backlight and regulator portions. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-15-arnd@kernel.org Signed-off-by: Lee Jones commit e399d779c9acf277488c5b306b71dcbc71e160ca Author: Arnd Bergmann Date: Fri Aug 8 17:17:57 2025 +0200 mfd: si476x: Add GPIOLIB_LEGACY dependency This driver uses the legacy gpiolib interfaces to get gpio numbers from platform data: drivers/mfd/si476x-i2c.c: In function 'si476x_core_start': drivers/mfd/si476x-i2c.c:133:21: error: implicit declaration of function 'gpio_is_valid'; did you mean 'uuid_is_valid'? [-Werror=implicit-function-declaration] 133 | if (gpio_is_valid(core->gpio_reset)) There are no in-tree users of this driver, so nothing defines the platform data. Add a dependency on GPIOLIB_LEGACY for the moment to avoid the build failure, and make sure the sound driver does not get built without the mfd portion either pass that dependency along. Alternatively, we could remove the mfd driver along with the radio and sound portions. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507231653.UFlH2dMO-lkp@intel.com/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-14-arnd@kernel.org Signed-off-by: Lee Jones commit 3d6a17fccc2832d8bc84420a634330941509d6e1 Author: Krzysztof Kozlowski Date: Mon Aug 25 10:12:02 2025 +0200 dt-bindings: mfd: Move embedded controllers to own directory Move several embedded controller bindings (like ChromeOS EC, Gateworks System Controller and Kontron sl28cpld Board Management) to new subdirectory "embedded-controller" matching their purpose. An embedded controller (EC) is a discrete component that contains a microcontroller (i.e. a small CPU running a small firmware without operating system) mounted into a larger computer system running a fully fledged operating system that needs to utilize the embedded controller as part of its operation. So far the EC bindings were split between "mfd" and "platform" directory. MFD name comes from Linux, not hardware, and "platform" is a bit too generic. Rename Gateworks GSC and Huawei Gaokun filenames to match compatible, as preferred for bindings. Acked-by: Michael Walle # for sl28cpld Reviewed-by: Linus Walleij Signed-off-by: Krzysztof Kozlowski Acked-by: Mark Brown Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250825081201.9775-2-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit fcbe47a83a41cfbf49eb96649acea38605aeaba6 Author: Wolfram Sang Date: Wed Aug 13 18:14:55 2025 +0200 mfd: Remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-10-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 9c5ad8374b1fe0c8c9eaabc1146d96a543858c4a Author: Arnd Bergmann Date: Fri Aug 8 17:17:56 2025 +0200 mfd: arizona: Make legacy gpiolib interface optional The only machine that still uses the old gpio number based interface is the wlf_cragg_6410 board file. In order to remove the dependency on the interfaces, add #ifdef blocks here. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-13-arnd@kernel.org Signed-off-by: Lee Jones commit a5b03d81c23ef2aae8a88dc9da009a56b4bbb8f6 Author: Xichao Zhao Date: Fri Aug 15 18:06:01 2025 +0800 mfd: max899x: Use dedicated interrupt wake setters Use enable_irq_wake() and disable_irq_wake() instead of calling low-level irq_set_irq_wake() with a parameter. No functional changes. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250815100601.622923-1-zhao.xichao@vivo.com Signed-off-by: Lee Jones commit c1c8ed81e200126b711ee5b012e1fa9a0da2cbe1 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:18 2025 -0500 dt-bindings: mfd: syscon: Add "marvell,armada-3700-usb2-host-device-misc" compatible Add the "marvell,armada-3700-usb2-host-device-misc" compatible which is already in use. Signed-off-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250812203319.729300-1-robh@kernel.org Signed-off-by: Lee Jones commit ec9b6f054d9de2bc7a713741980c84886a39cd7a Author: Xichao Zhao Date: Tue Aug 12 17:31:04 2025 +0800 mfd: kempld: Use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250812093104.103193-1-zhao.xichao@vivo.com Signed-off-by: Lee Jones commit 58091331b59eebc9bf725178be87021d20e4ec2d Author: Rob Herring (Arm) Date: Thu Aug 7 08:29:08 2025 -0500 dt-bindings: mfd: aspeed-lpc: Add missing "clocks" property on lpc-snoop node The ASpeed lpc-snoop nodes have a "clocks" property which isn't documented. It looks like all the LPC child devices have the same clock source. Perhaps it is the parent device that should have the clock, but it's too late for that. The driver for lpc-snoop requires a clock to be present. Signed-off-by: "Rob Herring (Arm)" Acked-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250807132909.3291770-1-robh@kernel.org Signed-off-by: Lee Jones commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 Author: Arnd Bergmann Date: Thu Aug 7 09:19:28 2025 +0200 mfd: madera: Work around false-positive -Wininitialized warning clang-21 warns about one uninitialized variable getting dereferenced in madera_dev_init: drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized] 739 | mfd_devs, n_devs, | ^~~~~~~~ drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning 459 | const struct mfd_cell *mfd_devs; | ^ | = NULL The code is actually correct here because n_devs is only nonzero when mfd_devs is a valid pointer, but this is impossible for the compiler to see reliably. Change the logic to check for the pointer as well, to make this easier for the compiler to follow. Signed-off-by: Arnd Bergmann Reviewed-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org Signed-off-by: Lee Jones commit 99767a0c8bb4e206f6cea37f5162073d1899168c Author: Waqar Hameed Date: Tue Aug 5 11:33:34 2025 +0200 mfd: macsmc: Remove error prints for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/pnd8qjym7td.a.out@axis.com Signed-off-by: Lee Jones commit 9ac4890ac39352ccea132109e32911495574c3ec Author: Jens Kehne Date: Mon Aug 4 15:37:54 2025 +0200 mfd: da9063: Split chip variant reading in two bus transactions We observed the initial probe of the da9063 failing in da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based board. The problem originates in da9063_i2c_blockreg_read, which uses a single bus transaction to turn the register page and then read a register. On the bus, this should translate to a write to register 0, followed by a read to the target register, separated by a repeated start. However, we found that after the write to register 0, the controller sometimes continues directly with the register address of the read request, without sending the chip address or a repeated start in between, which makes the read request invalid. To fix this, separate turning the page and reading the register into two separate transactions. This brings the initialization code in line with the rest of the driver, which uses register maps (which to my knowledge do not use repeated starts after turning the page). This has been included in our kernel for several months and was recently included in a shipped product. For us, it reliably fixes the issue, and we have not observed any new issues. While the underlying problem is probably with the i2c controller or its driver, I still propose a change here in the interest of robustness: First, I'm not sure this issue can be fixed on the controller side, since there are other issues related to repeated start which can't (AR# 60695, AR# 61664). Second, similar problems might exist with other controllers. Signed-off-by: Jens Kehne Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com Signed-off-by: Lee Jones commit 64e0d839c589f4f2ecd2e3e5bdb5cee6ba6bade9 Author: Hans de Goede Date: Mon Aug 4 15:32:40 2025 +0200 mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag Testing has shown that reading multiple registers at once (for 10-bit ADC values) does not work. Set the use_single_read regmap_config flag to make regmap split these for us. This should fix temperature opregion accesses done by drivers/acpi/pmic/intel_pmic_chtdc_ti.c and is also necessary for the upcoming drivers for the ADC and battery MFD cells. Fixes: 6bac0606fdba ("mfd: Add support for Cherry Trail Dollar Cove TI PMIC") Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250804133240.312383-1-hansg@kernel.org Signed-off-by: Lee Jones commit 71f529e9fedc377b43b73ec9d28ec59d9a3a2792 Author: Heiko Stuebner Date: Mon Aug 4 15:07:26 2025 +0200 mfd: qnap-mcu: Improve structure in qnap_mcu_exec Now with guard(mutex) in place, we can make the function's structure a bit easier to read, by removing the nested if-else-clauses. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-5-heiko@sntech.de Signed-off-by: Lee Jones commit 21c5ffb4211203de0a91de8a1c4a329e508a2ffb Author: Heiko Stuebner Date: Mon Aug 4 15:07:25 2025 +0200 mfd: qnap-mcu: Convert to guard(mutex) in qnap_mcu_exec guard() makes sure that the mutex gets unlocked when the function returns and thus removes the need for unlock gotos or similar mechanisms and therefore allows for a simpler function structure. So convert the qnap_mcu_exec function to use it. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-4-heiko@sntech.de Signed-off-by: Lee Jones commit bf2de43060d528e52e372c63182a94b95c80d305 Author: Heiko Stuebner Date: Mon Aug 4 15:07:24 2025 +0200 mfd: qnap-mcu: Handle errors returned from qnap_mcu_write qnap_mcu_write can return errors and those were not checked before. So do that now. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-3-heiko@sntech.de Signed-off-by: Lee Jones commit 5e1c88679174e4bfe5d152060b06d370bd85de80 Author: Heiko Stuebner Date: Mon Aug 4 15:07:23 2025 +0200 mfd: qnap-mcu: Include linux/types.h in qnap-mcu.h shared header Relying on other components to include those basic types is unreliable and may cause compile errors like: ../include/linux/mfd/qnap-mcu.h:13:9: error: unknown type name ‘u32’ 13 | u32 baud_rate; | ^~~ ../include/linux/mfd/qnap-mcu.h:17:9: error: unknown type name ‘bool’ 17 | bool usb_led; | ^~~~ So make sure, the types used in the header are available. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-2-heiko@sntech.de Signed-off-by: Lee Jones commit 309e65d151ab9be1e7b01d822880cd8c4e611dff Author: Heijligen, Thomas Date: Thu Jul 31 14:45:00 2025 +0000 mfd: kempld: Switch back to earlier ->init() behavior Commit 9e36775c22c7 ("mfd: kempld: Remove custom DMI matching code") removes the ability to load the driver if no matching system DMI data is found. Before this commit the driver could be loaded using alternative methods such as ACPI or `force_device_id` in the absence of a matching system DMI entry. Restore this ability while keeping the refactored `platform_device_info` table. Signed-off-by: Thomas Heijligen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/7d2c7e92253d851194a781720051536cca2722b8.camel@secunet.com Signed-off-by: Lee Jones commit 597b398bc27c84f3998c2169ad7ce74e8404533a Author: Heiko Stuebner Date: Wed Jul 30 19:22:47 2025 +0200 dt-bindings: mfd: qnap,ts433-mcu: Allow nvmem-layout child node The MCU has an eeprom memory connected internally, that for example contains some mac-addresses for the soc gmac controllers. Therefore allow defining the nvmem-layout for the eeprom. Signed-off-by: Heiko Stuebner Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250730172248.1875122-2-heiko@sntech.de Signed-off-by: Lee Jones commit 865417d5652d9e6de021c558e38fe94db0a778ea Author: Heiko Stuebner Date: Wed Jul 30 19:34:23 2025 +0200 mfd: qnap-mcu: Add driver data for TS233 variant Add the TS233 compatible and affiliated driver data to qnap-mcu. The TS233 is mostly similar to the TS433, except not having any of the PCIe components, so there are only 2 drives. The fan pwm-limits from the vendor-configuration also are the same as for the ts433 variant. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250730173423.1878599-3-heiko@sntech.de Signed-off-by: Lee Jones commit 9d602da0c9919f36d55b051951c1fd4f3dc24593 Author: Heiko Stuebner Date: Wed Jul 30 19:34:22 2025 +0200 dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts233-mcu compatible The same MCU is used on other devices of the series with a slightly different set of features, like the number of LEDs. Add a compatible for the MCU used in the TS233 variant. Signed-off-by: Heiko Stuebner Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250730173423.1878599-2-heiko@sntech.de Signed-off-by: Lee Jones commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 Author: Alexander Stein Date: Fri Jul 25 09:11:50 2025 +0200 mfd: stmpe-i2c: Add missing MODULE_LICENSE This driver is licensed GPL-2.0-only, so add the corresponding module flag. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit d00c9120414c3d908c0507fe26dd3b401a02c30a Author: Alexander Stein Date: Fri Jul 25 09:11:49 2025 +0200 mfd: stmpe-spi: Add missing MODULE_LICENSE This driver is licensed GPL-2.0-only, so add the corresponding module flag. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725071153.338912-2-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 557b09699b06f88ad2cb64747e4e8b6fc6e7141b Author: Alexander Stein Date: Fri Jul 25 09:07:50 2025 +0200 mfd: stmpe-i2c: Use module_i2c_driver to remove boilerplate Driver implements feature of module_i2c_driver() manually. Replace it by that macro instead. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-3-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 57b1fec0be8590278d81786eba11eb74252f784a Author: Alexander Stein Date: Fri Jul 25 09:07:49 2025 +0200 mfd: stmpe-spi: Use module_spi_driver to remove boilerplate Driver implements feature of module_spi_driver() manually. Replace it by that macro instead. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-2-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d Author: Alexander Stein Date: Fri Jul 25 09:07:48 2025 +0200 mfd: stmpe: Remove IRQ domain upon removal The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit ba2b3de78fe63cd3bb169f98c7d92fa09c79ca16 Author: Colin Ian King Date: Thu Jul 24 12:14:59 2025 +0100 mfd: Kconfig: Fix spelling mistake "infontainment" -> "infotainment" There is a spelling mistake in the MFD_TIMBERDALE description. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724111459.141633-1-colin.i.king@gmail.com Signed-off-by: Lee Jones commit 0b9483bf7f319468bd37351c112c8f0bfe242028 Author: Nuno Sá Date: Thu Jul 17 15:51:34 2025 +0100 mfd: adp5585: Drop useless return statement In adp5585_reset_ev_parse(), when parsing the adi,reset-pulse-width-us property, we were returning in case it was found and valid. No point in doing that as we'll be returning anyways after the exiting the property scope. And it could actually lead to bugs if new properties happen to added after this one. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-gpio/c85604d9e077511b8aa6ee0786579594cc0103d4.camel@gmail.com/T/#ma25557bd06ccd2531dc9c85ba6be74af781b81aa Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250717-adp5585-drop-ret-v1-1-2ae65bd780aa@analog.com Signed-off-by: Lee Jones commit 81a2c31257411296862487aaade98b7d9e25dc72 Author: Ioana Ciornei Date: Mon Jul 7 18:31:20 2025 +0300 mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA The QIXIS FPGA found on Layerscape boards such as LX2160AQDS, LS1028AQDS etc deals with power-on-reset timing, muxing etc. Use the simple-mfd-i2c as its core driver by adding its compatible string (already found in some dt files). By using the simple-mfd-i2c driver, any child device will have access to the i2c regmap created by it. Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250707153120.1371719-1-ioana.ciornei@nxp.com Signed-off-by: Lee Jones commit e8c81284032ad9ba9ec3a89311c587aad0c84beb Merge: 017bdcdb3af941 9b33bbc084accb d463bb14058360 32d4cedd24ed34 a377b1be3a0ed5 f0addd325ef692 981dd162b63578 Author: Lee Jones Date: Wed Oct 1 10:27:35 2025 +0100 Merge branches 'ib-mfd-char-crypto-6.18', 'ib-mfd-gpio-6.18', 'ib-mfd-gpio-hwmon-i2c-can-rtc-watchdog-6.18', 'ib-mfd-gpio-input-pinctrl-pwm-6.18', 'ib-mfd-input-6.18', 'ib-mfd-input-rtc-6.18' and 'ib-mfd-power-regulator-6.18' into ibs-for-mfd-merged commit f1455695d2d99894b65db233877acac9a0e120b9 Merge: 936f160a95cddd daa26ea63c6f84 Author: Paolo Abeni Date: Wed Oct 1 10:10:50 2025 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc8). Conflicts: tools/testing/selftests/drivers/net/bonding/Makefile 87951b566446 selftests: bonding: add test for passive LACP mode c2377f1763e9 selftests: bonding: add test for LACP actor port priority Adjacent changes: drivers/net/ethernet/cadence/macb.h fca3dc859b20 net: macb: remove illusion about TBQPH/RBQPH being per-queue 89934dbf169e net: macb: Add TAPRIO traffic scheduling support drivers/net/ethernet/cadence/macb_main.c fca3dc859b20 net: macb: remove illusion about TBQPH/RBQPH being per-queue 89934dbf169e net: macb: Add TAPRIO traffic scheduling support Signed-off-by: Paolo Abeni commit 936f160a95cddd361d9c70798464e87a9cc57a37 Merge: 1a98f5699bd57c f603808a98afd3 Author: Paolo Abeni Date: Wed Oct 1 10:01:37 2025 +0200 Merge branch 'net-stmmac-add-support-for-allwinner-a523-gmac200' Chen-Yu Tsai says: ==================== net: stmmac: Add support for Allwinner A523 GMAC200 This is v8 of my Allwinner A523 GMAC200 support series. This is based on next-20250925. This version only contains the DT binding and driver patches. The device tree patches are basically the same as the previous version. This series adds support for the second Ethernet controller found on the Allwinner A523 SoC family. This controller, dubbed GMAC200, is a DWMAC4 core with an integration layer around it. The integration layer is similar to older Allwinner generations, but with an extra memory bus gate and separate power domain. Patch 1 adds a new compatible string combo to the existing Allwinner EMAC binding. Patch 2 adds a new driver for this core and integration combo. ==================== Link: https://patch.msgid.link/20250925191600.3306595-1-wens@kernel.org Signed-off-by: Paolo Abeni commit f603808a98afd37c50a736f1d3c8e186b625b115 Author: Chen-Yu Tsai Date: Fri Sep 26 03:15:59 2025 +0800 net: stmmac: Add support for Allwinner A523 GMAC200 The Allwinner A523 SoC family has a second Ethernet controller, called the GMAC200 in the BSP and T527 datasheet, and referred to as GMAC1 for numbering. This controller, according to BSP sources, is fully compatible with a slightly newer version of the Synopsys DWMAC core. The glue layer around the controller is the same as found around older DWMAC cores on Allwinner SoCs. The only slight difference is that since this is the second controller on the SoC, the register for the clock delay controls is at a different offset. Last, the integration includes a dedicated clock gate for the memory bus and the whole thing is put in a separately controllable power domain. Add a new driver for this hardware supporting the integration layer. Reviewed-by: Jernej Skrabec Signed-off-by: Chen-Yu Tsai Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250925191600.3306595-3-wens@kernel.org Signed-off-by: Paolo Abeni commit d9fcb34f8b3bf793fadb591aafc76f27ecb48ff0 Author: Chen-Yu Tsai Date: Fri Sep 26 03:15:58 2025 +0800 dt-bindings: net: sun8i-emac: Add A523 GMAC200 compatible The Allwinner A523 SoC family has a second Ethernet controller, called the GMAC200 in the BSP and T527 datasheet, and referred to as GMAC1 for numbering. This controller, according to BSP sources, is fully compatible with a slightly newer version of the Synopsys DWMAC core. The glue layer around the controller is the same as found around older DWMAC cores on Allwinner SoCs. The only slight difference is that since this is the second controller on the SoC, the register for the clock delay controls is at a different offset. Last, the integration includes a dedicated clock gate for the memory bus and the whole thing is put in a separately controllable power domain. Add a compatible string entry for it, and work in the requirements for a second clock and a power domain. Reviewed-by: Rob Herring (Arm) Acked-by: Conor Dooley Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250925191600.3306595-2-wens@kernel.org Signed-off-by: Paolo Abeni commit 1a98f5699bd57c9b3f66ec54cc38571d5e42ffb1 Author: Paolo Abeni Date: Tue Sep 30 15:45:06 2025 +0200 Revert "Documentation: net: add flow control guide and document ethtool API" This reverts commit 7bd80ed89d72285515db673803b021469ba71ee8. I should not have merged it to begin with due to pending review and changes to be addressed. Link: https://patch.msgid.link/c6f3af12df9b7998920a02027fc8893ce82afc4c.1759239721.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit 7d85cd8730ab7701a1cafd0db0d7b6b1f6cfbb91 Author: Brian Masney Date: Sat Sep 27 20:34:34 2025 -0400 clk: microchip: core: remove duplicate roclk_determine_rate() Fix compiler error caused by the round_rate() to determine_rate() migration. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280327.jsapR0Ww-lkp@intel.com/ Signed-off-by: Brian Masney Fixes: e9f039c08cdc ("clk: microchip: core: convert from round_rate() to determine_rate()") Signed-off-by: Stephen Boyd commit e28c5bc45640bc851e8f7f0b8d5431fdaa420c8e Author: Namjae Jeon Date: Mon Aug 25 08:27:12 2025 +0900 ksmbd: increase session and share hash table bits Increases the number of bits for the hash table from 3 to 12. The thousands of sessions and shares can be connected. So the current 3-bit size can lead to frequent hash collisions. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0bcc831be535269556f59cb70396f7e34f03a276 Author: Namjae Jeon Date: Wed Oct 1 09:55:56 2025 +0900 ksmbd: replace connection list with hash table Replace connection list with hash table to improve lookup performance. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 67478857817be1585900ec49662e5b8f6ab6e3ef Author: Namjae Jeon Date: Mon Sep 29 09:08:36 2025 +0900 ksmbd: add an error print when maximum IP connections limit is reached This change introduces an error print using pr_info_ratelimited() to prevent excessive logging. This message will inform the user that the limit for maximum IP connections has been hit and what that current count is, which can be useful for debugging and monitoring connection limits. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d8b6dc9256762293048bf122fc11c4e612d0ef5d Author: Namjae Jeon Date: Wed Oct 1 09:25:35 2025 +0900 ksmbd: add max ip connections parameter This parameter set the maximum number of connections per ip address. The default is 8. Cc: stable@vger.kernel.org Fixes: c0d41112f1a5 ("ksmbd: extend the connection limiting mechanism to support IPv6") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 Author: Matvey Kovalev Date: Thu Sep 25 15:12:34 2025 +0300 ksmbd: fix error code overwriting in smb2_get_info_filesystem() If client doesn't negotiate with SMB3.1.1 POSIX Extensions, then proper error code won't be returned due to overwriting. Return error immediately. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Matvey Kovalev Acked-by: Namjae Jeon Signed-off-by: Steve French commit c20988c21751ef67df4191e262675e231610e9ab Author: Namjae Jeon Date: Thu Sep 25 21:15:20 2025 +0900 ksmbd: copy overlapped range within the same file cifs.ko request to copy overlapped range within the same file. ksmbd is using vfs_copy_file_range for this, vfs_copy_file_range() does not allow overlapped copying within the same file. This patch use do_splice_direct() if offset and length are overlapped. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 Author: Namjae Jeon Date: Thu Sep 25 21:12:05 2025 +0900 ksmbd: use sock_create_kern interface to create kernel socket we should use sock_create_kern() if the socket resides in kernel space. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5da92a251e41f824d7e6b4d54d65dcdcfd69fda3 Author: Namjae Jeon Date: Sun Sep 28 09:26:48 2025 +0900 ksmbd: make ksmbd thread names distinct by client IP This patch makes ksmbd thread names distinct by client IP address. 100943 ? S 0:00 [ksmbd:::ffff:10.177.110.57] or 101752 ? S 0:00 [ksmbd:10.177.110.57] Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 305853cce379407090a73b38c5de5ba748893aee Author: Yunseong Kim Date: Mon Sep 15 22:44:09 2025 +0000 ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup. Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open") Fixes: b685757c7b08 ("ksmbd: Implements sess->rpc_handle_list as xarray") Cc: stable@vger.kernel.org Signed-off-by: Yunseong Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa Merge: f4e0ff7e45c30f 2d965c1ae4135e Author: Linus Torvalds Date: Tue Sep 30 19:18:17 2025 -0700 Merge tag 'nolibc-20250928-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: "Only small bugfixes and cleanups" * tag 'nolibc-20250928-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: tools/nolibc: add stdbool.h to nolibc includes tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers selftests/nolibc: remove outdated comment about construct order selftests/nolibc: fix EXPECT_NZ macro tools/nolibc: drop wait4() support kselftest/arm64: tpidr2: Switch to waitpid() over wait4() tools/nolibc: fold llseek fallback into lseek() tools/nolibc: remove __nolibc_enosys() fallback from fork functions tools/nolibc: remove __nolibc_enosys() fallback from dup2() tools/nolibc: remove __nolibc_enosys() fallback from *at() functions tools/nolibc: remove __nolibc_enosys() fallback from time64-related functions tools/nolibc: use tabs instead of spaces for indentation tools/nolibc: avoid error in dup2() if old fd equals new fd selftests/nolibc: always compile the kernel with GCC selftests/nolibc: don't pass CC to toplevel Makefile selftests/nolibc: deduplicate invocations of toplevel Makefile selftests/nolibc: be more specific about variables affecting nolibc-test tools/nolibc: fix error return value of clock_nanosleep() commit f4e0ff7e45c30f4665cfbbe2f0538e9c5789bebc Merge: ae28ed4578e6d5 f3f6b3664302e1 Author: Linus Torvalds Date: Tue Sep 30 19:12:49 2025 -0700 Merge tag 'rust-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Derive 'Zeroable' for all structs and unions generated by 'bindgen' where possible and corresponding cleanups. To do so, add the 'pin-init' crate as a dependency to 'bindings' and 'uapi'. It also includes its first use in the 'cpufreq' module, with more to come in the next cycle. - Add warning to the 'rustdoc' target to detect broken 'srctree/' links and fix existing cases. - Remove support for unused (since v6.16) host '#[test]'s, simplifying the 'rusttest' target. Tests should generally run within KUnit. 'kernel' crate: - Add 'ptr' module with a new 'Alignment' type, which is always a power of two and is used to validate that a given value is a valid alignment and to perform masking and alignment operations: // Checked at build time. assert_eq!(Alignment::new::<16>().as_usize(), 16); // Checked at runtime. assert_eq!(Alignment::new_checked(15), None); assert_eq!(Alignment::of::().log2(), 0); assert_eq!(0x25u8.align_down(Alignment::new::<0x10>()), 0x20); assert_eq!(0x5u8.align_up(Alignment::new::<0x10>()), Some(0x10)); assert_eq!(u8::MAX.align_up(Alignment::new::<0x10>()), None); It also includes its first use in Nova. - Add 'core::mem::{align,size}_of{,_val}' to the prelude, matching Rust 1.80.0. - Keep going with the steps on our migration to the standard library 'core::ffi::CStr' type (use 'kernel::{fmt, prelude::fmt!}' and use upstream method names). - 'error' module: improve 'Error::from_errno' and 'to_result' documentation, including examples/tests. - 'sync' module: extend 'aref' submodule documentation now that it exists, and more updates to complete the ongoing move of 'ARef' and 'AlwaysRefCounted' to 'sync::aref'. - 'list' module: add an example/test for 'ListLinksSelfPtr' usage. - 'alloc' module: - Implement 'Box::pin_slice()', which constructs a pinned slice of elements. - Provide information about the minimum alignment guarantees of 'Kmalloc', 'Vmalloc' and 'KVmalloc'. - Take minimum alignment guarantees of allocators for 'ForeignOwnable' into account. - Remove the 'allocator_test' (including 'Cmalloc'). - Add doctest for 'Vec::as_slice()'. - Constify various methods. - 'time' module: - Add methods on 'HrTimer' that can only be called with exclusive access to an unarmed timer, or from timer callback context. - Add arithmetic operations to 'Instant' and 'Delta'. - Add a few convenience and access methods to 'HrTimer' and 'Instant'. 'macros' crate: - Reduce collections in 'quote!' macro. And a few other cleanups and improvements" * tag 'rust-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (58 commits) gpu: nova-core: use Alignment for alignment-related operations rust: add `Alignment` type rust: macros: reduce collections in `quote!` macro rust: acpi: use `core::ffi::CStr` method names rust: of: use `core::ffi::CStr` method names rust: net: use `core::ffi::CStr` method names rust: miscdevice: use `core::ffi::CStr` method names rust: kunit: use `core::ffi::CStr` method names rust: firmware: use `core::ffi::CStr` method names rust: drm: use `core::ffi::CStr` method names rust: cpufreq: use `core::ffi::CStr` method names rust: configfs: use `core::ffi::CStr` method names rust: auxiliary: use `core::ffi::CStr` method names drm/panic: use `core::ffi::CStr` method names rust: device: use `kernel::{fmt,prelude::fmt!}` rust: sync: use `kernel::{fmt,prelude::fmt!}` rust: seq_file: use `kernel::{fmt,prelude::fmt!}` rust: kunit: use `kernel::{fmt,prelude::fmt!}` rust: file: use `kernel::{fmt,prelude::fmt!}` rust: device: use `kernel::{fmt,prelude::fmt!}` ... commit ae28ed4578e6d5a481e39c5a9827f27048661fdd Merge: 4b81e2eb9e4db8 4ef77dd584cfd9 Author: Linus Torvalds Date: Tue Sep 30 17:58:11 2025 -0700 Merge tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Support pulling non-linear xdp data with bpf_xdp_pull_data() kfunc (Amery Hung) Applied as a stable branch in bpf-next and net-next trees. - Support reading skb metadata via bpf_dynptr (Jakub Sitnicki) Also a stable branch in bpf-next and net-next trees. - Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann) - Replace path-sensitive with path-insensitive live stack analysis in the verifier (Eduard Zingerman) This is a significant change in the verification logic. More details, motivation, long term plans are in the cover letter/merge commit. - Support signed BPF programs (KP Singh) This is another major feature that took years to materialize. Algorithm details are in the cover letter/marge commit - Add support for may_goto instruction to s390 JIT (Ilya Leoshkevich) - Add support for may_goto instruction to arm64 JIT (Puranjay Mohan) - Fix USDT SIB argument handling in libbpf (Jiawei Zhao) - Allow uprobe-bpf program to change context registers (Jiri Olsa) - Support signed loads from BPF arena (Kumar Kartikeya Dwivedi and Puranjay Mohan) - Allow access to union arguments in tracing programs (Leon Hwang) - Optimize rcu_read_lock() + migrate_disable() combination where it's used in BPF subsystem (Menglong Dong) - Introduce bpf_task_work_schedule*() kfuncs to schedule deferred execution of BPF callback in the context of a specific task using the kernel’s task_work infrastructure (Mykyta Yatsenko) - Enforce RCU protection for KF_RCU_PROTECTED kfuncs (Kumar Kartikeya Dwivedi) - Add stress test for rqspinlock in NMI (Kumar Kartikeya Dwivedi) - Improve the precision of tnum multiplier verifier operation (Nandakumar Edamana) - Use tnums to improve is_branch_taken() logic (Paul Chaignon) - Add support for atomic operations in arena in riscv JIT (Pu Lehui) - Report arena faults to BPF error stream (Puranjay Mohan) - Search for tracefs at /sys/kernel/tracing first in bpftool (Quentin Monnet) - Add bpf_strcasecmp() kfunc (Rong Tao) - Support lookup_and_delete_elem command in BPF_MAP_STACK_TRACE (Tao Chen) * tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (197 commits) libbpf: Replace AF_ALG with open coded SHA-256 selftests/bpf: Add stress test for rqspinlock in NMI selftests/bpf: Add test case for different expected_attach_type bpf: Enforce expected_attach_type for tailcall compatibility bpftool: Remove duplicate string.h header bpf: Remove duplicate crypto/sha2.h header libbpf: Fix error when st-prefix_ops and ops from differ btf selftests/bpf: Test changing packet data from kfunc selftests/bpf: Add stacktrace map lookup_and_delete_elem test case selftests/bpf: Refactor stacktrace_map case with skeleton bpf: Add lookup_and_delete_elem for BPF_MAP_STACK_TRACE selftests/bpf: Fix flaky bpf_cookie selftest selftests/bpf: Test changing packet data from global functions with a kfunc bpf: Emit struct bpf_xdp_sock type in vmlinux BTF selftests/bpf: Task_work selftest cleanup fixes MAINTAINERS: Delete inactive maintainers from AF_XDP bpf: Mark kfuncs as __noclone selftests/bpf: Add kprobe multi write ctx attach test selftests/bpf: Add kprobe write ctx attach test selftests/bpf: Add uprobe context ip register change test ... commit daa26ea63c6f848159821cd9b3cbe47cddbb0a1c Merge: 2aff4420efc291 92e9f4faffca70 Author: Jakub Kicinski Date: Tue Sep 30 17:27:01 2025 -0700 Merge branch 'octeontx2-fix-bitmap-leaks-in-pf-and-vf' Bo Sun says: ==================== octeontx2: fix bitmap leaks in PF and VF Two small patches that free the AF_XDP bitmap in the PF and VF remove paths. Both carry the same Fixes tag and should go to stable. ==================== Link: https://patch.msgid.link/20250930061236.31359-1-bo@mboxify.com Signed-off-by: Jakub Kicinski commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 Author: Bo Sun Date: Tue Sep 30 14:12:36 2025 +0800 octeontx2-pf: fix bitmap leak The bitmap allocated with bitmap_zalloc() in otx2_probe() was not released in otx2_remove(). Unbinding and rebinding the driver therefore triggers a kmemleak warning: unreferenced object (size 8): backtrace: bitmap_zalloc otx2_probe Call bitmap_free() in the remove path to fix the leak. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Bo Sun Signed-off-by: Jakub Kicinski commit cd9ea7da41a449ff1950230a35990155457b9879 Author: Bo Sun Date: Tue Sep 30 14:12:35 2025 +0800 octeontx2-vf: fix bitmap leak The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not released in otx2vf_remove(). Unbinding and rebinding the driver therefore triggers a kmemleak warning: unreferenced object (size 8): backtrace: bitmap_zalloc otx2vf_probe Call bitmap_free() in the remove path to fix the leak. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Bo Sun Signed-off-by: Jakub Kicinski commit 3cfb33f92dfb118ccaec5613c677f444af12bcc7 Merge: fd8c8216648cd8 a833538d1d8db9 Author: Jakub Kicinski Date: Tue Sep 30 17:21:17 2025 -0700 Merge branch 'net-mlx5-misc-changes-2025-09-28' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-09-28 This series contains misc enhancements to the mlx5 driver. v1: https://lore.kernel.org/1758531671-819655-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/1759094723-843774-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a833538d1d8db96b78bac04eec9be51b297f1d23 Author: Gal Pressman Date: Mon Sep 29 00:25:23 2025 +0300 net/mlx5e: Use extack in set rxfh callback The ->set/create/modify_rxfh() callbacks now pass a valid extack instead of NULL through netlink [1]. In case of an error, reflect it through extack instead of a dmesg print. [1] commit c0ae03588bbb ("ethtool: rss: initial RSS_SET (indirection table handling)") Signed-off-by: Gal Pressman Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-8-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c40a94ccfdc76fa26c620d1748ebda35c2153dd9 Author: Carolina Jubran Date: Mon Sep 29 00:25:22 2025 +0300 net/mlx5e: Introduce mlx5e_rss_params for RSS configuration Group RSS-related parameters into a dedicated mlx5e_rss_params struct. Pass this struct instead of individual arguments when initializing RSS. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-7-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit fc92cddd7a833d51ef857eca672214cab755ceaa Author: Carolina Jubran Date: Mon Sep 29 00:25:21 2025 +0300 net/mlx5e: Introduce mlx5e_rss_init_params Introduce a dedicated structure to group RSS initialization parameters that are only used during RSS creation, and drop the "init" prefix from pkt_merge_param. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a3f69641cbbc36015eb50ad6170caeb26f9022de Author: Carolina Jubran Date: Mon Sep 29 00:25:20 2025 +0300 net/mlx5e: Remove unused mdev param from RSS indir init The mdev parameter is not used in mlx5e_rss_params_indir_init, so drop it from the function and update all callers accordingly. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 33dbaa54ef431b416c1ddb2c25b9b201634edcfa Author: Carolina Jubran Date: Mon Sep 29 00:25:19 2025 +0300 net/mlx5: Improve QoS error messages with actual depth values Enhance error messages in MLX5 QoS scheduling depth validation by including the actual values that caused the validation to fail. Suggested-by: Paolo Abeni Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 06fdc45f16c392dc3394c67e7c17ae63935715d3 Author: Jianbo Liu Date: Mon Sep 29 00:25:18 2025 +0300 net/mlx5e: Prevent entering switchdev mode with inconsistent netns When a PF enters switchdev mode, its netdevice becomes the uplink representor but remains in its current network namespace. All other representors (VFs, SFs) are created in the netns of the devlink instance. If the PF's netns has been moved and differs from the devlink's netns, enabling switchdev mode would create a state where the OVS control plane (ovs-vsctl) cannot manage the switch because the PF uplink representor and the other representors are split across different namespaces. To prevent this inconsistent configuration, block the request to enter switchdev mode if the PF netdevice's netns does not match the netns of its devlink instance. As part of this change, the PF's netns is first marked as immutable. This prevents race conditions where the netns could be changed after the check is performed but before the mode transition is complete, and it aligns the PF's behavior with that of the final uplink representor. Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Jiri Pirko Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 906154caa7d3d750d47cd18f9349b75b77e12854 Author: Vlad Dogaru Date: Mon Sep 29 00:25:17 2025 +0300 net/mlx5: HWS, Generalize complex matchers The existing solution of complex matchers splits the match parameters across two, and exactly two, matchers. For some rather extreme cases (e.g. IPv6-in-IPv6 tunnels), even two matchers are not enough. Generalize complex matchers to up to 4 submatchers, and allow easy extension to more if needed. This resulted in rewriting a large part of the high-level complex matchers logic, but the original concepts were rock solid and still hold. Key characteristics of the new implementation: * Rework complex matchers to include multiple submatchers. All submatchers but the first are isolated, in keeping with the existing paradigm of handing off to specialized matchers that are not otherwise reachable by regular rules. * Similarly, rework complex rules to allow splitting them into more than two simple rules. Rules continue to be refcounted to allow for multiple complex rules matching on identical parts of the match params. * Rely on the match tag, as opposed to the entire match_param, to hash subrules. This results in lower memory usage. * Prefer to split the original user-supplied match parameters rather than the internal field descriptors. This avoids the awkward transition back and forth between the two formats. * Allow splitting multi-dword fields across matchers. The only restrictions that the new implementation impose are: a) any fragment of an IP address must be accompanied by a match on the IP version; and b) a single lower dword of an IPv6 address cannot be present in a submatcher as it would be interpreted as an IPv4 address. * Employ a greedy algorithm to split the match params, as opposed to complete search. The results are not optimal, but the algorithm is now linear compared to exponential. Consequently, we see complex matcher creation time drops two orders of magnitude in our tests. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e3ec97c3abaf2fb68cc755cae3229288696b9f3d Author: Mukesh Rathor Date: Mon Sep 15 16:46:04 2025 -0700 Drivers: hv: Make CONFIG_HYPERV bool With CONFIG_HYPERV and CONFIG_HYPERV_VMBUS separated, change CONFIG_HYPERV to bool from tristate. CONFIG_HYPERV now becomes the core Hyper-V hypervisor support, such as hypercalls, clocks/timers, Confidential Computing setup, PCI passthru, etc. that doesn't involve VMBus or VMBus devices. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 94b04355e6397a0a70b69c2571fa5c7d9990b835 Author: Mukesh Rathor Date: Mon Sep 15 16:46:03 2025 -0700 Drivers: hv: Add CONFIG_HYPERV_VMBUS option At present VMBus driver is hinged off of CONFIG_HYPERV which entails lot of builtin code and encompasses too much. It's not always clear what depends on builtin hv code and what depends on VMBus. Setting CONFIG_HYPERV as a module and fudging the Makefile to switch to builtin adds even more confusion. VMBus is an independent module and should have its own config option. Also, there are scenarios like baremetal dom0/root where support is built in with CONFIG_HYPERV but without VMBus. Lastly, there are more features coming down that use CONFIG_HYPERV and add more dependencies on it. So, create a fine grained HYPERV_VMBUS option and update Kconfigs for dependency on VMBus. Signed-off-by: Mukesh Rathor Acked-by: Bjorn Helgaas # drivers/pci Signed-off-by: Wei Liu commit 4b81e2eb9e4db8f6094c077d0c8b27c264901c1b Merge: 70de5572a82b3d e82bf7570d5ca3 Author: Linus Torvalds Date: Tue Sep 30 16:58:21 2025 -0700 Merge tag 'timers-vdso-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull VDSO updates from Thomas Gleixner: - Further consolidation of the VDSO infrastructure and the common data store - Simplification of the related Kconfig logic - Improve the VDSO selftest suite * tag 'timers-vdso-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests: vDSO: Drop vdso_test_clock_getres selftests: vDSO: vdso_test_abi: Add tests for clock_gettime64() selftests: vDSO: vdso_test_abi: Test CPUTIME clocks selftests: vDSO: vdso_test_abi: Use explicit indices for name array selftests: vDSO: vdso_test_abi: Drop clock availability tests selftests: vDSO: vdso_test_abi: Use ksft_finished() selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper vdso: Add struct __kernel_old_timeval forward declaration to gettime.h vdso: Gate VDSO_GETRANDOM behind HAVE_GENERIC_VDSO vdso: Drop Kconfig GENERIC_VDSO_TIME_NS vdso: Drop Kconfig GENERIC_VDSO_DATA_STORE vdso: Drop kconfig GENERIC_COMPAT_VDSO vdso: Drop kconfig GENERIC_VDSO_32 riscv: vdso: Untangle Kconfig logic time: Build generic update_vsyscall() only with generic time vDSO vdso/gettimeofday: Remove !CONFIG_TIME_NS stubs vdso: Move ENABLE_COMPAT_VDSO from core to arm64 ARM: VDSO: Remove cntvct_ok global variable vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY commit 70de5572a82b3d510df31d2c572c15cd53a00870 Merge: c5448d46b3995c 749b61c2d6a91c Author: Linus Torvalds Date: Tue Sep 30 16:53:59 2025 -0700 Merge tag 'timers-clocksource-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clocksource updates from Thomas Gleixner: - Further preparations for modular clocksource/event drivers - The usual device tree updates to support new chip variants and the related changes to thise drivers - Avoid a 64-bit division in the TEGRA186 driver, which caused a build fail on 32-bit machines. - Small fixes, improvements and cleanups all over the place * tag 'timers-clocksource-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits) dt-bindings: timer: exynos4210-mct: Add compatible for ARTPEC-9 SoC clocksource/drivers/sh_cmt: Split start/stop of clock source and events clocksource/drivers/clps711x: Fix resource leaks in error paths clocksource/drivers/arm_global_timer: Add auto-detection for initial prescaler values clocksource/drivers/ingenic-sysost: Convert from round_rate() to determine_rate() clocksource/drivers/timer-tegra186: Don't print superfluous errors clocksource/drivers/timer-rtl-otto: Simplify documentation clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts clocksource/drivers/timer-rtl-otto: Drop set_counter function clocksource/drivers/timer-rtl-otto: Work around dying timers clocksource/drivers/timer-ti-dm : Capture functionality for OMAP DM timer clocksource/drivers/arm_arch_timer_mmio: Add MMIO clocksource clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver clocksource/drivers/arm_arch_timer: Add standalone MMIO driver ACPI: GTDT: Generate platform devices for MMIO timers clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support dt: bindings: fsl,vf610-pit: Add compatible for s32g2 and s32g3 clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT clocksource/drivers/vf-pit: Unify the function name for irq ack clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable ... commit a3a4d6cb0b968e5d842e79f5dd9d7e07670e9b8a Author: Alok Tiwari Date: Sat Sep 13 12:24:44 2025 -0700 Drivers: hv: vmbus: Fix typos in vmbus_drv.c Fix two minor typos in vmbus_drv.c: - Correct "reponsible" -> "responsible" in a comment. - Add missing newline in pr_err() message ("channeln" -> "channel\n"). These are cosmetic changes only and do not affect functionality. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 332bf98d6c5a198d3078110b9000841dac3fd7b2 Author: Alok Tiwari Date: Sat Sep 13 12:24:42 2025 -0700 Drivers: hv: vmbus: Fix sysfs output format for ring buffer index The sysfs attributes out_read_index and out_write_index in vmbus_drv.c currently use %d to print outbound.current_read_index and outbound.current_write_index. These fields are u32 values, so printing them with %d (signed) is not logically correct. Update the format specifier to %u to correctly match their type. No functional change, only fixes the sysfs output format. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit fd9be098f7eb4bb6b1768145fd48e74a292e3730 Author: Alok Tiwari Date: Wed Sep 17 01:59:31 2025 -0700 Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() The target_cpu_store() function parses the target CPU from the sysfs buffer using sscanf(). The format string currently uses "%uu", which is redundant. The compiler ignores the extra "u", so there is no incorrect parsing at runtime. Update the format string to use "%u" for clarity and consistency. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit c5448d46b3995c0b477f6bb04f313af3d57665c4 Merge: c574fb2ed7c96f 391253b25f078d Author: Linus Torvalds Date: Tue Sep 30 16:09:27 2025 -0700 Merge tag 'timers-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - Address the inconsistent shutdown sequence of per CPU clockevents on CPU hotplug, which only removed it from the core but failed to invoke the actual device driver shutdown callback. This kept the timer active, which prevented power savings and caused pointless noise in virtualization. - Encapsulate the open coded access to the hrtimer clock base, which is a private implementation detail, so that the implementation can be changed without breaking a lot of usage sites. - Enhance the debug output of the clocksource watchdog to provide better information for analysis. - The usual set of cleanups and enhancements all over the place * tag 'timers-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Fix spelling mistakes in comments clocksource: Print durations for sync check unconditionally LoongArch: Remove clockevents shutdown call on offlining tick: Do not set device to detached state in tick_shutdown() hrtimer: Reorder branches in hrtimer_clockid_to_base() hrtimer: Remove hrtimer_clock_base:: Get_time hrtimer: Use hrtimer_cb_get_time() helper media: pwm-ir-tx: Avoid direct access to hrtimer clockbase ALSA: hrtimer: Avoid direct access to hrtimer clockbase lib: test_objpool: Avoid direct access to hrtimer clockbase sched/core: Avoid direct access to hrtimer clockbase timers/itimer: Avoid direct access to hrtimer clockbase posix-timers: Avoid direct access to hrtimer clockbase jiffies: Remove obsolete SHIFTED_HZ comment commit c574fb2ed7c96f87fc0e5295e910e646a7ee4dfa Merge: d8de3685f1a287 4386f71623b772 Author: Linus Torvalds Date: Tue Sep 30 16:07:10 2025 -0700 Merge tag 'locking-futex-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex updates from Thomas Gleixner: "A set of updates for futexes and related selftests: - Plug the ptrace_may_access() race against a concurrent exec() which allows to pass the check before the target's process transition in exec() by taking a read lock on signal->ext_update_lock. - A large set of cleanups and enhancement to the futex selftests. The bulk of changes is the conversion to the kselftest harness" * tag 'locking-futex-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) selftest/futex: Fix spelling mistake "boundarie" -> "boundary" selftests/futex: Remove logging.h file selftests/futex: Drop logging.h include from futex_numa selftests/futex: Refactor futex_numa_mpol with kselftest_harness.h selftests/futex: Refactor futex_priv_hash with kselftest_harness.h selftests/futex: Refactor futex_waitv with kselftest_harness.h selftests/futex: Refactor futex_requeue with kselftest_harness.h selftests/futex: Refactor futex_wait with kselftest_harness.h selftests/futex: Refactor futex_wait_private_mapped_file with kselftest_harness.h selftests/futex: Refactor futex_wait_unitialized_heap with kselftest_harness.h selftests/futex: Refactor futex_wait_wouldblock with kselftest_harness.h selftests/futex: Refactor futex_wait_timeout with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi_signal_restart with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi_mismatched_ops with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi with kselftest_harness.h selftests: kselftest: Create ksft_print_dbg_msg() futex: Don't leak robust_list pointer on exec race selftest/futex: Compile also with libnuma < 2.0.16 selftest/futex: Reintroduce "Memory out of range" numa_mpol's subtest selftest/futex: Make the error check more precise for futex_numa_mpol ... commit d8de3685f1a28722a4ba4f1f06a0987822750fb9 Merge: 03a53e09cd7232 ccf09357ffef2a Author: Linus Torvalds Date: Tue Sep 30 16:04:52 2025 -0700 Merge tag 'smp-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull smp doc fixlet from Thomas Gleixner: "An update of the stale smp_call_function_many() documentation to bring it back in sync with the actual implementation" * tag 'smp-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Fix up and expand the smp_call_function_many() kerneldoc commit 03a53e09cd723295ac1ddd16d9908d1680e7a1bf Merge: 3b2074c77d25f4 c33c43f71bda36 Author: Linus Torvalds Date: Tue Sep 30 16:00:29 2025 -0700 Merge tag 'irq-drivers-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq chip driver updates from Thomas Gleixner: - Use the startup/shutdown callbacks for the PCI/MSI per device interrupt domains. This allows us to initialize the RISCV PLIC interrupt hierarchy correctly and provides a mechanism to decouple the masking and unmasking during run-time from the expensive PCI mask and unmask when the underlying MSI provider implementation allows the interrupt to be masked. - Initialize the RISCV PLIC MSI interrupt hierarchy correctly so that the affinity assignment works correctly by switching it over to the startup/shutdown scheme - Allow MSI providers to opt out from masking a PCI/MSI interrupt at the PCI device during operation when the provider can mask the interrupt at the underlying interrupt chip. This reduces the overhead in scenarios where disable_irq()/enable_irq() is utilized frequently by a driver. The PCI/MSI device level [un]masking is only required on startup and shutdown in this case. - Remove the conditional mask/unmask logic in the PCI/MSI layer as this is now handled unconditionally. - Replace the hardcoded interrupt routing in the Loongson EIOINTC interrupt driver to respect the firmware settings and spread them out to different CPU interrupt inputs so that the demultiplexing handler only needs to read only a single 64-bit status register instead of four, which significantly reduces the overhead in VMs as the status register access causes a VM exit. - Add support for the new AST2700 SCU interrupt controllers - Use the legacy interrupt domain setup for the Loongson PCH-LPC interrupt controller, which resembles the x86 legacy PIC setup and has the same hardcoded legacy requirements. - The usual set of cleanups, fixes and improvements all over the place * tag 'irq-drivers-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller PCI/MSI: Remove the conditional parent [un]mask logic irqchip/msi-lib: Honor the MSI_FLAG_PCI_MSI_MASK_PARENT flag irqchip/aspeed-scu-ic: Add support for AST2700 SCU interrupt controllers dt-bindings: interrupt-controller: aspeed: Add AST2700 SCU IC compatibles dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles irqchip/aspeed-scu-ic: Refactor driver to support variant-based initialization irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path irqchip/gic-v5: Delete a stray tab irqchip/sg2042-msi: Set irq type according to DT configuration riscv: sophgo: dts: sg2044: Change msi irq type to IRQ_TYPE_EDGE_RISING riscv: sophgo: dts: sg2042: Change msi irq type to IRQ_TYPE_EDGE_RISING irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment irqchip/renesas-rzg2l: Remove dev_err_probe() if error is -ENOMEM irqchip: Use int type to store negative error codes irqchip/gic-v5: Remove the redundant ITS cache invalidation PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent() irqchip/loongson-eiointc: Add multiple interrupt pin routing support irqchip/loongson-eiointc: Route interrupt parsed from bios table ... commit 3b2074c77d25f453247163300d5638adfab4e4fa Merge: 1d17e808cf2aad 3253cb49cbad47 Author: Linus Torvalds Date: Tue Sep 30 15:55:25 2025 -0700 Merge tag 'irq-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq core updates from Thomas Gleixner: "A set of updates for the interrupt core subsystem: - Introduce irq_chip_[startup|shutdown]_parent() to prepare for addressing a few short comings in the PCI/MSI interrupt subsystem. It allows to utilize the interrupt chip startup/shutdown callbacks for initializing the interrupt chip hierarchy properly on certain RISCV implementations and provides a mechanism to reduce the overhead of masking and unmasking PCI/MSI interrupts during operation when the underlying MSI provider can mask the interrupt. The actual usage comes with the interrupt driver pull request. - Add generic error handling for devm_request_*_irq() This allows to remove the zoo of random error printk's all over the usage sites. - Add a mechanism to warn about long-running interrupt handlers Long running interrupt handlers can introduce latencies and tracking them down is a tedious task. The tracking has to be enabled with a threshold on the kernel command line and utilizes a static branch to remove the overhead when disabled. - Update and extend the selftests which validate the CPU hotplug interrupt migration logic - Allow dropping the per CPU softirq lock on PREEMPT_RT kernels, which causes contention and latencies all over the place. The serialization requirements have been pushed down into the actual affected usage sites already. - The usual small cleanups and improvements" * tag 'irq-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT softirq: Provide a handshake for canceling tasklets via polling genirq/test: Ensure CPU 1 is online for hotplug test genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions genirq/test: Depend on SPARSE_IRQ genirq/test: Fail early if interrupt request fails genirq/test: Factor out fake-virq setup genirq/test: Select IRQ_DOMAIN genirq/test: Fix depth tests on architectures with NOREQUEST by default. genirq: Add support for warning on long-running interrupt handlers genirq/devres: Add error handling in devm_request_*_irq() genirq: Add irq_chip_(startup/shutdown)_parent() genirq: Remove GENERIC_IRQ_LEGACY commit 4691db0704ac1c266377c99f00288a014fdb7af1 Author: Nam Cao Date: Fri Jul 18 21:57:50 2025 +0200 x86/hyperv: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). While doing the conversion, I noticed that hv_irq_compose_msi_msg() is doing more than it is supposed to (composing message content). The interrupt allocation bits should be moved into hv_msi_domain_alloc(). However, I have no hardware to test this change, therefore I leave a TODO note. Signed-off-by: Nam Cao Acked-by: Thomas Gleixner Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit c5eebe075e1129748f74e567da7bd8fbe77e485b Author: Sean Christopherson Date: Wed Aug 27 17:01:55 2025 -0700 mshv: Use common "entry virt" APIs to do work in root before running guest Use the kernel's common "entry virt" APIs to handle pending work prior to (re)entering guest mode, now that the virt APIs don't have a superfluous dependency on KVM. No functional change intended. Signed-off-by: Sean Christopherson Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 9be7e1e320ff2e7db4b23c8ec5f599bbfac94ede Author: Sean Christopherson Date: Wed Aug 27 17:01:54 2025 -0700 entry: Rename "kvm" entry code assets to "virt" to genericize APIs Rename the "kvm" entry code files and Kconfigs to use generic "virt" nomenclature so that the code can be reused by other hypervisors (or rather, their root/dom0 partition drivers), without incorrectly suggesting the code somehow relies on and/or involves KVM. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Thomas Gleixner Reviewed-by: Joel Fernandes Signed-off-by: Wei Liu commit 6d0386ea99875313fdfd074eb74013b6e3b48a76 Author: Sean Christopherson Date: Wed Aug 27 17:01:53 2025 -0700 entry/kvm: KVM: Move KVM details related to signal/-EINTR into KVM proper Move KVM's morphing of pending signals into userspace exits into KVM proper, and drop the @vcpu param from xfer_to_guest_mode_handle_work(). How KVM responds to -EINTR is a detail that really belongs in KVM itself, and invoking kvm_handle_signal_exit() from kernel code creates an inverted module dependency. E.g. attempting to move kvm_handle_signal_exit() into kvm_main.c would generate an linker error when building kvm.ko as a module. Dropping KVM details will also converting the KVM "entry" code into a more generic virtualization framework so that it can be used when running as a Hyper-V root partition. Lastly, eliminating usage of "struct kvm_vcpu" outside of KVM is also nice to have for KVM x86 developers, as keeping the details of kvm_vcpu purely within KVM allows changing the layout of the structure without having to boot into a new kernel, e.g. allows rebuilding and reloading kvm.ko with a modified kvm_vcpu structure as part of debug/development. Signed-off-by: Sean Christopherson Reviewed-by: Thomas Gleixner Signed-off-by: Wei Liu commit 0ebac01a00be972020c002a7fe0bb6b6fca8410f Author: Sean Christopherson Date: Wed Aug 27 17:01:50 2025 -0700 mshv: Handle NEED_RESCHED_LAZY before transferring to guest Check for NEED_RESCHED_LAZY, not just NEED_RESCHED, prior to transferring control to a guest. Failure to check for lazy resched can unnecessarily delay rescheduling until the next tick when using a lazy preemption model. Note, ideally both the checking and processing of TIF bits would be handled in common code, to avoid having to keep three separate paths synchronized, but defer such cleanups to the future to keep the fix as standalone as possible. Cc: Nuno Das Neves Cc: Mukesh R Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Sean Christopherson Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 7ad8c34f2435137e2a0dfd0a5dd000e219c642ce Author: Vitaly Kuznetsov Date: Thu Aug 28 12:16:18 2025 +0300 x86/hyperv: Add kexec/kdump support on Azure CVMs Azure CVM instance types featuring a paravisor hang upon kdump. The investigation shows that makedumpfile causes a hang when it steps on a page which was previously share with the host (HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY). The new kernel has no knowledge of these 'special' regions (which are Vmbus connection pages, GPADL buffers, ...). There are several ways to approach the issue: - Convey the knowledge about these regions to the new kernel somehow. - Unshare these regions before accessing in the new kernel (it is unclear if there's a way to query the status for a given GPA range). - Unshare these regions before jumping to the new kernel (which this patch implements). To make the procedure as robust as possible, store PFN ranges of shared regions in a linked list instead of storing GVAs and re-using hv_vtom_set_host_visibility(). This also allows to avoid memory allocation on the kdump/kexec path. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Michael Kelley Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit fd8c8216648cd8c047bd3bcad65424ed44b5b450 Author: Patrisious Haddad Date: Mon Sep 29 00:08:08 2025 +0300 net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs Write combining is an optimization feature in CPUs that is frequently used by modern devices to generate 32 or 64 byte TLPs at the PCIe level. These large TLPs allow certain optimizations in the driver to HW communication that improve performance. As WC is unpredictable and optional the HW designs all tolerate cases where combining doesn't happen and simply experience a performance degradation. Unfortunately many virtualization environments on all architectures have done things that completely disable WC inside the VM with no generic way to detect this. For example WC was fully blocked in ARM64 KVM until commit 8c47ce3e1d2c ("KVM: arm64: Set io memory s2 pte as normalnc for vfio pci device"). Trying to use WC when it is known not to work has a measurable performance cost (~5%). Long ago mlx5 developed an boot time algorithm to test if WC is available or not by using unique mlx5 HW features to measure how many large TLPs the device is receiving. The SW generates a large number of combining opportunities and if any succeed then WC is declared working. In mlx5 the WC optimization feature is never used by the kernel except for the boot time test. The WC is only used by userspace in rdma-core. Sadly modern ARM CPUs, especially NVIDIA Grace, have a combining implementation that is very unreliable compared to pretty much everything prior. This is being fixed architecturally in new CPUs with a new ST64B instruction, but current shipping devices suffer this problem. Unreliable means the SW can present thousands of combining opportunities and the HW will not combine for any of them, which creates a performance degradation, and critically fails the mlx5 boot test. However, the CPU is very sensitive to the instruction sequence used, with the better options being sufficiently good that the performance loss from the unreliable CPU is not measurable. Broadly there are several options, from worst to best: 1) A C loop doing a u64 memcpy. This was used prior to commit ef302283ddfc ("IB/mlx5: Use __iowrite64_copy() for write combining stores") and failed almost all the time on Grace CPUs. 2) ARM64 assembly with consecutive 8 byte stores. This was implemented as an arch-generic __iowriteXX_copy() family of functions suitable for performance use in drivers for WC. commit ead79118dae6 ("arm64/io: Provide a WC friendly __iowriteXX_copy()") provided the ARM implementation. 3) ARM64 assembly with consecutive 16 byte stores. This was rejected from kernel use over fears of virtualization failures. Common ARM VMMs will crash if STP is used against emulated memory. 4) A single NEON store instruction. Userspace has used this option for a very long time, it performs well. 5) For future silicon the new ST64B instruction is guaranteed to generate a 64 byte TLP 100% of the time The past upgrade from #1 to #2 was thought to be sufficient to solve this problem. However, more testing on more systems shows that #3 is still problematic at a low frequency and the kernel test fails. Thus, make the mlx5 use the same instructions as userspace during the boot time WC self test. This way the WC test matches the userspace and will properly detect the ability of HW to support the WC workload that userspace will generate. While #4 still has imperfect combining performance, it is substantially better than #2, and does actually give a performance win to applications. Self-test failures with #2 are like 3/10 boots, on some systems, #4 has never seen a boot failure. There is no real general use case for a NEON based WC flow in the kernel. This is not suitable for any performance path work as getting into/out of a NEON context is fairly expensive compared to the gain of WC. Future CPUs are going to fix this issue by using an new ARM instruction and __iowriteXX_copy() will be updated to use that automatically, probably using the ALTERNATES mechanism. Since this problem is constrained to mlx5's unique situation of needing a non-performance code path to duplicate what mlx5 userspace is doing as a matter of self-testing, implement it as a one line inline assembly in the driver directly. Lastly, this was concluded from the discussion with ARM maintainers which confirms that this is the best approach for the solution: https://lore.kernel.org/r/aHqN_hpJl84T1Usi@arm.com Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759093688-841357-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1d17e808cf2aad182f0eb2ea83e329e4a6795428 Merge: 7601d18be06943 a001cd248ab244 Author: Linus Torvalds Date: Tue Sep 30 15:06:33 2025 -0700 Merge tag 'core-rseq-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq updates from Thomas Gleixner: "Two fixes for RSEQ: - Protect the event mask modification against the membarrier() IPI as otherwise the RmW operation is unprotected and events might be lost - Fix the weak symbol reference in rseq selftests The current weak RSEQ symbols definitions which were added to allow static linkage are not working correctly as they effectively re-define the glibc symbols leading to multiple versions of the symbols when compiled with -fno-common. Mark them as 'extern' to convert them from weak symbol definitions to weak symbol references. That works with static and dynamic linkage independent of -fcommon and -fno-common" * tag 'core-rseq-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq/selftests: Use weak symbol reference, not definition, to link with glibc rseq: Protect event mask against membarrier IPI commit 7601d18be06943d5ac2b1802899ff6c303544936 Merge: 22bdd6e68bbe27 3ec09344b01a15 Author: Linus Torvalds Date: Tue Sep 30 14:36:20 2025 -0700 Merge tag 'core-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull TIF bit unification updates from Thomas Gleixner: "A set of changes to consolidate the generic TIF (thread info flag) bits accross architectures. All architectures define the same set of generic TIF bits. This makes it pointlessly hard to add a new generic TIF bit or to change an existing one. Provide a generic variant and convert the architectures which utilize the generic entry code over to use it. The TIF space is divided into 16 generic bits and 16 architecture specific bits, which turned out to provide enough space on both sides" * tag 'core-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: LoongArch: Fix bitflag conflict for TIF_FIXADE riscv: Use generic TIF bits loongarch: Use generic TIF bits s390/entry: Remove unused TIF flags s390: Use generic TIF bits x86: Use generic TIF bits asm-generic: Provide generic TIF infrastructure commit 2378a191f440a06e4c60fb8a50f4cb708c10ba40 Author: Michal Koutný Date: Wed Sep 24 13:38:09 2025 +0200 tracing: Ensure optimized hashing works If ever PID_MAX_DEFAULT changes, it must be compatible with tracing hashmaps assumptions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250924113810.2433478-1-mkoutny@suse.com Link: https://lore.kernel.org/r/20240409110126.651e94cb@gandalf.local.home/ Signed-off-by: Michal Koutný Signed-off-by: Steven Rostedt (Google) commit 4099b98203d6b33d990586542fa5beee408032a3 Author: Vladimir Riabchun Date: Fri Sep 12 13:28:55 2025 +0200 ftrace: Fix softlockup in ftrace_module_enable A soft lockup was observed when loading amdgpu module. If a module has a lot of tracable functions, multiple calls to kallsyms_lookup can spend too much time in RCU critical section and with disabled preemption, causing kernel panic. This is the same issue that was fixed in commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to ftrace_graph_set_hash()"). Fix it the same way by adding cond_resched() in ftrace_module_enable. Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc Signed-off-by: Vladimir Riabchun Signed-off-by: Steven Rostedt (Google) commit da1bb9135213744e7ec398826c8f2e843de4fb94 Author: Janne Grunau Date: Mon Sep 15 08:36:41 2025 +0200 fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by framebuffer_alloc(). This allocation is explicitly freed by unregister_framebuffer() in simplefb_remove(). Devres managed cleanup runs after the device remove call and thus can no longer access struct simplefb_par. Call simplefb_detach_genpds() explicitly from simplefb_destroy() like the cleanup functions for clocks and regulators. Fixes an use after free on M2 Mac mini during aperture_remove_conflicting_devices() using the downstream asahi kernel with Debian's kernel config. For unknown reasons this started to consistently dereference an invalid pointer in v6.16.3 based kernels. [ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220 [ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227 [ 6.750697] [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY [ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC [ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT) [ 6.752189] Call trace: [ 6.752190] show_stack+0x34/0x98 (C) [ 6.752194] dump_stack_lvl+0x60/0x80 [ 6.752197] print_report+0x17c/0x4d8 [ 6.752201] kasan_report+0xb4/0x100 [ 6.752206] __asan_report_load4_noabort+0x20/0x30 [ 6.752209] simplefb_detach_genpds+0x58/0x220 [ 6.752213] devm_action_release+0x50/0x98 [ 6.752216] release_nodes+0xd0/0x2c8 [ 6.752219] devres_release_all+0xfc/0x178 [ 6.752221] device_unbind_cleanup+0x28/0x168 [ 6.752224] device_release_driver_internal+0x34c/0x470 [ 6.752228] device_release_driver+0x20/0x38 [ 6.752231] bus_remove_device+0x1b0/0x380 [ 6.752234] device_del+0x314/0x820 [ 6.752238] platform_device_del+0x3c/0x1e8 [ 6.752242] platform_device_unregister+0x20/0x50 [ 6.752246] aperture_detach_platform_device+0x1c/0x30 [ 6.752250] aperture_detach_devices+0x16c/0x290 [ 6.752253] aperture_remove_conflicting_devices+0x34/0x50 ... [ 6.752343] [ 6.967409] Allocated by task 62: [ 6.970724] kasan_save_stack+0x3c/0x70 [ 6.974560] kasan_save_track+0x20/0x40 [ 6.978397] kasan_save_alloc_info+0x40/0x58 [ 6.982670] __kasan_kmalloc+0xd4/0xd8 [ 6.986420] __kmalloc_noprof+0x194/0x540 [ 6.990432] framebuffer_alloc+0xc8/0x130 [ 6.994444] simplefb_probe+0x258/0x2378 ... [ 7.054356] [ 7.055838] Freed by task 227: [ 7.058891] kasan_save_stack+0x3c/0x70 [ 7.062727] kasan_save_track+0x20/0x40 [ 7.066565] kasan_save_free_info+0x4c/0x80 [ 7.070751] __kasan_slab_free+0x6c/0xa0 [ 7.074675] kfree+0x10c/0x380 [ 7.077727] framebuffer_release+0x5c/0x90 [ 7.081826] simplefb_destroy+0x1b4/0x2c0 [ 7.085837] put_fb_info+0x98/0x100 [ 7.089326] unregister_framebuffer+0x178/0x320 [ 7.093861] simplefb_remove+0x3c/0x60 [ 7.097611] platform_remove+0x60/0x98 [ 7.101361] device_remove+0xb8/0x160 [ 7.105024] device_release_driver_internal+0x2fc/0x470 [ 7.110256] device_release_driver+0x20/0x38 [ 7.114529] bus_remove_device+0x1b0/0x380 [ 7.118628] device_del+0x314/0x820 [ 7.122116] platform_device_del+0x3c/0x1e8 [ 7.126302] platform_device_unregister+0x20/0x50 [ 7.131012] aperture_detach_platform_device+0x1c/0x30 [ 7.136157] aperture_detach_devices+0x16c/0x290 [ 7.140779] aperture_remove_conflicting_devices+0x34/0x50 ... Reported-by: Daniel Huhardeaux Cc: stable@vger.kernel.org Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains") Signed-off-by: Janne Grunau Reviewed-by: Hans de Goede Signed-off-by: Helge Deller commit 2e3da8cfe3b281d503ef0e968af131323562ae7c Author: Zsolt Kajtar Date: Wed Sep 3 21:14:15 2025 +0200 fbdev: s3fb: Revert mclk stop in suspend There are systems which want to wait for as long as it takes for the stopped video memory to answer. Mapping it out helps to avoid that while the system is running but standby still hangs somehow. So just leave the memory on in standby same as it was before my change. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 4d23d9f7fa7c9ed10b5b32a4e4871ddce02b2337 Author: Qianfeng Rong Date: Sat Aug 30 20:47:00 2025 +0800 fbdev: mb862xxfb: Use int type to store negative error codes Change the 'ret' variable in of_platform_mb862xx_probe() from unsigned long to int, as it needs to store either negative error codes or zero. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Helge Deller commit c7d655ef2e0ca25ae2c46df47eb62ada9e820c78 Author: Chelsy Ratnawat Date: Sun Aug 24 08:23:27 2025 -0700 fbdev: Use string choices helpers Use string_choices.h helpers instead of hard-coded strings. Signed-off-by: Chelsy Ratnawat Signed-off-by: Helge Deller commit aad1d99beaaf132e2024a52727c24894cdf9474a Author: Zsolt Kajtar Date: Thu Aug 21 04:42:48 2025 +0200 fbdev: core: Fix ubsan warning in pixel_to_pat It could be triggered on 32 bit big endian machines at 32 bpp in the pattern realignment. In this case just return early as the result is an identity. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 69c9820d40892f7c10db03c5364795f5bb12aced Author: Zsolt Kajtar Date: Mon Aug 18 22:44:26 2025 +0200 fbdev: s3fb: Implement 1 and 2 BPP modes, improve 4 BPP With the right setup S3 cards can display 1 and 2 BPP packed pixel modes, even in high resolutions. So this patch makes them available. The 4 BPP packed pixel mode had one pixel column of garbage on the left side due to how the shift register works, this is fixed now. There was a limitation that only 8 pixel wide fonts could be used at 4 BPP. Since the CFB routines were updated to handle reverse pixel ordering correctly that limitation doesn't exists and was removed now. In 4 BPP interleaved planes mode font widths of multiply of 8 are accepted now, not just 8 pixels. The horizontal screen position will not move as much between modes as it used to. That was caused by the various amount of pipeline delay which is compensated now as much as possible. While adjusting the code direct port access of PEL registers was corrected. Should work now on systems where these are memory mapped. I've noticed that when in 1 BPP mode the console is used with Unicode fonts erasing might be done with non-blanks. That's a bug in the VT code and so not part of this patch. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 43b30be2e7211d982b005d118dd6a12f97b9d458 Author: Zsolt Kajtar Date: Sun Aug 10 17:47:54 2025 +0200 fbdev: s3fb: Implement powersave for S3 FB This patch implements power saving for S3 cards by powering down the RAMDAC and stopping MCLK and DCLK while the card is supposed to be suspended. The RAMDAC is also disabled while the screen is blanked and the DCLK in stopped while in DPMS power off. The practical difference it makes is that on a machine with such a card the display will be placed in DPMS power off while standby is activated (due to stopped DCLK). Same like when using other cards with implemented power saving functionality. Without it on my setup the connected display powers up and stays that way showing VT63 while in standby. Sort of annoying as before standby it's specifically placed into DPMS off in Xorg for a while. The used functionality should exists for sure on Trio32 to Aurora64V (according to the documentation) so I think it's generally applicable. I'm using this on S3 Trio 3D and S3 Virge DX. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit d391bb1955747edc9f92e67d35c79ada996a93eb Author: Qianfeng Rong Date: Mon Aug 4 15:24:11 2025 +0800 fbdev: xenfb: Use vmalloc_array to simplify code Use vmalloc_array() instead of vmalloc() to simplify the function xenfb_probe(). Signed-off-by: Qianfeng Rong Signed-off-by: Helge Deller commit 22bdd6e68bbe270a916233ec5f34a13ae5e80ed9 Merge: 2cb8eeaf00efc0 1f6113ae5ac492 Author: Linus Torvalds Date: Tue Sep 30 13:40:35 2025 -0700 Merge tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV and apic updates from Borislav Petkov: - Add functionality to provide runtime firmware updates for the non-x86 parts of an AMD platform like the security processor (ASP) firmware, modules etc, for example. The intent being that these updates are interim, live fixups before a proper BIOS update can be attempted - Add guest support for AMD's Secure AVIC feature which gives encrypted guests the needed protection against a malicious hypervisor generating unexpected interrupts and injecting them into such guest, thus interfering with its operation in an unexpected and negative manner. The advantage of this scheme is that the guest determines which interrupts and when to accept them vs leaving that to the benevolence (or not) of the hypervisor - Strictly separate the startup code from the rest of the kernel where former is executed from the initial 1:1 mapping of memory. The problem was that the toolchain-generated version of the code was being executed from a different mapping of memory than what was "assumed" during code generation, needing an ever-growing pile of fixups for absolute memory references which are invalid in the early, 1:1 memory mapping during boot. The major advantage of this is that there's no need to check the 1:1 mapping portion of the code for absolute relocations anymore and get rid of the RIP_REL_REF() macro sprinkling all over the place. For more info, see Ard's very detailed writeup on this [1] - The usual cleanups and fixes Link: https://lore.kernel.org/r/CAMj1kXEzKEuePEiHB%2BHxvfQbFz0sTiHdn4B%2B%2BzVBJ2mhkPkQ4Q@mail.gmail.com [1] * tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (49 commits) x86/boot: Drop erroneous __init annotation from early_set_pages_state() crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver crypto: ccp - Add new HV-Fixed page allocation/free API x86/sev: Add new dump_rmp parameter to snp_leak_pages() API x86/startup/sev: Document the CPUID flow in the boot #VC handler objtool: Ignore __pi___cfi_ prefixed symbols x86/sev: Zap snp_abort() x86/apic/savic: Do not use snp_abort() x86/boot: Get rid of the .head.text section x86/boot: Move startup code out of __head section efistub/x86: Remap inittext read-execute when needed x86/boot: Create a confined code area for startup code x86/kbuild: Incorporate boot/startup/ via Kbuild makefile x86/boot: Revert "Reject absolute references in .head.text" x86/boot: Check startup code for absence of absolute relocations objtool: Add action to check for absence of absolute relocations x86/sev: Export startup routines for later use x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object x86/sev: Provide PIC aliases for SEV related data objects x86/boot: Provide PIC aliases for 5-level paging related constants ... commit 2cb8eeaf00efc037988910de17ffe592b23941a6 Merge: a65879b4584f98 dd86b69d20fb9f Author: Linus Torvalds Date: Tue Sep 30 13:29:42 2025 -0700 Merge tag 'x86_cache_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: "Add support on AMD for assigning QoS bandwidth counters to resources (RMIDs) with the ability for those resources to be tracked by the counters as long as they're assigned to them. Previously, due to hw limitations, bandwidth counts from untracked resources would get lost when those resources are not tracked. Refactor the code and user interfaces to be able to also support other, similar features on ARM, for example" * tag 'x86_cache_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (35 commits) fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled MAINTAINERS: resctrl: Add myself as reviewer x86/resctrl: Configure mbm_event mode if supported fs/resctrl: Introduce the interface to switch between monitor modes fs/resctrl: Disable BMEC event configuration when mbm_event mode is enabled fs/resctrl: Introduce the interface to modify assignments in a group fs/resctrl: Introduce mbm_L3_assignments to list assignments in a group fs/resctrl: Auto assign counters on mkdir and clean up on group removal fs/resctrl: Introduce mbm_assign_on_mkdir to enable assignments on mkdir fs/resctrl: Provide interface to update the event configurations fs/resctrl: Add event configuration directory under info/L3_MON/ fs/resctrl: Support counter read/reset with mbm_event assignment mode x86/resctrl: Implement resctrl_arch_reset_cntr() and resctrl_arch_cntr_read() x86/resctrl: Refactor resctrl_arch_rmid_read() fs/resctrl: Introduce counter ID read, reset calls in mbm_event mode fs/resctrl: Pass struct rdtgroup instead of individual members fs/resctrl: Add the functionality to unassign MBM events fs/resctrl: Add the functionality to assign MBM events x86,fs/resctrl: Implement resctrl_arch_config_cntr() to assign a counter with ABMC fs/resctrl: Introduce event configuration field in struct mon_evt ... commit d655a684c24dde9e9f3f98f3dbae5a4f592117d4 Author: Dan Carpenter Date: Tue Sep 30 15:25:33 2025 +0300 Input: aw86927 - fix error code in probe() Fix this copy and paste bug. Return "err" instead of PTR_ERR(haptics->regmap). Fixes: 52e06d564ce6 ("Input: aw86927 - add driver for Awinic AW86927") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aNvMPTnOovdBitdP@stanley.mountain Signed-off-by: Dmitry Torokhov commit a65879b4584f98e6c1b80380f55ca8cfca82cb47 Merge: d7ec0cf1cd79a7 27b1fd62012dfe Author: Linus Torvalds Date: Tue Sep 30 13:19:08 2025 -0700 Merge tag 'x86_cpu_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Make UMIP instruction detection more robust - Correct and cleanup AMD CPU topology detection; document the relevant CPUID leaves topology parsing precedence on AMD - Add support for running the kernel as guest on FreeBSD's Bhyve hypervisor - Cleanups and improvements * tag 'x86_cpu_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) x86/umip: Check that the instruction opcode is at least two bytes Documentation/x86/topology: Detail CPUID leaves used for topology enumeration x86/cpu/topology: Define AMD64_CPUID_EXT_FEAT MSR x86/cpu/topology: Check for X86_FEATURE_XTOPOLOGY instead of passing has_xtopology x86/cpu/cacheinfo: Simplify cacheinfo_amd_init_llc_id() using _cpuid4_info x86/cpu: Rename and move CPU model entry for Diamond Rapids x86/cpu: Detect FreeBSD Bhyve hypervisor commit 1f0d4ab0f5326ab6f940482b1941d2209d61285a Author: Mike Snitzer Date: Fri Sep 19 10:36:31 2025 -0400 NFS: add basic STATX_DIOALIGN and STATX_DIO_READ_ALIGN support NFS doesn't have DIO alignment constraints, so have NFS respond with accommodating DIO alignment attributes (rather than plumb in GETATTR support for STATX_DIOALIGN and STATX_DIO_READ_ALIGN). The most coarse-grained dio_offset_align is the most accommodating (e.g. PAGE_SIZE, in future larger may be supported). Now that NFS has support, NFS reexport will now handle unaligned DIO (NFSD's NFSD_IO_DIRECT support requires the underlying filesystem support STATX_DIOALIGN and/or STATX_DIO_READ_ALIGN). Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit cda94457c224915845b1d209ff71cad3c61ce194 Author: Mike Snitzer Date: Fri Sep 19 10:36:30 2025 -0400 nfs/localio: add tracepoints for misaligned DIO READ and WRITE support Add nfs_local_dio_class and use it to create nfs_local_dio_read, nfs_local_dio_write and nfs_local_dio_misaligned trace events. These trace events show how NFS LOCALIO splits a given misaligned IO into a mix of misaligned head and/or tail extents and a DIO-aligned middle extent. The misaligned head and/or tail extents are issued using buffered IO and the DIO-aligned middle is issued using O_DIRECT. This combination of trace events is useful for LOCALIO DIO READs: echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_read/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_misaligned/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_initiate_read/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_readpage_done/enable echo 1 > /sys/kernel/tracing/events/xfs/xfs_file_direct_read/enable This combination of trace events is useful for LOCALIO DIO WRITEs: echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_write/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_misaligned/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_initiate_write/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_writeback_done/enable echo 1 > /sys/kernel/tracing/events/xfs/xfs_file_direct_write/enable Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit c817248fc831f5494d076421672b70a6ec1a92dc Author: Mike Snitzer Date: Fri Sep 19 10:36:29 2025 -0400 nfs/localio: add proper O_DIRECT support for READ and WRITE Because the NFS client will already happily handle misaligned O_DIRECT IO (by sending it out to NFSD via RPC) this commit's new capabilities are for the benefit of LOCALIO. LOCALIO will make best effort to transform misaligned IO to DIO-aligned extents when possible. LOCALIO's READ and WRITE DIO that is misaligned will be split into as many as 3 component IOs (@start, @middle and @end) as needed -- IFF the @middle extent is verified to be DIO-aligned, and then the @start and/or @end are misaligned (due to each being a partial page). Otherwise if the @middle isn't DIO-aligned the code will fallback to issuing only a single contiguous buffered IO. The @middle is only DIO-aligned if both the memory and on-disk offsets for the IO are aligned relative to the underlying local filesystem's block device limits (@dma_alignment and @logical_block_size respectively). The misaligned @start and/or @end extents are issued using buffered IO and the DIO-aligned @middle is issued using O_DIRECT. The @start and @end IOs are issued first using buffered IO with IOCB_SYNC and then the @middle is issued last using direct IO with async completion (AIO). This out of order IO completion means that LOCALIO's IO completion code (nfs_local_read_done and nfs_local_write_done) is only called for the IO's last associated iov_iter completion. And in the case of DIO-aligned @middle it completes last using AIO. nfs_local_pgio_done() is updated to handle piece-wise partial completion of each iov_iter. This implementation for LOCALIO's misaligned DIO handling uses 3 iov_iter that share the same backing pages in their bio_vecs (so unfortunately 'struct nfs_local_kiocb' has 3 instead of only 1). [Reducing LOCALIO's per-IO (struct nfs_local_kiocb) memory use can be explored in the future. One logical progression to improve this code, and eliminate explicit loops over up to 3 iov_iter, is by extending 'struct iov_iter' to support iov_iter_clone() and iov_iter_chain() interfaces that are comparable to what 'struct bio' is able to support in the block layer. But even that wouldn't avoid the need to allocate/use up to 3 iov_iter] Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit e43e9a3a3d6652047808d6fadff5c3703f5ce90d Author: Mike Snitzer Date: Fri Sep 19 10:36:28 2025 -0400 nfs/localio: refactor iocb initialization The goal of this commit's various refactoring is to have LOCALIO's per IO initialization occur in process context so that we don't get into a situation where IO fails to be issued from workqueue (e.g. due to lack of memory, etc). Better to have LOCALIO's iocb initialization fail early. There isn't immediate need but this commit makes it possible for LOCALIO to fallback to NFS pagelist code in process context to allow for immediate retry over RPC. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 091bdcfcece0963a9a6590ba7cfcc9e1d454165f Author: Mike Snitzer Date: Fri Sep 19 10:36:27 2025 -0400 nfs/localio: refactor iocb and iov_iter_bvec initialization nfs_local_iter_init() is updated to follow the same pattern to initializing LOCALIO's iov_iter_bvec as was established by nfsd_iter_read(). Other LOCALIO iocb initialization refactoring in this commit offers incremental cleanup that will be taken further by the next commit. No functional change. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 558ae4579810fa0fef011944230c65a6f3087f85 Author: Hoyoung Seo Date: Tue Sep 30 15:14:28 2025 +0900 scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS When a UTP error occurs in isolation, UFS is not currently recoverable. This is because the UTP error is not considered fatal in the error handling code, leading to either an I/O timeout or an OCS error. Add the UTP error flag to INT_FATAL_ERRORS so the controller will be reset in this situation. sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 2 OCS error from controller = 9 for tag 39 pa_err[1] = 0x80000010 at 2667224756 us pa_err: total cnt=2 dl_err[0] = 0x80000002 at 2667148060 us dl_err[1] = 0x80002000 at 2667282844 us No record of nl_err No record of tl_err No record of dme_err No record of auto_hibern8_err fatal_err[0] = 0x804 at 2667282836 us --------------------------------------------------- REGISTER --------------------------------------------------- NAME OFFSET VALUE STD HCI SFR 0xfffffff0 0x0 AHIT 0x18 0x814 INTERRUPT STATUS 0x20 0x1000 INTERRUPT ENABLE 0x24 0x70ef5 [mkp: commit desc] Signed-off-by: Hoyoung Seo Reviewed-by: Bart Van Assche Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> Signed-off-by: Martin K. Petersen commit 25ba2b84c38f624151a3ba36e56d41c39b9223ad Author: Mike Snitzer Date: Fri Sep 19 10:36:26 2025 -0400 nfs/localio: avoid issuing misaligned IO using O_DIRECT Add nfsd_file_dio_alignment and use it to avoid issuing misaligned IO using O_DIRECT. Any misaligned DIO falls back to using buffered IO. Because misaligned DIO is now handled safely, remove the nfs modparam 'localio_O_DIRECT_semantics' that was added to require users opt-in to the requirement that all O_DIRECT be properly DIO-aligned. Also, introduce nfs_iov_iter_aligned_bvec() which is a variant of iov_iter_aligned_bvec() that also verifies the offset associated with an iov_iter is DIO-aligned. NOTE: in a parallel effort, iov_iter_aligned_bvec() is being removed along with iov_iter_is_aligned(). Lastly, add pr_info_ratelimited if underlying filesystem returns -EINVAL because it was made to try O_DIRECT for IO that is not DIO-aligned (shouldn't happen, so its best to be louder if it does). Fixes: 3feec68563d ("nfs/localio: add direct IO enablement with sync and async IO support") Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit fd6d93c2b79ded0a447502ce5c8a9a549c697819 Author: Mike Snitzer Date: Fri Sep 19 10:36:25 2025 -0400 nfs/localio: make trace_nfs_local_open_fh more useful Always trigger trace event when LOCALIO opens a file. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit d11f6cd1bb4a416b4515702d020a7480ac667f0f Author: Mike Snitzer Date: Mon Sep 29 11:56:41 2025 -0400 NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support Use STATX_DIOALIGN and STATX_DIO_READ_ALIGN to get DIO alignment attributes from the underlying filesystem and store them in the associated nfsd_file. This is done when the nfsd_file is first opened for each regular file. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever Acked-by: Chuck Lever Signed-off-by: Anna Schumaker commit ffe381923d87c8cf5d4372c12eea6127dc36fd3a Author: Jeff Layton Date: Mon Sep 22 17:36:48 2025 -0400 sunrpc: unexport rpc_malloc() and rpc_free() These are not used outside of sunrpc code. Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker commit d7ec0cf1cd79a74399b53453f9c48acbca7d6fce Merge: d9c43b6e43643e 930f2361fe542a Author: Linus Torvalds Date: Tue Sep 30 12:46:57 2025 -0700 Merge tag 'x86_bugs_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mitigation updates from Borislav Petkov: - Add VMSCAPE to the attack vector controls infrastructure - A bunch of the usual cleanups and fixlets, some of them resulting from fuzzing the different mitigation options * tag 'x86_bugs_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Report correct retbleed mitigation status x86/bugs: Fix reporting of LFENCE retpoline x86/bugs: Fix spectre_v2 forcing x86/bugs: Remove uses of cpu_mitigations_off() x86/bugs: Simplify SSB cmdline parsing x86/bugs: Use early_param() for spectre_v2 x86/bugs: Use early_param() for spectre_v2_user x86/bugs: Add attack vector controls for VMSCAPE x86/its: Move ITS indirect branch thunks to .text..__x86.indirect_thunk commit bb7663dec67b691528f104894429b3859fb16c14 Author: Daniel Lee Date: Mon Sep 29 18:09:39 2025 -0700 scsi: ufs: sysfs: Make HID attributes visible Call sysfs_update_group() after reading the device descriptor to ensure the HID sysfs attributes are visible when the feature is supported. Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support") Signed-off-by: Daniel Lee Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d9c43b6e43643e0c884179fd4598e2003f1a04a3 Merge: bd91417a962db2 5c6f123c419b6e Author: Linus Torvalds Date: Tue Sep 30 12:43:17 2025 -0700 Merge tag 'ras_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - Unify and refactor the MCA arch side and better separate code - Cleanup and simplify the AMD RAS side, unify code, drop unused stuff * tag 'ras_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Add a clear_bank() helper x86/mce: Move machine_check_poll() status checks to helper functions x86/mce: Separate global and per-CPU quirks x86/mce: Do 'UNKNOWN' vendor check early x86/mce: Define BSP-only SMCA init x86/mce: Define BSP-only init x86/mce: Set CR4.MCE last during init x86/mce: Remove __mcheck_cpu_init_early() x86/mce: Cleanup bank processing on init x86/mce/amd: Put list_head in threshold_bank x86/mce/amd: Remove smca_banks_map x86/mce/amd: Remove return value for mce_threshold_{create,remove}_device() x86/mce/amd: Rename threshold restart function commit bd91417a962db247d41a22720a79e68a509a9353 Merge: 45d96dd2c62899 43181a47263dd9 Author: Linus Torvalds Date: Tue Sep 30 12:41:10 2025 -0700 Merge tag 'x86_microcode_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislav Petkov: - Add infrastructure to be able to debug the microcode loader in a guest - Refresh Intel old microcode revisions * tag 'x86_microcode_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Add microcode loader debugging functionality x86/microcode: Add microcode= cmdline parsing x86/microcode/intel: Refresh the revisions that determine old_microcode commit 45d96dd2c62899ff8a3f07e3b8109656062b457a Merge: 163d9c6b339c4b ac9c408ed19d53 Author: Linus Torvalds Date: Tue Sep 30 12:19:29 2025 -0700 Merge tag 'x86_asm_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm update from Borislav Petkov: - Fix RDPID's output operand size in inline asm and use the insn mnemonic because the minimum binutils version supports it * tag 'x86_asm_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Fix output operand size of RDPID commit 163d9c6b339c4bbe1a7a877ed8c99702da96d994 Merge: 98afd4dd3dd385 2c6a28f3ef729e Author: Linus Torvalds Date: Tue Sep 30 12:17:22 2025 -0700 Merge tag 'x86_build_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Borislav Petkov: - Remove and simplify a bunch of cc-option and compiler version checks in the build machinery now that the minimal version of both compilers supports them * tag 'x86_build_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/Kconfig: Clean up LLVM version checks in IBT configurations x86/build: Remove cc-option from -mskip-rax-setup x86/build: Remove cc-option from -mno-fp-ret-in-387 x86/build: Clean up stack alignment flags in CC_FLAGS_FPU x86/build: Remove cc-option from stack alignment flags x86/build: Remove cc-option for GCC retpoline flags commit 98afd4dd3dd385623e8e7c88394e352b0fbf0c3f Merge: 03f76ddff5b04a 26178b713f2b3f Author: Linus Torvalds Date: Tue Sep 30 11:48:33 2025 -0700 Merge tag 'x86_misc_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 instruction decoder update from Borislav Petkov: - Add instruction decoding support for the XOP-prefixed instruction set present on the AMD Bulldozer uarch [ These instructions don't normally happen, but a X86_NATIVE_CPU build on a bulldozer host can make the compiler then use these unusual instruction encodings ] * tag 'x86_misc_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/insn: Add XOP prefix instructions decoder support commit 03f76ddff5b04a808ae16c06418460151e2fdd4b Merge: 88b489385bfe37 69ed025aeb4c8f Author: Linus Torvalds Date: Tue Sep 30 11:41:03 2025 -0700 Merge tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Add support for new AMD family 0x1a models to amd64_edac - Add an EDAC driver for the AMD VersalNET memory controller which reports hw errors from different IP blocks in the fabric using an IPC-type transport - Drop the silly static number of memory controllers in the Intel EDAC drivers (skx, i10nm) in favor of a flexible array so that former doesn't need to be increased with every new generation which adds more memory controllers; along with a proper refactoring - Add support for two Alder Lake-S SOCs to ie31200_edac - Add an EDAC driver for ADM Cortex A72 cores, and specifically for reporting L1 and L2 cache errors - Last but not least, the usual fixes, cleanups and improvements all over the subsystem * tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (23 commits) EDAC/versalnet: Return the correct error in mc_probe() EDAC/mc_sysfs: Increase legacy channel support to 16 EDAC/amd64: Add support for AMD family 1Ah-based newer models EDAC: Add a driver for the AMD Versal NET DDR controller dt-bindings: memory-controllers: Add support for Versal NET EDAC RAS: Export log_non_standard_event() to drivers cdx: Export Symbols for MCDI RPC and Initialization cdx: Split mcdi.h and reorganize headers EDAC/skx_common: Use topology_physical_package_id() instead of open coding EDAC: Fix wrong executable file modes for C source files EDAC/altera: Use dev_fwnode() EDAC/skx_common: Remove unused *NUM*_IMC macros EDAC/i10nm: Reallocate skx_dev list if preconfigured cnt != runtime cnt EDAC/skx_common: Remove redundant upper bound check for res->imc EDAC/skx_common: Make skx_dev->imc[] a flexible array EDAC/skx_common: Swap memory controller index mapping EDAC/skx_common: Move mc_mapping to be a field inside struct skx_imc EDAC/{skx_common,skx}: Use configuration data, not global macros EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller EDAC/ie31200: Add two more Intel Alder Lake-S SoCs for EDAC support ... commit 88b489385bfe3713497a63c0dcf4dd7852cf4568 Merge: e4dcbdff114e2c 17d9f8eaa87d40 Author: Linus Torvalds Date: Tue Sep 30 11:33:21 2025 -0700 Merge tag 'locking-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Mostly Rust runtime enhancements: - Add initial support for generic LKMM atomic variables in Rust (Boqun Feng) - Add the wrapper for `refcount_t` in Rust (Gary Guo) - Add a new reviewer, Gary Guo" * tag 'locking-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: update atomic infrastructure entry to include Rust rust: block: convert `block::mq` to use `Refcount` rust: convert `Arc` to use `Refcount` rust: make `Arc::into_unique_or_drop` associated function rust: implement `kernel::sync::Refcount` rust: sync: Add memory barriers rust: sync: atomic: Add Atomic<{usize,isize}> rust: sync: atomic: Add Atomic rust: sync: atomic: Add the framework of arithmetic operations rust: sync: atomic: Add atomic {cmp,}xchg operations rust: sync: atomic: Add generic atomics rust: sync: atomic: Add ordering annotation types rust: sync: Add basic atomic operation mapping framework rust: Introduce atomic API helpers commit e4dcbdff114e2c0a8059c396e233aa5d9637afce Merge: 6c7340a7a8d2b6 6d48436560e91b Author: Linus Torvalds Date: Tue Sep 30 11:11:21 2025 -0700 Merge tag 'perf-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: "Core perf code updates: - Convert mmap() related reference counts to refcount_t. This is in reaction to the recently fixed refcount bugs, which could have been detected earlier and could have mitigated the bug somewhat (Thomas Gleixner, Peter Zijlstra) - Clean up and simplify the callchain code, in preparation for sframes (Steven Rostedt, Josh Poimboeuf) Uprobes updates: - Add support to optimize usdt probes on x86-64, which gives a substantial speedup (Jiri Olsa) - Cleanups and fixes on x86 (Peter Zijlstra) PMU driver updates: - Various optimizations and fixes to the Intel PMU driver (Dapeng Mi) Misc cleanups and fixes: - Remove redundant __GFP_NOWARN (Qianfeng Rong)" * tag 'perf-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (57 commits) selftests/bpf: Fix uprobe_sigill test for uprobe syscall error value uprobes/x86: Return error from uprobe syscall when not called from trampoline perf: Skip user unwind if the task is a kernel thread perf: Simplify get_perf_callchain() user logic perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL perf: Have get_perf_callchain() return NULL if crosstask and user are set perf: Remove get_perf_callchain() init_nr argument perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error perf/x86/intel: Use early_initcall() to hook bts_init() uprobes: Remove redundant __GFP_NOWARN selftests/seccomp: validate uprobe syscall passes through seccomp seccomp: passthrough uprobe systemcall without filtering selftests/bpf: Fix uprobe syscall shadow stack test selftests/bpf: Change test_uretprobe_regs_change for uprobe and uretprobe selftests/bpf: Add uprobe_regs_equal test selftests/bpf: Add optimized usdt variant for basic usdt test ... commit 6b36119b94d0b2bb8cea9d512017efafd461d6ac Author: Sean Christopherson Date: Thu Sep 18 17:33:03 2025 -0700 KVM: x86: Export KVM-internal symbols for sub-modules only Rework almost all of KVM x86's exports to expose symbols only to KVM's vendor modules, i.e. to kvm-{amd,intel}.ko. Keep the generic exports that are guarded by CONFIG_KVM_EXTERNAL_WRITE_TRACKING=y, as they're explicitly designed/intended for external usage. Link: https://lore.kernel.org/r/20250919003303.1355064-6-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 6560468305da263c35ff51cde1dd74d6a228b286 Author: Sean Christopherson Date: Thu Sep 18 17:33:02 2025 -0700 KVM: x86: Drop pointless exports of kvm_arch_xxx() hooks Drop the exporting of several kvm_arch_xxx() hooks that are only called from arch-neutral code, i.e. that are only called from kvm.ko. Link: https://lore.kernel.org/r/20250919003303.1355064-5-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d273b52b6fad95b6b00b93250151c323c19de50d Author: Sean Christopherson Date: Thu Sep 18 17:33:01 2025 -0700 KVM: x86: Move kvm_intr_is_single_vcpu() to lapic.c Move kvm_intr_is_single_vcpu() to lapic.c, drop its export, and make its "fast" helper local to lapic.c. kvm_intr_is_single_vcpu() is only usable if the local APIC is in-kernel, i.e. it most definitely belongs in the local APIC code. No functional change intended. Fixes: cf04ec393ed0 ("KVM: x86: Dedup AVIC vs. PI code for identifying target vCPU") Link: https://lore.kernel.org/r/20250919003303.1355064-4-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 20c48920583675e67b3824f147726e0fbda735ce Author: Sean Christopherson Date: Thu Sep 18 17:33:00 2025 -0700 KVM: Export KVM-internal symbols for sub-modules only Rework the vast majority of KVM's exports to expose symbols only to KVM submodules, i.e. to x86's kvm-{amd,intel}.ko and PPC's kvm-{pr,hv}.ko. With few exceptions, KVM's exported APIs are intended (and safe) for KVM- internal usage only. Keep kvm_get_kvm(), kvm_get_kvm_safe(), and kvm_put_kvm() as normal exports, as they are needed by VFIO, and are generally safe for external usage (though ideally even the get/put APIs would be KVM-internal, and VFIO would pin a VM by grabbing a reference to its associated file). Implement a framework in kvm_types.h in anticipation of providing a macro to restrict KVM-specific kernel exports, i.e. to provide symbol exports for KVM if and only if KVM is built as one or more modules. Link: https://lore.kernel.org/r/20250919003303.1355064-3-seanjc@google.com Cc: Nathan Chancellor Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 15463eece957be34da64b4d6fe18fc98981bf487 Author: Sean Christopherson Date: Thu Sep 18 17:32:59 2025 -0700 KVM: s390/vfio-ap: Use kvm_is_gpa_in_memslot() instead of open coded equivalent Use kvm_is_gpa_in_memslot() to check the validity of the notification indicator byte address instead of open coding equivalent logic in the VFIO AP driver. Opportunistically use a dedicated wrapper that exists and is exported expressly for the VFIO AP module. kvm_is_gpa_in_memslot() is generally unsuitable for use outside of KVM; other drivers typically shouldn't rely on KVM's memslots, and using the API requires kvm->srcu (or slots_lock) to be held for the entire duration of the usage, e.g. to avoid TOCTOU bugs. handle_pqap() is a bit of a special case, as it's explicitly invoked from KVM with kvm->srcu already held, and the VFIO AP driver is in many ways an extension of KVM that happens to live in a separate module. Providing a dedicated API for the VFIO AP driver will allow restricting the vast majority of generic KVM's exports to KVM submodules (e.g. to x86's kvm-{amd,intel}.ko vendor mdoules). No functional change intended. Acked-by: Anthony Krowiak Reviewed-by: Christian Borntraeger Link: https://lore.kernel.org/r/20250919003303.1355064-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 12abeb81c87331bf53940947694cc51b7507aa38 Merge: d05ca6b7931e15 d292035fb5d209 Author: Paolo Bonzini Date: Tue Sep 30 13:37:14 2025 -0400 Merge tag 'kvm-x86-cet-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 CET virtualization support for 6.18 Add support for virtualizing Control-flow Enforcement Technology (CET) on Intel (Shadow Stacks and Indirect Branch Tracking) and AMD (Shadow Stacks). CET is comprised of two distinct features, Shadow Stacks (SHSTK) and Indirect Branch Tracking (IBT), that can be utilized by software to help provide Control-flow integrity (CFI). SHSTK defends against backward-edge attacks (a.k.a. Return-oriented programming (ROP)), while IBT defends against forward-edge attacks (a.k.a. similarly CALL/JMP-oriented programming (COP/JOP)). Attackers commonly use ROP and COP/JOP methodologies to redirect the control- flow to unauthorized targets in order to execute small snippets of code, a.k.a. gadgets, of the attackers choice. By chaining together several gadgets, an attacker can perform arbitrary operations and circumvent the system's defenses. SHSTK defends against backward-edge attacks, which execute gadgets by modifying the stack to branch to the attacker's target via RET, by providing a second stack that is used exclusively to track control transfer operations. The shadow stack is separate from the data/normal stack, and can be enabled independently in user and kernel mode. When SHSTK is is enabled, CALL instructions push the return address on both the data and shadow stack. RET then pops the return address from both stacks and compares the addresses. If the return addresses from the two stacks do not match, the CPU generates a Control Protection (#CP) exception. IBT defends against backward-edge attacks, which branch to gadgets by executing indirect CALL and JMP instructions with attacker controlled register or memory state, by requiring the target of indirect branches to start with a special marker instruction, ENDBRANCH. If an indirect branch is executed and the next instruction is not an ENDBRANCH, the CPU generates a #CP. Note, ENDBRANCH behaves as a NOP if IBT is disabled or unsupported. From a virtualization perspective, CET presents several problems. While SHSTK and IBT have two layers of enabling, a global control in the form of a CR4 bit, and a per-feature control in user and kernel (supervisor) MSRs (U_CET and S_CET respectively), the {S,U}_CET MSRs can be context switched via XSAVES/XRSTORS. Practically speaking, intercepting and emulating XSAVES/XRSTORS is not a viable option due to complexity, and outright disallowing use of XSTATE to context switch SHSTK/IBT state would render the features unusable to most guests. To limit the overall complexity without sacrificing performance or usability, simply ignore the potential virtualization hole, but ensure that all paths in KVM treat SHSTK/IBT as usable by the guest if the feature is supported in hardware, and the guest has access to at least one of SHSTK or IBT. I.e. allow userspace to advertise one of SHSTK or IBT if both are supported in hardware, even though doing so would allow a misbehaving guest to use the unadvertised feature. Fully emulating SHSTK and IBT would also require significant complexity, e.g. to track and update branch state for IBT, and shadow stack state for SHSTK. Given that emulating large swaths of the guest code stream isn't necessary on modern CPUs, punt on emulating instructions that meaningful impact or consume SHSTK or IBT. However, instead of doing nothing, explicitly reject emulation of such instructions so that KVM's emulator can't be abused to circumvent CET. Disable support for SHSTK and IBT if KVM is configured such that emulation of arbitrary guest instructions may be required, specifically if Unrestricted Guest (Intel only) is disabled, or if KVM will emulate a guest.MAXPHYADDR that is smaller than host.MAXPHYADDR. Lastly disable SHSTK support if shadow paging is enabled, as the protections for the shadow stack are novel (shadow stacks require Writable=0,Dirty=1, so that they can't be directly modified by software), i.e. would require non-trivial support in the Shadow MMU. Note, AMD CPUs currently only support SHSTK. Explicitly disable IBT support so that KVM doesn't over-advertise if AMD CPUs add IBT, and virtualizing IBT in SVM requires KVM modifications. commit d05ca6b7931e15d882af9ca4a609957cae7aac96 Merge: 10ef74c06bb1f5 86bcd23df9cec9 Author: Paolo Bonzini Date: Tue Sep 30 13:36:41 2025 -0400 Merge tag 'kvm-x86-misc-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 changes for 6.18 - Don't (re)check L1 intercepts when completing userspace I/O to fix a flaw where a misbehaving usersepace (a.k.a. syzkaller) could swizzle L1's intercepts and trigger a variety of WARNs in KVM. - Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 guests, as the MSR is supposed to exist for v2 PMUs. - Allow Centaur CPU leaves (base 0xC000_0000) for Zhaoxin CPUs. - Clean up KVM's vector hashing code for delivering lowest priority IRQs. - Clean up the fastpath handler code to only handle IPIs and WRMSRs that are actually "fast", as opposed to handling those that KVM _hopes_ are fast, and in the process of doing so add fastpath support for TSC_DEADLINE writes on AMD CPUs. - Clean up a pile of PMU code in anticipation of adding support for mediated vPMUs. - Add support for the immediate forms of RDMSR and WRMSRNS, sans full emulator support (KVM should never need to emulate the MSRs outside of forced emulation and other contrived testing scenarios). - Clean up the MSR APIs in preparation for CET and FRED virtualization, as well as mediated vPMU support. - Rejecting a fully in-kernel IRQCHIP if EOIs are protected, i.e. for TDX VMs, as KVM can't faithfully emulate an I/O APIC for such guests. - KVM_REQ_MSR_FILTER_CHANGED into a generic RECALC_INTERCEPTS in preparation for mediated vPMU support, as KVM will need to recalculate MSR intercepts in response to PMU refreshes for guests with mediated vPMUs. - Misc cleanups and minor fixes. commit 6c7340a7a8d2b6ecad1ad108f6daa73ba1dc082f Merge: 755fa5b4fb3662 45b7f780739a31 Author: Linus Torvalds Date: Tue Sep 30 10:35:11 2025 -0700 Merge tag 'sched-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Core scheduler changes: - Make migrate_{en,dis}able() inline, to improve performance (Menglong Dong) - Move STDL_INIT() functions out-of-line (Peter Zijlstra) - Unify the SCHED_{SMT,CLUSTER,MC} Kconfig (Peter Zijlstra) Fair scheduling: - Defer throttling to when tasks exit to user-space, to reduce the chance & impact of throttle-preemption with held locks and other resources (Aaron Lu, Valentin Schneider) - Get rid of sched_domains_curr_level hack for tl->cpumask(), as the warning was getting triggered on certain topologies (Peter Zijlstra) Misc cleanups & fixes: - Header cleanups (Menglong Dong) - Fix race in push_dl_task() (Harshit Agarwal)" * tag 'sched-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix some typos in include/linux/preempt.h sched: Make migrate_{en,dis}able() inline rcu: Replace preempt.h with sched.h in include/linux/rcupdate.h arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c sched/fair: Do not balance task to a throttled cfs_rq sched/fair: Do not special case tasks in throttled hierarchy sched/fair: update_cfs_group() for throttled cfs_rqs sched/fair: Propagate load for throttled cfs_rq sched/fair: Get rid of throttled_lb_pair() sched/fair: Task based throttle time accounting sched/fair: Switch to task based throttle model sched/fair: Implement throttle task work and related helpers sched/fair: Add related data structure for task based throttle sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig sched: Move STDL_INIT() functions out-of-line sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() sched/deadline: Fix race in push_dl_task() commit 10ef74c06bb1f51e706018f2939722e881192eff Merge: a104e0a3052d5e 6c7c620585c653 Author: Paolo Bonzini Date: Tue Sep 30 13:34:32 2025 -0400 Merge tag 'kvm-x86-ciphertext-6.18' of https://github.com/kvm-x86/linux into HEAD KVM SEV-SNP CipherText Hiding support for 6.18 Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents unauthorized CPU accesses from reading the ciphertext of SNP guest private memory, e.g. to attempt an offline attack. Instead of ciphertext, the CPU will always read back all FFs when CipherText Hiding is enabled. Add new module parameter to the KVM module to enable CipherText Hiding and control the number of ASIDs that can be used for VMs with CipherText Hiding, which is in effect the number of SNP VMs. When CipherText Hiding is enabled, the shared SEV-ES/SEV-SNP ASID space is split into separate ranges for SEV-ES and SEV-SNP guests, i.e. ASIDs that can be used for CipherText Hiding cannot be used to run SEV-ES guests. commit a104e0a3052d5e5d764e3e057c42ebaed17b53bd Merge: 0f68fe44550cf1 ca2967de5a5b09 Author: Paolo Bonzini Date: Tue Sep 30 13:34:12 2025 -0400 Merge tag 'kvm-x86-svm-6.18' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.18 - Require a minimum GHCB version of 2 when starting SEV-SNP guests via KVM_SEV_INIT2 so that invalid GHCB versions result in immediate errors instead of latent guest failures. - Add support for Secure TSC for SEV-SNP guests, which prevents the untrusted host from tampering with the guest's TSC frequency, while still allowing the the VMM to configure the guest's TSC frequency prior to launch. - Mitigate the potential for TOCTOU bugs when accessing GHCB fields by wrapping all accesses via READ_ONCE(). - Validate the XCR0 provided by the guest (via the GHCB) to avoid tracking a bogous XCR0 value in KVM's software model. - Save an SEV guest's policy if and only if LAUNCH_START fully succeeds to avoid leaving behind stale state (thankfully not consumed in KVM). - Explicitly reject non-positive effective lengths during SNP's LAUNCH_UPDATE instead of subtly relying on guest_memfd to do the "heavy" lifting. - Reload the pre-VMRUN TSC_AUX on #VMEXIT for SEV-ES guests, not the host's desired TSC_AUX, to fix a bug where KVM could clobber a different vCPU's TSC_AUX due to hardware not matching the value cached in the user-return MSR infrastructure. - Enable AVIC by default for Zen4+ if x2AVIC (and other prereqs) is supported, and clean up the AVIC initialization code along the way. commit 0f68fe44550cf165b7af5744617447ab038a89b5 Merge: 5b0d0d85422df8 510c47f165f0c1 Author: Paolo Bonzini Date: Tue Sep 30 13:32:57 2025 -0400 Merge tag 'kvm-x86-vmx-6.18' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.18 - Add read/write helpers for MSRs that need to be accessed with preemption disable to prepare for virtualizing FRED RSP0. - Fix a bug where KVM would return 0/success from __tdx_bringup() on error, i.e. where KVM would load with enable_tdx=true despite TDX not being usable. - Minor cleanups. commit 5b0d0d85422df8dbfeb02fb248e61e4d60228842 Merge: 99cab80208809c 2bc2694fe20bf0 Author: Paolo Bonzini Date: Tue Sep 30 13:32:27 2025 -0400 Merge tag 'kvm-x86-mmu-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.18 - Recover possible NX huge pages within the TDP MMU under read lock to reduce guest jitter when restoring NX huge pages. - Return -EAGAIN during prefault if userspace concurrently deletes/moves the relevant memslot to fix an issue where prefaulting could deadlock with the memslot update. - Don't retry in TDX's anti-zero-step mitigation if the target memslot is invalid, i.e. is being deleted or moved, to fix a deadlock scenario similar to the aforementioned prefaulting case. commit 99cab80208809cb918d6e579e6165279096f058a Merge: 3c5d19a365b71e cf6a8401b6a12c Author: Paolo Bonzini Date: Tue Sep 30 13:27:59 2025 -0400 Merge tag 'kvm-x86-generic-6.18' of https://github.com/kvm-x86/linux into HEAD KVM common changes for 6.18 Remove a redundant __GFP_NOWARN from kvm_setup_async_pf() as __GFP_NOWARN is now included in GFP_NOWAIT. commit 3c5d19a365b71e9775c831b9d3ab053dd591d9dd Merge: 473badf5c47817 96055050396509 Author: Paolo Bonzini Date: Tue Sep 30 13:24:59 2025 -0400 Merge tag 'kvm-x86-guest-6.18' of https://github.com/kvm-x86/linux into HEAD x86/kvm guest side changes for 6.18 - For the legacy PCI hole (memory between TOLUD and 4GiB) to UC when overriding guest MTRR for TDX/SNP to fix an issue where ACPI auto-mapping could map devices as WB and prevent the device drivers from mapping their devices with UC/UC-. - Make kvm_async_pf_task_wake() a local static helper and remove its export. - Use native qspinlocks when running in a VM with dedicated vCPU=>pCPU bindings even when PV_UNHALT is unsupported. commit 473badf5c478174754580bfa9d3207cf9b8d412e Merge: 6a137497178720 df1f294013da71 Author: Paolo Bonzini Date: Tue Sep 30 13:23:54 2025 -0400 Merge tag 'kvm-x86-selftests-6.18' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.18 - Add #DE coverage in the fastops test (the only exception that's guest- triggerable in fastop-emulated instructions). - Fix PMU selftests errors encountered on Granite Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF). - Minor cleanups and improvements commit 6a137497178720da8f454c81d2e9fcebc3137b51 Merge: 924ccf1d093a0c 66e2d96b1c5875 Author: Paolo Bonzini Date: Tue Sep 30 13:23:44 2025 -0400 Merge tag 'loongarch-kvm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.18 1. Add PTW feature detection on new hardware. 2. Add sign extension with kernel MMIO/IOCSR emulation. 3. Improve in-kernel IPI emulation. 4. Improve in-kernel PCH-PIC emulation. 5. Move kvm_iocsr tracepoint out of generic code. commit 924ccf1d093a0c688eba9da1adff9a290d7bd7d8 Merge: 924ebaefcec282 dbdadd943a278f Author: Paolo Bonzini Date: Tue Sep 30 13:23:36 2025 -0400 Merge tag 'kvm-riscv-6.18-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.18 - Added SBI FWFT extension for Guest/VM with misaligned delegation and pointer masking PMLEN features - Added ONE_REG interface for SBI FWFT extension - Added Zicbop and bfloat16 extensions for Guest/VM - Enabled more common KVM selftests for RISC-V such as access_tracking_perf_test, dirty_log_perf_test, memslot_modification_stress_test, memslot_perf_test, mmu_stress_test, and rseq_test - Added SBI v3.0 PMU enhancements in KVM and perf driver commit 924ebaefcec28289c210cad92551ae900e8fc220 Merge: 8cbb0df2945a0f 10fd0285305d0b Author: Paolo Bonzini Date: Tue Sep 30 13:23:28 2025 -0400 Merge tag 'kvmarm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.18 - Add support for FF-A 1.2 as the secure memory conduit for pKVM, allowing more registers to be used as part of the message payload. - Change the way pKVM allocates its VM handles, making sure that the privileged hypervisor is never tricked into using uninitialised data. - Speed up MMIO range registration by avoiding unnecessary RCU synchronisation, which results in VMs starting much quicker. - Add the dump of the instruction stream when panic-ing in the EL2 payload, just like the rest of the kernel has always done. This will hopefully help debugging non-VHE setups. - Add 52bit PA support to the stage-1 page-table walker, and make use of it to populate the fault level reported to the guest on failing to translate a stage-1 walk. - Add NV support to the GICv3-on-GICv5 emulation code, ensuring feature parity for guests, irrespective of the host platform. - Fix some really ugly architecture problems when dealing with debug in a nested VM. This has some bad performance impacts, but is at least correct. - Add enough infrastructure to be able to disable EL2 features and give effective values to the EL2 control registers. This then allows a bunch of features to be turned off, which helps cross-host migration. - Large rework of the selftest infrastructure to allow most tests to transparently run at EL2. This is the first step towards enabling NV testing. - Various fixes and improvements all over the map, including one BE fix, just in time for the removal of the feature. commit 8cbb0df2945a0fcb1f0b4384e65f13ec727baef4 Merge: 68f6051098f9b1 e6157256ee1a6a Author: Paolo Bonzini Date: Tue Sep 30 13:23:06 2025 -0400 Merge tag 'kvmarm-fixes-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.17, round #3 - Invalidate nested MMUs upon freeing the PGD to avoid WARNs when visiting from an MMU notifier - Fixes to the TLB match process and TLB invalidation range for managing the VCNR pseudo-TLB - Prevent SPE from erroneously profiling guests due to UNKNOWN reset values in PMSCR_EL1 - Fix save/restore of host MDCR_EL2 to account for eagerly programming at vcpu_load() on VHE systems - Correct lock ordering when dealing with VGIC LPIs, avoiding scenarios where an xarray's spinlock was nested with a *raw* spinlock - Permit stage-2 read permission aborts which are possible in the case of NV depending on the guest hypervisor's stage-2 translation - Call raw_spin_unlock() instead of the internal spinlock API - Fix parameter ordering when assigning VBAR_EL1 [Pull into kvm/master to fix conflicts. - Paolo] commit 68f6051098f9b12bf0e227f753cf60e2f751b03d Merge: a6ad54137af925 5deafa27d9ae04 Author: Paolo Bonzini Date: Tue Sep 30 13:09:20 2025 -0400 Merge tag 'kvm-s390-next-6.18-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: A bugfix and a performance improvement * Improve interrupt cpu for wakeup, change the heuristic to decide wich vCPU to deliver a floating interrupt to. * Clear the pte when discarding a swapped page because of CMMA; this bug was introduced in 6.16 when refactoring gmap code. commit 755fa5b4fb36627796af19932a432d343220ec63 Merge: 77fc3f6696554a 8f0fdbd4a06bf7 Author: Linus Torvalds Date: Tue Sep 30 09:55:41 2025 -0700 Merge tag 'cgroup-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Extensive cpuset code cleanup and refactoring work with no functional changes: CPU mask computation logic refactoring, introducing new helpers, removing redundant code paths, and improving error handling for better maintainability. - A few bug fixes to cpuset including fixes for partition creation failures when isolcpus is in use, missing error returns, and null pointer access prevention in free_tmpmasks(). - Core cgroup changes include replacing the global percpu_rwsem with per-threadgroup rwsem when writing to cgroup.procs for better scalability, workqueue conversions to use WQ_PERCPU and system_percpu_wq to prepare for workqueue default switching from percpu to unbound, and removal of unused code including the post_attach callback. - New cgroup.stat.local time accounting feature that tracks frozen time duration. - Misc changes including selftests updates (new freezer time tests and backward compatibility fixes), documentation sync, string function safety improvements, and 64-bit division fixes. * tag 'cgroup-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (39 commits) cpuset: remove is_prs_invalid helper cpuset: remove impossible warning in update_parent_effective_cpumask cpuset: remove redundant special case for null input in node mask update cpuset: fix missing error return in update_cpumask cpuset: Use new excpus for nocpu error check when enabling root partition cpuset: fix failure to enable isolated partition when containing isolcpus Documentation: cgroup-v2: Sync manual toctree cpuset: use partition_cpus_change for setting exclusive cpus cpuset: use parse_cpulist for setting cpus.exclusive cpuset: introduce partition_cpus_change cpuset: refactor cpus_allowed_validate_change cpuset: refactor out validate_partition cpuset: introduce cpus_excl_conflict and mems_excl_conflict helpers cpuset: refactor CPU mask buffer parsing logic cpuset: Refactor exclusive CPU mask computation logic cpuset: change return type of is_partition_[in]valid to bool cpuset: remove unused assignment to trialcs->partition_root_state cpuset: move the root cpuset write check earlier cgroup/cpuset: Remove redundant rcu_read_lock/unlock() in spin_lock cgroup: Remove redundant rcu_read_lock/unlock() in spin_lock ... commit 3f20f98e2a542fba932d374253b7c81c0f0957e9 Author: Ian Rogers Date: Thu Sep 25 10:27:36 2025 -0700 perf vendor events intel: Update sierraforest events to v1.12 Update sierraforest events to v1.12 released in: https://github.com/intel/perfmon/commit/8279984b0b2eef35412c0281983ef59ae74f19ed Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 0c32e2748c2968d51ab735e5ea19d867c7019828 Author: Ian Rogers Date: Thu Sep 25 10:27:35 2025 -0700 perf vendor events intel: Update sapphirerapids events to v1.35 Update sapphirerapids events to v1.35 released in: https://github.com/intel/perfmon/commit/94ed947d7b5966e50a685118f69e8942976ec397 https://github.com/intel/perfmon/commit/9d993957a2a8fc1d4f843013c979a413141e9839 Also adds cpu_cstate_c0 and cpu_cstate_c6 metrics. Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit dd171167f220d01331b40b1c6c1cff820e861cf2 Author: Ian Rogers Date: Thu Sep 25 10:27:34 2025 -0700 perf vendor events intel: Update pantherlake events to v1.00 Update pantherlake events to v1.00 released in: https://github.com/intel/perfmon/commit/b149786b6f9db18c09e6c89f3eb4fdb849ead2cf Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 53366556aab277688b325994953ca0e91e4c7120 Author: Ian Rogers Date: Thu Sep 25 10:27:33 2025 -0700 perf vendor events intel: Update meteorlake events to v1.17 Update lunarlake events to v1.17 released in: https://github.com/intel/perfmon/commit/ec387ac70602283d01da32c2ff5fe9cb15d3d25b Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit b4e77a135c039a37b6b15d443b32885508a30ebe Author: Ian Rogers Date: Thu Sep 25 10:27:32 2025 -0700 perf vendor events intel: Update lunarlake events to v1.18 Update lunarlake events to v1.18 released in: https://github.com/intel/perfmon/commit/04e11e566618d781b854f526d7e394ed50420638 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 399464cc90aac5ddde00b4da6ed68f971978b78f Author: Ian Rogers Date: Thu Sep 25 10:27:31 2025 -0700 perf vendor events intel: Update graniterapids events to v1.15 Update graniterapids events to v1.15 released in: https://github.com/intel/perfmon/commit/8af960a34864d291ad5a5a9f8fdf5a40486b78a1 https://github.com/intel/perfmon/commit/943667ba5b3f3203e47aede6bc7d017a26b89a26 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 3c393a11695cf62faca423e7e4b4b70057f4cd8d Author: Ian Rogers Date: Thu Sep 25 10:27:30 2025 -0700 perf vendor events intel: Update grandridge events to v1.10 Update grandridge events to v1.10 released in: https://github.com/intel/perfmon/commit/c3028836415b8b5d31b8439eefc087492148c19f Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 26bc991c8a95c72db37656d844c82f7f3dcfcfb1 Author: Ian Rogers Date: Thu Sep 25 10:27:29 2025 -0700 perf vendor events intel: Update emeraldrapids events to v1.20 Update emeraldrapids events to v1.20 released in: https://github.com/intel/perfmon/commit/868b433955f3e94126420ee9374b9e0a6ce2d83e https://github.com/intel/perfmon/commit/43681e2817a960d06c5b8870cc6d3e5b7b6feeb9 Also adds cpu_cstate_c0 and cpu_cstate_c6 metrics. Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit d41129fe5476664e927ca9e8825e39138f269d18 Author: Ian Rogers Date: Thu Sep 25 10:27:28 2025 -0700 perf vendor events intel: Update arrowlake events to v1.13 Update arrowlake events to v1.13 released in: https://github.com/intel/perfmon/commit/718cdcec8b9637819af5e9eff8f705f731b0f971 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 76619e81a8f83c266ab454f11c32725881c955c4 Author: Ian Rogers Date: Thu Sep 25 10:27:27 2025 -0700 perf vendor events intel: Update alderlake events to v1.34 Update alderlake events to v1.34 released in: https://github.com/intel/perfmon/commit/80b773ebcf601b0e48e31f2184ffef933c4d842e Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit aacaf65bb11598669f8bfff413c63eaf7bcbb6f1 Author: Arnaldo Carvalho de Melo Date: Fri Sep 19 18:02:23 2025 -0300 perf bpf: Check libbpf version to use btf_dump_type_data_opts.emit_strings When building perf with LIBBPF_DYNAMIC=1 on a fedora system with libbpf-devel 1.5 I it was breaking with: util/bpf-event.c: In function ‘format_btf_variable’: util/bpf-event.c:291:18: error: ‘const struct btf_dump_type_data_opts’ has no member named ‘emit_strings’ 291 | .emit_strings = 1, | ^~~~~~~~~~~~ util/bpf-event.c:291:33: error: initialized field overwritten [-Werror=override-init] 291 | .emit_strings = 1, | ^ util/bpf-event.c:291:33: note: (near initialization for ‘opts.skip_names’) Check the version before using that feature. Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Signed-off-by: Arnaldo Carvalho de Melo commit 5a022bf88fb0f4edde14b1f6f9029d96bffbf3e6 Author: Arnaldo Carvalho de Melo Date: Fri Sep 19 17:59:25 2025 -0300 perf bpf: Move the LIBBPF_CURRENT_VERSION_GEQ macro to bpf-utils.h We need it to fix some other libbpf version dependent issues when building with LIBBPF_DYNAMIC=1. Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Signed-off-by: Arnaldo Carvalho de Melo commit 77fc3f6696554a10cf7557c89bb3f1892ec29559 Merge: a23cd25baed231 0950c64ae38661 Author: Linus Torvalds Date: Tue Sep 30 09:31:09 2025 -0700 Merge tag 'wq-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - WQ_PERCPU was added to remaining alloc_workqueue() users and system_wq usage was replaced with system_percpu_wq and system_unbound_wq with system_dfl_wq. These are equivalent conversions with no functional changes, preparing for switching default to unbound workqueues from percpu. - A handshake mechanism was added for canceling BH workers to avoid live lock scenarios under PREEMPT_RT. - Unnecessary rcu_read_lock/unlock() calls were dropped in wq_watchdog_timer_fn() and workqueue_congested(). - Documentation was fixed to resolve texinfodocs warnings. * tag 'wq-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix texinfodocs warning for WQ_* flags reference workqueue: WQ_PERCPU added to alloc_workqueue users workqueue: replace use of system_wq with system_percpu_wq workqueue: replace use of system_unbound_wq with system_dfl_wq workqueue: Provide a handshake for canceling BH workers workqueue: Remove rcu_read_lock/unlock() in wq_watchdog_timer_fn() workqueue: Remove redundant rcu_read_lock/unlock() in workqueue_congested() commit 3a0f56d72a7575f03187a85b7869c76a862b40ab Author: Ian Rogers Date: Fri Aug 29 22:35:49 2025 -0700 perf bpf-filter: Fix opts declaration on older libbpfs Building perf with LIBBPF_DYNAMIC (ie not the default static linking of libbpf with perf) is breaking as the libbpf isn't version 1.7 or newer, where dont_enable is added to bpf_perf_event_opts. To avoid this breakage add a compile time version check and don't declare the variable when not present. Fixes: 5e2ac8e8571df54d ("perf bpf-filter: Enable events manually") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: bpf@vger.kernel.org Cc: Hao Ge Cc: Ilya Leoshkevich Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Richter Signed-off-by: Arnaldo Carvalho de Melo commit a23cd25baed2316e50597f8b67192bdc904f955b Merge: 76f01a4f22c465 df10932ad740ba Author: Linus Torvalds Date: Tue Sep 30 09:05:07 2025 -0700 Merge tag 'sched_ext-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - Code organization cleanup. Separate internal types and accessors to ext_internal.h to reduce the size of ext.c and improve maintainability. - Prepare for cgroup sub-scheduler support by adding @sch parameter to various functions and helpers, reorganizing scheduler instance handling, and dropping obsolete helpers like scx_kf_exit() and kf_cpu_valid(). - Add new scx_bpf_cpu_curr() and scx_bpf_locked_rq() BPF helpers to provide safer access patterns with proper RCU protection. scx_bpf_cpu_rq() is deprecated with warnings due to potential race conditions. - Improve debugging with migration-disabled counter in error state dumps, SCX_EFLAG_INITIALIZED flag, bitfields for warning flags, and other enhancements to help diagnose issues. - Use cgroup_lock/unlock() for cgroup synchronization instead of scx_cgroup_rwsem based synchronization. This is simpler and allows enable/disable paths to synchronize against cgroup changes independent of the CPU controller. - rhashtable_lookup() replacement to avoid redundant RCU locking was reverted due to RCU usage warnings. Will be redone once rhashtable is updated to use rcu_dereference_all(). - Other misc updates and fixes including bypass handling improvements, scx_task_iter_relock() improvements, tools/sched_ext updates, and compatibility helpers. * tag 'sched_ext-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (28 commits) Revert "sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast()" sched_ext: Misc updates around scx_sched instance pointer sched_ext: Drop scx_kf_exit() and scx_kf_error() sched_ext: Add the @sch parameter to scx_dsq_insert_preamble/commit() sched_ext: Drop kf_cpu_valid() sched_ext: Add the @sch parameter to ext_idle helpers sched_ext: Add the @sch parameter to __bstr_format() sched_ext: Separate out scx_kick_cpu() and add @sch to it tools/sched_ext: scx_qmap: Make debug output quieter by default sched_ext: Make qmap dump operation non-destructive sched_ext: Add SCX_EFLAG_INITIALIZED to indicate successful ops.init() sched_ext: Use bitfields for boolean warning flags sched_ext: Fix stray scx_root usage in task_can_run_on_remote_rq() sched_ext: Improve SCX_KF_DISPATCH comment sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast() sched_ext: Verify RCU protection in scx_bpf_cpu_curr() sched_ext: Add migration-disabled counter to error state dump sched_ext: Fix NULL dereference in scx_bpf_cpu_rq() warning tools/sched_ext: Add compat helper for scx_bpf_cpu_curr() sched_ext: deprecation warn for scx_bpf_cpu_rq() ... commit 76f01a4f22c465bdb63ee19aaf5b682c5893ba96 Merge: 57bc683896c55f 54d94c422fed95 Author: Linus Torvalds Date: Tue Sep 30 08:48:29 2025 -0700 Merge tag 'lsm-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Move the management of the LSM BPF security blobs into the framework In order to enable multiple LSMs we need to allocate and free the various security blobs in the LSM framework and not the individual LSMs as they would end up stepping all over each other. - Leverage the lsm_bdev_alloc() helper in lsm_bdev_alloc() Make better use of our existing helper functions to reduce some code duplication. - Update the Rust cred code to use 'sync::aref' Part of a larger effort to move the Rust code over to the 'sync' module. - Make CONFIG_LSM dependent on CONFIG_SECURITY As the CONFIG_LSM Kconfig setting is an ordered list of the LSMs to enable a boot, it obviously doesn't make much sense to enable this when CONFIG_SECURITY is disabled. - Update the LSM and CREDENTIALS sections in MAINTAINERS with Rusty bits Add the Rust helper files to the associated LSM and CREDENTIALS entries int the MAINTAINERS file. We're trying to improve the communication between the two groups and making sure we're all aware of what is going on via cross-posting to the relevant lists is a good way to start. * tag 'lsm-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: CONFIG_LSM can depend on CONFIG_SECURITY MAINTAINERS: add the associated Rust helper to the CREDENTIALS section MAINTAINERS: add the associated Rust helper to the LSM section rust,cred: update AlwaysRefCounted import to sync::aref security: use umax() to improve code lsm,selinux: Add LSM blob support for BPF objects lsm: use lsm_blob_alloc() in lsm_bdev_alloc() commit 57bc683896c55ff348e1a592175e76f9478035d6 Merge: 56a0810d8ca406 68e1e908cb7682 Author: Linus Torvalds Date: Tue Sep 30 08:30:32 2025 -0700 Merge tag 'selinux-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Support per-file labeling for functionfs Both genfscon and user defined labeling methods are supported. This should help users who want to provide separation between the control endpoint file, "ep0", and other endpoints. - Remove our use of get_zeroed_page() in sel_read_bool() Update sel_read_bool() to use a four byte stack buffer instead of a memory page fetched via get_zeroed_page(), and fix a memory in the process. Needless to say we should have done this a long time ago, but it was in a very old chunk of code that "just worked" and I don't think anyone had taken a real look at it in many years. - Better use of the netdev skb/sock helper functions Convert a sk_to_full_sk(skb->sk) into a skb_to_full_sk(skb) call. - Remove some old, dead, and/or redundant code * tag 'selinux-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: enable per-file labeling for functionfs selinux: fix sel_read_bool() allocation and error handling selinux: Remove redundant __GFP_NOWARN selinux: use a consistent method to get full socket from skb selinux: Remove unused function selinux_policycap_netif_wildcard() commit 03faea8466713f04a522c52c386124755be960bc Author: Gopi Krishna Menon Date: Mon Sep 29 22:01:38 2025 +0530 selftests/net: add tcp_port_share to .gitignore Add the tcp_port_share test binary to .gitignore to avoid accidentally staging the build artifact. Signed-off-by: Gopi Krishna Menon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250929163140.122383-1-krishnagopi487@gmail.com Signed-off-by: Jakub Kicinski commit adefb2ccea1e96b452cbbc39150bc0ccf1688b99 Author: Melissa Wen Date: Tue Sep 16 14:18:28 2025 -0300 drm/v3d: create a dedicated lock for dma fence Don't mix dma fence lock with the active_job lock. Use fence_lock to protect the dma fence used by drm scheduler when signalling a job completion and queue_lock to protect concurrent access to active bin job in OOM and stats collection for a given file priv. The issue was uncovered when PREEMPT_RT on with a system freeze when opening multiple Chromium tabs on Raspberry Pi 5. Link: https://github.com/raspberrypi/linux/issues/7035 Fixes: fa6a20c87470 ("drm/v3d: Address race-condition between per-fd GPU stats and fd release") Signed-off-by: Melissa Wen Acked-by: Iago Toral Quiroga Reviewed-by: Maíra Canal Signed-off-by: Melissa Wen Link: https://lore.kernel.org/r/20250916172022.2779837-1-mwen@igalia.com commit 56a0810d8ca406648fe01ec996ade1d61bf8ec8d Merge: f3827213abae92 d2c773159327f4 Author: Linus Torvalds Date: Tue Sep 30 08:22:16 2025 -0700 Merge tag 'audit-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Proper audit support for multiple LSMs As the audit subsystem predated the work to enable multiple LSMs, some additional work was needed to support logging the different LSM labels for the subjects/tasks and objects on the system. Casey's patches add new auxillary records for subjects and objects that convey the additional labels. - Ensure fanotify audit events are always generated Generally speaking security relevant subsystems always generate audit events, unless explicitly ignored. However, up to this point fanotify events had been ignored by default, but starting with this pull request fanotify follows convention and generates audit events by default. - Replace an instance of strcpy() with strscpy() - Minor indentation, style, and comment fixes * tag 'audit-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix skb leak when audit rate limit is exceeded audit: init ab->skb_list earlier in audit_buffer_alloc() audit: add record for multiple object contexts audit: add record for multiple task security contexts lsm: security_lsmblob_to_secctx module selection audit: create audit_stamp structure audit: add a missing tab audit: record fanotify event regardless of presence of rules audit: fix typo in auditfilter.c comment audit: Replace deprecated strcpy() with strscpy() audit: fix indentation in audit_log_exit() commit f3827213abae9291b7525b05e6fd29b1f0536ce6 Merge: 30d4efb2f5a515 45c222468d3320 Author: Linus Torvalds Date: Tue Sep 30 08:14:49 2025 -0700 Merge tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "There are no new features, the changes are in the core code, notably tree-log error handling and reporting improvements, and initial support for block size > page size. Performance improvements: - search data checksums in the commit root (previous transaction) to avoid locking contention, this improves parallelism of read heavy/low write workloads, and also reduces transaction commit time; on real and reproducer workload the sync time went from minutes to tens of seconds (workload and numbers are in the changelog) Core: - tree-log updates: - error handling improvements, transaction aborts - add new error state 'O' (printed in status messages) when log replay fails and is aborted - reduced number of btrfs_path allocations when traversing the tree - 'block size > page size' support - basic implementation with limitations, under experimental build - limitations: no direct io, raid56, encoded read (standalone and in send ioctl), encoded write - preparatory work for compression, removing implicit assumptions of page and block sizes - compression workspaces are now per-filesystem, we cannot assume common block size for work memory among different filesystems - tree-checker now verifies INODE_EXTREF item (which is implementing hardlinks) - tree leaf pretty printer updates, there were missing data from items, keys/items - move config option CONFIG_BTRFS_REF_VERIFY to CONFIG_BTRFS_DEBUG, it's a debugging feature and not needed to be enabled separately - more struct btrfs_path auto free updates - use ref_tracker API for tracking delayed inodes, enabled by mount option 'ref_verify', allowing to better pinpoint leaking references - in zoned mode, avoid selecting data relocation zoned for ordinary data block groups - updated and enhanced error messages - lots of cleanups and refactoring" * tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (113 commits) btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() btrfs: add unlikely annotations to branches leading to transaction abort btrfs: add unlikely annotations to branches leading to EIO btrfs: add unlikely annotations to branches leading to EUCLEAN btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions btrfs: zoned: don't fail mount needlessly due to too many active zones btrfs: use kmalloc_array() for open-coded arithmetic in kmalloc() btrfs: enable experimental bs > ps support btrfs: add extra ASSERT()s to catch unaligned bios btrfs: fix symbolic link reading when bs > ps btrfs: prepare scrub to support bs > ps cases btrfs: prepare zlib to support bs > ps cases btrfs: prepare lzo to support bs > ps cases btrfs: prepare zstd to support bs > ps cases btrfs: prepare compression folio alloc/free for bs > ps cases btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() btrfs: remove pointless key offset setup in create_pending_snapshot() btrfs: annotate btrfs_is_testing() as unlikely and make it return bool btrfs: make the rule checking more readable for should_cow_block() btrfs: simplify inline extent end calculation at replay_one_extent() ... commit cd3770675874ae72e4d26dd34f4e02dfc7ed8067 Merge: 6a88bb252b66b4 0b1fca9dce44d0 Author: Benjamin Tissoires Date: Tue Sep 30 16:58:07 2025 +0200 Merge branch 'for-6.18/intel-thc-hid' into for-linus - quicki2c: support ACPI config for advanced features: max input size and interrupt delay (Xinpeng Sun) - some more str_true_false() conversions commit 6a88bb252b66b43b5cc0828efe3e8ec3af27e57a Merge: 41a9d4fef6b284 be66a27b4f391e Author: Benjamin Tissoires Date: Tue Sep 30 16:51:38 2025 +0200 Merge branch 'for-6.18/selftests' into for-linus - update vmtest.sh (Benjamin Tissoires) commit 41a9d4fef6b284e243b000b591fadc86f5ff7da1 Merge: 8e32aa658ba59f b31e3bd7447a6e Author: Benjamin Tissoires Date: Tue Sep 30 16:50:51 2025 +0200 Merge branch 'for-6.18/uclogic' into for-linus - make use of str_true_or_false() (Liu Song) commit 8e32aa658ba59f239dc33cc32df3882b1149c8e2 Merge: a9328a16caa5f8 2910913ef87dd9 Author: Benjamin Tissoires Date: Tue Sep 30 16:48:36 2025 +0200 Merge branch 'for-6.18/steelseries' into for-linus - Make use of devm API for steelseries (Jeongjun Park) commit a9328a16caa5f8d3d3b035ef3cb440dbcac151c6 Merge: 6b7f7e43f6c4ad 8aa035a8407f6b Author: Benjamin Tissoires Date: Tue Sep 30 16:47:40 2025 +0200 Merge branch 'for-6.18/playstation' into for-linus - Add support for audio jack handling on DualSense (Cristian Ciocaltea) commit 6b7f7e43f6c4ad92beeb84b0d86d2618799472a9 Merge: 8e73e4cd021032 d927909d4d7a57 Author: Benjamin Tissoires Date: Tue Sep 30 16:46:30 2025 +0200 Merge branch 'for-6.18/pidff' into for-linus - hid-pidff improvements and fixes (Tomasz Pakuła) commit 8e73e4cd021032f45cee54efd13aef9ae7a6d697 Merge: b3f126f40016c6 b595974b4afe0e Author: Benjamin Tissoires Date: Tue Sep 30 16:45:07 2025 +0200 Merge branch 'for-6.18/asus' into for-linus - Fix Z13 folio touchpad not binding to hid-multitouch (Antheas Kapenekakis) commit b3f126f40016c6fbdcf31c8250ef359887f1dee1 Merge: b4b6bdd7fc79ab 8d0bf7908b5a65 Author: Benjamin Tissoires Date: Tue Sep 30 16:43:15 2025 +0200 Merge branch 'for-6.18/haptic' into for-linus - Implement haptic touchpad support (Angela Czubak and Jonathan Denose) commit b4b6bdd7fc79abec53da7d6d5ac0e178334ab5e8 Merge: 4965e2c75a36ae 8931f7b2799344 Author: Benjamin Tissoires Date: Tue Sep 30 16:38:06 2025 +0200 Merge branch 'for-6.18/intel-ish-ipc' into for-linus - Remove redundant ready check after timeout (Zhang Lixu) commit 4965e2c75a36ae3e38693ca956a6e36cdff3676e Merge: f6c53923e067d3 7d62beb102d6fa Author: Benjamin Tissoires Date: Tue Sep 30 16:36:47 2025 +0200 Merge branch 'for-6.18/i2c-hid' into for-linus - Resolve touchpad issues on Dell systems during S4 by invoking the _DSM on resume from hibernate (Mario Limonciello) commit f6c53923e067d3f23b14a71062ba912135aeba01 Merge: d325efac5938ef 75d5546f60b369 Author: Benjamin Tissoires Date: Tue Sep 30 16:34:33 2025 +0200 Merge branch 'for-6.18/hidraw' into for-linus - rework hidraw ioctls (Benjamin Tissoires) commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 Author: Jakub Kicinski Date: Mon Sep 29 11:15:29 2025 -0700 Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. Commit in question breaks the mapping of PGs to pools for some SKUs. Specifically multi-host NICs seem to be shipped with a custom buffer configuration which maps the lossy PG to pool 4. But the bad commit overrides this with pool 0 which does not have sufficient buffer space reserved. Resulting in ~40% packet loss. The commit also breaks BMC / OOB connection completely (100% packet loss). Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set""). The breakage is exactly the same, the only difference is that quoted commit would break the NIC immediately on boot, and the currently reverted commit only when MTU is changed. Note: "good" kernels do not restore the configuration, so downgrade isn't enough to recover machines. A NIC power cycle seems to be necessary to return to a healthy state (or overriding the relevant registers using a custom patch). Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") Signed-off-by: Jakub Kicinski Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit d325efac5938efa3c2a25df72a1bd1af16cd0ed8 Merge: bba920e6f80313 d1dd75c6500c74 Author: Benjamin Tissoires Date: Tue Sep 30 16:31:10 2025 +0200 Merge branch 'for-6.18/core' into for-linus - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin Tissoires) - Change hid_driver to use a const char* for .name (Rahul Rameshbabu) commit 11f6bce77e27e82015a0d044e6c1eec8b139831a Author: Thorsten Blum Date: Thu Sep 18 17:08:10 2025 +0200 fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to simplify and improve orangefs_debug_write(). Allocate only 'count' bytes instead of the maximum size ORANGEFS_MAX_DEBUG_STRING_LEN, and set 'buf' to NULL to ensure kfree(buf) still works. No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Mike Marshall commit 025e880759c279ec64d0f754fe65bf45961da864 Author: Mike Marshall Date: Mon Sep 15 17:40:46 2025 -0400 orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper `xattr_key()` uses the pointer variable in the loop condition > rather than dereferencing it. As `key` is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate on > valid C strings and will walk memory indefinitely, consuming CPU or hanging > the thread. I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on. After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed. I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture. Signed-off-by: Mike Marshall Reported-by: Stanislav Fort of Aisle Research commit 3dffadfa99f7ba2e9bee69d1e0bb42fd2d2d6022 Author: Zhen Ni Date: Mon Sep 1 10:58:18 2025 +0800 orangefs: Remove unused type in macro fill_default_sys_attrs Remove the unused type parameter from the macro definition and all its callers, making the interface consistent with its actual usage. Fixes: 69a23de2f3de ("orangefs: clean up fill_default_sys_attrs") Signed-off-by: Zhen Ni Signed-off-by: Mike Marshall commit 5deafa27d9ae040b75d392f60b12e300b42b4792 Author: Gautam Gala Date: Wed Sep 24 13:26:44 2025 +0200 KVM: s390: Fix to clear PTE when discarding a swapped page KVM run fails when guests with 'cmm' cpu feature and host are under memory pressure and use swap heavily. This is because npages becomes ENOMEN (out of memory) in hva_to_pfn_slow() which inturn propagates as EFAULT to qemu. Clearing the page table entry when discarding an address that maps to a swap entry resolves the issue. Fixes: 200197908dc4 ("KVM: s390: Refactor and split some gmap helpers") Cc: stable@vger.kernel.org Suggested-by: Claudio Imbrenda Signed-off-by: Gautam Gala Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit c18b0f5af42f8f98d4d629e578608188c0ce4652 Merge: 2c0592bd5cadfc 5628f3fe3b1611 Author: Paolo Abeni Date: Tue Sep 30 15:45:54 2025 +0200 Merge branch 'net-lockless-skb_attempt_defer_free' Eric Dumazet says: ==================== net: lockless skb_attempt_defer_free() Platforms with many cpus and relatively slow inter connect show a significant spinlock contention in skb_attempt_defer_free(). This series refactors this infrastructure to be NUMA aware, and lockless. Tested on various platforms, including AMD Zen 2/3/4 and Intel Granite Rapids, showing significant cost reductions under network stress (more than 20 Mpps). ==================== Link: https://patch.msgid.link/20250928084934.3266948-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 5628f3fe3b16114e8424bbfcf0594caef8958a06 Author: Eric Dumazet Date: Sun Sep 28 08:49:34 2025 +0000 net: add NUMA awareness to skb_attempt_defer_free() Instead of sharing sd->defer_list & sd->defer_count with many cpus, add one pair for each NUMA node. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-4-edumazet@google.com Signed-off-by: Paolo Abeni commit 844c9db7f7f5fe1b0b53ed9f1c2bc7313b3021c8 Author: Eric Dumazet Date: Sun Sep 28 08:49:33 2025 +0000 net: use llist for sd->defer_list Get rid of sd->defer_lock and adopt llist operations. We optimize skb_attempt_defer_free() for the common case, where the packet is queued. Otherwise sd->defer_count is increasing, until skb_defer_free_flush() clears it. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-3-edumazet@google.com Signed-off-by: Paolo Abeni commit 9c94ae6bb0b2895024b6e29fcc1cbec968b4776a Author: Eric Dumazet Date: Sun Sep 28 08:49:32 2025 +0000 net: make softnet_data.defer_count an atomic This is preparation work to remove the softnet_data.defer_lock, as it is contended on hosts with large number of cores. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-2-edumazet@google.com Signed-off-by: Paolo Abeni commit 2c0592bd5cadfcd5337eafa07e3145a097cfd880 Merge: 9ebef94cf67967 b3820e0e6c1251 Author: Paolo Abeni Date: Tue Sep 30 15:17:23 2025 +0200 Merge branch 'psp-add-a-kselftest-suite-and-netdevsim-implementation' Jakub Kicinski says: ==================== psp: add a kselftest suite and netdevsim implementation Add a basic test suite for drivers that support PSP. Also, add a PSP implementation in the netdevsim driver. The netdevsim implementation does encapsulation and decapsulation of PSP packets, but no crypto. The tests cover the basic usage of the uapi, and demonstrate key exchange and connection setup. The tests and netdevsim support IPv4 and IPv6. Here is an example run on a system with a CX7 NIC. TAP version 13 1..28 ok 1 psp.data_basic_send_v0_ip4 ok 2 psp.data_basic_send_v0_ip6 ok 3 psp.data_basic_send_v1_ip4 ok 4 psp.data_basic_send_v1_ip6 ok 5 psp.data_basic_send_v2_ip4 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-128') ok 6 psp.data_basic_send_v2_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-128') ok 7 psp.data_basic_send_v3_ip4 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-256') ok 8 psp.data_basic_send_v3_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-256') ok 9 psp.data_mss_adjust_ip4 ok 10 psp.data_mss_adjust_ip6 ok 11 psp.dev_list_devices ok 12 psp.dev_get_device ok 13 psp.dev_get_device_bad ok 14 psp.dev_rotate ok 15 psp.dev_rotate_spi ok 16 psp.assoc_basic ok 17 psp.assoc_bad_dev ok 18 psp.assoc_sk_only_conn ok 19 psp.assoc_sk_only_mismatch ok 20 psp.assoc_sk_only_mismatch_tx ok 21 psp.assoc_sk_only_unconn ok 22 psp.assoc_version_mismatch ok 23 psp.assoc_twice ok 24 psp.data_send_bad_key ok 25 psp.data_send_disconnect ok 26 psp.data_stale_key ok 27 psp.removal_device_rx # XFAIL Test only works on netdevsim ok 28 psp.removal_device_bi # XFAIL Test only works on netdevsim # Totals: pass:22 fail:0 xfail:2 xpass:0 skip:4 error:0 # # Responder logs (0): # STDERR: # Set PSP enable on device 1 to 0x3 # Set PSP enable on device 1 to 0x0 v2: https://lore.kernel.org/20250925211647.3450332-1-daniel.zahka@gmail.com v1: https://lore.kernel.org/20250924194959.2845473-1-daniel.zahka@gmail.com ==================== Link: https://patch.msgid.link/20250927225420.1443468-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit b3820e0e6c1251689318dcc831b7a07403fd923c Author: Jakub Kicinski Date: Sat Sep 27 15:54:20 2025 -0700 selftests: drv-net: psp: add tests for destroying devices Add tests for making sure device can disappear while associations exist. This is netdevsim-only since destroying real devices is more tricky. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-9-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 81236c74dba6f4966d76c471ef4434846c2fc05c Author: Jakub Kicinski Date: Sat Sep 27 15:54:19 2025 -0700 selftests: drv-net: psp: add test for auto-adjusting TCP MSS Test TCP MSS getting auto-adjusted. PSP adds an encapsulation overhead of 40B per packet, when used in transport mode without any virtualization cookie or other optional PSP header fields. The kernel should adjust the MSS for a connection after PSP tx state is reached. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-8-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2748087cf12d800db142eaefd2b0f4eccee8c943 Author: Jakub Kicinski Date: Sat Sep 27 15:54:18 2025 -0700 selftests: drv-net: psp: add connection breaking tests Add test checking conditions which lead to connections breaking. Using bad key or connection gets stuck if device key is rotated twice. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-7-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 81b89085319b2b20426d8c9468d8c508dcefdaaf Author: Jakub Kicinski Date: Sat Sep 27 15:54:17 2025 -0700 selftests: drv-net: psp: add association tests Add tests for exercising PSP associations for TCP sockets. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-6-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 8f90dc6e417a64144d06405ee0404965139c825a Author: Jakub Kicinski Date: Sat Sep 27 15:54:16 2025 -0700 selftests: drv-net: psp: add basic data transfer and key rotation tests Add basic tests for sending data over PSP and making sure that key rotation toggles the MSB of the spi. Deploy PSP responder on the remote end. We also need a healthy dose of common helpers for setting up the connections, assertions and interrogating socket state on the Python side. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-5-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2aeb71b2f9e864d3e4ff76bc93ab8cb1b6d56ced Author: Jakub Kicinski Date: Sat Sep 27 15:54:15 2025 -0700 selftests: drv-net: add PSP responder PSP tests need the remote system to support PSP, and some PSP capable application to exchange data with. Create a simple PSP responder app which we can build and deploy to the remote host. The tests themselves can be written in Python but for ease of deploying the responder is in C (using C YNL). Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-4-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 8a5f956a9fb7d74fff681145082acfad5afa6bb8 Author: Jakub Kicinski Date: Sat Sep 27 15:54:14 2025 -0700 selftests: drv-net: base device access API test Simple PSP test to getting info about PSP devices. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-3-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit f857478d62066ee94831a5e0679fc18c246cd534 Author: Jakub Kicinski Date: Sat Sep 27 15:54:13 2025 -0700 netdevsim: a basic test PSP implementation Provide a PSP implementation for netdevsim. Use psp_dev_encapsulate() and psp_dev_rcv() to do actual encapsulation and decapsulation on skbs, but perform no encryption or decryption. In order to make encryption with a bad key result in a drop on the peer's rx side, we stash our psd's generation number in the first byte of each key before handing to the peer. Signed-off-by: Jakub Kicinski Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-2-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2a918911ed3d0841923525ed0fe707762ee78844 Author: Guixin Liu Date: Thu Sep 25 13:47:30 2025 +0800 iommufd: Register iommufd mock devices with fwspec Since the bus ops were retired the iommu subsystem changed to using fwspec to match the iommu driver to the iommu device. If a device has a NULL fwspec then it is matched to the first iommu driver with a NULL fwspec, effectively disabling support for systems with more than one non-fwspec iommu driver. Thus, if the iommufd selfest are run in an x86 system that registers a non-fwspec iommu driver they fail to bind their mock devices to the mock iommu driver. Fix this by allocating a software fwnode for mock iommu driver's iommu_device, and set it to the device which mock iommu driver created. This is done by adding a new helper iommu_mock_device_add() which abuses the internals of the fwspec system to establish a fwspec before the device is added and is careful not to leak it. A matching dummy fwspec is automatically added to the mock iommu driver. Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests": PASSED: 229 / 229 tests passed. In addition, this issue is also can be found on amd platform, and also tested on a amd machine. Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com Fixes: 17de3f5fdd35 ("iommu: Retire bus ops") Signed-off-by: Guixin Liu Reviewed-by: Lu Baolu Tested-by: Qinyun Tan Signed-off-by: Jason Gunthorpe commit 74662f9f92b67c0ca55139c5aa392da0f0a26c08 Author: Steven 'Steve' Kendall Date: Mon Sep 29 21:33:34 2025 +0000 ALSA: hda/hdmi: Add pin fix for HP ProDesk model The HP ProDesk 400 (SSID 103c:83f3) also needs a quirk for enabling HDMI outputs. This patch adds the required quirk entry. Signed-off-by: Steven 'Steve' Kendall Cc: Signed-off-by: Takashi Iwai commit 9ebef94cf67967fd739eb90289b5b2c7774bd551 Author: Heiner Kallweit Date: Sat Sep 27 22:23:19 2025 +0200 net: sfp: improve poll interval handling The poll interval is a fixed value, so we don't need a static variable for it. The change also allows to use standard macro module_platform_driver, avoiding some boilerplate code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/b8079f96-6865-431c-a908-a0b9e9bd5379@gmail.com Signed-off-by: Paolo Abeni commit df7dcf5ebf347fd9d59ce2ccf40dd48b2d106144 Author: Heiner Kallweit Date: Sat Sep 27 22:03:35 2025 +0200 net: sfp: don't include swphy.h Nothing from swphy.h is used here, so don't include it. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/19921899-f0a8-4752-a897-1b6d62ade6eb@gmail.com Signed-off-by: Paolo Abeni commit 49ac3d7826936b30eaa5dbe1bec6dad58f7d2476 Author: Heiner Kallweit Date: Sat Sep 27 21:57:07 2025 +0200 net: phy: annotate linkmode initializers as not used after init phase Code and data used from phy_init() only, can be annotated accordingly. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/5fb9c41b-bf44-4915-a3c3-f20952fce6de@gmail.com Signed-off-by: Paolo Abeni commit e211c463b748c4e2e8364c10bc216ca775fcc943 Author: Heiner Kallweit Date: Sat Sep 27 21:52:30 2025 +0200 net: phy: stop exporting phy_driver_unregister After 42e2a9e11a1d ("net: phy: dp83640: improve phydev and driver removal handling") we can stop exporting also phy_driver_unregister(). Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/2bab950e-4b70-4030-b997-03f48379586f@gmail.com Signed-off-by: Paolo Abeni commit a1b501a8c6a87c9265fd03bd004035199e2e8128 Author: Dragos Tatulea Date: Fri Sep 26 16:16:05 2025 +0300 page_pool: Clamp pool size to max 16K pages page_pool_init() returns E2BIG when the page_pool size goes above 32K pages. As some drivers are configuring the page_pool size according to the MTU and ring size, there are cases where this limit is exceeded and the queue creation fails. The page_pool size doesn't have to cover a full queue, especially for larger ring size. So clamp the size instead of returning an error. Do this in the core to avoid having each driver do the clamping. The current limit was deemed to high [1] so it was reduced to 16K to avoid page waste. [1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/ Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com Signed-off-by: Paolo Abeni commit 2ade91705b596b7b6b7de84c0ca59eced7acd1f6 Author: Dmitry Antipov Date: Fri Sep 26 10:41:13 2025 +0300 tipc: adjust tipc_nodeid2string() to return string length Since the value returned by 'tipc_nodeid2string()' is not used, the function may be adjusted to return the length of the result, which is helpful to drop a few calls to 'strlen()' in 'tipc_link_create()' and 'tipc_link_bc_create()'. Compile tested only. Signed-off-by: Dmitry Antipov Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250926074113.914399-1-dmantipov@yandex.ru Signed-off-by: Paolo Abeni commit 2aff4420efc2910e905ee5b000e04e87422aebc4 Author: Wei Fang Date: Fri Sep 26 09:39:53 2025 +0800 net: enetc: initialize SW PIR and CIR based HW PIR and CIR values Software can only initialize the PIR and CIR of the command BD ring after a FLR, and these two registers can only be set to 0. But the reset values of these two registers are 0, so software does not need to update them. If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or other values by software will cause the command BD ring to work abnormally. This is because of an internal context in the ring prefetch logic that will retain the state from the first incarnation of the ring and continue prefetching from the stale location when the ring is reinitialized. The internal context can only be reset by the FLR. In addition, there is a logic error in the implementation, next_to_clean indicates the software CIR and next_to_use indicates the software PIR. But the current driver uses next_to_clean to set PIR and use next_to_use to set CIR. This does not cause a problem in actual use, because the current command BD ring is only initialized after FLR, and the initial values of next_to_use and next_to_clean are both 0. Therefore, this patch removes the initialization of PIR and CIR. Instead, next_to_use and next_to_clean are initialized by reading the values of PIR and CIR. Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 Author: Deepak Sharma Date: Thu Sep 25 18:58:46 2025 +0530 net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers). Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Tested-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepak Sharma Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250925132846.213425-1-deepak.sharma.472935@gmail.com Signed-off-by: Paolo Abeni commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 Author: Qingfang Deng Date: Thu Sep 25 13:10:59 2025 +0800 6pack: drop redundant locking and refcounting The TTY layer already serializes line discipline operations with tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack are unnecessary. Removing them simplifies the code and also resolves a lockdep warning reported by syzbot. The warning did not indicate a real deadlock, since the write-side lock was only taken in process context with hardirqs disabled. Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/ Signed-off-by: Qingfang Deng Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 99e4c35eada98d5959e61e7d3e049f64b2f0e4e1 Author: Hangbin Liu Date: Thu Sep 25 02:33:04 2025 +0000 selftests: bonding: add ipsec offload test This introduces a test for IPSec offload over bonding, utilizing netdevsim for the testing process, as veth interfaces do not support IPSec offload. The test will ensure that the IPSec offload functionality remains operational even after a failover event occurs in the bonding configuration. Here is the test result: TEST: bond_ipsec_offload (active_slave eth0) [ OK ] TEST: bond_ipsec_offload (active_slave eth1) [ OK ] Reviewed-by: Petr Machata Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250925023304.472186-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 5b66169f6be4847008c0aea50885ff0632151479 Author: Hangbin Liu Date: Thu Sep 25 02:33:03 2025 +0000 bonding: fix xfrm offload feature setup on active-backup mode The active-backup bonding mode supports XFRM ESP offload. However, when a bond is added using command like `ip link add bond0 type bond mode 1 miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is disabled. This occurs because, in bond_newlink(), we change bond link first and register bond device later. So the XFRM feature update in bond_option_mode_set() is not called as the bond device is not yet registered, leading to the offload feature not being set successfully. To resolve this issue, we can modify the code order in bond_newlink() to ensure that the bond device is registered first before changing the bond link parameters. This change will allow the XFRM ESP offload feature to be correctly enabled. Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 7bd80ed89d72285515db673803b021469ba71ee8 Author: Oleksij Rempel Date: Wed Sep 24 14:02:41 2025 +0200 Documentation: net: add flow control guide and document ethtool API Introduce a new document, flow_control.rst, to provide a comprehensive guide on Ethernet Flow Control in Linux. The guide explains how flow control works, how autonegotiation resolves pause capabilities, and how to configure it using ethtool and Netlink. In parallel, document the pause and pause-stat attributes in the ethtool.yaml netlink spec. This enables the ynl tool to generate kernel-doc comments for the corresponding enums in the UAPI header, making the C interface self-documenting. Finally, replace the legacy flow control section in phy.rst with a reference to the new document and add pointers in the relevant C source files. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250924120241.724850-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit d01579d590f72d2d91405b708e96f6169f24775a Author: Ethan Ferguson Date: Tue Sep 30 13:49:00 2025 +0900 exfat: Add support for FS_IOC_{GET,SET}FSLABEL Add support for reading / writing to the exfat volume label from the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls Co-developed-by: Yuezhang Mo Signed-off-by: Yuezhang Mo Signed-off-by: Ethan Ferguson Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 29c063658d532dfad22d4ef8aea9a494037ceab1 Author: Sang-Heon Jeon Date: Sat Sep 27 00:35:22 2025 +0900 exfat: combine iocharset and utf8 option setup Currently, exfat utf8 mount option depends on the iocharset option value. After exfat remount, utf8 option may become inconsistent with iocharset option. If the options are inconsistent; (specifically, iocharset=utf8 but utf8=0) readdir may reference uninitalized NLS, leading to a null pointer dereference. Extract and combine utf8/iocharset setup logic into exfat_set_iocharset(). Then Replace iocharset setup logic to exfat_set_iocharset to prevent utf8/iocharset option inconsistentcy after remount. Reported-by: syzbot+3e9cb93e3c5f90d28e19@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3e9cb93e3c5f90d28e19 Signed-off-by: Sang-Heon Jeon Fixes: acab02ffcd6b ("exfat: support modifying mount options via remount") Tested-by: syzbot+3e9cb93e3c5f90d28e19@syzkaller.appspotmail.com Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit e6fd5d3a431708df8f43d970bd3ba8a70a034fd5 Author: Yuezhang Mo Date: Thu Sep 11 16:54:31 2025 +0800 exfat: support modifying mount options via remount Before this commit, all exfat-defined mount options could not be modified dynamically via remount, and no error was returned. After this commit, these three exfat-defined mount options (discard, zero_size_dir, and errors) can be modified dynamically via remount. While other exfat-defined mount options cannot be modified dynamically via remount because their old settings are cached in inodes or dentries, modifying them will be rejected with an error. Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 9fd688678dd86e3be32a35e3b2c5cc3ef0c4e257 Author: Namjae Jeon Date: Sat Sep 6 08:13:04 2025 +0900 exfat: optimize allocation bitmap loading time Loading the allocation bitmap is very slow if user set the small cluster size on large partition. For optimizing it, This patch uses sb_breadahead() read the allocation bitmap. It will improve the mount time. The following is the result of about 4TB partition(2KB cluster size) on my target. without patch: real 0m41.746s user 0m0.011s sys 0m0.000s with patch: real 0m2.525s user 0m0.008s sys 0m0.008s Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit cb8d6d4aa015a8dace68d129baf7a4d7042a667d Author: Liao Yuanhong Date: Mon Aug 25 21:35:18 2025 +0800 exfat: Remove unnecessary parentheses When using &, it's unnecessary to have parentheses afterward. Remove redundant parentheses to enhance readability. Signed-off-by: Liao Yuanhong Signed-off-by: Namjae Jeon commit 2c88607ac82d1e375e4c85577fe54e69b0be43a9 Author: Xichao Zhao Date: Mon Aug 18 17:28:15 2025 +0800 exfat: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Signed-off-by: Xichao Zhao Signed-off-by: Namjae Jeon commit 79c1587b6cda74deb0c86fc7ba194b92958c793c Author: Namjae Jeon Date: Sat Aug 30 14:44:35 2025 +0900 exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use. Reported-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com Tested-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com Reviewed-by: Yuezhang Mo Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 Author: Chi Zhiling Date: Fri Aug 15 17:32:45 2025 +0800 exfat: limit log print for IO error For exFAT filesystems with 4MB read_ahead_size, removing the storage device when the read operation is in progress, which cause the last read syscall spent 150s [1]. The main reason is that exFAT generates excessive log messages [2]. After applying this patch, approximately 300,000 lines of log messages were suppressed, and the delay of the last read() syscall was reduced to about 4 seconds. [1]: write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120> read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032> write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119> read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215> [2]: [ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 30d4efb2f5a515a60fe6b0ca85362cbebea21e2f Merge: 417552999d0b66 9d52b0b41be5b9 Author: Linus Torvalds Date: Mon Sep 29 19:42:03 2025 -0700 Merge tag 'for-linus-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix the migration of a Xen virq to another cpu plus some related cleanup work - clean up Xen-PV mode specific code, resulting in removing some of that code in the resulting binary in case CONFIG_XEN_PV is not set - fixes and cleanup for suspend handling under Xen * tag 'for-linus-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: take system_transition_mutex on suspend xen/manage: Fix suspend error path xen/events: Update virq_to_irq on migration xen/events: Return -EEXIST for bound VIRQs xen/events: Cleanup find_virq() return codes x86/xen: select HIBERNATE_CALLBACKS more directly drivers/xen/gntdev: use xen_pv_domain() instead of cached value xen: replace XENFEAT_auto_translated_physmap with xen_pv_domain() xen: rework xen_pv_domain() commit 417552999d0b6681ac30e117ae890828ca7e46b3 Merge: 9cc220a422113f ef104054a31260 Author: Linus Torvalds Date: Mon Sep 29 19:28:50 2025 -0700 Merge tag 'powerpc-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - powerpc support for BPF arena and arena atomics - Patches to switch to msi parent domain (per-device MSI domains) - Add a lock contention tracepoint in the queued spinlock slowpath - Fixes for underflow in pseries/powernv msi and pci paths - Switch from legacy-of-mm-gpiochip dependency to platform driver - Fixes for handling TLB misses - Introduce support for powerpc papr-hvpipe - Add vpa-dtl PMU driver for pseries platform - Misc fixes and cleanups Thanks to Aboorva Devarajan, Aditya Bodkhe, Andrew Donnellan, Athira Rajeev, Cédric Le Goater, Christophe Leroy, Erhard Furtner, Gautam Menghani, Geert Uytterhoeven, Haren Myneni, Hari Bathini, Joe Lawrence, Kajol Jain, Kienan Stewart, Linus Walleij, Mahesh Salgaonkar, Nam Cao, Nicolas Schier, Nysal Jan K.A., Ritesh Harjani (IBM), Ruben Wauters, Saket Kumar Bhaskar, Shashank MS, Shrikanth Hegde, Tejas Manhas, Thomas Gleixner, Thomas Huth, Thorsten Blum, Tyrel Datwyler, and Venkat Rao Bagalkote. * tag 'powerpc-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (49 commits) powerpc/pseries: Define __u{8,32} types in papr_hvpipe_hdr struct genirq/msi: Remove msi_post_free() powerpc/perf/vpa-dtl: Add documentation for VPA dispatch trace log PMU powerpc/perf/vpa-dtl: Handle the writing of perf record when aux wake up is needed powerpc/perf/vpa-dtl: Add support to capture DTL data in aux buffer powerpc/perf/vpa-dtl: Add support to setup and free aux buffer for capturing DTL data docs: ABI: sysfs-bus-event_source-devices-vpa-dtl: Document sysfs event format entries for vpa_dtl pmu powerpc/vpa_dtl: Add interface to expose vpa dtl counters via perf powerpc/time: Expose boot_tb via accessor powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure powerpc/fprobe: fix updated fprobe for function-graph tracer powerpc/ftrace: support CONFIG_FUNCTION_GRAPH_RETVAL powerpc64/modules: replace stub allocation sentinel with an explicit counter powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs powerpc/ftrace: ensure ftrace record ops are always set for NOPs powerpc/603: Really copy kernel PGD entries into all PGDIRs powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler powerpc/pseries: HVPIPE changes to support migration powerpc/pseries: Enable hvpipe with ibm,set-system-parameter RTAS powerpc/pseries: Enable HVPIPE event message interrupt ... commit 998a67b954680f26f3734040aeeed08642d49721 Author: Enzo Matsumiya Date: Thu Sep 25 12:10:33 2025 -0300 smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf() for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests) or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn't need it. Backtrace: [ 945.272081] ------------[ cut here ]------------ [ 945.272774] kernel BUG at include/linux/scatterlist.h:209! [ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 [ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [ 945.286683] Call Trace: [ 945.286952] [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [ 945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103] __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140] __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397] ? __pfx_worker_thread+0x10/0x10 [ 945.299900] kthread+0x119/0x210 [ 945.300285] ? __pfx_kthread+0x10/0x10 [ 945.300729] ret_from_fork+0x119/0x1b0 [ 945.301163] ? __pfx_kthread+0x10/0x10 [ 945.301601] ret_from_fork_asm+0x1a/0x30 [ 945.302055] Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 8e979aab34d766986f6d14f50cebf5f5dd87ab8e Author: Eric Biggers Date: Sat Sep 6 20:20:03 2025 -0700 smb: Use arc4 library instead of duplicate arc4 code fs/smb/common/cifs_arc4.c has an implementation of ARC4, but a copy of this same code is also present in lib/crypto/arc4.c to serve the other users of this legacy algorithm in the kernel. Remove the duplicate implementation in fs/smb/, which seems to have been added because of a misunderstanding, and just use the lib/crypto/ one. Signed-off-by: Eric Biggers Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 02696ac0906540715dd4a0bb86b1117a1d00da4e Author: Henrique Carvalho Date: Tue Sep 23 13:20:48 2025 -0300 smb: client: add tcon information to smb2_reconnect() debug messages smb2_reconnect() debug messages lack tcon context, making it hard to identify which tcon is reconnecting in multi-share environments. Change cifs_dbg() to cifs_tcon_dbg() to include tcon information. Closes: https://bugzilla.suse.com/show_bug.cgi?id=1234066 Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 9cc220a422113f665e13364be1411c7bba9e3e30 Merge: f1004b2f19d7e9 088bb10e372520 Author: Linus Torvalds Date: Mon Sep 29 19:14:25 2025 -0700 Merge tag 's390-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Refactor SCLP memory hotplug code - Introduce common boot_panic() decompressor helper macro and use it to get rid of nearly few identical implementations - Take into account additional key generation flags and forward it to the ep11 implementation. With that allow users to modify the key generation process, e.g. provide valid combinations of XCP_BLOB_* flags - Replace kmalloc() + copy_from_user() with memdup_user_nul() in s390 debug facility and HMC driver - Add DAX support for DCSS memory block devices - Make the compiler statement attribute "assume" available with a new __assume macro - Rework ffs() and fls() family bitops functions, including source code improvements and generated code optimizations. Use the newly introduced __assume macro for that - Enable additional network features in default configurations - Use __GFP_ACCOUNT flag for user page table allocations to add missing kmemcg accounting - Add WQ_PERCPU flag to explicitly request the use of the per-CPU workqueue for 3590 tape driver - Switch power reading to the per-CPU and the Hiperdispatch to the default workqueue - Add memory allocation profiling hooks to allow better profiling data and the /proc/allocinfo output similar to other architectures * tag 's390-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (21 commits) s390/mm: Add memory allocation profiling hooks s390: Replace use of system_wq with system_dfl_wq s390/diag324: Replace use of system_wq with system_percpu_wq s390/tape: Add WQ_PERCPU to alloc_workqueue users s390/bitops: Switch to generic ffs() if supported by compiler s390/bitops: Switch to generic fls(), fls64(), etc. s390/mm: Use __GFP_ACCOUNT for user page table allocations s390/configs: Enable additional network features s390/bitops: Cleanup __flogr() s390/bitops: Use __assume() for __flogr() inline assembly return value compiler_types: Add __assume macro s390/bitops: Limit return value range of __flogr() s390/dcssblk: Add DAX support s390/hmcdrv: Replace kmalloc() + copy_from_user() with memdup_user_nul() s390/debug: Replace kmalloc() + copy_from_user() with memdup_user_nul() s390/pkey: Forward keygenflags to ep11_unwrapkey s390/boot: Add common boot_panic() code s390/bitops: Optimize inlining s390/bitops: Slightly optimize ffs() and fls64() s390/sclp: Move memory hotplug code for better modularity ... commit f1004b2f19d7e9add9d707f64d9fcbc50f67921b Merge: cb7e3669c68366 695f2c0c25f3c8 Author: Linus Torvalds Date: Mon Sep 29 19:05:58 2025 -0700 Merge tag 'm68k-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Fix whitespace in Zorro name macros - Fix find_*_bit() signatures - defconfig updates * tag 'm68k-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.17-rc1 m68k: bitops: Fix find_*_bit() signatures zorro: Remove extra whitespace in macro definitions commit cb7e3669c683669d93139184adff68a7d9000536 Merge: feafee284579d2 0b0ca959d20689 Author: Linus Torvalds Date: Mon Sep 29 19:01:08 2025 -0700 Merge tag 'riscv-for-linus-6.18-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley - Replacement of __ASSEMBLY__ with __ASSEMBLER__ in header files (other architectures have already merged this type of cleanup) - The introduction of ioremap_wc() for RISC-V - Cleanup of the RISC-V kprobes code to use mostly-extant macros rather than open code - A RISC-V kprobes unit test - An architecture-specific endianness swap macro set implementation, leveraging some dedicated RISC-V instructions for this purpose if they are available - The ability to identity and communicate to userspace the presence of a MIPS P8700-specific ISA extension, and to leverage its MIPS-specific PAUSE implementation in cpu_relax() - Several other miscellaneous cleanups * tag 'riscv-for-linus-6.18-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits) riscv: errata: Fix the PAUSE Opcode for MIPS P8700 riscv: hwprobe: Document MIPS xmipsexectl vendor extension riscv: hwprobe: Add MIPS vendor extension probing riscv: Add xmipsexectl instructions riscv: Add xmipsexectl as a vendor extension dt-bindings: riscv: Add xmipsexectl ISA extension description riscv: cpufeature: add validation for zfa, zfh and zfhmin perf: riscv: skip empty batches in counter start selftests: riscv: Add README for RISC-V KSelfTest riscv: sbi: Switch to new sys-off handler API riscv: Move vendor errata definitions to new header RISC-V: ACPI: enable parsing the BGRT table riscv: Enable ARCH_HAVE_NMI_SAFE_CMPXCHG riscv: pi: use 'targets' instead of extra-y in Makefile riscv: introduce asm/swab.h riscv: mmap(): use unsigned offset type in riscv_sys_mmap drivers/perf: riscv: Remove redundant ternary operators riscv: mm: Use mmu-type from FDT to limit SATP mode riscv: mm: Return intended SATP mode for noXlvl options riscv: kprobes: Remove duplication of RV_EXTRACT_ITYPE_IMM ... commit c5cb31c99257aacd5cc2ff72a3b6f0c660046c9b Merge: 377ea331281f2c 9363b4837659d1 Author: Jakub Kicinski Date: Mon Sep 29 18:57:43 2025 -0700 Merge branch 'dpll-add-phase-offset-averaging-factor' Ivan Vecera says: ==================== dpll: add phase offset averaging factor For some hardware, the phase shift may result from averaging previous values and the newly measured value. In this case, the averaging is controlled by a configurable averaging factor. Add new device level attribute phase-offset-avg-factor, appropriate callbacks and implement them in zl3073x driver. ==================== Link: https://patch.msgid.link/20250927084912.2343597-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9363b4837659d1b7ee04cfa714373ce4b4b8269f Author: Ivan Vecera Date: Sat Sep 27 10:49:12 2025 +0200 dpll: zl3073x: Allow to configure phase offset averaging factor The DPLL phase measurement block uses an exponential moving average with a configurable averaging factor. Measurements are taken at approximately 40 Hz or at the reference frequency, whichever is lower. Currently, factor=2 is used to prioritize fast response for dynamic phase changes. For applications needing a stable, precise average phase offset where rapid changes are unlikely, a higher factor is recommended. Implement the .phase_offset_avg_factor_get/set callbacks to allow a user to adjust this factor. Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit e28d5a68b6519ec6b2118a3f604295b5534eeb51 Author: Ivan Vecera Date: Sat Sep 27 10:49:11 2025 +0200 dpll: add phase_offset_avg_factor_get/set callback ops Add new callback operations for a dpll device: - phase_offset_avg_factor_get(...) - to obtain current phase offset averaging factor from dpll device, - phase_offset_avg_factor_set(...) - to set phase offset averaging factor Obtain the factor value using the get callback and provide it to the user if the device driver implement this callback. Execute the set callback upon user requests, if the driver implement it. Signed-off-by: Ivan Vecera v2: * do not require 'set' callback to retrieve current value * always call 'set' callback regardless of current value Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit a680581f6a131fd8c62d284ed4a24d4bc1cc553e Author: Ivan Vecera Date: Sat Sep 27 10:49:10 2025 +0200 dpll: add phase-offset-avg-factor device attribute to netlink spec Add dpll device level attribute DPLL_A_PHASE_OFFSET_AVG_FACTOR to allow control over a calculation of reported phase offset value. Attribute is present, if the driver provides such capability, otherwise attribute shall not be present. Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit eb11f02f3151e86f41bb15cc47b7400e91c07a4f Merge: 8169a6011c5fec 5cfbe7ebfa42fd Author: Jakub Kicinski Date: Mon Sep 29 18:50:51 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-09-28' Tariq Toukan says: ==================== mlx5 misc fixes 2025-09-28 misc bug fixes from the team to the mlx5 core driver. ==================== Signed-off-by: Jakub Kicinski commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 Author: Moshe Shemesh Date: Mon Sep 29 00:02:09 2025 +0300 net/mlx5: fw reset, add reset timeout work Add sync reset timeout to stop poll_sync_reset in case there was no reset done or abort event within timeout. Otherwise poll sync reset will just continue and in case of fw fatal error no health reporting will be done. Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 Author: Shay Drory Date: Mon Sep 29 00:02:08 2025 +0300 net/mlx5: pagealloc: Fix reclaim race during command interface teardown The reclaim_pages_cmd() function sends a command to the firmware to reclaim pages if the command interface is active. A race condition can occur if the command interface goes down (e.g., due to a PCI error) while the mlx5_cmd_do() call is in flight. In this case, mlx5_cmd_do() will return an error. The original code would propagate this error immediately, bypassing the software-based page reclamation logic that is supposed to run when the command interface is down. Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark that command interface is down. If this is the case, fall through to the software reclamation path. If the command failed for any another reason, or finished successfully, return as before. Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 Author: Moshe Shemesh Date: Mon Sep 29 00:02:07 2025 +0300 net/mlx5: Stop polling for command response if interface goes down Stop polling on firmware response to command in polling mode if the command interface got down. This situation can occur, for example, if a firmware fatal error is detected during polling. This change halts the polling process when the command interface goes down, preventing unnecessary waits. Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 377ea331281f2c63dc281a6ea2dc318e4e1fc2d1 Merge: 6d3728d424a2ad 137d1a63551314 Author: Jakub Kicinski Date: Mon Sep 29 18:49:58 2025 -0700 Merge tag 'mlx5-next-lag' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-09-28 * tag 'mlx5-next-lag' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: IFC add balance ID and LAG per MP group bits net/mlx5: Add IFC bit for TIR/SQ order capability ==================== Link: https://patch.msgid.link/1759093989-841873-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit feafee284579d29537a5a56ba8f23894f0463f3d Merge: fe68bb2861808e ea0b39168d3a23 Author: Linus Torvalds Date: Mon Sep 29 18:48:39 2025 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "There's good stuff across the board, including some nice mm improvements for CPUs with the 'noabort' BBML2 feature and a clever patch to allow ptdump to play nicely with block mappings in the vmalloc area. Confidential computing: - Add support for accepting secrets from firmware (e.g. ACPI CCEL) and mapping them with appropriate attributes. CPU features: - Advertise atomic floating-point instructions to userspace - Extend Spectre workarounds to cover additional Arm CPU variants - Extend list of CPUs that support break-before-make level 2 and guarantee not to generate TLB conflict aborts for changes of mapping granularity (BBML2_NOABORT) - Add GCS support to our uprobes implementation. Documentation: - Remove bogus SME documentation concerning register state when entering/exiting streaming mode. Entry code: - Switch over to the generic IRQ entry code (GENERIC_IRQ_ENTRY) - Micro-optimise syscall entry path with a compiler branch hint. Memory management: - Enable huge mappings in vmalloc space even when kernel page-table dumping is enabled - Tidy up the types used in our early MMU setup code - Rework rodata= for closer parity with the behaviour on x86 - For CPUs implementing BBML2_NOABORT, utilise block mappings in the linear map even when rodata= applies to virtual aliases - Don't re-allocate the virtual region between '_text' and '_stext', as doing so confused tools parsing /proc/vmcore. Miscellaneous: - Clean-up Kconfig menuconfig text for architecture features - Avoid redundant bitmap_empty() during determination of supported SME vector lengths - Re-enable warnings when building the 32-bit vDSO object - Avoid breaking our eggs at the wrong end. Perf and PMUs: - Support for v3 of the Hisilicon L3C PMU - Support for Hisilicon's MN and NoC PMUs - Support for Fujitsu's Uncore PMU - Support for SPE's extended event filtering feature - Preparatory work to enable data source filtering in SPE - Support for multiple lanes in the DWC PCIe PMU - Support for i.MX94 in the IMX DDR PMU driver - MAINTAINERS update (Thank you, Yicong) - Minor driver fixes (PERF_IDX2OFF() overflow, CMN register offsets). Selftests: - Add basic LSFE check to the existing hwcaps test - Support nolibc in GCS tests - Extend SVE ptrace test to pass unsupported regsets and invalid vector lengths - Minor cleanups (typos, cosmetic changes). System registers: - Fix ID_PFR1_EL1 definition - Fix incorrect signedness of some fields in ID_AA64MMFR4_EL1 - Sync TCR_EL1 definition with the latest Arm ARM (L.b) - Be stricter about the input fed into our AWK sysreg generator script - Typo fixes and removal of redundant definitions. ACPI, EFI and PSCI: - Decouple Arm's "Software Delegated Exception Interface" (SDEI) support from the ACPI GHES code so that it can be used by platforms booted with device-tree - Remove unnecessary per-CPU tracking of the FPSIMD state across EFI runtime calls - Fix a node refcount imbalance in the PSCI device-tree code. CPU Features: - Ensure register sanitisation is applied to fields in ID_AA64MMFR4 - Expose AIDR_EL1 to userspace via sysfs, primarily so that KVM guests can reliably query the underlying CPU types from the VMM - Re-enabling of SME support (CONFIG_ARM64_SME) as a result of fixes to our context-switching, signal handling and ptrace code" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (93 commits) arm64: cpufeature: Remove duplicate asm/mmu.h header arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN perf/dwc_pcie: Fix use of uninitialized variable arm/syscalls: mark syscall invocation as likely in invoke_syscall Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU Documentation: hisi-pmu: Fix of minor format error drivers/perf: hisi: Add support for L3C PMU v3 drivers/perf: hisi: Refactor the event configuration of L3C PMU drivers/perf: hisi: Extend the field of tt_core drivers/perf: hisi: Extract the event filter check of L3C PMU drivers/perf: hisi: Simplify the probe process of each L3C PMU version drivers/perf: hisi: Export hisi_uncore_pmu_isr() drivers/perf: hisi: Relax the event ID check in the framework perf: Fujitsu: Add the Uncore PMU driver arm64: map [_text, _stext) virtual address range non-executable+read-only arm64/sysreg: Update TCR_EL1 register arm64: Enable vmalloc-huge with ptdump arm64: cpufeature: add Neoverse-V3AE to BBML2 allow list arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions ... commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 Author: Yeounsu Moon Date: Mon Sep 29 04:01:24 2025 +0900 net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 6d3728d424a2ad6c1af03ae597db6b5aca929cf2 Author: Russell King (Oracle) Date: Mon Sep 29 08:43:55 2025 +0100 net: stmmac: remove stmmac_hw_setup() excess documentation parameter The kernel build bot reports: Warning: drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3438 Excess function parameter 'ptp_register' description in 'stmmac_hw_setup' Fix it. Reported-by: kernel test robot Fixes: 98d8ea566b85 ("net: stmmac: move timestamping/ptp init to stmmac_hw_setup() caller") Closes: https://lore.kernel.org/oe-kbuild-all/202509290927.svDd6xuw-lkp@intel.com/ Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1v38Y7-00000008UCQ-3w27@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fe68bb2861808ed5c48d399bd7e670ab76829d55 Merge: 46a1b6b2aaae96 438f7cd41765db Author: Linus Torvalds Date: Mon Sep 29 18:45:42 2025 -0700 Merge tag 'microblaze-v6.18' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze updates from Michal Simek: - Fix typos in Kconfig - s/__ASSEMBLY__/__ASSEMBLER__/g * tag 'microblaze-v6.18' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers microblaze: fix typos in Kconfig commit 4363d182191c0ea5d9461104955e296ba0490222 Merge: 4ed9db2dc5d898 9b62d53cc8b4f0 Author: Jakub Kicinski Date: Mon Sep 29 18:41:39 2025 -0700 Merge branch 'selftest-packetdrill-import-tfo-server-tests' Kuniyuki Iwashima says: ==================== selftest: packetdrill: Import TFO server tests. The series imports 15 TFO server tests from google/packetdrill and adds 2 more tests. The repository has two versions of tests for most scenarios; one uses the non-experimental option (34), and the other uses the experimental option (255) with 0xF989. Basically, we only import the non-experimental version of tests, and for the experimental option, tcp_fastopen_server_experimental_option.pkt is added. The following tests are not (yet) imported: * icmp-baseline.pkt * simple1.pkt / simple2.pkt / simple3.pkt The former is completely covered by icmp-before-accept.pkt. The later's delta is the src/dst IP pair to generate a different cookie, but supporting dualstack requires churn in ksft_runner.sh, so defered to future series. Also, sockopt-fastopen-key.pkt covers the same function. The following tests have the experimental version only, so converted to the non-experimental option: * client-ack-dropped-then-recovery-ms-timestamps.pkt * sockopt-fastopen-key.pkt For the imported tests, these common changes are applied. * Add SPDX header * Adjust path to default.sh * Adjust sysctl w/ set_sysctls.py * Use TFO_COOKIE instead of a raw hex value * Use SOCK_NONBLOCK for socket() not to block accept() * Add assertions for TCP state if commented * Remove unnecessary delay (e.g. +0.1 setsockopt(SO_REUSEADDR), etc) With this series, except for simple{1,2,3}.pkt, we can remove TFO server tests in google/packetdrill. ==================== Link: https://patch.msgid.link/20250927213022.1850048-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9b62d53cc8b4f089a1d069e1b6753b544d480212 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:51 2025 +0000 selftest: packetdrill: Import client-ack-dropped-then-recovery-ms-timestamps.pkt This also does not have the non-experimental version, so converted to FO. The comment in .pkt explains the detailed scenario. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-14-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 05b9f505fbe760416afa555bdfd0c461291ed69c Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:50 2025 +0000 selftest: packetdrill: Import sockopt-fastopen-key.pkt sockopt-fastopen-key.pkt does not have the non-experimental version, so the Experimental version is converted, FOEXP -> FO. The test sets net.ipv4.tcp_fastopen_key=0-0-0-0 and instead sets another key via setsockopt(TCP_FASTOPEN_KEY). The first listener generates a valid cookie in response to TFO option without cookie, and the second listner creates a TFO socket using the valid cookie. TCP_FASTOPEN_KEY is adjusted to use the common key in default.sh so that we can use TFO_COOKIE and support dualstack. Similarly, TFO_COOKIE_ZERO for the 0-0-0-0 key is defined. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-13-kuniyu@google.com Signed-off-by: Jakub Kicinski commit be90c7b3d5c8f3343d2402b883e7ec673538a302 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:49 2025 +0000 selftest: packetdrill: Refine tcp_fastopen_server_reset-after-disconnect.pkt. These changes are applied to follow the imported packetdrill tests. * Call setsockopt(TCP_FASTOPEN) * Remove unnecessary accept() delay * Add assertion for TCP states * Rename to tcp_fastopen_server_trigger-rst-reconnect.pkt. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-12-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 21f7fb31aef878df52c4575f3b71cbbea935d48a Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:48 2025 +0000 selftest: packetdrill: Import opt34/*-trigger-rst.pkt. This imports the non-experimental version of opt34/*-trigger-rst.pkt. | accept() | SYN data | -----------------------------------+----------+----------+ listener-closed-trigger-rst.pkt | no | unread | unread-data-closed-trigger-rst.pkt | yes | unread | Both files test that close()ing a SYN_RECV socket with unread SYN data triggers RST. The files are renamed to have the common prefix, trigger-rst. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5920f154e144c1e62b581454397e0f88fbd3b58d Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:47 2025 +0000 selftest: packetdrill: Import opt34/reset-* tests. This imports the non-experimental version of opt34/reset-*.pkt. | Child | RST | sk_err | ---------------------------------+---------+-------------------------------+---------+ reset-after-accept.pkt | TFO | after accept(), SYN_RECV | read() | reset-close-with-unread-data.pkt | TFO | after accept(), SYN_RECV | write() | reset-before-accept.pkt | TFO | before accept(), SYN_RECV | read() | reset-non-tfo-socket.pkt | non-TFO | before accept(), ESTABLISHED | write() | The first 3 files test scenarios where a SYN_RECV socket receives RST before/after accept() and data in SYN must be read() without error, but the following read() or fist write() will return ECONNRESET. The last test is similar but with non-TFO socket. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a8b1750e68f5fd6fe4bdff6f5d59d157c87a9b99 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:46 2025 +0000 selftest: packetdrill: Import opt34/icmp-before-accept.pkt. This imports the non-experimental version of icmp-before-accept.pkt. This file tests the scenario where an ICMP unreachable packet for a not-yet-accept()ed socket changes its state to TCP_CLOSE, but the SYN data must be read without error, and the following read() returns EHOSTUNREACH. Note that this test support only IPv4 as icmp is used. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5ed080f85a33ad76288711c64ec2d8699de65ff9 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:45 2025 +0000 selftest: packetdrill: Import opt34/fin-close-socket.pkt. This imports the non-experimental version of fin-close-socket.pkt. This file tests the scenario where a TFO child socket's state transitions from SYN_RECV to CLOSE_WAIT before accept()ed. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e57b3933abcec26255fd9b4405badfc22af67da2 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:44 2025 +0000 selftest: packetdrill: Add test for experimental option. The only difference between non-experimental vs experimental TFO option handling is SYN+ACK generation. When tcp_parse_fastopen_option() parses a TFO option, it sets tcp_fastopen_cookie.exp to false if the option number is 34, and true if 255. The value is carried to tcp_options_write() to generate a TFO option with the same option number. Other than that, all the TFO handling is the same and the kernel must generate the same cookie regardless of the option number. Let's add a test for the handling so that we can consolidate fastopen/server/ tests and fastopen/server/opt34 tests. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 399e0a7ed930c9d64e10dba2ac8bed0a5793e264 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:43 2025 +0000 selftest: packetdrill: Add test for TFO_SERVER_WO_SOCKOPT1. TFO_SERVER_WO_SOCKOPT1 is no longer enabled by default, and each server test requires setsockopt(TCP_FASTOPEN). Let's add a basic test for TFO_SERVER_WO_SOCKOPT1. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0b8f164eb264184bf8820cc0c59cf6089d0201b3 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:42 2025 +0000 selftest: packetdrill: Import TFO server basic tests. This imports basic TFO server tests from google/packetdrill. The repository has two versions of tests for most scenarios; one uses the non-experimental option (34), and the other uses the experimental option (255) with 0xF989. This only imports the following tests of the non-experimental version placed in [0]. I will add a specific test for the experimental option handling later. | TFO | Cookie | Payload | ---------------------------+-----+--------+---------+ basic-rw.pkt | yes | yes | yes | basic-zero-payload.pkt | yes | yes | no | basic-cookie-not-reqd.pkt | yes | no | yes | basic-non-tfo-listener.pkt | no | yes | yes | pure-syn-data.pkt | yes | no | yes | The original pure-syn-data.pkt missed setsockopt(TCP_FASTOPEN) and did not test TFO server in some scenarios unintentionally, so setsockopt() is added where needed. In addition, non-TFO scenario is stripped as it is covered by basic-non-tfo-listener.pkt. Also, I added basic- prefix. Link: https://github.com/google/packetdrill/tree/bfc96251310f/gtests/net/tcp/fastopen/server/opt34 #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 97b3b8306f782af80b4666d7137c75be9dba9219 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:41 2025 +0000 selftest: packetdrill: Define common TCP Fast Open cookie. TCP Fast Open cookie is generated in __tcp_fastopen_cookie_gen_cipher(). The cookie value is generated from src/dst IPs and a key configured by setsockopt(TCP_FASTOPEN_KEY) or net.ipv4.tcp_fastopen_key. The default.sh sets net.ipv4.tcp_fastopen_key, and the original packetdrill defines the corresponding cookie as TFO_COOKIE in run_all.py. [0] Then, each test does not need to care about the value, and we can easily update TFO_COOKIE in case __tcp_fastopen_cookie_gen_cipher() changes the algorithm. However, some tests use the bare hex value for specific IPv4 addresses and do not support IPv6. Let's define the same TFO_COOKIE in ksft_runner.sh. We will replace such bare hex values with TFO_COOKIE except for a single test for setsockopt(TCP_FASTOPEN_KEY). Link: https://github.com/google/packetdrill/blob/7230b3990f94/gtests/net/packetdrill/run_all.py#L65 #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 261cb8b12376d1c06c2840280fc602dc065ed924 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:40 2025 +0000 selftest: packetdrill: Require explicit setsockopt(TCP_FASTOPEN). To enable TCP Fast Open on a server, net.ipv4.tcp_fastopen must have 0x2 (TFO_SERVER_ENABLE), and we need to do either 1. Call setsockopt(TCP_FASTOPEN) for the socket 2. Set 0x400 (TFO_SERVER_WO_SOCKOPT1) additionally to net.ipv4.tcp_fastopen The default.sh sets 0x70403 so that each test does not need setsockopt(). (0x1 is TFO_CLIENT_ENABLE, and 0x70000 is ...???) However, some tests overwrite net.ipv4.tcp_fastopen without TFO_SERVER_WO_SOCKOPT1 and forgot setsockopt(TCP_FASTOPEN). For example, pure-syn-data.pkt [0] tests non-TFO servers unintentionally, except in the first scenario. To prevent such an accident, let's require explicit setsockopt(). TFO_CLIENT_ENABLE is necessary for tcp_syscall_bad_arg_fastopen-invalid-buf-ptr.pkt. Link: https://github.com/google/packetdrill/blob/bfc96251310f/gtests/net/tcp/fastopen/server/opt34/pure-syn-data.pkt #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 70dd4775db7fe33669bff6998e4b363298810127 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:39 2025 +0000 selftest: packetdrill: Set ktap_set_plan properly for single protocol test. The cited commit forgot to update the ktap_set_plan call. ktap_set_plan sets the number of tests (KSFT_NUM_TESTS), which must match the number of executed tests (KTAP_CNT_PASS + KTAP_CNT_SKIP + KTAP_CNT_XFAIL) in ktap_finished. Otherwise, the selftest exit()s with 1. Let's adjust KSFT_NUM_TESTS based on supported protocols. While at it, misalignment is fixed up. Fixes: a5c10aa3d1ba ("selftests/net: packetdrill: Support single protocol test.") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 46a1b6b2aaae965b27b3bb34cf88d441f6aef20e Merge: e129e479f2e444 a20b83cf45be20 Author: Linus Torvalds Date: Mon Sep 29 18:40:11 2025 -0700 Merge tag 'nios2_update_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 updates from Dinh Nguyen: - Replace __ASSEMBLY__ with __ASSEMBLER__ in headers - Set memblock.current_limit when setting pfn limits * tag 'nios2_update_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: ensure that memblock.current_limit is set when setting pfn limits nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers commit f017156aea60db8720e47591ed1e041993381ad2 Author: Kohei Enju Date: Mon Sep 29 14:02:22 2025 +0900 net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable In EC2 instances where the RSS hash key is not configurable, ethtool shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally returns ENA_HASH_KEY_SIZE. Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") added proper handling for devices that don't support RSS hash key configuration, but ena_get_rxfh_key_size() has been unchanged. When the RSS hash key is not configurable, return 0 instead of ENA_HASH_KEY_SIZE to clarify getting the value is not supported. Tested on m5 instance families. Without patch: # ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 With patch: # ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: Operation not supported Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") Signed-off-by: Kohei Enju Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit 8425161ac1204d2185e0a10f5ae652bae75d2451 Author: Kohei Enju Date: Mon Sep 29 14:42:15 2025 +0900 nfp: fix RSS hash key size when RSS is not supported The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when devices don't support RSS, and callers treat the negative value as a large positive value since the return type is u32. Return 0 when devices don't support RSS, aligning with the ethtool interface .get_rxfh_key_size() that requires returning 0 in such cases. Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") Signed-off-by: Kohei Enju Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit 4ed9db2dc5d8981ecb7042f084f5cff43ba539d6 Author: Alok Tiwari Date: Mon Sep 29 01:54:12 2025 -0700 net: rtnetlink: fix typo in rtnl_unregister_all() comment Corrected "rtnl_unregster()" -> "rtnl_unregister()" in the documentation comment of "rtnl_unregister_all()" Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250929085418.49200-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 7d452516b67add4a53e63bfa496d8df930a66b9a Author: Eric Dumazet Date: Mon Sep 29 18:21:12 2025 +0000 Revert "net: group sk_backlog and sk_receive_queue" This reverts commit 4effb335b5dab08cb6e2c38d038910f8b527cfc9. This was a benefit for UDP flood case, which was later greatly improved with commits 6471658dc66c ("udp: use skb_attempt_defer_free()") and b650bf0977d3 ("udp: remove busylock and add per NUMA queues"). Apparently blamed commit added a regression for RAW sockets, possibly because they do not use the dual RX queue strategy that UDP has. sock_queue_rcv_skb_reason() and RAW recvmsg() compete for sk_receive_buf and sk_rmem_alloc changes, and them being in the same cache line reduce performance. Fixes: 4effb335b5da ("net: group sk_backlog and sk_receive_queue") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509281326.f605b4eb-lkp@intel.com Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: David Ahern Cc: Kuniyuki Iwashima Link: https://patch.msgid.link/20250929182112.824154-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9dd4e022bfffe0fbc6eaccdb52fc25554be5c367 Author: Furong Xu <0x1207@gmail.com> Date: Sat Sep 27 16:10:36 2025 +0800 net: stmmac: Convert open-coded register polling to helper macro Drop the open-coded register polling routines. Use readl_poll_timeout_atomic() in atomic state. Also adjust the delay time to 10us which seems more reasonable. Tested on NXP i.MX8MP and ROCKCHIP RK3588 boards, the break condition was met right after the first polling, no delay involved at all. So the 10us delay should be long enough for most cases. Reviewed-by: Simon Horman Signed-off-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250927081036.10611-1-0x1207@gmail.com Signed-off-by: Jakub Kicinski commit 74f7c5233e09a8b10ccf94f2fef42f95961c288b Merge: f017c1f768b670 c912f935a5c7e4 Author: Jakub Kicinski Date: Mon Sep 29 18:23:37 2025 -0700 Merge branch 'mptcp-receive-path-improvement' Matthieu Baerts says: ==================== mptcp: receive path improvement This series includes several changes to the MPTCP RX path. The main goals are improving the RX performances, and increase the long term maintainability. Some changes reflects recent(ish) improvements introduced in the TCP stack: patch 1, 2 and 3 are the MPTCP counter part of SKB deferral free and auto-tuning improvements. Note that patch 3 could possibly fix additional issues, and overall such patch should protect from similar issues to arise in the future. Patches 4-7 are aimed at introducing the socket backlog usage which will be done in a later series to process the packets received by the different subflows while the msk socket is owned. Patch 8 is not related to the RX path, but it contains additional tests for new features recently introduced in net-next. ==================== Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-0-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit c912f935a5c7e43f2b6be94d76e4ddbb6ff14c6d Author: Matthieu Baerts (NGI0) Date: Sat Sep 27 11:40:44 2025 +0200 selftests: mptcp: join: validate new laminar endp Here are a few sub-tests for mptcp_join.sh, validating the new 'laminar' endpoint type. In a setup where subflows created using the routing rules would be rejected by the listener, and where the latter announces one IP address, some cases are verified: - Without any 'laminar' endpoints: no new subflows are created. - With one 'laminar' endpoint: a second subflow is created. - With multiple 'laminar' endpoints: 2 IPv4 subflows are created. - With one 'laminar' endpoint, but the server announcing a second IP address, only one subflow is created. - With one 'laminar' + 'subflow' endpoint, the same endpoint is only used once. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-8-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 59701b1870032c1bf32244d87476bcd4b5ecb41b Author: Paolo Abeni Date: Sat Sep 27 11:40:43 2025 +0200 mptcp: minor move_skbs_to_msk() cleanup Such function is called only by __mptcp_data_ready(), which in turn is always invoked when msk is not owned by the user: we can drop the redundant, related check. Additionally mptcp needs to propagate the socket error only for current subflow. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-7-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 68c7af988bd137479101e2b40ab5fdd0e0365364 Author: Paolo Abeni Date: Sat Sep 27 11:40:42 2025 +0200 mptcp: factor out a basic skb coalesce helper The upcoming patch will introduced backlog processing for MPTCP socket, and we want to leverage coalescing in such data path. Factor out the relevant bits not touching memory accounting to deal with such use-case. Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-6-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit c4ebc4ee4e751c6430604c52344d932bf1fde379 Author: Paolo Abeni Date: Sat Sep 27 11:40:41 2025 +0200 mptcp: remove unneeded mptcp_move_skb() Since commit b7535cfed223 ("mptcp: drop legacy code around RX EOF"), sk_shutdown can't change during the main recvmsg loop, we can drop the related race breaker. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-5-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 9a0afe0db46720ce1a009c7dac168aa0584bd732 Author: Paolo Abeni Date: Sat Sep 27 11:40:40 2025 +0200 mptcp: introduce the mptcp_init_skb helper Factor out all the skb initialization step in a new helper and use it. Note that this change moves the MPTCP CB initialization earlier: we can do such step as soon as the skb leaves the subflow socket receive queues. Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-4-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit e118cdc34dd109562b64f6a397f68cd33b041d5b Author: Paolo Abeni Date: Sat Sep 27 11:40:39 2025 +0200 mptcp: rcvbuf auto-tuning improvement Apply to the MPTCP auto-tuning the same improvements introduced for the TCP protocol by the merge commit 2da35e4b4df9 ("Merge branch 'tcp-receive-side-improvements'"). The main difference is that TCP subflow and the main MPTCP socket need to account separately for OoO: MPTCP does not care for TCP-level OoO and vice versa, as a consequence do not reflect MPTCP-level rcvbuf increase due to OoO packets at the subflow level. This refeactor additionally allow dropping the msk receive buffer update at receive time, as the latter only intended to cope with subflow receive buffer increase due to OoO packets. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/487 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/559 Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-3-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit a7556779745c047efb7b0ce8732889b0cdc80936 Author: Paolo Abeni Date: Sat Sep 27 11:40:38 2025 +0200 tcp: make tcp_rcvbuf_grow() accessible to mptcp code To leverage the auto-tuning improvements brought by commit 2da35e4b4df9 ("Merge branch 'tcp-receive-side-improvements'"), the MPTCP stack need to access the mentioned helper. Acked-by: Geliang Tang Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-2-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 9aa59323f2709370cb4f01acbba599a9167f317b Author: Paolo Abeni Date: Sat Sep 27 11:40:37 2025 +0200 mptcp: leverage skb deferral free Usage of the skb deferral API is straight-forward; with multiple subflows actives this allow moving part of the received application load into multiple CPUs. Also fix a typo in the related comment. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-1-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit f017c1f768b670bced4464476655b27dfb937e67 Author: Eric Dumazet Date: Sat Sep 27 09:28:27 2025 +0000 tcp: use skb->len instead of skb->truesize in tcp_can_ingest() Some applications are stuck to the 20th century and still use small SO_RCVBUF values. After the blamed commit, we can drop packets especially when using LRO/hw-gro enabled NIC and small MSS (1500) values. LRO/hw-gro NIC pack multiple segments into pages, allowing tp->scaling_ratio to be set to a high value. Whenever the receive queue gets full, we can receive a small packet filling RWIN, but with a high skb->truesize, because most NIC use 4K page plus sk_buff metadata even when receiving less than 1500 bytes of payload. Even if we refine how tp->scaling_ratio is estimated, we could have an issue at the start of the flow, because the first round of packets (IW10) will be sent based on the initial tp->scaling_ratio (1/2) Relax tcp_can_ingest() to use skb->len instead of skb->truesize, allowing the peer to use final RWIN, assuming a 'perfect' scaling_ratio of 1. Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250927092827.2707901-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d210ee58da1eff63626982ade65632a291aff941 Merge: c39d6d4d933381 be812ace0378a9 Author: Jakub Kicinski Date: Mon Sep 29 18:13:51 2025 -0700 Merge tag 'for-net-next-2025-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver - Avoid a couple dozen -Wflex-array-member-not-at-end warnings - bcsp: receive data only if registered - HCI: Fix using LE/ACL buffers for ISO packets - hci_core: Detect if an ISO link has stalled - ISO: Don't initiate CIS connections if there are no buffers - ISO: Use sk_sndtimeo as conn_timeout drivers: - btusb: Check for unexpected bytes when defragmenting HCI frames - btusb: Add new VID/PID 13d3/3627 for MT7925 - btusb: Add new VID/PID 13d3/3633 for MT7922 - btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - btintel: Add support for BlazarIW core - btintel_pcie: Add support for _suspend() / _resume() - btintel_pcie: Define hdev->wakeup() callback - btintel_pcie: Add Bluetooth core/platform as comments - btintel_pcie: Add id of Scorpious, Panther Lake-H484 - btintel_pcie: Refactor Device Coredump * tag 'for-net-next-2025-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (30 commits) Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements Bluetooth: ISO: don't leak skb in ISO_CONT RX Bluetooth: ISO: free rx_skb if not consumed Bluetooth: ISO: Fix possible UAF on iso_conn_free Bluetooth: SCO: Fix UAF on sco_conn_free Bluetooth: bcsp: receive data only if registered Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925 Bluetooth: remove duplicate h4_recv_buf() in header Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Bluetooth: hci_core: Print information of hcon on hci_low_sent Bluetooth: hci_core: Print number of packets in conn->data_q Bluetooth: Add function and line information to bt_dbg Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO Bluetooth: hci_core: Detect if an ISO link has stalled Bluetooth: ISO: Use sk_sndtimeo as conn_timeout Bluetooth: HCI: Fix using LE/ACL buffers for ISO packets Bluetooth: ISO: Don't initiate CIS connections if there are no buffers MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver ... ==================== Link: https://patch.msgid.link/20250927154616.1032839-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c39d6d4d933381714b6e5d735545256558ec6c05 Author: Michael S. Tsirkin Date: Sat Sep 27 08:29:35 2025 -0400 ptr_ring: __ptr_ring_zero_tail micro optimization __ptr_ring_zero_tail currently does the - 1 operation twice: - during initialization of head - at each loop iteration Let's just do it in one place, all we need to do is adjust the loop condition. this is better: - a slightly clearer logic with less duplication - uses prefix -- we don't need to save the old value - one less - 1 operation - for example, when ring is empty we now don't do - 1 at all, existing code does it once Text size shrinks from 15081 to 15050 bytes. Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman Link: https://patch.msgid.link/bcd630c7edc628e20d4f8e037341f26c90ab4365.1758976026.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit e8c4840d0c198215866728626b5c197048d4368b Merge: 1fb0e471611dc6 2a251b85ce918e Author: Jakub Kicinski Date: Mon Sep 29 18:11:18 2025 -0700 Merge branch 'net-wangxun-support-to-configure-rss' Jiawen Wu says: ==================== net: wangxun: support to configure RSS Implement ethtool ops for RSS configuration, and support multiple RSS for multiple pools. ==================== Link: https://patch.msgid.link/20250926023843.34340-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 2a251b85ce918e8552c604df4770040eae4432be Author: Jiawen Wu Date: Fri Sep 26 10:38:43 2025 +0800 net: libwx: restrict change user-set RSS configuration Enable/disable SR-IOV will change the number of rings, thereby changing the RSS configuration that the user has set. So reject these attempts if netif_is_rxfh_configured() returns true. And remind the user to reset the RSS configuration. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-5-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 2556f80a6abc69cb4f980ebcf5ca82ad383fef35 Author: Jiawen Wu Date: Fri Sep 26 10:38:42 2025 +0800 net: wangxun: add RSS reta and rxfh fields support Add ethtool ops for Rx flow hashing, query and set RSS indirection table and hash key. Disable UDP RSS by default, and support to configure L4 header fields with TCP/UDP/SCTP for flow hasing. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-4-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 58f244b25688bc0d891a1e52f13bd26cefbd8dae Author: Jiawen Wu Date: Fri Sep 26 10:38:41 2025 +0800 net: libwx: move rss_field to struct wx For global RSS and multiple RSS scheme, the RSS type fields are defined identically in the registers. So they can be defined as the macros WX_RSS_FIELD_* to cleanup the codes. And to prepare for the RXFH support in the next patch, move the rss_field to struct wx. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 1be6db04979944a05224807150038bab937521c8 Author: Jiawen Wu Date: Fri Sep 26 10:38:40 2025 +0800 net: libwx: support separate RSS configuration for every pool For those devices which support 64 pools, they also support PF and VF (i.e. different pools) to configure different RSS key and hash table. Enable multiple RSS, use up to 64 RSS configurations and each pool has a specific configuration. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit e129e479f2e444eaccd822717d418119d39d3d5c Merge: a5ba183bdeeeed d679c2e1e8d96f Author: Linus Torvalds Date: Mon Sep 29 18:08:34 2025 -0700 Merge tag 'pstore-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull tiny pstore update from Kees Cook: - Clarify various comments for better understanding (Eugen Hristev) * tag 'pstore-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/zone: rewrite some comments for better understanding commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 Author: Alok Tiwari Date: Thu Sep 25 11:02:10 2025 -0700 idpf: fix mismatched free function for dma_alloc_coherent The mailbox receive path allocates coherent DMA memory with dma_alloc_coherent(), but frees it with dmam_free_coherent(). This is incorrect since dmam_free_coherent() is only valid for buffers allocated with dmam_alloc_coherent(). Fix the mismatch by using dma_free_coherent() instead of dmam_free_coherent Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg") Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Reviewed-by: Madhu Chittim Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 1fb0e471611dc6a79dee609a7e0037eb1d124400 Author: Eric Dumazet Date: Thu Sep 25 23:09:29 2025 +0000 net: remove one stac/clac pair from move_addr_to_user() Convert the get_user() and __put_user() code to the fast masked_user_access_begin()/unsafe_{get|put}_user() variant. This patch increases the performance of an UDP recvfrom() receiver (netserver) on 120 bytes messages by 7 % on an AMD EPYC 7B12 64-Core Processor platform. Presence of audit_sockaddr() makes difficult to avoid the stac/clac pair in the copy_to_user() call, this is left for a future patch. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250925230929.3727873-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2b235765e9d4426cf56d7fd1a331f81a4dbbd85a Author: Eric Dumazet Date: Thu Sep 25 22:49:14 2025 +0000 scm: use masked_user_access_begin() in put_cmsg() Use the greatest and latest uaccess construct to get an optimal code. Before : lea (%r9,%rcx,1),%r10 movabs $,%r11 mov $0xfffffff2,%eax cmp %rcx,%r10 jb ffffffff81cdc312 cmp %r11,%r10 ja ffffffff81cdc312 stac lfence mov %r9,(%rcx) After: movabs $,%r9 cmp %r9,%rax cmova %r9,%rax stac mov %rcx,(%rax) Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250925224914.3590290-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3806446f609e111abf10b9a28c9e9762fafe56f4 Merge: 96ccc93744f826 de17376cad9706 Author: Jakub Kicinski Date: Mon Sep 29 17:49:35 2025 -0700 Merge branch 'net-stmmac-drop-frames-causing-hlbs-error' Rohan G Thomas says: ==================== net: stmmac: Drop frames causing HLBS error This patchset consists of following patchset to avoid netdev watchdog reset due to Head-of-Line Blocking due to EST scheduling error. 1. Drop those frames causing HLBS error 2. Add HLBS frame drops to taprio stats v2: https://lore.kernel.org/r/20250915-hlbs_2-v2-1-27266b2afdd9@altera.com ==================== Link: https://patch.msgid.link/20250925-hlbs_2-v3-0-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit de17376cad9706911f2d5a58a8c0f02b9665025d Author: Rohan G Thomas Date: Thu Sep 25 22:06:14 2025 +0800 net: stmmac: tc: Add HLBS drop count to taprio stats Add the count of the frames dropped by Head-Of-Line Blocking due to Scheduling(HLBS) error to taprio window drop count stats. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250925-hlbs_2-v3-2-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit 7ce48d497475d7222bd8258c5c055eb7d928793c Author: Rohan G Thomas Date: Thu Sep 25 22:06:13 2025 +0800 net: stmmac: est: Drop frames causing HLBS error Drop those frames causing Head-of-Line Blocking due to Scheduling (HLBS) error to avoid HLBS interrupt flooding and netdev watchdog timeouts due to blocked packets. Tx queues can be configured to drop those blocked packets by setting Drop Frames causing Scheduling Error (DFBS) bit of EST_CONTROL register. Also, add per queue HLBS drop count. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250925-hlbs_2-v3-1-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit a5ba183bdeeeedd5f5b683c02561072848258496 Merge: a240a79d435ae7 c8a935a31bc787 Author: Linus Torvalds Date: Mon Sep 29 17:48:27 2025 -0700 Merge tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "One notable addition is the creation of the 'transitional' keyword for kconfig so CONFIG renaming can go more smoothly. This has been a long-standing deficiency, and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will soon have KCFI support), this came up again. The breadth of the diffstat is mainly this renaming. - Clean up usage of TRAILING_OVERLAP() (Gustavo A. R. Silva) - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao) - Add str_assert_deassert() helper (Lad Prabhakar) - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - kconfig: Fix BrokenPipeError warnings in selftests - kconfig: Add transitional symbol attribute for migration support - kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI" * tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lib/string_choices: Add str_assert_deassert() helper kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI kconfig: Add transitional symbol attribute for migration support kconfig: Fix BrokenPipeError warnings in selftests gcc-plugins: Remove TODO_verify_il for GCC >= 16 stddef: Introduce __TRAILING_OVERLAP() stddef: Remove token-pasting in TRAILING_OVERLAP() lkdtm: fortify: Fix potential NULL dereference on kmalloc failure commit 96ccc93744f8260f62841ee1de7153bb1b8cfd83 Author: Alok Tiwari Date: Mon Sep 29 05:44:01 2025 -0700 ixgbe: fix typos and docstring inconsistencies Corrected function and variable name typos in comments and docstrings: ixgbe_write_ee_hostif_X550 -> ixgbe_write_ee_hostif_data_X550 ixgbe_get_lcd_x550em -> ixgbe_get_lcd_t_x550em "Determime" -> "Determine" "point to hardware structure" -> "pointer to hardware structure" "To turn on the LED" -> "To turn off the LED" These changes improve readability, consistency. Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Acked-by: Jacob Keller Link: https://patch.msgid.link/20250929124427.79219-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit a240a79d435ae7206a5c5101033f3f81d68bc3b4 Merge: 50157eaa0c13bb b0c9bfbab925ac Author: Linus Torvalds Date: Mon Sep 29 17:44:09 2025 -0700 Merge tag 'seccomp-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp update from Kees Cook: - Fix race with WAIT_KILLABLE_RECV (Johannes Nixdorf) * tag 'seccomp-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Add a test for the WAIT_KILLABLE_RECV fast reply race seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast commit 50157eaa0c13bb5aac5cc45330bf055d95d4af57 Merge: 8c1ed3021883f5 8c94db0ae97c72 Author: Linus Torvalds Date: Mon Sep 29 17:19:35 2025 -0700 Merge tag 'execve-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - binfmt_elf: preserve original ELF e_flags for core dumps (Svetlana Parfenova) - exec: Fix incorrect type for ret (Xichao Zhao) - binfmt_elf: Replace offsetof() with struct_size() in fill_note_info() (Xichao Zhao) * tag 'execve-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_elf: preserve original ELF e_flags for core dumps binfmt_elf: Replace offsetof() with struct_size() in fill_note_info() exec: Fix incorrect type for ret commit 8c1ed3021883f5e49f74dfb41ce0a24e5d07fdf0 Merge: 1896ce8eb6c618 95719dfa323709 Author: Linus Torvalds Date: Mon Sep 29 16:31:35 2025 -0700 Merge tag 'ffs-const-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull ffs const-attribute cleanups from Kees Cook: "While working on various hardening refactoring a while back we encountered inconsistencies in the application of __attribute_const__ on the ffs() family of functions. This series fixes this across all archs and adds KUnit tests. Notably, this found a theoretical underflow in PCI (also fixed here) and uncovered an inefficiency in ARC (fixed in the ARC arch PR). I kept the series separate from the general hardening PR since it is a stand-alone "topic". - PCI: Fix theoretical underflow in use of ffs(). - Universally apply __attribute_const__ to all architecture's ffs()-family of functions. - Add KUnit tests for ffs() behavior and const-ness" * tag 'ffs-const-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: KUnit: ffs: Validate all the __attribute_const__ annotations sparc: Add __attribute_const__ to ffs()-family implementations xtensa: Add __attribute_const__ to ffs()-family implementations s390: Add __attribute_const__ to ffs()-family implementations parisc: Add __attribute_const__ to ffs()-family implementations mips: Add __attribute_const__ to ffs()-family implementations m68k: Add __attribute_const__ to ffs()-family implementations openrisc: Add __attribute_const__ to ffs()-family implementations riscv: Add __attribute_const__ to ffs()-family implementations hexagon: Add __attribute_const__ to ffs()-family implementations alpha: Add __attribute_const__ to ffs()-family implementations sh: Add __attribute_const__ to ffs()-family implementations powerpc: Add __attribute_const__ to ffs()-family implementations x86: Add __attribute_const__ to ffs()-family implementations csky: Add __attribute_const__ to ffs()-family implementations bitops: Add __attribute_const__ to generic ffs()-family implementations KUnit: Introduce ffs()-family tests PCI: Test for bit underflow in pcie_set_readrq() commit b2ec5ca9d5c2c019e2316f7ba447596d1dcd8fde Merge: 62bea0e1d5c71a df2ba5709416ac Author: Dave Airlie Date: Tue Sep 30 09:26:24 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-09-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-09-26: amdgpu: - Misc fixes - Misc cleanups - SMU 13.x fixes - MES fix - VCN 5.0.1 reset fixes - DCN 3.2 watermark fixes - AVI infoframe fixes - PSR fix - Brightness fixes - DCN 3.1.4 fixes - DCN 3.1+ DTM fixes - DCN powergating fixes - DMUB fixes - DCN/SMU cleanup - DCN stutter fixes - DCN 3.5 fixes - GAMMA_LUT fixes - Add UserQ documentation - GC 9.4 reset fixes - Enforce isolation cleanups - UserQ fixes - DC/non-DC common modes cleanup - DCE6-10 fixes amdkfd: - Fix a race in sw_fini - Switch partition fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250926143918.2030854-1-alexander.deucher@amd.com commit 1896ce8eb6c61824f6c1125d69d8fda1f44a22f8 Merge: d8768fb12a14c3 a1f692fd69ccdb Author: Linus Torvalds Date: Mon Sep 29 15:55:20 2025 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull interleaved SHA-256 hashing support from Eric Biggers: "Optimize fsverity with 2-way interleaved hashing Add support for 2-way interleaved SHA-256 hashing to lib/crypto/, and make fsverity use it for faster file data verification. This improves fsverity performance on many x86_64 and arm64 processors. Later, I plan to make dm-verity use this too" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: Use 2-way interleaved SHA-256 hashing when supported fsverity: Remove inode parameter from fsverity_hash_block() lib/crypto: tests: Add tests and benchmark for sha256_finup_2x() lib/crypto: x86/sha256: Add support for 2-way interleaved hashing lib/crypto: arm64/sha256: Add support for 2-way interleaved hashing lib/crypto: sha256: Add support for 2-way interleaved hashing commit d8768fb12a14c30436bd0466b4fc28edeef45078 Merge: e2fffe1d958b36 b94bc4398beccd Author: Linus Torvalds Date: Mon Sep 29 15:48:56 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Add a RISC-V optimized implementation of Poly1305. This code was written by Andy Polyakov and contributed by Zhihang Shao. - Migrate the MD5 code into lib/crypto/, and add KUnit tests for MD5. Yes, it's still the 90s, and several kernel subsystems are still using MD5 for legacy use cases. As long as that remains the case, it's helpful to clean it up in the same way as I've been doing for other algorithms. Later, I plan to convert most of these users of MD5 to use the new MD5 library API instead of the generic crypto API. - Simplify the organization of the ChaCha, Poly1305, BLAKE2s, and Curve25519 code. Consolidate these into one module per algorithm, and centralize the configuration and build process. This is the same reorganization that has already been successful for SHA-1 and SHA-2. - Remove the unused crypto_kpp API for Curve25519. - Migrate the BLAKE2s and Curve25519 self-tests to KUnit. - Always enable the architecture-optimized BLAKE2s code. * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (38 commits) crypto: md5 - Implement export_core() and import_core() wireguard: kconfig: simplify crypto kconfig selections lib/crypto: tests: Enable Curve25519 test when CRYPTO_SELFTESTS lib/crypto: curve25519: Consolidate into single module lib/crypto: curve25519: Move a couple functions out-of-line lib/crypto: tests: Add Curve25519 benchmark lib/crypto: tests: Migrate Curve25519 self-test to KUnit crypto: curve25519 - Remove unused kpp support crypto: testmgr - Remove curve25519 kpp tests crypto: x86/curve25519 - Remove unused kpp support crypto: powerpc/curve25519 - Remove unused kpp support crypto: arm/curve25519 - Remove unused kpp support crypto: hisilicon/hpre - Remove unused curve25519 kpp support lib/crypto: tests: Add KUnit tests for BLAKE2s lib/crypto: blake2s: Consolidate into single C translation unit lib/crypto: blake2s: Move generic code into blake2s.c lib/crypto: blake2s: Always enable arch-optimized BLAKE2s code lib/crypto: blake2s: Remove obsolete self-test lib/crypto: x86/blake2s: Reduce size of BLAKE2S_SIGMA2 lib/crypto: chacha: Consolidate into single module ... commit e2fffe1d958b3660bc4e07e6542d97b6cc168826 Merge: d60ac92c105fd8 136d029662cdde Author: Linus Torvalds Date: Mon Sep 29 15:36:42 2025 -0700 Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull CRC updates from Eric Biggers: "Update crc_kunit to test the CRC functions in softirq and hardirq contexts, similar to what the lib/crypto/ KUnit tests do. Move the helper function needed to do this into a common header. This is useful mainly to test fallback code paths for when FPU/SIMD/vector registers are unusable" * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: Documentation/staging: Fix typo and incorrect citation in crc32.rst lib/crc: Drop inline from all *_mod_init_arch() functions lib/crc: Use underlying functions instead of crypto_simd_usable() lib/crc: crc_kunit: Test CRC computation in interrupt contexts kunit, lib/crypto: Move run_irq_test() to common header commit d60ac92c105fd8c09224b92c3e34dd03327ba3f4 Merge: a769648f464c9f 19591f7e781fd1 Author: Linus Torvalds Date: Mon Sep 29 15:33:50 2025 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "Make fs/crypto/ use the HMAC-SHA512 library functions instead of crypto_shash. This is simpler, faster, and more reliable" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: use HMAC-SHA512 library for HKDF fscrypt: Remove redundant __GFP_NOWARN commit a769648f464c9f453b3dc5c2bb8559b28c5d78a1 Merge: 5928397f5739fb 8e402107886366 Author: Linus Torvalds Date: Mon Sep 29 15:24:58 2025 -0700 Merge tag 'dlm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This adds a dlm_release_lockspace() flag to request that node-failure recovery be performed for the node leaving the lockspace. The implementation of this flag requires coordination with userland clustering components. It's been requested for use by GFS2" * tag 'dlm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: check for undefined release_option values dlm: handle release_option as unsigned dlm: move to rinfo for all middle conversion cases dlm: handle invalid lockspace member remove dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release dlm: add new configfs entry release_recover for lockspace members dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace dlm: use defines for force values in dlm_release_lockspace dlm: check for defined force value in dlm_lockspace_release commit 5928397f5739fb94559350575826d94fa8c35929 Merge: b3e1c7855e8e1c e2d3af0d64e5fe Author: Linus Torvalds Date: Mon Sep 29 15:19:45 2025 -0700 Merge tag 'erofs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: - Support FS_IOC_GETFSLABEL ioctl - Stop meaningless read-more policy on fragment extents - Remove a duplicate check for ztailpacking inline * tag 'erofs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: drop redundant sanity check for ztailpacking inline erofs: Add support for FS_IOC_GETFSLABEL erofs: avoid reading more for fragment maps commit b3e1c7855e8e1c4d77685ce4a8cd9cdd576058eb Merge: a9401710a5f568 f32a26fab3672e Author: Linus Torvalds Date: Mon Sep 29 15:03:07 2025 -0700 Merge tag 'hfs-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfs updates from Viacheslav Dubeyko: "This contains several fixes of syzbot reported issues, HFS/HFS+ fixes of xfstests failures, and rework of HFS/HFS+ debug output subsystem. - Kang Chen fixed a slab-out-of-bounds issue in hfsplus_uni2asc() when hfsplus_uni2asc() is called from hfsplus_listxattr(). - Yang Chenzhi fixed a crash in hfsplus_bmap_alloc() if record offset or length is larger than node_size. - Yangtao Li corrected the error code from hfsplus_fill_super() if Catalog File contains corrupted record for the case of hidden directory's type. - KMSAN uninit-value fixes: hfs_find_set_zero_bits() and __hfsplus_ext_cache_extent() use kzalloc() instead of kmalloc(), and in hfsplus_delete_cat() by proper initialization of struct hfsplus_inode_info in the hfsplus_iget() logic. - A slab-out-of-bounds issue could happen in hfsplus_strcasecmp() if the length field of struct hfsplus_unistr is bigger than HFSPLUS_MAX_STRLEN. Fixed by checking the length of comparing strings, and if the strings' length is bigger than HFSPLUS_MAX_STRLEN, then the length is corrected to this value. - The generic/736 xfstest failed for HFS because the HFS volume becomes corrupted after the test run. The main reason was the absence of logic that corrects mdb->drNxtCNID/HFS_SB(sb)->next_id (next unused CNID) after deleting a record in Catalog File. That was fixed by implementing the necessary logic in hfs_correct_next_unused_CNID()" * tag 'hfs-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfs/hfsplus: rework debug output subsystem hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfs: clear offset and space out of valid records in b-tree node hfs: add logic of correcting a next unused CNID hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() hfs: make proper initalization of struct hfs_find_data hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() hfs: validate record offset in hfsplus_bmap_alloc hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() MAINTAINERS: update location of hfs&hfsplus trees commit a9401710a5f5681abd2a6f21f9e76bc9f2e81891 Merge: e445fba2d76369 1b53426334c3c9 Author: Linus Torvalds Date: Mon Sep 29 14:57:08 2025 -0700 Merge tag 'v6.18-rc-part1-smb3-common' of git://git.samba.org/ksmbd Pull smb restructuring updates from Steve French: "Large set of small restructuring smbdirect related patches for cifs.ko and ksmbd.ko. This is the next step in order to use common structures for smbdirect handling across both modules. And also includes improved handling of broken connections, as well as fixed negotiation as rdma resources. Moving to common functions is planned for 6.19, as well as also providing smbdirect via sockets to userspace (e.g. for samba to also be able to use smbdirect for userspace server and userspace client tools). This was heavily reviewed and tested at the recent SMB3.1.1 test event at SDC" * tag 'v6.18-rc-part1-smb3-common' of git://git.samba.org/ksmbd: (159 commits) smb: server: let smb_direct_flush_send_list() invalidate a remote key first smb: server: make use of ib_alloc_cq_any() instead of ib_alloc_cq() smb: server: make consitent use of spin_lock_irq{save,restore}() in transport_rdma.c smb: server: let {free_transport,smb_direct_disconnect_rdma_{work,connection}}() wake up all wait queues smb: server: let smb_direct_disconnect_rdma_connection() disable all work but disconnect_work smb: server: fill in smbdirect_socket.first_error on error smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smb: server: pass struct smbdirect_socket to smb_direct_send_negotiate_response() smb: server: pass struct smbdirect_socket to {enqueue,get_first}_reassembly() smb: server: pass struct smbdirect_socket to smb_direct_post_send_data() smb: server: pass struct smbdirect_socket to post_sendmsg() smb: server: pass struct smbdirect_socket to smb_direct_create_header() smb: server: pass struct smbdirect_socket to manage_keep_alive_before_sending() smb: server: pass struct smbdirect_socket to manage_credits_prior_sending() smb: server: pass struct smbdirect_socket to calc_rw_credits() smb: server: pass struct smbdirect_socket to wait_for_rw_credits() smb: server: pass struct smbdirect_socket to wait_for_send_credits() smb: server: pass struct smbdirect_socket to wait_for_credits() smb: server: pass struct smbdirect_socket to smb_direct_flush_send_list() smb: server: pass struct smbdirect_socket to smb_direct_post_send() ... commit 98a4f5b7359205ced1b6a626df3963bf7c5e5052 Author: Jani Nurminen Date: Fri Sep 12 11:09:48 2025 +0200 PCI: xilinx-nwl: Fix ECAM programming When PCIe has been set up by the bootloader, the ecam_size field in the E_ECAM_CONTROL register already contains a value. The driver previously programmed it to 0xc (for 16 busses; 16 MB), but bumped to 0x10 (for 256 busses; 256 MB) by the commit 2fccd11518f1 ("PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses"). Regardless of what the bootloader has programmed, the driver ORs in a new maximal value without doing a proper RMW sequence. This can lead to problems. For example, if the bootloader programs in 0xc and the driver uses 0x10, the ORed result is 0x1c, which is beyond the ecam_max_size limit of 0x10 (from E_ECAM_CAPABILITIES). Avoid the problems by doing a proper RMW. Fixes: 2fccd11518f1 ("PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses") Signed-off-by: Jani Nurminen [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/e83a2af2-af0b-4670-bcf5-ad408571c2b0@windriver.com commit e445fba2d76369d72b497ecadf6b9787930693d9 Merge: a40eb50a956631 c91d38b57f2c47 Author: Linus Torvalds Date: Mon Sep 29 14:35:44 2025 -0700 Merge tag 'xfs-merge-6.18' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "For this merge window, there are really no new features, but there are a few things worth to emphasize: - Deprecated for years already, the (no)attr2 and (no)ikeep mount options have been removed for good - Several cleanups (specially from typedefs) and bug fixes - Improvements made in the online repair reap calculations - online fsck is now enabled by default" * tag 'xfs-merge-6.18' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (53 commits) xfs: rework datasync tracking and execution xfs: rearrange code in xfs_inode_item_precommit xfs: scrub: use kstrdup_const() for metapath scan setups xfs: use bt_nr_sectors in xfs_dax_translate_range xfs: track the number of blocks in each buftarg xfs: constify xfs_errortag_random_default xfs: improve default maximum number of open zones xfs: improve zone statistics message xfs: centralize error tag definitions xfs: remove pointless externs in xfs_error.h xfs: remove the expr argument to XFS_TEST_ERROR xfs: remove xfs_errortag_set xfs: remove xfs_errortag_get xfs: move the XLOG_REG_ constants out of xfs_log_format.h xfs: adjust the hint based zone allocation policy xfs: refactor hint based zone allocation fs: add an enum for number of life time hints xfs: fix log CRC mismatches between i386 and other architectures xfs: rename the old_crc variable in xlog_recover_process xfs: remove the unused xfs_log_iovec_t typedef ... commit a40eb50a9566318a138b3e222fc4fe04e3932cda Merge: f2c61db29f277b 28c4d9bc070895 Author: Linus Torvalds Date: Mon Sep 29 14:28:50 2025 -0700 Merge tag 'gfs2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Partially revert "gfs2: do_xmote fixes" to ignore dlm_lock() errors during withdraw; passing on those errors doesn't help - Change the LM_FLAG_TRY and LM_FLAG_TRY_1CB logic in add_to_queue() to check if the holder would actually block - Move some more dlm specific code from glock.c to lock_dlm.c - Remove the unused dlm alternate locking mode code - Add proper locking to make sure that dlm lockspaces are never used after being released - Various other cleanups * tag 'gfs2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Fix unlikely race in gdlm_put_lock gfs2: Add proper lockspace locking gfs2: Minor run_queue fixes gfs2: run_queue cleanup gfs2: Simplify do_promote gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote gfs2: Remove duplicate check in do_xmote gfs2: Fix LM_FLAG_TRY* logic in add_to_queue gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code gfs2: Further sanitize lock_dlm.c gfs2: Do not use atomic operations unnecessarily gfs2: Sanitize gfs2_meta_check, gfs2_metatype_check, gfs2_io_error gfs2: Turn gfs2_withdraw into a void function gfs2: Partially revert "gfs2: do_xmote fixes" gfs2: Simplify refcounting in do_xmote gfs2: do_xmote cleanup gfs2: Remove space before newline gfs2: Remove unused sd_withdraw_wait field gfs2: Remove unused GIF_FREE_VFS_INODE flag commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 Author: Duoming Zhou Date: Sat Sep 20 21:42:01 2025 +0800 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) mvs_pci_remove() | mvs_free() | mvs_work_queue() cancel_delayed_work() | kfree(mvi) | | mvi-> // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated. This bug was found by static analysis. Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") Signed-off-by: Duoming Zhou Signed-off-by: Martin K. Petersen commit 0ba7a254afd037cfc2b656f379c54b43c6e574e8 Author: Marek Szyprowski Date: Mon Sep 29 13:27:30 2025 +0200 scsi: ufs: core: Fix PM QoS mutex initialization hba->pm_qos_mutex is used very early as a part of ufshcd_init(), so it need to be initialized before that call. This fixes the following warning: ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:577 at __mutex_lock+0x268/0x894, CPU#4: kworker/u32:4/72 Modules linked in: CPU: 4 UID: 0 PID: 72 Comm: kworker/u32:4 Not tainted 6.17.0-rc7-next-20250926+ #11223 PREEMPT Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0x268/0x894 lr : __mutex_lock+0x268/0x894 ... Call trace: __mutex_lock+0x268/0x894 (P) mutex_lock_nested+0x24/0x30 ufshcd_pm_qos_update+0x30/0x78 ufshcd_setup_clocks+0x2d4/0x3c4 ufshcd_init+0x234/0x126c ufshcd_pltfrm_init+0x62c/0x82c ufs_qcom_probe+0x20/0x58 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0x40/0x164 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x80/0xdc __device_attach+0xa8/0x1b0 device_initial_probe+0x14/0x20 bus_probe_device+0xb0/0xb4 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x208/0x60c worker_thread+0x244/0x388 kthread+0x150/0x228 ret_from_fork+0x10/0x20 irq event stamp: 57267 hardirqs last enabled at (57267): [] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (57266): [] clk_enable_lock+0x7c/0xf0 softirqs last enabled at (56270): [] handle_softirqs+0x4c4/0x4dc softirqs last disabled at (56265): [] __do_softirq+0x14/0x20 ---[ end trace 0000000000000000 ]--- Fixes: 79dde5f7dc7c ("scsi: ufs: core: Fix data race in CPU latency PM QoS request handling") Signed-off-by: Marek Szyprowski Reviewed-by: Bart Van Assche Message-Id: <20250929112730.3782765-1-m.szyprowski@samsung.com> Signed-off-by: Martin K. Petersen commit f966e02ae52192928d544262ee7a68611e333031 Author: Peter Wang Date: Fri Sep 26 09:29:26 2025 +0800 scsi: ufs: core: Fix runtime suspend error deadlock Resolve the deadlock issue during runtime suspend when an error triggers the error handler. Prevent the deadlock by checking pm_op_in_progress and performing a quick recovery. This approach ensures that the error handler does not wait indefinitely for runtime PM to resume, allowing runtime suspend to proceed smoothly. Signed-off-by: Peter Wang Suggested-by: Bart Van Assche Reviewed-by: Bart Van Assche Message-Id: <20250926012940.3933367-1-peter.wang@mediatek.com> Signed-off-by: Martin K. Petersen commit f2c61db29f277b9c80de92102fc532cc247495cd Author: Linus Torvalds Date: Mon Sep 29 13:43:52 2025 -0700 Remove bcachefs core code bcachefs was marked 'externally maintained' in 6.17 but the code remained to make the transition smoother. It's now a DKMS module, making the in-kernel code stale, so remove it to avoid any version confusion. Link: https://lore.kernel.org/linux-bcachefs/yokpt2d2g2lluyomtqrdvmkl3amv3kgnipmenobkpgx537kay7@xgcgjviv3n7x/T/ Signed-off-by: Linus Torvalds commit 285654d58a747eb431ee538c803c077d90525674 Author: John Meneghini Date: Thu Sep 25 09:07:29 2025 -0400 Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue" This reverts commit 6f4b10226b6b1e7d1ff3cdb006cf0f6da6eed71e. We've been testing this patch and it turns out there is a significant bug here. This leaks memory and causes a driver hang. Link: https://lore.kernel.org/linux-scsi/yq1zfajqpec.fsf@ca-mkp.ca.oracle.com/ Signed-off-by: John Meneghini Acked-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen commit ee916dccd4df6e2fd19c3606c4735282b72f1473 Author: Linus Torvalds Date: Mon Sep 29 12:24:20 2025 -0700 Unbreak 'make tools/*' for user-space targets This pattern isn't very documented, and apparently not used much outside of 'make tools/help', but it has existed for over a decade (since commit ea01fa9f63ae: "tools: Connect to the kernel build system"). However, it doesn't work very well for most cases, particularly the useful "tools/all" target, because it overrides the LDFLAGS value with an empty one. And once overridden, 'make' will then not honor the tooling makefiles trying to change it - which then makes any LDFLAGS use in the tooling directory break, typically causing odd link errors. Remove that LDFLAGS override, since it seems to be entirely historical. The core kernel makefiles no longer modify LDFLAGS as part of the build, and use kernel-specific link flags instead (eg 'KBUILD_LDFLAGS' and friends). This allows more of the 'make tools/*' cases to work. I say 'more', because some of the tooling build rules make various other assumptions or have other issues, so it's still a bit hit-or-miss. But those issues tend to show up with the 'make -C tools xyz' pattern too, so now it's no longer an issue of this particular 'tools/*' build rule being special. Acked-by: Nathan Chancellor Cc: Nicolas Schier Cc: Borislav Petkov Signed-off-by: Linus Torvalds commit 29be241d11748dbcd9981587a85afa734942c885 Author: Markus Heidelberg Date: Fri Sep 26 15:15:20 2025 +0200 docs: networking: phy: clarify abbreviation "PAL" It is suddenly used in the text without introduction, so the meaning might have been unclear to readers. Signed-off-by: Markus Heidelberg Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250926131520.222346-1-m.heidelberg@cab.de Signed-off-by: Jakub Kicinski commit 2804359536275d8d5f92eb1949102eca4153ea1e Author: Markus Heidelberg Date: Fri Sep 26 15:13:23 2025 +0200 net: ethtool: remove duplicated mm.o from Makefile Fixes: 2b30f8291a30 ("net: ethtool: add support for MAC Merge layer") Signed-off-by: Markus Heidelberg Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250926131323.222192-1-m.heidelberg@cab.de Signed-off-by: Jakub Kicinski commit 449c2b302c8e200558619821ced46cc13cdb9aa6 Merge: 263e777ee3e00d 4f5ea5aa0dcdd3 Author: Linus Torvalds Date: Mon Sep 29 11:55:15 2025 -0700 Merge tag 'vfs-6.18-rc1.async' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs async directory updates from Christian Brauner: "This contains further preparatory changes for the asynchronous directory locking scheme: - Add lookup_one_positive_killable() which allows overlayfs to perform lookup that won't block on a fatal signal - Unify the mount idmap handling in struct renamedata as a rename can only happen within a single mount - Introduce kern_path_parent() for audit which sets the path to the parent and returns a dentry for the target without holding any locks on return - Rename kern_path_locked() as it is only used to prepare for the removal of an object from the filesystem: kern_path_locked() => start_removing_path() kern_path_create() => start_creating_path() user_path_create() => start_creating_user_path() user_path_locked_at() => start_removing_user_path_at() done_path_create() => end_creating_path() NA => end_removing_path()" * tag 'vfs-6.18-rc1.async' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: debugfs: rename start_creating() to debugfs_start_creating() VFS: rename kern_path_locked() and related functions. VFS/audit: introduce kern_path_parent() for audit VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata VFS: discard err2 in filename_create() VFS/ovl: add lookup_one_positive_killable() commit 263e777ee3e00d628ac2660f68c82aeab14707b3 Merge: 18b19abc3709b1 9426414f0d42f8 Author: Linus Torvalds Date: Mon Sep 29 11:34:40 2025 -0700 Merge tag 'vfs-6.18-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs writeback updates from Christian Brauner: "This contains work adressing lockups reported by users when a systemd unit reading lots of files from a filesystem mounted with the lazytime mount option exits. With the lazytime mount option enabled we can be switching many dirty inodes on cgroup exit to the parent cgroup. The numbers observed in practice when systemd slice of a large cron job exits can easily reach hundreds of thousands or millions. The logic in inode_do_switch_wbs() which sorts the inode into appropriate place in b_dirty list of the target wb however has linear complexity in the number of dirty inodes thus overall time complexity of switching all the inodes is quadratic leading to workers being pegged for hours consuming 100% of the CPU and switching inodes to the parent wb. Simple reproducer of the issue: FILES=10000 # Filesystem mounted with lazytime mount option MNT=/mnt/ echo "Creating files and switching timestamps" for (( j = 0; j < 50; j ++ )); do mkdir $MNT/dir$j for (( i = 0; i < $FILES; i++ )); do echo "foo" >$MNT/dir$j/file$i done touch -a -t 202501010000 $MNT/dir$j/file* done wait echo "Syncing and flushing" sync echo 3 >/proc/sys/vm/drop_caches echo "Reading all files from a cgroup" mkdir /sys/fs/cgroup/unified/mycg1 || exit echo $$ >/sys/fs/cgroup/unified/mycg1/cgroup.procs || exit for (( j = 0; j < 50; j ++ )); do cat /mnt/dir$j/file* >/dev/null & done wait echo "Switching wbs" # Now rmdir the cgroup after the script exits This can be solved by: - Avoiding contention on the wb->list_lock when switching inodes by running a single work item per wb and managing a queue of items switching to the wb - Allowing rescheduling when switching inodes over to a different cgroup to avoid softlockups - Maintaining the b_dirty list ordering instead of sorting it" * tag 'vfs-6.18-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: writeback: Add tracepoint to track pending inode switches writeback: Avoid excessively long inode switching times writeback: Avoid softlockup when switching many inodes writeback: Avoid contention on wb->list_lock when switching inodes commit 18b19abc3709b109676ffd1f48dcd332c2e477d4 Merge: 5484a4ea7a1f20 6e65f4e8fc5b02 Author: Linus Torvalds Date: Mon Sep 29 11:20:29 2025 -0700 Merge tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: "This contains a larger set of changes around the generic namespace infrastructure of the kernel. Each specific namespace type (net, cgroup, mnt, ...) embedds a struct ns_common which carries the reference count of the namespace and so on. We open-coded and cargo-culted so many quirks for each namespace type that it just wasn't scalable anymore. So given there's a bunch of new changes coming in that area I've started cleaning all of this up. The core change is to make it possible to correctly initialize every namespace uniformly and derive the correct initialization settings from the type of the namespace such as namespace operations, namespace type and so on. This leaves the new ns_common_init() function with a single parameter which is the specific namespace type which derives the correct parameters statically. This also means the compiler will yell as soon as someone does something remotely fishy. The ns_common_init() addition also allows us to remove ns_alloc_inum() and drops any special-casing of the initial network namespace in the network namespace initialization code that Linus complained about. Another part is reworking the reference counting. The reference counting was open-coded and copy-pasted for each namespace type even though they all followed the same rules. This also removes all open accesses to the reference count and makes it private and only uses a very small set of dedicated helpers to manipulate them just like we do for e.g., files. In addition this generalizes the mount namespace iteration infrastructure introduced a few cycles ago. As reminder, the vfs makes it possible to iterate sequentially and bidirectionally through all mount namespaces on the system or all mount namespaces that the caller holds privilege over. This allow userspace to iterate over all mounts in all mount namespaces using the listmount() and statmount() system call. Each mount namespace has a unique identifier for the lifetime of the systems that is exposed to userspace. The network namespace also has a unique identifier working exactly the same way. This extends the concept to all other namespace types. The new nstree type makes it possible to lookup namespaces purely by their identifier and to walk the namespace list sequentially and bidirectionally for all namespace types, allowing userspace to iterate through all namespaces. Looking up namespaces in the namespace tree works completely locklessly. This also means we can move the mount namespace onto the generic infrastructure and remove a bunch of code and members from struct mnt_namespace itself. There's a bunch of stuff coming on top of this in the future but for now this uses the generic namespace tree to extend a concept introduced first for pidfs a few cycles ago. For a while now we have supported pidfs file handles for pidfds. This has proven to be very useful. This extends the concept to cover namespaces as well. It is possible to encode and decode namespace file handles using the common name_to_handle_at() and open_by_handle_at() apis. As with pidfs file handles, namespace file handles are exhaustive, meaning it is not required to actually hold a reference to nsfs in able to decode aka open_by_handle_at() a namespace file handle. Instead the FD_NSFS_ROOT constant can be passed which will let the kernel grab a reference to the root of nsfs internally and thus decode the file handle. Namespaces file descriptors can already be derived from pidfds which means they aren't subject to overmount protection bugs. IOW, it's irrelevant if the caller would not have access to an appropriate /proc//ns/ directory as they could always just derive the namespace based on a pidfd already. It has the same advantage as pidfds. It's possible to reliably and for the lifetime of the system refer to a namespace without pinning any resources and to compare them trivially. Permission checking is kept simple. If the caller is located in the namespace the file handle refers to they are able to open it otherwise they must hold privilege over the owning namespace of the relevant namespace. The namespace file handle layout is exposed as uapi and has a stable and extensible format. For now it simply contains the namespace identifier, the namespace type, and the inode number. The stable format means that userspace may construct its own namespace file handles without going through name_to_handle_at() as they are already allowed for pidfs and cgroup file handles" * tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (65 commits) ns: drop assert ns: move ns type into struct ns_common nstree: make struct ns_tree private ns: add ns_debug() ns: simplify ns_common_init() further cgroup: add missing ns_common include ns: use inode initializer for initial namespaces selftests/namespaces: verify initial namespace inode numbers ns: rename to __ns_ref nsfs: port to ns_ref_*() helpers net: port to ns_ref_*() helpers uts: port to ns_ref_*() helpers ipv4: use check_net() net: use check_net() net-sysfs: use check_net() user: port to ns_ref_*() helpers time: port to ns_ref_*() helpers pid: port to ns_ref_*() helpers ipc: port to ns_ref_*() helpers cgroup: port to ns_ref_*() helpers ... commit cfcd6cab2f33c24a68517f9e3131480b4000c2be Author: Alok Tiwari Date: Fri Sep 5 14:14:34 2025 -0700 PCI: j721e: Fix incorrect error message in probe() The probe() function prints "pm_runtime_get_sync failed" when j721e_pcie_ctrl_init() returns an error. This is misleading since the failure is not from pm_runtime, but from the controller init routine. Update the error message to correctly reflect the source. No functional changes. Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") Signed-off-by: Alok Tiwari Signed-off-by: Manivannan Sadhasivam Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com commit 5484a4ea7a1f208b886b58dd55cc55f418930f8a Merge: 722df25ddf4f13 a19239ba14525c Author: Linus Torvalds Date: Mon Sep 29 10:53:22 2025 -0700 Merge tag 'vfs-6.18-rc1.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull afs updates from Christian Brauner: "This contains the change to enable afs to support RENAME_NOREPLACE and RENAME_EXCHANGE if the server supports it" * tag 'vfs-6.18-rc1.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: afs: Add support for RENAME_NOREPLACE and RENAME_EXCHANGE commit 722df25ddf4f13e303dcc4cd65b3df5b197a79e6 Merge: b7864056850879 76cea30ad52023 Author: Linus Torvalds Date: Mon Sep 29 10:36:50 2025 -0700 Merge tag 'kernel-6.18-rc1.clone3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull copy_process updates from Christian Brauner: "This contains the changes to enable support for clone3() on nios2 which apparently is still a thing. The more exciting part of this is that it cleans up the inconsistency in how the 64-bit flag argument is passed from copy_process() into the various other copy_*() helpers" [ Fixed up rv ltl_monitor 32-bit support as per Sasha Levin in the merge ] * tag 'kernel-6.18-rc1.clone3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nios2: implement architecture-specific portion of sys_clone3 arch: copy_thread: pass clone_flags as u64 copy_process: pass clone_flags as u64 across calltree copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) commit b786405685087912601e24d94c1670523c829137 Merge: df897265c0c6fc 56ce6c8b11a95c Author: Linus Torvalds Date: Mon Sep 29 10:27:17 2025 -0700 Merge tag 'vfs-6.18-rc1.workqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs workqueue updates from Christian Brauner: "This contains various workqueue changes affecting the filesystem layer. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This replaces the use of system_wq and system_unbound_wq. system_wq is a per-CPU workqueue which isn't very obvious from the name and system_unbound_wq is to be used when locality is not required. So this renames system_wq to system_percpu_wq, and system_unbound_wq to system_dfl_wq. This also adds a new WQ_PERCPU flag to allow the fs subsystem users to explicitly request the use of per-CPU behavior. Both WQ_UNBOUND and WQ_PERCPU flags coexist for one release cycle to allow callers to transition their calls. WQ_UNBOUND will be removed in a next release cycle" * tag 'vfs-6.18-rc1.workqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: WQ_PERCPU added to alloc_workqueue users fs: replace use of system_wq with system_percpu_wq fs: replace use of system_unbound_wq with system_dfl_wq commit df897265c0c6fc4b758b07f3a756e96b6f2ab81f Merge: e571372101522f c37adf34a5dc51 Author: Linus Torvalds Date: Mon Sep 29 10:23:02 2025 -0700 Merge tag 'vfs-6.18-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs rust updates from Christian Brauner: "This contains a few minor vfs rust changes: - Add the pid namespace Rust wrappers to the correct MAINTAINERS entry - Use to_result() in the Rust file error handling code - Update imports for fs and pid_namespce Rust wrappers" * tag 'vfs-6.18-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: rust: file: use to_result for error handling pid: add Rust files to MAINTAINERS rust: fs: update ARef and AlwaysRefCounted imports from sync::aref rust: pid_namespace: update AlwaysRefCounted imports from sync::aref commit e571372101522fa91735dac6d30a160b2abe600c Merge: 029a4eb5891294 da664c6db895f7 Author: Linus Torvalds Date: Mon Sep 29 10:02:35 2025 -0700 Merge tag 'vfs-6.18-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: "This just contains a few changes to pid_nr_ns() to make it more robust and cleans up or improves a few users that ab- or misuse it currently" * tag 'vfs-6.18-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: change task_state() to use task_ppid_nr_ns() pid: change bacct_add_tsk() to use task_ppid_nr_ns() pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers pid: Add a judgment for ns null in pid_nr_ns commit 029a4eb589129450f2735df825f784dd7e8c4c63 Merge: 56e7b310717697 c59c965292f75e Author: Linus Torvalds Date: Mon Sep 29 09:52:14 2025 -0700 Merge tag 'vfs-6.18-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs iomap updates from Christian Brauner: "This contains minor fixes and cleanups to the iomap code. Nothing really stands out here" * tag 'vfs-6.18-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: error out on file IO when there is no inline_data buffer iomap: trace iomap_zero_iter zeroing activities commit 56e7b310717697109998966cb3c4d3e490d09200 Merge: 3a2a5b278fb8d4 c3c616c53dbabd Author: Linus Torvalds Date: Mon Sep 29 09:42:30 2025 -0700 Merge tag 'vfs-6.18-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs inode updates from Christian Brauner: "This contains a series I originally wrote and that Eric brought over the finish line. It moves out the i_crypt_info and i_verity_info pointers out of 'struct inode' and into the fs-specific part of the inode. So now the few filesytems that actually make use of this pay the price in their own private inode storage instead of forcing it upon every user of struct inode. The pointer for the crypt and verity info is simply found by storing an offset to its address in struct fsverity_operations and struct fscrypt_operations. This shrinks struct inode by 16 bytes. I hope to move a lot more out of it in the future so that struct inode becomes really just about very core stuff that we need, much like struct dentry and struct file, instead of the dumping ground it has become over the years. On top of this are a various changes associated with the ongoing inode lifetime handling rework that multiple people are pushing forward: - Stop accessing inode->i_count directly in f2fs and gfs2. They simply should use the __iget() and iput() helpers - Make the i_state flags an enum - Rework the iput() logic Currently, if we are the last iput, and we have the I_DIRTY_TIME bit set, we will grab a reference on the inode again and then mark it dirty and then redo the put. This is to make sure we delay the time update for as long as possible We can rework this logic to simply dec i_count if it is not 1, and if it is do the time update while still holding the i_count reference Then we can replace the atomic_dec_and_lock with locking the ->i_lock and doing atomic_dec_and_test, since we did the atomic_add_unless above - Add an icount_read() helper and convert everyone that accesses inode->i_count directly for this purpose to use the helper - Expand dump_inode() to dump more information about an inode helping in debugging - Add some might_sleep() annotations to iput() and associated helpers" * tag 'vfs-6.18-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: add might_sleep() annotation to iput() and more fs: expand dump_inode() inode: fix whitespace issues fs: add an icount_read helper fs: rework iput logic fs: make the i_state flags an enum fs: stop accessing ->i_count directly in f2fs and gfs2 fsverity: check IS_VERITY() in fsverity_cleanup_inode() fs: remove inode::i_verity_info btrfs: move verity info pointer to fs-specific part of inode f2fs: move verity info pointer to fs-specific part of inode ext4: move verity info pointer to fs-specific part of inode fsverity: add support for info in fs-specific part of inode fs: remove inode::i_crypt_info ceph: move crypt info pointer to fs-specific part of inode ubifs: move crypt info pointer to fs-specific part of inode f2fs: move crypt info pointer to fs-specific part of inode ext4: move crypt info pointer to fs-specific part of inode fscrypt: add support for info in fs-specific part of inode fscrypt: replace raw loads of info pointer with helper function commit 3a2a5b278fb8d4cdb3154b8e4a38352b945f96fd Merge: 6c7ca6a02f8f95 1e5f0fb41fccf5 Author: Linus Torvalds Date: Mon Sep 29 09:32:34 2025 -0700 Merge tag 'vfs-6.18-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: "This contains some work around mount api handling: - Output the warning message for mnt_too_revealing() triggered during fsmount() to the fscontext log. This makes it possible for the mount tool to output appropriate warnings on the command line. For example, with the newest fsopen()-based mount(8) from util-linux, the error messages now look like: # mount -t proc proc /tmp mount: /tmp: fsmount() failed: VFS: Mount too revealing. dmesg(1) may have more information after failed mount system call. - Do not consume fscontext log entries when returning -EMSGSIZE Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case. Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. - Drop an unused argument from do_remount()" * tag 'vfs-6.18-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: fs/namespace.c: remove ms_flags argument from do_remount selftests/filesystems: add basic fscontext log tests fscontext: do not consume log entries when returning -EMSGSIZE vfs: output mount_too_revealing() errors to fscontext docs/vfs: Remove mentions to the old mount API helpers fscontext: add custom-prefix log helpers fs: Remove mount_bdev fs: Remove mount_nodev commit e51d05f523e43ce5d2bad957943a2b14f68078cd Author: Siddharth Vadapalli Date: Fri Sep 12 15:37:58 2025 +0530 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now. Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits. Fixes: 025dd3daeda7 ("PCI: keystone: Add error IRQ handler") Reported-by: Jiri Slaby Closes: https://lore.kernel.org/r/3d3a4b52-e343-42f3-9d69-94c259812143@kernel.org Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250912100802.3136121-2-s-vadapalli@ti.com commit 6c7ca6a02f8f9549a438a08a23c6327580ecf3d6 Author: Christian Brauner Date: Mon Sep 29 11:41:16 2025 +0200 mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. Handle that case gracefully. Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds commit b7ce6fa90fd9554482847b19756a06232c1dc78c Merge: fde0ab43b9a30d 28986dd7e38fb5 Author: Linus Torvalds Date: Mon Sep 29 09:03:07 2025 -0700 Merge tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains the usual selections of misc updates for this cycle. Features: - Add "initramfs_options" parameter to set initramfs mount options. This allows to add specific mount options to the rootfs to e.g., limit the memory size - Add RWF_NOSIGNAL flag for pwritev2() Add RWF_NOSIGNAL flag for pwritev2. This flag prevents the SIGPIPE signal from being raised when writing on disconnected pipes or sockets. The flag is handled directly by the pipe filesystem and converted to the existing MSG_NOSIGNAL flag for sockets - Allow to pass pid namespace as procfs mount option Ever since the introduction of pid namespaces, procfs has had very implicit behaviour surrounding them (the pidns used by a procfs mount is auto-selected based on the mounting process's active pidns, and the pidns itself is basically hidden once the mount has been constructed) This implicit behaviour has historically meant that userspace was required to do some special dances in order to configure the pidns of a procfs mount as desired. Examples include: * In order to bypass the mnt_too_revealing() check, Kubernetes creates a procfs mount from an empty pidns so that user namespaced containers can be nested (without this, the nested containers would fail to mount procfs) But this requires forking off a helper process because you cannot just one-shot this using mount(2) * Container runtimes in general need to fork into a container before configuring its mounts, which can lead to security issues in the case of shared-pidns containers (a privileged process in the pidns can interact with your container runtime process) While SUID_DUMP_DISABLE and user namespaces make this less of an issue, the strict need for this due to a minor uAPI wart is kind of unfortunate Things would be much easier if there was a way for userspace to just specify the pidns they want. So this pull request contains changes to implement a new "pidns" argument which can be set using fsconfig(2): fsconfig(procfd, FSCONFIG_SET_FD, "pidns", NULL, nsfd); fsconfig(procfd, FSCONFIG_SET_STRING, "pidns", "/proc/self/ns/pid", 0); or classic mount(2) / mount(8): // mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc mount("proc", "/tmp/proc", "proc", MS_..., "pidns=/proc/self/ns/pid"); Cleanups: - Remove the last references to EXPORT_OP_ASYNC_LOCK - Make file_remove_privs_flags() static - Remove redundant __GFP_NOWARN when GFP_NOWAIT is used - Use try_cmpxchg() in start_dir_add() - Use try_cmpxchg() in sb_init_done_wq() - Replace offsetof() with struct_size() in ioctl_file_dedupe_range() - Remove vfs_ioctl() export - Replace rwlock() with spinlock in epoll code as rwlock causes priority inversion on preempt rt kernels - Make ns_entries in fs/proc/namespaces const - Use a switch() statement() in init_special_inode() just like we do in may_open() - Use struct_size() in dir_add() in the initramfs code - Use str_plural() in rd_load_image() - Replace strcpy() with strscpy() in find_link() - Rename generic_delete_inode() to inode_just_drop() and generic_drop_inode() to inode_generic_drop() - Remove unused arguments from fcntl_{g,s}et_rw_hint() Fixes: - Document @name parameter for name_contains_dotdot() helper - Fix spelling mistake - Always return zero from replace_fd() instead of the file descriptor number - Limit the size for copy_file_range() in compat mode to prevent a signed overflow - Fix debugfs mount options not being applied - Verify the inode mode when loading it from disk in minixfs - Verify the inode mode when loading it from disk in cramfs - Don't trigger automounts with RESOLVE_NO_XDEV If openat2() was called with RESOLVE_NO_XDEV it didn't traverse through automounts, but could still trigger them - Add FL_RECLAIM flag to show_fl_flags() macro so it appears in tracepoints - Fix unused variable warning in rd_load_image() on s390 - Make INITRAMFS_PRESERVE_MTIME depend on BLK_DEV_INITRD - Use ns_capable_noaudit() when determining net sysctl permissions - Don't call path_put() under namespace semaphore in listmount() and statmount()" * tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits) fcntl: trim arguments listmount: don't call path_put() under namespace semaphore statmount: don't call path_put() under namespace semaphore pid: use ns_capable_noaudit() when determining net sysctl permissions fs: rename generic_delete_inode() and generic_drop_inode() init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD initramfs: Replace strcpy() with strscpy() in find_link() initrd: Use str_plural() in rd_load_image() initramfs: Use struct_size() helper to improve dir_add() initrd: Fix unused variable warning in rd_load_image() on s390 fs: use the switch statement in init_special_inode() fs/proc/namespaces: make ns_entries const filelock: add FL_RECLAIM to show_fl_flags() macro eventpoll: Replace rwlock with spinlock selftests/proc: add tests for new pidns APIs procfs: add "pidns" mount option pidns: move is-ancestor logic to helper openat2: don't trigger automounts with RESOLVE_NO_XDEV namei: move cross-device check to __traverse_mounts namei: remove LOOKUP_NO_XDEV check from handle_mounts ... commit 362f84c89e136539b8c3edb47f42fb06ce37bacf Author: Johan Hovold Date: Mon Sep 22 17:31:07 2025 +0200 mtd: rawnand: sunxi: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 2f05c108664056f91e5f9171169c685f517ac568 Author: Johan Hovold Date: Mon Sep 22 17:31:06 2025 +0200 mtd: rawnand: stm32_fmc2: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 61163e7373f678c453a4505865e0f8b27e506de8 Author: Johan Hovold Date: Mon Sep 22 17:31:05 2025 +0200 mtd: rawnand: rockchip: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 1f7005d382f567b25cfb96d9f201f5448cf67f9a Author: Johan Hovold Date: Mon Sep 22 17:31:04 2025 +0200 mtd: rawnand: pl353: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit b1a5c6de97b4c861c1ad1e7ad3818ebd32be190e Author: Johan Hovold Date: Mon Sep 22 17:31:03 2025 +0200 mtd: rawnand: omap2: drop unused module alias The driver only supports OF probing since commit 086c321ec57b ("mtd: nand: omap2: Remove omap_nand_platform_data") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 7a3f3c5bdecfe3cf6cdd35073c2729a46894a34d Author: Johan Hovold Date: Mon Sep 22 17:31:02 2025 +0200 mtd: rawnand: atmel: drop unused module alias The driver only supports OF probing since commit f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit cc74c3f8e4bc01ecf9849a2b22706ba96a29f749 Author: Johan Hovold Date: Mon Sep 22 17:31:01 2025 +0200 mtd: onenand: omap2: drop unused module alias The driver only supports OF probing since commit a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 192f981c14bfad4241446544cf0d27b9fa11a7bd Author: Johan Hovold Date: Mon Sep 22 17:31:00 2025 +0200 mtd: hyperbus: hbmc-am654: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 527668868862e0db65efc88fe82040f1e48d4ab3 Author: Rahul Kumar Date: Mon Sep 22 12:41:37 2025 +0530 mtd: jedec_probe: use struct_size() helper for cfiq allocation Documentation/process/deprecated.rst recommends against performing dynamic size calculations in the arguments of memory allocator functions due to the risk of overflow. Such calculations can wrap around and result in a smaller allocation than expected. Replace the size calculation in cfiq allocation with struct_size() helper to make the code clearer and handle overflows correctly. Signed-off-by: Rahul Kumar Signed-off-by: Miquel Raynal commit d496b6f42eb0455caf5d8cb30cf1f01b7fc2a747 Author: Gopi Krishna Menon Date: Fri Sep 19 00:14:14 2025 +0530 mtd: cfi: use struct_size() helper for cfiq allocation Documentation/process/deprecated.rst recommends against performing dynamic size calculations in the arguments of memory allocator function due to the risk of overflow. Such calculations can wrap around and result in a smaller allocation than what the caller was expecting. Replace the size calculation in cfiq allocation with struct_size() helper to make the code clearer and handle the overflows correctly. Signed-off-by: Gopi Krishna Menon Reviewed-by: Vignesh Raghavendra link: https://lore.kernel.org/linux-kernel-mentees/20250922071137.900508-1-rk0006818@gmail.com/T/#u Signed-off-by: Miquel Raynal commit 1001cc1171248ebb21d371fbe086b5d3f11b410b Author: Maarten Zanders Date: Mon Sep 22 17:39:38 2025 +0200 mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N Commit f04ced6d545e ("mtd: nand: raw: gpmi: improve power management handling") moved all clock handling into PM callbacks. With CONFIG_PM disabled, those callbacks are missing, leaving the driver unusable. Add clock init/teardown for !CONFIG_PM builds to restore basic operation. Keeping the driver working without requiring CONFIG_PM is preferred over adding a Kconfig dependency. Fixes: f04ced6d545e ("mtd: nand: raw: gpmi: improve power management handling") Signed-off-by: Maarten Zanders Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal commit fa1f26b48fe43195aa0ac4badf5651063590326f Author: Johan Hovold Date: Mon Sep 22 17:22:04 2025 +0200 mtd: rawnand: omap2: fix device leak on probe failure Make sure to drop the reference to the elm device taken by of_find_device_by_node() during probe on errors and on driver unload. Fixes: 62116e5171e0 ("mtd: nand: omap2: Support for hardware BCH error correction.") Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 Author: Erick Karanja Date: Mon Sep 22 14:07:27 2025 +0300 mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands In case of a jump to the err label due to atmel_nand_create() or atmel_nand_controller_add_nand() failure, the reference to nand_np need to be released Use for_each_child_of_node_scoped() to fix the issue. Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Signed-off-by: Erick Karanja Signed-off-by: Miquel Raynal commit 3148d0e5b1c5733d69ec51b70c8280e46488750a Author: Markus Stockhausen Date: Fri Sep 19 03:52:01 2025 -0400 mtd: nand: realtek-ecc: Add Realtek external ECC engine support The Realtek RTl93xx switch SoC series has a built in ECC controller that can provide BCH6 or BCH12 over 512 data and 6 tag bytes. It generates 10 (BCH6) or 20 (BCH12) bytes of parity. This engine will most likely work in conjunction with the Realtek spi-mem based NAND controller but can work on its own. Therefore the initial implementation will be of type external. Remark! The engine can support any data blocks that are multiples of 512 bytes. For now limit it to data+oob layouts that have been analyzed from existing devices. This way it keeps compatibility and pre-existing vendor data can be read. Signed-off-by: Markus Stockhausen Signed-off-by: Miquel Raynal commit 12bfcb84dc0852c97baff9ac1c0292a9db90c367 Author: Markus Stockhausen Date: Fri Sep 19 03:52:00 2025 -0400 dt-bindings: mtd: Add realtek,rtl9301-ecc Add a dtschema for the ECC engine on the Realtek RTL93xx SoCs. The engine supports BCH6 and BCH12 parity for 512 byte blocks. The hardware can make use of interrupts but this is not yet supported by the driver. From the known datasheets it is connected to the LXB (lexra bus) and propably depends on its clock. Provide an optional clock property that can describe the relation. Signed-off-by: Markus Stockhausen Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 Author: Linus Torvalds Date: Mon Sep 29 08:54:12 2025 -0700 Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with a working compiler it will fail on some architectures simply because it uses the mnemonic "jmp" for testing the inline asm. And as reported by Geert, not all architectures use that mnemonic, so the test fails spuriously on such platforms (including arm and riscv, but also several other architectures). This issue avoided any obvious test failures because the build still works thanks to falling back on the old non-asm-goto code, which just generates worse code. Just use an empty asm statement instead. Reported-and-tested-by: Geert Uytterhoeven Suggested-by: Peter Zijlstra Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17") Cc: Nathan Chancellor Cc: Thomas Gleixner Signed-off-by: Linus Torvalds commit 010dc7f2dd6a0078ade3f88f627ed5fbf45ceb94 Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:54:01 2025 +0300 mtd: spinand: repeat reading in regular mode if continuous reading fails Continuous reading may result in multiple flash pages reading in one operation. Unfortunately, not all spinand controllers support such large reading. They will read less data. Unfortunately, the operation can't be continued. In this case: * disable continuous reading on this (not good enough) spi controller * repeat reading in regular mode. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit 004f8ea0d9917398aabff7388b3bf62a84a4088b Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:54:00 2025 +0300 mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails Continuous reading may result in multiple flash pages reading in one operation. Typically only one flash page has read/written (a little bit more than 2-4 Kb), but continuous reading requires the spi controller to read up to 512 Kb in one operation without toggling CS in beetween. Roughly speaking spi controllers can be divided on 2 categories: * spi controllers without dirmap acceleration support * spi controllers with dirmap acceleration support Firt of them will have issues with continuous reading if restriction on the transfer length is implemented in the adjust_op_size() handler. Second group often supports acceleration of single page only reading. Thus enabling of continuous reading can break flash reading. This patch tries to create dirmap for continuous reading first and fallback to regular reading if spi controller refuses to create it. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit e4a0cf9f1d90e6888e5373da3314f761024f6c97 Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:53:59 2025 +0300 mtd: spinand: fix direct mapping creation sizes Continuous mode is only supported for data reads, thus writing requires only single flash page mapping. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit 99da5bf3dd6a8cb951adcace6153c34c86547811 Author: Lenny Szubowicz Date: Tue Sep 16 15:38:53 2025 -0400 efi/x86: Memory protection on EfiGcdMemoryTypeMoreReliable Check for needed memory protection changes on EFI DXE GCD memory space descriptors with type EfiGcdMemoryTypeMoreReliable in addition to EfiGcdMemoryTypeSystemMemory. This fixes a fault on entry into the decompressed kernel from the EFI stub that occurs when the memory allocated for the decompressed kernel is more reliable memory, has NX/XP set, and the kernel needs to use the EFI DXE protocol to adjust memory protections. The memory descriptors returned by the DXE protocol GetMemorySpaceDescriptor() service use a different GCD memory type to distinguish more reliable memory ranges from their conventional counterparts. This is in contrast to the EFI memory descriptors returned by the EFI GetMemoryMap() service which use the EFI_MEMORY_MORE_RELIABLE memory attributes flag to identify EFI_CONVENTIONAL_MEMORY type regions that have this additional property. Signed-off-by: Lenny Szubowicz Signed-off-by: Ard Biesheuvel commit 5c34f2b6f89ad4f31db15f9c658b597e23bacdf8 Author: Jiapeng Chong Date: Sun Sep 28 09:31:10 2025 +0800 nvdimm: Remove duplicate linux/slab.h header ./drivers/nvdimm/bus.c: linux/slab.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25516 Signed-off-by: Jiapeng Chong Signed-off-by: Ira Weiny commit d5e58ce1fb0f13a9a0845851f267ede3551cd9fe Author: Rafael J. Wysocki Date: Fri Sep 26 18:26:40 2025 +0200 PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() The DEFINE_FREE() for pm_runtime_put has been superseded by recently introduced runtime PM auto-cleanup macros and its only user has been converted to using one of the new macros, so drop it. Signed-off-by: Rafael J. Wysocki Reviewed-by: Dhruva Gole Reviewed-by: Takashi Iwai Reviewed-by: Jonathan Cameron commit 8ff5aaa7b8c9fb3e66df6f440ee109d00f8d7a1b Author: Rafael J. Wysocki Date: Fri Sep 26 18:24:05 2025 +0200 PCI/sysfs: Use runtime PM guard macro for auto-cleanup Use the newly introduced pm_runtime_active_try guard to simplify the code and add the proper error handling for PM runtime resume errors. Based on an earlier patch from Takashi Iwai [1]. Link: https://patch.msgid.link/20250919163147.4743-3-tiwai@suse.de [1] Acked-by: Bjorn Helgaas Signed-off-by: Rafael J. Wysocki Reviewed-by: Takashi Iwai Reviewed-by: Jonathan Cameron commit 9a0abc39450a3123fd52533a662fbd37e0d1508c Author: Rafael J. Wysocki Date: Fri Sep 26 17:47:14 2025 +0200 PM: runtime: Add auto-cleanup macros for "resume and get" operations It is generally useful to be able to automatically drop a device's runtime PM usage counter incremented by runtime PM operations that resume a device and bump up its usage counter [1]. To that end, add guard definition macros allowing pm_runtime_put() and pm_runtime_put_autosuspend() to be used for the auto-cleanup in those cases. Simply put, a piece of code like below: pm_runtime_get_sync(dev); ..... pm_runtime_put(dev); return 0; can be transformed with guard() like: guard(pm_runtime_active)(dev); ..... return 0; (see the pm_runtime_put() call is gone). However, it is better to do proper error handling in the majority of cases, so doing something like this instead of the above is recommended: ACQUIRE(pm_runtime_active_try, pm)(dev); if (ACQUIRE_ERR(pm_runtime_active_try, &pm)) return -ENXIO; ..... return 0; In all of the cases in which runtime PM is known to be enabled for the given device or the device can be regarded as operational (and so it can be accessed) with runtime PM disabled, a piece of code like: ret = pm_runtime_resume_and_get(dev); if (ret < 0) return ret; ..... pm_runtime_put(dev); return 0; can be changed as follows: ACQUIRE(pm_runtime_active_try, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_try, &pm); if (ret < 0) return ret; ..... return 0; (again, see the pm_runtime_put() call is gone). Still, if the device cannot be accessed unless runtime PM has been enabled for it, the pm_runtime_active_try_enabled guard variant needs to be used, that is (in the context of the example above): ACQUIRE(pm_runtime_active_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; When the original code calls pm_runtime_put_autosuspend(), use one of the "auto" guard variants, pm_runtime_active_auto/_try/_enabled, so for example, a piece of code like: ret = pm_runtime_resume_and_get(dev); if (ret < 0) return ret; ..... pm_runtime_put_autosuspend(dev); return 0; will become: ACQUIRE(pm_runtime_active_auto_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_auto_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; Note that the cases in which the return value of pm_runtime_get_sync() is checked can also be handled with the help of the new guard macros. For example, a piece of code like: ret = pm_runtime_get_sync(dev); if (ret < 0) { pm_runtime_put(dev); return ret; } ..... pm_runtime_put(dev); return 0; can be rewritten as: ACQUIRE(pm_runtime_active_auto_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_auto_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; or pm_runtime_get_active_try can be used if transparent handling of disabled runtime PM is desirable. Link: https://lore.kernel.org/linux-pm/878qimv24u.wl-tiwai@suse.de/ [1] Link: https://lore.kernel.org/linux-pm/20250926150613.000073a4@huawei.com/ Signed-off-by: Rafael J. Wysocki Acked-by: Dan Williams Reviewed-by: Takashi Iwai Link: https://patch.msgid.link/2238241.irdbgypaU6@rafael.j.wysocki [ rjw: Fixed leftovers from the previous version in the changelog ] Reviewed-by: Jonathan Cameron Reviewed-by: Dhruva Gole Signed-off-by: Rafael J. Wysocki commit c87072064bd482930a021e88c11f438e780d36de Merge: 02e9542558b8ee 7d444f50999709 39c87887606e51 b8db5517fe5265 Author: Rafael J. Wysocki Date: Mon Sep 29 15:28:51 2025 +0200 Merge branches 'acpi-apei', 'acpi-misc' and 'pnp' Merge ACPI APEI updates, a miscellaneous update related to ACPI, and a PNP update for 6.18-rc1: - Remove redundant assignments in erst_dbg_{ioctl|write}() in the ACPI APEI driver (Thorsten Blum) - Allow the ACPI APEI EINJ to handle more types of addresses than just MMIO (Jiaqi Yan) - Use str_low_high() helper in two places in the ACPI code (Chelsy Ratnawat) - Use str_plural() to simplify the PNP code (Xichao Zhao) * acpi-apei: ACPI: APEI: EINJ: Allow more types of addresses except MMIO ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() * acpi-misc: ACPI: Use str_low_high() helper in two places * pnp: PNP: isapnp: use str_plural() to simplify the code commit 02e9542558b8ee09994394cb6e06a1e4f0bf6f41 Merge: 6173176cf2fe7c 3f6b537a13c815 7a9490a1c929e0 f144bc21befdcf 4aac453deca0d9 311942ce763e21 Author: Rafael J. Wysocki Date: Mon Sep 29 15:23:52 2025 +0200 Merge branches 'acpi-thermal', 'acpi-fan', 'acpi-video', 'acpi-tad' and 'acpi-prm' Merge an ACPI thermal zone driver update, an ACPI fan driver update, an ACPI backlight (video) driver update, an ACPI TAD (time and alarm device) driver update, and an ACPI PRM (platform runtime mechanism) driver update for 6.18-rc1: - Eliminate a dummy local variable from the ACPI thermal driver (Rafael Wysocki) - Fold two simple functions into their only caller in the ACPI fan driver (Rafael Wysocki) - Force native backlight on Lenovo 82K8 in the ACPI backlight (video) driver (Mario Limonciello) - Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang) - Skip PRM handlers with NULL handler_address or NULL VA in the ACPI PRM driver (Shang song) * acpi-thermal: ACPI: thermal: Get rid of a dummy local variable * acpi-fan: ACPI: fan: Fold two simple functions into their only caller * acpi-video: ACPI: video: force native for Lenovo 82K8 * acpi-tad: ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT * acpi-prm: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA commit 6173176cf2fe7c518e2b112359c98c145acd59d6 Merge: be61a778185f4f 0f83b1d436c980 3a351de0d9c86e 0467ed880a17c2 4d330fe54145ec Author: Rafael J. Wysocki Date: Mon Sep 29 15:14:29 2025 +0200 Merge branches 'acpi-property', 'acpi-resource', 'acpi-pm' and 'acpi-tables' Merge updates of the ACPI device properties management code, ACPI resources management code, ACPI power management, and ACPI data tables parsing code for 6.18-rc1: - Fix ACPI buffer properties extraction for data-only subnodes represented as _DSD-equivalent packages (Rafael Wysocki) - Fix handling of ACPI data-only subnodes represented as _DSD-equivalent packages in the case when they are embedded in larger _DSD-equivalent packages and clean up acpi_nondev_subnode_extract() (Rafael Wysocki) - Skip ACPI IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen) - Add power resource init function and use it for introducing an HP EliteBook 855 G7 WWAN modem power resource quirk (Maciej Szmigiero) - Add support for DBG2 RISC-V SBI port subtype and Precise Baud Rate field to the ACPI SPCR table parser (Chen Pei) * acpi-property: ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() ACPI: property: Do not pass NULL handles to acpi_attach_data() ACPI: property: Add code comments explaining what is going on ACPI: property: Disregard references in data-only subnode lists ACPI: property: Fix buffer properties extraction for subnodes * acpi-resource: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU * acpi-pm: ACPI: PM: Add HP EliteBook 855 G7 WWAN modem power resource quirk ACPI: PM: Add power resource init function * acpi-tables: ACPI: SPCR: Support Precise Baud Rate field ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype commit be61a778185f4f41e2a94bc35cb438c6fab5d4db Merge: ab80f7707d4d6c 4405a214df1467 559f2eacc8a23c 149139ddcb9958 Author: Rafael J. Wysocki Date: Mon Sep 29 15:12:52 2025 +0200 Merge branches 'acpi-scan', 'acpi-processor' and 'acpi-sysfs' Merge an ACPI device enumeration update, ACPI processor driver updates, and an ACPI sysfs-related code update for 6.18-rc1: - Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] so it is not regarded as real dependency (Hans de Goede) - Use ACPI_FREE() for freeing an ACPI object in description_show() in the ACPI sysfs-related code (Kaushlendra Kumar) - Fix memory leak in the ACPI processor idle driver registration error code path and optimize ACPI idle driver registration (Huisong Li, Rafael Wysocki) - Add module import namespace to the ACPI processor idle driver (Rafael Wysocki) - Eliminate static variable flat_state_cnt from the ACPI processor idle driver (Rafael Wysocki) - Release cpufreq policy references using __free() in the ACPI processor thremal driver (Zihuan Zhang) - Remove unused empty stubs of some functions and rearrange function declarations in a header file in the ACPI processor driver (Huisong Li) - Redefine two functions as void in the ACPI processor driver (Rafael Wysocki) - Do not expose global variable acpi_idle_driver in the ACPI processor driver (Huisong Li) * acpi-scan: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] * acpi-processor: ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: thermal: Release policy references using __free() ACPI: processor: idle: Fix function defined but not used warning ACPI: processor: idle: Eliminate static variable flat_state_cnt ACPI: processor: idle: Add module import namespace ACPI: processor: idle: Optimize ACPI idle driver registration ACPI: processor: idle: Fix memory leak when register cpuidle device failed * acpi-sysfs: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object commit ab80f7707d4d6c0ab5103377bde2debdd449fcbf Merge: 496f9372eae147 54ba9071a04b0d Author: Rafael J. Wysocki Date: Mon Sep 29 15:10:54 2025 +0200 Merge branch 'acpica' Merge ACPICA updates (20250807 release material with a few fixes on top) for 6.18-rc1: - Add SoundWire File Table (SWFT) signature to ACPICA (Maciej Strozek) - Rearrange local variable definition involving #ifdef in ACPICA to avoid using uninitialized variables (Zhe Qiao) - Allow ACPICA to skip Global Lock initialization (Huacai Chen) - Apply ACPI_NONSTRING in more places in ACPICA and fix two regressions related to incorrect ACPI_NONSTRING usage (Ahmed Salem) - Fix printing CDAT table header when dissasebling CDAT AML (Ahmed Salem) - Use acpi_ds_clear_operands() in acpi_ds_call_control_method() in ACPICA (Hans de Goede) - Update dsmethod.c in ACPICA to address unused variable warning (Saket Dumbre) - Print error messages in ACPICA for too few or too many control method arguments (Saket Dumbre) - Update ACPICA version to 20250807 (Saket Dumbre) - Fix largest possible resource descriptor index in ACPICA (Dmitry Antipov) - Add Back-Invalidate restriction to CXL Window for CEDT in ACPICA (Davidlohr Bueso). - Add the package type to acceptable Arg3 types for _DSM in ACPICA because ACPI_TYPE_ANY does not cover it (Saket Dumbre) - Fix return values in ap_is_valid_checksum() in the acpidump utility in ACPICA (Kaushlendra Kumar) * acpica: ACPICA: acpidump: fix return values in ap_is_valid_checksum() ACPICA: ACPI_TYPE_ANY does not include the package type ACPICA: CEDT: Add Back-Invalidate restriction to CXL Window ACPICA: Fix largest possible resource descriptor index ACPICA: Update version to 20250807 ACPICA: Print error messages for too few or too many arguments ACPICA: Update dsmethod.c to get rid of unused variable warning ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() ACPICA: Debugger: drop ACPI_NONSTRING attribute from name_seg ACPICA: acpidump: drop ACPI_NONSTRING attribute from file_name ACPICA: iASL: Fix printing CDAT table header ACPICA: Apply ACPI_NONSTRING ACPICA: Allow to skip Global Lock initialization ACPICA: Change the compilation conditions ACPICA: Remove redundant "#ifdef" definitions ACPICA: Modify variable definition position ACPICA: Add SoundWire File Table (SWFT) signature commit 4335edb7138b45abab65f01d2be77a9be9cfd2fe Author: Heiko Carstens Date: Thu Sep 25 10:45:18 2025 +0200 s390: Remove superfluous newlines from inline assemblies Remove superfluous newlines from inline assemblies. Compilers use the number of lines of inline assemblies as heuristic for the complexity and inline decisions. Therefore inline assemblies should only contain as many lines as required. A lot of inline assemblies contain a superfluous newline for the last line. Remove such newlines to improve compiler inlining decisions. Suggested-by: Juergen Christ Signed-off-by: Heiko Carstens Reviewed-by: Alexander Gordeev Reviewed-by: Juergen Christ Signed-off-by: Alexander Gordeev commit f0edc8f113a39d1c9f8cf83e865c32b0668d80e0 Author: Heiko Carstens Date: Thu Sep 25 10:45:17 2025 +0200 s390/cio/ioasm: Fix __xsch() condition code handling For the __xsch() inline assembly the conversion to flag output macros is incomplete. Only the conditional shift of the return value was added, while the required changes to the inline assembly itself are missing. If compiled with GCC versions before 14.2 this leads to a double shift of the cc output operand and therefore the returned value of __xsch() is incorrectly always zero, instead of the expected condition code. Fixes: e200565d434b ("s390/cio/ioasm: Convert to use flag output macros") Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Acked-by: Alexander Gordeev Reviewed-by: Juergen Christ Signed-off-by: Alexander Gordeev commit fa7a0a53eeb7e16402f82c3d5a9ef4bf5efe9357 Author: Heiko Carstens Date: Fri Sep 26 15:39:10 2025 +0200 s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR If the decompressor is compiled with clang this can lead to the following warning: In file included from arch/s390/boot/startup.c:4: ... In file included from ./include/linux/pgtable.h:6: ./arch/s390/include/asm/pgtable.h:2065:48: warning: passing 'unsigned long *' to parameter of type 'long *' converts between pointers to integer types with different sign [-Wpointer-sign] 2065 | value = __atomic64_or_barrier(PGSTE_PCL_BIT, ptr); Add -Wno-pointer-sign to the decompressor compile flags, like it is also done for the kernel. This is similar to what was done for x86 to address the same problem [1]. [1] commit dca5203e3fe2 ("x86/boot: Add -Wno-pointer-sign to KBUILD_CFLAGS") Cc: stable@vger.kernel.org Reported-by: Gerd Bayer Signed-off-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit 27e06650a5eafe832a90fd2604f0c5e920857fae Author: Wang Haoran Date: Sat Sep 20 15:44:41 2025 +0800 scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow. Reported-by: Wang Haoran Reported-by: ziiiro Signed-off-by: Wang Haoran Signed-off-by: Martin K. Petersen commit 40d2cf9c3c1a5a1a9a443389d6b57a87362e4237 Merge: f58f86df6acb51 17eb8812917b10 Author: Rafael J. Wysocki Date: Mon Sep 29 13:10:10 2025 +0200 Merge branch 'pm-tools' Merge power management utilities updates for 6.18-rc1: - Fix and clean up the x86_energy_perf_policy utility and update its documentation (Len Brown, Kaushlendra Kumar) - Fix incorrect sorting of PMT telemetry in turbostat (Kaushlendra Kumar) - Fix incorrect size in cpuidle_state_disable() and the error return value of cpupower_write_sysfs() in cpupower (Kaushlendra Kumar) * pm-tools: tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/cpupower: fix error return value in cpupower_write_sysfs() commit f58f86df6acb51b19edebffa16c439938c9647bc Merge: 101642e43de154 3ce3f569991347 927f3e85015285 1f5bcfe91ffce7 Author: Rafael J. Wysocki Date: Mon Sep 29 12:54:01 2025 +0200 Merge branches 'pm-core', 'pm-runtime' and 'pm-sleep' Merge changes related to system sleep and runtime PM framework for 6.18-rc1: - Annotate loops walking device links in the power management core code as _srcu and add macros for walking device links to reduce the likelihood of coding mistakes related to them (Rafael Wysocki) - Document time units for *_time functions in the runtime PM API (Brian Norris) - Clear power.must_resume in noirq suspend error path to avoid resuming a dependant device under a suspended parent or supplier (Rafael Wysocki) - Fix GFP mask handling during hybrid suspend and make the amdgpu driver handle hybrid suspend correctly (Mario Limonciello, Rafael Wysocki) - Fix GFP mask handling after aborted hibernation in platform mode and combine exit paths in power_down() to avoid code duplication (Rafael Wysocki) - Use vmalloc_array() and vcalloc() in the hibernation core to avoid open-coded size computations (Qianfeng Rong) - Fix typo in hibernation core code comment (Li Jun) - Call pm_wakeup_clear() in the same place where other functions that do bookkeeping prior to suspend_prepare() are called (Samuel Wu) * pm-core: PM: core: Add two macros for walking device links PM: core: Annotate loops walking device links as _srcu * pm-runtime: PM: runtime: Documentation: ABI: Document time units for *_time * pm-sleep: PM: hibernate: Combine return paths in power_down() PM: hibernate: Restrict GFP mask in power_down() PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage drm/amd: Fix hybrid sleep PM: hibernate: Add pm_hibernation_mode_is_suspend() PM: hibernate: Fix hybrid-sleep PM: sleep: core: Clear power.must_resume in noirq suspend error path PM: sleep: Make pm_wakeup_clear() call more clear PM: hibernate: Fix typo in memory bitmaps description comment PM: hibernate: Use vmalloc_array() and vcalloc() to improve code commit 101642e43de15485cce7ac24ccaf6ab0fd0f0563 Merge: d6fd599cd4d8af 7b1b7961170e4f 03cf825911c95f Author: Rafael J. Wysocki Date: Mon Sep 29 12:47:06 2025 +0200 Merge branches 'pm-cpuidle' and 'pm-powercap' Merge cpuidle and power capping changes for 6.18-rc1: - Fail cpuidle device registration if there is one already to avoid sysfs-related issues (Rafael Wysocki) - Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() in cpuidle (Vivek Yadav) - Fix device and OF node leaks at probe in the qcom-spm cpuidle driver and drop unnecessary initialisations from it (Johan Hovold) - Remove unnecessary address-of operators from the intel_idle cpuidle driver (Kaushlendra Kumar) - Rearrange main loop in menu_select() to make the code in that funtion easier to follow (Rafael Wysocki) - Convert values in microseconds to ktime using us_to_ktime() where applicable in the intel_idle power capping driver (Xichao Zhao) * pm-cpuidle: cpuidle: Fail cpuidle device registration if there is one already cpuidle: sysfs: Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() cpuidle: qcom-spm: drop unnecessary initialisations cpuidle: qcom-spm: fix device and OF node leaks at probe intel_idle: Remove unnecessary address-of operators cpuidle: governors: menu: Rearrange main loop in menu_select() * pm-powercap: powercap: idle_inject: use us_to_ktime() where appropriate commit d6fd599cd4d8afb604d5c0b5f5d20a1484942eef Merge: d3f8f8d03061d2 1ebe8f7e782523 8646f111fae02f 531453a36c1391 Author: Rafael J. Wysocki Date: Mon Sep 29 12:30:44 2025 +0200 Merge branches 'pm-em', 'pm-opp' and 'pm-devfreq' Merge energy model management, OPP (operating performance points) and devfreq updates for 6.18-rc1: - Prevent CPU capacity updates after registering a perf domain from failing on a first CPU that is not present (Christian Loehle) - Add support for the cases in which frequency alone is not sufficient to uniquely identify an OPP (Krishna Chaitanya Chundru) - Use to_result() for OPP error handling in Rust (Onur Özkan) - Add support for LPDDR5 on Rockhip RK3588 SoC to rockchip-dfi devfreq driver (Nicolas Frattaroli) - Fix an issue where DDR cycle counts on RK3588/RK3528 with LPDDR4(X) are reported as half by adding a cycle multiplier to the DFI driver in rockchip-dfi devfreq-event driver (Nicolas Frattaroli) - Fix missing error pointer dereference check of regulator instance in the mtk-cci devfreq driver probe and remove a redundant condition from an if () statement in that driver (Dan Carpenter, Liao Yuanhong) * pm-em: PM: EM: Fix late boot with holes in CPU topology * pm-opp: OPP: Add support to find OPP for a set of keys rust: opp: use to_result for error handling * pm-devfreq: PM / devfreq: rockchip-dfi: add support for LPDDR5 PM / devfreq: rockchip-dfi: double count on RK3588 PM / devfreq: mtk-cci: avoid redundant conditions PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() commit ba6018929165fc914c665f071f8e8cdbac844a49 Author: Aaron Kling Date: Thu Aug 28 21:48:13 2025 -0500 cpufreq: tegra186: Initialize all cores to max frequencies During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores are still at reset values and not reflecting the actual frequency. This causes get calls to fail. Set all cores to their respective max frequency during probe to initialize the registers to working values. Suggested-by: Mikko Perttunen Signed-off-by: Aaron Kling Reviewed-by: Mikko Perttunen Signed-off-by: Viresh Kumar commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 Author: Aaron Kling Date: Thu Aug 28 21:48:12 2025 -0500 cpufreq: tegra186: Set target frequency for all cpus in policy The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency. Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") Signed-off-by: Aaron Kling Reviewed-by: Mikko Perttunen Signed-off-by: Viresh Kumar commit 24287f902095d845c6af9c2c369ba96877f5eb79 Author: Thorsten Blum Date: Mon Sep 15 15:59:54 2025 +0200 rust: cpufreq: streamline find_supply_names Remove local variables from find_supply_names() and use .and_then() with the more concise kernel::kvec![] macro, instead of KVec::with_capacity() followed by .push() and Some(). No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Viresh Kumar commit ebc4ed14a4dbf51307102bb7ffc82ed6c16a37c2 Author: Johan Hovold Date: Tue Sep 9 09:38:19 2025 +0200 cpufreq: mediatek: fix device leak on probe failure Make sure to drop the reference to the cci device taken by of_find_device_by_node() on probe failure (e.g. probe deferral). Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU") Cc: Jia-Wei Chang Cc: Rex-BC Chen Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Viresh Kumar commit 17eb8812917b10ce4146b5595f91d8e45bfe68cc Merge: 57610d69f909ea 23199d2aa6dcaf Author: Rafael J. Wysocki Date: Mon Sep 29 10:10:05 2025 +0200 Merge tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge cpupower utility updates for 6.18-rc1 from Shuah Khan: "Fixes incorrect return vale in cpupower_write_sysfs() error path and passing incorrect size to cpuidle_state_write_file() while writing status to disable file in cpuidle_state_disable()." * tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: (1125 commits) tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/cpupower: fix error return value in cpupower_write_sysfs() Linux 6.17-rc6 MAINTAINERS: Input: Drop melfas-mip4 section USB: core: remove the move buf action MAINTAINERS: Update the DMA Rust entry erofs: fix long xattr name prefix placement Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" hsr: hold rcu and dev lock for hsr_get_port_ndev hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr hsr: use rtnl lock when iterating over ports wifi: nl80211: completely disable per-link stats for now net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info selftests/bpf: Skip timer cases when bpf_timer is not supported bpf: Reject bpf_timer for PREEMPT_RT libceph: fix invalid accesses to ceph_connection_v1_info PM: hibernate: Restrict GFP mask in hibernation_snapshot() MAINTAINERS: add Phil as netfilter reviewer netfilter: nf_tables: restart set lookup on base_seq change ... commit ca74b8cadaad4b179f77f1f4dc3d288be9a580f1 Merge: b9120619246d73 af92793e52c3a9 Author: Vlastimil Babka Date: Fri Sep 26 15:50:25 2025 +0200 Merge series "slab: Re-entrant kmalloc_nolock()" From the cover letter [1]: This patch set introduces kmalloc_nolock() which is the next logical step towards any context allocation necessary to remove bpf_mem_alloc and get rid of preallocation requirement in BPF infrastructure. In production BPF maps grew to gigabytes in size. Preallocation wastes memory. Alloc from any context addresses this issue for BPF and other subsystems that are forced to preallocate too. This long task started with introduction of alloc_pages_nolock(), then memcg and objcg were converted to operate from any context including NMI, this set completes the task with kmalloc_nolock() that builds on top of alloc_pages_nolock() and memcg changes. After that BPF subsystem will gradually adopt it everywhere. Link: https://lore.kernel.org/all/20250909010007.1660-1-alexei.starovoitov@gmail.com/ [1] commit b9120619246d733a27e5e93c29e86f2e0401cfc5 Merge: f7381b9116407b 719a42e563bb08 Author: Vlastimil Babka Date: Fri Sep 26 14:51:17 2025 +0200 Merge series "SLUB percpu sheaves" This series adds an opt-in percpu array-based caching layer to SLUB. It has evolved to a state where kmem caches with sheaves are compatible with all SLUB features (slub_debug, SLUB_TINY, NUMA locality considerations). The plan is therefore that it will be later enabled for all kmem caches and replace the complicated cpu (partial) slabs code. Note the name "sheaf" was invented by Matthew Wilcox so we don't call the arrays magazines like the original Bonwick paper. The per-NUMA-node cache of sheaves is thus called "barn". This caching may seem similar to the arrays we had in SLAB, but there are some important differences: - deals differently with NUMA locality of freed objects, thus there are no per-node "shared" arrays (with possible lock contention) and no "alien" arrays that would need periodical flushing - instead, freeing remote objects (which is rare) bypasses the sheaves - percpu sheaves thus contain only local objects (modulo rare races and local node exhaustion) - NUMA restricted allocations and strict_numa mode is still honoured - improves kfree_rcu() handling by reusing whole sheaves - there is an API for obtaining a preallocated sheaf that can be used for guaranteed and efficient allocations in a restricted context, when the upper bound for needed objects is known but rarely reached - opt-in, not used for every cache (for now) The motivation comes mainly from the ongoing work related to VMA locking scalability and the related maple tree operations. This is why VMA and maple nodes caches are sheaf-enabled in the patchset. A sheaf-enabled cache has the following expected advantages: - Cheaper fast paths. For allocations, instead of local double cmpxchg, thanks to local_trylock() it becomes a preempt_disable() and no atomic operations. Same for freeing, which is otherwise a local double cmpxchg only for short term allocations (so the same slab is still active on the same cpu when freeing the object) and a more costly locked double cmpxchg otherwise. - kfree_rcu() batching and recycling. kfree_rcu() will put objects to a separate percpu sheaf and only submit the whole sheaf to call_rcu() when full. After the grace period, the sheaf can be used for allocations, which is more efficient than freeing and reallocating individual slab objects (even with the batching done by kfree_rcu() implementation itself). In case only some cpus are allowed to handle rcu callbacks, the sheaf can still be made available to other cpus on the same node via the shared barn. The maple_node cache uses kfree_rcu() and thus can benefit from this. Note: this path is currently limited to !PREEMPT_RT - Preallocation support. A prefilled sheaf can be privately borrowed to perform a short term operation that is not allowed to block in the middle and may need to allocate some objects. If an upper bound (worst case) for the number of allocations is known, but only much fewer allocations actually needed on average, borrowing and returning a sheaf is much more efficient then a bulk allocation for the worst case followed by a bulk free of the many unused objects. Maple tree write operations should benefit from this. - Compatibility with slub_debug. When slub_debug is enabled for a cache, we simply don't create the percpu sheaves so that the debugging hooks (at the node partial list slowpaths) are reached as before. The same thing is done for CONFIG_SLUB_TINY. Sheaf preallocation still works by reusing the (ineffective) paths for requests exceeding the cache's sheaf_capacity. This is in line with the existing approach where debugging bypasses the fast paths and SLUB_TINY preferes memory savings over performance. The above is adapted from the cover letter [1], which contains also in-kernel microbenchmark results showing the lower overhead of sheaves. Results from Suren Baghdasaryan [2] using a mmap/munmap microbenchmark also show improvements. Results from Sudarsan Mahendran [3] using will-it-scale show both benefits and regressions, probably due to overall noisiness of those tests. Link: https://lore.kernel.org/all/20250910-slub-percpu-caches-v8-0-ca3099d8352c@suse.cz/ [1] Link: https://lore.kernel.org/all/CAJuCfpEQ%3DRUgcAvRzE5jRrhhFpkm8E2PpBK9e9GhK26ZaJQt%3DQ@mail.gmail.com/ [2] Link: https://lore.kernel.org/all/20250913000935.1021068-1-sudarsanm@google.com/ [3] commit af92793e52c3a99b828ed4bdd277fd3e11c18d08 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:07 2025 -0700 slab: Introduce kmalloc_nolock() and kfree_nolock(). kmalloc_nolock() relies on ability of local_trylock_t to detect the situation when per-cpu kmem_cache is locked. In !PREEMPT_RT local_(try)lock_irqsave(&s->cpu_slab->lock, flags) disables IRQs and marks s->cpu_slab->lock as acquired. local_lock_is_locked(&s->cpu_slab->lock) returns true when slab is in the middle of manipulating per-cpu cache of that specific kmem_cache. kmalloc_nolock() can be called from any context and can re-enter into ___slab_alloc(): kmalloc() -> ___slab_alloc(cache_A) -> irqsave -> NMI -> bpf -> kmalloc_nolock() -> ___slab_alloc(cache_B) or kmalloc() -> ___slab_alloc(cache_A) -> irqsave -> tracepoint/kprobe -> bpf -> kmalloc_nolock() -> ___slab_alloc(cache_B) Hence the caller of ___slab_alloc() checks if &s->cpu_slab->lock can be acquired without a deadlock before invoking the function. If that specific per-cpu kmem_cache is busy the kmalloc_nolock() retries in a different kmalloc bucket. The second attempt will likely succeed, since this cpu locked different kmem_cache. Similarly, in PREEMPT_RT local_lock_is_locked() returns true when per-cpu rt_spin_lock is locked by current _task_. In this case re-entrance into the same kmalloc bucket is unsafe, and kmalloc_nolock() tries a different bucket that is most likely is not locked by the current task. Though it may be locked by a different task it's safe to rt_spin_lock() and sleep on it. Similar to alloc_pages_nolock() the kmalloc_nolock() returns NULL immediately if called from hard irq or NMI in PREEMPT_RT. kfree_nolock() defers freeing to irq_work when local_lock_is_locked() and (in_nmi() or in PREEMPT_RT). SLUB_TINY config doesn't use local_lock_is_locked() and relies on spin_trylock_irqsave(&n->list_lock) to allocate, while kfree_nolock() always defers to irq_work. Note, kfree_nolock() must be called _only_ for objects allocated with kmalloc_nolock(). Debug checks (like kmemleak and kfence) were skipped on allocation, hence obj = kmalloc(); kfree_nolock(obj); will miss kmemleak/kfence book keeping and will cause false positives. large_kmalloc is not supported by either kmalloc_nolock() or kfree_nolock(). Signed-off-by: Alexei Starovoitov Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 7612833192d56af86061de8ab51989b75daf5b0d Author: Alexei Starovoitov Date: Mon Sep 8 18:00:06 2025 -0700 slab: Reuse first bit for OBJEXTS_ALLOC_FAIL Since the combination of valid upper bits in slab->obj_exts with OBJEXTS_ALLOC_FAIL bit can never happen, use OBJEXTS_ALLOC_FAIL == (1ull << 0) as a magic sentinel instead of (1ull << 2) to free up bit 2. Signed-off-by: Alexei Starovoitov Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 83382af9ddc3cb0ef43f67d049b461720ad785e6 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:05 2025 -0700 slab: Make slub local_(try)lock more precise for LOCKDEP kmalloc_nolock() can be called from any context the ___slab_alloc() can acquire local_trylock_t (which is rt_spin_lock in PREEMPT_RT) and attempt to acquire a different local_trylock_t while in the same task context. The calling sequence might look like: kmalloc() -> tracepoint -> bpf -> kmalloc_nolock() or more precisely: __lock_acquire+0x12ad/0x2590 lock_acquire+0x133/0x2d0 rt_spin_lock+0x6f/0x250 ___slab_alloc+0xb7/0xec0 kmalloc_nolock_noprof+0x15a/0x430 my_debug_callback+0x20e/0x390 [testmod] ___slab_alloc+0x256/0xec0 __kmalloc_cache_noprof+0xd6/0x3b0 Make LOCKDEP understand that local_trylock_t-s protect different kmem_caches. In order to do that add lock_class_key for each kmem_cache and use that key in local_trylock_t. This stack trace is possible on both PREEMPT_RT and !PREEMPT_RT, but teach lockdep about it only for PREEMPT_RT, since in !PREEMPT_RT the ___slab_alloc() code is using local_trylock_irqsave() when lockdep is on. Note, this patch applies this logic to local_lock_t while the next one converts it to local_trylock_t. Both are mapped to rt_spin_lock in PREEMPT_RT. Signed-off-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit d7242af8643409aae32243450341ef25b28d8a8c Author: Alexei Starovoitov Date: Mon Sep 8 18:00:04 2025 -0700 mm: Introduce alloc_frozen_pages_nolock() Split alloc_pages_nolock() and introduce alloc_frozen_pages_nolock() to be used by alloc_slab_page(). Reviewed-by: Vlastimil Babka Signed-off-by: Alexei Starovoitov Reviewed-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 99253de51f80acccc528a9c94e2f4d5f329071f1 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:03 2025 -0700 mm: Allow GFP_ACCOUNT to be used in alloc_pages_nolock(). Change alloc_pages_nolock() to default to __GFP_COMP when allocating pages, since upcoming reentrant alloc_slab_page() needs __GFP_COMP. Also allow __GFP_ACCOUNT flag to be specified, since most of BPF infra needs __GFP_ACCOUNT except BPF streams. Reviewed-by: Vlastimil Babka Signed-off-by: Alexei Starovoitov Reviewed-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 4957089a23f41f31f8e7e22802a8ef9f5789c191 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:02 2025 -0700 locking/local_lock: Introduce local_lock_is_locked(). Introduce local_lock_is_locked() that returns true when given local_lock is locked by current cpu (in !PREEMPT_RT) or by current task (in PREEMPT_RT). The goal is to detect a deadlock by the caller. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit 719a42e563bb087758500e43e67a57b27f303c4c Author: Liam R. Howlett Date: Wed Sep 3 15:00:03 2025 +0200 maple_tree: Convert forking to use the sheaf interface Use the generic interface which should result in less bulk allocations during a forking. A part of this is to abstract the freeing of the sheaf or maple state allocations into its own function so mas_destroy() and the tree duplication code can use the same functionality to return any unused resources. [andriy.shevchenko@linux.intel.com: remove unused mt_alloc_bulk()] Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 6bf377b06c08049d0f4042493df302285e45165e Author: Liam R. Howlett Date: Wed Sep 3 15:00:02 2025 +0200 maple_tree: Add single node allocation support to maple state The fast path through a write will require replacing a single node in the tree. Using a sheaf (32 nodes) is too heavy for the fast path, so special case the node store operation by just allocating one node in the maple state. Signed-off-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit 9b05890a25d9197e39fcf5b2298f0b911c323306 Author: Liam R. Howlett Date: Wed Sep 3 15:00:01 2025 +0200 maple_tree: Prefilled sheaf conversion and testing Use prefilled sheaves instead of bulk allocations. This should speed up the allocations and the return path of unused allocations. Remove the push and pop of nodes from the maple state as this is now handled by the slab layer with sheaves. Testing has been removed as necessary since the features of the tree have been reduced. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit fdbebab19f147af6b1459c821bc11162911245fa Author: Liam R. Howlett Date: Wed Sep 3 15:00:00 2025 +0200 tools/testing: Add support for prefilled slab sheafs Add the prefilled sheaf structs to the slab header and the associated functions to the testing/shared/linux.c file. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 025f93101bb4e0a0cdc0fc4ee264f7905271ad75 Author: Pedro Falcato Date: Wed Sep 3 14:59:59 2025 +0200 maple_tree: Replace mt_free_one() with kfree() kfree() is a little shorter and works with kmem_cache_alloc'd pointers too. Also lets us remove one more helper. Signed-off-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9b60811cb3b42fe9a8e3f0aa3e007cd9cc814a78 Author: Pedro Falcato Date: Wed Sep 3 14:59:58 2025 +0200 maple_tree: Use kfree_rcu in ma_free_rcu kfree_rcu is an optimized version of call_rcu + kfree. It used to not be possible to call it on non-kmalloc objects, but this restriction was lifted ever since SLOB was dropped from the kernel, and since commit 6c6c47b063b5 ("mm, slab: call kvfree_rcu_barrier() from kmem_cache_destroy()"). Thus, replace call_rcu + mt_free_rcu with kfree_rcu. Signed-off-by: Pedro Falcato Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 551a6e757a95c23cd808533ef96e083d2a858ba0 Author: Liam R. Howlett Date: Wed Sep 3 14:59:57 2025 +0200 testing/radix-tree/maple: Hack around kfree_rcu not existing liburcu doesn't have kfree_rcu (or anything similar). Despite that, we can hack around it in a trivial fashion, by adding a wrapper. The wrapper only works for maple_nodes because we cannot get the kmem_cache pointer any other way in the test code. Link: https://lore.kernel.org/all/20250812162124.59417-1-pfalcato@suse.de/ Suggested-by: Pedro Falcato Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9f910f7d3d84927c388ede3c8053760a5947973b Author: Vlastimil Babka Date: Wed Sep 3 14:59:56 2025 +0200 tools/testing: include maple-shim.c in maple.c There's some duplicated code and we are about to add more functionality in maple-shared.h that we will need in the userspace maple test to be available, so include it via maple-shim.c Co-developed-by: Liam R. Howlett Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 59faa4da7cd4565cbce25358495556b75bb37022 Author: Vlastimil Babka Date: Wed Sep 3 14:59:55 2025 +0200 maple_tree: use percpu sheaves for maple_node_cache Setup the maple_node_cache with percpu sheaves of size 32 to hopefully improve its performance. Note this will not immediately take advantage of sheaf batching of kfree_rcu() operations due to the maple tree using call_rcu with custom callbacks. The followup changes to maple tree will change that and also make use of the prefilled sheaves functionality. Reviewed-by: Sidhartha Kumar Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 3accabda4da1b00ba21dc18573a0a43e032e35f4 Author: Vlastimil Babka Date: Wed Sep 3 14:59:54 2025 +0200 mm, vma: use percpu sheaves for vm_area_struct cache Create the vm_area_struct cache with percpu sheaves of size 32 to improve its performance. Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit c4fb7f0a79771dfd18838bfc5015650a9730e9c0 Author: Liam R. Howlett Date: Wed Sep 3 14:59:53 2025 +0200 tools/testing: Add support for changes to slab for sheaves The slab changes for sheaves requires more effort in the testing code. Unite all the kmem_cache work into the tools/include slab header for both the vma and maple tree testing. The vma test code also requires importing more #defines to allow for seamless use of the shared kmem_cache code. This adds the pthread header to the slab header in the tools directory to allow for the pthread_mutex in linux.c. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 4ec1a08d20315d2d2a6f942ea563e5dadd988e98 Author: Vlastimil Babka Date: Wed Sep 3 14:59:50 2025 +0200 slab: allow NUMA restricted allocations to use percpu sheaves Currently allocations asking for a specific node explicitly or via mempolicy in strict_numa node bypass percpu sheaves. Since sheaves contain mostly local objects, we can try allocating from them if the local node happens to be the requested node or allowed by the mempolicy. If we find the object from percpu sheaves is not from the expected node, we skip the sheaves - this should be rare. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit d09a61a3aa7de53fe055743993d79eaeb945cbad Author: Liam R. Howlett Date: Wed Sep 3 14:59:52 2025 +0200 tools/testing/vma: Implement vm_refcnt reset Add the reset of the ref count in vma_lock_init(). This is needed if the vma memory is not zeroed on allocation. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 989b09b73978a0b3dbee9ef343ab108742b1cc9f Author: Vlastimil Babka Date: Wed Sep 3 14:59:49 2025 +0200 slab: skip percpu sheaves for remote object freeing Since we don't control the NUMA locality of objects in percpu sheaves, allocations with node restrictions bypass them. Allocations without restrictions may however still expect to get local objects with high probability, and the introduction of sheaves can decrease it due to freed object from a remote node ending up in percpu sheaves. The fraction of such remote frees seems low (5% on an 8-node machine) but it can be expected that some cache or workload specific corner cases exist. We can either conclude that this is not a problem due to the low fraction, or we can make remote frees bypass percpu sheaves and go directly to their slabs. This will make the remote frees more expensive, but if it's only a small fraction, most frees will still benefit from the lower overhead of percpu sheaves. This patch thus makes remote object freeing bypass percpu sheaves, including bulk freeing, and kfree_rcu() via the rcu_free sheaf. However it's not intended to be 100% guarantee that percpu sheaves will only contain local objects. The refill from slabs does not provide that guarantee in the first place, and there might be cpu migrations happening when we need to unlock the local_lock. Avoiding all that could be possible but complicated so we can leave it for later investigation whether it would be worth it. It can be expected that the more selective freeing will itself prevent accumulation of remote objects in percpu sheaves so any such violations would have only short-term effects. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit e3852a1213ffc6fbd89c768e7c54a360652648b8 Author: Liam R. Howlett Date: Thu Aug 28 10:53:45 2025 -0400 maple_tree: Drop bulk insert support Bulk insert mode was added to facilitate forking faster, but forking now uses __mt_dup() to duplicate the tree. The addition of sheaves has made the bulk allocations difficult to maintain - since the expected entries would preallocate into the maple state. A big part of the maple state node allocation was the ability to push nodes back onto the state for later use, which was essential to the bulk insert algorithm. Remove mas_expected_entries() and mas_destroy_rebalance() functions as well as the MA_STATE_BULK and MA_STATE_REBALANCE maple state flags since there are no users anymore. Drop the associated testing as well. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 08294229210916c3b179186f3efa3b9c62a04678 Author: Vlastimil Babka Date: Wed Sep 3 14:59:48 2025 +0200 slab: determine barn status racily outside of lock The possibility of many barn operations is determined by the current number of full or empty sheaves. Taking the barn->lock just to find out that e.g. there are no empty sheaves results in unnecessary overhead and lock contention. Thus perform these checks outside of the lock with a data_race() annotated variable read and fail quickly without taking the lock. Checks for sheaf availability that racily succeed have to be obviously repeated under the lock for correctness, but we can skip repeating checks if there are too many sheaves on the given list as the limits don't need to be strict. Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit da577f1fcbdd0317b7c5089c19d5d61ec194f0e0 Author: Lorenzo Stoakes Date: Tue Aug 26 11:28:24 2025 +0100 tools/testing/vma: clean up stubs in vma_internal.h We do not need to references arguments just to avoid compiler warnings, the warning in question does not arise here, so remove all of the instances of '(void)xxx' introduced purely to avoid this warning. As reported by WagYuli in the referenced mail, GCC 8.3 and before will have issues compiling this file if parameter names are not provided, so ensure these are always provided. Finally, perform a trivial fix up of kmem_cache_alloc() which technically has parameters in the incorrect order (as reported by Vlastimil Babka off-list). Link: https://lkml.kernel.org/r/20250826102824.22730-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reported-by: WangYuli Closes: https://lore.kernel.org/linux-mm/EFCEBE7E301589DE+20250729084700.208767-1-wangyuli@uniontech.com/ Reported-by: Vlastimil Babka Acked-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Cc: Jann Horn Cc: WangYuli Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka commit 3c1ea5c5019ff197aca7e886a3a240c38f6c6f0d Author: Vlastimil Babka Date: Wed Sep 3 14:59:47 2025 +0200 slab: sheaf prefilling for guaranteed allocations Add functions for efficient guaranteed allocations e.g. in a critical section that cannot sleep, when the exact number of allocations is not known beforehand, but an upper limit can be calculated. kmem_cache_prefill_sheaf() returns a sheaf containing at least given number of objects. kmem_cache_alloc_from_sheaf() will allocate an object from the sheaf and is guaranteed not to fail until depleted. kmem_cache_return_sheaf() is for giving the sheaf back to the slab allocator after the critical section. This will also attempt to refill it to cache's sheaf capacity for better efficiency of sheaves handling, but it's not stricly necessary to succeed. kmem_cache_refill_sheaf() can be used to refill a previously obtained sheaf to requested size. If the current size is sufficient, it does nothing. If the requested size exceeds cache's sheaf_capacity and the sheaf's current capacity, the sheaf will be replaced with a new one, hence the indirect pointer parameter. kmem_cache_sheaf_size() can be used to query the current size. The implementation supports requesting sizes that exceed cache's sheaf_capacity, but it is not efficient - such "oversize" sheaves are allocated fresh in kmem_cache_prefill_sheaf() and flushed and freed immediately by kmem_cache_return_sheaf(). kmem_cache_refill_sheaf() might be especially ineffective when replacing a sheaf with a new one of a larger capacity. It is therefore better to size cache's sheaf_capacity accordingly to make oversize sheaves exceptional. CONFIG_SLUB_STATS counters are added for sheaf prefill and return operations. A prefill or return is considered _fast when it is able to grab or return a percpu spare sheaf (even if the sheaf needs a refill to satisfy the request, as those should amortize over time), and _slow otherwise (when the barn or even sheaf allocation/freeing has to be involved). sheaf_prefill_oversize is provided to determine how many prefills were oversize (counter for oversize returns is not necessary as all oversize refills result in oversize returns). When slub_debug is enabled for a cache with sheaves, no percpu sheaves exist for it, but the prefill functionality is still provided simply by all prefilled sheaves becoming oversize. If percpu sheaves are not created for a cache due to not passing the sheaf_capacity argument on cache creation, the prefills also work through oversize sheaves, but there's a WARN_ON_ONCE() to indicate the omission. Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit a8541957e7b18921dbf5d887780e8eaeb04916cf Author: Qianfeng Rong Date: Mon Aug 4 20:56:57 2025 +0800 maple_tree: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Link: https://lkml.kernel.org/r/20250804125657.482109-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Reviewed-by: Wei Yang Reviewed-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka commit ec66e0d599520ab414db745544e25d80d0ac5054 Author: Vlastimil Babka Date: Wed Sep 3 14:59:46 2025 +0200 slab: add sheaf support for batching kfree_rcu() operations Extend the sheaf infrastructure for more efficient kfree_rcu() handling. For caches with sheaves, on each cpu maintain a rcu_free sheaf in addition to main and spare sheaves. kfree_rcu() operations will try to put objects on this sheaf. Once full, the sheaf is detached and submitted to call_rcu() with a handler that will try to put it in the barn, or flush to slab pages using bulk free, when the barn is full. Then a new empty sheaf must be obtained to put more objects there. It's possible that no free sheaves are available to use for a new rcu_free sheaf, and the allocation in kfree_rcu() context can only use GFP_NOWAIT and thus may fail. In that case, fall back to the existing kfree_rcu() implementation. Expected advantages: - batching the kfree_rcu() operations, that could eventually replace the existing batching - sheaves can be reused for allocations via barn instead of being flushed to slabs, which is more efficient - this includes cases where only some cpus are allowed to process rcu callbacks (CONFIG_RCU_NOCB_CPU) Possible disadvantage: - objects might be waiting for more than their grace period (it is determined by the last object freed into the sheaf), increasing memory usage - but the existing batching does that too. Only implement this for CONFIG_KVFREE_RCU_BATCHED as the tiny implementation favors smaller memory footprint over performance. Also for now skip the usage of rcu sheaf for CONFIG_PREEMPT_RT as the contexts where kfree_rcu() is called might not be compatible with taking a barn spinlock or a GFP_NOWAIT allocation of a new sheaf taking a spinlock - the current kfree_rcu() implementation avoids doing that. Teach kvfree_rcu_barrier() to flush all rcu_free sheaves from all caches that have them. This is not a cheap operation, but the barrier usage is rare - currently kmem_cache_destroy() or on module unload. Add CONFIG_SLUB_STATS counters free_rcu_sheaf and free_rcu_sheaf_fail to count how many kfree_rcu() used the rcu_free sheaf successfully and how many had to fall back to the existing implementation. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit db74430a4218f282d16e58a38337275ad3f9f517 Author: Haotian Zhang Date: Sun Sep 28 22:01:10 2025 -0700 Input: psxpad-spi - add a check for the return value of spi_setup() The probe function in the psxpad-spi driver calls spi_setup() but fails to check its return value. If the SPI bus setup fails, the driver will still load successfully, resulting in potential error in later I/O operations. Add a check for the return value of spi_setup() and return an error on failure. Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI") Signed-off-by: Haotian Zhang Signed-off-by: Dmitry Torokhov commit d3366a04770eea807f2826cbdb96934dd8c9bf79 Author: Zhen Ni Date: Sun Sep 28 14:37:37 2025 +0800 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn Signed-off-by: Dmitry Torokhov commit c8a935a31bc787db52296944890f300ba9479088 Author: Lad Prabhakar Date: Tue Sep 23 10:52:29 2025 +0100 lib/string_choices: Add str_assert_deassert() helper Add str_assert_deassert() helper to return "assert" or "deassert" string literal depending on the boolean argument. Also add the inversed variant str_deassert_assert(). Suggested-by: Philipp Zabel Signed-off-by: Lad Prabhakar Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250923095229.2149740-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Kees Cook commit 129b91fc329604e05f794dc1a18a6da3eb518b4e Author: Rob Herring (Arm) Date: Fri Sep 26 16:47:37 2025 -0500 dt-bindings: arm: altera: Drop socfpga-sdram-edac.txt The contents of arm/altera/socfpga-sdram-edac.txt are already covered by edac/altr,socfpga-ecc-manager.yaml except for the "altr,sdram-edac" compatible string. Add the compatible and drop the old .txt binding doc. Acked-by: Matthew Gerlach Signed-off-by: Rob Herring (Arm) commit 1b53426334c3c942db47e0959a2527a4f815af50 Author: Stefan Metzmacher Date: Mon Sep 8 22:22:35 2025 +0200 smb: server: let smb_direct_flush_send_list() invalidate a remote key first If we want to invalidate a remote key we should do that as soon as possible, so do it in the first send work request. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 942ce74ab9a3f1e18fe00bffa80ecf6294e9e6b5 Author: Stefan Metzmacher Date: Mon Sep 15 08:05:31 2025 +0200 smb: server: make use of ib_alloc_cq_any() instead of ib_alloc_cq() commit 20cf4e026730 ("rdma: Enable ib_alloc_cq to spread work over a device's comp_vectors") happened before ksmbd was upstreamed, but after the out of tree ksmbd (a.k.a. cifsd) was developed. So we still used ib_alloc_cq(). Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8aa23bae607e3bd5ced892afc26bfbe8945f531b Author: Stefan Metzmacher Date: Wed Aug 27 15:54:35 2025 +0200 smb: server: make consitent use of spin_lock_irq{save,restore}() in transport_rdma.c There is a mix of using spin_lock() and spin_lock_irq(), which is confusing as IB_POLL_WORKQUEUE is used and no code would be called from any interrupt. So using spin_lock() or even mutexes would be ok. But we'll soon share common code with the client, which uses IB_POLL_SOFTIRQ. And Documentation/kernel-hacking/locking.rst section "Cheat Sheet For Locking" says: - Otherwise (== data can be touched in an interrupt), use spin_lock_irqsave() and spin_unlock_irqrestore(). So in order to keep it simple and safe we use that version now. It will help merging functions into common code and have consistent locking in all cases. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0491f26f8980d7a4028d3528df09e23f5a64adbe Author: Stefan Metzmacher Date: Tue Sep 2 12:36:50 2025 +0200 smb: server: let {free_transport,smb_direct_disconnect_rdma_{work,connection}}() wake up all wait queues This is important in order to let all waiters notice a broken connection. We also go via smb_direct_disconnect_rdma_{work,connection}() for broken connections. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 7d729df9945a5ff9d4947bbc3c1297040ae3c507 Author: Stefan Metzmacher Date: Thu Aug 28 12:17:23 2025 +0200 smb: server: let smb_direct_disconnect_rdma_connection() disable all work but disconnect_work There's no point run these if we already know the connection is broken. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3d71e7cdbcf056a0b8ca3e9634f161b9a7b1e634 Author: Stefan Metzmacher Date: Thu Aug 28 12:14:07 2025 +0200 smb: server: fill in smbdirect_socket.first_error on error For now we just use -ECONNABORTED, but it will get more detailed later. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b3fd52a0d85c688a381e2ce72912db0a73727ce9 Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smb_direct_disconnect_rdma_connection() should turn the status into an error state instead of leaving it as is until smb_direct_disconnect_rdma_work() is running. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9d0050874767ec5977843d4bfca3aeb9a43a8f74 Author: Stefan Metzmacher Date: Fri Aug 22 16:11:34 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_send_negotiate_response() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5e90c56e0e8b787b3a7ab1ff565c93c918f27f1c Author: Stefan Metzmacher Date: Fri Aug 22 16:08:49 2025 +0200 smb: server: pass struct smbdirect_socket to {enqueue,get_first}_reassembly() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c0cb9823ac52be33a974b3bfe698e62507f456db Author: Stefan Metzmacher Date: Fri Aug 22 16:06:09 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_send_data() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ab83128e65a1f56db292a6db9b96750a39ba074b Author: Stefan Metzmacher Date: Fri Aug 22 16:03:52 2025 +0200 smb: server: pass struct smbdirect_socket to post_sendmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0a715db380444089e2907fa72ed712d2150aae6c Author: Stefan Metzmacher Date: Fri Aug 22 16:02:21 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_create_header() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4d1dffe0a08d87eb4fb1a62e4d76f541849db94a Author: Stefan Metzmacher Date: Fri Aug 22 15:59:35 2025 +0200 smb: server: pass struct smbdirect_socket to manage_keep_alive_before_sending() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 663b3c3c864c906373ef231cbb1755b353cb5f9f Author: Stefan Metzmacher Date: Fri Aug 22 15:57:41 2025 +0200 smb: server: pass struct smbdirect_socket to manage_credits_prior_sending() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b156d2c559b0ac9b410effd081262d96aa9bf00e Author: Stefan Metzmacher Date: Fri Aug 22 15:55:20 2025 +0200 smb: server: pass struct smbdirect_socket to calc_rw_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cae2d9a2298d04c237c6b7c57b9584068a2223df Author: Stefan Metzmacher Date: Fri Aug 22 15:52:47 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_rw_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2dc6c7e8ba3f348b8bcf348c0f736898170225fd Author: Stefan Metzmacher Date: Fri Aug 22 15:51:53 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_send_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7f4805b7db94b75003d08a97f5125617b42c625b Author: Stefan Metzmacher Date: Fri Aug 22 15:49:40 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d14910bbf64404cb74f35419ca2cb427a558a43c Author: Stefan Metzmacher Date: Fri Aug 22 15:48:05 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_flush_send_list() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ecb56dbc93c67a0e03b6c4877ac1ead4cde0e9ca Author: Stefan Metzmacher Date: Fri Aug 22 15:46:53 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_send() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56b442a248b18e20b7a1b17d8bce2a97c62c8063 Author: Stefan Metzmacher Date: Fri Aug 22 15:08:27 2025 +0200 smb: server: remove unused struct struct smb_direct_transport argument from smb_direct_send_ctx_init() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 789cfc2ffa72d75394cee78abf3fd4d57d623399 Author: Stefan Metzmacher Date: Fri Aug 22 15:07:35 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_{alloc,free}_sendmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 100aec545ad170ac9139dd66e3475501f4b5bda4 Author: Stefan Metzmacher Date: Fri Aug 22 14:55:50 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_connect() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7cb0ab73f82f19a7d88d01a2949fc1275f56be39 Author: Stefan Metzmacher Date: Fri Aug 22 14:54:17 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_prepare_negotiation() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56bcc18d24f73f66b4211d4d028a626c0a5c56af Author: Stefan Metzmacher Date: Fri Aug 22 14:53:13 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_accept_client() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9221b12b356729cb9cb2a0e0ca3062b73aafb04c Author: Stefan Metzmacher Date: Fri Aug 22 14:52:04 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_recv() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cf789396479593d4929bdfdc775a45c9b7482360 Author: Stefan Metzmacher Date: Fri Aug 22 14:50:32 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_create_qpair() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit f75c226db0d29ee422f9b3ffd0a4730e6c552fbe Author: Stefan Metzmacher Date: Fri Aug 22 14:49:18 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_qpair_handler() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56227a7aa5c6e159205d79444833c0e2874dcc94 Author: Stefan Metzmacher Date: Fri Aug 22 14:44:16 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_cm_handler() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ece37ea815a70cd170d6922d33b7c9a7e8f2aa9e Author: Stefan Metzmacher Date: Fri Aug 22 14:48:01 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_disconnect_rdma_connection() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a25075f112b4bc02335d4df930409982405987f6 Author: Stefan Metzmacher Date: Fri Aug 22 14:04:34 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_init_params() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 57131bf9e87677dcb64c8ce517c220b1fc403022 Author: Stefan Metzmacher Date: Fri Aug 22 13:55:17 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_get_max_fr_pages() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ce85071d2cd63badaa71651033aa9f702ed36734 Author: Stefan Metzmacher Date: Fri Aug 22 13:50:42 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_{create,destroy}_pools() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01721df4e309e76866dd4d28b78e8683581e9e87 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: server: pass struct smbdirect_socket to {get_free,put}_recvmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit da7d45b9a3858abc89030cf08368e59b2ab2bdd4 Author: Stefan Metzmacher Date: Fri Aug 22 12:32:48 2025 +0200 smb: server: make use of smbdirect_socket.workqueue We still use the single global workqueue, but this will allow us to share common code soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8ad3a97eab240dabbe41b4452d37a5b6b64edf72 Author: Stefan Metzmacher Date: Fri Aug 15 12:36:33 2025 +0200 smb: server: implement correct keepalive and timeout handling for smbdirect Now client and server behave in the same way and we can start to share common functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b8c7776583e72f1fc50f0ed561346954c5d2fe82 Author: Stefan Metzmacher Date: Fri Aug 15 18:00:36 2025 +0200 smb: server: make use of smbdirect_socket.idle.immediate_work With this commit the server only uses struct smbdirect_socket! It doesn't use the idle timer yet, but it will be added soon, from there we'll be ready split common functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d0b9b967b35584379fd0421f408c77647e5d6b12 Author: Stefan Metzmacher Date: Thu Aug 21 12:32:05 2025 +0200 smb: server: make use of smbdirect_socket.rdma.legacy_iwarp Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 49635103e8e68020d80122b9ec408dbbd295d351 Author: Stefan Metzmacher Date: Thu Aug 21 12:30:32 2025 +0200 smb: server: make use of smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code first and then negotiate the value with the peer. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit be3c1d032fad608f48b428854694422633c4b004 Author: Stefan Metzmacher Date: Fri Aug 15 12:31:50 2025 +0200 smb: server: make use of smbdirect_socket_parameters.negotiate_timeout_msec and change to 5s The server negotiations timer is just 5 seconds in Windows, so use the same. See [MS-SMBD] 3.1.7.2 Connection Arrival. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d70e45823961e13af10f44a6a16c5c5a357ccdfb Author: Stefan Metzmacher Date: Fri Aug 15 12:22:09 2025 +0200 smb: server: fill smbdirect_socket_parameters at the beginning and use the values from there This is what we should do and it also simplifies the following changes. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 03a38d846750f06d4fb0aac2213192bdcc2a8435 Author: Stefan Metzmacher Date: Fri Aug 15 12:03:40 2025 +0200 smb: server: pass ksmbd_transport to get_smbd_max_read_write_size() We should use the per connection value. And for TCP return NT_STATUS_INVALID_PARAMETER if any SMB2_CHANNEL_RDMA_V1* is used. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 341b6c69b959a901b167a33b7e62e8b2ff8a1e74 Author: Stefan Metzmacher Date: Fri Aug 15 13:04:31 2025 +0200 smb: server: remove useless casts from KSMBD_TRANS/SMBD_TRANS At best they gain nothing, at worst we procude real bugs. Note container_of() already casts to a pointer of the given type. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4d2e333dabe74349d257ca2f02225e4bc39f23b8 Author: Stefan Metzmacher Date: Fri Aug 15 13:01:30 2025 +0200 smb: server: replace smb_trans_direct_transfort() with SMBD_TRANS() The spelling of smb_trans_direct_transfort was wrong anyway and we don't need the logic twice. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e8bc71986cbd2d2d5991a2fc6afbac0311ff3769 Author: Stefan Metzmacher Date: Thu Aug 14 16:33:30 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.{posted,credits} This will make it possible to introduce common helper functions in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 89b021a72663c4d96d8a8b85272bb42d991a1c6f Author: Stefan Metzmacher Date: Thu Aug 14 16:05:47 2025 +0200 smb: server: manage recv credits by counting posted recv_io and granted credits (At least for me) the logic maintaining the count of posted recv_io messages and the count of granted credits is much easier to understand. From there we can easily calculate the number of new_credits we'll grant to the peer in outgoing send_io messages. This will simplify the move to common logic that can be shared between client and server in the following patches. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 113ed9d56f63d2e4eb3d74002c3d91de1e7a3485 Author: Stefan Metzmacher Date: Thu Aug 14 15:50:05 2025 +0200 smb: server: take the recv_credit_target from the negotiate req and always limit the range The clients sends the initial recv_credit_target in the negotiate req, so we should use that. We also limit the range between 1 and our local defined sp->recv_credit_max. This will simplify further logic changes. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 780ccb0fb624600278ef4a65df30e563fd015a2a Author: Stefan Metzmacher Date: Mon Aug 18 21:07:06 2025 +0200 smb: server: make use of struct smbdirect_rw_io This will allow us to create functions in the common smbdirect code to be used by the server in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 95475d8886bd7e60860f7aa8657683a089f21db5 Author: Stefan Metzmacher Date: Thu Aug 14 12:01:50 2025 +0200 smb: server: make use smbdirect_socket.rw_io.credits This will allow to us to have functions moved into common code in future (even if it's only used by the server). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 73430a64469c86c027518014e63ca637d9a53b9a Author: Stefan Metzmacher Date: Mon Aug 18 21:16:48 2025 +0200 smb: server: make use of struct smbdirect_send_batch This makes it easier to move functions to the common smbdirect code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2def28338a19f03a15a99d7df46930e6be6944e8 Author: Stefan Metzmacher Date: Mon Aug 11 17:12:58 2025 +0200 smb: server: make use of smbdirect_socket.send_io.credits.{count,wait_queue} This will is used by the client already and will allow to create common helper functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit fd0ad9c521db6acf20fb24699830138481c07f8a Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: server: make use of smbdirect_socket.send_io.pending.{count,zero_wait_queue} This will is used by the client already and will allow to create common helper functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bb12617ecb3af1e1c8ba36ef2c3496f95521a605 Author: Stefan Metzmacher Date: Fri Aug 8 19:07:37 2025 +0200 smb: server: make use of smbdirect_socket.disconnect_work Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 16ba90e52bc7c367b62386fa4f61e4dc318c3583 Author: Stefan Metzmacher Date: Fri Aug 8 15:10:52 2025 +0200 smb: server: make use of smbdirect_socket_init() Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b4d56ced9e9dc353484dcb6355c1fd7074609124 Author: Stefan Metzmacher Date: Wed Aug 13 11:39:19 2025 +0200 smb: server: don't wait for info->send_pending == 0 on error Instead we just wake up the waiters and let them return -ENOTCONN. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b31606097de8393c8adac4161a4d3a6098af10e0 Author: Stefan Metzmacher Date: Tue Aug 12 10:55:31 2025 +0200 smb: server: move smb_direct_disconnect_rdma_work() into free_transport() The logic is also needed when smb_direct_handle_connect_request() calls free_transport(), because rdma_accept() and RDMA_CM_EVENT_ESTABLISHED could already be reached. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e2d5e516c66383bed098b60be4925f9cbe9e3530 Author: Stefan Metzmacher Date: Fri Aug 8 12:46:25 2025 +0200 smb: server: only turn into SMBDIRECT_SOCKET_CONNECTED when negotiation is done From SMBDIRECT_SOCKET_CREATED we now go via the following stages: 1. SMBDIRECT_SOCKET_RDMA_CONNECT_NEEDED This indicated rdma_accept needs to be called 2. SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING This waits for RDMA_CM_EVENT_ESTABLISHED to arrive 3. SMBDIRECT_SOCKET_NEGOTIATE_NEEDED This waits for the negotiate request to arrive 4. SMBDIRECT_SOCKET_NEGOTIATE_RUNNING This indicates the negotiate request arrived and needs to be processed 5. SMBDIRECT_SOCKET_CONNECTED The connection is ready to use This avoids the extra 'bool negotiation_requested' and makes the steps more clear. In future we may want to add trace points when changing the states, which would be useful for debugging. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c82a53211a378e70866aac8ec49f4df64905ccc2 Author: Stefan Metzmacher Date: Thu Aug 7 11:20:55 2025 +0200 smb: server: make use of smbdirect_socket.status_wait This will allow us to have common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a7eef6144c97bd7031d40ebc6e8fdd038ea3f46f Author: Stefan Metzmacher Date: Mon Aug 11 18:23:03 2025 +0200 smb: server: queue post_recv_credits_work in put_recvmsg() and avoid count_avail_recvmsg This is basically what the client is doing in put_receive_buffer(). It means we don't need complicated work to maintain count_avail_recvmsg. But we keep the logic to queue post_recv_credits_work if the peer raises the requested credit_target and put_receive_buffer() is not called. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d4b86b49093cbe98b68461a1b1af958f1a0ee16d Author: Stefan Metzmacher Date: Fri Aug 8 18:23:59 2025 +0200 smb: server: add a pr_info() when the server starts running We already have a message like: ksmbd: kill command received when the server stops running. This makes it easier for debugging in order to match any possible warnings/errors in dmesg with restarted server. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 27bc4c57f094917c450f1a2d3097bfea728fc1a5 Author: Stefan Metzmacher Date: Thu Aug 14 10:06:50 2025 +0200 smb: server: make only use of wake_up[_all]() in transport_rdma.c wake_up_interruptible(() doesn't wake up tasks waiting with wait_event(). So we better wake_up[_all]() in order to wake up all tasks in order to simplify the logic. As we currently don't use any wait_event_*_exclusive() it doesn't really matter if we use wake_up() or wake_up_all(). But in this patch I try to use wake_up() for expected situations and wake_up_all() for situations of a broken connection. So don't need to adjust things in future when we may use wait_event_*_exclusive() in order to wake up only one process that should make progress. Changing the wait_event_*() code in order to keep wait_event(), wait_event_interruptible() and wait_event_interruptible_timeout() or changing them to wait_event_killable(), wait_event_killable_timeout(), wait_event_killable_exclusive() is something to think about in a future patch. The goal here is to avoid that some tasks are not woken and freeze forever. Also note that this patch only changes the existing wake_up*() calls. Adding more wake_up*() calls for other wait queues is also deferred to a future patch. Link: https://lore.kernel.org/linux-cifs/13851363-0dc9-465c-9ced-3ede4904eef0@samba.org/T/#t Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 98dc77b310644b6716ed2da829697c128b2e5d51 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:04 2025 +0200 smb: server: make use of smbdirect_socket.{send,recv}_io.mem.{cache,pool} This will allow common helper functions to be created later. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 442959002fcce509069025aab2aaab0344709e6f Author: Stefan Metzmacher Date: Wed Aug 6 19:36:03 2025 +0200 smb: server: make use of struct smbdirect_send_io This is already used by the client and will allow us to use common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ea20d02842c8f38ed36045b46d8e95bcfa0514f2 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:02 2025 +0200 smb: server: make use of SMBDIRECT_RECV_IO_MAX_SGE Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bdb0f1596ae537535a0cebc2911b07ff264c3099 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:01 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.reassembly.* This is also used by the client and will allow us to introduce common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d9989207b78c2fa3008285c8b1e53e8618544de7 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:00 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.free.{list,lock} This is already used by the client and will allow us to add common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9883a142f1bba5bdc3a3091608aef8b1600cdd11 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:59 2025 +0200 smb: server: make use of struct smbdirect_recv_io This will allow us to move helper functions into common code soon as the client already uses smbdirect_recv_io. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3e691b1d16dbd30186d71ca707efeb3a98cc542c Author: Stefan Metzmacher Date: Wed Aug 6 19:35:58 2025 +0200 smb: server: make use of smbdirect_socket->recv_io.expected The expected incoming message type can be per connection. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 177368b9924314bde7d2ea6dc93de0d9ba728b61 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:57 2025 +0200 smb: server: make use of common smbdirect_socket_parameters Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4c564f03e23b1ea55b77679192a4cb07f5b3e7f3 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:56 2025 +0200 smb: server: make use of common smbdirect_socket This is the next step in the direction of a common smbdirect layer. Currently only structures are shared, but that will change over time until everything is shared. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e7de2c4521ce86eb23de133cdf48cb460cff5a91 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:55 2025 +0200 smb: server: make use of common smbdirect.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 575c1af4dc64434a42c4b00e5b7fd298e8c68c3c Author: Stefan Metzmacher Date: Sat Aug 16 10:24:30 2025 +0900 smb: server: make use of common smbdirect_pdu.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit fad988a2158d743da7971884b93482a73735b25e Author: Stefan Metzmacher Date: Wed Aug 20 15:34:58 2025 +0200 smb: server: fix IRD/ORD negotiation with the client Already do real negotiation in smb_direct_handle_connect_request() where we see the requested initiator_depth and responder_resources from the client. We should detect legacy iwarp clients using MPA v1 with the custom IRD/ORD negotiation. We need to send the custom IRD/ORD in big endian, but we need to try to let clients with broken requests using little endian (older cifs.ko) to work. Note the reason why this uses u8 for initiator_depth and responder_resources is that the rdma layer also uses it. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-rdma@vger.kernel.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2dad0b15bbe86ffa6d2f234c40609aa59894e9ec Author: Stefan Metzmacher Date: Mon Sep 15 00:55:31 2025 +0200 smb: client: let smbd_post_send_iter() call ib_dma_map_single() for the header first This will simplify further changes, the important part is that request->num_sge >= 1 is only set if request->sge[0].* is valid. Note that ib_dma_sync_single_for_device() is called in smbd_post_send() for each sge, so the device will still see the packet header even if it's modified after calling ib_dma_map_single(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c4709e61ef253eed4257328b614e7c57fed259ec Author: Stefan Metzmacher Date: Mon Sep 15 23:32:15 2025 +0200 smb: client: defer calling ib_alloc_pd() after we are connected The protection domain is not needed until we're connected. This makes further changes easier to follow... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 17a6bc60f47b344b831da8cf66adef5c2ea3d9c1 Author: Stefan Metzmacher Date: Tue Aug 26 15:54:10 2025 +0200 smb: client: allocate smbdirect workqueue at the beginning of _smbd_get_connection() This will simplify further changes when moving to common code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a437c9cebcc3c4193fe0143e6fbc72c6b7529ad2 Author: Stefan Metzmacher Date: Wed Aug 27 15:34:09 2025 +0200 smb: client: make consitent use of spin_lock_irq{save,restore}() in smbdirect.c There is a mix of using spin_lock(), spin_lock_irq() and spin_lock_irqsave() and it seems at least enqueue_reassembly() was wrong in using just spin_lock() as it's called via recv_done() from a SOFTIRQ as we're using IB_POLL_SOFTIRQ. And Documentation/kernel-hacking/locking.rst section "Cheat Sheet For Locking" says: - Otherwise (== data can be touched in an interrupt), use spin_lock_irqsave() and spin_unlock_irqrestore(). So in order to keep it simple and safe we use that version now. It will help merging functions into common code and have consistent locking in all cases. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1b128ec1c76dcf08b752b5f5268da813fea58a01 Author: Stefan Metzmacher Date: Tue Sep 2 12:17:56 2025 +0200 smb: client: let smbd_{destroy,disconnect_rdma_{work,connection}}() wake up all wait queues This is important in order to let all waiters notice a broken connection. We also go via smbd_disconnect_rdma_{work,connection}() for broken connections. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0cb7ed37af614bbda39dab3d13f0639458d77cae Author: Stefan Metzmacher Date: Thu Aug 28 12:15:11 2025 +0200 smb: client: let smbd_disconnect_rdma_connection() disable all work but disconnect_work There's no point run these if we already know the connection is broken. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 98a1cdca35eac55407c76067cdffd19aade0026c Author: Stefan Metzmacher Date: Thu Aug 28 12:12:09 2025 +0200 smb: client: fill in smbdirect_socket.first_error on error For now we just use -ECONNABORTED, but it will get more detailed later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ffbfc73e84eb829f7e2f901594271557de860827 Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: client: let smbd_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smbd_disconnect_rdma_connection() should turn the status into an error state instead of leaving it as is until smbd_disconnect_rdma_work() is running. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 114347dad6e7955b25aa707d62936023e501d8ed Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: remove unused struct smbdirect_socket argument of smbd_iter_to_mr() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4c4b1d1122fb49a207b86318b0940e09898d8e62 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: pass struct smbdirect_socket to get_mr() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2c6b999a90987a86285865569eac8a5a51ce18a1 Author: Stefan Metzmacher Date: Fri Aug 22 11:54:30 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_negotiate() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c612e60de5aa0b1cb60ac6c9e7d96eb3c4528b13 Author: Stefan Metzmacher Date: Fri Aug 22 11:52:24 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_negotiate_req() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0a5dc5fc7c014d88c31aff327a65d610d8006454 Author: Stefan Metzmacher Date: Fri Aug 22 11:34:05 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_ia_open() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2569536b0c69eb3c38deacf2b9ce82cd5f8b4633 Author: Stefan Metzmacher Date: Fri Aug 22 11:10:57 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_create_id() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 94a0e794b77f3300c99fcac65d1a4fc83fd4684f Author: Stefan Metzmacher Date: Fri Aug 22 11:08:13 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_qp_async_error_upcall() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit e3f095cca6563e6aaf9163690e22800f765cd193 Author: Stefan Metzmacher Date: Fri Aug 22 11:07:48 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_conn_upcall() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 05bd1378c821f4cea2818b0bef6b28415ffca56f Author: Stefan Metzmacher Date: Fri Aug 22 11:03:52 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_full_iter() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d76e8c7f546b2d2a49149b4ee59583aad0282c93 Author: Stefan Metzmacher Date: Fri Aug 22 10:47:06 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_empty() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 46b8fe2bd18c487aa4fd5c45e6f9c23a1c4c859a Author: Stefan Metzmacher Date: Fri Aug 22 10:27:01 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_iter() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8cead970e37c40727d9b93ce49e7c445c2caf7d0 Author: Stefan Metzmacher Date: Fri Aug 22 10:21:16 2025 +0200 smb: client: pass struct smbdirect_socket to manage_keep_alive_before_sending() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8a9919b2bf8199206e5c5e223e2dd3d04b93a4e2 Author: Stefan Metzmacher Date: Fri Aug 22 10:19:28 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 869bb7284fb2976b59ad29455cddd44bce0976f7 Author: Stefan Metzmacher Date: Fri Aug 22 10:18:12 2025 +0200 smb: client: pass struct smbdirect_socket to manage_credits_prior_sending() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit be8602d47d4116da477cba0e4284295892887b24 Author: Stefan Metzmacher Date: Fri Aug 22 10:14:29 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_recv() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c7e4d5facb47698411d144ea1c968ef3e1794be9 Author: Stefan Metzmacher Date: Fri Aug 22 10:12:35 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_disconnect_rdma_connection() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8a45d4c9597ff5357a44e88ce9910ccb52add06 Author: Stefan Metzmacher Date: Fri Aug 22 10:10:10 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_mr_list() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 419fc78fd81ffa6d6da847ba46050db1da64b874 Author: Stefan Metzmacher Date: Fri Aug 22 01:17:35 2025 +0200 smb: client: pass struct smbdirect_socket to {enqueue,_get_first}_reassembly() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b8a5d5d1aa00728a4604cc2c2775c0664e821173 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_caches_and_workqueue() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 163e0ff8c6e1ba5d436e125291d05951dcc6ba1c Author: Stefan Metzmacher Date: Fri Aug 22 01:11:36 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_receive_buffers() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f6de7482b42941056f2b3cef0e831abce62ebfa7 Author: Stefan Metzmacher Date: Fri Aug 22 01:07:11 2025 +0200 smb: client: pass struct smbdirect_socket to {get,put}_receive_buffer() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02e6f092c7aa1fa12337978837ad64d1b75bbc82 Author: Stefan Metzmacher Date: Fri Aug 22 00:57:19 2025 +0200 smb: client: make use of smbdirect_socket.mr_io Now struct smbd_connection only contains struct smbdirect_socket, this is an important step towards having common functions as well. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9a52e3b0d63fc5eaefee3707136fa3c5258ae39e Author: Stefan Metzmacher Date: Fri Aug 22 00:32:34 2025 +0200 smb: client: make use of smbdirect_socket_parameters.max_frmr_depth This make it easier to have common code later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f454f36cd0b9ee3b7b6c7181238ef20f1326063a Author: Stefan Metzmacher Date: Thu Aug 21 23:36:33 2025 +0200 smb: client: make use of struct smbdirect_mr_io This will allow us to move to common functions in future too. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5f84b0819a7e678d1004df9aea05d8484ca68ce8 Author: Stefan Metzmacher Date: Fri Aug 22 00:23:53 2025 +0200 smb: client: add and use smbd_get_parameters() In future struct smbdirect_socket_parameters will be the only public structure for the smb layer. This prepares this... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 40212a27c75ff22457d958097a27a3d8815b0a70 Author: Stefan Metzmacher Date: Fri Aug 22 12:29:03 2025 +0200 smb: client: make use of smbdirect_socket.workqueue This will simplify the move to common code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8efb796db30288fab498156ef1fa03a34d88817 Author: Stefan Metzmacher Date: Thu Aug 21 14:50:56 2025 +0200 smb: client: move rdma_readwrite_threshold from smbd_connection to TCP_Server_Info This belongs to the SMB layer not to the transport layer, it just uses the negotiated transport parameters to adjust the value if needed. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ddfcb069c1dd1c909c34605e025e0aeae1b496e3 Author: Stefan Metzmacher Date: Tue Aug 19 13:54:35 2025 +0200 smb: client: make use of smbdirect_socket.statistics This will allow us to use common functions soon. Note this generates the following warnings from scripts/checkpatch.pl --quiet: WARNING: quoted string split across lines #59: FILE: fs/smb/client/cifs_debug.c:481: + seq_printf(m, "\nDebug count_get_receive_buffer: %llu " + "count_put_receive_buffer: %llu count_send_empty: %llu", WARNING: quoted string split across lines #66: FILE: fs/smb/client/cifs_debug.c:486: seq_printf(m, "\nRead Queue " + "count_enqueue_reassembly_queue: %llu " WARNING: quoted string split across lines #67: FILE: fs/smb/client/cifs_debug.c:487: + "count_enqueue_reassembly_queue: %llu " + "count_dequeue_reassembly_queue: %llu " total: 0 errors, 3 warnings, 83 lines checked scripts/checkpatch.pl: FAILED But I left them in there, because it matches the code arround it... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2449c7cc9bc26f8c80560f376f26c6f50b346c0f Author: Stefan Metzmacher Date: Tue Aug 19 12:03:59 2025 +0200 smb: client: remove unused smbd_connection.count_reassembly_queue This basically represents the same information as sc->recv_io.reassembly.queue_length. The only thing that's different is that smbd_connection.count_reassembly_queue was updated in each loop step, while sc->recv_io.reassembly.queue_length is only updated once after the loop in smbd_recv. Also sc->recv_io.reassembly.queue_length is updated under a spinlock. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 87d03d6c829aea8c6cf632ac24ee5227c3b8b00b Author: Stefan Metzmacher Date: Mon Aug 18 10:42:42 2025 +0200 smb: client: remove unused smbd_connection->protocol There is only one protocol version for smbdirect yet and this variable is write only. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4dc536a135e0ef862ccc25f5d68ad5c062dc01a0 Author: Stefan Metzmacher Date: Fri Aug 15 17:57:32 2025 +0200 smb: client: make use of smbdirect_socket.idle.{keepalive,immediate_work,timer_work} This will allow client and server to use the common structures in order to share common functions later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ac31755c7a649786a9e11c6288513f5f4c1d30c9 Author: Stefan Metzmacher Date: Thu Aug 14 19:41:12 2025 +0200 smb: client: fix smbdirect keep alive handling to match the documentation We setup the first timer with the negotiate timeout and set KEEP_ALIVE_PENDING, so that the expired timer disconnects. On every incoming message we need to reset the timer to the keepalive interval (120s). On SMBDIRECT_FLAG_RESPONSE_REQUESTED we need to schedule a response instead of setting KEEP_ALIVE_PENDING. Doing both would mean we would also set SMBDIRECT_FLAG_RESPONSE_REQUESTED in that response. If both ends would do that we'd play ping pong in a busy loop. If we move to KEEP_ALIVE_SENT and send the keepalive request with SMBDIRECT_FLAG_RESPONSE_REQUESTED, we need to setup the timer with keepalive timeout (5s) in order to disconnect if no incoming message reset the timer. The fired timer sets KEEP_ALIVE_PENDING and also setup timer with keepalive timeout (5s) in order to disconnect if no incoming message reset the timer. We do that before queueing the send_immediate_work and have that timer in case we didn't reach the send code that typically sets the timer to keepalive timeout. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1b2c46cdb7c0127711cd72028072d85f6ebd1b53 Author: Stefan Metzmacher Date: Fri Aug 15 12:53:35 2025 +0200 smb: client: send empty packets via send_immediate_work This is what the server already does and it makes refactoring for common structures and functions much easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ea5a4e31ab4757273dacaa7e05368892516b53d6 Author: Stefan Metzmacher Date: Thu Aug 21 12:22:46 2025 +0200 smb: client: make use of smbdirect_socket.rdma.legacy_iwarp Currently it's write only for the client, but it will likely be use for debugging later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit dd53b45fc871cd9eb8ce90b215378c683aae783b Author: Stefan Metzmacher Date: Tue Aug 19 23:18:21 2025 +0200 smb: client: make use of smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code first and then negotiate the value with the peer. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1f2ff73a233005cb1f8e7bc02477603e2f9f4c69 Author: Stefan Metzmacher Date: Thu Aug 14 19:39:22 2025 +0200 smb: client: make use of smbdirect_socket_parameters.{resolve_{addr,route},rdma_connect,negotiate}_timeout_msec This will make future changes to these values much saner. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 14b6088dd97b5332c018a2e87c46be1e8cfdabc8 Author: Stefan Metzmacher Date: Fri Aug 15 11:03:04 2025 +0200 smb: client: fill smbdirect_socket_parameters at the beginning and use the values from there This is what we should do and it also simplifies the following changes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d3e743b514c20bfe26e340835cebb1f8301997ab Author: Stefan Metzmacher Date: Thu Aug 14 18:34:02 2025 +0200 smb: client: remove useless smbd_connection.send_immediate We always set it to true before having an if statement that checks it is true... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c7316ec2d542e27ea717a0d7493902098329f908 Author: Stefan Metzmacher Date: Thu Aug 14 16:32:30 2025 +0200 smb: client: make use of smbdirect_socket.recv_io.{posted,credits} This will make it possible to introduce common helper functions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5fb9b459b3686e366640edd4e62805ef7b4de927 Author: Stefan Metzmacher Date: Thu Aug 14 13:57:37 2025 +0200 smb: client: count the number of posted recv_io messages in order to calculated credits (At least for me) the logic maintaining the count of posted recv_io messages and the count of granted credits is much easier to understand. From there we can easily calculate the number of new_credits we'll grant to the peer in outgoing send_io messages. This will simplify the move to common logic that can be shared between client and server in the following patches. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9219f8cac296769324bbe8a28c289586114244c4 Author: Stefan Metzmacher Date: Thu Aug 14 15:01:35 2025 +0200 smb: client: limit the range of info->receive_credit_target This simplifies further changes... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1a07031fdd56754747a27b48d555152e1daf19cd Author: Stefan Metzmacher Date: Tue Aug 12 09:24:57 2025 +0200 smb: client: remove info->wait_receive_queues handling in smbd_destroy() We already call ib_drain_qp() before, which is an sync operation that only returns in the queues are fully drained. ib_drain_qp() completes pending requests with IB_WC_WR_FLUSH_ERR so we have already called put_receive_buffer(). So all smbdirect_recv_io objects are either in the smbdirect_socket.recv_io.free.list or smbdirect_socket.recv_io.reassembly.list. Then we explicitly iterate smbdirect_socket.recv_io.reassembly.list and call put_receive_buffer(), so every object is in smbdirect_socket.recv_io.free.list. It means info->count_receive_queue == sp->recv_credit_max was already true and calling wait_event(info->wait_receive_queues... is pointless. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8e970358b31a5abba8b5737a67ba7b8d26f4258 Author: Stefan Metzmacher Date: Tue Aug 12 09:44:07 2025 +0200 smb: client: make use of ib_wc_status_msg() and skip IB_WC_WR_FLUSH_ERR logging There's no need to get log message for every IB_WC_WR_FLUSH_ERR completion, but any other error should be logged at level ERR. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02548c477a90481c1fd0d6e7c84b4504ec2fcc12 Author: Stefan Metzmacher Date: Mon Aug 11 17:53:55 2025 +0200 smb: client: queue post_recv_credits_work also if the peer raises the credit target This is already handled in the server, but currently it done in a very complex way there. So we do it much simpler. Note that put_receive_buffer() will take care of it in case data_length is 0. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b0aa92a229ab9e6de3839e06f3a8494bce5b1cd2 Author: Stefan Metzmacher Date: Tue Aug 12 09:10:07 2025 +0200 smb: client: make sure smbd_disconnect_rdma_work() doesn't run after smbd_destroy() took over If we're already disconnecting we don't need to queue the disconnect_work again. disable_work() turns the next queue_work() into a no-op. Also let smbd_destroy() cancel(and disable) queued disconnect_work and call smbd_disconnect_rdma_work() inline. The makes it more obvious that disconnect_work is never queued again after smbd_destroy() called smbd_disconnect_rdma_work(). It also means we have a single place to call rdma_disconnect(). While there we better also disable all other [delayed_]work. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9b1a6b7583cb71e101a93e518e2cbc32911a2b89 Author: Stefan Metzmacher Date: Mon Aug 11 17:11:08 2025 +0200 smb: client: make use of smbdirect_socket.send_io.credits.{count,wait_queue} This will be used by the server too and will allow to create common helper functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ca48841de93cbb911d2d85e84a329bbe0fac412d Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: client: make use of smbdirect_socket.send_io.pending.{count,{dec,zero}_wait_queue} This will be used by the server too and will allow to create common helper functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a51c67db2c9e3f1539f5c441d8db2058ed8644f9 Author: Stefan Metzmacher Date: Fri Aug 8 19:06:49 2025 +0200 smb: client: make use of smbdirect_socket.disconnect_work Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 7360778b6f962bd87472238204b5cf76d98e8122 Author: Stefan Metzmacher Date: Fri Aug 8 15:10:52 2025 +0200 smb: client: make use of smbdirect_socket_init() It's much safer to initialize the whole structure at the beginning than doing it all over the place and then miss to move it if code changes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5a0d5ae65c121decfac03c68a20343e75f636957 Author: Stefan Metzmacher Date: Thu Aug 14 10:06:50 2025 +0200 smb: client: make only use of wake_up[_all]() in smbdirect.c wake_up_interruptible[_all]() doesn't wake up tasks waiting with wait_event(). So we better wake_up[_all]() in order to wake up all tasks in order to simplify the logic. As we currently don't use any wait_event_*_exclusive() it doesn't really matter if we use wake_up() or wake_up_all(). But in this patch I try to use wake_up() for expected situations and wake_up_all() for situations of a broken connection. So don't need to adjust things in future when we may use wait_event_*_exclusive() in order to wake up only one process that should make progress. Changing the wait_event_*() code in order to keep wait_event(), wait_event_interruptible() and wait_event_interruptible_timeout() or changing them to wait_event_killable(), wait_event_killable_timeout(), wait_event_killable_exclusive() is something to think about in a future patch. The goal here is to avoid that some tasks are not woken and freeze forever. Also note that this patch only changes the existing wake_up*() calls. Adding more wake_up*() calls for other wait queues is also deferred to a future patch. Link: https://lore.kernel.org/linux-cifs/13851363-0dc9-465c-9ced-3ede4904eef0@samba.org/T/#t Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d9140ef074239408a1d991819811fadbbe781c79 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:17 2025 +0200 smb: client: make use of smbdirect_socket.status_wait This will allow us to have common helper functions soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4ff3fa4e4aa78c3aa9083a8d448f8af4f0740df7 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:15 2025 +0200 smb: client: use status_wait and SMBDIRECT_SOCKET_RESOLVE_{ADDR,ROUTE}_RUNNING for completion We can use the state change from SMBDIRECT_SOCKET_RESOLVE_{ADDR,ROUTE}_RUNNING to the next state in order to wake the caller to do the next step. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 00e4c7a87d1fa8d5668e2922578ff4aff6efb8a2 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:14 2025 +0200 smb: client: use status_wait and SMBDIRECT_SOCKET_NEGOTIATE_RUNNING for completion We can use the state change from SMBDIRECT_SOCKET_NEGOTIATE_RUNNING to SMBDIRECT_SOCKET_CONNECTED or SMBDIRECT_SOCKET_NEGOTIATE_FAILED in order to notify the caller if the negotiation is over. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit afff34dc025b5f0476645f44b4d9cbc83dd54e71 Author: Stefan Metzmacher Date: Mon Sep 8 12:14:43 2025 +0200 smb: client: adjust smbdirect related output of cifs_debug_data_proc_show() For the reader it is not obvious that the counter values are displayed in hex as there's no leading '0x' before '%x'. So changed them to %u instead and added '0x' for non-counter values and also a string for the status. Note this generates some checkpatch warnings like this: WARNING: quoted string split across lines #45: FILE: fs/smb/client/cifs_debug.c:460: + seq_printf(m, "\nSMBDirect protocol version: 0x%x " + "transport status: %s (%u)", But I'll leave this is the current style in the related code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f5b893edde7bcd15246dfeefd25082fe637db647 Author: Stefan Metzmacher Date: Thu Aug 28 12:11:02 2025 +0200 smb: smbdirect: introduce smbdirect_socket.first_error This will be used when a connected conection gets the first error. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit cc678b8a89291ef55c8dfc01391506f1234c6cae Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: client/smbdirect: introduce SMBDIRECT_SOCKET_ERROR This will be used to turn SMBDIRECT_SOCKET_CONNECTED into an error within smbd_disconnect_rdma_connection() on the client and smb_direct_disconnect_rdma_connection() on the server. We do this in a single commit with the client as otherwise it won't build because the enum value is not handled in the switch statement. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 58dfba8a2d4eb6defc6e710196b053abdaf6cd79 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:13 2025 +0200 smb: client/smbdirect: replace SMBDIRECT_SOCKET_CONNECTING with more detailed states The process of reaching a functional connection represented by SMBDIRECT_SOCKET_CONNECTED, is more complex than using a single SMBDIRECT_SOCKET_CONNECTING state. This will allow us to remove a lot of special variables and completions in the following commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ef71f1e046489c77a2f7d012edc762fba0a7aadc Author: Stefan Metzmacher Date: Wed Aug 20 11:25:06 2025 +0200 smb: client: fix sending the iwrap custom IRD/ORD negotiation messages Do a real negotiation and check the servers initiator_depth and responder_resources. This should use big endian in order to be useful. I have captures of windows clients showing this. The fact that we used little endian up to now means that we sent very large numbers and the negotiation with the server truncated them to the server limits. Note the reason why this uses u8 for initiator_depth and responder_resources is that the rdma layer also uses it. The inconsitency regarding the initiator_depth and responder_resources values being reversed for iwarp devices in RDMA_CM_EVENT_ESTABLISHED should also be fixed later, but for now we should fix it. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-rdma@vger.kernel.org Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6920b4ad49fc7ff5b99a0dcff8e9612753a7a876 Author: Stefan Metzmacher Date: Tue Aug 26 16:30:32 2025 +0200 smb: smbdirect: let smbdirect_socket_init() initialize all [delayed_]work_structs as disabled This safer to start with and allows common code not care about if the caller uses these or not. E.g. sc->mr_io.recovery_work is only used on the client... Note disable_[delayed_]work_sync() requires a valid function pointer in INIT_[DELAYED_]WORK(). The non _sync() version don't require it, but as we need to use the _sync() version on cleanup we better use it here too, it won't block anyway here... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ed3350f09d2c0234c59910ef1655cb9cbe17b0ca Author: Stefan Metzmacher Date: Tue Aug 19 09:34:27 2025 +0200 smb: smbdirect: introduce smbdirect_socket.mr_io.* This will be used by the client and will allow us to move to common code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 41e5086905a3c37c3e5b716192b2dcd719ad8ef5 Author: Stefan Metzmacher Date: Thu Aug 21 23:50:42 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.max_frmr_depth This will be used by the client... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02c39c0121d209117cb10b76df0b960f546b72e3 Author: Stefan Metzmacher Date: Thu Aug 21 16:16:47 2025 +0200 smb: smbdirect: introduce struct smbdirect_mr_io This will be used by the client in order to maintain memory registrations. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6c5b0f9253d7f15722db22da28cd49ab34252214 Author: Stefan Metzmacher Date: Fri Aug 22 12:22:24 2025 +0200 smb: smbdirect: introduce smbdirect_socket.workqueue The client currently used a per socket workqueue because it can block in a work function waiting for credits. So we use a per socket pointer in order to prepare common code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6889d2f5caa69ff4f523ef11a207fcaedaff8c7e Author: Stefan Metzmacher Date: Tue Aug 19 13:52:29 2025 +0200 smb: smbdirect: introduce smbdirect_socket.statistics These will be used by the client and maybe shared code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 89bae05f9df68f827de0106760de53933083a391 Author: Stefan Metzmacher Date: Fri Aug 15 17:47:58 2025 +0200 smb: smbdirect: introduce smbdirect_socket.idle.{keepalive,immediate_work,timer_work} This will allow client and server to use the common structures in order to share common functions later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2baedb2026a5c01e79e9691540eea14d65f7277a Author: Stefan Metzmacher Date: Thu Aug 21 12:13:16 2025 +0200 smb: smbdirect: introduce smbdirect_socket.rdma.legacy_iwarp This will be used by client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8e34a763870dc48b69049c2a4ec032a21d66feb6 Author: Stefan Metzmacher Date: Tue Aug 19 23:18:21 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 932fa15c3726459d0f996893262af33b9f7dc121 Author: Stefan Metzmacher Date: Thu Aug 14 19:12:38 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.{resolve_{addr,route},rdma_connect,negotiate}_timeout_msec These will be used instead of hardcoded values in client and server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ec76e3cc6bbcb17815a4bfa6450d4bae1e708c9b Author: Stefan Metzmacher Date: Mon Aug 11 15:57:04 2025 +0200 smb: smbdirect: introduce smbdirect_socket.recv_io.{posted,credits} This will be used by client and server soon in order to maintain the state of posted recv_io messages and granted credits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b5a4242fb902f3780ef85d4027ba5987b7ce1e2d Author: Stefan Metzmacher Date: Mon Aug 18 21:04:14 2025 +0200 smb: smbdirect: introduce struct smbdirect_rw_io This will be used by the server in order to manage RDMA reads and writes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 90255ed46774bda93a945a6dbf9228d9ecfcd79f Author: Stefan Metzmacher Date: Thu Aug 14 11:41:59 2025 +0200 smb: smbdirect: introduce smbdirect_socket.rw_io.credits This will be used by the server to manage the state for RDMA read/write requests. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit cce93d2d0ccc88d2486e220e4a802c9edc48849b Author: Stefan Metzmacher Date: Mon Aug 18 21:13:03 2025 +0200 smb: smbdirect: introduce struct smbdirect_send_batch This will replace struct smb_direct_send_ctx in the server and allow us move code to the common smbdirect layer soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2191b3471df53d87a46179b0c302c77c9ccfec11 Author: Stefan Metzmacher Date: Mon Aug 11 16:03:00 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.credits.{count,wait_queue} This will be shared between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3b7be44a0eb18b2e51190fd1d26997dc7bddc32d Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.pending.{count,{dec,zero}_wait_queue} This will be shared between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit de32f33c0365d06962675dc2c2269723dd917d0f Author: Stefan Metzmacher Date: Fri Aug 8 19:05:39 2025 +0200 smb: smbdirect: introduce smbdirect_socket.disconnect_work Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 17e1d07430e4bd6a14e2d194791f545f8548ff58 Author: Stefan Metzmacher Date: Fri Aug 8 15:08:33 2025 +0200 smb: smbdirect: introduce smbdirect_socket_init() This will make it easier to keep the initialization in a single place. For now it's an __always_inline function as we only share the header files. Once move to common functions we'll have a dedicated smbdirect.ko that exports functions... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 371d3ab51ce44c8a7c0f9b835b74b7340a922059 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:16 2025 +0200 smb: smbdirect: introduce smbdirect_socket.status_wait This will be used by server and client soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1e2f487584ed426a744b86e04f96662488c7aa0e Author: Stefan Metzmacher Date: Mon Sep 8 12:06:18 2025 +0200 smb: smbdirect: introduce smbdirect_socket_status_string() This will be used for more useful debug messages. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 Author: Arnd Bergmann Date: Wed Sep 24 22:18:33 2025 +0200 i3c: fix big-endian FIFO transfers Short MMIO transfers that are not a multiple of four bytes in size need a special case for the final bytes, however the existing implementation is not endian-safe and introduces an incorrect byteswap on big-endian kernels. This usually does not cause problems because most systems are little-endian and most transfers are multiple of four bytes long, but still needs to be fixed to avoid the extra byteswap. Change the special case for both i3c_writel_fifo() and i3c_readl_fifo() to use non-byteswapping writesl() and readsl() with a single element instead of the byteswapping writel()/readl() that are meant for individual MMIO registers. As data is copied between a FIFO and a memory buffer, the writesl()/readsl() loops are typically based on __raw_readl()/ __raw_writel(), resulting in the order of bytes in the FIFO to match the order in the buffer, regardless of the CPU endianess. The earlier versions in the dw-i3c and i3c-master-cdns had a correct implementation, but the generic version that was recently added broke it. Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()") Cc: Manikanta Guntupalli Signed-off-by: Arnd Bergmann Reviewed-by: Jorge Marques Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org Signed-off-by: Alexandre Belloni commit 8a1f3fd1a89cd1d4acccb0181346ad212a275a69 Author: Alexandre Belloni Date: Wed Sep 24 21:56:00 2025 +0200 i3c: master: adi: fix number of bytes written to fifo adi_i3c_master_wr_to_tx_fifo computes the maximum number of bytes that can be sent to the fifo but never makes use of it, actually limit the number of bytes sent. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509190505.fKGvEJRa-lkp@intel.com/ Reviewed-by: Jorge Marques Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250924195600.122142-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 19692013415486febf71343f5cc539a343a2994b Author: Qinxin Xia Date: Thu Aug 14 21:35:27 2025 +0800 MAINTAINERS: add myself and Barry to dma_map_benchmark maintainers Since Chenxiang has left HiSilicon, Barry and I will jointly maintain this module. Cc: Barry Song Signed-off-by: Qinxin Xia Signed-off-by: Shuah Khan commit edf7e9040fc52c922db947f9c6c36f07377c52ea Author: Chao Yu Date: Sun Sep 28 18:24:22 2025 +0800 f2fs: fix UAF issue in f2fs_merge_page_bio() As JY reported in bugzilla [1], Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace: f2fs_is_cp_guaranteed+0x70/0x98 f2fs_inplace_write_data+0x174/0x2f4 f2fs_do_write_data_page+0x214/0x81c f2fs_write_single_data_page+0x28c/0x764 f2fs_write_data_pages+0x78c/0xce4 do_writepages+0xe8/0x2fc __writeback_single_inode+0x4c/0x4b4 writeback_sb_inodes+0x314/0x540 __writeback_inodes_wb+0xa4/0xf4 wb_writeback+0x160/0x448 wb_workfn+0x2f0/0x5dc process_scheduled_works+0x1c8/0x458 worker_thread+0x334/0x3f0 kthread+0x118/0x1ac ret_from_fork+0x10/0x20 [1] https://bugzilla.kernel.org/show_bug.cgi?id=220575 The panic was caused by UAF issue w/ below race condition: kworker - writepages - f2fs_write_cache_pages - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #1 into bio & cache bio in io->bio_list - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #2 into bio which is linked in io->bio_list write - f2fs_write_begin : write page #1 - f2fs_folio_wait_writeback - f2fs_submit_merged_ipu_write - f2fs_submit_write_bio : submit bio which inclues page #1 and #2 software IRQ - f2fs_write_end_io - fscrypt_free_bounce_page : freed bounced page which belongs to page #2 - inc_page_count( , WB_DATA_TYPE(data_folio), false) : data_folio points to fio->encrypted_page the bounced page can be freed before accessing it in f2fs_is_cp_guarantee() It can reproduce w/ below testcase: Run below script in shell #1: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" Run below script in shell #2: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache. Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") Reported-by: JY Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 72bdca6231a35aaf3fc1f3ac174d5203621d9e7f Author: Yunji Kang Date: Wed Sep 24 16:43:58 2025 +0900 f2fs: readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode In f2fs_precache_extents(), For large files, It requires reading many node blocks. Instead of reading each node block with synchronous I/O, this patch applies readahead so that node blocks can be fetched in advance. It reduces the overhead of repeated sync reads and improves efficiency when precaching extents of large files. I created a file with the same largest extent and executed the test. For this experiment, I set the file's largest extent with an offset of 0 and a size of 1GB. I configured the remaining area with 100MB extents. 5GB test file: dd if=/dev/urandom of=test1 bs=1m count=5120 cp test1 test2 fsync test1 dd if=test1 of=test2 bs=1m skip=1024 seek=1024 count=100 conv=notrunc dd if=test1 of=test2 bs=1m skip=1224 seek=1224 count=100 conv=notrunc ... dd if=test1 of=test2 bs=1m skip=5024 seek=5024 count=100 conv=notrunc reboot I also created 10GB and 20GB files with large extents using the same method. ioctl(F2FS_IOC_PRECACHE_EXTENTS) test results are as follows: +-----------+---------+---------+-----------+ | File size | Before | After | Reduction | +-----------+---------+---------+-----------+ | 5GB | 101.8ms | 37.0ms | 72.1% | | 10GB | 222.9ms | 56.0ms | 74.9% | | 20GB | 446.2ms | 116.4ms | 73.9% | +-----------+---------+---------+-----------+ Tested on a 256GB mobile device with an SM8750 chipset. Reviewed-by: Sungjong Seo Reviewed-by: Sunmin Jeong Signed-off-by: Yunji Kang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 45b70947a425fa121a8b9bcbb77472d9e35def6a Author: Chao Yu Date: Tue Sep 16 16:52:43 2025 +0800 f2fs: add sanity check on ei.len in __update_extent_tree_range() Add a sanity check in __update_extent_tree_range() to detect any zero-sized extent update. Signed-off-by: wangzijie Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1367da7eb875d01102d2ed18654b24d261ff5393 Author: Charan Teja Kalla Date: Wed Sep 24 23:41:38 2025 +0530 mm: swap: check for stable address space before operating on the VMA It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. Link: https://lkml.kernel.org/r/20250924181138.1762750-1-charan.kalla@oss.qualcomm.com Link: https://lore.kernel.org/all/20250815191031.3769540-1-Liam.Howlett@oracle.com/ [1] Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Charan Teja Kalla Suggested-by: David Hildenbrand Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nhat Pham Cc: Peng Zhang Cc: Signed-off-by: Andrew Morton commit 81e78b7ec61e89e8bab9736551839f79b063614c Author: David Hildenbrand Date: Tue Sep 23 16:00:58 2025 +0200 mm: convert folio_page() back to a macro In commit 73b3294b1152 ("mm: simplify folio_page() and folio_page_idx()") we converted folio_page() into a static inline function. However briefly afterwards in commit a847b17009ec ("mm: constify highmem related functions for improved const-correctness") we had to add some nasty const-away casting to make the compiler happy when checking const correctness. So let's just convert it back to a simple macro so the compiler can check const correctness properly. There is the alternative of using a _Generic() similar to page_folio(), but there is not a lot of benefit compared to just using a simple macro. Link: https://lkml.kernel.org/r/20250923140058.2020023-1-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Kiryl Shutsemau Reviewed-by: SeongJae Park Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Dev Jain Reviewed-by: Suren Baghdasaryan Reviewed-by: Lance Yang Reviewed-by: Wei Yang Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Michal Hocko Signed-off-by: Andrew Morton commit 1acc369373008b9eeb930fbb47847c0693055553 Author: Wei Yang Date: Mon Sep 22 14:09:38 2025 +0000 mm/khugepaged: use start_addr/addr for improved readability When collapsing a pmd, there are two address in use: * address points to the start of pmd * address points to each individual page Current naming makes it difficult to distinguish these two and is hence error prone. Considering the plan to collapse mTHP, name the first one `start_addr' and the second `addr' for better readability and consistency. Link: https://lkml.kernel.org/r/20250922140938.27343-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Nico Pache Acked-by: David Hildenbrand Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit dd83609b88986f4add37c0871c3434310652ebd5 Author: Deepanshu Kartikey Date: Fri Sep 26 09:02:54 2025 +0530 hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization"), if the trylock fails or the VMA has no lock, it should skip that VMA. Any remaining mapped pages are handled by remove_inode_hugepages() which is called after hugetlb_vmdelete_list() and uses proper lock ordering to guarantee unmapping success. Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs without shareable locks, the code proceeds to call unmap_hugepage_range(). This causes assertion failures in huge_pmd_unshare() → hugetlb_vma_assert_locked() because no lock is actually held: WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted Call Trace: hugetlb_vma_assert_locked+0x1dd/0x250 huge_pmd_unshare+0x2c8/0x540 __unmap_hugepage_range+0x6e3/0x1aa0 unmap_hugepage_range+0x32e/0x410 hugetlb_vmdelete_list+0x189/0x1f0 Fix by using goto to ensure locks acquired by trylock are always released, even when skipping VMAs without shareable locks. Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 Suggested-by: Andrew Morton Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit fb552b2425cf8f16c9c72229a972d1744b24d855 Author: Ran Xiaokai Date: Fri Sep 26 08:06:59 2025 +0000 alloc_tag: fix boot failure due to NULL pointer dereference There is a boot failure when both CONFIG_DEBUG_KMEMLEAK and CONFIG_MEM_ALLOC_PROFILING are enabled. BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__alloc_tagging_slab_alloc_hook+0x181/0x2f0 Call Trace: kmem_cache_alloc_noprof+0x1c8/0x5c0 __alloc_object+0x2f/0x290 __create_object+0x22/0x80 kmemleak_init+0x122/0x190 mm_core_init+0xb6/0x160 start_kernel+0x39f/0x920 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x104/0x120 common_startup_64+0x12c/0x138 In kmemleak, mem_pool_alloc() directly calls kmem_cache_alloc_noprof(), as a result, current->alloc_tag is NULL, leading to a null pointer dereference. Move the checks for SLAB_NO_OBJ_EXT, SLAB_NOLEAKTRACE, and __GFP_NO_OBJ_EXT to the parent function __alloc_tagging_slab_alloc_hook() to fix this. Also this distinguishes the SLAB_NOLEAKTRACE case between the actual memory allocation failures case, make CODETAG_FLAG_INACCURATE more accurate. Link: https://lkml.kernel.org/r/20250926080659.741991-1-ranxiaokai627@163.com Fixes: b9e2f58ffb84 ("alloc_tag: mark inaccurate allocation counters in /proc/allocinfo output") Signed-off-by: Ran Xiaokai Reviewed-by: Harry Yoo Acked-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: Johannes Weiner Cc: Roman Gushchin Cc: Shakeel Butt Cc: Usama Arif Signed-off-by: Andrew Morton commit 989c2f55ca4839121cbf23b5802f8513dbd54e1e Author: Lance Yang Date: Fri Sep 26 17:24:26 2025 +0800 mm: silence data-race in update_hiwater_rss KCSAN reports a data race on mm_cluster.hiwater_rss, which can be accessed concurrently from various paths like page migration and memory unmapping without synchronization. Since hiwater_rss is a statistical field for accounting purposes, this data race is benign. Annotate both the read and write accesses with data_race() to make KCSAN happy. Link: https://lkml.kernel.org/r/20250926092426.43312-1-lance.yang@linux.dev Signed-off-by: Lance Yang Reported-by: syzbot+60192c8877d0bc92a92b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/68d6364e.050a0220.3390a8.000d.GAE@google.com Acked-by: Vlastimil Babka Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Marco Elver Cc: Rik van Riel Signed-off-by: Andrew Morton commit cde31ecdd1aa1cc495bdf6d5cba84adc276d8861 Author: Xie Yuanbin Date: Mon Sep 22 22:36:18 2025 +0800 mm/memory-failure: don't select MEMORY_ISOLATION We added that "select MEMORY_ISOLATION" in commit ee6f509c3274 ("mm: factor out memory isolate functions"). However, in commit add05cecef80 ("mm: soft-offline: don't free target page in successful page migration") we remove the need for it, where we removed the calls to set_migratetype_isolate() etc. What CONFIG_MEMORY_FAILURE soft-offline support wants is migrate_pages() support. But that comes with CONFIG_MIGRATION. And isolate_folio_to_list() has nothing to do with CONFIG_MEMORY_ISOLATION. Therefore, we can remove "select MEMORY_ISOLATION" of MEMORY_FAILURE. Link: https://lkml.kernel.org/r/20250922143618.48640-1-xieyuanbin1@huawei.com Signed-off-by: Xie Yuanbin Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Acked-by: Miaohe Lin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit b4c9ffb54b3204dc8b4013c6410c897cff8cdd70 Author: Wei Yang Date: Fri Sep 19 07:12:44 2025 +0000 mm/khugepaged: remove definition of struct khugepaged_mm_slot Current code is not correct to get struct khugepaged_mm_slot by mm_slot_entry() without checking mm_slot is !NULL. There is no problem reported since slot is the first element of struct khugepaged_mm_slot. While struct khugepaged_mm_slot is just a wrapper of struct mm_slot, there is no need to define it. Remove the definition of struct khugepaged_mm_slot, so there is not chance to miss use mm_slot_entry(). [richard.weiyang@gmail.com: fix use-after-free crash] Link: https://lkml.kernel.org/r/20250922002834.vz6ntj36e75ehkyp@master Link: https://lkml.kernel.org/r/20250919071244.17020-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Cc: Lance Yang Cc: David Hildenbrand Cc: Dev Jain Cc: Kiryl Shutsemau Cc: xu xin Signed-off-by: Andrew Morton commit 08498be43ee676d8a5eefb22278266322578a3e0 Author: Wei Yang Date: Fri Sep 19 07:12:43 2025 +0000 mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL Patch series "mm_slot: fix the usage of mm_slot_entry", v2. When using mm_slot in ksm, there is code like: slot = mm_slot_lookup(mm_slots_hash, mm); mm_slot = mm_slot_entry(slot, struct ksm_mm_slot, slot); if (mm_slot && ..) { } The mm_slot_entry() won't return a valid value if slot is NULL generally. But currently it works since slot is the first element of struct ksm_mm_slot. To reduce the ambiguity and make it robust, access mm_slot_entry() when slot is !NULL. Link: https://lkml.kernel.org/r/20250919071244.17020-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250919071244.17020-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Lance Yang Cc: Kiryl Shutsemau Cc: xu xin Signed-off-by: Andrew Morton commit 3dfd02c900379d209ac9dcac24b4a61d8478842a Author: Li Zhe Date: Fri Sep 19 17:23:53 2025 +0800 hugetlb: increase number of reserving hugepages via cmdline Commit 79359d6d24df ("hugetlb: perform vmemmap optimization on a list of pages") batches the submission of HugeTLB vmemmap optimization (HVO) during hugepage reservation. With HVO enabled, hugepages obtained from the buddy allocator are not submitted for optimization and their struct-page memory is therefore not released—until the entire reservation request has been satisfied. As a result, any struct-page memory freed in the course of the allocation cannot be reused for the ongoing reservation, artificially limiting the number of huge pages that can ultimately be provided. As commit b1222550fbf7 ("mm/hugetlb: do pre-HVO for bootmem allocated pages") already applies early HVO to bootmem-allocated huge pages, this patch extends the same benefit to non-bootmem pages by incrementally submitting them for HVO as they are allocated, thereby returning struct-page memory to the buddy allocator in real time. The change raises the maximum 2 MiB hugepage reservation from just under 376 GB to more than 381 GB on a 384 GB x86 VM. Link: https://lkml.kernel.org/r/20250919092353.41671-1-lizhe.67@bytedance.com Signed-off-by: Li Zhe Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 08ff89b5659d89966fc845ee5040051d318b8d01 Author: Donet Tom Date: Wed Sep 24 00:17:00 2025 +0530 selftests/mm: add fork inheritance test for ksm_merging_pages counter Add a new selftest to verify whether the `ksm_merging_pages` counter in `mm_struct` is not inherited by a child process after fork. This helps ensure correctness of KSM accounting across process creation. Link: https://lkml.kernel.org/r/e7bb17d374133bd31a3e423aa9e46e1122e74971.1758648700.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: David Hildenbrand Cc: Aboorva Devarajan Cc: Chengming Zhou Cc: "Ritesh Harjani (IBM)" Cc: Wei Yang Cc: xu xin Signed-off-by: Andrew Morton commit 4d6fc29f36341d7795db1d1819b4c15fe9be7b23 Author: Donet Tom Date: Wed Sep 24 00:16:59 2025 +0530 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork Patch series "mm/ksm: Fix incorrect accounting of KSM counters during fork", v3. The first patch in this series fixes the incorrect accounting of KSM counters such as ksm_merging_pages, ksm_rmap_items, and the global ksm_zero_pages during fork. The following patch add a selftest to verify the ksm_merging_pages counter was updated correctly during fork. Test Results ============ Without the first patch ----------------------- # [RUN] test_fork_ksm_merging_page_count not ok 10 ksm_merging_page in child: 32 With the first patch -------------------- # [RUN] test_fork_ksm_merging_page_count ok 10 ksm_merging_pages is not inherited after fork This patch (of 2): Currently, the KSM-related counters in `mm_struct`, such as `ksm_merging_pages`, `ksm_rmap_items`, and `ksm_zero_pages`, are inherited by the child process during fork. This results in inconsistent accounting. When a process uses KSM, identical pages are merged and an rmap item is created for each merged page. The `ksm_merging_pages` and `ksm_rmap_items` counters are updated accordingly. However, after a fork, these counters are copied to the child while the corresponding rmap items are not. As a result, when the child later triggers an unmerge, there are no rmap items present in the child, so the counters remain stale, leading to incorrect accounting. A similar issue exists with `ksm_zero_pages`, which maintains both a global counter and a per-process counter. During fork, the per-process counter is inherited by the child, but the global counter is not incremented. Since the child also references zero pages, the global counter should be updated as well. Otherwise, during zero-page unmerge, both the global and per-process counters are decremented, causing the global counter to become inconsistent. To fix this, ksm_merging_pages and ksm_rmap_items are reset to 0 during fork, and the global ksm_zero_pages counter is updated with the per-process ksm_zero_pages value inherited by the child. This ensures that KSM statistics remain accurate and reflect the activity of each process correctly. Link: https://lkml.kernel.org/r/cover.1758648700.git.donettom@linux.ibm.com Link: https://lkml.kernel.org/r/7b9870eb67ccc0d79593940d9dbd4a0b39b5d396.1758648700.git.donettom@linux.ibm.com Fixes: 7609385337a4 ("ksm: count ksm merging pages for each process") Fixes: cb4df4cae4f2 ("ksm: count allocated ksm rmap_items for each process") Fixes: e2942062e01d ("ksm: count all zero pages placed by KSM") Signed-off-by: Donet Tom Reviewed-by: Chengming Zhou Acked-by: David Hildenbrand Cc: Aboorva Devarajan Cc: David Hildenbrand Cc: Donet Tom Cc: "Ritesh Harjani (IBM)" Cc: Wei Yang Cc: xu xin Cc: [6.6+] Signed-off-by: Andrew Morton commit 0efdedfa537eb534c251a5b4794caaf72cc55869 Author: Donet Tom Date: Thu Sep 18 11:11:44 2025 +0530 drivers/base/node: fix double free in register_one_node() When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure. As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free. This patch removes the redundant kfree(node) from register_one_node() to prevent the double free. Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") Signed-off-by: Donet Tom Acked-by: David Hildenbrand Acked-by: Oscar Salvador Cc: Alison Schofield Cc: Chris Mason Cc: Danilo Krummrich Cc: Dave Jiang Cc: Greg Kroah-Hartman Cc: Hiroyouki Kamezawa Cc: Joanthan Cameron Cc: "Ritesh Harjani (IBM)" Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit 4afb85f5e359e521ef20c0260af17a4490fc83f7 Author: Dev Jain Date: Thu Sep 18 15:04:53 2025 +0530 mm: remove PMD alignment constraint in execmem_vmalloc() When using vmalloc with VM_ALLOW_HUGE_VMAP flag, it will set the alignment to PMD_SIZE internally, if it deems huge mappings to be eligible. Therefore, setting the alignment in execmem_vmalloc is redundant. Apart from this, it also reduces the probability of allocation in case vmalloc fails to allocate hugepages - in the fallback case, vmalloc tries to use the original alignment and allocate basepages, which unfortunately will again be PMD_SIZE passed over from execmem_vmalloc, thus constraining the search for a free space in vmalloc region. Therefore, remove this constraint. Link: https://lkml.kernel.org/r/20250918093453.75676-1-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Mike Rapoport (Microsoft) Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 51032f26cff7a5ab458d549d88b905ca5bf7a7f5 Author: Manish Kumar Date: Thu Sep 18 23:15:28 2025 +0530 mm/memory_hotplug: fix typo 'esecially' -> 'especially' Link: https://lkml.kernel.org/r/20250918174528.90879-1-manish1588@gmail.com Signed-off-by: Manish Kumar Signed-off-by: Andrew Morton commit ab521b4142aa41fdf74efc20e2b1806f35dbc64b Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:11 2025 +0100 mm/rmap: improve mlock tracking for large folios The kernel currently does not mlock large folios when adding them to rmap, stating that it is difficult to confirm that the folio is fully mapped and safe to mlock it. This leads to a significant undercount of Mlocked in /proc/meminfo, causing problems in production where the stat was used to estimate system utilization and determine if load shedding is required. However, nowadays the caller passes a number of pages of the folio that are getting mapped, making it easy to check if the entire folio is mapped to the VMA. mlock the folio on rmap if it is fully mapped to the VMA. Mlocked in /proc/meminfo can still undercount, but the value is closer the truth and is useful for userspace. Link: https://lkml.kernel.org/r/20250923110711.690639-7-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Signed-off-by: Andrew Morton commit 357b92761d942432c90aeeb965f9eb0c94466921 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:10 2025 +0100 mm/filemap: map entire large folio faultaround Currently, kernel only maps part of large folio that fits into start_pgoff/end_pgoff range. Map entire folio where possible. It will match finish_fault() behaviour that user hits on cold page cache. Mapping large folios at once will allow the rmap code to mlock it on add, as it will recognize that it is fully mapped and mlocking is safe. Link: https://lkml.kernel.org/r/20250923110711.690639-6-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 19773df031bcc67d5caa06bf0ddbbff40174be7a Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:09 2025 +0100 mm/fault: try to map the entire file folio in finish_fault() finish_fault() uses per-page fault for file folios. This only occurs for file folios smaller than PMD_SIZE. The comment suggests that this approach prevents RSS inflation. However, it only prevents RSS accounting. The folio is still mapped to the process, and the fact that it is mapped by a single PTE does not affect memory pressure. Additionally, the kernel's ability to map large folios as PMD if they are large enough does not support this argument. When possible, map large folios in one shot. This reduces the number of minor page faults and allows for TLB coalescing. Mapping large folios at once will allow the rmap code to mlock it on add, as it will recognize that it is fully mapped and mlocking is safe. Link: https://lkml.kernel.org/r/20250923110711.690639-5-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Reviewed-by: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 8c49fbafedf15149069cdb9e0d543c4a68a1c683 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:08 2025 +0100 mm/rmap: mlock large folios in try_to_unmap_one() Currently, try_to_unmap_once() only tries to mlock small folios. Use logic similar to folio_referenced_one() to mlock large folios: only do this for fully mapped folios and under page table lock that protects all page table entries. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-4-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit a2880202767daded2898f62265f6cdf4cfb53bc4 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:07 2025 +0100 mm/rmap: fix a mlock race condition in folio_referenced_one() The mlock_vma_folio() function requires the page table lock to be held in order to safely mlock the folio. However, folio_referenced_one() mlocks a large folios outside of the page_vma_mapped_walk() loop where the page table lock has already been dropped. Rework the mlock logic to use the same code path inside the loop for both large and small folios. Use PVMW_PGTABLE_CROSSED to detect when the folio is mapped across a page table boundary. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-3-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 2db579838296239545554443234fafb8f485cca0 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:06 2025 +0100 mm/page_vma_mapped: track if the page is mapped across page table boundary Patch series "mm: Improve mlock tracking for large folios", v3. The patchset includes several fixes and improvements related to mlock tracking of large folios. The main objective is to reduce the undercount of Mlocked memory in /proc/meminfo and improve the accuracy of the statistics. Patches 1-2: These patches address a minor race condition in folio_referenced_one() related to mlock_vma_folio(). Currently, mlock_vma_folio() is called on large folio without the page table lock, which can result in a race condition with unmap (i.e. MADV_DONTNEED). This can lead to partially mapped folios on the unevictable LRU list. While not a significant issue, I do not believe backporting is necessary. Patch 3: This patch adds mlocking logic similar to folio_referenced_one() to try_to_unmap_one(), allowing for mlocking of large folios where possible. Patch 4-5: These patches modifies finish_fault() and faultaround to map in the entire folio when possible, enabling efficient mlocking upon addition to the rmap. Patch 6: This patch makes rmap mlock large folios if they are fully mapped, addressing the primary source of mlock undercount for large folios. This patch (of 6): Add a PVMW_PGTABLE_CROSSSED flag that page_vma_mapped_walk() will set if the page is mapped across page table boundary. Unlike other PVMW_* flags, this one is result of page_vma_mapped_walk() and not set by the caller. folio_referenced_one() will use it to detect if it safe to mlock the folio. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-1-kirill@shutemov.name Link: https://lkml.kernel.org/r/20250923110711.690639-2-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 89e688edcffee7858aa394fd107df98bfd7647a4 Author: Wei Yang Date: Wed Sep 10 09:22:40 2025 +0000 mm/compaction: fix low_pfn advance on isolating hugetlb Commit 56ae0bb349b4 ("mm: compaction: convert to use a folio in isolate_migratepages_block()") converts api from page to folio. But the low_pfn advance for hugetlb page seems wrong when low_pfn doesn't point to head page. Originally, if page is a hugetlb tail page, compound_nr() return 1, which means low_pfn only advance one in next iteration. After the change, low_pfn would advance more than the hugetlb range, since folio_nr_pages() always return total number of the large page. This results in skipping some range to isolate and then to migrate. The worst case for alloc_contig is it does all the isolation and migration, but finally find some range is still not isolated. And then undo all the work and try a new range. Advance low_pfn to the end of hugetlb. Link: https://lkml.kernel.org/r/20250910092240.3981-1-richard.weiyang@gmail.com Fixes: 56ae0bb349b4 ("mm: compaction: convert to use a folio in isolate_migratepages_block()") Signed-off-by: Wei Yang Acked-by: Zi Yan Cc: "Vishal Moola (Oracle)" Cc: Kefeng Wang Cc: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b Author: Phillip Lougher Date: Fri Sep 26 22:59:35 2025 +0100 Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [phillip@squashfs.org.uk: only need to check 64 bit quantity] Link: https://lkml.kernel.org/r/20250926222305.110103-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20250926215935.107233-1-phillip@squashfs.org.uk Fixes: 6545b246a2c8 ("Squashfs: inode operations") Signed-off-by: Phillip Lougher Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d580e5.a00a0220.303701.0019.GAE@google.com/ Cc: Amir Goldstein Cc: Signed-off-by: Andrew Morton commit 94b3f02fb33f56c896d855ccbac270766d1aa48b Author: Sahil Chandna Date: Fri Sep 26 13:20:53 2025 +0530 kallsyms: use kmalloc_array() instead of kmalloc() Replace kmalloc(sizeof(*stat) * 2, GFP_KERNEL) with kmalloc_array(2, sizeof(*stat), GFP_KERNEL) to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. Link: https://lkml.kernel.org/r/20250926075053.25615-1-chandna.linuxkernel@gmail.com Signed-off-by: Sahil Chandna Cc: Shuah Khan Cc: David Hunter Signed-off-by: Andrew Morton commit cf1bb6b2d0f24c138ddaf3e8b8ecbf90273ed558 Author: Sibi Sankar Date: Fri Sep 26 15:04:26 2025 +0530 MAINTAINERS: update Sibi Sankar's email address Switch to using oss.qualcomm.com email ID in the MAINTAINERS file. Also update mailmap to ensure proper attribution across historical commits. Link: https://lkml.kernel.org/r/20250926093426.1735334-1-sibi.sankar@oss.qualcomm.com Signed-off-by: Sibi Sankar Cc: Bjorn Andersson Cc: Carlos Bilbao Cc: Jarkko Sakkinen Cc: Shannon Nelson Signed-off-by: Andrew Morton commit dec91e7ab10ec465d59144aabe69c01723ddd1c4 Author: Phillip Lougher Date: Tue Sep 23 23:06:52 2025 +0100 Squashfs: add SEEK_DATA/SEEK_HOLE support Add support for SEEK_DATA and SEEK_HOLE lseek() whence values. These allow much faster searches for holes and data in sparse files, which can significantly speed up file copying, e.g. before (GNU coreutils, Debian 13): cp --sparse=always big-file / took real 11m58s, user 0m5.764s, sys 11m48s after: real 0.047s, user 0.000s, sys 0.027s Where big-file has a 256 GB hole followed by 47 KB of data. Link: https://lkml.kernel.org/r/20250923220652.568416-3-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher Signed-off-by: Andrew Morton commit 9ee94bfbe930a1b39df53fa2d7b31141b780eb5a Author: Phillip Lougher Date: Tue Sep 23 23:06:51 2025 +0100 Squashfs: add additional inode sanity checking Patch series "Squashfs: performance improvement and a sanity check". This patchset adds an additional sanity check when reading regular file inodes, and adds support for SEEK_DATA/SEEK_HOLE lseek() whence values. This patch (of 2): Add an additional sanity check when reading regular file inodes. A regular file if the file size is an exact multiple of the filesystem block size cannot have a fragment. This is because by definition a fragment block stores tailends which are not a whole block in size. Link: https://lkml.kernel.org/r/20250923220652.568416-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20250923220652.568416-2-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher Signed-off-by: Andrew Morton commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 Author: Johan Hovold Date: Wed Sep 24 10:02:07 2025 +0200 lib/genalloc: fix device leak in of_gen_pool_get() Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool. Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference. Link: https://lkml.kernel.org/r/20250924080207.18006-1-johan@kernel.org Fixes: 9375db07adea ("genalloc: add devres support, allow to find a managed pool by device") Signed-off-by: Johan Hovold Cc: Philipp Zabel Cc: Vladimir Zapolskiy Cc: [3.10+] Signed-off-by: Andrew Morton commit 1daf37592a050da046a03f78b20abb2a91f6d934 Author: Johannes Berg Date: Wed Sep 24 11:43:04 2025 +0200 panic: remove CONFIG_PANIC_ON_OOPS_VALUE There's really no need for this since it's 0 or 1 when CONFIG_PANIC_ON_OOPS is disabled/enabled, so just use IS_ENABLED() instead. The extra symbol goes back to the original code adding it in commit 2a01bb3885c9 ("panic: Make panic_on_oops configurable"). Link: https://lkml.kernel.org/r/20250924094303.18521-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg Signed-off-by: Andrew Morton commit 8f45f089337d924db24397f55697cda0e6960516 Author: Dan Carpenter Date: Tue Sep 23 14:26:07 2025 +0300 ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free. Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") Signed-off-by: Dan Carpenter Reviewed-by: Joseph Qi Reviewed-by: Goldwyn Rodrigues Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 99b70ece33d87500ef7bee8e32cb99772c45ce14 Author: Suchit Karunakaran Date: Tue Sep 23 22:47:21 2025 +0530 checkpatch: suppress strscpy warnings for userspace tools The checkpatch.pl script currently warns against the use of strcpy, strlcpy, and strncpy, recommending strscpy as a safer alternative. However, these warnings are also triggered for code under tools/ and scripts/, which are userspace utilities where strscpy is not available. This patch suppresses these warnings for files in tools/ and scripts/. Link: https://lkml.kernel.org/r/20250923171722.7798-1-suchitkarunakaran@gmail.com Signed-off-by: Suchit Karunakaran Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Lukas Bulwahn Cc: Shuah Khan Signed-off-by: Andrew Morton commit 20a8e0454d833d80d0c0cae304841a50a2a126bd Author: Alistair Popple Date: Tue Sep 23 10:53:33 2025 +1000 cramfs: fix incorrect physical page address calculation Commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") incorrectly replaced the pfn with the physical address when calling vmf_insert_mixed(). Instead the phys_to_pfn_t() call should have been replaced with PHYS_PFN(). Found by inspection after a similar issue was noted in fuse virtio_fs. Link: https://lkml.kernel.org/r/20250923005333.3165032-1-apopple@nvidia.com Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") Signed-off-by: Alistair Popple Reviewed-by: Dev Jain Reviewed-by: David Hildenbrand Cc: Haiyue Wang Cc: Nicolas Pitre Signed-off-by: Andrew Morton commit 634cdfd6b394cf4a5bfaeacf3b325998c752df45 Author: Demi Marie Obenour Date: Sat Sep 13 18:28:49 2025 -0400 kernel: prevent prctl(PR_SET_PDEATHSIG) from racing with parent process exit If a process calls prctl(PR_SET_PDEATHSIG) at the same time that the parent process exits, the child will write to me->pdeath_sig at the same time the parent is reading it. Since there is no synchronization, this is a data race. Worse, it is possible that a subsequent call to getppid() can continue to return the previous parent process ID without the parent death signal being delivered. This happens in the following scenario: parent child forget_original_parent() prctl(PR_SET_PDEATHSIG, SIGKILL) sys_prctl() me->pdeath_sig = SIGKILL; getppid(); RCU_INIT_POINTER(t->real_parent, reaper); if (t->pdeath_signal) /* reads stale me->pdeath_sig */ group_send_sig_info(t->pdeath_signal, ...); And in the following: parent child forget_original_parent() RCU_INIT_POINTER(t->real_parent, reaper); /* also no barrier */ if (t->pdeath_signal) /* reads stale me->pdeath_sig */ group_send_sig_info(t->pdeath_signal, ...); prctl(PR_SET_PDEATHSIG, SIGKILL) sys_prctl() me->pdeath_sig = SIGKILL; getppid(); /* reads old ppid() */ As a result, the following pattern is racy: pid_t parent_pid = getpid(); pid_t child_pid = fork(); if (child_pid == -1) { /* handle error... */ return; } if (child_pid == 0) { if (prctl(PR_SET_PDEATHSIG, SIGKILL) != 0) { /* handle error */ _exit(126); } if (getppid() != parent_pid) { /* parent died already */ raise(SIGKILL); } /* keep going in child */ } /* keep going in parent */ If the parent is killed at exactly the wrong time, the child process can (wrongly) stay running. I didn't manage to reproduce this in my testing, but I'm pretty sure the race is real. KCSAN is probably the best way to spot the race. Fix the bug by holding tasklist_lock for reading whenever pdeath_signal is being written to. This prevents races on me->pdeath_sig, and the locking and unlocking of the rwlock provide the needed memory barriers. If prctl(PR_SET_PDEATHSIG) happens before the parent exits, the signal will be sent. If it happens afterwards, a subsequent getppid() will return the new value. Link: https://lkml.kernel.org/r/20250913-fix-prctl-pdeathsig-race-v1-1-44e2eb426fe9@gmail.com Signed-off-by: Demi Marie Obenour Cc: Oleg Nesterov Cc: Mateusz Guzik Signed-off-by: Andrew Morton commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf Author: Phillip Lougher Date: Fri Sep 19 00:33:08 2025 +0100 Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0. Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk Fixes: 122601408d20 ("Squashfs: export operations") Signed-off-by: Phillip Lougher Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/ Cc: Signed-off-by: Andrew Morton commit f322a97aeb2a05b6b1ee17629145eb02e1a4c6a0 Author: Pratyush Yadav Date: Thu Sep 18 19:06:15 2025 +0200 kho: only fill kimage if KHO is finalized kho_fill_kimage() only checks for KHO being enabled before filling in the FDT to the image. KHO being enabled does not mean that the kernel has data to hand over. That happens when KHO is finalized. When a kexec is done with KHO enabled but not finalized, the FDT page is allocated but not initialized. FDT initialization happens after finalize. This means the KHO segment is filled in but the FDT contains garbage data. This leads to the below error messages in the next kernel: [ 0.000000] KHO: setup: handover FDT (0x10116b000) is invalid: -9 [ 0.000000] KHO: disabling KHO revival: -22 There is no problem in practice, and the next kernel boots and works fine. But this still leads to misleading error messages and garbage being handed over. Only fill in KHO segment when KHO is finalized. When KHO is not enabled, the debugfs interface is not created and there is no way to finalize it anyway. So the check for kho_enable is not needed, and kho_out.finalize alone is enough. Link: https://lkml.kernel.org/r/20250918170617.91413-1-pratyush@kernel.org Fixes: 3bdecc3c93f9 ("kexec: add KHO support to kexec file loads") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Jason Gunthorpe Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit f65dc3b1ab145c9b8b36301256d703c1dd153f71 Author: Roy Vegard Ovesen Date: Sun Sep 28 13:38:27 2025 +0200 ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio On the 1824c output channel 4 left/right is the S/PDIF output, so this needs to be able to be set. I'm guessing that for the 1810c since it has no output channel 4, it does not matter what the gain value of this channel is set to. Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit 0ca29010d426ed5dd08dbd2d03074d1673d963c8 Author: Roy Vegard Ovesen Date: Sun Sep 28 13:38:07 2025 +0200 ALSA: usb-audio: add the initial mix for Presonus Studio 1824c A reasonable initial mix for the 1824c is the one that Presonus Universal Control calls bypass. It mutes all the physical inputs, and connects Daw channel 1 to Line out channel 1 (left) Daw channel 2 to Line out channel 2 (right) Daw channel 3 to Line out channel 3 (left) etc. To get the most out of the 1824c a mixer application like Universal Control is needed. One is available for linux Link: https://github.com/royvegard/baton Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit eb379c3cab44831d7be156612920ae1c67e1f7a4 Merge: 6b9c4a05ae2b53 5c444aa63860f8 Author: Takashi Iwai Date: Sun Sep 28 18:45:34 2025 +0200 Merge branch 'for-linus' into for-next Pull the last minute fixes for 6.17. Signed-off-by: Takashi Iwai commit 6b9c4a05ae2b539bfd4d64a46eb861a57cc08351 Merge: a767d3583d4e80 f8b9c819ea20d1 Author: Takashi Iwai Date: Sun Sep 28 15:41:17 2025 +0200 Merge tag 'asoc-v6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.18 round 2 Some more updates for v6.18, mostly fixes for the earlier pull request with some cleanups and more minor fixes for older code. We do have one new driver, the TI TAS2783A, and some quirks for new platforms. commit 5c444aa63860f81d1f014b2b489c4206a7626c4f Merge: 9f2c0ac1423d5f 733a763dd8b3ac Author: Takashi Iwai Date: Sun Sep 28 15:38:54 2025 +0200 Merge tag 'asoc-fix-v6.17-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 A few final driver specific fixes for v6.17, none super urgent so waiting for v6.18 and backporting is probably fine for htem. commit c64c2a50cdd487e2270c875c1770cd55705d75ff Author: Jerry Hoemann Date: Tue Sep 23 13:03:52 2025 -0600 watchdog/hpwdt New maintianer Update MAINTAINERS file with new contact. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 064a97a29e3ba0e5d75b3b8ad5b762962aaad8ab Author: Michael Walle Date: Fri Sep 12 14:07:43 2025 +0200 dt-bindings: watchdog: add SMARC-sAM67 support The SMARC-sAM67 board has an on-board uC which has the same register interface as the older CPLD implementation on the SMARC-sAL28 board. Although the MCU emulates the same behavior, be prepared for any quirks and add a board specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2ea77fca84f07849aa995271271340d262d0c2e9 Author: Hugh Dickins Date: Sat Sep 27 21:28:06 2025 -0700 modpost: Initialize builtin_modname to stop SIGSEGVs Segmentation fault ./scripts/mod/modpost -o vmlinux.symvers vmlinux.o stops the kernel build. It comes when write_vmlinux_export_c_file() tries to buf_printf alias->builtin_modname. malloc'ed memory is not necessarily zeroed. NULL new->builtin_modname before adding to aliases. Fixes: 5ab23c7923a1 ("modpost: Create modalias for builtin modules") Signed-off-by: Hugh Dickins Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/4590a243-0a7e-b7e6-e2d3-cd1b41a12237@google.com Signed-off-by: Nathan Chancellor commit 4ef77dd584cfd915526328f516fec59e3a54d66e Author: Eric Biggers Date: Sat Sep 27 17:38:33 2025 -0700 libbpf: Replace AF_ALG with open coded SHA-256 Reimplement libbpf_sha256() using some basic SHA-256 C code. This eliminates the newly-added dependency on AF_ALG, which is a problematic UAPI that is not supported by all kernels. Make libbpf_sha256() return void, since it can no longer fail. This simplifies some callers. Also drop the unnecessary 'sha_out_sz' parameter. Finally, also fix the typo in "compute_sha_udpate_offsets". Fixes: c297fe3e9f99 ("libbpf: Implement SHA256 internal helper") Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20250928003833.138407-1-ebiggers@kernel.org Signed-off-by: Alexei Starovoitov commit c7bc7e9070d6bd17fad1a3fc6a7de097834beff8 Author: pengdonglin Date: Tue Sep 16 12:47:22 2025 +0800 ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock Since commit a8bb74acd8efe ("rcu: Consolidate RCU-sched update-side function definitions") there is no difference between rcu_read_lock(), rcu_read_lock_bh() and rcu_read_lock_sched() in terms of RCU read section and the relevant grace period. That means that spin_lock(), which implies rcu_read_lock_sched(), also implies rcu_read_lock(). There is no need no explicitly start a RCU read section if one has already been started implicitly by spin_lock(). Simplify the code and remove the inner rcu_read_lock() invocation. Signed-off-by: pengdonglin Signed-off-by: pengdonglin Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250916044735.2316171-2-dolinux.peng@gmail.com [ rjw: Subject adjustment ] Signed-off-by: Rafael J. Wysocki commit 399dbcadc01ebf0035f325eaa8c264f8b5cd0a14 Author: Rafael J. Wysocki Date: Sun Sep 28 12:18:29 2025 +0200 ACPI: battery: Add synchronization between interface updates There is no synchronization between different code paths in the ACPI battery driver that update its sysfs interface or its power supply class device interface. In some cases this results to functional failures due to race conditions. One example of this is when two ACPI notifications: - ACPI_BATTERY_NOTIFY_STATUS (0x80) - ACPI_BATTERY_NOTIFY_INFO (0x81) are triggered (by the platform firmware) in a row with a little delay in between after removing and reinserting a laptop battery. Both notifications cause acpi_battery_update() to be called and if the delay between them is sufficiently small, sysfs_add_battery() can be re-entered before battery->bat is set which leads to a duplicate sysfs entry error: sysfs: cannot create duplicate filename '/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0A:00/power_supply/BAT1' CPU: 1 UID: 0 PID: 185 Comm: kworker/1:4 Kdump: loaded Not tainted 6.12.38+deb13-amd64 #1 Debian 6.12.38-1 Hardware name: Gateway NV44 /SJV40-MV , BIOS V1.3121 04/08/2009 Workqueue: kacpi_notify acpi_os_execute_deferred Call Trace: dump_stack_lvl+0x5d/0x80 sysfs_warn_dup.cold+0x17/0x23 sysfs_create_dir_ns+0xce/0xe0 kobject_add_internal+0xba/0x250 kobject_add+0x96/0xc0 ? get_device_parent+0xde/0x1e0 device_add+0xe2/0x870 __power_supply_register.part.0+0x20f/0x3f0 ? wake_up_q+0x4e/0x90 sysfs_add_battery+0xa4/0x1d0 [battery] acpi_battery_update+0x19e/0x290 [battery] acpi_battery_notify+0x50/0x120 [battery] acpi_ev_notify_dispatch+0x49/0x70 acpi_os_execute_deferred+0x1a/0x30 process_one_work+0x177/0x330 worker_thread+0x251/0x390 ? __pfx_worker_thread+0x10/0x10 kthread+0xd2/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 kobject: kobject_add_internal failed for BAT1 with -EEXIST, don't try to register things with the same name in the same directory. There are also other scenarios in which analogous issues may occur. Address this by using a common lock in all of the code paths leading to updates of driver interfaces: ACPI Notify () handler, system resume callback and post-resume notification, device addition and removal. This new lock replaces sysfs_lock that has been used only in sysfs_remove_battery() which now is going to be always called under the new lock, so it doesn't need any internal locking any more. Fixes: 10666251554c ("ACPI: battery: Install Notify() handler directly") Closes: https://lore.kernel.org/linux-acpi/20250910142653.313360-1-luogf2025@163.com/ Reported-by: GuangFei Luo Tested-by: GuangFei Luo Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki commit 15cf39221e89ad413c3cc2cb8f15a2487db2ba2f Author: Kumar Kartikeya Dwivedi Date: Sat Sep 27 20:53:04 2025 +0000 selftests/bpf: Add stress test for rqspinlock in NMI Introduce a kernel module that will exercise lock acquisition in the NMI path, and bias toward creating contention such that NMI waiters end up being non-head waiters. Prior to the rqspinlock fix made in the commit 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters"), it was possible for the queueing path of non-head waiters to get stuck in NMI, which this stress test reproduces fairly easily with just 3 CPUs. Both AA and ABBA flavors are supported, and it will serve as a test case for future fixes that address this corner case. More information about the problem in question is available in the commit cited above. When the fix is reverted, this stress test will lock up the system. To enable this test automatically through the test_progs infrastructure, add a load_module_params API to exercise both AA and ABBA cases when running the test. Note that the test runs for at most 5 seconds, and becomes a noop after that, in order to allow the system to make forward progress. In addition, CPU 0 is always kept untouched by the created threads and NMIs. The test will automatically scale to the number of available online CPUs. Note that at least 3 CPUs are necessary to run this test, hence skip the selftest in case the environment has less than 3 CPUs available. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250927205304.199760-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 2085f0f4697234a0f59ed718d0e72f38688210e0 Merge: acbba7f0e5ec97 dc67521c20b701 Author: Rafael J. Wysocki Date: Sun Sep 28 12:01:58 2025 +0200 Merge tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge a thermal driver fix for 6.18 from Daniel Lezcano: "- Add missing file when importing conflicting change for the Renesas RZ/G3E thermal driver (Daniel Lezcano)" * tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC commit 137d1a6355131457723b51a34192320d93d15654 Author: Mark Bloch Date: Mon Sep 22 09:06:31 2025 +0300 net/mlx5: IFC add balance ID and LAG per MP group bits Add interface definitions for load balance ID and LAG per multiplane group functionality. This patch introduces the hardware capability bits needed to support balance ID in multiplane LAG configurations. The new fields include: - load_balance_id: 4-bit field for balance identifier. - lag_per_mp_group: capability bit for LAG per multiplane group support. These interface additions are prerequisites for implementing balance ID support in the MLX5 driver. Signed-off-by: Mark Bloch Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758521191-814350-3-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 1ddf1636e0e058adf2231486da0419243eb49539 Author: Tariq Toukan Date: Mon Sep 22 09:06:30 2025 +0300 net/mlx5: Add IFC bit for TIR/SQ order capability Before this cap, firmware requested a certain creation order between TIR objects and SQs of the same transport domain to properly support the self loopback prevention feature. If order is not preserved, explicit modify_tir operations are necessary after the opening of the SQs. When set, this cap bit indicates that this firmware requirement / limitation no longer holds. Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758521191-814350-2-git-send-email-tariqt@nvidia.com Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Leon Romanovsky commit a767d3583d4e800d6a2d0378d7e57513bb4d4bba Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:02 2025 +0800 ALSA: doc: improved docs about quirk_flags in snd-usb-audio Just briefly described about the option's change and its new usage. Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit 98b5427bb64fbc039b7715992e137a572ac14ff1 Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:01 2025 +0800 ALSA: usb-audio: make param quirk_flags change-able in runtime Change its permision from 0644 to 0444, and add runtime processing. Developers now can change it during sysfs, without rebooting, for debugging new buggy devices. Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit ffd586126a82e497e16336a1006430584d0570c4 Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:00 2025 +0800 ALSA: usb-audio: improve module param quirk_flags It accepts strings like `VID:PID:quirk_flag_name1|quirk_flag_name2;...` from now on, so that we can use it to debug USB audio devices more intuitive and flexible. The compatibility of previous form is kept. Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit ce0172627390c3c3885c60093904c79fbe19c543 Author: Cryolitia PukNgae Date: Sun Sep 28 11:07:59 2025 +0800 ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* Define quirk flags enum and its name. Add helper for converting between quirk flags' name and bit. - snd_usb_quirk_flag_find_name() - snd_usb_quirk_flags_from_name() Add helper for printing debug: log snd_usb_apply_flag_dbg() Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit 329bdcbbd229731dc5a8b6753aa2409f00869331 Merge: fa7d16734f9606 9f2c0ac1423d5f Author: Takashi Iwai Date: Sun Sep 28 08:34:58 2025 +0200 Merge branch 'for-linus' into for-next Pull 6.17-devel branch for applying further changes cleanly. Signed-off-by: Taksahi Iwai commit 9f2c0ac1423d5f267e7f1d1940780fc764b0fee3 Author: Jeongjun Park Date: Sun Sep 28 02:39:24 2025 +0900 ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory. Cc: Reported-by: syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f02665daa2abeef4a947 Fixes: 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") Signed-off-by: Jeongjun Park Signed-off-by: Takashi Iwai commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c Author: Roy Vegard Ovesen Date: Sat Sep 27 17:27:30 2025 +0200 ALSA: usb-audio: add mono main switch to Presonus S1824c The 1824c does not have the A/B switch that the 1810c has, but instead it has a mono main switch that sums the two main output channels to mono. Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit fa7d16734f9606c396681648618dd76a5af861e6 Author: Kriish Sharma Date: Sat Sep 27 14:27:08 2025 +0000 ALSA: compress: document 'chan_map' member in snd_dec_opus When building kernel docs, the following warning appeared: WARNING: ./include/uapi/sound/compress_params.h:364 struct member 'chan_map' not described in 'snd_dec_opus' The inline struct 'snd_dec_opus_ch_map' inside 'snd_dec_opus' was not properly documented. This patch documents the 'chan_map' member and its fields (stream_count, coupled_count, channel_map), resolving the warning. Fixes: 5d36370f3431 ("ALSA: compress: add raw opus codec define and opus decoder structs") Suggested-by: Bagas Sanjaya Signed-off-by: Kriish Sharma Signed-off-by: Takashi Iwai commit 33da2d892b6241a3e71f96acdd0e64de5d70b7f3 Author: Richard Fitzgerald Date: Tue Sep 23 14:03:26 2025 +0100 ASoC: cs35l56: Add support for CS35L56 B2 silicon This adds support for changed firmware addresses on the B2 revision of CS35L56 silicon. Signed-off-by: Richard Fitzgerald Signed-off-by: Takashi Iwai commit ab91835e61ab56d3964f51480955c9661678c269 Author: Richard Fitzgerald Date: Tue Sep 23 14:03:25 2025 +0100 ASoC: cs35l56: Set fw_regs table after getting REVID Defer setting the cs35l56_base.fw_regs pointer until after the REVID has been read in cs35l56_hw_init(). Also make the corresponding change to the cs35l56_hda drivers to prevent a build break. This is preparing for firmware registers that change address between revisions of the same device. Signed-off-by: Richard Fitzgerald Signed-off-by: Takashi Iwai commit 52e06d564ce6a5f03177922b2fa5667781d5ff83 Author: Griffin Kroah-Hartman Date: Sat Sep 27 21:14:45 2025 -0700 Input: aw86927 - add driver for Awinic AW86927 Add support for the I2C-connected Awinic AW86927 LRA haptic driver. This driver includes a hardcoded sine waveform to be uploaded to the AW86927's SRAM for haptic playback. This driver does not currently support all the capabilities of the AW86927, such as F0 calibration, RTP mode, and CONT mode. Signed-off-by: Griffin Kroah-Hartman Link: https://lore.kernel.org/r/20250925-aw86927-v3-2-1fc6265b42de@fairphone.com Signed-off-by: Dmitry Torokhov commit 9fbad55d6f9db98ab9f1d48ac5e5f8f72fbac0cc Author: Griffin Kroah-Hartman Date: Sat Sep 27 21:11:55 2025 -0700 dt-bindings: input: Add Awinic AW86927 Add bindings for the Awinic AW86927 haptic chip which can be found in smartphones. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Griffin Kroah-Hartman Link: https://lore.kernel.org/r/20250925-aw86927-v3-1-1fc6265b42de@fairphone.com Signed-off-by: Dmitry Torokhov commit 166c83f7789ed02dc1f25bc7bed4a1beb25343aa Author: Kael D'Alcamo Date: Sun Sep 21 18:11:34 2025 +0200 dt-bindings: rng: hisi-rng: convert to DT schema Convert the Devicetree binding documentation for hisilicon,hip04-rng and hisilicon,hip05-rng from plain text to YAML. Signed-off-by: Kael D'Alcamo Reviewed-by: Rob Herring (Arm) Signed-off-by: Herbert Xu commit 298ced6c3b3c116987554364998e9d8cb94e0126 Author: Bagas Sanjaya Date: Sat Sep 20 07:16:51 2025 +0700 crypto: doc - Add explicit title heading to API docs Documentation for crypto programming interfaces lack explicit title. As such, all its sections become entries in the toctree index. Add the title heading to tidy up toctree. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Herbert Xu commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 Author: Nishanth Menon Date: Fri Sep 19 08:20:02 2025 -0500 hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values. Add clock initialization code before using the clock. Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") Signed-off-by: Nishanth Menon drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ 1 file changed, 7 insertions(+) Reviewed-by: Alexander Sverdlin Signed-off-by: Herbert Xu commit 5851afffe2ab323a53e184ba5a35fddf268f096b Author: Fan Wu Date: Mon Sep 15 21:15:50 2025 +0000 KEYS: X.509: Fix Basic Constraints CA flag parsing Fix the X.509 Basic Constraints CA flag parsing to correctly handle the ASN.1 DER encoded structure. The parser was incorrectly treating the length field as the boolean value. Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) The basicConstraints extension with CA:TRUE is encoded as: SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) ^-- v[2] ^-- v[3] ^-- v[4] The parser was checking v[3] (the length field, always 0x01) instead of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). Also handle the case where the extension is an empty SEQUENCE (30 00), which is valid for CA:FALSE when the default value is omitted as required by DER encoding rules (X.690 section 11.5). Per ITU-T X.690-0207: - Section 11.5: Default values must be omitted in DER - Section 11.1: DER requires TRUE to be encoded as 0xFF Link: https://datatracker.ietf.org/doc/html/rfc5280 Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") Signed-off-by: Fan Wu Reviewed-by: Lukas Wunner Signed-off-by: Herbert Xu commit 40d4c761200b796a44bf2c7675ae09c87b17d4af Author: Takashi Sakamoto Date: Sun Sep 28 10:19:10 2025 +0900 firewire: core: fix undefined reference error in ARM EABI For ARM EABI, GCC generates a reference to __aeabi_uldivmod when compiling a division of 64-bit integer with 32-bit integer. This function is not available in Linux kernel. In such cases, helper macros are defined in include/linux/math64.h. This commit replaces the division with div_u64(). Fixes: 8ec6a8ec23b9 ("firewire: core: suppress overflow warning when computing jiffies from isochronous cycle") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509270428.FZaO2PPq-lkp@intel.com/ Link: https://lore.kernel.org/r/20250928011910.581475-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 2f7d98f10b8f64525b2c74cae7d70ae5278eb654 Author: Al Viro Date: Sun Jul 20 15:32:31 2025 -0400 Have cc(1) catch attempts to modify ->f_path There are very few places that have cause to do that - all in core VFS now, and all done to files that are not yet opened (or visible to anybody else, for that matter). Let's turn f_path into a union of struct path __f_path and const struct path f_path. It's C, not C++ - 6.5.2.3[4] in C99 and later explicitly allows that kind of type-punning. That way any attempts to bypass these checks will be either very easy to catch, or (if the bastards get sufficiently creative to make it hard to spot with grep alone) very clearly malicious - and still catchable with a bit of instrumentation for sparse. Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ae8425014ddc0e9a852f28ce8fcb952644a8520f Merge: cdc59a62bccadf 1b25dea3867abc a79765248649de Author: Al Viro Date: Sat Sep 27 20:18:21 2025 -0400 Merge branches 'work.path' and 'work.mount' into work.f_path commit cdc59a62bccadf104159547690a06d2b9aa88085 Author: Al Viro Date: Sun Jul 6 16:38:13 2025 -0400 kernel/acct.c: saner struct file treatment Instead of switching ->f_path.mnt of an opened file to internal clone, get a struct path with ->mnt set to internal clone of that ->f_path.mnt, then dentry_open() that to get the file with right ->f_path.mnt from the very beginning. The only subtle part here is that on failure exits we need to close the file with __fput_sync() and make sure we do that *before* dropping the original mount. With that done, only fs/{file_table,open,namei}.c ever store anything to file->f_path and only prior to file->f_mode & FMODE_OPENED becoming true. Analysis of mount write count handling also becomes less brittle and convoluted... [AV: folded a fix for a bug spotted by Jan Kara - we do need a full-blown open of the original file, not just user_path_at() or we end up skipping permission checks] Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit cb3005d4c490fe2489accd5408592683d705b455 Author: Jarkko Nikula Date: Fri Aug 8 16:09:56 2025 +0300 i2c: i801: Add support for Intel Wildcat Lake-U Add SMBus IDs on Intel Wildcat Lake-U. Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit ec67ef0a501d7dc915d84c0ada4ab3697adfa1d9 Author: AngeloGioacchino Del Regno Date: Wed Jun 11 13:08:00 2025 +0200 dt-bindings: i2c: i2c-mt65xx: Add MediaTek MT8196/6991 compatibles Add support for the MediaTek MT8196 Chromebook SoC and for its close relative, the MediaTek Dimensity 9400 MT6991 SoC. Those chips' multiple I2C controller instances are compatible with the ones found in the MT8188 SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley [wsa: rebased] Signed-off-by: Wolfram Sang commit dc67521c20b701b5237ff486ae078829dc1f8fea Author: John Madieu Date: Sat Sep 27 23:08:24 2025 +0200 thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC When applied the change commit 19d3a401a617, a conflict appeared resulting into a manual fix. However the new file rzg3e_thermal.c was not added but stayed locally in source tree and miss to be merged with the entire change. Fix this by adding the file back. Fixes: 19d3a401a617 ("Add thermal driver for the Renesas RZ/G3E SoC") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509272225.sARVqv2G-lkp@intel.com Signed-off-by: John Madieu Signed-off-by: Daniel Lezcano commit c07b3e60b4d853056f696c449d4d47701dc9f36f Merge: c149841b069ccc 217f92d91c9fae Author: Wolfram Sang Date: Sun Sep 28 00:10:34 2025 +0200 Merge tag 'i2c-host-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.18 - Add support for MediaTek MT6878 I2C - Drop support for S3C2410 commit 720a485d12c590750f40f4ffbe41e36725f43f3d Author: Eric Biggers Date: Sat Aug 9 10:19:41 2025 -0700 KEYS: trusted_tpm1: Move private functionality out of public header Move functionality used only by trusted_tpm1.c out of the public header . Specifically, change the exported functions into static functions, since they are not used outside trusted_tpm1.c, and move various other definitions and inline functions to trusted_tpm1.c. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 366284cfbc8ff4110c00fc23285449f53df739a7 Author: Eric Biggers Date: Sat Aug 9 10:19:40 2025 -0700 KEYS: trusted_tpm1: Use SHA-1 library instead of crypto_shash Use the SHA-1 and HMAC-SHA1 library functions instead of crypto_shash. This is simpler and faster. Replace the selection of CRYPTO, CRYPTO_HMAC, and CRYPTO_SHA1 with CRYPTO_LIB_SHA1 and CRYPTO_LIB_UTILS. The latter is needed for crypto_memneq() which was previously being pulled in via CRYPTO. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit eed0e3d305530066b4fc5370107cff8ef1a0d229 Author: Eric Biggers Date: Sat Aug 9 10:19:39 2025 -0700 KEYS: trusted_tpm1: Compare HMAC values in constant time To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq(). [For the Fixes commit I used the commit that introduced the memcmp(). It predates the introduction of crypto_memneq(), but it was still a bug at the time even though a helper function didn't exist yet.] Fixes: d00a1c72f7f4 ("keys: add new trusted key-type") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f12b69d8f22824a07f17c1399c99757072de73e0 Author: Sven Eckelmann Date: Sat Sep 27 19:39:08 2025 +0200 batman-adv: Release references to inactive interfaces Trying to dump the originators or the neighbors via netlink for a meshif with an inactive primary interface is not allowed. The dump functions were checking this correctly but they didn't handle non-existing primary interfaces and existing _inactive_ interfaces differently. (Primary) batadv_hard_ifaces hold a references to a net_device. And accessing them is only allowed when either being in a RCU/spinlock protected section or when holding a valid reference to them. The netlink dump functions use the latter. But because the missing specific error handling for inactive primary interfaces, the reference was never dropped. This reference counting error was only detected when the interface should have been removed from the system: unregister_netdevice: waiting for batadv_slave_0 to become free. Usage count = 2 Cc: stable@vger.kernel.org Fixes: 6ecc4fd6c2f4 ("batman-adv: netlink: reduce duplicate code by returning interfaces") Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit e835faaed2f80ee8652f59a54703edceab04f0d9 Author: Akiva Goldberger Date: Thu Sep 25 13:45:30 2025 +0300 net/mlx5: Expose uar access and odp page fault counters Add three counters to vnic health reporter: bar_uar_access, odp_local_triggered_page_fault, and odp_remote_triggered_page_fault. - bar_uar_access number of WRITE or READ access operations to the UAR on the PCIe BAR. - odp_local_triggered_page_fault number of locally-triggered page-faults due to ODP. - odp_remote_triggered_page_fault number of remotly-triggered page-faults due to ODP. Example access: $ devlink health diagnose pci/0000:08:00.0 reporter vnic vNIC env counters: total_error_queues: 0 send_queue_priority_update_flow: 0 comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 invalid_command: 0 quota_exceeded_command: 0 nic_receive_steering_discard: 0 icm_consumption: 1032 bar_uar_access: 1279 odp_local_triggered_page_fault: 20 odp_remote_triggered_page_fault: 34 Signed-off-by: Akiva Goldberger Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758797130-829564-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit be812ace0378a9db86344ad637c5ed2a5d11f216 Author: Gustavo A. R. Silva Date: Tue Sep 9 14:13:35 2025 +0200 Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the __struct_group() helper to fix 31 instances of the following type of warnings: 30 net/bluetooth/mgmt_config.c:16:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 1 net/bluetooth/mgmt_config.c:22:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c Author: Luiz Augusto von Dentz Date: Fri Sep 19 12:30:05 2025 -0400 Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements When creating an advertisement for BIG the address shall not be non-resolvable since in case of acting as BASS/Broadcast Assistant the address must be the same as the connection in order to use the PAST method and even when PAST/BASS are not in the picture a Periodic Advertisement can still be synchronized thus the same argument as to connectable advertisements still stand. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac Author: Pauli Virtanen Date: Mon Sep 22 21:11:22 2025 +0300 Bluetooth: ISO: don't leak skb in ISO_CONT RX For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the skb is leaked. Free skb after copying its data. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 6ba85da5804efffe15c89b03742ea868f20b4172 Author: Pauli Virtanen Date: Mon Sep 22 21:11:21 2025 +0300 Bluetooth: ISO: free rx_skb if not consumed If iso_conn is freed when RX is incomplete, free any leftover skb piece. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 Author: Luiz Augusto von Dentz Date: Mon Sep 22 16:27:51 2025 -0400 Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz commit ecb9a843be4d6fd710d7026e359f21015a062572 Author: Luiz Augusto von Dentz Date: Mon Sep 22 13:13:13 2025 -0400 Bluetooth: SCO: Fix UAF on sco_conn_free BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731 __do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: cen zhang Signed-off-by: Luiz Augusto von Dentz commit ca94b2b036c22556c3a66f1b80f490882deef7a6 Author: Ivan Pravdin Date: Sat Aug 30 16:03:40 2025 -0400 Bluetooth: bcsp: receive data only if registered Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin Signed-off-by: Luiz Augusto von Dentz commit 70cd38d22d4659ca8133c7124528c90678215dda Author: Chris Lu Date: Thu Sep 4 19:46:11 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 Add VID 13d3 & PID 3633 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3633 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 576952cf981b7d2b7d3227b246b4326e5548a133 Author: Chris Lu Date: Thu Sep 4 15:58:00 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925 Add VID 13d3 & PID 3627 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=07 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3627 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 93f06f8f0daf43d87b4f61a3535a9cda62c61dd7 Author: Calvin Owens Date: Mon Aug 25 21:11:08 2025 -0700 Bluetooth: remove duplicate h4_recv_buf() in header The "h4_recv.h" header contains a duplicate h4_recv_buf() that is nearly but not quite identical to the h4_recv_buf() in hci_h4.c. This duplicated header was added in commit 07eb96a5a7b0 ("Bluetooth: bpa10x: Use separate h4_recv_buf helper"). I wasn't able to find any explanation for duplicating the code in the discussion: https://lore.kernel.org/all/20180320181855.37297-1-marcel@holtmann.org/ https://lore.kernel.org/all/20180324091954.73229-2-marcel@holtmann.org/ Unfortunately, in the years since, several other drivers have come to also rely on this duplicated function, probably by accident. This is, at the very least, *extremely* confusing. It's also caused real issues when it's become out-of-sync, see the following: ef564119ba83 ("Bluetooth: hci_h4: Add support for ISO packets") 61b27cdf025b ("Bluetooth: hci_h4: Add support for ISO packets in h4_recv.h") This is the full diff between the two implementations today: --- orig.c +++ copy.c @@ -1,117 +1,100 @@ { - struct hci_uart *hu = hci_get_drvdata(hdev); - u8 alignment = hu->alignment ? hu->alignment : 1; - /* Check for error from previous call */ if (IS_ERR(skb)) skb = NULL; while (count) { int i, len; - /* remove padding bytes from buffer */ - for (; hu->padding && count > 0; hu->padding--) { - count--; - buffer++; - } - if (!count) - break; - if (!skb) { for (i = 0; i < pkts_count; i++) { if (buffer[0] != (&pkts[i])->type) continue; skb = bt_skb_alloc((&pkts[i])->maxlen, GFP_ATOMIC); if (!skb) return ERR_PTR(-ENOMEM); hci_skb_pkt_type(skb) = (&pkts[i])->type; hci_skb_expect(skb) = (&pkts[i])->hlen; break; } /* Check for invalid packet type */ if (!skb) return ERR_PTR(-EILSEQ); count -= 1; buffer += 1; } len = min_t(uint, hci_skb_expect(skb) - skb->len, count); skb_put_data(skb, buffer, len); count -= len; buffer += len; /* Check for partial packet */ if (skb->len < hci_skb_expect(skb)) continue; for (i = 0; i < pkts_count; i++) { if (hci_skb_pkt_type(skb) == (&pkts[i])->type) break; } if (i >= pkts_count) { kfree_skb(skb); return ERR_PTR(-EILSEQ); } if (skb->len == (&pkts[i])->hlen) { u16 dlen; switch ((&pkts[i])->lsize) { case 0: /* No variable data length */ dlen = 0; break; case 1: /* Single octet variable length */ dlen = skb->data[(&pkts[i])->loff]; hci_skb_expect(skb) += dlen; if (skb_tailroom(skb) < dlen) { kfree_skb(skb); return ERR_PTR(-EMSGSIZE); } break; case 2: /* Double octet variable length */ dlen = get_unaligned_le16(skb->data + (&pkts[i])->loff); hci_skb_expect(skb) += dlen; if (skb_tailroom(skb) < dlen) { kfree_skb(skb); return ERR_PTR(-EMSGSIZE); } break; default: /* Unsupported variable length */ kfree_skb(skb); return ERR_PTR(-EILSEQ); } if (!dlen) { - hu->padding = (skb->len + 1) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - /* No more data, complete frame */ (&pkts[i])->recv(hdev, skb); skb = NULL; } } else { - hu->padding = (skb->len + 1) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - /* Complete frame */ (&pkts[i])->recv(hdev, skb); skb = NULL; } } return skb; } -EXPORT_SYMBOL_GPL(h4_recv_buf) As I read this: If alignment is one, and padding is zero, padding remains zero throughout the loop. So it seems to me that the two functions behave strictly identically in that case. All the duplicated defines are also identical, as is the duplicated h4_recv_pkt structure declaration. All four drivers which use the duplicated function use the default alignment of one, and the default padding of zero. I therefore conclude the duplicate function may be safely replaced with the core one. I raised this in an RFC a few months ago, and didn't get much interest: https://lore.kernel.org/all/CABBYNZ+ONkYtq2fR-8PtL3X-vetvJ0BdP4MTw9cNpjLDzG3HUQ@mail.gmail.com/ ...but I'm still wary I've missed something, and I'd really appreciate more eyeballs on it. I tested this successfully on btnxpuart a few months ago, but unfortunately I no longer have access to that hardware. Cc: Marcel Holtmann Signed-off-by: Calvin Owens Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c Author: Arkadiusz Bokowy Date: Wed Aug 27 18:40:16 2025 +0200 Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Some Barrot based USB Bluetooth dongles erroneously send one extra random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The consequence of that is that the next HCI transfer is misaligned by one byte causing undefined behavior. In most cases the response event for the next command fails with random error code. Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI controller initialization, the initialization fails rendering the USB dongle not usable. > [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd > [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 > [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0 > [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter > [61.720116] Bluetooth: hci1: command 0x1005 tx timeout > [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110 This patch was tested with the 33fa:0012 device. The info from the /sys/kernel/debug/usb/devices is shown below: T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=33fa ProdID=0012 Rev=88.91 S: Product=UGREEN BT6.0 Adapter C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Now the device is initialized properly: > [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg > [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 > [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0 > [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter > [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes > [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes > [43.750141] Bluetooth: MGMT ver 1.23 Link: https://github.com/bluez/bluez/issues/1326 Signed-off-by: Arkadiusz Bokowy Tested-by: Arkadiusz Bokowy Signed-off-by: Luiz Augusto von Dentz commit 48a258b198c12685747beaf6392f2b68e6c542c2 Author: Luiz Augusto von Dentz Date: Wed Aug 20 12:21:09 2025 -0400 Bluetooth: hci_core: Print information of hcon on hci_low_sent This prints the information about the hcon on hci_low_sent to confirm all connection are being processed. Signed-off-by: Luiz Augusto von Dentz commit 3c34d6428740e47b29ae3afd85d6f9eb656a3ea3 Author: Luiz Augusto von Dentz Date: Tue Aug 19 15:31:28 2025 -0400 Bluetooth: hci_core: Print number of packets in conn->data_q This attempts to print the number of packets pending to be transmitted in the conn->data_q. Signed-off-by: Luiz Augusto von Dentz commit 9eb14331885b09adfa7fe69a5a4603e24909c88f Author: Luiz Augusto von Dentz Date: Mon Aug 18 16:43:53 2025 -0400 Bluetooth: Add function and line information to bt_dbg When enabling debug via CONFIG_BT_FEATURE_DEBUG include function and line information by default otherwise it is hard to make any sense of which function the logs comes from. Signed-off-by: Luiz Augusto von Dentz commit 79e562a52adea4afa0601a15964498fae66c823c Author: Luiz Augusto von Dentz Date: Wed Aug 20 08:50:12 2025 -0400 Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO was not called with a specific index which breaks the likes of bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an adapter is plugged, so instead of depending hdev not to be set just enable the UUID on any index like it was done with iso_sock_uuid. Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") Signed-off-by: Luiz Augusto von Dentz commit c9beb36c14660713b948e289b1e352cc3d386d44 Author: Luiz Augusto von Dentz Date: Wed Aug 13 15:57:39 2025 -0400 Bluetooth: hci_core: Detect if an ISO link has stalled This attempts to detect if an ISO link has been waiting for an ISO buffer for longer than the maximum allowed transport latency then proceed to use hci_link_tx_to which prints an error and disconnects. Signed-off-by: Luiz Augusto von Dentz commit 339a87883a14d6a818ca436fed41aa5d10e0f4bd Author: Luiz Augusto von Dentz Date: Wed Aug 13 15:21:19 2025 -0400 Bluetooth: ISO: Use sk_sndtimeo as conn_timeout This aligns the usage of socket sk_sndtimeo as conn_timeout when initiating a connection and then use it when scheduling the resulting HCI command, similar to what has been done in bf98feea5b65 ("Bluetooth: hci_conn: Always use sk_timeo as conn_timeout"). Signed-off-by: Luiz Augusto von Dentz commit 69a86cc17811c411fe336eb484a23bc0b425a814 Author: Luiz Augusto von Dentz Date: Fri Jun 27 11:18:30 2025 -0400 Bluetooth: HCI: Fix using LE/ACL buffers for ISO packets ISO packets shall not use LE/ACL buffer pool, that feature seem to be exclusive to LE-ACL only. Signed-off-by: Luiz Augusto von Dentz commit d79c7d01f1c8bcf9a48337c8960d618fbe31fc0c Author: Luiz Augusto von Dentz Date: Fri Jun 27 11:18:29 2025 -0400 Bluetooth: ISO: Don't initiate CIS connections if there are no buffers If the controller has no buffers left return -ENOBUFF to indicate that iso_cnt might be out of sync. Signed-off-by: Luiz Augusto von Dentz commit 8183c8ea8762b1de6d2e32f36531d6ea81878f11 Author: Bartosz Golaszewski Date: Mon Aug 11 17:04:00 2025 +0200 MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver Patches modifying drivers/bluetooth/hci_qca.c should be Cc'ed to the linux-arm-msm mailing list so that Qualcomm maintainers and reviewers can get notified about proposed changes to it. Add a sub-entry that adds the mailing list to the list of addresses returned by get_maintainer.pl. Acked-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 58fddb364dd5c4e9bf223a2113a42538d9c040de Author: Kiran K Date: Wed Aug 6 12:18:49 2025 +0530 Bluetooth: btintel_pcie: Refactor Device Coredump As device coredumps are not HCI traces, maintain the device coredump at the driver level and eliminate the dependency on hdev_devcd*() Signed-off-by: Kiran K Fixes: 07e6bddb54b4 ("Bluetooth: btintel_pcie: Add support for device coredump") Signed-off-by: Luiz Augusto von Dentz commit 5967c08545e9d591e06c205b74fd25f8a702029c Author: Thorsten Blum Date: Mon Aug 11 11:19:06 2025 +0200 Bluetooth: btintel_pcie: Use strscpy() instead of strscpy_pad() kzalloc() already zero-initializes the destination buffer 'data', making strscpy() sufficient for safely copying 'name'. The additional NUL-padding performed by strscpy_pad() is unnecessary. Add a new local variable to store the length of 'name' and reuse it instead of recalculating the same length. Signed-off-by: Thorsten Blum Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit d4e99db3d942c8099006f3b7536bc52f766b475a Author: Thorsten Blum Date: Sun Aug 10 23:53:20 2025 +0200 Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le() Add the __counted_by_le() compiler attribute to the flexible array member 'supported_commands' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz commit 3e94262921990e2884ff7a49064c12fb6d3a0733 Author: Chandrashekar Devegowda Date: Thu Jul 31 16:47:11 2025 +0530 Bluetooth: btintel_pcie: Define hdev->wakeup() callback Implement hdev->wakeup() callback to support Wake On BT feature. Test steps: 1. echo enabled > /sys/bus/pci/devices/0000:00:14.7/power/wakeup 2. connect bluetooth hid device 3. put the system to suspend - rtcwake -m mem -s 300 4. press any key on hid to wake up the system Signed-off-by: Kiran K Signed-off-by: Chandrashekar Devegowda Signed-off-by: Luiz Augusto von Dentz commit 34ecb8760190606472f71ebf4ca2817928ce5d40 Author: Zenm Chen Date: Sat Jul 26 00:14:32 2025 +0800 Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 Add USB ID 2001:332a for D-Link AX9U rev. A1 which is based on a Realtek RTL8851BU chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2001 ProdID=332a Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00e04c000001 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu_git E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org # 6.12.x Signed-off-by: Zenm Chen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit ee333727de222345e8c0a1ddcb8141e176fc147a Author: Luiz Augusto von Dentz Date: Mon Jul 28 14:05:14 2025 -0400 Bluetooth: btintel_pcie: Move model comment before its definition This prevents the comments going over 80 columns which is still required for Bluetooth code. Signed-off-by: Luiz Augusto von Dentz commit 04efaba1d7615a000195762e9f1dac69bd3b089a Author: Kiran K Date: Mon Jul 28 21:19:09 2025 +0530 Bluetooth: btintel_pcie: Add id of Scorpious, Panther Lake-H484 sudo lspci -v -k -d 8086:e376 00:14.7 Bluetooth: Intel Corporation Device e376 Subsystem: Intel Corporation Device 0011 Flags: bus master, fast devsel, latency 0, IRQ 16, IOMMU group 14 Memory at 14815368000 (64-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [80] MSI-X: Enable+ Count=32 Masked- Capabilities: [100] Latency Tolerance Reporting Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie Reviewed-by: Paul Menzel Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 2bae7d46149339905a4b89543c5c5b98c1771b30 Author: Kiran K Date: Mon Jul 28 21:19:08 2025 +0530 Bluetooth: btintel_pcie: Add Bluetooth core/platform as comments Add Bluetooth CNVi core and platform names to the PCI device table for each device ID as a comment. Reviewed-by: Paul Menzel Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit e57362f4911b025c31e032c7e1c67389b7eb8dd1 Author: Chandrashekar Devegowda Date: Fri Jul 25 14:31:33 2025 +0530 Bluetooth: btintel_pcie: Add support for _suspend() / _resume() This patch implements _suspend() and _resume() functions for the Bluetooth controller. When the system enters a suspended state, the driver notifies the controller to perform necessary housekeeping tasks by writing to the sleep control register and waits for an alive interrupt. The firmware raises the alive interrupt when it has transitioned to the D3 state. The same flow occurs when the system resumes. Command to test host initiated wakeup after 60 seconds sudo rtcwake -m mem -s 60 dmesg log (tested on Whale Peak2 on Panther Lake platform) On system suspend: [Fri Jul 25 11:05:37 2025] Bluetooth: hci0: device entered into d3 state from d0 in 80 us On system resume: [Fri Jul 25 11:06:36 2025] Bluetooth: hci0: device entered into d0 state from d3 in 7117 us Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Signed-off-by: Arnd Bergmann Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 926e8bfaaa11471b3df25befc284da62b11a1e92 Author: Kiran K Date: Thu Jul 24 17:58:24 2025 +0530 Bluetooth: btintel: Add support for BlazarIW core Add support for the BlazarIW Bluetooth core used in the Wildcat Lake platform. HCI traces: < HCI Command: Intel Read Version (0x3f|0x0005) plen 1 Requested Type: All Supported Types(0xff) > HCI Event: Command Complete (0x0e) plen 122 Intel Read Version (0x3f|0x0005) ncmd 1 Status: Success (0x00) ..... CNVi BT(18): 0x00223700 - BlazarIW(0x22) ..... ..... Signed-off-by: Vijay Satija Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 0e8e60e86cf3292e747a0fa7cc13127f290323ad Author: Daniel Borkmann Date: Fri Sep 26 19:12:01 2025 +0200 selftests/bpf: Add test case for different expected_attach_type Add a small test case which adds two programs - one calling the other through a tailcall - and check that BPF rejects them in case of different expected_attach_type values: # ./vmtest.sh -- ./test_progs -t xdp_devmap [...] #641/1 xdp_devmap_attach/DEVMAP with programs in entries:OK #641/2 xdp_devmap_attach/DEVMAP with frags programs in entries:OK #641/3 xdp_devmap_attach/Verifier check of DEVMAP programs:OK #641/4 xdp_devmap_attach/DEVMAP with programs in entries on veth:OK #641 xdp_devmap_attach:OK Summary: 2/4 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250926171201.188490-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 4540aed51b12bc13364149bf95f6ecef013197c0 Author: Daniel Borkmann Date: Fri Sep 26 19:12:00 2025 +0200 bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue. Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reviewed-by: Dongliang Mu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 528f218b31aac4bbfc58914d43766a22ab545d48 Author: Randall P. Embry Date: Fri Sep 26 18:27:31 2025 +0900 9p: sysfs_init: don't hardcode error to ENOMEM v9fs_sysfs_init() always returned -ENOMEM on failure; return the actual sysfs_create_group() error instead. Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 Author: Randall P. Embry Date: Fri Sep 26 18:27:30 2025 +0900 9p: fix /sys/fs/9p/caches overwriting itself caches_show() overwrote its buffer on each iteration, so only the last cache tag was visible in sysfs output. Properly append with snprintf(buf + count, …). Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 623fa18f6c94e589b29c4e6277943364f1bb71d6 Author: Randall P. Embry Date: Fri Sep 26 18:27:29 2025 +0900 9p: clean up comment typos Fix a few minor typos in comments (e.g. "trasnport" → "transport"). Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-1-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 632d31067be2f414c57955efcf29c79290cc749b Author: Pin-yen Lin Date: Fri Sep 26 18:23:18 2025 +0800 PM: sleep: Do not wait on SYNC_STATE_ONLY device links Device links with DL_FLAG_SYNC_STATE_ONLY should not affect system suspend and resume, and functions like device_reorder_to_tail() and device_link_add() don't try to reorder the consumers with that flag. However, dpm_wait_for_consumers() and dpm_wait_for_suppliers() don't check thas flag before triggering dpm_wait(), leading to potential hang during suspend/resume. This can be reproduced on MT8186 Corsola Chromebook with devicetree like: usb-a-connector { compatible = "usb-a-connector"; port { usb_a_con: endpoint { remote-endpoint = <&usb_hs>; }; }; }; usb_host { compatible = "mediatek,mt8186-xhci", "mediatek,mtk-xhci"; port { usb_hs: endpoint { remote-endpoint = <&usb_a_con>; }; }; }; In this case, the two nodes form a cycle and a SYNC_STATE_ONLY devlink between usb_host (supplier) and usb-a-connector (consumer) is created. Address this by exporting device_link_flag_is_sync_state_only() and making dpm_wait_for_consumers() and dpm_wait_for_suppliers() use it when deciding if dpm_wait() should be called. Fixes: 05ef983e0d65a ("driver core: Add device link support for SYNC_STATE_ONLY flag") Signed-off-by: Pin-yen Lin Link: https://patch.msgid.link/20250926102320.4053167-1-treapking@chromium.org [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 50a098e3e9b1bb30cefc43cdfba3c7b9b32e14a7 Author: Takashi Iwai Date: Sat Sep 27 11:47:23 2025 +0200 ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 HP-Spectre 14t-ea100 model has no speaker output unless booting previously from Windows on dual boot, a reboot while on Linux will stop the speakers working. Applying the existing quirk for HP Spectre X360 EU0xxx seems fixing this speaker problem. Reported-by: Kaden Berger Cc: Link: https://lore.kernel.org/aMxdGAmfOQ6VPNU8@archlinux Signed-off-by: Takashi Iwai commit fed7eaa4f037361fe4f3d4170649d6849a25998d Author: Brian Norris Date: Thu Sep 25 12:42:16 2025 -0700 PM: runtime: Update kerneldoc return codes APIs based on __pm_runtime_idle() (pm_runtime_idle(), pm_request_idle()) do not return 1 when already suspended. They return -EAGAIN. This is already covered in the docs, so the entry for "1" is redundant and conflicting. (pm_runtime_put() and pm_runtime_put_sync() were previously incorrect, but that's fixed in "PM: runtime: pm_runtime_put{,_sync}() returns 1 when already suspended", to ensure consistency with APIs like pm_runtime_put_autosuspend().) RPM_GET_PUT APIs based on __pm_runtime_suspend() do return 1 when already suspended, but the language is a little unclear -- it's not really an "error", so it seems better to list as a clarification before the 0/success case. Additionally, they only actually return 1 when the refcount makes it to 0; if the usage counter is still non-zero, we return 0. pm_runtime_put(), etc., also don't appear at first like they can ever see "-EAGAIN: Runtime PM usage_count non-zero", because in non-racy conditions, pm_runtime_put() would drop its reference count, see it's non-zero, and return early (in __pm_runtime_idle()). However, it's possible to race with another actor that increments the usage_count afterward, since rpm_idle() is protected by a separate lock; in such a case, we may see -EAGAIN. Because this case is only seen in the presence of concurrent actors, it makes sense to clarify that this is when "usage_count **became** non-zero", by way of some racing actor. Lastly, pm_runtime_put_sync_suspend() duplicated some -EAGAIN language. Fix that. Fixes: 271ff96d6066 ("PM: runtime: Document return values of suspend-related API functions") Link: https://lore.kernel.org/linux-pm/aJ5pkEJuixTaybV4@google.com/ Signed-off-by: Brian Norris Reviewed-by: Sakari Ailus Cc: 6.17+ # 6.17+ Signed-off-by: Rafael J. Wysocki commit d0b8651a026125d58b50b464aeb78f2c5956179f Author: Brian Norris Date: Thu Sep 25 12:42:15 2025 -0700 PM: runtime: Make put{,_sync}() return 1 when already suspended The pm_runtime.h docs say pm_runtime_put() and pm_runtime_put_sync() return 1 when already suspended, but this is not true -- they return -EAGAIN. On the other hand, pm_runtime_put_sync_suspend() and pm_runtime_put_sync_autosuspend() *do* return 1. This is an artifact of the fact that the former are built on rpm_idle(), whereas the latter are built on rpm_suspend(). There are precious few pm_runtime_put()/pm_runtime_put_sync() callers that check the return code at all, but most of them only log errors, and usually only for negative error codes. None of them should be treating this as an error, so: * at best, this may fix some case where a driver treats this condition as an error, when it shouldn't; * at worst, this should make no effect; and * somewhere in between, we could potentially clear up non-fatal log messages. Fix the pm_runtime_already_suspended_test() while tweaking the behavior. The test makes a lot more sense when these all return 1 when the device is already suspended: pm_runtime_put_sync(dev); pm_runtime_suspend(dev); pm_runtime_autosuspend(dev); pm_request_autosuspend(dev); pm_runtime_put_sync_autosuspend(dev); Notably, I've avoided testing the return codes for these, since they really should be ignored by callers, and we may make them 'void' altogether: pm_runtime_put(dev); pm_runtime_put_autosuspend(dev); Signed-off-by: Brian Norris Reviewed-by: Dhruva Gole Reviewed-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 7f7acd193ba8aaa8ed07cfadc335bb17a991fd42 Author: Brian Norris Date: Thu Sep 25 12:42:14 2025 -0700 PM: runtime: Add basic kunit tests for API contracts In exploring the various return codes and failure modes of runtime PM APIs, I found it helpful to verify and codify many of them in unit tests, especially given that even the kerneldoc can be rather complex to reason through, and it also has had subtle errors of its own. Notably, I avoid testing the return codes for pm_runtime_put() and pm_runtime_put_autosuspend(), since code that checks them is probably wrong, and we're considering making them return 'void' altogether. I still test the sync() variants, since those have a bit more meaning to them. Signed-off-by: Brian Norris Signed-off-by: Rafael J. Wysocki commit 4b2113413e76213cb36e30e6d5299208254d9369 Author: Jiapeng Chong Date: Fri Sep 26 17:52:40 2025 +0800 bpftool: Remove duplicate string.h header ./tools/bpf/bpftool/sign.c: string.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25502 Signed-off-by: Jiapeng Chong Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250926095240.3397539-2-jiapeng.chong@linux.alibaba.com Signed-off-by: Alexei Starovoitov commit 87608c2a7718dcac5deef801fb3c18cf36fb0233 Author: Jiapeng Chong Date: Fri Sep 26 17:52:39 2025 +0800 bpf: Remove duplicate crypto/sha2.h header ./include/linux/bpf.h: crypto/sha2.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25501 Signed-off-by: Jiapeng Chong Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250926095240.3397539-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Alexei Starovoitov commit 05b7e10687c69e0c28e62b9a74ce78b3e7463806 Author: Crystal Wood Date: Sat Sep 6 21:23:25 2025 -0500 tools/rtla: Add remaining support for osnoise actions The basic functionality came with the consolidation; now hook up the command line options, and add documentation and tests. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-8-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 3cd6b18d1025f2fca991c5d9543396892df3a8dd Author: Crystal Wood Date: Sat Sep 6 21:23:24 2025 -0500 tools/rtla: Add test engine support for unexpected output Add a check() parameter to indicate which text must not appear in the output. Simplify the code so that we can print failures as they happen rather than trying to figure out what went wrong after printing "not ok". This also means that "not ok" gets printed after the info rather than before, which seems more intuitive anyway. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-7-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit c4e30c22baa745173997c831011a95e03771e466 Author: Crystal Wood Date: Sat Sep 6 21:23:23 2025 -0500 tools/rtla: Fix -A option name in test comment This was changed to --on-threshold when the patches were applied. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-6-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 2f3172f9dd58cca0f188bc0766b619d24f8116ad Author: Crystal Wood Date: Sat Sep 6 21:23:22 2025 -0500 tools/rtla: Consolidate code between osnoise/timerlat and hist/top Currently a lot of code is duplicated between the different rtla tools, making maintenance more difficult, and encouraging divergence such as features that are only implemented for certain tools even though they could be more broadly applicable. Merge the various main() functions into a common run_tool() with an ops struct for tool-specific details. Implement enough support for actions on osnoise to not need to keep the old params->trace_output path. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-5-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 263d7eacf8d17d66078700ff6b4b540d66f56278 Author: Crystal Wood Date: Sat Sep 6 21:23:21 2025 -0500 tools/rtla: Create common_apply_config() Merge the common bits of osnoise_apply_config() and timerlat_apply_config(). Put the result in a new common.c, and move enough things to common.h so that common.c does not need to include osnoise.h. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-4-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 5742bf62e6d3070f04a2ea688758431537076129 Author: Crystal Wood Date: Sat Sep 6 21:23:20 2025 -0500 tools/rtla: Move top/hist params into common struct The hist members were very similar between timerlat and top, so just use one common hist struct. output_divisor, quiet, and pretty printing are pretty generic concepts that can go in the main struct even if not every specific tool (currently) uses them. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-3-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 344823886eafe5fe17ed788b00e463666c2183b4 Author: Costa Shulyupin Date: Sat Sep 6 21:23:19 2025 -0500 tools/rtla: Consolidate common parameters into shared structure timerlat_params and osnoise_params structures contain 15 identical fields. Introduce a new header common.h and define a common_params structure to consolidate shared fields, reduce code duplication, and enhance maintainability. Cc: John Kacur Link: https://lore.kernel.org/20250907022325.243930-2-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Costa Shulyupin Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 012ea489aedab1a4c08efbd936bb7be91a06d236 Merge: 439263376c2c4e 70a5ce8bc94545 Author: Jakub Kicinski Date: Fri Sep 26 17:54:55 2025 -0700 Merge branch 'net-macb-various-fixes' Théo Lebrun says: ==================== net: macb: various fixes Fix a few disparate topics in MACB: [PATCH net v6 1/5] dt-bindings: net: cdns,macb: allow tsu_clk without tx_clk [PATCH net v6 2/5] net: macb: remove illusion about TBQPH/RBQPH being per-queue [PATCH net v6 3/5] net: macb: move ring size computation to functions [PATCH net v6 4/5] net: macb: single dma_alloc_coherent() for DMA descriptors [PATCH net v6 5/5] net: macb: avoid dealing with endianness in macb_set_hwaddr() Patch 3/5 is a rework that simplifies patch 4/5. It is the only non-fix. Pending series on MACB are: (1) many cleanup patches, (2) patches for EyeQ5 support and (3) XDP work. Those will be sent targeting net-next/main once this series lands there, aiming to minimise merge conflicts. Old version of(1) and (2) are visible in the V2 revision [0]. [0]: https://lore.kernel.org/lkml/20250627-macb-v2-0-ff8207d0bb77@bootlin.com/ ==================== Link: https://patch.msgid.link/20250923-macb-fixes-v6-0-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d Author: Théo Lebrun Date: Tue Sep 23 18:00:27 2025 +0200 net: macb: avoid dealing with endianness in macb_set_hwaddr() bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32 pointer and dereferencing implies dealing manually with endianness, which is error-prone. Replace by calls to get_unaligned_le32|le16() helpers. This was found using sparse: ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o warning: incorrect type in assignment (different base types) expected unsigned int [usertype] bottom got restricted __le32 [usertype] warning: incorrect type in assignment (different base types) expected unsigned short [usertype] top got restricted __le16 [usertype] ... Reviewed-by: Sean Anderson Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 78d901897b3cae06b38f54e48a2378cf9da21175 Author: Théo Lebrun Date: Tue Sep 23 18:00:26 2025 +0200 net: macb: single dma_alloc_coherent() for DMA descriptors Move from 2*NUM_QUEUES dma_alloc_coherent() for DMA descriptor rings to 2 calls overall. Issue is with how all queues share the same register for configuring the upper 32-bits of Tx/Rx descriptor rings. Taking Tx, notice how TBQPH does *not* depend on the queue index: #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2)) #define GEM_TBQPH(hw_q) (0x04C8) queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma)); #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (bp->hw_dma_cap & HW_DMA_CAP_64B) queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma)); #endif To maximise our chances of getting valid DMA addresses, we do a single dma_alloc_coherent() across queues. This improves the odds because alloc_pages() guarantees natural alignment. Other codepaths (IOMMU or dev/arch dma_map_ops) don't give high enough guarantees (even page-aligned isn't enough). Two consideration: - dma_alloc_coherent() gives us page alignment. Here we remove this constraint meaning each queue's ring won't be page-aligned anymore. - This can save some tiny amounts of memory. Fewer allocations means (1) less overhead (constant cost per alloc) and (2) less wasted bytes due to alignment constraints. Example for (2): 4 queues, default ring size (512), 64-bit DMA descriptors, 16K pages: - Before: 8 allocs of 8K, each rounded to 16K => 64K wasted. - After: 2 allocs of 32K => 0K wasted. Fixes: 02c958dd3446 ("net/macb: add TX multiqueue support for gem") Reviewed-by: Sean Anderson Acked-by: Nicolas Ferre Tested-by: Nicolas Ferre # on sam9x75 Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-4-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 92d4256fafd8d0a14d3aaa10452ac771bf9b597c Author: Théo Lebrun Date: Tue Sep 23 18:00:25 2025 +0200 net: macb: move ring size computation to functions The tx/rx ring size calculation is somewhat complex and partially hidden behind a macro. Move that out of the {RX,TX}_RING_BYTES() macros and macb_{alloc,free}_consistent() functions into neat separate functions. In macb_free_consistent(), we drop the size variable and directly call the size helpers in the arguments list. In macb_alloc_consistent(), we keep the size variable that is used by netdev_dbg() calls. Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-3-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit fca3dc859b200ca4dcdd2124beaf3bb2ab80b0f7 Author: Théo Lebrun Date: Tue Sep 23 18:00:24 2025 +0200 net: macb: remove illusion about TBQPH/RBQPH being per-queue The MACB driver acts as if TBQPH/RBQPH are configurable on a per queue basis; this is a lie. A single register configures the upper 32 bits of each DMA descriptor buffers for all queues. Concrete actions: - Drop GEM_TBQPH/GEM_RBQPH macros which have a queue index argument. Only use MACB_TBQPH/MACB_RBQPH constants. - Drop struct macb_queue->TBQPH/RBQPH fields. - In macb_init_buffers(): do a single write to TBQPH and RBQPH for all queues instead of a write per queue. - In macb_tx_error_task(): drop the write to TBQPH. - In macb_alloc_consistent(): if allocations give different upper 32-bits, fail. Previously, it would have lead to silent memory corruption as queues would have used the upper 32 bits of the alloc from queue 0 and their own low 32 bits. - In macb_suspend(): if we use the tie off descriptor for suspend, do the write once for all queues instead of once per queue. Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM") Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues") Reviewed-by: Sean Anderson Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-2-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 9665aa15ef8bdf1fa596f9ff8162e9c5e00ac036 Author: Théo Lebrun Date: Tue Sep 23 18:00:23 2025 +0200 dt-bindings: net: cdns,macb: allow tsu_clk without tx_clk Allow providing tsu_clk without a tx_clk as both are optional. This is about relaxing unneeded constraints. It so happened that in the past HW that needed a tsu_clk always needed a tx_clk. Fixes: 4e5b6de1f46d ("dt-bindings: net: cdns,macb: Convert to json-schema") Reviewed-by: Krzysztof Kozlowski Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Link: https://patch.msgid.link/20250923-macb-fixes-v6-1-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 1493c18fe8696bfc758a97130a485fc4e08387f5 Merge: 9ccec266234a96 fca6ff9191bd60 Author: Jakub Kicinski Date: Fri Sep 26 17:54:36 2025 -0700 Merge branch 'selftests-mark-auto-deferring-functions-clearly' Petr Machata says: ==================== selftests: Mark auto-deferring functions clearly selftests/net/lib.sh contains a suite of iproute2 wrappers that automatically schedule the corresponding cleanup through defer. The fact they do so is however not immediately obvious, one needs to know which functions are handling the deferral behind the scenes, and which expect the caller to handle cleanups themselves. A convention for these auto-deferring functions would help both writing and patch review. This patchset does so by marking these functions with an adf_ prefix. We already have a few such functions: forwarding/lib.sh has adf_mcd_start() and a few selftests add private helpers that conform to this convention. Patches #1 to #8 gradually convert individual functions, one per patch. Patch #9 renames an auto-deferring private helpers named dfr_* to adf_*. The plan is not to retro-rename all private helpers, but I happened to know about this one. Patches #10 to #12 introduce several autodefer helpers for commonly used forwarding/lib.sh functions, and opportunistically convert straightforward instances of 'action; defer counteraction' to the new helpers. Patch #13 adds some README verbiage to pitch defer and the adf_* convention. ==================== Link: https://patch.msgid.link/cover.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit fca6ff9191bd60167d5fe1d1fea89bf988d9e355 Author: Petr Machata Date: Thu Sep 25 19:31:56 2025 +0200 selftests: forwarding: README: Mention defer, adf_ Mention how it would be nice if new code used defer. Also if it does that in dirtying helpers, how it would be nice if these were named adf_*. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/0764bdb9266cd516da23ddeec110e01118cf981e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 040a6cbead5d6be72eec0444af48241693241f8d Author: Petr Machata Date: Thu Sep 25 19:31:55 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of forwarding_enable() Most forwarding tests invoke forwarding_enable() to enable the router and forwarding_restore() to restore the original configuration. Add a helper, adf_forwarding_enable(), which is like forwarding_enable(), but takes care of scheduling the cleanup automatically. Convert the tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/78b752c40069cde21c44dcf4c7b966a76a0eef2c.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f53748d56d1092657d30a094df92b11a24eadd12 Author: Petr Machata Date: Thu Sep 25 19:31:54 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of simple_if_init() Most forwarding tests invoke simple_if_init() to set up a VRF-based "host" and simple_if_fini() to tear it down again. Add a helper, adf_simple_if_init(), which is like simple_if_fini(), but takes care of scheduling the cleanup automatically. Convert the tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/6b9ee1a7946a36fd32a47fdb1aa9325198ffc695.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 02aabe00b2e1cc61e7a60616d6044592f12a748c Author: Petr Machata Date: Thu Sep 25 19:31:53 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of vrf_prepare() Most forwarding tests invoke vrf_prepare() to set up VRF forwarding and vrf_cleanup() to restore the original configuration. Add a helper, adf_vrf_prepare(), which is like vrf_prepare(), but takes care of scheduling the cleanup automatically. Convert a number of tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/2f2000e54ae700d560a8d6128322dade3bd2207e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 14b72996ae8052b2174fc36f151791f7604d3b1b Author: Petr Machata Date: Thu Sep 25 19:31:52 2025 +0200 selftests: net: vlan_bridge_binding: Rename dfr_set_binding_*() to adf_* This test contains two autodefer-like helpers, but namespaces them as dfr_* instead of adf_* like this patchset. Rename them. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/5f0c81b39e9e1f56f706cc4b53f82238a1d1e2f9.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit b628dfcd54cb78718cfe0392ca1946df43c49ac8 Author: Petr Machata Date: Thu Sep 25 19:31:51 2025 +0200 selftests: net: lib: Rename bridge_vlan_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/93526ce79e635a3ec34753c796edf0c96711547d.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit d85bcf6505d2383847637d90ecd4fa94f507cbc8 Author: Petr Machata Date: Thu Sep 25 19:31:50 2025 +0200 selftests: net: lib: Rename ip_route_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/403143183373419e4a31df4665d6bfaa273eb761.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 773603d6db3079a0bf828f149224abf2bdde56b3 Author: Petr Machata Date: Thu Sep 25 19:31:49 2025 +0200 selftests: net: lib: Rename ip_addr_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/706327a5db660c7f18ba9fbfba7ce913da065e3e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a55f9fb3432e2eddacfad65294223bde2394c125 Author: Petr Machata Date: Thu Sep 25 19:31:48 2025 +0200 selftests: net: lib: Rename ip_link_set_down() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/e5bf4cb3405fb50fe6e217a04268952e97410dc2.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 34d3f8b75e2bb54f22c40868b6dcff2fab1f997d Author: Petr Machata Date: Thu Sep 25 19:31:47 2025 +0200 selftests: net: lib: Rename ip_link_set_up() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/475716ef792f5bd42e5c8ef1c3e287b1294f1630.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit beb98a3477622ccdb15d8a3dcdc53805f36ed8e7 Author: Petr Machata Date: Thu Sep 25 19:31:46 2025 +0200 selftests: net: lib: Rename ip_link_set_addr() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/5318e90f7f491f9f397ac221a8b47fdbedd0d3b2.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit c3cbd21fe18ed03f6926bbe5a7d3b62db0733896 Author: Petr Machata Date: Thu Sep 25 19:31:45 2025 +0200 selftests: net: lib: Rename ip_link_set_master() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/53ce64231faa1396a968b2869af5f1c0aebec2c9.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 191c4912f9c3aff76c4e46c92f6031714607e10b Author: Petr Machata Date: Thu Sep 25 19:31:44 2025 +0200 selftests: net: lib: Rename ip_link_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/0b163cca1bf2ec44270e0fc89108f488d99d9c9d.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 9ccec266234a960c63d56fa078ec2873d05a3c16 Merge: 1d312d54159153 539f6b9de39ec5 Author: Jakub Kicinski Date: Fri Sep 26 17:44:14 2025 -0700 Merge branch 'mptcp-pm-special-case-for-c-flag-luminar-endp' Matthieu Baerts says: ==================== mptcp: pm: special case for c-flag + luminar endp Here are some patches for the MPTCP PM, including some refactoring that I thought it would be best to send at the end of a cycle to avoid conflicts between net and net-next that could last a few weeks. The most interesting changes are in the first and last patch, the rest are patches refactoring the code & tests to validate the modifications. - Patches 1 & 2: When servers set the C-flag in their MP_CAPABLE to tell clients not to create subflows to the initial address and port -- e.g. a deployment behind a L4 load balancer like a typical CDN deployment -- clients will not use their other endpoints when default settings are used. That's because the in-kernel path-manager uses the 'subflow' endpoints to create subflows only to the initial address and port. The first patch fixes that (for >=v5.14), and the second one validates it. - Patches 3-14: various patches refactoring the code around the in-kernel PM (mainly): split too long functions, rename variables and functions to avoid confusions, reduce structure size, and compare IDs instead of IP addresses. Note that one patch modifies one internal variable used in one BPF selftest. - Patch 15: ability to control endpoints that are used in reaction to a new address announced by the other peer. With that, endpoints can be used only once. ==================== Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-0-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 539f6b9de39ec5d827b16f6f5c8f3cfd58669e93 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:50 2025 +0200 mptcp: pm: in-kernel: add laminar endpoints Currently, upon the reception of an ADD_ADDR (and when the fullmesh flag is not used), the in-kernel PM will create new subflows using the local address the routing configuration will pick. It would be easier to pick local addresses from a selected list of endpoints, and use it only once, than relying on routing rules. Use case: both the client (C) and the server (S) have two addresses (a and b). The client establishes the connection between C(a) and S(a). Once established, the server announces its additional address S(b). Once received, the client connects to it using its second address C(b). Compared to a situation without the 'laminar' endpoint for C(b), the client didn't use this address C(b) to establish a subflow to the server's primary address S(a). So at the end, we have: C S C(a) --- S(a) C(b) --- S(b) In case of a 3rd address on each side (C(c) and S(c)), upon the reception of an ADD_ADDR with S(c), the client should not pick C(b) because it has already been used. C(c) should then be used. Note that this situation is currently possible if C doesn't add any endpoint, but configure the routing in order to pick C(b) for the route to S(b), and pick C(c) for the route to S(c). That doesn't sound very practical because it means knowing in advance the IP addresses that will be used and announced by the server. 'laminar', like the idea of laminar flows: the different subflows don't mix with each other on an endpoint, unlike the "turbulent" way traffic is mixed by 'fullmesh'. In the code, the new endpoint type is added. Similar to the other subflow types, an MPTCP_INFO counter is added. While at it, hole are now commented in struct mptcp_info, to remember next time that these holes can no longer be used. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/503 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-15-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit f596293314b25fc494acb42f40ec256e4662d04f Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:49 2025 +0200 mptcp: pm: in-kernel: compare IDs instead of addresses When receiving an ADD_ADDR right after the 3WHS, the connection will switch to 'fully established'. It means the MPTCP worker will be called to treat two events, in this order: ADD_ADDR_RECEIVED, PM_ESTABLISHED. The MPTCP endpoints cannot have the ID 0, because it is reserved to the address and port used by the initial subflow. To be able to deal with this case in different places, msk->mpc_endpoint_id contains the endpoint ID linked to the initial subflow. This variable was only set when treating the first PM_ESTABLISHED event, after ADD_ADDR_RECEIVED. That's why in fill_local_addresses_vec(), the endpoint addresses were compared with the one of the initial subflow, instead of only comparing the IDs. Instead, msk->mpc_endpoint_id is now set when treating ADD_ADDR_RECEIVED as well, if needed, then the IDs can be compared. To be able to do so, the code doing that is now in a dedicated helper, and called from the functions linked to the two actions. While at it, mptcp_endp_get_local_id() has also been moved up, next to this new helper, because they are linked, and to be able to use it in fill_local_addresses_vec() in the next commit. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-14-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 4984fe6254f8d469c98e639856b7ce21fe8da86f Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:48 2025 +0200 mptcp: pm: in-kernel: reduce pernet struct size All the 'unsigned int' variables from the 'pm_nl_pernet' structure are bounded to MPTCP_PM_ADDR_MAX, currently set to 8. The endpoint ID is also bounded by the protocol to 8-bit. MPTCP_PM_ADDR_MAX, if extended later, will never over 8-bit. So no need to use 'unsigned int' variables, 'u8' is enough. Note that the exposed counters in MPTCP_INFO are already limited to 8-bit, same for pm->extra_subflows, and others. So it seems even better to limit them to 8-bit. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-13-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit db9a0e3858ba8acbe4f78edcb8c2061aee53dfa4 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:47 2025 +0200 mptcp: pm: in-kernel: remove stale_loss_cnt It is currently not used. It was in fact never used since its introduction in commit ff5a0b421cb2 ("mptcp: faster active backup recovery"). It was probably initially added to struct pm_nl_pernet during the development of this commit, before being added to struct mptcp_pernet in ctrl.c, but not removed from the first place. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-12-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit e9aa044f4a1f7c7a858b96ea1fc7c642095ef4b8 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:46 2025 +0200 mptcp: pm: in-kernel: rename 'addrs' to 'endpoints' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'addrs', which in fact represents the number of declared endpoints, and not only the 'signal' endpoints. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-11-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 35e71e43a56d40e68ea0ebab3ac85038624cb8b5 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:45 2025 +0200 mptcp: pm: in-kernel: rename 'local_addr_list' to 'endp_list' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'local_addr_list', which in fact represents the list of endpoints, and not only the 'subflow' endpoints. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-10-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit e7757b6d3a623671705388be24851af7360b54ba Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:44 2025 +0200 mptcp: pm: in-kernel: rename 'local_addr_max' to 'endp_subflow_max' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'local_addr_max', which in fact represents the maximum number of 'subflow' endpoints that can be used to create new subflows, and not the number of local addresses that have been used to create subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_endp_subflow_max. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. Also move the variable and function next to the other 'endp_X_max' ones. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-9-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 37712d84dfc2e80d4d218ff9be490c86e604aa69 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:43 2025 +0200 mptcp: pm: in-kernel: rename 'add_addr_accept_max' to 'limit_add_addr_accepted' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'add_addr_accept_max', which in fact represents the limit of ADD_ADDR that can be accepted: the limit set via 'ip mptcp limit add_addr_accepted X' for example. It is not linked to the maximum number of accepted ADD_ADDR. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_limit_add_addr_accepted. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-8-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 45cae570664d58c562e21a3c7409fc02147bba46 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:42 2025 +0200 mptcp: pm: in-kernel: rename 'add_addr_signal_max' to 'endp_signal_max' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'add_addr_signal_max', which in fact represents the maximum number of 'signal' endpoints that can be used to announced addresses, and not the number of ADD_ADDR that can be signalled. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_endp_signal_max. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-7-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 3eb3c9a9596a53880f7d7eff28ac5622f3e0ba37 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:41 2025 +0200 mptcp: pm: in-kernel: rename 'subflows_max' to 'limit_extra_subflows' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'subflows_max', which in fact represents the limit of extra subflows: the limit set via 'ip mptcp limit subflows X' for example. It is not linked to the maximum number of created / possible subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_limit_extra_subflows. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-6-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit c5273f6ca166c4edfaa6a87570e111453a0576ad Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:40 2025 +0200 mptcp: pm: rename 'subflows' to 'extra_subflows' A few variables linked to the Path-Managers are confusing, and it would help current and future developers, to clarify them. One of them is 'subflows', which in fact represents the number of extra subflows: all the additional subflows created after the initial one, and not the total number of subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_extra_subflows. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-5-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit a845b2bbf26ed73e545a3573df264c3a1cb302a1 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:39 2025 +0200 mptcp: pm: in-kernel: refactor fill_remote_addresses_vec Before this modification, this function was quite long with many levels of indentations. Each case can be split in a dedicated function: fullmesh, non-fullmesh. To remove one level of indentation, msk->pm.subflows >= subflows_max is now checked after having added one subflow, and stops the loop if it is no longer possible to add new subflows. This is fine to do this because this function should only be called if msk->pm.subflows < subflows_max. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-4-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 8dc63ade451d28211511b657fecf5e0822580986 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:38 2025 +0200 mptcp: pm: in-kernel: refactor fill_local_addresses_vec Before this modification, this function was quite long with many levels of indentations. Each case can be split in a dedicated function: fullmesh, C flag, any. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-3-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 008385efd05e04d8dff299382df2e8be0f91d8a0 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:37 2025 +0200 selftests: mptcp: join: validate C-flag + def limit The previous commit adds an exception for the C-flag case. The 'mptcp_join.sh' selftest is extended to validate this case. In this subtest, there is a typical CDN deployment with a client where MPTCP endpoints have been 'automatically' configured: - the server set net.mptcp.allow_join_initial_addr_port=0 - the client has multiple 'subflow' endpoints, and the default limits: not accepting ADD_ADDRs. Without the parent patch, the client is not able to establish new subflows using its 'subflow' endpoints. The parent commit fixes that. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: df377be38725 ("mptcp: add deny_join_id0 in mptcp_options_received") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-2-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 4b1ff850e0c1aacc23e923ed22989b827b9808f9 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:36 2025 +0200 mptcp: pm: in-kernel: usable client side with C-flag When servers set the C-flag in their MP_CAPABLE to tell clients not to create subflows to the initial address and port, clients will likely not use their other endpoints. That's because the in-kernel path-manager uses the 'subflow' endpoints to create subflows only to the initial address and port. If the limits have not been modified to accept ADD_ADDR, the client doesn't try to establish new subflows. If the limits accept ADD_ADDR, the routing routes will be used to select the source IP. The C-flag is typically set when the server is operating behind a legacy Layer 4 load balancer, or using anycast IP address. Clients having their different 'subflow' endpoints setup, don't end up creating multiple subflows as expected, and causing some deployment issues. A special case is then added here: when servers set the C-flag in the MPC and directly sends an ADD_ADDR, this single ADD_ADDR is accepted. The 'subflows' endpoints will then be used with this new remote IP and port. This exception is only allowed when the ADD_ADDR is sent immediately after the 3WHS, and makes the client switching to the 'fully established' mode. After that, 'select_local_address()' will not be able to find any subflows, because 'id_avail_bitmap' will be filled in mptcp_pm_create_subflow_or_signal_addr(), when switching to 'fully established' mode. Fixes: df377be38725 ("mptcp: add deny_join_id0 in mptcp_options_received") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/536 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-1-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 1d312d541591530bf1b2301220c0517ad5b43757 Merge: bf91f4bc9c1dfb 6294bcd423ae20 Author: Jakub Kicinski Date: Fri Sep 26 17:43:25 2025 -0700 Merge branch 'add-support-to-retrieve-hardware-channel-information' Sathesh B Edara says: ==================== Add support to retrieve hardware channel information This patch series introduces support for retrieving hardware channel configuration through the ethtool interface for both PF and VF. ==================== Link: https://patch.msgid.link/20250925125134.22421-1-sedara@marvell.com Signed-off-by: Jakub Kicinski commit 6294bcd423ae20e6843c5a05d26372879d25475d Author: Sathesh B Edara Date: Thu Sep 25 05:51:34 2025 -0700 octeon_ep_vf: Add support to retrieve hardware channel information This patch introduces support for retrieving hardware channel configuration through the ethtool interface. Signed-off-by: Sathesh B Edara Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925125134.22421-3-sedara@marvell.com Signed-off-by: Jakub Kicinski commit 24d15b6a17e265bd78b73e532a67fb074aa323c1 Author: Sathesh B Edara Date: Thu Sep 25 05:51:33 2025 -0700 octeon_ep: Add support to retrieve hardware channel information This patch introduces support for retrieving hardware channel configuration through the ethtool interface. Signed-off-by: Sathesh B Edara Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925125134.22421-2-sedara@marvell.com Signed-off-by: Jakub Kicinski commit bf91f4bc9c1dfba75e457e6a5f11e3cda658729a Author: Horatiu Vultur Date: Thu Sep 25 08:47:02 2025 +0200 net: phy: micrel: Fix lan8814_config_init The blamed commit introduced the function lanphy_modify_page_reg which as name suggests it, it modifies the registers. In the same commit we have started to use this function inside the drivers. The problem is that in the function lan8814_config_init we passed the wrong page number when disabling the aneg towards host side. We passed extended page number 4(LAN8814_PAGE_COMMON_REGS) instead of extended page 5(LAN8814_PAGE_PORT_REGS) Fixes: a0de636ed7a264 ("net: phy: micrel: Introduce lanphy_modify_page_reg") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925064702.3906950-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 439263376c2c4e126cac0d07e4987568de4eaba5 Author: Michael S. Tsirkin Date: Thu Sep 25 02:04:08 2025 -0400 vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values. Cc: zhang jiao Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit 105ce7ad57e492b75ab40f2dc591db645fadbaa2 Author: Lorenzo Bianconi Date: Wed Sep 24 23:14:53 2025 +0200 net: airoha: npu: Add a NPU callback to initialize flow stats Introduce a NPU callback to initialize flow stats and remove NPU stats initialization from airoha_npu_get routine. Add num_stats_entries to airoha_npu_ppe_stats_setup routine. This patch makes the code more readable since NPU statistic are now initialized on demand by the NPU consumer (at the moment NPU statistic are configured just by the airoha_eth driver). Moreover this patch allows the NPU consumer (PPE module) to explicitly enable/disable NPU flow stats. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924-airoha-npu-init-stats-callback-v1-1-88bdf3c941b2@kernel.org Signed-off-by: Jakub Kicinski commit 20a2e46f9e4c3c9a8a17708f81db672a26738adc Author: Mohsin Bashir Date: Wed Sep 24 11:44:45 2025 -0700 eth: fbnic: Add support to read lane count We are reporting the lane count in the link settings but the flag is not set to indicate that the driver supports lanes. Set the flag to report lane count. ~]# ethtool eth0 | grep Lanes Lanes: 2 Signed-off-by: Mohsin Bashir Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924184445.2293325-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit e556f011e2df317b23ee44542189ed52c8117eea Author: Mengyuan Lou Date: Wed Sep 24 16:21:40 2025 +0800 Wangxun: vf: Implement some ethtool apis for get_xxx Implement some ethtool interfaces for obtaining the status of Wangxun Virtual Function Ethernet. Just like connection status, version information, queue depth and so on. Signed-off-by: Mengyuan Lou Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924082140.41612-1-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 55f5a5a7c1770c3c79715e5236d7055f3cca8742 Merge: fbb8bc408027a9 ed3d74a754113e Author: Jakub Kicinski Date: Fri Sep 26 16:48:02 2025 -0700 Merge branch 'add-fec-bins-histogram-report-via-ethtool' Vadim Fedorenko says: ==================== add FEC bins histogram report via ethtool IEEE 802.3ck-2022 defines counters for FEC bins and 802.3df-2024 clarifies it a bit further. Implement reporting interface through as addition to FEC stats available in ethtool. NetDevSim driver has simple implementation as an example while mlx5 has much more complex solution. The example query is the same as usual FEC statistics while the answer is a bit more verbose: $ ynl --family ethtool --do fec-get \ --json '{"header":{"dev-index": 10, "flags": 4}}' {'auto': 0, 'header': {'dev-index': 10, 'dev-name': 'eni10np1'}, 'modes': {'bits': {}, 'nomask': True, 'size': 121}, 'stats': {'corr-bits': [], 'corrected': [123], 'hist': [{'bin-high': 0, 'bin-low': 0, 'bin-val': 445, 'bin-val-per-lane': [125, 120, 100, 100]}, {'bin-high': 3, 'bin-low': 1, 'bin-val': 12}, {'bin-high': 7, 'bin-low': 4, 'bin-val': 2, 'bin-val-per-lane': [2, 0, 0, 0]}], 'uncorr': [4]}} ==================== Link: https://patch.msgid.link/20250924124037.1508846-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ed3d74a754113eb84299a0a4ddc215199a6dd89c Author: Vadim Fedorenko Date: Wed Sep 24 12:40:37 2025 +0000 selftests: net-drv: stats: sanity check FEC histogram Simple tests to validate kernel's output. FEC bin range should be valid means high boundary should be not less than low boundary. Bin boundaries have to be provided as well as error counter value. Per-plane value should match bin's value. Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-6-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ca80036839eb9556b08f62d4c655885c6670c2cc Author: Carolina Jubran Date: Wed Sep 24 12:40:36 2025 +0000 net/mlx5e: Report RS-FEC histogram statistics via ethtool Add support for reporting RS-FEC histogram counters by reading them from the RS_FEC_HISTOGRAM_GROUP in the PPCNT register. Co-developed-by: Yael Chemla Signed-off-by: Yael Chemla Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Link: https://patch.msgid.link/20250924124037.1508846-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 44907e7c8fd0dec2d17ba8011bb7da443a9e4585 Author: Carolina Jubran Date: Wed Sep 24 12:40:35 2025 +0000 net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR Introduce support for querying the Ports Phy Histogram Configuration Register (PPHCR) to retrieve RS-FEC histogram bin ranges. The ranges are stored in a static array and will be used to map histogram counters to error levels. The actual RS-FEC histogram statistics are not yet reported in this commit and will be handled in a downstream patch. Co-developed-by: Yael Chemla Signed-off-by: Yael Chemla Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 6b81b8a0b1978284e007566d7a1607b47f92209f Author: Carolina Jubran Date: Wed Sep 24 12:40:34 2025 +0000 net/mlx5e: Don't query FEC statistics when FEC is disabled Update mlx5e_stats_fec_get() to check the active FEC mode and skip statistics collection when FEC is disabled. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit cc2f08129925b437bf28f7f7822f20dac083a87c Author: Vadim Fedorenko Date: Wed Sep 24 12:40:33 2025 +0000 ethtool: add FEC bins histogram report IEEE 802.3ck-2022 defines counters for FEC bins and 802.3df-2024 clarifies it a bit further. Implement reporting interface through as addition to FEC stats available in ethtool. Drivers can leave bin counter uninitialized if per-lane values are provided. In this case the core will recalculate summ for the bin. Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit fbb8bc408027a94b0b513410df15003e6ba6a77c Author: Zhen Ni Date: Wed Sep 24 11:02:19 2025 +0800 net: qed: Remove redundant NULL checks after list_first_entry() list_first_entry() never returns NULL — if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. The calls to list_first_entry() are always guarded by !list_empty(), which guarantees a valid entry is returned. Therefore, the additional `if (!p_buffer) break;` checks in qed_ooo_release_connection_isles(), qed_ooo_release_all_isles(), and qed_ooo_free() are redundant and unreachable. Remove the dead code for clarity and consistency with common list handling patterns in the kernel. No functional change intended. Signed-off-by: Zhen Ni Link: https://patch.msgid.link/20250924030219.1252773-1-zhen.ni@easystack.cn Signed-off-by: Jakub Kicinski commit e9f35294e18da82162004a2f35976e7031aaf7f9 Author: I Viswanath Date: Thu Sep 25 21:29:08 2025 +0530 ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: I Viswanath Acked-by: Richard Cochran Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 347afa39042728267550fa7a5ab5e9af52671add Author: Dan Carpenter Date: Thu Sep 25 16:28:13 2025 +0300 dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free() and the caller, zl3073x_devlink_flash_update(), also calls that same free function so it leads to a double free. Delete the extra free. Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/aNVDbcIQq4RmU_fl@stanley.mountain Signed-off-by: Jakub Kicinski commit 81dcfdd21dbd7067068c7c341ee448c3f0d6f115 Author: Alessandro Zanni Date: Thu Sep 25 15:28:23 2025 +0200 selftest: net: Fix error message if empty variable Fix to avoid cases where the `res` shell variable is empty in script comparisons. The comparison has been modified into string comparison to handle other possible values the variable could assume. The issue can be reproduced with the command: make kselftest TARGETS=net It solves the error: ./tfo_passive.sh: line 98: [: -eq: unary operator expected Signed-off-by: Alessandro Zanni Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925132832.9828-1-alessandro.zanni87@gmail.com Signed-off-by: Jakub Kicinski commit 793adf57e2cfa85792989f6d89cb1bba5bcc6df2 Merge: 4e9510f1621880 ffa8f0791955de Author: Jakub Kicinski Date: Fri Sep 26 15:21:40 2025 -0700 Merge branch 'dns_resolver-docs-formatting-cleanup' Bagas Sanjaya says: ==================== dns_resolver docs formatting cleanup Here are reST cleanups for DNS Resolver Module documentation. ==================== Link: https://patch.msgid.link/20250924020626.17073-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit ffa8f0791955dec12af2a09a1655a41e3fff783a Author: Bagas Sanjaya Date: Wed Sep 24 09:06:25 2025 +0700 net: dns_resolver: Fix request-key cross-reference Link to "Key Request Service" docs uses file:// scheme instead due to angled brackets markup. Fix it to proper cross-reference. Reviewed-by: Simon Horman Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20250924020626.17073-4-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 1b1fe672337bb7549f637853c1c9536872d3d19c Author: Bagas Sanjaya Date: Wed Sep 24 09:06:24 2025 +0700 net: dns_resolver: Move dns_query() explanation out of code block Documentation for dns_query() is placed in the function's literal code block snippet instead. Move it out of there. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924020626.17073-3-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 84a27b5a4cedd0b19381e27e8026614ddf3e900f Author: Bagas Sanjaya Date: Wed Sep 24 09:06:23 2025 +0700 net: dns_resolver: Use reST bullet list for features list Features overview list uses an asterisk in parentheses (``(*)``) as bullet list marker, which isn't supported by Sphinx as proper bullet. Replace it with just asterisk. Reviewed-by: Simon Horman Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20250924020626.17073-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 4e9510f16218802b5fc0d593d8707d4e7ebf9774 Author: Michael S. Tsirkin Date: Wed Sep 24 01:27:07 2025 -0400 ptr_ring: drop duplicated tail zeroing code We have some rather subtle code around zeroing tail entries, minimizing cache bouncing. Let's put it all in one place. Doing this also reduces the text size slightly, e.g. for drivers/vhost/net.o Before: text: 15,114 bytes After: text: 15,082 bytes Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/adb9d941de4a2b619ddb2be271a9939849e70687.1758690291.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit 8d5868f8c1b27e99b35d200b5ed2dfe12586e936 Author: Jonas Rebmann Date: Wed Sep 24 10:34:12 2025 +0200 dt-bindings: net: dsa: nxp,sja1105: Add reset-gpios property Both the nxp,sja1105 and the nxp,sja1110 series feature an active-low reset pin, rendering reset-gpios a valid property for all of the nxp,sja1105 family. Acked-by: Vladimir Oltean Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Signed-off-by: Jonas Rebmann Link: https://patch.msgid.link/20250924-imx8mp-prt8ml-v3-1-f498d7f71a94@pengutronix.de Signed-off-by: Jakub Kicinski commit 0a8fe9161164d84b8ed904ca39ddd21a0afac938 Merge: 0e41b0af474376 96da9d67da780c Author: Jakub Kicinski Date: Fri Sep 26 15:18:14 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== idpf: add XSk support Alexander Lobakin says: Add support for XSk xmit and receive using libeth_xdp. This includes adding interfaces to reconfigure/enable/disable only a particular set of queues and support for checksum offload XSk Tx metadata. libeth_xdp's implementation mostly matches the one of ice: batched allocations and sending, unrolled descriptor writes etc. But unlike other Intel drivers, XSk wakeup is implemented using CSD/IPI instead of HW "software interrupt". In lots of different tests, this yielded way better perf than SW interrupts, but also, this gives better control over which CPU will handle the NAPI loop (SW interrupts are a subject to irqbalance and stuff, while CSDs are strictly pinned 1:1 to the core of the same index). Note that the header split is always disabled for XSk queues, as for now we see no reasons to have it there. XSk xmit perf is up to 3x comparing to ice. XSk XDP_PASS is also faster a bunch as it uses system percpu page_pools, so that the only overhead left is memcpy(). The rest is at least comparable. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: enable XSk features and ndo_xsk_wakeup idpf: implement Rx path for AF_XDP idpf: implement XSk xmit idpf: add XSk pool initialization idpf: add virtchnl functions to manage selected queues ==================== Link: https://patch.msgid.link/20250924175230.1290529-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 0e41b0af4743761a5994b9a538146ea2adea72e6 Author: Christophe Leroy Date: Wed Sep 24 17:06:47 2025 +0200 net: wan: framer: Add version sysfs attribute for the Lantiq PEF2256 framer Lantiq PEF2256 framer has some little differences in behaviour depending on its version. Add a sysfs attribute to allow user applications to know the version. Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/77a27941d6924b1009df0162ed9f0fa07ed6e431.1758726302.git.christophe.leroy@csgroup.eu Signed-off-by: Jakub Kicinski commit 958baf5eaee394e5fd976979b0791a875f14a179 Author: I Viswanath Date: Wed Sep 24 19:13:50 2025 +0530 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio Signed-off-by: I Viswanath Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 231889d9b62650a2242b8b752565892a6cd18372 Author: Dan Carpenter Date: Wed Sep 24 17:21:17 2025 +0300 dibs: Check correct variable in dibs_init() There is a typo in this code. It should check "dibs_class" instead of "&dibs_class". Remove the &. Fixes: 804737349813 ("dibs: Create class dibs") Signed-off-by: Dan Carpenter Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/aNP-XcrjSUjZAu4a@stanley.mountain Signed-off-by: Jakub Kicinski commit 72bc38077e804b26188bdffe875874186bca8300 Author: Geert Uytterhoeven Date: Wed Sep 24 15:19:30 2025 +0200 net: renesas: rswitch: Remove unneeded semicolons Semicolons after end of function braces are not needed, remove them. Signed-off-by: Geert Uytterhoeven Reviewed-by: Nikita Yushchenko Link: https://patch.msgid.link/e6b57123f319c03b3f078981cb452be49e86253b.1758719832.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f Author: Claudiu Manoil Date: Wed Sep 24 16:27:55 2025 +0800 net: enetc: Fix probing error message typo for the ENETCv4 PF driver Blamed commit wrongly indicates VF error in case of PF probing error. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil Signed-off-by: Wei Fang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit bb9a242ce58e00da802d9ae49643f7271be9c99e Merge: ed6cfe861cc803 896d52af944107 Author: Jakub Kicinski Date: Fri Sep 26 14:46:58 2025 -0700 Merge tag 'linux-can-next-for-6.18-20250924' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-09-25 this is a pull request of 48 patches for net-next/main, which supersedes tags/linux-can-next-for-6.18-20250923. The 1st patch is by Xichao Zhao and converts ns_to_ktime() to us_to_ktime() in the m_can driver. Vincent Mailhol contributes 2 patches: Updating the MAINTAINERS and mailmap files to Vincent's new email address and sorting the includes in the CAN helper library alphabeticaly. Stéphane Grosjean's patch modifies all peak CAN drivers and the mailmap to reflect Stéphane's new email address. 4 patches by Biju Das update the CAN-FD handling in the rcar_canfd driver. Followed by 11 patches by Geert Uytterhoeven updating and improving the rcar_can driver. Stefan Mätje contributes 2 patches for the esd_usb driver updating the error messages. The next 3 patch series are all by Vincent Mailhol: 3 patches to optimize the size of struct raw_sock and struct uniqframe. 4 patches which rework the CAN MTU logic as preparation for CAN-XL interfaces. And finally 20 patches that prepare and refactor the CAN netlink code for the upcoming CAN-XL support. * tag 'linux-can-next-for-6.18-20250924' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (48 commits) can: netlink: add userland error messages can: dev: add can_get_ctrlmode_str() can: calc_bittiming: make can_calc_tdco() FD agnostic can: netlink: make can_tdc_fill_info() FD agnostic can: netlink: add can_bitrate_const_fill_info() can: netlink: add can_bittiming_const_fill_info() can: netlink: add can_bittiming_fill_info() can: netlink: add can_data_bittiming_get_size() can: netlink: make can_tdc_get_size() FD agnostic can: netlink: add can_ctrlmode_changelink() can: netlink: add can_dtb_changelink() can: netlink: make can_tdc_changelink() FD agnostic can: netlink: remove useless check in can_tdc_changelink() can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic can: netlink: add can_validate_databittiming() can: netlink: add can_validate_tdc() can: netlink: refactor can_validate_bittiming() can: netlink: document which symbols are FD specific can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h can: dev: move struct data_bittiming_params to linux/can/bittiming.h ... ==================== Link: https://patch.msgid.link/20250925121332.848157-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit ed6cfe861cc80387a0f71af14ca9d5d2242fcae2 Merge: 94aced6ed9e263 9f4f591cd5a410 Author: Jakub Kicinski Date: Fri Sep 26 14:44:50 2025 -0700 Merge tag 'ipsec-next-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2025-09-26 1) Fix field-spanning memcpy warning in AH output. From Charalampos Mitrodimas. 2) Replace the strcpy() calls for alg_name by strscpy(). From Miguel García. * tag 'ipsec-next-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: xfrm_user: use strscpy() for alg_name net: ipv6: fix field-spanning memcpy warning in AH output ==================== Link: https://patch.msgid.link/20250926053025.2242061-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit d1a7be736ca9b89c32023185fa95c0df02f6db27 Author: Rob Herring (Arm) Date: Wed Sep 24 17:35:49 2025 -0500 dt-bindings: gpu: Convert nvidia,gk20a to DT schema Convert the NVIDIA GPU binding to DT schema format. Add undocumented "interconnects" and "interconnect-names" properties for gp10b and gv11b. Drop all but one example. Signed-off-by: Rob Herring (Arm) commit 94aced6ed9e2630bae0b5631e384a5302c4b6783 Merge: 47f78a67d35e48 56d9de46715245 Author: Jakub Kicinski Date: Fri Sep 26 14:27:28 2025 -0700 Merge tag 'wireless-next-2025-09-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bit more things, including pull requests from drivers: - mt76: MLO support, HW restart improvements - rtw88/89: small features, prep for RTL8922DE support - ath10k: GTK rekey fixes - cfg80211/mac80211: - additions for more NAN support - S1G channel representation cleanup * tag 'wireless-next-2025-09-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (167 commits) wifi: libertas: add WQ_UNBOUND to alloc_workqueue users Revert "wifi: libertas: WQ_PERCPU added to alloc_workqueue users" wifi: libertas: WQ_PERCPU added to alloc_workqueue users wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again wifi: ath12k: enforce CPU endian format for all QMI data wifi: ath12k: Use 1KB Cache Flush Command for QoS TID Descriptors wifi: ath12k: Fix flush cache failure during RX queue update wifi: ath12k: Add Retry Mechanism for REO RX Queue Update Failures wifi: ath12k: Refactor REO command to use ath12k_dp_rx_tid_rxq wifi: ath12k: Refactor RX TID buffer cleanup into helper function wifi: ath12k: Refactor RX TID deletion handling into helper function wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 wifi: cfg80211: remove IEEE80211_CHAN_{1,2,4,8,16}MHZ flags wifi: rtw89: avoid circular locking dependency in ser_state_run() wifi: rtw89: fix leak in rtw89_core_send_nullfunc() wifi: rtw89: avoid possible TX wait initialization race wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() wifi: mac80211: fix Rx packet handling when pubsta information is not available ... ==================== Link: https://patch.msgid.link/20250925232341.4544-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 47f78a67d35e48a56add528c9aa681782cf1b8e1 Author: Stanislav Fomichev Date: Wed Sep 24 15:25:18 2025 -0700 selftests: drv-net: Enable BTF Commit fec2e55bdef ("selftests: drv-net: Pull data before parsing headers") added __ksym external symbol to xdp_native.bpf.c which now requires a kernel with BTF. Enable BTF for driver selftests. Before: # TAP version 13 # 1..10 # # Exception| Traceback (most recent call last): # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 244, in ksft_run # # Exception| case(*args) # # Exception| ~~~~^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 231, in test_xdp_native_pass_sb # # Exception| _test_pass(cfg, bpf_info, 256) # # Exception| ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 209, in _test_pass # # Exception| prog_info = _load_xdp_prog(cfg, bpf_info) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 114, in _load_xdp_prog # # Exception| cmd( # # Exception| ~~~^ # # Exception| f"ip link set dev {cfg.ifname} mtu {bpf_info.mtu} xdpdrv obj {abs_path} sec {bpf_info.xdp_sec}", # # Exception| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| shell=True # # Exception| ^^^^^^^^^^ # # Exception| ) # # Exception| ^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 75, in __init__ # # Exception| self.process(terminate=False, fail=fail, timeout=timeout) # # Exception| ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 95, in process # # Exception| raise CmdExitFailure("Command failed: %s\nSTDOUT: %s\nSTDERR: %s" % # # Exception| (self.proc.args, stdout, stderr), self) # # Exception| net.lib.py.utils.CmdExitFailure: Command failed: ip link set dev eni30773np1 mtu 1500 xdpdrv obj /home/sdf/src/linux/tools/testing/selftests/net/lib/xdp_native.bpf.o sec xdp # # Exception| STDOUT: b'' # # Exception| STDERR: b"libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?\nlibbpf: failed to find '.BTF' ELF section in /lib/modules/6.17.0-rc6-virtme/build/vmlinux\nlibbpf: failed to find valid kernel BTF\nlib bpf: Error loading vmlinux BTF: -3\nlibbpf: failed to load object '/home/sdf/src/linux/tools/testing/selftests/net/lib/xdp_native.bpf.o'\n" # not ok 1 xdp.test_xdp_native_pass_sb ... After: # TAP version 13 # 1..10 # ok 1 xdp.test_xdp_native_pass_sb # ok 2 xdp.test_xdp_native_pass_mb # ok 3 xdp.test_xdp_native_drop_sb # ok 4 xdp.test_xdp_native_drop_mb # ok 5 xdp.test_xdp_native_tx_sb # ok 6 xdp.test_xdp_native_tx_mb # # Ignoring SIGTERM (cnt: 2), already exiting... # # Ignoring SIGTERM (cnt: 3), already exiting... # # Exception| Traceback (most recent call last): # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 244, in ksft_run # # Exception| case(*args) # # Exception| ~~~~^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 506, in test_xdp_native_adjst_taa # # Exception| res = _test_xdp_native_tail_adjst( # # Exception| cfg, # # Exception| pkt_sz_lst, # # Exception| offset_lst, # # Exception| ) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 467, in _test_xdp_native_tail_adt # # Exception| recvd_str = _exchg_udp(cfg, port, test_str) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 72, in _exchg_udp # # Exception| with bkg(rx_udp_cmd, exit_wait=True) as nc: # # Exception| ~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 137, in __exit__ # # Exception| return self.process(terminate=terminate, fail=self.check_fail) # # Exception| ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 85, in process # # Exception| stdout, stderr = self.proc.communicate(timeout) # # Exception| ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^ # # Exception| File "/usr/lib/python3.13/subprocess.py", line 1222, in communicate # # Exception| stdout, stderr = self._communicate(input, endtime, timeout) # # Exception| ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/usr/lib/python3.13/subprocess.py", line 2128, in _communicate # # Exception| ready = selector.select(timeout) # # Exception| File "/usr/lib/python3.13/selectors.py", line 398, in select # # Exception| fd_event_list = self._selector.poll(timeout) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 208, in _ksft_intr # # Exception| raise KsftTerminate() # # Exception| net.lib.py.ksft.KsftTerminate # # Stopping tests due to KsftTerminate. # not ok 7 xdp.test_xdp_native_adjst_tail_grow_data # # Totals: pass:6 fail:1 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250924222518.1826863-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 96a17ed17b369109b662b40345df961b412c1cd3 Author: Qiang Yu Date: Fri Sep 19 19:53:25 2025 +0530 dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller On the Qualcomm Glymur platform, the fifth PCIe host is compatible with the DWC controller present on the X1E80100 platform, but does not have cnoc_sf_axi clock. Hence, set minItems of clocks and clock-names to six. Signed-off-by: Qiang Yu Signed-off-by: Pankaj Patil Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250919142325.1090059-1-pankaj.patil@oss.qualcomm.com commit cef730075cfe2b2091e3c94471cc0a78405401d5 Author: Konrad Dybcio Date: Fri Sep 26 14:22:45 2025 +0200 PCI: dwc: Support 16-lane operation Some hosts support 16 lanes of PCIe. Make num-lanes accept that number. Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250926-topic-pcie_16ln-v1-1-c249acc18790@oss.qualcomm.com commit 60e7b5aa85712f7f2fc75b2e9d28444de88ab47f Author: Niklas Schnelle Date: Tue Aug 26 10:52:09 2025 +0200 PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() Removing a PCI devices requires holding pci_rescan_remove_lock. Prompted by this being missed in sriov_disable() and going unnoticed since its inception, add a lockdep assert so this doesn't get missed again in the future. Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Reviewed-by: Julian Ruess Link: https://patch.msgid.link/20250826-pci_fix_sriov_disable-v1-2-2d0bc938f2a3@linux.ibm.com commit 6c85fb5486c5a8ae646438877d7dc5050992a173 Author: Geert Uytterhoeven Date: Thu Sep 25 09:09:50 2025 +0200 psp: Expand PSP acronym in INET_PSP help description People not very intimate with PSP may not know the meaning of this recursive acronym. Hence replace the half-explanatory "PSP protocol" in the help description by the full expansion, like is done in the linked PSP Architecture Specification document. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman Link: https://patch.msgid.link/ae13c3ed7f80e604b8ae1561437a67b73549e599.1758784164.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 267bca002c504b6c656c23dc973a34ddaededbce Author: Robert Marko Date: Thu Sep 25 15:19:49 2025 +0200 dt-bindings: net: sparx5: correct LAN969x register space windows LAN969x needs only 2 register space windows as GCB is already covered by the "devices" register space window, so expect only 2 "reg" and "reg-names" properties. Fixes: 41c6439fdc2b ("dt-bindings: net: add compatible strings for lan969x targets") Signed-off-by: Robert Marko Acked-by: Conor Dooley Link: https://patch.msgid.link/20250925132109.583984-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 Author: Niklas Schnelle Date: Tue Aug 26 10:52:08 2025 +0200 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs. Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls. On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed: PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56) GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001 00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8 #0 [3800313fb20] device_del at c9158ad5c #1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390 #9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2. This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy. Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper. Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking. Fixes: 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Reviewed-by: Farhan Ali Reviewed-by: Julian Ruess Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250826-pci_fix_sriov_disable-v1-1-2d0bc938f2a3@linux.ibm.com commit 11ae737efea10a8cc1c48b6288bde93180946b8c Author: Amery Hung Date: Thu Sep 25 09:14:52 2025 -0700 selftests: drv-net: Reload pkt pointer after calling filter_udphdr Fix a verification failure. filter_udphdr() calls bpf_xdp_pull_data(), which will invalidate all pkt pointers. Therefore, all ctx->data loaded before filter_udphdr() cannot be used. Reload it to prevent verification errors. The error may not appear on some compiler versions if they decide to load ctx->data after filter_udphdr() when it is first used. Fixes: efec2e55bdef ("selftests: drv-net: Pull data before parsing headers") Signed-off-by: Amery Hung Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925161452.1290694-1-ameryhung@gmail.com Signed-off-by: Jakub Kicinski commit 532a94352fca6b51f49d1cd9f0e4250ade49b8b2 Author: Kael D'Alcamo Date: Wed Sep 24 16:09:20 2025 +0200 dt-bindings: rng: sparc_sun_oracle_rng: convert to DT schema Convert the Devicetree binding documentation for: * SUNW,n2-rng * SUNW,vf-rng * SUNW,kt-rng * ORCL,m4-rng * ORCL,m7-rng from plain text to YAML. Signed-off-by: Kael D'Alcamo Signed-off-by: Rob Herring (Arm) commit 33b6c8ed1ddd6118fbc150269cd2201462fbd7e6 Author: Kael D'Alcamo Date: Wed Sep 24 16:09:22 2025 +0200 dt-bindings: vendor-prefixes: update regex for properties without a prefix Update vendor-prefixes.yaml to allow property names without a prefix to contain '#' character in all positions Signed-off-by: Kael D'Alcamo Signed-off-by: Rob Herring (Arm) commit 74459b0dacced28542b631abf89bc24456c7f789 Author: Frank Li Date: Tue Sep 23 16:55:48 2025 -0400 dt-bindings: display: bridge: convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml Convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml format. Additional changes: - Only keep one example. Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit 77e46093e83a2788e2cf80ba8c8731375e587ad2 Author: Markus Heidelberg Date: Fri Sep 26 12:57:49 2025 +0200 scripts: dt_to_config: fix grammar and a typo in --help text - grammar: singular/plural inconsistency - typo: "of" -> "or" Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit d6f57d8c5a5aede34c72382cdbd5b35616e171e6 Author: Markus Heidelberg Date: Fri Sep 26 12:57:48 2025 +0200 dt-bindings: fix spelling, typos, grammar, duplicated words Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit 86eedc669a56e5607c253253d7b466a5b8d70fc8 Author: Markus Heidelberg Date: Fri Sep 26 12:57:47 2025 +0200 docs: dt: fix grammar and spelling Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit dd5629a67c5f3b4d9783dcdf06c844f8b7c88fae Merge: 6f540af89e1cfd 30c3055f9c0d84 Author: Jakub Kicinski Date: Fri Sep 26 13:51:47 2025 -0700 Merge branch 'xsk-refactors-around-generic-xmit-side' Maciej Fijalkowski says: ==================== xsk: refactors around generic xmit side this small patchset is about refactoring code around xsk_build_skb() as it became pretty heavy. Generic xmit is a bit hard to follow so here are three clean ups to start with making this code more friendly. v1: https://lore.kernel.org/20250922152600.2455136-1-maciej.fijalkowski@intel.com ==================== Link: https://patch.msgid.link/20250925160009.2474816-1-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 30c3055f9c0d84a67b8fd723bdec9b1b52b3c695 Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:09 2025 +0200 xsk: wrap generic metadata handling onto separate function xsk_build_skb() has gone wild with its size and one of the things we can do about it is to pull out a branch that takes care of metadata handling and make it a separate function. While at it, let us add metadata SW support for devices supporting IFF_TX_SKB_NO_LINEAR flag, that happen to have separate logic for building skb in xsk's generic xmit path. Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Signed-off-by: Maciej Fijalkowski Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-4-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 6b9c129c2f93df545248e26434720928f249ff2e Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:08 2025 +0200 xsk: remove @first_frag from xsk_build_skb() Instead of using auxiliary boolean that tracks if we are at first frag when gathering all elements of skb, same functionality can be achieved with checking if skb_shared_info::nr_frags is 0. Remove @first_frag but be careful around xsk_build_skb_zerocopy() and NULL the skb pointer when it failed so that common error path does not incorrectly interpret it during decision whether to call kfree_skb(). Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-3-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit c30d084960cf316c95fbf145d39974ce1ff7889c Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:07 2025 +0200 xsk: avoid overwriting skb fields for multi-buffer traffic We are unnecessarily setting a bunch of skb fields per each processed descriptor, which is redundant for fragmented frames. Let us set these respective members for first fragment only. To address both paths that we have within xsk_build_skb(), move assignments onto xsk_set_destructor_arg() and rename it to xsk_skb_init_misc(). Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-2-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 Author: D. Wythe Date: Fri Sep 26 15:17:51 2025 +0800 libbpf: Fix error when st-prefix_ops and ops from differ btf When a module registers a struct_ops, the struct_ops type and its corresponding map_value type ("bpf_struct_ops_") may reside in different btf objects, here are four possible case: +--------+---------------+-------------+---------------------------------+ | |bpf_struct_ops_| xxx_ops | | +--------+---------------+-------------+---------------------------------+ | case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux | +--------+---------------+-------------+---------------------------------+ | case 1 | btf_vmlinux | mod_btf | INVALID | +--------+---------------+-------------+---------------------------------+ | case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in | | | | | vmlinux and mod. | +--------+---------------+-------------+---------------------------------+ | case 3 | mod_btf | mod_btf | be used and reg only in mod | +--------+---------------+-------------+---------------------------------+ Currently we figure out the mod_btf by searching with the struct_ops type, which makes it impossible to figure out the mod_btf when the struct_ops type is in btf_vmlinux while it's corresponding map_value type is in mod_btf (case 2). The fix is to use the corresponding map_value type ("bpf_struct_ops_") as the lookup anchor instead of the struct_ops type to figure out the `btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate the kern_type_id via btf__find_by_name_kind() with the `btf` we just obtained from find_ksym_btf_id(). With this change the lookup obtains the correct btf and mod_btf for case 2, preserves correct behavior for other valid cases, and still fails as expected for the invalid scenario (case 1). Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") Signed-off-by: D. Wythe Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com commit acbba7f0e5ec9736813dee221cc20f77a7d11d7b Merge: b1793cd1fefaa3 79428e60897916 Author: Rafael J. Wysocki Date: Fri Sep 26 22:01:13 2025 +0200 Merge tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge updates of thermal drivers for 6.18-rc1 from Daniel Lezcano: "- Add the QCS615 compatible DT bindings for QCom platforms (Gaurav Kohli) - Support fallback trimming values when the fuse is empty in the R-Car driver (Marek Vasut) - Remove unneeded semicolon in the Mediatek LVTS driver (Jiapeng Chong) - Fix the LMH Kconfig option by selecting QCOM_SCM and take the opportunity to add the COMPILE_TEST option for the QCom's LMH feature (Dmitry Baryshkov) - Fix the missing includes and incorrect error message in the Qcom's LMH driver (Dmitry Baryshkov) - Fix comment typo and add the documentation in the Kconfig for the R-Car Gen3 and Gen4 (Marek Vasut) - Add Tegra114 SOCTHERM support (Svyatoslav Ryhel) - Rename the functions name in the driver to be consistent and generic with the different R-Car platform variants (Wolfram Sang) - Register the TI K3 J72xx bandgap sensor as a hwmon sensor too (Michael Walle) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3S SoC (Claudiu Beznea) - Support the GRF in the Rockchip driver (Sebastian Reichel) - Add a temperature IIO sensor channel in the generic thermal ADC driver (Svyatoslav Ryhel) - Document the temperature sensor on the QCOM's Glymur platform (Manaf Meethalavalappu) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3E SoC (John Madieu)" * tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (24 commits) dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit thermal/drivers/thermal-generic-adc: Add temperature sensor channel dt-bindings: thermal: rockchip: Tighten grf requirements thermal/drivers/rockchip: Shut up GRF warning thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver dt-bindings: thermal: add Tegra114 soctherm header thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry thermal/drivers/rcar_gen3: Fix comment typo drivers/thermal/qcom/lmh: Fix incorrect error message thermal/drivers/qcom/lmh: Add missing IRQ includes thermal/drivers/qcom: Make LMH select QCOM_SCM ... commit a036bb0e60ad2828c3498bff7465bcbb247b7436 Author: Bjorn Helgaas Date: Thu Sep 25 14:56:30 2025 -0500 of: base: Add of_get_next_child_with_prefix() stub 1fcc67e3a354 ("of: base: Add for_each_child_of_node_with_prefix()") added of_get_next_child_with_prefix() but did not add a stub for the !CONFIG_OF case. Add a of_get_next_child_with_prefix() stub so users of for_each_child_of_node_with_prefix() can be built for compile testing even when !CONFIG_OF. Fixes: 1fcc67e3a354 ("of: base: Add for_each_child_of_node_with_prefix()") Signed-off-by: Bjorn Helgaas Signed-off-by: Rob Herring (Arm) commit 4fea3336ef57295b989a6b2db4a6946a06e4c787 Author: Frank Li Date: Tue Sep 23 16:41:18 2025 -0400 dt-bindings: trivial-devices: Add compatible string synaptics,synaptics_i2c Add compatible string synaptics,synaptics_i2c for synaptics touch pad. It match existed driver drivers/input/mouse/synaptics_i2c.c. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit 18b26b15178386eb82bca4b23b03e96ca9317d36 Author: Ariel D'Alessandro Date: Thu Sep 11 12:10:00 2025 -0300 dt-bindings: soc: mediatek: pwrap: Add power-domains property Currently, the DT bindings for Mediatek PMIC Wrapper is missing the power-domains property, which is used in the MT8173 E1 evaluation board as it needs USB power domain. Signed-off-by: Ariel D'Alessandro Acked-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Rob Herring (Arm) commit d0b5a39acd079bccaebbb0d94bfd4649359951c2 Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:57 2025 -0300 dt-bindings: pinctrl: mt65xx: Allow gpio-line-names Current, the DT bindings for MediaTek's MT65xx Pin controller is missing the gpio-line-names property, add it to the associated schema. Signed-off-by: Ariel D'Alessandro Acked-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Linus Walleij Signed-off-by: Rob Herring (Arm) commit 49ceb031b6c139e17e069b25506a4c283fd22595 Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:51 2025 -0300 dt-bindings: media: Convert MediaTek mt8173-vpu bindings to DT schema Convert the existing text-based DT bindings for Mediatek MT8173 Video Processor Unit to a DT schema. Signed-off-by: Ariel D'Alessandro Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski [robh: update MAINTAINERS and mediatek-mdp.txt references] Signed-off-by: Rob Herring (Arm) commit 37020f865aa3c4049266cb34cf83ef299184ae80 Author: Julien Massot Date: Tue Aug 26 09:39:36 2025 +0200 dt-bindings: arm: mediatek: Support mt8183-audiosys variant Update the mediatek,audsys binding to support the mt8183-audiosys compatible, which uses a different audio controller (mediatek,mt8183-audio.yaml) compared to the legacy mt2701-audio controller. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Signed-off-by: Rob Herring (Arm) commit a31c2f8e2b6af2e45d5e8016e5055b2b00b4d6c5 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:39 2025 +0200 dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional The GCE Mailbox needs only one clock and the clock-names can be used only by the driver (which, for instance, does not use it), and this is true for all of the currently supported MediaTek SoCs. Stop requiring to specify clock-names on all non-MT8195 GCEs. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Acked-by: Rob Herring (Arm) Reviewed-by: Chen-Yu Tsai Signed-off-by: Rob Herring (Arm) commit 1a8493e06b854b05263071a5db77488cb9c07972 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:48 2025 +0200 dt-bindings: regulator: mediatek,mt6331: Add missing compatible This binding had no compatible and for this reason would not be applied to anything: add the missing "mediatek,mt6331-regulator" comaptible. Fixes: 6385e21692bb ("regulator: Add bindings for MT6331 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit e29e64fb9c58ce92cb8316cd6a939bd3e49b7f63 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:47 2025 +0200 dt-bindings: regulator: mediatek,mt6331: Fix various regulator names This binding was never applied to anything because it misses the compatible, hence any mistake in it got unnoticed. Before adding the compatible to let it apply, fix the names and the node names of various regulators. Fixes: 6385e21692bb ("regulator: Add bindings for MT6331 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 41663b33cda3a70c719f82f4f62c2f54b16fad5b Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:46 2025 +0200 dt-bindings: regulator: mediatek,mt6332-regulator: Add missing compatible This binding had no compatible and for this reason would not be applied to anything: add the missing "mediatek,mt6332-regulator" compatible. Fixes: e22943e32e1f regulator: ("Add bindings for MT6332 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 8e0118a79bda64aad3ae72dd80c814c1978460ea Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:44 2025 +0200 dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing base reg The pin controller for both MT7622 and MT7629 need both a "base" and an "eint" MMIO like the ones found on other MediaTek SoCs: while devicetrees have always been correct, the binding is not, as it only allows an "eint" reg. Add "base" to reg-names and increment maxItems for reg to two. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) commit 8d200dff1e8e0cb521dd48ba1d5424be400cd9bc Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:43 2025 +0200 dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing pwm_ch7_2 The MT7622 SoC has a PWM channel 7-2 group for the pwm7 IP: add the missing pwm_ch7_2 group. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit c1f7800c9c70c67d5feea2d9acaac004086d41d2 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:42 2025 +0200 dt-bindings: timer: mediatek: Add compatible for MT6795 GP Timer Add a compatible for the General Purpose Timer (GPT) found on the MediaTek Helio X10 MT6795 SoC which is fully compatible with the one found in MT6577. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 069862313db33a2b68ebf9e92ac13b73ef12f2af Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:37 2025 +0200 dt-bindings: display: mediatek: dpi: Allow specifying resets Even though the DPI IP has a reset bit on all MediaTek SoCs, it is optional, and has always been unused until MT8195; specifically: on older SoCs, like MT8173, the reset bit is located in MMSYS, and on newer SoCs, like MT8195, it is located in VDOSYS. For this reason, allow specifying the resets and reset-names on all MediaTek SoCs. Those properties are optional because there are multiple ways to reset this IP and the reset lines in MM/VDO are used only if the IP cannot perform warm-reset. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Rob Herring (Arm) commit 4379fbb9b06c8c17dac63652cfc2a7ada96c5074 Author: Pankaj Patil Date: Thu Sep 18 19:32:49 2025 +0530 dt-bindings: interrupt-controller: qcom,pdc: Document Glymur PDC Document compatible for the Power Domain Controller(PDC) block on Glymur.PDC acts as interrupt controller in SoC states where GIC is non-operational. Signed-off-by: Pankaj Patil Signed-off-by: Rob Herring (Arm) commit c502ca1ea1b9a7ed4b9665bed48bc1d8887639b3 Author: sheetal Date: Thu Sep 18 15:50:08 2025 +0530 dt-bindings: interrupt-controller: arm,gic: Add tegra264-agic Add nvidia,tegra264-agic to the arm,gic binding for tegra264 audio interrupt controller support. Signed-off-by: sheetal Signed-off-by: Rob Herring (Arm) commit 60042a6ff2348fd2edca2f31e79fe80548d1a75d Author: Frank Li Date: Mon Sep 15 11:51:23 2025 -0400 dt-bindings: display: simple: Add innolux,n133hse-ea1 and nlt,nl12880bc20-spwg-24 Add innolux,n133hse-ea1 13.3" TFT LCD panel and nlt,nl12880bc20-spwg-24 12.1" WXGA (1280 x 800) LVDS TFT LCD panel. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6q-novena.dtb: /panel: failed to match any schema with compatible: ['innolux,n133hse-ea1'] arch/arm/boot/dts/nxp/imx/imx6dl-tx6u-811x.dtb: /lvds0-panel: failed to match any schema with compatible: ['nlt,nl12880bc20-spwg-24'] Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit b518ec73cc62fe3f921ea6c009628a40c927d92c Author: Ivaylo Ivanov Date: Sun Sep 14 16:14:52 2025 +0300 dt-bindings: gpu: arm,mali-midgard: add exynos8890-mali compatible The exynos8890 uses the ARM Mali T880 GPU, document its compatible string with the appropriate fallback. Signed-off-by: Ivaylo Ivanov Signed-off-by: Rob Herring (Arm) commit ad9a8291b13b985852ad617827a4c5265a8836f5 Author: Rob Herring (Arm) Date: Wed Apr 30 13:27:35 2025 -0500 dt-bindings: edac: Convert aspeed,ast2400-sdram-edac to DT schema Convert the ASpeed SDRAM EDAC binding to DT schema. It's a straight-forward conversion. Reviewed-by: Andrew Jeffery Reviewed-by: Stefan Schaeckeler Signed-off-by: Rob Herring (Arm) commit b1793cd1fefaa372f838aa43cf6c404ad49e2968 Merge: e3e661253e82b2 5cf952c54f3546 Author: Rafael J. Wysocki Date: Fri Sep 26 21:49:58 2025 +0200 Merge branch 'thermal-intel' Merge an adjustment of the new Power Slider interface in the int340x thermal driver. * thermal-intel: thermal: intel: int340x: Power Slider: Validate slider_balance range commit 20b1d75fb840cc27490028a5b13914e22375f273 Author: Jonathan Curley Date: Wed Sep 24 16:20:50 2025 +0000 NFSv4/flexfiles: Add support for striped layouts Updates lseg creation path to parse and add striped layouts. Enable support for striped layouts. Limitations: 1. All mirrors must have the same number of stripes. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 8a8e0f5566edc074a006246917fd78b358e39afa Author: Jonathan Curley Date: Wed Sep 24 16:20:49 2025 +0000 NFSv4/flexfiles: Update layout stats & error paths for striped layouts Updates the layout stats logic to be stripe aware. Read and write stats are accumulated on a per DS stripe basis. Also updates error paths to use dss_id where appropraite. Limitations: 1. The layout stats structure is still statically sized to 4 and there is no deduplication logic for deviceids that may appear more than once in a striped layout. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 06d157d6fc40615d199d0b2786dc469a05c9d254 Author: Jonathan Curley Date: Wed Sep 24 16:20:48 2025 +0000 NFSv4/flexfiles: Write path updates for striped layouts Updates write path to calculate and use dss_id to direct IO to the appropriate stripe DS. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 8a8729db676379e148ce56ac9a7bc1f90e3bd95a Author: Jonathan Curley Date: Wed Sep 24 16:20:47 2025 +0000 NFSv4/flexfiles: Commit path updates for striped layouts Updates the commit path to be stripe aware. This required updating the ds_commit_idx to be stripe aware. ds_commit_idx == mirror_idx * dss_count + dss_id. Updates code paths to utilize the new ds_commit_idx and derive dss_id & mirror_idx where appropriate to contact the correct DS using the corresponding parameters. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 4934ccbeaed39659474fa18b8a399e2887cef8a9 Author: Jonathan Curley Date: Wed Sep 24 16:20:46 2025 +0000 NFSv4/flexfiles: Read path updates for striped layouts Updates read path to calculate and use dss_id to direct IO to the appropriate stripe DS. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit a1491919c8805b3874f76fd273ae224ec9768aec Author: Jonathan Curley Date: Wed Sep 24 16:20:45 2025 +0000 NFSv4/flexfiles: Update low level helper functions to be DS stripe aware. Updates common helper functions to be dss_id aware. Most cases simply add a dss_id parameter. The has_available functions have been updated with a loop. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit d442670c0f63c46b7f348f68fb2002af597708f2 Author: Jonathan Curley Date: Wed Sep 24 16:20:44 2025 +0000 NFSv4/flexfiles: Add data structure support for striped layouts Adds a new struct nfs4_ff_layout_ds_stripe that represents a data server stripe within a layout. A new dynamically allocated array of this type has been added to nfs4_ff_layout_mirror and per stripe configuration information has been moved from the mirror type to the stripe based on the RFC. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit eb71428e1a7fb51b8d43762db1c2ec1d8a7a95b6 Author: Jonathan Curley Date: Wed Sep 24 16:20:43 2025 +0000 NFSv4/flexfiles: Use ds_commit_idx when marking a write commit Correct this path to use ds_commit_idx. Another noop preparation change. In current code commit_idx == mirror_idx but when striping is enabled that will not be true. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit fec80afc41afa3016421115427df8d00dc491ee5 Author: Jonathan Curley Date: Wed Sep 24 16:20:42 2025 +0000 NFSv4/flexfiles: Remove cred local variable dependency No-op preparation change to remove dependency on cred local variable. Subsequent striping diff has a cred per stripe so this local variable can't be trusted to be the same. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 6f540af89e1cfd1a33f63989c50010629b169cc5 Merge: 203e3beb73e535 b89cd87b77d48f Author: Jakub Kicinski Date: Fri Sep 26 12:26:43 2025 -0700 Merge branch 'scripts-coccinelle-symbolic-error-names-script' Tariq Toukan says: ==================== scripts/coccinelle: Symbolic error names script This small series by Gal adds a new coccinelle script that spots potential transitions to symbolic error names in print functions, and then uses it in mlx5 driver. ==================== Link: https://patch.msgid.link/1758192227-701925-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b89cd87b77d48ff14aea743cdba4193e76feb588 Author: Gal Pressman Date: Thu Sep 18 13:43:47 2025 +0300 net/mlx5: Use %pe format specifier for error pointers Using the coccinelle test introduced in previous commit (scripts/coccinelle/misc/ptr_err_to_pe.cocci), convert error logging throughout the mlx5 driver to use the %pe format specifier instead of PTR_ERR() with integer format specifiers. Signed-off-by: Gal Pressman Reviewed-by: Alexei Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758192227-701925-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 57c49d2355729c12475554b4c51dbf830b02d08d Author: Gal Pressman Date: Thu Sep 18 13:43:46 2025 +0300 scripts/coccinelle: Find PTR_ERR() to %pe candidates Add a new Coccinelle script to identify places where PTR_ERR() is used in print functions and suggest using the %pe format specifier instead. For printing error pointers (i.e., a pointer for which IS_ERR() is true) %pe will print a symbolic error name (e.g,. -EINVAL), opposed to the raw errno (e.g,. -22) produced by PTR_ERR(). It also makes the code cleaner by saving a redundant call to PTR_ERR(). The script supports context, report, and org modes. Example transformation: printk("Error: %ld\n", PTR_ERR(ptr)); // Before printk("Error: %pe\n", ptr); // After Signed-off-by: Gal Pressman Reviewed-by: Alexei Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758192227-701925-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1f5bcfe91ffce71bdd1022648b9d501d46d20c09 Author: Rafael J. Wysocki Date: Fri Sep 26 18:41:21 2025 +0200 PM: hibernate: Combine return paths in power_down() To avoid code duplication and improve clarity, combine the code paths in power_down() leading to a return from that function. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/3571055.QJadu78ljV@rafael.j.wysocki [ rjw: Changed the new label name to "exit" ] Signed-off-by: Rafael J. Wysocki commit 991e555efffde314e94be9c28fc0ea5504195df8 Author: Amery Hung Date: Fri Sep 26 09:41:42 2025 -0700 selftests/bpf: Test changing packet data from kfunc bpf_xdp_pull_data() is the first kfunc that changes packet data. Make sure the verifier clear all packet pointers after calling packet data changing kfunc. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250926164142.1850176-1-ameryhung@gmail.com commit 6f4c6f9ed4ce65303f6bb153e2afc71bc33c8ded Author: Rafael J. Wysocki Date: Fri Sep 26 18:40:25 2025 +0200 PM: hibernate: Restrict GFP mask in power_down() Commit 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") caused hibernation_platform_enter() to call pm_restore_gfp_mask() via dpm_resume_end(), so when power_down() returns after aborting hibernation_platform_enter(), it needs to match the pm_restore_gfp_mask() call in hibernate() that will occur subsequently. Address this by adding a pm_restrict_gfp_mask() call to the relevant error path in power_down(). Fixes: 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit bbfe987c5a2854705393ad79813074e5eadcbde6 Author: Rafael J. Wysocki Date: Fri Sep 26 13:10:22 2025 +0200 PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage Commit 495c8d35035e ("PM: hibernate: Add pm_hibernation_mode_is_suspend()") that introduced pm_hibernation_mode_is_suspend() did not define it in the case when CONFIG_HIBERNATION is unset, but CONFIG_SUSPEND is set. Subsequent commit 0a6e9e098fcc ("drm/amd: Fix hybrid sleep") made the amdgpu driver use that function which led to kernel build breakage in the case mentioned above [1]. Address this by using appropriate #ifdeffery around the definition of pm_hibernation_mode_is_suspend(). Fixes: 0a6e9e098fcc ("drm/amd: Fix hybrid sleep") Reported-by: KernelCI bot Closes: https://groups.io/g/kernelci-results/topic/regression_pm_testing/115439919 [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit 927f3e85015285ff68789bd00aa66b071016b27f Author: Brian Norris Date: Tue Sep 23 15:06:26 2025 -0700 PM: runtime: Documentation: ABI: Document time units for *_time Many .../power/... time-related attributes have an "_ms" suffix and also include language in their ABI description to make clear that their time is measured in milliseconds. However, 'runtime_suspended_time' and 'runtime_active_time' have neither, and it takes me a nontrivial amount of time to poke through the source to confirm that they are also measured in milliseconds. Update the doc with "millisecond" units. Signed-off-by: Brian Norris Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250923150625.1.If11a14e33d578369db48d678395d0323bdb01915@changeid [ rjw: Subject edits, changelog tweak ] Signed-off-by: Rafael J. Wysocki commit e6d736bd08902ba53460df1b62ee4218bbd17d9b Author: Abhijit Gangurde Date: Wed Sep 24 19:51:23 2025 +0530 RDMA/ionic: Fix memory leak of admin q_wr The admin queue work request buffer, aq->q_wr, is allocated via kcalloc in __ionic_create_rdma_adminq. However, it was not being freed in the corresponding teardown function __ionic_destroy_rdma_adminq. This results in a memory leak. Fix this leak by adding the missing kfree(aq->q_wr) in the destruction path. Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Link: https://patch.msgid.link/r/20250924142123.18344-1-abhijit.gangurde@amd.com Signed-off-by: Abhijit Gangurde Signed-off-by: Jason Gunthorpe commit fdd0fe94d68649322e391c5c27dd9f436b4e955e Author: Bernard Metzler Date: Tue Sep 23 16:45:36 2025 +0200 RDMA/siw: Always report immediate post SQ errors In siw_post_send(), any immediate error encountered during processing of the work request list must be reported to the caller, even if previous work requests in that list were just accepted and added to the send queue. Not reporting those errors confuses the caller, which would wait indefinitely for the failing and potentially subsequently aborted work requests completion. This fixes a case where immediate errors were overwritten by subsequent code in siw_post_send(). Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev Suggested-by: Stefan Metzmacher Signed-off-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit fe0126702a40b2f3d315bc943ef10dc2f707e29d Author: Thorsten Blum Date: Mon Sep 22 23:03:57 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in handle_nextprop_quirks() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 79f76dfb4ee299eaba9be8c17d59e146a54e6752 Author: Thorsten Blum Date: Mon Sep 22 23:03:56 2025 +0200 sparc64: Replace deprecated strcpy() with strscpy() in build_path_component() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit b7b2c2f7e8848299c5cc8c596c49e90b0a39a3db Author: Thorsten Blum Date: Mon Sep 22 23:03:55 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in prom_32.c strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit dcdba5966c1ef9a6890e03fdaaf1bd1a5b66ee75 Author: Thorsten Blum Date: Mon Sep 22 23:03:54 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in domain services driver strcpy() is deprecated; use strscpy() instead. In ldom_set_var(), use pr_err() instead of printk(KERN_ERR) to silence a checkpatch warning. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 9040d7c77e4d920c190ee2154d76e9daf4406de6 Author: Thorsten Blum Date: Mon Sep 22 23:03:53 2025 +0200 sparc64: Replace deprecated strcpy() with strscpy() in prom_nextprop() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit c7ae5d73b7af5723e7590015a570cd3cd397290b Author: Thorsten Blum Date: Mon Sep 22 23:03:52 2025 +0200 sparc: floppy: Replace deprecated strcpy() with strscpy() in sun_floppy_init() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 8ebfe29b710ba0c40531089ce649d0e4a776125a Author: Thorsten Blum Date: Mon Sep 22 23:03:51 2025 +0200 sparc: parport: Replace deprecated strcpy() with strscpy() in ecpp_probe() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 59d94ea8901cdab47dc65cabc790597eef99944f Author: Thorsten Blum Date: Mon Sep 22 23:03:50 2025 +0200 sparc: PCI: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 3b1307e1cd1224a063a1791d213dfdd35b05a38a Author: Thomas Huth Date: Fri Mar 14 08:10:05 2025 +0100 sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: David S. Miller Cc: Andreas Larsson Cc: sparclinux@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit d6fb6511de74bd0d4cb4cabddae9b31d533af1c1 Author: Thomas Huth Date: Fri Mar 14 08:10:04 2025 +0100 sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: David S. Miller Cc: Andreas Larsson Cc: sparclinux@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit dc356bf3c173a69d4b6f6ee6221cd21c6500fc65 Author: Thomas Huth Date: Tue Aug 5 11:25:40 2025 +0200 sparc: Drop the "-ansi" from the asflags In the very early kernel 1.x days, assembler files were pre-processed with the "-traditional" flag. With kernel 1.1.85, the sparc subsystem was changed to use "-ansi" instead while the other parts of the kernel continued to use "-traditional". That "-traditional" got removed from the other architectures in the course of time, but the sparc part kept the "-ansi" until today. This is bad since it comes with some disadvantages nowadays: You have to make sure to not include any header that contains a "//" C++ comment by accident (there are now some in the tree that use these for SPDX identifiers for example), and with "-ansi" we also do not get the pre-defined __ASSEMBLER__ macro which we'd like to use instead of the kernel-only __ASSEMBLY__ macro in the future. Since there does not seem to be any compelling reason anymore to use "-ansi" nowadays, let's simply drop the "-ansi" flag from the sparc subsystem now to get rid of those disadvantages. Signed-off-by: Thomas Huth Reviewed-by: Arnd Bergmann Reviewed-by: Andreas Larsson Tested-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 407aa63018d15c35a34938633868e61174d2ef6e Author: Tushar Dave Date: Thu Sep 25 12:09:35 2025 -0500 vfio/nvgrace-gpu: Add GB300 SKU to the devid table GB300 is NVIDIA's Grace Blackwell Ultra Superchip. Add the GB300 SKU device-id to nvgrace_gpu_vfio_pci_table. Signed-off-by: Tushar Dave Reviewed-by: Ankit Agrawal Link: https://lore.kernel.org/r/20250925170935.121587-1-tdave@nvidia.com Signed-off-by: Alex Williamson commit 8b9f128947dd72e0fcf256088a673abac9b720bf Author: Timothy Pearson Date: Tue Sep 23 12:04:33 2025 -0500 vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices PCI devices prior to PCI 2.3 both use level interrupts and do not support interrupt masking, leading to a failure when passed through to a KVM guest on at least the ppc64 platform. This failure manifests as receiving and acknowledging a single interrupt in the guest, while the device continues to assert the level interrupt indicating a need for further servicing. When lazy IRQ masking is used on DisINTx- (non-PCI 2.3) hardware, the following sequence occurs: * Level IRQ assertion on device * IRQ marked disabled in kernel * Host interrupt handler exits without clearing the interrupt on the device * Eventfd is delivered to userspace * Guest processes IRQ and clears device interrupt * Device de-asserts INTx, then re-asserts INTx while the interrupt is masked * Newly asserted interrupt acknowledged by kernel VMM without being handled * Software mask removed by VFIO driver * Device INTx still asserted, host controller does not see new edge after EOI The behavior is now platform-dependent. Some platforms (amd64) will continue to spew IRQs for as long as the INTX line remains asserted, therefore the IRQ will be handled by the host as soon as the mask is dropped. Others (ppc64) will only send the one request, and if it is not handled no further interrupts will be sent. The former behavior theoretically leaves the system vulnerable to interrupt storm, and the latter will result in the device stalling after receiving exactly one interrupt in the guest. Work around this by disabling lazy IRQ masking for DisINTx- INTx devices. Signed-off-by: Timothy Pearson Link: https://lore.kernel.org/r/333803015.1744464.1758647073336.JavaMail.zimbra@raptorengineeringinc.com Signed-off-by: Alex Williamson commit 4d164e08cd8457ebcd5346f612ac2c04e80b6bea Author: John Ogness Date: Fri Sep 26 00:55:59 2025 +0206 printk: ringbuffer: Fix data block max size check Currently data_check_size() limits data blocks to a maximum size of the full buffer minus an ID (long integer): max_size <= DATA_SIZE(data_ring) - sizeof(long) However, this is not an appropriate limit due to the nature of wrapping data blocks. For example, if a data block is larger than half the buffer: size = (DATA_SIZE(data_ring) / 2) + 8 and begins exactly in the middle of the buffer, then: - the data block will wrap - the ID will be stored at exactly half of the buffer - the record data begins at the beginning of the buffer - the record data ends 8 bytes _past_ exactly half of the buffer The record overwrites itself, i.e. needs more space than the full buffer! Luckily printk() is not vulnerable to this problem because truncate_msg() limits printk-messages to 1/4 of the ringbuffer. Indeed, by adjusting the printk_ringbuffer KUnit test, which does not use printk() and its truncate_msg() check, it is easy to see that the ringbuffer becomes corrupted for records larger than half the buffer size. The corruption occurs because data_push_tail() expects it will never be requested to push the tail beyond the head. Avoid this problem by adjusting data_check_size() to limit record sizes to half the buffer size. Also add WARN_ON_ONCE() before relevant data_push_tail() calls to validate that there are no such illegal requests. WARN_ON_ONCE() is used, rather than just adding extra checks to data_push_tail() because it is considered a bug to attempt such illegal actions. Link: https://lore.kernel.org/lkml/aMLrGCQSyC8odlFZ@pathway.suse.cz Signed-off-by: John Ogness Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek commit cb0c5a60a6f7dd7f35fa5b46fd04dfb66b37fc1e Author: Gopi Krishna Menon Date: Fri Sep 26 10:06:12 2025 +0530 docs: perf: Fujitsu: Fix htmldocs build warnings and errors Running "make htmldocs" generates the following build errors and warnings for fujitsu_uncore_pmu.rst: Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:20: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:23: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:28: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:29: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:81: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:82: WARNING: Block quote ends without a blank line; unexpected unindent. Add blank line before bullet lists, block quotes to fix build errors, resolve warnings and properly render perf commands as code blocks. Signed-off-by: Gopi Krishna Menon Reviewed-by: Koichi Okuno Fixes: bad11557eed2 ("perf: Fujitsu: Add the Uncore PMU driver") Reviewed-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Will Deacon commit 57610d69f909ea2ea072775c6ad64ba9fad590bb Merge: 2bc1adb05e360f 66f430522452fe Author: Rafael J. Wysocki Date: Fri Sep 26 15:02:37 2025 +0200 Merge tag 'power-utilities-for-v6.18-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Merge turbostat and x86_energy_perf_policy bug fixes for v6.18 merge window from Len Brown. * tag 'power-utilities-for-v6.18-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc Author: Alessandro Zanni Date: Wed Sep 24 19:16:28 2025 +0200 iommu/selftest: prevent use of uninitialized variable Fix to avoid the usage of the `res` variable uninitialized in the following macro expansions. It solves the following warning: In function ‘iommufd_viommu_vdevice_alloc’, inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1: ../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized] 760 | if (!(__exp _t __seen)) { \ | ^ ../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’ 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1) | ^~~~~~~~ iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’ 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents)) | ^~~~~~~~~ iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’ 2924 | test_cmd_trigger_vevents(dev_id, 3); | ^~~~~~~~~~~~~~~~~~~~~~~~ The issue can be reproduced, building the tests, with the command: make -C tools/testing/selftests TARGETS=iommu Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage") Signed-off-by: Alessandro Zanni Signed-off-by: Jason Gunthorpe commit bbc3110823eca23b066e75a920bdc8118adda0d2 Author: Dan Carpenter Date: Fri Sep 26 07:03:29 2025 +0300 pmdomain: thead: Fix error pointer vs NULL bug in th1520_pd_reboot_init() The devm_auxiliary_device_create() returns NULL on error. It never returns error pointers. Using PTR_ERR_OR_ZERO() here means the function always returns success. Replace the PTR_ERR_OR_ZERO() call check with a NULL check. Fixes: 64581f41f4c4 ("pmdomain: thead: create auxiliary device for rebooting") Signed-off-by: Dan Carpenter Acked-by: Icenowy Zheng Signed-off-by: Ulf Hansson commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e Author: Jan Kara Date: Thu Sep 25 14:30:39 2025 +0200 ext4: fix checks for orphan inodes When orphan file feature is enabled, inode can be tracked as orphan either in the standard orphan list or in the orphan file. The first can be tested by checking ei->i_orphan list head, the second is recorded by EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where we want to check whether inode is tracked as orphan and only some of them properly check for both possibilities. Luckily the consequences are mostly minor, the worst that can happen is that we track an inode as orphan although we don't need to and e2fsck then complains (resulting in occasional ext4/307 xfstest failures). Fix the problem by introducing a helper for checking whether an inode is tracked as orphan and use it in appropriate places. Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling") Cc: stable@kernel.org Signed-off-by: Jan Kara Reviewed-by: Zhang Yi Message-ID: <20250925123038.20264-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 44d2a72f4d64655f906ba47a5e108733f59e6f28 Author: Deepanshu Kartikey Date: Tue Sep 23 19:02:45 2025 +0530 ext4: validate ea_ino and size in check_xattrs During xattr block validation, check_xattrs() processes xattr entries without validating that entries claiming to use EA inodes have non-zero sizes. Corrupted filesystems may contain xattr entries where e_value_size is zero but e_value_inum is non-zero, indicating invalid xattr data. Add validation in check_xattrs() to detect this corruption pattern early and return -EFSCORRUPTED, preventing invalid xattr entries from causing issues throughout the ext4 codebase. Cc: stable@kernel.org Suggested-by: Theodore Ts'o Reported-by: syzbot+4c9d23743a2409b80293@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4c9d23743a2409b80293 Signed-off-by: Deepanshu Kartikey Signed-off-by: Theodore Ts'o Message-ID: <20250923133245.1091761-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o commit 57295e835408d8d425bef58da5253465db3d6888 Author: Ahmet Eray Karadag Date: Sat Sep 20 05:13:43 2025 +0300 ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn. Reported-by: syzbot+0be4f339a8218d2a5bb1@syzkaller.appspotmail.com Fixes: https://syzbot.org/bug?extid=0be4f339a8218d2a5bb1 Cc: stable@kernel.org Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Message-ID: <20250920021342.45575-1-eraykrdg1@gmail.com> Signed-off-by: Theodore Ts'o commit 04a91570ac67760301e5458d65eaf1342ecca314 Author: Theodore Ts'o Date: Tue Sep 16 23:22:49 2025 -0400 ext4: implemet new ioctls to set and get superblock parameters Implement the EXT4_IOC_GET_TUNE_SB_PARAM and EXT4_IOC_SET_TUNE_SB_PARAM ioctls, which allow certains superblock parameters to be set while the file system is mounted, without needing write access to the block device. Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-3-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 12c84dd4d308551568d85203fd6ed2685e861fda Author: Theodore Ts'o Date: Tue Sep 16 23:22:48 2025 -0400 ext4: add support for 32-bit default reserved uid and gid values Support for specifying the default user id and group id that is allowed to use the reserved block space was added way back when Linux only supported 16-bit uid's and gid's. (Yeah, that long ago.) It's not a commonly used feature, but let's add support for 32-bit user and group id's. Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-2-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8 Author: Theodore Ts'o Date: Tue Sep 16 23:22:47 2025 -0400 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring. Cc: stable@vger.kernel.org Fixes: 8b67f04ab9de ("ext4: Add mount options in superblock") Reviewed-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-1-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 12e803c8827d049ae8f2c743ef66ab87ae898375 Author: Zhang Yi Date: Fri Sep 12 18:58:41 2025 +0800 ext4: fix an off-by-one issue during moving extents During the movement of a written extent, mext_page_mkuptodate() is called to read data in the range [from, to) into the page cache and to update the corresponding buffers. Therefore, we should not wait on any buffer whose start offset is >= 'to'. Otherwise, it will return -EIO and fail the extents movement. $ for i in `seq 3 -1 0`; \ do xfs_io -fs -c "pwrite -b 1024 $((i * 1024)) 1024" /mnt/foo; \ done $ umount /mnt && mount /dev/pmem1s /mnt # drop cache $ e4defrag /mnt/foo e4defrag 1.47.0 (5-Feb-2023) ext4 defragmentation for /mnt/foo [1/1]/mnt/foo: 0% [ NG ] Success: [0/1] Cc: stable@kernel.org Fixes: a40759fb16ae ("ext4: remove array of buffer_heads from mext_page_mkuptodate()") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250912105841.1886799-1-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 9d80eaa1a1d37539224982b76c9ceeee736510b9 Author: Yongjian Sun Date: Thu Sep 11 21:30:24 2025 +0800 ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() After running a stress test combined with fault injection, we performed fsck -a followed by fsck -fn on the filesystem image. During the second pass, fsck -fn reported: Inode 131512, end of extent exceeds allowed value (logical block 405, physical block 1180540, len 2) This inode was not in the orphan list. Analysis revealed the following call chain that leads to the inconsistency: ext4_da_write_end() //does not update i_disksize ext4_punch_hole() //truncate folio, keep size ext4_page_mkwrite() ext4_block_page_mkwrite() ext4_block_write_begin() ext4_get_block() //insert written extent without update i_disksize journal commit echo 1 > /sys/block/xxx/device/delete da-write path updates i_size but does not update i_disksize. Then ext4_punch_hole truncates the da-folio yet still leaves i_disksize unchanged(in the ext4_update_disksize_before_punch function, the condition offset + len < size is met). Then ext4_page_mkwrite sees ext4_nonda_switch return 1 and takes the nodioread_nolock path, the folio about to be written has just been punched out, and it’s offset sits beyond the current i_disksize. This may result in a written extent being inserted, but again does not update i_disksize. If the journal gets committed and then the block device is yanked, we might run into this. It should be noted that replacing ext4_punch_hole with ext4_zero_range in the call sequence may also trigger this issue, as neither will update i_disksize under these circumstances. To fix this, we can modify ext4_update_disksize_before_punch to increase i_disksize to min(i_size, offset + len) when both i_size and (offset + len) are greater than i_disksize. Cc: stable@kernel.org Signed-off-by: Yongjian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Message-ID: <20250911133024.1841027-1-sunyongjian@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 0a6ce20c156442a4ce2a404747bb0fb05d54eeb3 Author: Jan Kara Date: Tue Sep 9 13:22:07 2025 +0200 ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files. Reported-by: syzbot+0b92850d68d9b12934f5@syzkaller.appspotmail.com Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling") Cc: stable@kernel.org Signed-off-by: Jan Kara Message-ID: <20250909112206.10459-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 963845748fe67125006859229487b45485564db7 Author: Jan Kara Date: Mon Sep 1 13:27:40 2025 +0200 ext4: fail unaligned direct IO write with EINVAL Commit bc264fea0f6f ("iomap: support incremental iomap_iter advances") changed the error handling logic in iomap_iter(). Previously any error from iomap_dio_bio_iter() got propagated to userspace, after this commit if ->iomap_end returns error, it gets propagated to userspace instead of an error from iomap_dio_bio_iter(). This results in unaligned writes to ext4 to silently fallback to buffered IO instead of erroring out. Now returning ENOTBLK for DIO writes from ext4_iomap_end() seems unnecessary these days. It is enough to return ENOTBLK from ext4_iomap_begin() when we don't support DIO write for that particular file offset (due to hole). Fixes: bc264fea0f6f ("iomap: support incremental iomap_iter advances") Cc: stable@kernel.org Signed-off-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Message-ID: <20250901112739.32484-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit f8b9c819ea20d1101656a91ced843d9e47ba0630 Author: Dan Carpenter Date: Fri Sep 26 07:03:11 2025 +0300 ASoc: tas2783A: Fix an error code in probe() This code returns the wrong variable "tas_dev->regmap" instead of "regmap" so it returns success instead of a negative error code. Return the correct variable. Fixes: 4cc9bd8d7b32 ("ASoc: tas2783A: Add soundwire based codec driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aNYQf4cyavnku5Nt@stanley.mountain Signed-off-by: Mark Brown commit 79428e60897916401c9ed326f6ada4d7c7c997a3 Author: Manaf Meethalavalappu Pallikunhi Date: Sat Sep 20 18:06:31 2025 +0530 dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor Document the Temperature Sensor (TSENS) on Glymur Platform. Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Pankaj Patil Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250920123631.281153-1-pankaj.patil@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit b8754092dfed4fc2fcdb0de32a029ba8f9b464b6 Author: Dmitry Torokhov Date: Mon Aug 11 15:50:05 2025 -0700 platform/x86: pcengines-apuv2: Use static device properties Convert the PC Engines APUv2/v3 board driver to use software nodes and static device properties for its on-board LEDs and front button. This change replaces the legacy gpiod_lookup_table and platform_data with a modern software node implementation, which allows the leds-gpio and gpio-keys drivers to use the standard device properties API. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/yaaegm5z2vtkl6ci5jpfnv42aywfjtoqw3bjgtli43ypask2r6@a7gg37rwkpx2 Signed-off-by: Ilpo Järvinen commit a2a815233c3068e3d41e15ee4dc4c19f256840df Author: Dmitry Torokhov Date: Mon Aug 11 15:47:09 2025 -0700 platform/x86: meraki-mx100: Use static device properties Convert the Meraki MX100 board driver to use software nodes and static device properties to describe the on-board LEDs and reset button. This moves away from the legacy gpiod_lookup_table and platform_data mechanisms, allowing consumer drivers like leds-gpio and gpio-keys to rely on the unified device properties interface instead of board-specific data. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/dzecghqrsrbe74akboqih7xculdm53rbhxa7dimt2ysdevyskd@hxhd2j3vnlt5 Signed-off-by: Ilpo Järvinen commit 4e0bcbd270e88800c4432715edd47964a080e52e Author: Dmitry Torokhov Date: Sun Aug 10 21:31:37 2025 -0700 platform/x86: barco-p50-gpio: use software nodes for gpio-leds/keys In preparation of dropping support for legacy GPIO API from gpio-keys switch the driver to use software nodes/properties to describe GPIO-connected LED and button. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/2meuzip4qnxvle4bwk4hbow4j34ii3cwb46xd5inq5btif5mjg@iiygy6ir7vtr Signed-off-by: Ilpo Järvinen commit 01fd7cf3534aa107797d130f461ba7bcad30414d Author: Hans de Goede Date: Sat Sep 20 22:07:13 2025 +0200 platform/x86: x86-android-tablets: Stop using EPROBE_DEFER Since the x86-android-tablets code uses platform_create_bundle() it cannot use EPROBE_DEFER and the driver-core will translate EPROBE_DEFER to ENXIO. Stop using EPROBE_DEFER instead log an error and return ENODEV, or for non-fatal cases log a warning and return 0. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-21-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 83fdf93f4bf45bda99c292c550ff299e2c249b1f Author: Hans de Goede Date: Sat Sep 20 22:07:12 2025 +0200 platform/x86: x86-android-tablets: Fix modules lists for Lenovo devices 2 fixes for Lenovo tablets: - The bq24190 charger on the Lenovo Yoga Tab2 830/1050 devices does not use the crystal-cove PMIC charger IRQ, so these shouldn't use bq24190_modules as that includes "intel_crystal_cove_charger" - Both the Tab2 and the Tab3 devices have a SPI audio-codec which init() attaches properties to, resp. the whole SPI device gets instantiated by the x86-android-tablets code. This requires the "spi_pxa2xx_platform" module to be loaded before init() runs Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-20-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6b4bc1451c23f9e41c544c0f6aa8fea048492611 Author: Hans de Goede Date: Sat Sep 20 22:07:11 2025 +0200 platform/x86: x86-android-tablets: Simplify lenovo_yoga_tab2_830_1050_exit() lenovo_yoga_tab2_830_1050_exit() only gets called after a successful lenovo_yoga_tab2_830_1050_init() call so there is no need to check if lenovo_yoga_tab2_830_1050_codec_[dev|pinctrl] are set. Also change the exit() order to be the exact reverse of init(). Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-19-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6564d3e1a46b12990a02dafa948b311a45bc4991 Author: Hans de Goede Date: Sat Sep 20 22:07:10 2025 +0200 platform/x86: x86-android-tablets: Add support for Acer A1-840 tablet Add support for the Acer Iconia One 8 A1-840 (non FHD version) tablet. This tablet has the usual issues for tablets shipped with Android as factory OS. The DSDT is broken in various ways, so i2c_clients for various devices as well as the INT3496 platform-device for OTG extcon handling need to be instantiated manually by x86-android-tablets. This tablet is special in that it is the first time a Bay Trail device has been found to use the Dollar Cove TI PMIC and the first time that the PMIC's Coulomb Counter is used as fuel-gauge. So far this PMIC has only been used together with Cherry Trail SoCs and always in combination with a separate full-featured fuel-gauge IC. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-18-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit d4bc149653d33d373c90b6dcdcc51fb55b296c7f Author: Hans de Goede Date: Sat Sep 20 22:07:09 2025 +0200 platform/x86: x86-android-tablets: Move Acer info to its own file Acer has several x86 based Android tablets which need x86-android-tablets support to work around their broken ACPI tables. At the moment x86-android-tablets only support one model, move this to its own file before adding support for more models to avoid needing to move more code around later. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-17-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e5e12fab129458b32f76ac6019132661f1f1737c Author: Hans de Goede Date: Sat Sep 20 22:07:08 2025 +0200 platform/x86: x86-android-tablets: Update my email address hdegoede@redhat.com will stop working soon, replace it with my kernel.org address. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-16-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit 2bb596a7d2375d2a2218b0cc5b028f0f86e9fed9 Author: Hans de Goede Date: Sat Sep 20 22:07:07 2025 +0200 platform/x86: x86-android-tablets: Simplify node-group [un]registration software_node_register_node_group() / software_node_unregister_node_group() both accept a NULL node-group as argument. So there is no need to check for the node-group being NULL before calling these functions, remove the checks to simplify the code. Note the "if (gpio_button_swnodes)" check for registering is kept because that also guards the creation of a gpio-button platform-device. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250920200713.20193-15-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 936ddb5398909d9e1255627386bc090ec8943558 Author: Hans de Goede Date: Sat Sep 20 22:07:06 2025 +0200 platform/x86: x86-android-tablets: use swnode_group instead of manual registering Replace manually calling software_node_register_node_group() from init() with the new swnode_group registration mechanism. Note this also fixes a missing software_node_unregister_node_group() for lenovo_yt3_swnodes. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-14-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a0133db5cdc02a8b6588558ebd4ca423c2f8c8bc Author: Hans de Goede Date: Sat Sep 20 22:07:05 2025 +0200 platform/x86: x86-android-tablets: replace bat_swnode with swnode_group Now that we are using software-nodes are used in more places it is useful to have a more generic mechanism to have the core code register software-nodes. Replace the bat_swnode registration mechanism with a more generic swnode_group registration mechanism. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-13-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6564e5d2ea06b262d3e87785693fd3e8903bef03 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:04 2025 +0200 platform/x86: x86-android-tablets: convert gpio_keys devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for gpio_keys devices to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-12-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit 74ff0b6f3ac245287dbff0bab9ff55db4323acc5 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:03 2025 +0200 platform/x86: x86-android-tablets: remove support for GPIO lookup tables Now that everything that used the lookup tables has been switched to using property entries to describe GPIOs, we can remove support for registering and unregistering the lookup tables. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-11-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 27d3e7351eea6fe2e967ea6028143e04f5914f0d Author: Dmitry Torokhov Date: Sat Sep 20 22:07:02 2025 +0200 platform/x86: x86-android-tablets: convert Yoga Tab2 fast charger to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for the fast charger device to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-10-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0a2f13e2747b14ee4c30d9c479dbe0a5a1d11c89 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:01 2025 +0200 platform/x86: x86-android-tablets: convert HID-I2C devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for HID-I2C touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-9-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0536b0372927e2ab4073ee84c9d0bd9c2105c7b2 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:00 2025 +0200 platform/x86: x86-android-tablets: convert wm1502 devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for wm1502 devices to using PROPERTY_ENTRY_GPIO(). Adding a swnode to the yt3 spi device changes the name of the SPI/codec device and the sound/soc/intel/boards/bytcr_wm5102.c machine driver looks up the code by name, update the machine driver to use the new name. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-8-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit ef64ca079345046c306153cacb63a58354819eb0 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:59 2025 +0200 platform/x86: x86-android-tablets: convert int3496 devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for int3496 devices to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-7-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e4a7488717688a9821c44f3b6023c94b95f6979a Author: Dmitry Torokhov Date: Sat Sep 20 22:06:58 2025 +0200 platform/x86: x86-android-tablets: convert EDT devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for EDT touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-6-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f6fd6e7bdbb89cfcbc6c889d9571d8efa7373ac7 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:57 2025 +0200 platform/x86: x86-android-tablets: convert Novatek devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Novatek touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-5-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 40949a3f0ed50bd50aa83629de73b88d13956ce7 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:56 2025 +0200 platform/x86: x86-android-tablets: convert HiDeep devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for HiDeep touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-4-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c5f7d46d52e24e500cfb036f0cfc2e1e596bdf8d Author: Dmitry Torokhov Date: Sat Sep 20 22:06:55 2025 +0200 platform/x86: x86-android-tablets: convert Wacom devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Wacom touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-3-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b40088bfdb8bcac165f55bb16b2ea24caa351234 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:54 2025 +0200 platform/x86: x86-android-tablets: convert Goodix devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Goodix touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Since the tablets are using either Baytrail or Cherryview GPIO controllers x86_dev_info structure has been extended to carry gpiochip type information so that the code can instantiate correct set of software nodes representing the GPIO chip. Because this adds a new point of failure in x86_android_tablet_probe(), x86_android_tablet_remove() is rearranged to handle cases where battery swnode has not been registered yet, and registering of GPIO lookup tables is moved earlier as it can not fail. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-2-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit e3b1320be6fed2ceabce08ba8cea0b3067ef40a9 Author: Xi Pardee Date: Tue Sep 16 12:13:32 2025 -0700 platform/x86:intel/pmc: Replace dev_warn() with dev_dbg() Replace dev_warn() with dev_dbg() to reduce unnecessary warning messages. When the low power mode priority register contains invalid data, the Intel PMC Core driver can still utilize the default priority list. This scenario is more suited for debug information rather than warning. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20250916191339.1748512-1-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a90a8ea288ef823621ccb9f786bd9d9ac1913ad9 Author: Sebastian Reichel Date: Thu Sep 18 23:20:28 2025 +0200 arm64: dts: qcom: x1e80100-t14s: add EC Describe ThinkPad Embedded Controller in the T14s device tree, which adds LED and special key support. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-3-ac0bc6382c5c@collabora.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 60b7ab6ce030939d86c26f591967fbe7938b05da Author: Sebastian Reichel Date: Thu Sep 18 23:20:27 2025 +0200 platform: arm64: thinkpad-t14s-ec: new driver Introduce EC driver for the ThinkPad T14s Gen6 Snapdragon, which is in theory compatible with ThinkPad ACPI. On Linux the system is booted with device tree, which is not supported by the ThinkPad ACPI driver (drivers/platform/x86/lenovo/thinkpad_acpi.c). Also most of the hardware compatibility is handled via ACPI tables, which are obviously not used when booting via device tree. Thus adding DT compatibility to the existing driver is not worth it as there is almost no code sharing. The driver currently exposes features, which are not available via other means: * Extra Keys * System LEDs * Keyboard Backlight Control The driver has been developed by reading the ACPI DSDT. There are some more features around thermal control, which are not yet supported by the driver. The speaker mute and mic mute LEDs need some additional changes in the ALSA UCM to be set automatically. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Reviewed-by: Bryan O'Donoghue Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-2-ac0bc6382c5c@collabora.com [ij: folded in patch from Chen Ni ] Link: https://patch.msgid.link/20250926091302.817919-1-nichen@iscas.ac.cn [ij: folded in patch from Lukas Bulwahn ] Link: https://patch.msgid.link/20250926071859.138396-1-lukas.bulwahn@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d517aa09bbc4203f10cdee7e1d42f3bbdc1b1cd Author: Vlastimil Babka Date: Wed Sep 3 14:59:45 2025 +0200 slab: add opt-in caching layer of percpu sheaves Specifying a non-zero value for a new struct kmem_cache_args field sheaf_capacity will setup a caching layer of percpu arrays called sheaves of given capacity for the created cache. Allocations from the cache will allocate via the percpu sheaves (main or spare) as long as they have no NUMA node preference. Frees will also put the object back into one of the sheaves. When both percpu sheaves are found empty during an allocation, an empty sheaf may be replaced with a full one from the per-node barn. If none are available and the allocation is allowed to block, an empty sheaf is refilled from slab(s) by an internal bulk alloc operation. When both percpu sheaves are full during freeing, the barn can replace a full one with an empty one, unless over a full sheaves limit. In that case a sheaf is flushed to slab(s) by an internal bulk free operation. Flushing sheaves and barns is also wired to the existing cpu flushing and cache shrinking operations. The sheaves do not distinguish NUMA locality of the cached objects. If an allocation is requested with kmem_cache_alloc_node() (or a mempolicy with strict_numa mode enabled) with a specific node (not NUMA_NO_NODE), the sheaves are bypassed. The bulk operations exposed to slab users also try to utilize the sheaves as long as the necessary (full or empty) sheaves are available on the cpu or in the barn. Once depleted, they will fallback to bulk alloc/free to slabs directly to avoid double copying. The sheaf_capacity value is exported in sysfs for observability. Sysfs CONFIG_SLUB_STATS counters alloc_cpu_sheaf and free_cpu_sheaf count objects allocated or freed using the sheaves (and thus not counting towards the other alloc/free path counters). Counters sheaf_refill and sheaf_flush count objects filled or flushed from or to slab pages, and can be used to assess how effective the caching is. The refill and flush operations will also count towards the usual alloc_fastpath/slowpath, free_fastpath/slowpath and other counters for the backing slabs. For barn operations, barn_get and barn_put count how many full sheaves were get from or put to the barn, the _fail variants count how many such requests could not be satisfied mainly because the barn was either empty or full. While the barn also holds empty sheaves to make some operations easier, these are not as critical to mandate own counters. Finally, there are sheaf_alloc/sheaf_free counters. Access to the percpu sheaves is protected by local_trylock() when potential callers include irq context, and local_lock() otherwise (such as when we already know the gfp flags allow blocking). The trylock failures should be rare and we can easily fallback. Each per-NUMA-node barn has a spin_lock. When slub_debug is enabled for a cache with sheaf_capacity also specified, the latter is ignored so that allocations and frees reach the slow path where debugging hooks are processed. Similarly, we ignore it with CONFIG_SLUB_TINY which prefers low memory usage to performance. [boot failure: https://lore.kernel.org/all/583eacf5-c971-451a-9f76-fed0e341b815@linux.ibm.com/ ] Reported-and-tested-by: Venkat Rao Bagalkote Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9d4e6ab865c48c70e684b176d3ee1574d092626f Author: Vlastimil Babka Date: Wed Sep 3 14:59:44 2025 +0200 slab: simplify init_kmem_cache_nodes() error handling We don't need to call free_kmem_cache_nodes() immediately when failing to allocate a kmem_cache_node, because when we return 0, do_kmem_cache_create() calls __kmem_cache_release() which also performs free_kmem_cache_nodes(). Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit bc061143637532c08d9fc657eec93fdc2588068e Author: Conor Dooley Date: Thu Sep 25 16:39:18 2025 +0100 gpio: mpfs: fix setting gpio direction to output mpfs_gpio_direction_output() actually sets the line to input mode. Use the correct register settings for output mode so that this function actually works as intended. This was a copy-paste mistake made when converting to regmap during the driver submission process. It went unnoticed because my test for output mode is toggling LEDs on an Icicle kit which functions with the incorrect code. The internal reporter has yet to test the patch, but on their system the incorrect setting may be the reason for failures to drive the GPIO lines on the BeagleV-fire board. CC: stable@vger.kernel.org Fixes: a987b78f3615e ("gpio: mpfs: add polarfire soc gpio support") Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20250925-boogieman-carrot-82989ff75d10@spud Signed-off-by: Bartosz Golaszewski commit 212b0f07cf021575ec25e0b2336df77c7a4d2e68 Author: Alexei Starovoitov Date: Wed Sep 3 14:59:43 2025 +0200 locking/local_lock: Expose dep_map in local_trylock_t. lockdep_is_held() macro assumes that "struct lockdep_map dep_map;" is a top level field of any lock that participates in LOCKDEP. Make it so for local_trylock_t. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Alexei Starovoitov Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 69ed025aeb4c8faa3019e5997b850a554b47498c Merge: c2fcb2e79d6f41 71965cae7db394 Author: Borislav Petkov (AMD) Date: Fri Sep 26 11:44:35 2025 +0200 Merge branches 'edac-drivers' and 'edac-misc' into edac-updates * edac-drivers: EDAC/versalnet: Return the correct error in mc_probe() EDAC/mc_sysfs: Increase legacy channel support to 16 EDAC/amd64: Add support for AMD family 1Ah-based newer models EDAC: Add a driver for the AMD Versal NET DDR controller dt-bindings: memory-controllers: Add support for Versal NET EDAC RAS: Export log_non_standard_event() to drivers cdx: Export Symbols for MCDI RPC and Initialization cdx: Split mcdi.h and reorganize headers EDAC/skx_common: Use topology_physical_package_id() instead of open coding EDAC/altera: Use dev_fwnode() EDAC/skx_common: Remove unused *NUM*_IMC macros EDAC/i10nm: Reallocate skx_dev list if preconfigured cnt != runtime cnt EDAC/skx_common: Remove redundant upper bound check for res->imc EDAC/skx_common: Make skx_dev->imc[] a flexible array EDAC/skx_common: Swap memory controller index mapping EDAC/skx_common: Move mc_mapping to be a field inside struct skx_imc EDAC/{skx_common,skx}: Use configuration data, not global macros EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller EDAC/ie31200: Add two more Intel Alder Lake-S SoCs for EDAC support dt-bindings: arm: cpus: Add edac-enabled property EDAC: Add EDAC driver for ARM Cortex A72 cores * edac-misc: EDAC: Fix wrong executable file modes for C source files MAINTAINERS: EDAC: Drop inactive reviewers Signed-off-by: Borislav Petkov (AMD) commit 28986dd7e38fb5ba2f180f9eb3ff330798719369 Author: Kanchan Joshi Date: Mon Sep 22 17:00:46 2025 +0530 fcntl: trim arguments Remove superfluous argument from fcntl_{get/set}_rw_hint. No functional change. Signed-off-by: Kanchan Joshi Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 Author: Christian Brauner Date: Fri Sep 19 17:33:47 2025 +0200 listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked. Fixes: b4c2bea8ceaa ("add listmount(2) syscall") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Christian Brauner commit e8c84e2082e69335f66c8ade4895e80ec270d7c4 Author: Christian Brauner Date: Fri Sep 19 17:03:51 2025 +0200 statmount: don't call path_put() under namespace semaphore Massage statmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked. Fixes: 46eae99ef733 ("add statmount(2) syscall") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Christian Brauner commit 5f4b8c03f41782f37d278946296d9443a7194153 Merge: 07e27ad16399af a2d2e6ea1865d3 e520b2520c81c5 4f901b3dce57d2 57f55048e564de 9be15fbfc6c5c8 Author: Joerg Roedel Date: Fri Sep 26 10:03:33 2025 +0200 Merge branches 'apple/dart', 'ti/omap', 'riscv', 'intel/vt-d' and 'amd/amd-vi' into next commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e Author: Lu Baolu Date: Fri Sep 26 10:41:30 2025 +0800 iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must be coherent between the IOMMU and the CPU. In another word, if the iommu page walk is incoherent, dirty page tracking doesn't work. The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: "Remapping hardware encountering the need to atomically update A/EA/D bits in a paging-structure entry that is not snooped will result in a non- recoverable fault." To prevent an IOMMU from being incorrectly configured for dirty page tracking when it is operating in an incoherent mode, mark SSADS as supported only when both ecap_slads and ecap_smpwc are supported. Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit c149841b069ccc6e480b00e11f35a57b5d88c7bb Author: Kunihiko Hayashi Date: Thu Jul 24 13:22:11 2025 +0900 i2c: designware: Add disabling clocks when probe fails After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is called. However, this function doesn't disable clocks and the clock-enable count keeps increasing. Should disable these clocks explicitly. Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") Co-developed-by: Kohei Ito Signed-off-by: Kohei Ito Signed-off-by: Kunihiko Hayashi Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f Author: Kunihiko Hayashi Date: Thu Jul 24 13:22:10 2025 +0900 i2c: designware: Fix clock issue when PM is disabled When the driver is removed, the clocks are first enabled by calling pm_runtime_get_sync(), and then disabled with pm_runtime_put_sync(). If CONFIG_PM=y, clocks for this controller are disabled when it's in the idle state. So the clocks are properly disabled when the driver exits. Othewise, the clocks are always enabled and the PM functions have no effect. Therefore, the driver exits without disabling the clocks. # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 18 # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 20 # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 20 To ensure that the clocks can be disabled correctly even without CONFIG_PM=y, should add the following fixes: - Replace with pm_runtime_put_noidle(), which only decrements the runtime PM usage count. - Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") Co-developed-by: Kohei Ito Signed-off-by: Kohei Ito Signed-off-by: Kunihiko Hayashi Tested-by: Jarkko Nikula Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit dff4f9ff5d7f289e4545cc936362e01ed3252742 Author: Anderson Nascimento Date: Mon Sep 8 09:49:02 2025 -0300 btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes). However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes). If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned. This results in an 8-byte out-of-bounds write at fid->parent_root_objectid = parent_root_id. A previous attempt to fix this issue was made but was lost. https://lore.kernel.org/all/4CADAEEC020000780001B32C@vpn.id2.novell.com/ Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data. Fixes: be6e8dc0ba84 ("NFS support for btrfs - v3") CC: stable@vger.kernel.org # 3.0+ Signed-off-by: Anderson Nascimento Reviewed-by: David Sterba Signed-off-by: David Sterba commit 22d693e45d4a4513bd99489a4e50b81cc0175b21 Author: Danilo Krummrich Date: Thu Sep 25 20:59:27 2025 +0200 rust: usb: keep usb::Device private for now The USB abstractions target to support USB interface drivers. While internally the abstraction has to deal with the interface's parent USB device, there shouldn't be a need for users to deal with the parent USB device directly. Functions, such as for preparing and sending USB URBs, can be implemented for the usb::Interface structure directly. Whether this internal implementation has to deal with the parent USB device can remain transparent to USB interface drivers. Hence, keep the usb::Device structure private for now, in order to avoid confusion for users and to make it less likely to accidentally expose APIs with unnecessary indirections. Should we start supporting USB device drivers, or need it for any other reason we do not foresee yet, it should be trivial to make it public again. Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250925190400.144699-2-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman commit f12140f21acba1499e55cc0220d7c1fe518de369 Author: Danilo Krummrich Date: Thu Sep 25 20:59:26 2025 +0200 rust: usb: don't retain device context for the interface parent When deriving the parent USB device (struct usb_device) from a USB interface (struct usb_interface), do not retain the device context. For the Bound context, as pointed out by Alan in [1], it is not guaranteed that the parent USB device is always bound when the interface is bound. The bigger problem, however, is that we can't infer the Core context, since eventually it indicates that the device lock is held. However, there is no guarantee that if the device lock of the interface is held, also the device lock of the parent USB device is held. Hence, fix this by not inferring any device context information; while at it, fix up the (affected) safety comments. Link: https://lore.kernel.org/all/0ff2a825-1115-426a-a6f9-df544cd0c5fc@rowland.harvard.edu/ [1] Fixes: e7e2296b0ecf ("rust: usb: add basic USB abstractions") Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250925190400.144699-1-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman commit 62bea0e1d5c71a3d9c953d4bbbae79428d0ba05c Merge: a2caae58f8e8f2 6ca282c3e635cd Author: Dave Airlie Date: Fri Sep 26 13:25:42 2025 +1000 Merge tag 'drm-habanalabs-next-2025-09-25' of https://github.com/HabanaAI/drivers.accel.habanalabs.kernel into drm-next This tag contains habanalabs driver changes for v6.18. It continues the previous upstream work from tags/drm-habanalabs-next-2024-06-23, Including improvements in debug and visibility, alongside general code cleanups, and new features such as vmalloc-backed coherent mmap, HLDIO infrastructure, etc. Signed-off-by: Dave Airlie From: "Elbaz, Koby" Link: https://lore.kernel.org/r/da02d370-9967-49d2-9eef-7aeaa40c987c@intel.com commit 66f430522452fe1a8a0fd2198cf9f335125acbfc Author: Len Brown Date: Wed Sep 24 11:50:29 2025 -0400 tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces This tool was originally written when Linux had no standard interface for EPB, or HWP support. Retain the capability to manage a system w/o any kernel PM support, but prefer the standard kernel interfaces, when avaialble. (not doing so led to a confusing conflict between a p-state limit request made via cpufreq and modified by the intel-pstate driver, versus the raw MSR write made by this utility) Signed-off-by: Len Brown commit a648e0892ccd8c2168c2deae7e12e18a8d596730 Author: Len Brown Date: Fri Sep 19 22:30:18 2025 -0400 tools/power x86_energy_perf_policy: Add make snapshot target $ make snapshot creates x86_energy_perf_policy-$(DATE).tar.gz Which can be transported to a target machine without needing a kernel tree to build on the target. Useful for creating debug versions. Signed-off-by: Len Brown commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 Author: Len Brown Date: Fri Sep 19 15:56:46 2025 -0400 tools/power x86_energy_perf_policy: Prefer driver HWP limits When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely. This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request. eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO. Signed-off-by: Len Brown commit f8241f5426eb9feb46a007341edd221ceaf73073 Author: Len Brown Date: Fri Sep 19 15:35:07 2025 -0400 tools/power x86_energy_perf_policy: EPB access is only via sysfs Comprehend that EPB writes are now only via sysfs by moving it out of the _msr specific path. No functional change. Signed-off-by: Len Brown commit 8ef8fa829f8ad313f18d694c15874f85d693215d Author: Len Brown Date: Fri Sep 19 15:05:48 2025 -0400 tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring Rename routines to make "_msr" and "_sysfs" access methods clear No functional change Signed-off-by: Len Brown commit c97c057d357c4b39b153e9e430bbf8976e05bd4e Author: Len Brown Date: Fri Sep 19 14:07:02 2025 -0400 tools/power x86_energy_perf_policy: Enhance HWP enable On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE. Also, skip writing the MSR_PM_ENABLE if HWP is already enabled. Signed-off-by: Len Brown commit b6b42a6051b203bb1d78bf6518007e5dc8b62fc4 Author: Len Brown Date: Fri Sep 19 13:46:55 2025 -0400 tools/power x86_energy_perf_policy: Enhance HWP enabled check Verify that all CPUs have HWP enabled, not just cpu0. Signed-off-by: Len Brown commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c Author: Kaushlendra Kumar Date: Wed Aug 13 12:32:08 2025 +0530 tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage The fopen_or_die() function was previously hardcoded to open files in read-only mode ("r"), ignoring the mode parameter passed to it. This patch corrects fopen_or_die() to use the provided mode argument, allowing for flexible file access as intended. Additionally, the call to fopen_or_die() in err_on_hypervisor() incorrectly used the mode "ro", which is not a valid fopen mode. This is fixed to use the correct "r" mode. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit cafb47be3f38ad81306bf894e743bebc2ccf66ab Author: Kaushlendra Kumar Date: Sat Aug 9 10:35:15 2025 +0530 tools/power turbostat: Fix incorrect sorting of PMT telemetry The pmt_telemdir_sort() comparison function was returning a boolean value (0 or 1) instead of the required negative, zero, or positive value for proper sorting. This caused unpredictable and incorrect ordering of telemetry directories named telem0, telem1, ..., telemN. Update the comparison logic to return -1, 0, or 1 based on the numerical value extracted from the directory name, ensuring correct numerical ordering when using scandir. This change improves stability and correctness when iterating PMT telemetry directories. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit a2caae58f8e8f24f085515d270b5983b83d2c6e3 Merge: 342f141ba9f4c9 0c4932f6ddf815 Author: Dave Airlie Date: Fri Sep 26 13:06:21 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: bridge: - waveshare-dsi: Fix error handling in probe function pixpaper: - select GEM SHMEM helpers Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250925064257.GA9107@linux.fritz.box commit 46c22a8bb4cb03211da1100d7ee4a2005bf77c70 Author: Ojaswin Mujoo Date: Fri Sep 5 13:44:46 2025 +0530 ext4: correctly handle queries for metadata mappings Currently, our handling of metadata is _ambiguous_ in some scenarios, that is, we end up returning unknown if the range only covers the mapping partially. For example, in the following case: $ xfs_io -c fsmap -d 0: 254:16 [0..7]: static fs metadata 8 1: 254:16 [8..15]: special 102:1 8 2: 254:16 [16..5127]: special 102:2 5112 3: 254:16 [5128..5255]: special 102:3 128 4: 254:16 [5256..5383]: special 102:4 128 5: 254:16 [5384..70919]: inodes 65536 6: 254:16 [70920..70967]: unknown 48 ... $ xfs_io -c fsmap -d 24 33 0: 254:16 [24..39]: unknown 16 <--- incomplete reporting $ xfs_io -c fsmap -d 24 33 (With patch) 0: 254:16 [16..5127]: special 102:2 5112 This is because earlier in ext4_getfsmap_meta_helper, we end up ignoring any extent that starts before our queried range, but overlaps it. While the man page [1] is a bit ambiguous on this, this fix makes the output make more sense since we are anyways returning an "unknown" extent. This is also consistent to how XFS does it: $ xfs_io -c fsmap -d ... 6: 254:16 [104..127]: free space 24 7: 254:16 [128..191]: inodes 64 ... $ xfs_io -c fsmap -d 137 150 0: 254:16 [128..191]: inodes 64 <-- full extent returned [1] https://man7.org/linux/man-pages/man2/ioctl_getfsmap.2.html Reported-by: Ritesh Harjani (IBM) Cc: stable@kernel.org Signed-off-by: Ojaswin Mujoo Message-ID: <023f37e35ee280cd9baac0296cbadcbe10995cab.1757058211.git.ojaswin@linux.ibm.com> Signed-off-by: Theodore Ts'o commit 21c3896b471aafe906f35e8d5a2dbf713754079e Author: Heinrich Schuchardt Date: Tue Jul 29 15:15:35 2025 +0200 ACPI: support BGRT table on RISC-V The BGRT table is used to display a vendor logo in the boot process. There is no good reason why RISC-V should not support it. Remove the architecture constraint. Signed-off-by: Heinrich Schuchardt Acked-by: Rafael J. Wysocki Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20250729131535.522205-3-heinrich.schuchardt@canonical.com Signed-off-by: Paul Walmsley commit 67b876663ecee3a74be3bb1ad358d309fcaec6b1 Author: Anup Patel Date: Mon Aug 18 09:39:20 2025 +0530 MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers Add Rahul and myself as maintainers for RISC-V RPMI and MPXY drivers. Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-25-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit f30d7ccd13f01aa6224a2de62562f63c7a298a7e Author: Anup Patel Date: Mon Aug 18 09:39:19 2025 +0530 RISC-V: Enable GPIO keyboard and event device in RV64 defconfig The GPIO keyboard and event device can be used to receive graceful shutdown or reboot input keys so let us enable it by default for RV64 (just like ARM64). Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-24-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4752b0cfbc37a4e62e583bd8723b1fc2fe8df319 Author: Sunil V L Date: Mon Aug 18 09:39:18 2025 +0530 irqchip/riscv-rpmi-sysmsi: Add ACPI support Add ACPI support for the RISC-V RPMI system MSI based irqchip driver. Reviewed-by: Thomas Gleixner Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-23-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 7e64042fdbacc04adce0caf4a0718bf2c4b2045f Author: Sunil V L Date: Mon Aug 18 09:39:17 2025 +0530 mailbox/riscv-sbi-mpxy: Add ACPI support Add ACPI support for the RISC-V SBI message proxy (MPXY) based mailbox driver. Acked-by: Jassi Brar Signed-off-by: Sunil V L Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-22-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 3f5d7a5c05b4d5ac011223359f15fb140125894b Author: Sunil V L Date: Mon Aug 18 09:39:16 2025 +0530 irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode() ACPI based loadable drivers which need MSIs will also need imsic_acpi_get_fwnode() to update the device MSI domain so export this function. Reviewed-by: Thomas Gleixner Signed-off-by: Sunil V L Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-21-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit bb96fb5a799a128bb478e1ea3dab25a484aadf63 Author: Sunil V L Date: Mon Aug 18 09:39:15 2025 +0530 ACPI: RISC-V: Add RPMI System MSI to GSI mapping The RPMI System MSI device will provide GSIs to downstream devices (such as GED) so add it to the RISC-V GSI to fwnode mapping. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-20-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4d185fdeef67d0c2c5d4a142392cf1ade3786dd2 Author: Sunil V L Date: Mon Aug 18 09:39:14 2025 +0530 ACPI: RISC-V: Add support to update gsi range Some RISC-V interrupt controllers like RPMI based system MSI interrupt controllers do not have MADT entry defined. These interrupt controllers exist only in the namespace. ACPI spec defines _GSB method to get the GSI base of the interrupt controller, However, there is no such standard method to get the GSI range. To support such interrupt controllers, set the GSI range of such interrupt controllers to non-overlapping range and provide API for interrupt controller driver to update it with proper value. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-19-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 694b2ef1e73c5eea6d7bd112894f465a9c4e42d5 Author: Sunil V L Date: Mon Aug 18 09:39:13 2025 +0530 ACPI: RISC-V: Create interrupt controller list in sorted order Currently, the interrupt controller list is created without any order. Create the list sorted with the GSI base of the interrupt controllers. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-18-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4215d1cf59e4b272755f4277a05cd5967935a704 Author: Sunil V L Date: Mon Aug 18 09:39:12 2025 +0530 ACPI: scan: Update honor list for RPMI System MSI The RPMI System MSI interrupt controller (just like PLIC and APLIC) needs to probed prior to devices like GED which use interrupts provided by it. Also, it has dependency on the SBI MPXY mailbox device. Add HIDs of RPMI System MSI and SBI MPXY mailbox devices to the honor list so that those dependencies are handled. Reviewed-by: Atish Patra Reviewed-by: Andy Shevchenko Acked-by: Rafael J. Wysocki Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-17-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 159c86f306ea20c019b36fc998e2677008183c04 Author: Sunil V L Date: Mon Aug 18 09:39:11 2025 +0530 ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() Currently, ACPI does not support the use of a nargs_prop (e.g., associated with a reference in fwnode_property_get_reference_args(). Instead, ACPI expects the number of arguments (nargs) to be explicitly passed or known. This behavior diverges from Open Firmware (OF), which allows the use of a #*-cells property in the referenced node to determine the number of arguments. Since fwnode_property_get_reference_args() is a common interface used across both OF and ACPI firmware paradigms, it is desirable to have a unified calling convention that works seamlessly for both. Add the support for ACPI to parse a nargs_prop from the referenced fwnode, aligning its behavior with the OF backend. This allows drivers and subsystems using fwnode_property_get_reference_args() to work in a firmware-agnostic way without having to hardcode or special-case argument counts for ACPI. Acked-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-16-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 76bb6969a8cfc5e00ca142fdad86ffd0a6ed9ecd Author: Frank Li Date: Thu Sep 25 15:22:19 2025 -0400 dt-bindings: hwmon: (lm75) allow interrupt for ti,tmp75 Allow interrupt for ti,tmp75 because chip has open drain ALERT signal. Signed-off-by: Frank Li Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250925192219.303825-1-Frank.Li@nxp.com Signed-off-by: Guenter Roeck commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e Author: Primoz Fiser Date: Thu Sep 25 10:59:29 2025 +0200 ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 The problem of having class-D initialization sequence in probe using regmap_register_patch() is that it will do hardware register writes immediately after being called as it bypasses regcache. Afterwards, in aic3x_init() we also perform codec soft reset, rendering class-D init sequence pointless. This issue is even more apparent when using reset GPIO line, since in that case class-D amplifier initialization fails with "Failed to init class D: -5" message as codec is already held in reset state after requesting the reset GPIO and hence hardware I/O fails with -EIO errno. Thus move class-D amplifier initialization sequence from probe function to aic3x_set_power() just before the usual regcache sync. Use bypassed regmap_multi_reg_write_bypassed() function to make sure, class-D init sequence is performed in proper order as described in the datasheet. Signed-off-by: Primoz Fiser Link: https://patch.msgid.link/20250925085929.2581749-1-primoz.fiser@norik.com Signed-off-by: Mark Brown commit ba0c67d3c4b0ce5ec5e6de35e6433b22eecb1f6a Author: Dmitry Baryshkov Date: Wed Sep 24 22:34:02 2025 +0300 ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 All firmware for the Lemans platform aka QCS9100 aka QCS9075 is for historical reasons located in the qcom/sa8775p/ subdir inside linux-firmware. The only exceptions to this rule are audio topology files. While it's not too late, change the subdir to point to the sa8775p/ subdir, so that all firmware for that platform is present at the same location. Fixes: 5b5bf5922f4c ("ASoC: qcom: sc8280xp: Add sound card support for QCS9100 and QCS9075") Signed-off-by: Dmitry Baryshkov Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250924-lemans-evk-topo-v2-1-7d44909a5758@oss.qualcomm.com Signed-off-by: Mark Brown commit b6b5bbad571f1204622881b30e6ca3e6d7324102 Merge: 27fa1a8b2803df e26387e950ee44 Author: Mark Brown Date: Fri Sep 26 01:21:48 2025 +0100 ASoC: renesas: msiof: tidyup to remove each errors Merge series from Kuninori Morimoto : Current Renesas MSIOF driver might get some errors. This patch-set try to reduce/remove them. commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 Author: Olivier Moysan Date: Tue Sep 16 14:31:18 2025 +0200 ASoC: stm32: sai: manage context in set_sysclk callback The mclk direction now needs to be specified in endpoint node with "system-clock-direction-out" property. However some calls to the set_sysclk callback, related to CPU DAI clock, result in unbalanced calls to clock API. The set_sysclk callback in STM32 SAI driver is intended only for mclk management. So it is relevant to ensure that calls to set_sysclk are related to mclk only. Since the master clock is handled only at runtime, skip the calls to set_sysclk in the initialization phase. Signed-off-by: Olivier Moysan Link: https://patch.msgid.link/20250916123118.84175-1-olivier.moysan@foss.st.com Signed-off-by: Mark Brown commit d43029ff7d1b7183dc0cf11b6cc2c12a0b810ad8 Author: Tao Chen Date: Fri Sep 26 01:50:30 2025 +0800 selftests/bpf: Add stacktrace map lookup_and_delete_elem test case Add tests for stacktrace map lookup and delete: 1. use bpf_map_lookup_and_delete_elem to lookup and delete the target stack_id, 2. lookup the deleted stack_id again to double check. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-3-chen.dylane@linux.dev commit 363b17e273f0929ba7791231a0bbb5424204d93a Author: Tao Chen Date: Fri Sep 26 01:50:29 2025 +0800 selftests/bpf: Refactor stacktrace_map case with skeleton The loading method of the stacktrace_map test case looks too outdated, refactor it with skeleton, and we can use global variable feature in the next patch. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-2-chen.dylane@linux.dev commit 17f0d1f6321caa95699b8f96baf12e654d7b8d60 Author: Tao Chen Date: Fri Sep 26 01:50:28 2025 +0800 bpf: Add lookup_and_delete_elem for BPF_MAP_STACK_TRACE The stacktrace map can be easily full, which will lead to failure in obtaining the stack. In addition to increasing the size of the map, another solution is to delete the stack_id after looking it up from the user, so extend the existing bpf_map_lookup_and_delete_elem() functionality to stacktrace map types. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-1-chen.dylane@linux.dev commit 5ed35b4d490d8735021cce9b715b62a418310864 Author: Marek Vasut Date: Tue Sep 9 18:26:25 2025 +0200 PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock The rcar_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls rcar_msi_irq_unmask(). Since the &desc->lock descriptor lock is a raw spinlock, and the rcar_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y. Use scoped_guard() to simplify the locking. Fixes: 83ed8d4fa656 ("PCI: rcar: Convert to MSI domains") Reported-by: Duy Nguyen Reported-by: Thuan Nguyen Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Acked-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250909162707.13927-2-marek.vasut+renesas@mailbox.org commit e1bd928479fb1fa60e9034b0fdb1ab9f3fa92f33 Author: Manivannan Sadhasivam Date: Mon Sep 22 13:40:57 2025 +0530 PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() In tegra_pcie_downstream_dev_to_D0(), PCI devices are transitioned to D0 state. For iterating over the devices, first the downstream bus of the Root Port is searched from the root bus. But the name of the variable that holds the Root Port downstream bus is named as 'root_bus', which is wrong. Rename the variable to 'root_port_bus'. Also, move the comment on 'bringing the devices to D0' to where the state is set exactly. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922081057.15209-1-mani@kernel.org commit 26fda92d3b56bf44a02bcb4001c5a5548e0ae8ee Author: Marek Vasut Date: Mon Sep 22 17:07:48 2025 +0200 PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock The tegra_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls tegra_msi_irq_unmask(). Since the &desc->lock descriptor lock is a raw spinlock, and the tegra_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y. Use scoped_guard() to simplify the locking. Fixes: 2c99e55f7955 ("PCI: tegra: Convert to MSI domains") Reported-by: Geert Uytterhoeven Closes: https://patchwork.kernel.org/project/linux-pci/patch/20250909162707.13927-2-marek.vasut+renesas@mailbox.org/#26574451 Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922150811.88450-1-marek.vasut+renesas@mailbox.org commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 Author: Mykyta Yatsenko Date: Thu Sep 25 22:52:30 2025 +0100 selftests/bpf: Fix flaky bpf_cookie selftest bpf_cookie can fail on perf_event_open(), when it runs after the task_work selftest. The task_work test causes perf to lower sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq, which is validated against that sysctl. As a result, perf_event_open() rejects the attr if the (now tighter) limit is exceeded. >From perf_event_open(): if (attr.freq) { if (attr.sample_freq > sysctl_perf_event_sample_rate) return -EINVAL; } else { if (attr.sample_period & (1ULL << 63)) return -EINVAL; } Switch bpf_cookie to use sample_period, which is not checked against sysctl_perf_event_sample_rate. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com commit 2bdf1d428f48e1077791bb7f88fd00262118256d Author: Marek Vasut Date: Tue Sep 16 01:58:40 2025 +0200 PCI: rcar-gen4: Fix inverted break condition in PHY initialization R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 Figure 104.3b Initial Setting of PCIEC(example), third quarter of the figure indicates that register 0xf8 should be polled until bit 18 becomes set to 1. Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is set to 1 in less than 1 ms afterward. The current readl_poll_timeout() break condition is inverted and returns when register 0xf8, bit 18 is set to 0, which in most cases means immediately. In case CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and afterward never read register 0xf8, bit 18 as 0, which leads to timeout and failure to start the PCIe controller. Fix this by inverting the poll condition to match the reference manual initialization sequence. Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 Author: Marek Vasut Date: Wed Sep 24 02:55:45 2025 +0200 PCI: rcar-gen4: Assure reset occurs before DBI access Assure the reset is latched and the core is ready for DBI access. On R-Car V4H, the PCIe reset is asynchronous and does not take effect immediately, but needs a short time to complete. In case DBI access happens in that short time, that access generates an SError. Make sure that condition can never happen, read back the state of the reset, which should turn the asynchronous reset into a synchronous one, and wait a little over 1ms to add additional safety margin. Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org commit 8795b70581770657cd5ead3c965348f05242580f Author: Marek Vasut Date: Fri Sep 19 15:45:58 2025 +0200 PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC domain, after reset has been asserted by writing a matching reset bit into register SRCR, it is mandatory to wait 1ms. Because it is the controller driver which can determine whether or not the controller is in HSC domain based on its compatible string, add the missing delay in the controller driver. This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear whether S4 is affected as well. This patch does apply the extra delay on R-Car S4 as well. Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") Suggested-by: Geert Uytterhoeven Signed-off-by: Marek Vasut [mani: added the missing r-b tag from Krzysztof] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Wilczyński Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org commit 1193c46c1745cf809dead55ece4f3baa728f316c Author: Amery Hung Date: Thu Sep 25 10:00:13 2025 -0700 selftests/bpf: Test changing packet data from global functions with a kfunc The verifier should invalidate all packet pointers after a packet data changing kfunc is called. So, similar to commit 3f23ee5590d9 ("selftests/bpf: test for changing packet data from global functions"), test changing packet data from global functions to make sure packet pointers are indeed invalidated. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925170013.1752561-2-ameryhung@gmail.com commit 12aad2960e9d6a32d7371e43cabcb02531ae3704 Author: Xichao Zhao Date: Wed Aug 27 17:43:44 2025 +0800 i2c: busses: Fix some spelling errors Fix spelling errors in some comments. Signed-off-by: Xichao Zhao Signed-off-by: Wolfram Sang commit 59ccb8176bd7e826d47962e891b460284f6978f0 Author: I Viswanath Date: Mon Aug 25 08:44:30 2025 +0530 i2c: mux: Simplify boolean assignment in i2c_mux_alloc Refactor boolean field assignments of the form `if (a) b = true` to `b = !!(a)` in i2c_mux_alloc. Signed-off-by: I Viswanath Signed-off-by: Wolfram Sang commit 2b7a2003ba01cde9a4958a50c55207f820766816 Author: Benoît Monin Date: Thu Sep 4 16:31:07 2025 +0200 i2c: designware: use dev_err_probe() when probing platform device Add calls to dev_err_probe() on error paths that can return -EPROBE_DEFER when probing platform device. Namely when requesting the reset controller, when probing for lock support and when requesting the clocks. PCI device probing already use dev_err_probe(). Signed-off-by: Benoît Monin Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 437e6c3e3175e40c07987be87eea1cf9d7b8f30f Author: Benoît Monin Date: Thu Sep 4 16:31:06 2025 +0200 i2c: designware: convert to dev_err_probe() on request IRQ error Simplify the error handling of devm_request_irq() in i2c_dw_probe_master() and i2c_dw_probe_slave() by converting to: return dev_err_probe(); instead of calling: dev_err(); return ret; This also handle deferred probe error without spamming the log. Signed-off-by: Benoît Monin Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 0de61943244dec418d396633a587adca1c350b55 Author: Troy Mitchell Date: Thu Sep 25 10:02:29 2025 +0800 i2c: spacemit: ensure SDA is released after bus reset After performing a conditional bus reset, the controller must ensure that the SDA line is actually released. Previously, the reset routine only performed a single check, which could leave the bus in a locked state in some situations. This patch introduces a loop that toggles the reset cycle and issues a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking SDA after each attempt. If SDA is released before the maximum count, the function returns early. Otherwise, a warning is emitted. This change improves bus recovery reliability. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Troy Mitchell Reviewed-by: Aurelien Jarno Signed-off-by: Wolfram Sang commit db7720ef50e0103be70a3887bc66e9c909933ad9 Author: Troy Mitchell Date: Thu Sep 25 10:02:28 2025 +0800 i2c: spacemit: check SDA instead of SCL after bus reset After calling spacemit_i2c_conditionally_reset_bus(), the controller should ensure that the SDA line is release before proceeding. Previously, the driver checked the SCL line instead, which does not guarantee that the bus is truly idle. This patch changes the check to verify SDA. This ensures proper bus recovery and avoids potential communication errors after a conditional reset. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d Author: Troy Mitchell Date: Thu Sep 25 10:02:27 2025 +0800 i2c: spacemit: disable SDA glitch fix to avoid restart delay The K1 I2C controller has an SDA glitch fix that introduces a small delay on restart signals. While this feature can suppress glitches on SDA when SCL = 0, it also delays the restart signal, which may cause unexpected behavior in some transfers. The glitch itself does not affect normal I2C operation, because the I2C specification allows SDA to change while SCL is low. To ensure correct transmission for every message, we disable the SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during initialization. This guarantees that restarts are issued promptly without unintended delays. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit bc8712f2b5250825968e6b0c3d2709a4b9d5d570 Author: Amery Hung Date: Thu Sep 25 10:00:12 2025 -0700 bpf: Emit struct bpf_xdp_sock type in vmlinux BTF Similar to other BPF UAPI struct, force emit BTF of struct bpf_xdp_sock so that it is defined in vmlinux.h. In a later patch, a selftest will use vmlinux.h to get the definition of struct bpf_xdp_sock instead of bpf.h. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925170013.1752561-1-ameryhung@gmail.com commit e121be784d35e2950652b46258a87381e00270ab Author: Sunil V L Date: Mon Aug 18 09:39:10 2025 +0530 ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop Currently, acpi_fwnode_get_reference_args() delegates to the internal function __acpi_node_get_property_reference() to retrieve property references. However, this function does not handle the nargs_prop (cells property) parameter, and instead expects the number of arguments (nargs) to be known or hardcoded. As a result, when fwnode_property_get_reference_args() is used with a valid nargs_prop, the ACPI backend ignores it, whereas the Device Tree (DT) backend uses the #*-cells property from the reference node to determine the number of arguments dynamically. To support the nargs_prop in ACPI, refactor the code as follows: - Move the implementation from __acpi_node_get_property_reference() into acpi_fwnode_get_reference_args(). - Update __acpi_node_get_property_reference() to call the (now updated) acpi_fwnode_get_reference_args() passing NULL as nargs_prop to keep the behavior of __acpi_node_get_property_reference() intact. Acked-by: Rafael J. Wysocki Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-15-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit a43ac325c7cbbfe72bdf9178059b3ee9f5a2c7dd Author: Ilpo Järvinen Date: Wed Sep 24 16:42:27 2025 +0300 PCI: Set up bridge resources earlier Bridge windows are read twice from PCI Config Space, the first time from pci_read_bridge_windows(), which does not set up the device's resources. This causes problems down the road as child resources of the bridge cannot check whether they reside within the bridge window or not. Set up the bridge windows already in pci_read_bridge_windows(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250924134228.1663-2-ilpo.jarvinen@linux.intel.com commit 445522fe7aad6131b2747ae8c76f77266054cd84 Author: Troy Mitchell Date: Thu Sep 25 10:02:26 2025 +0800 i2c: spacemit: remove stop function to avoid bus error Previously, STOP handling was split into two separate steps: 1) clear TB/STOP/START/ACK bits 2) issue STOP by calling spacemit_i2c_stop() This left a small window where the control register was updated twice, which can confuse the controller. While this race has not been observed with interrupt-driven transfers, it reliably causes bus errors in PIO mode. Inline the STOP sequence into the IRQ handler and ensure that control register bits are updated atomically in a single writel(). Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Troy Mitchell Reviewed-by: Aurelien Jarno Signed-off-by: Wolfram Sang commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b Author: Troy Mitchell Date: Thu Sep 25 10:02:25 2025 +0800 i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative error code on failure. Since 'ret' can never be positive, the final 'else' branch was unreachable, and spacemit_i2c_check_bus_release() was never called. This commit guarantees we attempt to release the bus whenever waiting for an idle bus fails. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit b492183652808e0f389272bf63dc836241b287ff Author: Leilk.Liu Date: Sat Sep 6 16:24:06 2025 +0800 i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD The old IC does not support the I2C_MASTER_WRRD (write-then-read) function, but the current code’s handling of i2c->auto_restart may potentially lead to entering the I2C_MASTER_WRRD software flow, resulting in unexpected bugs. Instead of repurposing the auto_restart flag, add a separate flag to signal I2C_MASTER_WRRD operations. Also fix handling of msgs. If the operation (i2c->op) is I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. For all other operations, msgs is simply incremented by 1. Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") Signed-off-by: Leilk.Liu Suggested-by: Chen-Yu Tsai Reviewed-by: Chen-Yu Tsai Signed-off-by: Wolfram Sang commit 1a2b423be6a89dd07d5fc27ea042be68697a6a49 Author: Heiner Kallweit Date: Sun Sep 14 22:24:13 2025 +0200 i2c: boardinfo: Annotate code used in init phase only Annotate two places in boardinfo code: - __i2c_first_dynamic_bus_num is set in init phase. Annotate it as __ro_after_init to prevent later changes. - i2c_register_board_info() is used in init phase only, so annotate it as __init, allowing to free the memory after init phase. This is safe, see comment: "done in board-specific init code near arch_initcall() time" Signed-off-by: Heiner Kallweit Signed-off-by: Wolfram Sang commit 749b61c2d6a91c81732860f22925ae9884de95fe Merge: 8f5ae30d69d754 45d78cd0bf2c40 Author: Thomas Gleixner Date: Thu Sep 25 23:14:04 2025 +0200 Merge tag 'timers-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource Pull clocksource/events driver updates from Daniel Lezcano: - Add the module owner to all the drivers which can be converted into modules in order to have the core time framework to take the refcount and prevent wild module removal. In addition export the symbols for the sched_clock_register() function to allow the drivers to be converted into modules (Daniel Lezcano) - Convert the faraday,fttmr010 DT bindings to yaml schema (Rob Herring) - Add the DT bindings compatible string for the MT6572 (Max Shevchenko) - Fix the fsl,ftm-timer bindings by using the items to describe a register (Frank Li) - Add the DT binding documentation for Andes machine timer (Ben Zong-You Xie) - Avoid 64-bit divide operation which fails on xtensa and simplify the timeleft computation with 32 bits operations on Tegra186 (Guenter Roeck) - Add the fsl,timrot.yaml DT bindings for i.MX23/i.MX28 timer (Frank Li) - Replace comma by semicolon which were introduced when moving the static structure initialization (Chen Ni) - Add a new compatible for the MediaTek MT8196 SoC, fully compatible with MT6765 (AngeloGioacchino Del Regno) - Add the support for the s32g2 and s32g3 platforms in the PIT timer after cleaning up the code to support multiple instances (Daniel Lezcano) - Generate platform devices for MMIO timers with ACPI and integrate it with the arch ARM timer (Marc Zyngier) - Fix RTL OTTO timer by working around dying timers (Markus Stockhausen) - Remove extra error message in the tegra186 timer (Wolfram Sang) - Convert from round_rate() to determine_rate() in the Ingenic sysost driver (Brian Masney) - Add PWM capture functionality in the OMAP DM driver (Gokul Praveen) - Autodetect the clock rate to initialize a prescaler value compatible with the frequency changes on the ARM global timer (Markus Schneider-Pargmann) - Fix rollbacks missing resource deallocation in case of error on the clps711x (Zhen Ni) - Reorganize the code to split the start and the stop routine on the sh_cmt driver (Niklas Söderlund) - Add the compatible definition for ARTPEC-9 on exynos MCT (SungMin Park) commit 54d6a978bb2bb78a781bc849608c5b4f0748985b Merge: 958e55f90a0145 d32bb69523b86c Author: Wolfram Sang Date: Thu Sep 25 22:42:24 2025 +0200 Merge branch 'i2c/immutable/scoped_fwnode_child' into i2c/for-mergewindow commit aa43953e862c031ff66e44353c88beb7a449e80d Author: Anup Patel Date: Mon Aug 18 09:39:09 2025 +0530 irqchip: Add driver for the RPMI system MSI service group The RPMI specification defines a system MSI service group which allows application processors to receive MSIs upon system events such as graceful shutdown/reboot request, CPU hotplug event, memory hotplug event, etc. Add an irqchip driver for the RISC-V RPMI system MSI service group to directly receive system MSIs in Linux kernel. Reviewed-by: Thomas Gleixner Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-14-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 3e6cf38486005831e063fd0d943a46bc8434e732 Author: Anup Patel Date: Mon Aug 18 09:39:08 2025 +0530 dt-bindings: Add RPMI system MSI interrupt controller bindings Add device tree bindings for the RPMI system MSI service group based interrupt controller for the supervisor software. The RPMI system MSI service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Atish Patra Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-13-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit a72ab2514b7c8e8203c551310166f4c72262ff43 Author: Anup Patel Date: Mon Aug 18 09:39:07 2025 +0530 dt-bindings: Add RPMI system MSI message proxy bindings Add device tree bindings for the RPMI system MSI service group based message proxy implemented by the SBI implementation (machine mode firmware or hypervisor). The RPMI system MSI service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Atish Patra Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-12-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 19d3a401a617c68e9487f55b9f2efe213f8f949d Author: John Madieu Date: Wed Sep 17 19:01:56 2025 +0200 thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC The RZ/G3E SoC integrates a Temperature Sensor Unit (TSU) block designed to monitor the chip's junction temperature. This sensor is connected to channel 1 of the APB port clock/reset and provides temperature measurements. It also requires calibration values stored in the system controller registers for accurate temperature measurement. Add a driver for the Renesas RZ/G3E TSU. [ dlezcano: Fixed conflict with "renesas: Add support for RZ/G3S" ] Signed-off-by: John Madieu Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20250917170202.197929-3-john.madieu.xa@bp.renesas.com Signed-off-by: Daniel Lezcano commit caf41eb4575ddac61dd0f6d4a6108bb7ab9fc408 Author: John Madieu Date: Wed Sep 17 19:01:55 2025 +0200 dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit The Renesas RZ/G3E SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The device provides real-time temperature measurements for thermal management, utilizing a single dedicated channel (channel 1) for temperature sensing. Reviewed-by: Rob Herring (Arm) Signed-off-by: John Madieu Link: https://lore.kernel.org/r/20250917170202.197929-2-john.madieu.xa@bp.renesas.com Signed-off-by: Daniel Lezcano commit 3762f5851ac5a65dcccadf73dbe853b1b346f561 Author: Svyatoslav Ryhel Date: Wed Sep 3 19:27:49 2025 +0300 thermal/drivers/thermal-generic-adc: Add temperature sensor channel To avoid duplicating sensor functionality and conversion tables, this design allows converting an ADC IIO channel's output directly into a temperature IIO channel. This is particularly useful for devices where hwmon isn't suitable or where temperature data must be accessible through IIO. One such device is, for example, the MAX17040 fuel gauge. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20250903162749.109910-2-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit e881662aa06af65021c2fa255dd7530235a3d195 Author: Sebastian Reichel Date: Wed Aug 20 19:40:49 2025 +0200 dt-bindings: thermal: rockchip: Tighten grf requirements Instead of having an optional rockchip,grf property, forbid using it on platforms without registers in a GRF being needed for thermal monitoring and make it mandatory on the platforms actually needing it. Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-3-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit c268a9d8c18d594418dcf16762bfe9caf6e1bbb6 Author: Sebastian Reichel Date: Wed Aug 20 19:40:48 2025 +0200 thermal/drivers/rockchip: Shut up GRF warning Most of the recent Rockchip devices do not have a GRF associated with the tsadc IP. Let's avoid printing a warning on those devices. Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Tested-by: Diederik de Haas Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-2-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit 6f769708d53ab029f09f78660680b4ad161092f2 Author: Sebastian Reichel Date: Wed Aug 20 19:40:47 2025 +0200 thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format Unify all chip descriptions to the version without any empty lines. Suggested-by: Heiko Stuebner Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-1-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit dc095b37b09e1abbdb6daf5e69dbd0cd5265087e Author: Claudiu Beznea Date: Sun Aug 10 15:21:23 2025 +0300 thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC The Renesas RZ/G3S SoC features a Thermal Sensor Unit (TSU) that reports the junction temperature. The temperature is reported through a dedicated ADC channel. Add a driver for the Renesas RZ/G3S TSU. Signed-off-by: Claudiu Beznea Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250810122125.792966-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Daniel Lezcano commit a3152e5c742ca2557c5cd0e5a9e6ca6b9a92df93 Author: Claudiu Beznea Date: Sun Aug 10 15:21:22 2025 +0300 dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit The Renesas RZ/G3S SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The temperature is measured using the RZ/G3S ADC, with a dedicated ADC channel directly connected to the TSU. Add documentation for it. Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250810122125.792966-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Daniel Lezcano commit 55173287e7a2dbab8c920f7d5db8ac515ab82b4e Author: Michael Walle Date: Thu Aug 28 14:40:42 2025 +0200 thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon Make the sensors available in the hwmon subsystem (if CONFIG_THERMAL_HWMON is enabled). Signed-off-by: Michael Walle Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20250828124042.1680853-1-mwalle@kernel.org Signed-off-by: Daniel Lezcano commit 117bdda24d68be7a61d460e1ee372458c41e787e Author: Wolfram Sang Date: Thu Sep 11 09:00:13 2025 +0200 thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry S4 was added first so it was assumed to be the blueprint for R-Car Gen4. It turned out now, that S4 is a special mix between Gen3 and Gen4. V4H and V4M are the similar ones as confirmed by HW engineers. So, rename the S4 entry to be specific instead of generic. Rename the V4H entry to be the new generic one, so V4M will use it as well now. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250911070254.2214-2-wsa+renesas@sang-engineering.com Signed-off-by: Daniel Lezcano commit 9d522a877b6f1a8a2675826d14d2edaa9712db9a Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:03 2025 +0300 thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver Add Tegra114 specific SOCTHERM driver. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-6-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit 10e1dcb62a7e874af43e7dfbef13ef8e3a2ad4a9 Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:02 2025 +0300 dt-bindings: thermal: add Tegra114 soctherm header This adds header for the Tegra114 SOCTHERM device tree node. Signed-off-by: Svyatoslav Ryhel Acked-by: Conor Dooley Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-5-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit 48fc33b95159badfca03d0c48aced60bf9f9325a Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:01 2025 +0300 thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support The Tegra114 has a different fuse calibration register layout and address compared to other Tegra SoCs, requiring SOCTHERM shift, mask, register address, and nominal tf calibration value to be configurable. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-4-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit aa0025154855b10b68ada4e60fd99623d51252cc Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:00 2025 +0300 dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System Document SOCTHERM Thermal Management System found in the Tegra 4 SoC. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250828055104.8073-3-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit ec4be3165e4c6af3f03c8a603af5ea118c95dfb4 Author: Marek Vasut Date: Fri Sep 5 21:32:56 2025 +0200 thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry The R-Car Gen3 thermal driver supports both R-Car Gen3 and Gen4 SoCs. Update the Kconfig entry. Signed-off-by: Marek Vasut Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250905193322.148115-1-marek.vasut+renesas@mailbox.org Signed-off-by: Daniel Lezcano commit 13eac80a2db125c56a13938216c23202cf7f59ac Author: Marek Vasut Date: Sun Sep 7 17:41:38 2025 +0200 thermal/drivers/rcar_gen3: Fix comment typo Fix typo to millidegree Celsius. This aligns the comment with another comment later on the same function. No functional change. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250907154148.171496-1-marek.vasut+renesas@mailbox.org Signed-off-by: Daniel Lezcano commit 14b7ea27bd0fcbaf06f3df1544dcbced43e9fb1b Author: Sumeet Pawnikar Date: Thu Jul 10 23:24:25 2025 +0530 drivers/thermal/qcom/lmh: Fix incorrect error message It was showing wrong error message as ARM threshold thremal trip for setting LOW threshold thermal trip. Fix this incorrect error message for setting LOW threshold thermal trip. Reviewed-by: Konrad Dybcio Signed-off-by: Sumeet Pawnikar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250710175426.5789-1-sumeet4linux@gmail.com commit b50b2c53f98fcdb6957e184eb488c16502db9575 Author: Dmitry Baryshkov Date: Mon Jul 28 15:18:24 2025 +0300 thermal/drivers/qcom/lmh: Add missing IRQ includes As reported by LKP, the Qualcomm LMH driver needs to include several IRQ-related headers, which decrlare necessary IRQ functionality. Currently driver builds on ARM64 platforms, where the headers are pulled in implicitly by other headers, but fails to build on other platforms. Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ Signed-off-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com commit 57eda47bd14b0c2876f2db42e757c57b7a671965 Author: Dmitry Baryshkov Date: Mon Jul 28 15:18:23 2025 +0300 thermal/drivers/qcom: Make LMH select QCOM_SCM The QCOM_SCM symbol is not user-visible, so it makes little sense to depend on it. Make LMH driver select QCOM_SCM as all other drivers do and, as the dependecy is now correctly handled, enable || COMPILE_TEST in order to include the driver into broader set of build tests. Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") Signed-off-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com commit 5ea75f3479ee7c97a54c8660ce2cd980c9e9afb6 Author: Jiapeng Chong Date: Fri Aug 1 14:35:40 2025 +0800 thermal/drivers/mediatek/lvts_thermal: Remove unneeded semicolon ./drivers/thermal/mediatek/lvts_thermal.c:642:2-3: Unneeded semicolon. A semicolon is present after the closing bracket of the loop, let's remove it. No functional change intended. [ dlezcano : Reworded the description and reordered the tags order ] Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=23244 Signed-off-by: Jiapeng Chong Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250801063540.2959610-1-jiapeng.chong@linux.alibaba.com commit 48bc3b3317b9e67103b82cebbc1475b57abde38b Author: Marek Vasut Date: Wed Jun 25 20:16:58 2025 +0200 thermal/drivers/rcar_gen3: Add support for R-Car V4H default trim values Add default trimming values for the four temperature sensors located in Renesas R-Car V4H Working Sample SoC. The trimming values are identical for all four THS temperature sensors. Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250625181739.28391-2-marek.vasut+renesas@mailbox.org commit 84fd9e4a6b996ca1ac00eb46fcb4ef3246b6f6a3 Author: Marek Vasut Date: Wed Jun 25 20:16:57 2025 +0200 thermal/drivers/rcar_gen3: Add support for per-SoC default trim values The Working Sample R-Car SoCs may not yet have thermal sensor trimming values programmed into fuses, those fuses are blank instead. For such SoCs, the driver includes fallback trimming values. Those values are currently applied to all SoCs which use this driver. Introduce support for per-SoC fallback trimming values in preparation for SoCs which do not use these current trimming values. No functional change is intended here. Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250625181739.28391-1-marek.vasut+renesas@mailbox.org commit 4ae50c82a5ab9071b928648da8723153004170bb Author: Gaurav Kohli Date: Tue Jun 24 12:19:44 2025 +0530 dt-bindings: thermal: tsens: Add QCS615 compatible Add compatibility string for the thermal sensors on QCS615 platform. Acked-by: Rob Herring (Arm) Signed-off-by: Gaurav Kohli Link: https://lore.kernel.org/r/20250624064945.764245-2-quic_gkohli@quicinc.com Signed-off-by: Daniel Lezcano commit df2ba5709416ac6ce8dab1d141fc246b79549e78 Author: Mario Limonciello Date: Wed Sep 24 11:16:24 2025 -0500 drm/amd: Add name to modes from amdgpu_connector_add_common_modes() [Why] When DC adds common modes it adds modes with a string to match what they are. Non-DC doesn't. This can be inconsistent when turning on/off DC support. [How] Add a name member to common_modes[] and copy it into the drm display mode. Cc: Timur Kristóf Reviewed-by: Alex Deucher Reviewed-by: Timur Kristóf Link: https://lore.kernel.org/r/20250924161624.1975819-6-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 6d622755bc9774a1edcb85325951f4c4a8ba9a55 Author: Mario Limonciello Date: Wed Sep 24 11:16:23 2025 -0500 drm/amd: Drop some common modes from amdgpu_connector_add_common_modes() [Why] DC and non-DC codepaths have different sets of common modes that are added for eDP and LVDS cases. This can cause different behaviors for turning on DC on hardware that can support both. [How] Drop extra modes from amdgpu_connector_add_common_modes() not present in amdgpu_dm_connector_add_common_modes(). Cc: Timur Kristóf Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-5-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit dbf2341569dfbc61ff34c32de988bc058d0644d9 Author: Alex Deucher Date: Fri Nov 15 08:56:33 2024 -0500 drm/amdgpu: update MODULE_PARM_DESC for freesync_video To better describe what it does. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3756 Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 123a1750c5e0dcbfec953647045947be9620a7d8 Author: Mario Limonciello Date: Wed Sep 24 11:16:22 2025 -0500 drm/amd: Use dynamic array size declaration for amdgpu_connector_add_common_modes() [Why] Adding or removing a mode from common_modes[] can be fragile if a user forgot to update the for loop boundaries. [How] Use ARRAY_SIZE() to detect size of the array and use that instead. Cc: Timur Kristóf Reviewed-by: Alex Deucher Reviewed-by: Timur Kristóf Link: https://lore.kernel.org/r/20250924161624.1975819-4-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 1f721ebcf312df88c6da6457e0ff21c33613f73c Author: Timur Kristóf Date: Wed Sep 24 13:38:36 2025 +0200 drm/amd/display: Share dce100_validate_global with DCE6-8 The dce100_validate_global function was verbatim exactly the same as dce60_validate_global and dce80_validate_global. Share dce100_validate_global between DCE6-10 to save code size. Signed-off-by: Timur Kristóf Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit ee352f6c56e1775b192f2d39ad45362148e1fd16 Author: Timur Kristóf Date: Wed Sep 24 13:38:35 2025 +0200 drm/amd/display: Share dce100_validate_bandwidth with DCE6-8 DCE6-8 have very similar capabilities to DCE10, they support the same DP and HDMI versions and work similarly. Share dce100_validate_bandwidth between DCE6-10 to reduce code duplication in the DC driver. Signed-off-by: Timur Kristóf Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit b8ae2640f9acd4f411c9227d2493755d03fe440a Author: Jesse.Zhang Date: Wed Sep 24 16:00:06 2025 +0800 drm/amdgpu: Fix fence signaling race condition in userqueue This commit fixes a potential race condition in the userqueue fence signaling mechanism by replacing dma_fence_is_signaled_locked() with dma_fence_is_signaled(). The issue occurred because: 1. dma_fence_is_signaled_locked() should only be used when holding the fence's individual lock, not just the fence list lock 2. Using the locked variant without the proper fence lock could lead to double-signaling scenarios: - Hardware completion signals the fence - Software path also tries to signal the same fence By using dma_fence_is_signaled() instead, we properly handle the locking hierarchy and avoid the race condition while still maintaining the necessary synchronization through the fence_list_lock. v2: drop the comment (Christian) Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 45da20e00d5da842e17dfc633072b127504f0d0e Author: Yifan Zhang Date: Wed Sep 24 23:19:14 2025 +0800 amd/amdkfd: enhance kfd process check in switch partition current switch partition only check if kfd_processes_table is empty. kfd_prcesses_table entry is deleted in kfd_process_notifier_release, but kfd_process tear down is in kfd_process_wq_release. consider two processes: Process A (workqueue) -> kfd_process_wq_release -> Access kfd_node member Process B switch partition -> amdgpu_xcp_pre_partition_switch -> amdgpu_amdkfd_device_fini_sw -> kfd_node tear down. Process A and B may trigger a race as shown in dmesg log. This patch is to resolve the race by adding an atomic kfd_process counter kfd_processes_count, it increment as create kfd process, decrement as finish kfd_process_wq_release. v2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds and bug fix. (Philip Yang) [3966658.307702] divide error: 0000 [#1] SMP NOPTI [3966658.350818] i10nm_edac [3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted [3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu] [3966658.362839] nfit [3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu] [3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00 [3966658.380967] x86_pkg_temp_thermal [3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246 [3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000 [3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00 [3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4 [3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000 [3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800 [3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000 [3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0 [3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [3966658.391536] PKRU: 55555554 [3966658.391536] Call Trace: [3966658.391674] deallocate_sdma_queue+0x38/0xa0 [amdgpu] [3966658.391762] process_termination_cpsch+0x1ed/0x480 [amdgpu] [3966658.399754] intel_powerclamp [3966658.402831] kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu] [3966658.402908] kfd_process_wq_release+0x1a/0x1a0 [amdgpu] [3966658.410516] coretemp [3966658.434016] process_one_work+0x1ad/0x380 [3966658.434021] worker_thread+0x49/0x310 [3966658.438963] kvm_intel [3966658.446041] ? process_one_work+0x380/0x380 [3966658.446045] kthread+0x118/0x140 [3966658.446047] ? __kthread_bind_mask+0x60/0x60 [3966658.446050] ret_from_fork+0x1f/0x30 [3966658.446053] Modules linked in: kpatch_20765354(OEK) [3966658.455310] kvm [3966658.464534] mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK) [3966658.473462] idxd_mdev [3966658.482306] kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqos_hotfixes(OE) rfkill uio_pci_generic uio cuse fuse nf_tables nfnetlink intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm idxd_mdev [3966658.491237] vfio_pci [3966658.501196] vfio_pci vfio_virqfd mdev vfio_iommu_type1 vfio iax_crypto intel_pmt_telemetry iTCO_wdt intel_pmt_class iTCO_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq [3966658.508537] vfio_virqfd [3966658.517569] snd_seq_device ipmi_ssif isst_if_mbox_pci isst_if_mmio pcspkr snd_pcm idxd intel_uncore ses isst_if_common intel_vsec idxd_bus enclosure snd_timer mei_me snd i2c_i801 i2c_smbus mei i2c_ismt soundcore joydev acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad vfat fat [3966658.526851] mdev [3966658.536096] nfsd auth_rpcgss nfs_acl lockd grace slb_vtoa(OE) sunrpc dm_mod hookers mlx5_ib(OE) ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helper ttm mlx5_core(OE) mlxfw(OE) [3966658.540381] vfio_iommu_type1 [3966658.544341] nvme mpt3sas tls drm nvme_core pci_hyperv_intf raid_class psample libcrc32c crc32c_intel mlxdevm(OE) i2c_core [3966658.551254] vfio [3966658.558742] scsi_transport_sas wmi pinctrl_emmitsburg sd_mod t10_pi sg ahci libahci libata rdma_ucm(OE) ib_uverbs(OE) rdma_cm(OE) iw_cm(OE) ib_cm(OE) ib_umad(OE) ib_core(OE) ib_ucm(OE) mlx_compat(OE) [3966658.563004] iax_crypto [3966658.570988] [last unloaded: diagnose] [3966658.571027] ---[ end trace cc9dbb180f9ae537 ]--- Signed-off-by: Yifan Zhang Reviewed-by: Philip.Yang Signed-off-by: Alex Deucher commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 Author: Yifan Zhang Date: Tue Sep 16 21:21:15 2025 +0800 amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw There is race in amdgpu_amdkfd_device_fini_sw and interrupt. if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and kfree(kfd), and KGD interrupt generated. kernel panic log: BUG: kernel NULL pointer dereference, address: 0000000000000098 amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP PGD d78c68067 P4D d78c68067 kfd kfd: amdgpu: Allocated 3969056 bytes on gart PUD 1465b8067 PMD @ Oops: @002 [#1] SMP NOPTI kfd kfd: amdgpu: Total number of KFD nodes to be created: 4 CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40 Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 OF b1 17 75 Ba 4c 89 e@ 41 Sc 89 c6 e8 07 38 5d RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018 0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098 ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020 0000000000000000 R11: 0000000000000000 R12: 0900000000000002 ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00 CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033 CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400 PKRU: 55555554 Call Trace: kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu] ? amdgpu_fence_process+0xa4/0x150 [amdgpu] kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace amdgpu_irq_dispatch+0x165/0x210 [amdgpu] amdgpu_ih_process+0x80/0x100 [amdgpu] amdgpu: Virtual CRAT table created for GPU amdgpu_irq_handler+0x1f/@x60 [amdgpu] __handle_irq_event_percpu+0x3d/0x170 amdgpu: Topology: Add dGPU node [0x74a2:0x1002] handle_irq_event+0x5a/@xcO handle_edge_irq+0x93/0x240 kfd kfd: amdgpu: KFD node 1 partition @ size 49148M asm_call_irq_on_stack+0xf/@x20 common_interrupt+0xb3/0x130 asm_common_interrupt+0x1le/0x40 5.10.134-010.a1i5000.a18.x86_64 #1 Signed-off-by: Yifan Zhang Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 118800b0797a046adaa2a8e9dee9b971b78802a7 Author: Timur Kristóf Date: Wed Sep 24 13:38:34 2025 +0200 drm/amd/display: Reject modes with too high pixel clock on DCE6-10 Reject modes with a pixel clock higher than the maximum display clock. Use 400 MHz as a fallback value when the maximum display clock is not known. Pixel clocks that are higher than the display clock just won't work and are not supported. With the addition of the YUV422 fallback, DC can now accidentally select a mode requiring higher pixel clock than actually supported when the DP version supports the required bandwidth but the clock is otherwise too high for the display engine. DCE 6-10 don't support these modes but they don't have a bandwidth calculation to reject them properly. Fixes: db291ed1732e ("drm/amd/display: Add fallback path for YCBCR422") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 210844d2c075e12927507097b7ac9ae7a4ae1c15 Author: Mario Limonciello Date: Wed Sep 24 11:16:21 2025 -0500 drm/amd: Drop unnecessary check in amdgpu_connector_add_common_modes() [Why] amdgpu_connector_add_common_modes() has a check for the width and height of common modes being too small, but the array of common_modes[] has fixed values. The check is dead code. [How] Drop unnecessary check. Cc: Timur Kristóf Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-3-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 0fb915d64d99b2cd6164fd0c5304457aa417ea3c Author: Mario Limonciello Date: Wed Sep 24 11:16:20 2025 -0500 drm/amd/display: Only enable common modes for eDP and LVDS [Why] The main reason common modes are added is for compatibility with clone mode when a laptop is connected to a projector or external monitor. Since commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") when non-native modes are picked for eDP the GPU scalar will be used. This is because it is inconsistent whether eDP panels have the capability to actually drive non-native resolutions. With panels connected to other connectors this limitation generally doesn't exist as we the EDID will advertise support for a number of resolutions and monitors will use built in scaling hardware. Comparing DC and non-DC code paths the non-DC code path only adds common modes for LVDS and eDP whereas the DC codepath does it for all connector types. In the past there was an experiment done to disable common mode adding for eDP and LVDS from commit 6d396e7ac1ce3 ("drm/amd/display: Disable common modes for LVDS") and commit 7948afb46af92 ("drm/amd/display: Disable common modes for eDP") but this was reverted in commit a8b79b09185de ("drm/amd: Re-enable common modes for eDP and LVDS") because it caused problems with Xorg. [How] Only add common modes for eDP and LVDS for DC, matching the behavior of non-DC. Suggested-by: Timur Kristóf Reviewed-by: Harry Wentland Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-2-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 4e3b45d7b6c36d7d1b9a30b13d2dfa890e7a0763 Author: Sunil Khatri Date: Wed Sep 24 18:03:07 2025 +0530 drm/amdgpu: remove the redeclaration of variable i Variable "i" has been redeclared as integer later in the function which is wrong and not serving any purpose. Fixes: 899fbde14646 ("drm/amdgpu: replace get_user_pages with HMM mirror helpers") Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 21bbcdf669554c2fe535592be639ba2f2e899399 Author: Dylan Yudaken Date: Fri Sep 19 10:01:39 2025 -0700 selftests/kexec: Ignore selftest binary Add a .gitignore for the test case build object. Signed-off-by: Dylan Yudaken Signed-off-by: Sohil Mehta Reviewed-by: Simon Horman Signed-off-by: Shuah Khan commit 883bd89d00085c2c5f1efcd25861745cb039f9e3 Author: Prike Liang Date: Fri Sep 19 14:31:50 2025 +0800 drm/amdgpu/userq: assign an error code for invalid userq va It should return an error code if userq VA validation fails. Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size") Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 90e09ea4cfd4aaaf07ababa6d8c880035587e7e9 Author: Christian König Date: Fri Sep 19 09:27:03 2025 +0200 drm/amdgpu: revert "rework reserved VMID handling" v2 This reverts commit e44a0fe630c58b0a87d8281f5c1077a3479e5fce. Initially we used VMID reservation to enforce isolation between processes. That has now been replaced by proper fence handling. Both OpenGL, RADV and ROCm developers requested a way to reserve a VMID for SPM, so restore that approach by reverting back to only allowing a single process to use the reserved VMID. Only compile tested for now. v2: use -ENOENT instead of -EINVAL if VMID is not available Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 66f3883dbc9245ca96abf97c2a4dd2a1e898b32f Author: Christian König Date: Tue Sep 16 16:07:35 2025 +0200 drm/amdgpu: remove leftover from enforcing isolation by VMID Initially we enforced isolation by reserving a VMID, but that practice was now removed. Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 7469567d882374dcac3fdb8b300e0f28cf875a75 Author: Jesse.Zhang Date: Tue Sep 16 13:11:06 2025 +0800 drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails Add a fallback mechanism to attempt pipe reset when KCQ reset fails to recover the ring. After performing the KCQ reset and queue remapping, test the ring functionality. If the ring test fails, initiate a pipe reset as an additional recovery step. v2: fix the typo (Lijo) v3: try pipeline reset when kiq mapping fails (Lijo) Reviewed-by: Alex Deucher Signed-off-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 0a6e9e098fcc318fec0f45a05a5c4743a81a60d9 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:08 2025 -0500 drm/amd: Fix hybrid sleep [Why] commit 530694f54dd5e ("drm/amdgpu: do not resume device in thaw for normal hibernation") optimized the flow for systems that are going into S4 where the power would be turned off. Basically the thaw() callback wouldn't resume the device if the hibernation image was successfully created since the system would be powered off. This however isn't the correct flow for a system entering into s0i3 after the hibernation image is created. Some of the amdgpu callbacks have different behavior depending upon the intended state of the suspend. [How] Use pm_hibernation_mode_is_suspend() as an input to decide whether to run resume during thaw() callback. Reported-by: Ionut Nechita Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4573 Tested-by: Ionut Nechita Fixes: 530694f54dd5e ("drm/amdgpu: do not resume device in thaw for normal hibernation") Acked-by: Alex Deucher Tested-by: Kenneth Crudup Signed-off-by: Mario Limonciello (AMD) Cc: 6.17+ # 6.17+: 495c8d35035e: PM: hibernate: Add pm_hibernation_mode_is_suspend() Signed-off-by: Rafael J. Wysocki commit 495c8d35035edb66e3284113bef01f3b1b843832 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:07 2025 -0500 PM: hibernate: Add pm_hibernation_mode_is_suspend() Some drivers have different flows for hibernation and suspend. If the driver opportunistically will skip thaw() then it needs a hint to know what is happening after the hibernate. Introduce a new symbol pm_hibernation_mode_is_suspend() that drivers can call to determine if suspending the system for this purpose. Tested-by: Ionut Nechita Tested-by: Kenneth Crudup Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Rafael J. Wysocki commit 469d80a3712c66a00b5bb888e62e809db8887ba7 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:06 2025 -0500 PM: hibernate: Fix hybrid-sleep Hybrid sleep will hibernate the system followed by running through the suspend routine. Since both the hibernate and the suspend routine will call pm_restrict_gfp_mask(), pm_restore_gfp_mask() must be called before starting the suspend sequence. Add an explicit call to pm_restore_gfp_mask() to power_down() before the suspend sequence starts. Add an extra call for pm_restrict_gfp_mask() when exiting suspend so that the pm_restore_gfp_mask() call in hibernate() is balanced. Reported-by: Ionut Nechita Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4573 Tested-by: Ionut Nechita Fixes: 12ffc3b1513eb ("PM: Restrict swap use to later in the suspend sequence") Tested-by: Kenneth Crudup Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250925185108.2968494-2-superm1@kernel.org [ rjw: Add comment explainig the new pm_restrict_gfp_mask() call purpose ] Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit 5ba9f520f41a33c99fd5d1eb81b5650ed3517b88 Author: Rahul Pathak Date: Mon Aug 18 09:39:06 2025 +0530 clk: Add clock driver for the RISC-V RPMI clock service group The RPMI specification defines a clock service group which can be accessed via SBI MPXY extension or dedicated S-mode RPMI transport. Add mailbox client based clock driver for the RISC-V RPMI clock service group. Reviewed-by: Stephen Boyd Reviewed-by: Andy Shevchenko Co-developed-by: Anup Patel Signed-off-by: Anup Patel Signed-off-by: Rahul Pathak Link: https://lore.kernel.org/r/20250818040920.272664-11-apatel@ventanamicro.com [pjw@kernel.org: converted rpmi_clkrate_u64 macro to a function; replaced bare constant with a macro] Signed-off-by: Paul Walmsley commit b385830290b417c7708e2db7c0e34a0b3e7297bf Author: Anup Patel Date: Mon Aug 18 09:39:05 2025 +0530 dt-bindings: clock: Add RPMI clock service controller bindings Add device tree bindings for the RPMI clock service group based controller for the supervisor software. The RPMI clock service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Conor Dooley Reviewed-by: Stephen Boyd Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-10-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 54e184f0f5f34b0cd18623117150b52444ab6433 Author: Anup Patel Date: Mon Aug 18 09:39:04 2025 +0530 dt-bindings: clock: Add RPMI clock service message proxy bindings Add device tree bindings for the RPMI clock service group based message proxy implemented by the SBI implementation (machine mode firmware or hypervisor). The RPMI clock service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20250818040920.272664-9-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 46e75c56dfeafb6756773b71cabe187a6886859a Author: Julian Sun Date: Wed Aug 27 20:18:12 2025 +0800 ext4: increase IO priority of fastcommit The following code paths may result in high latency or even task hangs: 1. fastcommit io is throttled by wbt. 2. jbd2_fc_wait_bufs() might wait for a long time while JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then jbd2_journal_commit_transaction() waits for the JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write lock of j_state_lock. 3. start_this_handle() waits for read lock of j_state_lock which results in high latency or task hang. Given the fact that ext4_fc_commit() already modifies the current process' IO priority to match that of the jbd2 thread, it should be reasonable to match jbd2's IO submission flags as well. Suggested-by: Ritesh Harjani (IBM) Signed-off-by: Julian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com> Signed-off-by: Theodore Ts'o commit d6ace46c82fd2d3bdb58c35e3dd5cb9e83e136bf Author: Lukas Bulwahn Date: Wed Aug 27 11:08:08 2025 +0200 ext4: remove obsolete EXT3 config options In June 2015, commit c290ea01abb7 ("fs: Remove ext3 filesystem driver") removed the historic ext3 filesystem support as ext3 partitions are fully supported with the ext4 filesystem support. To simplify updating the kernel build configuration, which had only EXT3 support but not EXT4 support enabled, the three config options EXT3_{FS,FS_POSIX_ACL,FS_SECURITY} were kept, instead of immediately removing them. The three options just enable the corresponding EXT4 counterparts when configs from older kernel versions are used to build on later kernel versions. This ensures that the kernels from those kernel build configurations would then continue to have EXT4 enabled for supporting booting from ext3 and ext4 file systems, to avoid potential unexpected surprises. Given that the kernel build configuration has no backwards-compatibility guarantee and this transition phase for such build configurations has been in place for a decade, we can reasonably expect all such users to have transitioned to use the EXT4 config options in their config files at this point in time. With that in mind, the three EXT3 config options are obsolete by now. Remove the obsolete EXT3 config options. Signed-off-by: Lukas Bulwahn Signed-off-by: Theodore Ts'o commit 0f3b05c12158ec7545fb336469ccce38c31c7f9f Author: Julian Sun Date: Mon Aug 25 20:53:39 2025 +0800 jbd2: increase IO priority of checkpoint In commit 6a3afb6ac6df ("jbd2: increase the journal IO's priority"), the priority of IOs initiated by jbd2 has been raised, exempting them from WBT throttling. Checkpoint is also a crucial operation of jbd2. While no serious issues have been observed so far, it should still be reasonable to exempt checkpoint from WBT throttling. Signed-off-by: Julian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o commit 3c3fac6bc0a9c00dbe65d8dc0d3a282afe4d3188 Author: Baokun Li Date: Mon Aug 25 11:38:30 2025 +0800 ext4: fix potential null deref in ext4_mb_init() In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy() lacks null pointer checking, this leads to a null pointer dereference. ================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40 Call Trace: xa_destroy+0x61/0x130 ext4_mb_init+0x483/0x540 __ext4_fill_super+0x116d/0x17b0 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 do_new_mount+0x197/0x300 __x64_sys_mount+0x116/0x150 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy() to prevent this issue. The same fix is also applied to ext4_mb_largest_free_orders_destroy(). Reported-by: syzbot+1713b1aa266195b916c2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1713b1aa266195b916c2 Cc: stable@kernel.org Fixes: f7eaacbb4e54 ("ext4: convert free groups order lists to xarrays") Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Theodore Ts'o commit d8b90e6387a74bcb1714c8d1e6a782ff709de9a9 Author: Baokun Li Date: Thu Aug 21 21:38:57 2025 +0800 ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() The implicit __GFP_NOFAIL flag in ext4_sb_bread() was removed in commit 8a83ac54940d ("ext4: call bdev_getblk() from sb_getblk_gfp()"), meaning the function can now fail under memory pressure. Most callers of ext4_sb_bread() propagate the error to userspace and do not remount the filesystem read-only. However, ext4_free_branches() handles ext4_sb_bread() failure by remounting the filesystem read-only. This implies that an ext3 filesystem (mounted via the ext4 driver) could be forcibly remounted read-only due to a transient page allocation failure, which is unacceptable. To mitigate this, introduce a new helper function, ext4_sb_bread_nofail(), which explicitly uses __GFP_NOFAIL, and use it in ext4_free_branches(). Fixes: 8a83ac54940d ("ext4: call bdev_getblk() from sb_getblk_gfp()") Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o commit 2728e71ad67810fea8346fb800c647b66a25162d Author: Dario Binacchi Date: Thu Sep 25 17:31:35 2025 +0200 dt-bindings: touchscreen: remove touchscreen.txt With commit 1d6204e2f51f ("dt-bindings: touchscreen: Add touchscreen schema") touchscreen.txt is no longer needed, and since no other file refers to it, it can be safely removed. Signed-off-by: Dario Binacchi Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-3-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 6b4896e404c7053cf09a6f58fd09684262fab6dd Author: Dario Binacchi Date: Thu Sep 25 17:31:34 2025 +0200 dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node Convert Raspberry Pi firmware 7" touchscreen controller device tree binding to json-schema. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-2-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit b0b255d6b86dd1f2618a1402d6cbdcec1be0c589 Author: Dario Binacchi Date: Thu Sep 25 17:31:33 2025 +0200 dt-bindings: touchscreen: convert eeti bindings to json schema Convert EETI touchscreen controller device tree binding to json-schema. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-1-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 981b696faf2d59a58d1dc8e258bba00b12e5de93 Author: Xichao Zhao Date: Mon Aug 18 15:28:59 2025 +0800 ext4: replace min/max nesting with clamp() The clamp() macro explicitly expresses the intent of constraining a value within bounds.Therefore, replacing max(min(a,b),c) with clamp(val, lo, hi) can improve code readability. Signed-off-by: Xichao Zhao Signed-off-by: Theodore Ts'o commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a Author: chuguangqing Date: Wed Aug 6 10:28:49 2025 +0800 fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag. Signed-off-by: chuguangqing Signed-off-by: Theodore Ts'o commit 203e3beb73e53584ca90bc2a6d8240b9b12b9bcf Merge: 12de5f0f6c2d7a 4ff71af020ae59 Author: Jakub Kicinski Date: Thu Sep 11 17:37:09 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc8). Conflicts: drivers/net/can/spi/hi311x.c 6b6968084721 ("can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled") 27ce71e1ce81 ("net: WQ_PERCPU added to alloc_workqueue users") https://lore.kernel.org/72ce7599-1b5b-464a-a5de-228ff9724701@kernel.org net/smc/smc_loopback.c drivers/dibs/dibs_loopback.c a35c04de2565 ("net/smc: fix warning in smc_rx_splice() when calling get_page()") cc21191b584c ("dibs: Move data path to dibs layer") https://lore.kernel.org/74368a5c-48ac-4f8e-a198-40ec1ed3cf5f@kernel.org Adjacent changes: drivers/net/dsa/lantiq/lantiq_gswip.c c0054b25e2f1 ("net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()") 7a1eaef0a791 ("net: dsa: lantiq_gswip: support model-specific mac_select_pcs()") Signed-off-by: Jakub Kicinski commit 5730dacb3f172858ca47b8b1aeab083b5713f24b Author: Mykyta Yatsenko Date: Wed Sep 24 15:29:54 2025 +0100 selftests/bpf: Task_work selftest cleanup fixes task_work selftest does not properly handle cleanup during failures: * destroy bpf_link * perf event fd is passed to bpf_link, no need to close it if link was created successfully * goto cleanup if fork() failed, close pipe. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250924142954.129519-2-mykyta.yatsenko5@gmail.com commit a9e6aa994917ee602798bbb03180a194b37865bb Author: Guangshuo Li Date: Thu Sep 25 14:44:48 2025 +0800 nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() devm_kcalloc() may fail. ndtest_probe() allocates three DMA address arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses them in ndtest_nvdimm_init(), which can lead to a NULL pointer dereference under low-memory conditions. Check all three allocations and return -ENOMEM if any allocation fails, jumping to the common error path. Do not emit an extra error message since the allocator already warns on allocation failure. Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Alison Schofield Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Signed-off-by: Ira Weiny commit 88506435d9d4148e31341a2be9492004df9f7611 Author: Dave Jiang Date: Tue Sep 23 10:40:13 2025 -0700 nvdimm: Clean up __nd_ioctl() and remove gotos Utilize scoped based resource management to clean up the code and and remove gotos for the __nd_ioctl() function. Change allocation of 'buf' to use kvzalloc() in order to use vmalloc() memory when needed and also zero out the allocated memory. Signed-off-by: Dave Jiang Reviewed-by: Dan Williams Signed-off-by: Ira Weiny commit 0020839be034cf1c57ebdf8af8c9e4f697055db6 Author: Dave Jiang Date: Tue Sep 23 10:40:12 2025 -0700 nvdimm: Introduce guard() for nvdimm_bus_lock Converting nvdimm_bus_lock/unlock to guard() to clean up usage of gotos for error handling and avoid future mistakes of missed unlock on error paths. Link: https://lore.kernel.org/linux-cxl/20250917163623.00004a3c@huawei.com/ Suggested-by: Jonathan Cameron Signed-off-by: Dave Jiang Acked-by: Dan Williams Signed-off-by: Ira Weiny commit 99510c324e531addd9f7b80a72dab7435ca66215 Author: Lukas Bulwahn Date: Thu Sep 25 09:36:34 2025 +0200 Documentation/features: Update feature lists for 6.17-rc7 It seems that ./Documentation/features/scripts/features-refresh.sh was most recently used in December 2022, with the latest kernel release v6.1-rc7 at that time (see commit 7f2e60ff51ca ("Documentation/features: Update feature lists for 6.1") to update the feature lists in this subdirectory. All further changes to Documentation/features/ since then have probably been done manually, without checking for changes in other architectures and features, that missed to update this part of the documentation. Running ./Documentation/features/scripts/features-refresh.sh now showed seven changes of supported features in various architectures (one in arc, two in parisc, one in riscv, one in openrisc, and two in um), which were not reflected yet in the current documentation. To confirm the sanity of this script's suggested changes, I checked if the commit messages confirm that the features have in fact been added in the following commits: - commit f122668ddcce ("ARC: Add eBPF JIT support") - commit 4800a6215e33 ("parisc: Wire up eBPF JIT compiler") - commit a869b8c29f86 ("riscv: enable mseal sysmap for RV64") - commit 2f681ba4b352 ("um: move thread info into task") - commit 3f17fed21491 ("um: switch to regset API and depend on XSTATE") - commit 7ce8716e2769 ("openrisc: Add HAVE_REGS_AND_STACK_ACCESS_API support") - commit b5ff52be8913 ("parisc: Convert to generic clockevents") So, update all documents to the current state with features-refresh.sh. Signed-off-by: Lukas Bulwahn Signed-off-by: Jonathan Corbet Message-ID: <20250925073634.112142-1-lukas.bulwahn@redhat.com> commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 Author: Cristian Ciocaltea Date: Tue Sep 2 15:15:46 2025 +0300 usb: vhci-hcd: Prevent suspending virtually attached devices The VHCI platform driver aims to forbid entering system suspend when at least one of the virtual USB ports are bound to an active USB/IP connection. However, in some cases, the detection logic doesn't work reliably, i.e. when all devices attached to the virtual root hub have been already suspended, leading to a broken suspend state, with unrecoverable resume. Ensure the virtually attached devices do not enter suspend by setting the syscore PM flag. Note this is currently limited to the client side only, since the server side doesn't implement system suspend prevention. Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") Signed-off-by: Cristian Ciocaltea Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com Signed-off-by: Greg Kroah-Hartman commit 2d965c1ae4135ed6f505661458f6dabd39488dac Author: André Almeida Date: Thu Sep 25 11:14:23 2025 -0300 tools/nolibc: add stdbool.h to nolibc includes Otherwise tests compiled with only "-include nolibc.h" will fail with "error: unknown type name 'bool'", even though a stdbool.h is available from nolibc. Fixes: ae1f550efc11 ("tools/nolibc: add stdbool.h header") Fixes: f2662ec26b26 ("selftests: kselftest: Create ksft_print_dbg_msg()") Reported-by: Mark Brown Closes: https://lore.kernel.org/lkml/833f5ae5-190e-47ec-9ad9-127ad166c80c@sirena.org.uk/ Signed-off-by: André Almeida [Thomas: add Fixes tags and massage commit message a bit] Signed-off-by: Thomas Weißschuh commit e26387e950ee4486b4ed5728b5d3c1430c33ba67 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:47 2025 +0000 ASoC: renesas: msiof: ignore 1st FSERR Renesas have tried to minimize the occurrence of FSERR errors as much as possible, but unfortunately we cannot remove them completely, because MSIOF might setup its register during CLK/SYNC are inputed. It can be happen because MSIOF is working as Clock/Frame Consumer. Ignore 1st FSERR which we can do nothing Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/874isryutg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8c363f61e5bcb92d5e88ca1b47be74be2683b212 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:41 2025 +0000 ASoC: renesas: msiof: Add note for The possibility of R/L opposite Capture This driver is assuming MSIOF is used as Clock/Frame Consumer Mode, and there is a case that some Codec (= Clock/Frame Provider) might output Clock/Frame before setup MSIOF. And, MSIOF will capture data without checking SYNC signal Hi/Low (= R/L). This means, if MSIOF RXE bit was set as 1 in case of SYNC signal was Hi (= R) timing, it will start capture data since next SYNC low signal (= L). Because Linux assumes sound data is lined up as R->L->R->L->..., the data R/L might be opposite. The only solution in this case is start CLK/SYNC *after* MSIOF settings, but it depends when and how Codec driver start it. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/875xd7yutm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit dc7473e6372ee36ff232af10c910ee3a8bad6447 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:34 2025 +0000 ASoC: renesas: msiof: setup both (Playback/Capture) in the same time SITMDRn / SIRMDRn and some other registers should not be updated during working even though it was not related the target direction (for example, do TX settings during RX is working), otherwise it cause a FSERR. Setup both direction (Playback/Capture) in the same time. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/877bxnyutt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 25aa058b5c83a3c455a2a288bb3295c0b234f093 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:27 2025 +0000 ASoC: renesas: msiof: tidyup DMAC stop timing Current DMAC is stopped before HW stop, but it might be cause of sync error. Stop HW first. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/878qi3yuu0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ab77fa5533e4d1dcfdd2711b9b1e166e4ed57dab Author: Kuninori Morimoto Date: Thu Sep 25 05:17:21 2025 +0000 ASoC: renesas: msiof: add .symmetric_xxx on snd_soc_dai_driver MSIOF TX/RX are sharing same clock. Adds .symmetric_xxx flags. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87a52jyuu6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 130947b4681c515a5e5a7961244b502de2de85ca Author: Kuninori Morimoto Date: Thu Sep 25 05:17:17 2025 +0000 ASoC: renesas: msiof: set SIFCTR register Because it uses DMAC, we would like to transfer data if there is any data. Set SIFCTR for it. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87bjmzyuub.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 25226abc1affd4bf4f6dd415d475b76e7a273fa8 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:11 2025 +0000 ASoC: renesas: msiof: use reset controller MSIOF has TXRST/RXRST to reset FIFO, but it shouldn't be used during SYNC signal was asserted, because it will be cause of HW issue. When MSIOF is used as Sound driver, this driver is assuming it is used as clock consumer mode (= Codec is clock provider). This means, it can't control SYNC signal by itself. We need to use SW reset (= reset_control_xxx()) instead of TXRST/RXRST. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87cy7fyuug.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 030c59df83b448fc873d1caabb9ea077ae25268e Author: Kuninori Morimoto Date: Thu Sep 25 05:17:04 2025 +0000 ASoC: renesas: msiof: add unique NOTE name MSIOF will have many NOTE on top of driver, give it a unique NOTE name. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ecrvyuuo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 264a58e60c5c93b358818f523eb4911190c8b8d7 Merge: ef351f8e39375a 0e0ba0ecec3d6e Author: Greg Kroah-Hartman Date: Thu Sep 25 18:38:53 2025 +0200 Merge tag 'usb-serial-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 6.18-rc1 Here are the USB serial updates for 6.18-rc1 consisting of some new modem device ids and a trivial cleanup. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add SIMCom 8230C compositions USB: serial: oti6858: remove extranenous ; after comment commit ef351f8e39375a12b64364e5cda7c62fb96a8566 Merge: a4e143636d5def 67600ccfc4f38e Author: Greg Kroah-Hartman Date: Thu Sep 25 18:36:54 2025 +0200 Merge tag 'thunderbolt-for-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.18 merge window This includes following USB4/Thunderbolt changes for the v6.18 merge window: - HMAC hashing improvements - Switch to use Linux Foundation IDs for XDomain discovery - Use is_pciehp instead of is_hotplug_bridge - Fixes for various kernel-doc issues - Fix use-after-free in DP tunneling error path. I'm sending the UAF fix with this pull request because it came quite late and I would like to give it some exposure before it lands the mainline. All these except the UAF fix have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (33 commits) thunderbolt: Fix use-after-free in tb_dp_dprx_work thunderbolt: Update thunderbolt.h header file thunderbolt: Update xdomain.c function documentation thunderbolt: Update usb4_port.c function documentation thunderbolt: Update usb4.c function documentation thunderbolt: Update tunnel.h function documentation thunderbolt: Update tunnel.c function documentation thunderbolt: Update tmu.c function documentation thunderbolt: Add missing documentation in tb.h thunderbolt: Update tb.h function documentation thunderbolt: Update tb.c function documentation thunderbolt: Update switch.c function documentation thunderbolt: Update retimer.c function documentation thunderbolt: Update property.c function documentation thunderbolt: Update path.c function documentation thunderbolt: Update nvm.c function documentation thunderbolt: Add missing documentation in nhi_regs.h ring_desc structure thunderbolt: Update nhi.c function documentation thunderbolt: Update lc.c function documentation thunderbolt: Update eeprom.c function documentation ... commit 130e6de62107116eba124647116276266be0f84c Author: Jaehoon Kim Date: Thu Sep 25 17:47:08 2025 +0200 s390/dasd: enforce dma_alignment to ensure proper buffer validation The block layer validates buffer alignment using the device's dma_alignment value. If dma_alignment is smaller than logical_block_size(bp_block) -1, misaligned buffer incorrectly pass validation and propagate to the lower-level driver. This patch adjusts dma_alignment to be at least logical_block_size -1, ensuring that misalignment buffers are properly rejected at the block layer and do not reach the DASD driver unnecessarily. Fixes: 2a07bb64d801 ("s390/dasd: Remove DMA alignment") Reviewed-by: Stefan Haberland Cc: stable@vger.kernel.org #6.11+ Signed-off-by: Jaehoon Kim Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 8f4ed0ce4857ceb444174503fc9058720d4faaa1 Author: Jaehoon Kim Date: Thu Sep 25 17:47:07 2025 +0200 s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request Currently, if CCW request creation fails with -EINVAL, the DASD driver returns BLK_STS_IOERR to the block layer. This can happen, for example, when a user-space application such as QEMU passes a misaligned buffer, but the original cause of the error is masked as a generic I/O error. This patch changes the behavior so that -EINVAL is returned as BLK_STS_INVAL, allowing user space to properly detect alignment issues instead of interpreting them as I/O errors. Reviewed-by: Stefan Haberland Cc: stable@vger.kernel.org #6.11+ Signed-off-by: Jaehoon Kim Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 1e11552ee54d10c0b602c76b94db602e2581ce57 Author: Vadim Pasternak Date: Mon Jan 13 10:48:59 2025 +0200 hwmon: (mlxreg-fan) Add support for new flavour of capability register FAN platform data is common across the various systems, while fan driver should be able to apply only the fan instances relevant to specific system. For example, platform data might contain descriptions for fan1, fan2, ..., fan{n}, while some systems equipped with all 'n' fans, others with less. Also, on some systems fan drawer can be equipped with several tachometers and on others only with one. For detection of the real number of equipped drawers and tachometers special capability registers are used. These registers used to indicate presence of drawers and tachometers through the bitmap. For some new big modular systems this register will provide presence data by counter. Use slot parameter to distinct whether capability register contains bitmask or counter. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250113084859.27064-3-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 Author: Vadim Pasternak Date: Mon Jan 13 10:48:58 2025 +0200 hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems Distinct between fan speed setting request coming for hwmon and thermal subsystems. There are fields 'last_hwmon_state' and 'last_thermal_state' in the structure 'mlxreg_fan_pwm', which respectively store the cooling state set by the 'hwmon' and 'thermal' subsystem. The purpose is to make arbitration of fan speed setting. For example, if fan speed required to be not lower than some limit, such setting is to be performed through 'hwmon' subsystem, thus 'thermal' subsystem will not set fan below this limit. Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing cooling state to never be set to a lower value. Eliminate update of 'last_thermal_state', when request is coming from 'hwmon' subsystem. Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit 5798b62867b47b6ace287d31172ce748ad70d869 Author: Sung-Chi Li Date: Thu Sep 11 06:56:36 2025 +0000 hwmon: (cros_ec) register fans into thermal framework cooling devices Register fans connected under EC as thermal cooling devices as well, so these fans can then work with the thermal framework. During the driver probing phase, we will also try to register each fan as a thermal cooling device based on previous probe result (whether the there are fans connected on that channel, and whether EC supports fan control). The basic get max state, get current state, and set current state methods are then implemented as well. Signed-off-by: Sung-Chi Li Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-3-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit fb8e659309f72e54ed011c6bfe98597b9236805d Author: Sung-Chi Li Date: Thu Sep 11 06:56:35 2025 +0000 hwmon: (cros_ec) add PWM control over fans Newer EC firmware supports controlling fans through host commands, so adding corresponding implementations for controlling these fans in the driver for other kernel services and userspace to control them. The driver will first probe the supported host command versions (get and set of fan PWM values, get and set of fan control mode) to see if the connected EC fulfills the requirements of controlling the fan, then exposes corresponding sysfs nodes for userspace to control the fan with corresponding read and write implementations. As EC will automatically change the fan mode to auto when the device is suspended, the power management hooks are added as well to keep the fan control mode and fan PWM value consistent during suspend and resume. As we need to access the hwmon device in the power management hook, update the driver by storing the hwmon device in the driver data as well. Signed-off-by: Sung-Chi Li Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-2-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit 60ac65a31041b0e5dfd736a79027314b9d533ef5 Author: Sung-Chi Li Date: Thu Sep 11 06:56:34 2025 +0000 platform/chrome: update pwm fan control host commands Update cros_ec_commands.h to include definitions for getting PWM fan duty, getting and setting the fan control mode. Signed-off-by: Sung-Chi Li Acked-by: Tzung-Bi Shih Reviewed-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-1-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit 443b39c82c322c9f3c38bea0389fe927ba00b3b4 Author: Michael Walle Date: Fri Sep 12 14:07:44 2025 +0200 hwmon: add SMARC-sAM67 support Add a new driver for the Kontron SMARC-sAM67 board management controller. It has two voltage sensors and one temperature sensor. Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250912120745.2295115-7-mwalle@kernel.org [groeck: Added sa67 to index.rst] Signed-off-by: Guenter Roeck commit 0f6eae86e626e0561d2f545a3183be2e12108410 Author: Michael Walle Date: Fri Sep 12 14:07:42 2025 +0200 dt-bindings: hwmon: sl28cpld: add sa67mcu compatible The Kontron SMARC-sAM67 module features an on-board house keeping uC. It is designed to be compatible with the older sl28cpld implementation, but has different sensors, like voltage and temperature monitoring. Add a new compatible for that board. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250912120745.2295115-5-mwalle@kernel.org Signed-off-by: Guenter Roeck commit 31c092baea5a1c5473d2183c2f2a36c76d083c59 Author: Mohamad Kamal Date: Sun Sep 14 10:40:10 2025 +0200 hwmon: (asus-ec-sensors) add TUF GAMING X670E PLUS WIFI Add support for TUF GAMING X670E PLUS WIFI Signed-off-by: Mohamad Kamal Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250914084019.1108941-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit cb403594701cd36f7f3f868258655d56f9afaf8e Author: Darrick J. Wong Date: Mon Sep 15 17:27:58 2025 -0700 fuse: move CREATE_TRACE_POINTS to a separate file Before we start adding new tracepoints for fuse+iomap, move the tracepoint creation itself to a separate source file so that we don't have to start pulling iomap dependencies into dev.c just for the iomap structures. Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit c4331e19a6b0f9b8de5921cc2f3253e572945564 Author: Darrick J. Wong Date: Mon Sep 15 17:27:11 2025 -0700 fuse: move the backing file idr and code into a new source file iomap support for fuse is also going to want the ability to attach backing files to a fuse filesystem. Move the fuse_backing code into a separate file so that both can use it. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit db155b7c7c85b5f14edec21e164001a168581ffb Author: Sergey Bashirov Date: Mon Aug 25 16:11:02 2025 +0300 NFSD: Disallow layoutget during grace period When the server is recovering from a reboot and is in a grace period, any operation that may result in deletion or reallocation of block extents should not be allowed. See RFC 8881, section 18.43.3. If multiple clients write data to the same file, rebooting the server during writing may result in file corruption. In the worst case, the exported XFS may also become corrupted. Observed this behavior while testing pNFS block volume setup. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit 6d97171ac6585de698df019b0bfea3f123fd8385 Author: John Hubbard Date: Wed Sep 24 18:33:59 2025 -0700 rust: pci: display symbolic PCI vendor names The Display implementation for Vendor was forwarding directly to Debug printing, resulting in raw hex values instead of PCI Vendor strings. Improve things by doing a stringify!() call for each PCI Vendor item. This now prints symbolic names such as "NVIDIA", instead of "Vendor(0x10de)". It still falls back to Debug formatting for unknown class values. Suggested-by: Danilo Krummrich Signed-off-by: John Hubbard Reviewed-by: Alexandre Courbot [ Remove #[inline] for Vendor::fmt(). - Danilo ] Signed-off-by: Danilo Krummrich commit 0a8f173d9dad13930d5888505dc4c4fd6a1d4262 Author: Marek Vasut Date: Tue Sep 9 18:26:24 2025 +0200 PCI: rcar-host: Drop PMSR spinlock The pmsr_lock spinlock used to be necessary to synchronize access to the PMSR register, because that access could have been triggered from either config space access in rcar_pcie_config_access() or an exception handler rcar_pcie_aarch32_abort_handler(). The rcar_pcie_aarch32_abort_handler() case is no longer applicable since commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read which triggered an exception"), which performs more accurate, controlled invocation of the exception, and a fixup. This leaves rcar_pcie_config_access() as the only call site from which rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be called from the controller struct pci_ops .read and .write callbacks, and those are serialized in drivers/pci/access.c using raw spinlock 'pci_lock' . It should be noted that CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform. Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a raw spinlock, this constellation triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y . Remove the pmsr_lock to fix the locking. Fixes: a115b1bd3af0 ("PCI: rcar: Add L1 link state fix into data abort hook") Reported-by: Duy Nguyen Reported-by: Thuan Nguyen Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250909162707.13927-1-marek.vasut+renesas@mailbox.org commit d53ea977adf913a6e5024323e6b7e02326d4453c Author: John Hubbard Date: Wed Sep 24 18:33:58 2025 -0700 rust: pci: display symbolic PCI class names The Display implementation for Class was forwarding directly to Debug printing, resulting in raw hex values instead of PCI Class strings. Improve things by doing a stringify!() call for each PCI Class item. This now prints symbolic names such as "DISPLAY_VGA", instead of "Class(0x030000)". It still falls back to Debug formatting for unknown class values. Suggested-by: Danilo Krummrich Signed-off-by: John Hubbard Reviewed-by: Alexandre Courbot Signed-off-by: Danilo Krummrich commit 200b0d25084d6e99f9f08229283b14b60a84c657 Author: Kevin Brodsky Date: Fri Sep 12 08:39:08 2025 +0100 arm64: mm: Move KPTI helpers to mmu.c create_kpti_ng_temp_pgd() is currently defined (as an alias) in mmu.c without matching declaration in a header; instead cpufeature.c makes its own declaration. This is clearly not pretty, and as commit ceca927c86e6 ("arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature") showed, it also makes it very easy for the prototypes to go out of sync. All this would be much simpler if kpti_install_ng_mappings() and associated functions lived in mmu.c, where they logically belong. This is what this patch does: - Move kpti_install_ng_mappings() and associated functions from cpufeature.c to mmu.c, add a declaration to - Remove create_kpti_ng_temp_pgd() and just call __create_pgd_mapping_locked() directly instead - Mark all these functions __init - Move __initdata after kpti_ng_temp_alloc (as suggested by checkpatch) Reviewed-by: Ryan Roberts Reviewed-by: Ard Biesheuvel Reviewed-by: Anshuman Khandual Signed-off-by: Kevin Brodsky Reviewed-by: Yeoreum Yun [will: Fix conflicts with init_idmap_kpti_bbml2_flag()] Signed-off-by: Will Deacon commit 0da48c5b2fa731b21bc523c82d927399a1e508b0 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:54 2025 +0530 PCI: dwc: Support ECAM mechanism by enabling iATU 'CFG Shift Feature' Designware databook r5.20a, sec 3.10.10.3 documents the 'CFG Shift Feature' of the internal Address Translation Unit (iATU). When this feature is enabled, it shifts/maps the BDF contained in the bits [27:12] of the target address in MEM TLP to become BDF of the CFG TLP. This essentially implements the Enhanced Configuration Address Mapping (ECAM) mechanism as defined in PCIe r6.0, sec 7.2.2. Currently, the driver is not making use of this CFG shift feature, thereby creating the iATU outbound map for each config access to the devices, causing latency and wasting CPU cycles. So to avoid this, configure the controller to enable CFG shift feature by enabling the 'CFG Shift' bit of the 'iATU Control 2 Register'. As a result of enabling CFG shift (ECAM), there is no longer a need to map the DBI register space separately as the DBI region falls under the 'config' space used for ECAM (as DBI is used to access the Root Port). For enabling ECAM using CFG shift, the platform has to satisfy following requirements: 1. Size of the 'config' memory space to be used as ECAM memory should be able to accommodate the number of buses defined in the 'bus-range' property of the host bridge DT node. 2. The 'config' memory space should be 256 MiB aligned. This requirement comes from PCIe r6.0, sec 7.2.2, which says the base address of ECAM memory should be aligned to a 2^(n+20) byte address boundary. For the DWC cores, n is 8, so this results in 2^28 byte alignment requirement. It should be noted that some DWC vendor glue drivers like pcie-al may use their own ECAM mechanism. For those controllers, set 'dw_pcie_rp::native_ecam' flag and skip enabling the CFG Shift feature in the DWC core. Signed-off-by: Krishna Chaitanya Chundru [mani: code split, reworded subject/description, comment, native_ecam flag] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-4-e84390ba75fa@kernel.org commit 4660e50cf81800f82eeecf743ad1e3e97ab72190 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:53 2025 +0530 PCI: qcom: Prepare for the DWC ECAM enablement To support the DWC ECAM mechanism, prepare the driver by performing below configurations: 1. Since the ELBI region will be covered by the ECAM 'config' space, override the 'elbi_base' with the address derived from 'dbi_base' and the offset from PARF_SLV_DBI_ELBI register. 2. Block the transactions from the host bridge to devices other than Root Port on the root bus to return all F's. This is required when the 'CFG Shift Feature' of iATU is enabled. Signed-off-by: Krishna Chaitanya Chundru [mani: code split, reworded subject/description and comments] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-3-e84390ba75fa@kernel.org commit f6fd357f7afbeb34a633e5688a23b9d7eb49d558 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:52 2025 +0530 PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature' In order to enable PCIe ECAM mechanism in DWC driver as per the 'CFG Shift Feature' documented in Designware databook r5.20a, sec 3.10.10.3, prepare the driver to handle the one time iATU setup and creating ECAM window. Signed-off-by: Krishna Chaitanya Chundru [mani: splitted the preparatory code into a separate commit for bisectability] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-2-e84390ba75fa@kernel.org commit c96992a24beca0768c1c42ad25d6a466e17ec70f Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:51 2025 +0530 PCI: dwc: Add support for ELBI resource mapping External Local Bus Interface (ELBI) is an optional register space for all DWC IPs containing the vendor specific registers. There is no need for the vendor glue drivers to fetch and map the ELBI region separately. Hence, optionally fetch and map the resource from DT in the DWC core. This also warrants dropping the corresponding code from glue drivers. Hence, drop the ELBI resource fetch and map logic from glue drivers and convert them to use 'dw_pci::elbi_base'. Note that the pcie-qcom-ep driver used devm_pci_remap_cfg_resource() to map the ELBI resource previously. But it was a mistake since devm_pci_remap_cfg_resource() should only be used for mapping the PCIe config space region as it maps the region as Non-Posted. As ELBI is used to hold vendor specific registers, there is no need to map the region as Non-Posted. With this conversion, the region will get mapped as normal MMIO memory. Suggested-by: Manivannan Sadhasivam Signed-off-by: Krishna Chaitanya Chundru [mani: removed elbi override, converted glue drivers and reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-1-e84390ba75fa@kernel.org commit fd2f74f8f3d3c1a524637caf5bead9757fae4332 Author: Feng Yang Date: Thu Sep 25 10:08:22 2025 +0800 tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 When using bpf_program__attach_kprobe_multi_opts on ARM64 to hook a BPF program that contains the bpf_get_stackid function, the BPF program fails to obtain the stack trace and returns -EFAULT. This is because ftrace_partial_regs omits the configuration of the pstate register, leaving pstate at the default value of 0. When get_perf_callchain executes, it uses user_mode(regs) to determine whether it is in kernel mode. This leads to a misjudgment that the code is in user mode, so perf_callchain_kernel is not executed and the function returns directly. As a result, trace->nr becomes 0, and finally -EFAULT is returned. Therefore, the assignment of the pstate register is added here. Fixes: b9b55c8912ce ("tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs") Closes: https://lore.kernel.org/bpf/20250919071902.554223-1-yangfeng59949@163.com/ Signed-off-by: Feng Yang Tested-by: Jiri Olsa Acked-by: Masami Hiramatsu (Google) Signed-off-by: Will Deacon commit 195a1b7d8388c0ec2969a39324feb8bebf9bb907 Author: Yang Shi Date: Thu Sep 18 09:23:49 2025 -0700 arm64: kprobes: call set_memory_rox() for kprobe page The kprobe page is allocated by execmem allocator with ROX permission. It needs to call set_memory_rox() to set proper permission for the direct map too. It was missed. Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page") Cc: Signed-off-by: Yang Shi Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit c584a1c7c8a192c13637bc51c7b63a9f15fe6474 Author: Greg Kroah-Hartman Date: Thu Sep 25 14:42:40 2025 +0200 USB: disable rust bindings from the build for now The rust USB bindings as submitted are a good start, but they don't really seem to be correct in a number of minor places, so just disable them from the build entirely at this point in time. When they are ready to be re-enabled, this commit can be reverted. Acked-by: Daniel Almeida Signed-off-by: Greg Kroah-Hartman commit a084c3c4a2674f156031eb04e785986c2744aca8 Author: Yicong Yang Date: Thu Sep 25 11:31:23 2025 +0800 drivers/perf: hisi: Add tt_core_deprecated for compatibility Previously tt_core is defined as config1:0-7 which may not cover all the CPUs sharing L3C on platforms with more than 8 CPUs in a L3C. In order to support such platforms extend tt_core to 16 bits, since no spare space in config1, tt_core was moved to config2:0-15. Though linux expects the users to retrieve the control encoding from sysfs first for each option, it's possible if user doesn't follow this and hardcoded tt_core in config1. So add an option tt_core_deprecated for config1:0-7 for backward compatibility. Signed-off-by: Yicong Yang Signed-off-by: Will Deacon commit 088bb10e37252034ec58a6152f20bfdc8a837f54 Author: Heiko Carstens Date: Tue Sep 23 17:34:30 2025 +0200 s390/mm: Add memory allocation profiling hooks Similar to common code changes [1] add alloc_hook() wrappers to page table allocation functions to allow for memory allocation profiling. If CONFIG_MEM_ALLOC_PROFILING is enabled call sites of page table allocations are accounted, instead of e.g. only crst_table_alloc() and page_table_alloc(). This allows for slightly better profiling data, and the output of /proc/allocinfo is similar to other architectures. Without alloc_hook() wrappers the output of /proc/allocinfo looks like this: 17096704 4174 mm/memory.c:1061 func:folio_prealloc 17809408 4348 mm/memory.c:1063 func:folio_prealloc 0 0 mm/memory.c:4422 func:alloc_swap_folio 0 0 mm/memory.c:4286 func:__alloc_swap_folio 0 0 mm/memory.c:4971 func:alloc_anon_folio ... 1589248 97 arch/s390/mm/pgalloc.c:25 func:crst_table_alloc 0 0 arch/s390/mm/pgalloc.c:124 func:page_table_alloc_pgste 4280320 1045 arch/s390/mm/pgalloc.c:149 func:page_table_alloc With alloc_hook() wrappers: 1097728 268 mm/memory.c:5147 func:__do_fault 20119552 4912 mm/memory.c:1061 func:folio_prealloc 17534976 4281 mm/memory.c:1063 func:folio_prealloc 0 0 mm/memory.c:4422 func:alloc_swap_folio 0 0 mm/memory.c:4286 func:__alloc_swap_folio 786432 192 mm/memory.c:452 func:__pte_alloc 405504 99 mm/memory.c:464 func:__pte_alloc_kernel 1880064 459 mm/memory.c:5525 func:do_fault_around 0 0 mm/memory.c:6403 func:__p4d_alloc 0 0 mm/memory.c:6426 func:__pud_alloc 1064960 65 mm/memory.c:6450 func:__pmd_alloc 0 0 mm/memory.c:4971 func:alloc_anon_folio 0 0 mm/memory.c:5233 func:do_set_pmd [1] commit 2c321f3f70bc ("mm: change inlined allocation helpers to account at the call site") Signed-off-by: Heiko Carstens Acked-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit 72105fc1c1cb67e779fe2da9d22ffae189c00cfc Author: Marco Crivellari Date: Wed Sep 17 17:38:59 2025 +0200 s390: Replace use of system_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue (replaced by system_percpu_wq), but the current code does not benefit from it. Because of that, system_wq has been replaced by system_dfl_wq, the new unbound workqueue. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Heiko Carstens Reviewed-by: Mete Durlu Signed-off-by: Alexander Gordeev commit dbfe205a344a865b9c36706738f45bc554a040c7 Author: Marco Crivellari Date: Wed Sep 17 17:38:58 2025 +0200 s390/diag324: Replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by renaming system_wq to system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit f707d2f7a0c7793406daf0e223bad01bb748343e Author: Marco Crivellari Date: Wed Sep 17 17:38:57 2025 +0200 s390/tape: Add WQ_PERCPU to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Alexander Gordeev Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 64826db1e2e177b58dcbc7cf1e1379527be2185a Author: Harrison Carter Date: Tue Sep 16 16:11:01 2025 +0100 dt-bindings: leds: as3645: Convert to DT schema Convert the ams,as3645a.txt to DT Schema format. Signed-off-by: Harrison Carter Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Lee Jones commit 017bdcdb3af941ca0070580a16162047090edd07 Author: Lukas Bulwahn Date: Fri Sep 12 09:46:38 2025 +0200 MAINTAINERS: Adjust file entry in LOONGSON SECURITY ENGINE DRIVERS Commit 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") adds a driver at drivers/char/tpm/tpm_loongson.c, and commit 74fddd5fbab8 ("MAINTAINERS: Add entry for Loongson Security Engine drivers") adds a new section LOONGSON SECURITY ENGINE DRIVERS intending to refer to that driver. It however adds the entry drivers/char/tpm_loongson.c; note that it misses the tpm subdirectory. Adjust the entry to refer to the intended file. Fixes: 74fddd5fbab8 ("MAINTAINERS: Add entry for Loongson Security Engine drivers") Signed-off-by: Lukas Bulwahn Signed-off-by: Lee Jones commit a727bc0588e77efb502c52d7356e8ed036b6a83e Author: Nathan Chancellor Date: Wed Sep 17 10:09:00 2025 -0700 tpm: loongson: Add bufsiz parameter to tpm_loongson_send() Commit 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") has a semantic conflict with commit 07d8004d6fb9 ("tpm: add bufsiz parameter in the .send callback"), as the former change was developed against a tree without the latter change. This results in a build error: drivers/char/tpm/tpm_loongson.c:48:17: error: initialization of 'int (*)(struct tpm_chip *, u8 *, size_t, size_t)' {aka 'int (*)(struct tpm_chip *, unsigned char *, long unsigned int, long unsigned int)'} from incompatible pointer type 'int (*)(struct tpm_chip *, u8 *, size_t)' {aka 'int (*)(struct tpm_chip *, unsigned char *, long unsigned int)'} [-Wincompatible-pointer-types] 48 | .send = tpm_loongson_send, | ^~~~~~~~~~~~~~~~~ drivers/char/tpm/tpm_loongson.c:48:17: note: (near initialization for 'tpm_loongson_ops.send') drivers/char/tpm/tpm_loongson.c:31:12: note: 'tpm_loongson_send' declared here 31 | static int tpm_loongson_send(struct tpm_chip *chip, u8 *buf, size_t count) | ^~~~~~~~~~~~~~~~~ Add the expected bufsiz parameter to tpm_loongson_send() to resolve the error. Fixes: 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") Signed-off-by: Nathan Chancellor Reviewed-by: Jarkko Sakkinen Signed-off-by: Lee Jones commit 37fac070eb1e59db81a9b3b18340083878a0a2c9 Author: Masahiro Yamada Date: Wed Sep 24 21:47:58 2025 +0200 Documentation: kbuild: note CONFIG_DEBUG_EFI in reproducible builds CONFIG_EFI_DEBUG embeds absolute file paths into object files, which makes the resulting vmlinux specific to the build environment. Add a note about this in reproducible-builds.rst Signed-off-by: Masahiro Yamada Signed-off-by: Nicolas Schier Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20250924-kbuild-doc-config-debug-efi-in-reproducible-builds-v2-1-d2d6b9dcdb7d@kernel.org Signed-off-by: Nathan Chancellor commit dd948aa63ee48e3032804bd10c87a0f4edaa3515 Author: Magnus Karlsson Date: Mon Sep 15 14:01:44 2025 +0200 MAINTAINERS: Delete inactive maintainers from AF_XDP Delete Björn Töpel and Jonathan Lemon as maintainer and reviewer, respectively, as they have not been contributing towards AF_XDP for several years. I have spoken to Björn and he is ok with his removal. Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Reviewed-by: Jason Xing Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250915120148.2922-1-magnus.karlsson@gmail.com commit 12de5f0f6c2d7aad7e60aada650fcfb374c28a5e Merge: bb6a22651b893c 5e9ff9378adcaf Author: Paolo Abeni Date: Thu Sep 25 12:42:52 2025 +0200 Merge branch 'net-gso-restore-outer-ip-ids-correctly' Richard Gobert says: ==================== net: gso: restore outer ip ids correctly GRO currently ignores outer IPv4 header IDs for encapsulated packets that have their don't-fragment flag set. GSO, however, always assumes that outer IP IDs are incrementing. This results in GSO mangling the outer IDs when they aren't incrementing. For example, GSO mangles the outer IDs of IPv6 packets that were converted to IPv4, which must have an ID of 0 according to RFC 6145, sect. 5.1. GRO+GSO is supposed to be entirely transparent by default. GSO already correctly restores inner IDs and IDs of non-encapsulated packets. The tx-tcp-mangleid-segmentation feature can be enabled to allow the mangling of such IDs so that TSO can be used. This series fixes outer ID restoration for encapsulated packets when tx-tcp-mangleid-segmentation is disabled. It also allows GRO to merge packets with fixed IDs that don't have their don't-fragment flag set. v1: https://lore.kernel.org/netdev/20250814114030.7683-1-richardbgobert@gmail.com/ v2: https://lore.kernel.org/netdev/20250819063223.5239-1-richardbgobert@gmail.com/ v3: https://lore.kernel.org/netdev/20250821073047.2091-1-richardbgobert@gmail.com/ v4: https://lore.kernel.org/netdev/20250901113826.6508-1-richardbgobert@gmail.com/ v5: https://lore.kernel.org/netdev/20250915113933.3293-1-richardbgobert@gmail.com/ v6: https://lore.kernel.org/netdev/20250916144841.4884-1-richardbgobert@gmail.com/ v7: https://lore.kernel.org/netdev/20250922084103.4764-1-richardbgobert@gmail.com/ ==================== Link: https://patch.msgid.link/20250923085908.4687-1-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 5e9ff9378adcaff1efd19d31f7be946472df02f8 Author: Richard Gobert Date: Tue Sep 23 10:59:08 2025 +0200 selftests/net: test ipip packets in gro.sh Add IPIP test-cases to the GRO selftest. This selftest already contains IP ID test-cases. They are now also tested for encapsulated packets. This commit also fixes ipip packet generation in the test. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-6-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit f095a358faf263bf1d8ae712bd38e13b71286819 Author: Richard Gobert Date: Tue Sep 23 10:59:07 2025 +0200 net: gro: remove unnecessary df checks Currently, packets with fixed IDs will be merged only if their don't-fragment bit is set. This restriction is unnecessary since packets without the don't-fragment bit will be forwarded as-is even if they were merged together. The merged packets will be segmented into their original forms before being forwarded, either by GSO or by TSO. The IDs will also remain identical unless NETIF_F_TSO_MANGLEID is set, in which case the IDs can become incrementing, which is also fine. Clean up the code by removing the unnecessary don't-fragment checks. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-5-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 3271f19bf7b9df665549666d789b9f126b4420c7 Author: Richard Gobert Date: Tue Sep 23 10:59:06 2025 +0200 net: gso: restore ids of outer ip headers correctly Currently, NETIF_F_TSO_MANGLEID indicates that the inner-most ID can be mangled. Outer IDs can always be mangled. Make GSO preserve outer IDs by default, with NETIF_F_TSO_MANGLEID allowing both inner and outer IDs to be mangled. This commit also modifies a few drivers that use SKB_GSO_FIXEDID directly. Signed-off-by: Richard Gobert Reviewed-by: Edward Cree # for sfc Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-4-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 21f7484220ace6c355cb0023d14d83da6fe5843d Author: Richard Gobert Date: Tue Sep 23 10:59:05 2025 +0200 net: gro: only merge packets with incrementing or fixed outer ids Only merge encapsulated packets if their outer IDs are either incrementing or fixed, just like for inner IDs and IDs of non-encapsulated packets. Add another ip_fixedid bit for a total of two bits: one for outer IDs (and for unencapsulated packets) and one for inner IDs. This commit preserves the current behavior of GSO where only the IDs of the inner-most headers are restored correctly. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-3-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 25c550464acd40803d63868dfa4a42506df48b88 Author: Richard Gobert Date: Tue Sep 23 10:59:04 2025 +0200 net: gro: remove is_ipv6 from napi_gro_cb Remove is_ipv6 from napi_gro_cb and use sk->sk_family instead. This frees up space for another ip_fixedid bit that will be added in the next commit. udp_sock_create always creates either a AF_INET or a AF_INET6 socket, so using sk->sk_family is reliable. In IPv6-FOU, cfg->ipv6_v6only is always enabled. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-2-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit bb6a22651b893c08c7855b34aa618b2a71bece9e Author: Mohsin Bashir Date: Mon Sep 22 16:18:55 2025 -0700 eth: fbnic: Read module EEPROM Add support to read module EEPROM for fbnic. Towards this, add required support to issue a new command to the firmware and to receive the response to the corresponding command. Create a local copy of the data in the completion struct before writing to ethtool_module_eeprom to avoid writing to data in case it is freed. Given that EEPROM pages are small, the overhead of additional copy is negligible. Do not block API with explicit checks since API has appropriate checks in place for length, offset, and page. Explicitly check bank, page, offset, and length in fbnic_fw_parse_qsfp_read_resp() to match EEPROM read responses to the correct request. This is important because if the driver times out waiting for an EEPROM read response, a subsequent read request with different values is susceptible to receiving an erroneous response (i.e., the response to the previous request). Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250922231855.3717483-1-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 45b7f780739a3145aeef24d2dfa02517a6c82ed6 Author: Menglong Dong Date: Wed Sep 17 14:09:16 2025 +0800 sched: Fix some typos in include/linux/preempt.h There are some typos in the comments of migrate in include/linux/preempt.h: elegible -> eligible it's -> its migirate_disable -> migrate_disable abritrary -> arbitrary Just fix them. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 378b7708194fff77c9020392067329931c3fcc04 Author: Menglong Dong Date: Wed Sep 17 14:09:15 2025 +0800 sched: Make migrate_{en,dis}able() inline For now, migrate_enable and migrate_disable are global, which makes them become hotspots in some case. Take BPF for example, the function calling to migrate_enable and migrate_disable in BPF trampoline can introduce significant overhead, and following is the 'perf top' of FENTRY's benchmark (./tools/testing/selftests/bpf/bench trig-fentry): 54.63% bpf_prog_2dcccf652aac1793_bench_trigger_fentry [k] bpf_prog_2dcccf652aac1793_bench_trigger_fentry 10.43% [kernel] [k] migrate_enable 10.07% bpf_trampoline_6442517037 [k] bpf_trampoline_6442517037 8.06% [kernel] [k] __bpf_prog_exit_recur 4.11% libc.so.6 [.] syscall 2.15% [kernel] [k] entry_SYSCALL_64 1.48% [kernel] [k] memchr_inv 1.32% [kernel] [k] fput 1.16% [kernel] [k] _copy_to_user 0.73% [kernel] [k] bpf_prog_test_run_raw_tp So in this commit, we make migrate_enable/migrate_disable inline to obtain better performance. The struct rq is defined internally in kernel/sched/sched.h, and the field "nr_pinned" is accessed in migrate_enable/migrate_disable, which makes it hard to make them inline. Alexei Starovoitov suggests to generate the offset of "nr_pinned" in [1], so we can define the migrate_enable/migrate_disable in include/linux/sched.h and access "this_rq()->nr_pinned" with "(void *)this_rq() + RQ_nr_pinned". The offset of "nr_pinned" is generated in include/generated/rq-offsets.h by kernel/sched/rq-offsets.c. Generally speaking, we move the definition of migrate_enable and migrate_disable to include/linux/sched.h from kernel/sched/core.c. The calling to __set_cpus_allowed_ptr() is leaved in ___migrate_enable(). The "struct rq" is not available in include/linux/sched.h, so we can't access the "runqueues" with this_cpu_ptr(), as the compilation will fail in this_cpu_ptr() -> raw_cpu_ptr() -> __verify_pcpu_ptr(): typeof((ptr) + 0) So we introduce the this_rq_raw() and access the runqueues with arch_raw_cpu_ptr/PERCPU_PTR directly. The variable "runqueues" is not visible in the kernel modules, and export it is not a good idea. As Peter Zijlstra advised in [2], we define and export migrate_enable/migrate_disable in kernel/sched/core.c too, and use them for the modules. Before this patch, the performance of BPF FENTRY is: fentry : 113.030 ± 0.149M/s fentry : 112.501 ± 0.187M/s fentry : 112.828 ± 0.267M/s fentry : 115.287 ± 0.241M/s After this patch, the performance of BPF FENTRY increases to: fentry : 143.644 ± 0.670M/s fentry : 149.764 ± 0.362M/s fentry : 149.642 ± 0.156M/s fentry : 145.263 ± 0.221M/s Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/bpf/CAADnVQ+5sEDKHdsJY5ZsfGDO_1SEhhQWHrt2SMBG5SYyQ+jt7w@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/20250819123214.GH4067720@noisy.programming.kicks-ass.net/ [2] commit 88a90315a99a9120cd471bf681515cc77cd7cdb8 Author: Menglong Dong Date: Wed Sep 17 14:09:14 2025 +0800 rcu: Replace preempt.h with sched.h in include/linux/rcupdate.h In the next commit, we will move the definition of migrate_enable() and migrate_disable() to linux/sched.h. However, migrate_enable/migrate_disable will be used in commit 1b93c03fb319 ("rcu: add rcu_read_lock_dont_migrate()") in bpf-next tree. In order to fix potential compiling error, replace linux/preempt.h with linux/sched.h in include/linux/rcupdate.h. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 35561bab768977c9e05f1f1a9bc00134c85f3e28 Author: Menglong Dong Date: Wed Sep 17 14:09:13 2025 +0800 arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c The include/generated/asm-offsets.h is generated in Kbuild during compiling from arch/SRCARCH/kernel/asm-offsets.c. When we want to generate another similar offset header file, circular dependency can happen. For example, we want to generate a offset file include/generated/test.h, which is included in include/sched/sched.h. If we generate asm-offsets.h first, it will fail, as include/sched/sched.h is included in asm-offsets.c and include/generated/test.h doesn't exist; If we generate test.h first, it can't success neither, as include/generated/asm-offsets.h is included by it. In x86_64, the macro COMPILE_OFFSETS is used to avoid such circular dependency. We can generate asm-offsets.h first, and if the COMPILE_OFFSETS is defined, we don't include the "generated/test.h". And we define the macro COMPILE_OFFSETS for all the asm-offsets.c for this purpose. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 6e65f4e8fc5b02f7a60ebb5b1b83772df0b86663 Merge: d969328c513c66 af075603f27b0f Author: Christian Brauner Date: Thu Sep 25 09:22:09 2025 +0200 Merge patch series "ns: tweak ns common handling" Christian Brauner says: This contains three minor tweaks for namespace handling: * Make struct ns_tree private. There's no need for anything to access that directly. * Drop a debug assert that would trigger in conditions that are benign. * Move the type of the namespace out of struct proc_ns_operations and into struct ns_common. This eliminates a pointer dereference and also allows assertions to work when the namespace type is disabled and the operations field set to NULL. * patches from https://lore.kernel.org/20250924-work-namespaces-fixes-v1-0-8fb682c8678e@kernel.org: ns: drop assert ns: move ns type into struct ns_common nstree: make struct ns_tree private Signed-off-by: Christian Brauner commit af075603f27b0f6e05f1bdf64bad42fa7cfb033b Author: Christian Brauner Date: Wed Sep 24 13:34:00 2025 +0200 ns: drop assert Otherwise we warn when e.g., no namespaces are configured but the initial namespace for is still around. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4055526d35746ce8b04bfa5e14e14f28bb163186 Author: Christian Brauner Date: Wed Sep 24 13:33:59 2025 +0200 ns: move ns type into struct ns_common It's misplaced in struct proc_ns_operations and ns->ops might be NULL if the namespace is compiled out but we still want to know the type of the namespace for the initial namespace struct. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 10cdfcd37ade7ce736bc4a1927680f390a6b1f7b Author: Christian Brauner Date: Wed Sep 24 13:33:58 2025 +0200 nstree: make struct ns_tree private Don't expose it directly. There's no need to do that. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a19239ba14525c26ad097d59fd52cd9198b5bcdb Author: David Howells Date: Wed Sep 24 13:49:49 2025 +0100 afs: Add support for RENAME_NOREPLACE and RENAME_EXCHANGE Add support for RENAME_NOREPLACE and RENAME_EXCHANGE, if the server supports them. The default is translated to YFS.Rename_Replace, falling back to YFS.Rename; RENAME_NOREPLACE is translated to YFS.Rename_NoReplace and RENAME_EXCHANGE to YFS.Rename_Exchange, both of which fall back to reporting EINVAL. Signed-off-by: David Howells Link: https://lore.kernel.org/740476.1758718189@warthog.procyon.org.uk cc: Marc Dionne cc: Dan Carpenter cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner commit fee2f45def0379ed140de4db8f998edb1d78e619 Author: Min Lin Date: Mon Aug 25 18:54:27 2025 +0530 riscv: dts: eswin: add HiFive Premier P550 board device tree Add minimal device tree for HiFive Premier P550 Development board Currently the data populated in this DT file is for UART. Signed-off-by: Min Lin Co-developed-by: Pinkesh Vaghela Signed-off-by: Pinkesh Vaghela Tested-by: Samuel Holland Tested-by: Ariel D'Alessandro Reviewed-by: Samuel Holland Link: https://lore.kernel.org/r/20250825132427.1618089-7-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 3329e2f3b524a6e2baef86236725e407493c46b8 Author: Min Lin Date: Mon Aug 25 18:54:26 2025 +0530 riscv: dts: add initial support for EIC7700 SoC Add initial support for EIC7700 SoC that uses a SiFive Quad-Core P550 CPU cluster. This file is expected to grow as more device drivers are added to the kernel. Signed-off-by: Min Lin Co-developed-by: Pritesh Patel Signed-off-by: Pritesh Patel Co-developed-by: Darshan Prajapati Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Link: https://lore.kernel.org/r/20250825132427.1618089-6-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 21b5a7ace6b2fc2fdee1eda4a802e0abfe192262 Author: Darshan Prajapati Date: Mon Aug 25 18:54:25 2025 +0530 dt-bindings: interrupt-controller: Add ESWIN EIC7700 PLIC Add compatible string for ESWIN EIC7700 PLIC. Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-5-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 3e907d0faa798f612747cbeacb6185e9a4ee4db1 Author: Pritesh Patel Date: Mon Aug 25 18:54:24 2025 +0530 dt-bindings: riscv: Add SiFive HiFive Premier P550 board Add DT binding documentation for the ESWIN EIC7700 SoC and HiFive Premier P550 Board Signed-off-by: Pritesh Patel Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Reviewed-by: Matthias Brugger Reviewed-by: Rob Herring (Arm) Acked-by: Min Lin Link: https://lore.kernel.org/r/20250825132427.1618089-4-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit faaf0ea59713732b66100d8b5440fe40e48b3847 Author: Pinkesh Vaghela Date: Mon Aug 25 18:54:23 2025 +0530 riscv: Add Kconfig option for ESWIN platforms Create a config option to build ESWIN SoC specific resources Signed-off-by: Pinkesh Vaghela Reviewed-by: Samuel Holland Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-3-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit b9607ff0f86ad310f4a5e6ac985b1e89d78fd3ec Author: Darshan Prajapati Date: Mon Aug 25 18:54:22 2025 +0530 dt-bindings: riscv: Add SiFive P550 CPU compatible Update Documentation for supporting SiFive P550 based CPU Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-2-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 6ca282c3e635cd98cc5a9bb24606b41379e1fd8e Author: Pavan S Date: Wed Oct 2 10:46:40 2024 +0300 accel/habanalabs: add Infineon version check On HL338 ASICs, the Infineon first‑stage firmware is not present and the reported version is 0. In this case printing a version number is misleading, as it suggests valid firmware when it does not exist. Fix this by printing the first‑stage Infineon firmware version only if the reported value is non‑zero. This avoids confusing or incorrect log messages on devices where the first stage is not applicable. Signed-off-by: Pavan S Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit a0d866bab184161ba155b352650083bf6695e50e Author: Konstantin Sinyuk Date: Tue Oct 1 15:52:27 2024 +0300 accel/habanalabs/gaudi2: read preboot status after recovering from dirty state Dirty state can occur when the host VM undergoes a reset while the device does not. In such a case, the driver must reset the device before it can be used again. As part of this reset, the device capabilities are zeroed. Therefore, the driver must read the Preboot status again to learn the Preboot state, capabilities, and security configuration. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 65a3f5bc331ca7384900641b46cadff63805c10e Author: Ariel Aviad Date: Tue Sep 24 11:02:49 2024 +0300 accel/habanalabs: add HL_GET_P_STATE passthrough type Add a new passthrough type HL_GET_P_STATE to the cpucp generic ioctl to allow userspace to read the device performance state via firmware. Signed-off-by: Ariel Aviad Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit eeb38d0e91860fb47bc42a2cc44ffd80989a04fc Author: Konstantin Sinyuk Date: Mon Sep 16 15:15:32 2024 +0300 accel/habanalabs: add debugfs interface for HLDIO testing Add debugfs files for NVMe Direct I/O (HLDIO) functionality. This interface allows userspace access to direct SSD ↔ device transfers through debugfs nodes. Four debugfs files are created under /sys/kernel/debug/habanalabs/hlN/: - dio_ssd2hl : trigger SSD-to-device transfers - dio_hl2ssd : trigger device-to-SSD transfers (placeholder, not yet implemented) - dio_stats : show transfer statistics - dio_reset : reset statistics counters Usage examples: # Perform SSD → device transfer echo "fd=3 va=0x10000 off=0 len=4096" > \ /sys/kernel/debug/habanalabs/hl0/dio_ssd2hl # View statistics cat /sys/kernel/debug/habanalabs/hl0/dio_stats # Reset counters echo 1 > /sys/kernel/debug/habanalabs/hl0/dio_reset This interface provides access to HLDIO functionality for validation and diagnostics. Signed-off-by: Konstantin Sinyuk Reviewed-by: Farah Kassabri Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 8cbacc9a2703c661c5e15bfbaeb1d4dcb58eb621 Author: Konstantin Sinyuk Date: Mon Sep 9 18:21:22 2024 +0300 accel/habanalabs: add NVMe Direct I/O (HLDIO) infrastructure Introduce NVMe Direct I/O (HLDIO) infrastructure to support peer‑to‑peer DMA in the habanalabs driver. This adds internal helpers and data structures to enable direct transfers between NVMe storage and device memory. The feature is built only when CONFIG_HL_HLDIO is enabled. A debugfs interface is also provided for functional validation. Signed-off-by: Konstantin Sinyuk Reviewed-by: Farah Kassabri Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 513024d5a0e34fd34247043f1876b6138ca52847 Author: Moti Haimovski Date: Sun Sep 8 15:01:26 2024 +0300 accel/habanalabs: support mapping cb with vmalloc-backed coherent memory When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range. If such an address is mapped without VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the VM_PFNMAP restriction. Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP in the VMA before mapping. This ensures safe mapping and avoids kernel crashes. The memory is still driver-allocated and cannot be accessed directly by userspace. Signed-off-by: Moti Haimovski Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 0668db41b5d8a834a04be3b281fa9452dcf3dc18 Author: Ilia Levi Date: Mon Aug 19 12:13:07 2024 +0300 accel/habanalabs: remove old interface variation of 'access_ok()' The access_ok() API no longer requires the VERIFY_WRITE argument, and the use of the old interface with VERIFY_WRITE is deprecated. Clean up the habanalabs memory manager to use the modern access_ok() interface consistently. This removes old #ifdef guards and aligns the driver with current upstream kernel APIs. Signed-off-by: Ilia Levi Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 0529b191ac9c907225593e12a68f1718a60b2fba Author: Konstantin Sinyuk Date: Thu Aug 15 15:24:24 2024 +0300 accel/habanalabs/gaudi2: use the CPLD_SHUTDOWN event handler After CPLD shutdown event the device is not usable anymore. The common CPLD_SHUTDOWN event handler disables any subsequent device access. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 083c53a85490b4cf5ed63876b09c067358085e20 Author: Konstantin Sinyuk Date: Thu Aug 15 11:24:24 2024 +0300 accel/habanalabs: disable device access after CPLD_SHUTDOWN After a CPLD shutdown event the device becomes unusable. Prevent further device access once this event is received. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit cade027efa9b358719dcb9305b845d905c3eafce Author: Tomer Tayar Date: Wed Jul 31 13:56:34 2024 +0300 accel/habanalabs: fix typo in trace output (cms -> cmd) Fix a typo in TP_printk format string of habanalabs tracepoint: replace "cms" with "cmd". Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit d0dd796becb08b164fb2d791dca4a76127b3e89a Author: Tomer Tayar Date: Thu Jul 25 11:39:58 2024 +0300 accel/habanalabs: clarify ctx use after hl_ctx_put() in dmabuf release In hl_release_dmabuf(), ctx is dereferenced after calling hl_ctx_put() to obtain the compute device file. This is safe because the dma-buf object holds a file reference taken in export_dmabuf(), and the file release (which drops another ctx reference) can only happen after we drop that file reference via fput(). Thus, this hl_ctx_put() call cannot be the last one at this point. Add a comment explaining this to avoid confusion. Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit b5cddeb0dc6521dfee669e74967c6d28b1fd0d9e Author: Sharley Calzolari Date: Thu Jul 18 18:01:52 2024 +0300 accel/habanalabs/gaudi2: add support for logging register accesses from debugfs Add infrastructure for logging the last configuration register accesses that occur via debugfs read/write operations. At interrupt time, these log entries can be dumped to dmesg, which helps in diagnosing the cause of RAZWI and ADDR_DEC interrupts. The logging is implemented as a ring buffer of access entries, with each entry recording timestamp and access details. To ensure correctness under concurrent access, operations are now protected using spinlocks. Entries are copied under lock and then printed after releasing it, which minimizes time spent in the critical section. Signed-off-by: Sharley Calzolari Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 214e26a43f237358eec59c7c4e5ed1eaf2bfe472 Author: Ariel Suller Date: Tue Jun 25 16:26:59 2024 +0300 accel/habanalabs/gaudi2: stringify engine/queue ids Print engine/queue names instead of numerical engine/queue IDs to make logs and debug output more readable. Signed-off-by: Ariel Suller Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 5295be6c4ea4e1ffd38ab0ab131a65afc6b78e9f Author: Vitaly Margolin Date: Sun Jun 23 09:19:15 2024 +0300 accel/habanalabs: add generic message type to get error counters Add a new CPUCP generic message type to retrieve HBM, SRAM and critical error counters from the device. Signed-off-by: Vitaly Margolin Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd Author: Vered Yavniely Date: Tue Jun 18 19:58:30 2024 +0300 accel/habanalabs/gaudi2: fix BMON disable configuration Change the BMON_CR register value back to its original state before enabling, so that BMON does not continue to collect information after being disabled. Signed-off-by: Vered Yavniely Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 Author: Tomer Tayar Date: Sun May 26 16:32:32 2024 +0300 accel/habanalabs: return ENOMEM if less than requested pages were pinned EFAULT is currently returned if less than requested user pages are pinned. This value means a "bad address" which might be confusing to the user, as the address of the given user memory is not necessarily "bad". Modify the return value to ENOMEM, as "out of memory" is more suitable in this case. Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 Author: Qi Xi Date: Tue Sep 9 19:29:10 2025 +0800 once: fix race by moving DO_ONCE to separate section The commit c2c60ea37e5b ("once: use __section(".data.once")") moved DO_ONCE's ___done variable to .data.once section, which conflicts with DO_ONCE_LITE() that also uses the same section. This creates a race condition when clear_warn_once is used: Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) __do_once_start read ___done (false) acquire once_lock execute func __do_once_done write ___done (true) __do_once_start release once_lock // Thread 3 clear_warn_once reset ___done read ___done (false) acquire once_lock execute func schedule once_work __do_once_done once_deferred: OK write ___done (true) static_branch_disable release once_lock schedule once_work once_deferred: BUG_ON(!static_key_enabled) DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning macros. Keep its ___done flag in the .data..once section and allow resetting by clear_warn_once, as originally intended. In contrast, DO_ONCE() is used for functions like get_random_once() and relies on its ___done flag for internal synchronization. We should not reset DO_ONCE() by clear_warn_once. Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, shielding it from clear_warn_once. Fixes: c2c60ea37e5b ("once: use __section(".data.once")") Reported-by: Hulk Robot Signed-off-by: Qi Xi Signed-off-by: Arnd Bergmann commit 9712fe00a7728c64be7e51f05162aafea231a929 Author: Luca Weiss Date: Tue Sep 9 08:02:14 2025 -0700 Input: pm8941-pwrkey - disable wakeup for resin by default 'Resin' (*Res*et *In*put) is usually connected to a volume down button on devices, which is usually not expected to wake up the device from suspend. On the other hand, pwrkey should keep wakeup on. So do not enable wakeup for resin unless the "wakeup-source" property is specified in devicetree. Note, that this does change behavior by turning off wakeup by default for 'resin' and requiring a new dt property to be added to turn it on again. But since this is not expected behavior in the first place, and most users will not expect this, I'd argue this change is acceptable. Signed-off-by: Luca Weiss Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250909-resin-wakeup-v1-2-46159940e02b@lucaweiss.eu Signed-off-by: Dmitry Torokhov commit 95e6b0af80525d14cb35fc664dd3ce5d5756dac1 Author: Luca Weiss Date: Tue Sep 9 07:59:51 2025 -0700 dt-bindings: input: pm8941-pwrkey: Document wakeup-source property The 'resin' keys (usually connected to a volume-down button) are generally not supposed to wake up the device from suspend, so explicitly document a wakeup-source property to enable this wakeup behavior. For 'pwrkey' the default stays that pressing the button does wake up the device from suspend. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250909-resin-wakeup-v1-1-46159940e02b@lucaweiss.eu Signed-off-by: Dmitry Torokhov commit c87a819bec86f9aff695caf79d672082bb123451 Author: Oleh Kuzhylnyi Date: Wed Sep 24 21:43:14 2025 -0700 Input: add driver for Hynitron CST816x series Introduce support for the Hynitron CST816x series touchscreen controller used for 240×240 1.28-inch Round LCD Display Module manufactured by Waveshare Electronics. The driver is designed based on an Arduino implementation marked as under MIT License. This driver is written for a particular round display based on the CST816S controller, which is not compatiable with existing driver for Hynitron controllers. Signed-off-by: Oleh Kuzhylnyi Link: https://lore.kernel.org/r/20250921125939.249788-2-kuzhylol@gmail.com Signed-off-by: Dmitry Torokhov commit 67c9b685c7f8f19b2f449fdd5fb6a0a0c39f429a Author: Oleh Kuzhylnyi Date: Wed Sep 24 21:42:47 2025 -0700 dt-bindings: input: touchscreen: add hynitron cst816x series Add documentation for Hynitron CST816x series touchscreen bindings. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Oleh Kuzhylnyi Link: https://lore.kernel.org/r/20250921125939.249788-1-kuzhylol@gmail.com Signed-off-by: Dmitry Torokhov commit e2d3af0d64e5fe2ee269e8f082642f82bcca3903 Author: Gao Xiang Date: Wed Sep 24 11:28:26 2025 +0800 erofs: drop redundant sanity check for ztailpacking inline It is already performed in z_erofs_map_blocks_fo(). Also align the error message with that used for the uncompressed inline layout. Signed-off-by: Gao Xiang commit 1cf12c7177410afcb53f815315d1247ea57fae4f Author: Bo Liu (OpenAnolis) Date: Tue Sep 23 15:01:12 2025 +0800 erofs: Add support for FS_IOC_GETFSLABEL Add support for reading to the erofs volume label from the FS_IOC_GETFSLABEL ioctls. Signed-off-by: Bo Liu (OpenAnolis) Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit fb641516a6687801fddc25e889bee9ab46e133d7 Author: James Smart Date: Tue Sep 23 08:38:57 2025 -0700 scsi: MAINTAINERS: Update FC element owners I'm relinquishing my maintainer position on the different FC elements. I am updating them to the Emulex folk that have been watching over them for a while. Signed-off-by: James Smart Message-Id: <20250923153857.100616-1-jsmart2021@gmail.com> Signed-off-by: Martin K. Petersen commit 408445e9c1639e41e37876cb9e887cb0fadad381 Merge: 3bd70aec2614a1 7e5a43897aa3e5 Author: Martin K. Petersen Date: Wed Sep 24 22:35:14 2025 -0400 Merge patch series "mpt3sas: Few Enhancements and minor fixes" Ranjan Kumar says: Few Enhancements and minor fixes of mpt3sas driver. Signed-off-by: Martin K. Petersen commit 7e5a43897aa3e5df197475809dd5264cb724474a Author: Ranjan Kumar Date: Mon Sep 22 15:21:13 2025 +0530 scsi: mpt3sas: Update driver version to 54.100.00.00 Updated driver version to 54.100.00.00. Signed-off-by: Ranjan Kumar Message-Id: <20250922095113.281484-5-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen commit 4be7599d6b27bade41bfccca42901b917c01c30c Author: Ranjan Kumar Date: Mon Sep 22 15:21:12 2025 +0530 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in _transport_convert_phy_link_rate(). This maps the new 22.5 Gbps negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link speeds. Signed-off-by: Ranjan Kumar Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen commit 27f0b41de1055a479267ab13e833c704f428f64a Author: Ranjan Kumar Date: Mon Sep 22 15:21:11 2025 +0530 scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGE Avoid unconditional IOCLogInfo prints for CONFIG_INVALID_PAGE. Log only if MPT_DEBUG_REPLY is enabled or when loginfo represents other errors. This reduces uncessary logging without losing useful error reporting. Signed-off-by: Ranjan Kumar Signed-off-by: Martin K. Petersen commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 Author: Ranjan Kumar Date: Mon Sep 22 15:21:10 2025 +0530 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device. Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal. [83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Ranjan Kumar Signed-off-by: Martin K. Petersen commit 3bd70aec2614a1a7ed2dfe83af63a10ebb8229ed Merge: 79dde5f7dc7c03 88f4d3aa29c8b1 Author: Martin K. Petersen Date: Wed Sep 24 22:28:45 2025 -0400 Merge patch series "Add DT-based gear and rate limiting support" Ram Kumar Dwivedi says: This patch series adds support for limiting the maximum high-speed gear and rate used by the UFS controller via device tree properties. Some platforms may have signal integrity, clock configuration, or layout issues that prevent reliable operation at higher gears or rates. This is especially critical in automotive and other platforms where stability is prioritized over peak performance. The series follows this logical progression: 1. Document the new DT properties in the common UFS binding 2. Clean up existing redundant code in the qcom driver 3. Add platform-level parsing support for the new properties 4. Integrate the platform support in the qcom driver This approach makes the functionality available to other UFS host drivers and provides a cleaner, more maintainable implementation. Signed-off-by: Martin K. Petersen commit 88f4d3aa29c8b1944ad506ac92c948258cbc004b Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:33 2025 +0530 scsi: ufs: ufs-qcom: Add support for limiting HS gear and rate Add support to limit Tx/Rx gear and rate during UFS initialization based on DT property. Also update the phy_gear to ensure PHY calibrations align with the required gear and rate. Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit 1cc577e64d68ba0a720329e37aa955c0de297a77 Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:32 2025 +0530 scsi: ufs: pltfrm: Add DT support to limit HS gear and gear rate Introduce parsing of 'limit-hs-gear' and 'limit-gear-rate' device tree properties to restrict high-speed gear and rate during initialization. This is useful in cases where the customer board may have signal integrity, clock configuration or layout issues that prevent reliable operation at higher gears. Such limitations are especially critical in those platforms, where stability is prioritized over peak performance. Co-developed-by: Nitin Rawat Signed-off-by: Nitin Rawat Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit d471a075ae019118fa2e1bd251bad7e98d97b49e Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:31 2025 +0530 scsi: ufs: ufs-qcom: Remove redundant re-assignment to hs_rate Remove the redundant else block that assigns PA_HS_MODE_B to hs_rate, as it is already assigned in ufshcd_init_host_params(). This avoids unnecessary reassignment and prevents overwriting hs_rate when it is explicitly set to a different value. Reviewed-by: Alim Akhtar Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Martin K. Petersen commit 91945660ac29341710b0914db200f6eacf251513 Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:30 2025 +0530 scsi: ufs: dt-bindings: Document gear and rate limit properties Add optional "limit-hs-gear" and "limit-rate" properties to the UFS controller common binding. These properties allow limiting the maximum HS gear and rate. This is useful in cases where the customer board may have signal integrity, clock configuration or layout issues that prevent reliable operation at higher gears. Such limitations are especially critical in those platforms, where stability is prioritized over peak performance. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit 79dde5f7dc7c038eec903745dc1550cd4139980e Author: Zhongqiu Han Date: Wed Sep 17 17:41:43 2025 +0800 scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current implementation relies on the 'pm_qos_enabled' flag, which is insufficient to prevent concurrent access and cannot serve as a proper synchronization mechanism. This has led to data races and list corruption issues. A typical race condition call trace is: [Thread A] ufshcd_pm_qos_exit() --> cpu_latency_qos_remove_request() --> cpu_latency_qos_apply(); --> pm_qos_update_target() --> plist_del <--(1) delete plist node --> memset(req, 0, sizeof(*req)); --> hba->pm_qos_enabled = false; [Thread B] ufshcd_devfreq_target --> ufshcd_devfreq_scale --> ufshcd_scale_clks --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true --> cpu_latency_qos_update_request --> pm_qos_update_target --> plist_del <--(3) plist node use-after-free Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe access to PM QoS resources, including sysfs interface reads. Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver") Signed-off-by: Zhongqiu Han Reviewed-by: Bart Van Assche Tested-by: Huan Tang Signed-off-by: Martin K. Petersen commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba Author: Alok Tiwari Date: Mon Sep 15 11:37:57 2025 -0700 scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() The fc_ct_ms_fill() helper currently formats the OS name and version into entry->value using "%s v%s". Since init_utsname()->sysname and ->release are unbounded strings, snprintf() may attempt to write more than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a -Wformat-truncation warning with W=1. In file included from drivers/scsi/libfc/fc_elsct.c:18: drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’: drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may be truncated writing up to 64 bytes into a region of size between 62 and 126 [-Werror=format-truncation=] 359 | "%s v%s", | ^~ 360 | init_utsname()->sysname, 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between 3 and 131 bytes into a destination of size 128 357 | snprintf((char *)&entry->value, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 358 | FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 359 | "%s v%s", | ~~~~~~~~~ 360 | init_utsname()->sysname, | ~~~~~~~~~~~~~~~~~~~~~~~~ 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by using "%.62s v%.62s", which ensures sysname and release are truncated to fit within the 128-byte field defined by FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN. [mkp: clarified commit description] Signed-off-by: Alok Tiwari Signed-off-by: Martin K. Petersen commit 15968590f07ce127839cb0e5ce002414c5ef067f Author: Liao Yuanhong Date: Tue Sep 2 21:23:46 2025 +0800 scsi: storvsc: Remove redundant ternary operators Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Reviewed-by: Michael Kelley Signed-off-by: Martin K. Petersen commit 253757797973c54ea967f8fd8f40d16e4a78e6d4 Author: Peter Wang Date: Wed Sep 24 17:16:19 2025 +0800 scsi: ufs: core: Change MCQ interrupt enable flow Move the MCQ interrupt enable process to ufshcd_mcq_make_queues_operational() to ensure that interrupts are set correctly when making queues operational, similar to ufshcd_make_hba_operational(). This change addresses the issue where ufshcd_mcq_make_queues_operational() was not fully operational due to missing interrupt enablement. This change only affects host drivers that call ufshcd_mcq_make_queues_operational(), i.e. ufs-mediatek. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 0ac3c901fbeb87d7aaa89e913dbd692dd342c3a8 Author: Thorsten Blum Date: Mon Sep 22 22:18:33 2025 +0200 scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to simplify and improve pqi_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'kernel_buffer' using memset(0). Return early if an error occurs. No functional changes intended. Signed-off-by: Thorsten Blum Acked-by: Don Brace Message-Id: <20250922201832.1697874-2-thorsten.blum@linux.dev> Signed-off-by: Martin K. Petersen commit ac01fc418f586c6a6e5582da16de7324e9c6391a Author: Thorsten Blum Date: Tue Sep 23 19:15:04 2025 +0200 scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to improve and simplify hpsa_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff' using memset(0). Return early if an error occurs and remove the 'out_kfree' label. No functional changes intended. Signed-off-by: Thorsten Blum Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 Author: Anup Patel Date: Mon Aug 18 09:39:03 2025 +0530 mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver Add a mailbox controller driver for the new SBI message proxy extension which is part of the SBI v3.0 specification. Acked-by: Jassi Brar Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-8-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 6f01c24f3a7525e953d514367a6d91b39c8f1f6a Author: Anup Patel Date: Mon Aug 18 09:39:02 2025 +0530 byteorder: Add memcpy_to_le32() and memcpy_from_le32() Add common memcpy APIs for copying u32 array to/from __le32 array. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Anup Patel Reviewed-by: Linus Walleij Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-7-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit ba879dfc0574878f3e08f217b2b4fdf845c426c0 Author: Anup Patel Date: Mon Aug 18 09:39:01 2025 +0530 mailbox: Allow controller specific mapping using fwnode Introduce optional fw_node() callback which allows a mailbox controller driver to provide controller specific mapping using fwnode. The Linux OF framework already implements fwnode operations for the Linux DD framework so the fw_xlate() callback works fine with device tree as well. Acked-by: Jassi Brar Reviewed-by: Andy Shevchenko Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-6-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit b81296591c567b12d3873b05a37b975707959b94 Author: Thorsten Blum Date: Fri Sep 19 11:26:37 2025 +0200 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally. Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0). Cc: stable@vger.kernel.org Fixes: edd163687ea5 ("[SCSI] hpsa: add driver for HP Smart Array controllers.") Signed-off-by: Thorsten Blum Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit a1f1f2422e098485b09e55a492de05cf97f9954d Merge: 5de92bd0d7543f b9c8a2c5670a92 Author: Jakub Kicinski Date: Wed Sep 24 18:13:05 2025 -0700 Merge branch 'convert-3-drivers-to-ndo_hwtstamp-api' Vadim Fedorenko says: ==================== convert 3 drivers to ndo_hwtstamp API Convert tg3, bnxt_en and mlx5 to use ndo_hwtstamp API. These 3 drivers were chosen because I have access to the HW and is able to test the changes. Also there is a selftest provided to validated that the driver correctly sets up timestamp configuration, according to what is exposed as supported by the hardware. Selftest allows driver to fallback to some wider scope of RX timestamping, i.e. it allows the driver to set up ptpv2-event filter when ptpv2-l2-event is requested. ==================== Link: https://patch.msgid.link/20250923173310.139623-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit b9c8a2c5670a92f1cb3ad7d88cd8e274160b59d6 Author: Vadim Fedorenko Date: Tue Sep 23 17:33:10 2025 +0000 selftests: drv-net: add HW timestamping tests Add simple tests to validate that the driver sets up timestamping configuration according to what is reported in capabilities. For RX timestamping we allow driver to fallback to wider scope for timestamping if filter is applied. That actually means that driver can enable ptpv2-event when it reports ptpv2-l4-event is supported, but not vice versa. Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit bd94c3649b6bf2c1a556d8fa2ffda56ab9d36414 Author: Vadim Fedorenko Date: Tue Sep 23 17:33:08 2025 +0000 bnxt_en: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() Convert bnxt dirver to use new timestamping configuration API. Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit de0aa209b9355afc46f3f5a25e588e552e12f43b Author: Vadim Fedorenko Date: Tue Sep 23 17:33:07 2025 +0000 tg3: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() Convert tg3 driver to new timestamping configuration API. Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 5de92bd0d7543f04e6f495103b69644f6e8e8d70 Author: Bagas Sanjaya Date: Mon Sep 22 19:41:37 2025 +0700 Documentation: rxrpc: Demote three sections Three sections ("Socket Options", "Security", and "Example Client Usage") use title headings, which increase number of entries in the networking docs toctree by three, and also make the rest of sections headed under "Example Client Usage". Demote these sections back to section headings. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Acked-by: David Howells Link: https://patch.msgid.link/20250922124137.5266-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit cf7f0e3bd9fa9f359fc73544a4f2ce0e95301401 Author: Horatiu Vultur Date: Mon Sep 22 15:03:14 2025 +0200 net: phy: micrel: Fix default LED behaviour By default the LED will be ON when there is a link but they are not blinking when there is any traffic activity. Therefore change this to blink when there is any traffic. Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250922130314.758229-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit c7ab8024ca124afa8eab9a07a470a34676efe123 Merge: 74eecb7c62d10f c5ba345b2d358b Author: Jakub Kicinski Date: Wed Sep 24 17:45:14 2025 -0700 Merge tag 'nf-next-25-09-24' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: fixes for net-next These fixes target next because the bug is either not severe or has existed for so long that there is no reason to cram them in at the last minute. 1) Fix IPVS ftp unregistering during netns cleanup, broken since netns support was introduced in 2011 in the 2.6.39 kernel. From Slavin Liu. 2) nfnetlink must reset the 'nlh' pointer back to the original address when a batch is replayed, else we emit bogus ACK messages and conceal real errno from userspace. From Fernando Fernandez Mancera. This was broken since 6.10. 3) Recent fix for nftables 'pipapo' set type was incomplete, it only made things work for the AVX2 version of the algorithm. 4) Testing revealed another problem with avx2 version that results in out-of-bounds read access, this bug always existed since feature was added in 5.7 kernel. This also comes with a selftest update. Last fix resolves a long-standing bug (since 4.9) in conntrack /proc interface: Decrease skip count when we reap an expired entry during dump. As-is we erronously elide one conntrack entry from dump for every expired entry seen. From Eric Dumazet. * tag 'nf-next-25-09-24' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack selftests: netfilter: nft_concat_range.sh: add check for double-create bug netfilter: nft_set_pipapo_avx2: fix skip of expired entries netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups netfilter: nfnetlink: reset nlh pointer during batch replay ipvs: Defer ip_vs_ftp unregister during netns cleanup ==================== Link: https://patch.msgid.link/20250924140654.10210-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 74eecb7c62d10f1feeb0a0d56bed605b7804a51a Merge: 1d7e0832509004 50acea3662bf54 Author: Jakub Kicinski Date: Wed Sep 24 17:40:29 2025 -0700 Merge branch 'net-stmmac-yet-more-cleanups' Russell King says: ==================== net: stmmac: yet more cleanups Building on the previous cleanup series, this cleans up yet more stmmac code. - Move stmmac_bus_clks_config() into stmmac_platform() which is where its onlny user is. - Move the xpcs Clause 73 test into stmmac_init_phy(), resulting in simpler code in __stmmac_open(). - Move "can't attach PHY" error message into stmmac_init_phy(). We then start moving stuff out of __stmac_open() into stmmac_open() (and correspondingly __stmmac_release() into stmmac_release()) which is not necessary when re-initialising the interface on e.g. MTU change. - Move initialisation of tx_lpi_timer - Move PHY attachment/detachment - Move PHY error message into stmmac_init_phy() Finally, simplfy the paths in stmmac_init_phy(). ==================== Link: https://patch.msgid.link/aNKDqqI7aLsuDD52@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 50acea3662bf54f3ea2cb6ca2db66ca3b1a0a0ee Author: Russell King (Oracle) Date: Tue Sep 23 12:26:24 2025 +0100 net: stmmac: simplify stmmac_init_phy() If we fail to attach a PHY, there is no point trying to configure WoL settings. Exit the function after printing the "cannot attach to PHY" error, and remove the now unnecessary code indentation for configuring the LPI timer in phylink. Since we know that "ret" must be zero at this point, change the final return to use a constant rather than "ret". Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v11A8-0000000774M-3pmH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit db299a0c09e98e5fc7e7b181d7f2b94560330a8c Author: Russell King (Oracle) Date: Tue Sep 23 12:26:19 2025 +0100 net: stmmac: move PHY handling out of __stmmac_open()/release() Move the PHY attachment/detachment from the network driver out of __stmmac_open() and __stmmac_release() into stmmac_open() and stmmac_release() where these actions will only happen when the interface is administratively brought up or down. It does not make sense to detach and re-attach the PHY during a change of MTU. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v11A3-0000000774G-3PKY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bae62989a31bde4018dc007b01d7cb408ccc91d7 Author: Russell King (Oracle) Date: Tue Sep 23 12:26:14 2025 +0100 net: stmmac: move initialisation of priv->tx_lpi_timer to stmmac_open() The initialisation of priv->tx_lpi_timer only happens once during the lifetime of the driver, which is during the initial administrative open of the device. Move this initialisation out of __stmmac_open() into stmmac_open(). Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119y-0000000774A-2vvl@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9641d727162d674902c7107eeab23a7849d5ff09 Author: Russell King (Oracle) Date: Tue Sep 23 12:26:09 2025 +0100 net: stmmac: move PHY attachment error message into stmmac_init_phy() Move the "cannot attach to PHY" error message into stmmac_init_phy() so we don't end up with multiple error messages printed when things go wrong. Drop the function name from the message, and use %pe to print the error code description rather than just a number. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119t-00000007744-2SxG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f005ec4a3d6bcbfac74069661a06dba2880f84fd Author: Russell King (Oracle) Date: Tue Sep 23 12:26:04 2025 +0100 net: stmmac: move xpcs clause 73 test into stmmac_init_phy() We avoid binding a PHY if the XPCS is using clause 73 negotiation. Rather than having this complexity in __stmmac_open(), move it to stmmac_init_phy() instead. There is no point checking the XPCS state this unless phylink wants a PHY, so place this appropriately. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119o-0000000773y-21gs@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 79d6e14e9cb3c9b8152c514e64674e820b5e9dce Author: Russell King (Oracle) Date: Tue Sep 23 12:25:59 2025 +0100 net: stmmac: move stmmac_bus_clks_config() to stmmac_platform.c stmmac_bus_clks_config() is only used by stmmac_platform.c, so rather than having it in stmmac_main.c and needing to export the symbol, move it to where it's used. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119j-0000000773s-1R2v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 217f92d91c9faeb6b78bd6205b3585944cbcb433 Author: Igor Belwon Date: Sat Sep 20 19:22:52 2025 +0200 dt-bindings: i2c: i2c-mt65xx: Document MediaTek MT6878 I2C Document the I2C controllers found in the MediaTek MT6878 SoC, by adding a new compatible string for the controllers. Their design is compatible with the design from the MediaTek MT8188 SoC. Signed-off-by: Igor Belwon Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250920-mt6878-i2c-bringup-v2-1-70a951f10be9@mentallysanemainliners.org Signed-off-by: Andi Shyti commit 25aab8f3ce56fd3cdf921c206ce42d1cdede5259 Author: Krzysztof Kozlowski Date: Sat Aug 30 12:36:03 2025 +0200 dt-bindings: i2c: samsung,s3c2410-i2c: Drop S3C2410 Samsung S3C2410 SoC was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of "samsung,s3c2410-i2c" compatible. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250830103601.82046-4-krzysztof.kozlowski@linaro.org commit f2b6b51d21ce7b84bc01d252b451684b86ad1cdc Author: Krzysztof Kozlowski Date: Sat Aug 30 12:36:02 2025 +0200 i2c: s3c2410: Drop S3C2410 OF support Samsung S3C2410 SoC was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of "samsung,s3c2410-i2c" compatible. However, there is still a user of "s3c2410-i2c" platform device ID, S3C64xx platform, so that part needs to stay. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250830103601.82046-3-krzysztof.kozlowski@linaro.org commit 15c5867b0ae6a47914b45daf3b64e2d2aceb4ee5 Author: Ilpo Järvinen Date: Wed Sep 24 16:56:41 2025 +0300 PCI: Don't print stale information about resource pbus_size_mem() logs the bridge window resource using pci_info() before the start and end fields of the resource have been updated which then prints stale information. Set resource addresses earlier to make understanding logs easier. Regrettably, this results in setting the addresses multiple times but that seems unavoidable. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250924135641.3399-1-ilpo.jarvinen@linux.intel.com commit f32a26fab3672e60f622bd7461bf978fc72f29ec Author: Viacheslav Dubeyko Date: Wed Sep 24 16:24:41 2025 -0700 hfs/hfsplus: rework debug output subsystem Currently, HFS/HFS+ has very obsolete and inconvenient debug output subsystem. Also, the code is duplicated in HFS and HFS+ driver. This patch introduces linux/hfs_common.h for gathering common declarations, inline functions, and common short methods. Currently, this file contains only hfs_dbg() function that employs pr_debug() with the goal to print a debug-level messages conditionally. So, now, it is possible to enable the debug output by means of: echo 'file extent.c +p' > /proc/dynamic_debug/control echo 'func hfsplus_evict_inode +p' > /proc/dynamic_debug/control And debug output looks like this: hfs: pid 5831:fs/hfs/catalog.c:228 hfs_cat_delete(): delete_cat: 00,48 hfs: pid 5831:fs/hfs/extent.c:484 hfs_file_truncate(): truncate: 48, 409600 -> 0 hfs: pid 5831:fs/hfs/extent.c:212 hfs_dump_extent(): hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 78:4 hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 0:0 hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 0:0 v4 Debug messages have been reworked and information about new HFS/HFS+ shared declarations file has been added to MAINTAINERS file. v5 Yangtao Li suggested to clean up debug output and fix several typos. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org cc: Johannes Thumshirn Signed-off-by: Viacheslav Dubeyko commit 1d7e08325090045b6b08ecda6f9eaa471d309880 Author: J. Neuschäfer Date: Tue Sep 23 01:10:01 2025 +0200 dt-bindings: net: ethernet-controller: Fix grammar in comment "difference" is a noun, so "sufficient" is an adjective without "ly". Signed-off-by: J. Neuschäfer Reviewed-by: Andrew Lunn Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250923-dt-net-typo-v1-1-08e1bdd14c74@posteo.net Signed-off-by: Jakub Kicinski commit b6db19d1df8a75b5f05f5fe487cbd09f48760a3c Author: Gustavo A. R. Silva Date: Tue Sep 23 22:45:10 2025 +0200 tls: Avoid -Wflex-array-member-not-at-end warning Remove unused flexible-array member in struct tls_rec and, with this, fix the following warning: net/tls/tls.h:131:29: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Also, add a comment to prevent people from adding any members after struct aead_request, which is a flexible structure --this is a structure that ends in a flexible-array member. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/aNMG1lyXw4XEAVaE@kspp Signed-off-by: Jakub Kicinski commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 Author: Kaushlendra Kumar Date: Wed Sep 17 10:38:20 2025 +0530 tools/cpupower: Fix incorrect size in cpuidle_state_disable() Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable(). The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer. Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file. This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs. Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Signed-off-by: Shuah Khan commit 340974c4f709ce8142a672ab11f1889dff94d6dc Author: Anup Patel Date: Mon Aug 18 09:39:00 2025 +0530 mailbox: Add common header for RPMI messages sent via mailbox The RPMI based mailbox controller drivers and mailbox clients need to share defines related to RPMI messages over mailbox interface so add a common header for this purpose. Acked-by: Jassi Brar Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-5-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 508da38677a67ed9aa87c3cf32807284f293c304 Author: Anup Patel Date: Mon Aug 18 09:38:59 2025 +0530 RISC-V: Add defines for the SBI message proxy extension Add defines for the new SBI message proxy extension which is part of the SBI v3.0 specification. Reviewed-by: Atish Patra Reviewed-by: Andy Shevchenko Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-4-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 581b4da1f73c9e0caf9b7d0a46d1b5a0b36fbe20 Author: Anup Patel Date: Mon Aug 18 09:38:58 2025 +0530 dt-bindings: mailbox: Add bindings for RISC-V SBI MPXY extension Add device tree bindings for the RISC-V SBI Message Proxy (MPXY) extension as a mailbox controller. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-3-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 23ef9d439769d5f35353650e771c63d13824235b Author: Kees Cook Date: Tue Sep 23 14:34:19 2025 -0700 kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI The kernel's CFI implementation uses the KCFI ABI specifically, and is not strictly tied to a particular compiler. In preparation for GCC supporting KCFI, rename CONFIG_CFI_CLANG to CONFIG_CFI (along with associated options). Use new "transitional" Kconfig option for old CONFIG_CFI_CLANG that will enable CONFIG_CFI during olddefconfig. Reviewed-by: Linus Walleij Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-3-kees@kernel.org Signed-off-by: Kees Cook commit 072c3547979053c575e819070074911b3d0bd4fb Merge: 2136c694a045c3 3df7ce0e43ad94 Author: Arnd Bergmann Date: Wed Sep 24 23:26:53 2025 +0200 Merge tag 'riscv-config-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/defconfig RISC-V config for v6.18 Enable the MMP_PDMA driver as a module in defconfig builds, where it is needed by Spacemit K1 boards. This depends on a savedefconfig reorder that it'd otherwise conflict with, so that's here too. Signed-off-by: Conor Dooley * tag 'riscv-config-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: defconfig: Enable MMP_PDMA support for SpacemiT K1 SoC riscv: defconfig: run savedefconfig to reorder it Link: https://lore.kernel.org/r/20250924-unenvied-armful-5fcc80c23d19@spud Signed-off-by: Arnd Bergmann commit 8c0650e0cef283fb31aca5dc7c72b891ff121a88 Merge: 0d4495122a5e0e 4cce8b2503ab50 Author: Arnd Bergmann Date: Wed Sep 24 23:22:49 2025 +0200 Merge tag 'riscv-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Misc Devicetrees for v6.18 Starfive: The main new addition is support for the JH7110 Milk-V Mars CM lite SoM. Other than that, there's several cleanups done to the common JH7110 dtsi file, some relating to properties used by U-Boot or encountered during U-Boot development. Additionally, there's a binding and devicetree node for the memory controller on the JH7110. The memory controller only sees use in U-Boot, so the binding is here rather than in Krzysztof's branch. SiFive: Support for SiFive vendor-specific extensions in the binding file for extensions. These currently only see use in the SBI implementation. Microchip: Addition of support for the PolarFire SoC Discovery kit and non-engineering sample Icicle kit. The latter differs very slightly from the final ES devices due to bug fixes affecting functionality, and needs its own dts. To reduce duplication, the common portion of the two Icicle kits are moved into a dtsi. There's a few minor fixes here too, mostly low-hanging fruit detected during the addition of the Discovery kit that were then applied to the Icicle. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: starfive: add Milk-V Mars CM Lite system-on-module dt-bindings: riscv: starfive: add milkv,marscm-lite riscv: dts: starfive: add Milk-V Mars CM system-on-module dt-bindings: riscv: starfive: add milkv,marscm-emmc riscv: dts: starfive: add common board dtsi for Milk-V Mars CM variants riscv: dts: microchip: add a device tree for Discovery Kit dt-bindings: riscv: microchip: document Discovery Kit riscv: dts: microchip: rename icicle kit ccc clock and other minor fixes riscv: dts: microchip: add icicle kit with production device dt-bindings: riscv: microchip: document icicle kit with production device riscv: dts: microchip: add common board dtsi for icicle kit variants riscv: dts: starfive: jh7110-common: drop mmc post-power-on-delay-ms riscv: dts: starfive: jh7110-common: drop no-mmc property from mmc1 riscv: dts: starfive: jh7110: bootph-pre-ram hinting needed by boot loader riscv: dts: starfive: jh7110: add DMC memory controller dt-bindings: memory-controllers: add StarFive JH7110 SoC DMC riscv: dts: starfive: jh7110-common: drop no-sdio property from mmc1 riscv: dts: microchip: Minor whitespace cleanup dt-bindings: riscv: Add SiFive vendor extensions description Link: https://lore.kernel.org/r/20250924-frighten-magazine-ee2f16e64638@spud Signed-off-by: Arnd Bergmann commit f9afce4f32e9a120fc902fa6c9e0b90ad799a6ec Author: Kees Cook Date: Tue Sep 23 14:34:18 2025 -0700 kconfig: Add transitional symbol attribute for migration support During kernel option migrations (e.g. CONFIG_CFI_CLANG to CONFIG_CFI), existing .config files need to maintain backward compatibility while preventing deprecated options from appearing in newly generated configurations. This is challenging with existing Kconfig mechanisms because: 1. Simply removing old options breaks existing .config files. 2. Manually listing an option as "deprecated" leaves it needlessly visible and still writes them to new .config files. 3. Using any method to remove visibility (.e.g no 'prompt', 'if n', etc) prevents the option from being processed at all. Add a "transitional" attribute that creates symbols which are: - Processed during configuration (can influence other symbols' defaults) - Hidden from user menus (no prompts appear) - Omitted from newly written .config files (gets migrated) - Restricted to only having help sections (no defaults, selects, etc) making it truly just a "prior value pass-through" option. The transitional syntax requires a type argument and prevents type redefinition: config NEW_OPTION bool "New option" default OLD_OPTION config OLD_OPTION bool transitional help Transitional config for OLD_OPTION migration. This allows seamless migration: olddefconfig processes existing CONFIG_OLD_OPTION=y settings to enable CONFIG_NEW_OPTION=y, while CONFIG_OLD_OPTION is omitted from newly generated .config files. Added positive and negative testing via "testconfig" make target. Co-developed-by: Vegard Nossum Signed-off-by: Vegard Nossum Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-2-kees@kernel.org Signed-off-by: Kees Cook commit 64f4ea200eca05a248533b8374d7b5f0756a3990 Author: Kees Cook Date: Tue Sep 23 14:34:17 2025 -0700 kconfig: Fix BrokenPipeError warnings in selftests The kconfig test harness ("make testconfig") was generating BrokenPipeError warnings when running interactive tests like oldaskconfig and oldconfig: /usr/lib/python3/dist-packages/_pytest/unraisableexception.py:85: PytestUnraisableExceptionWarning: Exception ignored in: <_io.BufferedWriter name=12> Traceback (most recent call last): File "/srv/code/scripts/kconfig/tests/conftest.py", line 127, in oldaskconfig return self._run_conf('--oldaskconfig', dot_config=dot_config, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ interactive=True, in_keys=in_keys) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ BrokenPipeError: [Errno 32] Broken pipe The issue occurred when the test framework attempted to write to stdin after the conf subprocess had already exited. Wrap stdin write operations in try/except to catch BrokenPipeError and stop sending more input. Add explicit flush() after writes so we can see delivery errors immediately. Ignore BrokenPipeError when closing stdin. Explicitly call wait() to validate subprocess termination. Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-1-kees@kernel.org Signed-off-by: Kees Cook commit 5042e57d39719e531f3e122f12bf320869e84782 Author: Dario Binacchi Date: Tue Sep 23 16:37:37 2025 +0200 Input: imx6ul_tsc - set glitch threshold by DTS property Set the glitch threshold by DTS property and keep the existing default behavior if the 'debounce-delay-us' is not present. Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250923143746.2857292-7-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 3fccd1f9552dd073915b0a69d43cc03c582ce79b Author: Dario Binacchi Date: Tue Sep 23 16:37:35 2025 +0200 dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold Support the debounce-delay-us property. Drivers must convert this value to IPG clock cycles and map it to one of the four discrete thresholds exposed by the TSC_DEBUG_MODE2 register: 0: 8191 IPG cycles 1: 4095 IPG cycles 2: 2047 IPG cycles 3: 1023 IPG cycles Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250923143746.2857292-5-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit cf6f234d7dfbbb13197eb71e7716412d4e30988d Author: Dario Binacchi Date: Tue Sep 23 16:37:34 2025 +0200 dt-bindings: touchscreen: add debounce-delay-us property Add support for glitch delay configuration. A detected signal is valid only if it remains stable longer than the configured delay; otherwise, it is considered a glitch. This property was introduced for the i.MX6UL touchscreen controller (TSC), which provides a hardware deglitch filter with four thresholds depending on the IPG clock frequency. In this use case, the IPG clock rate is 66 MHz, resulting in thresholds of 124 µs, 62 µs, 31 µs, and 15 µs, which requires a property with microsecond-level resolution. Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250923143746.2857292-4-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit c4ebd661282df563a0c83acacbc35cfd4d8da541 Merge: a53811fb37d306 941327ca5ddd45 Author: Arnd Bergmann Date: Wed Sep 24 23:17:20 2025 +0200 Merge tag 'riscv-cache-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers RISC-V cache drivers for v6.18 sifive: Reduce the number of fences issued while flushing. Samuel reports that this is approximately a 15% speed-up. ax45mp: Fix the binding so that it permits the cache-sets setting used by the recently added QiLai SoC. Signed-off-by: Conor Dooley * tag 'riscv-cache-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: cache: sifive_ccache: Optimize cache flushes dt-bindings: cache: ax45mp: add 2048 as a supported cache-sets value Link: https://lore.kernel.org/r/20250924-relenting-aqua-a4a93b89809e@spud Signed-off-by: Arnd Bergmann commit a53811fb37d30622db1fdfc37feb40a3190b9731 Merge: 0a8c31049107ed 5498f07842cbdd Author: Arnd Bergmann Date: Wed Sep 24 23:16:12 2025 +0200 Merge tag 'soc_fsl-6.18-1' of https://github.com/chleroy/linux into soc/drivers FSL SOC Changes for 6.18: - Use for_each_online_cpu() instead of for_each_cpu() in qbman - Update FSL QUICC ENGINE GPIO driver to a standard platform driver and stop using legacy-of-mm-gpiochip.h header - Misc fixes on bus/fsl-mc * tag 'soc_fsl-6.18-1' of https://github.com/chleroy/linux: soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu() soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver soc: fsl: qe: Change GPIO driver to a proper platform driver bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions bus: fsl-mc: Check return value of platform_get_resource() Link: https://lore.kernel.org/r/26615a15-3494-435f-b0c1-861122b4b5e1@csgroup.eu Signed-off-by: Arnd Bergmann commit 0a8c31049107ed39a68d21849e7b1b87856b240e Merge: ff0bebab778c74 d5cf5b37064b16 Author: Arnd Bergmann Date: Wed Sep 24 23:12:17 2025 +0200 Merge tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE fix2 for v6.17 Fixing incorrect error handling for a call to iov_iter_extract_pages(). * tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: fix register_shm_helper() Link: https://lore.kernel.org/r/20250924083404.GA3747732@rayden Signed-off-by: Arnd Bergmann commit 7b1f8e7671ebe3cd8899aef17db870e9eba938a3 Author: J. Neuschäfer Date: Tue Sep 23 02:14:50 2025 +0200 Input: ps2-gpio - fix typo "The data line must be sampled" makes much more sense than what was previously written, and given that "s" and "d" are neighbors on the QWERTY keybord, it was probably a typo. Signed-off-by: J. Neuschäfer Link: https://lore.kernel.org/r/20250923-ps2-typo-v1-1-03d2468acc32@posteo.net Signed-off-by: Dmitry Torokhov commit 5cf952c54f3546f904ded645aecc1788d1090bd2 Author: Srinivas Pandruvada Date: Tue Sep 23 13:56:31 2025 -0700 thermal: intel: int340x: Power Slider: Validate slider_balance range When the module parameter slider_balance is set to the performance slider value of 0, the SoC slider profile switches to the performance mode. This can cause the Linux power-profiles-daemon to change the system power mode to performance from balanced mode. This happens when there is only one platform profile registered as there will be no conflict with other platform profiles. Same issue occurs when the slider_balance is set to the power-saver slider value. Prevent module parameter slider_balance from overlapping with performance and power-saver slider values by adding range validation. Return an error when an invalid value is provided. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250923205631.3056590-1-srinivas.pandruvada@linux.intel.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit d3f8f8d03061d2706f8410aea7811acee65dc1f5 Merge: c51f0d3b6ef1d1 e3f761be5a178b Author: Rafael J. Wysocki Date: Wed Sep 24 21:33:56 2025 +0200 Merge tag 'amd-pstate-v6.18-2025-09-24' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Merge amd-pstate content for 6.18 from Mario Limonciello: "* Fix for amd_pstate_trace package references" * tag 'amd-pstate-v6.18-2025-09-24' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names commit c51f0d3b6ef1d1e40b6d7a5db76fadc034a98109 Merge: 4ea5af08590825 9a1aa642c1fb5a Author: Rafael J. Wysocki Date: Wed Sep 24 21:32:28 2025 +0200 Merge back earlier cpufreq material for 6.18 commit f8c9ad46b00453a8c075453f3745f8d263f44834 Author: Vidya Sagar Date: Mon Sep 22 16:08:26 2025 +0200 PCI: tegra194: Handle errors in BPMP response The return value from tegra_bpmp_transfer() indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code. If we don't have error handling for tegra_bpmp_transfer(), we will set the pcie->ep_state to EP_STATE_ENABLED even when the tegra_bpmp_transfer() command fails. Thus, the pcie->ep_state will get out of sync with reality, and any further PERST# assert + deassert will be a no-op and will not trigger the hardware initialization sequence. This is because pex_ep_event_pex_rst_deassert() checks the current pcie->ep_state, and does nothing if the current state is already EP_STATE_ENABLED. Thus, it is important to have error handling for tegra_bpmp_transfer(), such that the pcie->ep_state can not get out of sync with reality, so that we will try to initialize the hardware not only during the first PERST# assert + deassert, but also during any succeeding PERST# assert + deassert. One example where this fix is needed is when using a rock5b as host. During the initial PERST# assert + deassert (triggered by the bootloader on the rock5b) pex_ep_event_pex_rst_deassert() will get called, but for some unknown reason, the tegra_bpmp_transfer() call to initialize the PHY fails. Once Linux has been loaded on the rock5b, the PCIe driver will once again assert + deassert PERST#. However, without tegra_bpmp_transfer() error handling, this second PERST# assert + deassert will not trigger the hardware initialization sequence. With tegra_bpmp_transfer() error handling, the second PERST# assert + deassert will once again trigger the hardware to be initialized and this time the tegra_bpmp_transfer() succeeds. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Vidya Sagar [cassel: improve commit log] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Jon Hunter Acked-by: Thierry Reding Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-8-cassel@kernel.org commit 42f9c66a6d0cc45758dab77233c5460e1cf003df Author: Niklas Cassel Date: Mon Sep 22 16:08:25 2025 +0200 PCI: tegra194: Reset BARs when running in PCIe endpoint mode Tegra already defines all BARs except BAR0 as BAR_RESERVED. This is sufficient for pci-epf-test to not allocate backing memory and to not call set_bar() for those BARs. However, marking a BAR as BAR_RESERVED does not mean that the BAR gets disabled. The host side driver, pci_endpoint_test, simply does an ioremap for all enabled BARs and will run tests against all enabled BARs, so it will run tests against the BARs marked as BAR_RESERVED. After running the BAR tests (which will write to all enabled BARs), the inbound address translation is broken. This is because the tegra controller exposes the ATU Port Logic Structure in BAR4, so when BAR4 is written, the inbound address translation settings get overwritten. To avoid this, implement the dw_pcie_ep_ops .init() callback and start off by disabling all BARs (pci-epf-test will later enable/configure BARs that are not defined as BAR_RESERVED). This matches the behavior of other PCIe endpoint drivers: dra7xx, imx6, layerscape-ep, artpec6, dw-rockchip, qcom-ep, rcar-gen4, and uniphier-ep. With this, the PCI endpoint kselftest test case CONSECUTIVE_BAR_TEST (which was specifically made to detect address translation issues) passes. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-7-cassel@kernel.org commit 48991e4935078b05f80616c75d1ee2ea3ae18e58 Author: Brian Norris Date: Wed Sep 24 09:57:11 2025 -0700 PCI/sysfs: Ensure devices are powered for config reads The "max_link_width", "current_link_speed", "current_link_width", "secondary_bus_number", and "subordinate_bus_number" sysfs files all access config registers, but they don't check the runtime PM state. If the device is in D3cold or a parent bridge is suspended, we may see -EINVAL, bogus values, or worse, depending on implementation details. Wrap these access in pci_config_pm_runtime_{get,put}() like most of the rest of the similar sysfs attributes. Notably, "max_link_speed" does not access config registers; it returns a cached value since d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds"). Fixes: 56c1af4606f0 ("PCI: Add sysfs max_link_speed/width, current_link_speed/width, etc") Signed-off-by: Brian Norris Signed-off-by: Brian Norris Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250924095711.v2.1.Ibb5b6ca1e2c059e04ec53140cd98a44f2684c668@changeid commit 10fd0285305d0b48e8a3bf15d4f17fc4f3d68cb6 Merge: 181ce6b01ad52a b02a2c060b6572 Author: Marc Zyngier Date: Wed Sep 24 19:35:50 2025 +0100 Merge branch kvm-arm64/selftests-6.18 into kvmarm-master/next * kvm-arm64/selftests-6.18: : . : KVM/arm64 selftest updates for 6.18: : : - Large update to run EL1 selftests at EL2 when possible : (20250917212044.294760-1-oliver.upton@linux.dev) : : - Work around lack of ID_AA64MMFR4_EL1 trapping on CPUs : without FEAT_FGT : (20250923173006.467455-1-oliver.upton@linux.dev) : : - Additional fixes and cleanups : (20250920-kvm-arm64-id-aa64isar3-el1-v1-0-1764c1c1c96d@kernel.org) : . KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs KVM: arm64: selftests: Cope with arch silliness in EL2 selftest KVM: arm64: selftests: Add basic test for running in VHE EL2 KVM: arm64: selftests: Enable EL2 by default KVM: arm64: selftests: Initialize HCR_EL2 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 KVM: arm64: selftests: Select SMCCC conduit based on current EL KVM: arm64: selftests: Provide helper for getting default vCPU target KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts KVM: arm64: selftests: Create a VGICv3 for 'default' VMs KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation KVM: arm64: selftests: Add helper to check for VGICv3 support KVM: arm64: selftests: Initialize VGICv3 only once KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code Signed-off-by: Marc Zyngier commit b02a2c060b657296c080cff1b54ee4e9e650811c Author: Mark Brown Date: Sat Sep 20 20:52:00 2025 +0100 KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs We have a couple of writable bitfields in ID_AA64ISAR3_EL1 but the set_id_regs selftest does not cover this register at all, add coverage. Signed-off-by: Mark Brown Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 5a070fc376babc7efdc8288b97431e43e18f4646 Author: Mark Brown Date: Sat Sep 20 20:51:59 2025 +0100 KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs Currently we list the main set of registers with bits we test three times, once in the test_regs array which is used at runtime, once in the guest code and once in a list of ARRAY_SIZE() operations we use to tell kselftest how many tests we plan to execute. This is needlessly fiddly, when adding new registers as the test_cnt calculation is formatted with two registers per line. Instead count the number of bitfields in the register arrays at runtime. The existing code subtracts ARRAY_SIZE(test_regs) from the number of tests to account for the terminating FTR_REG_END entries in the per register arrays, the new code accounts for this when enumerating. Signed-off-by: Mark Brown Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 75b2fdc1a82195997cab4836f9e511cbe8c8eb52 Author: Oliver Upton Date: Tue Sep 23 10:30:06 2025 -0700 KVM: arm64: selftests: Cope with arch silliness in EL2 selftest Implementations without FEAT_FGT aren't required to trap the entire ID register space when HCR_EL2.TID3 is set. This is a terrible idea, as the hypervisor may need to advertise the absence of a feature to the VM using a negative value in a signed field, FEAT_E2H0 being a great example of this. Cope with uncooperative implementations in the EL2 selftest by accepting a zero value when FEAT_FGT is absent and otherwise only tolerating the expected nonzero value. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit f677b0efa93ce0afb127ccffb8aaf708045fcf10 Author: Oliver Upton Date: Wed Sep 17 14:20:43 2025 -0700 KVM: arm64: selftests: Add basic test for running in VHE EL2 Add an embarrassingly simple selftest for sanity checking KVM's VHE EL2 and test that the ID register bits are consistent with HCR_EL2.E2H being RES1. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 2de21fb62387459f762c93eec3d04e4f7540b952 Author: Oliver Upton Date: Wed Sep 17 14:20:42 2025 -0700 KVM: arm64: selftests: Enable EL2 by default Take advantage of VHE to implicitly promote KVM selftests to run at EL2 with only slight modification. Update the smccc_filter test to account for this now that the EL2-ness of a VM is visible to tests. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 05c93cbe6653e7e77567962aa6533b618df5e19f Author: Oliver Upton Date: Wed Sep 17 14:20:41 2025 -0700 KVM: arm64: selftests: Initialize HCR_EL2 Initialize HCR_EL2 such that EL2&0 is considered 'InHost', allowing the use of (mostly) unmodified EL1 selftests at EL2. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 7ae44d1cdad8a2483465373b9c9e91f0461ca9b2 Author: Oliver Upton Date: Wed Sep 17 14:20:40 2025 -0700 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters Configuring the number of implemented counters via PMCR_EL0.N was a bad idea in retrospect as it interacts poorly with nested. Migrate the selftest to use the vCPU attribute instead of the KVM_SET_ONE_REG mechanism. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0910778e49c6639d265ab2d7a47d0b461b8e2963 Author: Oliver Upton Date: Wed Sep 17 14:20:39 2025 -0700 KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 Arch timer registers are redirected to their hypervisor counterparts when running in VHE EL2. This is great, except for the fact that the hypervisor timers use different PPIs. Use the correct INTIDs when that is the case. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit d72543ac728ae4a4708cbefad2761df84599c268 Author: Oliver Upton Date: Wed Sep 17 14:20:38 2025 -0700 KVM: arm64: selftests: Select SMCCC conduit based on current EL HVCs are taken within the VM when EL2 is in use. Ensure tests use the SMC instruction when running at EL2 to interact with the host. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a1b91ac2381d86aa47b7109bbcde0c71e775f6d9 Author: Oliver Upton Date: Wed Sep 17 14:20:37 2025 -0700 KVM: arm64: selftests: Provide helper for getting default vCPU target The default vCPU target in KVM selftests is pretty boring in that it doesn't enable any vCPU features. Expose a helper for getting the default target to prepare for cramming in more features. Call KVM_ARM_PREFERRED_TARGET directly from get-reg-list as it needs fine-grained control over feature flags. Signed-off-by: Oliver Upton Reviewed-by: Itaru Kitayama Signed-off-by: Marc Zyngier commit 1c9604ba234711ca759f1147f2fbc7a94a5a486d Author: Oliver Upton Date: Wed Sep 17 14:20:36 2025 -0700 KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts FEAT_VHE has the somewhat nice property of implicitly redirecting EL1 register aliases to their corresponding EL2 representations when E2H=1. Unfortunately, there's no such abstraction for userspace and EL2 registers are always accessed by their canonical encoding. Introduce a helper that applies EL2 redirections to sysregs and use aggressive inlining to catch misuse at compile time. Go a little past the architectural definition for ease of use for test authors (e.g. the stack pointer). Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 8911c7dbc607212bf3dfc963004b062588c0ab38 Author: Oliver Upton Date: Wed Sep 17 14:20:35 2025 -0700 KVM: arm64: selftests: Create a VGICv3 for 'default' VMs Start creating a VGICv3 by default unless explicitly opted-out by the test. While having an interrupt controller is nice, the real benefit here is clearing a hurdle for EL2 VMs which mandate the presence of a VGIC. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit b8daa7ceac1c56e39b6ef4e62510a7d846511695 Author: Oliver Upton Date: Wed Sep 17 14:20:34 2025 -0700 KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation vgic_v3_setup() has a good bit of sanity checking internally to ensure that vCPUs have actually been created and match the dimensioning of the vgic itself. Spin off an unsanitised setup and initialization helper so vgic initialization can be wired in around a 'default' VM's vCPU creation. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit b712afa7a1cdb787f311f51c04df81fc6f026368 Author: Oliver Upton Date: Wed Sep 17 14:20:33 2025 -0700 KVM: arm64: selftests: Add helper to check for VGICv3 support Introduce a proper predicate for probing VGICv3 by performing a 'test' creation of the device on a dummy VM. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a5022da5f9a3a791ff2caf5fe3789561ae687747 Author: Oliver Upton Date: Wed Sep 17 14:20:32 2025 -0700 KVM: arm64: selftests: Initialize VGICv3 only once vgic_v3_setup() unnecessarily initializes the vgic twice. Keep the initialization after configuring MMIO frames and get rid of the other. Signed-off-by: Oliver Upton Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 7326348209a0079a83c7bd7963a0e32d26af61c8 Author: Oliver Upton Date: Wed Sep 17 14:20:31 2025 -0700 KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code In order to compel the default usage of EL2 in selftests, move kvm_arch_vm_post_create() to library code and expose an opt-in for using MTE by default. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 96da9d67da780c9fc10edc8822dcc69d62898d8d Author: Alexander Lobakin Date: Thu Sep 11 18:22:33 2025 +0200 idpf: enable XSk features and ndo_xsk_wakeup Now that AF_XDP functionality is fully implemented, advertise XSk XDP feature and add .ndo_xsk_wakeup() callback to be able to use it with this driver. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 9705d6552f5871a66b8701863567f11cee08dc76 Author: Alexander Lobakin Date: Thu Sep 11 18:22:32 2025 +0200 idpf: implement Rx path for AF_XDP Implement Rx packet processing specific to AF_XDP ZC using the libeth XSk infra. Initialize queue registers before allocating buffers to avoid redundant ifs when updating the queue tail. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 8ff6d62261a3d9a522e4bc90e27a2f6b745a22c4 Author: Alexander Lobakin Date: Thu Sep 11 18:22:31 2025 +0200 idpf: implement XSk xmit Implement the XSk transmit path using the libeth (libeth_xdp) XSk infra. When the NAPI poll is called, XSk Tx queues are polled first, before regular Tx and Rx. They're generally faster to serve and have higher priority comparing to regular traffic. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 3d57b2c00f09afb321bfc203c86a3eb674c0ff2c Author: Michal Kubiak Date: Thu Sep 11 18:22:30 2025 +0200 idpf: add XSk pool initialization Add functionality to setup an XSk buffer pool, including ability to stop, reconfig and start only selected queues, not the whole device. Pool DMA mapping is managed by libeth_xdp. Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 6b8e30b640653bb300a0d47aa7e2b2369eac674f Author: Michal Kubiak Date: Thu Sep 11 18:22:29 2025 +0200 idpf: add virtchnl functions to manage selected queues Implement VC functions dedicated to enabling, disabling and configuring not all but only selected queues. Also, refactor the existing implementation to make the code more modular. Introduce new generic functions for sending VC messages consisting of chunks, in order to isolate the sending algorithm and its implementation for specific VC messages. Finally, rewrite the function for mapping queues to q_vectors using the new modular approach to avoid copying the code that implements the VC message sending algorithm. Signed-off-by: Michal Kubiak Co-developed-by: Alexander Lobakin Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 5e3fee34f626a8cb8715f5b5409416c481714ebf Merge: dc1dea796b197a 55d5a5154d7510 Author: Jakub Kicinski Date: Wed Sep 24 10:21:39 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-09-23 We've added 9 non-merge commits during the last 33 day(s) which contain a total of 10 files changed, 480 insertions(+), 53 deletions(-). The main changes are: 1) A new bpf_xdp_pull_data kfunc that supports pulling data from a frag into the linear area of a xdp_buff, from Amery Hung. This includes changes in the xdp_native.bpf.c selftest, which Nimrod's future work depends on. It is a merge from a stable branch 'xdp_pull_data' which has also been merged to bpf-next. There is a conflict with recent changes in 'include/net/xdp.h' in the net-next tree that will need to be resolved. 2) A compiler warning fix when CONFIG_NET=n in the recent dynptr skb_meta support, from Jakub Sitnicki. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests: drv-net: Pull data before parsing headers selftests/bpf: Test bpf_xdp_pull_data bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN bpf: Make variables in bpf_prog_test_run_xdp less confusing bpf: Clear packet pointers after changing packet data in kfuncs bpf: Support pulling non-linear xdp data bpf: Allow bpf_xdp_shrink_data to shrink a frag from head and tail bpf: Clear pfmemalloc flag when freeing all fragments bpf: Return an error pointer for skb metadata when CONFIG_NET=n ==================== Link: https://patch.msgid.link/20250924050303.2466356-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 82f1cc171ce95544c024837c20a54d1954a67a76 Author: Niklas Cassel Date: Wed Sep 24 21:50:52 2025 +0530 PCI: tegra194: Set pci_epc_features::msi_capable to true Since the driver supports MSI, set the flag to true. This helps pci_endpoint_test to use the optimal IRQ type when using PCITEST_IRQ_TYPE_AUTO. Signed-off-by: Niklas Cassel [mani: splitted this change from the bug fix] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250922140822.519796-6-cassel@kernel.org commit b640d42a6ac9ba01abe65ec34f7c73aaf6758ab8 Author: Niklas Cassel Date: Mon Sep 22 16:08:24 2025 +0200 PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() The pci_epc_raise_irq() supplies a MSI or MSI-X interrupt number in range (1-N), as per the pci_epc_raise_irq() kdoc, where N is 32 for MSI. But tegra_pcie_ep_raise_msi_irq() incorrectly uses the interrupt number as the MSI vector. This causes wrong MSI vector to be triggered, leading to the failure of PCI endpoint Kselftest MSI_TEST test case. To fix this issue, convert the interrupt number to MSI vector. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-6-cassel@kernel.org commit c7d3dd9163e6095b2d4d000433ccdc166c33aa3c Merge: 95ee3364b29313 3328d39a8dca2d Author: Nathan Chancellor Date: Wed Sep 24 09:10:54 2025 -0700 Merge patch series "Add generated modalias to modules.builtin.modinfo" Alexey Gladkov says: The modules.builtin.modinfo file is used by userspace (kmod to be specific) to get information about builtin modules. Among other information about the module, information about module aliases is stored. This is very important to determine that a particular modalias will be handled by a module that is inside the kernel. There are several mechanisms for creating modalias for modules: The first is to explicitly specify the MODULE_ALIAS of the macro. In this case, the aliases go into the '.modinfo' section of the module if it is compiled separately or into vmlinux.o if it is builtin into the kernel. The second is the use of MODULE_DEVICE_TABLE followed by the use of the modpost utility. In this case, vmlinux.o no longer has this information and does not get it into modules.builtin.modinfo. For example: $ modinfo pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 modinfo: ERROR: Module pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 not found. $ modinfo xhci_pci name: xhci_pci filename: (builtin) license: GPL file: drivers/usb/host/xhci-pci description: xHCI PCI Host Controller Driver The builtin module is missing alias "pci:v*d*sv*sd*bc0Csc03i30*" which will be generated by modpost if the module is built separately. To fix this it is necessary to add the generated by modpost modalias to modules.builtin.modinfo. Fortunately modpost already generates .vmlinux.export.c for exported symbols. It is possible to add `.modinfo` for builtin modules and modify the build system so that `.modinfo` section is extracted from the intermediate vmlinux after modpost is executed. Link: https://patch.msgid.link/cover.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 3328d39a8dca2d6ed27197a0025df7540b99adf2 Author: Alexey Gladkov Date: Thu Sep 18 10:05:52 2025 +0200 kbuild: vmlinux.unstripped should always depend on .vmlinux.export.o Since .vmlinux.export.c is used to add generated by modpost modaliases for builtin modules the .vmlinux.export.o is no longer optional and should always be created. The generation of this file is not dependent on CONFIG_MODULES. Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/0e63a9c7741fe8217e4fd7c60afcf057ffa2ef5a.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 5ab23c7923a1d2ae1890026866a2d8506b010a4a Author: Alexey Gladkov Date: Thu Sep 18 10:05:51 2025 +0200 modpost: Create modalias for builtin modules For some modules, modalias is generated using the modpost utility and the section is added to the module file. When a module is added inside vmlinux, modpost does not generate modalias for such modules and the information is lost. As a result kmod (which uses modules.builtin.modinfo in userspace) cannot determine that modalias is handled by a builtin kernel module. $ cat /sys/devices/pci0000:00/0000:00:14.0/modalias pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 $ modinfo xhci_pci name: xhci_pci filename: (builtin) license: GPL file: drivers/usb/host/xhci-pci description: xHCI PCI Host Controller Driver Missing modalias "pci:v*d*sv*sd*bc0Csc03i30*" which will be generated by modpost if the module is built separately. To fix this it is necessary to generate the same modalias for vmlinux as for the individual modules. Fortunately '.vmlinux.export.o' is already generated from which '.modinfo' can be extracted in the same way as for vmlinux.o. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Tested-by: Stephen Rothwell Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/28d4da3b0e3fc8474142746bcf469e03752c3208.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 83fb49389bbe07defb85b063f7ff0fd016f06b35 Author: Alexey Gladkov Date: Thu Sep 18 10:05:50 2025 +0200 modpost: Add modname to mod_device_table alias At this point, if a symbol is compiled as part of the kernel, information about which module the symbol belongs to is lost. To save this it is possible to add the module name to the alias name. It's not very pretty, but it's possible for now. Cc: Miguel Ojeda Cc: Andreas Hindborg Cc: Danilo Krummrich Cc: Alex Gaynor Cc: rust-for-linux@vger.kernel.org Signed-off-by: Alexey Gladkov Acked-by: Danilo Krummrich Acked-by: Nicolas Schier Link: https://patch.msgid.link/1a0d0bd87a4981d465b9ed21e14f4e78eaa03ded.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit b88f88c26705ad436ff9675258f76082dd43996a Author: Alexey Gladkov Date: Thu Sep 18 10:05:49 2025 +0200 scsi: Always define blogic_pci_tbl structure The blogic_pci_tbl structure is used by the MODULE_DEVICE_TABLE macro. There is no longer a need to protect it with the MODULE condition, since this no longer causes the compiler to warn about an unused variable. To avoid warnings when -Wunused-const-variable option is used, mark it as __maybe_unused for such configuration. Cc: Khalid Aziz Cc: Martin K. Petersen Cc: linux-scsi@vger.kernel.org Suggested-by: James Bottomley Signed-off-by: Alexey Gladkov Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Acked-by: Martin K. Petersen Link: https://patch.msgid.link/fd8e30de07de79a4923ae967eaee5ba2f2fcef00.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 39cfd5b12160be4f57df1c3ba60139741c827616 Author: Masahiro Yamada Date: Thu Sep 18 10:05:48 2025 +0200 kbuild: extract modules.builtin.modinfo from vmlinux.unstripped Currently, we assume all the data for modules.builtin.modinfo are available in vmlinux.o. This makes it impossible for modpost, which is invoked after vmlinux.o, to add additional module info. This commit moves the modules.builtin.modinfo rule after modpost. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/cdb3e5b9a739666b755cd0097dc34ab69c350e51.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5 Author: Masahiro Yamada Date: Thu Sep 18 10:05:47 2025 +0200 kbuild: keep .modinfo section in vmlinux.unstripped Keep the .modinfo section during linking, but strip it from the final vmlinux. Adjust scripts/mksysmap to exclude modinfo symbols from kallsyms. This change will allow the next commit to extract the .modinfo section from the vmlinux.unstripped intermediate. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/aaf67c07447215463300fccaa758904bac42f992.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 0ce5139fd96e9d415d3faaef1c575e238f9bbd67 Author: Masahiro Yamada Date: Thu Sep 18 10:05:46 2025 +0200 kbuild: always create intermediate vmlinux.unstripped Generate the intermediate vmlinux.unstripped regardless of CONFIG_ARCH_VMLINUX_NEEDS_RELOCS. If CONFIG_ARCH_VMLINUX_NEEDS_RELOCS is unset, vmlinux.unstripped and vmlinux are identiacal. This simplifies the build rule, and allows to strip more sections by adding them to remove-section-y. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/a48ca543fa2305bd17324f41606dcaed9b19f2d4.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 Author: Alexey Gladkov Date: Thu Sep 18 10:05:45 2025 +0200 s390: vmlinux.lds.S: Reorder sections In the upcoming changes, the ELF_DETAILS macro will be extended with the ".modinfo" section, which will cause an error: >> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment >> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment >> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment This happens because the .vmlinux.info use :NONE to override the default segment and tell the linker to not put the section in any segment at all. To avoid this, we need to change the sections order that will be placed in the default segment. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: linux-s390@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/ Signed-off-by: Alexey Gladkov Acked-by: Heiko Carstens Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 1f6113ae5ac4927fe80256154ebb0461e670fa85 Author: Ard Biesheuvel Date: Wed Sep 24 17:53:11 2025 +0200 x86/boot: Drop erroneous __init annotation from early_set_pages_state() The kexec code will call set_pages_state() after tearing down all the GHCBs, which will therefore result in a call to early_set_pages_state(). This means the __init annotation is wrong, and must be dropped. Fixes: c5c30a373693 ("x86/boot: Move startup code out of __head section") Reported-by: Srikanth Aithal Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Tested-by: Srikanth Aithal commit ea0b39168d3a2313eabd145fb3440c946ccff4d1 Author: Jiapeng Chong Date: Tue Sep 23 11:50:23 2025 +0800 arm64: cpufeature: Remove duplicate asm/mmu.h header ./arch/arm64/kernel/cpufeature.c: asm/mmu.h is included more than once. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Will Deacon commit be9c94ca4ed5908e775dd9e31f9bd6bfb35adc70 Merge: 4e4e36dce3e44b 281817dffe2855 Author: Will Deacon Date: Wed Sep 24 16:35:10 2025 +0100 Merge branch 'for-next/vdso' into for-next/core * for-next/vdso: arm64: vdso32: Respect -Werror from kbuild arm64: vdso32: Stop suppressing warnings commit 4e4e36dce3e44b28b041aefedd5a0c1b150a8f43 Merge: c7c7eb4f0eff06 ea87c5536aa8c2 Author: Will Deacon Date: Wed Sep 24 16:35:06 2025 +0100 Merge branch 'for-next/uprobes' into for-next/core * for-next/uprobes: arm64: probes: Fix incorrect bl/blr address and register usage uprobes: uprobe_warn should use passed task arm64: Kconfig: Remove GCS restrictions on UPROBES arm64: uprobes: Add GCS support to uretprobes arm64: probes: Add GCS support to bl/blr/ret arm64: uaccess: Add additional userspace GCS accessors arm64: uaccess: Move existing GCS accessors definitions to gcs.h arm64: probes: Break ret out from bl/blr commit c7c7eb4f0eff06d0605051d4fd286b84adb072e0 Merge: 712f4ee70a38d5 14f158552eec70 Author: Will Deacon Date: Wed Sep 24 16:35:01 2025 +0100 Merge branch 'for-next/sysregs' into for-next/core * for-next/sysregs: arm64/sysreg: Update TCR_EL1 register arm64: sysreg: Add validation checks to sysreg header generation script arm64: sysreg: Correct sign definitions for EIESB and DoubleLock arm64: sysreg: Fix and tidy up sysreg field definitions commit 712f4ee70a38d5b39682c18d20a8a14c764d1e6c Merge: f2d64a22faeeec 777fb19ed8d6f1 Author: Will Deacon Date: Wed Sep 24 16:34:56 2025 +0100 Merge branch 'for-next/selftests' into for-next/core * for-next/selftests: kselftest/arm64: Add lsfe to the hwcaps test kselftest/arm64: Check that unsupported regsets fail in sve-ptrace kselftest/arm64: Verify that we reject out of bounds VLs in sve-ptrace kselftest/arm64/gcs/basic-gcs: Respect parent directory CFLAGS selftests/arm64: Fix grammatical error in string literals kselftest/arm64: Add parentheses around sizeof for clarity kselftest/arm64: Supress warning and improve readability kselftest/arm64: Remove extra blank line kselftest/arm64/gcs: Use nolibc's getauxval() kselftest/arm64/gcs: Correctly check return value when disabling GCS selftests: arm64: Fix -Waddress warning in tpidr2 test kselftest/arm64: Log error codes in sve-ptrace selftests: arm64: Check fread return value in exec_target commit f2d64a22faeeecff385b4c91fab5fe036ab00162 Merge: 77dfca70baefcb 2084660ad288c9 Author: Will Deacon Date: Wed Sep 24 16:34:52 2025 +0100 Merge branch 'for-next/perf' into for-next/core * for-next/perf: (29 commits) perf/dwc_pcie: Fix use of uninitialized variable Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU Documentation: hisi-pmu: Fix of minor format error drivers/perf: hisi: Add support for L3C PMU v3 drivers/perf: hisi: Refactor the event configuration of L3C PMU drivers/perf: hisi: Extend the field of tt_core drivers/perf: hisi: Extract the event filter check of L3C PMU drivers/perf: hisi: Simplify the probe process of each L3C PMU version drivers/perf: hisi: Export hisi_uncore_pmu_isr() drivers/perf: hisi: Relax the event ID check in the framework perf: Fujitsu: Add the Uncore PMU driver perf/arm-cmn: Fix CMN S3 DTM offset perf: arm_spe: Prevent overflow in PERF_IDX2OFF() coresight: trbe: Prevent overflow in PERF_IDX2OFF() MAINTAINERS: Remove myself from HiSilicon PMU maintainers drivers/perf: hisi: Add support for HiSilicon MN PMU driver drivers/perf: hisi: Add support for HiSilicon NoC PMU perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS arm64/boot: Factor out a macro to check SPE version ... commit 77dfca70baefcb988318a72fe69eb99f6dabbbb1 Merge: 30f9386820cddb 5973a62efa34c8 Author: Will Deacon Date: Wed Sep 24 16:34:34 2025 +0100 Merge branch 'for-next/mm' into for-next/core * for-next/mm: arm64: map [_text, _stext) virtual address range non-executable+read-only arm64: Enable vmalloc-huge with ptdump arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: support large block mapping when rodata=full arm64: Enable permission change on arm64 kernel block mappings arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED arm64: mm: Rework the 'rodata=' options arm64: mm: Represent physical memory with phys_addr_t and resource_size_t arm64: mm: Make map_fdt() return mapped pointer arm64: mm: Cast start/end markers to char *, not u64 commit 30f9386820cddbba59b48ae0670c3a1646dd440e Merge: 7df73a00490c9b 1cf89b6bf660c2 Author: Will Deacon Date: Wed Sep 24 16:34:06 2025 +0100 Merge branch 'for-next/misc' into for-next/core * for-next/misc: arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN arm64: Kconfig: Spell out "ARMv9.4" in menuconfig text arm64/fpsimd: simplify sme_setup() commit 7df73a00490c9b7a1b7c48d18881fe02ab0fabb4 Merge: e0669b95f7a561 da9e5c04be5895 Author: Will Deacon Date: Wed Sep 24 16:34:02 2025 +0100 Merge branch 'for-next/entry' into for-next/core * for-next/entry: arm/syscalls: mark syscall invocation as likely in invoke_syscall arm64: entry: Switch to generic IRQ entry arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() arm64: entry: Refactor preempt_schedule_irq() check code entry: Add arch_irqentry_exit_need_resched() for arm64 arm64: entry: Use preempt_count() and need_resched() helper arm64: entry: Rework arm64_preempt_schedule_irq() arm64: entry: Refactor the entry and exit for exceptions from EL1 arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() commit e0669b95f7a5614159045cd930071ff711f82b3e Merge: 3d751c56c9de79 3c0979c64481f0 Author: Will Deacon Date: Wed Sep 24 16:33:58 2025 +0100 Merge branch 'for-next/docs' into for-next/core * for-next/docs: arm64/sme: Drop inaccurate documentation of streaming mode switches commit 3d751c56c9de79b1624e45aba404177115b268c0 Merge: 5647d32f514eca 8fca3852e33d76 Author: Will Deacon Date: Wed Sep 24 16:33:53 2025 +0100 Merge branch 'for-next/cpufeature' into for-next/core * for-next/cpufeature: arm64: cpufeature: add Neoverse-V3AE to BBML2 allow list arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions arm64: cpufeature: add AmpereOne to BBML2 allow list arm64: cpufeature: Add Olympus MIDR to BBML2 allow list arm64: cputype: Add NVIDIA Olympus definitions arm64: cputype: Remove duplicate Cortex-X1C definitions arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE arm64: cputype: Add Cortex-A720AE definitions arm64/hwcap: Add hwcap for FEAT_LSFE commit 5647d32f514ecac98760d60a77c1fcfbc5fb2ed0 Merge: 57f13e3d912089 d02c2e45b1e776 Author: Will Deacon Date: Wed Sep 24 16:33:25 2025 +0100 Merge branch 'for-next/cca' into for-next/core * for-next/cca: arm64: acpi: Enable ACPI CCEL support arm64: Enable EFI secret area Securityfs support arm64: realm: ioremap: Allow mapping memory as encrypted commit 57f13e3d91208900c59fbb4d4314a0281762cfb6 Merge: 8f5ae30d69d754 a7ed7b9d0ebb03 Author: Will Deacon Date: Wed Sep 24 16:33:03 2025 +0100 Merge branch 'for-next/fixes' into for-next/core * for-next/fixes: arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO kselftest/arm64: Don't open code SVE_PT_SIZE() in fp-ptrace arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature commit 1cf89b6bf660c2e9fa137b3e160c7b1001937a78 Author: Will Deacon Date: Fri Sep 19 19:40:25 2025 +0100 arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN Big-endian arm64 configurations are vanishingly rare, yet we still claim to support them in Linux despite very limited testing or visible interest. Supporting big-endian adds unnecessary burden to reviewers and contributors which, without any known active users, is hard to justify. For example, recent work to improve our futex routines and to implement nested virtualisation support is non-trivially complicated by having to support both big- and little-endianness. Back in 2019 [1], it was claimed that Huawei were using arm64 big-endian machines in their telecommunication products but I don't know whether that's still the case and certainly haven't seen any patch contributions to help support or maintain it. Make CPU_BIG_ENDIAN depend on BROKEN as an initial deprecation step towards its removal. Cc: Catalin Marinas Cc: Marc Zyngier Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Hanjun Guo Cc: Jonathan Cameron Cc: Guenter Roeck Link: https://lore.kernel.org/linux-arm-kernel/73701e9f-bee1-7ae8-2277-7a3576171cd4@huawei.com/ [1] Acked-by: Catalin Marinas Acked-by: Marc Zyngier Acked-by: Ard Biesheuvel Signed-off-by: Will Deacon commit 896d52af944107c0644c12378741af9a3834c514 Merge: 2d51a5b83cf88d 6742ca18cb4169 Author: Marc Kleine-Budde Date: Wed Sep 24 17:10:01 2025 +0200 Merge patch series "can: netlink: preparation before introduction of CAN XL step 3/3" Vincent Mailhol says: In November last year, I sent an RFC to introduce CAN XL [1]. That RFC, despite positive feedback, was put on hold due to some unanswered question concerning the PWM encoding [2]. While stuck, some small preparation work was done in parallel in [3] by refactoring the struct can_priv and doing some trivial clean-up and renaming. Initially, [3] received zero feedback but was eventually merged after splitting it in smaller parts and resending it. Finally, in July this year, we clarified the remaining mysteries about PWM calculation, thus unlocking the series. Summer being a bit busy because of some personal matters brings us to now. After doing all the refactoring and adding all the CAN XL features, the final result is more than 30 patches, definitively too much for a single series. So I am splitting the remaining changes three: - can: rework the CAN MTU logic [4] - can: netlink: preparation before introduction of CAN XL (this series) - CAN XL (will come right after the two preparation series get merged) And thus, this series continues and finishes the preparation work done in [3] and [4]. It contains all the refactoring needed to smoothly introduce CAN XL. The goal is to: - split the functions in smaller pieces: CAN XL will introduce a fair amount of code. And some functions which are already fairly long (86 lines for can_validate(), 215 lines for can_changelink()) would grow to disproportionate sizes if the CAN XL logic were to be inlined in those functions. - repurpose the existing code to handle both CAN FD and CAN XL: a huge part of CAN XL simply reuses the CAN FD logic. All the existing CAN FD logic is made more generic to handle both CAN FD and XL. In more details: - Patch #1 moves struct data_bittiming_params from dev.h to bittiming.h and patch #2 makes can_get_relative_tdco() FD agnostic before also moving it to bittiming.h. - Patch #3 adds some comments to netlink.h tagging which IFLA symbols are FD specific. - Patches #4 to #6 are refactoring can_validate() and can_validate_bittiming(). - Patches #7 to #11 are refactoring can_changelink() and can_tdc_changelink(). - Patches #12 and #13 are refactoring can_get_size() and can_tdc_get_size(). - Patches #14 to #17 are refactoring can_fill_info() and can_tdc_fill_info(). - Patch #18 makes can_calc_tdco() FD agnostic. - Patch #19 adds can_get_ctrlmode_str() which converts control mode flags into strings. This is done in preparation of patch #20. - Patch #20 is the final patch and improves the user experience by providing detailed error messages whenever invalid parameters are provided. All those error messages came into handy when debugging the upcoming CAN XL patches. Aside from the last patch, the other changes do not impact any of the existing functionalities. The follow up series which introduces CAN XL is nearly completed but will be sent only once this one is approved: one thing at a time, I do not want to overwhelm people (including myself). [1] https://lore.kernel.org/linux-can/20241110155902.72807-16-mailhol.vincent@wanadoo.fr/ [2] https://lore.kernel.org/linux-can/c4771c16-c578-4a6d-baee-918fe276dbe9@wanadoo.fr/ [3] https://lore.kernel.org/linux-can/20241110155902.72807-16-mailhol.vincent@wanadoo.fr/ [4] https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v2-0-984f9868db69@kernel.org/ Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-0-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 6742ca18cb4169dc9a7f2860d18e78fcf00c6717 Author: Vincent Mailhol Date: Tue Sep 23 15:58:45 2025 +0900 can: netlink: add userland error messages Use NL_SET_ERR_MSG() and NL_SET_ERR_MSG_FMT() to return meaningful error messages to the userland whenever a -EOPNOTSUPP error is returned due to a failed validation of the CAN netlink arguments. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-20-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 7de54546fff11cb0a53f47847d62f7b1a5792d17 Author: Vincent Mailhol Date: Tue Sep 23 15:58:44 2025 +0900 can: dev: add can_get_ctrlmode_str() In an effort to give more human readable messages when errors occur because of conflicting options, it can be useful to convert the CAN control mode flags into text. Add a function which converts the first set CAN control mode into a human readable string. The reason to only convert the first one is to simplify edge cases: imagine that there are several invalid control modes, we would just return the first invalid one to the user, thus not having to handle complex string concatenation. The user can then solve the first problem, call the netlink interface again and see the next issue. People who wish to enumerate all the control modes can still do so by, for example, using this new function in a for_each_set_bit() loop. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-19-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 6ffc1230d3a728e07d7d2464f388ad4bbefe90c2 Author: Vincent Mailhol Date: Tue Sep 23 15:58:43 2025 +0900 can: calc_bittiming: make can_calc_tdco() FD agnostic can_calc_tdco() uses the CAN_CTRLMODE_FD_TDC_MASK and CAN_CTRLMODE_TDC_AUTO macros making it specific to CAN FD. Add the tdc mask to the function parameter list. The value of the tdc auto flag can then be derived from that mask and stored in a local variable. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-18-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e72f1ba700e3d502cd0a604fda86e38431467a46 Author: Vincent Mailhol Date: Tue Sep 23 15:58:42 2025 +0900 can: netlink: make can_tdc_fill_info() FD agnostic can_tdc_fill_info() depends on some variables which are specific to CAN FD. Move these to the function parameters list so that, later on, this function can be reused for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-17-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit d5ee934ee19b563a965da135e04d6d93067ccf2c Author: Vincent Mailhol Date: Tue Sep 23 15:58:41 2025 +0900 can: netlink: add can_bitrate_const_fill_info() Add can_bitrate_const_fill_info() to factorise the logic when filling the bitrate constant information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-16-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit aaeebdb7a7235ffec5c56a8a0144cac94b5a8e3e Author: Vincent Mailhol Date: Tue Sep 23 15:58:40 2025 +0900 can: netlink: add can_bittiming_const_fill_info() Add function can_bittiming_const_fill_info() to factorise the logic when filling the bittiming constant information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-15-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e1a2be5a6967143b56e253920be208635fc627b8 Author: Vincent Mailhol Date: Tue Sep 23 15:58:39 2025 +0900 can: netlink: add can_bittiming_fill_info() Add can_bittiming_fill_info() to factorise the logic when filling the bittiming information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-14-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit d5f45ef88ba4e6af14a0d36ed3323b5813f07988 Author: Vincent Mailhol Date: Tue Sep 23 15:58:38 2025 +0900 can: netlink: add can_data_bittiming_get_size() Add the can_data_bittiming_get_size() function to factorise the logic to retrieve the size of below data bittiming parameters: - data_bittiming - data_bittiming_const - data_bitrate_const - tdc parameters This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-13-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 63888a57801656ee1204f750ec4f98bd75fe44aa Author: Vincent Mailhol Date: Tue Sep 23 15:58:37 2025 +0900 can: netlink: make can_tdc_get_size() FD agnostic can_tdc_get_size() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. can_tdc_get_size() also uses the CAN_CTRLMODE_TDC_MANUAL macro making it specific to CAN FD. Add the tdc mask to the function parameter list. The value of the tdc manual flag can then be derived from that mask and stored in a local variable. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-12-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e1a5cd9d6665c44119d5e664ecaccdb6467aecda Author: Vincent Mailhol Date: Tue Sep 23 15:58:36 2025 +0900 can: netlink: add can_ctrlmode_changelink() Split the control mode change link logic into a new function: can_ctrlmode_changelink(). The purpose is to increase code readability by preventing can_changelink() from becoming too big. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-11-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2e543af483a98a5e51509d8a720940fa8a35fdce Author: Vincent Mailhol Date: Tue Sep 23 15:58:35 2025 +0900 can: netlink: add can_dtb_changelink() Factorise the databittiming parsing out of can_changelink() and move it in the new can_dtb_changelink() function. This is a preparation patch for the introduction of CAN XL because the databittiming changelink logic will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-10-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 530c918f8cf68c06e82dbebf44bda67c60fd004b Author: Vincent Mailhol Date: Tue Sep 23 15:58:34 2025 +0900 can: netlink: make can_tdc_changelink() FD agnostic can_tdc_changelink() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-9-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2b0a6930ae7c54ef401cd0a98ba194236ff8fbf7 Author: Vincent Mailhol Date: Tue Sep 23 15:58:33 2025 +0900 can: netlink: remove useless check in can_tdc_changelink() can_tdc_changelink() return -EOPNOTSUPP under this condition: !tdc_const || !can_fd_tdc_is_enabled(priv) But this function is only called if the data[IFLA_CAN_TDC] parameters are provided. At this point, can_validate_tdc() already checked that either of the tdc auto or tdc manual control modes were provided, that is to say, can_fd_tdc_is_enabled(priv) must be true. Because the right hand operand of this condition is always true, remove it. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-8-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 45be26b7e35a70ac7c79341747bd596d83dee977 Author: Vincent Mailhol Date: Tue Sep 23 15:58:32 2025 +0900 can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic CAN_CTRLMODE_TDC_AUTO and CAN_CTRLMODE_TDC_MANUAL are mutually exclusive. This means that whenever the user switches from auto to manual mode (or vice versa), the other flag which was set previously needs to be cleared. Currently, this is handled with a masking operation. It can be done in a simpler manner by clearing any of the previous TDC flags before copying netlink attributes. The code becomes easier to understand and will make it easier to add the new upcoming CAN XL flags which will have a similar reset logic as the current TDC flags. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-7-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 3820a415bece1feb7d832f6bda6c927d91c3ab52 Author: Vincent Mailhol Date: Tue Sep 23 15:58:31 2025 +0900 can: netlink: add can_validate_databittiming() Factorise the databittiming validation out of can_validate() and move it in the new add can_validate_databittiming() function. Also move can_validate()'s comment because it is specific to CAN FD. This is a preparation patch for the introduction of CAN XL as this databittiming validation will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-6-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit b23a8425cba5d7908d69f3bce8f3c697362b50ae Author: Vincent Mailhol Date: Tue Sep 23 15:58:30 2025 +0900 can: netlink: add can_validate_tdc() Factorise the TDC validation out of can_validate() and move it in the new can_validate_tdc() function. This is a preparation patch for the introduction of CAN XL because this TDC validation will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-5-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit f5ae5a75412db0b8ded2342d409c7ba504eb198f Author: Vincent Mailhol Date: Tue Sep 23 15:58:29 2025 +0900 can: netlink: refactor can_validate_bittiming() Whenever can_validate_bittiming() is called, it is always preceded by some boilerplate code which was copy pasted all over the place. Move that repeated code directly inside can_validate_bittiming(). Finally, the mempcy() is not needed: the nla attributes are four bytes aligned which is just enough for struct can_bittiming. Add a static_assert() to document that the alignment is correct and just use the pointer returned by nla_data() as-is. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-4-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 94040a8f484576cb1b7df3b2e93118c3b3e3aff4 Author: Vincent Mailhol Date: Tue Sep 23 15:58:28 2025 +0900 can: netlink: document which symbols are FD specific The CAN XL netlink interface will also have data bitrate and TDC parameters. The current FD parameters do not have a prefix in their names to differentiate them. Because the netlink interface is part of the UAPI, it is unfortunately not feasible to rename the existing symbols to add an FD_ prefix. The best alternative is to add a comment for each of the symbols to notify the reader of which parts are CAN FD specific. While at it, fix a typo: transiver -> transceiver. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-3-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 7208385df7846d30e29febc6c6280cb32e91ee82 Author: Vincent Mailhol Date: Tue Sep 23 15:58:27 2025 +0900 can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h can_get_relative_tdco() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Now that we dropped the dependency on struct can_priv, also move can_get_relative_tdco() back to bittiming.h where it was meant to belong to. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-2-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit cc470fcf1d59f9d6186810ea5253da49a4f85f83 Author: Vincent Mailhol Date: Tue Sep 23 15:58:26 2025 +0900 can: dev: move struct data_bittiming_params to linux/can/bittiming.h In commit b803c4a4f788 ("can: dev: add struct data_bittiming_params to group FD parameters"), struct data_bittiming_params was put into linux/can/dev.h. This structure being a collection of bittiming parameters, on second thought, bittiming.h is actually a better location. This way, users of struct data_bittiming_params will not have to forcefully include linux/can/dev.h thus removing some complexity and reducing the risk of circular dependencies in headers. Move struct data_bittiming_params from linux/can/dev.h to linux/can/bittiming.h. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-1-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2d51a5b83cf88dcf0100c2f1404da279fe66b522 Merge: c0b595230cc198 b98aceb65e2c57 Author: Marc Kleine-Budde Date: Wed Sep 24 17:06:20 2025 +0200 Merge patch series "can: rework the CAN MTU logic (CAN XL preparation step 2/3)" Vincent Mailhol says: The CAN MTU logic is currently broken. can_change_mtu() will update both the MTU and the CAN_CTRLMODE_FD flag. Back then, commit bc05a8944a34 ("can: allow to change the device mtu for CAN FD capable devices") stated that: The configuration can be done either with the 'fd { on | off }' option in the 'ip' tool from iproute2 or by setting the CAN netdevice MTU to CAN_MTU (16) or to CANFD_MTU (72). Link: https://git.kernel.org/torvalds/c/bc05a8944a34 The problem is that after doing for example: $ ip link set can0 mtu 72 bittiming 500000 on a CAN FD interface, we are left with a device on which CAN FD is enabled but which does not have the FD databittiming parameters configured. The same goes on when setting the mtu back to 16: ip link set can0 type can bitrate 500000 fd on dbitrate 5000000 ip link set can0 mtu 16 The device is now in Classical CAN mode but iproute2 is still reporting the databittiming values (although this time, the issue seems less critical as it is only a reporting problem). The only way to resolve the problem and bring the device back to a coherent state is to call again the netlink interface using the "fd on" or "fd off" options. The idea of being able to infer the CAN_CTRLMODE_FD flag from the MTU value is just incorrect for physical devices. Note that this logic remains valid on virtual interfaces (vcan and vxcan) because those do not have control mode flags and thus no conflict occurs. This series reworks the CAN MTU logic. The goal is to always maintain a coherent state between the MTU and the control mode flags as listed in below table: fd off, xl off fd on, xl off fd any, xl on --------------------------------------------------------------------------- default mtu CAN_MTU CANFD_MTU CANXL_MTU min mtu CAN_MTU CANFD_MTU CANXL_MIN_MTU max mtu CAN_MTU CANFD_MTU CANXL_MAX_MTU In order to switch between one column to another, the user must use the fd/xl on/off flags. Directly modifying the MTU from one column to the other is not permitted any more. The CAN XL is not yet supported at the moment, so the last column is just given as a reference to better understand what is coming up. This series will just implement the first two columns. While doing the rewrite, the logic is adjusted to reuse as much as possible the net core infrastructure. By populating: net_device->min_mtu and net_device->max_mtu the net core infrastructure will automatically: 1. validate that the user's inputs are in range. 2. report those min and max MTU values through the netlink interface. Point 1. will allow us to get rid of the can_change_mtu() in a near future for all the physical devices and point 2. allows the end user to see the valid MTU range by doing a: $ ip --details link show can0 Finally, because using the net core, it will be possible after the removal of can_change_mtu() to modify the MTU while the device is up. As stated previously, the only modifications allowed will be within the MTU range of a given CAN protocol. So for Classical CAN and CAN FD, the MTU is fixed to, respectively, CAN_MTU and CANFD_MTU. For the upcoming CAN XL, the user will be able to change the MTU to anything between CANXL_MIN_MTU and CANXL_MAX_MTU even if the device is up. The first patch of this series annotates the read access on net_device->mtu. This preparation is needed to prevent any race condition to occur when modifying the MTU while the device is up. The second patch is another preparation change which moves can_set_static_ctrlmode() from dev.h to dev.c. The third patch populates the MTU minimum and maximum value. The fourth patch is just a clean-up to remove the old can_change_mtu(). The fourth and last patch comes as a bonus content and modifies the default MTU of the vcan and vxcan so that CAN XL is on by default. Note that after this series, the old can_change_mtu() becomes useless. That function can not yet be removed because some pending changes from other maintainers' trees still depend on it. It will be removed in the next development window once all those changes reach net-next. Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-0-581bde113f52@kernel.org [mkl: squashed fixup patch into 3] Signed-off-by: Marc Kleine-Budde commit b98aceb65e2c57df9646530e5f2b2531a661203f Author: Vincent Mailhol Date: Tue Sep 23 15:37:11 2025 +0900 can: enable CAN XL for virtual CAN devices by default In commit 97edec3a11cf ("can: enable CAN FD for virtual CAN devices by default"), vcan and vxcan default MTU was set to CANFD_MTU by default. The reason was that users were confused on how to activate CAN FD on virtual interfaces. Following the introduction of CAN XL, the same logic should be applied. Set the MTU to CANXL_MTU by default. The users who really wish to use a Classical CAN only or a CAN FD virtual device can do respectively: $ ip link set vcan0 mtu 16 or $ ip link set vcan0 mtu 72 to force the old behaviour. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-4-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde commit 23049938605bda390f875ce20e0704252c2e5c3d Author: Vincent Mailhol Date: Tue Sep 23 15:37:10 2025 +0900 can: populate the minimum and maximum MTU values By populating: net_device->min_mtu and net_device->max_mtu the net core infrastructure will automatically: 1. validate that the user's inputs are in range. 2. report those min and max MTU values through the netlink interface. Add can_set_default_mtu() which sets the default mtu value as well as the minimum and maximum values. The logic for the default mtu value remains unchanged: - CANFD_MTU if the device has a static CAN_CTRLMODE_FD. - CAN_MTU otherwise. Call can_set_default_mtu() each time the CAN_CTRLMODE_FD is modified. This will guarantee that the MTU value is always consistent with the control mode flags. With this, the checks done in can_change_mtu() become fully redundant and will be removed in an upcoming change and it is now possible to confirm the minimum and maximum MTU values on a physical CAN interface by doing: $ ip --details link show can0 The virtual interfaces (vcan and vxcan) are not impacted by this change. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org [mkl: squashed https://patch.msgid.link/20250924143644.17622-2-mailhol@kernel.org] Signed-off-by: Marc Kleine-Budde commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 Author: Armin Wolf Date: Wed Sep 17 20:10:36 2025 +0200 hwmon: (dell-smm) Add support for Dell OptiPlex 7040 The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically. Closes: https://github.com/Wer-Wolf/i8kutils/issues/15 Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 1c1658058c99bcfd3b2347e587a556986037f80a Author: Armin Wolf Date: Wed Sep 17 20:10:35 2025 +0200 hwmon: (dell-smm) Add support for automatic fan mode Many machines treat fan state 3 as some sort of automatic mode, which is superior to the separate SMM calls for switching to automatic fan mode for two reasons: - the fan control mode can be controlled for each fan separately - the current fan control mode can be retrieved from the BIOS On some machines however, this special fan state does not exist. Fan state 3 acts like a regular fan state on such machines or does not exist at all. Such machines usually use separate SMM calls for enabling/disabling automatic fan control. Add support for it. If the machine supports separate SMM calls for changing the fan control mode, then the other interface is ignored. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-4-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 205c730262215fe1940668394a856f69ece55c66 Author: Cryolitia PukNgae Date: Wed Sep 24 15:48:38 2025 +0800 hwmon: (gpd-fan) complete Kconfig dependencies DMI and HAS_IOPORT is also needed Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509200214.i2QX7iwD-lkp@intel.com/ Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250924-hwmon2-v1-1-fc529865a325@uniontech.com Signed-off-by: Guenter Roeck commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 Author: Ben Copeland Date: Tue Sep 23 21:26:56 2025 +0200 hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex Some motherboards require more time to acquire the ACPI mutex, causing "Failed to acquire mutex" messages to appear in the kernel log. Increase the timeout from 500ms to 800ms to accommodate these cases. Signed-off-by: Ben Copeland Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 2c8ac03aad7a8dd649de9080503c68319afb43f9 Author: Ben Copeland Date: Tue Sep 23 21:26:55 2025 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X870E-E GAMING WIFI Add support for ROG STRIX X870E-E GAMING WIFI This board uses the same sensor configuration as the ProArt X870E-CREATOR WIFI motherboard. Signed-off-by: Ben Copeland Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250923192935.11339-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit b3499883c6d5f968f44e87d021ff2bd47ab5d094 Author: Armin Wolf Date: Wed Sep 17 20:10:34 2025 +0200 hwmon: (dell-smm) Move clamping of fan speed out of i8k_set_fan() Currently i8k_set_fan() clamps the fan speed before performing the SMM call to ensure that the speed is not negative and not greater than i8k_fan_max. This however is mostly unnecessary as the hwmon and thermal interfaces alread ensure this. Only the legacy ioctl interface does not ensure that the fan speed passed to i8k_set_fan() does meet the above criteria. Move the clamping out of i8k_set_fan() and into the legacy ioctl handler to prepare for future changes. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-3-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf Author: Armin Wolf Date: Wed Sep 17 20:10:33 2025 +0200 hwmon: (dell-smm) Remove Dell Precision 490 custom config data It turns out the second fan on the Dell Precision 490 does not really support I8K_FAN_TURBO. Setting the fan state to 3 enables automatic fan control, just like on the other two fans. The reason why this was misinterpreted as turbo mode was that the second fan normally spins faster in automatic mode than in the previous fan states. Yet when in state 3, the fan speed reacts to heat exposure, exposing the automatic mode setting. Link: https://github.com/lm-sensors/lm-sensors/pull/383 Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 5d5ec7c81c372d33875e0176f9f6d68e3e813e32 Author: Shane Fagan Date: Sun Sep 14 09:41:14 2025 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X670E-E GAMING WIFI Add support for ROG STRIX X670E-E GAMING WIFI Signed-off-by: Shane Fagan Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250914074125.135656-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 1fac317b6cae373d5d1a5695a5175c65c745922f Author: Cryolitia PukNgae Date: Fri Sep 19 16:38:49 2025 +0800 hwmon: (gpd-fan) Fix range check for pwm input Fixed the maximum value in the PWM input range check, allowing the input to be set to 255. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Reported-by: Chenx Dust Link: https://github.com/Cryolitia/gpd-fan-driver/pull/18 Co-developed-by: Chenx Dust Signed-off-by: Chenx Dust Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250919-hwmon-v1-1-2b69c8b9c062@uniontech.com Signed-off-by: Guenter Roeck commit bef3c793542b132ab1dc19076ce4f91594b5fbdc Author: Cosmo Chou Date: Tue Sep 16 17:50:26 2025 +0800 hwmon: (pmbus/mp5990) add support for MP5998 Add support for the MPS MP5998 hot-swap controller. Like MP5990, MP5998 uses EFUSE_CFG (0xC4) bit 9 to indicate linear/direct data format. Signed-off-by: Cosmo Chou Link: https://lore.kernel.org/r/20250916095026.800164-2-chou.cosmo@gmail.com Signed-off-by: Guenter Roeck commit bca9b6633fb92ff37247442d08f3889a2e87881c Author: Cosmo Chou Date: Tue Sep 16 17:50:25 2025 +0800 dt-bindings: trivial-devices: add mps,mp5998 Add dt-bindings for MPS mp5998 hot-swap controller. Signed-off-by: Cosmo Chou Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250916095026.800164-1-chou.cosmo@gmail.com Signed-off-by: Guenter Roeck commit 6c4e0cb3d87ad63a30e05e7624a45a6f01240e70 Author: Heiko Carstens Date: Mon Sep 22 13:40:20 2025 +0200 s390/bitops: Switch to generic ffs() if supported by compiler Use generic ffs() / __builtin_ffs() if supported by the compiler. GCC 16 will have support for __builtin_ffs(). See gcc commit f50cff9766c5 ("s390: Implement clz and ctz for SI mode"). In the distant future when GCC 16 becomes the minimum supported version, this allows to get rid of the flogr inline assembly. Kernel image size is reduced by ~500 bytes (gcc 16 beta + defconfig). Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 7b80a23c0e33ae5a3ae68e0cf5b5a59e8a368c37 Author: Heiko Carstens Date: Mon Sep 22 13:40:19 2025 +0200 s390/bitops: Switch to generic fls(), fls64(), etc. Switch to generic fls(), fls64(), etc. which are implemented with __builtin_ctzl(), __builtin_clzl(). Those builtins are available for all supported compilers. Kernel image size is reduced by ~10kb (gcc 15.1.0 + defconfig). Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 5671ce2a1fc6b4a16cff962423bc416b92cac3c8 Author: Heiko Carstens Date: Mon Sep 22 17:24:05 2025 +0200 s390/mm: Use __GFP_ACCOUNT for user page table allocations Add missing kmemcg accounting of user page table allocations. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 Author: Varad Gautam Date: Sun Mar 30 16:42:29 2025 +0000 asm-generic/io.h: Skip trace helpers if rwmmio events are disabled With `CONFIG_TRACE_MMIO_ACCESS=y`, the `{read,write}{b,w,l,q}{_relaxed}()` mmio accessors unconditionally call `log_{post_}{read,write}_mmio()` helpers, which in turn call the ftrace ops for `rwmmio` trace events This adds a performance penalty per mmio accessor call, even when `rwmmio` events are disabled at runtime (~80% overhead on local measurement). Guard these with `tracepoint_enabled()`. Signed-off-by: Varad Gautam Fixes: 210031971cdd ("asm-generic/io: Add logging support for MMIO accessors") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann commit fb0b08297ecb429b60cb2b6ed40632ce5294220c Author: Alok Tiwari Date: Wed Sep 24 04:01:27 2025 -0700 RDMA/bnxt_re: improve clarity in ALLOC_PAGE handler Update uverbs_copy_to call to use sizeof(dpi) instead of sizeof(length) when copying the device page index (DPI) back to user space. Both dpi and length are declared as u32, so this change has no functional impact but makes the code clearer. Link: https://patch.msgid.link/r/20250924110130.340195-1-alok.a.tiwari@oracle.com Signed-off-by: Alok Tiwari Reviewed-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit 880245fd029a8f8ee8fd557c2681d077c1b1a959 Author: Jacob Moroni Date: Tue Sep 23 14:21:28 2025 +0000 RDMA/irdma: Remove unused struct irdma_cq fields These fields were set but not used anywhere, so remove them. Link: https://patch.msgid.link/r/20250923142128.943240-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe commit 4bab6d9584497191c449212c85799de4d84a1263 Author: Dan Carpenter Date: Tue Sep 23 14:20:45 2025 +0300 RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() This code accidentally returns positive EINVAL instead of negative -EINVAL. Some of the callers treat positive returns as success. Add the missing '-' char. Fixes: a24a29c8747f ("RDMA/irdma: Add Atomic Operations support") Link: https://patch.msgid.link/r/aNKCjcD6Nab1jWEV@stanley.mountain Signed-off-by: Dan Carpenter Signed-off-by: Jason Gunthorpe commit 45d78cd0bf2c40e74c31f70340484e20aae45b07 Author: SungMin Park Date: Wed Sep 17 12:43:11 2025 +0530 dt-bindings: timer: exynos4210-mct: Add compatible for ARTPEC-9 SoC Add Axis ARTPEC-9 mct compatible to the bindings documentation. The design for the timer is reused from previous Samsung SoCs like exynos4210 and ARTPEC-8. Signed-off-by: SungMin Park Signed-off-by: Ravi Patel Signed-off-by: Daniel Lezcano Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250917071311.1404-1-ravi.patel@samsung.com commit 7fcf00bd7f30540cf7096c8f2fadab5d890d4cf2 Author: Anantha Prabhu Date: Tue Sep 23 11:56:57 2025 +0530 RDMA/bnxt_re: Remove non-statistics counters from hw_counters Remove non-statistics counters from the RDMA hw_counters framework. The removed data includes: - Active resource counts (ACTIVE_PD, ACTIVE_QP, etc.) - Resource watermarks (WATERMARK_PD, WATERMARK_QP, etc.) - Operational counters (RESIZE_CQ_CNT) - DB pacing metrics (PACING_RESCHED, PACING_CMPL, etc.) This change ensures hw_counters contains only true performance and error statistics. Link: https://patch.msgid.link/r/20250923062657.981487-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Anantha Prabhu Signed-off-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit 604f202bc9ebf9d8a96caec3375a7ba3bcf149b2 Author: Anantha Prabhu Date: Tue Sep 23 11:56:56 2025 +0530 RDMA/bnxt_re: Add debugfs info entry for device and resource information Add a new debugfs info entry that displays device information and non-statistics data using the seq_file interface. This entry shows: - Resource watermarks (peak usage tracking) - Operational counters (CQ resize count) - Doorbell pacing information Link: https://patch.msgid.link/r/20250923062657.981487-2-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Anantha Prabhu Signed-off-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit e216c49b3ebb0729c50870ebfb8b798376dc1edf Author: Takashi Sakamoto Date: Wed Sep 24 22:18:23 2025 +0900 Revert "firewire: core: disable bus management work temporarily during updating topology" This reverts commit abe7159125702c734e851bc0c52b51cd446298a5. The bus manager work item acquires the spin lock of fw_card again, thus no need to serialize it against fw_core_handle_bus_reset(). Link: https://lore.kernel.org/r/20250924131823.262136-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit a6176b7b2a025f050740887238a7fbd3916ab6b5 Author: Takashi Sakamoto Date: Wed Sep 24 22:18:22 2025 +0900 Revert "firewire: core: shrink critical section of fw_card spinlock in bm_work" This reverts commit 582310376d6e9a8d261b682178713cdc4b251af6. The bus manager work has the race condition against fw_destroy_nodes() called by fw_core_remove_card(). The acquition of spin lock of fw_card is left as is again. Link: https://lore.kernel.org/r/20250924131823.262136-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 8ec6a8ec23b9529d6203cab50a22fab3a5fd0d80 Author: Takashi Sakamoto Date: Wed Sep 24 22:11:40 2025 +0900 firewire: core: suppress overflow warning when computing jiffies from isochronous cycle The multiplication by USEC_PER_SEC (=1000000L) may trigger an overflow warning with 32 bit storage. In the case of the subsystem the input value ranges between 800 and 16000, thus the result always fits within 32 bit storage. This commit suppresses the warning by using widening conversion to 64 bit storage before multiplication, then using narrowing conversion to 32 bit storage. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509170136.b5ZHaNAV-lkp@intel.com/ Fixes: 379b870c28c6 ("firewire: core: use helper macros instead of direct access to HZ") Link: https://lore.kernel.org/r/20250924131140.261686-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 2235b26c1b25daf253748acff501af3ea85faaa8 Author: Bartosz Golaszewski Date: Wed Sep 17 10:54:06 2025 +0200 gpio: generic: move GPIO_GENERIC_ flags to the correct header These flags are specific to gpio-mmio and belong in linux/gpio/generic.h so move them there. Link: https://lore.kernel.org/r/20250917-gpio-generic-flags-v1-2-69f51fee8c89@linaro.org Signed-off-by: Bartosz Golaszewski commit 64f89f6e1f2b7f8f203d218a8c8d90922e1d4048 Author: Bartosz Golaszewski Date: Wed Sep 17 10:54:05 2025 +0200 gpio: generic: rename BGPIOF_ flags to GPIO_GENERIC_ Make the flags passed to gpio_generic_chip_init() use the same prefix as the rest of the modernized generic GPIO chip API. Link: https://lore.kernel.org/r/20250917-gpio-generic-flags-v1-1-69f51fee8c89@linaro.org Signed-off-by: Bartosz Golaszewski commit f85e254b51aeadf8dc367aaf2fbd2c20378f75c2 Author: Caleb Sander Mateos Date: Tue Sep 23 09:52:48 2025 -0600 ublk: remove redundant zone op check in ublk_setup_iod() ublk_setup_iod() checks first whether the request is a zoned operation issued to a device without zoned support and returns BLK_STS_IOERR if so. However, such a request would already hit the default case in the subsequent switch statement and fail the ublk_queue_is_zoned() check, which also results in a return of BLK_STS_IOERR. So remove the redundant early check for unsupported zone ops. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit dc64b3d42cb361d4b39eb7cc73037fec52ef9676 Author: Dan Carpenter Date: Tue Sep 23 14:28:39 2025 +0300 ASoC: codecs: wcd-common: fix signedness bug in wcd_dt_parse_micbias_info() The error handling does not work because common->micb_vout[] is an array of u32. We need a signed variable to store negative error codes. Fixes: 4f16b6351bbf ("ASoC: codecs: wcd: add common helper for wcd codecs") Signed-off-by: Dan Carpenter Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/aNKEZ3VqJ8js208v@stanley.mountain Signed-off-by: Mark Brown commit 2cc6710595fb2b693e1e9da4521d9a438d653ad8 Merge: 6be988660b4745 82fd5dc99d63f9 Author: Mark Brown Date: Wed Sep 24 13:45:01 2025 +0200 MediaTek devicetree/bindings warnings sanitization Merge series from Julien Massot : This patch series continues the effort to address Device Tree validation warnings for MediaTek platforms, with a focus on MT8183. It follows the initial cleanup series by Angelo (https://www.spinics.net/lists/kernel/msg5780177.html). The patches in this set eliminate several of the remaining warnings by improving or converting DT bindings to DT schema, adding missing properties, and updating device tree files accordingly. commit 2084660ad288c998b6f0c885e266deb364f65fba Author: Ilkka Koskinen Date: Tue Sep 23 14:31:36 2025 -0700 perf/dwc_pcie: Fix use of uninitialized variable Fix use of uninitialized variable in group validation code. Fixes: 71396cfac97d ("perf/dwc_pcie: Support counting multiple lane events in parallel") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202509231223.gZsX6Eio-lkp@intel.com/ Signed-off-by: Ilkka Koskinen Signed-off-by: Will Deacon commit cc80dbb73b5d0c75b105e5214f34e1360670e0a5 Author: Daniel Almeida Date: Mon Aug 25 15:18:06 2025 -0300 samples: rust: add a USB driver sample In light of the newly-added Rust abstractions for USB devices and drivers, add a sample USB rust driver that serves both to showcase what is currently supported, as well as be the only user of the USB abstractions for now. Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250825-b4-usb-v1-2-7aa024de7ae8@collabora.com [ force USB = y for now - gregkh ] Signed-off-by: Greg Kroah-Hartman commit e7e2296b0ecf9b6e934f7a1118cee91d4d486a84 Author: Daniel Almeida Date: Mon Aug 25 15:18:05 2025 -0300 rust: usb: add basic USB abstractions Add basic USB abstractions, consisting of usb::{Device, Interface, Driver, Adapter, DeviceId} and the module_usb_driver macro. This is the first step in being able to write USB device drivers, which paves the way for USB media drivers - for example - among others. This initial support will then be used by a subsequent sample driver, which constitutes the only user of the USB abstractions so far. Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250825-b4-usb-v1-1-7aa024de7ae8@collabora.com [ force USB = y for now - gregkh ] Signed-off-by: Greg Kroah-Hartman commit a446baa83e98e15b8f911ab7371b405f3063d65a Merge: d943fa61aeebac 01f96b812526a2 Author: Greg Kroah-Hartman Date: Wed Sep 24 13:05:19 2025 +0200 Merge tag 'coresight-next-v6.18-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for Linux v6.18, take 2 This is an updated drop for v6.18, fixing the invalid commit reference in the original tag. CoreSight selfhosted tracing subsystem updates targeting Linux v6.18, includes: - Clean up and consolidate clocks handling - Support for exposing labels via sysfs for better device identification - Add Qualcomm Trace Network On Chip driver support - Miscellaneous fixes Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.18-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits) coresight: Add label sysfs node support dt-bindings: arm: Add label in the coresight components coresight: tnoc: add new AMBA ID to support Trace Noc V2 coresight: Fix incorrect handling for return value of devm_kzalloc coresight: tpda: fix the logic to setup the element size coresight: trbe: Return NULL pointer for allocation failures coresight: Refactor runtime PM coresight: Make clock sequence consistent coresight: Refactor driver data allocation coresight: Consolidate clock enabling coresight: Avoid enable programming clock duplicately coresight: Appropriately disable trace bus clocks coresight: Appropriately disable programming clocks coresight: etm4x: Support atclk coresight: catu: Support atclk coresight: tmc: Support atclk coresight-etm4x: Conditionally access register TRCEXTINSELR coresight: fix indentation error in cscfg_remove_owned_csdev_configs() coresight: tnoc: Fix a NULL vs IS_ERR() bug in probe coresight: add coresight Trace Network On Chip driver ... commit 8aa035a8407f6b6e999afa33839e38267fdc8790 Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:42 2025 +0300 HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker() Those functions were initially excepted from using the scoped_guard() infrastructure as they contain too many long statements, while adding yet another level of indentation seemed to lower readability without bringing an immediate benefit. However, consistency should be more important, hence do the switch and get rid of the remaining explicit acquires & releases of the spinlocks. Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit 3969f77f5dd5c69d513a33f350128e61e0e1ab00 Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:41 2025 +0300 HID: playstation: Silence sparse warnings for locking context imbalances It seems sparse has some difficulties with guard() handling or when mixing it with scoped_guard(), as it shows a bunch lock related warnings: hid-playstation.c:1230:32: warning: context imbalance in 'dualsense_player_led_set_brightness' - wrong count at exit hid-playstation.c:1414:12: warning: context imbalance in 'dualsense_parse_report' - wrong count at exit hid-playstation.c:1615:12: warning: context imbalance in 'dualsense_play_effect' - different lock contexts for basic block hid-playstation.c:1668:13: warning: context imbalance in 'dualsense_set_lightbar' - wrong count at exit hid-playstation.c:1680:13: warning: context imbalance in 'dualsense_set_player_leds' - wrong count at exit hid-playstation.c:2185:33: warning: context imbalance in 'dualshock4_led_set_blink' - wrong count at exit hid-playstation.c:2226:33: warning: context imbalance in 'dualshock4_led_set_brightness' - wrong count at exit hid-playstation.c:2596:12: warning: context imbalance in 'dualshock4_play_effect' - different lock contexts for basic block hid-playstation.c:2634:13: warning: context imbalance in 'dualshock4_set_bt_poll_interval' - wrong count at exit hid-playstation.c:2642:13: warning: context imbalance in 'dualshock4_set_default_lightbar_colors' - wrong count at exit Silent them by switching from guard() to scoped_guard() in {dualsense|dualshock4}_schedule_work(). Reported-by: Benjamin Tissoires Suggested-by: Benjamin Tissoires Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit d335230cb29b7f578dba0b770d97cd320c83892b Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:40 2025 +0300 HID: playstation: Update SP preamp gain comment line Adjusting speaker pre-amp gain to 0x2 indicates +6dB, hence update the related comment line accordingly. Suggested-by: Roderick Colenbrander Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit afb100a5ea7a13d7e6937dcd3b36b19dc6cc9328 Author: Renjiang Han Date: Thu Sep 18 17:31:08 2025 +0530 media: venus: pm_helpers: add fallback for the opp-table Since the device trees for both HFI_VERSION_1XX and HFI_VERSION_3XX do not include an opp-table and have not configured opp-pmdomain, they still need to use the frequencies defined in the driver's freq_tbl. Both core_power_v1 and core_power_v4 functions require core_clks_enable function during POWER_ON. Therefore, in the core_clks_enable function, if calling dev_pm_opp_find_freq_ceil to obtain the frequency fails, it needs to fall back to the freq_tbl to retrieve the frequency. Fixes: b179234b5e59 ("media: venus: pm_helpers: use opp-table for the frequency") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Closes: https://lore.kernel.org/linux-media/CA+G9fYu5=3n84VY+vTbCAcfFKOq7Us5vgBZgpypY4MveM=eVwg@mail.gmail.com Signed-off-by: Renjiang Han Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 94662f560bfff75b58a7a68cab4bbd276c785da7 Author: Loic Poulain Date: Wed Sep 17 14:43:12 2025 +0200 media: qcom: camss: vfe: Fix BPL alignment for QCM2290 VFE-340 requires 8-byte alignment instead of 16-byte. This adjustment prevents image corruption/misaligment when padding is needed. Example: For SRGGB10_1X10/3280x2464, aligned BPL was 4112 instead of 4104 Fixes: 9e89149a19ed ("media: qcom: camss: add support for QCM2290 camss") Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 Author: Eric Dumazet Date: Wed Sep 24 07:27:09 2025 +0000 netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack ct_seq_show() has an opportunistic garbage collector : if (nf_ct_should_gc(ct)) { nf_ct_kill(ct); goto release; } So if one nf_conn is killed there, next time ct_get_next() runs, we skip the following item in the bucket, even if it should have been displayed if gc did not take place. We can decrement st->skip_elems to tell ct_get_next() one of the items was removed from the chain. Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack") Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit 94bd247bc25b7f1560f96e9c912db3ec1fc878ea Author: Florian Westphal Date: Wed Sep 10 01:39:48 2025 +0200 selftests: netfilter: nft_concat_range.sh: add check for double-create bug Add a test case for bug resolved with: 'netfilter: nft_set_pipapo_avx2: fix skip of expired entries'. It passes on nf.git (it uses the generic/C version for insertion duplicate check) but fails on unpatched nf-next if AVX2 is supported: cannot create same element twice 0s [FAIL] Could create element twice in same transaction table inet filter { # handle 8 [..] elements = { 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0, 1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0, 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0, 1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0 } Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 5823699a11cf3c05d751b473c66920d2d3cac0a5 Author: Florian Westphal Date: Tue Sep 9 14:11:48 2025 +0200 netfilter: nft_set_pipapo_avx2: fix skip of expired entries KASAN reports following splat: BUG: KASAN: slab-out-of-bounds in pipapo_get_avx2+0x941/0x25d0 Read of size 1 at addr ffff88814c561be0 by task nft/3944 Call Trace: pipapo_get_avx2+0x941/0x25d0 nft_pipapo_insert+0x440/0x11b0 nf_tables_newsetelem+0x220a/0x3a00 .. This bisects to commit 84c1da7b38d9 ("netfilter: nft_set_pipapo: use AVX2 algorithm for insertions too"). However, that change merely uncovers this bug. When we find a match but that match has expired or timed out, the AVX2 implementation restarts the full match loop. At that point, the pointer to the key data has already been changed and points to the keys last field. This will then result in out-of-bounds read once its incremented again for the next field. The restart logic in AVX2 is different compared to the plain C implementation, but both should follow the same logic. The C implementation just calls pipapo_refill() again do check the next entry. Do the same in the AVX2 implementation. Note that with this change, due to implementation differences of pipapo_refill vs. nft_pipapo_avx2_refill, the refill call will return the same element again. Then, on the next call, it will move to the next entry as expected. This is because avx2_refill doesn't clear the bitmap in the 'last' conditional. This is harmless. Expired/timed out elements are also not expected to be frequent. selftest is added in a followup commit. Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation") Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 4dbac7db17f1e973fbbd6aea07a00181cd4cd162 Author: Florian Westphal Date: Tue Sep 16 18:34:01 2025 +0200 netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups In commit c4eaca2e1052 ("netfilter: nft_set_pipapo: don't check genbit from packetpath lookups") I replaced genmask_cur() with NFT_GENMASK_ANY, but this change has no effect in the pipapo set type. New entries are unreachable from the active copy, so NFT_GENMASK_ANY has same result as genmask_cur(): current-gen elements are disabled and the new-generation elements cannot be found. Tests did not catch this incomplete fix because the change also dropped the genmask test from the AVX2 version of the algorithm, so test only fails if host cpu lacks AVX2 support. Use genmask test only from the control plane (inserts, deletions, ..). Packet path has to skip the check, use of 0 is enough for this because ext->genmask has a the relevant bit set when the element is INACTIVE in that generation: using a 0 genmask thus makes nft_set_elem_active() always return true. Fix the comment and replace NFT_GENMASK_ANY with 0. Fixes: c4eaca2e1052 ("netfilter: nft_set_pipapo: don't check genbit from packetpath lookups") Signed-off-by: Florian Westphal commit 09efbac953f6f076a07735f9ba885148d4796235 Author: Fernando Fernandez Mancera Date: Fri Sep 19 14:40:43 2025 +0200 netfilter: nfnetlink: reset nlh pointer during batch replay During a batch replay, the nlh pointer is not reset until the parsing of the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") that is problematic as the condition to add an ACK for batch begin will evaluate to true even if NLM_F_ACK wasn't used for batch begin message. If there is an error during the command processing, netlink is sending an ACK despite that. This misleads userspace tools which think that the return code was 0. Reset the nlh pointer to the original one when a replay is triggered. Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 134121bfd99a06d44ef5ba15a9beb075297c0821 Author: Slavin Liu Date: Fri Sep 12 01:57:59 2025 +0800 ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") Suggested-by: Julian Anastasov Signed-off-by: Slavin Liu Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e Author: Andrea Righi Date: Wed Sep 24 10:14:26 2025 +0200 bpf: Mark kfuncs as __noclone Some distributions (e.g., CachyOS) support building the kernel with -O3, but doing so may break kfuncs, resulting in their symbols not being properly exported. In fact, with gcc -O3, some kfuncs may be optimized away despite being annotated as noinline. This happens because gcc can still clone the function during IPA optimizations, e.g., by duplicating or inlining it into callers, and then dropping the standalone symbol. This breaks BTF ID resolution since resolve_btfids relies on the presence of a global symbol for each kfunc. Currently, this is not an issue for upstream, because we don't allow building the kernel with -O3, but it may be safer to address it anyway, to prevent potential issues in the future if compilers become more aggressive with optimizations. Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never cloned and remain distinct, globally visible symbols, regardless of the optimization level. Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs") Acked-by: David Vernet Acked-by: Yonghong Song Signed-off-by: Andrea Righi Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com Signed-off-by: Alexei Starovoitov commit ceeaa7135723d77eb1bdab90379125d7c5a56696 Merge: 34f033a6c9c94a 3d237467a444d4 Author: Alexei Starovoitov Date: Wed Sep 24 02:25:07 2025 -0700 Merge branch 'uprobe-bpf-allow-to-change-app-registers-from-uprobe-registers' Jiri Olsa says: ==================== we recently had several requests for tetragon to be able to change user application function return value or divert its execution through instruction pointer change. This patchset adds support for uprobe program to change app's registers including instruction pointer. v4 changes: - rebased on bpf-next/master, we will handle the future simple conflict with tip/perf/core - changed condition in kprobe_prog_is_valid_access [Andrii] - added acks ==================== Link: https://patch.msgid.link/20250916215301.664963-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 3d237467a444d4f23b78ac72210fe5860cd7aed8 Author: Jiri Olsa Date: Tue Sep 16 23:53:01 2025 +0200 selftests/bpf: Add kprobe multi write ctx attach test Adding test to check we can't attach kprobe multi program that writes to the context. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-7-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 1b881ee294b2d8929a77b0e489047765d55f0191 Author: Jiri Olsa Date: Tue Sep 16 23:53:00 2025 +0200 selftests/bpf: Add kprobe write ctx attach test Adding test to check we can't attach standard kprobe program that writes to the context. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-6-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 6a4ea0d1cb4408a7ca8ad0d12bd1d08a35838160 Author: Jiri Olsa Date: Tue Sep 16 23:52:59 2025 +0200 selftests/bpf: Add uprobe context ip register change test Adding test to check we can change the application execution through instruction pointer change through uprobe program. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 7f8a05c5d388668d5631275b3e3a59bfc8669e06 Author: Jiri Olsa Date: Tue Sep 16 23:52:58 2025 +0200 selftests/bpf: Add uprobe context registers changes test Adding test to check we can change common register values through uprobe program. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 4363264111e1297fa37aa39b0598faa19298ecca Author: Jiri Olsa Date: Tue Sep 16 23:52:57 2025 +0200 uprobe: Do not emulate/sstep original instruction when ip is changed If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length. This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution. If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it. Acked-by: Oleg Nesterov Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 7384893d970ea114952aef54ad7e3d7d2ca82d4f Author: Jiri Olsa Date: Tue Sep 16 23:52:56 2025 +0200 bpf: Allow uprobe program to change context registers Currently uprobe (BPF_PROG_TYPE_KPROBE) program can't write to the context registers data. While this makes sense for kprobe attachments, for uprobe attachment it might make sense to be able to change user space registers to alter application execution. Since uprobe and kprobe programs share the same type (BPF_PROG_TYPE_KPROBE), we can't deny write access to context during the program load. We need to check on it during program attachment to see if it's going to be kprobe or uprobe. Storing the program's write attempt to context and checking on it during the attachment. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 82fd5dc99d63f948c59ac3b08137ef49125938bc Author: Julien Massot Date: Tue Aug 26 09:39:39 2025 +0200 ASoC: dt-binding: Convert MediaTek mt8183-mt6358 to DT schema Convert the existing text-based DT binding for MT8183 sound cards using MT6358 and various other codecs to a DT schema. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-6-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit cf5be90ee4dfa3c38dc64fbcc4fb70fa0180b7b7 Author: Julien Massot Date: Tue Aug 26 09:39:38 2025 +0200 ASoC: Convert MT8183 DA7219 sound card to DT schema Convert the Device Tree binding for MT8183-based boards using the DA7219 headset codec and optional MAX98357, RT1015 or RT1015P speaker amplifiers from the legacy .txt format to DT schema. This improves binding validation and removes DT schema warnings for boards using these audio components. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-5-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit 52aefc1e3c5fbdfdd216796fbe78443ae67e447f Author: Julien Massot Date: Tue Aug 26 09:39:35 2025 +0200 ASoC: dt-binding: Convert mt8183-afe-pcm to dt-schema Convert the MediaTek MT8183 AFE PCM Device Tree binding from the old .txt format to dt-schema format to improve validation. While converting, also document all clock inputs and memory-region used by the AFE block. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-2-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit 56d9de46715245c9cc46dbe16830e431056abbc3 Author: Marco Crivellari Date: Tue Sep 23 16:59:05 2025 +0200 wifi: libertas: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. Explicitly add the WQ_UNBOUND flag to alloc_workqueue() users, marking the workqueue unbound. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250923145905.327269-2-marco.crivellari@suse.com [use imperative voice in subject, fix typos] Signed-off-by: Johannes Berg commit 04ffa809728f106e1f8824ba0a0ee32054e393bd Author: Johannes Berg Date: Wed Sep 24 10:47:48 2025 +0200 Revert "wifi: libertas: WQ_PERCPU added to alloc_workqueue users" This reverts commit 1e06a137513d ("wifi: libertas: WQ_PERCPU added to alloc_workqueue users") since there's really no reason to use per-CPU here. Signed-off-by: Johannes Berg commit 6be988660b474564c77cb6ff60776dafcd850a18 Author: Colin Ian King Date: Tue Sep 23 19:50:06 2025 +0100 ASoc: tas2783A: Fix spelling mistake "Perifpheral" -> "Peripheral" There is a spelling mistake in a dev_dbg debug message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250923185006.213861-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 70a0bcde87512c269269443444c109740dcacc19 Author: Chen Ni Date: Wed Sep 24 10:05:40 2025 +0800 ASoc: tas2783A: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20250924020540.234560-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 Author: Xiaowei Li Date: Wed Sep 24 11:16:50 2025 +0800 USB: serial: option: add SIMCom 8230C compositions Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. USB Device Listings: 0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9078 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=907b Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01 I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Xiaowei Li Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit df10932ad740ba1f871b6dd2ddafc7dc8cea944f Author: Tejun Heo Date: Tue Sep 23 20:38:23 2025 -1000 Revert "sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast()" This reverts commit c8191ee8e64a8c5c021a34e32868f2380965e82b which triggers the following suspicious RCU usage warning: [ 6.647598] ============================= [ 6.647603] WARNING: suspicious RCU usage [ 6.647605] 6.17.0-rc7-virtme #1 Not tainted [ 6.647608] ----------------------------- [ 6.647608] ./include/linux/rhashtable.h:602 suspicious rcu_dereference_check() usage! [ 6.647610] [ 6.647610] other info that might help us debug this: [ 6.647610] [ 6.647612] [ 6.647612] rcu_scheduler_active = 2, debug_locks = 1 [ 6.647613] 1 lock held by swapper/10/0: [ 6.647614] #0: ffff8b14bbb3cc98 (&rq->__lock){-.-.}-{2:2}, at: +raw_spin_rq_lock_nested+0x20/0x90 [ 6.647630] [ 6.647630] stack backtrace: [ 6.647633] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.17.0-rc7-virtme #1 +PREEMPT(full) [ 6.647643] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 6.647646] Sched_ext: beerland_1.0.2_g27d63fc3_x86_64_unknown_linux_gnu (enabled+all) [ 6.647648] Call Trace: [ 6.647652] [ 6.647655] dump_stack_lvl+0x78/0xe0 [ 6.647665] lockdep_rcu_suspicious+0x14a/0x1b0 [ 6.647672] __rhashtable_lookup.constprop.0+0x1d5/0x250 [ 6.647680] find_dsq_for_dispatch+0xbc/0x190 [ 6.647684] do_enqueue_task+0x25b/0x550 [ 6.647689] enqueue_task_scx+0x21d/0x360 [ 6.647692] ? trace_lock_acquire+0x22/0xb0 [ 6.647695] enqueue_task+0x2e/0xd0 [ 6.647698] ttwu_do_activate+0xa2/0x290 [ 6.647703] sched_ttwu_pending+0xfd/0x250 [ 6.647706] __flush_smp_call_function_queue+0x1cd/0x610 [ 6.647714] __sysvec_call_function_single+0x34/0x150 [ 6.647720] sysvec_call_function_single+0x6e/0x80 [ 6.647726] [ 6.647726] [ 6.647727] asm_sysvec_call_function_single+0x1a/0x20 Reported-by: Andrea Righi Signed-off-by: Tejun Heo commit 7378b003e9e091b9ee69d0545a6468057e7dbc91 Merge: 5d726c4dbeedde 2e482655019ab6 Author: Jens Axboe Date: Tue Sep 23 23:12:20 2025 -0600 Merge tag 'nvme-6.18-2025-09-23' of git://git.infradead.org/nvme into for-6.18/block Pull NVMe updates from Keith: " - FC target fixes (Daniel) - Authentication fixes and updates (Martin, Chris) - Admin controller handling (Kamaljit) - Target lockdep assertions (Max) - Keep-alive updates for discovery (Alastair) - Suspend quirk (Georg)" * tag 'nvme-6.18-2025-09-23' of git://git.infradead.org/nvme: nvme: Use non zero KATO for persistent discovery connections nvmet: add safety check for subsys lock nvme-core: use nvme_is_io_ctrl() for I/O controller check nvme-core: do ioccsz/iorcsz validation only for I/O controllers nvme-core: add method to check for an I/O controller nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk nvme-auth: use hkdf_expand_label() nvme-auth: add hkdf_expand_label() nvme-tcp: send only permitted commands for secure concat nvme-fc: use lock accessing port_state and rport state nvmet-fcloop: call done callback even when remote port is gone nvmet-fc: avoid scheduling association deletion twice nvmet-fc: move lsop put work to nvmet_fc_ls_req_op nvme-auth: update bi_directional flag commit 492263fd564c882a7170a58d3dffb4574de042d4 Author: Anup Patel Date: Mon Aug 18 09:38:57 2025 +0530 dt-bindings: mailbox: Add bindings for RPMI shared memory transport Add device tree bindings for the common RISC-V Platform Management Interface (RPMI) shared memory transport as a mailbox controller. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-2-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit dc1dea796b197aba2c3cae25bfef45f4b3ad46fe Author: Kuniyuki Iwashima Date: Tue Sep 23 00:54:19 2025 +0000 tcp: Remove stale locking comment for TFO. The listener -> child locking no longer exists in the fast path since commit e994b2f0fb92 ("tcp: do not lock listener to process SYN packets"). Let's remove the stale comment for reqsk_fastopen_remove(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250923005441.4131554-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e8ab231782e92bc26e5eb605263525636a2f7ae7 Author: Vadim Fedorenko Date: Mon Sep 22 16:19:24 2025 -0700 net: ethtool: tsconfig: set command must provide a reply Timestamping configuration through ethtool has inconsistent behavior of skipping the reply for set command if configuration was not changed. Fix it be providing reply in any case. Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Signed-off-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com Signed-off-by: Jakub Kicinski commit f67e9ae72dd72ae37d186d68f7a9f9eb8082cd95 Author: Petr Machata Date: Mon Sep 22 16:14:49 2025 +0200 selftests: bridge_fdb_local_vlan_0: Test FDB vs. NET_ADDR_SET behavior The previous patch fixed an issue whereby no FDB entry would be created for the bridge itself on VLAN 0 under some circumstances. This could break forwarding. Add a test for the fix. Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/137cc25396f5a4f407267af895a14bc45552ba5f.1758550408.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 Author: Petr Machata Date: Mon Sep 22 16:14:48 2025 +0200 net: bridge: Install FDB for bridge MAC on VLAN 0 Currently, after the bridge is created, the FDB does not hold an FDB entry for the bridge MAC on VLAN 0: # ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 92:19:8c:4e:01:ed # bridge fdb show | grep 92:19:8c:4e:01:ed 92:19:8c:4e:01:ed dev br vlan 1 master br permanent Later when the bridge MAC is changed, or in fact when the address is given during netdevice creation, the entry appears: # ip link add name br up address 00:11:22:33:44:55 type bridge # bridge fdb show | grep 00:11:22:33:44:55 00:11:22:33:44:55 dev br vlan 1 master br permanent 00:11:22:33:44:55 dev br master br permanent However when the bridge address is set by the user to the current bridge address before the first port is enslaved, none of the address handlers gets invoked, because the address is not actually changed. The address is however marked as NET_ADDR_SET. Then when a port is enslaved, the address is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not added, and it has not been added previously either: # ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 # ip link set dev br addr 7e:f0:a8:1a:be:c2 # ip link add name v up type veth # ip link set dev v master br # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 # bridge fdb | grep 7e:f0:a8:1a:be:c2 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent Then when the bridge MAC is used as DMAC, and br_handle_frame_finish() looks up an FDB entry with VLAN=0, it doesn't find any, and floods the traffic instead of passing it up. Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always on netdevice creation. This also makes the behavior consistent with how ports are treated: ports always have an FDB entry for each member VLAN as well as VLAN 0. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit bc992abe0fd1faa8c470c4a652f360b733d5bded Merge: 7e554f317be8e4 092263a0310553 Author: Jakub Kicinski Date: Tue Sep 23 16:58:44 2025 -0700 Merge branch 'net-phy-stop-exporting-phy_driver_register' Heiner Kallweit says: ==================== net: phy: stop exporting phy_driver_register Once the last user of a clock in dp83640 has been removed, the clock should be removed. So far orphaned clocks are cleaned up in dp83640_free_clocks() only. Add the logic to remove orphaned clocks in dp83640_remove(). This allows to simplify the code, and use standard macro module_phy_driver(). dp83640 was the last external user of phy_driver_register(), so we can stop exporting this function afterwards. ==================== Link: https://patch.msgid.link/b86c2ecc-41f6-4f7f-85db-b7fa684d1fb7@gmail.com Signed-off-by: Jakub Kicinski commit 092263a03105539b8dfe74c59be4c6cce1304d5f Author: Heiner Kallweit Date: Sat Sep 20 23:34:07 2025 +0200 net: phy: stop exporting phy_driver_register phy_driver_register() isn't used outside phy_device.c any longer, so we can stop exporting it. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/dff44b83-4a85-4fff-bf6b-f12efd97b56e@gmail.com Signed-off-by: Jakub Kicinski commit 42e2a9e11a1dcb81c83d50d18c547dc9a1c6d6ed Author: Heiner Kallweit Date: Sat Sep 20 23:33:16 2025 +0200 net: phy: dp83640: improve phydev and driver removal handling Once the last user of a clock has been removed, the clock should be removed. So far orphaned clocks are cleaned up in dp83640_free_clocks() only. Add the logic to remove orphaned clocks in dp83640_remove(). This allows to simplify the code, and use standard macro module_phy_driver(). dp83640 was the last external user of phy_driver_register(), so we can stop exporting this function afterwards. Signed-off-by: Heiner Kallweit Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/6d4e80e7-c684-4d95-abbd-ea62b79a9a8a@gmail.com Signed-off-by: Jakub Kicinski commit 7e554f317be8e41ce2f2ce9f6faca14e697b0d26 Author: Heiner Kallweit Date: Sat Sep 20 23:11:54 2025 +0200 net: phy: move config symbol MDIO_BUS to drivers/net/phy/Kconfig Config symbol MDIO_BUS isn't used in drivers/net/mdio. It's only used in drivers/net/phy. So move it there. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/164ff1c6-2cf9-4e30-80fb-da4cc7165dc8@gmail.com Signed-off-by: Jakub Kicinski commit f77064586026df2acbab0631df237d4147350983 Author: Alok Tiwari Date: Sun Sep 21 12:21:08 2025 -0700 selftests: rtnetlink: correct error message in rtnetlink.sh fou test The rtnetlink FOU selftest prints an incorrect string: "FAIL: fou"s. Change it to the intended "FAIL: fou" by removing a stray character in the end_test string of the test. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250921192111.1567498-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 09630ab91d840416b0178f3660afa4eebce24286 Author: Gustavo A. R. Silva Date: Mon Sep 22 16:08:21 2025 +0200 net: airoha: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that `struct airoha_foe_entry` is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: drivers/net/ethernet/airoha/airoha_eth.h:474:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Link: https://patch.msgid.link/aNFYVYLXQDqm4yxb@kspp Signed-off-by: Jakub Kicinski commit b650bf0977d34c52befb31a9fa711534e11b220f Author: Eric Dumazet Date: Mon Sep 22 10:42:40 2025 +0000 udp: remove busylock and add per NUMA queues busylock was protecting UDP sockets against packet floods, but unfortunately was not protecting the host itself. Under stress, many cpus could spin while acquiring the busylock, and NIC had to drop packets. Or packets would be dropped in cpu backlog if RPS/RFS were in place. This patch replaces the busylock by intermediate lockless queues. (One queue per NUMA node). This means that fewer number of cpus have to acquire the UDP receive queue lock. Most of the cpus can either: - immediately drop the packet. - or queue it in their NUMA aware lockless queue. Then one of the cpu is chosen to process this lockless queue in a batch. The batch only contains packets that were cooked on the same NUMA node, thus with very limited latency impact. Tested: DDOS targeting a victim UDP socket, on a platform with 6 NUMA nodes (Intel(R) Xeon(R) 6985P-C) Before: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 1004179 0.0 Udp6InErrors 3117 0.0 Udp6RcvbufErrors 3117 0.0 After: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 1116633 0.0 Udp6InErrors 14197275 0.0 Udp6RcvbufErrors 14197275 0.0 We can see this host can now proces 14.2 M more packets per second while under attack, and the victim socket can receive 11 % more packets. I used a small bpftrace program measuring time (in us) spent in __udp_enqueue_schedule_skb(). Before: @udp_enqueue_us[398]: [0] 24901 |@@@ | [1] 63512 |@@@@@@@@@ | [2, 4) 344827 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [4, 8) 244673 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [8, 16) 54022 |@@@@@@@@ | [16, 32) 222134 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [32, 64) 232042 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [64, 128) 4219 | | [128, 256) 188 | | After: @udp_enqueue_us[398]: [0] 5608855 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [1] 1111277 |@@@@@@@@@@ | [2, 4) 501439 |@@@@ | [4, 8) 102921 | | [8, 16) 29895 | | [16, 32) 43500 | | [32, 64) 31552 | | [64, 128) 979 | | [128, 256) 13 | | Note that the remaining bottleneck for this platform is in udp_drops_inc() because we limited struct numa_drop_counters to only two nodes so far. Signed-off-by: Eric Dumazet Acked-by: Paolo Abeni Reviewed-by: Willem de Bruijn Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250922104240.2182559-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 34f033a6c9c94a6e71c03133f006931bf7d5678b Merge: 8b52d09a1dfe94 5000380e3204fa Author: Martin KaFai Lau Date: Tue Sep 23 16:23:58 2025 -0700 Merge branch 'bpf-next/xdp_pull_data' into 'bpf-next/master' Merge the xdp_pull_data stable branch into the master branch. No conflict. Signed-off-by: Martin KaFai Lau commit a729c16646198872e345bf6c48dbe540ad8a9753 Author: Manivannan Sadhasivam Date: Mon Sep 22 21:46:45 2025 +0530 PCI: qcom: Remove custom ASPM enablement code Since the PCI subsystem has started enabling all ASPM states for all devicetree based platforms, the ASPM enablement code from this driver can now be dropped. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922-pci-dt-aspm-v2-2-2a65cf84e326@oss.qualcomm.com commit f3ac2ff14834a0aa056ee3ae0e4b8c641c579961 Author: Manivannan Sadhasivam Date: Mon Sep 22 21:46:44 2025 +0530 PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms So far, the PCI subsystem has honored the ASPM and Clock PM states set by the BIOS (through LNKCTL) during device initialization, if it relies on the default state selected using: * Kconfig: CONFIG_PCIEASPM_DEFAULT=y, or * cmdline: "pcie_aspm=off", or * FADT: ACPI_FADT_NO_ASPM This was done conservatively to avoid issues with the buggy devices that advertise ASPM capabilities, but behave erratically if the ASPM states are enabled. So the PCI subsystem ended up trusting the BIOS to enable only the ASPM states that were known to work for the devices. But this turned out to be a problem for devicetree platforms, especially the ARM based devicetree platforms powering Embedded and *some* Compute devices as they tend to run without any standard BIOS. So the ASPM states on these platforms were left disabled during boot and the PCI subsystem never bothered to enable them, unless the user has forcefully enabled the ASPM states through Kconfig, cmdline, and sysfs or the device drivers themselves, enabling the ASPM states through pci_enable_link_state() APIs. This caused runtime power issues on those platforms. So a couple of approaches were tried to mitigate this BIOS dependency without user intervention by enabling the ASPM states in the PCI controller drivers after device enumeration, and overriding the ASPM/Clock PM states by the PCI controller drivers through an API before enumeration. But it has been concluded that none of these mitigations should really be required and the PCI subsystem should enable the ASPM states advertised by the devices without relying on BIOS or the PCI controller drivers. If any device is found to be misbehaving after enabling ASPM states that they advertised, then those devices should be quirked to disable the problematic ASPM/Clock PM states. In an effort to do so, start by overriding the ASPM and Clock PM states set by the BIOS for devicetree platforms first. Separate helper functions are introduced to override the BIOS set states by enabling all of them if of_have_populated_dt() returns true. To aid debugging, print the overridden ASPM and Clock PM states as well. In the future, these helpers could be extended to allow other platforms like VMD, newer ACPI systems with a cutoff year etc... to follow the path. Link: https://lore.kernel.org/linux-pci/20250828204345.GA958461@bhelgaas Suggested-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam [bhelgaas: tweak comments and dmesg logs] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922-pci-dt-aspm-v2-1-2a65cf84e326@oss.qualcomm.com commit 55d5a5154d751023bdf12c196fb0f1accdacf300 Merge: 2dfd8b8de66d9b 5000380e3204fa Author: Martin KaFai Lau Date: Tue Sep 23 15:46:52 2025 -0700 Merge branch 'bpf-next/xdp_pull_data' into 'bpf-next/net' Merge the xdp_pull_data stable branch into the net branch. No conflict. Signed-off-by: Martin KaFai Lau commit 649764145b70a0328fc020fe31fc80594761a707 Author: Wolfram Sang Date: Tue Sep 23 22:35:58 2025 +0200 i3c: Remove superfluous FIXME I2C adapters can already change timeout and retry parameters via IOCTL. This allows for better tuning to workloads compared to per-adapter defaults. So, the FIXME is not needed. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250923203557.18298-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit da3a88e9656c17a34daf49c9acc6d85f73b4d3d9 Author: Bartosz Golaszewski Date: Wed Sep 10 09:25:46 2025 +0200 pinctrl: use more common syntax for compound literals The (typeof(foo)) construct is unusual in the kernel, use a more typical syntax by explicitly spelling out the type. Link: https://lore.kernel.org/all/20250909-gpio-mmio-gpio-conv-part4-v1-13-9f723dc3524a@linaro.org/ Suggested-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 Author: Alistair Francis Date: Tue Sep 2 13:52:11 2025 +1000 nvme: Use non zero KATO for persistent discovery connections The NVMe Base Specification 2.1 states that: """ A host requests an explicit persistent connection ... by specifying a non-zero Keep Alive Timer value in the Connect command. """ As such if we are starting a persistent connection to a discovery controller and the KATO is currently 0 we need to update KATO to a non zero value to avoid continuous timeouts on the target. Signed-off-by: Alistair Francis Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 20015410fbdff3633418484165c694f6ceeb855b Author: Max Gurtovoy Date: Sun Sep 21 15:44:05 2025 +0300 nvmet: add safety check for subsys lock Replace comment about required lock with a lockdep_assert_held() check in the following functions: - nvmet_p2pmem_ns_add_p2p() - nvmet_setup_p2p_ns_map() - nvmet_release_p2p_ns_map() This ensures the subsystem lock is held at runtime. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 80e653fab6676fdcdfe2710cab5fc4312ac47edd Author: Martin George Date: Mon Sep 22 17:35:32 2025 +0530 nvme-core: use nvme_is_io_ctrl() for I/O controller check Replace the current I/O controller check in nvme_init_non_mdts_limits() with the helper nvme_is_io_ctrl() function to maintain consistency with similar checks in other parts of the code and improve code readability. Signed-off-by: Martin George Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit f7e9a615302fec524445da213745609a06b9914d Author: Kamaljit Singh Date: Fri Sep 5 16:25:50 2025 -0700 nvme-core: do ioccsz/iorcsz validation only for I/O controllers An administrative controller does not support I/O queues, hence it should ignore existing checks for IOCCSZ/IORCSZ. Currently, these checks only exclude a discovery controller but need to also exclude an administrative controller. Signed-off-by: Kamaljit Singh Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit a5b852797411a65b99b467766a03be8f24284ddc Author: Kamaljit Singh Date: Fri Sep 5 16:25:49 2025 -0700 nvme-core: add method to check for an I/O controller Add nvme_is_io_ctrl() to check if the controller is of type I/O controller. Uses negative logic by excluding an administrative controller and a discovery controller. Signed-off-by: Kamaljit Singh Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 5000380e3204fa19a049c6ad5549ff3412124abd Merge: 54728bd535fb38 efec2e55bdefb8 Author: Martin KaFai Lau Date: Tue Sep 23 13:35:13 2025 -0700 Merge branch 'add-kfunc-bpf_xdp_pull_data' Amery Hung says: ==================== Add kfunc bpf_xdp_pull_data v7 -> v6 patch 5 (new patch) - Rename variables in bpf_prog_test_run_xdp() patch 6 - Fix bugs (Martin) v6 -> v5 patch 6 - v5 selftest failed on S390 when changing how tailroom occupied by skb_shared_info is calculated. Revert selftest to v4, where we get SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) by running an XDP program Link: https://lore.kernel.org/bpf/20250919230952.3628709-1-ameryhung@gmail.com/ v5 -> v4 patch 1 - Add a new patch clearing pfmemalloc bit in xdp->frags when all frags are freed in bpf_xdp_adjust_tail() (Maciej) patch 2 - Refactor bpf_xdp_shrink_data() (Maciej) patch 3 - Clear pfmemalloc when all frags are freed in bpf_xdp_pull_data() (Maciej) patch 6 - Use BTF to get sizes of skb_shared_info and xdp_frame (Maciej) Link: https://lore.kernel.org/bpf/20250919182100.1925352-1-ameryhung@gmail.com/ v3 -> v4 patch 2 - Improve comments (Jakub) - Drop new_end and len_free to simplify code (Jakub) patch 4 - Instead of adding is_xdp to bpf_test_init, move lower-bound check of user_size to callers (Martin) - Simplify linear data size calculation (Martin) patch 5 - Add static function identifier (Martin) - Free calloc-ed buf (Martin) Link: https://lore.kernel.org/bpf/20250917225513.3388199-1-ameryhung@gmail.com/ v2 -> v3 Separate mlx5 fixes from the patchset patch 2 - Use headroom for pulling data by shifting metadata and data down (Jakub) - Drop the flags argument (Martin) patch 4 - Support empty linear xdp data for BPF_PROG_TEST_RUN Link: https://lore.kernel.org/bpf/20250915224801.2961360-1-ameryhung@gmail.com/ v1 -> v2 Rebase onto bpf-next Try to build on top of the mlx5 patchset that avoids copying payload to linear part by Christoph but got a kernel panic. Will rebase on that patchset if it got merged first, or separate the mlx5 fix from this set. patch 1 - Remove the unnecessary head frag search (Dragos) - Rewind the end frag pointer to simplify the change (Dragos) - Rewind the end frag pointer and recalculate truesize only when the number of frags changed (Dragos) patch 3 - Fix len == zero behavior. To mirror bpf_skb_pull_data() correctly, the kfunc should do nothing (Stanislav) - Fix a pointer wrap around bug (Jakub) - Use memmove() when moving sinfo->frags (Jakub) Link: https://lore.kernel.org/bpf/20250905173352.3759457-1-ameryhung@gmail.com/ ==================== Link: https://patch.msgid.link/20250922233356.3356453-1-ameryhung@gmail.com Signed-off-by: Martin KaFai Lau commit efec2e55bdefb889639a6e7fe1f1f2431cdddc6a Author: Amery Hung Date: Mon Sep 22 16:33:56 2025 -0700 selftests: drv-net: Pull data before parsing headers It is possible for drivers to generate xdp packets with data residing entirely in fragments. To keep parsing headers using direct packet access, call bpf_xdp_pull_data() to pull headers into the linear data area. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-9-ameryhung@gmail.com commit 89a3ecca49ee889cc1ab4def6caa0452df196efb Author: Pratyush Yadav Date: Wed Sep 17 14:56:54 2025 +0200 kho: make sure page being restored is actually from KHO When restoring a page, no sanity checks are done to make sure the page actually came from a kexec handover. The caller is trusted to pass in the right address. If the caller has a bug and passes in a wrong address, an in-use page might be "restored" and returned, causing all sorts of memory corruption. Harden the page restore logic by stashing in a magic number in page->private along with the order. If the magic number does not match, the page won't be touched. page->private is an unsigned long. The union kho_page_info splits it into two parts, with one holding the order and the other holding the magic number. Link: https://lkml.kernel.org/r/20250917125725.665-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 20571b187051e5b78b48b99c9bdd425c94b29e18 Author: Pratyush Yadav Date: Wed Sep 17 14:56:53 2025 +0200 kho: move sanity checks to kho_restore_page() While KHO exposes folio as the primitive externally, internally its restoration machinery operates on pages. This can be seen with kho_restore_folio() for example. It performs some sanity checks and hands it over to kho_restore_page() to do the heavy lifting of page restoration. After the work done by kho_restore_page(), kho_restore_folio() only converts the head page to folio and returns it. Similarly, deserialize_bitmap() operates on the head page directly to store the order. Move the sanity checks for valid phys and order from the public-facing kho_restore_folio() to the private-facing kho_restore_page(). This makes the boundary between page and folio clearer from KHO's perspective. While at it, drop the comment above kho_restore_page(). The comment is misleading now. The function stopped looking like free_reserved_page() since 12b9a2c05d1b4 ("kho: initialize tail pages for higher order folios properly"), and now looks even more different. Link: https://lkml.kernel.org/r/20250917125725.665-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 0389c305ef56cbadca4cbef44affc0ec3213ed30 Author: Lance Yang Date: Wed Sep 17 21:31:37 2025 +0800 selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled The madv_populate and soft-dirty kselftests currently fail on systems where CONFIG_MEM_SOFT_DIRTY is disabled. Introduce a new helper softdirty_supported() into vm_util.c/h to ensure tests are properly skipped when the feature is not enabled. Link: https://lkml.kernel.org/r/20250917133137.62802-1-lance.yang@linux.dev Fixes: 9f3265db6ae8 ("selftests: vm: add test for Soft-Dirty PTE bit") Signed-off-by: Lance Yang Acked-by: David Hildenbrand Suggested-by: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Cc: Gabriel Krisman Bertazi Cc: Signed-off-by: Andrew Morton commit 8d009da32f13759ee7a6ec002ba62dc8faeb6423 Author: SeongJae Park Date: Wed Sep 17 08:31:54 2025 -0700 mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case damon_ctx->addr_unit is respected only for physical address space monitoring use case. Meanwhile, damon_ctx->min_sz_region is used by the core layer for aligning regions, regardless of whether it is set for physical address space monitoring or virtual address spaces monitoring. And it is set as 'DAMON_MIN_REGION / damon_ctx->addr_unit'. Hence, if user sets ->addr_unit on virtual address spaces monitoring mode, regions can be unexpectedly aligned in min_sz_region only when it is configured for physical address space monitoring. The issue was found from a result of Chris' experiments that thankfully shared with me off-list. Link: https://lkml.kernel.org/r/20250917160041.53187-1-sj@kernel.org Fixes: d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") Signed-off-by: SeongJae Park Cc: Chris Mason Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit 7ef5268a907534c4e6373b0d3fe45e0b3d95bfe2 Author: Uladzislau Rezki (Sony) Date: Wed Sep 17 20:59:06 2025 +0200 mm/vmalloc: move resched point into alloc_vmap_area() Currently vm_area_alloc_pages() contains two cond_resched() points. However, the page allocator already has its own in slow path so an extra resched is not optimal because it delays the loops. The place where CPU time can be consumed is in the VA-space search in alloc_vmap_area(), especially if the space is really fragmented using synthetic stress tests, after a fast path falls back to a slow one. Move a single cond_resched() there, after dropping free_vmap_area_lock in a slow path. This keeps fairness where it matters while removing redundant yields from the page-allocation path. [akpm@linux-foundation.org: tweak comment grammar] Link: https://lkml.kernel.org/r/20250917185906.1595454-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Baoquan He Cc: Michal Hocko Signed-off-by: Andrew Morton commit 1b00ab48892fe6115618e2c81f9c1891ad0c0a5a Author: Matthew Wilcox (Oracle) Date: Tue Sep 16 19:11:59 2025 +0100 ksm: use a folio inside cmp_and_merge_page() This removes the last call to page_stable_node(), so delete the wrapper. It also removes a call to trylock_page() and saves a call to compound_head(), as well as removing a reference to folio->page. Link: https://lkml.kernel.org/r/20250916181219.2400258-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chengming Zhou Acked-by: David Hildenbrand Cc: Longlong Xia Cc: xu xin Signed-off-by: Andrew Morton commit 19c5fb83f2a4dde7b53b3aeb1fa87bfa3559286b Author: Johannes Weiner Date: Fri Sep 19 12:21:34 2025 -0400 mm: page_alloc: avoid kswapd thrashing due to NUMA restrictions On NUMA systems without bindings, allocations check all nodes for free space, then wake up the kswapds on all nodes and retry. This ensures all available space is evenly used before reclaim begins. However, when one process or certain allocations have node restrictions, they can cause kswapds on only a subset of nodes to be woken up. Since kswapd hysteresis targets watermarks that are *higher* than needed for allocation, even *unrestricted* allocations can now get suckered onto such nodes that are already pressured. This ends up concentrating all allocations on them, even when there are idle nodes available for the unrestricted requests. This was observed with two numa nodes, where node0 is normal and node1 is ZONE_MOVABLE to facilitate hotplugging: a kernel allocation wakes kswapd on node0 only (since node1 is not eligible); once kswapd0 is active, the watermarks hover between low and high, and then even the movable allocations end up on node0, only to be kicked out again; meanwhile node1 is empty and idle. Similar behavior is possible when a process with NUMA bindings is causing selective kswapd wakeups. To fix this, on NUMA systems augment the (misleading) watermark test with a check for whether kswapd is already active during the first iteration through the zonelist. If this fails to place the request, kswapd must be running everywhere already, and the watermark test is good enough to decide placement. With this patch, unrestricted requests successfully make use of node1, even while kswapd is reclaiming node0 for restricted allocations. [gourry@gourry.net: don't retry if no kswapds were active] Link: https://lkml.kernel.org/r/20250919162134.1098208-1-hannes@cmpxchg.org Signed-off-by: Gregory Price Tested-by: Joshua Hahn Signed-off-by: Johannes Weiner Acked-by: Zi Yan Cc: Brendan Jackman Cc: Joshua Hahn Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fde591dad10900b9b4af07a532b5f91c53b20e25 Author: Lorenzo Stoakes Date: Wed Sep 17 06:16:37 2025 +0100 mm/oom_kill.c: fix inverted check Fix an incorrect logic conversion in process_mrelease(). Link: https://lkml.kernel.org/r/3b7f0faf-4dbc-4d67-8a71-752fbcdf0906@lucifer.local Fixes: 12e423ba4eae ("mm: convert core mm to mm_flags_*() accessors") Signed-off-by: Lorenzo Stoakes Reported-by: Chris Mason Closes: https://lkml.kernel.org/r/c2e28e27-d84b-4671-8784-de5fe0d14f41@lucifer.local Signed-off-by: Andrew Morton commit f8a01513f5749180228d6460662188dd1e101a53 Author: Kiryl Shutsemau Date: Mon Sep 15 14:52:53 2025 +0100 mm/khugepaged: do not fail collapse_pte_mapped_thp() on SCAN_PMD_NULL MADV_COLLAPSE on a file mapping behaves inconsistently depending on if PMD page table is installed or not. Consider following example: p = mmap(NULL, 2UL << 20, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); err = madvise(p, 2UL << 20, MADV_COLLAPSE); fd is a populated tmpfs file. The result depends on the address that the kernel returns on mmap(). If it is located in an existing PMD table, the madvise() will succeed. However, if the table does not exist, it will fail with -EINVAL. This occurs because find_pmd_or_thp_or_none() returns SCAN_PMD_NULL when a page table is missing, which causes collapse_pte_mapped_thp() to fail. SCAN_PMD_NULL and SCAN_PMD_NONE should be treated the same in collapse_pte_mapped_thp(): install the PMD leaf entry and allocate page tables as needed. Link: https://lkml.kernel.org/r/v5ivpub6z2n2uyemlnxgbilzs52ep4lrary7lm7o6axxoneb75@yfacfl5rkzeh Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Reviewed-by: Zach O'Keefe Cc: Barry Song Cc: "Kirill A. Shutemov" Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ff0bebab778c7474c328bc7e5e9bf3c39bf4fc1a Merge: ebc5eb9ea01fec dcc7a571a3665a Author: Arnd Bergmann Date: Tue Sep 23 23:08:23 2025 +0200 Merge tag 'tee-qcomtee-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers Add Qualcomm TEE driver (QTEE) This introduces a Trusted Execution Environment (TEE) driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs) and services to run securely. It uses an object-based interface, where each service is an object with sets of operations. Kernel and userspace services are also available to QTEE through a similar approach. QTEE makes callback requests that are converted into object invocations. These objects can represent services within the kernel or userspace process. We extend the TEE subsystem to understand object parameters and an ioctl call so client can invoke objects in QTEE: - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_* - TEE_IOC_OBJECT_INVOKE The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are used for invoking services in the userspace process by QTEE. The TEE backend driver uses the QTEE Transport Message to communicate with QTEE. Interactions through the object INVOKE interface are translated into QTEE messages. Likewise, object invocations from QTEE for userspace objects are converted into SEND/RECV ioctl calls to supplicants. * tag 'tee-qcomtee-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: Documentation: tee: Add Qualcomm TEE driver tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl tee: qcom: add primordial object tee: add Qualcomm TEE driver tee: increase TEE_MAX_ARG_SIZE to 4096 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF tee: add close_context to TEE driver operation tee: allow a driver to allocate a tee_device without a pool Link: https://lore.kernel.org/r/20250915174957.GA2040478@rayden Signed-off-by: Arnd Bergmann commit ebc5eb9ea01fecda0bf0666d856adc699d177150 Merge: 7150189b621b5f 3804cef4c59742 Author: Arnd Bergmann Date: Tue Sep 23 23:07:31 2025 +0200 Merge tag 'memory-controller-drv-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.18 1. STM32 OMM: Fix ineffective/missing setting of the req2ack in the device based on DT property, if the value is different than 0. 2. Samsung Exynos SROM: Fix IO map resource leak if of_platform_populate() in probe() failed. 3. Broadcom brcmstb: Document existing, older devices in Devicetree bindings. 4. Tegra 210 EMC: Document OPP table for interconnects (driver usage will come later) and define memory client IDs as bindings, because these are shared between DTS and driver. * tag 'memory-controller-drv-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra210: Use bindings for client ids dt-bindings: memory: tegra210: Add memory client IDs dt-bindings: memory: tegra210: emc: Document OPP table and interconnect dt-bindings: memory: Update brcmstb-memc-ddr binding with older chips memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe memory: stm32_omm: Fix req2ack update test Link: https://lore.kernel.org/r/20250912140030.204650-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 32cdf411b4f8c23f6a5e6d897a64d1501dfaaee3 Merge: ca8f96ffe67fa9 a1b20e06224557 Author: Arnd Bergmann Date: Tue Sep 23 23:06:28 2025 +0200 Merge tag 'v6.18-rockchip-arm32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/arm Commit d1bef995f61a ("ARM: rockchip: force built-in regulator support for PM") introduced the REGULATOR if PM dependency for the suspend code, while commit d1558dfd9f22 ("ARM: rockchip: Force CONFIG_PM on Rockchip systems") later always enabled PM. So we can simplify the REGULATOR dependency by dropping the if PM. * tag 'v6.18-rockchip-arm32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: remove REGULATOR conditional to PM Link: https://lore.kernel.org/r/6025175.zQ0Gbyo6oJ@diego Signed-off-by: Arnd Bergmann commit ca8f96ffe67fa97b39ac56cec8acbe87cec299f7 Merge: 1cdfe53d5798cb bb676996ed5834 Author: Arnd Bergmann Date: Tue Sep 23 23:05:04 2025 +0200 Merge tag 'omap-for-v6.18/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: OMAP: SoC: updates for v6.18 * tag 'omap-for-v6.18/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: OMAP2+: clock: convert from round_rate() to determine_rate() ARM: OMAP1: clock: convert from round_rate() to determine_rate() arm: omap2: use string choices helper ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init ARM: OMAP2+: use IS_ERR_OR_NULL() helper ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) Link: https://lore.kernel.org/r/7h7bxup0ob.fsf@baylibre.com Signed-off-by: Arnd Bergmann commit 1cdfe53d5798cbad2a1e67a108e8b3a4ef08edfb Merge: 9685b297597264 747436750bc0ef Author: Arnd Bergmann Date: Tue Sep 23 23:04:23 2025 +0200 Merge tag 'at91-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/arm Microchip arm-soc updates for v6.18 This update includes: - low priority fixes to the PM code, in relation to recent addition of sam9x75 or sama7d65 SoCs - removal of the 2.5V regulator for low power modes since this is no longer supported * tag 'at91-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: pm: Remove 2.5V regulator ARM: at91: pm: save and restore ACR during PLL disable/enable ARM: at91: pm: fix MCKx restore routine ARM: at91: pm: fix .uhp_udp_mask specification for current SoCs Link: https://lore.kernel.org/r/20250916150328.27015-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit 7150189b621b5fc7bfbd069d441cd8c6eefeabc9 Merge: be6d2636807649 e6b84cc2a6fe62 Author: Arnd Bergmann Date: Tue Sep 23 23:02:47 2025 +0200 Merge tag 'sunxi-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers Allwinner driver changes for 6.18 Some changes to the sram driver. One to register a syscon explicitly. Another to add a new driver entry for the A523, which has two Ethernet controllers, and thus has two RGMII clock delay control registers. * tag 'sunxi-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: soc: sunxi: sram: register regmap as syscon soc: sunxi: sram: add entry for a523 Link: https://lore.kernel.org/r/aMrsfw-_v3IAiKH8@wens.tw Signed-off-by: Arnd Bergmann commit be6d2636807649b8b20f956e70b54b799aab5cfd Merge: 833bb53d5ecf22 037e496038f6e4 Author: Arnd Bergmann Date: Tue Sep 23 23:01:25 2025 +0200 Merge tag 'ti-driver-soc-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.18 - ti_sci: Add support for abort handling of entry to Low Power Mode - k3-socinfo: Add decode for AM62L SR1.1 silicon revision - pruss: Replace usage of %pK in printk with safer %p formatting * tag 'ti-driver-soc-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: k3-socinfo: Add information for AM62L SR1.1 firmware: ti_sci: Enable abort handling of entry to LPM soc: ti: pruss: don't use %pK through printk Link: https://lore.kernel.org/r/20250916175441.iehltsk2377rg5c6@alike Signed-off-by: Arnd Bergmann commit 833bb53d5ecf22a0f950da98712008f32f406991 Merge: 72af4030bef819 0454346d1c5f7f Author: Arnd Bergmann Date: Tue Sep 23 23:00:33 2025 +0200 Merge tag 'amlogic-drivers-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic Drivers changes for v6.18: - device leak at probe in meson_sm - fix compile-test default for meson_sm * tag 'amlogic-drivers-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: firmware: firmware: meson-sm: fix compile-test default firmware: meson_sm: fix device leak at probe Link: https://lore.kernel.org/r/003cb467-531d-4a8d-a97f-19d59154132f@linaro.org Signed-off-by: Arnd Bergmann commit a40282dd3c484e6c882e93f4680e0a3ef3814453 Author: Kees Cook Date: Sat Sep 20 16:45:23 2025 -0700 gcc-plugins: Remove TODO_verify_il for GCC >= 16 GCC now runs TODO_verify_il automatically[1], so it is no longer exposed to plugins. Only use the flag on GCC < 16. Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=9739ae9384dd7cd3bb1c7683d6b80b7a9116eaf8 [1] Suggested-by: Christopher Fore Link: https://lore.kernel.org/r/20250920234519.work.915-kees@kernel.org Signed-off-by: Kees Cook commit 72af4030bef819e49b9fae1d753a730d517d2abc Merge: 3783cdc1df6d4b 442816f97a4f84 Author: Arnd Bergmann Date: Tue Sep 23 22:59:16 2025 +0200 Merge tag 'apple-soc-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers Apple SoC driver updates for 6.18 Krzysztof Kozlowski asked us to move away from generic compatibles: - Adjust all dt-bindings to use apple,t8103-XXXX instead of apple,XXXX as fallback and add a comment that the old generic list should no longer be extended. - Add new fallback compatibles to pinctrl, pmdomain, spi, and mca drivers. These changes have been Acked by their subsystem maintainers to be merged through our tree together with the dt-bindings. Support for pre-M1 Apple Silicon: - SART and mailbox gain support for Apple's A11, which are both required for NVMe. - NVMe also gains support for Apple's A11 and the nvme maintainers prefer that we merge this through the soc tree together with the mailbox and SART changes. - SPMI compatibles for A11 and T2 have been added, also going through the soc tree due to conflicts with the generic compatible removal and because no driver change is required. Signed-off-by: Sven Peter * tag 'apple-soc-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: (32 commits) pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" dt-bindings: spmi: Add Apple A11 and T2 compatible spi: apple: Add "apple,t8103-spi" compatible ASoC: apple: mca: Add "apple,t8103-mca" compatible pinctrl: apple: Add "apple,t8103-pinctrl" as compatible spi: dt-bindings: apple,spi: Add t6020-spi compatible ASoC: dt-bindings: apple,mca: Add t6020-mca compatible dt-bindings: dma: apple,admac: Add t6020-admac compatible dt-bindings: clock: apple,nco: Add t6020-nco compatible dt-bindings: watchdog: apple,wdt: Add t6020-wdt compatible dt-bindings: spmi: apple,spmi: Add t6020-spmi compatible dt-bindings: mfd: apple,smc: Add t6020-smc compatible dt-bindings: net: bcm4329-fmac: Add BCM4388 PCI compatible dt-bindings: net: bcm4377-bluetooth: Add BCM4388 compatible dt-bindings: nvme: apple: Add apple,t6020-nvme-ans2 compatible dt-bindings: iommu: apple,sart: Add apple,t6020-sart compatible dt-bindings: gpu: apple,agx: Add agx-{g14s,g14c,g14d} compatibles dt-bindings: mailbox: apple,mailbox: Add t6020 compatible dt-bindings: pinctrl: apple,pinctrl: Add apple,t6020-pinctrl compatible dt-bindings: iommu: dart: Add apple,t6020-dart compatible ... Link: https://lore.kernel.org/r/20250920123028.49973-1-sven@kernel.org Signed-off-by: Arnd Bergmann commit 3783cdc1df6d4b4337865ceb6709f8f4efed4318 Merge: 9674bc8805cd7a 3f1707306b79ca Author: Arnd Bergmann Date: Tue Sep 23 22:56:29 2025 +0200 Merge tag 'qcom-drivers-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm device driver updates for v6.18 Introduce support for loading firmware into the QUP serial engines from Linux, which allows deferring selection of which protocol (uart, i2c, spi, etc) a given SE should have until the OS loads. Also introduce the "object invoke" interface in the SCM driver, to provide interface to the Qualcomm TEE driver. * tag 'qcom-drivers-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: serial: qcom-geni: Load UART qup Firmware from linux side spi: geni-qcom: Load spi qup Firmware from linux side i2c: qcom-geni: Load i2c qup Firmware from linux side soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem soc: qcom: geni-se: Cleanup register defines and update copyright dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus firmware: qcom: scm: add support for object invocation firmware: qcom: tzmem: export shm_bridge create/delete Link: https://lore.kernel.org/r/20250921020225.595403-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 2136c694a045c347b52366a297d107329796ffe5 Merge: 4a77e9ed4e277d cf0ed173d27a2a Author: Arnd Bergmann Date: Tue Sep 23 22:55:03 2025 +0200 Merge tag 'qcom-arm64-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v6.18 The Qualcomm X Plus platform gained GPU support, enable the required clock controller. The support for Qualcomm QCS615 platform improved, enable the multimedia-related clock controllers. * tag 'qcom-arm64-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable X1P42100 GPUCC driver arm64: defconfig: Enable QCS615 clock controllers Link: https://lore.kernel.org/r/20250921020612.596098-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 4a77e9ed4e277dfaa6455d9005993c6dc62ab917 Merge: 8193017c718201 3e23fc50890d3f Author: Arnd Bergmann Date: Tue Sep 23 22:54:10 2025 +0200 Merge tag 'qcom-arm32-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm32 defconfig updates for v6.18 Remove a bunch of orphaned options from the defconfigs. * tag 'qcom-arm32-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: defconfig: Remove obsolete CONFIG_USB_EHCI_MSM ARM: defconfig: cleanup orphaned CONFIGs Link: https://lore.kernel.org/r/20250921020746.596400-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 0d4495122a5e0e7a32e68884c4037c969eb03764 Merge: 07d0eca0789657 fad32e8ac46019 Author: Arnd Bergmann Date: Tue Sep 23 22:49:41 2025 +0200 Merge tag 'cix-dt-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt CIX device tree changes for v6.18-rc1: - arm64: dts: cix: add DT nodes for all I2C and I3C ports for sky1 * tag 'cix-dt-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: arm64: dts: cix: add DT nodes for all I2C and I3C ports for sky1 Link: https://lore.kernel.org/r/aNIyhPSV6lJaZIvR@nchen-desktop Signed-off-by: Arnd Bergmann commit 07d0eca07896572b9aaa1ea5ed7a5143f1e38245 Merge: a08be517c450b7 c656932c3ece3e Author: Arnd Bergmann Date: Tue Sep 23 22:49:00 2025 +0200 Merge tag 'at91-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.18 This update includes: - sama7d65 and curiosity board: addition of gpio, leds and usart3 - sam9x75: qspi node - one cleanup * tag 'at91-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sam9x7: Add qspi controller ARM: dts: microchip: sama7d65: add uart3 definition for flexcom3 peripheral ARM: dts: microchip: sama7d65: Add GPIO buttons and LEDs ARM: dts: microchip: Minor whitespace cleanup Link: https://lore.kernel.org/r/20250922170346.40876-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit a08be517c450b72ca9e9e3b14201b5cb18cf3bfe Merge: d1f862c0b960c0 07c7f4f4e9504d Author: Arnd Bergmann Date: Tue Sep 23 22:48:16 2025 +0200 Merge tag 'sunxi-dt-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner Device Tree changes for 6.18 - part 2 A new board, the Amediatech X96Q, was added. * tag 'sunxi-dt-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h313: Add Amediatech X96Q dt-bindings: arm: sunxi: Add Amediatech X96Q Link: https://lore.kernel.org/r/aNFg7iuBtyWkCZg6@wens.tw Signed-off-by: Arnd Bergmann commit d1f862c0b960c0ed631ed3c631681f30ec1d77fd Merge: 5ab67bad49fa3f 93781211e9ad95 Author: Arnd Bergmann Date: Tue Sep 23 22:47:26 2025 +0200 Merge tag 'v6.18-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt One new board the ROC-RK3588-RT, gpu improvements for RK3328, frequency scaling for the RK3528 and the very first small steps for camera support on the RK3588 - with the CSI-DPHY support, with more hopefully to come soon'ish :-) . And apart from those bigger points, some more individual peripheral work on some boards. * tag 'v6.18-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Add devicetree for the ROC-RK3588-RT dt-bindings: arm: rockchip: Add Firefly ROC-RK3588-RT arm64: dts: rockchip: update pinctrl names for Radxa E52C arm64: dts: rockchip: remove vcc_3v3_pmu regulator for Radxa E52C arm64: dts: rockchip: Add USB and charger to Gameforce Ace arm64: dts: rockchip: enable the Mali GPU on RK3328 boards arm64: dts: rockchip: add GPU powerdomain, opps, and cooling to rk3328 arm64: dts: rockchip: Fix network on rk3576 evb1 board arm64: dts: rockchip: add mipi csi-2 dphy nodes to rk3588 dt-bindings: soc: rockchip: add rk3588 csidphy grf syscon arm64: dts: rockchip: Add rk3528 CPU frequency scaling support arm64: dts: rockchip: enable HDMI Receiver on NanoPC T6 Link: https://lore.kernel.org/r/2079092.kXSN5OTJKJ@diego Signed-off-by: Arnd Bergmann commit 5ab67bad49fa3f2a6b8fcab988e36f2e885ea0fa Merge: 8de446fd49c2de 2f695d3eac3660 Author: Arnd Bergmann Date: Tue Sep 23 22:46:00 2025 +0200 Merge tag 'qcom-arm64-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualocmm Arm64 DeviceTree updates for v6.18 Introduce the Hamoa IoT SOM and the Hamoa EVK board, the HP Omnibook X14, the Particle Tachyon board, and the Samsung Galaxy S22. On IPQ5018 another set of UART and I2C controllers are added. On Lemans SDHCI and the camera subsystem is introduced, the USB controllers are updated to the new flattened binding. The Lemans EVK gains Ethernet definition, more QUP controllers and their GPI DMA engines are defined. PCIe, SDHCI, remoteproc and iris video accelerator are added as well. On the Monaco platform GPU and GMU are introduced, the USB controller nodes are updated to the new flattened binding. The GPU is enabled on the EVK and the Ride boards. SDCC and MDSS resets are defined on MSM8916, MSM8939 also gets the MDSS reset. On QCM2290 the camera clock interface is added. On the QCS615 tsens and related thermal-zones are introduced. On SDM845 the OnePlus 6 gains notifications LED, and the sensor core (SLPI) is enabled on the Samsung Galaxy S9. WiFi and Bluetooth is enabled on the SM8750 MTP. The IRIS video accelerator is introduce for X Elite and enabled on a variety of laptops. DisplayPort controllers on a variety of boards are updated to describe additional pixel clocks, used for MST. * tag 'qcom-arm64-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (57 commits) arm64: dts: qcom: Add MST pixel streams for displayport arm64: dts: qcom: sm6350: correct DP compatibility strings arm64: dts: qcom: monaco-evk: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300-ride: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300: Add gpu and gmu nodes dt-bindings: arm: qcom: sort sm8450 boards arm64: dts: qcom: Add base HAMOA-IOT-EVK board arm64: dts: qcom: Add HAMOA-IOT-SOM platform dt-bindings: arm: qcom: Document HAMOA-IOT-EVK board arm64: dts: qcom: sm8750-mtp: Add WiFi and Bluetooth arm64: dts: qcom: msm8953-xiaomi-daisy: fix cd-gpios arm64: dts: qcom: ipq5018: add QUP1 UART2 node arm64: dts: qcom: lemans: Flatten usb controller nodes arm64: dts: qcom: qcs615: Enable TSENS support for QCS615 SoC arm64: dts: qcom: sdm845-enchilada: Add notification LED arm64: dts: qcom: apq8016-sbc: Drop redundant HDMI bridge status arm64: dts: qcom: apq8016-sbc: Correct HDMI bridge #sound-dai-cells arm64: dts: qcom: lemans: Add PCIe lane equalization preset properties arm64: dts: qcom: sm8450: enable camera clock controller by default arm64: dts: qcom: qcm2290: Add CCI node ... Link: https://lore.kernel.org/r/20250921022346.598294-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 8de446fd49c2de7f3d766a80c32f039c6445b5c3 Merge: 26116b98d657b4 70fa521f4d5512 Author: Arnd Bergmann Date: Tue Sep 23 22:43:08 2025 +0200 Merge tag 'apple-soc-dt-6.18-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt Apple SoC DTS updates for 6.18, part 2 - New device trees for all M2 Pro, Max and Ultra models are added. This is responsible for most of the changed lines since we already need 2000+ lines just to describe all the power domains inside t602x-pmgr.dtsi for these SoCs. - Missing WiFi properties for t600x are added. - Bluetooth nodes are added for all t600x machines. - The PCIe ethernet iommu-map was fixed for the Apple M1 iMac to account for a disabled PCIe port. - SPMI, NVMe, SART and mailbox nodes for Apple's T2 and A11. * tag 'apple-soc-dt-6.18-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: t8015: Add SPMI node arm64: dts: apple: t8012: Add SPMI node arm64: dts: apple: Add J180d (Mac Pro, M2 Ultra, 2023) device tree arm64: dts: apple: Add J474s, J475c and J475d device trees arm64: dts: apple: Add J414 and J416 Macbook Pro device trees arm64: dts: apple: Add initial t6020/t6021/t6022 DTs arm64: dts: apple: Add ethernet0 alias for J375 template dt-bindings: arm: apple: Add t6020x compatibles arm64: dts: apple: t8015: Add NVMe nodes arm64: dts: apple: t8015: Fix PCIE power domains dependencies arm64: dts: apple: Add devicetreee for t8112-j415 dt-bindings: arm: apple: Add t8112 j415 compatible arm64: dts: apple: t600x: Add bluetooth device nodes arm64: dts: apple: t600x: Add missing WiFi properties arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map Signed-off-by: Arnd Bergmann commit 26116b98d657b4d0ddc4d101a60b6ab072d556dc Merge: 345518c00ba6bc 27322753c8b913 Author: Arnd Bergmann Date: Tue Sep 23 22:40:43 2025 +0200 Merge tag 'omap-for-v6.18/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt ARM: dts: ti: omap updates for v6.18 These are all minor corrections to the dts files. * tag 'omap-for-v6.18/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax ARM: dts: omap: Minor whitespace cleanup ARM: dts: omap: dm816x: Split 'reg' per entry ARM: dts: omap: dm814x: Split 'reg' per entry ARM: dts: am33xx-l4: fix UART compatible ARM: dts: ti: omap4: Use generic "ethernet" as node name Signed-off-by: Arnd Bergmann commit 345518c00ba6bc90c8c557157bc0a6e081e7b2a4 Author: Rob Herring (Arm) Date: Fri Sep 19 11:15:28 2025 -0500 arm64: dts: apm-shadowcat: Drop "apm,xgene2-pcie" compatible The "apm,xgene2-pcie" compatible is unused, undocumented, and in the wrong position in the compatible list. Given this is a mature and little used platform, just remove the compatible rather than fix the order and document it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250919161529.1293151-1-robh@kernel.org Signed-off-by: Arnd Bergmann commit 676af08386e44fd6ea42b43db4c130bf04f36d92 Author: Rob Herring (Arm) Date: Fri Sep 19 11:15:08 2025 -0500 arm64: dts: apm-shadowcat: Move slimpro nodes out of "simple-bus" node The slimpro nodes are not MMIO devices, so they don't belong under a "simple-bus" node. Move them to the top level. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250919161509.1292227-1-robh@kernel.org Signed-off-by: Arnd Bergmann commit 323302f54db92dc1c80ff5b114c20f19ec0adf81 Author: Amery Hung Date: Mon Sep 22 16:33:55 2025 -0700 selftests/bpf: Test bpf_xdp_pull_data Test bpf_xdp_pull_data() with xdp packets with different layouts. The xdp bpf program first checks if the layout is as expected. Then, it calls bpf_xdp_pull_data(). Finally, it checks the 0xbb marker at offset 1024 using directly packet access. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-8-ameryhung@gmail.com commit fe9544ed1a2e9217b2c5285c3a4ac0dc5a38bd7b Author: Amery Hung Date: Mon Sep 22 16:33:54 2025 -0700 bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN To test bpf_xdp_pull_data(), an xdp packet containing fragments as well as free linear data area after xdp->data_end needs to be created. However, bpf_prog_test_run_xdp() always fills the linear area with data_in before creating fragments, leaving no space to pull data. This patch will allow users to specify the linear data size through ctx->data_end. Currently, ctx_in->data_end must match data_size_in and will not be the final ctx->data_end seen by xdp programs. This is because ctx->data_end is populated according to the xdp_buff passed to test_run. The linear data area available in an xdp_buff, max_linear_sz, is alawys filled up before copying data_in into fragments. This patch will allow users to specify the size of data that goes into the linear area. When ctx_in->data_end is different from data_size_in, only ctx_in->data_end bytes of data will be put into the linear area when creating the xdp_buff. While ctx_in->data_end will be allowed to be different from data_size_in, it cannot be larger than the data_size_in as there will be no data to copy from user space. If it is larger than the maximum linear data area size, the layout suggested by the user will not be honored. Data beyond max_linear_sz bytes will still be copied into fragments. Finally, since it is possible for a NIC to produce a xdp_buff with empty linear data area, allow it when calling bpf_test_init() from bpf_prog_test_run_xdp() so that we can test XDP kfuncs with such xdp_buff. This is done by moving lower-bound check to callers as most of them already do except bpf_prog_test_run_skb(). The change also fixes a bug that allows passing an xdp_buff with data < ETH_HLEN. This can happen when ctx is used and metadata is at least ETH_HLEN. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-7-ameryhung@gmail.com commit 7eb83bff02ad5e82e8c456c58717ef181c220870 Author: Amery Hung Date: Mon Sep 22 16:33:53 2025 -0700 bpf: Make variables in bpf_prog_test_run_xdp less confusing Change the variable naming in bpf_prog_test_run_xdp() to make the overall logic less confusing. As different modes were added to the function over the time, some variables got overloaded, making it hard to understand and changing the code becomes error-prone. Replace "size" with "linear_sz" where it refers to the size of metadata and data. If "size" refers to input data size, use test.data_size_in directly. Replace "max_data_sz" with "max_linear_sz" to better reflect the fact that it is the maximum size of metadata and data (i.e., linear_sz). Also, xdp_rxq.frags_size is always PAGE_SIZE, so just set it directly instead of subtracting headroom and tailroom and adding them back. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-6-ameryhung@gmail.com commit 0e7a733ab3d7be8d745e8ee38d637ea7a9b24343 Author: Amery Hung Date: Mon Sep 22 16:33:52 2025 -0700 bpf: Clear packet pointers after changing packet data in kfuncs bpf_xdp_pull_data() may change packet data and therefore packet pointers need to be invalidated. Add bpf_xdp_pull_data() to the special kfunc list instead of introducing a new KF_ flag until there are more kfuncs changing packet data. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-5-ameryhung@gmail.com commit 4dce1a0d7cf39575a5880414ea882890edd8d26f Author: Amery Hung Date: Mon Sep 22 16:33:51 2025 -0700 bpf: Support pulling non-linear xdp data Add kfunc, bpf_xdp_pull_data(), to support pulling data from xdp fragments. Similar to bpf_skb_pull_data(), bpf_xdp_pull_data() makes the first len bytes of data directly readable and writable in bpf programs. If the "len" argument is larger than the linear data size, data in fragments will be copied to the linear data area when there is enough room. Specifically, the kfunc will try to use the tailroom first. When the tailroom is not enough, metadata and data will be shifted down to make room for pulling data. A use case of the kfunc is to decapsulate headers residing in xdp fragments. It is possible for a NIC driver to place headers in xdp fragments. To keep using direct packet access for parsing and decapsulating headers, users can pull headers into the linear data area by calling bpf_xdp_pull_data() and then pop the header with bpf_xdp_adjust_head(). Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250922233356.3356453-4-ameryhung@gmail.com commit dea1526fbafb55099a788cde0b659530ee5b1c66 Author: Amery Hung Date: Mon Sep 22 16:33:50 2025 -0700 bpf: Allow bpf_xdp_shrink_data to shrink a frag from head and tail Move skb_frag_t adjustment into bpf_xdp_shrink_data() and extend its functionality to be able to shrink an xdp fragment from both head and tail. In a later patch, bpf_xdp_pull_data() will reuse it to shrink an xdp fragment from head. Additionally, in bpf_xdp_frags_shrink_tail(), breaking the loop when bpf_xdp_shrink_data() returns false (i.e., not releasing the current fragment) is not necessary as the loop condition, offset > 0, has the same effect. Remove the else branch to simplify the code. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250922233356.3356453-3-ameryhung@gmail.com commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c Author: Amery Hung Date: Mon Sep 22 16:33:49 2025 -0700 bpf: Clear pfmemalloc flag when freeing all fragments It is possible for bpf_xdp_adjust_tail() to free all fragments. The kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when building sk_buff from xdp_buff since all readers of xdp_buff->flags use the flag only when there are fragments. Clear the XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com commit abfbfb98acfe6fd603d48424e32f8d99922e70b9 Merge: 9f1bbcc46ecdee 663bfe77b6f70b Author: Arnd Bergmann Date: Tue Sep 23 22:28:42 2025 +0200 Merge tag 'amlogic-arm64-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v6.18: - Add cache information to the Amlogic SoCs - Add RTC node for Amlogic C3 SoC - Fix PWM node for Amlogic C3 SoC - Remove UHS capability for Odroid-C2 SDCard * tag 'amlogic-arm64-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: gxbb-odroidc2: remove UHS capability for SD card dts: arm: amlogic: fix pwm node for c3 arm64: dts: amlogic: sm1-bananapi: lower SD card speed for stability arm64: dts: amlogic: Add cache information to the Amlogic T7 SoC arm64: dts: amlogic: Add cache information to the Amlogic S922X SoC arm64: dts: amlogic: Add cache information to the Amlogic S7 SoC arm64: dts: amlogic: Add cache information to the Amlogic C3 SoC arm64: dts: amlogic: Add cache information to the Amlogic A4 SoC arm64: dts: amlogic: Add cache information to the Amlogic A1 SoC arm64: dts: amlogic: Add cache information to the Amlogic GXM SoCS arm64: dts: amlogic: Add cache information to the Amlogic AXG SoCS arm64: dts: amlogic: Add cache information to the Amlogic G12A SoCS arm64: dts: amlogic: Add cache information to the Amlogic SM1 SoC arm64: dts: amlogic: Add cache information to the Amlogic GXBB and GXL SoC arm64: dts: amlogic: C3: Add RTC controller node Link: https://lore.kernel.org/r/d40e7e96-4a7c-4e4f-b36f-750c6525b95c@linaro.org Signed-off-by: Arnd Bergmann commit 9f1bbcc46ecdee8fa4fa10b31db839dcc750282f Merge: ec1ede181e16e5 0f860eef417df9 Author: Arnd Bergmann Date: Tue Sep 23 22:26:59 2025 +0200 Merge tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt Another missing supply and a wrong headphone gpio level. * tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6 arm64: dts: rockchip: fix second M.2 slot on ROCK 5T arm64: dts: rockchip: fix USB on RADXA ROCK 5T arm64: dts: rockchip: Add vcc-supply to SPI flash on Pinephone Pro arm64: dts: rockchip: fix es8388 address on rk3588s-roc-pc arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 arm64: dts: rockchip: correct network description on Sige5 arm64: dts: rockchip: Minor whitespace cleanup ARM: dts: rockchip: Minor whitespace cleanup arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 plus arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro arm64: dts: rockchip: mark eeprom as read-only for Radxa E52C commit ec1ede181e16e54f98f0eacbc6b6054677cbf7b8 Merge: 17752efeca0925 0f084b221e2c5b Author: Arnd Bergmann Date: Tue Sep 23 22:22:19 2025 +0200 Merge tag 'spacemit-dt-for-6.18-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.18 - Add OrangePi RV2 board support - Add reset support to UART driver - Add PDMA driver support - Remove sec_uart1 node * tag 'spacemit-dt-for-6.18-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: uart: remove sec_uart1 device node riscv: dts: spacemit: Enable PDMA on Banana Pi F3 and Milkv Jupiter riscv: dts: spacemit: Add PDMA node for K1 SoC riscv: dts: spacemit: add UART resets for Soc K1 riscv: dts: spacemit: Add OrangePi RV2 board device tree dt-bindings: riscv: spacemit: Add OrangePi RV2 board Link: https://lore.kernel.org/r/20250919055525-GYC5766558@gentoo.org Signed-off-by: Arnd Bergmann commit 17752efeca0925bf607fe55abe9eae3136a06d78 Merge: 83ae575d6f0e96 cca07ac2b5f783 Author: Arnd Bergmann Date: Tue Sep 23 22:17:46 2025 +0200 Merge tag 'sunxi-dt-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner Device Tree changes for 6.18 This tag contains two DT binding header changes that are shared with the clk tree. In this cycle we gained support for the MCU PRCM clock and reset controller on the A523/A527/T527 family of SoCs, the NPU which is a Vivante GC9000 IP block, and the NPU clock that was missing. The other PRCM clock controller gained default bus clock rate settings. These were not configured in the upstream U-boot bootloader, leading to them running at slower rates. The assigned rates are from the user manual. There is also a new board, the NetCube Systems Nagami SoM and two of its carrier boards. The A523 family development boards now have their internal RTC clocks configured correctly, so that the RTC does not drift wildly. The missing functions for the AXP717 on these boards are added. Missing reset GPIOs and delays for Ethernet PHYs are added. Last, the Cubie A5E now has its LEDs described and usable. An overlay for the Orange Pi Zero interface (addon) board was added. This can be used with the Orange Pi Zero and Zero Plus 2. Default audio routing for these two boards (to be used with the addon) were added to complement the overlay. * tag 'sunxi-dt-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: sun55i: Complete AXP717A sub-functions arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k crystal arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal arm64: dts: sun55i: a523: Assign standard clock rates to PRCM bus clocks ARM: dts: sunxi: add support for NetCube Systems Nagami Keypad Carrier ARM: dts: sunxi: add support for NetCube Systems Nagami Basic Carrier ARM: dts: sunxi: add support for NetCube Systems Nagami SoM riscv: dts: allwinner: d1s-t113: Add pinctrl's required by NetCube Systems Nagami SoM dt-bindings: arm: sunxi: Add NetCube Systems Nagami SoM and carrier board bindings ARM: dts: allwinner: Add Orange Pi Zero Interface Board overlay ARM: dts: allwinner: orangepi-zero-plus2: Add default audio routing ARM: dts: allwinner: orangepi-zero: Add default audio routing arm64: dts: allwinner: a523: Add NPU device node arm64: dts: allwinner: a523: Add MCU PRCM CCU node dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset setting arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting arm64: dts: allwinner: a527: cubie-a5e: Add LEDs Link: https://lore.kernel.org/r/aMrtuZg8HlR--TAt@wens.tw Signed-off-by: Arnd Bergmann commit 83ae575d6f0e9636c16c62b6ef8980f969574005 Merge: 06510618555067 ffe6a5d1dd4d4d Author: Arnd Bergmann Date: Tue Sep 23 22:15:55 2025 +0200 Merge tag 'v6.17-next-dts64.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt mt8188: - change efuse compatible fallback to make GPU DVFS work - enable SCP core for video decoding and encoding mt8186: - add correct touchscreen compatible for tentacruel and krabby Fixes of DT warnings for many different SoCs and boards. * tag 'v6.17-next-dts64.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: (24 commits) arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes arm64: dts: mediatek: mt8195-cherry: Add missing regulators to rt5682 arm64: dts: mediatek: mt8195-cherry: Move VBAT-supply to Tomato R1/R2 arm64: dts: mediatek: mt8195: Fix ranges for jpeg enc/decoder nodes arm64: dts: mediatek: mt8183-kukui: Move DSI panel node to machine dtsis arm64: dts: mediatek: mt8183: Migrate to display controller OF graph arm64: dts: mediatek: mt8183-pumpkin: Add power supply for CCI arm64: dts: mediatek: pumpkin-common: Fix pinctrl node names arm64: dts: mediatek: mt8183: Fix pinctrl node names arm64: dts: mediatek: acelink-ew-7886cax: Remove unnecessary cells in spi-nand arm64: dts: mediatek: mt7986a-bpi-r3: Set interrupt-parent to mdio switch arm64: dts: mediatek: mt7986a-bpi-r3: Fix SFP I2C node names arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address arm64: dts: mediatek: Fix node name for SYSIRQ controller on all SoCs arm64: dts: mediatek: mt6795-sony-xperia-m5: Add pinctrl for mmc1/mmc2 arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value arm64: dts: mediatek: mt6795: Add mediatek,infracfg to iommu node arm64: dts: mediatek: mt6797: Remove bogus id property in i2c nodes arm64: dts: mediatek: mt6797: Fix pinctrl node names ... Link: https://lore.kernel.org/r/c0e2e902-2a10-44a7-9592-491ba7382df0@gmail.com Signed-off-by: Arnd Bergmann commit 065106185550677bb66231ab0cd0e69fb1d36408 Merge: 21a98498ae6eec 4d94abded400a5 Author: Arnd Bergmann Date: Tue Sep 23 22:15:15 2025 +0200 Merge tag 'riscv-sophgo-dt-for-v6.18' of https://github.com/sophgo/linux into soc/dt RISC-V Devicetrees for v6.18 Sophgo: Minor changes here only for SG2042. Enable numa and we can see significant performance improvements, for example in the STREAM test. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.18' of https://github.com/sophgo/linux: dts: sophgo: sg2042: added numa id description Link: https://lore.kernel.org/r/MAUPR01MB11072ABA02A18CC7AA9B88874FE17A@MAUPR01MB11072.INDPRD01.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 21a98498ae6eec28cf5c1cb54774edc7c41c1910 Merge: 57cff2159b4a06 20b3c9a403ee23 Author: Arnd Bergmann Date: Tue Sep 23 22:14:08 2025 +0200 Merge tag 'ti-keystone-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt Keystone2 device tree updates for v6.18 Cosmetic cleanups: * dt-bindings: Convert ti,keystone to DT schema * tag 'ti-keystone-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: dt-bindings: arm: Convert ti,keystone to DT schema Link: https://lore.kernel.org/r/20250916175415.o2zvkxsbiqdk5i7q@almost Signed-off-by: Arnd Bergmann commit 57cff2159b4a067097fb7aef471f1f9db54244d9 Merge: 2f5049f049a478 fcfedcb6804caa Author: Arnd Bergmann Date: Tue Sep 23 22:11:30 2025 +0200 Merge tag 'ti-k3-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.18 Generic fixes and cleanups: * k3-pinctrl: Fix incorrect macro usage, add missing DeepSleep/drive strength macros * k3: Rename rproc reserved-mem nodes to 'memory@addr' and add labels for reserved-memory * Long time pending major remoteproc firmware refactoring to allow flexibility for downstream variants: - am62x/am62ax: Move Mailbox/Remoteproc nodes to board-level DTS files - am64/am65/j721e/j721s2/j784s4/j742s2/j7200: Move Remoteproc enablement to board-level DTS - am62a/am62/am62p/j722s: Similarly restructure Mailbox/Remoteproc configs - am65/am64: Refactor IPC firmware carveouts/mailboxes into new SoC family-specific dtsi files - j721e/j721s2/j784s4/j742s2/am62/am62p/am62a/am64/am65/j7200/j722s: Refactor IPC firmware configs into new board-independent dtsi files - Various boards: Add missing or corrected carveouts/timers/mailbox configs for IPC firmware alignment * Multiple-boards: Bootph-all property added for USB PHYs to support DFU boot. New Boards/SoM/SiP: * Variscite VAR-SOM-AM62P SoM and carrier boards * AM6254atl SiP package and SK SoC specific changes: AM62P: * Update eMMC HS400 STRB tuning value * Split HS400 support away from J722S due to errata * Add Variscite VAR-SOM-AM62P SoM and Symphony carrier board support AM62: * Remove unused DeepSleep USB1 pin config on SK * Add CSI2 interrupts property on main CSI2RX * Enable Mailbox & Remoteproc at board level * PocketBeagle2 + Verdin variants: Add missing IPC firmware carveouts, enable R5F/M4F AM62A: * Fix padcfg length in pad configuration registers * Remove unused DeepSleep USB1 pin config on SK * Add CSI2 interrupts property * Add 1.4GHz OPP entry for phyCORE-AM62Ax * Enable Mailbox & Remoteproc at board level * Add missing IPC firmware carveouts for PocketBeagle2 and other boards AM62D2: * Add Octal SPI NOR flash (OSPI) support for EVM * Enable USB0/USB1 interface on EVM AM625: * Introduce AM6254atl SiP base SoC support * Add SK-AM6254atl board AM64: * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level * Add PA stats property for PEB-C-010 expansion Ethernet card * phyCORE SoM + SR SoM/Electra board: Add missing IPC firmware configs AM65: * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level AM69: * Switch SERDES0 config to PCIe Multilink + USB mode, enabling independent PCIe1 & PCIe3 link speeds J7200: * Refactor IPC firmware configs into new dtsi * Enable R5F Remoteproc at board level J721E: * Add DSI + DPHY-TX nodes * Add CSI2 interrupts property * BeagleBone AI64: Switch R5 clusters to split mode, add timer reserves for IPC FW, Correct carveouts (revert mistaken reordering of C6x carveouts) * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level J721S2: * Add DSI + DSI PHY nodes * Add USB0 Type-A overlay for EVM * Add CSI2 interrupts property * Ensure PCIe node has proper interrupt-controller #address-cells fixes dtbs_check warning. * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level * Common processor board: Add DisplayPort-1 enable, I2C4 instance for display connector J722S: * Add bootph-all to usb0_phy_ctrl node (DFU) * Add JPEG Encoder node (E5010) * Add CSI2 interrupts properties on main/J722S/AM62P common main * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level J784S4/J742S2: * Add CSI2 interrupts properties on main-common * Add DSI & PHY support * Enable DisplayPort-1 on EVM * Refactor IPC firmware configs into new dtsi (common & SoC-specific) * Enable Remoteproc at board level * J742S2: Override MCU R5 firmware names in dedicated dtsi Board specific changes: AM62P Variscite Symphony Board: * Add support with USB, Eth, Camera, CAN, GPIO expander AM642-phyBOARD-Electra * Add PEB-C-010 Ethernet expansion board overlay * Add PA stats handle AM642-sr/phyCORE * Add missing IPC carveouts for R5F/M4F AM62-Verdin/AM62P-Verdin * Add missing IPC carveouts for R5F/M4F, mailboxes * tag 'ti-k3-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (78 commits) arm64: dts: ti: k3-j721s2-evm: Add overlay to enable USB0 Type-A arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay arm64: dts: ti: var-som-am62p: Add support for Variscite Symphony Board arm64: dts: ti: Add support for Variscite VAR-SOM-AM62P dt-bindings: arm: ti: Add bindings for Variscite VAR-SOM-AM62P arm64: dts: ti: k3-j722s-evm: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62x-sk-common: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62p5-sk: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-j721e-main: Add DSI and DPHY-TX arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros arm64: dts: ti: k3-pinctrl: Add the remaining macros arm64: dts: ti: k3-am62x-sk-common: Remove the unused cfg in USB1_DRVVBUS arm64: dts: ti: k3-am62p5-sk: Remove the unused cfg in USB1_DRVVBUS arm64: dts: ti: k3-am62d2-evm: Add support for OSPI flash arm64: dts: ti: k3-am62d2-evm: Enable USB support arm64: dts: ti: k3-am62a-main: Fix main padcfg length arm64: dts: ti: k3-am62p: Update eMMC HS400 STRB value arm64: dts: ti: k3-am62p/j722s: Remove HS400 support from common arm64: dts: ti: Add support for AM6254atl SiP SK ... Link: https://lore.kernel.org/r/20250916175349.pxg6gxd4vg5vfmhx@overvalue Signed-off-by: Arnd Bergmann commit 958e55f90a01451de77e22063d37b60388219b96 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:32:06 2025 +0200 dt-bindings: i2c: spacemit,k1-i2c: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Troy Mitchell Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 8ab3bd59f9fc210a1a88b509f6931cf3f5ea229a Author: Ivaylo Ivanov Date: Sun Sep 14 16:16:20 2025 +0300 dt-bindings: i2c: exynos5: add samsung,exynos8890-hsi2c compatible Add samsung,exynos8890-hsi2c compatible, reusing the 8895 support since it's compatible with exynos8890's i2c controllers. Signed-off-by: Ivaylo Ivanov Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 8b52d09a1dfe949851675b30b309865ade8ce457 Merge: 0d3bf643b41bc3 d0bf7cd5df1846 Author: Alexei Starovoitov Date: Tue Sep 23 12:29:04 2025 -0700 Merge branch 'riscv-bpf-fix-uninitialized-symbol-retval_off' Chenghao Duan says: ==================== riscv: bpf: Fix uninitialized symbol 'retval_off' v2: Adjust the commit log URL for version v1: https://lore.kernel.org/all/20250820062520.846720-1-duanchenghao@kylinos.cn/ ==================== Link: https://patch.msgid.link/20250922062244.822937-1-duanchenghao@kylinos.cn Signed-off-by: Alexei Starovoitov commit d0bf7cd5df18466d969bb60e8890b74cf96081ca Author: Chenghao Duan Date: Mon Sep 22 14:22:44 2025 +0800 riscv: bpf: Fix uninitialized symbol 'retval_off' In the __arch_prepare_bpf_trampoline() function, retval_off is only meaningful when save_ret is true, so the current logic is correct. However, in the original logic, retval_off is only initialized under certain conditions; for example, in the fmod_ret logic, the compiler is not aware that the flags of the fmod_ret program (prog) have set BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol compilation warning. So initialize retval_off unconditionally to fix it. Signed-off-by: Chenghao Duan Reviewed-by: Pu Lehui Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn Signed-off-by: Alexei Starovoitov commit 0d3bf643b41bc339a02562a4aa382542d046bd0a Author: Quentin Monnet Date: Tue Sep 23 11:38:02 2025 +0100 bpftool: Add bash completion for program signing options Commit 40863f4d6ef2 ("bpftool: Add support for signing BPF programs") added new options for "bpftool prog load" and "bpftool gen skeleton". This commit brings the relevant update to the bash completion file. We rework slightly the processing of options to make completion more resilient for options that take an argument. Signed-off-by: Quentin Monnet Link: https://lore.kernel.org/r/20250923103802.57695-1-qmo@kernel.org Signed-off-by: Alexei Starovoitov commit ebfd5226ec365d0901d3ddee4aba9c737137645c Merge: c0008a5632103e 55ed11b181c43d Author: Tejun Heo Date: Tue Sep 23 09:10:20 2025 -1000 sched_ext: Merge branch 'for-6.17-fixes' into for-6.18 Pull sched_ext/for-6.17-fixes to receive: 55ed11b181c4 ("sched_ext: idle: Handle migration-disabled tasks in BPF code") which conflicts with the following commit in for-6.18: 2407bae23d1e ("sched_ext: Add the @sch parameter to ext_idle helpers") The conflict is a simple context conflict which can be resolved by taking the updated parts from both commits. Signed-off-by: Tejun Heo commit f0b5c1490aa8af7a0fcface6cc99266cff1549be Merge: 2383e45f1da7ac 1c6686bf7fc161 Author: Alexei Starovoitov Date: Tue Sep 23 12:07:47 2025 -0700 Merge branch 'bpf-allow-union-argument-in-trampoline-based-programs' Leon Hwang says: ==================== bpf: Allow union argument in trampoline based programs While tracing 'release_pages' with bpfsnoop[0], the verifier reports: The function release_pages arg0 type UNION is unsupported. However, it should be acceptable to trace functions that have 'union' arguments. This patch set enables such support in the verifier by allowing 'union' as a valid argument type. Changes: v3 -> v4: * Address comments from Alexei: * Trim bpftrace output in patch #1 log. * Drop the referenced commit info and the test output in patch #2 log. v2 -> v3: * Address comments from Alexei: * Reuse the existing flag BTF_FMODEL_STRUCT_ARG. * Update the comment of the flag BTF_FMODEL_STRUCT_ARG. v1 -> v2: * Add 16B 'union' argument support in x86_64 trampoline. * Update selftests using bpf_testmod. * Add test case about 16-bytes 'union' argument. * Address comments from Alexei: * Study the patch set about 'struct' argument support. * Update selftests to cover more cases. v1: https://lore.kernel.org/bpf/20250905133226.84675-1-leon.hwang@linux.dev/ Links: [0] https://github.com/bpfsnoop/bpfsnoop ==================== Link: https://patch.msgid.link/20250919044110.23729-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 1c6686bf7fc161ed87b44b523a96c5ae4bfed351 Author: Leon Hwang Date: Fri Sep 19 12:41:10 2025 +0800 selftests/bpf: Add union argument tests using fexit programs Add test coverage for union argument support using fexit programs: * 8B union argument - verify that the verifier accepts it and that fexit programs can trace such functions. * 16B union argument - verify that the verifier accepts it and that fexit programs can access the argument, which is passed using two registers. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250919044110.23729-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit ccb4f5d91ec43c05ba165ccfc7ed889eb9cdfd05 Author: Leon Hwang Date: Fri Sep 19 12:41:09 2025 +0800 bpf: Allow union argument in trampoline based programs Currently, functions with 'union' arguments cannot be traced with fentry/fexit: bpftrace -e 'fentry:release_pages { exit(); }' -v The function release_pages arg0 type UNION is unsupported. The type of the 'release_pages' arg0 is defined as: typedef union { struct page **pages; struct folio **folios; struct encoded_page **encoded_pages; } release_pages_arg __attribute__ ((__transparent_union__)); This patch relaxes the restriction by allowing function arguments of type 'union' to be traced in verifier. Reviewed-by: Amery Hung Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250919044110.23729-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 6d74ed4c81470b7df89b6688a0a95adcebb4794f Merge: 6e3cb25e62f208 c7ec58c39b0252 Author: Wolfram Sang Date: Tue Sep 23 21:07:40 2025 +0200 Merge tag 'at24-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-mergewindow at24 updates for v6.18-rc1 - add the compatible for Giantec GT24C256C to the device-tree bindings commit c0008a5632103eae31302e83d012e2d3b0cfad41 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Misc updates around scx_sched instance pointer In preparation for multiple scheduler support: - Add the @sch parameter to find_global_dsq() and refill_task_slice_dfl(). - Restructure scx_allow_ttwu_queue() and make it read scx_root into $sch. - Make RCU protection in scx_dsq_move() and scx_bpf_dsq_move_to_local() explicit. v2: Add scx_root -> sch conversion in scx_allow_ttwu_queue(). Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit d4f7d866667c32b097721a96ebf0b19e1c85a75a Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Drop scx_kf_exit() and scx_kf_error() The intention behind scx_kf_exit/error() was that when called from kfuncs, scx_kf_exit/error() would be able to implicitly determine the scx_sched instance being operated on and thus wouldn't need the @sch parameter passed in explicitly. This turned out to be unnecessarily complicated to implement and not have enough practical benefits. Replace scx_kf_exit/error() usages with scx_exit/error() which take an explicit @sch parameter. - Add the @sch parameter to scx_kf_allowed(), scx_kf_allowed_on_arg_tasks, mark_direct_dispatch() and other intermediate functions transitively. - In callers that don't already have @sch available, grab RCU, read $scx_root, verify it's not NULL and use it. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 4d9553fee3e278ca3d90c54c063ce2db01e93268 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to scx_dsq_insert_preamble/commit() In preparation for multiple scheduler support, add the @sch parameter to scx_dsq_insert_preamble/commit() and update the callers to read $scx_root and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 956f2b11a8a4fd2793aaa8a672c70206f0ce4655 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Drop kf_cpu_valid() The intention behind kf_cpu_valid() was that when called from kfuncs, kf_cpu_valid() would be able to implicitly determine the scx_sched instance being operated on and thus wouldn't need @sch passed in explicitly. This turned out to be unnecessarily complicated to implement and not have justifiable practical benefits. Replace kf_cpu_valid() usages with ops_cpu_valid() which takes explicit @sch. Callers which don't have $sch available in the context are updated to read $scx_root under RCU read lock, verify that it's not NULL and pass it in. scx_bpf_cpu_rq() is restructured to use guard(rcu)() instead of explicit rcu_read_[un]lock(). Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 2407bae23d1e93186afccb6a6a98d9bd6a7c8a74 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to ext_idle helpers In preparation for multiple scheduler support, add the @sch parameter to validate_node(), check_builtin_idle_enabled() and select_cpu_from_kfunc(), and update their callers to read $scx_root, verify that it's not NULL and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit fc6a93aa623f3e40bcddbacf5fc60d5aceda9cab Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to __bstr_format() In preparation for multiple scheduler support, add the @sch parameter to __bstr_format() and update the callers to read $scx_root, verify that it's not NULL and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 9fc687edf205dbc45bbdec60ea31e934a05ab6bc Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Separate out scx_kick_cpu() and add @sch to it In preparation for multiple scheduler support, separate out scx_kick_cpu() from scx_bpf_kick_cpu() and add the @sch parameter to it. scx_bpf_kick_cpu() now acquires an RCU read lock, reads $scx_root, and calls scx_kick_cpu() with it if non-NULL. The passed in @sch parameter is not used yet. Internal uses of scx_bpf_kick_cpu() are converted to scx_kick_cpu(). Where $sch is available, it's used. In the pick_task_scx() path where no associated scheduler can be identified, $scx_root is used directly. Note that $scx_root cannot be NULL in this case. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 7852e0fd1de05efadcd8b6f72140cd208c79ba56 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 tools/sched_ext: scx_qmap: Make debug output quieter by default scx_qmap currently outputs verbose debug messages including cgroup operations and CPU online/offline events by default, which can be noisy during normal operation. While the existing -P option controls DSQ dumps and event statistics, there's no way to suppress the other debug messages. Split the debug output controls to make scx_qmap quieter by default. The -P option continues to control DSQ dumps and event statistics (print_dsqs_and_events), while a new -M option controls debug messages like cgroup operations and CPU events (print_msgs). This allows users to run scx_qmap with minimal output and selectively enable debug information as needed. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit d452972858e5cfa4262320ab74fe8f016460b96f Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Make qmap dump operation non-destructive The qmap dump operation was destructively consuming queue entries while displaying them. As dump can be triggered anytime, this can easily lead to stalls. Add a temporary dump_store queue and modify the dump logic to pop entries, display them, and then restore them back to the original queue. This allows dump operations to be performed without affecting the scheduler's queue state. Note that if racing against new enqueues during dump, ordering can get mixed up, but this is acceptable for debugging purposes. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit f3aec2adce8dbe37dabff47a16bfb260b987e0b0 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add SCX_EFLAG_INITIALIZED to indicate successful ops.init() ops.exit() may be called even if the loading failed before ops.init() finishes successfully. This is because ops.exit() allows rich exit info communication. Add SCX_EFLAG_INITIALIZED flag to scx_exit_info.flags to indicate whether ops.init() finished successfully. This enables BPF schedulers to distinguish between exit scenarios and handle cleanup appropriately based on initialization state. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit c7e739746dbde9ae401fd88824f5656c5e2361fc Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Use bitfields for boolean warning flags Convert warned_zero_slice and warned_deprecated_rq in scx_sched struct to single-bit bitfields. While this doesn't reduce struct size immediately, it prepares for future bitfield additions. v2: Update patch description. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit f75efc8f4c0d52f6fe53a0acd9629e3ac017fc3e Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Fix stray scx_root usage in task_can_run_on_remote_rq() task_can_run_on_remote_rq() takes @sch but it is using scx_root when incrementing SCX_EV_DISPATCH_LOCAL_DSQ_OFFLINE, which is inconsistent and gets in the way of implementing multiple scheduler support. Use @sch instead. As currently scx_root is the only possible scheduler instance, this doesn't cause any behavior changes. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit edf005fa274a0c224e550a52726aa7a426384e36 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Improve SCX_KF_DISPATCH comment The comment for SCX_KF_DISPATCH was incomplete and didn't explain that ops.dispatch() may temporarily release the rq lock, allowing ENQUEUE and SELECT_CPU operations to be nested inside DISPATCH contexts. Update the comment to clarify this nesting behavior and provide better context for when these operations can occur within dispatch. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit c8191ee8e64a8c5c021a34e32868f2380965e82b Author: Tejun Heo Date: Tue Sep 23 09:03:25 2025 -1000 sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast() The find_user_dsq() function is called from contexts that are already under RCU read lock protection. Switch from rhashtable_lookup_fast() to rhashtable_lookup() to avoid redundant RCU locking. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 2383e45f1da7ac73683ac3494a205bc878a58cc9 Merge: 348f6117c16ae8 f6165491240415 Author: Alexei Starovoitov Date: Tue Sep 23 12:00:23 2025 -0700 Merge branch 'signed-loads-from-arena' Puranjay Mohan says: ==================== Signed loads from Arena Changelog: v3 -> v4: v3: https://lore.kernel.org/all/20250915162848.54282-1-puranjay@kernel.org/ - Update bpf_jit_supports_insn() in riscv jit to reject signed arena loads (Eduard) - Fix coding style related to braces usage in an if statement in x86 jit (Eduard) v2 -> v3: v2: https://lore.kernel.org/bpf/20250514175415.2045783-1-memxor@gmail.com/ - Fix encoding for the generated instructions in x86 JIT (Eduard) The patch in v2 was generating instructions like: 42 63 44 20 f8 movslq -0x8(%rax,%r12), %eax This doesn't make sense because movslq outputs a 64-bit result, but the destination register here is set to eax (32-bit). The fix it to set the REX.W bit in the opcode, that means changing EMIT2(add_3mod(0x40, ...)) to EMIT2(add_3mod(0x48, ...)) - Add arm64 support - Add selftests signed laods from arena. v1 -> v2: v1: https://lore.kernel.org/bpf/20250509194956.1635207-1-memxor@gmail.com - Use bpf_jit_supports_insn. (Alexei) Currently, signed load instructions into arena memory are unsupported. The compiler is free to generate these, and on GCC-14 we see a corresponding error when it happens. The hurdle in supporting them is deciding which unused opcode to use to mark them for the JIT's own consumption. After much thinking, it appears 0xc0 / BPF_NOSPEC can be combined with load instructions to identify signed arena loads. Use this to recognize and JIT them appropriately, and remove the verifier side limitation on the program if the JIT supports them. ==================== Link: https://patch.msgid.link/20250923110157.18326-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit f61654912404155e9097aaf88aa2445edf80f8d3 Author: Puranjay Mohan Date: Tue Sep 23 11:01:51 2025 +0000 selftests: bpf: Add tests for signed loads from arena Add tests for loading 8, 16, and 32 bits with sign extension from arena, also verify that exception handling is working correctly and correct assembly is being generated by the x86 and arm64 JITs. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit eab2a71f3a6a5c5f4d4acaffb962cb39c199421c Author: Puranjay Mohan Date: Tue Sep 23 11:01:50 2025 +0000 bpf, arm64: Add support for signed arena loads Add support for signed loads from arena which are internally converted to loads with mode set BPF_PROBE_MEM32SX by the verifier. The implementation is similar to BPF_PROBE_MEMSX and BPF_MEMSX but for BPF_PROBE_MEM32SX, arena_vm_base is added to the src register to form the address. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a91ae3c89311648cbaa9b46b860e4f76004a24b8 Author: Kumar Kartikeya Dwivedi Date: Tue Sep 23 11:01:49 2025 +0000 bpf, x86: Add support for signed arena loads Currently, signed load instructions into arena memory are unsupported. The compiler is free to generate these, and on GCC-14 we see a corresponding error when it happens. The hurdle in supporting them is deciding which unused opcode to use to mark them for the JIT's own consumption. After much thinking, it appears 0xc0 / BPF_NOSPEC can be combined with load instructions to identify signed arena loads. Use this to recognize and JIT them appropriately, and remove the verifier side limitation on the program if the JIT supports them. Co-developed-by: Puranjay Mohan Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit e3f761be5a178bdd5cd80351c5ca0a0cf675ef7e Author: Kuan-Wei Chiu Date: Mon Aug 25 04:09:02 2025 +0800 tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names The prerequisites section listed non-existent packages "phython-gnuplot" and "phython3-gnuplot", which may mislead users and cause installation failures. Update the names to the correct distribution package names "python-gnuplot" and "python3-gnuplot", helping users avoid confusion and saving time for those following the instructions. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello (AMD) commit d41e075b077142bb9ae5df40b9ddf9fd7821a811 Author: Zhen Ni Date: Tue Sep 23 19:21:09 2025 +0800 remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer. Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://lore.kernel.org/r/20250923112109.1165126-1-zhen.ni@easystack.cn Signed-off-by: Mathieu Poirier commit a890a2e339b929dbd843328f9a92a1625404fe63 Author: Al Viro Date: Tue Sep 16 17:22:45 2025 +0100 nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that. Signed-off-by: Al Viro Signed-off-by: Anna Schumaker commit 902893e3907620153a17fb40834ab6fba9f83fab Author: Trond Myklebust Date: Sat Sep 6 12:48:16 2025 -0400 NFS: Enable use of the RWF_DONTCACHE flag on the NFS client The NFS client needs to defer dropbehind until after any writes to the folio have been persisted on the server. Since this may be a 2 step process, use folio_end_writeback_no_dropbehind() to allow release of the writeback flag, and then call folio_end_dropbehind() once the COMMIT is done. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 010054a530aa266ee1711dfbe23fc06b6eb0fa48 Author: Trond Myklebust Date: Sat Sep 6 12:48:15 2025 -0400 filemap: Add a version of folio_end_writeback that ignores dropbehind Filesystems such as NFS may need to defer dropbehind until after their 2-stage writes are done. This adds a helper folio_end_writeback_no_dropbehind() that allows them to release the writeback flag without immediately dropping the folio. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 24bbd533f596a4544e17579e9f622918680e7bff Author: Trond Myklebust Date: Sat Sep 6 12:48:14 2025 -0400 filemap: Add a helper for filesystems implementing dropbehind Add a helper to allow filesystems to attempt to free the 'dropbehind' folio. Signed-off-by: Trond Myklebust Link: https://lore.kernel.org/all/5588a06f6d5a2cf6746828e2d36e7ada668b1739.1745381692.git.trond.myklebust@hammerspace.com/ Reviewed-by: Mike Snitzer Signed-off-by: Anna Schumaker commit cc6ac66f1c0946299b8f192026cff9a320aaad18 Author: Anna Schumaker Date: Tue Jul 1 10:46:50 2025 -0400 SUNRPC: Update gssx_accept_sec_context() to use xdr_set_scratch_folio() This was the last caller of xdr_set_scratch_page(), so I remove this function while I'm at it. Signed-off-by: Anna Schumaker commit d57e43b72bf2071caac90da323849c3983a695f0 Author: Anna Schumaker Date: Mon Jun 30 14:53:09 2025 -0400 SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio() The only snag here is that __folio_alloc_node() doesn't handle NUMA_NO_NODE, so I also need to update svc_pool_map_get_node() to return numa_mem_id() instead. I arrived at this approach by looking at what other users of __folio_alloc_node() do for this case. Signed-off-by: Anna Schumaker commit 4b7c3b4c673d40e4b98cdaf642495929f43787e6 Author: Anna Schumaker Date: Mon Jun 30 13:42:51 2025 -0400 NFS: Update the flexfilelayout driver to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 1a33b629af21a98fc1c85da7cc21c78bd1eb1030 Author: Anna Schumaker Date: Mon Jun 30 13:19:26 2025 -0400 NFS: Update the filelayout to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit cf289099ab8a1f4369415ea6c8fb4c39ab2173ca Author: Anna Schumaker Date: Mon Jun 30 12:56:33 2025 -0400 NFS: Update the blocklayout to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit c9cefd7ae86aa3463adfedca309696ba0946f9c5 Author: Anna Schumaker Date: Mon Jun 30 11:14:41 2025 -0400 NFS: Update listxattr to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 2f8416f23edf3b5c49ce8e08616d0071cda5c37b Author: Anna Schumaker Date: Mon Jun 30 10:32:29 2025 -0400 NFS: Update getacl to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 670335c0f97b2f86c80e2ca5321c7f7e018884f6 Author: Anna Schumaker Date: Mon Jun 30 10:07:56 2025 -0400 NFS: Update readdir to use a scratch folio Signed-off-by: Anna Schumaker commit c8a127596edc026e5364a7a609986dcd3999914c Author: Anna Schumaker Date: Mon Jun 30 10:04:54 2025 -0400 SUNRPC: Introduce xdr_set_scratch_folio() This will replace xdr_set_scratch_page() when we switch pages to folios. Signed-off-by: Anna Schumaker commit 040058a8f7fd333d4159a09ae308145a393c8551 Author: Qianfeng Rong Date: Sun Aug 10 15:29:42 2025 +0800 SUNRPC: Remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Acked-by: Chuck Lever Signed-off-by: Anna Schumaker commit 301f3470273c89df3a933762b7495569f650e68b Author: Jeff Layton Date: Thu Aug 21 12:27:00 2025 -0400 nfs: remove NFS_WBACK_BUSY() Nothing calls this macro. Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker commit 62c0c0e7491211969d8d1c2a9ab0e112b34664cf Author: Chuck Lever Date: Wed Aug 20 10:27:28 2025 -0400 SUNRPC: Move the svc_rpcb_cleanup() call sites Clean up: because svc_rpcb_cleanup() and svc_xprt_destroy_all() are always invoked in pairs, we can deduplicate code by moving the svc_rpcb_cleanup() call sites into svc_xprt_destroy_all(). Signed-off-by: Chuck Lever Tested-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit c231cea10d418c9d2596bcb8f5a06e18b55c1435 Author: Chuck Lever Date: Wed Aug 20 10:27:27 2025 -0400 NFS: Remove rpcbind cleanup for NFSv4.0 callback The NFS client's NFSv4.0 callback listeners are created with SVC_SOCK_ANONYMOUS, therefore svc_setup_socket() does not register them with the client's rpcbind service. And, note that nfs_callback_down_net() does not call svc_rpcb_cleanup() at all when shutting down the callback server. Even if svc_setup_socket() were to attempt to register or unregister these sockets, the callback service has vs_hidden set, which shunts the rpcbind upcalls. The svc_rpcb_cleanup() error flow was introduced by commit c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()"). It doesn't appear in the code that was relocated by that commit. Therefore, there is no need to call svc_rpcb_cleanup() when listener creation fails during callback server start-up. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit bf75ad096820fee5da40e671ebb32de725a1c417 Author: Anthony Iliopoulos Date: Wed Aug 13 11:00:47 2025 +0200 NFSv4.1: fix mount hang after CREATE_SESSION failure When client initialization goes through server trunking discovery, it schedules the state manager and then sleeps waiting for nfs_client initialization completion. The state manager can fail during state recovery, and specifically in lease establishment as nfs41_init_clientid() will bail out in case of errors returned from nfs4_proc_create_session(), without ever marking the client ready. The session creation can fail for a variety of reasons e.g. during backchannel parameter negotiation, with status -EINVAL. The error status will propagate all the way to the nfs4_state_manager but the client status will not be marked, and thus the mount process will remain blocked waiting. Fix it by adding -EINVAL error handling to nfs4_state_manager(). Signed-off-by: Anthony Iliopoulos Signed-off-by: Anna Schumaker commit 191512355e520dfc45c8bc3b56d4de59c3ade33e Author: Anthony Iliopoulos Date: Wed Aug 13 11:00:46 2025 +0200 NFSv4.1: fix backchannel max_resp_sz verification check When the client max_resp_sz is larger than what the server encodes in its reply, the nfs4_verify_back_channel_attrs() check fails and this causes nfs4_proc_create_session() to fail, in cases where the client page size is larger than that of the server and the server does not want to negotiate upwards. While this is not a problem with the linux nfs server that will reflect the proposed value in its reply irrespective of the local page size, other nfs server implementations may insist on their own max_resp_sz value, which could be smaller. Fix this by accepting smaller max_resp_sz values from the server, as this does not violate the protocol. The server is allowed to decrease but not increase proposed the size, and as such values smaller than the client-proposed ones are valid. Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") Signed-off-by: Anthony Iliopoulos Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 64afd8783920d4f3e831fd1d99b46a65b1de95f9 Author: Xichao Zhao Date: Fri Aug 8 16:41:03 2025 +0800 NFSv4: fix "prefered"->"preferred" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit be390f95242785adbf37d7b8a5101dd2f2ba891b Author: Olga Kornievskaia Date: Mon Aug 11 14:18:48 2025 -0400 NFSv4: handle ERR_GRACE on delegation recalls RFC7530 states that clients should be prepared for the return of NFS4ERR_GRACE errors for non-reclaim lock and I/O requests. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit ec7d8e68ef0ec5c635c8f9e93cd881673445a397 Author: Jeff Layton Date: Fri Aug 22 09:19:23 2025 -0400 sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer We have a lot of old dprintk() call sites that aren't going anywhere anytime soon. At the same time, turning them up is a serious burden on the host due to the console locking overhead. Add a new Kconfig option that redirects dfprintk() output to the trace buffer. This is more efficient than logging to the console and allows for proper interleaving of dprintk and static tracepoint events. Since using trace_printk() causes scary warnings to pop at boot time, this new option defaults to "n". Signed-off-by: Jeff Layton Reviewed-by: Chuck Lever Reviewed-by: Simon Horman Signed-off-by: Anna Schumaker commit 9082aae154be2d9e208b56e249cb886612f7c6cf Author: Jeff Layton Date: Fri Aug 22 09:19:22 2025 -0400 sunrpc: remove dfprintk_cont() and dfprintk_rcu_cont() KERN_CONT hails from a simpler time, when SMP wasn't the norm. These days, it doesn't quite work right since another printk() can always race in between the first one and the one being "continued". Nothing calls dprintk_rcu_cont(), so just remove it. The only caller of dprintk_cont() is in nfs_commit_release_pages(). Just use a normal dprintk() there instead, since this is not SMP-safe anyway. Signed-off-by: Jeff Layton Reviewed-by: Chuck Lever Reviewed-by: Simon Horman Signed-off-by: Anna Schumaker commit 64dd8022245038109826c0e2a778f16618d88600 Author: Leo Martins Date: Thu Aug 21 15:04:02 2025 -0700 nfs: cleanup tracepoint declarations Cleanup tracepoint declarations by replacing commas with semicolons to better match other tracepoint declarations. No functional changes introduced. Signed-off-by: Leo Martins Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 83c47ef8aca0dc5e2159e884b2bfd3440948eed1 Author: Jeff Layton Date: Fri Aug 8 07:40:34 2025 -0400 nfs: add tracepoints to nfs_writepages() Show the inode info and requested range. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit b6ef079fd984930dcc42f4b247777f296528507e Author: Jeff Layton Date: Fri Aug 8 07:40:33 2025 -0400 nfs: more in-depth tracing of writepage events Add tracepoints to nfs_writepage_setup() and nfs_do_writepage(). Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4a2d81714d10e66dd7df50d32f9f30382b85fa43 Author: Jeff Layton Date: Fri Aug 8 07:40:32 2025 -0400 nfs: new tracepoints around write handling New start and done tracepoints for: nfs_update_folio() nfs_write_begin() nfs_write_end() nfs_try_to_update_request() Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4b62f0e4488ad9fece76f0f0e7df749d37d1c12e Author: Jeff Layton Date: Fri Aug 8 07:40:31 2025 -0400 nfs: add tracepoints to nfs_file_read() and nfs_file_write() Add some tracepoints to the I/O submission codepaths. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit d292035fb5d209b78beda356a2a9720154bd7c00 Author: Mathias Krause Date: Fri Sep 19 15:32:58 2025 -0700 KVM: VMX: Make CR4.CET a guest owned bit Make CR4.CET a guest-owned bit under VMX by extending KVM_POSSIBLE_CR4_GUEST_BITS accordingly. There's no need to intercept changes to CR4.CET, as it's neither included in KVM's MMU role bits, nor does KVM specifically care about the actual value of a (nested) guest's CR4.CET value, beside for enforcing architectural constraints, i.e. make sure that CR0.WP=1 if CR4.CET=1. Intercepting writes to CR4.CET is particularly bad for grsecurity kernels with KERNEXEC or, even worse, KERNSEAL enabled. These features heavily make use of read-only kernel objects and use a cpu-local CR0.WP toggle to override it, when needed. Under a CET-enabled kernel, this also requires toggling CR4.CET, hence the motivation to make it guest-owned. Using the old test from [1] gives the following runtime numbers (perf stat -r 5 ssdd 10 50000): * grsec guest on linux-6.16-rc5 + cet patches: 2.4647 +- 0.0706 seconds time elapsed ( +- 2.86% ) * grsec guest on linux-6.16-rc5 + cet patches + CR4.CET guest-owned: 1.5648 +- 0.0240 seconds time elapsed ( +- 1.53% ) Not only does not intercepting CR4.CET make the test run ~35% faster, it's also more stable with less fluctuation due to fewer VMEXITs. Therefore, make CR4.CET a guest-owned bit where possible. This change is VMX-specific, as SVM has no such fine-grained control register intercept control. If KVM's assumptions regarding MMU role handling wrt. a guest's CR4.CET value ever change, the BUILD_BUG_ON()s related to KVM_MMU_CR4_ROLE_BITS and KVM_POSSIBLE_CR4_GUEST_BITS will catch that early. Link: https://lore.kernel.org/kvm/20230322013731.102955-1-minipli@grsecurity.net/ [1] Reviewed-by: Chao Gao Signed-off-by: Mathias Krause Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-52-seanjc@google.com Signed-off-by: Sean Christopherson commit 947ab90c91983c965acb994455734aae19317596 Author: Sean Christopherson Date: Fri Sep 19 15:32:57 2025 -0700 KVM: selftests: Verify MSRs are (not) in save/restore list when (un)supported Add a check in the MSRs test to verify that KVM's reported support for MSRs with feature bits is consistent between KVM's MSR save/restore lists and KVM's supported CPUID. To deal with Intel's wonderful decision to bundle IBT and SHSTK under CET, track the "second" feature to avoid false failures when running on a CPU with only one of IBT or SHSTK. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-51-seanjc@google.com Signed-off-by: Sean Christopherson commit 3469fd203bac201ad67d9586041689c4c6a87882 Author: Sean Christopherson Date: Fri Sep 19 15:32:56 2025 -0700 KVM: selftests: Add coverage for KVM-defined registers in MSRs test Add test coverage for the KVM-defined GUEST_SSP "register" in the MSRs test. While _KVM's_ goal is to not tie the uAPI of KVM-defined registers to any particular internal implementation, i.e. to not commit in uAPI to handling GUEST_SSP as an MSR, treating GUEST_SSP as an MSR for testing purposes is a-ok and is a naturally fit given the semantics of SSP. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-50-seanjc@google.com Signed-off-by: Sean Christopherson commit 80c2b6d8e7bb194744f5fdfc4f0560e053ababda Author: Sean Christopherson Date: Fri Sep 19 15:32:55 2025 -0700 KVM: selftests: Add KVM_{G,S}ET_ONE_REG coverage to MSRs test When KVM_{G,S}ET_ONE_REG are supported, verify that MSRs can be accessed via ONE_REG and through the dedicated MSR ioctls. For simplicity, run the test twice, e.g. instead of trying to get MSR values into the exact right state when switching write methods. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-49-seanjc@google.com Signed-off-by: Sean Christopherson commit a8b9cca99cf454799ef799f8af9bdb55389cfd94 Author: Sean Christopherson Date: Fri Sep 19 15:32:54 2025 -0700 KVM: selftests: Extend MSRs test to validate vCPUs without supported features Add a third vCPUs to the MSRs test that runs with all features disabled in the vCPU's CPUID model, to verify that KVM does the right thing with respect to emulating accesses to MSRs that shouldn't exist. Use the same VM to verify that KVM is honoring the vCPU model, e.g. isn't looking at per-VM state when emulating MSR accesses. Link: https://lore.kernel.org/r/20250919223258.1604852-48-seanjc@google.com Signed-off-by: Sean Christopherson commit 27c41353064f9fdec9276e6b8e618b01110ef282 Author: Sean Christopherson Date: Fri Sep 19 15:32:53 2025 -0700 KVM: selftests: Add support for MSR_IA32_{S,U}_CET to MSRs test Extend the MSRs test to support {S,U}_CET, which are a bit of a pain to handled due to the MSRs existing if IBT *or* SHSTK is supported. To deal with Intel's wonderful decision to bundle IBT and SHSTK under CET, track the second feature, but skip only RDMSR #GP tests to avoid false failures when running on a CPU with only one of IBT or SHSTK (the WRMSR #GP tests are still valid since the enable bits are per-feature). Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-47-seanjc@google.com Signed-off-by: Sean Christopherson commit 9c38ddb3df94acdc86485c7073610f01655309f9 Author: Sean Christopherson Date: Fri Sep 19 15:32:52 2025 -0700 KVM: selftests: Add an MSR test to exercise guest/host and read/write Add a selftest to verify reads and writes to various MSRs, from both the guest and host, and expect success/failure based on whether or not the vCPU supports the MSR according to supported CPUID. Note, this test is extremely similar to KVM-Unit-Test's "msr" test, but provides more coverage with respect to host accesses, and will be extended to provide addition testing of CPUID-based features, save/restore lists, and KVM_{G,S}ET_ONE_REG, all which are extremely difficult to validate in KUT. If kvm.ignore_msrs=true, skip the unsupported and reserved testcases as KVM's ABI is a mess; what exactly is supposed to be ignored, and when, varies wildly. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-46-seanjc@google.com Signed-off-by: Sean Christopherson commit fddd07626baa419c259ad5f3537a57188b5bb415 Author: Sean Christopherson Date: Fri Sep 19 15:32:50 2025 -0700 KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors Add {HV,CP,SX}_VECTOR definitions for AMD's Hypervisor Injection Exception, VMM Communication Exception, and SVM Security Exception vectors, along with human friendly formatting for trace_kvm_inj_exception(). Note, KVM is all but guaranteed to never observe or inject #SX, and #HV is also unlikely to go unused. Add the architectural collateral mostly for completeness, and on the off chance that hardware goes off the rails. Link: https://lore.kernel.org/r/20250919223258.1604852-44-seanjc@google.com Signed-off-by: Sean Christopherson commit f2f5519aa4e3ec4e42b009338f773bebb0bfd8a3 Author: Sean Christopherson Date: Fri Sep 19 15:32:49 2025 -0700 KVM: x86: Define Control Protection Exception (#CP) vector Add a CP_VECTOR definition for CET's Control Protection Exception (#CP), along with human friendly formatting for trace_kvm_inj_exception(). Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-43-seanjc@google.com Signed-off-by: Sean Christopherson commit d37cc4819a489bfe32008e50e3a76eb967d95d42 Author: Sean Christopherson Date: Fri Sep 19 15:32:48 2025 -0700 KVM: x86: Add human friendly formatting for #XM, and #VE Add XM_VECTOR and VE_VECTOR pretty-printing for trace_kvm_inj_exception(). Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-42-seanjc@google.com Signed-off-by: Sean Christopherson commit 8db428fd5229ba509d515af10d7f33d7d4a54bfe Author: John Allen Date: Fri Sep 19 15:32:47 2025 -0700 KVM: SVM: Enable shadow stack virtualization for SVM Remove the explicit clearing of shadow stack CPU capabilities. Reviewed-by: Chao Gao Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-41-seanjc@google.com Signed-off-by: Sean Christopherson commit b5fa221f7b08ca145b0357b77b90dcc998278967 Author: Sean Christopherson Date: Fri Sep 19 15:32:46 2025 -0700 KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid Synchronize XSS from the GHCB to KVM's internal tracking if the guest marks XSS as valid on a #VMGEXIT. Like XCR0, KVM needs an up-to-date copy of XSS in order to compute the required XSTATE size when emulating CPUID.0xD.0x1 for the guest. Treat the incoming XSS change as an emulated write, i.e. validatate the guest-provided value, to avoid letting the guest load garbage into KVM's tracking. Simply ignore bad values, as either the guest managed to get an unsupported value into hardware, or the guest is misbehaving and providing pure garbage. In either case, KVM can't fix the broken guest. Explicitly allow access to XSS at all times, as KVM needs to ensure its copy of XSS stays up-to-date. E.g. KVM supports migration of SEV-ES guests and so needs to allow the host to save/restore XSS, otherwise a guest that *knows* its XSS hasn't change could get stale/bad CPUID emulation if the guest doesn't provide XSS in the GHCB on every exit. This creates a hypothetical problem where a guest could request emulation of RDMSR or WRMSR on XSS, but arguably that's not even a problem, e.g. it would be entirely reasonable for a guest to request "emulation" as a way to inform the hypervisor that its XSS value has been modified. Note, emulating the change as an MSR write also takes care of side effects, e.g. marking dynamic CPUID bits as dirty. Suggested-by: John Allen base-commit: 14298d819d5a6b7180a4089e7d2121ca3551dc6c Link: https://lore.kernel.org/r/20250919223258.1604852-40-seanjc@google.com Signed-off-by: Sean Christopherson commit 38c46bdbf99812a07a8a7ef48718f0a03acd8a8a Author: John Allen Date: Fri Sep 19 15:32:45 2025 -0700 KVM: SVM: Pass through shadow stack MSRs as appropriate Pass through XSAVE managed CET MSRs on SVM when KVM supports shadow stack. These cannot be intercepted without also intercepting XSAVE which would likely cause unacceptable performance overhead. MSR_IA32_INT_SSP_TAB is not managed by XSAVE, so it is intercepted. Reviewed-by: Chao Gao Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-39-seanjc@google.com Signed-off-by: Sean Christopherson commit c7586aa3bed4969cc7345940e5a331efd614f41d Author: John Allen Date: Fri Sep 19 15:32:44 2025 -0700 KVM: SVM: Update dump_vmcb with shadow stack save area additions Add shadow stack VMCB fields to dump_vmcb. PL0_SSP, PL1_SSP, PL2_SSP, PL3_SSP, and U_CET are part of the SEV-ES save area and are encrypted, but can be decrypted and dumped if the guest policy allows debugging. Reviewed-by: Maxim Levitsky Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-38-seanjc@google.com Signed-off-by: Sean Christopherson commit c5ba49458513bd1ecd669d4ec7124e788b19347c Author: Sean Christopherson Date: Fri Sep 19 15:32:43 2025 -0700 KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02 Transfer the three CET Shadow Stack VMCB fields (S_CET, ISST_ADDR, and SSP) on VMRUN, #VMEXIT, and loading nested state (saving nested state simply copies the entire save area). SVM doesn't provide a way to disallow L1 from enabling Shadow Stacks for L2, i.e. KVM *must* provide nested support before advertising SHSTK to userspace. Link: https://lore.kernel.org/r/20250919223258.1604852-37-seanjc@google.com Signed-off-by: Sean Christopherson commit 48b2ec0d540c29cebb5119dd2b8e8e7369bc409c Author: John Allen Date: Fri Sep 19 15:32:42 2025 -0700 KVM: SVM: Emulate reads and writes to shadow stack MSRs Emulate shadow stack MSR access by reading and writing to the corresponding fields in the VMCB. Signed-off-by: John Allen [sean: mark VMCB_CET dirty/clean as appropriate] Link: https://lore.kernel.org/r/20250919223258.1604852-36-seanjc@google.com Signed-off-by: Sean Christopherson commit 42ae6448531b5106e9f29794992856e94a52b5cb Author: Chao Gao Date: Fri Sep 19 15:32:41 2025 -0700 KVM: nVMX: Advertise new VM-Entry/Exit control bits for CET state Advertise the LOAD_CET_STATE VM-Entry/Exit control bits in the nested VMX MSRS, as all nested support for CET virtualization, including consistency checks, is in place. Advertise support if and only if KVM supports at least one of IBT or SHSTK. While it's userspace's responsibility to provide a consistent CPU model to the guest, that doesn't mean KVM should set userspace up to fail. Note, the existing {CLEAR,LOAD}_BNDCFGS behavior predates KVM_X86_QUIRK_STUFF_FEATURE_MSRS, i.e. KVM "solved" the inconsistent CPU model problem by overwriting the VMX MSRs provided by userspace. Signed-off-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-35-seanjc@google.com Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit 62f7533a6b3aad9d39c6098dbc3d8e7daeda9399 Author: Chao Gao Date: Fri Sep 19 15:32:40 2025 -0700 KVM: nVMX: Add consistency checks for CET states Introduce consistency checks for CET states during nested VM-entry. A VMCS contains both guest and host CET states, each comprising the IA32_S_CET MSR, SSP, and IA32_INTERRUPT_SSP_TABLE_ADDR MSR. Various checks are applied to CET states during VM-entry as documented in SDM Vol3 Chapter "VM ENTRIES". Implement all these checks during nested VM-entry to emulate the architectural behavior. In summary, there are three kinds of checks on guest/host CET states during VM-entry: A. Checks applied to both guest states and host states: * The IA32_S_CET field must not set any reserved bits; bits 10 (SUPPRESS) and 11 (TRACKER) cannot both be set. * SSP should not have bits 1:0 set. * The IA32_INTERRUPT_SSP_TABLE_ADDR field must be canonical. B. Checks applied to host states only * IA32_S_CET MSR and SSP must be canonical if the CPU enters 64-bit mode after VM-exit. Otherwise, IA32_S_CET and SSP must have their higher 32 bits cleared. C. Checks applied to guest states only: * IA32_S_CET MSR and SSP are not required to be canonical (i.e., 63:N-1 are identical, where N is the CPU's maximum linear-address width). But, bits 63:N of SSP must be identical. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-34-seanjc@google.com [sean: have common helper return 0/-EINVAL, not true/false] Signed-off-by: Sean Christopherson commit 8060b2bd2dd05a19ad7ec248489d374f2bd2b057 Author: Chao Gao Date: Fri Sep 19 15:32:39 2025 -0700 KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET Add consistency checks for CR4.CET and CR0.WP in guest-state or host-state area in the VMCS12. This ensures that configurations with CR4.CET set and CR0.WP not set result in VM-entry failure, aligning with architectural behavior. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-33-seanjc@google.com Signed-off-by: Sean Christopherson commit 625884996bff1b25a39834fa4935d695d71ef1b1 Author: Yang Weijiang Date: Fri Sep 19 15:32:38 2025 -0700 KVM: nVMX: Prepare for enabling CET support for nested guest Set up CET MSRs, related VM_ENTRY/EXIT control bits and fixed CR4 setting to enable CET for nested VM. vmcs12 and vmcs02 needs to be synced when L2 exits to L1 or when L1 wants to resume L2, that way correct CET states can be observed by one another. Please note that consistency checks regarding CET state during VM-Entry will be added later to prevent this patch from becoming too large. Advertising the new CET VM_ENTRY/EXIT control bits are also be deferred until after the consistency checks are added. Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Xin Li (Intel) Tested-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-32-seanjc@google.com Signed-off-by: Sean Christopherson commit 033cc166f02920b193f7ec989083bce1a20e9abf Author: Yang Weijiang Date: Fri Sep 19 15:32:37 2025 -0700 KVM: nVMX: Virtualize NO_HW_ERROR_CODE_CC for L1 event injection to L2 Per SDM description(Vol.3D, Appendix A.1): "If bit 56 is read as 1, software can use VM entry to deliver a hardware exception with or without an error code, regardless of vector" Modify has_error_code check before inject events to nested guest. Only enforce the check when guest is in real mode, the exception is not hard exception and the platform doesn't enumerate bit56 in VMX_BASIC, in all other case ignore the check to make the logic consistent with SDM. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-31-seanjc@google.com Signed-off-by: Sean Christopherson commit f7336d47be53d0da1e74143b8befea8c0176f3cc Author: Sean Christopherson Date: Fri Sep 19 15:32:36 2025 -0700 KVM: VMX: Configure nested capabilities after CPU capabilities Swap the order between configuring nested VMX capabilities and base CPU capabilities, so that nested VMX support can be conditioned on core KVM support, e.g. to allow conditioning support for LOAD_CET_STATE on the presence of IBT or SHSTK. Because the sanity checks on nested VMX config performed by vmx_check_processor_compat() run _after_ vmx_hardware_setup(), any use of kvm_cpu_cap_has() when configuring nested VMX support will lead to failures in vmx_check_processor_compat(). While swapping the order of two (or more) configuration flows can lead to a game of whack-a-mole, in this case nested support inarguably should be done after base support. KVM should never condition base support on nested support, because nested support is fully optional, while obviously it's desirable to condition nested support on base support. And there's zero evidence the current ordering was intentional, e.g. commit 66a6950f9995 ("KVM: x86: Introduce kvm_cpu_caps to replace runtime CPUID masking") likely placed the call to kvm_set_cpu_caps() after nested setup because it looked pretty. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-30-seanjc@google.com Signed-off-by: Sean Christopherson commit e140467bbdafff84f1f346a7c59f404cd9782b82 Author: Yang Weijiang Date: Fri Sep 19 15:32:35 2025 -0700 KVM: x86: Enable CET virtualization for VMX and advertise to userspace Add support for the LOAD_CET_STATE VM-Enter and VM-Exit controls, the CET XFEATURE bits in XSS, and advertise support for IBT and SHSTK to userspace. Explicitly clear IBT and SHSTK onn SVM, as additional work is needed to enable CET on SVM, e.g. to context switch S_CET and other state. Disable KVM CET feature if unrestricted_guest is unsupported/disabled as KVM does not support emulating CET, as running without Unrestricted Guest can result in KVM emulating large swaths of guest code. While it's highly unlikely any guest will trigger emulation while also utilizing IBT or SHSTK, there's zero reason to allow CET without Unrestricted Guest as that combination should only be possible when explicitly disabling unrestricted_guest for testing purposes. Disable CET if VMX_BASIC[bit56] == 0, i.e. if hardware strictly enforces the presence of an Error Code based on exception vector, as attempting to inject a #CP with an Error Code (#CP architecturally has an Error Code) will fail due to the #CP vector historically not having an Error Code. Clear S_CET and SSP-related VMCS on "reset" to emulate the architectural of CET MSRs and SSP being reset to 0 after RESET, power-up and INIT. Note, KVM already clears guest CET state that is managed via XSTATE in kvm_xstate_reset(). Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: move some bits to separate patches, massage changelog] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-29-seanjc@google.com Signed-off-by: Sean Christopherson commit 343acdd158a55dab1cfb0d209cd1d70b0cabb8b2 Author: Sean Christopherson Date: Fri Sep 19 15:32:34 2025 -0700 KVM: x86: Disable support for IBT and SHSTK if allow_smaller_maxphyaddr is true Make IBT and SHSTK virtualization mutually exclusive with "officially" supporting setups with guest.MAXPHYADDR < host.MAXPHYADDR, i.e. if the allow_smaller_maxphyaddr module param is set. Running a guest with a smaller MAXPHYADDR requires intercepting #PF, and can also trigger emulation of arbitrary instructions. Intercepting and reacting to #PFs doesn't play nice with SHSTK, as KVM's MMU hasn't been taught to handle Shadow Stack accesses, and emulating arbitrary instructions doesn't play nice with IBT or SHSTK, as KVM's emulator doesn't handle the various side effects, e.g. doesn't enforce end-branch markers or model Shadow Stack updates. Note, hiding IBT and SHSTK based solely on allow_smaller_maxphyaddr is overkill, as allow_smaller_maxphyaddr is only problematic if the guest is actually configured to have a smaller MAXPHYADDR. However, KVM's ABI doesn't provide a way to express that IBT and SHSTK may break if enabled in conjunction with guest.MAXPHYADDR < host.MAXPHYADDR. I.e. the alternative is to do nothing in KVM and instead update documentation and hope KVM users are thorough readers. Go with the conservative-but-correct approach; worst case scenario, this restriction can be dropped if there's a strong use case for enabling CET on hosts with allow_smaller_maxphyaddr. Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-28-seanjc@google.com Signed-off-by: Sean Christopherson commit f705de12a22c945f55d51baec4ea495aedc5ebd7 Author: Sean Christopherson Date: Mon Sep 22 11:47:43 2025 -0700 KVM: x86: Initialize allow_smaller_maxphyaddr earlier in setup Initialize allow_smaller_maxphyaddr during hardware setup as soon as KVM knows whether or not TDP will be utilized. To avoid having to teach KVM's emulator all about CET, KVM's upcoming CET virtualization support will be mutually exclusive with allow_smaller_maxphyaddr, i.e. will disable SHSTK and IBT if allow_smaller_maxphyaddr is enabled. In general, allow_smaller_maxphyaddr should be initialized as soon as possible since it's globally visible while its only input is whether or not EPT/NPT is enabled. I.e. there's effectively zero risk of setting allow_smaller_maxphyaddr too early, and substantial risk of setting it too late. Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250922184743.1745778-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 1f6f68fcfe43cf26fc0a98fe14e0454cc5c75416 Author: Sean Christopherson Date: Fri Sep 19 15:32:33 2025 -0700 KVM: x86: Disable support for Shadow Stacks if TDP is disabled Make TDP a hard requirement for Shadow Stacks, as there are no plans to add Shadow Stack support to the Shadow MMU. E.g. KVM hasn't been taught to understand the magic Writable=0,Dirty=1 combination that is required for Shadow Stack accesses, and so enabling Shadow Stacks when using shadow paging will put the guest into an infinite #PF loop (KVM thinks the shadow page tables have a valid mapping, hardware says otherwise). Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-27-seanjc@google.com Signed-off-by: Sean Christopherson commit 69cc3e886582891f9c4d5830f18a2664a7f7cf7c Author: Yang Weijiang Date: Fri Sep 19 15:32:32 2025 -0700 KVM: x86: Add XSS support for CET_KERNEL and CET_USER Add CET_KERNEL and CET_USER to KVM's set of supported XSS bits when IBT *or* SHSTK is supported. Like CR4.CET, XFEATURE support for IBT and SHSTK are bundle together under the CET umbrella, and thus prone to virtualization holes if KVM or the guest supports only one of IBT or SHSTK, but hardware supports both. However, again like CR4.CET, such virtualization holes are benign from the host's perspective so long as KVM takes care to always honor the "or" logic. Require CET_KERNEL and CET_USER to come as a pair, and refuse to support IBT or SHSTK if one (or both) features is missing, as the (host) kernel expects them to come as a pair, i.e. may get confused and corrupt state if only one of CET_KERNEL or CET_USER is supported. Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: split to separate patch, write changelog, add XFEATURE_MASK_CET_ALL] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 19e6e083f3f9e4ac1794273d72dfb59d19a0fc69 Author: Sean Christopherson Date: Fri Sep 19 15:32:31 2025 -0700 KVM: nVMX: Always forward XSAVES/XRSTORS exits from L2 to L1 Unconditionally forward XSAVES/XRSTORS VM-Exits from L2 to L1, as KVM doesn't utilize the XSS-bitmap (KVM relies on controlling the XSS value in hardware to prevent unauthorized access to XSAVES state). KVM always loads vmcs02 with vmcs12's bitmap, and so any exit _must_ be due to vmcs12's XSS-bitmap. Drop the comment about XSS never being non-zero in anticipation of enabling CET_KERNEL and CET_USER support. Opportunistically WARN if XSAVES is not enabled for L2, as the CPU is supposed to generate #UD before checking the XSS-bitmap. Reviewed-by: Xiaoyao Li Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-25-seanjc@google.com Signed-off-by: Sean Christopherson commit b3744c59ebc5f2697d62844149c1a1c0e274ead0 Author: Yang Weijiang Date: Fri Sep 19 15:32:30 2025 -0700 KVM: x86: Allow setting CR4.CET if IBT or SHSTK is supported Drop X86_CR4_CET from CR4_RESERVED_BITS and instead mark CET as reserved if and only if IBT *and* SHSTK are unsupported, i.e. allow CR4.CET to be set if IBT or SHSTK is supported. This creates a virtualization hole if the CPU supports both IBT and SHSTK, but the kernel or vCPU model only supports one of the features. However, it's entirely legal for a CPU to have only one of IBT or SHSTK, i.e. the hole is a flaw in the architecture, not in KVM. More importantly, so long as KVM is careful to initialize and context switch both IBT and SHSTK state (when supported in hardware) if either feature is exposed to the guest, a misbehaving guest can only harm itself. E.g. VMX initializes host CET VMCS fields based solely on hardware capabilities. Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: split to separate patch, write changelog] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-24-seanjc@google.com Signed-off-by: Sean Christopherson commit 843af0f2e4617db197034b27a9a658a59271f19f Author: Sean Christopherson Date: Fri Sep 19 15:32:29 2025 -0700 KVM: x86/mmu: Pretty print PK, SS, and SGX flags in MMU tracepoints Add PK (Protection Keys), SS (Shadow Stacks), and SGX (Software Guard Extensions) to the set of #PF error flags handled via kvm_mmu_trace_pferr_flags. While KVM doesn't expect PK or SS #PFs in particular, pretty print their names instead of the raw hex value saves the user from having to go spelunking in the SDM to figure out what's going on. Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 296599346c671f31854d674db2891ff2e1654b6a Author: Sean Christopherson Date: Fri Sep 19 15:32:28 2025 -0700 KVM: x86/mmu: WARN on attempt to check permissions for Shadow Stack #PF Add PFERR_SS_MASK, a.k.a. Shadow Stack access, and WARN if KVM attempts to check permissions for a Shadow Stack access as KVM hasn't been taught to understand the magic Writable=0,Dirty=1 combination that is required for Shadow Stack accesses, and likely will never learn. There are no plans to support Shadow Stacks with the Shadow MMU, and the emulator rejects all instructions that affect Shadow Stacks, i.e. it should be impossible for KVM to observe a #PF due to a shadow stack access. Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-22-seanjc@google.com Signed-off-by: Sean Christopherson commit d4c03f63957c66bc95f5f33052f8b4be804631c3 Author: Sean Christopherson Date: Fri Sep 19 15:32:27 2025 -0700 KVM: x86: Emulate SSP[63:32]!=0 #GP(0) for FAR JMP to 32-bit mode Emulate the Shadow Stack restriction that the current SSP must be a 32-bit value on a FAR JMP from 64-bit mode to compatibility mode. From the SDM's pseudocode for FAR JMP: IF ShadowStackEnabled(CPL) IF (IA32_EFER.LMA and DEST(segment selector).L) = 0 (* If target is legacy or compatibility mode then the SSP must be in low 4GB *) IF (SSP & 0xFFFFFFFF00000000 != 0); THEN #GP(0); FI; FI; FI; Note, only the current CPL needs to be considered, as FAR JMP can't be used for inter-privilege level transfers, and KVM rejects emulation of all other far branch instructions when Shadow Stacks are enabled. To give the emulator access to GUEST_SSP, special case handling MSR_KVM_INTERNAL_GUEST_SSP in emulator_get_msr() to treat the access as a host access (KVM doesn't allow guest accesses to internal "MSRs"). The ->get_msr() API is only used for implicit accesses from the emulator, i.e. is only used with hardcoded MSR indices, and so any access to MSR_KVM_INTERNAL_GUEST_SSP is guaranteed to be from KVM, i.e. not from the guest via RDMSR. Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-21-seanjc@google.com Signed-off-by: Sean Christopherson commit 82c0ec02825814e1ef332d635d3441b07c05b1c9 Author: Sean Christopherson Date: Fri Sep 19 15:32:26 2025 -0700 KVM: x86: Don't emulate task switches when IBT or SHSTK is enabled Exit to userspace with KVM_INTERNAL_ERROR_EMULATION if the guest triggers task switch emulation with Indirect Branch Tracking or Shadow Stacks enabled, as attempting to do the right thing would require non-trivial effort and complexity, KVM doesn't support emulating CET generally, and it's extremely unlikely that any guest will do task switches while also utilizing CET. Defer taking on the complexity until someone cares enough to put in the time and effort to add support. Per the SDM: If shadow stack is enabled, then the SSP of the task is located at the 4 bytes at offset 104 in the 32-bit TSS and is used by the processor to establish the SSP when a task switch occurs from a task associated with this TSS. Note that the processor does not write the SSP of the task initiating the task switch to the TSS of that task, and instead the SSP of the previous task is pushed onto the shadow stack of the new task. Note, per the SDM's pseudocode on TASK SWITCHING, IBT state for the new privilege level is updated. To keep things simple, check both S_CET and U_CET (again, anyone that wants more precise checking can have the honor of implementing support). Reported-by: Binbin Wu Closes: https://lore.kernel.org/all/819bd98b-2a60-4107-8e13-41f1e4c706b1@linux.intel.com Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-20-seanjc@google.com Signed-off-by: Sean Christopherson commit 57c3db7e2e26970ee3630a25913368f849ea803a Author: Sean Christopherson Date: Fri Sep 19 15:32:25 2025 -0700 KVM: x86: Don't emulate instructions affected by CET features Don't emulate branch instructions, e.g. CALL/RET/JMP etc., that are affected by Shadow Stacks and/or Indirect Branch Tracking when said features are enabled in the guest, as fully emulating CET would require significant complexity for no practical benefit (KVM shouldn't need to emulate branch instructions on modern hosts). Simply doing nothing isn't an option as that would allow a malicious entity to subvert CET protections via the emulator. To detect instructions that are subject to IBT or affect IBT state, use the existing IsBranch flag along with the source operand type to detect indirect branches, and the existing NearBranch flag to detect far JMPs and CALLs, all of which are effectively indirect. Explicitly check for emulation of IRET, FAR RET (IMM), and SYSEXIT (the ret-like far branches) instead of adding another flag, e.g. IsRet, as it's unlikely the emulator will ever need to check for return-like instructions outside of this one specific flow. Use an allow-list instead of a deny-list because (a) it's a shorter list and (b) so that a missed entry gets a false positive, not a false negative (i.e. reject emulation instead of clobbering CET state). For Shadow Stacks, explicitly track instructions that directly affect the current SSP, as KVM's emulator doesn't have existing flags that can be used to precisely detect such instructions. Alternatively, the em_xxx() helpers could directly check for ShadowStack interactions, but using a dedicated flag is arguably easier to audit, and allows for handling both IBT and SHSTK in one fell swoop. Note! On far transfers, do NOT consult the current privilege level and instead treat SHSTK/IBT as being enabled if they're enabled for User *or* Supervisor mode. On inter-privilege level far transfers, SHSTK and IBT can be in play for the target privilege level, i.e. checking the current privilege could get a false negative, and KVM doesn't know the target privilege level until emulation gets under way. Note #2, FAR JMP from 64-bit mode to compatibility mode interacts with the current SSP, but only to ensure SSP[63:32] == 0. Don't tag FAR JMP as SHSTK, which would be rather confusing and would result in FAR JMP being rejected unnecessarily the vast majority of the time (ignoring that it's unlikely to ever be emulated). A future commit will add the #GP(0) check for the specific FAR JMP scenario. Note #3, task switches also modify SSP and so need to be rejected. That too will be addressed in a future commit. Suggested-by: Chao Gao Originally-by: Yang Weijiang Cc: Mathias Krause Cc: John Allen Cc: Rick Edgecombe Reviewed-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 584ba3ffb9843fd12d3b4a33cfe056e2264392a0 Author: Yang Weijiang Date: Fri Sep 19 15:32:24 2025 -0700 KVM: VMX: Set host constant supervisor states to VMCS fields Save constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} field explicitly. Kernel IBT is supported and the setting in MSR_IA32_S_CET is static after post-boot(The exception is BIOS call case but vCPU thread never across it) and KVM doesn't need to refresh HOST_S_CET field before every VM-Enter/ VM-Exit sequence. Host supervisor shadow stack is not enabled now and SSP is not accessible to kernel mode, thus it's safe to set host IA32_INT_SSP_TAB/SSP VMCS field to 0s. When shadow stack is enabled for CPL3, SSP is reloaded from PL3_SSP before it exits to userspace. Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/ SYSRET/SYSENTER SYSEXIT/RDSSP/CALL etc. Prevent KVM module loading if host supervisor shadow stack SHSTK_EN is set in MSR_IA32_S_CET as KVM cannot co-exit with it correctly. Suggested-by: Sean Christopherson Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: snapshot host S_CET if SHSTK *or* IBT is supported] Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 25f3840483e6c69e4d1a689cf3edc70f93604f2a Author: Yang Weijiang Date: Fri Sep 19 15:32:23 2025 -0700 KVM: VMX: Set up interception for CET MSRs Disable interception for CET MSRs that can be accessed via XSAVES/XRSTORS, and exist accordingly to CPUID, as accesses through XSTATE aren't subject to MSR interception checks, i.e. can't be intercepted without intercepting and emulating XSAVES/XRSTORS, and KVM doesn't support emulating XSAVE/XRSTOR instructions. Don't condition interception on the guest actually having XSAVES as there is no benefit to intercepting the accesses (when the MSRs exist). The MSRs in question are either context switched by the CPU on VM-Enter/VM-Exit or by KVM via XSAVES/XRSTORS (KVM requires XSAVES to virtualization SHSTK), i.e. KVM is going to load guest values into hardware irrespective of guest XSAVES support. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 1a61bd0d126abbf01c384c44b46bcdd4ef495850 Author: Yang Weijiang Date: Fri Sep 19 15:32:22 2025 -0700 KVM: x86: Save and reload SSP to/from SMRAM Save CET SSP to SMRAM on SMI and reload it on RSM. KVM emulates HW arch behavior when guest enters/leaves SMM mode,i.e., save registers to SMRAM at the entry of SMM and reload them at the exit to SMM. Per SDM, SSP is one of such registers on 64-bit Arch, and add the support for SSP. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 8b59d0275c964bcbe573dde46bd3c1f20ed2d2bd Author: Yang Weijiang Date: Fri Sep 19 15:32:21 2025 -0700 KVM: VMX: Emulate read and write to CET MSRs Add emulation interface for CET MSR access. The emulation code is split into common part and vendor specific part. The former does common checks for MSRs, e.g., accessibility, data validity etc., then passes operation to either XSAVE-managed MSRs via the helpers or CET VMCS fields. SSP can only be read via RDSSP. Writing even requires destructive and potentially faulting operations such as SAVEPREVSSP/RSTORSSP or SETSSBSY/CLRSSBSY. Let the host use a pseudo-MSR that is just a wrapper for the GUEST_SSP field of the VMCS. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: drop call to kvm_set_xstate_msr() for S_CET, consolidate code] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 9d6812d415358372aaaf1dfe95bc30d11e4e95db Author: Yang Weijiang Date: Fri Sep 19 15:32:20 2025 -0700 KVM: x86: Enable guest SSP read/write interface with new uAPIs Add a KVM-defined ONE_REG register, KVM_REG_GUEST_SSP, to let userspace save and restore the guest's Shadow Stack Pointer (SSP). On both Intel and AMD, SSP is a hardware register that can only be accessed by software via dedicated ISA (e.g. RDSSP) or via VMCS/VMCB fields (used by hardware to context switch SSP at entry/exit). As a result, SSP doesn't fit in any of KVM's existing interfaces for saving/restoring state. Internally, treat SSP as a fake/synthetic MSR, as the semantics of writes to SSP follow that of several other Shadow Stack MSRs, e.g. the PLx_SSP MSRs. Use a translation layer to hide the KVM-internal MSR index so that the arbitrary index doesn't become ABI, e.g. so that KVM can rework its implementation as needed, so long as the ONE_REG ABI is maintained. Explicitly reject accesses to SSP if the vCPU doesn't have Shadow Stack support to avoid running afoul of ignore_msrs, which unfortunately applies to host-initiated accesses (which is a discussion for another day). I.e. ensure consistent behavior for KVM-defined registers irrespective of ignore_msrs. Link: https://lore.kernel.org/all/aca9d389-f11e-4811-90cf-d98e345a5cc2@intel.com Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-14-seanjc@google.com Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit d6c387fc396b3d2c5aa00cb5b46f6401fb86bb43 Author: Yang Weijiang Date: Fri Sep 19 15:32:19 2025 -0700 KVM: VMX: Introduce CET VMCS fields and control bits Control-flow Enforcement Technology (CET) is a kind of CPU feature used to prevent Return/CALL/Jump-Oriented Programming (ROP/COP/JOP) attacks. It provides two sub-features(SHSTK,IBT) to defend against ROP/COP/JOP style control-flow subversion attacks. Shadow Stack (SHSTK): A shadow stack is a second stack used exclusively for control transfer operations. The shadow stack is separate from the data/normal stack and can be enabled individually in user and kernel mode. When shadow stack is enabled, CALL pushes the return address on both the data and shadow stack. RET pops the return address from both stacks and compares them. If the return addresses from the two stacks do not match, the processor generates a #CP. Indirect Branch Tracking (IBT): IBT introduces instruction(ENDBRANCH)to mark valid target addresses of indirect branches (CALL, JMP etc...). If an indirect branch is executed and the next instruction is _not_ an ENDBRANCH, the processor generates a #CP. These instruction behaves as a NOP on platforms that have no CET. Several new CET MSRs are defined to support CET: MSR_IA32_{U,S}_CET: CET settings for {user,supervisor} CET respectively. MSR_IA32_PL{0,1,2,3}_SSP: SHSTK pointer linear address for CPL{0,1,2,3}. MSR_IA32_INT_SSP_TAB: Linear address of SHSTK pointer table, whose entry is indexed by IST of interrupt gate desc. Two XSAVES state bits are introduced for CET: IA32_XSS:[bit 11]: Control saving/restoring user mode CET states IA32_XSS:[bit 12]: Control saving/restoring supervisor mode CET states. Six VMCS fields are introduced for CET: {HOST,GUEST}_S_CET: Stores CET settings for kernel mode. {HOST,GUEST}_SSP: Stores current active SSP. {HOST,GUEST}_INTR_SSP_TABLE: Stores current active MSR_IA32_INT_SSP_TAB. On Intel platforms, two additional bits are defined in VM_EXIT and VM_ENTRY control fields: If VM_EXIT_LOAD_CET_STATE = 1, host CET states are loaded from following VMCS fields at VM-Exit: HOST_S_CET HOST_SSP HOST_INTR_SSP_TABLE If VM_ENTRY_LOAD_CET_STATE = 1, guest CET states are loaded from following VMCS fields at VM-Entry: GUEST_S_CET GUEST_SSP GUEST_INTR_SSP_TABLE Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 6a11c860d8a4aa1c7351246bd1ee7b41f26399b6 Author: Yang Weijiang Date: Fri Sep 19 15:32:18 2025 -0700 KVM: x86: Report KVM supported CET MSRs as to-be-saved Add CET MSRs to the list of MSRs reported to userspace if the feature, i.e. IBT or SHSTK, associated with the MSRs is supported by KVM. Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 586ef9dcbb28fc0bc6beb496e6dc8a54276e7a32 Author: Yang Weijiang Date: Fri Sep 19 15:32:17 2025 -0700 KVM: x86: Add fault checks for guest CR4.CET setting Check potential faults for CR4.CET setting per Intel SDM requirements. CET can be enabled if and only if CR0.WP == 1, i.e. setting CR4.CET == 1 faults if CR0.WP == 0 and setting CR0.WP == 0 fails if CR4.CET == 1. Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Reviewed-by: Xiaoyao Li Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919223258.1604852-11-seanjc@google.com Signed-off-by: Sean Christopherson commit e44eb58334bbc28d790ed2851385cc86ea76dc12 Author: Sean Christopherson Date: Fri Sep 19 15:32:16 2025 -0700 KVM: x86: Load guest FPU state when access XSAVE-managed MSRs Load the guest's FPU state if userspace is accessing MSRs whose values are managed by XSAVES. Introduce two helpers, kvm_{get,set}_xstate_msr(), to facilitate access to such kind of MSRs. If MSRs supported in kvm_caps.supported_xss are passed through to guest, the guest MSRs are swapped with host's before vCPU exits to userspace and after it reenters kernel before next VM-entry. Because the modified code is also used for the KVM_GET_MSRS device ioctl(), explicitly check @vcpu is non-null before attempting to load guest state. The XSAVE-managed MSRs cannot be retrieved via the device ioctl() without loading guest FPU state (which doesn't exist). Note that guest_cpuid_has() is not queried as host userspace is allowed to access MSRs that have not been exposed to the guest, e.g. it might do KVM_SET_MSRS prior to KVM_SET_CPUID2. The two helpers are put here in order to manifest accessing xsave-managed MSRs requires special check and handling to guarantee the correctness of read/write to the MSRs. Co-developed-by: Yang Weijiang Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: drop S_CET, add big comment, move accessors to x86.c] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 779ed05511f2931b89fcd0087aba2fcca8890715 Author: Yang Weijiang Date: Fri Sep 19 15:32:15 2025 -0700 KVM: x86: Initialize kvm_caps.supported_xss Set original kvm_caps.supported_xss to (host_xss & KVM_SUPPORTED_XSS) if XSAVES is supported. host_xss contains the host supported xstate feature bits for thread FPU context switch, KVM_SUPPORTED_XSS includes all KVM enabled XSS feature bits, the resulting value represents the supervisor xstates that are available to guest and are backed by host FPU framework for swapping {guest,host} XSAVE-managed registers/MSRs. [sean: relocate and enhance comment about PT / XSS[8] ] Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 9622e116d0d25f1ddc47bf0328612cc7d87d20f2 Author: Yang Weijiang Date: Fri Sep 19 15:32:14 2025 -0700 KVM: x86: Refresh CPUID on write to guest MSR_IA32_XSS Update CPUID.(EAX=0DH,ECX=1).EBX to reflect current required xstate size due to XSS MSR modification. CPUID(EAX=0DH,ECX=1).EBX reports the required storage size of all enabled xstate features in (XCR0 | IA32_XSS). The CPUID value can be used by guest before allocate sufficient xsave buffer. Note, KVM does not yet support any XSS based features, i.e. supported_xss is guaranteed to be zero at this time. Opportunistically skip CPUID updates if XSS value doesn't change. Suggested-by: Sean Christopherson Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Reviewed-by: Xiaoyao Li Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 338543cbe033e56dcc8c13adcdf6c228953c0829 Author: Chao Gao Date: Fri Sep 19 15:32:13 2025 -0700 KVM: x86: Check XSS validity against guest CPUIDs Maintain per-guest valid XSS bits and check XSS validity against them rather than against KVM capabilities. This is to prevent bits that are supported by KVM but not supported for a guest from being set. Opportunistically return KVM_MSR_RET_UNSUPPORTED on IA32_XSS MSR accesses if guest CPUID doesn't enumerate X86_FEATURE_XSAVES. Since KVM_MSR_RET_UNSUPPORTED takes care of host_initiated cases, drop the host_initiated check. Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-7-seanjc@google.com Signed-off-by: Sean Christopherson commit c0a5f298912222f3bb4e8f5dc67c6a1f0e93d83f Author: Sean Christopherson Date: Fri Sep 19 15:32:12 2025 -0700 KVM: x86: Report XSS as to-be-saved if there are supported features Add MSR_IA32_XSS to list of MSRs reported to userspace if supported_xss is non-zero, i.e. KVM supports at least one XSS based feature. Before enabling CET virtualization series, guest IA32_MSR_XSS is guaranteed to be 0, i.e., XSAVES/XRSTORS is executed in non-root mode with XSS == 0, which equals to the effect of XSAVE/XRSTOR. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 06f2969c6a1237f05f8ba4324b6ddc2570a808d0 Author: Yang Weijiang Date: Fri Sep 19 15:32:11 2025 -0700 KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support Enable KVM_{G,S}ET_ONE_REG uAPIs so that userspace can access MSRs and other non-MSR registers through them, along with support for KVM_GET_REG_LIST to enumerate support for KVM-defined registers. This is in preparation for allowing userspace to read/write the guest SSP register, which is needed for the upcoming CET virtualization support. Currently, two types of registers are supported: KVM_X86_REG_TYPE_MSR and KVM_X86_REG_TYPE_KVM. All MSRs are in the former type; the latter type is added for registers that lack existing KVM uAPIs to access them. The "KVM" in the name is intended to be vague to give KVM flexibility to include other potential registers. More precise names like "SYNTHETIC" and "SYNTHETIC_MSR" were considered, but were deemed too confusing (e.g. can be conflated with synthetic guest-visible MSRs) and may put KVM into a corner (e.g. if KVM wants to change how a KVM-defined register is modeled internally). Enumerate only KVM-defined registers in KVM_GET_REG_LIST to avoid duplicating KVM_GET_MSR_INDEX_LIST, and so that KVM can return _only_ registers that are fully supported (KVM_GET_REG_LIST is vCPU-scoped, i.e. can be precise, whereas KVM_GET_MSR_INDEX_LIST is system-scoped). Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Link: https://lore.kernel.org/all/20240219074733.122080-18-weijiang.yang@intel.com [1] Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919223258.1604852-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 1f2bbbbbda57f1939d757f5021ec0e3ea782ccf6 Merge: 5dca3808b2fc5e df1f294013da71 Author: Sean Christopherson Date: Tue Sep 23 09:00:18 2025 -0700 KVM: x86: Merge 'selftests' into 'cet' to pick up ex_str() Merge the queue of KVM selftests changes for 6.18 to pick up the ex_str() helper so that it can be used to pretty print expected versus actual exceptions in a new MSR selftest. CET virtualization will add support for several MSRs with non-trivial semantics, along with new uAPI for accessing the guest's Shadow Stack Pointer (SSP) from userspace. commit 5dca3808b2fc5ebf6f202fca8dc38e439f8a3f5b Merge: 86bcd23df9cec9 4135a9a8ccba2b Author: Sean Christopherson Date: Tue Sep 23 08:59:49 2025 -0700 KVM: x86: Merge 'svm' into 'cet' to pick up GHCB dependencies Merge the queue of SVM changes for 6.18 to pick up the KVM-defined GHCB helpers so that kvm_ghcb_get_xss() can be used to virtualize CET for SEV-ES+ guests. commit ca2967de5a5b098b43c5ad665672945ce7e7d4f7 Author: Naveen N Rao Date: Fri Sep 19 14:59:34 2025 -0700 KVM: SVM: Enable AVIC by default for Zen4+ if x2AVIC is support AVIC and x2AVIC are fully functional since Zen 4, with no known hardware errata. Enable AVIC and x2AVIC by default on Zen4+ so long as x2AVIC is supported (to avoid enabling partial support for APIC virtualization by default). Internally, convert "avic" to an integer so that KVM can identify if the user has asked to explicitly enable or disable AVIC, i.e. so that KVM doesn't override an explicit 'y' from the user. Arbitrarily use -1 to denote auto-mode, and accept the string "auto" for the module param in addition to standard boolean values, i.e. continue to allow the user to configure the "avic" module parameter to explicitly enable/disable AVIC. To again maintain backward compatibility with a standard boolean param, set KERNEL_PARAM_OPS_FL_NOARG, which tells the params infrastructure to allow empty values for %true, i.e. to interpret a bare "avic" as "avic=y". Take care to check for a NULL @val when looking for "auto"! Lastly, always print "avic" as a boolean, since auto-mode is resolved during module initialization, i.e. the user should never see "auto" in sysfs. Signed-off-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919215934.1590410-8-seanjc@google.com Signed-off-by: Sean Christopherson commit b14665353162db70e445aacdd18b0566edba00c2 Author: Sean Christopherson Date: Fri Sep 19 14:59:33 2025 -0700 KVM: SVM: Move global "avic" variable to avic.c Move "avic" to avic.c so that it's colocated with the other AVIC specific globals and module params, and so that avic_hardware_setup() is a bit more self-contained, e.g. similar to sev_hardware_setup(). Deliberately set enable_apicv in svm.c as it's already globally visible (defined by kvm.ko, not by kvm-amd.ko), and to clearly capture the dependency on enable_apicv being initialized (svm_hardware_setup() clears several AVIC-specific hooks when enable_apicv is disabled). Alternatively, clearing of the hooks (and enable_ipiv) could be moved to avic_hardware_setup(), but that's not obviously better, e.g. it's helpful to isolate the setting of enable_apicv when reading code from the generic x86 side of the world. No functional change intended. Acked-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-7-seanjc@google.com Signed-off-by: Sean Christopherson commit ad65dca2ca4cf8c377135362c0c1e031ad92019d Author: Sean Christopherson Date: Fri Sep 19 14:59:32 2025 -0700 KVM: SVM: Don't advise the user to do force_avic=y (when x2AVIC is detected) Don't advise the end user to try to force enable AVIC when x2AVIC is reported as supported in CPUID, as forcefully enabling AVIC isn't something that should be done lightly. E.g. some Zen4 client systems hide AVIC but leave x2AVIC behind, and while such a configuration is indeed due to buggy firmware in the sense the reporting x2AVIC without AVIC is nonsensical, KVM has no idea _why_ firmware disabled AVIC in the first place. Suggesting that the user try to run with force_avic=y is sketchy even if the user explicitly tries to enable AVIC, and will be downright irresponsible once KVM starts enabling AVIC by default. Alternatively, KVM could print the message only when the user explicitly asks for AVIC, but running with force_avic=y isn't something that should be encouraged for random users. force_avic is a useful knob for developers and perhaps even advanced users, but isn't something that KVM should advertise broadly. Opportunistically append a newline to the pr_warn() so that it prints out immediately, and tweak the message to say that AVIC is unsupported instead of disabled (disabled suggests that the kernel/KVM is somehow responsible). Suggested-by: Naveen N Rao (AMD) Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-6-seanjc@google.com Signed-off-by: Sean Christopherson commit ce4253e21fa8a4468474e26884196770cb560eae Author: Sean Christopherson Date: Fri Sep 19 14:59:31 2025 -0700 KVM: SVM: Always print "AVIC enabled" separately, even when force enabled Print the customary "AVIC enabled" informational message even when AVIC is force enabled on a system that doesn't advertise supported for AVIC in CPUID, as not printing the standard message can confuse users and tools. Opportunistically clean up the scary message when AVIC is force enabled, but keep it as separate message so that it is printed at level "warn", versus the standard message only being printed for level "info". Suggested-by: Naveen N Rao (AMD) Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-5-seanjc@google.com Signed-off-by: Sean Christopherson commit a9095e4fc4368052593c84472a8d374fefd3df71 Author: Sean Christopherson Date: Fri Sep 19 14:59:30 2025 -0700 KVM: SVM: Update "APICv in x2APIC without x2AVIC" in avic.c, not svm.c Set the "allow_apicv_in_x2apic_without_x2apic_virtualization" flag as part of avic_hardware_setup() instead of handling in svm_hardware_setup(), and make x2avic_enabled local to avic.c (setting the flag was the only use in svm.c). Tag avic_hardware_setup() with __init as necessary (it should have been tagged __init long ago). No functional change intended (aside from the side effects of tagging avic_hardware_setup() with __init). Acked-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-4-seanjc@google.com Signed-off-by: Sean Christopherson commit eb44ea6a7aace13becd8d99905284ad272b3bd98 Author: Sean Christopherson Date: Fri Sep 19 14:59:29 2025 -0700 KVM: SVM: Move x2AVIC MSR interception helper to avic.c Move svm_set_x2apic_msr_interception() to avic.c as it's only relevant when x2AVIC is enabled/supported and only called by AVIC code. In addition to scoping AVIC code to avic.c, this will allow burying the global x2avic_enabled variable in avic. Opportunistically rename the helper to explicitly scope it to "avic". No functional change intended. Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 44bfe1f0490d5620c7962ab7384797672b4c4293 Author: Sean Christopherson Date: Fri Sep 19 14:59:28 2025 -0700 KVM: SVM: Make svm_x86_ops globally visible, clean up on-HyperV usage Make svm_x86_ops globally visible in anticipation of modifying the struct in avic.c, and clean up the KVM-on-HyperV usage, as declaring _and using_ a local variable in a header that's only defined in one specific .c-file is all kinds of ugly. Opportunistically make svm_hv_enable_l2_tlb_flush() local to svm_onhyperv.c, as the only reason it was visible was due to the aforementioned shenanigans in svm_onhyperv.h. Alternatively, svm_x86_ops could be explicitly passed to svm_hv_hardware_setup() as a parameter. While that approach is slightly safer, e.g. avoids "hidden" updates, for better or worse, the Intel side of KVM has already chosen to expose vt_x86_ops (and vt_init_ops). Given that svm_x86_ops is only truly consumed by kvm_ops_update, the odds of a "hidden" update causing problems are extremely low. So, absent a strong reason to rework the VMX/TDX code, make svm_x86_ops visible, as having all updates use exactly "svm_x86_ops." is advantageous in its own right. No functional change intended. Link: https://lore.kernel.org/r/20250919215934.1590410-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 29da8c823abffdacb71c7c07ec48fcf9eb38757c Author: Hou Wenlong Date: Tue Sep 23 08:37:38 2025 -0700 KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest Prior to running an SEV-ES guest, set TSC_AUX in the host save area to the current value in hardware, as tracked by the user return infrastructure, instead of always loading the host's desired value for the CPU. If the pCPU is also running a non-SEV-ES vCPU, loading the host's value on #VMEXIT could clobber the other vCPU's value, e.g. if the SEV-ES vCPU preempted the non-SEV-ES vCPU, in which case KVM expects the other vCPU's TSC_AUX value to be resident in hardware. Note, unlike TDX, which blindly _zeroes_ TSC_AUX on TD-Exit, SEV-ES CPUs can load an arbitrary value. Stuff the current value in the host save area instead of refreshing the user return cache so that KVM doesn't need to track whether or not the vCPU actually enterred the guest and thus loaded TSC_AUX from the host save area. Opportunistically tag tsc_aux_uret_slot as read-only after init to guard against unexpected modifications, and to make it obvious that using the variable in sev_es_prepare_switch_to_guest() is safe. Fixes: 916e3e5f26ab ("KVM: SVM: Do not use user return MSR support for virtualized TSC_AUX") Cc: stable@vger.kernel.org Suggested-by: Lai Jiangshan Signed-off-by: Hou Wenlong [sean: handle the SEV-ES case in sev_es_prepare_switch_to_guest()] Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250923153738.1875174-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 9bc366350734246301b090802fc71f9924daad39 Author: Hou Wenlong Date: Tue Sep 23 08:37:37 2025 -0700 KVM: x86: Add helper to retrieve current value of user return MSR In the user return MSR support, the cached value is always the hardware value of the specific MSR. Therefore, add a helper to retrieve the cached value, which can replace the need for RDMSR, for example, to allow SEV-ES guests to restore the correct host hardware value without using RDMSR. Cc: stable@vger.kernel.org Signed-off-by: Hou Wenlong [sean: drop "cache" from the name, make it a one-liner, tag for stable] Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250923153738.1875174-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 5b66e335ead6472f336b4d7d9cbf14488b844f27 Author: Sean Christopherson Date: Fri Sep 19 14:16:49 2025 -0700 KVM: SEV: Reject non-positive effective lengths during LAUNCH_UPDATE Check for an invalid length during LAUNCH_UPDATE at the start of snp_launch_update() instead of subtly relying on kvm_gmem_populate() to detect the bad state. Code that directly handles userspace input absolutely should sanitize those inputs; failure to do so is asking for bugs where KVM consumes an invalid "npages". Keep the check in gmem, but wrap it in a WARN to flag any bad usage by the caller. Note, this is technically an ABI change as KVM would previously allow a length of '0'. But allowing a length of '0' is nonsensical and creates pointless conundrums in KVM. E.g. an empty range is arguably neither private nor shared, but LAUNCH_UPDATE will fail if the starting gpa can't be made private. In practice, no known or well-behaved VMM passes a length of '0'. Note #2, the PAGE_ALIGNED(params.len) check ensures that lengths between 1 and 4095 (inclusive) are also rejected, i.e. that KVM won't end up with npages=0 when doing "npages = params.len / PAGE_SIZE". Cc: Thomas Lendacky Cc: Michael Roth Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919211649.1575654-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 4135a9a8ccba2b685f2301429ea765fa0f78eb89 Author: Sean Christopherson Date: Fri Sep 19 15:32:10 2025 -0700 KVM: SEV: Validate XCR0 provided by guest in GHCB Use __kvm_set_xcr() to propagate XCR0 changes from the GHCB to KVM's software model in order to validate the new XCR0 against KVM's view of the supported XCR0. Allowing garbage is thankfully mostly benign, as kvm_load_{guest,host}_xsave_state() bail early for vCPUs with protected state, xstate_required_size() will simply provide garbage back to the guest, and attempting to save/restore the bad value via KVM_{G,S}ET_XCRS will only harm the guest (setting XCR0 will fail). However, allowing the guest to put junk into a field that KVM assumes is valid is a CVE waiting to happen. And as a bonus, using the proper API eliminates the ugly open coding of setting arch.cpuid_dynamic_bits_dirty. Simply ignore bad values, as either the guest managed to get an unsupported value into hardware, or the guest is misbehaving and providing pure garbage. In either case, KVM can't fix the broken guest. Note, using __kvm_set_xcr() also avoids recomputing dynamic CPUID bits if XCR0 isn't actually changing (relatively to KVM's previous snapshot). Cc: Tom Lendacky Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-4-seanjc@google.com Signed-off-by: Sean Christopherson commit bd5f500d23170e5bde59ce97da523048b66a8183 Author: Sean Christopherson Date: Fri Sep 19 15:32:09 2025 -0700 KVM: SEV: Read save fields from GHCB exactly once Wrap all reads of GHCB save fields with READ_ONCE() via a KVM-specific GHCB get() utility to help guard against TOCTOU bugs. Using READ_ONCE() doesn't completely prevent such bugs, e.g. doesn't prevent KVM from redoing get() after checking the initial value, but at least addresses all potential TOCTOU issues in the current KVM code base. To prevent unintentional use of the generic helpers, take only @svm for the kvm_ghcb_get_xxx() helpers and retrieve the ghcb instead of explicitly passing it in. Opportunistically reduce the indentation of the macro-defined helpers and clean up the alignment. Fixes: 4e15a0ddc3ff ("KVM: SEV: snapshot the GHCB before accessing it") Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-3-seanjc@google.com Signed-off-by: Sean Christopherson commit e0ff302b79c54567eb6b8f609e76c633978ff06d Author: Sean Christopherson Date: Fri Sep 19 15:32:08 2025 -0700 KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() to make it clear that KVM is getting the cached value, not reading directly from the guest-controlled GHCB. More importantly, vacating kvm_ghcb_get_sw_exit_code() will allow adding a KVM-specific macro-built kvm_ghcb_get_##field() helper to read values from the GHCB. No functional change intended. Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-2-seanjc@google.com Signed-off-by: Sean Christopherson commit df1f294013da715f32521b3d0a69773e660a1af5 Author: Sean Christopherson Date: Fri Sep 19 15:32:51 2025 -0700 KVM: selftests: Add ex_str() to print human friendly name of exception vectors Steal exception_mnemonic() from KVM-Unit-Tests as ex_str() (to keep line lengths reasonable) and use it in assert messages that currently print the raw vector number. Co-developed-by: Chao Gao Signed-off-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-45-seanjc@google.com Signed-off-by: Sean Christopherson commit ff86b48d4ce3bdd8d2353c166e4c905f92cddd78 Author: Sukrut Heroorkar Date: Mon Sep 8 23:05:46 2025 +0200 selftests/kvm: remove stale TODO in xapic_state_test The TODO about using the number of vCPUs instead of vcpu.id + 1 was already addressed by commit 376bc1b458c9 ("KVM: selftests: Don't assume vcpu->id is '0' in xAPIC state test"). The comment is now stale and can be removed. Signed-off-by: Sukrut Heroorkar Link: https://lore.kernel.org/r/20250908210547.12748-1-hsukrut3@gmail.com Signed-off-by: Sean Christopherson commit c435978e4ffe87c6baee1290118039187eafc698 Author: dongsheng Date: Fri Sep 19 14:46:48 2025 -0700 KVM: selftests: Handle Intel Atom errata that leads to PMU event overcount Add a PMU errata framework and use it to relax precise event counts on Atom platforms that overcount "Instruction Retired" and "Branch Instruction Retired" events, as the overcount issues on VM-Exit/VM-Entry are impossible to prevent from userspace, e.g. the test can't prevent host IRQs. Setup errata during early initialization and automatically sync the mask to VMs so that tests can check for errata without having to manually manage host=>guest variables. For Intel Atom CPUs, the PMU events "Instruction Retired" or "Branch Instruction Retired" may be overcounted for some certain instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD and complex SGX/SMX/CSTATE instructions/flows. The detailed information can be found in the errata (section SRF7): https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/ For the Atom platforms before Sierra Forest (including Sierra Forest), Both 2 events "Instruction Retired" and "Branch Instruction Retired" would be overcounted on these certain instructions, but for Clearwater Forest only "Instruction Retired" event is overcounted on these instructions. Signed-off-by: dongsheng Co-developed-by: Dapeng Mi Signed-off-by: Dapeng Mi Tested-by: Yi Lai Co-developed-by: Sean Christopherson Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 2922b595886575ebef46e65a0d4c8a857c5cd464 Author: Dapeng Mi Date: Fri Sep 19 14:46:47 2025 -0700 KVM: selftests: Validate more arch-events in pmu_counters_test Add support for 5 new architectural events (4 topdown level 1 metrics events and LBR inserts event) that will first show up in Intel's Clearwater Forest CPUs. Detailed info about the new events can be found in SDM section 21.2.7 "Pre-defined Architectural Performance Events". Signed-off-by: Dapeng Mi Tested-by: Yi Lai [sean: drop "unavailable_mask" changes] Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 1fcd3053aa1a6d4c417450c92ddb960b9edb1bf1 Author: Sean Christopherson Date: Fri Sep 19 14:46:46 2025 -0700 KVM: selftests: Reduce number of "unavailable PMU events" combos tested Reduce the number of combinations of unavailable PMU events masks that are testing by the PMU counters test. In reality, testing every possible combination isn't all that interesting, and certainly not worth the tens of seconds (or worse, minutes) of runtime. Fully testing the N^2 space will be especially problematic in the near future, as 5! new arch events are on their way. Use alternating bit patterns (and 0 and -1u) in the hopes that _if_ there is ever a KVM bug, it's not something horribly convoluted that shows up only with a super specific pattern/value. Reported-by: Dapeng Mi Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 571fc2833ed0195d016c96e003b3611e95e40f09 Author: Sean Christopherson Date: Fri Sep 19 14:46:45 2025 -0700 KVM: selftests: Track unavailable_mask for PMU events as 32-bit value Track the mask of "unavailable" PMU events as a 32-bit value. While bits 31:9 are currently reserved, silently truncating those bits is unnecessary and asking for missed coverage. To avoid running afoul of the sanity check in vcpu_set_cpuid_property(), explicitly adjust the mask based on the non-reserved bits as reported by KVM's supported CPUID. Opportunistically update the "all ones" testcase to pass -1u instead of 0xff. Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 210b09fa428c078c44951170fe69234c880a05f6 Author: Dapeng Mi Date: Fri Sep 19 14:46:44 2025 -0700 KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test A new bit PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added to indicated if PEBS supports to record timing information in a new "Retried Latency" field. Since KVM requires user can only set host consistent PEBS capabilities, otherwise the PERF_CAPABILITIES setting would fail, add pebs_timing_info into the "immutable_caps" to block host inconsistent PEBS configuration and cause errors. Opportunistically drop the anythread_deprecated bit. It isn't and likely never was a PERF_CAPABILITIES flag, the test's definition snuck in when the union was copy+pasted from the kernel's definition. Signed-off-by: Dapeng Mi Tested-by: Yi Lai [sean: call out anythread_deprecated change] Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 66e2d96b1c5875122bfb94239989d832ccf51477 Author: Steven Rostedt Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Move kvm_iocsr tracepoint out of generic code The tracepoint kvm_iocsr is only used by the loongarch architecture. As trace events can take up to 5K of memory, move this tracepoint into the LoongArch specific tracing file so that it doesn't waste memory for all other architectures. Reviewed-by: Bibo Mao Signed-off-by: Steven Rostedt (Google) Signed-off-by: Huacai Chen commit 77336b918f59b9c715d1f752149557a05e0bc0bc Author: Yury Norov (NVIDIA) Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Rework pch_pic_update_batch_irqs() Use proper bitmap API and drop all the housekeeping code. Reviewed-by: Bibo Mao Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Huacai Chen commit f851fdd895dea69e23acc80262da0b8f9e4d04ad Author: Bibo Mao Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Add different length support in loongarch_pch_pic_write() With function loongarch_pch_pic_write(), currently there is only four bytes register write support. But in theory, all length 1/2/4/8 should be supported for all the registers, here add different length support about register write emulation in function loongarch_pch_pic_write(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f8a73df503f5145317de992b94df603ed97e2f86 Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Add different length support in loongarch_pch_pic_read() With function loongarch_pch_pic_read(), currently it is hardcoded length for different registers, and the length comes from exising linux pch_pic driver code. But in theory, all length 1/2/4/8 should be supported for all the registers, here add different length support about register read emulation in function loongarch_pch_pic_read(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit eb626c7704dc9dbc2eee2c2bee281992d36de6da Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Add IRR and ISR register read emulation With LS7A user manual, there are registers PCH_PIC_INT_IRR_START and PCH_PIC_INT_ISR_START. So add read access emulation in function loongarch_pch_pic_read() here. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 2f412eb7650c369744420cc2d06404fe3f1fb79f Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Set version information at initial stage Register PCH_PIC_INT_ID constains version and supported irq number information, and it is a read only register. The detailed value can be set at initial stage, rather than read callback. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 3da2b0d439aa4eccc2a65e87f0bb280595d91ffe Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Access mailbox directly in mail_send() With function mail_send(), it is to write mailbox of other VCPUs. Existing simple APIs read_mailbox()/write_mailbox() can be used directly rather than send command on IOCSR address. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1cf7b2881d832f05b31ec06484774604676189e2 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add implementation with IOCSR_IPI_SET IPI IOCSR register IOCSR_IPI_SET can send ipi interrupt to other vCPUs, but it can also send an interrupt to vCPU itself. Indeed there are such operations on Linux as arch_irq_work_raise() which will send ipi message to vCPU itself. Here add implementation of write operation with IOCSR_IPI_SET register. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 44598fe77663da1fdd59c2b01fc317afcb7bc753 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add sign extension with kernel IOCSR read emulation Function kvm_complete_iocsr_read() is to add sign extension with IOCSR read emulation, it is used in user space IOCSR read completion now. Also it should be used in kernel IOCSR read emulation. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 80edf90831a2c129db478b1e72b27839602b72ea Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add sign extension with kernel MMIO read emulation Function kvm_complete_mmio_read() is to add sign extension with MMIO read emulation, it is used in user space MMIO read completion now. Also it should be used in kernel MMIO read emulation. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 7109f51bcc80b79a8f31e50fa5c96a20c54197d9 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add PTW feature detection on new hardware With new Loongson-3A6000/3C6000 hardware platforms (or later), hardware page table walking (PTW) feature is supported on host. So here add this feature detection on KVM host. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9a1aa642c1fb5a3776447182aaf37dfaafb36134 Author: Zihuan Zhang Date: Tue Sep 23 15:55:53 2025 +0800 cpufreq: Replace pointer subtraction with iteration macro The cpufreq documentation suggests avoiding direct pointer subtraction when working with entries in driver_freq_table, as it is relatively costly. Instead, the recommended approach is to use the provided iteration macros, like cpufreq_for_each_valid_entry_idx(). Use cpufreq_for_each_entry_idx() instead of pointer subtraction in cpufreq_frequency_table_cpuinfo() which improves code clarity and follows the established cpufreq coding style. While at it, remove redundant local variable initialization from cpufreq_table_index_unsorted(). No functional change intended. Signed-off-by: Zihuan Zhang Link: https://patch.msgid.link/20250923075553.45532-1-zhangzihuan@kylinos.cn [ rjw: Subject tweak, changelog edits, local variable definition tweak ] Signed-off-by: Rafael J. Wysocki commit 67600ccfc4f38ebd331b9332ac94717bfbc87ea7 Author: Duoming Zhou Date: Tue Sep 23 13:13:57 2025 +0800 thunderbolt: Fix use-after-free in tb_dp_dprx_work The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed if it was already running. This leads to use-after-free scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while tunnel->dprx_work remains active and attempts to dereference tb_tunnel in tb_dp_dprx_work(). A typical race condition is illustrated below: CPU 0 | CPU 1 tb_dp_tunnel_active() | tb_deactivate_and_free_tunnel()| tb_dp_dprx_start() tb_tunnel_deactivate() | queue_delayed_work() tb_dp_activate() | tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker cancel_delayed_work() | tb_tunnel_put(tunnel); | | tunnel = container_of(...); //UAF | tunnel-> //UAF Replacing cancel_delayed_work() with cancel_delayed_work_sync() is not feasible as it would introduce a deadlock: both tb_dp_dprx_work() and the cleanup path acquire tb->lock, and cancel_delayed_work_sync() would wait indefinitely for the work item that cannot proceed. Instead, implement proper reference counting: - If cancel_delayed_work() returns true (work is pending), we release the reference in the stop function. - If it returns false (work is executing or already completed), the reference is released in delayed work function itself. This ensures the tb_tunnel remains valid during work item execution while preventing memory leaks. This bug was found by static analysis. Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Mika Westerberg commit 340de1f673ceb0ab46470cb19b7c773e3359a3e5 Author: Andrea Righi Date: Tue Sep 23 11:16:34 2025 +0200 sched_ext: Verify RCU protection in scx_bpf_cpu_curr() scx_bpf_cpu_curr() has been introduced to retrieve the current task of a given runqueue, allowing schedulers to interact with that task. The kfunc assumes that it is always called in an RCU context, but this is not always guaranteed and some BPF schedulers can trigger the following warning: WARNING: suspicious RCU usage sched_ext: BPF scheduler "cosmos_1.0.2_gd0e71ca_x86_64_unknown_linux_gnu_debug" enabled 6.17.0-rc1 #1-NixOS Not tainted ----------------------------- kernel/sched/ext.c:6415 suspicious rcu_dereference_check() usage! ... Call Trace: dump_stack_lvl+0x6f/0xb0 lockdep_rcu_suspicious.cold+0x4e/0x96 scx_bpf_cpu_curr+0x7e/0x80 bpf_prog_c68b2b6b6b1b0ff8_sched_timerfn+0xce/0x1dc bpf_timer_cb+0x7b/0x130 __hrtimer_run_queues+0x1ea/0x380 hrtimer_run_softirq+0x8c/0xd0 handle_softirqs+0xc9/0x3b0 __irq_exit_rcu+0x96/0xc0 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x73/0x80 To address this, mark the kfunc with KF_RCU_PROTECTED, so the verifier can enforce its usage only inside RCU-protected sections. Note: this also requires commit 1512231b6cc86 ("bpf: Enforce RCU protection for KF_RCU_PROTECTED"), currently in bpf-next, to enforce the proper KF_RCU_PROTECTED. Fixes: 20b158094a1ad ("sched_ext: Introduce scx_bpf_cpu_curr()") Cc: Christian Loehle Cc: Kumar Kartikeya Dwivedi Signed-off-by: Andrea Righi Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo commit 7aada81cd75ad844c84fb1dcdce2d67ec41763f8 Author: Ivaylo Ivanov Date: Sun Sep 14 16:18:48 2025 +0300 dt-bindings: mmc: samsung,exynos-dw-mshc: add specific compatible for exynos8890 Add samsung,exynos8890-dw-mshc-smu specific compatible to the bindings documentation. Since Samsung, as usual, likes reusing devices from older designs, use the samsung,exynos7-dw-mshc-smu compatible. Signed-off-by: Ivaylo Ivanov Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 70bd70c303ad4a00b299cb2468bc6475ff90b5b1 Author: Marco Crivellari Date: Fri Sep 5 11:10:40 2025 +0200 tracing: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Cc: Lai Jiangshan Cc: Frederic Weisbecker Cc: Sebastian Andrzej Siewior Cc: Michal Hocko Cc: Masami Hiramatsu Link: https://lore.kernel.org/20250905091040.109772-2-marco.crivellari@suse.com Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Steven Rostedt (Google) commit 4c709ccc478b4b711ee071146aae98eb7fa9f625 Author: Jesse.Zhang Date: Mon Sep 22 09:40:51 2025 +0800 drm/amd/pm: Add VCN reset message support for SMU v13.0.12 This commit adds support for VCN reset functionality in SMU v13.0.12 by: 1. Adding two new PPSMC messages in smu_v13_0_12_ppsmc.h: - PPSMC_MSG_ResetVCN (0x5E) - Updates PPSMC_Message_Count to 0x5F to account for new messages 2. Adding message mapping for ResetVCN in smu_v13_0_12_ppt.c: - Maps SMU_MSG_ResetVCN to PPSMC_MSG_ResetVCN These changes enable proper VCN reset handling through the SMU firmware interface for compatible AMD GPUs. v2: Added fw version check to support vcn queue reset. Acked-by: Alex Deucher Reviewed-by: Yang Wang Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5886090032ec891ccd6bf3c7e9d1ae3fe43ecc34 Author: Jesse.Zhang Date: Fri Aug 15 23:44:11 2025 +0800 drm/amdgpu: Move VCN reset mask setup to late_init for VCN 5.0.1 This patch moves the initialization of the VCN supported_reset mask from sw_init to a new late_init function for VCN 5.0.1. The change ensures that all necessary hardware and firmware initialization is complete before determining the supported reset types. Key changes: - Added vcn_v5_0_1_late_init() function to handle late initialization - Moved supported_reset mask setup from sw_init to late_init - Added check for per-queue reset support via amdgpu_dpm_reset_vcn_is_supported() - Updated ip_funcs to use the new late_init function This change helps ensure proper reset behavior by waiting until all dependencies are initialized before determining available reset types. Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit dc704458dd31ba45bf9cac3fe3e3ab546dabed20 Author: Jesse.Zhang Date: Wed Aug 6 16:20:28 2025 +0800 drm/amdgpu: Add ring reset support for VCN v5.0.1 Implement the ring reset callback for VCN v5.0.1 to properly handle hardware recovery when encountering GPU hangs. The new functionality: 1. Adds vcn_v5_0_1_ring_reset() function that: - Prepares for reset using amdgpu_ring_reset_helper_begin() - Performs VCN instance reset via amdgpu_dpm_reset_vcn() - Re-initializes hardware through vcn_v5_0_1_hw_init_inst() - Restarts DPG mode with vcn_v5_0_1_start_dpg_mode() - Completes reset with amdgpu_ring_reset_helper_end() 2. Hooks the reset function into the unified ring functions via: - Adding .reset = vcn_v5_0_1_ring_reset to vcn_v5_0_1_unified_ring_vm_funcs 3. Maintains existing behavior for SR-IOV VF cases by checking RRMT status This provides proper hardware recovery capabilities for VCN 5.0.1 IP block during fault conditions, matching functionality available in other VCN versions. v2: Remove the RRMT_ENABLED cap setting in the reset function and replace adev->vcn.inst[ring->me].indirect_sram with vinst->indirect_sram (Lijo) Reviewed-by: Sonny Jiang Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit eb6910cdaa8a1b5af11df6fd2e9a0b2b9f72a028 Author: Jesse.Zhang Date: Wed Aug 6 16:03:13 2025 +0800 drm/amdgpu: Refactor VCN v5.0.1 HW init into separate instance function Split the per-instance initialization code from vcn_v5_0_1_hw_init() into a new vcn_v5_0_1_hw_init_inst() function. This improves code organization by: 1. Separating the instance-specific initialization logic 2. Making the main init function more readable 3. Following the pattern used in queue reset The SR-IOV specific initialization remains in the main function since it has different requirements. Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit 0c1f3fe9a5f899ac95114e68959a35454af1523d Author: Alex Deucher Date: Fri May 2 16:22:45 2025 -0400 Documentation: add initial documenation for user queues Add an initial documentation page for user mode queues. Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 752e6f283ec59ae007aa15a93d5a4b2eefa8cec9 Author: Melissa Wen Date: Mon Sep 1 18:51:05 2025 -0300 drm/amd/display: remove output_tf_change flag Remove this flag as the driver stopped managing it individually since commit a4056c2a6344 ("drm/amd/display: use HW hdr mult for brightness boost"). After some back and forth it was reintroduced as a condition to `set_output_transfer_func()` in [1]. Without direct management, this flag only changes value when all surface update flags are set true on UPDATE_TYPE_FULL with no output TF status meaning. Fixes: bb622e0c0044 ("drm/amd/display: program output tf when required") [1] Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 43f06e8165c4f6e16ab32ede845171ac66d4eaaa Author: Kuan-Wei Chiu Date: Tue Sep 9 17:20:57 2025 +0800 drm/amd/display: Optimize remove_duplicates() from O(N^2) to O(N) Replace the previous O(N^2) implementation of remove_duplicates() with a O(N) version using a fast/slow pointer approach. The new version keeps only the first occurrence of each element and compacts the array in place, improving efficiency without changing functionality. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 51cb93aa0c4a9bb126b76f6e9fd640d88de25cee Author: Melissa Wen Date: Thu Sep 11 14:21:20 2025 -0300 drm/amd/display: change dc stream color settings only in atomic commit Don't update DC stream color components during atomic check. The driver will continue validating the new CRTC color state but will not change DC stream color components. The DC stream color state will only be programmed at commit time in the `atomic_setup_commit` stage. It fixes gamma LUT loss reported by KDE users when changing brightness quickly or changing Display settings (such as overscan) with nightlight on and HDR. As KWin can do a test commit with color settings different from those that should be applied in a non-test-only commit, if the driver changes DC stream color state in atomic check, this state can be eventually HW programmed in commit tail, instead of the respective state set by the non-blocking commit. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4444 Reported-by: Xaver Hugl Signed-off-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 2330437da0994321020777c605a2a8cb0ecb7001 Author: YiPeng Chai Date: Mon Mar 24 15:10:44 2025 +0800 drm/amd/ras: Add rascore status definition Add rascore status definition. V5: Merge the previous empty files. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 86a54e45fd91953e2b0e1aa15932112f135e4821 Author: Rahul Kumar Date: Thu Sep 18 12:42:00 2025 +0530 drm/amdgpu: Use kmalloc_array() instead of kmalloc() Documentation/process/deprecated.rst recommends against the use of kmalloc with dynamic size calculations due to the risk of overflow and smaller allocation being made than the caller was expecting. Replace kmalloc() with kmalloc_array() in amdgpu_amdkfd_gfx_v10.c, amdgpu_amdkfd_gfx_v10_3.c, amdgpu_amdkfd_gfx_v11.c and amdgpu_amdkfd_gfx_v12.c to make the intended allocation size clearer and avoid potential overflow issues. Suggested-by: Felix Kuehling Signed-off-by: Rahul Kumar Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit de023206fc27e1e848e3dd54ee6fbcdc78dba6bb Merge: 64581f41f4c4aa 5fc4ab3269dea6 Author: Ulf Hansson Date: Tue Sep 23 16:35:23 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 2f9c63883730a0bfecb086e6e59246933f936ca1 Author: Melissa Wen Date: Thu Sep 11 14:21:19 2025 -0300 drm/amd/display: update color on atomic commit time Use `atomic_commit_setup` to change the DC stream state. It's a preparation to remove from `atomic_check` changes in CRTC color components of DC stream state and prevent DC to commit TEST_ONLY changes. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4444 Reviewed-by: Harry Wentland Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit cceb54222ea00cec4960ad346a918920c24e75c5 Author: Taimur Hassan Date: Fri Sep 12 18:23:48 2025 -0500 drm/amd/display: Promote DC to 3.2.351 - Disable stutter when programming watermarks on dcn32 - Improve brightness calculations - Fix saving vbios clocks during init for DCN314 - Enable DTM 3 on DCN3.1+ dGPUs - Add new ultra sleep field in DMUB - Isolate DCN401 SMU functions - Refactor and add logging of SMU functions. - Add dccg logging - Fix DCN35 clocks initialization Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit dff184cdba518cef0c0eb6ac8ed115cb83cd26a8 Author: Taimur Hassan Date: Fri Sep 12 16:15:44 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.28.0 Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 348f6117c16ae89a06f53ec6dc893bd7b7a724b4 Merge: 58a5820582e4c8 c6ae18e0af5e7c Author: Alexei Starovoitov Date: Tue Sep 23 07:34:39 2025 -0700 Merge branch 'bpf-introduce-deferred-task-context-execution' Mykyta Yatsenko says: ==================== bpf: Introduce deferred task context execution From: Mykyta Yatsenko This patch introduces a new mechanism for BPF programs to schedule deferred execution in the context of a specific task using the kernel’s task_work infrastructure. The new bpf_task_work interface enables BPF use cases that require sleepable subprogram execution within task context, for example, scheduling sleepable function from the context that does not allow sleepable, such as NMI. Introduced kfuncs bpf_task_work_schedule_signal() and bpf_task_work_schedule_resume() for scheduling BPF callbacks correspond to different modes used by task_work (TWA_SIGNAL or TWA_RESUME). The implementation manages scheduling state via metadata objects (struct bpf_task_work_context). Pointers to bpf_task_work_context are stored in BPF map values. State transitions are handled via an atomic state machine (bpf_task_work_state) to ensure correctness under concurrent usage and deletion, lifetime is guarded by refcounting and RCU Tasks Trace. Kfuncs call task_work_add() indirectly via irq_work to avoid locking in potentially NMI context. Changelog: --- v7 -> v8 v7: https://lore.kernel.org/bpf/20250922232611.614512-1-mykyta.yatsenko5@gmail.com/ * Fix unused variable warning in patch 1 * Decrease stress test time from 2 to 1 second * Went through CI warnings, other than unused variable, there are just 2 new in kernel/bpf/helpers.c related to newly introduced kfuncs, these look expected. v6 -> v7 v6: https://lore.kernel.org/bpf/20250918132615.193388-1-mykyta.yatsenko5@gmail.com/ * Added stress test * Extending refactoring in patch 1 * Changing comment and removing one check for map->usercnt in patch 7 v5 -> v6 v5: https://lore.kernel.org/bpf/20250916233651.258458-1-mykyta.yatsenko5@gmail.com/ * Fixing readability in verifier.c:check_map_field_pointer() * Removing BUG_ON from helpers.c v4 -> v5 v4: https://lore.kernel.org/all/20250915201820.248977-1-mykyta.yatsenko5@gmail.com/ * Fix invalid/null pointer dereference bug, reported by syzbot * Nits in selftests v3 -> v4 v3: https://lore.kernel.org/all/20250905164508.1489482-1-mykyta.yatsenko5@gmail.com/ * Modify async callback return value processing in verifier, to allow non-zero return values. * Change return type of the callback from void to int, as verifier expects scalar value. * Switched to void* for bpf_map API kfunc arguments to avoid casts. * Addressing numerous nits and small improvements. v2 -> v3 v2: https://lore.kernel.org/all/20250815192156.272445-1-mykyta.yatsenko5@gmail.com/ * Introduce ref counting * Add patches with minor verifier and btf.c refactorings to avoid code duplication * Rework initiation of the task work scheduling to handle race with map usercnt dropping to zero ==================== Link: https://patch.msgid.link/20250923112404.668720-1-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit c6ae18e0af5e7c809ac26350043924e062dbb76f Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:04 2025 +0100 selftests/bpf: add bpf task work stress tests Add stress tests for BPF task-work scheduling kfuncs. The tests spawn multiple threads that concurrently schedule task_work callbacks against the same and different map values to exercise the kfuncs under high contention. Verify callbacks are reliably enqueued and executed with no drops. Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20250923112404.668720-10-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 39fd74dfd5d2ea9d1e94b2e03076284616798551 Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:03 2025 +0100 selftests/bpf: BPF task work scheduling tests Introducing selftests that check BPF task work scheduling mechanism. Validate that verifier does not accepts incorrect calls to bpf_task_work_schedule kfunc. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-9-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 38aa7003e369802f81a078f6673d10d97013f04f Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:02 2025 +0100 bpf: task work scheduling kfuncs Implementation of the new bpf_task_work_schedule kfuncs, that let a BPF program schedule task_work callbacks for a target task: * bpf_task_work_schedule_signal() - schedules with TWA_SIGNAL * bpf_task_work_schedule_resume() - schedules with TWA_RESUME Each map value should embed a struct bpf_task_work, which the kernel side pairs with struct bpf_task_work_kern, containing a pointer to struct bpf_task_work_ctx, that maintains metadata relevant for the concrete callback scheduling. A small state machine and refcounting scheme ensures safe reuse and teardown. State transitions: _______________________________ | | v | [standby] ---> [pending] --> [scheduling] --> [scheduled] ^ |________________|_________ | | | v | [running] |_______________________________________________________| All states may transition into FREED state: [pending] [scheduling] [scheduled] [running] [standby] -> [freed] A FREED terminal state coordinates with map-value deletion (bpf_task_work_cancel_and_free()). Scheduling itself is deferred via irq_work to keep the kfunc callable from NMI context. Lifetime is guarded with refcount_t + RCU Tasks Trace. Main components: * struct bpf_task_work_context – Metadata and state management per task work. * enum bpf_task_work_state – A state machine to serialize work scheduling and execution. * bpf_task_work_schedule() – The central helper that initiates scheduling. * bpf_task_work_acquire_ctx() - Attempts to take ownership of the context, pointed by passed struct bpf_task_work, allocates new context if none exists yet. * bpf_task_work_callback() – Invoked when the actual task_work runs. * bpf_task_work_irq() – An intermediate step (runs in softirq context) to enqueue task work. * bpf_task_work_cancel_and_free() – Cleanup for deleted BPF map entries. Flow of successful task work scheduling 1) bpf_task_work_schedule_* is called from BPF code. 2) Transition state from STANDBY to PENDING, mark context as owned by this task work scheduler 3) irq_work_queue() schedules bpf_task_work_irq(). 4) Transition state from PENDING to SCHEDULING (noop if transition successful) 5) bpf_task_work_irq() attempts task_work_add(). If successful, state transitions to SCHEDULED. 6) Task work calls bpf_task_work_callback(), which transition state to RUNNING. 7) BPF callback is executed 8) Context is cleaned up, refcounts released, context state set back to STANDBY. Signed-off-by: Mykyta Yatsenko Reviewed-by: Andrii Nakryiko Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250923112404.668720-8-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5e8134f50d3041a9922a732f24d705a238b61aad Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:01 2025 +0100 bpf: extract map key pointer calculation Calculation of the BPF map key, given the pointer to a value is duplicated in a couple of places in helpers already, in the next patch another use case is introduced as well. This patch extracts that functionality into a separate function. Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-7-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5c8fd7e2b5b0a527cf88740da122166695382a78 Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:00 2025 +0100 bpf: bpf task work plumbing This patch adds necessary plumbing in verifier, syscall and maps to support handling new kfunc bpf_task_work_schedule and kernel structure bpf_task_work. The idea is similar to how we already handle bpf_wq and bpf_timer. verifier changes validate calls to bpf_task_work_schedule to make sure it is safe and expected invariants hold. btf part is required to detect bpf_task_work structure inside map value and store its offset, which will be used in the next patch to calculate key and value addresses. arraymap and hashtab changes are needed to handle freeing of the bpf_task_work: run code needed to deinitialize it, for example cancel task_work callback if possible. The use of bpf_task_work and proper implementation for kfuncs are introduced in the next patch. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-6-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit d2699bdb6ebad4fecd0f8765f35bd32a4a142b16 Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:59 2025 +0100 bpf: verifier: permit non-zero returns from async callbacks The verifier currently enforces a zero return value for all async callbacks—a constraint originally introduced for bpf_timer. That restriction is too narrow for other async use cases. Relax the rule by allowing non-zero return codes from async callbacks in general, while preserving the zero-return requirement for bpf_timer to maintain its existing semantics. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-5-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit acc3a0d2506c1b8186e9190adcd5bee4a1932abc Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:58 2025 +0100 bpf: htab: extract helper for freeing special structs Extract the cleanup of known embedded structs into the dedicated helper. Remove duplication and introduce a single source of truth for freeing special embedded structs in hashtab. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-4-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5eab266b801f4b938fea6d112c560c84ab489627 Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:57 2025 +0100 bpf: extract generic helper from process_timer_func() Refactor the verifier by pulling the common logic from process_timer_func() into a dedicated helper. This allows reusing process_async_func() helper for verifying bpf_task_work struct in the next patch. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Tested-by: syzbot@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20250923112404.668720-3-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit f90213261681268b6dc4c944503ddcc20e15f8fe Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:56 2025 +0100 bpf: refactor special field-type detection Reduce code duplication in detection of the known special field types in map values. This refactoring helps to avoid copying a chunk of code in the next patch of the series. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250923112404.668720-2-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit d43cc4ea1f9d720ab4bf06806f79260bfe981508 Author: Leo Li Date: Fri Sep 12 11:01:50 2025 -0400 drm/amd/display: Init DCN35 clocks from pre-os HW values [Why] We did not initialize dc clocks with boot-time hw values during init. This lead to incorrect clock values in dc, causing `dcn35_update_clocks` to make incorrect updates. [How] Correctly initialize DC with pre-os clk values from HW. s/dump/save/ as that accurately reflects the purpose of the functions. Fixes: 8774029f76b9 ("drm/amd/display: Add DCN35 CLK_MGR") Reviewed-by: Aurabindo Pillai Signed-off-by: Leo Li Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 550038edef7f933591e10e32f94a5e9557b023b8 Author: Charlene Liu Date: Fri Sep 12 12:37:30 2025 -0400 drm/amd/display: Revert "correct sw cache timing to ensure dispclk ramping" [why] Need consider SSC enabled case This reverts commit f1fd8a9ac2aa5118f76baf28e6ca4d6962a485be. Reviewed-by: Ovidiu (Ovi) Bunea Reviewed-by: Chris Park Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f1fd8a9ac2aa5118f76baf28e6ca4d6962a485be Author: Charlene Liu Date: Thu Sep 11 19:20:45 2025 -0400 drm/amd/display: Correct sw cache timing to ensure dispclk ramping [why] Current driver will cache the dispclk right after send cmd to pmfw, but actual clock not reached yet. Change to only cache the dispclk setting after HW reached to the real clock. Also give some range as it might be in bypass clock setting. Reviewed-by: Yihan Zhu Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d943fa61aeebac13a0ddfbd2407f135c84405996 Merge: fc3e44e4925ab4 54c67740fff736 Author: Greg Kroah-Hartman Date: Tue Sep 23 16:32:18 2025 +0200 Merge tag 'mhi-for-v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Add support for all Foxconn T99W696 SKU variants - Fix accessing the uninitialized 'dev' pointer in mhi_init_irq_setup() - Notify the MHI Execution Environment (EE) change to userspace using uevent - Add support for Virtual Functions (VFs) in SR-IOV capable QDU100 device from Qualcomm. For adding SR-IOV support, MHI pci_generic driver has been modified to apply different configurations for PFs and VFs. MHI Endpoint ============ - Fix the handling of chained transfers in EP MHI driver that leads to reading past the host transfer buffers causing IOMMU faults in the host and other issues. * tag 'mhi-for-v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Set DMA mask for VFs bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state bus: mhi: host: pci_generic: Reset QDU100 while the MHI driver is removed bus: mhi: host: pci_generic: Add SRIOV support bus: mhi: host: pci_generic: Read SUBSYSTEM_VENDOR_ID for VF's to check status bus: mhi: host: Add support for separate controller configurations for VF and PF bus: mhi: ep: Fix chained transfer handling in read path bus: mhi: host: Notify EE change via uevent bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU variants commit 35bcc9168f3ce6416cbf3f776758be0937f84cb3 Author: Charlene Liu Date: Thu Sep 11 17:52:11 2025 -0400 drm/amd/display: Insert dccg log for easy debug [why] Log for sequence tracking Reviewed-by: Ovidiu (Ovi) Bunea Reviewed-by: Yihan Zhu Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 19d8f3192f78ce38e710da2df8bad2bc972a7a5a Author: Dillon Varone Date: Thu Sep 11 13:52:52 2025 -0400 drm/amd/display: Remove wm_optimized_required [WHY&HOW] This is a redundant field that is identically to optimized_required, so just replace it. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c480d074b3ff27a8d582505dfd53c9b091b63d57 Author: Dillon Varone Date: Wed Sep 10 16:55:23 2025 -0400 drm/amd/display: Set wm_pending when disable stutter w/a used [WHY&HOW] When stutter is disabled prior to watermark programming due to a w/a, wm_pending should be returned as true. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit adb441ca64a2f3972eb2919e2e340c83a3212479 Author: Dillon Varone Date: Wed Sep 10 10:55:48 2025 -0400 drm/amd/display: Refactor SMU tracing [WHY&HOW] Add new tracing and performance measurements for SMU messaging. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d19f570cdf94caa5fad0f1403466e01a7c430b8f Author: Dillon Varone Date: Fri Aug 22 13:23:18 2025 -0400 drm/amd/display: Isolate dcn401 SMU functions [WHY&HOW] SMU interfaces are not backwards and forwards compatible, so they should be isolated per version. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b65cf4baeb24bdb5fee747679ee88f1ade5c1d6c Author: Allen Li Date: Fri Sep 5 16:58:38 2025 +0800 drm/amd/display: Add fast sync field in ultra sleep more for DMUB [Why&How] We need to inform DMUB whether fast sync in ultra sleep mode is supported, so that it can disable desync error detection when the it is not enabled. This helps prevent unexpected desync errors when transitioning out of ultra sleep mode. Add fast sync in ultra sleep mode field in replay copy setting command. Reviewed-by: Robin Chen Reviewed-by: Nicholas Kazlauskas Signed-off-by: Allen Li Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8613a55ac57baf40e54633eab00c820515196113 Author: Liao Yuanhong Date: Mon Aug 25 20:31:59 2025 +0800 tracing: Remove redundant 0 value initialization The saved_cmdlines_buffer struct is already zeroed by memset(). It's redundant to initialize s->cmdline_idx to 0. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250825123200.306272-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Signed-off-by: Steven Rostedt (Google) commit 9e5d4a5e27c6dc4e1b4fc9d654d13de12b8ce156 Author: Alvin Lee Date: Tue Sep 9 16:03:08 2025 -0400 drm/amd/display: Use mpc.preblend flag to indicate preblend [Description] Modifications in per asic capability means mpc.preblend flag should be used to indicate preblend. Update relevant paths to use this flag. Fixes: 39923050615c ("drm/amd/display: Clear DPP 3DLUT Cap") Reviewed-by: Dillon Varone Signed-off-by: Alvin Lee Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0bf6b216d4783cb51f9af05a49d3cce4fc22dc24 Author: Sridevi Arvindekar Date: Wed Sep 10 11:04:07 2025 -0400 drm/amd/display: Fix for test crash due to power gating [Why/How] Call power gating routine only if it is defined. Reviewed-by: Alvin Lee Signed-off-by: Sridevi Arvindekar Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 3451021a9e153e3f3067c90429c8317c126e159e Author: Ivan Lipski Date: Tue Sep 9 14:15:05 2025 -0400 drm/amd/display: Enable DTM v3 on dGPUs with DCN 3.1+ [Why&How] Right now, only selected APUs have enabled DTM v3, which allows to use newer firmware for content protection. We want to enable it on the dGPUs starting with DCN 3.2 Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f082daf08f2ff313bdf9cf929a28f6d888117986 Author: Lo-an Chen Date: Mon Aug 25 18:16:24 2025 +0800 drm/amd/display: Init dispclk from bootup clock for DCN314 [Why] Driver does not pick up and save vbios's clocks during init clocks, the dispclk in clk_mgr will keep 0 until the first update clocks. In some cases, OS changes the timing in the second set mode (lower the pixel clock), causing the driver to lower the dispclk in prepare bandwidth, which is illegal and causes grey screen. [How] 1. Dump and save the vbios's clocks, and init the dispclk in dcn314_init_clocks. 2. Fix the condition in dcn314_update_clocks, regarding a 0kHz value. Reviewed-by: Charlene Liu Signed-off-by: Lo-an Chen Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6cec25f5b5660602b1953038cf40968b2d71c403 Author: Mario Limonciello Date: Thu Sep 4 13:49:35 2025 -0500 drm/amd/display: Handle interpolation for first data point [Why] If the first data point for a custom brightness curve is not 0% luminance then the first few luminance values will be ignored. [How] Check signal is below first data point and if so do linear interpolation to 0 instead. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 74d70e309d155550c9bd8bce74812875df47fb7b Author: Paul Hsieh Date: Fri Sep 5 11:38:21 2025 +0800 drm/amd/display: Add monitor patch to read psr cap again [Why & How] According to the vendor’s requirement, after each OUI write, the PSR cap must be read; otherwise, the vendor will default to using PSRSU. But its PSR cap indicates that it only supports PSR1. Reviewed-by: Wenjing Liu Signed-off-by: Paul Hsieh Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 Author: Karthi Kandasamy Date: Wed Sep 3 14:16:27 2025 +0200 drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream [WHY] Ensure AVI infoframe updates from stream updates are applied to the active stream so OS overrides are not lost. [HOW] Copy avi_infopacket to stream when valid flag is set. Follow existing infopacket copy pattern and perform a basic validity check before assignment. Reviewed-by: Aric Cyr Signed-off-by: Karthi Kandasamy Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 54980f3c63ed3e5cca3d251416581193c90eae76 Author: Dillon Varone Date: Mon Sep 15 11:35:37 2025 -0400 drm/amd/display: Add missing post flip calls [WHY&HOW] dc_post_update_surfaces_to_stream needs to be called after a full update completes in order to optimize clocks and watermarks for power. Add missing calls before idle entry is requested to ensure optimal power. Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c82b8f96eb972eb313e20ede5eb6617bc393c490 Author: Dillon Varone Date: Mon Sep 15 11:22:52 2025 -0400 drm/amd/display: Disable stutter when programming watermarks on dcn32 [WHY&HOW] Reprogramming watermarks with stutter allowed can cause instability on some ASICs. Disable it prior to raising watermarks (prepare bandwidth), then re-enable after lowering (optimize bandwidth). Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 854b9ab637d72bad8afe8f11cf6edd9aab0d1cf9 Author: Sonny Jiang Date: Thu Sep 18 12:34:48 2025 -0400 drm/amdgpu: Update amdgpu_vcn5_fw_shared for vcn_5_0_1 Align vcn5_fw_shared structure with FW Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 1fb710793ce2619223adffaf981b1ff13cd48f17 Author: Mario Limonciello Date: Thu Sep 18 19:48:00 2025 -0500 drm/amdgpu: Enable MES lr_compute_wa by default The MES set resources packet has an optional bit 'lr_compute_wa' which can be used for preventing MES hangs on long compute jobs. Set this bit by default. Co-developed-by: Yifan Zhang Signed-off-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit c5b3cc417b0260abc74ed32f6baa626c9de917c0 Author: Sunil Khatri Date: Wed Sep 17 20:12:43 2025 +0530 drm/amdgpu: use hmm_pfns instead of array of pages we dont need to allocate local array of pages to hold the pages returned by the hmm, instead we could use the hmm_range structure itself to get to hmm_pfn and get the required pages directly. This avoids call to alloc/free quite a lot. Signed-off-by: Sunil Khatri Suggested-by: Christian König Reviewed-by: Christian König Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit ae4d627e43ccecc403e7378811289b33de38e67d Author: Yang Wang Date: Fri Sep 19 09:44:25 2025 +0800 drm/amd/pm: place the smu 13.0.0 pptable header into the correct folder Place the smu 13.0.0 pptable header in the correct folder Signed-off-by: Yang Wang Reviewed-by: Mangesh Gadre Signed-off-by: Alex Deucher commit b29c22b8dafd951664a491bf629e615d81513197 Author: Lijo Lazar Date: Thu Sep 18 17:52:04 2025 +0530 drm/amdgpu: Fix vbios build number parsing logic It's not necessary that the build string and atom header section has a difference of 32 bytes. Use the remaining bytes in the section as copy limit. Fixes: d6fa80266178 ("drm/amdgpu: Add vbios build number interface") Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 496f9372eae14775e0524e83e952814691fe850a Author: Amir Mohammad Jahangirzad Date: Tue Sep 23 05:01:13 2025 +0330 ACPI: debug: fix signedness issues in read/write helpers In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation. Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits. Address the issue by: - Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics. - Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions. - Using "size_t" for the "n" variable to ensure calculations remain unsigned. - Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow. Signed-off-by: Amir Mohammad Jahangirzad Link: https://patch.msgid.link/20250923013113.20615-1-a.jahangirzad@gmail.com [ rjw: Changelog tweaks, local variable definitions ordering adjustments ] Fixes: 8cfb0cdf07e2 ("ACPI / debugger: Add IO interface to access debugger functionalities") Cc: 4.5+ # 4.5+ Signed-off-by: Rafael J. Wysocki commit ade2105e748f85eb026d26701091213855aea633 Author: Elijah Wright Date: Wed Aug 20 22:39:07 2025 -0700 tracing: Move buffer in trace_seq to end of struct TRACE_SEQ_BUFFER_SIZE is dependent on the architecture for its size. on 64-bit systems, it is 8148 bytes. forced 8-byte alignment in size_t and seq_buf means that trace_seq is 8200 bytes on 64-bit systems. moving the buffer to the end of the struct fixes the issue. there shouldn't be any side effects, i.e. pointer arithmetic on trace_seq Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250821053917.23301-1-git@elijahs.space Signed-off-by: Elijah Wright Signed-off-by: Steven Rostedt (Google) commit 1d67d67a8c88db99ebf5b1323c238929c5fa8483 Author: Fushuai Wang Date: Mon Aug 11 14:41:58 2025 +0800 tracing/osnoise: Use for_each_online_cpu() instead of for_each_cpu() Replace the opencoded for_each_cpu(cpu, cpu_online_mask) loop with the more readable and equivalent for_each_online_cpu(cpu) macro. Link: https://lore.kernel.org/20250811064158.2456-1-wangfushuai@baidu.com Signed-off-by: Fushuai Wang Signed-off-by: Steven Rostedt (Google) commit 559f2eacc8a23c7f44daac09d4f3efd958d497f2 Author: Huisong Li Date: Tue Sep 23 11:24:28 2025 +0800 ACPI: processor: Do not expose global variable acpi_idle_driver Move the cpuidle driver check from __acpi_processor_start() to acpi_processor_power_init() which allows variable acpi_idle_driver to become static. No intentional functional impact. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250923032428.2656329-2-lihuisong@huawei.com [ rjw: Subject tweak, new changelog, adjustment of a new comment ] Signed-off-by: Rafael J. Wysocki commit 09da59344a5a2abb5b2f209cf149421d7d105ebc Author: Qianfeng Rong Date: Sun Aug 17 16:47:25 2025 +0800 tracing: Use vmalloc_array() to improve code Remove array_size() calls and replace vmalloc() with vmalloc_array() in tracing_map_sort_entries(). vmalloc_array() is optimized better, uses fewer instructions, and handles overflow more concisely[1]. [1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250817084725.59477-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Signed-off-by: Steven Rostedt (Google) commit 3add2d34bdfb1caab1d3f28ba0160f52dcff9353 Author: Steven Rostedt Date: Tue Sep 23 09:04:59 2025 -0400 tracing: Have syscall trace events show "0x" for values greater than 10 Currently the syscall trace events show each value as hexadecimal, but without adding "0x" it can be confusing: sys_write(fd: 4, buf: 0x55c4a1fa9270, count: 44) Looks like the above write wrote 44 bytes, when in reality it wrote 68 bytes. Add a "0x" for all values greater or equal to 10 to remove the ambiguity. For values less than 10, leave off the "0x" as that just adds noise to the output. Also change the iterator to check if "i" is nonzero and print the ", " delimiter at the start, then adding the logic to the trace_seq_printf() at the end. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Peter Zijlstra Cc: Namhyung Kim Cc: Takaya Saeki Cc: Tom Zanussi Cc: Thomas Gleixner Cc: Ian Rogers Cc: Douglas Raillard Link: https://lore.kernel.org/20250923130713.764558957@kernel.org Signed-off-by: Steven Rostedt (Google) commit 17a1a107d0e96c1b7eef875de46f1d953c557f88 Author: Steven Rostedt Date: Tue Sep 23 09:04:58 2025 -0400 tracing: Replace syscall RCU pointer assignment with READ/WRITE_ONCE() The syscall events are pseudo events that hook to the raw syscalls. The ftrace_syscall_enter/exit() callback is called by the raw_syscall enter/exit tracepoints respectively whenever any of the syscall events are enabled. The trace_array has an array of syscall "files" that correspond to the system calls based on their __NR_SYSCALL number. The array is read and if there's a pointer to a trace_event_file then it is considered enabled and if it is NULL that syscall event is considered disabled. Currently it uses an rcu_dereference_sched() to get this pointer and a rcu_assign_ptr() or RCU_INIT_POINTER() to write to it. This is unnecessary as the file pointer will not go away outside the synchronization of the tracepoint logic itself. And this code adds no extra RCU synchronization that uses this. Replace these functions with a simple READ_ONCE() and WRITE_ONCE() which is all they need. This will also allow this code to not depend on preemption being disabled as system call tracepoints are now allowed to fault. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Peter Zijlstra Cc: Namhyung Kim Cc: Takaya Saeki Cc: Tom Zanussi Cc: Thomas Gleixner Cc: Ian Rogers Cc: Douglas Raillard Link: https://lore.kernel.org/20250923130713.594320290@kernel.org Reviewed-by: Paul E. McKenney Signed-off-by: Steven Rostedt (Google) commit 01f96b812526a2c8dcd5c0e510dda37e09ec8bcd Author: Mao Jinlong Date: Sat Aug 16 00:25:29 2025 -0700 coresight: Add label sysfs node support For some coresight components like CTI and TPDM, there could be numerous of them. From the node name, we can only get the type and register address of the component. We can't identify the HW or the system the component belongs to. Add label sysfs node support for showing the intuitive name of the device. Signed-off-by: Mao Jinlong Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250816072529.3716968-3-quic_jinlmao@quicinc.com commit 1ad38ef4dbccee28b9b50e315a2d4d9ca5f7ee09 Author: Mao Jinlong Date: Sat Aug 16 00:25:28 2025 -0700 dt-bindings: arm: Add label in the coresight components Current name of coresight component's folder consists of prefix of the device and the id in the device list. When run 'ls' command, we can get the register address of the device. Take CTI for example, if we want to set the config for modem CTI, but we can't know which CTI is modem CTI from all current information. cti_sys0 -> ../../../devices/platform/soc@0/138f0000.cti/cti_sys0 cti_sys1 -> ../../../devices/platform/soc@0/13900000.cti/cti_sys1 Add label to show hardware context information of each coresight device. There will be a sysfs node label in each device folder. cat /sys/bus/coresight/devices/cti_sys0/label Signed-off-by: Mao Jinlong Reviewed-by: Krzysztof Kozlowski Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250816072529.3716968-2-quic_jinlmao@quicinc.com commit 28a272d8eb9fb8a1fa3ef27f665c04d47d74e037 Author: Yuanfang Zhang Date: Thu Aug 14 02:00:13 2025 -0700 coresight: tnoc: add new AMBA ID to support Trace Noc V2 Add the new AMBA ID 0x001f0c00 to support Trace Noc V2 instances. Signed-off-by: Yuanfang Zhang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250814-tnoc_v2-v1-1-3285e37280c9@oss.qualcomm.com commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 Author: Lin Yujun Date: Mon Sep 8 20:20:22 2025 +0800 coresight: Fix incorrect handling for return value of devm_kzalloc The return value of devm_kzalloc could be an null pointer, use "!desc.pdata" to fix incorrect handling return value of devm_kzalloc. Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE") Signed-off-by: Lin Yujun Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 Author: Jie Gan Date: Sat Sep 6 07:53:04 2025 +0800 coresight: tpda: fix the logic to setup the element size Some TPDM devices support both CMB and DSB datasets, requiring the system to enable the port with both corresponding element sizes. Currently, the logic treats tpdm_read_element_size as successful if the CMB element size is retrieved correctly, regardless of whether the DSB element size is obtained. This behavior causes issues when parsing data from TPDM devices that depend on both element sizes. To address this, the function should explicitly fail if the DSB element size cannot be read correctly. Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element") Reviewed-by: James Clark Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d Author: Leo Yan Date: Thu Sep 4 15:13:52 2025 +0100 coresight: trbe: Return NULL pointer for allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etm_setup_aux() only checks for a NULL pointer, so it misses the error. As a result, the driver continues and eventually causes a kernel panic. Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on allocation failures. This allows that the callers can properly handle the failure. Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Reported-by: Tamas Zsoldos Signed-off-by: Leo Yan Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com commit dc783892cca69e721f81d54293dac6286134abfe Author: Leo Yan Date: Thu Jul 31 13:23:46 2025 +0100 coresight: Refactor runtime PM The validation for driver data pointers and clock pointers are redundant in the runtime PM callbacks. After a driver's probing, its driver data and clocks have been initialized successfully, this ensures it is safe to access driver data and clocks in the runtime PM callbacks. A corner case is a clock pointer is NULL, in this case, the clock core layer can handle it properly. So remove these redundant checking. In runtime resume, respect values returned from clock function and add error handling. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-10-1dfe10bb3f6f@arm.com commit 7b20a4fac7c82c0aed6beb22a8523df28361b1ad Author: Leo Yan Date: Thu Jul 31 13:23:45 2025 +0100 coresight: Make clock sequence consistent Since atclk is enabled after pclk during the probe phase, this commit maintains the same sequence for the runtime resume flow. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-9-1dfe10bb3f6f@arm.com commit ba6b61fa21aa44a5634f2dbf78ee6817d3196fc4 Author: Leo Yan Date: Thu Jul 31 13:23:44 2025 +0100 coresight: Refactor driver data allocation The driver data no longer needs to be allocated separately in the static and dynamic probes. Moved the allocation into the low-level functions to avoid code duplication. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-8-1dfe10bb3f6f@arm.com commit fbe7514a7912959e384acf108931ac1bfbb16466 Author: Leo Yan Date: Thu Jul 31 13:23:43 2025 +0100 coresight: Consolidate clock enabling CoreSight drivers enable pclk and atclk conditionally. For example, pclk is only enabled in the static probe, while atclk is an optional clock that it is enabled for both dynamic and static probes, if it is present. In the current CoreSight drivers, these two clocks are initialized separately. This causes complex and duplicate codes. CoreSight drivers are refined so that clocks are initialized in one go. For this purpose, this commit renames coresight_get_enable_apb_pclk() to coresight_get_enable_clocks() and encapsulates clock initialization logic: - If a clock is initialized successfully, its clock pointer is assigned to the double pointer passed as an argument. - For ACPI devices, clocks are controlled by firmware, directly bail out. - Skip enabling pclk for an AMBA device. - If atclk is not found, the corresponding double pointer is set to NULL. The function returns Success (0) to guide callers can proceed with no error. - Otherwise, an error number is returned for failures. The function became complex, move it from the header to the CoreSight core layer and the symbol is exported. Added comments for recording details. Suggested-by: Suzuki K Poulose Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-7-1dfe10bb3f6f@arm.com commit d091c6312561821f216ced63a7ad17c946b6d335 Author: Leo Yan Date: Thu Jul 31 13:23:42 2025 +0100 coresight: Avoid enable programming clock duplicately The programming clock is enabled by AMBA bus driver before a dynamic probe. As a result, a CoreSight driver may redundantly enable the same clock. To avoid this, add a check for device type and skip enabling the programming clock for AMBA devices. The returned NULL pointer will be tolerated by the drivers. Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 Author: Leo Yan Date: Thu Jul 31 13:23:41 2025 +0100 coresight: Appropriately disable trace bus clocks Some CoreSight components have trace bus clocks 'atclk' and are enabled using clk_prepare_enable(). These clocks are not disabled when modules exit. As atclk is optional, use devm_clk_get_optional_enabled() to manage it. The benefit is the driver model layer can automatically disable and release clocks. Check the returned value with IS_ERR() to detect errors but leave the NULL pointer case if the clock is not found. And remove the error handling codes which are no longer needed. Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com commit 1abc1b212effe920f4729353880c8e03f1d76b4b Author: Leo Yan Date: Thu Jul 31 13:23:40 2025 +0100 coresight: Appropriately disable programming clocks Some CoreSight components have programming clocks (pclk) and are enabled using clk_get() and clk_prepare_enable(). However, in many cases, these clocks are not disabled when modules exit and only released by clk_put(). To fix the issue, this commit refactors programming clock by replacing clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled() for enabling APB clock. If the "apb_pclk" clock is not found, a NULL pointer is returned, and the function proceeds to attempt enabling the "apb" clock. Since ACPI platforms rely on firmware to manage clocks, returning a NULL pointer in this case leaves clock management to the firmware rather than the driver. This effectively avoids a clock imbalance issue during module removal - where the clock could be disabled twice: once during the ACPI runtime suspend and again during the devm resource release. Callers are updated to reuse the returned error value. With the change, programming clocks are managed as resources in driver model layer, allowing clock cleanup to be handled automatically. As a result, manual cleanup operations are no longer needed and are removed from the Coresight drivers. Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce Author: Leo Yan Date: Thu Jul 31 13:23:39 2025 +0100 coresight: etm4x: Support atclk The atclk is an optional clock for the CoreSight ETMv4, but the driver misses to initialize it. This change enables atclk in probe of the ETMv4 driver, and dynamically control the clock during suspend and resume. No need to check the driver data and clock pointer in the runtime suspend and resume, so remove checks. And add error handling in the resume function. Add a minor fix to the comment format when adding the atclk field. Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com commit 5483624effea2e893dc0df6248253a6a2a085451 Author: Leo Yan Date: Thu Jul 31 13:23:38 2025 +0100 coresight: catu: Support atclk The atclk is an optional clock for the CoreSight CATU, but the driver misses to initialize it. This change enables atclk in probe of the CATU driver, and dynamically control the clock during suspend and resume. The checks for driver data and clocks in suspend and resume are not needed, remove them. Add error handling in the resume function. Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e Author: Leo Yan Date: Thu Jul 31 13:23:37 2025 +0100 coresight: tmc: Support atclk The atclk is an optional clock for the CoreSight TMC, but the driver misses to initialize it. In most cases, TMC shares the atclk clock with other CoreSight components. Since these components enable the clock before the TMC device is initialized, the TMC continues properly, which is why we don’t observe any lockup issues. This change enables atclk in probe of the TMC driver. Given the clock is optional, it is possible to return NULL if the clock does not exist. IS_ERR() is tolerant for this case. Dynamically disable and enable atclk during suspend and resume. The clock pointers will never be error values if the driver has successfully probed, and the case of a NULL pointer case will be handled by the clock core layer. The driver data is always valid after probe. Therefore, remove the related checks. Also in the resume flow adds error handling. Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 Author: Yuanfang Zhang Date: Tue Aug 12 01:24:45 2025 -0700 coresight-etm4x: Conditionally access register TRCEXTINSELR The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. To avoid invalid accesses, introduce a check on numextinsel (derived from TRCIDR5[11:9]) before reading or writing to this register. Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") Signed-off-by: Yuanfang Zhang Reviewed-by: James Clark Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 Author: Yeoreum Yun Date: Wed Jun 11 11:30:25 2025 +0100 coresight: fix indentation error in cscfg_remove_owned_csdev_configs() Fix wrong indentation in cscfg_remove_owned_csdev_configs() Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/ Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev") Signed-off-by: Yeoreum Yun Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com commit 7fdd04e15ad79cc2294b9e722d6282357da0b53a Author: Dan Carpenter Date: Wed Jul 16 14:38:30 2025 -0500 coresight: tnoc: Fix a NULL vs IS_ERR() bug in probe The devm_ioremap_resource() function returns error pointers on error. It never returns NULL. Update the error checking to match. Fixes: e54a52a28a36 ("coresight: add coresight Trace Network On Chip driver") Signed-off-by: Dan Carpenter Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/7bd9fae8-a15f-412a-8800-ce47acf0b5ce@sabinyo.mountain commit c91d38b57f2c4784d885c874b2a1234a01361afd Author: Dave Chinner Date: Thu Sep 18 08:12:54 2025 +1000 xfs: rework datasync tracking and execution Jan Kara reported that the shared ILOCK held across the journal flush during fdatasync operations slows down O_DSYNC DIO on unwritten extents significantly. The underlying issue is that unwritten extent conversion needs the ILOCK exclusive, whilst the datasync operation after the extent conversion holds it shared. Hence we cannot be flushing the journal for one IO completion whilst at the same time doing unwritten extent conversion on another IO completion on the same inode. This means that IO completions lock-step, and IO performance is dependent on the journal flush latency. Jan demonstrated that reducing the ifdatasync lock hold time can improve O_DSYNC DIO to unwritten extents performance by 2.5x. Discussion on that patch found issues with the method, and we came to the conclusion that separately tracking datasync flush sequences was the best approach to solving the problem. The fsync code uses the ILOCK to serialise against concurrent modifications in the transaction commit phase. In a transaction commit, there are several disjoint updates to inode log item state that need to be considered atomically by the fsync code. These operations are all done under ILOCK_EXCL context: 1. ili_fsync_flags is updated in ->iop_precommit 2. i_pincount is updated in ->iop_pin before it is added to the CIL 3. ili_commit_seq is updated in ->iop_committing, after it has been added to the CIL In fsync, we need to: 1. check that the inode is dirty in the journal (ipincount) 2. check that ili_fsync_flags is set 3. grab the ili_commit_seq if a journal flush is needed 4. clear the ili_fsync_flags to ensure that new modifications that require fsync are tracked in ->iop_precommit correctly The serialisation of ipincount/ili_commit_seq is needed to ensure that we don't try to unnecessarily flush the journal. The serialisation of ili_fsync_flags being set in ->iop_precommit and cleared in fsync post journal flush is required for correctness. Hence holding the ILOCK_SHARED in xfs_file_fsync() performs all this serialisation for us. Ideally, we want to remove the need to hold the ILOCK_SHARED in xfs_file_fsync() for best performance. We start with the observation that fsync/fdatasync() only need to wait for operations that have been completed. Hence operations that are still being committed have not completed and datasync operations do not need to wait for them. This means we can use a single point in time in the commit process to signal "this modification is complete". This is what ->iop_committing is supposed to provide - it is the point at which the object is unlocked after the modification has been recorded in the CIL. Hence we could use ili_commit_seq to determine if we should flush the journal. In theory, we can already do this. However, in practice this will expose an internal global CIL lock to the IO path. The ipincount() checks optimise away the need to take this lock - if the inode is not pinned, then it is not in the CIL and we don't need to check if a journal flush at ili_commit_seq needs to be performed. The reason this is needed is that the ili_commit_seq is never cleared. Once it is set, it remains set even once the journal has been committed and the object has been unpinned. Hence we have to look that journal internal commit sequence state to determine if ili_commit_seq needs to be acted on or not. We can solve this by clearing ili_commit_seq when the inode is unpinned. If we clear it atomically with the last unpin going away, then we are guaranteed that new modifications will order correctly as they add a new pin counts and we won't clear a sequence number for an active modification in the CIL. Further, we can then allow the per-transaction flag state to propagate into ->iop_committing (instead of clearing it in ->iop_precommit) and that will allow us to determine if the modification needs a full fsync or just a datasync, and so we can record a separate datasync sequence number (Jan's idea!) and then use that in the fdatasync path instead of the full fsync sequence number. With this infrastructure in place, we no longer need the ILOCK_SHARED in the fsync path. All serialisation is done against the commit sequence numbers - if the sequence number is set, then we have to flush the journal. If it is not set, then we have nothing to do. This greatly simplifies the fsync implementation.... Signed-off-by: Dave Chinner Tested-by: Jan Kara Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit bc7d684fea18cc48c3630d2b7f1789000ff2df5b Author: Dave Chinner Date: Thu Sep 18 08:12:53 2025 +1000 xfs: rearrange code in xfs_inode_item_precommit There are similar extsize checks and updates done inside and outside the inode item lock, which could all be done under a single top level logic branch outside the ili_lock. The COW extsize fixup can potentially miss updating the XFS_ILOG_CORE in ili_fsync_fields, so moving this code up above the ili_fsync_fields update could also be considered a fix. Further, to make the next change a bit cleaner, move where we calculate the on-disk flag mask to after we attach the cluster buffer to the the inode log item. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 55dcfdf8af9c38cce6f5b2058d3b58dde25e5020 Author: Heinz Mauelshagen Date: Thu Sep 18 15:48:40 2025 +0200 dm raid: use proper md_ro_state enumerators The dm-raid code was using hardcoded integer values to represent the read-only/read-write state of RAID arrays instead of the proper enumeration constants defined in the md_ro_state enumerator type. Changes: - Replace hardcoded integers with the appropriate md_ro_state enumerator values - Add the missing MD_RDONLY setting in the post_suspend function (no failures have been attributed to this inconsistency, the fix ensures correct state transitions for completeness) This improves code clarity and maintainability by using the defined enumeration constants rather than magic numbers, ensuring the code properly conforms to the established API interface. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mikulas Patocka commit 1cd83fb79083a2431f513956afca92b690ef11ad Author: Mikulas Patocka Date: Wed Sep 17 17:52:09 2025 +0200 dm-integrity: prefer synchronous hash interface The previous patch preferred async interface for the purpose of testing. However, the synchronous interface is faster, so it should be preferred. Signed-off-by: Mikulas Patocka commit 5076d4599ce1702ab3615c7600504ba68df02168 Author: Mikulas Patocka Date: Wed Sep 17 17:51:56 2025 +0200 dm-integrity: enable asynchronous hash interface This commit enables the asynchronous hash interface in dm-integrity. Signed-off-by: Mikulas Patocka commit e8a052ee1fb570b8e07f05f65752646eaac74355 Author: Mikulas Patocka Date: Wed Sep 17 17:51:36 2025 +0200 dm-integrity: rename internal_hash Rename "internal_hash" to "internal_shash" and introduce a boolean value "internal_hash". Signed-off-by: Mikulas Patocka commit e3de0a36409011cb630571cfe7c9e0f5394988b6 Author: Mikulas Patocka Date: Wed Sep 17 17:51:20 2025 +0200 dm-integrity: add the "offset" argument Make sure that the "data" argument passed to integrity_sector_checksum is always page-aligned and add an "offset" argument that specifies the offset from the start of the page. This will enable us to use the asynchronous hash interface later. Signed-off-by: Mikulas Patocka commit e7151e225c043106c745b7eeb1370255ac8eb048 Author: Mikulas Patocka Date: Wed Sep 17 17:49:59 2025 +0200 dm-integrity: allocate the recalculate buffer with kmalloc Allocate the recalculate buffer with kmalloc rather than vmalloc. This will be needed later, for the simplification of the asynchronous hash interface. Signed-off-by: Mikulas Patocka commit fc3e44e4925ab4ab2e1c9d2f8ebb1e4c1594dc34 Merge: cbcd30ae37a9aa 561285d048053f Author: Greg Kroah-Hartman Date: Tue Sep 23 14:15:25 2025 +0200 Merge tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features and cleanup for 6.18 New device support ================== ad,ade9000 - New driver for this complex energy and power monitoring ADC. infineon,tlv493d - New driver for this 3D magnetic sensor. intel,dollar - New driver for this TI PMIC (part number unknown) marvel,88pm886 - Driver for this PMIC ADC. microchip,mcp9600 - Add explicit support for the mcp9601 which has some additional features over the mcp9600. rohm,bd79112 - New driver for this ADC / GPIO Chip. Features ======== Core - New helper to multiply data expressed in IIO types. - Add KUnit tests. - New IIO_ALTCURRENT type, similar to existing IIO_ALTVOLTAGE - Add some channel modifiers related to energy and power, such as reactive. adi,ad7124 - Support external clocks sources and output of the internal clocks. - Filter control. adi,ad7173 - Add filter support. Some fiddly interactions with other parameters on this device. adi,ad7779 - Add backend support which required control of the number of lanes used. liteon,ltr390 - Add runtime PM support. microchip,mcp9600 - Add support for different thermocouple types. Cleanup and minor fixes ======================= core - Switch info_mask fields to be unsigned. Not clear why they were ever signed. - Fix handling of negative channel scale in iio_convert_raw_to_processed() - Fix offset handling for channels without a scale attribute. - Improve the precision of scaling slightly. - Drop apparent handling of IIO_CHAN_INFO_PROCESSED for devices that don't have any such channels. various - Drop many pm_runtime_mark_last_busy() calls now pm_runtime_put_autosuspend() calls it internally. - Drop dev_err_probe() calls where the error code is hard coded as -ENOMEM as they don't do anything. - Drop dev_err() calls where the error code is -ENOMEM. This will reduce error prints, but memory failures generate a lot of messages anyway so unlikely we need these prints. current-sense-amplifier - Add #io-channels property this channel to be used by a consumer driver. adi,ad7124 - Fix incorrect clocks dt-binding property. - Make the mclk clock optional in DT - this is internal to the ADC so should never have been in he binding. - Fix up sample rate to comply with ABI. - Use read_avail() callback rather than opencoding similar. - Deploy guard() to clean up some lock handling. adi,ad7768 - Use devm_regulator_get_enable_read_voltage() to replace similar code. adi,ad7816 - Drop an unnecessary dev_set_drvdata() call as nothing uses the data. ad,adxl345 - Fix missing blank line before bullet list in documentation. arm,scmi - Use devm_kcalloc() for an array allocation rather than devm_kzalloc(). bosch,bmi270 - Match an ACPI ID seen in the wild. It is not spec compliant but we can't do much about that. bosch,bmp280 - Drop overly noisy dev_info() - Allow for sleeping gpio controllers. gogle,cros-ec - Drop unused location attribute that has been replaced by label. invense,icm42600 - Simplify the power management. - Use guard() to simplify some locking. maxim,max1238 - Add io-channel-cells property to dt-binding as there is an in tree consumer. microchip,mcp9600 - Specify a default value in dt-binding for the thermocouple type - General whitespace cleanup. samsung,exynos - Drop support for the S3C2410 including bindings, and touchscreen support as nothing else uses that. - Drop platform ID based binding as not used. st,vl53l0x - Fix returning the wrong variable in an error path. ti,pac1934 - Replace open coded devm_mutex_init(). xilinx,ams - Update maintainers entry. * tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (178 commits) MAINTAINERS: Support ROHM BD79112 ADC iio: adc: Support ROHM BD79112 ADC/GPIO dt-bindings: iio: adc: ROHM BD79112 ADC/GPIO iio: pressure: bmp280: Use gpiod_set_value_cansleep() iio: pressure: bmp280: Remove noisy dev_info() iio: ABI: add filter types for ad7173 iio: adc: ad7173: support changing filter type iio: adc: ad7173: rename odr field iio: adc: ad7173: rename ad7173_chan_spec_ext_info iio: adc: Add driver for Marvell 88PM886 PMIC ADC dt-bindings: mfd: 88pm886: Add #io-channel-cells iio: ABI: document "sinc4+rej60" filter_type iio: adc: ad7124: add filter support iio: adc: ad7124: support fractional sampling_frequency iio: adc: ad7124: use guard(mutex) to simplify return paths iio: adc: ad7124: use read_avail() for scale_available iio: adc: ad7124: use clamp() iio: adc: ad7124: fix sample rate for multi-channel use Documentation: ABI: iio: add sinc4+lp docs: iio: add documentation for ade9000 driver ... commit cbcd30ae37a9aa9c03607f597e7fdea3a6ebd816 Merge: eafedbc7c050c4 bcdf7a064c3c73 Author: Greg Kroah-Hartman Date: Tue Sep 23 14:11:59 2025 +0200 Merge tag 'icc-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.18 This pull request contains the interconnect changes for the 6.18-rc1 merge window. It contains new driver and a minor core cleanup. Core change: - Use device_match_of_node() instead of open coding it Driver changes: - Add new driver for the Qualcomm Glymur SoC - Enable OSM L3 support for the QCS615 SoC Signed-off-by: Georgi Djakov * tag 'icc-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: dt-bindings: interconnect: Add OSM L3 compatible for QCS615 SoC interconnect: core: Use device_match_of_node() interconnect: qcom: add glymur interconnect provider driver interconnect: qcom: icc-rpmh: increase MAX_PORTS to support four QoS ports dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Glymur SoC commit 0c4932f6ddf815618fa34f7403df682aed7862b5 Author: LiangCheng Wang Date: Mon Sep 22 10:57:34 2025 +0800 drm/tiny: pixpaper: Fix missing dependency on DRM_GEM_SHMEM_HELPER The driver uses drm_gem_shmem_prime_import_no_map() and drm_gem_shmem_dumb_create(), but the Kconfig currently selects DRM_GEM_DMA_HELPER instead of DRM_GEM_SHMEM_HELPER. This causes link failures when DRM_GEM_SHMEM_HELPER is not enabled. Select DRM_GEM_SHMEM_HELPER to fix the build. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509220320.gfFZjmyg-lkp@intel.com/ Fixes: c9e70639f591 ("drm: tiny: Add support for Mayqueen Pixpaper e-ink panel") Reviewed-by: Thomas Zimmermann Signed-off-by: LiangCheng Wang Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250922-bar-v1-1-b2a1f54ace82@gmail.com commit 5d726c4dbeeddef612e6bed27edd29733f4d13af Author: Yu Kuai Date: Tue Sep 23 15:55:20 2025 +0800 blk-cgroup: fix possible deadlock while configuring policy Following deadlock can be triggered easily by lockdep: WARNING: possible circular locking dependency detected 6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted ------------------------------------------------------ check/1334 is trying to acquire lock: ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180 but task is already holding lock: ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}: blk_queue_enter+0x40b/0x470 blkg_conf_prep+0x7b/0x3c0 tg_set_limit+0x10a/0x3e0 cgroup_file_write+0xc6/0x420 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&q->rq_qos_mutex){+.+.}-{4:4}: __mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 wbt_init+0x17e/0x280 wbt_enable_default+0xe9/0x140 blk_register_queue+0x1da/0x2e0 __add_disk+0x38c/0x5d0 add_disk_fwnode+0x89/0x250 device_add_disk+0x18/0x30 virtblk_probe+0x13a3/0x1800 virtio_dev_probe+0x389/0x610 really_probe+0x136/0x620 __driver_probe_device+0xb3/0x230 driver_probe_device+0x2f/0xe0 __driver_attach+0x158/0x250 bus_for_each_dev+0xa9/0x130 driver_attach+0x26/0x40 bus_add_driver+0x178/0x3d0 driver_register+0x7d/0x1c0 __register_virtio_driver+0x2c/0x60 virtio_blk_init+0x6f/0xe0 do_one_initcall+0x94/0x540 kernel_init_freeable+0x56a/0x7b0 kernel_init+0x2b/0x270 ret_from_fork+0x268/0x4c0 ret_from_fork_asm+0x1a/0x30 -> #0 (&q->sysfs_lock){+.+.}-{4:4}: __lock_acquire+0x1835/0x2940 lock_acquire+0xf9/0x450 __mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 blk_unregister_queue+0x53/0x180 __del_gendisk+0x226/0x690 del_gendisk+0xba/0x110 sd_remove+0x49/0xb0 [sd_mod] device_remove+0x87/0xb0 device_release_driver_internal+0x11e/0x230 device_release_driver+0x1a/0x30 bus_remove_device+0x14d/0x220 device_del+0x1e1/0x5a0 __scsi_remove_device+0x1ff/0x2f0 scsi_remove_device+0x37/0x60 sdev_store_delete+0x77/0x100 dev_attr_store+0x1f/0x40 sysfs_kf_write+0x65/0x90 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->q_usage_counter(queue)#3); lock(&q->rq_qos_mutex); lock(&q->q_usage_counter(queue)#3); lock(&q->sysfs_lock); Root cause is that queue_usage_counter is grabbed with rq_qos_mutex held in blkg_conf_prep(), while queue should be freezed before rq_qos_mutex from other context. The blk_queue_enter() from blkg_conf_prep() is used to protect against policy deactivation, which is already protected with blkcg_mutex, hence convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile, consider that blkcg_mutex is held after queue is freezed from policy deactivation, also convert blkg_alloc() to use GFP_NOIO. Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit d3906d8f3cee0279d459dc88b5a871fcdcd4b236 Author: Darrick J. Wong Date: Mon Sep 15 17:26:09 2025 -0700 fuse: enable FUSE_SYNCFS for all fuseblk servers Turn on syncfs for all fuseblk servers so that the ones in the know can flush cached intermediate data and logs to disk. Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 0c617a3f62100ff25c291735ff907a7ca1c084ae Author: Niklas Söderlund Date: Wed Sep 10 16:26:56 2025 +0200 clocksource/drivers/sh_cmt: Split start/stop of clock source and events The CMT do a housekeeping such as dealing with runtime PM and enable/disable clocks when either a clock source is enabled, or when a new clock event is registered. Doing this type of housekeeping for when a clock event is registered is not always possible as it can happen in contexts where holding spinlocks is not possible. However doing it when registering a clock source is possible. As a first step to address this design break apart the CMT start and stop functions. The path for clock sources need not change, while the one for clock events need to be reworked in future work. There is no indented functional change, just breaking the two use-cases controlled by a flag into two distinct functions. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250910142657.1148696-2-niklas.soderlund+renesas@ragnatech.se commit cd32e596f02fc981674573402c1138f616df1728 Author: Zhen Ni Date: Thu Aug 14 20:33:24 2025 +0800 clocksource/drivers/clps711x: Fix resource leaks in error paths The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths. Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error") Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support") Signed-off-by: Zhen Ni Signed-off-by: Daniel Lezcano Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn commit 1c4b87c921fb158d853adcb8fd48c2dc07fc6f91 Author: Markus Schneider-Pargmann Date: Tue Aug 19 09:52:41 2025 +0200 clocksource/drivers/arm_global_timer: Add auto-detection for initial prescaler values am43xx has a clock tree where the global timer clock is an indirect child of the CPU clock used for frequency scaling: dpll_mpu_ck -- CPU/cpufreq | v dpll_mpu_m2_ck -- divider | v mpu_periphclk -- fixed divider by 2 used for global timer When CPU frequency changes, the global timer's clock notifier rejects the change because the hardcoded prescaler (1 or 2) cannot accommodate the frequency range across all CPU OPPs (300, 600, 720, 800, 1000 MHz). Add platform-specific prescaler auto-detection to solve this issue: - am43xx: prescaler = 50 (calculated as initial_freq/GCD of all OPP freqs) This allows the timer to work across all CPU frequencies after the fixed divider by 2. Tested on am4372-idk-evm. - zynq-7000: prescaler = 2 (preserves previous Kconfig default) - Other platforms: prescaler = 1 (previous default) The Kconfig option now defaults to 0 (auto-detection) but can still override the auto-detected value when set to a non-zero value, preserving existing customization workflows. Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Daniel Lezcano Tested-by: Kevin Hilman Tested-by: Patrice Chotard Tested-by: Judith Mendez Reviewed-by: Kevin Hilman Link: https://lore.kernel.org/r/20250819-topic-am43-arm-global-timer-v6-16-v2-1-6d082e2a5161@baylibre.com commit 21b8a635f3b3d6a165fa257808ed381c13c72e9b Author: Brian Masney Date: Sun Aug 10 18:37:10 2025 -0400 clocksource/drivers/ingenic-sysost: Convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. While changes are being made to 'struct clk_ops', let's also go ahead and fix the formatting of set_rate so that everything lines up as expected. Signed-off-by: Brian Masney Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250810-clocksource-round-rate-v1-1-486ef53e45eb@redhat.com commit 764d0654114b5ce52aafabdb2bf9ccee0e998651 Author: Wolfram Sang Date: Wed Aug 13 21:06:58 2025 +0200 clocksource/drivers/timer-tegra186: Don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Signed-off-by: Daniel Lezcano Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250813190657.3628-2-wsa+renesas@sang-engineering.com commit 931bd9273848aca9dc40dd5cad3fcfe5d0818972 Author: Markus Stockhausen Date: Mon Aug 4 04:03:28 2025 -0400 clocksource/drivers/timer-rtl-otto: Simplify documentation While the main SoC PLL is responsible for the lexra bus frequency it has no implications on the the timer divisior. Update the comments accordingly. Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804080328.2609287-5-markus.stockhausen@gmx.de commit c445bffbf28f721e05d0ce06895045fc62aaff7c Author: Markus Stockhausen Date: Mon Aug 4 04:03:27 2025 -0400 clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts During normal operation the timers are reprogrammed including an interrupt acknowledgement. This has no effect as the whole timer is setup from scratch afterwards. Especially in an interrupt this has already been done by rttm_timer_interrupt(). Change the behaviour as follows: - Use rttm_disable_timer() during reprogramming - Keep rttm_stop_timer() for all other use cases. Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de commit 4f5ea5aa0dcdd3c7487fbabad5b86b3cd7d2b8c4 Merge: 8f5ae30d69d754 0a2c70594704b1 Author: Christian Brauner Date: Tue Sep 23 12:37:42 2025 +0200 Merge patch series "vfs: preparatory changes to centralize locking of create/remove/rename" NeilBrown says: This is a re-re-revised selection of cleanups and API renaming which continues my work to centralise locking of create/remove/rename operations. * patches from https://lore.kernel.org/20250922043121.193821-2-neilb@ownmail.net: debugfs: rename start_creating() to debugfs_start_creating() VFS: rename kern_path_locked() and related functions. VFS/audit: introduce kern_path_parent() for audit VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata VFS: discard err2 in filename_create() VFS/ovl: add lookup_one_positive_killable() Signed-off-by: Christian Brauner commit 0a2c70594704b199849e8add59263fc98e057a63 Author: NeilBrown Date: Mon Sep 22 14:29:53 2025 +1000 debugfs: rename start_creating() to debugfs_start_creating() start_creating() is a generic name which I would like to use for a function similar to simple_start_creating(), only not quite so simple. debugfs is using this name which, though static, will cause complaints if then name is given a different signature in a header file. So rename it to debugfs_start_creating(). Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 3d18f80ce181ba27f37d0ec1c550b22acb01dd49 Author: NeilBrown Date: Mon Sep 22 14:29:52 2025 +1000 VFS: rename kern_path_locked() and related functions. kern_path_locked() is now only used to prepare for removing an object from the filesystem (and that is the only credible reason for wanting a positive locked dentry). Thus it corresponds to kern_path_create() and so should have a corresponding name. Unfortunately the name "kern_path_create" is somewhat misleading as it doesn't actually create anything. The recently added simple_start_creating() provides a better pattern I believe. The "start" can be matched with "end" to bracket the creating or removing. So this patch changes names: kern_path_locked -> start_removing_path kern_path_create -> start_creating_path user_path_create -> start_creating_user_path user_path_locked_at -> start_removing_user_path_at done_path_create -> end_creating_path and also introduces end_removing_path() which is identical to end_creating_path(). __start_removing_path (which was __kern_path_locked) is enhanced to call mnt_want_write() for consistency with the start_creating_path(). Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 76a53de6f7ff0641570364234fb4489f4d4fc8e9 Author: NeilBrown Date: Mon Sep 22 14:29:51 2025 +1000 VFS/audit: introduce kern_path_parent() for audit audit_alloc_mark() and audit_get_nd() both need to perform a path lookup getting the parent dentry (which must exist) and the final target (following a LAST_NORM name) which sometimes doesn't need to exist. They don't need the parent to be locked, but use kern_path_locked() or kern_path_locked_negative() anyway. This is somewhat misleading to the casual reader. This patch introduces a more targeted function, kern_path_parent(), which returns not holding locks. On success the "path" will be set to the parent, which must be found, and the return value is the dentry of the target, which might be negative. This will clear the way to rename kern_path_locked() which is otherwise only used to prepare for removing something. It also allows us to remove kern_path_locked_negative(), which is transformed into the new kern_path_parent(). Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit d7fb2c410240348edee7867c29b60688175dcc11 Author: NeilBrown Date: Mon Sep 22 14:29:50 2025 +1000 VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata A rename operation can only rename within a single mount. Callers of vfs_rename() must and do ensure this is the case. So there is no point in having two mnt_idmaps in renamedata as they are always the same. Only one of them is passed to ->rename in any case. This patch replaces both with a single "mnt_idmap" and changes all callers. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit e66ccd30dcdc2053388bd2ec20bd53e9897248d5 Author: NeilBrown Date: Mon Sep 22 14:29:49 2025 +1000 VFS: discard err2 in filename_create() Since 204a575e91f3 "VFS: add common error checks to lookup_one_qstr_excl()" filename_create() does not need to stash the error value from mnt_want_write() into a separate variable - the logic that used to clobber 'error' after the call of mnt_want_write() has migrated into lookup_one_qstr_excl(). So there is no need for two different err variables. This patch discards "err2" and uses "error' throughout. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 17eb98d6b517b6e7faaebed496fd688dbb1771d9 Author: NeilBrown Date: Mon Sep 22 14:29:48 2025 +1000 VFS/ovl: add lookup_one_positive_killable() ovl wants a lookup which won't block on a fatal signal. It currently uses down_write_killable() and then repeatedly calls to lookup_one() The lock may not be needed if the name is already in the dcache and it aids proposed future changes if the locking is kept internal to namei.c So this patch adds lookup_one_positive_killable() which is like lookup_one_positive() but will abort in the face of a fatal signal. overlayfs is changed to use this. Note that instead of always getting an exclusive lock, ovl now only gets a shared lock, and only sometimes. The exclusive lock was never needed. However down_read_killable() was only added in v4.15 but overlayfs started using down_write_killable() here in v4.7. Note that the linked list ->first_maybe_whiteout ->next_maybe_white is local to the thread so there is no concurrency in that list which could be threatened by removing the locking. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit ca90147e55a78441794aef5cb4a8d1cf8d0e209f Author: Markus Stockhausen Date: Mon Aug 4 04:03:26 2025 -0400 clocksource/drivers/timer-rtl-otto: Drop set_counter function The current counter value is a read only register. It will be reset when writing a new target timer value with rttm_set_period(). rttm_set_counter() is essentially a noop. Drop it. While this makes rttm_start_timer() and rttm_enable_timer() the same functions keep both to make the established abstraction layers for register and control functions active. Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-3-markus.stockhausen@gmx.de commit e7a25106335041aeca4fdf50a84804c90142c886 Author: Markus Stockhausen Date: Mon Aug 4 04:03:25 2025 -0400 clocksource/drivers/timer-rtl-otto: Work around dying timers The OpenWrt distribution has switched from kernel longterm 6.6 to 6.12. Reports show that devices with the Realtek Otto switch platform die during operation and are rebooted by the watchdog. Sorting out other possible reasons the Otto timer is to blame. The platform currently consists of 4 targets with different hardware revisions. It is not 100% clear which devices and revisions are affected. Analysis shows: A more aggressive sched/deadline handling leads to more timer starts with small intervals. This increases the bug chances. See https://marc.info/?l=linux-kernel&m=175276556023276&w=2 Focusing on the real issue a hardware limitation on some devices was found. There is a minimal chance that a timer ends without firing an interrupt if it is reprogrammed within the 5us before its expiration time. Work around this issue by introducing a bounce() function. It restarts the timer directly before the normal restart functions as follows: - Stop timer - Restart timer with a slow frequency. - Target time will be >5us - The subsequent normal restart is outside the critical window Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de commit 0494fc345b377d1207c2cbfef67dc51f6ec874c0 Author: Gokul Praveen Date: Tue Aug 12 16:23:46 2025 +0530 clocksource/drivers/timer-ti-dm : Capture functionality for OMAP DM timer Add PWM capture function in DM timer driver. OMAP DM timer hardware supports capture feature.It can be used to timestamp events (falling/rising edges) detected on input signal. Signed-off-by: Gokul Praveen Signed-off-by: Daniel Lezcano Reviewed-by: Neha Malcom Francis Link: https://lore.kernel.org/r/20250812105346.203541-1-g-praveen@ti.com commit 4e9bfe6969a768ef40c669fd100c9be70fb78a1f Author: Marc Zyngier Date: Thu Aug 14 16:46:22 2025 +0100 clocksource/drivers/arm_arch_timer_mmio: Add MMIO clocksource The MMIO driver can also double as a clocksource, something that was missing in its previous incarnation. Add it for completeness. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-5-maz@kernel.org commit 0f67b56d84b4c49adfd61f19f81f84ec613ab51a Author: Marc Zyngier Date: Thu Aug 14 16:46:21 2025 +0100 clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver Remove all the MMIO support from the per-CPU timer driver, and switch over to the standalove driver. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-4-maz@kernel.org commit 4891f01527bbbb0cf0e515c803ade67a17e247bb Author: Marc Zyngier Date: Thu Aug 14 16:46:20 2025 +0100 clocksource/drivers/arm_arch_timer: Add standalone MMIO driver Add a new driver for the MMIO side of the ARM architected timer. Most of it has been lifted from the existing arch timer code, massaged, and finally rewritten. It supports both DT and ACPI as firmware descriptions. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-3-maz@kernel.org commit 5669d92f3efa449c3906cbf15e676768a8f4d502 Author: Marc Zyngier Date: Thu Aug 14 16:46:19 2025 +0100 ACPI: GTDT: Generate platform devices for MMIO timers In preparation for the MMIO timer support code becoming an actual driver, mimic what is done for the SBSA watchdog and expose a synthetic device for each MMIO timer block. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250807160243.1970533-2-maz@kernel.org commit bee33f22d7c30626e711b4900e3f460b6e0e104f Author: Daniel Lezcano Date: Mon Aug 4 17:23:38 2025 +0200 clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support The previous changes put in place the encapsulation of the code in order to allow multiple instances of the driver. The S32G platform has two Periodic Interrupt Timer (PIT). The IP is exactly the same as the VF platform. Each PIT has four channels which are 32 bits wide and counting down. The two first channels can be chained to implement a 64 bits counter. The channel usage is kept unchanged with the original driver, channel 2 is used as a clocksource, channel 3 is used as a clockevent. Other channels are unused. In order to support the S32G platform which has two PIT, we initialize the timer and bind it to a CPU. The S32G platforms can have 2, 4 or 8 CPUs and this kind of configuration can appear unusual as we may endup with two PIT used as a clockevent for the two first CPUs while the other CPUs use the architected timers. However, in the context of the automotive, the platform can be partioned to assign 2 CPUs for Linux and the others CPUs to third party OS. The PIT is then used with their specifities like the ability to freeze the time which is needed for instance for debugging purpose. The setup found for this platform is each timer instance is bound to CPU0 and CPU1. A counter is incremented when a timer is successfully initialized and assigned to a CPU. This counter is used as an index for the CPU number and to detect when we reach the maximum possible instances for the platform. That in turn triggers the CPU hotplug callbacks to achieve the per CPU setup. It is the exact same mechanism found in the NXP STM driver. If the timers must be bound to different CPUs, it would require an additionnal mechanism which is not part of these changes. Tested on a s32g274a-rdb2. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-21-daniel.lezcano@linaro.org commit adaf5b248ff38f98ea1b3696b9a793db270f8c3e Author: Daniel Lezcano Date: Mon Aug 4 17:23:37 2025 +0200 dt: bindings: fsl,vf610-pit: Add compatible for s32g2 and s32g3 The Vybrid Family is a NXP (formerly Freescale) platform having a Programmable Interrupt Timer (PIT). This timer is an IP found also on the NXP Automotive platform S32G2 and S32G3. Add the compatible for those platforms to describe the timer. Signed-off-by: Daniel Lezcano Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804152344.1109310-20-daniel.lezcano@linaro.org commit fc346a155fe910a1cf4639b00b131f9a10284bdd Author: Daniel Lezcano Date: Mon Aug 4 17:23:36 2025 +0200 clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT The PIT acronym stands for Periodic Interrupt Timer which is found on different NXP platforms not only on the Vybrid Family. Change the name to be more generic for the NXP platforms in general. That will be consistent with the NXP STM driver naming convention. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-19-daniel.lezcano@linaro.org commit 3c34321e9b5965fdbf51fd407a35322a64c9e9c6 Author: Daniel Lezcano Date: Mon Aug 4 17:23:35 2025 +0200 clocksource/drivers/vf-pit: Unify the function name for irq ack Most the function are under the form pit_timer_*, let's change the interrupt acknowledgment function name to have the same format. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-18-daniel.lezcano@linaro.org commit 5ba405c719ce68a86308dd3bd90aeea59959030d Author: Daniel Lezcano Date: Mon Aug 4 17:23:34 2025 +0200 clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable The difference between the pit_clocksource_enable() and pit_clocksource_disable() is only setting the TIF flag for the clockevent. Let's group them and pass the TIF flag parameter to the function so we save some lines of code. But as the base address is different regarding if it is a clocksource or a clockevent, we pass the base address in parameter instead of the struct pit_timer. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-17-daniel.lezcano@linaro.org commit 46e83e4afc05c87b5edc2b0b4765283f101af0c6 Author: Daniel Lezcano Date: Mon Aug 4 17:23:33 2025 +0200 clocksource/drivers/vf-pit: Encapsulate set counter function Encapsulate the writel() calls to set the counter into a self-explainatory function. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-16-daniel.lezcano@linaro.org commit 13cea8527c95e1359191347abe5d94cccc47a311 Author: Daniel Lezcano Date: Mon Aug 4 17:23:32 2025 +0200 clocksource/drivers/vf-pit: Enable and disable module on error Encapsulate the calls to writel to enable and disable the PIT module and make use of them. Add the missing module disablement in case of error. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-15-daniel.lezcano@linaro.org commit fcf25b4427c7d1edb91dd02753d6153fb25da094 Author: Daniel Lezcano Date: Mon Aug 4 17:23:31 2025 +0200 clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable For the sake of lisibility, let's encapsulate the writel calls to enable and disable the timer into a function with a self-explainatory name. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-14-daniel.lezcano@linaro.org commit ad1423922781e6552f18d055a5742b1cff018cdc Author: Amir Goldstein Date: Wed Aug 27 19:55:26 2025 +0200 ovl: make sure that ovl_create_real() returns a hashed dentry e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity check of !d_unhashed(child) to try to verify that child dentry was not unlinked while parent dir was unlocked. This "was not unlink" check has a false positive result in the case of casefolded parent dir, because in that case, ovl_create_temp() returns an unhashed dentry after ovl_create_real() gets an unhashed dentry from ovl_lookup_upper() and makes it positive. To avoid returning unhashed dentry from ovl_create_temp(), let ovl_create_real() lookup again after making the newdentry positive, so it always returns a hashed positive dentry (or an error). This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout() after ovl_create_temp() and allows mount of overlayfs with casefolding enabled layers. Reported-by: André Almeida Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@igalia.com/ Suggested-by: Neil Brown Reviewed-by: Neil Brown Signed-off-by: Amir Goldstein commit 16754d61dc69cb4550225a967a2639809226de42 Author: André Almeida Date: Thu Aug 14 14:22:20 2025 -0300 ovl: Support mounting case-insensitive enabled layers Drop the restriction for casefold dentries lookup to enable support for case-insensitive layers in overlayfs. Support case-insensitive layers with the condition that they should be uniformly enabled across the stack and (i.e. if the root mount dir has casefold enabled, so should all the dirs bellow for every layer). Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit dfc7da402ccc92d6e4b01a4778a3f15f2496b9af Author: André Almeida Date: Thu Aug 14 14:22:19 2025 -0300 ovl: Check for casefold consistency when creating new dentries In a overlayfs with casefold enabled, all new dentries should have casefold enabled as well. Check this at ovl_create_real(). Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit f9377faaeae0473ea45f2b6d3ff758e192f3f01d Author: André Almeida Date: Thu Aug 14 14:22:18 2025 -0300 ovl: Add S_CASEFOLD as part of the inode flag to be copied To keep ovl's inodes consistent with their real inodes, create a new mask for inode file attributes that needs to be copied. Add the S_CASEFOLD flag as part of the flags that need to be copied along with the other file attributes. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 8a78f189756ac3bc8c1c326994ad7261885227bb Author: André Almeida Date: Thu Aug 14 14:22:17 2025 -0300 ovl: Set case-insensitive dentry operations for ovl sb For filesystems with encoding (i.e. with case-insensitive support), set the dentry operations for the super block as ovl_dentry_ci_operations. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 1f7168b28f667c0920fd83151ae35ce593950663 Author: André Almeida Date: Thu Aug 14 14:22:16 2025 -0300 ovl: Ensure that all layers have the same encoding When merging layers from different filesystems with casefold enabled, all layers should use the same encoding version and have the same flags to avoid any kind of incompatibility issues. Also, set the encoding and the encoding flags for the ovl super block as the same as used by the first valid layer. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit ee95c5fc86ddd10c354da554442582a2d12a1b90 Author: André Almeida Date: Fri Aug 22 11:17:07 2025 -0300 ovl: Create ovl_casefold() to support casefolded strncmp() To add overlayfs support casefold layers, create a new function ovl_casefold(), to be able to do case-insensitive strncmp(). ovl_casefold() allocates a new buffer and stores the casefolded version of the string on it. If the allocation or the casefold operation fails, fallback to use the original string. The case-insentive name is then used in the rb-tree search/insertion operation. If the name is found in the rb-tree, the name can be discarded and the buffer is freed. If the name isn't found, it's then stored at struct ovl_cache_entry to be used later. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 5fbf73c7f13ddd5d30dde6760955e644ceffe2ee Author: André Almeida Date: Thu Aug 14 14:22:14 2025 -0300 ovl: Prepare for mounting case-insensitive enabled layers Prepare for mounting layers with case-insensitive dentries in order to supporting such layers in overlayfs, while enforcing uniform casefold layers. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 7201c95c258936e32c950f447c59875780046848 Author: Daniel Lezcano Date: Mon Aug 4 17:23:30 2025 +0200 clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names In order to differentiate from userspace the pit timer given the device tree, let's use the node name for the interrupt and the timer names. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-13-daniel.lezcano@linaro.org commit d8629b9b2c17a458ca504b10b604b8cfe95df3ab Author: Daniel Lezcano Date: Mon Aug 4 17:23:29 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro Pass the channel and the base address to the PITLCVAL macro so it is possible to use multiple instances of the timer with the macro. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-12-daniel.lezcano@linaro.org commit 1ba63930e72356315e1a664952f52ee340edbbd3 Author: Daniel Lezcano Date: Mon Aug 4 17:23:28 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the macros Pass the base address to the macro, so we can use the macro with multiple instances of the timer because we deal with different base address. At the same time, change writes to the register to the existing corresponding functions. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-11-daniel.lezcano@linaro.org commit c106b698ab8d1899d62de880d73dd99edb319849 Author: Daniel Lezcano Date: Mon Aug 4 17:23:27 2025 +0200 clocksource/drivers/vf-pit: Register the clocksource from the driver The function clocksource_mmio_init() uses its own global static clocksource variable making no possible to have several instances of a clocksource using this function. In order to support that, let's add the clocksource structure to the pit structure and use the clocksource_register_hz() function instead. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-10-daniel.lezcano@linaro.org commit 0c063c9afc1b5243adde544637e273c1ac0a31d9 Author: Daniel Lezcano Date: Mon Aug 4 17:23:26 2025 +0200 clocksource/drivers/vf-pit: Convert raw values to BIT macros Use the BIT macros instead of the shifting syntax. No functional change intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-9-daniel.lezcano@linaro.org commit 375fbfc66ca23873c3d9b1c5f6739bf0e2875a57 Author: Daniel Lezcano Date: Mon Aug 4 17:23:25 2025 +0200 clocksource/drivers/vf-pit: Allocate the struct timer at init time Instead of having a static global structure for a timer, let's allocate it dynamically so we can create multiple instances in the future to support multiple timers. At the same time, add the rollbacking code in case of error. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-8-daniel.lezcano@linaro.org commit 23253e278a4574114d4c2729ed70f70b4ec7a30e Author: André Almeida Date: Thu Aug 14 14:22:13 2025 -0300 fs: Create sb_same_encoding() helper For cases where a file lookup can look in different filesystems (like in overlayfs), both super blocks must have the same encoding and the same flags. To help with that, create a sb_same_encoding() function. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 8b0795e0fc0cf181ecab59d3a9a1618886ea995b Author: Daniel Lezcano Date: Mon Aug 4 17:23:24 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy Move the cycles_per_jiffy initialization to the same place where the other pit timer fields are initialized. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-7-daniel.lezcano@linaro.org commit 9095d207417477eb50e84fd0652895db77ec584e Author: André Almeida Date: Thu Aug 14 14:22:12 2025 -0300 fs: Create sb_encoding() helper Filesystems that need to deal with the super block encoding need to use a if IS_ENABLED(CONFIG_UNICODE) around it because this struct member is not declared otherwise. In order to move this if/endif guards outside of the filesytem code and make it simpler, create a new function that returns the s_encoding member of struct super_block if Unicode is enabled, and return NULL otherwise. Suggested-by: Amir Goldstein Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 995ebf16043392d131bd22ed8484c9c952bfb45f Author: Daniel Lezcano Date: Mon Aug 4 17:23:23 2025 +0200 clocksource/drivers/vf-pit: Pass the cpu number as parameter In order to initialize the timer with a cpumask tied to a cpu, let's pass it as a parameter instead of hardwiring it in the init function. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-6-daniel.lezcano@linaro.org commit 361580317976ff25ce4eddbf207d06b0aca9ab22 Author: Daniel Lezcano Date: Mon Aug 4 17:23:22 2025 +0200 clocksource/drivers/vf-pit: Rework the base address usage This change passes the base address to the clockevent and clocksource initialization functions in order to use different base address in the next changes. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-5-daniel.lezcano@linaro.org commit 3996232e6e7e34a1f783c778f6c7075293912365 Author: Daniel Lezcano Date: Mon Aug 4 17:23:21 2025 +0200 clocksource/drivers/vf-pit: Set the scene for multiple timers The driver is implemented as using a single timer and a single clocksource. In order to take advantage of the multiple timers supported in the PIT hardware and introduce different setup for a new platform, let's encapsulate the data into a structure and pass this structure around in the function parameter. The structure will be a per timer instansiation in the next changes. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-4-daniel.lezcano@linaro.org commit 2decd0b63eb0a6773e9a5541300cd92e469f541b Author: Daniel Lezcano Date: Mon Aug 4 17:23:20 2025 +0200 clocksource/drivers/vf-pit: Add COMPILE_TEST option The VF PIT driver is a silent koption. In order to allow a better compilation test coverage, let's add the COMPILE_TEST option so it can be selected on other platforms than the Vybrid Family. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-3-daniel.lezcano@linaro.org commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c Author: Daniel Lezcano Date: Mon Aug 4 17:23:19 2025 +0200 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel The driver uses the raw_readl() and raw_writel() functions. Those are not for MMIO devices. Replace them with readl() and writel() [ dlezcano: Fixed typo in the subject s/reald/readl/ ] Signed-off-by: Daniel Lezcano Acked-by: Arnd Bergmann Cc: Arnd Bergmann Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org commit 0d375a1385ed80d8c84433fb54062a9253ccf7e5 Author: Darrick J. Wong Date: Mon Sep 15 17:24:48 2025 -0700 fuse: capture the unique id of fuse commands being sent The fuse_request_{send,end} tracepoints capture the value of req->in.h.unique in the trace output. It would be really nice if we could use this to match a request to its response for debugging and latency analysis, but the call to trace_fuse_request_send occurs before the unique id has been set: fuse_request_send: connection 8388608 req 0 opcode 1 (FUSE_LOOKUP) len 107 fuse_request_end: connection 8388608 req 6 len 16 error -2 (Notice that req moves from 0 to 6) Move the callsites to trace_fuse_request_send to after the unique id has been set by introducing a helper to do that for standard fuse_req requests. FUSE_FORGET requests are not covered by this because they appear to be synthesized into the event stream without a fuse_req object and are never replied to. Requests that are aborted without ever having been submitted to the fuse server retain the behavior that only the fuse_request_end tracepoint shows up in the trace record, and with req==0. Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 Author: Darrick J. Wong Date: Mon Sep 15 17:24:17 2025 -0700 fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are waiting for responses from itself: # cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that: "By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion). Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously. Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands. Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why. Cc: stable@vger.kernel.org # v2.6.38 Fixes: 5a18ec176c934c ("fuse: fix hang of single threaded fuseblk filesystem") Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit df1526752e0cd8db11b1fd4c1be3bd47409fd3ac Merge: 6e2f1484b94435 a612dbe8d04d47 Author: Paolo Abeni Date: Tue Sep 23 11:13:24 2025 +0200 Merge branch 'dibs-direct-internal-buffer-sharing' Alexandra Winter says: ==================== dibs - Direct Internal Buffer Sharing This series introduces a generic abstraction of existing components like: - the s390 specific ISM device (Internal Shared Memory), - the SMC-D loopback mechanism (Shared Memory Communication - Direct) - the client interface of the SMC-D module to the transport devices This generic shim layer can be extended with more devices, more clients and more features in the future. This layer is called 'dibs' for Direct Internal Buffer Sharing based on the common scheme that these mechanisms enable controlled sharing of memory buffers within some containing entity such as a hypervisor or a Linux instance. Benefits: - Cleaner separation of ISM and SMC-D functionality - simpler and less module dependencies - Clear interface definition. - Extendable for future devices and clients. An overview was given at the Netdev 0x19 conference, recordings and slides are available [1]. Background / Status quo: ------------------------ Currently s390 hardware provides virtual PCI ISM devices (Internal Shared Memory). Their driver is in drivers/s390/net/ism_drv.c. The main user is SMC-D (net/smc). The ism driver offers a client interface so other users/protocols can also use them, but it is still heavily intermingled with the smc code. Namely, the ism module cannot be used without the smc module, which feels artificial. There is ongoing work to extend the ISM concept of shared buffers that can be accessed directly by another instance on the same hardware: [2] proposed a loopback interface (ism_lo), that can be used on non-s390 architectures (e.g. between containers or to test SMC-D). A minimal implementation went upstream with [3]: ism_lo currently is a part of the smc protocol and rather hidden. [4] proposed a virtio definition of ism (ism_virtio) that can be used between kvm guests. We will shortly send an RFC for an dibs client that uses dibs as transport for TTY. Concept: -------- Create a shim layer in net/dibs that contains common definitions and code for all dibs devices and all dibs clients. Any device or client module only needs to depend on this dibs layer module and any device or client code only needs to include the definitions in include/linux/dibs.h. The name dibs was chosen to clearly distinguish it from the existing s390 ism devices. And to emphasize that it is not about sharing whole memory regions with anybody, but dedicating single buffers for another system. Implementation: --------------- The end result of this series is: A dibs shim layer with - One dibs client: smc-d - Two dibs device drivers: ism and dibs-loopback - Everything prepared to add more clients and more device drivers. Patches 1-2 contain some issues that were found along the way. They make sense on their own, but also enable a better structured dibs series. There are three components that exist today: a) smc module (especially SMC-D functionality, which is an ism client today) b) ism device driver (supports multiple ism clients today) c) smc-loopback (integrated with smc today) In order to preserve existing functionality at each step, these are not moved to dibs layer by component, instead: - the dibs layer is established in parallel to existing code [patches 3-6] - then some service functions are moved to the dibs layer [patches 7-12] - the actual data movement is moved to the dibs layer [patch 13] - and last event handling is moved to the dibs layer [patch 14] Future: ------- Items that are not part of this patchset but can be added later: - dynamically add or remove dibs_loopback. That will be allow for simple testing of add_dev()/del_dev() - handle_irq(): Call clients without interrupt context. e.g using threaded interrupts. I left this for a follow-on, because it includes conceptual changes for the smcd receive code. - Any improvements of locking scopes. I mainly moved some of the the existing locks to dibs layer. I have the feeling there is room for improvements. - The device drivers should not loop through the client array - dibs_dev_op.*_dmb() functions reveal unnecessary details of the internal dmb struct to the clients - Check whether client calls to dibs_dev_ops should be replaced by interface functions that provide additional value - Check whether device driver calls to dibs_client_ops should be replaced by interface functions that provide additional value. Link: [1] https://netdevconf.info/0x19/sessions/talk/communication-via-internal-shared-memory-ism-time-to-open-up.html Link: [2] https://lore.kernel.org/netdev/1695568613-125057-1-git-send-email-guwen@linux.alibaba.com/ Link: [3] https://lore.kernel.org/linux-kernel//20240428060738.60843-1-guwen@linux.alibaba.com/ Link: [4] https://groups.oasis-open.org/communities/community-home/digestviewer/viewthread?GroupId=3973&MessageKey=c060ecf9-ea1a-49a2-9827-c92f0e6447b2&CommunityKey=2f26be99-3aa1-48f6-93a5-018dce262226&hlmlt=VT ==================== Link: https://patch.msgid.link/20250918110500.1731261-1-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit a612dbe8d04d47af91fa88f0599c1370cc70f687 Author: Julian Ruess Date: Thu Sep 18 13:05:00 2025 +0200 dibs: Move event handling to dibs layer Add defines for all event types and subtypes an ism device is known to produce as it can be helpful for debugging purposes. Introduces a generic 'struct dibs_event' and adopt ism device driver and smc-d client accordingly. Tolerate and ignore other type and subtype values to enable future device extensions. SMC-D and ISM are now independent. struct ism_dev can be moved to drivers/s390/net/ism.h. Note that in smc, the term 'ism' is still used. Future patches could replace that with 'dibs' or 'smc-d' as appropriate. Signed-off-by: Julian Ruess Co-developed-by: Alexandra Winter Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-15-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit cc21191b584c6f7836b0f10774f8278b7cbfba10 Author: Alexandra Winter Date: Thu Sep 18 13:04:59 2025 +0200 dibs: Move data path to dibs layer Use struct dibs_dmb instead of struct smc_dmb and move the corresponding client tables to dibs_dev. Leave driver specific implementation details like sba in the device drivers. Register and unregister dmbs via dibs_dev_ops. A dmb is dedicated to a single client, but a dibs device can have dmbs for more than one client. Trigger dibs clients via dibs_client_ops->handle_irq(), when data is received into a dmb. For dibs_loopback replace scheduling an smcd receive tasklet with calling dibs_client_ops->handle_irq(). For loopback devices attach_dmb(), detach_dmb() and move_data() need to access the dmb tables, so move those to dibs_dev_ops in this patch as well. Remove remaining definitions of smc_loopback as they are no longer required, now that everything is in dibs_loopback. Note that struct ism_client and struct ism_dev are still required in smc until a follow-on patch moves event handling to dibs. (Loopback does not use events). Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-14-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 719c3b67bb7ea95bb8158b03c75641c8fc8f94a0 Author: Alexandra Winter Date: Thu Sep 18 13:04:58 2025 +0200 dibs: Move query_remote_gid() to dibs_dev_ops Provide the dibs_dev_ops->query_remote_gid() in ism and dibs_loopback dibs_devices. And call it in smc dibs_client. Reviewed-by: Julian Ruess Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-13-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 92a0f7bb081dde6e88368816b8ba51352ddabb1d Author: Alexandra Winter Date: Thu Sep 18 13:04:57 2025 +0200 dibs: Move vlan support to dibs_dev_ops It can be debated how much benefit definition of vlan ids for dibs devices brings, as the dmbs are accessible only by a single peer anyhow. But ism provides vlan support and smcd exploits it, so move it to dibs layer as an optional feature. smcd_loopback simply ignores all vlan settings, do the same in dibs_loopback. SMC-D and ISM have a method to use the invalid VLAN ID 1FFF (ISM_RESERVED_VLANID), to indicate that both communication peers support routable SMC-Dv2. Tolerate it in dibs, but move it to SMC only. Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-12-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 05e68d8dedf34f270cc3769ffe7f0ed413f23add Author: Alexandra Winter Date: Thu Sep 18 13:04:56 2025 +0200 dibs: Local gid for dibs devices Define a uuid_t GID attribute to identify a dibs device. SMC uses 64 Bit and 128 Bit Global Identifiers (GIDs) per device, that need to be sent via the SMC protocol. Because the smc code uses integers, network endianness and host endianness need to be considered. Avoid this in the dibs layer by using uuid_t byte arrays. Future patches could change SMC to use uuid_t. For now conversion helper functions are introduced. ISM devices provide 64 Bit GIDs. Map them to dibs uuid_t GIDs like this: _________________________________________ | 64 Bit ISM-vPCI GID | 00000000_00000000 | ----------------------------------------- If interpreted as UUID [1], this would be interpreted as the UIID variant, that is reserved for NCS backward compatibility. So it will not collide with UUIDs that were generated according to the standard. smc_loopback already uses version 4 UUIDs as 128 Bit GIDs, move that to dibs loopback. A temporary change to smc_lo_query_rgid() is required, that will be moved to dibs_loopback with a follow-on patch. Provide gid of a dibs device as sysfs read-only attribute. Link: https://datatracker.ietf.org/doc/html/rfc4122 [1] Signed-off-by: Alexandra Winter Reviewed-by: Julian Ruess Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20250918110500.1731261-11-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 804737349813a4ffc0e2a66579cb3cc42eb46446 Author: Julian Ruess Date: Thu Sep 18 13:04:55 2025 +0200 dibs: Create class dibs Create '/sys/class/dibs' to represent multiple kinds of dibs devices in sysfs. Show s390/ism devices as well as dibs_loopback devices. Show attribute fabric_id using dibs_ops.get_fabric_id(). This can help users understand which dibs devices are connected to the same fabric in different systems and which dibs devices are loopback devices (fabric_id 0xffff) Instead of using the same name as the pci device, give the ism devices their own readable names based on uid or fid from the HW definition. smc_loopback was never visible in sysfs. dibs_loopback is now represented as a virtual device. For the SMC feature "software defined pnet-id" either the ib device name or the PCI-ID (actually the parent device name) can be used for SMC-R entries. Mimic this behaviour for SMC-D, and check the parent device name as well. So device name or PCI-ID can be used for ism and device name can be used for dibs-loopback. Note that this: IB_DEVICE_NAME_MAX - 1 == smc_pnet_policy.[SMC_PNETID_IBNAME].len is the length of smcd_name. Future SW-pnetid cleanup patches to could use a meaningful define, but that would touch too much unrelated code here. Examples: --------- ism before: > ls /sys/bus/pci/devices/0000:00:00.0/0000:00:00.0 uevent ism now: > ls /sys/bus/pci/devices/0000:00:00.0/dibs/ism30 device -> ../../../0000:00:00.0/ fabric_id subsystem -> ../../../../../class/dibs/ uevent dibs loopback: > ls /sys/devices/virtual/dibs/lo/ fabric_id subsystem -> ../../../../class/dibs/ uevent dibs class: > ls -l /sys/class/dibs/ ism30 -> ../../devices/pci0000:00/0000:00:00.0/dibs/ism30/ lo -> ../../devices/virtual/dibs/lo/ For comparison: > ls -l /sys/class/net/ enc8410 -> ../../devices/qeth/0.0.8410/net/enc8410/ ens1693 -> ../../devices/pci0001:00/0001:00:00.0/net/ens1693/ lo -> ../../devices/virtual/net/lo/ Signed-off-by: Julian Ruess Co-developed-by: Alexandra Winter Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-10-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 845c334a0186a23c2ac4abfb444e499fec831b24 Author: Julian Ruess Date: Thu Sep 18 13:04:54 2025 +0200 dibs: Move struct device to dibs_dev Move struct device from ism_dev and smc_lo_dev to dibs_dev, and define a corresponding release function. Free ism_dev in ism_remove() and smc_lo_dev in smc_lo_dev_remove(). Replace smcd->ops->get_dev(smcd) by using dibs->dev directly. An alternative design would be to embed dibs_dev as a field in ism_dev and do the same for other dibs device driver specific structs. However that would have the disadvantage that each dibs device driver needs to allocate dibs_dev and each dibs device driver needs a different device release function. The advantage would be that ism_dev and other device driver specific structs would be covered by device reference counts. Signed-off-by: Julian Ruess Co-developed-by: Alexandra Winter Signed-off-by: Alexandra Winter Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20250918110500.1731261-9-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 69baaac9361edd169713562f088829a1be9c51a9 Author: Alexandra Winter Date: Thu Sep 18 13:04:53 2025 +0200 dibs: Define dibs_client_ops and dibs_dev_ops Move the device add() and remove() functions from ism_client to dibs_client_ops and call add_dev()/del_dev() for ism devices and dibs_loopback devices. dibs_client_ops->add_dev() = smcd_register_dev() for the smc_dibs_client. This is the first step to handle ism and loopback devices alike (as dibs devices) in the smc dibs client. Define dibs_dev->ops and move smcd_ops->get_chid to dibs_dev_ops->get_fabric_id() for ism and loopback devices. See below for why this needs to be in the same patch as dibs_client_ops->add_dev(). The following changes contain intermediate steps, that will be obsoleted by follow-on patches, once more functionality has been moved to dibs: Use different smcd_ops and max_dmbs for ism and loopback. Follow-on patches will change SMC-D to directly use dibs_ops instead of smcd_ops. In smcd_register_dev() it is now necessary to identify a dibs_loopback device before smcd_dev and smcd_ops->get_chid() are available. So provide dibs_dev_ops->get_fabric_id() in this patch and evaluate it in smc_ism_is_loopback(). Call smc_loopback_init() in smcd_register_dev() and call smc_loopback_exit() in smcd_unregister_dev() to handle the functionality that is still in smc_loopback. Follow-on patches will move all smc_loopback code to dibs_loopback. In smcd_[un]register_dev() use only ism device name, this will be replaced by dibs device name by a follow-on patch. End of changes with intermediate parts. Allocate an smcd event workqueue for all dibs devices, although dibs_loopback does not generate events. Use kernel memory instead of devres memory for smcd_dev and smcd->conn. Since commit a72178cfe855 ("net/smc: Fix dependency of SMC on ISM") an ism device and its driver can have a longer lifetime than the smc module, so smc should not rely on devres to free its resources [1]. It is now the responsibility of the smc client to free smcd and smcd->conn for all dibs devices, ism devices as well as loopback. Call client->ops->del_dev() for all existing dibs devices in dibs_unregister_client(), so all device related structures can be freed in the client. When dibs_unregister_client() is called in the context of smc_exit() or smc_core_reboot_event(), these functions have already called smc_lgrs_shutdown() which calls smc_smcd_terminate_all(smcd) and sets going_away. This is done a second time in smcd_unregister_dev(). This is analogous to how smcr is handled in these functions, by calling first smc_lgrs_shutdown() and then smc_ib_unregister_client() > smc_ib_remove_dev(), so leave it that way. It may be worth investigating, whether smc_lgrs_shutdown() is still required or useful. Remove CONFIG_SMC_LO. CONFIG_DIBS_LO now controls whether a dibs loopback device exists or not. Link: https://www.kernel.org/doc/Documentation/driver-model/devres.txt [1] Signed-off-by: Alexandra Winter Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20250918110500.1731261-8-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit cb990a45d7f6eb6dc495d2226a3005b284a5ee4f Author: Alexandra Winter Date: Thu Sep 18 13:04:52 2025 +0200 dibs: Define dibs loopback The first stage of loopback-ism was implemented as part of the SMC module [1]. Now that we have the dibs layer, provide access to a dibs_loopback device to all dibs clients. This is the first step of moving loopback-ism from net/smc/smc_loopback.* to drivers/dibs/dibs_loopback.*. One global structure lo_dev is allocated and added to the dibs devices. Follow-on patches will move functionality. Same as smc_loopback, dibs_loopback is provided by a config option. Note that there is no way to dynamically add or remove the loopback device. That could be a future improvement. When moving code to drivers/dibs, replace ism_ prefix with dibs_ prefix. As this is mostly a move of existing code, copyright and authors are unchanged. Link: https://lore.kernel.org/lkml/20240428060738.60843-1-guwen@linux.alibaba.com/ [1] Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-7-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 269726968f95ebc00e3a47f91eebd6818991d6fa Author: Alexandra Winter Date: Thu Sep 18 13:04:51 2025 +0200 dibs: Register ism as dibs device Register ism devices with the dibs layer. Follow-on patches will move functionality to the dibs layer. As DIBS is only a shim layer without any dependencies, we can depend ISM on DIBS without adding indirect dependencies. A follow-on patch will remove implication of SMC by ISM. Define struct dibs_dev. Follow-on patches will move more content into dibs_dev. The goal of follow-on patches is that ism_dev will only contain fields that are special for this device driver. The same concept will apply to other dibs device drivers. Define dibs_dev_alloc(), dibs_dev_add() and dibs_dev_del() to be called by dibs device drivers and call them from ism_drv.c Use ism_dev.dibs for a pointer to dibs_dev. Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-6-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit d324a2ca3f8efd57f5839aa2690554a5cbb3586f Author: Alexandra Winter Date: Thu Sep 18 13:04:50 2025 +0200 dibs: Register smc as dibs_client Formally register smc as dibs client. Functionality will be moved by follow-on patches from ism_client to dibs_client until eventually ism_client can be removed. As DIBS is only a shim layer without any dependencies, we can depend SMC on DIBS without adding indirect dependencies. A follow-on patch will remove dependency of SMC on ISM. Signed-off-by: Alexandra Winter Reviewed-by: Julian Ruess Link: https://patch.msgid.link/20250918110500.1731261-5-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 35758b0032c056cdff3e8f5a70669cb3e2c8d0e4 Author: Alexandra Winter Date: Thu Sep 18 13:04:49 2025 +0200 dibs: Create drivers/dibs Create the file structure for a 'DIBS - Direct Internal Buffer Sharing' shim layer that will provide generic functionality and declarations for dibs device drivers and dibs clients. Following patches will add functionality. Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20250918110500.1731261-4-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit a4997e17d13767e67170f09bfa0b867862cad9d9 Author: Alexandra Winter Date: Thu Sep 18 13:04:48 2025 +0200 net/smc: Decouple sf and attached send_buf in smc_loopback Before this patch there was the following assumption in smc_loopback.c>smc_lo_move_data(): sf (signalling flag) == 0 : data is already in an attached target dmb sf == 1 : data is not yet in the target dmb This is true for the 2 callers in smc client smcd_cdc_msg_send() : sf=1 smcd_tx_rdma_writes() : sf=0 but should not be a general assumption. Add a bool to struct smc_buf_desc to indicate whether an SMC-D sndbuf_desc is an attached buffer. Don't call move_data() for attached send_buffers, because it is not necessary. Move the data in smc_lo_move_data() if len != 0 and signal when requested. Signed-off-by: Alexandra Winter Reviewed-by: Mahanta Jambigi Reviewed-by: Dust Li Link: https://patch.msgid.link/20250918110500.1731261-3-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 884eee8e43f3072db4111178c98b9aa5c57bcf92 Author: Alexandra Winter Date: Thu Sep 18 13:04:47 2025 +0200 net/smc: Remove error handling of unregister_dmb() smcd_buf_free() calls smc_ism_unregister_dmb(lgr->smcd, buf_desc) and then unconditionally frees buf_desc. Remove the cleaning up of fields of buf_desc in smc_ism_unregister_dmb(), because it is not helpful. This removes the only usage of ISM_ERROR from the smc module. So move it to drivers/s390/net/ism.h. Signed-off-by: Alexandra Winter Reviewed-by: Mahanta Jambigi Reviewed-by: Dust Li Link: https://patch.msgid.link/20250918110500.1731261-2-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 1d289fc5691c7a970a285bc53292bac9e37c89a6 Merge: a590b67d330100 1441edd129e36c Author: Paul E. McKenney Date: Tue Sep 23 02:10:51 2025 -0700 Merge branch 'torture.2025.08.14a' into HEAD Torture-test updates: * rcutorture: Fix jitter.sh spin time * torture: Add --do-normal parameter to torture.sh help text * torture: Announce kernel boot status at torture-test startup * rcutorture: Suppress "Writer stall state" reports during boot * rcutorture: Delay rcutorture readers and writers until boot completes * torture: Delay CPU-hotplug operations until boot completes * rcutorture: Delay forward-progress testing until boot completes * rcutorture,refscale: Use kcalloc() instead of kzalloc() * refperf: Remove redundant kfree() after torture_stop_kthread() * refperf: Set reader_tasks to NULL after kfree() commit a590b67d3301006e41b767f958365743b14ce264 Merge: ccd0256e697e36 e6a43aeb71852a Author: Paul E. McKenney Date: Tue Sep 23 02:07:10 2025 -0700 Merge branch 'srcu-next.2025.08.21a' into HEAD SRCU updates: * Create srcu_read_{,un}lock_fast_notrace() * Add srcu_read_lock_fast_notrace() and srcu_read_unlock_fast_notrace() * Add guards for notrace variants of SRCU-fast readers * Document srcu_read_{,un}lock_fast() use of implicit RCU readers * Document srcu_flip() memory-barrier D relation to SRCU-fast * Remove preempt_disable/enable() in Tiny SRCU srcu_gp_start_if_needed() commit ccd0256e697e369fc3cfa57d321074eaeac18dce Merge: 0e9e7023df282c 82c427bc935aa5 Author: Paul E. McKenney Date: Tue Sep 23 02:02:43 2025 -0700 Merge branch 'rcu.2025.09.23a' into HEAD RCU miscellaneous updates: * Document that rcu_barrier() hurries lazy callbacks * Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() * Move list_for_each_rcu() to where it belongs * Replace use of system_wq with system_percpu_wq * WQ_PERCPU added to alloc_workqueue users * WQ_UNBOUND added to sync_wq workqueue commit 82c427bc935aa5b91d0cabbbc062e71132be2bb8 Author: Marco Crivellari Date: Fri Sep 19 16:50:39 2025 +0200 rcu: WQ_UNBOUND added to sync_wq workqueue Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change add the WQ_UNBOUND flag to sync_wq, to make explicit this workqueue can be unbound and that it does not benefit from per-cpu work. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Frederic Weisbecker Signed-off-by: Paul E. McKenney commit 499d48f75b230522f4aa5aa4b9cc3c5b1594e1af Author: Marco Crivellari Date: Fri Sep 19 16:50:38 2025 +0200 rcu: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Frederic Weisbecker Signed-off-by: Paul E. McKenney commit 143ddfa169bbb733275b1a720bafd5a4366b3d89 Author: Marco Crivellari Date: Fri Sep 19 16:50:37 2025 +0200 rcu: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Frederic Weisbecker Signed-off-by: Paul E. McKenney commit ef104054a312608deab266f95945057fa73eeaad Author: Haren Myneni Date: Mon Sep 22 02:11:08 2025 -0700 powerpc/pseries: Define __u{8,32} types in papr_hvpipe_hdr struct Fix the the following build errors with CONFIG_UAPI_HEADER_TEST: ./usr/include/asm/papr-hvpipe.h:16:9: error: unknown type name 'u8' 16 | u8 version; ./usr/include/asm/papr-hvpipe.h:17:9: error: unknown type name 'u8' 17 | u8 reserved[3]; ./usr/include/asm/papr-hvpipe.h:18:9: error: unknown type name 'u32' 18 | u32 flags; ./usr/include/asm/papr-hvpipe.h:19:9: error: unknown type name 'u8' 19 | u8 reserved2[40]; Fixes: 043439ad1a23c ("powerpc/pseries: Define papr-hvpipe ioctl") Reported-by: Venkat Rao Bagalkote Signed-off-by: Haren Myneni Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250922091108.1483970-1-haren@linux.ibm.com commit 91daac8a6893c65e18f194946ad3ad9df5e9de8d Author: Nam Cao Date: Tue Sep 16 08:10:07 2025 +0200 genirq/msi: Remove msi_post_free() The only user of msi_post_free() - powerpc/pseries - has been changed to use msi_teardown(). Remove this unused callback. Signed-off-by: Nam Cao Reviewed-by: Thomas Gleixner Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250916061007.964005-1-namcao@linutronix.de commit 2bfb20b65d9bc1d0de58f8c28ca9d6f1d27bbc01 Merge: 089558a9baaceb ad4728740bd68d Author: Mark Brown Date: Tue Sep 23 10:57:52 2025 +0200 spi: rpc-if: Add resume support for RZ/G3E Merge series from Biju Das : On RZ/G3E using PSCI, s2ram powers down the SoC. After resume, reinitialize the hardware for SPI operations. Also Replace the macro SIMPLE_DEV_PM_OPS->DEFINE_SIMPLE_DEV_PM_OPS macro and use pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP and __maybe_unused attribute from PM functions. commit 089558a9baaceb68b58c31cab658b7117743c452 Merge: 7ea79f536687a4 f98cabe3f6cf63 Author: Mark Brown Date: Tue Sep 23 10:57:45 2025 +0200 Virtio SPI Linux driver Merge series from Haixu Cui : This is the 10th version of the virtio SPI Linux driver patch series which is intended to be compliant with the upcoming virtio specification version 1.4. The specification can be found in repository: https://github.com/oasis-tcs/virtio-spec.git branch virtio-1.4. commit e609438851928381e39b5393f17156955a84122a Author: Dmitry Baryshkov Date: Sun Sep 21 10:09:17 2025 +0300 regulator: dt-bindings: qcom,sdm845-refgen-regulator: document more platforms Document refgen block being present on SDM670, Lemans and QCS8300 platforms. It should be used to provide reference voltage to DSI controller. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250921-refgen-v1-1-9d93e64133ea@oss.qualcomm.com Signed-off-by: Mark Brown commit 5fa7d739f811bdffb5fc99696c2e821344fe0b88 Author: Dmitry Baryshkov Date: Sun Sep 21 10:09:17 2025 +0300 regulator: dt-bindings: qcom,sdm845-refgen-regulator: document more platforms Document refgen block being present on SDM670, Lemans and QCS8300 platforms. It should be used to provide reference voltage to DSI controller. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250921-refgen-v1-1-9d93e64133ea@oss.qualcomm.com Signed-off-by: Mark Brown commit 99d19715daf5553a28452a4ef95e9692277e2787 Author: AngeloGioacchino Del Regno Date: Wed Jun 11 13:07:58 2025 +0200 dt-bindings: timer: mediatek,timer: Add MediaTek MT8196 compatible Add a new compatible for the MediaTek MT8196 SoC, fully compatible with MT6765. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Reviewed-by: Nícolas F. R. A. Prado Acked-by: Rob Herring (Arm) Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250611110800.458164-2-angelogioacchino.delregno@collabora.com commit d27b4e33c954f5fa6b6e366736838c98d3996f02 Author: Chen Ni Date: Tue Jun 3 14:04:50 2025 +0800 clocksource/timer-econet-en751221: Convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Signed-off-by: Daniel Lezcano Tested-by: Caleb James DeLisle Link: https://lore.kernel.org/r/20250603060450.1310204-1-nichen@iscas.ac.cn commit ffc5870fc4e0ea72bf73ad5ab1d648aa0b4f7cbf Author: Frank Li Date: Wed May 28 12:53:50 2025 -0400 dt-bindings: timer: Add fsl,timrot.yaml Add fsl,timrot.yaml for i.MX23/i.MX28 timer. Also add a generic fallback compatible string "fsl,timrot" for legacy devices, which have existed for over 15 years. Signed-off-by: Frank Li Signed-off-by: Daniel Lezcano Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250528165351.691848-1-Frank.Li@nxp.com commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf Author: Arnd Bergmann Date: Fri Jun 20 13:19:35 2025 +0200 clocksource/drivers/tegra186: Avoid 64-bit division The newly added function causes a build failure on 32-bit targets with older compiler version such as gcc-10: arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft': timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod' The calculation can trivially be changed to avoid the division entirely, as USEC_PER_SEC is a multiple of 5. Change both such calculation for consistency, even though gcc apparently managed to optimize the other one properly already. [dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ] Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") Signed-off-by: Arnd Bergmann Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org commit 7f3abae5b447a7f8458a0f58a003c11c46aade99 Author: Guenter Roeck Date: Sat Jun 14 10:55:56 2025 -0700 clocksource/drivers/timer-tegra186: Simplify calculating timeleft It is not necessary to use 64-bit operations to calculate the remaining watchdog timeout. Simplify to use 32-bit operations, and add comments explaining why there will be no overflow. Signed-off-by: Guenter Roeck Signed-off-by: Daniel Lezcano Reviewed-by: Jon Hunter Cc: Pohsun Su Cc: Robert Lin Link: https://lore.kernel.org/r/20250614175556.922159-2-linux@roeck-us.net commit 916aa36042db8ee230543ffe0d192f900e8b8c9f Author: Guenter Roeck Date: Sat Jun 14 10:55:55 2025 -0700 clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation Building the driver on xtensa fails with tensa-linux-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_timer_remove': timer-tegra186.c:(.text+0x350): undefined reference to `__udivdi3' Avoid the problem by rearranging the offending code to avoid the 64-bit divide operation. Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") Signed-off-by: Guenter Roeck Signed-off-by: Daniel Lezcano Reviewed-by: Jon Hunter Cc: Pohsun Su Cc: Robert Lin Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net commit be26ec8b1479a0bb1888ed93d7bb5ce4d8eaee1e Author: Will McVicker Date: Fri Jun 20 11:17:04 2025 -0700 of/irq: Export of_irq_count for modules Need to export `of_irq_count` in preparation for modularizing the Exynos MCT driver which uses this API for setting up the timer IRQs. Signed-off-by: Will McVicker Signed-off-by: Daniel Lezcano Tested-by: Youngmin Nam Reviewed-by: Linus Walleij Reviewed-by: Youngmin Nam Acked-by: Rob Herring (Arm) Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620181719.1399856-2-willmcvicker@google.com commit c1ff9e919addb8cf0414b08bd996f11a4a2e7297 Author: Frank Li Date: Fri May 23 10:14:37 2025 -0400 dt-bindings: timer: fsl,ftm-timer: use items for reg The original txt binding doc is: reg : Specifies base physical address and size of the register sets for the clock event device and clock source device. And existed dts provide two reg MMIO spaces. So change to use items to descript reg property. Update examples. Fixes: 8fc30d8f8e86 ("dt-bindings: timer: fsl,ftm-timer: Convert to dtschema") Signed-off-by: Frank Li Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250523141437.533643-1-Frank.Li@nxp.com commit bb7bf8b44de1b13b8b7b10ca166b545ff22edac9 Author: Max Shevchenko Date: Wed Jul 2 13:50:40 2025 +0300 dt-bindings: timer: mediatek: add MT6572 Add a compatible string for timer on the MT6572 SoC. Signed-off-by: Max Shevchenko Signed-off-by: Daniel Lezcano Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250702-mt6572-v4-3-bde75b7ed445@proton.me commit ef0e000cd162a58dba10608ef6959f172d1bc5f4 Author: Rob Herring (Arm) Date: Wed Jun 11 18:26:20 2025 -0500 dt-bindings: timer: Convert faraday,fttmr010 to DT schema Convert the Faraday fttmr010 Timer binding to DT schema format. Adjust the compatible string values to match what's in use. The number of interrupts can also be anywhere from 1 to 8. The clock-names order was reversed compared to what's used. Signed-off-by: Rob Herring (Arm) Signed-off-by: Daniel Lezcano Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250611232621.1508116-1-robh@kernel.org commit 84b1a903aed876a3fd6bb04786947f640d4d8e62 Author: Daniel Lezcano Date: Mon Jun 2 17:18:51 2025 +0200 time/sched_clock: Export symbol for sched_clock register function The timer drivers could be converted into modules. The different functions to register the clocksource or the clockevent are already exporting their symbols for modules but the sched_clock_register() function is missing. Export the symbols so the drivers using this function can be converted into modules. Signed-off-by: Daniel Lezcano Reviewed-by: Thomas Gleixner Reviewed-by: Carlos Llamas Reviewed-by: Will McVicker Acked-by: John Stultz Link: https://lore.kernel.org/r/20250602151853.1942521-8-daniel.lezcano@linaro.org commit eea65574e259f812e84080d56eca51f1a1889f8c Author: Daniel Lezcano Date: Mon Jun 2 17:18:50 2025 +0200 clocksource/drivers/cs5535: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250602151853.1942521-7-daniel.lezcano@linaro.org commit edef59887b5c5a527ad4b287a51f8f9fc239d867 Author: Daniel Lezcano Date: Mon Jun 2 17:18:49 2025 +0200 clocksource/drivers/stm: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250602151853.1942521-6-daniel.lezcano@linaro.org commit afe904f5091e2ceaa95b451f61a115a0224e8e38 Author: Daniel Lezcano Date: Mon Jun 2 17:18:48 2025 +0200 clocksource/drivers/tegra186: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250602151853.1942521-5-daniel.lezcano@linaro.org commit 376d11d32718c4d965714278ac6e6605d944fca2 Author: Daniel Lezcano Date: Mon Jun 2 17:18:47 2025 +0200 clocksource/drivers/sun5i: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Acked-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250602151853.1942521-4-daniel.lezcano@linaro.org commit 2cf51ab7f5c52f11dc12a11055f4b628121802d9 Author: Daniel Lezcano Date: Mon Jun 2 17:18:46 2025 +0200 clocksource/drivers/stm32-lp: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250602151853.1942521-3-daniel.lezcano@linaro.org commit 4b9197ed60bb3929d39833075b4108b366453018 Author: Mikulas Patocka Date: Wed Sep 17 17:49:39 2025 +0200 dm-integrity: introduce integrity_kmap and integrity_kunmap This abstraction will be used later, for the asynchronous hash interface. Signed-off-by: Mikulas Patocka commit d91610656499d228146cdf49fb6f7d720411fadb Author: Mikulas Patocka Date: Wed Sep 17 17:49:26 2025 +0200 dm-integrity: replace bvec_kmap_local with kmap_local_page Replace bvec_kmap_local with kmap_local_page - it will be needed for the upcoming patches that make kmap_local_page optional, depending on whether asynchronous hash interface is used or not. Signed-off-by: Mikulas Patocka commit e4cc9deca3da48986072327ae2eeb18e6fd0165d Author: Mikulas Patocka Date: Wed Sep 17 17:47:24 2025 +0200 dm-integrity: use internal variable for digestsize Instead of calling digestsize() each time the digestsize for the internal hash is needed, store the digestsize in a new field internal_hash_digestsize within struct dm_integrity_c once and use this value when needed. Signed-off-by: Harald Freudenberger Signed-off-by: Mikulas Patocka commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 Author: Ivan Abramov Date: Tue Sep 9 23:22:38 2025 +0300 dm vdo: return error on corrupted metadata in start_restoring_volume functions The return values of VDO_ASSERT calls that validate metadata are not acted upon. Return UDS_CORRUPT_DATA in case of an error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a4eb7e255517 ("dm vdo: implement the volume index") Signed-off-by: Ivan Abramov Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit e828a1875e3a6216e4d66ac2c2f60894d10945b7 Author: Bruce Johnston Date: Mon Sep 15 19:35:17 2025 -0400 dm vdo: Update code to use mem_is_zero Remove function that would check if data was all zeroes. Use the built-in kernel function mem_is_zero() instead. Signed-off-by: Bruce Johnston Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 4e65bda8273c938039403144730923e77916a3d7 Author: Ma Ke Date: Tue Sep 23 14:52:12 2025 +0800 ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() wcd934x_codec_parse_data() contains a device reference count leak in of_slim_get_device() where device_find_child() increases the reference count of the device but this reference is not properly decreased in the success path. Add put_device() in wcd934x_codec_parse_data() and add devm_add_action_or_reset() in the probe function, which ensures that the reference count of the device is correctly managed. Memory leak in regmap_init_slimbus() as the allocated regmap is not released when the device is removed. Using devm_regmap_init_slimbus() instead of regmap_init_slimbus() to ensure automatic regmap cleanup on device removal. Calling path: of_slim_get_device() -> of_find_slim_device() -> device_find_child(). As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use.'. Found by code review. Cc: stable@vger.kernel.org Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec") Signed-off-by: Ma Ke Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250923065212.26660-1-make24@iscas.ac.cn Signed-off-by: Mark Brown commit 7ea79f536687a478ec084567a23c536fa0729c15 Merge: 878702702dbbd9 e336ab509b43ea Author: Mark Brown Date: Tue Sep 23 10:29:10 2025 +0200 spi: multi CS cleanup and controller CS limit Merge series from Jonas Gorski : This series aims at cleaning up the current multi CS parts and removing the CS limit per controller that was introduced with the multi CS support. To do this, store the assigned chip selects per device in spi_device::num_chipselects, which allows us to use that instead of SPI_CS_CNT_MAX for most loops, as well as remove the check for SPI_INVALID_CS for any chip select. This should hopefully make it obvious that SPI_CS_CNT_MAX only limits accesses to arrays indexed by the number of chip selects of a device, not the controller, and we can remove the check for spi_controller::num_chipselects being less than SPI_CS_CNT_MAX in device registration (which was the wrong place to do that anyway). After having done that, we can reduce SPI_CS_CNT_MAX again to 4 without breaking devices on higher CS lines. Finally, rename SPI_CS_CNT_MAX to SPI_DEVICE_CNT_MAX to make it more clear that this limit only applies to devices, not controllers. There are still more issues left, but these can be addressed in future submissions: * The code allows multi-cs devices for any controller, as long as the device does not set parallel-memories. * No current spi controller driver handles logical chip selects other than the first one, and always use it, regardless what cs_index_mask says. * While most spi controllers should be able to handle devices that have multiple cs that just get enabled selectively, but not at the same time, there is no way to tell that to the core (ties into the above). * There is no parallel memories/multi cs flag for devices, so any implementing driver needs to check the device tree node, making it impossible to register these kind of devices via platform code. commit fd9814554328e189216bb1488c17157462600e99 Merge: 63b4c34635cf32 46c8b4d2a693ec Author: Mark Brown Date: Tue Sep 23 10:28:45 2025 +0200 Support reading Subsystem ID from Device Tree Merge series from Stefan Binding : In PC systems using ACPI, the driver is able to read back an SSID from the _SUB property. This SSID uniquely identifies the system, which enables the driver to read the correct firmware and tuning for that system from linux-firmware. Currently there is no way of reading this property from device tree. Add an equivalent property in device tree to perform the same role. commit d6bfdeb4fde74c9a0e227cc1af9dda69c57489f4 Author: Daniel Lezcano Date: Mon Jun 2 17:18:45 2025 +0200 clocksource/drivers/scx200: Add module owner The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250602151853.1942521-2-daniel.lezcano@linaro.org commit bee278e18e641a4bc11513b0fa8f5eb2667b8a32 Author: Sebastian Reichel Date: Thu Sep 18 23:20:26 2025 +0200 dt-bindings: embedded-controller: Add Lenovo Thinkpad T14s EC Add binding for the EC found in the Thinkpad T14s Gen6 Snapdragon, which is based on the Qualcomm X1 Elite. Some of the system LEDs and extra keys are only accessible via the EC. Reviewed-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-1-ac0bc6382c5c@collabora.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6e2f1484b94435d7491dcc380ce2959fcf6caba9 Merge: 3afb106f3f9aa8 8a8241cdaa343c Author: Paolo Abeni Date: Tue Sep 23 10:12:17 2025 +0200 Merge branch 'tcp-update-bind-bucket-state-on-port-release' Jakub Sitnicki says: ==================== tcp: Update bind bucket state on port release TL;DR ----- This is another take on addressing the issue we already raised earlier [1]. This time around, instead of trying to relax the bind-conflict checks in connect(), we make an attempt to fix the tcp bind bucket state accounting. The goal of this patch set is to make the bind buckets return to "port reusable by ephemeral connections" state when all sockets blocking the port from reuse get unhashed. Changelog --------- Changes in v5: - Fix initial port-addr bucket state on saddr update with ip_dynaddr=1 - Add Kuniyuki's tag for tests - Link to v4: https://lore.kernel.org/r/20250913-update-bind-bucket-state-on-unhash-v4-0-33a567594df7@cloudflare.com Changes in v4: - Drop redundant sk_is_connect_bind helper doc comment - Link to v3: https://lore.kernel.org/r/20250910-update-bind-bucket-state-on-unhash-v3-0-023caaf4ae3c@cloudflare.com Changes in v3: - Move the flag from inet_flags to sk_userlocks (Kuniyuki) - Rename the flag from AUTOBIND to CONNECT_BIND to avoid a name clash (Kuniyuki) - Drop unreachable code for sk_state == TCP_NEW_SYN_RECV (Kuniyuki) - Move the helper to inet_hashtables where it's used - Reword patch 1 description for conciseness - Link to v2: https://lore.kernel.org/r/20250821-update-bind-bucket-state-on-unhash-v2-0-0c204543a522@cloudflare.com Changes in v2: - Rename the inet_sock flag from LAZY_BIND to AUTOBIND (Eric) - Clear the AUTOBIND flag on disconnect path (Eric) - Add a test to cover the disconnect case (Eric) - Link to RFC v1: https://lore.kernel.org/r/20250808-update-bind-bucket-state-on-unhash-v1-0-faf85099d61b@cloudflare.com Situation --------- We observe the following scenario in production: inet_bind_bucket state for port 54321 -------------------- (bucket doesn't exist) // Process A opens a long-lived connection: s1 = socket(AF_INET, SOCK_STREAM) s1.setsockopt(IP_BIND_ADDRESS_NO_PORT) s1.setsockopt(IP_LOCAL_PORT_RANGE, 54000..54500) s1.bind(192.0.2.10, 0) s1.connect(192.51.100.1, 443) tb->fastreuse = -1 tb->fastreuseport = -1 s1.getsockname() -> 192.0.2.10:54321 s1.send() s1.recv() // ... s1 stays open. // Process B opens a short-lived connection: s2 = socket(AF_INET, SOCK_STREAM) s2.setsockopt(SO_REUSEADDR) s2.bind(192.0.2.20, 0) tb->fastreuse = 0 tb->fastreuseport = 0 s2.connect(192.51.100.2, 53) s2.getsockname() -> 192.0.2.20:54321 s2.send() s2.recv() s2.close() // bucket remains in this // state even though port // was released by s2 tb->fastreuse = 0 tb->fastreuseport = 0 // Process A attempts to open another connection // when there is connection pressure from // 192.0.2.30:54000..54500 to 192.51.100.1:443. // Assume only port 54321 is still available. s3 = socket(AF_INET, SOCK_STREAM) s3.setsockopt(IP_BIND_ADDRESS_NO_PORT) s3.setsockopt(IP_LOCAL_PORT_RANGE, 54000..54500) s3.bind(192.0.2.30, 0) s3.connect(192.51.100.1, 443) -> EADDRNOTAVAIL (99) Problem ------- We end up in a state where Process A can't reuse ephemeral port 54321 for as long as there are sockets, like s1, that keep the bind bucket alive. The bucket does not return to "reusable" state even when all sockets which blocked it from reuse, like s2, are gone. The ephemeral port becomes available for use again only after all sockets bound to it are gone and the bind bucket is destroyed. Programs which behave like Process B in this scenario - that is, binding to an IP address without setting IP_BIND_ADDRESS_NO_PORT - might be considered poorly written. However, the reality is that such implementation is not actually uncommon. Trying to fix each and every such program is like playing whack-a-mole. For instance, it could be any software using Golang's net.Dialer with LocalAddr provided: dialer := &net.Dialer{ LocalAddr: &net.TCPAddr{IP: srcIP}, } conn, err := dialer.Dial("tcp4", dialTarget) Or even a ubiquitous tool like dig when using a specific local address: $ dig -b 127.1.1.1 +tcp +short example.com Hence, we are proposing a systematic fix in the network stack itself. Solution -------- Please see the description in patch 1. [1] https://lore.kernel.org/r/20250714-connect-port-search-harder-v3-0-b1a41f249865@cloudflare.com Reported-by: Lee Valentine Signed-off-by: Jakub Sitnicki ==================== Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-0-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni commit 8a8241cdaa343c4bdb5ae11fa6cef09a2476d73b Author: Jakub Sitnicki Date: Wed Sep 17 15:22:05 2025 +0200 selftests/net: Test tcp port reuse after unbinding a socket Exercise the scenario described in detail in the cover letter: 1) socket A: connect() from ephemeral port X 2) socket B: explicitly bind() to port X 3) check that port X is now excluded from ephemeral ports 4) close socket B to release the port bind 5) socket C: connect() from ephemeral port X As well as a corner case to test that the connect-bind flag is cleared: 1) connect() from ephemeral port X 2) disconnect the socket with connect(AF_UNSPEC) 3) bind() it explicitly to port X 4) check that port X is now excluded from ephemeral ports Reviewed-by: Kuniyuki Iwashima Signed-off-by: Jakub Sitnicki Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-2-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni commit d57f4b874946e997be52f5ebb5e0e1dad368c16f Author: Jakub Sitnicki Date: Wed Sep 17 15:22:04 2025 +0200 tcp: Update bind bucket state on port release Today, once an inet_bind_bucket enters a state where fastreuse >= 0 or fastreuseport >= 0 after a socket is explicitly bound to a port, it remains in that state until all sockets are removed and the bucket is destroyed. In this state, the bucket is skipped during ephemeral port selection in connect(). For applications using a reduced ephemeral port range (IP_LOCAL_PORT_RANGE socket option), this can cause faster port exhaustion since blocked buckets are excluded from reuse. The reason the bucket state isn't updated on port release is unclear. Possibly a performance trade-off to avoid scanning bucket owners, or just an oversight. Fix it by recalculating the bucket state when a socket releases a port. To limit overhead, each inet_bind2_bucket stores its own (fastreuse, fastreuseport) state. On port release, only the relevant port-addr bucket is scanned, and the overall state is derived from these. Signed-off-by: Jakub Sitnicki Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-1-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni commit 7c7da8aa3fd69b77e8efaa14b80bddd948547739 Author: Vincent Mailhol Date: Tue Sep 23 15:37:09 2025 +0900 can: dev: turn can_set_static_ctrlmode() into a non-inline function can_set_static_ctrlmode() is declared as a static inline. But it is only called in the probe function of the devices and so does not really benefit from any kind of optimization. Transform it into a "normal" function by moving it to drivers/net/can/dev/dev.c Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-2-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde commit c67732d067860850b767c81736b49f88a946bffb Author: Vincent Mailhol Date: Tue Sep 23 15:37:08 2025 +0900 can: annotate mtu accesses with READ_ONCE() As hinted in commit 501a90c94510 ("inet: protect against too small mtu values."), net_device->mtu is vulnerable to race conditions if it is written and read without holding the RTNL. At the moment, all the writes are done while the interface is down, either in the devices' probe() function or in can_changelink(). So there are no such issues yet. But upcoming changes will allow to modify the MTU while the CAN XL devices are up. In preparation to the introduction of CAN XL, annotate all the net_device->mtu accesses which are not yet guarded by the RTNL with a READ_ONCE(). Note that all the write accesses are already either guarded by the RTNL or are already annotated and thus need no changes. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-1-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 Author: Gao Xiang Date: Tue Sep 16 16:48:51 2025 +0800 erofs: avoid reading more for fragment maps Since all real encoded extents (directly handled by the decompression subsystem) have a sane, limited maximum decoded length (Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied if needed. However, it makes no sense to read more for non-encoded maps, such as fragment extents, since such extents can be huge (up to i_size) and there is no benefit to reading more at this layer. For normal images, it does not really matter, but for crafted images generated by syzbot, excessively large fragment extents can cause read-more to run for an overly long time. Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com Fixes: b44686c8391b ("erofs: fix large fragment handling") Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 1e06a137513dff9835e57f76cff177cb1e2e5475 Author: Marco Crivellari Date: Mon Sep 22 12:24:07 2025 +0200 wifi: libertas: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change add a new WQ_PERCPU flag, to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250922102407.186660-2-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 Author: Ryder Lee Date: Mon Sep 22 22:19:08 2025 +0000 wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz. However, the expected unit is KHz. Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio") Signed-off-by: Ryder Lee Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/ Signed-off-by: Johannes Berg commit 2d6a229ecc2d4458352af431cf5d0382fc40c8cd Merge: 16444ae3f7af91 32be3ca4cf78b3 Author: Johannes Berg Date: Tue Sep 23 09:43:20 2025 +0200 Merge tag 'ath-next-20250922' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.18 Highlights for some specific drivers include: ath10k: Fix connection after GTK rekeying ath12k: Fix Issues in REO RX Queue Updates Handle inactivity STA kickout event And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. ================== Signed-off-by: Johannes Berg commit 670bfe683850cb29957a9d71f997e9774eb24de6 Author: Yu Kuai Date: Tue Sep 23 15:01:01 2025 +0800 blk-mq: fix null-ptr-deref in blk_mq_free_tags() from error path blk_mq_free_tags() can be called after blk_mq_init_tags(), while tags->page_list is still not initialized, causing null-ptr-deref. Fix this problem by initializing tags->page_list at blk_mq_init_tags(), meanwhile, also free tags directly from error path because there is no srcu barrier. Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback") Reported-by: syzbot+5c5d41e80248d610221f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d1b079.a70a0220.1b52b.0000.GAE@google.com/ Signed-off-by: Yu Kuai Signed-off-by: Jens Axboe commit 45c222468d33202c07c41c113301a4b9c8451b8f Author: Filipe Manana Date: Mon Sep 22 12:09:14 2025 +0100 btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a full write barrier, smp_wmb(), but we don't need to, all we need is a smp_mb__after_atomic(). The use of the smp_wmb() is from the old days when we didn't use a bit and used instead an int field in the root to signal if cow is forced. After the int field was changed to a bit in the root's state (flags field), we forgot to update the memory barrier in create_pending_snapshot() to smp_mb__after_atomic(), but we did the change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root"). On the reader side, in should_cow_block(), we also use the counterpart smp_mb__before_atomic() which generates further confusion. So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't even need any barrier at all since create_pending_snapshot() is called in the critical section of a transaction commit and therefore no one can concurrently join/attach the transaction, or start a new one, until the transaction is unblocked. By the time someone starts a new transaction and enters should_cow_block(), a lot of implicit memory barriers already took place by having acquired several locks such as fs_info->trans_lock and extent buffer locks on the root node at least. Nevertlheless, for consistency use smp_mb__after_atomic() after setting the force cow bit in create_pending_snapshot(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a929904cf73b650f49cc60941e6e618240096fcb Author: David Sterba Date: Wed Sep 17 19:53:56 2025 +0200 btrfs: add unlikely annotations to branches leading to transaction abort The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen. Transaction abort is one such error, the btrfs_abort_transaction() inlines code to check the state and print a warning, this ought to be out of the hot path. The most common pattern is when transaction abort is called after checking a return value and the control flow leads to a quick return. In other cases it may not be necessary to add unlikely() e.g. when the function returns anyway or the control flow is not changed noticeably. Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit cc53bd2085c8fa7b199a9a8e10e634b62a6d3fa8 Author: David Sterba Date: Wed Sep 17 19:53:55 2025 +0200 btrfs: add unlikely annotations to branches leading to EIO The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen, where EIO is one of them. Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit 9264d004a6c9788354b45553b9e4fe910e71b387 Author: David Sterba Date: Wed Sep 17 19:53:54 2025 +0200 btrfs: add unlikely annotations to branches leading to EUCLEAN The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen, where EUCLEAN (a corruption) is one of them. Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit 4ca6f24a52c4e94bd09f70cf132d0a38db7996b0 Author: Sun YangKai Date: Mon Sep 22 19:30:07 2025 +0800 btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions Trivial pattern for the auto freeing with goto -> return conversions if possible. The following cases are considered trivial in this patch: 1. Cases where there are no operations between btrfs_free_path() and the function returns. 2. Cases where only simple cleanup operations (such as kfree(), kvfree(), clear_bit(), and fs_path_free()) are present between btrfs_free_path() and the function return. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit c9ff83963a49a413b8ace36de21f61b47f461b98 Author: Johannes Thumshirn Date: Thu Sep 18 12:51:19 2025 +0200 btrfs: zoned: don't fail mount needlessly due to too many active zones Previously BTRFS did not look at a device's reported max_open_zones limit, but starting with commit 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones"), zoned BTRFS limited the number of concurrently used block-groups to the number of max_open_zones a device reported, if it hadn't already reported a number of max_active_zones. Starting with commit 04147d8394e8 the number of open zones is treated the same way as active zones. But this leads to mount failures on filesystems which have been used before 04147d8394e8 because too many zones are in an open state. Ignore the new limitations on these filesystems, so zones can be finished or evacuated. Reported-by: Yuwei Han Link: https://lore.kernel.org/all/2F48A90AF7DDF380+1790bcfd-cb6f-456b-870d-7982f21b5eae@bupt.moe/ Fixes: 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones") Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit f08d7147da5fb5ab4c26199dcbebb614283c99bb Author: Miquel Sabaté Solà Date: Fri Sep 19 16:58:15 2025 +0200 btrfs: use kmalloc_array() for open-coded arithmetic in kmalloc() As pointed out in the documentation, calling 'kmalloc' with open-coded arithmetic can lead to unfortunate overflows and this particular way of using it has been deprecated. Instead, it's preferred to use 'kmalloc_array' in cases where it might apply so an overflow check is performed. Note this is an API cleanup and is not fixing any overflows because in all cases the multipliers are bounded small numbers derived from number of items in leaves/nodes. Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98077f7f2180fa996710452564ebe71adc66af59 Author: Qu Wenruo Date: Tue Sep 9 12:38:47 2025 +0930 btrfs: enable experimental bs > ps support With all the preparation patches, we're able to finally enable btrfs block size (sector size) larger than page size support and give it a full fstests run. And obviously this new feature is hidden behind experimental flags, and should not be considered as a core feature yet as btrfs' default block size is still 4K. But this is still a feature that will shine in the future where 16K block sized device are widely adopted. For now there are some features explicitly disabled: - Direct IO This is the most complex part to support, the root reason is we can not control the pages of iov iter passed in. User space programs can only ensure the virtual addresses are contiguous, but have no control on their physical addresses. Our bs > ps support heavily relies on large folios, and direct IO memory can easily break it. So direct IO is disabled and will always fall back to buffered IO. - RAID56 In theory we can convert RAID56 to use large folios, but it will need to be converted back to page based if we want to support direct IO in the future. So just reject it for now. - Encoded send - Encoded read Both are utilizing btrfs_encoded_read_regular_fill_pages(), and send is utilizing vmallocated memory. Unfortunately for vmallocated memory we can not guarantee the minimal folio order. For send, it will just always fallback to regular writes, which reads from page cache and will follow the existing folio order requirement. - Encoded write Encoded write itself is allocating pages by themselves, and we can easily change it to follow the minimal order. But since encoded read is already disabled, there is no need to only enable encoded write. Finally just like what we did for bs < ps support in the past, add a warning message for bs > ps mounts. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e9bed72e883e7c6e6a2057ea29fcd4ba69225f91 Author: Qu Wenruo Date: Mon Sep 15 18:33:50 2025 +0930 btrfs: add extra ASSERT()s to catch unaligned bios Btrfs uses btrfs_bio to handle read/write of logical address, for the incoming bs > ps support, btrfs has extra requirements: - One folio must contain at least one fs block - No fs block can cross folio boundaries This requirement is not hard to maintain, thanks to the address space's minimal folio order. But not all btrfs bios are generated through address space, e.g. compression and scrub. To catch possible unaligned bios, introduce a helper, assert_bbio_alginment(), for each btrfs_bio in btrfs_submit_bbio(). This will check the following things: - bv_offset is aligned to block size - bv_len is aligned to block size With a btrfs bio passing above checks, unless it's empty it will ensure the requirements for bs > ps support. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 67378b754608a3524d125bfa5744508a49fe48be Author: Qu Wenruo Date: Mon Sep 15 14:29:42 2025 +0930 btrfs: fix symbolic link reading when bs > ps [BUG DURING BS > PS TEST] When running the following script on a btrfs whose block size is larger than page size, e.g. 8K block size and 4K page size, it will trigger a kernel BUG: # mkfs.btrfs -s 8k $dev # mount $dev $mnt # mkdir $mnt/dir # ln -s dir $mnt/link # ls $mnt/link The call trace looks like this: BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing BTRFS info (device dm-2): checking UUID tree BTRFS info (device dm-2): enabling ssd optimizations BTRFS info (device dm-2): enabling free space tree ------------[ cut here ]------------ kernel BUG at /home/adam/linux/include/linux/highmem.h:275! Oops: invalid opcode: 0000 [#1] SMP CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G OE 6.17.0-rc4-custom+ #283 PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs] Call Trace: btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] filemap_read_folio+0x37/0xe0 do_read_cache_folio+0x94/0x3e0 __page_get_link.isra.0+0x20/0x90 page_get_link+0x16/0x40 step_into+0x69b/0x830 path_lookupat+0xa7/0x170 filename_lookup+0xf7/0x200 ? set_ptes.isra.0+0x36/0x70 vfs_statx+0x7a/0x160 do_statx+0x63/0xa0 __x64_sys_statx+0x90/0xe0 do_syscall_64+0x82/0xae0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Please note bs > ps support is still under development and the enablement patch is not even in btrfs development branch. [CAUSE] Btrfs reuses its data folio read path to handle symbolic links, as the symbolic link target is stored as an inline data extent. But for newly created inodes, btrfs only set the minimal order if the target inode is a regular file. Thus for above newly created symbolic link, it doesn't properly respect the minimal folio order, and triggered the above crash. [FIX] Call btrfs_set_inode_mapping_order() unconditionally inside btrfs_create_new_inode(). For symbolic links this will fix the crash as now the folio will meet the minimal order. For regular files this brings no change. For directory/bdev/char and all the other types of inodes, they won't go through the data read path, thus no effect either. Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL") Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 5fbaae4b8567b19cd65b847043588e10af86eb60 Author: Qu Wenruo Date: Fri Sep 12 13:12:54 2025 +0930 btrfs: prepare scrub to support bs > ps cases This involves: - Migrate scrub_stripe::pages[] to folios[] - Use btrfs_alloc_folio_array() and folio_put() to alloc above array. - Migrate scrub_stripe_get_kaddr() and scrub_stripe_get_paddr() to use folio interfaces - Migrate raid56_parity_cache_data_pages() to raid56_parity_cache_data_folios() Since scrub is the only caller still using pages. This helper will copy the folio array contents into rbio::stripe_pages, with sector uptodate flags updated. And a new ASSERT() to make sure bs > ps cases will not hit this path. Since most scrub code is based on kaddr/paddr, the migration itself is pretty straightforward. And since we're here, also move the loop to set the stripe_sectors[].uptodate out of the copy loop. As we always mark all the sectors as uptodate for the data stripe, it's easier to do in one go, other than doing it inside the copy loop. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e88cb48e6709d73fe9f82f2b56a43ac9ba2a1fe2 Author: Qu Wenruo Date: Mon Sep 8 18:36:37 2025 +0930 btrfs: prepare zlib to support bs > ps cases This involves converting the following functions to use correct folio sizes/shifts: - zlib_compress_folios() - zlib_decompress_bio() There is a special handling for s390 hardware acceleration. With bs > ps cases, we can go with 16K block size on s390 (which uses fixed 4K page size). In that case we do not need to do the buffer copy as our folio is large enough for hardware acceleration. So factor out the s390 specific and folio size check into a helper, need_special_buffer(). Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4fd188a4fe5877a95e4812617a6c6ae66644427b Author: Qu Wenruo Date: Mon Sep 8 18:21:47 2025 +0930 btrfs: prepare lzo to support bs > ps cases This involves converting the following functions to use correct folio sizes/shifts: - copy_compress_data_to_page() - lzo_compress_folios() - lzo_decompress_bio() Just like zstd, lzo has some extra incorrect usage of kmap_local_folio() that the offset is always 0. This will not handle HIGHMEM large folios correctly, but those cases are already rejected explicitly so it should not cause problems when bs > ps support is enabled. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a6452b85b3e55aafceb84c25784f25f63ba620b0 Author: Qu Wenruo Date: Mon Sep 8 16:28:16 2025 +0930 btrfs: prepare zstd to support bs > ps cases This involves converting the following functions to use proper folio sizes/shifts: - zstd_compress_folios() - zstd_decompress_bio() The function zstd_decompress() is already using block size correctly without using page size, thus it needs no modification. And since zstd compression is calling kmap_local_folio(), the existing code cannot handle large folios with HIGHMEM, as kmap_local_folio() requires us to handle one page range each time. I do not really think it's worth to spend time on some feature that will be deprecated eventually. So here just add an extra explicit rejection for bs > ps with HIGHMEM feature enabled kernels. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c2ffb1ec1a7cfc754c1d2fe66d317f0aa4c0f1e6 Author: Qu Wenruo Date: Mon Sep 8 16:07:57 2025 +0930 btrfs: prepare compression folio alloc/free for bs > ps cases This includes the following preparation for bs > ps cases: - Always alloc/free the folio directly if bs > ps This adds a new @fs_info parameter for btrfs_alloc_compr_folio(), thus affecting all compression algorithms. For btrfs_free_compr_folio() it needs no parameter for now, as we can use the folio size to skip the caching part. For now the change is just to passing a @fs_info into the function, all the folio size assumption is still based on page size. - Properly zero the last folio in compress_file_range() Since the compressed folios can be larger than a page, we need to properly zero the whole folio. - Use correct folio size for btrfs_add_compressed_bio_folios() Instead of page size, use the correct folio size. - Use correct folio size/shift for btrfs_compress_filemap_get_folio() As we are not only using simple page sized folios anymore. - Use correct folio size for btrfs_decompress() There is an ASSERT() making sure the decompressed range is no larger than a page, which will be triggered for bs > ps cases. - Skip readahead for compressed pages Similar to subpage cases. - Make btrfs_alloc_folio_array() to accept a new @order parameter - Add a helper to calculate the minimal folio size All those changes should not affect the existing bs <= ps handling. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7b26da407420e5054e3f06c5d13271697add9423 Author: Qu Wenruo Date: Fri Sep 19 14:33:23 2025 +0930 btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() [BUG] With my local branch to enable bs > ps support for btrfs, sometimes I hit the following ASSERT() inside submit_one_sector(): ASSERT(block_start != EXTENT_MAP_HOLE); Please note that it's not yet possible to hit this ASSERT() in the wild yet, as it requires btrfs bs > ps support, which is not even in the development branch. But on the other hand, there is also a very low chance to hit above ASSERT() with bs < ps cases, so this is an existing bug affect not only the incoming bs > ps support but also the existing bs < ps support. [CAUSE] Firstly that ASSERT() means we're trying to submit a dirty block but without a real extent map nor ordered extent map backing it. Furthermore with extra debugging, the folio triggering such ASSERT() is always larger than the fs block size in my bs > ps case. (8K block size, 4K page size) After some more debugging, the ASSERT() is trigger by the following sequence: extent_writepage() | We got a 32K folio (4 fs blocks) at file offset 0, and the fs block | size is 8K, page size is 4K. | And there is another 8K folio at file offset 32K, which is also | dirty. | So the filemap layout looks like the following: | | "||" is the filio boundary in the filemap. | "//| is the dirty range. | | 0 8K 16K 24K 32K 40K | |////////| |//////////////////////||////////| | |- writepage_delalloc() | |- find_lock_delalloc_range() for [0, 8K) | | Now range [0, 8K) is properly locked. | | | |- find_lock_delalloc_range() for [16K, 40K) | | |- btrfs_find_delalloc_range() returned range [16K, 40K) | | |- lock_delalloc_folios() locked folio 0 successfully | | | | | | The filemap range [32K, 40K) got dropped from filemap. | | | | | |- lock_delalloc_folios() failed with -EAGAIN on folio 32K | | | As the folio at 32K is dropped. | | | | | |- loops = 1; | | |- max_bytes = PAGE_SIZE; | | |- goto again; | | | This will re-do the lookup for dirty delalloc ranges. | | | | | |- btrfs_find_delalloc_range() called with @max_bytes == 4K | | | This is smaller than block size, so | | | btrfs_find_delalloc_range() is unable to return any range. | | \- return false; | | | \- Now only range [0, 8K) has an OE for it, but for dirty range | [16K, 32K) it's dirty without an OE. | This breaks the assumption that writepage_delalloc() will find | and lock all dirty ranges inside the folio. | |- extent_writepage_io() |- submit_one_sector() for [0, 8K) | Succeeded | |- submit_one_sector() for [16K, 24K) Triggering the ASSERT(), as there is no OE, and the original extent map is a hole. Please note that, this also exposed the same problem for bs < ps support. E.g. with 64K page size and 4K block size. If we failed to lock a folio, and falls back into the "loops = 1;" branch, we will re-do the search using 64K as max_bytes. Which may fail again to lock the next folio, and exit early without handling all dirty blocks inside the folio. [FIX] Instead of using the fixed size PAGE_SIZE as @max_bytes, use @sectorsize, so that we are ensured to find and lock any remaining blocks inside the folio. And since we're here, add an extra ASSERT() to before calling btrfs_find_delalloc_range() to make sure the @max_bytes is at least no smaller than a block to avoid false negative. Cc: stable@vger.kernel.org # 5.15+ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 62701f419027711b9c18a1fc1c20714ceeea9e81 Author: Filipe Manana Date: Fri Sep 19 17:46:05 2025 +0100 btrfs: remove pointless key offset setup in create_pending_snapshot() There's no point in setting the key's offset to (u64)-1 since we never use it before setting it to the current transaction's ID. So remove the assignment of (u64)-1 to the key's offset and move the remainder of the key initialization close to where it's used. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit db524fd9802f7ec3281a7f1fdae66c67c9525ba3 Author: Filipe Manana Date: Fri Sep 19 09:55:12 2025 +0100 btrfs: annotate btrfs_is_testing() as unlikely and make it return bool We can annotate btrfs_is_testing() as unlikely since that's the most expected scenario and it's desirable for the compiler to optimize for the case we are not running the self tests. So add the annotation to btrfs_is_testing() and while at it also make it return bool instead of int. Also make two of the existing callers use btrfs_is_testing() directly instead of storing its result in a local variable. On x86_64 with Debian's gcc 14.2.0-19 this resulted in a very tiny object code reduction. Before this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1913263 161567 15592 2090422 1fe5b6 fs/btrfs/btrfs.ko After this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1913257 161567 15592 2090416 1fe5b0 fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f07575bab632af8d665c8cc95be0e83ca5d3bd80 Author: Filipe Manana Date: Fri Sep 19 09:16:20 2025 +0100 btrfs: make the rule checking more readable for should_cow_block() It's quite hard and unreadable the way the rule checks are organized in should_cow_block(). We have a single if statement that returns 0 (false) and it checks several conditions, with one them being a negated compound condition which is particularly hard to reason immediately. Improve on this by using multiple if statements, each checking a single condition and returning immediately. Also change the return type from an integer to a boolean, since all we need is to return true or false. At least on x86_64 with Debian's gcc 14.2.0-19, this also reduces the object code size by 64 bytes. Before this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1913327 161567 15592 2090486 1fe5f6 fs/btrfs/btrfs.ko After this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1913263 161567 15592 2090422 1fe5b6 fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7ff7b0d76e5478c319ab2066b287e156968231f Author: Filipe Manana Date: Thu Sep 18 13:29:16 2025 +0100 btrfs: simplify inline extent end calculation at replay_one_extent() There is no need to store the extent's ram_bytes in two variables, further more one of them, named 'size', is used only for the extent's end offset calculation. So remove the 'size' variable and use 'nbytes' only. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a35b3dd59bf6fe2bf3c2777bdde623d722caa68c Author: Filipe Manana Date: Thu Sep 18 12:58:53 2025 +0100 btrfs: fix comment about nbytes increase at replay_one_extent() The comment is wrong about the part where it says a prealloc extent does not contribute to an inode's nbytes - it does. Only holes don't contribute and that's what we are checking for, as prealloc extents always have a disk_bytenr different from 0. So fix the comment and re-organize the code to not set nbytes twice and set it to the extent item's number of bytes only if it doesn't represent a hole - in case it's a hole we have already initialized nbytes to 0 when we declared it. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b Author: Qu Wenruo Date: Thu Sep 18 08:40:45 2025 +0930 btrfs: return any hit error from extent_writepage_io() Since the support of bs < ps support, extent_writepage_io() will submit multiple blocks inside the folio. But if we hit error submitting one sector, but the next sector can still be submitted successfully, the function extent_writepage_io() will still return 0. This will make btrfs to silently ignore the error without setting error flag for the filemap. Fix it by recording the first error hit, and always return that value. Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed") Reviewed-by: Daniel Vacek Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 5afe85b771eefe91891cca332cb916f8da6d48e1 Author: Filipe Manana Date: Tue Sep 16 16:33:00 2025 +0100 btrfs: mark leaf space and overflow checks as unlikely on insert and extension We have several sanity checks when inserting or extending items in a btree that verify we didn't overflow the leaf or access a slot beyond the last one. These are cases that are never expected to be hit so mark them as unlikely, allowing the compiler to potentially generate better code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b0e30e373e3752d4a59cb0f2b6a4aa8b3b54f041 Author: Filipe Manana Date: Tue Sep 16 16:09:50 2025 +0100 btrfs: mark as unlikely not uptodate extent buffer checks when navigating btrees We expect that after attempting to read an extent buffer we had no errors therefore the extent buffer is up to date, so mark the checks for a not up to date extent buffer as unlikely and allow the compiler to pontentially generate better code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8f0534ec96e3cbba2ecefe560a482382198c044f Author: Filipe Manana Date: Tue Sep 16 15:50:49 2025 +0100 btrfs: mark extent buffer alignment checks as unlikely We are not expecting to ever fail the extent buffer alignment checks, so mark them as unlikely to allow the compiler to potentially generate more optimized code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6a9e1d1a65fef95fcf3097a75ad399f38c7ecb64 Author: Filipe Manana Date: Tue Sep 16 12:13:39 2025 +0100 btrfs: store and use node size in local variable in check_eb_alignment() Instead of dereferencing fs_info every time we need to access the node size, store in a local variable to make the code less verbose and avoid a line split too. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 26baec69ac85d6ce899ae9c43827250551e494f2 Author: Filipe Manana Date: Mon Sep 15 16:23:04 2025 +0100 btrfs: print-tree: print key types as human readable strings Looking at a leaf dump from the kernel's print-tree implementation is not so friendly to analyze since key types are printed as numbers. Improve on this by printing key types as strings that are a diminutive of the macro names for key types, just like we do in btrfs-progs. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 00b7eaaaa5ac1d686f8f5edc2f999710304236dc Author: Filipe Manana Date: Mon Sep 15 15:23:43 2025 +0100 btrfs: print-tree: move code for processing file extent item into helper The code for processing file extent items is quite large and it's better to have it in a dedicated helper rather than in a huge switch statement, just like we do in btrfs-progs. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit caac17073760d30a879517145f033a72eee507ae Author: Filipe Manana Date: Mon Sep 15 11:54:49 2025 +0100 btrfs: print-tree: print compression type for file extent items We are not printing anything about the compression type, so add that useful information in the same format as btrfs-progs. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c1b9a4782bc6b9169be6b721b161781696cbd1a7 Author: Filipe Manana Date: Mon Sep 15 11:37:34 2025 +0100 btrfs: print-tree: print correct inline extent data size We are advertising the ram_bytes of an inline extent as its data size, but that is not true for compressed extents. The ram_bytes corresponds to the uncompressed data size while the data size (compressed data) is given by btrfs_file_extent_inline_item_len(). So fix this and print both values in the same format as in btrfs-progs. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4dc1c3d0ae6fbfaf8ce5727d1ae098275eb276c6 Author: Filipe Manana Date: Mon Sep 15 11:09:10 2025 +0100 btrfs: print-tree: print range information for extent csum items Currently we don't print anything for extent csum items other than the generic line with the key, item offset and item size. While one can still determine the range the extent csum covers by doing a few simple computations, it makes it more time consuming to analyse a leaf dump. So add a line that prints information about the range covered by the checksum using the same format as btrfs-progs. This is useful when debugging log tree issues since we log extent csum items for new extents. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7d2197b5dc0cd02e9758fd4dd0d1e7e3707dfbe7 Author: Filipe Manana Date: Fri Sep 12 17:43:46 2025 +0100 btrfs: print-tree: print information about dir log items We currently don't print information about dir log items (other than the key, item offset and item size), which is useful to look at when debugging problems with a log tree. So print their specific information (currently they only have an end index number) in a format similar to btrfs-progs. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7317555f4553aaec9dc732e24c88b8258b3c9deb Author: Filipe Manana Date: Fri Sep 12 17:25:12 2025 +0100 btrfs: print-tree: print information about inode extref items Currently we ignore inode extref items, we just print their key, item offset in the leaf and their size, no information about their content like the index number, parent inode, name length and name. Improve on this by printing the index, parent and name length in the same format as btrfs-progs. Note that we don't print the name, as that would require some processing and escaping like we do in btrfs-progs, and that could expose sensitive information for some users in case they share their dmesg/syslog and it contains a leaf dump. So for now leave names out. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cee3aa138724fd354acd5947d96a3d295b606899 Author: Filipe Manana Date: Thu Sep 11 17:36:28 2025 +0100 btrfs: print-tree: print information about inode ref items Currently we ignore inode ref items, we just print their key, item offset in the leaf and their size, no information about their content like the index number, name length and name. Improve on this by printing the index and name length in the same format as btrfs-progs. Note that we don't print the name, as that would require some processing and escaping like we do in btrfs-progs, and that could expose sensitive information for some users in case they share their dmesg/syslog and it contains a leaf dump. So for now leave names out. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 93f818e62a081c707e6833f3ba2b7fa25c90199c Author: Filipe Manana Date: Wed Sep 10 17:10:37 2025 +0100 btrfs: print-tree: print dir items for dir index and xattr keys too Currently we only print the dir items for BTRFS_DIR_ITEM_KEY keys, but we also have dir items for BTRFS_DIR_INDEX_KEY and BTRFS_XATTR_ITEM_KEY keys too. So print them for those keys too. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 96fb032238d9bede9d3ade60047b8d604fcb4363 Author: Filipe Manana Date: Wed Sep 10 16:44:15 2025 +0100 btrfs: print-tree: print more information about dir items Currently we only print the object id component of the location key from a dir item and the flags. We are missing the whole key, transid and the name and data lengths. We are also ignoring the fact that we can have multiple dir item objects encoded in a single item for a BTRFS_DIR_ITEM_KEY key, so what we print is only for the first item. Improve on this by iterating on all dir items and print the missing information. This is done with the same format as in btrfs-progs, what we miss is printing the names and data since not only that would require some processing and escaping like in btrfs-progs, but it would also reveal information that may be sensitive and users may not want to share that in case that get a leaf dumped in dmesg. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ac9affd89949cb7680e29fdb3f5d6d41e4997cd6 Author: Filipe Manana Date: Wed Sep 10 15:11:41 2025 +0100 btrfs: print-tree: print missing fields for inode items We are not dumping a lot of fields for an inode item which are useful for debugging whenever we dump a leaf (log replay failure for example), so add them and make it as close as possible to the print tree implementation in btrfs-progs (things like converting timespecs to human readable dates and converting flags to strings are missing since they are not so practical to do in the kernel). Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit aab9458b9f0019e97fae394c2d6d9d1a03addfb3 Author: Qu Wenruo Date: Tue Sep 16 08:34:05 2025 +0930 btrfs: tree-checker: add inode extref checks Like inode refs, inode extrefs have a variable length name, which means we have to do a proper check to make sure no header nor name can exceed the item limits. The check itself is very similar to check_inode_ref(), just a different structure (btrfs_inode_extref vs btrfs_inode_ref). Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0dc93e465289d3eee30abd4710bac8d9f475311f Author: Filipe Manana Date: Mon Sep 8 12:19:29 2025 +0100 btrfs: send: index backref cache by node number instead of by sector number We now have a nodesize_bits member in fs_info so we can index an extent buffer in the backref cache by node number instead of by sector number. While this allows for a denser index space with the possibility of using less maple tree nodes, in practice it's unlikely to hit such benefits since we currently limit the maximum number of keys in the cache to 128, so unless all extent buffers are contiguous we are unlikely to see a memory usage reduction in the backing maple tree due to fewer nodes. Nevertheless it doesn't cost anything to index by node number and it's more logical. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2753e49176240f21e4bb10e03514f99e732704bb Author: Filipe Manana Date: Fri Sep 5 12:58:19 2025 +0100 btrfs: dump detailed info and specific messages on log replay failures Currently debugging log replay failures can be harder than needed, since all we do now is abort a transaction, which gives us a line number, a stack trace and an error code. But that is most of the times not enough to give some clue about what went wrong. So add a new helper to abort log replay and provide contextual information: 1) Dump the current leaf of the log tree being processed and print the slot we are currently at and the key at that slot; 2) Dump the current subvolume tree leaf if we have any; 3) Print the current stage of log replay; 4) Print the id of the subvolume root associated with the log tree we are currently processing (as we can have multiple); 5) Print some error message to mention what we were trying to do when we got an error. Replace all transaction abort calls (btrfs_abort_transaction()) with the new helper btrfs_abort_log_replay(), which besides dumping all that extra information, it also aborts the current transaction. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5a0565cad3ef7cbf4cf43d1dd1e849b156205292 Author: Filipe Manana Date: Wed Sep 3 17:43:04 2025 +0100 btrfs: abort transaction if we fail to update inode in log replay dir fixup If we fail to update the inode at link_to_fixup_dir(), we don't abort the transaction and propagate the error up the call chain, which makes it hard to pinpoint the error to the inode update. So abort the transaction if the inode update call fails, so that if it happens we known immediately. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0b7453b7a1c1f8aa1570da2d0cc81bf7691eb5f1 Author: Filipe Manana Date: Wed Sep 3 17:39:24 2025 +0100 btrfs: abort transaction if we fail to find dir item during log replay At __add_inode_ref() if we get an error when trying to lookup a dir item we don't abort the transaction and propagate the error up the call chain, so that somewhere else up in the call chain the transaction is aborted. This however makes it hard to know that the failure comes from looking up a dir item, so add a transaction abort in case we fail there, so that we immediately pinpoint where the problem comes from during log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e41c5e611a65799747709b8fed461dd07647c40d Author: Filipe Manana Date: Wed Sep 3 12:10:01 2025 +0100 btrfs: remove pointless inode lookup when processing extrefs during log replay At unlink_extrefs_not_in_log() we do an inode lookup of the directory but we already have the directory inode accessible as a function argument, so the lookup is redudant. Remove it and use the directory inode passed in as an argument. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bd9c063e6ff2657ae89de9838fd792c1157ec96c Author: Filipe Manana Date: Tue Sep 2 18:08:15 2025 +0100 btrfs: stop passing inode object IDs to __add_inode_ref() in log replay There's no point in passing the inode and parent inode object IDs to __add_inode_ref() and its helpers because we can get them by calling btrfs_ino() against the inode and the directory inode, and we pass both inodes to __add_inode_ref() and its helpers. So remove the object IDs parameters to reduce arguments passed and to make things less confusing. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1ebeee283a2ac8ea29a705d7f03a15e3aae30f22 Author: Filipe Manana Date: Tue Sep 2 12:16:17 2025 +0100 btrfs: add path for subvolume tree changes to struct walk_control While replaying log trees we need to do searches and updates to subvolume trees and for that we use a path that we allocate in replay_one_buffer() and then pass it as a parameter to other functions deeper in the log replay call chain. Instead of passing it as parameter, add it to struct walk_control since we pass a pointer to that structure for every log replay function. This reduces the number of arguments passed to the functions and it will be needed and important for an upcoming changes that improves error reporting for log replay. Also name the new filed in struct walk_control to 'subvol_path' - while that is longer to type, the naming makes it clear it's used for subvolume tree operations since many of the log replay functions operate both on subvolume and log trees, and for the log tree searches we have struct walk_control::log_leaf to also make it obvious it's an extent buffer for a log tree extent buffer. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f9c02e4b525d766bebfcbeac1b25b03aacfe62f1 Author: Filipe Manana Date: Tue Sep 2 17:08:19 2025 +0100 btrfs: remove redundant path release when overwriting item during log replay At overwrite_item() we have a redundant btrfs_release_path() just before failing with -ENOMEM, as the caller who passed in the path will free it and therefore also release any refcounts and locks on the extent buffers of the path. So remove it. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9bdfa3eddb67e73f57d1e527e1ba2dcca3bd08c4 Author: Filipe Manana Date: Mon Sep 1 17:03:46 2025 +0100 btrfs: remove redundant path release when processing dentry during log replay At replay_one_one() we have a redundant btrfs_release_path() just before calling insert_one_name(), as some lines above we have already released the path with another btrfs_release_path() call. So remove it. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f366722f3370dd561d45e667484c458245977e79 Author: Filipe Manana Date: Mon Sep 1 16:37:05 2025 +0100 btrfs: avoid unnecessary path allocation when replaying a dir item There's no need to allocate 'fixup_path' at replay_one_dir_item(), as the path passed as an argument is unused by the time link_to_fixup_dir() is called (replay_one_name() releases the path before it returns). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b343047c1a08779efb0d2691a8c6391318025cc6 Author: Filipe Manana Date: Mon Sep 1 15:51:19 2025 +0100 btrfs: avoid path allocations when dropping extents during log replay We can avoid a path allocation in the btrfs_drop_extents() calls we have at replay_one_extent() and replay_one_buffer() by passing the path we already have in those contextes as it's unused by the time they call btrfs_drop_extents(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 29d9c5e0370593cec8298601ab3e9ce29799fb6f Author: Filipe Manana Date: Mon Sep 1 12:43:42 2025 +0100 btrfs: avoid unnecessary path allocation at fixup_inode_link_count() There's no need to allocate a path as our single caller already has a path that we can use. So pass the caller's path and use it. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2ac70946621ff3d90eb84d2e3b74563f4154f24c Author: Filipe Manana Date: Mon Sep 1 12:13:48 2025 +0100 btrfs: add current log leaf, key and slot to struct walk_control A lot of the log replay functions get passed the current log leaf being processed as well as the current slot and the key at that slot. Instead of passing them as parameters, add them to struct walk_control so that we reduce the numbers of parameters. This is also going to be needed to further changes that improve error reporting during log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2a13cfc949e591702f1288d62c691099c67e04ca Author: Filipe Manana Date: Fri Aug 29 16:46:15 2025 +0100 btrfs: use the inode item boolean everywhere in overwrite_item() We have this boolean 'inode_item' to tell if we are processing an inode item key and we use it in a couple of places while in another two places we open code by checking if the key type matches the inode item type. Make this consistent and use the boolean everywhere. Also rename it from 'inode_item' to 'is_inode_item', which makes it more clear that it's a boolean and not an instance of struct btrfs_inode_item, and make it const too. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6cb7f0b8c9b0d6a35682335fea88bd26f089306f Author: Filipe Manana Date: Thu Aug 28 17:46:18 2025 +0100 btrfs: use level argument in log tree walk callback replay_one_buffer() We already have the extent buffer's level in an argument, there's no need to first ensure the extent buffer's data is loaded (by calling btrfs_read_extent_buffer()) and then call btrfs_header_level() to check the level. So use the level argument and do the check before calling btrfs_read_extent_buffer(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c2ef817b285fb893a2a7b410e2cdb46f9badf06b Author: Filipe Manana Date: Thu Aug 28 17:20:24 2025 +0100 btrfs: use level argument in log tree walk callback process_one_buffer() We already have the extent buffer's level in an argument, there's no need to call btrfs_header_level(). So use the level argument and make the code shorter. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 266967c0e225fe164819fa655a0829db8506ddde Author: Filipe Manana Date: Thu Aug 28 17:04:40 2025 +0100 btrfs: pass walk_control structure to overwrite_item() Instead of passing the transaction and subvolume root as arguments to overwrite_item(), pass the walk_control structure as we can grab them from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit aa5b6635b0e6e059badf8f16a431c5647105383e Author: Filipe Manana Date: Thu Aug 28 16:40:48 2025 +0100 btrfs: pass walk_control structure to drop_one_dir_item() and helpers Instead of passing the transaction as an argument to drop_one_dir_item() and its helpers (link_to_fixup_dir() and unlink_inode_for_log_replay()), pass the walk_control structure as we can access the transaction from it and the subvolume root. This is going to be needed by an incoming change that improves error reporting for log replay and also reduces the number of arguments passed to link_to_fixup_dir(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 744e0cebb4fa51fcca2d9d916dd3a8d353e2e6d1 Author: Filipe Manana Date: Thu Aug 28 13:54:40 2025 +0100 btrfs: pass walk_control structure to replay_one_dir_item() and replay_one_name() Instead of passing the transaction and subvolume root and log tree as arguments, pass the walk_control structure as we can grab all of those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 44463eb0799226e60c8ff358da78e33edac83ee5 Author: Filipe Manana Date: Thu Aug 28 13:11:17 2025 +0100 btrfs: pass walk_control structure to add_inode_ref() and helpers Instead of passing the transaction, subvolume root and log tree as arguments to add_inode_ref() and its helpers (__add_inode_ref(), unlink_refs_not_in_log(), unlink_extrefs_not_in_log() and unlink_old_inode_refs()), pass the walk_control structure as we can access all of those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c7da72022bb2cfeb21951b875db1f029ff236a72 Author: Filipe Manana Date: Thu Aug 28 13:05:52 2025 +0100 btrfs: pass walk_control structure to replay_one_extent() Instead of passing the transaction and subvolume root as arguments to replay_one_extent(), pass the walk_control structure as we can grab all of those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b150f1c32138d6cdf1e6330521a5bbff3cdd9018 Author: Filipe Manana Date: Wed Aug 27 16:27:57 2025 +0100 btrfs: pass walk_control structure to check_item_in_log() Instead of passing the transaction and log tree as arguments to check_item_in_log(), pass the walk_control structure as we can grab those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Notice that a NULL log root argument to check_item_in_log() makes it unconditionally delete a directory entry, so since the walk_control always has a non-NULL log root, we add an extra boolean to check_item_in_log() to tell it if it should unconditionally delete a directory entry, preserving the behaviour and also making it a bit more clear. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 82d1db6f465748d914cc95fb550ed786119f2925 Author: Filipe Manana Date: Wed Aug 27 16:10:39 2025 +0100 btrfs: pass walk_control structure to replay_dir_deletes() Instead of passing the transaction, subvolume root and log tree as arguments to replay_dir_deletes(), pass the walk_control structure as we can grab all of those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. This also requires changing fixup_inode_link_counts() and fixup_inode_link_count() to take that structure as an argument since fixup_inode_link_count() makes a call to replay_dir_deletes(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 94a5ac668a49c4fc1bd8e35a3c717ba0ae9f7cf8 Author: Filipe Manana Date: Wed Aug 27 15:48:49 2025 +0100 btrfs: move up the definition of struct walk_control In upcoming changes we need to pass struct walk_control as an argument to replay_dir_deletes() and link_to_fixup_dir() so we need to move its definition above the prototypes of those functions. So move it up right below the enum that defines log replay stages and before any functions and function prototypes are declared. Also fixup the comments while moving it so that they comply with the preferred code style (capitalize the first word in a sentence, end sentences with punctuation, makes lines wider and closer to the 80 characters limit). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7790a882ca6bfe24392080605e5ba19f138ac29d Author: Filipe Manana Date: Wed Aug 27 15:24:08 2025 +0100 btrfs: pass walk_control structure to replay_xattr_deletes() Instead of passing the transaction, subvolume root and log tree as arguments to replay_xattr_deletes(), pass the walk_control structure as we can grab all of those from the structure. This reduces the number of arguments passed and it's going to be needed by an incoming change that improves error reporting for log replay. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 Author: Filipe Manana Date: Wed Aug 27 12:10:28 2025 +0100 btrfs: always drop log root tree reference in btrfs_replay_log() Currently we have this odd behaviour: 1) At btrfs_replay_log() we drop the reference of the log root tree if the call to btrfs_recover_log_trees() failed; 2) But if the call to btrfs_recover_log_trees() did not fail, we don't drop the reference in btrfs_replay_log() - we expect that btrfs_recover_log_trees() does it in case it returns success. Let's simplify this and make btrfs_replay_log() always drop the reference on the log root tree, not only this simplifies code as it's what makes sense since it's btrfs_replay_log() who grabbed the reference in the first place. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4b7699f406225ce13afc6cbb320d4b84e9c8fe0f Author: Filipe Manana Date: Wed Aug 27 12:03:52 2025 +0100 btrfs: stop setting log_root_tree->log_root to NULL in btrfs_recover_log_trees() There's no point in setting log_root_tree->log_root to NULL as this is already NULL, we never assigned anything to it before and it's meaningless as a log root never has a value other than NULL for the ->log_root field, that can be not NULL only for non log roots. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d73896a55c047d0e7269128346f163a8efc908aa Author: Filipe Manana Date: Wed Aug 27 11:48:43 2025 +0100 btrfs: stop passing transaction parameter to log tree walk functions It's unncessary to pass a transaction parameter since struct walk_control already has a member that points to the transaction, so we can make the functions access the structure. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7f09699e5e6127db7bcb6d49d8fc674a74f23659 Author: Filipe Manana Date: Tue Aug 26 17:30:16 2025 +0100 btrfs: deduplicate log root free in error paths from btrfs_recover_log_trees() Instead of duplicating the dropping of a log tree in case we jump to the 'error' label, move the dropping under the 'error' label and get rid of the the unnecessary setting of the log root to NULL since we return immediately after. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit efa44fc4fde3eb60da436d31707c00f6c182a6c8 Author: Filipe Manana Date: Tue Aug 26 17:25:56 2025 +0100 btrfs: add and use a log root field to struct walk_control Instead of passing an extra log root parameter for the log tree walk functions and callbacks, add the log tree to struct walk_control and make those functions and callbacks extract the log root from that structure, reducing the number of parameters. This also simplifies further upcoming changes to report log tree replay failures. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 60ac80242be1ce5e75f7f1e79f0d02996702388c Author: Filipe Manana Date: Tue Aug 26 16:43:48 2025 +0100 btrfs: rename root to log in walk_down_log_tree() and walk_up_log_tree() Everywhere we have a log root we name it as 'log' or 'log_root' except in walk_down_log_tree() and walk_up_log_tree() where we name it as 'root', which not only it's inconsistent, it's also confusing since we typically use 'root' when naming variables that refer to a subvolume tree. So for clairty and consistency rename the 'root' argument to 'log'. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2c123db1f0e1fbba424263851973e2bb862c26fb Author: Filipe Manana Date: Tue Aug 26 16:27:46 2025 +0100 btrfs: rename replay_dest member of struct walk_control to root Everywhere else we refer to a subvolume root we are replaying to simply as 'root', so rename from 'replay_dest' to 'root' for consistency and having a more meaningful and shorter name. While at it also update the comment to be more detailed and comply to preferred style (first word in a sentence is capitalized and sentence ends with punctuation). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6803bff896ef96c9b2ee436d9e4f17ba7357d601 Author: Filipe Manana Date: Tue Aug 26 16:12:53 2025 +0100 btrfs: use booleans in walk control structure for log replay The 'free' and 'pin' member of struct walk_control, used during log replay and when freeing a log tree, are defined as integers but in practice are used as booleans. Change their type to bool and while at it update their comments to be more detailed and comply with the preferred comment style (first word in a sentence is capitalized, sentences end with punctuation and the comment opening (/*) is on a line of its own). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ea77a1c1c78942578a2f6995d60757c34fe50980 Author: Qu Wenruo Date: Mon Sep 1 07:55:00 2025 +0930 btrfs: cache max and min order inside btrfs_fs_info Inside btrfs_fs_info we cache several bits shift like sectorsize_bits. Apply this to max and min folio orders so that every time mapping order needs to be applied we can skip the calculation. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7425a2894019778460e65d24e8adfaeddac3b3b1 Author: Qu Wenruo Date: Tue Sep 2 16:45:02 2025 +0930 btrfs: introduce btrfs_bio_for_each_block_all() helper Currently if we want to iterate all blocks inside a bio, we do something like this: bio_for_each_segment_all(bvec, bio, iter_all) { for (off = 0; off < bvec->bv_len; off += sectorsize) { /* Iterate blocks using bv + off */ } } That's fine for now, but it will not handle future bs > ps, as bio_for_each_segment_all() is a single-page iterator, it will always return a bvec that's no larger than a page. But for bs > ps cases, we need a full folio (which covers at least one block) so that we can work on the block. To address this problem and handle future bs > ps cases better: - Introduce a helper btrfs_bio_for_each_block_all() This helper will create a local bvec_iter, which has the size of the target bio. Then grab the current physical address of the current location, then advance the iterator by block size. - Use btrfs_bio_for_each_block_all() to replace existing call sites Including: * set_bio_pages_uptodate() in raid56 * verify_bio_data_sectors() in raid56 Both will result much easier to read code. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9afc617265383f591614e94b702d558dfb1519c0 Author: Qu Wenruo Date: Tue Sep 2 14:51:49 2025 +0930 btrfs: introduce btrfs_bio_for_each_block() helper Currently if we want to iterate a bio in block unit, we do something like this: while (iter->bi_size) { struct bio_vec bv = bio_iter_iovec(); /* Do something with using the bv */ bio_advance_iter_single(&bbio->bio, iter, sectorsize); } That's fine for now, but it will not handle future bs > ps, as bio_iter_iovec() returns a single-page bvec, meaning the bv_len will not exceed page size. This means the code using that bv can only handle a block if bs <= ps. To address this problem and handle future bs > ps cases better: - Introduce a helper btrfs_bio_for_each_block() Instead of bio_vec, which has single and multiple page version and multiple page version has quite some limits, use my favorite way to represent a block, phys_addr_t. For bs <= ps cases, nothing is changed, except we will do a very small overhead to convert phys_addr_t to a folio, then use the proper folio helpers to handle the possible highmem cases. For bs > ps cases, all blocks will be backed by large folios, meaning every folio will cover at least one block. And still use proper folio helpers to handle highmem cases. With phys_addr_t, we will handle both large folio and highmem properly. So there is no better single variable to present a btrfs block than phys_addr_t. - Extract the data block csum calculation into a helper The new helper, btrfs_calculate_block_csum() will be utilized by btrfs_csum_one_bio(). - Use btrfs_bio_for_each_block() to replace existing call sites Including: * index_one_bio() from raid56.c Very straight-forward. * btrfs_check_read_bio() Also update repair_one_sector() to grab the folio using phys_addr_t, and do extra checks to make sure the folio covers at least one block. We do not need to bother bv_len at all now. * btrfs_csum_one_bio() Now we can move the highmem handling into a dedicated helper, calculate_block_csum(), and use btrfs_bio_for_each_block() helper. There is one exception in btrfs_decompress_buf2page(), which is copying decompressed data into the original bio, which is not iterating using block size thus we don't need to bother. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 35aff706dccbc51d30df6fedba76a746a1322839 Author: Qu Wenruo Date: Tue Sep 2 10:51:25 2025 +0930 btrfs: concentrate highmem handling for data verification Currently for btrfs checksum verification, we do it in the following pattern: kaddr = kmap_local_*(); ret = btrfs_check_csum_csum(kaddr); kunmap_local(kaddr); It's OK for now, but it's still not following the patterns of helpers inside linux/highmem.h, which never requires a virt memory address. In those highmem helpers, they mostly accept a folio, some offset/length inside the folio, and in the implementation they check if the folio needs partial kmap, and do the handling. Inspired by those formal highmem helpers, enhance the highmem handling of data checksum verification by: - Rename btrfs_check_sector_csum() to btrfs_check_block_csum() To follow the more common term "block" used in all other major filesystems. - Pass a physical address into btrfs_check_block_csum() and btrfs_data_csum_ok() The physical address is always available even for a highmem page. Since it's page frame number << PAGE_SHIFT + offset in page. And with that physical address, we can grab the folio covering the page, and do extra checks to ensure it covers at least one block. This also allows us to do the kmap inside btrfs_check_block_csum(). This means all the extra HIGHMEM handling will be concentrated into btrfs_check_block_csum(), and no callers will need to bother highmem by themselves. - Properly zero out the block if csum mismatch Since btrfs_data_csum_ok() only got a paddr, we can not and should not use memzero_bvec(), which only accepts single page bvec. Instead use paddr to grab the folio and call folio_zero_range() Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2ccfaf73690960e800c2dd7debea559de4b58010 Author: Qu Wenruo Date: Sat Aug 9 14:19:16 2025 +0930 btrfs: support all block sizes which is no larger than page size Currently if block size < page size, btrfs only supports one single config, 4K. This is mostly to reduce the test configurations, as 4K is going to be the default block size for all architectures. However all other major filesystems have no artificial limits on the support block size, and some are already supporting block size > page sizes. Since the btrfs subpage block support has been there for a long time, it's time for us to enable all block size <= page size support. So here enable all block sizes support as long as it's no larger than page size for experimental builds. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a7f3dfb8293c4cee99743132d69863a92e8f4875 Author: Thorsten Blum Date: Mon Sep 1 17:01:44 2025 +0200 btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() Replace max_t() followed by min_t() with a single clamp(). As was pointed by David Laight in https://lore.kernel.org/linux-btrfs/20250906122458.75dfc8f0@pumpkin/ the calculation may overflow u32 when the input value is too large, so clamp_t() is not used. In practice the expected values are in range of megabytes to gigabytes (throughput limit) so the bug would not happen. Signed-off-by: Thorsten Blum Reviewed-by: David Sterba [ Use clamp() and add explanation. ] Signed-off-by: David Sterba commit 17dc82dc1e77a6fce07252ce894748190d1487d0 Author: David Sterba Date: Fri Aug 22 00:57:42 2025 +0200 btrfs: fix typos in comments and strings Annual typo fixing pass. Strangely codespell found only about 30% of what is in this patch, the rest was done manually using text spellchecker with a custom dictionary of acceptable terms. Reviewed-by: Neal Gompa Signed-off-by: David Sterba commit 74e8f002b772686408d62e420d9f70a4bcb1c2c4 Author: Qu Wenruo Date: Thu Aug 14 10:44:48 2025 +0930 btrfs: reduce compression workspace buffer space to block size Currently the compression workspace buffer size is always based on PAGE_SIZE, but btrfs has support subpage sized block size for some time. This means for one-shot compression algorithm like lzo, we're wasting quite some memory if the block size is smaller than page size, as the LZO only works on one block (thus one-shot). On 64K page sized systems with 4K block size, it means we only need at most 8K buffer space for lzo, but in reality we're allocating 64K buffer. So to reduce the memory usage, change all workspace buffer to base its size based on block size other than page size. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0d0b80929eff93e7e0323060899d04905b8e6de9 Author: Qu Wenruo Date: Thu Aug 14 10:35:23 2025 +0930 btrfs: rename btrfs_compress_op to btrfs_compress_levels Since all workspace managers are per-fs, there is no need nor no way to store them inside btrfs_compress_op::wsm anymore. With that said, we can do the following modifications: - Remove zstd_workspace_mananger::ops Zstd always grab the global btrfs_compress_op[]. - Remove btrfs_compress_op::wsm member - Rename btrfs_compress_op to btrfs_compress_levels This should make it more clear that btrfs_compress_levels structures are only to indicate the levels of each compress algorithm. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9c8f4cf45651b8f07bd06df443871d526dc53cea Author: Qu Wenruo Date: Thu Aug 14 10:29:58 2025 +0930 btrfs: cleanup the per-module compression workspace managers Since all workspaces are handled by the per-fs workspace managers, we can safely remove the old per-module managers. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 856d46c31343169a566f44035c4c74b2f0842438 Author: Qu Wenruo Date: Thu Aug 14 09:49:50 2025 +0930 btrfs: migrate to use per-fs workspace manager There are several interfaces involved for each algorithm: - alloc workspace All algorithms allocate a workspace without the need for workspace manager. So no change needs to be done. - get workspace This involves checking the workspace manager to find a free one, and if not, allocate a new one. For none and lzo, they share the same generic btrfs_get_workspace() helper, only needs to update that function to use the per-fs manager. For zlib it uses a wrapper around btrfs_get_workspace(), so no special work needed. For zstd, update zstd_find_workspace() and zstd_get_workspace() to utilize the per-fs manager. - put workspace For none/zlib/lzo they share the same btrfs_put_workspace(), update that function to use the per-fs manager. For zstd, it's zstd_put_workspace(), the same update. - zstd specific timer This is the timer to reclaim workspace, change it to grab the per-fs workspace manager instead. Now all workspace are managed by the per-fs manager. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f9c3f48acffaffe7bb643b3bc04f8a99021179a Author: Qu Wenruo Date: Wed Aug 13 16:36:57 2025 +0930 btrfs: add generic workspace manager initialization This involves: - Add (alloc|free)_workspace_manager helpers. These are the helper to alloc/free workspace_manager structure. The allocator will allocate a workspace_manager structure, initialize it, and pre-allocate one workspace for it. The freer will do the cleanup and set the manager pointer to NULL. - Call alloc_workspace_manager() inside btrfs_alloc_compress_wsm() - Call alloc_workspace_manager() inside btrfs_free_compress_wsm() For none, zlib and lzo compression algorithms. For now the generic per-fs workspace managers won't really have any effect, and all compression is still going through the global workspace manager. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 330f02b136a8c2e025548683c265fc2be844614c Author: Qu Wenruo Date: Wed Aug 13 15:05:20 2025 +0930 btrfs: add workspace manager initialization for zstd This involves: - Add zstd_alloc_workspace_manager() and zstd_free_workspace_manager() Those two functions will accept an fs_info pointer, and alloc/free fs_info->compr_wsm[BTRFS_COMPRESS_ZSTD] pointer. - Add btrfs_alloc_compress_wsm() and btrfs_free_compress_wsm() Those are helpers allocating the workspace managers for all algorithms. For now only zstd is supported, and the timing is a little unusual, the btrfs_alloc_compress_wsm() should only be called after the sectorsize being initialized. Meanwhile btrfs_free_fs_info_compress() is called in btrfs_free_fs_info(). - Move the definition of btrfs_compression_type to "fs.h" The reason is that "compression.h" has already included "fs.h", thus we can not just include "compression.h" to get the definition of BTRFS_NR_COMPRESS_TYPES to define fs_info::compr_wsm[]. For now the per-fs zstd workspace manager won't really have any effect, and all compression is still going through the global workspace manager. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2c5cca03c1738e1342cbe57671d463f275c00623 Author: Qu Wenruo Date: Wed Aug 13 14:33:38 2025 +0930 btrfs: add an fs_info parameter for compression workspace manager [BACKGROUND] Currently btrfs shares workspaces and their managers for all filesystems, this is mostly fine as all those workspaces are using page size based buffers, and btrfs only support block size (bs) <= page size (ps). This means even if bs < ps, we at most waste some buffer space in the workspace, but everything will still work fine. The problem here is that is limiting our support for bs > ps cases. As now a workspace now may need larger buffer to handle bs > ps cases, but since the pool has no way to distinguish different workspaces, a regular workspace (which is still using buffer size based on ps) can be passed to a btrfs whose bs > ps. In that case the buffer is not large enough, and will cause various problems. [ENHANCEMENT] To prepare for the per-fs workspace migration, add an fs_info parameter to all workspace related functions. For now this new fs_info parameter is not yet utilized. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 737852c060fb54e5c43c2843fc4bad3c78cef51a Author: Qu Wenruo Date: Mon Jul 28 17:57:57 2025 +0930 btrfs: keep folios locked inside run_delalloc_nocow() [BUG] There is a very low chance that DEBUG_WARN() inside btrfs_writepage_cow_fixup() can be triggered when CONFIG_BTRFS_EXPERIMENTAL is enabled. This only happens after run_delalloc_nocow() failed. Unfortunately I haven't hit it for a while thus no real world dmesg for now. [CAUSE] There is a race window where after run_delalloc_nocow() failed, error handling can race with writeback thread. Before we hit run_delalloc_nocow(), there is an inode with the following dirty pages: (4K page size, 4K block size, no large folio) 0 4K 8K 12K 16K |/////////|///////////|///////////|////////////| The inode also have NODATACOW flag, and the above dirty range will go through different extents during run_delalloc_range(): 0 4K 8K 12K 16K | NOCOW | COW | COW | NOCOW | The race happen like this: writeback thread A | writeback thread B ----------------------------------+-------------------------------------- Writeback for folio 0 | run_delalloc_nocow() | |- nocow_one_range() | | For range [0, 4K), ret = 0 | | | |- fallback_to_cow() | | For range [4K, 8K), ret = 0 | | Folio 4K *UNLOCKED* | | | Writeback for folio 4K |- fallback_to_cow() | extent_writepage() | For range [8K, 12K), failure | |- writepage_delalloc() | | | |- btrfs_cleanup_ordered_extents()| | |- btrfs_folio_clear_ordered() | | | Folio 0 still locked, safe | | | | | Ordered extent already allocated. | | | Nothing to do. | | |- extent_writepage_io() | | |- btrfs_writepage_cow_fixup() |- btrfs_folio_clear_ordered() | | Folio 4K hold by thread B, | | UNSAFE! | |- btrfs_test_ordered() | | Cleared by thread A, | | | |- DEBUG_WARN(); This is only possible after run_delalloc_nocow() failure, as cow_file_range() will keep all folios and io tree range locked, until everything is finished or after error handling. The root cause is we allow fallback_to_cow() and nocow_one_range() to unlock the folios after a successful run, so that during error handling we're no longer safe to use btrfs_cleanup_ordered_extents() as the folios are already unlocked. [FIX] - Make fallback_to_cow() and nocow_one_range() to keep folios locked after a successful run For fallback_to_cow() we can pass COW_FILE_RANGE_KEEP_LOCKED flag into cow_file_range(). For nocow_one_range() we have to remove the PAGE_UNLOCK flag from extent_clear_unlock_delalloc(). - Unlock folios if everything is fine in run_delalloc_nocow() - Use extent_clear_unlock_delalloc() to handle range [@start, @cur_offset) inside run_delalloc_nocow() Since folios are still locked, we do not need cleanup_dirty_folios() to do the cleanup. extent_clear_unlock_delalloc() with "PAGE_START_WRITEBACK | PAGE_END_WRITEBACK" will clear the dirty flags. - Remove cleanup_dirty_folios() Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 13141df705b7145e46b88b1147d67d7a43f2d9e8 Author: Qu Wenruo Date: Mon Jul 28 17:57:56 2025 +0930 btrfs: make nocow_one_range() to do cleanup on error Currently if we hit an error inside nocow_one_range(), we do not clear the page dirty, and let the caller to handle it. This is very different compared to fallback_to_cow(), when that function failed, everything will be cleaned up by cow_file_range(). Enhance the situation by: - Use a common error handling for nocow_one_range() If we failed anything, use the same btrfs_cleanup_ordered_extents() and extent_clear_unlock_delalloc(). btrfs_cleanup_ordered_extents() is safe even if we haven't created new ordered extent, in that case there should be no OE and that function will do nothing. The same applies to extent_clear_unlock_delalloc(), and since we're passing PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK, it will also clear folio dirty flag during error handling. - Avoid touching the failed range of nocow_one_range() As the failed range will be cleaned up and unlocked by that function. Here we introduce a new variable @nocow_end to record the failed range, so that we can skip it during the error handling of run_delalloc_nocow(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 6a378edc9a61f0276e9c0261b0d65b2353c7f9e4 Author: Qu Wenruo Date: Mon Jul 28 17:57:55 2025 +0930 btrfs: enhance error messages for delalloc range failure When running emulated write error tests like generic/475, we can hit error messages like this: BTRFS error (device dm-12 state EA): run_delalloc_nocow failed, root=596 inode=264 start=1605632 len=73728: -5 BTRFS error (device dm-12 state EA): failed to run delalloc range, root=596 ino=264 folio=1605632 submit_bitmap=0-7 start=1605632 len=73728: -5 Which is normally buried by direct IO error messages. However above error messages are not enough to determine which is the real range that caused the error. Considering we can have multiple different extents in one delalloc range (e.g. some COW extents along with some NOCOW extents), just outputting the error at the end of run_delalloc_nocow() is not enough. To enhance the error messages: - Remove the rate limit on the existing error messages In the generic/475 example, most error messages are from direct IO, not really from the delalloc range. Considering how useful the delalloc range error messages are, we don't want they to be rate limited. - Add extra @cur_offset output for cow_file_range() - Add extra variable output for run_delalloc_nocow() This is especially important for run_delalloc_nocow(), as there are extra error paths where we can hit error without into nocow_one_range() nor fallback_to_cow(). - Add an error message for nocow_one_range() That's the missing part. For fallback_to_cow(), we have error message from cow_file_range() already. - Constify the @len and @end local variables for nocow_one_range() This makes it much easier to make sure @len and @end are not modified at runtime. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit fea55691aca1edf2fe612fd75536ec26354a8c4a Author: Bart Van Assche Date: Mon Sep 22 13:13:24 2025 -0700 blk-mq: Fix more tag iteration function documentation Commit 8ab30a331946 ("blk-mq: Drop busy_iter_fn blk_mq_hw_ctx argument") removed the hctx argument from the callback functions called by bt_for_each() and blk_mq_queue_tag_busy_iter(). Commit 2dd6532e9591 ("blk-mq: Drop 'reserved' arg of busy_tag_iter_fn") removed the 'reserved' argument of the busy_tag_iter_fn function pointer type. Bring the documentation of the tag iteration functions in sync with these changes. Cc: John Garry Cc: Ming Lei Cc: Christoph Hellwig Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit d1d6ad7f6686e208aba06b7af3feef7a7cba61cf Author: Roy Vegard Ovesen Date: Mon Sep 22 20:54:10 2025 +0200 ALSA: usb-audio: don't apply interface quirk to Presonus S1824c Testing with a Presonus STUDIO 1824c together with a Behringer ultragain digital ADAT device shows that using all 3 altno settings works fine. When selecting sample rate, the driver sets the interface to the correct altno setting and the correct number of channels is set. Selecting the correct altno setting via Ardour, Reaper or whatever other way to set the sample rate is more convenient than re-loading the driver module with device_setup to set altno. Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit ef9f603fd3d4b7937f2cdbce40e47df0a54b2a55 Author: Caleb Sander Mateos Date: Mon Sep 22 11:02:31 2025 -0600 io_uring/cmd: drop unused res2 param from io_uring_cmd_done() Commit 79525b51acc1 ("io_uring: fix nvme's 32b cqes on mixed cq") split out a separate io_uring_cmd_done32() helper for ->uring_cmd() implementations that return 32-byte CQEs. The res2 value passed to io_uring_cmd_done() is now unused because __io_uring_cmd_done() ignores it when is_cqe32 is passed as false. So drop the parameter from io_uring_cmd_done() to simplify the callers and clarify that it's not possible to return an extra value beyond the 32-bit CQE result. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit f7a741c53b712542aedd9382f215fbe969f8a580 Author: Lorenzo Stoakes Date: Wed Sep 3 18:48:42 2025 +0100 mm: do not assume file == vma->vm_file in compat_vma_mmap_prepare() In commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems") we introduced the ability for stacked drivers and file systems to correctly invoke the f_op->mmap_prepare() handler from an f_op->mmap() handler via a compatibility layer implemented in compat_vma_mmap_prepare(). This populates vm_area_desc fields according to those found in the (not yet fully initialised) VMA passed to f_op->mmap(). However this function implicitly assumes that the struct file which we are operating upon is equal to vma->vm_file. This is not a safe assumption in all cases. The only really sane situation in which this matters would be something like e.g. i915_gem_dmabuf_mmap() which invokes vfs_mmap() against obj->base.filp: ret = vfs_mmap(obj->base.filp, vma); if (ret) return ret; And then sets the VMA's file to this, should the mmap operation succeed: vma_set_file(vma, obj->base.filp); That is - it is the file that is intended to back the VMA mapping. This is not an issue currently, as so far we have only implemented f_op->mmap_prepare() handlers for some file systems and internal mm uses, and the only stacked f_op->mmap() operations that can be performed upon these are those in backing_file_mmap() and coda_file_mmap(), both of which use vma->vm_file. However, moving forward, as we convert drivers to using f_op->mmap_prepare(), this will become a problem. Resolve this issue by explicitly setting desc->file to the provided file parameter and update callers accordingly. Callers are expected to read desc->file and update desc->vm_file - the former will be the file provided by the caller (if stacked, this may differ from vma->vm_file). If the caller needs to differentiate between the two they therefore now can. While we are here, also provide a variant of compat_vma_mmap_prepare() that operates against a pointer to any file_operations struct and does not assume that the file_operations struct we are interested in is file->f_op. This function is __compat_vma_mmap_prepare() and we invoke it from compat_vma_mmap_prepare() so that we share code between the two functions. This is important, because some drivers provide hooks in a separate struct, for instance struct drm_device provides an fops field for this purpose. Also update the VMA selftests accordingly. Link: https://lkml.kernel.org/r/dd0c72df8a33e8ffaa243eeb9b01010b670610e9.1756920635.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Christian Brauner Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Al Viro Cc: David Hildenbrand Cc: Jan Kara Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit af6703838ecb1513efdd2502a8f7bb6472c5ce96 Author: Lorenzo Stoakes Date: Wed Sep 3 18:48:41 2025 +0100 mm: specify separate file and vm_file params in vm_area_desc Patch series "mm: do not assume file == vma->vm_file in compat_vma_mmap_prepare()", v2. As part of the efforts to eliminate the problematic f_op->mmap callback, a new callback - f_op->mmap_prepare was provided. While we are converting these callbacks, we must deal with 'stacked' filesystems and drivers - those which in their own f_op->mmap callback invoke an inner f_op->mmap callback. To accomodate for this, a compatibility layer is provided that, via vfs_mmap(), detects if f_op->mmap_prepare is provided and if so, generates a vm_area_desc containing the VMA's metadata and invokes the call. So far, we have provided desc->file equal to vma->vm_file. However this is not necessarily valid, especially in the case of stacked drivers which wish to assign a new file after the inner hook is invoked. To account for this, we adjust vm_area_desc to have both file and vm_file fields. The .vm_file field is strictly set to vma->vm_file (or in the case of a new mapping, what will become vma->vm_file). However, .file is set to whichever file vfs_mmap() is invoked with when using the compatibilty layer. Therefore, if the VMA's file needs to be updated in .mmap_prepare, desc->vm_file should be assigned, whilst desc->file should be read. No current f_op->mmap_prepare users assign desc->file so this is safe to do. This makes the .mmap_prepare callback in the context of a stacked filesystem or driver completely consistent with the existing .mmap implementations. While we're here, we do a few small cleanups, and ensure that we const-ify things correctly in the vm_area_desc struct to avoid hooks accidentally trying to assign fields they should not. This patch (of 2): Stacked filesystems and drivers may invoke mmap hooks with a struct file pointer that differs from the overlying file. We will make this functionality possible in a subsequent patch. In order to prepare for this, let's update vm_area_struct to separately provide desc->file and desc->vm_file parameters. The desc->file parameter is the file that the hook is expected to operate upon, and is not assignable (though the hok may wish to e.g. update the file's accessed time for instance). The desc->vm_file defaults to what will become vma->vm_file and is what the hook must reassign should it wish to change the VMA"s vma->vm_file. For now we keep desc->file, vm_file the same to remain consistent. No f_op->mmap_prepare() callback sets a new vma->vm_file currently, so this is safe to change. While we're here, make the mm_struct desc->mm pointers at immutable as well as the desc->mm field itself. As part of this change, also update the single hook which this would otherwise break - mlock_future_ok(), invoked by secretmem_mmap_prepare()). We additionally update set_vma_from_desc() to compare fields in a more logical fashion, checking the (possibly) user-modified fields as the first operand against the existing value as the second one. Additionally, update VMA tests to accommodate changes. Link: https://lkml.kernel.org/r/cover.1756920635.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/3fa15a861bb7419f033d22970598aa61850ea267.1756920635.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Al Viro Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 3437819c5e7a855b344030bfe15bbd513c28388f Author: Dmitry Antipov Date: Wed Sep 17 09:02:29 2025 +0300 ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name() Since 'ocfs2_sprintf_system_inode_name()' uses 'snprintf()' and returns the number of characters emitted, callers of the former are better to use that return value instead of an explicit calls to 'strlen()'. Link: https://lkml.kernel.org/r/20250917060229.1854335-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reviewed-by: Joseph Qi Reviewed-by: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit a15f37a40145c986cdf289a4b88390f35efdecc4 Author: Oleg Nesterov Date: Mon Sep 15 14:09:17 2025 +0200 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct. Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock(). Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable. Link: https://lkml.kernel.org/r/20250915120917.GA27702@redhat.com Fixes: 18c91bb2d872 ("prlimit: do not grab the tasklist_lock") Signed-off-by: Oleg Nesterov Cc: Christian Brauner Cc: Jiri Slaby Cc: Mateusz Guzik Cc: Signed-off-by: Andrew Morton commit 39f17c707454290900b608ee5a200b5db9245626 Author: Oleg Nesterov Date: Sun Sep 14 13:09:08 2025 +0200 sched/task.h: fix the wrong comment on task_lock() nesting with tasklist_lock The ancient comment above task_lock() states that it can be nested outside of read_lock(&tasklist_lock), but this is no longer true: CPU_0 CPU_1 CPU_2 task_lock() read_lock(tasklist) write_lock_irq(tasklist) read_lock(tasklist) task_lock() Unless CPU_0 calls read_lock() in IRQ context, queued_read_lock_slowpath() won't get the lock immediately, it will spin waiting for the pending writer on CPU_2, resulting in a deadlock. Link: https://lkml.kernel.org/r/20250914110908.GA18769@redhat.com Signed-off-by: Oleg Nesterov Cc: Christian Brauner Cc: Jiri Slaby Cc: Mateusz Guzik Signed-off-by: Andrew Morton commit f23e76a32dbfc45418a1448f94886eb608b35b98 Author: Krzysztof Kozlowski Date: Thu Sep 11 20:47:27 2025 +0200 coccinelle: platform_no_drv_owner: handle also built-in drivers builtin_platform_driver() and others also use macro platform_driver_register() which sets the .owner=THIS_MODULE, so extend the cocci script to detect these as well. Link: https://lkml.kernel.org/r/20250911184726.23154-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Cc: Julia Lawall Cc: Nathan Chancellor Cc: Nicolas Palix Signed-off-by: Andrew Morton commit 347b564599fb01d8ae1e9f473b82820fea4c2767 Author: Krzysztof Kozlowski Date: Thu Sep 11 21:33:55 2025 +0200 coccinelle: of_table: handle SPI device ID tables 'struct spi_device_id' tables also need to be NULL terminated. Link: https://lkml.kernel.org/r/20250911193354.56262-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Cc: Julia Lawall Cc: Nathan Chancellor Cc: Nicolas Palix Signed-off-by: Andrew Morton commit 04ae01a80df616b0998bb6a81c8db310f3aef102 Author: Thorsten Blum Date: Thu Sep 11 01:23:51 2025 +0200 lib/decompress: use designated initializers for struct compress_format Switch 'compressed_formats[]' to the more modern and flexible designated initializers. This improves readability and allows struct fields to be reordered. Also use a more concise sentinel marker. Remove the curly braces around the for loop while we're at it. No functional changes intended. Link: https://lkml.kernel.org/r/20250910232350.1308206-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Kuan-Wei Chiu Cc: David Sterba Cc: Nick Terrell Signed-off-by: Andrew Morton commit 58a5820582e4c809dd26b3f2d396cf072411d6e8 Merge: 5a427fddec5e76 b720903e2b14d3 Author: Alexei Starovoitov Date: Mon Sep 22 18:58:03 2025 -0700 Merge branch 'signed-bpf-programs' KP Singh says: ==================== Signed BPF programs BPF Signing has gone over multiple discussions in various conferences with the kernel and BPF community and the following patch series is a culmination of the current of discussion and signed BPF programs. Once signing is implemented, the next focus would be to implement the right security policies for all BPF use-cases (dynamically generated bpf programs, simple non CO-RE programs). Signing also paves the way for allowing unrivileged users to load vetted BPF programs and helps in adhering to the principle of least privlege by avoiding unnecessary elevation of privileges to CAP_BPF and CAP_SYS_ADMIN (ofcourse, with the appropriate security policy active). A early version of this design was proposed in [1]: The key idea of the design is to use a signing algorithm that allows us to integrity-protect a number of future payloads, including their order, by creating a chain of trust. Consider that Alice needs to send messages M_1, M_2, ..., M_n to Bob. We define blocks of data such that: B_n = M_n || H(termination_marker) (Each block contains its corresponding message and the hash of the *next* block in the chain.) B_{n-1} = M_{n-1} || H(B_n) B_{n-2} = M_{n-2} || H(B_{n-1}) ... B_2 = M_2 || H(B_3) B_1 = M_1 || H(B_2) Alice does the following (e.g., on a build system where all payloads are available): * Assembles the blocks B_1, B_2, ..., B_n. * Calculates H(B_1) and signs it, yielding Sig(H(B_1)). Alice sends the following to Bob: M_1, H(B_2), Sig(H(B_1)) Bob receives this payload and does the following: * Reconstructs B_1 as B_1' using the received M_1 and H(B_2) (i.e., B_1' = M_1 || H(B_2)). * Recomputes H(B_1') and verifies the signature against the received Sig(H(B_1)). * If the signature verifies, it establishes the integrity of M_1 and H(B_2) (and transitively, the integrity of the entire chain). Bob now stores the verified H(B_2) until it receives the next message. * When Bob receives M_2 (and H(B_3) if n > 2), it reconstructs B_2' (e.g., B_2' = M_2 || H(B_3), or if n=2, B_2' = M_2 || H(termination_marker)). Bob then computes H(B_2') and compares it against the stored H(B_2) that was verified in the previous step. This process continues until the last block is received and verified. Now, applying this to the BPF signing use-case, we simplify to two messages: M_1 = I_loader (the instructions of the loader program) M_2 = M_metadata (the metadata for the loader program, passed in a map, which includes the programs to be loaded and other context) For this specific BPF case, we will directly sign a composite of the first message and the hash of the second. Let H_meta = H(M_metadata). The block to be signed is effectively: B_signed = I_loader || H_meta The signature generated is Sig(B_signed). The process then follows a similar pattern to the Alice and Bob model, where the kernel (Bob) verifies I_loader and H_meta using the signature. Then, the trusted I_loader is responsible for verifying M_metadata against the trusted H_meta. From an implementation standpoint: bpftool (or some other tool in a trusted build environment) knows about the metadata (M_metadata) and the loader program (I_loader). It first calculates H_meta = H(M_metadata). Then it constructs the object to be signed and computes the signature: Sig(I_loader || H_meta) The loader program and the metadata are a hermetic representation of the source of the eBPF program, its maps and context. The loader program is generated by libbpf as a part of a standard API i.e. bpf_object__gen_loader. While users can use light skeletons as a convenient method to use signing support, they can directly use the loader program generation using libbpf (bpf_object__gen_loader) into their own trusted toolchains. libbpf, which has access to the program's instruction buffer is a key part of the TCB of the build environment An advanced threat model that does not intend to depend on libbpf (or any provenant userspace BPF libraries) due to supply chain risks despite it being developed in the kernel source and by the kernel community will require reimplmenting a lot of the core BPF userspace support (like instruction relocation, map handling). Such an advanced user would also need to integrate the generation of the loader into their toolchain. Given that many use-cases (e.g. Cilium) generate trusted BPF programs, trusted loaders are an inevitability and a requirement for signing support, a entrusting loader programs will be a fundamental requirement for an security policy. The initial instructions of the loader program verify the SHA256 hash of the metadata (M_metadata) that will be passed in a map. These instructions effectively embed the precomputed H_meta as immediate values. ld_imm64 r1, const_ptr_to_map // insn[0].src_reg == BPF_PSEUDO_MAP_IDX r2 = *(u64 *)(r1 + 0); ld_imm64 r3, sha256_of_map_part1 // precomputed by bpf_object__gen_load/libbpf (H_meta_1) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 8); ld_imm64 r3, sha256_of_map_part2 // precomputed by bpf_object__gen_load/libbpf (H_meta_2) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 16); ld_imm64 r3, sha256_of_map_part3 // precomputed by bpf_object__gen_load/libbpf (H_meta_3) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 24); ld_imm64 r3, sha256_of_map_part4 // precomputed by bpf_object__gen_load/libbpf (H_meta_4) if r2 != r3 goto out; ... This implicitly makes the payload equivalent to the signed block (B_signed) I_loader || H_meta bpftool then generates the signature of this I_loader payload (which now contains the expected H_meta) using a key and an identity: This signature is stored in bpf_attr, which is extended as follows for the BPF_PROG_LOAD command: __aligned_u64 signature; __u32 signature_size; __u32 keyring_id; The reasons for a simpler UAPI is that it's more future proof (e.g.) with more stable instruction buffers, loader programs being directly into the compilers. A simple API also allows simple programs e.g. for networking that don't need loader programs to directly use signing. OBJ_GET_INFO_BY_FD is used to get information about BPF objects (maps, programs, links) and returning the hash of the map is a natural extension of the UAPI as it can be helpful for debugging, fingerprinting etc. Currently, it's only implemented for BPF_MAP_TYPE_ARRAY. It can be trivially extended for BPF programs to return the complete SHA256 along with the tag. The SHA is stored in struct bpf_map for exclusive and frozen maps struct bpf_map { + u64 sha[4]; const struct bpf_map_ops *ops; struct bpf_map *inner_map_meta; }; Exclusivity ensures that the map can only be used by a future BPF program whose SHA256 hash matches sha256_of_future_prog. First, bpf_prog_calc_tag() is updated to compute the SHA256 instead of SHA1, and this hash is stored in struct bpf_prog_aux: @@ -1588,6 +1588,7 @@ struct bpf_prog_aux { int cgroup_atype; /* enum cgroup_bpf_attach_type */ struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]; char name[BPF_OBJ_NAME_LEN]; + u64 sha[4]; u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64); // ... }; An exclusive is created by passing an excl_prog_hash (and excl_prog_hash_size) in the BPF_MAP_CREATE command. When a BPF program is subsequently loaded and it attempts to use this map, the kernel will compare the program's own SHA256 hash against the one registered with the map, if matching, it will be added to prog->used_maps[]. The program load will fail if the hashes do not match or if the map is already in use by another (non-matching) exclusive program. Exclusive maps ensure that no other BPF programs and compromise the intergity of the map post the signature verification. NOTE: Exclusive maps cannot be added as inner maps. err = map_fd = skel_map_create(BPF_MAP_TYPE_ARRAY, "__loader.map", opts->excl_prog_hash, opts->excl_prog_hash_sz, 4, opts->data_sz, 1); err = skel_map_update_elem(map_fd, &key, opts->data, 0); err = skel_map_freeze(map_fd); // Kernel computes the hash of the map. err = skel_obj_get_info_by_fd(map_fd); memset(&attr, 0, prog_load_attr_sz); attr.prog_type = BPF_PROG_TYPE_SYSCALL; attr.insns = (long) opts->insns; attr.insn_cnt = opts->insns_sz / sizeof(struct bpf_insn); attr.signature = (long) opts->signature; attr.signature_size = opts->signature_sz; attr.keyring_id = opts->keyring_id; attr.license = (long) "Dual BSD/GPL"; The kernel will: * Compute the hash of the provided I_loader bytecode. * Verify the signature against this computed hash. * Check if the metadata map (now exclusive) is intended for this program's hash. The signature check happens in BPF_PROG_LOAD before the security_bpf_prog LSM hook. This ensures that the loaded loader program (I_loader), including the embedded expected hash of the metadata (H_meta), is trusted. Since the loader program is now trusted, it can be entrusted to verify the actual metadata (M_metadata) read from the (now exclusive and frozen) map against the embedded (and trusted) H_meta. There is no Time-of-Check-Time-of-Use (TOCTOU) vulnerability here because: * The signature covers the I_loader and its embedded H_meta. * The metadata map M_metadata is frozen before the loader program is loaded and associated with it. * The map is made exclusive to the specific (signed and verified) loader program. [1] https://lore.kernel.org/bpf/CACYkzJ6VQUExfyt0=-FmXz46GHJh3d=FXh5j4KfexcEFbHV-vg@mail.gmail.com/ ==================== Link: https://patch.msgid.link/20250921160120.9711-1-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit b720903e2b14d319268e1348a32c46a6fcbfd327 Author: KP Singh Date: Sun Sep 21 18:01:20 2025 +0200 selftests/bpf: Enable signature verification for some lskel tests The test harness uses the verify_sig_setup.sh to generate the required key material for program signing. Generate key material for signing LSKEL some lskel programs and use xxd to convert the verification certificate into a C header file. Finally, update the main test runner to load this certificate into the session keyring via the add_key() syscall before executing any tests. Use the session keyring in the tests with signed programs. Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250921160120.9711-6-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 40863f4d6ef2c34bb00dd1070dfaf9d5f27a497e Author: KP Singh Date: Sun Sep 21 18:01:19 2025 +0200 bpftool: Add support for signing BPF programs Two modes of operation being added: Add two modes of operation: * For prog load, allow signing a program immediately before loading. This is essential for command-line testing and administration. bpftool prog load -S -k -i fentry_test.bpf.o * For gen skeleton, embed a pre-generated signature into the C skeleton file. This supports the use of signed programs in compiled applications. bpftool gen skeleton -S -k -i fentry_test.bpf.o Generation of the loader program and its metadata map is implemented in libbpf (bpf_obj__gen_loader). bpftool generates a skeleton that loads the program and automates the required steps: freezing the map, creating an exclusive map, loading, and running. Users can use standard libbpf APIs directly or integrate loader program generation into their own toolchains. Signed-off-by: KP Singh Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250921160120.9711-5-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit ea923080c14578504c2e142760d9de547e38e87c Author: KP Singh Date: Sun Sep 21 18:01:18 2025 +0200 libbpf: Embed and verify the metadata hash in the loader To fulfill the BPF signing contract, represented as Sig(I_loader || H_meta), the generated trusted loader program must verify the integrity of the metadata. This signature cryptographically binds the loader's instructions (I_loader) to a hash of the metadata (H_meta). The verification process is embedded directly into the loader program. Upon execution, the loader loads the runtime hash from struct bpf_map i.e. BPF_PSEUDO_MAP_IDX and compares this runtime hash against an expected hash value that has been hardcoded directly by bpf_obj__gen_loader. The load from bpf_map can be improved by calling BPF_OBJ_GET_INFO_BY_FD from the kernel context after BPF_OBJ_GET_INFO_BY_FD has been updated for being called from the kernel context. The following instructions are generated: ld_imm64 r1, const_ptr_to_map // insn[0].src_reg == BPF_PSEUDO_MAP_IDX r2 = *(u64 *)(r1 + 0); ld_imm64 r3, sha256_of_map_part1 // constant precomputed by bpftool (part of H_meta) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 8); ld_imm64 r3, sha256_of_map_part2 // (part of H_meta) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 16); ld_imm64 r3, sha256_of_map_part3 // (part of H_meta) if r2 != r3 goto out; r2 = *(u64 *)(r1 + 24); ld_imm64 r3, sha256_of_map_part4 // (part of H_meta) if r2 != r3 goto out; ... Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250921160120.9711-4-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit fb2b0e290147ba01a53dfd92cf91058c9d2ee254 Author: KP Singh Date: Sun Sep 21 18:01:17 2025 +0200 libbpf: Update light skeleton for signing * The metadata map is created with as an exclusive map (with an excl_prog_hash) This restricts map access exclusively to the signed loader program, preventing tampering by other processes. * The map is then frozen, making it read-only from userspace. * BPF_OBJ_GET_INFO_BY_ID instructs the kernel to compute the hash of the metadata map (H') and store it in bpf_map->sha. * The loader is then loaded with the signature which is then verified by the kernel. loading signed programs prebuilt into the kernel are not currently supported. These can supported by enabling BPF_OBJ_GET_INFO_BY_ID to be called from the kernel. Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250921160120.9711-3-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 349271568303695f0ac3563af153d2b4542f6986 Author: KP Singh Date: Sun Sep 21 18:01:16 2025 +0200 bpf: Implement signature verification for BPF programs This patch extends the BPF_PROG_LOAD command by adding three new fields to `union bpf_attr` in the user-space API: - signature: A pointer to the signature blob. - signature_size: The size of the signature blob. - keyring_id: The serial number of a loaded kernel keyring (e.g., the user or session keyring) containing the trusted public keys. When a BPF program is loaded with a signature, the kernel: 1. Retrieves the trusted keyring using the provided `keyring_id`. 2. Verifies the supplied signature against the BPF program's instruction buffer. 3. If the signature is valid and was generated by a key in the trusted keyring, the program load proceeds. 4. If no signature is provided, the load proceeds as before, allowing for backward compatibility. LSMs can chose to restrict unsigned programs and implement a security policy. 5. If signature verification fails for any reason, the program is not loaded. Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250921160120.9711-2-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 3afb106f3f9aa81c512ec5c7e2f7e1c01a2a6e6b Merge: 4238cbf6ee27cd 649091ef597bb7 Author: Jakub Kicinski Date: Mon Sep 22 17:55:28 2025 -0700 Merge branch 'tcp-move-few-fields-for-data-locality' Eric Dumazet says: ==================== tcp: move few fields for data locality After recent additions (PSP and AccECN) I wanted to make another round on fields locations to increase data locality. This series manages to shrink TCP and TCPv6 objects by 128 bytes, but more importantly should reduce number of touched cache lines in TCP fast paths. There is more to come. v2: removed tcp CACHELINE_ASSERT_GROUP_SIZE after a kernel build bot reported an error. ==================== Link: https://patch.msgid.link/20250919204856.2977245-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 649091ef597bb7de34dd8ceea39bbc4252970558 Author: Eric Dumazet Date: Fri Sep 19 20:48:56 2025 +0000 tcp: reclaim 8 bytes in struct request_sock_queue synflood_warned had to be u32 for xchg(), but ensuring atomicity is not really needed. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 31c4511bbb0c75c525b6e4f4fe4167f2e9d3b05c Author: Eric Dumazet Date: Fri Sep 19 20:48:55 2025 +0000 tcp: move mtu_info to remove two 32bit holes This removes 8bytes waste on 64bit builds. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit a105ea47a4e855d24ebf65f1c5fb907162e7b8cf Author: Eric Dumazet Date: Fri Sep 19 20:48:54 2025 +0000 tcp: move tcp_clean_acked to tcp_sock_read_tx group tp->tcp_clean_acked is fetched in tx path when snd_una is updated. This field thus belongs to tcp_sock_read_tx group. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 969904dcd77dbb0a773d66cddaa59eccc6415d03 Author: Eric Dumazet Date: Fri Sep 19 20:48:53 2025 +0000 tcp: move recvmsg_inq to tcp_sock_read_txrx Fill a hole in tcp_sock_read_txrx, instead of possibly wasting a cache line. Note that tcp_recvmsg_locked() is also reading tp->repair, so this removes one cache line miss in tcp recvmsg(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1b44d700023e77dd92821e7811db825e75a1a394 Author: Eric Dumazet Date: Fri Sep 19 20:48:52 2025 +0000 tcp: move tcp->rcv_tstamp to tcp_sock_write_txrx group tcp_ack() writes this field, it belongs to tcp_sock_write_txrx. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit e1b022c2bdf1f2a631340b1b2ef265090534f65a Author: Eric Dumazet Date: Fri Sep 19 20:48:51 2025 +0000 tcp: remove CACHELINE_ASSERT_GROUP_SIZE() uses Maintaining the CACHELINE_ASSERT_GROUP_SIZE() uses for struct tcp_sock has been painful. This had little benefit, so remove them. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9303c3ced111803dcd1aa36a778f290977935ca5 Author: Eric Dumazet Date: Fri Sep 19 20:48:50 2025 +0000 net: move sk->sk_err_soft and sk->sk_sndbuf sk->sk_sndbuf is read-mostly in tx path, so move it from sock_write_tx group to more appropriate sock_read_tx. sk->sk_err_soft was not identified previously, but is used from tcp_ack(). Move it to sock_write_tx group for better cache locality. Also change tcp_ack() to clear sk->sk_err_soft only if needed. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 17b14d235f58155a05cd9371e4559361ca3c67da Author: Eric Dumazet Date: Fri Sep 19 20:48:49 2025 +0000 net: move sk_uid and sk_protocol to sock_read_tx sk_uid and sk_protocol are read from inet6_csk_route_socket() for each TCP transmit. Also read from udpv6_sendmsg(), udp_sendmsg() and others. Move them to sock_read_tx for better cache locality. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250919204856.2977245-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 32be3ca4cf78b309dfe7ba52fe2d7cc3c23c5634 Author: Muhammad Usama Anjum Date: Tue Jul 22 10:31:21 2025 +0500 wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again Don't deinitialize and reinitialize the HAL helpers. The dma memory is deallocated and there is high possibility that we'll not be able to get the same memory allocated from dma when there is high memory pressure. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org Cc: Baochen Qiang Reviewed-by: Baochen Qiang Signed-off-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20250722053121.1145001-1-usama.anjum@collabora.com Signed-off-by: Jeff Johnson commit 4238cbf6ee27cd158e7407e4fef36088028a7b86 Merge: c5aaf0225a81f9 9afad4a17174bf Author: Jakub Kicinski Date: Mon Sep 22 17:51:37 2025 -0700 Merge branch 'add-more-functionality-to-bnge' Bhargava Marreddy says: ==================== Add more functionality to BNGE This patch series adds the infrastructure to make the netdevice functional. It allocates data structures for core resources, followed by their initialisation and registration with the firmware. The core resources include the RX, TX, AGG, CMPL, and NQ rings, as well as the VNIC. RX/TX functionality will be introduced in the next patch series to keep this one at a reviewable size. ==================== Link: https://patch.msgid.link/20250919174742.24969-1-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 9afad4a17174bfc48772d9f052ebb3b6e011db0c Author: Bhargava Marreddy Date: Fri Sep 19 23:17:41 2025 +0530 bng_en: Configure default VNIC Add functions to add a filter to the VNIC to configure unicast addresses. Also, add multicast, broadcast, and promiscuous settings to the default VNIC. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-11-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 58930c035d5b1a8562382809cd074a57d7d0bf50 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:40 2025 +0530 bng_en: Register default VNIC Allocate the default VNIC with the firmware and configure its RSS, HDS, and Jumbo parameters. Add related functions to support VNIC configuration for these parameters. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-10-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit c757ef35078ba55194aa764a782034e23d9f1fd1 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:39 2025 +0530 bng_en: Register rings with the firmware Enable ring functionality by registering RX, AGG, TX, CMPL, and NQ rings with the firmware. Initialise the doorbells associated with the rings. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-9-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 23df6aebf803fe973f75db2d69898392aba1d879 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:38 2025 +0530 bng_en: Allocate stat contexts Allocate the hardware statistics context with the firmware and register DMA memory required for ring statistics. This helps the driver to collect ring statistics provided by the firmware. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-8-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 2fe6e77c9f8f11c12a08741092f5662193f5a86f Author: Bhargava Marreddy Date: Fri Sep 19 23:17:37 2025 +0530 bng_en: Allocate packet buffers Populate packet buffers into the RX and AGG rings while these rings are being initialized. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-7-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit d85b5a2071437aded65d8f0339acbf45f598d999 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:36 2025 +0530 bng_en: Initialise core resources Add initial settings to all core resources, such as the RX, AGG, TX, CQ, and NQ rings, as well as the VNIC. This will help enable these resources in future patches. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-6-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 490e145c3aacf40d600f453a402d4fbd6844d694 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:35 2025 +0530 bng_en: Introduce VNIC Add the VNIC-specific structures and DMA memory necessary to support UC/MC and RSS functionality. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-5-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit bd06d729722ea0b506be68f292aa91c628afc5be Author: Bhargava Marreddy Date: Fri Sep 19 23:17:34 2025 +0530 bng_en: Add initial support for CP and NQ rings Allocate CP and NQ related data structures and add support to associate NQ and CQ rings. Also, add the association of NQ, NAPI, and interrupts. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-4-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 0259379037cab9b4b266eef5601fe1951434cd46 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:33 2025 +0530 bng_en: Add initial support for RX and TX rings Allocate data structures to support RX, AGG, and TX rings. While data structures for RX/AGG rings are allocated, initialise the page pool accordingly. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-3-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 9ee5994418bb527788e77361d338af40a126aa21 Author: Bhargava Marreddy Date: Fri Sep 19 23:17:32 2025 +0530 bng_en: make bnge_alloc_ring() self-unwind on failure Ensure bnge_alloc_ring() frees any intermediate allocations when it fails. This enables later patches to rely on this self-unwinding behavior. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250919174742.24969-2-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit c5aaf0225a81f94ac64efb477d17b36dc692617d Merge: dfff18082a6c2c 27ce71e1ce8187 Author: Jakub Kicinski Date: Mon Sep 22 17:40:32 2025 -0700 Merge branch 'net-replace-wq-users-and-add-wq_percpu-to-alloc_workqueue-users' Marco Crivellari says: ==================== net: replace wq users and add WQ_PERCPU to alloc_workqueue() users Below is a summary of a discussion about the Workqueue API and cpu isolation considerations. Details and more information are available here: "workqueue: Always use wq_select_unbound_cpu() for WORK_CPU_UNBOUND." Link: https://lore.kernel.org/20250221112003.1dSuoGyc@linutronix.de === Current situation: problems === Let's consider a nohz_full system with isolated CPUs: wq_unbound_cpumask is set to the housekeeping CPUs, for !WQ_UNBOUND the local CPU is selected. This leads to different scenarios if a work item is scheduled on an isolated CPU where "delay" value is 0 or greater then 0: schedule_delayed_work(, 0); This will be handled by __queue_work() that will queue the work item on the current local (isolated) CPU, while: schedule_delayed_work(, 1); Will move the timer on an housekeeping CPU, and schedule the work there. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. === Plan and future plans === This patchset is the first stone on a refactoring needed in order to address the points aforementioned; it will have a positive impact also on the cpu isolation, in the long term, moving away percpu workqueue in favor to an unbound model. These are the main steps: 1) API refactoring (that this patch is introducing) - Make more clear and uniform the system wq names, both per-cpu and unbound. This to avoid any possible confusion on what should be used. - Introduction of WQ_PERCPU: this flag is the complement of WQ_UNBOUND, introduced in this patchset and used on all the callers that are not currently using WQ_UNBOUND. WQ_UNBOUND will be removed in a future release cycle. Most users don't need to be per-cpu, because they don't have locality requirements, because of that, a next future step will be make "unbound" the default behavior. 2) Check who really needs to be per-cpu - Remove the WQ_PERCPU flag when is not strictly required. 3) Add a new API (prefer local cpu) - There are users that don't require a local execution, like mentioned above; despite that, local execution yeld to performance gain. This new API will prefer the local execution, without requiring it. === Introduced Changes by this series === 1) [P 1-2] Replace use of system_wq and system_unbound_wq system_wq is a per-CPU workqueue, but his name is not clear. system_unbound_wq is to be used when locality is not required. Because of that, system_wq has been renamed in system_percpu_wq, and system_unbound_wq has been renamed in system_dfl_wq. 2) [P 3] add WQ_PERCPU to remaining alloc_workqueue() users Every alloc_workqueue() caller should use one among WQ_PERCPU or WQ_UNBOUND. WQ_UNBOUND will be removed in a next release cycle. ==================== Link: https://patch.msgid.link/20250918142427.309519-1-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit 27ce71e1ce81875df72f7698ba27988392bef602 Author: Marco Crivellari Date: Thu Sep 18 16:24:27 2025 +0200 net: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag at the network subsystem, to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250918142427.309519-4-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit 5fd8bb982e10f29e856ef71072609af5ce55d281 Author: Marco Crivellari Date: Thu Sep 18 16:24:26 2025 +0200 net: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250918142427.309519-3-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit 9870d350e45a5724ee25f77aa0b6d053c9b766db Author: Marco Crivellari Date: Thu Sep 18 16:24:25 2025 +0200 net: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250918142427.309519-2-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit dfff18082a6c2c52b07a6e0830298c6b3f48dfa9 Merge: 530ae8ec0e5e08 99e9c5ffbbee0f Author: Jakub Kicinski Date: Mon Sep 22 16:56:30 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-19 (ice, idpf, iavf, ixgbevf, fm10k) Paul adds support for Earliest TxTime First (ETF) hardware offload for E830 devices on ice. ETF is configured per-queue using tc-etf Qdisc; a new Tx flow mechanism utilizes a dedicated timestamp ring alongside the standard Tx ring. The timestamp ring contains descriptors that specify when hardware should transmit packets; up to 2048 Tx queues can be supported. Additional info: https://lore.kernel.org/intel-wired-lan/20250818132257.21720-1-paul.greenwalt@intel.com/ Dave removes excess cleanup call to ice_lag_move_new_vf_nodes() in error path. Milena adds reporting of timestamping statistics to idpf. Alex changes error variable type for code clarity for iavf and ixgbevf. Brahmajit Das removes unused parameter from fm10k_unbind_hw_stats_q(). * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: net: intel: fm10k: Fix parameter idx set but not used ixgbevf: fix proper type for error code in ixgbevf_resume() iavf: fix proper type for error code in iavf_resume() idpf: add HW timestamping statistics ice: Remove deprecated ice_lag_move_new_vf_nodes() call ice: add E830 Earliest TxTime First Offload support ice: move ice_qp_[ena|dis] for reuse ==================== Link: https://patch.msgid.link/20250919175412.653707-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 530ae8ec0e5e08b123ca667aedaf7fdbb1a8200f Author: Thorsten Blum Date: Fri Sep 19 12:39:45 2025 +0200 net: phy: ax88796b: Replace hard-coded values with PHY_ID_MATCH_MODEL() Use the PHY_ID_MATCH_MODEL() macro instead of hardcoding the values in asix_driver[] and asix_tbl[]. In asix_tbl[], the macro also uses designated initializers instead of positional initializers, which allows the struct fields to be reordered. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250919103944.854845-2-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit 312e6a58f764627037032160ed8c671885f31360 Author: Suraj Gupta Date: Fri Sep 19 16:07:54 2025 +0530 net: xilinx: axienet: Fix kernel-doc warnings for missing return descriptions Add missing "Return:" sections to kernel-doc comments for four functions: - axienet_calc_cr() - axienet_device_reset() - axienet_free_tx_chain() - axienet_dim_coalesce_count_rx() Also standardize the return documentation format by replacing inline "Returns" text with proper "Return:" tags as per kernel documentation guidelines. Fixes below kernel-doc warnings: - Warning: No description found for return value of 'axienet_calc_cr' - Warning: No description found for return value of 'axienet_device_reset' - Warning: No description found for return value of 'axienet_free_tx_chain' - Warning: No description found for return value of 'axienet_dim_coalesce_count_rx' Signed-off-by: Suraj Gupta Link: https://patch.msgid.link/20250919103754.434711-1-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski commit ab528156eca2d8264bc29f85e4a347556a4d52ba Merge: 1bcce9ec189b2a a0b977a3d19368 Author: Jakub Kicinski Date: Mon Sep 22 16:31:21 2025 -0700 Merge branch 'net-dsa-microchip-add-strap-description-to-set-spi-as-interface-bus' Bastien Curutchet says: ==================== net: dsa: microchip: Add strap description to set SPI as interface bus At reset, the KSZ8463 uses a strap-based configuration to set SPI as interface bus. If the required pull-ups/pull-downs are missing (by mistake or by design to save power) the pins may float and the configuration can go wrong preventing any communication with the switch. This small series aims to allow to configure the KSZ8463 switch at reset when the hardware straps are missing. PATCH 0 and 1 add a new property to the bindings that describes the GPIOs to be set during reset in order to configure the switch properly. PATCH 2 implements the use of these properties in the driver. ==================== Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-0-16662e881728@bootlin.com Signed-off-by: Jakub Kicinski commit a0b977a3d19368b235f2a6c06e800fb25452029b Author: Bastien Curutchet Date: Thu Sep 18 10:33:52 2025 +0200 net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 At reset, the KSZ8463 uses a strap-based configuration to set SPI as bus interface. SPI is the only bus supported by the driver. If the required pull-ups/pull-downs are missing (by mistake or by design to save power) the pins may float and the configuration can go wrong preventing any communication with the switch. Introduce a ksz8463_configure_straps_spi() function called during the device reset. It relies on the 'straps-rxd-gpios' OF property and the 'reset' pinmux configuration to enforce SPI as bus interface. Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-3-16662e881728@bootlin.com Signed-off-by: Jakub Kicinski commit e469b87e0fb0d1209edb6c291474b1a1afa45bd5 Author: Bastien Curutchet (Schneider Electric) Date: Thu Sep 18 10:33:51 2025 +0200 dt-bindings: net: dsa: microchip: Add strap description to set SPI mode At reset, KSZ8463 uses a strap-based configuration to set SPI as interface bus. If the required pull-ups/pull-downs are missing (by mistake or by design to save power) the pins may float and the configuration can go wrong preventing any communication with the switch. Add a 'reset' pinmux state Add a KSZ8463 specific strap description that can be used by the driver to drive the strap pins during reset. Two GPIOs are used. Users must describe either both of them or none of them. Signed-off-by: Bastien Curutchet (Schneider Electric) Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-2-16662e881728@bootlin.com Signed-off-by: Jakub Kicinski commit 6bd5b7297c95e6982cf0aee192431156681a1cdd Author: Bastien Curutchet (Schneider Electric) Date: Thu Sep 18 10:33:50 2025 +0200 dt-bindings: net: dsa: microchip: Group if clause under allOf tag Upcoming patch adds a new if/then clause. It requires to be grouped with the already existing if/then clause under an 'allOf:' tag. Move the if/then clause under the already existing 'allOf:' tag to prepare next patch. Acked-by: Rob Herring (Arm) Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-1-16662e881728@bootlin.com Signed-off-by: Jakub Kicinski commit 1bcce9ec189b2a28a5b9ee7b0c9ea9158bfd95ae Merge: 6710ab7558b282 a3d076b0567e72 Author: Jakub Kicinski Date: Mon Sep 22 16:30:17 2025 -0700 Merge tag 'mlx5-next-counters' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-09-21 * tag 'mlx5-next-counters' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add uar access and odp page fault counters ==================== Link: https://patch.msgid.link/1758443940-708689-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6710ab7558b28299e23aff5a7fba8af01c3115b5 Merge: 9b277fca90c39c 9ce138735efcb3 Author: Jakub Kicinski Date: Mon Sep 22 16:05:16 2025 -0700 Merge branch 'net-rework-sfp-capability-parsing-and-quirks' Russell King says: ==================== net: rework SFP capability parsing and quirks The original SPF module parsing was implemented prior to gaining any quirks, and was designed such that the upstream calls the parsing functions to get the translated capabilities of the module. SFP quirks were then added to cope with modules that didn't correctly fill out their ID EEPROM. The quirk function was called from sfp_parse_support() to allow quirks to modify the ethtool link mode masks. Using just ethtool link mode masks eventually lead to difficulties determining the correct phy_interface_t mode, so a bitmap of these modes were added - needing both the upstream API and quirks to be updated. We have had significantly more SFP module quirks added since, some which are modifying the ID EEPROM as a way of influencing the data we provide to the upstream - for example, sfp_fixup_10gbaset_30m() changes id.base.connector so we report PORT_TP. This could be done more cleanly if the quirks had access to the parsed SFP port. In order to improve flexibility, and to simplify some of the upstream code, we group all module capabilities into a single structure that the upstream can access via sfp_module_get_caps(). This will allow the module capabilities to be expanded if required without reworking all the infrastructure and upstreams again. In this series, we rework the SFP code to use the capability structure and then rework all the upstream implementations, finally removing the old kernel internal APIs. ==================== Link: https://patch.msgid.link/aMnaoPjIuzEAsESZ@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9ce138735efcb395974952972aa5dbd1d444ac2c Author: Russell King (Oracle) Date: Tue Sep 16 22:47:07 2025 +0100 net: sfp: remove old sfp_parse_* functions Remove the old sfp_parse_*() functions that are now no longer used. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVz-000000061Wj-13Yd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4b6276550f07188afabd922d504a24ca12c6b264 Author: Russell King (Oracle) Date: Tue Sep 16 22:47:02 2025 +0100 net: phy: update all PHYs to use sfp_get_module_caps() Update all PHYs to use sfp_get_module_caps() rather than the sfp_parse_*() family of functions. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVu-000000061Wd-0cAG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit cab1165195406a0a28153d61bd14967d8efb67f7 Author: Russell King (Oracle) Date: Tue Sep 16 22:46:57 2025 +0100 net: phylink: use sfp_get_module_caps() Use sfp_get_module_caps() to get SFP module's capabilities. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVp-000000061WW-08YM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 64fb4a3ae8a5d9c4d27d9f4ae58e38200fc3d44b Author: Russell King (Oracle) Date: Tue Sep 16 22:46:51 2025 +0100 net: sfp: provide sfp_get_module_caps() Provide a function to retrieve the current sfp_module_caps structure so that upstreams can get the entire module support in one go. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVj-000000061WQ-3q47@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a7dc35a9e49b103ff2a8a96519c47e149d733ccd Author: Russell King (Oracle) Date: Tue Sep 16 22:46:46 2025 +0100 net: sfp: convert sfp quirks to modify struct sfp_module_support In order to provide extensible module support properties, arrange for the SFP quirks to modify any member of the sfp_module_support struct, rather than just the ethtool link modes and interfaces. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVe-000000061WK-3KwI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ddae6127afbba46e32af3b31eb7bba939e1fad96 Author: Russell King (Oracle) Date: Tue Sep 16 22:46:41 2025 +0100 net: sfp: pre-parse the module support Pre-parse the module support on insert rather than when the upstream requests the data. This will allow more flexible and extensible parsing. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVZ-000000061WE-2pXD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a571f08d3db215dd6ec294d8faac8cc4184bc4e4 Author: Russell King (Oracle) Date: Tue Sep 16 22:46:36 2025 +0100 net: phy: add phy_interface_copy() Add a helper for copying PHY interface bitmasks. This will be used by the SFP bus code, which will then be moved to phylink in the subsequent patches. Reviewed-by: Andrew Lunn Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uydVU-000000061W8-2IDT@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8f0fdbd4a06bf795c68bc9839d9c349ab592654f Author: Chen Ridong Date: Mon Sep 22 13:02:33 2025 +0000 cpuset: remove is_prs_invalid helper The is_prs_invalid helper function is redundant as it serves a similar purpose to is_partition_invalid. It can be fully replaced by the existing is_partition_invalid function, so this patch removes the is_prs_invalid helper. Signed-off-by: Chen Ridong Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 39431592e93530d7f543e3d7204a8f9a062e6ac7 Author: Chen Ridong Date: Mon Sep 22 13:02:32 2025 +0000 cpuset: remove impossible warning in update_parent_effective_cpumask If the parent is not a valid partition, an error will be returned before any partition update command is processed. This means the WARN_ON_ONCE(!is_partition_valid(parent)) can never be triggered, so it is safe to remove. Signed-off-by: Chen Ridong Acked-by: Waiman Long Signed-off-by: Tejun Heo commit b72af996b67ccb1dea988765bf046cba2d4c6898 Author: Chen Ridong Date: Mon Sep 22 13:02:31 2025 +0000 cpuset: remove redundant special case for null input in node mask update The nodelist_parse function already handles empty nodemask input appropriately, making it unnecessary to handle this case separately during the node mask update process. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 42520df65bf67189541a425f7d36b0b3e7bd7844 Author: Viacheslav Dubeyko Date: Fri Sep 19 12:12:44 2025 -0700 hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() The hfsplus_strcasecmp() logic can trigger the issue: [ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.319783][ T9855] Call Trace: [ 117.319785][ T9855] [ 117.319788][ T9855] dump_stack_lvl+0x1c1/0x2a0 [ 117.319795][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319803][ T9855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 117.319808][ T9855] ? rcu_is_watching+0x15/0xb0 [ 117.319816][ T9855] ? lock_release+0x4b/0x3e0 [ 117.319821][ T9855] ? __kasan_check_byte+0x12/0x40 [ 117.319828][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319835][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319842][ T9855] print_report+0x17e/0x7e0 [ 117.319848][ T9855] ? __virt_addr_valid+0x1c8/0x5c0 [ 117.319855][ T9855] ? __virt_addr_valid+0x4a5/0x5c0 [ 117.319862][ T9855] ? __phys_addr+0xd3/0x180 [ 117.319869][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319876][ T9855] kasan_report+0x147/0x180 [ 117.319882][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490 [ 117.319891][ T9855] hfsplus_strcasecmp+0x1bc/0x490 [ 117.319900][ T9855] ? __pfx_hfsplus_cat_case_cmp_key+0x10/0x10 [ 117.319906][ T9855] hfs_find_rec_by_key+0xa9/0x1e0 [ 117.319913][ T9855] __hfsplus_brec_find+0x18e/0x470 [ 117.319920][ T9855] ? __pfx_hfsplus_bnode_find+0x10/0x10 [ 117.319926][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319933][ T9855] ? __pfx___hfsplus_brec_find+0x10/0x10 [ 117.319942][ T9855] hfsplus_brec_find+0x28f/0x510 [ 117.319949][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 117.319956][ T9855] ? __pfx_hfsplus_brec_find+0x10/0x10 [ 117.319963][ T9855] ? __kmalloc_noprof+0x2a9/0x510 [ 117.319969][ T9855] ? hfsplus_find_init+0x8c/0x1d0 [ 117.319976][ T9855] hfsplus_brec_read+0x2b/0x120 [ 117.319983][ T9855] hfsplus_lookup+0x2aa/0x890 [ 117.319990][ T9855] ? __pfx_hfsplus_lookup+0x10/0x10 [ 117.320003][ T9855] ? d_alloc_parallel+0x2f0/0x15e0 [ 117.320008][ T9855] ? __lock_acquire+0xaec/0xd80 [ 117.320013][ T9855] ? __pfx_d_alloc_parallel+0x10/0x10 [ 117.320019][ T9855] ? __raw_spin_lock_init+0x45/0x100 [ 117.320026][ T9855] ? __init_waitqueue_head+0xa9/0x150 [ 117.320034][ T9855] __lookup_slow+0x297/0x3d0 [ 117.320039][ T9855] ? __pfx___lookup_slow+0x10/0x10 [ 117.320045][ T9855] ? down_read+0x1ad/0x2e0 [ 117.320055][ T9855] lookup_slow+0x53/0x70 [ 117.320065][ T9855] walk_component+0x2f0/0x430 [ 117.320073][ T9855] path_lookupat+0x169/0x440 [ 117.320081][ T9855] filename_lookup+0x212/0x590 [ 117.320089][ T9855] ? __pfx_filename_lookup+0x10/0x10 [ 117.320098][ T9855] ? strncpy_from_user+0x150/0x290 [ 117.320105][ T9855] ? getname_flags+0x1e5/0x540 [ 117.320112][ T9855] user_path_at+0x3a/0x60 [ 117.320117][ T9855] __x64_sys_umount+0xee/0x160 [ 117.320123][ T9855] ? __pfx___x64_sys_umount+0x10/0x10 [ 117.320129][ T9855] ? do_syscall_64+0xb7/0x3a0 [ 117.320135][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320141][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320145][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.320150][ T9855] ? exc_page_fault+0x9f/0xf0 [ 117.320154][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.320158][ T9855] RIP: 0033:0x7f7dd7908b07 [ 117.320163][ T9855] Code: 23 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 08 [ 117.320167][ T9855] RSP: 002b:00007ffd5ebd9698 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 117.320172][ T9855] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7dd7908b07 [ 117.320176][ T9855] RDX: 0000000000000009 RSI: 0000000000000009 RDI: 00007ffd5ebd9740 [ 117.320179][ T9855] RBP: 00007ffd5ebda780 R08: 0000000000000005 R09: 00007ffd5ebd9530 [ 117.320181][ T9855] R10: 00007f7dd799bfc0 R11: 0000000000000202 R12: 000055e2008b32d0 [ 117.320184][ T9855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 117.320189][ T9855] [ 117.320190][ T9855] [ 117.351311][ T9855] Allocated by task 9855: [ 117.351683][ T9855] kasan_save_track+0x3e/0x80 [ 117.352093][ T9855] __kasan_kmalloc+0x8d/0xa0 [ 117.352490][ T9855] __kmalloc_noprof+0x288/0x510 [ 117.352914][ T9855] hfsplus_find_init+0x8c/0x1d0 [ 117.353342][ T9855] hfsplus_lookup+0x19c/0x890 [ 117.353747][ T9855] __lookup_slow+0x297/0x3d0 [ 117.354148][ T9855] lookup_slow+0x53/0x70 [ 117.354514][ T9855] walk_component+0x2f0/0x430 [ 117.354921][ T9855] path_lookupat+0x169/0x440 [ 117.355325][ T9855] filename_lookup+0x212/0x590 [ 117.355740][ T9855] user_path_at+0x3a/0x60 [ 117.356115][ T9855] __x64_sys_umount+0xee/0x160 [ 117.356529][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.356920][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.357429][ T9855] [ 117.357636][ T9855] The buggy address belongs to the object at ffff88802160f000 [ 117.357636][ T9855] which belongs to the cache kmalloc-2k of size 2048 [ 117.358827][ T9855] The buggy address is located 0 bytes to the right of [ 117.358827][ T9855] allocated 1036-byte region [ffff88802160f000, ffff88802160f40c) [ 117.360061][ T9855] [ 117.360266][ T9855] The buggy address belongs to the physical page: [ 117.360813][ T9855] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21608 [ 117.361562][ T9855] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 117.362285][ T9855] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 117.362929][ T9855] page_type: f5(slab) [ 117.363282][ T9855] raw: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.364015][ T9855] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.364750][ T9855] head: 00fff00000000040 ffff88801a842f00 ffffea0000932000 dead000000000002 [ 117.365491][ T9855] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 117.366232][ T9855] head: 00fff00000000003 ffffea0000858201 00000000ffffffff 00000000ffffffff [ 117.366968][ T9855] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 117.367711][ T9855] page dumped because: kasan: bad access detected [ 117.368259][ T9855] page_owner tracks the page as allocated [ 117.368745][ T9855] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN1 [ 117.370541][ T9855] post_alloc_hook+0x240/0x2a0 [ 117.370954][ T9855] get_page_from_freelist+0x2101/0x21e0 [ 117.371435][ T9855] __alloc_frozen_pages_noprof+0x274/0x380 [ 117.371935][ T9855] alloc_pages_mpol+0x241/0x4b0 [ 117.372360][ T9855] allocate_slab+0x8d/0x380 [ 117.372752][ T9855] ___slab_alloc+0xbe3/0x1400 [ 117.373159][ T9855] __kmalloc_cache_noprof+0x296/0x3d0 [ 117.373621][ T9855] nexthop_net_init+0x75/0x100 [ 117.374038][ T9855] ops_init+0x35c/0x5c0 [ 117.374400][ T9855] setup_net+0x10c/0x320 [ 117.374768][ T9855] copy_net_ns+0x31b/0x4d0 [ 117.375156][ T9855] create_new_namespaces+0x3f3/0x720 [ 117.375613][ T9855] unshare_nsproxy_namespaces+0x11c/0x170 [ 117.376094][ T9855] ksys_unshare+0x4ca/0x8d0 [ 117.376477][ T9855] __x64_sys_unshare+0x38/0x50 [ 117.376879][ T9855] do_syscall_64+0xf3/0x3a0 [ 117.377265][ T9855] page last free pid 9110 tgid 9110 stack trace: [ 117.377795][ T9855] __free_frozen_pages+0xbeb/0xd50 [ 117.378229][ T9855] __put_partials+0x152/0x1a0 [ 117.378625][ T9855] put_cpu_partial+0x17c/0x250 [ 117.379026][ T9855] __slab_free+0x2d4/0x3c0 [ 117.379404][ T9855] qlist_free_all+0x97/0x140 [ 117.379790][ T9855] kasan_quarantine_reduce+0x148/0x160 [ 117.380250][ T9855] __kasan_slab_alloc+0x22/0x80 [ 117.380662][ T9855] __kmalloc_noprof+0x232/0x510 [ 117.381074][ T9855] tomoyo_supervisor+0xc0a/0x1360 [ 117.381498][ T9855] tomoyo_env_perm+0x149/0x1e0 [ 117.381903][ T9855] tomoyo_find_next_domain+0x15ad/0x1b90 [ 117.382378][ T9855] tomoyo_bprm_check_security+0x11c/0x180 [ 117.382859][ T9855] security_bprm_check+0x89/0x280 [ 117.383289][ T9855] bprm_execve+0x8f1/0x14a0 [ 117.383673][ T9855] do_execveat_common+0x528/0x6b0 [ 117.384103][ T9855] __x64_sys_execve+0x94/0xb0 [ 117.384500][ T9855] [ 117.384706][ T9855] Memory state around the buggy address: [ 117.385179][ T9855] ffff88802160f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.385854][ T9855] ffff88802160f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 117.386534][ T9855] >ffff88802160f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.387204][ T9855] ^ [ 117.387566][ T9855] ffff88802160f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388243][ T9855] ffff88802160f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 117.388918][ T9855] ================================================================== The issue takes place if the length field of struct hfsplus_unistr is bigger than HFSPLUS_MAX_STRLEN. The patch simply checks the length of comparing strings. And if the strings' length is bigger than HFSPLUS_MAX_STRLEN, then it is corrected to this value. v2 The string length correction has been added for hfsplus_strcmp(). Reported-by: Jiaming Zhang Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org cc: syzkaller@googlegroups.com Link: https://lore.kernel.org/r/20250919191243.1370388-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit f3f6b3664302e16ef1c6b91034a72df5564d6b8a Author: Alexandre Courbot Date: Mon Sep 8 22:25:55 2025 +0900 gpu: nova-core: use Alignment for alignment-related operations Make use of the newly-available `Alignment` type and remove the corresponding TODO item. Signed-off-by: Alexandre Courbot Reviewed-by: Danilo Krummrich Acked-by: Alexandre Courbot Acked-by: Danilo Krummrich Signed-off-by: Miguel Ojeda commit ea60cea07d8c632e8e593bb9de804abb0f6aee99 Author: Alexandre Courbot Date: Mon Sep 8 22:25:54 2025 +0900 rust: add `Alignment` type Alignment operations are very common in the kernel. Since they are always performed using a power-of-two value, enforcing this invariant through a dedicated type leads to fewer bugs and can improve the generated code. Introduce the `Alignment` type, inspired by the nightly Rust type of the same name and providing the same interface, and a new `Alignable` trait allowing unsigned integers to be aligned up or down. Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Signed-off-by: Alexandre Courbot [ Used `build_assert!`, added intra-doc link, `allow`ed `clippy::incompatible_msrv`, added `feature(const_option)`, capitalized safety comment. - Miguel ] Signed-off-by: Miguel Ojeda commit 9eb6f553026e1268a62aa352af38f70fe7d42a46 Author: Alexander Wilhelm Date: Mon Sep 22 08:16:06 2025 +0200 wifi: ath12k: enforce CPU endian format for all QMI data Currently, the QMI interface only works on little endian systems due to how it encodes and decodes data. Most QMI related data structures do not use endian specific types and are already defined in CPU native order. The ath12k specific QMI structs are an exception: they use partially endian specific types, which prevents the QMI interface from being extended to support big endian systems. Update the two affected ath12k QMI structs to use CPU order types instead. This is required because the QMI interface is being extended to support big endian system, and that support depends on QMI data structures being defined in CPU native order. This change: * preserves compatibility with existing kernels, which only support little endian system * enables future support for big endian systems * aligns ath12k QMI handling with the general QMI design Signed-off-by: Alexander Wilhelm Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250922061607.11543-1-alexander.wilhelm@westermo.com Signed-off-by: Jeff Johnson commit b706fb4e580ba66b2c05be93809807c9312008e2 Author: Manish Dharanenthiran Date: Wed Aug 6 16:47:50 2025 +0530 wifi: ath12k: Use 1KB Cache Flush Command for QoS TID Descriptors Currently, if the descriptor size exceeds 128 bytes, the total descriptor is split into multiple 128-byte segments, each requiring a separate flush cache queue command. This results in multiple commands being issued to flush a single TID, which negatively impacts performance. To optimize this, use the _FLUSH_QUEUE_1K_DESC REO command to flush a 1KB descriptor in a single operation to optimize performance. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Manish Dharanenthiran Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-8-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 5e32edc6942570429d9c64d0641fc2addbf92be1 Author: Nithyanantham Paramasivam Date: Wed Aug 6 16:47:49 2025 +0530 wifi: ath12k: Fix flush cache failure during RX queue update Flush cache failures were observed after RX queue update for TID delete. This occurred because the queue was invalid during flush. Set the VLD bit in the RX queue update command for TID delete. This ensures the queue remains valid during the flush cache process. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-7-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 3bf2e57e7d6cd3e0896c2aa5e86f11aeb7bc3702 Author: Manish Dharanenthiran Date: Wed Aug 6 16:47:48 2025 +0530 wifi: ath12k: Add Retry Mechanism for REO RX Queue Update Failures During stress test scenarios, when the REO command ring becomes full, the RX queue update command issued during peer deletion fails due to insufficient space. In response, the host performs a dma_unmap and frees the associated memory. However, the hardware still retains a reference to the same memory address. If the kernel later reallocates this address, unaware that the hardware is still using it, it can lead to memory corruption-since the host might access or modify memory that is still actively referenced by the hardware. Implement a retry mechanism for the HAL_REO_CMD_UPDATE_RX_QUEUE command during TID deletion to prevent memory corruption. Introduce a new list, reo_cmd_update_rx_queue_list, in the struct ath12k_dp to track pending RX queue updates. Protect this list with reo_rxq_flush_lock, which also ensures synchronized access to reo_cmd_cache_flush_list. Defer memory release until hardware confirms the virtual address is no longer in use, avoiding immediate deallocation on command failure. Release memory for pending RX queue updates via ath12k_dp_rx_reo_cmd_list_cleanup() on system reset if hardware confirmation is not received. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Manish Dharanenthiran Co-developed-by: Nithyanantham Paramasivam Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-6-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6a01985105843e8c043c2bffe25c54b71bc45002 Author: Nithyanantham Paramasivam Date: Wed Aug 6 16:47:47 2025 +0530 wifi: ath12k: Refactor REO command to use ath12k_dp_rx_tid_rxq Introduce ath12k_dp_rx_tid_rxq as a lightweight structure to represent only the necessary fields for REO command construction. Replace direct usage of ath12k_dp_rx_tid in REO command paths with this new structure. This decouples REO command logic from internal TID state representation, improves modularity, and reduces unnecessary data dependencies. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-5-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f829a1f8f27555742c9759870895f22c4ab7febb Author: Nithyanantham Paramasivam Date: Wed Aug 6 16:47:46 2025 +0530 wifi: ath12k: Refactor RX TID buffer cleanup into helper function Introduce ath12k_dp_rx_tid_cleanup() to handle RX TID buffer unmapping and freeing. This replaces duplicated cleanup logic across multiple code paths. This improves code maintainability and avoids redundancy in buffer cleanup operations. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-4-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7c32476253f11210ac24c7818ca07e19bc032521 Author: Nithyanantham Paramasivam Date: Wed Aug 6 16:47:45 2025 +0530 wifi: ath12k: Refactor RX TID deletion handling into helper function Refactor RX TID deletion handling by moving the REO command setup and send sequence into a new helper function: ath12k_dp_rx_tid_delete_handler(). This improves code readability and modularity, and prepares the codebase for potential reuse of the REO command logic in other contexts where RX TID deletion is required. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-3-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 82993345aef6987a916337ebd2fca3ff4a6250a7 Author: Nithyanantham Paramasivam Date: Wed Aug 6 16:47:44 2025 +0530 wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 Increase DP_REO_CMD_RING_SIZE from 128 to 256 to avoid queuing failures observed during stress test scenarios. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250806111750.3214584-2-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit cfe872eba9071efe4292caeceaa65d130e4d3974 Merge: 9578c3906c7d9a 4521438fb076f8 Author: Miguel Ojeda Date: Mon Sep 22 22:07:40 2025 +0200 Merge tag 'rust-timekeeping-v6.18' of https://github.com/Rust-for-Linux/linux into rust-next Pull timekeeping updates from Andreas Hindborg: - Add methods on 'HrTimer' that can only be called with exclusive access to an unarmed timer, or form timer callback context. - Add arithmetic operations to 'Instant' and 'Delta'. - Add a few convenience and access methods to 'HrTimer' and 'Instant'. * tag 'rust-timekeeping-v6.18' of https://github.com/Rust-for-Linux/linux: rust: time: Implement basic arithmetic operations for Delta rust: time: Implement Add/Sub for Instant rust: hrtimer: Add HrTimer::expires() rust: time: Add Instant::from_ktime() rust: hrtimer: Add forward_now() to HrTimer and HrTimerCallbackContext rust: hrtimer: Add HrTimerCallbackContext and ::forward() rust: hrtimer: Add HrTimer::raw_forward() and forward() rust: hrtimer: Add HrTimerInstant rust: hrtimer: Document the return value for HrTimerHandle::cancel() commit 2cdae413cd3ee6aad782cf4bce8c10fdb0f0657c Author: Burak Emir Date: Mon Sep 8 07:21:55 2025 +0000 rust: add dynamic ID pool abstraction for bitmap This is a port of the Binder data structure introduced in commit 15d9da3f818c ("binder: use bitmap for faster descriptor lookup") to Rust. Like drivers/android/dbitmap.h, the ID pool abstraction lets clients acquire and release IDs. The implementation uses a bitmap to know what IDs are in use, and gives clients fine-grained control over the time of allocation. This fine-grained control is needed in the Android Binder. We provide an example that release a spinlock for allocation and unit tests (rustdoc examples). The implementation does not permit shrinking below capacity below BITS_PER_LONG. Suggested-by: Alice Ryhl Suggested-by: Yury Norov Reviewed-by: Alice Ryhl Signed-off-by: Burak Emir Signed-off-by: Yury Norov (NVIDIA) commit 38cc91db2e87ab55bfca2b194e791867b77f9e55 Author: Burak Emir Date: Mon Sep 8 07:21:54 2025 +0000 rust: add find_bit_benchmark_rust module. Microbenchmark protected by a config FIND_BIT_BENCHMARK_RUST, following `find_bit_benchmark.c` but testing the Rust Bitmap API. We add a fill_random() method protected by the config in order to maintain the abstraction. The sample output from the benchmark, both C and Rust version: find_bit_benchmark.c output: ``` Start testing find_bit() with random-filled bitmap [ 438.101937] find_next_bit: 860188 ns, 163419 iterations [ 438.109471] find_next_zero_bit: 912342 ns, 164262 iterations [ 438.116820] find_last_bit: 726003 ns, 163419 iterations [ 438.130509] find_nth_bit: 7056993 ns, 16269 iterations [ 438.139099] find_first_bit: 1963272 ns, 16270 iterations [ 438.173043] find_first_and_bit: 27314224 ns, 32654 iterations [ 438.180065] find_next_and_bit: 398752 ns, 73705 iterations [ 438.186689] Start testing find_bit() with sparse bitmap [ 438.193375] find_next_bit: 9675 ns, 656 iterations [ 438.201765] find_next_zero_bit: 1766136 ns, 327025 iterations [ 438.208429] find_last_bit: 9017 ns, 656 iterations [ 438.217816] find_nth_bit: 2749742 ns, 655 iterations [ 438.225168] find_first_bit: 721799 ns, 656 iterations [ 438.231797] find_first_and_bit: 2819 ns, 1 iterations [ 438.238441] find_next_and_bit: 3159 ns, 1 iterations ``` find_bit_benchmark_rust.rs output: ``` [ 451.182459] find_bit_benchmark_rust: [ 451.186688] Start testing find_bit() Rust with random-filled bitmap [ 451.194450] next_bit: 777950 ns, 163644 iterations [ 451.201997] next_zero_bit: 918889 ns, 164036 iterations [ 451.208642] Start testing find_bit() Rust with sparse bitmap [ 451.214300] next_bit: 9181 ns, 654 iterations [ 451.222806] next_zero_bit: 1855504 ns, 327026 iterations ``` Here are the results from 32 samples, with 95% confidence interval. The microbenchmark was built with RUST_BITMAP_HARDENED=n and run on a machine that did not execute other processes. Random-filled bitmap: +-----------+-------+-----------+--------------+-----------+-----------+ | Benchmark | Lang | Mean (ms) | Std Dev (ms) | 95% CI Lo | 95% CI Hi | +-----------+-------+-----------+--------------+-----------+-----------+ | find_bit/ | C | 825.07 | 53.89 | 806.40 | 843.74 | | next_bit | Rust | 870.91 | 46.29 | 854.88 | 886.95 | +-----------+-------+-----------+--------------+-----------+-----------+ | find_zero/| C | 933.56 | 56.34 | 914.04 | 953.08 | | next_zero | Rust | 945.85 | 60.44 | 924.91 | 966.79 | +-----------+-------+-----------+--------------+-----------+-----------+ Rust appears 5.5% slower for next_bit, 1.3% slower for next_zero. Sparse bitmap: +-----------+-------+-----------+--------------+-----------+-----------+ | Benchmark | Lang | Mean (ms) | Std Dev (ms) | 95% CI Lo | 95% CI Hi | +-----------+-------+-----------+--------------+-----------+-----------+ | find_bit/ | C | 13.17 | 6.21 | 11.01 | 15.32 | | next_bit | Rust | 14.30 | 8.27 | 11.43 | 17.17 | +-----------+-------+-----------+--------------+-----------+-----------+ | find_zero/| C | 1859.31 | 82.30 | 1830.80 | 1887.83 | | next_zero | Rust | 1908.09 | 139.82 | 1859.65 | 1956.54 | +-----------+-------+-----------+--------------+-----------+-----------+ Rust appears 8.5% slower for next_bit, 2.6% slower for next_zero. In summary, taking the arithmetic mean of all slow-downs, we can say the Rust API has a 4.5% slowdown. Suggested-by: Alice Ryhl Suggested-by: Yury Norov (NVIDIA) Reviewed-by: Yury Norov (NVIDIA) Reviewed-by: Alice Ryhl Signed-off-by: Burak Emir Signed-off-by: Yury Norov (NVIDIA) commit 11eca92a2caebcc2b3b65ca290385ff4b0498946 Author: Burak Emir Date: Mon Sep 8 07:21:53 2025 +0000 rust: add bitmap API. Provides an abstraction for C bitmap API and bitops operations. This commit enables a Rust implementation of an Android Binder data structure from commit 15d9da3f818c ("binder: use bitmap for faster descriptor lookup"), which can be found in drivers/android/dbitmap.h. It is a step towards upstreaming the Rust port of Android Binder driver. We follow the C Bitmap API closely in naming and semantics, with a few differences that take advantage of Rust language facilities and idioms. The main types are `BitmapVec` for owned bitmaps and `Bitmap` for references to C bitmaps. * We leverage Rust type system guarantees as follows: * all (non-atomic) mutating operations require a &mut reference which amounts to exclusive access. * the `BitmapVec` type implements Send. This enables transferring ownership between threads and is needed for Binder. * the `BitmapVec` type implements Sync, which enables passing shared references &Bitmap between threads. Atomic operations can be used to safely modify from multiple threads (interior mutability), though without ordering guarantees. * The Rust API uses `{set,clear}_bit` vs `{set,clear}_bit_atomic` as names for clarity, which differs from the C naming convention `set_bit` for atomic vs `__set_bit` for non-atomic. * we include enough operations for the API to be useful. Not all operations are exposed yet in order to avoid dead code. The missing ones can be added later. * We take a fine-grained approach to safety: * Low-level bit-ops get a safe API with bounds checks. Calling with an out-of-bounds arguments to {set,clear}_bit becomes a no-op and get logged as errors. * We also introduce a RUST_BITMAP_HARDENED config, which causes invocations with out-of-bounds arguments to panic. * methods correspond to find_* C methods tolerate out-of-bounds since the C implementation does. Also here, out-of-bounds arguments are logged as errors, or panic in RUST_BITMAP_HARDENED mode. * We add a way to "borrow" bitmaps from C in Rust, to make C bitmaps that were allocated in C directly usable in Rust code (`Bitmap`). * the Rust API is optimized to represent the bitmap inline if it would fit into a pointer. This saves allocations which is relevant in the Binder use case. The underlying C bitmap is *not* exposed for raw access in Rust. Doing so would permit bypassing the Rust API and lose static guarantees. An alternative route of vendoring an existing Rust bitmap package was considered but suboptimal overall. Reusing the C implementation is preferable for a basic data structure like bitmaps. It enables Rust code to be a lot more similar and predictable with respect to C code that uses the same data structures and enables the use of code that has been tried-and-tested in the kernel, with the same performance characteristics whenever possible. We use the `usize` type for sizes and indices into the bitmap, because Rust generally always uses that type for indices and lengths and it will be more convenient if the API accepts that type. This means that we need to perform some casts to/from u32 and usize, since the C headers use unsigned int instead of size_t/unsigned long for these numbers in some places. Adds new MAINTAINERS section BITMAP API [RUST]. Suggested-by: Alice Ryhl Suggested-by: Yury Norov Signed-off-by: Burak Emir Reviewed-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit 6cf93a9ed39e9f86c7f69c28078500270e70a695 Author: Burak Emir Date: Mon Sep 8 07:21:52 2025 +0000 rust: add bindings for bitops.h Makes atomic set_bit and clear_bit inline functions as well as the non-atomic variants __set_bit and __clear_bit available to Rust. Adds a new MAINTAINERS section BITOPS API BINDINGS [RUST]. Suggested-by: Alice Ryhl Suggested-by: Yury Norov Signed-off-by: Burak Emir Reviewed-by: Alice Ryhl Acked-by: Yury Norov (NVIDIA) Signed-off-by: Yury Norov (NVIDIA) commit 0452b4ab2961093f23bb289b0112351b917fb23c Author: Burak Emir Date: Mon Sep 8 07:21:51 2025 +0000 rust: add bindings for bitmap.h Makes the bitmap_copy_and_extend inline function available to Rust. Adds F: to existing MAINTAINERS section BITMAP API BINDINGS [RUST]. - Suggested-by: Alice Ryhl Suggested-by: Yury Norov Signed-off-by: Burak Emir Reviewed-by: Alice Ryhl Acked-by: Yury Norov (NVIDIA) Signed-off-by: Yury Norov (NVIDIA) commit 4688bb13dafbf07c4810c552245b4700e3624018 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:40 2025 +0200 phy: rockchip-pcie: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. The Rockchip PCIe PHY driver, used on the RK3399, has its own definition of HIWORD_UPDATE. Remove it, and replace instances of it with hw_bitfield.h's FIELD_PREP_WM16. To achieve this, some mask defines are reshuffled, as FIELD_PREP_WM16 uses the mask as both the mask of bits to write and to derive the shift amount from in order to shift the value. In order to ensure that the mask is always a constant, the inst->index shift is performed after the FIELD_PREP_WM16, as this is a runtime value. >From this, we gain compile-time error checking, and in my humble opinion nicer code, as well as a single definition of this macro across the entire codebase to aid in code comprehension. Tested on a RK3399 ROCKPro64, where PCIe still works as expected when accessing an NVMe drive. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit b8b567718844da9cf37a843706e60e71b8071645 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:39 2025 +0200 clk: sp7021: switch to FIELD_PREP_WM16 macro The sp7021 clock driver has its own shifted high word mask macro, similar to the ones many Rockchip drivers have. Remove it, and replace instances of it with hw_bitfield.h's FIELD_PREP_WM16 macro, which does the same thing except in a common macro that also does compile-time error checking. This was compile-tested with 32-bit ARM with Clang, no runtime tests were performed as I lack the hardware. However, I verified that fix commit 5c667d5a5a3e ("clk: sp7021: Adjust width of _m in HWM_FIELD_PREP()") is not regressed. No warning is produced. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Acked-by: Stephen Boyd Signed-off-by: Yury Norov (NVIDIA) commit 5498f07842cbddd86c725b960acb8e478684ca45 Author: Fushuai Wang Date: Mon Aug 11 14:52:16 2025 +0800 soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu() Replace the opencoded for_each_cpu(cpu, cpu_online_mask) loop with the more readable and equivalent for_each_online_cpu(cpu) macro. Signed-off-by: Fushuai Wang Link: https://lore.kernel.org/r/20250811065216.3320-1-wangfushuai@baidu.com Signed-off-by: Christophe Leroy commit 9578c3906c7d9a6f7c1ffefc73a4e8fc3452f336 Author: Tamir Duberstein Date: Wed Aug 13 11:45:05 2025 -0400 rust: macros: reduce collections in `quote!` macro Remove a handful of unnecessary intermediate vectors and token streams; mainly the top-level stream can be directly extended with the notable exception of groups. Remove an unnecessary `#[allow(dead_code)]` added in commit dbd5058ba60c ("rust: make pin-init its own crate"). Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 9b277fca90c39c8b749e659bf5c23e924c46c93b Merge: 35626012877b80 1be5b82c45850f Author: Jakub Kicinski Date: Mon Sep 22 11:51:27 2025 -0700 Merge branch 'mptcp-pm-netlink-announce-server-side-flag' Matthieu Baerts says: ==================== mptcp: pm: netlink: announce server-side flag Now that the 'flags' attribute is used, it seems interesting to add one flag for 'server-side', a boolean value. Here are a few patches related to the 'server-side' attribute: - Patch 1: only announce this attribute on the server side. - Patch 2: announce the 'server-side' flag when this is the case. - Patch 3: deprecate the 'server-side' attribute. - Patch 4: use the 'server-side' flag in the selftests. - Patches 5, 6: small cleanups when working on code around. ==================== Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-0-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit 1be5b82c45850f495adf67887075507d5e8a860b Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:09:03 2025 +0200 mptcp: remove unused returned value of check_data_fin When working on a fix modifying mptcp_check_data_fin(), I noticed the returned value was no longer used. It looks like it was used for 3 days, between commit 7ed90803a213 ("mptcp: send explicit ack on delayed ack_seq incr") and commit ea4ca586b16f ("mptcp: refine MPTCP-level ack scheduling"). This returned value can be safely removed. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-6-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit 5c967ebb551919661166305c0ff9422e41065c02 Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:09:02 2025 +0200 mptcp: use _BITUL() instead of (1 << x) Simply to use the proper way to declare bits, and to align with all other flags declared in this file. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-5-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit e6c35529452e658272d370535e8c1424dbb8e5d2 Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:09:01 2025 +0200 selftests: mptcp: pm: get server-side flag server-side info linked to the MPTCP connect/established events can now come from the flags, in addition to the dedicated attribute. The attribute is now deprecated -- in favour of the new flag, and will be removed later on. Print this info only once. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-4-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit c8bc168f5f3d152b378726f89e8561ccedcb5d5c Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:09:00 2025 +0200 mptcp: pm: netlink: deprecate server-side attribute Now that such info is in the 'flags' attribute, it is time to deprecate the dedicated 'server-side' attribute. It will be removed in a few versions. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-3-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit 3d7ae91107b839ffeeb19730a2e2a46e0054bae8 Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:08:59 2025 +0200 mptcp: pm: netlink: announce server-side flag Now that the 'flags' attribute is used, it seems interesting to add one flag for 'server-side', a boolean value. This is duplicating the info from the dedicated 'server-side' attribute, but it will be deprecated in the next commit, and removed in a few versions. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-2-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit c9809f03c158f07eaa76c7dd3606fc0a184520f2 Author: Matthieu Baerts (NGI0) Date: Fri Sep 19 14:08:58 2025 +0200 mptcp: pm: netlink: only add server-side attr when true This attribute is a boolean. No need to add it to set it to 'false'. Indeed, the default value when this attribute is not set is naturally 'false'. A few bytes can then be saved by not adding this attribute if the connection is not on the server side. This prepares the future deprecation of its attribute, in favour of a new flag. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250919-net-next-mptcp-server-side-flag-v1-1-a97a5d561a8b@kernel.org Signed-off-by: Jakub Kicinski commit 35626012877b80436e0627feb16520db4f0ba53e Author: Vivian Wang Date: Fri Sep 19 20:04:33 2025 +0800 net: spacemit: Make stats_lock softirq-safe While most of the statistics functions (emac_get_stats64() and such) are called with softirqs enabled, emac_stats_timer() is, as its name suggests, also called from a timer, i.e. called in softirq context. All of these take stats_lock. Therefore, make stats_lock softirq-safe by changing spin_lock() into spin_lock_bh() for the functions that get statistics. Also, instead of directly calling emac_stats_timer() in emac_up() and emac_resume(), set the timer to trigger instead, so that emac_stats_timer() is only called from the timer. It will keep using spin_lock(). This fixes a lockdep warning, and potential deadlock when stats_timer is triggered in the middle of getting statistics. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/a52c0cf5-0444-41aa-b061-a0a1d72b02fe@samsung.com/ Signed-off-by: Vivian Wang Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20250919-k1-ethernet-fix-lock-v1-1-c8b700aa4954@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 4b1eb8337e6bc1a8831e4ba8feff5927a8fb9a34 Merge: 78e87f9d5358a5 ac0e650fde45c4 Author: Jakub Kicinski Date: Mon Sep 22 11:49:18 2025 -0700 Merge branch 'net-enetc-improve-the-interface-for-obtaining-phc_index' Wei Fang says: ==================== net: enetc: improve the interface for obtaining phc_index The first patch is to fix the issue that a sleeping function is called in the context of rcu_read_lock(). The second patch is to use the generic API instead of the custom API to get phc_index. In addition, the second patch depends on the first patch to work. v1: https://lore.kernel.org/20250918074454.1742328-1-wei.fang@nxp.com ==================== Link: https://patch.msgid.link/20250919084509.1846513-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit ac0e650fde45c41f335024c82f408f09000d5317 Author: Wei Fang Date: Fri Sep 19 16:45:09 2025 +0800 net: enetc: use generic interfaces to get phc_index for ENETC v1 The commit 61f132ca8c46 ("ptp: add helpers to get the phc_index by of_node or dev") has added two generic interfaces to get the phc_index of the PTP clock. This eliminates the need for PTP device drivers to provide custom APIs for consumers to retrieve the phc_index. This has already been implemented for ENETC v4 and is also applicable to ENETC v1. Therefore, the global variable enetc_phc_index is removed from the driver. ENETC v1 now uses the same interface as v4 to get phc_index. Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20250919084509.1846513-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 26644c90e8fbf99d381d11873c5e8861ef0029d8 Author: Wei Fang Date: Fri Sep 19 16:45:08 2025 +0800 net: enetc: fix sleeping function called from rcu_read_lock() context The rcu_read_lock() has been introduced in __ethtool_get_ts_info() since the commit 4c61d809cf60 ("net: ethtool: Fix suspicious rcu_dereference usage"). Therefore, the device drivers cannot use any sleeping functions when implementing the callback of ethtool_ops::get_ts_info(). Currently, pci_get_slot() is used in enetc_get_ts_info(), but it calls down_read() which might sleep, so this is a potential issue. Therefore, to fix this issue, pci_get_domain_bus_and_slot() is used to replace pci_get_slot() in enetc_get_ts_info(). Reported-by: Vladimir Oltean Closes: https://lore.kernel.org/netdev/20250918124823.t3xlzn7w2glzkhnx@skbuf/ Fixes: f5b9a1cde0a2 ("net: enetc: add PTP synchronization support for ENETC v4") Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20250919084509.1846513-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 78e87f9d5358a5131191e439ef9a0c9f7c64423f Merge: 50d51cef555ee4 bb6f9445666e1e Author: Jakub Kicinski Date: Mon Sep 22 11:38:47 2025 -0700 Merge branch 'tcp-clean-up-inet_hash-and-inet_unhash' Kuniyuki Iwashima says: ==================== tcp: Clean up inet_hash() and inet_unhash(). While reviewing the ehash fix series from Xuanqiang Luo [0], I noticed that inet_twsk_hashdance_schedule() checks the retval of __sk_nulls_del_node_init_rcu(), which looks confusing. The test exists from the pre-git era: $ git blame -L:tcp_tw_hashdance net/ipv4/tcp_minisocks.c e48c414ee61f4~ Patch 3 is to clarify that the retval check is unnecessary in inet_twsk_hashdance_schedule(), but I'll delegate its removal to the Xuanqiang's series. Patch 1 & 2 are minor cleanups. [0]: https://lore.kernel.org/netdev/20250916103054.719584-4-xuanqiang.luo@linux.dev/ ==================== Link: https://patch.msgid.link/20250919083706.1863217-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bb6f9445666e1ed9f39c805e153243a65ea05257 Author: Kuniyuki Iwashima Date: Fri Sep 19 08:35:30 2025 +0000 tcp: Remove redundant sk_unhashed() in inet_unhash(). inet_unhash() checks sk_unhashed() twice at the entry and after locking ehash/lhash bucket. The former was somehow added redundantly by commit 4f9bf2a2f5aa ("tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH."). inet_unhash() is called for the full socket from 4 places, and it is always under lock_sock() or the socket is not yet published to other threads: 1. __sk_prot_rehash() -> called from inet_sk_reselect_saddr(), which has lockdep_sock_is_held() 2. sk_common_release() -> called when inet_create() or inet6_create() fail, then the socket is not yet published 3. tcp_set_state() -> calls tcp_call_bpf_2arg(), and tcp_call_bpf() has sock_owned_by_me() 4. inet_ctl_sock_create() -> creates a kernel socket and unhashes it immediately, but TCP socket is not hashed in sock_create_kern() (only SOCK_RAW is) So we do not need to check sk_unhashed() twice before/after ehash/lhash lock in inet_unhash(). Let's remove the 2nd one. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250919083706.1863217-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0ac44301e3bf4f5abc892ab530188ca95c61e59f Author: Kuniyuki Iwashima Date: Fri Sep 19 08:35:29 2025 +0000 tcp: Remove inet6_hash(). inet_hash() and inet6_hash() are exactly the same. Also, we do not need to export inet6_hash(). Let's consolidate the two into __inet_hash() and rename it to inet_hash(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250919083706.1863217-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6445bb832dc0ba0ab816e5bd79ef0209cdd46d3a Author: Kuniyuki Iwashima Date: Fri Sep 19 08:35:28 2025 +0000 tcp: Remove osk from __inet_hash() arg. __inet_hash() is called from inet_hash() and inet6_hash with osk NULL. Let's remove the 2nd arg from __inet_hash(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250919083706.1863217-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 50d51cef555ee42fe47dd51b71366a77895e5f0b Author: David Yang Date: Fri Sep 19 13:35:33 2025 +0800 selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt Quoted from musl wiki: GNU getopt permutes argv to pull options to the front, ahead of non-option arguments. musl and the POSIX standard getopt stop processing options at the first non-option argument with no permutation. Thus these scripts stop working on musl since non-option arguments for tools using getopt() (in this case, (ar)ping) do not always come last. Fix it by reordering arguments. Signed-off-by: David Yang Reviewed-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250919053538.1106753-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 5b87014e999903b63c6416183446bcc18aabe5ef Author: Mario Limonciello (AMD) Date: Mon Sep 15 15:43:16 2025 -0500 x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() acpi_processor_power_init_bm_check() has an open coded implementation of cpu_feature_enabled() to detect X86_FEATURE_ZEN. Switch to using cpu_feature_enabled(). Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Rafael J. Wysocki commit 4d330fe54145ecfbb657ac01a554fdedf3c1927e Author: Chen Pei Date: Sat Sep 13 15:08:15 2025 +0800 ACPI: SPCR: Support Precise Baud Rate field The Microsoft Serial Port Console Redirection (SPCR) specification revision 1.09 comprises additional field: Precise Baud Rate [1]. It is used to describe non-traditional baud rates (such as those used by high-speed UARTs). It contains a specific non-zero baud rate which overrides the value of the Configured Baud Rate field. If this field is zero or not present, Configured Baud Rate is used. Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1] Signed-off-by: Chen Pei Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com [ rjw: Corrected typo in the subject ] Signed-off-by: Rafael J. Wysocki commit c656932c3ece3eebe6240bb20e5c1d8aa0d7ecb0 Author: Dharma Balasubiramani Date: Mon Sep 15 14:43:57 2025 +0530 ARM: dts: microchip: sam9x7: Add qspi controller Add support for QSPI controller. Signed-off-by: Dharma Balasubiramani Link: https://lore.kernel.org/r/20250915-sam9x7-qspi-dtsi-v1-1-1cc9adba7573@microchip.com Signed-off-by: Nicolas Ferre commit 0950c64ae38661bd97127e9aa0522f1624f82006 Author: Kriish Sharma Date: Mon Sep 22 12:26:06 2025 +0000 workqueue: fix texinfodocs warning for WQ_* flags reference Sphinx emitted a warning during make texinfodocs: WARNING: Inline literal start-string without end-string. This was caused by the trailing '*' in "%WQ_*" being parsed as reStructuredText markup in the kernel-doc comment. Escape the '*' in the comment so that Sphinx treats it as a literal character, resolving the warning. Signed-off-by: Kriish Sharma Signed-off-by: Tejun Heo commit 86bcd23df9cec9c2df520ae0982033e301d3c184 Author: Bagas Sanjaya Date: Tue Sep 9 07:39:52 2025 +0700 KVM: x86: Fix hypercalls docs section number order Commit 4180bf1b655a79 ("KVM: X86: Implement "send IPI" hypercall") documents KVM_HC_SEND_IPI hypercall, yet its section number duplicates KVM_HC_CLOCK_PAIRING one (which both are 6th). Fix the numbering order so that the former should be 7th. Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20250909003952.10314-1-bagasdotme@gmail.com Signed-off-by: Sean Christopherson commit 299fad4133677b845ce962f78c9cf75bded63f61 Author: Mario Limonciello Date: Mon Sep 8 22:19:15 2025 -0500 PCI/PM: Skip resuming to D0 if device is disconnected When a device is surprise-removed (e.g., due to a dock unplug), the PCI core unconfigures all downstream devices and sets their error state to pci_channel_io_perm_failure. This marks them as disconnected via pci_dev_is_disconnected(). During device removal, the runtime PM framework may attempt to resume the device to D0 via pm_runtime_get_sync(), which calls into pci_power_up(). Since the device is already disconnected, this resume attempt is unnecessary and results in a predictable errors like this, typically when undocking from a TBT3 or USB4 dock with PCIe tunneling: pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible Avoid powering up disconnected devices by checking their status early in pci_power_up() and returning -EIO. Suggested-by: Lukas Wunner Signed-off-by: Mario Limonciello [bhelgaas: add typical message] Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Reviewed-by: Ilpo Järvinen Acked-by: Rafael J. Wysocki Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org commit e9713655b29a47d23cbf07aacf50b0ce8ee0a850 Author: Christophe Leroy Date: Thu Sep 18 18:23:23 2025 +0200 soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver Remove legacy-of-mm-gpiochip.h header file. The above mentioned file provides an OF API that's deprecated. There is no agnostic alternatives to it and we have to open code the logic which was hidden behind of_mm_gpiochip_add_data(). Note, most of the GPIO drivers are using their own labeling schemas and resource retrieval that only a few may gain of the code deduplication, so whenever alternative is appear we can move drivers again to use that one. As a side effect this change fixes a potential memory leak on an error path, if of_mm_gpiochip_add_data() fails. [Text copied from commit 34064c8267a6 ("powerpc/8xx: Drop legacy-of-mm-gpiochip.h header")] Suggested-by: Bartosz Golaszewski Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/e8a5d2c5b72233bd36da7fecc0a551ca54d39478.1758212309.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy commit 156460811def1ae699eebe40d9678e4ce3d1d9bc Author: Christophe Leroy Date: Thu Sep 18 18:23:22 2025 +0200 soc: fsl: qe: Change GPIO driver to a proper platform driver In order to be able to add interrupts to the GPIOs, first change the QE GPIO driver to the proper platform driver in order to allow initialisation to be done in the right order, otherwise the GPIOs get added before the interrupts are registered. Remove linux/of.h and linux/property.h which are unused. And to improve readability and reduce risk of errors, add a macro to transform a pin number into the mask that matches the associated bit in registers. Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/b0b4480255569c7f0dfe58854a444f9a40da6681.1758212309.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy commit e8f85d7884e0890ea43aa36396bcaf8a2659c2ac Author: Sean Christopherson Date: Thu Sep 18 17:46:39 2025 -0700 KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't Remove the IsBranch flag from ENTER and LEAVE in KVM's emulator, as ENTER and LEAVE are stack operations, not branches. Add forced emulation of said instructions to the PMU counters test to prove that KVM diverges from hardware, and to guard against regressions. Opportunistically add a missing "1 MOV" to the selftest comment regarding the number of instructions per loop, which commit 7803339fa929 ("KVM: selftests: Use data load to trigger LLC references/misses in Intel PMU") forgot to add. Fixes: 018d70ffcfec ("KVM: x86: Update vPMCs when retiring branch instructions") Cc: Jim Mattson Reviewed-by: Jim Mattson Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919004639.1360453-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 006824a1cb3bd4001745a2b1cc83c43fad522851 Author: Jerome Brunet Date: Wed Jul 2 18:48:34 2025 +0200 NTB: epf: Add Renesas rcar support Add virtual non-transparent bridge support for Renesas rcar platform Reviewed-by: Frank Li Signed-off-by: Jerome Brunet Signed-off-by: Jon Mason commit 5ad865862a0fd349163243e1834ed98ba9b81905 Author: Jerome Brunet Date: Wed Jul 2 18:48:33 2025 +0200 NTB: epf: Allow arbitrary BAR mapping The NTB epf host driver assumes the BAR number associated with a memory window is just incremented from the BAR number associated with MW1. This seems to have been enough so far but this is not really how the endpoint side work and the two could easily become mis-aligned. ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window index + 2, which means the function only returns a proper result if BAR_2 is associated with MW1. Instead, fully describe and allow arbitrary NTB BAR mapping. Signed-off-by: Jerome Brunet Signed-off-by: Jon Mason commit 3db835dd8f9a78e9709cb48b77d89b41792e9281 Author: fuyuanli Date: Mon Aug 25 17:15:08 2025 +0800 ntb: Add mutex to make link_event_callback executed linearly. Since the CPU selected by schedule_work is uncertain, multiple link_event callbacks may be executed at same time. For example, after peer's link is up, it is down quickly before local link_work completed. If link_cleanup is added to the workqueue of another CPU, then link_work and link_cleanup may be executed at the same time. So add a mutex to prevent them from being executed concurrently. Signed-off-by: fuyuanli Reviewed-by: Logan Gunthorpe Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit eb4431bf8823cc55be6c705c122980be0690a904 Author: Basavaraj Natikar Date: Thu Sep 18 13:04:48 2025 +0530 MAINTAINERS: Update for the NTB AMD driver maintainer Adding myself to the maintainers list for the ntb_hw_amd driver. Signed-off-by: Basavaraj Natikar Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit f0c260f175510e7e8a518e8e09bd57a96188f108 Author: Basavaraj Natikar Date: Thu Sep 18 13:04:47 2025 +0530 ntb_hw_amd: Update amd_ntb_get_link_status to support latest generation secondary topology In the NTB secondary topology configuration of the latest generation, the device behaves like an endpoint. Hence, add endpoint support and update amd_ntb_get_link_status to accommodate endpoint devices. Co-developed-by: Sanath S Signed-off-by: Sanath S Signed-off-by: Basavaraj Natikar Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 Author: Larshin Sergey Date: Mon Sep 22 16:13:58 2025 +0300 fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+8743fca924afed42f93e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Larshin Sergey Link: https://patch.msgid.link/20250922131358.745579-1-Sergey.Larshin@kaspersky.com Signed-off-by: Jan Kara commit 1ae4e2dbf4cbf7c1ab2bdc89af1dc1a6af4106b3 Author: Stephan Gerhold Date: Wed Aug 20 18:02:36 2025 +0200 remoteproc: qcom: pas: Drop redundant assignment to ret We don't have a way to detect if the lite firmware is actually running yet, so we should ignore the return status of qcom_scm_pas_shutdown() for now. The assignment to "ret" is not used anywhere, so just drop it. Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-4-910b1a3aff71@linaro.org Signed-off-by: Bjorn Andersson commit 142964960c7c35de5c5f7bdd61c32699de693630 Author: Stephan Gerhold Date: Wed Aug 20 18:02:35 2025 +0200 remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separate firmware binaries for the main firmware and the DTB. The same applies for the "lite" firmware loaded by the boot firmware. When preparing to load the new ADSP firmware we shutdown the lite_pas_id for the main firmware, but we don't shutdown the corresponding lite pas_id for the DTB. The fact that we're leaving it "running" forever becomes obvious if you try to reuse (or just access) the memory region used by the "lite" firmware: The &adsp_boot_mem is accessible, but accessing the &adsp_boot_dtb_mem results in a crash. We don't support reusing the memory regions currently, but nevertheless we should not keep part of the lite firmware running. Fix this by adding the lite_dtb_pas_id and shutting it down as well. We don't have a way to detect if the lite firmware is actually running yet, so ignore the return status of qcom_scm_pas_shutdown() for now. This was already the case before, the assignment to "ret" is not used anywhere. Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP") Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org Signed-off-by: Bjorn Andersson commit 479bec4cb39a1bfb2e5d3e3959d660f61399cad4 Author: Thorsten Blum Date: Wed Sep 17 17:09:41 2025 +0200 pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify pdsfc_fw_rpc(). Return early if an error occurs and remove the obsolete 'err_out' label. No functional changes intended. Link: https://patch.msgid.link/r/20250917150941.168887-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Dave Jiang Reviewed-by: Jason Gunthorpe Tested-by: Brett Creeley Signed-off-by: Jason Gunthorpe commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 Author: Stephan Gerhold Date: Wed Aug 20 18:02:34 2025 +0200 remoteproc: qcom: q6v5: Avoid handling handover twice A remoteproc could theoretically signal handover twice. This is unexpected and would break the reference counting for the handover resources (power domains, clocks, regulators, etc), so add a check to prevent that from happening. Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org Signed-off-by: Bjorn Andersson commit 110be46f5afe27b66caa2d12473a84cd397b1925 Author: Stephan Gerhold Date: Wed Aug 20 18:02:33 2025 +0200 remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice enable_irq() and disable_irq() are reference counted, so we must make sure that each enable_irq() is always paired with a single disable_irq(). If we call disable_irq() twice followed by just a single enable_irq(), the IRQ will remain disabled forever. For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() will end up being called twice, because disable_irq() also happens in qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more sense to have the rollback handled always by qcom_q6v5_unprepare(). Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org Signed-off-by: Bjorn Andersson commit e11727b2b0ca23d147c4d42f494a59aba0749c89 Author: Hendrik Brueckner Date: Thu Sep 18 16:53:41 2025 +0200 s390/configs: Enable additional network features Enable AF_XDP, kTLS, and Mellanox subfunctions to accelerate network packet processing. Signed-off-by: Hendrik Brueckner Signed-off-by: Alexander Gordeev commit d969328c513c6679b4be11a995ffd4d184c25b34 Merge: 7cf730321132e7 5890f504ef5431 Author: Christian Brauner Date: Mon Sep 22 14:47:25 2025 +0200 Merge patch series "ns: minor tweaks" Christian Brauner says: * Add a missing include into the cgroup namespace header. * Simplify ns_common_init{_inum}() and derive the namespace operations from the namespace type. * Add debug asserts into ns_common_init{_inum}() to catch bugs. * patches from https://lore.kernel.org/20250922-work-namespace-ns_common-fixes-v1-0-3c26aeb30831@kernel.org: ns: add ns_debug() ns: simplify ns_common_init() further cgroup: add missing ns_common include Signed-off-by: Christian Brauner commit 5890f504ef543190beae2a4e244bbfa7c3e0b57c Author: Christian Brauner Date: Mon Sep 22 14:42:37 2025 +0200 ns: add ns_debug() Add ns_debug() that asserts that the correct operations are used for the namespace type. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d7610cb7454bbd8bf6d58f71b0ed57155d3c545f Author: Christian Brauner Date: Mon Sep 22 14:42:36 2025 +0200 ns: simplify ns_common_init() further Simply derive the ns operations from the namespace type. Acked-by: Thomas Gleixner Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 8535bd38b4d58a3d19bf8e7dfa66e1d8180b316a Author: Christian Brauner Date: Mon Sep 22 14:42:35 2025 +0200 cgroup: add missing ns_common include Add the missing include of the ns_common header. Acked-by: Tejun Heo Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit da9e5c04be589524101aac31746902b6803581e4 Author: Can Peng Date: Fri Sep 19 18:00:42 2025 +0800 arm/syscalls: mark syscall invocation as likely in invoke_syscall The invoke_syscall() function is overwhelmingly called for valid system call entries. Annotate the main path with likely() to help the compiler generate better branch prediction hints, reducing CPU pipeline stalls due to mispredictions. This is a micro-optimization targeting syscall-heavy workloads [1]. Link: https://lore.kernel.org/r/20250922121730.986761-1-pengcan@kylinos.cn [1] Signed-off-by: Can Peng Signed-off-by: Will Deacon commit 878702702dbbd933a5da601c75b8e58eadeec311 Author: Sakari Ailus Date: Mon Sep 22 15:06:31 2025 +0300 spi: ljca: Remove Wentong's e-mail address Wentong's e-mail address no longer works, remove it. Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250922120632.10460-4-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit 6d2f913fda5683fbd4c3580262e10386c1263dfb Author: Yushan Wang Date: Fri Aug 29 18:14:27 2025 +0800 Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU Some of HiSilicon V3 PMU hardware is divided into parts to fulfill the job of monitoring specific parts of a device. Add description on that as well as the newly added ext option for L3C PMU. Acked-by: Jonathan Cameron Signed-off-by: Yushan Wang Reviewed-by: Yicong Yang Signed-off-by: Will Deacon commit 272dd0e5e58d9c216771aa4a9dc1e36a662792da Author: Yushan Wang Date: Fri Aug 29 18:14:26 2025 +0800 Documentation: hisi-pmu: Fix of minor format error The inline path of sysfs should be placed in literal blocks to make documentation look better. Acked-by: Jonathan Cameron Acked-by: Yicong Yang Signed-off-by: Yushan Wang Signed-off-by: Will Deacon commit 475d94dfe7c635b4311b6c9d87f49534eab6589c Author: Yicong Yang Date: Fri Aug 29 18:14:25 2025 +0800 drivers/perf: hisi: Add support for L3C PMU v3 This patch adds support for L3C PMU v3. The v3 L3C PMU supports an extended events space which can be controlled in up to 2 extra address spaces with separate overflow interrupts. The layout of the control/event registers are kept the same. The extended events with original ones together cover the monitoring job of all transactions on L3C. The extended events is specified with `ext=[1|2]` option for the driver to distinguish, like below: perf stat -e hisi_sccl0_l3c0_0/event=,ext=1/ Currently only event option using config bit [7, 0]. There's still plenty unused space. Make ext using config [16, 17] and reserve bit [15, 8] for event option for future extension. With the capability of extra counters, number of counters for HiSilicon uncore PMU could reach up to 24, the usedmap is extended accordingly. The hw_perf_event::event_base is initialized to the base MMIO address of the event and will be used for later control, overflow handling and counts readout. We still make use of the Uncore PMU framework for handling the events and interrupt migration on CPU hotplug. The framework's cpuhp callback will handle the event migration and interrupt migration of orginial event, if PMU supports extended events then the interrupt of extended events is migrated to the same CPU choosed by the framework. A new HID of HISI0215 is used for this version of L3C PMU. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Co-developed-by: Yushan Wang Signed-off-by: Yushan Wang Signed-off-by: Will Deacon commit b3abb08d6f628a76c36bf7da9508e1a67bf186a0 Author: Yicong Yang Date: Fri Aug 29 18:14:24 2025 +0800 drivers/perf: hisi: Refactor the event configuration of L3C PMU The event register is configured using hisi_pmu::base directly since only one address space is supported for L3C PMU. We need to extend if events configuration locates in different address space. In order to make preparation for such hardware, extract the event register configuration to separate function using hw_perf_event::event_base as each event's base address. Implement a private hisi_uncore_ops::get_event_idx() callback for initialize the event_base besides get the hardware index. No functional changes intended. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Signed-off-by: Will Deacon commit ede339ff61c61a1ac3bedd01528e4d701d4aea22 Author: Yicong Yang Date: Fri Aug 29 18:14:23 2025 +0800 drivers/perf: hisi: Extend the field of tt_core Currently the tt_core's using config1's bit [7, 0] and can not be extended. For some platforms there's more the 8 CPUs sharing the L3 cache. So make tt_core use config2's bit [15, 0] and the remaining bits in config2 is reserved for extension. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Reviewed-by: Jonathan Cameron Signed-off-by: Will Deacon commit 2271f1634243897cf18763386994d613a0594d98 Author: Yicong Yang Date: Fri Aug 29 18:14:22 2025 +0800 drivers/perf: hisi: Extract the event filter check of L3C PMU L3C PMU has 4 filter options which are sharing perf_event_attr::config1. Driver will check config1 to see whether a certain event has a filter setting. It'll be incorrect if we make use of other bits in config1 for non-filter options. So check whether each filter options are set directly in a separate function instead. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Reviewed-by: Jonathan Cameron Signed-off-by: Will Deacon commit 0960e535be5403954701b06e722b68b53463cbe0 Author: Yicong Yang Date: Fri Aug 29 18:14:21 2025 +0800 drivers/perf: hisi: Simplify the probe process of each L3C PMU version Version 1 and 2 of L3C PMU also use different HID. Make use of struct acpi_device_id::driver_data for version specific information rather than judge the version register. This will help to simplify the probe process and also a bit easier for extension. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Reviewed-by: Jonathan Cameron Signed-off-by: Will Deacon commit 4550244b53b7ef81607c0d52c72f835718497218 Author: Yicong Yang Date: Fri Aug 29 18:14:20 2025 +0800 drivers/perf: hisi: Export hisi_uncore_pmu_isr() Currently Uncore PMU framework assume one PMU device only have one interrupt and will help register the interrupt handler. It cannot support a PMU with multiple interrupt resources. An uncore PMU may have multiple interrupts that can share the same handler. Export hisi_uncore_pmu_isr() to allow drivers register the irq handler by their own routine. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Reviewed-by: Jonathan Cameron Signed-off-by: Will Deacon commit 43de0ac332b815cf56dbdce63687de9acfd35d49 Author: Yicong Yang Date: Fri Aug 29 18:14:19 2025 +0800 drivers/perf: hisi: Relax the event ID check in the framework Event ID is only using the attr::config bit [7, 0] but we check the event range using the whole 64bit field. It blocks the usage of the rest field of attr::config. Relax the check by only using the bit [7, 0]. Acked-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Signed-off-by: Will Deacon commit bad11557eed2592c017a06752e58df49080b4a6a Author: Koichi Okuno Date: Tue Sep 9 12:02:50 2025 +0900 perf: Fujitsu: Add the Uncore PMU driver This adds a new dynamic PMU to the Perf Events framework to program and control the Uncore PMUs in Fujitsu chips. This driver exports formatting and event information to sysfs so it can be used by the perf user space tools with the syntaxes: perf stat -e pci_iod0_pci0/ea-pci/ ls perf stat -e pci_iod0_pci0/event=0x80/ ls perf stat -e mac_iod0_mac0_ch0/ea-mac/ ls perf stat -e mac_iod0_mac0_ch0/event=0x80/ ls FUJITSU-MONAKA PMU Events Specification v1.1 URL: https://github.com/fujitsu/FUJITSU-MONAKA Reviewed-by: Yicong Yang Signed-off-by: Koichi Okuno Signed-off-by: Will Deacon commit 63b4c34635cf32af023796b64c855dd1ed0f0a4f Author: Niranjan H Y Date: Fri Sep 12 14:06:24 2025 +0530 tas2783A: Add acpi match changes for Intel MTL acpi match changes to support tas2783a on mtl on link 0 for 2 devices Reviewed-by: Bard Liao Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20250912083624.804-5-niranjan.hy@ti.com Signed-off-by: Mark Brown commit b41949a2109e49cb96a1dc292efa249933e5232e Author: Niranjan H Y Date: Fri Sep 12 14:06:23 2025 +0530 ASoc: tas2783A: add machine driver changes Add tas2783-codec for codec_info Reviewed-by: Bard Liao Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20250912083624.804-4-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 96384a34dd15b0e7357a34af5c848d1115a35e62 Author: Niranjan H Y Date: Fri Sep 12 14:06:22 2025 +0530 ASoc: tas2783A: machine driver amp utility for TI devices Machine driver amp utility file to initialize and support multiple tas2783a devices are added. Reviewed-by: Bard Liao Signed-off-by: Niranjan H Y -- v5: - removed empty line in soc_sdw_ti_amp.c Link: https://patch.msgid.link/20250912083624.804-3-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 4cc9bd8d7b32d59b86cb489a96aa8a7b9dd6a21b Author: Niranjan H Y Date: Fri Sep 12 14:06:21 2025 +0530 ASoc: tas2783A: Add soundwire based codec driver TAS2783 is mono digital input class-D Smart Amplifier based on MIPI Alliance Soundwire interface. The driver supports loading the algorithm coefficients for one or more tas2783 chips. Signed-off-by: Niranjan H Y Reviewed-by: Bard Liao Link: https://patch.msgid.link/20250912083624.804-2-niranjan.hy@ti.com Signed-off-by: Mark Brown commit a0ce874cfaaab9792d657440b9d050e2112f6e4d Author: Niranjan H Y Date: Fri Sep 12 14:06:20 2025 +0530 ASoC: ops: improve snd_soc_get_volsw * clamp the values if the register value read is out of range Signed-off-by: Niranjan H Y [This patch originally had two changes in it, I removed a second buggy one -- broonie] -- v5: - remove clamp parameter - move the boundary check after sign-bit extension Link: https://patch.msgid.link/20250912083624.804-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 5973a62efa34c80c9a4e5eac1fca6f6209b902af Author: Omar Sandoval Date: Fri Sep 19 14:27:51 2025 -0700 arm64: map [_text, _stext) virtual address range non-executable+read-only Since the referenced fixes commit, the kernel's .text section is only mapped starting from _stext; the region [_text, _stext) is omitted. As a result, other vmalloc/vmap allocations may use the virtual addresses nominally in the range [_text, _stext). This address reuse confuses multiple things: 1. crash_prepare_elf64_headers() sets up a segment in /proc/vmcore mapping the entire range [_text, _end) to [__pa_symbol(_text), __pa_symbol(_end)). Reading an address in [_text, _stext) from /proc/vmcore therefore gives the incorrect result. 2. Tools doing symbolization (either by reading /proc/kallsyms or based on the vmlinux ELF file) will incorrectly identify vmalloc/vmap allocations in [_text, _stext) as kernel symbols. In practice, both of these issues affect the drgn debugger. Specifically, there were cases where the vmap IRQ stacks for some CPUs were allocated in [_text, _stext). As a result, drgn could not get the stack trace for a crash in an IRQ handler because the core dump contained invalid data for the IRQ stack address. The stack addresses were also symbolized as being in the _text symbol. Fix this by bringing back the mapping of [_text, _stext), but now make it non-executable and read-only. This prevents other allocations from using it while still achieving the original goal of not mapping unpredictable data as executable. Other than the changed protection, this is effectively a revert of the fixes commit. Fixes: e2a073dde921 ("arm64: omit [_text, _stext) from permanent kernel mapping") Cc: stable@vger.kernel.org Signed-off-by: Omar Sandoval Signed-off-by: Will Deacon commit fc0d192303bd385ac24dc52eb31ceb6ca7e027d0 Author: Dmitry Antipov Date: Thu Sep 18 14:14:03 2025 +0300 xfs: scrub: use kstrdup_const() for metapath scan setups Except 'xchk_setup_metapath_rtginode()' case, 'path' argument of 'xchk_setup_metapath_scan()' is a compile-time constant. So it may be reasonable to use 'kstrdup_const()' / 'kree_const()' to manage 'path' field of 'struct xchk_metapath' in attempt to reuse .rodata instance rather than making a copy. Compile tested only. Signed-off-by: Dmitry Antipov Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 14f158552eec700ae0e52b91aa17168a7b168c0c Author: Anshuman Khandual Date: Sun Sep 21 06:22:58 2025 +0530 arm64/sysreg: Update TCR_EL1 register Update TCR_EL1 register fields as per latest ARM ARM DDI 0487 L.B and while here drop an explicit sysreg definition SYS_TCR_EL1 from sysreg.h, which is now redundant. Cc: Catalin Marinas Cc: Will Deacon Cc: Marc Zyngier Cc: Mark Brown Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Mark Brown Signed-off-by: Anshuman Khandual Signed-off-by: Will Deacon commit 6ef2175fce30ccab80d519f2afcc93d8b138c16c Author: Christoph Hellwig Date: Fri Sep 19 06:12:09 2025 -0700 xfs: use bt_nr_sectors in xfs_dax_translate_range Only ranges inside the file system can be translated, and the file system can be smaller than the containing device. Fixes: f4ed93037966 ("xfs: don't shut down the filesystem for media failures beyond end of log") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 42852fe57c6d2a0abb10429841cb1226b7186b7a Author: Christoph Hellwig Date: Fri Sep 19 06:12:08 2025 -0700 xfs: track the number of blocks in each buftarg Add a bt_nr_sectors to track the number of sector in each buftarg, and replace the check that hard codes sb_dblock in xfs_buf_map_verify with this new value so that it is correct for non-ddev buftargs. The RT buftarg only has a superblock in the first block, so it is unlikely to trigger this, or are we likely to ever have enough blocks in the in-memory buftargs, but we might as well get the check right. Fixes: 10616b806d1d ("xfs: fix _xfs_buf_find oops on blocks beyond the filesystem end") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit fa93b45fd397e25265ff618de26dd5c74ee403d3 Author: Dev Jain Date: Mon Sep 22 12:11:26 2025 +0530 arm64: Enable vmalloc-huge with ptdump Our goal is to move towards enabling vmalloc-huge by default on arm64 so as to reduce TLB pressure. Therefore, we need a way to analyze the portion of block mappings in vmalloc space we can get on a production system; this can be done through ptdump, but currently we disable vmalloc-huge if CONFIG_PTDUMP_DEBUGFS is on. The reason is that lazy freeing of kernel pagetables via vmap_try_huge_pxd() may race with ptdump, so ptdump may dereference a bogus address. To solve this, we need to synchronize ptdump_walk() and ptdump_check_wx() with pud_free_pmd_page() and pmd_free_pte_page(). Since this race is very unlikely to happen in practice, we do not want to penalize the vmalloc pagetable tearing path by taking the init_mm mmap_lock. Therefore, we use static keys. ptdump_walk() and ptdump_check_wx() are the pagetable walkers; they will enable the static key - upon observing that, the vmalloc pagetable tearing path will get patched in with an mmap_read_lock/unlock sequence. A combination of the patched-in mmap_read_lock/unlock, the acquire semantics of static_branch_inc(), and the barriers in __flush_tlb_kernel_pgtable() ensures that ptdump will never get a hold on the address of a freed PMD or PTE table. We can verify the correctness of the algorithm via the following litmus test (thanks to James Houghton and Will Deacon): AArch64 ptdump Variant=Ifetch { uint64_t pud=0xa110c; uint64_t pmd; 0:X0=label:"P1:L0"; 0:X1=instr:"NOP"; 0:X2=lock; 0:X3=pud; 0:X4=pmd; 1:X1=0xdead; 1:X2=lock; 1:X3=pud; 1:X4=pmd; } P0 | P1 ; (* static_key_enable *) | (* pud_free_pmd_page *) ; STR W1, [X0] | LDR X9, [X3] ; DC CVAU,X0 | STR XZR, [X3] ; DSB ISH | DSB ISH ; IC IVAU,X0 | ISB ; DSB ISH | ; ISB | (* static key *) ; | L0: ; (* mmap_lock *) | B out1 ; Lwlock: | ; MOV W7, #1 | (* mmap_lock *) ; SWPA W7, W8, [X2] | Lrlock: ; | MOV W7, #1 ; | SWPA W7, W8, [X2] ; (* walk pgtable *) | ; LDR X9, [X3] | (* mmap_unlock *) ; CBZ X9, out0 | STLR WZR, [X2] ; EOR X10, X9, X9 | ; LDR X11, [X4, X10] | out1: ; | EOR X10, X9, X9 ; out0: | STR X1, [X4, X10] ; exists (0:X8=0 /\ 1:X8=0 /\ (* Lock acquisitions succeed *) 0:X9=0xa110c /\ (* P0 sees the valid PUD ...*) 0:X11=0xdead) (* ... but the freed PMD *) For an approximate written proof of why this algorithm works, please read the code comment in [1], which is now removed for the sake of simplicity. mm-selftests pass. No issues were observed while parallelly running test_vmalloc.sh (which stresses the vmalloc subsystem), and cat /sys/kernel/debug/{kernel_page_tables, check_wx_pages} in a loop. Link: https://lore.kernel.org/all/20250723161827.15802-1-dev.jain@arm.com/ [1] Reviewed-by: Ryan Roberts Signed-off-by: Dev Jain Signed-off-by: Will Deacon commit 8fca3852e33d762b8d8beed5458c99ffb7fd5975 Author: Ryan Roberts Date: Fri Sep 19 15:58:30 2025 +0100 arm64: cpufeature: add Neoverse-V3AE to BBML2 allow list Neoverse-V3AE advertises support for BBML2 and is known to not raise conflict aborts. So add it to the BBML2_NOABORT allow list. However, just like Neoverse-V3, Neoverse-V3AE r0p0 and r0p1 suffer from erratum #3053180, for which the workaround is to always observe break-before-make requirements for affected revisions. Therefore only add to the allow list from r0p2 onwards. For more details see Software Developer Errata Notice (SDEN) document: Neoverse V3AE (MP172) SDEN v9.0, erratum 3053180 https://developer.arm.com/documentation/SDEN-2615521/9-0/ Signed-off-by: Ryan Roberts Signed-off-by: Will Deacon commit 0c33aa1804d101c11ba1992504f17a42233f0e11 Author: Mark Rutland Date: Fri Sep 19 15:58:29 2025 +0100 arm64: errata: Apply workarounds for Neoverse-V3AE Neoverse-V3AE is also affected by erratum #3312417, as described in its Software Developer Errata Notice (SDEN) document: Neoverse V3AE (MP172) SDEN v9.0, erratum 3312417 https://developer.arm.com/documentation/SDEN-2615521/9-0/ Enable the workaround for Neoverse-V3AE, and document this. Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Cc: Catalin Marinas Signed-off-by: Ryan Roberts Signed-off-by: Will Deacon commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 Author: Mark Rutland Date: Fri Sep 19 15:58:28 2025 +0100 arm64: cputype: Add Neoverse-V3AE definitions Add cputype definitions for Neoverse-V3AE. These will be used for errata detection in subsequent patches. These values can be found in the Neoverse-V3AE TRM: https://developer.arm.com/documentation/SDEN-2615521/9-0/ ... in section A.6.1 ("MIDR_EL1, Main ID Register"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Cc: Catalin Marinas Signed-off-by: Ryan Roberts Signed-off-by: Will Deacon commit 4a774b39e68fac7d6c7c9cffeb6a4ea4b6dc8b41 Author: Athira Rajeev Date: Mon Sep 15 15:59:47 2025 +0530 powerpc/perf/vpa-dtl: Add documentation for VPA dispatch trace log PMU Documentation for vpa-dtl (Virtual Processor Area - Dispatch Trace Log) PMU interface. And how it can be used to collect the distrace trace log entries in perf data, how to process/report as part of perf report/perf script. Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-8-atrajeev@linux.ibm.com commit b5e71cafa02d4e673639a3bd4c03d84db5dd8b8a Author: Athira Rajeev Date: Mon Sep 15 15:59:46 2025 +0530 powerpc/perf/vpa-dtl: Handle the writing of perf record when aux wake up is needed Handle the case when the aux buffer is going to be full and data needs to be written to the data file. perf_aux_output_begin() function checks if there is enough space depending on the values of aux_wakeup and aux_watermark which is part of "struct perf_buffer". Inorder to maintain where to write to aux buffer, add two fields to "struct vpa_pmu_buf". Field "threshold" to indicate total possible DTL entries that can be contained in aux buffer and field "full" to indicate anytime when buffer is full. In perf_aux_output_end, there is check to see if wake up is needed based on aux head value. In vpa_dtl_capture_aux(), check if there is enough space to contain the DTL data. If not, save the data for available memory and set full to true. Set head of private aux to zero when buffer is full so that next data will be copied to beginning of the buffer. The address used for copying to aux is "aux_copy_buf + buf->head". So once buffer is full, set head to zero, so that next time it will be written from start of the buffer. Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-7-atrajeev@linux.ibm.com commit 2de8b6dd5ae72eb6fb7c756a3f2c131171fe3b8b Author: Athira Rajeev Date: Mon Sep 15 15:59:45 2025 +0530 powerpc/perf/vpa-dtl: Add support to capture DTL data in aux buffer vpa dtl pmu has one hrtimer added per vpa-dtl pmu thread. When the hrtimer expires, in the timer handler, code is added to save the DTL data to perf event record via vpa_dtl_capture_aux() function. The DTL (Dispatch Trace Log) contains information about dispatch/preempt, enqueue time etc. We directly copy the DTL buffer data as part of auxiliary buffer. Data will be written to disk only when the allocated buffer is full. By this approach, all the DTL data will be present as-is in the perf.data. The data will be post-processed in perf tools side when doing perf report/perf script and this will avoid time taken to create samples in the kernel space. To corelate each DTL entry with other events across CPU's, we need to map timebase from "struct dtl_entry" which phyp provides with boot timebase. This also needs timebase frequency. Define "struct boottb_freq" to save these details. Added changes to capture the Dispatch Trace Log details to AUX buffer in vpa_dtl_dump_sample_data(). Boot timebase and frequency needs to be saved only at once, added field to indicate this as part of "vpa_pmu_buf" structure. perf_aux_output_begin: This function is called before writing to AUX area. This returns the pointer to aux area private structure, ie "struct vpa_pmu_buf". The function obtains the output handle (used in perf_aux_output_end). when capture completes in vpa_dtl_capture_aux(), call perf_aux_output_end() to commit the recorded data. perf_aux_output_end() is called to move the aux->head of "struct perf_buffer" to indicate size of data in aux buffer. aux_tail will be moved in perf tools side when writing the data from aux buffer to perf.data file in disk. It is responsiblity of PMU driver to make sure data is copied between perf_aux_output_begin and perf_aux_output_end. Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-6-atrajeev@linux.ibm.com commit 5d75aed84d3b6d25c7c4bb4a212b14fae4d1020b Author: Athira Rajeev Date: Mon Sep 15 15:59:44 2025 +0530 powerpc/perf/vpa-dtl: Add support to setup and free aux buffer for capturing DTL data vpa dtl pmu has one hrtimer added per vpa-dtl pmu thread. When the hrtimer expires, in the timer handler, code is added to save the DTL data to perf event record. DTL (Dispatch Trace Log) contains information about dispatch/preempt, enqueue time etc. We directly copy the DTL buffer data as part of auxiliary buffer and it will be postprocessed later. To enable the support for aux buffer, add the PMU callbacks for setup_aux and free_aux. In setup_aux, set up pmu-private data structures for an AUX area. rb_alloc_aux uses "alloc_pages_node" and returns pointer to each page address. Map these pages to contiguous space using vmap and use that as base address. The aux private data structure ie, "struct vpa_pmu_buf" mainly saves: 1. buf->base: aux buffer base address 2. buf->head: offset from base address where data will be written to. 3. buf->size: Size of allocated memory free_aux will free pmu-private AUX data structures. Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-5-atrajeev@linux.ibm.com commit 6f2c65680c336a274b69b1fdcbfa2eeb8159bee8 Author: Kajol Jain Date: Mon Sep 15 15:59:43 2025 +0530 docs: ABI: sysfs-bus-event_source-devices-vpa-dtl: Document sysfs event format entries for vpa_dtl pmu Details are added for the vpa_dtl pmu event and format attributes in the ABI documentation. Signed-off-by: Kajol Jain Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-4-atrajeev@linux.ibm.com commit 4708fba19adee9ba14ef28af6face4ab043d9cd6 Author: Kajol Jain Date: Mon Sep 15 15:59:42 2025 +0530 powerpc/vpa_dtl: Add interface to expose vpa dtl counters via perf The pseries Shared Processor Logical Partition(SPLPAR) machines can retrieve a log of dispatch and preempt events from the hypervisor using data from Disptach Trace Log(DTL) buffer. With this information, user can retrieve when and why each dispatch & preempt has occurred. Added an interface to expose the Virtual Processor Area(VPA) DTL counters via perf. The following events are available and exposed in sysfs: vpa_dtl/dtl_cede/ - Trace voluntary (OS initiated) virtual processor waits vpa_dtl/dtl_preempt/ - Trace time slice preempts vpa_dtl/dtl_fault/ - Trace virtual partition memory page faults. vpa_dtl/dtl_all/ - Trace all (dtl_cede/dtl_preempt/dtl_fault) Added interface defines supported event list, config fields for the event attributes and their corresponding bit values which are exported via sysfs. User could use the standard perf tool to access perf events exposed via vpa-dtl pmu. The VPA DTL PMU counters do not interrupt on overflow or generate any PMI interrupts. Therefore, the kernel needs to poll the counters, added hrtimer code to do that. The timer interval can be provided by user via sample_period field in nano seconds. There is one hrtimer added per vpa-dtl pmu thread. To ensure there are no other conflicting dtl users (example: debugfs dtl or /proc/powerpc/vcpudispatch_stats), interface added code to use "down_write_trylock" call to take the dtl_access_lock. The dtl_access_lock is defined in dtl.h file. Also added global reference count variable called "dtl_global_refc", to ensure dtl data can be captured per-cpu. Code also added global lock called "dtl_global_lock" to avoid race condition. Signed-off-by: Kajol Jain Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-3-atrajeev@linux.ibm.com commit 2dc019ca39347f76891d34a992b67258078aa45d Author: Aboorva Devarajan Date: Mon Sep 15 15:59:41 2025 +0530 powerpc/time: Expose boot_tb via accessor - Define accessor function get_boot_tb() to safely return boot_tb value, this is only needed when running in SPLPAR environments, so the accessor is built conditionally under CONFIG_PPC_SPLPAR. - Tag boot_tb as __ro_after_init since it is written once at initialized and never updated afterwards. Signed-off-by: Aboorva Devarajan Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915102947.26681-2-atrajeev@linux.ibm.com commit f145845d8348c9b6288df41cb7904fd9fde566dc Author: Rob Herring (Arm) Date: Fri Sep 19 17:35:31 2025 -0500 dt-bindings: ata: apm,xgene-ahci: Add apm,xgene-ahci-v2 support The "apm,xgene-ahci-v2" compatible has been in use for a long time, but was undocumented. It doesn't require clocks or phys. Remove the "apm,xgene-ahci-pcie" compatible which isn't used anywhere while we're here. Signed-off-by: Rob Herring (Arm) Signed-off-by: Damien Le Moal commit 3239c44df756bbc28182eb05aeeea84875c315fe Author: Qu Wenruo Date: Mon Jul 28 17:57:54 2025 +0930 btrfs: rework error handling of run_delalloc_nocow() Currently the error handling of run_delalloc_nocow() modifies @cur_offset to handle different parts of the delalloc range. However the error handling can always be split into 3 parts: 1) The range with ordered extents allocated (OE cleanup) We have to cleanup the ordered extents and unlock the folios. 2) The range that have been cleaned up (skip) For now it's only for the range of fallback_to_cow(). We should not touch it at all. 3) The range that is not yet touched (untouched) We have to unlock the folios and clear any reserved space. This 3 ranges split has the same principle as cow_file_range(), however the NOCOW/COW handling makes the above 3 range split much more complex: a) Failure immediately after a successful OE allocation Thus no @cow_start nor @cow_end set. start cur_offset end | OE cleanup | untouched | b) Failure after hitting a COW range but before calling fallback_to_cow() start cow_start cur_offset end | OE Cleanup | untouched | c) Failure to call fallback_to_cow() start cow_start cow_end end | OE Cleanup | skip | untouched | Instead of modifying @cur_offset, do proper range calculation for OE-cleanup and untouched ranges using above 3 cases with proper range charts. This avoid updating @cur_offset, as it will an extra output for debug purposes later, and explain the behavior easier. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 46d33a0cc484ceb11aa47166e66d349ab3074eef Author: Leo Martins Date: Tue Aug 12 16:04:41 2025 -0700 btrfs: add mount option for ref_tracker The ref_tracker infrastructure aids debugging but is not enabled by default as it has a performance impact. Add mount option 'ref_tracker' so it can be selectively enabled on a filesystem. Currently it track references of 'delayed inodes'. Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit b767a28d6154986929a2231d48b637b18b2aabb3 Author: Leo Martins Date: Tue Aug 12 16:04:40 2025 -0700 btrfs: print leaked references in kill_all_delayed_nodes() We are seeing soft lockups in kill_all_delayed_nodes due to a delayed_node with a lingering reference count of 1. Printing at this point will reveal the guilty stack trace. If the delayed_node has no references there should be no output. Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit e8513c012de75fd65e2df5499572bc6ef3f6e409 Author: Leo Martins Date: Tue Aug 12 16:04:39 2025 -0700 btrfs: implement ref_tracker for delayed_nodes Add ref_tracker infrastructure for struct btrfs_delayed_node. It is a response to the largest btrfs related crash in our fleet. We're seeing soft lockups in btrfs_kill_all_delayed_nodes() that seem to be a result of delayed_nodes not being released properly. A ref_tracker object is allocated on reference count increases and freed on reference count decreases. The ref_tracker object stores a stack trace of where it is allocated. The ref_tracker_dir object is embedded in btrfs_delayed_node and keeps track of all current and some old/freed ref_tracker objects. When a leak is detected we can print the stack traces for all ref_trackers that have not yet been freed. Here is a common example of taking a reference to a delayed_node and freeing it with ref_tracker. struct btrfs_ref_tracker tracker; struct btrfs_delayed_node *node; node = btrfs_get_delayed_node(inode, &tracker); // use delayed_node... btrfs_release_delayed_node(node, &tracker); There are two special cases where the delayed_node reference is "long lived", meaning that the thread that takes the reference and the thread that releases the reference are different. The 'inode_cache_tracker' tracks the delayed_node stored in btrfs_inode. The 'node_list_tracker' tracks the delayed_node stored in the btrfs_delayed_root node_list/prepare_list. These trackers are embedded in the btrfs_delayed_node. btrfs_ref_tracker and btrfs_ref_tracker_dir are wrappers that either compile to the corresponding ref_tracker structs or empty structs depending on CONFIG_BTRFS_DEBUG. There are also btrfs wrappers for the ref_tracker API. Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit 67e78f983e6a1208c2f52adad4b06a388f4a15a5 Author: David Sterba Date: Wed Aug 13 12:41:11 2025 +0200 btrfs: convert several int parameters to bool We're almost done cleaning misused int/bool parameters. Convert a bunch of them, found by manual grepping. Note that btrfs_sync_fs() needs an int as it's mandated by the struct super_operations prototype. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit cba7c35fec267188a9708deae857e9116c57497b Author: Leo Martins Date: Tue Aug 12 16:28:27 2025 -0700 btrfs: move ref-verify under CONFIG_BTRFS_DEBUG Remove CONFIG_BTRFS_FS_REF_VERIFY Kconfig and add it as part of CONFIG_BTRFS_DEBUG. This should not be impactful to the performance of debug. The struct btrfs_ref takes an additional u64, btrfs_fs_info takes an additional spinlock_t and rb_root. All of the ref_verify logic is still protected by a mount option. Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit 28a38e20acf58ddbeb65eb1c359cc43414094f5a Author: Xichao Zhao Date: Tue Aug 12 16:25:54 2025 +0800 btrfs: use PTR_ERR_OR_ZERO() to simplify code inbtrfs_control_ioctl() Use the standard error pointer macro to simplify the code. Reviewed-by: Daniel Vacek Signed-off-by: Xichao Zhao Reviewed-by: David Sterba Signed-off-by: David Sterba commit d728f2e5f8a075756ce60410c1ecb3a0b61f2bf8 Author: Qu Wenruo Date: Sat Aug 9 14:10:48 2025 +0930 btrfs: simplify support block size check Currently we manually check the block size against 3 different values: - 4K - PAGE_SIZE - MIN_BLOCKSIZE Those 3 values can match or differ from each other. This makes it pretty complex to output the supported block sizes. Considering we're going to add block size > page size support soon, this can make the support block size sysfs attribute much harder to implement. To make it easier, factor out a helper, btrfs_supported_blocksize() to do a simple check for the block size. Then utilize it in the two locations: - btrfs_validate_super() This is very straightforward - supported_sectorsizes_show() Iterate through all valid block sizes, and only output supported ones. This is to make future full range block sizes support much easier. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0a6dcd42353b96ab4a74796aed1541591de5890c Author: Qu Wenruo Date: Mon Aug 11 09:43:42 2025 +0930 btrfs: use blocksize to check if compression is making things larger [BEHAVIOR DIFFERENCE BETWEEN COMPRESSION ALGOS] Currently LZO compression algorithm will check if we're making the compressed data larger after compressing more than 2 blocks. But zlib and zstd do the same checks after compressing more than 8192 bytes. This is not a big deal, but since we're already supporting larger block size (e.g. 64K block size if page size is also 64K), this check is not suitable for all block sizes. For example, if our page and block size are both 16KiB, and after the first block compressed using zlib, the resulted compressed data is slightly larger than 16KiB, we will immediately abort the compression. This makes zstd and zlib compression algorithms to behave slightly different from LZO, which only aborts after compressing two blocks. [ENHANCEMENT] To unify the behavior, only abort the compression after compressing at least two blocks. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d71b419f274c2eea83038c8623ddc45d51af70e9 Author: Qu Wenruo Date: Sun Aug 10 20:14:57 2025 +0930 btrfs: pass btrfs_inode pointer directly into btrfs_compress_folios() For the 3 supported compression algorithms, two of them (zstd and zlib) are already grabbing the btrfs inode for error messages. It's more common to pass btrfs_inode and grab the address space from it. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0d703963d297964451783e1a0688ebdf74cd6151 Author: Naohiro Aota Date: Wed Jul 16 11:13:15 2025 +0900 btrfs: zoned: refine extent allocator hint selection The hint block group selection in the extent allocator is wrong in the first place, as it can select the dedicated data relocation block group for the normal data allocation. Since we separated the normal data space_info and the data relocation space_info, we can easily identify a block group is for data relocation or not. Do not choose it for the normal data allocation. Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit f07b855c56b1fd724c018c1d4ff8d319b9afd5a9 Author: Boris Burkov Date: Mon Oct 21 12:01:53 2024 -0700 btrfs: try to search for data csums in commit root If you run a workload with: - a cgroup that does tons of parallel data reading, with a working set much larger than its memory limit - a second cgroup that writes relatively fewer files, with overwrites, with no memory limit (see full code listing at the bottom for a reproducer) Then what quickly occurs is: - we have a large number of threads trying to read the csum tree - we have a decent number of threads deleting csums running delayed refs - we have a large number of threads in direct reclaim and thus high memory pressure The result of this is that we writeback the csum tree repeatedly mid transaction, to get back the extent_buffer folios for reclaim. As a result, we repeatedly COW the csum tree for the delayed refs that are deleting csums. This means repeatedly write locking the higher levels of the tree. As a result of this, we achieve an unpleasant priority inversion. We have: - a high degree of contention on the csum root node (and other upper nodes) eb rwsem - a memory starved cgroup doing tons of reclaim on CPU. - many reader threads in the memory starved cgroup "holding" the sem as readers, but not scheduling promptly. i.e., task __state == 0, but not running on a cpu. - btrfs_commit_transaction stuck trying to acquire the sem as a writer. (running delayed_refs, deleting csums for unreferenced data extents) This results in arbitrarily long transactions. This then results in seriously degraded performance for any cgroup using the filesystem (the victim cgroup in the script). It isn't an academic problem, as we see this exact problem in production at Meta with one cgroup over its memory limit ruining btrfs performance for the whole system, stalling critical system services that depend on btrfs syncs. The underlying scheduling "problem" with global rwsems is sort of thorny and apparently well known and was discussed at LPC 2024, for example. As a result, our main lever in the short term is just trying to reduce contention on our various rwsems with an eye to reducing the frequency of write locking, to avoid disabling the read lock fast acquisition path. Luckily, it seems likely that many reads are for old extents written many transactions ago, and that for those we *can* in fact search the commit root. The commit_root_sem only gets taken write once, near the end of transaction commit, no matter how much memory pressure there is, so we have much less contention between readers and writers. This change detects when we are trying to read an old extent (according to extent map generation) and then wires that through bio_ctrl to the btrfs_bio, which unfortunately isn't allocated yet when we have this information. When we go to lookup the csums in lookup_bio_sums we can check this condition on the btrfs_bio and do the commit root lookup accordingly. Note that a single bio_ctrl might collect a few extent_maps into a single bio, so it is important to track a maximum generation across all the extent_maps used for each bio to make an accurate decision on whether it is valid to look in the commit root. If any extent_map is updated in the current generation, we can't use the commit root. To test and reproduce this issue, I used the following script and accompanying C program (to avoid bottlenecks in constantly forking thousands of dd processes): ====== big-read.c ====== #include #include #include #include #include #include #include #define BUF_SZ (128 * (1 << 10UL)) int read_once(int fd, size_t sz) { char buf[BUF_SZ]; size_t rd = 0; int ret = 0; while (rd < sz) { ret = read(fd, buf, BUF_SZ); if (ret < 0) { if (errno == EINTR) continue; fprintf(stderr, "read failed: %d\n", errno); return -errno; } else if (ret == 0) { break; } else { rd += ret; } } return rd; } int read_loop(char *fname) { int fd; struct stat st; size_t sz = 0; int ret; while (1) { fd = open(fname, O_RDONLY); if (fd == -1) { perror("open"); return 1; } if (!sz) { if (!fstat(fd, &st)) { sz = st.st_size; } else { perror("stat"); return 1; } } ret = read_once(fd, sz); close(fd); } } int main(int argc, char *argv[]) { int fd; struct stat st; off_t sz; char *buf; int ret; if (argc != 2) { fprintf(stderr, "Usage: %s \n", argv[0]); return 1; } return read_loop(argv[1]); } ====== repro.sh ====== #!/usr/bin/env bash SCRIPT=$(readlink -f "$0") DIR=$(dirname "$SCRIPT") dev=$1 mnt=$2 shift shift CG_ROOT=/sys/fs/cgroup BAD_CG=$CG_ROOT/bad-nbr GOOD_CG=$CG_ROOT/good-nbr NR_BIGGOS=1 NR_LITTLE=10 NR_VICTIMS=32 NR_VILLAINS=512 START_SEC=$(date +%s) _elapsed() { echo "elapsed: $(($(date +%s) - $START_SEC))" } _stats() { local sysfs=/sys/fs/btrfs/$(findmnt -no UUID $dev) echo "================" date _elapsed cat $sysfs/commit_stats cat $BAD_CG/memory.pressure } _setup_cgs() { echo "+memory +cpuset" > $CG_ROOT/cgroup.subtree_control mkdir -p $GOOD_CG mkdir -p $BAD_CG echo max > $BAD_CG/memory.max # memory.high much less than the working set will cause heavy reclaim echo $((1 << 30)) > $BAD_CG/memory.high # victims get a subset of villain CPUs echo 0 > $GOOD_CG/cpuset.cpus echo 0,1,2,3 > $BAD_CG/cpuset.cpus } _kill_cg() { local cg=$1 local attempts=0 echo "kill cgroup $cg" [ -f $cg/cgroup.procs ] || return while true; do attempts=$((attempts + 1)) echo 1 > $cg/cgroup.kill sleep 1 procs=$(wc -l $cg/cgroup.procs | cut -d' ' -f1) [ $procs -eq 0 ] && break done rmdir $cg echo "killed cgroup $cg in $attempts attempts" } _biggo_vol() { echo $mnt/biggo_vol.$1 } _biggo_file() { echo $(_biggo_vol $1)/biggo } _subvoled_biggos() { total_sz=$((10 << 30)) per_sz=$((total_sz / $NR_VILLAINS)) dd_count=$((per_sz >> 20)) echo "create $NR_VILLAINS subvols with a file of size $per_sz bytes for a total of $total_sz bytes." for i in $(seq $NR_VILLAINS) do btrfs subvol create $(_biggo_vol $i) &>/dev/null dd if=/dev/zero of=$(_biggo_file $i) bs=1M count=$dd_count &>/dev/null done echo "done creating subvols." } _setup() { [ -f .done ] && rm .done findmnt -n $dev && exit 1 if [ -f .re-mkfs ]; then mkfs.btrfs -f -m single -d single $dev >/dev/null || exit 2 else echo "touch .re-mkfs to populate the test fs" fi mount -o noatime $dev $mnt || exit 3 [ -f .re-mkfs ] && _subvoled_biggos _setup_cgs } _my_cleanup() { echo "CLEANUP!" _kill_cg $BAD_CG _kill_cg $GOOD_CG sleep 1 umount $mnt } _bad_exit() { _err "Unexpected Exit! $?" _stats exit $? } trap _my_cleanup EXIT trap _bad_exit INT TERM _setup # Use a lot of page cache reading the big file _villain() { local i=$1 echo $BASHPID > $BAD_CG/cgroup.procs $DIR/big-read $(_biggo_file $i) } # Hit del_csum a lot by overwriting lots of small new files _victim() { echo $BASHPID > $GOOD_CG/cgroup.procs i=0; while (true) do local tmp=$mnt/tmp.$i dd if=/dev/zero of=$tmp bs=4k count=2 >/dev/null 2>&1 i=$((i+1)) [ $i -eq $NR_LITTLE ] && i=0 done } _one_sync() { echo "sync..." before=$(date +%s) sync after=$(date +%s) echo "sync done in $((after - before))s" _stats } # sync in a loop _sync() { echo "start sync loop" syncs=0 echo $BASHPID > $GOOD_CG/cgroup.procs while true do [ -f .done ] && break _one_sync syncs=$((syncs + 1)) [ -f .done ] && break sleep 10 done if [ $syncs -eq 0 ]; then echo "do at least one sync!" _one_sync fi echo "sync loop done." } _sleep() { local time=${1-60} local now=$(date +%s) local end=$((now + time)) while [ $now -lt $end ]; do echo "SLEEP: $((end - now))s left. Sleep 10." sleep 10 now=$(date +%s) done } echo "start $NR_VILLAINS villains" for i in $(seq $NR_VILLAINS) do _villain $i & disown # get rid of annoying log on kill (done via cgroup anyway) done echo "start $NR_VICTIMS victims" for i in $(seq $NR_VICTIMS) do _victim & disown done _sync & SYNC_PID=$! _sleep $1 _elapsed touch .done wait $SYNC_PID echo "OK" exit 0 Without this patch, that reproducer: - Ran for 6+ minutes instead of 60s - Hung hundreds of threads in D state on the csum reader lock - Got a commit stuck for 3 minutes sync done in 388s ================ Wed Jul 9 09:52:31 PM UTC 2025 elapsed: 420 commits 2 cur_commit_ms 0 last_commit_ms 159446 max_commit_ms 159446 total_commit_ms 160058 some avg10=99.03 avg60=98.97 avg300=75.43 total=418033386 full avg10=82.79 avg60=80.52 avg300=59.45 total=324995274 419 hits state R, D comms big-read btrfs_tree_read_lock_nested btrfs_read_lock_root_node btrfs_search_slot btrfs_lookup_csum btrfs_lookup_bio_sums btrfs_submit_bbio 1 hits state D comms btrfs-transacti btrfs_tree_lock_nested btrfs_lock_root_node btrfs_search_slot btrfs_del_csums __btrfs_run_delayed_refs btrfs_run_delayed_refs With the patch, the reproducer exits naturally, in 65s, completing a pretty decent 4 commits, despite heavy memory pressure. Occasionally you can still trigger a rather long commit (couple seconds) but never one that is minutes long. sync done in 3s ================ elapsed: 65 commits 4 cur_commit_ms 0 last_commit_ms 485 max_commit_ms 689 total_commit_ms 2453 some avg10=98.28 avg60=64.54 avg300=19.39 total=64849893 full avg10=74.43 avg60=48.50 avg300=14.53 total=48665168 some random rwalker samples showed the most common stack in reclaim, rather than the csum tree: 145 hits state R comms bash, sleep, dd, shuf shrink_folio_list shrink_lruvec shrink_node do_try_to_free_pages try_to_free_mem_cgroup_pages reclaim_high Link: https://lpc.events/event/18/contributions/1883/ Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 6d9cce2d1bb6b70916de351490d1ff197058b88f Author: Jiapeng Chong Date: Fri Jul 25 16:07:05 2025 +0800 btrfs: remove duplicate inclusion of linux/types.h In messages.h there's linux/types.h included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22939 Signed-off-by: Jiapeng Chong Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3c44cd3c79fcb38a86836dea6ff8fec322a9e68c Author: Johannes Thumshirn Date: Tue Jul 22 13:39:11 2025 +0200 btrfs: zoned: return error from btrfs_zone_finish_endio() Now that btrfs_zone_finish_endio_workfn() is directly calling do_zone_finish() the only caller of btrfs_zone_finish_endio() is btrfs_finish_one_ordered(). btrfs_finish_one_ordered() already has error handling in-place so btrfs_zone_finish_endio() can return an error if the block group lookup fails. Also as btrfs_zone_finish_endio() already checks for zoned filesystems and returns early, there's no need to do this in the caller. Reviewed-by: Damien Le Moal Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 3d16abf6c88ae20cc4168756e77ad270a9b37182 Author: Johannes Thumshirn Date: Tue Jul 22 13:39:10 2025 +0200 btrfs: zoned: directly call do_zone_finish() from btrfs_zone_finish_endio_workfn() When btrfs_zone_finish_endio_workfn() is calling btrfs_zone_finish_endio() it already has a pointer to the block group. Furthermore btrfs_zone_finish_endio() does additional checks if the block group can be finished or not. But in the context of btrfs_zone_finish_endio_workfn() only the actual call to do_zone_finish() is of interest, as the skipping condition when there is still room to allocate from the block group cannot be checked. Directly call do_zone_finish() on the block group. Reviewed-by: Damien Le Moal Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 669d38bf587f27df76bd485c88bac40694b19fbb Author: Filipe Manana Date: Mon Jul 21 17:43:41 2025 +0100 btrfs: collapse unaccount_log_buffer() into clean_log_buffer() There's one only one caller of unaccount_log_buffer() and both this function and the caller are short, so move its code into the caller. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cac2ab34d88e2e4aaa0991038854849a2eaff942 Author: Filipe Manana Date: Mon Jul 21 13:48:12 2025 +0100 btrfs: use local key variable to pass arguments in replay_one_extent() Instead of extracting again the disk_bytenr and disk_num_bytes values from the file extent item to pass to btrfs_qgroup_trace_extent(), use the key local variable 'ins' which already has those values, reducing the size of the source code. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 575f52a77a0aa045943cca67fdf9f0388e86a5f8 Author: Filipe Manana Date: Mon Jul 21 13:41:15 2025 +0100 btrfs: process inline extent earlier in replay_one_extent() Instead of having an if statement to check for regular and prealloc extents first, process them in a block, and then following with an else statement to check for an inline extent, check for an inline extent first, process it and jump to the 'update_inode' label, allowing us to avoid having the code for processing regular and prealloc extents inside a block, reducing the high indentation level by one and making the code easier to read and avoid line splittings too. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 88666b6df97ec3ac8e6522584bec4963cf7ce6f8 Author: Filipe Manana Date: Mon Jul 21 12:54:48 2025 +0100 btrfs: exit early when replaying hole file extent item from a log tree At replay_one_extent(), we can jump to the code that updates the file extent range and updates the inode when processing a file extent item that represents a hole and we don't have the NO_HOLES feature enabled. This helps reduce the high indentation level by one in replay_one_extent() and avoid splitting some lines to make the code easier to read. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 912c257c88cd8c9a466a3cf702912a03a979fd06 Author: Filipe Manana Date: Fri Jul 18 08:30:21 2025 +0100 btrfs: abort transaction where errors happen during log tree replay In the replay_one_buffer() log tree walk callback we return errors to the log tree walk caller and then the caller aborts the transaction, if we have one, or turns the fs into error state if we don't have one. While this reduces code it makes it harder to figure out where exactly an error came from. So add the transaction aborts after every failure inside the replay_one_buffer() callback and the functions it calls, making it as fine grained as possible, so that it helps figuring out why failures happen. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 874576d2a79a2e94cffc89b3bd0c285141b99208 Author: Filipe Manana Date: Wed Jul 16 17:36:13 2025 +0100 btrfs: return real error from read_alloc_one_name() in drop_one_dir_item() If read_alloc_one_name() we explicitly return -ENOMEM and currently that is fine since it's the only error read_alloc_one_name() can return for now. However this is fragile and not future proof, so return instead what read_alloc_one_name() returned. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 425652cf102838676d128e639ec5c2e416264007 Author: Filipe Manana Date: Wed Jul 16 16:22:32 2025 +0100 btrfs: use local variable for the transaction handle in replay_one_buffer() Instead of keep dereferencing the walk_control structure to extract the transaction handle whenever is needed, do it once by storing it in a local variable and then use the variable everywhere. This reduces code verbosity and eliminates the need for some split lines. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e6dd405b6671b9753b98d8bdf76f8f0ed36c11cd Author: Filipe Manana Date: Wed Jul 16 15:49:31 2025 +0100 btrfs: abort transaction in the process_one_buffer() log tree walk callback In the process_one_buffer() log tree walk callback we return errors to the log tree walk caller and then the caller aborts the transaction, if we have one, or turns the fs into error state if we don't have one. While this reduces code it makes it harder to figure out where exactly an error came from. So add the transaction aborts after every failure inside the process_one_buffer() callback, so that it helps figuring out why failures happen. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6ebd726b104fa99d47c0d45979e6a6109844ac18 Author: Filipe Manana Date: Wed Jul 16 14:56:11 2025 +0100 btrfs: abort transaction on specific error places when walking log tree We do several things while walking a log tree (for replaying and for freeing a log tree) like reading extent buffers and cleaning them up, but we don't immediately abort the transaction, or turn the fs into an error state, when one of these things fails. Instead we the transaction abort or turn the fs into error state in the caller of the entry point function that walks a log tree - walk_log_tree() - which means we don't get to know exactly where an error came from. Improve on this by doing a transaction abort / turn fs into error state after each such failure so that when it happens we have a better understanding where the failure comes from. This deliberately leaves the transaction abort / turn fs into error state in the callers of walk_log_tree() as to ensure we don't get into an inconsistent state in case we forget to do it deeper in call chain. It also deliberately does not do it after errors from the calls to the callback defined in struct walk_control::process_func(), as we will do it later on another patch. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit aa8fc9469d20d59dc36aae64226362303daeab4a Author: Qu Wenruo Date: Sat Jul 19 18:17:26 2025 +0930 btrfs: replace double boolean parameters of cow_file_range() The function cow_file_range() has two boolean parameters. Replace it with a single @flags parameter, with two flags: - COW_FILE_RANGE_NO_INLINE - COW_FILE_RANGE_KEEP_LOCKED And since we're here, also update the comments of cow_file_range() to replace the old "page" usage with "folio". Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e336ab509b43ea601801dfa05b4270023c3ed007 Author: Jonas Gorski Date: Mon Sep 15 20:37:25 2025 +0200 spi: rename SPI_CS_CNT_MAX => SPI_DEVICE_CS_CNT_MAX Rename SPI_CS_CNT_MAX to SPI_DEVICE_CS_CNT_MAX to make it more obvious that this is the max number of CS per device supported, not per controller. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-8-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 08fda410bae41cc8dde9697f9104da525be53153 Author: Jonas Gorski Date: Mon Sep 15 20:37:24 2025 +0200 spi: reduce device chip select limit again The spi chipselect limit SPI_CS_CNT_MAX was raised with commit 2f8c7c3715f2 ("spi: Raise limit on number of chip selects") from 4 to 16 to accommodate spi controllers with more than 4 chip selects, and then later to 24 with commit 96893cdd4760 ("spi: Raise limit on number of chip selects to 24"). Now that we removed SPI_CS_CNT_MAX limiting the chip selects of controllers, we can reduce the amount of chip selects per device again to 4, the original value. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-7-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 83c522fb642384aef43697aa5c7686363e9e92dd Author: Jonas Gorski Date: Mon Sep 15 20:37:23 2025 +0200 spi: don't check spi_controller::num_chipselect when parsing a dt device Do not validate spi_controller::num_chipselect against SPI_CS_CNT_MAX when parsing an spi device firmware node. Firstly this is the wrong place, and this should be done while registering/validating the controller. Secondly, there is no reason for that check, as SPI_CS_CNT_MAX controls the amount of chipselects a device may have, not a controller may have. So drop that check as it needlessly limits controllers to SPI_CS_CNT_MAX number of chipselects. Likewise, drop the check for number of device chipselects larger than controller's number of chipselects, as __spi_add_device() will already catch that as either one of the chip selects will be out of range, or there is a duplicate one. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-6-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit f3982daccf42cefcd80218c76a6b5dd134fe97e3 Author: Jonas Gorski Date: Mon Sep 15 20:37:22 2025 +0200 spi: drop check for validity of device chip selects Now that we know the number of chip selects of a device, we can assume these are valid, and do not need to check them first. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-5-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 1c923f624439b26b6740cdd2a9f7a12b1968f3f3 Author: Jonas Gorski Date: Mon Sep 15 20:37:21 2025 +0200 spi: move unused device CS initialization to __spi_add_device() Using spi_device::num_chipselect, initialize unused device CS as invalid at registration time in __spi_add_device(), and drop it from the different allocation paths. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-4-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 099f942182e3695554cba44e4bafb08a4111b50f Author: Jonas Gorski Date: Mon Sep 15 20:37:20 2025 +0200 spi: keep track of number of chipselects in spi_device There are several places where we need to iterate over a device's chipselect. To be able to do it efficiently, store the number of chipselects in spi_device, like we do for controllers. Since we now use a device supplied value, add a check to make sure it isn't more than we can support. Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-3-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 188f63235bcdd207646773a8739387d85347ed76 Author: Jonas Gorski Date: Mon Sep 15 20:37:19 2025 +0200 spi: fix return code when spi device has too many chipselects Don't return a positive value when there are too many chipselects. Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core") Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit f98cabe3f6cf6396b3ae0264800d9b53d7612433 Author: Haixu Cui Date: Mon Sep 8 17:23:48 2025 +0800 SPI: Add virtio SPI driver This is the virtio SPI Linux kernel driver. Signed-off-by: Haixu Cui Link: https://patch.msgid.link/20250908092348.1283552-4-quic_haixcui@quicinc.com Signed-off-by: Mark Brown commit 6a1f3390fafeafe130b8128b3047452b92911a98 Author: Haixu Cui Date: Mon Sep 8 17:23:47 2025 +0800 virtio-spi: Add virtio-spi.h Add virtio-spi.h header for virtio SPI. Signed-off-by: Haixu Cui Link: https://patch.msgid.link/20250908092348.1283552-3-quic_haixcui@quicinc.com Signed-off-by: Mark Brown commit d9a2211dd3aee3ef29fc675f70a1941bc3f4f51f Author: Haixu Cui Date: Mon Sep 8 17:23:46 2025 +0800 virtio: Add ID for virtio SPI Add VIRTIO_ID_SPI definition for virtio SPI. Signed-off-by: Haixu Cui Reviewed-by: Viresh Kumar Reviewed-by: Alex Bennée Link: https://patch.msgid.link/20250908092348.1283552-2-quic_haixcui@quicinc.com Signed-off-by: Mark Brown commit 46c8b4d2a693eca69a2191436cffa44f489e98c7 Author: Stefan Binding Date: Wed Sep 17 16:37:12 2025 +0100 ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI If ACPI is not used, then there is currently no way of reading a Subsystem ID property used for a system name to uniquely identify the system in order to load the correct firmware and tuning. Add a new property which can be read from device tree to be able to set the system name. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250917153722.94978-3-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit f8673e4069b2032bf9f854bae818a7bdbdca7520 Author: Stefan Binding Date: Wed Sep 17 16:37:11 2025 +0100 ASoC: dt-bindings: cirrus,cs35l41: Document the cirrus,subsystem-id property Add new property: cirrus,subsystem-id This new property is used to uniquely identify the system if device tree is used, to allow the driver to select the correct firmware and tuning for the system. The DSP driver searches for a compatible firmware (and tuning) based on what it is able to read from the hardware. However, the SSID is based on the system, and cannot be read from the hardware, therefore it needs to be read from the Device Tree. On ACPI-based systems, it is able to read this from the ACPI _SUB property, and to maintain compatibility with the driver between ACPI and Device Tree systems we need an equivalent property. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250917153722.94978-2-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 9cf5b8b69bfccf3d98d31f640244437a452daa80 Author: Baojun Xu Date: Sat Sep 20 14:20:44 2025 +0800 ASoC: tas2781: Correct the wrong description and register address on tas2781 Correct the wrong description for TAS257X. Combined TAS5825 with TAS2563, as they use the same register address and number. Correct the register address and number for TAS5827. Fixes: 7095d688de38 ("ASoC: tas2781: Add tas2118, tas2x20, tas5825 support") Signed-off-by: Baojun Xu Acked-by: Mark Brown Signed-off-by: Takashi Iwai commit ad4728740bd68d74365a43acc25a65339a9b2173 Author: Biju Das Date: Sun Sep 21 12:26:46 2025 +0100 spi: rpc-if: Add resume support for RZ/G3E On RZ/G3E using PSCI, s2ram powers down the SoC. After resume, reinitialize the hardware for SPI operations. Signed-off-by: Biju Das Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 81ef2022b311c7c4f29011f778442635acfaba90 Author: Biju Das Date: Sun Sep 21 12:26:45 2025 +0100 spi: rpc-if: Drop deprecated SIMPLE_DEV_PM_OPS Replace SIMPLE_DEV_PM_OPS->DEFINE_SIMPLE_DEV_PM_OPS macro and use pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled, while increasing build coverage. Also drop the __maybe_unused attribute from PM functions. Signed-off-by: Biju Das Link: https://patch.msgid.link/20250921112649.104516-2-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 9d52b0b41be5b932a0a929c10038f1bb04af4ca5 Author: Marek Marczykowski-Górecki Date: Sun Sep 21 18:28:47 2025 +0200 xen: take system_transition_mutex on suspend Xen's do_suspend() calls dpm_suspend_start() without taking required system_transition_mutex. Since 12ffc3b1513eb moved the pm_restrict_gfp_mask() call, not taking that mutex results in a WARN. Take the mutex in do_suspend(), and use mutex_trylock() to follow how enter_state() does this. Suggested-by: Jürgen Groß Fixes: 12ffc3b1513eb "PM: Restrict swap use to later in the suspend sequence" Link: https://lore.kernel.org/xen-devel/aKiBJeqsYx_4Top5@mail-itl/ Signed-off-by: Marek Marczykowski-Górecki Cc: stable@vger.kernel.org # v6.16+ Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250921162853.223116-1-marmarek@invisiblethingslab.com> commit 16444ae3f7af91aedfaabcada3f58e0d4aefc53a Merge: e0d3bba84ff8b8 570f94511766f9 Author: Johannes Berg Date: Mon Sep 22 09:29:52 2025 +0200 Merge tag 'rtw-next-2025-09-22' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw-next patches for v6.18 Some small fixes and features are listed: rtw88: * correct LED function rtw89: * fix wait/completion racing of sending NULL data * implement beacon tracking feature * implement report channel noise function supported by RTL8852A * correct RTL8851B RF calibration * preparation of PCI TX/RX ring and interrupts for coming RTL8922DE ================== Signed-off-by: Johannes Berg commit 4f152338e384a3a47dd61909e1457539fa93f5a4 Author: Nagarjuna Kristam Date: Thu Sep 11 11:30:22 2025 +0200 PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently called twice. pex_ep_event_pex_rst_assert() should do the opposite of pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate tegra_pcie_bpmp_set_pll_state() call should instead be a call to tegra_pcie_bpmp_set_ctrl_state(). With this, the uninitialization sequence also matches that of tegra_pcie_unconfig_controller(). Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") Signed-off-by: Nagarjuna Kristam [cassel: improve commit log] Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org [mani: added Fixes tag] Signed-off-by: Manivannan Sadhasivam commit e0d3bba84ff8b82d4e8820856a7850afb17c14f9 Author: Johannes Berg Date: Fri Sep 19 12:23:25 2025 +0200 wifi: cfg80211: remove IEEE80211_CHAN_{1,2,4,8,16}MHZ flags These were used by S1G for older chandef representation, but are no longer needed. Clean them up, even if we can't drop them from the userspace API entirely. Signed-off-by: Johannes Berg commit d5cf5b37064b1699d946e8b7ab4ac7d7d101814c Author: Jens Wiklander Date: Fri Sep 19 10:48:31 2025 +0200 tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a number larger than 0, but not the requested amount. This fixes a possible NULL pointer dereference following a bad input from ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped. Cc: stable@vger.kernel.org Reported-by: Masami Ichikawa Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq=u9W+-g@mail.gmail.com/ Tested-by: Masami Ichikawa Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration") Signed-off-by: Jens Wiklander commit 570f94511766f9236d3462dfb8a3c719c2b54c23 Author: Fedor Pchelkin Date: Sat Sep 20 00:08:50 2025 +0300 wifi: rtw89: avoid circular locking dependency in ser_state_run() Lockdep gives a splat [1] when ser_hdl_work item is executed. It is scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a wiphy lock inside. However, this workqueue can be flushed when e.g. closing the interface and wiphy lock is already taken in that case. Choosing wiphy_work_queue() for SER is likely not suitable. Back on to the global workqueue. [1]: WARNING: possible circular locking dependency detected 6.17.0-rc2 #17 Not tainted ------------------------------------------------------ kworker/u32:1/61 is trying to acquire lock: ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] but task is already holding lock: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: process_one_work+0x7c6/0x1450 worker_thread+0x49e/0xd00 kthread+0x313/0x640 ret_from_fork+0x221/0x300 ret_from_fork_asm+0x1a/0x30 -> #1 ((wq_completion)phy0){+.+.}-{0:0}: touch_wq_lockdep_map+0x8e/0x180 __flush_workqueue+0x129/0x10d0 ieee80211_stop_device+0xa8/0x110 ieee80211_do_stop+0x14ce/0x2880 ieee80211_stop+0x13a/0x2c0 __dev_close_many+0x18f/0x510 __dev_change_flags+0x25f/0x670 netif_change_flags+0x7b/0x160 do_setlink.isra.0+0x1640/0x35d0 rtnl_newlink+0xd8c/0x1d30 rtnetlink_rcv_msg+0x700/0xb80 netlink_rcv_skb+0x11d/0x350 netlink_unicast+0x49a/0x7a0 netlink_sendmsg+0x759/0xc20 ____sys_sendmsg+0x812/0xa00 ___sys_sendmsg+0xf7/0x180 __sys_sendmsg+0x11f/0x1b0 do_syscall_64+0xbb/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: __lock_acquire+0x124c/0x1d20 lock_acquire+0x154/0x2e0 __mutex_lock+0x17b/0x12f0 ser_state_run+0x5e/0x180 [rtw89_core] rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] process_one_work+0x82d/0x1450 worker_thread+0x49e/0xd00 kthread+0x313/0x640 ret_from_fork+0x221/0x300 ret_from_fork_asm+0x1a/0x30 other info that might help us debug this: Chain exists of: &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((work_completion)(&ser->ser_hdl_work)); lock((wq_completion)phy0); lock((work_completion)(&ser->ser_hdl_work)); lock(&rdev->wiphy.mtx); *** DEADLOCK *** 2 locks held by kworker/u32:1/61: #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 stack backtrace: CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] Call Trace: dump_stack_lvl+0x5d/0x80 print_circular_bug.cold+0x178/0x1be check_noncircular+0x14c/0x170 __lock_acquire+0x124c/0x1d20 lock_acquire+0x154/0x2e0 __mutex_lock+0x17b/0x12f0 ser_state_run+0x5e/0x180 [rtw89_core] rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] process_one_work+0x82d/0x1450 worker_thread+0x49e/0xd00 kthread+0x313/0x640 ret_from_fork+0x221/0x300 ret_from_fork_asm+0x1a/0x30 Found by Linux Verification Center (linuxtesting.org). Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 Author: Fedor Pchelkin Date: Sat Sep 20 00:08:49 2025 +0300 wifi: rtw89: fix leak in rtw89_core_send_nullfunc() If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated skb is leaked. Free it on the error handling path. Found by Linux Verification Center (linuxtesting.org). Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link") Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru commit c24248ed78f33ea299ea61d105355ba47157d49f Author: Fedor Pchelkin Date: Sat Sep 20 00:08:48 2025 +0300 wifi: rtw89: avoid possible TX wait initialization race The value of skb_data->wait indicates whether skb is passed on to the core mac80211 stack or released by the driver itself. Make sure that by the time skb is added to txwd queue and becomes visible to the completing side, it has already allocated and initialized TX wait related data (in case it's needed). This is found by code review and addresses a possible race scenario described below: Waiting thread Completing thread rtw89_core_send_nullfunc() rtw89_core_tx_write_link() ... rtw89_pci_txwd_submit() skb_data->wait = NULL /* add skb to the queue */ skb_queue_tail(&txwd->queue, skb) /* another thread (e.g. rtw89_ops_tx) performs TX kick off for the same queue */ rtw89_pci_napi_poll() ... rtw89_pci_release_txwd_skb() /* get skb from the queue */ skb_unlink(skb, &txwd->queue) rtw89_pci_tx_status() rtw89_core_tx_wait_complete() /* use incorrect skb_data->wait */ rtw89_core_tx_kick_off_and_wait() /* assign skb_data->wait but too late */ Found by Linux Verification Center (linuxtesting.org). Fixes: 1ae5ca615285 ("wifi: rtw89: add function to wait for completion of TX skbs") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250919210852.823912-3-pchelkin@ispras.ru commit 3e31a6bc07312b448fad3b45de578471f86f0e77 Author: Fedor Pchelkin Date: Sat Sep 20 00:08:47 2025 +0300 wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 CPU: 6 UID: 0 PID: 41377 Comm: kworker/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] Use-after-free write at 0x0000000020309d9d (in kfence-#251): rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.h:141 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago): __alloc_skb net/core/skbuff.c:659 __netdev_alloc_skb net/core/skbuff.c:734 ieee80211_nullfunc_get net/mac80211/tx.c:5844 rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.c:3194 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago): ieee80211_tx_status_skb net/mac80211/status.c:1117 rtw89_pci_release_txwd_skb drivers/net/wireless/realtek/rtw89/pci.c:564 rtw89_pci_release_tx_skbs.isra.0 drivers/net/wireless/realtek/rtw89/pci.c:651 rtw89_pci_release_tx drivers/net/wireless/realtek/rtw89/pci.c:676 rtw89_pci_napi_poll drivers/net/wireless/realtek/rtw89/pci.c:4238 __napi_poll net/core/dev.c:7495 net_rx_action net/core/dev.c:7557 net/core/dev.c:7684 handle_softirqs kernel/softirq.c:580 do_softirq.part.0 kernel/softirq.c:480 __local_bh_enable_ip kernel/softirq.c:407 rtw89_pci_interrupt_threadfn drivers/net/wireless/realtek/rtw89/pci.c:927 irq_thread_fn kernel/irq/manage.c:1133 irq_thread kernel/irq/manage.c:1257 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 It is a consequence of a race between the waiting and the signaling side of the completion: Waiting thread Completing thread rtw89_core_tx_kick_off_and_wait() rcu_assign_pointer(skb_data->wait, wait) /* start waiting */ wait_for_completion_timeout() rtw89_pci_tx_status() rtw89_core_tx_wait_complete() rcu_read_lock() /* signals completion and * proceeds further */ complete(&wait->completion) rcu_read_unlock() ... /* frees skb_data */ ieee80211_tx_status_ni() /* returns (exit status doesn't matter) */ wait_for_completion_timeout() ... /* accesses the already freed skb_data */ rcu_assign_pointer(skb_data->wait, NULL) The completing side might proceed and free the underlying skb even before the waiting side is fully awoken and run to execution. Actually the race happens regardless of wait_for_completion_timeout() exit status, e.g. the waiting side may hit a timeout and the concurrent completing side is still able to free the skb. Skbs which are sent by rtw89_core_tx_kick_off_and_wait() are owned by the driver. They don't come from core ieee80211 stack so no need to pass them to ieee80211_tx_status_ni() on completing side. Introduce a work function which will act as a garbage collector for rtw89_tx_wait_info objects and the associated skbs. Thus no potentially heavy locks are required on the completing side. Found by Linux Verification Center (linuxtesting.org). Fixes: 1ae5ca615285 ("wifi: rtw89: add function to wait for completion of TX skbs") Cc: stable@vger.kernel.org Suggested-by: Zong-Zhe Yang Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250919210852.823912-2-pchelkin@ispras.ru commit 302c04110f0ce70d25add2496b521132548cd408 Author: Ma Ke Date: Sat Sep 20 20:53:12 2025 +0800 sparc: fix error handling in scan_one_device() Once of_device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). Calling path: of_device_register() -> of_device_add() -> device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'. Found by code review. Cc: stable@vger.kernel.org Fixes: cf44bbc26cf1 ("[SPARC]: Beginnings of generic of_device framework.") Signed-off-by: Ma Ke Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 6c15463c4511d26f2a820f63f5b76624a71afc44 Author: Xichao Zhao Date: Tue Aug 12 19:33:59 2025 +0800 sunrpc: fix "occurence"->"occurrence" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Reviewed-by: Joe Damato Signed-off-by: Chuck Lever commit 13289ed501bad7a37ccbfa8581961d2e9dd4aea3 Author: Eric Biggers Date: Sun Aug 3 14:21:30 2025 -0700 nfsd: Don't force CRYPTO_LIB_SHA256 to be built-in Now that nfsd is accessing SHA-256 via the library API instead of via crypto_shash, there is a direct symbol dependency on the SHA-256 code and there is no benefit to be gained from forcing it to be built-in. Therefore, select CRYPTO_LIB_SHA256 from NFSD (conditional on NFSD_V4) instead of from NFSD_V4, so that it can be 'm' if NFSD is 'm'. Signed-off-by: Eric Biggers Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a082e4b4d08a4a0e656d90c2c05da85f23e6d0c9 Author: Olga Kornievskaia Date: Thu Aug 21 16:31:46 2025 -0400 nfsd: nfserr_jukebox in nlm_fopen should lead to a retry When v3 NLM request finds a conflicting delegation, it triggers a delegation recall and nfsd_open fails with EAGAIN. nfsd_open then translates EAGAIN into nfserr_jukebox. In nlm_fopen, instead of returning nlm_failed for when there is a conflicting delegation, drop this NLM request so that the client retries. Once delegation is recalled and if a local lock is claimed, a retry would lead to nfsd returning a nlm_lck_blocked error or a successful nlm lock. Fixes: d343fce148a4 ("[PATCH] knfsd: Allow lockd to drop replies as appropriate") Cc: stable@vger.kernel.org # v6.6 Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 8ddd06be9a9e2b9f4af9b337150af834862331ef Author: Chuck Lever Date: Thu Aug 21 10:53:21 2025 -0400 NFSD: Reduce DRC bucket size The common case is that a DRC lookup will not find the XID in the bucket. Reduce the amount of pointer chasing during the lookup by keeping fewer entries in each hash bucket. Changing the bucket size constant forces the size of the DRC hash table to increase, and the height of each bucket r-b tree to be reduced. Signed-off-by: Chuck Lever commit fb340bfd48bcc3a51d35be1fe2a2db290092d4ea Author: Chuck Lever Date: Thu Aug 21 10:53:20 2025 -0400 NFSD: Delay adding new entries to LRU Neil Brown observes: > I would not include RC_INPROG entries in the lru at all - they are > always ignored, and will be added when they are switched to > RCU_DONE. I also removed a stale comment. Suggested-by: NeilBrown Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit d73d06dac604043b94a5f18ebb6a69da1b867702 Author: Chuck Lever Date: Wed Aug 20 10:27:28 2025 -0400 SUNRPC: Move the svc_rpcb_cleanup() call sites Clean up: because svc_rpcb_cleanup() and svc_xprt_destroy_all() are always invoked in pairs, we can deduplicate code by moving the svc_rpcb_cleanup() call sites into svc_xprt_destroy_all(). Tested-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit dd9adfa0da2b0dac4c0abdae4bdb88c366bd83d5 Author: Chuck Lever Date: Wed Aug 20 10:27:27 2025 -0400 NFS: Remove rpcbind cleanup for NFSv4.0 callback The NFS client's NFSv4.0 callback listeners are created with SVC_SOCK_ANONYMOUS, therefore svc_setup_socket() does not register them with the client's rpcbind service. And, note that nfs_callback_down_net() does not call svc_rpcb_cleanup() at all when shutting down the callback server. Even if svc_setup_socket() were to attempt to register or unregister these sockets, the callback service has vs_hidden set, which shunts the rpcbind upcalls. The svc_rpcb_cleanup() error flow was introduced by commit c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()"). It doesn't appear in the code that was relocated by that commit. Therefore, there is no need to call svc_rpcb_cleanup() when listener creation fails during callback server start-up. Signed-off-by: Chuck Lever commit 898374fdd7f06fa4c4a66e8be3135efeae6128d5 Author: Olga Kornievskaia Date: Tue Aug 19 14:04:02 2025 -0400 nfsd: unregister with rpcbind when deleting a transport When a listener is added, a part of creation of transport also registers program/port with rpcbind. However, when the listener is removed, while transport goes away, rpcbind still has the entry for that port/type. When deleting the transport, unregister with rpcbind when appropriate. ---v2 created a new xpt_flag XPT_RPCB_UNREG to mark TCP and UDP transport and at xprt destroy send rpcbind unregister if flag set. Suggested-by: Chuck Lever Fixes: d093c9089260 ("nfsd: fix management of listener transports") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f64397e04b4d094319a8f72bb1b82e4d2e3672ae Author: Xichao Zhao Date: Mon Aug 18 18:03:20 2025 +0800 NFSD: Drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. Signed-off-by: Xichao Zhao Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7569065fb123f8428cb9d29939dd16d43d4b50c4 Author: Jeff Layton Date: Mon Aug 11 10:37:08 2025 -0400 sunrpc: eliminate return pointer in svc_tcp_sendmsg() Return a positive value if something was sent, or a negative error code. Eliminate the "err" variable in the only caller as well. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit a9a15ba23efc4d6d34127e8d175ae63a95434f58 Author: Jeff Layton Date: Mon Aug 11 10:37:07 2025 -0400 sunrpc: fix pr_notice in svc_tcp_sendto() to show correct length This pr_notice() is confusing since it only prints xdr->len, which doesn't include the 4-byte record marker. That can make it sometimes look like the socket sent more than was requested if it's short by just a few bytes. Add sizeof(marker) to the size and fix the format accordingly. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit e4f574ca9c6dfa66695bb054ff5df43ecea873ec Author: Scott Mayhew Date: Wed Aug 6 15:15:43 2025 -0400 nfsd: decouple the xprtsec policy check from check_nfsd_access() A while back I had reported that an NFSv3 client could successfully mount using '-o xprtsec=none' an export that had been exported with 'xprtsec=tls:mtls'. By "successfully" I mean that the mount command would succeed and the mount would show up in /proc/mount. Attempting to do anything futher with the mount would be met with NFS3ERR_ACCES. This was fixed (albeit accidentally) by commit bb4f07f2409c ("nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT") and was subsequently re-broken by commit 0813c5f01249 ("nfsd: fix access checking for NLM under XPRTSEC policies"). Transport Layer Security isn't an RPC security flavor or pseudo-flavor, so we shouldn't be conflating them when determining whether the access checks can be bypassed. Split check_nfsd_access() into two helpers, and have __fh_verify() call the helpers directly since __fh_verify() has logic that allows one or both of the checks to be skipped. All other sites will continue to call check_nfsd_access(). Link: https://lore.kernel.org/linux-nfs/ZjO3Qwf_G87yNXb2@aion/ Fixes: 9280c5774314 ("NFSD: Handle new xprtsec= export option") Cc: stable@vger.kernel.org Signed-off-by: Scott Mayhew Signed-off-by: Chuck Lever commit ab1c282c010c4f327bd7addc3c0035fd8e3c1721 Author: Thorsten Blum Date: Wed Aug 6 03:10:01 2025 +0200 NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() Commit 5304877936c0 ("NFSD: Fix strncpy() fortify warning") replaced strncpy(,, sizeof(..)) with strlcpy(,, sizeof(..) - 1), but strlcpy() already guaranteed NUL-termination of the destination buffer and subtracting one byte potentially truncated the source string. The incorrect size was then carried over in commit 72f78ae00a8e ("NFSD: move from strlcpy with unused retval to strscpy") when switching from strlcpy() to strscpy(). Fix this off-by-one error by using the full size of the destination buffer again. Cc: stable@vger.kernel.org Fixes: 5304877936c0 ("NFSD: Fix strncpy() fortify warning") Signed-off-by: Thorsten Blum Signed-off-by: Chuck Lever commit 9ebcd022a34388bd3c37c6a11c1a9d49d5394eb2 Author: Eric Biggers Date: Mon Aug 4 22:47:00 2025 +0000 nfsd: Eliminate an allocation in nfs4_make_rec_clidname() Since MD5 digests are fixed-size, make nfs4_make_rec_clidname() store the digest in a stack buffer instead of a dynamically allocated buffer. Use MD5_DIGEST_SIZE instead of a hard-coded value, both in nfs4_make_rec_clidname() and in the definition of HEXDIR_LEN. Signed-off-by: Eric Biggers Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 17695d72d0b192bb471a699483dd6c6c2576c57d Author: Eric Biggers Date: Mon Aug 4 22:46:59 2025 +0000 nfsd: Replace open-coded conversion of bytes to hex Since the Linux kernel's sprintf() has conversion to hex built-in via "%*phN", delete md5_to_hex() and just use that. Also add an explicit array bound to the dname parameter of nfs4_make_rec_clidname() to make its size clear. No functional change. Reviewed-by: Jeff Layton Signed-off-by: Eric Biggers Signed-off-by: Chuck Lever commit 6ecdfd7aa8e30e16193d4ee07bcb3f1216dbc358 Author: Colin Ian King Date: Tue Jul 29 14:07:09 2025 +0100 lockd: Remove space before newline There is an extraneous space before a newline in a dprintk message. Remove the space. Signed-off-by: Colin Ian King Signed-off-by: Chuck Lever commit e5e9b24ab8fa9e899d6627123d7d5ba0c317d267 Author: Jeff Layton Date: Wed Jul 30 09:24:37 2025 -0400 nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation Instead of allowing the ctime to roll backward with a WRITE_ATTRS delegation, set FMODE_NOCMTIME on the file and have it skip mtime and ctime updates. It is possible that the client will never send a SETATTR to set the times before returning the delegation. Add two new bools to struct nfs4_delegation: dl_written: tracks whether the file has been written since the delegation was granted. This is set in the WRITE and LAYOUTCOMMIT handlers. dl_setattr: tracks whether the client has sent at least one valid mtime that can also update the ctime in a SETATTR. When unlocking the lease for the delegation, clear FMODE_NOCMTIME. If the file has been written, but no setattr for the delegated mtime and ctime has been done, update the timestamps to current_time(). Suggested-by: NeilBrown Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit b40b1ba37ad5b6099c426765c4bc327c08b390b9 Author: Jeff Layton Date: Wed Jul 30 09:24:36 2025 -0400 nfsd: fix timestamp updates in CB_GETATTR When updating the local timestamps from CB_GETATTR, the updated values are not being properly vetted. Compare the update times vs. the saved times in the delegation rather than the current times in the inode. Also, ensure that the ctime is properly vetted vs. its original value. Fixes: 6ae30d6eb26b ("nfsd: add support for delegated timestamps") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 3952f1cbcbc454b2cb639ddbf165c07068e90371 Author: Jeff Layton Date: Wed Jul 30 09:24:35 2025 -0400 nfsd: fix SETATTR updates for delegated timestamps SETATTRs containing delegated timestamp updates are currently not being vetted properly. Since we no longer need to compare the timestamps vs. the current timestamps, move the vetting of delegated timestamps wholly into nfsd. Rename the set_cb_time() helper to nfsd4_vet_deleg_time(), and make it non-static. Add a new vet_deleg_attrs() helper that is called from nfsd4_setattr that uses nfsd4_vet_deleg_time() to properly validate the all the timestamps. If the validation indicates that the update should be skipped, unset the appropriate flags in ia_valid. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 7663e963a51122792811811c8119fd55c9ab254a Author: Jeff Layton Date: Wed Jul 30 09:24:34 2025 -0400 nfsd: track original timestamps in nfs4_delegation As Trond points out [1], the "original time" mentioned in RFC 9754 refers to the timestamps on the files at the time that the delegation was granted, and not the current timestamp of the file on the server. Store the current timestamps for the file in the nfs4_delegation when granting one. Add STATX_ATIME and STATX_MTIME to the request mask in nfs4_delegation_stat(). When granting OPEN_DELEGATE_READ_ATTRS_DELEG, do a nfs4_delegation_stat() and save the correct atime. If the stat() fails for any reason, fall back to granting a normal read deleg. [1]: https://lore.kernel.org/linux-nfs/47a4e40310e797f21b5137e847b06bb203d99e66.camel@kernel.org/ Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c066ff58e5d6e5d7400e5fda0c33f95b8c37dd02 Author: Jeff Layton Date: Wed Jul 30 09:24:33 2025 -0400 nfsd: use ATTR_CTIME_SET for delegated ctime updates Ensure that notify_change() doesn't clobber a delegated ctime update with current_time() by setting ATTR_CTIME_SET for those updates. Don't bother setting the timestamps in cb_getattr_update_times() in the non-delegated case. notify_change() will do that itself. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit afc5b36e29b95fbd31a60b9630d148857e5e513d Author: Jeff Layton Date: Wed Jul 30 09:24:32 2025 -0400 vfs: add ATTR_CTIME_SET flag When ATTR_ATIME_SET and ATTR_MTIME_SET are set in the ia_valid mask, the notify_change() logic takes that to mean that the request should set those values explicitly, and not override them with "now". With the advent of delegated timestamps, similar functionality is needed for the ctime. Add a ATTR_CTIME_SET flag, and use that to indicate that the ctime should be accepted as-is. Also, clean up the if statements to eliminate the extra negatives. In setattr_copy() and setattr_copy_mgtime() use inode_set_ctime_deleg() when ATTR_CTIME_SET is set, instead of basing the decision on ATTR_DELEG. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 5affb498e70bba3053b835c478a199bf92c99c4d Author: Jeff Layton Date: Wed Jul 30 09:24:31 2025 -0400 nfsd: ignore ATTR_DELEG when checking ia_valid before notify_change() If the only flag left is ATTR_DELEG, then there are no changes to be made. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 2990b5a47984c27873d165de9e88099deee95c8d Author: Jeff Layton Date: Wed Jul 30 09:24:30 2025 -0400 nfsd: fix assignment of ia_ctime.tv_nsec on delegated mtime update The ia_ctime.tv_nsec field should be set to modify.nseconds. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit d68886bae76a4b9b3484d23e5b7df086f940fa38 Author: Sergey Bashirov Date: Mon Jul 21 21:40:56 2025 +0300 NFSD: Fix last write offset handling in layoutcommit The data type of loca_last_write_offset is newoffset4 and is switched on a boolean value, no_newoffset, that indicates if a previous write occurred or not. If no_newoffset is FALSE, an offset is not given. This means that client does not try to update the file size. Thus, server should not try to calculate new file size and check if it fits into the segment range. See RFC 8881, section 12.5.4.2. Sometimes the current incorrect logic may cause clients to hang when trying to sync an inode. If layoutcommit fails, the client marks the inode as dirty again. Fixes: 9cf514ccfacb ("nfsd: implement pNFS operations") Cc: stable@vger.kernel.org Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f963cf2b91a30b5614c514f3ad53ca124cb65280 Author: Sergey Bashirov Date: Mon Jul 21 21:40:55 2025 +0300 NFSD: Implement large extent array support in pNFS When pNFS client in the block or scsi layout mode sends layoutcommit to MDS, a variable length array of modified extents is supplied within the request. This patch allows the server to accept such extent arrays if they do not fit within single memory page. The issue can be reproduced when writing to a 1GB file using FIO with O_DIRECT, 4K block and large I/O depth without preallocation of the file. In this case, the server returns NFSERR_BADXDR to the client. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 6bf1be3399e2635805074954011cb55745569788 Author: Sergey Bashirov Date: Tue Jul 15 18:32:20 2025 +0300 NFSD: Minor cleanup in layoutcommit decoding Use the appropriate xdr function to decode the lc_newoffset field, which is a boolean value. See RFC 8881, section 18.42.1. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 274365a51d88658fb51cca637ba579034e90a799 Author: Sergey Bashirov Date: Tue Jul 15 18:32:18 2025 +0300 NFSD: Minor cleanup in layoutcommit processing Remove dprintk in nfsd4_layoutcommit. These are not needed in day to day usage, and the information is also available in Wireshark when capturing NFS traffic. Reviewed-by: Christoph Hellwig Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit 832738e4b325b742940761e10487403f9aad13e8 Author: Sergey Bashirov Date: Mon Jul 21 17:48:55 2025 +0300 NFSD: Rework encoding and decoding of nfsd4_deviceid Compilers may optimize the layout of C structures, so we should not rely on sizeof struct and memcpy to encode and decode XDR structures. The byte order of the fields should also be taken into account. This patch adds the correct functions to handle the deviceid4 structure and removes the pad field, which is currently not used by NFSD, from the runtime state. The server's byte order is preserved because the deviceid4 blob on the wire is only used as a cookie by the client. Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit c97b737ef8f10f28424822c139e3b22b9e9bcc2b Author: Sergey Bashirov Date: Fri Jul 18 11:09:56 2025 +0300 sunrpc: Change ret code of xdr_stream_decode_opaque_fixed Since the opaque is fixed in size, the caller already knows how many bytes were decoded, on success. Thus, xdr_stream_decode_opaque_fixed() doesn't need to return that value. And, xdr_stream_decode_u32 and _u64 both return zero on success. This patch simplifies the caller's error checking to avoid potential integer promotion issues. Suggested-by: Dan Carpenter Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit 2ee3a75e42081db3d951c0893f5d654f16d1c0e8 Author: NeilBrown Date: Fri Jul 18 11:26:15 2025 +1000 nfsd: discard nfsd_file_get_local() This interface was deprecated by commit e6f7e1487ab5 ("nfs_localio: simplify interface to nfsd for getting nfsd_file") and is now unused. So let's remove it. Signed-off-by: NeilBrown Reviewed-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d9adbb6e10bf7d4223d3d521ede1b2052903bc5e Author: Jeff Layton Date: Tue Jul 8 14:14:53 2025 -0400 sunrpc: delay pc_release callback until after the reply is sent The server-side sunrpc code currently calls pc_release before sending the reply. Change svc_process and svc_process_bc to call pc_release after sending the reply instead. Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c1f203e46c55ac063791bb893e30e5d14cabe1f6 Author: Chuck Lever Date: Wed Jul 2 19:33:45 2025 -0400 NFSD: Move the fh_getattr() helper Clean up: The fh_getattr() function is part of NFSD's file handle API, so relocate it. I've made it an un-inlined function so that trace points and new functionality can easily be introduced. That increases the size of nfsd.ko by about a page on my x86_64 system (out of 26MB; compiled with -O2). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c926f0298d3cdd25f1bfa019f5b74ed48796cef7 Author: Chuck Lever Date: Wed Jul 2 19:33:44 2025 -0400 NFSD: Relocate the fh_want_write() and fh_drop_write() helpers Clean up: these helpers are part of the NFSD file handle API. Relocate them to fs/nfsd/nfsfh.h. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 Author: Lei Lu Date: Mon Aug 11 21:58:48 2025 +0800 sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream") Cc: stable@kernel.org Signed-off-by: Lei Lu Signed-off-by: Chuck Lever commit 342f141ba9f4c9e39de342d047a5245e8f4cda19 Merge: 0faeb8cf99c040 a490c8d77d500b Author: Dave Airlie Date: Mon Sep 22 08:44:52 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-09-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-09-19: amdgpu: - Fence drv clean up fix - DPC fixes - Misc display fixes - Support the MMIO remap page as a ttm pool - JPEG parser updates - UserQ updates - VCN ctx handling fixes - Documentation updates - Misc cleanups - SMU 13.0.x updates - SI DPM updates - GC 11.x cleaner shader updates - DMCUB updates - DML fixes - Improve fallback handling for pixel encoding - VCN reset improvements - DCE6 DC updates - DSC fixes - Use devm for i2c buses - GPUVM locking updates - GPUVM documentation improvements - Drop non-DC DCE11 code - S0ix fixes - Backlight fix - SR-IOV fixes amdkfd: - SVM updates Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250919193354.2989255-1-alexander.deucher@amd.com commit 2af8a8a47df36a202c65ce4af93fb8bc7b607210 Author: Mauro Carvalho Chehab Date: Sat Sep 20 17:22:09 2025 +0200 docs: remove cdomain.py This is not used anymore, as it was a logic we had to support pre Sphinx 3.x, as shown at: afde706afde2 ("Make the docs build "work" with Sphinx 3.x") Remove it. Fixes: b26717852db7 ("docs: conf.py: drop backward support for old Sphinx versions") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3b86d236c64af17924e4cfedbbfb8bc60059802f.1758381727.git.mchehab+huawei@kernel.org> commit 22014a23009326ae63efb08575aada1de2c95bda Author: Yash Suthar Date: Sun Sep 21 00:38:56 2025 +0530 Documentation/process: submitting-patches: fix typo in "were do" Fixes a typo in submitting-patches.rst: "were do" -> "where do" Signed-off-by: Yash Suthar Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20250920190856.7394-1-yashsuthar983@gmail.com> commit 383c4ff4987f651c5340b8e95f4c3e17ebd90ea8 Merge: 8f5ae30d69d754 77111b2c22ef5b Author: Stephen Boyd Date: Sun Sep 21 15:27:58 2025 -0700 Merge tag 'v6.18-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: Export the dsi-24MHz clock on the RK3368, which seems to get some attention to enable DSI support there. * tag 'v6.18-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3368: use clock ids for SCLK_MIPIDSI_24M dt-bindings: clock: rk3368: Add SCLK_MIPIDSI_24M commit ab588b78cdb8d677f70278587041a7366b0cff71 Author: Akira Yokosawa Date: Sun Sep 21 16:26:04 2025 +0900 docs: dev-tools/lkmm: Fix typo of missing file extension Commit 1e9ddbb2cd34 ("docs: Pull LKMM documentation into dev-tools book") failed to add a file extension in lkmm/docs/herd-representation.rst for referencing its plane-text counterpart. Fix it. Fixes: 1e9ddbb2cd34 ("docs: Pull LKMM documentation into dev-tools book") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509192138.fx3H6NzG-lkp@intel.com/ Signed-off-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: commit 0faeb8cf99c040886ac4917b0d7f4684dc9ae846 Merge: 748f41f353e216 d9b2623319fa20 Author: Dave Airlie Date: Mon Sep 22 07:42:05 2025 +1000 Merge tag 'drm-xe-next-2025-09-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Drop L3 bank mask reporting from the media GT on Xe3 and later. Only do that for the primary GT. No userspace needs or uses it for media and some platforms may report bogus values. - Add SLPC power_profile sysfs interface with support for base and power_saving modes (Vinay Belgaumkar, Rodrigo Vivi) - Add configfs attributes to add post/mid context-switch commands (Lucas De Marchi) Cross-subsystem Changes: - Fix hmm_pfn_to_map_order() usage in gpusvm and refactor APIs to align with pieces previous handled by xe_hmm (Matthew Auld) Core Changes: - Add MEI driver for Late Binding Firmware Update/Upload (Alexander Usyskin) Driver Changes: - Fix GuC CT teardown wrt TLB invalidation (Satyanarayana) - Fix CCS save/restore on VF (Satyanarayana) - Increase default GuC crash buffer size (Zhanjun) - Allow to clear GT stats in debugfs to aid debugging (Matthew Brost) - Add more SVM GT stats to debugfs (Matthew Brost) - Fix error handling in VMA attr query (Himal) - Move sa_info in debugfs to be per tile (Michal Wajdeczko) - Limit number of retries upon receiving NO_RESPONSE_RETRY from GuC to avoid endless loop (Michal Wajdeczko) - Fix configfs handling for survivability_mode undoing user choice when unbinding the module (Michal Wajdeczko) - Refactor configfs attribute visibility to future-proof it and stop exposing survivability_mode if not applicable (Michal Wajdeczko) - Constify some functions (Harish Chegondi, Michal Wajdeczko) - Add/extend more HW workarounds for Xe2 and Xe3 (Harish Chegondi, Tangudu Tilak Tirumalesh) - Replace xe_hmm with gpusvm (Matthew Auld) - Improve fake pci and WA kunit handling for testing new platforms (Michal Wajdeczko) - Reduce unnecessary PTE writes when migrating (Sanjay Yadav) - Cleanup GuC interface definitions and log message (John Harrison) - Small improvements around VF CCS (Michal Wajdeczko) - Enable bus mastering for the I2C controller (Raag Jadav) - Prefer devm_mutex of hand rolling it (Christophe JAILLET) - Drop sysfs and debugfs attributes not available for VF (Michal Wajdeczko) - GuC CT devm actions improvements (Michal Wajdeczko) - Recommend new GuC versions for PTL and BMG (Julia Filipchuk) - Improveme driver handling for exhaustive eviction using new xe_validation wrapper around drm_exec (Thomas Hellström) - Add and use printk wrappers for tile and device (Michal Wajdeczko) - Better document workaround handling in Xe (Lucas De Marchi) - Improvements on ARRAY_SIZE and ERR_CAST usage (Lucas De Marchi, Fushuai Wang) - Align CSS firmware headers with the GuC APIs (John Harrison) - Test GuC to GuC (G2G) communication to aid debug in pre-production firmware (John Harrison) - Bail out driver probing if GuC fails to load (John Harrison) - Allow error injection in xe_pxp_exec_queue_add() (Daniele Ceraolo Spurio) - Minor refactors in xe_svm (Shuicheng Lin) - Fix madvise ioctl error handling (Shuicheng Lin) - Use attribute groups to simplify sysfs registration (Michal Wajdeczko) - Add Late Binding Firmware implementation in Xe to work together with the MEI component (Badal Nilawar, Daniele Ceraolo Spurio, Rodrigo Vivi) - Fix build with CONFIG_MODULES=n (Lucas De Marchi) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/c2et6dnkst2apsgt46dklej4nprqdukjosb55grpaknf3pvcxy@t7gtn3hqtp6n commit 473b73222f3d8cc66bcd840bf9c3260619620789 Author: Dev Jain Date: Mon Sep 8 13:20:28 2025 +0530 mm: drop all references of writable and SCAN_PAGE_RO Now that all actionable outcomes from checking pte_write() are gone, drop the related references. Link: https://lkml.kernel.org/r/20250908075028.38431-3-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Kiryl Shutsemau Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Reviewed-by: Zach O'Keefe Reviewed-by: Anshuman Khandual Cc: Baolin Wang Cc: Barry Song Cc: Hugh Dickins Cc: Liam Howlett Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit 62b98015d98815ad65ab5ca4d4077bc7c952e917 Author: Dev Jain Date: Mon Sep 8 13:20:27 2025 +0530 mm: enable khugepaged anonymous collapse on non-writable regions Patch series "Expand scope of khugepaged anonymous collapse", v2. Currently khugepaged does not collapse an anonymous region which does not have a single writable pte. This is wasteful since a region mapped with non-writable ptes, for example, non-writable VMAs mapped by the application, won't benefit from THP collapse. An additional consequence of this constraint is that MADV_COLLAPSE does not perform a collapse on a non-writable VMA, and this restriction is nowhere to be found on the manpage - the restriction itself sounds wrong to me since the user knows the protection of the memory it has mapped, so collapsing read-only memory via madvise() should be a choice of the user which shouldn't be overridden by the kernel. Therefore, remove this constraint. On an arm64 bare metal machine, comparing with vanilla 6.17-rc2, an average of 5% improvement is seen on some mmtests benchmarks, particularly hackbench, with a maximum improvement of 12%. In the following table, (I) denotes statistically significant improvement, (R) denotes statistically significant regression. +-------------------------+--------------------------------+---------------+ | mmtests/hackbench | process-pipes-1 (seconds) | -0.06% | | | process-pipes-4 (seconds) | -0.27% | | | process-pipes-7 (seconds) | (I) -12.13% | | | process-pipes-12 (seconds) | (I) -5.32% | | | process-pipes-21 (seconds) | (I) -2.87% | | | process-pipes-30 (seconds) | (I) -3.39% | | | process-pipes-48 (seconds) | (I) -5.65% | | | process-pipes-79 (seconds) | (I) -6.74% | | | process-pipes-110 (seconds) | (I) -6.26% | | | process-pipes-141 (seconds) | (I) -4.99% | | | process-pipes-172 (seconds) | (I) -4.45% | | | process-pipes-203 (seconds) | (I) -3.65% | | | process-pipes-234 (seconds) | (I) -3.45% | | | process-pipes-256 (seconds) | (I) -3.47% | | | process-sockets-1 (seconds) | 2.13% | | | process-sockets-4 (seconds) | 1.02% | | | process-sockets-7 (seconds) | -0.26% | | | process-sockets-12 (seconds) | -1.24% | | | process-sockets-21 (seconds) | 0.01% | | | process-sockets-30 (seconds) | -0.15% | | | process-sockets-48 (seconds) | 0.15% | | | process-sockets-79 (seconds) | 1.45% | | | process-sockets-110 (seconds) | -1.64% | | | process-sockets-141 (seconds) | (I) -4.27% | | | process-sockets-172 (seconds) | 0.30% | | | process-sockets-203 (seconds) | -1.71% | | | process-sockets-234 (seconds) | -1.94% | | | process-sockets-256 (seconds) | -0.71% | | | thread-pipes-1 (seconds) | 0.66% | | | thread-pipes-4 (seconds) | 1.66% | | | thread-pipes-7 (seconds) | -0.17% | | | thread-pipes-12 (seconds) | (I) -4.12% | | | thread-pipes-21 (seconds) | (I) -2.13% | | | thread-pipes-30 (seconds) | (I) -3.78% | | | thread-pipes-48 (seconds) | (I) -5.77% | | | thread-pipes-79 (seconds) | (I) -5.31% | | | thread-pipes-110 (seconds) | (I) -6.12% | | | thread-pipes-141 (seconds) | (I) -4.00% | | | thread-pipes-172 (seconds) | (I) -3.01% | | | thread-pipes-203 (seconds) | (I) -2.62% | | | thread-pipes-234 (seconds) | (I) -2.00% | | | thread-pipes-256 (seconds) | (I) -2.30% | | | thread-sockets-1 (seconds) | (R) 2.39% | +-------------------------+--------------------------------+---------------+ +-------------------------+------------------------------------------------+ | mmtests/sysbench-mutex | sysbenchmutex-1 (usec) | -0.02% | | | sysbenchmutex-4 (usec) | -0.02% | | | sysbenchmutex-7 (usec) | 0.00% | | | sysbenchmutex-12 (usec) | 0.12% | | | sysbenchmutex-21 (usec) | -0.40% | | | sysbenchmutex-30 (usec) | 0.08% | | | sysbenchmutex-48 (usec) | 2.59% | | | sysbenchmutex-79 (usec) | -0.80% | | | sysbenchmutex-110 (usec) | -3.87% | | | sysbenchmutex-128 (usec) | (I) -4.46% | +-------------------------+--------------------------------+---------------+ This patch (of 2): Currently khugepaged does not collapse an anonymous region which does not have a single writable pte. This is wasteful since a region mapped with non-writable ptes, for example, non-writable VMAs mapped by the application, won't benefit from THP collapse. An additional consequence of this constraint is that MADV_COLLAPSE does not perform a collapse on a non-writable VMA, and this restriction is nowhere to be found on the manpage - the restriction itself sounds wrong to me since the user knows the protection of the memory it has mapped, so collapsing read-only memory via madvise() should be a choice of the user which shouldn't be overridden by the kernel. Therefore, remove this restriction by not honouring SCAN_PAGE_RO. Link: https://lkml.kernel.org/r/20250908075028.38431-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20250908075028.38431-2-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: Kiryl Shutsemau Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Reviewed-by: Zach O'Keefe Reviewed-by: Anshuman Khandual Cc: Barry Song Cc: Hugh Dickins Cc: Liam Howlett Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Ryan Roberts Signed-off-by: Andrew Morton commit a983a26d52989996f7626d10833610572112e753 Author: SeongJae Park Date: Tue Sep 16 11:31:27 2025 -0700 mm/damon/stat: expose negative idle time DAMON_STAT calculates the idle time of a region using the region's age if the region's nr_accesses is zero. If the nr_accesses value is non-zero (positive), the idle time of the region becomes zero. This means the users cannot know how warm and hot data is distributed, using DAMON_STAT's memory_idle_ms_percentiles output. The other stat, namely estimated_memory_bandwidth, can help understanding how the overall access temperature of the system is, but it is still very rough information. On production systems, actually, a significant portion of the system memory is observed with zero idle time, and we cannot break it down based on its internal hotness distribution. Define the idle time of the region using its age, similar to those having zero nr_accesses, but multiples '-1' to distinguish it. And expose that using the same parameter interface, memory_idle_ms_percentiles. Link: https://lkml.kernel.org/r/20250916183127.65708-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit cc7ceb1d14b0a6f6eb83dfdfa91970f69c4c23b4 Author: SeongJae Park Date: Tue Sep 16 11:31:26 2025 -0700 mm/damon/stat: expose the current tuned aggregation interval Patch series "mm/damon/stat: expose auto-tuned intervals and non-idle ages". DAMON_STAT is intentionally providing limited information for easy consumption of the information. From production fleet level usages, below limitations are found, though. The aggregation interval of DAMON_STAT represents the granularity of the memory_idle_ms_percentiles. But the interval is auto-tuned and not exposed to users, so users cannot know the granularity. All memory regions of non-zero (positive) nr_accesses are treated as having zero idle time. A significant portion of production systems have such zero idle time. Hence breakdown of warm and hot data is nearly impossible. Make following changes to overcome the limitations. Expose the auto-tuned aggregation interval with a new parameter named aggr_interval_us. Expose the age of non-zero nr_accesses (how long >0 access frequency the region retained) regions as a negative idle time. This patch (of 2): DAMON_STAT calculates the idle time for a region as the region's age multiplied by the aggregation interval. That is, the aggregation interval is the granularity of the idle time. Since the aggregation interval is auto-tuned and not exposed to users, however, users cannot easily know in what granularity the stat is made. Expose the tuned aggregation interval in microseconds via a new parameter, aggr_interval_us. Link: https://lkml.kernel.org/r/20250916183127.65708-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250916183127.65708-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d93871f473c57ed234d4549a602163019ea5b43f Author: SeongJae Park Date: Mon Sep 15 20:35:11 2025 -0700 samples/damon/mtier: use damon_initialized() damon_sample_mtier is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 20c0ed5035fa81872a97c46d2d5beee5aab09800 Author: SeongJae Park Date: Mon Sep 15 20:35:10 2025 -0700 samples/damon/prcl: use damon_initialized() damon_sample_prcl is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 1f70367f7b6720ca0d3280b202317aa9d0167066 Author: SeongJae Park Date: Mon Sep 15 20:35:09 2025 -0700 samples/damon/wsse: use damon_initialized() damon_sample_wsse is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c4a8e662c839ac0003e4781aa324cb2d68ed9cb1 Author: SeongJae Park Date: Mon Sep 15 20:35:08 2025 -0700 mm/damon/lru_sort: use damon_initialized() DAMON_LRU_SORT is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 3f7a914ab9a5e46cf8aac7de270f02aa3f63de04 Author: SeongJae Park Date: Mon Sep 15 20:35:07 2025 -0700 mm/damon/reclaim: use damon_initialized() DAMON_RECLAIM is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit b663f17b738f4a9a9f599dff1bed8e4db519e6f8 Author: SeongJae Park Date: Mon Sep 15 20:35:06 2025 -0700 mm/damon/stat: use damon_initialized() DAMON_STAT is assuming DAMON is ready to use in module_init time, and uses its own hack to see if it is the time. Use damon_initialized(), which is a way for seeing if DAMON is ready to be used that is more reliable and better to maintain instead of the hack. Link: https://lkml.kernel.org/r/20250916033511.116366-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit ab152db3cae520154d572cff32e63de441672454 Author: SeongJae Park Date: Mon Sep 15 20:35:05 2025 -0700 mm/damon/core: implement damon_initialized() function Patch series "mm/damon: define and use DAMON initialization check function". DAMON is initialized in subsystem initialization time, by damon_init(). If DAMON API functions are called before the initialization, the system could crash. Actually such issues happened and were fixed [1] in the past. For the fix, DAMON API callers have updated to check if DAMON is initialized or not, using their own hacks. The hacks are unnecessarily duplicated on every DAMON API callers and therefore it would be difficult to reliably maintain in the long term. Make it reliable and easy to maintain. For this, implement a new DAMON core layer API function that returns if DAMON is successfully initialized. If it returns true, it means DAMON API functions are safe to be used. After the introduction of the new API, update DAMON API callers to use the new function instead of their own hacks. This patch (of 7): If DAMON is tried to be used when it is not yet successfully initialized, the caller could be crashed. DAMON core layer is not providing a reliable way to see if it is successfully initialized and therefore ready to be used, though. As a result, DAMON API callers are implementing their own hacks to see it. The hacks simply assume DAMON should be ready on module init time. It is not reliable as DAMON initialization can indeed fail if KMEM_CACHE() fails, and difficult to maintain as those are duplicates. Implement a core layer API function for better reliability and maintainability to replace the hacks with followup commits. Link: https://lkml.kernel.org/r/20250916033511.116366-2-sj@kernel.org Link: https://lkml.kernel.org/r/20250916033511.116366-2-sj@kernel.org Link: https://lore.kernel.org/20250909022238.2989-1-sj@kernel.org [1] Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 9044cbe50a708b77f0135a9325f0298ff6266853 Author: SeongJae Park Date: Mon Sep 15 20:23:39 2025 -0700 MAINTAINERS: rename DAMON section DAMON section name is 'DATA ACCESS MONITOR', which implies it is only for data access monitoring. But DAMON is now evolved for not only access monitoring but also access-aware system operations (DAMOS). Rename the section to simply DAMON. It might make it difficult to understand what it does at a glance, but at least not spreading more confusion. Readers can further refer to the documentation to better understand what really DAMON does. Link: https://lkml.kernel.org/r/20250916032339.115817-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bff3026320adad29159758f4588cffc2cf5cb4b4 Author: SeongJae Park Date: Mon Sep 15 20:23:38 2025 -0700 Docs/admin-guide/mm/damon/start: add --target_pid to DAMOS example command The example command doesn't work [1] on the latest DAMON user-space tool, since --damos_action option is updated to receive multiple arguments, and hence cannot know if the final argument is for deductible monitoring target or an argument for --damos_action option. Add --target_pid option to let damo understand it is for target pid. Link: https://lkml.kernel.org/r/20250916032339.115817-5-sj@kernel.org Link: https://github.com/damonitor/damo/pull/32 [2] Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 489c5d096e6bdae0742299861c2f6551b73a7823 Author: SeongJae Park Date: Mon Sep 15 20:23:37 2025 -0700 Docs/mm/damon/maintainer-profile: update community meetup for reservation requirements DAMON community meetup was having two different kinds of meetups: reservation required ones and unrequired ones. Now the reservation unrequested one is gone, but the documentation on the maintainer-profile is not updated. Update. Link: https://lkml.kernel.org/r/20250916032339.115817-4-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ac93e87c66fd30b6cf328591ea0f09321ab98fac Author: SeongJae Park Date: Mon Sep 15 20:23:36 2025 -0700 mm/damon/core: set effective quota on first charge window The effective quota of a scheme is initialized zero, which means there is no quota. It is set based on user-specified time/quota/quota goals. But the later value set is done only from the second charge window. As a result, a scheme having a user-specified quota can work as not having the quota (unexpectedly fast) for the first charge window. In practical and common use cases the quota interval is not too long, and the scheme's target access pattern is restrictive. Hence the issue should be modest. That said, it is apparently an unintended misbehavior. Fix the problem by setting esz on the first charge window. Link: https://lkml.kernel.org/r/20250916032339.115817-3-sj@kernel.org Fixes: 1cd243030059 ("mm/damon/schemes: implement time quota") # 5.16.x Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2a05df14b3ad921ff2fcc6cc535cb153cbf38c87 Author: SeongJae Park Date: Mon Sep 15 20:23:35 2025 -0700 mm/damon/core: reset age if nr_accesses changes between non-zero and zero Patch series "mm/damon: misc fixups and improvements for 6.18", v2. Misc fixes and improvements for DAMON that are not critical and therefore aims to be merged into Linux 6.18-rc1. The first patch improves DAMON's age counting for nr_accesses zero to/from non-zero changes. The second patch fixes an initial DAMOS apply interval delay issue that is not realistic but still could happen on an odd setup. The third and the fourth patches update DAMON community meetup description and DAMON user-space tool example command for DAMOS usage, respectively. Finally, the fifth patch updates MAINTAINERS section name for DAMON to just DAMON. This patch (of 5): DAMON resets the age of a region if its nr_accesses value has significantly changed. Specifically, the threshold is calculated as 20% of largest nr_accesses of the current snapshot. This means that regions changing the nr_accesses from zero to small non-zero value or from a small non-zero value to zero will keep the age. Since many users treat zero nr_accesses regions special, this can be confusing. Kernel code including DAMOS' regions priority calculation and DAMON_STAT's idle time calculation also treat zero nr_accesses regions special. Make it unconfusing by resetting the age when the nr_accesses changes between zero and a non-zero value. Link: https://lkml.kernel.org/r/20250916032339.115817-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250916032339.115817-2-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b9e2f58ffb84afcbba7e66f96ca14f98e0e88f26 Author: Suren Baghdasaryan Date: Mon Sep 15 16:02:24 2025 -0700 alloc_tag: mark inaccurate allocation counters in /proc/allocinfo output While rare, memory allocation profiling can contain inaccurate counters if slab object extension vector allocation fails. That allocation might succeed later but prior to that, slab allocations that would have used that object extension vector will not be accounted for. To indicate incorrect counters, "accurate:no" marker is appended to the call site line in the /proc/allocinfo output. Bump up /proc/allocinfo version to reflect the change in the file format and update documentation. Example output with invalid counters: allocinfo - version: 2.0 0 0 arch/x86/kernel/kdebugfs.c:105 func:create_setup_data_nodes 0 0 arch/x86/kernel/alternative.c:2090 func:alternatives_smp_module_add 0 0 arch/x86/kernel/alternative.c:127 func:__its_alloc accurate:no 0 0 arch/x86/kernel/fpu/regset.c:160 func:xstateregs_set 0 0 arch/x86/kernel/fpu/xstate.c:1590 func:fpstate_realloc 0 0 arch/x86/kernel/cpu/aperfmperf.c:379 func:arch_enable_hybrid_capacity_scale 0 0 arch/x86/kernel/cpu/amd_cache_disable.c:258 func:init_amd_l3_attrs 49152 48 arch/x86/kernel/cpu/mce/core.c:2709 func:mce_device_create accurate:no 32768 1 arch/x86/kernel/cpu/mce/genpool.c:132 func:mce_gen_pool_create 0 0 arch/x86/kernel/cpu/mce/amd.c:1341 func:mce_threshold_create_device [surenb@google.com: document new "accurate:no" marker] Fixes: 39d117e04d15 ("alloc_tag: mark inaccurate allocation counters in /proc/allocinfo output") [akpm@linux-foundation.org: simplification per Usama, reflow text] [akpm@linux-foundation.org: add newline to prevent docs warning, per Randy] Link: https://lkml.kernel.org/r/20250915230224.4115531-1-surenb@google.com Signed-off-by: Suren Baghdasaryan Suggested-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Usama Arif Acked-by: Johannes Weiner Cc: David Rientjes Cc: David Wang <00107082@163.com> Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Roman Gushchin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5e1953dc71af01fae3d6786e073892ef3eebc3d8 Author: zhongjinji Date: Tue Sep 16 00:29:46 2025 +0800 mm/oom_kill: the OOM reaper traverses the VMA maple tree in reverse order Although the oom_reaper is delayed and it gives the oom victim chance to clean up its address space this might take a while especially for processes with a large address space footprint. In those cases oom_reaper might start racing with the dying task and compete for shared resources - e.g. page table lock contention has been observed. Reduce those races by reaping the oom victim from the other end of the address space. It is also a significant improvement for process_mrelease(). When a process is killed, process_mrelease is used to reap the killed process and often runs concurrently with the dying task. The test data shows that after applying the patch, lock contention is greatly reduced during the procedure of reaping the killed process. The test is conducted on arm64. The following basic perf numbers show that applying this patch significantly reduces pte spin lock contention. Without the patch: |--99.57%-- oom_reaper | |--73.58%-- unmap_page_range | | |--8.67%-- [hit in function] | | |--41.59%-- __pte_offset_map_lock | | |--29.47%-- folio_remove_rmap_ptes | | |--16.11%-- tlb_flush_mmu | |--19.94%-- tlb_finish_mmu | |--3.21%-- folio_remove_rmap_ptes With the patch: |--99.53%-- oom_reaper | |--55.77%-- unmap_page_range | | |--20.49%-- [hit in function] | | |--58.30%-- folio_remove_rmap_ptes | | |--11.48%-- tlb_flush_mmu | | |--3.33%-- folio_mark_accessed | |--32.21%-- tlb_finish_mmu | |--6.93%-- folio_remove_rmap_ptes | |--0.69%-- __pte_offset_map_lock Detailed breakdowns for both scenarios are provided below. The cumulative time for oom_reaper plus exit_mmap(victim) in both cases is also summarized, making the performance improvements clear. +----------------------------------------------------------------+ | Category | Applying patch | Without patch | +-------------------------------+----------------+---------------+ | Total running time | 132.6 | 167.1 | | (exit_mmap + reaper work) | 72.4 + 60.2 | 90.7 + 76.4 | +-------------------------------+----------------+---------------+ | Time waiting for pte spinlock | 1.0 | 33.1 | | (exit_mmap + reaper work) | 0.4 + 0.6 | 10.0 + 23.1 | +-------------------------------+----------------+---------------+ | folio_remove_rmap_ptes time | 42.0 | 41.3 | | (exit_mmap + reaper work) | 18.4 + 23.6 | 22.4 + 18.9 | +----------------------------------------------------------------+ From this report, we can see that: 1. The reduction in total time comes mainly from the decrease in time spent on pte spinlock and other locks. 2. oom_reaper performs more work in some areas, but at the same time, exit_mmap also handles certain tasks more efficiently, such as folio_remove_rmap_ptes. Here is a more detailed perf report. [1] Link: https://lkml.kernel.org/r/20250915162946.5515-3-zhongjinji@honor.com Link: https://lore.kernel.org/all/20250915162619.5133-1-zhongjinji@honor.com/ [1] Signed-off-by: zhongjinji Reviewed-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Acked-by: Shakeel Butt Acked-by: Michal Hocko Cc: David Rientjes Cc: Len Brown Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 59d4d36158ba3cdbce141d8e9261eea154d4c441 Author: zhongjinji Date: Tue Sep 16 00:29:45 2025 +0800 mm/oom_kill: thaw the entire OOM victim process Patch series "Improvements to Victim Process Thawing and OOM Reaper Traversal Order", v10. This patch series focuses on optimizing victim process thawing and refining the traversal order of the OOM reaper. Since __thaw_task() is used to thaw a single thread of the victim, thawing only one thread cannot guarantee the exit of the OOM victim when it is frozen. Patch 1 thaw the entire process of the OOM victim to ensure that OOM victims are able to terminate themselves. Even if the oom_reaper is delayed, patch 2 is still beneficial for reaping processes with a large address space footprint, and it also greatly improves process_mrelease. This patch (of 10): OOM killer is a mechanism that selects and kills processes when the system runs out of memory to reclaim resources and keep the system stable. But the oom victim cannot terminate on its own when it is frozen, even if the OOM victim task is thawed through __thaw_task(). This is because __thaw_task() can only thaw a single OOM victim thread, and cannot thaw the entire OOM victim process. In addition, freezing_slow_path() determines whether a task is an OOM victim by checking the task's TIF_MEMDIE flag. When a task is identified as an OOM victim, the freezer bypasses both PM freezing and cgroup freezing states to thaw it. Historically, TIF_MEMDIE was a "this is the oom victim & it has access to memory reserves" flag in the past. It has that thread vs. process problems and tsk_is_oom_victim was introduced later to get rid of them and other issues as well as the guarantee that we can identify the oom victim's mm reliably for other oom_reaper. Therefore, thaw_process() is introduced to unfreeze all threads within the OOM victim process, ensuring that every thread is properly thawed. The freezer now uses tsk_is_oom_victim() to determine OOM victim status, allowing all victim threads to be unfrozen as necessary. With this change, the entire OOM victim process will be thawed when an OOM event occurs, ensuring that the victim can terminate on its own. Link: https://lkml.kernel.org/r/20250915162946.5515-1-zhongjinji@honor.com Link: https://lkml.kernel.org/r/20250915162946.5515-2-zhongjinji@honor.com Signed-off-by: zhongjinji Reviewed-by: Suren Baghdasaryan Acked-by: Shakeel Butt Acked-by: Michal Hocko Acked-by: Liam R. Howlett Cc: David Rientjes Cc: Len Brown Cc: Lorenzo Stoakes Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit d02ac836e4d6bdfd7d44927d01a4cd048ad4aba8 Author: Andrew Morton Date: Sat Sep 13 17:03:39 2025 -0700 include/linux/pgtable.h: convert arch_enter_lazy_mmu_mode() and friends to static inlines For all the usual reasons, plus a new one. Calling (void)arch_enter_lazy_mmu_mode(); deservedly blows up. Cc: Balbir Singh Signed-off-by: Andrew Morton commit e18190b7e97e9db6546390e6e0ceddae606892b2 Author: SeongJae Park Date: Mon Sep 15 20:15:49 2025 -0700 mm/damon/lru_sort: use param_ctx for damon_attrs staging damon_lru_sort_apply_parameters() allocates a new DAMON context, stages user-specified DAMON parameters on it, and commits to running DAMON context at once, using damon_commit_ctx(). The code is, however, directly updating the monitoring attributes of the running context. And the attributes are over-written by later damon_commit_ctx() call. This means that the monitoring attributes parameters are not really working. Fix the wrong use of the parameter context. Link: https://lkml.kernel.org/r/20250916031549.115326-1-sj@kernel.org Fixes: a30969436428 ("mm/damon/lru_sort: use damon_commit_ctx()") Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: Joshua Hahn Cc: [6.11+] Signed-off-by: Andrew Morton commit e75f15fb69610cf90e9dfa0cbe436ae9342b9b79 Author: Muhammad Usama Anjum Date: Fri Sep 12 17:30:22 2025 +0500 selftests/mm: protection_keys: fix dead code The while loop doesn't execute and following warning gets generated: protection_keys.c:561:15: warning: code will never be executed [-Wunreachable-code] int rpkey = alloc_random_pkey(); Let's enable the while loop such that it gets executed nr_iterations times. Simplify the code a bit as well. Link: https://lkml.kernel.org/r/20250912123025.1271051-3-usama.anjum@collabora.com Signed-off-by: Muhammad Usama Anjum Reviewed-by: Sidhartha Kumar Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3d5022a0f82442e03f84e17a134c7ad8b14d6628 Author: Muhammad Usama Anjum Date: Fri Sep 12 17:30:21 2025 +0500 selftests/mm: add -Wunreachable-code and fix warnings Patch series "selftests/mm: Add -Wunreachable-code and fix warnings". Add -Wunreachable-code to selftests and remove dead code from generated warnings. This patch (of 2): Enable -Wunreachable-code flag to catch dead code and fix them. 1. Remove the dead code and write a comment instead: hmm-tests.c:2033:3: warning: code will never be executed [-Wunreachable-code] perror("Should not reach this\n"); ^~~~~~ 2. ksft_exit_fail_msg() calls exit(). So cleanup isn't done. Replace it with ksft_print_msg(). split_huge_page_test.c:301:3: warning: code will never be executed [-Wunreachable-code] goto cleanup; ^~~~~~~~~~~~ 3. Remove duplicate inline. pkey_sighandler_tests.c:44:15: warning: duplicate 'inline' declaration specifier [-Wduplicate-decl-specifier] static inline __always_inline Link: https://lkml.kernel.org/r/20250912123025.1271051-1-usama.anjum@collabora.com Link: https://lkml.kernel.org/r/20250912123025.1271051-2-usama.anjum@collabora.com Signed-off-by: Muhammad Usama Anjum Reviewed-by: Sidhartha Kumar Reviewed-by: Kevin Brodsky Acked-by: David Hildenbrand Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jason Gunthorpe Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit eea5706cb04216214bcd269a27afbc479c71bceb Author: Sumanth Korikkar Date: Fri Sep 12 14:30:21 2025 +0200 resource: improve child resource handling in release_mem_region_adjustable() When memory block is removed via try_remove_memory(), it eventually reaches release_mem_region_adjustable(). The current implementation assumes that when a busy memory resource is split into two, all child resources remain in the lower address range. This simplification causes problems when child resources actually belong to the upper split. For example: * Initial memory layout: lsmem RANGE SIZE STATE REMOVABLE BLOCK 0x0000000000000000-0x00000002ffffffff 12G online yes 0-95 * /proc/iomem 00000000-2dfefffff : System RAM 158834000-1597b3fff : Kernel code 1597b4000-159f50fff : Kernel data 15a13c000-15a218fff : Kernel bss 2dff00000-2ffefffff : Crash kernel 2fff00000-2ffffffff : System RAM * After offlining and removing range 0x150000000-0x157ffffff lsmem -o RANGE,SIZE,STATE,BLOCK,CONFIGURED (output according to upcoming lsmem changes with the configured column: s390) RANGE SIZE STATE BLOCK CONFIGURED 0x0000000000000000-0x000000014fffffff 5.3G online 0-41 yes 0x0000000150000000-0x0000000157ffffff 128M offline 42 no 0x0000000158000000-0x00000002ffffffff 6.6G online 43-95 yes The iomem resource gets split into two entries, but kernel code, kernel data, and kernel bss remain attached to the lower resource [0–5376M] instead of the correct upper resource [5504M–12288M]. As a result, WARN_ON() triggers in release_mem_region_adjustable() ("Usecase: split into two entries - we need a new resource") ------------[ cut here ]------------ WARNING: CPU: 5 PID: 858 at kernel/resource.c:1486 release_mem_region_adjustable+0x210/0x280 Modules linked in: CPU: 5 UID: 0 PID: 858 Comm: chmem Not tainted 6.17.0-rc2-11707-g2c36aaf3ba4e Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) Krnl PSW : 0704d00180000000 0000024ec0dae0e4 (release_mem_region_adjustable+0x214/0x280) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 00000002ffffafc0 fffffffffffffff0 0000000000000000 000000014fffffff 0000024ec2257608 0000000000000000 0000024ec2301758 0000024ec22680d0 00000000902c9140 0000000150000000 00000002ffffafc0 000003ffa61d8d18 0000024ec21fb478 0000024ec0dae014 000001cec194fbb0 Krnl Code: 0000024ec0dae0d8: af000000 mc 0,0 0000024ec0dae0dc: a7f4ffc1 brc 15,0000024ec0dae05e #0000024ec0dae0e0: af000000 mc 0,0 >0000024ec0dae0e4: a5defffd llilh %r13,65533 0000024ec0dae0e8: c04000c6064c larl %r4,0000024ec266ed80 0000024ec0dae0ee: eb1d400000f8 laa %r1,%r13,0(%r4) 0000024ec0dae0f4: 07e0 bcr 14,%r0 0000024ec0dae0f6: a7f4ffc0 brc 15,0000024ec0dae076 [<0000024ec0dae0e4>] release_mem_region_adjustable+0x214/0x280 ([<0000024ec0dadf3c>] release_mem_region_adjustable+0x6c/0x280) [<0000024ec10a2130>] try_remove_memory+0x100/0x140 [<0000024ec10a4052>] __remove_memory+0x22/0x40 [<0000024ec18890f6>] config_mblock_store+0x326/0x3e0 [<0000024ec11f7056>] kernfs_fop_write_iter+0x136/0x210 [<0000024ec1121e86>] vfs_write+0x236/0x3c0 [<0000024ec11221b8>] ksys_write+0x78/0x110 [<0000024ec1b6bfbe>] __do_syscall+0x12e/0x350 [<0000024ec1b782ce>] system_call+0x6e/0x90 Last Breaking-Event-Address: [<0000024ec0dae014>] release_mem_region_adjustable+0x144/0x280 ---[ end trace 0000000000000000 ]--- Also, resource adjustment doesn't happen and stale resources still cover [0-12288M]. Later, memory re-add fails in register_memory_resource() with -EBUSY. i.e: /proc/iomem is still: 00000000-2dfefffff : System RAM 158834000-1597b3fff : Kernel code 1597b4000-159f50fff : Kernel data 15a13c000-15a218fff : Kernel bss 2dff00000-2ffefffff : Crash kernel 2fff00000-2ffffffff : System RAM Enhance release_mem_region_adjustable() to reassign child resources to the correct parent after a split. Children are now assigned based on their actual range: If they fall within the lower split, keep them in the lower parent. If they fall within the upper split, move them to the upper parent. Kernel code/data/bss regions are not offlined, so they will always reside entirely within one parent and never span across both. Output after the enhancement: * Initial state /proc/iomem (before removal of memory block): 00000000-2dfefffff : System RAM 1f94f8000-1fa477fff : Kernel code 1fa478000-1fac14fff : Kernel data 1fae00000-1faedcfff : Kernel bss 2dff00000-2ffefffff : Crash kernel 2fff00000-2ffffffff : System RAM * Offline and remove 0x1e8000000-0x1efffffff memory range * /proc/iomem 00000000-1e7ffffff : System RAM 1f0000000-2dfefffff : System RAM 1f94f8000-1fa477fff : Kernel code 1fa478000-1fac14fff : Kernel data 1fae00000-1faedcfff : Kernel bss 2dff00000-2ffefffff : Crash kernel 2fff00000-2ffffffff : System RAM Link: https://lkml.kernel.org/r/20250912123021.3219980-1-sumanthk@linux.ibm.com Signed-off-by: Sumanth Korikkar Cc: Alexander Gordeev Cc: Andriy Shevchenko Cc: Dan Williams Cc: David Hildenbrand Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 5ea8ab7f93139c63626830b48b36aab4e62b3f8f Author: Muhammad Usama Anjum Date: Fri Sep 12 17:51:01 2025 +0500 selftests/mm: centralize the __always_unused macro This macro gets used in different tests. Add it to kselftest.h which is central location and tests use this header. Then use this new macro. Link: https://lkml.kernel.org/r/20250912125102.1309796-1-usama.anjum@collabora.com Signed-off-by: Muhammad Usama Anjum Acked-by: David Hildenbrand Cc: Antonio Quartulli Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kacinski Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Paolo Abeni Cc: "Sabrina Dubroca" Cc: Shuah Khan Cc: Simon Horman Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7db551fcfb2aa8a20740406d41b48fd4365fd17f Author: Quanmin Yan Date: Wed Sep 10 19:32:21 2025 +0800 mm/damon/reclaim: support addr_unit for DAMON_RECLAIM Implement a sysfs file to expose addr_unit for DAMON_RECLAIM users. During parameter application, use the configured addr_unit parameter to perform the necessary initialization. Similar to the core layer, prevent setting addr_unit to zero. It is worth noting that when monitor_region_start and monitor_region_end are unset (i.e., 0), their values will later be set to biggest_system_ram. At that point, addr_unit may not be the default value 1. Although we could divide the biggest_system_ram value by addr_unit, changing addr_unit without setting monitor_region_start/end should be considered a user misoperation. And biggest_system_ram is only within the 0~ULONG_MAX range, system can clearly work correctly with addr_unit=1. Therefore, if monitor_region_start/end are unset, always silently reset addr_unit to 1. Link: https://lkml.kernel.org/r/20250910113221.1065764-3-yanquanmin1@huawei.com Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit 2e0fe9245d6bcfc689961d58b43216adaece3182 Author: Quanmin Yan Date: Wed Sep 10 19:32:20 2025 +0800 mm/damon/lru_sort: support addr_unit for DAMON_LRU_SORT Patch series "mm/damon: add addr_unit for DAMON_LRU_SORT and DAMON_RECLAIM". In DAMON_LRU_SORT and DAMON_RECLAIM, damon_ctx is independent of the core. Add addr_unit to these modules to support systems like ARM32 with LPAE. This patch (of 2): Implement a sysfs file to expose addr_unit for DAMON_LRU_SORT users. During parameter application, use the configured addr_unit parameter to perform the necessary initialization. Similar to the core layer, prevent setting addr_unit to zero. It is worth noting that when monitor_region_start and monitor_region_end are unset (i.e., 0), their values will later be set to biggest_system_ram. At that point, addr_unit may not be the default value 1. Although we could divide the biggest_system_ram value by addr_unit, changing addr_unit without setting monitor_region_start/end should be considered a user misoperation. And biggest_system_ram is only within the 0~ULONG_MAX range, system can clearly work correctly with addr_unit=1. Therefore, if monitor_region_start/end are unset, always silently reset addr_unit to 1. Link: https://lkml.kernel.org/r/20250910113221.1065764-1-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20250910113221.1065764-2-yanquanmin1@huawei.com Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit a5883fa94295f1ef2473eadd84cc1e24dab9ae18 Author: David Hildenbrand Date: Wed Sep 10 11:30:51 2025 +0200 selftests/mm: gup_tests: option to GUP all pages in a single call We recently missed detecting an issue during early testing because the default (!all) tests would not trigger it and even when running "all" tests it only would happen sometimes because of races. So let's allow for an easy way to specify "GUP all pages in a single call", extend the test matrix and extend our default (!all) tests. By GUP'ing all pages in a single call, with the default size of 128MiB we'll cover multiple leaf page tables / PMDs on architectures with sane THP sizes. Link: https://lkml.kernel.org/r/20250910093051.1693097-1-david@redhat.com Signed-off-by: David Hildenbrand Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9d003dec972563efb8ce14c9962af3652d0e201d Author: Matthew Wilcox (Oracle) Date: Wed Sep 10 15:29:19 2025 +0100 mm: remove page->order We already use page->private for storing the order of a page while it's in the buddy allocator system; extend that to also storing the order while it's in the pcp_llist. Link: https://lkml.kernel.org/r/20250910142923.2465470-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Alexei Starovoitov Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton commit 6fd893a40e3c990ea4ca3a9c084d1ddc3020d936 Author: Matthew Wilcox (Oracle) Date: Wed Sep 10 15:29:18 2025 +0100 mm: remove redundant test in validate_page_before_insert() The page_has_type() call would have included slab since commit 46df8e73a4a3 and now we don't even get that far because slab pages have a zero refcount since commit 9aec2fb0fd5e. Link: https://lkml.kernel.org/r/20250910142923.2465470-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton commit 3a37469e5ac004905e4125bf60b43cc5216e83dc Author: Matthew Wilcox (Oracle) Date: Wed Sep 10 15:29:17 2025 +0100 mm: constify compound_order() and page_size() Patch series "Small cleanups". These small cleanups can be applied now to reduce conflicts during the next merge window. They're all from various efforts to split struct page from other memdescs. Thanks to Vlastimil for the suggestion. This patch (of 3): These functions do not modify their arguments. Telling the compiler this may improve code generation, and allows us to pass const arguments from other functions. Link: https://lkml.kernel.org/r/20250910142923.2465470-1-willy@infradead.org Link: https://lkml.kernel.org/r/20250910142923.2465470-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton commit b33939383b6439cb90cebf8df301cd2cbed0b980 Author: Hugh Dickins Date: Mon Sep 8 15:24:54 2025 -0700 mm: lru_add_drain_all() do local lru_add_drain() first No numbers to back this up, but it seemed obvious to me, that if there are competing lru_add_drain_all()ers, the work will be minimized if each flushes its own local queues before locking and doing cross-CPU drains. Link: https://lkml.kernel.org/r/33389bf8-f79d-d4dd-b7a4-680c4aa21b23@google.com Signed-off-by: Hugh Dickins Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Signed-off-by: Andrew Morton commit fa17bcd5f65ed702df001579cca8c885fa6bf3e7 Author: Aristeu Rozanski Date: Tue Aug 26 11:37:21 2025 -0400 mm: make folio page count functions return unsigned As raised by Andrew [1], a folio/compound page never spans a negative number of pages. Consequently, let's use "unsigned long" instead of "long" consistently for folio_nr_pages(), folio_large_nr_pages() and compound_nr(). Using "unsigned long" as return value is fine, because even "(long)-folio_nr_pages()" will keep on working as expected. Using "unsigned int" instead would actually break these use cases. This patch takes the first step changing these to return unsigned long (and making drm_gem_get_pages() use the new types instead of replacing min()). In the future, we might want to make more callers of these functions to consistently use "unsigned long". Link: https://lore.kernel.org/linux-mm/20250503182858.5a02729fcffd6d4723afcfc2@linux-foundation.org/ Link: https://lkml.kernel.org/r/20250826153721.GA23292@cathedrallabs.org Link: https://lore.kernel.org/linux-mm/20250503182858.5a02729fcffd6d4723afcfc2@linux-foundation.org/ [1] Signed-off-by: Aristeu Rozanski Suggested-by: Andrew Morton Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 9b375adb398493f096d776721caac8fe26bfb2b7 Author: Zach O'Keefe Date: Tue Sep 9 12:05:34 2025 -0700 selftests/mm: remove PROT_EXEC req from file-collapse tests As of v6.8 commit 7fbb5e188248 ("mm: remove VM_EXEC requirement for THP eligibility") thp collapse no longer requires file-backed mappings be created with PROT_EXEC. Remove the overly-strict dependency from thp collapse tests so we test the least-strict requirement for success. Link: https://lkml.kernel.org/r/20250909190534.512801-1-zokeefe@google.com Signed-off-by: Zach O'Keefe Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Reviewed-by: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Shuah Khan Cc: Zi Yan Signed-off-by: Andrew Morton commit 032c31127f27acb1b8152b512830ecef04ed2ebc Author: Brian Norris Date: Tue Sep 9 13:13:57 2025 -0700 mm: vm_event_item: explicit #include for THREAD_SIZE This header uses THREAD_SIZE, which is provided by the thread_info.h header but is not included in this header. Depending on the #include ordering in other files, this can produce preprocessor errors. Link: https://lkml.kernel.org/r/20250909201419.827638-1-briannorris@chromium.org Signed-off-by: Brian Norris Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7ffc923e252ca89e58228adbdc500a9fdea43c38 Author: Suren Baghdasaryan Date: Mon Sep 15 14:27:56 2025 -0700 alloc_tag: avoid warnings when freeing non-compound "tail" pages When freeing "tail" pages of a non-compount high-order page, we properly subtract the allocation tag counters, however later when these pages are released, alloc_tag_sub() will issue warnings because tags for these pages are NULL. This issue was originally anticipated by Vlastimil in his review [1] and then recently reported by David. Prevent warnings by marking the tags empty. Link: https://lkml.kernel.org/r/20250915212756.3998938-4-surenb@google.com Link: https://lore.kernel.org/all/6db0f0c8-81cb-4d04-9560-ba73d63db4b8@suse.cz/ [1] Signed-off-by: Suren Baghdasaryan Suggested-by: David Wang <00107082@163.com> Acked-by: Shakeel Butt Acked-by: Usama Arif Cc: Johannes Weiner Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9e8a0bbb128ec9379ce271ccecdfb022c483da0b Author: Suren Baghdasaryan Date: Mon Sep 15 14:27:55 2025 -0700 alloc_tag: prevent enabling memory profiling if it was shut down Memory profiling can be shut down due to reasons like a failure during initialization. When this happens, the user should not be able to re-enable it. Current sysctrl interface does not handle this properly and will allow re-enabling memory profiling. Fix this by checking for this condition during sysctrl write operation. Link: https://lkml.kernel.org/r/20250915212756.3998938-3-surenb@google.com Signed-off-by: Suren Baghdasaryan Acked-by: Shakeel Butt Acked-by: Usama Arif Cc: David Wang <00107082@163.com> Cc: Johannes Weiner Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 123bcf284205b2513c4172c50da8d193f8f8ab3d Author: Suren Baghdasaryan Date: Mon Sep 15 14:27:54 2025 -0700 alloc_tag: use release_pages() in the cleanup path Patch series "Minor fixes for memory allocation profiling", v2. Over the last couple months I gathered a few reports of minor issues in memory allocation profiling which are addressed in this patchset. This patch (of 2): When bulk-freeing an array of pages use release_pages() instead of freeing them page-by-page. Link: https://lkml.kernel.org/r/20250915212756.3998938-1-surenb@google.com Link: https://lkml.kernel.org/r/20250915212756.3998938-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Suggested-by: Andrew Morton Suggested-by: Usama Arif Acked-by: Shakeel Butt Acked-by: Usama Arif Cc: David Wang <00107082@163.com> Cc: Johannes Weiner Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5919f1282141f29345432a4f1dadf34716f3dbec Author: Jackie Liu Date: Mon Sep 8 14:26:14 2025 +0800 mm/shmem: remove unused entry_order after large swapin rework After commit 93c0476e7057 ("mm/shmem, swap: rework swap entry and index calculation for large swapin"), xas_get_order() will never return a non-zero value for `entry_order` in shmem_split_large_entry(). As a result, the local variable `entry_order` is effectively unused. Clean up the code by removing `entry_order` and directly using `cur_order`. This change is purely a refactor and has no functional impact. No functional change intended. Link: https://lkml.kernel.org/r/20250908062614.89880-1-liu.yun@linux.dev Signed-off-by: Jackie Liu Reviewed-by: Baolin Wang Cc: Hugh Dickins Cc: Kairui Song Signed-off-by: Andrew Morton commit 6ce3bc990cf0cc1ea1bfcae7149e095afd898d41 Author: Lance Yang Date: Mon Sep 8 17:07:41 2025 +0800 mm: skip mlocked THPs that are underused early in deferred_split_scan() When we stumble over a fully-mapped mlocked THP in the deferred shrinker, it does not make sense to try to detect whether it is underused, because try_to_map_unused_to_zeropage(), called while splitting the folio, will not actually replace any zeroed pages by the shared zeropage. Splitting the folio in that case does not make any sense, so let's not even scan to check if the folio is underused. Link: https://lkml.kernel.org/r/20250908090741.61519-1-lance.yang@linux.dev Signed-off-by: Lance Yang Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Usama Arif Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Zi Yan Cc: Kiryl Shutsemau Signed-off-by: Andrew Morton commit 10b9feee2d0dc81c44f7a9e69e7a894e33f8c4a1 Author: Francois Dugast Date: Mon Sep 8 11:10:52 2025 +0200 mm/hmm: populate PFNs from PMD swap entry Once support for THP migration of zone device pages is enabled, device private swap entries will be found during the walk not only for PTEs but also for PMDs. Therefore, it is necessary to extend to PMDs the special handling which is already in place for PTEs when device private pages are owned by the caller: instead of faulting or skipping the range, the correct behavior is to use the swap entry to populate HMM PFNs. This change is a prerequisite to make use of device-private THP in drivers using drivers/gpu/drm/drm_pagemap, such as xe. Even though subsequent PFNs can be inferred when handling large order PFNs, the PFN list is still fully populated because this is currently expected by HMM users. In case this changes in the future, that is all HMM users support a sparsely populated PFN list, the for() loop can be made to skip remaining PFNs for the current order. A quick test shows the loop takes about 10 ns, roughly 20 times faster than without this optimization. Link: https://lkml.kernel.org/r/20250908091052.612303-1-francois.dugast@intel.com Signed-off-by: Francois Dugast Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Zi Yan Cc: Alistair Popple Cc: Balbir Singh Cc: David Airlie Cc: Christian König Cc: Mika Penttilä Cc: Thomas Hellstrom Cc: Matthew Brost Signed-off-by: Andrew Morton commit 7cad96ae59b334a80b6e48c396f147a6c810c9ea Author: David Hildenbrand Date: Mon Sep 8 11:45:17 2025 +0200 mm/gup: fix handling of errors from arch_make_folio_accessible() in follow_page_pte() In case we call arch_make_folio_accessible() and it fails, we would incorrectly return a value that is "!= 0" to the caller, indicating that we pinned all requested pages and that the caller can keep going. follow_page_pte() is not supposed to return error values, but instead "0" on failure and "1" on success -- we'll clean that up separately. In case we return "!= 0", the caller will just keep going pinning more pages. If we happen to pin a page afterwards, we're in trouble, because we essentially skipped some pages in the requested range. Staring at the arch_make_folio_accessible() implementation on s390x, I assume it should actually never really fail unless something unexpected happens (BUG?). So let's not CC stable and just fix common code to do the right thing. Clean up the code a bit now that there is no reason to store the return value of arch_make_folio_accessible(). Link: https://lkml.kernel.org/r/20250908094517.303409-1-david@redhat.com Fixes: f28d43636d6f ("mm/gup/writeback: add callbacks for inaccessible pages") Signed-off-by: David Hildenbrand Reviewed-by: Claudio Imbrenda Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Cc: Christian Borntraeger Signed-off-by: Andrew Morton commit e7a5f249e6db3b41a4618763e0f840639f3578f4 Author: Chanwon Park Date: Mon Sep 8 19:04:10 2025 +0900 mm: re-enable kswapd when memory pressure subsides or demotion is toggled If kswapd fails to reclaim pages from a node MAX_RECLAIM_RETRIES in a row, kswapd on that node gets disabled. That is, the system won't wakeup kswapd for that node until page reclamation is observed at least once. That reclamation is mostly done by direct reclaim, which in turn enables kswapd back. However, on systems with CXL memory nodes, workloads with high anon page usage can disable kswapd indefinitely, without triggering direct reclaim. This can be reproduced with following steps: numa node 0 (32GB memory, 48 CPUs) numa node 2~5 (512GB CXL memory, 128GB each) (numa node 1 is disabled) swap space 8GB 1) Set /sys/kernel/mm/demotion_enabled to 0. 2) Set /proc/sys/kernel/numa_balancing to 0. 3) Run a process that allocates and random accesses 500GB of anon pages. 4) Let the process exit normally. During 3), free memory on node 0 gets lower than low watermark, and kswapd runs and depletes swap space. Then, kswapd fails consecutively and gets disabled. Allocation afterwards happens on CXL memory, so node 0 never gains more memory pressure to trigger direct reclaim. After 4), kswapd on node 0 remains disabled, and tasks running on that node are unable to swap. If you turn on NUMA_BALANCING_MEMORY_TIERING and demotion now, it won't work properly since kswapd is disabled. To mitigate this problem, reset kswapd_failures to 0 on following conditions: a) ZONE_BELOW_HIGH bit of a zone in hopeless node with a fallback memory node gets cleared. b) demotion_enabled is changed from false to true. Rationale for a): ZONE_BELOW_HIGH bit being cleared might be a sign that the node may be reclaimable afterwards. This won't help much if the memory-hungry process keeps running without freeing anything, but at least the node will go back to reclaimable state when the process exits. Rationale for b): When demotion_enabled is false, kswapd can only reclaim anon pages by swapping them out to swap space. If demotion_enabled is turned on, kswapd can demote anon pages to another node for reclaiming. So, the original failure count for determining reclaimability is no longer valid. Since kswapd_failures resets may be missed by ++ operation, it is changed from int to atomic_t. [akpm@linux-foundation.org: tweak whitespace] Link: https://lkml.kernel.org/r/aL6qGi69jWXfPc4D@pcw-MS-7D22 Signed-off-by: Chanwon Park Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit c56325259abc026205c98964616dcc0df5648912 Author: Chunyu Hu Date: Fri Sep 12 09:37:11 2025 +0800 selftests/mm: fix va_high_addr_switch.sh failure on x86_64 The test will fail as below on x86_64 with cpu la57 support (will skip if no la57 support). Note, the test requries nr_hugepages to be set first. # running bash ./va_high_addr_switch.sh # ------------------------------------- # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK # mmap(NULL): 0x7f55b60f9000 - OK # mmap(low_addr): 0x40000000 - OK # mmap(high_addr): 0x1000000000000 - OK # mmap(high_addr) again: 0xffff55b6136000 - OK # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK # mmap(-1): 0xffff55b6134000 - OK # mmap(-1) again: 0xffff55b6132000 - OK # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK # [FAIL] addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit. Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch code arch/x86/mm/hugetlbpage.c and addr is checked with map_address_hint_valid() after align with 'addr &= huge_page_mask(h)' which is a round down way, and it will fail the check because the addr is within the DEFAULT_MAP_WINDOW but (addr + len) is above the DFEFAULT_MAP_WINDOW. So it wil go through the hugetlb_get_unmmaped_area_top_down() to find an area within the DFEFAULT_MAP_WINDOW. After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions"). The addr hint for hugetlb_get_unmmaped_area() will be rounded up and aligned to hugepage size with ALIGN() for all arches. And after the align, the addr will be above the default MAP_DEFAULT_WINDOW, and the map_addresshint_valid() check will pass because both aligned addr (addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned hint address (0x800000000000) is returned as an suitable gap is found there, in arch_get_unmapped_area_topdown(). To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr, and the addr + len (2 hugepages) will be one hugepage above the DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page round up or round down from kernel, so it's determistic. Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions") Signed-off-by: Chunyu Hu Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit d9d957bd7b61175db0723b6238d8f5a9740868a4 Author: Chunyu Hu Date: Fri Sep 12 09:37:10 2025 +0800 selftests/mm: alloc hugepages in va_high_addr_switch test Alloc hugepages in the test internally, so we don't fully rely on the run_vmtests.sh. If run_vmtests.sh does that great, free hugepages is enough for being used to run the test, leave it as it is, otherwise setup the hugepages in the test. Save the original nr_hugepages value and restore it after test finish, so leave a stable test envronment. Link: https://lkml.kernel.org/r/20250912013711.3002969-3-chuhu@redhat.com Signed-off-by: Chunyu Hu Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 6e296bcf294ee9e8e024158ed1d279cf823eae63 Author: Chunyu Hu Date: Fri Sep 12 09:37:09 2025 +0800 selftests/mm: fix hugepages cleanup too early Patch series "Fix va_high_addr_switch.sh test failure", v3. These three patches fix the va_high_addr_switch.sh test failure on x86_64. Patch 1 fixes the hugepage setup issue that nr_hugepages is reset too early in run_vmtests.sh and break the later va_high_addr_switch testing. Patch 2 adds hugepage setup in va_high_addr_switch test, so that it can still work if vm_runtests.sh changes the hugepage setup someday. Patch 3 fixes the test failure caused by the hint addr align method change in hugetlb_get_unmapped_area(). This patch (of 3): The nr_hugepgs variable is used to keep the original nr_hugepages at the hugepage setup step at test beginning. After userfaultfd test, a cleaup is executed, both /sys/kernel/mm/hugepages/hugepages-*/nr_hugepages and /proc/sys//vm/nr_hugepages are reset to 'original' value before userfaultfd test starts. Issue here is the value used to restore /proc/sys/vm/nr_hugepages is nr_hugepgs which is the initial value before the vm_runtests.sh runs, not the value before userfaultfd test starts. 'va_high_addr_swith.sh' tests runs after that will possibly see no hugepages available for test, and got EINVAL when mmap(HUGETLB), making the result invalid. And before pkey tests, nr_hugepgs is changed to be used as a temp variable to save nr_hugepages before pkey test, and restore it after pkey tests finish. The original nr_hugepages value is not tracked anymore, so no way to restore it after all tests finish. Add a new variable orig_nr_hugepgs to save the original nr_hugepages, and and restore it to nr_hugepages after all tests finish. And change to use the nr_hugepgs variable to save the /proc/sys/vm/nr_hugeages after hugepage setup, it's also the value before userfaultfd test starts, and the correct value to be restored after userfaultfd finishes. The va_high_addr_switch.sh broken will be resolved. Link: https://lkml.kernel.org/r/20250912013711.3002969-1-chuhu@redhat.com Link: https://lkml.kernel.org/r/20250912013711.3002969-2-chuhu@redhat.com Signed-off-by: Chunyu Hu Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 602837268999912b3c0e0db21b67818ffbde7141 Author: Jan Kara Date: Mon Sep 8 16:55:34 2025 +0200 readahead: add trace points Add a couple of trace points to make debugging readahead logic easier. [jack@suse.cz: v2] Link: https://lkml.kernel.org/r/20250909145849.5090-2-jack@suse.cz Link: https://lkml.kernel.org/r/20250908145533.31528-2-jack@suse.cz Signed-off-by: Jan Kara Tested-by: Pankaj Raghav Signed-off-by: Andrew Morton commit e1831e8dd1c839088692c09c97031ce467db1a2a Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 17:41:59 2025 +0200 scripts/decode_stacktrace.sh: code: preserve alignment With lines having a code to decode, the alignment was not preserved for the first line. With this sample ... [ 52.238089][ T55] RIP: 0010:__ip_queue_xmit+0x127c/0x1820 [ 52.238401][ T55] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 (...) ... the script was producing the following output: [ 52.238089][ T55] RIP: 0010:__ip_queue_xmit (...) [ 52.238401][ T55] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 (...) That's because scripts/decodecode doesn't preserve the alignment. No need to modify it, it is enough to give only the "Code: (...)" part to this script, and print the prefix without modifications. With the same sample, we now have: [ 52.238089][ T55] RIP: 0010:__ip_queue_xmit (...) [ 52.238401][ T55] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 (...) Link: https://lkml.kernel.org/r/20250908-decode_strace_indent-v1-3-28e5e4758080@kernel.org Signed-off-by: Matthieu Baerts (NGI0) Tested-by: Carlos Llamas Cc: Breno Leitao Cc: Elliot Berman Cc: Luca Ceresoli Cc: Stephen Boyd Signed-off-by: Andrew Morton commit 4a2fc4897b5e0ca1e7a3cb4e32f44c7db3367dee Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 17:41:58 2025 +0200 scripts/decode_stacktrace.sh: symbol: preserve alignment With lines having a symbol to decode, the script was only trying to preserve the alignment for the timestamps, but not the rest, nor when the caller was set (CONFIG_PRINTK_CALLER=y). With this sample ... [ 52.080924] Call Trace: [ 52.080926] [ 52.080931] dump_stack_lvl+0x6f/0xb0 ... the script was producing the following output: [ 52.080924] Call Trace: [ 52.080926] [ 52.080931] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19) (dump_stack_lvl is no longer aligned with : one missing space) With this other sample ... [ 52.080924][ T48] Call Trace: [ 52.080926][ T48] [ 52.080931][ T48] dump_stack_lvl+0x6f/0xb0 ... the script was producing the following output: [ 52.080924][ T48] Call Trace: [ 52.080926][ T48] [ 52.080931][ T48] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19) (the misalignment is clearer here) That's because the script had a workaround for CONFIG_PRINTK_TIME=y only, see the previous comment called "Format timestamps with tabs". To always preserve spaces, they need to be recorded along the words. That is what is now done with the new 'spaces' array. Some notes: - 'extglob' is needed only for this operation, and that's why it is set in a dedicated subshell. - 'read' is used with '-r' not to treat a character in any special way, e.g. when followed by a space. - When a word is removed from the 'words' array, the corresponding space needs to be removed from the 'spaces' array as well. With the last sample, we now have: [ 52.080924][ T48] Call Trace: [ 52.080926][ T48] [ 52.080931][ T48] dump_stack_lvl (arch/x86/include/asm/irqflags.h:19) (the alignment is preserved) Link: https://lkml.kernel.org/r/20250908-decode_strace_indent-v1-2-28e5e4758080@kernel.org Signed-off-by: Matthieu Baerts (NGI0) Tested-by: Carlos Llamas Cc: Breno Leitao Cc: Elliot Berman Cc: Luca Ceresoli Cc: Stephen Boyd Signed-off-by: Andrew Morton commit d322f6a24ee5964a58294f61bf96a1b6404c676d Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 17:41:57 2025 +0200 scripts/decode_stacktrace.sh: symbol: avoid trailing whitespaces A few patches slightly improving the output generated by decode_stacktrace.sh. This patch (of 3): Lines having a symbol to decode might not always have info after this symbol. It means ${info_str} might not be set, but it will always be printed after a space, causing trailing whitespaces. That's a detail, but when the output is opened with an editor marking these trailing whitespaces, that's a bit disturbing. It is easy to remove them by printing this variable with a space only if it is set. While at it, do the same with ${module} and print everything in one line. Link: https://lkml.kernel.org/r/20250908-decode_strace_indent-v1-0-28e5e4758080@kernel.org Link: https://lkml.kernel.org/r/20250908-decode_strace_indent-v1-1-28e5e4758080@kernel.org Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Carlos Llamas Reviewed-by: Breno Leitao Reviewed-by: Luca Ceresoli Cc: Carlos Llamas Cc: Elliot Berman Cc: Stephen Boyd Signed-off-by: Andrew Morton commit 90ec2df9dd31653ceac4a35d2440b108bdf27550 Author: Matthew Wilcox (Oracle) Date: Mon Sep 8 18:11:02 2025 +0100 ptdesc: remove ptdesc_to_virt() This has the same effect as ptdesc_address() so convert the callers to use that and delete the function. Add kernel-doc for ptdesc_address(). Link: https://lkml.kernel.org/r/20250908171104.2409217-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit f0c92726e89f5c6c092526787465617a68af154f Author: Matthew Wilcox (Oracle) Date: Mon Sep 8 18:11:01 2025 +0100 ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor() In preparation for splitting struct ptdesc from struct page and struct folio, remove mentions of struct folio from these functions. Introduce ptdesc_nr_pages() to avoid using lruvec_stat_add/sub_folio() Link: https://lkml.kernel.org/r/20250908171104.2409217-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 522abd92279a8ea55bcc687f77697d4c0aaba6c0 Author: Matthew Wilcox (Oracle) Date: Mon Sep 8 18:11:00 2025 +0100 ptdesc: convert __page_flags to pt_flags Patch series "Some ptdesc cleanups". The first two patches here are preparation for splitting struct ptdesc from struct page and struct folio. I think their only dependency is on the memdesc_flags_t patches from August which is in mm-new. The third patch is just something I noticed while working on the code. This patch (of 3): Use the new memdesc_flags_t type to show that these are the same bits as page/folio/slab and thesefore have the zone/node/section information in them. Remove a use of ptdesc_folio() by converting pagetable_is_reserved() to use test_bit() directly. Link: https://lkml.kernel.org/r/20250908171104.2409217-1-willy@infradead.org Link: https://lkml.kernel.org/r/20250908171104.2409217-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 6106864b878e1ce5ecab4b8ffffff85e9ec69b78 Author: Alice Ryhl Date: Tue Sep 2 08:36:11 2025 +0000 maple_tree: remove lockdep_map_p typedef Having the ma_external_lock field exist when CONFIG_LOCKDEP=n isn't used anywhere, so just get rid of it. This also avoids generating a typedef called lockdep_map_p that could overlap with typedefs in other header files. Link: https://lkml.kernel.org/r/20250902-maple-lockdep-p-v1-1-3ae5a398a379@google.com Signed-off-by: Alice Ryhl Reviewed-by: Danilo Krummrich Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 152d42584a98cb2e542932e63b25cc563224129f Author: zhang jiao Date: Wed Sep 3 15:30:59 2025 +0800 samples/cgroup: rm unused MEMCG_EVENTS macro MEMCG_EVENTS is never referenced in the code. Just remove it. Link: https://lkml.kernel.org/r/20250903073100.2477-1-zhangjiao2@cmss.chinamobile.com Signed-off-by: zhang jiao Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 72797d218b430c59f9e30be44aeb7632e0a2f211 Author: Stanislav Fort Date: Fri Sep 5 12:38:51 2025 +0300 mm/memcg: v1: account event registrations and drop world-writable cgroup.event_control In cgroup v1, the legacy cgroup.event_control file is world-writable and allows unprivileged users to register unbounded events and thresholds. Each registration allocates kernel memory without capping or memcg charging, which can be abused to exhaust kernel memory in affected configurations. Make the following minimal changes: - Account allocations with __GFP_ACCOUNT in event and threshold registration. - Remove CFTYPE_WORLD_WRITABLE from cgroup.event_control to make it owner-writable. This does not affect cgroup v2. Allocations are still subject to kmem accounting being enabled, but this reduces unbounded global growth. Link: https://lkml.kernel.org/r/20250905093851.80596-1-disclosure@aisle.com Signed-off-by: Stanislav Fort Acked-by: Roman Gushchin Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit f83938e4188c44b535c18903a9761759366aa626 Author: Kairui Song Date: Wed Sep 17 00:01:00 2025 +0800 mm, swap: use a single page for swap table when the size fits We have a cluster size of 512 slots. Each slot consumes 8 bytes in swap table so the swap table size of each cluster is exactly one page (4K). If that condition is true, allocate one page direct and disable the slab cache to reduce the memory usage of swap table and avoid fragmentation. Link: https://lkml.kernel.org/r/20250916160100.31545-16-ryncsn@gmail.com Co-developed-by: Chris Li Signed-off-by: Chris Li Signed-off-by: Kairui Song Acked-by: Chris Li Suggested-by: Chris Li Reviewed-by: Barry Song Cc: Baolin Wang Cc: Baoquan He Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 07adc4cf1ecd316e7b6f4a142e5f5e96ce697e65 Author: Kairui Song Date: Wed Sep 17 00:00:59 2025 +0800 mm, swap: implement dynamic allocation of swap table Now swap table is cluster based, which means free clusters can free its table since no one should modify it. There could be speculative readers, like swap cache look up, protect them by making them RCU protected. All swap table should be filled with null entries before free, so such readers will either see a NULL pointer or a null filled table being lazy freed. On allocation, allocate the table when a cluster is used by any order. This way, we can reduce the memory usage of large swap device significantly. This idea to dynamically release unused swap cluster data was initially suggested by Chris Li while proposing the cluster swap allocator and it suits the swap table idea very well. Link: https://lkml.kernel.org/r/20250916160100.31545-15-ryncsn@gmail.com Co-developed-by: Chris Li Signed-off-by: Chris Li Signed-off-by: Kairui Song Suggested-by: Chris Li Reviewed-by: Barry Song Cc: Baolin Wang Cc: Baoquan He Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 685a17fbd35e66ae9b6440979b438caa2ae540cd Author: Kairui Song Date: Wed Sep 17 00:00:58 2025 +0800 mm, swap: remove contention workaround for swap cache Swap cluster setup will try to shuffle the clusters on initialization. It was helpful to avoid contention for the swap cache space. The cluster size (2M) was much smaller than each swap cache space (64M), so shuffling the cluster means the allocator will try to allocate swap slots that are in different swap cache spaces for each CPU, reducing the chance of two CPUs using the same swap cache space, and hence reducing the contention. Now, swap cache is managed by swap clusters, this shuffle is pointless. Just remove it, and clean up related macros. This also improves the HDD swap performance as shuffling IO is a bad idea for HDD, and now the shuffling is gone. Test have shown a ~40% performance gain for HDD [1]: Doing sequential swap in of 8G data using 8 processes with usemem, average of 3 test runs: Before: 1270.91 KB/s per process After: 1849.54 KB/s per process Link: https://lore.kernel.org/linux-mm/CAMgjq7AdauQ8=X0zeih2r21QoV=-WWj1hyBxLWRzq74n-C=-Ng@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20250916160100.31545-14-ryncsn@gmail.com Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202504241621.f27743ec-lkp@intel.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Barry Song Acked-by: David Hildenbrand Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 8b47299a411a178d572aaac31ff7ab33a8bd27e2 Author: Kairui Song Date: Wed Sep 17 00:00:57 2025 +0800 mm, swap: mark swap address space ro and add context debug check Swap cache is now backed by swap table, and the address space is not holding any mutable data anymore. And swap cache is now protected by the swap cluster lock, instead of the XArray lock. All access to swap cache are wrapped by swap cache helpers. Locking is mostly handled internally by swap cache helpers, only a few __swap_cache_* helpers require the caller to lock the cluster by themselves. Worth noting that, unlike XArray, the cluster lock is not IRQ safe. The swap cache was very different compared to filemap, and now it's completely separated from filemap. Nothing wants to mark or change anything or do a writeback callback in IRQ. So explicitly document this and add a debug check to avoid further potential misuse. And mark the swap cache space as read-only to avoid any user wrongly mixing unexpected filemap helpers with swap cache. Link: https://lkml.kernel.org/r/20250916160100.31545-13-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Chris Li Acked-by: David Hildenbrand Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 8578e0c00dcf0c58fbc32d4904ecaf8e802a6590 Author: Kairui Song Date: Wed Sep 17 00:00:56 2025 +0800 mm, swap: use the swap table for the swap cache and switch API Introduce basic swap table infrastructures, which are now just a fixed-sized flat array inside each swap cluster, with access wrappers. Each cluster contains a swap table of 512 entries. Each table entry is an opaque atomic long. It could be in 3 types: a shadow type (XA_VALUE), a folio type (pointer), or NULL. In this first step, it only supports storing a folio or shadow, and it is a drop-in replacement for the current swap cache. Convert all swap cache users to use the new sets of APIs. Chris Li has been suggesting using a new infrastructure for swap cache for better performance, and that idea combined well with the swap table as the new backing structure. Now the lock contention range is reduced to 2M clusters, which is much smaller than the 64M address_space. And we can also drop the multiple address_space design. All the internal works are done with swap_cache_get_* helpers. Swap cache lookup is still lock-less like before, and the helper's contexts are same with original swap cache helpers. They still require a pin on the swap device to prevent the backing data from being freed. Swap cache updates are now protected by the swap cluster lock instead of the XArray lock. This is mostly handled internally, but new __swap_cache_* helpers require the caller to lock the cluster. So, a few new cluster access and locking helpers are also introduced. A fully cluster-based unified swap table can be implemented on top of this to take care of all count tracking and synchronization work, with dynamic allocation. It should reduce the memory usage while making the performance even better. Link: https://lkml.kernel.org/r/20250916160100.31545-12-ryncsn@gmail.com Co-developed-by: Chris Li Signed-off-by: Chris Li Signed-off-by: Kairui Song Acked-by: Chris Li Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 094dc8b059b11eef0888f43eeb0f3ac53ade5c87 Author: Kairui Song Date: Wed Sep 17 00:00:55 2025 +0800 mm, swap: wrap swap cache replacement with a helper There are currently three swap cache users that are trying to replace an existing folio with a new one: huge memory splitting, migration, and shmem replacement. What they are doing is quite similar. Introduce a common helper for this. In later commits, this can be easily switched to use the swap table by updating this helper. The newly added helper also makes the swap cache API better defined, and make debugging easier by adding a few more debug checks. Migration and shmem replace are meant to clone the folio, including content, swap entry value, and flags. And splitting will adjust each sub folio's swap entry according to order, which could be non-uniform in the future. So document it clearly that it's the caller's responsibility to set up the new folio's swap entries and flags before calling the helper. The helper will just follow the new folio's entry value. This also prepares for replacing high-order folios in the swap cache. Currently, only splitting to order 0 is allowed for swap cache folios. Using the new helper, we can handle high-order folio splitting better. Link: https://lkml.kernel.org/r/20250916160100.31545-11-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Acked-by: Chris Li Suggested-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 84a7a9823e73fe3c0adcc4780fa7a091981048ef Author: Kairui Song Date: Wed Sep 17 00:00:54 2025 +0800 mm/shmem, swap: remove redundant error handling for replacing folio Shmem may replace a folio in the swap cache if the cached one doesn't fit the swapin's GFP zone. When doing so, shmem has already double checked that the swap cache folio is locked, still has the swap cache flag set, and contains the wanted swap entry. So it is impossible to fail due to an XArray mismatch. There is even a comment for that. Delete the defensive error handling path, and add a WARN_ON instead: if that happened, something has broken the basic principle of how the swap cache works, we should catch and fix that. Link: https://lkml.kernel.org/r/20250916160100.31545-10-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: David Hildenbrand Reviewed-by: Baolin Wang Suggested-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit fd8d4f862f8c278fd1f5b61cef20056e88d8dfa5 Author: Kairui Song Date: Wed Sep 17 00:00:53 2025 +0800 mm, swap: cleanup swap cache API and add kerneldoc In preparation for replacing the swap cache backend with the swap table, clean up and add proper kernel doc for all swap cache APIs. Now all swap cache APIs are well-defined with consistent names. No feature change, only renaming and documenting. Link: https://lkml.kernel.org/r/20250916160100.31545-9-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Barry Song Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Suggested-by: Chris Li Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 0fcf8ef4fdab8e5c91d1bce39c7fe6565974ffad Author: Kairui Song Date: Wed Sep 17 00:00:52 2025 +0800 mm, swap: tidy up swap device and cluster info helpers swp_swap_info is the most commonly used helper for retrieving swap info. It has an internal check that may lead to a NULL return value, but almost none of its caller checks the return value, making the internal check pointless. In fact, most of these callers already ensured the entry is valid and never expect a NULL value. Tidy this up and improve the function names. If the caller can make sure the swap entry/type is valid and the device is pinned, use the new introduced __swap_entry_to_info/__swap_type_to_info instead. They have more debug sanity checks and lower overhead as they are inlined. Callers that may expect a NULL value should use swap_entry_to_info/swap_type_to_info instead. No feature change. The rearranged codes should have had no effect, or they should have been hitting NULL de-ref bugs already. Only some new sanity checks are added so potential issues may show up in debug build. The new helpers will be frequently used with swap table later when working with swap cache folios. A locked swap cache folio ensures the entries are valid and stable so these helpers are very helpful. Link: https://lkml.kernel.org/r/20250916160100.31545-8-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Barry Song Acked-by: David Hildenbrand Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 4522aed4fffbbd18ab3581d733d0572d45780d07 Author: Kairui Song Date: Wed Sep 17 00:00:51 2025 +0800 mm, swap: rename and move some swap cluster definition and helpers No feature change, move cluster related definitions and helpers to mm/swap.h, also tidy up and add a "swap_" prefix for cluster lock/unlock helpers, so they can be used outside of swap files. And while at it, add kerneldoc. Link: https://lkml.kernel.org/r/20250916160100.31545-7-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Reviewed-by: Barry Song Acked-by: Chris Li Acked-by: David Hildenbrand Suggested-by: Chris Li Acked-by: Nhat Pham Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit ae38eb210590ed69fa4f70f29959df76a4bdc4da Author: Kairui Song Date: Wed Sep 17 00:00:50 2025 +0800 mm, swap: always lock and check the swap cache folio before use Swap cache lookup only increases the reference count of the returned folio. That's not enough to ensure a folio is stable in the swap cache, so the folio could be removed from the swap cache at any time. The caller should always lock and check the folio before using it. We have just documented this in kerneldoc, now introduce a helper for swap cache folio verification with proper sanity checks. Also, sanitize a few current users to use this convention and the new helper for easier debugging. They were not having observable problems yet, only trivial issues like wasted CPU cycles on swapoff or reclaiming. They would fail in some other way, but it is still better to always follow this convention to make things robust and make later commits easier to do. Link: https://lkml.kernel.org/r/20250916160100.31545-6-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: David Hildenbrand Acked-by: Chris Li Acked-by: Nhat Pham Suggested-by: Chris Li Reviewed-by: Barry Song Cc: Baolin Wang Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 3518b931df0cc57b1b97e5c3a307ad7d5fe17650 Author: Kairui Song Date: Wed Sep 17 00:00:49 2025 +0800 mm, swap: check page poison flag after locking it Instead of checking the poison flag only in the fast swap cache lookup path, always check the poison flags after locking a swap cache folio. There are two reasons to do so. The folio is unstable and could be removed from the swap cache anytime, so it's totally possible that the folio is no longer the backing folio of a swap entry, and could be an irrelevant poisoned folio. We might mistakenly kill a faulting process. And it's totally possible or even common for the slow swap in path (swapin_readahead) to bring in a cached folio. The cache folio could be poisoned, too. Only checking the poison flag in the fast path will miss such folios. The race window is tiny, so it's very unlikely to happen, though. While at it, also add a unlikely prefix. Link: https://lkml.kernel.org/r/20250916160100.31545-5-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Chris Li Acked-by: David Hildenbrand Acked-by: Nhat Pham Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit a733d8de7f1ccbf093ce2fde424616e529073876 Author: Kairui Song Date: Wed Sep 17 00:00:48 2025 +0800 mm, swap: fix swap cache index error when retrying reclaim The allocator will reclaim cached slots while scanning. Currently, it will try again if reclaim found a folio that is already removed from the swap cache due to a race. But the following lookup will be using the wrong index. It won't cause any OOB issue since the swap cache index is truncated upon lookup, but it may lead to reclaiming of an irrelevant folio. This should not cause a measurable issue, but we should fix it. Link: https://lkml.kernel.org/r/20250916160100.31545-4-ryncsn@gmail.com Fixes: fae859550531 ("mm, swap: avoid reclaiming irrelevant swap cache") Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Acked-by: Nhat Pham Acked-by: Chris Li Acked-by: David Hildenbrand Suggested-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit f28124617f34153b34d7716eaff084e25a2d71fa Author: Kairui Song Date: Wed Sep 17 00:00:47 2025 +0800 mm, swap: use unified helper for swap cache look up The swap cache lookup helper swap_cache_get_folio currently does readahead updates as well, so callers that are not doing swapin from any VMA or mapping are forced to reuse filemap helpers instead, and have to access the swap cache space directly. So decouple readahead update with swap cache lookup. Move the readahead update part into a standalone helper. Let the caller call the readahead update helper if they do readahead. And convert all swap cache lookups to use swap_cache_get_folio. After this commit, there are only three special cases for accessing swap cache space now: huge memory splitting, migration, and shmem replacing, because they need to lock the XArray. The following commits will wrap their accesses to the swap cache too, with special helpers. And worth noting, currently dropbehind is not supported for anon folio, and we will never see a dropbehind folio in swap cache. The unified helper can be updated later to handle that. While at it, add proper kernedoc for touched helpers. No functional change. Link: https://lkml.kernel.org/r/20250916160100.31545-3-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Reviewed-by: Barry Song Acked-by: David Hildenbrand Acked-by: Chris Li Acked-by: Nhat Pham Suggested-by: Chris Li Cc: Baoquan He Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Yosry Ahmed Cc: Zi Yan Cc: SeongJae Park Signed-off-by: Andrew Morton commit 87cc51571a7790f50151c4fdca10c43aa18a29ba Author: Chris Li Date: Wed Sep 17 00:00:46 2025 +0800 docs/mm: add document for swap table Patch series "mm, swap: introduce swap table as swap cache (phase I)", v4. This is the first phase of the bigger series implementing basic infrastructures for the Swap Table idea proposed at the LSF/MM/BPF topic "Integrate swap cache, swap maps with swap allocator" [1]. To give credit where it is due, this is based on Chris Li's idea and a prototype of using cluster size atomic arrays to implement swap cache. This phase I contains 15 patches, introduces the swap table infrastructure and uses it as the swap cache backend. By doing so, we have up to ~5-20% performance gain in throughput, RPS or build time for benchmark and workload tests. The speed up is due to less contention on the swap cache access and shallower swap cache lookup path. The cluster size is much finer-grained than the 64M address space split, which is removed in this phase I. It also unifies and cleans up the swap code base. Each swap cluster will dynamically allocate the swap table, which is an atomic array to cover every swap slot in the cluster. It replaces the swap cache backed by XArray. In phase I, the static allocated swap_map still co-exists with the swap table. The memory usage is about the same as the original on average. A few exception test cases show about 1% higher in memory usage. In the following phases of the series, swap_map will merge into the swap table without additional memory allocation. It will result in net memory reduction compared to the original swap cache. Testing has shown that phase I has a significant performance improvement from 8c/1G ARM machine to 48c96t/128G x86_64 servers in many practical workloads. The full picture with a summary can be found at [2]. An older bigger series of 28 patches is posted at [3]. vm-scability test: ================== Test with: usemem --init-time -O -y -x -n 31 1G (4G memcg, PMEM as swap) Before: After: System time: 219.12s 158.16s (-27.82%) Sum Throughput: 4767.13 MB/s 6128.59 MB/s (+28.55%) Single process Throughput: 150.21 MB/s 196.52 MB/s (+30.83%) Free latency: 175047.58 us 131411.87 us (-24.92%) usemem --init-time -O -y -x -n 32 1536M (16G memory, global pressure, PMEM as swap) Before: After: System time: 356.16s 284.68s (-20.06%) Sum Throughput: 4648.35 MB/s 5453.52 MB/s (+17.32%) Single process Throughput: 141.63 MB/s 168.35 MB/s (+18.86%) Free latency: 499907.71 us 484977.03 us (-2.99%) This shows an improvement of more than 20% improvement in most readings. Build kernel test: ================== The following result matrix is from building kernel with defconfig on tmpfs with ZSWAP / ZRAM, using different memory pressure and setups. Measuring sys and real time in seconds, less is better (user time is almost identical as expected): -j / Mem | Sys before / after | Real before / after Using 16G ZRAM with memcg limit: 6 / 192M | 9686 / 9472 -2.21% | 2130 / 2096 -1.59% 12 / 256M | 6610 / 6451 -2.41% | 827 / 812 -1.81% 24 / 384M | 5938 / 5701 -3.37% | 414 / 405 -2.17% 48 / 768M | 4696 / 4409 -6.11% | 188 / 182 -3.19% With 64k folio: 24 / 512M | 4222 / 4162 -1.42% | 326 / 321 -1.53% 48 / 1G | 3688 / 3622 -1.79% | 151 / 149 -1.32% With ZSWAP with 3G memcg (using higher limit due to kmem account): 48 / 3G | 603 / 581 -3.65% | 81 / 80 -1.23% Testing extremely high global memory and schedule pressure: Using ZSWAP with 32G NVMEs in a 48c VM that has 4G memory, no memcg limit, system components take up about 1.5G already, using make -j48 to build defconfig: Before: sys time: 2069.53s real time: 135.76s After: sys time: 2021.13s (-2.34%) real time: 134.23s (-1.12%) On another 48c 4G memory VM, using 16G ZRAM as swap, testing make -j48 with same config: Before: sys time: 1756.96s real time: 111.01s After: sys time: 1715.90s (-2.34%) real time: 109.51s (-1.35%) All cases are more or less faster, and no regression even under extremely heavy global memory pressure. Redis / Valkey bench: ===================== The test machine is a ARM64 VM with 1536M memory 12 cores, Redis is set to use 2500M memory, and ZRAM swap size is set to 5G: Testing with: redis-benchmark -r 2000000 -n 2000000 -d 1024 -c 12 -P 32 -t get no BGSAVE with BGSAVE Before: 487576.06 RPS 280016.02 RPS After: 487541.76 RPS (-0.01%) 300155.32 RPS (+7.19%) Testing with: redis-benchmark -r 2500000 -n 2500000 -d 1024 -c 12 -P 32 -t get no BGSAVE with BGSAVE Before: 466789.59 RPS 281213.92 RPS After: 466402.89 RPS (-0.08%) 298411.84 RPS (+6.12%) With BGSAVE enabled, most Redis memory will have a swap count > 1 so swap cache is heavily in use. We can see a about 6% performance gain. No BGSAVE is very slightly slower (<0.1%) due to the higher memory pressure of the co-existence of swap_map and swap table. This will be optimzed into a net gain and up to 20% gain in BGSAVE case in the following phases. HDD swap is also ~40% faster with usemem because we removed an old contention workaround. This patch (of 15): Swap table is the new swap cache. [chrisl@kernel.org: move swap table document, redo swap table size sentence] Link: https://lkml.kernel.org/r/CACePvbXjaUyzB_9RSSSgR6BNvz+L9anvn0vcNf_J0jD7-4Yy6Q@mail.gmail.com Link: https://lkml.kernel.org/r/20250916160100.31545-1-ryncsn@gmail.com Link: https://lore.kernel.org/linux-mm/20250514201729.48420-1-ryncsn@gmail.com/ [3] Link: https://lkml.kernel.org/r/20250916160100.31545-2-ryncsn@gmail.com Link: https://lore.kernel.org/CAMgjq7BvQ0ZXvyLGp2YP96+i+6COCBBJCYmjXHGBnfisCAb8VA@mail.gmail.com [1] Link: https://github.com/ryncsn/linux/tree/kasong/devel/swap-table [2] Signed-off-by: Chris Li Signed-off-by: Kairui Song Suggested-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yosry Ahmed Cc: Zi Yan Cc: kernel test robot Cc: SeongJae Park Signed-off-by: Andrew Morton commit 614d850efda98e4455e4f2b55e64864f68a4e370 Author: Alistair Popple Date: Thu Sep 4 08:59:26 2025 +1000 mm/memremap: remove unused get_dev_pagemap() parameter GUP no longer uses get_dev_pagemap(). As it was the only user of the get_dev_pagemap() pgmap caching feature it can be removed. Link: https://lkml.kernel.org/r/20250903225926.34702-2-apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: John Hubbard Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton commit d3f7922b929a92873e14f7c61a026a6b576e8773 Author: Alistair Popple Date: Thu Sep 4 08:59:25 2025 +1000 mm/gup: remove dead pgmap refcounting code Prior to commit aed877c2b425 ("device/dax: properly refcount device dax pages when mapping") ZONE_DEVICE pages were not fully reference counted when mapped into user page tables. Instead GUP would take a reference on the associated pgmap to ensure the results of pfn_to_page() remained valid. This is no longer required and most of the code was removed by commit fd2825b0760a ("mm/gup: remove pXX_devmap usage from get_user_pages()"). Finish cleaning this up by removing the dead calls to put_dev_pagemap() and the temporary context struct. Link: https://lkml.kernel.org/r/20250903225926.34702-1-apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Reviewed-by: John Hubbard Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton commit 4805ef3707608e04477caeba6a8a0de04d1d77b5 Author: Wei Yang Date: Fri Sep 5 14:03:58 2025 +0000 mm/page_alloc: check the correct buddy if it is a starting block find_large_buddy() search buddy based on start_pfn, which maybe different from page's pfn, e.g. when page is not pageblock aligned, because prep_move_freepages_block() always align start_pfn to pageblock. This means when we found a starting block at start_pfn, it may check on the wrong page theoretically. And not split the free page as it is supposed to, causing a freelist migratetype mismatch. The good news is the page passed to __move_freepages_block_isolate() has only two possible cases: * page is pageblock aligned * page is __first_valid_page() of this block So it is safe for the first case, and it won't get a buddy larger than pageblock for the second case. To fix the issue, check the returned pfn of find_large_buddy() to decide whether to split the free page: 1. if it is not a PageBuddy pfn, no split; 2. if it is a PageBuddy pfn but order <= pageblock_order, no split; 3. if it is a PageBuddy pfn with order > pageblock_order, start_pfn is either in the starting block or tail block, split the PageBuddy at pageblock_order level. Link: https://lkml.kernel.org/r/20250905140358.28849-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Zi Yan Cc: Johannes Weiner Cc: David Hildenbrand Cc: Baolin Wang Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5ce1dbfdd8e3d4dca2f842dd833ca7e264ace85b Author: Miaohe Lin Date: Thu Sep 4 14:22:58 2025 +0800 mm/hwpoison: decouple hwpoison_filter from mm/memory-failure.c mm/memory-failure.c defines and uses hwpoison_filter_* parameters but the values of those parameters can only be modified via mm/hwpoison-inject.c from userspace. They have a potentially different life time. Decouple those parameters from mm/memory-failure.c to fix this broken layering. Link: https://lkml.kernel.org/r/20250904062258.3336092-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Suggested-by: Michal Hocko Cc: David Hildenbrand Cc: Naoya Horiguchi Signed-off-by: Andrew Morton commit a488ba3124c82d704963fcd760fe653df1987b13 Author: Pankaj Raghav Date: Fri Sep 5 17:00:12 2025 +0200 huge_memory: return -EINVAL in folio split functions when THP is disabled split_huge_page_to_list_[to_order](), split_huge_page() and try_folio_split() return 0 on success and error codes on failure. When THP is disabled, these functions return 0 indicating success even though an error code should be returned as it is not possible to split a folio when THP is disabled. Make all these functions return -EINVAL to indicate failure instead of 0. As large folios depend on CONFIG_THP, issue warning as this function should not be called without a large folio. Link: https://lkml.kernel.org/r/20250905150012.93714-1-kernel@pankajraghav.com Signed-off-by: Pankaj Raghav Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509051753.riCeG7LC-lkp@intel.com/ Acked-by: David Hildenbrand Acked-by: Zi Yan Acked-by: Kiryl Shutsemau Reviewed-by: Lorenzo Stoakes Reviewed-by: Barry Song Reviewed-by: Anshuman Khandual Signed-off-by: Andrew Morton commit 0faa77afe72b0705cdba8a59a0969e20300f6548 Author: Jinjiang Tu Date: Thu Sep 4 21:27:37 2025 +0800 filemap: optimize folio refount update in filemap_map_pages There are two meaningless folio refcount update for order0 folio in filemap_map_pages(). First, filemap_map_order0_folio() adds folio refcount after the folio is mapped to pte. And then, filemap_map_pages() drops a refcount grabbed by next_uptodate_folio(). We could remain the refcount unchanged in this case. As Matthew metenioned in [1], it is safe to call folio_unlock() before calling folio_put() here, because the folio is in page cache with refcount held, and truncation will wait for the unlock. Optimize filemap_map_folio_range() with the same method too. With this patch, we can get 8% performance gain for lmbench testcase 'lat_pagefault -P 1 file' in order0 folio case, the size of file is 512M. Link: https://lkml.kernel.org/r/20250904132737.1250368-1-tujinjiang@huawei.com Link: https://lore.kernel.org/all/aKcU-fzxeW3xT5Wv@casper.infradead.org/ [1] Signed-off-by: Jinjiang Tu Reviewed-by: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 24a3c7af3bb2acbda5e2ce92b4867fb0a58dbb40 Author: David Hildenbrand Date: Wed Sep 3 09:02:53 2025 +0200 selftests/mm: split_huge_page_test: cleanups for split_pte_mapped_thp test There is room for improvement, so let's clean up a bit: (1) Define "4" as a constant. (2) SKIP if we fail to allocate all THPs (e.g., fragmented) and add recovery code for all other failure cases: no need to exit the test. (3) Rename "len" to thp_area_size, and "one_page" to "thp_area". (4) Allocate a new area "page_area" into which we will mremap the pages; add "page_area_size". Now we can easily merge the two mremap instances into a single one. (5) Iterate THPs instead of bytes when checking for missed THPs after mremap. (6) Rename "pte_mapped2" to "tmp", used to verify mremap(MAP_FIXED) result. (7) Split the corruption test from the failed-split test, so we can just iterate bytes vs. thps naturally. (8) Extend comments and clarify why we are using mremap in the first place. Link: https://lkml.kernel.org/r/20250903070253.34556-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 0d0e03d5b83ea481801783906d230b2ad591d8c1 Author: David Hildenbrand Date: Wed Sep 3 09:02:52 2025 +0200 selftests/mm: split_huge_page_test: fix occasional is_backed_by_folio() wrong results Patch series "selftests/mm: split_huge_page_test: split_pte_mapped_thp improvements", v2. One fix for occasional failures I found while testing and a bunch of cleanups that should make that test easier to digest. This patch (of 2): When checking for actual tail or head pages of a folio, we must make sure that the KPF_COMPOUND_HEAD/KPF_COMPOUND_TAIL flag is paired with KPF_THP. For example, if we have another large folio after our large folio in physical memory, our "pfn_flags & (KPF_THP | KPF_COMPOUND_TAIL)" would trigger even though it's actually a head page of the next folio. If is_backed_by_folio() returns a wrong result, split_pte_mapped_thp() can fail with "Some THPs are missing during mremap". Fix it by checking for head/tail pages of folios properly. Add folio_tail_flags/folio_head_flags to improve readability and use these masks also when just testing for any compound page. Link: https://lkml.kernel.org/r/20250903070253.34556-1-david@redhat.com Link: https://lkml.kernel.org/r/20250903070253.34556-2-david@redhat.com Fixes: 169b456b0162 ("selftests/mm: reimplement is_backed_by_thp() with more precise check") Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 69e0a3b490030d8d9e628ea69bdb3ff0010a0bb7 Author: Baolin Wang Date: Wed Sep 3 16:54:24 2025 +0800 mm: shmem: fix the strategy for the tmpfs 'huge=' options After commit acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs"), we have extended tmpfs to allow any sized large folios, rather than just PMD-sized large folios. The strategy discussed previously was: : Considering that tmpfs already has the 'huge=' option to control the : PMD-sized large folios allocation, we can extend the 'huge=' option to : allow any sized large folios. The semantics of the 'huge=' mount option : are: : : huge=never: no any sized large folios : huge=always: any sized large folios : huge=within_size: like 'always' but respect the i_size : huge=advise: like 'always' if requested with madvise() : : Note: for tmpfs mmap() faults, due to the lack of a write size hint, still : allocate the PMD-sized huge folios if huge=always/within_size/advise is : set. : : Moreover, the 'deny' and 'force' testing options controlled by : '/sys/kernel/mm/transparent_hugepage/shmem_enabled', still retain the same : semantics. The 'deny' can disable any sized large folios for tmpfs, while : the 'force' can enable PMD sized large folios for tmpfs. This means that when tmpfs is mounted with 'huge=always' or 'huge=within_size', tmpfs will allow getting a highest order hint based on the size of write() and fallocate() paths. It will then try each allowable large order, rather than continually attempting to allocate PMD-sized large folios as before. However, this might break some user scenarios for those who want to use PMD-sized large folios, such as the i915 driver which did not supply a write size hint when allocating shmem [1]. Moreover, Hugh also complained that this will cause a regression in userspace with 'huge=always' or 'huge=within_size'. So, let's revisit the strategy for tmpfs large page allocation. A simple fix would be to always try PMD-sized large folios first, and if that fails, fall back to smaller large folios. This approach differs from the strategy for large folio allocation used by other file systems, however, tmpfs is somewhat different from other file systems, as quoted from David's opinion: : There were opinions in the past that tmpfs should just behave like any : other fs, and I think that's what we tried to satisfy here: use the write : size as an indication. : : I assume there will be workloads where either approach will be beneficial. : I also assume that workloads that use ordinary fs'es could benefit from : the same strategy (start with PMD), while others will clearly not. Link: https://lkml.kernel.org/r/10e7ac6cebe6535c137c064d5c5a235643eebb4a.1756888965.git.baolin.wang@linux.alibaba.com Link: https://lore.kernel.org/lkml/0d734549d5ed073c80b11601da3abdd5223e1889.1753689802.git.baolin.wang@linux.alibaba.com/ [1] Fixes: acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs") Signed-off-by: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Hugh Dickins Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 56b1852e82bd5550c8987bb381a3d930f27b4058 Author: Alice Ryhl Date: Tue Sep 2 08:35:13 2025 +0000 rust: maple_tree: add MapleTreeAlloc To support allocation trees, we introduce a new type MapleTreeAlloc for the case where the tree is created using MT_FLAGS_ALLOC_RANGE. To ensure that you can only call mtree_alloc_range on an allocation tree, we restrict thta method to the new MapleTreeAlloc type. However, all methods on MapleTree remain accessible to MapleTreeAlloc as allocation trees can use the other methods without issues. Link: https://lkml.kernel.org/r/20250902-maple-tree-v3-3-fb5c8958fb1e@google.com Signed-off-by: Alice Ryhl Reviewed-by: Daniel Almeida Reviewed-by: Danilo Krummrich Cc: Andreas Hindborg Cc: Andrew Ballance Cc: Björn Roy Baron Cc: Boqun Feng Cc: Gary Guo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Andrew Morton commit 01422da19cbeb4b044649322968265464991368e Author: Alice Ryhl Date: Tue Sep 2 08:35:12 2025 +0000 rust: maple_tree: add lock guard for maple tree To load a value, one must be careful to hold the lock while accessing it. To enable this, we add a lock() method so that you can perform operations on the value before the spinlock is released. This adds a MapleGuard type without using the existing SpinLock type. This ensures that the MapleGuard type is not unnecessarily large, and that it is easy to swap out the type of lock in case the C maple tree is changed to use a different kind of lock. There are two ways of using the lock guard: You can call load() directly to load a value under the lock, or you can create an MaState to iterate the tree with find(). The find() method does not have the mas_ prefix since it's a method on MaState, and being a method on that struct serves a similar purpose to the mas_ prefix in C. Link: https://lkml.kernel.org/r/20250902-maple-tree-v3-2-fb5c8958fb1e@google.com Co-developed-by: Andrew Ballance Signed-off-by: Andrew Ballance Reviewed-by: Andrew Ballance Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Daniel Almeida Cc: Gary Guo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Andrew Morton commit da939ef4c494246bc2102ecb628bbcc71d650410 Author: Alice Ryhl Date: Tue Sep 2 08:35:11 2025 +0000 rust: maple_tree: add MapleTree Patch series "Add Rust abstraction for Maple Trees", v3. This will be used in the Tyr driver [1] to allocate from the GPU's VA space that is not owned by userspace, but by the kernel, for kernel GPU mappings. Danilo tells me that in nouveau, the maple tree is used for keeping track of "VM regions" on top of GPUVM, and that he will most likely end up doing the same in the Rust Nova driver as well. These abstractions intentionally do not expose any way to make use of external locking. You are required to use the internal spinlock. For now, we do not support loads that only utilize rcu for protection. This contains some parts taken from Andrew Ballance's RFC [2] from April. However, it has also been reworked significantly compared to that RFC taking the use-cases in Tyr into account. This patch (of 3): The maple tree will be used in the Tyr driver to allocate and keep track of GPU allocations created internally (i.e. not by userspace). It will likely also be used in the Nova driver eventually. This adds the simplest methods for additional and removal that do not require any special care with respect to concurrency. This implementation is based on the RFC by Andrew but with significant changes to simplify the implementation. [ojeda@kernel.org: fix intra-doc links] Link: https://lkml.kernel.org/r/20250910140212.997771-1-ojeda@kernel.org Link: https://lkml.kernel.org/r/20250902-maple-tree-v3-0-fb5c8958fb1e@google.com Link: https://lkml.kernel.org/r/20250902-maple-tree-v3-1-fb5c8958fb1e@google.com Link: https://lore.kernel.org/r/20250627-tyr-v1-1-cb5f4c6ced46@collabora.com [1] Link: https://lore.kernel.org/r/20250405060154.1550858-1-andrewjballance@gmail.com [2] Co-developed-by: Andrew Ballance Signed-off-by: Andrew Ballance Signed-off-by: Alice Ryhl Reviewed-by: Danilo Krummrich Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Daniel Almeida Cc: Gary Guo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Andrew Morton commit 8147bc15b409c8ca52e98c6692273dd9bc5c6905 Author: Yueyang Pan Date: Wed Sep 3 04:16:14 2025 -0700 mm/show_mem: add trylock while printing alloc info In production, show_mem() can be called concurrently from two different entities, for example one from oom_kill_process() another from __alloc_pages_slowpath from another kthread. This patch adds a spinlock and invokes trylock before printing out the kernel alloc info in show_mem(). This way two alloc info won't interleave with each other, which then makes parsing easier. Link: https://lkml.kernel.org/r/4ed91296e0c595d945a38458f7a8d9611b0c1e52.1756897825.git.pyyjason@gmail.com Signed-off-by: Yueyang Pan Acked-by: Usama Arif Acked-by: Vlastimil Babka Acked-by: Zi Yan Acked-by: Suren Baghdasaryan Acked-by: Shakeel Butt Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 9abd8bd4c6b16d152b7149ef2f27a606ae4ebf4e Author: Yueyang Pan Date: Wed Sep 3 04:16:13 2025 -0700 mm/show_mem: dump the status of the mem alloc profiling before printing This patchset fixes two issues we saw in production rollout. The first issue is that we saw all zero output of memory allocation profiling information from show_mem() if CONFIG_MEM_ALLOC_PROFILING is set and sysctl.vm.mem_profiling=0. This cause ambiguity as we don't know what 0B actually means in the output. It can mean either memory allocation profiling is temporary disabled or the allocation at that position is actually 0. Such ambiguity will make further parsing harder as we cannot differentiate between two case. The second issue is that multiple entities can call show_mem() which messed up the allocation info in dmesg. We saw outputs like this: 327 MiB 83635 mm/compaction.c:1880 func:compaction_alloc 48.4 GiB 12684937 mm/memory.c:1061 func:folio_prealloc 7.48 GiB 10899 mm/huge_memory.c:1159 func:vma_alloc_anon_folio_pmd 298 MiB 95216 kernel/fork.c:318 func:alloc_thread_stack_node 250 MiB 63901 mm/zsmalloc.c:987 func:alloc_zspage 1.42 GiB 372527 mm/memory.c:1063 func:folio_prealloc 1.17 GiB 95693 mm/slub.c:2424 func:alloc_slab_page 651 MiB 166732 mm/readahead.c:270 func:page_cache_ra_unbounded 419 MiB 107261 net/core/page_pool.c:572 func:__page_pool_alloc_pages_slow 404 MiB 103425 arch/x86/mm/pgtable.c:25 func:pte_alloc_one The above example is because one kthread invokes show_mem() from __alloc_pages_slowpath while kernel itself calls oom_kill_process() This patch (of 2): This patch prints the status of the memory allocation profiling before __show_mem actually prints the detailed allocation info. This way will let us know the `0B` we saw in allocation info is because the profiling is disabled or the allocation is actually 0B. Link: https://lkml.kernel.org/r/cover.1756897825.git.pyyjason@gmail.com Link: https://lkml.kernel.org/r/d7998ea0ddc2ea1a78bb6e89adf530526f76679a.1756897825.git.pyyjason@gmail.com Signed-off-by: Yueyang Pan Acked-by: Usama Arif Acked-by: Vlastimil Babka Acked-by: Zi Yan Acked-by: Suren Baghdasaryan Reviewed-by: Vishal Moola (Oracle) Acked-by: Shakeel Butt Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Signed-off-by: Andrew Morton commit d75d36547d11aed7fc0502e14f243873fb9c5844 Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:21 2025 -0700 virtio_balloon: stop calling page_address() in free_pages() free_pages() should be used when we only have a virtual address. We should call __free_pages() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-8-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Acked-by: Michael S. Tsirkin Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit 77d7dadf89a131a49006650940adf7b001228fbe Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:20 2025 -0700 arm64: stop calling page_address() in free_pages() free_pages() should be used when we only have a virtual address. We should call __free_pages() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-7-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: Catalin Marinas Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Dave Hansen Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit 57fd554c0723d2f9eef64ed8b5b659a6e9208a0b Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:19 2025 -0700 powerpc: stop calling page_address() in free_pages() free_pages() should be used when we only have a virtual address. We should call __free_pages() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-6-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Ritesh Harjani (IBM) Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Christophe Leroy Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit 5e8fce2016d1a863913265a9b5fcc2ecf1955067 Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:18 2025 -0700 riscv: stop calling page_address() in free_pages() free_pages() should be used when we only have a virtual address. We should call __free_pages() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Acked-by: Alexandre Ghiti Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit b45ef93701142a4a065bf3a5051c902678540ae1 Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:17 2025 -0700 x86: stop calling page_address() in free_pages() free_pages() should be used when we only have a virtual address. We should call __free_pages() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: Dave Hansen Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit 367af0508f86d380a817c569c3036c116bf9381f Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:16 2025 -0700 aoe: stop calling page_address() in free_page() free_page() should be used when we only have a virtual address. We should call __free_page() directly on our page instead. Link: https://lkml.kernel.org/r/20250903185921.1785167-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Dave Hansen Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: SeongJae Park Cc: Will Deacon Signed-off-by: Andrew Morton commit 162f6c69ea9c42c5553a1f9408ef4291b5b54c5c Author: Vishal Moola (Oracle) Date: Wed Sep 3 11:59:15 2025 -0700 mm/page_alloc: add kernel-docs for free_pages() Patch series "Cleanup free_pages() misuse", v3. free_pages() is supposed to be called when we only have a virtual address. __free_pages() is supposed to be called when we have a page. There are a number of callers that use page_address() to get a page's virtual address then call free_pages() on it when they should just call __free_pages() directly. Add kernel-docs for free_pages() to help callers better understand which function they should be calling, and replace the obvious cases of misuse. This patch (of 7): Add kernel-docs to free_pages(). This will help callers understand when to use it instead of __free_pages(). Link: https://lkml.kernel.org/r/20250903185921.1785167-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20250903185921.1785167-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Acked-by: SeongJae Park Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Andy Lutomirski Cc: Catalin Marinas Cc: Jens Axboe Cc: Justin Sanders Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Vishal Moola (Oracle) Cc: Will Deacon Cc: Dave Hansen Cc: Ritesh Harjani (IBM) Signed-off-by: Andrew Morton commit 94326d3130b5e78a35265bbf7822148372b39231 Author: Matthew Wilcox (Oracle) Date: Wed Sep 3 20:10:39 2025 +0100 mm: remove mlock_count from struct page All users now use folio->mlock_count so we can remove this element of struct page. Move the useful comments over to struct folio. Link: https://lkml.kernel.org/r/20250903191041.1630338-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 8583bb0f9a7ed744a376ad4f1647efc240927a5a Author: Chi Zhiling Date: Fri Aug 29 10:36:59 2025 +0800 mpage: convert do_mpage_readpage() to return void type The return value of do_mpage_readpage() is arg->bio, which is already set in the arg structure. Returning it again is redundant. This patch changes the return type to void since the caller doesn't care about the return value. Link: https://lkml.kernel.org/r/20250829023659.688649-2-chizhiling@163.com Signed-off-by: Chi Zhiling Reviewed-by: Jan Kara Cc: Al Viro Cc: Christian Brauner Cc: Matthew Wilcox (Oracle) Cc: Namjae Jeon Cc: Sungjong Seo Cc: Yuezhang Mo Signed-off-by: Andrew Morton commit f6d8c7102049f76027bf584eef3300d4bddc6462 Author: Chi Zhiling Date: Fri Aug 29 10:36:58 2025 +0800 mpage: terminate read-ahead on read error For exFAT filesystems with 4MB read_ahead_size, removing the storage device during read operations can delay EIO error reporting by several minutes. This occurs because the read-ahead implementation in mpage doesn't handle errors. Another reason for the delay is that the filesystem requires metadata to issue file read request. When the storage device is removed, the metadata buffers are invalidated, causing mpage to repeatedly attempt to fetch metadata during each get_block call. The original purpose of this patch is terminate read ahead when we fail to get metadata, to make the patch more generic, implement it by checking folio status, instead of checking the return of get_block(). So, if a folio is synchronously unlocked and non-uptodate, should we quit the read ahead? I think it depends on whether the error is permanent or temporary, and whether further read ahead might succeed. A device being unplugged is one reason for returning such a folio, but we could return it for many other reasons (e.g., metadata errors). I think most errors won't be restored in a short time, so we should quit read ahead when they occur. Link: https://lkml.kernel.org/r/20250829023659.688649-1-chizhiling@163.com Signed-off-by: Chi Zhiling Reviewed-by: Jan Kara Cc: Al Viro Cc: Christian Brauner Cc: Matthew Wilcox (Oracle) Cc: Namjae Jeon Cc: Sungjong Seo Cc: Yuezhang Mo Signed-off-by: Andrew Morton commit 9fd53c8122271d9fe8b687f50a9bdf5588d41d0b Author: Youling Tang Date: Fri Jul 11 13:55:09 2025 +0800 mm/filemap: align last_index to folio size On XFS systems with pagesize=4K, blocksize=16K, and CONFIG_TRANSPARENT_HUGEPAGE enabled, We observed the following readahead behaviors: # echo 3 > /proc/sys/vm/drop_caches # dd if=test of=/dev/null bs=64k count=1 # ./tools/mm/page-types -r -L -f /mnt/xfs/test foffset offset flags 0 136d4c __RU_l_________H______t_________________F_1 1 136d4d __RU_l__________T_____t_________________F_1 2 136d4e __RU_l__________T_____t_________________F_1 3 136d4f __RU_l__________T_____t_________________F_1 ... c 136bb8 __RU_l_________H______t_________________F_1 d 136bb9 __RU_l__________T_____t_________________F_1 e 136bba __RU_l__________T_____t_________________F_1 f 136bbb __RU_l__________T_____t_________________F_1 <-- first read 10 13c2cc ___U_l_________H______t______________I__F_1 <-- readahead flag 11 13c2cd ___U_l__________T_____t______________I__F_1 12 13c2ce ___U_l__________T_____t______________I__F_1 13 13c2cf ___U_l__________T_____t______________I__F_1 ... 1c 1405d4 ___U_l_________H______t_________________F_1 1d 1405d5 ___U_l__________T_____t_________________F_1 1e 1405d6 ___U_l__________T_____t_________________F_1 1f 1405d7 ___U_l__________T_____t_________________F_1 [ra_size = 32, req_count = 16, async_size = 16] # echo 3 > /proc/sys/vm/drop_caches # dd if=test of=/dev/null bs=60k count=1 # ./page-types -r -L -f /mnt/xfs/test foffset offset flags 0 136048 __RU_l_________H______t_________________F_1 ... c 110a40 __RU_l_________H______t_________________F_1 d 110a41 __RU_l__________T_____t_________________F_1 e 110a42 __RU_l__________T_____t_________________F_1 <-- first read f 110a43 __RU_l__________T_____t_________________F_1 <-- first readahead flag 10 13e7a8 ___U_l_________H______t_________________F_1 ... 20 137a00 ___U_l_________H______t_______P______I__F_1 <-- second readahead flag (20 - 2f) 21 137a01 ___U_l__________T_____t_______P______I__F_1 ... 3f 10d4af ___U_l__________T_____t_______P_________F_1 [first readahead: ra_size = 32, req_count = 15, async_size = 17] When reading 64k data (same for 61-63k range, where last_index is page-aligned in filemap_get_pages()), 128k readahead is triggered via page_cache_sync_ra() and the PG_readahead flag is set on the next folio (the one containing 0x10 page). When reading 60k data, 128k readahead is also triggered via page_cache_sync_ra(). However, in this case the readahead flag is set on the 0xf page. Although the requested read size (req_count) is 60k, the actual read will be aligned to folio size (64k), which triggers the readahead flag and initiates asynchronous readahead via page_cache_async_ra(). This results in two readahead operations totaling 256k. The root cause is that when the requested size is smaller than the actual read size (due to folio alignment), it triggers asynchronous readahead. By changing last_index alignment from page size to folio size, we ensure the requested size matches the actual read size, preventing the case where a single read operation triggers two readahead operations. After applying the patch: # echo 3 > /proc/sys/vm/drop_caches # dd if=test of=/dev/null bs=60k count=1 # ./page-types -r -L -f /mnt/xfs/test foffset offset flags 0 136d4c __RU_l_________H______t_________________F_1 1 136d4d __RU_l__________T_____t_________________F_1 2 136d4e __RU_l__________T_____t_________________F_1 3 136d4f __RU_l__________T_____t_________________F_1 ... c 136bb8 __RU_l_________H______t_________________F_1 d 136bb9 __RU_l__________T_____t_________________F_1 e 136bba __RU_l__________T_____t_________________F_1 <-- first read f 136bbb __RU_l__________T_____t_________________F_1 10 13c2cc ___U_l_________H______t______________I__F_1 <-- readahead flag 11 13c2cd ___U_l__________T_____t______________I__F_1 12 13c2ce ___U_l__________T_____t______________I__F_1 13 13c2cf ___U_l__________T_____t______________I__F_1 ... 1c 1405d4 ___U_l_________H______t_________________F_1 1d 1405d5 ___U_l__________T_____t_________________F_1 1e 1405d6 ___U_l__________T_____t_________________F_1 1f 1405d7 ___U_l__________T_____t_________________F_1 [ra_size = 32, req_count = 16, async_size = 16] The same phenomenon will occur when reading from 49k to 64k. Set the readahead flag to the next folio. Because the minimum order of folio in address_space equals the block size (at least in xfs and bcachefs that already support bs > ps), having request_count aligned to block size will not cause overread. [klarasmodin@gmail.com: fix overflow on 32-bit] Link: https://lkml.kernel.org/r/yru7qf5gvyzccq5ohhpylvxug5lr5tf54omspbjh4sm6pcdb2r@fpjgj2pxw7va [akpm@linux-foundation.org: update it for Max's constification efforts] Link: https://lkml.kernel.org/r/20250711055509.91587-1-youling.tang@linux.dev Co-developed-by: Chi Zhiling Signed-off-by: Chi Zhiling Signed-off-by: Youling Tang Signed-off-by: Klara Modin Reviewed-by: Ryan Roberts Reviewed-by: Jan Kara Cc: Matthew Wilcox (Oracle) Cc: Youling Tang Cc: David Hildenbrand Cc: Klara Modin Signed-off-by: Andrew Morton commit a847b17009ec271514b269c90320a3893cd9b667 Author: Max Kellermann Date: Mon Sep 1 22:50:21 2025 +0200 mm: constify highmem related functions for improved const-correctness Lots of functions in mm/highmem.c do not write to the given pointers and do not call functions that take non-const pointers and can therefore be constified. This includes functions like kunmap() which might be implemented in a way that writes to the pointer (e.g. to update reference counters or mapping fields), but currently are not. kmap() on the other hand cannot be made const because it calls set_page_address() which is non-const in some architectures/configurations. [akpm@linux-foundation.org: "fix" folio_page() build failure] Link: https://lkml.kernel.org/r/20250901205021.3573313-13-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Vishal Moola (Oracle) Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit da0045587d59d4ffd7710fa45cea51e5a48453a4 Author: Max Kellermann Date: Mon Sep 1 22:50:20 2025 +0200 mm: constify assert/test functions in mm.h For improved const-correctness. We select certain assert and test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. Link: https://lkml.kernel.org/r/20250901205021.3573313-12-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Vishal Moola (Oracle) Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit f346a9473a2fbbab785d1733d475160f1fc54e5a Author: Max Kellermann Date: Mon Sep 1 22:50:19 2025 +0200 mm: constify various inline functions for improved const-correctness We select certain test functions plus folio_migrate_refs() from mm_inline.h which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. One exception is the function folio_migrate_refs() which does write to the "new" folio pointer; there, only the "old" folio pointer is being constified; only its "flags" field is read, but nothing written. Link: https://lkml.kernel.org/r/20250901205021.3573313-11-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 89bf840b84bb53393436426cd4acd80604bd26fd Author: Max Kellermann Date: Mon Sep 1 22:50:18 2025 +0200 mm: constify ptdesc_pmd_pts_count() and folio_get_private() These functions from mm_types.h are trivial getters that should never write to the given pointers. Link: https://lkml.kernel.org/r/20250901205021.3573313-10-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit a955cca37288fe37cc1cde8d291e02717c8a7409 Author: Max Kellermann Date: Mon Sep 1 22:50:17 2025 +0200 mm: constify arch_pick_mmap_layout() for improved const-correctness This function only reads from the rlimit pointer (but writes to the mm_struct pointer which is kept without `const`). All callees are already const-ified or (internal functions) are being constified by this patch. Link: https://lkml.kernel.org/r/20250901205021.3573313-9-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit e7f778767d2e54d9019dd142708547b4e457dab9 Author: Max Kellermann Date: Mon Sep 1 22:50:16 2025 +0200 parisc: constify mmap_upper_limit() parameter For improved const-correctness. This piece is necessary to make the `rlim_stack` parameter to mmap_base() const. Link: https://lkml.kernel.org/r/20250901205021.3573313-8-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 0bf25cfc9e795ab302ee23550fdeebd2aeedf800 Author: Max Kellermann Date: Mon Sep 1 22:50:15 2025 +0200 mm, s390: constify mapping related test/getter functions For improved const-correctness. We select certain test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. (Even though seemingly unrelated, this also constifies the pointer parameter of mmap_is_legacy() in arch/s390/mm/mmap.c because a copy of the function exists in mm/util.c.) Link: https://lkml.kernel.org/r/20250901205021.3573313-7-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 4680092f8ccb4406e771a6b1a2c0243ebd40bab7 Author: Max Kellermann Date: Mon Sep 1 22:50:14 2025 +0200 mm: constify process_shares_mm() for improved const-correctness This function only reads from the pointer arguments. Local (loop) variables are also annotated with `const` to clarify that these will not be written to. Link: https://lkml.kernel.org/r/20250901205021.3573313-6-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Vishal Moola (Oracle) Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit b119fb0927738f150cbd179d23d08057dccd75c1 Author: Max Kellermann Date: Mon Sep 1 22:50:13 2025 +0200 fs: constify mapping related test functions for improved const-correctness We select certain test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. Link: https://lkml.kernel.org/r/20250901205021.3573313-5-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 959b0886256b6896b44633e0e07c5464169087c1 Author: Max Kellermann Date: Mon Sep 1 22:50:12 2025 +0200 mm: constify zone related test/getter functions For improved const-correctness. We select certain test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. Link: https://lkml.kernel.org/r/20250901205021.3573313-4-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 7c3e97ac0d75306d9d03de575c9878f8fd9efe3b Author: Max Kellermann Date: Mon Sep 1 22:50:11 2025 +0200 mm: constify pagemap related test/getter functions For improved const-correctness. We select certain test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. Link: https://lkml.kernel.org/r/20250901205021.3573313-3-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 8eccb066f28747e966bda716cb90dbca13b78032 Author: Max Kellermann Date: Mon Sep 1 22:50:10 2025 +0200 mm: constify shmem related test functions for improved const-correctness Patch series "mm: establish const-correctness for pointer parameters", v6. This series is to improved const-correctness in the low-level memory-management subsystem, which provides a basis for further constification further up the call stack (e.g. filesystems). I started this work when I tried to constify the Ceph filesystem code, but found that to be impossible because many "mm" functions accept non-const pointers, even though they modify nothing. This patch (of 12): We select certain test functions which either invoke each other, functions that are already const-ified, or no further functions. It is therefore relatively trivial to const-ify them, which provides a basis for further const-ification further up the call stack. Link: https://lkml.kernel.org/r/20250901205021.3573313-1-max.kellermann@ionos.com Link: https://lkml.kernel.org/r/20250901205021.3573313-2-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Acked-by: Mike Rapoport (Microsoft) Acked-by: Shakeel Butt Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Axel Rasmussen Cc: Baolin Wang Cc: Borislav Betkov Cc: Christian Borntraeger Cc: Christian Brauner Cc: Christian Zankel Cc: David Rientjes Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Bottomley Cc: Jan Kara Cc: Jocelyn Falempe Cc: Liam Howlett Cc: Mark Brown Cc: Matthew Wilcox (Oracle) Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: "Nysal Jan K.A" Cc: Oscar Salvador Cc: Peter Zijlstra Cc: Russel King Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vasily Gorbik Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 4fe2a8107f332a46ed284fb961a4ddb39a105509 Author: Kefeng Wang Date: Wed Sep 10 21:39:58 2025 +0800 mm: hugeltb: check NUMA_NO_NODE in only_alloc_fresh_hugetlb_folio() Move the NUMA_NO_NODE check out of buddy and gigantic folio allocation to cleanup code a bit, also this will avoid NUMA_NO_NODE passed as 'nid' to node_isset() in alloc_buddy_hugetlb_folio(). Link: https://lkml.kernel.org/r/20250910133958.301467-6-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Oscar Salvador Reviewed-by: Sidhartha Kumar Reviewed-by: Jane Chu Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit dd4d324bc02c7b14ae5dd864d185d1403648c74d Author: Kefeng Wang Date: Wed Sep 10 21:39:57 2025 +0800 mm: hugetlb: remove struct hstate from init_new_hugetlb_folio() The struct hstate is never used since commit d67e32f26713 ("hugetlb: restructure pool allocations”), remove it. Link: https://lkml.kernel.org/r/20250910133958.301467-5-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Oscar Salvador Reviewed-by: Sidhartha Kumar Reviewed-by: Jane Chu Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4a25f995bd59843a898b531bb3e472d710ef9439 Author: Kefeng Wang Date: Wed Sep 10 21:39:56 2025 +0800 mm: hugetlb: directly pass order when allocate a hugetlb folio Use order instead of struct hstate to remove huge_page_order() call from all hugetlb folio allocation, also order_is_gigantic() is added to check whether it is a gigantic order. Link: https://lkml.kernel.org/r/20250910133958.301467-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Oscar Salvador Reviewed-by: Sidhartha Kumar Reviewed-by: Jane Chu Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4094d3434b25a1f0524c28bc3a253fd09d05c361 Author: Kefeng Wang Date: Wed Sep 10 21:39:55 2025 +0800 mm: hugetlb: convert to account_new_hugetlb_folio() In order to avoid the wrong nid passed into the account, and we did make such mistake before, so it's better to move folio_nid() into account_new_hugetlb_folio(). Link: https://lkml.kernel.org/r/20250910133958.301467-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Oscar Salvador Reviewed-by: Sidhartha Kumar Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 902020f027457d999fd2a4ebdbb7ba72e5c8c27e Author: Kefeng Wang Date: Wed Sep 10 21:39:54 2025 +0800 mm: hugetlb: convert to use more alloc_fresh_hugetlb_folio() Patch series "mm: hugetlb: cleanup hugetlb folio allocation", v3. Some cleanups for hugetlb folio allocation. This patch (of 3): Simplify alloc_fresh_hugetlb_folio() and convert more functions to use it, which help us to remove prep_new_hugetlb_folio() and __prep_new_hugetlb_folio(). Link: https://lkml.kernel.org/r/20250910133958.301467-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20250910133958.301467-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Oscar Salvador Reviewed-by: Sidhartha Kumar Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0c83e7faa8481d184766409ed5aa10493f0040d9 Author: Thadeu Lima de Souza Cascardo Date: Tue Sep 2 09:49:21 2025 -0300 mm: show_mem: show number of zspages in show_free_areas When OOM is triggered, it will show where the pages might be for each zone. When using zram or zswap, it might look like lots of pages are missing. After this patch, zspages are shown as below. [ 48.792859] Node 0 DMA free:2812kB boost:0kB min:60kB low:72kB high:84kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:11160kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 48.792962] lowmem_reserve[]: 0 956 956 956 956 [ 48.792988] Node 0 DMA32 free:3512kB boost:0kB min:3912kB low:4888kB high:5864kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:28kB active_file:8kB inactive_file:16kB unevictable:0kB writepending:0kB zspages:916780kB present:1032064kB managed:978944kB mlocked:0kB bounce:0kB free_pcp:500kB local_pcp:248kB free_cma:0kB [ 48.793118] lowmem_reserve[]: 0 0 0 0 0 Link: https://lkml.kernel.org/r/20250902-show_mem_zspages-v2-1-545daaa8b410@igalia.com Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Acked-by: Zi Yan Acked-by: SeongJae Park Reviewed-by: Chengming Zhou Reviewed-by: Sergey Senozhatsky Acked-by: Johannes Weiner Acked-by: Nhat Pham Cc: Brendan Jackman Cc: Michal Hocko Cc: Minchan Kim Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 2a8f3f44f5ac9a2d27f43a11a96d935ac620be6a Author: Li RongQing Date: Mon Sep 1 16:20:52 2025 +0800 mm/hugetlb: retry to allocate for early boot hugepage allocation In cloud environments with massive hugepage reservations (95%+ of system RAM), single-attempt allocation during early boot often fails due to memory pressure. Commit 91f386bf0772 ("hugetlb: batch freeing of vmemmap pages") intensified this by deferring page frees, increase peak memory usage during allocation. Introduce a retry mechanism that leverages vmemmap optimization reclaim (~1.6% memory) when available. Upon initial allocation failure, the system retries until successful or no further progress is made, ensuring reliable hugepage allocation while preserving batched vmemmap freeing benefits. Testing on a 256G machine allocating 252G of hugepages: Before: 128056/129024 hugepages allocated After: Successfully allocated all 129024 hugepages Link: https://lkml.kernel.org/r/20250901082052.3247-1-lirongqing@baidu.com Signed-off-by: Li RongQing Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Li RongQing Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 2b79cb3eac3a2b841a2d66550c44e6e073dcd422 Author: Yeoreum Yun Date: Tue Sep 16 23:27:55 2025 +0100 kasan: apply write-only mode in kasan kunit testcases When KASAN is configured in write-only mode, fetch/load operations do not trigger tag check faults. As a result, the outcome of some test cases may differ compared to when KASAN is configured without write-only mode. Therefore, by modifying pre-exist testcases check the write only makes tag check fault (TCF) where writing is perform in "allocated memory" but tag is invalid (i.e) redzone write in atomic_set() testcases. Otherwise check the invalid fetch/read doesn't generate TCF. Also, skip some testcases affected by initial value (i.e) atomic_cmpxchg() testcase maybe successd if it passes valid atomic_t address and invalid oldaval address. In this case, if invalid atomic_t doesn't have the same oldval, it won't trigger write operation so the test will pass. Link: https://lkml.kernel.org/r/20250916222755.466009-3-yeoreum.yun@arm.com Signed-off-by: Yeoreum Yun Reviewed-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Ard Biesheuvel Cc: Breno Leitao Cc: Catalin Marinas Cc: David Hildenbrand Cc: Dmitriy Vyukov Cc: D Scott Phillips Cc: Hardevsinh Palaniya Cc: James Morse Cc: John Hubbard Cc: Jonathan Corbet Cc: Kalesh Singh Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Pankaj Gupta Cc: Vincenzo Frascino Cc: Will Deacon Cc: Yang Shi Signed-off-by: Andrew Morton commit 31d8edb535bd6b387c55650c245b09fcfeaef768 Author: Yeoreum Yun Date: Tue Sep 16 23:27:54 2025 +0100 kasan/hw-tags: introduce kasan.write_only option Patch series "introduce kasan.write_only option in hw-tags", v8. Hardware tag based KASAN is implemented using the Memory Tagging Extension (MTE) feature. MTE is built on top of the ARMv8.0 virtual address tagging TBI (Top Byte Ignore) feature and allows software to access a 4-bit allocation tag for each 16-byte granule in the physical address space. A logical tag is derived from bits 59-56 of the virtual address used for the memory access. A CPU with MTE enabled will compare the logical tag against the allocation tag and potentially raise an tag check fault on mismatch, subject to system registers configuration. Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag check fault on store operation only. Using this feature (FEAT_MTE_STORE_ONLY), introduce KASAN write-only mode which restricts KASAN check write (store) operation only. This mode omits KASAN check for read (fetch/load) operation. Therefore, it might be used not only debugging purpose but also in normal environment. This patch (of 2): Since Armv8.9, FEATURE_MTE_STORE_ONLY feature is introduced to restrict raise of tag check fault on store operation only. Introduce KASAN write only mode based on this feature. KASAN write only mode restricts KASAN checks operation for write only and omits the checks for fetch/read operations when accessing memory. So it might be used not only debugging enviroment but also normal enviroment to check memory safty. This features can be controlled with "kasan.write_only" arguments. When "kasan.write_only=on", KASAN checks write operation only otherwise KASAN checks all operations. This changes the MTE_STORE_ONLY feature as BOOT_CPU_FEATURE like ARM64_MTE_ASYMM so that makes it initialise in kasan_init_hw_tags() with other function together. Link: https://lkml.kernel.org/r/20250916222755.466009-1-yeoreum.yun@arm.com Link: https://lkml.kernel.org/r/20250916222755.466009-2-yeoreum.yun@arm.com Signed-off-by: Yeoreum Yun Reviewed-by: Catalin Marinas Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Ard Biesheuvel Cc: Breno Leitao Cc: David Hildenbrand Cc: Dmitriy Vyukov Cc: D Scott Phillips Cc: Hardevsinh Palaniya Cc: James Morse Cc: John Hubbard Cc: Jonathan Corbet Cc: Kalesh Singh Cc: levi.yun Cc: Marc Zyngier Cc: Mark Brown Cc: Oliver Upton Cc: Pankaj Gupta Cc: Vincenzo Frascino Cc: Will Deacon Cc: Yang Shi Signed-off-by: Andrew Morton commit 84efbefa26df36a845a9210ee962aa6866f99bb7 Author: David Hildenbrand Date: Mon Sep 1 17:03:58 2025 +0200 mm: remove nth_page() Now that all users are gone, let's remove it. Link: https://lkml.kernel.org/r/20250901150359.867252-38-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit d5170ce4d71b3843613ee1840bca50ad71c3671e Author: David Hildenbrand Date: Mon Sep 1 17:03:57 2025 +0200 block: update comment of "struct bio_vec" regarding nth_page() Ever since commit 858c708d9efb ("block: move the bi_size update out of __bio_try_merge_page"), page_is_mergeable() no longer exists, and the logic in bvec_try_merge_page() is now a simple page pointer comparison. Link: https://lkml.kernel.org/r/20250901150359.867252-37-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 56531761d4b04ea46de04f7ddab0cdc9cd1a35e1 Author: David Hildenbrand Date: Mon Sep 1 17:03:56 2025 +0200 kfence: drop nth_page() usage We want to get rid of nth_page(), and kfence init code is the last user. Unfortunately, we might actually walk a PFN range where the pages are not contiguous, because we might be allocating an area from memblock that could span memory sections in problematic kernel configs (SPARSEMEM without SPARSEMEM_VMEMMAP). We could check whether the page range is contiguous using page_range_contiguous() and failing kfence init, or making kfence incompatible these problemtic kernel configs. Let's keep it simple and simply use pfn_to_page() by iterating PFNs. Link: https://lkml.kernel.org/r/20250901150359.867252-36-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Marco Elver Reviewed-by: Lorenzo Stoakes Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit b5ba761a7f5612759770117657577925fcb2e668 Author: David Hildenbrand Date: Mon Sep 1 17:03:55 2025 +0200 mm/gup: drop nth_page() usage in unpin_user_page_range_dirty_lock() There is the concern that unpin_user_page_range_dirty_lock() might do some weird merging of PFN ranges -- either now or in the future -- such that PFN range is contiguous but the page range might not be. Let's sanity-check for that and drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-35-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit ce00897b94bc5c62fab962625efcf1ab824d3688 Author: David Hildenbrand Date: Mon Sep 1 17:03:54 2025 +0200 crypto: remove nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-34-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Herbert Xu Cc: "David S. Miller" Signed-off-by: Andrew Morton commit fae6406bca03688bde691ef7f2605165d6b4f9b8 Author: David Hildenbrand Date: Mon Sep 1 17:03:53 2025 +0200 vfio/pci: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-33-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Alex Williamson Reviewed-by: Brett Creeley Cc: Jason Gunthorpe Cc: Yishai Hadas Cc: Shameer Kolothum Cc: Kevin Tian Signed-off-by: Andrew Morton commit d66ff3db89997a916b26c2752d4ddd00772613d6 Author: David Hildenbrand Date: Mon Sep 1 17:03:52 2025 +0200 scsi: sg: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-32-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Bart Van Assche Reviewed-by: Lorenzo Stoakes Reviewed-by: Martin K. Petersen Cc: Doug Gilbert Cc: "James E.J. Bottomley" Signed-off-by: Andrew Morton commit 9b6024fa7616bf3b9497c871611f39e2b2893de2 Author: David Hildenbrand Date: Mon Sep 1 17:03:51 2025 +0200 scsi: scsi_lib: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-31-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Bart Van Assche Reviewed-by: Lorenzo Stoakes Reviewed-by: Martin K. Petersen Cc: "James E.J. Bottomley" Signed-off-by: Andrew Morton commit 727fd054a01aaecb63151b3ffdacb0a0437453bf Author: David Hildenbrand Date: Mon Sep 1 17:03:50 2025 +0200 mmc: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-30-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Ulf Hansson Reviewed-by: Lorenzo Stoakes Cc: Alex Dubov Cc: Jesper Nilsson Cc: Lars Persson Signed-off-by: Andrew Morton commit a1f4c374cc09789c8ed89b77b45d31e3f15a5685 Author: David Hildenbrand Date: Mon Sep 1 17:03:49 2025 +0200 memstick: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-29-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Ulf Hansson Reviewed-by: Lorenzo Stoakes Cc: Maxim Levitsky Cc: Alex Dubov Signed-off-by: Andrew Morton commit 58f2c185839756b690370f5e536e629c7c7b0aac Author: David Hildenbrand Date: Mon Sep 1 17:03:48 2025 +0200 mspro_block: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-28-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Ulf Hansson Reviewed-by: Lorenzo Stoakes Cc: Maxim Levitsky Cc: Alex Dubov Signed-off-by: Andrew Morton commit f3dd22376e02b0541bac695b77aaf97130a7c899 Author: David Hildenbrand Date: Mon Sep 1 17:03:47 2025 +0200 drm/i915/gem: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-27-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: David Airlie Cc: Simona Vetter Signed-off-by: Andrew Morton commit 70aa902651e8aa596f23d6f0d4c8b21a08e93cce Author: David Hildenbrand Date: Mon Sep 1 17:03:46 2025 +0200 ata: libata-sff: drop nth_page() usage within SG entry It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-26-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Damien Le Moal Reviewed-by: Lorenzo Stoakes Cc: Niklas Cassel Signed-off-by: Andrew Morton commit 80e7bb74d4ff24725f0ddb1c72d8de45a3d975f6 Author: David Hildenbrand Date: Mon Sep 1 17:03:45 2025 +0200 scatterlist: disallow non-contigous page ranges in a single SG entry The expectation is that there is currently no user that would pass in non-contigous page ranges: no allocator, not even VMA, will hand these out. The only problematic part would be if someone would provide a range obtained directly from memblock, or manually merge problematic ranges. If we find such cases, we should fix them to create separate SG entries. Let's check in sg_set_page() that this is really the case. No need to check in sg_set_folio(), as pages in a folio are guaranteed to be contiguous. As sg_set_page() gets inlined into modules, we have to export the page_range_contiguous() helper -- use EXPORT_SYMBOL, there is nothing special about this helper such that we would want to enforce GPL-only modules. We can now drop the nth_page() usage in sg_page_iter_page(). Link: https://lkml.kernel.org/r/20250901150359.867252-25-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Marek Szyprowski Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit a16c46c2402026162111ed9fd1fc28d25223443e Author: David Hildenbrand Date: Mon Sep 1 17:03:44 2025 +0200 dma-remap: drop nth_page() in dma_common_contiguous_remap() dma_common_contiguous_remap() is used to remap an "allocated contiguous region". Within a single allocation, there is no need to use nth_page() anymore. Neither the buddy, nor hugetlb, nor CMA will hand out problematic page ranges. Link: https://lkml.kernel.org/r/20250901150359.867252-24-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Marek Szyprowski Reviewed-by: Lorenzo Stoakes Cc: Robin Murphy Signed-off-by: Andrew Morton commit 6972706f95926838f9bd3ec2b2393c034bdb85ba Author: David Hildenbrand Date: Mon Sep 1 17:03:43 2025 +0200 mm/cma: refuse handing out non-contiguous page ranges Let's disallow handing out PFN ranges with non-contiguous pages, so we can remove the nth-page usage in __cma_alloc(), and so any callers don't have to worry about that either when wanting to blindly iterate pages. This is really only a problem in configs with SPARSEMEM but without SPARSEMEM_VMEMMAP, and only when we would cross memory sections in some cases. Will this cause harm? Probably not, because it's mostly 32bit that does not support SPARSEMEM_VMEMMAP. If this ever becomes a problem we could look into allocating the memmap for the memory sections spanned by a single CMA region in one go from memblock. [david@redhat.com: we can have NUMMU configs with SPARSEMEM enabled] Link: https://lkml.kernel.org/r/6ec933b1-b3f7-41c0-95d8-e518bb87375e@redhat.com Link: https://lkml.kernel.org/r/20250901150359.867252-23-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Alexandru Elisei Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit b71ddc9ecc4d142465617d60e16a8a6ff154fdea Author: David Hildenbrand Date: Mon Sep 1 17:03:42 2025 +0200 mips: mm: convert __flush_dcache_pages() to __flush_dcache_folio_pages() Let's make it clearer that we are operating within a single folio by providing both the folio and the page. This implies that for flush_dcache_folio() we'll now avoid one more page->folio lookup, and that we can safely drop the "nth_page" usage. While at it, drop the "extern" from the function declaration. Link: https://lkml.kernel.org/r/20250901150359.867252-22-david@redhat.com Signed-off-by: David Hildenbrand Cc: Thomas Bogendoerfer Signed-off-by: Andrew Morton commit d99c57546d8f8ae4bcd2b5a83d77e248756f0cd1 Author: David Hildenbrand Date: Mon Sep 1 17:03:41 2025 +0200 io_uring/zcrx: remove nth_page() usage within folio Within a folio/compound page, nth_page() is no longer required. Given that we call folio_test_partial_kmap()+kmap_local_page(), the code would already be problematic if the pages would span multiple folios. So let's just assume that all src pages belong to a single folio/compound page and can be iterated ordinarily. The dst page is currently always a single page, so we're not actually iterating anything. Link: https://lkml.kernel.org/r/20250901150359.867252-21-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Begunkov Reviewed-by: Lorenzo Stoakes Cc: Jens Axboe Cc: Pavel Begunkov Signed-off-by: Andrew Morton commit e3c05b6e370c22451f87f2d230d131ad1bb49a60 Author: David Hildenbrand Date: Mon Sep 1 17:03:40 2025 +0200 mm/gup: remove record_subpages() We can just cleanup the code by calculating the #refs earlier, so we can just inline what remains of record_subpages(). Calculate the number of references/pages ahead of times, and record them only once all our tests passed. [david@redhat.com: fix `pages' adjustment] Link: https://lkml.kernel.org/r/cc7f03f8-da8b-407e-a03a-e8e5a9ec5462@redhat.com Link: https://lkml.kernel.org/r/20250901150359.867252-20-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Eric Biggers Cc: Jens Axboe Signed-off-by: Andrew Morton commit 541541dbfeb84f0995ad1ec54a643c72081d46fc Author: David Hildenbrand Date: Mon Sep 1 17:03:39 2025 +0200 mm/gup: drop nth_page() usage within folio when recording subpages nth_page() is no longer required when iterating over pages within a single folio, so let's just drop it when recording subpages. Link: https://lkml.kernel.org/r/20250901150359.867252-19-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 1a55ac6068ae4ca2024164c6d484d681a3f98299 Author: David Hildenbrand Date: Mon Sep 1 17:03:38 2025 +0200 mm/pagewalk: drop nth_page() usage within folio in folio_walk_start() It's no longer required to use nth_page() within a folio, so let's just drop the nth_page() in folio_walk_start(). Link: https://lkml.kernel.org/r/20250901150359.867252-18-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit a638ee7f197f4596adeb4b15e5369d055e042635 Author: David Hildenbrand Date: Mon Sep 1 17:03:37 2025 +0200 fs: hugetlbfs: cleanup folio in adjust_range_hwpoison() Let's cleanup and simplify the function a bit. Link: https://lkml.kernel.org/r/20250901150359.867252-17-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 06d42cf49eb740da7dbc4c5fc138a0fdce67417c Author: David Hildenbrand Date: Mon Sep 1 17:03:36 2025 +0200 fs: hugetlbfs: remove nth_page() usage within folio in adjust_range_hwpoison() The nth_page() is not really required anymore, so let's remove it. Link: https://lkml.kernel.org/r/20250901150359.867252-16-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit cb77aa60a0a45db626b7b9db864be38a150a06f7 Author: David Hildenbrand Date: Mon Sep 1 17:03:35 2025 +0200 mm/mm/percpu-km: drop nth_page() usage within single allocation We're allocating a higher-order page from the buddy. For these pages (that are guaranteed to not exceed a single memory section) there is no need to use nth_page(). Link: https://lkml.kernel.org/r/20250901150359.867252-15-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 372c9b5491d2d8e85a8e1b8b74d4116654f5d816 Author: David Hildenbrand Date: Mon Sep 1 17:03:34 2025 +0200 mm/hugetlb: cleanup hugetlb_folio_init_tail_vmemmap() We can now safely iterate over all pages in a folio, so no need for the pfn_to_page(). Also, as we already force the refcount in __init_single_page() to 1 through init_page_count(), we can just set the refcount to 0 and avoid page_ref_freeze() + VM_BUG_ON. Likely, in the future, we would just want to tell __init_single_page() to which value to initialize the refcount. Further, adjust the comments to highlight that we are dealing with an open-coded prep_compound_page() variant, and add another comment explaining why we really need the __init_single_page() only on the tail pages. Note that the current code was likely problematic, but we never ran into it: prep_compound_tail() would have been called with an offset that might exceed a memory section, and prep_compound_tail() would have simply added that offset to the page pointer -- which would not have done the right thing on sparsemem without vmemmap. Link: https://lkml.kernel.org/r/20250901150359.867252-14-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 73b3294b1152e94c1971a735b8db8c7503fd97a1 Author: David Hildenbrand Date: Mon Sep 1 17:03:33 2025 +0200 mm: simplify folio_page() and folio_page_idx() Now that a single folio/compound page can no longer span memory sections in problematic kernel configurations, we can stop using nth_page() in folio_page() and folio_page_idx(). While at it, turn both macros into static inline functions and add kernel doc for folio_page_idx(). Link: https://lkml.kernel.org/r/20250901150359.867252-13-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 4751c39eee0c3fcc742aa7d7242ce2b78faa3606 Author: David Hildenbrand Date: Mon Sep 1 17:03:32 2025 +0200 mm: limit folio/compound page sizes in problematic kernel configs Let's limit the maximum folio size in problematic kernel config where the memmap is allocated per memory section (SPARSEMEM without SPARSEMEM_VMEMMAP) to a single memory section. Currently, only a single architectures supports ARCH_HAS_GIGANTIC_PAGE but not SPARSEMEM_VMEMMAP: sh. Fortunately, the biggest hugetlb size sh supports is 64 MiB (HUGETLB_PAGE_SIZE_64MB) and the section size is at least 64 MiB (SECTION_SIZE_BITS == 26), so their use case is not degraded. As folios and memory sections are naturally aligned to their order-2 size in memory, consequently a single folio can no longer span multiple memory sections on these problematic kernel configs. nth_page() is no longer required when operating within a single compound page / folio. Link: https://lkml.kernel.org/r/20250901150359.867252-12-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 99132d24d76511f0f6ded2e25448765b632794aa Author: David Hildenbrand Date: Mon Sep 1 17:03:31 2025 +0200 mm: sanity-check maximum folio size in folio_set_order() Let's sanity-check in folio_set_order() whether we would be trying to create a folio with an order that would make it exceed MAX_FOLIO_ORDER. This will enable the check whenever a folio/compound page is initialized through prepare_compound_head() / prepare_compound_page() with CONFIG_DEBUG_VM set. Link: https://lkml.kernel.org/r/20250901150359.867252-11-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 50765b46ab44544f661fb70923871f8d06381015 Author: David Hildenbrand Date: Mon Sep 1 17:03:30 2025 +0200 mm/mm_init: make memmap_init_compound() look more like prep_compound_page() Grepping for "prep_compound_page" leaves on clueless how devdax gets its compound pages initialized. Let's add a comment that might help finding this open-coded prep_compound_page() initialization more easily. Further, let's be less smart about the ordering of initialization and just perform the prep_compound_head() call after all tail pages were initialized: just like prep_compound_page() does. No need for a comment to describe the initialization order: again, just like prep_compound_page(). Link: https://lkml.kernel.org/r/20250901150359.867252-10-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 7b4f21f5e0386dfe02c68c009294d8f26e3c1bad Author: David Hildenbrand Date: Mon Sep 1 17:03:29 2025 +0200 mm/hugetlb: check for unreasonable folio sizes when registering hstate Let's check that no hstate that corresponds to an unreasonable folio size is registered by an architecture. If we were to succeed registering, we could later try allocating an unsupported gigantic folio size. Further, let's add a BUILD_BUG_ON() for checking that HUGETLB_PAGE_ORDER is sane at build time. As HUGETLB_PAGE_ORDER is dynamic on powerpc, we have to use a BUILD_BUG_ON_INVALID() to make it compile. No existing kernel configuration should be able to trigger this check: either SPARSEMEM without SPARSEMEM_VMEMMAP cannot be configured or gigantic folios will not exceed a memory section (the case on sparse). Link: https://lkml.kernel.org/r/20250901150359.867252-9-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 646b67d575897dc656b07446e23e756d54e49828 Author: David Hildenbrand Date: Mon Sep 1 17:03:28 2025 +0200 mm/memremap: reject unreasonable folio/compound page sizes in memremap_pages() Let's reject unreasonable folio sizes early, where we can still fail. We'll add sanity checks to prepare_compound_head/prepare_compound_page next. Is there a way to configure a system such that unreasonable folio sizes would be possible? It would already be rather questionable. If so, we'd probably want to bail out earlier, where we can avoid a WARN and just report a proper error message that indicates where something went wrong such that we messed up. Link: https://lkml.kernel.org/r/20250901150359.867252-8-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 0bf2edf041dcb0b304a8dbda8c699771d5a245d2 Author: David Hildenbrand Date: Mon Sep 1 17:03:27 2025 +0200 mm/page_alloc: reject unreasonable folio/compound page sizes in alloc_contig_range_noprof() Let's reject them early, which in turn makes folio_alloc_gigantic() reject them properly. To avoid converting from order to nr_pages, let's just add MAX_FOLIO_ORDER and calculate MAX_FOLIO_NR_PAGES based on that. While at it, let's just make the order a "const unsigned order". Link: https://lkml.kernel.org/r/20250901150359.867252-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Acked-by: SeongJae Park Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 3b864c8f557a52c142905575157c69be20899f09 Author: David Hildenbrand Date: Mon Sep 1 17:03:26 2025 +0200 wireguard: selftests: remove CONFIG_SPARSEMEM_VMEMMAP=y from qemu kernel config It's no longer user-selectable (and the default was already "y"), so let's just drop it. It was never really relevant to the wireguard selftests either way. Link: https://lkml.kernel.org/r/20250901150359.867252-6-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: "Jason A. Donenfeld" Cc: Shuah Khan Signed-off-by: Andrew Morton commit 016496e3e3cc33421a7b0f4971141ffeec44f04b Author: David Hildenbrand Date: Mon Sep 1 17:03:25 2025 +0200 x86/Kconfig: drop superfluous "select SPARSEMEM_VMEMMAP" Now handled by the core automatically once SPARSEMEM_VMEMMAP_ENABLE is selected. Link: https://lkml.kernel.org/r/20250901150359.867252-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Acked-by: Dave Hansen Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Andrew Morton commit a2f0cbea29d34c8b581ee335b4e59d213bb324fc Author: David Hildenbrand Date: Mon Sep 1 17:03:24 2025 +0200 s390/Kconfig: drop superfluous "select SPARSEMEM_VMEMMAP" Now handled by the core automatically once SPARSEMEM_VMEMMAP_ENABLE is selected. Link: https://lkml.kernel.org/r/20250901150359.867252-4-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Signed-off-by: Andrew Morton commit 84188a3ab578eb5822c668ba6980f3e68e0f8244 Author: David Hildenbrand Date: Mon Sep 1 17:03:23 2025 +0200 arm64: Kconfig: drop superfluous "select SPARSEMEM_VMEMMAP" Now handled by the core automatically once SPARSEMEM_VMEMMAP_ENABLE is selected. Link: https://lkml.kernel.org/r/20250901150359.867252-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Acked-by: Catalin Marinas Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Will Deacon Signed-off-by: Andrew Morton commit f8f03eb5f0f91fddc9bb8563c7e82bd7d3ba1dd0 Author: David Hildenbrand Date: Mon Sep 1 17:03:22 2025 +0200 mm: stop making SPARSEMEM_VMEMMAP user-selectable Patch series "mm: remove nth_page()", v2. As discussed recently with Linus, nth_page() is just nasty and we would like to remove it. To recap, the reason we currently need nth_page() within a folio is because on some kernel configs (SPARSEMEM without SPARSEMEM_VMEMMAP), the memmap is allocated per memory section. While buddy allocations cannot cross memory section boundaries, hugetlb and dax folios can. So crossing a memory section means that "page++" could do the wrong thing. Instead, nth_page() on these problematic configs always goes from page->pfn, to the go from (++pfn)->page, which is rather nasty. Likely, many people have no idea when nth_page() is required and when it might be dropped. We refer to such problematic PFN ranges and "non-contiguous pages". If we only deal with "contiguous pages", there is not need for nth_page(). Besides that "obvious" folio case, we might end up using nth_page() within CMA allocations (again, could span memory sections), and in one corner case (kfence) when processing memblock allocations (again, could span memory sections). So let's handle all that, add sanity checks, and remove nth_page(). Patch #1 -> #5 : stop making SPARSEMEM_VMEMMAP user-selectable + cleanups Patch #6 -> #13 : disallow folios to have non-contiguous pages Patch #14 -> #20 : remove nth_page() usage within folios Patch #22 : disallow CMA allocations of non-contiguous pages Patch #23 -> #33 : sanity+check + remove nth_page() usage within SG entry Patch #34 : sanity-check + remove nth_page() usage in unpin_user_page_range_dirty_lock() Patch #35 : remove nth_page() in kfence Patch #36 : adjust stale comment regarding nth_page Patch #37 : mm: remove nth_page() A lot of this is inspired from the discussion at [1] between Linus, Jason and me, so cudos to them. This patch (of 37): In an ideal world, we wouldn't have to deal with SPARSEMEM without SPARSEMEM_VMEMMAP, but in particular for 32bit SPARSEMEM_VMEMMAP is considered too costly and consequently not supported. However, if an architecture does support SPARSEMEM with SPARSEMEM_VMEMMAP, let's forbid the user to disable VMEMMAP: just like we already do for arm64, s390 and x86. So if SPARSEMEM_VMEMMAP is supported, don't allow to use SPARSEMEM without SPARSEMEM_VMEMMAP. This implies that the option to not use SPARSEMEM_VMEMMAP will now be gone for loongarch, powerpc, riscv and sparc. All architectures only enable SPARSEMEM_VMEMMAP with 64bit support, so there should not really be a big downside to using the VMEMMAP (quite the contrary). This is a preparation for not supporting (1) folio sizes that exceed a single memory section (2) CMA allocations of non-contiguous page ranges in SPARSEMEM without SPARSEMEM_VMEMMAP configs, whereby we want to limit possible impact as much as possible (e.g., gigantic hugetlb page allocations suddenly fails). Link: https://lkml.kernel.org/r/20250901150359.867252-1-david@redhat.com Link: https://lkml.kernel.org/r/20250901150359.867252-2-david@redhat.com Link: https://lore.kernel.org/all/CAHk-=wiCYfNp4AJLBORU-c7ZyRBUp66W2-Et6cdQ4REx-GyQ_A@mail.gmail.com/T/#u [1] Signed-off-by: David Hildenbrand Acked-by: Zi Yan Acked-by: Mike Rapoport (Microsoft) Acked-by: SeongJae Park Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Huacai Chen Cc: WANG Xuerui Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: "David S. Miller" Cc: Andreas Larsson Cc: Alexander Gordeev Cc: Alexander Potapenko Cc: Alexandru Elisei Cc: Alex Dubov Cc: Alex Willamson Cc: Bart van Assche Cc: Borislav Betkov Cc: Brendan Jackman Cc: Brett Creeley Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Lameter (Ampere) Cc: Damien Le Maol Cc: Dave Airlie Cc: Dennis Zhou Cc: Dmitriy Vyukov Cc: Doug Gilbert Cc: Heiko Carstens Cc: Herbert Xu Cc: Ingo Molnar Cc: Inki Dae Cc: James Bottomley Cc: Jani Nikula Cc: Jason A. Donenfeld Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jesper Nilsson Cc: Johannes Weiner Cc: John Hubbard Cc: Jonas Lahtinen Cc: Kevin Tian Cc: Lars Persson Cc: Linus Torvalds Cc: Marco Elver Cc: "Martin K. Petersen" Cc: Maxim Levitky Cc: Michal Hocko Cc: Muchun Song Cc: Niklas Cassel Cc: Oscar Salvador Cc: Pavel Begunkov Cc: Peter Xu Cc: Robin Murohy Cc: Rodrigo Vivi Cc: Shameerali Kolothum Thodi Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Tejun Heo Cc: Thomas Bogendoerfer Cc: Thomas Gleinxer Cc: Tvrtko Ursulin Cc: Ulf Hansson Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Will Deacon Cc: Yishai Hadas Signed-off-by: Andrew Morton commit 4fa5b88e772372e7ea3faccd0bbab03cb32104ed Author: Kaushlendra Kumar Date: Sat Aug 30 22:50:22 2025 +0530 tools/mm/slabinfo: fix access to null terminator in string boundary The current code incorrectly accesses buffer[strlen(buffer)], which points to the null terminator ('\0') at the end of the string. This is technically out-of-bounds access since valid string content ends at index strlen(buffer)-1. Fix by: 1. Declaring strlen() result variable at function scope 2. Adding bounds check (len > 0) to handle empty strings 3. Using buffer[len-1] to correctly access the last character before the null terminator [kaushlendra.kumar@intel.com: remove unnecessary blank line] Link: https://lkml.kernel.org/r/20250901044955.3902815-1-kaushlendra.kumar@intel.com Link: https://lkml.kernel.org/r/20250830172022.1927448-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Acked-by: SeongJae Park Signed-off-by: Andrew Morton commit 5a00878f78cf4ef12bd5dcea88ed4dd1ef0c7433 Author: Joey Pabalinas Date: Sun Aug 31 01:47:48 2025 -1000 mm/memfd: remove redundant casts MFD_ALL_FLAGS is already an unsigned int. Remove redundant casts to unsigned int. Link: https://lkml.kernel.org/r/efbbe6093b64a5b19f974871d5262d6e75dff2c0.1756639225.git.joeypabalinas@gmail.com Signed-off-by: Joey Pabalinas Cc: Baolin Wang Cc: Hugh Dickins Cc: Joey Pabalinas Signed-off-by: Andrew Morton commit 783dbe472d4af1704febf7c52b0ae9262220bf1b Author: Pasha Tatashin Date: Fri Aug 29 13:44:41 2025 +0200 task_stack.h: clean-up stack_not_used() implementation Inside the small stack_not_used() function there are several ifdefs for stack growing-up vs. regular versions. Instead just implement this function two times, one for growing-up and another regular. Add comments like /* !CONFIG_DEBUG_STACK_USAGE */ to clarify what the ifdefs are doing. [linus.walleij@linaro.org: rebased, function moved elsewhere in the kernel] Link: https://lkml.kernel.org/r/20250829-fork-cleanups-for-dynstack-v1-2-3bbaadce1f00@linaro.org Signed-off-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-13-pasha.tatashin@soleen.com Signed-off-by: Linus Walleij Reviewed-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 1bca7359d72f759f2b119fc324c138372d3a2cc0 Author: Pasha Tatashin Date: Fri Aug 29 13:44:40 2025 +0200 fork: check charging success before zeroing stack Patch series "mm: task_stack: Stack handling cleanups". These are some small cleanups for the fork code that was split off from Pasha:s dynamic stack patch series, they are generally nice on their own so let's propose them for merging. This patch (of 2): No need to do zero cached stack if memcg charge fails, so move the charging attempt before the memset operation. Link: https://lkml.kernel.org/r/20250829-fork-cleanups-for-dynstack-v1-0-3bbaadce1f00@linaro.org Link: https://lkml.kernel.org/r/20250829-fork-cleanups-for-dynstack-v1-1-3bbaadce1f00@linaro.org Signed-off-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-6-pasha.tatashin@soleen.com Signed-off-by: Linus Walleij Reviewed-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4dfd4bba85785c88365b27af859ddb01c6fcf44a Author: Ujwal Kundur Date: Fri Aug 29 21:26:00 2025 +0530 selftests/mm/uffd: refactor non-composite global vars into struct Refactor macros and non-composite global variable definitions into a struct that is defined at the start of a test and is passed around instead of relying on global vars. Link: https://lkml.kernel.org/r/20250829155600.2000-1-ujwal.kundur@gmail.com Signed-off-by: Ujwal Kundur Acked-by: Peter Xu Reviewed-by: Brendan Jackman Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2f5bd89ba9e322a9c4677837411203890286b53a Author: Johannes Weiner Date: Fri Aug 29 17:15:28 2025 +0100 mm: zpdesc: minor naming and comment corrections zpdesc is the page descriptor used by the zsmalloc backend allocator, which in turn is used by zswap and zram. The zpool layer is gone. Link: https://lkml.kernel.org/r/20250829162212.208258-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Yosry Ahmed Cc: Chengming Zhou Cc: Nhat Pham Cc: SeongJae Park Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 2ccd9fecd9163f168761d4398564c81554f636ef Author: Johannes Weiner Date: Fri Aug 29 17:15:27 2025 +0100 mm: remove unused zpool layer With zswap using zsmalloc directly, there are no more in-tree users of this code. Remove it. With zpool gone, zsmalloc is now always a simple dependency and no longer something the user needs to configure. Hide CONFIG_ZSMALLOC from the user and have zswap and zram pull it in as needed. Link: https://lkml.kernel.org/r/20250829162212.208258-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: SeongJae Park Acked-by: Yosry Ahmed Cc: Chengming Zhou Cc: Nhat Pham Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 5c3f8be0c6b1a7b145a5db012b427c25516564c4 Author: Johannes Weiner Date: Fri Aug 29 17:15:26 2025 +0100 mm: zswap: interact directly with zsmalloc Patch series "mm: remove zpool". zpool is an indirection layer for zswap to switch between multiple allocator backends at runtime. Since 6.15, zsmalloc is the only allocator left in-tree, so there is no point in keeping zpool around. This patch (of 3): zswap goes through the zpool layer to enable runtime-switching of allocator backends for compressed data. However, since zbud and z3fold were removed in 6.15, zsmalloc has been the only option available. As such, the zpool indirection is unnecessary. Make zswap deal with zsmalloc directly. This is comparable to zram, which also directly interacts with zsmalloc and has never supported a different backend. Note that this does not preclude future improvements and experiments with different allocation strategies. Should it become necessary, it's possible to provide an alternate implementation for the zsmalloc API, selectable at compile time. However, zsmalloc is also rather mature and feature rich, with years of widespread production exposure; it's encouraged to make incremental improvements rather than fork it. In any case, the complexity of runtime pluggability seems excessive and unjustified at this time. Switch zswap to zsmalloc to remove the last user of the zpool API. [hannes@cmpxchg.org: fix default compressr test] Link: https://lkml.kernel.org/r/20250915153640.GA828739@cmpxchg.org Link: https://lkml.kernel.org/r/20250829162212.208258-1-hannes@cmpxchg.org Link: https://lkml.kernel.org/r/20250829162212.208258-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Nacked-by: Vitaly Wool Acked-by: Nhat Pham Acked-by: Yosry Ahmed Cc: Chengming Zhou Cc: SeongJae Park Signed-off-by: Andrew Morton commit e45085f2673b165687a3874d8e868437683fa8e4 Author: Sabyrzhan Tasbolatov Date: Sun Aug 10 17:57:46 2025 +0500 kasan: call kasan_init_generic in kasan_init Call kasan_init_generic() which handles Generic KASAN initialization. For architectures that do not select ARCH_DEFER_KASAN, this will be a no-op for the runtime flag but will print the initialization banner. For SW_TAGS and HW_TAGS modes, their respective init functions will handle the flag enabling, if they are enabled/implemented. Link: https://lkml.kernel.org/r/20250810125746.1105476-3-snovitoll@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217049 Signed-off-by: Sabyrzhan Tasbolatov Tested-by: Alexandre Ghiti [riscv] Acked-by: Alexander Gordeev [s390] Reviewed-by: Christophe Leroy Cc: Alexander Potapenko Cc: Alexandre Ghiti Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Baoquan He Cc: David Gow Cc: Dmitriy Vyukov Cc: Heiko Carstens Cc: Huacai Chen Cc: Marco Elver Cc: Qing Zhang Cc: Vincenzo Frascino Cc: Ritesh Harjani (IBM) Signed-off-by: Andrew Morton commit 1e338f4d99e6814ede16bad1db1cc463aad8032c Author: Sabyrzhan Tasbolatov Date: Sun Aug 10 17:57:45 2025 +0500 kasan: introduce ARCH_DEFER_KASAN and unify static key across modes Patch series "kasan: unify kasan_enabled() and remove arch-specific implementations", v6. This patch series addresses the fragmentation in KASAN initialization across architectures by introducing a unified approach that eliminates duplicate static keys and arch-specific kasan_arch_is_ready() implementations. The core issue is that different architectures have inconsistent approaches to KASAN readiness tracking: - PowerPC, LoongArch, and UML arch, each implement own kasan_arch_is_ready() - Only HW_TAGS mode had a unified static key (kasan_flag_enabled) - Generic and SW_TAGS modes relied on arch-specific solutions or always-on behavior This patch (of 2): Introduce CONFIG_ARCH_DEFER_KASAN to identify architectures [1] that need to defer KASAN initialization until shadow memory is properly set up, and unify the static key infrastructure across all KASAN modes. [1] PowerPC, UML, LoongArch selects ARCH_DEFER_KASAN. The core issue is that different architectures haveinconsistent approaches to KASAN readiness tracking: - PowerPC, LoongArch, and UML arch, each implement own kasan_arch_is_ready() - Only HW_TAGS mode had a unified static key (kasan_flag_enabled) - Generic and SW_TAGS modes relied on arch-specific solutions or always-on behavior This patch addresses the fragmentation in KASAN initialization across architectures by introducing a unified approach that eliminates duplicate static keys and arch-specific kasan_arch_is_ready() implementations. Let's replace kasan_arch_is_ready() with existing kasan_enabled() check, which examines the static key being enabled if arch selects ARCH_DEFER_KASAN or has HW_TAGS mode support. For other arch, kasan_enabled() checks the enablement during compile time. Now KASAN users can use a single kasan_enabled() check everywhere. Link: https://lkml.kernel.org/r/20250810125746.1105476-1-snovitoll@gmail.com Link: https://lkml.kernel.org/r/20250810125746.1105476-2-snovitoll@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217049 Signed-off-by: Sabyrzhan Tasbolatov Reviewed-by: Christophe Leroy Reviewed-by: Ritesh Harjani (IBM) #powerpc Cc: Alexander Gordeev Cc: Alexander Potapenko Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Baoquan He Cc: David Gow Cc: Dmitriy Vyukov Cc: Heiko Carstens Cc: Huacai Chen Cc: Marco Elver Cc: Qing Zhang Cc: Sabyrzhan Tasbolatov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit bc9950b56f16e9cc53879118bfddcc175355a75a Merge: 103e90626d3a40 ce4be9e4307c5a Author: Andrew Morton Date: Sun Sep 21 14:19:36 2025 -0700 Merge branch 'mm-hotfixes-stable' into mm-stable in order to pick up changes required by mm-stable material: hugetlb and damon. commit decdff7db9d18a57a8581c5de3afd78a0a92aeac Author: Ryan Chen Date: Wed Sep 17 10:05:38 2025 +0800 reset: aspeed: register AST2700 reset auxiliary bus device The AST2700 reset driver is registered as an auxiliary device due to reset and clock controller share the same register region. Signed-off-by: Ryan Chen Reviewed-by: Philipp Zabel Signed-off-by: Stephen Boyd commit 8ea304cff08f0605b425a3fb494ad47175214ea3 Author: Ryan Chen Date: Wed Sep 17 10:05:37 2025 +0800 dt-bindings: clock: ast2700: modify soc0/1 clock define -add SOC0_CLK_AHBMUX: add SOC0_CLK_AHBMUX for ahb clock source divide. mpll-> ahb_mux -> div_table -> clk_ahb hpll-> -new add clock: SOC0_CLK_MPHYSRC: UFS MPHY clock source. SOC0_CLK_U2PHY_REFCLKSRC: USB2.0 phy clock reference source. SOC1_CLK_I3C: I3C clock source. Signed-off-by: Ryan Chen Acked-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit 49ef6491106209c595476fc122c3922dfd03253f Author: Fedor Pchelkin Date: Sat Apr 26 15:54:28 2025 +0300 clk: tegra: do not overallocate memory for bpmp clocks struct tegra_bpmp::clocks is a pointer to a dynamically allocated array of pointers to 'struct tegra_bpmp_clk'. But the size of the allocated area is calculated like it is an array containing actual 'struct tegra_bpmp_clk' objects - it's not true, there are just pointers. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf") Signed-off-by: Fedor Pchelkin Signed-off-by: Stephen Boyd commit 41bba99777be40924d99af117e8c220652c20ab6 Author: Qianfeng Rong Date: Sat Aug 30 20:27:52 2025 +0800 clk: ep93xx: Use int type to store negative error codes Change the 'ret' variable in ep93xx_uart_clock_init() from unsigned int to int, as it needs to store either negative error codes or zero. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Stephen Boyd commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 Author: Alok Tiwari Date: Sun Jul 6 13:11:55 2025 -0700 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX. This ensures proper bounds checking during clk rate setting and rounding. Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver") Signed-off-by: Alok Tiwari [sboyd@kernel.org: 'm' is unsigned so remove < condition] Signed-off-by: Stephen Boyd commit 74743c53a19fb7592ca0369f087015044ee4a571 Author: Yao Zi Date: Fri Sep 19 14:26:47 2025 +0000 clk: loongson2: Add clock definitions for Loongson-2K0300 SoC The clock controller of Loongson-2K0300 consists of three PLLs, requires an 120MHz external reference clock to function, and generates clocks in various frequencies for SoC peripherals. Clock definitions for previous SoC generations could be reused for most clock hardwares. There're two gates marked as critical, clk_node_gate and clk_boot_gate, which supply the CPU cores and the system configuration bus. Disabling them leads to a SoC hang. Signed-off-by: Yao Zi Signed-off-by: Stephen Boyd commit 158ddb87b13e6642dadaa16e3c4e9f5814825685 Author: Yao Zi Date: Fri Sep 19 14:26:46 2025 +0000 clk: loongson2: Avoid hardcoding firmware name of the reference clock Loongson-2K0300 requires a reference clock with a frequency different from previous SoCs (120MHz v.s. 100MHz), thus hardcoding the firmware name of the reference clock as ref_100m isn't a good idea. This patch retrives the clock name of the reference clock dynamically during probe, avoiding the hardcoded pdata structure and preparing for support of future SoCs. Signed-off-by: Yao Zi Signed-off-by: Stephen Boyd commit 1ba5395c6ad0f40cd94792f737b2d19d6ec97e3c Author: Yao Zi Date: Fri Sep 19 14:26:45 2025 +0000 clk: loongson2: Allow zero divisors for dividers LS2K0300 and LS2K0500 ship divider clocks which allows zero divisors, in which case the divider acts the same as one is specified. Let's pass CLK_DIVIDER_ALLOW_ZERO when registering divider clocks to prepare for future introduction of these clocks. Signed-off-by: Yao Zi Signed-off-by: Stephen Boyd commit 897117e35e180bc3f7346424c8b885ddb57fddc6 Author: Yao Zi Date: Fri Sep 19 14:26:44 2025 +0000 clk: loongson2: Support scale clocks with an alternative mode LS2K0300 and LS2K1500 ship scale clocks with an alternative mode. There's one mode bit in clock configuration register indicating the operation mode. When mode bit is unset, the scale clock acts the same as previous generation of scale clocks. When it's set, a different equation for calculating result frequency, Fout = Fin / (scale + 1), is used. This patch adds frequency calculation support for the scale clock variant. A helper macro, CLK_SCALE_MODE, is added to simplify definitions. Signed-off-by: Yao Zi Signed-off-by: Stephen Boyd commit 499f81848ef3bdca53122e0c3758381f7cd40934 Author: Yao Zi Date: Fri Sep 19 14:26:43 2025 +0000 clk: loongson2: Allow specifying clock flags for gate clock Some gate clocks need to be supplied with flags, e.g., it may be required to specify CLK_IS_CRTICAL for CPU clocks. Add a field to loongson2_clk_board_info for representing clock flags, and specify it when registering gate clocks. A new helper macro, CLK_GATE_FLAGS, is added to simplify definitions. Signed-off-by: Yao Zi Signed-off-by: Stephen Boyd commit 793e6b74806eea39da26f2fb7e4b640608d9598d Author: Yao Zi Date: Fri Sep 19 14:26:42 2025 +0000 dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible Document the clock controller shipped in Loongson-2K0300 SoC, which generates various clock signals for SoC peripherals. Differing from previous generations of SoCs, LS2K0300 requires a 120MHz external clock input. Signed-off-by: Yao Zi Reviewed-by: Krzysztof Kozlowski Reviewed-by: Yanteng Si Signed-off-by: Stephen Boyd commit 7c2e86f7b5af93d0e78c16e4359318fe7797671d Author: Shubhrajyoti Datta Date: Fri Sep 5 14:40:02 2025 +0530 clk: clocking-wizard: Fix output clock register offset for Versal platforms The output clock register offset used in clk_wzrd_register_output_clocks was incorrectly referencing 0x3C instead of 0x38, which caused misconfiguration of output dividers on Versal platforms. Correcting the off-by-one error ensures proper configuration of output clocks. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Stephen Boyd commit e0a94c6bb5b48c46ff4dd0533e79aacfda366b9f Author: Shubhrajyoti Datta Date: Tue Jul 29 10:38:42 2025 +0530 clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() Optimise the clock wizard divisor calculation by eliminating the innermost loop over output divider o. Earlier there was an error that is returned if the WZRD_MIN_ERR is not achieved error is returned now it computes the best possible frequency. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Stephen Boyd commit a787ab591c38ef790c733b60a3398c5da9a769a6 Author: Duje Mihanović Date: Sat Sep 13 23:12:50 2025 +0200 clk: mmp: pxa1908: Instantiate power driver through auxiliary bus The power domain driver shares the APMU clock controller's registers. Instantiate the power domain driver through the APMU clock driver using the auxiliary bus. Also create a separate Kconfig entry for the PXA1908 clock driver to allow (de)selecting the driver at will and selecting CONFIG_AUXILIARY_BUS. Signed-off-by: Duje Mihanović Signed-off-by: Stephen Boyd commit 823699ccbf0f3794d89031f68385936eddaccf0e Author: André Draszik Date: Wed Jul 30 10:31:35 2025 +0100 clk: s2mps11: add support for S2MPG10 PMIC clock Add support for Samsung's S2MPG10 PMIC clock, which is similar to the existing PMIC clocks supported by this driver. S2MPG10 has three clock outputs @ 32kHz: AP, peri1 and peri2. Acked-by: Stephen Boyd Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Signed-off-by: Stephen Boyd commit b92ef17f0c0b9ba8d913b092deee4d2914526007 Author: André Draszik Date: Wed Jul 30 10:31:34 2025 +0100 dt-bindings: clock: samsung,s2mps11: add s2mpg10 The Samsung S2MPG10 clock controller is similar to the existing clock controllers supported by this binding. Register offsets / layout are slightly different, so it needs its own compatible. Acked-by: Stephen Boyd Acked-by: Rob Herring (Arm) Signed-off-by: André Draszik Signed-off-by: Stephen Boyd commit 099760708aa37737663086ce28145f8d386564f3 Author: Gabriel Fernandez Date: Wed Jun 25 11:07:26 2025 +0200 dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings - drop minItems from access-controllers - remove rcc label from example - fixes typos - remove double '::' from 'See also::' Acked-by: Conor Dooley Signed-off-by: Gabriel Fernandez Signed-off-by: Stephen Boyd commit 37ae8501cdb0ac81521cfd850de4dd967561aae3 Author: Gabriel Fernandez Date: Wed Jun 25 11:07:25 2025 +0200 clk: stm32: introduce clocks for STM32MP21 platform This driver is intended for the STM32MP21 clock family. Signed-off-by: Nicolas Le Bayon Reviewed-by: Alok Tiwari Signed-off-by: Gabriel Fernandez Signed-off-by: Stephen Boyd commit 49f6c8b74d9a20c0dd16bd75c93b981a3d420a37 Author: Gabriel Fernandez Date: Wed Jun 25 11:07:24 2025 +0200 dt-bindings: stm32: add STM32MP21 clocks and reset bindings Adds clock and reset binding entries for STM32MP21 SoC family. Signed-off-by: Nicolas Le Bayon Reviewed-by: Conor Dooley Signed-off-by: Gabriel Fernandez Signed-off-by: Stephen Boyd commit 4bf2d2744e641886a1320bae7e8877f639a1c961 Author: Chen-Yu Tsai Date: Thu Aug 14 11:53:16 2025 +0800 clk: Use hashtable for global clk lookups A clk lookup using clk_core_lookup() is currently somewhat expensive since it has to walk the whole clk tree to find a match. This is extremely bad in the clk_core_init() function where it is used to look for clk name conflicts, which is always the worst case of walking the whole tree. Moreover, the number of clks checked increases as more clks are registered, causing each subsequent clk registration becoming slower. Add a hashtable for doing clk lookups to replace the tree walk method. On arm64 this increases kernel memory usage by 4 KB for the hashtable, and 16 bytes (2 pointers) for |struct hlist_node| in each clk. On a platform with around 800 clks, this reduces the time spent in clk_core_lookup() significantly: | PID 0 | kworker | | before | after | before | after | ------------------------------------------- avg | 203 us | 2.7 us | 123 us | 1.5 us | ------------------------------------------- min | 4.7 us | 2.3 us | 102 us | 0.9 us | ------------------------------------------- max | 867 us | 4.8 us | 237 us | 3.5 us | ------------------------------------------- culm | 109 ms | 1.5 ms | 21 ms | 0.3 ms | This in turn reduces the time spent in clk_hw_register(), and ultimately, boot time. On a different system with close to 700 clks, This reduces boot time by around 110 ms. While this doesn't seem like a lot, this helps in cases where minimizing boot time is important. Signed-off-by: Chen-Yu Tsai Tested-by: Brian Masney Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 904bed39490cc112b4c66b2ab035e5325cdbfbb6 Author: Chen-Yu Tsai Date: Thu Aug 14 11:53:15 2025 +0800 clk: Sort include statements The clk core has its include statements in some random order. Clean it up before we add more. Signed-off-by: Chen-Yu Tsai Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 1803012a8929213b1abb9a46fc92de3674187085 Merge: 8f5ae30d69d754 652b08afba69d5 Author: Stephen Boyd Date: Sun Sep 21 09:56:03 2025 -0700 Merge tag 'clk-microchip-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Nicolas Ferre: - add one clock for sam9x75 - new meaning for MCR register field in clk-master - use force-write to PLL update register to ensure reliable programming sequence - update Analog Control Register (ACR) management to accommodate differences across SoCs. - ACR management dependency with one ARM PM patch added beforehand * tag 'clk-microchip-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: remove default values for PMC_PLL_ACR clk: at91: add ACR in all PLL settings clk: at91: sam9x7: Add peripheral clock id for pmecc clk: at91: clk-master: Add check for divide by 3 clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register ARM: at91: pm: save and restore ACR during PLL disable/enable commit b52297f6eb82e46ae5ecc34d270e7ed96eca0594 Author: Raphael Gallais-Pou Date: Fri Sep 12 13:36:12 2025 +0200 dt-bindings: clock: st: flexgen: remove deprecated compatibles st/stih407-clock.dtsi file has been removed in commit 65322c1daf51 ("clk: st: flexgen: remove unused compatible"). This file has three compatibles which are now dangling. Remove them from documentation. Signed-off-by: Raphael Gallais-Pou Reviewed-by: Brian Masney Reviewed-by: Patrice Chotard Acked-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit bbcc60a43cf80c4d609bcddcb42bb5641066ac45 Author: Raphael Gallais-Pou Date: Fri Sep 12 13:36:11 2025 +0200 clk: st: flexgen: remove unused compatible Following B2120 boards removal in commit dee546e1adef ("ARM: sti: drop B2120 board support"), several compatibles are left unused. Remove them. Signed-off-by: Raphael Gallais-Pou Reviewed-by: Patrice Chotard Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 2f66f069999dda4a44c5586805d468b8ac93ac1a Author: Laura Nao Date: Mon Sep 15 17:19:47 2025 +0200 clk: mediatek: Add MT8196 vencsys clock support Add support for the MT8196 vencsys clock controller, which provides clock gate control for the video encoder. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 32ce24a3131b07b4348281f9e34359cb45883b25 Author: Laura Nao Date: Mon Sep 15 17:19:46 2025 +0200 clk: mediatek: Add MT8196 vdecsys clock support Add support for the MT8196 vdecsys clock controller, which provides clock gate control for the video decoder. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 1a7f3d32da3e5c8fb5079c354d9b04189704009b Author: Laura Nao Date: Mon Sep 15 17:19:45 2025 +0200 clk: mediatek: Add MT8196 ovl1 clock support Add support for the MT8196 ovl1 clock controller, which provides clock gate control for the display system. It is integrated with the mtk-mmsys driver, which registers the ovl1 clock driver via platform_device_register_data(). Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit e4be40b9a0c1a8ada21b6c7423e5c2f7be0e42fc Author: Laura Nao Date: Mon Sep 15 17:19:44 2025 +0200 clk: mediatek: Add MT8196 ovl0 clock support Add support for the MT8196 ovl0 clock controller, which provides clock gate control for the display system. It is integrated with the mtk-mmsys driver, which registers the ovl0 clock driver via platform_device_register_data(). Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit d4fb7e15a520bae2fae45f492f1e4dc34cdd5bba Author: Laura Nao Date: Mon Sep 15 17:19:43 2025 +0200 clk: mediatek: Add MT8196 disp-ao clock support Add support for the MT8196 disp-ao clock controller, which provides clock gate control for the display system. It is integrated with the mtk-mmsys driver, which registers the disp-ao clock driver via platform_device_register_data(). Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit e2d924746082ec2775f09c61279752aea0d670ac Author: Laura Nao Date: Mon Sep 15 17:19:42 2025 +0200 clk: mediatek: Add MT8196 disp1 clock support Add support for the MT8196 disp1 clock controller, which provides clock gate control for the display system. It is integrated with the mtk-mmsys driver, which registers the disp1 clock driver via platform_device_register_data(). Reviewed-by: Chen-Yu Tsai # CLK_OPS_PARENT_ENABLE removal Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 91894f618838339d51c694bd788f16c9b056b1b0 Author: Laura Nao Date: Mon Sep 15 17:19:41 2025 +0200 clk: mediatek: Add MT8196 disp0 clock support Add support for the MT8196 disp0 clock controller, which provides clock gate control for the display system. It is integrated with the mtk-mmsys driver, which registers the disp0 clock driver via platform_device_register_data(). Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 03dc02f8c7dc6d9d0cebea5f289c7052483353dc Author: Laura Nao Date: Mon Sep 15 17:19:40 2025 +0200 clk: mediatek: Add MT8196 mfg clock support Add support for the MT8196 mfg clock controller, which provides PLL control for the GPU. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 2a827a7a4c2d45c601d6e2539537c7363c6c8b36 Author: Laura Nao Date: Mon Sep 15 17:19:39 2025 +0200 clk: mediatek: Add MT8196 mdpsys clock support Add support for the MT8196 mdpsys clock controller, which provides clock gate control for MDP. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai # CLK_OPS_PARENT_ENABLE removal Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit d4ecae56a8c7d3287a5bcdb2d65f7102ee580ab6 Author: Laura Nao Date: Mon Sep 15 17:19:38 2025 +0200 clk: mediatek: Add MT8196 mcu clock support Add support for the MT8196 mcu clock controller, which provides PLL control for MCU. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 8f61d9d319915eb84511773dfa57fb0c60ead0f7 Author: Laura Nao Date: Mon Sep 15 17:19:37 2025 +0200 clk: mediatek: Add MT8196 I2C clock support Add support for the MT8196 I2C clock controller, which provides clock gate control for I2C. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit c9b9a66bde91b84157243f8a6fe6ac524868c199 Author: Laura Nao Date: Mon Sep 15 17:19:36 2025 +0200 clk: mediatek: Add MT8196 pextpsys clock support Add support for the MT8196 pextpsys clock controller, which provides clock gate control for PCIe. Co-developed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai # CLK_OPS_PARENT_ENABLE removal Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit a74d5e835a9ff3ac56c01e6235e3122b0208ad30 Author: Laura Nao Date: Mon Sep 15 17:19:35 2025 +0200 clk: mediatek: Add MT8196 ufssys clock support Add support for the MT8196 ufssys clock controller, which provides clock gate control for UFS. Co-developed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 212779900009b7658acc191432236746145a1ac2 Author: Laura Nao Date: Mon Sep 15 17:19:34 2025 +0200 clk: mediatek: Add MT8196 peripheral clock support Add support for the MT8196 peripheral clock controller, which provides clock gate control for dma/flashif/msdc/pwm/spi/uart. Reviewed-by: Chen-Yu Tsai # CLK_OPS_PARENT_ENABLE change Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 2f8b3ae6f0cb189c067f18480caf4bd52e1cc21d Author: Laura Nao Date: Mon Sep 15 17:19:33 2025 +0200 clk: mediatek: Add MT8196 vlpckgen clock support Add support for the MT8196 vlpckgen clock controller, which provides muxes and dividers for clock selection in other IP blocks. Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit b093e0f1709990666d75d3018db2d7b431678f2f Author: Laura Nao Date: Mon Sep 15 17:19:32 2025 +0200 clk: mediatek: Add MT8196 topckgen2 clock support Add support for the MT8196 topckgen2 clock controller, which provides muxes and dividers for clock selection in other IP blocks. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 895ab0134d64834b3f265a6cb5ed609c80876efb Author: Laura Nao Date: Mon Sep 15 17:19:31 2025 +0200 clk: mediatek: Add MT8196 topckgen clock support Add support for the MT8196 topckgen clock controller, which provides muxes and dividers for clock selection in other IP blocks. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit d78485d63b79dd896301439e57e3dea45db0b575 Author: Laura Nao Date: Mon Sep 15 17:19:30 2025 +0200 clk: mediatek: Add MT8196 apmixedsys clock support Add support for the MT8196 apmixedsys clock controller, which provides PLLs generated from SoC 26m. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit dd240e95f1bee671f58148dea25e3be7cb39b50d Author: Laura Nao Date: Mon Sep 15 17:19:29 2025 +0200 dt-bindings: clock: mediatek: Describe MT8196 clock controllers Introduce binding documentation for system clocks, functional clocks, and PEXTP0/1 and UFS reset controllers on MediaTek MT8196. This binding also includes a handle to the hardware voter, a fixed-function MCU designed to aggregate votes from the application processor and other remote processors to manage clocks and power domains. The HWV on MT8196/MT6991 is incomplete and requires software to manually enable power supplies, parent clocks, and FENC, as well as write to both the HWV MMIO and the controller registers. Because of these constraints, the HWV cannot be modeled using generic clock, power domain, or interconnect APIs. Instead, a custom phandle is exceptionally used to provide direct, syscon-like register access to drivers. Reviewed-by: Nícolas F. R. A. Prado Co-developed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit a94737a6652bd9fe2db4161e2b81dce58505b4cc Author: Laura Nao Date: Mon Sep 15 17:19:28 2025 +0200 clk: mediatek: clk-mtk: Add MUX_DIV_GATE macro On MT8196, some clocks use one register for parent selection and gating, and a separate register for frequency division. Since composite clocks can combine a mux, divider, and gate in a single entity, add a macro to simplify registration of such clocks by combining parent selection, frequency scaling, and enable control into one definition. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit e504d3bdb3d0bf581056f18ed12f7d2a59815cd1 Author: Laura Nao Date: Mon Sep 15 17:19:27 2025 +0200 clk: mediatek: clk-gate: Add ops for gates with HW voter MT8196 use a HW voter for gate enable/disable control. Voting is performed using set/clr regs, with a status bit used to verify the vote state. Add new set of gate clock operations with support for voting via set/clr regs. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 8ceff24a754ac065123ae0ec9f31ec03aff55f8a Author: Laura Nao Date: Mon Sep 15 17:19:26 2025 +0200 clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct MT8196 uses a HW voter for gate enable/disable control, with set/clr/sta registers located in a separate regmap. Refactor mtk_clk_register_gate() to take a struct mtk_gate, and add a pointer to it in struct mtk_clk_gate. This allows reuse of the static gate data (including HW voter register offsets) without adding extra function arguments, and removes redundant duplication in the runtime data struct. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit be89999259376eba724a52cc31560588bd5c95d8 Author: Laura Nao Date: Mon Sep 15 17:19:25 2025 +0200 clk: mediatek: clk-mux: Add ops for mux gates with HW voter and FENC MT8196 use a HW voter for mux gate enable/disable control, along with a FENC status bit to check the status. Voting is performed using set/clr/upd registers, with a status bit used to verify the vote state. Add new set of mux gate clock operations with support for voting via set/clr/upd regs and FENC status logic. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 516edf79a5c6af2ce862e83a34c9d9d74770ac93 Author: Laura Nao Date: Mon Sep 15 17:19:24 2025 +0200 clk: mediatek: clk-mtk: Introduce mtk_clk_get_hwv_regmap() On MT8196, some clock controllers use a separate regmap for hardware voting via set/clear/status registers. Add mtk_clk_get_hwv_regmap() to retrieve this optional regmap, avoiding duplicated lookup code in  mtk_clk_register_muxes() and mtk_clk_register_gate(). Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit d3c4dde9770dbe2eb3a57c3d952c630e81fcd1c0 Author: Laura Nao Date: Mon Sep 15 17:19:23 2025 +0200 clk: mediatek: clk-mux: Add ops for mux gates with set/clr/upd and FENC MT8196 uses set/clr/upd registers for mux gate enable/disable control, along with a FENC bit to check the status. Add new set of mux gate clock operations with support for set/clr/upd and FENC status logic. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 2c327a17718d8d6e7e79c2ab73ea6073aae9f22d Author: Laura Nao Date: Mon Sep 15 17:19:22 2025 +0200 clk: mediatek: clk-pll: Add ops for PLLs using set/clr regs and FENC MT8196 uses a combination of set/clr registers to control the PLL enable state, along with a FENC bit to check the preparation status. Add new set of PLL clock operations with support for set/clr enable and FENC status logic. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit aee9ffa010e9b06f4138c6575a9318422ac32fc3 Author: Laura Nao Date: Mon Sep 15 17:19:21 2025 +0200 clk: mediatek: clk-pll: Add set/clr regs for shared PLL enable control On MT8196, there are set/clr registers to control a shared PLL enable register. These are intended to prevent different masters from manipulating the PLLs independently. Add the corresponding en_set_reg and en_clr_reg fields to the mtk_pll_data structure. Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Laura Nao Signed-off-by: Stephen Boyd commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 Author: Chen-Yu Tsai Date: Mon Aug 25 23:09:31 2025 +0800 clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags. Passing one to the other is wrong. Since there aren't any actual users adding CLK_MUX_* flags, just drop it for now. Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback") Signed-off-by: Chen-Yu Tsai Signed-off-by: Stephen Boyd commit cc5f9cfb2a2d22f05f5aa1c09bfa816cbfc4e10a Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:06 2025 +0200 clk: mediatek: mt7622-aud: Add missing AFE_MRGIF clock Add the AFE Merge Interface clock used for the audio subsystem. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit 64e7df08ed43e45aa1a8382b459b516d04d47e99 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:05 2025 +0200 dt-bindings: clock: mt7622: Add AFE_MRGIF clock Add the missing AFE Merge Interface clock to MT7622 to make use of it in the audio subsystem. While at it, also remove the useless CLK_AUDIO_NR_CLK definition. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 6c4c26b624790098988c1034541087e3e5ed5bed Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:28 2025 +0200 clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m The infrastructure gate for the HDMI specific crystal needs the top_hdmi_xtal clock to be configured in order to ungate the 26m clock to the HDMI IP, and it wouldn't work without. Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that. Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support") Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit 6526402b9bac873d7a64c6e81eb53307d8471f08 Author: Maíra Canal Date: Thu Jul 31 18:06:19 2025 -0300 clk: bcm: rpi: Maximize V3D clock Although minimizing the clock rate is the best for most scenarios, as stated in commit 4d85abb0fb8e ("clk: bcm: rpi: Enable minimize for all firmware clocks"), when it comes to the GPU, it's ideal to have the maximum rate allowed. Add an option to maximize a firmware clock's rate when the clock is enabled and set this option for V3D. Signed-off-by: Maíra Canal Signed-off-by: Stephen Boyd commit 919d6924ae9b4bcc9cb1d5ce4b78d5b92665d630 Author: Maíra Canal Date: Thu Jul 31 18:06:18 2025 -0300 clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing Currently, when we prepare or unprepare RPi's clocks, we don't actually enable/disable the firmware clock. This means that `clk_disable_unprepare()` doesn't actually change the clock state at all, nor does it lowers the clock rate. From the Mailbox Property Interface documentation [1], we can see that we should use `RPI_FIRMWARE_SET_CLOCK_STATE` to set the clock state off/on. Therefore, use `RPI_FIRMWARE_SET_CLOCK_STATE` to create a prepare and an unprepare hook for RPi's firmware clock. As now the clocks are actually turned off, some of them are now marked CLK_IS_CRITICAL, as those are required to be on during the whole system operation. Link: https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface [1] Signed-off-by: Maíra Canal Reviewed-by: Stefan Wahren Signed-off-by: Stephen Boyd commit 072ce917bf95fc31f3c8c106b71a31e8607553ce Author: Stefan Wahren Date: Thu Jul 31 18:06:17 2025 -0300 clk: bcm: rpi: Add missing logs if firmware fails In contrary to raspberrypi_fw_set_rate(), the ops for is_prepared() and recalc_rate() silently ignore firmware errors by just returning 0. Since these operations should never fail, add at least error logs to inform the user. Signed-off-by: Stefan Wahren Signed-off-by: Maíra Canal Signed-off-by: Stephen Boyd commit 575e9a62b8cacec8b613a60d74c853efe3a74f87 Merge: 8f5ae30d69d754 4ca6a89f38718d Author: Stephen Boyd Date: Sun Sep 21 08:48:49 2025 -0700 Merge tag 'qcom-clk-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Introduce Qualcomm Glymur global, display, rpmh, and tcsr clock controllers - Introduce Qualcomm IPQ5424 APSS clock controller - Extend the Qualcomm MSM8916 global clock controller to add support for MSM8937 - Convert QUalcomm alpha PLL to determine_rate() clk_ops - Add missing resets in Qualcomm SC7280 display clock controller * tag 'qcom-clk-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (27 commits) clk: qcom: gcc-sc8280xp: drop obsolete PCIe GDSC comment clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk clk: qcom: dispcc-glymur: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock controller found on MSM8937 dt-bindings: clock: qcom: Add MSM8937 Global Clock Controller clk: qcom: Select the intended config in QCS_DISPCC_615 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() clk: qcom: alpha-pll: convert from round_rate() to determine_rate() clk: qcom: milos: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock Controller dt-bindings: clock: qcom: document the Glymur Global Clock Controller clk: qcom: clk-alpha-pll: Add support for Taycan EKO_T PLL clk: qcom: rpmh: Add support for Glymur rpmh clocks clk: qcom: Add TCSR clock driver for Glymur SoC dt-bindings: clock: qcom: Document the Glymur SoC TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Glymur SoCs clk: qcom: dispcc-glymur: Add support for Display Clock Controller dt-bindings: clock: Add DISPCC and reset controller for GLYMUR SoC clk: qcom: gcc-sdm660: Add missing LPASS/CDSP vote clocks dt-bindings: clock: gcc-sdm660: Add LPASS/CDSP vote clocks/GDSCs ... commit 9b9e32f75aa3d257e3ee3ab0a0f9ad5fbfb298af Author: Alok Tiwari Date: Sun Sep 21 01:18:48 2025 -0700 RDMA/bnxt_re: Fix incorrect errno used in function comments The function comments in qplib_rcfw.c mention -ETIMEOUT as a possible return value. However, the correct errno is -ETIMEDOUT. Update the comments to reflect the proper return value to avoid confusion for developers and users referring to the code. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250921081854.1059094-1-alok.a.tiwari@oracle.com Signed-off-by: Leon Romanovsky commit 4b6b6233f50f72353b54295ba594990b19f33223 Author: Leon Romanovsky Date: Thu Sep 18 20:53:41 2025 +0300 RDMA: Use %pe format specifier for error pointers Convert error logging throughout the RDMA subsystem to use the %pe format specifier instead of PTR_ERR() with integer format specifiers. Link: https://patch.msgid.link/e81ec02df1e474be20417fb62e779776e3f47a50.1758217936.git.leon@kernel.org Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 260cce64aaa2828d42956d356c682389aca24b47 Author: Abhijit Gangurde Date: Fri Sep 19 17:43:01 2025 +0530 RDMA/ionic: Use ether_addr_copy instead of memcpy eth header from ib_ud_header structure packs the mac into 4B high and 2B low parts. But when 4B high is used in memcpy, it sees it as overflow. However, this is safe due to the 4B high and 2B low arrangement in the structure. To avoid the memcpy warning, use ether_addr_copy to copy the mac address. In function ‘fortify_memcpy_chk’, inlined from ‘ionic_set_ah_attr.isra’ at drivers/infiniband/hw/ionic/ionic_controlpath.c:609:3: ./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 580 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/infiniband/hw/ionic/ionic_controlpath.o] Error 1 make[5]: *** [scripts/Makefile.build:556: drivers/infiniband/hw/ionic] Error 2 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [scripts/Makefile.build:556: drivers/infiniband/hw] Error 2 make[3]: *** [scripts/Makefile.build:556: drivers/infiniband] Error 2 make[2]: *** [scripts/Makefile.build:556: drivers] Error 2 make[1]: *** [/tmp/tmp53nb1nwr/Makefile:2011: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit ed9836c040bac2823dffd4e10c107206d88ac548 Author: Abhijit Gangurde Date: Fri Sep 19 17:43:00 2025 +0530 RDMA/ionic: Fix build failure on SPARC due to xchg() operand size xchg() is used to safely handle the event queue arming. However SPARC xchg operates only 4B of variable. Change variable type from bool to int. Unverified Error/Warning (likely false positive, kindly check if interested): ERROR: modpost: "__xchg_called_with_bad_pointer" [drivers/infiniband/hw/ionic/ionic_rdma.ko] undefined! Error/Warning ids grouped by kconfigs: recent_errors `-- sparc-allmodconfig `-- ERROR:__xchg_called_with_bad_pointer-drivers-infiniband-hw-ionic-ionic_rdma.ko-undefined Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 Author: Gui-Dong Han Date: Fri Sep 19 02:52:12 2025 +0000 RDMA/rxe: Fix race in do_task() when draining When do_task() exhausts its iteration budget (!ret), it sets the state to TASK_STATE_IDLE to reschedule, without a secondary check on the current task->state. This can overwrite the TASK_STATE_DRAINING state set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). While state changes are protected by a spinlock, both rxe_cleanup_task() and rxe_disable_task() release the lock while waiting for the task to finish draining in the while(!is_done(task)) loop. The race occurs if do_task() hits its iteration limit and acquires the lock in this window. The cleanup logic may then proceed while the task incorrectly reschedules itself, leading to a potential use-after-free. This bug was introduced during the migration from tasklets to workqueues, where the special handling for the draining case was lost. Fix this by restoring the original pre-migration behavior. If the state is TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to force a new loop iteration. This allows the task to finish its work, so that a subsequent iteration can reach the switch statement and correctly transition the state to TASK_STATE_DRAINED, stopping the task as intended. Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks") Reviewed-by: Zhu Yanjun Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com Signed-off-by: Leon Romanovsky commit 391253b25f078d2fe5657a1dedd360396d186407 Author: Haofeng Li Date: Wed Sep 10 17:37:03 2025 +0800 time: Fix spelling mistakes in comments Correct several typos found in comments across various files in the kernel/time directory. No functional changes are introduced by these corrections. Signed-off-by: Haofeng Li Signed-off-by: Thomas Gleixner commit a3835a44107fcbf05f183b5e8b60a8e4605b15ea Author: Uday Shankar Date: Tue Sep 16 18:42:52 2025 -0600 selftests: ublk: fix behavior when fio is not installed Some ublk selftests have strange behavior when fio is not installed. While most tests behave correctly (run if they don't need fio, or skip if they need fio), the following tests have different behavior: - test_null_01, test_null_02, test_generic_01, test_generic_02, and test_generic_12 try to run fio without checking if it exists first, and fail on any failure of the fio command (including "fio command not found"). So these tests fail when they should skip. - test_stress_05 runs fio without checking if it exists first, but doesn't fail on fio command failure. This test passes, but that pass is misleading as the test doesn't do anything useful without fio installed. So this test passes when it should skip. Fix these issues by adding _have_program fio checks to the top of all of these tests. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit ef575ff2054ceb2bd6701630db2f3d33f5c1a1cf Author: Luca Weiss Date: Mon Sep 15 13:15:19 2025 +0200 remoteproc: qcom: pas: Add Milos remoteproc support Add the different remoteprocs found on the Milos SoC: ADSP, CDSP, MPSS and WPSS. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250915-sm7635-remoteprocs-v5-2-96526cac59c6@fairphone.com Signed-off-by: Bjorn Andersson commit 24723d7c09ddac90bdd9e9864f92eb43ed70a083 Author: Luca Weiss Date: Mon Sep 15 13:15:18 2025 +0200 dt-bindings: remoteproc: qcom,milos-pas: Document remoteprocs Document the bindings for the ADSP, CDSP, MPSS and WPSS PAS on the Milos (e.g. SM7635) SoC. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250915-sm7635-remoteprocs-v5-1-96526cac59c6@fairphone.com Signed-off-by: Bjorn Andersson commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b Author: Dmitry Baryshkov Date: Sun Jul 6 17:47:08 2025 +0300 remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was specified as the firmware image. Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings") Signed-off-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov Tested-by: Luca Weiss # msm8974pro-fairphone-fp2 Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com [bjorn: Unwrapped the long memcpy line, to taste] Signed-off-by: Bjorn Andersson commit 09390ed9af37ed612dd0967ff2b0d639872b8776 Author: Barnabás Czémán Date: Fri Jul 25 22:02:58 2025 +0200 rpmsg: qcom_smd: Fix fallback to qcom,ipc parse mbox_request_channel() returning value was changed in case of error. It uses returning value of of_parse_phandle_with_args(). It is returning with -ENOENT instead of -ENODEV when no mboxes property exists. Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()") Reviewed-by: Dmitry Baryshkov Reviewed-by: Stephan Gerhold Tested-by: Stephan Gerhold # msm8939 Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org Signed-off-by: Bjorn Andersson commit c8a8df494f7103f66d2d677347b7b941d8de71a1 Author: Thorsten Blum Date: Tue Apr 29 12:45:43 2025 +0200 rpmsg: Use strscpy() instead of strscpy_pad() kzalloc() already zero-initializes the destination buffer, making strscpy() sufficient for safely copying the name. The additional NUL- padding performed by strscpy_pad() is unnecessary. The size parameter is optional, and strscpy() automatically determines the size of the destination buffer using sizeof() when the argument is omitted. RPMSG_NAME_SIZE is equal to sizeof(rpdev->id.name) and can be removed - remove it. No functional changes intended. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250429104543.66927-2-thorsten.blum@linux.dev Signed-off-by: Bjorn Andersson commit 5a427fddec5e76360725a0f03df3a2a003efbe2e Author: Yonghong Song Date: Fri Sep 19 21:58:05 2025 -0700 selftests/bpf: Fix selftest verifier_arena_large failure With latest llvm22, I got the following verification failure: ... ; int big_alloc2(void *ctx) @ verifier_arena_large.c:207 0: (b4) w6 = 1 ; R6_w=1 ... ; if (err) @ verifier_arena_large.c:233 53: (56) if w6 != 0x0 goto pc+62 ; R6=0 54: (b7) r7 = -4 ; R7_w=-4 55: (18) r8 = 0x7f4000000000 ; R8_w=scalar() 57: (bf) r9 = addr_space_cast(r8, 0, 1) ; R8_w=scalar() R9_w=arena 58: (b4) w6 = 5 ; R6_w=5 ; pg = page[i]; @ verifier_arena_large.c:238 59: (bf) r1 = r7 ; R1_w=-4 R7_w=-4 60: (07) r1 += 4 ; R1_w=0 61: (79) r2 = *(u64 *)(r9 +0) ; R2_w=scalar() R9_w=arena ; if (*pg != i) @ verifier_arena_large.c:239 62: (bf) r3 = addr_space_cast(r2, 0, 1) ; R2_w=scalar() R3_w=arena 63: (71) r3 = *(u8 *)(r3 +0) ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 64: (5d) if r1 != r3 goto pc+51 ; R1_w=0 R3_w=0 ; bpf_arena_free_pages(&arena, (void __arena *)pg, 2); @ verifier_arena_large.c:241 65: (18) r1 = 0xff11000114548000 ; R1_w=map_ptr(map=arena,ks=0,vs=0) 67: (b4) w3 = 2 ; R3_w=2 68: (85) call bpf_arena_free_pages#72675 ; 69: (b7) r1 = 0 ; R1_w=0 ; page[i + 1] = NULL; @ verifier_arena_large.c:243 70: (7b) *(u64 *)(r8 +8) = r1 R8 invalid mem access 'scalar' processed 61 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 2 ============= #489/5 verifier_arena_large/big_alloc2:FAIL The main reason is that 'r8' in insn '70' is not an arena pointer. Further debugging at llvm side shows that llvm commit ([1]) caused the failure. For the original code: page[i] = NULL; page[i + 1] = NULL; the llvm transformed it to something like below at source level: __builtin_memset(&page[i], 0, 16) Such transformation prevents llvm BPFCheckAndAdjustIR pass from generating proper addr_space_cast insns ([2]). Adding support in llvm BPFCheckAndAdjustIR pass should work, but not sure that such a pattern exists or not in real applications. At the same time, simply adding a memory barrier between two 'page' assignment can fix the issue. [1] https://github.com/llvm/llvm-project/pull/155415 [2] https://github.com/llvm/llvm-project/pull/84410 Cc: Eduard Zingerman Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250920045805.3288551-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit fdbdd0ccb30af18d3b29e714ac8d5ab6163279e0 Author: Colin Ian King Date: Wed May 7 11:43:37 2025 +0100 kdb: remove redundant check for scancode 0xe0 The check for scancode 0xe0 is always false because earlier on the scan code is masked with 0x7f so there are never going to be values greater than 0x7f. Remove the redundant check. Signed-off-by: Colin Ian King Reviewed-by: Douglas Anderson Signed-off-by: Daniel Thompson (RISCstar) commit 0c28a23722e03695ae1cbbadde3dd32d75c1cb7f Author: Thorsten Blum Date: Tue Aug 19 11:59:06 2025 +0200 kdb: Replace deprecated strcpy() with helper function in kdb_defcmd() strcpy() is deprecated; use the new helper function kdb_strdup_dequote() instead. In addition to string duplication similar to kdb_strdup(), it also trims surrounding quotes from the input string if present. kdb_strdup_dequote() also checks for a trailing quote in the input string which was previously not checked. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Douglas Anderson Signed-off-by: Thorsten Blum Signed-off-by: Daniel Thompson (RISCstar) commit 5b26f1a3146454a24dbcb8b1cdae5d507f7432e6 Author: Thorsten Blum Date: Tue Aug 19 11:59:05 2025 +0200 kdb: Replace deprecated strcpy() with memcpy() in parse_grep() strcpy() is deprecated; use memcpy() instead. We can safely use memcpy() because we already know the length of the source string 'cp' and that it is guaranteed to be NUL-terminated within the first KDB_GREP_STRLEN bytes. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Douglas Anderson Signed-off-by: Thorsten Blum Signed-off-by: Daniel Thompson (RISCstar) commit 8790cc2940bf9f5ec4d7458b0ea7f94a8acb094f Author: Thorsten Blum Date: Tue Aug 19 11:59:04 2025 +0200 kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() strcpy() is deprecated and its behavior is undefined when the source and destination buffers overlap. Use memmove() instead to avoid any undefined behavior. Adjust comments for clarity. Link: https://github.com/KSPP/linux/issues/88 Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)") Reviewed-by: Douglas Anderson Signed-off-by: Thorsten Blum Signed-off-by: Daniel Thompson (RISCstar) commit d4be3238d9e5f4841e5385cba3d81268c00d9e7d Author: Thorsten Blum Date: Tue Aug 19 11:59:03 2025 +0200 kdb: Replace deprecated strcpy() with memcpy() in kdb_strdup() strcpy() is deprecated; use memcpy() instead. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Douglas Anderson Signed-off-by: Thorsten Blum Signed-off-by: Daniel Thompson (RISCstar) commit 05c81eddc44733fee60d4c55508c76017995900e Author: Thorsten Blum Date: Mon Aug 18 01:13:49 2025 +0200 kernel: debug: gdbstub: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Douglas Anderson Signed-off-by: Thorsten Blum Signed-off-by: Daniel Thompson (RISCstar) commit 4386f71623b77215c9502e60fc399e76ec337fec Author: Colin Ian King Date: Fri Sep 19 17:57:11 2025 +0100 selftest/futex: Fix spelling mistake "boundarie" -> "boundary" There is a spelling mistake in a test message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner commit 520db0559deff096c33a95dd3be2583e02771261 Author: André Almeida Date: Wed Sep 17 18:21:54 2025 -0300 selftests/futex: Remove logging.h file Every futex selftest uses the kselftest_harness.h helper and don't need the logging.h file. Delete it. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit b257d91c4db5bafcc3f67eab120e75bda4f61137 Author: André Almeida Date: Wed Sep 17 18:21:53 2025 -0300 selftests/futex: Drop logging.h include from futex_numa futex_numa doesn't really use logging.h helpers, it's only need two includes from this file. So drop it and include the two missing includes. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit d35ca2f642726a2c8a85c5b864fd05f59f3965af Author: André Almeida Date: Wed Sep 17 18:21:52 2025 -0300 selftests/futex: Refactor futex_numa_mpol with kselftest_harness.h To reduce the boilerplate code, refactor futex_numa_mpol test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 4ba629e6c6dc6eef1a6b96dc06c140e622a8f836 Author: André Almeida Date: Wed Sep 17 18:21:51 2025 -0300 selftests/futex: Refactor futex_priv_hash with kselftest_harness.h To reduce the boilerplate code, refactor futex_priv_hash test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit a91e8e372e4f1ecce2a87905d4fa437865158b1e Author: André Almeida Date: Wed Sep 17 18:21:50 2025 -0300 selftests/futex: Refactor futex_waitv with kselftest_harness.h To reduce the boilerplate code, refactor futex_waitv test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit f341a20f6d7e25669b2fdf2b071bdd92962e5897 Author: André Almeida Date: Wed Sep 17 18:21:49 2025 -0300 selftests/futex: Refactor futex_requeue with kselftest_harness.h To reduce the boilerplate code, refactor futex_requeue test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit e5c04d0f3ea0dfa4858a449ff3153bc3cef6a140 Author: André Almeida Date: Wed Sep 17 18:21:48 2025 -0300 selftests/futex: Refactor futex_wait with kselftest_harness.h To reduce the boilerplate code, refactor futex_wait test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 14d016bd72822c0464e9aed4b6a620474923818d Author: André Almeida Date: Wed Sep 17 18:21:47 2025 -0300 selftests/futex: Refactor futex_wait_private_mapped_file with kselftest_harness.h To reduce the boilerplate code, refactor futex_wait_private_mapped_file test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit af3c79f8575d751914d1175c02dc024ecc173c58 Author: André Almeida Date: Wed Sep 17 18:21:46 2025 -0300 selftests/futex: Refactor futex_wait_unitialized_heap with kselftest_harness.h To reduce the boilerplate code, refactor futex_wait_unitialized_heap test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit f5a16834410a89f929657d9b8a5a4011c05293c8 Author: André Almeida Date: Wed Sep 17 18:21:45 2025 -0300 selftests/futex: Refactor futex_wait_wouldblock with kselftest_harness.h To reduce the boilerplate code, refactor futex_wait_wouldblock test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 0c02abf6389e01a3b78091394bc9624d5f1d84fb Author: André Almeida Date: Wed Sep 17 18:21:44 2025 -0300 selftests/futex: Refactor futex_wait_timeout with kselftest_harness.h To reduce the boilerplate code, refactor futex_wait_timeout test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 2ef0615685094f6c7ad7e18498759f90015b7de8 Author: André Almeida Date: Wed Sep 17 18:21:43 2025 -0300 selftests/futex: Refactor futex_requeue_pi_signal_restart with kselftest_harness.h To reduce the boilerplate code, refactor futex_requeue_pi_signal_restart test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 65a12ce20fb27067c0d946e7dcf83b9c9ff365fd Author: André Almeida Date: Wed Sep 17 18:21:42 2025 -0300 selftests/futex: Refactor futex_requeue_pi_mismatched_ops with kselftest_harness.h To reduce the boilerplate code, refactor futex_requeue_pi_mismatched_ops test to use kselftest_harness header instead of futex's logging header. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit d060495a37cb437459b3d202572d48a73bee8a66 Author: André Almeida Date: Wed Sep 17 18:21:41 2025 -0300 selftests/futex: Refactor futex_requeue_pi with kselftest_harness.h To reduce the boilerplate code, refactor futex_requeue_pi test to use kselftest_harness header instead of futex's logging header. Use kselftest fixture feature to make it easy to repeat the same test with different parameters. With that, drop all repetitive test calls from run.sh. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit f2662ec26b26adb71783fa5e5ee75aff6f18a940 Author: André Almeida Date: Wed Sep 17 18:21:40 2025 -0300 selftests: kselftest: Create ksft_print_dbg_msg() Create ksft_print_dbg_msg() so testers can enable extra debug messages when running a test with the flag -d. Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 Author: Pranav Tyagi Date: Mon Sep 15 23:51:54 2025 +0530 futex: Don't leak robust_list pointer on exec race sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer. This check is racy against a concurrent exec() in the target process. During exec(), a task may transition from a non-privileged binary to a privileged one (e.g., setuid binary) and its credentials/memory mappings may change. If get_robust_list() performs ptrace_may_access() before this transition, it may erroneously allow access to sensitive information after the target becomes privileged. A racy access allows an attacker to exploit a window during which ptrace_may_access() passes before a target process transitions to a privileged state via exec(). For example, consider a non-privileged task T that is about to execute a setuid-root binary. An attacker task A calls get_robust_list(T) while T is still unprivileged. Since ptrace_may_access() checks permissions based on current credentials, it succeeds. However, if T begins exec immediately afterwards, it becomes privileged and may change its memory mappings. Because get_robust_list() proceeds to access T->robust_list without synchronizing with exec() it may read user-space pointers from a now-privileged process. This violates the intended post-exec access restrictions and could expose sensitive memory addresses or be used as a primitive in a larger exploit chain. Consequently, the race can lead to unauthorized disclosure of information across privilege boundaries and poses a potential security risk. Take a read lock on signal->exec_update_lock prior to invoking ptrace_may_access() and accessing the robust_list/compat_robust_list. This ensures that the target task's exec state remains stable during the check, allowing for consistent and synchronized validation of credentials. Suggested-by: Jann Horn Signed-off-by: Pranav Tyagi Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/ Link: https://github.com/KSPP/linux/issues/119 commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 Author: Hari Chandrakanthan Date: Thu Jul 24 09:35:52 2025 +0530 wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because rxcb->peer_id is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular RX descriptor path that typically sets rxcb->peer_id. As a result, the peer is NULL, and link_id and link_valid fields in the RX status are not populated. This leads to a WARN_ON in mac80211 when it receives data frame from an associated station with invalid link_id. Fix this potential issue by using ppduinfo->peer_id, which holds the correct peer id for the received frame. This ensures that the peer is correctly found and the associated link metadata is updated accordingly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info") Signed-off-by: Hari Chandrakanthan Signed-off-by: Aishwarya R Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 755a18469ca4eca3b5bb4f52704b7708a9106db9 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:53 2025 -0600 ublk: don't access ublk_queue in ublk_unmap_io() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_unmap_io() is a frequent cache miss. Pass to __ublk_complete_rq() whether the ublk server's data buffer needs to be copied to the request. In the callers __ublk_fail_req() and ublk_ch_uring_cmd_local(), get the flags from the ublk_device instead, as its flags have just been read. In ublk_put_req_ref(), pass false since all the features that require reference counting disable copying of the data buffer upon completion. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 97a02be6303646e19e9092042928b0e13543305c Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:52 2025 -0600 ublk: pass ublk_io to __ublk_complete_rq() All callers of __ublk_complete_rq() already know the ublk_io. Pass it in to avoid looking it up again. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 122f6387e845dfbfcf1ed795734a1ec779e987f0 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:51 2025 -0600 ublk: don't access ublk_queue in ublk_need_complete_req() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_need_complete_req() is a frequent cache miss. Get the flags from the ublk_device instead, which is accessed earlier in ublk_ch_uring_cmd_local(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit be7962d7e3d9dd9ff5b6bcd3faccb3b0f76a9734 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:50 2025 -0600 ublk: don't access ublk_queue in ublk_check_commit_and_fetch() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_check_commit_and_fetch() is a frequent cache miss. Get the flags from the ublk_device instead, which is accessed earlier in ublk_ch_uring_cmd_local(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 3576e60a33c7f6be024b80f8c87312032fd27892 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:49 2025 -0600 ublk: don't pass ublk_queue to ublk_fetch() ublk_fetch() only uses the ublk_queue to get the ublk_device, which its caller already has. So just pass the ublk_device directly. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 23c014448e97d4b59c54816f545ab963bf8dd644 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:48 2025 -0600 ublk: don't access ublk_queue in ublk_config_io_buf() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_config_io_buf() is a frequent cache miss. Get the flags from the ublk_device instead, which is accessed earlier in ublk_ch_uring_cmd_local(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit a689efd5fde7b39cfbcf43267bccf0e56295cc16 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:47 2025 -0600 ublk: don't access ublk_queue in ublk_check_fetch_buf() Obtain the ublk device flags from ublk_device to avoid needing to access the ublk_queue, which may be a cache miss. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 25c028aa791503fe0876c20bfd67b2676e6e24d0 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:46 2025 -0600 ublk: pass q_id and tag to __ublk_check_and_get_req() __ublk_check_and_get_req() only uses its ublk_queue argument to get the q_id and tag. Pass those arguments explicitly to save an access to the ublk_queue. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit ce88e3ef33d35c740d26342be5d8f65972fd5597 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:45 2025 -0600 ublk: don't access ublk_queue in ublk_daemon_register_io_buf() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_daemon_register_io_buf() is a frequent cache miss. Get the flags from the ublk_device instead, which is accessed earlier in ublk_ch_uring_cmd_local(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 692cf47e1af39f86f28069db5ca6b00a7d2daddc Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:44 2025 -0600 ublk: don't access ublk_queue in ublk_register_io_buf() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_register_io_buf() is a frequent cache miss. Get the flags from the ublk_device instead, which is accessed earlier in ublk_ch_uring_cmd_local(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 8a81926e45670c6d9b6e73e0482485d5c9a627e6 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:43 2025 -0600 ublk: pass ublk_device to ublk_register_io_buf() Avoid repeating the 2 dereferences to get the ublk_device from the io_uring_cmd by passing it from ublk_ch_uring_cmd_local() to ublk_register_io_buf(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit b40dcdf8235d536072b9f61eb6d291f0f3720768 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:42 2025 -0600 ublk: don't dereference ublk_queue in ublk_check_and_get_req() For ublk servers with many ublk queues, accessing the ublk_queue in ublk_ch_{read,write}_iter() is a frequent cache miss. Get the flags and queue depth from the ublk_device instead, which is accessed just before. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 5125535f90564117506d926d0de92c4c2622b720 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:41 2025 -0600 ublk: don't dereference ublk_queue in ublk_ch_uring_cmd_local() For ublk servers with many ublk queues, accessing the ublk_queue to handle a ublk command is a frequent cache miss. Get the queue depth from the ublk_device instead, which is accessed just before. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit d74a383ec70de33ae6577af889556747d6693269 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:40 2025 -0600 ublk: add helpers to check ublk_device flags Introduce ublk_device analogues of the ublk_queue flag helpers: - ublk_support_zero_copy() -> ublk_dev_support_user_copy() - ublk_support_auto_buf_reg() -> ublk_dev_support_auto_buf_reg() - ublk_support_user_copy() -> ublk_dev_support_user_copy() - ublk_need_map_io() -> ublk_dev_need_map_io() - ublk_need_req_ref() -> ublk_dev_need_req_ref() - ublk_need_get_data() -> ublk_dev_need_get_data() These will be used in subsequent changes to avoid accessing the ublk_queue just for the flags, and instead use the ublk_device. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 0265595002b989db8e0c32dc33624fa61a974b20 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:39 2025 -0600 ublk: don't pass ublk_queue to __ublk_fail_req() __ublk_fail_req() only uses the ublk_queue to get the ublk_device, which its caller already has. So just pass the ublk_device directly. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit b7e255b0340b5319fca4fe076119d0f929a24305 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:38 2025 -0600 ublk: don't pass q_id to ublk_queue_cmd_buf_size() ublk_queue_cmd_buf_size() only needs the queue depth, which is the same for all queues. Get the queue depth from the ublk_device instead so the q_id parameter can be dropped. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 163f80dabf4f0c4d9e6c39e0dba474814dac78f8 Author: Caleb Sander Mateos Date: Wed Sep 17 19:49:37 2025 -0600 ublk: remove ubq check in ublk_check_and_get_req() ublk_get_queue() never returns a NULL pointer, so there's no need to check its return value in ublk_check_and_get_req(). Drop the check. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 79525b51acc1c8e331ab47eb131a99f5370a76c2 Author: Keith Busch Date: Fri Sep 19 12:38:58 2025 -0700 io_uring: fix nvme's 32b cqes on mixed cq The nvme uring_cmd only uses 32b CQEs. If the ring uses a mixed CQ, then we need to make sure we flag the completion as a 32b CQE. On the other hand, if nvme uring_cmd was using a dedicated 32b CQE, the posting was missing the extra memcpy because it only applied to bit CQEs on a mixed CQ. Fixes: e26dca67fde1943 ("io_uring: add support for IORING_SETUP_CQE_MIXED") Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit b73f28d2f847c24ca5d858a79fd37055036b0a67 Author: Thorsten Blum Date: Sun Sep 14 16:25:55 2025 +0200 crypto: anubis - simplify return statement in anubis_mod_init Return the result of calling crypto_register_alg() directly and remove the local return variable. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit f0cafb02de883b3b413d34eb079c9680782a9cc1 Author: Chenghai Huang Date: Sat Sep 13 18:57:54 2025 +0800 crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs When the initialization of qm->debug.acc_diff_reg fails, the probe process does not exit. However, after qm->debug.qm_diff_regs is freed, it is not set to NULL. This can lead to a double free when the remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs should be set to NULL after it is freed. Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 64b9642fc29a14e1fe67842be9c69c7b90a3bcd6 Author: Weili Qian Date: Sat Sep 13 18:57:53 2025 +0800 crypto: hisilicon/qm - clear all VF configurations in the hardware When disabling SR-IOV, clear the configuration of each VF in the hardware. Do not exit the configuration clearing process due to the failure of a single VF. Additionally, Clear the VF configurations before decrementing the PM counter. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 80736a97cf94eeb02da6de6cfbc5a74514c85a16 Author: Weili Qian Date: Sat Sep 13 18:57:52 2025 +0800 crypto: hisilicon - enable error reporting again When an error occurs on the device, an interrupt is reported. When the firmware forwards the interrupt to the driver and masks the error. If the driver does not enable error reporting when an error does not need to be reset, the device does not report the error to the driver when the error occurs again. Therefore, after the driver obtains the information, the error reporting needs to be enabled again. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 3d716c51e0e8791f8dd72479a3e6d5e7650ac35e Author: Weili Qian Date: Sat Sep 13 18:57:51 2025 +0800 crypto: hisilicon/qm - mask axi error before memory init After the device memory is cleared, if the software sends the doorbell operation, the hardware may trigger a axi error when processing the doorbell. This error is caused by memory clearing and hardware access to address 0. Therefore, the axi error is masked during this period. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 85acd1b26b8f5b838887dc965dc3aa2c0253f4d1 Author: Weili Qian Date: Sat Sep 13 18:57:50 2025 +0800 crypto: hisilicon/qm - invalidate queues in use Before the device reset, although the driver has set the queue status to intercept doorbells sent by the task process, the reset thread is isolated from the user-mode task process, so the task process may still send doorbells. Therefore, before the reset, the queue is directly invalidated, and the device directly discards the doorbells sent by the process. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 Author: Herbert Xu Date: Sat Sep 13 12:24:55 2025 +0800 crypto: qat - Return pointer directly in adf_ctl_alloc_resources Returning values through arguments is confusing and that has upset the compiler with the recent change to memdup_user: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] 308 | ctl_data->device_id); | ^~ ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here 294 | struct adf_user_cfg_ctl_data *ctl_data; | ^~~~~~~~ In function ‘adf_ctl_ioctl_dev_stop’, inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id); | ~~~~~~~~^~~~~~~~~~~ ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here 261 | struct adf_user_cfg_ctl_data *ctl_data; | ^~~~~~~~ In function ‘adf_ctl_ioctl_dev_config’, inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); | ~~~~~~~~^~~~~~~~~~~ ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here 185 | struct adf_user_cfg_ctl_data *ctl_data; | ^~~~~~~~ Fix this by returning the pointer directly. Signed-off-by: Herbert Xu Reviewed-by: Thorsten Blum Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 838d2d51513e6d2504a678e906823cfd2ecaaa22 Author: Thomas Fourier Date: Wed Sep 10 10:22:31 2025 +0200 crypto: aspeed - Fix dma_unmap_sg() direction It seems like everywhere in this file, when the request is not bidirectionala, req->src is mapped with DMA_TO_DEVICE and req->dst is mapped with DMA_FROM_DEVICE. Fixes: 62f58b1637b7 ("crypto: aspeed - add HACE crypto driver") Cc: Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit bee8a520eb84950193d0566ea2c2e46406a4b6ce Author: Herbert Xu Date: Tue Sep 9 17:50:56 2025 +0800 rhashtable: Use rcu_dereference_all and rcu_dereference_all_check Add rcu_dereference_all and rcu_dereference_all_check so that library code such as rhashtable can be used with any RCU variant. As it stands rcu_dereference is used within rashtable, which creates false-positive warnings if the user calls it from another RCU context, such as preempt_disable(). Use the rcu_dereference_all and rcu_dereference_all_check calls in rhashtable to suppress these warnings. Also replace the rcu_dereference_raw calls in the list iterators with rcu_dereference_all to uncover buggy calls. Reported-by: Menglong Dong Signed-off-by: Herbert Xu Reviewed-by: Paul E. McKenney Signed-off-by: Herbert Xu commit f75f66683ded09f7135aef2e763c245a07c8271a Author: Dan Moulding Date: Mon Sep 8 10:12:43 2025 -0600 crypto: comp - Use same definition of context alloc and free ops In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the crypto_acomp_streams struct was made to rely on having the alloc_ctx and free_ctx operations defined in the same order as the scomp_alg struct. But in that same commit, the alloc_ctx and free_ctx members of scomp_alg may be randomized by structure layout randomization, since they are contained in a pure ops structure (containing only function pointers). If the pointers within scomp_alg are randomized, but those in crypto_acomp_streams are not, then the order may no longer match. This fixes the problem by removing the union from scomp_alg so that both crypto_acomp_streams and scomp_alg will share the same definition of alloc_ctx and free_ctx, ensuring they will always have the same layout. Signed-off-by: Dan Moulding Suggested-by: Herbert Xu Fixes: 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp") Signed-off-by: Herbert Xu commit 181ce6b01ad52aeb791545edbae0b92648c6428d Merge: 47f15744fcf915 5d20605c8e7930 Author: Marc Zyngier Date: Sat Sep 20 12:26:29 2025 +0100 Merge branch kvm-arm64/misc-6.18 into kvmarm-master/next * kvm-arm64/misc-6.18: : . : . : Misc improvements and bug fixes: : : - Fix XN handling in the S2 page table dumper : (20250809135356.1003520-1-r09922117@csie.ntu.edu.tw) : : - Fix sanitity checks for huge mapping with pKVM running np guests : (20250815162655.121108-1-ben.horgan@arm.com) : : - Fix use of TRBE when KVM is disabled, and Linux running under : a lesser hypervisor (20250902-etm_crash-v2-1-aa9713a7306b@oss.qualcomm.com) : : - Fix out of date MTE-related comments (20250915155234.196288-1-alexandru.elisei@arm.com) : : - Fix PSCI BE support when running a NV guest (20250916161103.1040727-1-maz@kernel.org) : : - Fix page reference leak when refusing to map a page due to mismatched attributes : (20250917130737.2139403-1-tabba@google.com) : : - Add trap handling for PMSDSFR_EL1 : (20250901-james-perf-feat_spe_eft-v8-7-2e2738f24559@linaro.org) : : - Add advertisement from FEAT_LSFE (Large System Float Extension) : (20250918-arm64-lsfe-v4-1-0abc712101c7@kernel.org) : . KVM: arm64: Expose FEAT_LSFE to guests KVM: arm64: Add trap configs for PMSDSFR_EL1 KVM: arm64: Fix page leak in user_mem_abort() KVM: arm64: Fix kvm_vcpu_{set,is}_be() to deal with EL2 state KVM: arm64: Update stale comment for sanitise_mte_tags() KVM: arm64: Return early from trace helpers when KVM isn't available KVM: arm64: Fix debug checking for np-guests using huge mappings KVM: arm64: ptdump: Don't test PTE_VALID alongside other attributes Signed-off-by: Marc Zyngier commit 47f15744fcf91587afcd228a3c206a978f3d034b Merge: 46bd74ef07a8a9 5aea4096380f5b Author: Marc Zyngier Date: Sat Sep 20 12:26:24 2025 +0100 Merge branch kvm-arm64/nv-misc-6.18 into kvmarm-master/next * kvm-arm64/nv-misc-6.18: : . : Various NV-related fixes: : : - Relax KVM's SError injection to consider that HCR_EL2.AMO's : effective value is 1 when HCR_EL2.{E2H,TGE)=={1,0}. : (20250918164632.410404-1-oliver.upton@linux.dev) : : - Allow userspace to disable some S2 base granule sizes : (20250918165505.415017-1-oliver.upton@linux.dev) : . KVM: arm64: nv: Allow userspace to de-feature stage-2 TGRANs KVM: arm64: nv: Treat AMO as 1 when at EL2 and {E2H,TGE} = {1, 0} Signed-off-by: Marc Zyngier commit 46bd74ef07a8a9c4085d03595fce2bfc2a38f03a Merge: f01c7baa16bf28 b8b1d62f17d6fb Author: Marc Zyngier Date: Sat Sep 20 12:26:18 2025 +0100 Merge branch kvm-arm64/el2-feature-control into kvmarm-master/next * kvm-arm64/el2-feature-control: (23 commits) : . : General rework of EL2 features that can be disabled to satisfy : the requirement of migration between heterogeneous hosts: : : - Handle effective RES0 behaviour of undefined registers, making sure : that disabling a feature affects full registeres, and not just : individual control bits. (20250918151402.1665315-1-maz@kernel.org) : : - Allow ID_AA64MMFR1_EL1.{TWED,HCX} to be disabled from userspace. : (20250911114621.3724469-1-yangjinqian1@huawei.com) : : - Turn the NV feature management into a deny-list, and expose : missing features to EL2 guests. : (20250912212258.407350-1-oliver.upton@linux.dev) : . KVM: arm64: nv: Expose up to FEAT_Debugv8p8 to NV-enabled VMs KVM: arm64: nv: Advertise FEAT_TIDCP1 to NV-enabled VMs KVM: arm64: nv: Advertise FEAT_SpecSEI to NV-enabled VMs KVM: arm64: nv: Expose FEAT_TWED to NV-enabled VMs KVM: arm64: nv: Exclude guest's TWED configuration when TWE isn't set KVM: arm64: nv: Expose FEAT_AFP to NV-enabled VMs KVM: arm64: nv: Expose FEAT_ECBHB to NV-enabled VMs KVM: arm64: nv: Expose FEAT_RASv1p1 via RAS_frac KVM: arm64: nv: Expose FEAT_DF2 to NV-enabled VMs KVM: arm64: nv: Don't erroneously claim FEAT_DoubleLock for NV VMs KVM: arm64: nv: Convert masks to denylists in limit_nv_id_reg() KVM: arm64: selftests: Test writes to ID_AA64MMFR1_EL1.{HCX, TWED} KVM: arm64: Make ID_AA64MMFR1_EL1.{HCX, TWED} writable from userspace KVM: arm64: Convert MDCR_EL2 RES0 handling to compute_reg_res0_bits() KVM: arm64: Convert SCTLR_EL1 RES0 handling to compute_reg_res0_bits() KVM: arm64: Enforce absence of FEAT_TCR2 on TCR2_EL2 KVM: arm64: Enforce absence of FEAT_SCTLR2 on SCTLR2_EL{1,2} KVM: arm64: Convert HCR_EL2 RES0 handling to compute_reg_res0_bits() KVM: arm64: Enforce absence of FEAT_HCX on HCRX_EL2 KVM: arm64: Enforce absence of FEAT_FGT2 on FGT2 registers ... Signed-off-by: Marc Zyngier commit f01c7baa16bf28a579e48739df287408720e2844 Merge: d9476fd35636f7 3af1105c4fa362 Author: Marc Zyngier Date: Sat Sep 20 12:26:11 2025 +0100 Merge branch kvm-arm64/nv-debug into kvmarm-master/next * kvm-arm64/nv-debug: : . : Fix handling of MDSCR_EL1 in NV context, which is unfortunately : mishandled by the architecture. Patches courtesy of Oliver Upton : (20250917203125.283116-2-oliver.upton@linux.dev) : . KVM: arm64: nv: Apply guest's MDCR traps in nested context KVM: arm64: nv: Trap debug registers when in hyp context Signed-off-by: Marc Zyngier commit d9476fd35636f7ae5b8f94fed7011d351544125e Merge: 8cba6c8b87c55f 5c5db9efe323dd Author: Marc Zyngier Date: Sat Sep 20 12:26:05 2025 +0100 Merge branch kvm-arm64/gic-v5-nv into kvmarm-master/next * kvm-arm64/gic-v5-nv: : . : Add NV support to GICv5 in GICv3 emulation mode, ensuring that the v3 : guest support is identical to that of a pure v3 platform. : : Patches courtesy of Sascha Bischoff (20250828105925.3865158-1-sascha.bischoff@arm.com) : . irqchip/gic-v5: Drop has_gcie_v3_compat from gic_kvm_info KVM: arm64: Use ARM64_HAS_GICV5_LEGACY for GICv5 probing arm64: cpucaps: Add GICv5 Legacy vCPU interface (GCIE_LEGACY) capability KVM: arm64: Enable nested for GICv5 host with FEAT_GCIE_LEGACY KVM: arm64: Don't access ICC_SRE_EL2 if GICv3 doesn't support v2 compatibility Signed-off-by: Marc Zyngier commit 8cba6c8b87c55f14ea2c4c3173f4e01b60d7ae62 Merge: 32314d940ee6c7 00a37271c8a680 Author: Marc Zyngier Date: Sat Sep 20 12:25:57 2025 +0100 Merge branch kvm-arm64/52bit-at into kvmarm-master/next * kvm-arm64/52bit-at: : . : Upgrade the S1 page table walker to support 52bit PA, and use it to : report the fault level when taking a S2 fault on S1PTW, which is required : by the architecture (20250915114451.660351-1-maz@kernel.org). : . KVM: arm64: selftest: Expand external_aborts test to look for TTW levels KVM: arm64: Populate level on S1PTW SEA injection KVM: arm64: Add S1 IPA to page table level walker KVM: arm64: Add filtering hook to S1 page table walk KVM: arm64: Don't switch MMU on translation from non-NV context KVM: arm64: Allow EL1 control registers to be accessed from the CPU state KVM: arm64: Allow use of S1 PTW for non-NV vcpus KVM: arm64: Report faults from S1 walk setup at the expected start level KVM: arm64: Expand valid block mappings to FEAT_LPA/LPA2 support KVM: arm64: Populate PAR_EL1 with 52bit addresses KVM: arm64: Compute shareability for LPA2 KVM: arm64: Pass the walk_info structure to compute_par_s1() KVM: arm64: Decouple output address from the PT descriptor KVM: arm64: Compute 52bit TTBR address and alignment KVM: arm64: Account for 52bit when computing maximum OA KVM: arm64: Add helper computing the state of 52bit PA support Signed-off-by: Marc Zyngier commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f Author: Rafael J. Wysocki Date: Fri Sep 19 13:22:20 2025 +0200 cpuidle: Fail cpuidle device registration if there is one already Refuse to register a cpuidle device if the given CPU has a cpuidle device already and print a message regarding it. Without this, an attempt to register a new cpuidle device without unregistering the existing one leads to the removal of the existing cpuidle device without removing its sysfs interface. Signed-off-by: Rafael J. Wysocki commit 8dba0fd9cee34b80d6e26a188115e5427773285a Author: Vivek Yadav Date: Fri Sep 19 22:26:57 2025 +0530 cpuidle: sysfs: Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() The ->show() callbacks in sysfs should use sysfs_emit() or sysfs_emit_at() when formatting values for user space. These helpers are the recommended way to ensure correct buffer handling and consistency across the kernel. See Documentation/filesystems/sysfs.rst for details. No functional change intended. Suggested-by: Joe Perches Signed-off-by: Vivek Yadav Link: https://patch.msgid.link/20250919165657.233349-1-vivekyadav1207731111@gmail.com [ rjw: Minor subject edits ] Signed-off-by: Rafael J. Wysocki commit 00a37271c8a68070dc64f81a5d64644beb4cef2f Author: Marc Zyngier Date: Tue Aug 26 17:33:24 2025 +0100 KVM: arm64: selftest: Expand external_aborts test to look for TTW levels Add a basic test corrupting a level-2 table entry to check that the resulting abort is a SEA on a PTW at level-3. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 50f77dc87f133b09db44a5bbfdd64b1ca83a8d8e Author: Marc Zyngier Date: Mon Aug 25 13:13:56 2025 +0100 KVM: arm64: Populate level on S1PTW SEA injection Our fault injection mechanism is mildly primitive, and doesn't really implement the architecture when it comes to reporting the level of a failing S1 PTW (we blindly report a SEA outside of a PTW). Now that we can walk the S1 page tables and look for a particular IPA in the descriptors, it is pretty easy to improve the SEA injection code. Note that we only do it for AArch64 guests, and that 32bit guests are left to their own device (oddly enough, I don't fancy writing a 32bit PTW...). Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit b8e625167a321138f83b1f6c99cf25d1290cb04e Author: Marc Zyngier Date: Mon Aug 25 11:31:33 2025 +0100 KVM: arm64: Add S1 IPA to page table level walker Use the filtering hook infrastructure to implement a new walker that, for a given VA and an IPA, returns the level of the first occurence of this IPA in the walk from that VA. This will be used to improve our SEA syndrome reporting. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0c5471408cb5c518bce76b851aff89719283a428 Author: Marc Zyngier Date: Mon Aug 25 11:28:19 2025 +0100 KVM: arm64: Add filtering hook to S1 page table walk Add a filtering hook that can get called on each level of the walk, and providing access to the full state. Crucially, this is called *before* the access is made, so that it is possible to track down the level of a faulting access. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 61b0280a670bdbb3a209ae474625f387788af0a8 Author: Marc Zyngier Date: Mon Aug 25 11:24:11 2025 +0100 KVM: arm64: Don't switch MMU on translation from non-NV context If calling into the AT code from guest EL1, there is no need to consider any context switch, as we are guaranteed to be in the correct context. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit cb1762904c5000220a0facf9bcab68ba687ec417 Author: Marc Zyngier Date: Mon Aug 25 15:20:06 2025 +0100 KVM: arm64: Allow EL1 control registers to be accessed from the CPU state As we are about to plug the SW PTW into the EL1-only code, we can no longer assume that the EL1 state is not resident on the CPU, as we don't necessarily get there from EL2 traps. Turn the __vcpu_sys_reg() access on the EL1 state into calls to the vcpu_read_sys_reg() helper, which is guaranteed to do the right thing. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 14d4802dc22acf670333c8aad4e1931e7d6ee412 Author: Marc Zyngier Date: Tue Jul 29 12:06:14 2025 +0100 KVM: arm64: Allow use of S1 PTW for non-NV vcpus As we are about to use the S1 PTW in non-NV contexts, we must make sure that we don't evaluate the EL2 state when dealing with the EL1&0 translation regime. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit dabf9f73fed86e096255c5be12c7e1d08a939c67 Author: Marc Zyngier Date: Mon Jul 28 17:20:29 2025 +0100 KVM: arm64: Report faults from S1 walk setup at the expected start level Translation faults from TTBR must be reported on the start level, and not level-0. Enforcing this requires moving quite a lot of code around so that the start level can be computed early enough that it is usable. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 5da3a3b27a0108562547086e0ba7d9593f147cfe Author: Marc Zyngier Date: Mon Jul 28 16:29:56 2025 +0100 KVM: arm64: Expand valid block mappings to FEAT_LPA/LPA2 support With 52bit PAs, block mappings can exist at different levels (such as level 0 for 4kB pages, or level 1 for 16kB and 64kB pages). Account for this in walk_s1(). Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit dd82412c2b2b30bf4aa08ef069eb38c7795cd9b8 Author: Marc Zyngier Date: Sun Jul 27 19:47:00 2025 +0100 KVM: arm64: Populate PAR_EL1 with 52bit addresses Expand the output address populated in PAR_EL1 to 52bit addresses. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit c0cc438046eed8d906ac917bc70a7284b6cc3f03 Author: Marc Zyngier Date: Sun Jul 27 19:37:01 2025 +0100 KVM: arm64: Compute shareability for LPA2 LPA2 gets the memory access shareability from TCR_ELx instead of getting it form the descriptors. Store it in the walk info struct so that it is passed around and evaluated as required. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit e4bd479884a1353efd43aa950c996d333145642d Author: Marc Zyngier Date: Mon Aug 25 14:48:32 2025 +0100 KVM: arm64: Pass the walk_info structure to compute_par_s1() Instead of just passing the translation regime, pass the full walk_info structure to compute_par_s1(). This will help further chamges that will require it. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit df1d0197a2b939e28321686cafaead4a183980fa Author: Marc Zyngier Date: Sun Jul 27 18:46:02 2025 +0100 KVM: arm64: Decouple output address from the PT descriptor Add a helper converting the descriptor into a nicely formed OA, irrespective of the in-descriptor representation (< 52bit, LPA or LPA2). Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit e645226a9c238db919d105d0ee7b4e09d80d13b1 Author: Marc Zyngier Date: Sun Jul 27 10:18:56 2025 +0100 KVM: arm64: Compute 52bit TTBR address and alignment 52bit addresses from TTBR need extra adjustment and alignment checks. Implement the requirements of the architecture. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 23cf13def0c87d9ce234f12eb6132f6bf9442f29 Author: Marc Zyngier Date: Sat Jul 26 11:52:34 2025 +0100 KVM: arm64: Account for 52bit when computing maximum OA Adjust the computation of the max OA to account for 52bit PAs. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0090c0a247cd3dc37181be4a9af4750ae3fedbd0 Author: Marc Zyngier Date: Sat Jul 26 11:38:09 2025 +0100 KVM: arm64: Add helper computing the state of 52bit PA support Track whether the guest is using 52bit PAs, either LPA or LPA2. This further simplifies the handling of LVA for 4k and 16k pages, as LPA2 implies LVA in this case. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 Author: Zhouyi Zhou Date: Fri Sep 19 01:46:43 2025 +0000 tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") made nolibc use the kernel's time type so that `time_t` matches `timespec::tv_sec` on all ABIs (notably x32). But since __kernel_old_time_t is fairly new, notably from 2020 in commit 94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), nolibc builds that rely on host headers may fail. Switch to __kernel_time_t, which is the same as __kernel_old_time_t and has existed for longer. Tested in PPC VM of Open Source Lab of Oregon State University (./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") Signed-off-by: Zhouyi Zhou [Thomas: Reformat commit and its message a bit] Signed-off-by: Thomas Weißschuh commit 3ec09344b01a15901ba824e877a0562ed8103e27 Author: Yao Zi Date: Fri Sep 19 12:58:29 2025 +0000 LoongArch: Fix bitflag conflict for TIF_FIXADE After LoongArch was converted to use the generic TIF bits in commit f9629891d407 ("loongarch: Use generic TIF bits"), its TIF_FIXADE flag takes the same bit with TIF_RESTORE_SIGMASK in thread_info.flags. Such conflict causes TIF_FIXADE being considered cleared when TIF_RESTORE_SIGMASK is cleared during deliver of a signal. And since TIF_FIXADE determines whether unaligned access emulation works for a task, userspace making use of unaligned access will receive unexpected SIGBUS (and likely terminate) after receiving its first signal. This conflict looks like a simple typo, switch it to the free bit 19. Fixes: f9629891d407 ("loongarch: Use generic TIF bits") Signed-off-by: Yao Zi Signed-off-by: Thomas Gleixner Reviewed-by: Wentao Guan commit b8d8265a0db8b3e8a6b40e8a0b25da1c00599577 Merge: fc87f70bd133af 5998f0d07d2c4b Author: Takashi Iwai Date: Sat Sep 20 08:38:17 2025 +0200 Merge tag 'asoc-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.18 A relatively quiet release for ASoC, we've had a lot of maintainance work going on and several new drivers but really the most remarkable thing is that we removed a driver, the WL1273 driver used in some old Nokia systems that have had the underlying system support removed from the kernel. - Morimoto-san continues his work on cleanups of the core APIs and enforcement of abstraction layers. - Lots of cleanups and conversions of DT bindings. - Substantial maintainance work on the Intel AVS drivers. - Support for Qualcomm Glymur and PM4125, Realtek RT1321, Shanghai FourSemi FS2104/5S, Texas Instruments PCM1754. - Remove support for TI WL1273. commit 519cff1d85694cbdf33b27591740e7e37348e6b4 Author: Troy Mitchell Date: Thu Sep 11 11:34:05 2025 +0800 clk: spacemit: fix i2s clock Defining i2s_bclk and i2s_sysclk as fixed-rate clocks is insufficient for real I2S use cases. Moreover, the current I2S clock configuration does not work as expected due to missing parent clocks. This patch adds the missing parent clocks, defines i2s_sysclk as a DDN clock, and i2s_bclk as a DIV clock. A special note for i2s_bclk: From the register definition, the i2s_bclk divider always implies an additional 1/2 factor. The following table shows the correspondence between index and frequency division coefficients: | index | div | |-------|-------| | 0 | 2 | | 1 | 4 | | 2 | 6 | | 3 | 8 | From a software perspective, introducing i2s_bclk_factor as the parent of i2s_bclk is sufficient to address the issue. The I2S-related clock registers can be found here [1]. Link: https://developer.spacemit.com/documentation?token=LCrKwWDasiJuROkVNusc2pWTnEb [1] Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Co-developer: Jinmei Wei Suggested-by: Haylen Chu Signed-off-by: Jinmei Wei Signed-off-by: Troy Mitchell Signed-off-by: Stephen Boyd commit 74246a820c817f195f6191e370c3df98d2df5d91 Author: Troy Mitchell Date: Thu Sep 11 11:34:04 2025 +0800 clk: spacemit: introduce pre-div for ddn clock The original DDN operations applied an implicit divide-by-2, which should not be a default behavior. This patch removes that assumption, letting each clock define its actual behavior explicitly. Reviewed-by: Haylen Chu Signed-off-by: Troy Mitchell Signed-off-by: Stephen Boyd commit 8be1f299041220512195e40590bb4984f297ae48 Author: Troy Mitchell Date: Thu Sep 11 11:34:03 2025 +0800 dt-bindings: clock: spacemit: introduce i2s pre-clock to fix i2s clock Previously, the K1 clock driver did not include the parent clocks of the I2S sysclk. Introduce pre-clock to fix I2S clock. Otherwise, the I2S clock may not work as expected. This patch adds their definitions to allow proper registration in the driver and usage in the device tree. Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Acked-by: Krzysztof Kozlowski Signed-off-by: Troy Mitchell Signed-off-by: Stephen Boyd commit 18db1ff2dea0f97dedaeadd18b0cb0a0d76154df Author: Jacky Bai Date: Mon Jul 28 15:04:46 2025 +0800 clk: scmi: Add duty cycle ops only when duty cycle is supported For some of the SCMI based platforms, the oem extended config may be supported, but not for duty cycle purpose. Skip the duty cycle ops if err return when trying to get duty cycle info. Signed-off-by: Jacky Bai Reviewed-by: Sudeep Holla Signed-off-by: Stephen Boyd commit ac28c7598611df3034c0f61d25da7b3377bbce87 Author: Julien Massot Date: Tue Aug 26 09:39:34 2025 +0200 dt-bindings: clock: mediatek: Add power-domains property The mt8183-mfgcfg node uses a power domain in its device tree node. To prevent schema validation warnings, add the optional `power-domains` property to the binding schema for mediatek syscon clocks. Fixes: 1781f2c46180 ("arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Julien Massot Acked-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 048546931339b322f13c5863ce1815c9e5e7b0bd Author: Raag Jadav Date: Tue Sep 16 18:15:18 2025 +0530 clk: keystone: sci-clk: use devm_kmemdup_array() Convert to use devm_kmemdup_array() which is more robust. Signed-off-by: Raag Jadav Reviewed-by: Andy Shevchenko Reviewed-by: Nishanth Menon Signed-off-by: Stephen Boyd commit 1e0d75258bd09323cb452655549e03975992b29e Author: Matthias Schiffer Date: Mon Aug 25 16:08:11 2025 +0200 clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL can't be disabled - the clock module will just be stuck in transitioning state forever, resulting in the following warning message after the wait loop times out: l3-aon-clkctrl:0000:0: failed to disable Just add the clock to enable_init_clks, so no attempt is made to disable it. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Acked-by: Kevin Hilman Signed-off-by: Stephen Boyd commit 7e2e4e32cd47a4129bf25c21e7049ff0571b7b90 Author: Marek Szyprowski Date: Thu Sep 18 18:06:01 2025 +0200 clk: amlogic: fix recent code refactoring Commit 4c4e17f27013 ("clk: amlogic: naming consistency alignment") refactored some internals in the g12a meson clock driver. Unfortunately it introduced a bug in the clock init data, which results in the following kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ... Data abort info: ... [0000000000000000] user address but active_mm is swapper Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc1+ #11158 PREEMPT Hardware name: Hardkernel ODROID-N2 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __clk_register+0x60/0x92c lr : __clk_register+0x48/0x92c ... Call trace: __clk_register+0x60/0x92c (P) devm_clk_hw_register+0x5c/0xd8 meson_eeclkc_probe+0x74/0x110 g12a_clkc_probe+0x2c/0x58 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0xdc/0x164 __driver_attach+0x9c/0x1ac bus_for_each_dev+0x74/0xd0 driver_attach+0x24/0x30 bus_add_driver+0xe4/0x208 driver_register+0x60/0x128 __platform_driver_register+0x24/0x30 g12a_clkc_driver_init+0x1c/0x28 do_one_initcall+0x64/0x308 kernel_init_freeable+0x27c/0x4f8 kernel_init+0x20/0x1d8 ret_from_fork+0x10/0x20 Code: 52800038 aa0003fc b9010018 52819801 (f9400260) ---[ end trace 0000000000000000 ]--- Fix this by correcting the clock init data. Fixes: 4c4e17f27013 ("clk: amlogic: naming consistency alignment") Signed-off-by: Marek Szyprowski Tested-by: Neil Armstrong # on BananPi M2S Reviewed-by: Neil Armstrong Reviewed-by: Jerome Brunet Signed-off-by: Stephen Boyd commit 597fe80ba3fc55b67cd3aaed8431a3607f519f5b Merge: 8f5ae30d69d754 598e4b6713b542 Author: Stephen Boyd Date: Fri Sep 19 21:50:38 2025 -0700 Merge tag 'sunxi-clk-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: In this cycle support for power-of-two single divider clocks was added. This covers some of the clocks found in the A523 MCU PRCM clock and reset controller, for which support was added as well. Besides the new controller, a missing clock was added for the A523's main clock controller. The RTC clock driver gained specifics for the A523's RTC block for tweaking the clock rate of the internal oscillator to get it closer to what the RTC needs. * tag 'sunxi-clk-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: add support for the A523/T527 MCU CCU clk: sunxi-ng: div: support power-of-two dividers clk: sunxi-ng: sun55i-a523-ccu: Add missing NPU module clock dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock clk: sunxi-ng: sun6i-rtc: Add A523 specifics commit 2f695d3eac36601d383155e3bba189f06a0f750c Author: Jessica Zhang Date: Tue Sep 16 20:18:29 2025 +0300 arm64: dts: qcom: Add MST pixel streams for displayport Update Qualcomm DT files in order to declare extra stream pixel clocks and extra register resources used on these platforms to support DisplayPort MST. The driver will continue to work with the old DTS files as even after adding MST support the driver will have to support old DTS files which didn't have MST clocks. Signed-off-by: Jessica Zhang Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-dp_mst_bindings-v9-2-68c674b39d8e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f2983d8a1ea2812a4ccf6693dcd59118ac3f0a8e Author: Dmitry Baryshkov Date: Tue Sep 16 20:18:28 2025 +0300 arm64: dts: qcom: sm6350: correct DP compatibility strings SM6350 doesn't have MST support, as such in DT schema it has been switched to use SC7180 as a fallback compatible. Make DT file implement this change. DisplayPort on SC7180 has been supported long ago (and long before we added support for DP on SM8350). The driver will continue to work with the old DTS (having qcom,sm8350-dp fallback compatible) as even after adding MST support the driver will have to support old SM8350 DTS which didn't have MST clocks. Fixes: 62f87a3cac4e ("arm64: dts: qcom: sm6350: Add DisplayPort controller") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-dp_mst_bindings-v9-1-68c674b39d8e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ed7e440531601ba558fb81856352ef260ecb153f Author: Akhil P Oommen Date: Tue Sep 9 21:16:59 2025 +0530 arm64: dts: qcom: monaco-evk: Enable Adreno 623 GPU Enable GPU for monaco-evk platform and provide path for zap shader. Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250909-monaco-evk-gpu-v1-1-e14938780411@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9da690f1b649c9900dd97b9bcd78e4a5ec61f2ff Author: Jie Zhang Date: Wed Sep 3 12:49:56 2025 +0530 arm64: dts: qcom: qcs8300-ride: Enable Adreno 623 GPU Enable GPU for qcs8300-ride platform and provide path for zap shader. Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250903-a623-gpu-support-v5-5-5398585e2981@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0099675695aab4356f7d05c507edb60fe72a4973 Author: Jie Zhang Date: Wed Sep 3 12:49:54 2025 +0530 arm64: dts: qcom: qcs8300: Add gpu and gmu nodes Add gpu and gmu nodes for qcs8300 chipset. Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903-a623-gpu-support-v5-3-5398585e2981@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 312e6f7676e63bbb9b81e5c68e580a9f776cc6f0 Merge: 4d3c5db44cfd12 614accf5455304 Author: Jakub Kicinski Date: Fri Sep 19 17:50:19 2025 -0700 Merge branch 'net-netpoll-remove-dead-code-and-speed-up-rtnl-locked-region' Breno Leitao says: ==================== net: netpoll: remove dead code and speed up rtnl-locked region This patchset introduces two minor modernizations to the netpoll infrastructure: The first patch removes the unused netpoll pointer from the netpoll_info structure. This member is redundant and its presence does not benefit multi-instance setups, as reported by Jay Vosburgh. Eliminating it cleans up the structure and removes unnecessary code. The second patch updates the netpoll resource cleanup routine to use synchronize_net() instead of synchronize_rcu(). As __netpoll_free() is always called under the RTNL lock, using synchronize_net() leverages the more efficient synchronize_rcu_expedited() in these contexts, reducing time spent in critical sections and improving performance. Both changes simplify maintenance and enhance efficiency without altering netpoll behavior. ==================== Link: https://patch.msgid.link/20250918-netpoll_jv-v1-0-67d50eeb2c26@debian.org Signed-off-by: Jakub Kicinski commit 614accf5455304ac0e708882609a34ec9aec463b Author: Breno Leitao Date: Thu Sep 18 05:25:58 2025 -0700 net: netpoll: use synchronize_net() instead of synchronize_rcu() Replace synchronize_rcu() with synchronize_net() in __netpoll_free(). synchronize_net() is RTNL-aware and will use the more efficient synchronize_rcu_expedited() when called under RTNL lock, avoiding the potentially expensive synchronize_rcu() in RTNL critical sections. Since __netpoll_free() is called with RTNL held (as indicated by ASSERT_RTNL()), this change improves performance by reducing the time spent in the RTNL critical section. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250918-netpoll_jv-v1-2-67d50eeb2c26@debian.org Signed-off-by: Jakub Kicinski commit b34df17d588de926212527a2f2ce72bc4e330260 Author: Breno Leitao Date: Thu Sep 18 05:25:57 2025 -0700 net: netpoll: remove unused netpoll pointer from netpoll_info The netpoll_info structure contains an useless pointer back to its associated netpoll. This field is never used, and the assignment in __netpoll_setup() is does not comtemplate multiple instances, as reported by Jay[1]. Drop both the member and its initialization to simplify the structure. Link: https://lore.kernel.org/all/2930648.1757463506@famine/ [1] Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250918-netpoll_jv-v1-1-67d50eeb2c26@debian.org Signed-off-by: Jakub Kicinski commit 4d3c5db44cfd121ed3d930deea91c230e2db3bae Merge: b73b8146d7ff68 9e1e2f4ebf99d7 Author: Jakub Kicinski Date: Fri Sep 19 17:35:54 2025 -0700 Merge branch 'net-ipv4-some-drop-reason-cleanup-and-improvements' Antoine Tenart says: ==================== net: ipv4: some drop reason cleanup and improvements A few patches that were laying around cleaning up and improving drop reasons in net/ipv4. ==================== Link: https://patch.msgid.link/20250915091958.15382-1-atenart@kernel.org Signed-off-by: Jakub Kicinski commit 9e1e2f4ebf99d72389bb257f01f6bed70fccf66c Author: Antoine Tenart Date: Mon Sep 15 11:19:56 2025 +0200 net: ipv4: convert ip_rcv_options to drop reasons This converts the only path not returning drop reasons in ip_rcv_finish_core. Signed-off-by: Antoine Tenart Reviewed-by: David Ahern Link: https://patch.msgid.link/20250915091958.15382-4-atenart@kernel.org Signed-off-by: Jakub Kicinski commit dcc0e68ed300dae3325e323417773dd59a6a65db Author: Antoine Tenart Date: Mon Sep 15 11:19:55 2025 +0200 net: ipv4: simplify drop reason handling in ip_rcv_finish_core Instead of setting the drop reason to SKB_DROP_REASON_NOT_SPECIFIED early and having to reset it each time it is overridden by a function returned value, just set the drop reason to the expected value before returning from ip_rcv_finish_core. Signed-off-by: Antoine Tenart Link: https://patch.msgid.link/20250915091958.15382-3-atenart@kernel.org Signed-off-by: Jakub Kicinski commit 1c7e4a618509476658bafba35fffb3a5cfb213b1 Author: Antoine Tenart Date: Mon Sep 15 11:19:54 2025 +0200 net: ipv4: make udp_v4_early_demux explicitly return drop reason udp_v4_early_demux already returns drop reasons as it either returns 0 or ip_mc_validate_source, which itself returns drop reasons. Its return value is also already used as a drop reason itself. Makes this explicit by making it return drop reasons. Signed-off-by: Antoine Tenart Reviewed-by: David Ahern Link: https://patch.msgid.link/20250915091958.15382-2-atenart@kernel.org Signed-off-by: Jakub Kicinski commit b73b8146d7ff68e245525adb944a4c998d423d59 Author: Alasdair McWilliam Date: Wed Sep 17 10:55:42 2025 +0100 rtnetlink: add needed_{head,tail}room attributes Various network interface types make use of needed_{head,tail}room values to efficiently reserve buffer space for additional encapsulation headers, such as VXLAN, Geneve, IPSec, etc. However, it is not currently possible to query these values in a generic way. Introduce ability to query the needed_{head,tail}room values of a network device via rtnetlink, such that applications that may wish to use these values can do so. For example, Cilium agent iterates over present devices based on user config (direct routing, vxlan, geneve, wireguard etc.) and in future will configure netkit in order to expose the needed_{head,tail}room into K8s pods. See b9ed315d3c4c ("netkit: Allow for configuring needed_{head,tail}room"). Suggested-by: Daniel Borkmann Signed-off-by: Alasdair McWilliam Reviewed-by: Daniel Borkmann Link: https://patch.msgid.link/20250917095543.14039-1-alasdair@mcwilliam.dev Signed-off-by: Jakub Kicinski commit 0c2a4d304cea450d9f99e2092a731150a67ecc6b Merge: 6a46e4faa8fd84 6b0ed6a3a89cd2 Author: Jakub Kicinski Date: Fri Sep 19 17:19:47 2025 -0700 Merge branch 'net-stmmac-remove-mac_interface' Russell King says: ==================== net: stmmac: remove mac_interface The dwmac core supports a range of interfaces, but when it comes to SerDes interfaces, the core itself does not include the SerDes block. Consequently, it has to provide an interface suitable to interface such a block to, and uses TBI for this. The driver also uses "PCS" for RGMII, even though the dwmac PCS block is not present for this interface type - it was a convenice for the code structure as RGMII includes inband signalling of the PHY state, much like Cisco SGMII does at a high level. As such, the code refers to RGMII and SGMII modes for the PCS, and there used to be STMMAC_PCS_TBI and STMMAC_PCS_RTBI constants as well but these were never set, although they were used in the code. The selection of the PCS mode was from mac_interface. Thus, it seems that the original intention was for mac_interface to describe the interface mode used within the dwmac core, and phy_interface to describe the external world-accessible interface (e.g. which would connect to a PHY or SFP cage.) It appears that many glue drivers misinterpret these. A good exmple is socfpga. This supports SGMII and 1000BASE-X, but does not include the dwmac PCS, relying on the Lynx PCS instead. However, it makes use of mac_interface to configure the dwmac core to its GMII/MII mode. So, when operating in either of these modes, the dwmac is configured for GMII mode to communicate with the Lynx PCS which then provides the SGMII or 1000BASE-X interface mode to the external world. Given that phy_interface is the external world interface, and mac_interface is the dwmac core interface, selecting the interface mode based on mac_interface being 1000BASEX makes no sense. Moreover, mac_interface is initialised by the stmmac core code. If the "mac-mode" property is set in DT, this will be used. Otherwise, it will reflect the "phy-mode" property - meaning that it defaults to phy_interface. As no in-kernel DT makes reference to a "mac-mode" property, we can assume that for all in-kernel platforms, these two interface variables are the same. The exception are those platform glues which I reviwed and suggested they use phy_interface, setting mac_interface to PHY_INTERFACE_MODE_NA. The conclusion to all of this is that mac_interface serves no useful purpose, and causes confusion as the platform glue code doesn't seem to know which one should be used. Thus, let's get rid of mac_interface, which makes all this code more understandable. It also helps to untangle some of the questions such as: - should this be using the interface passed from phylink - should we set the range of phylink supported interfaces to be more than one - when we get phylink PCS support for the dwmac PCS, should we be selecting it based on mac_interface or phy_interface, and how should we populate the PCS' supported_interface bitmap. Having converted socfpga to use phy_interface, this turns out to feel like "the right way" to do this - convert the external world "phy_interface" to whatever phy_intf_sel value that the dwmac core needs to achieve the connection to whatever hardware blocks are integrated inside the SoC to achieve the requested external world interface. As an illustration why - consider that in the case of socfpga, it _could_ have been implemented such that the dwmac PCS was used for SGMII, and the Lynx PCS for 1000BASE-X, or vice versa. Only the platform glue would know which it is. I will also note that several cores provide their currently configured interface mode via the ACTPHYIF field of Hardware Feature 0, and thus can be read back in the platform-independent parts of the driver to decide whether the internal PCS or the RGMII (or actually SMII) "PCS" should be used. This is hot-off-the-press, and has only been build tested. As I have none of these platforms, this series has not been run-tested, so please test on your hardware. ==================== Link: https://patch.msgid.link/aMrPpc8oRxqGtVPJ@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6b0ed6a3a89cd2d04980e15a44c645bebb077418 Author: Russell King (Oracle) Date: Wed Sep 17 16:12:47 2025 +0100 net: stmmac: remove mac_interface mac_interface has served little purpose, and has only caused confusion. Now that we have cleaned up all platform glue drivers which should not have been using mac_interface, there are no users remaining. Remove mac_interface. This results in the special dwmac specific "mac-mode" DT property becoming redundant, and an in case, no DTS files in the kernel make use of this property. Add a warning if the property is set, and it is different from the "phy-mode". Signed-off-by: Russell King (Oracle) Acked-by: Vladimir Zapolskiy Link: https://patch.msgid.link/E1uytpv-00000006H2x-196h@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3a94ecdf1afb527753830c5ad65e45149629724d Author: Russell King (Oracle) Date: Wed Sep 17 16:12:42 2025 +0100 net: stmmac: thead: convert to use phy_interface dwmac-thead supports either MII or RGMII interface modes only. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-thead to use phy_interface when determining the interface mode rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpq-00000006H2q-0ajY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0fe080fa884e633ca2f0d741f8a2f6425fc7d63f Author: Russell King (Oracle) Date: Wed Sep 17 16:12:37 2025 +0100 net: stmmac: sun8i: convert to use phy_interface dwmac-sun8i supports MII, RMII and RGMII interface modes only. It is unclear whether the dwmac core interface is different from the one presented to the outside world. However, as none of the DTS files set "mac-mode", mac_interface will be identical to phy_interface. Convert dwmac-sun8i to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) Acked-by: Chen-Yu Tsai Link: https://patch.msgid.link/E1uytpl-00000006H2k-08pH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0ca60c26f6550f6e324b6a11dff0e5a97c836df5 Author: Russell King (Oracle) Date: Wed Sep 17 16:12:31 2025 +0100 net: stmmac: stm32: convert to use phy_interface dwmac-stm32 supports MII, RMII, GMII and RGMII interface modes, selecting the dwmac core interface mode via bits 23:21 of the SYSCFG register. The bit combinations are identical to the dwmac phy_intf_sel_i signals. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-stm32 to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpf-00000006H2c-3hiU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6cb2b69c3419a61b209b450b764d1bada9150d12 Author: Russell King (Oracle) Date: Wed Sep 17 16:12:26 2025 +0100 net: stmmac: starfive: convert to use phy_interface dwmac-starfive uses RMII or RGMII interface modes without any PCS, and selects the dwmac core accordingly using a register field with the same bit encoding as the core's phy_intf_sel_i signals. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-starfive to use phy_interface when determining the interface mode rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpa-00000006H2X-3GWx@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit de696c63c1dcd43d23ee86b721addb85056a11b8 Author: Russell King (Oracle) Date: Wed Sep 17 16:12:21 2025 +0100 net: stmmac: socfpga: convert to use phy_interface dwmac-socfpga uses MII, RMII, GMII, RGMII, SGMII and 1000BASE-X interface modes, and supports the Lynx PCS. The Lynx PCS will only be used for SGMII and 1000BASE-X modes, with the MAC programmed to use GMII or MII mode to talk to the PCS. This suggests that the Synopsys optional dwmac PCS is not present. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-socfpga to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpV-00000006H2R-2nA6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9ff682b4a28f617bba2880d1b9c7642290768f2f Author: Russell King (Oracle) Date: Wed Sep 17 16:12:16 2025 +0100 net: stmmac: ingenic: convert to use phy_interface dwmac-ingenic uses only MII, RMII, GMII or RGMII interface modes, none of which require any kind of conversion between the MAC and external world. Thus, mac_interface and phy_interface will be the same. Convert dwmac-ingenic to use phy_interface when determining the interface mode that the dwmac core should be configured to at reset, rather than mac_interface. Also convert the error prints to use phy_modes() and terminate with a newline so that we get a human readable string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpQ-00000006H2L-2Jzb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit db1948da68605b885943a2f243728c6c5fe8266f Author: Russell King (Oracle) Date: Wed Sep 17 16:12:11 2025 +0100 net: stmmac: imx: convert to use phy_interface Checking the IMX8MP documentation, there is no requirement for a separate mac_interface mode definition. As mac_interface and phy_interface will be the same, use phy_interface internally rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpL-00000006H2F-1o6b@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0522f152a2c9d4985f8b73ae0fc82f98087f488e Author: Russell King (Oracle) Date: Wed Sep 17 16:12:06 2025 +0100 net: stmmac: use phy_interface in stmmac_check_pcs_mode() In the majority, if not all cases, mac_interface and phy_interface are the same with the exception of some drivers that I have suggested only use phy_interface and set mac_interface to PHY_INTERFACE_MODE_NA. The only two that currently set mac_interface to PHY_INTERFACE_MODE_NA are dwmac-loongson and dwmac-lpc18xx, neither of which use RGMII nor SGMII. In order to phase out the use of mac_interface, we need to have a path for existing drivers so they can update to only using phy_interface without causing regressions. Therefore, in order to keep the "pcs" code working, we need to choose the STMMAC integrated PCS mode based on phy_interface if mac_interface is PHY_INTERFACE_MODE_NA. This will allow more drivers to set mac_interface to PHY_INTERFACE_MODE_NA without risking regressions. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpG-00000006H29-1Ltk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 32a8d2a197c1d2d36badb401657aa193938f071c Author: Russell King (Oracle) Date: Wed Sep 17 16:12:01 2025 +0100 net: stmmac: rework mac_interface and phy_interface documentation Based on new research, it has come to light that the comment that I added in a014c35556b9 ("net: stmmac: clarify difference between "interface" and "phy_interface"") is not fully correct. Update the comment to properly describe the difference between the two. All of the DTS files in the kernel tree do not mention the "mac-mode" property, which results in mac_interface and phy_interface being the same. Also, none of the platform glue drivers set mac_interface to anything but PHY_INTERFACE_MODE_NA. This means that for all the platforms known to mainline, mac_interface is either the same as phy_interface, or it is PHY_INTERFACE_MODE_NA. Thus, updating the definition for mac_interface in stmmac.h has no material effect on current uses known to mainline, but the change opens the door to cleaning up all uses. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uytpB-00000006H23-0pRi@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6a46e4faa8fd848acec81bd6149a44c3b9b17de6 Author: Vlad Dumitrescu Date: Thu Sep 18 15:05:07 2025 -0700 net/mlx5: Remove dead code from total_vfs setter The mlx5_devlink_total_vfs_set function branches based on per_pf_support twice. Remove the second branch as the first one exits the function when per_pf_support is false. Accidentally added as part of commit a4c49611cf4f ("net/mlx5: Implement devlink total_vfs parameter"). Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-rdma/aMQWenzpdjhAX4fm@stanley.mountain/ Signed-off-by: Vlad Dumitrescu Link: https://patch.msgid.link/a6142a60-1948-439a-b0ae-ff1df26a37f8@nvidia.com Signed-off-by: Jakub Kicinski commit 85c7333c35f22cdb8391b4cacfdc496aec4162ae Author: Daniel Zahka Date: Thu Sep 18 14:27:20 2025 -0700 psp: clarify checksum behavior of psp_dev_rcv() psp_dev_rcv() decapsulates psp headers from a received frame. This will make any csum complete computed by the device inaccurate. Rather than attempt to patch up skb->csum in psp_dev_rcv() just make it clear to callers what they can expect regarding checksum complete. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250918212723.17495-1-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit f1bf77491d5e48ab5477f585ee5fca2aa524bd15 Author: Kuniyuki Iwashima Date: Thu Sep 18 19:25:35 2025 +0000 psp: Fix typo in kdoc for struct psp_dev_caps.assoc_drv_spc. assoc_drv_spc is the size of psp_assoc.drv_data[]. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250918192539.1587586-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c3bef01f0a5697d516a4280cd0c7de00f806bcfd Author: Jakub Kicinski Date: Thu Sep 18 11:31:19 2025 -0700 net: phy: micrel: use %pe in print format New cocci check complains: drivers/net/phy/micrel.c:4308:6-13: WARNING: Consider using %pe to print PTR_ERR() drivers/net/phy/micrel.c:5742:6-13: WARNING: Consider using %pe to print PTR_ERR() Link: https://lore.kernel.org/1758192227-701925-1-git-send-email-tariqt@nvidia.com Reviewed-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250918183119.2396019-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d373176425ed0ddc8518e0a9cba27ecd07964bfd Merge: b02c1230104df8 28bb24dadd0ed7 Author: Jakub Kicinski Date: Fri Sep 19 17:01:22 2025 -0700 Merge branch 'address-miscellaneous-issues-with-psp_sk_get_assoc_rcu' Daniel Zahka says: ==================== address miscellaneous issues with psp_sk_get_assoc_rcu() There were a few minor issues with psp_sk_get_assoc_rcu() identified by Eric in his review of the initial psp series. This series addresses them. ==================== Link: https://patch.msgid.link/20250918155205.2197603-1-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 28bb24dadd0ed70aed43cf9af3a54c22c3ce04b2 Author: Daniel Zahka Date: Thu Sep 18 08:52:04 2025 -0700 psp: don't use flags for checking sk_state Using flags to check sk_state only makes sense to check for a subset of states in parallel e.g. sk_fullsock(). We are not doing that here. Compare for individual states directly. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250918155205.2197603-4-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 803cdb6ddca3e24418226e17e4b1c1134619aca8 Author: Daniel Zahka Date: Thu Sep 18 08:52:03 2025 -0700 psp: fix preemptive inet_twsk() cast in psp_sk_get_assoc_rcu() It is weird to cast to a timewait_sock before checking sk_state, even if the use is after such a check. Remove the tw local variable, and use inet_twsk() directly in the timewait branch. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250918155205.2197603-3-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit f8d2f8205be8cceef2dd3c0e68e7af3c5f83c75c Author: Daniel Zahka Date: Thu Sep 18 08:52:02 2025 -0700 psp: make struct sock argument const in psp_sk_get_assoc_rcu() This function does not need a mutable reference to its argument. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250918155205.2197603-2-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit b02c1230104df86d282bd298e5313bb9686cbd70 Author: Eric Dumazet Date: Thu Sep 18 13:20:07 2025 +0000 tcp: prefer sk_skb_reason_drop() Replace two calls to kfree_skb_reason() with sk_skb_reason_drop(). Signed-off-by: Eric Dumazet Cc: Daniel Zahka Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250918132007.325299-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d3ca2ef0c915d219e0d958e0bdcc4be6c02c210b Author: Vadim Fedorenko Date: Thu Sep 18 13:11:46 2025 +0000 ptp_ocp: make ptp_ocp driver compatible with PTP_EXTTS_REQUEST2 Originally ptp_ocp driver was not strictly checking flags for external timestamper and was always activating rising edge timestamping as it's the only supported mode. Recent changes to ptp made it incompatible with PTP_EXTTS_REQUEST2 ioctl. Adjust ptp_clock_info to provide supported mode and be compatible with new infra. While at here remove explicit check of periodic output flags from the driver and provide supported flags for ptp core to check. Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250918131146.651468-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 5fc7fa743dbfcc98c3210ac4a724c88f3e8718d8 Author: Dan Carpenter Date: Thu Sep 18 12:48:26 2025 +0300 net: ti: icssm-prueth: unwind cleanly in probe() This error handling triggers a Smatch warning: drivers/net/ethernet/ti/icssm/icssm_prueth.c:1574 icssm_prueth_probe() warn: 'prueth->pru1' is an error pointer or valid The warning is harmless because the pru_rproc_put() function has an IS_ERR_OR_NULL() check built in. However, there is a small bug if syscon_regmap_lookup_by_phandle() fails. In that case we should call of_node_put() on eth0_node and eth1_node. It's a little bit easier to re-write this code to only free things which we know have been allocated successfully. Fixes: 511f6c1ae093 ("net: ti: icssm-prueth: Adds ICSSM Ethernet driver") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Parvathi Pudi Link: https://patch.msgid.link/aMvVagz8aBRxMvFn@stanley.mountain Signed-off-by: Jakub Kicinski commit b1e5dfa6d8dfa1bdb416c8ff43a3c526c4d00e4f Merge: 3fb4f35a75e864 72ed3ebf95a73b Author: Jakub Kicinski Date: Fri Sep 19 16:48:39 2025 -0700 Merge branch 'net-mlx5e-support-rss-for-ipsec-offload' Tariq Toukan says: ==================== net/mlx5e: Support RSS for IPSec offload The series by Jianbo uses a new firmware feature to identify the inner protocol of decrypted packets, adding new flow groups and steering rules to redirect them for proper L4-based RSS. This ensures traffic is spread across multiple CPU cores. ==================== Link: https://patch.msgid.link/1758179963-649455-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 72ed3ebf95a73b3c822ab7efb6a46114672179c5 Author: Jianbo Liu Date: Thu Sep 18 10:19:23 2025 +0300 net/mlx5e: Add flow rules for the decrypted ESP packets The previous commit introduced two new flow groups to enable L4 RSS for decrypted IPsec traffic. This commit implements the logic to populate these groups with the necessary steering rules. The rules are created dynamically whenever the first IPSec offload rule is configured via the xfrm subsystem and the decryption tables for RX are created. Each rule matches a specific decrypted traffic type based on its ip version (or ethertype) and outer/inner l4_type_ext, directing it to the appropriate L4 RSS-enabled TIR. The lifecycle of these steering rules is tied directly to the RX tables. They are deleted when the RX tables are destroyed. Signed-off-by: Jianbo Liu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758179963-649455-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d8693cac22c7fa7ef13c836327f1720d3fe414f6 Author: Jianbo Liu Date: Thu Sep 18 10:19:22 2025 +0300 net/mlx5e: Add flow groups for the packets decrypted by crypto offload When using IPsec crypto offload, the hardware decrypts the packet payload but preserves the ESP header. This prevents the standard RSS mechanism from accessing the inner L4 (TCP/UDP) headers. As a result, the RSS hash is calculated only on the outer L3 IP headers, causing all traffic for a given IPsec tunnel to be directed to a single queue, leading to poor traffic distribution. Newer firmware introduces the ability to match on l4_type_ext, which exposes the L4 protocol type following an ESP header. This allows the driver to create steering rules that can identify the inner protocols of decrypted packets. This commit leverages this new capability to improve traffic distribution. It adds two new flow groups to steer decrypted packets to dedicated TIRs that was configured to perform RSS on the inner L4 headers. These groups are inserted after the standard L4 group and before the group that handles undecrypted ESP packets added in this series. The first new group matches decrypted packets based on the outer IP version (or ethertype) and l4_type_ext. The second new group matches decrypted tunneled packets based on the inner IP version and l4_type_ext. Eight new traffic types are also defined to support this functionality. Signed-off-by: Jianbo Liu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758179963-649455-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c69ac57199eac5259a715314a5edeb4c30925934 Author: Jianbo Liu Date: Thu Sep 18 10:19:21 2025 +0300 net/mlx5e: Recirculate decrypted packets into TTC table In the commit 5e466345291a ("net/mlx5e: IPsec: Add IPsec steering in local NIC RX"), the decrypted packets are handled in RX error flow table. There is only one rule in the table, which forwards packets to the default ESP TIR. This patch updates the design to allow RSS after decryption. For ESP traffic, SPI and IP addresses are the fields selected for RSS hash, and it's common that only one SPI is configured in RX direction, so RSS can't work properly as all the packets are hashed to one key in this case. To take advantage of RSS and improve performance, the decrypted packets need to be forwarded back to TTC table, where RSS can work based on the decrypted packet types. Signed-off-by: Jianbo Liu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758179963-649455-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 9f24f0c4d4ddbd207e655697e78ef67a0374a481 Author: Jianbo Liu Date: Thu Sep 18 10:19:20 2025 +0300 net/mlx5: Change TTC rules to match on undecrypted ESP packets The TTC (Traffic Type Classifier) table classifies the traffic and steers packet to TIRs, where RSS works based on the hash calculated from the selected packet fields. For AH/ESP packets, SPI and IP addresses are the fields used to calculate the hash value for RSS. So, it's hard to distribute packets to different receiving queues as there is usually only one SPI in that direction. IPSec hardware offloads, crypto offload and full (packet) offload were introduced later. For crypto offload, hardware does encryption, decryption and authentication, kernel does the others. Kernel always sends/receives formatted ESP packets with plaintext data instead of the ciphertext data, all other fields are unmodified. For full offload, hardware will take care of almost everything, kernel just sends/receives packets without any IPSec headers. Currently, all packets with ESP protocols are forwarded to IPSec offload tables if IPSec rules are configured. In a downstream patch, the decrypted packets will be recirculated to TTC table, in order to use RSS, which does the hash on L4 fields after IPSec headers are stripped by full offload. So those packets handled by crypto offload must filtered out, as they still have the ESP headers, but apparently no need to be decrypted again. To do that, ipsec_next_header is added for the packet matching, as it is valid only after passing through IPSec decryption. Signed-off-by: Jianbo Liu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758179963-649455-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 Author: Tom Stellard Date: Wed Sep 17 11:38:47 2025 -0700 bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 This fixes the build with -Werror -Wall. btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 71 | info.func_info = ptr_to_u64(&finfo); | ^~~~~ prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 2294 | info.func_info = ptr_to_u64(&func_info); | v2: - Initialize instead of using memset. Signed-off-by: Tom Stellard Signed-off-by: Andrii Nakryiko Acked-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com commit 57cb26950112f0dfa9077b2710b1c280efa97e81 Author: Tao Chen Date: Fri Sep 19 11:48:16 2025 +0800 bpftool: Fix UAF in get_delegate_value The return value ret pointer is pointing opts_copy, but opts_copy gets freed in get_delegate_value before return, fix this by free the mntent->mnt_opts strdup memory after show delegate value. Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show") Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20250919034816.1287280-2-chen.dylane@linux.dev commit bce5749b02019f9b7e60fdff584098e57337c8b6 Author: Tao Chen Date: Fri Sep 19 11:48:15 2025 +0800 bpftool: Add HELP_SPEC_OPTIONS in token.c $ ./bpftool token help Usage: bpftool token { show | list } bpftool token help OPTIONS := { {-j|--json} [{-p|--pretty}] | {-d|--debug} } Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show") Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20250919034816.1287280-1-chen.dylane@linux.dev commit 510c47f165f0c1f0b57329a30a9a797795519831 Author: Tony Lindgren Date: Thu Sep 18 08:32:25 2025 +0300 KVM: TDX: Fix uninitialized error code for __tdx_bringup() Fix a Smatch static checker warning reported by Dan: arch/x86/kvm/vmx/tdx.c:3464 __tdx_bringup() warn: missing error code 'r' Initialize r to -EINVAL before tdx_get_sysinfo() to simplify the code and to prevent similar issues from sneaking in later on as suggested by Kai. Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Fixes: 61bb28279623 ("KVM: TDX: Get system-wide info about TDX module on initialization") Suggested-by: Kai Huang Reviewed-by: Kai Huang Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20250918053226.802204-1-tony.lindgren@linux.intel.com [sean: tag for stable] Signed-off-by: Sean Christopherson commit 02d09026a88f227aa1f4687bd31d6ffc4970e8be Author: Yaxiong Tian Date: Fri Sep 12 15:35:02 2025 +0800 cpufreq: intel_pstate: Use likely() optimization in intel_pstate_sample() The comment above the condition `if (cpu->last_sample_time)` clearly indicates that the branch is taken for the vast majority of invocations after the first sample in a cycle. The first sample is a one-time initialization case. Add likely() hint to the condition to improve branch prediction for this performance-critical path in intel_pstate_sample(). Signed-off-by: Yaxiong Tian Signed-off-by: Rafael J. Wysocki commit 7c0dde86c17665cb27e1c8dd23d263e2ed2d5b50 Author: Zihuan Zhang Date: Mon Sep 8 16:57:38 2025 +0800 cpufreq: Add defensive check during driver registration Currently, cpufreq allows drivers to implement both ->target() and ->target_index() callbacks, but that can lead to ambiguous or incorrect behavior. For this reason, prevent cpufreq drivers implementing both ->target() and ->target_index() at the same time from registering. This check can help to catch driver implementation mistakes early and improve overall robustness, without affecting existing valid drivers. Signed-off-by: Zihuan Zhang Link: https://patch.msgid.link/20250908085738.31602-1-zhangzihuan@kylinos.cn [ rjw: Subject adjustment and changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit 46c435cbaf5591a349c339e080ac2a228aa99649 Author: Rafael J. Wysocki Date: Thu Sep 11 14:02:33 2025 +0200 cpufreq: intel_pstate: Enable HWP without EPP if DEC is enabled So far, HWP has never been enabled without EPP (Energy-Performance Preference) interface support, since the lack of the latter indicates an incomplete implementation of HWP, which was the case on early development vehicle platforms. However, HWP can be expected to work if DEC (Dynamic Efficiency Control) is enabled as indicated by setting bit 27 in MSR_IA32_POWER_CTL (DEC enable bit). Accordingly, allow HWP to be enabled if the EPP interface is not supported so long as DEC is enabled in the processor. Still, the EPP control sysfs interface is useless when EPP is not supported, so do not expose it in that case. Link: https://lore.kernel.org/linux-pm/20250904000608.260817-2-srinivas.pandruvada@linux.intel.com/ Signed-off-by: Srinivas Pandruvada Co-developed-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit fbd401e95e569ad0307e4301012f2d8e1ec1ee98 Author: Rafael J. Wysocki Date: Thu Sep 18 23:10:31 2025 +0200 ACPI: processor: idle: Redefine two functions as void Notice that acpi_processor_power_init() and acpi_processor_power_exit() don't need to return any values because their callers don't check them anyway, so redefine those functions as void. While at it, rearrange the code in acpi_processor_power_init() to reduce the indentation level, get rid of a redundant local variable in that function, and rephrase a code comment in it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit 8a1b5d412cb405df402cdc59135655788fc59d0f Author: Rafael J. Wysocki Date: Thu Sep 18 23:09:17 2025 +0200 ACPI: processor: Update cpuidle driver check in __acpi_processor_start() Commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") moved the ACPI idle driver registration to acpi_processor_driver_init() and acpi_processor_power_init() does not register an idle driver any more. Accordingly, the cpuidle driver check in __acpi_processor_start() needs to be updated to avoid calling acpi_processor_power_init() without a cpuidle driver, in which case the registration of the cpuidle device in that function would lead to a NULL pointer dereference in __cpuidle_register_device(). Fixes: 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/5044465.31r3eYUQgx@rafael.j.wysocki [ rjw: Changelog update ] Signed-off-by: Rafael J. Wysocki commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 Author: Zilin Guan Date: Sat Sep 13 15:31:54 2025 +0000 vfio/pds: replace bitmap_free with vfree host_seq_bmp is allocated with vzalloc but is currently freed with bitmap_free, which uses kfree internally. This mismach prevents the resource from being released properly and may result in memory leaks or other issues. Fix this by freeing host_seq_bmp with vfree to match the vzalloc allocation. Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") Signed-off-by: Zilin Guan Reviewed-by: Brett Creeley Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn Signed-off-by: Alex Williamson commit 16df67f2189a71a8310bcebddb87ed569e8352be Author: Alex Mastro Date: Mon Sep 8 08:58:40 2025 -0700 vfio: return -ENOTTY for unsupported device feature The two implementers of vfio_device_ops.device_feature, vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return -ENOTTY in the fallthrough case when the feature is unsupported. For consistency, the base case, vfio_ioctl_device_feature, should do the same when device_feature == NULL, indicating an implementation has no feature extensions. Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com Signed-off-by: Alex Williamson commit 95ee3364b29313a7587b7d1e42a9d043aaf7e592 Merge: aa943a280e88e3 f83ec76bf285be Author: Nathan Chancellor Date: Fri Sep 19 13:43:11 2025 -0700 Merge 6.17-rc6 into kbuild-next Commit bd7c2312128e ("pinctrl: meson: Fix typo in device table macro") is needed in kbuild-next to avoid a build error with a future change. While at it, address the conflict between commit 41f9049cff32 ("riscv: Only allow LTO with CMODEL_MEDANY") and commit 6578a1ff6aa4 ("riscv: Remove version check for LTO_CLANG selects"), as reported by Stephen Rothwell [1]. Link: https://lore.kernel.org/20250908134913.68778b7b@canb.auug.org.au/ [1] Signed-off-by: Nathan Chancellor commit eaba58355ecd124b4a8c91df7335970ad9fe2624 Author: Miaoqian Lin Date: Mon Sep 1 16:18:08 2025 +0800 hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init The debugfs_lookup() function returns a dentry with an increased reference count that must be released by calling dput(). Fixes: b398f91779b8 ("hisi_acc_vfio_pci: register debugfs for hisilicon migration driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Longfang Liu Link: https://lore.kernel.org/r/20250901081809.2286649-1-linmq006@gmail.com Signed-off-by: Alex Williamson commit 801ca4ce0bce45aae1da2c8914d2f86cb68f8b55 Author: Alex Williamson Date: Mon Aug 25 11:58:01 2025 -0600 vfio/platform: Mark reset drivers for removal While vfio-platform itself is on a reprieve from being removed[1], these reset drivers don't support any current hardware, are not being tested, and suggest a level of support that doesn't really exist. Mark them for removal to surface any remaining user such that we can potentially drop them and simplify the code if none appear. Link: https://lore.kernel.org/all/20250806170314.3768750-3-alex.williamson@redhat.com [1] Reviewed-by: Pranjal Shrivastava Reviewed-by: Mostafa Saleh Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20250825175807.3264083-3-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit fd0f75308bfde358e39b0ebd25a50750b6139ae5 Author: Alex Williamson Date: Mon Aug 25 11:58:00 2025 -0600 vfio/amba: Mark for removal vfio-amba has only been touched to keep up with the rest of the code base for the past 10 years. We have no basis to believe that it's currently tested or used. Mark it for deprecation. Reviewed-by: Pranjal Shrivastava Reviewed-by: Mostafa Saleh Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20250825175807.3264083-2-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit 08fb9897f75719947303acfb23b8c41039118a2d Author: Pranjal Shrivastava Date: Mon Sep 1 19:16:19 2025 +0000 MAINTAINERS: Add myself as VFIO-platform reviewer While my work at Google Cloud focuses on various areas of the kernel, my background in IOMMU and the VFIO subsystem motivates me to help with the maintenance effort for vfio-platform (based on the discussion [1]) and ensure its continued health. Link: https://lore.kernel.org/all/aKxpyyKvYcd84Ayi@google.com/ [1] Signed-off-by: Pranjal Shrivastava Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20250901191619.183116-1-praan@google.com Signed-off-by: Alex Williamson commit 6dbcc6ed4bd340f96fde4335a901d985401dd45b Author: Mostafa Saleh Date: Wed Aug 20 20:31:02 2025 +0000 MAINTAINERS: Add myself as VFIO-platform reviewer Based on discussion: https://lore.kernel.org/kvm/20250806170314.3768750-3-alex.williamson@redhat.com/ I will start looking into adding support for modern HW and more features to VFIO-platform. Signed-off-by: Mostafa Saleh Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20250820203102.2034333-1-smostafa@google.com Signed-off-by: Alex Williamson commit 5998f0d07d2c4bf3d8ecc4e6218e6a324aeb7301 Merge: 309e94a64b61d1 2c618f361ae6b9 Author: Mark Brown Date: Fri Sep 19 21:23:48 2025 +0100 ASoC: fsl: fsl_qmc_audio: Reduce amount of Merge series from Christophe Leroy : This is a RESEND of v3 sent one month ago, see: https://lore.kernel.org/all/cover.1754993232.git.christophe.leroy@csgroup.eu/ This series reduces significantly the amount of interrupts on fsl_qmc_audio device. Patches 1 and 2 are preparatory patches. Patch 3 is the main change Patch 4 is a cleanup which is enabled by previous patch commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 Author: Ian Rogers Date: Thu Sep 18 10:24:16 2025 -0700 perf build-id: Ensure snprintf string is empty when size is 0 The string result of build_id__snprintf() is unconditionally used in places like dsos__fprintf_buildid_cb(). If the build id has size 0 then this creates a use of uninitialized memory. Add null termination for the size 0 case. A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf tools: Initialize output buffer in build_id__sprintf") but lost in the transition to snprintf. Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 24937ee839e4bbc097acde73eeed67812bad2d99 Author: Ian Rogers Date: Thu Sep 18 10:24:15 2025 -0700 perf evsel: Ensure the fallback message is always written to The fallback message is unconditionally printed in places like record__open(). If no fallback is attempted this can lead to printing uninitialized data, crashes, etc. Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit edaeb4bcf1511fe4e464fff9dd4a3abf6b0096da Author: Ian Rogers Date: Thu Sep 18 15:22:02 2025 -0700 perf test: Avoid uncore_imc/clockticks in uniquification test The detection of uncore_imc may happen for free running PMUs and the clockticks event may be present on uncore_clock. Rewrite the test to detect duplicated/deduplicated events from perf list, not hardcoded to uncore_imc. If perf stat fails then assume it is permissions and skip the test. Committer testing: Before: root@x1:~# perf test -vv uniquifyi 96: perf stat events uniquifying: --- start --- test child forked, pid 220851 stat event uniquifying test grep: Unmatched [, [^, [:, [., or [= Event is not uniquified [Failed] perf stat -e clockticks -A -o /tmp/__perf_test.stat_output.X7ChD -- true # started on Fri Sep 19 16:48:38 2025 Performance counter stats for 'system wide': CPU0 2,310,956 uncore_clock/clockticks/ 0.001746771 seconds time elapsed ---- end(-1) ---- 96: perf stat events uniquifying : FAILED! root@x1:~# After: root@x1:~# perf test -vv uniquifyi 96: perf stat events uniquifying: --- start --- test child forked, pid 222366 Uniquification of PMU sysfs events test Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_0/data_read/ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_0/data_total/ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_0/data_write/ Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_1/data_read/ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_1/data_total/ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_1/data_write/ ---- end(0) ---- 96: perf stat events uniquifying : Ok root@x1:~# Fixes: 070b315333ee942f ("perf test: Restrict uniquifying test to machines with 'uncore_imc'") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 693101792e45eefc888c7ba10b91108047399f5d Author: Ian Rogers Date: Thu Sep 18 15:22:01 2025 -0700 perf evsel: Fix uniquification when PMU given without suffix The PMU name is appearing twice in: ``` $ perf stat -e uncore_imc_free_running/data_total/ -A true Performance counter stats for 'system wide': CPU0 1.57 MiB uncore_imc_free_running_0/uncore_imc_free_running,data_total/ CPU0 1.58 MiB uncore_imc_free_running_1/uncore_imc_free_running,data_total/ 0.000892376 seconds time elapsed ``` Use the pmu_name_len_no_suffix to avoid this problem. Committer testing: After this patch: root@x1:~# perf stat -e uncore_imc_free_running/data_total/ -A true Performance counter stats for 'system wide': CPU0 1.69 MiB uncore_imc_free_running_0/data_total/ CPU0 1.68 MiB uncore_imc_free_running_1/data_total/ 0.002141605 seconds time elapsed root@x1:~# Fixes: 7d45f402d3117e0b ("perf evlist: Make uniquifying counter names consistent") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 48918cacefd226af44373e914e63304927c0e7dc Author: Ian Rogers Date: Thu Sep 18 15:22:00 2025 -0700 perf test: Don't leak workload gopipe in PERF_RECORD_* The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails. Before: ``` $ perf test -vv 7 7: PERF_RECORD_* events & perf_sample fields: --- start --- test child forked, pid 1189568 Using CPUID GenuineIntel-6-B7-1 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 Attempt to add: software/cpu-clock/ ..after resolving event: software/config=0/ cpu-clock -> software/cpu-clock/ ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0x9 (PERF_COUNT_SW_DUMMY) sample_type IP|TID|TIME|CPU read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 enable_on_exec 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 { wakeup_events, wakeup_watermark } 1 ------------------------------------------------------------ sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 perf_evlist__open: Permission denied ---- end(-2) ---- Leak of file descriptor 6 that opened: 'pipe:[14200347]' ---- unexpected signal (6) ---- iFailed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 #3 0x7f29ce849cc2 in raise raise.c:27 #4 0x7f29ce8324ac in abort abort.c:81 #5 0x565358f662d4 in check_leaks builtin-test.c:226 #6 0x565358f6682e in run_test_child builtin-test.c:344 #7 0x565358ef7121 in start_command run-command.c:128 #8 0x565358f67273 in start_test builtin-test.c:545 #9 0x565358f6771d in __cmd_test builtin-test.c:647 #10 0x565358f682bd in cmd_test builtin-test.c:849 #11 0x565358ee5ded in run_builtin perf.c:349 #12 0x565358ee6085 in handle_internal_command perf.c:401 #13 0x565358ee61de in run_argv perf.c:448 #14 0x565358ee6527 in main perf.c:555 #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #17 0x565358e391c1 in _start perf[851c1] 7: PERF_RECORD_* events & perf_sample fields : FAILED! ``` After: ``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ``` Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 27b1fd62012dfe9d3eb8ecde344d7aa673695ecf Author: Sean Christopherson Date: Fri Aug 8 10:23:57 2025 -0700 x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) Filter out the register forms of 0F 01 when determining whether or not to emulate in response to a potential UMIP violation #GP, as SGDT and SIDT only accept memory operands. The register variants of 0F 01 are used to encode instructions for things like VMX and SGX, i.e. not checking the Mod field would cause the kernel to incorrectly emulate on #GP, e.g. due to a CPL violation on VMLAUNCH. Fixes: 1e5db223696a ("x86/umip: Add emulation code for UMIP instructions") Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org commit 5519b69183c80fbbed8d6eb6dcdf63ba52090d77 Author: Ian Rogers Date: Mon Sep 8 11:19:18 2025 -0700 tools build: Make libperl opt-in rather than opt-out, deprecate If libperl is installed then the perf tool build will build against it. There appears to be limited interest in the scripting support for perl so let's make it opt-in and deprecate it. With this patch applied you need to add LIBPERL=1 to get libperl support in perf - there is no warning if libperl is missing, but building will fail if libperl is missing and the build has LIBPERL=1. The perf version output is changed to: ``` $ perf version --build-options perf version 6.17.rc3.g8eca69269947 aio: [ on ] # HAVE_AIO_SUPPORT bpf: [ on ] # HAVE_LIBBPF_SUPPORT bpf_skeletons: [ on ] # HAVE_BPF_SKEL debuginfod: [ on ] # HAVE_DEBUGINFOD_SUPPORT dwarf: [ on ] # HAVE_LIBDW_SUPPORT dwarf_getlocations: [ on ] # HAVE_LIBDW_SUPPORT dwarf-unwind: [ on ] # HAVE_DWARF_UNWIND_SUPPORT auxtrace: [ on ] # HAVE_AUXTRACE_SUPPORT libbfd: [ OFF ] # HAVE_LIBBFD_SUPPORT ( tip: Deprecated, license incompatibility, use BUILD_NONDISTRO=1 and install binutils-dev[el] ) libbpf-strings: [ on ] # HAVE_LIBBPF_STRINGS_SUPPORT libcapstone: [ on ] # HAVE_LIBCAPSTONE_SUPPORT libdw-dwarf-unwind: [ on ] # HAVE_LIBDW_SUPPORT libelf: [ on ] # HAVE_LIBELF_SUPPORT libnuma: [ on ] # HAVE_LIBNUMA_SUPPORT libopencsd: [ OFF ] # HAVE_CSTRACE_SUPPORT libperl: [ OFF ] # HAVE_LIBPERL_SUPPORT ( tip: Deprecated, use LIBPERL=1 and install libperl-dev to build with it ) libpfm4: [ on ] # HAVE_LIBPFM libpython: [ on ] # HAVE_LIBPYTHON_SUPPORT libslang: [ on ] # HAVE_SLANG_SUPPORT libtraceevent: [ on ] # HAVE_LIBTRACEEVENT libunwind: [ OFF ] # HAVE_LIBUNWIND_SUPPORT ( tip: Deprecated, use LIBUNWIND=1 and install libunwind-dev[el] to build with it ) lzma: [ on ] # HAVE_LZMA_SUPPORT numa_num_possible_cpus: [ on ] # HAVE_LIBNUMA_SUPPORT zlib: [ on ] # HAVE_ZLIB_SUPPORT zstd: [ on ] # HAVE_ZSTD_SUPPORT ``` i.e. there is a tip saying about deprecation and how to get support back. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Charlie Jenkins Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Steven Rostedt (VMware) Cc: Tomas Glozar Cc: Yuzhuo Jing Link: https://lore.kernel.org/lkml/aMrk03gigBlGcYLK@x1/ Link: https://lore.kernel.org/lkml/CAP-5=fVX+bLBRJCiziDi_hBySgv2NFtDoghtpheSSxVAvvETGw@mail.gmail.com [ Keep the pre-existing perl-ExtUtils-Embed hint for Fedora/RHEL systems ] Signed-off-by: Arnaldo Carvalho de Melo commit 3e2518d8b646afe159170422c1c8e072ba7c0798 Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:51 2025 -0500 dt-bindings: arm: marvell: Convert marvell,orion5x boards to DT schema Convert Marvell Orion5x based boards to DT schema format. Signed-off-by: Rob Herring (Arm) commit 573a8be749aed8d0744b78d6795cb2d7c20c14be Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:31 2025 -0500 dt-bindings: arm: marvell: Convert marvell,dove boards to DT schema Convert Marvell Dove based boards to DT schema format. Signed-off-by: Rob Herring (Arm) commit 1c5f2ea8ce7f53f1c72980ac312ae1c0c29aa8a5 Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:25 2025 -0500 dt-bindings: arm: marvell: Convert marvell,kirkwood boards to DT schema Convert Marvell Kirkwood based boards to DT schema format. Signed-off-by: Rob Herring (Arm) commit 3ef9017c373bba536d5e23d535d404525bdcfeb9 Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:17 2025 -0500 dt-bindings: arm: marvell: Convert marvell,armada390 boards to DT schema Convert Marvell Armada-390 based boards to DT schema format. Signed-off-by: Rob Herring (Arm) commit abd4ac56f4af01a60922ccdfcbaa6b7dac994a32 Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:12 2025 -0500 dt-bindings: arm: marvell: Convert marvell,armada375 boards to DT schema Convert Marvell Armada-375 based boards to DT schema format. Signed-off-by: Rob Herring (Arm) commit ae28e0b895bb4fa78390ac9ad799a3fcd0ec11d2 Author: Rob Herring (Arm) Date: Tue Aug 5 18:25:00 2025 -0500 dt-bindings: arm: marvell: Convert marvell,armada-370-xp boards to DT schema Convert Marvell Armada 370/XP based boards to DT schema format. Acked-by: Gregory CLEMENT Signed-off-by: Rob Herring (Arm) commit c0b595230cc19833f3a3def766a5e9865b80f8fa Merge: 2c9684bfee9476 a146cfaaa0dd8a Author: Marc Kleine-Budde Date: Fri Sep 19 20:57:14 2025 +0200 Merge patch series "can: raw: optimize the sizes of struct uniqframe and struct raw_sock" Vincent Mailhol says: A few bytes can be shaved out of can raw's struct uniqframe and struct raw_sock. Patch #1 reorders struct uniqframe fields to save 8 bytes. Patch #2 and #3 modify struct raw_sock to use bitfields and to reorder its fields to save 24 bytes in total. Link: https://patch.msgid.link/20250917-can-raw-repack-v2-0-395e8b3a4437@kernel.org Signed-off-by: Marc Kleine-Budde commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 Author: Michael Karcher Date: Fri Sep 5 00:03:34 2025 +0200 sparc: fix accurate exception reporting in copy_{from,to}_user for M7 The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de Signed-off-by: Michael Karcher Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de Signed-off-by: Andreas Larsson commit 5a746c1a2c7980de6c888b6373299f751ad7790b Author: Michael Karcher Date: Fri Sep 5 00:03:33 2025 +0200 sparc: fix accurate exception reporting in copy_to_user for Niagara 4 The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a bad calculation. This will fix the return value of copy_to_user in a specific faulting case. The behaviour of memcpy stays unchanged. Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 Signed-off-by: Michael Karcher Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de Signed-off-by: Andreas Larsson commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c Author: Michael Karcher Date: Fri Sep 5 00:03:32 2025 +0200 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code Tested-by: Magnus Lindholm # on Sun Fire T2000 Signed-off-by: Michael Karcher Tested-by: Ethan Hawke # on Sun Fire T2000 Tested-by: Ken Link # on Sun Fire T1000 Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de Signed-off-by: Andreas Larsson commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 Author: Michael Karcher Date: Fri Sep 5 00:03:31 2025 +0200 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy. The BUG_ON has been reported in https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 Reviewed-by: Anthony Yznaga Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi Signed-off-by: Michael Karcher Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de Signed-off-by: Andreas Larsson commit 4fba1713001195e59cfc001ff1f2837dab877efb Author: Michael Karcher Date: Fri Sep 5 00:03:30 2025 +0200 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 Tested-by: René Rebe # on Ultra 5 UltraSparc IIi Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 Signed-off-by: Michael Karcher Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de Signed-off-by: Andreas Larsson commit a146cfaaa0dd8a3e2cf3447cd2965a3c4d046e8f Author: Vincent Mailhol Date: Wed Sep 17 13:48:26 2025 +0900 can: raw: reorder struct raw_sock's members to optimise packing struct raw_sock has several holes. Reorder the fields to save 8 bytes. Statistics before: $ pahole --class_name=raw_sock net/can/raw.o struct raw_sock { struct sock sk __attribute__((__aligned__(8))); /* 0 776 */ /* XXX last struct has 1 bit hole */ /* --- cacheline 12 boundary (768 bytes) was 8 bytes ago --- */ int ifindex; /* 776 4 */ /* XXX 4 bytes hole, try to pack */ struct net_device * dev; /* 784 8 */ netdevice_tracker dev_tracker; /* 792 0 */ struct list_head notifier; /* 792 16 */ unsigned int bound:1; /* 808: 0 4 */ unsigned int loopback:1; /* 808: 1 4 */ unsigned int recv_own_msgs:1; /* 808: 2 4 */ unsigned int fd_frames:1; /* 808: 3 4 */ unsigned int xl_frames:1; /* 808: 4 4 */ unsigned int join_filters:1; /* 808: 5 4 */ /* XXX 2 bits hole, try to pack */ /* Bitfield combined with next fields */ struct can_raw_vcid_options raw_vcid_opts; /* 809 4 */ /* XXX 3 bytes hole, try to pack */ canid_t tx_vcid_shifted; /* 816 4 */ canid_t rx_vcid_shifted; /* 820 4 */ canid_t rx_vcid_mask_shifted; /* 824 4 */ int count; /* 828 4 */ /* --- cacheline 13 boundary (832 bytes) --- */ struct can_filter dfilter; /* 832 8 */ struct can_filter * filter; /* 840 8 */ can_err_mask_t err_mask; /* 848 4 */ /* XXX 4 bytes hole, try to pack */ struct uniqframe * uniq; /* 856 8 */ /* size: 864, cachelines: 14, members: 20 */ /* sum members: 852, holes: 3, sum holes: 11 */ /* sum bitfield members: 6 bits, bit holes: 1, sum bit holes: 2 bits */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 32 bytes */ } __attribute__((__aligned__(8))); ...and after: $ pahole --class_name=raw_sock net/can/raw.o struct raw_sock { struct sock sk __attribute__((__aligned__(8))); /* 0 776 */ /* XXX last struct has 1 bit hole */ /* --- cacheline 12 boundary (768 bytes) was 8 bytes ago --- */ struct net_device * dev; /* 776 8 */ netdevice_tracker dev_tracker; /* 784 0 */ struct list_head notifier; /* 784 16 */ int ifindex; /* 800 4 */ unsigned int bound:1; /* 804: 0 4 */ unsigned int loopback:1; /* 804: 1 4 */ unsigned int recv_own_msgs:1; /* 804: 2 4 */ unsigned int fd_frames:1; /* 804: 3 4 */ unsigned int xl_frames:1; /* 804: 4 4 */ unsigned int join_filters:1; /* 804: 5 4 */ /* XXX 2 bits hole, try to pack */ /* Bitfield combined with next fields */ struct can_raw_vcid_options raw_vcid_opts; /* 805 4 */ /* XXX 3 bytes hole, try to pack */ canid_t tx_vcid_shifted; /* 812 4 */ canid_t rx_vcid_shifted; /* 816 4 */ canid_t rx_vcid_mask_shifted; /* 820 4 */ can_err_mask_t err_mask; /* 824 4 */ int count; /* 828 4 */ /* --- cacheline 13 boundary (832 bytes) --- */ struct can_filter dfilter; /* 832 8 */ struct can_filter * filter; /* 840 8 */ struct uniqframe * uniq; /* 848 8 */ /* size: 856, cachelines: 14, members: 20 */ /* sum members: 852, holes: 1, sum holes: 3 */ /* sum bitfield members: 6 bits, bit holes: 1, sum bit holes: 2 bits */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 24 bytes */ } __attribute__((__aligned__(8))); Acked-by: Oliver Hartkopp Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250917-can-raw-repack-v2-3-395e8b3a4437@kernel.org Signed-off-by: Marc Kleine-Budde commit 890e5198a6e5b238627c245fafea1a92670a86cd Author: Vincent Mailhol Date: Wed Sep 17 13:48:25 2025 +0900 can: raw: use bitfields to store flags in struct raw_sock The bound, loopback, recv_own_msgs, fd_frames, xl_frames and join_filters fields of struct raw_sock just need to store one bit of information. Declare all those members as a bitfields of type unsigned int and width one bit. Add a temporary variable to raw_setsockopt() and raw_getsockopt() to make the conversion between the stored bits and the socket interface. This reduces the size of struct raw_sock by sixteen bytes. Statistics before: $ pahole --class_name=raw_sock net/can/raw.o struct raw_sock { struct sock sk __attribute__((__aligned__(8))); /* 0 776 */ /* XXX last struct has 1 bit hole */ /* --- cacheline 12 boundary (768 bytes) was 8 bytes ago --- */ int bound; /* 776 4 */ int ifindex; /* 780 4 */ struct net_device * dev; /* 784 8 */ netdevice_tracker dev_tracker; /* 792 0 */ struct list_head notifier; /* 792 16 */ int loopback; /* 808 4 */ int recv_own_msgs; /* 812 4 */ int fd_frames; /* 816 4 */ int xl_frames; /* 820 4 */ struct can_raw_vcid_options raw_vcid_opts; /* 824 4 */ canid_t tx_vcid_shifted; /* 828 4 */ /* --- cacheline 13 boundary (832 bytes) --- */ canid_t rx_vcid_shifted; /* 832 4 */ canid_t rx_vcid_mask_shifted; /* 836 4 */ int join_filters; /* 840 4 */ int count; /* 844 4 */ struct can_filter dfilter; /* 848 8 */ struct can_filter * filter; /* 856 8 */ can_err_mask_t err_mask; /* 864 4 */ /* XXX 4 bytes hole, try to pack */ struct uniqframe * uniq; /* 872 8 */ /* size: 880, cachelines: 14, members: 20 */ /* sum members: 876, holes: 1, sum holes: 4 */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 48 bytes */ } __attribute__((__aligned__(8))); ...and after: $ pahole --class_name=raw_sock net/can/raw.o struct raw_sock { struct sock sk __attribute__((__aligned__(8))); /* 0 776 */ /* XXX last struct has 1 bit hole */ /* --- cacheline 12 boundary (768 bytes) was 8 bytes ago --- */ int ifindex; /* 776 4 */ /* XXX 4 bytes hole, try to pack */ struct net_device * dev; /* 784 8 */ netdevice_tracker dev_tracker; /* 792 0 */ struct list_head notifier; /* 792 16 */ unsigned int bound:1; /* 808: 0 4 */ unsigned int loopback:1; /* 808: 1 4 */ unsigned int recv_own_msgs:1; /* 808: 2 4 */ unsigned int fd_frames:1; /* 808: 3 4 */ unsigned int xl_frames:1; /* 808: 4 4 */ unsigned int join_filters:1; /* 808: 5 4 */ /* XXX 2 bits hole, try to pack */ /* Bitfield combined with next fields */ struct can_raw_vcid_options raw_vcid_opts; /* 809 4 */ /* XXX 3 bytes hole, try to pack */ canid_t tx_vcid_shifted; /* 816 4 */ canid_t rx_vcid_shifted; /* 820 4 */ canid_t rx_vcid_mask_shifted; /* 824 4 */ int count; /* 828 4 */ /* --- cacheline 13 boundary (832 bytes) --- */ struct can_filter dfilter; /* 832 8 */ struct can_filter * filter; /* 840 8 */ can_err_mask_t err_mask; /* 848 4 */ /* XXX 4 bytes hole, try to pack */ struct uniqframe * uniq; /* 856 8 */ /* size: 864, cachelines: 14, members: 20 */ /* sum members: 852, holes: 3, sum holes: 11 */ /* sum bitfield members: 6 bits, bit holes: 1, sum bit holes: 2 bits */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 32 bytes */ } __attribute__((__aligned__(8))); Acked-by: Oliver Hartkopp Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250917-can-raw-repack-v2-2-395e8b3a4437@kernel.org Signed-off-by: Marc Kleine-Budde commit fc8418eca43d5872e3976636d7c4924094bd07fd Author: Vincent Mailhol Date: Wed Sep 17 13:48:24 2025 +0900 can: raw: reorder struct uniqframe's members to optimise packing struct uniqframe has one hole. Reorder the fields to save 8 bytes. Statistics before: $ pahole --class_name=uniqframe net/can/raw.o struct uniqframe { int skbcnt; /* 0 4 */ /* XXX 4 bytes hole, try to pack */ const struct sk_buff * skb; /* 8 8 */ unsigned int join_rx_count; /* 16 4 */ /* size: 24, cachelines: 1, members: 3 */ /* sum members: 16, holes: 1, sum holes: 4 */ /* padding: 4 */ /* last cacheline: 24 bytes */ }; ...and after: $ pahole --class_name=uniqframe net/can/raw.o struct uniqframe { const struct sk_buff * skb; /* 0 8 */ int skbcnt; /* 8 4 */ unsigned int join_rx_count; /* 12 4 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; Acked-by: Oliver Hartkopp Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250917-can-raw-repack-v2-1-395e8b3a4437@kernel.org Signed-off-by: Marc Kleine-Budde commit 7205ef77dfe167df1b83aea28cf00fc02d662990 Author: Al Viro Date: Sun Aug 10 04:42:08 2025 +0100 sparc64: fix prototypes of reads[bwl]() Conventions for readsl() are the same as for readl() - any __iomem pointer is acceptable, both const and volatile ones being OK. Same for readsb() and readsw(). Signed-off-by: Al Viro Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson # Making sparc64 subject prefix commit 3751aa6e7147791e0c0c446f5f55c61762886a2f Author: Qianfeng Rong Date: Sat Aug 9 22:33:01 2025 +0800 sparc64: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 6fd44a481b3c6111e4801cec964627791d0f3ec5 Author: Anthony Yznaga Date: Tue Jul 15 18:24:46 2025 -0700 sparc64: fix hugetlb for sun4u An attempt to exercise sparc hugetlb code in a sun4u-based guest running under qemu results in the guest hanging due to being stuck in a trap loop. This is due to invalid hugetlb TTEs being installed that do not have the expected _PAGE_PMD_HUGE and page size bits set. Although the breakage has gone apparently unnoticed for several years, fix it now so there is the option to exercise sparc hugetlb code under qemu. This can be useful because sun4v support in qemu does not support linux guests currently and sun4v-based hardware resources may not be readily available. Fix tested with a 6.15.2 and 6.16-rc6 kernels by running libhugetlbfs tests on a qemu guest running Debian 13. Fixes: c7d9f77d33a7 ("sparc64: Multi-page size support") Cc: stable@vger.kernel.org Signed-off-by: Anthony Yznaga Tested-by: John Paul Adrian Glaubitz Reviewed-by: John Paul Adrian Glaubitz Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20250716012446.10357-1-anthony.yznaga@oracle.com Signed-off-by: Andreas Larsson commit fd321a861fcae862a4800fa49375336ee64e6c9c Author: Svyatoslav Ryhel Date: Tue Sep 9 08:49:03 2025 +0300 Input: atmel_mxt_ts - add support for generic touchscreen configurations This provides support for generic touchscreen configuration options like swapped-x-y, min-x, min-y, size-x, size-y, etc. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250909054903.11519-3-clamor95@gmail.com Signed-off-by: Dmitry Torokhov commit dee099fd9d9af800ef28a3f930d32974104cf36a Author: Koakuma Date: Mon Jun 9 20:53:12 2025 +0700 sparc/module: Make it clear that relocation numbers are shown in hex This is to ease debugging by removing the ambiguity of the shown number base. Signed-off-by: Koakuma Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 05457d96175d25c976ab6241c332ae2eb5e07833 Author: Koakuma Date: Mon Jun 9 20:53:11 2025 +0700 sparc/module: Add R_SPARC_UA64 relocation handling This is needed so that the kernel can handle R_SPARC_UA64 relocations, which is emitted by LLVM's IAS. Signed-off-by: Koakuma Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit b90d027afbdde5a0b640586f4cf91cc5cc97a5bc Author: Svyatoslav Ryhel Date: Tue Sep 9 08:49:02 2025 +0300 dt-bindings: input: maxtouch: add common touchscreen properties Since atmel,maxtouch describes touchscreens too, it should include common touchscreen properties. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250909054903.11519-2-clamor95@gmail.com Signed-off-by: Dmitry Torokhov commit 1c72774df028429836eec3394212f2921bb830fc Author: Chen Wang Date: Fri Sep 12 10:36:31 2025 +0800 PCI: sg2042: Add Sophgo SG2042 PCIe driver Add support for PCIe controller in Sophgo SG2042 SoC. The controller uses the Cadence PCIe core programmed by pcie-cadence* common driver. The PCIe controller in SG2042 works in host mode only, supporting data rate up to 16 GT/s and lanes up to x16 or x8. Signed-off-by: Chen Wang [mani: reworded description and minor code cleanups] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/01b0a57cd9dba8bed7c1f2d52997046c2c6f042b.1757643388.git.unicorn_wang@outlook.com commit 32278c677947ae2f042c9535674a7fff9a245dd3 Author: Sean Christopherson Date: Fri Aug 8 10:23:56 2025 -0700 x86/umip: Check that the instruction opcode is at least two bytes When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation. E.g. if a VPALIGNR instruction 62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream). Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness. Analyzed by Nick Bray . Fixes: 1e5db223696a ("x86/umip: Add emulation code for UMIP instructions") Reported-by: Dan Snyder Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org commit 2c9684bfee9476ef5038fe44d96464c632358fbc Merge: 79edb88b891e7c 37dc3ea4d2a21f Author: Marc Kleine-Budde Date: Fri Sep 19 20:17:57 2025 +0200 Merge patch series "can: esd_usb: Fixes and improvements" Stefan Mätje says: The first patch makes some error messages also print the error code to achieve a higher significance. Removes also a duplicate message and makes the register / unregister messages symmetric. The second patch avoids emitting any error messages during the disconnect of CAN-USB devices or the driver unload. Changes in v2: - Second patch: - Convert all occurrences of error status prints to use "ERR_PTR(err)" instead of printing the decimal value of "err". - Rename retval to err in esd_usb_read_bulk_callback() to make the naming of error status variables consistent with all other functions. Link: https://patch.msgid.link/20250821143422.3567029-1-stefan.maetje@esd.eu [mkl: only take paches 4+5, which are new features, adjust cover letter accordingly] Signed-off-by: Marc Kleine-Budde commit 3df6979d222b8638a60aa6921b73cb5f3e4f5dcb Author: Ryan Roberts Date: Wed Sep 17 12:02:10 2025 -0700 arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs The kernel linear mapping is painted in very early stage of system boot. The cpufeature has not been finalized yet at this point. So the linear mapping is determined by the capability of boot CPU only. If the boot CPU supports BBML2, large block mappings will be used for linear mapping. But the secondary CPUs may not support BBML2, so repaint the linear mapping if large block mapping is used and the secondary CPUs don't support BBML2 once cpufeature is finalized on all CPUs. If the boot CPU doesn't support BBML2 or the secondary CPUs have the same BBML2 capability with the boot CPU, repainting the linear mapping is not needed. Repainting is implemented by the boot CPU, which we know supports BBML2, so it is safe for the live mapping size to change for this CPU. The linear map region is walked using the pagewalk API and any discovered large leaf mappings are split to pte mappings using the existing helper functions. Since the repainting is performed inside of a stop_machine(), we must use GFP_ATOMIC to allocate the extra intermediate pgtables. But since we are still early in boot, it is expected that there is plenty of memory available so we will never need to sleep for reclaim, and so GFP_ATOMIC is acceptable here. The secondary CPUs are all put into a waiting area with the idmap in TTBR0 and reserved map in TTBR1 while this is performed since they cannot be allowed to observe any size changes on the live mappings. Some of this infrastructure is reused from the kpti case. Specifically we share the same flag (was __idmap_kpti_flag, now idmap_kpti_bbml2_flag) since it means we don't have to reserve any extra pgtable memory to idmap the extra flag. Co-developed-by: Yang Shi Signed-off-by: Yang Shi Signed-off-by: Ryan Roberts Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 Author: Chen Wang Date: Fri Sep 12 10:36:01 2025 +0800 PCI: cadence: Check for the existence of cdns_pcie::ops before using it cdns_pcie::ops might not be populated by all the Cadence glue drivers. This is going to be true for the upcoming Sophgo platform which doesn't set the ops. Hence, add a check to prevent NULL pointer dereference. Signed-off-by: Chen Wang [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com commit 4e4a4f58bed19e1a3a5a7c3a18ce3b927b76fcd3 Author: Chen Wang Date: Fri Sep 12 10:35:32 2025 +0800 dt-bindings: pci: Add Sophgo SG2042 PCIe host Add binding for Sophgo SG2042 PCIe host controller. Signed-off-by: Chen Wang Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/2755f145755b6096247c26852b63671a6fea4dbf.1757643388.git.unicorn_wang@outlook.com commit 37dc3ea4d2a21f3b0c474ae3aeebcfada6a29655 Author: Stefan Mätje Date: Thu Aug 21 16:34:22 2025 +0200 can: esd_usb: Avoid errors triggered from USB disconnect The USB stack calls during disconnect the esd_usb_disconnect() callback. esd_usb_disconnect() calls netdev_unregister() for each network which in turn calls the net_device_ops::ndo_stop callback esd_usb_close() if the net device is up. The esd_usb_close() callback tries to disable all CAN Ids and to reset the CAN controller of the device sending appropriate control messages. Sending these messages in .disconnect() is moot and always fails because either the device is gone or the USB communication is already torn down by the USB stack in the course of a rmmod operation. Move the code that sends these control messages to a new function esd_usb_stop() which is approximately the counterpart of esd_usb_start() to make code structure less convoluted. Then change esd_usb_close() not to send the control messages at all if the ndo_stop() callback is executed from the USB .disconnect() callback. Add a new flag in_usb_disconnect to the struct esd_usb device structure to mark this condition which is checked by esd_usb_close() whether to skip the send operations in esd_usb_start(). Signed-off-by: Stefan Mätje Link: https://patch.msgid.link/20250821143422.3567029-6-stefan.maetje@esd.eu [mkl: minor change patch description to imperative language] Signed-off-by: Marc Kleine-Budde commit c6e07521431ce6d45a0ea2d220df456a7785087c Author: Stefan Mätje Date: Thu Aug 21 16:34:21 2025 +0200 can: esd_usb: Rework display of error messages - esd_usb_open(): Get rid of duplicate "couldn't start device: %d\n" message already printed from esd_usb_start(). - Fix duplicate printout of network device name when network device is registered. Add an unregister message for the network device as counterpart to the register message. - Add the printout of error codes together with the error messages in esd_usb_close() and some in esd_usb_probe(). The additional error codes should lead to a better understanding what is really going wrong. - Convert all occurrences of error status prints to use "ERR_PTR(err)" instead of printing the decimal value of "err". - Rename retval to err in esd_usb_read_bulk_callback() to make the naming of error status variables consistent with all other functions. Signed-off-by: Stefan Mätje Link: https://patch.msgid.link/20250821143422.3567029-5-stefan.maetje@esd.eu [mkl: minor change patch description to imperative language] Signed-off-by: Marc Kleine-Budde commit 537e189f2708864e21c9be7109e1f454b956370c Author: Rob Herring (Arm) Date: Tue Sep 9 09:21:59 2025 -0500 dt-bindings: watchdog: Convert nuvoton,npcm-wdt to DT schema Convert the Nuvoton watchdog binding to DT schema format. It's a straight-forward conversion. Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20250909142201.3209482-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 11f8652b7112ee2deba436045ef9b847cbb415a6 Author: Rob Herring (Arm) Date: Thu Aug 21 13:06:40 2025 -0500 dt-bindings: arm: Add Arm C1 cores and PMUs Add the newly introduced Arm C1-Nano/Pro/Premium/Ultra core and PMU compatible strings. These cores are part of the Lumex CSS. The new names are replacing the long lived Cortex-A/X branding going forward. Signed-off-by: Rob Herring (Arm) commit 2ad572d3a5b340770672aee9aa3c4941d3df737d Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:55 2025 -0300 dt-bindings: display: mediatek,ufoe: Add mediatek,gce-client-reg property Currently, users of Mediatek UFOe (Unified Frame Optimization engine) DT bindings set mediatek,gce-client-reg node property, which is missing from the DT schema. For example, device tree arch/arm64/boot/dts/mediatek/mt8173.dtsi is causing the following dtb check error: arch/arm64/boot/dts/mediatek/mt8173-elm.dtb: ufoe@1401a000 (mediatek,mt8173-disp-ufoe): 'mediatek,gce-client-reg' does not match any of the regexes: '^pinctrl-[0-9]+$' This commit adds the missing node property in the DT schema and updates the example as well. Signed-off-by: Ariel D'Alessandro Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250911151001.108744-7-ariel.dalessandro@collabora.com Signed-off-by: Rob Herring (Arm) commit 9b4bacf5d998a9222cab8f9cd3b851ccba0d9351 Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:54 2025 -0300 dt-bindings: display: mediatek,od: Add mediatek,gce-client-reg property Currently, users of Mediatek OD (display overdrive) DT bindings set mediatek,gce-client-reg node property, which is missing from the DT schema. For example, device tree arch/arm64/boot/dts/mediatek/mt8173.dtsi is causing the following dtb check error: arch/arm64/boot/dts/mediatek/mt8173-elm.dtb: od@14023000 (mediatek,mt8173-disp-od): 'mediatek,gce-client-reg' does not match any of the regexes: '^pinctrl-[0-9]+$' This commit adds the missing node property in the DT schema and updates the example as well. Signed-off-by: Ariel D'Alessandro Link: https://lore.kernel.org/r/20250911151001.108744-6-ariel.dalessandro@collabora.com Signed-off-by: Rob Herring (Arm) commit d27ce63a31c3c9b221287844c41088e499042199 Author: Rob Herring (Arm) Date: Thu Aug 28 17:30:21 2025 -0500 dt-bindings: edac: Convert apm,xgene-edac to DT schema Convert the APM XGene EDAC binding to DT schema. Add the missing "apm,xgene-edac-soc" compatible, and drop the unused "apm,xgene-edac-pmd-v2" compatible. Link: https://lore.kernel.org/r/20250828223023.2409337-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 047170ac08d6fa250209bed7c105d0443f1e0d81 Author: Rob Herring (Arm) Date: Fri Aug 22 17:57:00 2025 -0500 dt-binding: thermal: Convert marvell,armada-ap806-thermal to DT schema Convert the Marvell Armada AP80x/CP110 thermal binding to schema. It is a straight forward conversion. Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250822225701.766947-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit c72504a22e1c4d87b3addc73db2f6e51a4b78b88 Author: Rob Herring (Arm) Date: Fri Aug 22 17:56:44 2025 -0500 dt-bindings: thermal: Convert marvell,armada370-thermal to DT schema Convert the Marvell Armada 3xx/XP thermal binding to schema. Drop the AP80x and CP110 as they have long been deprecated and have been replaced by a new binding. Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250822225645.766397-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 638f9174e4bf8036e9167f4ff6b937cc5b842da6 Author: Rob Herring (Arm) Date: Tue Aug 12 15:32:57 2025 -0500 dt-bindings: watchdog: Convert marvell,armada-3700-wdt to DT schema Convert the Marvell Armada 3700 watchdog binding to DT schema format. It's a straight-forward conversion. Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20250812203301.726374-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 930c78583d350bedcaa8fc2302e9d3c37a7f0700 Author: Rob Herring (Arm) Date: Tue Aug 12 13:14:13 2025 -0500 dt-bindings: mailbox: Convert brcm,iproc-flexrm-mbox to DT schema Convert the Broadcom FlexRM Ring Manager binding to DT schema format. It's a straightforward conversion. Link: https://lore.kernel.org/r/20250812181415.66923-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit bc4f25b5b7c5a8b0f85b2840421590ad9260eda5 Author: Rob Herring (Arm) Date: Tue Aug 12 13:14:04 2025 -0500 dt-bindings: mailbox: Convert brcm,iproc-pdc-mbox to DT schema Convert the Broadcom iProc PDC mailbox binding to DT schema format. It's a straightforward conversion. Link: https://lore.kernel.org/r/20250812181406.65390-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit cae18692965571a3ccf7582b6b661cebbcd0ccae Author: Rob Herring (Arm) Date: Tue Aug 12 13:13:53 2025 -0500 dt-bindings: mailbox: Convert marvell,armada-3700-rwtm-mailbox to DT schema Convert the Marvell Armada 3700 rWTM mailbox binding to DT schema format. It's a straightforward conversion. Link: https://lore.kernel.org/r/20250812181357.63395-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 72289f57b071b35fa4fe48382ce30ea5c7d60ebc Author: Rob Herring (Arm) Date: Tue Aug 12 13:13:46 2025 -0500 dt-bindings: mailbox: Convert rockchip,rk3368-mailbox to DT schema Convert the rockchip,rk3368-mailbox binding to DT schema format. Add the missing 'clocks' and 'clock-names' properties. Document that it's one interrupt per mailbox channel (and there are 4 channels). Link: https://lore.kernel.org/r/20250812181348.62137-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 8a454c05632077e9bee51ddbf8a633739490e308 Author: Rob Herring (Arm) Date: Thu Aug 7 16:42:21 2025 -0500 dt-bindings: watchdog: Drop duplicate moxa,moxart-watchdog.txt "moxa,moxart-watchdog" is already documented in faraday,ftwdt010.yaml, so drop the old text binding. Reviewed-by: Guenter Roeck Fixes: 289660a4af0e ("dt-bindings: watchdog: convert faraday,ftwdt010 to yaml") Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250807214222.4170236-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 79edb88b891e7c10a0da43c0ec95b1f30892e270 Merge: fbfa8f4f3d4ede 7207788031b9c9 Author: Marc Kleine-Budde Date: Fri Sep 19 19:25:20 2025 +0200 Merge patch series "can: rcar_can: Miscellaneous cleanups and improvements" Geert Uytterhoeven says: This patch series contains miscellaneous cleanups and improvements for the R-Car CAN driver. I deliberately sent this as a separate series from "[PATCH] can: rcar_can: Fix s2ram with PSCI"[1], to avoid blocking the latter. However, this series (in particular [PATCH 3/9]) does depend on it. Changes compared to v1[2]: - Convert new Runtime PM error messages to %pe, - New patches 10 and 11. [1] https://lore.kernel.org/699b2f7fcb60b31b6f976a37f08ce99c5ffccb31.1755165227.git.geert+renesas@glider.be [2] https://lore.kernel.org/cover.1755172404.git.geert+renesas@glider.be Link: https://patch.msgid.link/cover.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 7207788031b9c92eb12600272e20b1c8a27908bf Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:12 2025 +0200 can: rcar_can: Convert to %pe Replace numerical error codes by mnemotechnic error codes, to improve the user experience in case of errors. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/adb2dc49c78b45191de410f645a5e423d341f94e.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 5317225e015c9575e70998cf23534cac0ceab2ba Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:11 2025 +0200 can: rcar_can: Do not print alloc_candev() failures If alloc_candev() failed due to out-of-memory, the core memory allocation code has already printed an error message. If alloc_candev() failed for a different reason, alloc_netdev_mqs() has already printed an error message. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/2d6ad4be211a35492570fd7219ca7a89b384bfad.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 729b1c69b8fa4de212056eca1771732013da357b Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:10 2025 +0200 can: rcar_can: Mailbox bitfield conversion Convert CAN Mailbox Register field accesses to use the FIELD_PREP() and FIELD_GET() bitfield access macro. This gets rid of explicit shifts, and keeps a clear separation between hardware register layouts and offical CAN definitions. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/c75c7d6ed5929c4becf7c9178cec04a0731e8ab1.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 8d930226d3e543b9d1c7f1b33bcf1b881168d420 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:09 2025 +0200 can: rcar_can: BCR bitfield conversion Convert CAN Bit Configuration Register field accesses to use the FIELD_PREP() bitfield access macro. While at it, fix the misspelling of BRP. This gets rid of custom function-like field preparation macros. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/01cfaedba2be22515ba8700893ea7f113df959c0.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 75f319455d0527e5ac6eb2c94af79fea548ac5a6 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:08 2025 +0200 can: rcar_can: TFCR bitfield conversion Convert CAN Transmit FIFO Control Register field accesses to use the FIELD_GET() bitfield access macro. This gets rid of an explicit shift. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/a8b1dc6f1249a01af9b691ca59e2e5cc2dba6d44.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 669abc406812e2d8db9a7a7cb49cd52935650cf8 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:07 2025 +0200 can: rcar_can: CTLR bitfield conversion Convert CAN Control Register field accesses to use the FIELD_PREP() bitfield access macro. Add a few more comments and definitions while at it. This gets rid of explicit (and sometimes confusing) shifts. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/077640e31949dc3c9d128a08ade94c9e9cd25672.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 28f3617c392ab2606c5cfa03ad0717def28fdf12 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:06 2025 +0200 can: rcar_can: Convert to GENMASK() Use the GENMASK() macro instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/3f947f0f91a8857a2cbce74807e42258e9f209ca.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit bcf4dee47fdf9e9961376c3e46bce777808cdec8 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:05 2025 +0200 can: rcar_can: Convert to BIT() Use the BIT() macro instead of open-coding the same operation. Add a few more comments while at it. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/78fb16beb74975f6f6140ec9abb48beb94fb0afa.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 1bbff1762638830916f62694b43cf6c4de298c36 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:04 2025 +0200 can: rcar_can: Convert to Runtime PM The R-Car CAN module is part of a Clock Domain on all supported SoCs. Hence convert its driver from explicit clock management to Runtime PM. While at it, use %pe to format error codes. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/68bfa5480a79c17c6ceec4fb073f33872e7ff5d0.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit f7844496cba4a6eae00ee39d6fff0a98c9952cfa Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:03 2025 +0200 can: rcar_can: Add helper variable dev to rcar_can_probe() rcar_can_probe() has many users of "pdev->dev". Introduce a shorthand to simplify the code. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/baf34c8bef5625ae73c830dbb3c617eb8f7adddd.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 7abf704493694e5f42cc0ce467fca0f885494ae6 Author: Geert Uytterhoeven Date: Fri Aug 22 12:17:02 2025 +0200 can: rcar_can: Consistently use ndev for net_device pointers Most net_device pointers are named "ndev", but some are called "dev". Increase uniformity by always using "ndev". Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/aac66fb5b5e1d6787121cf2ec36b551b41d4b32e.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit a755da0dd0530e53aa026fd4d08b3097e1be6455 Author: Uday Shankar Date: Thu Sep 18 13:34:09 2025 -0600 selftests: ublk: add test to verify that feat_map is complete Add a test that verifies that the currently running kernel does not report support for any features that are unrecognized by kublk. This should catch cases where features are added without updating kublk's feat_map accordingly, which has happened multiple times in the past (see [1], [2]). Note that this new test may fail if the test suite is older than the kernel, and the newer kernel contains a newly introduced feature. I believe this is not a use case we currently care about - we only care about newer test suites passing on older kernels. [1] https://lore.kernel.org/linux-block/20250606214011.2576398-1-csander@purestorage.com/t/#u [2] https://lore.kernel.org/linux-block/2a370ab1-d85b-409d-b762-f9f3f6bdf705@nvidia.com/t/#m1c520a058448d594fd877f07804e69b28908533f Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 742bcc1101bcaca92901fe3fe434e4b1a467b5e8 Author: Uday Shankar Date: Thu Sep 18 13:34:08 2025 -0600 selftests: ublk: kublk: add UBLK_F_BUF_REG_OFF_DAEMON to feat_map When UBLK_F_BUF_REG_OFF_DAEMON was added, we missed updating kublk's feat_map, which results in the feature being reported as "unknown." Add UBLK_F_BUF_REG_OFF_DAEMON to feat_map to fix this. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 1f924cf781de47432f220185bb2beeb12c666aa1 Author: Uday Shankar Date: Thu Sep 18 13:34:07 2025 -0600 selftests: ublk: kublk: simplify feat_map definition Simplify the definition of feat_map by introducing a helper macro FEAT_NAME to avoid having to type the feature name twice. As a side effect, this changes the names in the feature list to be the full macro name instead of the abbreviated names that were used before, but this is a good change for clarity. Using the full feature macro names ruins the alignment of the output, so change the output format to put each feature's hex value before its name, as this is easier to align nicely. The output now looks as follows: root# ./kublk features ublk_drv features: 0x7fff 0x1 : UBLK_F_SUPPORT_ZERO_COPY 0x2 : UBLK_F_URING_CMD_COMP_IN_TASK 0x4 : UBLK_F_NEED_GET_DATA 0x8 : UBLK_F_USER_RECOVERY 0x10 : UBLK_F_USER_RECOVERY_REISSUE 0x20 : UBLK_F_UNPRIVILEGED_DEV 0x40 : UBLK_F_CMD_IOCTL_ENCODE 0x80 : UBLK_F_USER_COPY 0x100 : UBLK_F_ZONED 0x200 : UBLK_F_USER_RECOVERY_FAIL_IO 0x400 : UBLK_F_UPDATE_SIZE 0x800 : UBLK_F_AUTO_BUF_REG 0x1000 : UBLK_F_QUIESCE 0x2000 : UBLK_F_PER_IO_DAEMON 0x4000 : unknown Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 51840f7ba393dce7624a759cc4cee8c2bedf9068 Author: Chen Ridong Date: Fri Sep 19 09:49:03 2025 +0000 cpuset: fix missing error return in update_cpumask The commit c6366739804f ("cpuset: refactor cpus_allowed_validate_change") inadvertently removed the error return when cpus_allowed_validate_change() fails. This patch restores the proper error handling by returning retval when the validation check fails. Fixes: c6366739804f ("cpuset: refactor cpus_allowed_validate_change") Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 59d5de3655698679ad8fd2cc82228de4679c4263 Author: Chen Ridong Date: Fri Sep 19 01:12:27 2025 +0000 cpuset: Use new excpus for nocpu error check when enabling root partition A previous patch fixed a bug where new_prs should be assigned before checking housekeeping conflicts. This patch addresses another potential issue: the nocpu error check currently uses the xcpus which is not updated. Although no issue has been observed so far, the check should be performed using the new effective exclusive cpus. The comment has been removed because the function returns an error if nocpu checking fails, which is unrelated to the parent. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 216217ebee16afc4d79c3e86a736d87175c18e68 Author: Chen Ridong Date: Fri Sep 19 01:12:26 2025 +0000 cpuset: fix failure to enable isolated partition when containing isolcpus The 'isolcpus' parameter specified at boot time can be assigned to an isolated partition. While it is valid put the 'isolcpus' in an isolated partition, attempting to change a member cpuset to an isolated partition will fail if the cpuset contains any 'isolcpus'. For example, the system boots with 'isolcpus=9', and the following configuration works correctly: # cd /sys/fs/cgroup/ # mkdir test # echo 1 > test/cpuset.cpus # echo isolated > test/cpuset.cpus.partition # cat test/cpuset.cpus.partition isolated # echo 9 > test/cpuset.cpus # cat test/cpuset.cpus.partition isolated # cat test/cpuset.cpus 9 However, the following steps to convert a member cpuset to an isolated partition will fail: # cd /sys/fs/cgroup/ # mkdir test # echo 9 > test/cpuset.cpus # echo isolated > test/cpuset.cpus.partition # cat test/cpuset.cpus.partition isolated invalid (partition config conflicts with housekeeping setup) The issue occurs because the new partition state (new_prs) is used for validation against housekeeping constraints before it has been properly updated. To resolve this, move the assignment of new_prs before the housekeeping validation check when enabling a root partition. Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup") Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 1f1cb5d60c76e4ebbdfc5aa673233b305589876d Author: Bagas Sanjaya Date: Fri Sep 19 14:43:48 2025 +0700 Documentation: cgroup-v2: Sync manual toctree Manually-arranged toctree comment in cgroup v2 documentation is a rather out-of-sync with actual contents: a few sections are missing and/or named differently. Sync the toctree. Signed-off-by: Bagas Sanjaya Acked-by: Michal Koutný Signed-off-by: Tejun Heo commit 0b0ca959d20689fece038954bbf1d7b14c0b11c3 Author: Djordje Todorovic Date: Thu Jul 24 17:23:31 2025 +0200 riscv: errata: Fix the PAUSE Opcode for MIPS P8700 Add ERRATA_MIPS and ERRATA_MIPS_P8700_PAUSE_OPCODE configs. Handle errata for the MIPS PAUSE instruction. Signed-off-by: Djordje Todorovic Signed-off-by: Aleksandar Rikalo Signed-off-by: Raj Vishwanathan4 Signed-off-by: Aleksa Paunovic Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-7-a6cbbe1c3412@htecgroup.com [pjw@kernel.org: updated to apply and compile; fixed a checkpatch issue] Signed-off-by: Paul Walmsley commit c9a9fc23228f447beefe473224207944521b14a1 Author: Aleksa Paunovic Date: Thu Jul 24 17:23:29 2025 +0200 riscv: hwprobe: Document MIPS xmipsexectl vendor extension Document support for MIPS vendor extensions using the key "RISCV_HWPROBE_KEY_VENDOR_EXT_MIPS_0" and xmipsexectl vendor extension using the key "RISCV_HWPROBE_VENDOR_EXT_XMIPSEXECTL". Signed-off-by: Aleksa Paunovic Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-5-a6cbbe1c3412@htecgroup.com Signed-off-by: Paul Walmsley commit bb4b0f8a1bcbf8f4e3a0841aaefb3fd580d12fc9 Author: Aleksa Paunovic Date: Thu Jul 24 17:23:28 2025 +0200 riscv: hwprobe: Add MIPS vendor extension probing Add a new hwprobe key "RISCV_HWPROBE_KEY_VENDOR_EXT_MIPS_0" which allows userspace to probe for the new xmipsexectl vendor extension. Signed-off-by: Aleksa Paunovic Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-4-a6cbbe1c3412@htecgroup.com [pjw@kernel.org: fixed some checkpatch issues] Signed-off-by: Paul Walmsley commit 1d4ce63e338fc62f47f22d61cf4b1624caa8cf1c Author: Aleksa Paunovic Date: Thu Jul 24 17:23:27 2025 +0200 riscv: Add xmipsexectl instructions Add xmipsexectl instruction opcodes. This includes the MIPS.PAUSE, MIPS.EHB, and MIPS.IHB instructions. Signed-off-by: Aleksa Paunovic Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-3-a6cbbe1c3412@htecgroup.com Signed-off-by: Paul Walmsley commit 815276dbfbb79abd531f09eca7d3208a847d6a0b Merge: 8cd189e414bb70 fdcecdff905cf7 Author: Alexei Starovoitov Date: Fri Sep 19 09:27:24 2025 -0700 Merge branch 'bpf-replace-path-sensitive-with-path-insensitive-live-stack-analysis' Eduard Zingerman says: ==================== bpf: replace path-sensitive with path-insensitive live stack analysis Consider the following program, assuming checkpoint is created for a state at instruction (3): 1: call bpf_get_prandom_u32() 2: *(u64 *)(r10 - 8) = 42 -- checkpoint #1 -- 3: if r0 != 0 goto +1 4: exit; 5: r0 = *(u64 *)(r10 - 8) 6: exit The verifier processes this program by exploring two paths: - 1 -> 2 -> 3 -> 4 - 1 -> 2 -> 3 -> 5 -> 6 When instruction (5) is processed, the current liveness tracking mechanism moves up the register parent links and records a "read" mark for stack slot -8 at checkpoint #1, stopping because of the "write" mark recorded at instruction (2). This patch set replaces the existing liveness tracking mechanism with a path-insensitive data flow analysis. The program above is processed as follows: - a data structure representing live stack slots for instructions 1-6 in frame #0 is allocated; - when instruction (2) is processed, record that slot -8 is written at instruction (2) in frame #0; - when instruction (5) is processed, record that slot -8 is read at instruction (5) in frame #0; - when instruction (6) is processed, propagate read mark for slot -8 up the control flow graph to instructions 3 and 2. The key difference is that the new mechanism operates on a control flow graph and associates read and write marks with pairs of (call chain, instruction index). In contrast, the old mechanism operates on verifier states and register parent links, associating read and write marks with verifier states. Motivation ========== As it stands, this patch set makes liveness tracking slightly less precise, as it no longer distinguishes individual program paths taken by the verifier during symbolic execution. See the "Impact on verification performance" section for details. However, this change is intended as a stepping stone toward the following goals: - Short term, integrate precision tracking into liveness analysis and remove the following code: - verifier backedge states accumulation in is_state_visited(); - most of the logic for precision tracking; - jump history tracking. - Long term, help with more efficient loop verification handling. Why integrating precision tracking? ----------------------------------- In a sense, precision tracking is very similar to liveness tracking. The data flow equations for liveness tracking look as follows: live_after = U [state[s].live_before for s in insn_successors(i)] state[i].live_before = (live_after / state[i].must_write) U state[i].may_read While data flow equations for precision tracking look as follows: precise_after = U [state[s].precise_before for s in insn_successors(i)] // if some of the instruction outputs are precise, // assume its inputs to be precise induced_precise = ⎧ state[i].may_read if (state[i].may_write ∩ precise_after) ≠ ∅ ⎨ ⎩ ∅ otherwise state[i].precise_before = (precise_after / state[i].must_write) ∩ induced_precise Where: - `may_read` set represents a union of all possibly read slots (any slot in `may_read` set might be by the instruction); - `must_write` set represents an intersection of all possibly written slots (any slot in `must_write` set is guaranteed to be written by the instruction). - `may_write` set represents a union of all possibly written slots (any slot in `may_write` set might be written by the instruction). This means that precision tracking can be implemented as a logical extension of liveness tracking: - track registers as well as stack slots; - add bit masks to represent `precise_before` and `may_write`; - add above equations for `precise_before` computation; - (linked registers require some additional consideration). Such extension would allow removal of: - precision propagation logic in verifier.c: - backtrack_insn() - mark_chain_precision() - propagate_{precision,backedges}() - push_jmp_history() and related data structures, which are only used by precision tracking; - add_scc_backedge() and related backedge state accumulation in is_state_visited(), superseded by per-callchain function state accumulated by liveness analysis. The hope here is that unifying liveness and precision tracking will reduce overall amount of code and make it easier to reason about. How this helps with loops? -------------------------- As it stands, this patch set shares the same deficiency as the current liveness tracking mechanism. Liveness marks on stack slots cannot be used to prune states when processing iterator-based loops: - such states still have branches to be explored; - meaning that not all stack slot reads have been discovered. For example: 1: while(iter_next()) { 2: if (...) 3: r0 = *(u64 *)(r10 - 8) 4: if (...) 5: r0 = *(u64 *)(r10 - 16) 6: ... 7: } For any checkpoint state created at instruction (1), it is only possible to rely on read marks for slots fp[-8] and fp[-16] once all child states of (1) have been explored. Thus, when the verifier transitions from (7) to (1), it cannot rely on read marks. However, sacrificing path-sensitivity makes it possible to run analysis defined in this patch set before main verification pass, if estimates for value ranges are available. E.g. for the following program: 1: while(iter_next()) { 2: r0 = r10 3: r0 += r2 4: r0 = *(u64 *)(r2 + 0) 5: ... 6: } If an estimate for `r2` range is available before the main verification pass, it can be used to populate read marks at instruction (4) and run the liveness analysis. Thus making conservative liveness information available during loops verification. Such estimates can be provided by some form of value range analysis. Value range analysis is also necessary to address loop verification from another angle: computing boundaries for loop induction variables and iteration counts. The hope here is that the new liveness tracking mechanism will support the broader goal of making loop verification more efficient. Validation ========== The change was tested on three program sets: - bpf selftests - sched_ext - Meta's internal set of programs Commit [#8] enables a special mode where both the current and new liveness analyses are enabled simultaneously. This mode signals an error if the new algorithm considers a stack slot dead while the current algorithm assumes it is alive. This mode was very useful for debugging. At the time of posting, no such errors have been reported for the above program sets. [#8] "bpf: signal error if old liveness is more conservative than new" Impact on memory consumption ============================ Debug patch [1] extends the kernel and veristat to count the amount of memory allocated for storing analysis data. This patch is not included in the submission. The maximal observed impact for the above program sets is 2.6Mb. Data below is shown in bytes. For bpf selftests top 5 consumers look as follows: File Program liveness mem ----------------------- ---------------- ------------ pyperf180.bpf.o on_event 2629740 pyperf600.bpf.o on_event 2287662 pyperf100.bpf.o on_event 1427022 test_verif_scale3.bpf.o balancer_ingress 1121283 pyperf_subprogs.bpf.o on_event 756900 For sched_ext top 5 consumers loog as follows: File Program liveness mem --------- ------------------------------- ------------ bpf.bpf.o lavd_enqueue 164686 bpf.bpf.o lavd_select_cpu 157393 bpf.bpf.o layered_enqueue 154817 bpf.bpf.o lavd_init 127865 bpf.bpf.o layered_dispatch 110129 For Meta's internal set of programs top consumer is 1Mb. [1] https://github.com/kernel-patches/bpf/commit/085588e787b7998a296eb320666897d80bca7c08 Impact on verification performance ================================== Veristat results below are reported using `-f insns_pct>1 -f !insns<500` filter and -t option (BPF_F_TEST_STATE_FREQ flag). master vs patch-set, selftests (out of ~4K programs) ---------------------------------------------------- File Program Insns (A) Insns (B) Insns (DIFF) -------------------------------- -------------------------------------- --------- --------- --------------- cpumask_success.bpf.o test_global_mask_nested_deep_array_rcu 1622 1655 +33 (+2.03%) strobemeta_bpf_loop.bpf.o on_event 2163 2684 +521 (+24.09%) test_cls_redirect.bpf.o cls_redirect 36001 42515 +6514 (+18.09%) test_cls_redirect_dynptr.bpf.o cls_redirect 2299 2339 +40 (+1.74%) test_cls_redirect_subprogs.bpf.o cls_redirect 69545 78497 +8952 (+12.87%) test_l4lb_noinline.bpf.o balancer_ingress 2993 3084 +91 (+3.04%) test_xdp_noinline.bpf.o balancer_ingress_v4 3539 3616 +77 (+2.18%) test_xdp_noinline.bpf.o balancer_ingress_v6 3608 3685 +77 (+2.13%) master vs patch-set, sched_ext (out of 148 programs) ---------------------------------------------------- File Program Insns (A) Insns (B) Insns (DIFF) --------- ---------------- --------- --------- --------------- bpf.bpf.o chaos_dispatch 2257 2287 +30 (+1.33%) bpf.bpf.o lavd_enqueue 20735 22101 +1366 (+6.59%) bpf.bpf.o lavd_select_cpu 22100 24409 +2309 (+10.45%) bpf.bpf.o layered_dispatch 25051 25606 +555 (+2.22%) bpf.bpf.o p2dq_dispatch 961 990 +29 (+3.02%) bpf.bpf.o rusty_quiescent 526 534 +8 (+1.52%) bpf.bpf.o rusty_runnable 541 547 +6 (+1.11%) Perf report =========== In relative terms, the analysis does not consume much CPU time. For example, here is a perf report collected for pyperf180 selftest: # Children Self Command Shared Object Symbol # ........ ........ ........ .................... ........................................ ... 1.22% 1.22% veristat [kernel.kallsyms] [k] bpf_update_live_stack ... Changelog ========= v1: https://lore.kernel.org/bpf/20250911010437.2779173-1-eddyz87@gmail.com/T/ v1 -> v2: - compute_postorder() fixed to handle jumps with offset -1 (syzbot). - is_state_visited() in patch #9 fixed access to uninitialized `err` (kernel test robot, Dan Carpenter). - Selftests added. - Fixed bug with write marks propagation from callee to caller, see verifier_live_stack.c:caller_stack_write() test case. - Added a patch for __not_msg() annotation for test_loader based tests. v2: https://lore.kernel.org/bpf/20250918-callchain-sensitive-liveness-v2-0-214ed2653eee@gmail.com/ v2 -> v3: - Added __diag_ignore_all("-Woverride-init", ...) in liveness.c for bpf_insn_successors() (suggested by Alexei). Signed-off-by: Eduard Zingerman ==================== Link: https://patch.msgid.link/20250918-callchain-sensitive-liveness-v3-0-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit fdcecdff905cf712279d3ba72ec8ac7bc02be7ff Author: Eduard Zingerman Date: Thu Sep 18 19:18:45 2025 -0700 selftests/bpf: test cases for callchain sensitive live stack tracking - simple propagation of read/write marks; - joining read/write marks from conditional branches; - avoid must_write marks in when same instruction accesses different stack offsets on different execution paths; - avoid must_write marks in case same instruction accesses stack and non-stack pointers on different execution paths; - read/write marks propagation to outer stack frame; - independent read marks for different callchains ending with the same function; - bpf_calls_callback() dependent logic in liveness.c:bpf_stack_slot_alive(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-12-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 34c513be3dada9fb6314ea8c9ec35d71d09a2e58 Author: Eduard Zingerman Date: Thu Sep 18 19:18:44 2025 -0700 selftests/bpf: __not_msg() tag for test_loader framework This patch adds tags __not_msg() and __not_msg_unpriv(). Test fails if is found in verifier log. If __msg_not() is situated between __msg() tags framework matches __msg() tags first, and then checks that is not present in a portion of a log between bracketing __msg() tags. __msg_not() tags bracketed by a same __msg() group are effectively unordered. The idea is borrowed from LLVM's CheckFile with its CHECK-NOT syntax. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-11-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 79f047c7d968b21ff4b72bd70c4533140553c56c Author: Eduard Zingerman Date: Thu Sep 18 19:18:43 2025 -0700 bpf: table based bpf_insn_successors() Converting bpf_insn_successors() to use lookup table makes it ~1.5 times faster. Also remove unnecessary conditionals: - `idx + 1 < prog->len` is unnecessary because after check_cfg() all jump targets are guaranteed to be within a program; - `i == 0 || succ[0] != dst` is unnecessary because any client of bpf_insn_successors() can handle duplicate edges: - compute_live_registers() - compute_scc() Moving bpf_insn_successors() to liveness.c allows its inlining in liveness.c:__update_stack_liveness(). Such inlining speeds up __update_stack_liveness() by ~40%. bpf_insn_successors() is used in both verifier.c and liveness.c. perf shows such move does not negatively impact users in verifier.c, as these are executed only once before main varification pass. Unlike __update_stack_liveness() which can be triggered multiple times. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-10-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 107e169799057bc6a379ddb625cbe1e51cfc7d72 Author: Eduard Zingerman Date: Thu Sep 18 19:18:42 2025 -0700 bpf: disable and remove registers chain based liveness Remove register chain based liveness tracking: - struct bpf_reg_state->{parent,live} fields are no longer needed; - REG_LIVE_WRITTEN marks are superseded by bpf_mark_stack_write() calls; - mark_reg_read() calls are superseded by bpf_mark_stack_read(); - log.c:print_liveness() is superseded by logging in liveness.c; - propagate_liveness() is superseded by bpf_update_live_stack(); - no need to establish register chains in is_state_visited() anymore; - fix a bunch of tests expecting "_w" suffixes in verifier log messages. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-9-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit ccf25a67c7e29cfa6815d193054789b45ef825ad Author: Eduard Zingerman Date: Thu Sep 18 19:18:41 2025 -0700 bpf: signal error if old liveness is more conservative than new Unlike the new algorithm, register chain based liveness tracking is fully path sensitive, and thus should be strictly more accurate. Validate the new algorithm by signaling an error whenever it considers a stack slot dead while the old algorithm considers it alive. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-8-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit e41c237953b36cdd025b82996a74bfe39c509d20 Author: Eduard Zingerman Date: Thu Sep 18 19:18:40 2025 -0700 bpf: enable callchain sensitive stack liveness tracking Allocate analysis instance: - Add bpf_stack_liveness_{init,free}() calls to bpf_check(). Notify the instance about any stack reads and writes: - Add bpf_mark_stack_write() call at every location where REG_LIVE_WRITTEN is recorded for a stack slot. - Add bpf_mark_stack_read() call at every location mark_reg_read() is called. - Both bpf_mark_stack_{read,write}() rely on env->liveness->cur_instance callchain being in sync with env->cur_state. It is possible to update env->liveness->cur_instance every time a mark read/write is called, but that costs a hash table lookup and is noticeable in the performance profile. Hence, manually reset env->liveness->cur_instance whenever the verifier changes env->cur_state call stack: - call bpf_reset_live_stack_callchain() when the verifier enters a subprogram; - call bpf_update_live_stack() when the verifier exits a subprogram (it implies the reset). Make sure bpf_update_live_stack() is called for a callchain before issuing liveness queries. And make sure that bpf_update_live_stack() is called for any callee callchain first: - Add bpf_update_live_stack() call at every location that processes BPF_EXIT: - exit from a subprogram; - before pop_stack() call. This makes sure that bpf_update_live_stack() is called for callee callchains before caller callchains. Make sure must_write marks are set to zero for instructions that do not always access the stack: - Wrap do_check_insn() with bpf_reset_stack_write_marks() / bpf_commit_stack_write_marks() calls. Any calls to bpf_mark_stack_write() are accumulated between this pair of calls. If no bpf_mark_stack_write() calls were made it means that the instruction does not access stack (at-least on the current verification path) and it is important to record this fact. Finally, use bpf_live_stack_query_init() / bpf_stack_slot_alive() to query stack liveness info. The manual tracking of the correct order for callee/caller bpf_update_live_stack() calls is a bit convoluted and may warrant some automation in future revisions. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-7-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit b3698c356ad92bcdb9920655bc9df02a2a8946f9 Author: Eduard Zingerman Date: Thu Sep 18 19:18:39 2025 -0700 bpf: callchain sensitive stack liveness tracking using CFG This commit adds a flow-sensitive, context-sensitive, path-insensitive data flow analysis for live stack slots: - flow-sensitive: uses program control flow graph to compute data flow values; - context-sensitive: collects data flow values for each possible call chain in a program; - path-insensitive: does not distinguish between separate control flow graph paths reaching the same instruction. Compared to the current path-sensitive analysis, this approach trades some precision for not having to enumerate every path in the program. This gives a theoretical capability to run the analysis before main verification pass. See cover letter for motivation. The basic idea is as follows: - Data flow values indicate stack slots that might be read and stack slots that are definitely written. - Data flow values are collected for each (call chain, instruction number) combination in the program. - Within a subprogram, data flow values are propagated using control flow graph. - Data flow values are transferred from entry instructions of callee subprograms to call sites in caller subprograms. In other words, a tree of all possible call chains is constructed. Each node of this tree represents a subprogram. Read and write marks are collected for each instruction of each node. Live stack slots are first computed for lower level nodes. Then, information about outer stack slots that might be read or are definitely written by a subprogram is propagated one level up, to the corresponding call instructions of the upper nodes. Procedure repeats until root node is processed. In the absence of value range analysis, stack read/write marks are collected during main verification pass, and data flow computation is triggered each time verifier.c:states_equal() needs to query the information. Implementation details are documented in kernel/bpf/liveness.c. Quantitative data about verification performance changes and memory consumption is in the cover letter. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-6-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit efcda22aa541bbda827e54302baf9ae4fd44cdf2 Author: Eduard Zingerman Date: Thu Sep 18 19:18:38 2025 -0700 bpf: compute instructions postorder per subprogram The next patch would require doing postorder traversal of individual subprograms. Facilitate this by moving env->cfg.insn_postorder computation from check_cfg() to a separate pass, as check_cfg() descends into called subprograms (and it needs to, because of merge_callee_effects() logic). env->cfg.insn_postorder is used only by compute_live_registers(), this function does not track cross subprogram dependencies, thus the change does not affect it's operation. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-5-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 3b20d3c120bae1e18ee11aa04531b161743db682 Author: Eduard Zingerman Date: Thu Sep 18 19:18:37 2025 -0700 bpf: declare a few utility functions as internal api Namely, rename the following functions and add prototypes to bpf_verifier.h: - find_containing_subprog -> bpf_find_containing_subprog - insn_successors -> bpf_insn_successors - calls_callback -> bpf_calls_callback - fmt_stack_mask -> bpf_fmt_stack_mask Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-4-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 12a23f93a50dad7f820ca4326c7e289e7e13fb9f Author: Eduard Zingerman Date: Thu Sep 18 19:18:36 2025 -0700 bpf: remove redundant REG_LIVE_READ check in stacksafe() stacksafe() is called in exact == NOT_EXACT mode only for states that had been porcessed by clean_verifier_states(). The latter replaces dead stack spills with a series of STACK_INVALID masks. Such masks are already handled by stacksafe(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-3-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 6cd21eb9adc924237a6f398a7f6c9f3da251df71 Author: Eduard Zingerman Date: Thu Sep 18 19:18:35 2025 -0700 bpf: use compute_live_registers() info in clean_func_state Prepare for bpf_reg_state->live field removal by leveraging insn_aux_data->live_regs_before instead of bpf_reg_state->live in compute_live_registers(). This is similar to logic in func_states_equal(). No changes in verification performance for selftests or sched_ext. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-2-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit daf4c2929fb792d24af0cd7bb6ca1f2949190fa4 Author: Eduard Zingerman Date: Thu Sep 18 19:18:34 2025 -0700 bpf: bpf_verifier_state->cleaned flag instead of REG_LIVE_DONE Prepare for bpf_reg_state->live field removal by introducing a separate flag to track if clean_verifier_state() had been applied to the state. No functional changes. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-1-c3cd27bacc60@gmail.com Signed-off-by: Alexei Starovoitov commit 3c54e6027f14c4f54be5508af748f6cc2fd72f89 Author: Christoph Hellwig Date: Fri Sep 19 06:14:11 2025 -0700 xfs: constify xfs_errortag_random_default This table is never modified, so mark it const. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c17dda8013495d8132c976cbf349be9949d0fbd1 Author: Leo Yan Date: Fri Aug 8 14:24:40 2025 +0100 perf session: Fix handling when buffer exceeds 2 GiB If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative. As a result, the perf record command reports an error: 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232] Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly. Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more") Reported-by: Tamas Zsoldos Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit a8f0992998af9ea1135ee6415c68c1d84cb5ad22 Author: Ankur Arora Date: Wed Sep 17 08:24:11 2025 -0700 perf bench mem: Add mmap() workloads Add two mmap() workloads: one that eagerly populates a region and another that demand faults it in. The intent is to probe the memory subsytem performance incurred by mmap(). $ perf bench mem mmap -s 4gb -p 4kb -l 10 -f populate # Running 'mem/mmap' benchmark: # function 'populate' (Eagerly populated map()) # Copying 4gb bytes ... 1.811691 GB/sec $ perf bench mem mmap -s 4gb -p 2mb -l 10 -f populate # Running 'mem/mmap' benchmark: # function 'populate' (Eagerly populated mmap()) # Copying 4gb bytes ... 12.272017 GB/sec $ perf bench mem mmap -s 4gb -p 1gb -l 10 -f populate # Running 'mem/mmap' benchmark: # function 'populate' (Eagerly populated mmap()) # Copying 4gb bytes ... 17.085927 GB/sec Signed-off-by: Ankur Arora Tested-by: Arnaldo Carvalho de Melo Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit c3047f9a1ab457b60caa3b2baa2c605b935ca4f1 Author: Ankur Arora Date: Wed Sep 17 08:24:10 2025 -0700 perf bench mem: Refactor mem_options Split mem benchmark options into common and memset/memcpy specific. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit fd1d882c4c34e1925bf134e31dddf4891578a72f Author: Ankur Arora Date: Wed Sep 17 08:24:09 2025 -0700 perf bench mem: Allow chunking on a memory region There can be a significant gap in memset/memcpy performance depending on the size of the region being operated on. With chunk-size=4kb: $ echo madvise > /sys/kernel/mm/transparent_hugepage/enabled $ perf bench mem memset -p 4kb -k 4kb -s 4gb -l 10 -f x86-64-stosq # Running 'mem/memset' benchmark: # function 'x86-64-stosq' (movsq-based memset() in arch/x86/lib/memset_64.S) # Copying 4gb bytes ... 13.011655 GB/sec With chunk-size=1gb: $ echo madvise > /sys/kernel/mm/transparent_hugepage/enabled $ perf bench mem memset -p 4kb -k 1gb -s 4gb -l 10 -f x86-64-stosq # Running 'mem/memset' benchmark: # function 'x86-64-stosq' (movsq-based memset() in arch/x86/lib/memset_64.S) # Copying 4gb bytes ... 21.936355 GB/sec So, allow the user to specify the chunk-size. The default value is identical to the total size of the region, which preserves current behaviour. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Tested-by: Arnaldo Carvalho de Melo Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit 7b6837e63a091d15ea35974aae5ccf2605ad7047 Author: Ankur Arora Date: Wed Sep 17 08:24:08 2025 -0700 perf bench mem: Allow mapping of hugepages Page sizes that can be selected: 4KB, 2MB, 1GB. Both the reservation and node from which hugepages are allocated from are expected to be addressed by the user. An example of page-size selection: $ perf bench mem memset -s 4gb -p 2mb # Running 'mem/memset' benchmark: # function 'default' (Default memset() provided by glibc) # Copying 4gb bytes ... 14.919194 GB/sec # function 'x86-64-unrolled' (unrolled memset() in arch/x86/lib/memset_64.S) # Copying 4gb bytes ... 11.514503 GB/sec # function 'x86-64-stosq' (movsq-based memset() in arch/x86/lib/memset_64.S) # Copying 4gb bytes ... 12.600568 GB/sec Signed-off-by: Ankur Arora Tested-by: Arnaldo Carvalho de Melo Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit fe0f3216dd8736afc1a6ddb0b79fd24f37418357 Author: Ankur Arora Date: Wed Sep 17 08:24:07 2025 -0700 perf bench mem: Switch from zalloc() to mmap() Using mmap() ensures that the buffer is always aligned at a fixed boundary. Switch to that to remove one source of variability. Since we always want to read/write from the allocated buffers map with pagetables pre-populated. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit bdc22a83dc2a2f1ecfc4cdd8e605d6c075b3dd82 Author: Ankur Arora Date: Wed Sep 17 08:24:06 2025 -0700 perf bench mem: Pull out init/fini logic No functional change. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit dbf5dad1540e28bddde701268beb77beadb58321 Author: Ankur Arora Date: Wed Sep 17 08:24:05 2025 -0700 perf bench mem: Move mem op parameters into a structure Move benchmark function parameters in struct bench_params. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250917152418.4077386-4-ankur.a.arora@oracle.com Signed-off-by: Arnaldo Carvalho de Melo commit 07e257245d5ee0c5393ae2fe8c7fc18071c5a637 Author: Ankur Arora Date: Wed Sep 17 08:24:04 2025 -0700 perf bench mem: Defer type munging of size to float Do type conversion to double at the point of use. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250917152418.4077386-3-ankur.a.arora@oracle.com Signed-off-by: Arnaldo Carvalho de Melo commit 79a0194f2f28abca7a17c37d5384762355d17c26 Author: Ankur Arora Date: Wed Sep 17 08:24:03 2025 -0700 perf bench mem: Remove repetition around time measurement We have two copies of each mem benchmark: one using cycles to measure time, the second for gettimeofday(). Unify. Reviewed-by: Namhyung Kim Signed-off-by: Ankur Arora Cc: Andrew Morton Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 Author: Brahmajit Das Date: Tue Sep 2 12:54:22 2025 +0530 net: intel: fm10k: Fix parameter idx set but not used Variable idx is set in the loop, but is never used resulting in dead code. Building with GCC 16, which enables -Werror=unused-but-set-parameter= by default results in build error. This patch removes the idx parameter, since all the callers of the fm10k_unbind_hw_stats_q as 0 as idx anyways. Suggested-by: Vadim Fedorenko Signed-off-by: Brahmajit Das Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit a460f96709bb0dab9a527e2e6126ce0b2fcd02fe Author: Aleksandr Loktionov Date: Wed Sep 10 06:01:08 2025 +0000 ixgbevf: fix proper type for error code in ixgbevf_resume() The variable 'err' in ixgbevf_resume() is used to store the return value of different functions, which return an int. Currently, 'err' is declared as u32, which is semantically incorrect and misleading. In the Linux kernel, u32 is typically reserved for fixed-width data used in hardware interfaces or protocol structures. Using it for a generic error code may confuse reviewers or developers into thinking the value is hardware-related or size-constrained. Replace u32 with int to reflect the actual usage and improve code clarity and semantic correctness. No functional change. Signed-off-by: Aleksandr Loktionov Reviewed-by: Jedrzej Jagielski Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit c4f7a6672f9019c9509c656c76dcbe804fb66e0c Author: Aleksandr Loktionov Date: Fri Sep 12 08:02:08 2025 +0000 iavf: fix proper type for error code in iavf_resume() The variable 'err' in iavf_resume() is used to store the return value of different functions, which return an int. Currently, 'err' is declared as u32, which is semantically incorrect and misleading. In the Linux kernel, u32 is typically reserved for fixed-width data used in hardware interfaces or protocol structures. Using it for a generic error code may confuse reviewers or developers into thinking the value is hardware-related or size-constrained. Replace u32 with int to reflect the actual usage and improve code clarity and semantic correctness. No functional change. Signed-off-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 7a5a03869801e2f1cabdc55b2e697fea20da5c68 Author: Milena Olech Date: Fri Aug 29 13:57:33 2025 -0400 idpf: add HW timestamping statistics Add HW timestamping statistics support - through implementing get_ts_stats. Timestamp statistics include correctly timestamped packets, discarded, skipped and flushed during PTP release. Most of the stats are collected per vport, only requests skipped due to lack of free latch index are collected per Tx queue. Statistics can be obtained using kernel ethtool since version 6.10 with: ethtool -I -T The output will include: Statistics: tx_pkts: 15 tx_lost: 0 tx_err: 0 Signed-off-by: Milena Olech Co-developed-by: Anton Nadezhdin Signed-off-by: Anton Nadezhdin Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Tested-by: Samuel Salin Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 34138ea02a608dc39f04e364f3249e12f6002bad Author: Dave Ertman Date: Wed Aug 27 10:34:23 2025 +0200 ice: Remove deprecated ice_lag_move_new_vf_nodes() call Moving the code to handle the LAG part of a VF reset to helper functions deprecated the function ice_lag_move_new_vf_nodes(). The cleanup missed a call to this function in the error path of ice_vc_cfg_qs_msg(). In the case that would end in the error path, a NULL pointer would be encountered due to the empty list of netdevs for members of the aggregate. Remove the unnecessary call to ice_lag_move_new_vf_nodes(), and since this is the only call to this function, remove the function as well. Fixes: 351d8d8ab6af ("ice: breakout common LAG code into helpers") Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Dave Ertman Tested-by: Priya Singh Signed-off-by: Tony Nguyen commit b0f4ade163e551d0c470ead7ac57eaf373eec71a Author: Fushuai Wang Date: Wed Sep 17 17:54:22 2025 +0800 perf trace: Fix IS_ERR() vs NULL check bug The alloc_syscall_stats() function always returns an error pointer (ERR_PTR) on failure. So replace NULL check with IS_ERR() check after calling alloc_syscall_stats() function. Fixes: fc00897c8a3f7f57 ("perf trace: Add --summary-mode option") Reviewed-by: Ian Rogers Signed-off-by: Fushuai Wang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 Author: Paul Greenwalt Date: Mon Aug 18 09:22:57 2025 -0400 ice: add E830 Earliest TxTime First Offload support E830 supports Earliest TxTime First (ETF) hardware offload, which is configured via the ETF Qdisc on a per-queue basis (see tc-etf(8)). ETF introduces a new Tx flow mechanism that utilizes a timestamp ring (tstamp_ring) alongside the standard Tx ring. This timestamp ring is used to indicate when hardware will transmit a packet. Tx Time is supported on the first 2048 Tx queues of the device, and the NVM image limits the maximum number of Tx queues to 2048 for the device. The allocation and initialization of the timestamp ring occur when the feature is enabled on a specific Tx queue via tc-etf. The requested Tx Time queue index cannot be greater than the number of Tx queues (vsi->num_txq). To support ETF, the following flags and bitmap are introduced: - ICE_F_TXTIME: Device feature flag set for E830 NICs, indicating ETF support. - txtime_txqs: PF-level bitmap set when ETF is enabled and cleared when disabled for a specific Tx queue. It is used by ice_is_txtime_ena() to check if ETF is allocated and configured on any Tx queue, which is checked during Tx ring allocation. - ICE_TX_FLAGS_TXTIME: Per Tx ring flag set when ETF is allocated and configured for a specific Tx queue. It determines ETF status during packet transmission and is checked by ice_is_txtime_ena() to verify if ETF is enabled on any Tx queue. Due to a hardware issue that can result in a malicious driver detection event, additional timestamp descriptors are required when wrapping around the timestamp ring. Up to 64 additional timestamp descriptors are reserved, reducing the available Tx descriptors. To accommodate this, ICE_MAX_NUM_DESC_BY_MAC is introduced, defining: - E830: Maximum Tx descriptor count of 8096 (8K - 32 - 64 for timestamp fetch descriptors). - E810 and E82X: Maximum Tx descriptor count of 8160 (8K - 32). Reviewed-by: Aleksandr Loktionov Co-developed-by: Alice Michael Signed-off-by: Alice Michael Signed-off-by: Paul Greenwalt Acked-by: Maciej Fijalkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3b8606193d435796ca07e488d4fb4fca4bbf1b68 Author: Paul Greenwalt Date: Mon Aug 18 09:22:56 2025 -0400 ice: move ice_qp_[ena|dis] for reuse Move ice_qp_[ena|dis] and related helper functions to ice_base.c to allow reuse of these function currently only used by ice_xsk.c. Suggested-by: Maciej Fijalkowski Signed-off-by: Paul Greenwalt Reviewed-by: Aleksandr Loktionov Acked-by: Maciej Fijalkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0e9e7bc14e8f7a3b4193a8e3febb9e1e92051bd3 Author: Trevor Allison Date: Tue Sep 16 15:30:46 2025 -0400 perf test attr: Add missing int_mist.uop_dropping event to test-stat files Setup 'struct perf_event_attr' test was failing on EMR cpu because 'perf stat' was providing an event that was not included in the test. Type 4 Config 4269 or 10ad, int_misc.uop_dropping. Add event type=4 config=4269 to test-stat-default and test-stat-detailed-* files with optional=1 so EMR (Emerald Rapids) machines can pass the test. Fixes: d9a6bb9e359e6f81 ("perf vendor events: Update emeraldrapids events/metrics") Reviewed-by: Ian Rogers Signed-off-by: Trevor Allison Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 72c181399b01bb4836d1fabaa9f5f6438c82178e Merge: 48314d20fe467d e8442d5b7bc633 Author: Arnaldo Carvalho de Melo Date: Fri Sep 19 12:38:16 2025 -0300 Merge remote-tracking branch 'torvalds/master' into perf-tools-next To pick up the latest perf-tools batch sent by Namhyung Kim for v6.17-rc7. Signed-off-by: Arnaldo Carvalho de Melo commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c Author: Ian Rogers Date: Thu Aug 21 15:18:31 2025 -0700 perf test shell lbr: Avoid failures with perf event paranoia When not running as root and with higher perf event paranoia values the perf record LBR tests could fail rather than skipping the problematic tests. Add the sensitivity to the test and confirm it passes with paranoia values from -1 to 2. Committer testing: Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing the output shows the mentioned errors before this patch: acme@x1:~$ grep -m1 "model name" /proc/cpuinfo model name : 13th Gen Intel(R) Core(TM) i7-1365U acme@x1:~$ Before: 132: perf record LBR tests : Skip After: 132: perf record LBR tests : Ok Fixes: 32559b99e0f59070 ("perf test: Add set of perf record LBR tests") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 98dbed7aee7f8fd664927a6eea5fce15663be198 Author: Namhyung Kim Date: Fri Aug 8 15:26:50 2025 -0700 perf tools: Remove a pointless check Static analyser cppcheck says: linux-6.16/tools/perf/util/tool_pmu.c:242:15: warning: Opposite inner 'if' condition leads to a dead code block. [oppositeInnerCondition] Source code is: for (thread = 0; thread < nthreads; thread++) { if (thread >= nthreads) break; Reported-by: David Binderman Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 817af72c05c8adfc5b5c8c772e237a2ac85b25f5 Author: Thomas Richter Date: Tue Aug 5 11:03:49 2025 +0200 perf tools: Update header documentation on BPF_PROG_INFO Update the perf.data file format description on header section HEADER_BPF_PROG_INFO. The information is taken from process_bpf_prog_info() and write_bpf_prog_info() from file util/header.c. Reviewed-by: Jan Polensky Signed-off-by: Thomas Richter Acked-by: Namhyung Kim Acked-by: Sumanth Korikkar Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo commit c0e885e92534ae83ff2721332c17022a48d769c7 Author: Athira Rajeev Date: Thu Aug 14 17:19:08 2025 +0530 perf tests record: Update testcase to fix usage of affinity for machines with #CPUs > 1K The perf record testcase fails on systems with more than 1K CPUs. Testcase: perf test -vv "PERF_RECORD_* events & perf_sample fields" PERF_RECORD_* events & perf_sample fields : --- start --- test child forked, pid 272482 sched_getaffinity: Invalid argument sched__get_first_possible_cpu: Invalid argument test child finished with -1 ---- end ---- PERF_RECORD_* events & perf_sample fields: FAILED! sched__get_first_possible_cpu uses "sched_getaffinity" to get the cpumask and this call is returning EINVAL (Invalid argument). This happens because the default mask size in glibc is 1024. To overcome this 1024 CPUs mask size limitation of cpu_set_t, change the mask size using the CPU_*_S macros ie, use CPU_ALLOC to allocate cpumask, CPU_ALLOC_SIZE for size. Same fix needed for mask which is used to setaffinity so that mask size is large enough to represent number of possible CPU's in the system. Reported-by: Tejas Manhas Signed-off-by: Athira Rajeev Tested-by: Ian Rogers Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Acked-by: Namhyung Kim Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Hari Bathini Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Signed-off-by: Arnaldo Carvalho de Melo commit e7ace97fcf6d2eb458bd7e16bba8e3f24d396e9b Author: Zecheng Li Date: Mon Aug 25 19:58:17 2025 +0000 perf dwarf-aux: Fix __die_find_scope_cb() for namespaces Currently __die_find_scope_cb() goes to check siblings when the DIE doesn't include the given PC. However namespaces don't have a PC and could contain children that have that PC. When we encounter a namespace, we should check both its children and siblings. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Link: https://lore.kernel.org/r/20250825195817.226560-1-zecheng@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4a6ce9ad20257a9b8fc32994366a24170a3dfa3d Author: Zecheng Li Date: Mon Aug 25 19:54:05 2025 +0000 perf dwarf-aux: Better variable collection for insn tracking Utilizes the previous is_breg_access_indirect function to determine if the register + offset stores the variable itself or the struct it points to, save the information in die_var_type.is_reg_var_addr. Since we are storing the real types in the stack state, we need to do a type dereference when is_reg_var_addr is set to false for stack/frame registers. For other gp registers, skip the variable when the register is a pointer to the type. If we want to accept these variables, we might also utilize is_reg_var_addr in a different way, we need to mark that register as a pointer to the type. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Signed-off-by: Arnaldo Carvalho de Melo commit 8c6d842302f3d070a5f41c296f1668fd69dae468 Author: Zecheng Li Date: Mon Aug 25 19:54:04 2025 +0000 perf dwarf-aux: More accurate variable type match for breg Introduces the function is_breg_access_indirect to determine whether a memory access involving a DW_OP_breg* operation refers to the variable's value directly or requires dereferencing the variable's type as a pointer based on the DWARF expression. Previously, all breg based accesses were assumed to directly access the variable's value (is_pointer = false). The is_breg_access_indirect function handles three cases: 1. Base register + offset only: (e.g., DW_OP_breg7 RSP+88) The calculated address is the location of the variable. The access is direct, so no type dereference is needed. Returns false. 2. Base register + offset, followed by other operations ending in DW_OP_stack_value, including DW_OP_deref: (e.g., DW_OP_breg*, DW_OP_deref, DW_OP_stack_value) The DWARF expression computes the variable's value, but that value requires a dereference. The memory access is fetching that value, so no type dereference is needed. Returns false. 3. Base register + offset, followed only by DW_OP_stack_value: (e.g., DW_OP_breg13 R13+256, DW_OP_stack_value) This indicates the value at the base + offset is the variable's value. Since this value is being used as an address in the memory access, the variable's type is treated as a pointer and requires a type dereference. Returns true. The is_pointer argument passed to match_var_offset is now set by is_breg_access_indirect for breg accesses. There are more complex expressions that includes multiple operations and may require additional handling, such as DW_OP_deref without a DW_OP_stack_value, or including multiple base registers. They are less common in the Linux kernel dwarf and are skipped in check_allowed_ops. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Link: https://lore.kernel.org/r/CAJUgMyK2wTiEZB__dtgCELmaNGFWhG1j0g9rv_C=cLD6Zq4_5w@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 2e3501212293c5005873c6ca6bb4f963a7eec442 Author: Ian Rogers Date: Fri Sep 12 17:03:50 2025 -0700 perf test: AMD IBS swfilt skip kernel tests if paranoia is >1 If not root and the perf_event_paranoid is set >1 swfilt will fail to open the event failing the test. Add check to skip the test in that case. Fixes: 0e71bcdcf1f0b10b ("perf test: Add AMD IBS sw filter test") Reviewed-by: Namhyung Kim Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Collin Funk Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20250913000350.1306948-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 54a7685fd2d687dc4a7015d7bc32614d65d0d05a Author: Gautam Menghani Date: Mon Aug 4 16:36:01 2025 +0530 perf auxtrace: Avoid redundant NULL check in auxtrace_mmap_params__set_idx() Since commit eead8a011477 ("libperf threadmap: Don't segv for index 0 for the NULL 'struct perf_thread_map' pointer"), perf_thread_map__pid() can check for a NULL map and return -1 if idx is 0. Cleanup auxtrace_mmap_params__set_idx() and remove the redundant NULL check. No functional change intended. Reviewed-by: Aditya Bodkhe Reviewed-by: Adrian Hunter Reviewed-by: Amit Machhiwal Signed-off-by: Gautam Menghani Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit acd331d706f6b11e56670875fb228379feb7906c Author: Ilkka Koskinen Date: Wed Sep 10 12:52:13 2025 -0700 perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions While fixing a typo in "l1d_cache_access_prefetches" in AmpereOneX, a few other typos were found in metrics' descriptions too. While AmpereOne doesn't have the metric, it did have the typos in the descriptions. Reviewed-by: James Clark Signed-off-by: Ilkka Koskinen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Link: https://lore.kernel.org/r/20250910195214.50814-3-ilkka@os.amperecomputing.com Signed-off-by: Arnaldo Carvalho de Melo commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 Author: Ilkka Koskinen Date: Wed Sep 10 12:52:12 2025 -0700 perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches Add missing 'h' to l1d_cache_access_prefetces Also fix a couple of typos and use consistent term in brief descriptions Fixes: 16438b652b464ef7 ("perf vendor events arm64 AmpereOneX: Add core PMU events and metrics") Reviewed-by: James Clark Signed-off-by: Ilkka Koskinen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ilkka Koskinen Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit ece3c7754fc94aed15b7da567a4d22e30e3ee52b Author: Namhyung Kim Date: Wed Aug 20 17:32:20 2025 -0700 perf trace: Add --max-summary option The --max-summary option is to limit the number of output lines for syscall summary stats. The max applies to each entries like thread and cgroups. For total summary, it will just print up to the given number. For example, $ sudo perf trace -as --max-summary 3 sleep 0.1 ThreadPoolServi (1011651), 114 events, 14.8% syscall calls errors total min avg max stddev (msec) (msec) (msec) (msec) (%) --------------- -------- ------ -------- --------- --------- --------- ------ epoll_wait 38 0 95.589 0.000 2.515 11.153 28.98% futex 9 0 0.040 0.002 0.004 0.014 28.63% read 10 0 0.037 0.003 0.004 0.005 4.67% sleep (1050529), 250 events, 32.4% syscall calls errors total min avg max stddev (msec) (msec) (msec) (msec) (%) --------------- -------- ------ -------- --------- --------- --------- ------ clock_nanosleep 1 0 100.156 100.156 100.156 100.156 0.00% execve 4 3 1.020 0.005 0.255 0.989 95.93% openat 36 17 0.416 0.003 0.012 0.029 10.58% ... And this is for per-cgroup summary using BPF. $ sudo perf trace -as --max-summary 3 --summary-mode=cgroup --bpf-summary sleep 0.1 cgroup /user.slice/user-657345.slice/user@657345.service/session.slice/org.gnome.Shell@x11.service, 12 events syscall calls errors total min avg max stddev (msec) (msec) (msec) (msec) (%) --------------- -------- ------ -------- --------- --------- --------- ------ recvmsg 8 7 0.016 0.001 0.002 0.006 39.73% ppoll 1 0 0.014 0.014 0.014 0.014 0.00% write 2 0 0.010 0.002 0.005 0.008 61.02% cgroup /user.slice/user-657345.slice/session-4.scope, 73 events syscall calls errors total min avg max stddev (msec) (msec) (msec) (msec) (%) --------------- -------- ------ -------- --------- --------- --------- ------ epoll_wait 8 0 13.461 0.010 1.683 12.235 89.66% ioctl 20 0 0.204 0.001 0.010 0.113 54.01% writev 11 0 0.164 0.004 0.015 0.042 20.34% Reviewed-by: Howard Chu Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit d120cb34c9c75cf49d8ef821215d26d6e22fe8a9 Author: Leo Yan Date: Fri Sep 12 16:42:19 2025 +0100 perf arm_spe: Allow parsing both data source and events Current code skips to parse events after generating data source. The reason is the data source packets have cache and snooping related info, the afterwards event packets might contain duplicate info. This commit changes to continue parsing the events after data source analysis. If data source does not give out memory level and snooping types, then the event info is used to synthesize the related fields. As a result, both the peer snoop option ('-d peer') and hitm options ('-d tot/lcl/rmt') are supported by Arm SPE in 'perf c2c'. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit d510568970f38539eff41e6fe4ef76809f1b184c Author: Leo Yan Date: Fri Sep 12 16:42:18 2025 +0100 perf arm_spe: Set HITM flag Since FEAT_SPEv1p4, Arm SPE provides two extra events: "Cache data modified" and "Data snooped". Set the snoop mode as: - If both the "Cache data modified" event and the "Data snooped" event are set, which indicates a load operation that snooped from a outside cache and hit a modified copy, set the HITM flag to inspect false sharing. - If the snooped event bit is not set, and the snooped event has been supported by the hardware, set as NONE mode (no snoop operation). - If the snooped event bit is not set, and the event is not supported or absent the events info in the meta data, set as NA mode (not available). Don't set any mode for only "Cache data modified" event, as it hits a local modified copy. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 04abd5c06516a3c59fe14fbee0e510d3c21fc3b6 Author: Leo Yan Date: Fri Sep 12 16:42:17 2025 +0100 perf arm_spe: Refactor arm_spe__get_metadata_by_cpu() Handle "CPU=-1" (per-thread mode) in the arm_spe__get_metadata_by_cpu() function. As a result, the function is more general and will be invoked by a sequential change. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 786e7e7a504634168c0287ad8de3f4fe34f1b1f6 Author: Leo Yan Date: Fri Sep 12 16:42:16 2025 +0100 perf arm_spe: Fill memory levels for FEAT_SPEv1p4 Starting with FEAT_SPEv1p4, Arm SPE provides information on Level 2 data cache and recently fetched events. This patch fills in the memory levels for these new events. The recently fetched events are matched to line-fill buffer (LFB). In general, the latency for accessing LFB is higher than accessing L1 cache but lower than accessing L2 cache. Thus, it locates in the memory hierarchy information between L1 cache and L2 cache. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 14d4ecb15e885ebea8eeb0389c6a35e3a166f199 Author: Leo Yan Date: Fri Sep 12 16:42:15 2025 +0100 perf arm_spe: Separate setting of memory levels for loads and stores For a load hit, the lowest-level cache reflects the latency of fetching a data. Otherwise, the highest-level cache involved in refilling indicates the overhead caused by a load. Store operations remain unchanged to keep the descending order when iterating through cache levels. Split into two functions: one is for setting memory levels for loads and another for stores. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 98f993ae6f4bc50fcdb0168a1673f7943e1189f2 Author: Leo Yan Date: Fri Sep 12 16:42:14 2025 +0100 perf arm_spe: Refine memory level filling This commit introduces macros for detecting cache level and cache miss. Populates the 'mem_lvl_num' field which is a later added attribute for representing memory level. Set NA ("not available") to memory levels if memory hierarchy info is absent. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 99940fd9e145895d03b4ee456491b9583ae88795 Author: Leo Yan Date: Fri Sep 12 16:42:13 2025 +0100 perf arm_spe: Add "event_filter" entry in meta data Add a new "event_filter" entry in the meta data and dump it in raw data mode. After: # perf script -D ... 0 0 0x470 [0x1f0]: PERF_RECORD_AUXTRACE_INFO type: 4 Header version :2 Header size :4 PMU type v2 :11 CPU number :8 Magic :0x1010101010101010 CPU # :0 Num of params :4 MIDR :0x410fd0f0 PMU Type :11 Min Interval :256 Event Filter :0x3fe08fe ... Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit e44e2b2b16dffc56c86cc062d85721644dcf37f4 Author: Leo Yan Date: Fri Sep 12 16:42:12 2025 +0100 perf arm_spe: Decode event types for new features Decode new event types introduced by FEAT_SPEv1p4, FEAT_SPE_SME and FEAT_SPE_SME. The printed event names don't strictly follow the naming in the Arm ARM. For example, the "Cache data modified" event is shown as "HITM", and the "Data snooped" event is printed as "SNOOPED". Shorter names are easier to read while preserving core meanings. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 45854b6d775b3a0610cdd5e00393253539338d14 Author: Leo Yan Date: Fri Sep 12 16:42:11 2025 +0100 perf arm_spe: Directly propagate raw event Two sets of event bits are defined: one for generating samples and another are raw event bits used in the backend decoder. Reduce the redundancy by using the raw event bits directly in the frontend code. To avoid overflow issues, change the type of the event variable from enum to u64. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 7203a22492e6c1836e641c8f65786c40e456dd42 Author: James Clark Date: Fri Sep 12 16:42:10 2025 +0100 perf arm_spe: Use full type for data_src data_src has an actual type rather than just being a u64. To help readers, delay decomposing it to a u64 until it's finally assigned to the sample. Signed-off-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit cb300e3515057fb555983ce47e8acc86a5c69c3c Author: Leo Yan Date: Fri Sep 12 16:42:09 2025 +0100 perf arm_spe: Correct memory level for remote access For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available). Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 039fd0634a0629132432632d7ac9a14915406b5c Author: Leo Yan Date: Fri Sep 12 16:42:08 2025 +0100 perf arm_spe: Correct setting remote access Set the mem_remote field for a remote access to appropriately represent the event. Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field") Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 0b1fca9dce44d0d2a8f4c55df1e4149744934a91 Author: Xinpeng Sun Date: Wed Sep 17 09:53:44 2025 +0800 HID: intel-thc-hid: intel-quicki2c: support ACPI config for advanced features There is a new BIOS enhancement that adds the capability to configure the following two features of I2C subsystem introduced in commit 1ed0b48 ("Intel-thc: Introduce max input size control") and commit 3f2a921 ("Intel-thc: Introduce interrupt delay control"): - Max input size control - Interrupt delay control As BIOS is used for the configuration of these two features, change driver data usage to indicate hardware capability, and add corresponding ACPI configuration support in QuickI2C driver. Signed-off-by: Xinpeng Sun Tested-by: Rui Zhang Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 71b28769d708f20046fc6f853cf93fb88a8b6e11 Merge: 1860b13beca829 02d6eeedbc36d4 Author: Jiri Kosina Date: Fri Sep 19 17:08:20 2025 +0200 Merge remote-tracking branch 'origin' into for-6.18/intel-thc-hid Needed as a basisi for followup support for quicki2c advanced BIOS features. Signed-off-by: Jiri Kosina commit c3c616c53dbabddf32a0485bd133d8d3b9f6656a Merge: f0883b9c395ecd 2ef435a872abc3 Author: Christian Brauner Date: Fri Sep 19 16:46:02 2025 +0200 Merge branch 'vfs-6.18.inode.refcount.preliminaries' Bring in cleanup patches from the inode reference counting rework. Signed-off-by: Christian Brauner commit 5d20605c8e7930254f7bee41336e421be247181c Author: Mark Brown Date: Thu Sep 18 20:42:06 2025 +0100 KVM: arm64: Expose FEAT_LSFE to guests FEAT_LSFE (Large System Float Extension), providing atomic floating point memory operations, is optional from v9.5. This feature adds no new architectural state, expose the relevant ID register field to guests so they can discover it. Signed-off-by: Mark Brown Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 3fb4f35a75e864ecf298b55259223bc984f63276 Author: Jakub Kicinski Date: Thu Sep 18 06:46:37 2025 -0700 wan: framer: pef2256: use %pe in print format New cocci check complains: drivers/net/wan/framer/pef2256/pef2256.c:733:3-10: WARNING: Consider using %pe to print PTR_ERR() Link: https://lore.kernel.org/1758192227-701925-1-git-send-email-tariqt@nvidia.com Acked-by: Herve Codina Link: https://patch.msgid.link/20250918134637.2226614-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7cf730321132e726ff949c6f3c0d5c598788f7a2 Author: Christian Brauner Date: Fri Sep 19 11:29:49 2025 +0200 ns: use inode initializer for initial namespaces Just use the common helper we have. Signed-off-by: Christian Brauner commit d093090ea79979ca7198b03bb2c31cd518b80b59 Author: Christian Brauner Date: Fri Sep 19 12:01:38 2025 +0200 selftests/namespaces: verify initial namespace inode numbers Make sure that all works correctly. Signed-off-by: Christian Brauner commit 1f84344c8d83bb867d142608cf543b80bc74b7a2 Merge: bb57289f0ce1ba 024596a4e2802e Author: Christian Brauner Date: Fri Sep 19 10:16:49 2025 +0200 Merge patch series "ns: rework reference counting" Christian Brauner says: Stop open accesses to the reference counts and cargo-culting the same code in all namespace. Use a set of dedicated helpers and make the actual count private. * patches from https://lore.kernel.org/20250918-work-namespace-ns_ref-v1-0-1b0a98ee041e@kernel.org: ns: rename to __ns_ref nsfs: port to ns_ref_*() helpers net: port to ns_ref_*() helpers uts: port to ns_ref_*() helpers ipv4: use check_net() net: use check_net() net-sysfs: use check_net() user: port to ns_ref_*() helpers time: port to ns_ref_*() helpers pid: port to ns_ref_*() helpers ipc: port to ns_ref_*() helpers cgroup: port to ns_ref_*() helpers mnt: port to ns_ref_*() helpers ns: add reference count helpers Signed-off-by: Christian Brauner commit 024596a4e2802e457a9f92af79f246fa9631f8de Author: Christian Brauner Date: Thu Sep 18 12:11:59 2025 +0200 ns: rename to __ns_ref Make it easier to grep and rename to ns_count. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b3d8ff0679507a21c1917f6ae0b56ed9b9c625f6 Author: Christian Brauner Date: Thu Sep 18 12:11:58 2025 +0200 nsfs: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 99d33ce100cbc982647c9299cadb1277cfad503e Author: Christian Brauner Date: Thu Sep 18 12:11:57 2025 +0200 net: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 2438b7d63ad866d6b2bb7b8d3455a6365d9b0fbe Author: Christian Brauner Date: Thu Sep 18 12:11:56 2025 +0200 uts: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f12021e68a13f4f867b8d55212254f1f83f75e00 Author: Christian Brauner Date: Thu Sep 18 12:11:55 2025 +0200 ipv4: use check_net() Don't directly acess the namespace count. There's even a dedicated helper for this. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit dc41b844da530e94f5b8384deb2af602cbeb312a Author: Christian Brauner Date: Thu Sep 18 12:11:54 2025 +0200 net: use check_net() Don't directly acess the namespace count. There's even a dedicated helper for this. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 83914de1c1d39dca4a3196a03bcd64d0a861d551 Author: Christian Brauner Date: Thu Sep 18 12:11:53 2025 +0200 net-sysfs: use check_net() Don't directly acess the namespace count. There's even a dedicated helper for this. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 96d997ea5ad1911cc393ffdb5c928b532f2f921a Author: Christian Brauner Date: Thu Sep 18 12:11:52 2025 +0200 user: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit e0c173f1fa02c0b08720aa8aa0cc91c3063146ae Author: Christian Brauner Date: Thu Sep 18 12:11:51 2025 +0200 time: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 07897b38eadf5a370a6001790239f23036d5b970 Author: Christian Brauner Date: Thu Sep 18 12:11:50 2025 +0200 pid: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d4825c99d6a738c565d5142ce37369368a4352da Author: Christian Brauner Date: Thu Sep 18 12:11:49 2025 +0200 ipc: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit bb57289f0ce1bab7c9ea2106a29088088dc95229 Merge: 3ab378cfa793c6 be5f21d3985f00 Author: Christian Brauner Date: Fri Sep 19 10:14:45 2025 +0200 Merge patch series "ns: rework common initialization" Christian Brauner says: The current scheme still involves a lot of open-coding and copy-pasing and bleeds a lot of unnecessary details into actual namespace implementers. Encapsulate it in the common helpers and simplify it all. * patches from https://lore.kernel.org/20250917-work-namespace-ns_common-v1-0-1b3bda8ef8f2@kernel.org: ns: add ns_common_free() nscommon: simplify initialization net: centralize ns_common initialization mnt: simplify ns_common_init() handling nsfs: add inode number for anon namespace cgroup: split namespace into separate header nscommon: move to separate file mnt: expose pointer to init_mnt_ns uts: split namespace into separate header Signed-off-by: Christian Brauner commit 06099e374f3ab818f0501671b21493ba2e1b94b9 Author: Christian Brauner Date: Thu Sep 18 12:11:48 2025 +0200 cgroup: port to ns_ref_*() helpers Stop accessing ns.count directly. Acked-by: Tejun Heo Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit be5f21d3985f00827e09b798f7a07ebd6dd7f54a Author: Christian Brauner Date: Wed Sep 17 12:28:08 2025 +0200 ns: add ns_common_free() And drop ns_free_inum(). Anything common that can be wasted centrally should be wasted in the new common helper. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 2e9e6972279fec7dd352ff05abe596e55988ec41 Author: Christian Brauner Date: Thu Sep 18 12:11:47 2025 +0200 mnt: port to ns_ref_*() helpers Stop accessing ns.count directly. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 224ef741ce87aa6474b82e0eb76e0e8e1bafe544 Author: Christian Brauner Date: Thu Sep 18 12:11:46 2025 +0200 ns: add reference count helpers Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 56ce6c8b11a95c65764e27cb6021b1e98ccc4212 Merge: 8f5ae30d69d754 69635d7f4b344e Author: Christian Brauner Date: Fri Sep 19 16:15:12 2025 +0200 Merge patch series "fs: replace wq users and add WQ_PERCPU to alloc_workqueue() users" Marco Crivellari says: Below is a summary of a discussion about the Workqueue API and cpu isolation considerations. Details and more information are available here: "workqueue: Always use wq_select_unbound_cpu() for WORK_CPU_UNBOUND." https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ === Current situation: problems === Let's consider a nohz_full system with isolated CPUs: wq_unbound_cpumask is set to the housekeeping CPUs, for !WQ_UNBOUND the local CPU is selected. This leads to different scenarios if a work item is scheduled on an isolated CPU where "delay" value is 0 or greater then 0: schedule_delayed_work(, 0); This will be handled by __queue_work() that will queue the work item on the current local (isolated) CPU, while: schedule_delayed_work(, 1); Will move the timer on an housekeeping CPU, and schedule the work there. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. === Plan and future plans === This patchset is the first stone on a refactoring needed in order to address the points aforementioned; it will have a positive impact also on the cpu isolation, in the long term, moving away percpu workqueue in favor to an unbound model. These are the main steps: 1) API refactoring (that this patch is introducing) - Make more clear and uniform the system wq names, both per-cpu and unbound. This to avoid any possible confusion on what should be used. - Introduction of WQ_PERCPU: this flag is the complement of WQ_UNBOUND, introduced in this patchset and used on all the callers that are not currently using WQ_UNBOUND. WQ_UNBOUND will be removed in a future release cycle. Most users don't need to be per-cpu, because they don't have locality requirements, because of that, a next future step will be make "unbound" the default behavior. 2) Check who really needs to be per-cpu - Remove the WQ_PERCPU flag when is not strictly required. 3) Add a new API (prefer local cpu) - There are users that don't require a local execution, like mentioned above; despite that, local execution yeld to performance gain. This new API will prefer the local execution, without requiring it. === Introduced Changes by this series === 1) [P 1-2] Replace use of system_wq and system_unbound_wq system_wq is a per-CPU workqueue, but his name is not clear. system_unbound_wq is to be used when locality is not required. Because of that, system_wq has been renamed in system_percpu_wq, and system_unbound_wq has been renamed in system_dfl_wq. 2) [P 3] add WQ_PERCPU to remaining alloc_workqueue() users Every alloc_workqueue() caller should use one among WQ_PERCPU or WQ_UNBOUND. This is actually enforced warning if both or none of them are present at the same time. WQ_UNBOUND will be removed in a next release cycle. * patches from https://lore.kernel.org/20250916082906.77439-1-marco.crivellari@suse.com: fs: WQ_PERCPU added to alloc_workqueue users fs: replace use of system_wq with system_percpu_wq fs: replace use of system_unbound_wq with system_dfl_wq Signed-off-by: Christian Brauner commit 69635d7f4b344e6f5344bba3c3de92e4fb8b0d2a Author: Marco Crivellari Date: Tue Sep 16 10:29:06 2025 +0200 fs: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to all the fs subsystem users to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/20250916082906.77439-4-marco.crivellari@suse.com Signed-off-by: Christian Brauner commit 4ef64db060619be040351e3960e151e5fef3f895 Author: Marco Crivellari Date: Tue Sep 16 10:29:05 2025 +0200 fs: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq to all the fs subsystem. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/20250916082906.77439-3-marco.crivellari@suse.com Signed-off-by: Christian Brauner commit 7a4f92d39f66f890cbb157dd4d7daf6a9298324a Author: Marco Crivellari Date: Tue Sep 16 10:29:04 2025 +0200 fs: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/20250916082906.77439-2-marco.crivellari@suse.com Signed-off-by: Christian Brauner commit 40987a08ba6c3e9408efc00e6388304452276e40 Merge: faef0c6ccef8a6 20253f806818e9 Author: Mark Brown Date: Fri Sep 19 15:11:58 2025 +0100 Add QSPI support for sam9x7 and sama7d65 SoCs Merge series from Dharma Balasubiramani : This patch series adds support for SAM9X7 and sama7d65 QSPI controller along with the SoC-specific capabilities. commit faef0c6ccef8a6d7709227654032427ba0bb3911 Merge: a24802b0a2a238 0f67557763accb Author: Mark Brown Date: Fri Sep 19 15:11:53 2025 +0100 spi: spi-nxp-fspi: add DTR mode support Merge series from Haibo Chen : this patch set add DTR mode support for flexspi. For DTR mode, flexspi only support 8D-8D-8D mode. Patch 1~2 extract nxp_fspi_dll_override(), prepare for adding the DTR mode. in nor suspend, it will disable DTR mode, and enable DTR mode back in nor resume. this require the flexspi driver has the ability to set back to dll override mode in STR mode when clock rate < 100MHz. Patch 3 Add the DDR LUT command support. flexspi use LUT command to handle the dtr/str mode. Patch 4 add the logic of sample clock source selection for STR/DTR mode STR use the default mode 0, sample based on the internal dummy pad. DTR use the mode 3, sample based on the external DQS pad, so this board and device connect the DQS pad. adjust the clock rate for DTR mode, when detect the DDR LUT command, flexspi will automatically div 2 of the root clock and output to device. Patch 5 finally add the DTR support in default after the upper 4 patches's prepareation. Since lx2160a do not implement DQS pad, so can't support this DTR mode. commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea Author: Richard Fitzgerald Date: Fri Sep 19 15:02:35 2025 +0100 ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar is not NULL before calling it. The original code assumed that if include_sidecar is true, the codec on that link has an add_sidecar callback. But there could be other codecs on the same link that do not have an add_sidecar callback. Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit e156dd6b856fa462430d875b0d4cd281ecd66c23 Author: Lorenzo Bianconi Date: Thu Sep 18 08:59:41 2025 +0200 net: airoha: Fix PPE_IP_PROTO_CHK register definitions Fix typo in PPE_IP_PROTO_CHK_IPV4_MASK and PPE_IP_PROTO_CHK_IPV6_MASK register mask definitions. This is not a real problem since this register is not actually used in the current codebase. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc Author: ChunHao Lin Date: Thu Sep 18 10:34:25 2025 +0800 r8169: set EEE speed down ratio to 1 EEE speed down means speed down MAC MCU clock. It is not from spec. It is kind of Realtek specific power saving feature. But enable it may cause some issues, like packet drop or interrupt loss. Different hardware may have different issues. EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed down rate. The larger this value is, the more power can save. But it actually save less power then we expected. And, as mentioned above, will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0) , which means not to speed down, to improve compatibility. Signed-off-by: ChunHao Lin Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com Signed-off-by: Jakub Kicinski commit a346e48c1792cbc600fdafc8fb4c0044f7c2ccfe Author: Heiner Kallweit Date: Thu Sep 18 07:54:00 2025 +0200 net: dsa: dsa_loop: remove duplicated definition of NUM_FIXED_PHYS Remove duplicated definition of NUM_FIXED_PHYS. This was a leftover from 41357bc7b94b ("net: dsa: dsa_loop: remove usage of mdio_board_info"). Signed-off-by: Heiner Kallweit Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/67a3b7df-c967-4431-86b6-a836dc46a4ef@gmail.com Signed-off-by: Jakub Kicinski commit 833d4313bc1e9e194814917d23e8874d6b651649 Author: Matthieu Baerts (NGI0) Date: Thu Sep 18 10:50:18 2025 +0200 mptcp: reset blackhole on success with non-loopback ifaces When a first MPTCP connection gets successfully established after a blackhole period, 'active_disable_times' was supposed to be reset when this connection was done via any non-loopback interfaces. Unfortunately, the opposite condition was checked: only reset when the connection was established via a loopback interface. Fixing this by simply looking at the opposite. This is similar to what is done with TCP FastOpen, see tcp_fastopen_active_disable_ofo_check(). This patch is a follow-up of a previous discussion linked to commit 893c49a78d9f ("mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable()."), see [1]. Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/4209a283-8822-47bd-95b7-87e96d9b7ea3@kernel.org [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250918-net-next-mptcp-blackhole-reset-loopback-v1-1-bf5818326639@kernel.org Signed-off-by: Jakub Kicinski commit c4bdef8b3d2a9ad4ac45017fa294b3b0784ca974 Author: Dan Carpenter Date: Thu Sep 18 12:45:47 2025 +0300 hinic3: Fix NULL vs IS_ERR() check in hinic3_alloc_rxqs_res() The page_pool_create() function never returns NULL, it returns error pointers. Update the check to match. Fixes: 73f37a7e1993 ("hinic3: Queue pair resource initialization") Signed-off-by: Dan Carpenter Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/aMvUywhgbmO1kH3Z@stanley.mountain Signed-off-by: Jakub Kicinski commit 17f1b7711e81107de60ff1f74b93fe5111dd3b0a Author: Eric Dumazet Date: Thu Sep 18 11:52:38 2025 +0000 psp: do not use sk_dst_get() in psp_dev_get_for_sock() Use __sk_dst_get() and dst_dev_rcu(), because dst->dev could be changed under us. Fixes: 6b46ca260e22 ("net: psp: add socket security association code") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Tested-by: Daniel Zahka Reviewed-by: Daniel Zahka Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250918115238.237475-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 92d051a1c1e30d6f8655a3fab91e19fdad72040b Author: Will Deacon Date: Fri Sep 19 14:56:43 2025 +0100 arm64: Kconfig: Spell out "ARMv9.4" in menuconfig text The menuconfig entries to configure various architectural features are all formatted as "ARMvx.y architecture features" with the unusual exception of 9.4, which omits the "ARM" prefix. Add the "ARM" prefix to the menuconfig entry for the ARMv9.4 architectural features. Signed-off-by: Will Deacon commit 557c82a4480719f64cf6530b5090001e9d908904 Author: James Clark Date: Mon Sep 1 13:40:36 2025 +0100 KVM: arm64: Add trap configs for PMSDSFR_EL1 SPE data source filtering (SPE_FEAT_FDS) adds a new register PMSDSFR_EL1, add the trap configs for it. PMSNEVFR_EL1 was also missing its VNCR offset so add it along with PMSDSFR_EL1. Tested-by: Leo Yan Signed-off-by: James Clark Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit 309e94a64b61d1b18a0d0d83de4bf2d2582708ce Merge: dfe3de7b5abe19 0266f9541038b9 Author: Mark Brown Date: Fri Sep 19 14:27:28 2025 +0100 ASoC: codecs: wcd93xxx: remove code duplication Merge series from Srinivas Kandagatla : All the Qualcomm WCD codecs and WCD based codecs have lots of code in common, resulting in lot of duplicate code. This series is an attempt to clean some of this by moving the common code to wcd-common library or to soundwire helper functions. Currently I have done cleanups for 4 codecs wcd934x, wcd937x, wcd938x and wcd939x, however any new Qualcomm codecs can avoid this duplication by using the wcd-common library. I have also added two helpers of_sdw_find_device_by_node() and sdw_slave_get_current_bank() in soundwire layer for the codecs to use them, this series was already acked by Soundwire maintainer Vinod. As original cleanup series was depending on the new soundwire interfaces I have combined both the series as they are cleaning up code duplications. As am touching the same codec drivers, 2 bug fixes are also added at the start of the series. There is still lot of code that is duplicate, but this is just a starting point for such cleanups. I have tested this on T14s, any testing is appreciated. commit 7ea24326e72dad7cd326bedd8442c162ae23df9d Author: Pavel Begunkov Date: Fri Sep 19 12:11:57 2025 +0100 io_uring/query: cap number of queries If a query chain forms a cycle, it'll be looping in the kernel until the process is killed. It might be fine as any such mistake can be easily uncovered during testing, but it's still nicer to let it break out of the syscall if it executed too many queries. Suggested-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 2408d1783204920880f929a7a3087c76f5a59c13 Author: Pavel Begunkov Date: Fri Sep 19 12:11:56 2025 +0100 io_uring/query: prevent infinite loops If the query chain forms a cycle, the interface will loop indefinitely. Make sure it handles fatal signals, so the user can kill the process and hence break out of the infinite loop. Fixes: c265ae75f900 ("io_uring: introduce io_uring querying") Reported-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b8b1d62f17d6fb323dc1f38dd7ad43a88fcd75e3 Author: Oliver Upton Date: Fri Sep 12 14:22:58 2025 -0700 KVM: arm64: nv: Expose up to FEAT_Debugv8p8 to NV-enabled VMs The changes to the debug architecture up to v8.8 are concerned with external debug, which of course has no direct impact on VMs. Raise the feature limit and document what's preventing us from raising it further. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 6f2224ef07437116ae9c46257b323306260074d1 Author: Oliver Upton Date: Fri Sep 12 14:22:57 2025 -0700 KVM: arm64: nv: Advertise FEAT_TIDCP1 to NV-enabled VMs While KVM does not expose IMPDEF features to VMs, FEAT_TIDCP1 is an architecturally-defined EL1 trap of a particular sysreg encoding range. Furthermore, KVM already advertises this feature to non-NV VMs. As there is no interaction with EL2 traps, expose the feature. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit fe2c9cd439e0f84a31b3610e2530663e5d1d3fa8 Author: Oliver Upton Date: Fri Sep 12 14:22:56 2025 -0700 KVM: arm64: nv: Advertise FEAT_SpecSEI to NV-enabled VMs FEAT_SpecSEI is an informational feature describing whether speculative loads may generate SErrors. Since there are already cases where KVM reinjects an SError into the VM it is already possible this may happen due to a speculative load within the VM. Stop hiding the feature from NV-enabled VMs. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 952387c9d39998c7ba48a93aa7f8b8eb420d61dd Author: Oliver Upton Date: Fri Sep 12 14:22:55 2025 -0700 KVM: arm64: nv: Expose FEAT_TWED to NV-enabled VMs KVM now handles HCR_EL2.{TWEDEn,TWEDEL} correctly when computing the effective HCR for a nested context. Advertise the feature. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 05d9f3408334afb97b91dc869c658e6951c3dcb3 Author: Oliver Upton Date: Fri Sep 12 14:22:54 2025 -0700 KVM: arm64: nv: Exclude guest's TWED configuration when TWE isn't set Ignore the guest hypervisor's configured TWE delay if it hasn't actually requested WFE traps. Otherwise, OR'ing these fields into the effective HCR when the guest sets TWE is safe as KVM doesn't use FEAT_TWED and leaves the fields initialized to 0. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 09dc6b42c62e47718ce0e94d44db7deffdc193ff Author: Oliver Upton Date: Fri Sep 12 14:22:53 2025 -0700 KVM: arm64: nv: Expose FEAT_AFP to NV-enabled VMs FEAT_AFP doesn't intersect with any EL2 trap behavior, expose to NV-enabled VMs. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 7cbdb25bed4046dacf139cce25fad9ef39a04a5f Author: Oliver Upton Date: Fri Sep 12 14:22:52 2025 -0700 KVM: arm64: nv: Expose FEAT_ECBHB to NV-enabled VMs The exact wording of the restrictions on branch prediction due to FEAT_ECBHB in DDI0487L.b is as follows: When FEAT_ECBHB is implemented, the branch history information created in a context before an exception to a higher Exception level using AArch64 cannot be used by code before that exception to exploitatively control the execution of any indirect branches in code in a different context after the exception. While vEL2 and EL1 are multiplexed at EL1, they exist in different hardware-described contexts as KVM uses different stage-2 MMUs to represent the corresponding translation regimes. Additionally, exception entries into vEL2 always imply a hardware exception entry into literal EL2 for the emulated regime change. Given all of this, and the fact that FEAT_ECBHB places no limitation on the EL of the protected context after the exception, we can claim FEAT_ECBHB on supporting hardware. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 26785cf28bb10bc94b2a52820c8ba1b3cfc534e5 Author: Oliver Upton Date: Fri Sep 12 14:22:51 2025 -0700 KVM: arm64: nv: Expose FEAT_RASv1p1 via RAS_frac KVM already supports FEAT_RASv1p1 for NV-enabled VMs but only when advertised through the canonical field. Stop masking the silly frac field to expose the feature on systems without FEAT_DF. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit fac4ee7abe47a078a790ad2a9dd777257a186acc Author: Oliver Upton Date: Fri Sep 12 14:22:50 2025 -0700 KVM: arm64: nv: Expose FEAT_DF2 to NV-enabled VMs The supporting infrastructure in KVM's abort injection code was merged a while ago, but the author (me!) forgot to relax the NV limitation when FEAT_DF2 got exposed to non-NV VMs. Fix it. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 49da9872a6a6fa943c02448eeae6db5e7f479283 Author: Oliver Upton Date: Fri Sep 12 14:22:49 2025 -0700 KVM: arm64: nv: Don't erroneously claim FEAT_DoubleLock for NV VMs ID_AA64DFR0_EL1.DoubleLock is one of those annoying signed feature fields where a non-negative value implies that a feature is implemented and a negative value implies that it is not. While the intention of masking this field was likely to hide the feature, KVM actually advertises it, even on unsupporting hardware. Remove FEAT_DoubleLock from the mask, making the NI value visible to the VM. Take care to accept the old, incorrect values for this field as we've lied to userspace. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit d3c35b7c57fc33ce787921e2faf84b7d58989a2a Author: Oliver Upton Date: Fri Sep 12 14:22:48 2025 -0700 KVM: arm64: nv: Convert masks to denylists in limit_nv_id_reg() Consistently use denylisting of features such that the limitations of KVM's nested implementation are explicitly documented (rather than implied). Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit fc87f70bd133afd5b41fa8c128beb58c1ccc6e99 Author: Alexey Klimov Date: Wed Sep 17 08:32:52 2025 +0100 ASoC: qcom: qdsp6/audioreach: add support for offloading raw opus playback Add support for OPUS module, OPUS format ID, media format payload struct and make it all recognizable by audioreach compress playback path. At this moment this only supports raw or plain OPUS packets not encapsulated in container (for instance OGG container). For this usecase each OPUS packet needs to be prepended with 4-bytes long length field which is expected to be done by userspace applications. This is Qualcomm DSP specific requirement. Cc: Annemarie Porter Cc: Vinod Koul Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Signed-off-by: Alexey Klimov Acked-by: Mark Brown Signed-off-by: Takashi Iwai commit b07d2514b91c30ab16fdf8f9cc3523bef969becf Author: Alexey Klimov Date: Wed Sep 17 08:32:51 2025 +0100 ALSA: compress_offload: increase SNDRV_COMPRESS_VERSION minor version by 1 Since addition of raw opus codec support we need to update compress API minor version by one. Bump the SNDRV_COMPRESS_VERSION to 0.4.1. Signed-off-by: Alexey Klimov Acked-by: Vinod Koul Signed-off-by: Takashi Iwai commit 5d36370f34312776d202e5c35d1a786d8b07a9c3 Author: Alexey Klimov Date: Wed Sep 17 08:32:50 2025 +0100 ALSA: compress: add raw opus codec define and opus decoder structs Adds a raw opus codec define and raw opus decoder structs. This is for raw OPUS packets not packed in any type of container (for instance OGG container). The decoder struct fields are taken from corresponding RFC document: RFC 7845 Section 5. Cc: Srinivas Kandagatla Cc: Vinod Koul Co-developed-by: Annemarie Porter Signed-off-by: Annemarie Porter Signed-off-by: Alexey Klimov Signed-off-by: Takashi Iwai commit be8c9192eaeee21fdaacd72ad4ba992b9e42377b Author: Jinqian Yang Date: Thu Sep 11 19:46:21 2025 +0800 KVM: arm64: selftests: Test writes to ID_AA64MMFR1_EL1.{HCX, TWED} Assert that the EL2 features {HCX, TWED} of ID_AA64MMFR1_EL1 are writable from userspace. They are only allowed to be downgraded in userspace. Signed-off-by: Jinqian Yang Signed-off-by: Marc Zyngier commit 1a0b2bf6ff11d2e0438f3a7d1d299339edab96e8 Author: Jinqian Yang Date: Thu Sep 11 19:46:20 2025 +0800 KVM: arm64: Make ID_AA64MMFR1_EL1.{HCX, TWED} writable from userspace Allow userspace to downgrade {HCX, TWED} in ID_AA64MMFR1_EL1. Userspace can only change the value from high to low. Signed-off-by: Jinqian Yang Signed-off-by: Marc Zyngier commit dfe3de7b5abe194f422dd92cf18fb5678fb918a7 Merge: 2aa28b748fc967 cb3c715d89607f Author: Mark Brown Date: Fri Sep 19 13:54:28 2025 +0100 ASoC: soc-dapm: prepare for hiding struct Merge series from Kuninori Morimoto : We would like to hide struct snd_soc_dapm_context from driver. So we need cleanup code first. These are preparation for it. commit ac53365990a19e808fde2758074ee31be65d1015 Author: Marc Zyngier Date: Thu Sep 18 16:14:02 2025 +0100 KVM: arm64: Convert MDCR_EL2 RES0 handling to compute_reg_res0_bits() While MDCR_EL2 cannot be RES0, convert it to the same infrastructure anyway, as it make things cleaner. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit d2a1d78ce5962b01500d09b15e2a854768552d44 Author: Marc Zyngier Date: Thu Sep 18 16:14:01 2025 +0100 KVM: arm64: Convert SCTLR_EL1 RES0 handling to compute_reg_res0_bits() While SCTLR_EL1 cannot be RES0, convert it to the same infrastructure anyway, as it make things cleaner. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 4870a8c1d18897681b6f6a50288d0b6dd5e21e24 Author: Marc Zyngier Date: Thu Sep 18 16:14:00 2025 +0100 KVM: arm64: Enforce absence of FEAT_TCR2 on TCR2_EL2 Enforce that TCR2_EL2 are RES0 when FEAT_TCR2 isn't present. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit f89763efe86cc05f8465c7eea85a76183f218c56 Author: Marc Zyngier Date: Thu Sep 18 16:13:59 2025 +0100 KVM: arm64: Enforce absence of FEAT_SCTLR2 on SCTLR2_EL{1,2} Enforce that SCTLR2_EL{1,2} are RES0 when FEAT_SCTLR2 isn't present. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit efe5406c55fb3203028507555c7da2bb417a397c Author: Marc Zyngier Date: Thu Sep 18 16:13:58 2025 +0100 KVM: arm64: Convert HCR_EL2 RES0 handling to compute_reg_res0_bits() While HCR_EL2 is unlikely to ever be RES0 (at least when NV is on), but consistency doesn't hurt, and it can be described in the same way as the other registers. Convert it over to the new RES0-computing infrastructure. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit c99d62771f63116ffe54636980414fc74ab3471c Author: Marc Zyngier Date: Thu Sep 18 16:13:57 2025 +0100 KVM: arm64: Enforce absence of FEAT_HCX on HCRX_EL2 Add the dependency between the HCRX_EL2 register and FEAT_HCX. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 338a41e83c3dab81573ac33bc30f0f36bd29cd78 Author: Marc Zyngier Date: Thu Sep 18 16:13:56 2025 +0100 KVM: arm64: Enforce absence of FEAT_FGT2 on FGT2 registers Similarly to the FEAT_FGT registers, add the dependency between the registers and the controlling feature. WHile we're at it, add the missing checks for the RES0 vs valid bit overlap. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 7d3a4d048925d52e5511d82e479cbdcf7354aa7c Author: Marc Zyngier Date: Thu Sep 18 16:13:55 2025 +0100 KVM: arm64: Enforce absence of FEAT_FGT on FGT registers As we want to enforce FGT registers behaving as RES0 when FEAT_FGT is not exposed to the guest, We move a bumch of things that are so far passed as parameter into a structure that points to the bit description. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 559442afea8812814135ec6fa33bc62c9d09f5c4 Author: Marc Zyngier Date: Thu Sep 18 16:13:54 2025 +0100 KVM: arm64: Add reg_feat_map_desc to describe full register dependency struct reg_bits_to_feat_map is great to describe bit-to-feature dependency, but not so much to describe register-to-feature dependency. Yet both need to exist. Add a new reg_feat_map_desc structure to describe this. Extra complexity is added by the need to source the RES0 bits from the runtime-computed FGT masks, for which we need an extra flag and extra complexity. Oh well. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit c3b3bbd160d2014a638d40bda17909a0afd85d09 Author: Marc Zyngier Date: Thu Sep 18 16:13:53 2025 +0100 KVM: arm64: Remove duplicate FEAT_{SYSREG128,MTE2} descriptions Turns out I'm rather bad at noticing that the description of features has already been added. Remove superflusous definitions for SYSREG128 and MTE2. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit d9b2623319fa20c2206754284291817488329648 Author: Lucas De Marchi Date: Fri Sep 12 14:54:51 2025 -0700 drm/xe: Fix build with CONFIG_MODULES=n When building with CONFIG_MODULES=n, the __exit functions are dropped. However our init functions may call them for error handling, so they are not good candidates for the exit sections. Fix this error reported by 0day: ld.lld: error: relocation refers to a symbol in a discarded section: xe_configfs_exit >>> defined in vmlinux.a(drivers/gpu/drm/xe/xe_configfs.o) >>> referenced by xe_module.c >>> drivers/gpu/drm/xe/xe_module.o:(init_funcs) in archive vmlinux.a This is the only exit function using __exit. Drop it to fix the build. Cc: Riana Tauro Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506092221.1FmUQmI8-lkp@intel.com/ Fixes: 16280ded45fb ("drm/xe: Add configfs to enable survivability mode") Reviewed-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250912-fix-nomodule-build-v1-1-d11b70a92516@intel.com Signed-off-by: Lucas De Marchi commit 5612ff3ec588be09f11a9424db6d1186bcdeb3fa Author: Christian Brauner Date: Wed Sep 17 12:28:07 2025 +0200 nscommon: simplify initialization There's a lot of information that namespace implementers don't need to know about at all. Encapsulate this all in the initialization helper. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d5b27cb8c5f30c972e041b30bc38fa5875b1a469 Author: Christian Brauner Date: Wed Sep 17 12:28:06 2025 +0200 net: centralize ns_common initialization Centralize ns_common initialization. Signed-off-by: Christian Brauner commit 86cdbae5c61c6b8c0a2adc78dbbb0314b3254a9c Author: Christian Brauner Date: Wed Sep 17 12:28:05 2025 +0200 mnt: simplify ns_common_init() handling Assign the reserved MNT_NS_ANON_INO sentinel to anonymous mount namespaces and cleanup the initial mount ns allocation. This is just a preparatory patch and the ns->inum check in ns_common_init() will be dropped in the next patch. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit cc47f434271ba90c18c16e0bba360df38a8bc954 Author: Christian Brauner Date: Wed Sep 17 12:28:04 2025 +0200 nsfs: add inode number for anon namespace Add an inode number anonymous namespaces. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 5fc6bef178f1b644f1439e520c8f83bfc83a1252 Author: Christian Brauner Date: Wed Sep 17 12:28:03 2025 +0200 cgroup: split namespace into separate header We have dedicated headers for all namespace types. Add one for the cgroup namespace as well. Now it's consistent for all namespace types and easy to figure out what to include. Acked-by: Tejun Heo Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f74ca6da113d5d4b21c00bb4da3f3c137162b4fe Author: Christian Brauner Date: Wed Sep 17 12:28:02 2025 +0200 nscommon: move to separate file It's really awkward spilling the ns common infrastructure into multiple headers. Move it to a separate file. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b2a0b192084acd0a86d66cbbc61e17ba1f5bd583 Author: Christian Brauner Date: Wed Sep 17 12:28:01 2025 +0200 mnt: expose pointer to init_mnt_ns There's various scenarios where we need to know whether we are in the initial set of namespaces or not to e.g., shortcut permission checking. All namespaces expose that information. Let's do that too. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3ab378cfa793c648d4edf02bbfff3af8715aca91 Merge: 8f5ae30d69d754 28ef38a9a2c7aa Author: Christian Brauner Date: Mon Sep 15 13:45:37 2025 +0200 Merge patch series "ns: support file handles" Christian Brauner says: For a while now we have supported file handles for pidfds. This has proven to be very useful. Extend the concept to cover namespaces as well. After this patchset it is possible to encode and decode namespace file handles using the commong name_to_handle_at() and open_by_handle_at() apis. Namespaces file descriptors can already be derived from pidfds which means they aren't subject to overmount protection bugs. IOW, it's irrelevant if the caller would not have access to an appropriate /proc//ns/ directory as they could always just derive the namespace based on a pidfd already. It has the same advantage as pidfds. It's possible to reliably and for the lifetime of the system refer to a namespace without pinning any resources and to compare them. Permission checking is kept simple. If the caller is located in the namespace the file handle refers to they are able to open it otherwise they must hold privilege over the owning namespace of the relevant namespace. Both the network namespace and the mount namespace already have an associated cookie that isn't recycled and is fully exposed to userspace. Move this into ns_common and use the same id space for all namespaces so they can trivially and reliably be compared. There's more coming based on the iterator infrastructure but the series is large enough and focuses on file handles. Extensive selftests included. * patches from https://lore.kernel.org/20250912-work-namespace-v2-0-1a247645cef5@kernel.org: (33 commits) selftests/namespaces: add file handle selftests selftests/namespaces: add identifier selftests tools: update nsfs.h uapi header nsfs: add missing id retrieval support nsfs: support exhaustive file handles nsfs: support file handles nsfs: add current_in_namespace() ns: add to__ns() to respective headers uts: support ns lookup user: support ns lookup time: support ns lookup pid: support ns lookup net: support ns lookup ipc: support ns lookup cgroup: support ns lookup mnt: support ns lookup nstree: make iterator generic ns: remove ns_alloc_inum() uts: use ns_common_init() user: use ns_common_init() ... Signed-off-by: Christian Brauner commit 93f67a7ddadf6ed8997c000df9790e5d64617196 Author: Christian Brauner Date: Wed Sep 17 12:28:00 2025 +0200 uts: split namespace into separate header We have dedicated headers for all namespace types. Add one for the uts namespace as well. Now it's consistent for all namespace types. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 28ef38a9a2c7aa4dd8dfbb1d2b12f9ea84044327 Author: Christian Brauner Date: Fri Sep 12 13:52:56 2025 +0200 selftests/namespaces: add file handle selftests Add a bunch of selftests for namespace file handles. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 14f98438f0ed7b121a847260023de64ae128887e Author: Christian Brauner Date: Fri Sep 12 13:52:55 2025 +0200 selftests/namespaces: add identifier selftests Add a bunch of selftests for the identifier retrieval ioctls. Signed-off-by: Christian Brauner commit 87a1716c7d6551e59ca4bd9cdcdf04c67deaa337 Author: Christian Brauner Date: Fri Sep 12 13:52:54 2025 +0200 tools: update nsfs.h uapi header Update the nsfs.h tools header to the uapi/nsfs.h header so we can rely on it in the selftests. Signed-off-by: Christian Brauner commit f861225b9ee9cb2da1c7b2f5f921856cb8ca86bb Author: Christian Brauner Date: Fri Sep 12 13:52:53 2025 +0200 nsfs: add missing id retrieval support The mount namespace has supported id retrieval for a while already. Add support for the other types as well. Signed-off-by: Christian Brauner commit e83f0b5d10dcf62833008327cb661c7d118bca85 Author: Christian Brauner Date: Fri Sep 12 13:52:52 2025 +0200 nsfs: support exhaustive file handles Pidfd file handles are exhaustive meaning they don't require a handle on another pidfd to pass to open_by_handle_at() so it can derive the filesystem to decode in. Instead it can be derived from the file handle itself. The same is possible for namespace file handles. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5222470b2fbb3740f931f189db33dd1367b1ae75 Author: Christian Brauner Date: Fri Sep 12 13:52:51 2025 +0200 nsfs: support file handles A while ago we added support for file handles to pidfs so pidfds can be encoded and decoded as file handles. Userspace has adopted this quickly and it's proven very useful. Implement file handles for namespaces as well. A process is not always able to open /proc/self/ns/. That requires procfs to be mounted and for /proc/self/ or /proc/self/ns/ to not be overmounted. However, userspace can always derive a namespace fd from a pidfd. And that always works for a task's own namespace. There's no need to introduce unnecessary behavioral differences between /proc/self/ns/ fds, pidfd-derived namespace fds, and file-handle-derived namespace fds. So namespace file handles are always decodable if the caller is located in the namespace the file handle refers to. This also allows a task to e.g., store a set of file handles to its namespaces in a file on-disk so it can verify when it gets rexeced that they're still valid and so on. This is akin to the pidfd use-case. Or just plainly for namespace comparison reasons where a file handle to the task's own namespace can be easily compared against others. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d2afdb73f8ad77b49eca9d110d0c54bf30d1df0f Author: Christian Brauner Date: Fri Sep 12 13:52:50 2025 +0200 nsfs: add current_in_namespace() Add a helper to easily check whether a given namespace is the caller's current namespace. This is currently open-coded in a lot of places. Simply switch on the type and compare the results. Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner commit d7afdf889561058068ab46fd8f306c70ef29216a Author: Christian Brauner Date: Fri Sep 12 13:52:49 2025 +0200 ns: add to__ns() to respective headers Every namespace type has a container_of(ns, , ns) static inline function that is currently not exposed in the header. So we have a bunch of places that open-code it via container_of(). Move it to the headers so we can use it directly. Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner commit 58f976d41fd915acd2403a2b8e0eef8e9c478357 Author: Christian Brauner Date: Fri Sep 12 13:52:48 2025 +0200 uts: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Signed-off-by: Christian Brauner commit 2f5243cbba6cff66cc8b43bdc14853282f5b1e67 Author: Christian Brauner Date: Fri Sep 12 13:52:47 2025 +0200 user: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Signed-off-by: Christian Brauner commit b36c823b9a4be5b0c8e38c3fd60cade7d41c216c Author: Christian Brauner Date: Fri Sep 12 13:52:46 2025 +0200 time: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Reviewed-by: Thomas Gleixner Signed-off-by: Christian Brauner commit 488acdcec8e24377506934a95e0ba21619073e8f Author: Christian Brauner Date: Fri Sep 12 13:52:45 2025 +0200 pid: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Signed-off-by: Christian Brauner commit 195f7422298d711e89643369988ed285d484dd74 Author: Christian Brauner Date: Fri Sep 12 13:52:44 2025 +0200 net: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. The network namespace has a separate list with different lifetime rules which we can just leave in tact. We have a similar concept for mount namespaces as well where it is on two differenet lists for different purposes. Signed-off-by: Christian Brauner commit 74b24a582e1ff3960f0454f57afc2bcdbc52562e Author: Christian Brauner Date: Fri Sep 12 13:52:43 2025 +0200 ipc: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Signed-off-by: Christian Brauner commit 7c60593985331e7839ec3fea6328a3253a325e82 Author: Christian Brauner Date: Fri Sep 12 13:52:42 2025 +0200 cgroup: support ns lookup Support the generic ns lookup infrastructure to support file handles for namespaces. Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit 7d7d164989586c0ad61934975c40ca795dc134c7 Author: Christian Brauner Date: Fri Sep 12 13:52:41 2025 +0200 mnt: support ns lookup Move the mount namespace to the generic ns lookup infrastructure. This allows us to drop a bunch of members from struct mnt_namespace. Signed-off-by: Christian Brauner commit 7914f15c5e45ea6c76f2b3272ff39d8fe67b13f5 Merge: 885fc8ac0a4dc7 38f4885088fc5a Author: Christian Brauner Date: Wed Sep 17 12:01:05 2025 +0200 Merge branch 'no-rebase-mnt_ns_tree_remove' Bring in the fix for removing a mount namespace from the mount namespace rbtree and list. Signed-off-by: Christian Brauner commit 885fc8ac0a4dc70f5d87b80b0977292870e35c60 Author: Christian Brauner Date: Fri Sep 12 13:52:40 2025 +0200 nstree: make iterator generic Move the namespace iteration infrastructure originally introduced for mount namespaces into a generic library usable by all namespace types. Signed-off-by: Christian Brauner commit 86c5aba210b145d7de011a5abaf9b785aa70a183 Author: Christian Brauner Date: Fri Sep 12 13:52:39 2025 +0200 ns: remove ns_alloc_inum() It's now unused. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 09337e064cbb692d5e0e34d7e1e2f2c53166f91a Author: Christian Brauner Date: Fri Sep 12 13:52:38 2025 +0200 uts: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 00ed42285c46e2c84223e3ec5e1d07638948b4d1 Author: Christian Brauner Date: Fri Sep 12 13:52:37 2025 +0200 user: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 7b0e2c83624b02a8a11f04f0581721d95ea6e4a6 Author: Christian Brauner Date: Fri Sep 12 13:52:36 2025 +0200 time: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Reviewed-by: Thomas Gleixner Signed-off-by: Christian Brauner commit 8e199cd6e3303d8f9352030ab9e4a221f277bd51 Author: Christian Brauner Date: Fri Sep 12 13:52:35 2025 +0200 pid: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 08027f6b790be1e444e4182fb4dc53faa6539d16 Author: Christian Brauner Date: Fri Sep 12 13:52:34 2025 +0200 net: use ns_common_init() Don't cargo-cult the same thing over and over. Signed-off-by: Christian Brauner commit 96ece8eb676453d09036c9a1eed7b680267f7778 Author: Christian Brauner Date: Fri Sep 12 13:52:33 2025 +0200 mnt: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 90d4d9f4d235673da83574f0f84be3e37f955a39 Author: Christian Brauner Date: Fri Sep 12 13:52:32 2025 +0200 ipc: use ns_common_init() Don't cargo-cult the same thing over and over. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0b40774ef06cee7c3334dcee068f06d331ff2749 Author: Christian Brauner Date: Fri Sep 12 13:52:31 2025 +0200 cgroup: use ns_common_init() Don't cargo-cult the same thing over and over. Acked-by: Tejun Heo Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 660def10b01b248fd97255afacb7b0e305ac833a Author: Christian Brauner Date: Fri Sep 12 13:52:30 2025 +0200 ns: uniformly initialize ns_common No point in cargo-culting the same code across all the different types. Use one common initializer. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 9296f46a9645cf753d2522093485cebe77635aa6 Author: Christian Brauner Date: Fri Sep 12 13:52:29 2025 +0200 nsfs: add nsfs.h header And move the stuff out from proc_ns.h where it really doesn't belong. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit e3e1812f8e25ac277f5cc9249802365300c582e3 Author: Christian Brauner Date: Fri Sep 12 13:52:28 2025 +0200 ns: move to_ns_common() to ns_common.h Move the helper to ns_common.h where it belongs. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit fa8ee8627b7411f2157aad59d3d2a68ab00adeeb Author: Christian Brauner Date: Fri Sep 12 13:52:27 2025 +0200 block: use extensible_ioctl_valid() Use the new extensible_ioctl_valid() helper which is equivalent to what is done here. Reviewed-by: Jens Axboe Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit c59c965292f75e39cc4cfefb50d56d4b1900812e Merge: 8f5ae30d69d754 6a96fb653b6481 Author: Christian Brauner Date: Fri Sep 19 14:17:16 2025 +0200 Merge patch series "iomap: cleanups ahead of adding fuse support" Darrick J. Wong says: In preparation for making fuse use the fs/iomap code for regular file data IO, fix a few bugs in fuse and apply a couple of tweaks to iomap. These patches can go in immediately. * patches from https://lore.kernel.org/175803480273.966383.16598493355913871794.stgit@frogsfrogsfrogs: iomap: error out on file IO when there is no inline_data buffer iomap: trace iomap_zero_iter zeroing activities Signed-off-by: Christian Brauner commit 6a96fb653b6481ec73e9627ade216b299e4de9ea Author: Darrick J. Wong Date: Tue Sep 16 08:00:45 2025 -0700 iomap: error out on file IO when there is no inline_data buffer Return IO errors if an ->iomap_begin implementation returns an IOMAP_INLINE buffer but forgets to set the inline_data pointer. Filesystems should never do this, but we could help fs developers (me) fix their bugs by handling this more gracefully than crashing the kernel. Signed-off-by: Darrick J. Wong Link: https://lore.kernel.org/175803480324.966383.7414345025943296442.stgit@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 231af8c14f0f1574ce5d5e66b48f0087a6a764e3 Author: Darrick J. Wong Date: Tue Sep 16 08:00:29 2025 -0700 iomap: trace iomap_zero_iter zeroing activities Trace which bytes actually get zeroed. Signed-off-by: Darrick J. Wong Link: https://lore.kernel.org/175803480303.966383.2380024013746734540.stgit@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 2ef435a872abc347dc0a92f1c213bb0af3cbf195 Author: Max Kellermann Date: Wed Sep 17 17:36:31 2025 +0200 fs: add might_sleep() annotation to iput() and more When iput() drops the reference counter to zero, it may sleep via inode_wait_for_writeback(). This happens rarely because it's usually the dcache which evicts inodes, but really iput() should only ever be called in contexts where sleeping is allowed. This annotation allows finding buggy callers. Additionally, this patch annotates a few low-level functions that can call iput() conditionally. Cc: Mateusz Guzik Signed-off-by: Max Kellermann Link: https://lore.kernel.org/20250917153632.2228828-1-max.kellermann@ionos.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 777fb19ed8d6f193c2811b76371ffb41acbca1da Author: Mark Brown Date: Thu Sep 18 20:42:07 2025 +0100 kselftest/arm64: Add lsfe to the hwcaps test This feature has no traps associated with it so the SIGILL is not reliable. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit 9426414f0d42f824892ecd4dccfebf8987084a41 Merge: 8f5ae30d69d754 0cee64c547e3c9 Author: Christian Brauner Date: Mon Sep 15 14:50:03 2025 +0200 Merge patch series "writeback: Avoid lockups when switching inodes" Jan Kara says: This patch series addresses lockups reported by users when systemd unit reading lots of files from a filesystem mounted with lazytime mount option exits. See patch 3 for more details about the reproducer. There are two main issues why switching many inodes between wbs: 1) Multiple workers will be spawned to do the switching but they all contend on the same wb->list_lock making all the parallelism pointless and just wasting time. 2) Sorting of wb->b_dirty list by dirtied_time_when is inherently slow. Patches 1-3 address these problems, patch 4 adds a tracepoint for better observability of inode writeback switching. * patches from https://lore.kernel.org/20250912103522.2935-1-jack@suse.cz: writeback: Add tracepoint to track pending inode switches writeback: Avoid excessively long inode switching times writeback: Avoid softlockup when switching many inodes writeback: Avoid contention on wb->list_lock when switching inodes Signed-off-by: Christian Brauner commit 0cee64c547e3c9cda646af3e075a64f445ee8148 Author: Jan Kara Date: Fri Sep 12 12:38:38 2025 +0200 writeback: Add tracepoint to track pending inode switches Add trace_inode_switch_wbs_queue tracepoint to allow insight into how many inodes are queued to switch their bdi_writeback structure. Acked-by: Tejun Heo Signed-off-by: Jan Kara Signed-off-by: Christian Brauner commit 9a6ebbdbd41235ea3bc0c4f39e2076599b8113cc Author: Jan Kara Date: Fri Sep 12 12:38:37 2025 +0200 writeback: Avoid excessively long inode switching times With lazytime mount option enabled we can be switching many dirty inodes on cgroup exit to the parent cgroup. The numbers observed in practice when systemd slice of a large cron job exits can easily reach hundreds of thousands or millions. The logic in inode_do_switch_wbs() which sorts the inode into appropriate place in b_dirty list of the target wb however has linear complexity in the number of dirty inodes thus overall time complexity of switching all the inodes is quadratic leading to workers being pegged for hours consuming 100% of the CPU and switching inodes to the parent wb. Simple reproducer of the issue: FILES=10000 # Filesystem mounted with lazytime mount option MNT=/mnt/ echo "Creating files and switching timestamps" for (( j = 0; j < 50; j ++ )); do mkdir $MNT/dir$j for (( i = 0; i < $FILES; i++ )); do echo "foo" >$MNT/dir$j/file$i done touch -a -t 202501010000 $MNT/dir$j/file* done wait echo "Syncing and flushing" sync echo 3 >/proc/sys/vm/drop_caches echo "Reading all files from a cgroup" mkdir /sys/fs/cgroup/unified/mycg1 || exit echo $$ >/sys/fs/cgroup/unified/mycg1/cgroup.procs || exit for (( j = 0; j < 50; j ++ )); do cat /mnt/dir$j/file* >/dev/null & done wait echo "Switching wbs" # Now rmdir the cgroup after the script exits We need to maintain b_dirty list ordering to keep writeback happy so instead of sorting inode into appropriate place just append it at the end of the list and clobber dirtied_time_when. This may result in inode writeback starting later after cgroup switch however cgroup switches are rare so it shouldn't matter much. Since the cgroup had write access to the inode, there are no practical concerns of the possible DoS issues. Acked-by: Tejun Heo Signed-off-by: Jan Kara Signed-off-by: Christian Brauner commit 66c14dccd810d42ec5c73bb8a9177489dfd62278 Author: Jan Kara Date: Fri Sep 12 12:38:36 2025 +0200 writeback: Avoid softlockup when switching many inodes process_inode_switch_wbs_work() can be switching over 100 inodes to a different cgroup. Since switching an inode requires counting all dirty & under-writeback pages in the address space of each inode, this can take a significant amount of time. Add a possibility to reschedule after processing each inode to avoid softlockups. Acked-by: Tejun Heo Signed-off-by: Jan Kara Signed-off-by: Christian Brauner commit e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b Author: Jan Kara Date: Wed Apr 9 17:12:59 2025 +0200 writeback: Avoid contention on wb->list_lock when switching inodes There can be multiple inode switch works that are trying to switch inodes to / from the same wb. This can happen in particular if some cgroup exits which owns many (thousands) inodes and we need to switch them all. In this case several inode_switch_wbs_work_fn() instances will be just spinning on the same wb->list_lock while only one of them makes forward progress. This wastes CPU cycles and quickly leads to softlockup reports and unusable system. Instead of running several inode_switch_wbs_work_fn() instances in parallel switching to the same wb and contending on wb->list_lock, run just one work item per wb and manage a queue of isw items switching to this wb. Acked-by: Tejun Heo Signed-off-by: Jan Kara commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e Author: Christian Göttsche Date: Wed Sep 10 21:26:05 2025 +0200 pid: use ns_capable_noaudit() when determining net sysctl permissions The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated. The denial audit message can either lead to the capability being unnecessarily allowed in a security policy, or being silenced potentially masking a legitimate capability check at a later point in time. Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when determining net sysctl permissions") Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace") CC: Christian Brauner CC: linux-security-module@vger.kernel.org CC: selinux@vger.kernel.org Signed-off-by: Christian Göttsche Acked-by: Serge Hallyn Reviewed-by: Paul Moore Signed-off-by: Christian Brauner commit 64581f41f4c4aa1845edeee6bb0c8f2a7103d9aa Author: Icenowy Zheng Date: Fri Sep 19 01:33:23 2025 +0800 pmdomain: thead: create auxiliary device for rebooting The reboot / power off operations require communication with the AON firmware too. As the driver is already present, create an auxiliary device with name "reboot" to match that driver, and pass the AON channel by using platform_data. Signed-off-by: Icenowy Zheng Signed-off-by: Ulf Hansson commit 2d81a24a74e577b0d34266059ff95f56150b40f9 Author: Icenowy Zheng Date: Fri Sep 19 01:33:22 2025 +0800 driver: reset: th1520-aon: add driver for poweroff/reboot via AON FW This driver implements poweroff/reboot support for T-Head TH1520 SoCs running the AON firmware by sending a message to the AON firmware's WDG part. This is a auxiliary device driver, and expects the AON channel to be passed via the platform_data of the auxiliary device. Signed-off-by: Icenowy Zheng Acked-by: Sebastian Reichel Signed-off-by: Ulf Hansson commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 Author: Fenglin Wu Date: Fri Sep 19 11:18:51 2025 +0800 power: supply: qcom_battmgr: handle charging state change notifications The X1E80100 battery management firmware sends a notification with code 0x83 when the battery charging state changes, such as switching between fast charge, taper charge, end of charge, or any other error charging states. The same notification code is used with bit[8] set when charging stops because the charge control end threshold is reached. Additionally, a 2-bit value is included in bit[10:9] with the same code to indicate the charging source capability, which is determined by the calculated power from voltage and current readings from PDOs: 2 means a strong charger over 60W, 1 indicates a weak charger, and 0 means there is no charging source. These 3-MSB [10:8] in the notification code is not much useful for now, hence just ignore them and trigger a power supply change event whenever 0x83 notification code is received. This helps to eliminate the unknown notification error messages. Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/ Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit 32d340ae675800672e1219444a17940a8efe5cca Author: Aditya Kumar Singh Date: Wed Sep 17 12:42:03 2025 +0530 wifi: mac80211: fix Rx packet handling when pubsta information is not available In ieee80211_rx_handle_packet(), if the caller does not provide pubsta information, an attempt is made to find the station using the address 2 (source address) field in the header. Since pubsta is missing, link information such as link_valid and link_id is also unavailable. Now if such a situation comes, and if a matching ML station entry is found based on the source address, currently the packet is dropped due to missing link ID in the status field which is not correct. Hence, to fix this issue, if link_valid is not set and the station is an ML station, make an attempt to find a link station entry using the source address. If a valid link station is found, derive the link ID and proceed with packet processing. Otherwise, drop the packet as per the existing flow. Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") Suggested-by: Vasanthakumar Thiagarajan Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com Signed-off-by: Johannes Berg commit cbcd507f01deb983d5cad0a25b6495930ab59593 Author: Lachlan Hodges Date: Thu Sep 18 15:19:13 2025 +1000 wifi: cfg80211: remove ieee80211_s1g_channel_width With the introduction of proper S1G channel flags, this function is no longer used. Remove it. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250918051913.500781-4-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 31e7681da78d7e8d2d83185c0e640012a018f229 Author: Lachlan Hodges Date: Thu Sep 18 15:19:12 2025 +1000 wifi: mac80211: correctly initialise S1G chandef for STA When moving to the APs channel, ensure we correctly initialise the chandef and perform the required validation. Additionally, if the AP is beaconing on a 2MHz primary, calculate the 2MHz primary center frequency by extracting the sibling 1MHz primary and averaging the frequencies to find the 2MHz primary center frequency. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250918051913.500781-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit d0688dc2b172d19e20fdb8be8c37930da12aaf88 Author: Lachlan Hodges Date: Thu Sep 18 15:19:11 2025 +1000 wifi: cfg80211: correctly implement and validate S1G chandef Currently, the S1G channelisation implementation differs from that of VHT, which is the PHY that S1G is based on. The major difference between the clock rate is 1/10th of VHT. However how their channelisation is represented within cfg80211 and mac80211 vastly differ. To rectify this, remove the use of IEEE80211_CHAN_1/2/4.. flags that were previously used to indicate the control channel width, however it should be implied that the control channels are 1MHz in the case of S1G. Additionally, introduce the invert - being IEEE80211_CHAN_NO_4/8/16MHz - that imply the control channel may not be used for a certain bandwidth. With these new flags, we can perform regulatory and chandef validation just as we would for VHT. To deal with the notion that S1G PHYs may contain a 2MHz primary channel, introduce a new variable, s1g_primary_2mhz, which indicates whether we are operating on a 2MHz primary channel. In this case, the chandef::chan points to the 1MHz primary channel pointed to by the primary channel location. Alongside this, introduce some new helper routines that can extract the sibling 1MHz channel. The sibling being the alternate 1MHz primary subchannel within the 2MHz primary channel that is not pointed to by chandef::chan. Furthermore, due to unique restrictions imposed on S1G PHYs, introduce a new flag, IEEE80211_CHAN_S1G_NO_PRIMARY, which states that the 1MHz channel cannot be used as a primary channel. This is assumed to be set by vendors as it is hardware and regdom specific, When we validate a 2MHz primary channel, we need to ensure both 1MHz subchannels do not contain this flag. If one or both of the 1MHz subchannels contain this flag then the 2MHz primary is not permitted for use as a primary channel. Properly integrate S1G channel validation such that it is implemented according with other PHY types such as VHT. Additionally, implement a new S1G-specific regulatory flag to allow cfg80211 to understand specific vendor requirements for S1G PHYs. Signed-off-by: Arien Judge Signed-off-by: Andrew Pope Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250918051913.500781-2-lachlan.hodges@morsemicro.com [remove redundant NL80211_ATTR_S1G_PRIMARY_2MHZ check] Signed-off-by: Johannes Berg commit 5aea4096380f5b14e3c0345bdafc291e9ae6d8d1 Author: Oliver Upton Date: Thu Sep 18 09:55:05 2025 -0700 KVM: arm64: nv: Allow userspace to de-feature stage-2 TGRANs KVM advertises the stage-2 TGRAN fields as writable to userspace but prevents any modification for NV-enabled VMs. Update the special-cased sanitization to permit de-featuring a particular TGRAN without allowing the legacy value which refers to the stage-1 field for support. Reported-by: Itaru Kitayama Signed-off-by: Oliver Upton Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit ccdc96fa0ed888e89e617fffdd5c11915568d7a0 Author: Sarika Sharma Date: Thu Sep 18 09:38:46 2025 +0530 wifi: mac80211: remove tx_handlers_drop debugfs stats Commit 906a5a8c7152 ("wifi: mac80211: add tx_handlers_drop statistics to ethtool") added a tx_handlers_drop counter to ethtool stats. During review [1], Johannes noted that the existing debugfs counter is now redundant. Remove the debugfs stat to avoid duplication and streamline statistics reporting. Link: https://lore.kernel.org/linux-wireless/ce5f2bd899caa2de32f36ce554d9cada073979c0.camel@sipsolutions.net/ # [1] Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250918040846.4032734-1-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 872e397d62a67843ea09cf6641819cb1a7e5ee98 Author: pengdonglin Date: Tue Sep 16 12:47:31 2025 +0800 wifi: mac80211: Remove redundant rcu_read_lock/unlock() in spin_lock Since commit a8bb74acd8efe ("rcu: Consolidate RCU-sched update-side function definitions") there is no difference between rcu_read_lock(), rcu_read_lock_bh() and rcu_read_lock_sched() in terms of RCU read section and the relevant grace period. That means that spin_lock(), which implies rcu_read_lock_sched(), also implies rcu_read_lock(). There is no need no explicitly start a RCU read section if one has already been started implicitly by spin_lock(). Simplify the code and remove the inner rcu_read_lock() invocation. Cc: Johannes Berg Signed-off-by: pengdonglin Signed-off-by: pengdonglin Link: https://patch.msgid.link/20250916044735.2316171-11-dolinux.peng@gmail.com Signed-off-by: Johannes Berg commit ff37a41db8b47834b747b3bb427825fc75bc86a7 Author: Oliver Upton Date: Thu Sep 18 09:46:31 2025 -0700 KVM: arm64: nv: Treat AMO as 1 when at EL2 and {E2H,TGE} = {1, 0} SErrors are not deliverable at EL2 when the effective value of HCR_EL2.{TGE,AMO} = {0, 0}. This is bothersome to deal with in nested as we need to use auxiliary pending state to track the pending vSError since HCR_EL2.VSE has no mechanism for honoring the guest HCR. On top of that, we have no way of making that auxiliary pending state visible in ISR_EL1. A defect against the architecture now allows an implementation to treat HCR_EL2.AMO as 1 when HCR_EL2.{E2H,TGE} = {1, 0}. Let's do exactly that, meaning SErrors are always deliverable at EL2 for the typical E2H=RES1 VM. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a37a6f54439bf82b827a7072415d3a4afa4e12bd Author: Ilan Peer Date: Mon Sep 8 14:13:08 2025 +0300 wifi: mac80211_hwsim: Add simulation support for NAN device Add support for simulating a NAN Device interface: - Update interface limits to include support for NAN Device. - Increase the number of supported HW addresses to allow unique addresses for combination such as: station interface + P2P Device interface + NAN Device interface. - Declare support for NAN capabilities, specifically support for NAN synchronization offload and NAN DE user space support. - Add the relevant callbacks to support start/stop NAN Device operation. - Use a timer to simulate starting a Discovery Window (currently the timer doesn't do much). - Update the Tx path to simulate that the channel used for NAN Device is either channel 6 or channel 149. - Send DW notification when DW starts. - Send cluster join notification when new cluster starts, or when an existing cluster is joined. "Joining" is implemented by reusing the cluster id of any other existing NAN management interface. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.2d02d5be6468.I3badfdb80c29e7713bd37373650ccbf099547a59@changeid Signed-off-by: Johannes Berg commit 1d04fad3a495062a33940278536c15a29d0f0dbb Author: Ilan Peer Date: Mon Sep 8 14:13:07 2025 +0300 wifi: mac80211: Extend support for changing NAN configuration As 'struct cfg80211_nan_config' was updated, update the relevant logic to accommodate these changes. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.92b530ddaedf.I2b6d6f6074e25487303fde573ce764a64f87bdcd@changeid Signed-off-by: Johannes Berg commit 04f17cfea2442ef2ed01da7ba1f686a58a50048e Author: Ilan Peer Date: Mon Sep 8 14:13:06 2025 +0300 wifi: mac80211: Export an API to check if NAN is started So it can be used by drivers to check if NAN Device interface is started or not. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.c69652f77eb6.Ie4f3d197e0706e742e3d97614fadc11b22adfbc6@changeid Signed-off-by: Johannes Berg commit c7b5355b37a59c927b2374e9f783acd004d00960 Author: Ilan Peer Date: Mon Sep 8 14:13:05 2025 +0300 wifi: mac80211: Get the correct interface for non-netdev skb status The function ieee80211_sdata_from_skb() always returned the P2P Device interface in case the skb was not associated with a netdev and didn't consider the possibility that an NAN Device interface is also enabled. To support configurations where both P2P Device and a NAN Device interface are active, extend the function to match the correct interface based on address 2 in the 802.11 MAC header. Since the 'p2p_sdata' field in struct ieee80211_local is no longer needed, remove it. Signed-off-by: Ilan Peer Reviewed-by: Andrei Otcheretianski Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.5252d2579a49.Id4576531c6b2ad83c9498b708dc0ade6b0214fa8@changeid Signed-off-by: Johannes Berg commit 8f79d2f13dd3b0af00a5303d4ff913767dd7684e Author: Ilan Peer Date: Mon Sep 8 14:13:04 2025 +0300 wifi: mac80211: Track NAN interface start/stop In case that NAN is started, mark the device as non idle, and set LED triggering similar to scan and ROC. Set the device to idle once NAN is stopped. Signed-off-by: Ilan Peer Reviewed-by: Andrei Otcheretianski Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.2711d62fce22.I9b9f826490e50967a66788d713b0eba985879873@changeid Signed-off-by: Johannes Berg commit 488d2e0bba65257cd0e723c413f02a9caf95b27c Author: Ilan Peer Date: Mon Sep 8 14:13:03 2025 +0300 wifi: mac80211: Accept management frames on NAN interface Accept Public Action frames and Authentication frames on NAN Device interface to support flows that require these frames: - SDFs: For user space Discovery Engine (DE) implementation. - NAFs: For user space NAN Data Path (NDP) establishment. - Authentication frames: For NAN Pairing and Verification. Accept only frames from devices that are part of the NAN cluster. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.46528d69e881.Ifccd87fb2a49a3af05238f74f52fa6da8de28811@changeid Signed-off-by: Johannes Berg commit fc41f4a28ac4d462487903229494eeb266f68a40 Author: Ilan Peer Date: Mon Sep 8 14:13:02 2025 +0300 wifi: mac80211: Support Tx of action frame for NAN Add support for sending management frame over a NAN Device interface: - Declare support for the supported management frames types. - Since action frame transmissions over a NAN Device interface do not necessarily require a channel configuration, e.g., they can be transmitted during DW, modify the Tx path to avoid accessing channel information for NAN Device interface. - In addition modify the points in the Tx path logic to account for cases that a band is not specified in the Tx information. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.23b160089228.I65a58af753bcbcfb5c4ad8ef372d546f889725ba@changeid Signed-off-by: Johannes Berg commit 1884e2594b084a6b1eb438e5eda586f284d80fee Author: Ilan Peer Date: Mon Sep 8 14:13:01 2025 +0300 wifi: cfg80211: Store the NAN cluster ID When the driver indicates that the device has joined a cluster, store the cluster ID. This is needed for data path operations, e.g., filtering received frames etc. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.63e9fef2a3aa.I6c858185c9e71f84bd2c5174d7ee45902b4391c3@changeid Signed-off-by: Johannes Berg commit 78e3bd0133f1981755fd0372013a77819e22c825 Author: Ilan Peer Date: Mon Sep 8 14:13:00 2025 +0300 wifi: cfg80211: Support Tx/Rx of action frame for NAN Add support for sending and receiving action frames over a NAN Device interface: - For Synchronized NAN operation NAN Service Discovery Frames (SDFs) and NAN Action Frames (NAFs) transmissions over a NAN Device interface, a channel parameter is not mandatory as the frame can be transmitted based on the NAN Device schedule. - For Unsynchronized NAN Discovery (USD) operation the SDFs and NAFs could be transmitted using NL80211_CMD_FRAME where a specific channel and dwell time are configured. As Synchronized NAN Operation and USD can be done concurrently, both modes need to be supported. Thus, allow sending NAN action frames when user space handles the NAN Discovery Engine (DE) with and without providing a channel as a parameter. To support reception of NAN Action frames and Authentication frames (used for NAN paring and verification) allow to register for management frame reception of NAN Device interface when user space handles the NAN DE. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.71da2b062929.I0166d51dcf14393f628cd5da366c21114f518618@changeid Signed-off-by: Johannes Berg commit b9c3d426c8a5823b3a1e5078719750c6abb0d2c1 Author: Ilan Peer Date: Mon Sep 8 14:12:59 2025 +0300 wifi: cfg80211: Advertise supported NAN capabilities Allow drivers to specify the supported NAN capabilities and support advertising the NAN capabilities to user space. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.2976966556f5.Ic6e43b10049573180c909dad806f279cfb31143e@changeid Signed-off-by: Johannes Berg commit 3cbadd84f5c4ea792c0df3506639a2cb57ba9b11 Author: Andrei Otcheretianski Date: Mon Sep 8 14:12:58 2025 +0300 wifi: nl80211: Add more NAN capabilities Add better break down for NAN capabilities, as NAN has multiple optional features. This allows to better indicate which features are supported or or offloaded to the device. Signed-off-by: Andrei Otcheretianski Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.bb02cd8c1596.I01fb2e8dc3662b847f3c27117bc4e199fc96d0a3@changeid Signed-off-by: Johannes Berg commit 1ccfd8db34fb3b1852284668094d7207499c2415 Author: Andrei Otcheretianski Date: Mon Sep 8 14:12:57 2025 +0300 wifi: cfg80211: Add cluster joined notification APIs The drivers should notify upper layers and user space when a NAN device joins a cluster. This is needed, for example, to set the correct addr3 in SDF frames. Add API to report cluster join event. Signed-off-by: Andrei Otcheretianski Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.ad27b7b6e4d9.I70b213a2a49f18d1ba2ad325e67e8eff51cc7a1f@changeid Signed-off-by: Johannes Berg commit ba9b2ceaa2558a38a5da59fd654b641610a8568e Author: Andrei Otcheretianski Date: Mon Sep 8 14:12:56 2025 +0300 wifi: nl80211: Add NAN Discovery Window (DW) notification This notification will be used by the device to inform user space about upcoming DW. When received, user space will be able to prepare multicast Service Discovery Frames (SDFs) to be transmitted during the next DW using %NL80211_CMD_FRAME command on the NAN management interface. The device/driver will take care to transmit the frames in the correct timing. This allows to implement a synchronized Discovery Engine (DE) in user space, if the device doesn't support DE offload. Note that this notification can be sent before the actual DW starts as long as the driver/device handles the actual timing of the SDF transmission. Signed-off-by: Andrei Otcheretianski Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.0e1d15031bab.I5b1721e61b63910452b3c5cdcdc1e94cb094d4c9@changeid Signed-off-by: Johannes Berg commit 01b4a3061b1d4ded108e1a700b4414c00662954c Author: Andrei Otcheretianski Date: Mon Sep 8 14:12:55 2025 +0300 wifi: nl80211: Add more configuration options for NAN commands Current NAN APIs have only basic configuration for master preference and operating bands. Add and parse additional parameters which provide more control over NAN synchronization. The newly added attributes allow to publish additional NAN attributes and vendor elements in NAN beacons, control scan and discovery beacons periodicity, enable/disable DW notifications etc. Signed-off-by: Andrei Otcheretianski tested: Miriam Rachel Korenblit Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908140015.a4779492bf8e.I375feb919bd72358173766b9fe10010c40796b33@changeid Signed-off-by: Johannes Berg commit 4f8ea79acde7a0610646189ef66ea4f46661e48d Merge: f2cdc4c22bca57 b36d55610215a9 Author: Johannes Berg Date: Fri Sep 19 11:23:24 2025 +0200 Merge tag 'mt76-next-2025-09-15' of https://github.com/nbd168/wireless Felix Fietkau says: =================== mt76 patches for 6.18 - fixes - mt7996 MLO support - mt7996 hw restart improvements =================== Signed-off-by: Johannes Berg commit d02c2e45b1e7767b177f6854026e4ad0d70b4a4d Author: Suzuki K Poulose Date: Thu Sep 18 13:56:18 2025 +0100 arm64: acpi: Enable ACPI CCEL support Add support for ACPI CCEL by handling the EfiACPIMemoryNVS type memory. As per UEFI specifications NVS memory is reserved for Firmware use even after exiting boot services. Thus map the region as read-only. Cc: Sami Mujawar Cc: Will Deacon Cc: Catalin Marinas Cc: Aneesh Kumar K.V Cc: Steven Price Cc: Sudeep Holla Cc: Gavin Shan Reviewed-by: Gavin Shan Tested-by: Sami Mujawar Signed-off-by: Suzuki K Poulose Signed-off-by: Will Deacon commit 9e8a3df3e7f762966762a6fbf3282b9da2074127 Author: Suzuki K Poulose Date: Thu Sep 18 13:56:17 2025 +0100 arm64: Enable EFI secret area Securityfs support Enable EFI COCO secrets support. Provide the ioremap_encrypted() support required by the driver. Cc: Sami Mujawar Cc: Will Deacon Cc: Catalin Marinas Cc: Aneesh Kumar K.V Cc: Steven Price Reviewed-by: Gavin Shan Tested-by: Sami Mujawar Signed-off-by: Suzuki K Poulose Signed-off-by: Will Deacon commit fa84e534c3ec2904d8718a83180294f7b5afecc7 Author: Suzuki K Poulose Date: Thu Sep 18 13:56:16 2025 +0100 arm64: realm: ioremap: Allow mapping memory as encrypted For ioremap(), so far we only checked if it was a device (RIPAS_DEV) to choose an encrypted vs decrypted mapping. However, we may have firmware reserved memory regions exposed to the OS (e.g., EFI Coco Secret Securityfs, ACPI CCEL). We need to make sure that anything that is RIPAS_RAM (i.e., Guest protected memory with RMM guarantees) are also mapped as encrypted. Rephrasing the above, anything that is not RIPAS_EMPTY is guaranteed to be protected by the RMM. Thus we choose encrypted mapping for anything that is not RIPAS_EMPTY. While at it, rename the helper function __arm64_is_protected_mmio => arm64_rsi_is_protected to clearly indicate that this not an arm64 generic helper, but something to do with Realms. Cc: Sami Mujawar Cc: Will Deacon Cc: Catalin Marinas Cc: Aneesh Kumar K.V Cc: Steven Price Reviewed-by: Gavin Shan Reviewed-by: Steven Price Tested-by: Sami Mujawar Signed-off-by: Suzuki K Poulose Signed-off-by: Will Deacon commit 5bd5ab53e7b8c87908341accb3ad8da555d6b778 Author: Lu Baolu Date: Thu Sep 18 13:02:04 2025 +0800 iommu/vt-d: debugfs: Avoid dumping context command register The register-based cache invalidation interface is in the process of being replaced by the queued invalidation interface. The VT-d architecture allows hardware implementations with a queued invalidation interface to not implement the registers used for cache invalidation. Currently, the debugfs interface dumps the Context Command Register unconditionally, which is not reasonable. Remove it to avoid potential access to non-present registers. Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250917025051.143853-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 7d4e40410283cc8c404170d0787b8d2a2458e3a1 Author: Lu Baolu Date: Thu Sep 18 13:02:03 2025 +0800 iommu/vt-d: Removal of Advanced Fault Logging The advanced fault logging has been removed from the specification since v4.0. Linux doesn't implement advanced fault logging functionality, but it currently dumps the advanced logging registers through debugfs. Remove the dumping of these advanced fault logging registers through debugfs to avoid potential access to non-present registers. Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250917024850.143801-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 5ef7e24c742038a5d8c626fdc0e3a21834358341 Author: Lu Baolu Date: Thu Sep 18 13:02:02 2025 +0800 iommu/vt-d: PRS isn't usable if PDS isn't supported The specification, Section 7.10, "Software Steps to Drain Page Requests & Responses," requires software to submit an Invalidation Wait Descriptor (inv_wait_dsc) with the Page-request Drain (PD=1) flag set, along with the Invalidation Wait Completion Status Write flag (SW=1). It then waits for the Invalidation Wait Descriptor's completion. However, the PD field in the Invalidation Wait Descriptor is optional, as stated in Section 6.5.2.9, "Invalidation Wait Descriptor": "Page-request Drain (PD): Remapping hardware implementations reporting Page-request draining as not supported (PDS = 0 in ECAP_REG) treat this field as reserved." This implies that if the IOMMU doesn't support the PDS capability, software can't drain page requests and group responses as expected. Do not enable PCI/PRI if the IOMMU doesn't support PDS. Reported-by: Joel Granados Closes: https://lore.kernel.org/r/20250909-jag-pds-v1-1-ad8cba0e494e@kernel.org Fixes: 66ac4db36f4c ("iommu/vt-d: Add page request draining support") Cc: stable@vger.kernel.org Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250915062946.120196-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 4402e8f39d0bfff5c0a5edb5e1afe27a56545e11 Author: Lu Baolu Date: Thu Sep 18 13:02:01 2025 +0800 iommu/vt-d: Remove LPIG from page group response descriptor Bit 66 in the page group response descriptor used to be the LPIG (Last Page in Group), but it was marked as Reserved since Specification 4.0. Remove programming on this bit to make it consistent with the latest specification. Existing hardware all treats bit 66 of the page group response descriptor as "ignored", therefore this change doesn't break any existing hardware. Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250901053943.1708490-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 4c48101364301b14b236ace5a7e9de6b9ccd1950 Author: Yury Norov (NVIDIA) Date: Thu Sep 18 13:02:00 2025 +0800 iommu/vt-d: Drop unused cap_super_offset() The macro is unused. Drop the dead code. Signed-off-by: Yury Norov (NVIDIA) Link: https://lore.kernel.org/r/20250913015024.81186-1-yury.norov@gmail.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit fbe6070c73badca726e4ff7877320e6c62339917 Author: Vineeth Pillai (Google) Date: Thu Sep 18 13:01:59 2025 +0800 iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 75c02a037609f34db17e91be195cedb33b61bae0 Author: Seyediman Seyedarab Date: Thu Sep 18 13:01:58 2025 +0800 iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() snprintf() returns the number of bytes that would have been written, not the number actually written. Using this for offset tracking can cause buffer overruns if truncation occurs. Replace snprintf() with scnprintf() to ensure the offset stays within bounds. Since scnprintf() never returns a negative value, and zero is not possible in this context because 'bytes' starts at 0 and 'size - bytes' is DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the string literals used, the return value is always positive. An integer overflow is also completely out of reach here due to the small and fixed buffer size. The error check in latency_show_one() is therefore unnecessary. Remove it and make dmar_latency_snapshot() return void. Signed-off-by: Seyediman Seyedarab Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 54c67740fff7360b6607d02b8499d09b944b3fda Author: Vivek Pernamitta Date: Fri Sep 12 18:18:10 2025 +0530 bus: mhi: host: pci_generic: Set DMA mask for VFs VFs in devices like QDU100 are capable of accessing host memory up to 40 bits, compared to 32 bits used by PFs and other non-SR-IOV capable MHI devices. To support this, configure `dma_mask` independently for PFs and VFs, by introducing a new 'vf_dma_data_width' member in 'mhi_pci_dev_info' struct and set it to 40 for QDU100. Signed-off-by: Vivek Pernamitta [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-6-fa2f6ccd301b@quicinc.com commit eafedbc7c050c44744fbdf80bdf3315e860b7513 Author: Alice Ryhl Date: Fri Sep 19 06:42:07 2025 +0000 rust_binder: add Rust Binder driver We're generally not proponents of rewrites (nasty uncomfortable things that make you late for dinner!). So why rewrite Binder? Binder has been evolving over the past 15+ years to meet the evolving needs of Android. Its responsibilities, expectations, and complexity have grown considerably during that time. While we expect Binder to continue to evolve along with Android, there are a number of factors that currently constrain our ability to develop/maintain it. Briefly those are: 1. Complexity: Binder is at the intersection of everything in Android and fulfills many responsibilities beyond IPC. It has become many things to many people, and due to its many features and their interactions with each other, its complexity is quite high. In just 6kLOC it must deliver transactions to the right threads. It must correctly parse and translate the contents of transactions, which can contain several objects of different types (e.g., pointers, fds) that can interact with each other. It controls the size of thread pools in userspace, and ensures that transactions are assigned to threads in ways that avoid deadlocks where the threadpool has run out of threads. It must track refcounts of objects that are shared by several processes by forwarding refcount changes between the processes correctly. It must handle numerous error scenarios and it combines/nests 13 different locks, 7 reference counters, and atomic variables. Finally, It must do all of this as fast and efficiently as possible. Minor performance regressions can cause a noticeably degraded user experience. 2. Things to improve: Thousand-line functions [1], error-prone error handling [2], and confusing structure can occur as a code base grows organically. After more than a decade of development, this codebase could use an overhaul. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/android/binder.c?h=v6.5#n2896 [2]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/android/binder.c?h=v6.5#n3658 3. Security critical: Binder is a critical part of Android's sandboxing strategy. Even Android's most de-privileged sandboxes (e.g. the Chrome renderer, or SW Codec) have direct access to Binder. More than just about any other component, it's important that Binder provide robust security, and itself be robust against security vulnerabilities. It's #1 (high complexity) that has made continuing to evolve Binder and resolving #2 (tech debt) exceptionally difficult without causing #3 (security issues). For Binder to continue to meet Android's needs, we need better ways to manage (and reduce!) complexity without increasing the risk. The biggest change is obviously the choice of programming language. We decided to use Rust because it directly addresses a number of the challenges within Binder that we have faced during the last years. It prevents mistakes with ref counting, locking, bounds checking, and also does a lot to reduce the complexity of error handling. Additionally, we've been able to use the more expressive type system to encode the ownership semantics of the various structs and pointers, which takes the complexity of managing object lifetimes out of the hands of the programmer, reducing the risk of use-after-frees and similar problems. Rust has many different pointer types that it uses to encode ownership semantics into the type system, and this is probably one of the most important aspects of how it helps in Binder. The Binder driver has a lot of different objects that have complex ownership semantics; some pointers own a refcount, some pointers have exclusive ownership, and some pointers just reference the object and it is kept alive in some other manner. With Rust, we can use a different pointer type for each kind of pointer, which enables the compiler to enforce that the ownership semantics are implemented correctly. Another useful feature is Rust's error handling. Rust allows for more simplified error handling with features such as destructors, and you get compilation failures if errors are not properly handled. This means that even though Rust requires you to spend more lines of code than C on things such as writing down invariants that are left implicit in C, the Rust driver is still slightly smaller than C binder: Rust is 5.5kLOC and C is 5.8kLOC. (These numbers are excluding blank lines, comments, binderfs, and any debugging facilities in C that are not yet implemented in the Rust driver. The numbers include abstractions in rust/kernel/ that are unlikely to be used by other drivers than Binder.) Although this rewrite completely rethinks how the code is structured and how assumptions are enforced, we do not fundamentally change *how* the driver does the things it does. A lot of careful thought has gone into the existing design. The rewrite is aimed rather at improving code health, structure, readability, robustness, security, maintainability and extensibility. We also include more inline documentation, and improve how assumptions in the code are enforced. Furthermore, all unsafe code is annotated with a SAFETY comment that explains why it is correct. We have left the binderfs filesystem component in C. Rewriting it in Rust would be a large amount of work and requires a lot of bindings to the file system interfaces. Binderfs has not historically had the same challenges with security and complexity, so rewriting binderfs seems to have lower value than the rest of Binder. Correctness and feature parity ------------------------------ Rust binder passes all tests that validate the correctness of Binder in the Android Open Source Project. We can boot a device, and run a variety of apps and functionality without issues. We have performed this both on the Cuttlefish Android emulator device, and on a Pixel 6 Pro. As for feature parity, Rust binder currently implements all features that C binder supports, with the exception of some debugging facilities. The missing debugging facilities will be added before we submit the Rust implementation upstream. Tracepoints ----------- I did not include all of the tracepoints as I felt that the mechansim for making C access fields of Rust structs should be discussed on list separately. I also did not include the support for building Rust Binder as a module since that requires exporting a bunch of additional symbols on the C side. Original RFC Link with old benchmark numbers: https://lore.kernel.org/r/20231101-rust-binder-v1-0-08ba9197f637@google.com Co-developed-by: Wedson Almeida Filho Signed-off-by: Wedson Almeida Filho Co-developed-by: Matt Gilbride Signed-off-by: Matt Gilbride Acked-by: Carlos Llamas Acked-by: Paul Moore Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250919-rust-binder-v2-1-a384b09f28dd@google.com Signed-off-by: Greg Kroah-Hartman commit e8fe3f07a357c39d429e02ca34f740692d88967a Author: Oleg Nesterov Date: Tue Aug 19 18:10:13 2025 +0200 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) if list_empty(&m->req_list). However, if the pipe is full, we need to read more data and this used to work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer if the pipe is still full"). p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before the commit above) triggered the unnecessary wakeup. This wakeup calls p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() will notice EPOLLIN and schedule_work(&m->rq). This no longer happens after the optimization above, change p9_fd_request() to use p9_poll_mux() instead of only checking for EPOLLOUT. Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/ Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/ Co-developed-by: K Prateek Nayak Signed-off-by: K Prateek Nayak Signed-off-by: Oleg Nesterov Tested-by: K Prateek Nayak Message-ID: <20250819161013.GB11345@redhat.com> Signed-off-by: Dominique Martinet commit a9ee2c461e5c361545f0c45e9f149159ba369c64 Author: Dan Carpenter Date: Thu Sep 18 12:50:41 2025 +0300 tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails If copy_from_user() fails, the correct error code is -EFAULT, not -EINVAL. Signed-off-by: Dan Carpenter Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit b14bb2e7821bdd133afeb5e623fd6c5a2273ecf6 Author: Dan Carpenter Date: Thu Sep 18 12:50:26 2025 +0300 tee: qcom: prevent potential off by one read Re-order these checks to check if "i" is a valid array index before using it. This prevents a potential off by one read access. Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Dan Carpenter Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit aa1a0e93ed21a06acb7ca9d4a4a9fce75ea53d0c Author: Vivek Pernamitta Date: Fri Sep 12 18:18:09 2025 +0530 bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state Allow mhi_sync_power_up to handle SYS_ERR during power-up, reboot, or recovery. This is to avoid premature exit when MHI_PM_IN_ERROR_STATE is observed during above mentioned system states. To achieve this, treat SYS_ERR as a valid state and let its handler process the error and queue the next transition to Mission Mode instead of aborting early. Signed-off-by: Vivek Pernamitta [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-5-fa2f6ccd301b@quicinc.com commit 12543f4405887da9f3e401e708ca0ff796a7b866 Author: Vivek Pernamitta Date: Fri Sep 12 18:18:08 2025 +0530 bus: mhi: host: pci_generic: Reset QDU100 while the MHI driver is removed So, When the MHI driver is removed from the host side, it is essential to ensure a clean and stable recovery of the device. This commit introduces the following steps to achieve that: 1. Disable SR-IOV for any SR-IOV-enabled devices on the Physical Function. 2. Perform a SOC_RESET on the PF to fully reset the device. Disabling SR-IOV ensures all Virtual Functions (VFs) are properly shutdown, preventing issues during the reset process. The SOC_RESET guarantees that the PF is restored to a known good state. If soc_reset is not performed device at driver remove, device will be stuck in mission mode state and subsequent driver insert/power_up will not proceed further. Signed-off-by: Vivek Pernamitta [mani: reworded subject] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-4-fa2f6ccd301b@quicinc.com commit fd6e0509d0e86059f9a1c25b0b91ef5d0021701f Author: Vivek Pernamitta Date: Fri Sep 12 18:18:07 2025 +0530 bus: mhi: host: pci_generic: Add SRIOV support pci_sriov_configure_simple() will enable or disable SR-IOV for devices that don't require any specific PF setup before enabling SR-IOV. Signed-off-by: Vivek Pernamitta Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-3-fa2f6ccd301b@quicinc.com commit b4d01c5b9a9d2dc39f52be22809e845cc4c46f03 Author: Vivek Pernamitta Date: Fri Sep 12 18:18:06 2025 +0530 bus: mhi: host: pci_generic: Read SUBSYSTEM_VENDOR_ID for VF's to check status In SR-IOV enabled devices, reading the VF DEVICE/VENDOR ID register returns `FFFFh`, as specified in section 3.4.1.1 of the PCIe SR-IOV spec. To accurately determine device activity, read the PCIe VENDOR_ID of the Physical Function (PF) instead. Health check monitoring for Virtual Functions (VFs) has been disabled, since VFs are not physical functions and lack direct hardware control. This change prevents unnecessary CPU cycles from being consumed by VF health checks, which are both unintended and non-functional. Signed-off-by: Vivek Pernamitta Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-2-fa2f6ccd301b@quicinc.com commit a9e3d5a69cf8d1a73733c52f593a3f803f576391 Author: Vivek Pernamitta Date: Fri Sep 12 18:18:05 2025 +0530 bus: mhi: host: Add support for separate controller configurations for VF and PF Implement support for separate controller configurations for both Virtual Functions (VF) and Physical Functions (PF). This enhancement allows for more flexible and efficient management of resources. The PF takes on a supervisory role and will have bootup information such as SAHARA, DIAG, and NDB (for file system sync data, etc.). VFs can handle resources associated with the main data movement of the Function are available to the SI (system image) as per PCIe SRIOV spec (rev 0.9 1.Architectural overview) Signed-off-by: Vivek Pernamitta Reviewed-by: Krishna Chaitanya Chundru Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-1-fa2f6ccd301b@quicinc.com commit 07c7f4f4e9504da240ef68adfd95a1150d3a6fd4 Author: J. Neuschäfer Date: Thu Sep 18 12:58:44 2025 +0200 arm64: dts: allwinner: h313: Add Amediatech X96Q The X96Q is a set-top box with an H313 SoC, AXP305 PMIC, 1 or 2 GiB RAM, 8 or 16 GiB eMMC flash, 2x USB A, Micro-SD, HDMI, Ethernet, audio/video output, and infrared input. https://x96mini.com/products/x96q-tv-box-android-10-set-top-box Tested, works: - debug UART - status LED - USB ports in host mode - MicroSD - eMMC - recovery button hidden behind audio/video port - analog audio (line out) Does not work: - Ethernet (requires AC200 MFD/EPHY driver) - WLAN (requires out-of-tree XRadio driver) - analog video output (requires AC200 driver) - HDMI audio/video output Untested: - "OTG" USB port in device mode - built-in IR receiver - external IR receiver Table of regulators on the downstream kernel, for reference: vcc-5v 1 15 0 unknown 5000mV 0mA 5000mV 5000mV dcdca 0 0 0 unknown 900mV 0mA 0mV 0mV dcdcb 0 0 0 unknown 1350mV 0mA 0mV 0mV dcdcc 0 0 0 unknown 900mV 0mA 0mV 0mV dcdcd 0 0 0 unknown 1500mV 0mA 0mV 0mV dcdce 0 0 0 unknown 3300mV 0mA 0mV 0mV aldo1 0 0 0 unknown 3300mV 0mA 0mV 0mV aldo2 0 0 0 unknown 700mV 0mA 0mV 0mV aldo3 0 0 0 unknown 700mV 0mA 0mV 0mV bldo1 0 0 0 unknown 1800mV 0mA 0mV 0mV bldo2 0 0 0 unknown 1800mV 0mA 0mV 0mV bldo3 0 0 0 unknown 700mV 0mA 0mV 0mV bldo4 0 0 0 unknown 700mV 0mA 0mV 0mV cldo1 0 0 0 unknown 2500mV 0mA 0mV 0mV cldo2 0 0 0 unknown 700mV 0mA 0mV 0mV cldo3 0 0 0 unknown 700mV 0mA 0mV 0mV Signed-off-by: J. Neuschäfer Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250918-x96q-v2-2-51bd39928806@posteo.net Signed-off-by: Chen-Yu Tsai commit f9d3206506b4db2711eca0f6b3d9dc621cc1e650 Author: J. Neuschäfer Date: Thu Sep 18 12:58:43 2025 +0200 dt-bindings: arm: sunxi: Add Amediatech X96Q The X96Q is a set-top box with an H313 SoC, AXP305 PMIC, 1 or 2 GiB RAM, 8 or 16 GiB eMMC flash, 2x USB A, Micro-SD, HDMI, Ethernet, audio/video output, and infrared input. https://x96mini.com/products/x96q-tv-box-android-10-set-top-box Reviewed-by: Andre Przywara Acked-by: Rob Herring (Arm) Signed-off-by: J. Neuschäfer Link: https://patch.msgid.link/20250918-x96q-v2-1-51bd39928806@posteo.net Signed-off-by: Chen-Yu Tsai commit 748f41f353e216814fa7a53aca792effea8f1435 Merge: 124076705c008a 65805c2ed74ee4 Author: Dave Airlie Date: Fri Sep 19 12:59:29 2025 +1000 Merge tag 'drm-intel-next-2025-09-12' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Cross-subsystem Changes: - Overflow: add range_overflows and range_end_overflows (Jani) Core Changes: - Get rid of dev->struct_mutex (Luiz) Non-display related: - GVT: Remove redundant ternary operators (Liao) - Various i915_utils clean-ups (Jani) Display related: - Wait PSR idle before on dsb commit (Jouni) - Fix size for for_each_set_bit() in abox iteration (Jani) - Abstract figuring out encoder name (Jani) - Remove FBC modulo 4 restriction for ADL-P+ (Uma) - Panic: refactor framebuffer allocation (Jani) - Backlight luminance control improvements (Suraj, Aaron) - Add intel_display_device_present (Jani) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aMxX_lBxm7wd5wmi@intel.com commit 3e6339a19cfc93bd3fec2179a2e766ab1cf39e16 Author: Liu Ying Date: Wed Aug 6 16:41:21 2025 +0800 drm/bridge: waveshare-dsi: Fix bailout for devm_drm_bridge_alloc() devm_drm_bridge_alloc() returns ERR_PTR on failure instead of a NULL pointer, so use IS_ERR() to check the returned pointer and turn proper error code on failure by using PTR_ERR(). Fixes: dbdea37add13 ("drm: bridge: Add waveshare DSI2DPI unit driver") Signed-off-by: Liu Ying Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250806084121.510207-1-victor.liu@nxp.com commit 124076705c008abe23225798b6ff418914d5c134 Merge: 6f17ab9a63e670 0265d0ebb409a2 Author: Dave Airlie Date: Fri Sep 19 12:50:22 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-09-18' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: pixpaper: - Fix mode_valid function signature Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250918064558.GA10017@linux.fritz.box commit a8fed1bc03ace27902338e4f0d318335883ac847 Author: Aleksa Paunovic Date: Thu Jul 24 17:23:26 2025 +0200 riscv: Add xmipsexectl as a vendor extension Add support for MIPS vendor extensions. Add support for the xmipsexectl vendor extension. Signed-off-by: Aleksa Paunovic Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-2-a6cbbe1c3412@htecgroup.com [pjw@kernel.org: added the MIPS vendor ID from another patch to fix the build] Signed-off-by: Paul Walmsley commit f79671dc87b6cea78dbe429969eb5549fca1bcc1 Author: Aleksa Paunovic Date: Thu Jul 24 17:23:25 2025 +0200 dt-bindings: riscv: Add xmipsexectl ISA extension description The xmipsexectl extension is described in the MIPS RV64 P8700/P8700-F Multiprocessing System Programmer’s Guide linked at [1]. Link: https://mips.com/wp-content/uploads/2025/06/P8700_Programmers_Reference_Manual_Rev1.84_5-31-2025.pdf Signed-off-by: Aleksa Paunovic Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250724-p8700-pause-v5-1-a6cbbe1c3412@htecgroup.com Signed-off-by: Paul Walmsley commit 8cd189e414bb705312fbfff7f7b5605f6de2459a Author: KP Singh Date: Sun Sep 14 23:51:36 2025 +0200 bpf: Move the signature kfuncs to helpers.c No functional changes, except for the addition of the headers for the kfuncs so that they can be used for signature verification. Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-8-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit ea2e6467ac36bf3d785defc89e58269b15d182f7 Author: KP Singh Date: Sun Sep 14 23:51:35 2025 +0200 bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD Currently only array maps are supported, but the implementation can be extended for other maps and objects. The hash is memoized only for exclusive and frozen maps as their content is stable until the exclusive program modifies the map. This is required for BPF signing, enabling a trusted loader program to verify a map's integrity. The loader retrieves the map's runtime hash from the kernel and compares it against an expected hash computed at build time. Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-7-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 6c850cbca82c2d20bc1b1c5e0e1c25c515292abd Author: KP Singh Date: Sun Sep 14 23:51:34 2025 +0200 selftests/bpf: Add tests for exclusive maps Check if access is denied to another program for an exclusive map Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-6-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 567010a5478ff4cbf1f14a01fa03cb50f68ac354 Author: KP Singh Date: Sun Sep 14 23:51:33 2025 +0200 libbpf: Support exclusive map creation Implement setters and getters that allow map to be registered as exclusive to the specified program. The registration should be done before the exclusive program is loaded. Signed-off-by: KP Singh Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250914215141.15144-5-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit c297fe3e9f9917e8bfd569442290736a551bfc60 Author: KP Singh Date: Sun Sep 14 23:51:32 2025 +0200 libbpf: Implement SHA256 internal helper Use AF_ALG sockets to not have libbpf depend on OpenSSL. The helper is used for the loader generation code to embed the metadata hash in the loader program and also by the bpf_map__make_exclusive API to calculate the hash of the program the map is exclusive to. Acked-by: Andrii Nakryiko Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-4-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit baefdbdf6812e120c9fba9cfb101d3656f478026 Author: KP Singh Date: Sun Sep 14 23:51:31 2025 +0200 bpf: Implement exclusive map creation Exclusive maps allow maps to only be accessed by program with a program with a matching hash which is specified in the excl_prog_hash attr. For the signing use-case, this allows the trusted loader program to load the map and verify the integrity Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-3-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 603b4416232524dafde8e2cf859788dae786dea1 Author: KP Singh Date: Sun Sep 14 23:51:30 2025 +0200 bpf: Update the bpf_prog_calc_tag to use SHA256 Exclusive maps restrict map access to specific programs using a hash. The current hash used for this is SHA1, which is prone to collisions. This patch uses SHA256, which is more resilient against collisions. This new hash is stored in bpf_prog and used by the verifier to determine if a program can access a given exclusive map. The original 64-bit tags are kept, as they are used by users as a short, possibly colliding program identifier for non-security purposes. Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20250914215141.15144-2-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit 2e2cf5581fccc562f7faf174ffb9866fed5cafbd Author: Clément Léger Date: Tue May 27 12:00:00 2025 +0200 riscv: cpufeature: add validation for zfa, zfh and zfhmin These extensions depends on the F one. Add a validation callback checking for the F extension to be present. Now that extensions are correctly reported using the F/D presence, we can remove the has_fpu() check in hwprobe_isa_ext0(). Signed-off-by: Clément Léger Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250527100001.33284-1-cleger@rivosinc.com Signed-off-by: Paul Walmsley commit 568a2fa10dd06bbd8160e3f8cce9483fabcb7121 Author: Yunhui Cui Date: Mon Aug 4 10:51:10 2025 +0800 perf: riscv: skip empty batches in counter start Avoid unnecessary SBI calls when starting non-overflowed counters in pmu_sbi_start_ovf_ctrs_sbi() by checking ctr_start_mask. Signed-off-by: Yunhui Cui Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250804025110.11088-1-cuiyunhui@bytedance.com Signed-off-by: Paul Walmsley commit f68cd7ddd014b60451922207bff2ea3beea0d8cb Author: Bala-Vignesh-Reddy Date: Fri Aug 15 23:37:24 2025 +0530 selftests: riscv: Add README for RISC-V KSelfTest Add a README file for RISC-V specific kernel selftests under tools/testing/selftests/riscv/. This mirrors the existing README for arm64, providing clear guidance on how the tests are architecture specific and skipped on non-riscv systems. It also includes standard make commands for building, running and installing the tests, along with a reference to general kselftest documentation. Signed-off-by: Bala-Vignesh-Reddy Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250815180724.14459-1-reddybalavignesh9979@gmail.com Signed-off-by: Paul Walmsley commit 19e73f65940d3d3357c637f3d7e19a59305a748f Author: Takashi Sakamoto Date: Fri Sep 19 08:54:48 2025 +0900 firewire: core: minor code refactoring to delete useless local variable The do_reset local variable has less merit. Let's remove it. Link: https://lore.kernel.org/r/20250918235448.129705-7-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 9192c37929ff26eae7ab4e82ddb4af54ed73c6e2 Author: Takashi Sakamoto Date: Fri Sep 19 08:54:47 2025 +0900 firewire: core; eliminate pick_me goto label This commit uses condition statements instead of pick_me goto label. Link: https://lore.kernel.org/r/20250918235448.129705-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 4ff62194d3739c8c7c2d2f365cbc069753387d79 Author: Takashi Sakamoto Date: Fri Sep 19 08:54:46 2025 +0900 firewire: core: code refactoring to split contention procedure for bus manager The precedure to contend for bus manager has much code. It is better to split it into a helper function. This commit refactors in the point. Link: https://lore.kernel.org/r/20250918235448.129705-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit e31b990cafd49a8c56eac55094c1a783f5826b47 Author: Takashi Sakamoto Date: Fri Sep 19 08:54:45 2025 +0900 firewire: core: code refactoring for the case of generation mismatch Current implementation stores the bus generation at which the bus manager contending procedure finishes. The condition for the procedure is the mismatch of the stored generation against current bus generation. This commit refactors the code for the contending procedure. Two existing branches are put into a new branch to detect the generation mismatch, thus the most of change is indentation. Link: https://lore.kernel.org/r/20250918235448.129705-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 52561ebfae9dc9871d6ca2c9e72a4a4e246c4476 Author: Takashi Sakamoto Date: Fri Sep 19 08:54:44 2025 +0900 firewire: core: use switch statement to evaluate transaction result to CSR_BUS_MANAGER_ID The result of the lock transaction to swap bus manager on isochronous resource manager looks like an ad-hoc style. It is hard to read. This commit uses switch statement to evaluate the result. Link: https://lore.kernel.org/r/20250918235448.129705-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 182edc05b087f58245d5481e2d4adb231a45a903 Author: Takashi Sakamoto Date: Fri Sep 19 08:54:43 2025 +0900 firewire: core: remove useless generation check Two functions, fw_core_handle_bus_reset() and bm_work(), are serialized by a commit 3d91fd440cc7 ("firewire: core: disable bus management work temporarily during updating topology"). Therefore the generation member of fw_card is immutable in bm_work(). This commit removes useless generation check in bm_work(). Link: https://lore.kernel.org/r/20250918235448.129705-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 70ddf86d76c1a560095c397c01b0862fe302b500 Author: Andrew Davis Date: Wed Aug 13 10:18:55 2025 -0500 riscv: sbi: Switch to new sys-off handler API Kernel now supports chained power-off handlers. Use register_platform_power_off() that registers a platform level power-off handler. Legacy pm_power_off() will be removed once all drivers and archs are converted to the new sys-off API. Signed-off-by: Andrew Davis Tested-by: Alexandre Ghiti Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250813151855.105237-1-afd@ti.com Signed-off-by: Paul Walmsley commit dcdb05a43df9d2e40116a1ddd1460846bd98a6e0 Author: Maharaja Kennadyrajan Date: Tue Aug 12 16:47:08 2025 +0530 wifi: ath12k: Extend beacon miss handling for MLO non-AP STA Currently, ath12k_mac_handle_beacon_miss() does not handle the beacon miss for the MLO case. In MLO scenarios, the host fails to process the beacon miss because the vdev_id comparison in ath12k_mac_handle_beacon_miss_iter() does not match. This mismatch occurs since arvif always points to ahvif->deflink, which may not correspond to the actual vdev_id associated with the event. Fix this by retrieving arvif from vdev_id instead of ahvif->deflink which will work for both MLO and Non-MLO case. Also refactor the ath12k_mac_handle_beacon_miss(), by passing arvif directly instead of vdev_id and remove ath12k_mac_handle_beacon_miss_iter() which is no longer needed. ath12k_mac_handle_beacon_miss() is called from ath12k_roam_event() for WCN chipsets and ath12k_peer_sta_kickout_event() for QCN chipsets. So, refactor the ath12k_roam_event() to pass arvif instead vdev_id to the ath12k_mac_handle_beacon_miss() function to align with the ath12k_peer_sta_kickout_event() and change the rcu_read_lock() to guard(rcu)() in the same function ath12k_roam_event(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Co-developed-by: Aditya Kumar Singh Signed-off-by: Aditya Kumar Singh Signed-off-by: Maharaja Kennadyrajan Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250812111708.3686-4-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 9891fbd9d8ec1710215b3c1ce1a5e9b3f33b5c1f Author: Arulanbu Balusamy Date: Tue Aug 12 16:47:07 2025 +0530 wifi: ath12k: Add support to handle reason inactivity STA kickout event for QCN9274/IPQ5332 Currently, when the non-AP STA connected to the AP STA, and the AP STA goes down or becomes inactive without indication, firmware detects the beacon miss and sends the WMI event WMI_PEER_STA_KICKOUT_EVENTID with reason as INACTIVITY. The host driver handles this event as low ACK and reports it to the mac80211 driver. However, the expectation is that non-AP STA should be disconnected from AP STA instantly once it receives the STA kickout event with reason of inactivity. Trigger a disconnect from AP STA through beacon miss handling upon receiving non-AP STA peer kickout event with reason code inactivity. Replace the helper function ath12k_mac_get_ar_by_vdev_id() with ath12k_mac_get_arvif_by_vdev_id() due to the following reasons. 1. Check the station VIF type for handling the beacon miss. 2. Retrieve the proper ar from the arvif by checking the vdev_id with vdev_map and link_map lookup which is needed for the MLO case in the following patch. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Co-developed-by: Ramya Gnanasekar Signed-off-by: Ramya Gnanasekar Signed-off-by: Arulanbu Balusamy Co-developed-by: Maharaja Kennadyrajan Signed-off-by: Maharaja Kennadyrajan Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250812111708.3686-3-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 59a2ef69ec1d0a754f9a229adee64c229f70ed36 Author: Maharaja Kennadyrajan Date: Tue Aug 12 16:47:06 2025 +0530 wifi: ath12k: enhance the WMI_PEER_STA_KICKOUT event with reasons and RSSI reporting Enhance the WMI_PEER_STA_KICKOUT event by adding support for reporting the kickout reason and RSSI value. The reason code will be used in the following patches when the beacon miss handling is added. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Maharaja Kennadyrajan Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250812111708.3686-2-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6af5bc381b36282bb90c649c1edcc3396a6cba99 Author: Lingbo Kong Date: Tue Aug 12 11:00:36 2025 +0800 wifi: ath12k: report station mode per-chain signal strength Currently, command “iw wlan0 station dump” does not show per-chain signal strength. This is because ath12k does not handle the num_per_chain_rssi and rssi_avg_beacon reported by firmware to ath12k. To address this, update ath12k to send WMI_REQUEST_STATS_CMDID with the flag WMI_REQUEST_RSSI_PER_CHAIN_STAT to the firmware. Then, add logic to handle num_per_chain_rssi and rssi_avg_beacon in the ath12k_wmi_tlv_fw_stats_parse(), and assign the resulting per-chain signal strength to the chain_signal of struct station_info. After that, "iw dev xxx station dump" shows the correct per-chain signal strength. Such as: Station AA:BB:CC:DD:EE:FF (on wlan0) inactive time: 212 ms rx bytes: 10398 rx packets: 64 tx bytes: 4362 tx packets: 33 tx retries: 49 tx failed: 0 beacon loss: 0 beacon rx: 14 rx drop misc: 16 signal: -45 [-51, -46] dBm beacon signal avg: -44 dBm Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219751 Signed-off-by: Lingbo Kong Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250812030044.688-1-quic_lingbok@quicinc.com Signed-off-by: Jeff Johnson commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 Author: Loic Poulain Date: Tue Sep 2 16:32:25 2025 +0200 wifi: ath10k: Fix connection after GTK rekeying It appears that not all hardware/firmware implementations support group key deletion correctly, which can lead to connection hangs and deauthentication following GTK rekeying (delete and install). To avoid this issue, instead of attempting to delete the key using the special WMI_CIPHER_NONE value, we now replace the key with an invalid (random) value. This behavior has been observed with WCN39xx chipsets. Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1 Reported-by: Alexey Klimov Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org Signed-off-by: Loic Poulain Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Tested-by: Alexey Klimov # QRB2210 RB1 Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a Author: Baochen Qiang Date: Mon Aug 11 17:26:45 2025 +0800 wifi: ath10k: avoid unnecessary wait for service ready message Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") works around the failure in waiting for the service ready message by active polling. Note the polling is triggered after initial wait timeout, which means that the wait-till-timeout can not be avoided even the message is ready. A possible fix is to do polling once before wait as well, however this can not handle the race that the message arrives right after polling. So the solution is to do periodic polling until timeout. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") Reported-by: Paul Menzel Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782 Author: Matvey Kovalev Date: Wed Sep 17 22:20:01 2025 +0300 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7db88b962f06 ("wifi: ath11k: add firmware-2.bin support") Cc: stable@vger.kernel.org Signed-off-by: Matvey Kovalev Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250917192020.1340-1-matvey.kovalev@ispras.ru Signed-off-by: Jeff Johnson commit 900730dc4705dc78f9bf69c4c513ec018bffee37 Author: Rob Herring (Arm) Date: Wed Aug 13 16:49:32 2025 -0500 wifi: ath: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different for ath10k. "memory-region" is optional, so failed lookup is not an error. But then an error in of_address_to_resource() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250813214933.897486-1-robh@kernel.org Signed-off-by: Jeff Johnson commit 5b345471752701ccfcfa6e86e15d2cebc6e17343 Author: Arnd Bergmann Date: Fri Aug 8 17:18:00 2025 +0200 wifi: ath10k: remove gpio number assignment The leds-gpio traditionally takes a global gpio number in its platform data, but the number assigned here is not actually such a number but only meant to be used internally to this driver. As part of the kernel-wide cleanup of the old gpiolib interfaces, the 'gpio' number field is going away, so to keep ath10k building, move the assignment into a private structure instead. Signed-off-by: Arnd Bergmann Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250808151822.536879-17-arnd@kernel.org Signed-off-by: Jeff Johnson commit 2418fcf2006804425c12d85479b9ad17c4db5e90 Author: Liao Yuanhong Date: Tue Aug 12 15:52:58 2025 +0800 wifi: ath11k: Remove redundant semicolon Remove unnecessary semicolon. Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250812075259.6921-1-liaoyuanhong@vivo.com Signed-off-by: Jeff Johnson commit 8873edecb38888726ce411b32de91b96cf41bbdb Author: Baochen Qiang Date: Fri Aug 15 09:44:58 2025 +0800 wifi: ath12k: downgrade log level for CE buffer enqueue failure There are two rings involved in the Copy Engine (CE) receive path handling, the CE status (STS) ring and the CE destination (DST) ring. Each time CE hardware needs to send an event (e.g. WMI event) to host, CE hardware finds a buffer (to which the tail pointer (TP) points) in DST ring and fills it with payload, then hardware fills meta data in STS ring and fires interrupt to host. Please note the TP of DST ring is expected to be advanced by CE hardware before interrupting host. While handling the interrupt, host finds that DST ring buffers are used hence increases rx_buf_needed to record the number of buffers to be replenished. Note before that, host compares TP and head pointer (HP) of DST ring to see if there is available space. Normally rx_buf_needed simply equals available space. But sometimes CE hardware doesn't (for whatever reason) update TP timely, making the comparison fails, then enqueue is cancelled and a warning is logged. However even enqueue fails this time, rx_buf_needed still records the numbers of needed buffers. Later when TP gets updated correctly, the missing buffer will be eventually replenished. And there is no doubt on the late update, it always comes (or lots of such warnings should be seen). Since this won't cause any functional issue, downgrade logging level to avoid misleading. Compile tested only. Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-3-f955ddc3ba7a@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 43746f13fec67f6f223d64cfe96c095c9b468e70 Author: Baochen Qiang Date: Fri Aug 15 09:44:57 2025 +0800 wifi: ath12k: fix wrong logging ID used for CE ATH12K_DBG_AHB is used for CE logging which is not proper. Add ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it. Compile tested only. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 541a201e9f46c6633aa1a08df4ab17cc7c96bf89 Author: Baochen Qiang Date: Fri Aug 15 09:44:56 2025 +0800 wifi: ath11k: downgrade log level for CE buffer enqueue failure There are two rings involved in the Copy Engine (CE) receive path handling, the CE status (STS) ring and the CE destination (DST) ring. Each time CE hardware needs to send an event (e.g. WMI event) to host, CE hardware finds a buffer (to which the tail pointer (TP) points) in DST ring and fills it with payload, then hardware fills meta data in STS ring and fires interrupt to host. Please note the TP of DST ring is expected to be advanced by CE hardware before interrupting host. While handling the interrupt, host finds that DST ring buffers are used hence increases rx_buf_needed to record the number of buffers to be replenished. Note before that, host compares TP and head pointer (HP) of DST ring to see if there is available space. Normally rx_buf_needed simply equals available space. But sometimes CE hardware doesn't (for whatever reason) update TP timely, making the comparison fails, then enqueue is cancelled and a warning is logged: ath11k_pci 0000:02:00.0: failed to enqueue rx buf: -28 However even enqueue fails this time, rx_buf_needed still records the numbers of needed buffers. Later when TP gets updated correctly, the missing buffer will be eventually replenished. And there is no doubt on the late update, it always comes (or lots of such warnings should be seen). Since this won't cause any functional issue, downgrade logging level to avoid misleading. Compile tested only. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220269 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-1-f955ddc3ba7a@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 Author: Sriram R Date: Thu Jul 24 00:36:51 2025 +0530 wifi: ath12k: Add fallback for invalid channel number in PHY metadata Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency based on the channel number and center frequency from the RX descriptor's PHY metadata. However, in rare cases, it is observed that frequency retrieved from the metadata may be invalid or unexpected especially for 6 GHz frames. This can result in a NULL sband, which prevents proper frequency assignment in rx_status and potentially leading to incorrect RX packet classification. To fix this potential issue, add a fallback mechanism that uses ar->rx_channel to populate the band and frequency when the derived sband is invalid or missing. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Sriram R Co-developed-by: Vinith Kumar R Signed-off-by: Vinith Kumar R Signed-off-by: Aishwarya R Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 Author: Kang Yang Date: Tue Jul 22 17:59:34 2025 +0800 wifi: ath12k: fix the fetching of combined rssi Currently, host fetches combined rssi from rssi_comb in struct hal_rx_phyrx_rssi_legacy_info. rssi_comb is 8th to 15th bits of the second to last variable. rssi_comb_ppdu is the 0th to 7th of the last variable. When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth > 20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power of primary 20 MHz while rssi_comb_ppdu includes power of active RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu. Also related macro definitions are too long, rename them. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6b46e85129185ec076f9c3bd2813dfd2f968522b Author: Kang Yang Date: Tue Jul 22 17:59:33 2025 +0800 wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with struct hal_phyrx_common_user_info. Obviously, they do not match. The original intention here was to parse HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing HAL_PHYRX_COMMON_USER_INFO instead. Also add LTF parsing and report to radiotap along with GI. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit cf412ae7b7124e2b3bfe472616ec24b117b6008a Author: Kang Yang Date: Tue Jul 22 17:59:32 2025 +0800 wifi: ath12k: fix signal in radiotap for WCN7850 Currently host will add ATH12K_DEFAULT_NOISE_FLOOR to rssi_comb to convert RSSI from dB to dBm. For WCN7850, this conversion is unnecessary because the RSSI value is already reported in dBm units. No longer convert for those firmware that already support dBM conversion. This patch won't affect QCN chips. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250722095934.67-2-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 Author: Baochen Qiang Date: Mon Aug 4 11:03:11 2025 +0800 wifi: ath12k: fix overflow warning on num_pwr_levels In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is limited by ATH12K_NUM_PWR_LEVELS which is 16: if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; Then it is used to iterate entries in local_non_psd->power[] and reg_non_psd->power[]: for (i = 0; i < tpc_info->num_pwr_levels; i++) { tpc_info->tpe[i] = min(local_non_psd->power[i], reg_non_psd->power[i]) / 2; Since the two array are of size 5, Smatch warns: drivers/net/wireless/ath/ath12k/mac.c:9812 ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15 drivers/net/wireless/ath/ath12k/mac.c:9812 ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15 This is a false positive as there is already implicit limitation: tpc_info->num_pwr_levels = max(local_non_psd->count, reg_non_psd->count); meaning it won't exceed 5. However, to make robot happy, add explicit limit there. Also add the same to the PSD case, although no warning due to ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/ Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com Signed-off-by: Jeff Johnson commit bba2f9faf41ee9607c78fcd669527b7654543cfe Author: Baochen Qiang Date: Mon Aug 4 11:03:10 2025 +0800 wifi: ath12k: initialize eirp_power before use Currently, at the end of ath12k_mac_fill_reg_tpc_info(), the reg_tpc_info struct is populated, including the following: reg_tpc_info->is_psd_power = is_psd_power; reg_tpc_info->eirp_power = eirp_power; Kernel test robot complains on uninitialized symbol: drivers/net/wireless/ath/ath12k/mac.c:10069 ath12k_mac_fill_reg_tpc_info() error: uninitialized symbol 'eirp_power' This is because there are some code paths that never set eirp_power, so the assignment of reg_tpc_info->eirp_power can come from an uninitialized variable. Functionally this is OK since the eirp_power only has meaning when is_psd_power is true, and all code paths which set is_psd_power to true also set eirp_power. However, to keep the robot happy, always initialize eirp_power before use. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: aeda163bb0c7 ("wifi: ath12k: fill parameters for vdev set TPC power WMI command") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202505180927.tbNWr3vE-lkp@intel.com/ Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-1-56f1e54152ab@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 87a67cc357a8d01f244ae04284eac4c41c221e34 Author: Roopni Devanathan Date: Tue Aug 26 16:27:14 2025 +0530 wifi: ath12k: Add support to set per-radio RTS threshold Currently, command to set RTS threshold makes changes to the threshold of all radios in the multi-radio wiphy. But each radio in a multi-radio wiphy can have different RTS threshold requirements. To support this requirement, use the index of radio for which the RTS threshold needs to be changed from mac80211 - radio_idx. Based on the value passed, set the RTS threshold value for the corresponding radios. Following are the possible values of radio_idx and the corresponding behavior in multi-radio wiphys: 1. radio_idx is -1: consider RTS threshold as a global parameter, i.e., make changes to all the radios in a wiphy. If setting RTS threshold fails for any radio, then the previous RTS threshold values of respective radios will be restored. 2. radio_idx denotes a specific radio: make changes in RTS threshold to that radio alone. 3. radio_idx is any other number: report it as an invalid number. In case of single-radio wiphys, continue with the existing behavior, i.e., set the passed RTS threshold value to the radio present. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Roopni Devanathan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250826105714.1188131-1-quic_rdevanat@quicinc.com Signed-off-by: Jeff Johnson commit 315f423be0d1ebe720d8fd4fa6bed68586b13d34 Author: Daniel Machon Date: Wed Sep 17 13:49:43 2025 +0200 net: sparx5/lan969x: Add support for ethtool pause parameters Implement get_pauseparam() and set_pauseparam() ethtool operations for Sparx5 ports. This allows users to query and configure IEEE 802.3x pause frame settings via: ethtool -a ethX ethtool -A ethX rx on|off tx on|off autoneg on|off The driver delegates pause parameter handling to phylink through phylink_ethtool_get_pauseparam() and phylink_ethtool_set_pauseparam(). The underlying configuration of pause frame generation and reception is already implemented in the driver; this patch only wires it up to the standard ethtool interface, making the feature accessible to userspace. Signed-off-by: Daniel Machon Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250917-802-3x-pause-v1-1-3d1565a68a96@microchip.com Signed-off-by: Jakub Kicinski commit 6287982aa54946449bccff3e6488d3a15e458392 Author: Robert Marko Date: Wed Sep 17 13:00:24 2025 +0200 net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X LAN969x switchdev support depends on the SparX-5 core,so make it selectable for ARCH_LAN969X. Signed-off-by: Robert Marko Reviewed-by: Daniel Machon Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 5a26346e6250475038f4b23b5c9348dc8333e6e4 Author: Horatiu Vultur Date: Wed Sep 17 12:46:30 2025 +0200 net: phy: micrel: Add Fast link failure support for lan8842 Add support for fast link failure for lan8842, when this is enabled the PHY will detect link down immediately (~1ms). The disadvantage of this is that also small instability might be reported as link down. Therefore add this feature as a tunable configuration and the user will know when to enable or not. By default it is not enabled. Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250917104630.3931969-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 38c5b9c38be8303b536d0c15a5f955715bfba534 Merge: 60f887b1290b43 2ac207381c37ee Author: Jakub Kicinski Date: Thu Sep 18 15:47:34 2025 -0700 Merge tag 'mlx5-next-09-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-09-17 This series by Carolina contains cleanups significantly touching shared mlx5 net and rdma headers. * tag 'mlx5-next-09-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads net/mlx5: Refactor MACsec WQE metadata shifts net/mlx5: Remove VLAN insertion fields from WQE Ether segment ==================== Link: https://patch.msgid.link/1757574619-604874-1-git-send-email-tariqt@nvidia.com Link: https://patch.msgid.link/1758104780-642426-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 60f887b1290b43a4f5a3497982a725687b193fa4 Author: Oleksij Rempel Date: Wed Sep 17 11:47:51 2025 +0200 net: phy: clear link parameters on admin link down When a PHY is halted (e.g. `ip link set dev lan2 down`), several fields in struct phy_device may still reflect the last active connection. This leads to ethtool showing stale values even though the link is down. Reset selected fields in _phy_state_machine() when transitioning to PHY_HALTED and the link was previously up: - speed/duplex -> UNKNOWN, but only in autoneg mode (in forced mode these fields carry configuration, not status) - master_slave_state -> UNKNOWN if previously supported - mdix -> INVALID (state only, same meaning as "unknown") - lp_advertising -> always cleared The cleanup is skipped if the PHY is in PHY_ERROR state, so the last values remain available for diagnostics. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250917094751.2101285-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 97248adb5a3bda5e6e557930499a8afc31eeff5e Author: Vishnu Singh Date: Wed Sep 17 09:44:55 2025 +0530 net: ti: am65-cpsw: Update hw timestamping filter for PTPv1 RX packets CPTS module of CPSW supports hardware timestamping of PTPv1 packets.Update the "hwtstamp_rx_filters" of CPSW driver to enable timestamping of received PTPv1 packets. Also update the advertised capability to include PTPv1. Signed-off-by: Vishnu Singh Reviewed-by: Vadim Fedorenko Reviewed-by: MD Danish Anwar Link: https://patch.msgid.link/20250917041455.1815579-1-v-singh1@ti.com Signed-off-by: Jakub Kicinski commit bc7d3a0f92dad811110f5602f58fe756cefce2b8 Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:52 2025 +0300 power: supply: max77705_charger: use REGMAP_IRQ_REG_LINE macro Refactor regmap_irq declarations with REGMAP_IRQ_REG_LINE saves a few lines on definitions. Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit 12a1185a06e3377af777e792ba7436862f8e528a Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:51 2025 +0300 power: supply: max77705_charger: rework interrupts Current implementation uses handle_post_irq to actually handle chgin irq. This is not how things are meant to work in regmap-irq. Remove handle_post_irq, and request a threaded interrupt for chgin. Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit baedd8be7036233025527a78f209e34d03057872 Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:50 2025 +0300 power: supply: max77705_charger: add writable properties Add INPUT_CURRENT_LIMIT, CONSTANT_CHARGE_CURRENT properties as writeable to be able to control input power consumption and charging speed. Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit 55af7b9bb66c1cf796142f75a76914e2c3df5d06 Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:49 2025 +0300 power: supply: max77705_charger: return error when config fails Handle error, returned from register writes in init function. Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit ef1e734dbe257ce8bc42383b9977b5558f061288 Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:48 2025 +0300 power: supply: max77705_charger: use regfields for config registers Using regfields allows to cleanup masks and register offset definition, allowing to access register info by it's functional name. Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit d84510db8c1414b67167cdc452103c1f429588cc Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:47 2025 +0300 power: supply: max77705_charger: refactoring: rename charger to chg Rename struct max77705_charger_data variable to chg for consistency. Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit 3547a61ee2fe8f1fc46d4326a9517d97ae3614cd Merge: 6ff4a0fa3e1b2b 8b788d66386127 Author: Alexei Starovoitov Date: Thu Sep 18 15:36:17 2025 -0700 Merge branch 'update-kf_rcu_protected' Kumar Kartikeya Dwivedi says: ==================== Update KF_RCU_PROTECTED Currently, KF_RCU_PROTECTED only applies to iterator APIs and that too in a convoluted fashion: the presence of this flag on the kfunc is used to set MEM_RCU in iterator type, and the lack of RCU protection results in an error only later, once next() or destroy() methods are invoked on the iterator. While there is no bug, this is certainly a bit unintuitive, and makes the enforcement of the flag iterator specific. In the interest of making this flag useful for other upcoming kfuncs, e.g. scx_bpf_cpu_curr() [0][1], add enforcement for invoking the kfunc in an RCU critical section in general. In addition to this, the aforementioned kfunc also needs to return an RCU protected pointer, which currently has no generic kfunc flag or annotation. Add such a flag as well while we are at it. [0]: https://lore.kernel.org/all/20250903212311.369697-3-christian.loehle@arm.com [1]: https://lore.kernel.org/all/20250909195709.92669-1-arighi@nvidia.com Changelog: ---------- v2 -> v3 v2: https://lore.kernel.org/bpf/20250917032014.4060112-1-memxor@gmail.com * Add back lost hunk reworking documentation for KF_RCU_PROTECTED. v1 -> v2 v1: https://lore.kernel.org/bpf/20250915024731.1494251-1-memxor@gmail.com * Drop KF_RET_RCU and fold change into KF_RCU_PROTECTED. (Andrea, Alexei) * Update tests for non-struct pointer return values with KF_RCU_PROTECTED. ==================== Link: https://patch.msgid.link/20250917032755.4068726-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 8b788d663861271c10905b23195bc6ae862caad2 Author: Kumar Kartikeya Dwivedi Date: Wed Sep 17 03:27:55 2025 +0000 selftests/bpf: Add tests for KF_RCU_PROTECTED Add a couple of test cases to ensure RCU protection is kicked in automatically, and the return type is as expected. Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250917032755.4068726-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 1512231b6cc860ffbfbd85b295449dfb6977d357 Author: Kumar Kartikeya Dwivedi Date: Wed Sep 17 03:27:54 2025 +0000 bpf: Enforce RCU protection for KF_RCU_PROTECTED Currently, KF_RCU_PROTECTED only applies to iterator APIs and that too in a convoluted fashion: the presence of this flag on the kfunc is used to set MEM_RCU in iterator type, and the lack of RCU protection results in an error only later, once next() or destroy() methods are invoked on the iterator. While there is no bug, this is certainly a bit unintuitive, and makes the enforcement of the flag iterator specific. In the interest of making this flag useful for other upcoming kfuncs, e.g. scx_bpf_cpu_curr() [0][1], add enforcement for invoking the kfunc in an RCU critical section in general. This would also mean that iterator APIs using KF_RCU_PROTECTED will error out earlier, instead of throwing an error for lack of RCU CS protection when next() or destroy() methods are invoked. In addition to this, if the kfuncs tagged KF_RCU_PROTECTED return a pointer value, ensure that this pointer value is only usable in an RCU critical section. There might be edge cases where the return value is special and doesn't need to imply MEM_RCU semantics, but in general, the assumption should hold for the majority of kfuncs, and we can revisit things if necessary later. [0]: https://lore.kernel.org/all/20250903212311.369697-3-christian.loehle@arm.com [1]: https://lore.kernel.org/all/20250909195709.92669-1-arighi@nvidia.com Tested-by: Andrea Righi Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250917032755.4068726-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 8a760c454da263f4b5f0f557e26141b2a3186b40 Author: Emilio Perez Date: Mon Aug 18 03:31:21 2025 +0100 Documentation: PCI: Fix typos The PCIe spec uses "Requester ID", not "requestor ID". Follow the spec to avoid confusion. Signed-off-by: Emilio Perez [bhelgaas: capitalize as a hint that the spec defines this] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250818023121.33427-1-emiliopeju@gmail.com commit 2c618f361ae6b9da7fafafc289051728ef4c6ea3 Author: Christophe Leroy Date: Thu Sep 18 17:34:11 2025 +0200 ASoC: fsl: fsl_qmc_audio: Drop struct qmc_dai_chan prtd_tx and prtd_rx members are not used anymore and only qmc_chan member remains so struct qmc_dai_chan has become pointless. Use qmc_chan directly and drop struct qmc_dai_chan. Acked-by: Herve Codina Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/9c729bbd9f1b61120a09a87fb76176ef344c5153.1758209158.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit 4c5f8c25561f36407cb137d4c350651820068148 Author: Christophe Leroy Date: Thu Sep 18 17:34:10 2025 +0200 ASoC: fsl: fsl_qmc_audio: Only request completion on last channel In non-interleaved mode, several QMC channels are used in sync. More details can be found in commit 188d9cae5438 ("ASoC: fsl: fsl_qmc_audio: Add support for non-interleaved mode.") At the time being, an interrupt is requested on each channel to perform capture/playback completion, allthough the completion is really performed only once all channels have completed their work. This leads to a lot more interrupts than really needed. Looking at /proc/interrupts shows ~3800 interrupts per second when using 4 capture and 4 playback devices with 5ms periods while only 1600 (200 x 4 + 200 x 4) periods are processed during one second. The QMC channels work in sync, the one started first is the one finishing first and the one started last is the one finishing last, so when the last one finishes it is guaranteed that the other ones are finished as well. Therefore only request completion processing on the last QMC channel. On my board with the above exemple, on a kernel started with 'threadirqs' option, the QMC irq thread uses 16% CPU time with this patch while it uses 26% CPU time without this patch. Acked-by: Herve Codina Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/bbd5167d190bbb45c3a4cd6ef2dece8817e0cc1e.1758209158.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit fb418fe26d28378700bddc16f5fa3362dda86d1b Author: Christophe Leroy Date: Thu Sep 18 17:34:09 2025 +0200 ASoC: fsl: fsl_qmc_audio: Ensure audio channels are ordered in TDM bus To reduce complexity of interrupt handling in following patch, ensure audio channels are configured in the same order as timeslots on the TDM bus. If we need a given ordering of audio sources in the audio frame, it is possible to re-order codecs on the TDM bus, no need to mix up timeslots in channels. Acked-by: Herve Codina Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/4ff40afdf3d032b05dd4af6c0f777d4d4b445a76.1758209158.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit c2a60426e94a56e5329f6c2681c251281f63ab24 Author: Christophe Leroy Date: Thu Sep 18 17:34:08 2025 +0200 soc: fsl: qmc: Only set completion interrupt when needed When no post-completion processing is expected, don't waste time handling useless interrupts. Only set QMC_BD_[R/T]X_I when a completion function is passed in, and perform seamless completion on submit for interruptless buffers. Acked-by: Herve Codina Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/40b41b53a26e77a50b3a5f68fcecc6f9a40a84b4.1758209158.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit 46037455cbb748c5e85071c95f2244e81986eb58 Merge: c5dca38633daa1 f6ee24913de24d Author: Dave Jiang Date: Thu Sep 18 14:34:51 2025 -0700 Merge branch 'for-6.18/cxl-delay-dport' into cxl-for-next Add changes to delay the allocation and setup of dports until when the endpoint device is being probed. At this point, the CXL link is established from endpoint to host bridge. Addresses issues seen on some platforms when dports are probed earlier. Link: https://lore.kernel.org/linux-cxl/20250829180928.842707-1-dave.jiang@intel.com/ commit a96d68ea0ab7536c25a5304112484172a5acc803 Merge: ee6cd8f3e28ee5 c24928ac69be23 Author: Sebastian Reichel Date: Thu Sep 18 23:33:28 2025 +0200 Merge tag 'ib-max77705-for-v6.17-signed' Merge immutable branch between power-supply and MFD subsystem to move the regmap register update from the max77976 charger sub-device to the main MFD device. Signed-off-by: Sebastian Reichel commit f6ee24913de24dbda8d49213e1a27f5e1a5204cc Author: Dave Jiang Date: Thu Aug 14 15:21:44 2025 -0700 cxl: Move port register setup to when first dport appear This patch moves the port register setup to when the first dport appears via the memdev probe path. At this point, the CXL link should be established and the register access is expected to succeed. This change addresses an error message observed when PCIe hotplug is enabled on an Intel platform. The error messages "cxl portN: Couldn't locate the CXL.cache and CXL.mem capability array header" is observed for the host bridge (CHBCR) during cxl_acpi driver probe. If the cxl_acpi module probe is running before the CXL link between the endpoint device and the RP is established, then the platform may not have exposed DVSEC ID 3 and/or DVSEC ID 7 blocks which will trigger the error message. This behavior is defined by the CXL spec r3.2 9.12.3 for RPs and DSPs, however the Intel platform also added this behavior to the host bridge. This change also needs the dport enumeration to be moved to the memdev probe path in order to address the issue. This change is not a wholly contained solution by itself. [dj: Add missing var init during port alloc] Suggested-by: Dan Williams Reviewed-by: Jonathan Cameron Tested-by: Robert Richter Reviewed-by: Alison Schofield Reviewed-by: Ira Weiny Signed-off-by: Dave Jiang commit 7ee0f793d00d586bf01017a0a24308659873975c Author: Dario Binacchi Date: Thu Sep 18 17:36:09 2025 +0200 dt-bindings: touchscreen: convert zet6223 bindings to json schema Convert Zeitec ZET6223 touchscreen controller device tree binding to json-schema. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250918153630.2535208-4-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 7e52794b88f8bce684ffd7081279ac4236131ae1 Author: Dario Binacchi Date: Thu Sep 18 17:36:06 2025 +0200 dt-bindings: touchscreen: convert bu21013 bindings to json schema Convert Rohm BU21013 I2C touchscreen controller device tree binding to json-schema. Additional changes: - Replace -supply with avdd-supply to match example and existing DTS. - Add reset-gpios in the example because it is required. Signed-off-by: Dario Binacchi Reviewed-by: Krzysztof Kozlowski Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250918153630.2535208-1-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit c24928ac69be2390cdf456d126b464af079c57ef Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:46 2025 +0300 mfd: max77705: max77705_charger: move active discharge setting to mfd parent Active discharge setting is a part of MFD top level i2c device, hence cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1 register from charger driver is a mistake. Move active discharge setting to MFD parent driver. Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") Signed-off-by: Dzmitry Sankouski Acked-by: Lee Jones Signed-off-by: Sebastian Reichel commit a24802b0a2a238eaa610b0b0e87a4500a35de64a Author: Gabor Juhos Date: Tue Sep 16 19:43:46 2025 +0200 spi: spi-qpic-snand: simplify clock handling by using devm_clk_get_enabled() The devm_clk_get_enabled() function prepares and enables the particular clock, which then automatically gets disabled and unprepared on probe failure and on device removal. Use that function instead of devm_clk_get() and remove the clk_prepare_enable()/clk_disable_unprepare() calls in order to simplify the code. This also ensures that the clocks are handled in the correct order during device removal. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250916-qpic-snand-devm_clk_get_enabled-v1-1-09953493b7f1@gmail.com Signed-off-by: Mark Brown commit 0f67557763accbdd56681f17ed5350735198c57b Author: Haibo Chen Date: Wed Sep 17 15:27:10 2025 +0800 spi: spi-nxp-fspi: Add OCT-DTR mode support Add OCT-DTR mode support in default, since flexspi do not supports swapping bytes on a 16 bit boundary in OCT-DTR mode, so mark swap16 as false. lx2160a do not support DQS, so add a quirk to disable DTR mode for this platform. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Link: https://patch.msgid.link/20250917-flexspi-ddr-v2-5-bb9fe2a01889@nxp.com Signed-off-by: Mark Brown commit c07f270323175b83779c2c2b80b360ed476baec5 Author: Haibo Chen Date: Wed Sep 17 15:27:09 2025 +0800 spi: spi-nxp-fspi: add the support for sample data from DQS pad flexspi define four mode for sample clock source selection. Here is the list of modes: mode 0: Dummy Read strobe generated by FlexSPI Controller and loopback internally mode 1: Dummy Read strobe generated by FlexSPI Controller and loopback from DQS pad mode 2: Reserved mode 3: Flash provided Read strobe and input from DQS pad In default, flexspi use mode 0 after reset. And for DTR mode, flexspi only support 8D-8D-8D mode. For 8D-8D-8D mode, IC suggest to use mode 3, otherwise read always get incorrect data. For DTR mode, flexspi will automatically div 2 of the root clock and output to device. the formula is: device_clock = root_clock / (is_dtr ? 2 : 1) So correct the clock rate setting for DTR mode to get the max performance. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Link: https://patch.msgid.link/20250917-flexspi-ddr-v2-4-bb9fe2a01889@nxp.com Signed-off-by: Mark Brown commit 3c1000e15fd0eb387fcca420c9fb36ae07887782 Author: Haibo Chen Date: Wed Sep 17 15:27:08 2025 +0800 spi: spi-nxp-fspi: Add the DDR LUT command support For DTR mode, flexspi need to use DDR LUT command, flexspi will switch to DDR mode when detect the DDR LUT command. Reviewed-by: Frank Li Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250917-flexspi-ddr-v2-3-bb9fe2a01889@nxp.com Signed-off-by: Mark Brown commit a9888b3222ec73d055447a39cf9a0118f67497f4 Author: Haibo Chen Date: Wed Sep 17 15:27:07 2025 +0800 spi: spi-nxp-fspi: set back to dll override mode when clock rate < 100MHz Preparation of supportting DTR mode. In nor suspend, driver will disable DTR mode, and enable DTR mode back in nor resume. This require the flexspi driver has the ability to set back to dll override mode in STR mode when clock rate < 100MHz. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Link: https://patch.msgid.link/20250917-flexspi-ddr-v2-2-bb9fe2a01889@nxp.com Signed-off-by: Mark Brown commit 614180a54d5f21ccb4f60042d19744694d31d3f8 Author: Haibo Chen Date: Wed Sep 17 15:27:06 2025 +0800 spi: spi-nxp-fspi: extract function nxp_fspi_dll_override() Extract function nxp_fspi_dll_override(), this is the suggested setting when clock rate < 100MHz. Just the preparation of supportting DTR mode. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Link: https://patch.msgid.link/20250917-flexspi-ddr-v2-1-bb9fe2a01889@nxp.com Signed-off-by: Mark Brown commit 20253f806818e9a1657a832ebcf4141d0a08c02a Author: Varshini Rajendran Date: Mon Sep 8 09:44:20 2025 +0530 spi: atmel-quadspi: Add support for sama7d65 QSPI Add support for sama7d65 QSPI controller and define its caps. Signed-off-by: Varshini Rajendran Link: https://patch.msgid.link/20250908-microchip-qspi-v2-5-8f3d69fdd5c9@microchip.com Signed-off-by: Mark Brown commit 65a977d752d72a53d16ce32b85ef9db9b0747df6 Author: Varshini Rajendran Date: Mon Sep 8 09:44:19 2025 +0530 spi: atmel-quadspi: add support for SAM9X7 QSPI controller Add support for the QuadSPI controller found on the SAM9X7 SoC. This controller does not implement pad calibration. It supports operation up to 100 MHz, and requires the GCK to run at twice the data rate. Signed-off-by: Varshini Rajendran Signed-off-by: Dharma Balasubiramani Link: https://patch.msgid.link/20250908-microchip-qspi-v2-4-8f3d69fdd5c9@microchip.com Signed-off-by: Mark Brown commit 86d074921e34db6daaa7ea2976b1dfe7d507309b Author: Varshini Rajendran Date: Mon Sep 8 09:44:18 2025 +0530 spi: atmel-quadspi: add padcalib, 2xgclk, and dllon capabilities Introduce capability flags for SoC-specific variations of the QuadSPI controller: - has_padcalib: controller supports pad calibration - has_2xgclk: requires GCLK at half the data rate (2x clocking) - has_dllon: controller supports DLL clock Set `has_padcalib` for Octal controllers that provide pad calibration support. Use `has_2xgclk` for controllers that require the GCLK to run at twice the data rate. Differentiate SoC integration variants with the `has_dllon` flag and set it as needed. Signed-off-by: Varshini Rajendran Signed-off-by: Dharma Balasubiramani Link: https://patch.msgid.link/20250908-microchip-qspi-v2-3-8f3d69fdd5c9@microchip.com Signed-off-by: Mark Brown commit f3837edc05c66de0104041d3f300524773b46526 Author: Dharma Balasubiramani Date: Mon Sep 8 09:44:17 2025 +0530 dt-bindings: spi: Define sama7d65 QSPI sama7d65 has 2 instances of the QSPI controller: • One Octal Serial Peripheral Interface (QSPI0) supporting DDR. Octal, Twin-Quad, HyperFlashTM and OctaFlashTM protocols supported. • One Quad Serial Peripheral Interface (QSPI1) supporting DDR/SDR. Signed-off-by: Dharma Balasubiramani Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250908-microchip-qspi-v2-2-8f3d69fdd5c9@microchip.com Signed-off-by: Mark Brown commit 68f6b403ee90293b6fa4eb094dcee79138b692b2 Author: Dharma Balasubiramani Date: Mon Sep 8 09:44:16 2025 +0530 dt-bindings: spi: Document sam9x7 QSPI Document the sam9x7 quad spi that supports interface to serial memories operating in - Single-bit SPI, Dual SPI, Quad SPI and Octal SPI - Single Data Rate or Double Data Rate modes Signed-off-by: Dharma Balasubiramani Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250908-microchip-qspi-v2-1-8f3d69fdd5c9@microchip.com Signed-off-by: Mark Brown commit 2aa28b748fc967a2f2566c06bdad155fba8af7d8 Author: Geert Uytterhoeven Date: Thu Sep 4 17:31:42 2025 +0200 ASoC: da7213: Convert to DEFINE_RUNTIME_DEV_PM_OPS() Convert the Dialog DA7213 CODEC driver from an open-coded dev_pm_ops structure to DEFINE_RUNTIME_DEV_PM_OPS(), to simplify the code. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/0c001e0f7658c2d5f33faea963d6ca64f60ccea8.1756999876.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 Author: Alexey Klimov Date: Thu Sep 11 16:43:40 2025 +0100 ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() Setting format to s16le is required for compressed playback on compatible soundcards. Signed-off-by: Alexey Klimov Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org Signed-off-by: Mark Brown commit ce2335cd14b6585d57dc05a4375a506079adba81 Author: Samasth Norway Ananda Date: Tue Sep 9 15:51:11 2025 -0700 ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation Fix a potential integer overflow vulnerability in trace_filter_parse() where the allocation size calculation could overflow. The issue occurs when: 1. capacity is calculated by adding TRACE_FILTER_ELEMENTS_PER_ENTRY in a loop for each entry found in the input string. 2. capacity * sizeof(**out) multiplication could overflow if many entries are present in the input. 3. This results in a smaller allocation than expected, leading to potential buffer overflow. Replace kmalloc() with kmalloc_array() which provides built-in overflow checking and will safely fail the allocation if overflow would occur, preventing memory corruption. Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20250909225111.3740029-1-samasth.norway.ananda@oracle.com Signed-off-by: Mark Brown commit ee6cd8f3e28ee5a929c3b67c01a350f550f9b73a Author: Dzmitry Sankouski Date: Thu Sep 18 20:06:45 2025 +0300 power: supply: max77976_charger: fix constant current reporting CHARGE_CONTROL_LIMIT is a wrong property to report charge current limit, because `CHARGE_*` attributes represents capacity, not current. The correct attribute to report and set charge current limit is CONSTANT_CHARGE_CURRENT. Rename CHARGE_CONTROL_LIMIT to CONSTANT_CHARGE_CURRENT. Cc: stable@vger.kernel.org Fixes: 715ecbc10d6a ("power: supply: max77976: add Maxim MAX77976 charger driver") Signed-off-by: Dzmitry Sankouski Signed-off-by: Sebastian Reichel commit 0266f9541038b9b98ddd387132b5bdfe32a304e3 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:54 2025 +0100 ASoC: codecs: wcd937x: get regmap directly Remove usage of dev_get_regmap, as this its more efficient to directly reference the pointer. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-14-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit edf8918028e226515c3869c3b8b16f12fe6e62fe Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:53 2025 +0100 ASoC: codecs: wcd938x: get regmap directly Remove usage of dev_get_regmap, as this its more efficient to directly reference the pointer. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-13-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 59aebbbb0b47ee97c15cb6992c0fd665289544de Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:52 2025 +0100 ASoC: codecs: wcd-common: move status_update callback to common Soundwire update_status, bus_config and interrupt callbacks for wcd937x, wcd938x, wcd939x soundwire codecs are exactly identlical, move them to common driver to remove this duplicate code. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-12-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 45f2c5e1d1fa413e862379f0ec765c3fdd07ec8e Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:51 2025 +0100 ASoC: codecs: wcd939x: get regmap directly for some reason we ended up with a boiler plate for dev_get_regmap in wcd939x codec and started exporting a symbol for this. Remove this redundant wrapper and direclty get regmap. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-11-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit ebaf88c0546ddfd5efe5d7867a2e8e9f0e5969ed Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:50 2025 +0100 ASoC: codecs: wcd-common: move component ops to common component_ops for wcd97x, wcd938x, wcd939x soundwire codecs are exactly identlical, move them to common driver to remove this duplicate code. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-10-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4652f02cf6150ae496eec582e76b7cc7bb3089a1 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:49 2025 +0100 ASoC: codecs: wcd-common: move WCD_SDW_CH to common sdw_ch_info and WCD_SDW_CH macro is duplicated across wcd937x, wcd938x, wcd939x soundwire codec drivers. Move this to wcd common driver to remove this code duplication. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-9-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4f16b6351bbff629e1a2a9d902b96210a50d65f0 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:48 2025 +0100 ASoC: codecs: wcd: add common helper for wcd codecs All the Qualcomm WCD codecs have most of its code duplicated across all these 3/4 drivers. This is an attempt to remove those duplicate parts by adding a common helper library for these codecs. To start with move all the micbias parsing and voltage settings these are identical in WCD934x, WCD937x, WCD938x and WCD939x codec driver. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-8-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 45a3295a3005f7782054a153312ba81d28eb7664 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:47 2025 +0100 ASoC: codecs: wcdxxxx: use sdw_slave_get_current_bank helper use sdw_slave_get_current_bank() helper function, rather than duplicating this function in every codec driver. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Acked-by: Vinod Koul Link: https://patch.msgid.link/20250909121954.225833-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 772ed12bd04e6e6ad6d3fbc34016a2f88e63af7d Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:46 2025 +0100 ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper use of_sdw_find_device_by_node helper function, rather than duplicating this function in every codec driver. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 2e07017b28e8bbace4a4973d11d0646575d36f94 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:45 2025 +0100 soundwire: bus: add sdw_slave_get_current_bank helper There has been 2 instances of this helper in codec drivers, it does not make sense to keep duplicating this part of code. Lets add a helper sdw_get_current_bank() for codec drivers to use it. Signed-off-by: Srinivas Kandagatla Acked-by: Vinod Koul Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250909121954.225833-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 76cffc3eb1bdee0a7e8cca090adfd46a740f1cb0 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:44 2025 +0100 soundwire: bus: add of_sdw_find_device_by_node helper There has been more than 3 instances of this helper in multiple codec drivers, it does not make sense to keep duplicating this part of code. Lets add a helper of_sdw_find_device_by_node for codec drivers to use it. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Acked-by: Vinod Koul Link: https://patch.msgid.link/20250909121954.225833-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit c4bb62eb594418a6bd05ff03bb9072ee1fef29c2 Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:43 2025 +0100 ASoC: codecs: wcd937x: make stub functions inline For some reason we ended up with stub functions that are not inline, this can result in build error if its included multiple places, as we will be redefining the same function Fixes: c99a515ff153 ("ASoC: codecs: wcd937x-sdw: add SoundWire driver") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250909121954.225833-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 66a940b1bf48a7095162688332d725ba160154eb Author: Srinivas Kandagatla Date: Tue Sep 9 13:19:42 2025 +0100 ASoC: codecs: wcd937x: set the comp soundwire port correctly For some reason we endup with setting soundwire port for HPHL_COMP and HPHR_COMP as zero, this can potentially result in a memory corruption due to accessing and setting -1 th element of port_map array. Fixes: 82be8c62a38c ("ASoC: codecs: wcd937x: add basic controls") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Reviewed-by: Alexey Klimov Link: https://patch.msgid.link/20250909121954.225833-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit cb3c715d89607f8896c0f20fe528a08e7ebffea9 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:45 2025 +0000 ASoC: soc-dapm: add snd_soc_dapm_set_idle_bias() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Many drivers are directly setting dapm->idle_bias, but it will be impossible soon. adds snd_soc_dapm_set_idle_bias() for them. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87zfbavllj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2e7f0a86123d54a94fa3d309efdfbac02f2999b8 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:41 2025 +0000 ASoC: soc-dapm: add snd_soc_dapm_get_bias_level() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Many drivers are directly using dapm->idle_bias, but it should get it via get_idle_bias() function. Makes it as global function. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/871pomx062.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4b4fdc8b75a902eeb7441dff1876c2bb31c7715f Author: Kuninori Morimoto Date: Thu Sep 4 05:21:37 2025 +0000 ASoC: soc-dapm: tidyup idle_bias handling - step2 Current dapm_get_idle_bias() is unnecessarily complicated/confusable. Tidyup it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/873492x066.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 889dd56f8c03586e5489050e7457a405fae6a420 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:33 2025 +0000 ASoC: soc-dapm: tidyup idle_bias handling - step1 Current soc-dapm is using "idle_bias_off", and its default settings came from snd_soc_component "idle_bias_on". It is complicated/confusable. Let's handling it as "idle_bias". Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874itix06a.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3bc0a92cb2062fce54ddd97ad68ad6fe358c3ff0 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:29 2025 +0000 ASoC: soc-dapm: remove suspend_bias_off from snd_soc_dapm_context We can directly use suspend_bias_off via snd_soc_component, no need to keep it on dapm. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875xdyx06e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e38a80c5c24f3058bd5da6f2910e2b672493f4f2 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:25 2025 +0000 ASoC: soc-card: add snd_soc_card_to_dapm() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Current dapm of card/component are using "instance", but it will be "pointer" if snd_soc_dapm_context was removed from header. snd_soc_card_to_dapm() is needed to switch to the new style while maintaining compatibility Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877byex06i.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a1c99b6097afe64ed493c05b522ee4d6f9b0094d Author: Kuninori Morimoto Date: Thu Sep 4 05:21:21 2025 +0000 ASoC: soc-component: add snd_soc_component_to_dapm() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Current dapm of card/component are using "instance", but it will be "pointer" if snd_soc_dapm_context was removed from header. snd_soc_component_to_dapm() is needed to switch to the new style while maintaining compatibility Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qiux06m.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 96e311b561a2d393a786a2aeb50cd5e02d06afb3 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:17 2025 +0000 ASoC: soc-dapm: use dapm->component instead of container_of() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Now, snd_soc_dapm_to_component() (A) will convert dapm to component by container_of() (a). (A) static inline struct snd_soc_component *snd_soc_dapm_to_component( struct snd_soc_dapm_context *dapm) { (a) return container_of(dapm, struct snd_soc_component, dapm); } dapm of component works, but dapm of card will be "unknown" pointer (= not NULL), because (a) is using "container_of()". OTOH, ASoC will call snd_soc_dapm_init() (X) to initialize dapm, and it will be called from snd_soc_bind_card() (p) (for card) or soc_probe_component() (q) (for component) with component pointer. (p) static int snd_soc_bind_card(...) { ... (X) snd_soc_dapm_init(..., NULL); ... ^^^^ } (q) static int soc_probe_component(...) { ... (X) snd_soc_dapm_init(..., component); ... ^^^^^^^^^ } And snd_soc_dapm_init() (X) will fill dapm->component (x) (X) void snd_soc_dapm_init(..., component, ...) { ... (x) dapm->component = component; ... } We can simply use dapm->component in snd_soc_dapm_to_component() (A). In this case, dapm of card (p) will be just NULL. Use dapm->component instead of container_of(). The picky note can be removed by this patch. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87a53ax06q.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c8df096bca84c9eb04b656015c8430d0b87ebbcf Author: Kuninori Morimoto Date: Thu Sep 4 05:21:13 2025 +0000 ASoC: soc-dapm: add snd_soc_dapm_to_card() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Some drivers need to get card from dapm (which will be removed). We need such function. Add it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87bjnqx06v.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6b8ba0db92cd01450acaf375caf4c126aa913d72 Author: Kuninori Morimoto Date: Thu Sep 4 05:21:08 2025 +0000 ASoC: soc-dapm: add snd_soc_dapm_to_dev() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Some drivers need to get dev from dapm (which will be removed). We need such function. Add it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87cy86x06z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 62a7b3bbb6b873fdcc85a37efbd0102d66c8a73e Author: Richard Fitzgerald Date: Tue Aug 19 17:05:25 2025 +0100 ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of tdm_slots In ipc4_ssp_dai_config_pcm_params_match() when comparing params_channels() against hw_config->tdm_slots the comparison should be a <= not a ==. The number of TDM slots must be enough for the number of required channels. But it can be greater. There are various reason why a I2S/TDM link has more TDM slots than a particular audio stream needs. The original comparison would fail on systems that had more TDM slots. Signed-off-by: Richard Fitzgerald Fixes: 8a07944a77e9 ("ASoC: SOF: ipc4-pcm: Look for best matching hw_config for SSP") Link: https://patch.msgid.link/20250819160525.423416-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit b30d5de3d40c3fa642079bac0d91f17091c5f877 Author: Lucas De Marchi Date: Tue Sep 16 14:15:44 2025 -0700 drm/xe/configfs: Add mid context restore bb Like done for post context restore, allow the user to add commands to the middle of context restore, at the beginning of engine restore commands. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-7-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit 7a4756b2fd0431f109b07b904a7442f00838abf9 Author: Lucas De Marchi Date: Tue Sep 16 14:15:43 2025 -0700 drm/xe/lrc: Allow to add user commands mid context switch Like done for post-context-restore commands, allow to add commands from configfs in the middle of context restore. Since currently the indirect ctx hardcodes the offset to CTX_INDIRECT_CTX_OFFSET_DEFAULT, this is executed in the very beginning of engine context restore. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-6-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit c9dfd66cb91ef32f76e51f75e315c07907df2b85 Author: Lucas De Marchi Date: Tue Sep 16 14:15:42 2025 -0700 drm/xe/lrc: Allow INDIRECT_CTX for more engine classes Currently it's only allowed for render and compute. Going forward we want to enable it for more engine classes. Let the XE_LRC_FLAG_INDIRECT_CTX flag (and thus gt_engine_needs_indirect_ctx()) be the deciding factor for its availability. While at it, add the missing const to rcs_funcs array. Since CTX_INDIRECT_CTX_OFFSET_DEFAULT already matches the HW default and gt_engine_needs_indirect_ctx() only ever enables it for rcs/ccs, there is no change in behavior, it's only preparation for future use case. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-5-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit 39ac06f70062b6867836ea631e196cf2f60c1513 Author: Lucas De Marchi Date: Tue Sep 16 14:15:41 2025 -0700 drm/xe/configfs: Add post context restore bb Allow the user to specify commands to execute during a context restore. Currently it's possible to parse 2 types of actions: - cmd: the instructions are added as is to the bb - reg: just use the address and value, without worrying about encoding the right LRI instruction. This is possibly the most useful use case, so added a dedicated action for that. This also prepares for future BBs: mid context restore and rc6 context restore that can re-use the same parsing functions. Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-4-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit 6c6988c5e03df145e6c5cabc50d67b11f5aa2e56 Author: Lucas De Marchi Date: Tue Sep 16 14:15:40 2025 -0700 drm/xe/lrc: Allow to add user commands on context switch During validation it's useful to allows additional commands to be executed on context switch. Fetch the commands from configfs (to be added) and add them to the WA BB. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-3-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit e2a9854d806e1cb95861a0f3c7125caaefd7ef03 Author: Lucas De Marchi Date: Tue Sep 16 14:15:39 2025 -0700 drm/xe/configfs: Allow to select by class only For a future configfs attribute, it's desirable to select by engine mask only as the instance doesn't make sense. Rename the function lookup_engine_mask() to lookup_engine_info() and make it return the entry. This allows parse_engine() to still return an item if the caller wants to allow parsing a class-only string like "rcs", "bcs", "ccs", etc. Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-2-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit 7166cc3a6aae9aaa529f52e1468006e67e3e6846 Author: Lucas De Marchi Date: Tue Sep 16 14:15:38 2025 -0700 drm/xe/configfs: Extract function to parse engine Move the part that copies the engine to a local buffer so it can be shared in future for other configfs attributes parsing an engine. Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250916-wa-bb-cmds-v5-1-306bddbc15da@intel.com Signed-off-by: Lucas De Marchi commit a490c8d77d500b5981e739be3d59c60cfe382536 Author: Matthew Schwartz Date: Thu Sep 11 10:48:51 2025 -0700 drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume On clients that utilize AMD_PRIVATE_COLOR properties for HDR support, brightness sliders can include a hardware controlled portion and a gamma-based portion. This is the case on the Steam Deck OLED when using gamescope with Steam as a client. When a user sets a brightness level while HDR is active, the gamma-based portion and/or hardware portion are adjusted to achieve the desired brightness. However, when a modeset takes place while the gamma-based portion is in-use, restoring the hardware brightness level overrides the user's overall brightness level and results in a mismatch between what the slider reports and the display's current brightness. To avoid overriding gamma-based brightness, only restore HW backlight level after boot or resume. This ensures that the backlight level is set correctly after the DC layer resets it while avoiding interference with subsequent modesets. Fixes: 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4551 Signed-off-by: Matthew Schwartz Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit cc9a8e238e42c1f43b98c097995137d644b69245 Author: Guangshuo Li Date: Thu Sep 18 18:57:05 2025 +0800 drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.ws_size is set, leading to a potential NULL pointer dereference in atom_get_src_int() when accessing WS entries. Return -ENOMEM on allocation failure to avoid the NULL dereference. Signed-off-by: Guangshuo Li Signed-off-by: Alex Deucher commit 59e4405e9ee2b318342d252422a82dd863b89ef4 Author: Christian König Date: Wed Aug 27 11:45:45 2025 +0200 drm/amdgpu: revert to old status lock handling v3 It turned out that protecting the status of each bo_va with a spinlock was just hiding problems instead of solving them. Revert the whole approach, add a separate stats_lock and lockdep assertions that the correct reservation lock is held all over the place. This not only allows for better checks if a state transition is properly protected by a lock, but also switching back to using list macros to iterate over the state of lists protected by the dma_resv lock of the root PD. v2: re-add missing check v3: split into two patches Signed-off-by: Christian König Acked-by: Sunil Khatri Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8 Author: Yang Shi Date: Wed Sep 17 12:02:09 2025 -0700 arm64: mm: support large block mapping when rodata=full When rodata=full is specified, kernel linear mapping has to be mapped at PTE level since large page table can't be split due to break-before-make rule on ARM64. This resulted in a couple of problems: - performance degradation - more TLB pressure - memory waste for kernel page table With FEAT_BBM level 2 support, splitting large block page table to smaller ones doesn't need to make the page table entry invalid anymore. This allows kernel split large block mapping on the fly. Add kernel page table split support and use large block mapping by default when FEAT_BBM level 2 is supported for rodata=full. When changing permissions for kernel linear mapping, the page table will be split to smaller size. The machine without FEAT_BBM level 2 will fallback to have kernel linear mapping PTE-mapped when rodata=full. With this we saw significant performance boost with some benchmarks and much less memory consumption on my AmpereOne machine (192 cores, 1P) with 256GB memory. * Memory use after boot Before: MemTotal: 258988984 kB MemFree: 254821700 kB After: MemTotal: 259505132 kB MemFree: 255410264 kB Around 500MB more memory are free to use. The larger the machine, the more memory saved. * Memcached We saw performance degradation when running Memcached benchmark with rodata=full vs rodata=on. Our profiling pointed to kernel TLB pressure. With this patchset we saw ops/sec is increased by around 3.5%, P99 latency is reduced by around 9.6%. The gain mainly came from reduced kernel TLB misses. The kernel TLB MPKI is reduced by 28.5%. The benchmark data is now on par with rodata=on too. * Disk encryption (dm-crypt) benchmark Ran fio benchmark with the below command on a 128G ramdisk (ext4) with disk encryption (by dm-crypt). fio --directory=/data --random_generator=lfsr --norandommap \ --randrepeat 1 --status-interval=999 --rw=write --bs=4k --loops=1 \ --ioengine=sync --iodepth=1 --numjobs=1 --fsync_on_close=1 \ --group_reporting --thread --name=iops-test-job --eta-newline=1 \ --size 100G The IOPS is increased by 90% - 150% (the variance is high, but the worst number of good case is around 90% more than the best number of bad case). The bandwidth is increased and the avg clat is reduced proportionally. * Sequential file read Read 100G file sequentially on XFS (xfs_io read with page cache populated). The bandwidth is increased by 150%. Co-developed-by: Ryan Roberts Signed-off-by: Ryan Roberts Reviewed-by: Catalin Marinas Signed-off-by: Yang Shi Signed-off-by: Will Deacon commit a660194dd101e937c319171ad99c3fbe466fd825 Author: Dev Jain Date: Wed Sep 17 12:02:07 2025 -0700 arm64: Enable permission change on arm64 kernel block mappings This patch paves the path to enable huge mappings in vmalloc space and linear map space by default on arm64. For this we must ensure that we can handle any permission games on the kernel (init_mm) pagetable. Previously, __change_memory_common() used apply_to_page_range() which does not support changing permissions for block mappings. We move away from this by using the pagewalk API, similar to what riscv does right now. It is the responsibility of the caller to ensure that the range over which permissions are being changed falls on leaf mapping boundaries. For systems with BBML2, this will be handled in future patches by dyanmically splitting the mappings when required. Unlike apply_to_page_range(), the pagewalk API currently enforces the init_mm.mmap_lock to be held. To avoid the unnecessary bottleneck of the mmap_lock for our usecase, this patch extends this generic API to be used locklessly, so as to retain the existing behaviour for changing permissions. Apart from this reason, it is noted at [1] that KFENCE can manipulate kernel pgtable entries during softirqs. It does this by calling set_memory_valid() -> __change_memory_common(). This being a non-sleepable context, we cannot take the init_mm mmap lock. Add comments to highlight the conditions under which we can use the lockless variant - no underlying VMA, and the user having exclusive control over the range, thus guaranteeing no concurrent access. We require that the start and end of a given range do not partially overlap block mappings, or cont mappings. Return -EINVAL in case a partial block mapping is detected in any of the PGD/P4D/PUD/PMD levels; add a corresponding comment in update_range_prot() to warn that eliminating such a condition is the responsibility of the caller. Note that, the pte level callback may change permissions for a whole contpte block, and that will be done one pte at a time, as opposed to an atomic operation for the block mappings. This is fine as any access will decode either the old or the new permission until the TLBI. apply_to_page_range() currently performs all pte level callbacks while in lazy mmu mode. Since arm64 can optimize performance by batching barriers when modifying kernel pgtables in lazy mmu mode, we would like to continue to benefit from this optimisation. Unfortunately walk_kernel_page_table_range() does not use lazy mmu mode. However, since the pagewalk framework is not allocating any memory, we can safely bracket the whole operation inside lazy mmu mode ourselves. Therefore, wrap the call to walk_kernel_page_table_range() with the lazy MMU helpers. Link: https://lore.kernel.org/linux-arm-kernel/89d0ad18-4772-4d8f-ae8a-7c48d26a927e@arm.com/ [1] Signed-off-by: Dev Jain Signed-off-by: Yang Shi Reviewed-by: Ryan Roberts Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 13efe932d2fc3f4f753e7662d550e903b7ce8e88 Author: Yang Shi Date: Wed Sep 17 12:02:08 2025 -0700 arm64: cpufeature: add AmpereOne to BBML2 allow list AmpereOne supports BBML2 without conflict abort, add to the allow list. Reviewed-by: Christoph Lameter (Ampere) Reviewed-by: Ryan Roberts Acked-by: Catalin Marinas Signed-off-by: Yang Shi Signed-off-by: Will Deacon commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a Author: Rafael J. Wysocki Date: Tue Sep 9 13:44:14 2025 +0200 smp: Fix up and expand the smp_call_function_many() kerneldoc The smp_call_function_many() kerneldoc comment got out of sync with the function definition (bool parameter "wait" is incorrectly described as a bitmask in it), so fix it up by copying the "wait" description from the smp_call_function() kerneldoc and add information regarding the handling of the local CPU to it. Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") Signed-off-by: Rafael J. Wysocki Signed-off-by: Thomas Gleixner commit ea87c5536aa8c2b5bcd2fb482df6f11e5517df06 Author: Jeremy Linton Date: Thu Sep 18 12:54:24 2025 -0500 arm64: probes: Fix incorrect bl/blr address and register usage The pt_regs registers are 64-bit on arm64, and should be u64 when manipulated. Correct this so that we aren't truncating the address during br/blr sequences. Fixes: efb07ac534e2 ("arm64: probes: Add GCS support to bl/blr/ret") Signed-off-by: Jeremy Linton Signed-off-by: Will Deacon commit c49aa98376864ddf82175a7ea48977c637398653 Author: Sean Christopherson Date: Wed Aug 6 12:56:53 2025 -0700 KVM: x86/pmu: Restrict GLOBAL_{CTRL,STATUS}, fixed PMCs, and PEBS to PMU v2+ Restrict support for GLOBAL_CTRL, GLOBAL_STATUS, fixed PMCs, and PEBS to v2 or later vPMUs. The SDM explicitly states that GLOBAL_{CTRL,STATUS} and fixed counters were introduced with PMU v2, and PEBS has hard dependencies on fixed counters and the bitmap MSR layouts established by PMU v2. Reported-by: Dapeng Mi Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-32-seanjc@google.com Signed-off-by: Sean Christopherson commit 9bae7a086394128bd829c0c04f9f75600fdc1bc1 Author: Sean Christopherson Date: Wed Aug 6 12:56:52 2025 -0700 KVM: x86/pmu: Move initialization of valid PMCs bitmask to common x86 Move all initialization of all_valid_pmc_idx to common code, as the logic is 100% common to Intel and AMD, and KVM heavily relies on Intel and AMD having the same semantics. E.g. the fact that AMD doesn't support fixed counters doesn't allow KVM to use all_valid_pmc_idx[63:32] for other purposes. Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-31-seanjc@google.com Signed-off-by: Sean Christopherson commit 30c0267f15812114d7ab96a7dd45874742d736fe Author: Dapeng Mi Date: Wed Aug 6 12:56:51 2025 -0700 KVM: x86/pmu: Use BIT_ULL() instead of open coded equivalents Replace a variety of "1ull << N" and "(u64)1 << N" snippets with BIT_ULL() in the PMU code. No functional change intended. Signed-off-by: Dapeng Mi [sean: split to separate patch, write changelog] Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-30-seanjc@google.com Signed-off-by: Sean Christopherson commit 2bff2edf69ed80b21d35470a3580f25979be2c4b Author: Dapeng Mi Date: Wed Aug 6 12:56:48 2025 -0700 KVM: VMX: Add helpers to toggle/change a bit in VMCS execution controls Expand the VMCS controls builder macros to generate helpers to change a bit to the desired value, and use the new helpers when toggling APICv related controls. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Dapeng Mi Signed-off-by: Mingwei Zhang [sean: rewrite changelog] Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-27-seanjc@google.com Signed-off-by: Sean Christopherson commit 5a1a726e68ff256f564cf51ad21a96bceb4dd954 Author: Sean Christopherson Date: Wed Aug 6 12:56:47 2025 -0700 KVM: x86: Use KVM_REQ_RECALC_INTERCEPTS to react to CPUID updates Defer recalculating MSR and instruction intercepts after a CPUID update via RECALC_INTERCEPTS to converge on RECALC_INTERCEPTS as the "official" mechanism for triggering recalcs. As a bonus, because KVM does a "recalc" during vCPU creation, and every functional VMM sets CPUID at least once, for all intents and purposes this saves at least one recalc. Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 6057497336bbfabd3a2f632bba2cd2bfbcb7b304 Author: Sean Christopherson Date: Wed Aug 6 12:56:46 2025 -0700 KVM: x86: Rework KVM_REQ_MSR_FILTER_CHANGED into a generic RECALC_INTERCEPTS Rework the MSR_FILTER_CHANGED request into a more generic RECALC_INTERCEPTS request, and expand the responsibilities of vendor code to recalculate all intercepts that vary based on userspace input, e.g. instruction intercepts that are tied to guest CPUID. Providing a generic recalc request will allow the upcoming mediated PMU support to trigger a recalc when PMU features, e.g. PERF_CAPABILITIES, are set by userspace, without having to make multiple calls to/from PMU code. As a bonus, using a request will effectively coalesce recalcs, e.g. will reduce the number of recalcs for normal usage from 3+ to 1 (vCPU create, set CPUID, set PERF_CAPABILITIES (Intel only), set filter). The downside is that MSR filter changes that are done in isolation will do a small amount of unnecessary work, but that's already a relatively slow path, and the cost of recalculating instruction intercepts is negligible. Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-25-seanjc@google.com Signed-off-by: Sean Christopherson commit cdfed9370b96aabaa2d20f65ca4e9c9b009fe8fa Author: Dapeng Mi Date: Wed Aug 6 12:56:45 2025 -0700 KVM: x86/pmu: Move PMU_CAP_{FW_WRITES,LBR_FMT} into msr-index.h header Move PMU_CAP_{FW_WRITES,LBR_FMT} into msr-index.h and rename them with PERF_CAP prefix to keep consistent with other perf capabilities macros. No functional change intended. Signed-off-by: Dapeng Mi Signed-off-by: Mingwei Zhang Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-24-seanjc@google.com Signed-off-by: Sean Christopherson commit 1e24bece26812547608dd02eb1fc138359d0f813 Author: Dapeng Mi Date: Wed Aug 6 12:56:44 2025 -0700 KVM: x86: Rename vmx_vmentry/vmexit_ctrl() helpers Rename the two helpers vmx_vmentry/vmexit_ctrl() to vmx_get_initial_vmentry/vmexit_ctrl() to represent their real meaning. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Dapeng Mi Signed-off-by: Mingwei Zhang Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 51f34b1e650fc5843530266cea4341750bd1ae37 Author: Sean Christopherson Date: Wed Aug 6 12:56:39 2025 -0700 KVM: x86/pmu: Snapshot host (i.e. perf's) reported PMU capabilities Take a snapshot of the unadulterated PMU capabilities provided by perf so that KVM can compare guest vPMU capabilities against hardware capabilities when determining whether or not to intercept PMU MSRs (and RDPMC). Reviewed-by: Sandipan Das Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-18-seanjc@google.com Signed-off-by: Sean Christopherson commit e3d1f2826da68c763cba1f29dba5cc81d3fdaaee Author: Sean Christopherson Date: Wed Aug 6 12:56:37 2025 -0700 KVM: SVM: Check pmu->version, not enable_pmu, when getting PMC MSRs Gate access to PMC MSRs based on pmu->version, not on kvm->arch.enable_pmu, to more accurately reflect KVM's behavior. This is a glorified nop, as pmu->version and pmu->nr_arch_gp_counters can only be non-zero if amd_pmu_refresh() is reached, kvm_pmu_refresh() invokes amd_pmu_refresh() if and only if kvm->arch.enable_pmu is true, and amd_pmu_refresh() forces pmu->version to be 1 or 2. I.e. the following holds true: !pmu->nr_arch_gp_counters || kvm->arch.enable_pmu == (pmu->version > 0) and so the only way for amd_pmu_get_pmc() to return a non-NULL value is if both kvm->arch.enable_pmu and pmu->version evaluate to true. No real functional change intended. Reviewed-by: Sandipan Das Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 4687a2c4e6a61b247ad14ffb2ef5ca56e44fa4f2 Author: Sean Christopherson Date: Wed Aug 6 12:56:36 2025 -0700 KVM: VMX: Setup canonical VMCS config prior to kvm_x86_vendor_init() Setup the golden VMCS config during vmx_init(), before the call to kvm_x86_vendor_init(), instead of waiting until the callback to do hardware setup. setup_vmcs_config() only touches VMX state, i.e. doesn't poke anything in kvm.ko, and has no runtime dependencies beyond hv_init_evmcs(). Setting the VMCS config early on will allow referencing VMCS and VMX capabilities at any point during setup, e.g. to check for PERF_GLOBAL_CTRL save/load support during mediated PMU initialization. Tested-by: Xudong Hao Link: https://lore.kernel.org/r/20250806195706.1650976-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 Author: Janne Grunau Date: Thu Aug 28 16:01:22 2025 +0200 pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use "apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Signed-off-by: Janne Grunau Acked-by: Ulf Hansson Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Sven Peter commit cc80537caaa789e097f35b2032ddc693a4e136f9 Author: Shanker Donthineni Date: Thu Sep 18 08:25:48 2025 -0500 arm64: cpufeature: Add Olympus MIDR to BBML2 allow list The NVIDIA Olympus core supports BBML2 without conflict abort. Add its MIDR to the allow list to enable FEAT_BBM. Signed-off-by: Shanker Donthineni Signed-off-by: Will Deacon commit e185c8a0d84236d14af61faff8147c953a878a77 Author: Shanker Donthineni Date: Thu Sep 18 08:25:47 2025 -0500 arm64: cputype: Add NVIDIA Olympus definitions Add cpu part and model macro definitions for NVIDIA Olympus core. Signed-off-by: Shanker Donthineni Signed-off-by: Will Deacon commit b3fe1c83a56f3cb7c475747ee1c6ec5a9dd5f60e Author: Robin Murphy Date: Thu Sep 18 17:25:31 2025 +0100 perf/arm-cmn: Fix CMN S3 DTM offset CMN S3's DTM offset is different between r0px and r1p0, and it turns out this was not a error in the earlier documentation, but does actually exist in the design. Lovely. Cc: stable@vger.kernel.org Fixes: 0dc2f4963f7e ("perf/arm-cmn: Support CMN S3") Signed-off-by: Robin Murphy Signed-off-by: Will Deacon commit 70fa521f4d55127c85d7c2defe8c20be75e29efd Author: Nick Chan Date: Mon Sep 15 09:52:26 2025 +0800 arm64: dts: apple: t8015: Add SPMI node Add SPMI node for Apple A11 SoC. Signed-off-by: Nick Chan Signed-off-by: Sven Peter commit 8f6e6934e33ed95273b2a5467d244ab280beaeed Author: Nick Chan Date: Mon Sep 15 09:52:25 2025 +0800 arm64: dts: apple: t8012: Add SPMI node Add SPMI node for Apple T2 SoC. Signed-off-by: Nick Chan Signed-off-by: Sven Peter commit 4b167146ec051dce3e770052ddfe4689f41cfdd3 Author: Nick Chan Date: Mon Sep 15 09:52:24 2025 +0800 dt-bindings: spmi: Add Apple A11 and T2 compatible The SPMI bus found on Apple A11 and T2 SoCs are compatible with the existing driver for t8103's spmi so add their compatibles. Signed-off-by: Nick Chan Acked-by: Rob Herring (Arm) Signed-off-by: Sven Peter commit 637f7d2c731f1e5aa974bb572981a7a80834e6bb Author: Hector Martin Date: Sun Sep 14 21:38:49 2025 +0200 arm64: dts: apple: Add J180d (Mac Pro, M2 Ultra, 2023) device tree The M2 Ultra in the Mac Pro differs from the M2 Ultra Mac Studio in its PCIe setup. It uses all available 16 PCIe Gen4 on the first die and 8 PCIe Gen4 lanes on the second die to connect to a 100 lane Microchip Switchtec PCIe switch. All internal PCIe devices and the PCIe slots are connected to the PCIe switch. Each die implements a PCIe controller with a single 16 or 8 lane port. The PCIe controller is mostly compatible with existing implementation in pcie-apple.c. The resources for other 8 lanes on the second die are used to connect the NVMe flash with the controller in the SoC. This initial device tree does not include PCIe support. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Co-developed-by: Janne Grunau Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit a1b20e062245571c128ec521c4df56ad1bff9bd0 Author: Mikko Rapeli Date: Mon Sep 15 11:33:17 2025 +0300 ARM: rockchip: remove REGULATOR conditional to PM PM is explicitly enabled in lines just below so REGULATOR can be too. Suggested-by: Geert Uytterhoeven Signed-off-by: Mikko Rapeli Link: https://lore.kernel.org/r/20250915083317.2885761-5-mikko.rapeli@linaro.org Signed-off-by: Heiko Stuebner commit 93781211e9ad9578787355147c2f28b7289a8ec6 Author: Kaison Deng Date: Mon Sep 15 10:22:05 2025 +0800 arm64: dts: rockchip: Add devicetree for the ROC-RK3588-RT Link: https://en.t-firefly.com/product/industry/rocrk3588rt The Firefly ROC-RK3588-RT is RK3588 based SBC featuring: - TF card slot - SATA 2242 socket - 1x USB 3.0 Port, 1x USB 2.0 Port, 1x Typec Port - 1x HDMI 2.1 out, 1x HDMI 2.0 out - 2x Gigabit Ethernet, 1x 2.5G Ethernet - M.2 E-KEY for Extended WiFI and Bluetoolh - ES8388 on-board sound codec - jack in/out - RTC - LED: WORK, DIY Signed-off-by: Kaison Deng Reviewed-by: Andrew Lunn #gmac0, gmac1, mdio0, mdio1 nodes Link: https://lore.kernel.org/r/349c4226824efa52ceb14e3d8518c8bb5c7465fc.1757902513.git.dkx@t-chip.com.cn Signed-off-by: Heiko Stuebner commit ac6772e8bcdaaaf3605e306859b54d821efef7fd Author: Andrea Righi Date: Thu Sep 18 19:06:02 2025 +0200 sched_ext: Add migration-disabled counter to error state dump Include the task's migration-disabled counter when dumping task state during an error exit. This can help diagnose cases where tasks can get stuck, because they're unable to migrate elsewhere. tj: s/nomig/no_mig/ for readability and consistency with other keys. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit f2cdc4c22bca57ab4cdb28ef4a02c53837d26fe0 Merge: 1d9770838dcbe2 cbf658dd09419f Author: Jakub Kicinski Date: Thu Sep 18 11:23:29 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc7). No conflicts. Adjacent changes: drivers/net/ethernet/mellanox/mlx5/core/en/fs.h 9536fbe10c9d ("net/mlx5e: Add PSP steering in local NIC RX") 7601a0a46216 ("net/mlx5e: Add a miss level for ipsec crypto offload") Signed-off-by: Jakub Kicinski commit 2c55daf7de07158df2ab3835321086beca25a691 Author: Thomas Weißschuh Date: Thu Sep 18 11:56:36 2025 +0200 selftests: always install UAPI headers to the correct directory Currently the UAPI headers are always installed into the source directory. When building out-of-tree this doesn't work, as the include path will be wrong and it dirties the source tree, leading to complains by kbuild. Make sure the 'headers' target installs the UAPI headers in the correctly. The real target directory can come from multiple places. To handle them all extract the target directory from KHDR_INCLUDES. Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de Reported-by: Jason Gunthorpe Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/ Fixes: 1a59f5d31569 ("selftests: Add headers target") Signed-off-by: Thomas Weißschuh Reviewed-by: Jason Gunthorpe Signed-off-by: Shuah Khan commit b8874ea3d0fdb2c48b2261bb3b46c84908fa67bb Author: Bagas Sanjaya Date: Tue Sep 16 12:42:03 2025 +0700 Documentation: trace: histogram: Convert ftrace docs cross-reference In brief "Extended error information" section, details on error condition is referred to ftrace docs, which is written in :file: directive instead of a proper cross-reference. Convert it. Reviewed-by: Tom Zanussi Signed-off-by: Bagas Sanjaya Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20250916054202.582074-7-bagasdotme@gmail.com> commit fa06220f3467bc7264809be58a8cbb0329ce6fcb Author: Bagas Sanjaya Date: Tue Sep 16 12:42:02 2025 +0700 Documentation: trace: histogram-design: Wrap introductory note in note:: directive Use Sphinx note:: directive for the introductory note at the beginning of docs, instead of aligned-text paragraph that renders as definition list. Reviewed-by: Tom Zanussi Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Bagas Sanjaya Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20250916054202.582074-6-bagasdotme@gmail.com> commit 8c716e87ea33519920811338100d6d8a7fb32456 Author: Bagas Sanjaya Date: Tue Sep 16 12:42:01 2025 +0700 Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram Section heading for sched_waking histogram is shown as normal paragraph instead due to codeblock marker for the following diagram being in the same line as the section underline. Separate them. Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") Reviewed-by: Tom Zanussi Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Bagas Sanjaya Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> commit f867a298ac71c097a22ea77c06f5814095c0d288 Author: Bagas Sanjaya Date: Tue Sep 16 12:42:00 2025 +0700 Documentation: trace: histogram-design: Trim trailing vertices in diagram explanation text Diagram explanation text is supposed to be interleaved commentary between diagram parts that are spread out, but it outputs ugly in htmldocs due to trailing vertices as if both the explanation and the diagram are in the same literal code block. Trim trailing vertices. Reviewed-by: Tom Zanussi Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Bagas Sanjaya Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20250916054202.582074-4-bagasdotme@gmail.com> commit 348b7ca8d3f7fdc7bc28ef219253cb31c218fdb0 Author: Bagas Sanjaya Date: Tue Sep 16 12:41:59 2025 +0700 Documentation: trace: histogram: Fix histogram trigger subsection number order Section numbering in subsections of "Histogram Trigger Command" sections is inconsistent in order. In particular, "'hist' trigger examples" is erroneously numbered as 6.2, which is a leftover from b8df4a3634e08a ("tracing: Move hist trigger Documentation to histogram.txt"). Fix the order. Reviewed-by: Tom Zanussi Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Bagas Sanjaya Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20250916054202.582074-3-bagasdotme@gmail.com> commit 0bb8d67611b59740f47ad57658a8d2986c43f8c1 Author: Kaison Deng Date: Mon Sep 15 10:22:04 2025 +0800 dt-bindings: arm: rockchip: Add Firefly ROC-RK3588-RT This documents Firefly ROC-RK3588-RT which is a SBC based on RK3588 SoC. Link: https://en.t-firefly.com/product/industry/rocrk3588rt Signed-off-by: Kaison Deng Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/27b2ce7950fdbf28c6c8404c3f8be3c1c35d6b3c.1757902513.git.dkx@t-chip.com.cn Signed-off-by: Heiko Stuebner commit cf311ff5e7b27c267c05279e26546fe74f46e5da Author: Chukun Pan Date: Mon Sep 1 18:00:27 2025 +0800 arm64: dts: rockchip: update pinctrl names for Radxa E52C Updated the pinctrl names of the user key and power LED according to the schematic. Also updated the nodenames of other pinctrls. Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250901100027.164594-4-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 3edb9c95ffa60c029074804c39b35103a9fb4bfd Author: Chukun Pan Date: Mon Sep 1 18:00:26 2025 +0800 arm64: dts: rockchip: remove vcc_3v3_pmu regulator for Radxa E52C According to Radxa E52C Schematic V1.2 [1] page 5, vcc_3v3_pmu is directly connected to vcc_3v3_s3 via a 0 ohm resistor. The vcc_3v3_pmu is not a new regulator, so remove it. [1] https://dl.radxa.com/e/e52c/hw/radxa_e52c_v1.2_schematic.pdf Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250901100027.164594-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit d64035a5a37741b25712fb9c2f6aca535c2967ea Author: Dave Jiang Date: Fri Aug 29 11:09:28 2025 -0700 cxl: Change sslbis handler to only handle single dport While cxl_switch_parse_cdat() is harmless to be run multiple times, it is not efficient in the current scheme where one dport is being updated at a time by the memdev probe path. Change the input parameter to the specific dport being updated to pick up the SSLBIS information for just that dport. Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Tested-by: Robert Richter Signed-off-by: Dave Jiang commit 87439b598ad962ffc5744e2e0a8b461e78d8d32f Author: Dave Jiang Date: Fri Aug 29 11:09:27 2025 -0700 cxl/test: Setup target_map for cxl_test decoder initialization cxl_test uses mock functions for decoder enumaration. Add initialization of the cxld->target_map[] for cxl_test based decoders in the mock functions. Reviewed-by: Jonathan Cameron Tested-by: Robert Richter Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 644685abc16b58b3afcc2feb0ac14e86476ca2ed Author: Dave Jiang Date: Fri Aug 29 11:09:26 2025 -0700 cxl/test: Adjust the mock version of devm_cxl_switch_port_decoders_setup() With devm_cxl_switch_port_decoders_setup() being called within cxl_core instead of by the port driver probe, adjustments are needed to deal with circular symbol dependency when this function is being mock'd. Add the appropriate changes to get around the circular dependency. Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang commit d96eb90d9ca6e4652c8a23d48c94364aa061fdc4 Author: Dave Jiang Date: Fri Aug 29 11:09:25 2025 -0700 cxl/test: Add mock version of devm_cxl_add_dport_by_dev() devm_cxl_add_dport_by_dev() outside of cxl_test is done through PCI hierarchy. However with cxl_test, it needs to be done through the platform device hierarchy. Add the mock function for devm_cxl_add_dport_by_dev(). When cxl_core calls a cxl_core exported function and that function is mocked by cxl_test, the call chain causes a circular dependency issue. Dan provided a workaround to avoid this issue. Apply the method to changes from the late dport allocation changes in order to enable cxl-test. In cxl_core they are defined with "__" added in front of the function. A macro is used to define the original function names for when non-test version of the kernel is built. A bit of macros and typedefs are used to allow mocking of those functions in cxl_test. Co-developed-by: Dan Williams Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Tested-by: Alison Schofield Tested-by: Robert Richter Signed-off-by: Dave Jiang commit 4f06d81e7c6a02f850bfe9812295b1e859ab2db0 Author: Dave Jiang Date: Fri Aug 29 11:09:24 2025 -0700 cxl: Defer dport allocation for switch ports The current implementation enumerates the dports during the cxl_port driver probe. Without an endpoint connected, the dport may not be active during port probe. This scheme may prevent a valid hardware dport id to be retrieved and MMIO registers to be read when an endpoint is hot-plugged. Move the dport allocation and setup to behind memdev probe so the endpoint is guaranteed to be connected. In the original enumeration behavior, there are 3 phases (or 2 if no CXL switches) for port creation. cxl_acpi() creates a Root Port (RP) from the ACPI0017.N device. Through that it enumerates downstream ports composed of ACPI0016.N devices through add_host_bridge_dport(). Once done, it uses add_host_bridge_uport() to create the ports that enumerate the PCI RPs as the dports of these ports. Every time a port is created, the port driver is attached, cxl_switch_porbe_probe() is called and devm_cxl_port_enumerate_dports() is invoked to enumerate and probe the dports. The second phase is if there are any CXL switches. When the pci endpoint device driver (cxl_pci) calls probe, it will add a mem device and triggers the cxl_mem_probe(). cxl_mem_probe() calls devm_cxl_enumerate_ports() and attempts to discovery and create all the ports represent CXL switches. During this phase, a port is created per switch and the attached dports are also enumerated and probed. The last phase is creating endpoint port which happens for all endpoint devices. The new sequence is instead of creating all possible dports at initial port creation, defer port instantiation until a memdev beneath that dport arrives. Introduce devm_cxl_create_or_extend_port() to centralize the creation and extension of ports with new dports as memory devices arrive. As part of this rework, switch decoder target list is amended at runtime as dports show up. While the decoders are allocated during the port driver probe, The decoders must also be updated since previously they were setup when all the dports are setup. Now every time a dport is setup per endpoint, the switch target listing need to be updated with new dport. A guard(rwsem_write) is used to update decoder targets. This is similar to when decoder_populate_target() is called and the decoder programming must be protected. Also the port registers are probed the first time when the first dport shows up. This ensures that the CXL link is established when the port registers are probed. [dj] Use ERR_CAST() (Jonathan) Link: https://lore.kernel.org/linux-cxl/20250305100123.3077031-1-rrichter@amd.com/ Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang commit 68d5d9734c12fce20ad493fe24738ab2019108c0 Author: Dave Jiang Date: Fri Aug 29 11:09:23 2025 -0700 cxl/test: Refactor decoder setup to reduce cxl_test burden Group the decoder setup code in switch and endpoint port probe into a single function for each to reduce the number of functions to be mocked in cxl_test. Introduce devm_cxl_switch_port_decoders_setup() and devm_cxl_endpoint_decoders_setup(). These two functions will be mocked instead with some functions optimized out since the mock version does not do anything. Remove devm_cxl_setup_hdm(), devm_cxl_add_passthrough_decoder(), and devm_cxl_enumerate_decoders() in cxl_test mock code. In turn, mock_cxl_add_passthrough_decoder() can be removed since cxl_test does not setup passthrough decoders. __wrap_cxl_hdm_decode_init() and __wrap_cxl_dvsec_rr_decode() can be removed as well since they only return 0 when called. [dj: drop 'struct cxl_port' forward declaration (Robert)] Suggested-by: Robert Richter Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Robert Richter Signed-off-by: Dave Jiang commit 52b49bd6de29a89a040fa33e980270904c734d69 Author: Mark Rutland Date: Thu Sep 18 15:11:31 2025 +0100 arm64: cputype: Remove duplicate Cortex-X1C definitions We currently have duplicate definitions for ARM_CPU_PART_CORTEX_X1C and MIDR_CORTEX_X1C as a result of commits: 58d245e03c324d08 ("arm64: cputype: Add Cortex-X1C definitions") efe676a1a7554219 ("arm64: proton-pack: Add new CPUs 'k' values for branch mitigation") Due to inconsistent sorting when adding entries, there was no textual conflict between the two patches. Delete the duplicate definitions added by the latter commit. The definitions in general are largely (but not entirely) in order of the MIDR_EL1.PartNum value rather than by CPU name, and the remaining Cortex-X1C definitions appear later in the list. For now I haven't sorted the remaining MIDR definitions to minimize churn. I intend to perform some larger cleanup of these in the near future which should supersede that anyhow. Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Cc: Catalin Marinas Signed-off-by: Will Deacon commit 395107a7c91aafef8eb8ffee574b43cc7cce34be Author: Marneni PoornaChandu Date: Thu Sep 18 06:04:30 2025 +0800 docs: driver-api: fix spelling of "buses". Replace incorrect plural form "busses" with "buses" in multiple documentation files under "Documentation/driver-api". Signed-off-by: Marneni PoornaChandu Signed-off-by: Jonathan Corbet Message-ID: <20250917220430.5815-1-Poornachandumarneni@gmail.com> commit 4eb018bd15881504351c44f0d3d7287c88ef161f Author: Bagas Sanjaya Date: Tue Sep 9 13:37:43 2025 +0700 Documentation: fbcon: Use admonition directives Use reST syntax for admonitions (notes and custom admonition for gotcha). Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20250909063744.30053-4-bagasdotme@gmail.com> commit cfa51cfdb5100cecc3feb9ccdc08b17eeb711fe8 Author: Bagas Sanjaya Date: Tue Sep 9 13:37:42 2025 +0700 Documentation: fbcon: Reindent 8th step of attach/detach/unload Properly indent 8th step text (as enumerated list item) to be inline with other steps. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20250909063744.30053-3-bagasdotme@gmail.com> commit 78494f9e3b52d339463962b462bda1604990e4fb Author: Bagas Sanjaya Date: Tue Sep 9 13:37:41 2025 +0700 Documentation: fbcon: Add boot options and attach/detach/unload section headings These last two enumerated sections headings are in normal paragraphs, making both sections merged into "Loading" section instead. Add the headings. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20250909063744.30053-2-bagasdotme@gmail.com> commit a3d13ec44aea30794c4764b3516b4b0396ce4814 Author: Alex Tran Date: Mon Sep 1 19:30:37 2025 -0700 docs: filesystems: sysfs: add remaining top level sysfs directory descriptions Finish top level sysfs directory descriptions for block, class, firmware, hypervisor, kernel, and power. Did not write one for net directory. See commit bc3a88431672 ("docs: filesystems: sysfs: remove top level sysfs net directory") Signed-off-by: Alex Tran Signed-off-by: Jonathan Corbet Message-ID: <20250902023039.1351270-1-alex.t.tran@gmail.com> commit 63e6e9dde28a8e8967308a9dfb807edea3810aab Author: Alex Tran Date: Mon Sep 1 19:30:38 2025 -0700 docs: filesystems: sysfs: clarify symlink destinations in dev and bus/devices descriptions Change sysfs bus/devices and dev directory descriptions to provide more verbose information about the specific symlink destination the devices point to. Signed-off-by: Alex Tran Signed-off-by: Jonathan Corbet Message-ID: <20250902023039.1351270-2-alex.t.tran@gmail.com> commit a1d4416f8682d3c6d0545ad8a887d2a77f170808 Author: Alex Tran Date: Mon Sep 1 19:30:39 2025 -0700 docs: filesystems: sysfs: remove top level sysfs net directory The net/ directory is not present as a top level sysfs directory in standard Linux systems. Network interfaces can be accessible via /sys/class/net instead. Signed-off-by: Alex Tran Signed-off-by: Jonathan Corbet Message-ID: <20250902023039.1351270-3-alex.t.tran@gmail.com> commit efa29317a55392a4a1e7934426fb602e50dc55fc Author: Badal Nilawar Date: Fri Sep 5 21:19:53 2025 +0530 drm/xe/xe_late_bind_fw: Extract and print version info Extract and print version info of the late binding binary. v2: Some refinements (Daniele) Signed-off-by: Badal Nilawar Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-10-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 67de7982d5053f5a277f86e4560fea98dd95dcdf Author: Badal Nilawar Date: Fri Sep 5 21:19:52 2025 +0530 drm/xe/xe_late_bind_fw: Introduce debug fs node to disable late binding Introduce a debug filesystem node to disable late binding fw reload during the system or runtime resume. This is intended for situations where the late binding fw needs to be loaded from user mode, perticularly for validation purpose. Note that xe kmd doesn't participate in late binding flow from user space. Binary loaded from the userspace will be lost upon entering to D3 cold hence user space app need to handle this situation. v2: - s/(uval == 1) ? true : false/!!uval/ (Daniele) v3: - Refine the commit message (Daniele) Acked-by: Rodrigo Vivi Signed-off-by: Badal Nilawar Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-9-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 02f52f6d924037a20e90a280363afba10e425367 Author: Badal Nilawar Date: Fri Sep 5 21:19:51 2025 +0530 drm/xe/xe_late_bind_fw: Reload late binding fw during system resume Reload late binding fw during resume from system suspend v2: - Unconditionally reload late binding fw (Rodrigo) - Flush worker during system suspend Cc: Rodrigo Vivi Signed-off-by: Badal Nilawar Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-8-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 69ac1bb8fca5ea5fea40364ded86b4ceae2ffa21 Author: Badal Nilawar Date: Fri Sep 5 21:19:50 2025 +0530 drm/xe/xe_late_bind_fw: Reload late binding fw in rpm resume Reload late binding fw during runtime resume. Signed-off-by: Badal Nilawar Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-7-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 691a54ad94792cd155620e6bac1b33d126efbf1a Author: Badal Nilawar Date: Fri Sep 5 21:19:49 2025 +0530 drm/xe/xe_late_bind_fw: Load late binding firmware Load late binding firmware v2: - s/EAGAIN/EBUSY/ - Flush worker in suspend and driver unload (Daniele) v3: - Use retry interval of 6s, in steps of 200ms, to allow other OS components release MEI CL handle (Sasha) v4: - return -ENODEV if component not added (Daniele) - parse and print status returned by csc v5: - Use payload to check firmware valid (Daniele) - Obtain the RPM reference before scheduling the worker to ensure the device remains awake until the worker completes firmware loading (Rodrigo) v6: - In case of error donot re-attempt fw download (Daniele) v7 (Rodrigo): - Rename of mei structs and callback. Signed-off-by: Badal Nilawar Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-6-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 45832bf9c10f309b579f81b05bacc44fbb4d81b4 Author: Badal Nilawar Date: Fri Sep 5 21:19:48 2025 +0530 drm/xe/xe_late_bind_fw: Initialize late binding firmware Search for late binding firmware binaries and populate the meta data of firmware structures. v2 (Daniele): - drm_err if firmware size is more than max pay load size - s/request_firmware/firmware_request_nowarn/ as firmware will not be available for all possible cards v3 (Daniele): - init firmware from within xe_late_bind_init, propagate error - switch late_bind_fw to array to handle multiple firmware types v4 (Daniele): - Alloc payload dynamically, fix nits v6 (Daniele) - %s/MAX_PAYLOAD_SIZE/XE_LB_MAX_PAYLOAD_SIZE/ Signed-off-by: Badal Nilawar Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-5-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 918bd789d62e6ecbcbc37b2c631ee9127f17bfa9 Author: Badal Nilawar Date: Fri Sep 5 21:19:47 2025 +0530 drm/xe/xe_late_bind_fw: Introduce xe_late_bind_fw Introduce xe_late_bind_fw to enable firmware loading for the devices, such as the fan controller, during the driver probe. Typically, firmware for such devices are part of IFWI flash image but can be replaced at probe after OEM tuning. This patch binds mei late binding component to enable firmware loading. v2: - Add devm_add_action_or_reset to remove the component (Daniele) - Add INTEL_MEI_GSC check in xe_late_bind_init() (Daniele) v3: - Fail driver probe if late bind initialization fails, add has_late_bind flag (Daniele) v4: - %s/I915_COMPONENT_LATE_BIND/INTEL_COMPONENT_LATE_BIND/ v6: - rebased v7: - rebased - In xe_late_bind_init, use drm_err when returning an error to stop the probe (Lucas) - Use imperative mode in commit message (Lucas) Signed-off-by: Badal Nilawar Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905154953.3974335-4-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 741eeabb7c78c555c4c8e39df91b2b8e8d6f5ec6 Author: Alexander Usyskin Date: Fri Sep 5 21:19:46 2025 +0530 mei: late_bind: add late binding component driver Introduce a new MEI client driver to support Late Binding firmware upload/update for Intel discrete graphics platforms. Late Binding is a runtime firmware upload/update mechanism that allows payloads, such as fan control and voltage regulator, to be securely delivered and applied without requiring SPI flash updates or system reboots. This driver enables the Xe graphics driver and other user-space tools to push such firmware blobs to the authentication firmware via the MEI interface. The driver handles authentication, versioning, and communication with the authentication firmware, which in turn coordinates with the PUnit/PCODE to apply the payload. This is a foundational component for enabling dynamic, secure, and re-entrant configuration updates on platforms like Battlemage. Cc: Badal Nilawar Reviewed-by: Mika Westerberg Signed-off-by: Badal Nilawar Reviewed-by: Anshuman Gupta Signed-off-by: Rodrigo Vivi Signed-off-by: Alexander Usyskin Reviewed-by: Lucas De Marchi Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250905154953.3974335-3-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 8d5b7009aabc27e626e4167fedf1e1c1c3d6b143 Author: Alexander Usyskin Date: Fri Sep 5 21:19:45 2025 +0530 mei: bus: add mei_cldev_mtu interface Add a new helper function that allows MEI client drivers to query the maximum transmission unit (MTU) for a connected MEI client. This is useful for clients that need to transmit large payloads, such as firmware blobs, allowing them to determine the maximum message size that can be safely sent before starting transmission and size of the buffer to allocate when receiving data. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Signed-off-by: Badal Nilawar Reviewed-by: Umesh Nerlige Ramappa Signed-off-by: Rodrigo Vivi Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250905154953.3974335-2-badal.nilawar@intel.com Signed-off-by: Lucas De Marchi commit 55f6ac4484b342e62640ee4135ab1f1ffbcd5be5 Merge: 68be6c432cfa84 f9deb462d52e71 Author: Greg Kroah-Hartman Date: Thu Sep 18 18:29:34 2025 +0200 Merge patch series "mei: connect to card in D3cold" Alexander Usyskin says: When discrete graphic card enters D3cold th CSC engine is powered down. On wakeup from the D3cold full HECI link reset is required. The driver should detect that firmware requests link reset and initiate the link reset flow. In the usual flow the connect IOCTL will trigger the wake from D3cold and corresponding link reset. The MEI driver invalidates all open handles on link reset including the one that triggered the wake rendering this connection unusable. To break this loop make connect detect that it is interrupted by link reset and retry connect attempt after reset was completed. Link: https://lore.kernel.org/r/20250918130435.3327400-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit f9deb462d52e71e12f339a43b10f4443287e1f08 Author: Alexander Usyskin Date: Thu Sep 18 16:04:35 2025 +0300 mei: gsc: demote unexpected reset print Discrete graphic card can go to D3cold. On the exit from D3cold the link reset is performed. Driver did not expect such link reset and print warning. Print debug message for unexpected reset in discrete graphic case and remove infrastructure to print warning is some cases. Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250918130435.3327400-6-alexander.usyskin@intel.com commit ecdddd20b0c5987a824bb4f3948d5a597d8fb8d8 Author: Alexander Usyskin Date: Thu Sep 18 16:04:34 2025 +0300 mei: bus: demote error on connect There are flows, like exit from D3cold where connect via bus can fail. Demote error print to debug level to unclutter dmesg. Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250918130435.3327400-5-alexander.usyskin@intel.com commit 2b5c4cb2c008f01182f87f529cb104bc5bc80418 Author: Alexander Usyskin Date: Thu Sep 18 16:04:33 2025 +0300 mei: retry connect if interrupted by link reset When device is in D3cold the connect message will wake device and cause link reset. Link reset flow cleans all queues and wakes all waiters. Retry the connect flow if connect is failed and link reset is detected. Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250918130435.3327400-4-alexander.usyskin@intel.com commit bb29fc32ae56393269d8fe775159fd59e45682d1 Author: Alexander Usyskin Date: Thu Sep 18 16:04:32 2025 +0300 mei: make a local copy of client uuid in connect Connect ioctl has the same memory for in and out parameters. Copy in parameter (client uuid) to the local stack to avoid it be overwritten by out parameters fill. Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250918130435.3327400-3-alexander.usyskin@intel.com commit 2cedb296988c384e1555d74fb55e3b7b9fb268ae Author: Alexander Usyskin Date: Thu Sep 18 16:04:31 2025 +0300 mei: me: trigger link reset if hw ready is unexpected Driver can receive HW not ready interrupt unexpectedly. E.g. for cards that go donwn to D3cold. Trigger link reset in this case to synchronize driver and firmware state. No need to do that sync if driver is going down or interrupt is received before driver started initial link reset sequence. Introduce UNINITIALIZED device state to allow interrupt handler to ignore interrupts before first init. Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250918130435.3327400-2-alexander.usyskin@intel.com commit 68be6c432cfa84abe908668b0d5c26060f2fe589 Author: Alexander Usyskin Date: Mon Sep 15 15:45:54 2025 +0300 mei: gsc: fix remove operations order The mei disconnect should be the last operation in remove flow. Otherwise the device is used after destruction. Fix minor free flow that happens after device destruction too. The fault leads to the following oops in Intel Gfx CI: <4>[ 267.871331] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#1] SMP NOPTI ... <4>[ 267.871410] RIP: 0010:mei_gsc_remove+0x44/0x90 [mei_gsc] ... <4>[ 267.871555] Call Trace: <4>[ 267.871562] <4>[ 267.871570] auxiliary_bus_remove+0x1b/0x30 <4>[ 267.871589] device_remove+0x43/0x80 <4>[ 267.871604] device_release_driver_internal+0x215/0x280 <4>[ 267.871619] device_release_driver+0x12/0x20 <4>[ 267.871630] bus_remove_device+0xdc/0x150 <4>[ 267.871645] device_del+0x15f/0x3b0 <4>[ 267.871656] ? bus_unregister_notifier+0x37/0x50 <4>[ 267.871672] gsc_destroy_one.isra.0+0x44/0x210 [i915] <4>[ 267.872295] intel_gsc_fini+0x28/0x50 [i915] <4>[ 267.872860] intel_gt_driver_unregister+0x2c/0x80 [i915] <4>[ 267.873300] i915_driver_remove+0x6e/0x150 [i915] <4>[ 267.873694] i915_pci_remove+0x1e/0x40 [i915] <4>[ 267.874095] pci_device_remove+0x3e/0xb0 <4>[ 267.874111] device_remove+0x43/0x80 <4>[ 267.874126] device_release_driver_internal+0x215/0x280 <4>[ 267.874137] ? bus_find_device+0xa5/0xe0 <4>[ 267.874153] device_driver_detach+0x14/0x20 <4>[ 267.874164] unbind_store+0xac/0xc0 <4>[ 267.874178] drv_attr_store+0x21/0x50 <4>[ 267.874190] sysfs_kf_write+0x4a/0x80 <4>[ 267.874204] kernfs_fop_write_iter+0x188/0x240 <4>[ 267.874222] vfs_write+0x283/0x540 <4>[ 267.874241] ksys_write+0x6f/0xf0 <4>[ 267.874253] __x64_sys_write+0x19/0x30 <4>[ 267.874264] x64_sys_call+0x79/0x26a0 <4>[ 267.874277] do_syscall_64+0x93/0xd50 <4>[ 267.874291] ? do_syscall_64+0x1a2/0xd50 <4>[ 267.874301] ? do_syscall_64+0x1a2/0xd50 <4>[ 267.874313] ? do_syscall_64+0x1a2/0xd50 <4>[ 267.874324] ? clear_bhb_loop+0x30/0x80 <4>[ 267.874336] ? clear_bhb_loop+0x30/0x80 <4>[ 267.874349] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250915124554.2263330-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit d725668ed28b2434b548190472ac9bdc64a08e80 Author: Thorsten Blum Date: Wed Sep 17 00:29:44 2025 +0200 docs: maintainer: Fix ambiguous subheading formatting Add a newline after both subheadings to avoid any ambiguous formatting, especially in htmldocs. Without the newline, subheadings are rendered as part of the following paragraphs, which can be confusing to read. Suggested-by: Randy Dunlap Signed-off-by: Thorsten Blum Reviewed-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20250916222944.2547948-2-thorsten.blum@linux.dev> commit c01878437739f86851da76235f394346c6bd8ce3 Author: Jonathan Corbet Date: Mon Sep 8 17:12:14 2025 -0600 docs: kdoc: a few more dump_typedef() tweaks Merge "typedef" into the typedef_type pattern rather than repeating it later, and add some comments. Signed-off-by: Jonathan Corbet commit 00fa9bc4e93cb336575a5f2c1da90d2443ff14c8 Author: Jonathan Corbet Date: Mon Sep 8 16:49:58 2025 -0600 docs: kdoc: remove redundant comment stripping in dump_typedef() By the time we get here, comments have long since been stripped out; there is no need to do it again. Signed-off-by: Jonathan Corbet commit 999a642d7e7d4241cc7dba942a13c67d0685284b Author: Jonathan Corbet Date: Mon Sep 8 16:32:10 2025 -0600 docs: kdoc: remove some dead code in dump_typedef() The regex in this block of code makes no sense, and a quick test shows that it never matches anything; simply delete the code. No output changes. Signed-off-by: Jonathan Corbet commit 3dff54410e56ddee2dad8824ea77e60cd5b16d5b Author: Jonathan Corbet Date: Mon Sep 8 16:21:28 2025 -0600 docs: kdoc: final dump_function() cleanups Add some more comments to dump_function(), add some comments, and trim out an unneeded duplicate output_declaration() call. Signed-off-by: Jonathan Corbet commit 370f430527ecd35938ad94167e45fc784f6e4d95 Author: Jonathan Corbet Date: Mon Sep 8 16:01:15 2025 -0600 docs: kdoc: consolidate some of the macro-processing logic The logic to handle macros is split in dump_function(); bring it all together into a single place and add a comment saying what's going on. Remove the unneeded is_define_proto variable, and tighten up the code a bit. Signed-off-by: Jonathan Corbet commit ff1f2af341b72bd5b6b5d432da55faf2f6d24cfe Author: Jonathan Corbet Date: Mon Sep 8 13:22:42 2025 -0600 docs: kdoc: Simplify the dump_function() prototype regexes The regexes for the parsing of function prototypes were more complicated than they needed to be and difficult to understand -- at least, I spent a fair amount of time bashing my head against them. Simplify them, and add some documentation comments as well. Signed-off-by: Jonathan Corbet commit 08b5228cf455d46a23bfb341766563d1a48e3c8f Author: Jonathan Corbet Date: Fri Sep 5 16:30:48 2025 -0600 docs: kdoc: remove a useless empty capture group The is_define_proto case in dump_function() uses a regex with an empty capture group - () - that has no use; just take it out. Signed-off-by: Jonathan Corbet commit fee63c8f10c2fe77f618f9955c2f5521ff9cc622 Author: Jonathan Corbet Date: Fri Sep 5 15:53:05 2025 -0600 docs: kdoc: remove a couple of spurious regex characters The "name" regex in dump_function() includes both the tilde and colon characters, but neither has any place in function prototypes. Remove the characters, after which the regex simplifies to "\w+" No output changes. Signed-off-by: Jonathan Corbet commit a2752f8c631201e189f501fc4d320354efa3e72e Author: Jonathan Corbet Date: Thu Sep 4 16:49:52 2025 -0600 doc: kdoc: unify transform handling Both functions and structs are passed through a set of regex-based transforms, but the two were structured differently, despite being the same thing. Create a utility function to apply transformations and use it in both cases. Signed-off-by: Jonathan Corbet commit 4c232a81b0831e7bfa7518968e431d5db29b2cac Author: Jonathan Corbet Date: Thu Sep 4 16:40:49 2025 -0600 docs: kdoc: move the function transform patterns out of dump_function() Move these definitions to file level, where they are executed once, and don't clutter the function itself. Signed-off-by: Jonathan Corbet commit f853e83006ab39c3dafe085a488c14bb46906601 Author: Jonathan Corbet Date: Thu Sep 4 14:27:00 2025 -0600 docs: kdoc: remove a single-use variable struct_attribute is only used once, so just put its value there directly and drop the name. Signed-off-by: Jonathan Corbet commit e214cca38f1f35d42e63e990c610c96f993343c4 Author: Jonathan Corbet Date: Thu Sep 4 14:01:20 2025 -0600 docs: kdoc: tighten up the push_parameter() no-type case The handling of untyped parameters involved a number of redundant tests; restructure the code to remove them and be more compact. No output changes. Signed-off-by: Jonathan Corbet commit 8b00d6fe96960aaba1b923d4a8c1ddb173c9c1ff Author: Jonathan Corbet Date: Thu Sep 4 13:33:56 2025 -0600 docs: kdoc: trim __cacheline_group_* with the other annotations The special case for __cacheline_group_begin/end() can be handled by just adding another pattern to the struct_prefixes, eliminating the need for a special case in push_parameter(). One change is that these annotations no longer appear in the rendered output, just like all the other annotations that we clean out. Signed-off-by: Jonathan Corbet commit 3af1105c4fa362d17d577b55d2b8a7c4609f16fc Author: Oliver Upton Date: Wed Sep 17 13:31:25 2025 -0700 KVM: arm64: nv: Apply guest's MDCR traps in nested context KVM needs to ensure the guest hypervisor's traps take effect when the vCPU is in a nested context. While supporting infrastructure is in place for most of the EL2 trap registers, MDCR_EL2 is not. Fold the guest's trap configuration into the effective MDCR_EL2. Apply it directly to the in-memory representation as it gets recomputed on every vcpu_load() anyway. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 4a684088421d5a1ffb3b13243c58a9078c99e4b9 Author: Oliver Upton Date: Wed Sep 17 13:31:24 2025 -0700 KVM: arm64: nv: Trap debug registers when in hyp context In case you haven't realized it yet, the architecture is _slightly_ broken in the context of nested virt. Here we have another example of FEAT_NV2 redirecting a sysreg (MDSCR_EL1) to memory that actually affects execution at vEL2. Fortunately, MDCR_EL2.TDA provides the necessary traps to hide this mess at the expense of unnecessarily trapping the breakpoint/watchpoint registers. Yes, FEAT_FGT gives us a precise trap but let's just opt for obvious correctness to start. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit ff3d90903f8f525eedb26efe6fea03c39476cb69 Author: Damien Le Moal Date: Thu Sep 18 22:01:11 2025 +0900 xfs: improve default maximum number of open zones For regular block devices using the zoned allocator, the default maximum number of open zones is set to 1/4 of the number of realtime groups. For a large capacity device, this leads to a very large limit. E.g. with a 26 TB HDD: mount /dev/sdb /mnt ... XFS (sdb): 95836 zones of 65536 blocks size (23959 max open) In turn such large limit on the number of open zones can lead, depending on the workload, on a very large number of concurrent write streams which devices generally do not handle well, leading to poor performance. Introduce the default limit XFS_DEFAULT_MAX_OPEN_ZONES, defined as 128 to match the hardware limit of most SMR HDDs available today, and use this limit to set mp->m_max_open_zones in xfs_calc_open_zones() instead of calling xfs_max_open_zones(), when the user did not specify a limit with the max_open_zones mount option. For the 26 TB HDD example, we now get: mount /dev/sdb /mnt ... XFS (sdb): 95836 zones of 65536 blocks (128 max open zones) This change does not prevent the user from specifying a lareger number for the open zones limit. E.g. mount -o max_open_zones=4096 /dev/sdb /mnt ... XFS (sdb): 95836 zones of 65536 blocks (4096 max open zones) Finally, since xfs_calc_open_zones() checks and caps the mp->m_max_open_zones limit against the value calculated by xfs_max_open_zones() for any type of device, this new default limit does not increase m_max_open_zones for small capacity devices. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8e1cfa51320da0cf599d286c89db043f329ca6b0 Author: Damien Le Moal Date: Thu Sep 18 22:01:10 2025 +0900 xfs: improve zone statistics message Reword the information message displayed in xfs_mount_zones() indicating the total zone count and maximum number of open zones. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 71fa062196ae3abab790c91f1bdf09dcdc6fb1fe Author: Christoph Hellwig Date: Thu Sep 18 07:34:37 2025 -0700 xfs: centralize error tag definitions Right now 5 places in the kernel and one in xfsprogs need to be updated for each new error tag. Add a bit of macro magic so that only the error tag definition and a single table, which reside next to each other, need to be updated. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b55dd72798115015908f4a17a1f8d70e8e974ab4 Author: Christoph Hellwig Date: Thu Sep 18 07:34:36 2025 -0700 xfs: remove pointless externs in xfs_error.h Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 807df3227d7674d7957c576551d552acf15bb96f Author: Christoph Hellwig Date: Thu Sep 18 07:34:35 2025 -0700 xfs: remove the expr argument to XFS_TEST_ERROR Don't pass expr to XFS_TEST_ERROR. Most calls pass a constant false, and the places that do pass an expression become cleaner by moving it out. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 991dcadaddcced38c5d2da656862d94a1fc9e6e5 Author: Christoph Hellwig Date: Thu Sep 18 07:34:34 2025 -0700 xfs: remove xfs_errortag_set xfs_errortag_set is only called by xfs_errortag_attr_store, , which does not need to validate the error tag, because it can only be called on valid error tags that had a sysfs attribute registered. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d5409ebf46bb0735ba26c64d7a9c80dde3f94eb6 Author: Christoph Hellwig Date: Thu Sep 18 07:34:33 2025 -0700 xfs: remove xfs_errortag_get xfs_errortag_get is only called by xfs_errortag_attr_show, which does not need to validate the error tag, because it can only be called on valid error tags that had a sysfs attribute registered. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3ebcd3460cad351f198c39c6edb4af519a0ed934 Author: Carlos Llamas Date: Mon Sep 15 22:12:47 2025 +0000 binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free(). Cc: stable@vger.kernel.org Fixes: 15d9da3f818c ("binder: use bitmap for faster descriptor lookup") Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Reviewed-by: Tiffany Yang Link: https://lore.kernel.org/r/20250915221248.3470154-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit a29fea30dd93da16652930162b177941abd8c75e Author: Leo Yan Date: Wed Sep 17 18:41:39 2025 +0100 perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") Signed-off-by: Leo Yan Signed-off-by: Will Deacon commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 Author: Leo Yan Date: Wed Sep 17 18:41:38 2025 +0100 coresight: trbe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Signed-off-by: Leo Yan Signed-off-by: Will Deacon commit 16d18e3eaf29be1d987f5238ec03226f15dad5f5 Author: Guo Ren (Alibaba DAMO Academy) Date: Sun Jul 13 11:53:20 2025 -0400 riscv: Move vendor errata definitions to new header Move vendor errata definitions into errata_list_vendors.h. Signed-off-by: Guo Ren (Alibaba DAMO Academy) Reviewed-by: Alexandre Ghiti Tested-by: Han Gao Link: https://lore.kernel.org/r/20250713155321.2064856-2-guoren@kernel.org [pjw@kernel.org: updated to apply and to make the whitespace consistent] Signed-off-by: Paul Walmsley commit 92c4995b4d494f197858a79c6c6af7b6b06d38bf Author: Heinrich Schuchardt Date: Tue Jul 29 15:15:34 2025 +0200 RISC-V: ACPI: enable parsing the BGRT table The BGRT table is used to display a vendor logo during the boot process. Add the code for parsing it. Signed-off-by: Heinrich Schuchardt Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20250729131535.522205-2-heinrich.schuchardt@canonical.com Signed-off-by: Paul Walmsley commit 205cbc714842478df4239b5be205b9b459fd9fbc Author: Pu Lehui Date: Fri Jul 11 09:04:43 2025 +0000 riscv: Enable ARCH_HAVE_NMI_SAFE_CMPXCHG The implement of cmpxchg() in riscv is based on atomic primitives and has NMI-safe features, so it can be used safely in the in_nmi context. ftrace's ringbuffer relies on NMI-safe cmpxchg() in the NMI context. Currently, in_nmi() is true when riscv kprobe is in trap-based mode, so this config needs to be selected, otherwise kprobetrace will not be available. Signed-off-by: Pu Lehui Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250711090443.1688404-1-pulehui@huaweicloud.com [pjw@kernel.org: moved to preserve alphabetical order] Signed-off-by: Paul Walmsley commit 6dab7e15c0b312be79ccadf85c9ec7332427ba7b Author: Masahiro Yamada Date: Tue Jun 3 03:10:18 2025 +0900 riscv: pi: use 'targets' instead of extra-y in Makefile %.pi.o files are built as prerequisites of other objects. There is no need to use extra-y, which is planned for deprecation. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20250602181023.528550-1-masahiroy@kernel.org Signed-off-by: Paul Walmsley commit cc2294d3f9c99c216ef563b83b08d2c0604f9b92 Author: Ignacio Encinas Date: Wed Jul 23 20:47:29 2025 +0100 riscv: introduce asm/swab.h Implement endianness swap macros for RISC-V. Use the rev8 instruction when Zbb is available. Otherwise, rely on the default mask-and-shift implementation. Acked-by: Palmer Dabbelt Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Signed-off-by: Ignacio Encinas Link: https://lore.kernel.org/r/20250723-riscv-swab-v6-1-fc11e9a2efc9@iencinas.com Signed-off-by: Paul Walmsley commit 316b60b984d5be9b86047cdf3bf16d51c7c70cc5 Author: Jessica Liu Date: Fri Aug 1 10:49:48 2025 +0800 riscv: mmap(): use unsigned offset type in riscv_sys_mmap The variable type of offset should be consistent with the relevant interfaces of mmap which described in commit 295f10061af0 ("syscalls: mmap(): use unsigned offset type consistently"). Otherwise, a user input with the top bit set would result in a negative page offset rather than a large one. Signed-off-by: Jessica Liu Tested-by: Han Gao Reviewed-by: Alexandre Ghiti Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250801104948133AaMr5S6E382PbNNhoJgHA@zte.com.cn [pjw@kernel.org: hand-applied mangled patch; fixed checkpatch error] Signed-off-by: Paul Walmsley commit 01dc937ac18dd0bc0fc77c24030639553f977ffe Author: Liao Yuanhong Date: Thu Aug 28 20:25:09 2025 +0800 drivers/perf: riscv: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250828122510.30843-1-liaoyuanhong@vivo.com Signed-off-by: Paul Walmsley commit 17e9521044c9b3ee839f861d1ac35c5b5c20d16b Author: Junhui Liu Date: Tue Jul 22 00:53:11 2025 +0800 riscv: mm: Use mmu-type from FDT to limit SATP mode Some RISC-V implementations may hang when attempting to write an unsupported SATP mode, even though the latest RISC-V specification states such writes should have no effect. To avoid this issue, the logic for selecting SATP mode has been refined: The kernel now determines the SATP mode limit by taking the minimum of the value specified by the kernel command line (noXlvl) and the "mmu-type" property in the device tree (FDT). If only one is specified, use that. - If the resulting limit is sv48 or higher, the kernel will probe SATP modes from this limit downward until a supported mode is found. - If the limit is sv39, the kernel will directly use sv39 without probing. This ensures SATP mode selection is safe and compatible with both hardware and user configuration, minimizing the risk of hangs. Signed-off-by: Junhui Liu Reviewed-by: Alexandre Ghiti Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250722-satp-from-fdt-v1-2-5ba22218fa5f@pigmoral.tech Signed-off-by: Paul Walmsley commit cafc6679824a026998d93e7435f6005f64e515d2 Author: Zheng Yu Date: Tue Jul 29 18:28:56 2025 +0000 jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant Replace hardcoded value 127 with DTPAGEMAXSLOT constant in boundary checks within jfs_readdir() and dtReadFirst(). This improves code maintainability and ensures consistency with the defined maximum slot value. Signed-off-by: Zheng Yu Signed-off-by: Dave Kleikamp commit e551cc21bb0bb3f0a776a012c6033ccd4cbe419e Author: Liao Yuanhong Date: Tue Aug 19 11:28:14 2025 +0800 JFS: Remove redundant 0 value initialization The jfs_log struct is already zeroed by kzalloc(). It's redundant to initialize dummy_log->base to 0. Signed-off-by: Liao Yuanhong Signed-off-by: Dave Kleikamp commit 69f7321ce7250b779e7ff2f20d330987c966000a Author: Liao Yuanhong Date: Mon Aug 25 21:36:49 2025 +0800 JFS: Remove unnecessary parentheses When using &, it's unnecessary to have parentheses afterward. Remove redundant parentheses to enhance readability. Signed-off-by: Liao Yuanhong Signed-off-by: Dave Kleikamp commit 300b072df72694ea330c4c673c035253e07827b8 Author: Shaurya Rane Date: Mon Aug 25 01:43:32 2025 +0530 jfs: fix uninitialized waitqueue in transaction manager The transaction manager initialization in txInit() was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems. When a filesystem is mounted read-only, txBegin() returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor via tid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0. This causes a 'non-static key' lockdep warning and system crash: INFO: trying to register non-static key in txEnd Fix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during txInit(). Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com Signed-off-by: Shaurya Rane Signed-off-by: Dave Kleikamp commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 Author: Tetsuo Handa Date: Fri Sep 12 23:18:44 2025 +0900 jfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Signed-off-by: Dave Kleikamp commit 1d9770838dcbe25151a319c1eae0c9879385b49f Merge: 672beab06656f2 483446690a625c Author: Jakub Kicinski Date: Thu Sep 18 07:07:41 2025 -0700 Merge branch 'net-ethtool-add-dedicated-grxrings-driver-callbacks' Breno Leitao says: ==================== net: ethtool: add dedicated GRXRINGS driver callbacks This patchset introduces a new dedicated ethtool_ops callback, .get_rx_ring_count, which enables drivers to provide the number of RX rings directly, improving efficiency and clarity in RX ring queries and RSS configuration. Number of drivers implements .get_rxnfc callback just to report the ring count, so, having a proper callback makes sense and simplify .get_rxnfc (in some cases remove it completely). This has been suggested by Jakub, and follow the same idea as RXFH driver callbacks [1]. This also port virtio_net to this new callback. Once there is consensus on this approach, I can start moving the drivers to this new callback. Link: https://lore.kernel.org/all/20250611145949.2674086-1-kuba@kernel.org/ [1] v3: https://lore.kernel.org/20250915-gxrings-v3-0-bfd717dbcaad@debian.org v2: https://lore.kernel.org/20250912-gxrings-v2-0-3c7a60bbeebf@debian.org v1: https://lore.kernel.org/20250909-gxrings-v1-0-634282f06a54@debian.org RFC: https://lore.kernel.org/20250905-gxrings-v1-0-984fc471f28f@debian.org ==================== Link: https://patch.msgid.link/20250917-gxrings-v4-0-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 483446690a625c325149c6d14283b9782aaefffe Author: Breno Leitao Date: Wed Sep 17 02:58:15 2025 -0700 net: virtio_net: add get_rxrings ethtool callback for RX ring queries Replace the existing virtnet_get_rxnfc callback with a dedicated virtnet_get_rxrings implementation to provide the number of RX rings directly via the new ethtool_ops get_rx_ring_count pointer. This simplifies the RX ring count retrieval and aligns virtio_net with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-8-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 8b7c4b612decb79b157611225faee68c384102a9 Author: Breno Leitao Date: Wed Sep 17 02:58:14 2025 -0700 net: ethtool: use the new helper in rss_set_prep_indir() Refactor rss_set_prep_indir() to utilize the new ethtool_get_rx_ring_count() helper for determining the number of RX rings, replacing the direct use of get_rxnfc with ETHTOOL_GRXRINGS. This ensures compatibility with both legacy and new ethtool_ops interfaces by transparently multiplexing between them. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-7-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit dce08107f1f305b0fbef115410034b1fb3b7e070 Author: Breno Leitao Date: Wed Sep 17 02:58:13 2025 -0700 net: ethtool: update set_rxfh_indir to use ethtool_get_rx_ring_count helper Modify ethtool_set_rxfh() to use the new ethtool_get_rx_ring_count() helper function for retrieving the number of RX rings instead of directly calling get_rxnfc with ETHTOOL_GRXRINGS. This way, we can leverage the new helper if it is available in ethtool_ops. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-6-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit d5544688d4217f370e9189e17b6536b469ee0f1d Author: Breno Leitao Date: Wed Sep 17 02:58:12 2025 -0700 net: ethtool: update set_rxfh to use ethtool_get_rx_ring_count helper Modify ethtool_set_rxfh() to use the new ethtool_get_rx_ring_count() helper function for retrieving the number of RX rings instead of directly calling get_rxnfc with ETHTOOL_GRXRINGS. This way, we can leverage the new helper if it is available in ethtool_ops. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-5-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 84eaf4359c36b0ba888f571a964138d22ba5914f Author: Breno Leitao Date: Wed Sep 17 02:58:11 2025 -0700 net: ethtool: add get_rx_ring_count callback to optimize RX ring queries Add a new optional get_rx_ring_count callback in ethtool_ops to allow drivers to provide the number of RX rings directly without going through the full get_rxnfc flow classification interface. Create ethtool_get_rx_ring_count() to use .get_rx_ring_count if available, falling back to get_rxnfc() otherwise. It needs to be non-static, given it will be called by other ethtool functions laters, as those calling get_rxfh(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-4-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 87c76c2db002e747269fc5d91461786ce57976d7 Author: Breno Leitao Date: Wed Sep 17 02:58:10 2025 -0700 net: ethtool: remove the duplicated handling from ethtool_get_rxrings ethtool_get_rxrings() was a copy of ethtool_get_rxnfc(). Clean the code that will never be executed for GRXRINGS specifically. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-3-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 06fad5a4aeb2622b7aeefd6ad60b6cf76c0b7c5b Author: Breno Leitao Date: Wed Sep 17 02:58:09 2025 -0700 net: ethtool: add support for ETHTOOL_GRXRINGS ioctl This patch adds handling for the ETHTOOL_GRXRINGS ioctl command in the ethtool ioctl dispatcher. It introduces a new helper function ethtool_get_rxrings() that calls the driver's get_rxnfc() callback with appropriate parameters to retrieve the number of RX rings supported by the device. By explicitly handling ETHTOOL_GRXRINGS, userspace queries through ethtool can now obtain RX ring information in a structured manner. In this patch, ethtool_get_rxrings() is a simply copy of ethtool_get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-2-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 3efaede2e13b0c0372500a6acdfc5c31268a3ed4 Author: Breno Leitao Date: Wed Sep 17 02:58:08 2025 -0700 net: ethtool: pass the num of RX rings directly to ethtool_copy_validate_indir Modify ethtool_copy_validate_indir() and callers to validate indirection table entries against the number of RX rings as an integer instead of accessing rx_rings->data. This will be useful in the future, given that struct ethtool_rxnfc might not exist for native GRXRINGS call. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250917-gxrings-v4-1-dae520e2e1cb@debian.org Signed-off-by: Jakub Kicinski commit 672beab06656f2f1bda4708cda2b9af61c58a7ea Author: Eric Dumazet Date: Thu Sep 18 11:35:46 2025 +0000 psp: rename our psp_dev_destroy() psp_dev_destroy() was already used in drivers/crypto/ccp/psp-dev.c Use psp_dev_free() instead, to avoid a link error when CRYPTO_DEV_SP_CCP=y Fixes: 00c94ca2b99e ("psp: base PSP device support") Closes: https://lore.kernel.org/netdev/CANn89i+ZdBDEV6TE=Nw5gn9ycTzWw4mZOpPuCswgwEsrgOyNnw@mail.gmail.com/ Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Acked-by: Paolo Abeni Reviewed-by: Daniel Zahka Link: https://patch.msgid.link/20250918113546.177946-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 542342d27122e4a0dc90025748f7821f8e15920a Author: Yicong Yang Date: Thu Aug 14 17:16:22 2025 +0800 MAINTAINERS: Remove myself from HiSilicon PMU maintainers Remove myself as I'm leaving HiSilicon and not suitable for maintaining this. Thanks for the journey. Signed-off-by: Yicong Yang Acked-by: Jonathan Cameron Signed-off-by: Will Deacon commit 2257798498b3b069e5ff46ad957c32a9a06b5fc9 Author: Junhao He Date: Thu Aug 14 17:16:21 2025 +0800 drivers/perf: hisi: Add support for HiSilicon MN PMU driver MN (Miscellaneous Node) is a hybrid node in ARM CHI. It broadcasts the following two types of requests: DVM operations and PCIe configuration. MN PMU devices exist on both SCCL and SICL, so we named the MN pmu driver after SCL (Super cluster) ID. The MN PMU driver using the HiSilicon uncore PMU framework. And only the event parameter is supported. Signed-off-by: Junhao He Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Will Deacon commit e31c0eb10388e2af0502b77e61453efbc8a4f974 Author: Yicong Yang Date: Thu Aug 14 17:16:20 2025 +0800 drivers/perf: hisi: Add support for HiSilicon NoC PMU Adds the support for HiSilicon NoC (Network on Chip) PMU which will be used to monitor the events on the system bus. The PMU device will be named after the SCL ID (either Super CPU cluster or Super IO cluster) and the index ID, just similar to other HiSilicon Uncore PMUs. Below PMU formats are provided besides the event: - ch: the transaction channel (data, request, response, etc) which can be used to filter the counting. - tt_en: tracetag filtering enable. Just as other HiSilicon Uncore PMUs the NoC PMU supports only counting the transactions with tracetag. The NoC PMU doesn't have an interrupt to indicate the overflow. However we have a 64 bit counter which is large enough and it's nearly impossible to overflow. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Will Deacon commit 0aa09d8a6cab0f7d284e61eff28ac3be4d324c20 Author: Sunil Khatri Date: Thu Sep 18 09:33:51 2025 +0530 drm/amdgpu: add missing comment for the new argument In function 'amdgpu_vm_lock_done_list' update the comment for the new argument 'vm'. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509180211.UAqME0zj-lkp@intel.com/ Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f8b367e6fa1716cab7cc232b9e3dff29187fc99d Author: Alex Deucher Date: Wed Sep 17 12:42:11 2025 -0400 drm/amdgpu: suspend KFD and KGD user queues for S0ix We need to make sure the user queues are preempted so GFX can enter gfxoff. Reviewed-by: Mario Limonciello (AMD) Tested-by: David Perry Signed-off-by: Alex Deucher commit 846de1384a6ab5576601f206b9a94786276ec204 Author: Alex Deucher Date: Wed Sep 17 12:42:10 2025 -0400 drm/amdgpu/userq: Optimize S0ix handling In S0i3, GFX state is retained, so it's preferrable to preempt queues rather than unmapping them as the overhead is lower. Reviewed-by: Mario Limonciello (AMD) Tested-by: David Perry Signed-off-by: Alex Deucher commit f05c03ffc786968ec728422728f5226522886d9c Author: Joe.Wang Date: Wed Sep 17 14:58:49 2025 +0800 drm/amdgpu: Fix PRT flag for gfx12 AMDGPU_PTE_PRT_GFX12 flag is missed during pageTable rework, add it back. Fixes: 6716a823d18d ("drm/amdgpu: rework how PTE flags are generated v3") Signed-off-by: Joe Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1ed511fb760848e3ccdcb936f4257c094e95a43c Author: Xiang Liu Date: Tue Aug 19 13:06:24 2025 +0800 drm/amdgpu: Check VF critical region before RAS poison injection Check VF critical region before RAS poison injection to ensure that the poison injection will not hit the VF critical region. Signed-off-by: Xiang Liu Reviewed-by: Shravan Kumar Gande Signed-off-by: Alex Deucher commit 4bfa8609934dbf39bbe6e75b4f971469384b50b1 Author: Alex Deucher Date: Wed Sep 17 12:42:09 2025 -0400 drm/amdkfd: add proper handling for S0ix When in S0i3, the GFX state is retained, so all we need to do is stop the runlist so GFX can enter gfxoff. Reviewed-by: Mario Limonciello (AMD) Tested-by: David Perry Signed-off-by: Alex Deucher commit f1fdeb3d07a4c2dcfc8cf0e20c0bddb68e8bc607 Author: Xiang Liu Date: Tue Aug 19 12:51:28 2025 +0800 drm/amdgpu: Introduce VF critical region check for RAS poison injection The SRIOV guest send requet to host to check whether the poison injection address is in VF critical region or not via mabox. Signed-off-by: Xiang Liu Reviewed-by: Shravan Kumar Gande Signed-off-by: Alex Deucher commit 18f769ff368c6b133a41b44ae673c329eb5d9f46 Author: Alex Deucher Date: Wed Aug 20 16:04:18 2025 -0400 drm/amdgpu: remove non-DC DCE 11 code DC has been the default for ~8 years now and supports many things that the non-DC code does not (audio, DP MST, etc.). No DCE 11.x IPs ever supported analog encoders so that is not an issue. Finally drop this code. Acked-by: Timur Kristóf Signed-off-by: Alex Deucher commit 34f10da667090c66a4efcda895dd7b1766c1e2a1 Author: Asad Kamal Date: Mon Sep 15 20:28:49 2025 +0800 drm/amd/pm: Enable npm metrics data Enable npm metrics data for smu_v13_0_12 v3: Add node id check for setting NPM_CAPS (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit acae8ad69bb513fdc3c111b8794fd6a36bf147c0 Author: Asad Kamal Date: Fri Aug 29 12:25:54 2025 +0800 drm/amd/pm: Fetch npm data from system metrics table Fetch npm data from system metrics table for smu_v13_0_12 v3: Remove intermittent type for npm data, remove node id check, move npm caps check to npm_get_data function (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit ef612f58d944ce4a468fa533335035a6e5163eda Author: Asad Kamal Date: Wed Aug 27 21:22:13 2025 +0800 drm/amd/pm: Add sysfs node for node power Add sysfs node to expose node power limit for smu_v13_0_12 v2: Remove support check from visible function (Kevin) v3: Update comments (Kevin) Remove sysfs remove file, change format specifier for sysfs_emit, use attribute_group.name (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 4072b16dd841fad544b3efac1a5d2f99682a1ee2 Author: Asad Kamal Date: Mon Sep 15 17:53:19 2025 +0800 drm/amd/pm: Allow system metrics table in 1vf mode Allow fetching system metrics table in 1VF mode Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit f8f89e8cf3d668a40106444276d8c448c114e963 Author: Yicong Yang Date: Wed Aug 20 16:45:33 2025 +0800 perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions PMCCNTR_EL0 is preferred for counting CPU_CYCLES under certain conditions. Factor out the condition check to a separate function for further extension. Add documents for better understanding. No functional changes intended. Reviewed-by: James Clark Acked-by: Mark Rutland Signed-off-by: Yicong Yang Signed-off-by: Will Deacon commit 00d7a1af5ab58d89c2f0af27485b2d710c862dfc Author: James Clark Date: Mon Sep 1 13:40:35 2025 +0100 arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS SPE data source filtering (optional from Armv8.8) requires that traps to the filter register PMSDSFR be disabled. Document the requirements and disable the traps if the feature is present. Tested-by: Leo Yan Reviewed-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit 510a8fa49dc1d18b120e2d3992fa2aff7fc5c46b Author: James Clark Date: Mon Sep 1 13:40:34 2025 +0100 arm64/boot: Factor out a macro to check SPE version We check the version of SPE twice, and we'll add one more check in the next commit so factor out a macro to do this. Change the #3 magic number to the actual SPE version define (V1p2) to make it more readable. No functional changes intended. Tested-by: Leo Yan Reviewed-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit dad9603c5ea308a7b26af66ff4824dccd438af5d Author: James Clark Date: Mon Sep 1 13:40:33 2025 +0100 perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering FEAT_SPE_EFT (optional from Armv9.4) adds mask bits for the existing load, store and branch filters. It also adds two new filter bits for SIMD and floating point with their own associated mask bits. The current filters only allow OR filtering on samples that are load OR store etc, and the new mask bits allow setting part of the filter to an AND, for example filtering samples that are store AND SIMD. With mask bits set to 0, the OR behavior is preserved, so the unless any masks are explicitly set old filters will behave the same. Add them all and make them behave the same way as existing format bits, hidden and return EOPNOTSUPP if set when the feature doesn't exist. Reviewed-by: Leo Yan Tested-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit 51b9f16697cda2229aacc10bbb0216b6900cbca1 Author: Leo Yan Date: Mon Sep 1 13:40:32 2025 +0100 perf: arm_spe: Expose event filter Expose an "event_filter" entry in the caps folder to inform user space about which events can be filtered. Change the return type of arm_spe_pmu_cap_get() from u32 to u64 to accommodate the added event filter entry. Signed-off-by: Leo Yan Tested-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit b4401403afb992844fa47513ac9c94520722c43d Author: James Clark Date: Mon Sep 1 13:40:31 2025 +0100 perf: arm_spe: Support FEAT_SPEv1p4 filters FEAT_SPEv1p4 (optional from Armv8.8) adds some new filter bits and also makes some previously available bits unavailable again e.g: E[30], bit [30] When FEAT_SPEv1p4 is _not_ implemented ... Continuing to hard code the valid filter bits for each version isn't scalable, and it also doesn't work for filter bits that aren't related to SPE version. For example most bits have a further condition: E[15], bit [15] When ... and filtering on event 15 is supported: Whether "filtering on event 15" is implemented or not is only discoverable from the TRM of that specific CPU or by probing PMSEVFR_EL1. Instead of hard coding them, write all 1s to the PMSEVFR_EL1 register and read it back to discover the RES0 bits. Unsupported bits are RAZ/WI so should read as 0s. For any hardware that doesn't strictly follow RAZ/WI for unsupported filters: Any bits that should have been supported in a specific SPE version but now incorrectly appear to be RES0 wouldn't have worked anyway, so it's better to fail to open events that request them rather than behaving unexpectedly. Bits that aren't implemented but also aren't RAZ/WI will be incorrectly reported as supported, but allowing them to be used is harmless. Testing on N1SDP shows the probed RES0 bits to be the same as the hard coded ones. The FVP with SPEv1p4 shows only additional new RES0 bits, i.e. no previously hard coded RES0 bits are missing. Tested-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit a7005ff2d0a5dfb15ba7152f4fb325ad9e00a472 Author: James Clark Date: Mon Sep 1 13:40:30 2025 +0100 arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register Add new fields and register that are introduced for the features FEAT_SPE_EFT (extended filtering) and FEAT_SPE_FDS (data source filtering). Tested-by: Leo Yan Reviewed-by: Anshuman Khandual Acked-by: Will Deacon Signed-off-by: James Clark Signed-off-by: Will Deacon commit 71396cfac97d0249fa7d8dcc8e649b6ba4c090e4 Author: Ilkka Koskinen Date: Thu Aug 28 15:35:19 2025 -0700 perf/dwc_pcie: Support counting multiple lane events in parallel While Designware PCIe PMU allows to count only one time based event at a time, it allows to count all the lane events simultaneously. After the patch one is able to count a group of lane events: $ perf stat -e '{dwc_rootport/tx_memory_write,lane=1/,dwc_rootport/rx_memory_read,lane=0/}' dd if=/dev/nvme0n1 of=/dev/null bs=1M count=1 Earlier the events wouldn't have been counted successfully. Signed-off-by: Ilkka Koskinen Signed-off-by: Will Deacon commit 1e558fb31bec3076500219cc417f477fe10a8463 Author: Xichao Zhao Date: Wed Aug 13 16:32:57 2025 +0800 drivers: perf: use us_to_ktime() where appropriate The arm_ccn_pmu_poll_period_us are more suitable for using the us_to_ktime(). This can make the code more concise and enhance readability. Signed-off-by: Xichao Zhao Acked-by: Mark Rutland Signed-off-by: Will Deacon commit 2c599c68c43e65fa333b222effbeab61cbd35df5 Author: Xu Yang Date: Thu Aug 21 19:01:52 2025 +0800 MAINTAINERS: include fsl_imx9_ddr_perf.c and some perf metric files The fsl_imx9_ddr_perf.c and some perf metric files under tools/perf/pmu-events/arch/arm64/freescale/ is missing in MAINTAINERS. Add them and add me as another maintainer. Reviewed-by: Frank Li Signed-off-by: Xu Yang Signed-off-by: Will Deacon commit e4d9e8fb406bef3936aceac85d3f400b1acdbe73 Author: Xu Yang Date: Thu Aug 21 19:01:50 2025 +0800 perf: imx_perf: add support for i.MX94 platform Add compatible string and related devtype for i.MX94 platform. Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Xu Yang Signed-off-by: Will Deacon commit f8cc02321bfca71967db1620d684aa3abab59612 Author: Xu Yang Date: Thu Aug 21 19:01:49 2025 +0800 dt-bindings: perf: fsl-imx-ddr: Add a compatible string fsl,imx94-ddr-pmu for i.MX94 i.MX94 has a DDR Performance Monitor Unit which is compatible with i.MX93. This will add a compatible for i.MX94. Reviewed-by: Peng Fan Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Xu Yang Signed-off-by: Will Deacon commit c2fcb2e79d6f4113e93aabc50158bc97a359d1f5 Author: Dan Carpenter Date: Thu Sep 18 09:57:47 2025 +0300 EDAC/versalnet: Return the correct error in mc_probe() Return -ENOMEM if memory allocation in mc_probe() fails. [ bp: Massage commit message. ] Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Dan Carpenter Signed-off-by: Borislav Petkov (AMD) commit f46ccdb87a2573a23ee2d2c21a6b087af9ae76c0 Author: Heiko Carstens Date: Tue Sep 16 15:48:03 2025 +0200 s390/bitops: Cleanup __flogr() The flogr() inline assembly has no side effects and generates the same output if the input does not change. Therefore remove the volatile qualifier to allow the compiler to optimize the inline assembly away, if possible. Also remove the superfluous '\n' which makes the inline assembly appear larger than it is according to compiler heuristics (number of lines). Furthermore change the return type of flogr() to unsigned long and add the const attribute to the function. This reduces the kernel image size by 994 bytes (defconfig, gcc 15.2.0). Suggested-by: Juergen Christ Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 79161603952c842eb22313f2060051b359b0a592 Author: Heiko Carstens Date: Tue Sep 16 15:48:02 2025 +0200 s390/bitops: Use __assume() for __flogr() inline assembly return value Use __assume() to tell compilers that the output operand of the __flogr() inline assembly contains a value in the range of 0..64. This allows to optimize the logical AND operation away. This reduces the kernel image size by 2804 bytes (defconfig, gcc 15.2.0). Suggested-by: Juergen Christ Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit f72e2cff13aefe305fc8fc6afe4f43626e4ad88c Author: Heiko Carstens Date: Tue Sep 16 15:48:01 2025 +0200 compiler_types: Add __assume macro Make the statement attribute "assume" with a new __assume macro available. The assume attribute is used to indicate that a certain condition is assumed to be true. Compilers may or may not use this indication to generate optimized code. If this condition is violated at runtime, the behavior is undefined. Note that the clang documentation states that optimizers may react differently to this attribute, and this may even have a negative performance impact. Therefore this attribute should be used with care. Signed-off-by: Heiko Carstens Reviewed-by: Nathan Chancellor Signed-off-by: Alexander Gordeev commit a9f859b516ac98c06b0d24e691fceab32a9665d5 Author: Heiko Carstens Date: Tue Sep 16 15:48:00 2025 +0200 s390/bitops: Limit return value range of __flogr() With the recent ffs() and ffs64() optimization a logical AND operation was removed, which allowed the compiler to tell the return value range of both functions. This may lead to compile warnings as reported by the kernel test robot: drivers/infiniband/hw/mlx5/mr.c: In function 'mlx5r_cache_create_ent_locked': >> drivers/infiniband/hw/mlx5/mr.c:840:31: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=] 840 | sprintf(ent->name, "%d", order); | ^ In function 'mlx5_mkey_cache_debugfs_add_ent', inlined from 'mlx5r_cache_create_ent_locked' at drivers/infiniband/hw/mlx5/mr.c:930:3: drivers/infiniband/hw/mlx5/mr.c:840:9: note: 'sprintf' output between 2 and 5 bytes into a destination of size 4 840 | sprintf(ent->name, "%d", order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Add the AND operation again to address the warning. From a correctness point of view the AND operation is not necessary, however there is no other way to tell the compiler that the returned value of the flogr inline assembly is in the range of 0..64. This increases the kernel image size by 566 bytes (defconfig, gcc 15.2.0). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508211859.UoYsJbLN-lkp@intel.com/ Fixes: de88e74889a3 ("s390/bitops: Slightly optimize ffs() and fls64()") Suggested-by: Juergen Christ Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 09b5febf84262a303ecedf0821e03b8d8492a38b Author: Mark Brown Date: Wed Aug 20 19:29:04 2025 +0100 kselftest/arm64: Check that unsupported regsets fail in sve-ptrace Add a test which verifies that NT_ARM_SVE and NT_ARM_SSVE reads and writes are rejected as expected when the relevant architecture feature is not supported. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit dd68f51febbd6eb8a40872724f4c9bcc84442114 Author: Mark Brown Date: Wed Aug 20 19:29:03 2025 +0100 kselftest/arm64: Verify that we reject out of bounds VLs in sve-ptrace We do not currently have a test that asserts that we reject attempts to set a vector length smaller than SVE_VL_MIN or larger than SVE_VL_MAX, add one since that is our current behaviour. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit 7b712146cb8c2b9b741a7eea028c24adef66b1e4 Merge: 64d2616972b775 fa18932afb29b5 Author: Paolo Abeni Date: Thu Sep 18 13:09:44 2025 +0200 Merge branch 'bnxt_en-updates-for-net-next' Michael Chan says: ==================== bnxt_en: Updates for net-next This series includes some code clean-ups and optimizations. New features include 2 new backing store memory types to collect FW logs for core dumps, dynamic SRIOV resource allocations for RoCE, and ethtool tunable for PFC watchdog. v2: Drop patch #4. The patch makes the code different from the original bnxt_hwrm_func_backing_store_cfg_v2() that allows instance_bmap to have bits that are not contiguous. It is safer to keep the original code. v1: https://lore.kernel.org/netdev/20250915030505.1803478-1-michael.chan@broadcom.com/ ==================== Link: https://patch.msgid.link/20250917040839.1924698-1-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit fa18932afb29b51530508f28adcc824a8c00b712 Author: Michael Chan Date: Tue Sep 16 21:08:39 2025 -0700 bnxt_en: Implement ethtool .set_tunable() for ETHTOOL_PFC_PREVENTION_TOUT Support the setting of the tunable if it is supported by firmware. The supported range is 0 to the maximum msec value reported by firmware. PFC_STORM_PREVENTION_AUTO is also supported and 0 means it is disabled. Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-11-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 6684b91d04b408843bd65e2120f6db2159e4f40b Author: Michael Chan Date: Tue Sep 16 21:08:38 2025 -0700 bnxt_en: Implement ethtool .get_tunable() for ETHTOOL_PFC_PREVENTION_TOUT Return the current PFC watchdog timeout value if it is supported. Reviewed-by: Andy Gospodarek Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-10-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 7ef55292dc2d97afd6754524f53ab0fb62829841 Author: Kalesh AP Date: Tue Sep 16 21:08:37 2025 -0700 bnxt_en: Use VLAN_ETH_HLEN when possible Replace ETH_HLEN + VLAN_HLEN with VLAN_ETH_HLEN. Cosmetic change and no functional changes intended. Reviewed-by: Pavan Chebbi Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-9-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 48e619627832c58ebdd3ed00c411afd5327f5c07 Author: Anantha Prabhu Date: Tue Sep 16 21:08:36 2025 -0700 bnxt_en: Support for RoCE resources dynamically shared within VFs. Add support for dynamic RoCE SRIOV resource configuration. Instead of statically dividing the RoCE resources by the number of VFs, provide the maximum resources and let the FW dynamically dsitribute to the VFs on the fly. Reviewed-by: Somnath Kotur Reviewed-by: Kalesh AP Signed-off-by: Anantha Prabhu Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-8-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 6f115863f736ea8ac4c1ce738529a3d53a456d00 Author: Kashyap Desai Date: Tue Sep 16 21:08:35 2025 -0700 bnxt_en: Add err_qpc backing store handling New backing store component err_qpc is added to the existing host logging interface for FW traces. Allocate the backing store memory if this memory type is supported. Copy this memory when collecting the coredump. Reviewed-by: Shruti Parab Signed-off-by: Kashyap Desai Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-7-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit ba1aefee2e9835fe6e07b86cb7020bd2550a81ee Author: Shruti Parab Date: Tue Sep 16 21:08:34 2025 -0700 bnxt_en: Add fw log trace support for 5731X/5741X chips These older chips now support the fw log traces via backing store qcaps_v2. No other backing store memory types are supported besides the fw trace types. Reviewed-by: Hongguang Gao Reviewed-by: Andy Gospodarek Signed-off-by: Shruti Parab Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-6-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit de6768750319eb2a3ced020585f9481a2ee961fa Author: Michael Chan Date: Tue Sep 16 21:08:33 2025 -0700 bnxt_en: Improve bnxt_backing_store_cfg_v2() Improve the logic that determines the last_type in this function. The different context memory types are configured in a loop. The last_type signals the last context memory type to be configured which requires the ALL_DONE flag to be set for the FW. The existing logic makes some assumptions that TIM is the last_type when RDMA is enabled or FTQM is the last_type when only L2 is enabled. Improve it to just search for the last_type so that we don't need to make these assumptions that won't necessary be true for future devices. Reviewed-by: Shruti Parab Reviewed-by: Hongguang Gao Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-5-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 21b6b8e8b344ec99777ebb349647b2069297188c Author: Kalesh AP Date: Tue Sep 16 21:08:32 2025 -0700 bnxt_en: Optimize bnxt_sriov_disable() bnxt_sriov_disable() is invoked from 2 places: 1. When the user deletes the VFs. 2. During the unload of the PF driver instance. Inside bnxt_sriov_disable(), driver invokes bnxt_restore_pf_fw_resources() which in turn causes a close/open_nic(). There is no harm doing this in the unload path, although it is inefficient and unnecessary. Optimize the function to make it more efficient. Reviewed-by: Somnath Kotur Reviewed-by: Pavan Chebbi Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-4-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit e23c40d41b88281b771920035d84050735aaf841 Author: Kalesh AP Date: Tue Sep 16 21:08:31 2025 -0700 bnxt_en: Remove unnecessary VF check in bnxt_hwrm_nvm_req() The driver registers the supported configuration parameters with the devlink stack only on the PF using devlink_params_register(). Hence there is no need for a VF check inside bnxt_hwrm_nvm_req(). Reviewed-by: Ajit Khaparde Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-3-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 3b46a9e404abcf4c4292be9e3ca13ce884169ae0 Author: Kalesh AP Date: Tue Sep 16 21:08:30 2025 -0700 bnxt_en: Drop redundant if block in bnxt_dl_flash_update() The devlink stack has sanity checks and it invokes flash_update() only if it is supported by the driver. The VF driver does not advertise the support for flash_update in struct devlink_ops. This makes if condition inside bnxt_dl_flash_update() redundant. Reviewed-by: Pavan Chebbi Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250917040839.1924698-2-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 2b1c6d7a890aeaeabfeabd1cef5a4808043dc1a4 Author: Mikulas Patocka Date: Mon Sep 15 17:42:45 2025 +0200 dm: optimize REQ_PREFLUSH with data when using the linear target If the table has only linear targets and there is just one underlying device, we can optimize REQ_PREFLUSH with data - we don't have to split it to two bios - a flush and a write. We can pass it to the linear target directly. Signed-off-by: Mikulas Patocka Tested-by: Bart Van Assche Reviewed-by: Bart Van Assche commit 3ba8d4aa42bd5dc6e2493ce4a73bb41c9cfd77ca Author: Kuninori Morimoto Date: Thu Sep 18 06:27:12 2025 +0000 arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE It is same as Cortex-A720. Link: https://lore.kernel.org/all/aMlFwbDjJ6yKuxTv@J2N7QTR9R3.cambridge.arm.com/ Signed-off-by: Kuninori Morimoto Signed-off-by: Will Deacon commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af Author: Kuninori Morimoto Date: Thu Sep 18 06:26:55 2025 +0000 arm64: cputype: Add Cortex-A720AE definitions Add cputype definitions for Cortex-A720AE. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A720AE TRM: https://developer.arm.com/documentation/102828/0001/ ... in Table A-187 Signed-off-by: Kuninori Morimoto Signed-off-by: Will Deacon commit fc511497101daf538355ab47ec36c377e524e65d Merge: b80c59af752348 32d4cedd24ed34 Author: Bartosz Golaszewski Date: Thu Sep 18 12:39:22 2025 +0200 Merge tag 'ib-mfd-gpio-input-pinctrl-pwm-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Pull changes from the immutable branch between MFD, GPIO, Input, Pinctrl and PWM trees containing the GPIO driver for max7360. commit 64d2616972b77506731fa0122d3c48cb04dbe21b Merge: b332fb727509c0 411d9d33c8a2cf Author: Paolo Abeni Date: Thu Sep 18 12:32:31 2025 +0200 Merge branch 'add-basic-psp-encryption-for-tcp-connections' Daniel Zahka says: ================== add basic PSP encryption for TCP connections This is v13 of the PSP RFC [1] posted by Jakub Kicinski one year ago. General developments since v1 include a fork of packetdrill [2] with support for PSP added, as well as some test cases, and an implementation of PSP key exchange and connection upgrade [3] integrated into the fbthrift RPC library. Both [2] and [3] have been tested on server platforms with PSP-capable CX7 NICs. Below is the cover letter from the original RFC: Add support for PSP encryption of TCP connections. PSP is a protocol out of Google: https://github.com/google/psp/blob/main/doc/PSP_Arch_Spec.pdf which shares some similarities with IPsec. I added some more info in the first patch so I'll keep it short here. The protocol can work in multiple modes including tunneling. But I'm mostly interested in using it as TLS replacement because of its superior offload characteristics. So this patch does three things: - it adds "core" PSP code PSP is offload-centric, and requires some additional care and feeding, so first chunk of the code exposes device info. This part can be reused by PSP implementations in xfrm, tunneling etc. - TCP integration TLS style Reuse some of the existing concepts from TLS offload, such as attaching crypto state to a socket, marking skbs as "decrypted", egress validation. PSP does not prescribe key exchange protocols. To use PSP as a more efficient TLS offload we intend to perform a TLS handshake ("inline" in the same TCP connection) and negotiate switching to PSP based on capabilities of both endpoints. This is also why I'm not including a software implementation. Nobody would use it in production, software TLS is faster, it has larger crypto records. - mlx5 implementation That's mostly other people's work, not 100% sure those folks consider it ready hence the RFC in the title. But it works :) Not posted, queued a branch [4] are follow up pieces: - standard stats - netdevsim implementation and tests [1] https://lore.kernel.org/netdev/20240510030435.120935-1-kuba@kernel.org/ [2] https://github.com/danieldzahka/packetdrill [3] https://github.com/danieldzahka/fbthrift/tree/dzahka/psp [4] https://github.com/kuba-moo/linux/tree/psp Comments we intend to defer to future series: - we prefer to keep the version field in the tx-assoc netlink request, because it makes parsing keys require less state early on, but we are willing to change in the next version of this series. - using a static branch to wrap psp_enqueue_set_decrypted() and other functions called from tcp. - using INDIRECT_CALL for tls/psp in sk_validate_xmit_skb(). We prefer to address this in a dedicated patch series, so that this series does not need to modify the way tls_validate_xmit_skb() is declared and stubbed out. v12: https://lore.kernel.org/netdev/20250916000559.1320151-1-kuba@kernel.org/ v11: https://lore.kernel.org/20250911014735.118695-1-daniel.zahka@gmail.com v10: https://lore.kernel.org/netdev/20250828162953.2707727-1-daniel.zahka@gmail.com/ v9: https://lore.kernel.org/netdev/20250827155340.2738246-1-daniel.zahka@gmail.com/ v8: https://lore.kernel.org/netdev/20250825200112.1750547-1-daniel.zahka@gmail.com/ v7: https://lore.kernel.org/netdev/20250820113120.992829-1-daniel.zahka@gmail.com/ v6: https://lore.kernel.org/netdev/20250812003009.2455540-1-daniel.zahka@gmail.com/ v5: https://lore.kernel.org/netdev/20250723203454.519540-1-daniel.zahka@gmail.com/ v4: https://lore.kernel.org/netdev/20250716144551.3646755-1-daniel.zahka@gmail.com/ v3: https://lore.kernel.org/netdev/20250702171326.3265825-1-daniel.zahka@gmail.com/ v2: https://lore.kernel.org/netdev/20250625135210.2975231-1-daniel.zahka@gmail.com/ v1: https://lore.kernel.org/netdev/20240510030435.120935-1-kuba@kernel.org/ ================== Links: https://patch.msgid.link/20250917000954.859376-1-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni --- * add-basic-psp-encryption-for-tcp-connections: net/mlx5e: Implement PSP key_rotate operation net/mlx5e: Add Rx data path offload psp: provide decapsulation and receive helper for drivers net/mlx5e: Configure PSP Rx flow steering rules net/mlx5e: Add PSP steering in local NIC RX net/mlx5e: Implement PSP Tx data path psp: provide encapsulation helper for drivers net/mlx5e: Implement PSP operations .assoc_add and .assoc_del net/mlx5e: Support PSP offload functionality psp: track generations of device key net: psp: update the TCP MSS to reflect PSP packet overhead net: psp: add socket security association code net: tcp: allow tcp_timewait_sock to validate skbs before handing to device net: move sk_validate_xmit_skb() to net/core/dev.c psp: add op for rotation of device key tcp: add datapath logic for PSP with inline key exchange net: modify core data structures for PSP datapath support psp: base PSP device support psp: add documentation commit b80c59af7523488ddcca63ae7f1874b8c5a6e1cd Merge: 0b1619c38600fc d463bb14058360 Author: Bartosz Golaszewski Date: Thu Sep 18 12:36:22 2025 +0200 Merge tag 'ib-mfd-gpio-hwmon-i2c-can-rtc-watchdog-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Pull changes from the immutable branch between MFD, GPIO, HWMON, I2C, CAN, RTC and Watchdog trees containing GPIO support for Nuvoton NCT6694. commit 411d9d33c8a2cf04a611cad948b24ed3f746230b Author: Raed Salem Date: Tue Sep 16 17:09:46 2025 -0700 net/mlx5e: Implement PSP key_rotate operation Implement .key_rotate operation where when invoked will cause the HW to use a new master key to derive PSP spi/key pairs with complience with PSP spec. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-20-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 29d7f433fcec02cb1a98695a3562a05dd183b044 Author: Raed Salem Date: Tue Sep 16 17:09:45 2025 -0700 net/mlx5e: Add Rx data path offload On receive flow inspect received packets for PSP offload indication using the cqe, for PSP offloaded packets set SKB PSP metadata i.e spi, header length and key generation number to stack for further processing. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-19-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 0eddb8023cee546eb05658ef3322234de8461f3b Author: Raed Salem Date: Tue Sep 16 17:09:44 2025 -0700 psp: provide decapsulation and receive helper for drivers Create psp_dev_rcv(), which drivers can call to psp decapsulate and attach a psp_skb_ext to an skb. psp_dev_rcv() only supports what the PSP architecture specification refers to as "transport mode" packets, where the L3 header is either IPv6 or IPv4. Reviewed-by: Willem de Bruijn Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-18-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 2b6e450bfde7b021bfb44c3c7b04d3b3a2bfe1bb Author: Raed Salem Date: Tue Sep 16 17:09:43 2025 -0700 net/mlx5e: Configure PSP Rx flow steering rules Set the Rx PSP flow steering rule where PSP packet is identified and decrypted using the dedicated UDP destination port number 1000. If packet is decrypted then a PSP marker and syndrome are added to metadata so SW can use it later on in Rx data path. The rule is set as part of init_rx netdev profile implementation. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-17-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 9536fbe10c9ded3f5ce37eda40650039aed5e2ac Author: Raed Salem Date: Tue Sep 16 17:09:42 2025 -0700 net/mlx5e: Add PSP steering in local NIC RX Introduce decrypt FT, the RX error FT, and the default rules. The PSP (PSP) RX decrypt flow table is pointed by the TTC (Traffic Type Classifier) UDP steering rules. The decrypt flow table has two flow groups. The first flow group keeps the decrypt steering rule programmed always when PSP packet is recognized using the dedicated udp destination port number 1000, if packet is decrypted then a PSP marker is set in metadata_regB[30]. The second flow group has a default rule to forward all non-offloaded PSP packet to the TTC UDP default RSS TIR. The RX error flow table is the destination of the decrypt steering rules in the PSP RX decrypt flow table. It has two fixed rule one with single copy action that copies psp_syndrome to metadata_regB[23:29]. The PSP marker and syndrome is used to filter out non-psp packet and to return the PSP crypto offload status in Rx flow. The marker is used to identify such packet in driver so the driver could set SKB PSP metadata. The destination of RX error flow table is the TTC UDP default RSS TIR. The second rule will drop packets that failed to be decrypted (like in case illegal SPI or expired SPI is used). Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-16-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit e5a1861a298eb386bf22c2cfc95b147f65c6071c Author: Raed Salem Date: Tue Sep 16 17:09:41 2025 -0700 net/mlx5e: Implement PSP Tx data path Setup PSP offload on Tx data path based on whether skb indicates that it is intended for PSP or not. Support driver side encapsulation of the UDP headers, PSP headers, and PSP trailer for the PSP traffic that will be encrypted by the NIC. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-15-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit fc724515741a1b86ca0457825fdb784ab038e92c Author: Raed Salem Date: Tue Sep 16 17:09:40 2025 -0700 psp: provide encapsulation helper for drivers Create a new function psp_encapsulate(), which takes a TCP packet and PSP encapsulates it according to the "Transport Mode Packet Format" section of the PSP Architecture Specification. psp_encapsulate() does not push a PSP trailer onto the skb. Both IPv6 and IPv4 are supported. Virtualization cookie is not included. Reviewed-by: Willem de Bruijn Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-14-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit af2196f494808e236362b3b126e8b09489093102 Author: Raed Salem Date: Tue Sep 16 17:09:39 2025 -0700 net/mlx5e: Implement PSP operations .assoc_add and .assoc_del Implement .assoc_add and .assoc_del PSP operations used in the tx control path. Allocate the relevant hardware resources when a new key is registered using .assoc_add. Destroy the key when .assoc_del is called. Use a atomic counter to keep track of the current number of keys being used by the device. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-13-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 89ee2d92f66c45625ff1c173df2dbdea32568c5d Author: Raed Salem Date: Tue Sep 16 17:09:38 2025 -0700 net/mlx5e: Support PSP offload functionality Add PSP offload related structs, layouts, and enumerations. Implement .set_config and .rx_spi_alloc PSP device operations. Driver does not need to make use of the .set_config operation. Stub .assoc_add and .assoc_del PSP operations. Introduce the MLX5_EN_PSP configuration option for enabling PSP offload support on mlx5 devices. Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Cosmin Ratiu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250917000954.859376-12-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit e78851058b35deb9f2d60ecf698fbf7ae7790d09 Author: Jakub Kicinski Date: Tue Sep 16 17:09:37 2025 -0700 psp: track generations of device key There is a (somewhat theoretical in absence of multi-host support) possibility that another entity will rotate the key and we won't know. This may lead to accepting packets with matching SPI but which used different crypto keys than we expected. The PSP Architecture specification mentions that an implementation should track device key generation when device keys are managed by the NIC. Some PSP implementations may opt to include this key generation state in decryption metadata each time a device key is used to decrypt a packet. If that is the case, that key generation counter can also be used when policy checking a decrypted skb against a psp_assoc. This is an optional feature that is not explicitly part of the PSP spec, but can provide additional security in the case where an attacker may have the ability to force key rotations faster than rekeying can occur. Since we're tracking "key generations" more explicitly now, maintain different lists for associations from different generations. This way we can catch stale associations (the user space should listen to rotation notifications and change the keys). Drivers can "opt out" of generation tracking by setting the generation value to 0. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-11-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit e97269257fe437910cddc7c642a636ca3cf9fb1d Author: Jakub Kicinski Date: Tue Sep 16 17:09:36 2025 -0700 net: psp: update the TCP MSS to reflect PSP packet overhead PSP eats 40B of header space. Adjust MSS appropriately. We can either modify tcp_mtu_to_mss() / tcp_mss_to_mtu() or reuse icsk_ext_hdr_len. The former option is more TCP specific and has runtime overhead. The latter is a bit of a hack as PSP is not an ext_hdr. If one squints hard enough, UDP encap is just a more practical version of IPv6 exthdr, so go with the latter. Happy to change. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-10-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 6b46ca260e2290e3453d1355ab5b6d283d73d780 Author: Jakub Kicinski Date: Tue Sep 16 17:09:35 2025 -0700 net: psp: add socket security association code Add the ability to install PSP Rx and Tx crypto keys on TCP connections. Netlink ops are provided for both operations. Rx side combines allocating a new Rx key and installing it on the socket. Theoretically these are separate actions, but in practice they will always be used one after the other. We can add distinct "alloc" and "install" ops later. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-9-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 0917bb139eed467a6376db903ad7a67981ec1420 Author: Daniel Zahka Date: Tue Sep 16 17:09:34 2025 -0700 net: tcp: allow tcp_timewait_sock to validate skbs before handing to device Provide a callback to validate skb's originating from tcp timewait socks before passing to the device layer. Full socks have a sk_validate_xmit_skb member for checking that a device is capable of performing offloads required for transmitting an skb. With psp, tcp timewait socks will inherit the crypto state from their corresponding full socks. Any ACKs or RSTs that originate from a tcp timewait sock carrying psp state should be psp encapsulated. Reviewed-by: Willem de Bruijn Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-8-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 8c511c1df380780b8a81050767dbfe7ca518d3a2 Author: Daniel Zahka Date: Tue Sep 16 17:09:33 2025 -0700 net: move sk_validate_xmit_skb() to net/core/dev.c Move definition of sk_validate_xmit_skb() from net/core/sock.c to net/core/dev.c. This change is in preparation of the next patch, where sk_validate_xmit_skb() will need to cast sk to a tcp_timewait_sock *, and access member fields. Including linux/tcp.h from linux/sock.h creates a circular dependency, and dev.c is the only current call site of this function. Reviewed-by: Willem de Bruijn Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-7-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 117f02a49b7719b210d154a0d0e728001bf4af06 Author: Jakub Kicinski Date: Tue Sep 16 17:09:32 2025 -0700 psp: add op for rotation of device key Rotating the device key is a key part of the PSP protocol design. Some external daemon needs to do it once a day, or so. Add a netlink op to perform this operation. Add a notification group for informing users that key has been rotated and they should rekey (next rotation will cut them off). Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-6-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 659a2899a57da59f433182eba571881884d6323e Author: Jakub Kicinski Date: Tue Sep 16 17:09:31 2025 -0700 tcp: add datapath logic for PSP with inline key exchange Add validation points and state propagation to support PSP key exchange inline, on TCP connections. The expectation is that application will use some well established mechanism like TLS handshake to establish a secure channel over the connection and if both endpoints are PSP-capable - exchange and install PSP keys. Because the connection can existing in PSP-unsecured and PSP-secured state we need to make sure that there are no race conditions or retransmission leaks. On Tx - mark packets with the skb->decrypted bit when PSP key is at the enqueue time. Drivers should only encrypt packets with this bit set. This prevents retransmissions getting encrypted when original transmission was not. Similarly to TLS, we'll use sk->sk_validate_xmit_skb to make sure PSP skbs can't "escape" via a PSP-unaware device without being encrypted. On Rx - validation is done under socket lock. This moves the validation point later than xfrm, for example. Please see the documentation patch for more details on the flow of securing a connection, but for the purpose of this patch what's important is that we want to enforce the invariant that once connection is secured any skb in the receive queue has been encrypted with PSP. Add GRO and coalescing checks to prevent PSP authenticated data from being combined with cleartext data, or data with non-matching PSP state. On Rx, check skb's with psp_skb_coalesce_diff() at points before psp_sk_rx_policy_check(). After skb's are policy checked and on the socket receive queue, skb_cmp_decrypted() is sufficient for checking for coalescable PSP state. On Tx, tcp_write_collapse_fence() should be called when transitioning a socket into PSP Tx state to prevent data sent as cleartext from being coalesced with PSP encapsulated data. This change only adds the validation points, for ease of review. Subsequent change will add the ability to install keys, and flesh the enforcement logic out Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-5-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit ed8a507b748336902525aa79e3573552534e8b3e Author: Jakub Kicinski Date: Tue Sep 16 17:09:30 2025 -0700 net: modify core data structures for PSP datapath support Add pointers to psp data structures to core networking structs, and an SKB extension to carry the PSP information from the drivers to the socket layer. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-4-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit 00c94ca2b99e6610e483f92e531b319eeaed94aa Author: Jakub Kicinski Date: Tue Sep 16 17:09:29 2025 -0700 psp: base PSP device support Add a netlink family for PSP and allow drivers to register support. The "PSP device" is its own object. This allows us to perform more flexible reference counting / lifetime control than if PSP information was part of net_device. In the future we should also be able to "delegate" PSP access to software devices, such as *vlan, veth or netkit more easily. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-3-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit a9266275fd7b309067fd132982035270fee6dc06 Author: Jakub Kicinski Date: Tue Sep 16 17:09:28 2025 -0700 psp: add documentation Add documentation of things which belong in the docs rather than commit messages. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250917000954.859376-2-daniel.zahka@gmail.com Signed-off-by: Paolo Abeni commit b332fb727509c0d38e18dd16f36d166f1c9ede88 Merge: 18cfe3c1a121c2 e6afcd60c26fca Author: Paolo Abeni Date: Thu Sep 18 11:37:25 2025 +0200 Merge branch 'eth-fbnic-add-devlink-health-support-for-fw-crashes-and-otp-mem-corruptions' Jakub Kicinski says: ==================== eth: fbnic: add devlink health support for FW crashes and OTP mem corruptions Add support for FW crash detection and a corresponding devlink health reporter. Add a reporter for checking OTP memory health. The output is not particularly exciting: # devlink health show pci/0000:01:00.0: reporter fw state healthy error 0 recover 0 auto_dump true reporter otp state healthy error 0 recover 0 auto_dump true # devlink health diagnose pci/0000:01:00.0 reporter fw FW uptime: 0 # devlink health dump show pci/0000:01:00.0 reporter fw FW coredump: 5a 45 01 00 04 00 06 00 00 00 00 00 4d 01 00 d0 .. lots of hex follows .. # devlink health dump show pci/0000:01:00.0 reporter otp OTP: Status: 0 Data: 0 ECC: 0 v2: https://lore.kernel.org/20250915155312.1083292-1-kuba@kernel.org v1: https://lore.kernel.org/20250912201428.566190-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250916231420.1693955-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit e6afcd60c26fca227c700825a94020209970c05e Author: Jakub Kicinski Date: Tue Sep 16 16:14:20 2025 -0700 eth: fbnic: add OTP health reporter OTP memory ("fuses") are used for secure boot and anti-rollback protection. The OTP memory is ECC protected. Check for its health periodically to notice when the chip is starting to go bad. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250916231420.1693955-10-kuba@kernel.org Signed-off-by: Paolo Abeni commit 6da8344f92dfc607069ed10ed5ba76b61e612691 Author: Jakub Kicinski Date: Tue Sep 16 16:14:19 2025 -0700 eth: fbnic: report FW uptime in health diagnose FW crashes are detected based on uptime going back, expose the uptime via devlink health diagnose. $ devlink -j health diagnose pci/0000:01:00.0 reporter fw {"last_heartbeat":{"fw_uptime":{"sec":201,"msec":76}}} $ devlink -j health diagnose pci/0000:01:00.0 reporter fw last_heartbeat: fw_uptime: sec: 201 msec: 76 Reviewed-by: Lee Trager Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250916231420.1693955-9-kuba@kernel.org Signed-off-by: Paolo Abeni commit 005a54722e9d493be58405a77f2a444e06f03be0 Author: Jakub Kicinski Date: Tue Sep 16 16:14:18 2025 -0700 eth: fbnic: add FW health reporter Add a health reporter to catch FW crashes. Dumping the reporter if FW has not crashed will create a snapshot of FW memory. Reviewed-by: Lee Trager Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-8-kuba@kernel.org Signed-off-by: Paolo Abeni commit 5df1d0a08483eff13f0da1cc66883e0bc2cf4fcf Author: Jakub Kicinski Date: Tue Sep 16 16:14:17 2025 -0700 eth: fbnic: support FW communication for core dump To read FW core dump we need to issue two commands to FW: - first get the FW core dump info - second read the dump chunk by chunk Implement these two FW commands. Subsequent commits will use them to expose FW dump via devlink heath. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-7-kuba@kernel.org Signed-off-by: Paolo Abeni commit a8896d14fc0c1f1b8d532be5605c05440b15d881 Author: Jakub Kicinski Date: Tue Sep 16 16:14:16 2025 -0700 eth: fbnic: support allocating FW completions with extra space Support allocating extra space after the FW completion. This makes it easy to pass extra variable size buffer space to FW response handlers without worrying about synchronization (completion itself is already refcounted). Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 6ae7da8e9e069ff63ceea9953d53920b136ff008 Author: Jakub Kicinski Date: Tue Sep 16 16:14:15 2025 -0700 eth: fbnic: reprogram TCAMs after FW crash FW may mess with the TCAM after it boots, to try to restore the traffic flow to the BMC (it may not be aware that the host is already up). Make sure that we reprogram the TCAMs after detecting a crash. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit 504f8b7119eb44a9b04b5249356405ebb302e382 Author: Jakub Kicinski Date: Tue Sep 16 16:14:14 2025 -0700 eth: fbnic: factor out clearing the action TCAM We'll want to wipe the driver TCAM state after FW crash, to force a re-programming. Factor out the clearing logic. Remove the micro- -optimization to skip clearing the BMC entry twice, it doesn't hurt. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 7fd1f7bac2b878eb203fb316e03e1b87e8b86f6e Author: Jakub Kicinski Date: Tue Sep 16 16:14:13 2025 -0700 eth: fbnic: use fw uptime to detect fw crashes Currently we only detect FW crashes when it stops responding to heartbeat messages. FW has a watchdog which will reset it in case of crashes. Use FW uptime sent in the ownership and heartbeat messages to detect that the watchdog has fired (uptime went down). Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit e6c8ab0a11293ac44a2d5550cafaf775ccf64ea0 Author: Jakub Kicinski Date: Tue Sep 16 16:14:12 2025 -0700 eth: fbnic: make fbnic_fw_log_write() parameter const Make the log message parameter const, it's not modified and this lets us pass in strings which are const for the caller. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916231420.1693955-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit a3d076b0567e729d5f21a95525c4d096b1f59e79 Author: Akiva Goldberger Date: Wed Sep 17 16:27:58 2025 +0300 net/mlx5: Add uar access and odp page fault counters Add bar_uar_access, odp_local_triggered_page_fault, and odp_remote_triggered_page_fault counters to the query_vnic_env command. Additionally, add corresponding capabilities bits to the HCA CAP. Signed-off-by: Akiva Goldberger Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758115678-643464-1-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 1428cd764cd708d53a072a2f208d87014bfe05bc Author: Vlad Dumitrescu Date: Tue Sep 16 19:31:12 2025 +0300 IB/sa: Fix sa_local_svc_timeout_ms read race When computing the delta, the sa_local_svc_timeout_ms is read without ib_nl_request_lock held. Though unlikely in practice, this can cause a race condition if multiple local service threads are managing the timeout. Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") Signed-off-by: Vlad Dumitrescu Reviewed-by: Mark Zhang Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com Signed-off-by: Leon Romanovsky commit 42f993d3439827c4959ea77e60620d7ebfb3a477 Author: Vlad Dumitrescu Date: Tue Sep 16 14:11:03 2025 +0300 IB/ipoib: Ignore L3 master device Currently, all master upper netdevices (e.g., bond, VRF) are treated equally. When a VRF netdevice is used over an IPoIB netdevice, the expected netdev resolution is on the lower IPoIB device which has the IP address assigned to it and not the VRF device. The rdma_cm module (CMA) tries to match incoming requests to a particular netdevice. When successful, it also validates that the return path points to the same device by performing a routing table lookup. Currently, the former would resolve to the VRF netdevice, while the latter to the correct lower IPoIB netdevice, leading to failure in rdma_cm. Improve this by ignoring the VRF master netdevice, if it exists, and instead return the lower IPoIB device. Signed-off-by: Vlad Dumitrescu Reviewed-by: Parav Pandit Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250916111103.84069-5-edwards@nvidia.com Signed-off-by: Leon Romanovsky commit c31e4038c97f355967bf906c0b6914edb4f20d75 Author: Parav Pandit Date: Tue Sep 16 14:11:02 2025 +0300 RDMA/core: Use route entry flag to decide on loopback traffic addr_resolve() considers a destination to be local if the next-hop device of the resolved route for the destination is the loopback netdevice. This fails when the source and destination IP addresses belong to a netdev enslaved to a VRF netdev. In this case the next-hop device is the VRF itself: $ ip link add name myvrf up type vrf table 100 $ ip link set ens2f0np0 master myvrf up $ ip addr add 192.168.1.1/24 dev ens2f0np0 $ ip route get 192.168.1.1 oif myvrf local 192.168.1.1 dev myvrf table 100 src 192.168.1.1 uid 0 cache This results in packets being generated with an incorrect destination MAC of the VRF netdevice and ib_write_bw failing with timeout. Solve this by determining if a destination is local or not based on the resolved route's type rather than based on its next-hop netdevice loopback flag. This enables to resolve loopback traffic with and without VRF configurations in a uniform way. Signed-off-by: Parav Pandit Reviewed-by: Vlad Dumitrescu Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250916111103.84069-4-edwards@nvidia.com Signed-off-by: Leon Romanovsky commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab Author: Parav Pandit Date: Tue Sep 16 14:11:01 2025 +0300 RDMA/core: Resolve MAC of next-hop device without ARP support Currently, if the next-hop netdevice does not support ARP resolution, the destination MAC address is silently set to zero without reporting an error. This leads to incorrect behavior and may result in packet transmission failures. Fix this by deferring MAC resolution to the IP stack via neighbour lookup, allowing proper resolution or error reporting as appropriate. Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") Signed-off-by: Parav Pandit Reviewed-by: Vlad Dumitrescu Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com Signed-off-by: Leon Romanovsky commit fa29d1e8877bcfb9813efc7d0138e01ca07f1863 Author: Parav Pandit Date: Tue Sep 16 14:11:00 2025 +0300 RDMA/core: Squash a single user static function To reduce dependencies in IFF_LOOPBACK in route and neighbour resolution steps, squash the static function to its single caller and simplify the code. Until now, network field was set even when neighbour resolution failed. With this change, dev_addr output fields are valid only when resolution is successful. Signed-off-by: Parav Pandit Reviewed-by: Vlad Dumitrescu Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250916111103.84069-2-edwards@nvidia.com Signed-off-by: Leon Romanovsky commit 9da45d978ccbe00e967093a0c0dc962c28c65734 Author: Janne Grunau Date: Sun Sep 14 21:38:48 2025 +0200 arm64: dts: apple: Add J474s, J475c and J475d device trees Add device trees for the M2 Pro Mac mini and the M2 Max and Ultra Mac Studio. These devices are very similar to the M1 Max and Ultra Mac Studio so reuse the device template, include the .dtsi for the new SoCs and correct for the minimal differences. Co-developed-by: Hector Martin Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit 44a952585b4b530099f60fa076e35f29619f3e78 Author: Hector Martin Date: Sun Sep 14 21:38:47 2025 +0200 arm64: dts: apple: Add J414 and J416 Macbook Pro device trees Add device trees for the T6020 and T6021 based Macbook Pros (M2 Pro/Max, 14/16-inch). The devices are very similar to the T6000/T6001 based ones so reuse the device templates, include the new SoCs and correct for the minimal differences. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Co-developed-by: Janne Grunau Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit a8f20eb60788ab2dcf311b83e875c77c89dd298b Author: Hector Martin Date: Sun Sep 14 21:38:46 2025 +0200 arm64: dts: apple: Add initial t6020/t6021/t6022 DTs These SoCs are found in Apple devices with M2 Pro (t6020), M2 Max (t6021) and M2 Ultra (t6022) and follow the pattern of their M1 counterparts. t6020 is a cut-down version of t6021, so the former just includes the latter and disables the missing bits (This is currently just one PMGR node and all of its domains). t6022 is two connected t6021 dies. The implementation seems to use t6021 with blocks disabled (mostly on the second die). MMIO addresses on the second die have a constant offset. The interrupt controller is multi-die aware. This setup can be represented in the device tree with two top level "soc" nodes. The MMIO offset is applied via "ranges" and devices are included with preproceesor macros to make the node labels unique and to specify the die number for the interrupt definition. Device nodes are distributed over dtsi files based on whether they are present on both dies or just on the first die. The only exception is the NVMe controller which resides on the second die. Its nodes are in a separate file. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Co-developed-by: Janne Grunau Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit 6313115c55f44f7bee3f469c91d3de60d724eabd Author: Janne Grunau Date: Sun Sep 14 21:38:45 2025 +0200 arm64: dts: apple: Add ethernet0 alias for J375 template The alias is used by the boot loader to fill the MAC address. Fixes: aaa1d42a4ce3 ("arm64: dts: apple: Add J375 devicetrees") Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit 28f94ed138c347504c1b1b94291da8a9a398e0d7 Author: Janne Grunau Date: Sun Sep 14 21:38:44 2025 +0200 dt-bindings: arm: apple: Add t6020x compatibles This adds the following apple,t6020/t6021/t6022 platforms: - apple,j414s - MacBook Pro (14-inch, M2 Pro, 2023) - apple,j414c - MacBook Pro (14-inch, M2 Nax, 2023) - apple,j416s - MacBook Pro (16-inch, M2 Pro, 2023) - apple,j416c - MacBook Pro (16-inch, M2 Max, 2023) - apple,j474s - Mac mini (M2 Pro, 2023) - apple,j475c - Mac Studio (M2 Max, 2023) - apple,j475d - Mac Studio (M2 Ultra, 2023) - apple,j475d - Mac Pro (M2 Ultra, 2023) Acked-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Signed-off-by: Sven Peter commit 060842fed53f77a73824c9147f51dc6746c1267a Author: Tatyana Nikolova Date: Wed Aug 27 10:25:45 2025 -0500 RDMA/irdma: Update Kconfig Update Kconfig to add dependency on idpf module and add IPU E2000 to the list of supported devices. Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 42f1d099093bc2ad6e6b1d631e1fd9bdbacdddb1 Author: Shiraz Saleem Date: Wed Aug 27 10:25:44 2025 -0500 RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices Enhance the CQE error and flush handling specific to GEN3 devices. Unlike GEN1/2 devices, which depend on software to generate completions in error, GEN3 devices leverage firmware to generate CQEs in error for all WQEs posted after a QP moves to an error state. Key changes include: - Updating the CQ poll logic to properly advance the CQ head in the event of a flush CQE. - Updating the flush logic for GEN3 to pass error WQE idx for SQ on an AE to flush out unprocessed WQEs in error. - Isolating the decoding of AE to flush codes into a separate routine irdma_ae_to_qp_err_code. This routine can now be leveraged to flush error CQEs on an AE and when error CQE is received for SRQ. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-16-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit a24a29c8747f75c4b6967e689c2ca82445ccc9b1 Author: Faisal Latif Date: Wed Aug 27 10:25:43 2025 -0500 RDMA/irdma: Add Atomic Operations support Extend irdma to support atomic operations, namely Compare and Swap and Fetch and Add, for GEN3 devices. Signed-off-by: Faisal Latif Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-15-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit eb31dfc2b41a1bccd697b57ad6f059534fbd5b71 Author: Shiraz Saleem Date: Wed Aug 27 10:25:42 2025 -0500 RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3 With the deprecation of Memory Window and Timestamping support in GEN2, move these features to be exclusive to GEN3. This iteration supports only Type2 Memory Windows. Additionally, it includes the reporting of the timestamp mask and Host Channel Adapter (HCA) core clock frequency via the query device verb. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-14-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 563e1feb5f6ed579acb55850f1bbb831aecf645a Author: Faisal Latif Date: Wed Aug 27 10:25:41 2025 -0500 RDMA/irdma: Add SRQ support Implement verb API and UAPI changes to support SRQ functionality in GEN3 devices. Signed-off-by: Faisal Latif Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-13-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 9a1d68786393c4767bf153c73dbcd1ac6c5ecdfe Author: Shiraz Saleem Date: Wed Aug 27 10:25:40 2025 -0500 RDMA/irdma: Support 64-byte CQEs and GEN3 CQE opcode decoding Introduce support for 64-byte CQEs in GEN3 devices. Additionally, implement GEN3-specific CQE opcode decoding. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-12-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 419afdd122ea39a0a98401b2688eed0678b67000 Author: Vinoth Kumar Chandra Mohan Date: Wed Aug 27 10:25:39 2025 -0500 RDMA/irdma: Add support for V2 HMC resource management scheme HMC resource initialization is updated to support V1 or V2 approach based on the FW capability. In the V2 approach, driver receives the assigned HMC resources count and verifies if it will fit in the given local memory. If it doesn't fit, the driver load fails. Signed-off-by: Vinoth Kumar Chandra Mohan Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-11-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 87f413b6c930bec82a3831b499d013d59c83eb19 Author: Shiraz Saleem Date: Wed Aug 27 10:25:38 2025 -0500 RDMA/irdma: Extend QP context programming for GEN3 Extend the QP context structure with support for new fields specific to GEN3 hardware capabilities. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-10-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit d6ed4b69b8ea756200432099b9a525f23d2a4c56 Author: Shiraz Saleem Date: Wed Aug 27 10:25:37 2025 -0500 RDMA/irdma: Add GEN3 virtual QP1 support Add a new RDMA virtual channel op during QP1 creation that allow the Control Plane (CP) to virtualize a regular QP as QP1 on non-default RDMA capable vPorts. Additionally, the CP will return the Qsets to use on the ib_device of the vPort. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-9-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 2ad49ae7330b8a456edf639c92241a343641a763 Author: Mustafa Ismail Date: Wed Aug 27 10:25:36 2025 -0500 RDMA/irdma: Introduce GEN3 vPort driver support In the IPU model, a function can host one or more logical network endpoints called vPorts. Each vPort may be associated with either a physical or an internal communication port, and can be RDMA capable. A vPort features a netdev and, if RDMA capable, must have an associated ib_dev. This change introduces a GEN3 auxiliary vPort driver responsible for registering a verbs device for every RDMA-capable vPort. Additionally, the UAPI is updated to prevent the binding of GEN3 devices to older user-space providers. Signed-off-by: Mustafa Ismail Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-8-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit da278cb29c41dc2d8344d62238de339db6695132 Author: Krzysztof Czurylo Date: Wed Aug 27 10:25:35 2025 -0500 RDMA/irdma: Add GEN3 HW statistics support Plug into the unified HW statistics framework by adding a hardware statistics map array for GEN3, defining the HW-specific width and location for each counter in the statistics buffer. Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-7-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit b800e82feba7bd758f6564975e9f9995866162e3 Author: Shiraz Saleem Date: Wed Aug 27 10:25:34 2025 -0500 RDMA/irdma: Add GEN3 support for AEQ and CEQ Extend support for GEN3 devices by programming the necessary hardware IRQ registers and the updated descriptor fields for the Asynchronous Event Queue (AEQ) and Completion Event Queue (CEQ). Introduce a RDMA virtual channel operation with the Control Plane (CP) to associate interrupt vectors appropriately with AEQ and CEQ. Add new Asynchronous Event (AE) definitions specific to GEN3. Additionally, refactor the AEQ and CEQ setup into the irdma_ctrl_init_hw device control initialization routine. This completes the PCI device level initialization for RDMA in the core driver. Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-6-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit c7db0abe5f2bbfa99a080b344e6f70a3d6d0ea38 Author: Krzysztof Czurylo Date: Wed Aug 27 10:25:33 2025 -0500 RDMA/irdma: Add GEN3 CQP support with deferred completions GEN3 introduces asynchronous handling of Control QP (CQP) operations to minimize head-of-line blocking. Create the CQP using the updated GEN3- specific descriptor fields and implement the necessary support for this deferred completion mechanism. Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-5-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 7d5a7cc7b9989d7f4507b89cbff35df75959e0d9 Author: Christopher Bednarz Date: Wed Aug 27 10:25:32 2025 -0500 RDMA/irdma: Discover and set up GEN3 hardware register layout Discover the hardware register layout for GEN3 devices through an RDMA virtual channel operation with the Control Plane (CP). Set up the corresponding hardware attributes specific to GEN3 devices. Signed-off-by: Christopher Bednarz Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-4-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit d5edd33364a59795a3e3ba83bcdabe591a4b9931 Author: Mustafa Ismail Date: Wed Aug 27 10:25:31 2025 -0500 RDMA/irdma: Add GEN3 core driver support Introduce support for the GEN3 auxiliary core driver, which is responsible for initializing PCI-level RDMA resources. Facilitate host-driver communication with the device's Control Plane (CP) to discover capabilities and perform privileged operations through an RDMA-specific messaging interface built atop the IDPF mailbox and virtual channel protocol. Establish the RDMA virtual channel message interface and incorporate operations to retrieve the hardware version and discover capabilities from the CP. Additionally, set up the RDMA MMIO regions and initialize the RF structure. Signed-off-by: Mustafa Ismail Co-developed-by: Tatyana Nikolova Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-3-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 0c2b80cac96e199674de464a4b619bebab3d7761 Author: Mustafa Ismail Date: Wed Aug 27 10:25:30 2025 -0500 RDMA/irdma: Refactor GEN2 auxiliary driver Refactor the irdma auxiliary driver and associated interfaces out of main.c and into a standalone GEN2-specific source file and rename as gen_2 driver. This is in preparation for adding GEN3 auxiliary drivers. Each HW generation will have its own gen-specific interface file. Additionally, move the Address Handle hash table and associated locks under rf struct. This will allow GEN3 code to migrate to use it easily. Signed-off-by: Mustafa Ismail Co-developed-by: Tatyana Nikolova Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20250827152545.2056-2-tatyana.e.nikolova@intel.com Tested-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 18cfe3c1a121c275fb0a86dd7b0c049c6dd0a038 Author: Yury Norov (NVIDIA) Date: Tue Sep 16 12:35:16 2025 -0400 net: renesas: rswitch: simplify rswitch_stop() rswitch_stop() opencodes for_each_set_bit(). CC: Simon Horman Reviewed-by: Nikita Yushchenko Signed-off-by: Yury Norov (NVIDIA) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250916163516.486827-1-yury.norov@gmail.com Signed-off-by: Paolo Abeni commit b8df622cf7f6808c85764e681847150ed6d85f3d Author: Linus Walleij Date: Tue Sep 16 18:07:37 2025 +0200 mtd: rawnand: fsmc: Default to autodetect buswidth If you don't specify buswidth 2 (16 bits) in the device tree, FSMC doesn't even probe anymore: fsmc-nand 10100000.flash: FSMC device partno 090, manufacturer 80, revision 00, config 00 nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1 nand: ST Micro 10100000.flash nand: bus width 8 instead of 16 bits nand: No NAND device found fsmc-nand 10100000.flash: probe with driver fsmc-nand failed with error -22 With this patch to use autodetection unless buswidth is specified, the device is properly detected again: fsmc-nand 10100000.flash: FSMC device partno 090, manufacturer 80, revision 00, config 00 nand: device found, Manufacturer ID: 0x20, Chip ID: 0xb1 nand: ST Micro NAND 128MiB 1,8V 16-bit nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 fsmc-nand 10100000.flash: Using 1-bit HW ECC scheme Scanning device for bad blocks I don't know where or how this happened, I think some change in the nand core. Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Signed-off-by: Miquel Raynal commit 6b88293aae7fb78872e5cc1ec36e2f750ae12e38 Author: Markus Stockhausen Date: Wed Sep 10 14:32:58 2025 -0400 mtd: nand: move nand_check_erased_ecc_chunk() to nand/core The check function for bitflips in erased blocks will be needed by the Realtek ECC engine driver (which is currently under development). Right now it is located in raw/nand_base.c. While this is sufficient for the current usecases, there is no real dependency for an ECC engine on the raw nand library. Move the function over to a more generic place in core library. Suggested-by: Miquel Raynal Signed-off-by: Markus Stockhausen Signed-off-by: Miquel Raynal commit 01adc8207cf3c42c5cf389be7578fd726ef26fe1 Author: Miquel Raynal Date: Wed Sep 10 14:36:45 2025 +0200 mtd: nand: ecc-mxic: Lower log level during init A working init shall be silent rather than exposing the configuration with kernel messages at the error level. Thwart myself from the past and use the debug level for these. Signed-off-by: Miquel Raynal commit ce463e4357570096bc0b348d872e0205826a04ce Merge: b127e355f1af1e 6471658dc66c67 Author: Paolo Abeni Date: Thu Sep 18 10:17:12 2025 +0200 Merge branch 'udp-increase-rx-performance-under-stress' Eric Dumazet says: ==================== udp: increase RX performance under stress This series is the result of careful analysis of UDP stack, to optimize the receive side, especially when under one or several UDP sockets are receiving a DDOS attack. I have measured a 47 % increase of throughput when using IPv6 UDP packets with 120 bytes of payload, under DDOS. 16 cpus are receiving traffic targeting a single socket. Even after adding NUMA aware drop counters, we were suffering from false sharing between packet producers and the consumer. 1) First four patches are shrinking struct ipv6_pinfo size and reorganize fields to get more efficient TX path. They should also benefit TCP, by removing one cache line miss. 2) patches 5 & 6 changes how sk->sk_rmem_alloc is read and updated. They reduce reduce spinlock contention on the busylock. 3) Patches 7 & 8 change the ordering of sk_backlog (including sk_rmem_alloc) sk_receive_queue and sk_drop_counters for better data locality. 4) Patch 9 removes the hashed array of spinlocks in favor of a per-udp-socket one. 5) Final patch adopts skb_attempt_defer_free(), after TCP got good results with it. ==================== Link: https://patch.msgid.link/20250916160951.541279-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 6471658dc66c670580a7616e75f51b52917e7883 Author: Eric Dumazet Date: Tue Sep 16 16:09:51 2025 +0000 udp: use skb_attempt_defer_free() Move skb freeing from udp recvmsg() path to the cpu which allocated/received it, as TCP did in linux-5.17. This increases max thoughput by 20% to 30%, depending on number of BH producers. Signed-off-by: Eric Dumazet Acked-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-11-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 3cd04c8f4afed71a48edef0db5255afc249c2feb Author: Eric Dumazet Date: Tue Sep 16 16:09:50 2025 +0000 udp: make busylock per socket While having all spinlocks packed into an array was a space saver, this also caused NUMA imbalance and hash collisions. UDPv6 socket size becomes 1600 after this patch. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-10-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 9db27c80622bd612549ea213390500f7377ee3e1 Author: Eric Dumazet Date: Tue Sep 16 16:09:49 2025 +0000 udp: add udp_drops_inc() helper Generic sk_drops_inc() reads sk->sk_drop_counters. We know the precise location for UDP sockets. Move sk_drop_counters out of sock_read_rxtx so that sock_write_rxtx starts at a cache line boundary. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-9-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 4effb335b5dab08cb6e2c38d038910f8b527cfc9 Author: Eric Dumazet Date: Tue Sep 16 16:09:48 2025 +0000 net: group sk_backlog and sk_receive_queue UDP receivers suffer from sk_rmem_alloc updates, currently sharing a cache line with fields that need to be read-mostly (sock_read_rx group): 1) RFS enabled hosts read sk_napi_id from __udpv6_queue_rcv_skb(). 2) sk->sk_rcvbuf is read from __udp_enqueue_schedule_skb() /* --- cacheline 3 boundary (192 bytes) --- */ struct { atomic_t rmem_alloc; /* 0xc0 0x4 */ // Oops int len; /* 0xc4 0x4 */ struct sk_buff * head; /* 0xc8 0x8 */ struct sk_buff * tail; /* 0xd0 0x8 */ } sk_backlog; /* 0xc0 0x18 */ __u8 __cacheline_group_end__sock_write_rx[0]; /* 0xd8 0 */ __u8 __cacheline_group_begin__sock_read_rx[0]; /* 0xd8 0 */ struct dst_entry * sk_rx_dst; /* 0xd8 0x8 */ int sk_rx_dst_ifindex;/* 0xe0 0x4 */ u32 sk_rx_dst_cookie; /* 0xe4 0x4 */ unsigned int sk_ll_usec; /* 0xe8 0x4 */ unsigned int sk_napi_id; /* 0xec 0x4 */ u16 sk_busy_poll_budget;/* 0xf0 0x2 */ u8 sk_prefer_busy_poll;/* 0xf2 0x1 */ u8 sk_userlocks; /* 0xf3 0x1 */ int sk_rcvbuf; /* 0xf4 0x4 */ struct sk_filter * sk_filter; /* 0xf8 0x8 */ Move sk_error (which is less often dirtied) there. Alternative would be to cache align sock_read_rx but this has more implications/risks. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-8-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit faf7b4aefd5be1d1b460e2161b8f730e03abb9b9 Author: Eric Dumazet Date: Tue Sep 16 16:09:47 2025 +0000 udp: update sk_rmem_alloc before busylock acquisition Avoid piling too many producers on the busylock by updating sk_rmem_alloc before busylock acquisition. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250916160951.541279-7-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 9aaec660b5be29f23aaa7d1b0ae426b895dc0ca5 Author: Eric Dumazet Date: Tue Sep 16 16:09:46 2025 +0000 udp: refine __udp_enqueue_schedule_skb() test Commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc.") allowed to slightly overshoot sk->sk_rmem_alloc, when many cpus are trying to feed packets to a common UDP socket. This patch, combined with the following one reduces false sharing on the victim socket under DDOS. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250916160951.541279-6-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit b76543b21fbcfbb96332fd80cc0d85bbcd72d8f0 Author: Eric Dumazet Date: Tue Sep 16 16:09:45 2025 +0000 ipv6: reorganise struct ipv6_pinfo Move fields used in tx fast path at the beginning of the structure, and seldom used ones at the end. Note that rxopt is also in the first cache line. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-5-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 Author: Eric Dumazet Date: Tue Sep 16 16:09:44 2025 +0000 ipv6: np->rxpmtu race annotation Add READ_ONCE() annotations because np->rxpmtu can be changed while udpv6_recvmsg() and rawv6_recvmsg() read it. Since this is a very rarely used feature, and that udpv6_recvmsg() and rawv6_recvmsg() read np->rxopt anyway, change the test order so that np->rxpmtu does not need to be in a hot cache line. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 5489f333ef993bfceebce9ae98944f04eaafcc30 Author: Eric Dumazet Date: Tue Sep 16 16:09:43 2025 +0000 ipv6: make ipv6_pinfo.daddr_cache a boolean ipv6_pinfo.daddr_cache is either NULL or &sk->sk_v6_daddr We do not need 8 bytes, a boolean is enough. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-3-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit 3fbb2a6f3a70c27a6a2be80d131970608c0f84d0 Author: Eric Dumazet Date: Tue Sep 16 16:09:42 2025 +0000 ipv6: make ipv6_pinfo.saddr_cache a boolean ipv6_pinfo.saddr_cache is either NULL or &np->saddr. We do not need 8 bytes, a boolean is enough. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250916160951.541279-2-edumazet@google.com Reviewed-by: Jakub Kicinski Signed-off-by: Paolo Abeni commit b127e355f1af1e4a635ed8f78cb0d11c916613cf Author: Jakub Kicinski Date: Tue Sep 16 07:54:01 2025 -0700 eth: fbnic: support devmem Tx Support devmem Tx. We already use skb_frag_dma_map(), we just need to make sure we don't try to unmap the frags. Check if frag is unreadable and mark the ring entry. # ./tools/testing/selftests/drivers/net/hw/devmem.py TAP version 13 1..3 ok 1 devmem.check_rx ok 2 devmem.check_tx ok 3 devmem.check_tx_chunks # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Acked-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250916145401.1464550-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit a4e143636d5def935dd461539b67b61287a8dfef Author: Niklas Neronin Date: Thu Sep 18 00:07:25 2025 +0300 usb: xhci: align PORTSC trace with one-based port numbering In the xHCI driver, port numbers are typically described using a one-based index. However, tracing currently uses a zero-based index. To ensure consistency between tracing and dynamic debugging, update the trace port number to use a one-based index. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e16fdeaa96846aefd05760ca45be32da8c1dfc83 Author: Niklas Neronin Date: Thu Sep 18 00:07:24 2025 +0300 usb: xhci: correct indentation for PORTSC tracing function Correct the indentation in USB Port Register Set (PORTSC) tracing. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 931e468764b22a587febf562e57249e95e84350d Author: Niklas Neronin Date: Thu Sep 18 00:07:23 2025 +0300 usb: xhci: improve TR Dequeue Pointer mask Address the naming and usage of the TR Dequeue Pointer mask in the xhci driver. The Endpoint Context Field at offset 0x08 is defined as follows: Bit 0 Dequeue Cycle State (DCS) Bits 3:1 RsvdZ (Reserved and Zero) Bits 63:4 TR Dequeue Pointer When extracting the TR Dequeue Pointer for an Endpoint without Streams, in xhci_handle_cmd_set_deq(), the inverted Dequeue Cycle State mask (~EP_CTX_CYCLE_MASK) is used, inadvertently including the Reserved bits. Although bits 3:1 are typically zero, using the incorrect mask could cause issues. The existing mask, named "SCTX_DEQ_MASK," is misleading because "SCTX" implies exclusivity to Stream Contexts, whereas the TR Dequeue Pointer is applicable to both Stream and non-Stream Contexts. Rename the mask to "TR_DEQ_PTR_MASK", utilize GENMASK_ULL() macro and use the mask when handling the TR Dequeue Pointer field. Function xhci_get_hw_deq() returns the Endpoint Context Field 0x08, either directly from the Endpoint context or a Stream. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 719de070f764e079cdcb4ddeeb5b19b3ddddf9c1 Author: Niklas Neronin Date: Thu Sep 18 00:07:22 2025 +0300 usb: xhci-pci: add support for hosts with zero USB3 ports Add xhci support for PCI hosts that have zero USB3 ports. Avoid creating a shared Host Controller Driver (HCD) when there is only one root hub. Additionally, all references to 'xhci->shared_hcd' are now checked before use. Only xhci-pci.c requires modification to accommodate this change, as the xhci core already supports configurations with zero USB3 ports. This capability was introduced when xHCI Platform and MediaTek added support for zero USB3 ports. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220181 Tested-by: Nick Nielsen Tested-by: grm1 Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0ed023a88396088d4221c345a3911f553dd42598 Author: Michal Pecio Date: Thu Sep 18 00:07:21 2025 +0300 usb: xhci: Update a comment about Stop Endpoint retries Retries are no longer gated by a quirk, so remove that part. Add a brief explanation of the timeout. Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 08fa726e66039dfa80226dfa112931f60ad4c898 Author: Michal Pecio Date: Thu Sep 18 00:07:20 2025 +0300 Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. No actual HW bugs are known where Endpoint Context shows Running state but Stop Endpoint fails repeatedly with Context State Error and leaves the endpoint state unchanged. Stop Endpoint retries on Running EPs have been performed since early 2021 with no such issues reported so far. Trying to handle this hypothetical case brings a more realistic danger: if Stop Endpoint fails on an endpoint which hasn't yet started after a doorbell ring and enough latency occurs before this completion event is handled, the driver may time out and begin removing cancelled TDs from a running endpoint, even though one more retry would stop it reliably. Such high latency is rare but not impossible, and removing TDs from a running endpoint can cause more damage than not giving back a cancelled URB (which wasn't happening anyway). So err on the side of caution and revert to the old policy of always retrying if the EP appears running. [Remove stable tag as we are dealing with theoretical cases -Mathias] Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f60034689f2c6076c88d247c534ff1ce85a67f47 Merge: 152ba35c04ade1 e7e9da850a46b0 Author: Paolo Abeni Date: Thu Sep 18 08:47:54 2025 +0200 Merge branch 'accecn-protocol-patch-series' Chia-Yu Chang says: ==================== AccECN protocol patch series Please find the v19 AccECN protocol patch series, which covers the core functionality of Accurate ECN, AccECN negotiation, AccECN TCP options, and AccECN failure handling. The Accurate ECN draft can be found in https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-accurate-ecn-28, and it will be RFC9768. This patch series is part of the full AccECN patch series, which is available at https://github.com/L4STeam/linux-net-next/commits/upstream_l4steam/ --- Chia-Yu Chang (3): tcp: accecn: AccECN option send control tcp: accecn: AccECN option failure handling tcp: accecn: try to fit AccECN option with SACK Ilpo Järvinen (7): tcp: AccECN core tcp: accecn: AccECN negotiation tcp: accecn: add AccECN rx byte counters tcp: accecn: AccECN needs to know delivered bytes tcp: sack option handling improvements tcp: accecn: AccECN option tcp: accecn: AccECN option ceb/cep and ACE field multi-wrap heuristics Documentation/networking/ip-sysctl.rst | 55 +- .../networking/net_cachelines/tcp_sock.rst | 12 + include/linux/tcp.h | 28 +- include/net/netns/ipv4.h | 2 + include/net/tcp.h | 33 ++ include/net/tcp_ecn.h | 554 +++++++++++++++++- include/uapi/linux/tcp.h | 9 + net/ipv4/syncookies.c | 4 + net/ipv4/sysctl_net_ipv4.c | 19 + net/ipv4/tcp.c | 30 +- net/ipv4/tcp_input.c | 318 +++++++++- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_minisocks.c | 40 +- net/ipv4/tcp_output.c | 239 +++++++- net/ipv6/syncookies.c | 2 + net/ipv6/tcp_ipv6.c | 1 + 16 files changed, 1278 insertions(+), 76 deletions(-) ==================== Link: https://patch.msgid.link/20250916082434.100722-1-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit e7e9da850a46b0632b18861525602faa08f3e9e1 Author: Chia-Yu Chang Date: Tue Sep 16 10:24:34 2025 +0200 tcp: accecn: try to fit AccECN option with SACK As SACK blocks tend to eat all option space when there are many holes, it is useful to compromise on sending many SACK blocks in every ACK and attempt to fit the AccECN option there by reducing the number of SACK blocks. However, it will never go below two SACK blocks because of the AccECN option. As the AccECN option is often not put to every ACK, the space hijack is usually only temporary. Depending on the reuqired AccECN fields (can be either 3, 2, 1, or 0, cf. Table 5 in AccECN spec) and the NOPs used for alignment of other TCP options, up to two SACK blocks will be reduced. Please find below tables for more details: +====================+=========================================+ | Number of | Required | Remaining | Number of | Final | | SACK | AccECN | option | reduced | number of | | blocks | fields | spaces | SACK blocks | SACK blocks | +===========+==========+===========+=============+=============+ | x (<=2) | 0 to 3 | any | 0 | x | +-----------+----------+-----------+-------------+-------------+ | 3 | 0 | any | 0 | 3 | | 3 | 1 | <4 | 1 | 2 | | 3 | 1 | >=4 | 0 | 3 | | 3 | 2 | <8 | 1 | 2 | | 3 | 2 | >=8 | 0 | 3 | | 3 | 3 | <12 | 1 | 2 | | 3 | 3 | >=12 | 0 | 3 | +-----------+----------+-----------+-------------+-------------+ | y (>=4) | 0 | any | 0 | y | | y (>=4) | 1 | <4 | 1 | y-1 | | y (>=4) | 1 | >=4 | 0 | y | | y (>=4) | 2 | <8 | 1 | y-1 | | y (>=4) | 2 | >=8 | 0 | y | | y (>=4) | 3 | <4 | 2 | y-2 | | y (>=4) | 3 | <12 | 1 | y-1 | | y (>=4) | 3 | >=12 | 0 | y | +===========+==========+===========+=============+=============+ Signed-off-by: Chia-Yu Chang Co-developed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-11-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit fe2cddc648f0d7cdf7377e1cb5a8c7dc5547e290 Author: Ilpo Järvinen Date: Tue Sep 16 10:24:33 2025 +0200 tcp: accecn: AccECN option ceb/cep and ACE field multi-wrap heuristics The AccECN option ceb/cep heuristic algorithm is from AccECN spec Appendix A.2.2 to mitigate against false ACE field overflows. Armed with ceb delta from option, delivered bytes, and delivered packets it is possible to estimate how many times ACE field wrapped. This calculation is necessary only if more than one wrap is possible. Without SACK, delivered bytes and packets are not always trustworthy in which case TCP falls back to the simpler no-or-all wraps ceb algorithm. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-10-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit b40671b5ee588c8a61b2d0eacbad32ffc57e9a8f Author: Chia-Yu Chang Date: Tue Sep 16 10:24:32 2025 +0200 tcp: accecn: AccECN option failure handling AccECN option may fail in various way, handle these: - Attempt to negotiate the use of AccECN on the 1st retransmitted SYN - From the 2nd retransmitted SYN, stop AccECN negotiation - Remove option from SYN/ACK rexmits to handle blackholes - If no option arrives in SYN/ACK, assume Option is not usable - If an option arrives later, re-enabled - If option is zeroed, disable AccECN option processing This patch use existing padding bits in tcp_request_sock and holes in tcp_sock without increasing the size. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-9-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit aa55a7dde7ec506bb23448a5005ae3f4f809d022 Author: Chia-Yu Chang Date: Tue Sep 16 10:24:31 2025 +0200 tcp: accecn: AccECN option send control Instead of sending the option in every ACK, limit sending to those ACKs where the option is necessary: - Handshake - "Change-triggered ACK" + the ACK following it. The 2nd ACK is necessary to unambiguously indicate which of the ECN byte counters in increasing. The first ACK has two counters increasing due to the ecnfield edge. - ACKs with CE to allow CEP delta validations to take advantage of the option. - Force option to be sent every at least once per 2^22 bytes. The check is done using the bit edges of the byte counters (avoids need for extra variables). - AccECN option beacon to send a few times per RTT even if nothing in the ECN state requires that. The default is 3 times per RTT, and its period can be set via sysctl_tcp_ecn_option_beacon. Below are the pahole outcomes before and after this patch, in which the group size of tcp_sock_write_tx is increased from 89 to 97 due to the new u64 accecn_opt_tstamp member: [BEFORE THIS PATCH] struct tcp_sock { [...] u64 tcp_wstamp_ns; /* 2488 8 */ struct list_head tsorted_sent_queue; /* 2496 16 */ [...] __cacheline_group_end__tcp_sock_write_tx[0]; /* 2521 0 */ __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2521 0 */ u8 nonagle:4; /* 2521: 0 1 */ u8 rate_app_limited:1; /* 2521: 4 1 */ /* XXX 3 bits hole, try to pack */ /* Force alignment to the next boundary: */ u8 :0; u8 received_ce_pending:4;/* 2522: 0 1 */ u8 unused2:4; /* 2522: 4 1 */ u8 accecn_minlen:2; /* 2523: 0 1 */ u8 est_ecnfield:2; /* 2523: 2 1 */ u8 unused3:4; /* 2523: 4 1 */ [...] __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2628 0 */ [...] /* size: 3200, cachelines: 50, members: 171 */ } [AFTER THIS PATCH] struct tcp_sock { [...] u64 tcp_wstamp_ns; /* 2488 8 */ u64 accecn_opt_tstamp; /* 2596 8 */ struct list_head tsorted_sent_queue; /* 2504 16 */ [...] __cacheline_group_end__tcp_sock_write_tx[0]; /* 2529 0 */ __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2529 0 */ u8 nonagle:4; /* 2529: 0 1 */ u8 rate_app_limited:1; /* 2529: 4 1 */ /* XXX 3 bits hole, try to pack */ /* Force alignment to the next boundary: */ u8 :0; u8 received_ce_pending:4;/* 2530: 0 1 */ u8 unused2:4; /* 2530: 4 1 */ u8 accecn_minlen:2; /* 2531: 0 1 */ u8 est_ecnfield:2; /* 2531: 2 1 */ u8 accecn_opt_demand:2; /* 2531: 4 1 */ u8 prev_ecnfield:2; /* 2531: 6 1 */ [...] __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2636 0 */ [...] /* size: 3200, cachelines: 50, members: 173 */ } Signed-off-by: Chia-Yu Chang Co-developed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-8-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit b5e74132dfbe60329b3ff0e5c485039f2e31605c Author: Ilpo Järvinen Date: Tue Sep 16 10:24:30 2025 +0200 tcp: accecn: AccECN option The Accurate ECN allows echoing back the sum of bytes for each IP ECN field value in the received packets using AccECN option. This change implements AccECN option tx & rx side processing without option send control related features that are added by a later change. Based on specification: https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt (Some features of the spec will be added in the later changes rather than in this one). A full-length AccECN option is always attempted but if it does not fit, the minimum length is selected based on the counters that have changed since the last update. The AccECN option (with 24-bit fields) often ends in odd sizes so the option write code tries to take advantage of some nop used to pad the other TCP options. The delivered_ecn_bytes pairs with received_ecn_bytes similar to how delivered_ce pairs with received_ce. In contrast to ACE field, however, the option is not always available to update delivered_ecn_bytes. For ACK w/o AccECN option, the delivered bytes calculated based on the cumulative ACK+SACK information are assigned to one of the counters using an estimation heuristic to select the most likely ECN byte counter. Any estimation error is corrected when the next AccECN option arrives. It may occur that the heuristic gets too confused when there are enough different byte counter deltas between ACKs with the AccECN option in which case the heuristic just gives up on updating the counters for a while. tcp_ecn_option sysctl can be used to select option sending mode for AccECN: TCP_ECN_OPTION_DISABLED, TCP_ECN_OPTION_MINIMUM, and TCP_ECN_OPTION_FULL. This patch increases the size of tcp_info struct, as there is no existing holes for new u32 variables. Below are the pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_info { [...] __u32 tcpi_total_rto_time; /* 244 4 */ /* size: 248, cachelines: 4, members: 61 */ } [AFTER THIS PATCH] struct tcp_info { [...] __u32 tcpi_total_rto_time; /* 244 4 */ __u32 tcpi_received_ce; /* 248 4 */ __u32 tcpi_delivered_e1_bytes; /* 252 4 */ __u32 tcpi_delivered_e0_bytes; /* 256 4 */ __u32 tcpi_delivered_ce_bytes; /* 260 4 */ __u32 tcpi_received_e1_bytes; /* 264 4 */ __u32 tcpi_received_e0_bytes; /* 268 4 */ __u32 tcpi_received_ce_bytes; /* 272 4 */ /* size: 280, cachelines: 5, members: 68 */ } This patch uses the existing 1-byte holes in the tcp_sock_write_txrx group for new u8 members, but adds a 4-byte hole in tcp_sock_write_rx group after the new u32 delivered_ecn_bytes[3] member. Therefore, the group size of tcp_sock_write_rx is increased from 96 to 112. Below are the pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_sock { [...] u8 received_ce_pending:4; /* 2522: 0 1 */ u8 unused2:4; /* 2522: 4 1 */ /* XXX 1 byte hole, try to pack */ [...] u32 rcv_rtt_last_tsecr; /* 2668 4 */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2728 0 */ [...] /* size: 3200, cachelines: 50, members: 167 */ } [AFTER THIS PATCH] struct tcp_sock { [...] u8 received_ce_pending:4;/* 2522: 0 1 */ u8 unused2:4; /* 2522: 4 1 */ u8 accecn_minlen:2; /* 2523: 0 1 */ u8 est_ecnfield:2; /* 2523: 2 1 */ u8 unused3:4; /* 2523: 4 1 */ [...] u32 rcv_rtt_last_tsecr; /* 2668 4 */ u32 delivered_ecn_bytes[3];/* 2672 12 */ /* XXX 4 bytes hole, try to pack */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2744 0 */ [...] /* size: 3200, cachelines: 50, members: 171 */ } Signed-off-by: Ilpo Järvinen Signed-off-by: Neal Cardwell Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-7-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 77a4fdf43c5ec81a431770511505d371c8822837 Author: Ilpo Järvinen Date: Tue Sep 16 10:24:29 2025 +0200 tcp: sack option handling improvements 1) Don't early return when sack doesn't fit. AccECN code will be placed after this fragment so no early returns please. 2) Make sure opts->num_sack_blocks is not left undefined. E.g., tcp_current_mss() does not memset its opts struct to zero. AccECN code checks if SACK option is present and may even alter it to make room for AccECN option when many SACK blocks are present. Thus, num_sack_blocks needs to be always valid. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-6-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit a92543d597621736b8e40fd1a2b50a93bd9840f7 Author: Ilpo Järvinen Date: Tue Sep 16 10:24:28 2025 +0200 tcp: accecn: AccECN needs to know delivered bytes AccECN byte counter estimation requires delivered bytes which can be calculated while processing SACK blocks and cumulative ACK. The delivered bytes will be used to estimate the byte counters between AccECN option (on ACKs w/o the option). Accurate ECN does not depend on SACK to function; however, the calculation would be more accurate if SACK were there. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-5-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 9a011277445583bab002fbf5043fab0ea03dc5dd Author: Ilpo Järvinen Date: Tue Sep 16 10:24:27 2025 +0200 tcp: accecn: add AccECN rx byte counters These three byte counters track IP ECN field payload byte sums for all arriving (acceptable) packets for ECT0, ECT1, and CE. The AccECN option (added by a later patch in the series) echoes these counters back to sender side; therefore, it is placed within the group of tcp_sock_write_txrx. Below are the pahole outcomes before and after this patch, in which the group size of tcp_sock_write_txrx is increased from 95 + 4 to 107 + 4 and an extra 4-byte hole is created but will be exploited in later patches: [BEFORE THIS PATCH] struct tcp_sock { [...] u32 delivered_ce; /* 2576 4 */ u32 received_ce; /* 2580 4 */ u32 app_limited; /* 2584 4 */ u32 rcv_wnd; /* 2588 4 */ struct tcp_options_received rx_opt; /* 2592 24 */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2616 0 */ [...] /* size: 3200, cachelines: 50, members: 166 */ } [AFTER THIS PATCH] struct tcp_sock { [...] u32 delivered_ce; /* 2576 4 */ u32 received_ce; /* 2580 4 */ u32 received_ecn_bytes[3];/* 2584 12 */ u32 app_limited; /* 2596 4 */ u32 rcv_wnd; /* 2600 4 */ struct tcp_options_received rx_opt; /* 2604 24 */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2628 0 */ /* XXX 4 bytes hole, try to pack */ [...] /* size: 3200, cachelines: 50, members: 167 */ } Signed-off-by: Ilpo Järvinen Signed-off-by: Neal Cardwell Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-4-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 3cae34274c79e0c60ccd1c10516973af1aed2a7c Author: Ilpo Järvinen Date: Tue Sep 16 10:24:26 2025 +0200 tcp: accecn: AccECN negotiation Accurate ECN negotiation parts based on the specification: https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt Accurate ECN is negotiated using ECE, CWR and AE flags in the TCP header. TCP falls back into using RFC3168 ECN if one of the ends supports only RFC3168-style ECN. The AccECN negotiation includes reflecting IP ECN field value seen in SYN and SYNACK back using the same bits as negotiation to allow responding to SYN CE marks and to detect ECN field mangling. CE marks should not occur currently because SYN=1 segments are sent with Non-ECT in IP ECN field (but proposal exists to remove this restriction). Reflecting SYN IP ECN field in SYNACK is relatively simple. Reflecting SYNACK IP ECN field in the final/third ACK of the handshake is more challenging. Linux TCP code is not well prepared for using the final/third ACK a signalling channel which makes things somewhat complicated here. tcp_ecn sysctl can be used to select the highest ECN variant (Accurate ECN, ECN, No ECN) that is attemped to be negotiated and requested for incoming connection and outgoing connection: TCP_ECN_IN_NOECN_OUT_NOECN, TCP_ECN_IN_ECN_OUT_ECN, TCP_ECN_IN_ECN_OUT_NOECN, TCP_ECN_IN_ACCECN_OUT_ACCECN, TCP_ECN_IN_ACCECN_OUT_ECN, and TCP_ECN_IN_ACCECN_OUT_NOECN. After this patch, the size of tcp_request_sock remains unchanged and no new holes are added. Below are the pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_request_sock { [...] u32 rcv_nxt; /* 352 4 */ u8 syn_tos; /* 356 1 */ /* size: 360, cachelines: 6, members: 16 */ } [AFTER THIS PATCH] struct tcp_request_sock { [...] u32 rcv_nxt; /* 352 4 */ u8 syn_tos; /* 356 1 */ bool accecn_ok; /* 357 1 */ u8 syn_ect_snt:2; /* 358: 0 1 */ u8 syn_ect_rcv:2; /* 358: 2 1 */ u8 accecn_fail_mode:4; /* 358: 4 1 */ /* size: 360, cachelines: 6, members: 20 */ } After this patch, the size of tcp_sock remains unchanged and no new holes are added. Also, 4 bits of the existing 2-byte hole are exploited. Below are the pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_sock { [...] u8 dup_ack_counter:2; /* 2761: 0 1 */ u8 tlp_retrans:1; /* 2761: 2 1 */ u8 unused:5; /* 2761: 3 1 */ u8 thin_lto:1; /* 2762: 0 1 */ u8 fastopen_connect:1; /* 2762: 1 1 */ u8 fastopen_no_cookie:1; /* 2762: 2 1 */ u8 fastopen_client_fail:2; /* 2762: 3 1 */ u8 frto:1; /* 2762: 5 1 */ /* XXX 2 bits hole, try to pack */ [...] u8 keepalive_probes; /* 2765 1 */ /* XXX 2 bytes hole, try to pack */ [...] /* size: 3200, cachelines: 50, members: 164 */ } [AFTER THIS PATCH] struct tcp_sock { [...] u8 dup_ack_counter:2; /* 2761: 0 1 */ u8 tlp_retrans:1; /* 2761: 2 1 */ u8 syn_ect_snt:2; /* 2761: 3 1 */ u8 syn_ect_rcv:2; /* 2761: 5 1 */ u8 thin_lto:1; /* 2761: 7 1 */ u8 fastopen_connect:1; /* 2762: 0 1 */ u8 fastopen_no_cookie:1; /* 2762: 1 1 */ u8 fastopen_client_fail:2; /* 2762: 2 1 */ u8 frto:1; /* 2762: 4 1 */ /* XXX 3 bits hole, try to pack */ [...] u8 keepalive_probes; /* 2765 1 */ u8 accecn_fail_mode:4; /* 2766: 0 1 */ /* XXX 4 bits hole, try to pack */ /* XXX 1 byte hole, try to pack */ [...] /* size: 3200, cachelines: 50, members: 166 */ } Signed-off-by: Ilpo Järvinen Co-developed-by: Olivier Tilmans Signed-off-by: Olivier Tilmans Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-3-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 542a495cbaa6dc57a310da62b501fdf318657cad Author: Ilpo Järvinen Date: Tue Sep 16 10:24:25 2025 +0200 tcp: AccECN core This change implements Accurate ECN without negotiation and AccECN Option (that will be added by later changes). Based on AccECN specifications: https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt Accurate ECN allows feeding back the number of CE (congestion experienced) marks accurately to the sender in contrast to RFC3168 ECN that can only signal one marks-seen-yes/no per RTT. Congestion control algorithms can take advantage of the accurate ECN information to fine-tune their congestion response to avoid drastic rate reduction when only mild congestion is encountered. With Accurate ECN, tp->received_ce (r.cep in AccECN spec) keeps track of how many segments have arrived with a CE mark. Accurate ECN uses ACE field (ECE, CWR, AE) to communicate the value back to the sender which updates tp->delivered_ce (s.cep) based on the feedback. This signalling channel is lossy when ACE field overflow occurs. Conservative strategy is selected here to deal with the ACE overflow, however, some strategies using the AccECN option later in the overall patchset mitigate against false overflows detected. The ACE field values on the wire are offset by TCP_ACCECN_CEP_INIT_OFFSET. Delivered_ce/received_ce count the real CE marks rather than forcing all downstream users to adapt to the wire offset. This patch uses the first 1-byte hole and the last 4-byte hole of the tcp_sock_write_txrx for 'received_ce_pending' and 'received_ce'. Also, the group size of tcp_sock_write_txrx is increased from 91 + 4 to 95 + 4 due to the new u32 received_ce member. Below are the trimmed pahole outcomes before and after this patch. [BEFORE THIS PATCH] struct tcp_sock { [...] __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2521 0 */ u8 nonagle:4; /* 2521: 0 1 */ u8 rate_app_limited:1; /* 2521: 4 1 */ /* XXX 3 bits hole, try to pack */ /* XXX 2 bytes hole, try to pack */ [...] u32 delivered_ce; /* 2576 4 */ u32 app_limited; /* 2580 4 */ u32 rcv_wnd; /* 2684 4 */ struct tcp_options_received rx_opt; /* 2688 24 */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2612 0 */ /* XXX 4 bytes hole, try to pack */ [...] /* size: 3200, cachelines: 50, members: 161 */ } [AFTER THIS PATCH] struct tcp_sock { [...] __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2521 0 */ u8 nonagle:4; /* 2521: 0 1 */ u8 rate_app_limited:1; /* 2521: 4 1 */ /* XXX 3 bits hole, try to pack */ /* Force alignment to the next boundary: */ u8 :0; u8 received_ce_pending:4;/* 2522: 0 1 */ u8 unused2:4; /* 2522: 4 1 */ /* XXX 1 byte hole, try to pack */ [...] u32 delivered_ce; /* 2576 4 */ u32 received_ce; /* 2580 4 */ u32 app_limited; /* 2584 4 */ u32 rcv_wnd; /* 2588 4 */ struct tcp_options_received rx_opt; /* 2592 24 */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2616 0 */ [...] /* size: 3200, cachelines: 50, members: 164 */ } Signed-off-by: Ilpo Järvinen Co-developed-by: Olivier Tilmans Signed-off-by: Olivier Tilmans Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916082434.100722-2-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 187e16f69de2ba30779b97ba8852b583fd7f5fad Author: Thomas Hellström Date: Thu Sep 11 10:03:24 2025 +0200 drm/xe: Work around clang multiple goto-label error When using drm_exec_retry_on_contention(), clang may consider all labels for which we take addresses in a function as potential retry goto targets, although strictly only one is possible. It will then in some situations generate false positive errors. In this case, the compiler, for some architectures, consider the might_lock(&m->job_mutex); as a potential goto target from drm_exec_retry_on_contention(), and errors. Work around that by moving the xe_validate / drm_exec transaction to a separate function. v2: - New commit message based on analysis of Nathan Chancellor Fixes: 59eabff2a352 ("drm/xe: Convert xe_bo_create_pin_map() for exhaustive eviction") Cc: Matthew Brost Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509101853.nDmyxTEM-lkp@intel.com/ Signed-off-by: Thomas Hellström Reviewed-by: Lucas De Marchi Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor # build Link: https://lore.kernel.org/r/20250911080324.180307-1-thomas.hellstrom@linux.intel.com commit 6e4a5154934f8c7283452651c4d398d34a46e952 Author: Frank Li Date: Wed Sep 10 18:44:01 2025 -0400 dt-bindings: touchscreen: resistive-adc-touch: change to unevaluatedProperties Change additionalProperties to unevaluatedProperties because it refs to touchscreen.yaml. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-skov-revc-lt6.dtb: touchscreen (resistive-adc-touch): 'touchscreen-y-plate-ohms' does not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/input/touchscreen/resistive-adc-touch.yaml# Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250910224402.994046-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit 05fcd78bcb14f68d46e4de8812ce6646d3d7f941 Author: Dario Binacchi Date: Wed Sep 17 10:05:07 2025 +0200 Input: imx6ul_tsc - use BIT, FIELD_{GET,PREP} and GENMASK macros Replace opencoded masking and shifting, with BIT(), GENMASK(), FIELD_GET() and FIELD_PREP() macros. Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250917080534.1772202-3-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 6c521885da34e61908d84a4f3eda85545f060848 Author: Michael Trimarchi Date: Wed Sep 17 10:05:06 2025 +0200 Input: imx6ul_tsc - fix typo in register name Replace 'SETING' with 'SETTING'. Signed-off-by: Michael Trimarchi Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250917080534.1772202-2-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 1b7d2e1742427527aac2b2d5cb92fb8f2f047cad Author: Frank Li Date: Tue Sep 16 13:13:26 2025 -0400 dt-bindings: input: convert tca8418_keypad.txt to yaml format Convert tca8418_keypad.txt to yaml format. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250916171327.3773620-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit 1081eafa1bca16d3610bf44f515550d060526dd4 Author: Eric Gonçalves Date: Tue Sep 16 18:04:08 2025 +0000 dt-bindings: arm: qcom: sort sm8450 boards The bindings had samsung,r0q before sony,pdx*, which is out of alphabetical order, solve this issue by moving samsung,r0q before the pdx boards. Signed-off-by: Eric Gonçalves Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250916180409.157115-1-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit c11645afb0e228546279ad1b74826fffbfebbc7f Author: Yijie Yang Date: Wed Sep 17 10:59:00 2025 +0800 arm64: dts: qcom: Add base HAMOA-IOT-EVK board The HAMOA-IOT-EVK is an evaluation platform for IoT products, composed of the Hamoa IoT SoM and a carrier board. Together, they form a complete embedded system capable of booting to UART. Make the following peripherals on the carrier board enabled: - UART - On-board regulators - USB Type-C mux - Pinctrl - Embedded USB (EUSB) repeaters - NVMe - pmic-glink - USB DisplayPorts - Bluetooth - WLAN - Audio Written in collaboration with Quill Qi (Audio) , Jie Zhang (Graphics) , Shuai Zhang (Bluetooth) , Yingying Tang (WLAN) , and Yongxing Mou (USB DisplayPorts) . Signed-off-by: Yijie Yang Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250917-hamoa_initial-v12-3-4ed39d17dfc5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5098ae93ce44110a4d86574819b254fd126243af Author: Yijie Yang Date: Wed Sep 17 10:58:59 2025 +0800 arm64: dts: qcom: Add HAMOA-IOT-SOM platform The HAMOA-IOT-SOM is a compact computing module that integrates a System on Chip (SoC) — specifically the x1e80100 — along with essential components optimized for IoT applications. It is designed to be mounted on carrier boards, enabling the development of complete embedded systems. Make the following peripherals on the SOM enabled: - Regulators on the SOM - Reserved memory regions - PCIe6a and its PHY - PCIe4 and its PHY - USB0 through USB6 and their PHYs - ADSP, CDSP - Graphic - Video Written in collaboration with Yingying Tang (PCIe4) and Wangao Wang (Video) . Reviewed-by: Konrad Dybcio Signed-off-by: Yijie Yang Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250917-hamoa_initial-v12-2-4ed39d17dfc5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 458bb855f274e227618acfa8c098b8e4894d9cd9 Author: Yijie Yang Date: Wed Sep 17 10:58:58 2025 +0800 dt-bindings: arm: qcom: Document HAMOA-IOT-EVK board Document the device tree binding for the HAMOA-IOT-EVK board, which uses the Qualcomm X1E80100 SoC. The EVK consists of a carrier board and a modular System-on-Module (SoM). The SoM integrates the SoC, PMICs, and essential GPIOs, while the EVK carrier board provides additional peripherals such as UART and USB interfaces. Acked-by: Krzysztof Kozlowski Signed-off-by: Yijie Yang Link: https://lore.kernel.org/r/20250917-hamoa_initial-v12-1-4ed39d17dfc5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 152ba35c04ade1a164c774d6fccbf8e8cf4652cf Merge: cbff0b1ec64ee9 11bbcfb7668c6f Author: Jakub Kicinski Date: Wed Sep 17 18:29:33 2025 -0700 Merge branch 'net-mlx5e-use-multiple-doorbells' Tariq Toukan says: ==================== net/mlx5e: Use multiple doorbells mlx5e uses a single MMIO-mapped doorbell per netdevice for all send and receive operations. Writes to the doorbell go over the PCIe bus directly to the device, which then services the indicated queues. On certain architectures and with sufficiently high volume of doorbell ringing (many cores, many active channels, small MTU, no GSO, etc.), the MMIO-mapped doorbell address can become contended, leading to delays in servicing writes to that address and a global slowdown of all traffic for that netdevice. mlx5 NICs have supported using multiple doorbells for many years, the mlx5_ib driver for the same hardware has been using multiple doorbells traditionally. This patch series extends the mlx5 Ethernet driver to also use multiple doorbells to solve the MMIO contention issues. By allocating and using more doorbells for all channel queues (TX and RX), the MMIO contention on any particular doorbell address is reduced significantly. The first patches are cleanups: net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET net/mlx5: Remove unused 'offset' field from struct mlx5_sq_bfreg' net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param The next patch separates the global doorbell from Ethernet-specific resources: net/mlx5: Store the global doorbell in mlx5_priv Next, plumbing to allow a different doorbell to be used for channel TX and RX queues: net/mlx5e: Prepare for using multiple TX doorbells net/mlx5e: Prepare for using different CQ doorbells Then, enable using multiple doorbells for channel queues: net/mlx5e: Use multiple TX doorbells net/mlx5e: Use multiple CQ doorbells Finally, introduce a devlink parameter to control this: devlink: Add a 'num_doorbells' driverinit param net/mlx5e: Use the 'num_doorbells' devlink param Some performance results, done with the Linux pktgen script, running b2b over Connect-X 8 NICs: samples/pktgen/pktgen_sample02_multiqueue.sh -i $NIC -s 64 -d $DST_IP \ -m $MAC -t 64 Baseline (1 doorbell): 9 Mpps This series (8 doorbells): 56 Mpps Note that pktgen without 'burst' rings the doorbell after every packet, while real packet TX using NAPI usually batches multiple pending packets with the xmit_more mechanism. So this is in essence a micro-benchmark showcasing the improvement of using multiple doorbells on platforms affected by MMIO contention. Real life traffic usually sees little movement either way. ==================== Link: https://patch.msgid.link/1758031904-634231-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 11bbcfb7668c6f4d97260f7caaefea22678bc31e Author: Cosmin Ratiu Date: Tue Sep 16 17:11:44 2025 +0300 net/mlx5e: Use the 'num_doorbells' devlink param Use the new devlink param to control how many doorbells mlx5e devices allocate and use. The maximum number of doorbells configurable is capped to the maximum number of channels. This only applies to the Ethernet part, the RDMA devices using mlx5 manage their own doorbells. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 6bdcb735fec6cb866b0d40634d4f23effba81074 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:43 2025 +0300 devlink: Add a 'num_doorbells' driverinit param This parameter can be used by drivers to configure a different number of doorbells. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 325db9c6f69b1408ccd2c6e237fc07697a9f210f Author: Cosmin Ratiu Date: Tue Sep 16 17:11:42 2025 +0300 net/mlx5e: Use multiple CQ doorbells Channel doorbells are now also used by all channel CQs. A new 'uar' parameter is added to 'struct mlx5e_create_cq_param', which is then used in mlx5e_alloc_cq. A single UAR page has two TX doorbells and a single CQ doorbell, so every consecutive pair of 'struct mlx5_sq_bfreg' (TX doorbells) uses the same underlying 'struct mlx5_uars_page' (CQ doorbell). So by using c->bfreg->up, CQs from every consecutive channel pair will share the same CQ doorbell. Non-channel associated CQs keep using the global CQ doorbell. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 71fb4832d50b01f0af2d257360c239879ce93a8e Author: Cosmin Ratiu Date: Tue Sep 16 17:11:41 2025 +0300 net/mlx5e: Use multiple TX doorbells First, allocate more doorbells in mlx5e_create_mdev_resources: - one doorbell remains 'global' and will be used by all non-channel associated SQs (e.g. ASO, HWS, PTP, ...). - allocate additional 'num_doorbells' doorbells. This defaults to minimum between 8 and max number of channels. mlx5e_channel_pick_doorbell() now spreads out channel SQs across available doorbells. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit a315b723e87ba4e4573e1e5c759d512f38bdc0b3 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:40 2025 +0300 net/mlx5e: Prepare for using different CQ doorbells Completion queues (CQs) in mlx5 use the same global doorbell, which may become contended when accessed concurrently from many cores. This patch prepares the CQ management code for supporting different doorbells per CQ. This will be used in downstream patches to allow separate doorbells to be used by channels CQs. The main change is moving the 'uar' pointer from struct mlx5_core_cq to struct mlx5e_cq, as the uar page to be used is better off stored directly there. Other users of mlx5_core_cq also store the UAR to be used separately and therefore the pointer being removed is dead weight for them. As evidence, in this patch there are two users which set the mcq.uar pointer but didn't use it, Software Steering and old Innova CQ creation code. Instead, they rang the doorbell directly from another pointer. The 'uar' pointer added to struct mlx5e_cq remains in a hot cacheline (as before), because it may get accessed for each packet. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 673d7ab7563e1268ac4ca62914b2b99d16219500 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:39 2025 +0300 net/mlx5e: Prepare for using multiple TX doorbells The driver allocates a single doorbell per device and uses it for all Send Queues (SQs). This can become a bottleneck due to the high number of concurrent MMIO accesses when ringing the same doorbell from many channels. This patch makes the doorbells used by channel queues configurable. mlx5e_channel_pick_doorbell() is added to select the doorbell to be used for a given channel, picking the default for now. When opening a channel, the selected doorbell is saved to the channel struct and used whenever channel-related queues are created. Finally, 'uar_page' is added to 'struct mlx5e_create_sq_param' to control which doorbell to use when allocating an SQ, since that can happen outside channel context (e.g. for PTP). Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit aa4595d0ada65d5d44fa924a42a87c175d9d88e3 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:38 2025 +0300 net/mlx5: Store the global doorbell in mlx5_priv The global doorbell is used for more than just Ethernet resources, so move it out of mlx5e_hw_objs into a common place (mlx5_priv), to avoid non-Ethernet modules (e.g. HWS, ASO) depending on Ethernet structs. Use this opportunity to consolidate it with the 'uar' pointer already there, which was used as an RX doorbell. Underneath the 'uar' pointer is identical to 'bfreg->up', so store a single resource and use that instead. For CQ doorbells, care is taken to always use bfreg->up->index instead of bfreg->index, which may refer to a subsequent UAR page from the same ALLOC_UAR batch on some NICs. This paves the way for cleanly supporting multiple doorbells in the Ethernet driver. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 913d28f8a71cd8e38d6d788c70643f5a71507400 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:37 2025 +0300 net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param This was added in commit [1], but its only use removed in commit [2]. The parameter is unused, so remove it from the function parameter list. [1] commit 9ded70fa1d81 ("net/mlx5e: Don't prefill WQEs in XDP SQ in the multi buffer mode") [2] commit 1a9304859b3a ("net/mlx5: XDP, Enable TX side XDP multi-buffer support") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 05dfe654b5932322e297aba11dd6f3f26eea6ecb Author: Cosmin Ratiu Date: Tue Sep 16 17:11:36 2025 +0300 net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg The 'offset' field was introduced in the original commit [1] and never used until commit [2], which added an unnecessary use. Remove the field and refactor the write-combining test to use a local variable instead. [1] commit a6d51b68611e ("net/mlx5: Introduce blue flame register allocator") [2] commit d98995b4bf98 ("net/mlx5: Reimplement write combining test") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 917449e7c3cdc7a0dfe429de997e39098d9cdd20 Author: Cosmin Ratiu Date: Tue Sep 16 17:11:35 2025 +0300 net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET Also convert it to a simple define. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 533e60e1ca99dfb99412023c86d34b7a78b0e57b Author: Chih-Kang Chang Date: Mon Sep 15 14:54:34 2025 +0800 wifi: rtw89: wow: enable TKIP related feature For chips that supports TKIP HW encryption and decryption, enable TKIP cipher for WoWLAN feature. Additionally, the TX MIC KEY and RX MIC KEY is opposite in FW. Therefore, reverse the MIC KEY direction in H2C format, and also reverse it from AOAC report before reporting to mac80211. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065434.39324-1-pkshih@realtek.com commit cbff0b1ec64ee984759e3a0af84f4384540148a8 Merge: e218ae40241c16 e866e5118bb678 Author: Jakub Kicinski Date: Wed Sep 17 18:20:36 2025 -0700 Merge branch 'net-dsa-mv88e6xxx-further-ptp-related-cleanups' Russell King says: ==================== net: dsa: mv88e6xxx: further PTP-related cleanups Further mv88e6xxx PTP-related cleanups, mostly centred around the register definitions, but also moving one function prototype to a more logical header. ==================== Link: https://patch.msgid.link/aMnJ1uRPvw82_aCT@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e866e5118bb678de8d159cd865678359e2493894 Author: Russell King (Oracle) Date: Tue Sep 16 21:35:08 2025 +0100 net: dsa: mv88e6xxx: move mv88e6xxx_hwtstamp_work() prototype Since mv88e6xxx_hwtstamp_work() is defined in hwtstamp.c, its prototype should be in hwtstamp.h, so move it there. Remove it's redundant stub definition, as both hwtstamp.c (the function provider) and ptp.c (the consumer) are both dependent on the same config symbol. Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit a295b33b0faf43cd0d076f7e86ea90a777f6796e Author: Russell King (Oracle) Date: Tue Sep 16 21:35:03 2025 +0100 net: dsa: mv88e6xxx: remove unused 88E6165 register definitions Remove the unused 88E6165 register definitions. For the port registers, add a comment describing that each arrival and departure offset is for a set of four registers that correspond with status, two timestamp registers and the PTP sequence ID captured from the packet. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 30cf6a875e2986ff137feaf2a25620b01ad412ab Author: Russell King (Oracle) Date: Tue Sep 16 21:34:58 2025 +0100 net: dsa: mv88e6xxx: remove duplicated register definition There are two identical MV88E6XXX_PTP_GC_ETYPE definitions in ptp.h, and MV88E6XXX_PTP_ETHERTYPE in hwtstamp.h which all refer to the exact same register. As the code that accesses this register is in hwtstamp.c, use the hwtstamp.h definition, and remove the unnecessary duplicated definition in ptp.h Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 946fc083fcb57e11bd0f2505f75bb5e63ee86cdd Author: Russell King (Oracle) Date: Tue Sep 16 21:34:53 2025 +0100 net: dsa: mv88e6xxx: remove unused TAI definitions Remove the TAI definitions that the code never uses. Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit a12372ac5946c4c64bf89c7046eb6d387f697f6e Author: Russell King (Oracle) Date: Tue Sep 16 21:34:48 2025 +0100 net: dsa: mv88e6xxx: rename TAI definitions according to core The TAI_EVENT_STATUS and TAI_CFG definitions are only used for the 88E6352-family of TAI implementations. Rename them as such, and remove the TAI_EVENT_TIME_* definitions that are unused (although we read them as a block.) Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 8e72c3a6255a2bf6f857c10468c670b4af29d600 Author: Kuan-Chung Chen Date: Mon Sep 15 14:54:29 2025 +0800 wifi: rtw89: 8922a: add TAS feature support Add TAS support for 8922AE. Unlike AX ICs, BE ICs introduce a TAS timer switch. The firmware starts a TAS timer to periodically collect TX power information and notify the driver via C2H events. To avoid unnecessary C2H events, the TAS timer is enabled during core_start(). Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065429.39269-1-pkshih@realtek.com commit a27136f1050a653f8d267d6b906880186b695d70 Author: Zong-Zhe Yang Date: Mon Sep 15 14:53:52 2025 +0800 wifi: rtw89: open C2H event waiting window first before sending H2C command Some H2C commands need to wait for target C2H events to confirm they are executed well. The characteristics of a target C2H event will be encoded into a value, called condition. Then, the corresponding H2C command will wait for it. And, C2H events will complete a condition according to their own characteristics. So, when conditions of both side match, the corresponding H2C command will be completed. Originally, condition waiting window is opened after the H2C command is sent. However, for CPU-bound systems, target C2H event might be already done before the H2C command opens condition waiting window. Without that, C2H event won't match condition, and it will complete nothing. Finally, H2C command wait will time out. Hence, now open condition waiting window first for H2C commands which need to wait for target C2H events. The waiting function is split to two parts, prepare and evaluate. And, waiting side becomes the below where prepare part and evaluate part must be a pair. waiting prepare: condition (open condition waiting window) Do the needed things to trigger completing side. Record errors that will cause no real completer. waiting evaluate: prepare, errors (start waiting for completion if things are fine; otherwise, clean up and return final result.) Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065352.39082-1-pkshih@realtek.com commit bc2a5a12fa6259e190c7edb03e63b28ab480101b Author: Zong-Zhe Yang Date: Mon Sep 15 14:53:43 2025 +0800 wifi: rtw89: renew a completion for each H2C command waiting C2H event Logically before a waiting side which has already timed out turns the atomic status back to idle, a completing side could still pass atomic condition and call complete. It will make the following H2C commands, waiting C2H events, get a completion unexpectedly early. Hence, renew a completion for each H2C command waiting a C2H event. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065343.39023-1-pkshih@realtek.com commit 5ff9e80de2a8bea5a7c0b30a4e273b399fbf2acc Author: Kuan-Chung Chen Date: Mon Sep 15 14:53:37 2025 +0800 wifi: rtw89: 8852b: enable beacon tracking support Enable beacon tracking support on 8852B to improve connection stability. 8852B firmware has supported the power level H2C since version 0.29.128. This H2C is one of the required elements for beacon tracking, allowing control of the maximum receive window while in power save mode. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065337.38966-1-pkshih@realtek.com commit e6badd999a87fd48d17929fdd594d016989202e8 Author: Zong-Zhe Yang Date: Mon Sep 15 14:53:29 2025 +0800 wifi: rtw89: debug: support SER L0 simulation SER (system error recovery) can deal with different crash types by different levels of processes. Now, add a debug function to trigger MAC error in purpose for SER L0 simulation/verification. And, extend dbgfs fw_crash to accept different parameters. # simulate MAC error (one kind of SER L0) echo 3 > fw_crash Normally, FW won't report SER L0 cases to driver. Instead, they will be handled by FW directly. If unfortunately FW handling fails, SER will rise to L1 and be reported to driver. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065329.38911-1-pkshih@realtek.com commit 298f39f0d9c3ee381793e7a4ba1f54755e4687eb Author: Ping-Ke Shih Date: Mon Sep 15 14:53:14 2025 +0800 wifi: rtw89: phy: initialize AFE by firmware element table A power-on sequence table is introduced to initialize AFE (Analogue Front End) connecting to RF components. Build the sequence in firmware file, and use a parser to execute the sequences including write/poll/delay actions. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065314.38846-1-pkshih@realtek.com commit e156d2ab36d7e47aec36845705e4ecb1e4e89976 Author: Chih-Kang Chang Date: Mon Sep 15 14:52:06 2025 +0800 wifi: rtw89: obtain RX path from ppdu status IE00 The header v2 of ppdu status is optional, If it is not enabled, the RX path must be obtained from IE00 or IE01. Append the IE00 part. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065213.38659-5-pkshih@realtek.com commit 4e79a5cc01c5e1f1ba393ed3b44b0c3611eaadf1 Author: Chih-Kang Chang Date: Mon Sep 15 14:52:05 2025 +0800 wifi: rtw89: disable RTW89_PHYSTS_IE09_FTR_0 for ppdu status The IE length of RTW89_PHYSTS_IE09_FTR_0 is dynamic, need to calculate more to get it. This IE is not necessary now, disable it to avoid get wrong IE length to let the parse function check failed. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065213.38659-4-pkshih@realtek.com commit 19989c80734cc8c60e1529dba8641d2bfe162662 Author: Ping-Ke Shih Date: Mon Sep 15 14:52:04 2025 +0800 wifi: rtw89: use ieee80211_tx_info::driver_data to store driver TX info It makes more sense to use ieee80211_tx_info::driver_data instead of ieee80211_tx_info::status.status_driver_data which is used to share TX status reporting to mac80211, because actually driver calls ieee80211_tx_info_clear_status() to clear the content including status_driver_data in rtw89_pci_tx_status() before filling the status. Review and point out the scope (by comments) driver can safely use ieee80211_tx_info::driver_data between rtw89_hci_tx_write() and calling ieee80211_tx_info_clear_status(). Add BUILD_BUG_ON() to assert that driver struct size is smaller than the size defined by mac80211. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065213.38659-3-pkshih@realtek.com commit e218ae40241c162a752200efec92030d4de1b503 Merge: 6b957c0a36f5a6 893c49a78d9f85 Author: Jakub Kicinski Date: Wed Sep 17 18:10:24 2025 -0700 Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev' Kuniyuki Iwashima says: ==================== net: Fix UAF of sk_dst_get(sk)->dev. syzbot caught use-after-free of sk_dst_get(sk)->dev, which was not fetched under RCU nor RTNL. [0] Patch 1 ~ 5, 7 fix UAF in smc, tcp, ktls, mptcp Patch 6 fixes dst ref leak in mptcp [0]: https://lore.kernel.org/68c237c7.050a0220.3c6139.0036.GAE@google.com v1: https://lore.kernel.org/20250911030620.1284754-1-kuniyu@google.com ==================== Link: https://patch.msgid.link/20250916214758.650211-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 893c49a78d9f85e4b8081b908fb7c407d018106a Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:25 2025 +0000 mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 108a86c71c93ff28087994e6107bc99ebe336629 Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:24 2025 +0000 mptcp: Call dst_release() in mptcp_active_enable(). mptcp_active_enable() calls sk_dst_get(), which returns dst with its refcount bumped, but forgot dst_release(). Let's add missing dst_release(). Cc: stable@vger.kernel.org Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c65f27b9c3be2269918e1cbad6d8884741f835c5 Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:23 2025 +0000 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0b0e4d51c6554e5ecc3f8cc73c2eaf12da21249a Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:22 2025 +0000 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). smc_vlan_by_tcpsk() fetches sk_dst_get(sk)->dev before RTNL and passes it to netdev_walk_all_lower_dev(), which is illegal. Also, smc_vlan_by_tcpsk_walk() does not require RTNL at all. Let's use __sk_dst_get(), dst_dev_rcu(), and netdev_walk_all_lower_dev_rcu(). Note that the returned value of smc_vlan_by_tcpsk() is not used in the caller. Fixes: 0cfdd8f92cac ("smc: connection and link group creation") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 235f81045c008169cc4e1955b4a64e118eebe61b Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:21 2025 +0000 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller. Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 935d783e5de9b64587f3adb25641dd8385e64ddb Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:20 2025 +0000 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3d3466878afd8d43ec0ca2facfbc7f03e40d0f79 Author: Kuniyuki Iwashima Date: Tue Sep 16 21:47:19 2025 +0000 smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at __pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline] smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline] smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154 smc_find_ism_device net/smc/af_smc.c:1030 [inline] smc_find_proposal_devices net/smc/af_smc.c:1115 [inline] __smc_connect+0x372/0x1890 net/smc/af_smc.c:1545 smc_connect+0x877/0xd90 net/smc/af_smc.c:1715 __sys_connect_file net/socket.c:2086 [inline] __sys_connect+0x313/0x440 net/socket.c:2105 __do_sys_connect net/socket.c:2111 [inline] __se_sys_connect net/socket.c:2108 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2108 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f47cbf8eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9 RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000 raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kvmalloc_node_noprof+0x6d/0x5f0 mm/slub.c:5067 alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11812 tun_set_iff+0x532/0xef0 drivers/net/tun.c:2775 __tun_chr_ioctl+0x788/0x1df0 drivers/net/tun.c:3085 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 18610 tgid 18608 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895 free_large_kmalloc+0x13a/0x1f0 mm/slub.c:4820 device_release+0x99/0x1c0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11513 rtnl_unlock net/core/rtnetlink.c:157 [inline] rtnl_net_unlock include/linux/rtnetlink.h:135 [inline] rtnl_dellink+0x537/0x710 net/core/rtnetlink.c:3563 rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6946 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036bac200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888036bac280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888036bac300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888036bac380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888036bac400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 0afff91c6f5e ("net/smc: add pnetid support") Fixes: 1619f770589a ("net/smc: add pnetid support for SMC-D and ISM") Reported-by: syzbot+ea28e9d85be2f327b6c6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250916214758.650211-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit df3d55a63f9a9372f6530fedfc495b2164181c5d Author: Zong-Zhe Yang Date: Mon Sep 15 14:52:03 2025 +0800 wifi: rtw89: chan: allow callers to check if a link has no managed chanctx Originally, to directly align with the chanctx design, getter of managed chanctx returned a default channel when a link doesn't own a chanctx yet. Then, callers could simply use the return without trivial NULL checking. But in MLD HW settings of next chip, there will be a special case that a caller needs to check if a link has owned chanctx or not to determine CCK hardware circuit working on HW-x. So, add a func *_or_null for this first. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250915065213.38659-2-pkshih@realtek.com commit 92003056e5d45f0f32a87f9f96d15902f2f21fbf Author: Al Viro Date: Wed Jul 2 03:33:02 2025 -0400 nfsd_get_inode(): lift setting ->i_{,f}op to callers. Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit e59f06bb5d3f8403b425e42719b44a47264f20cc Author: Al Viro Date: Wed Jul 2 03:30:58 2025 -0400 nfsdfs_create_files(): switch to simple_start_creating() Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit a6281a7043bc4a58e2fb1c499fcff6ef52050767 Author: Al Viro Date: Wed Jul 2 03:26:28 2025 -0400 _nfsd_symlink(): switch to simple_start_creating() Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 6b614c56cdf616c18664d39c0686d132e4672940 Author: Al Viro Date: Wed Jul 2 03:22:12 2025 -0400 nfsd_mkdir(): switch to simple_start_creating() ... and fold __nfsd_mkdir() into it. Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 7e6135fe7b483cd85e28789d70e09cc91064be95 Author: Al Viro Date: Wed Sep 10 18:41:52 2025 -0400 nfsctl: symlink has no business bumping link count of parent directory mkdir should incrment the parent's refcount; symlink should not. Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit cc3e883a06251ba835f15672dbe8724f2687971b Author: Fenglin Wu Date: Wed Sep 17 18:15:20 2025 +0800 power: supply: qcom_battmgr: Add charge control support Add charge control support for SM8550 and X1E80100. It's supported with below two power supply properties: charge_control_end_threshold: The battery SoC (State of Charge) threshold at which the charging should be terminated. charge_control_start_threshold: The battery SoC threshold at which the charging should be resumed. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Reviewed-by: Neil Armstrong Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit 7f8624af8e8c2c1a0169b46a23729a4cc614635c Author: Fenglin Wu Date: Wed Sep 17 18:15:19 2025 +0800 dt-bindings: soc: qcom,pmic-glink: Add charge limit nvmem properties Add nvmem properties to retrieve charge control configurations from the PMIC SDAM registers. Acked-by: Rob Herring (Arm) Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit b3c0f651b3cf4dfaf2e8210d7bb9b79471f6403b Author: Fenglin Wu Date: Wed Sep 17 18:15:18 2025 +0800 power: supply: qcom_battmgr: update compats for SM8550 and X1E80100 The SM8550 and X1E80100 platforms now include charge control functionality in battery management firmware, allowing charging to stop when the battery reaches a set level and resume when it drops below another level. To support this in the qcom_battmgr driver, CHARGE_CONTROL_START/END_THRESHOLD power supply properties can be added to manage these levels. This results in the battery power supply properties for SM8550 and X1E80100 differing from those for SM8350 and SC8280XP. Therefore, separate compatible entries for SM8550 and X1E80100 are introduced, each with their own variant definitions as match data. Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit b8e5030e09c11a47b7dadd28b492ec00b40a1b8c Author: Fenglin Wu Date: Wed Sep 17 18:15:17 2025 +0800 power: supply: qcom_battmgr: Add state_of_health property Add state_of_health property to read battery health percentage from battery management firmware. Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit 45e57e6a213448f0b372f9cbd3f90f301f675c9b Author: Fenglin Wu Date: Wed Sep 17 18:15:16 2025 +0800 power: supply: qcom_battmgr: Add resistance power supply property Add power supply property to get battery internal resistance from the battery management firmware. Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit cd93fbdce5981c947f22015ded3ac6bd1939b0ad Author: Fenglin Wu Date: Wed Sep 17 18:15:15 2025 +0800 power: supply: core: Add state_of_health power supply property Add state_of_health power supply property to represent battery health percentage. Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit d69ae81efbc95c94a2760fc82d27cdab4c26fe76 Author: Fenglin Wu Date: Wed Sep 17 18:15:14 2025 +0800 power: supply: core: Add resistance power supply property Some battery drivers provide the ability to export internal resistance as a parameter. Add internal_resistance power supply property for that purpose. Signed-off-by: Fenglin Wu Signed-off-by: Sebastian Reichel commit 1bafaa156ed3881cd4f187ab1c43e408742e1f11 Author: Xichao Zhao Date: Tue Sep 9 10:09:25 2025 +0800 power: supply: rx51: remove redundant condition checks Remove redundant condition checks and replace else if with else. Signed-off-by: Xichao Zhao Signed-off-by: Sebastian Reichel commit c3a45c5fde95d319125812f629c579cc63c69941 Author: Svyatoslav Ryhel Date: Fri Sep 12 09:51:46 2025 +0300 dt-bindings: power: supply: bq24190: document charge enable pin Document active low Charge Enable pin. Battery charging is enabled when REG01[5:4] = 01 and CE pin = Low. CE pin must be pulled high or low. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Sebastian Reichel commit f3243bed39c26ce0f13e6392a634f91d409b2d02 Author: Junhui Liu Date: Tue Jul 22 00:53:10 2025 +0800 riscv: mm: Return intended SATP mode for noXlvl options Change the return value of match_noXlvl() to return the SATP mode that will be used, rather than the mode being disabled. This enables unified logic for return value judgement with the function that obtains mmu-type from the fdt, avoiding extra conversion. This only changes the naming, with no functional impact. Signed-off-by: Junhui Liu Reviewed-by: Alexandre Ghiti Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250722-satp-from-fdt-v1-1-5ba22218fa5f@pigmoral.tech Signed-off-by: Paul Walmsley commit 6b957c0a36f5a68d9b210ed2db67fc191d873ba4 Merge: 2479cba209463e b67a8631a4a8f2 Author: Jakub Kicinski Date: Wed Sep 17 15:24:03 2025 -0700 Merge branch 'net-phy-remove-mdio_board_info-support-from-phylib' Heiner Kallweit says: ==================== net: phy: remove mdio_board_info support from phylib Since its introduction in 2017 mdio_board_info has had only two users: - dsa_loop (still existing) - arm orion, added in 2017 and removed with fd68572b57f2 ("ARM: orion5x: remove dsa_chip_data references") So let's remove usage of mdio_board_info from dsa_loop, then support for mdio_board_info can be dropped from phylib. ==================== Link: https://patch.msgid.link/4ccf7476-0744-4f6b-aafc-7ba84d15a432@gmail.com Signed-off-by: Jakub Kicinski commit b67a8631a4a8f26a18fac236aaf61aa2412c7a0d Author: Heiner Kallweit Date: Sat Sep 13 23:08:17 2025 +0200 net: phy: remove mdio_board_info support from phylib After having removed mdio_board_info usage from dsa_loop, there's no user left. So let's drop support for it from phylib. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/01542a2e-05f5-4f13-acef-72632b33b5be@gmail.com Signed-off-by: Jakub Kicinski commit 41357bc7b94bb3719a95e72f63dc288bd0fa4ad5 Author: Heiner Kallweit Date: Sat Sep 13 23:07:08 2025 +0200 net: dsa: dsa_loop: remove usage of mdio_board_info dsa_loop is the last remaining user of mdio_board_info. Let's remove using mdio_board_info, so that support for it can be dropped from phylib. Signed-off-by: Heiner Kallweit Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/da9563a4-8e14-41cf-bfea-cf5f1b58a4b7@gmail.com Signed-off-by: Jakub Kicinski commit 2479cba209463e8387400218e754b92ce8e7b5d1 Author: Wei Fang Date: Mon Sep 15 16:25:28 2025 +0800 ptp: netc: only enable periodic pulse event interrupts for PPS The periodic pulse event interrupts are used to register the PPS events into the system, so it is only applicable to PTP_CLK_REQ_PPS request. However, these interrupts are mistakenly enabled in PTP_CLK_REQ_PEROUT request, so fix this error. Fixes: 671e266835b8 ("ptp: netc: add periodic pulse output support") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20250915082528.1616361-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit a09655dde754bc9c39fc603c310fc8c02b7e8a19 Author: Chaoyi Chen Date: Tue Sep 16 09:26:28 2025 +0800 Revert "net: ethernet: stmmac: dwmac-rk: Make the clk_phy could be used for external phy" This reverts commit da114122b83149d1f1db0586b1d67947b651aa20. As discussed, the PHY clock should be managed by PHY driver instead of other driver like dwmac-rk. Reported-by: Marek Szyprowski Link: https://lore.kernel.org/a30a8c97-6b96-45ba-bad7-8a40401babc2@samsung.com Fixes: da114122b831 ("net: ethernet: stmmac: dwmac-rk: Make the clk_phy could be used for external phy") Signed-off-by: Chaoyi Chen Link: https://patch.msgid.link/0A3F1D1604FEE424+20250916012628.1819-1-kernel@airkyi.com Signed-off-by: Jakub Kicinski commit dc110d1b23564ce448cc4c9ff2346b7e1db4dd84 Author: Dave Stevenson Date: Tue Sep 16 11:10:59 2025 +0300 net: cadence: macb: Add support for Raspberry Pi RP1 ethernet controller The RP1 chip has the Cadence GEM block, but wants the tx_clock to always run at 125MHz, in the same way as sama7g5. Add the relevant configuration. Signed-off-by: Dave Stevenson Signed-off-by: Stanimir Varbanov Reviewed-by: Andrew Lunn Acked-by: Nicolas Ferre Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20250916081059.3992108-1-svarbanov@suse.de Signed-off-by: Jakub Kicinski commit aa9f09a26bfda97bdbdbec4bce2279a41300c969 Merge: dfc85640796b41 a60fc3294a3772 Author: Jakub Kicinski Date: Wed Sep 17 15:04:11 2025 -0700 Merge branch 'ptp-safely-cleanup-when-unregistering-a-ptp-clock' Russell King says: ==================== ptp: safely cleanup when unregistering a PTP clock The standard rule in the kernel for unregistering user visible devices is to unpublish the userspace API before doing any shutdown of the resources necessary for the operation of the device. PTP has several issues in this area: 1. ptp_clock_unregister() cancells and destroys work while the PTP chardev is still published, which gives the opportunity for a precisely timed user API call to cause a driver to attempt to queue the aux work. 2. PTP pins are not cleaned up - if userspace has enabled PTP pins, e.g. for extts, drivers are forced to do cleanup before calling ptp_clock_unregister() to stop events being forwarded into the PTP layer. E.g mv88e6xxx cancells its internal tai_event_work to avoid calling into the PTP clock code with a stale ptp_clock pointer, but a badly timed userspace EXTTS enable will re-schedule the tai_event_work. Simplify the process by ensuring that: 1. we take a referene on the PTP struct device to stop the ptp_clock structure going away underneath us when we call posix_clock_unregister(). 2. call posix_clock_unregister() to remove the /dev/ptp* device. 3. add additional functionality to disable any PTP EXTTS pins and PPS event generation that have been configured on this device. This should shutdown all events coming from PTP clock drivers. 4. cancel the delayed aux_work and destroy the kthread. 5. remove the PPS source. 6. drop the reference on the PTP struct device to allow the ptp_clock structure to be released. This is difficult for me to test beyond build testing - on the Clearfog platform with Marvell PHY PTP, the ethernet PHY is the primary connectivity, so removing the PHY driver for an in-use network interface isn't possible. On the ZII rev B platform, where the DSA switches have the TAI hardware and where root NFS is used, removal of the DSA switch module somehow forces the FEC interface _not_ connected to the DSA switch to lose link, causing the machine to become unresponsive as its root filesystem vanishes. ==================== Link: https://patch.msgid.link/aMnYIu7RbgfXrmGx@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a60fc3294a377204664b5484e4a487fa124155da Author: Russell King (Oracle) Date: Tue Sep 16 22:36:03 2025 +0100 ptp: rework ptp_clock_unregister() to disable events The ordering of ptp_clock_unregister() is not ideal, as the chardev remains published while state is being torn down, which means userspace can race with the kernel teardown. There is also no cleanup of enabled pin settings nor of the internal PPS event, which means enabled events can still forward into the core, dereferencing a free'd pointer. Rework the ordering of cleanup in ptp_clock_unregister() so that we unpublish the posix clock (and user chardev), disable any pins that have EXTTS events enabled, disable the PPS event, and then clean up the aux work and PPS source. This avoids potential use-after-free and races in PTP clock driver teardown. Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean # ocelot, sja1105, netdevsim, vclocks Reviewed-by: Vadim Fedorenko Acked-by: Richard Cochran Link: https://patch.msgid.link/E1uydLH-000000061DM-2gcV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0fcb1dc3e8044a20f584c3dbdf01ce6d2234ca4c Author: Russell King (Oracle) Date: Tue Sep 16 22:35:58 2025 +0100 ptp: describe the two disables in ptp_set_pinfunc() Accurately describe what each call to ptp_disable_pinfunc() is doing, rather than the misleading comment above the first disable. This helps to make the code more readable. Reviewed-by: Vladimir Oltean Reviewed-by: Vadim Fedorenko Signed-off-by: Russell King (Oracle) Acked-by: Richard Cochran Link: https://patch.msgid.link/E1uydLC-000000061DG-2BRt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 11fafeb2657e2c2df3d011ca759962a4e81b19b1 Author: Dmitry Torokhov Date: Thu Aug 14 11:47:06 2025 -0700 Input: twl4030_keypad - drop support for platform data Support for platform data from dropped from twl in 4a346a03a63c ("mfd: twl: Remove platform data support") and board files were dropped even earlier. There are no in-kernel users of twl4030_keypad_data in the kernel, and the driver supports configuration via generic device properties. Drop support of static platform data from the keypad driver. Reviewed-by: Andreas Kemnade Link: https://lore.kernel.org/r/tica7ol7xwv5tqb7hlkzu6wkiv4quxwrpqv6croe4wfnwvj6wv@4ob6ktqqi3cr Signed-off-by: Dmitry Torokhov commit dfc85640796b414385e50c932eb2b8ce4d38ce72 Author: Lad Prabhakar Date: Tue Sep 16 17:23:35 2025 +0100 net: pcs: Kconfig: Fix unmet dependency warning Fix the Kconfig dependencies for PCS_RZN1_MIIC to avoid the unmet direct dependency warning when enabling DWMAC_RENESAS_GBETH. The PCS driver is used on multiple Renesas SoCs including RZ/N1, RZ/N2H and RZ/T2H, but the existing condition only allowed ARCH_RZN1, ARCH_R9A09G077, or ARCH_R9A09G087. This conflicted with the GBETH/GMAC driver which selects PCS_RZN1_MIIC under ARCH_RENESAS. Update the dependency to ARCH_RENESAS || COMPILE_TEST so that the PCS driver is available on all Renesas platforms. Fixes: 08f89e42121d ("net: pcs: rzn1-miic: Add RZ/T2H MIIC support") Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/all/aMlgg_QpJOEDGcEA@monster/ Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250916162335.3339558-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 4436b2b324cec38caa876b11e521d270240a9986 Author: Jakub Kicinski Date: Tue Sep 16 10:04:31 2025 -0700 tools: ynl-gen: support uint in multi-attr The ethtool FEC histogram series run into a build issue with type: uint + multi-attr: True. Auto scalars use 64b types, we need to convert them explicitly when rendering the types. No current spec needs this, and the ethtool FEC histogram doesn't need this either any more, so not posting as a fix. Link: https://lore.kernel.org/8f52c5b8-bd8a-44b8-812c-4f30d50f63ff@redhat.com Reviewed-by: Vadim Fedorenko Reviewed-by: Donald Hunter Signed-off-by: Jakub Kicinski commit 09fd8626cf8285503b4803b30b06c296599a24e7 Author: Stephan Gerhold Date: Wed Sep 17 14:11:32 2025 -0700 Input: add Himax HX852x(ES) touchscreen driver Add a simple driver for the Himax HX852x(ES) touch panel controller, with support for multi-touch and capacitive touch keys. The driver is somewhat based on sample code from Himax. However, that code was rather confusing, so that we spent a significant amount of time just trying to understand the packet format and register commands. In this driver they are described with clean structs and defines rather than magic numbers and offset calculations. Co-developed-by: Jonathan Albrieux Signed-off-by: Jonathan Albrieux Reviewed-by: Jeff LaBundy Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250915-hx852x-v5-2-b938182f1056@linaro.org Signed-off-by: Dmitry Torokhov commit f9d803784f8dfea60f394d7fc94084c5f1eb4027 Author: Stephan Gerhold Date: Wed Sep 17 14:11:18 2025 -0700 dt-bindings: input: touchscreen: document Himax HX852x(ES) Himax HX852x(ES) is a touch panel controller with optional support for capacitive touch keys. Unfortunately, the model naming is quite unclear and confusing. There seems to be a distinction between models (e.g. HX8526) and the "series" suffix (e.g. -A, -B, -C, -D, -E, -ES). But this doesn't seem to be applied very consistently because e.g. HX8527-E(44) actually seems to belong to the -ES series. The compatible consists of the actual part number followed by the "series" as fallback compatible. Typically only the latter will be interesting for drivers as there is no relevant difference on the driver side. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250915-hx852x-v5-1-b938182f1056@linaro.org Signed-off-by: Dmitry Torokhov commit 925e9296dadf83b5136665060f86c3e5b6669fa1 Merge: d5ad57fc428c1e 32d4cedd24ed34 Author: Dmitry Torokhov Date: Wed Sep 17 14:42:16 2025 -0700 Merge tag 'ib-mfd-gpio-input-pinctrl-pwm-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next Sync up with MFD tree to bring in support for MAX7360. commit fb3c27a69c4736a9a78bb344b56907f8fb172edc Author: Michal Wajdeczko Date: Tue Sep 16 19:00:29 2025 +0200 drm/xe/sysfs: Simplify sysfs registration Instead of manually maintaining each sysfs file define and use attribute groups and register them using device managed function. Then use is_visible() to filter-out unsupported attributes. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Rodrigo Vivi Cc: Raag Jadav Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250916170029.3313-3-michal.wajdeczko@intel.com commit a2d6223d224f333f705ed8495bf8bebfbc585c35 Author: Michal Wajdeczko Date: Tue Sep 16 19:00:28 2025 +0200 drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE (already guarded by the info.skip_pcode flag) so we shouldn't expose attributes that require any of them to avoid errors like: [] xe 0000:03:00.1: [drm] Tile0: GT0: VF is trying to read an \ inaccessible register 0x138340+0x0 [] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe] [] Call Trace: [] xe_mmio_read32+0x110/0x280 [xe] [] auto_link_downgrade_capable_show+0x2e/0x70 [xe] [] dev_attr_show+0x1a/0x70 [] sysfs_kf_seq_show+0xaa/0x120 [] kernfs_seq_show+0x41/0x60 Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Fixes: cdc36b66cd41 ("drm/xe: Expose fan control and voltage regulator version") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Lukasz Laguna Reviewed-by: Raag Jadav Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250916170029.3313-2-michal.wajdeczko@intel.com commit a79765248649de77771c24f7be08ff4c96f16f7a Author: Al Viro Date: Sat Aug 30 02:48:13 2025 -0400 constify {__,}mnt_is_readonly() Signed-off-by: Al Viro commit 1e414adf03ae5a9928aad9044a07adeb92ddcd2c Author: Al Viro Date: Wed Aug 27 14:04:31 2025 -0400 WRITE_HOLD machinery: no need for to bump mount_lock seqcount ... neither for insertion into the list of instances, nor for mnt_{un,}hold_writers(), nor for mnt_get_write_access() deciding to be nice to RT during a busy-wait loop - all of that only needs the spinlock side of mount_lock. IOW, it's mount_locked_reader, not mount_writer. Clarify the comment re locking rules for mnt_unhold_writers() - it's not just that mount_lock needs to be held when calling that, it must have been held all along since the matching mnt_hold_writers(). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 3371fa2f27134fc4ec7d40b2ae7b9e92c3b2527e Author: Al Viro Date: Wed Aug 27 13:37:12 2025 -0400 struct mount: relocate MNT_WRITE_HOLD bit ... from ->mnt_flags to LSB of ->mnt_pprev_for_sb. This is safe - we always set and clear it within the same mount_lock scope, so we won't interfere with list operations - traversals are always forward, so they don't even look at ->mnt_prev_for_sb and both insertions and removals are in mount_lock scopes of their own, so that bit will be clear in *all* mount instances during those. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 09a1b33c080f6ac700fadc67c8471e67bf75fda4 Author: Al Viro Date: Wed Aug 27 12:33:11 2025 -0400 preparations to taking MNT_WRITE_HOLD out of ->mnt_flags We have an unpleasant wart in accessibility rules for struct mount. There are per-superblock lists of mounts, used by sb_prepare_remount_readonly() to check if any of those is currently claimed for write access and to block further attempts to get write access on those until we are done. As soon as it is attached to a filesystem, mount becomes reachable via that list. Only sb_prepare_remount_readonly() traverses it and it only accesses a few members of struct mount. Unfortunately, ->mnt_flags is one of those and it is modified - MNT_WRITE_HOLD set and then cleared. It is done under mount_lock, so from the locking rules POV everything's fine. However, it has easily overlooked implications - once mount has been attached to a filesystem, it has to be treated as globally visible. In particular, initializing ->mnt_flags *must* be done either prior to that point or under mount_lock. All other members are still private at that point. Life gets simpler if we move that bit (and that's *all* that can get touched by access via this list) out of ->mnt_flags. It's not even hard to do - currently the list is implemented as list_head one, anchored in super_block->s_mounts and linked via mount->mnt_instance. As the first step, switch it to hlist-like open-coded structure - address of the first mount in the set is stored in ->s_mounts and ->mnt_instance replaced with ->mnt_next_for_sb and ->mnt_pprev_for_sb - the former either NULL or pointing to the next mount in set, the latter - address of either ->s_mounts or ->mnt_next_for_sb in the previous element of the set. In the next commit we'll steal the LSB of ->mnt_pprev_for_sb as replacement for MNT_WRITE_HOLD. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 5d132cfafb6a86740e65177c79fd5d7b02613383 Author: Al Viro Date: Sat Jul 5 00:38:09 2025 -0400 setup_mnt(): primitive for connecting a mount to filesystem Take the identical logics in vfs_create_mount() and clone_mnt() into a new helper that takes an empty struct mount and attaches it to given dentry (sub)tree. Should be called once in the lifetime of every mount, prior to making it visible in any data structures. After that point ->mnt_root and ->mnt_sb never change; ->mnt_root is a counting reference to dentry and ->mnt_sb - an active reference to superblock. Mount remains associated with that dentry tree all the way until the call of cleanup_mnt(), when the refcount eventually drops to zero. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7f954a6f491088f18a6c7c975da8ddc8c003e518 Author: Al Viro Date: Wed Aug 27 13:46:33 2025 -0400 simplify the callers of mnt_unhold_writers() The logics in cleanup on failure in mount_setattr_prepare() is simplified by having the mnt_hold_writers() failure followed by advancing m to the next node in the tree before leaving the loop. And since all calls are preceded by the same check that flag has been set and the function is inlined, let's just shift the check into it. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d7b7253a0adc6e24869ef74a2085767cb11eb6fc Author: Al Viro Date: Tue Aug 26 17:12:15 2025 -0400 copy_mnt_ns(): use guards * mntput() of rootmnt and pwdmnt done via __free(mntput) * mnt_ns_tree_add() can be done within namespace_excl scope. Signed-off-by: Al Viro commit 7bb4c851dcb7a4ec0b4ba7fcf3f451da0894969d Author: Al Viro Date: Tue Aug 26 17:04:44 2025 -0400 copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure Now that free_mnt_ns() works prior to mnt_ns_tree_add(), there's no need for an open-coded analogue free_mnt_ns() there - yes, we do avoid one call_rcu() use per failing call of clone() or unshare(), if they fail due to OOM in that particular spot, but it's not really worth bothering. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1b966c4471e6c3862a14f80aeb316ef636d40f84 Merge: 57a7b5b0b6d9b9 38f4885088fc5a Author: Al Viro Date: Wed Sep 17 15:58:06 2025 -0400 Merge branch 'no-rebase-mnt_ns_tree_remove' into work.mount commit bdf780fbcef5df4d365404a178e7f845a317b4e9 Author: Huisong Li Date: Thu Sep 11 19:24:07 2025 +0800 ACPI: processor: idle: Rearrange declarations in header file Group all of the declarations of functions that belong to the ACPI processor idle driver together in one place in processor.h. While at it, drop the unnecessary extern modifier from the declaraions of two functions. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250911112408.1668431-3-lihuisong@huawei.com [ rjw: Subject and changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit 141714e163bbb7620d538af48fce4024a4f239e1 Author: Krzysztof Kozlowski Date: Tue Sep 2 16:00:19 2025 +0200 arm64: dts: qcom: sm8750-mtp: Add WiFi and Bluetooth MTP8750 rev 2.0 (power grid v8) boards come as two different variants with different WiFi chips: WCN7850 and WCN786x. WCN7850 is already supported by the kernel, but WCN786x is not. Both of the board variants are considered newest revisions and the difference is only in MCN numbers and internal codenames. Add WCN7850 WiFi and Bluetooth to the MTP8750, stating that this DTS represents the WCN7850 variant. The S4D and S5F regulators should operate at 0.85 V, thus adjust lower constraint and regulator name. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250902140018.247209-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 48e7e8996cf78101da5aa8292647ed960506da03 Author: Barnabás Czémán Date: Wed Sep 3 23:27:33 2025 +0200 arm64: dts: qcom: msm8953-xiaomi-daisy: fix cd-gpios SD detection was not working because cd-gpios flag was wrongly configured, according to downstream sources device is using GPIO_ACTIVE_HIGH. Fix SD detection with change cd-gpios from GPIO_ACTIVE_LOW to GPIO_ACTIVE_HIGH. Fixes: 38d779c26395 ("arm64: dts: qcom: msm8953: Add device tree for Xiaomi Mi A2 Lite") Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903-daisy-sd-fix-v2-1-e08c50f3be57@mainlining.org Signed-off-by: Bjorn Andersson commit 3f1707306b79cafc5a11350befd5a4081b807760 Author: Viken Dadhaniya Date: Thu Sep 11 10:02:56 2025 +0530 serial: qcom-geni: Load UART qup Firmware from linux side Add provision to load firmware of Serial engine for UART protocol from Linux Execution Environment on running on APPS processor. Co-developed-by: Mukesh Kumar Savaliya Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250911043256.3523057-7-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 99cf351ee1c46b39c0581220807290b1dd56488e Author: Viken Dadhaniya Date: Thu Sep 11 10:02:55 2025 +0530 spi: geni-qcom: Load spi qup Firmware from linux side Add provision to load firmware of Serial engine for SPI protocol from Linux Execution Environment on running on APPS processor. Co-developed-by: Mukesh Kumar Savaliya Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Viken Dadhaniya Acked-by: Mark Brown Link: https://lore.kernel.org/r/20250911043256.3523057-6-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b645df76536c5b7d40e60450bf8011f70f34415f Author: Viken Dadhaniya Date: Thu Sep 11 10:02:54 2025 +0530 i2c: qcom-geni: Load i2c qup Firmware from linux side Add provision to load firmware of Serial engine for I2C protocol from Linux Execution Environment on running on APPS processor. Acked-by: Andi Shyti Co-developed-by: Mukesh Kumar Savaliya Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250911043256.3523057-5-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d4bf06592ad68ac4353a81c73e8e662cf88aa2cc Author: Viken Dadhaniya Date: Thu Sep 11 10:02:53 2025 +0530 soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem In Qualcomm SoCs, firmware loading for Serial Engines (SE) within the QUP hardware has traditionally been managed by TrustZone (TZ). This restriction poses a significant challenge for developers, as it limits their ability to enable various protocols on any of the SEs from the Linux side, reducing flexibility. Load the firmware to QUP SE based on the 'firmware-name' property specified in devicetree at bootup time. Co-developed-by: Mukesh Kumar Savaliya Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250911043256.3523057-4-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b44a593fb53a6f5e135af2c5351546f80c1285ac Author: Viken Dadhaniya Date: Thu Sep 11 10:02:52 2025 +0530 soc: qcom: geni-se: Cleanup register defines and update copyright Refactor register macros for consistency and clarity and remove redundant definitions and update naming for better alignment. Update copyright to include Qualcomm Technologies, Inc. Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250911043256.3523057-3-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9bc7130822c4c7f3ef39f20174a379e476586ab3 Author: Viken Dadhaniya Date: Thu Sep 11 10:02:51 2025 +0530 dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus Introduce a new YAML schema for QUP-supported peripherals. Define common properties used across QUP-supported peripherals. Add property `qcom,enable-gsi-dma` to configure the Serial Engine (SE) for QCOM GPI DMA mode. Reference the common schema YAML in the GENI I2C, SPI, and SERIAL YAML files. Reviewed-by: Krzysztof Kozlowski Co-developed-by: Mukesh Kumar Savaliya Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250911043256.3523057-2-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c49b5e89c45f317f23d11b640f77e91d0d8e5b56 Author: Chen Ridong Date: Wed Sep 17 06:04:54 2025 +0000 cpuset: use partition_cpus_change for setting exclusive cpus A previous patch has introduced a new helper function partition_cpus_change(). Now replace the exclusive cpus setting logic with this helper function. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit de9f15e21c55a0a7d2c907b7f0eec95385c5a9de Author: Chen Ridong Date: Wed Sep 17 06:04:53 2025 +0000 cpuset: use parse_cpulist for setting cpus.exclusive Previous patches made parse_cpulist handle empty cpu mask input. Now use this helper for exclusive cpus setting. Also, compute_trialcs_xcpus can be called with empty cpus and handles it correctly. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 27db8246004ad467ab36dedce847e24f9ca34b94 Author: Chen Ridong Date: Wed Sep 17 06:04:52 2025 +0000 cpuset: introduce partition_cpus_change Introduce the partition_cpus_change function to handle both regular CPU set updates and exclusive CPU modifications, either of which may trigger partition state changes. This generalized function will also be utilized for exclusive CPU updates in subsequent patches. With the introduction of compute_trialcs_excpus in a previous patch, the trialcs->effective_xcpus field is now consistently computed and maintained. Consequently, the legacy logic which assigned **trialcs->allowed_cpus to a local 'xcpus' variable** when trialcs->effective_xcpus was empty has been removed. This removal is safe because when trialcs is not a partition member, trialcs->effective_xcpus is now correctly populated with the intersection of user_xcpus and the parent's effective_xcpus. This calculation inherently covers the scenario previously handled by the removed code. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit c6366739804f836ac88474527430d3fd174580eb Author: Chen Ridong Date: Wed Sep 17 06:04:51 2025 +0000 cpuset: refactor cpus_allowed_validate_change Refactor cpus_allowed_validate_change to handle the special case where cpuset.cpus can be set even when violating partition sibling CPU exclusivity rules. This differs from the general validation logic in validate_change. Add a wrapper function to properly handle this exceptional case. The trialcs->prs_err field is cleared before performing validation checks for both CPU changes and partition errors. If cpus_allowed_validate_change fails its validation, trialcs->prs_err is set to PERR_NOTEXCL. If partition validation fails, the specific error code returned by validate_partition is assigned to trialcs->prs_err. With the partition validation status now directly available through trialcs->prs_err, the local boolean variable 'invalidate' becomes redundant and can be safely removed. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 7e05981ba34a214fd43a2e4d776bc6b0c235e2fb Author: Chen Ridong Date: Wed Sep 17 06:04:50 2025 +0000 cpuset: refactor out validate_partition Refactor the validate_partition function to handle cpuset partition validation when modifying cpuset.cpus. This refactoring also makes the function reusable for handling cpuset.cpus.exclusive updates in subsequent patches. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 8daab66eb329ed2fe7e2922c3739dfa53dcf4694 Author: Chen Ridong Date: Wed Sep 17 06:04:49 2025 +0000 cpuset: introduce cpus_excl_conflict and mems_excl_conflict helpers This patch adds cpus_excl_conflict() and mems_excl_conflict() helper functions to improve code readability and maintainability. The exclusive conflict checking follows these rules: 1. If either cpuset has the 'exclusive' flag set, their user_xcpus must not have any overlap. 2. If neither cpuset has the 'exclusive' flag set, their 'cpuset.cpus.exclusive' (only for v2) values must not intersect. 3. The 'cpuset.cpus' of one cpuset must not form a subset of another cpuset's 'cpuset.cpus.exclusive'. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit c5866c9a007deb92717fc0b94ac47b47291748be Author: Chen Ridong Date: Wed Sep 17 06:04:48 2025 +0000 cpuset: refactor CPU mask buffer parsing logic The current implementation contains redundant handling for empty mask inputs, as cpulist_parse() already properly handles these cases. This refactoring introduces a new helper function parse_cpuset_cpulist() to consolidate CPU list parsing logic and eliminate special-case checks for empty inputs. Additionally, the effective_xcpus computation for trial cpusets has been simplified. Rather than computing effective_xcpus only when exclusive_cpus is set or when the cpuset forms a valid partition, we now recalculate it on every cpuset.cpus update. This approach ensures consistency and allows removal of redundant effective_xcpus logic in subsequent patches. The trial cpuset's effective_xcpus calculation follows two distinct cases: 1. For member cpusets: effective_xcpus is determined by the intersection of cpuset->exclusive_cpus and the parent's effective_xcpus. 2. For non-member cpusets: effective_xcpus is derived from the intersection of user_xcpus and the parent's effective_xcpus. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 86bbbd1f33ab31a20f6cacf88660333d25ef5fa4 Author: Chen Ridong Date: Wed Sep 17 06:04:47 2025 +0000 cpuset: Refactor exclusive CPU mask computation logic The current compute_effective_exclusive_cpumask function handles multiple scenarios with different input parameters, making the code difficult to follow. This patch refactors it into two separate functions: compute_excpus and compute_trialcs_excpus. The compute_excpus function calculates the exclusive CPU mask for a given input and excludes exclusive CPUs from sibling cpusets when cs's exclusive_cpus is not explicitly set. The compute_trialcs_excpus function specifically handles exclusive CPU computation for trial cpusets used during CPU mask configuration updates, and always excludes exclusive CPUs from sibling cpusets. This refactoring significantly improves code readability and clarity, making it explicit which function to call for each use case and what parameters should be provided. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 6a59fc4a3a5b19ea375b54ea70d16713c45ea5a0 Author: Chen Ridong Date: Wed Sep 17 06:04:46 2025 +0000 cpuset: change return type of is_partition_[in]valid to bool The functions is_partition_valid() and is_partition_invalid() logically return boolean values, but were previously declared with return type 'int'. This patch changes their return type to 'bool' to better reflect their semantic meaning and improve type safety. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit bba0ccf829b904e6d1f119d94f01d7209d34ba28 Author: Chen Ridong Date: Wed Sep 17 06:04:45 2025 +0000 cpuset: remove unused assignment to trialcs->partition_root_state The trialcs->partition_root_state field is not used during the configuration of 'cpuset.cpus' or 'cpuset.cpus.exclusive'. Therefore, the assignment of values to this field can be safely removed. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit b783a6265589783e297f8dc4647a31d870d8396e Author: Chen Ridong Date: Wed Sep 17 06:04:44 2025 +0000 cpuset: move the root cpuset write check earlier The 'cpus' or 'mems' lists of the top_cpuset cannot be modified. This check can be moved before acquiring any locks as a common code block to improve efficiency and maintainability. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 Author: Hengqi Chen Date: Tue Sep 16 23:26:53 2025 +0000 bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() The current implementation seems incorrect and does NOT match the comment above, use bpf_jit_binary_pack_finalize() instead. Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") Acked-by: Puranjay Mohan Signed-off-by: Hengqi Chen Acked-by: Song Liu Acked-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com Signed-off-by: Alexei Starovoitov commit a24a2dda70fb40629d44b899452d8e4c0be075e2 Author: Eduard Zingerman Date: Tue Sep 16 14:22:51 2025 -0700 selftests/bpf: trigger verifier.c:maybe_exit_scc() for a speculative state This is a test case minimized from a syzbot reproducer from [1]. The test case triggers verifier.c:maybe_exit_scc() w/o preceding call to verifier.c:maybe_enter_scc() on a speculative symbolic execution path. Here is verifier log for the test case: Live regs before insn: 0: .......... (b7) r0 = 100 1 1: 0......... (7b) *(u64 *)(r10 -512) = r0 1 2: 0......... (b5) if r0 <= 0x0 goto pc-2 3: 0......... (95) exit 0: R1=ctx() R10=fp0 0: (b7) r0 = 100 ; R0_w=100 1: (7b) *(u64 *)(r10 -512) = r0 ; R0_w=100 R10=fp0 fp-512_w=100 2: (b5) if r0 <= 0x0 goto pc-2 mark_precise: ... 2: R0_w=100 3: (95) exit from 2 to 1 (speculative execution): R0_w=scalar() R1=ctx() R10=fp0 fp-512_w=100 1: R0_w=scalar() R1=ctx() R10=fp0 fp-512_w=100 1: (7b) *(u64 *)(r10 -512) = r0 processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 - Non-speculative execution path 0-3 does not allocate any checkpoints (and hence does not call maybe_enter_scc()), and schedules a speculative jump from 2 to 1. - Speculative execution path stops immediately because of an infinite loop detection and triggers verifier.c:update_branch_counts() -> maybe_exit_scc() calls. [1] https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/ Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250916212251.3490455-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit a3c73d629ea1373af3c0c954d41fd1af555492e3 Author: Eduard Zingerman Date: Tue Sep 16 14:22:50 2025 -0700 bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a verifier_bug() call in maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a state with insn_idx in some SCC, there should be an instance of struct bpf_scc_visit allocated for that SCC. Turns out the assumption does not hold for speculative execution paths. See example in the next patch. maybe_scc_exit() is called from update_branch_counts() for states that reach branch count of zero, meaning that path exploration for a particular path is finished. Path exploration can finish in one of three ways: a. Verification error is found. In this case, update_branch_counts() is called only for non-speculative paths. b. Top level BPF_EXIT is reached. Such instructions are never a part of an SCC, so compute_scc_callchain() in maybe_scc_exit() will return false, and maybe_scc_exit() will return early. c. A checkpoint is reached and matched. Checkpoints are created by is_state_visited(), which calls maybe_enter_scc(), which allocates bpf_scc_visit instances for checkpoints within SCCs. Hence, for non-speculative symbolic execution paths, the assumption still holds: if maybe_scc_exit() is called for a state within an SCC, bpf_scc_visit instance must exist. This patch removes the verifier_bug() call for speculative paths. Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges") Reported-by: syzbot+3afc814e8df1af64b653@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/ Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250916212251.3490455-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit a1f692fd69ccdbe1e492d366788b63227d429753 Author: Eric Biggers Date: Mon Sep 15 11:08:19 2025 -0500 fsverity: Use 2-way interleaved SHA-256 hashing when supported When the crypto library provides an optimized implementation of sha256_finup_2x(), use it to interleave the hashing of pairs of data blocks. On some CPUs this nearly doubles hashing performance. The increase in overall throughput of cold-cache fsverity reads that I'm seeing on arm64 and x86_64 is roughly 35% (though this metric is hard to measure as it jumps around a lot). For now this is only done on the verification path, and only for data blocks, not Merkle tree blocks. We could use sha256_finup_2x() on Merkle tree blocks too, but that is less important as there aren't as many Merkle tree blocks as data blocks, and that would require some additional code restructuring. We could also use sha256_finup_2x() to accelerate building the Merkle tree, but verification performance is more important. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4bd70b53bd7d554d402b2d8f5972a54e39a2e5ab Author: Eric Biggers Date: Mon Sep 15 11:08:18 2025 -0500 fsverity: Remove inode parameter from fsverity_hash_block() Due to the conversion from crypto_shash to the library API, fsverity_hash_block() can no longer fail. Therefore, the inode parameter, which was used only to print an error message in the case of a failure, is no longer necessary. Remove it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6733968be7cb0ce559c755f639c41629fa11761e Author: Eric Biggers Date: Mon Sep 15 11:08:17 2025 -0500 lib/crypto: tests: Add tests and benchmark for sha256_finup_2x() Update sha256_kunit to include test cases and a benchmark for the new sha256_finup_2x() function. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit bc6d6a4172a7fa599fe66f16e9a2c1cdc6983207 Author: Eric Biggers Date: Mon Sep 15 11:08:16 2025 -0500 lib/crypto: x86/sha256: Add support for 2-way interleaved hashing Add an implementation of sha256_finup_2x_arch() for x86_64. It interleaves the computation of two SHA-256 hashes using the x86 SHA-NI instructions. dm-verity and fs-verity will take advantage of this for greatly improved performance on capable CPUs. This increases the throughput of SHA-256 hashing 4096-byte messages by the following amounts on the following CPUs: Intel Ice Lake (server): 4% Intel Sapphire Rapids: 38% Intel Emerald Rapids: 38% AMD Zen 1 (Threadripper 1950X): 84% AMD Zen 4 (EPYC 9B14): 98% AMD Zen 5 (Ryzen 9 9950X): 64% For now, this seems to benefit AMD more than Intel. This seems to be because current AMD CPUs support concurrent execution of the SHA-NI instructions, but unfortunately current Intel CPUs don't, except for the sha256msg2 instruction. Hopefully future Intel CPUs will support SHA-NI on more execution ports. Zen 1 supports 2 concurrent sha256rnds2, and Zen 4 supports 4 concurrent sha256rnds2, which suggests that even better performance may be achievable on Zen 4 by interleaving more than two hashes. However, doing so poses a number of trade-offs, and furthermore Zen 5 goes back to supporting "only" 2 concurrent sha256rnds2. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 34c3f1e346e7b2b8a420b1ea341b341525baf92b Author: Eric Biggers Date: Mon Sep 15 11:08:15 2025 -0500 lib/crypto: arm64/sha256: Add support for 2-way interleaved hashing Add an implementation of sha256_finup_2x_arch() for arm64. It interleaves the computation of two SHA-256 hashes using the ARMv8 SHA-256 instructions. dm-verity and fs-verity will take advantage of this for greatly improved performance on capable CPUs. This increases the throughput of SHA-256 hashing 4096-byte messages by the following amounts on the following CPUs: ARM Cortex-X1: 70% ARM Cortex-X3: 68% ARM Cortex-A76: 65% ARM Cortex-A715: 43% ARM Cortex-A510: 25% ARM Cortex-A55: 8% Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4ca24d6abbca5df76c4b189dd94fb055613de297 Author: Eric Biggers Date: Mon Sep 15 11:08:14 2025 -0500 lib/crypto: sha256: Add support for 2-way interleaved hashing Many arm64 and x86_64 CPUs can compute two SHA-256 hashes in nearly the same speed as one, if the instructions are interleaved. This is because SHA-256 is serialized block-by-block, and two interleaved hashes take much better advantage of the CPU's instruction-level parallelism. Meanwhile, a very common use case for SHA-256 hashing in the Linux kernel is dm-verity and fs-verity. Both use a Merkle tree that has a fixed block size, usually 4096 bytes with an empty or 32-byte salt prepended. Usually, many blocks need to be hashed at a time. This is an ideal scenario for 2-way interleaved hashing. To enable this optimization, add a new function sha256_finup_2x() to the SHA-256 library API. It computes the hash of two equal-length messages, starting from a common initial context. For now it always falls back to sequential processing. Later patches will wire up arm64 and x86_64 optimized implementations. Note that the interleaving factor could in principle be higher than 2x. However, that runs into many practical difficulties and CPU throughput limitations. Thus, both the implementations I'm adding are 2x. In the interest of using the simplest solution, the API matches that. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250915160819.140019-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ed323aeda5e09fa1ab95946673939c8c425c329c Author: Sebastian Andrzej Siewior Date: Mon Sep 15 23:26:30 2025 +0200 selftest/futex: Compile also with libnuma < 2.0.16 After using numa_set_mempolicy_home_node() the test fails to compile on systems with libnuma library versioned lower than 2.0.16. In order to allow lower library version add a pkg-config related check and exclude that part of the code. Without the proper MPOL setup it can't be tested. Make a total number of tests two. The first one is the first batch and the second is the MPOL related one. The goal is to let the user know if it has been skipped due to library limitation. Remove test_futex_mpol(), it was unused and it is now complained by the compiler if the part is not compiled. Fixes: 0ecb4232fc65e ("selftests/futex: Set the home_node in futex_numa_mpol") Closes: https://lore.kernel.org/oe-lkp/202507150858.bedaf012-lkp@intel.com Reported-by: kernel test robot Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) commit 2951dddef0a87c20e83c77070bd5077290d9121f Author: André Almeida Date: Mon Sep 15 23:26:29 2025 +0200 selftest/futex: Reintroduce "Memory out of range" numa_mpol's subtest Commit d8e2f919997 ("selftests/futex: Fix some futex_numa_mpol subtests") removed the "Memory out of range" subtest due to it being dependent on the memory layout of the test process having an invalid memory address just after the `*futex_ptr` allocated memory. Reintroduce this test and make it deterministic, by allocation two memory pages and marking the second one with PROT_NONE. Signed-off-by: André Almeida Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Waiman Long commit c1c863457780adfb2e29fa9a85897179ad3903e6 Author: André Almeida Date: Mon Sep 15 23:26:28 2025 +0200 selftest/futex: Make the error check more precise for futex_numa_mpol Instead of just checking if the syscall failed as expected, check as well if the returned error code matches the expected error code. [ bigeasy: reword the commmit message ] Signed-off-by: André Almeida Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Waiman Long commit abe962346ef420998d47ba1c2fe591582f69e92e Author: Igor Belwon Date: Wed Sep 17 16:58:28 2025 +0200 regulator: Fix MAX77838 selection The current entry for the MAX77838 regulator is unselectable (as it depended on a non-user-selectable config - REGMAP_I2C). Fix this by making it select the config, and not depending on it. Signed-off-by: Igor Belwon Link: https://patch.msgid.link/20250917-maxreg-kconfig-fix-v1-1-1369f88d6272@mentallysanemainliners.org Signed-off-by: Mark Brown commit 652b08afba69d5d26fe91098eb832b1bcc0f91c2 Author: Cristian Birsan Date: Thu Nov 21 20:16:38 2024 +0200 ARM: at91: remove default values for PMC_PLL_ACR Remove default values for PMC PLL Analog Control Register(ACR) as the values are specific for each SoC and PLL and load them from PLL characteristics structure Co-developed-by: Andrei Simion Signed-off-by: Andrei Simion Signed-off-by: Cristian Birsan [nicolas.ferre@microchip.com: fix pll acr write sequence, preserve val] Signed-off-by: Nicolas Ferre commit bfa2bddf6ffe0ac034d02cda20c74ef05571210e Author: Cristian Birsan Date: Thu Nov 21 17:47:17 2024 +0200 clk: at91: add ACR in all PLL settings Add the ACR register to all PLL settings and provide the correct ACR value for each PLL used in different SoCs. Suggested-by: Mihai Sain Signed-off-by: Cristian Birsan [nicolas.ferre@microchip.com: add sama7d65 and review commit message] Signed-off-by: Nicolas Ferre commit 94a1274100e397a27361ae53ace37be6da42a079 Author: Balamanikandan Gunasundar Date: Tue Sep 9 16:08:17 2025 +0530 clk: at91: sam9x7: Add peripheral clock id for pmecc Add pmecc instance id in peripheral clock description. Signed-off-by: Balamanikandan Gunasundar Link: https://lore.kernel.org/r/20250909103817.49334-1-balamanikandan.gunasundar@microchip.com [claudiu.beznea@tuxon.dev: use tabs instead of spaces] Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre commit e0237f5635727d64635ec6665e1de9f4cacce35c Author: Ryan Wanner Date: Mon Sep 8 13:07:17 2025 -0700 clk: at91: clk-master: Add check for divide by 3 A potential divider for the master clock is div/3. The register configuration for div/3 is MASTER_PRES_MAX. The current bit shifting method does not work for this case. Checking for MASTER_PRES_MAX will ensure the correct decimal value is stored in the system. Signed-off-by: Ryan Wanner Signed-off-by: Nicolas Ferre commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 Author: Nicolas Ferre Date: Wed Aug 27 17:08:10 2025 +0200 clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register This register is important for sequencing the commands to PLLs, so actually write the update bits with regmap_write_bits() instead of relying on a read/modify/write regmap command that could skip the actual hardware write if the value is identical to the one read. It's changed when modification is needed to the PLL, when read-only operation is done, we could keep the call to regmap_update_bits(). Add a comment to the sam9x60_div_pll_set_div() function that uses this PLL_UPDT register so that it's used consistently, according to the product's datasheet. Signed-off-by: Nicolas Ferre Tested-by: Ryan Wanner # on sama7d65 and sam9x75 Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com [claudiu.beznea: fix "Alignment should match open parenthesis" checkpatch.pl check] Signed-off-by: Claudiu Beznea commit 0c01fe49651d387776abed6a28541e80c8a93319 Author: Nicolas Ferre Date: Wed Aug 27 16:54:27 2025 +0200 ARM: at91: pm: save and restore ACR during PLL disable/enable Add a new word in assembly to store ACR value during the calls to at91_plla_disable/at91_plla_enable macros and use it. Signed-off-by: Nicolas Ferre [cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] Signed-off-by: Cristian Birsan Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com Reviewed-by: Alexandre Belloni Signed-off-by: Claudiu Beznea commit 33fe111a35a40c62761cc4ee75509b50c598fa4f Author: Shuicheng Lin Date: Thu Sep 11 17:31:40 2025 +0000 drm/xe/madvise: Fix ioctl argument check It is "preferred_mem_loc" instead of "atomic" for the ATTR_PREFERRED_LOC path. Also include 2 minor changes with no functional impact. 1. Remove the redundant "attr.atomic_access" assignment. 2. Replace down_read_interruptible() with xe_svm_notifier_lock_interruptible() to pair with xe_svm_notifier_unlock(). Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Cc: Himal Prasad Ghimiray Signed-off-by: Shuicheng Lin Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250911173139.1405878-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 5959c4da17e01782ad09b226802ac1f1ef157a70 Author: Shuicheng Lin Date: Thu Sep 11 03:14:06 2025 +0000 drm/xe: Misc refine for svm These changes should have no functional impact. 1. Correct typo of "operation"in macro range_debug(). 2. Combine 2 spin_lock() call in xe_svm_garbage_collector() into 1. 3. Drop redundant preferred_region_is_vram check in xe_svm_range_needs_migrate_to_vram(). 4. Combine the devmem_possible check in xe_svm_handle_pagefault(). need_vram includes the IS_DGFX() check, so there is no change for .devmem_only. v2: revert !ctx.devmem_only change (Matt) v3: rebase code and refine commit message. v4: rebase code and refine commit message. Reviewed-by: Matthew Brost Signed-off-by: Shuicheng Lin Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250911031405.1371812-2-shuicheng.lin@intel.com commit 5c5db9efe323dd0b0d7917dbe5b9c0999c95e79e Author: Sascha Bischoff Date: Thu Aug 28 10:59:43 2025 +0000 irqchip/gic-v5: Drop has_gcie_v3_compat from gic_kvm_info The presence of FEAT_GCIE_LEGACY is now handled as a CPU feature. Therefore, drop the check and flag from the GIC driver and gic_kvm_info as it is no longer required or used by KVM. Signed-off-by: Sascha Bischoff Acked-by: Thomas Gleixner Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 754e43b09561f59dd04e0b8aafe4f5c9a71a4d1f Author: Sascha Bischoff Date: Thu Aug 28 10:59:42 2025 +0000 KVM: arm64: Use ARM64_HAS_GICV5_LEGACY for GICv5 probing The previous implementation of the probing function had the flaw that it wouldn't catch mismatched CPU features. Specifically, GICv5 legacy support (support for GICv3 VMs on a GICv5 host) was being enabled as long as the initial boot CPU had support for the feature. This allowed the support to become enabled on mismatched configurations. Move to using cpus_have_final_cap(ARM64_HAS_GICV5_LEGACY) instead, which only returns true when all booted CPUs support FEAT_GCIE_LEGACY. A byproduct of this is that it ensures that late onlining of CPUs is blocked on feature mismatch. Signed-off-by: Sascha Bischoff Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 7847f51189343b29a24ca7edafb60a9032d5acf8 Author: Sascha Bischoff Date: Thu Aug 28 10:59:42 2025 +0000 arm64: cpucaps: Add GICv5 Legacy vCPU interface (GCIE_LEGACY) capability Implement the GCIE_LEGACY capability as a system feature to be able to check for support from KVM. The type is explicitly ARM64_CPUCAP_EARLY_LOCAL_CPU_FEATURE, which means that the capability is enabled early if all boot CPUs support it. Additionally, if this capability is enabled during boot, it prevents late onlining of CPUs that lack it, thereby avoiding potential mismatched configurations which would break KVM. Signed-off-by: Sascha Bischoff Reviewed-by: Suzuki K Poulose Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit d5a012af348d4d84287267547eb8637b937545af Author: Sascha Bischoff Date: Thu Aug 28 10:59:42 2025 +0000 KVM: arm64: Enable nested for GICv5 host with FEAT_GCIE_LEGACY Extend the NV check to pass for a GICv5 host that has FEAT_GCIE_LEGACY. The has_gcie_v3_compat flag is only set on GICv5 hosts (that explicitly support FEAT_GCIE_LEGACY), and hence the explicit check for a VGIC_V5 is omitted. As of this change, vGICv3-based VMs can run with nested on a compatible GICv5 host. Signed-off-by: Sascha Bischoff Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 9664d5810e9bc919a9a661594e01eabc80befe8a Author: Marc Zyngier Date: Wed Sep 17 10:11:28 2025 +0100 KVM: arm64: Don't access ICC_SRE_EL2 if GICv3 doesn't support v2 compatibility We currently access ICC_SRE_EL2 at each load/put on VHE, and on each entry/exit on nVHE. Both are quite onerous on NV, as this register always traps. We do this to make sure the EL1 guest doesn't flip between v2 and v3 behind our back. But all modern implementations have dropped v2, and this is just overhead. At the same time, the GICv5 spec has been fixed to allow access to ICC_SRE_EL2 in legacy mode. Use this opportunity to replace the GICv5 checks for v2 compat checks, with an ad-hoc static key. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 5f9466b50c1b4253d91abf81780b90a722133162 Author: Fuad Tabba Date: Wed Sep 17 14:07:37 2025 +0100 KVM: arm64: Fix page leak in user_mem_abort() The user_mem_abort() function acquires a page reference via __kvm_faultin_pfn() early in its execution. However, the subsequent checks for mismatched attributes between stage 1 and stage 2 mappings would return an error code directly, bypassing the corresponding page release. Fix this by storing the error and releasing the unused page before returning the error. Fixes: 6d674e28f642 ("KVM: arm/arm64: Properly handle faulting of device mappings") Fixes: 2a8dfab26677 ("KVM: arm64: Block cacheable PFNMAP mapping") Signed-off-by: Fuad Tabba Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 32314d940ee6c7608219f9fffb20483c020dc63c Merge: 295593ab948f76 6f1ece1e868839 Author: Marc Zyngier Date: Wed Sep 17 17:30:44 2025 +0100 Merge branch kvm-arm64/dump-instr into kvmarm-master/next * kvm-arm64/dump-instr: : . : Dump the isntruction stream on panic, just like the rest of the kernel : already does. : : Patches courtesy of Mostafa Saleh (20250909133631.3844423-1-smostafa@google.com) : . KVM: arm64: Map hyp text as RO and dump instr on panic KVM: arm64: Dump instruction on hyp panic Signed-off-by: Marc Zyngier commit 295593ab948f76a4e9c5f4579b07cab2a243396d Merge: 3064cee8c3f78a 7d9a0273c45962 Author: Marc Zyngier Date: Wed Sep 17 17:30:32 2025 +0100 Merge branch kvm-arm64/mmio-rcu into kvmarm-master/next * kvm-arm64/mmio-rcu: : . : Speed up MMIO registration by avoiding unnecessary RCU synchronisation, : courtesy of Keir Fraser (20250909100007.3136249-1-keirf@google.com). : . KVM: Avoid synchronize_srcu() in kvm_io_bus_register_dev() KVM: Implement barriers before accessing kvm->buses[] on SRCU read paths KVM: arm64: vgic: Explicitly implement vgic_dist::ready ordering KVM: arm64: vgic-init: Remove vgic_ready() macro Signed-off-by: Marc Zyngier commit 2bbdcf02c3f3df6c85abd0a2fee0d7f0f4113e96 Author: Gustavo A. R. Silva Date: Wed Sep 17 15:28:07 2025 +0200 stddef: Introduce __TRAILING_OVERLAP() Introduce underlying __TRAILING_OVERLAP() macro to let callers apply atributes to trailing overlapping members. For instance, the code below: | struct flex { | size_t count; | int data[]; | }; | struct { | struct flex f; | struct foo a; | struct boo b; | } __packed instance; can now be changed to the following, and preserve the __packed attribute: | __TRAILING_OVERLAP(struct flex, f, data, __packed, | struct foo a; | struct boo b; | ) instance; Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/f80c529b239ce11f0a51f714fe00ddf839e05f5e.1758115257.git.gustavoars@kernel.org Signed-off-by: Kees Cook commit 413187f79062634575098653c40f95d439d3b157 Author: Gustavo A. R. Silva Date: Wed Sep 17 15:26:49 2025 +0200 stddef: Remove token-pasting in TRAILING_OVERLAP() Currently, TRAILING_OVERLAP() token-pastes the FAM parameter into the name of internal pdding member `__offset_to_##FAM`. This forces FAM to be a single identifier, which prevents callers from using a FAM when it's a nested member. For instance, see the following scenario: | struct flex { | size_t count; | int data[]; | }; | struct foo { | int hdr_foo; | struct flex f; | }; | struct composite { | struct foo hdr; | int data[100]; | }; In this case, it'd be useful if TRAILING_OVERLAP() could be used in the following way: | struct composite { | TRAILING_OVERLAP(struct foo, hdr, f.data, | int data[100]; | ); | }; However, this is not current possible due to the token concatenation in `__offset_to_##FAM`, which fails when FAM contains a dot. So, remove token-pasting and use the fixed internal name `__offset_to_FAM` and, with this, expand the capabilities of TRAILING_OVERLAP(). :) Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/13b3e0a69aad837b4e32ca8269b9d91bf1fbe9ef.1758115257.git.gustavoars@kernel.org Signed-off-by: Kees Cook commit 6515c612e79949b17ef4b8c4180c07bbeaf01e4d Author: Marc Zyngier Date: Tue Sep 16 17:11:03 2025 +0100 KVM: arm64: Fix kvm_vcpu_{set,is}_be() to deal with EL2 state Nobody really cares about BE, but KVM currently only deals with SCTLR_EL1 when evaluating or setting the endianness in PSCI, meaning that we evaluate whatever the L2 state has been at some point. Teach these primitives about SCTLR_EL2, and forget about BE... Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 23361bd54966b437e1ed3eb1a704572f4b279e58 Author: wangzijie Date: Wed Sep 17 10:36:22 2025 +0800 f2fs: fix infinite loop in __insert_extent_tree() When we get wrong extent info data, and look up extent_node in rb tree, it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by return NULL and print some kernel messages in that case. Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8175c864391753b210f3dcfae1aeed686a226ebb Author: wangzijie Date: Wed Sep 17 10:36:21 2025 +0800 f2fs: fix zero-sized extent for precache extents Script to reproduce: f2fs_io write 1 0 1881 rand dsync testfile f2fs_io fallocate 0 7708672 4096 testfile f2fs_io write 1 1881 1 rand buffered testfile fsync testfile umount mount f2fs_io precache_extents testfile When the data layout is something like this: dnode1: dnode2: [0] A [0] NEW_ADDR [1] A+1 [1] 0x0 ... [1016] A+1016 [1017] B (B!=A+1017) [1017] 0x0 During precache_extents, we map the last block(valid blkaddr) in dnode1: map->m_flags |= F2FS_MAP_MAPPED; map->m_pblk = blkaddr(valid blkaddr); map->m_len = 1; then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: map->m_len = 1 ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 ei.fofs = start_pgofs = 1882 ei.len = map->m_len - ofs = 1 - 1 = 0 Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: A,B,C is valid blkaddr case1: dnode1: dnode2: [0] A [0] NEW_ADDR [1] A+1 [1] 0x0 ... .... [1016] A+1016 [1017] B (B!=A+1017) [1017] 0x0 case2: dnode1: dnode2: [0] A [0] C (C!=B+1) [1] A+1 [1] C+1 ... .... [1016] A+1016 [1017] B (B!=A+1017) [1017] 0x0 case3: dnode1: dnode2: [0] A [0] C (C!=B+2) [1] A+1 [1] C+1 ... .... [1015] A+1015 [1016] B (B!=A+1016) [1017] B+1 [1017] 0x0 [1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit cf6ee09b0913308729f9c38cfbcb8320c10fe5d5 Author: Matthew Wood Date: Wed Sep 17 05:58:14 2025 -0700 PCI/sysfs: Expose PCI device serial number Add a single sysfs read-only interface for reading PCI device serial numbers from userspace in a programmatic way. This device attribute uses the same hexadecimal 1-byte dashed formatting as lspci serial number capability output. If a device doesn't support the serial number capability, the serial_number sysfs attribute will not be visible. Signed-off-by: Matthew Wood Signed-off-by: Bjorn Helgaas Reviewed-by: Mario Limonciello Reviewed-by: Jonathan Cameron Reviewed-by: Thomas Weißschuh Reviewed-by: Keith Busch Reviewed-by: Krzysztof Wilczyński Link: https://patch.msgid.link/20250917125815.722952-2-thepacketgeek@gmail.com commit 02edab6ceefaaf8cb917e864d8c26dbac0ea9686 Author: Dave Jiang Date: Fri Aug 29 11:09:21 2025 -0700 cxl: Add a cached copy of target_map to cxl_decoder Add a cached copy of the hardware port-id list that is available at init before all @dport objects have been instantiated. Change is in preparation of delayed dport instantiation. Reviewed-by: Robert Richter Reviewed-by: Jonathan Cameron Tested-by: Robert Richter Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 8330671c57c7056ef5e1e8dccfcdda7d5fe6d0b0 Author: Dave Jiang Date: Fri Aug 29 11:09:20 2025 -0700 cxl: Add helper to delete dport Refactor the code in reap_dports() out to provide a helper function that reaps a single dport. This will be used later in the cleanup path for allocating a dport. Renaming to del_port() and del_dports() to mirror devm_cxl_add_dport(). [dj] Fixed up subject per Robert Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Tested-by: Robert Richter Signed-off-by: Dave Jiang commit 4fde89539a18d39169a511fda00db65eeba1a8e0 Author: Dave Jiang Date: Fri Aug 29 11:09:19 2025 -0700 cxl: Add helper to detect top of CXL device topology Add a helper to replace the open code detection of CXL device hierarchy root, or the host bridge. The helper will be used for delayed downstream port (dport) creation. Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Reviewed-by: Dan Williams Reviewed-by: Alison Schofield Reviewed-by: Robert Richter Tested-by: Robert Richter Signed-off-by: Dave Jiang commit b410d25fb349bc32132749bd2cb17aa17054287d Author: Manikanta Mylavarapu Date: Wed Sep 17 15:49:00 2025 +0400 arm64: dts: qcom: ipq5018: add QUP1 UART2 node Add node to support the second UART node controller in IPQ5018. Signed-off-by: Manikanta Mylavarapu Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250917-ipq5018-uart2-v1-1-f8680bbf947f@outlook.com Signed-off-by: Bjorn Andersson commit 6e5c4c093c7215198ea9fa83dcbc47d3f961de7a Author: Krishna Kurapati Date: Wed Sep 17 18:08:27 2025 +0530 arm64: dts: qcom: lemans: Flatten usb controller nodes Flatten usb controller nodes and update to using latest bindings and flattened driver approach. Enumeration of ADB has been tested on EVK Platform. Signed-off-by: Krishna Kurapati Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250917123827.671966-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5b7bdc4402b12bdad747cce305ecbc9737aed7ba Author: Thomas Weißschuh Date: Tue Sep 16 18:51:35 2025 +0200 kselftest/arm64/gcs/basic-gcs: Respect parent directory CFLAGS basic-gcs has it's own make rule to handle the special compiler invocation to build against nolibc. This rule does not respect the $(CFLAGS) passed by the Makefile from the parent directory. However these $(CFLAGS) set up the include path to include the UAPI headers from the current kernel. Due to this the asm/hwcap.h header is used from the toolchain instead of the UAPI and the definition of HWCAP_GCS is not found. Restructure the rule for basic-gcs to respect the $(CFLAGS). Also drop those options which are already provided by $(CFLAGS). Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/lkml/CA+G9fYv77X+kKz2YT6xw7=9UrrotTbQ6fgNac7oohOg8BgGvtw@mail.gmail.com/ Fixes: a985fe638344 ("kselftest/arm64/gcs: Use nolibc's getauxval()") Tested-by: Linux Kernel Functional Testing Signed-off-by: Thomas Weißschuh Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit e6d2338b6f3e522872f3a14fcc5e5de2f58bf23b Author: Thorsten Blum Date: Tue Sep 16 14:21:45 2025 +0200 firewire: core: use struct_size and flex_array_size in ioctl_add_descriptor Use struct_size() to determine the memory needed for a new 'struct descriptor_resource' and flex_array_size() to calculate the number of bytes to copy from userspace. This removes the hardcoded size (4 bytes) for the 'u32 data[]' entries. No functional changes intended. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250916122143.2459993-3-thorsten.blum@linux.dev Signed-off-by: Takashi Sakamoto commit 67da3f16e5f97a864a0beb4f9758d09e1890a76e Author: Mikko Rapeli Date: Mon Sep 15 11:33:16 2025 +0300 mmc: select REGMAP_MMIO with MMC_LOONGSON2 COMPILE_TEST with MMC_LOONGSON2 failed to link due to undeclared dependency: ERROR: modpost: "__devm_regmap_init_mmio_clk" [drivers/mmc/host/loongson2-mmc.ko] undefined! Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver") Suggested-by: Arnd Bergmann Suggested-by: Binbin Zhou Signed-off-by: Mikko Rapeli Signed-off-by: Ulf Hansson commit 7cd8db0fb0b2bf309163d56fec585c0f9e0964d1 Author: Mikko Rapeli Date: Mon Sep 15 11:33:15 2025 +0300 mmc: add COMPILE_TEST to multiple drivers These compile on x86_64 with =y and =m. Acked-by: Arnd Bergmann Signed-off-by: Mikko Rapeli Signed-off-by: Ulf Hansson commit c60934d5ca088908794510ae9314dbbc5fcc9935 Author: Brian Masney Date: Sun Aug 10 18:16:19 2025 -0400 pmdomain: mediatek: airoha: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Note that prior to running the Coccinelle, airoha_cpu_pmdomain_clk_round() was renamed to airoha_cpu_pmdomain_clk_round_rate(). Signed-off-by: Brian Masney Signed-off-by: Ulf Hansson commit 3253cb49cbad4772389d6ef55be75db1f97da910 Author: Sebastian Andrzej Siewior Date: Thu Sep 4 16:25:25 2025 +0200 softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT softirqs are preemptible on PREEMPT_RT. There is synchronisation between individual sections which disable bottom halves. This in turn means that a forced threaded interrupt cannot preempt another forced threaded interrupt. Instead it will PI-boost the other handler and wait for its completion. This is required because code within a softirq section is assumed to be non-preemptible and may expect exclusive access to per-CPU resources such as variables or pinned timers. Code with such expectation has been identified and updated to use local_lock_nested_bh() for locking of the per-CPU resource. This means the softirq lock can be removed. Disable the softirq synchronization, but add a new config switch CONFIG_PREEMPT_RT_NEEDS_BH_LOCK which allows to re-enable the synchronized behavior in case that there are issues, which haven't been detected yet. The softirq_ctrl.cnt accounting remains to let the NOHZ code know if softirqs are currently handled. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner commit fd4e876f59b7e70283b4025c717cad8948397be1 Author: Sebastian Andrzej Siewior Date: Thu Sep 4 16:25:24 2025 +0200 softirq: Provide a handshake for canceling tasklets via polling The tasklet_unlock_spin_wait() via tasklet_disable_in_atomic() is provided for a few legacy tasklet users. The interface is used from atomic context (which is either softirq or disabled preemption) on non-PREEMPT_RT and relies on spinning until the tasklet callback completes. On PREEMPT_RT the context is never atomic but the busy polling logic remains. It is possible that the thread invoking tasklet_unlock_spin_wait() has higher priority than the tasklet. If both run on the same CPU the the tasklet makes no progress and the thread trying to cancel the tasklet will live-lock the system. To avoid the lockup tasklet_unlock_spin_wait() uses local_bh_disable()/ enable() which utilizes the local_lock_t for synchronisation. This lock is a central per-CPU BKL and about to be removed. Solve this by acquire a lock in tasklet_action_common() which is held while the tasklet's callback is invoked. This lock will be acquired from tasklet_unlock_spin_wait() via tasklet_callback_cancel_wait_running(). After the tasklet completed tasklet_callback_sync_wait_running() drops the lock and acquires it again. In order to avoid unlocking the lock even if there is no cancel request, there is a cb_waiters counter which is incremented during a cancel request. Blocking on the lock will PI-boost the tasklet if needed, ensuring progress is made. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner commit 5b3a897c3f90e16beff5124934bf5b10c6c68f6b Author: Mikko Rapeli Date: Mon Sep 15 11:33:14 2025 +0300 pmdomain: rockchip: enable ROCKCHIP_PM_DOMAINS with ARCH_ROCKCHIP On rk3399 based rockpi4b, mounting rootfs from mmc fails unless ROCKCHIP_PM_DOMAINS is enabled. Accoriding to Heiko Stübner all SoCs since 2012 have power domains so the support should be enabled by default on both arm and arm64. Failing boot without CONFIG_ROCKCHIP_PM_DOMAINS=y: https://ledge.validation.linaro.org/scheduler/job/119268 /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev dw-apb-uart ff1a0000.serial: forbid DMA for kernel console root '/dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e' doesn't exist or does not contain a /dev. rk_gmac-dwmac fe300000.ethernet: deferred probe timeout, ignoring dependency rk_gmac-dwmac fe300000.ethernet: probe with driver rk_gmac-dwmac failed with error -110 rk_iommu ff650800.iommu: deferred probe timeout, ignoring dependency rk_iommu ff650800.iommu: probe with driver rk_iommu failed with error -110 dwmmc_rockchip fe320000.mmc: deferred probe timeout, ignoring dependency rockchip-typec-phy ff7c0000.phy: deferred probe timeout, ignoring dependency dwmmc_rockchip fe320000.mmc: probe with driver dwmmc_rockchip failed with error -110 rockchip-typec-phy ff7c0000.phy: probe with driver rockchip-typec-phy failed with error -110 rockchip-typec-phy ff800000.phy: deferred probe timeout, ignoring dependency rockchip-typec-phy ff800000.phy: probe with driver rockchip-typec-phy failed with error -110 rk_iommu ff660480.iommu: deferred probe timeout, ignoring dependency rk_iommu ff660480.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff8f3f00.iommu: deferred probe timeout, ignoring dependency rk_iommu ff8f3f00.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff903f00.iommu: deferred probe timeout, ignoring dependency rk_iommu ff903f00.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff914000.iommu: deferred probe timeout, ignoring dependency rk_iommu ff914000.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff924000.iommu: deferred probe timeout, ignoring dependency rk_iommu ff924000.iommu: probe with driver rk_iommu failed with error -110 platform fe800000.usb: deferred probe pending: platform: wait for supplier /phy@ff7c0000/usb3-port sdhci-arasan fe330000.mmc: deferred probe timeout, ignoring dependency platform fe900000.usb: deferred probe pending: platform: wait for supplier /phy@ff800000/usb3-port sdhci-arasan fe330000.mmc: probe with driver sdhci-arasan failed with error -110 platform ff1d0000.spi: deferred probe pending: (reason unknown) platform hdmi-sound: deferred probe pending: asoc-simple-card: parse error Working boot with CONFIG_ROCKCHIP_PM_DOMAINS=y: https://ledge.validation.linaro.org/scheduler/job/119272 dwmmc_rockchip fe320000.mmc: IDMAC supports 32-bit address mode. dwmmc_rockchip fe320000.mmc: Using internal DMA controller. dwmmc_rockchip fe320000.mmc: Version ID is 270a dwmmc_rockchip fe320000.mmc: DW MMC controller at irq 45,32 bit host data width,256 deep fifo dwmmc_rockchip fe320000.mmc: Got CD GPIO ff1a0000.serial: ttyS2 at MMIO 0xff1a0000 (irq = 44, base_baud = 1500000) is a 16550A printk: legacy console [ttyS2] enabled mmc_host mmc1: Bus speed (slot 0) = 400000Hz (slot req 400000Hz, actual 400000HZ div = 0) dw_wdt ff848000.watchdog: No valid TOPs array specified mmc_host mmc1: Bus speed (slot 0) = 50000000Hz (slot req 50000000Hz, actual 50000000HZ div = 0) mmc0: CQHCI version 5.10 rk_gmac-dwmac fe300000.ethernet: IRQ eth_wake_irq not found mmc1: new high speed SDHC card at address aaaa fan53555-regulator 0-0040: FAN53555 Option[8] Rev[1] Detected! fan53555-regulator 0-0041: FAN53555 Option[8] Rev[1] Detected! rk_gmac-dwmac fe300000.ethernet: IRQ eth_lpi not found mmcblk1: mmc1:aaaa SC16G 14.8 GiB rk_gmac-dwmac fe300000.ethernet: IRQ sfty not found GPT:Primary header thinks Alt. header is not at the end of the disk. rk_gmac-dwmac fe300000.ethernet: Deprecated MDIO bus assumption used GPT:1978417 != 31116287 rk_gmac-dwmac fe300000.ethernet: PTP uses main clock GPT:Alternate GPT header not at the end of the disk. rk_gmac-dwmac fe300000.ethernet: clock input or output? (input). GPT:1978417 != 31116287 rk_gmac-dwmac fe300000.ethernet: TX delay(0x28). GPT: Use GNU Parted to correct GPT errors. rk_gmac-dwmac fe300000.ethernet: RX delay(0x11). mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 Acked-by: Heiko Stuebner Acked-by: Arnd Bergmann Suggested-by: Ulf Hansson Suggested-by: Heiko Stübner Suggested-by: Arnd Bergmann Signed-off-by: Mikko Rapeli Signed-off-by: Ulf Hansson commit 180a46bc1a1c585f5187df7bccdb522556f4ecd8 Author: Paul Chaignon Date: Wed Sep 17 10:10:53 2025 +0200 selftests/bpf: Test accesses to ctx padding This patch adds tests covering the various paddings in ctx structures. In case of sk_lookup BPF programs, the behavior is a bit different because accesses to the padding are explicitly allowed. Other cases result in a clear reject from the verifier. Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/3dc5f025e350aeb2bb1c257b87c577518e574aeb.1758094761.git.paul.chaignon@gmail.com commit 7c60f6e488b7aba224ebe396b04ad54b8e31e168 Author: Paul Chaignon Date: Wed Sep 17 10:09:26 2025 +0200 selftests/bpf: Move macros to bpf_misc.h Move the sizeof_field and offsetofend macros from individual test files to the common bpf_misc.h to avoid duplication. Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/97a3f3788bd3aec309100bc073a5c77130e371fd.1758094761.git.paul.chaignon@gmail.com commit 6fabca2fc94d33cdf7ec102058983b086293395f Author: Paul Chaignon Date: Wed Sep 17 10:08:00 2025 +0200 bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch. Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Acked-by: Daniel Borkmann Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com commit 6f51a04551d162f5acbcf6c1998f0527093c93ef Author: Duje Mihanović Date: Sat Sep 13 23:12:49 2025 +0200 pmdomain: marvell: Add PXA1908 power domains Marvell's PXA1908 SoC has a few power domains for its VPU, GPU, image processor and DSI PHY. Add a driver to control these. Signed-off-by: Duje Mihanović Signed-off-by: Ulf Hansson commit 614106a731f9b78a6edd07ee94d57afb9d0097ff Merge: 5c479a670a22eb 5bcf9e1d0a5da7 Author: Ulf Hansson Date: Wed Sep 17 16:12:08 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 5bcf9e1d0a5da750ff180e7385b0bd4041686516 Author: Duje Mihanović Date: Sat Sep 13 23:12:48 2025 +0200 dt-bindings: clock: marvell,pxa1908: Add syscon compatible to apmu Add required syscon compatible and #power-domain-cells to the APMU controller. This is required for the SoC's power domain controller as the registers are shared. Device tree bindings for said power domains are also added. Reviewed-by: Rob Herring (Arm) Signed-off-by: Duje Mihanović Signed-off-by: Ulf Hansson commit 5bb5258e357eb79719d1c998731b932c945cb52c Author: Michal Wajdeczko Date: Tue Sep 16 19:16:45 2025 +0200 drm/xe/tests: Add pre-GMDID IP descriptors to param generators Recently introduced kunit parameter generators were based on the existing arrays which have only GDMID-based IPs and didn't take into account IP definitions from pre-GMDID era. Add test only arrays with pre-GMDID IPs (as those will not change) and extend param generators to start iterating over them. [ ] =================== xe_pci (2 subtests) ==================== [ ] ==================== check_graphics_ip ==================== [ ] [PASSED] 12.00 Xe_LP [ ] [PASSED] 12.10 Xe_LP+ [ ] [PASSED] 12.55 Xe_HPG [ ] [PASSED] 12.60 Xe_HPC [ ] [PASSED] 12.70 Xe_LPG [ ] [PASSED] 12.71 Xe_LPG [ ] [PASSED] 12.74 Xe_LPG+ [ ] [PASSED] 20.01 Xe2_HPG [ ] [PASSED] 20.02 Xe2_HPG [ ] [PASSED] 20.04 Xe2_LPG [ ] [PASSED] 30.00 Xe3_LPG [ ] [PASSED] 30.01 Xe3_LPG [ ] [PASSED] 30.03 Xe3_LPG [ ] ================ [PASSED] check_graphics_ip ================ [ ] ===================== check_media_ip ====================== [ ] [PASSED] 12.00 Xe_M [ ] [PASSED] 12.55 Xe_HPM [ ] [PASSED] 13.00 Xe_LPM+ [ ] [PASSED] 13.01 Xe2_HPM [ ] [PASSED] 20.00 Xe2_LPM [ ] [PASSED] 30.00 Xe3_LPM [ ] [PASSED] 30.02 Xe3_LPM [ ] ================= [PASSED] check_media_ip ================== [ ] ===================== [PASSED] xe_pci ====================== Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Matt Roper Cc: Jani Nikula Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250916171645.3335-1-michal.wajdeczko@intel.com commit 336aec7b06be860477be80a4299263a2e9355789 Author: Yu Kuai Date: Wed Sep 17 15:55:39 2025 +0800 blk-throttle: fix throtl_data leak during disk release Tightening the throttle activation check in blk_throtl_activated() to require both q->td presence and policy bit set introduced a memory leak during disk release: blkg_destroy_all() clears the policy bit first during queue deactivation, causing subsequent blk_throtl_exit() to skip throtl_data cleanup when blk_throtl_activated() fails policy check. Idealy we should avoid modifying blk_throtl_exit() activation check because it's intuitive that blk-throtl start from blk_throtl_init() and end in blk_throtl_exit(). However, call blk_throtl_exit() before blkg_destroy_all() will make a long term deadlock problem easier to trigger[1], hence fix this problem by checking if q->td is NULL from blk_throtl_exit(), and remove policy deactivation as well since it's useless. [1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation") Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/ Signed-off-by: Yu Kuai Signed-off-by: Jens Axboe commit 0b507305a08c134722f363de6fe6f1ba84e313b7 Author: Bart Van Assche Date: Tue Sep 16 13:40:43 2025 -0700 blk-mq: Fix the blk_mq_tagset_busy_iter() documentation Commit 2dd6532e9591 ("blk-mq: Drop 'reserved' arg of busy_tag_iter_fn") removed the 'reserved' argument from tag iteration callback functions. Bring the blk_mq_tagset_busy_iter() documentation in sync with that change. Cc: Jens Axboe Cc: Christoph Hellwig Cc: Ming Lei Cc: John Garry Signed-off-by: Bart Van Assche Reviewed-by: Ming Lei Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit e7085be863839e3438fb67da65a74b64e99917e7 Author: Saeed Mahameed Date: Mon Sep 8 09:52:56 2025 -0700 fwctl/mlx5: Add Adjacent function query commands and their scope MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID: - Query Adjacent functions (PFs/VFs) of the function calling FW. MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT: - Delegates own VFs to be managed/seen by other adjacent PFs MLX5_CMD_OP_QUERY_DELEGATED_VHCA: - Query current function delegation state. Link: https://patch.msgid.link/r/20250908165256.1255985-3-saeed@kernel.org Signed-off-by: Saeed Mahameed Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe commit cb81f72f86e0ad7da83236c2f8b2db5a8f1310ba Author: Avihai Horon Date: Mon Sep 8 09:52:55 2025 -0700 fwctl/mlx5: Allow MODIFY_CONG_STATUS command MODIFY_CONG_STATUS command is used to enable or disable congestion control according to a given priority and protocol. Add MODIFY_CONG_STATUS to the allowed commands under configuration scope. Link: https://patch.msgid.link/r/20250908165256.1255985-2-saeed@kernel.org Signed-off-by: Avihai Horon Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe commit ef3d979b3e270b6a41b6f306bfc442253c41a4cd Author: Leon Romanovsky Date: Wed Sep 17 09:37:36 2025 +0300 kmsan: fix missed kmsan_handle_dma() signature conversion kmsan_handle_dma_sg() has call to kmsan_handle_dma() function which was missed during conversion to physical addresses. Update that caller too and fix the following compilation error: mm/kmsan/hooks.c:372:6: error: too many arguments to function call, expected 3, have 4 371 | kmsan_handle_dma(sg_page(item), item->offset, item->length, | ~~~~~~~~~~~~~~~~ 372 | dir); | ^~~ mm/kmsan/hooks.c:362:19: note: 'kmsan_handle_dma' declared here 362 | EXPORT_SYMBOL_GPL(kmsan_handle_dma); Fixes: 6eb1e769b2c1 ("kmsan: convert kmsan_handle_dma to use physical addresses") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509170638.AMGNCMEE-lkp@intel.com/ Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Reviewed-by: Alexander Potapenko Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/4b2d7d0175b30177733bbbd42bf979d77eb73c29.1758090947.git.leon@kernel.org commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c Author: Takashi Iwai Date: Wed Sep 17 14:13:27 2025 +0200 ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait() snd_seq_fifo_poll_wait() evaluates f->cells without locking after poll_wait(), and KCSAN doesn't like it as it appears to be a data-race. Although this doesn't matter much in practice as the value is volatile, it's still better to address it for the mind piece. Wrap it with f->lock spinlock for avoiding the potential data race. Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba Signed-off-by: Takashi Iwai commit 7e18682bdbda4df24837dae4cf103b2a6de3d699 Author: Takashi Iwai Date: Wed Sep 17 13:12:49 2025 +0200 ALSA: spi/at73c213: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit ab63e9910d2d3ea4b8e6c08812258a676defcb9c Author: Tim Kuo Date: Wed Sep 17 13:58:39 2025 +0800 spi: mt65xx: add dual and quad mode for standard spi device Mediatek SPI hardware natively supports dual and quad modes, and these modes are already enabled for SPI flash devices under spi-mem framework in MTK SPI controller spi-mt65xx. However, other SPI devices, such as touch panels, are limited to single mode because spi-mt65xx lacks SPI mode argument parsing from SPI framework for these SPI devices outside spi-mem framework. This patch adds dual and quad mode support for these SPI devices by introducing a new API, mtk_spi_set_nbits, for SPI mode argument parsing. Signed-off-by: Tim Kuo Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250917055839.500615-1-Tim.Kuo@mediatek.com Signed-off-by: Mark Brown commit a699213d4e6ef4286348c6439837990f121e0c03 Author: Krzysztof Kozlowski Date: Wed Sep 17 10:04:38 2025 +0900 serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its dependent commit 86fa39dd6fb7 ("serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms") because the first one causes regression - hang task on Qualcomm RB1 board (QRB2210) and unable to use serial at all during normal boot: INFO: task kworker/u16:0:12 blocked for more than 42 seconds. Not tainted 6.17.0-rc1-00004-g53e760d89498 #9 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u16:0 state:D stack:0 pid:12 tgid:12 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: async async_run_entry_fn Call trace: __switch_to+0xe8/0x1a0 (T) __schedule+0x290/0x7c0 schedule+0x34/0x118 rpm_resume+0x14c/0x66c rpm_resume+0x2a4/0x66c rpm_resume+0x2a4/0x66c rpm_resume+0x2a4/0x66c __pm_runtime_resume+0x50/0x9c __driver_probe_device+0x58/0x120 driver_probe_device+0x3c/0x154 __driver_attach_async_helper+0x4c/0xc0 async_run_entry_fn+0x34/0xe0 process_one_work+0x148/0x290 worker_thread+0x2c4/0x3e0 kthread+0x118/0x1c0 ret_from_fork+0x10/0x20 The issue was reported on 12th of August and was ignored by author of commits introducing issue for two weeks. Only after complaining author produced a fix which did not work, so if original commits cannot be reliably fixed for 5 weeks, they obviously are buggy and need to be dropped. Fixes: 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") Reported-by: Alexey Klimov Closes: https://lore.kernel.org/all/DC0D53ZTNOBU.E8LSD5E5Z8TX@linaro.org/ Signed-off-by: Krzysztof Kozlowski Tested-by: Alexey Klimov Reviewed-by: Alexey Klimov Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250917010437.129912-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit f4abab350840d58d69814c6993736f03ac27df83 Author: Arturs Artamonovs Date: Tue Sep 16 16:57:17 2025 +0100 tty: serial: fix help message for SERIAL_CPM Running checkpatch reported error extra whitespace at the end of help message for SERIAL_CPM menu entry Signed-off-by: Arturs Artamonovs Signed-off-by: Greg Kroah-Hartman commit 855318e7c0c4a3e3014c0469dd5bc93a1c0df30c Author: Rahul Rameshbabu Date: Sun Sep 14 03:18:34 2025 +0000 rust: pci: fix incorrect platform reference in PCI driver probe doc comment Substitute 'platform' with 'pci'. Fixes: 1bd8b6b2c5d3 ("rust: pci: add basic PCI device / driver abstractions") Cc: stable@kernel.org Signed-off-by: Rahul Rameshbabu Signed-off-by: Danilo Krummrich commit a404d099554d17206d1f283c9a91f0616324f691 Author: Rahul Rameshbabu Date: Sun Sep 14 03:19:19 2025 +0000 rust: pci: fix incorrect platform reference in PCI driver unbind doc comment Substitute 'platform' with 'pci'. Fixes: 18ebb25dfa18 ("rust: pci: implement Driver::unbind()") Cc: stable@kernel.org Signed-off-by: Rahul Rameshbabu Signed-off-by: Danilo Krummrich commit 41f71deda1c12e063a0793252021f37e790d1ef1 Merge: 5db5025d32e5b0 08228941436047 Author: Greg Kroah-Hartman Date: Wed Sep 17 12:44:55 2025 +0200 Merge patch series "usb: gadget: Refactor function drivers to use __free() cleanup" Kuen-Han Tsai says: This patch series refactors the error-handling paths in the bind() function for f_ncm, f_acm, f_ecm, and f_rndis drivers. The current, unified goto logic in these drivers is vulnerable to a null pointer dereference. This is caused by the cleanup logic incorrectly handling the stale usb_request pointer after a bind/unbind cycle. This series fixes this issue by converting the drivers to use the modern __free() scope-based cleanup mechanism. Patches 1-2 are preparatory, adding the endpoint pointer to struct usb_request and defining helpers for the __free() cleanup. The remaining four patches use this new plumbing to refactor each driver. Future work ----------- 1. Refactor usb_ep_free_request(), usb_ep_queue(), and usb_ep_dequeue() functions as the ep parameter becomes redudant. 2. Convert the remaining gadget function drivers to use the new __free() cleanup mechanism. Link: https://lore.kernel.org/r/20250916-ready-v1-0-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman commit 08228941436047bdcd35a612c1aec0912a29d8cd Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:37 2025 +0800 usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Fixes: 45fe3b8e5342 ("usb ethernet gadget: split RNDIS function") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-6-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-6-4997bf277548@google.com commit 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5 Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:36 2025 +0800 usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Fixes: da741b8c56d6 ("usb ethernet gadget: split CDC Ethernet function") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-5-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-5-4997bf277548@google.com commit 47b2116e54b4a854600341487e8b55249e926324 Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:35 2025 +0800 usb: gadget: f_acm: Refactor bind path to use __free() After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec gs_free_req+0x30/0x44 acm_bind+0x1b8/0x1f4 usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20 Fixes: 1f1ba11b6494 ("usb gadget: issue notifications from ACM function") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-4-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-4-4997bf277548@google.com commit 75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:34 2025 +0800 usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20 Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-3-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-3-4997bf277548@google.com commit 201c53c687f2b55a7cc6d9f4000af4797860174b Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:33 2025 +0800 usb: gadget: Introduce free_usb_request helper Introduce the free_usb_request() function that frees both the request's buffer and the request itself. This function serves as the cleanup callback for DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request pointers. Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-2-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-2-4997bf277548@google.com commit bfb1d99d969fe3b892db30848aeebfa19d21f57f Author: Kuen-Han Tsai Date: Tue Sep 16 16:21:32 2025 +0800 usb: gadget: Store endpoint pointer in usb_request Gadget function drivers often have goto-based error handling in their bind paths, which can be bug-prone. Refactoring these paths to use __free() scope-based cleanup is desirable, but currently blocked. The blocker is that usb_ep_free_request(ep, req) requires two parameters, while the __free() mechanism can only pass a pointer to the request itself. Store an endpoint pointer in the struct usb_request. The pointer is populated centrally in usb_ep_alloc_request() on every successful allocation, making the request object self-contained. Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250916-ready-v1-1-4997bf277548@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250916-ready-v1-1-4997bf277548@google.com commit 5db5025d32e5b0b4c13198b5570f33d92ae941d3 Author: Biju Das Date: Tue Sep 16 16:02:42 2025 +0100 usb: host: xhci-rcar: Add Renesas RZ/G3E USB3 Host driver support The USB3.2 Gen2 Host controller (a.k.a USB3HOST), IP found on the RZ/G3E SoC is similar to R-Car XHCI, but it doesn't require any firmware. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250916150255.4231-7-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 2ef16e4eb41fe711479d92805e4b9e430c7bbefd Author: Biju Das Date: Tue Sep 16 16:02:41 2025 +0100 usb: host: xhci-plat: Add .post_resume_quirk for struct xhci_plat_priv Some SoCs (eg Renesas RZ/G3E SoC) have special sequence after xhci_resume, add .post_resume_quick for it. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250916150255.4231-6-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit f7acd12eba05fb9e7dba3222e2aeca5f49d38b3a Author: Biju Das Date: Tue Sep 16 16:02:40 2025 +0100 usb: host: xhci-rcar: Move R-Car reg definitions Move xhci-rcar reg definitions to a header file for the preparation of adding support for RZ/G3E XHCI that has different register definitions. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250916150255.4231-5-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit dd0d2618e3f815a030622599e540d3be1964a888 Author: Biju Das Date: Tue Sep 16 16:02:39 2025 +0100 dt-bindings: usb: Document Renesas RZ/G3E USB3HOST Document the Renesas RZ/G3E USB3.2 Gen2 Host Controller (a.k.a USB3HOST). The USB3HOST is compliant with the Universal Serial Bus 3.2 Specification Revision 1.0. - Supports 1 downstream USB receptacles - Number of SSP Gen2 or SS ports: 1 - Number of HS or FS or LS ports: 1 - Supports Super Speed Plus Gen2x1 (10 Gbps), Super Speed (5 Gbps), High Speed (480 Mbps), Full Speed (12Mbps), and Low Speed (1.5 Mbps). - Supports all transfer-types: Control, Bulk, Interrupt, Isochronous, and these split-transactions. - Supports Power Control and Over Current Detection. Reviewed-by: Rob Herring (Arm) Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250916150255.4231-4-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 Author: Owen Gu Date: Mon Sep 15 17:29:07 2025 +0800 usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable(). The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock. Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues Signed-off-by: Owen Gu Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com Signed-off-by: Greg Kroah-Hartman commit 45fe729be9a6be326a1ca25af82d34de32ba2ce8 Author: Stephen Boyd Date: Tue Sep 16 10:16:20 2025 +0800 usb: typec: Stub out typec_switch APIs when CONFIG_TYPEC=n Ease driver development by adding stubs for the typec_switch APIs when CONFIG_TYPEC=n. Copy the same method used for the typec_mux APIs to be consistent. Acked-by: Greg Kroah-Hartman Reviewed-by: Heikki Krogerus Signed-off-by: Stephen Boyd Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20250916021620.1303995-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 Author: Forest Crossman Date: Mon Sep 15 15:55:10 2025 -0400 usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs The usbmon binary interface currently truncates captures of large transfers from higher-speed USB devices. Because a single event capture is limited to one-fifth of the total buffer size, the current maximum size of a captured URB is around 240 KiB. This is insufficient when capturing traffic from modern devices that use transfers of several hundred kilobytes or more, as truncated URBs can make it impossible for user-space USB analysis tools like Wireshark to properly defragment and reassemble higher-level protocol packets in the captured data. The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has not been changed since the binary interface was introduced in 2006. To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The original comment for BUFF_MAX based the limit's calculation on a saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2 Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the buffer should be at least 50 MB. The new limit of 64 MiB covers that, plus a little extra for any overhead. With this change, both users and developers should now be able to debug and reverse engineer modern USB devices even when running unmodified distro kernels. Please note that this change does not affect the default buffer size. A larger buffer is only allocated when a user explicitly requests it via the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size should not unduly increase memory usage for users that don't deliberately request a larger buffer. Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com Signed-off-by: Forest Crossman Acked-by: Alan Stern Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com Signed-off-by: Greg Kroah-Hartman commit 41cf11946b9076383a2222bbf1ef57d64d033f66 Author: Krishna Kurapati Date: Tue Sep 16 17:34:36 2025 +0530 usb: xhci: plat: Facilitate using autosuspend for xhci plat devices Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs, when in host mode, it is intended that the controller goes to suspend state to save power and wait for interrupts from connected peripheral to wake it up. This is particularly used in cases where a HID or Audio device is connected. In such scenarios, the usb controller can enter auto suspend and resume action after getting interrupts from the connected device. Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 90422219191973d9f534338e6f694bd2f18257d0 Merge: a4d43c1f17b9f1 e0b6dc00c701e6 Author: Greg Kroah-Hartman Date: Wed Sep 17 12:38:35 2025 +0200 Merge patch series "Add SpacemiT K1 USB3.0 host controller support" Ze Huang says: The USB 3.0 controller found in the SpacemiT K1 SoC[1] supports both USB3.0 Host and USB2.0 Dual-Role Device (DRD). This controller is compatible with DesignWare Core USB 3 (DWC3) driver. However, constraints in the `snps,dwc3` bindings limit the ability to describe hardware-specific features in a clean and maintainable way. While `dwc3-of-simple` still serves as a glue layer for many platforms, it requires a split device tree node structure, which is less desirable in newer platforms. To promote a transition toward a flattened `dwc` node structure, this series introduces `dwc3-generic-plat`, building upon prior efforts that exposed the DWC3 core driver [2]. The device tree support for SpacemiT K1 will be submitted separately when the associated PHY driver is ready. Link: https://developer.spacemit.com/documentation?token=AjHDwrW78igAAEkiHracBI9HnTb [1] Link: https://lore.kernel.org/all/20250414-dwc3-refactor-v7-3-f015b358722d@oss.qualcomm.com [2] Link: https://lore.kernel.org/r/20250913-dwc3_generic-v8-0-b50f81f05f95@linux.dev Signed-off-by: Greg Kroah-Hartman commit e0b6dc00c701e600e655417aab1e100b73de821a Author: Ze Huang Date: Sat Sep 13 00:53:48 2025 +0800 usb: dwc3: add generic driver to support flattened To support flattened dwc3 dt model and drop the glue layer, introduce the `dwc3-generic` driver. This enables direct binding of the DWC3 core driver and offers an alternative to the existing glue driver `dwc3-of-simple`. Acked-by: Thinh Nguyen Signed-off-by: Ze Huang Link: https://lore.kernel.org/r/20250913-dwc3_generic-v8-2-b50f81f05f95@linux.dev Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250913-dwc3_generic-v8-2-b50f81f05f95@linux.dev commit 7d547c1c249872b7732767e483758cb4fcb2d99b Author: Ze Huang Date: Sat Sep 13 00:53:47 2025 +0800 dt-bindings: usb: dwc3: add support for SpacemiT K1 Add support for the USB 3.0 Dual-Role Device (DRD) controller embedded in the SpacemiT K1 SoC. The controller is based on the Synopsys DesignWare Core USB 3 (DWC3) IP, supporting USB3.0 host mode and USB 2.0 DRD mode. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ze Huang Link: https://lore.kernel.org/r/20250913-dwc3_generic-v8-1-b50f81f05f95@linux.dev Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250913-dwc3_generic-v8-1-b50f81f05f95@linux.dev commit 648dbccc03a000cd64c2a9d86012d98053545e64 Author: Ashish Kalra Date: Tue Sep 16 21:29:49 2025 +0000 crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver AMD Seamless Firmware Servicing (SFS) is a secure method to allow non-persistent updates to running firmware and settings without requiring BIOS reflash and/or system reset. SFS does not address anything that runs on the x86 processors and it can be used to update ASP firmware, modules, register settings and update firmware for other microprocessors like TMPM, etc. SFS driver support adds ioctl support to communicate the SFS commands to the ASP/PSP by using the TEE mailbox interface. The Seamless Firmware Servicing (SFS) driver is added as a PSP sub-device. For detailed information, please look at the SFS specifications: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/58604.pdf Signed-off-by: Ashish Kalra Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Acked-by: Herbert Xu Link: https://lore.kernel.org/cover.1758057691.git.ashish.kalra@amd.com commit 40b7a19f321e65789612ebaca966472055dab48c Author: Duoming Zhou Date: Wed Sep 17 17:56:08 2025 +0800 media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. Fixes: f7a27ff1fb77 ("[media] xc5000: delay tuner sleep to 5 seconds") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Hans Verkuil [hverkuil: fix typo in Subject: tunner -> tuner] commit b76029bdd71054b17f62740fe9617d6b2ea601c3 Author: Akiyoshi Kurita Date: Wed Sep 17 15:37:29 2025 +0900 staging: rtl8723bs: xmit: rephrase comment and drop extra space Rephrase the comment to avoid the "number of" construction and remove an extra leading space. Signed-off-by: Akiyoshi Kurita Link: https://lore.kernel.org/r/20250917063729.1450525-1-weibu@redadmin.org Signed-off-by: Greg Kroah-Hartman commit 79d10f4f21a92e459b2276a77be62c59c1502c9d Author: Duoming Zhou Date: Wed Sep 17 17:57:42 2025 +0800 media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing. During probe failure after timer initialization, these may continue running as orphans and reference the already-freed tc358743_state object through tc358743_irq_poll_timer. The following is the trace captured by KASAN. BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync() to ensure proper termination of timer and work items before resource cleanup. This bug was initially identified through static analysis. For reproduction and testing, I created a functional emulation of the tc358743 device via a kernel module and introduced faults through the debugfs interface. Fixes: 869f38ae07f7 ("media: i2c: tc358743: Fix crash in the probe error path when using polling") Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Hans Verkuil commit 01e03fb7db419d39e18d6090d4873c1bff103914 Author: Duoming Zhou Date: Wed Sep 17 17:59:26 2025 +0800 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) flexcop_pci_remove() | flexcop_pci_irq_check_work() cancel_delayed_work() | flexcop_device_kfree(fc_pci->fc_dev) | | fc = fc_pci->fc_dev; // UAF This is confirmed by a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug. Fixes: 382c5546d618 ("V4L/DVB (10694): [PATCH] software IRQ watchdog for Flexcop B2C2 DVB PCI cards") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Hans Verkuil commit b32655a5f4c1a3b830f05fe3d43e17b2c4d09146 Author: Laurent Pinchart Date: Thu Aug 21 18:42:41 2025 +0300 media: vsp1: Export missing vsp1_isp_free_buffer symbol The vsp1_isp_free_buffer() function implemented by the vsp1 driver is part of the API exposed to the rcar-isp driver. All other symbols except that one are properly exported. Fix it. Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support") Cc: stable@vger.kernel.org Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit 410d938a707d85c7c7eb9b32f3fb45e5bcd77319 Author: Geert Uytterhoeven Date: Wed Jul 9 21:16:11 2025 +0200 media: renesas: vsp1: Convert to SYSTEM_SLEEP/RUNTIME_PM_OPS() Convert the Renesas VSP1 Video Processing Engine driver from SET_SYSTEM_SLEEP_PM_OPS() and SET_RUNTIME_PM_OPS() to SYSTEM_SLEEP_PM_OPS(), RUNTIME_PM_OPS(), and pm_ptr(). This lets us drop the __maybe_unused annotations from its various suspend and resume callbacks, and reduces kernel size in case CONFIG_PM is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Fabrizio Castro Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2549f534e131a6e40994c63171153cdb2c9dc7f9 Author: Geert Uytterhoeven Date: Wed Jul 9 21:16:10 2025 +0200 media: renesas: ceu: Convert to RUNTIME_PM_OPS() Convert the Renesas Capture Engine Unit driver from SET_RUNTIME_PM_OPS() to RUNTIME_PM_OPS() and pm_ptr(). This lets us drop the __maybe_unused annotations from its runtime suspend and resume callbacks, and reduces kernel size in case CONFIG_PM is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2ca1d2a041d4fffc458e0b98278536a88438950a Author: Geert Uytterhoeven Date: Wed Jul 9 21:16:09 2025 +0200 media: renesas: fdp1: Convert to RUNTIME_PM_OPS() Convert the Renesas Fine Display Processor driver from SET_RUNTIME_PM_OPS() to RUNTIME_PM_OPS() and pm_ptr(). This lets us drop the __maybe_unused annotations from its runtime suspend and resume callbacks, and reduces kernel size in case CONFIG_PM is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit cde682d151eccd1803fabea43d7327d1a11d358d Author: Geert Uytterhoeven Date: Wed Jul 9 21:16:08 2025 +0200 media: renesas: rcar-vin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car Video Input driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Reviewed-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a0e4177138769d6ac23d6802c92409049a899fd8 Author: Geert Uytterhoeven Date: Wed Jul 9 21:16:07 2025 +0200 media: renesas: rcar_drif: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas Digital Radio Interface driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Reviewed-by: Fabrizio Castro Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit e09701dcdd9ca06be249091eeb786d57e67b613e Author: Ashish Kalra Date: Tue Sep 16 21:29:33 2025 +0000 crypto: ccp - Add new HV-Fixed page allocation/free API When SEV-SNP is active, the TEE extended command header page and all output buffers for TEE extended commands (such as used by Seamless Firmware servicing support) must be in hypervisor-fixed state, assigned to the hypervisor and marked immutable in the RMP entrie(s). Add a new generic SEV API interface to allocate/free hypervisor fixed pages which abstracts hypervisor fixed page allocation/free for PSP sub devices. The API internally uses SNP_INIT_EX to transition pages to HV-Fixed page state. If SNP is not enabled then the allocator is simply a wrapper over alloc_pages() and __free_pages(). When the sub device free the pages, they are put on a free list and future allocation requests will try to re-use the freed pages from this list. But this list is not preserved across PSP driver load/unload hence this free/reuse support is only supported while PSP driver is loaded. As HV_FIXED page state is only changed at reboot, these pages are leaked as they cannot be returned back to the page allocator and then potentially allocated to guests, which will cause SEV-SNP guests to fail to start or terminate when accessing the HV_FIXED page. Suggested-by: Thomas Lendacky Signed-off-by: Ashish Kalra Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Acked-by: Herbert Xu Link: https://lore.kernel.org/cover.1758057691.git.ashish.kalra@amd.com commit af8df709bf365f5583d31091280354e1ef0b201f Author: Manivannan Sadhasivam Date: Fri Sep 12 14:05:02 2025 +0530 PCI: qcom: Move host bridge 'phy' and 'reset' pointers to struct qcom_pcie_port DT binding allows specifying 'phy' and 'reset' properties in both host bridge and Root Port nodes, though specifying in the host bridge node is marked as deprecated. Still, the pcie-qcom driver should support both combinations for maintaining the DT backwards compatibility. For this purpose, the driver is holding the relevant pointers of these properties in two structs: struct qcom_pcie_port and struct qcom_pcie. However, this causes confusion and increases the driver complexity. Hence, move the pointers from struct qcom_pcie to struct qcom_pcie_port. As a result, even if these properties are specified in the host bridge node, the pointers will be stored in struct qcom_pcie_port as if the properties are specified in a single Root Port node. This logic simplifies the driver a lot. Suggested-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bjorn Helgaas Link: https://patch.msgid.link/20250912-pci-pwrctrl-perst-v3-2-3c0ac62b032c@oss.qualcomm.com commit e4c00c4ce2aafe61dc7436e763a78d6d112d9e2f Author: Ashish Kalra Date: Tue Sep 16 21:29:04 2025 +0000 x86/sev: Add new dump_rmp parameter to snp_leak_pages() API When leaking certain page types, such as Hypervisor Fixed (HV_FIXED) pages, it does not make sense to dump RMP contents for the 2MB range of the page(s) being leaked. In the case of HV_FIXED pages, this is not an error situation where the surrounding 2MB page RMP entries can provide debug information. Add new __snp_leak_pages() API with dump_rmp bool parameter to support continue adding pages to the snp_leaked_pages_list but not issue dump_rmpentry(). Make snp_leak_pages() a wrapper for the common case which also allows existing users to continue to dump RMP entries. Suggested-by: Thomas Lendacky Suggested-by: Sean Christopherson Signed-off-by: Ashish Kalra Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Acked-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/cover.1758057691.git.ashish.kalra@amd.com commit 6e1c2c6c2c40ce99e0d2633b212f43c702c1a002 Author: Avadhut Naik Date: Tue Sep 16 20:30:17 2025 +0000 EDAC/mc_sysfs: Increase legacy channel support to 16 Newer AMD systems can support up to 16 channels per EDAC "mc" device. These are detected by the EDAC module running on the device, and the current EDAC interface is appropriately enumerated. The legacy EDAC sysfs interface however, provides device attributes for channels 0 through 11 only. Consequently, the last four channels, 12 through 15, will not be enumerated and will not be visible through the legacy sysfs interface. Add additional device attributes to ensure that all 16 channels, if present, are enumerated by and visible through the legacy EDAC sysfs interface. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250916203242.1281036-1-avadhut.naik@amd.com commit 6fffa38c4c4427470f832e59b7380b992e677e36 Author: Avadhut Naik Date: Tue Sep 16 20:30:16 2025 +0000 EDAC/amd64: Add support for AMD family 1Ah-based newer models Add support for family 1Ah-based models 50h-57h, 90h-9Fh, A0h-AFh, and C0h-C7h. Also, raise the maximum memory controllers number as those machines support that many. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250916203242.1281036-1-avadhut.naik@amd.com commit d1dd75c6500c74b91c5286fd3277710371d3e3ca Author: Rahul Rameshbabu Date: Sat Sep 13 16:12:54 2025 +0000 HID: core: Change hid_driver to use a const char* for name name is never mutated by the core HID stack. Making name a const char* simplifies passing the string from Rust to C. Otherwise, it becomes difficult to pass a 'static lifetime CStr from Rust to a char*, rather than a const char*, due to lack of guarantee that the underlying data of the CStr will not be mutated by the C code. Signed-off-by: Rahul Rameshbabu Signed-off-by: Benjamin Tissoires commit 75d5546f60b36900051d75ee623fceccbeb6750c Author: Benjamin Tissoires Date: Fri Sep 12 18:58:51 2025 +0200 HID: hidraw: tighten ioctl command parsing The handling for variable-length ioctl commands in hidraw_ioctl() is rather complex and the check for the data direction is incomplete. Simplify this code by factoring out the various ioctls grouped by dir and size, and using a switch() statement with the size masked out, to ensure the rest of the command is correctly matched. Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw") Reported-by: Arnd Bergmann Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 8c62074fa824db0878a039e40f8424c3c3284f42 Author: Benjamin Tissoires Date: Fri Sep 12 18:58:50 2025 +0200 selftests/hid: hidraw: forge wrong ioctls and tests them We also need coverage for when the malicious user is not using the proper ioctls definitions and tries to work around the driver. Most of the scaffholding has been generated by claude-4-sonnet and then carefully reviewed. Suggested-by: Arnd Bergmann Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit bb6c861a290f2d6b3df2b176d2c2491f1a242265 Author: Benjamin Tissoires Date: Fri Sep 12 18:58:49 2025 +0200 selftests/hid: hidraw: add more coverage for hidraw ioctls Try to ensure all ioctls are having at least one test. Most of the scaffholding has been generated by claude-4-sonnet and then carefully reviewed. Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit be66a27b4f391ecd9cfb9394feb4369c4d39f94f Author: Benjamin Tissoires Date: Thu Aug 21 16:29:55 2025 +0200 selftests/hid: update vmtest.sh for virtme-ng This commit is a rewrite almost from scratch of vmtest.sh. By relying on virtme-ng, we get rid of boot2container, reducing the total bootup time (and network requirements). That means that we are relying on the programs being installed on the host, but that shouldn't be an issue. The generation of the kconfig is also now handled by virtme-ng, so that's one less thing to worry. I used tools/testing/selftests/vsock/vmtest.sh as a base and modified it to look mostly like my previous script: - removed the custom ssh handling - make use of vng for compiling, which allows to bring remote compilation (and potentially remote compilation on a remote container) - change the verbosity logic by having 2 levels: - first one shows the tests outputs - second level also shows the VM logs - instead of only running the compiled kernel when it is built, if we are in the kernel tree, use the kernel artifacts there (and complain if they are not built) - adapted the tests list to match the HID subsystem tests Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit e1c24d545b8d0f4f04e01258f1ac5d2934c6a08d Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:55 2025 +0300 HID: playstation: Support DualSense audio jack event reporting The DualSense controller complies with v1.0 of the USB Audio Class spec (UAC1), hence it cannot advertise any jack detection capability. However, this feature can be implemented in the generic USB audio driver via quirks, i.e. by configuring an input handler to receive hotplug events from the HID driver. When operating in USB mode, register a dedicated input device for the audio jack and use it to report all headphone and headset mic insert events. Signed-off-by: Cristian Ciocaltea Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit b1b4806c0c528e51c648dbaf8cd9f7027c1c11b7 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:54 2025 +0300 HID: playstation: Support DualSense audio jack hotplug detection The default audio output path on DualSense controller hardware is set to headphones, regardless of whether they are actually inserted or not. Detect when the plugged state of the 3.5mm audio jack changes and toggle audio output between headphones and internal speaker, as required. The latter is achieved by essentially routing the right channel of the audio source to the mono speaker. Additionally, adjust the speaker volume since its default level is too low and, therefore, cannot generate any audible sound. It's worth noting the audio functionality is currently not supported for Bluetooth, hence it's limited to USB connectivity. Signed-off-by: Cristian Ciocaltea Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit d7b744fa977b4c402c25ba723b4981a8420ad15a Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:53 2025 +0300 HID: playstation: Redefine DualSense input report status field The 'status' member of struct dualsense_input_report is currently used to store just the battery data, despite the fact that hardware is capable to report two extra bytes of status information. In preparation to make use of some of the additional data, redefine the field type as a 3-byte array. Moreover, to preserve consistency with the related DS_STATUS[0..2]_* registers in datasheet, rename DS_STATUS_* bitfield macros accordingly. Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 400c6bbc7b48a011c18c765cd1fbb396113e2f63 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:52 2025 +0300 HID: playstation: Prefer kzalloc(sizeof(*buf)...) Use the shorter variant as suggested by checkpatch.pl: CHECK: Prefer kzalloc(sizeof(*buf)...) over kzalloc(sizeof(struct dualsense_output_report_bt)...) This also improves further maintainability. Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit d9812f06be437c64e00fd557ed374100c97077cc Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:51 2025 +0300 HID: playstation: Document spinlock_t usage Document the usage of 'lock' member in struct ps_device and silent checkpatch.pl complaint: CHECK: spinlock_t definition without comment Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 56d7f285bfaa38fad082c1b50e20c1b57b2a8e18 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:50 2025 +0300 HID: playstation: Fix all alignment and line length issues Format code to address the following checkpatch.pl reports: CHECK: Alignment should match open parenthesis CHECK: line length of exceeds 100 columns CHECK: Please don't use multiple blank lines Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 70db9aa76d29663047a84f337091f438be3c8a4f Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:49 2025 +0300 HID: playstation: Correct spelling in comment sections Handle a couple of spelling complaints from checkpatch.pl: CHECK: 'connectd' may be misspelled - perhaps 'connected'? CHECK: 'Comptabile' may be misspelled - perhaps 'Compatible'? Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 134a40c9d6d9bf27a6743e65eebdb81985880712 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:48 2025 +0300 HID: playstation: Replace uint{32,16,8}_t with u{32,16,8} And get rid of the following checkpatch.pl complaints: CHECK: Prefer kernel type 'u32' over 'uint32_t' CHECK: Prefer kernel type 'u16' over 'uint16_t' CHECK: Prefer kernel type 'u8' over 'uint8_t' Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit a38d070ffe338710037f6a45767542ce249c61a0 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:47 2025 +0300 HID: playstation: Simplify locking with guard() and scoped_guard() Use guard() and scoped_guard() infrastructure instead of explicitly acquiring and releasing spinlocks and mutexes to simplify the code and ensure that all locks are released properly. Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 6c6af4c4dfd3ca734b3507361476ec1774dca477 Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:46 2025 +0300 HID: playstation: Add spaces around arithmetic operators Get rid of several checkpatch.pl complaints: CHECK: spaces preferred around that '*' (ctx:VxV) CHECK: spaces preferred around that '/' (ctx:VxV) Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 0d52aafb8bcee01b11ec8f3b46050540585431eb Author: Cristian Ciocaltea Date: Wed Jun 25 00:56:45 2025 +0300 HID: playstation: Make use of bitfield macros Improve code readability and make it more robust by replacing open coded bit operations with the equivalent bitfield macros. While at it, also fix the vertical alignment for some of the bitfield constants. Signed-off-by: Cristian Ciocaltea Reviewed-by: Benjamin Tissoires Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit dd86b69d20fb9fa7e941ed01ff05f1e662fcc3ff Author: Babu Moger Date: Tue Sep 16 12:25:49 2025 -0500 fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled rdt_resource::resctrl_mon::mbm_assign_on_mkdir determines if a counter will automatically be assigned to an RMID, MBM event pair when its associated monitor group is created via mkdir. Testing shows that counters are always automatically assigned to new monitor groups, whether mbm_assign_on_mkdir is set or not. To support automatic counter assignment the check for mbm_assign_on_mkdir should be in rdtgroup_assign_cntrs() that assigns counters during monitor group creation. Instead, the check for mbm_assign_on_mkdir is in rdtgroup_unassign_cntrs() that is called on monitor group deletion from where counters should always be unassigned, whether mbm_assign_on_mkdir is set or not. Fix automatic counter assignment by moving the mbm_assign_on_mkdir check from rdtgroup_unassign_cntrs() to rdtgroup_assign_cntrs(). [ bp: Replace commit message with Reinette's version. ] Fixes: ef712fe97ec57 ("fs/resctrl: Auto assign counters on mkdir and clean up on group removal") Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Acked-by: Reinette Chatre commit d98b40c07552a3bdc72bfc5879748707ba7598ae Author: K Prateek Nayak Date: Mon Sep 1 17:04:18 2025 +0000 Documentation/x86/topology: Detail CPUID leaves used for topology enumeration Add a new section describing the different CPUID leaves and fields used to parse topology on x86 systems. [ bp: Cleanups and simplifications ontop. ] Suggested-by: Borislav Petkov Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/20250901170418.4314-1-kprateek.nayak@amd.com commit bc6397cf0bc4f2b7a47cc6ac44086daf67c3c71c Author: K Prateek Nayak Date: Mon Sep 1 17:04:17 2025 +0000 x86/cpu/topology: Define AMD64_CPUID_EXT_FEAT MSR Add defines for the 0xc001_1005 MSR (Core::X86::Msr::CPUID_ExtFeatures) used to toggle the extended CPUID features, instead of using literal numbers. Also define and use the bits necessary for an old TOPOEXT fixup on AMD Family 0x15 processors. No functional changes intended. [ bp: Massage, rename MSR to adhere to the documentation name. ] Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/20250901170418.4314-1-kprateek.nayak@amd.com commit d691c5f87f344a448b1a522284fa314e2bb403e2 Author: K Prateek Nayak Date: Mon Sep 1 17:04:16 2025 +0000 x86/cpu/topology: Check for X86_FEATURE_XTOPOLOGY instead of passing has_xtopology cpu_parse_topology_ext() sets X86_FEATURE_XTOPOLOGY before returning true if any of the XTOPOLOGY leaf (0x80000026 / 0xb) could be parsed successfully. Instead of storing and passing around this return value using "has_xtopology" in parse_topology_amd(), check for X86_FEATURE_XTOPOLOGY directly in parse_8000_001e() to simplify the flow. No functional changes intended. Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/20250901170418.4314-1-kprateek.nayak@amd.com commit af507c6951180ae5e5edb71f56a227ffdcc54f78 Author: K Prateek Nayak Date: Thu Aug 21 05:19:09 2025 +0000 x86/cpu/cacheinfo: Simplify cacheinfo_amd_init_llc_id() using _cpuid4_info struct _cpuid4_info has the same layout as the CPUID leaf 0x8000001d. Use the encoded definition and amd_fill_cpuid4_info(), get_cache_id() helpers instead of open coding masks and shifts to calculate the llc_id. cacheinfo_amd_init_llc_id() is only called on AMD systems that support X86_FEATURE_TOPOEXT and amd_fill_cpuid4_info() uses the information from CPUID leaf 0x8000001d on all these systems which is consistent with the current open coded implementation. While at it, avoid reading cpu_data() every time get_cache_id() is called and instead pass the APIC ID necessary to return the _cpuid4_info.id from get_cache_id(). No functional changes intended. [ bp: do what Ahmed suggests: merge into one patch, make id4 ptr const. ] Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Acked-by: Ahmed S. Darwish Link: https://lore.kernel.org/20250821051910.7351-2-kprateek.nayak@amd.com commit 70d1d98934e723b9e463283a542b88f4f009ae82 Author: Tony Luck Date: Mon Aug 11 14:33:45 2025 -0700 x86/cpu: Rename and move CPU model entry for Diamond Rapids This model was added as INTEL_PANTHERCOVE_X (based on the name of the core) with a comment that the platform name is Diamond Rapids. It was also placed at the end of the file in a new section for family 19 processors. This is different from previous naming as Andrew Cooper noted. PeterZ agreed and posted a patch[1] to fix the name and move it in sequence with other Xeon servers. But without a commit description or sign-off the patch wasn't ever applied. Patch updated to cover one additional use of the #define by turbostat and to change the "Family 6" comment to also list 18 and 19 since new models in these families are mixed in with family 6. Originally-by: Peter Zijlstra Signed-off-by: Tony Luck Signed-off-by: Dave Hansen Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/all/20250214130205.GK14028@noisy.programming.kicks-ass.net/ # [1] commit 0b1619c38600fc06c73b1f59c64af0b7df08fc2c Author: Bartosz Golaszewski Date: Mon Sep 15 11:10:07 2025 +0200 gpio: nomadik: fix the debugfs helper stub Commit ddeb66d2cb10 ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks") failed to also update the stub of the debugfs helper for !CONFIG_DEBUG_FS. Fix the resulting build failure. Fixes: ddeb66d2cb10 ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509132232.12viPUPB-lkp@intel.com/ Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250915091007.28438-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 2ac207381c37eebc49559634ce5642119784bc7c Author: Carolina Jubran Date: Thu Sep 11 10:10:19 2025 +0300 net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads Update the WQE metadata assignment to avoid overriding existing metadata when setting the sysport timestamp ID. Since timestamp IDs are limited to 256 values, they use only the lower 8 bits of the metadata field. To avoid conflicts, move IPsec and MACsec metadata ID to bits 8 and 9, and shift the MACsec fs_id accordingly. This ensures safe coexistence of timestamping and offload features that use the same metadata field. Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Patrisious Haddad Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757574619-604874-4-git-send-email-tariqt@nvidia.com Reviewed-by: Simon Horman Signed-off-by: Leon Romanovsky commit cce65f32443b61db2370a67d2e92d16b773fe8a4 Author: Carolina Jubran Date: Thu Sep 11 10:10:18 2025 +0300 net/mlx5: Refactor MACsec WQE metadata shifts Introduce MLX5_ETH_WQE_FT_META_SHIFT as a shared base offset for features that use the lower 8 bits of the WQE flow_table_metadata field, currently used for timestamping, IPsec, and MACsec. Define MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK so that fs_id occupies bits 2–5, making it clear that fs_id occupies bits in the metadata. Set MLX5_ETH_WQE_FT_META_MACSEC_MASK as the OR of the MACsec flag and MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK, corresponding to the original 0x3E mask. Update the fs_id macro to right-shift the MACsec flag by MLX5_ETH_WQE_FT_META_SHIFT and update the RoCE modify-header action to use it. Introduce the helper macro MLX5_MACSEC_TX_METADATA(fs_id) to compose the full shifted MACsec metadata value. These changes make it explicit exactly which metadata bits carry MACsec information, simplifying future feature exclusions when multiple features share the WQE flowtable metadata. In addition, drop the incorrect “RX flow steering” comment, since this applies to TX flow steering. Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757574619-604874-3-git-send-email-tariqt@nvidia.com Reviewed-by: Simon Horman Signed-off-by: Leon Romanovsky commit de2be98541dbe0de58d2dccf7fa19dfc9d9a8260 Author: Carolina Jubran Date: Thu Sep 11 10:10:17 2025 +0300 net/mlx5: Remove VLAN insertion fields from WQE Ether segment Now that the driver no longer uses VLAN TX insertion via the WQE Ethernet segment, the related fields and flags can be removed. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757574619-604874-2-git-send-email-tariqt@nvidia.com Reviewed-by: Simon Horman Signed-off-by: Leon Romanovsky commit 4d94abded400a5194b929c26b3aa07fb9485fe35 Author: Han Gao Date: Wed Sep 10 18:55:31 2025 +0800 dts: sophgo: sg2042: added numa id description According to the description of [1], sg2042 is divided into 4 numa. STREAM test performance will improve. Before: Function Best Rate MB/s Avg time Min time Max time Copy: 10739.7 0.015687 0.014898 0.016385 Scale: 10865.9 0.015628 0.014725 0.016757 Add: 10622.3 0.023276 0.022594 0.023899 Triad: 10583.4 0.023653 0.022677 0.024761 After: Function Best Rate MB/s Avg time Min time Max time Copy: 34254.9 0.005142 0.004671 0.005995 Scale: 37735.5 0.004752 0.004240 0.005407 Add: 44206.8 0.005983 0.005429 0.006461 Triad: 43040.6 0.006320 0.005576 0.006996 [1] https://github.com/sophgo/sophgo-doc/blob/main/SG2042/TRM/source/pic/mesh.png Signed-off-by: Han Gao Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20250910105531.519897-1-rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 41e871f2b63edaf8da20907d512cd5d91ba51476 Author: Thomas Gleixner Date: Mon Sep 8 23:32:38 2025 +0200 riscv: Use generic TIF bits No point in defining generic items and the upcoming RSEQ optimizations are only available with this _and_ the generic entry infrastructure, which is already used by RISCV. So no further action required here. Signed-off-by: Thomas Gleixner commit f9629891d407e455dc1334e1594108c73074fe8b Author: Thomas Gleixner Date: Mon Sep 8 23:32:36 2025 +0200 loongarch: Use generic TIF bits No point in defining generic items and the upcoming RSEQ optimizations are only available with this _and_ the generic entry infrastructure, which is already used by loongarch. So no further action required here. Signed-off-by: Thomas Gleixner commit c7ac5a089d495fd57f6851126e83e9c19205afae Author: Sven Schnelle Date: Thu Sep 11 11:28:06 2025 +0200 s390/entry: Remove unused TIF flags The conversion of s390 to generic entry missed to remove the TIF_SYSCALL*/TIF_SECCOMP flags. Remove them as they are unused now. Fixes: 56e62a737028 ("s390: convert to generic entry") Signed-off-by: Sven Schnelle Signed-off-by: Thomas Gleixner Acked-by: Heiko Carstens commit 06e5b72858b168fcedb0402b8dfdb896276fc08e Author: Thomas Gleixner Date: Mon Sep 8 23:32:34 2025 +0200 s390: Use generic TIF bits No point in defining generic items and the upcoming RSEQ optimizations are only available with this _and_ the generic entry infrastructure, which is already used by s390. So no further action required here. This leaves a comment about the AUDIT/TRACE/SECCOMP bits which are handled by SYSCALL_WORK in the generic code, so they seem redundant, but that's a problem for the s390 wizards to think about. Signed-off-by: Thomas Gleixner Acked-by: Heiko Carstens commit da3f033a9fbfdb88826c1b0486fe1522fe4f94aa Author: Thomas Gleixner Date: Mon Sep 8 23:32:32 2025 +0200 x86: Use generic TIF bits No point in defining generic items and the upcoming RSEQ optimizations are only available with this _and_ the generic entry infrastructure, which is already used by x86. So no further action required here. Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers commit 29589343488e116ac31f6f3cfa83e43949a2207a Author: Thomas Gleixner Date: Mon Sep 8 23:32:30 2025 +0200 asm-generic: Provide generic TIF infrastructure Common TIF bits do not have to be defined by every architecture. They can be defined in a generic header. That allows adding generic TIF bits without chasing a gazillion of architecture headers, which is again a unjustified burden on anyone who works on generic infrastructure as it always needs a boat load of work to keep existing architecture code working when adding new stuff. While it is not as horrible as the ignorance of the generic entry infrastructure, it is a welcome mechanism to make architecture people rethink their approach of just leaching generic improvements into architecture code and thereby making it accumulatingly harder to maintain and improve generic code. It's about time that this changes. Provide the infrastructure and split the TIF space in half, 16 generic and 16 architecture specific bits. This could probably be extended by TIF_SINGLESTEP and BLOCKSTEP, but those are only used in architecture specific code. So leave them alone for now. Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Acked-by: Arnd Bergmann commit 6f17ab9a63e670bd62a287f95e3982f99eafd77e Merge: 5770495279d795 299eb32863e584 Author: Dave Airlie Date: Wed Sep 17 16:09:24 2025 +1000 Merge tag 'drm-rust-next-2025-09-16' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v6.18 Alloc - Add BorrowedPage type and AsPageIter trait - Implement Vmalloc::to_page() and VmallocPageIter - Implement AsPageIter for VBox and VVec DMA & Scatterlist - Add dma::DataDirection and type alias for dma_addr_t - Abstraction for struct scatterlist and struct sg_table DRM - In the DRM GEM module, simplify overall use of generics, add DriverFile type alias and drop Object::SIZE. Nova (Core) - Various register!() macro improvements (paving the way for lifting it to common driver infrastructure) - Minor VBios fixes and refactoring - Minor firmware request refactoring - Advance firmware boot stages; process Booter and patch its signature, process GSP and GSP bootloader - Switch development fimrware version to r570.144 - Add basic firmware bindings for r570.144 - Move GSP boot code to its own module - Clean up and take advantage of pin-init features to store most of the driver's private data within a single allocation - Update ARef import from sync::aref - Add website to MAINTAINERS entry Nova (DRM) - Update ARef import from sync::aref - Add website to MAINTAINERS entry Pin-Init - Merge pin-init PR from Benno - `#[pin_data]` now generates a `*Projection` struct similar to the `pin-project` crate. - Add initializer code blocks to `[try_][pin_]init!` macros: make initializer macros accept any number of `_: {/* arbitrary code */},` & make them run the code at that point. - Make the `[try_][pin_]init!` macros expose initialized fields via a `let` binding as `&mut T` or `Pin<&mut T>` for later fields. Rust - Various methods for AsBytes and FromBytes traits Tyr - Initial Rust driver skeleton for ARM Mali GPUs. - It can power up the GPU, query for GPU metatdata through MMIO and provide the metadata to userspace via DRM device IOCTL (struct drm_panthor_dev_query). Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://lore.kernel.org/r/DCUC4SY6SRBD.1ZLHAIQZOC6KG@kernel.org commit ea6bb47fd6a4c5a332f9349c39bf7462e3e7a35b Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:46 2025 +0200 thunderbolt: Update thunderbolt.h header file Make Thunderbolt header file compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 81a1962cb281636a95c49f02ef57d37deb6ceb8f Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:45 2025 +0200 thunderbolt: Update xdomain.c function documentation Make xdomain.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit a2ba553cd45a5fb33f0edc6dd8c6b5280cad4ab0 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:44 2025 +0200 thunderbolt: Update usb4_port.c function documentation Make usb4_port.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 9a5abaf8be02aeedd8f374b253da472f9eedfbf1 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:43 2025 +0200 thunderbolt: Update usb4.c function documentation Make usb4.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit e262b91b223a237fa87c83ce1b4e4e2dafd053ad Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:42 2025 +0200 thunderbolt: Update tunnel.h function documentation Make tunnel.h function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 6f3ed985b7d1e4950f1f63139f32a7d889e4aaee Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:41 2025 +0200 thunderbolt: Update tunnel.c function documentation Make tunnel.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 371c2374449db296675a865c46cde54336ff2ef7 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:40 2025 +0200 thunderbolt: Update tmu.c function documentation Make tmu.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit b30234f27396c915547fa5905dcf79e5e9be3ff6 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:39 2025 +0200 thunderbolt: Add missing documentation in tb.h Add missing parameters and struct/enum description in tb.h kernel-doc comments. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 978a3d608f9f162ba2f0fa3c392ce8adaa171c95 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:38 2025 +0200 thunderbolt: Update tb.h function documentation Make tb.h function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit d05cc39d1d2b9df8cd86ca24c21f36408a5c72a7 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:37 2025 +0200 thunderbolt: Update tb.c function documentation Make tb.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 207b8a260578b3240f1501feb75376e4b00706b1 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:36 2025 +0200 thunderbolt: Update switch.c function documentation Make switch.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit f72f4d5cdb1ddbc323df6c3f638dd2499c038bef Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:35 2025 +0200 thunderbolt: Update retimer.c function documentation Make retimer.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit d015642ad36d78e6eba12d8ab96cea6fd4602b49 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:34 2025 +0200 thunderbolt: Update property.c function documentation Make property.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit a6e3f939ada8c4502bb9264adce106f5f2c9d51d Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:33 2025 +0200 thunderbolt: Update path.c function documentation Make path.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit fe83a27383ca0a95022f5b5807e8516d4d7554fe Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:32 2025 +0200 thunderbolt: Update nvm.c function documentation Make nvm.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit bbbca9bfd1720d5eaeede878d63a171e34ea4b9b Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:31 2025 +0200 thunderbolt: Add missing documentation in nhi_regs.h ring_desc structure Add missing description of fields in ring_desc struct found in "nhi_regs.h". No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit a38523805007a7498a4cbc56239ffb7709826179 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:30 2025 +0200 thunderbolt: Update nhi.c function documentation Make nhi.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 4815b7548cf669b402919d592583a1ad00de9305 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:29 2025 +0200 thunderbolt: Update lc.c function documentation Make lc.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 728ab0e4a0ca78f550ca59d9267e0b2835f523fa Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:28 2025 +0200 thunderbolt: Update eeprom.c function documentation Make eeprom.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 250afc7f396d456a3458cc9160cf44990474c644 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:27 2025 +0200 thunderbolt: Update domain.c function documentation Make domain.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit a84be45d332ae69b1ed1ef82143d98936b14201d Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:26 2025 +0200 thunderbolt: Update dma_port.c function documentation Make dma_port.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 12cb68e48691ffb6700ef0d8dceae7b4739b8dea Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:25 2025 +0200 thunderbolt: Add missing documentation in ctl.h tb_cfg_request struct Add missing @request field description in tb_cfg_request struct kernel-doc. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 38f33b8e2cc2d3d3bae88dd5b4546e4f38cda3be Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:24 2025 +0200 thunderbolt: Update ctl.c function documentation Make ctl.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 66cf14cc9fdf2a9747bdaf2a629e3a510d31a3de Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:23 2025 +0200 thunderbolt: Update clx.c function documentation Make clx.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit c0a078d7bc008d27f06cfc6bb05d311158d4b3b9 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:22 2025 +0200 thunderbolt: Update cap.c function documentation Make cap.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 1fac4d003fd6895599053f8f046139108fba68b8 Author: Alan Borzeszkowski Date: Wed Aug 27 13:56:21 2025 +0200 thunderbolt: Update acpi.c function documentation Make acpi.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit acf800c8fc567b6cf991e22df2dc4e3fd1b8eea5 Merge: 8f5ae30d69d754 14be8b7b6cbc0a Author: Stephen Boyd Date: Tue Sep 16 21:40:54 2025 -0700 Merge tag 'clk-imx-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Rework the i.MX95 BLK CTL driver to add the platform data to the state container - Retain the state of the i.MS95 BLK CTL registers through both runtime and system suspend * tag 'clk-imx-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx95-blk-ctl: Save/restore registers when RPM routines are called clk: imx95-blk-ctl: Save platform data in imx95_blk_ctl structure commit 2944ebee9a96c9d2ddb9c9cb99df6105f2de62ff Author: Al Viro Date: Fri Sep 12 13:51:28 2025 -0400 slightly simplify nfs_atomic_open() Reviewed-by: NeilBrown Signed-off-by: Al Viro commit d71cbf0d3bc029d4ef3f321c8778960afc049158 Author: Al Viro Date: Fri Sep 12 13:47:57 2025 -0400 simplify gfs2_atomic_open() the difference from 9p et.al. is that on gfs2 the lookup side might end up opening the file. That's what the FMODE_OPENED check there is about - and it might actually be seen with finish_open() having failed, if it fails late enough. Reviewed-by: NeilBrown Signed-off-by: Al Viro commit 1d7b343785914826f04cd91a9d53f136e626a919 Author: Al Viro Date: Fri Sep 12 12:01:31 2025 -0400 simplify fuse_atomic_open() Reviewed-by: NeilBrown Signed-off-by: Al Viro commit aae9db5739164353fa1894db000fabad940a835b Author: Al Viro Date: Fri Sep 12 11:52:41 2025 -0400 simplify nfs_atomic_open_v23() 1) finish_no_open() takes ERR_PTR() as dentry now. 2) caller of ->atomic_open() will call d_lookup_done() itself, no need to do it here. Reviewed-by: NeilBrown Signed-off-by: Al Viro commit 0b7543126e7b64f3f98b377440e61ceea9d24eda Author: Al Viro Date: Fri Sep 12 11:45:41 2025 -0400 simplify vboxsf_dir_atomic_open() similar to 9p et.al. Reviewed-by: NeilBrown Signed-off-by: Al Viro commit fe871217ac64a6a26607f74f7f59ab9fa56fd41c Author: Al Viro Date: Fri Sep 12 11:37:21 2025 -0400 simplify cifs_atomic_open() now that finish_no_open() does the right thing if it's given ERR_PTR() as dentry... Reviewed-by: NeilBrown Signed-off-by: Al Viro commit f681e72e2773b9015f1b93cb973f13e4b36d4d24 Author: Al Viro Date: Fri Sep 12 11:34:57 2025 -0400 9p: simplify v9fs_vfs_atomic_open_dotl() again, preexisting aliases will always be positive Reviewed-by: NeilBrown Signed-off-by: Al Viro commit fb3d71972bc3112e7dde2426bef6efa1d0a122a7 Author: Al Viro Date: Fri Sep 12 11:28:20 2025 -0400 9p: simplify v9fs_vfs_atomic_open() if v9fs_vfs_lookup() returns a preexisting alias, it is guaranteed to be positive. IOW, in that case we will immediately return finish_no_open(), leaving only the case res == NULL past that point. Reviewed-by: NeilBrown Signed-off-by: Al Viro commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb Author: Al Viro Date: Fri Sep 12 11:20:27 2025 -0400 allow finish_no_open(file, ERR_PTR(-E...)) ... allowing any ->lookup() return value to be passed to it. Reviewed-by: NeilBrown Signed-off-by: Al Viro commit 88e8acffd7af9b030d2772f27ee30639be7024cf Merge: d125deba5cc894 a28205c2bc2277 Author: Martin K. Petersen Date: Tue Sep 16 22:20:57 2025 -0400 Merge patch series "Update lpfc to revision 14.4.0.11" Justin Tee says: Update lpfc to revision 14.4.0.11 This patch set contains clean up of unused members in various structs, bug fixes related to discovery and resource allocation, and updates to handling of debugfs entries. The patches were cut against Martin's 6.18/scsi-queue tree. Signed-off-by: Martin K. Petersen commit a28205c2bc22774dcab375411683f2b47d9102f3 Author: Justin Tee Date: Mon Sep 15 11:08:11 2025 -0700 scsi: lpfc: Copyright updates for 14.4.0.11 patches Update copyrights to 2025 for files modified in the 14.4.0.11 patch set. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-15-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 546ad76b2a9a87ce72bc91f644365a2f250d1417 Author: Justin Tee Date: Mon Sep 15 11:08:10 2025 -0700 scsi: lpfc: Update lpfc version to 14.4.0.11 Update lpfc version to 14.4.0.11 Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-14-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit a045ae21ce3e3411ac38ff2f9051792585f444d7 Author: Justin Tee Date: Mon Sep 15 11:08:09 2025 -0700 scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int Atomicity is not necessary for debugfs directory accounting because vport deletion and creation is already serialized. Creation has always been serialized through sysfs. Deletion is serialized via walking the lpfc_create_vport_work_array and calling fc_vport_terminate one-by-one for each NPIV port. Reported-by: Al Viro Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-13-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 8221b3450501c7cdc93be1eb65a6fe0dcfb4b538 Author: Justin Tee Date: Mon Sep 15 11:08:08 2025 -0700 scsi: lpfc: Clean up extraneous phba dentries Because debugfs_remove recursively removes debugfs entries, the lpfc_debugfs_terminate routine is updated to remove only the parent/root debugfs directories. As such, there no longer is a need to keep track of each individual debugfs entry so clean up the unused phba dentries. Reported-by: Al Viro Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-12-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 5d7ef44d8ae3b94565e8212d68c06bcee6f6ef90 Author: Justin Tee Date: Mon Sep 15 11:08:07 2025 -0700 scsi: lpfc: Use switch case statements in DIF debugfs handlers With the introduction of aux numbers for debugfs entries, there's no need to use the if-else-if clause based on debugfs entry pointers. Update both the lpfc_debugfs_dif_err_read and lpfc_debugfs_dif_err_write routines to use switch case based on aux instead. Reported-by: Al Viro Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-11-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 06d3c77c520b8c3ddcfd11c75f92f91213f7078a Author: Justin Tee Date: Mon Sep 15 11:08:06 2025 -0700 scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used Right after phba->nvmeio_trc is kzalloc'ed, phba->nvmeio_trc is set to NULL and the memory reference to free the kzalloc'ed memory is lost. Remove the phba->nvmeio_trc NULL ptr assignment after kzalloc. phba->nvmeio_trc is freed in lpfc_debugfs_terminate. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-10-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 Author: Justin Tee Date: Mon Sep 15 11:08:05 2025 -0700 scsi: lpfc: Define size of debugfs entry for xri rebalancing To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs entry is used. The debugfs file operations for xri rebalancing have been previously implemented, but lack definition for its information buffer size. Similar to other pre-existing debugfs entry buffers, define LPFC_HDWQINFO_SIZE as 8192 bytes. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-9-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 2bf81856a403c92a4ce375288f33fba82ca2ccc6 Author: Justin Tee Date: Mon Sep 15 11:08:04 2025 -0700 scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology There is a timing race condition when a PRLI may be sent on the wire before PLOGI_ACC in Point to Point topology. Fix by deferring REG_RPI mbox completion handling to after PLOGI_ACC's CQE completion. Because the discovery state machine only sends PRLI after REG_RPI mbox completion, PRLI is now guaranteed to be sent after PLOGI_ACC. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-8-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 Author: Justin Tee Date: Mon Sep 15 11:08:03 2025 -0700 scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET If lpfc_reset_flush_io_context fails to execute, then the wrong return status code may be passed back to upper layers when issuing a target reset TMF command. Fix by checking the return status from lpfc_reset_flush_io_context() first in order to properly return FAILED or FAST_IO_FAIL. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-7-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit b5bf6d681fce69cd1a57bfc0f1bdbbb348035117 Author: Justin Tee Date: Mon Sep 15 11:08:02 2025 -0700 scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted The kref for Fabric_DID ndlps is not decremented after repeated FDISC failures and exhausting maximum allowed retries. This can leave the ndlp lingering unnecessarily. Add a test and set bit operation for the NLP_DROPPED flag. If not previously set, then a kref is decremented. The ndlp is freed when the remaining reference for the completing ELS is put. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-6-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 Author: Justin Tee Date: Mon Sep 15 11:08:01 2025 -0700 scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the F_Port_Ctrl ndlp object. In cases when an ABTS is issued, the outstanding kref is needed for when a second XRI_ABORTED CQE is received. The final kref for the ndlp is designed to be decremented in lpfc_sli4_els_xri_aborted instead. Also, add a new log message to allow for future diagnostics when debugging related issues. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-5-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 803dfd83df33b7565f23aef597d5dd036adfa792 Author: Justin Tee Date: Mon Sep 15 11:08:00 2025 -0700 scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail lpfc_sli4_queue_setup() does not allocate memory and is used for submitting CREATE_QUEUE mailbox commands. Thus, if such mailbox commands fail we should clean up by also freeing the memory allocated for the queues with lpfc_sli4_queue_destroy(). Change the intended clean up label for the lpfc_sli4_queue_setup() error case to out_destroy_queue. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-4-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit dcf5ea65cff290cfcf73c3c3b7b201bd2b0d92d2 Author: Justin Tee Date: Mon Sep 15 11:07:59 2025 -0700 scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress Driver rmmod may take a long time when in a very large SAN environment. This is because outstanding ELS WQEs may end up taking E_D_TOV seconds to complete causing long delays. Speed this up by issuing aborts with the ia bit set so that outstanding ELS WQEs complete faster. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-3-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit 12ff7c57928269c947fcc032364f088c57e7efb8 Author: Justin Tee Date: Mon Sep 15 11:07:58 2025 -0700 scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport There are variables defined in struct lpfc_hba and lpfc_vport that are not used anywhere. Delete the unused variables from struct lpfc_hba and lpfc_vport. Signed-off-by: Justin Tee Message-ID: <20250915180811.137530-2-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen commit d125deba5cc89455ce4a4f42bd003bd9b9f7c795 Merge: fb1f4568346153 9877c004e9f4d1 Author: Martin K. Petersen Date: Tue Sep 16 22:05:59 2025 -0400 Merge patch series "scsi: qla2xxx: Fix incorrect sign of error code" Qianfeng Rong says: qla2x00_start_sp() returns only negative error codes or QLA_SUCCESS. Therefore, comparing its return value with positive error codes (e.g., if (_rval == EAGAIN)) causes logical errors. Signed-off-by: Martin K. Petersen commit 9877c004e9f4d10e7786ac80a50321705d76e036 Author: Qianfeng Rong Date: Fri Sep 5 15:54:45 2025 +0800 scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Signed-off-by: Qianfeng Rong Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen commit 1f037e3acda79639a78f096355f2c308a3d45492 Author: Qianfeng Rong Date: Fri Sep 5 15:54:44 2025 +0800 scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Additionally, the '_rval' variable should store negative error codes to conform to Linux kernel error code conventions. Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") Signed-off-by: Qianfeng Rong Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc Author: Qianfeng Rong Date: Fri Sep 5 15:54:43 2025 +0800 scsi: qla2xxx: edif: Fix incorrect sign of error code Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and qla_edif_process_els() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") Signed-off-by: Qianfeng Rong Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen commit fb1f4568346153d2f80fdb4ffcfa0cf4fb257d3c Author: Bart Van Assche Date: Tue Sep 9 12:06:07 2025 -0700 scsi: ufs: core: Disable timestamp functionality if not supported Some Kioxia UFS 4 devices do not support the qTimestamp attribute. Set the UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT for these devices such that no error messages appear in the kernel log about failures to set the qTimestamp attribute. Signed-off-by: Bart Van Assche Reviewed-by: Avri Altman Tested-by: Nitin Rawat # on SM8650-QRD Reviewed-by: Nitin Rawat Reviewed-by: Peter Wang Reviewed-by: Manivannan Sadhasivam Message-ID: <20250909190614.3531435-1-bvanassche@acm.org> Signed-off-by: Martin K. Petersen commit 7c85e4da8ce734eaca66a921aabeb6107842169f Author: Rob Herring (Arm) Date: Sat Sep 6 15:16:56 2025 -0500 dt-bindings: clock: silabs,si5341: Add missing properties Add "clock-output-names" which is a standard property for clock providers. Add the "always-on" boolean property which was undocumented, but already in use for some time. The flag prevents a clock output from being disabled. Signed-off-by: Rob Herring (Arm) Tested-by: Michal Simek Reviewed-by: Michal Simek Signed-off-by: Stephen Boyd commit 4d4a3cc7f280b2751a6967b25c6d8c1e2740cafd Author: Nam Cao Date: Sun May 11 23:18:03 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_ITYPE_IMM Use RV_EXTRACT_ITYPE_IMM, instead of re-implementing it in simulate_jalr(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/8ae34e966c312ae5cf6c09a35ddc290cce942208.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 7843b48dbf47d7fed4feaeb960244a757bb5d355 Author: Nam Cao Date: Sun May 11 23:18:02 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_UTYPE_IMM Use RV_EXTRACT_UTYPE_IMM, instead of reimplementing it in simulate_auipc(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/8f0defce9f1f23f1b44bb9750ed083cfc124213c.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit e33349630220e19264bd133dea8eee5d4e8684c6 Author: Nam Cao Date: Sun May 11 23:18:01 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_RD_REG Use RV_EXTRACT_RD_REG, instead of reimplementing its code. Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/b31e5b41df5839a76103348e54dc034c8a43447a.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 05df05bb04188c1c898f940cb2ef5440f94d5b56 Author: Nam Cao Date: Sun May 11 23:18:00 2025 +0200 riscv: kprobes: Remove duplication of RVC_EXTRACT_BTYPE_IMM Use RVC_EXTRACT_BTYPE_IMM, instead of reimplementing it in simulate_c_bnez_beqz(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/8a8ed970f279fa5f24c90d840c2130e37bc6d16e.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 580c11cd0b364c098df86789e230ee54ca3ece46 Author: Nam Cao Date: Sun May 11 23:17:59 2025 +0200 riscv: kprobes: Remove duplication of RVC_EXTRACT_C2_RS1_REG Use RVC_EXTRACT_C2_RS1_REG, instead of reimplementing it in simulate_c_jr_jalr(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/d56955cd683411c6d2f63d13c78e0572462a3269.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 05ede658d435f3969b13220c629cdc626356353f Author: Nam Cao Date: Sun May 11 23:17:58 2025 +0200 riscv: kprobes: Remove duplication of RVC_EXTRACT_JTYPE_IMM Use RVC_EXTRACT_JTYPE_IMM, instead of reimplementing it in simulate_c_j(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/24497deaab06d6b12cb84923606ec26f67e25424.1747215274.git.namcao@linutronix.de/ [pjw@kernel.org: fixed subject line typo] Signed-off-by: Paul Walmsley commit 76494817df791a2a6453dd353a4eec3faf57c578 Author: Nam Cao Date: Sun May 11 23:17:57 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_BTYPE_IMM Use RV_EXTRACT_BTYPE_IMM, instead of reimplementing it in simulate_branch(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/b441038c991da11a7a48ea7140ab00e3bb119387.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit d57676c21ef6f3dd530bcd7f5035a5e0b7699cc6 Author: Nam Cao Date: Sun May 11 23:17:56 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_RS1_REG Use RV_EXTRACT_RS1_REG instead of reimplementing its code. Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/b441038c991da11a7a48ea7140ab00e3bb119387.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 8f1ea7f04edd918b0e0fd8dc1318b22049a6c716 Author: Nam Cao Date: Sun May 11 23:17:55 2025 +0200 riscv: kprobes: Remove duplication of RV_EXTRACT_JTYPE_IMM Use RV_EXTRACT_JTYPE_IMM, instead of reimplementing it in simulate_jal(). Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/af502036738d381c6bdb96a236d21bab8c343f74.1747215274.git.namcao@linutronix.de/ Signed-off-by: Paul Walmsley commit 518c550eebbc5502177c3b8c4a28286120c518db Author: Nam Cao Date: Sun May 11 23:17:54 2025 +0200 riscv: kprobes: Move branch_funct3 to insn.h Similar to other instruction-processing macros/functions, branch_funct3 should be in insn.h. Move it into insn.h as RV_EXTRACT_FUNCT3. This new name matches the style in insn.h. Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/200c29a26338f19d09963fa02562787e8cfa06f2.1747215274.git.namcao@linutronix.de/ [pjw@kernel.org: updated to use RV_X_MASK and to apply] Signed-off-by: Paul Walmsley commit 5fe59140276d94f1390d062f5643f852270f8d95 Author: Nam Cao Date: Sun May 11 23:17:53 2025 +0200 riscv: kprobes: Move branch_rs2_idx to insn.h Similar to other instruction-processing macros/functions, branch_rs2_idx should be in insn.h. Move it into insn.h as RV_EXTRACT_RS2_REG. This new name matches the style in insn.h. Signed-off-by: Nam Cao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/linux-riscv/107d4a6c1818bf169be2407b273a0483e6d55bbb.1747215274.git.namcao@linutronix.de/ [pjw@kernel.org: updated to use RV_X_MASK and to apply] Signed-off-by: Paul Walmsley commit 5e87fdc37f8dc619549d49ba5c951b369ce7c136 Merge: 739d911ce58a78 629a2b18e87294 Author: Jakub Kicinski Date: Tue Sep 16 17:36:02 2025 -0700 Merge tag 'batadv-next-pullrequest-20250916' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== This cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - Remove network coding support, by Sven Eckelmann (2 patches) - remove includes for extern declarations, by Sven Eckelmann * tag 'batadv-next-pullrequest-20250916' of https://git.open-mesh.org/linux-merge: batman-adv: remove includes for extern declarations batman-adv: keep skb crc32 helper local in BLA batman-adv: remove network coding support batman-adv: Start new development cycle ==================== Link: https://patch.msgid.link/20250916122441.89246-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 739d911ce58a7827aefdcf0d0dc7397263c6f6ed Merge: 7cfbe1c3397c93 d654d3fc2066c4 Author: Jakub Kicinski Date: Tue Sep 16 17:25:56 2025 -0700 Merge branch 'net-mlx5-refactor-devcom-and-add-net-namespace-support' Tariq Toukan says: ==================== net/mlx5: Refactor devcom and add net namespace support This series by Shay improves the mlx5 devcom infrastructure by introducing a structured matching attribute interface, relocating certain devcom registration flows to more appropriate locations, and adding net namespace awareness to the devcom framework and its users. Patch 1: Refactors the devcom interface to accept a match attribute structure instead of raw keys, enabling future extensibility such as namespace-based matching. Patch 2: Moves the devcom registration for HCA components from the core code to the LAG layer to better reflect their logical ownership and lifecycle. Patch 3: Adds net namespace support to the devcom framework, enabling components to operate in isolated namespaces. Patch 4: Updates the LAG layer to make use of the new namespace-aware devcom interface and improves reload behavior in LAG mode. ==================== Link: https://patch.msgid.link/1757940070-618661-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d654d3fc2066c40586fa3b0538c0bf093e20b817 Author: Shay Drory Date: Mon Sep 15 15:41:10 2025 +0300 net/mlx5: Lag, add net namespace support Update the LAG implementation to support net namespace isolation. Recent devcom changes added namespace-aware client matching. Align LAG with this model so that hardware LAG forms only between mlx5 interfaces that share the same network namespace. This avoids cross-namespace interference and matches user expectations when devices are placed in different netns. Make LAG netns-aware by storing the device’s namespace in mlx5_lag and registering the devcom client with that namespace. As a result, only peers in the same netns are eligible to form a LAG. Adjust reload handling so LAG teardown/re-evaluation happens in the correct namespace context. Remove the blanket restriction that prevented devlink reload when LAG was active. Remove the reload restriction here allowing devlink reload in LAG mode is part of delivering complete netns aware LAG support: With per-netns devcom registration, reload no longer risks cross-namespace coupling. The devcom client is torn down and re-registered in the device’s current netns, and LAG is re-evaluated within that scope. The change is trivial and self-contained, and keeping it in this patch avoids splitting a feature that is functionally one unit. Only devices in same netns can form hardware LAG. devlink reload no longer fails just because LAG is active. LAG is torn down/re-created as needed within the correct namespace. No change for setups that don’t use namespaces. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757940070-618661-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 95f73447c269e196dc149bece65b2d83cdb42b08 Author: Shay Drory Date: Mon Sep 15 15:41:09 2025 +0300 net/mlx5: Add net namespace support to devcom Extend the devcom framework to support namespace-aware components. The existing devcom matching logic was based solely on numeric keys, limiting its use to the global (init_net) scope or requiring clients to ignore namespaces altogether, both of which are incorrect in multi-namespace environments. This patch introduces namespace support by allowing devcom clients to provide a namespace match attribute. The devcom pairing mechanism is updated to compare the namespace, enabling proper isolation and interaction of components across different net namespaces. With this change, components that require namespace aware pairing, such as SD groups or LAG, can now work correctly in multi-namespace scenarios. In particular, this opens the way to support hardware LAG within a net namespace. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757940070-618661-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5a977b5833b7a261bfa6094595ffa73c1071588c Author: Shay Drory Date: Mon Sep 15 15:41:08 2025 +0300 net/mlx5: Lag, move devcom registration to LAG layer Move the devcom registration for the HCA_PORTS component from the core initialization path into the LAG logic. This better reflects the logical ownership of this component and ensures proper alignment with the LAG lifecycle. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757940070-618661-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f05a82fbcc645dceeed242d80bccb9dad2ca3383 Author: Shay Drory Date: Mon Sep 15 15:41:07 2025 +0300 net/mlx5: Refactor devcom to use match attributes Refactor the devcom interface to use a match attribute structure instead of passing raw keys. This change lays the groundwork for extending devcom matching logic with additional fields like net namespace, improving its flexibility and robustness. No functional changes. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757940070-618661-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 582310376d6e9a8d261b682178713cdc4b251af6 Author: Takashi Sakamoto Date: Wed Sep 17 09:03:47 2025 +0900 firewire: core: shrink critical section of fw_card spinlock in bm_work Now fw_core_handle_bus_reset() and bm_work() are serialized. Some members of fw_card are free to access in bm_work() This commit shrinks critical section of fw_card spinlock in bm_work() Link: https://lore.kernel.org/r/20250917000347.52369-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit abe7159125702c734e851bc0c52b51cd446298a5 Author: Takashi Sakamoto Date: Wed Sep 17 09:03:46 2025 +0900 firewire: core: disable bus management work temporarily during updating topology When processing selfID sequence, bus topology tree is (re)built, and some members of fw_card are determined. Once determined, the members are valid during the bus generation. The above operations are in the critical section of fw_card spin lock. Before building the bus topology, a work item is scheduled for bus manager work. The bm_work() function is invoked by the work item. The function tries to acquire the spin lock, then can be stalled until the bus topology building finishes. The bus manager should work once the members of fw_card are determined. This commit suppresses the above situation by disabling the work item during processing selfID sequence. Link: https://lore.kernel.org/r/20250917000347.52369-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit b460b317b21d5106f3ebd34bd51b851ad355a70a Author: Takashi Sakamoto Date: Wed Sep 17 09:03:45 2025 +0900 firewire: core: schedule bm_work item outside of spin lock Before (re)building topology tree, fw_core_handle_bus_reset() schedules a work item under acquiring fw_card spin lock. The work item invokes bm_work() which acquires the spin lock at first, then can be stalled to wait until the building tree finishes. This is inconvenient. This commit moves the timing to schedule the work item after releasing the spin lock. Link: https://lore.kernel.org/r/20250917000347.52369-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 3e23a3f688b457288c37899f8898180cc231ff97 Author: Yi Lai Date: Tue Sep 9 16:26:19 2025 +0800 selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES The harness-selftest.expected is not installed in INSTALL_PATH. Attempting to execute harness-selftest.sh shows warning: diff: ./kselftest_harness/harness-selftest.expected: No such file or directory Add harness-selftest.expected to TEST_FILES. Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest") Signed-off-by: Yi Lai Reviewed-by: Thomas Weißschuh Signed-off-by: Shuah Khan commit 7cfbe1c3397c9368d2bd7fbf5345a5bf4c43df0d Author: Kory Maincent (Dent Project) Date: Mon Sep 15 19:06:28 2025 +0200 docs: devlink: Sort table of contents alphabetically Sort devlink documentation table of contents alphabetically to improve readability and make it easier to locate specific chapters. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250915-feature_poe_permanent_conf-v3-3-78871151088b@bootlin.com Signed-off-by: Jakub Kicinski commit c94ef36ec9d1093e676c81a1ed415e63dffb0046 Author: Russell King (Oracle) Date: Mon Sep 15 13:13:06 2025 +0100 net: dsa: mv88e6xxx: clean up PTP clock during setup failure If an error occurs during mv88e6xxx_setup() and the PTP clock has been registered, the clock will not be unregistered as mv88e6xxx_ptp_free() will not be called. mv88e6xxx_hwtstamp_free() also is not called. As mv88e6xxx_ptp_free() can cope with being called without a successful call to mv88e6xxx_ptp_setup(), and mv88e6xxx_hwtstamp_free() is empty, add both these *_free() calls to the error cleanup paths in mv88e6xxx_setup(). Moreover, mv88e6xxx_teardown() should teardown setup done in mv88e6xxx_setup() - see dsa_switch_setup(). However, instead *_free() are called from mv88e6xxx_remove() function that is only called when a device is unbound, which omits cleanup should a failure occur later in dsa_switch_setup(). Move the *_free() calls from mv88e6xxx_remove() to mv88e6xxx_teardown(). Note that mv88e6xxx_ptp_setup() must be called holding the reg_lock, but mv88e6xxx_ptp_free() must never be. This is especially true after commit "ptp: rework ptp_clock_unregister() to disable events". This patch does not change this, but adds a comment to that effect. Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/E1uy84w-00000005Spi-46iF@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3ea308da69b1a0848828e95eb5d514873f3a5249 Author: Russell King Date: Mon Sep 15 13:10:18 2025 +0100 net: mvpp2: add support for hardware timestamps Add support for hardware timestamps in (e.g.) the PHY by calling skb_tx_timestamp() as close as reasonably possible to the point that the hardware is instructed to send the queued packets. As this also introduces software timestamping support, report those capabilities via the .get_ts_info() method. Signed-off-by: Russell King Link: https://patch.msgid.link/E1uy82E-00000005Sll-0SSy@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5ed994dd0b7ba1f98f234cd92d3a31b1a7696380 Author: Alexander Lobakin Date: Tue Sep 16 18:01:18 2025 +0200 libie: fix linking with libie_{adminq,fwlog} when CONFIG_LIBIE=n Initially, libie contained only 1 module and I assumed that new modules in its folder would depend on it. However, Michał did a good job and libie_{adminq,fwlog} are completely independent, but libie/ is still traversed by Kbuild only under CONFIG_LIBIE != n. This results in undefined references with certain kernel configs. Tell Kbuild to always descend to libie/ to be able to build each module regardless of whether the basic one is enabled. If none of CONFIG_LIBIE* is set, Kbuild will just create an empty built-in.a there with no side effects. Fixes: 641585bc978e ("ixgbe: fwlog support for e610") Reported-by: kernel test robot Closes: https://lore.kernel.org/202509140606.j8z3rE73-lkp@intel.com Reported-by: Breno Leitao Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/CA+G9fYvH8d6pJRbHpOCMZFjgDCff3zcL_AsXL-nf5eB2smS8SA@mail.gmail.com Signed-off-by: Alexander Lobakin Reviewed-by: Tony Nguyen Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250916160118.2209412-1-aleksander.lobakin@intel.com Signed-off-by: Jakub Kicinski commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 Author: Nai-Chen Cheng Date: Wed Sep 10 19:30:32 2025 +0800 selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency The selftests 'make clean' does not clean the net/lib because it only processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves compiled objects in net/lib after cleaning, requiring manual cleanup. Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib dependency is properly cleaned. Signed-off-by: Nai-Chen Cheng Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Acked-by: Shuah Khan Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com Signed-off-by: Jakub Kicinski commit e8cfc524eaf3c0ed88106177edb6961e202e6716 Author: Akhilesh Patil Date: Sun Sep 14 20:58:41 2025 +0530 selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported Check if watchdog device supports WDIOF_KEEPALIVEPING option before entering keep_alive() ping test loop. Fix watchdog-test silently looping if ioctl based ping is not supported by the device. Exit from test in such case instead of getting stuck in loop executing failing keep_alive() watchdog_info: identity: m41t93 rtc Watchdog firmware_version: 0 Support/Status: Set timeout (in seconds) Support/Status: Watchdog triggers a management or other external alarm not a reboot Watchdog card disabled. Watchdog timeout set to 5 seconds. Watchdog ping rate set to 2 seconds. Watchdog card enabled. WDIOC_KEEPALIVE not supported by this device without this change Watchdog card disabled. Watchdog timeout set to 5 seconds. Watchdog ping rate set to 2 seconds. Watchdog card enabled. Watchdog Ticking Away! (Where test stuck here forver silently) Updated change log at commit time: Shuah Khan Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") Signed-off-by: Akhilesh Patil Signed-off-by: Shuah Khan commit aaae483657ec9de5782169bc052dd6e8ee7f806c Author: Daniele Ceraolo Spurio Date: Tue Sep 9 15:12:41 2025 -0700 drm/xe: Allow error injection for xe_pxp_exec_queue_add This will allow us to simulate this function returning an error like we do for other functions called in the exec_queue_create path. Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: John Harrison Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250909221240.3711023-4-daniele.ceraolospurio@intel.com commit 626667321deb4c7a294725406faa3dd71c3d445d Author: Daniele Ceraolo Spurio Date: Tue Sep 9 15:12:40 2025 -0700 drm/xe: Fix error handling if PXP fails to start Since the PXP start comes after __xe_exec_queue_init() has completed, we need to cleanup what was done in that function in case of a PXP start error. __xe_exec_queue_init calls the submission backend init() function, so we need to introduce an opposite for that. Unfortunately, while we already have a fini() function pointer, it performs other operations in addition to cleaning up what was done by the init(). Therefore, for clarity, the existing fini() has been renamed to destroy(), while a new fini() has been added to only clean up what was done by the init(), with the latter being called by the former (via xe_exec_queue_fini). Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Matthew Brost Reviewed-by: John Harrison Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250909221240.3711023-3-daniele.ceraolospurio@intel.com commit 2dfb75cd5695fa9db2ad90d1339330eda7a0239d Author: Chunyan Zhang Date: Fri Jul 18 15:27:08 2025 +0800 raid6: riscv: replace one load with a move to speed up the caculation Since wp$$==wq$$, it doesn't need to load the same data twice, use move instruction to replace one of the loads to let the program run faster. Reviewed-by: Alexandre Ghiti Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20250718072711.3865118-3-zhangchunyan@iscas.ac.cn Signed-off-by: Paul Walmsley commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd Author: Chunyan Zhang Date: Fri Jul 18 15:27:07 2025 +0800 raid6: riscv: Clean up unused header file inclusion These two C files don't reference things defined in simd.h or types.h so remove these redundant #inclusions. Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations") Reviewed-by: Alexandre Ghiti Signed-off-by: Chunyan Zhang Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn Signed-off-by: Paul Walmsley commit a601732236834a84e110508e884dc8d368d99d07 Author: Alexandre Ghiti Date: Fri Jun 20 20:21:59 2025 +0000 riscv: Move all duplicate insn parsing macros into asm/insn.h kernel/traps_misaligned.c and kvm/vcpu_insn.c define the same macros to extract information from the instructions. Let's move the definitions into asm/insn.h to avoid this duplication. Reviewed-by: Andrew Jones Signed-off-by: Alexandre Ghiti Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20250620-dev-alex-insn_duplicate_v5_manual-v5-3-d865dc9ad180@rivosinc.com [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit 833bbb0d91d21694ec0d8909b6c71f5df448c575 Author: Alexandre Ghiti Date: Fri Jun 20 20:21:58 2025 +0000 riscv: Strengthen duplicate and inconsistent definition of RV_X() RV_X() macro is defined in two different ways which is error prone. So harmonize its first definition and add another macro RV_X_MASK() for the second one. Reviewed-by: Andrew Jones Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250620-dev-alex-insn_duplicate_v5_manual-v5-2-d865dc9ad180@rivosinc.com [pjw@kernel.org: upcase the macro name to conform with previous practice] Signed-off-by: Paul Walmsley commit 932131fd3ed21538a9b16f14e46b2794f244a196 Author: Alexandre Ghiti Date: Fri Jun 20 20:21:57 2025 +0000 riscv: Fix typo EXRACT -> EXTRACT Simply fix a typo. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Andrew Jones Signed-off-by: Alexandre Ghiti Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20250620-dev-alex-insn_duplicate_v5_manual-v5-1-d865dc9ad180@rivosinc.com Signed-off-by: Paul Walmsley commit f2fab612824ffc8314d3a752724dd37a3ce27a31 Author: Nam Cao Date: Tue May 13 17:16:31 2025 +0200 riscv: Add kprobes KUnit test Add KUnit test for riscv kprobes, mostly for simulated instructions. The test install kprobes into multiple sample functions, and check that these functions still return the expected magic value. This test can detect some kprobe bugs reported in the past (in Link:). Link: https://lore.kernel.org/linux-riscv/20241119111056.2554419-1-namcao@linutronix.de/ Link: https://lore.kernel.org/stable/c7e463c0-8cad-4f4e-addd-195c06b7b6de@iscas.ac.cn/ Link: https://lore.kernel.org/linux-riscv/20230829182500.61875-1-namcaov@gmail.com/ Signed-off-by: Nam Cao Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250513151631.3520793-1-namcao@linutronix.de Signed-off-by: Paul Walmsley commit f811f58597acba9100dd61cdef052d1d1f931968 Author: Thomas Huth Date: Fri Jun 6 09:09:52 2025 +0200 riscv: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This originally was a completely mechanical patch (done with a simple "sed -i" statement), with some manual fixups during rebasing of the patch later. Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: linux-riscv@lists.infradead.org Signed-off-by: Thomas Huth Link: https://lore.kernel.org/r/20250606070952.498274-3-thuth@redhat.com Signed-off-by: Paul Walmsley commit 35ebe00307f3f9b1a7103d0697632c6ef7310d1c Author: Thomas Huth Date: Fri Jun 6 09:09:51 2025 +0200 riscv: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: linux-riscv@lists.infradead.org Signed-off-by: Thomas Huth Link: https://lore.kernel.org/r/20250606070952.498274-2-thuth@redhat.com Signed-off-by: Paul Walmsley commit 3a8ee3a9f4f6caca192fd2fdc88c1ce56c521b38 Author: Yunhui Cui Date: Tue Jul 22 17:15:04 2025 +0800 riscv: introduce ioremap_wc() Compared with IO attributes, NC attributes can improve performance, specifically in these aspects: Relaxed Order, Gathering, Supports Read Speculation, Supports Unaligned Access. Signed-off-by: Yunhui Cui Signed-off-by: Qingfang Deng Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250722091504.45974-2-cuiyunhui@bytedance.com Signed-off-by: Paul Walmsley commit 57b100d4cf14276e0340eecb561005c07c129eb8 Author: Kaushlendra Kumar Date: Thu Aug 28 12:00:00 2025 +0530 tools/cpupower: fix error return value in cpupower_write_sysfs() The cpupower_write_sysfs() function currently returns -1 on write failure, but the function signature indicates it should return an unsigned int. Returning -1 from an unsigned function results in a large positive value rather than indicating an error condition. Fix this by returning 0 on failure, which is more appropriate for an unsigned return type and maintains consistency with typical success/failure semantics where 0 indicates failure and non-zero indicates success (bytes written). Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Signed-off-by: Shuah Khan commit df99f6d112493808c5e5d948ad482d267aad5b89 Author: Christian König Date: Wed Aug 27 11:45:45 2025 +0200 drm/amdgpu: re-order and document VM code Re-order fields in the VM structure and try to improve the documentation a bit. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 930595df251c24e44642651a1386f7ed53cffd10 Author: Christian König Date: Wed Aug 27 10:17:48 2025 +0200 drm/amdgpu: remove check for BO reservation add assert instead We should leave such checks to lockdep and not implement something manually. Signed-off-by: Christian König Acked-by: Sunil Khatri Reviewed-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit beae798b6829dbecda7fdcdb3e466b1059976960 Author: Asad Kamal Date: Wed Aug 27 18:19:13 2025 +0800 drm/amd/pm: Update pmfw headers for smu_v13_0_12 Update pmfw headers for smu_v13_0_12 to include node power limit Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit e09a4fdfbb1cf21a6f32f03497f3307b03653b36 Author: Asad Kamal Date: Mon Sep 15 17:42:44 2025 +0800 drm/amd/pm: Rename amdgpu_hwmon_get_sensor_generic Rename amdgpu_hwmon_get_sensor_generic to use for generic pm interfaces Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 1a4dd33cc6e1baaa81efdbe68227a19f51c50f20 Author: Mario Limonciello Date: Mon Sep 15 20:59:02 2025 -0500 drm/amd: Only restore cached manual clock settings in restore if OD enabled If OD is not enabled then restoring cached clock settings doesn't make sense and actually leads to errors in resume. Check if enabled before restoring settings. Fixes: 4e9526924d09 ("drm/amd: Restore cached manual clock settings during resume") Reported-by: Jérôme Lécuyer Closes: https://lore.kernel.org/amd-gfx/0ffe2692-7bfa-4821-856e-dd0f18e2c32b@amd.com/T/#me6db8ddb192626360c462b7570ed7eba0c6c9733 Suggested-by: Jérôme Lécuyer Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 49e957b2899c2f1c4ea44527727e46923d057a86 Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:43 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the V14_0_2 smu The I2C init for V14_0_2 uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that V14_0_2 init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit c32da00612baa106d7cfea707411b1510239e66a Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:42 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the V13_0_6 smu The I2C init for V13_0_6 uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that V13_0_6 init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 4970883abd31e4da100a3bf73a74b41517fc552e Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:41 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the V13 smu The I2C init for SMU_V13 uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that SMU_V13 init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 13f785d37aea745de0e722c81ec67995456577fd Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:40 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the Sienna smu The I2C init for Sienna Cichlid uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that Sienna Cichlid init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 9058cb7775083bbbc2795439be8cf18f98098c49 Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:39 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the Navi10 smu The I2C init for Navi10 uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that Navi10 init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 439158c47512910054d28a5b6d6b01280c089ab8 Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:38 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the Arcturus smu The I2C init for Arcturus uses i2c_add_adapter() and i2c_del_adapter(), this commit replaces the use of these two functions with devm_i2c_add_adapter(). Notice that Arcturus init initializes multiple I2C buses in a loop; if something goes wrong, the previous adapters are removed, and the amdgpu load is interrupted. Since I2C init is required for the correct load of amdgpu, it is safe to rely on devm_i2c_add_adapter() to handle any previously initialized I2C adapter. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit f4dfc4447d57c1d03ded394797018ac463449d2c Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:37 2025 -0600 drm/amd/pm: Use devm_i2c_add_adapter() in the i2c init Instead of using i2c_add_adapter() and i2c_del_adapter(), replace them with devm_i2c_add_adapter() to simplify the i2c logic. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 63137c7c8cd1aee788067b9d3782dce6ea21c0df Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:36 2025 -0600 drm/amdgpu: Use devm_i2c_add_adapter() in SMU V11 Instead of using i2c_add_adapter() and i2c_del_adapter() in the SMU V11, use devm_i2c_add_adapter() to simplify the code path. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 0f36a3c6af9e137344a2060cf2510db7ff9920c0 Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:35 2025 -0600 drm/amdgpu/amdgpu_i2c: Use devm_i2c_add_adapter instead of i2c_add_adapter This commit replaces i2c_add_adapter() with devm_i2c_add_adapter() and removes part of the cleanup logic since the new function handles the i2c removal. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 Author: Rodrigo Siqueira Date: Wed Sep 10 11:39:34 2025 -0600 drm/amd/display: Use devm_i2c_add_adapter to simplify i2c cleanup logic This commit replaces the utilization of i2c_add/del_adapter() with devm_i2c_add_adapter() to reduce the amount of boilerplate. Using devm_i2c_add_adapter() has the advantage of removing the manual manipulation of the I2C adapter. Suggested-by: Robert Beckett Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 70db83e2b9064bc427d1a7003e516b3400a8ceda Author: James Flowers Date: Fri Sep 12 22:19:52 2025 -0700 drm/amd/display: Use kmalloc_array() instead of kmalloc() Documentation/process/deprecated.rst recommends against the use of kmalloc with dynamic size calculations due to the risk of overflow and smaller allocation being made than the caller was expecting. This could lead to buffer overflow in code similar to the memcpy in amdgpu_dm_plane_add_modifier(). Signed-off-by: James Flowers Signed-off-by: Alex Deucher commit 39203f5e6dcf2b0529ae526004e7a9c8ef453ae2 Author: Christian König Date: Wed Aug 27 09:28:40 2025 +0200 drm/amdgpu: fix userq VM validation v4 That was actually complete nonsense and not validating the BOs at all. The code just cleared all VM areas were it couldn't grab the lock for a BO. Try to fix this. Only compile tested at the moment. v2: fix fence slot reservation as well as pointed out by Sunil. also validate PDs, PTs, per VM BOs and update PDEs v3: grab the status_lock while working with the done list. v4: rename functions, add some comments, fix waiting for updates to complete. v4: rename amdgpu_vm_lock_done_list(), add some more comments Signed-off-by: Christian König Reviewed-by: Sunil Khatri Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d Author: Christian König Date: Wed Aug 27 13:14:43 2025 +0200 drm/amdgpu: reject gang submissions under SRIOV Gang submission means that the kernel driver guarantees that multiple submissions are executed on the HW at the same time on different engines. Background is that those submissions then depend on each other and each can't finish stand alone. SRIOV now uses world switch to preempt submissions on the engines to allow sharing the HW resources between multiple VFs. The problem is now that the SRIOV world switch can't know about such inter dependencies and will cause a timeout if it waits for a partially running gang submission. To conclude SRIOV and gang submissions are fundamentally incompatible at the moment. For now just disable them. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 32bd60d5eca048fb91eed723799c0b4a847c18e4 Merge: c99642913d4c4a e5b4ad2183f7ab Author: Mark Brown Date: Tue Sep 16 22:42:25 2025 +0100 ASoC: cs35l56: Handle vendor-specific UEFI Merge series from Richard Fitzgerald : This series adds handling for vendor-specific UEFI variables from Lenovo and HP. These vendors will switch to using their UEFI variables instead of the normal Cirrus Logic-defined mechanisms. The model of speaker fitted (Speaker ID) is normally signaled by a GPIO, and the driver is given access to this GPIO. Lenovo and HP will both stop giving the driver access to the GPIO and instead the BIOS will create a UEFI variable giving the value of the GPIO. HP will also start using their own UEFI variable to store amp calibration data. The content of the variable is the same as the Cirrus Logic variable, only the UEFI name and GUID are changed. Change in v2: Removed unused target_uid variable and code that set it in patch 6. Richard Fitzgerald (6): ASoC: cs-amp-lib: Rename defines for Cirrus Logic EFI ASoC: cs-amp-lib: Add handling for Lenovo and HP UEFI speaker ID ASoC: cs35l56: Check for vendor-specific speaker ID value ASoC: cs-amp-lib-test: Add tests for cs_amp_get_vendor_spkid() ASoC: cs-amp-lib: Add HP-specific EFI variable for calibration data ASoC: cs-amp-lib-test: Add test for getting cal data from HP EFI include/sound/cs-amp-lib.h | 1 + sound/soc/codecs/cs-amp-lib-test.c | 252 ++++++++++++++++++++++++++++- sound/soc/codecs/cs-amp-lib.c | 139 +++++++++++++++- sound/soc/codecs/cs35l56-shared.c | 12 +- 4 files changed, 395 insertions(+), 9 deletions(-) -- 2.39.5 commit c99642913d4c4ab9e8ac73d0241e7b5e3e14fd05 Merge: 5b65120115420b 88d0d17192c5a8 Author: Mark Brown Date: Tue Sep 16 22:42:21 2025 +0100 Add PM4125 audio codec driver Merge series from Alexey Klimov : PMICs like PM4125 have in-built audio codec IC. The series here adds support for this codec driver: DT bindings and codec driver itself that consists mainly of two parts: soundwire devices and codec part itself. This audio codec can be found on platforms like QCM2290 and on Qualcomm QRB2210 RB1 board. We are working on this together with Srini (srinivas.kandagatla@oss.qualcomm.com or srini@kernel.org). This driver also has a bit limited support for concurrent playback, since line out path is connected to left input channel. commit 5b65120115420b1b7132c2aafbfe1a54120cbfb7 Merge: 8d7de4a014f589 1217b573978482 Author: Mark Brown Date: Tue Sep 16 22:42:16 2025 +0100 ASoC: codecs: pcm1754: add pcm1754 dac driver Merge series from Stefan Kerkmann : Add a CODEC driver for the TI PCM1754. commit ba1afc94deb849eab843a372b969444581add2c9 Author: Jeremy Linton Date: Sun Aug 24 22:34:21 2025 -0500 uprobes: uprobe_warn should use passed task uprobe_warn() is passed a task structure, yet its using current. For the most part this shouldn't matter, but since a task structure is provided, lets use it. Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances") Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas Acked-by: Oleg Nesterov Acked-by: Masami Hiramatsu (Google) Signed-off-by: Will Deacon commit cc66c711e58f5dd29da79c24ca699a0312e012e3 Author: Jeremy Linton Date: Sun Aug 24 22:34:20 2025 -0500 arm64: Kconfig: Remove GCS restrictions on UPROBES Now that the uprobe paths have been made GCS compatible drop the Kconfig restriction. Signed-off-by: Jeremy Linton Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 4a601714bb24926507b2051c4a95f07e0e142004 Author: Jeremy Linton Date: Sun Aug 24 22:34:19 2025 -0500 arm64: uprobes: Add GCS support to uretprobes Ret probes work by changing the value in the link register at the probe location to return to the probe rather than the calling routine. Thus the GCS needs to be updated with this address as well. Since its possible to insert probes at locations where the current value of the LR doesn't match the GCS state this needs to be detected and handled in order to maintain the existing no-fault behavior. Co-developed-by: Steve Capper Signed-off-by: Steve Capper Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas [will: Add '__force' to gcspr casts in arch_uretprobe_hijack_return_addr()] Signed-off-by: Will Deacon commit dadb3ebcf395ebee3626d88ac7e5e234f15bae2c Author: Marco Crivellari Date: Sun Sep 14 15:44:26 2025 +0200 workqueue: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit efb07ac534e24e22a7eb32815fb50f69931cdeae Author: Jeremy Linton Date: Sun Aug 24 22:34:18 2025 -0500 arm64: probes: Add GCS support to bl/blr/ret The arm64 probe simulation doesn't currently have logic in place to deal with GCS and this results in core dumps if probes are inserted at control flow locations. Fix-up bl, blr and ret to manipulate the shadow stack as needed. While we manipulate and validate the shadow stack correctly, the hardware provides additional security by only allowing GCS operations against pages which are marked to support GCS. For writing there is gcssttr() which enforces this, but there isn't an equivalent for reading. This means that uprobe users should be aware that probing on control flow instructions which require reading the shadow stack (ex: ret) offers lower security guarantees than what is achieved without the uprobe active. Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 9cd2a7f1180f9b6fe5214abc90eaf5c053f545ee Author: Jeremy Linton Date: Sun Aug 24 22:34:17 2025 -0500 arm64: uaccess: Add additional userspace GCS accessors Uprobes need more advanced read, push, and pop userspace GCS functionality. Implement those features using the existing gcsstr() and copy_from_user(). Its important to note that GCS pages can be read by normal instructions, but the hardware validates that pages used by GCS specific operations, have a GCS privilege set. We aren't validating this in load_user_gcs because it requires stabilizing the VMA over the read which may fault. Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas Reviewed-by: Mark Brown [will: Add '__force' to gcspr cast in pop_user_gcs()] Signed-off-by: Will Deacon commit 5020d05b3476f3561377a4ab076d42fda00e3607 Author: Huisong Li Date: Thu Sep 11 19:24:06 2025 +0800 ACPI: processor: Remove unused empty stubs of some functions Empty stubs are defined in processor.h for some functions provided by the ACPI processor idle driver, but those functions are only used in the main ACPI processor driver which requires the ACPI processor idle driver to be present (selecting CONFIG_ACPI_PROCESSOR causes CONFIG_ACPI_PROCESSOR_IDLE to be selected too automatically). This means that the empty stubs in question are not really necessary and if both CONFIG_ACPI_PROCESSOR and CONFIG_ACPI_PROCESSOR_IDLE are unset, the compiler complains that they are defined, but not used. Drop them to get rid of the compiler warning. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250911112408.1668431-2-lihuisong@huawei.com [ rjw: Subject and changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit 19dd484cd19c308e2ea763f8d31e43a7f1ab6141 Author: Yury Norov (NVIDIA) Date: Fri Sep 12 20:09:05 2025 -0400 arm64/fpsimd: simplify sme_setup() The function checks info->vq_map for emptiness right before calling find_last_bit(). We can use the find_last_bit() output and save on bitmap_empty() call, which is O(N). Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Will Deacon commit 4e26b0f4f1a965e366795c100bd7a8ee1635ed14 Author: Gaurav Kohli Date: Wed Jul 2 13:53:11 2025 +0530 arm64: dts: qcom: qcs615: Enable TSENS support for QCS615 SoC Add TSENS and thermal devicetree node for QCS615 SoC. Signed-off-by: Gaurav Kohli Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250702082311.4123461-3-quic_gkohli@quicinc.com Signed-off-by: Bjorn Andersson commit 5b5133e6a55bf6ca18de1b33c2ffe17d1162ec8e Author: Jiaming Zhang Date: Sat Sep 6 01:47:36 2025 +0800 Documentation: KVM: Call out that KVM strictly follows the 8254 PIT spec Explicitly document that the behavior of KVM_SET_PIT2 strictly conforms to the Intel 8254 PIT hardware specification, specifically that a write of '0' adheres to the spec's definition that a programmed count of '0' is converted to the maximum possible value (2^16). E.g. an unaware userspace might attempt to validate that KVM_GET_PIT2 returns the exact state set via KVM_SET_PIT2, and be surprised when the returned count is 65536, not 0. Add a references to the Intel 8254 PIT datasheet that will hopefully stay fresh for some time (the internet isn't exactly brimming with copies of the 8254 datasheet). Link: https://lore.kernel.org/all/CANypQFbEySjKOFLqtFFf2vrEe=NBr7XJfbkjQhqXuZGg7Rpoxw@mail.gmail.com Signed-off-by: Jiaming Zhang Link: https://lore.kernel.org/r/20250905174736.260694-1-r772577952@gmail.com [sean: add context Link, drop local APIC change, massage changelog accordingly] Signed-off-by: Sean Christopherson commit cbd860293d139fae44b76d821d8112aab89d8e17 Author: Liao Yuanhong Date: Mon Sep 1 21:16:04 2025 +0800 KVM: x86: hyper-v: Use guard() instead of mutex_lock() to simplify code Use guard(mutex) instead of mutex_lock/mutex_unlock pair to simplify the error handling when setting up the TSC page for a Hyper-V guest. No functional change intended. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250901131604.646415-1-liaoyuanhong@vivo.com [sean: tweak changelog] Signed-off-by: Sean Christopherson commit 4319fa120f0f42be167d56d84ece94340e11d61e Author: Liao Yuanhong Date: Mon Sep 1 21:18:21 2025 +0800 KVM: x86: Use guard() instead of mutex_lock() to simplify code Use guard(mutex) instead of mutex_lock/mutex_unlock pair to simplify the error handling when allocating the APIC access page. No functional change intended. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250901131822.647802-1-liaoyuanhong@vivo.com [sean: add blank link to isolate guard(), tweak changelog] Signed-off-by: Sean Christopherson commit 06dc910f5e07a3b85ea1a6891596689f492ecc72 Author: Dapeng Mi Date: Fri Jul 18 08:19:01 2025 +0800 KVM: x86/pmu: Correct typo "_COUTNERS" to "_COUNTERS" Fix typos. "_COUTNERS" -> "_COUNTERS". Signed-off-by: Dapeng Mi Tested-by: Yi Lai Link: https://lore.kernel.org/r/20250718001905.196989-2-dapeng1.mi@linux.intel.com Signed-off-by: Sean Christopherson commit b3a37bff8daf50cdd6fa9ebe4a503d4261d99796 Author: Sagi Shahar Date: Tue Aug 26 18:17:26 2025 -0700 KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs Reject KVM_CREATE_IRQCHIP if the VM type has protected EOIs, i.e. if KVM can't intercept EOI and thus can't faithfully emulate level-triggered interrupts that are routed through the I/O APIC. For TDX VMs, the TDX-Module owns the VMX EOI-bitmap and configures all IRQ vectors to have the CPU accelerate EOIs, i.e. doesn't allow KVM to intercept any EOIs. KVM already requires a split irqchip[1], but does so during vCPU creation, which is both too late to allow userspace to fallback to a split irqchip and a less-than-stellar experience for userspace since an -EINVAL on KVM_VCPU_CREATE is far harder to debug/triage than failure exactly on KVM_CREATE_IRQCHIP. And of course, allowing an action that ultimately fails is arguably a bug regardless of the impact on userspace. Link: https://lore.kernel.org/lkml/20250222014757.897978-11-binbin.wu@linux.intel.com [1] Link: https://lore.kernel.org/lkml/aK3vZ5HuKKeFuuM4@google.com Suggested-by: Sean Christopherson Signed-off-by: Sagi Shahar Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250827011726.2451115-1-sagis@google.com [sean: massage shortlog+changelog, relocate setting has_protected_eoi] Signed-off-by: Sean Christopherson commit bfbbb0d3215f0f6ef622cc8066e5f6afda6960a2 Author: Huang Shijie Date: Tue Sep 9 11:32:36 2025 +0800 arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED Now that 'rodata=full' has been removed in favour of parity with x86, CONFIG_RODATA_FULL_DEFAULT_ENABLED no longer serves a useful purpose. Remove it. Reviewed-by: Anshuman Khandual Signed-off-by: Huang Shijie Signed-off-by: Will Deacon commit c0f303d7d4723b01c686e949e6f26a93e5cda910 Author: Huang Shijie Date: Tue Sep 9 11:32:35 2025 +0800 arm64: mm: Rework the 'rodata=' options As per admin guide documentation, "rodata=on" should be the default on platforms. Documentation/admin-guide/kernel-parameters.txt describes these options as rodata= [KNL,EARLY] on Mark read-only kernel memory as read-only (default). off Leave read-only kernel memory writable for debugging. full Mark read-only kernel memory and aliases as read-only [arm64] But on arm64 platform, RODATA_FULL_DEFAULT_ENABLED is enabled by default, so "rodata=full" is the default instead. For parity with other architectures, namely x86, rework 'rodata=on' to match the current "full" behaviour and replace 'rodata=full' with a new 'rodata=noalias' option which retains writable aliases in the direct map for memory regions outside of the kernel image. Signed-off-by: Huang Shijie Reviewed-by: Anshuman Khandual Signed-off-by: Will Deacon commit 9e6eb49ec13936461c697348c74e5450ac82707d Author: Yang Li Date: Tue Sep 16 10:10:39 2025 +0800 drm/xe: Remove duplicate header files Fix some duplicate includes in xe: ./drivers/gpu/drm/xe/xe_tlb_inval.c: xe_tlb_inval.h is included more than once. ./drivers/gpu/drm/xe/xe_pt.c: xe_tlb_inval_job.h is included more than once. While at it, also sort the include lines alphabetically. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=24705 Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=24706 Signed-off-by: Yang Li [Reword commit message] Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250916021039.1632766-1-yang.lee@linux.alibaba.com Signed-off-by: Lucas De Marchi commit b868fff5b10b6d09506e93e489ee19166bf6c5d2 Author: Sam Edwards Date: Wed Sep 3 17:52:09 2025 -0700 arm64: mm: Represent physical memory with phys_addr_t and resource_size_t This is a type-correctness cleanup to MMU/boot code that replaces several instances of void * and u64 with phys_addr_t (to represent addresses) and resource_size_t (to represent sizes) to emphasize that the code in question concerns physical memory specifically. The rationale for this change is to improve clarity and readability in a few modules that handle both types (physical and virtual) of address and differentiation is essential. I have left u64 in cases where the address may be either physical or virtual, where the address is exclusively virtual but used in heavy pointer arithmetic, and in cases I may have overlooked. I do not necessarily consider u64 the ideal type in those situations, but it avoids breaking existing semantics in this cleanup. This patch provably has no effect at runtime: I have verified that .text of vmlinux is identical after this change. Signed-off-by: Sam Edwards Signed-off-by: Will Deacon commit c56aa9a67a0853ffcf64ebe7f1dbe5a5a7c315cc Author: Sam Edwards Date: Wed Sep 3 17:52:08 2025 -0700 arm64: mm: Make map_fdt() return mapped pointer Currently map_fdt() accepts a physical address and relies on the caller to keep using the same value after mapping, since the implementation happens to install an identity mapping. This obscures the fact that the usable pointer is defined by the mapping, not by the input value. Since the mapping determines pointer validity, it is more natural to produce the pointer at mapping time. Change map_fdt() to return a void * pointing to the mapped FDT. This clarifies the data flow, removes the implicit identity assumption, and prepares for making map_fdt() accept a phys_addr_t in a follow-up change. Signed-off-by: Sam Edwards Signed-off-by: Will Deacon commit 030b3ffbdac75005ef73af752a42cd48c7bba155 Author: Sam Edwards Date: Wed Sep 3 17:52:07 2025 -0700 arm64: mm: Cast start/end markers to char *, not u64 There are a few memset() calls in map_kernel.c that cast marker-symbol addresses to u64 in order to perform pointer subtraction (range size computation). Cast them with (char *) instead, aligning with idiomatic C pointer arithmetic. This patch provably has no effect at runtime: I have verified that .text of vmlinux is identical after this change. Signed-off-by: Sam Edwards Signed-off-by: Will Deacon commit 8b9b2af6de97e2d2cfcfb5d92178c198f01e1559 Author: Antonio Rische Date: Thu Sep 4 15:54:54 2025 +0200 arm64: dts: qcom: sdm845-enchilada: Add notification LED Add the notification LED for the device. The R/G/B channels are controlled by the PMI8998 LPG. Signed-off-by: Antonio Rische Signed-off-by: David Heidelberg Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250904-enchilada-led-v1-1-dcf936ea7795@ixit.cz Signed-off-by: Bjorn Andersson commit 24f8b8ef130b7249684948a2a82318476f7ab11c Author: Krzysztof Kozlowski Date: Thu Sep 4 10:44:23 2025 +0200 arm64: dts: qcom: apq8016-sbc: Drop redundant HDMI bridge status New device nodes are enabled by default, so status is redundant. No functional impact, verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250904084421.82985-4-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit e36b9782fafa4502bd2d3e2aaf4fbf425e9ca908 Author: Krzysztof Kozlowski Date: Thu Sep 4 10:44:22 2025 +0200 arm64: dts: qcom: apq8016-sbc: Correct HDMI bridge #sound-dai-cells HDMI bridge has only one sound DAI and bindings already expect that (dtbs_check): apq8016-sbc.dtb: bridge@39 (adi,adv7533): #sound-dai-cells: 0 was expected Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250904084421.82985-3-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 4cce8b2503ab50f75a2dbc3eef2e55722836588e Author: E Shattow Date: Fri Sep 5 07:39:43 2025 -0700 riscv: dts: starfive: add Milk-V Mars CM Lite system-on-module Milk-V Mars CM Lite is a System-on-Module based on the Milk-V Mars CM without the onboard eMMC storage component populated and configured instead for SD3.0 Card Slot on that interface via 100-pin connector. Link to Milk-V Mars CM Lite schematics: https://github.com/milkv-mars/mars-files/tree/main/Mars-CM_Hardware_Schematices Link to StarFive JH7110 Technical Reference Manual: https://doc-en.rvspace.org/JH7110/TRM/index.html Link to Raspberry Pi CM4IO datasheet: https://datasheets.raspberrypi.com/cm4io/cm4io-datasheet.pdf Add the devicetree file to make use of StarFive JH7110 common supported features PMIC, EEPROM, UART, I2C, GPIO, PCIe, QSPI Flash, PWM, and Ethernet. Also configure the eMMC interface mmc0 for SD Card use and configure the common SD Card interface mmc1 for onboard SDIO BT+WiFi. Signed-off-by: E Shattow Signed-off-by: Conor Dooley commit 12a29108384cfe073a4de778d5207d53b492f85e Author: E Shattow Date: Fri Sep 5 07:39:42 2025 -0700 dt-bindings: riscv: starfive: add milkv,marscm-lite Add "milkv,marscm-lite" as a StarFive JH7110 SoC-based system-on-module. Signed-off-by: E Shattow Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit 8d193bc0aa2e802be30de331317639482735d738 Author: E Shattow Date: Fri Sep 5 07:39:41 2025 -0700 riscv: dts: starfive: add Milk-V Mars CM system-on-module Milk-V Mars CM is a System-on-Module based on the StarFive VisionFive 2 board and Radxa CM3 System-on-Module compatible with the Raspberry Pi CM4IO Classic IO Board. Mars CM SoM features: - StarFive JH7110 System on Chip with RV64GC up to 1.5GHz - AXP15060 Power Management Unit - LPDDR4 2GB / 4GB / 8GB DRAM memory - BL24C04F 4K bits (512 x 8) EEPROM - GigaDevice 25LQ128EWIG QSPI NOR Flash 16M or SoC ROM UART loader for boot (selectable by GPIO) - eMMC5.0 8GB / 16GB / 32GB flash storage onboard - AP6256 via SDIO 2.0 onboard wireless connectivity WiFi 5 + Bluetooth 5.2 (optional, present in models with WiFi feature) - 1x Motorcomm YT8531C Gigabit Ethernet PHY - IMG BXE-4-32 Integrated GPU with 3D Acceleration: - H.264 & H.265 4K@60fps Decoding - H.265 1080p@30fps Encoding - JPEG encoder / decoder Additional features available via 2x 100-pin connectors for CM4IO Board: - 1x HDMI 2.0 - 1x MIPI DSI (4-lanes) - 1x 2CH Audio out (via GPIO) - 1x MIPI CSI (2x2-lanes or 1x4-lanes) - 1x USB 2.0 - 1x PCIe 1-lane Host, Gen 2 (5Gbps) - Up to 28x GPIO, supporting 3.3V - UART x6 - PWM x8 - I2C x7 - SPI - I2S Link to Milk-V Mars CM schematics: https://github.com/milkv-mars/mars-files/tree/main/Mars-CM_Hardware_Schematices Link to StarFive JH7110 Technical Reference Manual: https://doc-en.rvspace.org/JH7110/TRM/index.html Link to Raspberry Pi CM4IO datasheet: https://datasheets.raspberrypi.com/cm4io/cm4io-datasheet.pdf Add the devicetree file to make use of StarFive JH7110 common supported features PMIC, EEPROM, UART, I2C, GPIO, eMMC, PCIe, QSPI Flash, PWM, and Ethernet. Also configure the common SD Card interface mmc1 for onboard SDIO BT+WiFi. Signed-off-by: E Shattow Signed-off-by: Conor Dooley commit d1829e0b2f0619c39b0ce0b84fcbf67569108376 Author: E Shattow Date: Fri Sep 5 07:39:40 2025 -0700 dt-bindings: riscv: starfive: add milkv,marscm-emmc Add "milkv,marscm-emmc" as a StarFive JH7110 SoC-based system-on-module. Signed-off-by: E Shattow Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit 651b30c58775e334c79aa3ecd44a3d98ac201db2 Author: E Shattow Date: Fri Sep 5 07:39:39 2025 -0700 riscv: dts: starfive: add common board dtsi for Milk-V Mars CM variants Add a common board dtsi for use by Milk-V Mars CM and Milk-V Mars CM Lite. Signed-off-by: E Shattow Signed-off-by: Conor Dooley commit ea920b50ac9ff13ef0282428bd80395ea134a26c Author: Jeremy Linton Date: Sun Aug 24 22:34:16 2025 -0500 arm64: uaccess: Move existing GCS accessors definitions to gcs.h We are going to add some additional GCS access helpers to gcs.h in order to avoid some forward reference problems with uaccess. In preparation for that, lets move the existing gcssttr() and put_user_gcs() routines into gcs.h where it makes sense to keep all the accessors together. Further, the code which uses them already includes gcs.h and there is an existing CONFIG_ARM64_GCS check we can reuse. The GCSSTTR instruction description comment is corrected during the move. Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 47687aa4d9c91a9d9b1dbae40c242cd291030bd9 Author: Jeremy Linton Date: Sun Aug 24 22:34:15 2025 -0500 arm64: probes: Break ret out from bl/blr Prepare for GCS by breaking RET out into its own function, where it makes more sense to encapsulate the new behavior independent from the branch instructions. Signed-off-by: Jeremy Linton Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit b4f745f1d8adad62ba8c2065873c8a857ed4c3da Author: Ziyue Zhang Date: Thu Sep 4 14:52:25 2025 +0800 arm64: dts: qcom: lemans: Add PCIe lane equalization preset properties Add PCIe lane equalization preset properties with all values set to 5 for 8.0 GT/s and 16.0 GT/s data rates to enhance link stability. Co-developed-by: Qiang Yu Signed-off-by: Qiang Yu Signed-off-by: Ziyue Zhang Reviewed-by: Konrad Dybcio Acked-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250904065225.1762793-4-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3b09b11805bfee32d5a0000f5ede42c07237a6c4 Author: John Harrison Date: Tue Sep 9 15:41:31 2025 -0700 drm/xe/guc: Return an error code if the GuC load fails Due to multiple explosion issues in the early days of the Xe driver, the GuC load was hacked to never return a failure. That prevented kernel panics and such initially, but now all it achieves is creating more confusing errors when the driver tries to submit commands to a GuC it already knows is not there. So fix that up. As a stop-gap and to help with debug of load failures due to invalid GuC init params, a wedge call had been added to the inner GuC load function. The reason being that it leaves the GuC log accessible via debugfs. However, for an end user, simply aborting the module load is much cleaner than wedging and trying to continue. The wedge blocks user submissions but it seems that various bits of the driver itself still try to submit to a dead GuC and lots of subsequent errors occur. And with regards to developers debugging why their particular code change is being rejected by the GuC, it is trivial to either add the wedge back in and hack the return code to zero again or to just do a GuC log dump to dmesg. v2: Add support for error injection testing and drop the now redundant wedge call. CC: Rodrigo Vivi Signed-off-by: John Harrison Reviewed-by: Matt Atwood Link: https://lore.kernel.org/r/20250909224132.536320-1-John.C.Harrison@Intel.com commit 220928e52cb03d223b3acad3888baf0687486d21 Author: Mark Brown Date: Mon Aug 18 20:21:18 2025 +0100 arm64/hwcap: Add hwcap for FEAT_LSFE FEAT_LSFE (Large System Float Extension), providing atomic floating point memory operations, is optional from v9.5. This feature adds no new architectural stare and we have no immediate use for it in the kernel so simply provide a hwcap for it to support discovery by userspace. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit 31bf77dcc3810e08bcc7d15470e92cdfffb7f7f1 Author: Pavel Begunkov Date: Tue Sep 16 15:28:03 2025 +0100 io_uring/zcrx: account niov arrays to cgroup net_iov / freelist / etc. arrays can be quite long, make sure they're accounted. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 705d2ac7b2044f1ca05ba6033183151a04dbff4d Author: Pavel Begunkov Date: Tue Sep 16 15:28:02 2025 +0100 io_uring/zcrx: allow synchronous buffer return Returning buffers via a ring is performant and convenient, but it becomes a problem when/if the user misconfigured the ring size and it becomes full. Add a synchronous way to return buffers back to the page pool via a new register opcode. It's supposed to be a reliable slow path for refilling. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8fd08d8dda3c6c4e9f0b73acdcf8a1cf391b0c8f Author: Pavel Begunkov Date: Tue Sep 16 15:28:01 2025 +0100 io_uring/zcrx: introduce io_parse_rqe() Add a helper for verifying a rqe and extracting a niov out of it. It'll be reused in following patches. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5a8b6e7c1d7b5863faaf392eafa089bd599a8973 Author: Pavel Begunkov Date: Tue Sep 16 15:28:00 2025 +0100 io_uring/zcrx: don't adjust free cache space The cache should be empty when io_pp_zc_alloc_netmems() is called, that's promised by page pool and further checked, so there is no need to recalculate the available space in io_zcrx_ring_refill(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit c95257f336556de05f26dc88a890fb2a59364939 Author: Pavel Begunkov Date: Tue Sep 16 15:27:59 2025 +0100 io_uring/zcrx: use guards for the refill lock Use guards for rq_lock in io_zcrx_ring_refill(), makes it a tad simpler. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 73fa880effc5644aaf746596acb1b1efa44606df Author: Pavel Begunkov Date: Tue Sep 16 15:27:58 2025 +0100 io_uring/zcrx: reduce netmem scope in refill Reduce the scope of a local var netmem in io_zcrx_ring_refill. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 20dda449c0b6297ed7c13a23a1207ed072655bff Author: Pavel Begunkov Date: Tue Sep 16 15:27:57 2025 +0100 io_uring/zcrx: protect netdev with pp_lock Remove ifq->lock and reuse pp_lock to protect the netdev pointer. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 4f602f3112c8271e32bea358dd2a8005d32a5bd5 Author: Pavel Begunkov Date: Tue Sep 16 15:27:56 2025 +0100 io_uring/zcrx: rename dma lock In preparation for reusing the lock for other purposes, rename it to "pp_lock". As before, it can be taken deeper inside the networking stack by page pool, and so the syscall io_uring must avoid holding it while doing queue reconfiguration or anything that can result in immediate pp init/destruction. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d8d135dfe3e8e306d9edfcccf28dbe75c6a85567 Author: Pavel Begunkov Date: Tue Sep 16 15:27:55 2025 +0100 io_uring/zcrx: make niov size variable Instead of using PAGE_SIZE for the niov size add a niov_shift field to ifq, and patch up all important places. Copy fallback still assumes PAGE_SIZE, so it'll be wasting some memory for now. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5d93f7bade0b1eb60d0f395ad72b35581d28a896 Author: Pavel Begunkov Date: Tue Sep 16 15:27:54 2025 +0100 io_uring/zcrx: set sgt for umem area Set struct io_zcrx_mem::sgt for umem areas as well to simplify looking up the current sg table. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6c185117291a85937fa67d402efc4f11b2891c6a Author: Pavel Begunkov Date: Tue Sep 16 15:27:53 2025 +0100 io_uring/zcrx: remove dmabuf_offset It was removed from uapi, so now it's always 0 and can be removed together with offset handling in io_populate_area_dma(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 439a98b972fbb1991819b5367f482cd4161ba39c Author: Pavel Begunkov Date: Tue Sep 16 15:27:52 2025 +0100 io_uring/zcrx: deduplicate area mapping With a common type for storing dma addresses and io_populate_area_dma(), type-specific area mapping helpers are trivial, so open code them and deduplicate the call to io_populate_area_dma(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 02bb047b5f42ed30ca97010069cb36cd3afb74e1 Author: Pavel Begunkov Date: Tue Sep 16 15:27:51 2025 +0100 io_uring/zcrx: pass ifq to io_zcrx_alloc_fallback() io_zcrx_copy_chunk() doesn't and shouldn't care from which area the buffer is allocated, don't try to resolve the area in it but pass the ifq to io_zcrx_alloc_fallback() and let it handle it. Also rename it for more clarity. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d7ae46b454eb05e3df0d46c2ac9c61416a4d9057 Author: Pavel Begunkov Date: Tue Sep 16 15:27:50 2025 +0100 io_uring/zcrx: check all niovs filled with dma addresses Add a warning if io_populate_area_dma() can't fill in all net_iovs, it should never happen. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 01464ea405e13789bf4f14c7d4e9fa97f0885d46 Author: Pavel Begunkov Date: Tue Sep 16 15:27:49 2025 +0100 io_uring/zcrx: move area reg checks into io_import_area io_import_area() is responsible for importing memory and parsing io_uring_zcrx_area_reg, so move all area reg structure checks into the function. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d425f13146af0ef10b8f1dc7cc9fd700ce7c759e Author: Pavel Begunkov Date: Tue Sep 16 15:27:48 2025 +0100 io_uring/zcrx: don't pass slot to io_zcrx_create_area Don't pass a pointer to a pointer where an area should be stored to io_zcrx_create_area(), and let it handle finding the right place for a new area. It's more straightforward and will be needed to support multiple areas. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit c49606fc4be78da6c7a7c623566f6cf7663ba740 Author: Pavel Begunkov Date: Tue Sep 16 15:27:47 2025 +0100 io_uring/zcrx: remove extra io_zcrx_drop_netdev io_close_queue() already detaches the netdev, don't unnecessary call io_zcrx_drop_netdev() right after. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d5e31db9a950f1edfa20a59e7105e9cc78135493 Author: Pavel Begunkov Date: Tue Sep 16 15:27:46 2025 +0100 io_uring/zcrx: use page_pool_unref_and_test() page_pool_unref_and_test() tries to better follow usuall refcount semantics, use it instead of page_pool_unref_netmem(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit bdc0d478a1632a72afa6d359d7fdd49dd08c0b25 Author: Pavel Begunkov Date: Tue Sep 16 15:27:45 2025 +0100 io_uring/zcrx: replace memchar_inv with is_zero memchr_inv() is more ambiguous than mem_is_zero(), so use the latter for zero checks. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 9eb3c571787d1ef7e2c3393c153b1a6b103a26e3 Author: Pavel Begunkov Date: Tue Sep 16 15:27:44 2025 +0100 io_uring/zcrx: improve rqe cache alignment Refill queue entries are 16B structures, but because of the ring header placement, they're 8B aligned but not naturally / 16B aligned, which means some of them span across 2 cache lines. Push rqes to a new cache line. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 58ab6d25a1bfca42510979cb2b6921f1c807bd02 Author: pengdonglin Date: Tue Sep 16 12:47:30 2025 +0800 cgroup/cpuset: Remove redundant rcu_read_lock/unlock() in spin_lock Since commit a8bb74acd8efe ("rcu: Consolidate RCU-sched update-side function definitions") there is no difference between rcu_read_lock(), rcu_read_lock_bh() and rcu_read_lock_sched() in terms of RCU read section and the relevant grace period. That means that spin_lock(), which implies rcu_read_lock_sched(), also implies rcu_read_lock(). There is no need no explicitly start a RCU read section if one has already been started implicitly by spin_lock(). Simplify the code and remove the inner rcu_read_lock() invocation. Cc: Waiman Long Cc: Johannes Weiner Acked-by: Waiman Long Signed-off-by: pengdonglin Signed-off-by: pengdonglin Signed-off-by: Tejun Heo commit 3ee4211ef8693377f67624a46b4f8577f6a495d9 Author: pengdonglin Date: Tue Sep 16 12:47:29 2025 +0800 cgroup: Remove redundant rcu_read_lock/unlock() in spin_lock Since commit a8bb74acd8efe ("rcu: Consolidate RCU-sched update-side function definitions") there is no difference between rcu_read_lock(), rcu_read_lock_bh() and rcu_read_lock_sched() in terms of RCU read section and the relevant grace period. That means that spin_lock(), which implies rcu_read_lock_sched(), also implies rcu_read_lock(). There is no need no explicitly start a RCU read section if one has already been started implicitly by spin_lock(). Simplify the code and remove the inner rcu_read_lock() invocation. Cc: Tejun Heo Cc: Johannes Weiner Cc: Waiman Long Signed-off-by: pengdonglin Signed-off-by: pengdonglin Signed-off-by: Tejun Heo commit da7b97ba0d219a14a83e9cc93f98b53939f12944 Author: John Garry Date: Mon Sep 15 10:35:00 2025 +0000 block: relax atomic write boundary vs chunk size check blk_validate_atomic_write_limits() ensures that any boundary fits into and is aligned to any chunk size. However, it should also be possible to fit the chunk size into any boundary. That check is already made in blk_stack_atomic_writes_boundary_head(). Relax the check in blk_validate_atomic_write_limits() by reusing (and renaming) blk_stack_atomic_writes_boundary_head(). Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit f2d8c5a2f79c28569edf4948b611052253b5e99a Author: John Garry Date: Mon Sep 15 10:34:59 2025 +0000 block: fix stacking of atomic writes when atomics are not supported Atomic writes support may not always be possible when stacking devices which support atomic writes. Such as case is a different atomic write boundary between stacked devices (which is not supported). In the case that atomic writes cannot supported, the top device queue HW limits are set to 0. However, in blk_stack_atomic_writes_limits(), we detect that we are stacking the first bottom device by checking the top device atomic_write_hw_max value == 0. This get confused with the case of atomic writes not supported, above. Make the distinction between stacking the first bottom device and no atomics supported by initializing stacked device atomic_write_hw_max = UINT_MAX and checking that for stacking the first bottom device. Fixes: d7f36dc446e8 ("block: Support atomic writes limits for stacked devices") Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit bfd4037296bd7e1f95394a2e3daf8e3c1796c3b3 Author: John Garry Date: Mon Sep 15 10:34:58 2025 +0000 block: update validation of atomic writes boundary for stacked devices In commit 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked atomic write limits"), it was missed to use a chunk sectors limit check in blk_stack_atomic_writes_boundary_head(), so update that function to do the proper check. Fixes: 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked atomic write limits") Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit eeaed48980a7aeb0d3d8b438185d4b5a66154ff9 Author: Georg Gottleuber Date: Tue Jul 1 22:55:49 2025 +0200 nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk On the TUXEDO InfinityBook S Gen8, a Samsung 990 Evo NVMe leads to a high power consumption in s2idle sleep (3.5 watts). This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with a lower power consumption, typically around 1 watts. Signed-off-by: Georg Gottleuber Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Signed-off-by: Keith Busch commit 0f83b1d436c98083dcbf7f3e6204015ed4a46743 Author: Rafael J. Wysocki Date: Mon Sep 15 20:29:50 2025 +0200 ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() Make acpi_nondev_subnode_extract() follow the usual code flow pattern in which failure is handled at the point where it is detected. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus commit baf60d5cb8bc6b85511c5df5f0ad7620bb66d23c Author: Rafael J. Wysocki Date: Mon Sep 15 20:28:52 2025 +0200 ACPI: property: Do not pass NULL handles to acpi_attach_data() In certain circumstances, the ACPI handle of a data-only node may be NULL, in which case it does not make sense to attempt to attach that node to an ACPI namespace object, so update the code to avoid attempts to do so. This prevents confusing and unuseful error messages from being printed. Also document the fact that the ACPI handle of a data-only node may be NULL and when that happens in a code comment. In addition, make acpi_add_nondev_subnodes() print a diagnostic message for each data-only node with an unknown ACPI namespace scope. Fixes: 1d52f10917a7 ("ACPI: property: Tie data nodes to acpi handles") Cc: 6.0+ # 6.0+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus commit 737c3a09dcf69ba2814f3674947ccaec1861c985 Author: Rafael J. Wysocki Date: Mon Sep 15 20:25:13 2025 +0200 ACPI: property: Add code comments explaining what is going on In some places in the ACPI device properties handling code, it is unclear why the code is what it is. Some assumptions are not documented and some pieces of code are based on knowledge that is not mentioned anywhere. Add code comments explaining these things. Signed-off-by: Rafael J. Wysocki Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus commit d06118fe9b03426484980ed4c189a8c7b99fa631 Author: Rafael J. Wysocki Date: Mon Sep 15 20:23:28 2025 +0200 ACPI: property: Disregard references in data-only subnode lists Data-only subnode links following the ACPI data subnode GUID in a _DSD package are expected to point to named objects returning _DSD-equivalent packages. If a reference to such an object is used in the target field of any of those links, that object will be evaluated in place (as a named object) and its return data will be embedded in the outer _DSD package. For this reason, it is not expected to see a subnode link with the target field containing a local reference (that would mean pointing to a device or another object that cannot be evaluated in place and therefore cannot return a _DSD-equivalent package). Accordingly, simplify the code parsing data-only subnode links to simply print a message when it encounters a local reference in the target field of one of those links. Moreover, since acpi_nondev_subnode_data_ok() would only have one caller after the change above, fold it into that caller. Link: https://lore.kernel.org/linux-acpi/CAJZ5v0jVeSrDO6hrZhKgRZrH=FpGD4vNUjFD8hV9WwN9TLHjzQ@mail.gmail.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus commit d0759b10989c5c5aae3d455458c9fc4e8cc694f7 Author: Rafael J. Wysocki Date: Mon Sep 15 20:21:33 2025 +0200 ACPI: property: Fix buffer properties extraction for subnodes The ACPI handle passed to acpi_extract_properties() as the first argument represents the ACPI namespace scope in which to look for objects returning buffers associated with buffer properties. For _DSD objects located immediately under ACPI devices, this handle is the same as the handle of the device object holding the _DSD, but for data-only subnodes it is not so. First of all, data-only subnodes are represented by objects that cannot hold other objects in their scopes (like control methods). Therefore a data-only subnode handle cannot be used for completing relative pathname segments, so the current code in in acpi_nondev_subnode_extract() passing a data-only subnode handle to acpi_extract_properties() is invalid. Moreover, a data-only subnode of device A may be represented by an object located in the scope of device B (which kind of makes sense, for instance, if A is a B's child). In that case, the scope in question would be the one of device B. In other words, the scope mentioned above is the same as the scope used for subnode object lookup in acpi_nondev_subnode_extract(). Accordingly, rearrange that function to use the same scope for the extraction of properties and subnode object lookup. Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID") Cc: 6.0+ # 6.0+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus commit b4f7a727c29cd1fa6149a81f16408ee7c1f7de0c Author: Svyatoslav Ryhel Date: Tue Sep 9 17:34:32 2025 +0300 dt-bindings: power: supply: bq27xxx: document optional interrupt Document an optional interrupt found in some controllers of BQ27xxx series. The pin to which the interrupt is connected is called SOC_INT or GPOUT. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Sebastian Reichel commit 520f9fec5d6f5a23e7985140dc4dd9986f0ed140 Author: Vladimir Zapolskiy Date: Wed Sep 10 02:55:47 2025 +0300 arm64: dts: qcom: sm8450: enable camera clock controller by default Enable camera clock controller on Qualcomm SM8450 boards by default due to a reasonable agreement of having all clock controllers enabled. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250909235547.787396-1-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit e645096d1f6dadcead09c722a3fbc6c44a45fece Author: Loic Poulain Date: Thu Sep 11 23:21:02 2025 +0200 arm64: dts: qcom: qcm2290: Add CCI node Add Camera Control Interface (CCI), supporting two I2C masters. Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250911212102.470886-2-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b68fc45910d4eb1b3bb7e160282fba5a4bdd8409 Author: Wenmeng Liu Date: Fri Sep 12 23:19:27 2025 +0800 arm64: dts: qcom: lemans-evk: Add IMX577-based camera overlay Enable IMX577 via CCI1 on LeMans EVK Core Kit. The LeMans EVK board does not include a camera sensor by default, this overlay reflects the possibility of attaching an optional camera sensor. For this reason, the camera sensor configuration is placed in lemans-evk-camera.dtso, rather than modifying the base lemans-evk.dts. Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Wenmeng Liu Link: https://lore.kernel.org/r/20250912-camss_rb8-v6-3-c9a6c3d67392@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3964a91e552880c356ec4d3f09eed927f48e9c66 Author: Wenmeng Liu Date: Fri Sep 12 23:19:26 2025 +0800 arm64: dts: qcom: lemans: Add CCI definitions Qualcomm SA8775P SoC contains 4 Camera Control Interface controllers. Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Wenmeng Liu Link: https://lore.kernel.org/r/20250912-camss_rb8-v6-2-c9a6c3d67392@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c5dca38633daa1e240144bac453cf9065604a413 Author: Fabio M. De Francesco Date: Mon Sep 15 16:57:20 2025 +0200 cxl: Documentation/driver-api/cxl: Describe the x86 Low Memory Hole solution Add documentation on how to resolve conflicts between CXL Fixed Memory Windows, Platform Low Memory Holes, intermediate Switch and Endpoint Decoders. [dj]: Fixed inconsistent spacing after '.' [dj]: Fixed subject line from Alison. [dj]: Removed '::' before table from Bagas. Reviewed-by: Gregory Price Signed-off-by: Fabio M. De Francesco Reviewed-by: Bagas Sanjaya Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Signed-off-by: Dave Jiang commit 43b4f7cd064b2ae11742f33e2af195adae00c617 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:13 2025 +0300 PCI: Alter misleading recursion to pci_bus_release_bridge_resources() Recursing into pci_bus_release_bridge_resources() should not alter rel_type because it makes no sense to change the release type within the recursion call chain. A literal "whole_subtree" is passed into the recursion instead of "rel_type" parameter which is misleading as the release type should remain the same throughout the entire operation. This is not a correctness issue because of the preceding if () that only allows the recursion to happen if rel_type is "whole_subtree". Still, replace the non-intuitive parameter with direct passing of "rel_type". Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-25-ilpo.jarvinen@linux.intel.com commit 159fbfd0412b0351a512d716757b6eac4639da84 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:12 2025 +0300 PCI: Pass bridge window to pci_bus_release_bridge_resources() pci_bus_release_bridge_resources() takes type, which is converted into a bridge window resource in pci_bridge_release_resources(). Find out the correct bridge window for resource whose assignment failed. Pass that bridge window to pci_bus_release_bridge_resources() instead of passing the type. When recursing to subordinate, check which bridge windows have to be released and recurse for each. For now, use pbus_select_window_for_type() instead of pbus_select_window() because non-bridge window resources still have their flags reset which destroys the type information from the struct resource. The struct pci_dev_resource holds a copy of the flags which are used instead. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-24-ilpo.jarvinen@linux.intel.com commit ebbebd8873c4bab4f3553b22f43388de6349f1ee Author: Ilpo Järvinen Date: Fri Aug 29 16:11:11 2025 +0300 PCI: Add pci_setup_one_bridge_window() pci_bridge_release_resources() contains a resource type hack to work around the unsuitable __pci_setup_bridge() interface. Extract the switch statement that picks the correct bridge window setup function from pci_claim_bridge_resource() into pci_setup_one_bridge_window() and use it also in pci_bridge_release_resources(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-23-ilpo.jarvinen@linux.intel.com commit aaae2863e7319b0201029868433e8356b923063c Author: Ilpo Järvinen Date: Fri Aug 29 16:11:10 2025 +0300 PCI: Refactor remove_dev_resources() to use pbus_select_window() Convert remove_dev_resources() to use pbus_select_window(). As 'available' is not the real resources, the index has to be adjusted as only bridge resource counterparts are present in the 'available' array. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-22-ilpo.jarvinen@linux.intel.com commit 4292a1e45fd464551efac7b2b52fd3606e956c28 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:09 2025 +0300 PCI: Refactor distributing available memory to use loops pci_bus_distribute_available_resources() and pci_bridge_distribute_available_resources() retain bridge window resources and related data needed for distributing the available window in independent variables for io, memory, and prefetchable memory windows. The code is essentially the same for all of them and therefore repeated three times with different variable names. Refactor pci_bus_distribute_available_resources() to take an array. This is complicated slightly by the function taking advantage of passing the struct as value, which cannot be done for arrays in C. Therefore, copy the data into a local array in the stack in the first loop. Variable names are (hopefully) improved slightly as well. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-21-ilpo.jarvinen@linux.intel.com commit ae88d0b9c57f70086dca4f8ccb14c64b2f144c58 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:08 2025 +0300 PCI: Use pbus_select_window_for_type() during mem window sizing __pci_bus_size_bridges() goes to great lengths of helping pbus_size_mem() in which types it should put into a particular bridge window, requiring passing up to three resource type into pbus_size_mem(). Instead of having complex logic in __pci_bus_size_bridges() and a non-straightforward interface between those functions, use pbus_select_window_for_type() and pbus_select_window() to find the correct bridge window and compare if the resources belong to that window. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-20-ilpo.jarvinen@linux.intel.com commit 13016e15d595125ec2da83e1715083efe7499f91 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:07 2025 +0300 PCI: Use pbus_select_window() in space available checker pbus_upstream_space_available() figures out the upstream bridge window resources on its own. Migrate it to use pbus_select_window(). Note: pbus_select_window() -> pbus_select_window_for_type() calls find_bus_resource_of_type() for root bus, which does not do parent check similar to what pbus_upstream_space_available() did earlier, but the difference does not matter because pbus_upstream_space_available() itself stops when it encounters the root bus. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-19-ilpo.jarvinen@linux.intel.com commit da07881005e57b3c19dccce2ad2f488ba96e8a6a Author: Ilpo Järvinen Date: Fri Aug 29 16:11:06 2025 +0300 PCI: Rename resource variable from r to res Resource is going to be passed in as argument aften an upcoming change. Rename the struct resource variable from "r" to "res" to avoid using one letter variable name in a function argument. This rename is made separately to reduce churn in the upcoming change. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-18-ilpo.jarvinen@linux.intel.com commit ebe091ad81e1d3e5cbb1592ebc18175b5ca3d2bd Author: Ilpo Järvinen Date: Fri Aug 29 16:11:05 2025 +0300 PCI: Use pbus_select_window_for_type() during IO window sizing Convert pbus_size_io() to use pbus_select_window_for_type(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-17-ilpo.jarvinen@linux.intel.com commit 7dc58aa7f1b32a215fb0b7c6ca30ddf4663dedf4 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:04 2025 +0300 PCI: Use pbus_select_window() during BAR resize Prior to a BAR resize, __resource_resize_store() loops through the normal resources of the PCI device and releases those that match to the flags of the BAR to be resized. This is necessary to allow resizing also the upstream bridge window as only childless bridge windows can be resized. While the flags check (mostly) works (if corner cases are ignored), the more straightforward way is to check if the resources share the bridge window. Change __resource_resize_store() to do the check using pbus_select_window(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-16-ilpo.jarvinen@linux.intel.com commit 85796d20a6907e8ede81380a8fa73745d486f0af Author: Ilpo Järvinen Date: Fri Aug 29 16:11:03 2025 +0300 PCI: Warn if bridge window cannot be released when resizing BAR BAR resizing calls to pci_reassign_bridge_resources(), which attempts to release any upstream bridge window to allow them to accommodate the new BAR size. The release can only be performed if there are no other child resources for the bridge window. Previously the code continued silently when other child resources were detected. Add pci_warn() to inform user that a bridge window could not be released because of child resources. As a small bridge window is often the reason why BAR resize fails, this warning will help to pinpoint to the cause. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-15-ilpo.jarvinen@linux.intel.com commit 3ab10f83e277ba9640742cbba67b8df369591450 Author: Ilpo Järvinen Date: Fri Aug 29 16:11:02 2025 +0300 PCI: Fix finding bridge window in pci_reassign_bridge_resources() pci_reassign_bridge_resources() walks upwards in the PCI bus hierarchy, locates the relevant bridge window on each level using flags check, and attempts to release the bridge window. The flags-based check is fragile due to various fallbacks in the bridge window selection logic. As such, the algorithm might not locate the correct bridge window. Refactor pci_reassign_bridge_resources() to determine the correct bridge window using pbus_select_window(), which contains logic to handle all fallback cases correctly. Change function prefix to pbus as it now inputs struct bus and resource for which to locate the bridge window. The main purpose is to make bridge window selection logic consistent across the entire PCI core (one step at a time). While this technically also fixes the commit 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs") making the bridge window walk algorithm more robust, the normal setup having a 64-bit resizable BAR underneath bridge(s) with 64-bit prefetchable windows does not need to use any fallbacks. As such, the practical impact is low (requiring BAR resize use case and a non-typical bridge device). The way to detect if unrelated resource failed again is left to use the type based approximation which should not behave worse than before. Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs") Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-14-ilpo.jarvinen@linux.intel.com commit 74afce3dfcba117064c0eb7eb4d075836aa1370f Author: Ilpo Järvinen Date: Fri Aug 29 16:11:01 2025 +0300 PCI: Add bridge window selection functions Various places in the PCI core code independently decide into which bridge window a child resource should be placed. It is hard to see whether these decisions always end up in agreement, especially in the corner cases, and in some places it requires complex logic to pass multiple resource types and/or bridge windows around. Add pbus_select_window() and pbus_select_window_for_type() for cases where the former cannot be used so that eventually the same helper can be used to select the bridge window everywhere. Using the same function ensures the selected bridge window remains always the same and it can be easily recalculated in-situ allowing simplifying the interfaces between internal functions in upcoming changes. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-13-ilpo.jarvinen@linux.intel.com commit e4934832c588f72bcc139d3ca0acc490c63a821c Author: Ilpo Järvinen Date: Fri Aug 29 16:11:00 2025 +0300 PCI: Add defines for bridge window indexing include/linux/pci.h provides PCI_BRIDGE_{IO,MEM,PREF_MEM}_WINDOW defines, however, they're based on the resource array indexing in the pci_dev struct. The struct pci_bus also has pointers to those same resources but they start from zeroth index. Add PCI_BUS_BRIDGE_{IO,MEM,PREF_MEM}_WINDOW defines to get rid of literal indexing. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-12-ilpo.jarvinen@linux.intel.com commit 8278c6914306f35f32d73bdf2a918950919a0051 Author: Ilpo Järvinen Date: Fri Aug 29 16:10:59 2025 +0300 PCI: Preserve bridge window resource type flags When a bridge window is found unused or fails to assign, the flags of the associated resource are cleared. Clearing flags is problematic as it also removes the type information of the resource which is needed later. Thus, always preserve the bridge window type flags and use IORESOURCE_UNSET and IORESOURCE_DISABLED to indicate the status of the bridge window. Also, when initializing resources, make sure all valid bridge windows do get their type flags set. Change various places that relied on resource flags being cleared to check for IORESOURCE_UNSET and IORESOURCE_DISABLED to allow bridge window resource to retain their type flags. Add pdev_resource_assignable() and pdev_resource_should_fit() helpers to filter out disabled bridge windows during resource fitting; the latter combines more common checks into the helper. When reading the bridge windows from the registers, instead of leaving the resource flags cleared for bridge windows that are not enabled, always set up the flags and set IORESOURCE_UNSET | IORESOURCE_DISABLED as needed. When resource fitting or assignment fails for a bridge window resource, or the bridge window is not needed, mark the resource with IORESOURCE_UNSET or IORESOURCE_DISABLED, respectively. Use dummy zero resource in resource_show() for backwards compatibility as lspci will otherwise misrepresent disabled bridge windows. This change fixes an issue which highlights the importance of keeping the resource type flags intact: At the end of __assign_resources_sorted(), reset_resource() is called, previously clearing the flags. Later, pci_prepare_next_assign_round() attempted to release bridge resources using pci_bus_release_bridge_resources() that calls into pci_bridge_release_resources() that assumes type flags are still present. As type flags were cleared, IORESOURCE_MEM_64 was not set leading to resources under an incorrect bridge window to be released (idx = 1 instead of idx = 2). While the assignments performed later covered this problem so that the wrongly released resources got assigned in the end, it was still causing extra release+assign pairs. There are other reasons why the resource flags should be retained in upcoming changes too. Removing the flag reset for non-bridge window resource is left as future work, in part because it has a much higher regression potential due to pci_enable_resources() that will start to work also for those resources then and due to what endpoint drivers might assume about resources. Despite the Fixes tag, backporting this (at least any time soon) is highly discouraged. The issue fixed is borderline cosmetic as the later assignments normally cover the problem entirely. Also there might be non-obvious dependencies. Fixes: 5b28541552ef ("PCI: Restrict 64-bit prefetchable bridge windows to 64-bit resources") Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-11-ilpo.jarvinen@linux.intel.com commit 1cdffa51ecc4ee02c46160bafa2e5d25d09e97ec Author: Ilpo Järvinen Date: Fri Aug 29 16:10:58 2025 +0300 PCI: Enable bridge even if bridge window fails to assign A normal PCI bridge has multiple bridge windows and not all of them are always required by devices underneath the bridge. If a Root Port or bridge does not have a device underneath, no bridge windows get assigned. Yet, pci_enable_resources() is set to fail indiscriminantly on any resource assignment failure if the resource is not known to be optional. In practice, the code in pci_enable_resources() is currently largely dormant. The kernel sets resource flags to zero for any unused bridge window and resets flags to zero in case of an resource assignment failure, which short-circuits pci_enable_resources() because of this check: if (!(r->flags & (IORESOURCE_IO | IORESOURCE_MEM))) continue; However, an upcoming change to resource flags will alter how bridge window resource flags behave activating these long dormants checks in pci_enable_resources(). While complex logic could be built to selectively enable a bridge only under some conditions, a few versions of such logic were tried during development of this change and none of them worked satisfactorily. Thus, I just gave up and decided to enable any bridge regardless of the bridge windows as there seems to be no clear benefit from not enabling it, but a major downside as pcieport will not be probed for the bridge if it's not enabled. Therefore, change pci_enable_resources() to not check if bridge window resources remain unassigned. Resource assignment failures are pretty noisy already so there is no need to log that for bridge windows in pci_enable_resources(). Ignoring bridge window failures hopefully prevents an obvious source of regressions when the upcoming change that no longer clears resource flags for bridge windows is enacted. I've hit this problem even during my own testing on multiple occasions so I expect it to be a quite common problem. This can always be revisited later if somebody thinks the enable check for bridges is not strict enough, but expect a mind-boggling number of regressions from such a change. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-10-ilpo.jarvinen@linux.intel.com commit 3baeae36039afc233d4a42d6ff4aa7019892619f Author: Ilpo Järvinen Date: Fri Aug 29 16:10:57 2025 +0300 PCI: Use pci_release_resource() instead of release_resource() A few places in setup-bus.c call release_resource() directly and end up duplicating functionality from pci_release_resource() such as parent check, logging, and clearing the resource. Worse yet, the way the resource is cleared is inconsistent between different sites. Convert release_resource() calls into pci_release_resource() to remove code duplication. This will also make the resource start, end, and flags behavior consistent, i.e., start address is cleared, and only IORESOURCE_UNSET is asserted for the resource. While at it, eliminate the unnecessary initialization of idx variable in pci_bridge_release_resources(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-9-ilpo.jarvinen@linux.intel.com commit b15f45ab65e2ce04339fbd54387a9209529d315b Author: Ilpo Järvinen Date: Fri Aug 29 16:10:56 2025 +0300 PCI: Disable non-claimed bridge window If clipping or claiming the bridge window fails, the bridge window is left in a state that does not match the kernel's view on what the bridge window is. Disable the bridge window by writing the magic disable value into the Base and Limit Registers if clipping or claiming failed. To detect if claiming the resource was successful, add res->parent checks into the bridge setup functions. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-8-ilpo.jarvinen@linux.intel.com commit 2ee33aa14d3f2e92ba8ae80443f2cd9b575f08cb Author: Ilpo Järvinen Date: Fri Aug 29 16:10:55 2025 +0300 PCI: Always claim bridge window before its setup When the claim of a resource fails for the full range in pci_claim_bridge_resource(), clipping the resource to a smaller size is attempted. If clipping is successful, the new bridge window is programmed and only as the last step the code attempts to claim the resource again. The order of the last two steps is slightly illogical and inconsistent with the assignment call chains. If claiming the bridge window after clipping fails, the bridge window that was set up is left in place. Rework the logic such that the bridge window is claimed before calling the relevant bridge setup function. This make the behavior consistent with resource fitting call chains that always assign the bridge window before programming it. If claiming the bridge window fails, the clipped bridge window is no longer set up but pci_claim_bridge_resource() returns without writing the bridge window at all. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-7-ilpo.jarvinen@linux.intel.com commit 1ce76bc0497b9289d6f6195258d8bdc1c42eb91a Author: Ilpo Järvinen Date: Fri Aug 29 16:10:54 2025 +0300 PCI: Refactor find_bus_resource_of_type() logic checks Reorder the logic checks in find_bus_resource_of_type() to simplify them. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-6-ilpo.jarvinen@linux.intel.com commit e240edffd04fe179536f7b5c22daae1e3b509b46 Author: Ilpo Järvinen Date: Fri Aug 29 16:10:53 2025 +0300 PCI: Move find_bus_resource_of_type() earlier Move find_bus_resource_of_type() earlier in setup-bus.c to be able to call it in upcoming changes. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-5-ilpo.jarvinen@linux.intel.com commit ae81aad5c2e17fd1fafd930e75b81aedc837f705 Author: Ilpo Järvinen Date: Fri Aug 29 16:10:52 2025 +0300 MIPS: PCI: Use pci_enable_resources() pci-legacy.c under MIPS has a copy of pci_enable_resources() named as pcibios_enable_resources(). Having own copy of same functionality could lead to inconsistencies in behavior, especially now as pci_enable_resources() and the bridge window resource flags behavior are going to be altered by upcoming changes. The check for !r->start && r->end is already covered by the more generic checks done in pci_enable_resources(). Call pci_enable_resources() from MIPS's pcibios_enable_device() and remove pcibios_enable_resources(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Acked-by: Thomas Bogendoerfer Link: https://patch.msgid.link/20250829131113.36754-4-ilpo.jarvinen@linux.intel.com commit 754babaaf33349d9ef27bb1ac6f5d9d5a503a2a6 Author: Ilpo Järvinen Date: Fri Aug 29 16:10:51 2025 +0300 sparc/PCI: Remove pcibios_enable_device() as they do nothing extra Under arch/sparc/ there are multiple copies of pcibios_enable_device() but none of those seem to do anything extra beyond what pci_enable_resources() is supposed to do. These functions could lead to inconsistencies in behavior, especially now as pci_enable_resources() and the bridge window resource flags behavior are going to be altered by upcoming changes. Remove all pcibios_enable_device() from arch/sparc/ so that PCI core can simply call into pci_enable_resources() instead using its __weak version of pcibios_enable_device(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-3-ilpo.jarvinen@linux.intel.com commit 2657a0c982239fecc41d0df5a69091ca4297647c Author: Ilpo Järvinen Date: Fri Aug 29 16:10:50 2025 +0300 m68k/PCI: Use pci_enable_resources() in pcibios_enable_device() m68k has a resource enable (check) loop in its pcibios_enable_device() which for some reason differs from pci_enable_resources(). This could lead to inconsistencies in behavior, especially now as pci_enable_resources() and the bridge window resource flags behavior are going to be altered by upcoming changes. The check for !r->start && r->end is already covered by the more generic checks done in pci_enable_resources(). The entire pcibios_enable_device() suspiciously looks copy-paste from some other arch as also indicated by the preceding comment. However, it also enables PCI_COMMAND_IO | PCI_COMMAND_MEMORY always for bridges. It is not clear why that is being done as the commit e93a6bbeb5a5 ("m68k: common PCI support definitions and code") introducing this code states "Nothing specific to any PCI implementation in any m68k class CPU hardware yet". Replace the resource enable loop with a call to pci_enable_resources() and adjust the Command Register afterwards as it's unclear if that is necessary or not so keep it for now. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250829131113.36754-2-ilpo.jarvinen@linux.intel.com commit 31af09b3eaf3603870ce9fd5a7b6c8693129c4cf Author: Ilpo Järvinen Date: Mon Jun 30 17:26:41 2025 +0300 PCI: Fix failure detection during resource resize Since 96336ec70264 ("PCI: Perform reset_resource() and build fail list in sync") the failed list is always built and returned to let the caller decide what to do with the failures. The caller may want to retry resource fitting and assignment and before that can happen, the resources should be restored to their original state (a reset effectively clears the struct resource), which requires returning them to the failed list so the original state remains stored in the associated struct pci_dev_resource. Resource resizing is different from the ordinary resource fitting and assignment in that it only considers part of the resources. This means failures for other resource types are not relevant at all and should be ignored. As resize doesn't unassign such unrelated resources, those resources ending up in the failed list implies assignment of that resource must have failed before resize too. The check in pci_reassign_bridge_resources() to decide if the whole assignment is successful, however, is based on list emptiness which will cause false negatives when the failed list has resources with an unrelated type. If the failed list is not empty, call pci_required_resource_failed() and extend it to be able to filter on specific resource types too (if provided). Calling pci_required_resource_failed() at this point is slightly problematic because the resource itself is reset when the failed list is constructed in __assign_resources_sorted(). As a result, pci_resource_is_optional() does not have access to the original resource flags. This could be worked around by restoring and re-resetting the resource around the call to pci_resource_is_optional(), however, it shouldn't cause issue as resource resizing is meant for 64-bit prefetchable resources according to Christian König (see the Link which unfortunately doesn't point directly to Christian's reply because lore didn't store that email at all). Fixes: 96336ec70264 ("PCI: Perform reset_resource() and build fail list in sync") Link: https://lore.kernel.org/all/c5d1b5d8-8669-5572-75a7-0b480f581ac1@linux.intel.com/ Reported-by: D Scott Phillips Closes: https://lore.kernel.org/all/86plf0lgit.fsf@scott-ph-mail.amperecomputing.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: D Scott Phillips Reviewed-by: D Scott Phillips Cc: Christian König Cc: stable@vger.kernel.org # v6.15+ Link: https://patch.msgid.link/20250822123359.16305-4-ilpo.jarvinen@linux.intel.com commit ff77c5219747d6b78e8b0ffc4c43d3dd8173d1b2 Author: Ilpo Järvinen Date: Mon Jun 30 17:26:40 2025 +0300 PCI: Fix pdev_resources_assignable() disparity pdev_sort_resources() uses pdev_resources_assignable() helper to decide if device's resources cannot be assigned, so it ignores class 0 (PCI_CLASS_NOT_DEFINED) devices. pbus_size_mem(), on the other hand, does not do the same check. This could lead into a situation where a resource ends up on realloc_head list but is not on the head list, which in turn prevents emptying the resource from the realloc_head list in __assign_resources_sorted(). A non-empty realloc_head is unacceptable because it triggers an internal sanity check as shown in this log with a device that has class 0 (PCI_CLASS_NOT_DEFINED): pci 0001:01:00.0: [144d:a5a5] type 00 class 0x000000 PCIe Endpoint pci 0001:01:00.0: BAR 0 [mem 0x00000000-0x000fffff 64bit] pci 0001:01:00.0: ROM [mem 0x00000000-0x0000ffff pref] pcieport 0001:00:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 01-ff] add_size 100000 add_align 100000 pcieport 0001:00:00.0: bridge window [mem 0x40000000-0x401fffff]: assigned ------------[ cut here ]------------ kernel BUG at drivers/pci/setup-bus.c:2532! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP ... Call trace: pci_assign_unassigned_bus_resources+0x110/0x114 (P) pci_rescan_bus+0x28/0x48 Use pdev_resources_assignable() also within pbus_size_mem() to skip processing of non-assignable resources which removes the disparity in between what resources pdev_sort_resources() and pbus_size_mem() consider. As non-assignable resources are no longer processed, they are not added to the realloc_head list, thus the sanity check no longer triggers. This disparity problem is very old but only now became apparent after 2499f5348431 ("PCI: Rework optional resource handling") that made the ROM resources optional when calculating bridge window sizes which required adding the resource to the realloc_head list. Previously, bridge windows were just sized larger than necessary. Fixes: 2499f5348431 ("PCI: Rework optional resource handling") Reported-by: Tudor Ambarus Closes: https://lore.kernel.org/all/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v6.15+ Link: https://patch.msgid.link/20250822123359.16305-3-ilpo.jarvinen@linux.intel.com commit 6e460c3d611009a1d1c2c1f61c96578284a14fba Author: Ilpo Järvinen Date: Mon Jun 30 17:26:39 2025 +0300 PCI: Ensure relaxed tail alignment does not increase min_align When using relaxed tail alignment for the bridge window, pbus_size_mem() also tries to minimize min_align, which can under certain scenarios end up increasing min_align from that found by calculate_mem_align(). Ensure min_align is not increased by the relaxed tail alignment. Eventually, it would be better to add calculate_relaxed_head_align() similar to calculate_mem_align() which finds out what alignment can be used for the head without introducing any gaps into the bridge window to give flexibility on head address too. But that looks relatively complex so it requires much more testing than fixing the immediate problem causing a regression. Fixes: 67f9085596ee ("PCI: Allow relaxed bridge window tail sizing for optional resources") Reported-by: Rio Liu Closes: https://lore.kernel.org/all/o2bL8MtD_40-lf8GlslTw-AZpUPzm8nmfCnJKvS8RQ3NOzOW1uq1dVCEfRpUjJ2i7G2WjfQhk2IWZ7oGp-7G-jXN4qOdtnyOcjRR0PZWK5I=@r26.me/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Rio Liu Cc: stable@vger.kernel.org # v6.15+ Link: https://patch.msgid.link/20250822123359.16305-2-ilpo.jarvinen@linux.intel.com commit 1e9ddbb2cd346e42256c5ede2cc40439f2f99bb7 Author: Akira Yokosawa Date: Thu Sep 11 17:29:31 2025 +0900 docs: Pull LKMM documentation into dev-tools book Currently, LKMM docs are not included in any of kernel documentation books. Commit e40573a43d16 ("docs: put atomic*.txt and memory-barriers.txt into the core-api book") covered plain-text docs under Documentation/ by using the "include::" directive along with the ":literal:" option. As LKMM docs are not under Documentation/, the same approach would not work due to the directive's restriction. As a matter of fact, kernel documentation has an extended directive by the name of "kernel-include::", which loosens such restriction and accepts any files under the kernel source tree. Rather than moving LKMM docs around, use the latter and pull them into the dev-tools book next to KCSAN. Signed-off-by: Akira Yokosawa Cc: Paul E. McKenney Acked-by: Paul E. McKenney Signed-off-by: Jonathan Corbet Message-ID: <7ce84a93-5cbc-420e-894a-06a0372c52ab@gmail.com> commit ba3b29a639fe5173033914db6ee58d8d9bb86aba Author: Thomas Zimmermann Date: Tue Jul 15 14:24:51 2025 +0200 backlight: rt4831: Include Include to declare struct of_device_id. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-15-tzimmermann@suse.de Signed-off-by: Lee Jones commit 246da2b48e2ce973db255fc4b6faf42f73c03114 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:50 2025 +0200 backlight: rave-sp: Include and Include to declare struct device_node and include to declare struct of_device_id. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-14-tzimmermann@suse.de Signed-off-by: Lee Jones commit b38ed7c05a35f3a029c2fc5e43a94aa81e2ac843 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:49 2025 +0200 backlight: led_bl: Include Include to declare struct of_count_phandle_with_args(). Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-13-tzimmermann@suse.de Signed-off-by: Lee Jones commit 5f60004f152b432c6ae5dbacc172adc1fa215825 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:48 2025 +0200 backlight: ktd2801: Include Include to declare struct of_device_id. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: Nick Chan Reviewed-by: "Daniel Thompson (RISCstar)" Acked-by: Duje Mihanović Link: https://lore.kernel.org/r/20250715122643.137027-12-tzimmermann@suse.de Signed-off-by: Lee Jones commit ce4bb1a2f1cbcd5f6471f74ee5c7e1443a4cfd84 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:47 2025 +0200 backlight: jornada720: Include Include to declare IOMEM(). Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-11-tzimmermann@suse.de Signed-off-by: Lee Jones commit e2e76f67bdbbc7b8df608e3dd1028059d838871e Author: Thomas Zimmermann Date: Tue Jul 15 14:24:46 2025 +0200 backlight: da9052_bl: Include Include to declare struct platform_device_id. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-10-tzimmermann@suse.de Signed-off-by: Lee Jones commit 6789cd935a57464deaacdd14c84bc026aa228e72 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:45 2025 +0200 backlight: as3711_bl: Include Include to declare various OF helpers. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-9-tzimmermann@suse.de Signed-off-by: Lee Jones commit 945e411acde3800234d506f4304203a9b11890f8 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:44 2025 +0200 backlight: apple_dwi_bl: Include Include to declare struct of_device_id. Avoids dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: Nick Chan Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-8-tzimmermann@suse.de Signed-off-by: Lee Jones commit b12224c28d84d054dfb680c05cda61d1e2584bf5 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:43 2025 +0200 backlight: Include Include to avoid dependency on backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250715122643.137027-7-tzimmermann@suse.de Signed-off-by: Lee Jones commit 9946f344528afabb8620a5c3b788cfa505211517 Author: Akiyoshi Kurita Date: Sun Sep 14 02:34:13 2025 +0900 docs: w1: ds2482: fix typo in buses Correct a spelling mistake in ds2482.rst ("busses" -> "buses"). No functional change. Signed-off-by: Akiyoshi Kurita Signed-off-by: Jonathan Corbet Message-ID: <20250913173413.951378-1-weibu@redadmin.org> commit d1a599a8136b16522b5afebd122395524496d549 Author: Colin Ian King Date: Tue Sep 2 12:45:18 2025 +0100 ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message There appears to be a cut-n-paste error with the incorrect field ndr_desc->numa_node being reported for the target node. Fix this by using ndr_desc->target_node instead. Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") Signed-off-by: Colin Ian King Reviewed-by: Ira Weiny Signed-off-by: Ira Weiny commit 11bdf36be82721b8c4eda95a21c78ad856e047f9 Author: Xichao Zhao Date: Wed Aug 27 10:13:25 2025 +0800 nvdimm: Use str_plural() to simplify the code Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao Reviewed-by: Dave Jiang Signed-off-by: Ira Weiny commit 5089ec0bb1bc80a87cfbc2a90e047161adfcb630 Author: Taimoor Zaeem Date: Sun Sep 14 16:31:56 2025 +0500 Documentation: staging: fix spelling error in remoteproc.rst Fix typo 'implementors' to 'implementers' in remote processor framework documentation. Signed-off-by: Taimoor Zaeem Signed-off-by: Jonathan Corbet Message-ID: commit 40103d2a42fe68f3aad77609b42451ee5c713f6e Author: Lukas Wunner Date: Mon Sep 15 15:50:04 2025 +0200 Documentation: PCI: Tidy error recovery doc's PCIe nomenclature Commit 11502feab423 ("Documentation: PCI: Tidy AER documentation") replaced the terms "PCI-E", "PCI-Express" and "PCI Express" with "PCIe" in the AER documentation. Do the same in the documentation on PCI error recovery. While at it, add a missing period and a missing blank. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Brian Norris Reviewed-by: Niklas Schnelle Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/db56b7ef12043f709a04ce67c1d1e102ab5f4e19.1757942121.git.lukas@wunner.de commit 15dea68d41d58979dcf9011b5dd787aed5fe7dba Author: Lukas Wunner Date: Mon Sep 15 15:50:03 2025 +0200 Documentation: PCI: Amend error recovery doc with DPC/AER specifics Amend the documentation on PCI error recovery with specifics about Downstream Port Containment and Advanced Error Reporting: * Explain that with DPC, devices are inaccessible upon an error (similar to EEH on powerpc) and do not become accessible until the link is re-enabled. * Explain that with AER, although devices may already be accessible in the ->error_detected() callback, accesses should be deferred to the ->mmio_enabled() callback for compatibility with EEH on powerpc and with s390. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Brian Norris Reviewed-by: Niklas Schnelle Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/61d8eeadb20ee71c3a852f44c863bfe0209c454d.1757942121.git.lukas@wunner.de commit 8e4a13fc61d364ff61b4410810f7b947b6208039 Author: Lukas Wunner Date: Mon Sep 15 15:50:02 2025 +0200 Documentation: PCI: Sync error recovery doc with code Amend the documentation on PCI error recovery to fix minor inaccuracies vis-à-vis the actual code: * The documentation claims that a missing ->resume() or ->mmio_enabled() callback always leads to recovery through reset. But none of the implementations do this (pcie_do_recovery(), eeh_handle_normal_event(), zpci_event_do_error_state_clear()). Drop the claim to align the documentation with the code. * The documentation does not list PCI_ERS_RESULT_RECOVERED as a valid return value from ->error_detected(). But none of the implementations forbid this and some drivers are returning it, e.g.: drivers/bus/mhi/host/pci_generic.c drivers/infiniband/hw/hfi1/pcie.c Further down in the documentation it is implied that the return value is in fact allowed: "The platform will call the resume() callback on all affected device drivers if all drivers on the segment have returned PCI_ERS_RESULT_RECOVERED from one of the 3 previous callbacks." The "3 previous callbacks" being ->error_detected(), ->mmio_enabled() and ->slot_reset(). Add it to the valid return values for consistency. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Brian Norris Reviewed-by: Niklas Schnelle Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/ed3c3385499775fcc25f1ee66f395e212919f94a.1757942121.git.lukas@wunner.de commit 01cc0dc9de9c5647a2e42309f86db0f2d3cc0f68 Author: Lukas Wunner Date: Mon Sep 15 15:50:01 2025 +0200 Documentation: PCI: Sync AER doc with code The PCIe Advanced Error Reporting driver has evolved over the years but its documentation hasn't. Catch up with past code changes: * The documentation claims that Correctable Errors are logged with KERN_INFO severity, but the code uses KERN_WARN. It had used KERN_WARN from the beginning with commit 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver"). In 2013, commit 2cced2d95961 ("aerdrv: Cleanup log output for AER") switched to KERN_ERR, until 2020 when it was reverted back to KERN_WARN by commit e83e2ca3c395 ("PCI/AER: Log correctable errors as warning, not error"). * An example log message in the documentation uses the term "Uncorrected", but the code uses "Uncorrectable" since commit 02a06f5f1a6a ("PCI/AER: Use 'Correctable' and 'Uncorrectable' spec terms for errors"). * The example contains the Requester ID "id=0500", which is omitted since commit 010caed4ccb6 ("PCI/AER: Decode Error Source Requester ID"). * The example contains the error name "Unsupported Request", which is instead reported as "UnsupReq" since commit bd237801fef2 ("PCI/AER: Adopt lspci names for AER error decoding"). * The example doesn't prepend "0x" to hex values from the TLP Header Log, as introduced by commit f68ea779d98a ("PCI: Add pcie_print_tlp_log() to print TLP Header and Prefix Log"). * The documentation refers to a reset_link callback which was removed by commit b6cf1a42f916 ("PCI/ERR: Remove service dependency in pcie_do_recovery()"). * Commit 579086225502 ("PCI/ERR: Recover from RCiEP AER errors") added support to recover Root Complex Integrated Endpoints by applying a Function Level Reset, alternatively to the Secondary Bus Reset which is applied otherwise. * On non-fatal errors, a reset was previously never performed. But the AER driver has just been amended to allow drivers to opt in to a reset. * The documentation claims that a warning message is logged if a driver lacks pci_error_handlers. But the message has been informational (logged with KERN_INFO severity) since its introduction with commit 01daacfb9035 ("PCI/AER: Log which device prevents error recovery"). The documentation claims that the message is only logged for fatal errors, which is incorrect. Moreover it refers to "section 3", even though the documentation no longer contains section numbers since commit 4e37f055a92e ("Documentation: PCI: convert pcieaer-howto.txt to reST"). Section 3 is titled "Developer Guide". That's the same section where the reference is located, so it is self-referential and can be dropped. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Brian Norris Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/7501bfc5b9920193a25998a3cbcf72c47674ec63.1757942121.git.lukas@wunner.de commit 07c7efda24453e05951fb2879f5452b720b91169 Author: Svyatoslav Ryhel Date: Tue Sep 9 10:43:04 2025 +0300 video: backlight: lp855x_bl: Set correct EPROM start for LP8556 According to LP8556 datasheet EPROM region starts at 0x98 so adjust value in the driver accordingly. Signed-off-by: Svyatoslav Ryhel Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com Signed-off-by: Lee Jones commit ef381e17930e9c5268a53f57187c87a85676d0f7 Author: Hans de Goede Date: Wed Sep 10 14:01:10 2025 +0200 leds: led-class: Add Device Tree support to led_get() Add 'name' argument to of_led_get() such that it can lookup LEDs in devicetree by either name or index. And use this modified function to add devicetree support to the generic (non devicetree specific) [devm_]led_get() function. This uses the standard devicetree pattern of adding a -names string array to map names to the indexes for an array of resources. Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Signed-off-by: Aleksandrs Vinarskis Link: https://lore.kernel.org/r/20250910-leds-v5-3-bb90a0f897d5@vinarskis.com Signed-off-by: Lee Jones commit d0fa8751525d3aa4359de00bcbed578eab6f1d79 Author: Qianfeng Rong Date: Tue Aug 19 11:58:03 2025 +0800 backlight: led_bl: Use devm_kcalloc() for array space allocation Replace calls of devm_kzalloc() with devm_kcalloc() in led_bl_get_leds() and led_bl_parse_levels() for safer memory allocation with built-in overflow protection. Signed-off-by: Qianfeng Rong Reviewed-by: "Daniel Thompson (RISCstar)" Link: https://lore.kernel.org/r/20250819035804.433615-1-rongqianfeng@vivo.com Signed-off-by: Lee Jones commit 3ab1da2614e616ea62f32e4d695f1cc449089f07 Author: Alexandre Belloni Date: Tue Sep 16 11:12:51 2025 +0200 i3c: master: adi: fix header location The adi-axi-common header has been moved to the upper directory. Acked-by: Jorge Marques Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-3-bc4b3b61d1d4@analog.com Acked-by: Nuno Sá Link: https://lore.kernel.org/r/20250916091252.39265-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit a6de182daa2b1a627d88a594526a0db4ac1e396e Author: Alex Elder Date: Mon Aug 25 12:20:53 2025 -0500 rtc: spacemit: support the SpacemiT P1 RTC Add support for the RTC found in the SpacemiT P1 PMIC. Initially only setting and reading the time are supported. The PMIC is implemented as a multi-function device. This RTC is probed based on this driver being named in a MFD cell in the simple MFD I2C driver. Signed-off-by: Alex Elder Acked-by: Alexandre Belloni Link: https://lore.kernel.org/r/20250825172057.163883-5-elder@riscstar.com Signed-off-by: Alexandre Belloni commit 6266aea864fa5484f6e8313f913a69e794765fab Author: Clément Le Goffic Date: Tue Jul 15 16:07:15 2025 +0200 rtc: optee: add alarm related rtc ops to optee rtc driver Add read_alarm and set_alarm ops from the rtc framework. The support of an alarm is handled by a kernel thread waiting in OP-TEE for an asynchronous notification that comes in the interrupt handler of the alarm interruption on OP-TEE secure world. Once the notification arrives, the kernel thread previously suspended is rescheduled (this is handled by the OP-TEE kernel driver) and comes back with the alarm information to the kernel. A second session is therefore needed to enable/disable/cancel a waiting alarm event as the kernel thread stopped in OP-TEE takes a form of mutex on the session and so no one can use this session in parallel. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-3-e0fdf8aae545@foss.st.com Signed-off-by: Alexandre Belloni commit 44fee00f2139894b2ae4433f0661d70134b511c0 Author: Clément Le Goffic Date: Tue Jul 15 16:07:14 2025 +0200 rtc: optee: remove unnecessary memory operations Remove memcpy by using directly the shared memory. Remove memset be initialize variable to 0 on stack. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-2-e0fdf8aae545@foss.st.com Signed-off-by: Alexandre Belloni commit a531350d2fe58f7fc4516e555f22391dee94efd9 Author: Clément Le Goffic Date: Tue Jul 15 16:07:13 2025 +0200 rtc: optee: fix memory leak on driver removal Fix a memory leak in case of driver removal. Free the shared memory used for arguments exchanges between kernel and OP-TEE RTC PTA. Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA") Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com Signed-off-by: Alexandre Belloni commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 Author: Rob Herring (Arm) Date: Thu Aug 21 16:57:02 2025 -0500 rtc: x1205: Fix Xicor X1205 vendor prefix The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered. Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support") Signed-off-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org Signed-off-by: Alexandre Belloni commit f2e44e5fb2de9a464b4fc94d8de071da7ebfda15 Author: Rob Herring (Arm) Date: Thu Aug 21 16:57:01 2025 -0500 dt-bindings: rtc: Fix Xicor X1205 vendor prefix The vendor for the Xircom X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Signed-off-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250821215703.869628-1-robh@kernel.org Signed-off-by: Alexandre Belloni commit f0ea5f6e75f6b8bbe5d393720bfaf804d04e383f Author: Wolfram Sang Date: Wed Aug 13 18:15:03 2025 +0200 rtc: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250813161517.4746-18-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 84454c4e504b1fe86f77a898190d63b4193ca25d Author: Rob Herring (Arm) Date: Thu Aug 7 16:44:13 2025 -0500 dt-bindings: rtc: Drop isil,isl12057.txt The "isil,isl12057" compatible is already supported by rtc-ds1307.yaml, so remove the old text binding. Signed-off-by: Rob Herring (Arm) Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250807214414.4172910-1-robh@kernel.org Signed-off-by: Alexandre Belloni commit 18a3510bc87d48deec0abb72bc9e0b2f8393ff0b Author: Ard Biesheuvel Date: Mon Jul 14 08:08:45 2025 +0200 rtc: efi: Remove wakeup functionality The EFI rtc driver is used by non-x86 architectures only, and exposes the get/set wakeup time functionality provided by the underlying platform. This is usually broken on most platforms, and not widely used to begin with [if at all], so let's just remove it. Signed-off-by: Ard Biesheuvel Tested-by: Feng Tang Link: https://lore.kernel.org/r/20250714060843.4029171-6-ardb+git@google.com Signed-off-by: Alexandre Belloni commit a6f1a4f05970664004a9370459c6799c1b2f2dcf Author: Josua Mayer Date: Mon Aug 25 19:54:09 2025 +0200 rtc: pcf2127: clear minute/second interrupt PCF2127 can generate interrupt every full second or minute configured from control and status register 1, bits MI (1) and SI (0). On interrupt control register 2 bit MSF (7) is set and must be cleared to continue normal operation. While the driver never enables this interrupt on its own, users or firmware may do so - e.g. as an easy way to test the interrupt. Add preprocessor definition for MSF bit and include it in the irq bitmask to ensure minute and second interrupts are cleared when fired. This fixes an issue where the rtc enters a test mode and becomes unresponsive after a second interrupt has fired and is not cleared in time. In this state register writes to control registers have no effect and the interrupt line is kept asserted [1]: [1] userspace commands to put rtc into unresponsive state: $ i2cget -f -y 2 0x51 0x00 0x04 $ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI $ i2cget -f -y 2 0x51 0x00 0x84 # bit 8 EXT_TEST set $ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register $ i2cget -f -y 2 0x51 0x00 0x84 # no change Signed-off-by: Josua Mayer Reviewed-by: Bruno Thomsen Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com Signed-off-by: Alexandre Belloni commit bf7ab18cd741ae82ee8d8e356f73ce3003f6b2fc Author: Krzysztof Kozlowski Date: Sat Aug 30 15:00:27 2025 +0200 dt-bindings: rtc: s3c: Drop S3C2410 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250830130024.142815-6-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit 9693342805748bcf0c02b16ac0a0aa852688dea9 Author: Krzysztof Kozlowski Date: Sat Aug 30 15:00:26 2025 +0200 rtc: s3c: Drop support for S3C2410 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250830130024.142815-5-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit d06b24f805b5c86c83f4182f32ed1cdd7c690171 Author: Krzysztof Kozlowski Date: Sat Aug 30 15:00:25 2025 +0200 rtc: s3c: Drop unused defines Drop defines for S3C2416 and S3C2443 SoCs which are not used anywhere. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250830130024.142815-4-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit 0dbb84b5c447ddf2681ed0248a6fb7c9fc3fdb6c Author: Frank Li Date: Wed Aug 27 15:33:55 2025 -0400 dt-bindings: rtc: trivial-rtc: add dallas,m41t00 Add compatible string dallas,m41t00 for dallas m41t00 RTC. Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250827193356.78368-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni commit 06ce29264f1d46f00fdb46b0c2d9fb060ce72368 Author: Frank Li Date: Wed Sep 3 15:11:27 2025 -0400 dt-bindings: rtc: pcf85063: remove quartz-load-femtofarads restriction for nxp,pcf85063 Original TXT binding doc have not limitition about quartz-load-femtofarads, which only allow 7000 for nxp,pcf85063. So remove it to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-skov-revc-lt2.dtb: rtc@51 (nxp,pcf85063): quartz-load-femtofarads:0: 7000 was expected from schema $id: http://devicetree.org/schemas/rtc/nxp,pcf85063.yaml# Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250903191128.439164-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni commit a19c879b69b12cc31ed59b50e743a1ef2e5b08b1 Author: Vikram Sharma Date: Thu Aug 14 15:46:15 2025 +0530 arm64: dts: qcom: lemans: Add support for camss Add changes to support the camera subsystem on the lemans. Co-developed-by: Suresh Vankadara Signed-off-by: Suresh Vankadara Signed-off-by: Vikram Sharma Reviewed-by: Konrad Dybcio Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250814101615.1102795-10-quic_vikramsa@quicinc.com Signed-off-by: Bjorn Andersson commit 50ced16fe5bfe76cf1cb7f0ff5371b0c141ea6c3 Author: Dzmitry Sankouski Date: Fri Sep 12 21:56:36 2025 +0300 arm64: dts: qcom: sdm845-starqltechn: add slpi support Add support for Qualcomm sensor low power island. Signed-off-by: Dzmitry Sankouski Link: https://lore.kernel.org/r/20250912-starqltechn_slpi-v2-2-5ca5ddbbe7b4@gmail.com Signed-off-by: Bjorn Andersson commit 171e12ff755812dcf98b3ed98f15f54bf264fae3 Author: Dzmitry Sankouski Date: Fri Sep 12 21:56:35 2025 +0300 arm64: dts: qcom: sdm845-starqltechn: fix slpi reserved mem When adding adsp reserved mem, slpi reserved memory was shrunk according to vendor kernel log: `Removed memory: created DMA memory pool at 0x0000000096700000, size 15 M` However, kernel failed to load firmware with 15MiB reserved region: `[ 14.885885] qcom_q6v5_pas 5c00000.remoteproc: segment outside memory range` Increase slpi reserved region to 16MiB. Fixes: 58782c229e3e ("arm64: dts: qcom: sdm845-starqltechn: add initial sound support") Signed-off-by: Dzmitry Sankouski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250912-starqltechn_slpi-v2-1-5ca5ddbbe7b4@gmail.com Signed-off-by: Bjorn Andersson commit 11cf389c103f69d1170fbd70acbcc282cf03b748 Author: Eric Gonçalves Date: Fri Sep 12 20:25:57 2025 +0000 arm64: dts: qcom: add initial support for Samsung Galaxy S22 Add new device support for the Samsung Galaxy S22 (SM-S901E) phone What works: - SimpleFB - USB Signed-off-by: Eric Gonçalves Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250912202603.7312-2-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit ed32443efe2c044bad53309670e5b58473a620d1 Author: Krishna Kurapati Date: Sat Sep 13 23:53:18 2025 +0530 arm64: dts: qcom: qcs8300: Flatten usb controller nodes Flatten usb controller nodes and update to using latest bindings and flattened driver approach. Enumeration of ADB has been tested on EVK Platform. Signed-off-by: Krishna Kurapati Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250913182318.3547789-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 949ddfb774fe527cebfa3f769804344940f7ed2e Merge: a6824f65c9966c 1b255e1beabf68 Author: Jakub Kicinski Date: Tue Sep 16 08:14:43 2025 -0700 Merge branch 'tools-ynl-prepare-for-wireguard' Asbjørn Sloth Tønnesen says: ==================== tools: ynl: prepare for wireguard This series contains the last batch of YNL changes to support the wireguard YNL conversion. ==================== Link: https://patch.msgid.link/20250915144301.725949-1-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 1b255e1beabf6826758d6018ddd2e1e3bba32f44 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:56 2025 +0000 tools: ynl: add ipv4-or-v6 display hint The attribute WGALLOWEDIP_A_IPADDR can contain either an IPv4 or an IPv6 address depending on WGALLOWEDIP_A_FAMILY, however in practice it is enough to look at the attribute length. This patch implements an ipv4-or-v6 display hint, that can deal with this kind of attribute. It only implements this display hint for genetlink-legacy, it can be added to other protocol variants if needed, but we don't want to encourage it's use. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250915144301.725949-12-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 52550d518d2454bf0af0b79ca54b6d38f2d94777 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:55 2025 +0000 tools: ynl: decode hex input This patch adds support for decoding hex input, so that binary attributes can be read through --json. Example (using future wireguard.yaml): $ sudo ./tools/net/ynl/pyynl/cli.py --family wireguard \ --do set-device --json '{"ifindex":3, "private-key":"2a ae 6c 35 c9 4f cf <... to 32 bytes>"}' In order to somewhat mirror what is done in _formatted_string(), then for non-binary attributes attempt to convert it to an int. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250915144301.725949-11-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 5c51ae2446c2f56b505974b1ff91d0c802a0e301 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:54 2025 +0000 tools: ynl: encode indexed-arrays This patch adds support for encoding indexed-array attributes with sub-type nest in pyynl. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250915144301.725949-10-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 328c13426240579ea224018fd543ad52ef68183e Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:53 2025 +0000 tools: ynl: move nest packing to a helper function This patch moves nest packing into a helper function, that can also be used for packing indexed arrays. No behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250915144301.725949-9-ast@fiberby.net Signed-off-by: Jakub Kicinski commit a44a93ea6f06da7bd15232805fd8f8b90fd59e37 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:52 2025 +0000 tools: ynl-gen: rename TypeArrayNest to TypeIndexedArray Since TypeArrayNest can now be used with many other sub-types than nest, then rename it to TypeIndexedArray, to reduce confusion. This patch continues the rename, that was started in commit aa6485d813ad ("ynl: rename array-nest to indexed-array"), when the YNL type was renamed. In order to get rid of all references to the old naming, within ynl, then renaming some variables in _multi_parse(). This is a trivial patch with no behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250915144301.725949-8-ast@fiberby.net Signed-off-by: Jakub Kicinski commit d46651d4e3c0caab554c4c591c0b6c3b026b1e93 Author: Binbin Zhou Date: Thu Sep 4 20:35:07 2025 +0800 ipmi: Add Loongson-2K BMC support This patch adds Loongson-2K BMC IPMI support. According to the existing design, we use software simulation to implement the KCS interface registers: Stauts/Command/Data_Out/Data_In. Also since both host side and BMC side read and write kcs status, fifo flag is used to ensure data consistency. The single KCS message block is as follows: +-------------------------------------------------------------------------+ |FIFO flags| KCS register data | CMD data | KCS version | WR REQ | WR ACK | +-------------------------------------------------------------------------+ Co-developed-by: Chong Qiao Signed-off-by: Chong Qiao Reviewed-by: Huacai Chen Acked-by: Corey Minyard Signed-off-by: Binbin Zhou Message-ID: <8f9ffb6f0405345af8f04193ce1510aacd075e72.1756987761.git.zhoubinbin@loongson.cn> Signed-off-by: Corey Minyard commit 1d99aa4ed707c5630a7a7f067c8818e19167e3a1 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:51 2025 +0000 tools: ynl-gen: validate nested arrays In nested arrays don't require that the intermediate attribute type should be a valid attribute type, it might just be zero or an incrementing index, it is often not even used. See include/net/netlink.h about NLA_NESTED_ARRAY: > The difference to NLA_NESTED is the structure: > NLA_NESTED has the nested attributes directly inside > while an array has the nested attributes at another > level down and the attribute types directly in the > nesting don't matter. Example based on include/uapi/linux/wireguard.h: > WGDEVICE_A_PEERS: NLA_NESTED > 0: NLA_NESTED > WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN > [..] > 0: NLA_NESTED > ... > ... Previous the check required that the nested type was valid in the parent attribute set, which in this case resolves to WGDEVICE_A_UNSPEC, which is YNL_PT_REJECT, and it took the early exit and returned YNL_PARSE_CB_ERROR. This patch renames the old nl_attr_validate() to __nl_attr_validate(), and creates a new inline function nl_attr_validate() to mimic the old one. The new __nl_attr_validate() takes the attribute type as an argument, so we can use it to validate attributes of a nested attribute, in the context of the parents attribute type, which in the above case is generated as: [WGDEVICE_A_PEERS] = { .name = "peers", .type = YNL_PT_NEST, .nest = &wireguard_wgpeer_nest, }, __nl_attr_validate() only checks if the attribute length is plausible for a given attribute type, so the .nest in the above example is not used. As the new inline function needs to be defined after ynl_attr_type(), then the definitions are moved down, so we avoid a forward declaration of ynl_attr_type(). Some other examples are NL80211_BAND_ATTR_FREQS (nest) and NL80211_ATTR_SUPPORTED_COMMANDS (u32) both in nl80211-user.c $ make -C tools/net/ynl/generated nl80211-user.c Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250915144301.725949-7-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 099902fc66f87424a5b4aa6d58832c7aab0ac6c6 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:50 2025 +0000 tools: ynl-gen: avoid repetitive variables definitions In the generated attribute parsing code, avoid repetitively defining the same variables over and over again, local to the conditional block for each attribute. This patch consolidates the definitions of local variables for attribute parsing, so that they are defined at the function level, and re-used across attributes, thus making the generated code read more natural. If attributes defines identical local_vars, then they will be deduplicated, attributes are assumed to only use their local variables transiently. The example below shows how `len` was defined repeatedly in tools/net/ynl/generated/nl80211-user.c: nl80211_iftype_data_attrs_parse(..) { [..] ynl_attr_for_each_nested(attr, nested) { unsigned int type = ynl_attr_type(attr); if (type == NL80211_BAND_IFTYPE_ATTR_IFTYPES) { unsigned int len; [..] } else if (type == NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC) { unsigned int len; [..] [same pattern 8 times, so 11 times in total] } else if (type == NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE) { unsigned int len; [..] } } return 0; } This patch results in this diffstat for the generated code: $ diff -Naur pre/ post/ | diffstat devlink-user.c | 187 +++---------------- dpll-user.c | 10 - ethtool-user.c | 49 +---- fou-user.c | 5 handshake-user.c | 3 mptcp_pm-user.c | 3 nfsd-user.c | 16 - nl80211-user.c | 159 +--------------- nlctrl-user.c | 21 -- ovpn-user.c | 7 ovs_datapath-user.c | 9 ovs_flow-user.c | 89 --------- ovs_vport-user.c | 7 rt-addr-user.c | 14 - rt-link-user.c | 183 ++---------------- rt-neigh-user.c | 14 - rt-route-user.c | 26 -- rt-rule-user.c | 11 - tc-user.c | 380 +++++---------------------------------- tcp_metrics-user.c | 7 team-user.c | 5 21 files changed, 175 insertions(+), 1030 deletions(-) The changed lines are mostly `unsigned int len;` definitions: $ diff -Naur pre/ post/ | grep ^[-+] | grep -v '^[-+]\{3\}' | grep -v '^.$' | sed -e 's/\t\+/ /g' | sort | uniq -c | sort -nr 488 - unsigned int len; 153 + unsigned int len; 24 - const struct nlattr *attr2; 18 + const struct nlattr *attr2; 1 - __u32 policy_id, attr_id; 1 + __u32 policy_id, attr_id; 1 - __u32 op_id; 1 + __u32 op_id; 1 - const struct nlattr *attr_policy_id, *attr_attr_id; 1 + const struct nlattr *attr_policy_id, *attr_attr_id; 1 - const struct nlattr *attr_op_id; 1 + const struct nlattr *attr_op_id; Suggested-by: Jakub Kicinski Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250915144301.725949-6-ast@fiberby.net Signed-off-by: Jakub Kicinski commit db4ea3baa4842d01de201662da628655cd366c38 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:49 2025 +0000 tools: ynl-gen: refactor local vars for .attr_put() callers Refactor the generation of local variables needed when building requests, by moving the logic from put_req_nested() into a new helper put_local_vars(), and use the helper before .attr_put() is called, thus generating the local variables assumed by .attr_put(). Previously only put_req_nested() generated the variables assumed by .attr_put(), print_req() only generated the count iterator `i`, and print_dump() neither generated `i` nor `array`. This patch fixes the build errors below: $ make -C tools/net/ynl/generated/ [...] -e GEN wireguard-user.c -e GEN wireguard-user.h -e CC wireguard-user.o wireguard-user.c: In function ‘wireguard_get_device_dump’: wireguard-user.c:480:9: error: ‘array’ undeclared (first use in func) 480 | array = ynl_attr_nest_start(nlh, WGDEVICE_A_PEERS); | ^~~~~ wireguard-user.c:480:9: note: each undeclared identifier is reported only once for each function it appears in wireguard-user.c:481:14: error: ‘i’ undeclared (first use in func) 481 | for (i = 0; i < req->_count.peers; i++) | ^ wireguard-user.c: In function ‘wireguard_set_device’: wireguard-user.c:533:9: error: ‘array’ undeclared (first use in func) 533 | array = ynl_attr_nest_start(nlh, WGDEVICE_A_PEERS); | ^~~~~ make: *** [Makefile:52: wireguard-user.o] Error 1 make: Leaving directory '/usr/src/linux/tools/net/ynl/generated' Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250915144301.725949-5-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 8df78d97e49816eacb7a8c4da63bf1e8be4e20ac Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:48 2025 +0000 tools: ynl-gen: add sub-type check Add a check to verify that the sub-type is "nest", and throw an exception if no policy could be generated, as a guard to prevent against generating a bad policy. This is a trivial patch with no behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Reviewed-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250915144301.725949-4-ast@fiberby.net Signed-off-by: Jakub Kicinski commit d0bdfe36d77791a67f18d18e93f3fca9a2b10240 Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:47 2025 +0000 tools: ynl-gen: generate nested array policies This patch adds support for NLA_POLICY_NESTED_ARRAY() policies. Example spec (from future wireguard.yaml): - name: wgpeer attributes: - name: allowedips type: indexed-array sub-type: nest nested-attributes: wgallowedip yields NLA_POLICY_NESTED_ARRAY(wireguard_wgallowedip_nl_policy). This doesn't change any currently generated code, as it isn't used in any specs currently used for generating code. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250915144301.725949-3-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 3ff5258b97813d83c12ad80b42a0c40f74dfb06b Author: Asbjørn Sloth Tønnesen Date: Mon Sep 15 14:42:46 2025 +0000 tools: ynl-gen: allow overriding name-prefix for constants Allow using custom name-prefix with constants, just like it is for enum and flags declarations. This is needed for generating WG_KEY_LEN in include/uapi/linux/wireguard.h from a spec. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Reviewed-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250915144301.725949-2-ast@fiberby.net Signed-off-by: Jakub Kicinski commit a6824f65c9966cf514abc334754104b7af53567c Author: Vladimir Oltean Date: Mon Sep 15 17:44:14 2025 +0300 tools: ynl: avoid "use of uninitialized variable" false positive in generated code With indexed-array types such as "ops" from Documentation/netlink/specs/nlctrl.yaml, the generator creates code such as: int nlctrl_getfamily_rsp_parse(const struct nlmsghdr *nlh, struct ynl_parse_arg *yarg) { struct nlctrl_getfamily_rsp *dst; const struct nlattr *attr_ops; const struct nlattr *attr; struct ynl_parse_arg parg; unsigned int n_ops = 0; int i; ... ynl_attr_for_each(attr, nlh, yarg->ys->family->hdr_len) { unsigned int type = ynl_attr_type(attr); if (type == CTRL_ATTR_FAMILY_ID) { ... } else if (type == CTRL_ATTR_OPS) { const struct nlattr *attr2; attr_ops = attr; ynl_attr_for_each_nested(attr2, attr) { if (ynl_attr_validate(yarg, attr2)) return YNL_PARSE_CB_ERROR; n_ops++; } } else { ... } } if (n_ops) { dst->ops = calloc(n_ops, sizeof(*dst->ops)); dst->_count.ops = n_ops; i = 0; parg.rsp_policy = &nlctrl_op_attrs_nest; ynl_attr_for_each_nested(attr, attr_ops) { ... } } return YNL_PARSE_CB_OK; } It is clear that due to the sequential nature of code execution, when n_ops (initially zero) is incremented, attr_ops is also assigned from the value of "attr" (the current iterator). But some compilers, like gcc version 12.2.0 (Debian 12.2.0-14+deb12u1) as distributed by Debian Bookworm, seem to be not sophisticated enough to see this, and fail to compile (warnings treated as errors): In file included from ../lib/ynl.h:10, from nlctrl-user.c:9: In function ‘ynl_attr_data_end’, inlined from ‘nlctrl_getfamily_rsp_parse’ at nlctrl-user.c:427:3: ../lib/ynl-priv.h:209:44: warning: ‘attr_ops’ may be used uninitialized [-Wmaybe-uninitialized] 209 | return (char *)ynl_attr_data(attr) + ynl_attr_data_len(attr); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ nlctrl-user.c: In function ‘nlctrl_getfamily_rsp_parse’: nlctrl-user.c:341:30: note: ‘attr_ops’ was declared here 341 | const struct nlattr *attr_ops; | ^~~~~~~~ It is a pity that we have to do this, but I see no other way than to suppress the false positive by appeasing the compiler and initializing the "*attr_{aspec.c_name}" variable with a bogus value (NULL). This will never be used - at runtime it will always be overwritten when "n_{struct[anest].c_name}" is non-zero. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250915144414.1185788-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 17e163f3d7a5449fe9065030048e28c4087b24ce Author: Manikanta Guntupalli Date: Wed Jul 30 20:42:07 2025 +0530 i3c: dw: Add shutdown support to dw_i3c_master driver Add shutdown handler to the Synopsys DesignWare I3C master driver, ensuring the device is gracefully disabled during system shutdown. The shutdown handler cancels any pending hot-join work and disables interrupts. Signed-off-by: Manikanta Guntupalli Link: https://lore.kernel.org/r/20250730151207.4113708-1-manikanta.guntupalli@amd.com Signed-off-by: Alexandre Belloni commit bc7dd24c114e37c67061f4651bbbbbc57106c617 Author: Wolfram Sang Date: Sun Aug 3 23:12:57 2025 +0200 i3c: renesas: Simplify return statement in 'renesas_i3c_daa' There was already a bail out for 'ret < 0', so we can always return success at the end of the function. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aIyzJ7HOENL1qp1l@stanley.mountain Signed-off-by: Wolfram Sang Tested-by: Tommaso Merciai Link: https://lore.kernel.org/r/20250803211256.18513-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit c5d0df4945085098e4778b27267a225efacf4d2a Author: Lad Prabhakar Date: Mon Sep 8 10:39:30 2025 +0100 dt-bindings: i3c: renesas,i3c: Add RZ/V2H(P) and RZ/V2N support Add device tree binding support for the I3C Bus Interface on Renesas RZ/V2H(P) and RZ/V2N SoCs. The I3C IP on these SoCs is identical to that found on the RZ/G3E SoC. Add new compatible strings "renesas,r9a09g056-i3c" for RZ/V2N and "renesas,r9a09g057-i3c" for RZ/V2H(P). Both variants use "renesas,r9a09g047-i3c" as a fallback compatible to indicate hardware compatibility with the RZ/G3E implementation. Update the title to be more generic as it now covers multiple SoC families beyond just RZ/G3S and RZ/G3E. Signed-off-by: Lad Prabhakar Reviewed-by: Tommaso Merciai Acked-by: Rob Herring (Arm) Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250908093930.12591-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 Author: Stanley Chu Date: Fri Aug 29 09:23:09 2025 +0800 i3c: master: svc: Recycle unused IBI slot In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool to store the IBI payload. However, when an error condition is encountered, the function returns without recycling the IBI slot, resulting in an IBI slot leak. Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") Signed-off-by: Stanley Chu Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com Signed-off-by: Alexandre Belloni commit a7869b0a2540fd122eccec00ae7d4243166b0a60 Author: Stanley Chu Date: Fri Aug 29 09:23:08 2025 +0800 i3c: master: svc: Use manual response for IBI events Driver wants to nack the IBI request when the target is not in the known address list. In below code, svc_i3c_master_nack_ibi() will cause undefined behavior when using AUTOIBI with auto response rule, because hw always auto ack the IBI request. switch (ibitype) { case SVC_I3C_MSTATUS_IBITYPE_IBI: dev = svc_i3c_master_dev_from_addr(master, ibiaddr); if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) svc_i3c_master_nack_ibi(master); ... break; AutoIBI has another issue that the controller doesn't quit AutoIBI state after IBIWON polling timeout when there is a SDA glitch(high->low->high). 1. SDA high->low: raising an interrupt to execute IBI ISR 2. SDA low->high 3. Driver writes an AutoIBI request 4. AutoIBI process does not start because SDA is not low 5. IBIWON polling times out 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request Emitting broadcast address with IBIRESP_MANUAL avoids both issues. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Signed-off-by: Stanley Chu Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com Signed-off-by: Alexandre Belloni commit a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 Author: Jorge Marques Date: Wed Aug 27 15:51:59 2025 +0200 i3c: master: Add driver for Analog Devices I3C Controller IP Add support for Analog Devices I3C Controller IP, an AXI-interfaced IP core that supports I3C and I2C devices, multiple speed-grades and I3C IBIs. Reviewed-by: Frank Li Signed-off-by: Jorge Marques Link: https://lore.kernel.org/r/20250827-adi-i3c-master-v9-2-04413925abe1@analog.com Signed-off-by: Alexandre Belloni commit f3317e8c36a26d3374f29b8475982a96c6d44ccf Author: Jorge Marques Date: Wed Aug 27 15:51:58 2025 +0200 dt-bindings: i3c: Add adi-i3c-master Add bindings doc for ADI I3C Controller IP core, a FPGA synthesizable IP core that implements the MIPI I3C Basic controller specification. The IP Core is versioned following Semantic Versioning 2.0.0 and ADI's open-source HDL guidelines for devicetree bindings and drivers. Reviewed-by: Conor Dooley Signed-off-by: Jorge Marques Link: https://lore.kernel.org/r/20250827-adi-i3c-master-v9-1-04413925abe1@analog.com Signed-off-by: Alexandre Belloni commit 9395b3c412933401a34845d5326afe4011bbd40f Author: Jarkko Nikula Date: Fri Sep 5 13:03:20 2025 +0300 i3c: Fix default I2C adapter timeout value Commit 3a379bbcea0a ("i3c: Add core I3C infrastructure") set the default adapter timeout for I2C transfers as 1000 (ms). However that parameter is defined in jiffies not in milliseconds. With mipi-i3c-hci driver this wasn't visible until commit c0a90eb55a69 ("i3c: mipi-i3c-hci: use adapter timeout value for I2C transfers"). Fix this by setting the default timeout as HZ (CONFIG_HZ) not 1000. Fixes: 1b84691e7870 ("i3c: dw: use adapter timeout value for I2C transfers") Fixes: be27ed672878 ("i3c: master: cdns: use adapter timeout value for I2C transfers") Fixes: c0a90eb55a69 ("i3c: mipi-i3c-hci: use adapter timeout value for I2C transfers") Fixes: a747e01adad2 ("i3c: master: svc: use adapter timeout value for I2C transfers") Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller") Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Cc: stable@vger.kernel.org # 6.17 Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250905100320.954536-1-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit a4ea64abb480a74c625424e617f6be80cfc26898 Author: Jarkko Nikula Date: Wed Aug 27 13:30:09 2025 +0300 i3c: mipi-i3c-hci: Convert remaining DBG() prints to dev_dbg() Get rid of local DBG() macro and convert remaining debug prints to dev_dbg() which can be controlled without code recompile when kernel is built with dynamic debug support. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20250827103009.243771-6-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit a00e15f34e5e08481c858af6ed694d98a0fbf744 Author: Jarkko Nikula Date: Wed Aug 27 13:30:08 2025 +0300 i3c: mipi-i3c-hci: Remove function enter DBG() printouts These function enter DBG("") printouts are not very useful in error report point of view because they require code recompile. In which case they can be replaced with more informative debug prints if needed so remove them for now. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20250827103009.243771-5-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit 4470c85ed54d30b1e25f2096c808459204725045 Author: Jarkko Nikula Date: Wed Aug 27 13:30:07 2025 +0300 i3c: mipi-i3c-hci: Uniform ring number printouts Use the same "Ring" prefix in all prints that print out the ring number. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250827103009.243771-4-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit 422d0e401e13f6effdff0ae669fe1c81059cb91f Author: Jarkko Nikula Date: Wed Aug 27 13:30:06 2025 +0300 i3c: mipi-i3c-hci: Remove nonexistent ring interrupt Ring interrupt bit 7, INTR_WARN_INS_STOP_MODE was probably drafted at some point but is marked as reserved in the MIPI I3C HCI specification versions 1.1 and 1.2 that came out after the initial code and also in the earlier specification versions so remove it. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250827103009.243771-3-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit fc09ffd3a658901b9262f5aedffb4663a2b1dcf5 Author: Jarkko Nikula Date: Wed Aug 27 13:30:05 2025 +0300 i3c: mipi-i3c-hci: Change interrupt status prints to dev_dbg() Change interrupt status prints from local DBG() macro to dev_dbg() in order to make it easier to enable them without needing to recompile code with DEBUG defined. While doing so, spell out the status register names as they are in the specification to make it easier to differentiate between different interrupt status registers. Since dynamic debug prints can include the line number remove the "(in)" and "(out)" markers from the PIO interrupt status prints. Prefix the ring interrupt status print using "Ring %d" instead of "rh%d" to make it uniform across all other prints showing the ring number. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250827103009.243771-2-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit ec01115194142e39a06142447de88117365c90b3 Author: Jarkko Nikula Date: Fri Aug 22 13:56:30 2025 +0300 i3c: mipi-i3c-hci: Use own DMA bounce buffer management for I2C transfers Stop using I2C DMA-safe API for two reasons: - Not needed if driver is using PIO mode. - DMA transfers needs a DWORD align sized receive bounce buffer when the device DMA is IOMMU mapped, which is causing needless double bounce buffering in that case. Cc: Billy Tsai Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250822105630.2820009-5-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit 9e23897bca622eae20d2c038cc09b45bfaf5aed2 Author: Jarkko Nikula Date: Fri Aug 22 13:56:29 2025 +0300 i3c: mipi-i3c-hci: Use physical device pointer with DMA API DMA transfer faults on Intel hardware when the IOMMU is enabled and driver initialization will fail when attempting to do the first transfer: DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Read NO_PASID] Request device [00:11.0] fault addr 0x676e3000 [fault reason 0x71] SM: Present bit in first-level paging entry is clear i3c mipi-i3c-hci.0: ring 0: Transfer Aborted mipi-i3c-hci mipi-i3c-hci.0: probe with driver mipi-i3c-hci failed with error -62 Reason for this is that the IOMMU setup is done for the physical devices only and not for the virtual I3C Controller device object. Therefore use the pointer to a physical device object with the DMA API. Due to a data corruption observation when the device DMA is IOMMU mapped, a properly sized receive bounce buffer is required if transfer length is not a multiple of DWORDs. Reported-by: Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250822105630.2820009-4-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit 1c46bfc4f75e7d43261af65b64e7d3dc4a30daa9 Author: Jarkko Nikula Date: Fri Aug 22 13:56:28 2025 +0300 i3c: mipi-i3c-hci: Use core helpers for DMA mapping and bounce buffering So far only I3C private and I2C transfers have required a bounce buffer for DMA transfers when buffer is not DMA'able. It was observed that when the device DMA is IOMMU mapped and the receive length is not a multiple of DWORDs (32-bit), the last DWORD is padded with stale data from the RX FIFO, corrupting 1-3 bytes beyond the expected data. A similar issue, though less severe, occurs when an I3C target returns less data than requested. In this case, the padding does not exceed the requested number of bytes, assuming the device DMA is not IOMMU mapped. Therefore, all I3C private transfer, CCC command payload and I2C transfer receive buffers must be properly sized for the DMA being IOMMU mapped. Even if those buffers are already DMA safe, their size may not be DWORD aligned. To prepare for the device DMA being IOMMU mapped and to address the above issue, use helpers from I3C core for DMA mapping and bounce buffering for all DMA transfers. For now, require bounce buffer only when the buffer is in the vmalloc() area to avoid unnecessary copying with CCC commands and DMA-safe I2C transfers. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250822105630.2820009-3-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit f8d9e56aeb87ce82ce8636cd176cc59b69aa0e41 Author: Jarkko Nikula Date: Fri Aug 22 13:56:27 2025 +0300 i3c: master: Add helpers for DMA mapping and bounce buffer handling Some I3C controllers such as MIPI I3C HCI may pad the last DWORD (32-bit) with stale data from the RX FIFO in DMA transfers if the receive length is not DWORD aligned and when the device DMA is IOMMU mapped. In such a case, a properly sized bounce buffer is required in order to avoid possible data corruption. In a review discussion, proposal was to have a common helpers in I3C core for DMA mapping and bounce buffer handling. Drivers may use the helper i3c_master_dma_map_single() to map a buffer for a DMA transfer. It internally allocates a bounce buffer if buffer is not DMA'able or when the driver requires it for a transfer. Helper i3c_master_dma_unmap_single() does the needed cleanups and data copying from the bounce buffer. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250822105630.2820009-2-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit d515503f3c8a8475b2f78782534aad09722904e1 Author: Jarkko Nikula Date: Fri Aug 8 16:17:32 2025 +0300 i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C Add I3C controller PCI IDs on Intel Wildcat Lake-U. Signed-off-by: Jarkko Nikula Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250808131732.1213227-1-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni commit 1a869168d91f1a1a2b0db22cea0295c67908e5d8 Author: Zongyao Bai Date: Tue Sep 16 05:47:15 2025 +0800 drm/xe/sysfs: Add cleanup action in xe_device_sysfs_init On partial failure, some sysfs files created before the failure might not be removed. Add common cleanup step to remove them all immediately, as is should be harmless to attempt to remove non-existing files. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Cc: Lucas De Marchi Cc: Stuart Summers Cc: Shuicheng Lin Cc: Michal Wajdeczko Signed-off-by: Zongyao Bai Reviewed-by: Shuicheng Lin Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250915214716.1327379-2-zongyao.bai@intel.com Signed-off-by: Lucas De Marchi commit f8f7cc59dcd234f0dcc4964ff2188a7a2ae09fd6 Author: Jens Glathe Date: Mon Sep 15 09:35:06 2025 +0200 arm64: dts: qcom: x1-hp-x14: Add support for X1P42100 HP Omnibook X14 These laptops are the same as the already known 14-fe0xxx models, but with a Purwa SoC, SKU number 14-fe1xxx. [1] The supported features are the same as for the original Omnibook X14: - Keyboard (no function keys though) - Display - PWM brightness control - Touchpad - Touchscreen - PCIe ports (pcie4, pcie6a) - USB type-c, type-a - WCN6855 Wifi-6E - WCN6855 Bluetooth - ADSP and CDSP - X1 GPU - GPIO Keys (Lid switch) - Audio definition (works via USB and with internal speakers) [1]: https://www.hp.com/us-en/shop/pdp/hp-omnibook-x-laptop-next-gen-ai-pc-14-fe100-14-a4nd1av-1#techSpecs Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250915-hp-x14-x1p-v9-3-fa457ca30ffe@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 72b50c2fd887f632501ce69e03d8e6bb35c8a1e8 Author: Jens Glathe Date: Mon Sep 15 09:35:05 2025 +0200 arm64: dts: qcom: x1-hp-x14: Unify HP Omnibook X14 device tree structure Extract common elements into a shared .dtsi file for HP Omnibook X14 to support both Hamoa (x1e*/x1p6*) and Purwa (x1p4*/x1*) variants. Required because the device trees are not compatible. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250915-hp-x14-x1p-v9-2-fa457ca30ffe@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit a58d6100ee2c4a732fb4e1520885958480a82110 Author: Jens Glathe Date: Mon Sep 15 09:35:04 2025 +0200 dt-bindings: arm: qcom: Add HP Omnibook X14 AI X1P4200 variant The HP Omnibook X14 AI PC is available in fe0 (Hamoa, x1e80100) and fe1 (Purwa, x1p42100) SKUs. Since they are not completely dtb-compatible, add another variant: hp,omnibook-x14-fe1 compatible to cqom,x1p42100 Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250915-hp-x14-x1p-v9-1-fa457ca30ffe@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 747436750bc0ef73be32391bd5d0d7dcd185da7f Author: Ryan Wanner Date: Wed Sep 10 09:20:38 2025 -0700 ARM: at91: pm: Remove 2.5V regulator Remove 2.5V regulator since enabling and disabling this regulator is no longer supported. Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/a6785a40648b315a07152bca261a42bbf0f356af.1757519351.git.Ryan.Wanner@microchip.com Signed-off-by: Nicolas Ferre commit 5b27dfb1d7b59db9e72766c990a3ee80e39e4f69 Author: Gerald Schaefer Date: Tue Sep 9 15:46:26 2025 +0200 s390/dcssblk: Add DAX support With ZONE_DEVICE now available for s390, struct pages can be allocated for proper DAX support in dcssblk driver via devm_memremap_pages(). Adding struct pages for a range requires that the range is aligned to SUBSECTION_SIZE, which is defined as 2 MB in common code. Therefore, only enable DAX support and allocate struct pages for DCSS ranges that are aligned to 2 MB. Signed-off-by: Gerald Schaefer Acked-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit 435712ac13a58ba006af741b8d759034a69b808d Author: Vandhiadevan Karunamoorthy Date: Mon Sep 15 13:24:18 2025 +0400 arm64: dts: qcom: ipq5018: add QUP3 I2C node Add node to support I2C bus inside of IPQ5018. Signed-off-by: Vandhiadevan Karunamoorthy Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250915-ipq5018-i2c-v1-1-46bbf27396d6@outlook.com Signed-off-by: Bjorn Andersson commit c4376ad753566e44f8e9198b7f05f79145419cd3 Author: Stephan Gerhold Date: Mon Sep 15 12:06:20 2025 +0200 arm64: dts: qcom: x1e80100-dell-xps13-9345: Enable IRIS Enable IRIS to allow using the hardware-accelerated video codecs. The firmware is not upstream in linux-firmware yet, so users need to copy it from Windows to qcom/x1e80100/dell/xps13-9345/qcvss8380.mbn (just like GPU/ADSP/CDSP firmware). Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-9-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit a80ead38c51e93ed6f19733f2cbdb93abab4dbf8 Author: Stephan Gerhold Date: Mon Sep 15 12:06:19 2025 +0200 arm64: dts: qcom: x1e80100-dell-latitude-7455: Enable IRIS Enable IRIS to allow using the hardware-accelerated video codecs. The firmware is not upstream in linux-firmware yet, so users need to copy it from Windows to qcom/x1e80100/dell/latitude-7455/qcvss8380.mbn (just like GPU/ADSP/CDSP firmware). Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-8-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit 647198bd7101cd399b3dbae96630d72db68b8752 Author: Stephan Gerhold Date: Mon Sep 15 12:06:18 2025 +0200 arm64: dts: qcom: x1e80100-dell-inspiron-14-plus-7441: Enable IRIS Enable IRIS to allow using the hardware-accelerated video codecs. The firmware is not upstream in linux-firmware yet, so users need to copy it from Windows to qcom/x1e80100/dell/inspiron-14-plus-7441/qcvss8380.mbn (just like GPU/ADSP/CDSP firmware). Signed-off-by: Stephan Gerhold Tested-by: Bryan O'Donoghue Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-7-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit 98180f6796925abdfce26e44671048fd05387190 Author: Stephan Gerhold Date: Mon Sep 15 12:06:17 2025 +0200 arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Enable IRIS IRIS firmware for the Lenovo Yoga Slim 7x is already upstream in linux-firmware at qcom/x1e80100/LENOVO/83ED/qcvss8380.mbn, so enable IRIS for the Slim 7x with the corresponding firmware-name property. Tested-by: Anthony Ruhier Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-6-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit ee2d56bb33d5fe17155e933326fb0f9b7ff1d034 Author: Stephan Gerhold Date: Mon Sep 15 12:06:16 2025 +0200 arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Enable IRIS IRIS firmware for the Lenovo ThinkPad T14s is already upstream in linux-firmware at qcom/x1e80100/LENOVO/21N1/qcvss8380.mbn, so enable IRIS for the T14s with the corresponding firmware-name property. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-5-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit e2367a67b3de64e1972cd6fdb8029c974fc3b2fc Author: Stephan Gerhold Date: Mon Sep 15 12:06:15 2025 +0200 arm64: dts: qcom: x1e80100-crd: Enable IRIS video codec IRIS firmware for x1e80100-crd is already upstream in linux-firmware in the default path, so enable IRIS for the CRD to accelerate video decoding. It looks like the X1P CRD might need a different IRIS firmware (possibly even changes in the Linux kernel driver), so keep it local to the X1E CRD for now. Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-4-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit c0f045e303e014cec5d883edf82fe5de74769944 Author: Stephan Gerhold Date: Mon Sep 15 12:06:14 2025 +0200 arm64: dts: qcom: x1-el2: Disable IRIS for now The reset and IOMMU management for remoteprocs like IRIS is implemented in the hypervisor for older targets such as X1E [1]. When booting Linux/KVM directly in EL2, this functionality is missing and the PAS interface normally used by IRIS to boot the video firmware is not working. The Venus driver supports starting the video firmware without using the PAS interface. The same code also works for X1E when using KVM. However, for the new IRIS dt-bindings it was decided to avoid using the dummy "video-firmware" node in the device tree to describe the IOMMU [2]. Discussion is still ongoing how to describe this properly [3]. To avoid regressions when running using KVM, add a TODO in x1-el2.dtso for now and disable IRIS even when it was enabled by the board. [1]: https://resources.linaro.org/en/resource/sF8jXifdb9V1mUefdbfafa [2]: https://lore.kernel.org/r/20250823155349.22344-2-krzysztof.kozlowski@linaro.org/ [3]: https://lore.kernel.org/r/20250819165447.4149674-12-mukesh.ojha@oss.qualcomm.com/ Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-3-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit 9065340ac04dd8a1b07da0f024aa3a1e4dd2cffb Author: Stephan Gerhold Date: Mon Sep 15 12:06:13 2025 +0200 arm64: dts: qcom: x1e80100: Add IRIS video codec Add the IRIS video codec to accelerate video decoding/encoding. Copied mostly from sm8550.dtsi, only the opp-table is slightly different for X1E. For opp-240000000, we need to vote for a higher OPP on one of the power domains, because the voltage requirements for the PLL and the derived clocks differ (sm8550.dtsi has the same). Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue # x1e Inspiron 14p Tested-by: Neil Armstrong # on Thinkpad T14S OLED Tested-by: Anthony Ruhier # Lenovo Slim 7x Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-2-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit 893e2abc1ae35f67f29909cd062cff978bf26b44 Author: Stephan Gerhold Date: Mon Sep 15 12:06:12 2025 +0200 arm64: dts: qcom: sm8550/sm8650: Fix typo in IRIS comment It should be "enable on boards", not "enable in boards". Reported-by: Alexey Klimov Closes: https://lore.kernel.org/r/DCQ8G73ISXHC.3V03MOGB6NDZE@linaro.org/ Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250915-x1e-iris-dt-v2-1-1f928de08fd4@linaro.org Signed-off-by: Bjorn Andersson commit 456dcaf570043e60978352da9b2a55d067fd290b Author: Stephan Gerhold Date: Mon Sep 15 15:28:32 2025 +0200 arm64: dts: qcom: msm8916: Add SDCC resets Add the missing resets for the two SDCC controllers to allow fully resetting previous hardware state from the bootloader. Signed-off-by: Stephan Gerhold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250915-msm8916-resets-v1-3-a5c705df0c45@linaro.org Signed-off-by: Bjorn Andersson commit f73c82c855e186e9b67125e3eee743960320e43c Author: Stephan Gerhold Date: Mon Sep 15 15:28:31 2025 +0200 arm64: dts: qcom: msm8939: Add missing MDSS reset On most MSM8939 devices, the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state. The reset for MDSS is currently missing in msm8939.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers: dsi_err_worker: status=6 dsi_err_worker: status=6 dsi_err_worker: status=6 ... It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module. Cc: stable@vger.kernel.org Fixes: 61550c6c156c ("arm64: dts: qcom: Add msm8939 SoC") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250915-msm8916-resets-v1-2-a5c705df0c45@linaro.org Signed-off-by: Bjorn Andersson commit 99b78773c2ae55dcc01025f94eae8ce9700ae985 Author: Stephan Gerhold Date: Mon Sep 15 15:28:30 2025 +0200 arm64: dts: qcom: msm8916: Add missing MDSS reset On most MSM8916 devices (aside from the DragonBoard 410c), the bootloader already initializes the display to show the boot splash screen. In this situation, MDSS is already configured and left running when starting Linux. To avoid side effects from the bootloader configuration, the MDSS reset can be specified in the device tree to start again with a clean hardware state. The reset for MDSS is currently missing in msm8916.dtsi, which causes errors when the MDSS driver tries to re-initialize the registers: dsi_err_worker: status=6 dsi_err_worker: status=6 dsi_err_worker: status=6 ... It turns out that we have always indirectly worked around this by building the MDSS driver as a module. Before v6.17, the power domain was temporarily turned off until the module was loaded, long enough to clear the register contents. In v6.17, power domains are not turned off during boot until sync_state() happens, so this is no longer working. Even before v6.17 this resulted in broken behavior, but notably only when the MDSS driver was built-in instead of a module. Cc: stable@vger.kernel.org Fixes: 305410ffd1b2 ("arm64: dts: msm8916: Add display support") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250915-msm8916-resets-v1-1-a5c705df0c45@linaro.org Signed-off-by: Bjorn Andersson commit 9feef33b3f18eb370364a5838ed14baba10f3368 Author: Alok Tiwari Date: Mon Sep 15 13:01:26 2025 -0700 arm64: dts: qcom: sm8150: Fix reg base of frame@17c27000 The frame@17c27000 node uses the wrong base address 0x17c26000. This does not match the node name. Update the reg property to use the correct base address 0x17c27000, which matches the node name and avoids the overlap. Fixes: e13c6d144fa0 ("arm64: dts: qcom: sm8150: Add base dts file") Signed-off-by: Alok Tiwari Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250915200132.774377-1-alok.a.tiwari@oracle.com Signed-off-by: Bjorn Andersson commit a319cf4a4b09a1dd3b2652fc96f4f08c0647ae64 Author: Bjorn Andersson Date: Mon Sep 15 23:24:17 2025 -0500 arm64: dts: qcom: qcm6490: Introduce the Particle Tachyon The Particle Tachyon is a single board computer with 5G connectivity with AI accelerator, based on the Qualcomm QCM6490 platform. Introduce the board, with support for UFS, USB, USB Type-C PD and altmode (DisplayPort), GPU, charger/battery status, PCIe shield, SD-card, and remoteprocs. Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250915-tachyon-v2-3-4f8b02a17512@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b727cf24feb56a93f7bafbcdce7ea99b9ccb16cd Author: Bjorn Andersson Date: Mon Sep 15 23:24:16 2025 -0500 dt-bindings: arm: qcom: Add Particle Tachyon The Particle Tachyon is a single board computer with 5G connectivity with AI accelerator, based on the Qualcomm QCM6490 platform. Document the top-level compatible for this board. Acked-by: Rob Herring (Arm) Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250915-tachyon-v2-2-4f8b02a17512@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3bc3ff8fd2fe5886043b38d3d3c9d6ecb12d0a83 Author: Bjorn Andersson Date: Mon Sep 15 23:24:15 2025 -0500 dt-bindings: vendor-prefixes: Add Particle Industries Particle is a San Francisco-based company providing an integrated IoT Platform-as-a-Service. https://www.particle.io/ Acked-by: Rob Herring (Arm) Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250915-tachyon-v2-1-4f8b02a17512@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 22420da3662a69d8894ee624494213a5888a1e87 Author: Aleksandrs Vinarskis Date: Wed Sep 10 14:01:09 2025 +0200 dt-bindings: leds: Unify 'leds' property A number of existing schemas use 'leds' property to provide phandle-array of LED(s) to the consumer. Additionally, with the upcoming privacy-led support in device-tree, v4l2 subnode could be a LED consumer, meaning that all camera sensors should support 'leds' and 'led-names' property via common 'video-interface-devices.yaml'. To avoid duplication, unify 'leds' property from existing schemas to newly introduced 'led-consumer.yaml'. Signed-off-by: Aleksandrs Vinarskis Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250910-leds-v5-2-bb90a0f897d5@vinarskis.com Signed-off-by: Lee Jones commit 3f5df63955756fbe253a2a26043accf7318fa53a Author: Aleksandrs Vinarskis Date: Wed Sep 10 14:01:08 2025 +0200 dt-bindings: leds: Add generic LED consumer documentation Introduce common generic led consumer binding, where consumer defines led(s) by phandle, as opposed to trigger-source binding where the trigger source is defined in led itself. Add already used in some schemas 'leds' parameter which expects phandle-array. Additionally, introduce 'led-names' which could be used by consumers to map LED devices to their respective functions. Signed-off-by: Aleksandrs Vinarskis Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250910-leds-v5-1-bb90a0f897d5@vinarskis.com Signed-off-by: Lee Jones commit 71ee90ed1756724d62cb55873555e006372792c7 Author: Mohd Ayaan Anwar Date: Tue Sep 16 16:16:58 2025 +0530 arm64: dts: qcom: lemans-evk: Enable 2.5G Ethernet interface Enable the QCA8081 2.5G Ethernet PHY on port 0. Add MDC and MDIO pin functions for ethernet0, and enable the internal SGMII/SerDes PHY node. Additionally, support fetching the MAC address from EEPROM via an nvmem cell. Signed-off-by: Mohd Ayaan Anwar Reviewed-by: Konrad Dybcio Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-10-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c3f107b514c357cbc08ae70a69700222e7d1192d Author: Monish Chunara Date: Tue Sep 16 16:16:57 2025 +0530 arm64: dts: qcom: lemans-evk: Enable SDHCI for SD Card Enable the SD Host Controller Interface (SDHCI) on the lemans EVK board to support SD card for storage. Also add the corresponding regulators. Signed-off-by: Monish Chunara Reviewed-by: Konrad Dybcio Signed-off-by: Wasim Nazir Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-9-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7bd68ef80661a9436120702e1300b56904fdd022 Author: Krishna Kurapati Date: Tue Sep 16 16:16:56 2025 +0530 arm64: dts: qcom: lemans-evk: Enable first USB controller in device mode Enable the first USB controller in device mode on the Lemans EVK board and configure the associated LDO regulators to power the PHYs accordingly. The USB port is a Type-C port controlled by HD3SS3320 port controller. The role switch notifications would need to be routed to glue driver by adding an appropriate usb-c-connector node in DT. However in the design, the vbus supply that is to be provided to connected peripherals when port is configured as an DFP, is controlled by a GPIO. There is also one ID line going from Port controller chip to GPIO-50 of the SoC. As per the datasheet of HD3SS3320: "Upon detecting a UFP device, HD3SS3220 will keep ID pin high if VBUS is not at VSafe0V. Once VBUS is at VSafe0V, the HD3SS3220 will assert ID pin low. This is done to enforce Type-C requirement that VBUS must be at VSafe0V before re-enabling VBUS." The current HD3SS3220 driver doesn't have this functionality present. So, putting the first USB controller in device mode for now. Once the vbus control based on ID pin is implemented in hd3ss3220.c, the usb-c-connector will be implemented and dr mode would be made OTG. Signed-off-by: Krishna Kurapati Reviewed-by: Konrad Dybcio Signed-off-by: Wasim Nazir Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-8-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fd32b5d586ac650ce1c6f58535ec79cd2632be09 Author: Vikash Garodia Date: Tue Sep 16 16:16:55 2025 +0530 arm64: dts: qcom: lemans-evk: Enable Iris video codec support Enable the Iris video codec accelerator on the Lemans EVK board and reference the appropriate firmware required for its operation. This allows hardware-accelerated video encoding and decoding using the Iris codec engine. Signed-off-by: Vikash Garodia Reviewed-by: Konrad Dybcio Signed-off-by: Wasim Nazir Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-7-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cac44c46970adb4553bab5c5aa528462a5fe98d0 Author: Wasim Nazir Date: Tue Sep 16 16:16:54 2025 +0530 arm64: dts: qcom: lemans-evk: Enable remoteproc subsystems Enable remoteproc subsystems for supported DSPs such as Audio DSP, Compute DSP-0/1 and Generic DSP-0/1, along with their corresponding firmware. Signed-off-by: Wasim Nazir Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-6-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 94d7d37f6ac34bd683a93fbf1013736616fc3677 Author: Sushrut Shree Trivedi Date: Tue Sep 16 16:16:53 2025 +0530 arm64: dts: qcom: lemans-evk: Enable PCIe support Enable PCIe0 and PCIe1 along with the respective phy-nodes. PCIe0 is routed to an m.2 E key connector on the mainboard for wifi attaches while PCIe1 routes to a standard PCIe x4 expansion slot. Signed-off-by: Sushrut Shree Trivedi Signed-off-by: Wasim Nazir Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-5-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 81618ba3fe33017be5e1fce99891abd220a775b8 Author: Monish Chunara Date: Tue Sep 16 16:16:52 2025 +0530 arm64: dts: qcom: lemans-evk: Add EEPROM and nvmem layout Integrate the GT24C256C EEPROM via I2C to enable access to board-specific non-volatile data. Also, define an nvmem-layout to expose structured regions within the EEPROM, allowing consumers to retrieve configuration data such as Ethernet MAC addresses via the nvmem subsystem. Signed-off-by: Monish Chunara Reviewed-by: Konrad Dybcio Reviewed-by: Bartosz Golaszewski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-4-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6ae6381f871803246e9f655537999f163656de33 Author: Nirmesh Kumar Singh Date: Tue Sep 16 16:16:51 2025 +0530 arm64: dts: qcom: lemans-evk: Add TCA9534 I/O expander Integrate the TCA9534 I/O expander via I2C to provide 8 additional GPIO lines for extended I/O functionality. Signed-off-by: Nirmesh Kumar Singh Reviewed-by: Konrad Dybcio Reviewed-by: Bartosz Golaszewski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-3-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5bc646aa0c7a444d4e81d8e3cae4baf463e1a018 Author: Viken Dadhaniya Date: Tue Sep 16 16:16:50 2025 +0530 arm64: dts: qcom: lemans-evk: Enable GPI DMA and QUPv3 controllers Enable GPI DMA controllers (gpi_dma0, gpi_dma1, gpi_dma2) and QUPv3 interfaces (qupv3_id_0, qupv3_id_2) in the device tree to support DMA and peripheral communication on the Lemans EVK platform. qupv3_id_0 provides access to I2C/SPI/UART instances 0-5. qupv3_id_2 provides access to I2C/SPI/UART instances 14-20. Signed-off-by: Viken Dadhaniya Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-2-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit dfdbe4bf6ff386d96c1dc8c7407201d882fc4113 Author: Monish Chunara Date: Tue Sep 16 16:16:49 2025 +0530 arm64: dts: qcom: lemans: Add SDHC controller and SDC pin configuration Introduce the SDHC v5 controller node for the Lemans platform. This controller supports either eMMC or SD-card, but only one can be active at a time. SD-card is the preferred configuration on Lemans targets, so describe this controller. Define the SDC interface pins including clk, cmd, and data lines to enable proper communication with the SDHC controller. Signed-off-by: Monish Chunara Reviewed-by: Konrad Dybcio Co-developed-by: Wasim Nazir Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250916-lemans-evk-bu-v5-1-53d7d206669d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 285cae57a51664cc94e85de0ff994f9965b3aca8 Author: Thomas Weißschuh Date: Tue Sep 16 08:15:46 2025 +0200 kunit: Extend kconfig help text for KUNIT_UML_PCI Checkpatch.pl expects at least 4 lines of help text. Extend the help text to make checkpatch.pl happy. Link: https://lore.kernel.org/r/20250916-kunit-pci-kconfig-v1-1-6d1369f06f2a@linutronix.de Fixes: 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()") Suggested-by: Shuah Khan Link: https://lore.kernel.org/lkml/3dc95227-2be9-48a0-bdea-3f283d9b2a38@linuxfoundation.org/ Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Signed-off-by: Shuah Khan commit c652dc44192d96820d73a7ecd89d275ca7e4355d Author: Kaibo Ma Date: Mon Sep 15 22:12:56 2025 -0400 rust: kunit: allow `cfg` on `test`s The `kunit_test` proc macro only checks for the `test` attribute immediately preceding a `fn`. If the function is disabled via a `cfg`, the generated code would result in a compile error referencing a non-existent function [1]. This collects attributes and specifically cherry-picks `cfg` attributes to be duplicated inside KUnit wrapper functions such that a test function disabled via `cfg` compiles and is marked as skipped in KUnit correctly. Link: https://lore.kernel.org/r/20250916021259.115578-1-ent3rm4n@gmail.com Link: https://lore.kernel.org/rust-for-linux/CANiq72==48=69hYiDo1321pCzgn_n1_jg=ez5UYXX91c+g5JVQ@mail.gmail.com/ [1] Closes: https://github.com/Rust-for-Linux/linux/issues/1185 Suggested-by: Miguel Ojeda Suggested-by: David Gow Signed-off-by: Kaibo Ma Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 32d4cedd24ed346edbe063323ed495d685e033df Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:29 2025 +0200 MAINTAINERS: Add entry on MAX7360 driver Add myself as maintainer of Maxim MAX7360 driver and device-tree bindings. Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-10-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit 229c15e9a69cb3d6a303a9e20b10fb991b66895d Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:28 2025 +0200 input: misc: Add support for MAX7360 rotary Add driver for Maxim Integrated MAX7360 rotary encoder controller, supporting a single rotary switch. Acked-by: Dmitry Torokhov Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-9-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit fa6a23f1c59c67de9160b4acc5a8651ad2106fa8 Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:27 2025 +0200 input: keyboard: Add support for MAX7360 keypad Add driver for Maxim Integrated MAX7360 keypad controller, providing support for up to 64 keys, with a matrix of 8 columns and 8 rows. Acked-by: Dmitry Torokhov Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-8-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit b1a7433d857edb14b993161af9ed1ee98d4c9cee Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:26 2025 +0200 gpio: max7360: Add MAX7360 gpio support Add driver for Maxim Integrated MAX7360 GPIO/GPO controller. Two sets of GPIOs are provided by the device: - Up to 8 GPIOs, shared with the PWM and rotary encoder functionalities. These GPIOs also provide interrupts on input changes. - Up to 6 GPOs, on unused keypad columns pins. Co-developed-by: Kamel Bouhara Signed-off-by: Kamel Bouhara Acked-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-7-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit 0627b71fa5508ab605b6e9fd74baed40805cfdda Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:25 2025 +0200 gpio: regmap: Allow to provide init_valid_mask callback Allows to populate the gpio_regmap_config structure with init_valid_mask() callback to set on the final gpio_chip structure. Reviewed-by: Michael Walle Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Reviewed-by: Bartosz Golaszewski Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-6-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit 553b75d4bfe9264f631d459fe9996744e0672b0e Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:24 2025 +0200 gpio: regmap: Allow to allocate regmap-irq device GPIO controller often have support for IRQ: allow to easily allocate both gpio-regmap and regmap-irq in one operation. Reviewed-by: Andy Shevchenko Acked-by: Bartosz Golaszewski Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-5-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit d93a75d94b79ba3e664f7236ee05790e8b1d0e4b Author: Kamel Bouhara Date: Sun Aug 24 13:57:23 2025 +0200 pwm: max7360: Add MAX7360 PWM support Add driver for Maxim Integrated MAX7360 PWM controller, supporting up to 8 independent PWM outputs. Signed-off-by: Kamel Bouhara Co-developed-by: Mathieu Dubois-Briand Signed-off-by: Mathieu Dubois-Briand Reviewed-by: Andy Shevchenko Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-4-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit b4b993c0e39436ffb3a9b21cabf62b5df085b2e1 Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:22 2025 +0200 pinctrl: Add MAX7360 pinctrl driver Add driver for Maxim Integrated MAX7360 pinctrl on the PORT pins. Pins can be used either for GPIO, PWM or rotary encoder functionalities. Signed-off-by: Mathieu Dubois-Briand Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-3-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit a22ddeef55c4df847d9ac862b6192da774948fe1 Author: Kamel Bouhara Date: Sun Aug 24 13:57:21 2025 +0200 mfd: Add max7360 support Add core driver to support MAX7360 i2c chip, multi function device with keypad, GPIO, PWM, GPO and rotary encoder submodules. Signed-off-by: Kamel Bouhara Co-developed-by: Mathieu Dubois-Briand Signed-off-by: Mathieu Dubois-Briand Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-2-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit aee814458fb98819876442f0261fad0bb9842224 Author: Mathieu Dubois-Briand Date: Sun Aug 24 13:57:20 2025 +0200 dt-bindings: mfd: gpio: Add MAX7360 Add device tree bindings for Maxim Integrated MAX7360 device with support for keypad, rotary, gpios and pwm functionalities. Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Krzysztof Kozlowski Signed-off-by: Mathieu Dubois-Briand Link: https://lore.kernel.org/r/20250824-mdb-max7360-support-v14-1-435cfda2b1ea@bootlin.com Signed-off-by: Lee Jones commit d463bb140583609f78f61d48c3dfb6f46c5cb062 Author: Ming Yu Date: Fri Sep 12 17:19:52 2025 +0800 rtc: Add Nuvoton NCT6694 RTC support This driver supports RTC functionality for NCT6694 MFD device based on USB interface. Acked-by: Alexandre Belloni Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-8-a0282524688@gmail.com Signed-off-by: Lee Jones commit 197e779d29d87961be12eb6429dda472a843830f Author: Ming Yu Date: Fri Sep 12 17:19:51 2025 +0800 hwmon: Add Nuvoton NCT6694 HWMON support This driver supports Hardware monitor functionality for NCT6694 MFD device based on USB interface. Reviewed-by: Guenter Roeck Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-7-a0282524688@gmail.com Signed-off-by: Lee Jones commit f9d737a7d84ff4c1df4244361e66ddda400678dc Author: Ming Yu Date: Fri Sep 12 17:19:50 2025 +0800 watchdog: Add Nuvoton NCT6694 WDT support This driver supports Watchdog timer functionality for NCT6694 MFD device based on USB interface. Acked-by: Guenter Roeck Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-6-a0282524688@gmail.com Signed-off-by: Lee Jones commit 8a204684d0ffdf8d39c16d70fc6f1000e831ef27 Author: Ming Yu Date: Fri Sep 12 17:19:49 2025 +0800 can: Add Nuvoton NCT6694 CANFD support This driver supports Socket CANFD functionality for NCT6694 MFD device based on USB interface. Reviewed-by: Marc Kleine-Budde Reviewed-by: Vincent Mailhol Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-5-a0282524688@gmail.com Signed-off-by: Lee Jones commit c5cf27dbaeb6e12ea1703ee896dd4b42e92343aa Author: Ming Yu Date: Fri Sep 12 17:19:48 2025 +0800 i2c: Add Nuvoton NCT6694 I2C support This driver supports I2C adapter functionality for NCT6694 MFD device based on USB interface. Each I2C controller uses the default baudrate of 100kHz, which can be overridden via module parameters. Acked-by: Andi Shyti Reviewed-by: Wolfram Sang Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-4-a0282524688@gmail.com Signed-off-by: Lee Jones commit 611a995e8ae1a52e34abb80ae02800ea100bdf84 Author: Ming Yu Date: Fri Sep 12 17:19:47 2025 +0800 gpio: Add Nuvoton NCT6694 GPIO support This driver supports GPIO and IRQ functionality for NCT6694 MFD device based on USB interface. Reviewed-by: Linus Walleij Acked-by: Bartosz Golaszewski Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-3-a0282524688@gmail.com Signed-off-by: Lee Jones commit 51dad33ede63618a6b425c650f3042d85e646dac Author: Ming Yu Date: Fri Sep 12 17:19:46 2025 +0800 mfd: Add core driver for Nuvoton NCT6694 The Nuvoton NCT6694 provides an USB interface to the host to access its features. Sub-devices can use the USB functions nct6694_read_msg() and nct6694_write_msg() to issue a command. They can also request interrupt that will be called when the USB device receives its interrupt pipe. Signed-off-by: Ming Yu Link: https://lore.kernel.org/r/20250912091952.1169369-2-a0282524688@gmail.com Signed-off-by: Lee Jones commit 8b84d712ad849172f6bbcad57534b284d942b0b5 Author: Alex Elder Date: Mon Aug 25 12:20:52 2025 -0500 regulator: spacemit: support SpacemiT P1 regulators Add support for the regulators found in the SpacemiT P1 PMIC. This PMIC provides 6 buck converters and 12 LDO regulators. The PMIC is implemented as a multi-function device. These regulators are probed based on this driver being named in a MFD cell in the simple MFD I2C driver. Signed-off-by: Alex Elder Link: https://patch.msgid.link/20250825172057.163883-4-elder@riscstar.com Signed-off-by: Mark Brown commit 88d0d17192c5a850dc07bb38035b69c4cefde270 Author: Alexey Klimov Date: Mon Sep 15 17:27:48 2025 +0100 ASoC: dt-bindings: add bindings for pm4125 audio codec The audio codec IC is found on Qualcomm PM4125/PM2250 PMIC. It has TX and RX soundwire slave devices hence two files are added. Signed-off-by: Alexey Klimov Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250915-pm4125_audio_codec_v1-v4-1-b247b64eec52@linaro.org Signed-off-by: Mark Brown commit b9cb410d48b00a759f0947f2491785f4d0486c68 Author: Alexey Klimov Date: Mon Sep 15 17:27:51 2025 +0100 MAINTAINERS: add Qualcomm PM4125 audio codec to drivers list Since new audio codec driver is added the get_maintainers script should catch the new files. Signed-off-by: Alexey Klimov Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250915-pm4125_audio_codec_v1-v4-4-b247b64eec52@linaro.org Signed-off-by: Mark Brown commit 8ad5294849379543782e290e8e670b69e4580a24 Author: Alexey Klimov Date: Mon Sep 15 17:27:50 2025 +0100 ASoC: codecs: add new pm4125 audio codec driver The audio codec is found in Qualcomm PM2250/PM4125 PMICs and is used on platforms like Qualcomm QCM2290. It has soundwire interface and corresponding RX and TX slave devices. It has only two input channels: HPH left and right. The line output (LO) is linked to HPHL so the hardware has some limitations regarding concurrent playback via HPH and LO for instance. The codec driver also uses WCD MBCH framework. The MBHC functionality is implemented in a minimalistic way to enable IRQs and avoid different issues with IRQs. Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Signed-off-by: Alexey Klimov Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250915-pm4125_audio_codec_v1-v4-3-b247b64eec52@linaro.org Signed-off-by: Mark Brown commit b28a55db452edb1d997edee723d8dcbef7f065a3 Merge: 18dda9eb9e11b2 d9e33b38c89f4c Author: Mark Brown Date: Tue Sep 16 14:17:33 2025 +0100 Miscellaneous fixes and clean-ups Merge series from Santhosh Kumar K : This series introduces some small but important fixes and cleanups in the Cadence QSPI Controller. Tested on TI's AM62A SK and AM62P SK: Logs: https://gist.github.com/santhosh21/0d25767b58d9a1d9624f2c502dd8f36b commit 41b5c85ba94057c955f0f6348c551093917da06d Merge: 2e0fd4583d0efc 6a1f303cba45fa Author: Mark Brown Date: Tue Sep 16 13:52:09 2025 +0100 regulator: max77838: add max77838 regulator driver Merge series from Ivaylo Ivanov : This patchset adds support for the max77838 PMIC. It's used on the Galaxy S7 lineup of phones, and provides regulators for the display. commit f7381b9116407ba2a429977c80ff8df953ea9354 Author: Suren Baghdasaryan Date: Mon Sep 15 13:09:18 2025 -0700 slab: mark slab->obj_exts allocation failures unconditionally alloc_slab_obj_exts() should mark failed obj_exts vector allocations independent on whether the vector is being allocated for a new or an existing slab. Current implementation skips doing this for existing slabs. Fix this by marking failed allocations unconditionally. Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Reported-by: Shakeel Butt Closes: https://lore.kernel.org/all/avhakjldsgczmq356gkwmvfilyvf7o6temvcmtt5lqd4fhp5rk@47gp2ropyixg/ Signed-off-by: Suren Baghdasaryan Cc: stable@vger.kernel.org # v6.10+ Acked-by: Shakeel Butt Signed-off-by: Vlastimil Babka commit 4038016397da5c1cebb10e7c85a36d06123724a8 Author: Suren Baghdasaryan Date: Mon Sep 15 13:09:17 2025 -0700 slab: prevent warnings when slab obj_exts vector allocation fails When object extension vector allocation fails, we set slab->obj_exts to OBJEXTS_ALLOC_FAIL to indicate the failure. Later, once the vector is successfully allocated, we will use this flag to mark codetag references stored in that vector as empty to avoid codetag warnings. slab_obj_exts() used to retrieve the slab->obj_exts vector pointer checks slab->obj_exts for being either NULL or a pointer with MEMCG_DATA_OBJEXTS bit set. However it does not handle the case when slab->obj_exts equals OBJEXTS_ALLOC_FAIL. Add the missing condition to avoid extra warning. Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Reported-by: Shakeel Butt Closes: https://lore.kernel.org/all/jftidhymri2af5u3xtcqry3cfu6aqzte3uzlznhlaylgrdztsi@5vpjnzpsemf5/ Signed-off-by: Suren Baghdasaryan Cc: stable@vger.kernel.org # v6.10+ Acked-by: Shakeel Butt Signed-off-by: Vlastimil Babka commit 42c21838708c20dd8ba605e4099bf6a7156c3362 Author: Christoph Hellwig Date: Mon Sep 15 06:24:13 2025 -0700 xfs: move the XLOG_REG_ constants out of xfs_log_format.h These are purely in-memory values and not used at all in xfsprogs. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 930f2361fe542a00de9ce6070b1b6edb976f1165 Author: David Kaplan Date: Mon Sep 15 08:47:06 2025 -0500 x86/bugs: Report correct retbleed mitigation status On Intel CPUs, the default retbleed mitigation is IBRS/eIBRS but this requires that a similar spectre_v2 mitigation is applied. If the user selects a different spectre_v2 mitigation (like spectre_v2=retpoline) a warning is printed but sysfs will still report 'Mitigation: IBRS' or 'Mitigation: Enhanced IBRS'. This is incorrect because retbleed is not mitigated, and IBRS is not actually set. Fix this by choosing RETBLEED_MITIGATION_NONE in this scenario so the kernel correctly reports the system as vulnerable to retbleed. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250915134706.3201818-1-david.kaplan@amd.com commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc Author: David Kaplan Date: Mon Sep 15 08:47:05 2025 -0500 x86/bugs: Fix reporting of LFENCE retpoline The LFENCE retpoline mitigation is not secure but the kernel prints inconsistent messages about this fact. The dmesg log says 'Mitigation: LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable: LFENCE' implying the system (correctly) is not mitigated. Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere when this mitigation is selected. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250915134706.3201818-1-david.kaplan@amd.com commit 30ef245c6f5a6842d60308590cf26d0ae836fbf0 Author: David Kaplan Date: Mon Sep 15 08:47:04 2025 -0500 x86/bugs: Fix spectre_v2 forcing There were two oddities with spectre_v2 command line options. First, any option other than 'off' or 'auto' would force spectre_v2 mitigations even if the CPU (hypothetically) wasn't vulnerable to spectre_v2. That was inconsistent with all the other bugs where mitigations are ignored unless an explicit 'force' option is specified. Second, even though spectre_v2 mitigations would be enabled in these cases, the X86_BUG_SPECTRE_V2 bit wasn't set. This is again inconsistent with the forcing behavior of other bugs and arguably incorrect as it doesn't make sense to enable a mitigation if the X86_BUG bit isn't set. Fix both issues by only forcing spectre_v2 mitigations when the 'spectre_v2=on' option is specified (which was already called SPECTRE_V2_CMD_FORCE) and setting the relevant X86_BUG_* bits in that case. This also allows for simplifying bhi_update_mitigation() because spectre_v2_cmd will now always be SPECTRE_V2_CMD_NONE if the CPU is immune to spectre_v2. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250915134706.3201818-1-david.kaplan@amd.com commit 9316512b717f6f25c4649b3fdb0a905b6a318e9f Author: Christophe Leroy Date: Tue Sep 9 12:03:49 2025 +0200 powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure PAGE_KERNEL_TEXT is an old macro that is used to tell kernel whether kernel text has to be mapped read-only or read-write based on build time options. But nowadays, with functionnalities like jump_labels, static links, etc ... more only less all kernels need to be read-write at some point, and some combinations of configs failed to work due to innacurate setting of PAGE_KERNEL_TEXT. On the other hand, today we have CONFIG_STRICT_KERNEL_RWX which implements a more controlled access to kernel modifications. Instead of trying to keep PAGE_KERNEL_TEXT accurate with all possible options that may imply kernel text modification, always set kernel text read-write at startup and rely on CONFIG_STRICT_KERNEL_RWX to provide accurate protection. Do this by passing PAGE_KERNEL_X to map_kernel_page() in __maping_ram_chunk() instead of passing PAGE_KERNEL_TEXT. Once this is done, the only remaining user of PAGE_KERNEL_TEXT is mmu_mark_initmem_nx() which uses it in a call to setibat(). As setibat() ignores the RW/RO, we can seamlessly replace PAGE_KERNEL_TEXT by PAGE_KERNEL_X here as well and get rid of PAGE_KERNEL_TEXT completely. Reported-by: Erhard Furtner Closes: https://lore.kernel.org/all/342b4120-911c-4723-82ec-d8c9b03a8aef@mailbox.org/ Signed-off-by: Christophe Leroy Tested-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/8e2d793abf87ae3efb8f6dce10f974ac0eda61b8.1757412205.git.christophe.leroy@csgroup.eu commit a4ab91f470c5c84ce0c17197c1562d29aa032340 Merge: 29fa7f9e5adf31 e32dc7a936b11e Author: Paolo Abeni Date: Tue Sep 16 12:43:50 2025 +0200 Merge branch 'add-ethernet-mac-support-for-spacemit-k1' Vivian Wang says: ==================== Add Ethernet MAC support for SpacemiT K1 SpacemiT K1 has two gigabit Ethernet MACs with RGMII and RMII support. Add devicetree bindings, driver, and DTS for it. Tested primarily on BananaPi BPI-F3. Basic TX/RX functionality also tested on Milk-V Jupiter. I would like to note that even though some bit field names superficially resemble that of DesignWare MAC, all other differences point to it in fact being a custom design. Based on SpacemiT drivers [1]. These patches are also available at: https://github.com/dramforever/linux/tree/k1/ethernet/v12 [1]: https://github.com/spacemit-com/linux-k1x ==================== Link: https://patch.msgid.link/20250914-net-k1-emac-v12-0-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit e32dc7a936b11e437298bcc4601476befcbcb88f Author: Vivian Wang Date: Sun Sep 14 12:23:16 2025 +0800 riscv: dts: spacemit: Add Ethernet support for Jupiter Milk-V Jupiter uses an RGMII PHY for each port and uses GPIO for PHY reset. Signed-off-by: Vivian Wang Reviewed-by: Yixun Lan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250914-net-k1-emac-v12-5-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit 3c247a6366d5891f1ac60fe37a530acda3a12d06 Author: Vivian Wang Date: Sun Sep 14 12:23:15 2025 +0800 riscv: dts: spacemit: Add Ethernet support for BPI-F3 Banana Pi BPI-F3 uses an RGMII PHY for each port and uses GPIO for PHY reset. Tested-by: Hendrik Hamerlinck Signed-off-by: Vivian Wang Reviewed-by: Yixun Lan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250914-net-k1-emac-v12-4-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit 60775f28cfb7d46d7b1945c527929ac20e99ac44 Author: Vivian Wang Date: Sun Sep 14 12:23:14 2025 +0800 riscv: dts: spacemit: Add Ethernet support for K1 Add nodes for each of the two Ethernet MACs on K1 with generic properties. Also add "gmac" pins to pinctrl config. Signed-off-by: Vivian Wang Reviewed-by: Yixun Lan Link: https://patch.msgid.link/20250914-net-k1-emac-v12-3-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit bfec6d7f2001c7470c3cd261ae65a3ba8737f226 Author: Vivian Wang Date: Sun Sep 14 12:23:13 2025 +0800 net: spacemit: Add K1 Ethernet MAC The Ethernet MACs found on SpacemiT K1 appears to be a custom design that only superficially resembles some other embedded MACs. SpacemiT refers to them as "EMAC", so let's just call the driver "k1_emac". Supports RGMII and RMII interfaces. Includes support for MAC hardware statistics counters. PTP support is not implemented. Signed-off-by: Vivian Wang Reviewed-by: Maxime Chevallier Reviewed-by: Vadim Fedorenko Reviewed-by: Troy Mitchell Tested-by: Junhui Liu Tested-by: Troy Mitchell Link: https://patch.msgid.link/20250914-net-k1-emac-v12-2-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit 62a12a221769f102062c014dc227555d3a6a6df1 Author: Vivian Wang Date: Sun Sep 14 12:23:12 2025 +0800 dt-bindings: net: Add support for SpacemiT K1 The Ethernet MACs on SpacemiT K1 appears to be a custom design. SpacemiT refers to them as "EMAC", so let's just call them "spacemit,k1-emac". Signed-off-by: Vivian Wang Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20250914-net-k1-emac-v12-1-65b31b398f44@iscas.ac.cn Signed-off-by: Paolo Abeni commit 7cec88bfdd33434d62d4d5ba664127fa175b50e7 Author: Hari Bathini Date: Tue Sep 16 10:10:35 2025 +0530 powerpc/fprobe: fix updated fprobe for function-graph tracer Since commit 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer"), FPROBE depends on HAVE_FUNCTION_GRAPH_FREGS. With previous patch adding HAVE_FUNCTION_GRAPH_FREGS for powerpc, FPROBE can be enabled on powerpc. But with the commit b5fa903b7f7c ("fprobe: Add fprobe_header encoding feature"), asm/fprobe.h header is needed to define arch dependent encode/decode macros. The fprobe header MSB pattern on powerpc is not 0xf. So, define FPROBE_HEADER_MSB_PATTERN expected on powerpc. Also, commit 762abbc0d09f ("fprobe: Use ftrace_regs in fprobe exit handler") introduced HAVE_FTRACE_REGS_HAVING_PT_REGS for archs that have pt_regs in ftrace_regs. Advertise that on powerpc to reuse common definitions like ftrace_partial_regs(). Acked-by: Masami Hiramatsu (Google) Tested-by: Venkat Rao Bagalkote Signed-off-by: Hari Bathini Signed-off-by: Aditya Bodkhe Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250916044035.29033-2-adityab1@linux.ibm.com commit d733f18a6da6fb719450d5122162556d785ed580 Author: Aditya Bodkhe Date: Tue Sep 16 10:10:34 2025 +0530 powerpc/ftrace: support CONFIG_FUNCTION_GRAPH_RETVAL commit a1be9ccc57f0 ("function_graph: Support recording and printing the return value of function") introduced support for function graph return value tracing. Additionally, commit a3ed4157b7d8 ("fgraph: Replace fgraph_ret_regs with ftrace_regs") further refactored and optimized the implementation, making `struct fgraph_ret_regs` unnecessary. This patch enables the above modifications for powerpc all, ensuring that function graph return value tracing is available on this architecture. In this patch we have redefined two functions: - 'ftrace_regs_get_return_value()' - the existing implementation on ppc returns -ve of return value based on some conditions not relevant to our patch. - 'ftrace_regs_get_frame_pointer()' - always returns 0 in current code . We also allocate stack space to equivalent of 'SWITCH_FRAME_SIZE', allowing us to directly use predefined offsets like 'GPR3' and 'GPR4' this keeps code clean and consistent with already defined offsets . After this patch, v6.14+ kernel can also be built with FPROBE on powerpc but there are a few other build and runtime dependencies for FPROBE to work properly. The next patch addresses them. Tested-by: Venkat Rao Bagalkote Reviewed-by: Christophe Leroy Signed-off-by: Aditya Bodkhe Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250916044035.29033-1-adityab1@linux.ibm.com commit 8e2cdd8e18ff5073ad76ab2220910001eae39398 Author: Hans Holmberg Date: Mon Sep 1 10:52:05 2025 +0000 xfs: adjust the hint based zone allocation policy As we really can't make any general assumptions about files that don't have any life time hint set or are set to "NONE", adjust the allocation policy to avoid co-locating data from those files with files with a set life time. Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 0301dae732a5402a68fdb8d8461b97da6b9bccc6 Author: Hans Holmberg Date: Mon Sep 1 10:52:05 2025 +0000 xfs: refactor hint based zone allocation Replace the co-location code with a matrix that makes it more clear on how the decisions are made. The matrix contains scores for zone/file hint combinations. A "GOOD" score for an open zone will result in immediate co-location while "OK" combinations will only be picked if we cannot open a new zone. Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 94deac977fbd0246c971b4f1d17a6385f5e0b1a4 Author: Hans Holmberg Date: Mon Sep 1 10:52:04 2025 +0000 fs: add an enum for number of life time hints Add WRITE_LIFE_HINT_NR into the rw_hint enum to define the number of values write life time hints can be set to. This is useful for e.g. file systems which may want to map these values to allocation groups. Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit e747883c7d7306acb4d683038d881528fbfbe749 Author: Christoph Hellwig Date: Mon Sep 15 06:20:30 2025 -0700 xfs: fix log CRC mismatches between i386 and other architectures When mounting file systems with a log that was dirtied on i386 on other architectures or vice versa, log recovery is unhappy: [ 11.068052] XFS (vdb): Torn write (CRC failure) detected at log block 0x2. Truncating head block from 0xc. This is because the CRCs generated by i386 and other architectures always diff. The reason for that is that sizeof(struct xlog_rec_header) returns different values for i386 vs the rest (324 vs 328), because the struct is not sizeof(uint64_t) aligned, and i386 has odd struct size alignment rules. This issue goes back to commit 13cdc853c519 ("Add log versioning, and new super block field for the log stripe") in the xfs-import tree, which adds log v2 support and the h_size field that causes the unaligned size. At that time it only mattered for the crude debug only log header checksum, but with commit 0e446be44806 ("xfs: add CRC checks to the log") it became a real issue for v5 file system, because now there is a proper CRC, and regular builds actually expect it match. Fix this by allowing checksums with and without the padding. Fixes: 0e446be44806 ("xfs: add CRC checks to the log") Cc: # v3.8 Signed-off-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 0b737f4ac1d3ec093347241df74bbf5f54a7e16c Author: Christoph Hellwig Date: Mon Sep 15 06:20:29 2025 -0700 xfs: rename the old_crc variable in xlog_recover_process old_crc is a very misleading name. Rename it to expected_crc as that described the usage much better. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3e5bdfe48e1f159de7ca3b23a6afa6c10f2a9ad2 Author: Christoph Hellwig Date: Mon Sep 15 06:27:05 2025 -0700 xfs: remove the unused xfs_log_iovec_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit bf0013f59ccdb283083f0451f6edc50ff98e68c0 Author: Christoph Hellwig Date: Mon Sep 15 06:27:04 2025 -0700 xfs: remove the unused xfs_qoff_logformat_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ae1ef3272b31e6bccd9f2014e8e8c41887a5137b Author: Christoph Hellwig Date: Mon Sep 15 06:27:03 2025 -0700 xfs: remove the unused xfs_dq_logformat_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 1b5c7cc8f8c54858f69311290d5ade12627ff233 Author: Christoph Hellwig Date: Mon Sep 15 06:27:02 2025 -0700 xfs: remove the unused xfs_buf_log_format_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3dde08b64c98cf76b2e2378ecf36351464e2972a Author: Christoph Hellwig Date: Mon Sep 15 06:27:01 2025 -0700 xfs: remove the unused xfs_efd_log_format_64_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a0cb349672f9ac2dcd80afa3dd25e2df2842db7a Author: Christoph Hellwig Date: Mon Sep 15 06:27:00 2025 -0700 xfs: remove the unused xfs_efd_log_format_32_t typedef Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0a33d5ad8a46d1f63174d2684b1d743bd6090554 Author: Christoph Hellwig Date: Mon Sep 15 06:26:59 2025 -0700 xfs: remove the xfs_efd_log_format_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3fe5abc2bf4db88c7c9c99e8a1f5b3d1336d528f Author: Christoph Hellwig Date: Mon Sep 15 06:26:58 2025 -0700 xfs: remove the xfs_efi_log_format_64_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 68c9f8444ae930343a2c900cb909825bc8f7304a Author: Christoph Hellwig Date: Mon Sep 15 06:26:57 2025 -0700 xfs: remove the xfs_efi_log_format_32_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 655d9ec7bd9e38735ae36dbc635a9161a046f7b9 Author: Christoph Hellwig Date: Mon Sep 15 06:26:56 2025 -0700 xfs: remove the xfs_efi_log_format_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 72628b6f459ea4fed3003db8161b52ee746442d0 Author: Christoph Hellwig Date: Mon Sep 15 06:26:55 2025 -0700 xfs: remove the xfs_extent64_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 7eaf684bc48923b5584fc119e8c477be2cdb3eb2 Author: Christoph Hellwig Date: Mon Sep 15 06:26:54 2025 -0700 xfs: remove the xfs_extent32_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 476688c8ac60da9bfcb3ce7f5a2d30a145ef7f76 Author: Christoph Hellwig Date: Mon Sep 15 06:26:53 2025 -0700 xfs: remove the xfs_extent_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Also fix up the comment about the struct xfs_extent definition to be correct and read more easily. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 05f17dcbfd5dbe309af310508d8830ac4e0c5d4c Author: Christoph Hellwig Date: Mon Sep 15 06:26:52 2025 -0700 xfs: remove the xfs_trans_header_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit eff8668607888988cad7b31528ff08d8883c5d7e Author: Christoph Hellwig Date: Mon Sep 15 06:26:51 2025 -0700 xfs: remove the xlog_op_header_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e3df98d30369d7859a855bd3e500ea46205640ca Author: Bagas Sanjaya Date: Tue Sep 9 07:04:31 2025 +0700 xfs: extend removed sysctls table Commit 21d59d00221e4e ("xfs: remove deprecated sysctl knobs") moves recently-removed sysctls to the removed sysctls table but fails to extend the table, hence triggering Sphinx warning: Documentation/admin-guide/xfs.rst:365: ERROR: Malformed table. Text in column margin in table line 8. ============================= ======= Name Removed ============================= ======= fs.xfs.xfsbufd_centisec v4.0 fs.xfs.age_buffer_centisecs v4.0 fs.xfs.irix_symlink_mode v6.18 fs.xfs.irix_sgid_inherit v6.18 fs.xfs.speculative_cow_prealloc_lifetime v6.18 ============================= ======= [docutils] Extend "Name" column of the table to fit the now-longest sysctl, which is fs.xfs.speculative_cow_prealloc_lifetime. Fixes: 21d59d00221e ("xfs: remove deprecated sysctl knobs") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250908180406.32124fb7@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Darrick J. Wong Reviewed-by: Randy Dunlap Signed-off-by: Carlos Maiolino commit 29fa7f9e5adf31a2f02c9413824909cd96356148 Author: Yury Norov (NVIDIA) Date: Sat Sep 13 14:28:36 2025 -0400 net: phy: nxp-c45-tja11xx: use bitmap_empty() where appropriate The driver opencodes bitmap_empty() in a couple of funcitons. Switch to the proper and more verbose API. Signed-off-by: Yury Norov (NVIDIA) Link: https://patch.msgid.link/20250913182837.206800-1-yury.norov@gmail.com Signed-off-by: Paolo Abeni commit 8d7de4a014f589c1776959f7fdadbf7b12045aac Author: Jonas Rebmann Date: Wed Sep 10 14:35:22 2025 +0200 ASoC: dt-bindings: asahi-kasei,ak4458: Reference common DAI properties Reference the dai-common.yaml schema to allow '#sound-dai-cells' and "sound-name-prefix' to be used. Signed-off-by: Jonas Rebmann Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250910-imx8mp-prt8ml-v1-2-fd04aed15670@pengutronix.de Signed-off-by: Mark Brown commit 17628f1abbf4bd4162c655f3260d68bc1934ec73 Author: Ioana Ciornei Date: Fri Sep 12 19:59:16 2025 +0300 dt-bindings: gpio: fix trivial-gpio's schema id In case the trivial-gpio schema is referenced through a $ref like /schemas/trivial-gpio.yaml to match its current schema ID, the following error message is displayed: Error in referenced schema matching $id: http://devicetree.org/schemas/trivial-gpio.yaml Tried these paths (check schema $id if path is wrong): /path/to/linux/Documentation/devicetree/bindings/trivial-gpio.yaml /path/to/dtchema/schemas/trivial-gpio.yaml Fix this by adding the 'gpio' folder to the schema's ID to match its file path. Fixes: f03a7f20b23c ("dt-bindings: gpio: Create a trivial GPIO schema") Signed-off-by: Ioana Ciornei Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250912165916.3098215-1-ioana.ciornei@nxp.com Signed-off-by: Bartosz Golaszewski commit 9fc4a3da9a0259a0500848b5d8657918efde176b Author: Sebastian Andrzej Siewior Date: Mon Sep 15 17:28:51 2025 +0200 ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts via spin_lock_irq(). This also implicitly disables the handling of softirqs such as TIMER_SOFTIRQ. On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not disable them. That means a timer can be invoked during spin_lock_irq() on the same CPU. Due to synchronisations reasons local_bh_disable() has a per-CPU lock named softirq_ctrl.lock which synchronizes individual softirq against each other. syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This is a possible deadlock. The softirq_ctrl.lock can not be made part of spin_lock_irq() as this would lead to too much synchronisation against individual threads on the system. To avoid the possible deadlock, softirqs must be manually disabled before the lock is acquired. Disable softirqs before the lock is acquired on PREEMPT_RT. Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Takashi Iwai commit 8236b4667aca63afcd29620a48a084f6a0eed162 Author: Yen-Chi Huang Date: Wed Sep 10 11:58:13 2025 +0800 platform/x86: portwell-ec: Add hwmon support for voltage and temperature Integrates voltage and temperature monitoring into the driver via the hwmon subsystem, enabling standardized reporting via tools like lm-sensors. Signed-off-by: Yen-Chi Huang Link: https://patch.msgid.link/0d73c577-1941-44b4-917e-3aed6f1f664a@portwell.com.tw [ij: align struct member comments] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dfc0882a4088001a9bcd620bc32938d13d0f18b9 Merge: 05c05d14d95fa5 d5aeec59215471 Author: Paolo Abeni Date: Tue Sep 16 10:49:09 2025 +0200 Merge branch 'net-hinic3-add-a-driver-for-huawei-3rd-gen-nic-sw-and-hw-initialization' Fan Gong says: ==================== net: hinic3: Add a driver for Huawei 3rd gen NIC - sw and hw initialization This is [3/3] part of hinic3 Ethernet driver initial submission. With this patch hinic3 becomes a functional Ethernet driver. The driver parts contained in this patch: Memory allocation and initialization of the driver structures. Management interfaces initialization. HW capabilities probing, initialization and setup using management interfaces. Net device open/stop implementation and data queues initialization. Register VID:DID in PCI id_table. Fix netif_queue_set_napi usage. V01: https://lore.kernel.org/netdev/cover.1756195078.git.zhuyikai1@h-partners.com V02: https://lore.kernel.org/netdev/cover.1756378721.git.zhuyikai1@h-partners.com V03: https://lore.kernel.org/netdev/cover.1756524443.git.zhuyikai1@h-partners.com V04: https://lore.kernel.org/netdev/cover.1757057860.git.zhuyikai1@h-partners.com V05: https://lore.kernel.org/netdev/cover.1757401320.git.zhuyikai1@h-partners.com ==================== Link: https://patch.msgid.link/cover.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit d5aeec592154716ae8ba2cf094c1f04b077998a3 Author: Fan Gong Date: Fri Sep 12 14:28:31 2025 +0800 hinic3: Fix code style (Missing a blank line before return) Fix code style of missing a blank line before return. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/e4b34db5ee423ca554ff60b49a9ecd7f84c32110.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 4404f6af810829588a51968959c6b85574109c13 Author: Fan Gong Date: Fri Sep 12 14:28:30 2025 +0800 hinic3: Fix missing napi->dev in netif_queue_set_napi As netif_queue_set_napi checks napi->dev, if it doesn't have it and it will warn_on and return. So we should use netif_napi_add before netif_queue_set_napi because netif_napi_add has "napi->dev = dev". Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/a17a5a087350eaf2e081dcd879779ca2c69b0908.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 45f97ae93de2edeb7d214d619306612af6d1d03a Author: Fan Gong Date: Fri Sep 12 14:28:29 2025 +0800 hinic3: Add port management Add port management of enable/disable/query/flush function. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/122cbde6dec03e091340bda32c8b0d7fac3a2fb4.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 1f3838b84a6374d5529c0b929053d19674595df8 Author: Fan Gong Date: Fri Sep 12 14:28:28 2025 +0800 hinic3: Add Rss function Initialize rss functions. Configure rss hash data and HW resources. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/a69336e9b174950be5fe2c14f3450790f18eb293.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit b83bb584bc97f9dfe409474c87b0dd6b9ba01755 Author: Fan Gong Date: Fri Sep 12 14:28:27 2025 +0800 hinic3: Tx & Rx configuration Configure Tx & Rx queue common attributes. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/22e71492cd7c819fca45200fcf4030c32f4f924d.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 97dcb914a25ba889db3a529e34ca4071a6ceb4d1 Author: Fan Gong Date: Fri Sep 12 14:28:26 2025 +0800 hinic3: Queue pair context initialization Initialize queue pair context of hardware interaction. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/92b9c23f21cd37fb30066c7f075ec196e11f1fb2.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 73f37a7e1993dfde3362a2d3fd18c2bc8b0c519e Author: Fan Gong Date: Fri Sep 12 14:28:25 2025 +0800 hinic3: Queue pair resource initialization Add Tx & Rx queue resources and functions for packet transmission and reception. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/8d72eefd38d1c3b106eeb830d9e149df247b2906.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 6b822b658aafe840ffd6d7f1af5bf4f77df15a11 Author: Fan Gong Date: Fri Sep 12 14:28:24 2025 +0800 hinic3: Queue pair endianness improvements Explicitly use little-endian & big-endian structs to support big endian hosts. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Vadim Fedorenko Reviewed-by: Simon Horman Link: https://patch.msgid.link/9b995a10f1e209a878bf98e4e1cdfb926f386695.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 8133788d023ffb5498ad19ad4d079705d30ddef1 Author: Fan Gong Date: Fri Sep 12 14:28:23 2025 +0800 hinic3: Nic_io initialization Add nic_io initialization to enable NIC service, configure the function table, initialize hwdev dev_id and negotiate activation of NIC features. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/fab9c4235c0fc0f65c9ac1add20dba5ac2160328.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit b92e6c734db80900b1a59383b5f35700ae248b8f Author: Fan Gong Date: Fri Sep 12 14:28:22 2025 +0800 hinic3: Command Queue flush interfaces Add the data structures and functions for command queue flushing. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/2cfd5dfbccb5265e22bdb5a2b279122a57795bb1.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit a0543a79359ed838960bc10ac3a5ee8810f63834 Author: Fan Gong Date: Fri Sep 12 14:28:21 2025 +0800 hinic3: HW capability initialization Use mailbox to get device capability for initializing driver capability. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/8f4cbd99306a14cee1b7621714c269a02a5082dc.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 069e42485e53e25b5875ccf9642eb097fe40b231 Author: Fan Gong Date: Fri Sep 12 14:28:20 2025 +0800 hinic3: HW common function initialization Add initialization for data structures and functions(cmdq ceq mbox ceq) that interact with hardware. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/717fc839f415996d6f2540f9208fb038c367c050.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 8a1c655f55c8fe2d7b595fe31acfe87d39caf633 Author: Fan Gong Date: Fri Sep 12 14:28:19 2025 +0800 hinic3: HW management interfaces Initialize hardware management config of irq, aeq and ceq. These will send hardware messages to driver. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/91c2ec3178bd1f28b4f9c509fd49b86a289ff79e.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit cdb096c41b7dc26abab644886514135141a76978 Author: Fan Gong Date: Fri Sep 12 14:28:18 2025 +0800 hinic3: HW initialization Add the hardware resource data structures, functions for HW initialization, configuration and releasement. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/e3381375e3d4a89e11d4816a0a20a1db4df93b66.1757653621.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 9441d6b876529d519547a1ed3af5a08b05bd0339 Merge: 4a58aac59f785a 94d885eb8ffe15 Author: Greg Kroah-Hartman Date: Tue Sep 16 10:31:52 2025 +0200 Merge tag 'extcon-next-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next Chanwoo writes: Update extcon next for v6.18 Detailed description for this pull request: - Fix wakeup source leaks on device unbind for extcon drivers - Add new Maxim MAX14526 MUIC extcon driver and dt-binding document : The MAX14526 is designed to simplify interface requirements on portable devices by multiplexing common inputs (USB, UART, Microphone, Stereo Audio and Composite Video) on a single micro/mini USB connector. The USB input supports Hi-Speed USB and the audio/video inputs feature : This provides the following supported external connector detection - EXTCON_USB - EXTCON_USB_HOST - EXTCON_CHG_USB_FAST - EXTCON_DISP_MHL - Convert legacy DT binding to YAML of richktek,rt8973a-muic.yaml - Add missing DT binding information of that must include either id-gpios or vbus-gpios for linux,extcon-usb-gpio.yaml * tag 'extcon-next-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon: dt-bindings: extcon: linux,extcon-usb-gpio: GPIO must be provided dt-bindings: extcon: rt8973a: Convert DT bindings to YAML extcon: max14526: depends on I2C to prevent build warning/errors extcon: max14526: avoid defined but not used warning extcon: Add basic support for Maxim MAX14526 MUIC dt-bindings: extcon: Document Maxim MAX14526 MUIC extcon: adc-jack: Cleanup wakeup source only if it was enabled extcon: qcom-spmi-misc: Fix wakeup source leaks on device unbind extcon: fsa9480: Fix wakeup source leaks on device unbind extcon: axp288: Fix wakeup source leaks on device unbind extcon: adc-jack: Fix wakeup source leaks on device unbind commit 4a58aac59f785acec48ffe5be499f7b00a8bcb0b Merge: ef509269d93d98 3379c900320954 Author: Greg Kroah-Hartman Date: Tue Sep 16 10:30:55 2025 +0200 Merge tag 'iio-fixes-for-6.17b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: 2nd set of fixes for the 6.17 cycle (or 6.18 merge window) adi,ad5360 - Use a signed int type to be able to hold a potential error return. adi,ad5421 - Use a signed int type to be able to hold a potential error return. adi,adf4350 - Ensure rules on VCO frequency and prescaler values are met. - Fix a wrong offset for the clock divisor control field. xilinx,ams - Unmask alarms correctly if an event is disabled and re-enabled. - Fix a wrong register field mask. * tag 'iio-fixes-for-6.17b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: dac: ad5421: use int type to store negative error codes iio: dac: ad5360: use int type to store negative error codes iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE iio: frequency: adf4350: Fix prescaler usage. iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK iio: xilinx-ams: Unmask interrupts after updating alarms iio/adc/pac1934: fix channel disable configuration commit ef509269d93d9832b366005f9626b44e38cc0ca7 Merge: e2258cfd9b9809 51548c36b37d0e Author: Greg Kroah-Hartman Date: Tue Sep 16 10:27:55 2025 +0200 Merge tag 'counter-updates-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next William writes: Counter updates for 6.18 Includes a cleanup of the Counter subsystem sysfs attributes documentation component_id list to alphabetical order, and replaces superfluous error handling code in ecap_cnt_probe() with a call to device-managed devm_pm_runtime_enable(). * tag 'counter-updates-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: ti-ecap-capture: Use devm_pm_runtime_enable() counter: Alphabetize component_id sysfs attributes Documentation list commit 7d62beb102d6fa9a4e5e874be7fbf47a62fcc4f6 Author: Mario Limonciello (AMD) Date: Tue Sep 9 06:00:06 2025 -0500 HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 Dell systems utilize an EC-based touchpad emulation when the ACPI touchpad _DSM is not invoked. This emulation acts as a secondary master on the I2C bus, designed for scenarios where the I2C touchpad driver is absent, such as in BIOS menus. Typically, loading the i2c-hid module triggers the _DSM at initialization, disabling the EC-based emulation. However, if the i2c-hid module is missing from the boot kernel used for hibernation snapshot restoration, the _DSM remains uncalled, resulting in dual masters on the I2C bus and subsequent arbitration errors. This issue arises when i2c-hid resides in the rootfs instead of the kernel or initramfs. To address this, switch from using the SYSTEM_SLEEP_PM_OPS() macro to dedicated callbacks, introducing a specific callback for restoring the S4 image. This callback ensures the _DSM is invoked. Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Benjamin Tissoires commit 657403637f7d343352efb29b53d9f92dcf86aebb Author: Tamir Duberstein Date: Wed Aug 13 11:42:02 2025 -0400 rust: acpi: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 5749cd1ed8bd11e99ba87146d117e711a4a38f30 Author: Tamir Duberstein Date: Wed Aug 13 11:42:01 2025 -0400 rust: of: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 182d95571ffa278f7c68a80d76de88a5333fb69f Author: Tamir Duberstein Date: Wed Aug 13 11:42:00 2025 -0400 rust: net: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit e49c43ef82f57a155a6c1e6c79795abff1227f29 Author: Tamir Duberstein Date: Wed Aug 13 11:41:59 2025 -0400 rust: miscdevice: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit f16a23743ef57e42985bb934a7d511cddb82b868 Author: Tamir Duberstein Date: Wed Aug 13 11:41:58 2025 -0400 rust: kunit: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 141ba59cc967d8c156b9cc5c95aff4b1fe50eec8 Author: Tamir Duberstein Date: Wed Aug 13 11:41:57 2025 -0400 rust: firmware: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 23218425cb2f18785539856f9aabfa4a4f47b3c5 Author: Tamir Duberstein Date: Wed Aug 13 11:41:56 2025 -0400 rust: drm: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 23cd58b1d80364a0dbacf1f8ee5bf1b0aa825be1 Author: Tamir Duberstein Date: Wed Aug 13 11:41:55 2025 -0400 rust: cpufreq: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Acked-by: Viresh Kumar Signed-off-by: Miguel Ojeda commit a3a7d09ab8bf881ea64aa8f33c76554ab9b5f6d6 Author: Tamir Duberstein Date: Wed Aug 13 11:41:54 2025 -0400 rust: configfs: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Also avoid `Deref for CStr` as that impl doesn't exist on `core::ffi::CStr`. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Acked-by: Andreas Hindborg Signed-off-by: Miguel Ojeda commit 7ad635c936f8b11496a9a83a539304a39e66cf45 Author: Tamir Duberstein Date: Wed Aug 13 11:41:53 2025 -0400 rust: auxiliary: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 7dfabaa0c489ce65883c26ba5cdb15169f168d7a Author: Tamir Duberstein Date: Wed Aug 13 11:41:52 2025 -0400 drm/panic: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoid methods that only exist on the latter. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Acked-by: Jocelyn Falempe Signed-off-by: Miguel Ojeda commit eb98599528ebee9b660d98ae6613c2f2966e0dbb Author: Tamir Duberstein Date: Wed Aug 13 11:39:54 2025 -0400 rust: device: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 0fe1ca3c8bc5e0b278d4793247eb787131e84112 Author: Tamir Duberstein Date: Wed Aug 13 11:39:53 2025 -0400 rust: sync: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 5990533a83bb801b4a28ba29df3d033ab17fdad4 Author: Tamir Duberstein Date: Wed Aug 13 11:39:52 2025 -0400 rust: seq_file: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit aa2417c1a5842a1eb9b6b5dcf1a9ccb617583eb9 Author: Tamir Duberstein Date: Wed Aug 13 11:39:51 2025 -0400 rust: kunit: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit e6aedde22dc42d83280d63753309884de3c21da4 Author: Tamir Duberstein Date: Wed Aug 13 11:39:50 2025 -0400 rust: file: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 97bcbe585476e67980a0873e89965254e1fd6a67 Author: Tamir Duberstein Date: Wed Aug 13 11:39:49 2025 -0400 rust: device: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit e0be3d34f1089fd9681a66f8295de91a77f55d7f Author: Tamir Duberstein Date: Wed Aug 13 11:39:48 2025 -0400 rust: block: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Suggested-by: Alice Ryhl Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Custom.20formatting/with/516476467 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Acked-by: Andreas Hindborg Signed-off-by: Miguel Ojeda commit 1f96115f502abae7d08ba35dd02e6b0381f265a4 Author: Tamir Duberstein Date: Wed Aug 13 11:39:47 2025 -0400 rust: alloc: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 4b4d06a7630e14c4a8567d0dae6847260eba8a3c Author: Tamir Duberstein Date: Wed Aug 13 11:39:46 2025 -0400 gpu: nova-core: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 85afa9ea122dd9d4a2ead104a951d318975dcd25 Author: Shin'ichiro Kawasaki Date: Tue Sep 16 11:57:56 2025 +0900 PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to check that they have non-NULL values before releasing the channels. Add the checks in pci_epf_test_clean_dma_chan(). Without the checks, NULL pointer dereferences happen and they can lead to a kernel panic in some cases: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Call trace: dma_release_channel+0x2c/0x120 (P) pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test] pci_epc_deinit_notify+0x74/0xc0 tegra_pcie_ep_pex_rst_irq+0x250/0x5d8 irq_thread_fn+0x34/0xb8 irq_thread+0x18c/0x2e8 kthread+0x14c/0x210 ret_from_fork+0x10/0x20 Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") Fixes: 5ebf3fc59bd2 ("PCI: endpoint: functions/pci-epf-test: Add DMA support to transfer data") Signed-off-by: Shin'ichiro Kawasaki [mani: trimmed the stack trace] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Damien Le Moal Reviewed-by: Krzysztof Wilczyński Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250916025756.34807-1-shinichiro.kawasaki@wdc.com commit 85df1cd15ff5d775e88e23b9fc2a9f429fa5b504 Merge: 8d73829b78ca1a 7f830e126dc357 Author: Ingo Molnar Date: Tue Sep 16 08:24:22 2025 +0200 Merge branch 'x86/urgent' into x86/apic, to resolve conflict Conflicts: arch/x86/include/asm/sev.h Signed-off-by: Ingo Molnar commit dbdadd943a278fb8a24ae4199a668131108034b4 Author: Atish Patra Date: Tue Sep 9 00:03:27 2025 -0700 RISC-V: KVM: Upgrade the supported SBI version to 3.0 Upgrade the SBI version to v3.0 so that corresponding features can be enabled in the guest. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-8-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit e309fd113b9f6c34672a487be08fecb7e12e7e29 Author: Atish Patra Date: Tue Sep 9 00:03:26 2025 -0700 RISC-V: KVM: Implement get event info function The new get_event_info funciton allows the guest to query the presence of multiple events with single SBI call. Currently, the perf driver in linux guest invokes it for all the standard SBI PMU events. Support the SBI function implementation in KVM as well. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-7-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 41f4d0cc331a1e9dc247ce22ae45f983f0ed9054 Author: Atish Patra Date: Tue Sep 9 00:03:25 2025 -0700 RISC-V: KVM: No need of explicit writable slot check There is not much value in checking if a memslot is writable explicitly before a write as it may change underneath after the check. Rather, return invalid address error when write_guest fails as it checks if the slot is writable anyways. Suggested-by: Sean Christopherson Signed-off-by: Atish Patra Reviewed-by: Anup Patel Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-6-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 880fcc329e2473ba02ffbc446fcd403972ab1fca Author: Atish Patra Date: Tue Sep 9 00:03:24 2025 -0700 drivers/perf: riscv: Export PMU event info function The event mapping function can be used in event info function to find out the corresponding SBI PMU event encoding during the get_event_info function as well. Refactor and export it so that it can be invoked from kvm and internal driver. Signed-off-by: Atish Patra Reviewed-by: Anup Patel Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-5-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit adffbd06d0036a1f2d8424ecc22d37ca38709012 Author: Atish Patra Date: Tue Sep 9 00:03:23 2025 -0700 drivers/perf: riscv: Implement PMU event info function With the new SBI PMU event info function, we can query the availability of the all standard SBI PMU events at boot time with a single ecall. This improves the bootime by avoiding making an SBI call for each standard PMU event. Since this function is defined only in SBI v3.0, invoke this only if the underlying SBI implementation is v3.0 or higher. Signed-off-by: Atish Patra Reviewed-by: Anup Patel Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-4-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 190b74154299d210de7937d7325571fc3fa37383 Author: Atish Patra Date: Tue Sep 9 00:03:22 2025 -0700 RISC-V: KVM: Add support for Raw event v2 SBI v3.0 introduced a new raw event type v2 for wider mhpmeventX programming. Add the support in kvm for that. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-3-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 656ef2ea30a90f910e1d2691674c98e5dcd164b5 Author: Atish Patra Date: Tue Sep 9 00:03:21 2025 -0700 drivers/perf: riscv: Add raw event v2 support SBI v3.0 introduced a new raw event type that allows wider mhpmeventX width to be programmed via CFG_MATCH. Use the raw event v2 if SBI v3.0 is available. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-2-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 8c8d0f002b769dbef26c93d68e49d1d0ba54d094 Author: Atish Patra Date: Tue Sep 9 00:03:20 2025 -0700 drivers/perf: riscv: Add SBI v3.0 flag There are new PMU related features introduced in SBI v3.0. 1. Raw Event v2 which allows mhpmeventX value to be 56 bit wide. 2. Get Event info function to do a bulk query at one shot. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Paul Walmsley Link: https://lore.kernel.org/r/20250909-pmu_event_info-v6-1-d8f80cacb884@rivosinc.com Signed-off-by: Anup Patel commit 5c6d333a9e10d6230d4ab74125c7dcb4fdd69825 Author: Anup Patel Date: Sat Aug 23 21:29:47 2025 +0530 KVM: riscv: selftests: Add SBI FWFT to get-reg-list test KVM RISC-V now supports SBI FWFT, so add it to the get-reg-list test. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250823155947.1354229-7-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 48d67106f4a72a32dcd762774e639e7ed9dbed5e Author: Anup Patel Date: Sat Aug 23 21:29:46 2025 +0530 RISC-V: KVM: Implement ONE_REG interface for SBI FWFT state The KVM user-space needs a way to save/restore the state of SBI FWFT features so implement SBI extension ONE_REG callbacks. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250823155947.1354229-6-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 85e7850e0dcd754112cf54c9e4baf0ae9ffda345 Author: Anup Patel Date: Sat Aug 23 21:29:45 2025 +0530 RISC-V: KVM: Move copy_sbi_ext_reg_indices() to SBI implementation The ONE_REG handling of SBI extension enable/disable registers and SBI extension state registers is already under SBI implementation. On similar lines, let's move copy_sbi_ext_reg_indices() under SBI implementation. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250823155947.1354229-5-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 699a53aedb18da50b4040b870784f9943dead5d8 Author: Anup Patel Date: Sat Aug 23 21:29:44 2025 +0530 RISC-V: KVM: Introduce optional ONE_REG callbacks for SBI extensions SBI extensions can have per-VCPU state which needs to be saved/restored through ONE_REG interface for Guest/VM migration. Introduce optional ONE_REG callbacks for SBI extensions so that ONE_REG implementation for an SBI extenion is part of the extension sources. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250823155947.1354229-4-apatel@ventanamicro.com Signed-off-by: Anup Patel commit a6250b18b5df7880b3c26e5d16ca24c31c1be259 Author: Anup Patel Date: Sat Aug 23 21:29:43 2025 +0530 RISC-V: KVM: Introduce feature specific reset for SBI FWFT The SBI FWFT feature values must be reset upon VCPU reset so introduce feature specific reset callback for this purpose. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250823155947.1354229-3-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 83df1d64d663f4bf450a924cf337ff0cb7d63261 Author: Anup Patel Date: Sat Aug 23 21:29:42 2025 +0530 RISC-V: KVM: Set initial value of hedeleg in kvm_arch_vcpu_create() The hedeleg may be updated by ONE_REG interface before the VCPU is run at least once hence set the initial value of hedeleg in kvm_arch_vcpu_create() instead of kvm_riscv_vcpu_setup_config(). Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250823155947.1354229-2-apatel@ventanamicro.com Signed-off-by: Anup Patel commit b8d13949a6125c0e2e59f0c1f102a38d3c4809d1 Author: Guo Ren (Alibaba DAMO Academy) Date: Thu Aug 21 10:25:42 2025 -0400 RISC-V: KVM: Prevent HGATP_MODE_BARE passed Current kvm_riscv_gstage_mode_detect() assumes H-extension must have HGATP_MODE_SV39X4/SV32X4 at least, but the spec allows H-extension with HGATP_MODE_BARE alone. The KVM depends on !HGATP_MODE_BARE at least, so enhance the gstage-mode-detect to block HGATP_MODE_BARE. Move gstage-mode-check closer to gstage-mode-detect to prevent unnecessary init. Reviewed-by: Troy Mitchell Reviewed-by: Nutty Liu Signed-off-by: Guo Ren (Alibaba DAMO Academy) Reviewed-by: Fangyu Yu Link: https://lore.kernel.org/r/20250821142542.2472079-4-guoren@kernel.org Signed-off-by: Anup Patel commit 9eac3744db944e887c0a73ce0fb4e5680614dd70 Author: Guo Ren (Alibaba DAMO Academy) Date: Thu Aug 21 10:25:41 2025 -0400 RISC-V: KVM: Remove unnecessary HGATP csr_read The HGATP has been set to zero in gstage_mode_detect(), so there is no need to save the old context. Unify the code convention with gstage_mode_detect(). Reviewed-by: Fangyu Yu Signed-off-by: Fangyu Yu Signed-off-by: Guo Ren (Alibaba DAMO Academy) Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250821142542.2472079-3-guoren@kernel.org Signed-off-by: Anup Patel commit 2b351e3d04be9e1533f26c3464f1e44a5beace30 Author: Fangyu Yu Date: Thu Aug 21 10:25:40 2025 -0400 RISC-V: KVM: Write hgatp register with valid mode bits According to the RISC-V Privileged Architecture Spec, when MODE=Bare is selected,software must write zero to the remaining fields of hgatp. We have detected the valid mode supported by the HW before, So using a valid mode to detect how many vmid bits are supported. Fixes: fd7bb4a251df ("RISC-V: KVM: Implement VMID allocator") Reviewed-by: Nutty Liu Reviewed-by: Troy Mitchell Reviewed-by: Guo Ren (Alibaba DAMO Academy) Signed-off-by: Fangyu Yu Signed-off-by: Guo Ren (Alibaba DAMO Academy) Link: https://lore.kernel.org/r/20250821142542.2472079-2-guoren@kernel.org Signed-off-by: Anup Patel commit dbe3d1d1609e171bd26de077abba6ae142de86af Author: Quan Zhou Date: Mon Sep 1 15:35:51 2025 +0800 KVM: riscv: selftests: Add common supported test cases Some common KVM test cases are supported on riscv now as following: access_tracking_perf_test dirty_log_perf_test memslot_modification_stress_test memslot_perf_test mmu_stress_test rseq_test Signed-off-by: Quan Zhou Signed-off-by: Dong Yang Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/c447f18115b27562cd65863645e41a5ef89bd37b.1756710918.git.dayss1224@gmail.com Signed-off-by: Anup Patel commit f4103c1171a4e661a61783e16073160be31b956f Author: Dong Yang Date: Mon Sep 1 15:35:50 2025 +0800 KVM: riscv: selftests: Add missing headers for new testcases Add missing headers to fix the build for new RISC-V KVM selftests. Signed-off-by: Quan Zhou Signed-off-by: Dong Yang Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/bfb66541918de68cd89b83bc3430af94bdc75a85.1756710918.git.dayss1224@gmail.com Signed-off-by: Anup Patel commit c92786e179e0def2cf9a8003e7be0fcba73afb15 Author: Quan Zhou Date: Mon Sep 1 15:35:49 2025 +0800 KVM: riscv: selftests: Use the existing RISCV_FENCE macro in `rseq-riscv.h` To avoid redefinition issues with RISCV_FENCE, directly reference the existing macro in `rseq-riscv.h`. Signed-off-by: Quan Zhou Signed-off-by: Dong Yang Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/85e5e51757c9289ca463fbc4ba6d22f9c9db791b.1756710918.git.dayss1224@gmail.com Signed-off-by: Anup Patel commit b4ab605e2ff5ffdcbf26ccdd9dec938dc38c6970 Author: Quan Zhou Date: Fri Aug 8 18:19:18 2025 +0800 KVM: riscv: selftests: Add bfloat16 extension to get-reg-list test The KVM RISC-V allows Zfbfmin/Zvfbfmin/Zvfbfwma extensions for Guest/VM so add them to get-reg-list test. Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/40e52ff7053401a2fcb206e75f45ebc8557fc28b.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit e677fab86502e7c716dc893299965cffec57b9f5 Author: Quan Zhou Date: Fri Aug 8 18:19:00 2025 +0800 KVM: riscv: selftests: Add Zicbop extension to get-reg-list test The KVM RISC-V allows Zicbop extension for Guest/VM so add them to get-reg-list test. Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/076908690c15070f907f43d2ff81ba7e95582ec7.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 44c3d084e4c8737cbef6fed262af21965d6adfb1 Author: Quan Zhou Date: Fri Aug 8 18:18:51 2025 +0800 RISC-V: KVM: Allow bfloat16 extension for Guest/VM Extend the KVM ISA extension ONE_REG interface to allow KVM user space to detect and enable Zfbfmin/Zvfbfmin/Zvfbfwma extension for Guest/VM. Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/f846cecd330ab9fc88211c55bc73126f903f8713.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 0efd9a29c52d357088e190d0bf6c33dc8ed53d2d Author: Quan Zhou Date: Fri Aug 8 18:18:44 2025 +0800 RISC-V: KVM: Allow Zicbop extension for Guest/VM Extend the KVM ISA extension ONE_REG interface to allow KVM user space to detect and enable Zicbop extension for Guest/VM. Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/db4a9b679cc653bb6f5f5574e4196de7a980e458.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 48e2febcda745150b4e05a8f6e6d8fd2e14e25ec Author: Quan Zhou Date: Fri Aug 8 18:18:34 2025 +0800 RISC-V: KVM: Provide UAPI for Zicbop block size We're about to allow guests to use the Zicbop extension. KVM userspace needs to know the cache block size in order to properly advertise it to the guest. Provide a virtual config register for userspace to get it with the GET_ONE_REG API, but setting it cannot be supported, so disallow SET_ONE_REG. Signed-off-by: Quan Zhou Reviewed-by: Nutty Liu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/befd8403cd76d7adb97231ac993eaeb86bf2582c.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit eca26eadd27e59d6d673308d2a28416dd741513e Author: Quan Zhou Date: Fri Aug 8 18:18:21 2025 +0800 RISC-V: KVM: Change zicbom/zicboz block size to depend on the host isa The zicbom/zicboz block size registers should depend on the host's isa, the reason is that we otherwise create an ioctl order dependency on the VMM. Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Reviwed-by: Troy Mitchell Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/fef5907425455ecd41b224e0093f1b6bc4067138.1754646071.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 6f576fc0aeb9072ac17630a58e693de0488f9ce3 Author: Samuel Holland Date: Fri Jan 10 16:46:59 2025 -0800 RISC-V: KVM: Add support for SBI_FWFT_POINTER_MASKING_PMLEN Pointer masking is controlled through a WARL field in henvcfg. Expose the feature only if at least one PMLEN value is supported for VS-mode. Allow the VMM to block access to the feature by disabling the Smnpm ISA extension in the guest. Signed-off-by: Samuel Holland Reviewed-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250111004702.2813013-3-samuel.holland@sifive.com Signed-off-by: Anup Patel commit 38f4885088fc5ad41b8b0a2a2cfc73d01e709e5c Author: Al Viro Date: Tue Aug 26 16:35:55 2025 -0400 mnt_ns_tree_remove(): DTRT if mnt_ns had never been added to mnt_ns_list Actual removal is done under the lock, but for checking if need to bother the lockless RB_EMPTY_NODE() is safe - either that namespace had never been added to mnt_ns_tree, in which case the the node will stay empty, or whoever had allocated it has called mnt_ns_tree_add() and it has already run to completion. After that point RB_EMPTY_NODE() will become false and will remain false, no matter what we do with other nodes in the tree. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 Author: Chao Yu Date: Tue Sep 16 10:47:09 2025 +0800 f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock and page lookup, change as below to mitigate its overhead: - check new_size before grabbing invalidate_lock - lookup and invalidate pages only in range of [old_size, new_size] Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d625a2b08c089397d3a03bff13fa8645e4ec7a01 Author: Chao Yu Date: Mon Sep 1 10:04:15 2025 +0800 f2fs: fix to avoid migrating empty section It reports a bug from device w/ zufs: F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT F2FS-fs (dm-64): Stopped filesystem due to reason: 4 Thread A Thread B - f2fs_expand_inode_data - f2fs_allocate_pinning_section - f2fs_gc_range - do_garbage_collect w/ segno #x - writepage - f2fs_allocate_data_block - new_curseg - allocate segno #x The root cause is: fallocate on pinning file may race w/ block allocation as above, result in do_garbage_collect() from fallocate() may migrate segment which is just allocated by a log, the log will update segment type in its in-memory structure, however GC will get segment type from on-disk SSA block, once segment type changes by log, we can detect such inconsistency, then shutdown filesystem. In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE), however segno #173822 was just allocated as data type segment, so in-memory SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA). Change as below to fix this issue: - check whether current section is empty before gc - add sanity checks on do_garbage_collect() to avoid any race case, result in migrating segment used by log. - btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA". Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 Author: Chao Yu Date: Wed Sep 10 16:40:24 2025 +0800 f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change from 0 to 40427 F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop0): invalid crc value F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. ------------[ cut here ]------------ kernel BUG at fs/inode.c:753! RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 Call Trace: evict+0x504/0x9c0 fs/inode.c:810 f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 do_mount fs/namespace.c:4136 [inline] __do_sys_mount fs/namespace.c:4347 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f During f2fs_evict_inode(), clear_inode() detects that we missed to truncate all page cache before destorying inode, that is because in below path, we will create page #0 in cache, but missed to drop it in error path, let's fix it. - evict - f2fs_evict_inode - f2fs_truncate - f2fs_convert_inline_inode - f2fs_grab_cache_folio : create page #0 in cache - f2fs_convert_inline_folio : sanity check failed, return -EFSCORRUPTED - clear_inode detects that inode->i_data.nrpages is not zero Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large") Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 869833f54e8306326b85ca3ed08979b7ad412a4a Author: Chao Yu Date: Fri Sep 12 16:12:50 2025 +0800 f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() Script to reproduce: mkfs.f2fs -O extra_attr,compression /dev/vdb -f mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache cd /mnt/f2fs f2fs_io write 1 0 1024 rand dsync testfile xfs_io testfile -c "fsync" f2fs_io write 1 0 512 rand dsync testfile xfs_io testfile -c "fsync" cd / umount /mnt/f2fs mount /dev/vdb /mnt/f2fs f2fs_io precache_extents /mnt/f2fs/testfile umount /mnt/f2fs Tracepoint output: f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0 f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0 f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0 During precache_extents, there is off-by-one issue, we should update map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is valid and not contiguous to previous extent. Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f2d81dd6751ae4a28456ed5b8807f381dc0dc6ad Author: Alok Tiwari Date: Wed Sep 10 12:07:20 2025 -0700 scsi: target: iscsi: fix typos and formatting in lio_target messages Fix several minor issues in lio_target code and messages: - Correct typo "locatel" -> "locate" in error log. - Add missing space in pr_debug() message for better readability. - Fix comment typo: "contig_item" -> "config_item". These changes improve code clarity and log readability. Signed-off-by: Alok Tiwari Reviewed-by: Mike Christie Message-ID: <20250910190728.3783157-1-alok.a.tiwari@oracle.com> Signed-off-by: Martin K. Petersen commit c1553fc105dff28f79bef90fab207235f5f2d977 Author: Palash Kambar Date: Tue Sep 9 11:21:49 2025 +0530 scsi: ufs: ufs-qcom: Disable lane clocks during phy hibern8 Currently, the UFS lane clocks remain enabled even after the link enters the Hibern8 state and are only disabled during runtime/system suspend.This patch modifies the behavior to disable the lane clocks during ufs_qcom_setup_clocks(), which is invoked shortly after the link enters Hibern8 via gate work. While hibern8_notify() offers immediate control, toggling clocks on every transition isn't ideal due to varied contexts like clock scaling. Since setup_clocks() manages PHY/controller resources and is invoked soon after Hibern8 entry, it serves as a central and stable point for clock gating. Signed-off-by: Palash Kambar Reviewed-by: Manivannan Sadhasivam Message-ID: <20250909055149.2068737-1-quic_pkambar@quicinc.com> Signed-off-by: Martin K. Petersen commit 0bd0e43776b6a0ff5f7aa3783f547849356ac899 Author: Alok Tiwari Date: Sun Sep 7 13:27:49 2025 -0700 scsi: ufs: exynos: Correct sync pattern mask timing comment Fix the comment for SYNC_LEN_G2 in exynos_ufs_config_sync_pattern_mask(). The actual value is 40us, not 44us, matching the configured mask timing. This change improves code clarity and avoids potential confusion for readers and maintainers. No functional changes. Signed-off-by: Alok Tiwari Reviewed-by: Peter Griffin Message-ID: <20250907202752.3613183-1-alok.a.tiwari@oracle.com> Signed-off-by: Martin K. Petersen commit 05c05d14d95fa54814f39197dfa4ad2a241c46bc Author: Niklas Söderlund Date: Sat Sep 13 15:32:29 2025 +0200 net: ravb: Fix -Wmaybe-uninitialized warning Fix a -Wmaybe-uninitialized warning by initializing the variable to NULL. The warning is bogus and should not happen, but fixing it allows running the check on the driver to catch potential future problems. $ make CFLAGS_ravb_main.o=-Wmaybe-uninitialized In function 'ravb_rx_csum_gbeth', inlined from 'ravb_rx_gbeth' at .../linux/drivers/net/ethernet/renesas/ravb_main.c:923:6: .../linux/drivers/net/ethernet/renesas/ravb_main.c:765:25: error: 'skb' may be used uninitialized [-Werror=maybe-uninitialized] 765 | if (unlikely(skb->len < csum_len)) | ~~~^~~~~ .../linux/include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ .../linux/drivers/net/ethernet/renesas/ravb_main.c: In function 'ravb_rx_gbeth': .../linux/drivers/net/ethernet/renesas/ravb_main.c:806:25: note: 'skb' was declared here 806 | struct sk_buff *skb; | ^~~ cc1: all warnings being treated as errors Warning was found when cross compiling using aarch64-linux-gnu-gcc (GCC) 15.1.0. Signed-off-by: Niklas Söderlund Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20250913133229.2087822-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit a75ca9ae47f90c619c88d359c7ae8af96bb350c5 Merge: 8f5ae30d69d754 01f3a6d1d59b8e Author: Stephen Boyd Date: Mon Sep 15 18:34:57 2025 -0700 Merge tag 'clk-meson-v6.18-1' of https://github.com/BayLibre/clk-meson into clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Factorize Amlogic clock controller probe functions - Clean up Amlogic peripheral clocks definitions - Clean redundant Amlogic composite clock definitions * tag 'clk-meson-v6.18-1' of https://github.com/BayLibre/clk-meson: clk: amlogic: c3-peripherals: use helper for basic composite clocks clk: amlogic: align s4 and c3 pwm clock descriptions clk: amlogic: add composite clock helpers clk: amlogic: use the common pclk definition clk: amlogic: introduce a common pclk definition clk: amlogic: pclk explicitly use CLK_IGNORE_UNUSED clk: amlogic: drop CLK_SET_RATE_PARENT from peripheral clocks clk: amlogic: move PCLK definition to clkc-utils clk: amlogic: aoclk: use clkc-utils syscon probe clk: amlogic: use probe helper in mmio based controllers clk: amlogic: add probe helper for mmio based controllers clk: amlogic: drop meson-clkcee clk: amlogic: naming consistency alignment commit 56f34e97d9eee6b640ff7a4baa7b8b773e152efe Merge: a5a8844af43448 d2d3f529e7b6ff Author: Jakub Kicinski Date: Mon Sep 15 18:34:11 2025 -0700 Merge branch 'microchip-lan865x-minor-improvements' Stefan Wahren says: ==================== microchip: lan865x: Minor improvements Recently I setup a custom i.MX93 board which contains a LAN8651 chip. These minor improvements were considered as helpful. The series has been tested with the mentioned i.MX93 board. ==================== Link: https://patch.msgid.link/20250912140332.35395-1-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit d2d3f529e7b6ff2aa432b16a2317126621c28058 Author: Stefan Wahren Date: Fri Sep 12 16:03:32 2025 +0200 ethernet: Extend device_get_mac_address() to use NVMEM A lot of modern SoC have the ability to store MAC addresses in their NVMEM. So extend the generic function device_get_mac_address() to obtain the MAC address from an nvmem cell named 'mac-address' in case there is no firmware node which contains the MAC address directly. Signed-off-by: Stefan Wahren Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit c5b7509d3a47c0c7b09629340c90ce5d4dae07ca Author: Stefan Wahren Date: Fri Sep 12 16:03:31 2025 +0200 microchip: lan865x: Enable MAC address validation Use the generic eth_validate_addr() function for MAC address validation. Signed-off-by: Stefan Wahren Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250912140332.35395-2-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit a5a8844af43448cd2b3bf5f0e588396671192157 Merge: 7acc8b904836f7 12e74931ee9792 Author: Jakub Kicinski Date: Mon Sep 15 18:27:22 2025 -0700 Merge branch 'tools-ynl-rst-display-attribute-set-doc' Matthieu Baerts says: ==================== tools: ynl: rst: display attribute-set doc Some attribute-set have a documentation (doc:), but they are not displayed in the RST / HTML version. This series adds the missing parsing of these 'doc' fields. While at it, it also fixes how the 'doc' fields are declared on multiple lines. ==================== Link: https://patch.msgid.link/20250913-net-next-ynl-attr-doc-rst-v3-0-4f06420d87db@kernel.org Signed-off-by: Jakub Kicinski commit 12e74931ee9792b5256f4433efd779cfd0aca443 Author: Matthieu Baerts (NGI0) Date: Sat Sep 13 15:29:53 2025 +0200 netlink: specs: explicitly declare block scalar strings In YAML, it is allowed to declare a scalar strings at the next lines without explicitly declaring them as a block. Yet, they looks weird, and can cause issues when ':' or '#' are present. The modified lines didn't have issues with the special characters, but it seems better to explicitly declare such blocks as scalar strings to encourage people to "properly" declare future scalar strings. The right angle bracket is used with a minus sign to indicate that the folded style should be used without adding extra newlines. By doing that, the output is not changed compared to what was done before this patch. Suggested-by: Donald Hunter Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250913-net-next-ynl-attr-doc-rst-v3-3-4f06420d87db@kernel.org Signed-off-by: Jakub Kicinski commit 515c0ead788f4118a91b3ae55fe51f95543553ec Author: Matthieu Baerts (NGI0) Date: Sat Sep 13 15:29:52 2025 +0200 netlink: specs: team: avoid mangling multilines doc By default, strings defined in YAML at the next line are folded: newlines are replaced by spaces. Here, the newlines are there for a reason, and should be kept in the output. This can be fixed by adding the '|' symbol to use the "literal" style. This issue was introduced by commit 387724cbf415 ("Documentation: netlink: add a YAML spec for team"), but visible in the doc only since the parent commit. To avoid warnings when generating the HTML output, and to look better, the code layout is now in a dedicated code block, which requires '::' and a new blank line. Just for a question of uniformity, a new blank line is also added after the code block. Suggested-by: Donald Hunter Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250913-net-next-ynl-attr-doc-rst-v3-2-4f06420d87db@kernel.org Signed-off-by: Jakub Kicinski commit a51126424f75a7b44b11f7b821f6abb0b78bd931 Author: Matthieu Baerts (NGI0) Date: Sat Sep 13 15:29:51 2025 +0200 tools: ynl: rst: display attribute-set doc Some attribute-set have a documentation (doc:), but it was not displayed in the RST / HTML version. Such field can be found in ethtool, netdev, tcp_metrics and team YAML files. Only the 'name' and 'attributes' fields from an 'attribute-set' section were parsed. Now the content of the 'doc' field, if available, is added as a new paragraph before listing each attribute. This is similar to what is done when parsing the 'operations'. Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250913-net-next-ynl-attr-doc-rst-v3-1-4f06420d87db@kernel.org Signed-off-by: Jakub Kicinski commit 57a7b5b0b6d9b92871bffcc21865ec07d5c8b297 Author: Al Viro Date: Tue Aug 26 16:59:16 2025 -0400 open_detached_copy(): separate creation of namespace into helper ... and convert the helper to use of a guard(namespace_excl) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 71cf10ce4562ed7b18f3bd44a4e2dfafd0e84c50 Author: Al Viro Date: Tue Aug 26 16:53:42 2025 -0400 open_detached_copy(): don't bother with mount_lock_hash() we are holding namespace_sem and a reference to root of tree; iterating through that tree does not need mount_lock. Neither does the insertion into the rbtree of new namespace or incrementing the mount count of that namespace. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1a22542b5ffe2f91859ed7c7e610dc7b588a6713 Author: Al Viro Date: Tue Sep 2 19:55:41 2025 -0400 path_has_submounts(): use guard(mount_locked_reader) Needed there since the callback passed to d_walk() (path_check_mount()) is using __path_is_mountpoint(), which uses __lookup_mnt(). Has to be taken in the caller - d_walk() might take rename_lock spinlock component and that nests inside mount_lock. Signed-off-by: Al Viro commit 19ac81735c9bcb0c93895e3674792b923ac16956 Author: Al Viro Date: Wed Aug 20 03:11:30 2025 -0400 fs/namespace.c: sanitize descriptions for {__,}lookup_mnt() Comments regarding "shadow mounts" were stale - no such thing anymore. Document the locking requirements for __lookup_mnt(). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit fc812c40f5eeee81836eabc3cdd017a46fe39d4c Author: Al Viro Date: Thu Jul 24 22:45:09 2025 -0400 ecryptfs: get rid of pointless mount references in ecryptfs dentries ->lower_path.mnt has the same value for all dentries on given ecryptfs instance and if somebody goes for mountpoint-crossing variant where that would not be true, we can deal with that when it happens (and _not_ with duplicating these reference into each dentry). As it is, we are better off just sticking a reference into ecryptfs-private part of superblock and keeping it pinned until ->kill_sb(). That way we can stick a reference to underlying dentry right into ->d_fsdata of ecryptfs one, getting rid of indirection through struct ecryptfs_dentry_info, along with the entire struct ecryptfs_dentry_info machinery. [kudos to Dan Carpenter for spotting a bug in ecryptfs_get_tree() part] Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 75db7fd99075bf46f3bfeaa8f1aaa8b13b2590cf Author: Al Viro Date: Tue Aug 19 12:22:03 2025 -0400 umount_tree(): take all victims out of propagation graph at once For each removed mount we need to calculate where the slaves will end up. To avoid duplicating that work, do it for all mounts to be removed at once, taking the mounts themselves out of propagation graph as we go, then do all transfers; the duplicate work on finding destinations is avoided since if we run into a mount that already had destination found, we don't need to trace the rest of the way. That's guaranteed O(removed mounts) for finding destinations and removing from propagation graph and O(surviving mounts that have master removed) for transfers. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit fc9d5efc4c620807af53d62285adc7d4bf9b9978 Author: Al Viro Date: Sun Aug 24 14:19:58 2025 -0400 do_mount(): use __free(path_put) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 43d672dbf1f20c1d09b4ee73498bb39442e70f18 Author: Al Viro Date: Sun Aug 24 14:00:12 2025 -0400 do_move_mount_old(): use __free(path_put) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 86af25b01df1181ac4a81d6cbbc6d48a9cc7106f Author: Al Viro Date: Sun Aug 24 16:55:27 2025 -0400 constify can_move_mount_beneath() arguments Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit f91c433a5c1240b5ad48d2cb8b69d38453b63e00 Author: Al Viro Date: Sun Aug 24 14:24:59 2025 -0400 path_umount(): constify struct path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 4f4b18af4c2e4abb7cb7047de5c6d7f5e4b48b05 Author: Al Viro Date: Sun Aug 24 14:23:24 2025 -0400 may_copy_tree(), __do_loopback(): constify struct path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8ec7ee2e0be710317bbfeeae8c16a3834e78ab9c Author: Al Viro Date: Sun Aug 24 14:18:09 2025 -0400 path_mount(): constify struct path argument now it finally can be done. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a8be822f61934b493bc1c8ed98aa3326b7d176df Author: Al Viro Date: Sun Aug 24 14:13:52 2025 -0400 do_{loopback,change_type,remount,reconfigure_mnt}(): constify struct path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 17d44b452c4f0135b1b18f99e2d4fc607de59af4 Author: Al Viro Date: Sun Aug 24 14:08:19 2025 -0400 do_new_mount{,_fc}(): constify struct path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 27e4b785596602cebe9acd0fd2d4fb4f5f9a3e4d Author: Al Viro Date: Sun Aug 24 14:06:07 2025 -0400 mnt_warn_timestamp_expiry(): constify struct path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 44b58cdaf99264a99e9f07e90b944ecdd8081c2a Author: Al Viro Date: Sun Jul 6 17:13:15 2025 -0400 do_move_mount(), vfs_move_mount(), do_move_mount_old(): constify struct path argument(s) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit b42ffcd5069d5cfb777b8982a1c55c7e2f1d3998 Author: Al Viro Date: Sun Aug 24 19:34:37 2025 -0400 collect_paths(): constify the return value callers have no business modifying the paths they get Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1f6df5847454dee8608f78ee0df7352472cb2447 Author: Al Viro Date: Sun Jul 6 18:45:02 2025 -0400 drop_collected_paths(): constify arguments ... and use that to constify the pointers in callers Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6e024a0e280e1ce3c18579b73735cf78bb7f1ead Author: Al Viro Date: Sun Jul 6 17:09:39 2025 -0400 do_set_group(): constify path arguments Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 08404199f3f232828dcd6614e34a0c154cddb13d Author: Al Viro Date: Sun Jul 6 17:04:02 2025 -0400 do_mount_setattr(): constify path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8be87700c9801559893d75ed6c8ae6685db60f1d Author: Al Viro Date: Wed Aug 20 14:48:46 2025 -0400 constify check_mnt() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 90006f21b78ab30cdab8bc5202d293655ce4cfc4 Author: Al Viro Date: Fri Aug 22 17:41:55 2025 -0400 do_lock_mount(): don't modify path. Currently do_lock_mount() has the target path switched to whatever might be overmounting it. We _do_ want to have the parent mount/mountpoint chosen on top of the overmounting pile; however, the way it's done has unpleasant races - if umount propagation removes the overmount while we'd been trying to set the environment up, we might end up failing if our target path strays into that overmount just before the overmount gets kicked out. Users of do_lock_mount() do not need the target path changed - they have all information in res->{parent,mp}; only one place (in do_move_mount()) currently uses the resulting path->mnt, and that value is trivial to reconstruct by the original value of path->mnt + chosen parent mount. Let's keep the target path unchanged; it avoids a bunch of subtle races and it's not hard to do: do as mount_locked_reader find the prospective parent mount/mountpoint dentry grab references if it's not the original target lock the prospective mountpoint dentry take namespace_sem exclusive if prospective parent/mountpoint would be different now err = -EAGAIN else if location has been unmounted err = -ENOENT else if mountpoint dentry is not allowed to be mounted on err = -ENOENT else if beneath and the top of the pile was the absolute root err = -EINVAL else try to get struct mountpoint (by dentry), set err to 0 on success and -ENO{MEM,ENT} on failure if err != 0 res->parent = ERR_PTR(err) drop locks else res->parent = prospective parent drop temporary references while err == -EAGAIN A somewhat subtle part is that dropping temporary references is allowed. Neither mounts nor dentries should be evicted by a thread that holds namespace_sem. On success we are dropping those references under namespace_sem, so we need to be sure that these are not the last references remaining. However, on success we'd already verified (under namespace_sem) that original target is still mounted and that mount and dentry we are about to drop are still reachable from it via the mount tree. That guarantees that we are not about to drop the last remaining references. Signed-off-by: Al Viro commit 25423edc787842d17520b3f9df4d0a58a6a663b1 Author: Al Viro Date: Wed Aug 20 03:23:12 2025 -0400 new helper: topmost_overmount() Returns the final (topmost) mount in the chain of overmounts starting at given mount. Same locking rules as for any mount tree traversal - either the spinlock side of mount_lock, or rcu + sample the seqcount side of mount_lock before the call and recheck afterwards. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ed8ba4aad78887d88231c1c66c0ddf9fe12aaad1 Author: Al Viro Date: Wed Aug 20 14:37:44 2025 -0400 don't bother passing new_path->dentry to can_move_mount_beneath() Signed-off-by: Al Viro commit a2bdb7d8dcf20810349e68824f399f5092269cf7 Author: Al Viro Date: Wed Aug 20 00:26:44 2025 -0400 pivot_root(2): use old_mp.mp->m_dentry instead of old.dentry That kills the last place where callers of lock_mount(path, &mp) used path->dentry. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6bfb6938e2ffd2ae0b9962aa7cc94c0808eeb100 Author: Al Viro Date: Fri Aug 22 19:03:29 2025 -0400 graft_tree(), attach_recursive_mnt() - pass pinned_mountpoint parent and mountpoint always come from the same struct pinned_mountpoint now. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ef307f89bfb662109a25acdde5b5837fe84a3a64 Author: Al Viro Date: Tue Aug 19 21:21:24 2025 -0400 do_add_mount(): switch to passing pinned_mountpoint instead of mountpoint + path Both callers pass it a mountpoint reference picked from pinned_mountpoint and path it corresponds to. First of all, path->dentry is equal to mp.mp->m_dentry. Furthermore, path->mnt is &mp.parent->mnt, making struct path contents redundant. Pass it the address of that pinned_mountpoint instead; what's more, if we teach it to treat ERR_PTR(error) in ->parent as "bail out with that error" we can simplify the callers even more - do_add_mount() will do the right thing even when called after lock_mount() failure. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 842e12352c3074b8af1bc95cc2bb1e9fb47f4334 Author: Al Viro Date: Wed Aug 20 13:47:43 2025 -0400 do_move_mount(): use the parent mount returned by do_lock_mount() After successful do_lock_mount() call, mp.parent is set to either real_mount(path->mnt) (for !beneath case) or to ->mnt_parent of that (for beneath). p is set to real_mount(path->mnt) and after several uses it's made equal to mp.parent. All uses prior to that care only about p->mnt_ns and since p->mnt_ns == parent->mnt_ns, we might as well use mp.parent all along. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2010464cfafb22821e39c216cb068d83c91d7d8b Author: Al Viro Date: Wed Aug 20 13:42:24 2025 -0400 change calling conventions for lock_mount() et.al. 1) pinned_mountpoint gets a new member - struct mount *parent. Set only if we locked the sucker; ERR_PTR() - on failed attempt. 2) do_lock_mount() et.al. return void and set ->parent to * on success with !beneath - mount corresponding to path->mnt * on success with beneath - the parent of mount corresponding to path->mnt * in case of error - ERR_PTR(-E...). IOW, we get the mount we will be actually mounting upon or ERR_PTR(). 3) we can't use CLASS, since the pinned_mountpoint is placed on hlist during initialization, so we define local macros: LOCK_MOUNT(mp, path) LOCK_MOUNT_MAYBE_BENEATH(mp, path, beneath) LOCK_MOUNT_EXACT(mp, path) All of them declare and initialize struct pinned_mountpoint mp, with unlock_mount done via __cleanup(). Users converted. [ lock_mount() is unused now; removed. Reported-by: Andy Shevchenko ] Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7acc8b904836f7e72833526279e7eef09b4b9065 Author: Yury Norov (NVIDIA) Date: Sat Sep 13 14:01:31 2025 -0400 mlxsw: spectrum_cnt: use bitmap_empty() in mlxsw_sp_counter_pool_fini() The function opencodes bitmap_empty(). Switch to the proper API in sake of verbosity. Signed-off-by: Yury Norov (NVIDIA) Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250913180132.202593-1-yury.norov@gmail.com Signed-off-by: Jakub Kicinski commit 1b25dea3867abc9bad6f0337d395c6f0ce4e4f6f Author: Al Viro Date: Thu Sep 4 21:47:50 2025 -0400 configfs:get_target() - release path as soon as we grab configfs_item reference ... and get rid of path argument - it turns into a local variable in get_target() Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 39e6bc58b8f47ce88d5a1863dd8bccc372ac2414 Author: Al Viro Date: Thu Sep 4 21:27:32 2025 -0400 apparmor/af_unix: constify struct path * arguments unix_sk(sock)->path should never be modified, least of all by LSM... Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 5f587dd9b77a110456ff05442be7852c2ac2475d Author: Al Viro Date: Fri Sep 5 00:58:00 2025 -0400 ovl_is_real_file: constify realpath argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ee17384ace3ca663b3d7c7c868d3355f2618ff6c Author: Al Viro Date: Sun Jul 6 21:55:21 2025 -0400 ovl_sync_file(): constify path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 055e9d5efc6f02f58ae96af8ab5d72a5436e860c Author: Al Viro Date: Sun Jul 6 21:54:20 2025 -0400 ovl_lower_dir(): constify path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 465309d63f6d98c58d545b2e96130432020a6c9e Author: Al Viro Date: Sun Jul 6 21:51:37 2025 -0400 ovl_get_verity_digest(): constify path argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit c93cd353744e57d1eea7d4c65d0377c75adae569 Author: Al Viro Date: Sun Jul 6 21:50:25 2025 -0400 ovl_validate_verity(): constify {meta,data}path arguments Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7e978e8fb6a349a7a413e8a8fe4b1366122ae467 Author: Al Viro Date: Sun Jul 6 21:49:22 2025 -0400 ovl_ensure_verity_loaded(): constify datapath argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 3d866c3b938c4f47cc8c5e27659d455f7e399c2e Author: Al Viro Date: Sun Jul 6 21:40:23 2025 -0400 ksmbd_vfs_set_init_posix_acl(): constify path argument Acked-by: Namjae Jeon Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit e74e75150e2b6dc0e059134d64b673dd887f1d17 Author: Al Viro Date: Sun Jul 6 21:39:26 2025 -0400 ksmbd_vfs_inherit_posix_acl(): constify path argument Acked-by: Namjae Jeon Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a67e08f74604a9f2e95b701d5de94a71d5d93a0e Author: Al Viro Date: Sun Jul 6 21:38:33 2025 -0400 ksmbd_vfs_kern_path_unlock(): constify path argument Acked-by: Namjae Jeon Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 94cb22d109d5172569cf0a477a9e76f08b92ed01 Author: Al Viro Date: Sun Jul 6 21:36:36 2025 -0400 ksmbd_vfs_path_lookup_locked(): root_share_path can be const struct path * Acked-by: Namjae Jeon Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 72c1118d32eb35e1548a161b428bd89d4a244f79 Author: Al Viro Date: Sun Jul 6 21:56:58 2025 -0400 check_export(): constify path argument Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2930afe2c9cb9aec329269e40c851bf56cdcc09c Author: Al Viro Date: Sun Jul 6 21:32:41 2025 -0400 export_operations->open(): constify path argument for the method and its sole instance... Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9c71fe0abf324ab0ba77e3d161d16af3e0f9074b Author: Al Viro Date: Sun Jul 6 18:53:37 2025 -0400 rqst_exp_get_by_name(): constify path argument Acked-by: Chuck Lever Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit df9a4d79f1decb1b85efa58a66bcf122d6b6c624 Author: Al Viro Date: Sun Jul 6 17:02:01 2025 -0400 nfs: constify path argument of __vfs_getattr() Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1b8abbb12128d0084712bf263d8f6bbc039e5547 Author: Al Viro Date: Sun Jul 6 18:39:04 2025 -0400 bpf...d_path(): constify path argument Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 63dbfb077cdad21b356e17d4ce76650e67b83159 Author: Al Viro Date: Sun Jul 6 21:58:05 2025 -0400 done_path_create(): constify path argument Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7b129f2e70e71651c98172fa35df1b3fdc3089f0 Author: Al Viro Date: Sun Jul 6 18:48:53 2025 -0400 filename_lookup(): constify root argument Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit dd22857510e1981a366992faabc5454d9d2b1357 Author: Al Viro Date: Sun Jul 6 16:56:47 2025 -0400 constify path argument of vfs_statx_path() Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit dae575e669811b201114702d96f6854d5c8324b5 Author: Al Viro Date: Thu Sep 4 23:16:35 2025 -0400 backing_file_user_path(): constify struct path * Callers never use the resulting pointer to modify the struct path it points to (nor should they). Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 4d01e55b1ac91369e4b67ab55caf10bcda939392 Author: Heiner Kallweit Date: Fri Sep 12 21:11:23 2025 +0200 r8169: log that system vendor flags ASPM as safe ASPM isn't disabled if system vendor flags it as safe. Log this, in order to know whom to blame if a user complains about ASPM issues on such a system. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/a532b46b-ef68-4d68-a129-35ff0ee35150@gmail.com Signed-off-by: Jakub Kicinski commit dd749a3cb9c1dc7303f8a6d5c15d9d80e58a502f Merge: 17a0374be98ea2 4689a42904299d Author: Jakub Kicinski Date: Mon Sep 15 18:15:43 2025 -0700 Merge branch 'net-phy-print-warning-if-usage-of-deprecated-array-style-fixed-link-binding-is-detected' Heiner Kallweit says: ==================== net: phy: print warning if usage of deprecated array-style fixed-link binding is detected The array-style fixed-link binding has been marked deprecated for more than 10 yrs, but still there's a number of users. Print a warning when usage of the deprecated binding is detected. ==================== Link: https://patch.msgid.link/b36f459f-958a-455e-9687-33da56e8b3b6@gmail.com Signed-off-by: Jakub Kicinski commit 4689a42904299d054e59fc9d59e8e00884ffcf87 Author: Heiner Kallweit Date: Fri Sep 12 21:07:16 2025 +0200 net: phylink: warn if deprecated array-style fixed-link binding is used The array-style fixed-link binding has been marked deprecated for more than 10 yrs, but still there's a number of users. Print a warning when usage of the deprecated binding is detected. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/cc823d38-2a2c-4c83-9a27-d7f25d61a2de@gmail.com Signed-off-by: Jakub Kicinski commit a8ebee579e7edcb543587ad462c77e2354335549 Author: Heiner Kallweit Date: Fri Sep 12 21:06:12 2025 +0200 of: mdio: warn if deprecated fixed-link binding is used The array-style fixed-link binding has been marked deprecated for more than 10 yrs, but still there's a number of users. Print a warning when usage of the deprecated binding is detected. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/faf94844-96eb-400f-8a3a-b2a0e93b27d7@gmail.com Signed-off-by: Jakub Kicinski commit 17a0374be98ea2469928a9c58f1e7b09c1a6e86c Author: Stanislav Fomichev Date: Fri Sep 12 10:06:11 2025 -0700 selftests: ncdevmem: remove sleep on rx RX devmem sometimes fails on NIPA: https://netdev-3.bots.linux.dev/vmksft-fbnic-qemu-dbg/results/294402/7-devmem-py/ Both RSS and flow steering are properly installed, but the wait_port_listen fails. Try to remove sleep(1) to see if the cause of the failure is spending too much time during RX setup. I don't see a good reason to have sleep in the first place. If there needs to be a delay between installing the rules and receiving the traffic, let's add it to the callers (devmem.py) instead. Signed-off-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250912170611.676110-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit ba5c906d5177609bab766c7b0beca88465a2c268 Merge: f3b52167a0cb23 3f9a22be374b86 Author: Jakub Kicinski Date: Mon Sep 15 18:14:25 2025 -0700 Merge branch 'mptcp-misc-minor-cleanups' Matthieu Baerts says: ==================== mptcp: misc minor cleanups Here are some small unrelated cleanups collected when working on some fixes recently. - Patches 1 & 2: close file descriptors in exit paths in the selftests. - Patch 3: fix a wrong type (int i/o u32) when parsing netlink message. ==================== Link: https://patch.msgid.link/20250912-net-next-mptcp-minor-fixes-6-18-v1-0-99d179b483ad@kernel.org Signed-off-by: Jakub Kicinski commit 3f9a22be374b864c9199a43971d0eec18a88cde4 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 18:36:49 2025 +0200 mptcp: pm: netlink: fix if-idx type As pointed out by Donald, when parsing an entry, the wrong type was set for the temp value: this value is signed. There are no real issues here, because the intermediate variable was only wrong for the sign, not for the size, and the final variable had the right sign. But this feels wrong, and is confusing, so fixing this small typo introduced by commit ef0da3b8a2f1 ("mptcp: move address attribute into mptcp_addr_info"). Reported-by: Donald Hunter Closes: https://lore.kernel.org/m2plc0ui9z.fsf@gmail.com Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-next-mptcp-minor-fixes-6-18-v1-3-99d179b483ad@kernel.org Signed-off-by: Jakub Kicinski commit e3241506a47175de74f65bc638e588b9f70dc105 Author: Geliang Tang Date: Fri Sep 12 18:36:48 2025 +0200 selftests: mptcp: close server IPC descriptors The client-side function connect_one_server() properly closes its IPC descriptor after use, but the server-side code in both mptcp_sockopt.c and mptcp_inq.c was missing corresponding close() calls for their IPC descriptors, leaving file descriptors open unnecessarily. This change ensures proper cleanup by: 1. Adding missing close(pipefds[0]/unixfds[0]) in server processes 2. Adding close(pipefds[1]/unixfds[1]) after server() function calls This ensures both ends of the IPC pipe are properly closed in their respective processes, preventing file descriptor leaks. Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-next-mptcp-minor-fixes-6-18-v1-2-99d179b483ad@kernel.org Signed-off-by: Jakub Kicinski commit dab86ee688ae03919648c871c603356818090797 Author: Geliang Tang Date: Fri Sep 12 18:36:47 2025 +0200 selftests: mptcp: close server file descriptors The server file descriptor ('fd') is opened in server() but never closed. While accepted connections are properly closed in process_one_client(), the main listening socket remains open, causing a resource leak. This patch ensures the server fd is properly closed after processing clients, bringing the sockopt and inq test cases in line with proper resource cleanup practices. Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-next-mptcp-minor-fixes-6-18-v1-1-99d179b483ad@kernel.org Signed-off-by: Jakub Kicinski commit f3b52167a0cb23b27414452fbc1278da2ee884fc Author: Jakub Kicinski Date: Fri Sep 12 09:17:03 2025 -0700 page_pool: always add GFP_NOWARN for ATOMIC allocations Driver authors often forget to add GFP_NOWARN for page allocation from the datapath. This is annoying to users as OOMs are a fact of life, and we pretty much expect network Rx to hit page allocation failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations by default. Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3a0ac202534bcd397e6fd744b6d1038d372c5b5e Author: Feng Zhou Date: Fri Sep 12 22:01:33 2025 +0800 io_uring/zcrx: fix ifq->if_rxq is -1, get dma_dev is NULL ifq->if_rxq has not been assigned, is -1, the correct value is in reg.if_rxq. Fixes: 59b8b32ac8d469958936fcea781c7f58e3d64742 ("io_uring/zcrx: add support for custom DMA devices") Signed-off-by: Feng Zhou Reviewed-by: Jens Axboe Link: https://patch.msgid.link/20250912140133.97741-1-zhoufeng.zf@bytedance.com Signed-off-by: Jakub Kicinski commit 1bdf99fd1d82622c8c0da2b6189ca257662ea307 Author: Alok Tiwari Date: Fri Sep 12 06:31:30 2025 -0700 bonding: fix standard reference typo in ad_select description The bonding option description for "ad_select" mistakenly referred to "803.ad". Update it to the correct IEEE standard "802.3ad". Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250912133132.3920213-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit f037fd7fbca4d111955b5889417ddf6fb24498e5 Author: Al Viro Date: Mon Feb 6 23:24:35 2023 -0500 alpha: unobfuscate _PAGE_P() definition Way, way back it used to be _PAGE_NORMAL((x) | ((x & _PAGE_FOW) ? 0 : _PAGE_FOW | _PAGE_COW)) Then (in 1.3.54) _PAGE_COW had died. Result: _PAGE_NORMAL((x) | ((x & _PAGE_FOW) ? 0 : _PAGE_FOW)) which is somewhat... obscure. What it does is simply _PAGE_NORMAL((x) | _PAGE_FOW) and IMO that's easier to follow. Signed-off-by: Al Viro commit 50247b66428e8aae306b754fb958d4f38a2b102d Author: Al Viro Date: Fri Feb 3 14:37:59 2023 -0500 kill FIRST_USER_PGD_NR dead since 2005, time to bury the body... Reviewed-by: Michal Simek # microblaze Reviewed-by: Max Filippov Signed-off-by: Al Viro commit ccd74beccdacda1533ad6f2de747e8f267276061 Merge: 8f5ae30d69d754 5aba939e80f439 Author: Stephen Boyd Date: Mon Sep 15 18:11:00 2025 -0700 Merge tag 'for-6.18-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into clk-tegra Pull Tegra clk driver updates from Thierry Reding: - Add DFLL support on Tegra114 This is quite similar to the existing Tegra124 support and most of the code can be reused, except for the CVB frequency tables. * tag 'for-6.18-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: clk: tegra: dfll: Add CVB tables for Tegra114 clk: tegra: Add DFLL DVCO reset control for Tegra114 dt-bindings: arm: tegra: Add ASUS TF101G and SL101 dt-bindings: reset: Add Tegra114 CAR header dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) dt-bindings: clock: tegra30: Add IDs for CSI pad clocks dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C commit 180a9cc3fd6a020746fbd7f97b9b62295a325fd2 Author: Al Viro Date: Fri Feb 9 14:57:43 2024 -0500 make it easier to catch those who try to modify ->d_name Turn d_name into an anon union of const struct qstr d_name with struct qstr __d_name. Very few places need to modify it (all in fs/dcache.c); those are switched to use of ->__d_name. Note that ->d_name can actually change under you unless you have the right locking environment; this const just prohibits accidentally doing stores without being easily spotted. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ca97d6c60b1d1dff519a7e3dd86708304e657365 Author: Al Viro Date: Fri Jul 11 05:45:01 2025 -0400 generic_ci_validate_strict_name(): constify name argument Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6acbce445a5f2b4cf200f2ee04d920fd22cde85e Author: Al Viro Date: Fri Jul 11 05:44:31 2025 -0400 afs_dir_search: constify qstr argument Reviewed-by: David Howells Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 3edcd68e35a7ad21186dbe9f74fad59cdcd24d71 Author: Al Viro Date: Sun Feb 4 21:39:50 2024 -0500 afs_edit_dir_{add,remove}(): constify qstr argument Nothing outside of fs/dcache.c has any business modifying dentry names; passing &dentry->d_name as an argument should have that argument declared as a const pointer. Reviewed-by: David Howells Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2974831dd5d298d18d0ea87ec46a84e920731efa Author: Al Viro Date: Sun Feb 4 21:33:49 2024 -0500 exfat_find(): constify qstr argument Nothing outside of fs/dcache.c has any business modifying dentry names; passing &dentry->d_name as an argument should have that argument declared as a const pointer. Acked-by: Namjae Jeon Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit f9fadf23c7f1a0df72ef50a873e1bd3bd4631ec1 Author: Al Viro Date: Sun Feb 4 21:25:18 2024 -0500 security_dentry_init_security(): constify qstr argument Nothing outside of fs/dcache.c has any business modifying dentry names; passing &dentry->d_name as an argument should have that argument declared as a const pointer. Acked-by: Casey Schaufler # smack part Acked-by: Paul Moore Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 78fb23d77b12b73f996356731f71612ad8a5b692 Merge: 943a4fd7e1f382 08f89e42121d42 Author: Jakub Kicinski Date: Mon Sep 15 17:44:38 2025 -0700 Merge branch 'add-pcs-support-for-renesas-rz-t2h-n2h-socs' Lad Prabhakar says: ==================== Add PCS support for Renesas RZ/{T2H,N2H} SoCs This series aims to add PCS support for the Renesas RZ/T2H and RZ/N2H SoCs These SoCs include a MII converter (MIIC) that converts MII to RMII/RGMII or can be set in pass-through mode for MII similar to the RZ/N1 SoC. The MIIC is used in conjunction with the Ethernet switch (ETHSW) available on these SoCs. ==================== Link: https://patch.msgid.link/20250910204132.319975-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 08f89e42121d421b3a6571dd82485a0669beeb45 Author: Lad Prabhakar Date: Wed Sep 10 21:41:30 2025 +0100 net: pcs: rzn1-miic: Add RZ/T2H MIIC support Add support for the Renesas RZ/T2H MIIC by defining SoC-specific modctrl match tables, register map, and string representations for converters and ports. Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-10-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 419747319e3a138ed3ee862fe9b66aa1735ae3bf Author: Lad Prabhakar Date: Wed Sep 10 21:41:29 2025 +0100 net: pcs: rzn1-miic: Add per-SoC control for MIIC register unlock/lock Make MIIC accessory register unlock/lock behaviour selectable via SoC/OF data. Add init_unlock_lock_regs and miic_write to struct miic_of_data so the driver can either perform the traditional global unlock sequence (as used on RZ/N1) or use a different policy for other SoCs (for example RZ/T2H, which does not require leaving registers unlocked). miic_reg_writel() now calls the per-SoC miic_write callback to perform register writes. Provide miic_reg_writel_unlocked() as the default writer and set it for the RZ/N1 OF data so existing platforms keep the same behaviour. Add a miic_unlock_regs() helper that implements the accessory register unlock sequence so the unlock/lock sequence can be reused where needed (for example when a SoC requires explicit unlock/lock around individual accesses). This change is preparatory work for supporting RZ/T2H. Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-9-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 882a8bb0706c0c3af6b33858bcad630cf61fe894 Author: Lad Prabhakar Date: Wed Sep 10 21:41:28 2025 +0100 net: pcs: rzn1-miic: Add support to handle resets Add reset-line handling to the RZN1 MIIC driver and move reset configuration into the SoC/OF data. Introduce MIIC_MAX_NUM_RSTS (= 2), add storage for reset_control_bulk_data in struct miic and add reset_ids and reset_count fields to miic_of_data. When reset_ids are present in the OF data, the driver obtains the reset lines with devm_reset_control_bulk_get_exclusive(), deasserts them during probe and registers a devres action to assert them on remove or on error. This change is preparatory work to support the RZ/T2H SoC, which exposes two reset lines for the ETHSS IP. The driver remains backward compatible for platforms that do not provide reset lines. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-8-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 6245237abae3e78dd0bba20c6067ff45619481a5 Author: Lad Prabhakar Date: Wed Sep 10 21:41:27 2025 +0100 net: pcs: rzn1-miic: Make switch mode mask SoC-specific Move the hardcoded switch mode mask definition into the SoC-specific miic_of_data structure. This allows each SoC to define its own mask value rather than relying on a single fixed constant. For RZ/N1 the mask remains GENMASK(4, 0). This is in preparation for adding support for RZ/T2H, where the switch mode mask is GENMASK(2, 0). Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit c112520de041758e037682bb63c51ab0d69e1adf Author: Lad Prabhakar Date: Wed Sep 10 21:41:26 2025 +0100 net: pcs: rzn1-miic: move port range handling into SoC data Define per-SoC miic_port_start and miic_port_max fields in struct miic_of_data and use them to validate the device-tree "reg" port number and to compute the driver's internal zero-based port index as (port - miic_port_start). Replace uses of the hard-coded MIIC_MAX_NR_PORTS with the SoC-provided miic_port_max when iterating over ports. On RZ/N1 the MIIC ports are numbered 1..5, whereas RZ/T2H numbers its MIIC ports 0..3. By making the port base and range part of the OF data the driver no longer assumes a fixed numbering scheme and can support SoCs that enumerate ports from either zero or one and that expose different numbers of ports. This change is preparatory work for adding RZ/T2H support. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit f39e968dc168a7bd31fbdb320f4ff4ffd98d4589 Author: Lad Prabhakar Date: Wed Sep 10 21:41:25 2025 +0100 net: pcs: rzn1-miic: Move configuration data to SoC-specific struct Move configuration data such as the modctrl matching table, converter count, and string lookup tables into the SoC-specific miic_of_data structure. Update the helper functions to use the per-SoC configuration instead of relying on fixed-size arrays or global tables, and allocate DT configuration memory dynamically. This refactoring keeps the existing RZ/N1 support intact while preparing the driver to handle the different configuration requirements of the RZ/T2H SoC. Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 861d10f09250537e6eb0cfd3b6fcee8ada8b482f Author: Lad Prabhakar Date: Wed Sep 10 21:41:24 2025 +0100 net: pcs: rzn1-miic: Add missing include files The pcs-rzn1-miic driver makes use of ARRAY_SIZE(), BIT() and GENMASK() macros but does not explicitly include the headers where they are defined. Add the missing and includes. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit b2e12fca3164faf7e0c073000ef693c7d9f764b2 Author: Lad Prabhakar Date: Wed Sep 10 21:41:23 2025 +0100 net: pcs: rzn1-miic: Drop trailing comma from of_device_id table Remove the trailing comma after the sentinel entry in the of_device_id match table. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250910204132.319975-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 8c01cc2382bc351672c8eb946c16f567cfffef60 Author: Lad Prabhakar Date: Wed Sep 10 21:41:22 2025 +0100 dt-bindings: net: pcs: renesas,rzn1-miic: Add RZ/T2H and RZ/N2H support Add device tree binding support for RZ/T2H and RZ/N2H SoCs to the existing RZ/N1 MIIC converter binding. These SoCs share similar MIIC functionality but have architectural differences that require schema updates. Add new compatible strings "renesas,r9a09g077-miic" for RZ/T2H and "renesas,r9a09g087-miic" for RZ/N2H, with the latter falling back to the RZ/T2H variant. The new SoCs require reset support with two reset lines for converter register reset and converter reset, which are not present on RZ/N1. Update port configurations to accommodate the different architectures. RZ/N1 supports 5 ports numbered 1-5 with complex input mappings covering indices 0-13, while RZ/T2H and RZ/N2H support 4 ports numbered 0-3 with simplified input mappings covering indices 0-8. Extend the switch port configuration property to support value 0 for the new SoCs. Add a new dt-bindings header file with media interface connection matrix constants that map GMAC, ESC, and ETHSW ports to numeric identifiers for use with RZ/T2H and RZ/N2H device trees. Update DT schema validation to ensure proper port numbering and input mappings per SoC variant. Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250910204132.319975-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 5770495279d79514989b00fe9ef0ff487bf2e54e Merge: 35106dd36c244b 472df181d7c4c7 Author: Dave Airlie Date: Tue Sep 16 10:35:41 2025 +1000 Merge tag 'exynos-drm-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next New feature - Add glue layer support for Exynos7870 DSIM in Exynos DSI driver . Introduces Exynos7870 DSIM bridge integration at Exynos DRM DSI layer. Bug fixups for exynos7_drm_decon.c module - Remove redundant ctx->suspended state handling . Cleans up unused state check logic as call flow is now correctly managed. . Fixes an issue where decon_commit() was blocked from decon_atomic_enable() due to incorrect state setting. Signed-off-by: Dave Airlie From: Inki Dae Link: https://lore.kernel.org/r/20250915113543.51294-1-inki.dae@samsung.com commit 35106dd36c244b03a13f12c8d832e5e065bb274a Merge: 8299ee7ff7d545 77169a11d4e991 Author: Dave Airlie Date: Tue Sep 16 10:31:32 2025 +1000 Merge tag 'exynos-drm-misc-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next New feature - Add DSIM bridge driver support for Exynos7870 . Introduces Exynos7870 DSIM IP block support in the samsung-dsim bridge driver. - Document Exynos7870 DSIM compatible in dt-bindings . Adds exynos7870 compatible string and required clocks in device tree schema. Signed-off-by: Dave Airlie From: Inki Dae Link: https://lore.kernel.org/r/20250915111802.28177-1-inki.dae@samsung.com commit 8299ee7ff7d545ad8cb5ebd969642414ba9df850 Merge: 0d9f0083f7a5a3 b5bad77e1e3c72 Author: Dave Airlie Date: Tue Sep 16 10:21:37 2025 +1000 Merge tag 'drm-msm-next-2025-09-12' of https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v6.18 GPU and Core: - in DT bindings describe clocks per GPU type - GMU bandwidth voting for x1-85 - a663 speedbins - a623 speedbins - cleanup some remaining no-iommu leftovers after VM_BIND conversion - fix GEM obj 32b size truncation - add missing VM_BIND param validation - various fixes - IFPC for x1-85 and a750 - register xml and gen_header.py sync from mesa Display: - add missing bindings for display on SC8180X - added DisplayPort MST bindings - conversion from round_rate() to determine_rate() - DSI PHY fixes, correcting programming glitches - misc small fixes Signed-off-by: Dave Airlie From: Rob Clark Link: https://lore.kernel.org/r/CACSVV01FgXN+fD6U1Hi6Tj4WCf=V-+NO8BXi+80iS4qOZwpaGg@mail.gmail.com commit e0cda0dd12e08ecb8d26b8d78dc63e67e7069510 Author: Takashi Sakamoto Date: Tue Sep 16 08:47:47 2025 +0900 firewire: core: annotate fw_destroy_nodes with must-hold-lock The function, fw_destroy_nodes(), is used widely within firewire-core module. It has a prerequisite condition that struct fw_card.lock must be hold in advance. This commit adds annotation for it. Link: https://lore.kernel.org/r/20250915234747.915922-7-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit b5725cfa4120a4d234ab112aad151d731531d093 Author: Takashi Sakamoto Date: Tue Sep 16 08:47:46 2025 +0900 firewire: core: use spin lock specific to timer for split transaction At present the parameters to compute timeout time for split transaction is protected by card-wide spin lock, while it is not necessarily convenient in a point to narrower critical section. This commit adds and uses another spin lock specific for the purpose. Link: https://lore.kernel.org/r/20250915234747.915922-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 420bd7068cbfaea0a857472dd631dc48311e2a8f Author: Takashi Sakamoto Date: Tue Sep 16 08:47:45 2025 +0900 firewire: core: use spin lock specific to transaction The list of instance for asynchronous transaction to wait for response subaction is maintained as a member of fw_card structure. The card-wide spinlock is used at present for any operation over the list, however it is not necessarily suited for the purpose. This commit adds and uses the spin lock specific to maintain the list. Link: https://lore.kernel.org/r/20250915234747.915922-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 7d138cb269dbd2fa9b0da89a9c10503d1cf269d5 Author: Takashi Sakamoto Date: Tue Sep 16 08:47:44 2025 +0900 firewire: core: use spin lock specific to topology map At present, the operation for read transaction to topology map register is not protected by any kind of lock primitives. This causes a potential problem to result in the mixed content of topology map. This commit adds and uses spin lock specific to topology map. Link: https://lore.kernel.org/r/20250915234747.915922-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 07c446e35b89bc8774792f8036e595cffdf5b162 Author: Takashi Sakamoto Date: Tue Sep 16 08:47:43 2025 +0900 firewire: core: maintain phy packet receivers locally in cdev layer The list of receivers for phy packet is used only by cdev layer, while it is maintained as a member of fw_card structure. This commit maintains the list locally in cdev layer. Link: https://lore.kernel.org/r/20250915234747.915922-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 80c5b023a7d6ae41bd79aadece4cb1fc62e95a08 Author: Takashi Sakamoto Date: Tue Sep 16 08:47:42 2025 +0900 firewire: core: use scoped_guard() to manage critical section to update topology At present, guard() macro is used for the critical section to update topology. It is inconvenient to add the other critical sections into the function. This commit uses scoped_guard() macro instead. Link: https://lore.kernel.org/r/20250915234747.915922-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit c5931d590e793c0291c0ba9fd1247567786612ea Author: Chris Leech Date: Thu Aug 21 13:48:16 2025 -0700 nvme-auth: use hkdf_expand_label() When generating keying material during an authentication transaction (secure channel concatenation), the HKDF-Expand-Label function is part of the specified key derivation process. The current open-coded implementation misses the length prefix requirements on the HkdfLabel label and context variable-length vectors (RFC 8446 Section 3.4). Instead, use the hkdf_expand_label() function. Signed-off-by: Chris Leech Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 1cab50da62aa810e532396fcaeb96cf9c3fdf87a Author: Chris Leech Date: Thu Aug 21 13:48:15 2025 -0700 nvme-auth: add hkdf_expand_label() Provide an implementation of RFC 8446 (TLS 1.3) HKDF-Expand-Label Signed-off-by: Chris Leech Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 943a4fd7e1f382ac35cb630b0c04f695ef12ab2b Merge: 0915cb22452723 30f5ca00624397 Author: Jakub Kicinski Date: Mon Sep 15 16:26:40 2025 -0700 Merge branch 'accecn-protocol-patch-series' TCP preparations for AccECN support Just code reshuffling, no functional changes. Link: https://patch.msgid.link/20250911110642.87529-1-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 30f5ca00624397d81c99515bdd43286ade93d7c8 Author: Chia-Yu Chang Date: Thu Sep 11 13:06:32 2025 +0200 tcp: ecn functions in separated include file The following patches will modify ECN helpers and add AccECN herlpers, and this patch moves the existing ones into a separated include file. No functional changes. Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250911110642.87529-5-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit c3426ba2ed6942fe33c75bf17fc7513ba2c6ac64 Author: Chia-Yu Chang Date: Thu Sep 11 13:06:31 2025 +0200 tcp: reorganize tcp_sock_write_txrx group for variables later Use the first 3-byte hole at the beginning of the tcp_sock_write_txrx group for 'noneagle'/'rate_app_limited' to fill in the existing hole in later patches. Therefore, the group size of tcp_sock_write_txrx is reduced from 92 + 4 to 91 + 4. In addition, the group size of tcp_sock_write_rx is changed to 96 to fit in the pahole outcome. Below are the trimmed pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_sock { [...] __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2521 0 */ /* XXX 3 bytes hole, try to pack */ [...] struct tcp_options_received rx_opt; /* 2588 24 */ u8 nonagle:4; /* 2612: 0 1 */ u8 rate_app_limited:1; /* 2612: 4 1 */ /* XXX 3 bits hole, try to pack */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2613 0 */ /* XXX 3 bytes hole, try to pack */ __cacheline_group_begin__tcp_sock_write_rx[0] __attribute__((__aligned__(8))); /* 2616 0 */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2712 0 */ [...] /* size: 3200, cachelines: 50, members: 161 */ } [AFTER THIS PATCH] struct tcp_sock { [...] __cacheline_group_begin__tcp_sock_write_txrx[0]; /* 2521 0 */ u8 nonagle:4; /* 2521: 0 1 */ u8 rate_app_limited:1; /* 2521: 4 1 */ /* XXX 3 bits hole, try to pack */ /* XXX 2 bytes hole, try to pack */ [...] struct tcp_options_received rx_opt; /* 2588 24 */ __cacheline_group_end__tcp_sock_write_txrx[0]; /* 2612 0 */ /* XXX 4 bytes hole, try to pack */ __cacheline_group_begin__tcp_sock_write_rx[0] __attribute__((__aligned__(8))); /* 2616 0 */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2712 0 */ [...] /* size: 3200, cachelines: 50, members: 161 */ } Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250911110642.87529-4-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 61b2f7baa9779b12a7bf1b9800a3f2a2549a1315 Author: Ilpo Järvinen Date: Thu Sep 11 13:06:30 2025 +0200 tcp: fast path functions later The following patch will use tcp_ecn_mode_accecn(), TCP_ACCECN_CEP_INIT_OFFSET, TCP_ACCECN_CEP_ACE_MASK in __tcp_fast_path_on() to make new flag for AccECN. No functional changes. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250911110642.87529-3-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 449144f4d5f284c038c57bd7ea54c0d4b7ca766d Author: Ilpo Järvinen Date: Thu Sep 11 13:06:29 2025 +0200 tcp: reorganize SYN ECN code Prepare for AccECN that needs to have access here on IP ECN field value which is only available after INET_ECN_xmit(). No functional changes. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250911110642.87529-2-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 00d95fcc4dee66dfb6980de6f2973b32f973a1eb Author: Jonathan Corbet Date: Tue Sep 9 13:35:37 2025 -0600 docs: kdoc: handle the obsolescensce of docutils.ErrorString() The ErrorString() and SafeString() docutils functions were helpers meant to ease the handling of encodings during the Python 3 transition. There is no real need for them after Python 3.6, and docutils 0.22 removes them, breaking the docs build Handle this by just injecting our own one-liner version of ErrorString(), and removing the sole SafeString() call entirely. Reported-by: Zhixu Liu Signed-off-by: Jonathan Corbet Message-ID: <87ldmnv2pi.fsf@trenco.lwn.net> commit 944df7a31452f75bbc15b1e7215e1aacee8cd1b4 Author: Jonathan Corbet Date: Mon Sep 8 13:32:10 2025 -0600 docs: update the guidance for Link: tags As stated definitively by Linus, the use of Link: tags should be limited to situations where there is additional useful information to be found at the far end of the link. Update our documentation to reflect that policy, and to remove the suggestion for a Git hook to add those tags automatically. Link: https://lore.kernel.org/all/CAHk-=wh5AyuvEhNY9a57v-vwyr7EkPVRUKMPwj92yF_K0dJHVg@mail.gmail.com/ Cc: Linus Walleij Reviewed-by: Randy Dunlap Reviewed-by: Linus Walleij Signed-off-by: Jonathan Corbet Message-ID: <87segwyc3p.fsf@trenco.lwn.net> commit bb676996ed583464504123721195e98a708fbba9 Author: Brian Masney Date: Thu Jul 10 19:42:17 2025 -0400 ARM: OMAP2+: clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to virt_prcm_set_ops had to be made manually. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-arm32-clk-round-rate-v1-2-a9146b77aca9@redhat.com Signed-off-by: Kevin Hilman commit e2c0510935c5485a2dacfd13af3958536b9d138b Author: Brian Masney Date: Thu Jul 10 19:42:16 2025 -0400 ARM: OMAP1: clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Acked-by: Janusz Krzysztofik Link: https://lore.kernel.org/r/20250710-arm32-clk-round-rate-v1-1-a9146b77aca9@redhat.com Signed-off-by: Kevin Hilman commit 0915cb22452723407ca9606b7e5cc3fe6ce767d5 Author: Oleksij Rempel Date: Fri Sep 12 15:20:00 2025 +0200 net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR Clear EEE runtime flags when the PHY transitions to HALTED or ERROR and the state machine drops the link. This avoids stale EEE state being reported via ethtool after the PHY is stopped or hits an error. This change intentionally only clears software runtime flags and avoids MDIO accesses in HALTED/ERROR. A follow-up patch will address other link state variables. Suggested-by: Russell King (Oracle) Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250912132000.1598234-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit b7df2e7eaef7c5402d47553b2cc82f92b301ecb4 Author: Victor Nogueira Date: Fri Sep 12 12:46:16 2025 -0300 selftests/tc-testing: Adapt tc police action tests for Gb rounding changes For the tc police action, iproute2 rounds up mtu and burst sizes to a higher order representation. For example, if the user specifies the default mtu for a police action instance (4294967295 bytes), iproute2 will output it as 4096Mb when this action instance is dumped. After Jay's changes [1], iproute2 will round up to Gb, so 4096Mb becomes 4Gb. With that in mind, fix police's tc test output so that it works both with the current iproute2 version and Jay's. [1] https://lore.kernel.org/netdev/20250907014216.2691844-1-jay.vosburgh@canonical.com/ Signed-off-by: Victor Nogueira Reviewed-by: Cong Wang Reviewed-by: Jay Vosburgh Link: https://patch.msgid.link/20250912154616.67489-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 7840a699c513dfd20661b5d1d055011b3ab17e30 Author: Mario Limonciello (AMD) Date: Fri Sep 12 12:59:33 2025 -0500 drm/amd: Drop unnecessary calls to smu_dpm_set_vpe_enable() smu_hw_init() and smu_hw_fini() call smu_dpm_set_vpe_enable() for APUs as part of startup and teardown. These calls however are not necessary because vpe_hw_init()/vpe_hw_fini() will call at init/fini: ``` vpe_hw_init() / vpe_hw_fini() amdgpu_device_ip_set_powergating_state() vpe_set_powergating_state() amdgpu_dpm_enable_vpe() amdgpu_dpm_set_powergating_by_smu() smu_dpm_set_power_gate() smu_dpm_set_vpe_enable() ``` Drop the extra calls. Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Yang Wang Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 27405096232bc8e5042c6836920f793d31845694 Author: Christian König Date: Fri Jun 6 14:53:54 2025 +0200 drm/amdgpu: revert "Implement new dummy vram manager" This is should be unnecessary since a VRAM manager isn't mandatory in the first place. It could be that we have some missing checks inside AMDGPU or TTM but those should then be fixed instead of worked around like that. Signed-off-by: Christian König Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit a9273da04fa033667a4d0ccfe46c4ba55721d7d1 Author: Christian König Date: Fri Sep 5 14:45:39 2025 +0200 drm/amdgpu: add AMDGPU_IDS_FLAGS_GANG_SUBMIT Add a UAPI flag indicating if gang submit is supported or not. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 6cbe6e072c5d088101cd542ad8ef8541edeea5c3 Author: Timur Kristóf Date: Mon Aug 25 23:56:31 2025 +0200 drm/amd/display: Don't use non-registered VUPDATE on DCE 6 The VUPDATE interrupt isn't registered on DCE 6, so don't try to use that. This fixes a page flip timeout after sleep/resume on DCE 6. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 043c87d7d56e135393f8aab927148096e2d17589 Author: Timur Kristóf Date: Mon Aug 25 23:56:30 2025 +0200 drm/amd/display: Disable VRR on DCE 6 DCE 6 was not advertised as being able to support VRR, so let's mark it as unsupported for now. The VRR implementation in amdgpu_dm depends on the VUPDATE interrupt which is not registered for DCE 6. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 7495962cbceb967e095233a5673ea71f3bcdee7e Author: Timur Kristóf Date: Mon Aug 25 23:56:29 2025 +0200 drm/amd/display: Disable fastboot on DCE 6 too It already didn't work on DCE 8, so there is no reason to assume it would on DCE 6. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit c97a7dccb3ed680031011cfc1457506e6de49c9a Author: Xi Ruoyao Date: Mon Aug 25 16:52:11 2025 +0800 drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START dml21_map_dc_state_into_dml_display_cfg calls (the call is usually inlined by the compiler) populate_dml21_surface_config_from_plane_state and populate_dml21_plane_config_from_plane_state which may use FPU. In a x86-64 build: $ objdump --disassemble=dml21_map_dc_state_into_dml_display_cfg \ > drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.o | > grep %xmm -c 63 Thus it needs to be guarded with DC_FP_START. But we must note that the current code quality of the in-kernel FPU use in AMD dml2 is very much problematic: we are actually calling DC_FP_START in dml21_wrapper.c here, and this translation unit is built with CC_FLAGS_FPU. Strictly speaking this does not make any sense: with CC_FLAGS_FPU the compiler is allowed to generate FPU uses anywhere in the translated code, perhaps out of the DC_FP_START guard. This problematic pattern also occurs in at least dml2_wrapper.c, dcn35_fpu.c, and dcn351_fpu.c. Thus we really need a careful audit and refactor for the in-kernel FPU uses, and this patch is simply whacking a mole. However per the reporter, whacking this mole is enough to make a 9060XT "just work." Reported-by: Asiacn <710187964@qq.com> Closes: https://github.com/loongson-community/discussions/issues/102 Tested-by: Asiacn <710187964@qq.com> Signed-off-by: Xi Ruoyao Reviewed-by: Huacai Chen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 0449726b58ea64ec96b95f95944f0a3650204059 Author: Timur Kristóf Date: Mon Aug 25 23:56:28 2025 +0200 drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4 DC can turn off the display clock when no displays are connected or when all displays are off, for reference see: - dce*_validate_bandwidth DC also assumes that the DP clock is always on and never powers it down, for reference see: - dce110_clock_source_power_down In case of DCE 6.0 and 6.4, PLL0 is the clock source for both the engine clock and DP clock, for reference see: - radeon_atom_pick_pll - atombios_crtc_set_disp_eng_pll Therefore, PLL0 should be always kept running on DCE 6.0 and 6.4. This commit achieves that by ensuring that by setting the display clock to the corresponding value in low power state instead of zero. This fixes a page flip timeout on SI with DC which happens when all connected displays are blanked. Signed-off-by: Timur Kristóf Reviewed-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 489f0f600ce2c0dae640df9035e1d82677d2580f Author: Timur Kristóf Date: Mon Aug 25 23:33:33 2025 +0200 drm/amd/display: Fix DVI-D/HDMI adapters When the EDID has the HDMI bit, we should simply select the HDMI signal type even on DVI ports. For reference see, the legacy amdgpu display code: amdgpu_atombios_encoder_get_encoder_mode which selects ATOM_ENCODER_MODE_HDMI for the same case. This commit fixes DVI connectors to work with DVI-D/HDMI adapters so that they can now produce output over these connectors for HDMI monitors with higher bandwidth modes. With this change, even HDMI audio works through DVI. For testing, I used a CAA-DMDHFD3 DVI-D/HDMI adapter with the following GPUs: Tahiti (DCE 6) - DC can now output 4K 30 Hz over DVI Polaris 10 (DCE 11.2) - DC can now output 4K 60 Hz over DVI Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit a450d225327845c9e780d81ec881c8813bbf1f7b Author: James Zhu Date: Fri Aug 22 15:38:01 2025 -0400 drm/amdkfd: add function svm_migrate_successful_pages to get migration pages. dst MIGRATE_PFN_VALID bit and src MIGRATE_PFN_MIGRATE bit should always be set when migration success. cpage includes src MIGRATE_PFN_MIGRATE bit set and MIGRATE_PFN_VALID bit unset pages for both RAM and VRAM when memory is only allocated without being populated before migration, those ram pages should be counted as migrated pages and those vram pages should not be counted as migrated pages. Here migration pages refer to how many vram pages invloved. Current svm_migrate_unsuccessful_pages only covers the unsuccessful case that source is on RAM. So far, we only see two unsuccessful migration cases. Since we can clearly identify successful migration cases through dst MIGRATE_PFN_VALID bit and src MIGRATE_PFN_MIGRATE bit within this prange, also eventually successful migration pages will be used, so we can use function svm_migrate_successful_pages to replace function svm_migrate_unsuccessful_pages. Signed-off-by: James Zhu Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 7ccaaf13197fddb525571d6646bc174405efb37c Author: James Zhu Date: Fri Aug 22 15:38:00 2025 -0400 Revert "drm/amdkfd: return migration pages from copy function" This reverts commit bd6093e2f1601c0c83906f5115a2efb6b93050b1. migrate_vma_pages can fail if a CPU thread faults on the same page. However, the page table is locked and only one of the new pages will be inserted. The device driver will see that the MIGRATE_PFN_MIGRATE bit is cleared if it loses the race. Signed-off-by: James Zhu Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 85442bac84666640354c6728fd5d5d241190d960 Author: Shaoyun Liu Date: Thu Sep 11 12:59:00 2025 -0400 drm/amd/amdgpu: Fix the mes version that support inv_tlbs MES pipe0 will do VM invalidation with engine set 5 when assign VMID to a process, driver will submit inv_tlb package to mes pipe1. It might run into race condition if both pipes use the same invalidate engine set. From MES version 0x83 it will use invalidate engine set 6 for pipe1 to fix the issue Signed-off-by: Shaoyun Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 531df041f2a5296174abd8292d298eb62fe1ea97 Author: Mario Limonciello (AMD) Date: Mon Aug 11 12:00:06 2025 -0500 drm/amd: Avoid evicting resources at S5 Normally resources are evicted on dGPUs at suspend or hibernate and on APUs at hibernate. These steps are unnecessary when using the S4 callbacks to put the system into S5. Cc: AceLan Kao Cc: Kai-Heng Feng Cc: Mark Pearson Cc: Denis Benato Cc: Merthan Karakaş Tested-by: Eric Naim Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit bb1d7f157e3d2357daf3146f7bcd03bcdbcefd25 Author: Jesse.Zhang Date: Tue Aug 5 12:23:18 2025 +0800 drm/amdgpu: Switch user queues to use preempt/restore for eviction This patch modifies the user queue management to use preempt/restore operations instead of full map/unmap for queue eviction scenarios where applicable. The changes include: 1. Introduces new helper functions: - amdgpu_userqueue_preempt_helper() - amdgpu_userqueue_restore_helper() 2. Updates queue state management to track PREEMPTED state 3. Modifies eviction handling to use preempt instead of unmap: - amdgpu_userq_evict_all() now uses preempt_helper - amdgpu_userq_restore_all() now uses restore_helper The preempt/restore approach provides better performance during queue eviction by avoiding the overhead of full queue teardown and setup. Full map/unmap operations are still used for initial setup/teardown and system suspend scenarios. v2: rename amdgpu_userqueue_restore_helper/amdgpu_userqueue_preempt_helper to amdgpu_userq_restore_helper/amdgpu_userq_preempt_helper for consistency. (Alex) v3: amdgpu_userq_stop_sched_for_enforce_isolation() and amdgpu_userq_start_sched_for_enforce_isolation() should use preempt and restore (Alex) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5cefcbb306d6b4fa3ac5fba86db94cac81f0b457 Author: Jesse.Zhang Date: Thu Sep 4 16:30:08 2025 +0800 drm/amdgpu: adjust MES API used for suspend and resume Use the suspend and resume API rather than remove queue and add queue API. The former just preempts the queue while the latter remove it from the scheduler completely. There is no need to do that, we only need preemption in this case. V2: replace queue_active with queue state v3: set the suspend_fence_addr v4: allocate another per queue buffer for the suspend fence, and set the sequence number. also wait for the suspend fence. (Alex) v5: use a wb slot (Alex) v6: Change the timeout period. For MES, the default timeout is 2100000; /* 2100 ms */ (Alex) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 28af436a8fa69d4408eadc1beb84528cc216b30b Author: Yang Wang Date: Thu Sep 4 09:57:25 2025 +0800 drm/amd/pm: unified smu feature cap for vcn reset unified vcn reset smu feature cap Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8dbd641f8e0be8a34c755da518ab9aabea285c5f Author: Yang Wang Date: Thu Sep 4 09:53:43 2025 +0800 drm/amd/pm: unified smu feature cap for sdma reset unified sdma reset smu feature cap Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 7a1e3cfe8c8aed4cad7097c13d68ea2dbe4b001d Author: Yang Wang Date: Thu Sep 4 09:48:00 2025 +0800 drm/amd/pm: unified smu feature cap for link reset unified link reset smu feature cap Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit d7d0008ece3785ab19412be07d12f798c0feb5b1 Author: Taimur Hassan Date: Sun Sep 7 18:55:39 2025 -0400 drm/amd/display: Promote DC to 3.2.350 This version brings along following updates: - Add DSC padding for OVT support - Setup pixel encoding for YCBCR422 - Fix dml ms order - Rename header file link.h to link_service.h - Fix DMUB loading sequence - Modify link training policy Signed-off-by: Taimur Hassan Acked-by: Wayne Lin Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c062decc5e9b62afffe5ee9e44ce1f35962a750e Author: Martin Leung Date: Wed Aug 6 17:40:55 2025 -0400 Revert "drm/amd/display: Reduce Stack Usage by moving 'audio_output' into 'stream_res' v4" This reverts commit 1cf1205ef268 ("drm/amd/display: Reduce Stack Usage by moving 'audio_output' into 'stream_res' v4") Reason for revert: Causes DP compliance errors Acked-by: Wayne Lin Signed-off-by: Martin Leung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit edae98a2bdf25d719297f5aa5dfbfc1b4d86bde5 Author: Relja Vojvodic Date: Thu Sep 4 15:38:24 2025 -0400 drm/amd/display: Add DSC padding for OVT Support [Why] -Certain OVT timings require DSC configurations which divide the horizontal active unevenly across DSC slices -DSC slices must be even, so padding needs to be added to the active to make this possible -The pixel clock of the HW now needs to be increased to accommodate the extra padded pixels -To keep the line time the same, the blank of the HW timing needs to be increased as well [How] -Calculate h_active padding, h_total padding, and pixel clock based off of the original OVT timing and DSC calculations -Store these values in the pipe and program HW with these modifications -Added general support for cases where DSC slice config does not evenly split the horizontal active by fixing some slice width calculations -Updated PPS calculations for these cases Reviewed-by: Chris Park Reviewed-by: Wenjing Liu Signed-off-by: Relja Vojvodic Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit db291ed1732e02e79dca431838713bbf602bda1c Author: Mario Limonciello Date: Wed Aug 27 12:17:19 2025 -0500 drm/amd/display: Add fallback path for YCBCR422 [Why] DP validation may fail with multiple displays and higher color depths. The sink may support others though. [How] When DP bandwidth validation fails, progressively fallback through: - YUV422 8bpc (bandwidth efficient) - YUV422 6bpc (reduced color depth) - YUV420 (last resort) This resolves cases where displays would show no image due to insufficient DP link bandwidth for the requested RGB mode. Suggested-by: Mauri Carvalho Reviewed-by: Wayne Lin Signed-off-by: Mario Limonciello Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5e76bc677cb7c92b37d8bc66bb67a18922895be2 Author: Mario Limonciello Date: Tue Aug 26 20:18:22 2025 -0500 drm/amd/display: Set up pixel encoding for YCBCR422 [Why] fill_stream_properties_from_drm_display_mode() will not configure pixel encoding to YCBCR422 when the DRM color format supports YCBCR422 but not YCBCR420 or YCBCR4444. Instead it will fallback to RGB. [How] Add support for YCBCR422 in pixel encoding mapping. Suggested-by: Mauri Carvalho Reviewed-by: Wayne Lin Signed-off-by: Mario Limonciello Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 02a6c2e4b28ff31f7a904c196a99fb2efe81e2cf Author: Ausef Yousof Date: Tue Sep 2 12:10:18 2025 -0400 drm/amd/display: fix dml ms order of operations [why&how] small error in order of operations in immediateflipbytes calculation on dml ms side that can result in dml ms and mp mismatch immediateflip support for a given pipe and thus an invalid hw state, correct the order to align with mp. Reviewed-by: Leo Chen Signed-off-by: Ausef Yousof Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 29591e6fd422c154ef14abbffe02c29644149a35 Author: Charlene Liu Date: Wed Sep 3 15:00:22 2025 -0400 drm/amd/display: limit one non-related log to dGPU [Why&How] some log are for dGPU only. Added check to limit log. Reviewed-by: Chris Park Signed-off-by: Charlene Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 95d168b367aa28a59f94fc690ff76ebf69312c6d Author: Ivan Lipski Date: Tue Sep 2 16:20:09 2025 -0400 drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put [Why&How] As reported on https://gitlab.freedesktop.org/drm/amd/-/issues/3936, SMU hang can occur if the interrupts are not enabled appropriately, causing a vblank timeout. This patch reverts commit 5009628d8509 ("drm/amd/display: Remove unnecessary amdgpu_irq_get/put"), but only for RX6xxx & RX7700 GPUs, on which the issue was observed. This will re-enable interrupts regardless of whether the user space needed it or not. Fixes: 5009628d8509 ("drm/amd/display: Remove unnecessary amdgpu_irq_get/put") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3936 Suggested-by: Sun peng Li Reviewed-by: Sun peng Li Signed-off-by: Ivan Lipski Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 782f0bb5a129f588dc16ad54a2e88c93ef2e079a Author: Wesley Chalmers Date: Tue Sep 2 21:47:39 2025 -0400 drm/amd/display: Rename header file link.h to link_service.h [WHY] Header file name "link.h" collides with system header when dc is compiled as a user-mode library [WHAT] Rename link.h to link_service.h to avoid name collision Reviewed-by: Alvin Lee Signed-off-by: Wesley Chalmers Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 18e755155caa57a6e6c4aa4a40b0db0fba015289 Author: Nicholas Kazlauskas Date: Fri Aug 8 10:26:22 2025 -0400 drm/amd/display: Fix DMCUB loading sequence for DCN3.2 [Why] New sequence from HW for reset and firmware reloading has been provided that aims to stabilize the reload sequence in the case the firmware is hung or has outstanding requests. [How] Update the sequence to remove the DMUIF reset and the redundant writes in the release. Reviewed-by: Sreeja Golui Signed-off-by: Nicholas Kazlauskas Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 44343e8b250abb2f6bfd615493ca07a7f11f3cc2 Author: Dmytro Laktyushkin Date: Wed Jun 11 16:51:21 2025 -0400 drm/amd/display: prepare dml 2.1 for new asic [Why&How] prepare dml 2.1 for new asic Acked-by: Wayne Lin Signed-off-by: Dmytro Laktyushkin Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0bfcb56e8b074c9f013f357e799c446a9dbc1fad Author: Zhikai Zhai Date: Tue Jul 29 17:39:54 2025 +0800 drm/amd/display: Modify the link training policy [Why&How] Currently fallback to low link rate if the link training fails once on USB4. It may cause the bandwidth couldn't satisfy the requirement of streams. Modify the policy to do training retry in the previous few times, only do fallback at the last time. Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Zhikai Zhai Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 46fbe1e349b89eff48d6d8e87cfb6ffe955f75e9 Author: Hawking Zhang Date: Thu Sep 11 23:22:04 2025 +0800 Revert "drm/amdgpu: Allocate psp fw private buffer in vram" This reverts commit 22dcb283d63d5677a5875d0002d04d2c61720f78. Need to certain APU platforms and will proceed to rework the patch accordingly Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher commit 0a71ceb27f88a944c2de2808b67b2f46ac75076b Author: Srinivasan Shanmugam Date: Wed Sep 10 12:27:05 2025 +0530 drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs Enable the cleaner shader for additional GFX11.0.1/11.0.4 series GPUs to ensure data isolation among GPU tasks. The cleaner shader is tasked with clearing the Local Data Store (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs), which helps avoid data leakage and guarantees the accuracy of computational results. This update extends cleaner shader support to GFX11.0.1/11.0.4 GPUs, previously available for GFX11.0.3. It enhances security by clearing GPU memory between processes and maintains a consistent GPU state across KGD and KFD workloads. Cc: Wasee Alam Cc: Mario Sopena-Novales Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit e0dd9b8e9e669c5f7de0bbf2e1d2706a7c7d63f7 Author: Mario Limonciello Date: Wed Sep 10 13:40:30 2025 -0500 drm/amd: Duplicate DC_FEATURE_MASK and DC_DEBUG_MASK enum values into kdoc [Why] When kernel documentation is generated the enum values themselves don't end up in the documentation. This makes browsing them in HTML a lot less useful. [How] Copy DC_DEBUG_MASK and DC_FEATURE_MASK enum values into matching kdoc comments. Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit efbacd8aeace6e0ab161e3254eb5e73fc6a85bf2 Author: Yang Wang Date: Thu Sep 4 08:52:53 2025 +0800 drm/amd/pm: unified smu feature cap interface add a unified interface to provide smu feature cap set. Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 10a9c09a7c3b905b761d4e5df24d958314d6cf3d Author: Asad Kamal Date: Tue Aug 26 00:33:53 2025 +0800 drm/amd/pm: Allow to set power cap in vf mode Allow setting power cap for smu_v13_0_6 in 1vf mode Signed-off-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 780f7a45e56e9fd2bbae146687c054fcf6a08743 Author: Lijo Lazar Date: Thu Sep 4 17:47:20 2025 +0530 drm/amdgpu: Add virtual device capabilities Add a member to define the capabilities of virtual device. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1f9ba8ea04efa0e4366eac2d2ebf2deff167bf14 Author: Lijo Lazar Date: Thu Sep 4 17:43:44 2025 +0530 drm/amdgpu: Add generic capability class Define a utility macro for defining capabilities and their attributes. Capability attributes are read-only, write-only, read-write. Signed-off-by: Lijo Lazar Acked-by: Hawking Zhang Signed-off-by: Alex Deucher commit c3cdc3bebd1fc610d6051f8e0678c05091fcab4c Author: Lijo Lazar Date: Wed Sep 10 11:38:08 2025 +0530 drm/amdgpu: Read memory vendor information Read VRAM vendor information from scratch register for GC v9.4.3 and GC v9.5.0 SOCs. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit e09b081d8ae0e60022a66b26e9d51909c6f2e383 Author: Stanley.Yang Date: Thu Aug 21 16:05:42 2025 +0800 drm/amdgpu: wait pmfw polling mca bank info done wait 500ms to ensure pmfw polling mca bank info done. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit e2ee0f1b1ab1cfdab1ddc832e336fc85da286dfe Author: Tvrtko Ursulin Date: Tue Sep 9 16:49:37 2025 +0200 drm/amdgpu: Use memset32 for ring clearing Use memset32 instead of open coding it, just because it is a tiny bit nicer. Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 Author: Timur Kristóf Date: Tue Sep 9 16:49:35 2025 +0200 drm/amdgpu: Fix allocating extra dwords for rings (v2) Rename extra_dw to extra_bytes and document what it's for. The value is already used as if it were bytes in vcn_v4_0.c and in amdgpu_ring_init. Just adjust the dword count in jpeg_v1_0.c so that it becomes a byte count. v2: Rename extra_dw to extra_bytes as discussed during review. Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 156db7d353286b7bfd7f43f548a4046a97fe67c6 Author: Timur Kristóf Date: Tue Sep 9 16:17:52 2025 +0200 drm/amd/pm: Remove unneeded legacy DPM related code. This code isn't needed anymore as we collect the same information into pm_display_cfg instead. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9d73b107a61b73e7101d4b728ddac3d2c77db111 Author: Timur Kristóf Date: Tue Sep 9 16:17:51 2025 +0200 drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) This commit is necessary for DC to function well with chips that use the legacy power management code, ie. SI and KV. Communicate display information from DC to the legacy PM code. Currently DC uses pm_display_cfg to communicate power management requirements from the display code to the DPM code. However, the legacy (non-DC) code path used different fields and therefore could not take into account anything from DC. Change the legacy display code to fill the same pm_display_cfg struct as DC and use the same in the legacy DPM code. To ease review and reduce churn, this commit does not yet delete the now unneeded code, that is done in the next commit. v2: Rebase. Fix single_display in amdgpu_dpm_pick_power_state. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit b515dcb0dc4e85d8254f5459cfb32fce88dacbfb Author: Timur Kristóf Date: Tue Sep 9 16:17:50 2025 +0200 drm/amd/display: Add pixel_clock to amd_pp_display_configuration This commit adds the pixel_clock field to the display config struct so that power management (DPM) can use it. We currently don't have a proper bandwidth calculation on old GPUs with DCE 6-10 because dce_calcs only supports DCE 11+. So the power management (DPM) on these GPUs may need to make ad-hoc decisions for display based on the pixel clock. Also rename sym_clock to pixel_clock in dm_pp_single_disp_config to avoid confusion with other code where the sym_clock refers to the DisplayPort symbol clock. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 92d6295a29dba56148406a8452c69ab49787741b Author: Mario Limonciello Date: Tue Sep 9 23:22:54 2025 -0500 Documentation/amdgpu: Add Ryzen AI 330 series processor This has been announced so add to the table. Link: https://www.amd.com/en/products/processors/laptop/ryzen/ai-300-series/amd-ryzen-ai-5-330.html Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit c1456fadce0c99175f97e66c2b982dd051e01aa2 Author: Lijo Lazar Date: Tue Sep 2 11:37:37 2025 +0530 drm/amdgpu: Release hive reference properly xgmi hive reference is taken on function entry, but not released correctly for all paths. Use __free() to release reference properly. Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher commit 2a7a794eb82c37014ea95f7f58ebeff73ef72858 Author: Srinivasan Shanmugam Date: Thu Aug 28 19:18:49 2025 +0530 drm/amdgpu/ttm: Allocate/Free 4K MMIO_REMAP Singleton Add mmio_remap bookkeeping to amdgpu_device and introduce amdgpu_ttm_mmio_remap_bo_init()/fini() to manage a kernel-owned, one-page (4K) BO in AMDGPU_GEM_DOMAIN_MMIO_REMAP. Bookkeeping: - adev->rmmio_remap.bo : kernel-owned singleton BO The BO is allocated during TTM init when a remap bus address is available (adev->rmmio_remap.bus_addr) and PAGE_SIZE <= AMDGPU_GPU_PAGE_SIZE (4K), and freed during TTM fini. v2: - Check mmio_remap bus address (adev->rmmio_remap.bus_addr) instead of rmmio_base. (Alex) - Skip quietly if PAGE_SIZE > AMDGPU_GPU_PAGE_SIZE or no bus address (no warn). (Alex) - Use `amdgpu_bo_create()` (not *_kernel) - Only with this The object is stored in adev->mmio_remap.bo and will later be exposed to userspace via a GEM handle. (Christian) v3: - Remove obvious comment before amdgpu_ttm_mmio_remap_bo_fini() call. (Alex) v4: - Squash bookkeeping into this patch (Christian) Suggested-by: Christian König Suggested-by: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9e46b8bb0539d7bc9a9e7b3072fa4f6082490392 Author: Prike Liang Date: Mon Jun 23 16:29:38 2025 +0800 drm/amdgpu: validate userq buffer virtual address and size It needs to validate the userq object virtual address to determine whether it is residented in a valid vm mapping. Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4ba48fc3dac4c1dd4b54269afc40e43297f9e073 Author: Yang Wang Date: Tue Sep 9 10:10:40 2025 +0800 drm/amd/pm: make smu_set_temp_funcs() smu specific for smu v13.0.6 move smu_set_temp_funcs() into smu_v13.0.6 ppt.c file to keep same code layer in amdgpu_smu.c. (only set_ppt func in amdgpu_smu.c) Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a3ac30ffea5de2f511696ae46f5a7f793e6d4bfb Author: Srinivasan Shanmugam Date: Wed Aug 20 16:39:38 2025 +0530 drm/amdgpu/ttm: Initialize AMDGPU_PL_MMIO_REMAP Heap Add a one-page TTM range manager for AMDGPU_PL_MMIO_REMAP via amdgpu_ttm_init_on_chip(). This only registers the placement with TTM; no BO is allocated in this patch. The singleton 4K remap BO is created and freed in the following patch. This split follows to separate heap bring-up from BO allocation. Cc: Christian König Suggested-by: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit fb5a52dbe9fecde432b4da7ea2d2724a947e9a79 Author: Srinivasan Shanmugam Date: Wed Aug 20 16:21:16 2025 +0530 drm/amdgpu: Implement TTM handling for MMIO_REMAP placement Implement TTM-level behavior for AMDGPU_PL_MMIO_REMAP so it behaves as a CPU-visible IO page: * amdgpu_evict_flags(): mark as unmovable * amdgpu_res_cpu_visible(): consider CPU-visible * amdgpu_bo_move(): use null move when src/dst is MMIO_REMAP * amdgpu_ttm_io_mem_reserve(): program base/is_iomem/caching using the device's mmio_remap_* metadata * amdgpu_ttm_io_mem_pfn(): return PFN for the remapped HDP page * amdgpu_ttm_tt_pde_flags(): set AMDGPU_PTE_SYSTEM for this mem type v2: - Drop HDP-specific comment; keep generic remap (Alex). v3: - Fix indentation in amdgpu_res_cpu_visible (Christian). - Use adev->rmmio_remap.bus_addr for MMIO_REMAP bus/PFN calculations (Alex). v4: - Drop unnecessary (resource_size_t) casts in MMIO_REMAP io-mem paths (Alex) Cc: Christian König Suggested-by: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 99eeb8358e6cdb7050bf2956370c15dcceda8c7e Author: Thorsten Blum Date: Mon Sep 8 23:15:54 2025 +0200 drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify ta_if_load_debugfs_write() and ta_if_invoke_debugfs_write(). No functional changes intended. Reviewed-by: Tvrtko Ursulin Signed-off-by: Thorsten Blum Signed-off-by: Alex Deucher commit 6156c101e5f082ee8911fbf0e112319d67403794 Author: Thorsten Blum Date: Mon Sep 8 23:31:56 2025 +0200 drm/amdkfd: Replace kzalloc + copy_from_user with memdup_user Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify kfd_ioctl_set_cu_mask(). Return early if an error occurs and remove the obsolete 'out' label. No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Alex Deucher commit d4b6274cbf0b0ee92294d699f138b63aa4796ad0 Author: Tvrtko Ursulin Date: Thu Jun 12 11:44:28 2025 +0100 drm/amdgpu: Use (v)memdup_array_user in amdgpu_cs_pass1 Replace k(v)malloc_array() + copy_from_user() with (v)memdup_array_user(). This shrinks the source code and improves separation between the kernel and userspace slabs. Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb Author: Tvrtko Ursulin Date: Thu Jun 12 11:44:27 2025 +0100 drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl Replace kmalloc_array() + copy_from_user() with memdup_array_user(). This shrinks the source code and improves separation between the kernel and userspace slabs. Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit c4ac100e9ae252b09986766ad23b1f83ca3a369d Author: Tvrtko Ursulin Date: Thu Jun 12 11:44:26 2025 +0100 drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Replace kvmalloc_array() + copy_from_user() with vmemdup_array_user() on the fast path. This shrinks the source code and improves separation between the kernel and userspace slabs. Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit 65307484851980aaa965e35d84ab7cb195308f2c Author: Rodrigo Siqueira Date: Mon Sep 8 17:15:40 2025 -0600 drm/amdgpu: Remove volatile references from VCN Reviewed-by: Christian König Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 897025300721eb9b585c9b90ae531a5f3ee29022 Author: Rodrigo Siqueira Date: Mon Sep 8 17:15:39 2025 -0600 drm/amdgpu: Remove volatile from amdgpu and amdgpu_ih headers Remove the unnecessary use of volatile in some of the amdgpu.h and amdgpu_ih.h headers. Reviewed-by: Christian König Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit f307cfb91734b36bde2597552971553d91838048 Author: Rodrigo Siqueira Date: Mon Sep 8 17:15:38 2025 -0600 drm/amdgpu: Remove volatile from ring manipulation None of the pointer operations handled by the ring file requires volatile, for this reason, this commit removes all occurrences of volatile associated with rings. Reviewed-by: Christian König Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit b8fc541089582ed77cc567bb28a83abe834e8902 Author: Rodrigo Siqueira Date: Mon Sep 8 17:15:37 2025 -0600 drm/amdgpu: Remove volatile from RLC files The RLC uses volatile with some pointers that are not directly related to any of the situations where volatile is advised to be used [1]. For this reason, this commit removes all the volatile occurrences associated with RLC. 1. https://docs.kernel.org/process/volatile-considered-harmful.html Reviewed-by: Christian König Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit d8586afe38984f9eb98d6753c9b1134295d55ceb Author: Rodrigo Siqueira Date: Mon Sep 8 17:15:36 2025 -0600 drm/amdgpu: Remove volatile from CSB functions The CSB buffer manipulation occurs in memory where the BO is mapped during initialization, and some references to this buffer are handled with volatile, which is incorrect in this scenario. There are a few cases where the use of volatile is accepted, but none of them align with CSB operations. Therefore, this commit removes all the volatile variables associated with the CSB code. Reviewed-by: Christian König Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 561285d048053fec8a3d6d1e3ddc60df11c393a0 Author: Matti Vaittinen Date: Mon Sep 15 10:12:57 2025 +0300 MAINTAINERS: Support ROHM BD79112 ADC Add the ROHM BD79112 ADC in the list of the BD791xx ADC drivers which are maintained by undersigned. Signed-off-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit edf2fc7b5bc4213abd19e9532b80a16e7690a512 Author: Matti Vaittinen Date: Mon Sep 15 10:12:43 2025 +0300 iio: adc: Support ROHM BD79112 ADC/GPIO The ROHM BD79112 is an ADC/GPIO with 32 channels. The channel inputs can be used as ADC or GPIO. Using the GPIOs as IRQ sources isn't supported. The ADC is 12-bit, supporting input voltages up to 5.7V, and separate I/O voltage supply. Maximum SPI clock rate is 20 MHz (10 MHz with daisy-chain configuration) and maximum sampling rate is 1MSPS. The IC does also support CRC but it is not implemented in the driver. Signed-off-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit 2f5049f049a4784dc92972fd43f1ecf2ac12a69b Merge: a409fac1f74bae 53c18dc078bb6d Author: Arnd Bergmann Date: Mon Sep 15 22:07:20 2025 +0200 Merge tag 'stm32-dt-for-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.18, round 1 Highlights: ---------- - MPU: - STM32MP13: - Add missing Ethernet1/2 PTP reference clocks. - Add Hardware debug port (HDP). - STMP32MP15: - Add resets property to m_can nodes. - Add Hardware debug port (HDP) and enable it on stm32mp157c-dk2 board. - Reserve leds for CM4 on stm32mp15xx-ed1 and stm32mp15xx-dkx. - stm32mp151c-plyaqm: Use correct dai-format property. - STM32MP23: - Add Ethernet1 MAC controller on stm32mp235f-dk board: It is connected to a RTL8211F-CG phy through RGMII. - Fix GPIO bank definition & memory size (DDR). - STM32MP25: - Add Ethernet1 MAC controller on stm32mp257f-dk board. It is connected to a RTL8211F-CG phy through RGMII. - Add Ethernet1 MAC controller on stm32mp257f-ev1 board. It is connected to a RTL8211F-CG phy through RGMII. - Add display support by enabling the following IPs on stm32mp257f-ev1: * LTDC * LVDS * WSVGA LVDS panel (1024x600) * Panel LVDS backlight as GPIO backlight * ILI2511 i2c touchscreen - Add PCIe Root complex and Endpoint support on stm32mp257f-ev1. Root complex mode is used by default. * tag 'stm32-dt-for-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (30 commits) arm64: dts: st: fix memory region size on stm32mp235f-dk arm64: dts: st: remove gpioj and gpiok banks from stm32mp231 arm64: dts: st: enable ethernet1 controller on stm32mp235f-dk arm64: dts: st: enable ethernet1 controller on stm32mp257f-ev1 arm64: dts: st: enable ethernet1 controller on stm32mp257f-dk arm64: dts: st: add eth1 pins for stm32mp2x platforms ARM: dts: stm32: add missing PTP reference clocks on stm32mp13x SoCs arm64: dts: st: enable display support on stm32mp257f-ev1 board arm64: dts: st: add clock-cells to syscfg node on stm32mp251 arm64: dts: st: add lvds support on stm32mp255 arm64: dts: st: add ltdc support on stm32mp255 arm64: dts: st: add ltdc support on stm32mp251 ARM: dts: stm32: add resets property to m_can nodes in the stm32mp153 dt-binding: can: m_can: add optional resets property arm64: dts: st: Enable PCIe on the stm32mp257f-ev1 board arm64: dts: st: Add PCIe Endpoint mode on stm32mp251 arm64: dts: st: Add PCIe Root Complex mode on stm32mp251 arm64: dts: st: add PCIe pinctrl entries in stm32mp25-pinctrl.dtsi arm64: defconfig: Enable STMicroelectronics STM32 DMA3 support ARM: dts: stm32: add Hardware debug port (HDP) on stm32mp157c-dk2 board ... Link: https://lore.kernel.org/r/13153fc2-1abe-4d53-807a-5d289981a63d@foss.st.com Signed-off-by: Arnd Bergmann commit b13448dd64e27752fad252cec7da1a50ab9f0b6f Author: Eduard Zingerman Date: Fri Sep 12 12:18:16 2025 -0700 bpf: potential double-free of env->insn_aux_data Function bpf_patch_insn_data() has the following structure: static struct bpf_prog *bpf_patch_insn_data(... env ...) { struct bpf_prog *new_prog; struct bpf_insn_aux_data *new_data = NULL; if (len > 1) { new_data = vrealloc(...); // <--------- (1) if (!new_data) return NULL; env->insn_aux_data = new_data; // <---- (2) } new_prog = bpf_patch_insn_single(env->prog, off, patch, len); if (IS_ERR(new_prog)) { ... vfree(new_data); // <----------------- (3) return NULL; } ... happy path ... } In case if bpf_patch_insn_single() returns an error the `new_data` allocated at (1) will be freed at (3). However, at (2) this pointer is stored in `env->insn_aux_data`. Which is freed unconditionally by verifier.c:bpf_check() on both happy and error paths. Thus, leading to double-free. Fix this by removing vfree() call at (3), ownership over `new_data` is already passed to `env->insn_aux_data` at this point. Fixes: 77620d126739 ("bpf: use realloc in bpf_patch_insn_data") Reported-by: Chris Mason Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250912-patch-insn-data-double-free-v1-1-af05bd85a21a@gmail.com Signed-off-by: Alexei Starovoitov commit d021fb3ae844dad0a1d2f037a9657fde330955bb Author: Matti Vaittinen Date: Mon Sep 15 10:12:26 2025 +0300 dt-bindings: iio: adc: ROHM BD79112 ADC/GPIO The ROHM BD79112 is an ADC/GPIO with 32 channels. The channel inputs can be used as ADC or GPIO. Using the GPIOs as IRQ sources isn't supported. The ADC is 12-bit, supporting input voltages up to 5.7V, and separate I/O voltage supply. Maximum SPI clock rate is 20 MHz (10 MHz with daisy-chain configuration) and maximum sampling rate is 1MSPS. Add a device tree binding document for the ROHM BD79112. Signed-off-by: Matti Vaittinen Acked-by: Conor Dooley Reviewed-by: Linus Walleij Signed-off-by: Jonathan Cameron commit 995694ef91da7076ce235f028680fb31ad0b5c04 Author: Rafael J. Wysocki Date: Thu Sep 11 14:04:53 2025 +0200 cpufreq: ACPI: Use on_each_cpu_mask() in drv_write() Make drv_write() call on_each_cpu_mask() instead of using an open-coded equivalent of the latter. Also remove a comment mentioning the smp_call_function_many() usage which is not particularly useful anyway. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit bf4206d7ac278bbd1eb2cf02d25486c2cc61b298 Author: Chen Pei Date: Wed Sep 10 17:41:36 2025 +0800 ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype Commit 4aca2bef90bd1296 ("ACPICA: Headers: Add RISC-V SBI Subtype to DBG2") added the definition of ACPI_DBG2_RISCV_SBI_CON. Continue to implement its function so that the parameters of UART can be configured correctly. Subsequent calls to setup_earlycon() will reuse the earlycon based on SBI. Signed-off-by: Chen Pei Reviewed-by: Guo Ren (Alibaba Damo Academy) Link: https://patch.msgid.link/20250910094136.4423-1-cp0613@linux.alibaba.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 7d444f50999709d52a18ec7e88649ac936ab62dc Author: Jiaqi Yan Date: Wed Sep 10 04:45:31 2025 +0000 ACPI: APEI: EINJ: Allow more types of addresses except MMIO EINJ driver today only allows injection request to go through for two kinds of IORESOURCE_MEM: IORES_DESC_PERSISTENT_MEMORY and IORES_DESC_SOFT_RESERVED. This check prevents user of EINJ to test memory corrupted in many interesting areas: - Legacy persistent memory - Memory claimed to be used by ACPI tables or NV storage - Kernel crash memory and others There is need to test how kernel behaves when something consumes memory errors in these memory regions. For example, if certain ACPI table is corrupted, does kernel crash gracefully to prevent "silent data corruption". For another example, legacy persistent memory, when managed by Device DAX, does support recovering from Machine Check Exception raised by memory failure, hence worth to be tested. However, attempt to inject memory error via EINJ to legacy persistent memory or ACPI owned memory fails with -EINVAL. Allow EINJ to inject at address except it is MMIO. Leave it to the BIOS or firmware to decide what is a legitimate injection target. In addition to the test done in [1], on a machine having the following iomem resources: ... 01000000-08ffffff : Crash kernel 768f0098-768f00a7 : APEI EINJ ... 768f4000-77323fff : ACPI Non-volatile Storage 77324000-777fefff : ACPI Tables 777ff000-777fffff : System RAM 77800000-7fffffff : Reserved 80000000-8fffffff : PCI MMCONFIG 0000 [bus 00-ff] 90040000-957fffff : PCI Bus 0000:00 ... 300000000-3ffffffff : Persistent Memory (legacy) ... I commented __einj_error_inject during the test and just tested when injecting a memory error at each start address shown above: - 0x80000000 and 0x90040000 both failed with EINVAL - request passed through for all other addresses Link: https://lore.kernel.org/linux-acpi/20250825223348.3780279-1-jiaqiyan@google.com [1] Signed-off-by: Jiaqi Yan Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250910044531.264043-1-jiaqiyan@google.com [ rjw: Adding a link tag for the [1] reference ] Signed-off-by: Rafael J. Wysocki commit e06722a9df14eff39f42059f84063daa0a95b92c Author: Thorsten Blum Date: Thu Sep 4 00:49:11 2025 +0200 ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() Use the result of copy_from_user() directly instead of assigning it to the local variable 'rc' and then overwriting it in erst_dbg_write() or immediately returning from erst_dbg_ioctl(). No intentional functional changes. Signed-off-by: Thorsten Blum Reviewed-by: Shuai Xue Link: https://patch.msgid.link/20250903224913.242928-2-thorsten.blum@linux.dev [ rjw: Changelog edit ] Signed-off-by: Rafael J. Wysocki commit 440d20154add24082eb43305f85288a756a5cc56 Author: David Kaplan Date: Mon Sep 15 08:47:03 2025 -0500 x86/bugs: Remove uses of cpu_mitigations_off() cpu_mitigations_off() is no longer needed because all bugs use attack vector controls to select a mitigation, and cpu_mitigations_off() is equivalent to no attack vectors being selected. Remove the few remaining unnecessary uses of this function in this file. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta commit 74b1db86847cce1c0fb54d362f8f5fde3adfd41b Author: chengkaitao Date: Mon Sep 15 20:33:07 2025 +0800 block/mq-deadline: Remove the redundant rb_entry_rq in the deadline_from_pos(). In commit(fde02699c242), the "if (blk_rq_is_seq_zoned_write(rq))" was removed, but the "rb_entry_rq(node)" and some other code were inadvertently left behind. This patch fixed it. Signed-off-by: chengkaitao Reviewed-by: Bart Van Assche Reviewed-by: Li Nan Signed-off-by: Jens Axboe commit 3ae4c527080ce81b889ffc2780e077770b95ae88 Author: Alan Maguire Date: Thu Sep 11 17:30:56 2025 +0100 selftests/bpf: More open-coded gettid syscall cleanup Commit 0e2fb011a0ba ("selftests/bpf: Clean up open-coded gettid syscall invocations") addressed the issue that older libc may not have a gettid() function call wrapper for the associated syscall. A few more instances have crept into tests, use sys_gettid() instead, and poison raw gettid() usage to avoid future issues. Signed-off-by: Alan Maguire Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250911163056.543071-1-alan.maguire@oracle.com commit 6a1f303cba45fa3b612d5a2898b1b1b045eb74e3 Author: Ivaylo Ivanov Date: Sun Sep 14 16:02:30 2025 +0300 regulator: max77838: add max77838 regulator driver The max77838 PMIC contains a BUCK regulator and 4 LDOs. It's primarily used in the Samsung Galaxy S7 lineup and is accessed over I2C. Signed-off-by: Ivaylo Ivanov Link: https://patch.msgid.link/20250914130230.2622030-3-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Mark Brown commit 0f101028407605c7b7cea53946ee4d25f82cfb6c Author: Ivaylo Ivanov Date: Sun Sep 14 16:02:29 2025 +0300 dt-bindings: regulator: document max77838 pmic The max77838 is a pmic, containing a BUCK regulator and 4 LDOs. It's primarily used in the Samsung Galaxy S7 lineup and is accessed over I2C. Document it. Signed-off-by: Ivaylo Ivanov Acked-by: Conor Dooley Reviewed-by: Igor Belwon Link: https://patch.msgid.link/20250914130230.2622030-2-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Mark Brown commit 61ee2cce3fe4a006c600069c726dc36d54256765 Merge: a9d4e9f0e87135 a8250d167c0cf6 Author: Alexei Starovoitov Date: Mon Sep 15 10:53:15 2025 -0700 Merge branch 'remove-use-of-current-cgns-in-bpf_cgroup_from_id' Kumar Kartikeya Dwivedi says: ==================== Remove use of current->cgns in bpf_cgroup_from_id bpf_cgroup_from_id currently ends up doing a check on whether the cgroup being looked up is a descendant of the root cgroup of the current task's cgroup namespace. This leads to unreliable results since this kfunc can be invoked from any arbitrary context, for any arbitrary value of current. Fix this by removing namespace-awarness in the kfunc, and include a test that detects such a case and fails without the fix. Changelog: ---------- v2 -> v3 v2: https://lore.kernel.org/bpf/20250811195901.1651800-1-memxor@gmail.com * Refactor cgroup_get_from_id into non-ns version. (Andrii) * Address nits from Eduard. v1 -> v2 v1: https://lore.kernel.org/bpf/20250811175045.1055202-1-memxor@gmail.com * Add Ack from Tejun. * Fix selftest to perform namespace migration and cgroup setup in a child process to avoid changing test_progs namespace. ==================== Link: https://patch.msgid.link/20250915032618.1551762-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit a8250d167c0cf6b98ccb5168fb2daf2859679d72 Author: Kumar Kartikeya Dwivedi Date: Mon Sep 15 03:26:18 2025 +0000 selftests/bpf: Add a test for bpf_cgroup_from_id lookup in non-root cgns Make sure that we only switch the cgroup namespace and enter a new cgroup in a child process separate from test_progs, to not mess up the environment for subsequent tests. To remove this cgroup, we need to wait for the child to exit, and then rmdir its cgroup. If the read call fails, or waitpid succeeds, we know the child exited (read call would fail when the last pipe end is closed, otherwise waitpid waits until exit(2) is called). We then invoke a newly introduced remove_cgroup_pid() helper, that identifies cgroup path using the passed in pid of the now dead child, instead of using the current process pid (getpid()). Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250915032618.1551762-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 2c895133950646f45e5cf3900b168c952c8dbee8 Author: Kumar Kartikeya Dwivedi Date: Mon Sep 15 03:26:17 2025 +0000 bpf: Do not limit bpf_cgroup_from_id to current's namespace The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the cgroup corresponding to a given cgroup ID. This helper can be called in a lot of contexts where the current thread can be random. A recent example was its use in sched_ext's ops.tick(), to obtain the root cgroup pointer. Since the current task can be whatever random user space task preempted by the timer tick, this makes the behavior of the helper unreliable. Refactor out __cgroup_get_from_id as the non-namespace aware version of cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it. There is no compatibility breakage here, since changing the namespace against which the lookup is being done to the root cgroup namespace only permits a wider set of lookups to succeed now. The cgroup IDs across namespaces are globally unique, and thus don't need to be retranslated. Reported-by: Dan Schatzberg Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit a9d4e9f0e871352a48a82da11a50df7196fe567a Author: Saket Kumar Bhaskar Date: Sat Sep 13 14:43:37 2025 +0530 selftests/bpf: Fix arena_spin_lock selftest failure For systems having CONFIG_NR_CPUS set to > 1024 in kernel config the selftest fails as arena_spin_lock_irqsave() returns EOPNOTSUPP. (eg - incase of powerpc default value for CONFIG_NR_CPUS is 8192) The selftest is skipped incase bpf program returns EOPNOTSUPP, with a descriptive message logged. Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Link: https://lore.kernel.org/r/20250913091337.1841916-1-skb99@linux.ibm.com Signed-off-by: Alexei Starovoitov commit f7528e4412138699d69946d2a811feb319268f6b Author: Leon Hwang Date: Mon Sep 15 20:16:57 2025 +0800 selftests/bpf: Skip timer_interrupt case when bpf_timer is not supported Like commit fbdd61c94bcb ("selftests/bpf: Skip timer cases when bpf_timer is not supported"), 'timer_interrupt' test case should be skipped if verifier rejects bpf_timer with returning -EOPNOTSUPP. cd tools/testing/selftests/bpf ./test_progs -t timer 461 timer_interrupt:SKIP Summary: 6/0 PASSED, 7 SKIPPED, 0 FAILED Signed-off-by: Leon Hwang Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250915121657.28084-1-leon.hwang@linux.dev commit 6c7c620585c6537dd5dcc75f972b875caf00f773 Author: Ashish Kalra Date: Wed Aug 20 20:50:25 2025 +0000 KVM: SEV: Add SEV-SNP CipherTextHiding support Ciphertext hiding prevents host accesses from reading the ciphertext of SNP guest private memory. Instead of reading ciphertext, the host reads will see constant default values (0xff). The SEV ASID space is split into SEV and SEV-ES/SEV-SNP ASID ranges. Enabling ciphertext hiding further splits the SEV-ES/SEV-SNP ASID space into separate ASID ranges for SEV-ES and SEV-SNP guests. Add a new off-by-default kvm-amd module parameter to enable ciphertext hiding and allow the admin to configure the SEV-ES and SEV-SNP ASID ranges. Simply cap the maximum SEV-SNP ASID as appropriate, i.e. don't reject loading KVM or disable ciphertest hiding for a too-big value, as KVM's general approach for module params is to sanitize inputs based on hardware/kernel support, not burn the world down. This also allows the admin to use -1u to assign all SEV-ES/SNP ASIDs to SNP without needing dedicated handling in KVM. Suggested-by: Sean Christopherson Signed-off-by: Ashish Kalra Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/95abc49edfde36d4fb791570ea2a4be6ad95fd0d.1755721927.git.ashish.kalra@amd.com Signed-off-by: Sean Christopherson commit 32d376610bdfdcda39e0a74aac7c6c3b92f91098 Author: Quentin Monnet Date: Mon Sep 15 14:42:09 2025 +0100 bpftool: Search for tracefs at /sys/kernel/tracing first With "bpftool prog tracelog", bpftool prints messages from the trace pipe. To do so, it first needs to find the tracefs mount point to open the pipe. Bpftool looks at a few "default" locations, including /sys/kernel/debug/tracing and /sys/kernel/tracing. Some of these locations, namely /tracing and /trace, are not standard. They are in the list because some users used to hardcode the tracing directory to short names; but we have no compelling reason to look at these locations. If we fail to find the tracefs at the default locations, we have an additional step to find it by parsing /proc/mounts anyway, so it's safe to remove these entries from the list of default locations to check. Additionally, Alexei reports that looking for the tracefs at /sys/kernel/debug/tracing may automatically mount the file system under that location, and generate a kernel log message telling that auto-mounting there is deprecated. To avoid this message, let's swap the order for checking the potential mount points: try /sys/kernel/tracing first, which should be the standard location nowadays. The kernel log message may still appear if the tracefs is not mounted on /sys/kernel/tracing when we run bpftool. Reported-by: Alexei Starovoitov Closes: https://lore.kernel.org/r/CAADnVQLcMi5YQhZKsU4z3S2uVUAGu_62C33G2Zx_ruG3uXa-Ug@mail.gmail.com/ Signed-off-by: Quentin Monnet Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250915134209.36568-1-qmo@kernel.org Signed-off-by: Alexei Starovoitov commit d7fc7d9833f6b60805f67e3f913b7a646ce2a47e Author: Ashish Kalra Date: Wed Aug 20 20:50:01 2025 +0000 KVM: SEV: Introduce new min,max sev_es and sev_snp asid variables Introduce new min, max sev_es_asid and sev_snp_asid variables. The new {min,max}_{sev_es,snp}_asid variables along with existing {min,max}_sev_asid variable simplifies partitioning of the SEV and SEV-ES+ ASID space. Suggested-by: Sean Christopherson Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Link: https://lore.kernel.org/r/1db48277e8e96a633d734786ea69bf830f014857.1755721927.git.ashish.kalra@amd.com Signed-off-by: Sean Christopherson commit 456b32c9c1bc6c99310163281edb53eefd51330c Author: John Harrison Date: Wed Sep 10 14:02:35 2025 -0700 drm/xe/guc: Add test for G2G communications Add a test for sending messages from every GuC to every other GuC to test G2G communications. Note that, being a debug only feature, the test interface only exists in pre-production builds of the GuC firmware. v2: Fix 'default' case to actually use the driver's registration code as well as allocation. Add comments explaining the different test types. Fix (C) date and an assert. Review feedback from Daniele. Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250910210237.603576-5-John.C.Harrison@Intel.com commit 537773db91c2765898eee0521d5f03acae5a545f Author: John Harrison Date: Wed Sep 10 14:02:34 2025 -0700 drm/xe: Allow freeing of a managed bo If a bo is created via xe_managed_bo_create_pin_map() then it cannot be freed by the driver using xe_bo_unpin_map_no_vm(), or indeed any other existing function. The DRM layer will still have a pointer stashed away for later freeing, causing a invalid memory access on driver unload. So add a helper for releasing the DRM action as well. v2: Drop 'xe' parameter (review feedbak from Michal W) Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250910210237.603576-4-John.C.Harrison@Intel.com commit acf01c79f0684e3cbaa8e6326b970d7a7381c2ee Author: John Harrison Date: Wed Sep 10 14:02:33 2025 -0700 drm/xe/guc: Add firmware build type to available info Some test features are not available in production builds of the GuC firmware. So add the build type field to the available information that tests can inspect to decide if they should skip or run. Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250910210237.603576-3-John.C.Harrison@Intel.com commit 7d0ca56e9176578babd527736840e7c32c3ee5fc Author: John Harrison Date: Wed Sep 10 14:02:32 2025 -0700 drm/xe/guc: Update CSS header structures Rework the CSS header structure according to recent updates to the GuC API spec. Also include more field definitions. v2: Also pass the new GuC specific structure to a GuC specific function instead of the higher level, generic structure (review feedback from Daniele). Also correct naming of CSS_TIME_* fields. Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250910210237.603576-2-John.C.Harrison@Intel.com commit 597f41e1743882db32f99dde062adbec29104586 Author: Alexandru Elisei Date: Mon Sep 15 16:52:34 2025 +0100 KVM: arm64: Update stale comment for sanitise_mte_tags() Commit c911f0d46879 ("KVM: arm64: permit all VM_MTE_ALLOWED mappings with MTE enabled") allowed VM_SHARED VMAs in a VM with MTE enabled, so remove the comment to the contrary. Commit d77e59a8fccd ("arm64: mte: Lock a page for MTE tag initialisation") removed the race that can lead to tags being zeroed more than once when multiple threads attempt initialisation at the same time, so remove the comment about mmap_lock too. Note that sanitise_mte_tags() was never called with the mmap_lock held from user_mem_abort() and the race was prevented by kvm->mmu_lock. However, the function still requires to have the kvm->mmu_lock held to ensure that the memory remains mapped in the userspace process while the tags are zeroed. Document this in a comment. CC: Peter Collingbourne CC: Catalin Marinas CC: Steven Price Signed-off-by: Alexandru Elisei Reviewed-by: Steven Price Signed-off-by: Marc Zyngier commit f20e264262f1e6a6e5302249e37da355d844b52b Author: Thomas Weißschuh Date: Mon Sep 8 09:03:53 2025 +0200 kunit: qemu_configs: Add MIPS configurations Add basic support to run various MIPS variants via kunit_tool using the virtualized malta platform. Link: https://lore.kernel.org/r/20250908-kunit-mips-v5-1-d9f0632d1854@linutronix.de Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 031cdd3bc3f369553933c1b0f4cb18000162c8ff Author: Thomas Weißschuh Date: Mon Sep 8 09:03:38 2025 +0200 kunit: Enable PCI on UML without triggering WARN() Various KUnit tests require PCI infrastructure to work. All normal platforms enable PCI by default, but UML does not. Enabling PCI from .kunitconfig files is problematic as it would not be portable. So in commit 6fc3a8636a7b ("kunit: tool: Enable virtio/PCI by default on UML") PCI was enabled by way of CONFIG_UML_PCI_OVER_VIRTIO=y. However CONFIG_UML_PCI_OVER_VIRTIO requires additional configuration of CONFIG_UML_PCI_OVER_VIRTIO_DEVICE_ID or will otherwise trigger a WARN() in virtio_pcidev_init(). However there is no one correct value for UML_PCI_OVER_VIRTIO_DEVICE_ID which could be used by default. This warning is confusing when debugging test failures. On the other hand, the functionality of CONFIG_UML_PCI_OVER_VIRTIO is not used at all, given that it is completely non-functional as indicated by the WARN() in question. Instead it is only used as a way to enable CONFIG_UML_PCI which itself is not directly configurable. Instead of going through CONFIG_UML_PCI_OVER_VIRTIO, introduce a custom configuration option which enables CONFIG_UML_PCI without triggering warnings or building dead code. Link: https://lore.kernel.org/r/20250908-kunit-uml-pci-v2-1-d8eba5f73c9d@linutronix.de Signed-off-by: Thomas Weißschuh Reviewed-by: Johannes Berg Reviewed-by: David Gow Signed-off-by: Shuah Khan commit df4666a4908a6d883f628f93a3e6c80981332035 Author: Martin George Date: Tue Sep 9 16:05:09 2025 +0530 nvme-tcp: send only permitted commands for secure concat In addition to sending permitted commands such as connect/auth over the initial unencrypted admin connection as part of secure channel concatenation, the host also sends commands such as Property Get and Identify on the same. This is a spec violation leading to secure concat failures. Fix this by ensuring these additional commands are avoided on this connection. Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") Signed-off-by: Martin George Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit e65a9ed4c3ec11fb40474f3340b9c1e1551c6b7a Author: Peng Fan Date: Wed Sep 10 15:11:50 2025 +0800 remoteproc: imx_rproc: Clean up after ops introduction With the switch-case in imx_rproc_{start,stop}{} removed, simplify the code logic by removing 'goto'. The last switch-case in imx_rproc_detect_mode() are no longer needed and can be removed. This cleanup improves code readability and aligns with the new ops-based design. No functional changes. Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-6-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit 02ac6cc8c5a129013695c3eee48b65fb5ba669c0 Author: David Kaplan Date: Mon Sep 15 08:47:02 2025 -0500 x86/bugs: Simplify SSB cmdline parsing Simplify the SSB command line parsing by selecting a mitigation directly, as is done in most of the simpler vulnerabilities. Use early_param() instead of cmdline_find_option() for consistency with the other mitigation selections. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta Link: https://lore.kernel.org/r/20250819192200.2003074-4-david.kaplan@amd.com commit ecadd767fb83556fe4db599fd5305b08b8328cef Author: Peng Fan Date: Wed Sep 10 15:11:49 2025 +0800 remoteproc: imx_rproc: Simplify IMX_RPROC_SMC switch case Introduce imx_rproc_arm_smc_{start, stop, detect_mode}() helper functions for all i.MX variants using IMX_RPROC_SMC to manage remote processors. This allows the removal of the IMX_RPROC_SMC switch-case blocks from imx_rproc_start(), imx_rproc_stop(), and imx_rproc_detect_mode(), resulting in cleaner and more maintainable code. Since this is the last switch in imx_rproc_{start,stop}{}, remove the switch-case. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-5-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit b7ea858a82194160952875a2e8643ceda1943db5 Author: Peng Fan Date: Wed Sep 10 15:11:48 2025 +0800 remoteproc: imx_rproc: Simplify IMX_RPROC_SCU_API switch case Introduce imx_rproc_scu_api_{start, stop, detect_mode}() helper functions for all i.MX variants using IMX_RPROC_SCU_API to manage remote processors. This allows the removal of the IMX_RPROC_SCU_API switch-case blocks from imx_rproc_start(), imx_rproc_stop(), and imx_rproc_detect_mode(), resulting in cleaner and more maintainable code. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-4-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit e14168bf3493aa86dcca1eb2666318a61b450b18 Author: Peng Fan Date: Wed Sep 10 15:11:47 2025 +0800 remoteproc: imx_rproc: Simplify IMX_RPROC_MMIO switch case Introduce imx_rproc_mmio_{start, stop, detect_mode}() helper functions for all i.MX variants using IMX_RPROC_MMIO to manage remote processors. This allows the removal of the IMX_RPROC_MMIO switch-case blocks from imx_rproc_start(), imx_rproc_stop(), and imx_rproc_detect_mode(), resulting in cleaner and more maintainable code. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-3-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit 11a8d3cb4c624a2b29e2fa1d8b5046f69b71b40f Author: Peng Fan Date: Wed Sep 10 15:11:46 2025 +0800 remoteproc: imx_rproc: Move imx_rproc_dcfg closer to imx_rproc_of_match Move the imx_rproc_dcfg structure definitions closer to imx_rproc_of_match to prepare for adding start/stop/detect_mode ops for each i.MX variant. This relocation avoids the need to declare function prototypes such as 'static int imx_rproc_xtr_mbox_init(struct rproc *rproc, bool tx_block)' at the beginning of the file, improving code organization and readability. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-2-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit ff24e5b26dc6853364b0c006130b653f65a15acd Author: Peng Fan Date: Wed Sep 10 15:11:45 2025 +0800 remoteproc: imx_rproc: Introduce start/stop/detect_mode ops for imx_rproc_dcfg Simplify the logic in imx_rproc_start(), imx_rproc_stop() and imx_rproc_detect_mode(), introduce start, stop and detect_mode ops for the imx_rproc_dcfg structure. Allow each platform to provide its own implementation of start/stop/detect_mode operations, and prepare to eliminate the need for multiple switch-case statements. Improve code readability and maintainability by encapsulating platform-specific behavior. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250910-imx-rproc-cleanup-v2-1-10386685b8a9@nxp.com Signed-off-by: Mathieu Poirier commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad Author: Daniel Wagner Date: Tue Sep 2 12:22:03 2025 +0200 nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport. Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 10c165af35d225eb033f4edc7fcc699a8d2d533d Author: Daniel Wagner Date: Tue Sep 2 12:22:02 2025 +0200 nvmet-fcloop: call done callback even when remote port is gone When the target port is gone, it's not possible to access any of the request resources. The function should just silently drop the response. The comment is misleading in this regard. Though it's still necessary to call the driver via the ->done callback so the driver is able to release all resources. Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/ Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone") Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit f2537be4f8421f6495edfa0bc284d722f253841d Author: Daniel Wagner Date: Tue Sep 2 12:22:01 2025 +0200 nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion. Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted. Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/ Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 Author: Daniel Wagner Date: Tue Sep 2 12:22:00 2025 +0200 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command. Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit 53c18dc078bb6d9e9dfe2cc0671ab78588c44723 Author: Amelie Delaunay Date: Wed Sep 10 10:24:38 2025 +0200 arm64: dts: st: fix memory region size on stm32mp235f-dk STM32MP23x SoCs provide a DDR controller supporting up to 4GB/16-bit. The control pin to properly configure 4GB/16-bit is not routed on stm32mp235f-dk, that's why the board only supports 2GB. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250910-stm32mp231_gpio_update-v2-2-8510efa2c5cf@foss.st.com Signed-off-by: Alexandre Torgue commit 7bfa81d4b299d236ddecbf9dc2fc097e585d5b36 Author: Amelie Delaunay Date: Wed Sep 10 10:24:37 2025 +0200 arm64: dts: st: remove gpioj and gpiok banks from stm32mp231 STM32MP23x supports AJ, AK and AL packages, where PI12 to PI15, PJ0 to PJ15 (whole J bank) and PK0 to PK7 (whole K bank) pins are not available. It means gpioj and gpiok nodes are useless in stm32mp231. Remove them. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250910-stm32mp231_gpio_update-v2-1-8510efa2c5cf@foss.st.com Signed-off-by: Alexandre Torgue commit df4eb8bbdd13e504f545d803e2e3cb3673efa5c8 Author: Gatien Chevallier Date: Thu Sep 4 09:40:59 2025 +0200 arm64: dts: st: enable ethernet1 controller on stm32mp235f-dk ethernet1 controller is connected to the RTL8211F-CG Realtek PHY in RGMII mode. Enable this peripheral on the stm32mp235f-dk board. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250904-mp2_ethernet-v2-4-05a060157fb7@foss.st.com Signed-off-by: Alexandre Torgue commit 58f29beb1ff5515a8423599a6422eb3e3790da75 Author: Gatien Chevallier Date: Thu Sep 4 09:40:58 2025 +0200 arm64: dts: st: enable ethernet1 controller on stm32mp257f-ev1 ethernet1 controller is connected to the RTL8211F-CG Realtek PHY in RGMII mode. It can either be used as a standalone Ethernet controller or be connected to the internal TSN capable switch. For this board, keep the standalone setup. Also enable this peripheral on the stm32mp257f-ev1 board. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250904-mp2_ethernet-v2-3-05a060157fb7@foss.st.com Signed-off-by: Alexandre Torgue commit 74e42b3c5938a643a32106e2921a6f3b0fc75872 Author: Gatien Chevallier Date: Thu Sep 4 09:40:57 2025 +0200 arm64: dts: st: enable ethernet1 controller on stm32mp257f-dk ethernet1 controller is connected to the RTL8211F-CG Realtek PHY in RGMII mode. Enable this peripheral on the stm32mp257f-dk board. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250904-mp2_ethernet-v2-2-05a060157fb7@foss.st.com Signed-off-by: Alexandre Torgue commit 4c2ac7b9abc8d7d3407cca3677835d137a748492 Author: Gatien Chevallier Date: Thu Sep 4 09:40:56 2025 +0200 arm64: dts: st: add eth1 pins for stm32mp2x platforms Eth1 ethernet controller is present on every stm32mp2x vendor boards. Describe the pinctrl of eth1 for each of them. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250904-mp2_ethernet-v2-1-05a060157fb7@foss.st.com Signed-off-by: Alexandre Torgue commit bd0c7718ae1877e2e4eeb903096e905754d5df78 Author: Gatien Chevallier Date: Mon Sep 1 11:16:29 2025 +0200 ARM: dts: stm32: add missing PTP reference clocks on stm32mp13x SoCs ETH1/2 miss their PTP reference clock in the SoC device tree. Add them as the fallback is not correctly handled for PPS generation and it seems there's no reason to not add them. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20250901-relative_flex_pps-v4-3-b874971dfe85@foss.st.com Signed-off-by: Alexandre Torgue commit 86803282a11801fb15360e52e6f2a7d7c7afdbec Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:22 2025 +0200 arm64: dts: st: enable display support on stm32mp257f-ev1 board Enable the following IPs on stm32mp257f-ev1 in order to get display: * LTDC * LVDS * WSVGA LVDS panel (1024x600) * Panel LVDS backlight as GPIO backlight * ILI2511 i2c touchscreen Signed-off-by: Raphael Gallais-Pou Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-13-9c825e28f733@foss.st.com Signed-off-by: Alexandre Torgue commit 092f7634fffa66c7dfc5c452e0c8818040ff77b8 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:21 2025 +0200 arm64: dts: st: add clock-cells to syscfg node on stm32mp251 Make the syscfg node a clock provider so clock consumers can reach child clocks through device-tree. Signed-off-by: Raphael Gallais-Pou Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-12-9c825e28f733@foss.st.com Signed-off-by: Alexandre Torgue commit c067119b07369a2d27eb2575f050afb271ec01e7 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:20 2025 +0200 arm64: dts: st: add lvds support on stm32mp255 The LVDS is used on STM32MP2 as a display interface. Add the LVDS node. Signed-off-by: Raphael Gallais-Pou Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-11-9c825e28f733@foss.st.com Signed-off-by: Alexandre Torgue commit 84b78bc2cb144ea0945320c5d1c4ad2085a704e6 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:19 2025 +0200 arm64: dts: st: add ltdc support on stm32mp255 Add the LTDC node for stm32mp255 SoC and handle its loopback clocks. ck_ker_ltdc has the CLK_SET_RATE_PARENT flag. While having this flag is semantically correct, it for now leads to an improper setting of the clock rate. The ck_ker_ltdc parent clock is the flexgen 27, which does not support changing rates yet. To overcome this issue, a fixed clock can be used for the kernel clock. Signed-off-by: Raphael Gallais-Pou Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-10-9c825e28f733@foss.st.com Signed-off-by: Alexandre Torgue commit 114e282d51ea87dab368397d525be96e57d084ff Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:18 2025 +0200 arm64: dts: st: add ltdc support on stm32mp251 The LCD-TFT Display Controller (LTDC) handles display composition, scaling and rotation. It provides a parallel digital RGB flow to be used by display interfaces. Add the LTDC node. Signed-off-by: Raphael Gallais-Pou Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-9-9c825e28f733@foss.st.com Signed-off-by: Alexandre Torgue commit 6bb200f11aedd1c3c5579e5b37c13144d1e49ac8 Author: Marc Kleine-Budde Date: Thu Aug 7 08:09:31 2025 +0200 ARM: dts: stm32: add resets property to m_can nodes in the stm32mp153 On the STM32MP153 the m_cam IP cores (a.k.a. FDCAN) have an external shared reset in the RCC. Add the reset to both m_can nodes. Signed-off-by: Marc Kleine-Budde Link: https://lore.kernel.org/r/20250807-stm32mp15-m_can-add-reset-v2-2-f69ebbfced1f@pengutronix.de Signed-off-by: Alexandre Torgue commit dd1704a50738605997e0aff71981c33241c3df67 Author: Marc Kleine-Budde Date: Thu Aug 7 08:09:30 2025 +0200 dt-binding: can: m_can: add optional resets property The m_can IP core has an external reset line. Add it to the bindings documentation. Signed-off-by: Marc Kleine-Budde Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250807-stm32mp15-m_can-add-reset-v2-1-f69ebbfced1f@pengutronix.de Signed-off-by: Alexandre Torgue commit 30793e0108942cb086ae9febfa5bf736453013e7 Author: Christian Bruel Date: Wed Aug 20 09:54:11 2025 +0200 arm64: dts: st: Enable PCIe on the stm32mp257f-ev1 board Add PCIe RC and EP support on stm32mp257f-ev1 board. Default to RC mode. Signed-off-by: Christian Bruel Link: https://lore.kernel.org/r/20250820075411.1178729-12-christian.bruel@foss.st.com Signed-off-by: Alexandre Torgue commit 73d536ae1a43015dd184e5ced6879f61c8907bca Author: Christian Bruel Date: Wed Aug 20 09:54:10 2025 +0200 arm64: dts: st: Add PCIe Endpoint mode on stm32mp251 Add pcie_ep node to support STM32 MP25 PCIe driver based on the DesignWare PCIe core configured as Endpoint mode Signed-off-by: Christian Bruel Acked-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250820075411.1178729-11-christian.bruel@foss.st.com Signed-off-by: Alexandre Torgue commit 0ecdf6d2f55044487e7c1ceeed70b6356b670aa4 Author: Christian Bruel Date: Wed Aug 20 09:54:09 2025 +0200 arm64: dts: st: Add PCIe Root Complex mode on stm32mp251 Add pcie_rc node to support STM32 MP25 PCIe driver based on the DesignWare PCIe core configured as Root Complex mode Supports Gen1/Gen2, single lane, MSI interrupts using the ARM GICv2m Signed-off-by: Christian Bruel Acked-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250820075411.1178729-10-christian.bruel@foss.st.com Signed-off-by: Alexandre Torgue commit 7e4479c9243d1b5d1e3deb7fb9efae64a399a3e3 Author: Christian Bruel Date: Wed Aug 20 09:54:08 2025 +0200 arm64: dts: st: add PCIe pinctrl entries in stm32mp25-pinctrl.dtsi Add PCIe pinctrl entries in stm32mp25-pinctrl.dtsi init: forces GPIO to low while probing so CLKREQ is low for phy_init default: restore the AFMUX after controller probe Add Analog pins of PCIe to perform power cycle Signed-off-by: Christian Bruel Link: https://lore.kernel.org/r/20250820075411.1178729-9-christian.bruel@foss.st.com Signed-off-by: Alexandre Torgue commit 27cd5cd8bd332d9d09fe5af6b1b0ed9c02ccdf24 Author: Patrice Chotard Date: Thu Aug 21 11:14:02 2025 +0200 arm64: defconfig: Enable STMicroelectronics STM32 DMA3 support Enable STMicroelectronics STM32 DMA3 support as module. STM32 DMA3 is used among others by STM32 Octo SPI driver on STM32MP257F-EV1 board. Signed-off-by: Patrice Chotard Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250821-upstream_defconfig_enable_stm32_dma3-v1-1-d9c1b71883d9@foss.st.com Signed-off-by: Alexandre Torgue commit d0647b20d1e19a6d8dc44e57d2d453610c0f29f2 Author: Clément Le Goffic Date: Fri Jul 11 09:41:26 2025 +0200 ARM: dts: stm32: add Hardware debug port (HDP) on stm32mp157c-dk2 board On the stm32mp157fc-dk2 board, we can observe the hdp GPOVAL function on SoC pin E13 accessible on the pin 5 on the Arduino connector CN13. Add the relevant configuration but keep it disabled as it's used for debug only. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250711-hdp-upstream-v7-8-faeecf7aaee1@foss.st.com Signed-off-by: Alexandre Torgue commit 3d42567279e1328ba90e51b47b80539b9dae007e Author: Clément Le Goffic Date: Fri Jul 11 09:41:25 2025 +0200 ARM: dts: stm32: add alternate pinmux for HDP pin and add HDP pinctrl node Introduce hdp node to output a user defined value on port hdp2. Add pinctrl nodes to be able to output this signal on one SoC pin. Signed-off-by: Clément Le Goffic Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250711-hdp-upstream-v7-7-faeecf7aaee1@foss.st.com Signed-off-by: Alexandre Torgue commit f398bb61833500bceb81c2445f2a9e6e8cbc3551 Author: Clément Le Goffic Date: Fri Jul 11 09:41:24 2025 +0200 arm64: dts: st: add Hardware debug port (HDP) on stm32mp25 Add the hdp devicetree node for stm32mp25 SoC family Keep the node disabled as HDP needs the pinctrl SoC configuration to be able to output its mux output signal outside of the SoC, on the SoC pad. This configuration is provided in the board dtsi file through 'pinctrl-*' properties as well as HDP mux configuration. Thus, if needed, HDP should be enabled in board dtsi file. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250711-hdp-upstream-v7-6-faeecf7aaee1@foss.st.com Signed-off-by: Alexandre Torgue commit 4c8bad3ed035ab85ad9b0d247154be43a53ef84d Author: Thorsten Blum Date: Mon Sep 15 14:05:39 2025 +0200 xtensa: use HZ_PER_MHZ in platform_calibrate_ccount Replace the hardcoded 1000000UL with the HZ_PER_MHZ unit macro, and add a space in "10 MHz" to improve the readability of the error message. Signed-off-by: Thorsten Blum Message-Id: <20250915120540.2150841-3-thorsten.blum@linux.dev> Signed-off-by: Max Filippov commit dcc7a571a3665a16581b5b18ca6b113f60a9a41a Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:50 2025 -0700 Documentation: tee: Add Qualcomm TEE driver Add documentation for the Qualcomm TEE driver. Acked-by: Sumit Garg Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 87ab676d909b192000342e6c301fcd13eaa17dbd Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:49 2025 -0700 tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl Enable userspace to allocate shared memory with QTEE. Since QTEE handles shared memory as object, a wrapper is implemented to represent tee_shm as an object. The shared memory identifier, obtained through TEE_IOC_SHM_ALLOC, is transferred to the driver using TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT/OUTPUT. Tested-by: Neil Armstrong Acked-by: Sumit Garg Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 0f7bfdcb7c37ae826ba6f1fde05d31040a97fd77 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:48 2025 -0700 tee: qcom: add primordial object After booting, the kernel provides a static object known as the primordial object. This object is utilized by QTEE for native kernel services such as yield or privileged operations. Acked-by: Sumit Garg Tested-by: Neil Armstrong Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit d6e290837e50f73f88f31f19bd8a7213d92e6e46 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:47 2025 -0700 tee: add Qualcomm TEE driver Introduce qcomtee_object, which represents an object in both QTEE and the kernel. QTEE clients can invoke an instance of qcomtee_object to access QTEE services. If this invocation produces a new object in QTEE, an instance of qcomtee_object will be returned. Similarly, QTEE can request services from by issuing a callback request, which invokes an instance of qcomtee_object. Implement initial support for exporting qcomtee_object to userspace and QTEE, enabling the invocation of objects hosted in QTEE and userspace through the TEE subsystem. Tested-by: Neil Armstrong Tested-by: Harshal Dev Acked-by: Sumit Garg Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit bd5139306886a9626a7d794940376806eccb9547 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:46 2025 -0700 tee: increase TEE_MAX_ARG_SIZE to 4096 Increase TEE_MAX_ARG_SIZE to accommodate worst-case scenarios where additional buffer space is required to pass all arguments to TEE. This change is necessary for upcoming support for Qualcomm TEE, which requires a larger buffer for argument marshaling. Reviewed-by: Sumit Garg Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit d5b8b0fa1775d8b59c3fc9e4aa2baa715d08f3ee Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:45 2025 -0700 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF The TEE subsystem allows session-based access to trusted services, requiring a session to be established to receive a service. This is not suitable for an environment that represents services as objects. An object supports various operations that a client can invoke, potentially generating a result or a new object that can be invoked independently of the original object. Add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT/OUTPUT/INOUT to represent an object. Objects may reside in either TEE or userspace. To invoke an object in TEE, introduce a new ioctl. Use the existing SUPPL_RECV and SUPPL_SEND to invoke an object in userspace. Reviewed-by: Sumit Garg Tested-by: Neil Armstrong Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 54a53e95a908a4cc770f0530c49f04c89e7b18dc Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:44 2025 -0700 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF For drivers that can transfer data to the TEE without using shared memory from client, it is necessary to receive the user address directly, bypassing any processing by the TEE subsystem. Introduce TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT/OUTPUT/INOUT to represent userspace buffers. Reviewed-by: Sumit Garg Tested-by: Neil Armstrong Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 0cbaf65c91db0e40a577e8919979dac1963cfcc0 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:43 2025 -0700 tee: add close_context to TEE driver operation The tee_context can be used to manage TEE user resources, including those allocated by the driver for the TEE on behalf of the user. The release() callback is invoked only when all resources, such as tee_shm, are released and there are no references to the tee_context. When a user closes the device file, the driver should notify the TEE to release any resources it may hold and drop the context references. To achieve this, a close_context() callback is introduced to initiate resource release in the TEE driver when the device file is closed. Relocate teedev_ctx_get, teedev_ctx_put, tee_device_get, and tee_device_get functions to tee_core.h to make them accessible outside the TEE subsystem. Reviewed-by: Sumit Garg Tested-by: Neil Armstrong Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:42 2025 -0700 tee: allow a driver to allocate a tee_device without a pool A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly. Reviewed-by: Sumit Garg Signed-off-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 84afb84bcc28b08e6d8a4e36865959d770e2643d Author: Fushuai Wang Date: Sun Sep 14 18:16:30 2025 +0800 drm/xe: Use ERR_CAST instead of ERR_PTR(PTR_ERR(...)) Use ERR_CAST inline function instead of ERR_PTR(PTR_ERR(...)). Signed-off-by: Fushuai Wang Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250914101630.17719-1-wangfushuai@baidu.com Signed-off-by: Lucas De Marchi commit 36629d52241f785b044e50357686f177232fb288 Merge: dbc2868b7b57fb 4b700098c0fc4a Author: Jens Wiklander Date: Mon Sep 15 17:26:53 2025 +0200 Merge branch '20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-2-17f07a942b8d@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux firmware: qcom: tzmem: export shm_bridge create/delete firmware: qcom: scm: add support for object invocation Signed-off-by: Jens Wiklander commit 9a9f8147ae7fd558d6f0d40b560ffbdd408768df Author: David Kaplan Date: Mon Sep 15 08:47:01 2025 -0500 x86/bugs: Use early_param() for spectre_v2 Most of the mitigations in bugs.c use early_param() for command line parsing. Rework the spectre_v2 and nospectre_v2 command line options to be consistent with the others. Remove spec_v2_print_cond() as informing the user of the their cmdline choice isn't interesting. [ bp: Zap spectre_v2_check_cmd(). ] Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta Link: https://lore.kernel.org/r/20250819192200.2003074-3-david.kaplan@amd.com commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 Author: Martin George Date: Mon Sep 15 17:19:21 2025 +0530 nvme-auth: update bi_directional flag While setting chap->s2 to zero as part of secure channel concatenation, the host missed out to disable the bi_directional flag to indicate that controller authentication is not requested. Fix the same. Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") Signed-off-by: Martin George Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit c5e389cc6b36701098d31fa3438c553c7fe7c1bb Author: Alok Tiwari Date: Fri Sep 12 06:50:44 2025 -0700 net/mlx5: fix typo in pci_irq.c comment Fix a typo in a comment in pci_irq.c: "ssigned" → "assigned" Signed-off-by: Alok Tiwari Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250912135050.3921116-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 1b3aa3900782707ec2f4cc1651bc82c628f25d2b Author: Jens Axboe Date: Wed Sep 10 17:45:36 2025 -0600 io_uring/uring_cmd: correct signature for io_uring_mshot_cmd_post_cqe() The !CONFIG_IO_URING signature is wrong, fix that up. The non stub signature got updated for the io_br_sel changes that happened before this patch went in, but the stub one did not. Fixes: 620a50c92700 ("io_uring: uring_cmd: add multishot support") Signed-off-by: Jens Axboe commit 8c42986b02887f66af31b6e42babc904b2f4f4b6 Merge: 5b5ba63a54cc7c a1e891fe4ae8df Author: Jakub Kicinski Date: Mon Sep 15 08:08:41 2025 -0700 Merge branch 'dpll-zl3073x-add-support-for-devlink-flash' Ivan Vecera says: ==================== dpll: zl3073x: Add support for devlink flash Add functionality for accessing device hardware registers, loading firmware bundles, and accessing the device's internal flash memory, and use it to implement the devlink flash functionality. ==================== Link: https://patch.msgid.link/20250909091532.11790-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit a1e891fe4ae8df3ba17d75c270f1877e282c9d2c Author: Ivan Vecera Date: Tue Sep 9 11:15:32 2025 +0200 dpll: zl3073x: Implement devlink flash callback Use the introduced functionality to read firmware files and flash their contents into the device's internal flash memory to implement the devlink flash update callback. Sample output on EDS2 development board: # devlink -j dev info i2c/1-0070 | jq '.[][]["versions"]["running"]' { "fw": "6026" } # devlink dev flash i2c/1-0070 file firmware_fw2.hex [utility] Prepare flash mode [utility] Downloading image 100% [utility] Flash mode enabled [firmware1-part1] Downloading image 100% [firmware1-part1] Flashing image [firmware1-part2] Downloading image 100% [firmware1-part2] Flashing image [firmware1] Flashing done [firmware2] Downloading image 100% [firmware2] Flashing image 100% [firmware2] Flashing done [utility] Leaving flash mode Flashing done # devlink -j dev info i2c/1-0070 | jq '.[][]["versions"]["running"]' { "fw": "7006" } Reviewed-by: Przemek Kitszel Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250909091532.11790-6-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit ebb1031c51377829b21e1c58e8eccc479e4921b7 Author: Ivan Vecera Date: Tue Sep 9 11:15:31 2025 +0200 dpll: zl3073x: Refactor DPLL initialization Refactor DPLL initialization and move DPLL (de)registration, monitoring control, fetching device invariant parameters and phase offset measurement block setup to separate functions. Use these new functions during device probe and teardown functions and during changes to the clock_id devlink parameter. These functions will also be used in the next patch implementing devlink flash, where this functionality is likewise required. Reviewed-by: Przemek Kitszel Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250909091532.11790-5-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit ca017409da6944310d2a9d8744f5ebc81179ce19 Author: Ivan Vecera Date: Tue Sep 9 11:15:30 2025 +0200 dpll: zl3073x: Add firmware loading functionality Add functionality for loading firmware files provided by the vendor to be flashed into the device's internal flash memory. The firmware consists of several components, such as the firmware executable itself, chip-specific customizations, and configuration files. The firmware file contains at least a flash utility, which is executed on the device side, and one or more flashable components. Each component has its own specific properties, such as the address where it should be loaded during flashing, one or more destination flash pages, and the flashing method that should be used. Reviewed-by: Przemek Kitszel Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250909091532.11790-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 3639bd087679f77c3fdedc6922f2cb01bb6ecbaf Author: Ivan Vecera Date: Tue Sep 9 11:15:29 2025 +0200 dpll: zl3073x: Add low-level flash functions To implement the devlink device flash functionality, the driver needs to access both the device memory and the internal flash memory. The flash memory is accessed using a device-specific program (called the flash utility). This flash utility must be downloaded by the driver into the device memory and then executed by the device CPU. Once running, the flash utility provides a flash API to access the flash memory itself. During this operation, the normal functionality provided by the standard firmware is not available. Therefore, the driver must ensure that DPLL callbacks and monitoring functions are not executed during the flash operation. Add all necessary functions for downloading the utility to device memory, entering and exiting flash mode, and performing flash operations. Reviewed-by: Przemek Kitszel Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250909091532.11790-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 259ede9da4ec8159c312aa60015a3aecbb67f348 Author: Ivan Vecera Date: Tue Sep 9 11:15:28 2025 +0200 dpll: zl3073x: Add functions to access hardware registers Besides the device host registers that are directly accessible, there are also hardware registers that can be accessed indirectly via specific host registers. Add register definitions for accessing hardware registers and provide helper functions for working with them. Additionally, extend the number of pages in the regmap configuration to 256, as the host registers used for accessing hardware registers are located on page 255. Reviewed-by: Przemek Kitszel Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250909091532.11790-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 8edb9e77119be3cdd930e71204ee48c4994b217b Author: David Kaplan Date: Mon Sep 15 08:47:00 2025 -0500 x86/bugs: Use early_param() for spectre_v2_user Most of the mitigations in bugs.c use early_param() to parse their command line options. Modify spectre_v2_user to use early_param() for consistency. Remove spec_v2_user_print_cond() because informing a user about their cmdline choice isn't very interesting and the chosen mitigation is already printed in spectre_v2_user_update_mitigation(). Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta Link: https://lore.kernel.org/r/20250819192200.2003074-2-david.kaplan@amd.com commit b8cac8c98e85e977369a4c07b5eccd73fbc30cb9 Author: Hans de Goede Date: Wed Sep 10 16:07:54 2025 +0200 power: supply: intel_dc_ti_battery: Drop no longer relevant comment Drop the comment about not being able to use devm_iio_channel_get(). The code has actually already successfully been switched over to devm_iio_channel_get(). This is just a no longer applicable left-over comment, drop it. Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 19baa830fbb60d712137dfbdf97a538f7057d100 Author: Lucas De Marchi Date: Fri Sep 12 15:05:34 2025 -0700 drm/xe: Use ARRAY_SIZE in guc_waklv_init() Prefer using ARRAY_SIZE where needed and just passing 1 instead of calculating the size of one element. Cc: Jonathan Cavitt Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508130158.eogeBZQT-lkp@intel.com/ Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250912-guc-ads-array-size-v1-1-a6555392a1f8@intel.com Signed-off-by: Lucas De Marchi commit 3864e4d5a526870e011e6aadc05645bc93ca3dd6 Author: Vlastimil Babka Date: Mon Sep 15 15:55:13 2025 +0200 slab: don't validate slab pointer in free_debug_processing() The struct slab pointer has been obtained from the object being freed on all the paths that lead to this function. In all cases this already includes the test for slab type of the struct page which struct slab is overlaying. Thus we would not reach this function if it was not a valid slab pointer in the first place. One less obvious case is that kmem_cache_free() trusts virt_to_slab() blindly so it may be NULL if the slab type check is false. But with SLAB_CONSISTENCY_CHECKS, cache_from_obj() called also from kmem_cache_free() catches this and returns NULL, which terminates freeing immediately. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit a21fe7b010e32c51c62a86dcba02f9404ed77cac Author: Vlastimil Babka Date: Mon Sep 15 15:55:12 2025 +0200 slab: validate slab before using it in alloc_single_from_partial() We touch slab->freelist and slab->inuse before checking the slab pointer is actually sane. Do that validation first, which will be safer. We can thus also remove the check from alloc_debug_processing(). This adds a new "s->flags & SLAB_CONSISTENCY_CHECKS" test but alloc_single_from_partial() is only called for caches with debugging enabled so it's acceptable. In alloc_single_from_new_slab() we just created the struct slab and call alloc_debug_processing() to mainly set up redzones, tracking etc, while not really expecting the consistency checks to fail. Thus don't validate it there. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit a409fac1f74bae095605fda86d8f7083aa5b35a6 Author: Rob Herring (Arm) Date: Wed Sep 10 18:37:40 2025 -0500 ARM: dts: socionext: Drop "linux,spdif-dit" port node unit-address A single graph port node without an address (i.e. "reg") should not have a unit-address, drop it from the "linux,spdif-dit" port node. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250910233740.777077-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit 9674bc8805cd7aa0082daab17d628aff37407182 Merge: dc16fd9dd0b137 f1a68ba5739e42 Author: Arnd Bergmann Date: Mon Sep 15 16:43:10 2025 +0200 Merge tag 'v6.17-next-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers mtk-svs: * Drop reference taken on probe failure * tag 'v6.17-next-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure Link: https://lore.kernel.org/r/87c8f50b-90a5-47ed-af60-99a4e075a266@gmail.com Signed-off-by: Arnd Bergmann commit 6c1c107bf5f4fc0d03ac3dbf02720c232c1142ba Merge: 636d134e3c52e0 dc8662956496d2 Author: Arnd Bergmann Date: Mon Sep 15 16:36:33 2025 +0200 Merge tag 'imx-dt64-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX arm64 device tree changes for 6.18: - New device trees: TQMa91xx/MBa91xxCA, Ultratronik Ultra-MACH SBC, SolidRun i.MX8MP SoM, i.MX8ULP EVK9, TQMLS1012AL, i.MX91 11x11 EVK, EDM-G-IMX8M-PLUS SOM - A bunch of Kontron boards update from Annette Kobou and Frieder Schrempf, adding overlay for LTE extension board, fixing GPIO for panel regulator, removing unused regulators, fixing USB hub reset and USB port etc. - A number of s32g updates from Dan Carpenter and Daniel Lezcano, adding OCOTP, timers and watchdog support - An i.MX95 update from Frank Li to add msi-map for pci-ep device - A series from Joy Zou to add i.MX91 support - A series from Krzysztof Kozlowski to add default GIC address cells for LS and i.MX8 SoCs - A set of changes from Peng Fan to improve i.MX95 support with more devices enabled - A series from Shengjiu Wang to support more sample rates for wm8524 card on i.MX8M EVK boards - Other random updates and cleanups on various boards * tag 'imx-dt64-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (75 commits) arm64: dts: s32g: Add device tree information for the OCOTP driver arm64: dts: add description for solidrun imx8mp hummingboard variants arm64: dts: imx8mm-phycore-som: optimize drive strengh arm64: dts: freescale: imx93-phycore-som: Remove "fsl,magic-packet" arm64: dts: freescale: imx93-phyboard-nash: Current sense via iio-hwmon arm64: dts: imx95: add standard PCI device compatible string to NETC Timer arm64: dts: freescale: add initial device tree for TQMa91xx/MBa91xxCA arm64: dts: imx93-11x11-evk: remove fec property eee-broken-1000t arm64: dts: freescale: add i.MX91 11x11 EVK basic support arm64: dts: imx91: add i.MX91 dtsi support arm64: dts: freescale: rename imx93.dtsi to imx91_93_common.dtsi and modify them arm64: dts: freescale: move aliases from imx93.dtsi to board dts arm64: dts: lx2160a-clearfog-itx: enable pcie nodes for x4 and x8 slots arm64: dts: lx2160a-cex7: add interrupts for rtc and ethernet phy arm64: dts: add description for solidrun imx8mp som and cubox-m arm64: dts: imx8: Use GIC_SPI for interrupt-map for readability arm64: dts: imx8qxp: Add default GIC address cells arm64: dts: imx8qm: Add default GIC address cells arm64: dts: imx8mq: Add default GIC address cells arm64: dts: imx8mp: Add default GIC address cells ... Link: https://lore.kernel.org/r/20250915132535.253859-3-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 636d134e3c52e034426506a8f39cd26ca553e942 Merge: 1c615dd3031b6b c56b0b3c2465ae Author: Arnd Bergmann Date: Mon Sep 15 16:34:08 2025 +0200 Merge tag 'imx-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX ARM device tree changes for 6.18: - A series from Alexander Stein to clean up the most of dt-schema warnings for LS1021A - A couple of changes from Bence Csókás to replace license text comment with SPDX identifier for imx6-display5 and imx6-aristainetos2 board - A couple of vfxxx dt-schema cleanups from Fabio Estevam - A bunch of changes from Frank Li to clean up dt-schema warnings on various platforms, VF610, LS1021A, i.MX6, etc. - Minor whitespace cleanup on i.MX8ULL from Krzysztof Kozlowski - An imx6ulz-bsh-smm-m2 workaround from Wolfgang Birkner to get resume via console work * tag 'imx-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (44 commits) ARM: dts: imx6sll: Use 'dma-names' ARM: dts: imx6: change rtc compatible string to st,m41t00 from m41t00 ARM: dts: imx6: remove undefined linux,default-trigger source ARM: dts: imx6ul-pico: add power-supply for vxt,vl050-8048nt-c01 ARM: dts: imx6ul-14x14-evk: add regulator for ov5640 ARM: dts: imx6: replace isl,isl12022 with isil,isl12022 for RTC ARM: dts: imx6: replace gpio-key with gpio-keys compatible string ARM: dts: imx6: rename i2cmux i2c-mux- ARM: dts: imx6: rename node name flash to eeprom ARM: dts: imx6: rename node i2c-gpio to i2c. ARM: dts: imx6: rename touch screen's node name to touchscreen ARM: dts: imx6: remove redundant pinctrl-names ARM: dts: imx6qdl-aristainetos2: rename ethernet-phy to ethernet-phy@0 ARM: dts: imx6: add interrupt-cells for dlg,da9063 pmic ARM: dts: imx6: align rtc chip node name to 'rtc' ARM: dts: imx6: add key- prefix for gpio-keys ARM: dts: imx6: add #address-cells for gsc@20 ARM: dts: imx6ul-tx6ul: Switch away from deprecated `phy-reset-gpios` ARM: dts: mba6ul: Add MicIn routing ARM: dts: ls1021a-tsn: Remove redundant #address-cells for ethernet-switch@1 ... Link: https://lore.kernel.org/r/20250915132535.253859-2-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 1c615dd3031b6be6f20d3a8588dd2610ad220b9d Merge: 10588787c8037a f001225088b873 Author: Arnd Bergmann Date: Mon Sep 15 16:32:50 2025 +0200 Merge tag 'imx-bindings-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX DT bindings changes for 6.18: - New board compatibles: TQMa91xx SOM, Ultratronik Ultra-MACH SBC, SolidRun i.MX8MP SoM, i.MX8ULP EVK9, TQMLS1012AL, i.MX91 11x11 EVK, EDM-G-IMX8M-PLUS SOM - Update imx95-scmi firmware bindings to allow linux,code for protocol@81 - Add i.MX53 compatible for fsl,imx-iomuxc-gpr bindings - Update fsl,imx7ulp-smc1 bindings to allow clocks and clock-names * tag 'imx-bindings-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: arm: fsl: add TQMa91xx SOM series dt-bindings: fsl: fsl,imx7ulp-smc1: Allow clocks and clock-names dt-bindings: arm: fsl: Add bindings for SolidRun i.MX8MP SoM and boards dt-bindings: soc: fsl,imx-iomuxc-gpr: Document i.MX53 dt-bindings: arm: fsl: Add EDM-G-IMX8M-PLUS SOM and WB-EDM-G carrier board dt-bindings: firmware: imx95-scmi: Allow linux,code for protocol@81 dt-bindings: arm: fsl: add i.MX91 11x11 evk board dt-bindings: arm: fsl: add TQMLS1012AL dt-bindings: arm: fsl: add i.MX8ULP EVK9 board dt-bindings: arm: imx8mp: Add Ultratronik Ultra-MACH SBC Link: https://lore.kernel.org/r/20250915132535.253859-1-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 8193017c718201ffcc9a3cb6f379ee07182a7096 Merge: bb6550192575c0 8b3ce9541129c9 Author: Arnd Bergmann Date: Mon Sep 15 16:32:04 2025 +0200 Merge tag 'imx-defconfig-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/defconfig i.MX defconfig changes for 6.18: - Enable i.MX91 pinctrl driver and Marvell WiFi-Ex USB driver in arm64 defconfig * tag 'imx-defconfig-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: defconfig: Enable Marvell WiFi-Ex USB driver arm64: defconfig: enable i.MX91 pinctrl Link: https://lore.kernel.org/r/20250915132535.253859-4-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit dc16fd9dd0b13736e84a60c349eb4c9193005089 Merge: bc43efa13708c0 38b22cde38aba6 Author: Arnd Bergmann Date: Mon Sep 15 16:23:40 2025 +0200 Merge tag 'microchip-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/drivers Microchip ARM64 SoC updates for v6.18: This update includes: - basic infrastructure support for Microchip LAN969x SoC - SoC ARCH symbols (existing SparX-5, new LAN969x) under the ARCH_MICROCHIP hidden symbol (already in use by AT91 in 6.17) - addition of that new symbol for drivers that are shared by Microchip SoC-s now and in the future * tag 'microchip-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: crypto: atmel-aes: make it selectable for ARCH_MICROCHIP char: hw_random: atmel: make it selectable for ARCH_MICROCHIP i2c: at91: make it selectable for ARCH_MICROCHIP spi: atmel: make it selectable for ARCH_MICROCHIP tty: serial: atmel: make it selectable for ARCH_MICROCHIP mfd: at91-usart: Make it selectable for ARCH_MICROCHIP arm64: lan969x: Add support for Microchip LAN969x SoC arm64: Add config for Microchip SoC platforms Link: https://lore.kernel.org/r/20250915123548.13722-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit d5fe2fec6c40dda03df8cc9b4a97de0b7e39f984 Author: Shubhrajyoti Datta Date: Mon Sep 8 17:26:49 2025 +0530 EDAC: Add a driver for the AMD Versal NET DDR controller Add a driver for the AMD Versal NET DDR memory controller which supports single bit error correction, double bit error detection and other system errors from various IP subsystems (e.g., RPU, NOCs, HNICX, PL). The driver listens for notifications from the NMC (Network management controller) using RPMsg (Remote Processor Messaging). The channel used for communicating to RPMsg is named "error_edac". Upon receipt of a notification, the driver sends a RAS event trace. [ bp: - Fixup title - Rewrite commit message - Fixup Kconfig text - Zap unused defines and align them - Simplify rpmsg_cb() considerably - Drop silly double-brackets in conditionals - Use proper void * type in mcdi_request() - Do not clear chinfo in rpmsg_probe() unnecessarily - Fix indentation - Do a proper err unwind path in init_versalnet() - Redo the error unwind path in mc_probe() properly - Fix the ordering in mc_remove() ] Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250908115649.22903-1-shubhrajyoti.datta@amd.com Link: https://lore.kernel.org/r/20250703173105.GLaGa-WQCESDNsqygm@fat_crate.local commit bc43efa13708c07514df296df1c5afbfff153f07 Merge: b7c0fe16545113 2f86054cc1a679 Author: Arnd Bergmann Date: Mon Sep 15 16:21:57 2025 +0200 Merge tag 'scmi-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates/fixes for v6.18 These SCMI changes bring a mix of improvements, fixes, and cleanups: 1. Device Tree bindings - allow multiple SCMI instances by suffixing node names (Nikunj Kela). 2. Code hardening - constify both scmi_{transport,voltage_proto}_ops so they reside in read-only memory (Christophe JAILLET). 3. VirtIO transport initialization - set DRIVER_OK before SCMI probing to prevent potential stalls; while recent rework removes the practical risk, this ensures correctness (Junnan Wu). 4. Quirk handling - fix a critical bug by preventing writes to string constants, avoiding faults in read-only memory (Johan Hovold). 5. i.MX SCMI MISC protocol - extend support to discover board info, retrieve configuration and build data, and document the new MISC_BOARD_INFO command; all handled gracefully if unsupported (Peng Fan). 6. Logging cleanup - simplify device tree node name logging by using the %pOF format to print full paths (Krzysztof Kozlowski). * tag 'scmi-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Simplify printks with pOF format firmware: arm_scmi: imx: Discover MISC board info from the system manager firmware: arm_scmi: imx: Support retrieving MISC protocol configuration info firmware: arm_scmi: imx: Discover MISC build info from the system manager firmware: arm_scmi: imx: Add documentation for MISC_BOARD_INFO firmware: arm_scmi: quirk: Prevent writes to string constants firmware: arm_scmi: Fix function name typo in scmi_perf_proto_ops struct firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver firmware: arm_scmi: Constify struct scmi_transport_ops firmware: arm_scmi: Constify struct scmi_voltage_proto_ops dt-bindings: firmware: arm,scmi: Allow multiple instances Link: https://lore.kernel.org/r/20250915101341.2987516-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 8d978222e87c5ea50f912141b18421882f89492a Author: Shubhrajyoti Datta Date: Mon Sep 8 17:26:48 2025 +0530 dt-bindings: memory-controllers: Add support for Versal NET EDAC Add device tree bindings for AMD Versal NET EDAC for DDR controller. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250908115649.22903-1-shubhrajyoti.datta@amd.com commit b7c0fe165451139df15f194e1a10818e17ac75b1 Merge: 7b1349bd47a2fc b9c01adedf38c6 Author: Arnd Bergmann Date: Mon Sep 15 16:21:00 2025 +0200 Merge tag 'tegra-for-6.18-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v6.18-rc1 NVMEM cells are added for Tegra114. These contain calibration data for sensors and USB. * tag 'tegra-for-6.18-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Link: https://lore.kernel.org/r/20250914063927.89981-2-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 36e74c95638296b1f272d9d011d435ce62d8f11c Author: Shubhrajyoti Datta Date: Mon Sep 8 17:26:47 2025 +0530 RAS: Export log_non_standard_event() to drivers The function log_non_standard_event() is responsible for logging platform-specific or vendor-defined RAS (Reliability, Availability, and Serviceability) events. Currently, this function is only available within the RAS subsystem, preventing external modules from leveraging its capabilities. Export it to drivers to log non-standard RAS events via EDAC. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250908115649.22903-1-shubhrajyoti.datta@amd.com commit 7b1349bd47a2fcc1c838986d00fcf76bd7428dc2 Merge: 68454c6fc14948 1da4cbefed4a2e Author: Arnd Bergmann Date: Mon Sep 15 16:18:34 2025 +0200 Merge tag 'samsung-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v6.18 1. Google GS101: Enable CPU Idle, which needs programming C2 idle hints via ACPM firmware (Alive Clock and Power Manager). The patch introducing this depends on 'local-timer-stop' Devicetree property, which was merged in v6.17. Fix handling error codes in ACPM firmware driver when talking to PMIC. 2. Exynos2200: Add dedicated compatible for serial engines (USI). * tag 'samsung-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: exynos-acpm: fix PMIC returned errno dt-bindings: soc: samsung: usi: add samsung,exynos2200-usi compatible soc: samsung: exynos-pmu: Enable CPU Idle for gs101 Link: https://lore.kernel.org/r/20250912135448.203678-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 8b0d03129b6165bbf8c9494897489c6da6fadd58 Author: Shubhrajyoti Datta Date: Mon Sep 8 17:26:46 2025 +0530 cdx: Export Symbols for MCDI RPC and Initialization The cdx_mcdi_init(), cdx_mcdi_process_cmd(), and cdx_mcdi_rpc() functions are needed by the VersalNET EDAC module that interact with the MCDI (Management Controller Direct Interface) framework. These functions facilitate communication between different hardware components by enabling command execution and status management. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/20250908115649.22903-1-shubhrajyoti.datta@amd.com commit 68454c6fc1494894e0972027b86f530705a973f3 Merge: 820429d53bd7c8 5284d0b09d1bdc Author: Arnd Bergmann Date: Mon Sep 15 16:17:21 2025 +0200 Merge tag 'renesas-drivers-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.18 (take two) - Identify the Renesas R-Car X5H (R8A78000) SoC. * tag 'renesas-drivers-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: Identify R-Car X5H Link: https://lore.kernel.org/r/cover.1757669914.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 820429d53bd7c8b19beb5686540f372be2a18eea Merge: 15550d05c50a47 dbc2868b7b57fb Author: Arnd Bergmann Date: Mon Sep 15 16:05:04 2025 +0200 Merge tag 'tee-prot-dma-buf-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE protected DMA-bufs for v6.18 - Allocates protected DMA-bufs from a DMA-heap instantiated from the TEE subsystem. - The DMA-heap uses a protected memory pool provided by the backend TEE driver, allowing it to choose how to allocate the protected physical memory. - Three use-cases (Secure Video Playback, Trusted UI, and Secure Video Recording) have been identified so far to serve as examples of what can be expected. - The use-cases have predefined DMA-heap names, "protected,secure-video", "protected,trusted-ui", and "protected,secure-video-record". The backend driver registers protected memory pools for the use-cases it supports. * tag 'tee-prot-dma-buf-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: optee: smc abi: dynamic protected memory allocation optee: FF-A: dynamic protected memory allocation optee: support protected memory allocation tee: add tee_shm_alloc_dma_mem() tee: new ioctl to a register tee_shm from a dmabuf file descriptor tee: refactor params_from_user() tee: implement protected DMA-heap dma-buf: dma-heap: export declared functions optee: sync secure world ABI headers Link: https://lore.kernel.org/r/20250912101752.GA1453408@rayden Signed-off-by: Arnd Bergmann commit 40522db59b5bd36dd63d215bfb7fa83d64bce05a Author: Vlastimil Babka Date: Mon Sep 15 15:55:11 2025 +0200 slab: move validate_slab_ptr() from alloc_consistency_checks() to its caller In alloc_debug_processing() we can call validate_slab_ptr() upfront and then don't need to recheck when alloc_consistency_checks() fails for other reasons. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 6f6fcd463410445101fae04335f617f40e6eca8a Author: Vlastimil Babka Date: Mon Sep 15 15:55:10 2025 +0200 slab: move validate_slab_ptr() from check_slab() to its callers We will want to do the validation earlier in some callers or remove it completely, so extract it from check_slab() first. No functional change. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 86169b00f89633e255048feb5dde438dd3522fd4 Author: Vlastimil Babka Date: Mon Sep 15 15:55:09 2025 +0200 slab: wrap debug slab validation in validate_slab_ptr() This will make it clear where we currently cast struct slab to folio only to check the slab type, and allow to change the implementation later with memdesc conversion. For now use a struct page based implementation instead of struct folio to be compatible with further upcoming changes. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f4930de03dcf4a3f2515546f5b3c04bac016685d Author: Matthew Wilcox (Oracle) Date: Mon Sep 15 15:55:08 2025 +0200 slab: Remove dead code in free_consistency_checks() We already know that slab is a valid slab as that's checked by the caller. In the future, we won't be able to get to a slab pointer from a non-slab page. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f99b3917789d83ea89b24b722d784956f8289f45 Author: Mateusz Guzik Date: Mon Sep 15 14:57:29 2025 +0200 fs: rename generic_delete_inode() and generic_drop_inode() generic_delete_inode() is rather misleading for what the routine is doing. inode_just_drop() should be much clearer. The new naming is inconsistent with generic_drop_inode(), so rename that one as well with inode_ as the suffix. No functional changes. Signed-off-by: Mateusz Guzik Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 15550d05c50a47cd8a1b257b63403057f3f51f7f Merge: a97c004c9b8fbf dfb2a4f76ff7f6 Author: Arnd Bergmann Date: Mon Sep 15 16:01:35 2025 +0200 Merge tag 'tee-sha1-lib-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers Use SHA-1 library instead of crypto_shash * tag 'tee-sha1-lib-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: Use SHA-1 library instead of crypto_shash Link: https://lore.kernel.org/r/20250912091611.GA1442659@rayden Signed-off-by: Arnd Bergmann commit a97c004c9b8fbf386c6e19f98e594ddeb8b19e50 Merge: d88449249152a2 1faa0d62a19bb8 Author: Arnd Bergmann Date: Mon Sep 15 15:58:03 2025 +0200 Merge tag 'tee-improve-sysfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers Use sysfs_emit() for sysfs buffers to userspace * tag 'tee-improve-sysfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: drivers: tee: improve sysfs interface by using sysfs_emit() Link: https://lore.kernel.org/r/20250912091000.GA1441709@rayden Signed-off-by: Arnd Bergmann commit d88449249152a27e12728168478785bfbd67bb88 Merge: ecdca1af962b36 07188450191da0 Author: Arnd Bergmann Date: Mon Sep 15 15:57:17 2025 +0200 Merge tag 'hisi-drivers-for-6.18' of https://github.com/hisilicon/linux-hisi into soc/drivers HiSilicon driver updates for v6.18 - Fix a spelling mistake in the HCCS driver * tag 'hisi-drivers-for-6.18' of https://github.com/hisilicon/linux-hisi: soc: hisilicon: kunpeng_hccs: Fix spelling mistake "decrese" -> "decrease" Link: https://lore.kernel.org/r/68C376C4.2030808@hisilicon.com Signed-off-by: Arnd Bergmann commit ecdca1af962b366d27067cd61da2f37baf418d20 Merge: b609d742172533 3cc9a8cadaf66e Author: Arnd Bergmann Date: Mon Sep 15 15:52:53 2025 +0200 Merge tag 'qcom-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.18 Allowlist the uefisec application, to provide UEFI variable access on Dell Inspiron 7441 and Latitude 7455, the Hamoa EVK, and the Lenovo Thinkbook 16. Disable tzmem on the SC7180 platform, as this causes problems with rmtfs. Clean up unused, lingering, parameters in the MDT loader API. Unconditinally clear TCS trigger bit, to avoid false completion IRQs in the RPMh/RSC driver. Fix endianess issue in SMEM driver. Add pd-mapper support for SM8750. * tag 'qcom-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: firmware: qcom: tzmem: disable sc7180 platform soc: qcom: use devm_kcalloc() for array space allocation dt-bindings: firmware: qcom,scm: Add MSM8937 firmware: qcom: scm: Allow QSEECOM on Dell Inspiron 7441 / Latitude 7455 firmware: qcom: scm: Allow QSEECOM on Lenovo Thinkbook 16 soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS soc: qcom: pd-mapper: Add SM8750 compatible soc: qcom: icc-bwmon: Fix handling dev_pm_opp_find_bw_*() errors soc: remove unneeded 'fast_io' parameter in regmap_config soc: qcom: smem: Fix endian-unaware access of num_entries dt-bindings: soc: qcom,rpmh-rsc: Remove double colon from description dt-bindings: sram: qcom,imem: Document IPQ5424 compatible firmware: qcom: scm: Allow QSEECOM on HAMOA-IOT-EVK soc: qcom: mdt_loader: Remove unused parameter soc: qcom: mdt_loader: Remove pas id parameter soc: qcom: mdt_loader: Remove unused parameter firmware: qcom: scm: preserve assign_mem() error return value Link: https://lore.kernel.org/r/20250911215017.3020481-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 54fd6bd42e7bd351802ff1d193a2e33e4bfb1836 Author: Shubhrajyoti Datta Date: Mon Sep 8 17:26:45 2025 +0530 cdx: Split mcdi.h and reorganize headers Move bitfield.h from the CDX controller directory to include/linux/cdx to make them accessible to other drivers. As part of this refactoring, split mcdi.h into two headers: - mcdi.h: retains interface-level declarations - mcdid.h: contains internal definitions and macros This is in preparation for VersalNET EDAC driver that relies on it. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/20250908115649.22903-1-shubhrajyoti.datta@amd.com commit b609d742172533ef7228971699319e5df1bf8eac Merge: a4bd33f4a3d9b6 41c9570e417836 Author: Arnd Bergmann Date: Mon Sep 15 15:51:43 2025 +0200 Merge tag 'arm-soc/for-6.18/drivers' of https://github.com/Broadcom/stblinux into soc/drivers This pull request contains Broadcom SoC drivers updates for 6.18: - Andrea adds the missing MIPI DSI clock defines for the RP1 and then continues to implement the remaining clocks for the RP1 chip (ADC, I2S, Audio in/out, DMA, MIPI, PWM, SDIO, UART, encoder) - Akhilesh fixes a spelling typo in the bcm47xx_sprom driver - Brian converts the RP1 clock driver to use the new determine_rate() API * tag 'arm-soc/for-6.18/drivers' of https://github.com/Broadcom/stblinux: clk: rp1: convert from round_rate() to determine_rate() drivers: firmware: bcm47xx_sprom: fix spelling clk: rp1: Implement remaining clock tree dt-bindings: clock: rp1: Add missing MIPI DSI defines Link: https://lore.kernel.org/r/20250910171910.666401-4-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit a4bd33f4a3d9b623a9b8ae9f613b73b1e7f90c58 Merge: cc309f979394b5 1527cd3b89f0db Author: Arnd Bergmann Date: Mon Sep 15 15:50:32 2025 +0200 Merge tag 'reset-for-v6.18' of https://git.pengutronix.de/git/pza/linux into soc/drivers Reset controller updates for v6.18 * Fix the reset tree git repository link in MAINTAINERS. * Add support for bcm63xx ephy reset control to reset-bcm6345. * Add support for the AST2700 reset controller, as an auxiliary device driver to the corresponding clock controller driver. * Add support for the remaining TH1520 VO subsystem reset controls to reset-th1520. * Drop unnecessary .fast_io setting from MMIO regmap_configs. * tag 'reset-for-v6.18' of https://git.pengutronix.de/git/pza/linux: reset: remove unneeded 'fast_io' parameter in regmap_config reset: th1520: add resets for display pipeline dt-bindings: reset: thead,th1520-reset: add more VOSYS resets reset: aspeed: register AST2700 reset auxiliary bus device reset: bcm6345: add support for bcm63xx ephy control register dt-bindings: reset: add compatible for bcm63xx ephy control MAINTAINERS: Use https:// protocol for Reset Controller Framework tree Link: https://lore.kernel.org/r/20250904154135.2385905-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit bb6550192575c08480dc6383fd75ead1e40966b7 Merge: 92be260308d886 2182fe932dc83e Author: Arnd Bergmann Date: Mon Sep 15 15:48:37 2025 +0200 Merge tag 'arm-soc/for-6.18/defconfig-arm64' of https://github.com/Broadcom/stblinux into soc/defconfig This pull request contains ARM64 defconfig changes for Broadcom SoCs, please pull the following: - Andrea enables the RP1 pinctrl driver which is necessary for the Raspberry Pi 5 systems * tag 'arm-soc/for-6.18/defconfig-arm64' of https://github.com/Broadcom/stblinux: arm64: defconfig: Enable BCM2712 on-chip pin controller driver Link: https://lore.kernel.org/r/20250910171910.666401-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 92be260308d8861f3a61fe592b9f23c5bc917af3 Merge: 70757ee5d2bc6d eca86a61aedaa4 Author: Arnd Bergmann Date: Mon Sep 15 15:47:55 2025 +0200 Merge tag 'samsung-defconfig-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/defconfig Samsung SoC defconfig changes for v6.18 1. Cleanup MTD_NAND_S3C2410, being removed from the kernel via separate tree. 2. Enable Axis ARTPEC SoC in arm64 defconfig - new Samsung subarch. * tag 'samsung-defconfig-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: defconfig: Enable Axis ARTPEC SoC ARM: s3c6400_defconfig: Drop MTD_NAND_S3C2410 Link: https://lore.kernel.org/r/20250909180127.99783-3-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 0ea453542998ff3833a8aad5e61b645dce409a7b Merge: 3cc9a8cadaf66e 4b700098c0fc4a Author: Bjorn Andersson Date: Mon Sep 15 08:43:03 2025 -0500 Merge branch '20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-2-17f07a942b8d@oss.qualcomm.com' into drivers-for-6.18 Merge the addition of support for object invocation into the SCM driver though a topic branch, to enable sharing this with TEE subsystem. commit 4b700098c0fc4a76c5c1e54465c8f35e13755294 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:41 2025 -0700 firmware: qcom: scm: add support for object invocation Qualcomm TEE (QTEE) hosts Trusted Applications (TAs) and services in the secure world, accessed via objects. A QTEE client can invoke these objects to request services. Similarly, QTEE can request services from the nonsecure world using objects exported to the secure world. Add low-level primitives to facilitate the invocation of objects hosted in QTEE, as well as those hosted in the nonsecure world. If support for object invocation is available, the qcom_scm allocates a dedicated child platform device. The driver for this device communicates with QTEE using low-level primitives. Tested-by: Neil Armstrong Tested-by: Harshal Dev Signed-off-by: Amirreza Zarrabi Link: https://lore.kernel.org/r/20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-2-17f07a942b8d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8aa1e3a6f0ffbcfdf3bd7d87feb9090f96c54bc4 Author: Amirreza Zarrabi Date: Thu Sep 11 21:07:40 2025 -0700 firmware: qcom: tzmem: export shm_bridge create/delete Anyone with access to contiguous physical memory should be able to share memory with QTEE using shm_bridge. Tested-by: Neil Armstrong Tested-by: Harshal Dev Reviewed-by: Kuldeep Singh Signed-off-by: Amirreza Zarrabi Link: https://lore.kernel.org/r/20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-1-17f07a942b8d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 10588787c8037a7bf459bf8a5ebc131944b9b005 Merge: d75f5aded453a0 3708a165a98c23 Author: Arnd Bergmann Date: Mon Sep 15 15:39:03 2025 +0200 Merge tag 'aspeed-6.18-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt Further ASPEED devicetree updates for v6.18 New platforms: - Meta Clemente Clemente is a compute-tray platform using an AST2600 SoC Updated platforms: - Harma (Meta): Hot-swap controller, power monitoring, GPIO names There are also some devicetree cleanups from Rob and Krzysztof that touch a variety of platforms and the DTSIs. These lead to fewer warnings emitted for the ASPEED devicetrees. * tag 'aspeed-6.18-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: Drop syscon "reg-io-width" properties ARM: dts: aspeed: Drop "sdhci" compatibles ARM: dts: aspeed: Fix/add I2C device vendor prefixes ARM: dts: aspeed: Minor whitespace cleanup ARM: dts: aspeed: clemente: add Meta Clemente BMC ARM: dts: aspeed: Add NCSI3 and NCSI4 pinctrl nodes dt-bindings: arm: aspeed: add Meta Clemente board ARM: dts: aspeed: harma: add mp5990 ARM: dts: aspeed: harma: revise gpio name ARM: dts: aspeed: harma: add power monitor support Link: https://lore.kernel.org/r/5793039afcedeb28179a3c9909631d8251abc73e.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit d75f5aded453a005c8c0f79e0b1221a5629e73fe Merge: b4952e54c3fde1 e1899da95f5924 Author: Arnd Bergmann Date: Mon Sep 15 15:38:17 2025 +0200 Merge tag 'tegra-for-6.18-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v6.18-rc1 Add I2C nodes for Tegra264. These are currently unused but are needed for subsequent audio patches, as well as various monitoring and other auxiliary chips. * tag 'tegra-for-6.18-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Add I2C nodes for Tegra264 Link: https://lore.kernel.org/r/20250914063927.89981-4-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit b4952e54c3fde100bff2a012c670bba8363d1e5f Merge: 431ab7953c234c 73e23d3bd72208 Author: Arnd Bergmann Date: Mon Sep 15 15:37:38 2025 +0200 Merge tag 'tegra-for-6.18-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v6.18-rc1 Add DFLL support on Tegra114, fix some issues on Transformer and P880 devices and add support for the ASUS Eee Pad Slider SL101. * tag 'tegra-for-6.18-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: add support for ASUS Eee Pad Slider SL101 ARM: tegra: transformer-20: fix audio-codec interrupt ARM: tegra: transformer-20: add missing magnetometer interrupt ARM: tegra: Add DFLL clock support for Tegra114 ARM: tegra: p880: set correct touchscreen clipping Link: https://lore.kernel.org/r/20250914063927.89981-3-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 431ab7953c234cef6c9074761cd0e6482a26a761 Merge: aa14c3aff06bf5 04f27a0fda6b6b Author: Arnd Bergmann Date: Mon Sep 15 15:36:59 2025 +0200 Merge tag 'tegra-for-6.18-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v6.18-rc1 Support for the Tegra264 generation of I2C is documented as well as some older Tegra devices, such as the Xiaomi Mi Pad and the ASUS 101 devices. Contained are also some additions to existing bindings for Tegra114 and a fix for the power supply feeding VI/CSI. * tag 'tegra-for-6.18-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: arm: tegra: Add ASUS TF101G and SL101 dt-bindings: reset: Add Tegra114 CAR header dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) dt-bindings: clock: tegra30: Add IDs for CSI pad clocks dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C Link: https://lore.kernel.org/r/20250914063927.89981-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit aa14c3aff06bf5e85c46845efcee749d5b1caaa1 Merge: b4d01b6ff23379 129d617c60c910 Author: Arnd Bergmann Date: Mon Sep 15 15:36:28 2025 +0200 Merge tag 'sti-dt-for-v6.18-round2' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti into soc/dt STi dt fixes: - Remove unused stih407-clock.dtsi file * tag 'sti-dt-for-v6.18-round2' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti: ARM: dts: sti: remove dangling stih407-clock file Link: https://lore.kernel.org/r/4a710c05-aeeb-4421-b3a1-5bfb8230d51d@foss.st.com Signed-off-by: Arnd Bergmann commit b4d01b6ff2337976b6eb007469ad1e307915ad58 Merge: e3fa766a4de900 1cc3d6c8640e4a Author: Arnd Bergmann Date: Mon Sep 15 15:35:38 2025 +0200 Merge tag 'mvebu-dt64-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 6.18 (part 1) Improve device tree correctness: - Whitespace cleanup - Add missing address-cells Add new board definition for RIPE Atlas Probe v5, based on Turris MOX (Armada 3720 SoC) * tag 'mvebu-dt64-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: cn9130-sr-som: add missing properties to emmc arm64: dts: marvell: add dts for RIPE Atlas Probe v5 dt-bindings: marvell: armada-37xx: add ripe,atlas-v5 compatible arm64: dts: marvell: armada-cp11x: Add default ICU address cells arm64: dts: marvell: armada-37xx: Add default PCI interrup controller address cells arm64: dts: marvell: Minor whitespace cleanup Link: https://lore.kernel.org/r/87frcrn1o0.fsf@BLaptop.bootlin.com Signed-off-by: Arnd Bergmann commit e3fa766a4de90015246eafc50c144e58b087ab0c Merge: 55f624c71d0194 0e81960419ad18 Author: Arnd Bergmann Date: Mon Sep 15 15:34:48 2025 +0200 Merge tag 'zynqmp-dt-for-6.18' of https://github.com/Xilinx/linux-xlnx into soc/dt arm64: Xilinx DT changes for 6.18 - Fix some issues reported by dtschema - Properly mark EMMC devices - Update PSCI version - Update DP description and enable it on boards - Disable DEBUG IPs by default SOM: - Describe usb hubs - Fix PWM polarity issue - Add support for k24, kr260 and kd240 Versal NET: - Describe CPU cache layout - Fix RTC calibration value * tag 'zynqmp-dt-for-6.18' of https://github.com/Xilinx/linux-xlnx: arm64: versal-net: Describe L1/L2/L3/LLC caches arm64: zynqmp: Enable DP in kr260/kv260 revA arm64: zynqmp: Describe ethernet controllers via aliases on SOM arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 arm64: zynqmp: Disable coresight by default arm64: zynqmp: Add support for kd240 board arm64: zynqmp: Add support for kr260 board dt-bindings: soc: xilinx: Add support for K24, KR260 and KD240 CCs arm64: zynqmp: Enable PSCI 1.0 arm64: zynqmp: Enable DP for zcu100, zcu102, zcu104, zcu111 arm64: zynqmp: Introduce DP port labels arm64: zynqmp: Fix pwm-fan polarity arm64: zynqmp: Update the usb5744 hub node as per binding arm64: zynqmp: Add cap-mmc-hw-reset and no-sd, no-sdio property to eMMC arm64: zynqmp: Remove undocumented arasan,has-mdma property arm64: zynqmp: Use generic spi@ name in zcu111-revA arm64: versal-net: Update rtc calibration value Link: https://lore.kernel.org/r/CAHTX3dK6if9f+-DW5ZEnfSO4=K_Zje-WH-fwysTY77farsSS9g@mail.gmail.com Signed-off-by: Arnd Bergmann commit 55f624c71d0194aaec7714c74d950ca1a9f58f0f Merge: 499a04f3283f89 5bf682d9747277 Author: Arnd Bergmann Date: Mon Sep 15 15:30:00 2025 +0200 Merge tag 'renesas-dts-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.18 (take two) - Add pin control and I2C support for the RZ/N2H SoC and its evaluation board, - Add LED, EEPROM, eMMC, SD card, watchdog, and USB2.0 support for the RZ/T2H and RZ/N2H SoCs and their evaluation boards, - Add I3C support for the RZ/V2H and RZ/V2N SoCs, - Add IMX219 and IMX462 camera overlay support for the Sparrow Hawk board, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (26 commits) arm64: dts: renesas: sparrow-hawk-fan-pwm: Rework hwmon comment arm64: dts: renesas: sparrow-hawk: Add overlay for IMX462 on J2 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX462 on J1 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX219 on J2 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX219 on J1 arm64: dts: renesas: rcar: Rename dsi-encoder to dsi arm64: dts: renesas: r9a09g056: Add I3C node arm64: dts: renesas: r9a09g057: Add I3C node arm64: dts: renesas: rzt2h-n2h-evk: Enable USB2.0 support arm64: dts: renesas: r9a09g047e57-smarc: Use Schmitt input for NMI function arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio key's pin control node arm64: dts: renesas: r9a09g047: Enable Tx coe support arm64: dts: renesas: r9a09g087: Add USB2.0 support arm64: dts: renesas: r9a09g077: Add USB2.0 support arm64: dts: renesas: rzt2h-n2h-evk-common: Enable WDT2 arm64: dts: renesas: r9a09g087: Add WDT nodes arm64: dts: renesas: r9a09g077: Add WDT nodes arm64: dts: renesas: rzt2h-rzn2h-evk: Enable SD card slot arm64: dts: renesas: rzt2h-rzn2h-evk: Enable MicroSD card slot arm64: dts: renesas: rzt2h-rzn2h-evk: Enable eMMC ... Link: https://lore.kernel.org/r/cover.1757669917.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 499a04f3283f898b91055d06ecdef0c96c7eb95a Merge: a3ef7cad8b533a 1ed2786e9ef8f1 Author: Arnd Bergmann Date: Mon Sep 15 15:29:14 2025 +0200 Merge tag 'renesas-dt-bindings-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DT binding updates for v6.18 - Document the R-Car X5H (R8A78000) SoC and the Ironhide board. * tag 'renesas-dt-bindings-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Document R-Car X5H Ironhide Link: https://lore.kernel.org/r/cover.1757669916.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit a3ef7cad8b533ae82b1c86917defe280750a509e Merge: cad0261fd0408b be6f43c64ca0f7 Author: Arnd Bergmann Date: Mon Sep 15 15:25:50 2025 +0200 Merge tag 'qcom-arm64-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v6.18 Add support for Lenovo Thinkbook 16, Dell Inspiron 7441, Dell Latitude 7455, Samsung Galaxy S20, Billion Capture+, the Monaco EVK and the Lemans EVK. The SDM845 Cheza development boards are removed, as they are not longer in use. For IPQ5018 crypto, tsens, rng, SPI NAND support is dded, the two MDIO buses are added and the internal GE PHY. IPQ5424 gets CPU frequency scaling and a missing UART. The SA8775P SoC is remaned Lemans, to reduce confusion about the chip name. The IoT memory map introduced and made the default, GDSP FastRPC and GPR nodes are added. Touch keys are enabled on the BQ Aquaris X5 Plus. On QCM2290 the video accelerator is enabled, so is HS timing modes for eMMC. The QCS615 platform is renamed SM6150. CPU frequency scaling and the WiFi PCIe controller is introduced. On Monaco (QCS8300) scaling of L3 and DDR bandwidth is introduced. So is eMMC support and generic packer router (GPR). On the Monaco Ride board, the eMMC controller is enabled. On QRB220 RB1, the venus video accelerator is enabled. For SC7280 the first PCIe controller and PHY is introduced. SoundWire, LPASS, and USB offload support is added, the codecs and sound card is then described on the QCM6490 IDP. The MDSS core reset is introduced, to clear bootloader configuration on SC7280-based devices. On Fairphone5, USB audio offload is added. AudioReach support on SC7280 (QCS6490) is introduced and used to enable sound on the RB3Gen2 board. The video clock controller is added to SC8180X. On SC8280XP the GPI DMA controllers are described and enabled. Display and GPU is enabled for the Fairphone 3 and charging is enabled on the Google Pixel 3a. The routing for the second USB connector on the Lenovo Yoga C630 is described. On SM6150 ADSP and CDSP FastRPC is introduced, as is the video encoder/decoder (venus). On SM6350 RPMh statistics is enabled, the USB audio offload DAI is introduced and on Fairphone4 the USB audio offload support is enabled. On SM8450 QRD the PMIC GLINK is described, to add USB Type-C and battery functionality. On SM8650 ACD levels are added for the GPU. Camera and video clock controllers power-domains are updated on SM8450, SM8550, and SM8650, now that support for multiple power-domains is accepted. SM8750 gains bwmon support for dynamic bus scaling, and PCIe nodes. The DWC3 glue and core nodes are flattened on a number of platforms. USB Type-C DisplayPort support is extended to 4 lanes (from 2) on a variety of platforms, now that the QMP PHY driver supports this. Platform specific RPMh PD constants are replaced with generic constants wherever possible. On X Elite the PM8010 is disabled by default, removing boot splats on a variety of boards without this PMIC, the video clock controller is added. For the X Elite and X Plus CRDs, and the Lenovo Thinkpad T14s, HBR3 is marked as valid for the external DisplayPorts. The fingerprint reader found on the CRDs are enabled. The PCIe x8 slot on the QCP is enabled. The two Microsoft Surface Laptop 7 gains WiFi and Bluetooth support. GPU support is added for the X Plus SoC. * tag 'qcom-arm64-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (208 commits) arm64: dts: qcom: x1e80100: Update GPU OPP table arm64: dts: qcom: sm8650: Drop redundant status from PMK8550 RTC arm64: dts: qcom: add initial support for Samsung Galaxy S20 dt-bindings: arm: qcom: document x1q board binding arm64: dts: qcom: sm8250-samsung-r8q: Move common parts to dtsi arm64: dts: qcom: lemans-evk: Add sound card arm64: dts: qcom: lemans: Add gpr node arm64: dts: qcom: x1e78100-t14s-oled: Add eDP panel arm64: dts: qcom: qcs615-ride: enable venus node to initialize video codec arm64: dts: qcom: sm6150: add venus node to devicetree arm64: dts: qcom: x1e80100-romulus: Add WCN7850 Wi-Fi/BT arm64: dts: qcom: qrb2210-rb1: Enable Venus arm64: dts: qcom: qcm2290: Add Venus video node arm64: dts: qcom: monaco-evk: Add sound card arm64: dts: qcom: qcs8300: Add gpr node arm64: dts: qcom: qcs8300: Add Monaco EVK board dt-bindings: arm: qcom: Add Monaco EVK support arm64: dts: qcom: qcm6490-idp: Add sound card arm64: dts: qcom: qcm6490-idp: Add WSA8830 speakers and WCD9370 headset codec arm64: dts: qcom: qcs6490-rb3gen2: Add sound card ... Link: https://lore.kernel.org/r/20250911233600.3033675-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit cad0261fd0408b2e47636e3d4869d73b6f96ca90 Merge: 4c4457342a12d7 ba1045c76be299 Author: Arnd Bergmann Date: Mon Sep 15 15:24:04 2025 +0200 Merge tag 'qcom-arm32-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v6.18 Bring a few updates to the MSM8960 platform and add support for the Sony Xperia SP. Touch keys support is added to the Samsung Galaxy Grand 2. A number of DeviceTree cleanups. * tag 'qcom-arm32-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: Use GIC_SPI for interrupt-map for readability ARM: dts: qcom: sdx55: Add default GIC address cells ARM: dts: qcom: ipq8064: Add default GIC address cells ARM: dts: qcom: apq8064: Add default GIC address cells ARM: dts: qcom: ipq4019: Add default GIC address cells ARM: dts: qcom: apq8064-mako: Minor whitespace cleanup ARM: dts: qcom: msm8226-samsung-ms013g: Add touch keys ARM: dts: qcom: msm8974-samsung-hlte: Add touchkey support ARM: dts: qcom: pm8921: add vibrator device node ARM: dts: qcom: add device tree for Sony Xperia SP dt-bindings: arm: qcom: add Sony Xperia SP ARM: dts: qcom: msm8960: disable gsbi1 and gsbi5 nodes in msm8960 dtsi ARM: dts: qcom: msm8960: add gsbi8 and its serial configuration ARM: dts: qcom: msm8960: add sdcc3 pinctrl states Link: https://lore.kernel.org/r/20250911220940.3023575-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 4c4457342a12d7b971481de9cbf11b3ed4774b80 Merge: 58760bd7219d9d d2dab63098bde9 Author: Arnd Bergmann Date: Mon Sep 15 15:21:55 2025 +0200 Merge tag 'lpc32xx-dt-for-6.18' of https://github.com/vzapolskiy/linux-lpc32xx into soc/dt ARM: nxp: lpc: device tree updates for v6.18 This pull request contains device tree changes for ARM NXP LPC32xx and ARM NXP LPC18xx/LPC43xx for v6.18, please pull the following: - Frank fixes a multitude of device tree checker warnings reported for NXP LPC18xx/LPC43xx powered boards, - Vladimir fixes a number of compile time warnings issued by a dt checker for NXP LPC32xx powered boards, - Vladimir replaces Roland as a maintainer of NXP LPC32xx platform device trees, Roland is inactive for more than 10 years. * tag 'lpc32xx-dt-for-6.18' of https://github.com/vzapolskiy/linux-lpc32xx: ARM: dts: lpc32xx: Correct PL080 DMA controller device node name ARM: dts: lpc32xx: Specify #dma-cells property of PL080 DMA controller ARM: dts: lpc32xx: Specify a precise version of the SD/MMC controller IP ARM: dts: lpc32xx: Correct SD/MMC controller device node name ARM: dts: lpc32xx: Correct motor PWM device tree node name ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells dt-bindings: arm: nxp: lpc: Assign myself as maintainer of NXP LPC32xx platforms ARM: dts: lpc18xx: add missed arm,num-irq-priority-bits ARM: dts: lpc18xx: add #address-cell and #szie-cell for spi flash controller ARM: dts: lpc4357-myd-lpc4357: change node name mdio0 to mdio ARM: dts: lpc: change node name 'button[0-9]' to button-[0-9]' ARM: dts: lpc4357-myd-lpc4357: add power-supply for innolux,at070tn92 ARM: dts: lpc: add cfg surfix in pinctrl child node ARM: dts: lpc: add #address-cells and #size-cells for sram node ARM: dts: lpc18xx: swap clock-names bic and cui ARM: dts: lpc4350-hitex-eval: change node name flash to flash@0 ARM: dts: lpc18xx: rename node name mmcsd to mmc ARM: dts: lpc18xx: rename node name flash-controller to spi Link: https://lore.kernel.org/r/20250911130642.41958-1-vz@mleia.com Signed-off-by: Arnd Bergmann commit 58760bd7219d9d0318720049117d27ee90c96f4f Author: Rob Herring (Arm) Date: Wed Sep 10 18:39:23 2025 -0500 arm64: dts: socionext: Drop "linux,spdif-dit" port node unit-address A single graph port node without an address (i.e. "reg") should not have a unit-address, drop it from the "linux,spdif-dit" port node. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250910233923.778992-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit 668cf076552dd820914484e10cc48600dafd7e71 Author: Rob Herring (Arm) Date: Wed Sep 10 17:30:19 2025 -0500 arm64: dts: apm: Clean-up clock bindings Clean-up a couple of clock binding related issues in the the X-Gene DTS. CPU and I2C nodes aren't clock providers and shouldn't have "#clock-cells" properties. A fixed-clock only provides 1 clock, so "#clock-cells" must be 0. The preferred node name is "clock-" as well. The "type" property is undocumented and unused, so drop it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250910223020.612244-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit 7a0e28e5b2aa25919b9f32f7ef9d1e425aefabca Author: Rob Herring (Arm) Date: Wed Sep 10 16:48:23 2025 -0500 arm64: dts: apm: Move slimpro nodes out of "simple-bus" node The slimpro nodes are not MMIO devices, so they don't belong under a "simple-bus" node. Move them to the top level. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250910214822.508317-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit 7a33f9092f1ee9c58bfbc027134ecc970f04a995 Merge: 41d773149b88dd 484199a02aca6c Author: Arnd Bergmann Date: Mon Sep 15 15:16:40 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM SoC Device Tree changes for 6.18, please pull the following: - Taishi-san adds support for the Buffalo WXR-1750DHP using a BCM4708 SoC * tag 'arm-soc/for-6.18/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: BCM5301X: Add support for Buffalo WXR-1750DHP dt-bindings: arm: bcm: Add support for Buffalo WXR-1750DHP Link: https://lore.kernel.org/r/20250910171910.666401-2-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 41d773149b88dd10b59a7df0416e62f41abfe695 Merge: 2c58d35618c87c 70bab1937e39fd Author: Arnd Bergmann Date: Mon Sep 15 15:14:59 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM64-based SoCs Device Tree updates for 6.18, please pull the following: - Krzysztof fixes a DTC warning for the ARM GIC in bcm2712.dtsi - Ivan adds the pin controller node(s), an additional GPIO controller, the second SDHCI controller node for SDIO Wi-Fi, and the UARTA for Bluetooth to the BCM2712 DTS (Raspberry Pi 5) - Stanimir adds the Ethernet DT node and enables it for the RP1 sister chip - Andrea deletes a number of redundant PCIe DT node enablement, updates a comment to describe the relationship between bcm2712 and RP1 and finally enables the USB controllers with RP1 * tag 'arm-soc/for-6.18/devicetree-arm64' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: Enable USB devicetree entries for Rpi5 arm64: dts: broadcom: rp1: Add USB nodes arm64: dts: broadcom: amend the comment about the role of BCM2712 board DTS arm64: dts: broadcom: delete redundant pcie enablement nodes arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5 arm64: dts: rp1: Add ethernet DT node dt-bindings: mmc: Add support for capabilities to Broadcom SDHCI controller arm64: dts: broadcom: bcm2712: Add UARTA controller node arm64: dts: broadcom: bcm2712: Add second SDHCI controller node arm64: dts: broadcom: bcm2712: Add one more GPIO node arm64: dts: broadcom: bcm2712: Add pin controller nodes arm64: dts: broadcom: bcm2712: Add default GIC address cells Link: https://lore.kernel.org/r/20250910171910.666401-3-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 2c58d35618c87c4d1bf2a12e7f92dfa8aead05cf Merge: 9a801e8b96b847 12a565af705542 Author: Arnd Bergmann Date: Mon Sep 15 15:12:54 2025 +0200 Merge tag 'v6.17-next-dts64' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt mt7988 (bpi r4): * enable network mt7986: * add dedicated sram node * add interrupts for RSS to ethernet mt7981: * add thermal sensor and auxadc nodes mt8395 (NIO 12L): * enable UFS * add gpio keys to the PMIC mt8195: * drop reset for PCIe device * tag 'v6.17-next-dts64' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: dt-bindings: arm: mediatek: Add grinn,genio-510-sbc dt-bindings: arm: mediatek: Add grinn,genio-700-sbc arm64: dts: mediatek: mt7988a-bpi-r4: configure switch phys and leds arm64: dts: mediatek: mt7988a-bpi-r4: add sfp cages and link to gmac arm64: dts: mediatek: mt7988a-bpi-r4: add aliases for ethernet arm64: dts: mediatek: mt7988: add switch node arm64: dts: mediatek: mt7988: add basic ethernet-nodes arm64: dts: mediatek: mt7986: add interrupts for RSS and interrupt names arm64: dts: mediatek: mt7986: add sram node arm64: dts: mediatek: add thermal sensor support on mt7981 arm64: dts: mediatek: mt8395-nio-12l: add PMIC and GPIO keys support arm64: dts: mediatek: mt8395-nio-12l: Enable UFS arm64: dts: mediatek: mt8183: Fix out of range pull values arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 Link: https://lore.kernel.org/r/46756067-ca2f-4053-b9e9-bc6e66170b21@gmail.com Signed-off-by: Arnd Bergmann commit 9a801e8b96b84727c61885d24e4363d7f589e508 Merge: b425afb3488464 d19b1773362adf Author: Arnd Bergmann Date: Mon Sep 15 15:11:37 2025 +0200 Merge tag 'samsung-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v6.18 1. Drop S3C2416 SoC from bindings, because it was removed from kernel in 2023. 2. Add Ethernet attached via SROM controller (memory bus) on SMDK5250. This wasn't tested, but code should work just like it is working on Exynos5410-based boards. * tag 'samsung-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: samsung: smdk5250: add sromc node ARM: dts: samsung: exynos5250: describe sromc bank memory map ARM: dts: samsung: exynos5410: use multiple tuples for sromc ranges dt-bindings: arm: samsung: Drop S3C2416 Link: https://lore.kernel.org/r/20250909184559.105777-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit b425afb3488464f38aa433b2d960f3839c7f4187 Merge: 942d46b4329ca8 7ee0f223cabe9b Author: Arnd Bergmann Date: Mon Sep 15 15:10:11 2025 +0200 Merge tag 'dt64-cleanup-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt Minor improvements in ARM64 DTS for v6.18 Add default address cells for interrupt controllers to fix dtc W=1 warnings on Amazon, APM, Socionext and Toshiba boards. * tag 'dt64-cleanup-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: arm64: dts: toshiba: tmpv7708: Add default GIC address cells arm64: dts: amazon: alpine-v3: Add default GIC address cells arm64: dts: amazon: alpine-v2: Add default GIC address cells arm64: dts: apm: storm: Add default GIC address cells arm64: dts: socionext: uniphier-pxs3: Add default PCI interrup controller address cells arm64: dts: socionext: uniphier-ld20: Add default PCI interrup controller address cells Link: https://lore.kernel.org/r/20250909182256.102840-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 942d46b4329ca86dc0de254a12024528859867fe Merge: 54a5a6041bfc48 ed8c952aee4183 Author: Arnd Bergmann Date: Mon Sep 15 15:08:19 2025 +0200 Merge tag 'i2c-gpio-fixes-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux into soc/dt i2c-gpio-fixes-for-6.18 We have dedictaded bindings for scl/sda nowadays. Switch away from the deprecated plain 'gpios' property. * tag 'i2c-gpio-fixes-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: ARM: dts: stm32: use recent scl/sda gpio bindings ARM: dts: cirrus: ep7211: use recent scl/sda gpio bindings Link: https://lore.kernel.org/r/aLlgGdrFEjh26knK@shikoro Signed-off-by: Arnd Bergmann commit 9685b2975972640a98f682462ea0741757c13294 Author: Andrew Davis Date: Wed Aug 13 12:03:08 2025 -0500 ARM: mach-hpe: Rework support and directory structure Having a platform need a mach-* directory should be seen as a negative, it means the platform needs special non-standard handling. ARM64 support does not allow mach-* directories at all. While we may not get to that given all the non-standard architectures we support, we should still try to get as close as we can and reduce the number of mach directories. The mach-hpe/ directory and files, provides just one "feature": having the kernel print the machine name if the DTB does not also contain a "model" string (which they always do). To reduce the number of mach-* directories let's do without that feature and remove this directory. Note, we drop the l2c_aux_mask = ~0 line, but this is safe as the fallback GENERIC_DT machine has that as the default. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250813170308.290349-1-afd@ti.com Signed-off-by: Arnd Bergmann commit 54a5a6041bfc48f0393284c267210803238f0e39 Merge: b1161065094f54 44b0a8e433aaad Author: Arnd Bergmann Date: Mon Sep 15 15:04:43 2025 +0200 Merge tag 'samsung-dt64-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.18 1. Exynos850 e850 board: Enable Ethernet. 2. Exynos990: Enable watchdog and USB, add more clock controllers. 3. Exynos2200: Switch to 32-bit address space for blocks, because all peripherals fit there. Add remaining serial engine (USI) nodes (serial, I2C). 4. New Artpec ARTPEC-8 SoC with board. That's a design from Samsung, sharing all basic blocks with other Samsung SoCs (busses, clock controllers, pin controllers, PCIe, USB) and having media/video related blocks from Axis. Only basic support is added here: few clock controllers, pin controller and UART. 5. Several cleanups. * tag 'samsung-dt64-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos990: Enable PERIC0 and PERIC1 clock controllers arm64: dts: axis: Add ARTPEC-8 Grizzly dts support arm64: dts: exynos: axis: Add initial ARTPEC-8 SoC support dt-bindings: arm: axis: Add ARTPEC-8 grizzly board arm64: dts: exynos8895: Minor whitespace cleanup dt-bindings: arm: Convert Axis board/soc bindings to json-schema arm64: dts: exynos2200: Add default GIC address cells arm64: dts: fsd: Add default GIC address cells arm64: dts: google: gs101: Add default GIC address cells arm64: dts: exynos5433: Add default GIC address cells arm64: dts: exynos2200: define all usi nodes arm64: dts: exynos2200: increase the size of all syscons arm64: dts: exynos2200: use 32-bit address space for /soc arm64: dts: exynos2200: fix typo in hsi2c23 bus pins label arm64: dts: exynos990-r8s: Enable USB arm64: dts: exynos990-c1s: Enable USB arm64: dts: exynos990-x1s-common: Enable USB arm64: dts: exynos990: Add USB nodes arm64: dts: exynos990: Enable watchdog timer arm64: dts: exynos: Add Ethernet node for E850-96 board Link: https://lore.kernel.org/r/20250909180127.99783-4-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 74792608606a525a0e0df7e8d48acd8000561389 Author: Geert Uytterhoeven Date: Mon Sep 15 09:11:05 2025 +0200 init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to prevent asking the user about this feature when configuring a kernel without initramfs support. Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") Signed-off-by: Geert Uytterhoeven Reviewed-by: Martin Wilck Reviewed-by: David Disseldorp Signed-off-by: Christian Brauner commit b1161065094f545ef7595068a647d9849e72dc44 Merge: 839bef00712dc2 9cb76813425956 Author: Arnd Bergmann Date: Mon Sep 15 15:02:06 2025 +0200 Merge tag 'socfpga_dts_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v6.18 - Add and enable gmac for Agilex5 * tag 'socfpga_dts_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: socfpga: agilex5: enable gmac2 on the Agilex5 dev kit arm64: dts: Agilex5 Add gmac nodes to DTSI for Agilex5 Link: https://lore.kernel.org/r/20250908040718.187857-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 839bef00712dc2d98842838dafa894621bfcfc13 Merge: 46cb19e52ac79d 2a91dcd5be9dde Author: Arnd Bergmann Date: Mon Sep 15 14:57:53 2025 +0200 Merge tag 'v6.18-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt HDMI-CEC and -audio on RK3288-Miqi * tag 'v6.18-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: add HDMI audio to rk3288-miqi ARM: dts: rockchip: add CEC pinctrl to rk3288-miqi Link: https://lore.kernel.org/r/12138356.VV5PYv0bhD@phil Signed-off-by: Arnd Bergmann commit 46cb19e52ac79d184e1b159ccbb2153dff1aab26 Merge: 48c7bf3ebd284b 07c53a9e970712 Author: Arnd Bergmann Date: Mon Sep 15 14:55:25 2025 +0200 Merge tag 'v6.18-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: FriendlyElec NanoPi Zero2, ArmSoM Sige1, Radxa ROCK 2A/2F, HINLINK H66K / H68K . Interesting new peripherals: I guess the most interesting one is likely the NPU on RK3588. The rocket driver has been merged into both the DRM tree as well as mainline Mesa. Other stll interesting ones are DW-Displayport on RK3588, DSI on RK3576 (missing soc pwm-support to be useful on most boards), thermal support and watchdog on RK3576. The rest peripheral additions on a number of boards (Beelink A1, Pine{phone,book}, rk3576-evb1-v10, Rock 5*, ...) * tag 'v6.18-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (46 commits) arm64: dts: rockchip: Enable DP2HDMI for ROCK 5 ITX arm64: dts: rockchip: Enable DisplayPort for rk3588s Cool Pi 4B arm64: dts: rockchip: Add DP1 for rk3588 arm64: dts: rockchip: Add DP0 for rk3588 arm64: dts: rockchip: Add FriendlyElec NanoPi Zero2 dt-bindings: arm: rockchip: Add FriendlyElec NanoPi Zero2 arm64: dts: rockchip: Add ArmSoM Sige1 dt-bindings: arm: rockchip: Add ArmSoM Sige1 arm64: dts: rockchip: Add Radxa ROCK 2A/2F dt-bindings: arm: rockchip: Add Radxa ROCK 2A/2F dt-bindings: soc: rockchip: add missing clock reference for rk3576-dcphy syscon arm64: dts: rockchip: add USB3 on Beelink A1 arm64: dts: rockchip: add SPDIF audio to Beelink A1 arm64: dts: rockchip: add IR receiver to rk3328-roc arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro arm64: dts: rockchip: Enable the NPU on NanoPi R6C/R6S arm64: dts: rockchip: enable NPU on OPI5/5B arm64: dts: rockchip: Add Bluetooth on rk3576-evb1-v10 arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10 ... Link: https://lore.kernel.org/r/5241735.C4sosBPzcN@phil Signed-off-by: Arnd Bergmann commit 48c7bf3ebd284be4d23a287712faffb450fae9b7 Merge: cea9c89d46c62b dfa743da83ab7b Author: Arnd Bergmann Date: Mon Sep 15 14:52:25 2025 +0200 Merge tag 'thead-dt-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD Devicetrees for v6.18 Add a device tree node for the IMG BXM-4-64 GPU present in the T-HEAD TH1520 SoC used by the Lichee Pi 4A board. This node enables support for the GPU using the drm/imagination driver. By adding this node, the kernel can recognize and initialize the GPU, providing graphics acceleration capabilities on the Lichee Pi 4A and other boards based on the TH1520 SoC. The display controller and HDMI output are still a work in progress. Also included is a MAINTAINERS patch that adds an entry for the T-Head SoC patchwork. Signed-off-by: Drew Fustini * tag 'thead-dt-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: MAINTAINERS: Add RISC-V T-HEAD SoC patchwork riscv: dts: thead: th1520: Add IMG BXM-4-64 GPU node Link: https://lore.kernel.org/r/aLyIXR1G9DUzwGWc@x1 Signed-off-by: Arnd Bergmann commit afd77d2050c35aee0d51ab7fb5b36a0fcabd4eee Author: Thorsten Blum Date: Fri Sep 12 08:47:24 2025 +0200 initramfs: Replace strcpy() with strscpy() in find_link() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Justin Stitt Signed-off-by: Christian Brauner commit beb022ef9263d0c5b1a994fa3ab5d3244a01aaa1 Author: Thorsten Blum Date: Fri Sep 12 09:46:52 2025 +0200 initrd: Use str_plural() in rd_load_image() Add the local variable 'nr_disks' and replace the manual ternary "s" pluralization with the standardized str_plural() helper function. Use pr_notice() instead of printk(KERN_NOTICE) to silence a checkpatch warning. No functional changes intended. Signed-off-by: Thorsten Blum Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit e60625e7ce10f696690d9e36a9f32fc7c1897f79 Author: Thorsten Blum Date: Fri Sep 12 08:52:57 2025 +0200 initramfs: Use struct_size() helper to improve dir_add() Use struct_size() to calculate the number of bytes to allocate for a new directory entry. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Christian Brauner commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162 Author: Dan Carpenter Date: Thu Aug 7 18:53:41 2025 +0300 drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() The xe_preempt_fence_create() function returns error pointers. It never returns NULL. Update the error checking to match. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Dan Carpenter Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain Signed-off-by: Rodrigo Vivi commit 8d0bf7908b5a6532a18ee658337d498158672862 Author: Angela Czubak Date: Mon Aug 18 23:08:52 2025 +0000 HID: multitouch: add haptic multitouch support If CONFIG_HID_HAPTIC is enabled, and the device is recognized to have simple haptic capabilities, try initializing the haptic device, check input frames for pressure and handle it using hid_haptic_* API. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit ff66b8eebbab37146ef1399d93332f82b752990b Author: Angela Czubak Date: Mon Aug 18 23:08:51 2025 +0000 HID: haptic: add hid_haptic_switch_mode Function hid_haptic_switch_mode() can be used to switch between device-controlled mode and host-controlled mode. Uploading a WAVEFORMPRESS or WAVEFORMRELEASE effect triggers host-controlled mode if the device is in device-controlled mode. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit 4e584ac737884ef0fd80f6836b917972fad86b17 Author: Angela Czubak Date: Mon Aug 18 23:08:50 2025 +0000 Input: MT - add INPUT_MT_TOTAL_FORCE flags Add a flag to generate ABS_PRESSURE as sum of ABS_MT_PRESSURE across all slots. This flag should be set if one knows a device reports true force and would like to report total force to the userspace. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Acked-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires commit a77efca3aa85e382b52b587ca9976c0f8e11d49c Author: Angela Czubak Date: Mon Aug 18 23:08:49 2025 +0000 HID: haptic: add functions handling events Implement hid_haptic_handle_press_release() which generates haptic feedback as well as saves the pressed state of the haptic device. Add functions to increase and reset the state of the pressure detected by the device. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit 7657bf0b7cfb63ded95a6fe4e1cf106cf386b6cc Author: Angela Czubak Date: Mon Aug 18 23:08:48 2025 +0000 HID: input: calculate resolution for pressure Assume that if the pressure is given in newtons it should be normalized to grams. If the pressure has no unit do not calculate resolution. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit 344ff358495706abc7aac1e0c59a5bb16b350307 Author: Angela Czubak Date: Mon Aug 18 23:08:47 2025 +0000 HID: haptic: initialize haptic device Add hid_haptic_init(). Parse autotrigger report to retrieve ordinals for press and release waveforms. Implement force feedback functions. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit 7a56e7b211e5b6e78cd87786ea4c5a62231d1da2 Author: Angela Czubak Date: Mon Aug 18 23:08:46 2025 +0000 HID: input: allow mapping of haptic output This change makes it possible to parse output reports by input mapping functions by HID drivers. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Reviewed-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires commit b44779d44f7152c1b62091ab31514a62b4629d4c Author: Angela Czubak Date: Mon Aug 18 23:08:45 2025 +0000 HID: haptic: introduce hid_haptic_device Define a new structure that contains simple haptic device configuration as well as current state. Add functions that recognize auto trigger and manual trigger reports as well as save their addresses. Verify that the pressure unit is either grams or newtons. Mark the input device as a haptic touchpad if the unit is correct and the reports are found. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit 7075ae4ac9db93a3e762f3c2793ad57dbbf8a120 Author: Angela Czubak Date: Mon Aug 18 23:08:44 2025 +0000 Input: add INPUT_PROP_HAPTIC_TOUCHPAD INPUT_PROP_HAPTIC_TOUCHPAD property is to be set for a device with simple haptic capabilities. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Acked-by: Dmitry Torokhov Reviewed-by: Randy Dunlap Signed-off-by: Benjamin Tissoires commit 08a72a220e960e7f153a810fb633638afd0b7563 Author: Angela Czubak Date: Mon Aug 18 23:08:43 2025 +0000 Input: add FF_HAPTIC effect type FF_HAPTIC effect type can be used to trigger haptic feedback with HID simple haptic usages. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Acked-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires commit 5e0ae59159e3a07391a35865bb79ff335473fa79 Author: Angela Czubak Date: Mon Aug 18 23:08:42 2025 +0000 HID: add haptics page defines Introduce haptic usages as defined in HID Usage Tables specification. Add HID units for newton and gram. Signed-off-by: Angela Czubak Co-developed-by: Jonathan Denose Signed-off-by: Jonathan Denose Signed-off-by: Benjamin Tissoires commit cde560f98a9b6e64dd675f6bd10137cc8243a32a Author: Mateusz Guzik Date: Thu Sep 11 08:56:41 2025 +0200 fs: expand dump_inode() This adds fs name and few fields from struct inode: i_mode, i_opflags, i_flags, i_state and i_count. All values printed raw, no attempt to pretty-print anything. Compile tested on i386 and runtime tested on amd64. Sample output: [ 23.121281] VFS_WARN_ON_INODE("crap") encountered for inode ffff9a1a83ce3660 fs pipefs mode 10600 opflags 0x4 flags 0x0 state 0x38 count 0 Signed-off-by: Mateusz Guzik commit 695f2c0c25f3c844f9dd177d20c1e8afc55df1ac Author: Geert Uytterhoeven Date: Mon Aug 11 11:30:06 2025 +0200 m68k: defconfig: Update defconfigs for v6.17-rc1 - Enable Netfilter legacy tables support, - Drop CONFIG_IP_NF_FILTER=m, CONFIG_IP_NF_MANGLE=m, CONFIG_IP6_NF_FILTER=m, and CONFIG_IP6_NF_MANGLE=m (auto-modular since commit 9fce66583f06c212 ("netfilter: Exclude LEGACY TABLES on PREEMPT_RT.")), - Enable legacy EBTABLES support (no longer auto-selected since commit 9fce66583f06c212 ("netfilter: Exclude LEGACY TABLES on PREEMPT_RT.")), - Drop CONFIG_CDROM_PKTCDVD=m (removed in commit 1cea5180f2f812c4 ("block: remove pktcdvd driver")), - Move CONFIG_CRC_BENCHMARK=y (moved in commit 89a51591405e09a8 ("lib/crc: Move files into lib/crc/")). Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/012bc96a01eef989b39eedbe84591bd50c022e57.1754904412.git.geert@linux-m68k.org commit 6d5674090543b89aac0c177d67e5fb32ddc53804 Author: Geert Uytterhoeven Date: Wed Sep 10 17:16:13 2025 +0200 m68k: bitops: Fix find_*_bit() signatures The function signatures of the m68k-optimized implementations of the find_{first,next}_{,zero_}bit() helpers do not match the generic variants. Fix this by changing all non-pointer inputs and outputs to "unsigned long", and updating a few local variables. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509092305.ncd9mzaZ-lkp@intel.com/ Signed-off-by: Geert Uytterhoeven Acked-by: "Yury Norov (NVIDIA)" Link: https://patch.msgid.link/de6919554fbb4cd1427155c6bafbac8a9df822c8.1757517135.git.geert@linux-m68k.org commit ac1440de1ba39fbd68da7fbcc4b1885685aa69e1 Author: Dishank Jogi Date: Mon Jul 28 07:14:52 2025 +0000 zorro: Remove extra whitespace in macro definitions Clean up the formatting of the MANUF() and PRODUCT() macro definitions in 'drivers/zorro/names.c' by removing unneeded spaces. No functional changes. Signed-off-by: Dishank Jogi Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250728071452.35171-1-jogidishank503@gmail.com Signed-off-by: Geert Uytterhoeven commit 84f1766bdba5a6394618a45b34a320f336b02d95 Author: Thorsten Blum Date: Thu Sep 11 11:49:08 2025 +0200 initrd: Fix unused variable warning in rd_load_image() on s390 The local variables 'rotator' and 'rotate' (used for the progress indicator) aren't used on s390. Building the kernel with W=1 generates the following warning: init/do_mounts_rd.c:192:17: warning: variable 'rotate' set but not used [-Wunused-but-set-variable] 192 | unsigned short rotate = 0; | ^ 1 warning generated. Remove the preprocessor directives and use the IS_ENABLED(CONFIG_S390) macro instead, allowing the compiler to optimize away unused variables and avoid the warning on s390. Signed-off-by: Thorsten Blum Signed-off-by: Christian Brauner commit af67f4c1cd0730810521ef4bc194c21ac3683d97 Author: Mateusz Guzik Date: Tue Sep 9 09:54:58 2025 +0200 fs: use the switch statement in init_special_inode() Similar to may_open(). No functional changes. Signed-off-by: Mateusz Guzik Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 796667c9dc94ef9431d4ac620021527b273080e1 Author: Max Kellermann Date: Tue Sep 9 09:55:06 2025 +0200 fs/proc/namespaces: make ns_entries const Global variables that are never modified should be "const" so so that they live in the .rodata section instead of the .data section of the kernel, gaining the protection of the kernel's strict memory permissions as described in Documentation/security/self-protection.rst Signed-off-by: Max Kellermann Signed-off-by: Christian Brauner commit 1441edd129e36cf5d1a9c2abff39619d5d90e1a8 Author: Kaushlendra Kumar Date: Thu Sep 11 08:48:11 2025 +0530 refperf: Set reader_tasks to NULL after kfree() Set reader_tasks to NULL after kfree() in ref_scale_cleanup() to improve debugging experience with kernel debugging tools. This follows the common pattern of NULLing pointers after freeing to avoid dangling pointer issues during debugging sessions. Setting pointers to NULL after freeing helps debugging tools like kdgb,drgn, and other kernel debuggers by providing clear indication that the memory has been freed and the pointer is no longer valid. Suggested-by: Paul E. McKenney Signed-off-by: Kaushlendra Kumar Signed-off-by: Paul E. McKenney commit fb7855a6b58b045f60a7456096da29842e9ca079 Author: Kaushlendra Kumar Date: Wed Sep 10 20:44:19 2025 +0530 refperf: Remove redundant kfree() after torture_stop_kthread() Remove unnecessary kfree(main_task) call in ref_scale_cleanup() as torture_stop_kthread() already handles the memory cleanup for the task structure internally. The additional kfree(main_task) call after torture_stop_kthread() is redundant and confusing since torture_stop_kthread() sets the pointer to NULL, making this a no-op. This pattern is consistent with other torture test modules where torture_stop_kthread() is called without explicit kfree() of the task pointer, as the torture framework manages the task lifecycle internally. Signed-off-by: Kaushlendra Kumar Signed-off-by: Paul E. McKenney commit e6a43aeb71852a39432332dcc3a6d11bb464b075 Author: Zqiang Date: Thu Sep 11 20:51:55 2025 +0800 srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed() Currently, the srcu_gp_start_if_needed() is always be invoked in preempt disable's critical section, this commit therefore remove redundant preempt_disable/enable() in srcu_gp_start_if_needed() and adds a call to lockdep_assert_preemption_disabled() in order to enable lockdep to diagnose mistaken invocations of this function from preempts-enabled code. Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption") Signed-off-by: Zqiang Signed-off-by: Paul E. McKenney commit 1c77e862b81e8fe84d3a908271c72da9711ea801 Author: Paul E. McKenney Date: Tue Jul 22 14:57:33 2025 -0700 srcu: Document srcu_flip() memory-barrier D relation to SRCU-fast The smp_mb() memory barrier at the end of srcu_flip() has a comment, but that comment does not make it clear that this memory barrier is an optimization, as opposed to being needed for correctness. This commit therefore adds this information and points out that it is omitted for SRCU-fast, where a much heavier weight synchronize_srcu() would be required. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: commit be975448a45cd024e2b98598eefc0e164ad93f09 Author: Paul E. McKenney Date: Tue Jul 22 14:25:35 2025 -0700 srcu: Document __srcu_read_{,un}lock_fast() implicit RCU readers This commit documents the implicit RCU readers that are implied by the this_cpu_inc() and atomic_long_inc() operations in __srcu_read_lock_fast() and __srcu_read_unlock_fast(). While in the area, fix the documentation of the memory pairing of atomic_long_inc() in __srcu_read_lock_fast(). [ paulmck: Apply Joel Fernandes feedback. ] Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: commit fa1d117162aa820a8f73a31ccab85bde6c84725b Author: David Woodhouse Date: Sat Aug 16 11:06:32 2025 +0100 x86/cpu: Detect FreeBSD Bhyve hypervisor Detect the Bhyve hypervisor and enable 15-bit MSI support if available. Detecting Bhyve used to be a purely cosmetic issue of the kernel printing 'Hypervisor detected: Bhyve' at boot time. But FreeBSD 15.0 will support¹ the 15-bit MSI enlightenment to support more than 255 vCPUs (http://david.woodhou.se/ExtDestId.pdf) which means there's now actually some functional reason to do so. ¹ https://github.com/freebsd/freebsd-src/commit/313a68ea20b4 [ bp: Massage, move tail comment ontop. ] Signed-off-by: David Woodhouse Signed-off-by: Borislav Petkov (AMD) Acked-by: Ahmed S. Darwish Link: https://lore.kernel.org/03802f6f7f5b5cf8c5e8adfe123c397ca8e21093.camel@infradead.org commit 6f1ece1e868839cf81a28c77e19420ff57df7ecf Author: Mostafa Saleh Date: Tue Sep 9 13:36:31 2025 +0000 KVM: arm64: Map hyp text as RO and dump instr on panic Map the hyp text section as RO, there are no secrets there and that allows the kernel extract info for debugging. As in case of panic we can now dump the faulting instructions similar to the kernel. Signed-off-by: Mostafa Saleh Acked-by: Will Deacon Signed-off-by: Marc Zyngier commit 92b7624fe052ffb0b7b70d96cd514e02e91664a8 Author: Mostafa Saleh Date: Tue Sep 9 13:36:30 2025 +0000 KVM: arm64: Dump instruction on hyp panic Similar to the kernel panic, where the instruction code is printed, we can do the same for hypervisor panics. This patch does that only in case of “CONFIG_NVHE_EL2_DEBUG” or nvhe. The next patch adds support for pKVM. Also, remove the hardcoded argument dump_kernel_instr(). Signed-off-by: Mostafa Saleh Tested-by: Kunwu Chan Reviewed-by: Kunwu Chan Acked-by: Will Deacon Signed-off-by: Marc Zyngier commit 18dda9eb9e11b2aeec73cbe2a56ab2f862841ba4 Author: Colin Ian King Date: Sat Sep 13 21:16:11 2025 +0100 spi: amlogic: Fix error checking on regmap_write call Currently a call to regmap_write is not being error checked because the return checke is being performed on the variable ret and this variable is not assigned the return value from the regmap_write call. Fix this by adding in the missing assignment. Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250913201612.1338217-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 8b184c34806e5da4d4847fabd3faeff38b47e70a Author: Bard Liao Date: Mon Sep 15 10:48:53 2025 +0800 ASoC: Intel: hda-sdw-bpt: set persistent_buffer false The persistent_buffer agreement is false when hda_cl_prepare() is called. We should use the same value when hda_cl_cleanup() is called. Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 6d48436560e91be858158e227f21aab71698814e Author: Jiri Olsa Date: Fri Sep 5 22:57:30 2025 +0200 selftests/bpf: Fix uprobe_sigill test for uprobe syscall error value The uprobe syscall now returns -ENXIO errno when called outside kernel trampoline, fixing the current sigill test to reflect that and renaming it to uprobe_error. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko commit d3aeb6d97b22272bb4783c6d4309d81bb0a4527c Author: Jiri Olsa Date: Fri Sep 5 22:57:29 2025 +0200 uprobes/x86: Return error from uprobe syscall when not called from trampoline Currently uprobe syscall handles all errors with forcing SIGILL to current process. As suggested by Andrii it'd be helpful for uprobe syscall detection to return error value for the !in_uprobe_trampoline check. This way we could just call uprobe syscall and based on return value we will find out if the kernel has it. Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov commit f8527a29f4619f74bc30a9845ea87abb9a6faa1e Author: Christian Brauner Date: Fri Sep 12 13:52:26 2025 +0200 nsfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4d906371d1f9fc9ce47b2c8f37444680246557bc Author: Christian Brauner Date: Fri Sep 12 13:52:25 2025 +0200 nsfs: drop tautological ioctl() check This check does absolutely nothing. So drop it. Signed-off-by: Christian Brauner commit 3c17001b21b9f168c957ced9384abe969019b609 Author: Christian Brauner Date: Fri Sep 12 13:52:24 2025 +0200 pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. Reviewed-by: Aleksa Sarai Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b36d55610215a976267197ddc914902c494705d7 Author: Felix Fietkau Date: Mon Sep 15 09:59:10 2025 +0200 wifi: mt76: abort scan/roc on hw restart Avoid spurious channel changes and clean up allocated links Link: https://patch.msgid.link/20250915075910.47558-15-nbd@nbd.name Signed-off-by: Felix Fietkau commit 3f34cced88a429872d1eefc393686f9a48ec01d9 Author: Felix Fietkau Date: Mon Sep 15 09:59:09 2025 +0200 wifi: mt76: improve phy reset on hw restart - fix number of station accounting for scanning code. - reset channel context Link: https://patch.msgid.link/20250915075910.47558-14-nbd@nbd.name Signed-off-by: Felix Fietkau commit 6855bebea8f8935af1a193c26dc13ae5ba771116 Author: Howard Hsu Date: Mon Sep 15 09:59:08 2025 +0200 wifi: mt76: mt7996: fill User Priority in skb->priority for rx packets Set UP in skb->priority to allow DSCP Learning at upper layers Signed-off-by: Howard Hsu Link: https://patch.msgid.link/20250915075910.47558-13-nbd@nbd.name Signed-off-by: Felix Fietkau commit 5847e7579e8924f7ef20cf4b2b4cea4ab145aa7d Author: Peter Chiu Date: Mon Sep 15 09:59:07 2025 +0200 wifi: mt76: mt7996: set VTA in txwi Enable VTA flag in txwi to enable HQD in SPL which is needed by the PST. Without this patch, PST cannot get the correct delay of TxD and lead to a large latency. Signed-off-by: Peter Chiu Link: https://patch.msgid.link/20250915075910.47558-12-nbd@nbd.name Signed-off-by: Felix Fietkau commit e99113ac0984d5fcfdee3883367c5747d918d6e9 Author: Howard Hsu Date: Mon Sep 15 09:59:06 2025 +0200 wifi: mt76: mt7996: remove the mem_total field of STA_REC_BF command It is not used by the firmware. Signed-off-by: Howard Hsu Link: https://patch.msgid.link/20250915075910.47558-11-nbd@nbd.name Signed-off-by: Felix Fietkau commit a4a66cbaa20f51cb953d09a95c67cb237a088ec9 Author: Peter Chiu Date: Mon Sep 15 09:59:05 2025 +0200 wifi: mt76: mt7996: disable promiscuous mode by default Set MT_WF_RFCR_DROP_OTHER_UC by default and disable this flag in mt7996_set_monitor only if monitor mode is enabled. Without this patch, the MT_WF_RFCR_DROP_OTHER_UC would not be set so the driver would receive lots of packets meant for other devices. Signed-off-by: Peter Chiu Link: https://patch.msgid.link/20250915075910.47558-10-nbd@nbd.name Signed-off-by: Felix Fietkau commit 12911593efa97abc27b75e98c530b8b1193c384b Author: Felix Fietkau Date: Mon Sep 15 09:59:04 2025 +0200 wifi: mt76: use altx queue for offchannel tx on connac+ This ensures that packets are sent out immediately and are not held by firmware internal buffering. Link: https://patch.msgid.link/20250915075910.47558-9-nbd@nbd.name Signed-off-by: Felix Fietkau commit 467cf7ae6036340a845cf81bdd22e20ab9ba8245 Author: Felix Fietkau Date: Mon Sep 15 09:59:03 2025 +0200 wifi: mt76: mt7996: fix updating beacon protection with beacons enabled Disable and re-enable beacon after beacon protection key change, in order to fully apply the changes. Link: https://patch.msgid.link/20250915075910.47558-8-nbd@nbd.name Signed-off-by: Felix Fietkau commit eddc7286f6bbf574f8ab22cdf2afd349a893b447 Author: Felix Fietkau Date: Mon Sep 15 09:59:02 2025 +0200 wifi: mt76: mt7996: fix key add/remove imbalance Ensure that a key for a link is only added and removed once. When bringing up a link, only upload keys for that particular link, instead of iterating over all of them. Link: https://patch.msgid.link/20250915075910.47558-7-nbd@nbd.name Signed-off-by: Felix Fietkau commit 04414d7bba785a80400dff4b349f15f847ebc4ba Author: Felix Fietkau Date: Mon Sep 15 09:59:01 2025 +0200 wifi: mt76: mt7996: delete vif keys when requested While deleting sta keys can be omitted in order to fix race conditions, vif keys must be deleted before being replaced in order to prevent accidental reuse in firmware. Link: https://patch.msgid.link/20250915075910.47558-6-nbd@nbd.name Signed-off-by: Felix Fietkau commit 7c0f63fe37a5da2c13fc35c89053b31be8ead895 Author: Felix Fietkau Date: Mon Sep 15 09:59:00 2025 +0200 wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error Free the allocated skb on error Link: https://patch.msgid.link/20250915075910.47558-5-nbd@nbd.name Signed-off-by: Felix Fietkau commit 0c45d52276fd744f5cc6b4129189506f83c0ef1d Author: Felix Fietkau Date: Mon Sep 15 09:58:59 2025 +0200 wifi: mt76: mt7996: fix setting beacon protection keys Include beacon key information in the STA_REC_UPDATE call. Remove mt7996_mcu_get_pn - when installing a new key, we should not reuse any existing PN value. Signed-off-by: Allen Ye Signed-off-by: Michael-CY Lee Link: https://patch.msgid.link/20250915075910.47558-4-nbd@nbd.name Signed-off-by: Felix Fietkau commit beb01caa570c52b87c8f234381eff72817c2a7ab Author: Felix Fietkau Date: Mon Sep 15 09:58:58 2025 +0200 wifi: mt76: mt7996: decrease timeout for commonly issued MCU commands This allows faster recovery from firmware issues. Based on patch by Chad Monroe and ported from mt7915. Link: https://patch.msgid.link/20250915075910.47558-3-nbd@nbd.name Signed-off-by: Felix Fietkau commit ace5d3b6b49e8391beb4d7244348ba7da5298878 Author: Felix Fietkau Date: Mon Sep 15 09:58:57 2025 +0200 wifi: mt76: mt7996: improve hardware restart reliability Port latest version of similar changes from mt7915: - use reconfig_complete to restart mac_work / queues - clear wcid and vif mask to avoid leak - fix sta poll list corruption - reset station links - reset interface links - clear rro list Link: https://patch.msgid.link/20250915075910.47558-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit 0a5df0ec47f7edc04957925a9644101682041d27 Author: Felix Fietkau Date: Mon Sep 15 09:58:56 2025 +0200 wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart There is only one wiphy, so extra calls must be removed. For calls that need to remain per-wiphy, use mt7996_for_each_phy Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit fd2e08128944a7679e753f920e9eda72057e427c Author: Hengqi Chen Date: Mon Sep 8 01:24:48 2025 +0000 riscv, bpf: Sign extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel panic: Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [] __qdisc_run+0x82/0x6f0 [] __dev_queue_xmit+0x4c0/0x1128 [] neigh_resolve_output+0xd0/0x170 [] ip6_finish_output2+0x226/0x6c8 [] ip6_finish_output+0x10c/0x2a0 [] ip6_output+0x5e/0x178 [] ip6_xmit+0x29a/0x608 [] inet6_csk_xmit+0xe6/0x140 [] __tcp_transmit_skb+0x45c/0xaa8 [] tcp_connect+0x9ce/0xd10 [] tcp_v6_connect+0x4ac/0x5e8 [] __inet_stream_connect+0xd8/0x318 [] inet_stream_connect+0x3e/0x68 [] __sys_connect_file+0x50/0x88 [] __sys_connect+0x96/0xc8 [] __riscv_sys_connect+0x20/0x30 [] do_trap_ecall_u+0x256/0x378 [] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI. So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]). [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") Signed-off-by: Hengqi Chen Signed-off-by: Daniel Borkmann Tested-by: Pu Lehui Reviewed-by: Pu Lehui Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com commit 472df181d7c4c732d5c5b98d506d1902e7580acb Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:47 2025 +0530 drm/exynos: dsi: add support for exynos7870 Add glue layer support for Exynos7870's DSIM IP bridge driver. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b Author: Kaustabh Chakraborty Date: Sun Jul 6 22:59:46 2025 +0530 drm/exynos: exynos7_drm_decon: remove ctx->suspended Condition guards are found to be redundant, as the call flow is properly managed now, as also observed in the Exynos5433 DECON driver. Since state checking is no longer necessary, remove it. This also fixes an issue which prevented decon_commit() from decon_atomic_enable() due to an incorrect state change setting. Fixes: 96976c3d9aff ("drm/exynos: Add DECON driver") Cc: stable@vger.kernel.org Suggested-by: Inki Dae Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 0e6ee83c4b68448063e88e14c13c17d83e7d9735 Author: Kaustabh Chakraborty Date: Sun Jul 6 22:59:45 2025 +0530 dt-bindings: display: samsung,exynos7-decon: document iommus, memory-region, and ports Similar to FIMD and Exynos5433's DECON, the Exynos7 DECON hardware: - May optionally require an IOMMU to initialize a display region. - Outputs image data to another block, say an MIC or a DSI master. If an IOMMU is present, it may also require to access the reserved framebuffer region. Document these bindings in the devicetree schema. Signed-off-by: Kaustabh Chakraborty Reviewed-by: Krzysztof Kozlowski Signed-off-by: Inki Dae commit 6798668ab19557520876d0f7dfabca827ee8b524 Author: Hengqi Chen Date: Thu Sep 4 10:51:18 2025 +0000 riscv, bpf: Remove duplicated bpf_flush_icache() The bpf_flush_icache() is done by bpf_arch_text_copy() already. Remove the duplicated one in arch_prepare_bpf_trampoline(). Signed-off-by: Hengqi Chen Signed-off-by: Daniel Borkmann Reviewed-by: Pu Lehui Link: https://lore.kernel.org/bpf/20250904105119.21861-1-hengqi.chen@gmail.com commit b137312fbf2dd1edc39acf7e8e6e8ac0a6ad72c0 Author: Joe Lawrence Date: Fri Sep 12 10:27:40 2025 -0400 powerpc64/modules: replace stub allocation sentinel with an explicit counter The logic for allocating ppc64_stub_entry trampolines in the .stubs section relies on an inline sentinel, where a NULL .funcdata member indicates an available slot. While preceding commits fixed the initialization bugs that led to ftrace stub corruption, the sentinel-based approach remains fragile: it depends on an implicit convention between subsystems modifying different struct types in the same memory area. Replace the sentinel with an explicit counter, module->arch.num_stubs. Instead of iterating through memory to find a NULL marker, the module loader uses this counter as the boundary for the next free slot. This simplifies the allocation code, hardens it against future changes to stub structures, and removes the need for an extra relocation slot previously reserved to terminate the sentinel search. Signed-off-by: Joe Lawrence Acked-by: Naveen N Rao (AMD) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250912142740.3581368-4-joe.lawrence@redhat.com commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd Author: Joe Lawrence Date: Fri Sep 12 10:27:39 2025 -0400 powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to extend the ppc64le module .stubs section with an array of ftrace_ool_stub structures for each patchable function. Fix its ppc64_stub_entry stub reservation loop to properly write across all of the num_stubs used and not just the first entry. Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") Signed-off-by: Joe Lawrence Acked-by: Naveen N Rao (AMD) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com commit 5337609a314828aa2474ac359db615f475c4a4d2 Author: Joe Lawrence Date: Fri Sep 12 10:27:38 2025 -0400 powerpc/ftrace: ensure ftrace record ops are always set for NOPs When an ftrace call site is converted to a NOP, its corresponding dyn_ftrace record should have its ftrace_ops pointer set to ftrace_nop_ops. Correct the powerpc implementation to ensure the ftrace_rec_set_nop_ops() helper is called on all successful NOP initialization paths. This ensures all ftrace records are consistent before being handled by the ftrace core. Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") Suggested-by: Naveen N Rao Signed-off-by: Joe Lawrence Acked-by: Naveen N Rao (AMD) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com commit d79bab8a48bfcf5495f72d10bf609478a4a3b916 Author: Babu Moger Date: Fri Sep 5 16:34:32 2025 -0500 MAINTAINERS: resctrl: Add myself as reviewer I have been contributing to resctrl for sometime now and I would like to help with code reviews as well. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Acked-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 77169a11d4e9916f6c22587df396d6128505dbfb Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:46 2025 +0530 drm/bridge: samsung-dsim: add driver support for exynos7870 DSIM bridge Add support for Exynos7870's DSIM IP block in the bridge driver. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 7f8d35b589c9f6acda0e36b184c193d38f092c36 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:45 2025 +0530 dt-bindings: samsung,mipi-dsim: document exynos7870 DSIM compatible Add compatible string for Exynos7870 DSIM bridge controller. The device requires four clock sources, in schema they're named as "bus", "pll", "byte", and "esc". Suggested-by: Krzysztof Kozlowski Reviewed-by: Rob Herring (Arm) Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit f08051a4158fec363e1f33b75dd48131f524fa5f Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:44 2025 +0530 drm/bridge: samsung-dsim: add ability to define clock names for every variant Presently, all devices refer to clock names from a single array. The only controlling parameter is the number of clocks (num_clks field of samsung_dsim_driver_data) which uses the first n clocks of that array. As new devices are added, this approach turns out to be cumbersome. Separate the clock names in individual arrays required by each variant, in a struct clk_bulk_data. Add a pointer field to the driver data struct which points to their respective clock names, and rework the clock usage code to use the clk_bulk_* API instead. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 7ef93667ab19370a2a05b8dbcad36d76b887ff38 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:43 2025 +0530 drm/bridge: samsung-dsim: increase timeout value for PLL_STABLE Exynos7870's DSIM requires more time to stabilize its PLL. The current timeout value, 1000, doesn't suffice. Increase the value to 3000, which is just about enough as observed experimentally. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit f7754d843a05c685ba453be176a29ae157f88b0c Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:42 2025 +0530 drm/bridge: samsung-dsim: allow configuring the PLL_STABLE bit The PLL_STABLE bit of DSIM_DPHY_STATUS is hardcoded to BIT(31), but Exynos7870's DSIM has it in BIT(24) as per downstream kernel sources. In order to support both, move this bit value to the driver data struct and define it for every driver compatible. Reference the value from there instead, in functions wherever required. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 9aa49c21aac071383353315036520ba753484c93 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:41 2025 +0530 drm/bridge: samsung-dsim: allow configuring PLL_M and PLL_S offsets Currently, PLL_P offset of DSIM_PLLCTRL is configurable in the driver data, while PLL_M and PLL_S offsets are hardcoded as 4-bit and 1-bit offsets respectively, but Exynos7870's DSIM have them at 3-bit and 0-bit offsets as per downstream kernel sources. In order to support both, move both offset values to the driver data struct and define it for every driver compatible. Reference the values from there instead, in functions wherever required. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit d6dbefb2fed7d7f333c4241965296d84c202b6bf Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:40 2025 +0530 drm/bridge: samsung-dsim: allow configuring the VIDEO_MODE bit The VIDEO_MODE bit of DSIM_CONFIG is hardcoded to BIT(25), but Exynos7870's DSIM has it in BIT(18) as per downstream kernel sources. In order to support both, move this bit value to the driver data struct and define it for every driver compatible. Reference the value from there instead, in functions wherever required. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 4d244122dd90c72f6c3f10eb7a53678d78d3b857 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:39 2025 +0530 drm/bridge: samsung-dsim: allow configuring the MAIN_VSA offset The MAIN_VSA offset of DSIM_MSYNC is hardcoded to a 22-bit offset, but Exynos7870's DSIM has it in a 16-bit offset as per the downstream kernel sources. In order to support both, move this offset value to the driver data struct and define it for every driver compatible. Reference the value from there instead, in functions wherever required. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit f6ba4c1577a8184105133a79b5d1b6d465158362 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:38 2025 +0530 drm/bridge: samsung-dsim: allow configuring bits and offsets of CLKCTRL register DSIM_CLKCTRL bit and offset values hardcoded in the driver: name | bit/offset value --------------------------+----------------- DSIM_LANE_ESC_CLK_EN_CLK | 19 DSIM_LANE_ESC_CLK_EN_DATA | 20 DSIM_BYTE_CLKEN | 24 DSIM_ESC_CLKEN | 28 DSIM_TX_REQUEST_HSCLK | 31 DSIM_CLKCTRL bit and offset values in Exynos7870 DSIM as per downstream kernel sources: name | bit/offset value --------------------------+----------------- DSIM_LANE_ESC_CLK_EN_CLK | 8 DSIM_LANE_ESC_CLK_EN_DATA | 9 DSIM_BYTE_CLKEN | 17 DSIM_ESC_CLKEN | 16 DSIM_TX_REQUEST_HSCLK | 20 In order to support both, move all values to the driver data struct and define it for every driver compatible. Reference the values from there instead, in functions wherever required. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 92beab1a397d80d04d90f511c6d0af696da67a33 Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:37 2025 +0530 drm/bridge: samsung-dsim: add flag to control header FIFO wait Exynos7870's DSIM device doesn't require waiting for the header FIFO during a MIPI DSI transfer. Add a flag in the driver data in order to control said behavior. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae Date: Sun Jul 6 23:55:36 2025 +0530 drm/bridge: samsung-dsim: add SFRCTRL register On Exynos7870 devices, enabling the display requires disabling standby by writing to the SFRCTRL register. Add the register and related bit values. Since this behavior isn't available on other SoCs, implement a flag in the driver data struct indicating the availability of this feature. Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 4e445729dc103ff7780ed03da9f8310759ea5dae Author: Kaustabh Chakraborty Date: Sun Jul 6 23:55:35 2025 +0530 drm/bridge: samsung-dsim: support separate LINK and DPHY status registers Exynos7870's DSIM has separate registers for LINK and DPHY status. This is in contrast to older variants in the driver which use a single register for both. Add a driver data flag which indicates that the device variant supports the legacy status register. Change the register read calls appropriately. Suggested-by: Inki Dae Signed-off-by: Kaustabh Chakraborty Signed-off-by: Inki Dae commit 0f1576e43adc62756879a240e66e89ce386b6eb9 Author: Babu Moger Date: Fri Sep 5 16:34:31 2025 -0500 x86/resctrl: Configure mbm_event mode if supported Configure mbm_event mode on AMD platforms. On AMD platforms, it is recommended to use the mbm_event mode, if supported, to prevent the hardware from resetting counters between reads. This can result in misleading values or display "Unavailable" if no counter is assigned to the event. Enable mbm_event mode, known as ABMC (Assignable Bandwidth Monitoring Counters) on AMD, by default if the system supports it. Update ABMC across all logical processors within the resctrl domain to ensure proper functionality. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 8004ea01cf6338298e0c6ab055bc3ec659ce381b Author: Babu Moger Date: Fri Sep 5 16:34:30 2025 -0500 fs/resctrl: Introduce the interface to switch between monitor modes Resctrl subsystem can support two monitoring modes, "mbm_event" or "default". In mbm_event mode, monitoring event can only accumulate data while it is backed by a hardware counter. In "default" mode, resctrl assumes there is a hardware counter for each event within every CTRL_MON and MON group. Introduce mbm_assign_mode resctrl file to switch between mbm_event and default modes. Example: To list the MBM monitor modes supported: $ cat /sys/fs/resctrl/info/L3_MON/mbm_assign_mode [mbm_event] default To enable the "mbm_event" counter assignment mode: $ echo "mbm_event" > /sys/fs/resctrl/info/L3_MON/mbm_assign_mode To enable the "default" monitoring mode: $ echo "default" > /sys/fs/resctrl/info/L3_MON/mbm_assign_mode Reset MBM event counters automatically as part of changing the mode. Clear both architectural and non-architectural event states to prevent overflow conditions during the next event read. Clear assignable counter configuration on all the domains. Also, enable auto assignment when switching to "mbm_event" mode. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 9f0209b857d2fc99c2a32bff1d7bfd54b314c29c Author: Babu Moger Date: Fri Sep 5 16:34:29 2025 -0500 fs/resctrl: Disable BMEC event configuration when mbm_event mode is enabled The BMEC (Bandwidth Monitoring Event Configuration) feature enables per-domain event configuration. With BMEC the MBM events are configured using the mbm_total_bytes_config or mbm_local_bytes_config files in /sys/fs/resctrl/info/L3_MON/ and the per-domain event configuration affects all monitor resource groups. The mbm_event counter assignment mode enables counters to be assigned to RMID (i.e. a monitor resource group), event pairs, with potentially unique event configurations associated with every counter. There may be systems that support both BMEC and mbm_event counter assignment mode, but resctrl supporting both concurrently will present a conflicting interface to the user with both per-domain and per RMID, event configurations active at the same time. The mbm_event counter assignment provides most flexibility to user space and aligns with Arm's counter support. On systems that support both, disable BMEC event configuration when mbm_event mode is enabled by hiding the mbm_total_bytes_config or mbm_local_bytes_config files when mbm_event mode is enabled. Ensure mon_features always displays accurate information about monitor features. Suggested-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 88bee79640aea6192f98c8faae30e0013453479d Author: Babu Moger Date: Fri Sep 5 16:34:28 2025 -0500 fs/resctrl: Introduce the interface to modify assignments in a group Enable the mbm_l3_assignments resctrl file to be used to modify counter assignments of CTRL_MON and MON groups when the "mbm_event" counter assignment mode is enabled. Process the assignment modifications in the following format: :=;= Event: A valid MBM event in the /sys/fs/resctrl/info/L3_MON/event_configs directory. Domain ID: A valid domain ID. When writing, '*' applies the changes to all domains. Assignment states: _ : Unassign a counter. e : Assign a counter exclusively. Examples: $ cd /sys/fs/resctrl $ cat /sys/fs/resctrl/mbm_L3_assignments mbm_total_bytes:0=e;1=e mbm_local_bytes:0=e;1=e To unassign the counter associated with the mbm_total_bytes event on domain 0: $ echo "mbm_total_bytes:0=_" > mbm_L3_assignments $ cat /sys/fs/resctrl/mbm_L3_assignments mbm_total_bytes:0=_;1=e mbm_local_bytes:0=e;1=e To unassign the counter associated with the mbm_total_bytes event on all the domains: $ echo "mbm_total_bytes:*=_" > mbm_L3_assignments $ cat /sys/fs/resctrl/mbm_L3_assignments mbm_total_bytes:0=_;1=_ mbm_local_bytes:0=e;1=e Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit cba8222880b88d96f3ed6c8a115e335e552b83a1 Author: Babu Moger Date: Fri Sep 5 16:34:27 2025 -0500 fs/resctrl: Introduce mbm_L3_assignments to list assignments in a group Introduce the mbm_L3_assignments resctrl file associated with CTRL_MON and MON resource groups to display the counter assignment states of the resource group when "mbm_event" counter assignment mode is enabled. Display the list in the following format: :=;= Event: A valid MBM event listed in /sys/fs/resctrl/info/L3_MON/event_configs directory. Domain ID: A valid domain ID. The assignment state can be one of the following: _ : No counter assigned. e : Counter assigned exclusively. Example: To list the assignment states for the default group $ cd /sys/fs/resctrl $ cat /sys/fs/resctrl/mbm_L3_assignments mbm_total_bytes:0=e;1=e mbm_local_bytes:0=e;1=e Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit ef712fe97ec575657abb12d76837867dd8b8a0ed Author: Babu Moger Date: Fri Sep 5 16:34:26 2025 -0500 fs/resctrl: Auto assign counters on mkdir and clean up on group removal Resctrl provides a user-configurable option mbm_assign_on_mkdir that determines if a counter will automatically be assigned to an RMID, event pair when its associated monitor group is created via mkdir. Enable mbm_assign_on_mkdir by default to automatically assign counters to the two default events (MBM total and MBM local) of a new monitoring group created via mkdir. This maintains backward compatibility with original resctrl support for these two events. Unassign and free counters belonging to a monitoring group when the group is deleted. Monitor group creation does not fail if a counter cannot be assigned to one or both events. There may be limited counters and users have the flexibility to modify counter assignments at a later time. Log the error message "Failed to allocate counter for in domain " in /sys/fs/resctrl/info/last_cmd_status when a new monitoring group is created but counter assignment failed. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit ac1df9bb0ba3ae94137fb494cd9efc598f65d826 Author: Babu Moger Date: Fri Sep 5 16:34:25 2025 -0500 fs/resctrl: Introduce mbm_assign_on_mkdir to enable assignments on mkdir The "mbm_event" counter assignment mode allows users to assign a hardware counter to an RMID, event pair and monitor the bandwidth as long as it is assigned. Introduce a user-configurable option that determines if a counter will automatically be assigned to an RMID, event pair when its associated monitor group is created via mkdir. Accessible when "mbm_event" counter assignment mode is enabled. Suggested-by: Peter Newman Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit f9ae5913d47cda67481a4f54cc3273d3d1d00a01 Author: Babu Moger Date: Fri Sep 5 16:34:24 2025 -0500 fs/resctrl: Provide interface to update the event configurations When "mbm_event" counter assignment mode is enabled, users can modify the event configuration by writing to the 'event_filter' resctrl file. The event configurations for mbm_event mode are located in /sys/fs/resctrl/info/L3_MON/event_configs/. Update the assignments of all CTRL_MON and MON resource groups when the event configuration is modified. Example: $ mount -t resctrl resctrl /sys/fs/resctrl $ cd /sys/fs/resctrl/ $ cat info/L3_MON/event_configs/mbm_local_bytes/event_filter local_reads,local_non_temporal_writes,local_reads_slow_memory $ echo "local_reads,local_non_temporal_writes" > info/L3_MON/event_configs/mbm_total_bytes/event_filter $ cat info/L3_MON/event_configs/mbm_total_bytes/event_filter local_reads,local_non_temporal_writes Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit ea274cbeaf8f0667267b347e3f84797439cdab4e Author: Babu Moger Date: Fri Sep 5 16:34:23 2025 -0500 fs/resctrl: Add event configuration directory under info/L3_MON/ The "mbm_event" counter assignment mode allows the user to assign a hardware counter to an RMID, event pair and monitor the bandwidth as long as it is assigned. The user can specify the memory transaction(s) for the counter to track. When this mode is supported, the /sys/fs/resctrl/info/L3_MON/event_configs directory contains a sub-directory for each MBM event that can be assigned to a counter. The MBM event sub-directory contains a file named "event_filter" that is used to view and modify which memory transactions the MBM event is configured with. Create /sys/fs/resctrl/info/L3_MON/event_configs directory on resctrl mount and pre-populate it with directories for the two existing MBM events: mbm_total_bytes and mbm_local_bytes. Create the "event_filter" file within each MBM event directory with the needed *show() that displays the memory transactions with which the MBM event is configured. Example: $ mount -t resctrl resctrl /sys/fs/resctrl $ cd /sys/fs/resctrl/ $ cat info/L3_MON/event_configs/mbm_total_bytes/event_filter local_reads,remote_reads,local_non_temporal_writes, remote_non_temporal_writes,local_reads_slow_memory, remote_reads_slow_memory,dirty_victim_writes_all $ cat info/L3_MON/event_configs/mbm_local_bytes/event_filter local_reads,local_non_temporal_writes,local_reads_slow_memory Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 159f36cd4de7718779fd0b232de5137b4ffd2d1e Author: Babu Moger Date: Fri Sep 5 16:34:22 2025 -0500 fs/resctrl: Support counter read/reset with mbm_event assignment mode When "mbm_event" counter assignment mode is enabled, the architecture requires a counter ID to read the event data. Introduce an is_mbm_cntr field in struct rmid_read to indicate whether counter assignment mode is in use. Update the logic to call resctrl_arch_cntr_read() and resctrl_arch_reset_cntr() when the assignment mode is active. Report 'Unassigned' in case the user attempts to read an event without assigning a hardware counter. Suggested-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 27d2b47eef033f1fc6c0452dc1017e43dad5fe14 Author: Yingchao Deng Date: Tue Sep 2 11:48:25 2025 +0800 KVM: arm64: Return early from trace helpers when KVM isn't available When Linux is booted at EL1, host_data_ptr() resolves to the nVHE hypervisor's copy of host data. When hyp mode isn't available for KVM the nVHE percpu bases remain uninitialized. Consequently, any usage of host_data_ptr() will result in a NULL dereference which has been observed in KVM's trace filtering helpers. Add an early return to the trace filtering helpers if KVM isn't initialized, avoiding the NULL dereference. Take this opportunity to move the TRBE-skipping checks to a common helper. Fixes: 054b88391bbe2 ("KVM: arm64: Support trace filtering for guests") Signed-off-by: Yingchao Deng Reviewed-by: James Clark [maz: repainted the helpers to be readable, and the commit message with Oliver's suggestion] Signed-off-by: Marc Zyngier commit 84973249011fda3ff292f83439a062fec81ef982 Author: John Keeping Date: Mon Sep 15 10:42:19 2025 +0100 ALSA: serial-generic: remove shared static buffer If multiple instances of this driver are instantiated and try to send concurrently then the single static buffer snd_serial_generic_tx_work() will cause corruption in the data output. Move the buffer into the per-instance driver data to avoid this. Signed-off-by: John Keeping Signed-off-by: Takashi Iwai commit 2a65b72c1603a74f35228acbb8de2ecff9c13efe Author: Babu Moger Date: Fri Sep 5 16:34:21 2025 -0500 x86/resctrl: Implement resctrl_arch_reset_cntr() and resctrl_arch_cntr_read() System software reads resctrl event data for a particular resource by writing the RMID and Event Identifier (EvtID) to the QM_EVTSEL register and then reading the event data from the QM_CTR register. In ABMC mode, the event data of a specific counter ID is read by setting the following fields: QM_EVTSEL.ExtendedEvtID = 1, QM_EVTSEL.EvtID = L3CacheABMC (=1) and setting QM_EVTSEL.RMID to the desired counter ID. Reading the QM_CTR then returns the contents of the specified counter ID. RMID_VAL_ERROR bit is set if the counter configuration is invalid, or if an invalid counter ID is set in the QM_EVTSEL.RMID field. RMID_VAL_UNAVAIL bit is set if the counter data is unavailable. Introduce resctrl_arch_reset_cntr() and resctrl_arch_cntr_read() to reset and read event data for a specific counter. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 0265d0ebb409a25d3bb3a19494e0173d06d9d132 Author: Nathan Chancellor Date: Mon Sep 8 13:24:59 2025 -0700 drm/pixpaper: Fix return type of pixpaper_mode_valid() When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance in the new tiny DRM pixpaper driver: drivers/gpu/drm/tiny/pixpaper.c:982:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_crtc *, const struct drm_display_mode *)' with an expression of type 'int (struct drm_crtc *, const struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] 982 | .mode_valid = pixpaper_mode_valid, | ^~~~~~~~~~~~~~~~~~~ While 'int' and 'enum drm_mode_status' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when pixpaper_mode_valid() is called indirectly. Update the return type of pixpaper_mode_valid() to be 'enum drm_mode_status' to clear up the warning and kCFI violation. Fixes: c9e70639f591 ("drm: tiny: Add support for Mayqueen Pixpaper e-ink panel") Signed-off-by: Nathan Chancellor Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250908-drm-pixpaper-fix-mode_valid-return-type-v1-1-705ceaf03757@kernel.org commit 7c9ac605e202c4668e441fc8146a993577131ca1 Author: Babu Moger Date: Fri Sep 5 16:34:20 2025 -0500 x86/resctrl: Refactor resctrl_arch_rmid_read() resctrl_arch_rmid_read() adjusts the value obtained from MSR_IA32_QM_CTR to account for the overflow for MBM events and apply counter scaling for all the events. This logic is common to both reading an RMID and reading a hardware counter directly. Refactor the hardware value adjustment logic into get_corrected_val() to prepare for support of reading a hardware counter. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 862314fd1f93d96eddb0559a807c66cb1f6ee520 Author: Babu Moger Date: Fri Sep 5 16:34:19 2025 -0500 fs/resctrl: Introduce counter ID read, reset calls in mbm_event mode When supported, "mbm_event" counter assignment mode allows users to assign a hardware counter to an RMID, event pair and monitor the bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. Introduce the architecture calls resctrl_arch_cntr_read() and resctrl_arch_reset_cntr() to read and reset event counters when "mbm_event" mode is supported. Function names match existing resctrl_arch_rmid_read() and resctrl_arch_reset_rmid(). Suggested-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit bc53eea6c2a1dea152a0073a2f2814b697ad197e Author: Babu Moger Date: Fri Sep 5 16:34:18 2025 -0500 fs/resctrl: Pass struct rdtgroup instead of individual members Reading monitoring data for a monitoring group requires both the RMID and CLOSID. The RMID and CLOSID are members of struct rdtgroup but passed separately to several functions involved in retrieving event data. When "mbm_event" counter assignment mode is enabled, a counter ID is required to read event data. The counter ID is obtained through mbm_cntr_get(), which expects a struct rdtgroup pointer. Provide a pointer to the struct rdtgroup as parameter to functions involved in retrieving event data to simplify access to RMID, CLOSID, and counter ID. Suggested-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit aab2c5088cdb26e80d51ffbe72d24ab23fa1533e Author: Babu Moger Date: Fri Sep 5 16:34:17 2025 -0500 fs/resctrl: Add the functionality to unassign MBM events The "mbm_event" counter assignment mode offers "num_mbm_cntrs" number of counters that can be assigned to RMID, event pairs and monitor bandwidth usage as long as it is assigned. If all the counters are in use, the kernel logs the error message "Failed to allocate counter for in domain " in /sys/fs/resctrl/info/last_cmd_status when a new assignment is requested. To make space for a new assignment, users must unassign an already assigned counter and retry the assignment again. Add the functionality to unassign and free the counters in the domain. Also, add the helper rdtgroup_unassign_cntrs() to unassign counters in the group. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit bd85310efd71b9e7809e1b95fe7a60fde42e62db Author: Babu Moger Date: Fri Sep 5 16:34:16 2025 -0500 fs/resctrl: Add the functionality to assign MBM events When supported, "mbm_event" counter assignment mode offers "num_mbm_cntrs" number of counters that can be assigned to RMID, event pairs and monitor bandwidth usage as long as it is assigned. Add the functionality to allocate and assign a counter to an RMID, event pair in the domain. Also, add the helper rdtgroup_assign_cntrs() to assign counters in the group. Log the error message "Failed to allocate counter for in domain " in /sys/fs/resctrl/info/last_cmd_status if all the counters are in use. Exit on the first failure when assigning counters across all the domains. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit f7a4fb22312646329ba21bc58958fd83fb9fc15d Author: Babu Moger Date: Fri Sep 5 16:34:15 2025 -0500 x86,fs/resctrl: Implement resctrl_arch_config_cntr() to assign a counter with ABMC The ABMC feature allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. Implement an x86 architecture-specific handler to configure a counter. This architecture specific handler is called by resctrl fs when a counter is assigned or unassigned as well as when an already assigned counter's configuration should be updated. Configure counters by writing to the L3_QOS_ABMC_CFG MSR, specifying the counter ID, bandwidth source (RMID), and event configuration. The ABMC feature details are documented in APM [1] available from [2]. [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3.3 Assignable Bandwidth Monitoring (ABMC). Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit 54ba9071a04b0d05086826c442c2de5830fce5bf Author: Kaushlendra Kumar Date: Fri Sep 12 22:06:08 2025 +0200 ACPICA: acpidump: fix return values in ap_is_valid_checksum() The function ap_is_valid_checksum() has a boolean name suggesting it should return TRUE/FALSE, but incorrectly returns AE_OK on success and has no explicit return on failure, leading to undefined behavior. Fix by returning proper values: - FALSE when checksum validation fails - TRUE when checksum validation succeeds Link: https://github.com/acpica/acpica/commit/479ba862 Signed-off-by: Kaushlendra Kumar Signed-off-by: Rafael J. Wysocki commit 81f92cff6d423f86ed7cbc9d7fa967c6c92f2fa8 Author: Saket Dumbre Date: Fri Sep 12 22:05:01 2025 +0200 ACPICA: ACPI_TYPE_ANY does not include the package type So add it to the list of acceptable Arg3 types for _DSM. Link: https://github.com/acpica/acpica/commit/6eb81e7c Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki commit eddf12041ddd8c40289015f42285c5ac614b5c30 Author: Davidlohr Bueso Date: Fri Sep 12 22:04:04 2025 +0200 ACPICA: CEDT: Add Back-Invalidate restriction to CXL Window This is added in newer version (3.0+) of the CXL Spec to support the HDM-DB coherency model. Link: https://github.com/acpica/acpica/commit/a6886da1 Signed-off-by: Davidlohr Bueso Signed-off-by: Rafael J. Wysocki commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f Author: Dmitry Antipov Date: Fri Sep 12 22:03:16 2025 +0200 ACPICA: Fix largest possible resource descriptor index ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be clamped incorrectly and resulting value may issue an out-of-bounds access for 'acpi_gbl_resource_types' array. Compile tested only. Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") Link: https://github.com/acpica/acpica/commit/cf00116c Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 Signed-off-by: Dmitry Antipov Signed-off-by: Rafael J. Wysocki commit b0fb6891b8ad55cb5767edf94351ffe4f0b9a404 Author: Saket Dumbre Date: Fri Sep 12 22:02:32 2025 +0200 ACPICA: Update version to 20250807 Link: https://github.com/acpica/acpica/commit/0845a773 Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki commit e2c80b3c23782d809b4e15da7d8a0135a8d350b5 Author: Saket Dumbre Date: Fri Sep 12 22:01:52 2025 +0200 ACPICA: Print error messages for too few or too many arguments Fix Issue #1027 by displaying error messages when there are too few or too many arguments in the caller vs the definition of an ASL/AML method. Link: https://github.com/acpica/acpica/commit/cbc243e4 Reported-by: Peter Williams Signed-off-by: Rafael J. Wysocki Tested-by: Hans de Goede Signed-off-by: Saket Dumbre commit 761dc71c6020d6aa68666e96373342d49a7e9d0a Author: Saket Dumbre Date: Fri Sep 12 22:01:04 2025 +0200 ACPICA: Update dsmethod.c to get rid of unused variable warning All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about the unused variable i after the removal of its usage by PR #1031 addressing Issue #1027 Link: https://github.com/acpica/acpica/commit/6d235320 Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 Author: Hans de Goede Date: Fri Sep 12 22:00:17 2025 +0200 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more. After correcting the for loop to check `i < this_walk_state->num_operands` the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this. Link: https://github.com/acpica/acpica/commit/53fc0220 Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 22c65572eff14a6e9546a9dbaa333619eb5505ab Author: Ahmed Salem Date: Fri Sep 12 21:59:17 2025 +0200 ACPICA: Debugger: drop ACPI_NONSTRING attribute from name_seg ACPICA commit 4623b3369f3aa1ec5229d461e91c514510a96912 Partially revert commit 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") as I've yet again incorrectly applied the ACPI_NONSTRING attribute where it is not needed. A warning was initially reported by Collin Funk [1], and further review by Jiri Slaby [2] highlighted another issue related to the same commit. Drop the ACPI_NONSTRING attribute to fix the issue. Fixes: 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") Link: https://lore.kernel.org/all/87ecvpcypw.fsf@gmail.com [1] Link: https://lore.kernel.org/all/5c210121-c9b8-4458-b1ad-0da24732ac72@kernel.org [2] Link: https://github.com/acpica/acpica/commit/4623b336 Reported-by: Jiri Slaby Signed-off-by: Ahmed Salem Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit 16ae95800b1cc46c0d69d8d90c9c7be488421a40 Author: Ahmed Salem Date: Fri Sep 12 21:58:25 2025 +0200 ACPICA: acpidump: drop ACPI_NONSTRING attribute from file_name Partially revert commit 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") as I've yet again incorrectly applied the ACPI_NONSTRING attribute where it is not needed. A warning was initially reported by Collin Funk [1], and further review by Jiri Slaby [2] highlighted another issue related to the same commit. Drop the ACPI_NONSTRING attribute to fix the issue. Fixes: 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") Link: https://lore.kernel.org/all/87ecvpcypw.fsf@gmail.com [1] Link: https://lore.kernel.org/all/5c210121-c9b8-4458-b1ad-0da24732ac72@kernel.org [2] Link: https://github.com/acpica/acpica/commit/a6ee09ca Reported-by: Collin Funk Signed-off-by: Ahmed Salem Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit 4b020eff6633af45fd714ff08cec95341da834ad Author: Ahmed Salem Date: Fri Sep 12 21:56:18 2025 +0200 ACPICA: iASL: Fix printing CDAT table header When disassembling CDAT AML, the lack of CDAT's common ACPI table header should be taken into consideration when printing the table's actual header. As the table header lacks fields like Signature, header information is mangled and incorrect: # $ iasl -d -ds CDAT cdat.aml # Input file cdat.aml, Length 0xE4 (228) bytes # ACPI: ? 0x0000000000000000 000C01 (v00 ? 00180000 ?? 23456789) Both Signature and Length are printed incorrectly, and the remaining fields are not applicable for this special table. To fix this, verify acpi_gbl_CDAT is set (<-ds CDAT> via command line) and Header->Signature is an invalid nameseg (due to the presence of non-ASCII char(s)), then print only the explicitly-passed signature (ACPI_SIG_CDAT) and the table length as cast with a pointer to the struct acpi_table_cdat structure. Link: https://github.com/acpica/acpica/commit/2b5586b4 Signed-off-by: Ahmed Salem Signed-off-by: Rafael J. Wysocki commit 12fd607554c4efb4856959f0e5823f541bc0e701 Author: Ahmed Salem Date: Fri Sep 12 21:55:35 2025 +0200 ACPICA: Apply ACPI_NONSTRING Add ACPI_NONSTRING for destination char arrays without a terminating NUL character. This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") where a few more destination arrays were missed. Link: https://github.com/acpica/acpica/commit/f359e5ed Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") Signed-off-by: Ahmed Salem Signed-off-by: Rafael J. Wysocki commit feb8ae81b2378b75a99c81d315602ac8918ed382 Author: Huacai Chen Date: Fri Sep 12 21:54:53 2025 +0200 ACPICA: Allow to skip Global Lock initialization Introduce acpi_gbl_use_global_lock, which allows to skip the Global Lock initialization. This is useful for systems without Global Lock (such as loong_arch), so as to avoid error messages during boot phase: ACPI Error: Could not enable global_lock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) Link: https://github.com/acpica/acpica/commit/463cb0fe Signed-off-by: Huacai Chen Signed-off-by: Rafael J. Wysocki commit 9d2f57fee5a0bf5b3f7ef690ba90d8d8ba1c0c96 Author: Zhe Qiao Date: Fri Sep 12 21:54:07 2025 +0200 ACPICA: Change the compilation conditions To prevent the risk of undefined variables. Link: https://github.com/acpica/acpica/commit/9f86d4c9 Signed-off-by: Zhe Qiao Signed-off-by: Rafael J. Wysocki commit 2926d3753aa1d839df8a6a349c713c1ebcbf8087 Author: Zhe Qiao Date: Fri Sep 12 21:53:30 2025 +0200 ACPICA: Remove redundant "#ifdef" definitions Link: https://github.com/acpica/acpica/commit/204776a3 Signed-off-by: Zhe Qiao Signed-off-by: Rafael J. Wysocki commit 3104fc98cba139e55107df6c2e60593423a5a799 Author: Zhe Qiao Date: Fri Sep 12 21:52:39 2025 +0200 ACPICA: Modify variable definition position To prevent potential undefined risks. Link: https://github.com/acpica/acpica/commit/efc4d8ab Signed-off-by: Zhe Qiao Signed-off-by: Rafael J. Wysocki commit ebebda853633de389ba2c6737f8ca38405713e90 Author: Babu Moger Date: Fri Sep 5 16:34:14 2025 -0500 fs/resctrl: Introduce event configuration field in struct mon_evt When supported, mbm_event counter assignment mode allows the user to configure events to track specific types of memory transactions. Introduce an evt_cfg field in struct mon_evt to define the type of memory transactions tracked by a monitoring event. Also add a helper function to get the evt_cfg value. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 84ecefb766748916099f5b7444a973a623611d63 Author: Babu Moger Date: Fri Sep 5 16:34:13 2025 -0500 x86/resctrl: Add data structures and definitions for ABMC assignment The ABMC feature allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. The ABMC feature implements an MSR L3_QOS_ABMC_CFG (C000_03FDh). ABMC counter assignment is done by setting the counter id, bandwidth source (RMID) and bandwidth configuration. Attempts to read or write the MSR when ABMC is not enabled will result in a #GP(0) exception. Introduce the data structures and definitions for MSR L3_QOS_ABMC_CFG (0xC000_03FDh): ========================================================================= Bits Mnemonic Description Access Reset Type Value ========================================================================= 63 CfgEn Configuration Enable R/W 0 62 CtrEn Enable/disable counting R/W 0 61:53 – Reserved MBZ 0 52:48 CtrID Counter Identifier R/W 0 47 IsCOS BwSrc field is a CLOSID R/W 0 (not an RMID) 46:44 – Reserved MBZ 0 43:32 BwSrc Bandwidth Source R/W 0 (RMID or CLOSID) 31:0 BwType Bandwidth configuration R/W 0 tracked by the CtrID ========================================================================== The ABMC feature details are documented in APM [1] available from [2]. [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3.3 Assignable Bandwidth Monitoring (ABMC). [ bp: Touchups. ] Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit 16ff6b038fb3b64aa033efdc95d673239610e1a6 Author: Babu Moger Date: Fri Sep 5 16:34:12 2025 -0500 fs/resctrl: Introduce interface to display number of free MBM counters Introduce the "available_mbm_cntrs" resctrl file to display the number of counters available for assignment in each domain when "mbm_event" mode is enabled. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 4d32c24a74f2c12ff440d381ba01de574f6631ce Author: Babu Moger Date: Fri Sep 5 16:34:11 2025 -0500 fs/resctrl: Introduce mbm_cntr_cfg to track assignable counters per domain The "mbm_event" counter assignment mode allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. Counters are assigned/unassigned at monitoring domain level. Manage a monitoring domain's hardware counters using a per monitoring domain array of struct mbm_cntr_cfg that is indexed by the hardware counter ID. A hardware counter's configuration contains the MBM event ID and points to the monitoring group that it is assigned to, with a NULL pointer meaning that the hardware counter is available for assignment. There is no direct way to determine which hardware counters are assigned to a particular monitoring group. Check every entry of every hardware counter configuration array in every monitoring domain to query which MBM events of a monitoring group is tracked by hardware. Such queries are acceptable because of a very small number of assignable counters (32 to 64). Suggested-by: Peter Newman Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 8c793336eaf8893a29626155d74615fe9f03e7f2 Author: Babu Moger Date: Fri Sep 5 16:34:10 2025 -0500 fs/resctrl: Add resctrl file to display number of assignable counters The "mbm_event" counter assignment mode allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. Create 'num_mbm_cntrs' resctrl file that displays the number of counters supported in each domain. 'num_mbm_cntrs' is only visible to user space when the system supports "mbm_event" mode. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 3b497c3f4f0427d940ec5c8600e840c8adc5cfbf Author: Babu Moger Date: Fri Sep 5 16:34:09 2025 -0500 fs/resctrl: Introduce the interface to display monitoring modes Introduce the resctrl file "mbm_assign_mode" to list the supported counter assignment modes. The "mbm_event" counter assignment mode allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. Each event within a resctrl group can be assigned independently in this mode. On AMD systems "mbm_event" mode is backed by the ABMC (Assignable Bandwidth Monitoring Counters) hardware feature and is enabled by default. The "default" mode is the existing mode that works without the explicit counter assignment, instead relying on dynamic counter assignment by hardware that may result in hardware not dedicating a counter resulting in monitoring data reads returning "Unavailable". Provide an interface to display the monitor modes on the system. $ cat /sys/fs/resctrl/info/L3_MON/mbm_assign_mode [mbm_event] default Add IS_ENABLED(CONFIG_RESCTRL_ASSIGN_FIXED) check to support Arm64. On x86, CONFIG_RESCTRL_ASSIGN_FIXED is not defined. On Arm64, it will be defined when the "mbm_event" mode is supported. Add IS_ENABLED(CONFIG_RESCTRL_ASSIGN_FIXED) check early to ensure the user interface remains compatible with upcoming Arm64 support. IS_ENABLED() safely evaluates to 0 when the configuration is not defined. As a result, for MPAM, the display would be either: [default] or [mbm_event] Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit faebbc58cde9d8f6050ac152c34c88195ed4abaa Author: Babu Moger Date: Fri Sep 5 16:34:08 2025 -0500 x86/resctrl: Add support to enable/disable AMD ABMC feature Add the functionality to enable/disable the AMD ABMC feature. The AMD ABMC feature is enabled by setting enabled bit(0) in the L3_QOS_EXT_CFG MSR. When the state of ABMC is changed, the MSR needs to be updated on all the logical processors in the QOS Domain. Hardware counters will reset when ABMC state is changed. [ bp: Massage commit message. ] Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit 13390861b426e936db20d675804a5b405622bc79 Author: Babu Moger Date: Fri Sep 5 16:34:07 2025 -0500 x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details ABMC feature details are reported via CPUID Fn8000_0020_EBX_x5. Bits Description 15:0 MAX_ABMC Maximum Supported Assignable Bandwidth Monitoring Counter ID + 1 The ABMC feature details are documented in APM [1] available from [2]. [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3.3 Assignable Bandwidth Monitoring (ABMC). Detect the feature and number of assignable counters supported. For backward compatibility, upon detecting the assignable counter feature, enable the mbm_total_bytes and mbm_local_bytes events that users are familiar with as part of original L3 MBM support. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit e3e661253e82b20467b0d6eb5ff34f5c9c9ccdc8 Merge: 5136380b74f1e5 0115d063559fa6 Author: Rafael J. Wysocki Date: Mon Sep 15 12:07:49 2025 +0200 Merge branch 'thermal-intel' Intel int340x thermal driver changes for 6.18: - Add support for new "power slider" firmware interface to the int340x thermal driver end enable it for Panther Lake platforms (Srinivas Pandruvada) - Remove a redundant ACPI control method evaluation from the int340x thermal driver (Salah Triki) and clean it up. * thermal-intel: thermal: intel: selftests: workload_hint: Mask unsupported types thermal: intel: int340x: Add module parameter to change slider offset thermal: intel: int340x: Add module parameter for balanced Slider thermal: intel: int340x: Enable power slider interface for Panther Lake thermal: intel: int340x: Add support for power slider thermal: intel: int340x: Remove redundant acpi_has_method() call commit 5ad68c8f965fed78c61f2ac7aea933f06bb50032 Author: Babu Moger Date: Fri Sep 5 16:34:06 2025 -0500 x86,fs/resctrl: Consolidate monitoring related data from rdt_resource The cache allocation and memory bandwidth allocation feature properties are consolidated into struct resctrl_cache and struct resctrl_membw respectively. In preparation for more monitoring properties that will clobber the existing resource struct more, re-organize the monitoring specific properties to also be in a separate structure. Also convert "bandwidth sources" terminology to "memory transactions" to have consistency within resctrl for related monitoring features. [ bp: Massage commit message. ] Suggested-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit bebf57bf054b561a62f3440142b2eddab2b0bbff Author: Babu Moger Date: Fri Sep 5 16:34:05 2025 -0500 x86/resctrl: Add ABMC feature in the command line options Add a kernel command-line parameter to enable or disable the exposure of the ABMC (Assignable Bandwidth Monitoring Counters) hardware feature to resctrl. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit e19c06219985f2beb9d71959d80f56e318abf744 Author: Babu Moger Date: Fri Sep 5 16:34:04 2025 -0500 x86/cpufeatures: Add support for Assignable Bandwidth Monitoring Counters (ABMC) Users can create as many monitor groups as RMIDs supported by the hardware. However, the bandwidth monitoring feature on AMD only guarantees that RMIDs currently assigned to a processor will be tracked by hardware. The counters of any other RMIDs which are no longer being tracked will be reset to zero. The MBM event counters return "Unavailable" for the RMIDs that are not tracked by hardware. So, there can be only limited number of groups that can give guaranteed monitoring numbers. With ever changing configurations there is no way to definitely know which of these groups are being tracked during a particular time. Users do not have the option to monitor a group or set of groups for a certain period of time without worrying about RMID being reset in between. The ABMC feature allows users to assign a hardware counter to an RMID, event pair and monitor bandwidth usage as long as it is assigned. The hardware continues to track the assigned counter until it is explicitly unassigned by the user. There is no need to worry about counters being reset during this period. Additionally, the user can specify the type of memory transactions (e.g., reads, writes) for the counter to track. Without ABMC enabled, monitoring will work in current mode without assignment option. The Linux resctrl subsystem provides an interface that allows monitoring of up to two memory bandwidth events per group, selected from a combination of available total and local events. When ABMC is enabled, two events will be assigned to each group by default, in line with the current interface design. Users will also have the option to configure which types of memory transactions are counted by these events. Due to the limited number of available counters (32), users may quickly exhaust the available counters. If the system runs out of assignable ABMC counters, the kernel will report an error. In such cases, users will need to unassign one or more active counters to free up counters for new assignments. resctrl will provide options to assign or unassign events through the group-specific interface file. The feature is detected via CPUID_Fn80000020_EBX_x00 bit 5: ABMC (Assignable Bandwidth Monitoring Counters). The ABMC feature details are documented in APM [1] available from [2]. [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3.3 Assignable Bandwidth Monitoring (ABMC). [ bp: Massage commit message, fixup enumeration due to VMSCAPE ] Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit bd03c7020d753f592fc0813481a27e245b0e4406 Merge: 449c9c02537a14 be82483d1b60ba Author: Rafael J. Wysocki Date: Mon Sep 15 12:03:26 2025 +0200 Merge back earlier material related to system sleep for 6.18 commit 1ebe8f7e782523e62cd1fa8237f7afba5d1dae83 Author: Christian Loehle Date: Sun Aug 31 22:43:57 2025 +0100 PM: EM: Fix late boot with holes in CPU topology Commit e3f1164fc9ee ("PM: EM: Support late CPUs booting and capacity adjustment") added a mechanism to handle CPUs that come up late by retrying when any of the `cpufreq_cpu_get()` call fails. However, if there are holes in the CPU topology (offline CPUs, e.g. nosmt), the first missing CPU causes the loop to break, preventing subsequent online CPUs from being updated. Instead of aborting on the first missing CPU policy, loop through all and retry if any were missing. Fixes: e3f1164fc9ee ("PM: EM: Support late CPUs booting and capacity adjustment") Suggested-by: Kenneth Crudup Reported-by: Kenneth Crudup Link: https://lore.kernel.org/linux-pm/40212796-734c-4140-8a85-854f72b8144d@panix.com/ Cc: 6.9+ # 6.9+ Signed-off-by: Christian Loehle Link: https://patch.msgid.link/20250831214357.2020076-1-christian.loehle@arm.com [ rjw: Drop the new pr_debug() message which is not very useful ] Signed-off-by: Rafael J. Wysocki commit 34d2eb4c1642b10714b59949808b41aedec994ba Merge: 971e2c87e4a9f6 7f3cfb7943d27a Author: Rafael J. Wysocki Date: Mon Sep 15 11:59:36 2025 +0200 Merge back earlier cpufreq material for 6.18 commit 83b039877310ae1eb614eef17b780df1e10d9fb5 Author: Tony Luck Date: Fri Sep 5 16:34:03 2025 -0500 x86,fs/resctrl: Prepare for more monitor events There's a rule in computer programming that objects appear zero, once, or many times. So code accordingly. There are two MBM events and resctrl is coded with a lot of if (local) do one thing if (total) do a different thing Change the rdt_mon_domain and rdt_hw_mon_domain structures to hold arrays of pointers to per event data instead of explicit fields for total and local bandwidth. Simplify by coding for many events using loops on which are enabled. Move resctrl_is_mbm_event() to so it can be used more widely. Also provide a for_each_mbm_event_id() helper macro. Cleanup variable names in functions touched to consistently use "eventid" for those with type enum resctrl_event_id. Signed-off-by: Tony Luck Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 63cc9811aa874e6fab671599ba93a989f4f93a5d Author: Tony Luck Date: Fri Sep 5 16:34:02 2025 -0500 x86/resctrl: Remove the rdt_mon_features global variable rdt_mon_features is used as a bitmask of enabled monitor events. A monitor event's status is now maintained in mon_evt::enabled with all monitor events' mon_evt structures found in the filesystem's mon_event_all[] array. Remove the remaining uses of rdt_mon_features. Signed-off-by: Tony Luck Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 7d9a0273c45962e9a6bc06f3b87eef7c431c1853 Author: Keir Fraser Date: Tue Sep 9 10:00:07 2025 +0000 KVM: Avoid synchronize_srcu() in kvm_io_bus_register_dev() Device MMIO registration may happen quite frequently during VM boot, and the SRCU synchronization each time has a measurable effect on VM startup time. In our experiments it can account for around 25% of a VM's startup time. Replace the synchronization with a deferred free of the old kvm_io_bus structure. Tested-by: Li RongQing Signed-off-by: Keir Fraser Signed-off-by: Marc Zyngier commit 7788255aba6545a27b8d143c5256536f8dfb2c0a Author: Keir Fraser Date: Tue Sep 9 10:00:06 2025 +0000 KVM: Implement barriers before accessing kvm->buses[] on SRCU read paths This ensures that, if a VCPU has "observed" that an IO registration has occurred, the instruction currently being trapped or emulated will also observe the IO registration. At the same time, enforce that kvm_get_bus() is used only on the update side, ensuring that a long-term reference cannot be obtained by an SRCU reader. Signed-off-by: Keir Fraser Signed-off-by: Marc Zyngier commit 11490b5ec6bc4fe3a36f90817bbc8021ba8b05cd Author: Keir Fraser Date: Tue Sep 9 10:00:05 2025 +0000 KVM: arm64: vgic: Explicitly implement vgic_dist::ready ordering In preparation to remove synchronize_srcu() from MMIO registration, remove the distributor's dependency on this implicit barrier by direct acquire-release synchronization on the flag write and its lock-free check. Signed-off-by: Keir Fraser Signed-off-by: Marc Zyngier commit 8810c6e7cca8fbfce7652b53e05acc465e671d28 Author: Keir Fraser Date: Tue Sep 9 10:00:04 2025 +0000 KVM: arm64: vgic-init: Remove vgic_ready() macro It is now used only within kvm_vgic_map_resources(). vgic_dist::ready is already written directly by this function, so it is clearer to bypass the macro for reads as well. Signed-off-by: Keir Fraser Signed-off-by: Marc Zyngier commit d257cc2e5c8bb8236cb161360d6c0529fd442712 Author: Tony Luck Date: Fri Sep 5 16:34:01 2025 -0500 x86,fs/resctrl: Replace architecture event enabled checks The resctrl file system now has complete knowledge of the status of every event. So there is no need for per-event function calls to check. Replace each of the resctrl_arch_is_{event}enabled() calls with resctrl_is_mon_event_enabled(QOS_{EVENT}). No functional change. Signed-off-by: Tony Luck Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Fenghua Yu Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 3064cee8c3f78ac800111e60bd04ddf87e565cfc Merge: ebdda44a2be98c 07aeb70707b1d5 Author: Marc Zyngier Date: Mon Sep 15 10:49:04 2025 +0100 Merge branch kvm-arm64/pkvm_vm_handle into kvmarm-master/next * kvm-arm64/pkvm_vm_handle: : pKVM VM handle allocation fixes, courtesy of Fuad Tabba. : : From the cover letter (20250909072437.4110547-1-tabba@google.com): : : "In pKVM, this handle is allocated when the VM is initialized at the : hypervisor, which is on the first vCPU run. However, the host starts : initializing the VM and setting up its data structures earlier. MMU : notifiers for the VMs are also registered before VM initialization at : the hypervisor, and rely on the handle to identify the VM. : : Therefore, there is a potential gap between when the VM is (partially) : setup at the host, but still without a valid pKVM handle to identify it : when communicating with the hypervisor." KVM: arm64: Reserve pKVM handle during pkvm_init_host_vm() KVM: arm64: Introduce separate hypercalls for pKVM VM reservation and initialization KVM: arm64: Consolidate pKVM hypervisor VM initialization logic KVM: arm64: Separate allocation and insertion of pKVM VM table entries KVM: arm64: Decouple hyp VM creation state from its handle KVM: arm64: Clarify comments to distinguish pKVM mode from protected VMs KVM: arm64: Rename 'host_kvm' to 'kvm' in pKVM host code KVM: arm64: Rename pkvm.enabled to pkvm.is_protected KVM: arm64: Add build-time check for duplicate DECLARE_REG use Signed-off-by: Marc Zyngier commit 07aeb70707b1d52968f4959a5dba321ea4219c8a Author: Fuad Tabba Date: Tue Sep 9 08:24:36 2025 +0100 KVM: arm64: Reserve pKVM handle during pkvm_init_host_vm() When a pKVM guest is active, TLB invalidations triggered by host MMU notifiers require a valid hypervisor handle. Currently, this handle is only allocated when the first vCPU is run. However, the guest's memory is associated with the host MMU much earlier, during kvm_arch_init_vm(). This creates a window where an MMU invalidation could occur after the kvm_pgtable pointer checked by the notifiers is set but before the pKVM handle has been created. Fix this by reserving the pKVM handle when the host VM is first set up. Move the call to the __pkvm_reserve_vm hypercall from the first-vCPU-run path into pkvm_init_host_vm(), which is called during initial VM setup. This ensures the handle is available before any subsystem can trigger an MMU notification for the VM. The VM destruction path is updated to call __pkvm_unreserve_vm for cases where a VM was reserved but never fully created at the hypervisor, ensuring the handle is properly released. This fix leverages the two-stage reservation/initialization hypercall interface introduced in preceding patches. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 256b4668cd890b741c54f83dbbef76ba847c23be Author: Fuad Tabba Date: Tue Sep 9 08:24:35 2025 +0100 KVM: arm64: Introduce separate hypercalls for pKVM VM reservation and initialization The existing __pkvm_init_vm hypercall performs both the reservation of a VM table entry and the initialization of the hypervisor VM state in a single operation. This design prevents the host from obtaining a VM handle from the hypervisor until all preparation for the creation and the initialization of the VM is done, which is on the first vCPU run operation. To support more flexible VM lifecycle management, the host needs the ability to reserve a handle early, before the first vCPU run. Refactor the hypercall interface to enable this, splitting the single hypercall into a two-stage process: - __pkvm_reserve_vm: A new hypercall that allocates a slot in the hypervisor's vm_table, marks it as reserved, and returns a unique handle to the host. - __pkvm_unreserve_vm: A corresponding cleanup hypercall to safely release the reservation if the host fails to proceed with full initialization. - __pkvm_init_vm: The existing hypercall is modified to no longer allocate a slot. It now expects a pre-reserved handle and commits the donated VM memory to that slot. For now, the host-side code in __pkvm_create_hyp_vm calls the new reserve and init hypercalls back-to-back to maintain existing behavior. This paves the way for subsequent patches to separate the reservation and initialization steps in the VM's lifecycle. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 814fd6beacf3c105ab8c8796be07d740952899fe Author: Fuad Tabba Date: Tue Sep 9 08:24:34 2025 +0100 KVM: arm64: Consolidate pKVM hypervisor VM initialization logic The insert_vm_table_entry() function was performing tasks beyond its primary responsibility. In addition to inserting a VM pointer into the vm_table, it was also initializing several fields within 'struct pkvm_hyp_vm', such as the VMID and stage-2 MMU pointers. This mixing of concerns made the code harder to follow. As another preparatory step towards allowing a VM table entry to be reserved before the VM is fully created, this logic must be cleaned up. By separating table insertion from state initialization, we can control the timing of the initialization step more precisely in subsequent patches. Refactor the code to consolidate all initialization logic into init_pkvm_hyp_vm(): - Move the initialization of the handle, VMID, and MMU fields from insert_vm_table_entry() to init_pkvm_hyp_vm(). - Simplify insert_vm_table_entry() to perform only one action: placing the provided pkvm_hyp_vm pointer into the vm_table. - Update the calling sequence in __pkvm_init_vm() to first allocate an entry in the VM table, initialize the VM, and then insert the VM into the VM table. This is all protected by the vm_table_lock for now. Subsequent patches will adjust the sequence and not hold the vm_table_lock while initializing the VM at the hypervisor (init_pkvm_hyp_vm()). Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 1abc1ad52989fcc45a0de68bc49656d9fd0c2d74 Author: Fuad Tabba Date: Tue Sep 9 08:24:33 2025 +0100 KVM: arm64: Separate allocation and insertion of pKVM VM table entries The current insert_vm_table_entry() function performs two actions at once: it finds a free slot in the pKVM VM table and populates it with the pkvm_hyp_vm pointer. Refactor this function as a preparatory step for future work that will require reserving a VM slot and its corresponding handle earlier in the VM lifecycle, before the pkvm_hyp_vm structure is initialized and ready to be inserted. Split the function into a two-phase process: - A new allocate_vm_table_entry() function finds an empty slot, marks it as reserved with a RESERVED_ENTRY placeholder, and returns a handle derived from the slot's index. - The insert_vm_table_entry() function is repurposed to take the handle, validate that the corresponding slot is in the reserved state, and then populate it with the pkvm_hyp_vm pointer. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 3c45b67625357ac680ee2508493b697cdcd78128 Author: Fuad Tabba Date: Tue Sep 9 08:24:32 2025 +0100 KVM: arm64: Decouple hyp VM creation state from its handle Currently, the presence of a pKVM handle (pkvm.handle != 0) is used to determine if the corresponding hypervisor (EL2) VM has been created and initialized. This couples the handle's lifecycle with the VM's creation state. This coupling will become problematic with upcoming changes that will allocate the pKVM handle earlier in the VM's life, before the VM is instantiated at the hypervisor. To prepare for this and make the state tracking explicit, decouple the two concepts. Introduce a new boolean flag, 'pkvm.is_created', to track whether the hypervisor-side VM has been created and initialized. A new helper, pkvm_hyp_vm_is_created(), is added to check this flag. All call sites that previously checked for the handle's existence are converted to use the new, explicit check. The 'is_created' flag is set to true upon successful creation in the hypervisor (EL2) and cleared upon destruction. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 070362648f5f546018747a9a1857c1597594934e Author: Fuad Tabba Date: Tue Sep 9 08:24:31 2025 +0100 KVM: arm64: Clarify comments to distinguish pKVM mode from protected VMs The hypervisor code for protected KVM contains comments that are imprecise and at times flat-out wrong. They often refer to a "protected VM" in contexts where the code or data structure applies to _any_ VM managed by the hypervisor when pKVM is enabled. For instance, the 'vm_table' holds handles for all VMs known to the hypervisor, not exclusively for those that are configured as protected. This inaccurate terminology can make the code scope harder to understand for future (and current) developers. Clarify the comments throughout the pKVM hypervisor code to make a clear distinction between the pKVM feature itself (i.e., "protected mode") and the VMs that are specifically configured to be protected. This involves replacing ambiguous uses of "protected VM" with more accurate phrasing. No functional change intended. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 604a5032b454bde03200d755f6ecc3f724511c6a Author: Fuad Tabba Date: Tue Sep 9 08:24:30 2025 +0100 KVM: arm64: Rename 'host_kvm' to 'kvm' in pKVM host code In hypervisor (EL2) code, it is important to distinguish between the host's 'struct kvm' and a protected VM's 'struct kvm'. Using 'host_kvm' as variable name in that context makes this distinction clear. However, in the host kernel code (EL1), there is no such ambiguity. The code is only ever concerned with the host's own 'struct kvm' instance. The 'host_' prefix is therefore redundant and adds unnecessary verbosity. Simplify the code by renaming the 'host_kvm' parameter to 'kvm' in all functions within host-side kernel code (EL1). This improves readability and makes the naming consistent with other host-side kernel code. No functional change intended. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 58dfb66b1e4cfb998db9e71437a2c0d9b83a93c0 Author: Fuad Tabba Date: Tue Sep 9 08:24:29 2025 +0100 KVM: arm64: Rename pkvm.enabled to pkvm.is_protected The 'pkvm.enabled' field in struct kvm_protected_vm is confusingly named. Its purpose is to indicate whether a VM is a _protected_ VM under pKVM, and not whether the VM itself is enabled or running. For a non-protected VM, the VM can be fully active and running, yet this field would be false. This ambiguity can lead to incorrect assumptions about the VM's operational state and makes the code harder to reason about. Rename the field to 'is_protected' to make it unambiguous that the flag tracks the protected status of the VM. No functional change intended. Reviewed-by: Kunwu Chan Signed-off-by: Fuad Tabba Reviewed-by: Kunwu Chan Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit f9ac33e45d57bc4aa365363ffb650c830e5bb325 Author: Fuad Tabba Date: Tue Sep 9 08:24:28 2025 +0100 KVM: arm64: Add build-time check for duplicate DECLARE_REG use The DECLARE_REG() macro provides a convenient way to create a local variable initialized from a cpu context in the hyp trap handlers. However, a common error is to use the macro multiple times in the same scope with the same register index, but for different logical purposes. This results in valid C code that compiles without error, but introduces subtle bugs where a developer expects two different variables to hold values from two different registers, when in fact they are both sourced from the same one. To prevent this entire class of bugs, modify the DECLARE_REG() macro to declare a dummy variable whose name is derived from the register index. If the macro is used again with the same index in the same scope, the compiler will fail with a "redeclaration of variable" error, turning a subtle runtime bug into an obvious build-time failure. Signed-off-by: Fuad Tabba Tested-by: Mark Brown Signed-off-by: Marc Zyngier commit 09f37134464cc03baf5cb8eab2d99db27ee73217 Author: Tony Luck Date: Fri Sep 5 16:34:00 2025 -0500 x86,fs/resctrl: Consolidate monitor event descriptions There are currently only three monitor events, all associated with the RDT_RESOURCE_L3 resource. Growing support for additional events will be easier with some restructuring to have a single point in file system code where all attributes of all events are defined. Place all event descriptions into an array mon_event_all[]. Doing this has the beneficial side effect of removing the need for rdt_resource::evt_list. Add resctrl_event_id::QOS_FIRST_EVENT for a lower bound on range checks for event ids and as the starting index to scan mon_event_all[]. Drop the code that builds evt_list and change the two places where the list is scanned to scan mon_event_all[] instead using a new helper macro for_each_mon_event(). Architecture code now informs file system code which events are available with resctrl_enable_mon_event(). Signed-off-by: Tony Luck Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Fenghua Yu Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/cover.1757108044.git.babu.moger@amd.com commit 0e58f6a7dd689c73d67e6a2164b46d4618f2698a Author: Shaopeng Tan Date: Mon Jun 23 16:50:50 2025 +0900 fs/resctrl: Optimize code in rdt_get_tree() schemata_list_destroy() has to be called if schemata_list_create() fails. rdt_get_tree() calls schemata_list_destroy() in two different ways: directly if schemata_list_create() itself fails and on the exit path via the out_schemata_free goto label. Remove schemata_list_destroy() call on schemata_list_create() failure. Use existing out_schemata_free goto label instead. Signed-off-by: Shaopeng Tan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Reviewed-by: James Morse Reviewed-by: Koba Ko Link: https://lore.kernel.org/20250623075051.3610592-1-tan.shaopeng@jp.fujitsu.com commit 8f2689f194b8d1bff41150ae316abdfccf191309 Author: Gustavo A. R. Silva Date: Tue Aug 12 23:35:41 2025 +0900 pwm: cros-ec: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warnings: drivers/pwm/pwm-cros-ec.c:53:40: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/pwm/pwm-cros-ec.c:87:40: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/aJtRPZpc-Lv-C6zD@kspp Signed-off-by: Uwe Kleine-König commit ebd524a3ac3a172aa26f99d20d4d00d57da9a875 Author: Ivaylo Ivanov Date: Sun Sep 14 16:20:33 2025 +0300 dt-bindings: pwm: samsung: add exynos8890 compatible Add samsung,exynos8890-pwm compatible string to binding document. Signed-off-by: Ivaylo Ivanov Link: https://lore.kernel.org/r/20250914132033.2622886-1-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Uwe Kleine-König commit d322a0e01d9ecc91881d7a6ad388a37a1a81471f Author: Janne Grunau Date: Thu Aug 28 16:01:39 2025 +0200 dt-bindings: pwm: apple,s5l-fpwm: Add t6020-fpwm compatible The PWM controller on Apple's M2 Pro/Max SoCs behaves in the same way as on previous M1 and M2 SoCs. Add its per SoC compatible. At the same time fix the order of existing entries. The sort order logic is having SoC numeric code families in release order, and SoCs within each family in release order: - t8xxx (Apple HxxP/G series, "phone"/"tablet" chips) - t8103 (Apple H13G/M1) - t8112 (Apple H14G/M2) - t6xxx (Apple HxxJ series, "desktop" chips) - t6000/t6001/t6002 (Apple H13J(S/C/D) / M1 Pro/Max/Ultra) - t6020/t6021/t6022 (Apple H14J(S/C/D) / M2 Pro/Max/Ultra) Note that SoCs of the t600[0-2] / t602[0-2] family share the t6000 / t6020 compatible where the hardware is 100% compatible, which is usually the case in this highly related set of SoCs. Signed-off-by: Janne Grunau Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250828-dt-apple-t6020-v1-20-507ba4c4b98e@jannau.net Signed-off-by: Uwe Kleine-König commit efedb508591e231b47b23ce6b353c81eeb3b9a84 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:31:11 2025 +0200 dt-bindings: pwm: nxp,lpc1850-sct-pwm: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250821083110.46420-2-krzysztof.kozlowski@linaro.org Signed-off-by: Uwe Kleine-König commit ce1116446098e183720ac529217889c88b964e0f Author: Uwe Kleine-König Date: Tue Jul 29 12:36:04 2025 +0200 pwm: pca9586: Convert to waveform API This allows to expose the duty_offset feature that the chip supports, and so also emit inverted polarity waveforms. The conversion from a waveform to hardware settings (and vice versa) is aligned to the usual rounding rules silencing warnings with PWM_DEBUG. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/1927d115ae6797858e6c4537971dacf1d563854f.1753784092.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 42f18ae36f3f262683739fed5fff9342a6954914 Author: Uwe Kleine-König Date: Tue Jul 29 12:36:03 2025 +0200 pwm: pca9685: Drop GPIO support The functionality will be restored after the driver is converted to the waveform API as the pwm core optionally provides a gpio chip for all pwm chips that support the waveform API. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/d975376fce9640c90ddc868e3722adeb83fff279.1753784092.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 3d4c42172380d287f118a14458ea9b418bbebefc Author: Uwe Kleine-König Date: Tue Jul 29 12:36:02 2025 +0200 pwm: pca9685: Make use of register caching in regmap This essentially only caches the PRESCALE register because the per channel registers are affected by the ALL configuration that is used by the virtual pwm #16. The PRESCALE register is read often so caching it saves quite some i2c transfers. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/dc25361908ad1dd790f108599bc9dbcc752288a5.1753784092.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit de5855613263b426ee697dd30224322f2e634dec Author: Uwe Kleine-König Date: Tue Jul 29 12:36:01 2025 +0200 pwm: pca9685: Use bulk write to atomicially update registers The output of a PWM channel is configured by four register values. Write them in a single i2c transaction to ensure glitch free updates. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/bfa8c0267c9ec059d0d77f146998d564654c75ca.1753784092.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit ca478d8a4b6d342e7df95bcba842301027a3b490 Author: Uwe Kleine-König Date: Tue Jul 29 12:36:00 2025 +0200 pwm: pca9685: Don't disable hardware in .free() It's the responsibility of the consumer to disable the hardware before it's released. And there are use cases where it's beneficial to keep the PWM on, e.g. to keep a backlight on before kexec()ing into a new kernel. Even if it would be considered right to disable on pwm_put(), this should be done in the core and not each individual driver. So drop the hardware access in .free(). Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/1ee1a514aeb5f0effafa2d6ec91bc54130895cd9.1753784092.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit d8af3812b1e8b3b02bdac2f74eda1463540edd61 Author: Ghennadi Procopciuc Date: Tue Aug 12 22:00:36 2025 +0200 pwm: Add the S32G support in the Freescale FTM driver The Automotive S32G2 and S32G3 platforms include two FTM timers for pwm. Each FTM has 6 PWM channels. The current Freescale FTM driver supports the iMX8 and the Vybrid Family FTM IP. The FTM IP found on the S32G platforms is almost identical except for the number of channels and the register mapping. These changes allow to deal with different number of channels and support the holes found in the register memory mapping for s32gx for suspend / resume. The fault register does not exist on the s32gx and at resume time all the mapping is wrote back leading to a kernel crash. /* restore all registers from cache */ regcache_cache_only(fpc->regmap, false); regcache_sync(fpc->regmap); The regmap callbacks 'writeable_reg()' and 'readable_reg()' will skip the address corresponding to a register which is not present. Tested on a s32g274-rdb2 J5 PWM pin output with signal visualization on oscilloscope. Signed-off-by: Ghennadi Procopciuc Co-developed-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250812200036.3432917-3-daniel.lezcano@linaro.org Signed-off-by: Uwe Kleine-König commit 3513752cfe6fc1cfb0d99b3b4c554eb56e8bf8a1 Author: Daniel Lezcano Date: Tue Aug 12 22:00:35 2025 +0200 dt-bindings: pwm: fsl,vf610-ftm-pwm: Add compatible for s32g2 and s32g3 The S32G2 and S32G3 have a FlexTimer (FTM) available which is the same as the one found on the Vybrid Family and the i.MX8. Add the compatibles in the bindings Signed-off-by: Daniel Lezcano Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250812200036.3432917-2-daniel.lezcano@linaro.org Signed-off-by: Uwe Kleine-König commit ed5902a2464834656f94f1c23fa61f99ea38f328 Author: Uwe Kleine-König Date: Fri Jul 25 17:45:11 2025 +0200 pwm: mediatek: Lock and cache clock rate This simplifies error handling and reduces the amount of clk_get_rate() calls. While touching the clk handling also allocate the clock array as part of driver data and lock the clock rate to ensure that the output doesn't change unexpectedly. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-17-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 849b064c16977202298ac411f80c83ea047fe466 Author: Uwe Kleine-König Date: Fri Jul 25 17:45:10 2025 +0200 pwm: mediatek: Fix various issues in the .apply() callback duty_cycle and period were silently cast from u64 to int losing relevant bits. Dividing by the result of a division (resolution) looses precision. clkdiv was determined using a loop while it can be done without one. Also too low period values were not catched. Improve all these issues. Handling period and duty_cycle being u64 now requires a bit more care to prevent overflows, so mul_u64_u64_div_u64() is used. The changes implemented in this change also align the chosen hardware settings to match the usual PWM rules (i.e. round down instead round nearest) and so .apply() also matches .get_state() silencing several warnings with PWM_DEBUG=y. While this probably doesn't result in problems, this aspect makes this change---though it might be considered a fix---unsuitable for backporting. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-16-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit edd6a37e06f381af9a05c813a822ac8528da0fca Author: Uwe Kleine-König Date: Fri Jul 25 17:45:09 2025 +0200 pwm: mediatek: Implement .get_state() callback The registers can be read out just fine on an MT8365. In the assumption that this works on all supported devices, a .get_state() callback can be implemented. This enables consumers to make use of pwm_get_state_hw() and improves the usefulness of /sys/kernel/debug/pwm. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-15-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit a911f15745fd4a93381b52acea3083e7e9fd135a Author: Uwe Kleine-König Date: Fri Jul 25 17:45:08 2025 +0200 pwm: mediatek: Initialize clks when the hardware is enabled at probe time When a PWM is already configured by the bootloader (e.g. to power a backlight), the clk enable count must be increased to keep clock usage balanced. So check which PWMs are enabled during probe and enable the respective clocks. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-14-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit f43e1280731c2a6bbd2d9517fd6b726d6ebe6641 Author: Uwe Kleine-König Date: Fri Jul 25 17:45:07 2025 +0200 pwm: mediatek: Rework parameters for clk helper function Convert pwm_mediatek_clk_enable() and pwm_mediatek_clk_disable() to take lower level parameters. This enables these functions to be used in the next commit when there is no valid pwm_chip and pwm_device yet. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-13-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 88863c9d81bb043bd02f70be6cb629494cac4225 Author: Uwe Kleine-König Date: Fri Jul 25 17:45:06 2025 +0200 pwm: mediatek: Introduce and use a few more register defines Instead of using a magic constant for bound checking, derive the numbers from appropriate register defines. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-12-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit c95ab56a7ad6e6ae2be93591287fd9b25027fe38 Author: Uwe Kleine-König Date: Fri Jul 25 17:45:05 2025 +0200 pwm: mediatek: Simplify representation of channel offsets The general register layout contains some per-chip registers starting at offset 0 and then at a higher address there are n nearly identical and equidistant blocks for the registers of the n channels. This allows to represent the offsets of per-channel registers as $base + i * $width instead of listing all (or too many) offsets explicitly in an array. So for a small additional effort in pwm_mediatek_writel() the three arrays with the channel offsets can be dropped. The size changes according to bloat-o-meter are: add/remove: 0/3 grow/shrink: 1/0 up/down: 12/-96 (-84) Function old new delta pwm_mediatek_apply 696 708 +12 mtk_pwm_reg_offset_v3 32 - -32 mtk_pwm_reg_offset_v2 32 - -32 mtk_pwm_reg_offset_v1 32 - -32 Total: Before=5347, After=5263, chg -1.57% Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250725154506.2610172-11-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit a2f77ae4778d1eef2d273683ccc09fa971111c8c Author: Uwe Kleine-König Date: Wed Jul 30 10:02:20 2025 +0200 pwm: tiecap: Document behaviour of hardware disable According to David Lechner[1] disabling a tiecap PWM makes the PWM pin an input. The reported problem is fixed in commit deaeeda2051f ("backlight: pwm_bl: Don't rely on a disabled PWM emiting inactive state"). Document the behaviour in the driver for future reference. [1] https://lore.kernel.org/linux-pwm/39a472c0-ba24-de7b-8783-a16a71b172cd@lechnology.com Signed-off-by: Uwe Kleine-König Reviewed-by: David Lechner Link: https://lore.kernel.org/r/20250730080219.183181-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit e7c9b66b106989aeb17b167f5bbea9a108d26c0d Author: Uwe Kleine-König Date: Thu Jul 17 17:11:16 2025 +0200 pwm: Provide a gpio device for waveform drivers A PWM is a more general concept than an output-only GPIO. When using duty_length = period_length the PWM looks like an active GPIO, with duty_length = 0 like an inactive GPIO. With the waveform abstraction there is enough control over the configuration to ensure that PWMs that cannot generate a constant signal at both levels error out. The pwm-pca9685 driver already provides a gpio chip. When this driver is converted to the waveform callbacks, the gpio part can just be dropped. Signed-off-by: Uwe Kleine-König Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250717151117.1828585-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit b871d093f1caebeb39b12136a33e7529b8fdea50 Author: Uwe Kleine-König Date: Tue Jul 8 19:18:01 2025 +0200 pwm: Check actual period and duty_cycle for ignored polarity test When a lowlevel driver configures the wrong period that might (historically) be ok if the emitted signal has a 100% relative duty_cycle as that just corresponds to rounding down the duty_cycle to 0 which is an allowed thing to do for a lowlevel driver. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/bc511c0250ea2f6390e4209ab1ea9c08a3c18612.1751994988.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 5364e70b013c204088dfcd888a5517a81f0b1836 Author: Uwe Kleine-König Date: Tue Jul 8 19:18:00 2025 +0200 pwm: Disable PWM_DEBUG check for disabled states When a PWM is requested to be disabled, the result is unspecified, the only intention is to save some power. So skip all checks in this case. All but two checks already only triggered for states with .enabled = true. The first resulted in some false positive diagnostics, the other checked for a condition that depending on hardware might not be implementable. Similar if the lowlevel driver disabled the hardware this might be a valid reaction and with .enabled = false all other state parameters are unreliable, so skip further tests in this case, too. All later usages of .enabled can be assumed to yield true, and so several if conditions can be simplified. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/16d29212b09b66c286c1232b1ab0ec0f8d510aae.1751994988.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 09cbe54681241ac67ca595743d29f7da85363928 Author: Uwe Kleine-König Date: Tue May 27 22:58:22 2025 +0200 dt-bindings: timer: renesas,rz-mtu3: Use #pwm-cells = <3> With the goal to unify all PWM bindings to use #pwm-cells = <3> update the renesas,rz-mtu3 binding accordingly. Keep <2> documented as a deprecated value at least until the in-tree device trees are fixed accordingly. Signed-off-by: Uwe Kleine-König Acked-by: Rob Herring (Arm) Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20250527205823.377785-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d Author: Uwe Kleine-König Date: Mon Aug 11 18:01:02 2025 +0200 pwm: tiehrpwm: Fix corner case in clock divisor calculation The function set_prescale_div() is responsible for calculating the clock divisor settings such that the input clock rate is divided down such that the required period length is at most 0x10000 clock ticks. If period_cycles is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is good enough. So round up in the calculation of the required divisor and compare it using >= instead of >. Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 Author: Uwe Kleine-König Date: Mon Aug 11 18:01:01 2025 +0200 pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation In Up-Count Mode the timer is reset to zero one tick after it reaches TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both the documentation and measurements. So the value written to the TBPRD has to be one less than the calculated period_cycles value. A complication here is that for a 100% relative duty-cycle the value written to the CMPx register has to be TBPRD + 1 which might overflow if TBPRD is 0xffff. To handle that the calculation of the AQCTLx register has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to be skipped. Additionally the AQCTL_PRD register field has to be 0 because that defines the hardware's action when the maximal counter value is reached, which is (as above) one clock tick before the period's end. The period start edge has to happen when the counter is reset and so is defined in the AQCTL_ZRO field. Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 Author: Uwe Kleine-König Date: Mon Aug 11 18:01:00 2025 +0200 pwm: tiehrpwm: Make code comment in .free() more useful Instead of explaining trivia to everyone who can read C describe the higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero. Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 Author: Uwe Kleine-König Date: Mon Aug 11 18:00:59 2025 +0200 pwm: tiehrpwm: Don't drop runtime PM reference in .free() The pwm driver calls pm_runtime_get_sync() when the hardware becomes enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's state is kept when a consumer goes away, so the call to pm_runtime_put_sync() in the .free() callback is unbalanced resulting in a non-functional device and a reference underlow for the second consumer. The easiest fix for that issue is to just not drop the runtime PM reference in .free(), so do that. Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit afe872274edc7da46719a2029bfa4eab142b15f6 Author: Colin Ian King Date: Tue Sep 2 14:03:48 2025 +0100 pwm: Fix incorrect variable used in error message The dev_err message is reporting the incorrect return value ret_tohw, it should be reporting the value in ret_fromhw. Fix this by using ret_fromhw instead of ret_tohw. Fixes: 6c5126c6406d ("pwm: Provide new consumer API functions for waveforms") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250902130348.2630053-1-colin.i.king@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit 3a4b9d027e4061766f618292df91760ea64a1fcc Author: Jisheng Zhang Date: Tue Aug 19 19:42:24 2025 +0800 pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kernel panic during suspend/resume. Fixes: bbf0722c1c66 ("pwm: berlin: Add suspend/resume support") Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250819114224.31825-1-jszhang@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit 75604e9a5b60707722028947d6dc6bdacb42282e Author: Xi Ruoyao Date: Sat Aug 16 18:49:05 2025 +0800 pwm: loongson: Fix LOONGSON_PWM_FREQ_DEFAULT Per the 7A1000 and 7A2000 user manual, the clock frequency of their PWM controllers is 50 MHz, not 50 kHz. Fixes: 2b62c89448dd ("pwm: Add Loongson PWM controller support") Signed-off-by: Xi Ruoyao Reviewed-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250816104904.4779-2-xry111@xry111.site Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit 2ba972bf71cb71d2127ec6c3db1ceb6dd0c73173 Author: Ben Horgan Date: Fri Aug 15 17:26:55 2025 +0100 KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG then the debug checking in assert_host_shared_guest() fails on the launch of an np-guest. This WARN_ON() causes a panic and generates the stack below. In __pkvm_host_relax_perms_guest() the debug checking assumes the mapping is a single page but it may be a block map. Update the checking so that the size is not checked and just assumes the correct size. While we're here make the same fix in __pkvm_host_mkyoung_guest(). Info: # lkvm run -k /share/arch/arm64/boot/Image -m 704 -c 8 --name guest-128 Info: Removed ghost socket file "/.lkvm//guest-128.sock". [ 1406.521757] kvm [141]: nVHE hyp BUG at: arch/arm64/kvm/hyp/nvhe/mem_protect.c:1088! [ 1406.521804] kvm [141]: nVHE call trace: [ 1406.521828] kvm [141]: [] __kvm_nvhe_hyp_panic+0xb4/0xe8 [ 1406.521946] kvm [141]: [] __kvm_nvhe_assert_host_shared_guest+0xb0/0x10c [ 1406.522049] kvm [141]: [] __kvm_nvhe___pkvm_host_relax_perms_guest+0x48/0x104 [ 1406.522157] kvm [141]: [] __kvm_nvhe_handle___pkvm_host_relax_perms_guest+0x64/0x7c [ 1406.522250] kvm [141]: [] __kvm_nvhe_handle_trap+0x8c/0x1a8 [ 1406.522333] kvm [141]: [] __kvm_nvhe___skip_pauth_save+0x4/0x4 [ 1406.522454] kvm [141]: ---[ end nVHE call trace ]--- [ 1406.522477] kvm [141]: Hyp Offset: 0xfffece8013600000 [ 1406.522554] Kernel panic - not syncing: HYP panic: [ 1406.522554] PS:834003c9 PC:0000b1806db6d170 ESR:00000000f2000800 [ 1406.522554] FAR:ffff8000804be420 HPFAR:0000000000804be0 PAR:0000000000000000 [ 1406.522554] VCPU:0000000000000000 [ 1406.523337] CPU: 3 UID: 0 PID: 141 Comm: kvm-vcpu-0 Not tainted 6.16.0-rc7 #97 PREEMPT [ 1406.523485] Hardware name: FVP Base RevC (DT) [ 1406.523566] Call trace: [ 1406.523629] show_stack+0x18/0x24 (C) [ 1406.523753] dump_stack_lvl+0xd4/0x108 [ 1406.523899] dump_stack+0x18/0x24 [ 1406.524040] panic+0x3d8/0x448 [ 1406.524184] nvhe_hyp_panic_handler+0x10c/0x23c [ 1406.524325] kvm_handle_guest_abort+0x68c/0x109c [ 1406.524500] handle_exit+0x60/0x17c [ 1406.524630] kvm_arch_vcpu_ioctl_run+0x2e0/0x8c0 [ 1406.524794] kvm_vcpu_ioctl+0x1a8/0x9cc [ 1406.524919] __arm64_sys_ioctl+0xac/0x104 [ 1406.525067] invoke_syscall+0x48/0x10c [ 1406.525189] el0_svc_common.constprop.0+0x40/0xe0 [ 1406.525322] do_el0_svc+0x1c/0x28 [ 1406.525441] el0_svc+0x38/0x120 [ 1406.525588] el0t_64_sync_handler+0x10c/0x138 [ 1406.525750] el0t_64_sync+0x1ac/0x1b0 [ 1406.525876] SMP: stopping secondary CPUs [ 1406.525965] Kernel Offset: disabled [ 1406.526032] CPU features: 0x0000,00000080,8e134ca1,9446773f [ 1406.526130] Memory Limit: none [ 1406.959099] ---[ end Kernel panic - not syncing: HYP panic: [ 1406.959099] PS:834003c9 PC:0000b1806db6d170 ESR:00000000f2000800 [ 1406.959099] FAR:ffff8000804be420 HPFAR:0000000000804be0 PAR:0000000000000000 [ 1406.959099] VCPU:0000000000000000 ] Signed-off-by: Ben Horgan Fixes: f28f1d02f4eaa ("KVM: arm64: Add a range to __pkvm_host_unshare_guest()") Cc: Vincent Donnefort Cc: Quentin Perret Cc: Ryan Roberts Cc: stable@vger.kernel.org Reviewed-by: Vincent Donnefort Signed-off-by: Marc Zyngier commit ebdda44a2be98ce7fb9e267867d8f6dcdb62f25d Merge: b320789d6883cc 162190f2ccdc59 Author: Marc Zyngier Date: Mon Sep 15 10:27:28 2025 +0100 Merge branch kvm-arm64/ffa-1.2 into kvmarm-master/next * kvm-arm64/ffa-1.2: : . : FFA 1.2 support for pKVM, courtesy of Per Larsen. : : From the cover letter at [1]: : : "The FF-A 1.2 specification introduces a new SEND_DIRECT2 ABI which : allows registers x4-x17 to be used for the message payload. This patch : set prevents the host from using a lower FF-A version than what has : already been negotiated with the hypervisor. This is necessary because : the hypervisor does not have the necessary compatibility paths to : translate from the hypervisor FF-A version to a previous version." : : [1] https://lore.kernel.org/r/20250820-virtio-msg-ffa-v11-0-497ef43550a3@google.com : . KVM: arm64: Bump the supported version of FF-A to 1.2 KVM: arm64: Mask response to FFA_FEATURE call KVM: arm64: Mark optional FF-A 1.2 interfaces as unsupported KVM: arm64: Mark FFA_NOTIFICATION_* calls as unsupported KVM: arm64: Use SMCCC 1.2 for FF-A initialization and in host handler KVM: arm64: Correct return value on host version downgrade attempt Signed-off-by: Marc Zyngier commit b4d90dbc4c1bc4bd3eb2d2989330af0eb95c98e8 Merge: 54d4f445517fe8 0d9f0083f7a5a3 Author: Thomas Zimmermann Date: Mon Sep 15 10:23:28 2025 +0200 Merge drm/drm-next into drm-misc-next-fixes Backmerging to drm-misc-next-fixes to get features and fixes from v6.17-rc6. Signed-off-by: Thomas Zimmermann commit f2863371f017eb03c230addc253783fa4c7e90f5 Author: Christophe Leroy Date: Thu Aug 21 08:30:18 2025 +0200 powerpc/603: Really copy kernel PGD entries into all PGDIRs Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables") was supposed to extend to powerpc 603 the copy of kernel PGD entries into all PGDIRs implemented in a previous patch on the 8xx. But 603 is book3s/32 and uses a duplicate of pgd_alloc() defined in another header. So really do the copy at the correct place for the 603. Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables") Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed Author: Christophe Leroy Date: Sat Aug 16 18:33:26 2025 +0200 powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") removed the test that needed the valeur in SPRN_EPN but failed to remove the read. Remove it. And remove related comments, including the very same comment in InstructionTLBMiss that should have been removed by commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in ITLB misses"). Also update the comment about absence of a second level table which has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx: remove tests on PGDIR entry validity"). Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu commit 2bd7dd383609f11330814ecc0d3c10b67073a6be Author: Shiraz Saleem Date: Mon Sep 15 00:59:32 2025 -0700 RDMA/mana_ib: Extend modify QP Extend modify QP to support further attributes: local_ack_timeout, UD qkey, rate_limit, qp_access_flags, flow_label, max_rd_atomic. Signed-off-by: Shiraz Saleem Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1757923172-4475-1-git-send-email-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky commit 6d84f85151bbd062d36bda6daf37a73945b471c9 Author: Haren Myneni Date: Tue Sep 9 01:44:01 2025 -0700 powerpc/pseries: HVPIPE changes to support migration The hypervisor assigns one pipe per partition for all sources and assigns new pipe after migration. Also the partition ID that is used by source as its target ID may be changed after the migration. So disable hvpipe during SUSPEND event with ‘hvpipe enable’ system parameter value = 0 and enable it after migration during RESUME event with hvpipe enable’ system parameter value = 1. The user space calls such as ioctl()/ read() / write() / poll() returns -ENXIO between SUSPEND and RESUME events. The user space process can close FD and reestablish connection with new FD after migration if needed (Example: source IDs are changed). Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-10-haren@linux.ibm.com commit 39a08a4f94980518ef2eca3c6c6b61094c99f1af Author: Haren Myneni Date: Tue Sep 9 01:44:00 2025 -0700 powerpc/pseries: Enable hvpipe with ibm,set-system-parameter RTAS The partition uses “Hypervisor Pipe OS Enablement Notification” system parameter token (value = 64) to enable / disable hvpipe in the hypervisor. Once hvpipe is enabled, the hypervisor notifies OS if the payload is pending for that partition from any source. This system parameter token takes 1 byte length of data with 1 = Enable and 0 = Disable. Enable hvpipe in the hypervisor with ibm,set-system-parameter RTAS after registering hvpipe event source interrupt. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-9-haren@linux.ibm.com commit b48b6cc8c655d8cdcf5124ba9901b74c8f759668 Author: Haren Myneni Date: Tue Sep 9 01:43:59 2025 -0700 powerpc/pseries: Enable HVPIPE event message interrupt The hypervisor signals the OS via a Hypervisor Pipe Event external interrupt when data is available to be received from the pipe. Then the OS should call RTAS check-exception and provide the input Event Mask as defined for the ‘ibm,hvpipe-msg-events’. In response, check-exception will return an event log containing an Pipe Events message. This message contains the source ID for which this message is intended to and the pipe status such as whether the payload is pending in the hypervisor or pipe to source is closed. If there is any user space process waiting in the wait_queue for the payload from this source ID, wake up that process which can issue read() to obtain payload with ibm,receive-hvpipe-msg RTAS or close FD if the pipe to source is closed. The hypervisor has one pipe per partition for all sources and it will not deliver another hvpipe event message until the partition reads the payload for the previous hvpipe event. So if the source ID is not found in the source list, issue the dummy ibm,receive-hvpipe-msg RTAS so that pipe will not blocked. Register hvpipe event source interrupt based on entries from /proc/device-tree//event-sources/ibm,hvpipe-msg-events property. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-8-haren@linux.ibm.com commit da24fb99a1b5cc842b9446f67f6bcda36b49817f Author: Haren Myneni Date: Tue Sep 9 01:43:58 2025 -0700 powerpc/pseries: Wakeup hvpipe FD when the payload is pending The user space polls on the wait_queue for the payload from the specific source. The hypervisor interrupts the OS when the pipe status for the specific source is changed such as payload is available for the partition or pipe to the source is closed. The OS retrieves the HVPIPE event message with check-exception RTAS and event message contains the source ID and the pipe status. Then wakes up all FDs waiting on the wait_queue so that the user space can read the payload or close the FD if the pipe to source in the hypervisor is closed. The hypervisor assigns one pipe per partition for all sources. Hence issue ibm,receive-hvpipe-msg() to read the pending payload during release() before closing FD so that pipe to the partition will not be blocked. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-7-haren@linux.ibm.com commit cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 Author: Haren Myneni Date: Tue Sep 9 01:43:57 2025 -0700 powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS ibm,receive-hvpipe-msg RTAS call is used to receive data from the source (Ex: Hardware Management Console) over the hypervisor pipe. The hypervisor will signal the OS via a Hypervisor Pipe Event external interrupt when data is available to be received from the pipe and the event message has the source ID and the message type such as payload or closed pipe to the specific source. The hypervisor will not generate another interrupt for the next payload until the partition reads the previous payload. It means the hvpipe is blocked and will not deliver other events for any source. The maximum data length of 4048 bytes is supported with this RTAS call right now. The user space uses read() to receive data from HMC which issues ibm,receive-hvpipe-msg RTAS and the kernel returns the buffer length (including papr_hvpipe_hdr length) to the user space for success or RTAS failure error. If the message is regarding the pipe closed, kernel just returns the papr_hvpipe_hdr with flags = HVPIPE_LOST_CONNECTION and expects the user space to close FD for the corresponding source. ibm,receive-hvpipe-msg RTAS call passes the buffer and returns the source ID from where this payload is received and the payload length. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-6-haren@linux.ibm.com commit 56dbc6678bbb9c011bea91c4a0774a9464ab99a7 Author: Haren Myneni Date: Tue Sep 9 01:43:56 2025 -0700 powerpc/pseries: Send payload with ibm,send-hvpipe-msg RTAS ibm,send-hvpipe-msg RTAS call is used to send data to the source (Ex: Hardware Management Console) over the hypervisor pipe. The maximum data length of 4048 bytes is supported with this RTAS call right now. The user space uses write() to send this payload which invokes this RTAS. Then the write returns the buffer length (including papr_hvpipe_hdr length) to the user space for success or RTAS failure error. ibm,send-hvpipe-msg call takes source ID as target and the buffer in the form of buffer list. The buffer list format consists of work area of size 4K to hold buffer list and number of 4K work areas depends on buffers is as follows: Length of Buffer List in bytes Address of 4K buffer 1 Length of 4K buffer 1 used ... Address of 4K buffer n Length of 4K buffer n used Only one buffer is used right now because of max payload size is 4048 bytes. writev() can be used in future when supported more than one buffer. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-5-haren@linux.ibm.com commit 814ef095f12c9fa142043ee689500f3a41bb6dab Author: Haren Myneni Date: Tue Sep 9 01:43:55 2025 -0700 powerpc/pseries: Add papr-hvpipe char driver for HVPIPE interfaces The hypervisor provides ibm,send-hvpipe-msg and ibm,receive-hvpipe-msg RTAS calls which can be used by the partition to communicate through an inband hypervisor channel with different external sources such as Hardware Management Console (HMC). The information exchanged, whether it be messages, raw or formatted data, etc., is only known to between applications in the OS and the source (HMC). This patch adds papr-hvpipe character driver and provides the standard interfaces such as open / ioctl/ read / write to user space for exchanging information with HMC using send/recevive HVPIPE RTAS functions. PAPR (7.3.32 Hypervisor Pipe Information Exchange) defines the HVPIPE usage: - The hypervisor has one HVPIPE per partition for all sources. - OS can determine this feature’s availability by detecting the “ibm,hypervisor-pipe-capable” property in the /rtas node of the device tree. - Each source is represented by the source ID which is used in send / recv HVPIPE RTAS. (Ex: source ID is the target for the payload in send RTAS). - Return status of ibm,send-hvpipe-msg can be considered as delivered the payload. - Return status of ibm,receive-hvpipe-msg can be considered as ACK to source. - The hypervisor generates hvpipe message event interrupt when the partition has the payload to receive. Provide the interfaces to the user space with /dev/papr-hvpipe character device using the following programming model: int devfd = open("/dev/papr-hvpipe") int fd = ioctl(devfd, PAPR_HVPIPE_IOC_CREATE_HANDLE, &srcID); - Restrict the user space to use the same source ID and do not expect more than one process access with the same source. char *buf = malloc(size); - SIZE should be 4K and the buffer contains header and the payload. length = write(fd, buf, size); - OS issues ibm,send-hvpipe-msg RTAS and returns the RTAS status to the user space. ret = poll(fd,...) - The HVPIPE event message IRQ wakes up for any waiting FDs. length = read(fd, buf, size); - OS issues ibm,receive-hvpipe-msg to receive payload from the hypervisor. release(fd); - OS issues ibm,receive-hvpipe-msg if any payload is pending so that pipe is not blocked. The actual implementation of these calls are added in the next patches. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-4-haren@linux.ibm.com commit 26b4fcecea05b8927b17c9ace132914ffcb4d97e Author: Haren Myneni Date: Tue Sep 9 01:43:54 2025 -0700 powerpc/pseries: Define HVPIPE specific macros Define HVPIPE specific macros which are needed to support ibm,send-hvpipe-msg and ibm,receive-hvpipe-msg RTAS calls and used to handle HVPIPE message events. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-3-haren@linux.ibm.com commit 043439ad1a23cd3f65628310d1f5a06e61f8b431 Author: Haren Myneni Date: Tue Sep 9 01:43:53 2025 -0700 powerpc/pseries: Define papr-hvpipe ioctl PowerPC FW introduced HVPIPE RTAS calls such as ibm,send-hvpipe-msg and ibm,receive-hvpipe-msg for the user space to exchange information with different sources such as Hardware Management Consoles (HMC). HVPIPE_IOC_CREATE_HANDLE is defined to use /dev/papr-hvpipe interface for ibm,send-hvpipe-msg and ibm,receive-hvpipe-msg RTAS calls. Also defined papr_hvpipe_hdr which will added in the payload that is passed between the kernel and the user space. Signed-off-by: Haren Myneni Tested-by: Shashank MS Reviewed-by: Mahesh Salgaonkar Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250909084402.1488456-2-haren@linux.ibm.com commit 0d9f0083f7a5a31d91d501467b499bb8c4b25bdf Merge: 2cda9a063dd6f2 f83ec76bf285be Author: Dave Airlie Date: Mon Sep 15 17:51:07 2025 +1000 Merge tag 'v6.17-rc6' into drm-next This is a backmerge of Linux 6.17-rc6, needed for msm, also requested by misc. Signed-off-by: Dave Airlie commit fc6627ca8a5f811b601aea74e934cf8a048c88ac Author: Nick Morrow Date: Fri Sep 12 15:45:56 2025 -0500 wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 Add VID/PID 0846/9065 for Netgear A7500. Reported-by: Autumn Dececco Tested-by: Autumn Dececco Signed-off-by: Nick Morrow Cc: stable@vger.kernel.org Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/80bacfd6-6073-4ce5-be32-ae9580832337@gmail.com Signed-off-by: Felix Fietkau commit c7c682100cec97b699fe24b26d89278fd459cc84 Author: Rosen Penev Date: Thu Sep 11 15:16:19 2025 -0700 wifi: mt76: mt76_eeprom_override to int mt76_eeprom_override has of_get_mac_address, which can return -EPROBE_DEFER if the nvmem driver gets loaded after mt76 for some reason. Make sure this gets passed to probe so that nvmem mac overrides always work. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20250911221619.16035-1-rosenp@gmail.com Signed-off-by: Felix Fietkau commit cb6ebbdffef2a888b95f121637cd1fad473919c6 Author: Howard Hsu Date: Tue Sep 9 17:35:49 2025 +0200 wifi: mt76: mt7996: support writing MAC TXD for AddBA Request Support writing MAC TXD for the AddBA Req. Without this commit, the start sequence number in AddBA Req will be unexpected value for MT7996 and MT7992. This can result in certain stations (e.g., AX200) dropping packets, leading to ping failures and degraded connectivity. Ensuring the correct MAC TXD and TXP helps maintain reliable packet transmission and prevents interoperability issues with affected stations. Signed-off-by: Howard Hsu Link: https://patch.msgid.link/20250909-mt7996-addba-txd-fix-v1-1-feec16f0c6f0@kernel.org Signed-off-by: Felix Fietkau commit 9557b6fe0c8b58d32a5c857183a7b431dd5e7b21 Author: Ming Yen Hsieh Date: Mon Sep 8 15:12:45 2025 +0800 wifi: mt76: mt7925: refine the txpower initialization flow Refactor the initialization and reset flow for tx power setting to eliminate redundant configurations Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250908071245.1833006-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 Author: Zhi-Jun You Date: Tue Sep 9 14:48:24 2025 +0800 wifi: mt76: mt7915: fix mt7981 pre-calibration In vendor driver, size of group cal and dpd cal for mt7981 includes 6G although the chip doesn't support it. mt76 doesn't take this into account which results in reading from the incorrect offset. For devices with precal, this would lead to lower bitrate. Fix this by aligning groupcal size with vendor driver and switch to freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset. Below are iwinfo of the test device with two clients connected (iPhone 16, Intel AX210). Before : Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 Center Channel 1: 42 2: unknown Tx-Power: 23 dBm Link Quality: 43/70 Signal: -67 dBm Noise: -92 dBm Bit Rate: 612.4 MBit/s Encryption: WPA3 SAE (CCMP) Type: nl80211 HW Mode(s): 802.11ac/ax/n Hardware: embedded [MediaTek MT7981] After: Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 Center Channel 1: 42 2: unknown Tx-Power: 23 dBm Link Quality: 43/70 Signal: -67 dBm Noise: -92 dBm Bit Rate: 900.6 MBit/s Encryption: WPA3 SAE (CCMP) Type: nl80211 HW Mode(s): 802.11ac/ax/n Hardware: embedded [MediaTek MT7981] Tested-on: mt7981 20240823 Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration") Signed-off-by: Zhi-Jun You Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com Signed-off-by: Felix Fietkau commit a09d2f9d69afba4365ff507d18aeeb4ff1aa0e61 Author: Lorenzo Bianconi Date: Tue Sep 9 12:46:37 2025 +0200 wifi: mt76: Convert mt76_wed_rro_ind to LE Do not use bitmask in mt76_wed_rro_ind DMA descriptor in order to not break endianness. This patch is based on the following series: https://lore.kernel.org/linux-wireless/20250909-mt7996-rro-rework-v5-0-7d66f6eb7795@kernel.org/T/#m8b488004d69036cd3672b9eeca8005a937ec0313 Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/301d5f2982ddb729c876fb65f9ac2443ce3f5ff1.1757414621.git.lorenzo@kernel.org Signed-off-by: Felix Fietkau commit 3a29164425e927eaf4dfe21512c5de3b8339b1eb Author: Rex Lu Date: Tue Sep 9 11:45:24 2025 +0200 wifi: mt76: mt7996: Add SW path for HW-RRO v3.1 Introduce HW-RRO v3.1 support to be reused when Wireless Ethernet Dispatcher (WED) is not available. HW-RRO v3.1 is supported by MT7992 chipset. Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-16-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit e50d4d710efd2dbc46965e9608bbb502bcfc5c99 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:23 2025 +0200 wifi: mt76: Add mt76_dma_get_rxdmad_c_buf utility routione Introduce mt76_dma_get_rxdmad_c_buf routine to process packets received by HW-RRO v3.1 module. This is a preliminary patch to introduce SW path for HW-RRO v3.1 module available on MT7992 chipset. Co-developed-by: Rex Lu Signed-off-by: Rex Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-15-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 7b3c83dd873707f1b70e251bd904d5c3e949d5fb Author: Rex Lu Date: Tue Sep 9 11:45:22 2025 +0200 wifi: mt76: mt7996: Decouple RRO logic from WED support Decouple RRO logic from WED support in MT7996 driver in order to reuse it when WED module is not available. Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-14-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 1a7c1bffd33bc32e59cefb66f236d7170eb15b90 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:21 2025 +0200 wifi: mt76: Add rx_queue_init callback Introduce rx_queue_init DMA callback. This is a preliminary patch to configure RRO RX queues and decouple RRO logic from WED support. Co-developed-by: Rex Lu Signed-off-by: Rex Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-13-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit b1e58e137b61693f12da037d2d50aca9c2140a43 Author: Rex Lu Date: Tue Sep 9 11:45:20 2025 +0200 wifi: mt76: mt7996: Introduce RRO MSDU callbacks Introduce rx_rro_ind_process and rx_rro_add_msdu_page callbacks and the related logic in the MT7996 driver. This is a preliminary patch to decouple RRO logic from WED support and reuse RRO when WED module is not available. Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-12-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 809054a60d613ccca6e7f243bc68966b58044163 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:19 2025 +0200 wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not break endianness Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 0d4dafacc1f7b4fb34ef8b87c19b9f95c6ea5f67 Author: Rex Lu Date: Tue Sep 9 11:45:18 2025 +0200 wifi: mt76: mt7996: Enable WED for MT7992 chipset Introduce WED offload support for MT7992 chipset in MT7996 driver. Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-10-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:17 2025 +0200 wifi: mt76: mt7996: Fix RX packets configuration for primary WED device In order to properly set the number of rx packets for primary WED device if hif device is available, move hif pointer initialization before running mt7996_mmio_wed_init routine. Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 77ff8caf3b17626ad91568cef63d75e288aa4052 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:16 2025 +0200 wifi: mt76: mt7996: Fix tx-queues initialization for second phy on mt7996 Fix the second phy tx queue initialization if hif device is not available for MT7990 chipset. Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Co-developed-by: Rex Lu Signed-off-by: Rex Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 9dd5beb7f0393049ae3076adc77bd2920ff7d8da Author: Rex Lu Date: Tue Sep 9 11:45:15 2025 +0200 wifi: mt76: mt7996: Introduce the capability to reset MT7992 WED device This is a preliminary patch to enable WED support for MT7992 Kite chipset supported by MT7996 driver. Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-7-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit eedb427eb26061ee1bfed3b19da6ffbc832f54f4 Author: Rex Lu Date: Tue Sep 9 11:45:14 2025 +0200 wifi: mt76: mt7996: Enable HW RRO for MT7992 chipset This is a preliminary patch to enable WED support for MT7992 Kite chipset supported by MT7996 driver. Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-6-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 3bc2f02f5cd49c6e17d67974f561611608548652 Author: Rex Lu Date: Tue Sep 9 11:45:13 2025 +0200 wifi: mt76: mt7996: Initial DMA configuration for MT7992 WED support Manage differences in DMA and RX queues configuration for MT7992 and MT7996. This is a preliminary patch to enable WED support for MT7992 Kite chipset supported by MT7996 driver. Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-5-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit d77f77ff45445062411fa2770c804c9c6e8c2c95 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:12 2025 +0200 wifi: mt76: Do not always enable NAPIs for WED RRO queues Do not initialize NAPIs for WED RRO queues if WED is active. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-4-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit ba9f68bb77f86b48f6a7dd1190c4cc8d6156fbcb Author: Rex Lu Date: Tue Sep 9 11:45:11 2025 +0200 wifi: mt76: Differentiate between RRO data and RRO MSDU queues This is a preliminary patch to enable WED support for MT7992 Kite chipset supported by MT7996 driver. Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-3-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit 2182974e9fd06a2cf78f60ee0ae38a22db4d2126 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:10 2025 +0200 wifi: mt76: Remove q->ndesc check in mt76_dma_rx_fill() Remove q->ndesc check in mt76_dma_rx_fill routine since this is already done in mt76_dma_rx_fill_buf(). Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-2-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit f6b29367b04219c6d7053f160f3096c9d48b0254 Author: Lorenzo Bianconi Date: Tue Sep 9 11:45:09 2025 +0200 wifi: mt76: Add reset_idx to reset_q mt76_queue_ops signature. Remove __mt76_dma_queue_reset routine and use mt76_dma_queue_reset directly instead in mt76_queue_ops struct. This is a preliminary patch to enable WED support for MT7992 Kite chipset supported by MT7996 driver. Co-developed-by: Rex Lu Signed-off-by: Rex Lu Co-developed-by: Sujuan Chen Signed-off-by: Sujuan Chen Co-developed-by: Benjamin Lin Signed-off-by: Benjamin Lin Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-1-7d66f6eb7795@kernel.org Signed-off-by: Felix Fietkau commit f5160304d57c5543c63404a15cc8737ef714b669 Author: Lorenzo Bianconi Date: Mon Sep 1 15:02:33 2025 +0200 wifi: mt76: mt7996: Enable MLO support for client interfaces Report MT7996 MLO STA capabilities to mac80211 stack. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250901-mt7996-enable-mlo-client-v1-1-50c46317325d@kernel.org Signed-off-by: Felix Fietkau commit 24e2846f15b045f323692adcf24cabfcba7f7de6 Author: Lorenzo Bianconi Date: Sat Aug 30 19:12:50 2025 +0200 wifi: mt76: mt7996: Set EML capabilities for AP interface Report EML capabilities to hostapd for AP interface. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250830-mt7996_ap_eml_capa-v1-1-ef69c97c6adc@kernel.org Signed-off-by: Felix Fietkau commit a9eae65d97f3cb3f899c4bc7ae6304f64fcedce3 Author: Shayne Chen Date: Wed Aug 27 10:01:02 2025 +0200 wifi: mt76: mt7996: Export MLO AP capabilities to mac80211 Report MT7996 MLO AP capabilities to mac80211 stack. Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250827-mt7996-mlo-ap-capa-v1-1-b5cfbcafa25f@kernel.org Signed-off-by: Felix Fietkau commit e6291bb7a5935b2f1d337fd7a58eab7ada6678ad Author: Benjamin Lin Date: Thu Sep 4 09:56:42 2025 +0200 wifi: mt76: mt7996: Temporarily disable EPCS EPCS is not yet ready, so do not claim to support it. Signed-off-by: Benjamin Lin Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-4-89d8fed67f20@kernel.org Signed-off-by: Felix Fietkau commit 7ef0c7ad735b0c38140259519a3f165bee2b857c Author: Shayne Chen Date: Thu Sep 4 09:56:41 2025 +0200 wifi: mt76: mt7996: Implement MLD address translation for EAPOL Do the MLD to link address translation for EAPOL frames in driver. Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-3-89d8fed67f20@kernel.org Signed-off-by: Felix Fietkau commit 9aa03d182343e51164f56ee269b571f740e2b804 Author: Lorenzo Bianconi Date: Thu Sep 4 09:56:40 2025 +0200 wifi: mt76: mt7996: Add all active links to poll list in mt7996_mac_tx_free() Add all valid links to poll list for Airtime Fairness/AQL accounting when tx-free event occurs. Co-developed-by: Bo Jiao Signed-off-by: Bo Jiao Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-2-89d8fed67f20@kernel.org Signed-off-by: Felix Fietkau commit a3ea1c309bf32fdb3665898c40b3ff8ca29ba6c4 Author: Shayne Chen Date: Thu Sep 4 09:56:39 2025 +0200 wifi: mt76: mt7996: Fix mt7996_reverse_frag0_hdr_trans for MLO Update mt7996_reverse_frag0_hdr_trans routine to support MLO. Co-developed-by: Bo Jiao Signed-off-by: Bo Jiao Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-1-89d8fed67f20@kernel.org Signed-off-by: Felix Fietkau commit 141f0c9a89f9591b312845c4fe5df5e965706c91 Author: Lorenzo Bianconi Date: Tue Sep 2 08:55:12 2025 +0200 wifi: mt76: mt7996: Use proper link info in mt7996_mcu_add_group Do not always use default link in mt7996_mcu_add_group routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250902-mt7996_mcu_add_group-fix-v1-1-312e14794dee@kernel.org Signed-off-by: Felix Fietkau commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 Author: Quan Zhou Date: Thu Aug 28 20:39:42 2025 +0800 wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device Enable 160MHz beamformee support on mt7922 by updating HE capability element configuration. Previously, only 160MHz channel width was set, but beamformee for 160MHz was not properly advertised. This patch adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices to utilize 160MHz BW for beamforming. Tested by connecting to 160MHz-bandwidth beamforming AP and verified HE capability. Signed-off-by: Quan Zhou Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau commit d54424fbc53b4d6be00f90a8b529cd368f20d357 Author: Jack Kao Date: Mon Sep 1 15:32:00 2025 +0800 wifi: mt76: mt7925: add pci restore for hibernate Due to hibernation causing a power off and power on, this modification adds mt7925_pci_restore callback function for kernel. When hibernation resumes, it calls mt7925_pci_restore to reset the device, allowing it to return to the state it was in before the power off. Signed-off-by: Jack Kao Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250901073200.230033-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit fe5fffadc6c77c56f122cf1042dc830f59e904bf Author: Lorenzo Bianconi Date: Sat Aug 30 00:26:47 2025 +0200 wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() In order to avoid a possible NULL pointer dereference in mt7996_mac_sta_init_link routine, move the phy pointer check before running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine. Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250830-mt7996_mac_sta_add_links-fix-v1-1-4219fb8755ee@kernel.org Signed-off-by: Felix Fietkau commit afff4325548f0cf872e404df2856bf8bd9581c7e Author: Lorenzo Bianconi Date: Mon Sep 1 00:14:37 2025 +0200 wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback Do not always use deflink_id in link_sta_rc_update mac80211 callback but use the proper link_id provided by mac80211. Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org Signed-off-by: Felix Fietkau commit 1318d6822f6ceca5a6932655d140aea56f672f52 Author: Lorenzo Bianconi Date: Tue Aug 26 10:13:04 2025 +0200 wifi: mt76: Remove dead code in mt76_scan_work Duration can't be equal to 0 in mt76_scan_work routine so get rid of related if condition. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250826-mt76_scan_work-dead-code-v1-1-ac5234c4d044@kernel.org Signed-off-by: Felix Fietkau commit 6ccb6bb9bd7de15b148cb2b4e7229091aa17ce18 Author: Lorenzo Bianconi Date: Sat Aug 23 16:55:37 2025 +0200 wifi: mt76: mt7996: Use deflink for AMPDU rx reordering Packets belonging to the same TID can be sent over multiple links. AMPDU rx reordering must be performed over all active links. Fix the problem always using default link for AMPDU rx reordering. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250823-mt7996-mlo-aggr-fix-v1-1-f35cf0ea4c8a@kernel.org Signed-off-by: Felix Fietkau commit 7ae99dd459ba1ea83a9b3d8de254f374182e602c Author: Ming Yen Hsieh Date: Tue Aug 12 19:16:42 2025 +0800 wifi: mt76: mt7921: add MBSSID support Enable MBSSID support for MT7921 by setting the appropriate capability to the firmware. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250812111642.3620845-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 Author: Abdun Nihaal Date: Wed Jul 9 20:25:30 2025 +0530 wifi: mt76: fix potential memory leak in mt76_wmac_probe() In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory is allocated for both struct ieee80211_hw and a workqueue. However, on the error path, the workqueue is not freed. Fix that by calling mt76_free_device() on the error path. Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") Signed-off-by: Abdun Nihaal Reviewed-by: Jiri Slaby Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com Signed-off-by: Felix Fietkau commit 74e756b9e28af3ee94a7ea480bb39694be5fbd96 Author: Ming Yen Hsieh Date: Tue Jul 29 16:49:32 2025 +0800 wifi: mt76: mt7925: add MBSSID support Enable MBSSID support for MT7925 by setting the appropriate capability to the firmware. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250729084932.264155-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit f6159b2051e157550d7609e19d04471609c6050b Author: Nick Morrow Date: Tue Jul 8 16:40:42 2025 -0500 wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 Add VID/PID 0846/9072 for recently released Netgear A9000. Signed-off-by: Nick Morrow Cc: stable@vger.kernel.org Link: https://patch.msgid.link/7afd3c3c-e7cf-4bd9-801d-bdfc76def506@gmail.com Signed-off-by: Felix Fietkau commit f940c9b7aef65b20456dc709bab3056a79550a01 Author: Lorenzo Bianconi Date: Thu Jul 31 12:41:24 2025 +0200 wifi: mt76: mt7996: Set proper link destination address in mt7996_tx() Overwrite 802.11 destination address with in-use link address for MLD capable VIFs in mt7996_tx routine. Signed-off-by: Lorenzo Bianconi Tested-by: Jose Ignacio Tornos Martinez Link: https://patch.msgid.link/20250731-mt7996-mlo-devel-v1-2-7ff4094285d0@kernel.org Signed-off-by: Felix Fietkau commit a70b5903c57308fff525cbd62654f6104aa7ecbf Author: Lorenzo Bianconi Date: Thu Jul 31 12:41:23 2025 +0200 wifi: mt76: mt7996: Set def_wcid pointer in mt7996_mac_sta_init_link() In order to get the ieee80211_sta pointer from wcid struct for a MLO client, set def_wcid pointer in mt7996_mac_sta_init_link routine. Signed-off-by: Lorenzo Bianconi Tested-by: Jose Ignacio Tornos Martinez Link: https://patch.msgid.link/20250731-mt7996-mlo-devel-v1-1-7ff4094285d0@kernel.org Signed-off-by: Felix Fietkau commit ed01c310eca96453c11b59db46c855aa593cffdd Author: Lorenzo Bianconi Date: Thu Jul 10 10:26:19 2025 +0200 wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine Update mt7996_mcu_bss_mld_tlv routine to properly support MLO configuring the BSS. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org Signed-off-by: Felix Fietkau commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 Author: Lorenzo Bianconi Date: Tue Jul 8 09:12:05 2025 +0200 wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly support MLO scenario. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org Signed-off-by: Felix Fietkau commit 1609b014aa29f9a2bf3aaa93f71de4a06725845e Author: Lorenzo Bianconi Date: Tue Jul 8 09:12:04 2025 +0200 wifi: mt76: mt7996: Overwrite unspecified link_id in mt7996_tx() Set link_id to msta or mvif primary value if it is set to IEEE80211_LINK_UNSPECIFIED by mac80211 in mt7996_tx routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-1-f2682818a8a3@kernel.org Signed-off-by: Felix Fietkau commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e Author: Håkon Bugge Date: Fri Sep 12 12:05:20 2025 +0200 RDMA/cm: Rate limit destroy CM ID timeout error message When the destroy CM ID timeout kicks in, you typically get a storm of them which creates a log flooding. Hence, change pr_err() to pr_err_ratelimited() in cm_destroy_id_wait_timeout(). Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") Signed-off-by: Håkon Bugge Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 0d4eaf8caf8cd633b23e949e2996b420052c2d45 Author: Aaron Lu Date: Fri Sep 12 11:44:28 2025 +0800 sched/fair: Do not balance task to a throttled cfs_rq When doing load balance and the target cfs_rq is in throttled hierarchy, whether to allow balancing there is a question. The good side to allow balancing is: if the target CPU is idle or less loaded and the being balanced task is holding some kernel resources, then it seems a good idea to balance the task there and let the task get the CPU earlier and release kernel resources sooner. The bad part is, if the task is not holding any kernel resources, then the balance seems not that useful. While theoretically it's debatable, a performance test[0] which involves 200 cgroups and each cgroup runs hackbench(20 sender, 20 receiver) in pipe mode showed a performance degradation on AMD Genoa when allowing load balance to throttled cfs_rq. Analysis[1] showed hackbench doesn't like task migration across LLC boundary. For this reason, add a check in can_migrate_task() to forbid balancing to a cfs_rq that is in throttled hierarchy. This reduced task migration a lot and performance restored. [0]: https://lore.kernel.org/lkml/20250822110701.GB289@bytedance/ [1]: https://lore.kernel.org/lkml/20250903101102.GB42@bytedance/ Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak commit 253b3f587241967a97a971e23b1e2a7d74244fad Author: Aaron Lu Date: Wed Sep 10 17:50:43 2025 +0800 sched/fair: Do not special case tasks in throttled hierarchy With the introduction of task based throttle model, task in a throttled hierarchy is allowed to continue to run till it gets throttled on its ret2user path. For this reason, remove those throttled_hierarchy() checks in the following functions so that those tasks can get their turn as normal tasks: dequeue_entities(), check_preempt_wakeup_fair() and yield_to_task_fair(). The benefit of doing it this way is: if those tasks gets the chance to run earlier and if they hold any kernel resources, they can release those resources earlier. The downside is, if they don't hold any kernel resouces, all they can do is to throttle themselves on their way back to user space so the favor to let them run seems not that useful and for check_preempt_wakeup_fair(), that favor may be bad for curr. K Prateek Nayak pointed out prio_changed_fair() can send a throttled task to check_preempt_wakeup_fair(), further tests showed the affinity change path from move_queued_task() can also send a throttled task to check_preempt_wakeup_fair(), that's why the check of task_is_throttled() in that function. Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) commit fcd394866e3db344cbe0bb485d7e3f741ac07245 Author: Aaron Lu Date: Wed Sep 10 17:50:42 2025 +0800 sched/fair: update_cfs_group() for throttled cfs_rqs With task based throttle model, tasks in a throttled hierarchy are allowed to continue to run if they are running in kernel mode. For this reason, PELT clock is not stopped for these cfs_rqs in throttled hierarchy when they still have tasks running or queued. Since PELT clock is not stopped, whether to allow update_cfs_group() doing its job for cfs_rqs which are in throttled hierarchy but still have tasks running/queued is a question. The good side is, continue to run update_cfs_group() can get these cfs_rq entities with an up2date weight and that up2date weight can be useful to derive an accurate load for the CPU as well as ensure fairness if multiple tasks of different cgroups are running on the same CPU. OTOH, as Benjamin Segall pointed: when unthrottle comes around the most likely correct distribution is the distribution we had at the time of throttle. In reality, either way may not matter that much if tasks in throttled hierarchy don't run in kernel mode for too long. But in case that happens, let these cfs_rq entities have an up2date weight seems a good thing to do. Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) commit fe8d238e646e16cc431b7a5899f8dda690258ee9 Author: Aaron Lu Date: Wed Sep 10 17:50:41 2025 +0800 sched/fair: Propagate load for throttled cfs_rq Before task based throttle model, propagating load will stop at a throttled cfs_rq and that propagate will happen on unthrottle time by update_load_avg(). Now that there is no update_load_avg() on unthrottle for throttled cfs_rq and all load tracking is done by task related operations, let the propagate happen immediately. While at it, add a comment to explain why cfs_rqs that are not affected by throttle have to be added to leaf cfs_rq list in propagate_entity_cfs_rq() per my understanding of commit 0258bdfaff5b ("sched/fair: Fix unfairness caused by missing load decay"). Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chengming Zhou commit 17d9f8eaa87d40a2ff66598875a43363e37a909b Author: Gary Guo Date: Thu Sep 4 21:41:41 2025 -0700 MAINTAINERS: update atomic infrastructure entry to include Rust I would like to help review atomic related patches, especially Rust related ones, hence add myself as an reviewer. Suggested-by: Boqun Feng Signed-off-by: Gary Guo Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Elle Rhumsaa Acked-by: Boqun Feng Link: https://lore.kernel.org/r/20250723233312.3304339-6-gary@kernel.org commit a307bf1db5448eccd72a1d7857f7661c6330d5ad Author: Gary Guo Date: Thu Sep 4 21:41:40 2025 -0700 rust: block: convert `block::mq` to use `Refcount` Currently there's a custom reference counting in `block::mq`, which uses `AtomicU64` Rust atomics, and this type doesn't exist on some 32-bit architectures. We cannot just change it to use 32-bit atomics, because doing so will make it vulnerable to refcount overflow. So switch it to use the kernel refcount `kernel::sync::Refcount` instead. There is an operation needed by `block::mq`, atomically decreasing refcount from 2 to 0, which is not available through refcount.h, so I exposed `Refcount::as_atomic` which allows accessing the refcount directly. [boqun: Adopt the LKMM atomic API] Signed-off-by: Gary Guo Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Acked-by: Andreas Hindborg Tested-by: David Gow Link: https://lore.kernel.org/r/20250723233312.3304339-5-gary@kernel.org commit 076acb647c1f448177d8b3b0e4f33de959713d7d Author: Gary Guo Date: Thu Sep 4 21:41:39 2025 -0700 rust: convert `Arc` to use `Refcount` With `Refcount` type created, `Arc` can use `Refcount` instead of calling into FFI directly. Signed-off-by: Gary Guo Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alexandre Courbot Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/r/20250723233312.3304339-4-gary@kernel.org commit 7487645f0b2d1a30590bafa7a977dc6661006d4f Author: Gary Guo Date: Thu Sep 4 21:41:38 2025 -0700 rust: make `Arc::into_unique_or_drop` associated function Make `Arc::into_unique_or_drop` to become a mere associated function instead of a method (i.e. removing the `self` receiver). It's a general convention for Rust smart pointers to avoid having methods defined on them, because if the pointee type has a method of the same name, then it is shadowed. This is normally for avoiding semver breakage, which isn't an issue for kernel codebase, but it's still generally a good practice to follow this rule, so that `ptr.foo()` would always be calling a method on the pointee type. Signed-off-by: Gary Guo Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Benno Lossin Reviewed-by: Alexandre Courbot Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/r/20250723233312.3304339-3-gary@kernel.org commit bb38f35b35f9de0cebc4d62ea73482454e38cef3 Author: Gary Guo Date: Thu Sep 4 21:41:37 2025 -0700 rust: implement `kernel::sync::Refcount` This is a wrapping layer of `include/linux/refcount.h`. Currently the kernel refcount has already been used in `Arc`, however it calls into FFI directly. [boqun: Add the missing <> for the link in comment] Signed-off-by: Gary Guo Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Boqun Feng Reviewed-by: Fiona Behrens Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/r/20250723233312.3304339-2-gary@kernel.org commit d9ea5a41cef80dc8103f4114b072b27364f2e06a Author: Boqun Feng Date: Thu Sep 4 21:41:36 2025 -0700 rust: sync: Add memory barriers Memory barriers are building blocks for concurrent code, hence provide a minimal set of them. The compiler barrier, barrier(), is implemented in inline asm instead of using core::sync::atomic::compiler_fence() because memory models are different: kernel's atomics are implemented in inline asm therefore the compiler barrier should be implemented in inline asm as well. Also it's currently only public to the kernel crate until there's a reasonable driver usage. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-10-boqun.feng@gmail.com/ commit 84c6d36bcaf98a8c0533cd334a624d536d20879b Author: Boqun Feng Date: Thu Sep 4 21:41:35 2025 -0700 rust: sync: atomic: Add Atomic<{usize,isize}> Add generic atomic support for `usize` and `isize`. Note that instead of mapping directly to `atomic_long_t`, the represention type (`AtomicType::Repr`) is selected based on CONFIG_64BIT. This reduces the necessity of creating `atomic_long_*` helpers, which could save the binary size of kernel if inline helpers are not available. To do so, an internal type `isize_atomic_repr` is defined, it's `i32` in 32bit kernel and `i64` in 64bit kernel. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Andreas Hindborg Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-9-boqun.feng@gmail.com/ commit d6df37ba918198c0a7f55734c20512431770c4b3 Author: Boqun Feng Date: Thu Sep 4 21:41:34 2025 -0700 rust: sync: atomic: Add Atomic Add generic atomic support for basic unsigned types that have an `AtomicImpl` with the same size and alignment. Unit tests are added including Atomic and Atomic. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Andreas Hindborg Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-8-boqun.feng@gmail.com/ commit d132054360baf0d127a463bbf853e43dd6eb0dd9 Author: Boqun Feng Date: Thu Sep 4 21:41:33 2025 -0700 rust: sync: atomic: Add the framework of arithmetic operations One important set of atomic operations is the arithmetic operations, i.e. add(), sub(), fetch_add(), add_return(), etc. However it may not make senses for all the types that `AtomicType` to have arithmetic operations, for example a `Foo(u32)` may not have a reasonable add() or sub(), plus subword types (`u8` and `u16`) currently don't have atomic arithmetic operations even on C side and might not have them in the future in Rust (because they are usually suboptimal on a few architecures). Therefore the plan is to add a few subtraits of `AtomicType` describing which types have and can do atomic arithemtic operations. One trait `AtomicAdd` is added, and only add() and fetch_add() are added. The rest will be added in the future. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-7-boqun.feng@gmail.com/ commit b606a532c01380ac282fd0a0858e3e8ea01ad904 Author: Boqun Feng Date: Thu Sep 4 21:41:32 2025 -0700 rust: sync: atomic: Add atomic {cmp,}xchg operations xchg() and cmpxchg() are basic operations on atomic. Provide these based on C APIs. Note that cmpxchg() use the similar function signature as compare_exchange() in Rust std: returning a `Result`, `Ok(old)` means the operation succeeds and `Err(old)` means the operation fails. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-6-boqun.feng@gmail.com/ commit 29c32c405e53605dfd24054a4460516f7f6e3938 Author: Boqun Feng Date: Thu Sep 4 21:41:31 2025 -0700 rust: sync: atomic: Add generic atomics To provide using LKMM atomics for Rust code, a generic `Atomic` is added, currently `T` needs to be Send + Copy because these are the straightforward usages and all basic types support this. Implement `AtomicType` for `i32` and `i64`, and so far only basic operations load() and store() are introduced. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-5-boqun.feng@gmail.com/ commit b638c9bc471030ebd898b57c5bf7c96f6d70cda4 Author: Boqun Feng Date: Thu Sep 4 21:41:30 2025 -0700 rust: sync: atomic: Add ordering annotation types Preparation for atomic primitives. Instead of a suffix like _acquire, a method parameter along with the corresponding generic parameter will be used to specify the ordering of an atomic operations. For example, atomic load() can be defined as: impl Atomic { pub fn load(&self, _o: O) -> T { ... } } and acquire users would do: let r = x.load(Acquire); relaxed users: let r = x.load(Relaxed); doing the following: let r = x.load(Release); will cause a compiler error. Compared to suffixes, it's easier to tell what ordering variants an operation has, and it also make it easier to unify the implementation of all ordering variants in one method via generic. The `TYPE` associate const is for generic function to pick up the particular implementation specified by an ordering annotation. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-4-boqun.feng@gmail.com/ commit 2387fb2a9b84950dfe2eaa0b170f429e04b38168 Author: Boqun Feng Date: Thu Sep 4 21:41:29 2025 -0700 rust: sync: Add basic atomic operation mapping framework Preparation for generic atomic implementation. To unify the implementation of a generic method over `i32` and `i64`, the C side atomic methods need to be grouped so that in a generic method, they can be referred as ::, otherwise their parameters and return value are different between `i32` and `i64`, which would require using `transmute()` to unify the type into a `T`. Introduce `AtomicImpl` to represent a basic type in Rust that has the direct mapping to an atomic implementation from C. Use a sealed trait to restrict `AtomicImpl` to only support `i32` and `i64` for now. Further, different methods are put into different `*Ops` trait groups, and this is for the future when smaller types like `i8`/`i16` are supported but only with a limited set of API (e.g. only set(), load(), xchg() and cmpxchg(), no add() or sub() etc). While the atomic mod is introduced, documentation is also added for memory models and data races. Also bump my role to the maintainer of ATOMIC INFRASTRUCTURE to reflect my responsibility on the Rust atomic mod. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/all/20250719030827.61357-3-boqun.feng@gmail.com/ commit fdd7c7e0d2ab3987882c570612d4622f437292c7 Author: Boqun Feng Date: Thu Sep 4 21:41:28 2025 -0700 rust: Introduce atomic API helpers In order to support LKMM atomics in Rust, add rust_helper_* for atomic APIs. These helpers ensure the implementation of LKMM atomics in Rust is the same as in C. This could save the maintenance burden of having two similar atomic implementations in asm. Originally-by: Mark Rutland Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/all/20250719030827.61357-2-boqun.feng@gmail.com/ commit c29287bb32bc72a037c34d84a160060a6122b7ed Author: Jihed Chaibi Date: Sun Sep 14 22:59:45 2025 +0200 ALSA: asihpi: Simplify error handling in PCM substream setup Refactor error handling in the PCM substream setup to combine redundant checks and improve code readability. Free the dpcm structure and return appropriate error codes (-EBUSY for HPI_ERROR_OBJ_ALREADY_OPEN, -EIO for other errors) in a single block. Signed-off-by: Jihed Chaibi Signed-off-by: Takashi Iwai commit d21b26cad33250be758ea9d860ff9d5c3992c459 Merge: ed68411e879e9b f83ec76bf285be Author: Greg Kroah-Hartman Date: Mon Sep 15 08:27:31 2025 +0200 Merge 6.17-rc6 into tty-next We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit c319c4ec062477edd0d14b79e2f3a9bd26a9a82e Merge: 3b5eba544a8af6 f83ec76bf285be Author: Greg Kroah-Hartman Date: Mon Sep 15 08:26:05 2025 +0200 Merge 6.17-rc6 into driver-core-next We need the driver core fixes in here to build on top of. Signed-off-by: Greg Kroah-Hartman commit a4d43c1f17b9f143af5868285c513c866e9cf67b Merge: 82432bbfb9e83b f83ec76bf285be Author: Greg Kroah-Hartman Date: Mon Sep 15 08:18:40 2025 +0200 Merge 6.17-rc6 into usb-next We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit 2cda9a063dd6f21e5294092a679afdcd0fc58549 Merge: cf99b26d3081b1 ba391a102ec11a Author: Dave Airlie Date: Mon Sep 15 13:16:53 2025 +1000 Merge tag 'drm-intel-gt-next-2025-09-12' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: - Include the GuC registers in the error state (Daniele) - Use memdup_user() (Thorsten) - Selftest improvements (Jonathan) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aMPCfRObHMg6DZAs@jlahtine-mobl commit 931383f161c066ac5fda12035540498931739842 Author: Takashi Sakamoto Date: Mon Sep 15 11:42:32 2025 +0900 firewire: core: use helper macro to compare against current jiffies The pattern of calling either time_before64() or time_after64() with get_jiffies_64() can be replaced with the corresponding helper macros. Link: https://lore.kernel.org/r/20250915024232.851955-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 379b870c28c6a615a101df7986eba70fea99eff7 Author: Takashi Sakamoto Date: Mon Sep 15 11:42:31 2025 +0900 firewire: core: use helper macros instead of direct access to HZ There are some macros available to convert usecs, msecs, and secs into jiffies count. Link: https://lore.kernel.org/r/20250915024232.851955-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit bf87a41b85d67695a04b422499b77748fe845945 Author: Boqun Feng Date: Thu Jul 24 10:20:05 2025 -0700 rust: list: Add an example for `ListLinksSelfPtr` usage It appears that the support for `ListLinksSelfPtr` is dead code at the moment [1]. Although some tests were added at [2] for impl `ListItem` using `ListLinksSelfPtr` field, still we could use more examples demonstrating and testing the usage of `ListLinksSelfPtr`. Hence add an example similar to `ListLinks` usage. The example is mostly based on Alice's usage in binder driver [3]. Link: https://lore.kernel.org/rust-for-linux/20250719183649.596051-1-ojeda@kernel.org/ [1] Link: https://lore.kernel.org/rust-for-linux/20250709-list-no-offset-v4-5-a429e75840a9@gmail.com/ [2] Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-4-08ba9197f637@google.com/ [3] Signed-off-by: Boqun Feng Reviewed-by: Alice Ryhl [ Fixed typo. - Miguel ] Signed-off-by: Miguel Ojeda commit a15d12c24fa790533c8c133e84a8bf23777a7a43 Author: Benno Lossin Date: Tue Jul 22 14:14:38 2025 +0200 rust: sync: extend module documentation of aref Commit 07dad44aa9a9 ("rust: kernel: move ARef and AlwaysRefCounted to sync::aref") moved `ARef` and `AlwaysRefCounted` into their own module. In that process only a short, single line description of the module was added. Extend the description by explaining what is meant by "internal reference counting", the two items in the trait & the difference to `Arc`. Signed-off-by: Benno Lossin Reviewed-by: Alexandre Courbot Signed-off-by: Miguel Ojeda commit 67ff56cecc8701665ec137e5f151a7a7b2c37329 Author: Ritvik Gupta Date: Mon Aug 11 06:49:58 2025 +0530 rust: kernel: cpu: mark `CpuId::current()` inline When building the kernel using llvm-20.1.7-rust-1.89.0-x86_64, this symbol is generated: $ llvm-nm --demangle vmlinux | grep CpuId ffffffff84c77450 T ::current However, this Rust symbol is a trivial wrapper around `raw_smp_processor_id` function. It doesn't make sense to go through a trivial wrapper for such functions, so mark it inline. After applying this patch, the above command will produce no output. Suggested-by: Alice Ryhl Link: https://github.com/Rust-for-Linux/linux/issues/1145 Signed-off-by: Ritvik Gupta Reviewed-by: Boqun Feng Reviewed-by: Alice Ryhl Signed-off-by: Miguel Ojeda commit 5b5ba63a54cc7cb050fa734dbf495ffd63f9cbf7 Author: Raju Rangoju Date: Tue Sep 9 17:01:43 2025 +0530 amd-xgbe: Add PPS periodic output support Add support for hardware PPS (Pulse Per Second) output to the AMD XGBE driver. The implementation enables flexible periodic output mode, exposing it via the PTP per_out interface. The driver supports configuring PPS output using the standard PTP subsystem, allowing precise periodic signal generation for time synchronization applications. The feature has been verified using the testptp tool and oscilloscope. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20250909113143.1364477-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit b957665dc00ee62c5d3d557ecf1a96cc66667ddd Merge: d586676a271417 d466c16026e9ac Author: Jakub Kicinski Date: Sun Sep 14 14:20:03 2025 -0700 Merge branch 'net-fec-add-the-jumbo-frame-support' Shenwei Wang says: ==================== net: fec: add the Jumbo frame support ==================== Link: https://patch.msgid.link/20250910185211.721341-1-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit d466c16026e9ac125e5053a2fa26e59c82538fa4 Author: Shenwei Wang Date: Wed Sep 10 13:52:11 2025 -0500 net: fec: enable the Jumbo frame support for i.MX8QM Certain i.MX SoCs, such as i.MX8QM and i.MX8QXP, feature enhanced FEC hardware that supports Ethernet Jumbo frames with packet sizes up to 16K bytes. When Jumbo frames are supported, the TX FIFO may not be large enough to hold an entire frame. To handle this, the FIFO is configured to operate in cut-through mode when the frame size exceeds (PKT_MAXBUF_SIZE - ETH_HLEN - ETH_FCS_LEN), which allows transmission to begin once the FIFO reaches a certain threshold. Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-7-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit 59e9bf037d7579a8d845bb8026276bc7e3852436 Author: Shenwei Wang Date: Wed Sep 10 13:52:10 2025 -0500 net: fec: add change_mtu to support dynamic buffer allocation Add a fec_change_mtu() handler to recalculate the pagepool_order based on the new_mtu value. And update the rx_frame_size accordingly when pagepool_order changes. MTU changes are only allowed when the adater is not running. Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-6-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit 5b14ed3ac5133a1f7a5fe760451e645524b6c34e Author: Shenwei Wang Date: Wed Sep 10 13:52:09 2025 -0500 net: fec: add rx_frame_size to support configurable RX length Add a new rx_frame_size member in the fec_enet_private structure to track the RX buffer size. On the Jumbo frame enabled system, the value will be recalculated whenever the MTU is updated, allowing the driver to allocate RX buffer efficiently. Configure the TRUNC_FL (Frame Truncation Length) based on the smaller value between max_buf_size and the rx_frame_size to maintain consistent RX error behavior, regardless of whether Jumbo frames are enabled. Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-5-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit 62b5bb7be7bc3dcf87a2ab6ceced88164a626397 Author: Shenwei Wang Date: Wed Sep 10 13:52:08 2025 -0500 net: fec: update MAX_FL based on the current MTU Configure the MAX_FL (Maximum Frame Length) register according to the current MTU value, which ensures that packets exceeding the configured MTU trigger an RX error. Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-4-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit 29e6d5f89e482ceccaa71358333316a7624df009 Author: Shenwei Wang Date: Wed Sep 10 13:52:07 2025 -0500 net: fec: add pagepool_order to support variable page size Add a new pagepool_order member in the fec_enet_private struct to allow dynamic configuration of page size for an instance. This change clears the hardcoded page size assumptions. Reviewed-by: Andrew Lunn Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-3-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit ec2a1681ed4f0aa74e15e4430e26afff514e4e19 Author: Shenwei Wang Date: Wed Sep 10 13:52:06 2025 -0500 net: fec: use a member variable for maximum buffer size Refactor code to support Jumbo frame functionality by adding a member variable in the fec_enet_private structure to store PKT_MAXBUF_SIZE. Remove the OPT_FRAME_SIZE and define a new macro OPT_ARCH_HAS_MAX_FL to indicate architectures that support configurable maximum frame length. And update the MAX_FL register value to max_buf_size when OPT_ARCH_HAS_MAX_FL is defined as 1. Reviewed-by: Andrew Lunn Reviewed-by: Wei Fang Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20250910185211.721341-2-shenwei.wang@nxp.com Signed-off-by: Jakub Kicinski commit d586676a2714176bed06cf70467c4e08ac2d4681 Author: Alok Tiwari Date: Fri Sep 12 07:14:24 2025 -0700 ionic: use int type for err in ionic_get_module_eeprom_by_page The variable 'err' is declared as u32, but it is used to store negative error codes such as -EINVAL. Changing the type of 'err' to int ensures proper representation of negative error codes and aligns with standard kernel error handling conventions. Also, there is no need to initialize 'err' since it is always set before being used. Signed-off-by: Alok Tiwari Reviewed-by: Shannon Nelson Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20250912141426.3922545-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit c20302dd42ac2aa3cbb3e8099a8a39b90194d189 Merge: 617d53f74b8488 641585bc978e0a Author: Jakub Kicinski Date: Sun Sep 14 13:13:12 2025 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Fwlog support in ixgbe Michal Swiatkowski says: Firmware logging is a feature that allow user to dump firmware log using debugfs interface. It is supported on device that can handle specific firmware ops. It is true for ice and ixgbe driver. Prepare code from ice driver to be moved to the library code and reuse it in ixgbe driver. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: fwlog support for e610 ice, libie: move fwlog code to libie ice: reregister fwlog after driver reinit ice: prepare for moving file to libie ice: move debugfs code to fwlog libie, ice: move fwlog admin queue to libie ice: drop driver specific structure from fwlog code ice: check for PF number outside the fwlog code ice: move out debugfs init from fwlog ice: allow calling custom send function in fwlog ice: add pdev into fwlog structure and use it for logging ice: introduce ice_fwlog structure ice: drop ice_pf_fwlog_update_module() ice: move get_fwlog_data() to fwlog file ice: make fwlog functions static ==================== Link: https://patch.msgid.link/20250911210525.345110-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 617d53f74b8488ba5636c56737afe8d321566ee2 Merge: 1611666834d70d 7d4b52174dacf5 Author: Jakub Kicinski Date: Sun Sep 14 13:00:56 2025 -0700 Merge branch 'pru-icssm-ethernet-driver' Parvathi Pudi says: ==================== PRU-ICSSM Ethernet Driver The Programmable Real-Time Unit Industrial Communication Sub-system (PRU-ICSS) is available on the TI SOCs in two flavors: Gigabit ICSS (ICSSG) and the older Megabit ICSS (ICSSM). Support for ICSSG Dual-EMAC mode has already been mainlined [1] and the fundamental components/drivers such as PRUSS driver, Remoteproc driver, PRU-ICSS INTC, and PRU-ICSS IEP drivers are already available in the mainline Linux kernel. The current set of patch series builds on top of these components and introduces changes to support the Dual-EMAC using ICSSM on the TI AM57xx, AM437x and AM335x devices. AM335x, AM437x and AM57xx devices may have either one or two PRU-ICSS instances with two 32-bit RISC PRU cores. Each PRU core has (a) dedicated Ethernet interface (MII, MDIO), timers, capture modules, and serial communication interfaces, and (b) dedicated data and instruction RAM as well as shared RAM for inter PRU communication within the PRU-ICSS. These patches add support for basic RX and TX functionality over PRU Ethernet ports in Dual-EMAC mode. Further, note that these are the initial set of patches for a single instance of PRU-ICSS Ethernet. Additional features such as Ethtool support, VLAN Filtering, Multicast Filtering, Promiscuous mode, Storm prevention, Interrupt coalescing, Linux PTP (ptp4l) Ordinary clock and Switch mode support for AM335x, AM437x and AM57x along with support for a second instance of PRU-ICSS on AM57x will be posted subsequently. The patches presented in this series have gone through the patch verification tools and no warnings or errors are reported. Sample test logs obtained from AM33x, AM43x and AM57x verifying the functionality on Linux next kernel are available here: [Interface up Testing](https://gist.github.com/ParvathiPudi/59ca0087dc7bed0f83a3b0e6db27d39c) [Ping Testing](https://gist.github.com/ParvathiPudi/bcd39aa7006f6176d8c5b71a23d0928b) [Iperf Testing](https://gist.github.com/ParvathiPudi/9bb4fa42410fbc757a93f65ecb45e4f3) [1] https://lore.kernel.org/all/20230106121046.886863-1-danishanwar@ti.com/ [2] https://lore.kernel.org/all/20250108125937.10604-1-basharath@couthit.com/ ==================== Link: https://patch.msgid.link/20250912104741.528721-1-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit 7d4b52174dacf58526fe67dd7ed6b2c6c77fc77c Author: Parvathi Pudi Date: Fri Sep 12 18:23:01 2025 +0530 MAINTAINERS: Add entries for ICSSM Ethernet driver Add an entry to MAINTAINERS file for the ICSSM Ethernet driver with appropriate maintainer information and mailing list. Signed-off-by: Parvathi Pudi Link: https://patch.msgid.link/20250912125421.530286-7-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit 1853367b76cd7568cd903db938651d799f49065c Author: Parvathi Pudi Date: Fri Sep 12 17:23:29 2025 +0530 net: ti: icssm-prueth: Adds IEP support for PRUETH on AM33x, AM43x and AM57x SOCs Added API hooks for IEP module (legacy 32-bit model) to support timestamping requests from application. Reviewed-by: Mohan Reddy Putluru Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Link: https://patch.msgid.link/20250912115443.529856-6-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit e15472e8f2e7eb2abf9059bba3797463f4f6d2d5 Author: Roger Quadros Date: Fri Sep 12 17:23:28 2025 +0530 net: ti: icssm-prueth: Adds link detection, RX and TX support. Changes corresponding to link configuration such as speed and duplexity. IRQ and handler initializations are performed for packet reception.Firmware receives the packet from the wire and stores it into OCMC queue. Next, it notifies the CPU via interrupt. Upon receiving the interrupt CPU will service the IRQ and packet will be processed by pushing the newly allocated SKB to upper layers. When the user application want to transmit a packet, it will invoke sys_send() which will in turn invoke the PRUETH driver, then it will write the packet into OCMC queues. PRU firmware will pick up the packet and transmit it on to the wire. Reviewed-by: Mohan Reddy Putluru Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Link: https://patch.msgid.link/20250912115443.529856-5-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit a99b56577da4398e602394518618c720db5b7cbb Author: Roger Quadros Date: Fri Sep 12 17:23:27 2025 +0530 net: ti: icssm-prueth: Adds PRUETH HW and SW configuration Updates for MII_RT hardware peripheral configuration such as RX and TX configuration for PRU0 and PRU1, frame sizes, and MUX config. Updates for PRU-ICSS firmware register configuration and DRAM, SRAM and OCMC memory initialization, which will be used in the runtime for packet reception and transmission. DUAL-EMAC memory allocation for software queues and its supporting components such as the buffer descriptors and queue descriptors. These software queues are placed in OCMC memory and are shared with CPU by PRU-ICSS for packet receive and transmit. All declarations and macros are being used from common header file for various protocols. Reviewed-by: Mohan Reddy Putluru Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Link: https://patch.msgid.link/20250912115443.529856-4-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit 511f6c1ae093c7045742299d29eba71925709a71 Author: Roger Quadros Date: Fri Sep 12 16:14:51 2025 +0530 net: ti: icssm-prueth: Adds ICSSM Ethernet driver Updates Kernel configuration to enable PRUETH driver and its dependencies along with makefile changes to add the new PRUETH driver. Changes includes init and deinit of ICSSM PRU Ethernet driver including net dev registration and firmware loading for DUAL-MAC mode running on PRU-ICSS2 instance. Changes also includes link handling, PRU booting, default firmware loading and PRU stopping using existing remoteproc driver APIs. Reviewed-by: Mohan Reddy Putluru Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Link: https://patch.msgid.link/20250912104741.528721-3-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit eb391228ae08dfc153f8838ed700bb75a28b1493 Author: Parvathi Pudi Date: Fri Sep 12 16:14:50 2025 +0530 dt-bindings: net: ti: Adds DUAL-EMAC mode support on PRU-ICSS2 for AM57xx, AM43xx and AM33xx SOCs Documentation update for the newly added "pruss2_eth" device tree node and its dependencies along with compatibility for PRU-ICSS Industrial Ethernet Peripheral (IEP), PRU-ICSS Enhanced Capture (eCAP) peripheral and using YAML binding document for AM57xx SoCs. Reviewed-by: Mohan Reddy Putluru Co-developed-by: Basharath Hussain Khaja Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250912104741.528721-2-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit 989ca853ddeefad448bdfb771113faf9cc480936 Author: Janne Grunau Date: Thu Aug 28 16:52:09 2025 +0200 spi: apple: Add "apple,t8103-spi" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,spi" anymore [1]. Use "apple,t8103-spi" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Mark Brown Signed-off-by: Janne Grunau commit 096f12b45eabbbeb153a0a493d922c9f31210d50 Author: Janne Grunau Date: Thu Aug 28 16:01:48 2025 +0200 ASoC: apple: mca: Add "apple,t8103-mca" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,mca" anymore [1]. Use "apple,t8103-mca" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Mark Brown Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau commit 856f3d7557209f4d320b3bb9a7f2a999a205a5e7 Author: Janne Grunau Date: Thu Aug 28 16:01:27 2025 +0200 pinctrl: apple: Add "apple,t8103-pinctrl" as compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pinctrl" anymore [1]. Use "apple,t8103-pinctrl" as fallback compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Linus Walleij Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau commit b85efa8dcbb3b4147ebab9dc053e8bb20c7c48f9 Author: Janne Grunau Date: Thu Aug 28 16:52:10 2025 +0200 spi: dt-bindings: apple,spi: Add t6020-spi compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,spi" anymore [1]. Use "apple,t8103-spi" as base compatible as it is the SoC the driver and bindings were written for. The SPI controller on Apple M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-spi" so add its per-SoC compatible with the former as fallback used by the existing driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Mark Brown Signed-off-by: Janne Grunau commit a3ec6ef203e436dfa7fd007d2122b3bc3679edb6 Author: Janne Grunau Date: Thu Aug 28 16:01:49 2025 +0200 ASoC: dt-bindings: apple,mca: Add t6020-mca compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,mca" anymore [1]. Use "apple,t8103-mca" as base compatible as it is the SoC the driver and bindings were written for. mca on Apple's M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-mca" so add its per-SoC compatible with the former as fallbeck used by the existing driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Mark Brown Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 19cf142ab94d326fb06582fda57485801e1c328d Author: Janne Grunau Date: Thu Aug 28 16:01:47 2025 +0200 dt-bindings: dma: apple,admac: Add t6020-admac compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,admac" anymore [1]. Use "apple,t8103-admac" as base compatible as it is the SoC the driver and bindings were written for. admac on Apple's M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-admac" so add its per-SoC compatible with the former as fallback used by the existing driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit ff0b47ab71a6171da70319b147efe6fa675a471f Author: Janne Grunau Date: Thu Aug 28 16:01:45 2025 +0200 dt-bindings: clock: apple,nco: Add t6020-nco compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,nco" anymore [1]. Use "apple,t8103-nco" as base compatible as it is the SoC the driver and bindings were written for. The block found on Apple's M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-nco" so add its per-SoC compatible with the former as fallback used by the existing driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 5410df1a5a4b1d23abcb0dfe1b43c9745b731749 Author: Janne Grunau Date: Thu Aug 28 16:01:43 2025 +0200 dt-bindings: watchdog: apple,wdt: Add t6020-wdt compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,wdt" anymore [1]. Use "apple,t8103-wdt" as base compatible as it is the SoC the driver and bindings were written for. The block on the Apple M2 Pro/Max/Ultra SoCs is compatible with the existing driver so add its per-SoC compatible. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 006d3506094ce32984d53001b502826b8fe410d3 Author: Janne Grunau Date: Thu Aug 28 16:01:41 2025 +0200 dt-bindings: spmi: apple,spmi: Add t6020-spmi compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,spmi" anymore [1]. Use "apple,t8103-spmi" as base compatible as it is the SoC the driver and bindings were written for. The SPMI controller on Apple M2 Pro/Max/Ultra is compatible to "apple,t8103-spmi" so add its per-SoC compatible with the former as fallback used by the existing driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit b7e4229a5a2c9c25be4acf99153071779864be95 Author: Janne Grunau Date: Thu Aug 28 16:01:38 2025 +0200 dt-bindings: mfd: apple,smc: Add t6020-smc compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,smc" anymore [1]. Use "apple,t8103-smc" as base compatible as it is the SoC the driver and bindings were written for. SMC on Apple's M2 Pro/Max/Ultra SoCs is compatible with the existing driver so add its per-SoC compatible with the new base compatible as fallback used by the driver. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 4fb80f2f90d6882ead09d5333dee82ec8df580b0 Author: Janne Grunau Date: Thu Aug 28 16:01:36 2025 +0200 dt-bindings: net: bcm4329-fmac: Add BCM4388 PCI compatible BCM4388 WiFi/BT modules are found on Apple silicon devices using M2 Pro/Max/Ultra and later. Driver support for this module is not submitted yet. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit ef4d6ea11df035d742d4ef4ba21fbe401fc05d86 Author: Janne Grunau Date: Thu Aug 28 16:01:35 2025 +0200 dt-bindings: net: bcm4377-bluetooth: Add BCM4388 compatible Add BCM4388 PCI vendor/product ID as compatible. The BCM4388 WiFi/BT module is found on Apple silicon devices with M2 Pro/Max/Ultra and later. Support for this variant was added in 2024 without amending the dt-bindings. Link: https://lore.kernel.org/asahi/20240602-btbcm4388-v1-1-210e4b4eeb3b@svenpeter.dev/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit a3ee3333467c076a1f0655dbe6d4950af360c3a5 Author: Janne Grunau Date: Thu Aug 28 16:01:34 2025 +0200 dt-bindings: nvme: apple: Add apple,t6020-nvme-ans2 compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,nvme-ans2" anymore [1]. Add "apple,t8103-nvme-ans2" as fallback compatible as it is the SoC the driver and bindings were written for. Invert the condition for the 2 or 3 power-domains check to allow using "apple,t8103-nvme-ans2" as base compatible. "apple,t6020-nvme-ans2" on Apple M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-nvme-ans2" so add its per-SoC compatible. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 9d7b6d117df245721902a497d90da220d7c27ee5 Author: Janne Grunau Date: Thu Aug 28 16:01:32 2025 +0200 dt-bindings: iommu: apple,sart: Add apple,t6020-sart compatible "apple,t6020-sart" as found in Apple's M2 Pro/Max/Ultra SoCs is compatible with SART3 used in t6000. Add its per-SoC compatible to allow a distinction should it become necessary. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit c7a4fe4086ad5fabb1ca8a8bd3f02e728eab1eb9 Author: Janne Grunau Date: Thu Aug 28 16:01:31 2025 +0200 dt-bindings: gpu: apple,agx: Add agx-{g14s,g14c,g14d} compatibles Add compatibles for the GPU variants found on Apple's M2 Pro/Max/Ultra SoCs. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 9f601db6a1c0c7e191f7948a18f9daedde009836 Author: Janne Grunau Date: Thu Aug 28 16:01:30 2025 +0200 dt-bindings: mailbox: apple,mailbox: Add t6020 compatible The mailbox hardware remains unchanged on M2 Pro/Max/Ultra SoCs so just add its per-SoC compatible. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit aa5272300c5acaef878d32205b3b3bfd80084c14 Author: Janne Grunau Date: Thu Aug 28 16:01:28 2025 +0200 dt-bindings: pinctrl: apple,pinctrl: Add apple,t6020-pinctrl compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pinctrl" anymore [1]. Use "apple,t8103-pinctrl" as fallback compatible as it is the SoC the driver and bindings were written for. The M2 Pro/Max/Ultra SoCs use the same pinctrl hardware, so just add its per-SoC compatible using the new base as fallback. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Linus Walleij Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 874c90221e261b7a778f6beacd3d5f7e9a701a64 Author: Janne Grunau Date: Thu Aug 28 16:01:26 2025 +0200 dt-bindings: iommu: dart: Add apple,t6020-dart compatible t6020-dart is compatible to t8110-dart and annotated as such in Apple's device tree. Add its per-SoC compatible in case t6020 specific handling becomes necessary. The dart instances on M2 Pro/Max/Ultra based SoCs differ in one aspect from the M2 based ones. They indicate an IAS of 42 requiring implementing support for a fouth page table level in the dart driver and its io-pgtable [1]. [1]: https://lore.kernel.org/asahi/20250821-apple-dart-4levels-v2-0-e39af79daa37@jannau.net/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 0b95df9004b150c38cf9177735c39a51fff00561 Author: Janne Grunau Date: Thu Aug 28 16:01:25 2025 +0200 dt-bindings: interrupt-controller: apple,aic2: Add apple,t6020-aic compatible The Apple M2 Pro/Max/Ultra SoCs use AIC2 as interrupt controller. This is the final SoC added as compatible as Apple M3 and later use AIC3. Apple's A15 uses AIC2 as well but has no official support for alternate operating systems. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 5a606b577cba2326e122811ab5130ff56568902f Author: Janne Grunau Date: Thu Aug 28 16:01:24 2025 +0200 dt-bindings: cpufreq: apple,cluster-cpufreq: Add t6020 compatible The CPU frequency control on M2 Pro/Max/Ultra SoCs is compatible to the M2 (T8112) one. So add this with the per-SoC compatible to the bindings. Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 48553ae8cc09ca7f720b20f7253d528cb8052847 Author: Janne Grunau Date: Thu Aug 28 16:01:23 2025 +0200 dt-bindings: power: apple,pmgr-pwrstate: Add t6020 compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use "apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the driver and bindings were written for. The implementation on Apple M2 Pro/Max/Ultra SoCs is compatible so add its per-SoC compatible with the new base. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit e13f988c4591eed99f5f34d396458f315f0f5651 Author: Janne Grunau Date: Thu Aug 28 16:01:21 2025 +0200 dt-bindings: arm: apple: apple,pmgr: Add t6020-pmgr compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pmgr" anymore [1]. Use "apple,t8103-pmgr" as base compatible as it is the SoC the bindings were written for. The block on Apple M2 Pro/Max/Ultra SoCs is compatible with "apple,t8103-pmgr" so use it as fallback compatible and add t6020 as per-SoC compatible. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Acked-by: Krzysztof Kozlowski Reviewed-by: Neal Gompa Acked-by: Rob Herring (Arm) Signed-off-by: Janne Grunau commit 1611666834d70d951614b20e6eacf94b296a1e3c Author: Christian Marangi Date: Thu Sep 11 15:08:33 2025 +0200 net: phy: broadcom: Convert to PHY_ID_MATCH_MODEL macro Convert the pattern phy_id phy_id_mask to the generic PHY_ID_MATCH_MODEL macro to drop hardcoding magic mask. Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250911130840.23569-3-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 64d1726ba9d32743be1caf2257d26346a526bc16 Author: Christian Marangi Date: Thu Sep 11 15:08:32 2025 +0200 net: phy: broadcom: Convert to phy_id_compare_model() Convert driver to phy_id_compare_model() helper instead of the custom BRCM_PHY_MODEL macro. Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250911130840.23569-2-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit ae1c658b33d4bec20c037aebba583a68375d4773 Author: Christian Marangi Date: Thu Sep 11 15:08:31 2025 +0200 net: phy: introduce phy_id_compare_model() PHY ID helper Similar to phy_id_compare_vendor(), introduce the equivalent phy_id_compare_model() helper for the generic PHY ID Model mask. Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250911130840.23569-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit e0706474b186ed4a99a98c8650f1cdbbd27b7509 Merge: 9c0d0fa8d4a871 98d8ea566b85c4 Author: Jakub Kicinski Date: Sun Sep 14 11:59:21 2025 -0700 Merge branch 'net-stmmac-timestamping-ptp-cleanups' Russell King says: ==================== net: stmmac: timestamping/ptp cleanups This series cleans up the hardware timestamping / PTP initialisation and cleanup code in the stmmac driver. Several key points in no particular order: 1. Golden rule: unregister first, then release resources. stmmac_release_ptp didn't do this. 2. Avoid leaking resources - __stmmac_open() failure leaves the timestamping support initialised, but stops its clock. Also violates (1). 3. Avoid double-release of resources - stmmac_open() followed by stmmac_xdp_open() failing results in the PTP clock prepare and enable counts being released, and if the interface is then brought down, they are incorrectly released again. As XDP doesn't gain any additional prepare/enables on the PTP clock, remove this incorrect cleanup. 4. Changing the MTU of the interface is disruptive to PTP, and remains so as long as. This is not fixed by this series (too invasive at the moment.) 5. Avoid exporting functions that aren't used... 6. Avoid unnecessary runtime PM state manipulations (no point manipulating this when MTU changes). 7. Make the PTP/timestamping initialisation more readable - no point calling functions in the same file from one callsite that return error codes from one location in the called function, to only have the sole callee print messages depending on that return code. Also simplifying the mess in stmmac_hw_setup(). Also placing support checks in a better location. Also getting rid of the "ptp_register" boolean through this restructuring. v1 was tested by Gatien CHEVALLIER - thanks. ==================== Link: https://patch.msgid.link/aMKtV6O0WqlmJFN4@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 98d8ea566b85c41a6f32ea38bb91b35f0ac73c1e Author: Russell King (Oracle) Date: Thu Sep 11 12:10:28 2025 +0100 net: stmmac: move timestamping/ptp init to stmmac_hw_setup() caller Move the call to stmmac_init_timestamping() or stmmac_setup_ptp() out of stmmac_hw_setup() to its caller after stmmac_hw_setup() has successfully completed. This slightly changes the ordering during setup, but should be safe to do. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 9d5059228c55c8d05590830468f5e1cb90440a41 Author: Russell King (Oracle) Date: Thu Sep 11 12:10:23 2025 +0100 net: stmmac: move PTP support check into stmmac_init_timestamping() Move the PTP support check from stmmac_init_tstamp_counter() into stmmac_init_timestamping() as it makes more sense to be there. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 84b994ac4e4ea60b7752372c581796b95fc88656 Author: Russell King (Oracle) Date: Thu Sep 11 12:10:18 2025 +0100 net: stmmac: add stmmac_setup_ptp() Add a function to setup PTP, which will enable the clock, initialise the timestamping, and register with the PTP clock subsystem. Call this when we want to register the PTP clock in stmmac_hw_setup(), otherwise just call the Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit b09f58ddc6ca8ae09e3df9ca485d92cc504b238f Author: Russell King (Oracle) Date: Thu Sep 11 12:10:13 2025 +0100 net: stmmac: rename stmmac_init_ptp() Changes to the stmmac driver to fix various issues with PTP have made stmmac_init_ptp() less about initialising the entire PTP block, and now primarily deals with the packet timestamping support. The exception to this is ptp_clk_freq_config(), which is an odditiy. It remains as stmmac_init_ptp() is used both at .ndo_open() time and in the resume paths. However, restructuring this code to make it more easily readable makes the continued use of "init_ptp" confusing. In preparation to cleaning up the (re-)initialisation of timestamping, rename the existing stmmac_init_ptp() to stmmac_init_timestamping() which better reflects its functionality. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 4fbd180acd5784ea6fd98aeeeb829e11294a9b75 Author: Russell King (Oracle) Date: Thu Sep 11 12:10:07 2025 +0100 net: stmmac: move stmmac_init_ptp() messages into function Move the stmmac_init_ptp() messages from stmmac_hw_setup() to stmmac_init_ptp(), which will allow further cleanups. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 67ec43792b110540211485deb59e33839d8a2f5a Author: Russell King (Oracle) Date: Thu Sep 11 12:10:02 2025 +0100 net: stmmac: add __stmmac_release() to complement __stmmac_open() Rename stmmac_release() to __stmmac_release(), providing a new stmmac_release() method. Update stmmac_change_mtu() to use __stmmac_release(). Move the runtime PM handling into stmmac_open() and stmmac_release(). This avoids stmmac_change_mtu() needlessly fiddling with the runtime PM state, and will allow future changes to remove code from __stmmac_open() and __stmmac_release() that should only happen when the net device is administratively brought up or down. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit ff2e19d5690e00396c897aa63f7fcf64eeec7c1b Author: Russell King (Oracle) Date: Thu Sep 11 12:09:57 2025 +0100 net: stmmac: unexport stmmac_init_tstamp_counter() Nothing outside of stmmac_main.c makes use of stmmac_init_tstamp_counter(), so there's no point exporting it for modules, or even having it non-static. Remove the export and make it static. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 586f1aebc9a112d5e76af045e38fda0632176fae Author: Russell King (Oracle) Date: Thu Sep 11 12:09:52 2025 +0100 net: stmmac: fix stmmac_xdp_open() clk_ptp_ref error cleanup Neither stmmac_xdp_release() nor the normal paths of stmmac_xdp_open() touch clk_ptp_ref, so stmmac_xdp_open() should not be doing anything with this clock. However, in its error path, it calls stmmac_hw_teardown() which disables and unprepares this clock, which can lead to the clock state becoming unbalanced when the netdev is taken administratively down. Remove this call to stmmac_hw_teardown(), and as this is the last user of this function, remove the function as well. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 454bbe5913b2c56a3b4c5bf85138b5382ba8b8e6 Author: Russell King (Oracle) Date: Thu Sep 11 12:09:47 2025 +0100 net: stmmac: fix PTP error cleanup in __stmmac_open() The cleanup function for stmmac_setup_ptp() is stmmac_release_ptp() which entirely undoes the effects of stmmac_setup_ptp() by unregistering the PTP device and then stopping the PTP clock, whereas stmmac_hw_teardown() will only stop the PTP clock while leaving the PTP device registered. This can lead to a kernel oops - if __stmmac_open() fails after registering the PTP clock, the PTP device will remain registered, and if the module is removed, subsequent PTP device accesses will lead to a kernel oops. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 99a8789afd1251f3b712f412661770e702ec7dbd Author: Russell King (Oracle) Date: Thu Sep 11 12:09:42 2025 +0100 net: stmmac: disable PTP clock after unregistering PTP Follow the principle of unpublish from userspace and then teardown resources. Disable the PTP clock only after unregistering with the PTP subsystem, which ensures that we only stop the clock that ticks the timesource after we have removed the PTP device. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 9a1d6fa0012dc998ceebab64bd6cb95e807185d3 Author: Russell King (Oracle) Date: Thu Sep 11 12:09:37 2025 +0100 net: stmmac: ptp: improve handling of aux_ts_lock lifetime The aux_ts_lock mutex is only required while the PTP clock has been successfully registered. stmmac_ptp_register() does not return any errors (as we don't wish to prevent the netdev being opened if PTP fails), stmmac_ptp_unregister() was coded to allow it to be called irrespective of whether PTP was successfully registered or not. Arrange for the aux_ts_lock mutex to be destroyed if the PTP clock is not functional during stmmac_ptp_register(), and only destroy it in stmmac_ptp_unregister() if we had a PTP clock registered. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 9c0d0fa8d4a8719adbe68108ebc9cd723cfa4493 Merge: 010fe36ad2a398 fbd12de4c5b1af Author: Jakub Kicinski Date: Sun Sep 14 11:56:26 2025 -0700 Merge branch 'net-dsa-mv88e6xxx-remove-redundant-ptp-timestamping-code' Russell King says: ==================== net: dsa: mv88e6xxx: remove redundant ptp/timestamping code mv88e6xxx as accumulated some unused data structures and code over the years. This series removes it and simplifies the code. See the patches for each change. ==================== Link: https://patch.msgid.link/aMKoYyN18FHFCa1q@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fbd12de4c5b1af3dc9d63103a121492317a8b80c Author: Russell King (Oracle) Date: Thu Sep 11 11:46:43 2025 +0100 net: dsa: mv88e6xxx: remove unused support for PPS event capture mv88e6352_config_eventcap() is documented as handling both EXTTS and PPS capture modes, but nothing ever calls it for PPS capture. Remove the unused PPS capture mode support, and the now unused MV88E6XXX_TAI_EVENT_STATUS_CAP_TRIG definition. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uwep9-00000004ikJ-2FeF@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ae4c94981683e39f75f202feedc300da7a545209 Author: Russell King (Oracle) Date: Thu Sep 11 11:46:38 2025 +0100 net: dsa: mv88e6xxx: remove chip->evcap_config evcap_config is only read and written in mv88e6352_config_eventcap(), so it makes little sense to store it in the global chip struct. Make it a local variable instead. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uwep4-00000004ikD-1ZEh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 578c1eb9c541ba8843bac324e3e5c092595d7514 Author: Russell King (Oracle) Date: Thu Sep 11 11:46:33 2025 +0100 net: dsa: mv88e6xxx: remove chip->trig_config chip->trig_config is never written, and thus takes the value zero. Remove this struct member and its single reader. Reviewed-by: Vadim Fedorenko Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uweoz-00000004ik7-13Fl@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit afc0e12a235ce86dfe321f893b4d1dfe4d195dbe Author: Russell King (Oracle) Date: Thu Sep 11 11:46:28 2025 +0100 net: dsa: mv88e6xxx: remove mv88e6250_ptp_ops mv88e6250_ptp_ops and mv88e6352_ptp_ops are identical since commit 7e3c18097a70 ("net: dsa: mv88e6xxx: read cycle counter period from hardware"). Remove the unnecessary duplication. Reviewed-by: Vadim Fedorenko Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uweou-00000004ik1-0aiX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 010fe36ad2a398adc06c54983466b2f08658d748 Author: Mahanta Jambigi Date: Wed Sep 10 08:31:25 2025 +0200 net/smc: Remove unused argument from 2 SMC functions The smc argument is not used in both smc_connect_ism_vlan_setup() & smc_connect_ism_vlan_cleanup(). Hence removing it. Signed-off-by: Mahanta Jambigi Reviewed-by: Sidraya Jayagond Reviewed-by: Dust Li Link: https://patch.msgid.link/20250910063125.2112577-1-mjambigi@linux.ibm.com Signed-off-by: Jakub Kicinski commit 66048f8b3cc7e462953c04285183cdee43a1cb89 Author: Yafang Shao Date: Tue Sep 2 14:29:33 2025 +0800 net/cls_cgroup: Fix task_get_classid() during qdisc run During recent testing with the netem qdisc to inject delays into TCP traffic, we observed that our CLS BPF program failed to function correctly due to incorrect classid retrieval from task_get_classid(). The issue manifests in the following call stack: bpf_get_cgroup_classid+5 cls_bpf_classify+507 __tcf_classify+90 tcf_classify+217 __dev_queue_xmit+798 bond_dev_queue_xmit+43 __bond_start_xmit+211 bond_start_xmit+70 dev_hard_start_xmit+142 sch_direct_xmit+161 __qdisc_run+102 <<<<< Issue location __dev_xmit_skb+1015 __dev_queue_xmit+637 neigh_hh_output+159 ip_finish_output2+461 __ip_finish_output+183 ip_finish_output+41 ip_output+120 ip_local_out+94 __ip_queue_xmit+394 ip_queue_xmit+21 __tcp_transmit_skb+2169 tcp_write_xmit+959 __tcp_push_pending_frames+55 tcp_push+264 tcp_sendmsg_locked+661 tcp_sendmsg+45 inet_sendmsg+67 sock_sendmsg+98 sock_write_iter+147 vfs_write+786 ksys_write+181 __x64_sys_write+25 do_syscall_64+56 entry_SYSCALL_64_after_hwframe+100 The problem occurs when multiple tasks share a single qdisc. In such cases, __qdisc_run() may transmit skbs created by different tasks. Consequently, task_get_classid() retrieves an incorrect classid since it references the current task's context rather than the skb's originating task. Given that dev_queue_xmit() always executes with bh disabled, we can use softirq_count() instead to obtain the correct classid. The simple steps to reproduce this issue: 1. Add network delay to the network interface: such as: tc qdisc add dev bond0 root netem delay 1.5ms 2. Build two distinct net_cls cgroups, each with a network-intensive task 3. Initiate parallel TCP streams from both tasks to external servers. Under this specific condition, the issue reliably occurs. The kernel eventually dequeues an SKB that originated from Task-A while executing in the context of Task-B. It is worth noting that it will change the established behavior for a slightly different scenario: prior to this patch the skb will be classified with the 'new' task A classid, now with the old/original one. The bpf_get_cgroup_classid_curr() function is a more appropriate choice for this case. Signed-off-by: Yafang Shao Cc: Daniel Borkmann Cc: Thomas Graf Cc: Sebastian Andrzej Siewior Cc: Nikolay Aleksandrov Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com Signed-off-by: Jakub Kicinski commit c4deabbc1abe452ea230b86d53ed3711e5a8a062 Author: Haiyang Zhang Date: Wed Sep 10 13:57:21 2025 -0700 net: mana: Reduce waiting time if HWC not responding If HW Channel (HWC) is not responding, reduce the waiting time, so further steps will fail quickly. This will prevent getting stuck for a long time (30 minutes or more), for example, during unloading while HWC is not responding. Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/1757537841-5063-1-git-send-email-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit fdae0ab67d57d480dc61e9fb45678bbdc3786711 Author: Eric Dumazet Date: Tue Sep 9 12:19:42 2025 +0000 net: use NUMA drop counters for softnet_data.dropped Hosts under DOS attack can suffer from false sharing in enqueue_to_backlog() : atomic_inc(&sd->dropped). This is because sd->dropped can be touched from many cpus, possibly residing on different NUMA nodes. Generalize the sk_drop_counters infrastucture added in commit c51613fa276f ("net: add sk->sk_drop_counters") and use it to replace softnet_data.dropped with NUMA friendly softnet_data.drop_counters. This adds 64 bytes per cpu, maybe more in the future if we increase the number of counters (currently 2) per 'struct numa_drop_counters'. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250909121942.1202585-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 278289bcec901663868048497e36c92560bd1b14 Merge: fc006f5478fcf0 57e9e4d7023a0d Author: Jakub Kicinski Date: Sun Sep 14 11:33:51 2025 -0700 Merge branch 'add-gmac-support-for-renesas-rz-t2h-n2h-socs' Lad Prabhakar says: ==================== Add GMAC support for Renesas RZ/{T2H, N2H} SoCs This series adds support for the Ethernet MAC (GMAC) IP present on the Renesas RZ/T2H and RZ/N2H SoCs. While these SoCs use the same Synopsys DesignWare MAC IP (version 5.20) as the existing RZ/V2H(P), the hardware is synthesized with different options that require driver and binding updates: - 8 RX/TX queue pairs instead of 4 (requiring 19 interrupts vs 11) - Different clock requirements (3 clocks vs 7) - Different reset handling (2 named resets vs 1 unnamed) - Split header feature enabled - GMAC connected through a MIIC PCS on RZ/T2H The series first updates the generic dwmac binding to accommodate the higher interrupt count, then extends the Renesas-specific binding with a to document both SoCs. The driver changes prepare for multi-SoC support by introducing OF match data for per-SoC configuration, then add RZ/T2H support including PCS integration through the existing RZN1 MIIC driver. Note this patch series is dependent on the PCS driver [0] (not a build dependency). [0] https://lore.kernel.org/all/20250904114204.4148520-1-prabhakar.mahadev-lad.rj@bp.renesas.com/ ==================== Link: https://patch.msgid.link/20250908105901.3198975-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 57e9e4d7023a0d23869753b1baf4a89e6774107a Author: Lad Prabhakar Date: Mon Sep 8 11:59:01 2025 +0100 net: stmmac: dwmac-renesas-gbeth: Add support for RZ/T2H SoC Extend the Renesas GBETH stmmac glue driver to support the RZ/T2H SoC, where the GMAC is connected through a MIIC PCS. Introduce a new `has_pcs` flag in `struct renesas_gbeth_of_data` to indicate when PCS handling is required. When enabled, the driver parses the `pcs-handle` phandle, creates a PCS instance with `miic_create()`, and wires it into phylink. Proper cleanup is done with `miic_destroy()`. New init/exit/select hooks are added to `plat_stmmacenet_data` for PCS integration. Update Kconfig to select `PCS_RZN1_MIIC` when building the Renesas GBETH driver so the PCS support is always available. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20250908105901.3198975-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 264c26934f75e78cb71817a102184bd88a98932f Author: Lad Prabhakar Date: Mon Sep 8 11:59:00 2025 +0100 net: stmmac: dwmac-renesas-gbeth: Use OF data for configuration Prepare for adding RZ/T2H SoC support by making the driver configuration selectable via OF match data. While the RZ/V2H(P) and RZ/T2H use the same version of the Synopsys DesignWare MAC (version 5.20), the hardware is synthesized with different options. To accommodate these differences, introduce a struct holding per-SoC configuration such as clock list, number of clocks, TX clock rate control, and STMMAC flags, and retrieve it from the device tree match entry during probe. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20250908105901.3198975-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit d43ce98223496e68bf8f12b42325e39ea5ae7247 Author: Lad Prabhakar Date: Mon Sep 8 11:58:59 2025 +0100 dt-bindings: net: renesas,rzv2h-gbeth: Document Renesas RZ/T2H and RZ/N2H SoCs Add device tree binding support for the Gigabit Ethernet MAC (GMAC) IP on Renesas RZ/T2H and RZ/N2H SoCs. While these SoCs use the same Synopsys DesignWare MAC version 5.20 as RZ/V2H, they are synthesized with different hardware configurations. Add new compatible strings "renesas,r9a09g077-gbeth" for RZ/T2H and "renesas,r9a09g087-gbeth" for RZ/N2H, with the latter using RZ/T2H as fallback since they share identical GMAC IP. Update the schema to handle hardware differences between SoC variants. RZ/T2H requires only 3 clocks compared to 7 on RZ/V2H, supports 8 RX/TX queue pairs instead of 4, and needs 2 reset controls with reset-names property versus a single unnamed reset. RZ/T2H also has the split header feature enabled which is disabled on RZ/V2H. Add support for an optional pcs-handle property to connect the GMAC to the MIIC PCS converter on RZ/T2H. Use conditional schema validation to enforce the correct clock, reset, and interrupt configurations per SoC variant. Extend the base snps,dwmac.yaml schema to accommodate the increased interrupt count, supporting up to 19 interrupts and extending the rx-queue and tx-queue interrupt name patterns to cover queues 0-7. Signed-off-by: Lad Prabhakar Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250908105901.3198975-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit cca07ac2b5f7838b8ff612b53b9f82ac8cb58312 Author: Chen-Yu Tsai Date: Sun Sep 14 01:35:11 2025 +0800 arm64: dts: allwinner: sun55i: Complete AXP717A sub-functions When the AXP717A PMIC is missing nodes for the sub-functions, the kernel complains about not found nodes. Add all the remaining nodes corresponding to the defined functions for the dev boards, which have publicly available schematics to base this change on. The battery charger on all of them are disabled. Also add an "iio-hwmon" node to express some of the ADC channels as hwmon sensors. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250913173511.4064176-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit bd1ce7ef6aef4ee7349eb3124166e712693650ce Author: Chen-Yu Tsai Date: Sat Sep 13 18:24:50 2025 +0800 arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k crystal When the board was added, its external 32.768 KHz crystal was described but not hooked up correctly. This meant the device had to fall back to the SoC's internal oscillator or divide a 32 KHz clock from the main oscillator, neither of which are accurate for the RTC. As a result the RTC clock will drift badly. Hook the crystal up to the RTC block and request the correct clock rate. Fixes: de713ccb9934 ("arm64: dts: allwinner: t527: Add OrangePi 4A board") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250913102450.3935943-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 Author: Chen-Yu Tsai Date: Sat Sep 13 18:24:49 2025 +0800 arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal When the board was added, its external 32.768 KHz crystal was described but not hooked up correctly. This meant the device had to fall back to the SoC's internal oscillator or divide a 32 KHz clock from the main oscillator, neither of which are accurate for the RTC. As a result the RTC clock will drift badly. Hook the crystal up to the RTC block and request the correct clock rate. Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 9f01e1e14e71defefcb4d6823b8476a15f3cf04a Author: Chen-Yu Tsai Date: Sat Sep 13 18:24:48 2025 +0800 arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal The Radxa Cubie A5E has empty pads for a 32.768 KHz crystal, but it is left unpopulated, as per the schematics and seen on board images. A dead give away is the RTC's LOSC auto switch register showing the external OSC to be abnormal. Drop the external crystal from the device tree. It was not referenced anyway. Fixes: c2520cd032ae ("arm64: dts: allwinner: a523: add Radxa A5E support") Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250913102450.3935943-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit e6fad4960fc67b7225255b10b080765b451a7bc7 Author: Chen-Yu Tsai Date: Sat Sep 13 18:16:00 2025 +0800 arm64: dts: sun55i: a523: Assign standard clock rates to PRCM bus clocks At least in the initial version of U-boot support landed upstream, the PRCM bus clocks were not configured, and left at their reset default 24 MHz clock rate. This is quite slow for the peripherals on them. The recommended rates from the manual are: - AHBS: 200 MHz - APBS0: 100 MHz - APBS1: 24 MHz Since 24 MHz is the hardware default, just assign rates for the first two. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250913101600.3932762-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 3df7ce0e43ad94afce24b6300e7836e2db6dc0ee Author: Guodong Xu Date: Fri Aug 22 11:06:34 2025 +0800 riscv: defconfig: Enable MMP_PDMA support for SpacemiT K1 SoC Enable CONFIG_MMP_PDMA in the riscv defconfig for SpacemiT K1 SoC boards. Signed-off-by: Guodong Xu Signed-off-by: Conor Dooley commit 125c62df09a3fa4143298658340f093d2bd364a6 Author: Yixun Lan Date: Wed Jun 11 22:56:04 2025 +0800 riscv: defconfig: run savedefconfig to reorder it Changes to defconfig should be always updated via 'make savedefconfig', run this command to make it aligned again. This will ease the effort of reviewing changes of defconfig in the future. Signed-off-by: Yixun Lan commit e4cb5665211013e5fe4488493b5bd6a13797901e Author: Ahmet Sezgin Duran Date: Fri Sep 12 16:26:27 2025 +0000 staging: sm750fb: rename camel case variable Rename regValue to reg_value to follow kernel coding style. Signed-off-by: Ahmet Sezgin Duran Link: https://lore.kernel.org/r/20250912162627.95010-1-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman commit 357704a3cf366146f1f829062970bc52162f0c76 Author: Akiyoshi Kurita Date: Sat Sep 13 01:26:13 2025 +0900 staging: rtl8723bs: hal: put return type and function name on one line Make the function definition of phy_StoreTxPowerByRateBase() follow the kernel coding style by placing the return type and function name on a single line. No functional change. Signed-off-by: Akiyoshi Kurita Link: https://lore.kernel.org/r/20250912162613.776769-1-weibu@redadmin.org Signed-off-by: Greg Kroah-Hartman commit 82432bbfb9e83b7e81d04660fe129b99a29b2ac2 Author: Hector Martin Date: Sun Sep 14 12:56:16 2025 +0000 usb: typec: tipd: Handle mode transitions for CD321x On Apple Silicon machines there is no control over which alt mode is chosen. The CD321x' firmware negotiates the target mode on its own and only lets the main CPU know after the mode has already been chosen. Especially after plugging a new cable in this can result to quick mode changes from e.g. power only -> USB3 only -> USB3+DisplayPort in a short time. It is not possile to influence this in any way and we also do not get direct access to the PDOs or VDOs exchanged via USB PD. Additionally, mode changes must be tightly synchronized between DWC3 and the Type C PHY and most mode changes require a full reset of DWC3 to make the port work correctly. This is all done synchronously from the role switch handler inside the DWC3 glue driver on these machines to avoid tripping any failsafes or watchdogs inside the Type-C PHY that may, in the worst case, reset the entire SoC. To be able to control all this we trigger the entire process in the correct order directly from the TIPD driver and de-bounce any mode changes to avoid tearing down and re-setting DWC3 back up multiple times any time a new connection is made. Signed-off-by: Hector Martin Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Co-developed-by: Sven Peter Signed-off-by: Sven Peter Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-11-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 04041fd7d6ec0bc5c4277711e17b43ffb45e30ba Author: Hector Martin Date: Sun Sep 14 12:56:15 2025 +0000 usb: typec: tipd: Read data status in probe and cache its value Just like for power status we also need to keep track of data status to be able to detect mode changes once we introduce de-bouncing for CD321x. Read it during probe and keep a cached copy of its value. Signed-off-by: Hector Martin Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-10-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 77ed2f4538da7356a1813e9d4e4c13de6e3d5a2a Author: Hector Martin Date: Sun Sep 14 12:56:14 2025 +0000 usb: typec: tipd: Use read_power_status function in probe We need the initial power status to be able to reliably detect connector changes once we introduce de-bouncing for CD321x next. read_power_status takes care of this and also forwards the status to the trace subsystem so let's use that instead of open-coding it inside probe. Signed-off-by: Hector Martin Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-9-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 36c791c1996db13d5042960aa5895f777239845b Author: Hector Martin Date: Sun Sep 14 12:56:13 2025 +0000 usb: typec: tipd: Update partner identity when power status was updated Whenever the power status is changed make sure to also update the partner identity to be able to detect changes once de-bouncing and mode changes are added for CD321x. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-8-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7b1d318506839ea8b71b258a3e48b1f87f69d1bb Author: Sven Peter Date: Sun Sep 14 12:56:12 2025 +0000 usb: typec: tipd: Register DisplayPort and Thunderbolt altmodes for cd321x Ports equipped with a CD321x are only found on Apple Silicon machines and always support DisplayPort, Thunderbolt and USB4. Register these port modes unconditionally. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-7-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0b31c978935fb15863c0299a4c35ec6e89b492d2 Author: Sven Peter Date: Sun Sep 14 12:56:11 2025 +0000 usb: typec: tipd: Read USB4, Thunderbolt and DisplayPort status for cd321x CD321x supports various alternate modes and stores information once these are entered into separate status registers. Read those when they are active when reading TPS_DATA_STATUS to prepare supporting these. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-6-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9f36fdfcf36445db4c886afdeff2d1d126f16c45 Author: Sven Peter Date: Sun Sep 14 12:56:10 2025 +0000 usb: typec: tipd: Add cd321x struct with separate size We're about to add more fields to struct tps6598x which are only relevant for Apple's CD321x and to ensure that we don't waste memory everywhere for those add a separate struct for cd321x and prepare to allocate more space inside probe. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-5-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 60e1ff66179ca59bf98ec64a849d0325c0db0f57 Author: Sven Peter Date: Sun Sep 14 12:56:09 2025 +0000 usb: typec: tipd: Trace data status for CD321x correctly Some bits inside the CD321x TPS_DATA_STATUS register have a different function compared to the original tipd chip. Add these and introduce a separate trace function to show them correctly. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-4-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit ff175d85888e6bb4c41101493b8e74717842fb39 Author: Sven Peter Date: Sun Sep 14 12:56:08 2025 +0000 usb: typec: tipd: Move switch_power_state to tipd_data When support for CD321x was originally added no other hardware variant was supported and there was no need for struct tipd_data. Now that it exists move the special case in there so that we can drop the of_device_is_compatible_check entirely. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-3-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit b3dddff502c5e049e43e3d0c43586de342b9e1d7 Author: Sven Peter Date: Sun Sep 14 12:56:07 2025 +0000 usb: typec: tipd: Move initial irq mask to tipd_data Since the irq mask was originally added more tipd variants have been introduced and there's now struct tipd_data. Move the initial mask in there. Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-2-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit be5ae730ffa6fd774a00a4705c1e11e078b08ca1 Author: Sven Peter Date: Sun Sep 14 12:56:06 2025 +0000 usb: typec: tipd: Clear interrupts first Right now the interrupt handler first reads all updated status registers and only then clears the interrupts. It's possible that a duplicate interrupt for a changed register or plug state comes in after the interrupts have been processed but before they have been cleared: * plug is inserted, TPS_REG_INT_PLUG_EVENT is set * TPS_REG_INT_EVENT1 is read * tps6598x_handle_plug_event() has run and registered the plug * plug is removed again, TPS_REG_INT_PLUG_EVENT is set (again) * TPS_REG_INT_CLEAR1 is written, TPS_REG_INT_PLUG_EVENT is cleared We then have no plug connected and no pending interrupt but the tipd core still thinks there is a plug. It's possible to trigger this with e.g. a slightly broken Type-C to USB A converter. Fix this by first clearing the interrupts and only then reading the updated registers. Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X") Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Cc: stable@kernel.org Reviewed-by: Heikki Krogerus Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-1-4e99c8649024@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3b5eba544a8af6826209d34daf6197b79b1333bf Author: Ricardo B. Marliere Date: Sun Feb 4 10:29:39 2024 -0300 perf: make pmu_bus const Now that the driver core can properly handle constant struct bus_type, move the pmu_bus variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Greg Kroah-Hartman Suggested-by: Greg Kroah-Hartman Signed-off-by: "Ricardo B. Marliere" Acked-by: Mark Rutland Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240204-bus_cleanup-events-v1-1-c779d1639c3a@marliere.net Signed-off-by: Greg Kroah-Hartman commit dc8662956496d2bfeee95eca3cf57d7b9a8f2ba4 Author: Dan Carpenter Date: Fri Sep 12 18:03:22 2025 +0300 arm64: dts: s32g: Add device tree information for the OCOTP driver Add the device tree information for the S32G On Chip One-Time Programmable Controller (OCOTP) chip. Signed-off-by: Dan Carpenter Signed-off-by: Shawn Guo commit 2a222aa2bee9e56fc1082c2fad1a92138b5bea4c Author: Josua Mayer Date: Thu Sep 11 12:20:04 2025 +0300 arm64: dts: add description for solidrun imx8mp hummingboard variants Add descriptions for the SolidRun i.MX8M Plus System on Module based HummingBoard product-line. They share a common designed based on the "Pulse" version, defined by various assembly options. The HummingBoard Pulse features: - 2x RJ45 Ethernet - 2x USB-3.0 Type A - HDMI connector - mini-HDMI connector - microSD connector - mini-PCI-E connector with SIM slot supporting USB-2.0/3.0 interfaces - M.2 connector with SIM slot supporting USB-2.0/3.0 interfaces - MIPI-CSI Camera Connector (not described without specific camera) - 3.5mm Analog Stereo Out / Microphone In Headphone Jack - RTC with backup battery The variants Mate and Ripple are reduced versions of Pulse. The HummingBoard Pro extends Pulse with PCI-E on M.2 connector. Signed-off-by: Josua Mayer Signed-off-by: Shawn Guo commit 5aba939e80f439c1a67adb6d9cae23cc72db7ef9 Author: Svyatoslav Ryhel Date: Fri Aug 29 15:22:33 2025 +0300 clk: tegra: dfll: Add CVB tables for Tegra114 Extend the Tegra124 DFLL driver to include configuration settings required for Tegra114 compatibility. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen [treding@nvidia.com: Use TEGRA210 instead of T210] Signed-off-by: Thierry Reding commit e68f150bc11d0a05cbe984a4e5c0f72a95cae07d Author: Mike Rapoport (Microsoft) Date: Mon Aug 18 09:46:15 2025 +0300 memblock: drop for_each_free_mem_pfn_range_in_zone_from() for_each_free_mem_pfn_range_in_zone_from() and its "backend" implementation __next_mem_pfn_range_in_zone() were only used by deferred initialization of the memory map. Remove them as they are not used anymore. Reviewed-by: Wei Yang Reviewed-by: David Hildenbrand Signed-off-by: Mike Rapoport (Microsoft) commit 219f624d0690459440c5c4d4ebfc54f0d440d615 Author: Mike Rapoport (Microsoft) Date: Mon Aug 18 09:46:14 2025 +0300 mm/mm_init: drop deferred_init_maxorder() deferred_init_memmap_chunk() calls deferred_init_maxorder() to initialize struct pages in MAX_ORDER_NR_PAGES because according to commit 0e56acae4b4d ("mm: initialize MAX_ORDER_NR_PAGES at a time instead of doing larger sections") this provides better cache locality than initializing the memory map in larger sections. The looping through free memory ranges is quite cumbersome in the current implementation as it is divided between deferred_init_memmap_chunk() and deferred_init_maxorder(). Besides, the latter has two loops, one that initializes struct pages and another one that frees them. There is no need in two loops because it is safe to free pages in groups smaller than MAX_ORDER_NR_PAGES. Even if lookup for a buddy page will access a struct page ahead of the pages being initialized, that page is guaranteed to be initialized either by memmap_init_reserved_pages() or by init_unavailable_range(). Simplify the code by moving initialization and freeing of the pages into deferred_init_memmap_chunk() and dropping deferred_init_maxorder(). Reviewed-by: David Hildenbrand Reviewed-by: Wei Yang Signed-off-by: Mike Rapoport (Microsoft) commit f1f86187fd72332ef214716a3c5b71616c0d340e Author: Mike Rapoport (Microsoft) Date: Mon Aug 18 09:46:13 2025 +0300 mm/mm_init: deferred_init_memmap: use a job per zone deferred_init_memmap() loops over free memory ranges and creates a padata_mt_job for every free range that intersects with the zone being initialized. padata_do_multithreaded() then splits every such range to several chunks and runs a thread that initializes struct pages in that chunk using deferred_init_memmap_chunk(). The number of threads is limited by amount of the CPUs on the node (or 1 for memoryless nodes). Looping through free memory ranges is then repeated in deferred_init_memmap_chunk() first to find the first range that should be initialized and then to traverse the ranges until the end of the chunk is reached. Remove the loop over free memory regions in deferred_init_memmap() and pass the entire zone to padata_do_multithreaded() so that it will be divided to several chunks by the parallelization code. Reviewed-by: David Hildenbrand Reviewed-by: Wei Yang Signed-off-by: Mike Rapoport (Microsoft) commit 3acb913c9d5bd8dcf61677ccba96d349e7681cf8 Author: Mike Rapoport (Microsoft) Date: Mon Aug 18 09:46:12 2025 +0300 mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone() deferred_grow_zone() initializes one or more sections in the memory map if buddy runs out of initialized struct pages when CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled. It loops through memblock regions and initializes and frees pages in MAX_ORDER_NR_PAGES chunks. Essentially the same loop is implemented in deferred_init_memmap_chunk(), the only actual difference is that deferred_init_memmap_chunk() does not count initialized pages. Make deferred_init_memmap_chunk() count the initialized pages and return their number, wrap it with deferred_init_memmap_job() for multithreaded initialization with padata_do_multithreaded() and replace open-coded initialization of struct pages in deferred_grow_zone() with a call to deferred_init_memmap_chunk(). Reviewed-by: David Hildenbrand Reviewed-by: Wei Yang Signed-off-by: Mike Rapoport (Microsoft) commit 48633acccf38d706d7b368400647bb9db9caf1ae Author: Tzung-Bi Shih Date: Thu Aug 28 08:36:01 2025 +0000 Input: cros_ec_keyb - Defer probe until parent EC device is registered The `cros_ec_keyb` driver can be probed before the cros_ec_device has completed the registration. This creates a race condition where `cros_ec_keyb` might access uninitialized data. Fix this by calling `cros_ec_device_registered()` to check the parent's status. If the device is not yet ready, return -EPROBE_DEFER to ensure the probe is retried later. Acked-by: Dmitry Torokhov Link: https://lore.kernel.org/r/20250828083601.856083-6-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 56cb557279d70397cefb497e0f06bdd6fd685f8e Author: Tzung-Bi Shih Date: Thu Aug 28 08:36:00 2025 +0000 platform/chrome: cros_ec: Add a flag to track registration state Introduce a `registered` flag to the `struct cros_ec_device` to allow callers to determine if the device has been fully registered and is ready for use. This is a preparatory step to prevent race conditions where other drivers might try to access the device before it is fully registered or after it has been unregistered. Link: https://lore.kernel.org/r/20250828083601.856083-5-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 7a79b0bfd8b3995a39d25bffcf57273635c0e542 Author: Tzung-Bi Shih Date: Thu Aug 28 08:35:59 2025 +0000 platform/chrome: cros_ec: Separate initialization from cros_ec_register() Move the initialization of the `struct cros_ec_device` from cros_ec_register() into cros_ec_device_alloc(). This decouples device initialization from registration. By doing so, the per-device lock is now available immediately after allocation, allowing it to be used safely even before the device is fully registered. Link: https://lore.kernel.org/r/20250828083601.856083-4-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit e19ceeb1c0f63e3e15b197c5f34797134b51ba0e Author: Tzung-Bi Shih Date: Thu Aug 28 08:35:58 2025 +0000 platform/chrome: Centralize common cros_ec_device initialization Move the common initialization from protocol device drivers into central cros_ec_device_alloc(). This removes duplicated code from each driver's probe function. The buffer sizes are now calculated once, using the maximum possible overhead required by any of the transport protocols, ensuring the allocated buffers are sufficient for all cases. Link: https://lore.kernel.org/r/20250828083601.856083-3-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 918856986014142271a70a334d300994b9c41720 Author: Tzung-Bi Shih Date: Thu Aug 28 08:35:57 2025 +0000 platform/chrome: Centralize cros_ec_device allocation Introduce a helper function, cros_ec_device_alloc(), to centralize the allocation of the struct cros_ec_device. Convert all protocol device drivers to use this new function. This is a preparatory step for separating common initialization logic out of device drivers' probe() and cros_ec_register(). Link: https://lore.kernel.org/r/20250828083601.856083-2-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 5b86af1ded2d90402477dce6d4cf8dfa95cca6ac Author: Evangelos Petrongonas Date: Thu Aug 21 17:59:00 2025 +0000 efi: support booting with kexec handover (KHO) When KHO (Kexec HandOver) is enabled, it sets up scratch memory regions early during device tree scanning. After kexec, the new kernel exclusively uses this region for memory allocations during boot up to the initialization of the page allocator However, when booting with EFI, EFI's reserve_regions() uses memblock_remove(0, PHYS_ADDR_MAX) to clear all memory regions before rebuilding them from EFI data. This destroys KHO scratch regions and their flags, thus causing a kernel panic, as there are no scratch memory regions. Instead of wholesale removal, iterate through memory regions and only remove non-KHO ones. This preserves KHO scratch regions, which are good known memory, while still allowing EFI to rebuild its memory map. Link: https://lkml.kernel.org/r/b34da9fd50c89644cd4204136cfa6f5533445c56.1755721529.git.epetron@amazon.de Signed-off-by: Evangelos Petrongonas Acked-by: Mike Rapoport (Microsoft) Acked-by: Pratyush Yadav Cc: Alexander Graf Cc: Ard Biesheuvel Cc: Baoquan He Cc: Changyuan Lyu Signed-off-by: Andrew Morton commit d6d5116391857fc78fad9aa42317b36e4ce17b58 Author: Evangelos Petrongonas Date: Thu Aug 21 17:58:59 2025 +0000 kexec: introduce is_kho_boot() Patch series "efi: Fix EFI boot with kexec handover (KHO)", v3. This patch series fixes a kernel panic that occurs when booting with both EFI and KHO (Kexec HandOver) enabled. The issue arises because EFI's `reserve_regions()` clears all memory regions with `memblock_remove(0, PHYS_ADDR_MAX)` before rebuilding them from EFI data. This destroys KHO scratch regions that were set up early during device tree scanning, causing a panic as the kernel has no valid memory regions for early allocations. The first patch introduces `is_kho_boot()` to allow early boot components to reliably detect if the kernel was booted via KHO-enabled kexec. The existing `kho_is_enabled()` only checks the command line and doesn't verify if an actual KHO FDT was passed. The second patch modifies EFI's `reserve_regions()` to selectively remove only non-KHO memory regions when KHO is active, preserving the critical scratch regions while still allowing EFI to rebuild its memory map. This patch (of 3): During early initialisation, after a kexec, other components, like EFI need to know if a KHO enabled kexec is performed. The `kho_is_enabled` function is not enough as in the early stages, it only reflects whether the cmdline has KHO enabled, not if an actual KHO FDT exists. Extend the KHO API with `is_kho_boot()` to provide a way for components to check if a KHO enabled kexec is performed. Link: https://lkml.kernel.org/r/cover.1755721529.git.epetron@amazon.de Link: https://lkml.kernel.org/r/7dc6674a76bf6e68cca0222ccff32427699cc02e.1755721529.git.epetron@amazon.de Signed-off-by: Evangelos Petrongonas Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Ard Biesheuvel Cc: Baoquan He Cc: Changyuan Lyu Signed-off-by: Andrew Morton commit c25822ccaa40fbc8ec38510397e0fbb8b1b0c0e2 Author: Fan Yu Date: Sun Sep 7 00:14:57 2025 +0800 docs: update delaytop documentation for new interactive features This commit updates the delaytop documentation to reflect the newly added features: 1) Added comprehensive description of interactive keyboard controls 2) Documented all available sort fields 3) Added examples for advanced usage scenarios 4) Included PSI availability note Link: https://lkml.kernel.org/r/20250907001457696qAqUGGkV1VfEO6OkVMovW@zte.com.cn Signed-off-by: Fan Yu Reviewed-by: xu xin Signed-off-by: Andrew Morton commit 0c10f9cd812f6f32dca928010e132a7d89812666 Author: Fan Yu Date: Sun Sep 7 00:14:17 2025 +0800 tools/delaytop: improve error handling for missing PSI support Enhanced display logic to conditionally show PSI information only when successfully read, with helpful guidance for users to enable PSI support (psi=1 cmdline parameter). Link: https://lkml.kernel.org/r/20250907001417537vSx6nUsb3ILqI0iQ-WnGp@zte.com.cn Signed-off-by: Fan Yu Reviewed-by: xu xin Signed-off-by: Andrew Morton commit 5e57515d81f9003555b7a4d246e02f1ee9c74ffa Author: Fan Yu Date: Sun Sep 7 00:13:38 2025 +0800 tools/delaytop: add interactive mode with keyboard controls The original delaytop only supported static output with limited interaction. Users had to restart the tool with different command-line options to change sorting or display modes, which disrupted continuous monitoring and reduced productivity during performance investigations. Adds real-time interactive controls through keyboard input: 1) Add interactive menu system with visual prompts 2) Support dynamic sorting changes without restarting 3) Enable toggle of memory verbose mode with 'M' key The interactive mode transforms delaytop from a static monitoring tool into a dynamic investigation platform, allowing users to adapt the view in real-time based on observed performance patterns. Link: https://lkml.kernel.org/r/20250907001338580EURha20BxWFmBSrUpS8D1@zte.com.cn Signed-off-by: Fan Yu Reviewed-by: xu xin Signed-off-by: Andrew Morton commit 99d9c55f88e69ebbfc90e05ce7c320bdb3901d03 Author: Fan Yu Date: Sun Sep 7 00:12:52 2025 +0800 tools/delaytop: add memory verbose mode support The original delaytop tool always displayed detailed memory subsystem breakdown, which could be overwhelming for users who only need high-level overview. Add flexible display control allowing users to choose their preferred information granularity. The new flexibility provides: 1) For quick monitoring: use normal mode to reduce visual clutter 2) For deep analysis: use verbose mode to see all memory subsystem details Link: https://lkml.kernel.org/r/202509070012527934u0ySb3teQ4gOYKnocyNO@zte.com.cn Signed-off-by: Fan Yu Reviewed-by: xu xin Signed-off-by: Andrew Morton commit 0471440c8061e9a7c0fd292c7c6598d6304efd53 Author: Fan Yu Date: Sun Sep 7 00:12:05 2025 +0800 tools/delaytop: add flexible sorting by delay field Patch series "tools/delaytop: implement real-time keyboard interaction support", v2. Current Limitations =================== The current delaytop implementation has two main limitations: 1) Static sorting only by CPU delay Forcing users to restart with different parameters to analyze other resource bottlenecks. 2) Memory delay information is always expanded Causing information overload when only high-level memory pressure monitoring is needed. Improvements ============ 1) Implemented dynamic sorting capability - Interactive key 'o' triggers sort mode. - Supports sorting by CPU/IO/Memory/IRQ delays. - Memory subcategories available in verbose mode. * c - CPU delay (default) * i - IO delay * m - Total memory delay * q - IRQ delay * s/r/t/p/w - Memory subcategories (in verbose mode) 2) Added memory display modes - Compact view (default): shows aggregated memory delays. - Verbose view ('M' key): breaks down into memory sub-delays. * SWAP - swapin delays * RCL - freepages reclaim delays * THR - thrashing delays * CMP - compaction delays * WP - write-protect copy delays Practical benefits ================== 1) Dynamic Sorting for Real-Time Bottleneck Detection System administrators can now dynamically change sorting to identify different types of resource bottlenecks without restarting. 2) Enhanced Usability with On-Screen Keybindings More intuitive interactive usage with on-screen keybindings help. Reduced screen clutter when only memory overview is needed. Use Case ======== # ./delaytop System Pressure Information: (avg10/avg60vg300/total) CPU some: 0.0%/ 0.0%/ 0.0%/ 106817(ms) CPU full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory some: 0.0%/ 0.0%/ 0.0%/ 0(ms) IO full: 0.0%/ 0.0%/ 0.0%/ 2245(ms) IO some: 0.0%/ 0.0%/ 0.0%/ 2791(ms) IRQ full: 0.0%/ 0.0%/ 0.0%/ 0(ms) [o]sort [M]memverbose [q]quit Top 20 processes (sorted by cpu delay): PID TGID COMMAND CPU(ms) IO(ms) IRQ(ms) MEM(ms) ------------------------------------------------------------------------ 110 110 kworker/15:0H-s 27.91 0.00 0.00 0.00 57 57 cpuhp/7 3.18 0.00 0.00 0.00 99 99 cpuhp/14 2.97 0.00 0.00 0.00 51 51 cpuhp/6 0.90 0.00 0.00 0.00 44 44 kworker/4:0H-sy 0.80 0.00 0.00 0.00 76 76 idle_inject/10 0.31 0.00 0.00 0.00 100 100 idle_inject/14 0.30 0.00 0.00 0.00 1309 1309 systemsettings 0.29 0.00 0.00 0.00 60 60 ksoftirqd/7 0.28 0.00 0.00 0.00 45 45 cpuhp/5 0.22 0.00 0.00 0.00 63 63 cpuhp/8 0.20 0.00 0.00 0.00 87 87 cpuhp/12 0.18 0.00 0.00 0.00 93 93 cpuhp/13 0.17 0.00 0.00 0.00 1265 1265 acpid 0.17 0.00 0.00 0.00 1552 1552 sshd 0.17 0.00 0.00 0.00 2584 2584 sddm-helper 0.16 0.00 0.00 0.00 1284 1284 rtkit-daemon 0.15 0.00 0.00 0.00 1326 1326 nde-netfilter 0.14 0.00 0.00 0.00 27 27 cpuhp/2 0.13 0.00 0.00 0.00 631 631 kworker/11:2-rc 0.11 0.00 0.00 0.00 # ./delaytop -M System Pressure Information: (avg10/avg60vg300/total) CPU some: 0.0%/ 0.0%/ 0.0%/ 106827(ms) CPU full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory some: 0.0%/ 0.0%/ 0.0%/ 0(ms) IO full: 0.0%/ 0.0%/ 0.0%/ 2245(ms) IO some: 0.0%/ 0.0%/ 0.0%/ 2791(ms) IRQ full: 0.0%/ 0.0%/ 0.0%/ 0(ms) [o]sort [M]memverbose [q]quit Top 20 processes (sorted by mem delay): PID TGID COMMAND MEM(ms) SWAP(ms) RCL(ms) THR(ms) CMP(ms) WP(ms) ------------------------------------------------------------------------------------------ 121732 121732 delaytop 0.01 0.00 0.00 0.00 0.00 0.01 95876 95876 top 0.00 0.00 0.00 0.00 0.00 0.00 121641 121641 systemd-userwor 0.00 0.00 0.00 0.00 0.00 0.00 121693 121693 systemd-userwor 0.00 0.00 0.00 0.00 0.00 0.00 121661 121661 systemd-userwor 0.00 0.00 0.00 0.00 0.00 0.00 1 1 systemd 0.00 0.00 0.00 0.00 0.00 0.00 2 2 kthreadd 0.00 0.00 0.00 0.00 0.00 0.00 3 3 pool_workqueue_ 0.00 0.00 0.00 0.00 0.00 0.00 4 4 kworker/R-rcu_g 0.00 0.00 0.00 0.00 0.00 0.00 5 5 kworker/R-rcu_p 0.00 0.00 0.00 0.00 0.00 0.00 6 6 kworker/R-slub_ 0.00 0.00 0.00 0.00 0.00 0.00 7 7 kworker/R-netns 0.00 0.00 0.00 0.00 0.00 0.00 9 9 kworker/0:0H-sy 0.00 0.00 0.00 0.00 0.00 0.00 11 11 kworker/u32:0-n 0.00 0.00 0.00 0.00 0.00 0.00 12 12 kworker/R-mm_pe 0.00 0.00 0.00 0.00 0.00 0.00 13 13 rcu_tasks_kthre 0.00 0.00 0.00 0.00 0.00 0.00 14 14 rcu_tasks_rude_ 0.00 0.00 0.00 0.00 0.00 0.00 15 15 rcu_tasks_trace 0.00 0.00 0.00 0.00 0.00 0.00 16 16 ksoftirqd/0 0.00 0.00 0.00 0.00 0.00 0.00 17 17 rcu_preempt 0.00 0.00 0.00 0.00 0.00 0.00 When psi is not enabled: # ./delaytop System Pressure Information: (avg10/avg60vg300/total) PSI not found: check if psi=1 enabled in cmdline This patch (of 5): The delaytop tool only supported sorting by CPU delay, which limited its usefulness when users needed to identify bottlenecks in other subsystems. Users had no way to sort processes by IO, IRQ, or other delay types to quickly pinpoint specific performance issues. Add -s/--sort option to allow sorting by different delay types. Users can now quickly identify bottlenecks in specific subsystems by sorting processes by the relevant delay metric. Link: https://lkml.kernel.org/r/20250907001101305vrTGnXaRNvtmsGkp-Ljk_@zte.com.cn Link: https://lkml.kernel.org/r/20250907001205573L3XpsQMIQnLgDqiiKYd3H@zte.com.cn Signed-off-by: Fan Yu Reviewed-by: xu xin Cc: Jonathan Corbet Cc: Wang Yaxin Cc: Yang Yang Signed-off-by: Andrew Morton commit 7b1e502eb17c23fa6459a19bfe5974bffdb95574 Author: Randy Dunlap Date: Sat Sep 6 21:38:57 2025 -0700 kernel.h: add comments for enum system_states Provide some basic comments about the system_states and what they imply. Also convert the comments to kernel-doc format. Split the enum declaration from the definition of the system_state variable so that kernel-doc notation works cleanly with it. This is picked up by Documentation/driver-api/basics.rst so it does not need further inclusion in the kernel docbooks. Link: https://lkml.kernel.org/r/20250907043857.2941203-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Acked-by: Rafael J. Wysocki # v1 Reviewed-by: Mauro Carvalho Chehab [v5] Cc: "Brown, Len" Cc: Greg Kroah-Hartman Cc: James Bottomley Cc: Jani Nikula Cc: Jonathan Corbet Cc: Mauro Carvalho Chehab Cc: Pavel Machek Signed-off-by: Andrew Morton commit 913e65a2fe1a16fa253c4a016e2306b2cf9ffef8 Author: Coiby Xu Date: Thu Sep 4 17:38:53 2025 +0800 crash: add KUnit tests for crash_exclude_mem_range crash_exclude_mem_range seems to be a simple function but there have been multiple attempts to fix it, - commit a2e9a95d2190 ("kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges") - commit 6dff31597264 ("crash_core: fix and simplify the logic of crash_exclude_mem_range()") So add a set of unit tests to verify the correctness of current implementation. Shall we change the function in the future, the unit tests can also help prevent any regression. For example, we may make the function smarter by allocating extra crash_mem range on demand thus there is no need for the caller to foresee any memory range split or address -ENOMEM failure. The testing strategy is to verify the correctness of base case. The base case is there is one to-be-excluded range A and one existing range B. Then we can exhaust all possibilities of the position of A regarding B. For example, here are two combinations, Case: A is completely inside B (causes split) Original: [----B----] Exclude: {--A--} Result: [B1] .. [B2] Case: A overlaps B's left part Original: [----B----] Exclude: {---A---} Result: [..B..] In theory we can prove the correctness by induction, - Base case: crash_exclude_mem_range is correct in the case where n=1 (n is the number of existing ranges). - Inductive step: If crash_exclude_mem_range is correct for n=k existing ranges, then the it's also correct for n=k+1 ranges. But for the sake of simplicity, simply use unit tests to cover the base case together with two regression tests. Note most of the exclude_single_range_test() code is generated by Google Gemini with some small tweaks. The function specification, function body and the exhausting test strategy are presented as prompts. [akpm@linux-foundation.org: export crash_exclude_mem_range() to modules, for kernel/crash_core_test.c] Link: https://lkml.kernel.org/r/20250904093855.1180154-2-coxu@redhat.com Signed-off-by: Coiby Xu Assisted-by: Google Gemini Cc: Baoquan He Cc: Borislav Betkov Cc: Dave Young Cc: fuqiang wang Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleinxer Cc: Vivek Goyal Signed-off-by: Andrew Morton commit d337f4524861f4e74c31ee575d60f2eaa1e82388 Author: fuqiang wang Date: Thu Sep 4 17:38:52 2025 +0800 x86/kexec: fix potential cmem->ranges out of memory In memmap_exclude_ranges(), elfheader will be excluded from crashk_res. In the current x86 architecture code, the elfheader is always allocated at crashk_res.start. It seems that there won't be a new split range. But it depends on the allocation position of elfheader in crashk_res. To avoid potential out of memory in future, add a extra slot. Otherwise loading the kdump kernel will fail because crash_exclude_mem_range will return -ENOMEM. random kexec_buf for passing dm crypt keys may cause a range split too, add another extra slot here. The similar issue also exists in fill_up_crash_elf_data(). The range to be excluded is [0, 1M], start (0) is special and will not appear in the middle of existing cmem->ranges[]. But in cast the low 1M could be changed in the future, add a extra slot too. Previous discussions: [1] https://lore.kernel.org/kexec/ZXk2oBf%2FT1Ul6o0c@MiWiFi-R3L-srv/ [2] https://lore.kernel.org/kexec/273284e8-7680-4f5f-8065-c5d780987e59@easystack.cn/ [3] https://lore.kernel.org/kexec/ZYQ6O%2F57sHAPxTHm@MiWiFi-R3L-srv/ Link: https://lkml.kernel.org/r/20250904093855.1180154-1-coxu@redhat.com Signed-off-by: fuqiang wang Signed-off-by: Baoquan He Signed-off-by: Coiby Xu Cc: Dave Young Cc: Vivek Goyal Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 13f23538ef49a96a1b8ba9d61bd778de65f00613 Author: zhang jiao Date: Wed Sep 3 16:39:47 2025 +0800 fs/proc/base.c: fix the wrong format specifier Use '%d' instead of '%u' for int. Link: https://lkml.kernel.org/r/20250903083948.2536-1-zhangjiao2@cmss.chinamobile.com Signed-off-by: zhang jiao Cc: Al Viro Cc: Christian Brauner Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Lorenzo Stoakes Cc: Thomas Gleinxer Cc: xu xin Signed-off-by: Andrew Morton commit 37aa782df94d16277b45b9a62b748cd62b4bccb9 Author: Sergey Senozhatsky Date: Wed Sep 3 12:04:18 2025 +0200 panic: remove redundant panic-cpu backtrace Backtraces from all CPUs are printed during panic() when SYS_INFO_ALL_CPU_BT is set. It shows the backtrace for the panic-CPU even when it has already been explicitly printed before. Do not change the legacy code which prints the backtrace in various contexts, for example, as part of Oops report, right after panic message. It will always be visible in the crash dump. Instead, remember when the backtrace was printed, and skip it when dumping the optional backtraces on all CPUs. [akpm@linux-foundation.org: make panic_this_cpu_backtrace_printed static] Closes: https://lore.kernel.org/oe-kbuild-all/202509050048.FMpVvh1u-lkp@intel.com/ [pmladek@suse.com: Handle situations when the backtrace was not printed for the panic CPU] Link: https://lkml.kernel.org/r/20250903100418.410026-1-pmladek@suse.com Signed-off-by: Sergey Senozhatsky Link: https://lore.kernel.org/r/20250731030314.3818040-1-senozhatsky@chromium.org Signed-off-by: Petr Mladek Tested-by: Feng Tang Reviewed-by: John Ogness Signed-off-by: Andrew Morton commit 652ab7c8fab36bd803d2947a3abf26155faa5dc5 Author: Jinchao Wang Date: Fri Aug 29 13:13:02 2025 +0800 panic: use angle-bracket include for panic.h Replace quoted includes of panic.h with `#include ` for consistency across the kernel. Link: https://lkml.kernel.org/r/20250829051312.33773-1-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Reviewed-by: John Ogness Reviewed-by: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Steven Rostedt Signed-off-by: Andrew Morton commit fe7a283b39160153b6d1bd7f61b0a9d5d44987a8 Author: Dmitry Antipov Date: Tue Aug 26 12:51:06 2025 +0300 ocfs2: add suballoc slot check in ocfs2_validate_inode_block() In 'ocfs2_validate_inode_block()', add suballoc slot check similar to one in 'ocfs2_get_suballoc_slot_bit()', thus preventing an out-of-bounds accesses for 'local_system_inodes' in 'get_local_system_inode()'. Most likely this fixes https://syzkaller.appspot.com/bug?extid=a77d690840e60bc2ddd8 as well. Link: https://lkml.kernel.org/r/20250826095106.666980-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reported-by: syzbot+900962ac9bf1860033f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=900962ac9bf1860033f2 Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 17bdc64c0d419b78bb400c221d36eaa391d16b3a Author: Bala-Vignesh-Reddy Date: Wed Aug 20 23:26:10 2025 +0530 selftests: proc: mark vsyscall strings maybe-unused The str_vsyscall_* constants in proc-pid-vm.c triggers -Wunused-const-variable warnings with gcc-13.32 and clang 18.1. Define and apply __maybe_unused locally to suppress the warnings. No functional change Fixes compiler warning: warning: `str_vsyscall_*' defined but not used[-Wunused-const-variable] Link: https://lkml.kernel.org/r/20250820175610.83014-1-reddybalavignesh9979@gmail.com Signed-off-by: Bala-Vignesh-Reddy Cc: Shuah Khan Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 3e3f55f8b73fa0e5c4df50f8b6c001f0a1f18adf Author: Guan-Chun Wu <409411716@gms.tku.edu.tw> Date: Wed Aug 27 00:17:41 2025 +0800 btree: simplify merge logic by using btree_last() return value Previously btree_merge() called btree_last() only to test existence, then performed an extra btree_lookup() to fetch the value. This patch changes it to directly use the value returned by btree_last(), avoiding redundant lookups and simplifying the merge loop. Link: https://lkml.kernel.org/r/20250826161741.686704-1-409411716@gms.tku.edu.tw Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Cc: Kuan-Wei Chiu Signed-off-by: Andrew Morton commit 3d5f4f15b778d6da9760d54455cc256ecf924c0a Author: Jinchao Wang Date: Mon Aug 25 10:29:37 2025 +0800 watchdog: skip checks when panic is in progress This issue was found when an EFI pstore was configured for kdump logging with the NMI hard lockup detector enabled. The efi-pstore write operation was slow, and with a large number of logs, the pstore dump callback within kmsg_dump() took a long time. This delay triggered the NMI watchdog, leading to a nested panic. The call flow demonstrates how the secondary panic caused an emergency_restart() to be triggered before the initial pstore operation could finish, leading to a failure to dump the logs: real panic() { kmsg_dump() { ... pstore_dump() { start_dump(); ... // long time operation triggers NMI watchdog nmi panic() { ... emergency_restart(); // pstore unfinished } ... finish_dump(); // never reached } } } Both watchdog_buddy_check_hardlockup() and watchdog_overflow_callback() may trigger during a panic. This can lead to recursive panic handling. Add panic_in_progress() checks so watchdog activity is skipped once a panic has begun. This prevents recursive panic and keeps the panic path more reliable. Link: https://lkml.kernel.org/r/20250825022947.1596226-10-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Reviewed-by: Yury Norov (NVIDIA) Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Signed-off-by: Andrew Morton commit d4a36db5639db032a434aef968f9188a600139ec Author: Jinchao Wang Date: Mon Aug 25 10:29:36 2025 +0800 panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() The helper other_cpu_in_panic() duplicated logic already provided by panic_on_other_cpu(). Remove other_cpu_in_panic() and update all users to call panic_on_other_cpu() instead. This removes redundant code and makes panic handling consistent. Link: https://lkml.kernel.org/r/20250825022947.1596226-9-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit c6be36e2997662f423edfa3979a63935873ff648 Author: Jinchao Wang Date: Mon Aug 25 10:29:35 2025 +0800 panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() The helper this_cpu_in_panic() duplicated logic already provided by panic_on_this_cpu(). Remove this_cpu_in_panic() and switch all users to panic_on_this_cpu(). This simplifies the code and avoids having two helpers for the same check. Link: https://lkml.kernel.org/r/20250825022947.1596226-8-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit 2325e8eadf7cd2a086855809ffcd054336369d47 Author: Jinchao Wang Date: Mon Aug 25 10:29:34 2025 +0800 printk/nbcon: use panic_on_this_cpu() helper nbcon_context_try_acquire() compared panic_cpu directly with smp_processor_id(). This open-coded check is now provided by panic_on_this_cpu(). Switch to panic_on_this_cpu() to simplify the code and improve readability. Link: https://lkml.kernel.org/r/20250825022947.1596226-7-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit 6f313b558562161c181734c1d23b25bf71e574b9 Author: Jinchao Wang Date: Mon Aug 25 10:29:33 2025 +0800 panic: use panic_try_start() in vpanic() vpanic() had open-coded logic to claim panic_cpu with atomic_try_cmpxchg. This is already handled by panic_try_start(). Switch to panic_try_start() and use panic_on_other_cpu() for the fallback path. This removes duplicate code and makes panic handling consistent across functions. Link: https://lkml.kernel.org/r/20250825022947.1596226-6-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit 6b69c7ef96f1afc7b426195087f7488f1510c2a4 Author: Jinchao Wang Date: Mon Aug 25 10:29:32 2025 +0800 panic: use panic_try_start() in nmi_panic() nmi_panic() duplicated the logic to claim panic_cpu with atomic_try_cmpxchg. This is already wrapped in panic_try_start(). Replace the open-coded logic with panic_try_start(), and use panic_on_other_cpu() for the fallback path. This removes duplication and keeps panic handling code consistent. Link: https://lkml.kernel.org/r/20250825022947.1596226-5-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit 33effbcaf110a68b49b7ab4f8720858e7598c216 Author: Jinchao Wang Date: Mon Aug 25 10:29:31 2025 +0800 crash_core: use panic_try_start() in crash_kexec() crash_kexec() had its own code to exclude parallel execution by setting panic_cpu. This is already handled by panic_try_start(). Switch to panic_try_start() to remove the duplication and keep the logic consistent. Link: https://lkml.kernel.org/r/20250825022947.1596226-4-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit f7998e7f03ff9846a5047743d0eae554f25fdbe8 Author: Jinchao Wang Date: Mon Aug 25 10:29:30 2025 +0800 fbdev: use panic_in_progress() helper Update the fbcon_skip_panic() function to use the panic_in_progress() helper. The previous direct access to panic_cpu is less readable and is being replaced by a dedicated function that more clearly expresses the intent. This change is part of a series to refactor the kernel's panic handling logic for better clarity and robustness. Link: https://lkml.kernel.org/r/20250825022947.1596226-3-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Acked-by Qianqiang Liu Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit d0d9c7235548f1d772f1e48c9d5742c65d81c705 Author: Jinchao Wang Date: Mon Aug 25 10:29:29 2025 +0800 panic: introduce helper functions for panic state Patch series "panic: introduce panic status function family", v2. This series introduces a family of helper functions to manage panic state and updates existing code to use them. Before this series, panic state helpers were scattered and inconsistent. For example, panic_in_progress() was defined in printk/printk.c, not in panic.c or panic.h. As a result, developers had to look in unexpected places to understand or re-use panic state logic. Other checks were open- coded, duplicating logic across panic, crash, and watchdog paths. The new helpers centralize the functionality in panic.c/panic.h: - panic_try_start() - panic_reset() - panic_in_progress() - panic_on_this_cpu() - panic_on_other_cpu() Patches 1–8 add the helpers and convert panic/crash and printk/nbcon code to use them. Patch 9 fixes a bug in the watchdog subsystem by skipping checks when a panic is in progress, avoiding interference with the panic CPU. Together, this makes panic state handling simpler, more discoverable, and more robust. This patch (of 9): This patch introduces four new helper functions to abstract the management of the panic_cpu variable. These functions will be used in subsequent patches to refactor existing code. The direct use of panic_cpu can be error-prone and ambiguous, as it requires manual checks to determine which CPU is handling the panic. The new helpers clarify intent: panic_try_start(): Atomically sets the current CPU as the panicking CPU. panic_reset(): Reset panic_cpu to PANIC_CPU_INVALID. panic_in_progress(): Checks if a panic has been triggered. panic_on_this_cpu(): Returns true if the current CPU is the panic originator. panic_on_other_cpu(): Returns true if a panic is on another CPU. This change lays the groundwork for improved code readability and robustness in the panic handling subsystem. Link: https://lkml.kernel.org/r/20250825022947.1596226-1-wangjinchao600@gmail.com Link: https://lkml.kernel.org/r/20250825022947.1596226-2-wangjinchao600@gmail.com Signed-off-by: Jinchao Wang Cc: Anna Schumaker Cc: Baoquan He Cc: "Darrick J. Wong" Cc: Dave Young Cc: Doug Anderson Cc: "Guilherme G. Piccoli" Cc: Helge Deller Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Joel Granados Cc: John Ogness Cc: Kees Cook Cc: Li Huafei Cc: "Luck, Tony" Cc: Luo Gengkun Cc: Max Kellermann Cc: Nam Cao Cc: oushixiong Cc: Petr Mladek Cc: Qianqiang Liu Cc: Sergey Senozhatsky Cc: Sohil Mehta Cc: Steven Rostedt Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Zimemrmann Cc: Thorsten Blum Cc: Ville Syrjala Cc: Vivek Goyal Cc: Yicong Yang Cc: Yunhui Cui Cc: Yury Norov (NVIDIA) b Signed-off-by: Andrew Morton commit e40d2014b2ccaf0f1a49ba0d0cfb59ac2a36cc6e Author: Petr Mladek Date: Mon Aug 25 10:57:01 2025 +0800 panic: clean up message about deprecated 'panic_print' parameter Remove duplication of the message about deprecated 'panic_print' parameter. Also make the wording more direct. Make it clear that the new parameters already exist and should be used instead. Link: https://lkml.kernel.org/r/20250825025701.81921-5-feng.tang@linux.alibaba.com Signed-off-by: Petr Mladek Signed-off-by: Feng Tang Reviewed-by: Lance Yang Tested-by: Lance Yang Reviewed-by: Feng Tang Cc: Askar Safin Cc: John Ogness Cc: Jonathan Corbet Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 2683df6539cbc3f0eeeba11154bc0cbf042a5cee Author: Feng Tang Date: Mon Aug 25 10:57:00 2025 +0800 panic: add note that 'panic_print' parameter is deprecated Just like for 'panic_print's systcl interface, add similar note for setup of kernel cmdline parameter and parameter under /sys/module/kernel/. Also add __core_param_cb() macro, which enables to add special get/set operation for a kernel parameter. Link: https://lkml.kernel.org/r/20250825025701.81921-4-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Reviewed-by: Petr Mladek Cc: Askar Safin Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 8c2b91fbb0078b0c33d9031ebbbced04a351ecfe Author: Feng Tang Date: Mon Aug 25 10:56:59 2025 +0800 panic: refine the document for 'panic_print' User reported current document about SYS_INFO_PANIC_CONSOLE_REPLAY is confusing, that people could expect all user space console messages to be replayed. Specify that only 'kernel' messages will be replayed to solve the confusion. Link: https://lkml.kernel.org/r/20250825025701.81921-3-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Reported-by: Askar Safin Reviewed-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 31cf021b6161ac63c2ab8c64415cca0e3e136636 Author: Feng Tang Date: Mon Aug 25 10:56:58 2025 +0800 lib/sys_info: handle sys_info_mask==0 case Generalization of panic_print's dump function [1] has been merged, and this patchset is to address some remaining issues, like adding note of the obsoletion of 'panic_print' cmdline parameter, refining the kernel document for panic_print, and hardening some string management. This patch (of 4): It is a normal case that bitmask parameter is 0, so pre-initialize the names[] to null string to cover this case. Also remove the superfluous "+1" in names[sizeof(sys_info_avail) + 1], which is needed for 'strlen()', but not for 'sizeof()'. Link: https://lkml.kernel.org/r/20250825025701.81921-1-feng.tang@linux.alibaba.com Link: https://lkml.kernel.org/r/20250825025701.81921-2-feng.tang@linux.alibaba.com Link: Link: https://lkml.kernel.org/r/20250703021004.42328-1-feng.tang@linux.alibaba.com [1] Signed-off-by: Feng Tang Suggested-by: Petr Mladek Reviewed-by: Petr Mladek Cc: Askar Safin Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 13818f7b8c85c89aa97a430f8116490c1b833470 Author: Liao Yuanhong Date: Mon Aug 25 20:33:05 2025 +0800 kexec_core: remove redundant 0 value initialization The kimage struct is already zeroed by kzalloc(). It's redundant to initialize image->head to 0. Link: https://lkml.kernel.org/r/20250825123307.306634-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Signed-off-by: Andrew Morton commit 493977de1469b9898e178c9aab5fd498c4083da7 Author: yili Date: Thu Aug 7 23:57:49 2025 +0800 ocfs2: fix super block reserved field offset comment The offset annotation for s_reserved2 in struct ocfs2_super_block was incorrect. After the preceding fields: - s_xattr_inline_size (2 bytes at 0xB8) - s_reserved0 (2 bytes at 0xBA) - s_dx_seed[3] (12 bytes at 0xBC) The actual offset of s_reserved2 is at 0xC8, when calculating from the start of the structure. Correct the offset comment from C0 to C8 to reflect the proper location in the super block structure. Link: https://lkml.kernel.org/r/20250807155749.164481-1-yili@winhong.com Signed-off-by: yili Reviewed-by: Joel Becker Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 171c04728993bac01666994cacaf4d840be97801 Author: Dan Carpenter Date: Tue Aug 19 12:41:51 2025 +0300 ocfs2: remove unnecessary NULL check in ocfs2_grab_folios() Smatch complains that checking "folios" for NULL doesn't make sense because it has already been dereferenced at this point. Really passing a NULL "folios" pointer to ocfs2_grab_folios() doesn't make sense, and fortunately none of the callers do that. Delete the unnecessary NULL check. Link: https://lkml.kernel.org/r/aKRG39hyvDJcN2G7@stanley.mountain Signed-off-by: Dan Carpenter Acked-by: Joseph Qi Reviewed-by: Mark Tinguely Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit f7071db2fe3d20991a35043b32012e1b37d32cc0 Author: Oleg Nesterov Date: Wed Aug 20 18:39:46 2025 +0200 fork: kill the pointless lower_32_bits() in create_io_thread(), kernel_thread(), and user_mode_thread() Unlike sys_clone(), these helpers have only in kernel users which should pass the correct "flags" argument. lower_32_bits(flags) just adds the unnecessary confusion and doesn't allow to use the CLONE_ flags which don't fit into 32 bits. create_io_thread() looks especially confusing because: - "flags" is a compile-time constant, so lower_32_bits() simply has no effect - .exit_signal = (lower_32_bits(flags) & CSIGNAL) is harmless but doesn't look right, copy_process(CLONE_THREAD) will ignore this argument anyway. None of these helpers actually need CLONE_UNTRACED or "& ~CSIGNAL", but their presence does not add any confusion and improves code clarity. Link: https://lkml.kernel.org/r/20250820163946.GA18549@redhat.com Signed-off-by: Oleg Nesterov Reviewed-by: Jens Axboe Cc: Christian Brauner Cc: Kees Cook Signed-off-by: Andrew Morton commit b32730e68d326bef5c081c4b7cdd275c45b1902b Author: Tio Zhang Date: Wed Aug 20 18:18:46 2025 +0800 fork: remove #ifdef CONFIG_LOCKDEP in copy_process() lockdep_init_task() is defined as an empty when CONFIG_LOCKDEP is not set. So the #ifdef here is redundant, remove it. Link: https://lkml.kernel.org/r/20250820101826.GA2484@didi-ThinkCentre-M930t-N000 Signed-off-by: Tio Zhang Cc: Kees Cook Signed-off-by: Andrew Morton commit 2a8c51bc9391ff3c701f06ae1b678419f843dc1a Author: Randy Dunlap Date: Tue Aug 19 00:55:07 2025 -0700 list.h: add missing kernel-doc for basic macros kernel-doc for the basic LIST_HEAD() and LIST_HEAD_INIT() macros has been missing forever (i.e., since git). Add them for completeness. Link: https://lkml.kernel.org/r/20250819075507.113639-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Nicolas Frattaroli Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit b1e34412998d628dfa8ba3da042bb60dee232b6c Author: Alexey Dobriyan Date: Tue Aug 19 21:19:17 2025 +0300 proc: test lseek on /proc/net/dev This line in tools/testing/selftests/proc/read.c was added to catch oopses, not to verify lseek correctness: (void)lseek(fd, 0, SEEK_SET); Oh, well. Prevent more embarassement with simple test. Link: https://lkml.kernel.org/r/aKTCfMuRXOpjBXxI@p183 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton commit 6c609f36398adfe0de712a9025cc1065074b9abc Author: Liao Yuanhong Date: Mon Aug 18 20:35:28 2025 +0800 x86/crash: remove redundant 0 value initialization The crash_mem struct is already zeroed by vzalloc(). It's redundant to initialize cmem->nr_ranges to 0. Link: https://lkml.kernel.org/r/20250818123530.635234-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Cc: Baoquan He Cc: Borislav Betkov Cc: Brian Gerst Cc: Coiby Xu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Bohac Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 228bf041a7fdf8c94dfc57df1e2e918fefce1a25 Author: zhoumin Date: Mon Aug 18 22:44:49 2025 +0800 vfat: remove unused variable Remove unused variable definition and related function definition and redundant variable assignments within functions. Link: https://lkml.kernel.org/r/tencent_9DE7CC9367096503F6ADD2BD960079267406@qq.com Signed-off-by: zhoumin Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton commit 95f091274f3db39493e8b5c44671b9f1e02c0c25 Author: ZhenguoYao Date: Tue Aug 12 16:25:10 2025 +0800 watchdog/softlockup: fix incorrect CPU utilization output during softlockup Since we use 16-bit precision, the raw data will undergo integer division, which may sometimes result in data loss. This can lead to slightly inaccurate CPU utilization calculations. Under normal circumstances, this isn't an issue. However, when CPU utilization reaches 100%, the calculated result might exceed 100%. For example, with raw data like the following: sample_period 400000134 new_stat 83648414036 old_stat 83247417494 sample_period=400000134/2^24=23 new_stat=83648414036/2^24=4985 old_stat=83247417494/2^24=4961 util=105% Below log will output： CPU#3 Utilization every 0s during lockup: #1: 0% system, 0% softirq, 105% hardirq, 0% idle #2: 0% system, 0% softirq, 105% hardirq, 0% idle #3: 0% system, 0% softirq, 100% hardirq, 0% idle #4: 0% system, 0% softirq, 105% hardirq, 0% idle #5: 0% system, 0% softirq, 105% hardirq, 0% idle To avoid confusion, we enforce a 100% display cap when calculations exceed this threshold. We also round to the nearest multiple of 16.8 milliseconds to improve the accuracy. [yaozhenguo1@gmail.com: make get_16bit_precision() more accurate, fix comment layout] Link: https://lkml.kernel.org/r/20250818081438.40540-1-yaozhenguo@jd.com Link: https://lkml.kernel.org/r/20250812082510.32291-1-yaozhenguo@jd.com Signed-off-by: ZhenguoYao Cc: Bitao Hu Cc: Li Huafei Cc: Max Kellermann Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 41f88ddfd453fe894678e1f6909b9fb9e08e8c3d Author: ZhenguoYao Date: Tue Aug 12 15:41:32 2025 +0800 watchdog/softlockup: fix wrong output when watchdog_thresh < 3 When watchdog_thresh is below 3, sample_period will be less than 1 second. So the following output will print when softlockup: CPU#3 Utilization every 0s during lockup Fix this by changing time unit from seconds to milliseconds. Link: https://lkml.kernel.org/r/20250812074132.27810-1-yaozhenguo@jd.com Signed-off-by: ZhenguoYao Cc: Bitao Hu Cc: Li Huafei Cc: Max Kellermann Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 0ca863b7c638803722dc5596b2d520812cf283b7 Author: Kuan-Wei Chiu Date: Thu Aug 14 17:38:27 2025 +0800 alloc_tag: use str_on_off() helper Replace the ternary (enable ? "on" : "off") with the str_on_off() helper from string_choices.h. This improves readability by replacing the three-operand ternary with a single function call, ensures consistent string output, and allows potential string deduplication by the linker, resulting in a slightly smaller binary. Link: https://lkml.kernel.org/r/20250814093827.237980-1-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu Cc: Ching-Chun (Jim) Huang Cc: Kent Overstreet Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 7da017eaa43a215f68d42ebfd08d381134ea6356 Author: Kuan-Wei Chiu Date: Thu Aug 14 17:50:33 2025 +0800 test_firmware: use str_true_false() helper Replace ternary (condition ? "true" : "false") expressions with the str_true_false() helper from string_choices.h. This improves readability by replacing the three-operand ternary with a single function call, ensures consistent string output, and allows potential string deduplication by the linker, resulting in a slightly smaller binary. Link: https://lkml.kernel.org/r/20250814095033.244034-1-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu Cc: Kuan-Wei Chiu Signed-off-by: Andrew Morton commit 9a0ee378eb6ca39513dcfeffabd10037c2c9f2a0 Author: Thorsten Blum Date: Thu Aug 14 13:38:10 2025 +0200 ocfs2: remove commented out mlog() statements The mlog() statements have been commented out ever since commit 6714d8e86bf44 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") - remove them. Link: https://lkml.kernel.org/r/20250814113815.219064-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Mark Tinguely Reviewed-by: Mark Fasheh Cc: Ahelenia Ziemiańska Cc: Dmitry Antipov Cc: Joel Becker Cc: Joseph Qi Cc: Thorsten Blum Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit bc107a619f029415e0a87e6df16f995553da4568 Author: Tetsuo Handa Date: Wed Aug 13 16:17:43 2025 +0900 squashfs: verify inode mode when loading from disk The inode mode loaded from corrupted disk might by error contain the file type bits. Since the file type bits are set by squashfs_read_inode() using bitwise OR, the file type bits must not be set by squashfs_new_inode() from squashfs_read_inode(); otherwise, an invalid file type bits later confuses may_open(). Link: https://lkml.kernel.org/r/f63d8d11-2254-4fc3-9292-9a43a93b374e@I-love.SAKURA.ne.jp Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Reviewed-by: Phillip Lougher Signed-off-by: Andrew Morton commit 6c0022d6dc341668d704b1490674a21805ef645b Author: Xichao Zhao Date: Tue Aug 12 16:40:45 2025 +0800 lib/fault-inject-usercopy.c: use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Link: https://lkml.kernel.org/r/20250812084045.64218-1-zhao.xichao@vivo.com Signed-off-by: Xichao Zhao Signed-off-by: Andrew Morton commit a6cf527e66b8ea7b3119a354a873ebfa57ea225e Author: Joe Perches Date: Sat Aug 9 21:31:10 2025 -0700 checkpatch: allow http links of any length in commit logs Dave Gilbert noticed that checkpatch warns about URL links over 75 chars in length in commit logs. Fix that. Link: https://lkml.kernel.org/r/3529faaf84a5a9a96c5c0ec4183ae0ba6e97673c.camel@perches.com Signed-off-by: Joe Perches Cc: Dave Gilbert Signed-off-by: Andrew Morton commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 Author: Huacai Chen Date: Mon Jul 21 18:13:43 2025 +0800 init: handle bootloader identifier in kernel parameters BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= /boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not recognized by the kernel itself so will be passed to userspace. However user space init program also don't recognize it. KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on some architectures. We cannot change BootLoader's behavior, because this behavior exists for many years, and there are already user space programs search BOOT_IMAGE= in /proc/cmdline to obtain the kernel image locations: https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go (search getBootOptions) https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go (search getKernelReleaseWithBootOption) So the the best way is handle (ignore) it by the kernel itself, which can avoid such boot warnings (if we use something like init=/bin/bash, bootloader identifier can even cause a crash): Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space. [chenhuacai@loongson.cn: use strstarts()] Link: https://lkml.kernel.org/r/20250815090120.1569947-1-chenhuacai@loongson.cn Link: https://lkml.kernel.org/r/20250721101343.3283480-1-chenhuacai@loongson.cn Signed-off-by: Huacai Chen Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Signed-off-by: Andrew Morton commit ca78a04ce5c42b00addc063a7610a5ae12dafc39 Author: Liao Yuanhong Date: Mon Aug 11 16:27:38 2025 +0800 lib/digsig: remove unnecessary memset kzalloc() has already been initialized to full 0 space, there is no need to use memset() to initialize again. Link: https://lkml.kernel.org/r/20250811082739.378284-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Signed-off-by: Andrew Morton commit baa96bcb180e979a821ce3ade87a3d2349b2d640 Author: Christophe JAILLET Date: Mon Jul 14 10:17:10 2025 +0200 nvmem: update a comment related to struct nvmem_config Update a comment to match the function used in nvmem_register(). ida_simple_get() was replaced by ida_alloc() in commit 1eb51d6a4fce ("nvmem: switch to simpler IDA interface") Link: https://lkml.kernel.org/r/27a9dec93a9f79140b11a77df38b1b45bd342e09.1752480043.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit c8a09fc9664f79eeb66cdf4a2a34d5b6a239b727 Author: Christophe JAILLET Date: Mon Jul 14 10:17:09 2025 +0200 ida: remove the ida_simple_xxx() API All users of the ida_simple_xxx() have been converted. In Linux 6.11-rc2, the only callers are in tools/testing/. So it is now time to remove the definition of this old and deprecated ida_simple_get() and ida_simple_remove(). Link: https://lkml.kernel.org/r/aa205f45fef70a9c948b6a98bad06da58e4de776.1752480043.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 8f09142e4f9bacb7f3b9f41c864ef3eb2cfa27df Author: Christophe JAILLET Date: Mon Jul 14 10:17:08 2025 +0200 idr test suite: remove usage of the deprecated ida_simple_xx() API Patch series "ida: Remove the ida_simple_xxx() API", v3. These are the final steps in removing the ida_simple_xxx() API. This series was last proposed in August 2024. Since then, some users of the old API have be re-introduced and then removed. A first time in drivers/misc/rpmb-core.c, added in commit 1e9046e3a154 ("rpmb: add Replay Protected Memory Block (RPMB) subsystem") (2024-08-26) and removed in commit dfc881abca42 ("rpmb: Remove usage of the deprecated ida_simple_xx() API") (2024-10-13). A second time in drivers/gpio/gpio-mpsse.c, added in commit c46a74ff05c0 ("gpio: add support for FTDI's MPSSE as GPIO") (2024-10-14) and removed in commit f57c08492866 (gpio: mpsse: Remove usage of the deprecated ida_simple_xx() API) (2024-11-22). Since then, I've not spotted any new usage. So things being stable now, it's time to end this story once and for all. This patch (of 3): ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove(). Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_range()/ida_alloc_max() is inclusive. But because of the ranges used for the tests, there is no need to adjust them. While at it remove some useless {}. Link: https://lkml.kernel.org/r/cover.1752480043.git.christophe.jaillet@wanadoo.fr Link: https://lkml.kernel.org/r/2904fa2006e4fe58eea63aef87fa7f832c7804a1.1752480043.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Acked-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1455b6ac210d5c094066264e7a6809c3a6a9a4d2 Author: Soham Bagchi Date: Mon Jul 28 12:43:18 2025 -0600 kcov: load acquire coverage count in user-space code Update the KCOV documentation to use a load-acquire operation for the first element of the shared memory buffer between kernel-space and user-space. The load-acquire pairs with the write memory barrier used in kcov_move_area(). [soham.bagchi@utah.edu: v2] Link: https://lkml.kernel.org/r/20250803180558.2967962-1-soham.bagchi@utah.edu Link: https://lkml.kernel.org/r/20250728184318.1839137-2-soham.bagchi@utah.edu Signed-off-by: Soham Bagchi Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Dmitriy Vyukov Cc: Jonathan Corbet Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit c2fe368b6eb24af72708890b04e9a773c8465703 Author: Soham Bagchi Date: Mon Jul 28 12:43:17 2025 -0600 kcov: use write memory barrier after memcpy() in kcov_move_area() KCOV Remote uses two separate memory buffers, one private to the kernel space (kcov_remote_areas) and the second one shared between user and kernel space (kcov->area). After every pair of kcov_remote_start() and kcov_remote_stop(), the coverage data collected in the kcov_remote_areas is copied to kcov->area so the user can read the collected coverage data. This memcpy() is located in kcov_move_area(). The load/store pattern on the kernel-side [1] is: ``` /* dst_area === kcov->area, dst_area[0] is where the count is stored */ dst_len = READ_ONCE(*(unsigned long *)dst_area); ... memcpy(dst_entries, src_entries, ...); ... WRITE_ONCE(*(unsigned long *)dst_area, dst_len + entries_moved); ``` And for the user [2]: ``` /* cover is equivalent to kcov->area */ n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED); ``` Without a write-memory barrier, the atomic load for the user can potentially read fresh values of the count stored at cover[0], but continue to read stale coverage data from the buffer itself. Hence, we recommend adding a write-memory barrier between the memcpy() and the WRITE_ONCE() in kcov_move_area(). Link: https://lkml.kernel.org/r/20250728184318.1839137-1-soham.bagchi@utah.edu Link: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kcov.c?h=master#n978 [1] Link: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/dev-tools/kcov.rst#n364 [2] Signed-off-by: Soham Bagchi Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Dmitriy Vyukov Cc: Jonathan Corbet Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 06ef8b9aa25ea7342ffd604784edcfdbc8348920 Author: Qianfeng Rong Date: Tue Aug 5 10:30:31 2025 +0800 ref_tracker: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Link: https://lkml.kernel.org/r/20250805023031.331718-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit f367474b5884edbc42661e7fecf784cb131dd25d Author: Brian Mak Date: Tue Aug 5 14:15:27 2025 -0700 x86/kexec: carry forward the boot DTB on kexec Currently, the kexec_file_load syscall on x86 does not support passing a device tree blob to the new kernel. Some embedded x86 systems use device trees. On these systems, failing to pass a device tree to the new kernel causes a boot failure. To add support for this, we copy the behavior of ARM64 and PowerPC and copy the current boot's device tree blob for use in the new kernel. We do this on x86 by passing the device tree blob as a setup_data entry in accordance with the x86 boot protocol. This behavior is gated behind the KEXEC_FILE_FORCE_DTB flag. Link: https://lkml.kernel.org/r/20250805211527.122367-3-makb@juniper.net Signed-off-by: Brian Mak Cc: Alexander Graf Cc: Baoquan He Cc: Borislav Betkov Cc: Dave Young Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Rob Herring Cc: Saravana Kannan Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 1440648c0feed03cfd51c7dba92a77feb34bf27b Author: Masami Hiramatsu (Google) Date: Thu Jul 31 07:11:54 2025 +0900 hung_task: dump blocker task if it is not hung Dump the lock blocker task if it is not hung because if the blocker task is also hung, it should be dumped by the detector. This will de-duplicate the same stackdumps if the blocker task is also blocked by another task (and hung). Link: https://lkml.kernel.org/r/175391351423.688839.11917911323784986774.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Suggested-by: Sergey Senozhatsky Tested-by: Sergey Senozhatsky Acked-by: Lance Yang Signed-off-by: Andrew Morton commit 103e90626d3a4032d22e8b09ff14600e71cda59c Author: Liam R. Howlett Date: Wed Aug 27 20:30:23 2025 -0400 maple_tree: testing fix for spanning store on 32b 32 bit nodes have a larger branching factor. This affects the required value to cause a height change. Update the spanning store height test to work for both 64 and 32 bit nodes. Link: https://lkml.kernel.org/r/20250828003023.418966-3-Liam.Howlett@oracle.com Fixes: f9d3a963fef4 ("maple_tree: use height and depth consistently") Signed-off-by: Liam R. Howlett Reviewed-by: Sidhartha Kumar Signed-off-by: Andrew Morton commit 82b5fe3059a52e1419521ac32703208d03bb15e9 Author: Liam R. Howlett Date: Wed Aug 27 20:30:22 2025 -0400 maple_tree: fix testing for 32 bit builds Patch series "maple_tree: Fix testing for 32bit compiles". The maple tree test suite supports 32bit builds which causes 32bit nodes and index/last values. Some tests have too large values and must be skipped while others depend on certain actions causing the tree to be altered in another measurable way (such as the height decreasing or increasing). Two tests were added that broke 32bit testing, either by compile warnings or failures. These fixes restore the tests to a working order. Building 32bit version can be done on a 32bit platform, or by using a command like: BUILD=32 make clean maple This patch (of 2): Some tests are invalid on 32bit due to the size of the index and last. Making those tests depend on the correct build flags stops compile complaints. Link: https://lkml.kernel.org/r/20250828003023.418966-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20250828003023.418966-2-Liam.Howlett@oracle.com Fixes: 5d659bbb52a2 ("maple_tree: introduce mas_wr_store_type()") Signed-off-by: Liam R. Howlett Reviewed-by: Sidhartha Kumar Signed-off-by: Andrew Morton commit 39b44c8c73312ac535ffdf7c8ecd37ea07d4ef86 Author: Max Kellermann Date: Thu Aug 28 10:48:20 2025 +0200 huge_mm.h: disallow is_huge_zero_folio(NULL) Calling is_huge_zero_folio(NULL) should not be legal - it makes no sense, and a different (theoretical) implementation may dereference the pointer. But currently, lacking any explicit documentation, this call is possible. But if somebody really passes NULL, the function should not return true - this isn't the huge zero folio after all! However, if the `huge_zero_folio` hasn't been allocated yet, it's NULL, and is_huge_zero_folio(NULL) just happens to return true, which is a lie. This weird side effect prevented me from reproducing a kernel crash that occurred when the elements of a folio_batch were NULL - since folios_put_refs() skips huge zero folios, this sometimes causes a crash, but sometimes does not. For debugging, it is better to reveal such bugs reliably and not hide them behind random preconditions like "has the huge zero folio already been created?" To improve detection of such bugs, David Hildenbrand suggested adding a VM_WARN_ON_ONCE(). Link: https://lkml.kernel.org/r/20250828084820.570118-1-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Dev Jain Cc: Kairui Song Cc: Kemeng Shi Cc: Liam Howlett Cc: Mariano Pache Cc: Nhat Pham Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 204dfefe039263d7b81857c7f320834b5c7dc94e Author: Wei Yang Date: Thu Aug 28 09:16:18 2025 +0000 mm/page_alloc: find_large_buddy() from start_pfn aligned order We iterate pfn from order 0 to MAX_PAGE_ORDER aligned to find large buddy. While if the order is less than start_pfn aligned order, we would get the same pfn and do the same check again. Iterate from start_pfn aligned order to reduce duplicated work. [richard.weiyang@gmail.com: add comment on assignment of order] Link: https://lkml.kernel.org/r/20250828091618.7869-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250902025807.11467-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250828091618.7869-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250902025807.11467-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Zi Yan Acked-by: Johannes Weiner Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Vlastimil Babka Cc: David Hildenbrand Signed-off-by: Andrew Morton commit c66ae64401d148733ff564488160b58a659b80a5 Author: Brendan Jackman Date: Thu Aug 28 12:28:01 2025 +0000 tools: testing: use existing atomic.h for vma/maple tests The shared userspace logic used for unit-testing maple tree and VMA code currently has its own replacements for atomics helpers. This is not needed as the necessary APIs already have userspace implementations in the tools tree. Switching over to that allows deleting a bit of code. Note that the implementation is different; while the version being deleted here is implemented using liburcu, the existing version in tools uses either x86 asm or compiler builtins. It's assumed that both are equally likely to be correct. The tools tree's version of atomic_t is a struct type while the version being deleted was just a typedef of an integer. This means it's no longer valid to call __sync_bool_compare_and_swap() directly on it. One option would be to just peek into the struct and call it on the field, but it seems a little cleaner to just use the corresponding atomic.h API whic has been added recently. Now the fake mapping_map_writable() is copied from the real one. Link: https://lkml.kernel.org/r/20250828-b4-vma-no-atomic-h-v2-4-02d146a58ed2@google.com Signed-off-by: Brendan Jackman Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 953dad21bb691b77265bf5a9acdec5769596b8e0 Author: Brendan Jackman Date: Thu Aug 28 12:28:00 2025 +0000 tools: testing: support EXTRA_CFLAGS in shared.mk This allows the user to set cflags when building tests that use this shared build infrastructure. For example, it enables building with -Werror so that patch-check scripts will fail: make -C tools/testing/vma -j EXTRA_CFLAGS=-Werror Link: https://lkml.kernel.org/r/20250828-b4-vma-no-atomic-h-v2-3-02d146a58ed2@google.com Signed-off-by: Brendan Jackman Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Acked-by: Pedro Falcato Cc: Jann Horn Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d794cd23dc81f4e61eb166a214ea22a5b6a09d02 Author: Brendan Jackman Date: Thu Aug 28 12:27:59 2025 +0000 tools: testing: allow importing arch headers in shared.mk There is an arch/ tree under tools. This contains some useful stuff, to make that available, add it to the -I flags. This requires $(SRCARCH), which is provided by Makefile.arch, so include that.. There still aren't that many headers so also just smush all of them into SHARED_DEPS instead of starting to do any header dependency hocus pocus. Link: https://lkml.kernel.org/r/20250828-b4-vma-no-atomic-h-v2-2-02d146a58ed2@google.com Signed-off-by: Brendan Jackman Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Acked-by: Pedro Falcato Cc: Jann Horn Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ff0db419b278256a45db9bf6bd3f9a9a2c22b762 Author: Brendan Jackman Date: Thu Aug 28 12:27:58 2025 +0000 tools/include: implement a couple of atomic_t ops Patch series "tools: testing: Use existing atomic.h for vma/maple tests", v2. De-duplicating this lets us delete a bit of code. Ulterior motive: I'm working on a new set of the userspace-based unit tests, which will need the atomics API too. That would involve even more duplication, so while the win in this patchset alone is very minimal, it looks a lot more significant with my other WIP patchset. I've tested these commands: make -C tools/testing/vma -j tools/testing/vma/vma make -C tools/testing/radix-tree -j tools/testing/radix-tree/maple Note the EXTRA_CFLAGS patch is actually orthogonal, let me know if you'd prefer I send it separately. This patch (of 4): The VMA tests need an operation equivalent to atomic_inc_unless_negative() to implement a fake mapping_map_writable(). Adding it will enable them to switch to the shared atomic headers and simplify that fake implementation. In order to add that, also add atomic_try_cmpxchg() which can be used to implement it. This is copied from Documentation/atomic_t.txt. Then, implement atomic_inc_unless_negative() itself based on the raw_atomic_dec_unless_positive() in include/linux/atomic/atomic-arch-fallback.h. There's no present need for a highly-optimised version of this (nor any reason to think this implementation is sub-optimal on x86) so just implement this with generic C, no x86-specifics. Link: https://lkml.kernel.org/r/20250828-b4-vma-no-atomic-h-v2-0-02d146a58ed2@google.com Link: https://lkml.kernel.org/r/20250828-b4-vma-no-atomic-h-v2-1-02d146a58ed2@google.com Signed-off-by: Brendan Jackman Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 1e332f303ae93ba4d38b480b1bb5a08f833306f6 Author: Max Kellermann Date: Thu Aug 28 15:03:11 2025 +0200 pagevec.h: add `const` to pointer parameters of getter functions For improved const-correctness. Link: https://lkml.kernel.org/r/20250828130311.772993-1-max.kellermann@ionos.com Signed-off-by: Max Kellermann Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Lorenzo Stoakes Acked-by: SeongJae Park Reviewed-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d8f867fa0825fb3e358457566d7326d8aab2406a Author: Quanmin Yan Date: Thu Aug 28 10:12:42 2025 -0700 mm/damon: add damon_ctx->min_sz_region Adopting addr_unit would make DAMON_MINREGION 'addr_unit * 4096' bytes and cause data alignment issues[1]. Add damon_ctx->min_sz_region to change DAMON_MIN_REGION from a global macro value to per-context variable. Link: https://lkml.kernel.org/r/20250828171242.59810-12-sj@kernel.org Link: https://lore.kernel.org/all/527714dd-0e33-43ab-bbbd-d89670ba79e7@huawei.com [1] Signed-off-by: Quanmin Yan Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 56cd19404abae2c17d1e6d1e3c7d23dd79b75039 Author: SeongJae Park Date: Thu Aug 28 10:12:41 2025 -0700 Docs/ABI/damon: document addr_unit file Document addr_unit DAMON sysfs file on DAMON ABI document. Link: https://lkml.kernel.org/r/20250828171242.59810-11-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit e0c725455fd5a042a50f029c24738ee60b5e1516 Author: SeongJae Park Date: Thu Aug 28 10:12:40 2025 -0700 Docs/admin-guide/mm/damon/usage: document addr_unit file Document addr_unit DAMON sysfs file on DAMON usage document. Link: https://lkml.kernel.org/r/20250828171242.59810-10-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 7b06c471afc8d82c9c246532b74c4ad4db2890d2 Author: SeongJae Park Date: Thu Aug 28 10:12:39 2025 -0700 Docs/mm/damon/design: document 'address unit' parameter Add 'addr_unit' parameter description on DAMON design document. Link: https://lkml.kernel.org/r/20250828171242.59810-9-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 540a2aebc657b02520a8837778dace8608ec4f05 Author: SeongJae Park Date: Thu Aug 28 10:12:38 2025 -0700 mm/damon/sysfs: implement addr_unit file under context dir Only DAMON kernel API callers can use addr_unit parameter. Implement a sysfs file to let DAMON sysfs ABI users use it. Additionally, addr_unit must be set to a non-zero value. Link: https://lkml.kernel.org/r/20250828171242.59810-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 01e7ee33a0caddc7b86d6ea1ae61090c7d2fe4a6 Author: SeongJae Park Date: Thu Aug 28 10:12:37 2025 -0700 mm/damon/paddr: support addr_unit for DAMOS_STAT Add support of addr_unit for DAMOS_STAT action handling from the DAMOS operation implementation for the physical address space. Link: https://lkml.kernel.org/r/20250828171242.59810-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit ec1d5bab0689658b105810aaceff68e7078e4697 Author: SeongJae Park Date: Thu Aug 28 10:12:36 2025 -0700 mm/damon/paddr: support addr_unit for MIGRATE_{HOT,COLD} Add support of addr_unit for DAMOS_MIGRATE_HOT and DAMOS_MIGRATE_COLD action handling from the DAMOS operation implementation for the physical address space. Link: https://lkml.kernel.org/r/20250828171242.59810-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 51a1ebd3a295c8c1a75331a97d0c7820606dd056 Author: SeongJae Park Date: Thu Aug 28 10:12:35 2025 -0700 mm/damon/paddr: support addr_unit for DAMOS_LRU_[DE]PRIO Add support of addr_unit for DAMOS_LRU_PRIO and DAMOS_LRU_DEPRIO action handling from the DAMOS operation implementation for the physical address space. Link: https://lkml.kernel.org/r/20250828171242.59810-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 85246435b249b852bd8a1b1e5913a157e6d12f2f Author: SeongJae Park Date: Thu Aug 28 10:12:34 2025 -0700 mm/damon/paddr: support addr_unit for DAMOS_PAGEOUT Add support of addr_unit for DAMOS_PAGEOUT action handling from the DAMOS operation implementation for the physical address space. Link: https://lkml.kernel.org/r/20250828171242.59810-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit d8096848e73e3740bd3ff1a96f7fb3c6a5578882 Author: SeongJae Park Date: Thu Aug 28 10:12:33 2025 -0700 mm/damon/paddr: support addr_unit for access monitoring Add support of addr_unit paramer for access monitoing operations of paddr. Link: https://lkml.kernel.org/r/20250828171242.59810-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 09a616cbb371e6b843e536f00e38d6b43d796ac4 Author: SeongJae Park Date: Thu Aug 28 10:12:32 2025 -0700 mm/damon/core: add damon_ctx->addr_unit Patch series "mm/damon: support ARM32 with LPAE", v3. Previously, DAMON's physical address space monitoring only supported memory ranges below 4GB on LPAE-enabled systems. This was due to the use of 'unsigned long' in 'struct damon_addr_range', which is 32-bit on ARM32 even with LPAE enabled[1]. To add DAMON support for ARM32 with LPAE enabled, a new core layer parameter called 'addr_unit' was introduced[2]. Operations set layer can translate a core layer address to the real address by multiplying the parameter value to the core layer address. Support of the parameter is up to each operations layer implementation, though. For example, operations set implementations for virtual address space can simply ignore the parameter. Add the support on paddr, which is the DAMON operations set implementation for the physical address space, as we have a clear use case for that. This patch (of 11): In some cases, some of the real address that handled by the underlying operations set cannot be handled by DAMON since it uses only 'unsinged long' as the address type. Using DAMON for physical address space monitoring of 32 bit ARM devices with large physical address extension (LPAE) is one example[1]. Add a parameter name 'addr_unit' to core layer to help such cases. DAMON core API callers can set it as the scale factor that will be used by the operations set for translating the core layer's addresses to the real address by multiplying the parameter value to the core layer address. Support of the parameter is up to each operations set layer. The support from the physical address space operations set (paddr) will be added with following commits. Link: https://lkml.kernel.org/r/20250828171242.59810-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250828171242.59810-2-sj@kernel.org Link: https://lore.kernel.org/20250408075553.959388-1-zuoze1@huawei.com [1] Link: https://lore.kernel.org/all/20250416042551.158131-1-sj@kernel.org/ [2] Signed-off-by: SeongJae Park Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: ze zuo Signed-off-by: Andrew Morton commit 98c94f1035fc0c82ab008854a165df2c20c0cb6a Author: Wei Yang Date: Wed Aug 27 07:01:05 2025 +0000 mm/pageblock-flags: remove PB_migratetype_bits/PB_migrate_end enum pageblock_bits defines the meaning of pageblock bits. Currently PB_migratetype_bits says the lowest 3 bits represents migratetype and PB_migrate_end/MIGRATETYPE_MASK's definition rely on it with magical computation. Remove the definition of PB_migratetype_bits/PB_migrate_end. Use PB_migrate_[0|1|2] to represent lowest bits for migratetype. Then we can simplify related definition. Also, MIGRATETYPE_AND_ISO_MASK is MIGRATETYPE_MASK add isolation bit. Use MIGRATETYPE_MASK in the definition of MIGRATETYPE_AND_ISO_MASK looks cleaner. No functional change intended. Link: https://lkml.kernel.org/r/20250827070105.16864-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Zi Yan Cc: Vlastimil Babka Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit dd3b304b9410e5d99f7d35e8b0b998f4446c5191 Author: Wei Yang Date: Wed Aug 27 07:01:04 2025 +0000 mm/page_alloc: use xxx_pageblock_isolate() for better reading Patch series "mm/pageblock: improve readability of some pageblock handling", v3. During code reading, found two possible points to improve the readability of pageblock handling. Patch 1: isolate bit is standalone and there are dedicated helpers. Instead of check the bit directly, we could use the helper to do it. Patch 2: remove PB_migratetype_bits and PB_migrate_end to reduce magical computation. This patch (of 2): Since commit e904bce2d9d4 ("mm/page_isolation: make page isolation a standalone bit"), it provides dedicated helper to handle isolation. Change to use these helpers to be better reading. No functional change intended. Link: https://lkml.kernel.org/r/20250827070105.16864-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250827070105.16864-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit b55102826d7d3d41a5777931689c746207308c95 Author: Boris Burkov Date: Thu Aug 21 14:55:37 2025 -0700 btrfs: set AS_KERNEL_FILE on the btree_inode extent_buffers are global and shared so their pages should not belong to any particular cgroup (currently whichever cgroups happens to allocate the extent_buffer). Btrfs tree operations should not arbitrarily block on cgroup reclaim or have the shared extent_buffer pages on a cgroup's reclaim lists. Link: https://lkml.kernel.org/r/2ee99832619a3fdfe80bf4dc9760278662d2d746.1755812945.git.boris@bur.io Signed-off-by: Boris Burkov Acked-by: Shakeel Butt Tested-by: syzbot@syzkaller.appspotmail.com Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Qu Wenruo Cc: Roman Gushchin Signed-off-by: Andrew Morton commit e3a9ac4e866ea746475b4026819a8c08ec1142e6 Author: Boris Burkov Date: Thu Aug 21 14:55:36 2025 -0700 mm: add vmstat for kernel_file pages Kernel file pages are tricky to track because they are indistinguishable from files whose usage is accounted to the root cgroup. To maintain good accounting, introduce a vmstat counter tracking kernel file pages. Confirmed that these work as expected at a high level by mounting a btrfs using AS_KERNEL_FILE for metadata pages, and seeing the counter rise with fs usage then go back to a minimal level after drop_caches and finally down to 0 after unmounting the fs. Link: https://lkml.kernel.org/r/08ff633e3a005ed5f7691bfd9f58a5df8e474339.1755812945.git.boris@bur.io Signed-off-by: Boris Burkov Suggested-by: Shakeel Butt Acked-by: Shakeel Butt Tested-by: syzbot@syzkaller.appspotmail.com Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Qu Wenruo Cc: Roman Gushchin Signed-off-by: Andrew Morton commit cf1dec76ba8a00b20e51d205f3c9f5c45bc96df2 Author: Boris Burkov Date: Thu Aug 21 14:55:35 2025 -0700 mm/filemap: add AS_KERNEL_FILE Patch series "introduce kernel file mapped folios", v4. Btrfs currently tracks its metadata pages in the page cache, using a fake inode (fs_info->btree_inode) with offsets corresponding to where the metadata is stored in the filesystem's full logical address space. A consequence of this is that when btrfs uses filemap_add_folio(), this usage is charged to the cgroup of whichever task happens to be running at the time. These folios don't belong to any particular user cgroup, so I don't think it makes much sense for them to be charged in that way. Some negative consequences as a result: - A task can be holding some important btrfs locks, then need to lookup some metadata and go into reclaim, extending the duration it holds that lock for, and unfairly pushing its own reclaim pain onto other cgroups. - If that cgroup goes into reclaim, it might reclaim these folios a different non-reclaiming cgroup might need soon. This is naturally offset by LRU reclaim, but still. We have two options for how to manage such file pages: 1. charge them to the root cgroup. 2. don't charge them to any cgroup at all. 2. breaks the invariant that every mapped page has a cgroup. This is workable, but unnecessarily risky. Therefore, go with 1. A very similar proposal to use the root cgroup was previously made by Qu, where he eventually proposed the idea of setting it per address_space. This makes good sense for the btrfs use case, as the behavior should apply to all use of the address_space, not select allocations. I.e., if someone adds another filemap_add_folio() call using btrfs's btree_inode, we would almost certainly want to account that to the root cgroup as well. This patch (of 3): Add the flag AS_KERNEL_FILE to the address_space to indicate that this mapping's memory is exempt from the usual memcg accounting. [boris@bur.io: fix CONFIG_MEMCG build for AS_KERNEL_FILE] Link: https://lkml.kernel.org/r/6de59ddeec81b5c294d337c001ba0061631d4ec6.1755816635.git.boris@bur.io Link: https://lore.kernel.org/linux-mm/b5fef5372ae454a7b6da4f2f75c427aeab6a07d6.1727498749.git.wqu@suse.com/ Link: https://lkml.kernel.org/r/f09c4e2c90351d4cb30a1969f7a863b9238bd291.1755812945.git.boris@bur.io Signed-off-by: Boris Burkov Suggested-by: Qu Wenruo Suggested-by: Shakeel Butt Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Signed-off-by: Andrew Morton commit c090868f59ce888db838cf543d18f731d13ed498 Author: Miaohe Lin Date: Tue Aug 26 11:09:55 2025 +0800 Revert "hugetlb: make hugetlb depends on SYSFS or SYSCTL" Commit f8142cf94d47 ("hugetlb: make hugetlb depends on SYSFS or SYSCTL") added dependency on SYSFS or SYSCTL but hugetlb can be used without SYSFS or SYSCTL. So this dependency is wrong and should be removed. For users with CONFIG_SYSFS or CONFIG_SYSCTL on, there should be no difference. For users have CONFIG_SYSFS and CONFIG_SYSCTL both undefined, hugetlbfs can still works perfectly well through cmdline except a possible kismet warning[1] when select CONFIG_HUGETLBFS. IMHO, it might not worth a backport. This reverts commit f8142cf94d4737ea0c3baffb3b9bad8addcb9b6b. It overlooked the scenario of using hugetlb through boot parameters when it was submitted. Link: https://lkml.kernel.org/r/20250826030955.2898709-1-linmiaohe@huawei.com Link: https://lore.kernel.org/all/5c99458f-4a91-485f-8a35-3618a992e2e4@csgroup.eu/ [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508222032.bwJsQPZ1-lkp@intel.com/ Signed-off-by: Miaohe Lin Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 1580cd50b6d40af81fe48611ef7a60545eb8d40b Author: Dev Jain Date: Tue Sep 9 11:45:30 2025 +0530 selftests/mm/uffd-stress: stricten constraint on free hugepages needed before the test The test requires at least 2 * (bytes/page_size) hugetlb memory, since we require identical number of hugepages for src and dst location. Fix this. Along with the above, as explained in patch "selftests/mm/uffd-stress: Make test operate on less hugetlb memory", the racy nature of the test requires that we have some extra number of hugepages left beyond what is required. Therefore, stricten this constraint. Link: https://lkml.kernel.org/r/20250909061531.57272-3-dev.jain@arm.com Fixes: 5a6aa60d1823 ("selftests/mm: skip uffd hugetlb tests with insufficient hugepages") Signed-off-by: Dev Jain Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 060b6c72ce94ebd1190842e81eb9675d7400c5f6 Author: Dev Jain Date: Tue Sep 9 11:45:29 2025 +0530 selftests/mm/uffd-stress: make test operate on less hugetlb memory Patch series "selftests/mm: uffd-stress fixes", v2. This patchset ensures that the number of hugepages is correctly set in the system so that the uffd-stress test does not fail due to the racy nature of the test. Patch 1 changes the hugepage constraint in the run_vmtests.sh script, whereas patch 2 changes the constraint in the test itself. This patch (of 2): We observed uffd-stress selftest failure on arm64 and intermittent failures on x86 too: running ./uffd-stress hugetlb-private 128 32 bounces: 17, mode: rnd read, ERROR: UFFDIO_COPY error: -12 (errno=12, @uffd-common.c:617) [FAIL] not ok 18 uffd-stress hugetlb-private 128 32 # exit=1 For this particular case, the number of free hugepages from run_vmtests.sh will be 128, and the test will allocate 64 hugepages in the source location. The stress() function will start spawning threads which will operate on the destination location, triggering uffd-operations like UFFDIO_COPY from src to dst, which means that we will require 64 more hugepages for the dst location. Let us observe the locking_thread() function. It will lock the mutex kept at dst, triggering uffd-copy. Suppose that 127 (64 for src and 63 for dst) hugepages have been reserved. In case of BOUNCE_RANDOM, it may happen that two threads trying to lock the mutex at dst, try to do so at the same hugepage number. If one thread succeeds in reserving the last hugepage, then the other thread may fail in alloc_hugetlb_folio(), returning -ENOMEM. I can confirm that this is indeed the case by this hacky patch: :--- a/mm/hugetlb.c ; +++ b/mm/hugetlb.c ; @@ -6929,6 +6929,11 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, ; ; folio = alloc_hugetlb_folio(dst_vma, dst_addr, false); ; if (IS_ERR(folio)) { ; + pte_t *actual_pte = hugetlb_walk(dst_vma, dst_addr, PMD_SIZE); ; + if (actual_pte) { ; + ret = -EEXIST; ; + goto out; ; + } ; ret = -ENOMEM; ; goto out; ; } This code path gets triggered indicating that the PMD at which one thread is trying to map a hugepage, gets filled by a racing thread. Therefore, instead of using freepgs to compute the amount of memory, use freepgs - (min(32, nr_cpus) - 1), so that the test still has some extra hugepages to use. The adjustment is a function of min(32, nr_cpus) - the value of nr_parallel in the test - because in the worst case, nr_parallel number of threads will try to map a hugepage on the same PMD, one will win the allocation race, and the other nr_parallel - 1 threads will fail, so we need extra nr_parallel - 1 hugepages to satisfy this request. Note that, in case the adjusted value underflows, there is a check for the number of free hugepages in the test itself, which will fail: get_free_hugepages() < bytes / page_size A negative value will be passed on to bytes which is of type size_t, thus the RHS will become a large value and the check will fail, so we are safe. Link: https://lkml.kernel.org/r/20250909061531.57272-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20250909061531.57272-2-dev.jain@arm.com Signed-off-by: Dev Jain Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6d11dec130ad16f2b08ef88fb7f3d37dc99d74d6 Author: Baolin Wang Date: Tue Aug 26 17:35:55 2025 +0800 mm: shmem: drop the unnecessary folio_nr_pages() We've got the number of pages in the folio earlier, thus remove the redundant folio_nr_pages() call. Link: https://lkml.kernel.org/r/67c80182ebd949e3894908e01e224697c143aabb.1756200587.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit ab1c34c83407b6ae1f1313789cb7ec813c26b5e8 Author: Baolin Wang Date: Tue Aug 26 17:35:54 2025 +0800 mm: shmem: use 'folio' for shmem_partial_swap_usage() It is more straightforward to use the term `folio'. No functional changes. Link: https://lkml.kernel.org/r/a2d39608d99cba1130cacd9cffbafc6949193c08.1756200587.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 6c3826173e6aece0f7375392f509065b6944fd35 Author: Brendan Jackman Date: Tue Aug 26 14:06:54 2025 +0000 mm/page_alloc: harmonize should_compact_retry() type Currently order is signed in one version of the function and unsigned in the other. Tidy that up. In page_alloc.c, order is unsigned in the vast majority of cases. But, there is a cluster of exceptions in compaction-related code (probably stemming from the fact that compact_control.order is signed). So, prefer local consistency and make this one signed too. Link: https://lkml.kernel.org/r/20250826-cleanup-should_compact_retry-v1-1-d2ca89727fcf@google.com Signed-off-by: Brendan Jackman Reviewed-by: Zi Yan Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ef49b7b39d50b9e4f9d63e64f5d8acafe3c71158 Author: Sidhartha Kumar Date: Tue Aug 26 15:13:44 2025 +0000 maple_tree: fix MAPLE_PARENT_RANGE32 and parent pointer docs MAPLE_PARENT_RANGE32 should be 0x02 as a 32 bit node is indicated by the bit pattern 0b010 which is the hex value 0x02. There are no users currently, so there is no associated bug with this wrong value. Fix typo Note -> Node and replace x with b to indicate binary values. Link: https://lkml.kernel.org/r/20250826151344.403286-1-sidhartha.kumar@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Sidhartha Kumar Reviewed-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit e76e09bdf9f7d58ccc62d416a4b90700000f145a Author: Pratyush Yadav Date: Tue Aug 26 14:38:16 2025 +0200 kho: make sure kho_scratch argument is fully consumed When specifying fixed sized scratch areas, the parser only parses the three scratch sizes and ignores the rest of the argument. This means the argument can have any bogus trailing characters. For example, "kho_scratch=256M,512M,512Mfoobar" results in successful parsing: [ 0.000000] KHO: scratch areas: lowmem: 256MiB global: 512MiB pernode: 512MiB It is generally a good idea to parse arguments as strictly as possible. In addition, if bogus trailing characters are allowed in the kho_scratch argument, it is possible that some people might end up using them and later extensions to the argument format will cause unexpected breakages. Make sure the argument is fully consumed after all three scratch sizes are parsed. With this change, the bogus argument "kho_scratch=256M,512M,512Mfoobar" results in: [ 0.000000] Malformed early option 'kho_scratch' Link: https://lkml.kernel.org/r/20250826123817.64681-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit dfd04add595b97758c8ad1ee970554b7af5c57dd Author: Wander Lairson Costa Date: Mon Aug 25 09:59:26 2025 -0300 kmem/tracing: add kmem name to kmem_cache_alloc tracepoint The kmem_cache_free tracepoint includes a "name" field, which allows for easy identification and filtering of specific kmem's. However, the kmem_cache_alloc tracepoint lacks this field, making it difficult to pair corresponding alloc and free events for analysis. Add the "name" field to kmem_cache_alloc to enable consistent tracking and correlation of kmem alloc and free events. Link: https://lkml.kernel.org/r/20250825125927.59816-1-wander@redhat.com Signed-off-by: Wander Lairson Costa Cc: David Hildenbrand Cc: David Rientjes Cc: Martin Liu Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit 46afff459925297d9d47c043eb8541fabac9bb0a Author: Kairui Song Date: Tue Aug 26 00:37:21 2025 +0800 mm/page-writeback: drop usage of folio_index folio_index is only needed for mixed usage of page cache and swap cache. The remaining three caller in page-writeback are for page cache tag marking. Swap cache space doesn't use tag (explicitly sets mapping_set_no_writeback_tags), so use folio->index here directly. Link: https://lkml.kernel.org/r/20250825163721.17734-1-ryncsn@gmail.com Signed-off-by: Kairui Song Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 79dfed097680084f3d4716fa2c5bc945233bd2c0 Author: I Viswanath Date: Mon Aug 25 22:36:43 2025 +0530 selftests/mm: use calloc instead of malloc in pagemap_ioctl.c As per Documentation/process/deprecated.rst, dynamic size calculations should not be performed in memory allocator arguments due to possible overflows. Replace malloc with calloc to avoid open-ended arithmetic and prevent possible overflows. Link: https://lkml.kernel.org/r/20250825170643.63174-1-viswanathiyyappan@gmail.com Signed-off-by: I Viswanath Reviewed-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Reviewed by: Donet Tom Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 786eb990cfb78aab94eb74fb32a030e14723a620 Author: Donet Tom Date: Fri Aug 22 14:18:45 2025 +0530 drivers/base/node: handle error properly in register_one_node() If register_node() returns an error, it is not handled correctly. The function will proceed further and try to register CPUs under the node, which is not correct. So, in this patch, if register_node() returns an error, we return immediately from the function. Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") Signed-off-by: Donet Tom Acked-by: David Hildenbrand Cc: Alison Schofield Cc: Danilo Krummrich Cc: Dave Jiang Cc: Donet Tom Cc: Greg Kroah-Hartman Cc: Hiroyouki Kamezawa Cc: Joanthan Cameron Cc: Oscar Salvador Cc: "Ritesh Harjani (IBM)" Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit 3615e106e0f7099af5ac8a2d4338b34b7a2dbae1 Author: Wei Yang Date: Fri Aug 22 02:57:32 2025 +0000 mm/khugepaged: use list_xxx() helper to improve readability In general, khugepaged_scan_mm_slot() iterates khugepaged_scan.mm_head list to get a mm_struct for collapse memory. Use list_xxx() helper would be more obvious to the list iteration operation. No functional change. Link: https://lkml.kernel.org/r/20250822025732.9025-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Lorenzo Stoakes Acked-by: SeongJae Park Reviewed-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Baolin Wang Reviewed-by: Dev Jain Cc: Barry Song Cc: Mariano Pache Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit a7498388b099f08219bad5f19d00e436da27fbf9 Author: Bala-Vignesh-Reddy Date: Thu Aug 21 15:41:59 2025 +0530 selftests: centralise maybe-unused definition in kselftest.h Several selftests subdirectories duplicated the define __maybe_unused, leading to redundant code. Move to kselftest.h header and remove other definitions. This addresses the duplication noted in the proc-pid-vm warning fix Link: https://lkml.kernel.org/r/20250821101159.2238-1-reddybalavignesh9979@gmail.com Signed-off-by: Bala-Vignesh-Reddy Suggested-by: Andrew Morton Link:https://lore.kernel.org/lkml/20250820143954.33d95635e504e94df01930d0@linux-foundation.org/ Reviewed-by: Wei Yang Acked-by: SeongJae Park Reviewed-by: Ming Lei Acked-by: Mickal Salan [landlock] Cc: Shuah Khan Signed-off-by: Andrew Morton commit 940b1be22578dc67a0aa78338177b97b9a13eb8b Author: ally heev Date: Sat Aug 23 22:32:08 2025 +0530 kselftest: mm: fix typos in test_vmalloc.sh Fix simple typos in function name and console message. Link: https://lkml.kernel.org/r/20250823170208.184149-1-allyheev@gmail.com Signed-off-by: ally heev Cc: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 32960f750386283a9103d3cc9aa53415b79e03f5 Author: Usama Arif Date: Thu Aug 21 16:00:38 2025 +0100 mm/huge_memory: remove enforce_sysfs from __thp_vma_allowable_orders Using forced_collapse directly is clearer and enforce_sysfs is not really needed. Link: https://lkml.kernel.org/r/20250821150038.2025521-1-usamaarif642@gmail.com Signed-off-by: Usama Arif Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: SeongJae Park Reviewed-by: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ce32123b9bc02bb4cd343fa03d1b8bb7f9ce9c51 Author: Brendan Jackman Date: Thu Aug 21 13:29:47 2025 +0000 mm: remove is_migrate_highatomic() There are 3 potential reasons for is_migrate_*() helpers: 1. They represent higher-level attributes of migratetypes, like is_migrate_movable() 2. They are ifdef'd, like is_migrate_isolate(). 3. For consistency with an is_migrate_*_page() helper, also like is_migrate_isolate(). It looks like is_migrate_highatomic() was for case 3, but that was removed in commit e0932b6c1f94 ("mm: page_alloc: consolidate free page accounting"). So remove the indirection and go back to a simple comparison. Link: https://lkml.kernel.org/r/20250821-is-migrate-highatomic-v1-1-ddb6e5d7c566@google.com Signed-off-by: Brendan Jackman Reviewed-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Johannes Weiner Reviewed-by: Lorenzo Stoakes Acked-by: SeongJae Park Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9907e1df31c0f4bdcebe16de809121baa754e5b5 Author: Shankari Anand Date: Wed Jul 16 14:41:58 2025 +0530 rust: mm: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in the mm subsystem to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Link: https://lkml.kernel.org/r/20250716091158.812860-1-shankari.ak0208@gmail.com Signed-off-by: Shankari Anand Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Acked-by: Alice Ryhl Cc: Alex Gaynor Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Andrew Morton commit 0b1bf60c324a8135f780d50bffb53d54f8863f88 Author: Nhat Pham Date: Wed Aug 20 11:15:47 2025 -0700 mm/zswap: reduce the size of the compression buffer to a single page Reduce the compression buffer size from 2 * PAGE_SIZE to only one page, as the compression output (in the success case) should not exceed the length of the input. In the past, Chengming tried to reduce the compression buffer size, but ran into issues with the LZO algorithm (see [2]). Herbert Xu reported that the issue has been fixed (see [3]). Now we should have the guarantee that compressors' output should not exceed one page in the success case, and the algorithm will just report failure otherwise. With this patch, we save one page per cpu (per compression algorithm). Link: https://lkml.kernel.org/r/20250820181547.3794167-1-nphamcs@gmail.com Link: https://lore.kernel.org/linux-mm/20231213-zswap-dstmem-v4-1-f228b059dd89@bytedance.com/ [1] Link: https://lore.kernel.org/lkml/0000000000000b05cd060d6b5511@google.com/ [2] Link: https://lore.kernel.org/linux-mm/aKUmyl5gUFCdXGn-@gondor.apana.org.au/ [3] Co-developed-by: Chengming Zhou Signed-off-by: Chengming Zhou Signed-off-by: Nhat Pham Acked-by: SeongJae Park Reviewed-by: Chengming Zhou Cc: Herbert Xu Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 0cd01c4a5cc140efb9fc203dd05ffccf3c2197d0 Author: gaoxiang17 Date: Thu Aug 21 06:38:55 2025 +0800 mm/cma: add 'available count' and 'total count' to trace_cma_alloc_start This makes cma info more intuitive during debugging. Show up in the trace as: 279.814717: cma_alloc_start: name=reserved request_count=4 available_count=8096 total_count=8192 align=0 309.790580: cma_alloc_start: name=reserved request_count=4 available_count=8092 total_count=8192 align=0 317.046609: cma_alloc_start: name=reserved request_count=4 available_count=8088 total_count=8192 align=0 Link: https://lkml.kernel.org/r/8a79284879c529f467478552825154b018076e95.1755729178.git.gaoxiang17@xiaomi.com Signed-off-by: gaoxiang17 Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5d5d75ff646c9b5e54f1c0018097d970dabafb74 Author: Wei Yang Date: Sun Aug 17 03:26:47 2025 +0000 mm/rmap: use folio_large_nr_pages() when we are sure it is a large folio Non-large folio is handled at the beginning, so it is a large folio for sure. Use folio_large_nr_pages() here like elsewhere. Link: https://lkml.kernel.org/r/20250817032647.29147-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit e5e758922d1a8ce5ea97140192d395f296bcf32c Author: Wei Yang Date: Sun Aug 17 03:26:46 2025 +0000 mm/rmap: not necessary to mask off FOLIO_PAGES_MAPPED At this point, we are in an if branch conditional on (nr < ENTIRELY_MAPPED), and FOLIO_PAGES_MAPPED is equal to (ENTIRELY_MAPPED - 1). This means the upper bits are already cleared. It is not necessary to mask it off. Link: https://lkml.kernel.org/r/20250817032647.29147-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit 658fa653b4d17715c6b4c3686dabbfee6eb15e51 Author: Steven Rostedt Date: Thu Jun 12 10:03:13 2025 -0400 mm, x86/mm: move creating the tlb_flush event back to x86 code Commit e73ad5ff2f76 ("mm, x86/mm: Make the batched unmap TLB flush API more generic") moved the trace_tlb_flush out of mm/rmap.c and back into x86 specific architecture, but it kept the include to the events/tlb.h file, even though it didn't use that event. Then another commit came in and added more events to the mm/rmap.c file and moved the #define CREATE_TRACE_POINTS define from the x86 specific architecture to the generic mm/rmap.h file to create both the tlb_flush tracepoint and the new tracepoints. But since the tlb_flush tracepoint is only x86 specific, it now creates that tracepoint for all other architectures and this wastes approximately 5K of text and meta data that will not be used. Remove the events/tlb.h from mm/rmap.c and add the define CREATE_TRACE_POINTS back in the x86 code. Link: https://lkml.kernel.org/r/20250612100313.3b9a8b80@batman.local.home Fixes: e73ad5ff2f76 ("mm, x86/mm: Make the batched unmap TLB flush API more generic") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Lorenzo Stoakes Cc: Andy Lutomirski Cc: Borislav Betkov Cc: David Hildenbrand Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 7bebb41b96b5a898134b757fda520b7b990a91fa Author: Christoph Hellwig Date: Mon Aug 18 08:10:10 2025 +0200 mm: remove write_cache_pages No users left. Link: https://lkml.kernel.org/r/20250818061017.1526853-4-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: David Hildenbrand Cc: Kent Overstreet Cc: Konstantin Komarov Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit e34b21ba1541760e64e913caa10181ea3b7d0761 Author: Christoph Hellwig Date: Mon Aug 18 08:10:09 2025 +0200 bcachefs: stop using write_cache_pages Stop using the obsolete write_cache_pages and use writeback_iter directly. This basically just open codes write_cache_pages without the indirect call, but there's probably ways to structure the code even nicer as a follow on. Link: https://lkml.kernel.org/r/20250818061017.1526853-3-hch@lst.de Signed-off-by: Christoph Hellwig Cc: David Hildenbrand Cc: Kent Overstreet Cc: Konstantin Komarov Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 8d4bb46ba7671899a506c555ab71df65ba2e4a60 Author: Christoph Hellwig Date: Mon Aug 18 08:10:08 2025 +0200 ntfs3: stop using write_cache_pages Patch series "remove write_cache_pages()". Kill off write_cache_pages() after converting the last two users to the iterator. This patch (of 3): Stop using the obsolete write_cache_pages and use writeback_iter directly. Link: https://lkml.kernel.org/r/20250818061017.1526853-1-hch@lst.de Link: https://lkml.kernel.org/r/20250818061017.1526853-2-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Kent Overstreet Cc: Konstantin Komarov Cc: Matthew Wilcox (Oracle) Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 1aca4021f8456470fe92ba795886be0e595b927d Author: Xichao Zhao Date: Tue Aug 19 15:04:57 2025 +0800 lib/test_hmm: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Link: https://lkml.kernel.org/r/20250819070457.486348-1-zhao.xichao@vivo.com Signed-off-by: Xichao Zhao Reviewed-by: Alistair Popple Cc: Jason Gunthorpe Cc: Leon Romanovsky Signed-off-by: Andrew Morton commit c9615059cab5ad8aa6b96195163a7478fcef194c Author: Wei Yang Date: Tue Aug 19 08:00:47 2025 +0000 selftests/mm: test that rmap behaves as expected As David suggested, currently we don't have a high level test case to verify the behavior of rmap. This patch introduce the verification on rmap by migration. The general idea is if migrate one shared page between processes, this would be reflected in all related processes. Otherwise, we have problem in rmap. Currently it covers following four scenarios: * anonymous page * shmem page * pagecache page * ksm page Link: https://lkml.kernel.org/r/20250819080047.10063-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: David Hildenbrand Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit b27f292de6b1a39e9fb0f83c79dfe902a9ea86c3 Author: Wei Yang Date: Tue Aug 19 08:00:46 2025 +0000 selftests/mm: put general ksm operation into vm_util Patch series "test that rmap behaves as expected", v4. As David suggested, currently we don't have a high level test case to verify the behavior of rmap. This patch set introduce the verification on rmap by migration. Patch 1 is a preparation to move ksm related operations into vm_util. Patch 2 is the new test case for rmap. Currently it covers following four scenarios: * anonymous page * shmem page * pagecache page * ksm page This patch (of 2): There are some general ksm operations could be used by other related test cases. Put them into vm_util for common use. This is a preparation patch for later use. Link: https://lkml.kernel.org/r/20250819080047.10063-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250819080047.10063-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: David Hildenbrand Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit 63ec0c26b682ca235953490dfa82b8fa4d4ab4a0 Author: Baokun Li Date: Tue Aug 19 14:18:03 2025 +0800 tmpfs: preserve SB_I_VERSION on remount Now tmpfs enables i_version by default and tmpfs does not modify it. But SB_I_VERSION can also be modified via sb_flags, and reconfigure_super() always overwrites the existing flags with the latest ones. This means that if tmpfs is remounted without specifying iversion, the default i_version will be unexpectedly disabled. To ensure iversion remains enabled, SB_I_VERSION is now always set for fc->sb_flags in shmem_init_fs_context(), instead of for sb->s_flags in shmem_fill_super(). Link: https://lkml.kernel.org/r/20250819061803.1496443-1-libaokun@huaweicloud.com Fixes: 36f05cab0a2c ("tmpfs: add support for an i_version counter") Signed-off-by: Baokun Li Reviewed-by: Baolin Wang Tested-by: Baolin Wang Reviewed-by: Jeff Layton Acked-by: Hugh Dickins Signed-off-by: Andrew Morton commit c55ed758e04717564347c40688d40bf231cd7964 Author: Zi Yan Date: Mon Aug 18 14:46:22 2025 -0400 selftests/mm: check after-split folio orders in split_huge_page_test Instead of just checking the existence of PMD folios before and after folio split tests, use check_folio_orders() to check after-split folio orders. The split ranges in split_thp_in_pagecache_to_order_at() are changed to [addr, addr + pagesize) for every pmd_pagesize. It prevents folios within the range being split multiple times due to debugfs split function always perform splits with a pagesize step for a given range. The following tests are not changed: 1. split_pte_mapped_thp: the test already uses kpageflags to check; 2. split_file_backed_thp: no vaddr available. Link: https://lkml.kernel.org/r/20250818184622.1521620-6-ziy@nvidia.com Signed-off-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Donet Tom Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: wang lian Cc: Wei Yang Signed-off-by: Andrew Morton commit fca418e59afafbad3e3656905d3cee241cc0b7a2 Author: Zi Yan Date: Mon Aug 18 14:46:21 2025 -0400 selftests/mm: add check_after_split_folio_orders() helper The helper gathers a folio order statistics of folios within a virtual address range and checks it against a given order list. It aims to provide a more precise folio order check instead of just checking the existence of PMD folios. The helper will be used the upcoming commit. Link: https://lkml.kernel.org/r/20250818184622.1521620-5-ziy@nvidia.com Signed-off-by: Zi Yan Tested-by: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Donet Tom Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: wang lian Cc: Wei Yang Signed-off-by: Andrew Morton commit bd66448f2a0e8da0c7ff01ce2e6dbc2766cf2692 Author: Zi Yan Date: Mon Aug 18 14:46:20 2025 -0400 selftests/mm: reimplement is_backed_by_thp() with more precise check and rename it to is_backed_by_folio(). is_backed_by_folio() checks if the given vaddr is backed a folio with a given order. It does so by: 1. getting the pfn of the vaddr; 2. checking kpageflags of the pfn; if order is greater than 0: 3. checking kpageflags of the head pfn; 4. checking kpageflags of all tail pfns. pmd_order is added to split_huge_page_test.c and replaces max_order. [ziy@nvidia.com: reduce code duplication, per David] Link: https://lkml.kernel.org/r/F54782D6-65A3-4D35-AE03-8ADE636EE258@nvidia.com Link: https://lkml.kernel.org/r/20250818184622.1521620-4-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: wang lian Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Donet Tom Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 72a07c03909b430b454d7557d2b8fe08b01da42d Author: Zi Yan Date: Mon Aug 18 14:46:19 2025 -0400 selftests/mm: mark all functions static in split_huge_page_test.c All functions are only used within the file. Link: https://lkml.kernel.org/r/20250818184622.1521620-3-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: wang lian Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Donet Tom Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9eff16bd3a4b97b3e13337eddaa12abe6e0b2a78 Author: Zi Yan Date: Mon Aug 18 14:46:18 2025 -0400 mm/huge_memory: add new_order and offset to split_huge_pages*() pr_debug Patch series "Better split_huge_page_test result check", v5. This patchset uses kpageflags to get after-split folio orders for a better split_huge_page_test result check[1]. The added gather_after_split_folio_orders() scans through a VPN range and collects the numbers of folios at different orders. check_after_split_folio_orders() compares the result of gather_after_split_folio_orders() to a given list of numbers of different orders. This patchset also adds new order and in folio offset to the split huge page debugfs's pr_debug()s; This patch (of 5): They are useful information for debugging split huge page tests. Link: https://lkml.kernel.org/r/20250818184622.1521620-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250818184622.1521620-2-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: Donet Tom Reviewed-by: wang lian Reviewed-by: Baolin Wang Reviewed-by: Barry Song Acked-by: David Hildenbrand Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b322e88b3d553e85b4e15779491c70022783faa4 Author: Li RongQing Date: Thu Aug 14 18:23:33 2025 +0800 mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 Optimize hugetlb_pages_alloc_boot() to return immediately when max_huge_pages is 0, avoiding unnecessary CPU cycles and the below log message when hugepages aren't configured in the kernel command line. [ 3.702280] HugeTLB: allocation took 0ms with hugepage_allocation_threads=32 Link: https://lkml.kernel.org/r/20250814102333.4428-1-lirongqing@baidu.com Signed-off-by: Li RongQing Reviewed-by: Dev Jain Tested-by: Dev Jain Reviewed-by: Jane Chu Acked-by: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 35224da7e30b08cffa7aa5d893a91b7332b61c2a Author: Chi Zhiling Date: Mon Jul 28 16:39:52 2025 +0800 mm/filemap: skip non-uptodate folio if there are available folios When reading data exceeding the maximum IO size, the operation is split into multiple IO requests, but the data isn't immediately copied to userspace after each IO completion. For example, when reading 2560k data from a device with 1280k maximum IO size, the following sequence occurs: 1. read 1280k 2. copy 41 pages and issue read ahead for next 1280k 3. copy 31 pages to user buffer 4. wait the next 1280k 5. copy 8 pages to user buffer 6. copy 20 folios(64k) to user buffer The 8 pages in step 5 are copied after the second 1280k completes(step 4) due to waiting for a non-uptodate folio in filemap_update_page. We can copy the 8 pages before the second 1280k completes(step 4) to reduce the latency of this read operation. After applying the patch, these 8 pages will be copied before the next IO completes: 1. read 1280k 2. copy 41 pages and issue read ahead for next 1280k 3. copy 31 pages to user buffer 4. copy 8 pages to user buffer 5. wait the next 1280k 6. copy 20 folios(64k) to user buffer This patch drops a setting of IOCB_NOWAIT for AIO, which is fine because filemap_read will set it again for AIO. The final solution provided by Matthew Wilcox: Link: https://lore.kernel.org/linux-fsdevel/aIDy076Sxt544qja@casper.infradead.org/ Link: https://lkml.kernel.org/r/20250728083952.75518-3-chizhiling@163.com Signed-off-by: Chi Zhiling Suggested-by: Matthew Wilcox (Oracle) Cc: Christoph Hellwig Cc: Jan Kara Signed-off-by: Andrew Morton commit c4408277c0d773b7601def781702f7215f894ca7 Author: Chi Zhiling Date: Mon Jul 28 16:39:51 2025 +0800 mm/filemap: do not use is_partially_uptodate for entire folio Patch series "Tiny optimization for large read operations". This series contains two patches, 1. Skip calling is_partially_uptodate for entire folio to save time, I have reviewed the mpage and iomap implementations and didn't spot any issues, but this change likely needs more thorough review. 2. Skip calling filemap_uptodate if there are ready folios in the batch, This might save a few milliseconds in practice, but I didn't observe measurable improvements in my tests. This patch (of 2): When a folio is marked as non-uptodate, it means the folio contains some non-uptodate data. Therefore, calling is_partially_uptodate() to recheck the entire folio is redundant. If all data in a folio is actually up-to-date but the folio lacks the uptodate flag, it will still be treated as non-uptodate in many other places. Thus, there should be no special case handling for filemap. Link: https://lkml.kernel.org/r/20250728083952.75518-1-chizhiling@163.com Link: https://lkml.kernel.org/r/20250728083952.75518-2-chizhiling@163.com Signed-off-by: Chi Zhiling Cc: Matthew Wilcox (Oracle) Cc: Jan Kara Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit f6a4a150f1ec2ef9a1241adc173d8a67ff19633f Author: Sang-Heon Jeon Date: Sun Aug 17 11:13:48 2025 +0900 mm/damon/tests/core-kunit: add damos_commit_filter test Add unit test to verify that damos_commmit_filter() change dest value well. Link: https://lkml.kernel.org/r/20250817021348.570692-1-ekffu200098@gmail.com Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Honggyu Kim Signed-off-by: Andrew Morton commit 4bd22a7ae5742df90abfdc0931a0f1bded65c1de Author: liuqiqi Date: Tue Aug 12 15:02:10 2025 +0800 mm: fix duplicate accounting of free pages in should_reclaim_retry() In the zone_reclaimable_pages() function, if the page counts for NR_ZONE_INACTIVE_FILE, NR_ZONE_ACTIVE_FILE, NR_ZONE_INACTIVE_ANON, and NR_ZONE_ACTIVE_ANON are all zero, the function returns the number of free pages as the result. In this case, when should_reclaim_retry() calculates reclaimable pages, it will inadvertently double-count the free pages in its accounting. static inline bool should_reclaim_retry(gfp_t gfp_mask, unsigned order, struct alloc_context *ac, int alloc_flags, bool did_some_progress, int *no_progress_loops) { ... available = reclaimable = zone_reclaimable_pages(zone); available += zone_page_state_snapshot(zone, NR_FREE_PAGES); This may result in an increase in the number of retries of __alloc_pages_slowpath(), causing increased kswapd load. Link: https://lkml.kernel.org/r/20250812070210.1624218-1-liuqiqi@kylinos.cn Fixes: 6aaced5abd32 ("mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()") Signed-off-by: liuqiqi Reviewed-by: Ye Liu Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 88df6ab2f34b60837ebdab64b2514f356d5ebb65 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:23:01 2025 +0100 mm: add folio_is_pci_p2pdma() Reimplement is_pci_p2pdma_page() in terms of folio_is_pci_p2pdma(). Moves the page_folio() call from inside page_pgmap() to is_pci_p2pdma_page(). This removes a page_folio() call from try_grab_folio() which already has a folio and can pass it in. Link: https://lkml.kernel.org/r/20250805172307.1302730-12-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Shakeel Butt Cc: Zi Yan Signed-off-by: Andrew Morton commit c995ac3aa3747ec2a0373e5f319a22e0cb31d613 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:23:00 2025 +0100 mm: reimplement folio_is_fsdax() For callers of folio_is_fsdax(), we save a folio->page->folio conversion. Callers of is_fsdax_page() simply move the conversion of page->folio from the implementation of page_pgmap() to is_fsdax_page(). Link: https://lkml.kernel.org/r/20250805172307.1302730-11-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit bd0dbbb3fd902c7eea7eb166d91bda4530a8de96 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:59 2025 +0100 mm: reimplement folio_is_device_coherent() For callers of folio_is_device_coherent(), we save a folio->page->folio conversion. Callers of is_device_coherent_page() simply move the conversion of page->folio from the implementation of page_pgmap() to is_device_coherent_page(). Link: https://lkml.kernel.org/r/20250805172307.1302730-10-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 7cfe9cafb6adebc13a246bebafcd69cd37add4e6 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:58 2025 +0100 mm: reimplement folio_is_device_private() For callers of folio_is_device_private(), we save a folio->page->folio conversion. Callers of is_device_private_page() simply move the conversion of page->folio from the implementation of page_pgmap() to is_device_private_page(). Link: https://lkml.kernel.org/r/20250805172307.1302730-9-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 89ef6ad6fa849b780b5a5caae9068261603e1738 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:57 2025 +0100 mm: introduce memdesc_is_zone_device() Remove the conversion from folio to page in folio_is_zone_device() by introducing memdesc_is_zone_device() which takes a memdesc_flags_t from either a page or a folio. Link: https://lkml.kernel.org/r/20250805172307.1302730-8-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 11afccce2ac5fd1ea5e6f0d251e746df782c8cfe Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:56 2025 +0100 slab: use memdesc_nid() We no longer need to convert from slab to folio to get the nid, we can ask memdesc_nid() for the nid directly. Link: https://lkml.kernel.org/r/20250805172307.1302730-7-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 87479378acdd79a0ac84be0b823e37e3816433d9 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:55 2025 +0100 slab: use memdesc_flags_t The slab flags are memdesc flags and contain the same information in the upper bits as the other memdescs (like node ID). Link: https://lkml.kernel.org/r/20250805172307.1302730-6-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 4aff03fbe508780394039053bebfc4f4800b286e Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:54 2025 +0100 mm: introduce memdesc_zonenum() Remove a conversion from folio to page by passing the folio->flags (which are a copy of the page->flags) to the new memdesc_zonenum() function. Link: https://lkml.kernel.org/r/20250805172307.1302730-5-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit eb00fdd84ddabd6948d26595bb5e8c1302220d37 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:53 2025 +0100 mm: introduce memdesc_nid() Remove a conversion from folio to page by passing the folio->flags (which are a copy of the page->flags) to the new memdesc_nid() function. Link: https://lkml.kernel.org/r/20250805172307.1302730-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 56d578c1300f7efe9605b75714173dd3fda16fe2 Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:52 2025 +0100 mm: convert page_to_section() to memdesc_section() Pass in the memdesc_flags_t instead of a pointer to the page. This will allow us to remove a few conversions to struct page in upcoming patches. Link: https://lkml.kernel.org/r/20250805172307.1302730-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 53fbef56e07df822ea3029109ffca25328c2e5ac Author: Matthew Wilcox (Oracle) Date: Tue Aug 5 18:22:51 2025 +0100 mm: introduce memdesc_flags_t Patch series "Add and use memdesc_flags_t". At some point struct page will be separated from struct slab and struct folio. This is a step towards that by introducing a type for the 'flags' word of all three structures. This gives us a certain amount of type safety by establishing that some of these unsigned longs are different from other unsigned longs in that they contain things like node ID, section number and zone number in the upper bits. That lets us have functions that can be easily called by anyone who has a slab, folio or page (but not easily by anyone else) to get the node or zone. There's going to be some unusual merge problems with this as some odd bits of the kernel decide they want to print out the flags value or something similar by writing page->flags and now they'll need to write page->flags.f instead. That's most of the churn here. Maybe we should be removing these things from the debug output? This patch (of 11): Wrap the unsigned long flags in a typedef. In upcoming patches, this will provide a strong hint that you can't just pass a random unsigned long to functions which take this as an argument. [willy@infradead.org: s/flags/flags.f/ in several architectures] Link: https://lkml.kernel.org/r/aKMgPRLD-WnkPxYm@casper.infradead.org [nicola.vetrini@gmail.com: mips: fix compilation error] Link: https://lore.kernel.org/lkml/CA+G9fYvkpmqGr6wjBNHY=dRp71PLCoi2341JxOudi60yqaeUdg@mail.gmail.com/ Link: https://lkml.kernel.org/r/20250825214245.1838158-1-nicola.vetrini@gmail.com Link: https://lkml.kernel.org/r/20250805172307.1302730-1-willy@infradead.org Link: https://lkml.kernel.org/r/20250805172307.1302730-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Zi Yan Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 4e915656a38afe8aeebb283493f49c22d675a9fc Author: Enze Li Date: Fri Aug 15 17:21:10 2025 +0800 mm/damon/Kconfig: make DAMON_STAT_ENABLED_DEFAULT depend on DAMON_STAT The DAMON_STAT_ENABLED_DEFAULT option is strongly tied to DAMON_STAT option -- enabling it alone is meaningless. This patch makes DAMON_STAT_ENABLED_DEFAULT depend on DAMON_STAT, ensuring functional consistency. Link: https://lkml.kernel.org/r/20250815092110.811757-1-lienze@kylinos.cn Fixes: 369c415e6073 ("mm/damon: introduce DAMON_STAT module") Signed-off-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 6bb961448418f3b7c2b2f22b0cc2d766c4f17d95 Author: Usama Arif Date: Fri Aug 15 14:54:59 2025 +0100 selftests: prctl: introduce tests for disabling THPs except for madvise The test will set the global system THP setting to never, madvise or always depending on the fixture variant and the 2M setting to inherit before it starts (and reset to original at teardown). The fixture setup will also test if PR_SET_THP_DISABLE prctl call can be made with PR_THP_DISABLE_EXCEPT_ADVISED and skip if it fails. This tests if the process can: - successfully get the policy to disable THPs expect for madvise. - get hugepages only on MADV_HUGE and MADV_COLLAPSE if the global policy is madvise/always and only with MADV_COLLAPSE if the global policy is never. - successfully reset the policy of the process. - after reset, only get hugepages with: - MADV_COLLAPSE when policy is set to never. - MADV_HUGE and MADV_COLLAPSE when policy is set to madvise. - always when policy is set to "always". - never get a THP with MADV_NOHUGEPAGE. - repeat the above tests in a forked process to make sure the policy is carried across forks. Test results: ./prctl_thp_disable TAP version 13 1..12 ok 1 prctl_thp_disable_completely.never.nofork ok 2 prctl_thp_disable_completely.never.fork ok 3 prctl_thp_disable_completely.madvise.nofork ok 4 prctl_thp_disable_completely.madvise.fork ok 5 prctl_thp_disable_completely.always.nofork ok 6 prctl_thp_disable_completely.always.fork ok 7 prctl_thp_disable_except_madvise.never.nofork ok 8 prctl_thp_disable_except_madvise.never.fork ok 9 prctl_thp_disable_except_madvise.madvise.nofork ok 10 prctl_thp_disable_except_madvise.madvise.fork ok 11 prctl_thp_disable_except_madvise.always.nofork ok 12 prctl_thp_disable_except_madvise.always.fork [usamaarif642@gmail.com: return after executing test in child process] Link: https://lkml.kernel.org/r/3dca2de4-9a6a-4efe-a86c-83f9509831fc@gmail.com Link: https://lkml.kernel.org/r/20250815135549.130506-8-usamaarif642@gmail.com Signed-off-by: Usama Arif Acked-by: David Hildenbrand Cc: Arnd Bergmann Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Cc: Zi Yan Signed-off-by: Andrew Morton commit 681f45deca1c7f517299d032783f655e5f2c36b4 Author: Usama Arif Date: Fri Aug 15 14:54:58 2025 +0100 selftests: prctl: introduce tests for disabling THPs completely The test will set the global system THP setting to never, madvise or always depending on the fixture variant and the 2M setting to inherit before it starts (and reset to original at teardown). The fixture setup will also test if PR_SET_THP_DISABLE prctl call can be made to disable all THPs and skip if it fails. This tests if the process can: - successfully get the policy to disable THPs completely. - never get a hugepage when the THPs are completely disabled with the prctl, including with MADV_HUGE and MADV_COLLAPSE. - successfully reset the policy of the process. - after reset, only get hugepages with: - MADV_COLLAPSE when policy is set to never. - MADV_HUGE and MADV_COLLAPSE when policy is set to madvise. - always when policy is set to "always". - never get a THP with MADV_NOHUGEPAGE. - repeat the above tests in a forked process to make sure the policy is carried across forks. [usamaarif642@gmail.com: return after executing test in child process] Link: https://lkml.kernel.org/r/2d0ea708-ecba-4021-b6ca-e93f1413d60a@gmail.com [usamaarif642@gmail.com: include linux/mman.h for prctl_thp_disable] Link: https://lkml.kernel.org/r/20250910204609.1720498-1-usamaarif642@gmail.com Link: https://lore.kernel.org/all/c8249725-e91d-4c51-b9bb-40305e61e20d@sirena.org.uk/ Link: https://lkml.kernel.org/r/20250815135549.130506-7-usamaarif642@gmail.com Signed-off-by: Usama Arif Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Arnd Bergmann Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Cc: Zi Yan Signed-off-by: Andrew Morton commit 49850bd02658181f235e3f3fd0a9884f812f0914 Author: Usama Arif Date: Fri Aug 15 14:54:57 2025 +0100 selftest/mm: extract sz2ord function into vm_util.h The function already has 2 uses and will have a 3rd one in prctl selftests. The pagesize argument is added into the function, as it's not a global variable anymore. No functional change intended with this patch. Link: https://lkml.kernel.org/r/20250815135549.130506-6-usamaarif642@gmail.com Suggested-by: David Hildenbrand Signed-off-by: Usama Arif Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Arnd Bergmann Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Signed-off-by: Andrew Morton commit 7de854910bcb7aca917223caf9feec23035d4c26 Author: Usama Arif Date: Fri Aug 15 14:54:56 2025 +0100 docs: transhuge: document process level THP controls This includes the PR_SET_THP_DISABLE/PR_GET_THP_DISABLE pair of prctl calls as well the newly introduced PR_THP_DISABLE_EXCEPT_ADVISED flag for the PR_SET_THP_DISABLE prctl call. Link: https://lkml.kernel.org/r/20250815135549.130506-5-usamaarif642@gmail.com Signed-off-by: Usama Arif Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Arnd Bergmann Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Signed-off-by: Andrew Morton commit 8cdc4d27019356b0304308eb799484c899b62a87 Author: David Hildenbrand Date: Fri Aug 15 14:54:55 2025 +0100 mm/huge_memory: respect MADV_COLLAPSE with PR_THP_DISABLE_EXCEPT_ADVISED Let's allow for making MADV_COLLAPSE succeed on areas that neither have VM_HUGEPAGE nor VM_NOHUGEPAGE when we have THP disabled unless explicitly advised (PR_THP_DISABLE_EXCEPT_ADVISED). MADV_COLLAPSE is a clear advice that we want to collapse. Note that we still respect the VM_NOHUGEPAGE flag, just like MADV_COLLAPSE always does. So consequently, MADV_COLLAPSE is now only refused on VM_NOHUGEPAGE with PR_THP_DISABLE_EXCEPT_ADVISED, including for shmem. Link: https://lkml.kernel.org/r/20250815135549.130506-4-usamaarif642@gmail.com Co-developed-by: Usama Arif Signed-off-by: Usama Arif Signed-off-by: David Hildenbrand Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Arnd Bergmann Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Signed-off-by: Andrew Morton commit 1f1c061089dcd274befa0c76fb9f6e253a8368c0 Author: David Hildenbrand Date: Fri Aug 15 14:54:54 2025 +0100 mm/huge_memory: convert "tva_flags" to "enum tva_type" When determining which THP orders are eligible for a VMA mapping, we have previously specified tva_flags, however it turns out it is really not necessary to treat these as flags. Rather, we distinguish between distinct modes. The only case where we previously combined flags was with TVA_ENFORCE_SYSFS, but we can avoid this by observing that this is the default, except for MADV_COLLAPSE or an edge cases in collapse_pte_mapped_thp() and hugepage_vma_revalidate(), and adding a mode specifically for this case - TVA_FORCED_COLLAPSE. We have: * smaps handling for showing "THPeligible" * Pagefault handling * khugepaged handling * Forced collapse handling: primarily MADV_COLLAPSE, but also for an edge case in collapse_pte_mapped_thp() Disregarding the edge cases, we only want to ignore sysfs settings only when we are forcing a collapse through MADV_COLLAPSE, otherwise we want to enforce it, hence this patch does the following flag to enum conversions: * TVA_SMAPS | TVA_ENFORCE_SYSFS -> TVA_SMAPS * TVA_IN_PF | TVA_ENFORCE_SYSFS -> TVA_PAGEFAULT * TVA_ENFORCE_SYSFS -> TVA_KHUGEPAGED * 0 -> TVA_FORCED_COLLAPSE With this change, we immediately know if we are in the forced collapse case, which will be valuable next. Link: https://lkml.kernel.org/r/20250815135549.130506-3-usamaarif642@gmail.com Signed-off-by: David Hildenbrand Signed-off-by: Usama Arif Acked-by: Usama Arif Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Arnd Bergmann Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Signed-off-by: Andrew Morton commit 9dc21bbd62edeae6f63e6f25e1edb7167452457b Author: David Hildenbrand Date: Fri Aug 15 14:54:53 2025 +0100 prctl: extend PR_SET_THP_DISABLE to optionally exclude VM_HUGEPAGE Patch series "prctl: extend PR_SET_THP_DISABLE to only provide THPs when advised", v5. This will allow individual processes to opt-out of THP = "always" into THP = "madvise", without affecting other workloads on the system. This has been extensively discussed on the mailing list and has been summarized very well by David in the first patch which also includes the links to alternatives, please refer to the first patch commit message for the motivation for this series. Patch 1 adds the PR_THP_DISABLE_EXCEPT_ADVISED flag to implement this, along with the MMF changes. Patch 2 is a cleanup patch for tva_flags that will allow the forced collapse case to be transmitted to vma_thp_disabled (which is done in patch 3). Patch 4 adds documentation for PR_SET_THP_DISABLE/PR_GET_THP_DISABLE. Patches 6-7 implement the selftests for PR_SET_THP_DISABLE for completely disabling THPs (old behaviour) and only enabling it at advise (PR_THP_DISABLE_EXCEPT_ADVISED). This patch (of 7): People want to make use of more THPs, for example, moving from the "never" system policy to "madvise", or from "madvise" to "always". While this is great news for every THP desperately waiting to get allocated out there, apparently there are some workloads that require a bit of care during that transition: individual processes may need to opt-out from this behavior for various reasons, and this should be permitted without needing to make all other workloads on the system similarly opt-out. The following scenarios are imaginable: (1) Switch from "none" system policy to "madvise"/"always", but keep THPs disabled for selected workloads. (2) Stay at "none" system policy, but enable THPs for selected workloads, making only these workloads use the "madvise" or "always" policy. (3) Switch from "madvise" system policy to "always", but keep the "madvise" policy for selected workloads: allocate THPs only when advised. (4) Stay at "madvise" system policy, but enable THPs even when not advised for selected workloads -- "always" policy. Once can emulate (2) through (1), by setting the system policy to "madvise"/"always" while disabling THPs for all processes that don't want THPs. It requires configuring all workloads, but that is a user-space problem to sort out. (4) can be emulated through (3) in a similar way. Back when (1) was relevant in the past, as people started enabling THPs, we added PR_SET_THP_DISABLE, so relevant workloads that were not ready yet (i.e., used by Redis) were able to just disable THPs completely. Redis still implements the option to use this interface to disable THPs completely. With PR_SET_THP_DISABLE, we added a way to force-disable THPs for a workload -- a process, including fork+exec'ed process hierarchy. That essentially made us support (1): simply disable THPs for all workloads that are not ready for THPs yet, while still enabling THPs system-wide. The quest for handling (3) and (4) started, but current approaches (completely new prctl, options to set other policies per process, alternatives to prctl -- mctrl, cgroup handling) don't look particularly promising. Likely, the future will use bpf or something similar to implement better policies, in particular to also make better decisions about THP sizes to use, but this will certainly take a while as that work just started. Long story short: a simple enable/disable is not really suitable for the future, so we're not willing to add completely new toggles. While we could emulate (3)+(4) through (1)+(2) by simply disabling THPs completely for these processes, this is a step backwards, because these processes can no longer allocate THPs in regions where THPs were explicitly advised: regions flagged as VM_HUGEPAGE. Apparently, that imposes a problem for relevant workloads, because "not THPs" is certainly worse than "THPs only when advised". Could we simply relax PR_SET_THP_DISABLE, to "disable THPs unless not explicitly advised by the app through MAD_HUGEPAGE"? *maybe*, but this would change the documented semantics quite a bit, and the versatility to use it for debugging purposes, so I am not 100% sure that is what we want -- although it would certainly be much easier. So instead, as an easy way forward for (3) and (4), add an option to make PR_SET_THP_DISABLE disable *less* THPs for a process. In essence, this patch: (A) Adds PR_THP_DISABLE_EXCEPT_ADVISED, to be used as a flag in arg3 of prctl(PR_SET_THP_DISABLE) when disabling THPs (arg2 != 0). prctl(PR_SET_THP_DISABLE, 1, PR_THP_DISABLE_EXCEPT_ADVISED). (B) Makes prctl(PR_GET_THP_DISABLE) return 3 if PR_THP_DISABLE_EXCEPT_ADVISED was set while disabling. Previously, it would return 1 if THPs were disabled completely. Now it returns the set flags as well: 3 if PR_THP_DISABLE_EXCEPT_ADVISED was set. (C) Renames MMF_DISABLE_THP to MMF_DISABLE_THP_COMPLETELY, to express the semantics clearly. Fortunately, there are only two instances outside of prctl() code. (D) Adds MMF_DISABLE_THP_EXCEPT_ADVISED to express "no THP except for VMAs with VM_HUGEPAGE" -- essentially "thp=madvise" behavior Fortunately, we only have to extend vma_thp_disabled(). (E) Indicates "THP_enabled: 0" in /proc/pid/status only if THPs are disabled completely Only indicating that THPs are disabled when they are really disabled completely, not only partially. For now, we don't add another interface to obtained whether THPs are disabled partially (PR_THP_DISABLE_EXCEPT_ADVISED was set). If ever required, we could add a new entry. The documented semantics in the man page for PR_SET_THP_DISABLE "is inherited by a child created via fork(2) and is preserved across execve(2)" is maintained. This behavior, for example, allows for disabling THPs for a workload through the launching process (e.g., systemd where we fork() a helper process to then exec()). For now, MADV_COLLAPSE will *fail* in regions without VM_HUGEPAGE and VM_NOHUGEPAGE. As MADV_COLLAPSE is a clear advise that user space thinks a THP is a good idea, we'll enable that separately next (requiring a bit of cleanup first). There is currently not way to prevent that a process will not issue PR_SET_THP_DISABLE itself to re-enable THP. There are not really known users for re-enabling it, and it's against the purpose of the original interface. So if ever required, we could investigate just forbidding to re-enable them, or make this somehow configurable. Link: https://lkml.kernel.org/r/20250815135549.130506-1-usamaarif642@gmail.com Link: https://lkml.kernel.org/r/20250815135549.130506-2-usamaarif642@gmail.com Acked-by: Zi Yan Acked-by: Usama Arif Tested-by: Usama Arif Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Signed-off-by: Usama Arif Cc: Arnd Bergmann Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yafang Signed-off-by: Andrew Morton commit e338d83531540c6cda4bdc8de52aaae186d8a97c Author: Roman Gushchin Date: Fri Aug 15 11:32:24 2025 -0700 mm: readahead: improve mmap_miss heuristic for concurrent faults If two or more threads of an application faulting on the same folio, the mmap_miss counter can be decreased multiple times. It breaks the mmap_miss heuristic and keeps the readahead enabled even under extreme levels of memory pressure. It happens often if file folios backing a multi-threaded application are getting evicted and re-faulted. Fix it by skipping decreasing mmap_miss if the folio is locked. This change was evaluated on several hundred thousands hosts in Google's production over a couple of weeks. The number of containers being stuck in a vicious reclaim cycle for a long time was reduced several fold (~10-20x), as well as the overall fleet-wide cpu time spent in direct memory reclaim was meaningfully reduced. No regressions were observed. Link: https://lkml.kernel.org/r/20250815183224.62007-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Reviewed-by: Jan Kara Cc: David Hildenbrand Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 19de1e5d11d142d50c80cad1aa9916f25a36ab0d Author: Aboorva Devarajan Date: Sat Aug 16 09:31:13 2025 +0530 selftests/mm: skip hugepage-mremap test if userfaultfd unavailable Gracefully skip test if userfaultfd is not supported (ENOSYS) or not permitted (EPERM), instead of failing. This avoids misleading failures with clear skip messages. -------------- Before Patch -------------- ~ running ./hugepage-mremap ... ~ Bail out! userfaultfd: Function not implemented ~ Planned tests != run tests (1 != 0) ~ Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 ~ [FAIL] not ok 4 hugepage-mremap # exit=1 -------------- After Patch -------------- ~ running ./hugepage-mremap ... ~ ok 2 # SKIP userfaultfd is not supported/not enabled. ~ 1 skipped test(s) detected. ~ Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0 ~ [SKIP] ok 4 hugepage-mremap # SKIP Link: https://lkml.kernel.org/r/20250816040113.760010-8-aboorvad@linux.ibm.com Co-developed-by: Donet Tom Signed-off-by: Donet Tom Signed-off-by: Aboorva Devarajan Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit e36215431ce2e381bd3ff0bf2d16d1fe5792ddba Author: Aboorva Devarajan Date: Sat Aug 16 09:31:12 2025 +0530 selftests/mm: skip thuge-gen test if system is not setup properly Make thuge-gen skip instead of fail when it can't run due to system settings. If shmmax is too small or no 1G huge pages are available, the test now prints a warning and is marked as skipped. ------------------- Before Patch: ------------------- ~ running ./thuge-gen ~ Bail out! Please do echo 262144 > /proc/sys/kernel/shmmax ~ Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 ~ [FAIL] not ok 28 thuge-gen ~ exit=1 ------------------- After Patch: ------------------- ~ running ./thuge-gen ~ ~ WARNING: shmmax is too small to run this test. ~ ~ Please run the following command to increase shmmax: ~ ~ echo 262144 > /proc/sys/kernel/shmmax ~ 1..0 ~ SKIP Test skipped due to insufficient shmmax value. ~ [SKIP] ok 29 thuge-gen ~ SKIP Link: https://lkml.kernel.org/r/20250816040113.760010-7-aboorvad@linux.ibm.com Co-developed-by: Donet Tom Signed-off-by: Donet Tom Signed-off-by: Aboorva Devarajan Reviewed-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit 2d941088f4570f50df8a079b3ca25c392226fb38 Author: Aboorva Devarajan Date: Sat Aug 16 09:31:11 2025 +0530 selftests/mm: fix child process exit codes in ksm_functional_tests In ksm_functional_tests, test_child_ksm() returned negative values to indicate errors. However, when passed to exit(), these were interpreted as large unsigned values (e.g, -2 became 254), leading to incorrect handling in the parent process. As a result, some tests appeared to be skipped or silently failed. This patch changes test_child_ksm() to return positive error codes (1, 2, 3) and updates test_child_ksm_err() to interpret them correctly. Additionally, test_prctl_fork_exec() now uses exit(4) after a failed execv() to clearly signal exec failures. This ensures the parent accurately detects and reports child process failures. -------------- Before patch: -------------- - [RUN] test_unmerge ok 1 Pages were unmerged ... - [RUN] test_prctl_fork - No pages got merged - [RUN] test_prctl_fork_exec ok 7 PR_SET_MEMORY_MERGE value is inherited ... Bail out! 1 out of 8 tests failed - Planned tests != run tests (9 != 8) - Totals: pass:7 fail:1 xfail:0 xpass:0 skip:0 error:0 -------------- After patch: -------------- - [RUN] test_unmerge ok 1 Pages were unmerged ... - [RUN] test_prctl_fork - No pages got merged not ok 7 Merge in child failed - [RUN] test_prctl_fork_exec ok 8 PR_SET_MEMORY_MERGE value is inherited ... Bail out! 2 out of 9 tests failed - Totals: pass:7 fail:2 xfail:0 xpass:0 skip:0 error:0 Link: https://lkml.kernel.org/r/20250816040113.760010-6-aboorvad@linux.ibm.com Fixes: 6c47de3be3a0 ("selftest/mm: ksm_functional_tests: extend test case for ksm fork/exec") Co-developed-by: Donet Tom Signed-off-by: Donet Tom Signed-off-by: Aboorva Devarajan Acked-by: David Hildenbrand Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Cc: Zi Yan Signed-off-by: Andrew Morton commit 7bc857ddeeaa35a059f6e645365526e10e1f3511 Author: Donet Tom Date: Sat Aug 16 09:31:10 2025 +0530 mm/selftests: fix split_huge_page_test failure on systems with 64KB page size The split_huge_page_test fails on systems with a 64KB base page size. This is because the order of a 2MB huge page is different: On 64KB systems, the order is 5. On 4KB systems, it's 9. The test currently assumes a maximum huge page order of 9, which is only valid for 4KB base page systems. On systems with 64KB pages, attempting to split huge pages beyond their actual order (5) causes the test to fail. In this patch, we calculate the huge page order based on the system's base page size. With this change, the tests now run successfully on both 64KB and 4KB page size systems. Link: https://lkml.kernel.org/r/20250816040113.760010-5-aboorvad@linux.ibm.com Fixes: fa6c02315f74 ("mm: huge_memory: a new debugfs interface for splitting THP tests") Co-developed-by: Aboorva Devarajan Signed-off-by: Aboorva Devarajan Signed-off-by: Donet Tom Reviewed-by: Dev Jain Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit 08c907c5bc0ae8c9f0741c9622366ed30a1f6232 Author: Donet Tom Date: Sat Aug 16 09:31:09 2025 +0530 selftest/mm: fix ksm_funtional_test failures This patch fixes 2 issues. 1) After fork() in test_prctl_fork, the child process uses the file descriptors from the parent process to read ksm_stat and ksm_merging_pages. This results in incorrect values being read (parent process ksm_stat and ksm_merging_pages will be read in child), causing the test to fail. This patch calls init_global_file_handles() in the child process to ensure that the current process's file descriptors are used to read ksm_stat and ksm_merging_pages. 2) All tests currently call ksm_merge to trigger page merging. To ensure the system remains in a consistent state for subsequent tests, it is better to call ksm_unmerge during the test cleanup phase In the test_prctl_fork test, after a fork(), reading ksm_merging_pages in the child process returns a non-zero value because a previous test performed a merge, and the child's memory state is inherited from the parent. Although the child process calls ksm_unmerge, the ksm_merging_pages counter in the parent is reset to zero, while the child's counter remains unchanged. This discrepancy causes the test to fail. To avoid this issue, each test should call ksm_unmerge during cleanup to ensure the counter is reset and the system is in a clean state for subsequent tests. execv argument is an array of pointers to null-terminated strings. In this patch we also added NULL in the execv argument. Link: https://lkml.kernel.org/r/20250816040113.760010-4-aboorvad@linux.ibm.com Fixes: 6c47de3be3a0 ("selftest/mm: ksm_functional_tests: extend test case for ksm fork/exec") Co-developed-by: Aboorva Devarajan Signed-off-by: Aboorva Devarajan Signed-off-by: Donet Tom Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Cc: Zi Yan Signed-off-by: Andrew Morton commit 0ef3783d7558de874570696b681fcbb173f42e81 Author: Donet Tom Date: Sat Aug 16 09:31:08 2025 +0530 selftests/mm: add support to test 4PB VA on PPC64 PowerPC64 supports a 4PB virtual address space, but this test was previously limited to 512TB. This patch extends the coverage up to the full 4PB VA range on PowerPC64. Memory from 0 to 128TB is allocated without an address hint, while allocations from 128TB to 4PB use a hint address. Link: https://lkml.kernel.org/r/20250816040113.760010-3-aboorvad@linux.ibm.com Co-developed-by: Aboorva Devarajan Signed-off-by: Aboorva Devarajan Signed-off-by: Donet Tom Reviewed-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit eda0bf339b41a948af745e0b17db56037813c04f Author: Donet Tom Date: Sat Aug 16 09:31:07 2025 +0530 mm/selftests: fix incorrect pointer being passed to mark_range() Patch series "selftests/mm: Fix false positives and skip unsupported tests", v4. This patch series addresses false positives in the generic mm selftests and skips tests that cannot run correctly due to missing features or system limitations. This patch (of 7): In main(), the high address is stored in hptr, but for mark_range(), the address passed is ptr, not hptr. Fixed this by changing ptr[i] to hptr[i] in mark_range() function call. Link: https://lkml.kernel.org/r/20250816040113.760010-1-aboorvad@linux.ibm.com Link: https://lkml.kernel.org/r/20250816040113.760010-2-aboorvad@linux.ibm.com Fixes: b2a79f62133a ("selftests/mm: virtual_address_range: unmap chunks after validation") Co-developed-by: Aboorva Devarajan Signed-off-by: Aboorva Devarajan Signed-off-by: Donet Tom Reviewed-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5922deb3ecc0e3c6027e4779e00d2505ebeba9df Author: Ye Liu Date: Thu Aug 14 15:18:28 2025 +0800 mm/page_alloc: remove redundant pcp->free_count initialization in per_cpu_pages_init() In per_cpu_pages_init(), pcp->free_count is explicitly initialized to 0, but this is redundant because the entire struct is already zeroed by memset(pcp, 0, sizeof(*pcp)). Link: https://lkml.kernel.org/r/20250814071828.12036-1-ye.liu@linux.dev Signed-off-by: Ye Liu Reviewed-by: Brendan Jackman Acked-by: Johannes Weiner Reviewed-by: Zi Yan Signed-off-by: Andrew Morton commit e4fe1388dfbdd9641331071cd9b4a9efa16da34d Author: Ye Liu Date: Thu Aug 14 15:37:59 2025 +0800 mm: fix typos in VMA comments Fix the following typos in VMA-related files: 1. "operationr" -> "operation" in mm/vma.h 2. "initialisaing" -> "initializing" in mm/vma_init.c Link: https://lkml.kernel.org/r/20250814073800.13617-1-ye.liu@linux.dev Signed-off-by: Ye Liu Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 0c04015d45e6f102e14bde69b05a0a0591923248 Author: Ye Liu Date: Thu Aug 14 17:00:52 2025 +0800 mm/page_alloc: simplify lowmem_reserve max calculation Use max() to find the maximum lowmem_reserve value and min_t() to cap it to managed_pages in calculate_totalreserve_pages(), instead of open-coding the comparisons. No functional change. [liuye@kylinos.cn: fix layout, use min_t] Link: https://lkml.kernel.org/r/20250815024509.37900-1-ye.liu@linux.dev Link: https://lkml.kernel.org/r/20250814090053.22241-1-ye.liu@linux.dev Signed-off-by: Ye Liu Acked-by: Johannes Weiner Acked-by: Zi Yan Reviewed-by: Wei Yang Cc: Brendan Jackman Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a3f451ad33791d56455c5434c5c30b427e147be8 Author: Enze Li Date: Thu Aug 14 20:54:16 2025 +0800 selftests/damon/access_memory_even: remove unused header file Since the time.h header file is not actually needed in this code, we can safely remove its inclusion. Link: https://lkml.kernel.org/r/20250814125417.659937-1-lienze@kylinos.cn Signed-off-by: Enze Li Reviewed-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6a204d4b14c99232e05d35305c27ebce1c009840 Author: Thadeu Lima de Souza Cascardo Date: Thu Aug 14 14:22:45 2025 -0300 mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations Commit 524c48072e56 ("mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE") is the start of a series that explains how __GFP_HIGH, which implies ALLOC_MIN_RESERVE, is going to be used instead of __GFP_ATOMIC for high atomic reserves. Commit eb2e2b425c69 ("mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags") introduced ALLOC_HIGHATOMIC for such allocations of order higher than 0. It still used __GFP_ATOMIC, though. Then, commit 1ebbb21811b7 ("mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves") just turned that check for !__GFP_DIRECT_RECLAIM, ignoring that high atomic reserves were expected to test for __GFP_HIGH. This leads to high atomic reserves being added for high-order GFP_NOWAIT allocations and others that clear __GFP_DIRECT_RECLAIM, which is unexpected. Later, those reserves lead to 0-order allocations going to the slow path and starting reclaim. From /proc/pagetypeinfo, without the patch: Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 1 8 10 9 7 3 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 64 20 12 5 0 0 0 0 0 0 0 With the patch: Node 0, zone DMA, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone DMA32, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Node 0, zone Normal, type HighAtomic 0 0 0 0 0 0 0 0 0 0 0 Link: https://lkml.kernel.org/r/20250814172245.1259625-1-cascardo@igalia.com Fixes: 1ebbb21811b7 ("mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves") Signed-off-by: Thadeu Lima de Souza Cascardo Tested-by: Helen Koike Reviewed-by: Vlastimil Babka Tested-by: Sergey Senozhatsky Acked-by: Michal Hocko Cc: Mel Gorman Cc: Matthew Wilcox Cc: NeilBrown Cc: Thierry Reding Cc: Brendan Jackman Cc: Johannes Weiner Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 668208b161a0b679427e7d0f34c0a65fd7d23979 Author: Alexandre Ghiti Date: Thu Aug 14 12:06:14 2025 +0000 riscv: use an atomic xchg in pudp_huge_get_and_clear() Make sure we return the right pud value and not a value that could have been overwritten in between by a different core. Link: https://lkml.kernel.org/r/20250814-dev-alex-thp_pud_xchg-v1-1-b4704dfae206@rivosinc.com Fixes: c3cc2a4a3a23 ("riscv: Add support for PUD THP") Signed-off-by: Alexandre Ghiti Cc: Andrew Donnellan Cc: Signed-off-by: Andrew Morton commit 0ee82798282aeede8b11553593f7920b15b2240f Author: Liao Yuanhong Date: Wed Aug 13 17:45:43 2025 +0800 lib/test_maple_tree.c: remove redundant semicolons Remove unnecessary semicolons. Link: https://lkml.kernel.org/r/20250813094543.555906-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Reviewed-by: Dev Jain Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit ec45783fce52f358c9e8680d2837bc0d477f16ad Author: Thomas Gleixner Date: Wed Aug 13 16:57:55 2025 +0200 memcg: optimize exit to user space memcg uses TIF_NOTIFY_RESUME to handle reclaiming on exit to user space. TIF_NOTIFY_RESUME is a multiplexing TIF bit, which is utilized by other entities as well. This results in a unconditional mem_cgroup_handle_over_high() call for every invocation of resume_user_mode_work(), which is a pointless exercise as most of the time there is no reclaim work to do. Especially since RSEQ is used by glibc, TIF_NOTIFY_RESUME is raised quite frequently and the empty calls show up in exit path profiling. Optimize this by doing a quick check of the reclaim condition before invoking it. [akpm@linux-foundation.org: remove now-unneeded test of memcg_nr_pages_over_high==0, per Shakeel] Link: https://lkml.kernel.org/r/87tt2b6zgs.ffs@tglx Signed-off-by: Thomas Gleixner Reviewed-by: Roman Gushchin Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 868ade323e9deff67b8be3e93876596e4d2c71d3 Author: Hui Zhu Date: Thu Jul 31 10:50:05 2025 +0800 rust: allocator: add KUnit tests for alignment guarantees Add a test module to verify memory alignment guarantees for Rust kernel allocators. The tests cover `Kmalloc`, `Vmalloc` and `KVmalloc` allocators with both standard and large page-aligned allocations. Key features of the tests: 1. Creates alignment-constrained types: - 128-byte aligned `Blob` - 8192-byte (4-page) aligned `LargeAlignBlob` 2. Validates allocators using `TestAlign` helper which: - Checks address alignment masks - Supports uninitialized allocations 3. Tests all three allocators with both alignment requirements: - Kmalloc with 128B and 8192B - Vmalloc with 128B and 8192B - KVmalloc with 128B and 8192B Link: https://lkml.kernel.org/r/d2e3d6454c1435713be0fe3c0dc444d2c60bba51.1753929369.git.zhuhui@kylinos.cn Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Hui Zhu Reviewed-by: Kunwu Chan Acked-by: Danilo Krummrich Cc: Alex Gaynor Cc: Alice Ryhl Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Gary Guo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Cc: "Uladzislau Rezki (Sony)" Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 50944692052b1e76fd211f4da0798ab19d7fc276 Author: Lokesh Gidra Date: Wed Aug 13 12:30:24 2025 -0700 userfaultfd: opportunistic TLB-flush batching for present pages in MOVE MOVE ioctl's runtime is dominated by TLB-flush cost, which is required for moving present pages. Mitigate this cost by opportunistically batching present contiguous pages for TLB flushing. Without batching, in our testing on an arm64 Android device with UFFD GC, which uses MOVE ioctl for compaction, we observed that out of the total time spent in move_pages_pte(), over 40% is in ptep_clear_flush(), and ~20% in vm_normal_folio(). With batching, the proportion of vm_normal_folio() increases to over 70% of move_pages_pte() without any changes to vm_normal_folio(). Furthermore, time spent within move_pages_pte() is only ~20%, which includes TLB-flush overhead. When the GC intensive benchmark, which was used to gather the above numbers, is run on cuttlefish (qemu android instance on x86_64), the completion time of the benchmark went down from ~45mins to ~20mins. Furthermore, system_server, one of the most performance critical system processes on android, saw over 50% reduction in GC compaction time on an arm64 android device. [lokeshgidra@google.com: make calculation of largest extent that can be batched unconditional on length, per Barry] Link: https://lkml.kernel.org/r/20250816191123.3601561-1-lokeshgidra@google.com Link: https://lkml.kernel.org/r/20250813193024.2279805-1-lokeshgidra@google.com Signed-off-by: Lokesh Gidra Acked-by: Peter Xu Reviewed-by: Barry Song Cc: Suren Baghdasaryan Cc: Kalesh Singh Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 85b8cec15034e07500a6e5b8a5aea8185a3d775a Author: Chris Li Date: Tue Aug 12 00:10:59 2025 -0700 mm: swap.h: Remove deleted field from comments The comment for struct swap_info_struct.lock incorrectly mentions fields that have already been deleted from the structure. Update the comments to accurately reflect the current struct swap_info_struct. There is no functional change. Link: https://lkml.kernel.org/r/20250812-swap-scan-list-v3-2-6d73504d267b@kernel.org Signed-off-by: Chris Li Reviewed-by: Kairui Song Acked-by: Nhat Pham Reviewed-by: Barry Song Cc: Baoquan He Cc: "Huang, Ying" Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 348e474f18e12c5a27422d0ae3b4316b13dbe3c9 Author: Chris Li Date: Tue Aug 12 00:10:58 2025 -0700 mm/swapfile.c: introduce function alloc_swap_scan_list() Patch series "mm/swapfile.c and swap.h cleanup", v3. This patch series, which builds on Kairui's swap improve cluster scan series. https://lore.kernel.org/linux-mm/20250806161748.76651-1-ryncsn@gmail.com/ It introduces a new function, alloc_swap_scan_list(), for swapfile.c. It also cleans up swap.h by removing comments that reference fields that have been deleted. There are no functional changes in this two-patch series. This patch (of 2): alloc_swap_scan_list() will scan the whole list or the first cluster. This reduces the repeat patterns of isolating a cluster then scanning that cluster. As a result, cluster_alloc_swap_entry() is shorter and shallower. No functional change. Link: https://lkml.kernel.org/r/20250812-swap-scan-list-v3-0-6d73504d267b@kernel.org Link: https://lkml.kernel.org/r/20250812-swap-scan-list-v3-1-6d73504d267b@kernel.org Signed-off-by: Chris Li Reviewed-by: Kairui Song Acked-by: Nhat Pham Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 9d246d7410c9c4187e37cc3bfd1284d06b697566 Author: Alexandre Ghiti Date: Tue Aug 12 08:12:11 2025 +0000 selftests/damon: fix damon selftests by installing _common.sh _common.sh was recently introduced but is not installed and then triggers an error when trying to run the damon selftests: selftests: damon: sysfs.sh ./sysfs.sh: line 4: _common.sh: No such file or directory Install this file to avoid this error. Link: https://lkml.kernel.org/r/20250812-alex-fixes_manual-v1-1-c4e99b1f80e4@rivosinc.com Fixes: 511914506d19 ("selftests/damon: introduce _common.sh to host shared function") Signed-off-by: Alexandre Ghiti Tested-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Tested-by: Enze Li Cc: Shuah Khan Signed-off-by: Andrew Morton commit 0f9ab62a6e44ef51ea3e7f1c552b447cf4eb20ae Author: Christoph Hellwig Date: Tue Aug 12 10:30:08 2025 +0200 mempool: rename struct mempool_s to struct mempool Drop the pointless _s prefix and align to the usual struct naming to prepare for actually using the struct instead of the typedef so that random headers don't need to include mempool.h for just having a pointer to the mempool. Link: https://lkml.kernel.org/r/20250812083105.371295-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: Roman Gushchin Signed-off-by: Andrew Morton commit dca4437a5861abf197f1ee934d4db251328d0ed6 Author: SeongJae Park Date: Tue Aug 19 12:34:04 2025 -0700 mm/zswap: store length == PAGE_SIZE'. Because the uncompressed data is saved in zpool, same to the compressed ones, this introduces no change in terms of memory management including movability and migratability of involved pages. This change is also not increasing per zswap entry metadata overhead. But as the number of incompressible pages increases, total zswap metadata overhead is proportionally increased. The overhead should not be problematic in usual cases, since the zswap metadata for single zswap entry is much smaller than PAGE_SIZE, and in common zswap use cases there should be a sufficient amount of compressible pages. Also it can be mitigated by the zswap writeback. When the writeback is disabled, the additional overhead could be problematic. For the case, keep the current behavior that just returns the failure and let swap_writeout() put the page back to the active LRU list in the case. Knowing how many incompressible pages are stored at the given moment will be useful for future investigations. Add a new debugfs file called stored_incompressible_pages for the purpose. Tests ----- I tested this patch using a simple self-written microbenchmark that is available at GitHub[1]. You can reproduce the test I did by executing run_tests.sh of the repo on your system. Note that the repo's documentation is not good as of this writing, so you may need to read and use the code. The basic test scenario is simple. Run a test program making artificial accesses to memory having artificial content under memory.high-set memory limit and measure how many accesses were made in a given time. The test program repeatedly and randomly access three anonymous memory regions. The regions are all 500 MiB size, and be accessed in the same probability. Two of those are filled up with a simple content that can easily be compressed, while the remaining one is filled up with a content that s read from /dev/urandom, which is easy to fail at compressing to a size smaller than PAGE_SIZE. The program runs for two minutes and prints out the number of accesses made every five seconds. The test script runs the program under below four configurations. - 0: memory.high is set to 2 GiB, zswap is disabled. - 1-1: memory.high is set to 1350 MiB, zswap is disabled. - 1-2: On 1-1, zswap is enabled without this patch. - 1-3: On 1-2, this patch is applied. For all zswap enabled cases, zswap shrinker is enabled. Configuration '0' is for showing the original memory performance. Configurations 1-1, 1-2 and 1-3 are for showing the performance of swap, zswap, and this patch under a level of memory pressure (~10% of working set). Configurations 0 and 1-1 are not the main focus of this patch, but I'm adding those since their results transparently show how far this microbenchmark test is from the real world. Because the per-5 seconds performance is not very reliable, I measured the average of that for the last one minute period of the test program run. I also measured a few vmstat counters including zswpin, zswpout, zswpwb, pswpin and pswpout during the test runs. The measurement results are as below. To save space, I show performance numbers that are normalized to that of the configuration '0' (no memory pressure). The averaged accesses per 5 seconds of configuration '0' was 36493417.75. config 0 1-1 1-2 1-3 perf_normalized 1.0000 0.0057 0.0235 0.0367 perf_stdev_ratio 0.0582 0.0652 0.0167 0.0346 zswpin 0 0 3548424 1999335 zswpout 0 0 3588817 2361689 zswpwb 0 0 10214 340270 pswpin 0 485806 772038 340967 pswpout 0 649543 144773 340270 'perf_normalized' is the performance metric, normalized to that of configuration '0' (no pressure). 'perf_stdev_ratio' is the standard deviation of the averaged data points, as a ratio to the averaged metric value. For example, configuration '0' performance was showing 5.8% stdev. Configurations 1-1 and 1-3 were having about 6.5% and 6.1% stdev. Also the results were highly variable between multiple runs. So this result is not very stable but just showing ball park figures. Please keep this in your mind when reading these results. Under about 10% of working set memory pressure, the performance was dropped to about 0.57% of no-pressure one, when the normal swap is used (1-1). Note that ~10% working set pressure is already extreme, at least on this test setup. No one would desire system setups that can degrade performance to 0.57% of the best case. By turning zswap on (1-2), the performance was improved about 4x, resulting in about 2.35% of no-pressure one. Because of the incompressible pages in the third memory region, a significant amount of (non-zswap) swap I/O operations were made, though. By applying this patch (1-3), about 56% performance improvement was made, resulting in about 3.67% of no-pressure one. Reduced pswpin of 1-3 compared to 1-2 let us see where this improvement came from. Tests without Zswap Shrinker ---------------------------- Zswap shrinker is not enabled by default, so I ran the above test after disabling zswap shrinker. The results are as below. config 0 1-1 1-2 1-3 perf_normalized 1.0000 0.0056 0.0185 0.0260 perf_stdev_ratio 0.0467 0.0348 0.1832 0.3387 zswpin 0 0 2506765 6049078 zswpout 0 0 2534357 6115426 zswpwb 0 0 0 0 pswpin 0 463694 472978 0 pswpout 0 686227 612149 0 The overall normalized performance of the different configs are very similar to those of zswap shrinker enabled case. By adding the memory pressure, the performance was dropped to 0.56% of the original one. By enabling zswap without zswap shrinker, the performance was increased to 1.85% of the original one. By applying this patch on it, the performance was further increased to 2.6% of the original one. Even though zswap shrinker is disabled, 1-2 shows high numbers of pswpin and pswpout because the incompressible pages are directly swapped out. In the case of 1-3, it shows zero pswpin and pswpout since it saves incompressible pages in the memory, and shows higher performance. Note that the performance of 1-2 and 1-3 varies pretty much. Standard deviation of the performance for 1-2 was about 18.32% of the performance, while that for 1-3 was about 33.87%. Because zswap shrinker is disabled and the memory pressure is induced by memory.high, the workload got penalty_jiffies sleeps, and this resulted in the unstabilized performance. Related Works ------------- This is not an entirely new attempt. Nhat Pham and Takero Funaki tried very similar approaches in October 2023[2] and April 2024[3], respectively. The two approaches didn't get merged mainly due to the metadata overhead concern. I described why I think that shouldn't be a problem for this change, which is automatically disabled when writeback is disabled, at the beginning of this changelog. This patch is not particularly different from those, and actually built upon those. I wrote this from scratch again, though. Hence adding Suggested-by tags for them. Actually Nhat first suggested this to me offlist. Historically, writeback disabling was introduced partially as a way to solve the LRU order issue. Yosry pointed out[4] this is still suboptimal when the incompressible pages are cold, since the incompressible pages will continuously be tried to be zswapped out, and burn CPU cycles for compression attempts that will anyway fail. One imaginable solution for the problem is reusing the swapped-out page and its struct page to store in the zswap pool. But that's out of the scope of this patch. [sj@kernel.org: mark zswap_stored_incompressible_pages as static] Link: https://lkml.kernel.org/r/20250821161750.78192-1-sj@kernel.org [sj@kernel.org: v5] Link: https://lkml.kernel.org/r/20250822190817.49287-1-sj@kernel.org [sj@kernel.org: cleanup incompressible pages handling code] Link: https://lkml.kernel.org/r/20250828163913.57957-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250819193404.46680-1-sj@kernel.org Link: https://github.com/sjp38/eval_zswap/blob/master/run.sh [1] Link: https://lore.kernel.org/20231017003519.1426574-3-nphamcs@gmail.com [2] Link: https://lore.kernel.org/20240706022523.1104080-6-flintglass@gmail.com [3] Link: https://lore.kernel.org/CAJD7tkZXS-UJVAFfvxJ0nNgTzWBiqepPYA4hEozi01_qktkitg@mail.gmail.com [4] Signed-off-by: SeongJae Park Suggested-by: Nhat Pham Suggested-by: Takero Funaki Acked-by: Nhat Pham Acked-by: Chris Li Cc: Chengming Zhou Cc: David Hildenbrand Cc: Johannes Weiner Cc: SeongJae Park Cc: Baoquan He Cc: Barry Song Cc: Kairui Song Cc: Herbert Xu Signed-off-by: Andrew Morton commit 53c225ffa72a63bbca8537a3357c8baec122b9a6 Author: Colin Ian King Date: Wed Aug 13 09:13:33 2025 +0100 selftests/mm: fix spelling mistake "mrmeap" -> "mremap" There are spelling mistakes in perror messages. Fix these. Link: https://lkml.kernel.org/r/20250813081333.1978096-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit adf085ff0d6fde54015bfca1ce6e4ce392828ba9 Author: Qianfeng Rong Date: Tue Aug 12 21:52:25 2025 +0800 mm: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Link: https://lkml.kernel.org/r/20250812135225.274316-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Reviewed-by: Harry Yoo Reviewed-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Vishal Moola (Oracle) Reviewed-by: SeongJae Park Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 8166353fb8841390bf3ffe1b923a5ddeb348e4f7 Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:19 2025 +0100 mm: replace mm->flags with bitmap entirely and set to 64 bits Now we have updated all users of mm->flags to use the bitmap accessors, repalce it with the bitmap version entirely. We are then able to move to having 64 bits of mm->flags on both 32-bit and 64-bit architectures. We also update the VMA userland tests to ensure that everything remains functional there. No functional changes intended, other than there now being 64 bits of available mm_struct flags. Link: https://lkml.kernel.org/r/e1f6654e016d36c43959764b01355736c5cbcdf8.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit d14d3f535e13ff0661b9a74133a8d6b9f9950712 Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:18 2025 +0100 mm: convert remaining users to mm_flags_*() accessors As part of the effort to move to mm->flags becoming a bitmap field, convert existing users to making use of the mm_flags_*() accessors which will, when the conversion is complete, be the only means of accessing mm_struct flags. No functional change intended. Link: https://lkml.kernel.org/r/cc67a56f9a8746a8ec7d9791853dc892c1c33e0b.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 19148a19da86f1b7d1a1b067c9f656b0f3a60fb1 Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:17 2025 +0100 mm: update fork mm->flags initialisation to use bitmap We now need to account for flag initialisation on fork. We retain the existing logic as much as we can, but dub the existing flag mask legacy. These flags are therefore required to fit in the first 32-bits of the flags field. However, further flag propagation upon fork can be implemented in mm_init() on a per-flag basis. We ensure we clear the entire bitmap prior to setting it, and use __mm_flags_get_word() and __mm_flags_set_word() to manipulate these legacy fields efficiently. Link: https://lkml.kernel.org/r/9fb8954a7a0f0184f012a8e66f8565bcbab014ba.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 01f86753a05a3b971d69147d6d074c1a8d29b57d Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:16 2025 +0100 mm: correct sign-extension issue in MMF_* flag masks There is an issue with the mask declarations in linux/mm_types.h, which naively do (1 << bit) operations. Unfortunately this results in the 1 being defaulted as a signed (32-bit) integer. When the compiler expands the MMF_INIT_MASK bitmask it comes up with: (((1 << 2) - 1) | (((1 << 9) - 1) << 2) | (1 << 24) | (1 << 28) | (1 << 30) | (1 << 31)) Which overflows the signed integer to -788,527,105. Implicitly casting this to an unsigned integer results in sign-expansion, and thus this value becomes 0xffffffffd10007ff, rather than the intended 0xd10007ff. While we're limited to a maximum of 32 bits in mm->flags, this isn't an issue as the remaining bits being masked will always be zero. However, now we are moving towards having more bits in this flag, this becomes an issue. Simply resolve this by using the _BITUL() helper to cast the shifted value to an unsigned long. [lorenzo.stoakes@oracle.com: prefer BIT() to _BITUL()] Link: https://lkml.kernel.org/r/a0290c77-cd88-46d6-8d9a-073be7600d88@lucifer.local Link: https://lkml.kernel.org/r/f92194bee8c92a04fd4c9b2c14c7e65229639300.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 39f8049cd49f7e88f89a33f97f996c7306e8be0b Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:15 2025 +0100 mm: update coredump logic to correctly use bitmap mm flags The coredump logic is slightly different from other users in that it both stores mm flags and additionally sets and gets using masks. Since the MMF_DUMPABLE_* flags must remain as they are for uABI reasons, and of course these are within the first 32-bits of the flags, it is reasonable to provide access to these in the same fashion so this logic can all still keep working as it has been. Therefore, introduce coredump-specific helpers __mm_flags_get_dumpable() and __mm_flags_set_mask_dumpable() for this purpose, and update all core dump users of mm flags to use these. [lorenzo.stoakes@oracle.com: abstract set_mask_bits() invocation to mm_types.h to satisfy ARC] Link: https://lkml.kernel.org/r/0e7ad263-1ff7-446d-81fe-97cff9c0e7ed@lucifer.local Link: https://lkml.kernel.org/r/2a5075f7e3c5b367d988178c79a3063d12ee53a9.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Christian Brauner Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit c0951573e0d6e39083ef7f39a2f0983ece8fb1a0 Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:14 2025 +0100 mm: convert uprobes to mm_flags_*() accessors As part of the effort to move to mm->flags becoming a bitmap field, convert existing users to making use of the mm_flags_*() accessors which will, when the conversion is complete, be the only means of accessing mm_struct flags. No functional change intended. Link: https://lkml.kernel.org/r/1d4fe5963904cc0c707da1f53fbfe6471d3eff10.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 4141c2dc88f21881e34e0a3678fa48f0303adc5e Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:13 2025 +0100 mm: convert arch-specific code to mm_flags_*() accessors As part of the effort to move to mm->flags becoming a bitmap field, convert existing users to making use of the mm_flags_*() accessors which will, when the conversion is complete, be the only means of accessing mm_struct flags. No functional change intended. [lorenzo.stoakes@oracle.com: fix typo] Link: https://lkml.kernel.org/r/f8ff8fe9-0c89-4742-bf52-d31319d948c1@lucifer.local Link: https://lkml.kernel.org/r/6e0a4563fcade8678d0fc99859b3998d4354e82f.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 879d0d99541f6877c4e0f532c589c39869cf7077 Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:12 2025 +0100 mm: convert prctl to mm_flags_*() accessors As part of the effort to move to mm->flags becoming a bitmap field, convert existing users to making use of the mm_flags_*() accessors which will, when the conversion is complete, be the only means of accessing mm_struct flags. No functional change intended. Link: https://lkml.kernel.org/r/b64f07b94822d02beb88d0d21a6a85f9ee45fc69.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 12e423ba4eaed7b1561b677d32e6599f932d03db Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:11 2025 +0100 mm: convert core mm to mm_flags_*() accessors As part of the effort to move to mm->flags becoming a bitmap field, convert existing users to making use of the mm_flags_*() accessors which will, when the conversion is complete, be the only means of accessing mm_struct flags. This will result in the debug output being that of a bitmap output, which will result in a minor change here, but since this is for debug only, this should have no bearing. Otherwise, no functional changes intended. [akpm@linux-foundation.org: fix typo in comment]Link: https://lkml.kernel.org/r/1eb2266f4408798a55bda00cb04545a3203aa572.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit bb6525f2f8c41e89ba3fc506bc1705c68cf845ae Author: Lorenzo Stoakes Date: Tue Aug 12 16:44:10 2025 +0100 mm: add bitmap mm->flags field Patch series "mm: make mm->flags a bitmap and 64-bit on all arches". We are currently in the bizarre situation where we are constrained on the number of flags we can set in an mm_struct based on whether this is a 32-bit or 64-bit kernel. This is because mm->flags is an unsigned long field, which is 32-bits on a 32-bit system and 64-bits on a 64-bit system. In order to keep things functional across both architectures, we do not permit mm flag bits to be set above flag 31 (i.e. the 32nd bit). This is a silly situation, especially given how profligate we are in storing metadata in mm_struct, so let's convert mm->flags into a bitmap and allow ourselves as many bits as we like. In order to execute this change, we introduce a new opaque type - mm_flags_t - which wraps a bitmap. We go further and mark the bitmap field __private, which forces users to have to use accessors, which allows us to enforce atomicity rules around mm->flags (except on those occasions they are not required - fork, etc.) and makes it far easier to keep track of how mm flags are being utilised. In order to implement this change sensibly and an an iterative way, we start by introducing the type with the same bitsize as the current mm flags (system word size) and place it in union with mm->flags. We are then able to gradually update users as we go without being forced to do everything in a single patch. In the course of working on this series I noticed the MMF_* flag masks encounter a sign extension bug that, due to the 32-bit limit on mm->flags thus far, has not caused any issues in practice, but required fixing for this series. We must make special dispensation for two cases - coredump and initailisation on fork, but of which use masks extensively. Since coredump flags are set in stone, we can safely assume they will remain in the first 32-bits of the flags. We therefore provide special non-atomic accessors for this case that access the first system word of flags, keeping everything there essentially the same. For mm->flags initialisation on fork, we adjust the logic to ensure all bits are cleared correctly, and then adjust the existing intialisation logic, dubbing the implementation utilising flags as legacy. This means we get the same fast operations as we do now, but in future we can also choose to update the forking logic to additionally propagate flags beyond 32-bits across fork. With this change in place we can, in future, decide to have as many bits as we please. Since the size of the bitmap will scale in system word multiples, there should be no issues with changes in alignment in mm_struct. Additionally, the really sensitive field (mmap_lock) is located prior to the flags field so this should have no impact on that either. This patch (of 10): We are currently in the bizarre situation where we are constrained on the number of flags we can set in an mm_struct based on whether this is a 32-bit or 64-bit kernel. This is because mm->flags is an unsigned long field, which is 32-bits on a 32-bit system and 64-bits on a 64-bit system. In order to keep things functional across both architectures, we do not permit mm flag bits to be set above flag 31 (i.e. the 32nd bit). This is a silly situation, especially given how profligate we are in storing metadata in mm_struct, so let's convert mm->flags into a bitmap and allow ourselves as many bits as we like. To keep things manageable, firstly we introduce the bitmap at a system word system as a new field mm->_flags, in union. This means the new bitmap mm->_flags is bitwise exactly identical to the existing mm->flags field. We have an opportunity to also introduce some type safety here, so let's wrap the mm flags field as a struct and declare it as an mm_flags_t typedef to keep it consistent with vm_flags_t for VMAs. We make the internal field privately accessible, in order to force the use of helper functions so we can enforce that accesses are bitwise as required. We therefore introduce accessors prefixed with mm_flags_*() for callers to use. We place the bit parameter first so as to match the parameter ordering of the *_bit() functions. Having this temporary union arrangement allows us to incrementally swap over users of mm->flags patch-by-patch rather than having to do everything in one fell swoop. [lorenzo.stoakes@oracle.com: place __private in correct place, const-ify __mm_flags_get_word] Link: https://lkml.kernel.org/r/d4ba117d-6234-4069-b871-254d152d7d21@lucifer.local Link: https://lkml.kernel.org/r/cover.1755012943.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/9de8dfd9de8c95cd31622d6e52051ba0d1848f5a.1755012943.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand Cc: Adrian Hunter Cc: Alexander Gordeev Cc: Alexander Shishkin Cc: Al Viro Cc: Andreas Larsson Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Baolin Wang Cc: Barry Song Cc: Ben Segall Cc: Borislav Betkov Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Rientjes Cc: David S. Miller Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gerald Schaefer Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ian Rogers Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: John Hubbard Cc: Juri Lelli Cc: Kan Liang Cc: Kees Cook Cc: Marc Rutland Cc: Mariano Pache Cc: "Masami Hiramatsu (Google)" Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Xu Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Gleinxer Cc: Valentin Schneider Cc: Vasily Gorbik Cc: Vincent Guittot Cc: Vlastimil Babka Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 4a12633e87abec277a9911614d4aee3ef66b9c4c Author: Wei Yang Date: Sat Aug 9 19:42:09 2025 +0000 selftests/mm: do check_huge_anon() with a number been passed in Currently it hard codes the number of hugepage to check for check_huge_anon(), but it would be more reasonable to do the check based on a number passed in. Pass in the hugepage number and do the check based on it. Link: https://lkml.kernel.org/r/20250809194209.30484-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed by: Donet Tom Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Vishal Moola (Oracle) Reviewed-by: wang lian Cc: Dev Jain Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 10725cd2b09afe512ff60df651b9dd0e11720801 Author: Sang-Heon Jeon Date: Sun Aug 10 21:43:54 2025 +0900 selftests/damon: test no-op commit broke DAMON status Add test to verify that DAMON status is not changed after a no-op commit. [ekffu200098@gmail.com: change wrong json.dump usage to json.dumps] Link: https://lkml.kernel.org/r/20250816014033.190451-1-ekffu200098@gmail.com Link: https://lkml.kernel.org/r/20250810124354.16456-1-ekffu200098@gmail.com Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Honggyu Kim Signed-off-by: Andrew Morton commit 801295be015fc53557a6ef221ab74df6950d1b80 Author: Mike Rapoport (Microsoft) Date: Mon Aug 11 11:25:10 2025 +0300 selftest/kho: update generation of initrd Use nolibc include directory rather than include a cumulative nolibc.h on the compiler command line and replace use of 'sudo cpio' with usr/gen_init_cpio. While on it fix spelling of KHO_FINALIZE Link: https://lkml.kernel.org/r/20250811082510.4154080-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Suggested-by: Thomas Weißschuh Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Pasha Tatashin Cc: Pratyush Yadav Cc: Shuah Khan Signed-off-by: Andrew Morton commit 950c31e8f1280c45697e9353e2d4973ff79312bf Author: Mike Rapoport (Microsoft) Date: Mon Aug 11 11:25:09 2025 +0300 lib/test_kho: fixes for error handling * Update kho_test_save() so that folios array won't be freed when returning from the function and the fdt will be freed on error * Reset state->nr_folios to 0 in kho_test_generate_data() on error * Simplify allocation of folios info in fdt. Link: https://lkml.kernel.org/r/20250811082510.4154080-3-rppt@kernel.org Fixes: b753522bed0b ("kho: add test for kexec handover") Signed-off-by: Mike Rapoport (Microsoft) Reported-by: Pratyush Yadav Closes: https://lore.kernel.org/all/mafs0zfcjcepf.fsf@kernel.org Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Pasha Tatashin Cc: Shuah Khan Cc: Thomas Weißschuh Signed-off-by: Andrew Morton commit be564840bbc2bdd803794a7c1a3b5195a901b0d4 Author: Mike Rapoport (Microsoft) Date: Mon Aug 11 11:25:08 2025 +0300 kho: allow scratch areas with zero size Patch series "kho: fixes and cleanups", v3. These are small KHO and KHO test fixes and cleanups. This patch (of 3): Parsing of kho_scratch parameter treats zero size as an invalid value, although it should be fine for user to request zero sized scratch area for some types if scratch memory, when for example there is no need to create scratch area in the low memory. Treat zero as a valid value for a scratch area size but reject kho_scratch parameter that defines no scratch memory at all. Link: https://lkml.kernel.org/r/20250811082510.4154080-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20250811082510.4154080-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Pasha Tatashin Cc: Shuah Khan Cc: Thomas Weißschuh Signed-off-by: Andrew Morton commit ea5e101fb6018486ae706b905665b2fe63f9c979 Author: Pankaj Raghav Date: Mon Aug 11 10:41:13 2025 +0200 block: use largest_zero_folio in __blkdev_issue_zero_pages() Use largest_zero_folio() in __blkdev_issue_zero_pages(). On systems with CONFIG_PERSISTENT_HUGE_ZERO_FOLIO enabled, we will end up sending larger bvecs instead of multiple small ones. Noticed a 4% increase in performance on a commercial NVMe SSD which does not support OP_WRITE_ZEROES. The device's MDTS was 128K. The performance gains might be bigger if the device supports bigger MDTS. Link: https://lkml.kernel.org/r/20250811084113.647267-6-kernel@pankajraghav.com Signed-off-by: Pankaj Raghav Acked-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Hannes Reinecke Cc: Kiryl Shutsemau Cc: Baolin Wang Cc: Christoph Hellwig Cc: "Darrick J. Wong" Cc: Dev Jain Cc: Jens Axboe Cc: Liam Howlett Cc: Luis Chamberalin Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 415a0fd62f1899fe2bb81d661e427194b1c97201 Author: Pankaj Raghav Date: Mon Aug 11 10:41:12 2025 +0200 mm: add largest_zero_folio() routine The callers of mm_get_huge_zero_folio() have access to a mm struct and the lifetime of the huge_zero_folio is tied to the lifetime of the mm struct. largest_zero_folio() will give access to huge_zero_folio when PERSISTENT_HUGE_ZERO_FOLIO config option is enabled for callers that do not want to tie the lifetime to a mm struct. This is very useful for filesystem and block layers where the request completions can be async and there is no guarantee on the mm struct lifetime. This function will return a ZERO_PAGE folio if PERSISTENT_HUGE_ZERO_FOLIO is disabled or if we failed to allocate a huge_zero_folio during early init. Link: https://lkml.kernel.org/r/20250811084113.647267-5-kernel@pankajraghav.com Signed-off-by: David Hildenbrand Signed-off-by: Pankaj Raghav Reviewed-by: Lorenzo Stoakes Co-developed-by: David Hildenbrand Reviewed-by: Hannes Reinecke Cc: Baolin Wang Cc: Christoph Hellwig Cc: "Darrick J. Wong" Cc: Dev Jain Cc: Jens Axboe Cc: Liam Howlett Cc: Luis Chamberalin Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Zi Yan Cc: Kiryl Shutsemau Signed-off-by: Andrew Morton commit 2d8bd8049e89efe42a5397de4effd899e8dd2249 Author: Pankaj Raghav Date: Mon Aug 11 10:41:11 2025 +0200 mm: add persistent huge zero folio Many places in the kernel need to zero out larger chunks, but the maximum segment that can be zeroed out at a time by ZERO_PAGE is limited by PAGE_SIZE. This is especially annoying in block devices and filesystems where multiple ZERO_PAGEs are attached to the bio in different bvecs. With multipage bvec support in block layer, it is much more efficient to send out larger zero pages as a part of single bvec. This concern was raised during the review of adding Large Block Size support to XFS[1][2]. Usually huge_zero_folio is allocated on demand, and it will be deallocated by the shrinker if there are no users of it left. At moment, huge_zero_folio infrastructure refcount is tied to the process lifetime that created it. This might not work for bio layer as the completions can be async and the process that created the huge_zero_folio might no longer be alive. And, one of the main points that came up during discussion is to have something bigger than zero page as a drop-in replacement. Add a config option PERSISTENT_HUGE_ZERO_FOLIO that will result in allocating the huge zero folio during early init and never free the memory by disabling the shrinker. This makes using the huge_zero_folio without having to pass any mm struct and does not tie the lifetime of the zero folio to anything, making it a drop-in replacement for ZERO_PAGE. If PERSISTENT_HUGE_ZERO_FOLIO config option is enabled, then mm_get_huge_zero_folio() will simply return the allocated page instead of dynamically allocating a new PMD page. Use this option carefully in resource constrained systems as it uses one full PMD sized page for zeroing purposes. [1] https://lore.kernel.org/linux-xfs/20231027051847.GA7885@lst.de/ [2] https://lore.kernel.org/linux-xfs/ZitIK5OnR7ZNY0IG@infradead.org/ Link: https://lkml.kernel.org/r/20250811084113.647267-4-kernel@pankajraghav.com Signed-off-by: David Hildenbrand Signed-off-by: Pankaj Raghav Reviewed-by: Lorenzo Stoakes Co-developed-by: David Hildenbrand Reviewed-by: Hannes Reinecke Cc: Baolin Wang Cc: Christoph Hellwig Cc: "Darrick J. Wong" Cc: Dev Jain Cc: Jens Axboe Cc: Liam Howlett Cc: Luis Chamberalin Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Zi Yan Cc: Kiryl Shutsemau Signed-off-by: Andrew Morton commit 2843408ca971d1472a6a8b32ee4647f55ecab598 Author: Pankaj Raghav Date: Mon Aug 11 10:41:10 2025 +0200 mm: rename MMF_HUGE_ZERO_PAGE to MMF_HUGE_ZERO_FOLIO As all the helper functions has been renamed from *_page to *_folio, rename the MM flag from MMF_HUGE_ZERO_PAGE to MMF_HUGE_ZERO_FOLIO. No functional changes. Link: https://lkml.kernel.org/r/20250811084113.647267-3-kernel@pankajraghav.com Signed-off-by: Pankaj Raghav Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Hannes Reinecke Cc: Baolin Wang Cc: Christoph Hellwig Cc: "Darrick J. Wong" Cc: Dev Jain Cc: Jens Axboe Cc: Liam Howlett Cc: Luis Chamberalin Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Kiryl Shutsemau Signed-off-by: Andrew Morton commit b912586ba7cffabcfc1af7ff0f0b1569a73b21f4 Author: Pankaj Raghav Date: Mon Aug 11 10:41:09 2025 +0200 mm: rename huge_zero_page to huge_zero_folio Patch series "add persistent huge zero folio support", v3. Many places in the kernel need to zero out larger chunks, but the maximum segment we can zero out at a time by ZERO_PAGE is limited by PAGE_SIZE. This concern was raised during the review of adding Large Block Size support to XFS[1][2]. This is especially annoying in block devices and filesystems where multiple ZERO_PAGEs are attached to the bio in different bvecs. With multipage bvec support in block layer, it is much more efficient to send out larger zero pages as a part of single bvec. Some examples of places in the kernel where this could be useful: - blkdev_issue_zero_pages() - iomap_dio_zero() - vmalloc.c:zero_iter() - rxperf_process_call() - fscrypt_zeroout_range_inline_crypt() - bch2_checksum_update() ... Usually huge_zero_folio is allocated on demand, and it will be deallocated by the shrinker if there are no users of it left. At the moment, huge_zero_folio infrastructure refcount is tied to the process lifetime that created it. This might not work for bio layer as the completions can be async and the process that created the huge_zero_folio might no longer be alive. And, one of the main point that came during discussion is to have something bigger than zero page as a drop-in replacement. Add a config option PERSISTENT_HUGE_ZERO_FOLIO that will always allocate the huge_zero_folio, and disable the shrinker so that huge_zero_folio is never freed. This makes using the huge_zero_folio without having to pass any mm struct and does not tie the lifetime of the zero folio to anything, making it a drop-in replacement for ZERO_PAGE. I have converted blkdev_issue_zero_pages() as an example as a part of this series. I also noticed close to 4% performance improvement just by replacing ZERO_PAGE with persistent huge_zero_folio. I will send patches to individual subsystems using the huge_zero_folio once this gets upstreamed. [1] https://lore.kernel.org/linux-xfs/20231027051847.GA7885@lst.de/ [2] https://lore.kernel.org/linux-xfs/ZitIK5OnR7ZNY0IG@infradead.org/ As the transition already happened from exposing huge_zero_page to huge_zero_folio, change the name of the shrinker and the other helper function to reflect that. No functional changes. Link: https://lkml.kernel.org/r/20250811084113.647267-1-kernel@pankajraghav.com Link: https://lkml.kernel.org/r/20250811084113.647267-2-kernel@pankajraghav.com Signed-off-by: Pankaj Raghav Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Hannes Reinecke Cc: Baolin Wang Cc: Christoph Hellwig Cc: "Darrick J. Wong" Cc: Dev Jain Cc: Jens Axboe Cc: Liam Howlett Cc: Luis Chamberalin Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: "Ritesh Harjani (IBM)" Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Kiryl Shutsemau Signed-off-by: Andrew Morton commit 4c89792ea0a224340ff198abc7caffa211baccd6 Author: David Hildenbrand Date: Mon Aug 11 13:26:31 2025 +0200 mm: rename vm_ops->find_special_page() to vm_ops->find_normal_page() ... and hide it behind a kconfig option. There is really no need for any !xen code to perform this check. The naming is a bit off: we want to find the "normal" page when a PTE was marked "special". So it's really not "finding a special" page. Improve the documentation, and add a comment in the code where XEN ends up performing the pte_mkspecial() through a hypercall. More details can be found in commit 923b2919e2c3 ("xen/gntdev: mark userspace PTEs as special on x86 PV guests"). Link: https://lkml.kernel.org/r/20250811112631.759341-12-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Cc: David Vrabel Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 2db308160b5a191b494746fd167dbbaaead3fb26 Author: David Hildenbrand Date: Mon Aug 11 13:26:30 2025 +0200 mm: introduce and use vm_normal_page_pud() Let's introduce vm_normal_page_pud(), which ends up being fairly simple because of our new common helpers and there not being a PUD-sized zero folio. Use vm_normal_page_pud() in folio_walk_start() to resolve a TODO, structuring the code like the other (pmd/pte) cases. Defer introducing vm_normal_folio_pud() until really used. Note that we can so far get PUDs with hugetlb, daxfs and PFNMAP entries. Link: https://lkml.kernel.org/r/20250811112631.759341-11-david@redhat.com Reviewed-by: Wei Yang Reviewed-by: Oscar Salvador Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit af38538801c6a97565b44700ee6695d7d60ad779 Author: David Hildenbrand Date: Mon Aug 11 13:26:29 2025 +0200 mm/memory: factor out common code from vm_normal_page_*() Let's reduce the code duplication and factor out the non-pte/pmd related magic into __vm_normal_page(). To keep it simpler, check the pfn against both zero folios, which shouldn't really make a difference. It's a good question if we can even hit the !CONFIG_ARCH_HAS_PTE_SPECIAL scenario in the PMD case in practice: but doesn't really matter, as it's now all unified in vm_normal_page_pfn(). Add kerneldoc for all involved functions. Note that, as a side product, we now: * Support the find_special_page special thingy also for PMD * Don't check for is_huge_zero_pfn() anymore if we have CONFIG_ARCH_HAS_PTE_SPECIAL and the PMD is not special. The VM_WARN_ON_ONCE would catch any abuse No functional change intended. Link: https://lkml.kernel.org/r/20250811112631.759341-10-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit ec63a44011dccebca24e7ef7e8a9521306de1bc9 Author: David Hildenbrand Date: Mon Aug 11 13:26:28 2025 +0200 mm/memory: convert print_bad_pte() to print_bad_page_map() print_bad_pte() looks like something that should actually be a WARN or similar, but historically it apparently has proven to be useful to detect corruption of page tables even on production systems -- report the issue and keep the system running to make it easier to actually detect what is going wrong (e.g., multiple such messages might shed a light). As we want to unify vm_normal_page_*() handling for PTE/PMD/PUD, we'll have to take care of print_bad_pte() as well. Let's prepare for using print_bad_pte() also for non-PTEs by adjusting the implementation and renaming the function to print_bad_page_map(). Provide print_bad_pte() as a simple wrapper. Document the implicit locking requirements for the page table re-walk. To make the function a bit more readable, factor out the ratelimit check into is_bad_page_map_ratelimited() and place the printing of page table content into __print_bad_page_map_pgtable(). We'll now dump information from each level in a single line, and just stop the table walk once we hit something that is not a present page table. The report will now look something like (dumping pgd to pmd values): [ 77.943408] BUG: Bad page map in process XXX pte:80000001233f5867 [ 77.944077] addr:00007fd84bb1c000 vm_flags:08100071 anon_vma: ... [ 77.945186] pgd:10a89f067 p4d:10a89f067 pud:10e5a2067 pmd:105327067 Not using pgdp_get(), because that does not work properly on some arm configs where pgd_t is an array. Note that we are dumping all levels even when levels are folded for simplicity. [david@redhat.com: drop warning] Link: https://lkml.kernel.org/r/923b279c-de33-44dd-a923-2959afad8626@redhat.com Link: https://lkml.kernel.org/r/20250811112631.759341-9-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Oscar Salvador Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit b22cc9a9c7ff0ad8998d58fdd7122de6038c46a7 Author: David Hildenbrand Date: Mon Aug 11 13:26:27 2025 +0200 mm/rmap: convert "enum rmap_level" to "enum pgtable_level" Let's factor it out, and convert all checks for unsupported levels to BUILD_BUG(). The code is written in a way such that force-inlining will optimize out the levels. [nathan@kernel.org: always inline __folio_rmap_sanity_checks()] Link: https://lkml.kernel.org/r/20250814-rmap-fix-build_bug-conversion-v1-1-fb7b10a0b362@kernel.org Link: https://lkml.kernel.org/r/20250811112631.759341-8-david@redhat.com Signed-off-by: David Hildenbrand Signed-off-by: Nathan Chancellor Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Oscar Salvador Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit 30680d5ef0dc7a1032edc1519e85cbb504280d73 Author: David Hildenbrand Date: Mon Aug 11 13:26:26 2025 +0200 powerpc/ptdump: rename "struct pgtable_level" to "struct ptdump_pg_level" We want to make use of "pgtable_level" for an enum in core-mm. Other architectures seem to call "struct pgtable_level" either: * "struct pg_level" when not exposed in a header (riscv, arm) * "struct ptdump_pg_level" when expose in a header (arm64) So let's follow what arm64 does. Link: https://lkml.kernel.org/r/20250811112631.759341-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Ritesh Harjani (IBM) Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Oscar Salvador Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit d82d09e482199e6bbc204df10b2082f764cbe1f4 Author: David Hildenbrand Date: Mon Aug 11 13:26:25 2025 +0200 mm/huge_memory: mark PMD mappings of the huge zero folio special The huge zero folio is refcounted (+mapcounted -- is that a word?) differently than "normal" folios, similarly (but different) to the ordinary shared zeropage. For this reason, we special-case these pages in vm_normal_page*/vm_normal_folio*, and only allow selected callers to still use them (e.g., GUP can still take a reference on them). vm_normal_page_pmd() already filters out the huge zero folio, to indicate it a special (return NULL). However, so far we are not making use of pmd_special() on architectures that support it (CONFIG_ARCH_HAS_PTE_SPECIAL), like we would with the ordinary shared zeropage. Let's mark PMD mappings of the huge zero folio similarly as special, so we can avoid the manual check for the huge zero folio with CONFIG_ARCH_HAS_PTE_SPECIAL next, and only perform the check on !CONFIG_ARCH_HAS_PTE_SPECIAL. In copy_huge_pmd(), where we have a manual pmd_special() check to handle PFNMAP, we have to manually rule out the huge zero folio. That code needs a serious cleanup, but that's something for another day. While at it, update the doc regarding the shared zero folios. No functional change intended: vm_normal_page_pmd() still returns NULL when it encounters the huge zero folio. Link: https://lkml.kernel.org/r/20250811112631.759341-6-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit b0f86aaebed1fc2bdc7475b14675ebc9d542e5d3 Author: David Hildenbrand Date: Mon Aug 11 13:26:24 2025 +0200 fs/dax: use vmf_insert_folio_pmd() to insert the huge zero folio Let's convert to vmf_insert_folio_pmd(). There is a theoretical change in behavior: in the unlikely case there is already something mapped, we'll now still call trace_dax_pmd_load_hole() and return VM_FAULT_NOPAGE. Previously, we would have returned VM_FAULT_FALLBACK, and the caller would have zapped the PMD to try a PTE fault. However, that behavior was different to other PTE+PMD faults, when there would already be something mapped, and it's not even clear if it could be triggered. Assuming the huge zero folio is already mapped, all good, no need to fallback to PTEs. Assuming there is already a leaf page table ... the behavior would be just like when trying to insert a PMD mapping a folio through dax_fault_iter()->vmf_insert_folio_pmd(). Assuming there is already something else mapped as PMD? It sounds like a BUG, and the behavior would be just like when trying to insert a PMD mapping a folio through dax_fault_iter()->vmf_insert_folio_pmd(). So, it sounds reasonable to not handle huge zero folios differently to inserting PMDs mapping folios when there already is something mapped. Link: https://lkml.kernel.org/r/20250811112631.759341-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Alistair Popple Reviewed-by: Lorenzo Stoakes Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Oscar Salvador Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit 5528ef06da011aa35fc9704127e41a154649a6df Author: David Hildenbrand Date: Mon Aug 11 13:26:23 2025 +0200 mm/huge_memory: support huge zero folio in vmf_insert_folio_pmd() Just like we do for vmf_insert_page_mkwrite() -> ... -> insert_page_into_pte_locked() with the shared zeropage, support the huge zero folio in vmf_insert_folio_pmd(). When (un)mapping the huge zero folio in page tables, we neither adjust the refcount nor the mapcount, just like for the shared zeropage. For now, the huge zero folio is not marked as special yet, although vm_normal_page_pmd() really wants to treat it as special. We'll change that next. Link: https://lkml.kernel.org/r/20250811112631.759341-4-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Cc: Alistair Popple Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 77e493280e92301d3151d6a18a2e17f0c30a582c Author: David Hildenbrand Date: Mon Aug 11 13:26:22 2025 +0200 mm/huge_memory: move more common code into insert_pud() Let's clean it all further up. No functional change intended. Link: https://lkml.kernel.org/r/20250811112631.759341-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Alistair Popple Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: David Vrabel Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Lance Yang Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit b7298e418e298545b195aef51c01cceed816558e Author: David Hildenbrand Date: Mon Aug 11 13:26:21 2025 +0200 mm/huge_memory: move more common code into insert_pmd() Patch series "mm: vm_normal_page*() improvements", v3. Cleanup and unify vm_normal_page_*() handling, also marking the huge zerofolio as special in the PMD. Add+use vm_normal_page_pud() and cleanup that XEN vm_ops->find_special_page thingy. There are plans of using vm_normal_page_*() more widely soon. This patch (of 11): Let's clean it all further up. No functional change intended. Link: https://lkml.kernel.org/r/20250811112631.759341-1-david@redhat.com Link: https://lkml.kernel.org/r/20250811112631.759341-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Alistair Popple Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Reviewed-by: Lance Yang Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Christian Brauner Cc: Christophe Leroy Cc: Dan Williams Cc: Dev Jain Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oleksandr Tyshchenko Cc: Ryan Roberts Cc: Stefano Stabellini Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: David Vrabel Signed-off-by: Andrew Morton commit fb49a4425cfa163faccd91f913773d3401d3a7d4 Author: David Hildenbrand Date: Mon Aug 11 16:39:48 2025 +0200 treewide: remove MIGRATEPAGE_SUCCESS At this point MIGRATEPAGE_SUCCESS is misnamed for all folio users, and now that we remove MIGRATEPAGE_UNMAP, it's really the only "success" return value that the code uses and expects. Let's just get rid of MIGRATEPAGE_SUCCESS completely and just use "0" for success. Link: https://lkml.kernel.org/r/20250811143949.1117439-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan [mm] Acked-by: Dave Kleikamp [jfs] Acked-by: David Sterba [btrfs] Acked-by: Greg Kroah-Hartman Reviewed-by: Byungchul Park Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Benjamin LaHaise Cc: Chris Mason Cc: Christian Brauner Cc: Christophe Leroy Cc: Dave Kleikamp Cc: Eugenio Pé rez Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Wang Cc: Jerrin Shaji George Cc: Josef Bacik Cc: Joshua Hahn Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Minchan Kim Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Rakie Kim Cc: Sergey Senozhatsky Cc: Xuan Zhuo Cc: Lance Yang Signed-off-by: Andrew Morton commit 95c2908f1a4fd608b1cdbb5acef3572e5d769e1c Author: David Hildenbrand Date: Mon Aug 11 16:39:47 2025 +0200 mm/migrate: remove MIGRATEPAGE_UNMAP migrate_folio_unmap() is the only user of MIGRATEPAGE_UNMAP. We want to remove MIGRATEPAGE_* completely. It's rather weird to have a generic MIGRATEPAGE_UNMAP, documented to be returned from address-space callbacks, when it's only used for an internal helper. Let's start by having only a single "success" return value for migrate_folio_unmap() -- 0 -- by moving the "folio was already freed" check into the single caller. There is a remaining comment for PG_isolated, which we renamed to PG_movable_ops_isolated recently and forgot to update. While we might still run into that case with zsmalloc, it's something we want to get rid of soon. So let's just focus that optimization on real folios only for now by excluding movable_ops pages. Note that concurrent freeing can happen at any time and this "already freed" check is not relevant for correctness. [david@redhat.com: no need to pass "reason" to migrate_folio_unmap(), per Lance] Link: https://lkml.kernel.org/r/3bb725f8-28d7-4aa2-b75f-af40d5cab280@redhat.com Link: https://lkml.kernel.org/r/20250811143949.1117439-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lance Yang Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Benjamin LaHaise Cc: Byungchul Park Cc: Chris Mason Cc: Christian Brauner Cc: Christophe Leroy Cc: Dave Kleikamp Cc: David Sterba Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Wang Cc: Jerrin Shaji George Cc: Josef Bacik Cc: Joshua Hahn Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Minchan Kim Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Rakie Kim Cc: Sergey Senozhatsky Cc: Xuan Zhuo Cc: Dave Kleikamp Signed-off-by: Andrew Morton commit 1f2052755c152940c336918bd73d13d5468f548b Author: Kairui Song Date: Tue Aug 12 01:20:18 2025 +0800 mm/mincore: use a helper for checking the swap cache Introduce a mincore_swap helper for checking swap entries. Move all swap related logic and sanity debug check into it, and separate them from page cache checking. The performance is better after this commit. mincore_page is never called on a swap cache space now, so the logic can be simpler. The sanity check also covers more potential cases now, previously the WARN_ON only catches potentially corrupted page table, now if shmem contains a swap entry with !CONFIG_SWAP, a WARN will be triggered. This changes the mincore value when the WARN is triggered, but this shouldn't matter. The WARN_ON means the data is already corrupted or something is very wrong, so it really should not happen. Before this series: mincore on a swaped out 16G anon mmap range: Took 488220 us mincore on 16G shmem mmap range: Took 530272 us. After this commit: mincore on a swaped out 16G anon mmap range: Took 446763 us mincore on 16G shmem mmap range: Took 460496 us. About ~10% faster. Link: https://lkml.kernel.org/r/20250811172018.48901-3-ryncsn@gmail.com Signed-off-by: Kairui Song Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Kemeng Shi Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 27763edac9288bbb35a9feecb82652de04e637fd Author: Kairui Song Date: Tue Aug 12 01:20:17 2025 +0800 mm/mincore, swap: consolidate swap cache checking for mincore Patch series "mm/mincore: minor clean up for swap cache checking". This series cleans up a swap cache helper only used by mincore, move it back into mincore code. Also separate the swap cache related logics out of shmem / page cache logics in mincore. With this series we have less lines of code and better performance. Before this series: mincore on a swaped out 16G anon mmap range: Took 488220 us mincore on 16G shmem mmap range: Took 530272 us. After this series: mincore on a swaped out 16G anon mmap range: Took 446763 us mincore on 16G shmem mmap range: Took 460496 us. About ~10% faster. This patch (of 2): The filemap_get_incore_folio (previously find_get_incore_page) helper was introduced by commit 61ef18655704 ("mm: factor find_get_incore_page out of mincore_page") to be used by later commit f5df8635c5a3 ("mm: use find_get_incore_page in memcontrol"), so memory cgroup charge move code can be simplified. But commit 6b611388b626 ("memcg-v1: remove charge move code") removed that user completely, it's only used by mincore now. So this commit basically reverts commit 61ef18655704 ("mm: factor find_get_incore_page out of mincore_page"). Move it back to mincore side to simplify the code. Link: https://lkml.kernel.org/r/20250811172018.48901-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250811172018.48901-2-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Nhat Pham Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Kemeng Shi Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7bca1760cd86b9ef62d4c2baf168b68a708011bd Author: Sang-Heon Jeon Date: Sun Aug 10 12:25:47 2025 -0700 docs/mm/damon/design: fix typo: s/sz_trtied/sz_tried/ There are some typo in statistics section of DAMON design docs - sz_trtied -> sz_tried Link: https://lkml.kernel.org/r/20250729144414.31958-1-ekffu200098@gmail.com Signed-off-by: Sang-Heon Jeon Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Reviewed-by: Dev Jain Reviewed-by: Honggyu Kim Signed-off-by: Andrew Morton commit e6d7d3502e00ed6f86e03dcdb282cb7785e55448 Author: Sang-Heon Jeon Date: Tue Aug 5 21:39:40 2025 +0900 mm/damon: update expired description of damos_action Nowadays, damos operation actions support a greater operation set. But comments (also, generated documentation) weren't updated. So fix the comments with current support status. Link: https://lkml.kernel.org/r/20250805123940.13691-1-ekffu200098@gmail.com Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Honggyu Kim Signed-off-by: Andrew Morton commit 3e86861d00d5cff8185a17da7e9d3b2f8fb90a99 Author: Xichao Zhao Date: Mon Aug 11 11:42:57 2025 +0800 mm/kasan/init.c: remove unnecessary pointer variables Simplify the code to enhance readability and maintain a consistent coding style. Link: https://lkml.kernel.org/r/20250811034257.154862-1-zhao.xichao@vivo.com Signed-off-by: Xichao Zhao Reviewed-by: Anshuman Khandual Reviewed-by: Andrey Konovalov Reviewed-by: Vishal Moola (Oracle) Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit d9d1c2d81797250270babcf108d990e3a4799a9d Author: Suren Baghdasaryan Date: Fri Aug 8 08:28:49 2025 -0700 fs/proc/task_mmu: execute PROCMAP_QUERY ioctl under per-vma locks Utilize per-vma locks to stabilize vma after lookup without taking mmap_lock during PROCMAP_QUERY ioctl execution. If vma lock is contended, we fall back to mmap_lock but take it only momentarily to lock the vma and release the mmap_lock. In a very unlikely case of vm_refcnt overflow, this fall back path will fail and ioctl is done under mmap_lock protection. This change is designed to reduce mmap_lock contention and prevent PROCMAP_QUERY ioctl calls from blocking address space updates. Link: https://lkml.kernel.org/r/20250808152850.2580887-4-surenb@google.com Signed-off-by: Suren Baghdasaryan Acked-by: SeongJae Park Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Ye Bin Signed-off-by: Andrew Morton commit ee737a5a102c87cba43514483fcaa6fa75f866b8 Author: Suren Baghdasaryan Date: Fri Aug 8 08:28:48 2025 -0700 fs/proc/task_mmu: factor out proc_maps_private fields used by PROCMAP_QUERY Refactor struct proc_maps_private so that the fields used by PROCMAP_QUERY ioctl are moved into a separate structure. In the next patch this allows ioctl to reuse some of the functions used for reading /proc/pid/maps without using file->private_data. This prevents concurrent modification of file->private_data members by ioctl and /proc/pid/maps readers. The change is pure code refactoring and has no functional changes. Link: https://lkml.kernel.org/r/20250808152850.2580887-3-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Ye Bin Signed-off-by: Andrew Morton commit 41f105581680c821cd0081c91805c0420cc1e0e4 Author: Suren Baghdasaryan Date: Fri Aug 8 08:28:47 2025 -0700 selftests/proc: test PROCMAP_QUERY ioctl while vma is concurrently modified Patch series " execute PROCMAP_QUERY ioctl under per-vma lock", v4. With /proc/pid/maps now being read under per-vma lock protection we can reuse parts of that code to execute PROCMAP_QUERY ioctl also without taking mmap_lock. The change is designed to reduce mmap_lock contention and prevent PROCMAP_QUERY ioctl calls from blocking address space updates. This patchset was split out of the original patchset [1] that introduced per-vma lock usage for /proc/pid/maps reading. It contains PROCMAP_QUERY tests, code refactoring patch to simplify the main change and the actual transition to per-vma lock. This patch (of 3): Extend /proc/pid/maps tearing tests to verify PROCMAP_QUERY ioctl operation correctness while the vma is being concurrently modified. Link: https://lkml.kernel.org/r/20250808152850.2580887-1-surenb@google.com Link: https://lkml.kernel.org/r/20250808152850.2580887-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Tested-by: SeongJae Park Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Vlastimil Babka Cc: Ye Bin Signed-off-by: Andrew Morton commit 63f39737d1e3cfb3a2173fb4c56a64b4d8ce6fa8 Author: Yueyang Pan Date: Sat Aug 2 11:52:46 2025 +0000 mm/damon/vaddr: support stat-purpose DAMOS filters This patch extends DAMOS_STAT handling of the DAMON operations sets for virtual address spaces for ops-level DAMOS filters. It leverages the walk_page_range to walk the page table and gets the folio from page table. The last folio scanned is stored in damos->last_applied to prevent double counting. Link: https://lkml.kernel.org/r/264a4b5ea202fd73c01b349c9694d8bf9978c441.1754135312.git.pyyjason@gmail.com Signed-off-by: Yueyang Pan Reviewed-by: SeongJae Park Cc: Usama Arif Signed-off-by: Andrew Morton commit 408b299a62ec207fa5f213d7044245752eb50dab Author: Yueyang Pan Date: Sat Aug 2 11:52:45 2025 +0000 mm/damon/paddr: move filters existence check function to ops-common Patch series "mm/damon/vaddr: support stat-purpose DAMOS filters", v4. Extend DAMOS_STAT handling of the DAMON operations sets for virtual address spaces for ops-level DAMOS filters. Functionality Test ================== I wrote a small test program which allocates 10GB of DRAM, use madvise(MADV_HUGEPAGE) to convert the base pages to 2MB huge pages Then my program does the following things in order: 1. Write sequentially to the whole 10GB region 2. Read the first 5GB region sequentially for 10 times 3. Sleep 5s 4. Read the second 5GB region sequentially for 10 times With a proper damon setting, we are expected to see df-passed to be 10GB and hot region move around with the read $ # Start DAMON $ sudo ./damo/damo start "./my_test/test" --monitoring_intervals 100ms\ 1s 2s $ # Show DAMON-generated access pattern snapshot $ sudo ./damo/damo report access --snapshot_damos_filter allow \ hugepage_size 2MiB 2MiB heatmap: # min/max temperatures: -600,000,000, 100,001,000, column size: 137.352 MiB intervals: sample 100 ms aggr 1 s (max access hz 10) # damos filters (df): reject none hugepage_size [2.000 MiB, 2.000 MiB] df-pass: # min/max temperatures: -400,000,000, 100,001,000, column size: 128.031 MiB 0 addr 85.373 TiB size 745.555 MiB access 0 hz age 6 s df-passed 0 B 1 addr 127.608 TiB size 877.664 MiB access 3.000 hz age 0 ns df-passed 878.000 MiB 2 addr 127.609 TiB size 219.418 MiB access 2.000 hz age 0 ns df-passed 220.000 MiB 3 addr 127.609 TiB size 316.613 MiB access 1.000 hz age 1 s df-passed 316.000 MiB 4 addr 127.609 TiB size 474.922 MiB access 1.000 hz age 1 s df-passed 476.000 MiB 5 addr 127.610 TiB size 407.188 MiB access 1.000 hz age 0 ns df-passed 406.000 MiB 6 addr 127.610 TiB size 610.781 MiB access 1.000 hz age 0 ns df-passed 612.000 MiB 7 addr 127.611 TiB size 697.309 MiB access 0 hz age 0 ns df-passed 696.000 MiB 8 addr 127.611 TiB size 77.480 MiB access 1.000 hz age 0 ns df-passed 78.000 MiB 9 addr 127.611 TiB size 573.102 MiB access 1.000 hz age 0 ns df-passed 574.000 MiB 10 addr 127.612 TiB size 245.617 MiB access 2.000 hz age 0 ns df-passed 246.000 MiB 11 addr 127.612 TiB size 295.102 MiB access 1.000 hz age 1 s df-passed 294.000 MiB 12 addr 127.612 TiB size 295.105 MiB access 1.000 hz age 1 s df-passed 296.000 MiB 13 addr 127.613 TiB size 67.172 MiB access 1.000 hz age 1 s df-passed 66.000 MiB 14 addr 127.613 TiB size 604.570 MiB access 0 hz age 1 s df-passed 606.000 MiB 15 addr 127.613 TiB size 389.578 MiB access 0 hz age 4 s df-passed 388.000 MiB 16 addr 127.614 TiB size 259.719 MiB access 0 hz age 4 s df-passed 260.000 MiB 17 addr 127.614 TiB size 817.941 MiB access 0 hz age 4 s df-passed 818.000 MiB 18 addr 127.615 TiB size 204.488 MiB access 0 hz age 4 s df-passed 204.000 MiB 19 addr 127.615 TiB size 730.902 MiB access 0 hz age 4 s df-passed 732.000 MiB 20 addr 127.616 TiB size 182.727 MiB access 0 hz age 4 s df-passed 182.000 MiB 21 addr 127.616 TiB size 926.824 MiB access 0 hz age 2 s df-passed 928.000 MiB 22 addr 127.617 TiB size 102.984 MiB access 0 hz age 2 s df-passed 102.000 MiB 23 addr 127.617 TiB size 86.527 MiB access 0 hz age 2 s df-passed 86.000 MiB 24 addr 127.617 TiB size 778.777 MiB access 0 hz age 2 s df-passed 776.000 MiB 25 addr 127.999 TiB size 132.000 KiB access 0 hz age 6 s df-passed 0 B memory bw estimate: 6.524 GiB per second df-passed: 6.527 GiB per second total size: 10.731 GiB df-passed 10.000 GiB record DAMON intervals: sample 100 ms, aggr 1 s $ # Show DAMON-generated access pattern snapshot again $ sudo ./damo/damo report access --snapshot_damos_filter allow \ hugepage_size 2MiB 2MiB heatmap: # min/max temperatures: -1,100,000,000, 2,000, column size: 137.352 MiB intervals: sample 100 ms aggr 1 s (max access hz 10) # damos filters (df): reject none hugepage_size [2.000 MiB, 2.000 MiB] df-pass: # min/max temperatures: -900,000,000, 2,000, column size: 128.031 MiB 0 addr 85.373 TiB size 745.555 MiB access 0 hz age 11 s df-passed 0 B 1 addr 127.608 TiB size 579.715 MiB access 2.000 hz age 0 ns df-passed 580.000 MiB 2 addr 127.608 TiB size 144.930 MiB access 2.000 hz age 0 ns df-passed 146.000 MiB 3 addr 127.608 TiB size 452.453 MiB access 2.000 hz age 0 ns df-passed 452.000 MiB 4 addr 127.609 TiB size 113.117 MiB access 1.000 hz age 0 ns df-passed 114.000 MiB 5 addr 127.609 TiB size 182.367 MiB access 2.000 hz age 0 ns df-passed 182.000 MiB 6 addr 127.609 TiB size 182.371 MiB access 2.000 hz age 0 ns df-passed 182.000 MiB 7 addr 127.609 TiB size 350.488 MiB access 1.000 hz age 0 ns df-passed 350.000 MiB 8 addr 127.610 TiB size 525.738 MiB access 1.000 hz age 0 ns df-passed 526.000 MiB 9 addr 127.610 TiB size 401.352 MiB access 1.000 hz age 0 ns df-passed 402.000 MiB 10 addr 127.611 TiB size 100.340 MiB access 1.000 hz age 0 ns df-passed 100.000 MiB 11 addr 127.611 TiB size 19.523 MiB access 0 hz age 0 ns df-passed 20.000 MiB 12 addr 127.611 TiB size 175.727 MiB access 0 hz age 0 ns df-passed 176.000 MiB 13 addr 127.611 TiB size 106.629 MiB access 0 hz age 0 ns df-passed 106.000 MiB 14 addr 127.611 TiB size 959.676 MiB access 0 hz age 0 ns df-passed 960.000 MiB 15 addr 127.612 TiB size 424.469 MiB access 1.000 hz age 0 ns df-passed 424.000 MiB 16 addr 127.612 TiB size 424.469 MiB access 1.000 hz age 0 ns df-passed 424.000 MiB 17 addr 127.613 TiB size 201.648 MiB access 0 hz age 6 s df-passed 202.000 MiB 18 addr 127.613 TiB size 806.609 MiB access 0 hz age 6 s df-passed 806.000 MiB 19 addr 127.614 TiB size 862.125 MiB access 0 hz age 9 s df-passed 862.000 MiB 20 addr 127.614 TiB size 215.535 MiB access 0 hz age 9 s df-passed 216.000 MiB 21 addr 127.615 TiB size 104.500 MiB access 0 hz age 9 s df-passed 104.000 MiB 22 addr 127.615 TiB size 940.523 MiB access 0 hz age 9 s df-passed 942.000 MiB 23 addr 127.616 TiB size 640.281 MiB access 0 hz age 7 s df-passed 640.000 MiB 24 addr 127.616 TiB size 426.855 MiB access 0 hz age 7 s df-passed 426.000 MiB 25 addr 127.617 TiB size 90.105 MiB access 0 hz age 7 s df-passed 90.000 MiB 26 addr 127.617 TiB size 810.965 MiB access 0 hz age 7 s df-passed 808.000 MiB 27 addr 127.999 TiB size 132.000 KiB access 0 hz age 11 s df-passed 0 B memory bw estimate: 5.297 GiB per second df-passed: 5.297 GiB per second total size: 10.731 GiB df-passed 10.000 GiB record DAMON intervals: sample 100 ms, aggr 1 s As you can see the total df-passed region is 10GiB and the hot region moves as the seq read keeps going This patch (of 2): This patch moves damon_pa_scheme_has_filter to ops-common. renaming to damos_ops_has_filter. Doing so allows us to reuse its logic in the vaddr version of DAMOS_STAT. Link: https://lkml.kernel.org/r/cover.1754135312.git.pyyjason@gmail.com Link: https://lkml.kernel.org/r/cbe01740f7ac5ac7c9fd1ca367d297c3d7f2a69d.1754135312.git.pyyjason@gmail.com Signed-off-by: Yueyang Pan Reviewed-by: SeongJae Park Cc: Usama Arif Signed-off-by: Andrew Morton commit dc32c8d4875fdd27b43d5c295853860f4d647055 Author: Bijan Tabatabai Date: Wed Aug 6 18:42:54 2025 -0500 mm/damon/core: skip needless update of damon_attrs in damon_commit_ctx() Currently, damon_commit_ctx() always calls damon_set_attrs() even if the attributes have not been changed. This can be problematic when the DAMON state is committed relatively frequently because damon_set_attrs() resets ctx->next_{aggregation,ops_update}_sis, causing aggregation and ops update operations to be needlessly delayed. This patch avoids this by only calling damon_set_attrs() in damon_commit_ctx when the attributes have been changed. [akpm@linux-foundation.org: Link: https://lkml.kernel.org/r/20250807001924.76275-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250806234254.10572-1-bijan311@gmail.com Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Bijan Tabatabai Signed-off-by: Andrew Morton commit 878d9e8cebbb111a678e1f83d7daee917922f700 Author: Wei Yang Date: Mon Aug 4 06:41:06 2025 +0000 mm/rmap: do __folio_mod_stat() in __folio_add_rmap() It is required to modify folio statistic after rmap changes, so it looks reasonable to do it in __folio_add_rmap(), which is the current behavior of __folio_remove_rmap() and folio_add_new_anon_rmap(). Call __folio_mod_stat() in __folio_add_rmap(), so that rmap adjustment family shares the same pattern. Link: https://lkml.kernel.org/r/20250804064106.21269-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Rik van Riel Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit 9863124e0bfb94a0c1e84186d2f56f400b2e0112 Author: Qianfeng Rong Date: Mon Aug 4 21:00:17 2025 +0800 xarray: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Link: https://lkml.kernel.org/r/20250804130018.484321-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1097a3d456ae11a09a8c624f80505150e1f112ae Author: Sidhartha Kumar Date: Mon Aug 4 14:51:17 2025 +0000 mm/nommu: convert kobjsize() to folios Simple folio conversion to remove a user of PageSlab() and PageCompound(). Link: https://lkml.kernel.org/r/20250804145117.3857308-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: SeongJae Park Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Sidhartha Kumar Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 1738796994a439b0ea796847e3ceb8688dacd93d Author: Vitaly Wool Date: Wed Aug 6 14:55:52 2025 +0200 rust: support large alignments in allocations Add support for large (> PAGE_SIZE) alignments in Rust allocators. All the preparations on the C side are already done, we just need to add bindings for _node_align() functions and start using those. Link: https://lkml.kernel.org/r/20250806125552.1727073-1-vitaly.wool@konsulko.se Signed-off-by: Vitaly Wool Acked-by: Danilo Krummrich Acked-by: Alice Ryhl Cc: Herbert Xu Cc: Jann Horn Cc: Kent Overstreet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Uladzislau Rezki (Sony) Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7760b6421b6c1b49550885ecdfa9cf720ead6eed Author: Vitaly Wool Date: Wed Aug 6 14:55:22 2025 +0200 rust: add support for NUMA ids in allocations Add a new type to support specifying NUMA identifiers in Rust allocators and extend the allocators to have NUMA id as a parameter. Thus, modify ReallocFunc to use the new extended realloc primitives from the C side of the kernel (i.e. k[v]realloc_node_align/vrealloc_node_align) and add the new function alloc_node to the Allocator trait while keeping the existing one (alloc) for backward compatibility. This will allow to specify node to use for allocation of e. g. {KV}Box, as well as for future NUMA aware users of the API. [ojeda@kernel.org: fix missing import needed for `rusttest`] Link: https://lkml.kernel.org/r/20250816210214.2729269-1-ojeda@kernel.org Link: https://lkml.kernel.org/r/20250806125522.1726992-1-vitaly.wool@konsulko.se Signed-off-by: Vitaly Wool Signed-off-by: Miguel Ojeda Acked-by: Danilo Krummrich Acked-by: Alice Ryhl Cc: Herbert Xu Cc: Jann Horn Cc: Kent Overstreet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Uladzislau Rezki (Sony) Cc: Vlastimil Babka Cc: Miguel Ojeda Signed-off-by: Andrew Morton commit 2cd8231796b5e7133b1c3d66ad7d2a3c42c97258 Author: Vitaly Wool Date: Wed Aug 6 14:41:47 2025 +0200 mm/slub: allow to set node and align in k[v]realloc Reimplement k[v]realloc_node() to be able to set node and alignment should a user need to do so. In order to do that while retaining the maximal backward compatibility, add k[v]realloc_node_align() functions and redefine the rest of API using these new ones. While doing that, we also keep the number of _noprof variants to a minimum, which implies some changes to the existing users of older _noprof functions, that basically being bcachefs. With that change we also provide the ability for the Rust part of the kernel to set node and alignment in its K[v]xxx [re]allocations. Link: https://lkml.kernel.org/r/20250806124147.1724658-1-vitaly.wool@konsulko.se Signed-off-by: Vitaly Wool Reviewed-by: Vlastimil Babka Cc: Alice Ryhl Cc: Danilo Krummrich Cc: Herbert Xu Cc: Jann Horn Cc: Kent Overstreet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton commit 4c5d3365882dbbc0784688784904f440d7a4c0f1 Author: Vitaly Wool Date: Wed Aug 6 14:41:08 2025 +0200 mm/vmalloc: allow to set node and align in vrealloc Patch series "support large align and nid in Rust allocators", v15. The series provides the ability for Rust allocators to set NUMA node and large alignment. This patch (of 4): Reimplement vrealloc() to be able to set node and alignment should a user need to do so. Rename the function to vrealloc_node_align() to better match what it actually does now and introduce macros for vrealloc() and friends for backward compatibility. With that change we also provide the ability for the Rust part of the kernel to set node and alignment in its allocations. Link: https://lkml.kernel.org/r/20250806124034.1724515-1-vitaly.wool@konsulko.se Link: https://lkml.kernel.org/r/20250806124108.1724561-1-vitaly.wool@konsulko.se Signed-off-by: Vitaly Wool Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: Vlastimil Babka Cc: Alice Ryhl Cc: Danilo Krummrich Cc: Herbert Xu Cc: Jann Horn Cc: Kent Overstreet Cc: Liam Howlett Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 61dc4358d37ae0be3220a0fa32cf7f0ccd4f7636 Author: Adrian Huang (Lenovo) Date: Wed Aug 6 22:59:06 2025 +0800 mm: correct misleading comment on mmap_lock field in mm_struct The comment previously described the offset of mmap_lock as 0x120 (hex), which is misleading. The correct offset is 56 bytes (decimal) from the last cache line boundary. Using '0x120' could confuse readers trying to understand why the count and owner fields reside in separate cachelines. This change also removes an unnecessary space for improved formatting. Link: https://lkml.kernel.org/r/20250806145906.24647-1-adrianhuang0701@gmail.com Signed-off-by: Adrian Huang (Lenovo) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6de1ef1ca39a07fe1c17f3f73a74106543eae127 Author: Pranav Tyagi Date: Wed Jul 30 19:53:01 2025 +0530 selftests/mm: use __auto_type in swap() macro Replace typeof() with __auto_type in the swap() macro in uffd-stress.c. __auto_type was introduced in GCC 4.9 and reduces the compile time for all compilers. No functional changes intended. Link: https://lkml.kernel.org/r/20250730142301.6754-1-pranav.tyagi03@gmail.com Signed-off-by: Pranav Tyagi Reviewed-by: Joshua Hahn Cc: Peter Xu Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9a42aed48421390155037460a3f2fd510fa6df76 Author: Kairui Song Date: Thu Aug 7 00:17:48 2025 +0800 mm, swap: prefer nonfull over free clusters We prefer a free cluster over a nonfull cluster whenever a CPU local cluster is drained to respect the SSD discard behavior [1]. It's not a best practice for non-discarding devices. And this is causing a higher fragmentation rate. So for a non-discarding device, prefer nonfull over free clusters. This reduces the fragmentation issue by a lot. Testing with make -j96, defconfig, using 64k mTHP, 8G ZRAM: Before: sys time: 6176.34s 64kB/swpout: 1659757 64kB/swpout_fallback: 139503 After: sys time: 6194.11s 64kB/swpout: 1689470 64kB/swpout_fallback: 56147 Testing with make -j96, defconfig, using 64k mTHP, 10G ZRAM: After: sys time: 5531.49s 64kB/swpout: 1791142 64kB/swpout_fallback: 17676 After: sys time: 5587.53s 64kB/swpout: 1811598 64kB/swpout_fallback: 0 Performance is basically unchanged, and the large allocation failure rate is lower. Enabling all mTHP sizes showed a more significant result. Using the same test setup with 10G ZRAM and enabling all mTHP sizes: 128kB swap failure rate: Before: swpout:451599 swpout_fallback:54525 After: swpout:502710 swpout_fallback:870 256kB swap failure rate: Before: swpout:63652 swpout_fallback:2708 After: swpout:65913 swpout_fallback:20 512kB swap failure rate: Before: swpout:11663 swpout_fallback:1767 After: swpout:14480 swpout_fallback:6 2M swap failure rate: Before: swpout:24 swpout_fallback:1442 After: swpout:1329 swpout_fallback:7 The success rate of large allocations is much higher. Link: https://lore.kernel.org/linux-mm/87v8242vng.fsf@yhuang6-desk2.ccr.corp.intel.com/ [1] Link: https://lkml.kernel.org/r/20250806161748.76651-4-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Nhat Pham Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 913fff314547c1922002e655bb25199ee38e8825 Author: Kairui Song Date: Thu Aug 7 00:17:47 2025 +0800 mm, swap: remove fragment clusters counter It was used for calculating the iteration number when the swap allocator wants to scan the whole fragment list. Now the allocator only scans one fragment cluster at a time, so no one uses this counter anymore. Remove it as a cleanup; the performance change is marginal: Build linux kernel using 10G ZRAM, make -j96, defconfig with 2G cgroup memory limit, on top of tmpfs, 64kB mTHP enabled: Before: sys time: 6278.45s After: sys time: 6176.34s Change to 8G ZRAM: Before: sys time: 5572.85s After: sys time: 5531.49s Link: https://lkml.kernel.org/r/20250806161748.76651-3-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Nhat Pham Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kemeng Shi Signed-off-by: Andrew Morton commit b25786b4a9819419a317994dabb6ecb409e8114b Author: Kairui Song Date: Thu Aug 7 00:17:46 2025 +0800 mm, swap: only scan one cluster in fragment list Patch series "mm, swap: improve cluster scan strategy", v2. This series improves the large allocation performance and reduces the failure rate. Some design of the cluster alloactor was later found to be improvable after thorough testing. The allocator spent too much effort scanning the fragment list, which is not helpful in most setups, but causes serious contention of the list lock (si->lock). Besides, the allocator prefers free clusters when searching for a new cluster due to historical reasons, which causes fragmentation issues. So make the allocator only scan one cluster for high order allocation, and prefer nonfull cluster. This both improves the performance and reduces fragmentation. For example, build kernel test with make -j96 and 10G ZRAM with 64kB mTHP enabled shows better performance and a lower failure rate: Before: sys time: 11609.69s 64kB/swpout: 1787051 64kB/swpout_fallback: 20917 After: sys time: 5587.53s 64kB/swpout: 1811598 64kB/swpout_fallback: 0 System time is cut in half, and the failure rate drops to zero. Larger allocations in a hybrid workload also showed a major improvement: 512kB swap failure rate: Before: swpout:11663 swpout_fallback:1767 After: swpout:14480 swpout_fallback:6 2M swap failure rate: Before: swpout:24 swpout_fallback:1442 After: swpout:1329 swpout_fallback:7 This patch (of 3): Fragment clusters were mostly failing high order allocation already. The reason we scan it through now is that a swap slot may get freed without releasing the swap cache, so a swap map entry will end up in HAS_CACHE only status, and the cluster won't be moved back to non-full or free cluster list. This may cause a higher allocation failure rate. Usually only !SWP_SYNCHRONOUS_IO devices may have a large number of slots stuck in HAS_CACHE only status. Because when a !SWP_SYNCHRONOUS_IO device's usage is low (!vm_swap_full()), it will try to lazy free the swap cache. But this fragment list scan out is a bit overkill. Fragmentation is only an issue for the allocator when the device is getting full, and by that time, swap will be releasing the swap cache aggressively already. Only scanning one fragment cluster at a time is good enough to reclaim already pinned slots, and move the cluster back to nonfull. And besides, only high order allocation requires iterating over the list, order 0 allocation will succeed on the first attempt. And high order allocation failure isn't a serious problem. So the iteration of fragment clusters is trivial, but it will slow down large allocation by a lot when the fragment cluster list is long. So it's better to drop this fragment cluster iteration design. Test on a 48c96t system, build linux kernel using 10G ZRAM, make -j48, defconfig with 768M cgroup memory limit, on top of tmpfs, 4K folio only: Before: sys time: 4432.56s After: sys time: 4430.18s Change to make -j96, 2G memory limit, 64kB mTHP enabled, and 10G ZRAM: Before: sys time: 11609.69s 64kB/swpout: 1787051 64kB/swpout_fallback: 20917 After: sys time: 5572.85s 64kB/swpout: 1797612 64kB/swpout_fallback: 19254 Change to 8G ZRAM: Before: sys time: 21524.35s 64kB/swpout: 1687142 64kB/swpout_fallback: 128496 After: sys time: 6278.45s 64kB/swpout: 1679127 64kB/swpout_fallback: 130942 Change to use 10G brd device with SWP_SYNCHRONOUS_IO flag removed: Before: sys time: 7393.50s 64kB/swpout:1788246 swpout_fallback: 0 After: sys time: 7399.88s 64kB/swpout:1784257 swpout_fallback: 0 Change to use 8G brd device with SWP_SYNCHRONOUS_IO flag removed: Before: sys time: 26292.26s 64kB/swpout:1645236 swpout_fallback: 138945 After: sys time: 9463.16s 64kB/swpout:1581376 swpout_fallback: 259979 The performance is a lot better for large folios, and the large order allocation failure rate is only very slightly higher or unchanged even for !SWP_SYNCHRONOUS_IO devices high pressure. Link: https://lkml.kernel.org/r/20250806161748.76651-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250806161748.76651-2-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Nhat Pham Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kairui Song Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 0b16f8bed19c6af82233cb57d01cfc944cce8fb7 Author: Suren Baghdasaryan Date: Mon Aug 4 16:33:49 2025 -0700 mm: change vma_start_read() to drop RCU lock on failure vma_start_read() can drop and reacquire RCU lock in certain failure cases. It's not apparent that the RCU session started by the caller of this function might be interrupted when vma_start_read() fails to lock the vma. This might become a source of subtle bugs and to prevent that we change the locking rules for vma_start_read() to drop RCU read lock upon failure. This way it's more obvious that RCU-protected objects are unsafe after vma locking fails. Link: https://lkml.kernel.org/r/20250804233349.1278678-2-surenb@google.com Suggested-by: Vlastimil Babka Signed-off-by: Suren Baghdasaryan Tested-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit cc483b328881bbccb55265a86731384d5176fe85 Author: Suren Baghdasaryan Date: Mon Aug 4 16:33:48 2025 -0700 mm: limit the scope of vma_start_read() Limit the scope of vma_start_read() as it is used only as a helper for higher-level locking functions implemented inside mmap_lock.c and we are about to introduce more complex RCU rules for this function. The change is pure code refactoring and has no functional changes. Link: https://lkml.kernel.org/r/20250804233349.1278678-1-surenb@google.com Suggested-by: Vlastimil Babka Signed-off-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Jann Horn Cc: Liam Howlett Signed-off-by: Andrew Morton commit 35edbaa04a460531862d3f00c1c2bb0d5e45cd5d Author: Sudarsan Mahendran Date: Mon Aug 4 18:36:29 2025 -0700 selftests/mm: pass filename as input param to VM_PFNMAP tests Enable these tests to be run on other pfnmap'ed memory like NVIDIA's EGM. Add '--' as a separator to pass in file path. This allows passing of cmd line arguments to kselftest_harness. Use '/dev/mem' as default filename. Existing test passes: pfnmap TAP version 13 1..6 # Starting 6 tests from 1 test cases. # PASSED: 6 / 6 tests passed. # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 Pass params to kselftest_harness: pfnmap -r pfnmap:mremap_fixed TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN pfnmap.mremap_fixed ... # OK pfnmap.mremap_fixed ok 1 pfnmap.mremap_fixed # PASSED: 1 / 1 tests passed. # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Pass non-existent file name as input: pfnmap -- /dev/blah TAP version 13 1..6 # Starting 6 tests from 1 test cases. # RUN pfnmap.madvise_disallowed ... # SKIP Cannot open '/dev/blah' Pass non pfnmap'ed file as input: pfnmap -r pfnmap.madvise_disallowed -- randfile.txt TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN pfnmap.madvise_disallowed ... # SKIP Invalid file: 'randfile.txt'. Not pfnmap'ed Link: https://lkml.kernel.org/r/20250805013629.47629-1-sudarsanm@google.com Signed-off-by: Sudarsan Mahendran Acked-by: David Hildenbrand Cc: Axel Rasmussen Cc: Shuah Khan Signed-off-by: Andrew Morton commit 7cbce1eaeb783af9e88fc5cebe9b18d46d9030bd Author: Sergey Senozhatsky Date: Tue Aug 5 19:19:29 2025 +0900 zram: protect recomp_algorithm_show() with ->init_lock sysfs handlers should be called under ->init_lock and are not supposed to unlock it until return, otherwise e.g. a concurrent reset() can occur. There is one handler that breaks that rule: recomp_algorithm_show(). Move ->init_lock handling outside of __comp_algorithm_show() (also drop it and call zcomp_available_show() directly) so that the entire recomp_algorithm_show() loop is protected by the lock, as opposed to protecting individual iterations. The patch does not need to go to -stable, as it does not fix any runtime errors (at least I can't think of any). It makes recomp_algorithm_show() "atomic" w.r.t. zram reset() (just like the rest of zram sysfs show() handlers), that's a pretty minor change. Link: https://lkml.kernel.org/r/20250805101946.1774112-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reported-by: Seyediman Seyedarab Suggested-by: Seyediman Seyedarab Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 79e1c24285c40cdfa9eb00fe8131d1ba14b84ef1 Author: Ye Liu Date: Fri Jul 18 10:41:32 2025 +0800 mm: replace (20 - PAGE_SHIFT) with common macros for pages<->MB conversion Replace repeated (20 - PAGE_SHIFT) calculations with standard macros: - MB_TO_PAGES(mb) converts MB to page count - PAGES_TO_MB(pages) converts pages to MB No functional change. [akpm@linux-foundation.org: remove arc's private PAGES_TO_MB, remove its unused PAGES_TO_KB] [akpm@linux-foundation.org: don't include mm.h due to include file ordering mess] Link: https://lkml.kernel.org/r/20250718024134.1304745-1-ye.liu@linux.dev Signed-off-by: Ye Liu Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Ben Segall Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Dietmar Eggemann Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Josh Triplett Cc: Juri Lelli Cc: Kairui Song Cc: Kemeng Shi Cc: Lai jiangshan Cc: Liam Howlett Cc: Mariano Pache Cc: Mathieu Desnoyers Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Neeraj Upadhyay Cc: Nhat Pham Cc: "Paul E . McKenney" Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 849d5cff4d48be9146c2bf3c492fc7f434b5ffaa Author: Zhang Qilong Date: Thu Jul 31 20:23:05 2025 +0800 /dev/zero: try to align PMD_SIZE for private mapping Attempt to map aligned to huge page size for private mapping which could achieve performance gains, the mprot_tw4m in libMicro average execution time on arm64: - Test case: mprot_tw4m - Before the patch: 22 us - After the patch: 17 us If THP config is not set, we fall back to system page size mappings. Link: https://lkml.kernel.org/r/20250731122305.2669090-1-zhangqilong3@huawei.com Signed-off-by: Zhang Qilong Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Kefeng Wang Cc: Nanyong Sun Signed-off-by: Andrew Morton commit 337135e6124b6d37d7ef1cd5a6c0b9681938c5ee Author: Ruan Shiyang Date: Tue Jul 29 11:51:01 2025 +0800 mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting Goto-san reported confusing pgpromote statistics where the pgpromote_success count significantly exceeded pgpromote_candidate. On a system with three nodes (nodes 0-1: DRAM 4GB, node 2: NVDIMM 4GB): # Enable demotion only echo 1 > /sys/kernel/mm/numa/demotion_enabled numactl -m 0-1 memhog -r200 3500M >/dev/null & pid=$! sleep 2 numactl memhog -r100 2500M >/dev/null & sleep 10 kill -9 $pid # terminate the 1st memhog # Enable promotion echo 2 > /proc/sys/kernel/numa_balancing After a few seconds, we observeed `pgpromote_candidate < pgpromote_success` $ grep -e pgpromote /proc/vmstat pgpromote_success 2579 pgpromote_candidate 0 In this scenario, after terminating the first memhog, the conditions for pgdat_free_space_enough() are quickly met, and triggers promotion. However, these migrated pages are only counted for in PGPROMOTE_SUCCESS, not in PGPROMOTE_CANDIDATE. To solve these confusing statistics, introduce PGPROMOTE_CANDIDATE_NRL to count the missed promotion pages. And also, not counting these pages into PGPROMOTE_CANDIDATE is to avoid changing the existing algorithm or performance of the promotion rate limit. Link: https://lkml.kernel.org/r/20250901090122.124262-1-ruansy.fnst@fujitsu.com Link: https://lkml.kernel.org/r/20250729035101.1601407-1-ruansy.fnst@fujitsu.com Fixes: c6833e10008f ("memory tiering: rate limit NUMA migration throughput") Co-developed-by: Li Zhijian Signed-off-by: Li Zhijian Signed-off-by: Ruan Shiyang Reported-by: Yasunori Gotou (Fujitsu) Suggested-by: Huang Ying Acked-by: Vlastimil Babka Reviewed-by: Huang Ying Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Valentin Schneider Signed-off-by: Andrew Morton commit 915a4022b591d5476f72a4d2ca688212a0f983a4 Author: Hao Jia Date: Thu Jul 17 16:28:45 2025 +0800 mm/mglru: update MG-LRU proactive reclaim statistics only to memcg Users can use /sys/kernel/debug/lru_gen to trigger proactive memory reclaim of a specified memcg. Currently, statistics such as pgrefill, pgscan and pgsteal will be updated to the /proc/vmstat system memory statistics. This will confuse some system memory pressure monitoring tools, making it difficult to determine whether pgscan and pgsteal are caused by system-level pressure or by proactive memory reclaim of some specific memory cgroup. Therefore, make this interface behave similarly to memory.reclaim. Update proactive memory reclaim statistics only to its memory cgroup. Link: https://lkml.kernel.org/r/20250717082845.34673-1-jiahao.kernel@gmail.com Signed-off-by: Hao Jia Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Greg Thelen Cc: Johannes Weiner Cc: Kinsey Ho Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Yuanchu Xie Cc: Yu Zhao Cc: Roman Gushchin Cc: Muchun Song Signed-off-by: Andrew Morton commit e5eb32468859145806bd72d4d3ce3cb617528f37 Author: Jann Horn Date: Mon Jul 28 17:25:07 2025 +0200 kasan: add test for SLAB_TYPESAFE_BY_RCU quarantine skipping Verify that KASAN does not quarantine objects in SLAB_TYPESAFE_BY_RCU slabs if CONFIG_SLUB_RCU_DEBUG is off. [jannh@google.com: v2] Link: https://lkml.kernel.org/r/20250729-kasan-tsbrcu-noquarantine-test-v2-1-d16bd99309c9@google.com [jannh@google.com: make comment more verbose] Link: https://lkml.kernel.org/r/20250814-kasan-tsbrcu-noquarantine-test-v3-1-9e9110009b4e@google.com Link: https://lkml.kernel.org/r/20250728-kasan-tsbrcu-noquarantine-test-v1-1-fa24d9ab7f41@google.com Signed-off-by: Jann Horn Suggested-by: Andrey Konovalov Acked-by: Vlastimil Babka Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 56b060d0a1d3b1fd0429daeac366f00c030fca59 Author: Joshua Hahn Date: Tue Aug 5 13:50:47 2025 -0700 mempolicy: clarify what zone reclaim means The zone_reclaim_mode API controls the reclaim behavior when a node runs out of memory. Contrary to its user-facing name, it is internally referred to as "node_reclaim_mode". This can be confusing. But because we cannot change the name of the API since it has been in place since at least 2.6, let's try to be more explicit about what the behavior of this API is. Change the description to clarify what zone reclaim entails, and be explicit about the RECLAIM_ZONE bit, whose purpose has led to some confusion in the past already [1] [2]. While at it, also soften the warning about changing these bits. [joshua.hahnjy@gmail.com: remove the reference to the vm.zone_reclaim_mode sysctl as an ABI] Link: https://lkml.kernel.org/r/20250806134404.2000234-1-joshua.hahnjy@gmail.com Link: https://lkml.kernel.org/r/20250805205048.1518453-1-joshua.hahnjy@gmail.com Link: https://lore.kernel.org/linux-mm/1579005573-58923-1-git-send-email-alex.shi@linux.alibaba.com/ [1] Link: https://lore.kernel.org/linux-mm/20200626003459.D8E015CA@viggo.jf.intel.com/ [2] Signed-off-by: Joshua Hahn Acked-by: SeongJae Park Acked-by: David Hildenbrand Reviewed-by: Huang Ying Acked-by: Zi Yan Acked-by: Byungchul Park Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: Mathew Brost Cc: Rakie Kim Signed-off-by: Andrew Morton commit 91ec7ad756f103d3a45baac651ea55e4b8c479ca Merge: 8f5ae30d69d754 80cb2b6edd8368 Author: Stephen Boyd Date: Sat Sep 13 15:08:27 2025 -0700 Merge tag 'clk-round-rate-6.18' of https://github.com/masneyb/linux into clk-determine-rate Pull clk_ops::round_rate conversion to clk_ops::determine_rate() from Brian Masney: The round_rate() clk ops is deprecated in the clk framework in favor of the determine_rate() clk ops, so let's go ahead and convert the various clk drivers using the Coccinelle semantic patch posted below. I did some minor cosmetic cleanups of the code in some cases. Coccinelle semantic patch: virtual patch // Look up the current name of the round_rate function @ has_round_rate @ identifier round_rate_name =~ ".*_round_rate"; identifier hw_param, rate_param, parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { ... } // Rename the route_rate function name to determine_rate() @ script:python generate_name depends on has_round_rate @ round_rate_name << has_round_rate.round_rate_name; new_name; @@ coccinelle.new_name = round_rate_name.replace("_round_rate", "_determine_rate") // Change rate to req->rate; also change occurrences of 'return XXX'. @ chg_rate depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; identifier ERR =~ "E.*"; expression E; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... ( -return -ERR; +return -ERR; | - return rate_param; + return 0; | - return E; + req->rate = E; + + return 0; | - rate_param + req->rate ) ...> } // Coccinelle only transforms the first occurrence of the rate parameter // Run a second time. FIXME: Is there a better way to do this? @ chg_rate2 depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... - rate_param + req->rate ...> } // Change parent_rate to req->best_parent_rate @ chg_parent_rate depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... ( - *parent_rate_param + req->best_parent_rate | - parent_rate_param + &req->best_parent_rate ) ...> } // Convert the function definition from round_rate() to determine_rate() @ func_definition depends on chg_rate @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; identifier generate_name.new_name; @@ - long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, - unsigned long *parent_rate_param) + int new_name(struct clk_hw *hw, struct clk_rate_request *req) { ... } // Update the ops from round_rate() to determine_rate() @ ops depends on func_definition @ identifier has_round_rate.round_rate_name; identifier generate_name.new_name; @@ { ..., - .round_rate = round_rate_name, + .determine_rate = new_name, ..., } Note that I used coccinelle 1.2 instead of 1.3 since the newer version adds unnecessary braces as described in this post. https://lore.kernel.org/cocci/67642477-5f3e-4b2a-914d-579a54f48cbd@intel.com/ * tag 'clk-round-rate-6.18' of https://github.com/masneyb/linux: (118 commits) clk: scmi: migrate round_rate() to determine_rate() clk: ti: fapll: convert from round_rate() to determine_rate() clk: ti: dra7-atl: convert from round_rate() to determine_rate() clk: ti: divider: convert from round_rate() to determine_rate() clk: ti: composite: convert from round_rate() to determine_rate() clk: ti: dpll: convert from round_rate() to determine_rate() clk: ti: dpll: change error return from ~0 to -EINVAL clk: ti: dpll: remove round_rate() in favor of determine_rate() clk: tegra: tegra210-emc: convert from round_rate() to determine_rate() clk: tegra: super: convert from round_rate() to determine_rate() clk: tegra: pll: convert from round_rate() to determine_rate() clk: tegra: periph: divider: convert from round_rate() to determine_rate() clk: tegra: divider: convert from round_rate() to determine_rate() clk: tegra: audio-sync: convert from round_rate() to determine_rate() clk: fixed-factor: drop round_rate() clk ops clk: divider: remove round_rate() in favor of determine_rate() clk: visconti: pll: convert from round_rate() to determine_rate() clk: versatile: vexpress-osc: convert from round_rate() to determine_rate() clk: versatile: icst: convert from round_rate() to determine_rate() clk: versaclock7: convert from round_rate() to determine_rate() ... commit 3153d7b8f1b91e8340e2c2653ceeba61b00e8ead Merge: 8f5ae30d69d754 b3b314ef13e46d Author: Stephen Boyd Date: Sat Sep 13 15:06:14 2025 -0700 Merge tag 'samsung-clk-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clk driver updates from Krzysztof Kozlowski: - Tesla FSD: Expose CSI clocks to consumers (DTS) - Exynos990: - Few fixes for fixed factor clocks, register widths and proper PLL parents - Add four more clocks for the DPU and HSI0 clock for USB - Add PERIC0 and PERIC1 clock controllers (CMU), responsible for providing clocks to serial engines - Add seven clock controllers for the new Axis ARTPEC-8 SoC. The SoC shares all main blocks, including the clock controllers, with Samsung SoC, so same drivers and bindings are used. - Cleanups: switch to clk_ops::determine_rate() * tag 'samsung-clk-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: exynos990: Add PERIC0 and PERIC1 clock support dt-bindings: clock: exynos990: Add PERIC0 and PERIC1 clock units clk: samsung: exynos990: Add missing USB clock registers to HSI0 clk: samsung: exynos990: Add LHS_ACEL gate clock for HSI0 and update CLK_NR_TOP dt-bindings: clock: exynos990: Add LHS_ACEL clock ID for HSI0 block clk: samsung: artpec-8: Add initial clock support for ARTPEC-8 SoC clk: samsung: Add clock PLL support for ARTPEC-8 SoC dt-bindings: clock: Add ARTPEC-8 clock controller clk: samsung: exynos990: Add DPU_BUS and CMUREF mux/div and update CLKS_NR_TOP dt-bindings: clock: exynos990: Extend clocks IDs clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes clk: samsung: pll: convert from round_rate() to determine_rate() clk: samsung: cpu: convert from round_rate() to determine_rate() clk: samsung: fsd: Add clk id for PCLK and PLL in CAM_CSI block dt-bindings: clock: Add CAM_CSI clock macro for FSD commit 8de790a3d49e1ead65ad0a6947b3ae200637e1b2 Merge: 8f5ae30d69d754 d02c71cba7bba4 Author: Stephen Boyd Date: Sat Sep 13 15:04:11 2025 -0700 Merge tag 'spacemit-clk-for-6.18-1' of https://github.com/spacemit-com/linux into clk-spacemit Pull RISC-V SpacemiT clk driver updates from Yixun Lan: - Convert to use clk_ops::determine_rate() - Fix parent clocks of SSPA in SpacemiT driver * tag 'spacemit-clk-for-6.18-1' of https://github.com/spacemit-com/linux: clk: spacemit: ccu_pll: convert from round_rate() to determine_rate() clk: spacemit: ccu_mix: convert from round_rate() to determine_rate() clk: spacemit: ccu_ddn: convert from round_rate() to determine_rate() clk: spacemit: fix sspax_clk dt-bindings: clock: spacemit: CLK_SSPA_I2S_BCLK for SSPA commit 73e6f3ae8044f2b9513c5302e725da51172f9d7a Merge: 8f5ae30d69d754 c567bc5fc68c43 Author: Stephen Boyd Date: Sat Sep 13 14:56:54 2025 -0700 Merge tag 'thead-clk-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull T-HEAD clock driver updates from Drew Fustini: - Describe gate clocks with clk_gate so that clock gates can be clock parents. This is similar to the mux clock refactor in 54edba916e29 ("clk: thead: th1520-ap: Describe mux clocks with clk_mux"). - Add support for enabling/disabling PLLs. Some PLLs are put into a disabled state by the bootloader, and clock driver now has the ability to enable them. - Set all AXI clocks to CLK_IS_CRITICAL. The AXI crossbar of TH1520 has no proper timeout handling, which means gating AXI clocks can easily lead to bus timeout and hang the system. All these clock gates are ungated by default on system reset. - Convert all current CLK_IGNORE_UNUSED usage to CLK_IS_CRITICAL to prevent unwanted clock gating. - Fix parent of padctrl0 clock, fix parent of DPU pixel clocks and support changing DPU pixel clock rate. * tag 'thead-clk-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL clk: thead: support changing DPU pixel clock rate clk: thead: add support for enabling/disabling PLLs clk: thead: Correct parent for DPU pixel clocks clk: thead: th1520-ap: fix parent of padctrl0 clock clk: thead: th1520-ap: describe gate clocks with clk_gate commit 1ef1b8b9666d9615b1a09bf6faea913a0bbc2c69 Merge: 8f5ae30d69d754 b5788b96cba97d Author: Stephen Boyd Date: Sat Sep 13 14:33:10 2025 -0700 Merge tag 'renesas-clk-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add Ethernet clocks on Renesas RZ/T2H and RZ/N2H - Add USB3.0 clocks and resets on Renesas RZ/G3E - Add I3C clocks and resets on Renesas RZ/V2H and RZ/V2N - Add USB and remaining serial (SCI) clocks and resets on Renesas RZ/T2H and RZ/N2H - Add I3C and PCIe clocks and resets on Renesas RZ/G3S - Add DMAC and PWM (GPT) clocks and resets on Renesas RZ/G3E - Add Module Stop (MSTOP) support on RZ/G2L and Renesas RZ/G2UL - Convert from clk_ops::round_rate() to clk_ops::determine_rate() * tag 'renesas-clk-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: (27 commits) clk: renesas: r9a09g05[67]: Reduce differences clk: renesas: r9a09g047: Add USB3.0 clocks/resets clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() clk: renesas: r9a09g056: Add clock and reset entries for I3C clk: renesas: r9a09g057: Add clock and reset entries for I3C dt-bindings: clock: renesas,r9a09g047-cpg: Add USB3.0 core clocks clk: renesas: r9a09g077: Add Ethernet Subsystem core and module clocks clk: renesas: rzv2h: Simplify polling condition in __rzv2h_cpg_assert() clk: renesas: rzv2h: Re-assert reset on deassert timeout clk: renesas: rzg2l: Re-assert reset on deassert timeout clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert() dt-bindings: clock: renesas,r9a09g077/87: Add Ethernet clock IDs clk: renesas: r9a09g047: Add GPT clocks and resets clk: renesas: r9a09g077: Add module clocks for SCI1-SCI5 clk: renesas: rzv2h: remove round_rate() in favor of determine_rate() clk: renesas: rzg2l: convert from round_rate() to determine_rate() clk: renesas: r9a07g04[34]: Use tabs instead of spaces clk: renesas: r9a07g043: Add MSTOP for RZ/G2UL clk: renesas: r9a07g044: Add MSTOP for RZ/G2L clk: renesas: r9a08g045: Add MSTOP for GPIO ... commit f4cfb3c49f931f71f68e807b061a0df96d3bbe6b Author: Al Viro Date: Thu Feb 2 14:03:31 2023 -0500 alpha: get rid of the remnants of BAD_PAGE and friends unused since 2.4 times... Signed-off-by: Al Viro commit 90b0615fb5c6f5255bc69cfafb69366eb7279123 Author: Al Viro Date: Thu Feb 2 13:28:20 2023 -0500 SET_PAGE_DIR() users had been gone since 2.3.12pre1 Signed-off-by: Al Viro commit 4d364c660a4934ff77af0710abfc47b407f0d99d Author: Al Viro Date: Thu Feb 2 13:17:47 2023 -0500 PAGE_PTR() had been last used outside of arch/* in 1.1.94 .. and in arch/* - circa 2.2.7. Reviewed-by: Geert Uytterhoeven # m68k Acked-by: Geert Uytterhoeven # m68k Signed-off-by: Al Viro commit 9892775af5a5323a7f15ae1d92d025b5be14c658 Author: Al Viro Date: Wed Feb 1 16:52:54 2023 -0500 csky: remove BS check for FAULT_FLAG_ALLOW_RETRY flags are initialized as FAULT_FLAG_DEFAULT, and the only thing done to that afterwards is |=; since FAULT_FLAG_DEFAULT already includes FAULT_FLAG_ALLOW_RETRY, it's guaranteed to remain there all along. Reviewed-by: Guo Ren (Alibaba Damo Academy) Signed-off-by: Al Viro commit a001cd248ab244633c5fabe4f7c707e13fc1d1cc Author: Sean Christopherson Date: Tue Aug 19 15:29:44 2025 -0700 rseq/selftests: Use weak symbol reference, not definition, to link with glibc Add "extern" to the glibc-defined weak rseq symbols to convert the rseq selftest's usage from weak symbol definitions to weak symbol _references_. Effectively re-defining the glibc symbols wreaks havoc when building with -fno-common, e.g. generates segfaults when running multi-threaded programs, as dynamically linked applications end up with multiple versions of the symbols. Building with -fcommon, which until recently has the been the default for GCC and clang, papers over the bug by allowing the linker to resolve the weak/tentative definition to glibc's "real" definition. Note, the symbol itself (or rather its address), not the value of the symbol, is set to 0/NULL for unresolved weak symbol references, as the symbol doesn't exist and thus can't have a value. Check for a NULL rseq size pointer to handle the scenario where the test is statically linked against a libc that doesn't support rseq in any capacity. Fixes: 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+") Reported-by: Thomas Gleixner Suggested-by: Florian Weimer Signed-off-by: Sean Christopherson Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/87frdoybk4.ffs@tglx commit 6eb350a2233100a283f882c023e5ad426d0ed63b Author: Thomas Gleixner Date: Wed Aug 13 17:02:30 2025 +0200 rseq: Protect event mask against membarrier IPI rseq_need_restart() reads and clears task::rseq_event_mask with preemption disabled to guard against the scheduler. But membarrier() uses an IPI and sets the PREEMPT bit in the event mask from the IPI, which leaves that RMW operation unprotected. Use guard(irq) if CONFIG_MEMBARRIER is enabled to fix that. Fixes: 2a36ab717e8f ("rseq/membarrier: Add MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ") Signed-off-by: Thomas Gleixner Reviewed-by: Boqun Feng Reviewed-by: Mathieu Desnoyers Cc: stable@vger.kernel.org commit fbfa8f4f3d4edeebf3a9a074a817512e403a5ad3 Merge: f1880f9cc14761 33815032b0a667 Author: Marc Kleine-Budde Date: Sat Sep 13 19:07:28 2025 +0200 Merge patch series "can: rcar_canfd: R-Car CANFD Improvements" Biju says: From: Biju Das The calculation formula for nominal bit rate of classical CAN is same as that of nominal bit rate of CANFD on the RZ/G3E SoC and R-Car Gen4 compared to other SoCs. Update the nominal bit rate constants. Apart from this, for replacing function-like macros, introduced rcar_canfd_compute_{nominal,data}_bit_rate_cfg(). v2->v3: * Replaced "shared_bittiming"->"shared_can_regs" as it is same for RZ/G3E and R-Car Gen4. * Updated commit header and description for patch#1. * Added Rb tag from Geert for patch #2,#3 and #4. * Dropped _MASK suffix from RCANFD_CFG_* macros. * Dropped _MASK suffix from RCANFD_NCFG_NBRP_MASK macro. * Dropped _MASK suffix from the macro RCANFD_DCFG_DBRP_MASK. * Followed the order as used in struct can_bittiming{_const} for easy maintenance. v1->v2: * Dropped patch#2 as it is accepted. * Moved patch#4 to patch#2. * Updated commit header and description for patch#2. * Kept RCANFD_CFG* macro definitions to give a meaning to the magic number using GENMASK macro and used FIELD_PREP to extract value. * Split patch#3 for computing nominal and data bit rate config separate. * Updated rcar_canfd_compute_nominal_bit_rate_cfg() to handle nominal bit rate configuration for both classical CAN and CANFD. * Replaced RCANFD_NCFG_NBRP->RCANFD_NCFG_NBRP_MASK and used FIELD_PREP to extract value. * Replaced RCANFD_DCFG_DBRP->RCANFD_DCFG_DBRP_MASK and used FIELD_PREP to extract value. Link: https://patch.msgid.link/20250908120940.147196-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 33815032b0a66769ca59ccdab07b45fff3bec070 Author: Biju Das Date: Mon Sep 8 13:09:33 2025 +0100 can: rcar_canfd: Simplify data bit rate config Introduce rcar_canfd_compute_data_bit_rate_cfg() for simplifying data bit rate configuration by replacing function-like macros. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20250908120940.147196-5-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 02d274adf485a0b3454dbedb4b4a36d97cb98fa8 Author: Biju Das Date: Mon Sep 8 13:09:32 2025 +0100 can: rcar_canfd: Simplify nominal bit rate config Introduce rcar_canfd_compute_nominal_bit_rate_cfg() for simplifying nominal bit rate configuration by replacing function-like macros. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20250908120940.147196-4-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 726213c8e79a615497816b76c9d236aaf8a47053 Author: Biju Das Date: Mon Sep 8 13:09:31 2025 +0100 can: rcar_canfd: Update RCANFD_CFG_* macros Update RCANFD_CFG_* macros to give a meaning to the magic number using GENMASK macro and extract the values using FIELD_PREP macro. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20250908120940.147196-3-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 100fafc3e46138cb5a6526ddc03dcede8b020c8c Author: Biju Das Date: Mon Sep 8 13:09:30 2025 +0100 can: rcar_canfd: Update bit rate constants for RZ/G3E and R-Car Gen4 The calculation formula for nominal bit rate of classical CAN is the same as that of nominal bit rate of CANFD on the RZ/G3E and R-Car Gen4 SoCs compared to other SoCs. Update nominal bit rate constants. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250908120940.147196-2-biju.das.jz@bp.renesas.com [mkl: slightly improve wording of commit message] Signed-off-by: Marc Kleine-Budde commit f1880f9cc1476171bec3dae8fd56fff5665e22a4 Author: Stéphane Grosjean Date: Fri Sep 12 10:17:19 2025 +0200 can: peak: Modification of references to email accounts being deleted With the upcoming deletion of @peak-system.com accounts and following the acquisition of PEAK-System and its brand by HMS-Networks, this fix aims to migrate all address references to @hms-networks.com, as well as to map my personal committer addresses to author addresses, while taking the opportunity to correct the accent on the first ‘e’ of my first name. Signed-off-by: Stéphane Grosjean Link: https://patch.msgid.link/20250912081820.86314-1-stephane.grosjean@free.fr Signed-off-by: Marc Kleine-Budde commit 4827dcc19cc7e80fcf5269f10b1cddf0b8e99e8e Author: Vincent Mailhol Date: Sun Aug 31 00:20:17 2025 +0900 can: dev: sort includes by alphabetical order Includes are out of order in drivers/net/can/dev/dev.c Sort them by alphabetical order. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250830152107.694201-2-mailhol@kernel.org Signed-off-by: Marc Kleine-Budde commit 39b8e0fef155e7fa58b8a3f521cd803189c5c53f Author: Vincent Mailhol Date: Tue Aug 26 19:48:39 2025 +0900 MAINTAINERS: update Vincent Mailhol's email address Now that I have received my kernel.org account, I am changing my email address from mailhol.vincent@wanadoo.fr to mailhol@kernel.org. The wanadoo.fr address was my first email which I created when I was a kid and has a special meaning to me, but it is restricted to a maximum of 50 messages per hour which starts to be problematic on threads where many people are CC-ed. Update all the MAINTAINERS entries accordingly and map the old address to the new one. I remain reachable from my old address. The different copyright notices mentioning my old address are kept as-is for the moment. I will update those one at a time only if I need to touch those files. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250826105255.35501-2-mailhol@kernel.org Signed-off-by: Marc Kleine-Budde commit 646cb48d447728f51957a96a70f919ee1b0fad07 Author: Xichao Zhao Date: Mon Aug 25 17:09:04 2025 +0800 can: m_can: use us_to_ktime() where appropriate The tx_coalesce_usecs_irq are more suitable for using the us_to_ktime(). This can make the code more concise and enhance readability. Signed-off-by: Xichao Zhao Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20250825090904.248927-1-zhao.xichao@vivo.com [mkl: remove not needed line break] Signed-off-by: Marc Kleine-Budde commit 0e2ee70291e64a30fe36960c85294726d34a103e Author: Thadeu Lima de Souza Cascardo Date: Wed Aug 20 16:08:16 2025 +0000 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. ``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ``` If we add a new entity with id 0 or a duplicated ID, it will be marked as UVC_INVALID_ENTITY_ID. In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require entities to have a non-zero unique ID"), we ignored all the invalid units, this broke a lot of non-compatible cameras. Hopefully we are more lucky this time. This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings. In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid. Here is a sample stack trace for one of those cases. [ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ? _raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1fd/0x290 [ 21.056413] uvc_probe+0x380e/0x3dc0 [ 21.056676] ? __lock_acquire+0x5aa/0x26e0 [ 21.056946] ? find_held_lock+0x33/0xa0 [ 21.057196] ? kernfs_activate+0x70/0x80 [ 21.057533] ? usb_match_dynamic_id+0x1b/0x70 [ 21.057811] ? find_held_lock+0x33/0xa0 [ 21.058047] ? usb_match_dynamic_id+0x55/0x70 [ 21.058330] ? lock_release+0x124/0x260 [ 21.058657] ? usb_match_one_id_intf+0xa2/0x100 [ 21.058997] usb_probe_interface+0x1ba/0x330 [ 21.059399] really_probe+0x1ba/0x4c0 [ 21.059662] __driver_probe_device+0xb2/0x180 [ 21.059944] driver_probe_device+0x5a/0x100 [ 21.060170] __device_attach_driver+0xe9/0x160 [ 21.060427] ? __pfx___device_attach_driver+0x10/0x10 [ 21.060872] bus_for_each_drv+0xa9/0x100 [ 21.061312] __device_attach+0xed/0x190 [ 21.061812] device_initial_probe+0xe/0x20 [ 21.062229] bus_probe_device+0x4d/0xd0 [ 21.062590] device_add+0x308/0x590 [ 21.062912] usb_set_configuration+0x7b6/0xaf0 [ 21.063403] usb_generic_driver_probe+0x36/0x80 [ 21.063714] usb_probe_device+0x7b/0x130 [ 21.063936] really_probe+0x1ba/0x4c0 [ 21.064111] __driver_probe_device+0xb2/0x180 [ 21.064577] driver_probe_device+0x5a/0x100 [ 21.065019] __device_attach_driver+0xe9/0x160 [ 21.065403] ? __pfx___device_attach_driver+0x10/0x10 [ 21.065820] bus_for_each_drv+0xa9/0x100 [ 21.066094] __device_attach+0xed/0x190 [ 21.066535] device_initial_probe+0xe/0x20 [ 21.066992] bus_probe_device+0x4d/0xd0 [ 21.067250] device_add+0x308/0x590 [ 21.067501] usb_new_device+0x347/0x610 [ 21.067817] hub_event+0x156b/0x1e30 [ 21.068060] ? process_scheduled_works+0x48b/0xaf0 [ 21.068337] process_scheduled_works+0x5a3/0xaf0 [ 21.068668] worker_thread+0x3cf/0x560 [ 21.068932] ? kthread+0x109/0x1b0 [ 21.069133] kthread+0x197/0x1b0 [ 21.069343] ? __pfx_worker_thread+0x10/0x10 [ 21.069598] ? __pfx_kthread+0x10/0x10 [ 21.069908] ret_from_fork+0x32/0x40 [ 21.070169] ? __pfx_kthread+0x10/0x10 [ 21.070424] ret_from_fork_asm+0x1a/0x30 [ 21.070737] Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675 Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b Reported-by: Youngjun Lee Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads") Cc: stable@vger.kernel.org Signed-off-by: Thadeu Lima de Souza Cascardo Co-developed-by: Ricardo Ribalda Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 0f99b8bed426b8f5434b10c3f6f6b92d7ce3c467 Author: Ricardo Ribalda Date: Mon Aug 18 20:15:39 2025 +0000 media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE The ChromeOS XU provides a control to change the IQ profile for a camera. It can be switched from VIVID (a.k.a. standard) to NONE (a.k.a. natural). Wire it up to the standard v4l2 control. Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 04ddfcdb711d94d05a5b4c8a8c3f9c283bbb518a Author: Ricardo Ribalda Date: Mon Aug 18 20:15:38 2025 +0000 media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls The function uvc_ctrl_init_ctrl() is called for every control for every entity, but it exits early if the entity is a extension unit. The comment claims that this is done to avoid querying XU controls during probe. We only query a control if its entity GUIDs and index matches the uvc_ctrls list. There are only controls for the following GUIDs: UVC_GUID_UVC_PROCESSING, UVC_GUID_UVC_CAMERA and UVC_GUID_EXT_GPIO_CONTROLLER. In other words, XU controls will not be queried even without this condition. In future patches we want to add ChromeOS XU controls that need to the initialized. We will make sure that all cameras with ChromeOS XU can be queried at probe time. Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c01ae95eeb145892f9ed325a5947ed2f108170c4 Author: Michal Pecio Date: Thu Sep 4 08:14:29 2025 +0200 media: uvcvideo: Shorten the transfer size non compliance message This message is much longer than others and doesn't fit even in a 160 column window when printed, despite providing little real information. Also replace 'transmission' with 'transfer' because that's the actual name and 'max packet' with 'limit' because it isn't same thing with isochronus endpoints. Remove cryptic abbreviations like 'ep'. Signed-off-by: Michal Pecio Reviewed-by: Ricardo Ribalda Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit eb5ec760c25b1fd0af3cc43fb0dbc8e5eba11025 Author: Ricardo Ribalda Date: Fri Jul 25 11:01:30 2025 +0000 media: uvcvideo: Do not re-reference dev->udev dev->udev is already referenced by the variable udev. Let's use it. Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 5cdbca8967dc804829883e251a9d197b5fab4aed Author: Ricardo Ribalda Date: Fri Jul 25 11:01:29 2025 +0000 media: uvcvideo: Use intf instead of udev for printks The UVC driver is a usb_interface driver. Use the correct device for printks to avoid confusions with other interface drivers associated to the same usb device. With this change: uvcvideo 3-6:1.0: Found UVC 1.10 device USB2.0 WebCam (1234:abcd) Without this change: usb 3-6: Found UVC 1.10 device USB2.0 WebCam (1234:abcd) Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 3e412a7b57c32410b05f659045a64c28b0acbb24 Author: Ricardo Ribalda Date: Fri Jul 25 13:12:49 2025 +0000 media: uvcvideo: Move video_device under video_queue It is more natural that the "struct video_device" belongs to uvc_video_queue instead of uvc_streaming. This is an aesthetic change. No functional change expected. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 97b6ff8603f2bdd8863a4d9b8b5432e8f3272b64 Author: Ricardo Ribalda Date: Fri Jul 25 13:12:48 2025 +0000 media: uvcvideo: Drop stream->mutex Since commit c93d73c9c2cf ("media: uvcvideo: Use vb2 ioctl and fop helpers"), the IOCTLs are serialized. Due to this there is no more need to protect ctrl, cur_format or cur_frame from concurrent access. Drop stream->mutex after thanking it for years of good service. Use this opportunity to do fix some CodeStyle. Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 1ab40529ad52f339975886a6a9e815dfdcb8d011 Author: Laurent Pinchart Date: Tue Jul 15 21:52:54 2025 +0300 media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header Move the MSXU_CONTROL_METADATA control definitino to the include/linux/usb/uvc.h header, alongside the corresponding XU GUID. Add a UVC_ prefix to avoid namespace clashes. While at it, add the definition for the other controls for that extension unit, as defined in https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/uvc-extensions-1-5#222-extension-unit-controls. Signed-off-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 50c320a5f7065de7b0bcba67f72d23e40188bc70 Author: Laurent Pinchart Date: Tue Jul 15 21:52:53 2025 +0300 media: uvcvideo: Add missing curly braces The uvc_meta_v4l2_try_format() function is missing curly braces on an outer for loop statement to comply with the driver coding style. Add them. Signed-off-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 1dcfbdb361c86c29b084432696f5d847c5599e2b Author: Laurent Pinchart Date: Tue Jul 15 21:52:52 2025 +0300 media: uvcvideo: Drop unneeded memset() in meta device ioctl handlers The .vidioc_g_fmt_meta_cap() and .vidioc_enum_fmt_meta_cap() ioctl handlers for meta capture devices memset the ioctl argument structure to zero. This is unnecessary as the memory is already zeroed by the V4L2 ioctl core. Drop the memset(), which, in uvc_meta_v4l2_enum_formats(), also allows further simplification as structure fields don't need to be saved and restored. Signed-off-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit e8e65d9237e590a953e17beb15bfd13dcfbe3ebf Author: Ricardo Ribalda Date: Wed Jul 16 10:43:44 2025 +0000 media: uvcvideo: Fix comments in uvc_meta_detect_msxu The comments can be more precise. Let's fix them. Fixes: 6cb786f040ad ("media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META") Cc: stable+noautosel@kernel.org # Coment change only, no need to backport Reviewed-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Signed-off-by: Hans de Goede Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f4da0de6b4b470a60c5c0cc4c09b0c987f9df35f Author: Desnes Nunes Date: Tue Jul 8 11:46:28 2025 -0300 media: uvcvideo: Avoid variable shadowing in uvc_ctrl_cleanup_fh This avoids a variable loop shadowing occurring between the local loop iterating through the uvc_entity's controls and the global one going through the pending async controls of the file handle. Fixes: 10acb9101355 ("media: uvcvideo: Increase/decrease the PM counter per IOCTL") Cc: stable@vger.kernel.org Signed-off-by: Desnes Nunes Reviewed-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit e67b5f8313229d058bddc88e29a73b9b6cdab7a9 Author: Darshan Rathod Date: Tue Jul 15 11:30:56 2025 +0000 media: uvcvideo: Fix assignment in if condition The function uvc_input_init() uses an assignment of the return value of input_register_device() within the condition of an if statement. This coding style is discouraged by the Linux kernel coding style guide as it can be confused with a comparison and hide potential bugs. The checkpatch.pl script flags this as an error: "ERROR: do not use assignment in if condition" Separate the assignment into its own statement before the conditional check to improve code readability and adhere to the kernel's coding standards. Signed-off-by: Darshan Rathod Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 671b9b6d7f4fe17a174c410397e72253877ca64e Author: Salah Triki Date: Sun Aug 24 13:06:09 2025 +0100 iio: pressure: bmp280: Use gpiod_set_value_cansleep() Replace `gpiod_set_value()` with `gpiod_set_value_cansleep()`, which is required when the GPIO controller is connected via a slow bus such as I2C. This is also safe to use in sleepable contexts like the driver probe function. Signed-off-by: Salah Triki Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6233067494ae034484882e37ece378fa08bca6a4 Author: Salah Triki Date: Mon Aug 18 10:27:31 2025 +0100 iio: pressure: bmp280: Remove noisy dev_info() Remove `dev_info()` call as it was considered noisy and is not necessary for normal driver operation. Signed-off-by: Salah Triki Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 299eb32863e584cfff7c6b667c3e92ae7d4d2bf9 Author: Alistair Popple Date: Sat Sep 13 23:12:23 2025 +0900 gpu: nova-core: Add base files for r570.144 firmware bindings Interacting with the GSP currently requires using definitions from C header files. Rust definitions for the types needed for Nova core will be generated using the Rust bindgen tool. This patch adds the base module to allow inclusion of the generated bindings. The generated bindings themselves are added by subsequent patches when they are first used. Currently we only intend to support a single firmware version, 570.144, with these bindings. Longer term we intend to move to a more stable GSP interface that isn't tied to specific firmware versions. Signed-off-by: Alistair Popple Reviewed-by: John Hubbard [acourbot@nvidia.com: adapt the bindings module comment a bit] Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-10-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit cb05748b4295d811e47f3adc324b021a919cd4d5 Author: Alexandre Courbot Date: Sat Sep 13 23:12:22 2025 +0900 gpu: nova-core: firmware: use 570.144 firmware 570.144 is the latest available into linux-firmware as of this commit, and the one we will use to start development of nova-core. It should eventually be dropped for a newer version before the driver becomes able to do anything useful. The newer firmware is expected to iron out some of the inelegances of 570.144, notably related to packaging. Reviewed-by: John Hubbard Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-9-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit 015b1d36505a1ad6830dc2ead65db2d36a209c23 Author: Alexandre Courbot Date: Sat Sep 13 23:12:21 2025 +0900 gpu: nova-core: firmware: process the GSP bootloader The GSP bootloader is a small RISC-V firmware that is loaded by Booter onto the GSP core and is in charge of loading, validating, and starting the actual GSP firmware. It is a regular binary firmware file containing a specific header. Create a type holding the DMA-mapped firmware as well as useful information extracted from the header, and hook it into our firmware structure for later use. The GSP bootloader is stored into the `GspFirmware` structure, since it is part of the GSP firmware package. This makes the `Firmware` structure empty, so remove it. Reviewed-by: John Hubbard Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-8-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit a841614e607c9e232dd56ec726ba63d2750025a2 Author: Alexandre Courbot Date: Sat Sep 13 23:12:20 2025 +0900 gpu: nova-core: firmware: process and prepare the GSP firmware The GSP firmware is a binary blob that is verified, loaded, and run by the GSP bootloader. Its presentation is a bit peculiar as the GSP bootloader expects to be given a DMA address to a 3-levels page table mapping the GSP firmware at address 0 of its own address space. Prepare such a structure containing the DMA-mapped firmware as well as the DMA-mapped page tables, and a way to obtain the DMA handle of the level 0 page table. Then, move the GSP firmware instance from the `Firmware` struct to the `start_gsp` method since it doesn't need to be kept after the GSP is booted. As we are performing the required ELF section parsing and radix3 page table building, remove these items from the TODO file. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-7-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit 3e5c9681bf86461d26e9db85eeb9b8cbaa256e6a Author: Alexandre Courbot Date: Sat Sep 13 23:12:19 2025 +0900 gpu: nova-core: firmware: process Booter and patch its signature The Booter signed firmware is an essential part of bringing up the GSP on Turing and Ampere. It is loaded on the sec2 falcon core and is responsible for loading and running the RISC-V GSP bootloader into the GSP core. Add support for parsing the Booter firmware loaded from userspace, patch its signatures, and store it into a form that is ready to be loaded and executed on the sec2 falcon. Then, move the Booter instance from the `Firmware` struct to the `start_gsp` method since it doesn't need to be kept after the GSP is booted. We do not run Booter yet, as its own payload (the GSP bootloader and firmware image) still need to be prepared. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-6-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit d6cb7319e64eecbdaa63e54a38dec03b30a4fdfd Author: Alexandre Courbot Date: Sat Sep 13 23:12:18 2025 +0900 gpu: nova-core: firmware: add support for common firmware header Several firmware files loaded from userspace feature a common header that describes their payload. Add basic support for it so subsequent patches can leverage it. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-5-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit ebe658732c6325aa3f4063726af00c0d12449d3c Author: Alexandre Courbot Date: Sat Sep 13 23:12:17 2025 +0900 gpu: nova-core: firmware: move firmware request code into a function When all the firmware files are loaded from `Firmware::new`, it makes sense to have the firmware request code as a closure. However, since we eventually want each individual firmware constructor to request its own file (and get rid of `Firmware` altogether), move this code into a dedicated function that can be called by individual firmware types. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-4-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit b345c917d7c1e3841d286560afca476ab7caff74 Author: Alexandre Courbot Date: Sat Sep 13 23:12:16 2025 +0900 gpu: nova-core: add Chipset::name() method There are a few cases where we need the lowercase name of a given chipset, notably to resolve firmware files paths for dynamic loading or to build the module information. So far, we relied on a static `NAMES` array for the latter, and some CString hackery for the former. Replace both with a new `name` const method that returns the lowercase name of a chipset instance. We can generate it using the `paste!` macro. Using this method removes the need to create a `CString` when loading firmware, and lets us remove a couple of utility functions that now have no user. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-3-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit e7c96980ea4d93e79b43b07c5489d700207b0055 Author: Alexandre Courbot Date: Sat Sep 13 23:12:15 2025 +0900 gpu: nova-core: move GSP boot code to its own module Right now the GSP boot code is very incomplete and limited to running FRTS, so having it in `Gpu::new` is not a big constraint. However, this will change as we add more steps of the GSP boot process, and not all GPU families follow the same procedure, so having these steps in a dedicated method is the logical construct. There is also the fact the GSP will require its own runtime data, and while it won't immediately need to be pinned, we want to be ready for the time where it will - most likely when it starts using mutexes. Thus, add an empty `Gsp` type that is pinned inside `Gpu` and initialized using a pin initializer. This sets the constraint we need to observe from the start, and could spare us some costly refactoring down the road. Then, move the code related to GSP boot to the `gsp::boot` module, as part of the `Gsp` implementation. Doing so allows us to make `Gpu::new` return a fallible `impl PinInit` instead of a `Result.` This is more idiomatic when working with pinned objects, and sets up the pinned initialization pattern we want to preserve as the code grows more complex. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-2-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit f0fbbff7e3082b0e1065aef83cc1418ed2cb1b69 Author: Alexandre Courbot Date: Sat Sep 13 23:12:14 2025 +0900 gpu: nova-core: require `Send` on `FalconEngine` and `FalconHal` We want to store the GSP and SEC2 falcon instances inside the `Gpu` structure, but doing so require these types to implement `Send` for `pci::Driver` to remain implementable on `NovaCore`, which embeds `Gpu`. All implementors of `FalconEngine` and `FalconHal` satisfy the requirements of `Send`, and these traits also already required `Sync`, so this a minor tweak. Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250913-nova_firmware-v6-1-9007079548b0@nvidia.com Signed-off-by: Alexandre Courbot commit bf99115eb2b8e7022e497290c1d4c585b56a6926 Author: David Lechner Date: Fri Sep 12 14:09:33 2025 -0500 iio: ABI: add filter types for ad7173 Add new filter types used in the ad7173 driver to the IIO ABI documentation. These chips have a few filter types that haven't been seen before in other drivers. Reviewed-by: Nuno Sá Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit ff06b39be1a1f5c97a6095e03a519967966819fe Author: David Lechner Date: Fri Sep 12 14:09:32 2025 -0500 iio: adc: ad7173: support changing filter type Add support for changing the filter type to the ad7173 driver. This family of chips by default uses a sinc5+sinc1 filter. There are also optional post-filters that can be added in this configuration for various 50/60Hz rejection purposes. The sinc3 filter doesn't have any post-filters and handles the output data rate (ODR) a bit differently. Here, we've opted to use SINC3_MAPx to get the maximum possible sampling frequencies with the SINC3 filter. Adding support consists of adding the filter_type and filter_type_available attributes, making the sampling_frequency attribute aware of the filter type, and programming the filter parameters when we configure the channel of the ADC for reading a sample. Reviewed-by: Nuno Sá Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit 27901cbc5bbcd4dbe0514999e08304074988a5d7 Author: David Lechner Date: Fri Sep 12 14:09:31 2025 -0500 iio: adc: ad7173: rename odr field Rename odr to sinc5_odr_index in the channel setup structure. In a following commit, we will be adding a separate odr field for when the sinc3 filter is used instead so having sinc5 in the name will help avoid confusion. And _index makes it more clear that this is an index of the sinc5_data_rates array and not the output data rate itself. Reviewed-by: Nuno Sá Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit 63cc48ea772e0aa9633ce91e70f6a7756d4060c9 Author: David Lechner Date: Fri Sep 12 14:09:30 2025 -0500 iio: adc: ad7173: rename ad7173_chan_spec_ext_info Rename ad7173_calibsys_ext_info[] to ad7173_chan_spec_ext_info[]. This array is not limited to calibration attributes, so the name should be more generic. Reviewed-by: Nuno Sá Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit 421d4487ef2ead206f57a8950ea9bdd1f7a7b39a Merge: 3422b4bc606eee 1b237f190eb3d3 Author: Jonathan Cameron Date: Sat Sep 13 15:00:48 2025 +0100 Merge tag 'v6.17-rc3' into togreg Linux 6.17-rc3 commit 3422b4bc606eee2ba7758ea9347c83332eeec3e3 Author: Duje Mihanović Date: Thu Sep 11 14:43:45 2025 +0200 iio: adc: Add driver for Marvell 88PM886 PMIC ADC Marvell's 88PM886 PMIC has a so-called General Purpose ADC used for monitoring various system voltages and temperatures. Add the relevant register definitions to the MFD header and a driver for the ADC. Acked-by: Karel Balej # for the PMIC Signed-off-by: Duje Mihanović Signed-off-by: Jonathan Cameron commit 0f06e28747b3d896b9c71c2a7e9f48061755162b Author: Duje Mihanović Date: Thu Sep 11 14:43:44 2025 +0200 dt-bindings: mfd: 88pm886: Add #io-channel-cells Add an #io-channel-cells property to the Marvell 88PM886 PMIC binding to allow referencing the IO channels exposed by its GPADC. Acked-by: Karel Balej # for the PMIC Acked-by: Krzysztof Kozlowski Signed-off-by: Duje Mihanović Signed-off-by: Jonathan Cameron commit 29cc0ac502a4804e624ffe152d720ba7dd28703c Author: David Lechner Date: Thu Sep 11 16:42:05 2025 -0500 iio: ABI: document "sinc4+rej60" filter_type Add a bullet point for "sinc4+rej60" filter_type that is used in the ad7124 driver. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit f1496949c75d8c77c6829fa5b2c7dcca2d1a0764 Author: David Lechner Date: Thu Sep 11 16:42:04 2025 -0500 iio: adc: ad7124: add filter support Add support to the ad7124 driver for selecting the filter type. The filter type has an influence on the effective sampling frequency of each channel. For sinc3+pf{1,2,3,4}, the sampling frequency is fixed. For sinc{3,4} (without post filter), there is a factor of 3 or 4 depending on the filter type. For the extra +sinc1, there is an extra averaging factor that depends on the power mode. In order to select the closest sampling frequency for each filter type, we keep a copy of the requested sampling frequency. This way, if the user sets the sampling frequency first and then selects the filter type, the sampling frequency will still be as close as possible to the requested value. Since we always either have the SINGLE_CYCLE bit set or have more than one channel enabled, the sampling frequency is always using the "zero-latency" calculation from the data sheet. This is only documented for the basic sinc{3,4} filters, so the other filter types had to be inferred and confirmed through testing. Since the flat filter type list consists of multiple register fields, the struct ad7124_channel_config::filter_type field is changed to the enum ad7124_filter_type type to avoid nested switch statements in a lot of places. Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit b2dbba2b9388636d0a6066c52f9507c7a7cdf40c Author: David Lechner Date: Thu Sep 11 16:42:03 2025 -0500 iio: adc: ad7124: support fractional sampling_frequency Modify the attribute read/write functions for sampling_frequency and filter_low_pass_3db_frequency to return fractional values. These ADCs support output data rates in the single digits, so being able to specify fractional values is necessary to use all possible sampling frequencies. Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit d904b8e6d4efadbcb4a4a0e077850cabbee513ed Author: David Lechner Date: Thu Sep 11 16:42:02 2025 -0500 iio: adc: ad7124: use guard(mutex) to simplify return paths Use guard(mutex) in a couple of functions to allow direct returns. This simplifies the code a bit and will make later changes easier. cleanup.h was already included for prior use of __free() Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1b4956cac19bb8bc9cf97ee8d3a7d5ee27871c7b Author: David Lechner Date: Thu Sep 11 16:42:01 2025 -0500 iio: adc: ad7124: use read_avail() for scale_available Replace custom attribute with the standard IIO read_avail() callback to provide in_voltage_scale_available attribute. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit faf7f9e72a57481448f5047bb3c7a951e9683952 Author: David Lechner Date: Thu Sep 11 16:42:00 2025 -0500 iio: adc: ad7124: use clamp() Use clamp() instead of open-coding clamping. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 08a9e5f8bb1e2233d19fb0c12f454e2d625532f5 Author: David Lechner Date: Wed Sep 10 12:33:29 2025 -0500 iio: adc: ad7124: fix sample rate for multi-channel use Change how the FS[10:0] field of the FILTER register is calculated to get consistent sample rates when only one channel is enabled vs when multiple channels are enabled in a buffered read. By default, the AD7124 allows larger sampling frequencies when only one channel is enabled. It assumes that you will discard the first sample or so to allow for settling time and then no additional settling time is needed between samples because there is no multiplexing due to only one channel being enabled. The conversion formula to convert between the sampling frequency and the FS[10:0] field is: fADC = fCLK / (FS[10:0] x 32) which is what the driver has been using. On the other hand, when multiple channels are enabled, there is additional settling time needed when switching between channels so the calculation to convert between becomes: fADC = fCLK / (FS[10:0] x 32 x N) where N depends on if SINGLE_CYCLE is set, the selected filter type and, in some cases, the power mode. The FILTER register has a SINGLE_CYCLE bit that can be set to force the single channel case to use the same timing as the multi-channel case. Before this change, the first formula was always used, so if all of the in_voltageY_sampling_frequency attributes were set to 10 Hz, then doing a buffered read with 1 channel enabled would result in the requested sampling frequency of 10 Hz. But when more than one channel was enabled, the actual sampling frequency would be 2.5 Hz per channel, which is 1/4 of the requested frequency. After this change, the SINGLE_CYCLE flag is now always enabled and the multi-channel formula is now always used. This causes the sampling frequency to be consistent regardless of the number of channels enabled. For now, we are hard-coding N = 4 since the driver doesn't yet support other filter types other than the default sinc4 filter. The AD7124_FILTER_FS define is moved while we are touching this to keep the bit fields in descending order to be consistent with the rest of the file. Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit ee905c92feb469daac1b48ae0db026f528f8b5f7 Author: Antoniu Miclaus Date: Mon Sep 8 07:35:26 2025 +0000 Documentation: ABI: iio: add sinc4+lp Add new filter type to the sysfs-bus-iio ABI documentation: - "sinc4+lp" for Sinc4 + Low Pass Filter Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 942ab02bc96f4a03c5221a8855d5fb0d27515e6a Author: Antoniu Miclaus Date: Mon Sep 8 07:35:25 2025 +0000 docs: iio: add documentation for ade9000 driver Add documentation for ade9000 driver which describes the driver device files and shows how the user may use the ABI for various scenarios (configuration, measurement, etc.). Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 81de7b4619fc3682a3bedaa7e8d6b2d67ab4e10a Author: Antoniu Miclaus Date: Mon Sep 8 07:35:24 2025 +0000 iio: adc: add ade9000 support Add driver support for the ade9000. highly accurate, fully integrated, multiphase energy and power quality monitoring device. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit a29d1137efd9c20b6801caf14f3b7a1053e75839 Author: Antoniu Miclaus Date: Mon Sep 8 07:35:23 2025 +0000 dt-bindings: iio: adc: add ade9000 Add devicetree bindings support for ade9000. Signed-off-by: Antoniu Miclaus Reviewed-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 70da02061499ca89ab92f7c4310f815d5fe674ec Author: Antoniu Miclaus Date: Mon Sep 8 07:35:22 2025 +0000 iio: add power and energy measurement modifiers Add new IIO modifiers to support power and energy measurement devices: Power modifiers: - IIO_MOD_ACTIVE: Real power consumed by the load - IIO_MOD_REACTIVE: Power that oscillates between source and load - IIO_MOD_APPARENT: Magnitude of complex power Signal quality modifiers: - IIO_MOD_RMS: Root Mean Square value Additionally adds: - IIO_CHAN_INFO_POWERFACTOR: Power factor channel info type for representing the ratio of active power to apparent power These modifiers enable proper representation of power measurement devices like energy meters and power analyzers. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit f15bc37d8c336e79491209b268e73868c44733c4 Author: Antoniu Miclaus Date: Mon Sep 8 07:35:21 2025 +0000 iio: add IIO_ALTCURRENT channel type Add support for IIO_ALTCURRENT channel type to distinguish AC current measurements from DC current measurements. This follows the same pattern as IIO_VOLTAGE and IIO_ALTVOLTAGE. Reviewed-by: David Lechner Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit abe629ebdabea4827f7c8f1c8fe79caf1fc4deb9 Author: Akshay Jindal Date: Wed Sep 10 01:16:46 2025 +0530 iio: light: ltr390: Implement runtime PM support Implement runtime power management for the LTR390 sensor. The device autosuspends after 1s of idle time, reducing current consumption from 100 µA in active mode to 1 µA in standby mode as per the datasheet. Ensure that interrupts continue to be delivered with runtime PM. Since the LTR390 cannot be used as a wakeup source during runtime suspend, therefore increment the runtime PM refcount when enabling events and decrement it when disabling events or powering down. This prevents event loss while still allowing power savings when IRQs are unused. Signed-off-by: Akshay Jindal Signed-off-by: Jonathan Cameron commit 2ba08d1bad79cc8d9c82f529adc01f27118e0ca7 Author: Takashi Sakamoto Date: Sat Sep 13 19:57:37 2025 +0900 firewire: core: use macro expression for not-registered state of BUS_MANAGER_ID The value of BUS_MANAGER_ID register has 0x3f when no node_id is registered. Current implementation uses hard-coded numeric literal but in the case the macro expression is preferable since it is easy to distinguish the state from node ID mask. This commit applies the idea. Link: https://lore.kernel.org/r/20250913105737.778038-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 91bf158f8cdf6fd344d3035a13ac746d5846de33 Author: Takashi Sakamoto Date: Sat Sep 13 19:57:36 2025 +0900 firewire: core: use macro expression for gap count mismatch The gap_count field is assigned to zero when mismatch is detected. In such case, the macro expression is preferable since it is easy to understand the situation. This commit applies the idea. Link: https://lore.kernel.org/r/20250913105737.778038-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit caffed0800ef4dd29cc29ee17a89d015e867e03a Author: Lukas Schmid Date: Sun Aug 31 18:25:34 2025 +0200 ARM: dts: sunxi: add support for NetCube Systems Nagami Keypad Carrier The NetCube Systems Nagami Keypad Carrier uses the Nagami SoM and contains a TCA8418 connected to a 4x4 matrix keypad. The I2C2 interface is connected to said TCA8418 and also a header for an PN532 NFC-Module. It also provides a pin-header for a bi-color status led. Ethernet with PoE support is available on a screwterminal after magnetics. Signed-off-by: Lukas Schmid Link: https://patch.msgid.link/20250831162536.2380589-6-lukas.schmid@netcube.li [wens@csie.org: fix indentation for board level compatible fallback, gpio-line-names and keypad matrix.] Signed-off-by: Chen-Yu Tsai commit e36d4d54eefb60144666b27754007e1c0dd0a581 Author: Lukas Schmid Date: Sun Aug 31 18:25:33 2025 +0200 ARM: dts: sunxi: add support for NetCube Systems Nagami Basic Carrier The NetCube Systems Nagami Basic Carrier is a Carrier for the Nagami SoM It provides an ethernet port for the phy on the SoM and some USB-Ports. All other interfaces and gpios are available on pinheader, except for the SD-Interface which is available on a micro-sd slot. Signed-off-by: Lukas Schmid Link: https://patch.msgid.link/20250831162536.2380589-5-lukas.schmid@netcube.li [wens@csie.org: fix indentation for board level compatible string fallback] Signed-off-by: Chen-Yu Tsai commit cba2febbd6465aabdff157fb95b1c07d090af1f0 Author: Lukas Schmid Date: Sun Aug 31 18:25:32 2025 +0200 ARM: dts: sunxi: add support for NetCube Systems Nagami SoM NetCube Systems Nagami SoM is a module based around the Allwinner T113s SoC. It includes the following features and interfaces: - 128MB DDR3 included in SoC - 10/100 Mbps Ethernet using LAN8720A phy - One USB-OTG interface - One USB-Host interface - One I2S interface with in and output support - Two CAN interfaces - ESP32 over SDIO - One SPI interface - I2C EEPROM for MAC address - One QWIIC I2C Interface with dedicated interrupt pin shared with EEPROM - One external I2C interface - SD interface for external SD-Card Signed-off-by: Lukas Schmid Link: https://patch.msgid.link/20250831162536.2380589-4-lukas.schmid@netcube.li [wens@csie.org: fix up pinctrl names for i2c* and i2s_d*; fix indentation for gpio-line-names and rmii_pe_pins; fix "pre-magnetics" typo in comment] Signed-off-by: Chen-Yu Tsai commit cbce6d5326b116f55dc29f7fc0a7d56a9a03d9e5 Author: Lukas Schmid Date: Sun Aug 31 18:25:31 2025 +0200 riscv: dts: allwinner: d1s-t113: Add pinctrl's required by NetCube Systems Nagami SoM Added the following pinctrl's used by the NetCube Systems Nagami SoM * i2c2_pins * i2c3_pins * i2s1_pins, i2s1_din_pins, i2s1_dout_pins * spi1_pins, spi1_hold_pin, spi1_wp_pin Signed-off-by: Lukas Schmid Link: https://patch.msgid.link/20250831162536.2380589-3-lukas.schmid@netcube.li [wens@csie.org: Fix up node names and labels for i2c* and i2s1_d* pins] Signed-off-by: Chen-Yu Tsai commit db5796c5c5c6db72339e818b54e6a2e043f7032c Author: Lukas Schmid Date: Sun Aug 31 18:25:30 2025 +0200 dt-bindings: arm: sunxi: Add NetCube Systems Nagami SoM and carrier board bindings The NetCube Systems Nagami is an System on Module base on the Allwinner T113s SoC. It is intended to be used in low cost devices which require simple layouts and low BOM cost. The NetCube Systems Nagami Basic Carrier Board is a simple carrier for the Nagami SoM. It is intended to serve as a simple reference design for a custom implementation or just evaluating the module with other peripherals The NetCube Systems Nagami Keypad Carrier is a custom board intended to fit a standard Ritto Intercom enclosure and provides a Keypad, NFC-Reader and Status-LED all controllable over Ethernet with PoE support. Signed-off-by: Lukas Schmid Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250831162536.2380589-2-lukas.schmid@netcube.li Signed-off-by: Chen-Yu Tsai commit b65ee02e77cb14486cf30709e978430e91f74d2e Author: J. Neuschäfer Date: Thu Sep 11 22:23:57 2025 +0200 ARM: dts: allwinner: Add Orange Pi Zero Interface Board overlay The Orange Pi Zero interface board is a (mostly) passive adapter from the 13-pin header of the Orange Pi Zero and Orange Pi Zero Plus2 to standard connectors (2x USB A, 1x Audio/Video output, 1x built-in microphone, 1x infrared input). Headphones, microphone, infrared (CIR) input, and USB have been tested with the Orange Pi Zero. CVBS output is currently not supported. https://orangepi.com/index.php?route=product/product&product_id=871 Signed-off-by: J. Neuschäfer Link: https://patch.msgid.link/20250911-opz-audio-v3-3-9dfd317a8163@posteo.net Signed-off-by: Chen-Yu Tsai commit fd5c7bf8ddb51373a6c9456865b3af99f53642a2 Author: J. Neuschäfer Date: Thu Sep 11 22:23:56 2025 +0200 ARM: dts: allwinner: orangepi-zero-plus2: Add default audio routing The Orange Pi Zero Plus 2 has the same pinout[1] as the Orange Pi Zero[2] (with the possible exception of line-out left/right being swapped), and the Orange Pi Zero Interface Board is sold[3] as compatible with both of them. We can thus use the same audio routing. [1]: http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-Zero-Plus-2.html [2]: https://linux-sunxi.org/Xunlong_Orange_Pi_Zero#Expansion_Port [3]: https://orangepi.com/index.php?route=product/product&product_id=871 Signed-off-by: J. Neuschäfer Link: https://patch.msgid.link/20250911-opz-audio-v3-2-9dfd317a8163@posteo.net Signed-off-by: Chen-Yu Tsai commit 3173a760021b9340923831aa5edc5530d61a6b9b Author: J. Neuschäfer Date: Thu Sep 11 22:23:55 2025 +0200 ARM: dts: allwinner: orangepi-zero: Add default audio routing Line out playback and microphone capture work, after enabling the corresponding ALSA controls. Tested with the Orange Pi Zero interface board. Signed-off-by: J. Neuschäfer Link: https://patch.msgid.link/20250911-opz-audio-v3-1-9dfd317a8163@posteo.net Signed-off-by: Chen-Yu Tsai commit a2d2e6ea1865d316e4f0c0bbd8275ffdc4ec62f5 Author: Janne Grunau Date: Tue Sep 9 13:54:43 2025 +0200 iommu/io-pgtable-dart: Fix off by one error in table index check The check for the dart table index allowed values of (1 << data->tbl_bits) while only as many entries are initialized in apple_dart_alloc_pgtable. This results in an array out of bounds access when data->tbl_bits is at its maximal value of 2. When data->tbl_bits is 0 or 1 an unset (initialized to zero) data->pgd[] entry is used. In both cases the value is used as pointer to read page table entries and results in dereferencing invalid pointers. There is no prior check that the passed iova is inside the iommu's IAS so invalid values can be passed from driver's calling iommu_map(). Fixes: 74a0e72f03ff ("iommu/io-pgtable-dart: Add 4-level page table support") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/asahi/aMACFlJjrZHs_Yf-@stanley.mountain/ Signed-off-by: Janne Grunau Signed-off-by: Joerg Roedel commit a1845487afd06899502714a3500b60f815d98203 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:10 2025 +0800 arm64: dts: allwinner: a523: Add NPU device node The Allwinner T527 SoC has an NPU built in. Based on identifiers found in the BSP, it is a Vivante IP block. After enabling it, the etnaviv driver reports it as a GC9000 revision 9003. The standard bindings are used as everything matches directly. There is no option for DVFS at the moment. That might require some more work, perhaps on the efuse side to map speed bins. It is unclear whether the NPU block is fused out at the hardware level or the BSP limits use of the NPU through software, as the author only has boards with the T527. Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250911174710.3149589-8-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit edd63e54e516b54c0b7071463d6e839445efab68 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:09 2025 +0800 arm64: dts: allwinner: a523: Add MCU PRCM CCU node Add a device node for the third supported clock controller found in the A523 / T527 SoCs. This controller has clocks and resets for the RISC-V MCU, and others peripherals possibly meant to operate in low power mode driven by the MCU, such as audio interfaces, an audio DSP, and the NPU. Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250911174710.3149589-7-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 304c75d2299996e51b4651e4203dfa83c13c7ef1 Merge: 8dc3f973b2ff7e 0f610e650d4e97 Author: Chen-Yu Tsai Date: Sat Sep 13 13:56:58 2025 +0800 Merge branch 'sunxi/shared-dt-headers-for-6.18' into sunxi/dt-for-6.18 commit 598e4b6713b54267acc257b3c66a269079ee4d8f Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:08 2025 +0800 clk: sunxi-ng: add support for the A523/T527 MCU CCU The A523/T527 SoCs have a new MCU PRCM, which has more clocks and reset controls for the RISC-V MCU and other peripherals. There is a second audio PLL, but no bus clock dividers. The BSP driver uses the 24MHz main oscillator as the parent for all the bus clocks. But the diagram suggests busses from the other PRCM are used in this block as well. Add a driver to support this part. Unlike the BSP driver, the SoC's main MBUS clock is chosen as the parent for the MCU MBUS clock, and the latter then serves as the parent of the MCU DMA controller's MBUS clock. The bus gate clocks also use their respective bus clocks as parents according to the system bus tree diagram. In cases where a block does not appear in that diagram, an educated guess is made. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250911174710.3149589-6-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 44293edd013e5ed48060e6a8848c215fd3bf8ce3 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:07 2025 +0800 clk: sunxi-ng: div: support power-of-two dividers Some clocks (for timers) on the A523 are mux-divider-gate types with the divider being values of power-of-two. Add a macro for these types of clocks so that we can use the divider types instead of the M-P types without an M divider. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250911174710.3149589-5-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 828dea389683d8e1df687fbd4521d391df369437 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:06 2025 +0800 clk: sunxi-ng: sun55i-a523-ccu: Add missing NPU module clock The main clock controller on the A523/T527 has the NPU's module clock. It was missing from the original submission, likely because that was based on the A523 user manual; the A523 is marketed without the NPU. Also, merge the private header back into the driver code itself. The header only contains a macro containing the total number of clocks. This has to be updated every time a missing clock gets added. Having it in a separate file doesn't help the process. Instead just drop the macro, and thus the header no longer has any reason to exist. Also move the .num value to after the list of clks to make it obvious that it should be updated when new clks are added. Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20250911174710.3149589-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 391aa264ce580e9814ff827c5bebacf2a539b0ab Merge: 7aa8781f379c32 0f610e650d4e97 Author: Chen-Yu Tsai Date: Sat Sep 13 13:50:11 2025 +0800 Merge branch 'sunxi/shared-dt-headers-for-6.18' into sunxi/clk-for-6.18 commit 0f610e650d4e979490ccfa4c22ca29ca547f41e7 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:05 2025 +0800 dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller There are four clock controllers in the A523 SoC. The existing binding already covers two of them that are critical for basic operation. The remaining ones are the MCU clock controller and CPU PLL clock controller. Add a description for the MCU CCU. This unit controls and provides clocks to the MCU (RISC-V) subsystem and peripherals meant to operate under low power conditions. Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250911174710.3149589-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit e9671ddd82eee96146a7359431a4e1f04ac2b076 Author: Chen-Yu Tsai Date: Fri Sep 12 01:47:04 2025 +0800 dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock The main clock controller on the A523/T527 has the NPU's module clock. It was missing from the original submission, likely because that was based on the A523 user manual; the A523 is marketed without the NPU. Reviewed-by: Andre Przywara Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250911174710.3149589-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 381e8ee368234a51b3a4f231f6f24ff0b09d9f9e Author: Ryo Takakura Date: Sat Sep 6 11:41:35 2025 +0000 crypto: omap - convert from tasklet to BH workqueue tasklet has been marked deprecated and it's planned to be removed. Make omap crypto drivers to use BH workqueue which is the new interface for executing in BH context in place of tasklet. Signed-off-by: Ryo Takakura Acked-by: Tejun Heo Signed-off-by: Herbert Xu commit 1e26339703e2afd397037defa798682b2b93dcc0 Author: Thorsten Blum Date: Fri Sep 5 18:39:11 2025 +0200 crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify adf_ctl_alloc_resources(). memdup_user() returns either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs. Remove the unnecessary device id initialization, since memdup_user() (like copy_from_user()) immediately overwrites it. No functional changes intended other than returning the more idiomatic error code -EFAULT. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 9048beca9c5614d486e2b492c0a7867164bf56a8 Author: Gaurav Jain Date: Fri Sep 5 15:41:48 2025 +0530 crypto: caam - double the entropy delay interval for retry during entropy evaluation, if the generated samples fail any statistical test, then, all of the bits will be discarded, and a second set of samples will be generated and tested. the entropy delay interval should be doubled before performing the retry. also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG status register, but only inst_handles is updated before every retry. so only check inst_handles and removing ctrlpriv->rng4_sh_init Signed-off-by: Gaurav Jain Signed-off-by: Herbert Xu commit 4fcd322914068f2c6aec7bb5cfd12ce0207b3a21 Author: Marco Crivellari Date: Fri Sep 5 11:05:33 2025 +0200 padata: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Herbert Xu commit b6d02e0e41aa87aaa46b9b995e71a585284c5d27 Author: Marco Crivellari Date: Fri Sep 5 11:05:32 2025 +0200 padata: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Herbert Xu commit a5d71f011ee1f211e437333555fd981e040c146c Author: Marco Crivellari Date: Fri Sep 5 10:57:01 2025 +0200 crypto: cryptd - WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Herbert Xu commit 9c6ed103a75756aadee0e4e6a1aa3b8187b55c22 Author: Eric Biggers Date: Thu Sep 4 20:04:28 2025 -0700 crypto: chelsio - Use library to prepare HMAC keys To prepare HMAC keys, just use the library functions instead of crypto_shash. This is much simpler, avoids depending on the fragile export_core and import_core methods, and is faster too. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 408cf4850f640f08470450569c209dc3fdfaf12d Author: Eric Biggers Date: Thu Sep 4 20:01:53 2025 -0700 crypto: qat - Use library to prepare HMAC keys To prepare HMAC keys, just use the library functions instead of crypto_shash. This is much simpler, avoids depending on the fragile export_core and import_core methods, and is faster too. Acked-by: Giovanni Cabiddu Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit a710a71cd8ad294937e03b352cd71deb7ad08700 Author: Qianfeng Rong Date: Wed Sep 3 21:25:37 2025 +0800 crypto: tegra - Use int type to store negative error codes Change the 'ret' variable in tegra_sha_do_update() from unsigned int to int, as it needs to store either negative error codes or zero returned by tegra_se_host1x_submit(). No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Herbert Xu commit a9a84a853c81b8ecc4ec601f9b04577cf1f86742 Author: Qianfeng Rong Date: Wed Sep 3 21:25:36 2025 +0800 crypto: hisilicon/sec - Use int type to store negative error codes Change the 'ret' variable in sec_hw_init() from u32 to int, as it needs to store either negative error codes or zero returned by sec_ipv4_hashmask(). No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Herbert Xu commit e002780c14392373b26f73890ed88365e97c1cd4 Author: Qianfeng Rong Date: Wed Sep 3 21:25:35 2025 +0800 crypto: ccp - Use int type to store negative error codes Change the 'ret' variable in __sev_do_cmd_locked() from unsigned int to int, as it needs to store negative error codes. No effect on runtime. Signed-off-by: Qianfeng Rong Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit 2b0dc40ac6ca16ee0c489927f4856cf9cd3874c7 Author: Yunseong Kim Date: Wed Sep 3 22:16:43 2025 +0900 crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() payload_size field of the request header is incorrectly calculated using sizeof(req). Since 'req' is a pointer (struct hsti_request *), sizeof(req) returns the size of the pointer itself (e.g., 8 bytes on a 64-bit system), rather than the size of the structure it points to. This leads to an incorrect payload size being sent to the Platform Security Processor (PSP), potentially causing the HSTI query command to fail. Fix this by using sizeof(*req) to correctly calculate the size of the struct hsti_request. Signed-off-by: Yunseong Kim Reviewed-by: Mario Limonciello (AMD) > --- Signed-off-by: Herbert Xu commit f5d643156ef62216955c119216d2f3815bd51cb1 Author: Thomas Fourier Date: Wed Sep 3 10:34:46 2025 +0200 crypto: atmel - Fix dma_unmap_sg() direction It seems like everywhere in this file, dd->in_sg is mapped with DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE. Fixes: 13802005d8f2 ("crypto: atmel - add Atmel DES/TDES driver") Cc: Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit 21140e5caf019e4a24e1ceabcaaa16bd693b393f Author: Thomas Fourier Date: Wed Sep 3 10:06:46 2025 +0200 crypto: rockchip - Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 57d67c6e8219 ("crypto: rockchip - rework by using crypto_engine") Cc: Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit 27d5a2d1ad94561994fe6b5ed3a2258039e9ac2b Author: Ovidiu Panait Date: Tue Sep 2 16:21:34 2025 +0300 crytpo: sun8i-ce - factor out prepare/unprepare from sun8i_ce_hash_run() In order to make the ahash code more clear and modular, split the monolithic sun8i_ce_hash_run() callback into two parts, prepare and unprepare (therefore aligning it with the sun8i-ce skcipher code). Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit c3a61eea658a9f6808a3d466a0978320b3855b49 Author: Ovidiu Panait Date: Tue Sep 2 16:21:33 2025 +0300 crypto: sun8i-ce - save hash buffers and dma info to request context Similar to sun8i-ce skcipher code, move all request-specific data to request context. This simplifies sun8i_ce_hash_run() and it eliminates the remaining kmalloc() calls from the digest path. Since the 'result' buffer in the request ctx struct is used for from-device DMA, it needs to be properly aligned to CRYPTO_DMA_ALIGN. Therefore: - increase reqsize by CRYPTO_DMA_PADDING - add __aligned(CRYPTO_DMA_ALIGN) attribute for the 'result' buffer - convert all ahash_request_ctx_dma() calls to ahash_request_ctx_dma() Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 49034c03b5814ba4257927be2916bdadfe281be7 Author: Ovidiu Panait Date: Tue Sep 2 16:21:32 2025 +0300 crypto: sun8i-ce - pass task descriptor to cipher prepare/unprepare To remove some duplicated code, directly pass 'struct skcipher_request' and 'struct ce_task' pointers to sun8i_ce_cipher_{prepare,unprepare}. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 2dc57f02f24957626f5c07e69486915eecc9ebd8 Author: Ovidiu Panait Date: Tue Sep 2 16:21:31 2025 +0300 crypto: sun8i-ce - fold sun8i_ce_cipher_run() into sun8i_ce_cipher_do_one() Fold sun8i_ce_cipher_run() into it's only caller, sun8i_ce_cipher_do_one(), to eliminate a bit of boilerplate. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 27eaada08c8c94f0d89225c8fd982320c68b9a80 Author: Ovidiu Panait Date: Tue Sep 2 16:21:30 2025 +0300 crypto: sun8i-ce - move bounce_iv and backup_iv to request context Currently, the iv buffers are allocated per flow during driver probe, which means that the buffers are shared by all requests. This works because the driver is not yet truly asynchronous, since it waits inside do_one_request() for the completion irq. However, the iv data is request-specific, so it should be part of the request context. Move iv buffers to request context. The bounce_iv buffer is aligned to sizeof(u32) to match the 'word address' requirement for the task descriptor's iv field. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit cedb1e9e9a6465ce0568588d6b8ff10b9826603e Author: Ovidiu Panait Date: Tue Sep 2 16:21:29 2025 +0300 crypto: sun8i-ce - add a new function for dumping task descriptors In order to remove code duplication, factor out task descriptor dumping to a new function sun8i_ce_dump_task_descriptors(). Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 6713d9842bd50463ce5f8e2ed056c4d843b9fee0 Author: Ovidiu Panait Date: Tue Sep 2 16:21:28 2025 +0300 crypto: sun8i-ce - remove unnecessary __maybe_unused annotations There are 3 instances of '__maybe_unused' annotations that are not needed, as the variables are always used, so remove them. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 01d7d3c3db778c89b4943cd70c2dc25c8ed96c4f Author: Ovidiu Panait Date: Tue Sep 2 16:21:27 2025 +0300 crypto: sun8i-ce - remove boilerplate in sun8i_ce_hash_digest() Retrieve the dev pointer from tfm context to eliminate some boilerplate code in sun8i_ce_hash_digest(). Signed-off-by: Ovidiu Panait Tested-by: Corentin LABBE Reviewed-by: Corentin LABBE Signed-off-by: Herbert Xu commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e Author: Ovidiu Panait Date: Tue Sep 2 16:21:26 2025 +0300 crypto: sun8i-ce - remove channel timeout field Using the number of bytes in the request as DMA timeout is really inconsistent, as large requests could possibly set a timeout of hundreds of seconds. Remove the per-channel timeout field and use a single, static DMA timeout of 3 seconds for all requests. Signed-off-by: Ovidiu Panait Tested-by: Corentin LABBE Reviewed-by: Corentin LABBE Signed-off-by: Herbert Xu commit fc006f5478fcf07d79b35e9dcdc51ecd11a6bf82 Author: Jonas Rebmann Date: Thu Sep 11 10:29:03 2025 +0200 net: phy: micrel: Update Kconfig help text This driver by now supports 17 different Microchip (formerly known as Micrel) chips: KSZ9021, KSZ9031, KSZ9131, KSZ8001, KS8737, KSZ8021, KSZ8031, KSZ8041, KSZ8051, KSZ8061, KSZ8081, KSZ8873MLL, KSZ886X, KSZ9477, LAN8814, LAN8804 and LAN8841. Support for the VSC8201 was removed in commit 51f932c4870f ("micrel phy driver - updated(1)") Update the help text to reflect that, list families instead of models to ease future maintenance. Signed-off-by: Jonas Rebmann Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250911-micrel-kconfig-v2-1-e8f295059050@pengutronix.de Signed-off-by: Jakub Kicinski commit bd569dd9352a6d2c192c994c5328bb4a97eaa19c Merge: 3456820e01f9b4 db99b2f2b3e2cd Author: Jakub Kicinski Date: Fri Sep 12 17:06:25 2025 -0700 Merge tag 'nf-next-25-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next 1) Don't respond to ICMP_UNREACH errors with another ICMP_UNREACH error. 2) Support fetching the current bridge ethernet address. This allows a more flexible approach to packet redirection on bridges without need to use hardcoded addresses. From Fernando Fernandez Mancera. 3) Zap a few no-longer needed conditionals from ipvs packet path and convert to READ/WRITE_ONCE to avoid KCSAN warnings. From Zhang Tengfei. 4) Remove a no-longer-used macro argument in ipset, from Zhen Ni. * tag 'nf-next-25-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_reject: don't reply to icmp error messages ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support netfilter: ipset: Remove unused htable_bits in macro ahash_region selftest:net: fixed spelling mistakes ==================== Link: https://patch.msgid.link/20250911143819.14753-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 3456820e01f9b40167e8438f5a43c76e4361c2d6 Author: Rob Herring (Arm) Date: Tue Sep 9 09:23:38 2025 -0500 dt-bindings: net: Drop duplicate brcm,bcm7445-switch-v4.0.txt The brcm,bcm7445-switch-v4.0.txt binding is already covered by dsa/brcm,sf2.yaml. The listed deprecated properties aren't used anywhere either. Signed-off-by: Rob Herring (Arm) Acked-by: Florian Fainelli Link: https://patch.msgid.link/20250909142339.3219200-2-robh@kernel.org Signed-off-by: Jakub Kicinski commit 903e6d05876f5b79df64468580b76622d372c167 Author: Russell King Date: Wed Sep 10 13:50:46 2025 +0100 net: mvneta: add support for hardware timestamps Add support for hardware timestamps in (e.g.) the PHY by calling skb_tx_timestamp() as close as reasonably possible to the point that the hardware is instructed to send the queued packets. Signed-off-by: Russell King Link: https://patch.msgid.link/E1uwKHe-00000004glk-3nkJ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6e3cb25e62f2081f19057f1abe62c014b8e814de Author: Akhil R Date: Mon Aug 18 10:03:45 2025 +0530 i2c: tegra: Add Tegra256 support Add compatible and the hardware struct for Tegra256. Tegra256 controllers use a different parent clock. Hence the timing parameters are different from the previous generations to meet the expected frequencies. Signed-off-by: Akhil R Acked-by: Thierry Reding Signed-off-by: Wolfram Sang commit 69329daf16af7d0ec189a760f28ea6a1ffb7f23a Author: Akhil R Date: Mon Aug 18 10:03:44 2025 +0530 dt-bindings: i2c: nvidia,tegra20-i2c: Add Tegra256 I2C compatible Add compatible for Tegra256 I2C controllers. Tegra256 consists of 8 generic Tegra I2C controllers similar to previous generations. The parent clock frequency is different in these controllers and hence the timing parameter values are different from the previous ones. Signed-off-by: Akhil R Acked-by: Rob Herring (Arm) Acked-by: Thierry Reding Signed-off-by: Wolfram Sang commit eddfe53b0d84b02802432bf783ccd53b095dd10a Author: Claudiu Beznea Date: Wed Aug 27 13:10:42 2025 +0300 i2c: core: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Signed-off-by: Wolfram Sang commit c90fa5493f7a96370c6774b4197d974b003fad7f Author: Manikanta Guntupalli Date: Thu Jul 31 18:25:35 2025 +0530 i2c: mux: pca9541: Use I2C adapter timeout value for arbitration timeout Remove existing arbitration timeout macros and use I2C adapter timeout value for arbitration timeout and forceful bus ownership. I2C adapter timeout can be configurable from user space, so using it for arbitration timeout helps in configuring the arbitration timeout from user space depending on the use case. Signed-off-by: Manikanta Guntupalli Signed-off-by: Wolfram Sang commit f77a13df57e803fe574dd29c5454088fcc6f3285 Author: Janne Grunau Date: Thu Aug 28 16:01:29 2025 +0200 dt-bindings: i2c: apple,i2c: Add apple,t6020-i2c compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,i2c" anymore [1]. Use "apple,t8103-i2c" as fallback compatible as it is the SoC the driver and bindings were written for. This block is compatible with t8103, so just add the new per-SoC compatible using apple,t8103-i2c as base. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Signed-off-by: Janne Grunau Acked-by: Andi Shyti Signed-off-by: Wolfram Sang commit 947e2d6414b3118bab920f1b0c27b4301dc5a361 Author: Denzeel Oliva Date: Sun Sep 7 22:13:38 2025 +0000 dt-bindings: i2c: exynos5: Add exynos990-hsi2c compatible Add samsung,exynos990-hsi2c dedicated compatible for representing I2C of Exynos990 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Denzeel Oliva Signed-off-by: Wolfram Sang commit c62859e13712334bd17d46ee0c1b26e8673d2961 Author: Wenmeng Liu Date: Fri Sep 12 23:19:25 2025 +0800 dt-bindings: i2c: qcom-cci: Document sa8775p compatible Add the sa8775p CCI device string compatible. Acked-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Wenmeng Liu Signed-off-by: Wolfram Sang commit 3e403c2faad9398fb70313f7cc0303c38f1ade9c Author: Loic Poulain Date: Thu Sep 11 23:21:01 2025 +0200 dt-bindings: i2c: qcom-cci: Document QCM2290 compatible The CCI on QCM2290 is the interface for controlling camera sensor over I2C. It requires only two clocks. Signed-off-by: Loic Poulain Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Wolfram Sang commit eea30c76012245efa87f427ca6d110d1674e433a Author: Niklas Cassel Date: Mon Sep 8 18:59:16 2025 +0200 PCI: qcom-ep: Remove redundant edma.nr_irqs initialization dw_pcie_edma_irq_verify() already parses device tree for either "dma" (if there is a single IRQ for all DMA channels) or "dmaX" (if there is one IRQ per DMA channel), and initializes dma.nr_irqs accordingly. Additionally, the probing of the eDMA driver will fail if neither "dma" nor "dmaX" is defined in the device tree. Therefore there is no need for a glue driver to specify edma.nr_irqs, so remove the redundant edma.nr_irqs initialization. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam [bhelgaas: fix typos] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250908165914.547002-4-cassel@kernel.org commit 09fefb24ed5e15f3b112f6c04b21a90ea23eaf8b Author: Niklas Cassel Date: Mon Sep 8 18:59:15 2025 +0200 PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() dw_pcie_edma_irq_verify() is supposed to verify the eDMA IRQs in devicetree by fetching them using either 'dma' or 'dmaX' IRQ names. Former is used when the platform uses a single IRQ for all eDMA channels and latter is used when the platform uses separate IRQ per channel. But currently, dw_pcie_edma_irq_verify() bails out early if edma::nr_irqs is 1, i.e., when a single IRQ is used. This gives an impression that the driver could work with any single IRQ in devicetree, not necessarily with name 'dma'. But dw_pcie_edma_irq_vector(), which actually requests the IRQ, does require the single IRQ to be named as 'dma'. So this creates inconsistency between dw_pcie_edma_irq_verify() and dw_pcie_edma_irq_vector(). Thus, to fix this inconsistency, make sure dw_pcie_edma_irq_verify() also verifies the single IRQ name by removing the bail out code. Signed-off-by: Niklas Cassel [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: fix typos] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250908165914.547002-3-cassel@kernel.org commit 5799d5d8a6c877f03ad5b5a640977053be45059a Author: David Kaplan Date: Fri Sep 12 10:24:28 2025 -0500 x86/bugs: Add attack vector controls for VMSCAPE Use attack vector controls to select whether VMSCAPE requires mitigation, similar to other bugs. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) commit f272210b28d050df56ec7dfaecb9fa3bebca6419 Author: Niklas Cassel Date: Mon Sep 8 18:19:42 2025 +0200 PCI: endpoint: pci-epf-test: Fix doorbell test support The doorbell feature temporarily overrides the inbound translation to point to the address stored in epf_test->db_bar.phys_addr, i.e., it calls set_bar() twice without ever calling clear_bar(), as calling clear_bar() would clear the BAR's PCI address assigned by the host. Thus, when disabling the doorbell, restore the inbound translation to point to the memory allocated for the BAR. Without this, running the PCI endpoint kselftest doorbell test case more than once would fail. Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20250908161942.534799-2-cassel@kernel.org commit fad8e97854504bcd2dc108703fc7d25749945097 Author: Lorenzo Pieralisi Date: Mon Aug 18 11:35:04 2025 +0200 PCI: of: Update parent unit address generation in of_pci_prop_intr_map() Some interrupt controllers require an #address-cells property in their bindings without requiring a "reg" property to be present. The current logic used to craft an interrupt-map property in of_pci_prop_intr_map() is based on reading the #address-cells property in the interrupt-parent and, if != 0, read the interrupt parent "reg" property to determine the parent unit address to be used to create the parent unit interrupt specifier. First of all, it is not correct to read the "reg" property of the interrupt-parent with an #address-cells value taken from the interrupt-parent node, because the #address-cells value define the number of address cells required by child nodes. More importantly, for all modern interrupt controllers, the parent unit address is irrelevant in hardware in relation to the device <-> interrupt-controller connection and the kernel actually ignores the parent unit address value when hierarchically parsing the interrupt-map property (i.e., of_irq_parse_raw()). For the reasons above, remove the code parsing the interrupt parent "reg" property in of_pci_prop_intr_map() -- it is not needed and prevents interrupt-map property generation on systems with an interrupt-controller that has no "reg" property in its interrupt-controller node -- and leave the parent unit address always initialized to 0 since it is simply ignored by the kernel. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Lizhi Hou Reviewed-by: Rob Herring Link: https://lore.kernel.org/lkml/aJms+YT8TnpzpCY8@lpieralisi/ Link: https://patch.msgid.link/20250818093504.80651-1-lpieralisi@kernel.org commit d4c3ed963e41d488695cf91068eabb8eb9f538ec Author: Nitin Gote Date: Thu Sep 11 10:58:23 2025 +0530 drm/xe: defer free of NVM auxiliary container to device release callback Do not kfree the intel_dg_nvm_dev in xe_nvm_fini() right after auxiliary_device_delete/uninit. The auxiliary_device embeds the device/kobject (and its name); freeing it too early can race with asynchronous device_del/udev processing and cause a use-after-free. Signed-off-by: Nitin Gote Fixes: c28bfb107dac ("drm/xe/nvm: add on-die non-volatile memory device") Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250911052823.226696-1-nitin.r.gote@intel.com Signed-off-by: Lucas De Marchi commit 035c17893082b403c98330f1fdb58fd925951038 Author: Ian Rogers Date: Mon Aug 25 14:12:04 2025 -0700 perf parse-events: Add 'X' modifier to exclude an event from being regrouped The function parse_events__sort_events_and_fix_groups is needed to fix uncore events like: ``` $ perf stat -e '{data_read,data_write}' ... ``` so that the multiple uncore PMUs have a group each of data_read and data_write events. The same function will perform architecture sorting and group fixing, in particular for Intel topdown/perf-metric events. Grouping multiple perf metric events together causes perf_event_open to fail as the group can only support one. This means command lines like: ``` $ perf stat -e 'slots,slots' ... ``` fail as the slots events are forced into a group together to try to satisfy the perf-metric event constraints. As the user may know better than parse_events__sort_events_and_fix_groups add a 'X' modifier to skip its regrouping behavior. This allows the following to succeed rather than fail on the second slots event being opened: ``` $ perf stat -e 'slots,slots:X' -a sleep 1 Performance counter stats for 'system wide': 6,834,154,071 cpu_core/slots/ (50.13%) 5,548,629,453 cpu_core/slots/X (49.87%) 1.002634606 seconds time elapsed ``` Closes: https://lore.kernel.org/lkml/20250822082233.1850417-1-dapeng1.mi@linux.intel.com/ Reported-by: Dapeng Mi Reported-by: Xudong Hao Reviewed-by: Dapeng Mi Signed-off-by: Ian Rogers Tested-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Greg Kroah-Hartman Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Yoshihiro Furudera Signed-off-by: Arnaldo Carvalho de Melo commit 9eac5612da1c91027fb842d42cdf228d8c93e350 Author: Ian Rogers Date: Mon Aug 25 14:12:03 2025 -0700 perf stat: Don't skip failing group events Pass errno to stat_handle_error() rather than reading errno after it has potentially been clobbered. Move "skippable" handling first as a skippable event (from the perf stat default list) should always just be skipped. Remove logic to skip rather than fail events in a group when they aren't the group leader. The original logic was added in commit cb5ef60067c1 ("perf stat: Error out unsupported group leader immediately") due to error handling and opening being together and an assertion being raised. Not failing this case causes broken groups to not report values, particularly for topdown events. Closes: https://lore.kernel.org/lkml/20250822082233.1850417-1-dapeng1.mi@linux.intel.com/ Reported-by: Dapeng Mi Reviewed-by: Dapeng Mi Signed-off-by: Ian Rogers Tested-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Greg Kroah-Hartman Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Yoshihiro Furudera Signed-off-by: Arnaldo Carvalho de Melo commit 7970e206e18f0d9c2c5e36d2dbdfb0d52902aa9d Author: Ian Rogers Date: Mon Aug 25 14:12:02 2025 -0700 perf evsel: Give warning for broken Intel topdown event grouping Extend arch_evsel__open_strerror() from just AMD IBS events to Intel core PMU events, to give a message when a slots event isn't a group leader or when a perf metric event is duplicated within an event group. As generating the warning happens after non-arch specific warnings are generated, disable the missing system wide (-a) flag warning for the core PMU. This assumes core PMU events should support per-thread/process and system-wide. Reviewed-by: Dapeng Mi Signed-off-by: Ian Rogers Tested-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Greg Kroah-Hartman Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Yoshihiro Furudera Signed-off-by: Arnaldo Carvalho de Melo commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 Author: Yunseong Kim Date: Fri Aug 22 16:25:08 2025 +0000 perf util: Fix compression checks returning -1 as bool The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1. A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers. Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch. Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function") Reviewed-by: Ian Rogers Signed-off-by: Yunseong Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Stephen Brennan Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com Signed-off-by: Arnaldo Carvalho de Melo commit 94d4dfbbe8e011667934d2f681db5c8a2747fe8d Author: Yunseong Kim Date: Fri Aug 22 23:58:56 2025 +0900 perf arm64: Sync ESR_ELx_EC_* macros in arm64_exception_types.h with esr.h Update perf util arm64_exception_types.h to match the exception class macros defined in tools/arch/arm64/include/asm/esr.h. This ensures consistency between perf tooling and the kernel header definitions for ESR_ELx_EC_* values. In v2, ESR_ELx_EC_OTHER and ESR_ELx_EC_GCS, which were missing in v1, were included. Reviewed-by: Leo Yan Signed-off-by: Yunseong Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Levi Yun Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Link: https://lore.kernel.org/r/20250822145855.53071-2-ysk@kzalloc.com Signed-off-by: Arnaldo Carvalho de Melo commit baa03483fdf3545f2b223a4ca775e1938d956284 Author: GuoHan Zhao Date: Mon Sep 8 14:52:03 2025 +0800 perf drm_pmu: Fix fd_dir leaks in for_each_drm_fdinfo_in_dir() Fix file descriptor leak when callback function returns error. The function was directly returning without closing fdinfo_dir_fd and fd_dir when cb() returned non-zero value. Fixes: 28917cb17f9df9c2 ("perf drm_pmu: Add a tool like PMU to expose DRM information") Reviewed-by: Ian Rogers Reviewed-by: Markus Elfring Reviewed-by: Namhyung Kim Signed-off-by: GuoHan Zhao Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250908065203.22187-1-zhaoguohan@kylinos.cn Signed-off-by: Arnaldo Carvalho de Melo commit 3760401981f18c427cacea41921620806c06c4bd Merge: cf4fd52e323604 42415d163e5df6 Author: Danilo Krummrich Date: Fri Sep 12 20:06:56 2025 +0200 Merge tag 'pin-init-v6.18' of https://github.com/Rust-for-Linux/linux into drm-rust-next pin-init changes for v6.18 Changed: - `#[pin_data]` now generates a `*Projection` struct similar to the `pin-project` crate. - Add initializer code blocks to `[try_][pin_]init!` macros: make initializer macros accept any number of `_: {/* arbitrary code */},` & make them run the code at that point. - Make the `[try_][pin_]init!` macros expose initialized fields via a `let` binding as `&mut T` or `Pin<&mut T>` for later fields. Upstream dev news: - Released v0.0.10 before the changes included in this tag. - Inform users of the impending rename from `pinned-init` to `pin-init` (in the kernel the rename already happened). - More CI improvements. Signed-off-by: Danilo Krummrich From: Benno Lossin Link: https://lore.kernel.org/r/20250912174148.373530-1-lossin@kernel.org commit 2ec29456254822f638bd9673a225ea0eb2245382 Author: Lucas De Marchi Date: Thu Sep 11 12:36:26 2025 -0700 drm/xe/configfs: Fix documentation warning Fix this warning while building the documentation: Documentation/gpu/xe/xe_configfs:9: drivers/gpu/drm/xe/xe_configfs.c:138: WARNING: Definition list ends without a blank line; unexpected unindent. That also makes it better formatted in the output. While at it, also fix the underline length in "Overview". Fixes: e2b33fce5eb0 ("drm/xe/configfs: Improve documentation steps") Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250911-wa-bb-cmds-v4-2-c8f7e48f7eae@intel.com Signed-off-by: Lucas De Marchi commit c34f9868dfb3888e1475e98b0bf112c2add2ddcd Author: Lucas De Marchi Date: Thu Sep 11 12:36:25 2025 -0700 drm/xe: Update workaround documentation Bring it up to reality, better documenting the existing batch buffers, OOB rules and fixing some typos. Bspec: 60122 Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250911-wa-bb-cmds-v4-1-c8f7e48f7eae@intel.com Signed-off-by: Lucas De Marchi commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b Author: Christophe Leroy Date: Tue Aug 12 14:51:26 2025 +0200 watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog When the watchdog gets enabled with this driver, it leaves enough time for the core watchdog subsystem to start pinging it. But when the watchdog is already started by hardware or by the boot loader, little time remains before it fires and it happens that the core watchdog subsystem doesn't have time to start pinging it. Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") pinging was managed by the driver itself and the watchdog was immediately pinged by setting the timer expiry to 0. So restore similar behaviour by pinging it when enabling it so that if it was already enabled the watchdog timer counter is reloaded. Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") Signed-off-by: Christophe Leroy Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7c628fb8db079917ceee70bffb0e784d30cb553e Author: Wolfram Sang Date: Wed Aug 13 21:05:11 2025 +0200 watchdog: visconti: don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Reviewed-by: Nobuhiro Iwamatsu Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 28cee77baf63aa4e98b510753e5c7212ec5b6567 Author: Wolfram Sang Date: Wed Aug 13 21:05:10 2025 +0200 watchdog: rzv2h_wdt: don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 66036fa63a9b070a76100179d829d8d34e450e68 Author: Wolfram Sang Date: Wed Aug 13 21:05:09 2025 +0200 watchdog: rzg2l_wdt: don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9f2517f59d3638adf954ade6c461ad270b40adba Author: Sangwook Shin Date: Mon Aug 18 11:18:26 2025 +0900 watchdog: s3c2410_wdt: exynosautov9: Enable supported features Enable supported features for ExynosAutov9 SoC. - QUIRK_HAS_DBGACK_BIT - QUIRK_HAS_32BIT_CNT Reviewed-by: Sam Protsenko Signed-off-by: Sangwook Shin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c76c029ce568a1129fc6e59199558dcbe2a17de7 Author: Sangwook Shin Date: Mon Aug 18 11:18:25 2025 +0900 watchdog: s3c2410_wdt: exynosautov920: Enable QUIRK_HAS_32BIT_CNT Enable QUIRK_HAS_32BIT_CNT to ExynosAutov920 SoC which has 32-bit WTCNT. Reviewed-by: Sam Protsenko Signed-off-by: Sangwook Shin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a36c90ab4d28bebd12b679f85ff1c51ea96d8665 Author: Sangwook Shin Date: Mon Aug 18 11:18:24 2025 +0900 watchdog: s3c2410_wdt: Increase max timeout value of watchdog Increase max_timeout value from 55s to 3665038s (1018h 3min 58s) with 38400000 frequency system if the system has 32-bit WTCNT register. cat /sys/class/watchdog/watchdog0/max_timeout 3665038 [ 0.330082] s3c2410-wdt 10060000.watchdog_cl0: Heartbeat: count=1099511400000, timeout=3665038, freq=300000 [ 0.330087] s3c2410-wdt 10060000.watchdog_cl0: Heartbeat: timeout=3665038, divisor=256, count=1099511400000 (fffffc87) [ 0.330127] s3c2410-wdt 10060000.watchdog_cl0: starting watchdog timer [ 0.330134] s3c2410-wdt 10060000.watchdog_cl0: Starting watchdog: count=0xfffffc87, wtcon=0001ff39 [ 0.330319] s3c2410-wdt 10060000.watchdog_cl0: watchdog active, reset enabled, irq disabled If the system has a 32-bit WTCNT, add QUIRK_HAS_32BIT_CNT to its quirk flags, and it will operate with a 32-bit counter. If not, it will operate with a 16-bit counter like in the previous version. Reviewed-by: Sam Protsenko Signed-off-by: Sangwook Shin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 Author: Sangwook Shin Date: Mon Aug 18 11:18:23 2025 +0900 watchdog: s3c2410_wdt: Fix max_timeout being calculated larger Fix the issue of max_timeout being calculated larger than actual value. The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) / S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder is discarded during the calculation process. This leads to a larger calculated value for max_timeout compared to the actual settable value. To resolve this issue, the order of calculations in the computation process has been adjusted. Reviewed-by: Sam Protsenko Signed-off-by: Sangwook Shin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e76bb4ee92dc6b4f21eb13d79b5c190b2e5a97e5 Author: Sangwook Shin Date: Mon Aug 18 11:18:22 2025 +0900 watchdog: s3c2410_wdt: Replace hardcoded values with macro definitions Modify the code to utilize macro-defined values instead of hardcoded values. The value 0x100 in the s3c2410wdt_set_heartbeat function represents S3C2410_WTCON_PRESCALE_MAX + 1, but it is hardcoded, making its meaning difficult to understand and reducing code readability. Reviewed-by: Sam Protsenko Reviewed-by: Alim Akhtar Signed-off-by: Sangwook Shin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 73ea1e92be46671d9a139578fdf5f6b93b7e85e4 Author: Lad Prabhakar Date: Wed Aug 20 21:23:22 2025 +0100 watchdog: rzv2h: Improve error strings and add newlines Update rzv2h_wdt_probe() to provide clearer error strings when retrieving the pclk, oscclk, and reset controller, and append missing newline characters to dev_err_probe() and dev_warn() calls for proper log formatting. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2b20697635276b0281a2a4abf70099c4377c51dc Author: Lad Prabhakar Date: Wed Aug 20 21:23:21 2025 +0100 watchdog: rzv2h: Add support for RZ/T2H Add support for the RZ/T2H watchdog timer. The RZ/T2H requires control of the watchdog counter using the WDT Debug Control Register (WDTDCR), which allows explicitly stopping and starting the counter. This behavior differs from RZ/V2H, which doesn't have WDTDCR, so the driver is extended to handle this requirement. To support this, a new `wdtdcr` flag is introduced in the `rzv2h_of_data` structure. When set, the driver maps the WDTDCR register and uses it to control the watchdog counter in the start, stop, and restart callbacks. Additionally, the clock divisor and count source for RZ/T2H are defined to match its hardware configuration. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ef6080fec60af92fc00b96743e85779927baf87b Author: Lad Prabhakar Date: Wed Aug 20 21:23:20 2025 +0100 watchdog: rzv2h: Add support for configurable count clock source Add support for selecting the count clock source used by the watchdog timer. The RZ/V2H(P) SoC uses the LOCO as the count source, whereas on RZ/T2H and RZ/N2H SoCs, the count source is the peripheral clock (PCLKL). Introduce a `count_source` field in the SoC-specific data structure and refactor the clock rate selection logic accordingly. This prepares the driver for supporting the RZ/T2H and RZ/N2H SoCs, which differ in their watchdog clocking architecture from RZ/V2H(P). Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6229b35298af8c3cb983d866e9da1c1ad4803cc6 Author: Lad Prabhakar Date: Wed Aug 20 21:23:19 2025 +0100 watchdog: rzv2h: Make "oscclk" and reset controller optional Update the rzv2h_wdt driver to make the "oscclk" clock and reset controller optional. Use devm_clk_get_optional_prepared() to obtain the "oscclk" clock, allowing the driver to work on platforms that do not provide this clock, such as the RZ/T2H SoC. Similarly, use devm_reset_control_get_optional_exclusive() to allow the driver to function on platforms that lack a reset controller. These changes are preparatory steps for supporting the RZ/T2H SoC, which does not provide an "oscclk" clock or a reset controller. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 19f7eaec4d9d1dcd8b49e14dbad56a65810c2910 Author: Lad Prabhakar Date: Wed Aug 20 21:23:18 2025 +0100 watchdog: rzv2h: Obtain clock-divider and timeout values from OF match data Update the rzv2h_wdt driver to fetch clock configuration and timeout parameters from device tree match data rather than relying on hardcoded constants. Introduce a new structure rzv2h_of_data that encapsulates minimum and maximum clock select values (cks_min and cks_max), clock divider (cks_div), timeout cycle count (timeout_cycles), and the timeout period select bits (tops). These values are provided through the OF match table and retrieved via of_device_get_match_data() during probe. This change allows dynamic configuration of the watchdog timer for different SoCs, such as the RZ/T2H, which require different settings. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 5cacd26436a66e24b1f0335a5d2b71eed4ab0d74 Author: Lad Prabhakar Date: Wed Aug 20 21:23:17 2025 +0100 dt-bindings: watchdog: renesas,wdt: Add support for RZ/T2H and RZ/N2H Extend the Renesas WDT device tree bindings to support the watchdog timer found on the RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. The RZ/T2H WDT is mostly compatible with the one found on the RZ/V2H(P), but includes an additional register and differs in the clock division ratio settings for the WDTCR[CKS] field. To reflect these differences, introduce a new compatible string, "renesas,r9a09g077-wdt". The binding schema is updated accordingly. On RZ/T2H, the WDT does not require the "resets" property. It also requires two register regions and the presence of a "power-domains" property. The "clock-names" property is limited to a single entry, "pclk", for this SoC. The RZ/N2H SoC uses the same WDT IP as the RZ/T2H. It is supported by using "renesas,r9a09g087-wdt" as the primary compatible string, with "renesas,r9a09g077-wdt" listed as a fallback to describe the shared hardware features. Example: wdt0: watchdog@80082000 { compatible = "renesas,r9a09g077-wdt"; reg = <0 0x80082000 0 0x400>, <0 0x81295100 0 0x04>; clocks = <&cpg CPG_CORE R9A09G077_CLK_PCLKL>; clock-names = "pclk"; power-domains = <&cpg>; status = "disabled"; }; Signed-off-by: Lad Prabhakar Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 Author: Guenter Roeck Date: Sun Aug 17 07:48:17 2025 -0700 watchdog: intel_oc_wdt: Do not try to write into const memory The code tries to update the intel_oc_wdt_info data structure if the watchdog is locked. That data structure is marked as const and can not be written into. Copy it into struct intel_oc_wdt and modify it there to fix the problem. Reported-by: Petar Kulić Cc: Diogo Ivo Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT") Signed-off-by: Guenter Roeck Reviewed-by: Diogo Ivo Tested-by: Diogo Ivo Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t Signed-off-by: Wim Van Sebroeck commit b595974b4afe0e171dd707da570964ff642742e3 Author: Antheas Kapenekakis Date: Thu Aug 14 15:01:51 2025 +0200 HID: asus: add Z13 folio to generic group for multitouch to work The Asus Z13 folio has a multitouch touchpad that needs to bind to the hid-multitouch driver in order to work properly. So bind it to the HID_GROUP_GENERIC group to release the touchpad and move it to the bottom so that the comment applies to it. While at it, change the generic KEYBOARD3 name to Z13_FOLIO. Reviewed-by: Luke D. Jones Signed-off-by: Antheas Kapenekakis Signed-off-by: Jiri Kosina commit 129d617c60c9101963f0af07dd8edfbe9d346056 Author: Raphael Gallais-Pou Date: Mon Sep 8 09:21:25 2025 +0200 ARM: dts: sti: remove dangling stih407-clock file Following the removal of B2120 board support, the st/stih407-clock.dtsi file has been left unused. Remove it. Fixes: dee546e1adef ("ARM: sti: drop B2120 board support") Signed-off-by: Raphael Gallais-Pou Reviewed-by: Patrice Chotard Signed-off-by: Patrice Chotard commit d927909d4d7a57fc27684e0761fa7ca1991ba115 Author: Tomasz Pakuła Date: Sat Aug 23 21:45:16 2025 +0200 HID: pidff: Fix possible null pointer dereference As reported by Dan Carpenter, if the axes_enable field wasn't found, trying to find the axes themselves will result in a null pointer dereference. This could only occur with a broken PID descriptor, but it's worth protecting from. Exit early if the axes_enable wasn't found AND add a gate to the pidff_find_special_keys to exit early if the passed HID field is null. This will protect again null dereferencing in the future and properly return 0 found special keys. Fixes: 1d72e7bd340b ("HID: pidff: Add support for AXES_ENABLE field") Reported-by: Dan Carpenter Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 8931f7b27993444adfc8cd1d3c6592cc167fb280 Author: Zhang Lixu Date: Thu Aug 21 10:06:09 2025 +0800 HID: intel-ish-ipc: Remove redundant ready check after timeout function timed_wait_for_timeout() internally checks for ish_is_input_ready() and ishtp_fw_is_ready() based on the provided parameters. If timed_wait_for_timeout() returns 0, it indicates the status is ready. In rare cases, another thread may send a message immediately after timed_wait_for_timeout() returns, causing a subsequent ish_is_input_ready() check to fail. Since the return value of timed_wait_for_timeout() is sufficient to determine readiness, the additional ready check is unnecessary and may introduce issues. This patch removes the redundant check and relies solely on the return value of timed_wait_for_timeout(). Fixes: ae02e5d40d5f ("HID: intel-ish-hid: ipc layer") Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 4c2c5ff9f3d72fb41f884f7c493ae9df83379340 Author: Benjamin Tissoires Date: Thu Aug 21 16:38:14 2025 +0200 HID: bpf: rescan the device for the group after a load/unload When a BPF gets loaded, it was previously not possible to bind a hid-generic device to hid-multitouch because the group was never updated. This change forces a rescan of the report descriptor after a bpf is loaded/unloaded so we set up the proper group. This was detected while Peter was trying to fix a Viewsonic device: the HID device sending multiotuch data through a proprietary collection was handled by hid-generic, and we don't have any way of attaching it to hid-multitouch because the pre-scanning wasn't able to see the Contact ID HID usage. Suggested-by: Peter Hutterer Reviewed-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 4e411a3f7bba10579bbeec3af77ae2a05c9e4259 Author: Benjamin Tissoires Date: Thu Aug 21 16:38:13 2025 +0200 HID: core: factor out hid_set_group() When we load a bpf, we can change the report descriptor. However, the current implementation doesn't change the group meaning that we can not rebind a device from hid-generic to hid-multitouch. This is a preparatory patch to force a rescan of the device after the bpf has been loaded. Signed-off-by: Benjamin Tissoires Reviewed-by: Peter Hutterer Signed-off-by: Jiri Kosina commit 4e1d3b5e6423dc841acd8691d75626b3d3b2b6a8 Author: Mallesh Koujalagi Date: Fri Sep 12 17:04:58 2025 +0530 drm/xe/hwmon: Remove type casting Refactor: eliminate type casts by using proper u32 declarations. v2: - Address review comments. (Karthik) v3: - Use the proper u32 type and drop cast. (Lucas De Marchi) - Modify variable when actually using u64 value. - Change r value to reg_value with u32 type. v4: - Remove newline between trailer and Signed-off-by. (Lucas De Marchi) - Change reg_val to val for more user-friendly logging. - Use mul_u32_u32 function since both values are u32. v5: - mul_u32_u32 function with shift. (Lucas De Marchi) Fixes: 7596d839f6228 ("drm/xe/hwmon: Add support to manage power limits though mailbox") Signed-off-by: Mallesh Koujalagi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250912113458.2815172-1-mallesh.koujalagi@intel.com Signed-off-by: Lucas De Marchi commit 10df039834f84a297c72ec962c0f9b7c8c5ca31a Author: Ling Xu Date: Fri Sep 12 14:12:36 2025 +0100 misc: fastrpc: Skip reference for DMA handles If multiple dma handles are passed with same fd over a remote call the kernel driver takes a reference and expects that put for the map will be called as many times to free the map. But DSP only updates the fd one time in the fd list when the DSP refcount goes to zero and hence kernel make put call only once for the fd. This can cause SMMU fault issue as the same fd can be used in future for some other call. Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131236.303102-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit da1ba64176e0138f2bfa96f9e43e8c3640d01e1e Author: Ling Xu Date: Fri Sep 12 14:12:35 2025 +0100 misc: fastrpc: fix possible map leak in fastrpc_put_args copy_to_user() failure would cause an early return without cleaning up the fdlist, which has been updated by the DSP. This could lead to map leak. Fix this by redirecting to a cleanup path on failure, ensuring that all mapped buffers are properly released before returning. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131236.303102-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 Author: Ling Xu Date: Fri Sep 12 14:12:34 2025 +0100 misc: fastrpc: Fix fastrpc_map_lookup operation Fastrpc driver creates maps for user allocated fd buffers. Before creating a new map, the map list is checked for any already existing maps using map fd. Checking with just map fd is not sufficient as the user can pass offsetted buffer with less size when the map is created and then a larger size the next time which could result in memory issues. Check for dma_buf object also when looking up for the map. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131236.303102-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8b5b456222fd604079b5cf2af1f25ad690f54a25 Author: Ling Xu Date: Fri Sep 12 14:12:33 2025 +0100 misc: fastrpc: Save actual DMA size in fastrpc_map structure For user passed fd buffer, map is created using DMA calls. The map related information is stored in fastrpc_map structure. The actual DMA size is not stored in the structure. Store the actual size of buffer and check it against the user passed size. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable@kernel.org Reviewed-by: Dmitry Baryshkov Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131236.303102-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 810b790033ccc795d55cbef3927668fd01efdfdf Author: Michael Walle Date: Fri Sep 12 14:13:47 2025 +0100 nvmem: layouts: fix automatic module loading To support loading of a layout module automatically the MODALIAS variable in the uevent is needed. Add it. Fixes: fc29fd821d9a ("nvmem: core: Rework layouts to become regular devices") Cc: stable@vger.kernel.org Signed-off-by: Michael Walle Reviewed-by: Miquel Raynal Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131347.303345-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 14be8b7b6cbc0a072c749e46e28d66e0ea6d0857 Author: Laurentiu Palcu Date: Mon Aug 4 16:14:50 2025 +0300 clk: imx95-blk-ctl: Save/restore registers when RPM routines are called When runtime PM is used for clock providers that are part of a power domain, the power domain supply is cut off during runtime suspend. This causes all BLK CTL registers belonging to that power domain to reset. To prevent this, save the state of the registers before entering suspend and restore them on resume. Additionally, disable the APB clock during suspend to minimize power consumption. Signed-off-by: Laurentiu Palcu Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250804131450.3918846-3-laurentiu.palcu@oss.nxp.com Signed-off-by: Abel Vesa commit aa1735d72bc085c4d107fb2017c597f83bb9490c Author: Laurentiu Palcu Date: Mon Aug 4 16:14:49 2025 +0300 clk: imx95-blk-ctl: Save platform data in imx95_blk_ctl structure Add a platform data (pdata) member to struct imx95_blk_ctl to store the result of of_device_get_match_data() during probe to avoid redundant calls in suspend and resume functions. Signed-off-by: Laurentiu Palcu Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250804131450.3918846-2-laurentiu.palcu@oss.nxp.com Signed-off-by: Abel Vesa commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 Author: Jiri Kosina Date: Fri Sep 12 16:27:35 2025 +0200 HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove() srws1_remove label can be only reached only if LEDS subsystem is enabled. To avoid putting horryfing ifdef second time around the label, just perform the cleanup and exit immediately directly. Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/ Signed-off-by: Jiri Kosina commit 82a051e2553b9e297cba82a975d9c538b882c79e Author: Ovidiu Panait Date: Fri Sep 12 13:13:22 2025 +0300 staging: axis-fifo: flush RX FIFO on read errors Flush stale data from the RX FIFO in case of errors, to avoid reading old data when new packets arrive. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") removed full FIFO resets from the read error paths, which fixed potential TX data losses, but introduced this RX issue. Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") Cc: stable@vger.kernel.org Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250912101322.1282507-2-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Author: Ovidiu Panait Date: Fri Sep 12 13:13:21 2025 +0300 staging: axis-fifo: fix TX handling on copy_from_user() failure If copy_from_user() fails, write() currently returns -EFAULT, but any partially written data leaves the TX FIFO in an inconsistent state. Subsequent write() calls then fail with "transmit length mismatch" errors. Once partial data is written to the hardware FIFO, it cannot be removed without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") removed a full FIFO reset for this case, which fixed a potential RX data loss, but introduced this TX issue. Fix this by introducing a bounce buffer: copy the full packet from userspace first, and write to the hardware FIFO only if the copy was successful. Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") Cc: stable@vger.kernel.org Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9e0b0fd5311ef68638abcd05306233b367c6b407 Author: Colin Ian King Date: Fri Sep 12 08:43:30 2025 +0100 drm/xe/guc: Fix spelling mistake "sheduling" -> "scheduling" There is a spelling mistake in a xe_gt_err error message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250912074330.1275279-1-colin.i.king@gmail.com Signed-off-by: Lucas De Marchi commit 2a810401aa054513f8f740af5e381c9e4f651d0d Author: Harish Chegondi Date: Wed Sep 10 18:27:41 2025 -0700 drm/xe/xe3: Extend Wa_18041344222 to graphics IP versions 30.00 and 30.01 Apply WA 18041344222 to Xe3 LPG graphics IP versions 30.00 and 30.01 too. Bspec: 56024 Cc: Matt Roper Cc: Matt Atwood Cc: Lucas De Marchi Signed-off-by: Harish Chegondi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/7368f8059013424ac94f4a01c23f9c98a37b06dc.1757552915.git.harish.chegondi@intel.com Signed-off-by: Lucas De Marchi commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:14 2025 +0200 arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible This devicetree contained only the SoC compatible but lacked the machine specific one: add a "mediatek,mt8516-pumpkin" compatible to the list to fix dtbs_check warnings. Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 09a1e9c973973aff26e66a5673c19442d91b9e3d Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:13 2025 +0200 arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes All of the MT6360 regulator nodes were wrong and would not probe because the regulator names are supposed to be lower case, but they are upper case in this devicetree. Change all nodes to be lower case to get working regulators. Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 45049abe5bcda5b049d22423f10f74e38041a435 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:12 2025 +0200 arm64: dts: mediatek: mt8195-cherry: Add missing regulators to rt5682 Add the missing DBVDD and LDO1-IN power supplies to the codec node as both RT5682i and RT5682s require those. This commit only fixes a dtbs_check warning but doesn't produce any functional changes because the VIO18 LDO is already powered on because it's assigned as AVDD supply anyway. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250724083914.61351-37-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit d0c8ecd9ec6d5222aade05dd63ab5dd36d52ab27 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:11 2025 +0200 arm64: dts: mediatek: mt8195-cherry: Move VBAT-supply to Tomato R1/R2 Move the VBAT supply to mt8195-cherry-tomato-{r1,r2} as this power supply is named like that only for the Realtek RT5682i codec. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250724083914.61351-36-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit a9eac43d039f86518595a8a731064309f1088fc6 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:10 2025 +0200 arm64: dts: mediatek: mt8195: Fix ranges for jpeg enc/decoder nodes The jpeg decoder main node is under the soc bus but currently has no ranges or reg specified, while the children do, and this is wrong in multiple aspects. The very same is also valid for the jpeg encoder node. Rename the decoder and encoder nodes to "jpeg-decoder@1a040000" and to "jpeg-encoder@1a030000" respectively, and change their children to use the newly defined ranges. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-35-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 0f4a8198d6825d75ae42ea01680a3a532d3ccb6f Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:09 2025 +0200 arm64: dts: mediatek: mt8183-kukui: Move DSI panel node to machine dtsis Not all of the kukui machines have got a real DSI panel, infact, some of those have got a DSI to eDP bridge instead: this means that the address and size cells are necessary in the first case but unnecessary in the latter. Instead of adding a bunch of /delete-node/ which would impact on human readability, move the entire panel node declaration to each of the relevant Kukui machine dtsi: even though this introduces some duplication, the advantages in readability surclass that. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250724083914.61351-34-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit e72d63fa0563f8a6e98c10fed3a9ce74dc0536e6 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:08 2025 +0200 arm64: dts: mediatek: mt8183: Migrate to display controller OF graph The display related IPs in MT8183 are flexible and support being interconnected with different instances of DDP IPs forming a full Display Data Path that ends with an actual display output, which is board specific. Add a common graph in the main mt8183.dtsi devicetree, which is shared between all of the currently supported boards, and do it such that only a very minimal amount of changes are needed to each board - the only required change was done in mt8183-pumpkin, using a phandle to assign the display to DPI0. All boards featuring any display functionality will extend this common graph to hook the display controller of the SoC to their specific output port(s). Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250724083914.61351-33-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 3808199f034fbf3633d99a97ce42a974bbe0fbe6 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:07 2025 +0200 arm64: dts: mediatek: mt8183-pumpkin: Add power supply for CCI Add a power supply for the Cache Coherent Interconnect node as it is required to perform CPU DVFS because both are scaling together. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250724083914.61351-32-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 181eb7d996d24a02487a627de9a47294174db7a7 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:06 2025 +0200 arm64: dts: mediatek: pumpkin-common: Fix pinctrl node names Fix the pinctrl node names to adhere to the bindings, as the main pin node is supposed to be named like "uart0-pins" and the pinmux node named like "pins-bus". Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-31-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 510e32c27e221ed9cccded07d5f56ecd82a01e2d Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:05 2025 +0200 arm64: dts: mediatek: mt8183: Fix pinctrl node names Fix the pinctrl node names to adhere to the bindings, as the main pin node is supposed to be named like "uart0-pins" and the pinmux node named like "pins-bus". Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-30-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit ca27e6078ffc1581ed5ec3ac36917d26668a4462 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:02 2025 +0200 arm64: dts: mediatek: acelink-ew-7886cax: Remove unnecessary cells in spi-nand There is no need to specify #address-cells and #size-cells in a node that has only one non-addressable subnode, and this is the case of the flash@0 node in this devicetree, as it has only one "partitions" subnode. Remove those to suppress an avoid_unnecessary_addr_size warning. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-27-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 1d0775def5e71cc8074edd85c6791b8780062737 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:01 2025 +0200 arm64: dts: mediatek: mt7986a-bpi-r3: Set interrupt-parent to mdio switch Being this an interrupt controller, the binding forbids to use interrupts-extended and wants an `interrupts` property instead. Since this interrupt controller's parent is on the GPIO controller set it as interrupt-parent and change interrupts-extended to just interrupts to silence a dtbs_check warning. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250724083914.61351-26-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit e11590394fc999c64a67b3a49f89e37fb839fb7d Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:39:00 2025 +0200 arm64: dts: mediatek: mt7986a-bpi-r3: Fix SFP I2C node names The binding wants the node to be named "i2c-number", alternatively "i2c@address", but those are named "i2c-gpio-number" instead. Rename those to i2c-0, i2c-1 to adhere to the binding and suppress dtbs_check warnings. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-25-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 6b3fff78c13f1a2ba5a355a101fa1ca0a13054ad Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:59 2025 +0200 arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address The PCIe TPHY is under the soc bus, which provides MMIO, and all nodes under that must use the bus, otherwise those would clearly be out of place. Add ranges to the PCIe tphy and assign the address to the main node to silence a dtbs_check warning, and fix the children to use the MMIO range of t-phy. Fixes: 963c3b0c47ec ("arm64: dts: mediatek: fix t-phy unit name") Fixes: 918aed7abd2d ("arm64: dts: mt7986: add pcie related device nodes") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-24-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 3f9f2a32ddcb18066656f793a7285ceeb4431ed7 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:58 2025 +0200 arm64: dts: mediatek: Fix node name for SYSIRQ controller on all SoCs The sysirq has "intpol-controller" as node name, but being this an interrupt controller, it needs to be named "interrupt-controller" as per what the bindings (correctly) expect. This commit brings no functional changes, but fixes a dtbs_check warning. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250724083914.61351-23-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 20be341f0b911a184934b17e9a9cf025da208974 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:57 2025 +0200 arm64: dts: mediatek: mt6795-sony-xperia-m5: Add pinctrl for mmc1/mmc2 Add pinctrl nodes for the MicroSD slot on mmc1 and SDIO Controller on mmc2 and assign those to the respective controller nodes. This makes sure that all of the pins are muxed in the right state and with the right pullup/down(s) before trying to use the mmc controllers. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250724083914.61351-22-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit ed68411e879e9bd512e266d3c46d4b35c5f5fbbc Author: Markus Schneider-Pargmann Date: Wed Sep 10 16:23:32 2025 -0500 serial: 8250: omap: Support wakeup pinctrl state on suspend UART can be used as a wakeup source for am62 from suspend to ram states. To enable wakeup from UART am62 requires a wakeup flag being set in the pinctrl. If the device is marked as wakeup enabled, select the 'wakeup' pinctrl state on suspend and restore the default pinctrl state on resume. Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Kendall Willis Link: https://lore.kernel.org/r/20250910-uart-daisy-chain-8250-omap-v2-2-e90d44c1a9ac@ti.com Signed-off-by: Greg Kroah-Hartman commit 49fce0730fd3c028982574c85eb2eb824d6e63f7 Author: Markus Schneider-Pargmann Date: Wed Sep 10 16:23:31 2025 -0500 dt-bindings: serial: 8250_omap: Add wakeup pinctrl state Pins associated with the 8250 omap unit can be the source of a wakeup in deep sleep states. To be able to wakeup, these pins have to be configured in a special way. To support this configuration add the default and wakeup pinctrl states. Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Kendall Willis Link: https://lore.kernel.org/r/20250910-uart-daisy-chain-8250-omap-v2-1-e90d44c1a9ac@ti.com Signed-off-by: Greg Kroah-Hartman commit 8d17dc05c94ce95a9c9fc7ca5f1b92f6561a9284 Author: Tapio Reijonen Date: Mon Sep 8 06:53:43 2025 +0000 serial: max310x: improve interrupt handling When there is a heavy load of receiving characters to all four UART's, the warning 'Hardware RX FIFO overrun' is sometimes detected. The current implementation always service first the highest UART until no more interrupt and then service another UART (ex: UART3 will be serviced for as long as there are interrupts for it, then UART2, etc). This commit handle all individual interrupt sources before reading the global IRQ register again. This commit has also a nice side-effect of improving the efficiency of the driver by reducing the number of reads of the global IRQ register. Signed-off-by: Tapio Reijonen Reviewed-by: Jiri Slaby Reviewed-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250908-master-max310x-improve-interrupt-handling-v3-1-91985e82ba39@vaisala.com Signed-off-by: Greg Kroah-Hartman commit 236681fb64102f25ed11df55999e6985c1bc2f7d Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:56 2025 +0200 arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value Change the latch-ck value from 0x14 to 4: as only bits [0-3] are actually used, the final value that gets written to the register field for DAT_LATCH_CK_SEL is just 0x4. This also fixes dtbs_check warnings. Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO") Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 4f6a808b36eb4cb1cfde4c46be8c64653c606d00 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:55 2025 +0200 arm64: dts: mediatek: mt6795: Add mediatek,infracfg to iommu node The "M4U" IOMMU requires a handle to the infracfg to switch to the 4gb/pae addressing mode: add it. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-20-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 50dd9ea91de1c0fa23a91ac9850f01c8d4e44172 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:54 2025 +0200 arm64: dts: mediatek: mt6797: Remove bogus id property in i2c nodes All of the I2C nodes in this devicetree has a bogus "id" property, which was probably specifying the I2C bus number. This property was never parsed and never used - and besides, it also gives dtbs_check warnings: remove it from all i2c nodes. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-19-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit fc702e7df456e219f029d0192fbc7cb357a16f4c Author: Edward Adam Davis Date: Tue Sep 9 08:51:22 2025 +0800 vt: move vc_saved_screen to within tty allocated judgment Everything starts with the assumption that a tty has been allocated. Therefore, Move it to within the tty allocation check. Fixes: 23743ba64709 ("vt: add support for smput/rmput escape codes") Reported-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6cb41c144427dc0796a Tested-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com Signed-off-by: Greg Kroah-Hartman commit 0daed4c3b6a6f863a40e6b6effa462c5a46f2949 Author: Akiyoshi Kurita Date: Fri Sep 12 15:44:06 2025 +0900 staging: rtl8723bs: fix typo in comment Fix a misspelling in a header comment: "configurtions" -> "configurations". Signed-off-by: Akiyoshi Kurita Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250912064406.707039-1-weibu@redadmin.org Signed-off-by: Greg Kroah-Hartman commit 5865a858dbc9cbb0f458d5954ff97971d3fd209f Author: Yiming Qian Date: Tue Sep 9 14:01:30 2025 +0800 staging: sm750fb: rename snake case variables Replaces CamelCase variable names with snake_case: - dprBase -> dpr_base - dpPortBase -> dp_port_base Signed-off-by: Yiming Qian Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250909060130.12919-3-qianym1996@gmail.com Signed-off-by: Greg Kroah-Hartman commit 02accdf0ca0242e040f14bbe96d9e9f29f8c95f5 Author: Yiming Qian Date: Tue Sep 9 14:01:29 2025 +0800 staging: sm750fb: remove unnecessary volatile qualifiers The use of 'volatile' for memory-mapped I/O pointers is discouraged in the Linux kernel as per Documentation/process/volatile-considered-harmful.rst. This patch removes the unnecessary 'volatile' qualifiers from the lynx_accel struct members, improving code quality and maintainability. Signed-off-by: Yiming Qian Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250909060130.12919-2-qianym1996@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6f19c1ef7f95fb432ba2b36d4634870d55e658ce Author: Akiyoshi Kurita Date: Tue Sep 9 14:33:26 2025 +0900 staging: rtl8723bs: rtw_efuse.h: simplify copyright banner Replace the banner-style copyright comment with a single-line comment. No functional changes. Signed-off-by: Akiyoshi Kurita Link: https://lore.kernel.org/r/20250909053327.140763-1-weibu@redadmin.org Signed-off-by: Greg Kroah-Hartman commit 6f8fb022ef2c6694e47f6e2f5676eb63be66c208 Author: Christophe Leroy Date: Mon Aug 18 11:57:15 2025 +0200 perf: Completely remove possibility to override MAX_NR_CPUS Commit 21b8732eb447 ("perf tools: Allow overriding MAX_NR_CPUS at compile time") added the capability to override MAX_NR_CPUS. At that time it was necessary to reduce the huge amount of RAM used by static stats variables. But this has been unnecessary since commit 6a1e2c5c2673 ("perf stat: Remove a set of shadow stats static variables"), and commit e8399d34d568 ("libperf cpumap: Hide/reduce scope of MAX_NR_CPUS") broke the build in that case because it failed to add the guard around the new definition of MAX_NR_CPUS. So cleanup things and remove guards completely to officialise it is not necessary anymore to override MAX_NR_CPUS. Fixes: e8399d34d568d61c ("libperf cpumap: Hide/reduce scope of MAX_NR_CPUS") Signed-off-by: Christophe Leroy Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/all/8c8553387ebf904a9e5a93eaf643cb01164d9fb3.1736188471.git.christophe.leroy@csgroup.eu/ Signed-off-by: Arnaldo Carvalho de Melo commit 013c09b7ac8c471fb721f0966b4e8f749cd5fdfa Author: Michael Straube Date: Mon Sep 8 08:12:43 2025 +0200 staging: rtl8723bs: remove unused tables Remove some unused tabels to get rid of dead code and thereby reduce the object file size by more than 1400 bytes. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250908061243.62692-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit e2258cfd9b9809002ad52f1f763ff192e612a1fe Author: Christian Marangi Date: Fri Sep 12 14:14:15 2025 +0100 nvmem: an8855: Add support for Airoha AN8855 Switch EFUSE Add support for Airoha AN8855 Switch EFUSE. These EFUSE might be used for calibration data for the internal switch PHYs. Signed-off-by: Christian Marangi Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131415.303407-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit ddb095e81d60902d76be250fa5f7f1d1e32f65ec Author: Christian Marangi Date: Fri Sep 12 14:14:14 2025 +0100 dt-bindings: nvmem: Document support for Airoha AN8855 Switch EFUSE Document support for Airoha AN8855 Switch EFUSE used to calibrate internal PHYs and store additional configuration info. Signed-off-by: Christian Marangi Reviewed-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131415.303407-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4a9b344e90c7ca654d7a469d0a467f90ef2add64 Author: Michael Walle Date: Fri Sep 12 14:14:13 2025 +0100 dt-bindings: nvmem: sl28cpld: add sa67mcu compatible The Kontron SMARC-sAM67 has the same nvmem layout as the SMARC-sAL28. To To be prepared for any board specific quirks, add a specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131415.303407-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5a356145e9683ec0b4cba6e455b6370d4fcbcd68 Author: Ciprian Costea Date: Fri Sep 12 14:14:12 2025 +0100 nvmem: s32g-ocotp: Add driver for S32G OCOTP Provide access to the On Chip One-Time Programmable Controller (OCOTP) pages on the NXP S32G platform. Signed-off-by: Ciprian Costea Co-developed-by: Ghennadi Procopciuc Signed-off-by: Ghennadi Procopciuc Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Dan Carpenter Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131415.303407-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9b58f88a1f48b75e98ebb03490340c48b54cb804 Author: Ciprian Costea Date: Fri Sep 12 14:14:11 2025 +0100 dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file Add bindings to expose the On Chip One-Time Programmable Controller (OCOTP) for the NXP s32g chipset. There are three versions of this chip but they're compatible so we can fall back to the nxp,s32g2-ocotp compatible. Signed-off-by: Ciprian Costea Signed-off-by: Dan Carpenter Reviewed-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131415.303407-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 698de37f78c7c0100f5506df36871c64588636e9 Author: Ling Xu Date: Fri Sep 12 14:13:02 2025 +0100 misc: fastrpc: add support for gdsp remoteproc Some platforms (like lemans) feature one or more GPDSPs (General Purpose DSPs). Similar to other kinds of Hexagon DSPs, they provide a FastRPC implementation, allowing code execution in both signed and unsigned protection domains. Extend the checks to allow domain names starting with "gdsp" (possibly followed by an index). Reviewed-by: Dmitry Baryshkov Reviewed-by: Ekansh Gupta Signed-off-by: Ling Xu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131302.303199-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit fb4679f628956e09467e66835025f9a9bcead238 Author: Ling Xu Date: Fri Sep 12 14:13:01 2025 +0100 misc: fastrpc: Cleanup the domain names Currently the domain ids are added for each instance of domains, this is totally not scalable approach. Clean this mess and create domain ids for only domains not its instances. Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Ekansh Gupta Signed-off-by: Ling Xu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131302.303199-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit d81c041ed5e444233daaa2d4b0f9ae4008c57f59 Author: Ling Xu Date: Fri Sep 12 14:13:00 2025 +0100 misc: fastrpc: Remove kernel-side domain checks from capability ioctl Domain ID in the uAPI is misleading. Remove checks and log messages related to 'domain' field in capability structure. Update UAPI to mark the field as unused. Reviewed-by: Dmitry Baryshkov Reviewed-by: Ekansh Gupta Signed-off-by: Ling Xu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131302.303199-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8de0848447b9d94db3c09e6aea62181ac1329706 Author: Ling Xu Date: Fri Sep 12 14:12:59 2025 +0100 dt-bindings: misc: qcom,fastrpc: Add GDSP label There are some products which support GDSP remoteprocs. GDSP is General Purpose DSP where tasks can be offloaded. There are 2 GDSPs named gdsp0 and gdsp1. Add "gdsp0" and "gdsp1" as the new supported labels for GDSP fastrpc domains. Acked-by: Krzysztof Kozlowski Reviewed-by: Ekansh Gupta Signed-off-by: Ling Xu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131302.303199-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit ae0de6333368fd8c4535f5dbdfe1b2660438e089 Author: Xichao Zhao Date: Fri Sep 12 14:12:02 2025 +0100 slimbus: messaging: fix "transfered"->"transferred" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131202.303026-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5c6794f16b22a0e66b5feffda39a81762ed27887 Author: Qiang Liu Date: Fri Sep 12 14:12:01 2025 +0100 slimbus: messaging: Remove redundant code Assigning txn->comp to itself has no effect. Signed-off-by: Qiang Liu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131202.303026-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7cbba32a2d62c3c18128c04f88b1901d702bb2bf Author: Srinivas Kandagatla Date: Fri Sep 12 14:12:00 2025 +0100 slimbus: qcom: remove unused qcom controller driver Qcom Slimbus controller driver is totally unused and dead code, there is no point in keeping this driver in the kernel without users. This patch removes the driver along with device tree bindings. Signed-off-by: Srinivas Kandagatla Acked-by: Rob Herring (Arm) Acked-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250912131202.303026-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit fed1a9d60fa39faa9b10b927681d85a81bcbe797 Author: Rodrigo Vivi Date: Thu Sep 11 17:20:25 2025 -0400 drm/xe: Fix circular locking dependency Fix this: ====================================================== WARNING: possible circular locking dependency detected 6.17.0-rc4-lgci-xe-xe-pw-153723v2+ #1 Tainted: G S U ------------------------------------------------------ xe_pm/11324 is trying to acquire lock: ffff8881085f22a0 (&pc->freq_lock){+.+.}-{3:3}, at: xe_guc_pc_start+0x39f/0xf70 [xe] but task is already holding lock: ffffffffa1020420 (xe_rpm_nod3cold_map){+.+.}-{0:0}, at: xe_rpm_lockmap_acquire+0x1a/0x70 [xe] which lock already depends on the new lock. Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(xe_rpm_nod3cold_map); lock(&pc->freq_lock); lock(xe_rpm_nod3cold_map); lock(&pc->freq_lock); Reported-by: Michal Wajdeczko Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6122 Fixes: 60d2b7899142 ("drm/xe/guc: Add SLPC power profile interface") Cc: Vinay Belgaumkar Reviewed-by: Vinay Belgaumkar Tested-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250911212024.966757-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi commit 3acbb5feafe0240ee769746f3e5861393f6fa5fd Merge: ce7d8a3e19e7f6 77a436c93d10d6 Author: Ulf Hansson Date: Fri Sep 12 15:19:21 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit ce7d8a3e19e7f62060b31d401339b81458587ce2 Author: Bean Huo Date: Thu Sep 11 23:06:06 2025 +0200 mmc: core: Improve RPMB frame handling code Introduce RPMB_FRAME_SIZE, CHECK_SIZE_NEQ(), and CHECK_SIZE_ALIGNED() macros to replace repetitive sizeof(struct rpmb_frame) checks in mmc_route_rpmb_frames(). Signed-off-by: Bean Huo Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson commit 072755cca7e743c28a273fcb69b0e826109473d7 Author: Bean Huo Date: Thu Sep 11 23:06:05 2025 +0200 mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() Rename the inner 'frm' variable to 'resp_frm' in the write path of mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable. The function declares 'frm' at function scope pointing to the request frame, but then redeclares another 'frm' variable inside the write block pointing to the response frame. This shadowing makes the code confusing and error-prone. Using 'resp_frm' for the response frame makes the distinction clear and improves code readability. Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") Reviewed-by: Avri Altman Reviewed-by: Jens Wiklander Signed-off-by: Bean Huo Signed-off-by: Ulf Hansson commit 1cc3d6c8640e4a75dab4077121b8cafd15eab8b0 Author: Josua Mayer Date: Thu Sep 11 20:28:07 2025 +0200 arm64: dts: marvell: cn9130-sr-som: add missing properties to emmc CN9130 System on Module connects an eMMC to ap_sdhci0, but the common properties indicating eMMC were not added to device-tree. Add no-sdio and non-removable as applicable to eMMC. Signed-off-by: Josua Mayer Signed-off-by: Gregory CLEMENT commit f338529ca9279e3bea392cb53cec8bd292909cb1 Author: Sarthak Garg Date: Mon Sep 8 16:11:21 2025 +0530 mmc: core: Parse and use the new max-sd-hs-hz DT property Introduce a new device tree flag to cap the maximum High-Speed (HS) mode frequency for SD cards, accommodating board-specific electrical limitations which cannot support the default 50Mhz HS frequency and others. Signed-off-by: Sarthak Garg Signed-off-by: Ulf Hansson commit 0b738a2901f43980fc2307a50a26457be1c8030b Author: Tomáš Macholda Date: Thu Sep 11 18:13:08 2025 +0200 arm64: dts: marvell: add dts for RIPE Atlas Probe v5 internet measurement device based on Turris MOX Signed-off-by: Tomáš Macholda Signed-off-by: Gregory CLEMENT commit d1a7bf9031b9f91b86187bcd5bd7a4bfd76bcaef Author: Tomáš Macholda Date: Thu Sep 11 18:13:07 2025 +0200 dt-bindings: marvell: armada-37xx: add ripe,atlas-v5 compatible Document compatible for RIPE Atlas Probe v5. Signed-off-by: Tomáš Macholda Acked-by: Krzysztof Kozlowski Signed-off-by: Gregory CLEMENT commit 98682689a1a443067e1981d9eed8c6ddcef8cdf3 Author: Sarthak Garg Date: Mon Sep 8 16:11:20 2025 +0530 dt-bindings: mmc: controller: Add max-sd-hs-hz property Introduce a new optional device tree property max-sd-hs-hz to limit the maximum frequency (in Hz) used for SD cards operating in High-Speed (HS) mode due to any board electrical limitations. Signed-off-by: Sarthak Garg Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b Author: Sarthak Garg Date: Mon Sep 8 16:11:19 2025 +0530 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path. To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's. Signed-off-by: Sarthak Garg Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit ce55f63137919a1d943b0d883a6ac3744108af0f Author: Monish Chunara Date: Mon Sep 8 13:49:51 2025 +0530 dt-bindings: mmc: sdhci-msm: Document the Lemans compatible Add the MSM SDHCI compatible name to support both eMMC and SD card for Lemans, which uses 'sa8775p' as the fallback SoC. Ensure the new compatible string matches existing Lemans-compatible formats without introducing a new naming convention. The SDHCI controller on Lemans is based on MSM SDHCI v5 IP. Hence, document the compatible with "qcom,sdhci-msm-v5" as the fallback. Signed-off-by: Monish Chunara Acked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Signed-off-by: Ulf Hansson commit 5c479a670a22ebf1bd23011054a0ec75d284e1d8 Merge: 0b5fe1c4ab3c29 303010f4658cb1 Author: Ulf Hansson Date: Fri Sep 12 14:27:31 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 0b5fe1c4ab3c2960b8b978122eba810f37f87aee Author: Tomi Valkeinen Date: Mon Sep 8 11:34:54 2025 +0300 pmdomain: ti-sci: Set PD on/off state according to the HW state At the moment the driver sets the power state of all the PDs it creates to off, regardless of the actual HW state. This has two drawbacks: 1) The kernel cannot disable unused PDs automatically for power saving, as it thinks they are off already 2) A more specific case (but perhaps applicable to other scenarios also): bootloader enabled splash-screen cannot be kept on the screen. The issue in 2) is that the driver framework automatically enables the device's PD before calling probe() and disables it after the probe(). This means that when the display subsystem (DSS) driver probes, but e.g. fails due to deferred probing, the DSS PD gets turned off and the driver cannot do anything to affect that. Solving the 2) requires more changes to actually keep the PD on during the boot, but a prerequisite for it is to have the correct power state for the PD. The downside with this patch is that it takes time to call the 'is_on' op, and we need to call it for each PD. In my tests with AM62 SK, using defconfig, I see an increase from ~3.5ms to ~7ms. However, the added feature is valuable, so in my opinion it's worth it. The performance could probably be improved with a new firmware API which returns the power states of all the PDs. There's also a related HW issue at play here: if the DSS IP is enabled and active, and its PD is turned off without first disabling the DSS display outputs, the DSS IP will hang and causes the kernel to halt if and when the DSS driver accesses the DSS registers the next time. With the current upstream kernel, with this patch applied, this means that if the bootloader enables the display, and the DSS driver is compiled as a module, the kernel will at some point disable unused PDs, including the DSS PD. When the DSS module is later loaded, it will hang the kernel. The same issue is already there, even without this patch, as the DSS driver may hit deferred probing, which causes the PD to be turned off, and leading to kernel halt when the DSS driver is probed again. This issue has been made quite rare with some arrangements in the DSS driver's probe, but it's still there. With recent change from Ulf (e.g. commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync")), the sync state mechanism comes to rescue. It will keep the power domains enabled, until the drivers have probed, or the sync-state is triggered via some other mechanism (e.g. manually by the boot scripts). Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Tomi Valkeinen Signed-off-by: Ulf Hansson commit 8c2467dea393622123f66b38fa4ca695670eb656 Author: Krzysztof Kozlowski Date: Fri Sep 12 11:23:52 2025 +0200 pinctrl: Simplify printks with pOF format Print full device node name with %pOF format, so the code will be a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit e3c84c9408bbaead850daf5e5f515ea025821b57 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:53 2025 +0200 arm64: dts: mediatek: mt6797: Fix pinctrl node names Change the pinctrl node names to adhere to the binding: the main nodes are now named like "uart0-pins" and the children "pins-bus". Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-18-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 98967109c9c0e2de4140827628c63f96314099ab Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:52 2025 +0200 arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names The node names for "pmic", "regulators", "rtc", and "keys" are dictated by the PMIC MFD binding: change those to adhere to it. Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com Signed-off-by: Matthias Brugger commit 00637d92cb1e00e2f5c68a8504053c2ac41ac125 Author: Geert Uytterhoeven Date: Thu Sep 4 17:35:43 2025 +0200 mmc: sh_mmcif: Remove dummy PM resume callback Unassigned system sleep callbacks were always treated the same as dummy callbacks that just return zero. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Signed-off-by: Ulf Hansson commit c656c99c118b44bb360b0718fadfbf3754fd44d5 Author: Duje Mihanović Date: Wed Sep 3 12:51:39 2025 +0200 dt-bindings: mmc: sdhci-pxa: Add minItems to pinctrl-names Some older boards only require a default pinctrl. Add a minItems property so these don't cause dt-validate warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509030625.PBgLIAwG-lkp@intel.com/ Signed-off-by: Duje Mihanović Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 44bbcba50d55ca97e09b0eaa7c1e6bf97b9f425d Merge: daf161343a3904 38d627bc8522a6 Author: Greg Kroah-Hartman Date: Fri Sep 12 14:08:09 2025 +0200 Merge patch series "Support system sleep with offloaded usb transfers" into usb-next Guan-Yu Lin says: Wesley Cheng and Mathias Nyman's USB offload design enables a co-processor to handle some USB transfers, potentially allowing the system to sleep (suspend-to-RAM) and save power. However, Linux's System Sleep model halts the USB host controller when the main system isn't managing any USB transfers. To address this, the proposal modifies the system to recognize offloaded USB transfers and manage power accordingly. This way, offloaded USB transfers could still happen during system sleep (Suspend-to-RAM). This involves two key steps: 1. Transfer Status Tracking: Propose offload_usage and corresponding apis drivers could track USB transfers on the co-processor, ensuring the system is aware of any ongoing activity. 2. Power Management Adjustment: Modifications to the USB driver stack (xhci host controller driver, and USB device drivers) allow the system to sleep (Suspend-to-RAM) without disrupting co-processor managed USB transfers. This involves adding conditional checks to bypass some power management operations in the System Sleep model. Link: https://lore.kernel.org/r/20250911142051.90822-1-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman commit 38d627bc8522a6a2fd6f9454c8b3b5d3848f5f03 Author: Guan-Yu Lin Date: Thu Sep 11 14:20:16 2025 +0000 usb: host: enable USB offload during system sleep Sharing a USB controller with another entity via xhci-sideband driver creates power management complexities. To prevent the USB controller from being inadvertently deactivated while in use by the other entity, a usage-count based mechanism is implemented. This allows the system to manage power effectively, ensuring the controller remains available whenever needed. In order to maintain full functionality of an offloaded USB devices, several changes are made within the suspend flow of such devices: - skip usb_suspend_device() so that the port/hub are still active for USB transfers via offloaded path. - not suspending the endpoints which are used by USB interfaces marked with needs_remote_wakeup. Namely, skip usb_suspend_interface() and usb_hcd_flush_endpoint() on associated USB interfaces. This reserves a pending interrupt urb during system suspend for handling the interrupt transfer, which is necessary since remote wakeup doesn't apply in the offloaded USB devices when controller is still active. - not flushing the endpoints of actively offloaded USB devices. Given that the USB devices is used by another entity, unilaterally flush the endpoint might lead to unexpected behavior on another entity. - not suspending the xhci controller. This is done by skipping the suspend/resume callbacks in the xhci platform driver. Signed-off-by: Guan-Yu Lin Link: https://lore.kernel.org/r/20250911142051.90822-5-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250911142051.90822-5-guanyulin@google.com commit ef82a4803aabaf623bfcae07981406f1386eabf9 Author: Guan-Yu Lin Date: Thu Sep 11 14:20:15 2025 +0000 xhci: sideband: add api to trace sideband usage The existing sideband driver only registers sidebands without tracking their active usage. To address this, sideband will now record its active usage when it creates/removes interrupters. In addition, a new api is introduced to provide a means for other dirvers to fetch sideband activity information on a USB host controller. Signed-off-by: Guan-Yu Lin Link: https://lore.kernel.org/r/20250911142051.90822-4-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250911142051.90822-4-guanyulin@google.com commit 7f70b89b2be66c03ddc76d3ad8aebeeec4a9c505 Author: Guan-Yu Lin Date: Thu Sep 11 14:20:14 2025 +0000 usb: offload: add apis for offload usage tracking Introduce offload_usage and corresponding apis to track offload usage on each USB device. Offload denotes that there is another co-processor accessing the USB device via the same USB host controller. To optimize power usage, it's essential to monitor whether the USB device is actively used by other co-processor. This information is vital when determining if a USB device can be safely suspended during system power state transitions. Signed-off-by: Guan-Yu Lin Link: https://lore.kernel.org/r/20250911142051.90822-3-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250911142051.90822-3-guanyulin@google.com commit ddb473a51b4bf33d040d827ae9a8724ee5ef1a36 Author: Guan-Yu Lin Date: Thu Sep 11 14:20:13 2025 +0000 usb: xhci-plat: separate dev_pm_ops for each pm_event Separate dev_pm_ops for different power events such as suspend, thaw, and hibernation. This is crucial when xhci-plat driver needs to adapt its behavior based on different power state changes. Signed-off-by: Guan-Yu Lin Link: https://lore.kernel.org/r/20250911142051.90822-2-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250911142051.90822-2-guanyulin@google.com commit daf161343a3904f6699febbfb1e18d532371ba00 Author: Israel Cepeda Date: Thu Sep 11 20:13:43 2025 +0200 i2c: Add Intel USBIO I2C driver Add a a driver for the I2C auxbus child device of the Intel USBIO USB IO-expander used by the MIPI cameras on various new (Meteor Lake and later) Intel laptops. Co-developed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Israel Cepeda Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250911181343.77398-4-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit c122451ce04e6991316ed37bac41d45646942027 Author: Israel Cepeda Date: Thu Sep 11 20:13:42 2025 +0200 gpio: Add Intel USBIO GPIO driver Add a a driver for the GPIO auxbus child device of the Intel USBIO USB IO-expander used by the MIPI cameras on various new (Meteor Lake and later) Intel laptops. Reviewed-by: Linus Walleij Acked-by: Bartosz Golaszewski Co-developed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Israel Cepeda Link: https://lore.kernel.org/r/20250911181343.77398-3-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 121a0f839dbb397af5fabb701cea3e9983223e50 Author: Israel Cepeda Date: Thu Sep 11 20:13:41 2025 +0200 usb: misc: Add Intel USBIO bridge driver Add a driver for the Intel USBIO USB IO-expander used by the MIPI cameras on various new (Meteor Lake and later) Intel laptops. This is an USB bridge driver which adds auxbus child devices for the GPIO, I2C and SPI functions of the USBIO chip and which exports IO-functions for the drivers for the auxbus child devices to communicate with the USBIO device's firmware. Co-developed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Israel Cepeda Link: https://lore.kernel.org/r/20250911181343.77398-2-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 334ef450cc97b448ba0771f1e6c182eae0b50e7a Merge: cb730dac4a1870 512bf60226c621 Author: Linus Walleij Date: Fri Sep 12 14:04:31 2025 +0200 Merge tag 'renesas-pinctrl-for-v6.18-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.18 (take two) - Improve suspend/resume support on RZ/G2L family SoCs, - Miscellaneous fixes and improvements. Signed-off-by: Linus Walleij commit 21188e8d6d75900f35c2acc8baa5a6ed4aec5af7 Author: Krishna Kurapati Date: Sun Sep 7 23:44:12 2025 +0530 usb: dwc3: qcom: Implement glue callbacks to facilitate runtime suspend On Qualcomm DWC3 dual-role controllers, the conndone/disconnect events in device mode are generated by controller when software writes to QSCRATCH registers in Qualcomm Glue layer rather than the vbus line being routed to dwc3 core IP for it to recognize and generate these events. UTMI_OTG_VBUS_VALID bit of QSCRATCH_HS_PHY_CTRL register needs to be set to generate a connection done event and to be cleared for the controller to generate a disconnect event during cable removal. When the disconnect is not generated upon cable removal, the "connected" flag of dwc3 is left marked as "true" and it blocks suspend routines and for that to happen upon cable removal, the cable disconnect notification coming in via set_role call need to be provided to the Qualcomm glue layer as well. Currently, the way DWC3 core and Qualcomm legacy glue driver are designed, there is no mechanism through which the DWC3 core can notify the Qualcomm glue layer of any role changes which it receives via role switch. To register these glue callbacks at probe time, for enabling core to notify glue layer, the legacy Qualcomm driver has no way to find out when the child driver probe was successful since it does not check for the same during of_platform_populate. Hence implement the following glue callbacks for flattened Qualcomm glue driver: 1. set_role: To pass role switching information from drd layer to glue. This information is needed to identify NONE/DEVICE mode switch and modify QSCRATCH to generate connect-done event on device mode entry and disconnect event on cable removal in device mode. 2. run_stop: When booting up in device mode, if autouspend is enabled and userspace doesn't write UDC on boot, controller enters autosuspend. After this, if the userspace writes to UDC in the future, run_stop notifier is required to enable UTMI_OTG_VBUS_VALID of QSCRATCH so that connect done event is generated after run_stop(1) is done to finish enumeration. Acked-by: Thinh Nguyen Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20250907181412.2174616-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 643df901f7ead35a71552a61927ad665a15aa87f Author: Krishna Kurapati Date: Sun Sep 7 23:44:11 2025 +0530 usb: dwc3: core: Introduce glue callbacks for flattened implementations In certain situations like role switching, the glue layers need to be informed of these events, so that they can take any necessary action. But in non-flattened implementations, the glue drivers have no data on when the core driver probe was successful post invoking of_platform_ populate. Now that the core driver supports flattened implementations as well, introduce vendor callbacks that can be passed on from glue to core before invoking dwc3_core_probe. Introduce callbacks to notify glue layer of role_switch and run_stop changes. These can be used by flattened implementation of Qualcomm glue layer to generate connect/disconnect events in controller during cable connect and run stop modifications by udc in device mode. Acked-by: Thinh Nguyen Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20250907181412.2174616-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 5df186e2ef11dca3fb6f0f332dc09c4ac0bed870 Author: Haotien Hsu Date: Mon Aug 11 15:45:58 2025 +0800 usb: xhci: tegra: Support USB wakeup function for Tegra234 When the system is suspended, USB hot-plugging/unplugging can trigger wake events of the Tegra USB host controller. Enable support for USB wake-up events by parsing device-tree to see if the interrupts for the wake-up events are present and if so configure those interrupts. Note that if wake-up events are not present, still allow the USB host controller to probe as normal. Signed-off-by: Haotien Hsu Link: https://lore.kernel.org/r/20250811074558.1062048-5-haotienh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 7bf1158514e410310aec975e630cec99d4e4092f Author: Kuen-Han Tsai Date: Mon Aug 18 16:27:19 2025 +0800 usb: udc: Add trace event for usb_gadget_set_state While the userspace program can be notified of gadget state changes, timing issue can lead to missed transitions when reading the state value. Introduce a trace event for usb_gadget_set_state to reliably track state transitions. Signed-off-by: Kuen-Han Tsai Link: https://lore.kernel.org/r/20250818082722.2952867-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit e77ee1d2a8fa0f3179d4ac7b7d35b555da6a8cea Author: Herve Codina Date: Wed Sep 10 18:07:30 2025 +0200 usb: dwc2: Add support for 'maximum-speed' property The DWC2 IP can be properly integrated in a SoC to work at high-speed USB speed but some board issues, EMC constraints or any other reasons can lead to the need to limit this USB speed at board level. The device-tree 'maximum-speed' property already exists for this purpose but is not handled by the DWC2 driver. Fill this lack adding support for 'maximum-speed' property and so allow to limit the USB speed in device-tree (board description). Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20250910160730.585303-1-herve.codina@bootlin.com Signed-off-by: Greg Kroah-Hartman commit a5d2edb2c9fa48382aec1673c709c2919899527c Author: Xu Yang Date: Wed Sep 10 18:50:42 2025 +0800 usb: typec: tcpci: add wakeup support Add wakeup support for tcpci. If the user enables the wakeup file, call enable_irq_wake() during system suspend and disable_irq_wake() during system resume. Since this driver supports shared interrupts, mask the chip interrupt by default when wakeup is disabled to avoid affecting other IRQ users. Reviewed-by: Frank Li Reviewed-by: Badhri Jagan Sridharan Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20250910105042.695146-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit cb730dac4a1870ef66a7c3838fcd84de1809ddc7 Merge: 5e302106099efc d37db94b078197 Author: Linus Walleij Date: Fri Sep 12 14:01:06 2025 +0200 Merge tag 'samsung-pinctrl-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/samsung into devel Samsung pinctrl drivers changes for v6.18 1. Add pin controller drivers for new Axis ARTPEC-8 SoC. The SoC shares all main blocks, including the pin controller, with Samsung SoC, so same drivers and bindings are used. 2. Drop remaining support for Samsung S3C2410 SoC pin controllers. The actual SoC support was removed in January 2023, so this is just remaining cleanup. Signed-off-by: Linus Walleij commit 438f7cd41765dbe8830009a37f90145b7f05ed39 Author: Thomas Huth Date: Fri Mar 14 08:09:49 2025 +0100 microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Michal Simek Signed-off-by: Thomas Huth Link: https://lore.kernel.org/r/20250314071013.1575167-19-thuth@redhat.com Signed-off-by: Michal Simek commit f0bff4e437960ac45c3078582c00f323b1339f96 Author: Thomas Huth Date: Fri Mar 14 08:09:48 2025 +0100 microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Michal Simek Signed-off-by: Thomas Huth Link: https://lore.kernel.org/r/20250314071013.1575167-18-thuth@redhat.com Signed-off-by: Michal Simek commit 70784d2e0453f8c90fadbf7b67c452ce784f1478 Author: Ahelenia Ziemiańska Date: Wed Jun 4 14:18:46 2025 +0200 microblaze: fix typos in Kconfig optimalize -> optimize, these configs turn the functions on instead of allowing them to be turned on, consistent pluralisation Signed-off-by: Ahelenia Ziemiańska Link: https://lore.kernel.org/r/2pg4pexvl2guyww56tnjrt3hjsb6bqtccmpkzt42sqz3igcq56@tarta.nabijaczleweli.xyz Signed-off-by: Michal Simek commit bcdf7a064c3c73cd97870a3ef5e4dd6214b28b79 Merge: 273532a0da0963 5c5f2221821a43 Author: Georgi Djakov Date: Fri Sep 12 13:54:17 2025 +0300 Merge branch 'icc-glymur' into icc-next Add interconnect dt-bindings and driver support for Qualcomm's next gen compute SoC - Glymur. * icc-glymur dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Glymur SoC interconnect: qcom: icc-rpmh: increase MAX_PORTS to support four QoS ports interconnect: qcom: add glymur interconnect provider driver Link: https://lore.kernel.org/r/20250814-glymur-icc-v2-0-596cca6b6015@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 273532a0da09638d0e981df3d012199e2af38447 Author: Raviteja Laggyshetty Date: Tue Aug 19 11:24:46 2025 +0000 dt-bindings: interconnect: Add OSM L3 compatible for QCS615 SoC Add Operation State Manager (OSM) L3 interconnect provider binding for QCS615 SoC. As the OSM hardware in QCS615 and SM8150 are same, added a family-level compatible for SM8150 SoC. Signed-off-by: Raviteja Laggyshetty Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819-talos-l3-icc-v3-1-04529e85dac7@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 2d1a7eb029f7d7a6e55f0ac6c7264f4bbd2f5510 Author: Zhang Enpei Date: Thu Aug 7 14:18:33 2025 +0800 interconnect: core: Use device_match_of_node() Make use of device_match_of_node() instead of open coding its functionality. Signed-off-by: Zhang Enpei Link: https://lore.kernel.org/r/20250807141833927wb2idY1sZi1OpUKkrXk44@zte.com.cn Signed-off-by: Georgi Djakov commit f5225a34bd8f9f64eec37f6ae1461289aaa3eb86 Author: Sumit Kumar Date: Wed Sep 10 18:11:09 2025 +0530 bus: mhi: ep: Fix chained transfer handling in read path The mhi_ep_read_channel function incorrectly assumes the End of Transfer (EOT) bit is present for each packet in a chained transactions, causing it to advance mhi_chan->rd_offset beyond wr_offset during host-to-device transfers when EOT has not yet arrived. This leads to access of unmapped host memory, causing IOMMU faults and processing of stale TREs. Modify the loop condition to ensure mhi_queue is not empty, allowing the function to process only valid TREs up to the current write pointer to prevent premature reads and ensure safe traversal of chained TREs. Due to this change, buf_left needs to be removed from the while loop condition to avoid exiting prematurely before reading the ring completely, and also remove write_offset since it will always be zero because the new cache buffer is allocated every time. Fixes: 5301258899773 ("bus: mhi: ep: Add support for reading from the host") Co-developed-by: Akhil Vinod Signed-off-by: Akhil Vinod Signed-off-by: Sumit Kumar [mani: reworded description slightly] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250910-final_chained-v3-1-ec77c9d88ace@oss.qualcomm.com commit 2f86054cc1a6792f0812d5f23f271a83848edabb Author: Krzysztof Kozlowski Date: Fri Sep 12 11:24:24 2025 +0200 firmware: arm_scmi: Simplify printks with pOF format Print full device node name with %pOF format, so the code will be a bit simpler. Signed-off-by: Krzysztof Kozlowski Message-Id: <20250912092423.162497-2-krzysztof.kozlowski@linaro.org> Signed-off-by: Sudeep Holla commit 01ecf00463975f5fc782b214cf3c34b7d8c4b74c Author: Michal Wajdeczko Date: Tue Sep 9 18:59:39 2025 +0200 drm/xe: Use tile-oriented messages in GGTT code Use recently added macros to print tile-oriented messages. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250909165941.31730-6-michal.wajdeczko@intel.com commit 48a8659cd5703e539a87f447fb5a0c59628cb742 Author: Michal Wajdeczko Date: Tue Sep 9 18:59:38 2025 +0200 drm/xe: Add dedicated printk macros for tile and device We already have dedicated helper macros for printing GT-oriented messages but we don't have any to print messages that are tile oriented and we wrongly try to use plain drm or GT-oriented ones. Add tile-oriented printk messages and to provide similar coverage as we have with xe_assert() macros. Also add set of simple macros for the top level xe_device, which we could easily tweak to include extra device specific info if needed. Typical output of our printk macros will look like: [drm] this is xe_WARN() [drm] *ERROR* this is xe_err() [drm] *ERROR* this is xe_err_printer() [drm] this is xe_info() [drm] this is xe_info_printer() [drm:printk_demo.cold] this is xe_dbg() [drm:printk_demo.cold] this is xe_dbg_printer() [drm] Tile0: this is xe_tile_WARN() [drm] *ERROR* Tile0: this is xe_tile_err() [drm] *ERROR* Tile0: this is xe_tile_err_printer() [drm] Tile0: this is xe_tile_info() [drm] Tile0: this is xe_tile_info_printer() [drm:printk_demo.cold] Tile0: this is xe_tile_dbg() [drm:printk_demo.cold] Tile0: this is xe_tile_dbg_printer() [drm] Tile0: GT0: this is xe_gt_WARN() [drm] *ERROR* Tile0: GT0: this is xe_gt_err() [drm] *ERROR* Tile0: GT0: this is xe_gt_err_printer() [drm] Tile0: GT0: this is xe_gt_info() [drm] Tile0: GT0: this is xe_gt_info_printer() [drm:printk_demo.cold] Tile0: GT0: this is xe_gt_dbg() [drm:printk_demo.cold] Tile0: GT0: this is xe_gt_dbg_printer() Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250909165941.31730-5-michal.wajdeczko@intel.com commit efd54b0cff9902638bc48a797c1ef6f57c348ac2 Author: Michal Wajdeczko Date: Tue Sep 9 18:59:37 2025 +0200 drm/xe: Prepare format for GT-oriented messages in one place To avoid code duplication (and thus potential mistakes) and to allow easier changes (if needed) of the prefix format of the GT-oriented messages, prepare that prefix in dedicated macro. Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250909165941.31730-4-michal.wajdeczko@intel.com commit a2dc39fb1c0c2a2113ffd72dbcc5888dadba919f Author: Michal Wajdeczko Date: Tue Sep 9 18:59:36 2025 +0200 drm/xe: Drop "gt_" prefix from xe_gt_WARN() macros Those WARN messages will already include GT-specific "GT%u:" prefix so there is no point to include additional "gt_" prefix. Signed-off-by: Michal Wajdeczko Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250909165941.31730-3-michal.wajdeczko@intel.com commit edffa93a93d896463948f966dcf0cf2b9de461d0 Author: Michal Wajdeczko Date: Tue Sep 9 18:59:35 2025 +0200 drm/xe: Keep xe_gt_err() macro definitions together There is no need to keep them separated. No functional changes. Signed-off-by: Michal Wajdeczko Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250909165941.31730-2-michal.wajdeczko@intel.com commit 41bab90bbfdc55228b8697d960839a4abb5016d4 Author: Josh Poimboeuf Date: Fri Jun 6 09:55:02 2025 -0700 x86/its: Move ITS indirect branch thunks to .text..__x86.indirect_thunk The ITS mitigation includes both indirect branch thunks and return thunks. Both are currently placed in .text..__x86.return_thunk, which is appropriate for the latter but not the former. For consistency with other mitigations, move the indirect branch thunks to .text..__x86.indirect_thunk. Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta commit 28c4d9bc0708956c1a736a9e49fee71b65deee81 Author: Andreas Gruenbacher Date: Wed Aug 6 23:34:03 2025 +0200 gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 6ab26555c9ffef96c56ca16356e55ac5ab61ec93 Author: Andreas Gruenbacher Date: Mon Jul 7 14:31:41 2025 +0200 gfs2: Add proper lockspace locking GFS2 has been calling functions like dlm_lock() even after the lockspace that these functions operate on has been released with dlm_release_lockspace(). It has always assumed that those functions would return -EINVAL in that case, but that was never guaranteed, and it certainly is no longer the case since commit 4db41bf4f04f ("dlm: remove ls_local_handle from struct dlm_ls"). To fix that, add proper lockspace locking. Fixes: 3e11e5304150 ("GFS2: ignore unlock failures after withdraw") Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 47faf937da43df9a84e65e5a880cf813e764971e Author: Andreas Gruenbacher Date: Mon Aug 11 21:38:23 2025 +0200 gfs2: Minor run_queue fixes Provide a better description of why the GLF_DEMOTE_IN_PROGRESS flag cannot be set. Function do_xmote() may block, so make sure it isn't called when nonblock is true. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit cd493dcf4f827700b66d1adb43f20d3838759beb Author: Andreas Gruenbacher Date: Mon Aug 11 21:35:23 2025 +0200 gfs2: run_queue cleanup Transform the code in run_queue() to make it more readable. No change in functionality. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 2045364497dbb16663df0267d6f733d964f22866 Author: Andreas Gruenbacher Date: Mon Aug 11 22:34:50 2025 +0200 gfs2: Simplify do_promote While not immediately obvious, do_promote() returns whether or not there are any active holders in the queue. But the function description is confusing, and this information is easy to come by for callers anyway, so turn do_promote() into a void function. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit bddb53b776fb7ce81dfba7c24884d9f2c0c68e50 Author: Andreas Gruenbacher Date: Fri Aug 8 23:26:12 2025 +0200 gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS Get rid of the GLF_INVALIDATE_IN_PROGRESS flag: it was originally used to indicate to add_to_queue() that the ->go_sync() and ->go_invalid() operations were in progress, but as we have established in commit "gfs2: Fix LM_FLAG_TRY* logic in add_to_queue", add_to_queue() has no need to know. Commit d99724c3c36a describes a race in which GLF_INVALIDATE_IN_PROGRESS is used to serialize two processes which are both in do_xmote() at the same time. That analysis is wrong: the serialization happens via the GLF_LOCK flag, which ensures that at most one glock operation can be active at any time. Fixes: d99724c3c36a ("gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS") Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 Author: Andreas Gruenbacher Date: Sat Aug 2 23:57:24 2025 +0200 gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS flag a second time after it has already been cleared. Fix that. Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 9b54770b68ae793a3a8d378be4cda2bb7be6c8cc Author: Andreas Gruenbacher Date: Fri Aug 8 23:18:45 2025 +0200 gfs2: Remove duplicate check in do_xmote In do_xmote(), remove the duplicate check for the ->go_sync and ->go_inval glock operations. They are either both defined, or none of them are. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 0c23e24164d83086e75581b0cf930f4e161636d6 Author: Andreas Gruenbacher Date: Fri Aug 8 22:31:59 2025 +0200 gfs2: Fix LM_FLAG_TRY* logic in add_to_queue The logic in add_to_queue() for determining whether a LM_FLAG_TRY or LM_FLAG_TRY_1CB holder should be queued does not make any sense: we are interested in wether or not the new operation will block behind an existing or future holder in the queue, but the current code checks for ongoing locking or ->go_inval() operations, which has little to do with that. Replace that code with something more sensible, remove the incorrect add_to_queue() function annotations, remove the similarly misguided do_error(gl, 0) call in do_xmote(), and add a missing comment to the same call in do_promote(). Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 2b813a72880dcc90ab5997e2307f961b5a8650bd Author: Andreas Gruenbacher Date: Thu Aug 7 10:21:33 2025 +0200 gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code Commit 6802e3400ff45 ("[GFS2] Clean up the glock core") stopped passing the LM_FLAG_ANY flag down to gdlm_lock() (then gfs2_lm_lock()). Since then, gfs2 effectively hasn't been using dlm's DLM_LKF_ALTCW / DLM_LKF_ALTPR flags, but the code still suggests that it does. Recent testing shows that those flags don't even work reliably anymore, so instead of fixing code that hasn't been used since 2008, remove it. In addition, clean up how the flags are passed to [gd]lm_lock(). Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit d5411ed6cabd376468f76584b1fe75235325966c Author: Vivek Pernamitta Date: Fri Sep 12 10:29:16 2025 +0530 bus: mhi: host: Notify EE change via uevent Notify the MHI device's Execution Environment (EE) state via uevent, enabling applications to receive real-time updates and take appropriate actions based on the current state of MHI. Signed-off-by: Vivek Pernamitta [mani: Reworded subject, removed error print, fixed indentation] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250912-b4-uevent_vdev_next-20250911-v2-1-89440407bf7e@quicinc.com commit fd70ab7155c4b92a9747d42c02791a0793ab9c66 Author: Andreas Gruenbacher Date: Thu Aug 7 10:21:33 2025 +0200 gfs2: Further sanitize lock_dlm.c The gl_req field and GLF_BLOCKING flag are only relevant to gdlm_lock(), its callback gdlm_ast(), and their helpers, so set and clear them inside lock_dlm.c. Also, the LM_FLAG_ANY flag is relevant to gdlm_lock(), but do_xmote() doesn't pass that flag down to gdlm_lock() as it should. Fix that by passing down all the flags. In addition, document the effect of the LM_FLAG_ANY flag on locks held in EX mode locally. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit cd718046646593ced5ad98f9cde22aaf2a2eb8f2 Author: Andreas Gruenbacher Date: Tue Aug 5 01:58:47 2025 +0200 gfs2: Do not use atomic operations unnecessarily The GLF_DEMOTE_IN_PROGRESS and GLF_LOCK flags and the glock refcount are all protected by the glock spin lock, so there is no need for atomic operations / barriers here. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 13c0004168633845fba328edf2cdec0de0292307 Author: Andreas Gruenbacher Date: Tue Aug 5 20:08:35 2025 +0200 gfs2: Sanitize gfs2_meta_check, gfs2_metatype_check, gfs2_io_error Change those functions to either return a useful value, or nothing at all. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 6e4224082696940d57c9129ed3aeb5e69904a5b2 Author: Andreas Gruenbacher Date: Tue Aug 5 19:51:47 2025 +0200 gfs2: Turn gfs2_withdraw into a void function Since commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"), gfs2_withdraw() always returns -1, so turn it into a straight void function. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 418c854759341cdf687240bd064de09ce38b92c5 Author: Andreas Gruenbacher Date: Tue Jul 8 22:07:17 2025 +0200 gfs2: Partially revert "gfs2: do_xmote fixes" When the lm_lock hook which calls dlm_lock() returns an error, do_xmote() previously reported the error to the syslog ("lm_lock ret %d\n") but otherwise ignored it during withdraws. Commit 9947a06d29c0 ("gfs2: do_xmote fixes") changed that to pass the error on to the glock layer, but the error would then only result in an unconditional BUG() in finish_xmote(), which doesn't help. Instead, revert to the previous behavior. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 4250e683de69a637b93f7c7bda7818b36b1cf32e Author: Andreas Gruenbacher Date: Sat Aug 2 23:41:24 2025 +0200 gfs2: Simplify refcounting in do_xmote In do_xmote(), take the additional glock references close to where those references are needed. This will simplify the next commit. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 2309a01351e56446f43c89e200d643647d47e739 Author: Andreas Gruenbacher Date: Tue Jul 8 19:13:32 2025 +0200 gfs2: do_xmote cleanup Check for asynchronous completion and clear the GLF_PENDING_REPLY flag earlier in do_xmote(). This will make future changes more readable. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit aa94ad9ab230d08741e6630a20fd1296b52c1009 Author: Colin Ian King Date: Tue Jul 29 12:36:38 2025 +0100 gfs2: Remove space before newline There is an extraneous space before a newline in a fs_err message. Remove it Signed-off-by: Colin Ian King Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 37b1c0f120b78f804f588ce78cfbd5a2df352a33 Author: Andreas Gruenbacher Date: Fri Jul 25 23:41:37 2025 +0200 gfs2: Remove unused sd_withdraw_wait field This field was introduced in commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish") and never used. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 60c6273131330a57b3eb55233d3706f48e4c4b3e Author: Andreas Gruenbacher Date: Fri Jul 25 15:09:00 2025 +0200 gfs2: Remove unused GIF_FREE_VFS_INODE flag Since commit 38552ff676f0 ("gfs2: Fix and clean up create / evict interaction"), the GIF_FREE_VFS_INODE flag isn't used anymore. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit c662a6fef10aff3b13befc499335a334205316d5 Author: Osama Abdelkader Date: Thu Sep 4 21:25:25 2025 +0200 mips: math-emu: replace deprecated strcpy() in me-debugfs use strscpy() instead of deprecated strcpy(). Signed-off-by: Osama Abdelkader Signed-off-by: Thomas Bogendoerfer commit 5bf682d9747277a0190e82e5ae6f9e201ce002d9 Author: Marek Vasut Date: Mon Sep 8 00:53:05 2025 +0200 arm64: dts: renesas: sparrow-hawk-fan-pwm: Rework hwmon comment Reword fan DT overlay hwmon comment to accurately locate the fan control sysfs hwmon node on Retronix R-Car V4H Sparrow Hawk. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250907225338.426253-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit babab7f22da6ae04b87c0cded98622ea4a648910 Author: Niklas Söderlund Date: Fri Sep 5 10:40:50 2025 +0200 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX462 on J2 Add an overlay to connect an IMX462 camera sensor to the J2 connector. The IMX462 utilizes 4 CSI-2 D-PHY lanes. This enables the video capture pipeline behind the CSI41 Rx to be enabled to process images from the sensor. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250905084050.310651-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit de6a859c29e6624eabac0a474562290ee49850d4 Author: Niklas Söderlund Date: Fri Sep 5 10:40:49 2025 +0200 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX462 on J1 Add an overlay to connect an IMX462 camera sensor to the J1 connector. The IMX462 utilizes 4 CSI-2 D-PHY lanes. This enables the video capture pipeline behind the CSI40 Rx to be enabled to process images from the sensor. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250905084050.310651-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 6e7f6aa88405bc6c1fc29d4104f9040688ca5efc Author: Niklas Söderlund Date: Fri Sep 5 10:40:48 2025 +0200 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX219 on J2 Add an overlay to connect an IMX219 camera sensor to the J2 connector. The IMX219 utilizes 2 CSI-2 D-PHY lanes. This enables the video capture pipeline behind the CSI41 Rx to be enabled to process images from the sensor. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250905084050.310651-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 3ba261af4214996915970448fc308cde93cc3345 Author: Niklas Söderlund Date: Fri Sep 5 10:40:47 2025 +0200 arm64: dts: renesas: sparrow-hawk: Add overlay for IMX219 on J1 Add an overlay to connect an IMX219 camera sensor to the J1 connector. The IMX219 utilizes 2 CSI-2 D-PHY lanes. This enables the video capture pipeline behind the CSI40 Rx to be enabled to process images from the sensor. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250905084050.310651-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 675621b20f7bd3abaa2ee47f397894d9cab90c9a Author: Marek Vasut Date: Thu Sep 4 23:01:18 2025 +0200 arm64: dts: renesas: rcar: Rename dsi-encoder to dsi Rename "dsi-encoder" nodes to "dsi" to follow node name pattern in Documentation/devicetree/bindings/display/dsi-controller.yaml. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904210147.186728-1-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20250904210147.186728-2-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20250904210147.186728-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 16e10c91ae4d4cab6fd8aa605689ebd31de98888 Author: Lad Prabhakar Date: Thu Sep 4 17:59:09 2025 +0100 arm64: dts: renesas: r9a09g056: Add I3C node Add I3C node to RZ/V2N ("R9A09G056") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904165909.281131-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 21fd8f45bad1c82c5fc94b372e47ad481bbad99b Author: Lad Prabhakar Date: Thu Sep 4 17:59:08 2025 +0100 arm64: dts: renesas: r9a09g057: Add I3C node Add I3C node to RZ/V2H(P) ("R9A09G057") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904165909.281131-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7e7bac722ddbd2fc9ba5c5916929cdd2507b97af Author: Lad Prabhakar Date: Thu Sep 4 11:04:35 2025 +0100 arm64: dts: renesas: rzt2h-n2h-evk: Enable USB2.0 support Enable USB2.0 support on RZ/T2H and RZ/N2H EVKs. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904100435.4033858-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4b9e0d8aa96c92be0073825344b661afc49242aa Author: Biju Das Date: Sun Aug 17 15:51:31 2025 +0100 arm64: dts: renesas: r9a09g047e57-smarc: Use Schmitt input for NMI function The latest RZ/G3E pin control document (rev 1.2) recommends using Schmitt input when PS0 pin used as NMI function. Enable Schmitt input for PS0 pin. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250817145135.166591-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3e5df910b592d47734b6dcd03d57498d4766bf6c Author: Biju Das Date: Sun Aug 17 15:51:30 2025 +0100 arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio key's pin control node Adding pin control node to the child won't parse the pins during driver bind. Fix the issue by moving it to parent node. This issue is observed while adding Schmitt input enable for PS0 pin on later patch. Currently the reset value of the PIN is set to NMI function and hence there is no breakage. Fixes: 9e95446b0cf9 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250817145135.166591-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit da7326322d31eb60fea27be30ca013d1e9b0a86c Author: John Madieu Date: Thu Aug 14 17:34:55 2025 +0200 arm64: dts: renesas: r9a09g047: Enable Tx coe support The GBETH IPs found on RZ/G3E SoC family are compatible with the stmmac driver. They have a MAC HW feature register used by this driver to enable respective features. While the register advertises Tx coe support, it was not enabled by the driver due to the 'snps,force_thresh_dma_mode' dtsi property. Switch from 'snps,force_thresh_dma_mode' to 'snps,force_sf_dma_mode' to enable Tx checksum offload support on both GBETH IPs. While at it, also switch from 'snps,fixed-burst' to 'snps,mixed-burst' and remove 'snps,no-pbl-x8' for optimal DMA configuration. This improvement results in a measurable TCP Tx performance gain, increasing throughput by 20Mbps. Signed-off-by: John Madieu Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250814153456.268208-1-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 00998e5fe0d85798b7d1f30d2ddfd9990cf5d7ef Author: Lad Prabhakar Date: Thu Aug 21 17:19:45 2025 +0100 arm64: dts: renesas: r9a09g087: Add USB2.0 support Add EHCI, OHCI, PHY and HSUSB nodes to RZ/N2H (R9A09G087) SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250821161946.1096033-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a777631037d0f5e55d50e59e5f2179381eb91fbb Author: Lad Prabhakar Date: Thu Aug 21 17:19:44 2025 +0100 arm64: dts: renesas: r9a09g077: Add USB2.0 support Add EHCI, OHCI, PHY and HSUSB nodes to RZ/T2H (R9A09G077) SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250821161946.1096033-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit da23f1bdce81712096601d9e5e59cfe071aa1c92 Author: Lad Prabhakar Date: Thu Aug 21 17:19:43 2025 +0100 arm64: dts: renesas: rzt2h-n2h-evk-common: Enable WDT2 Enable watchdog (WDT2) on RZ/T2H and RZ/N2H EVKs. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250821161946.1096033-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 283b465626a0fd2404a65de76a3485f09ccb32f0 Author: Lad Prabhakar Date: Thu Aug 21 17:19:42 2025 +0100 arm64: dts: renesas: r9a09g087: Add WDT nodes Add WDT0-5 nodes to RZ/N2H (R9A09G087) SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250821161946.1096033-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 19adb35f9dccd16df111f2d0ec265d572f8bb3f5 Author: Lad Prabhakar Date: Thu Aug 21 17:19:41 2025 +0100 arm64: dts: renesas: r9a09g077: Add WDT nodes Add WDT0-5 nodes to RZ/T2H (R9A09G077) SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250821161946.1096033-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d065453e5ee097193e3da3f7a8aafcdfabbaf78f Author: Lad Prabhakar Date: Wed Aug 20 21:06:59 2025 +0100 arm64: dts: renesas: rzt2h-rzn2h-evk: Enable SD card slot Enable SD card slot which is connected to SDHI0 on the RZ/T2H and RZ/N2H EVKs. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-10-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit dba8ee27c5de15c3c347816bb189af939092aea9 Author: Lad Prabhakar Date: Wed Aug 20 21:06:58 2025 +0100 arm64: dts: renesas: rzt2h-rzn2h-evk: Enable MicroSD card slot Enable MicroSD card slot which is connected to SDHI1 on the RZ/T2H and RZ/N2H EVKs. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-9-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4d7624fc85a27240ce35e0acc624dd165a314fca Author: Lad Prabhakar Date: Wed Aug 20 21:06:57 2025 +0100 arm64: dts: renesas: rzt2h-rzn2h-evk: Enable eMMC Enable eMMC on RZ/T2H and RZ/N2H EVKs. As SDHI0 can be connected to either eMMC0/SD0 `SD0_EMMC` macro is added. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-8-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit fcfedcb6804caaf18f22016de16d93bf18bbcfdd Author: Siddharth Vadapalli Date: Fri Sep 12 11:50:14 2025 +0530 arm64: dts: ti: k3-j721s2-evm: Add overlay to enable USB0 Type-A The J721S2-EVM (J721S2-SOM mounted on the J7 Common Processor Board) has a single instance of USB namely USB0. On the board, USB0 can be enabled using a single USB interface at a time among the following: 1. USB3.1 Gen1 Type C interface 2. Two USB2.0 Type A interfaces via an on-board USB Hub By default, USB0 is enabled using the USB3.1 Gen1 Type C interface. Hence, add a device-tree overlay to allow using USB0 with the USB2.0 Type A interfaces by configuring the "USB2.0_MUX_SEL" mux. Also, since the Type A interfaces only connect to USB Devices with USB0 acting as the USB Host, set the Dual-Role mode for USB0 to Host. Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250912062021.2906034-1-s-vadapalli@ti.com Signed-off-by: Nishanth Menon commit e53fbf955ea7753ef7970b866ca229abe32d5639 Author: Garrett Giordano Date: Wed Sep 10 16:17:16 2025 +0200 arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay The PEB-C-010 expansion board adds two extra 1Gbps ethernet ports to the phyBOARD-Electra-AM64x. Signed-off-by: Garrett Giordano Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20250910141716.2133707-1-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit e402a3f1d9681d4b0be4568b5f318b3c3bc804bf Author: Stefano Radaelli Date: Tue Sep 9 23:37:41 2025 +0200 arm64: dts: ti: var-som-am62p: Add support for Variscite Symphony Board Add device tree support for the Variscite Symphony carrier board with the VAR-SOM-AM62P system on module. The Symphony board includes - uSD Card support - USB ports and OTG - Additional Gigabit Ethernet interface - Uart interfaces - OV5640 Camera support - GPIO Expander - CAN, I2C and general purpose interfaces Link: https://www.variscite.it/product/single-board-computers/symphony-board/ Signed-off-by: Stefano Radaelli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250909213749.28098-4-stefano.radaelli21@gmail.com Signed-off-by: Nishanth Menon commit 571562e76458682231453a561d5df0c8e91c461d Author: Stefano Radaelli Date: Tue Sep 9 23:37:40 2025 +0200 arm64: dts: ti: Add support for Variscite VAR-SOM-AM62P Add device tree support for the Variscite VAR-SOM-AM62P system on module. This SOM is designed to be used with various carrier boards. The module includes: - AM62P Sitara MPU processor - Up to 8GB of DDR4-3733 memory - eMMC storage memory - PS6522430 chip as a Power Management Integrated circuit (PMIC) - Integrated 10/100/1000 Mbps Ethernet Transceiver Analog Devices ADIN1300 - Resistive touch panel interface controller TI TSC2046 - I2C interfaces Only SOM-specific peripherals are enabled by default. Carrier board specific interfaces are left disabled to be enabled in the respective carrier board device trees. Link: https://www.variscite.it/product/system-on-module-som/cortex-a53-krait/var-som-am62p-ti-sitara-am62px/ Signed-off-by: Stefano Radaelli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250909213749.28098-3-stefano.radaelli21@gmail.com Signed-off-by: Nishanth Menon commit 03c7b1f0ee9f7c8d047a6ea5767ac96490d1385c Author: Stefano Radaelli Date: Tue Sep 9 23:37:39 2025 +0200 dt-bindings: arm: ti: Add bindings for Variscite VAR-SOM-AM62P Add devicetree bindings for Variscite VAR-SOM-AM62P System on Module and its carrier boards. Signed-off-by: Stefano Radaelli Reviewed-by: Judith Mendez Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250909213749.28098-2-stefano.radaelli21@gmail.com Signed-off-by: Nishanth Menon commit 5cad4ce9a7b82118cfeeb764e1a555a5789c22e3 Author: Hrushikesh Salunke Date: Tue Sep 2 11:00:09 2025 +0530 arm64: dts: ti: k3-j722s-evm: Add bootph-all tag to usb0_phy_ctrl node Add bootph-all property to the USB0 PHY controller node to make it available during all boot phases. This is required for USB DFU boot. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250902053009.1732607-5-h-salunke@ti.com Signed-off-by: Nishanth Menon commit 69cd3e0eef26edbc39dca06522f6ae289448d172 Author: Hrushikesh Salunke Date: Tue Sep 2 11:00:08 2025 +0530 arm64: dts: ti: k3-am62x-sk-common: Add bootph-all tag to usb0_phy_ctrl node Add bootph-all property to the USB0 PHY controller node to make it available during all boot phases. This is required for USB DFU boot. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250902053009.1732607-4-h-salunke@ti.com Signed-off-by: Nishanth Menon commit 398af33bedc1a64f7045be065e1e17e292cc1c60 Author: Hrushikesh Salunke Date: Tue Sep 2 11:00:07 2025 +0530 arm64: dts: ti: k3-am62p5-sk: Add bootph-all tag to usb0_phy_ctrl node Add bootph-all property to the USB0 PHY controller node to make it available during all boot phases. This is required for USB DFU boot. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250902053009.1732607-3-h-salunke@ti.com Signed-off-by: Nishanth Menon commit 47315d395a98a56f8854a2085f887fb18a8217d9 Author: Hrushikesh Salunke Date: Tue Sep 2 11:00:06 2025 +0530 arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to usb0_phy_ctrl node Add bootph-all property to the USB0 PHY controller node to make it available during all boot phases. This is required for USB DFU boot. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Reviewed-by: Judith Mendez Link: https://patch.msgid.link/20250902053009.1732607-2-h-salunke@ti.com Signed-off-by: Nishanth Menon commit 6fdcb1013f13f87cdebd94ab8aa2f8ea2c644a33 Author: Rahul T R Date: Fri Sep 5 15:13:25 2025 +0530 arm64: dts: ti: k3-j721e-main: Add DSI and DPHY-TX TI's J721E SoC supports a DPI to DSI video signal conversion bridge on it's platform bus. The IP is from Cadence, and it has a custom TI wrapper around it to facilitate integration. This IP takes the DPI video signals from DSS and alongwith the DPHY IP, it transmits DSI video signals out of the SoC. Add support for DSI bridge and the DPHY-TX. Signed-off-by: Rahul T R Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Link: https://patch.msgid.link/20250905094325.472473-1-h-shenoy@ti.com Signed-off-by: Nishanth Menon commit 2e79ee4d64e9ba4a3fc90e91dfd715407efab16d Author: Akashdeep Kaur Date: Tue Sep 9 10:11:08 2025 +0530 arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros Currently, DS_IO_OVERRIDE_EN_SHIFT macro is not defined anywhere but used for defining other macro. Replace this undefined macro with valid macro. Rename the existing macro to reflect the actual behavior. Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros") Reviewed-by: Kendall Willis Reviewed-by: Dhruva Gole Reviewed-by: Vignesh Raghavendra Signed-off-by: Akashdeep Kaur Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros") Link: https://patch.msgid.link/20250909044108.2541534-5-a-kaur@ti.com Signed-off-by: Nishanth Menon commit 42558822658e0ad249a8f109fd053e3bad4476e9 Author: Akashdeep Kaur Date: Tue Sep 9 10:11:07 2025 +0530 arm64: dts: ti: k3-pinctrl: Add the remaining macros Add the drive strength, schmitt trigger enable macros to pinctrl file. Add the missing macros for DeepSleep configuration control referenced from "Table 14-8769. Description Of The Pad Configuration Register Bits" in AM62Px TRM[0]. Add some DeepSleep macros to provide combinations that can be used directly in device tree files example PIN_DS_OUTPUT_LOW that configures pin to be output and also sets its value to 0. [0] https://www.ti.com/lit/pdf/SPRUJ83 Reviewed-by: Dhruva Gole Reviewed-by: Vignesh Raghavendra Signed-off-by: Akashdeep Kaur Reviewed-by: Kendall Willis Link: https://patch.msgid.link/20250909044108.2541534-4-a-kaur@ti.com Signed-off-by: Nishanth Menon commit 121babfed84a0c6d7ebee4486db4fbd9a900d9f5 Author: Akashdeep Kaur Date: Tue Sep 9 10:11:06 2025 +0530 arm64: dts: ti: k3-am62x-sk-common: Remove the unused cfg in USB1_DRVVBUS After the SoC has entered the DeepSleep low power mode, USB1 can be used to wakeup the SoC based on USB events triggered by USB devices. This requires that the pin corresponding to the Type-A connector remains pulled up even after the SoC has entered the DeepSleep low power mode. For that, either DeepSleep pullup configuration can be selected or the pin can have the same configuration that it had when SoC was in active mode. Remove the unnecessary DeepSleep state configuration from USB1_DRVBUS pin, as the DeepSleep control bit is not set and the active configuration is sufficient to keep the pin pulled up. This simplifies the setup and removes redundant configuration. This reverts commit 527f884d2d94981016e181dcbd4c4b5bf597c0ad. Tested-by: Kendall Willis Reviewed-by: Dhruva Gole Signed-off-by: Akashdeep Kaur Reviewed-by: Kendall Willis Acked-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250909044108.2541534-3-a-kaur@ti.com Signed-off-by: Nishanth Menon commit fe0e018b05f118cb8e5c8cd77dd74185b2cb7177 Author: Akashdeep Kaur Date: Tue Sep 9 10:11:05 2025 +0530 arm64: dts: ti: k3-am62p5-sk: Remove the unused cfg in USB1_DRVVBUS After the SoC has entered the DeepSleep low power mode, USB1 can be used to wakeup the SoC based on USB events triggered by USB devices. This requires that the pin corresponding to the Type-A connector remains pulled up even after the SoC has entered the DeepSleep low power mode. For that, either DeepSleep pullup configuration can be selected or the pin can have the same configuration that it had when SoC was in active mode. Remove the unnecessary DeepSleep state configuration from USB1_DRVBUS pin, as the DeepSleep control bit is not set and the active configuration is sufficient to keep the pin pulled up. This simplifies the setup and removes redundant configuration. This reverts commit 115290c112952db27009668aa7ae2f29920704f0. Tested-by: Kendall Willis Reviewed-by: Dhruva Gole Signed-off-by: Akashdeep Kaur Reviewed-by: Kendall Willis Acked-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250909044108.2541534-2-a-kaur@ti.com Signed-off-by: Nishanth Menon commit 65805c2ed74ee47e81246f97f4b3c126a75f0b0e Author: Jani Nikula Date: Thu Sep 11 12:17:40 2025 +0300 drm/i915: split out i915_wait_util.h Move waiting related utilities from i915_utils.h to separate new file i915_wait_util.h. Clean up related includes. Note: Many of the various wait macro usages could likely be refactored to use poll_timeout_us(). Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/431396ac8cdb3e2f4ff053a8933290289a66ce42.1757582214.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2f04432fcf0ad7b825d67ee283345e2721c83f5c Author: Jani Nikula Date: Thu Sep 11 12:17:39 2025 +0300 drm/i915: split out i915_list_util.h Move list related utilities from i915_utils.h to separate new file i915_list_util.h. Clean up related includes. Note: Arguably none of this should exist in i915 in the first place. At least isolate it better. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/d7526809735194137116682f37cfa126a6a87ec9.1757582214.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit df7d085b585016fdda440719a58ee3ac73c5db7c Author: Jani Nikula Date: Thu Sep 11 12:17:38 2025 +0300 drm/i915: split out i915_timer_util.[ch] Move timer related utilities from i915_utils.[ch] to separate new files i915_timer_util.[ch]. Clean up related includes. Note: Arguably none of this should exist in i915 in the first place. At least isolate it better. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/0a83d9489626121dcefcd4c1a05317399b5708f3.1757582214.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a394f12a4d6d6ec3c72d62107282c6022cd96333 Author: Jani Nikula Date: Thu Sep 11 12:17:37 2025 +0300 drm/i915: split out i915_ptr_util.h Move pointer related utilities from i915_utils.h to a separate new i915_ptr_util.h header. Clean up related includes. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/3cd06aa2483e68f19401292e9d4c28bf2977fce5.1757582214.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b5788b96cba97da01e1f0e1316133427c1102ff6 Author: Geert Uytterhoeven Date: Thu Sep 11 17:57:58 2025 +0200 clk: renesas: r9a09g05[67]: Reduce differences The clock drivers for RZ/V2H and RZ/V2N are very similar. Reduce the differences between them by: - Moving and reformatting the PLLCM33_GEAR clock definitions, - Replacing spaces by TABs. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/2246d2263e8a24d1aaf653db2004cbf2263c9048.1757606097.git.geert+renesas@glider.be commit 82e0aa95ec8cec76bec23146ad8effb5a09e6e92 Author: Biju Das Date: Tue Sep 9 19:07:47 2025 +0100 clk: renesas: r9a09g047: Add USB3.0 clocks/resets Add USB3.0 clock and reset entries. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250909180803.140939-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 9bb55594efaf9feb299675a9d007f878f13f8b9e Merge: cc55fc58fc1b7f a24cd110e66439 Author: Geert Uytterhoeven Date: Fri Sep 12 09:53:27 2025 +0200 Merge tag 'renesas-r9a09g047-dt-binding-defs-tag4' into renesas-clk-for-v6.18 Renesas RZ/G3E USB3.0 Core Clock DT Binding Definitions USB3.0 core clock DT binding definitions for the Renesas RZ/G3E (R9A09G047) SoC, shared by driver and DT source files. commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b Author: Yuan CHen Date: Mon Sep 8 02:28:10 2025 +0100 clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() In case of krealloc_array() failure, the current error handling just returns from the function without freeing the original array. Fix this memory leak by freeing the original array. Fixes: 6aa1754764901668 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system") Signed-off-by: Yuan CHen Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250908012810.4767-1-chenyuan_fl@163.com Signed-off-by: Geert Uytterhoeven commit 36d05f21da4d1879f7e81f18eae85f34e9c64aa5 Author: Chris Morgan Date: Thu Sep 4 11:05:30 2025 -0500 arm64: dts: rockchip: Add USB and charger to Gameforce Ace Add support for the BQ25703A charger manager and boost regulator to the Gameforce Ace. Add the USB-C port and PHY as well as they all depend on each other for operation. Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20250904160530.66178-6-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 9b90afa6d613b66ec4e74ae75f9bfa5baf386ecd Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:51 2025 +0200 gpio: move gpio-mmio-specific fields out of struct gpio_chip With all users of bgpio_init() converted to using the modernized generic GPIO chip API, we can now move the gpio-mmio-specific fields out of struct gpio_chip and into the dedicated struct gpio_generic_chip. To that end: adjust the gpio-mmio driver to the new layout, update the docs, etc. The changes in gpio-mlxbf2.c and gpio-mpc8xxx.c are here and not in their respective conversion commits because the former passes the address of the generic chip's lock to the __releases() annotation and we cannot really hide it while gpio-mpc8xxx.c accesses the shadow registers in a driver-specific workaround and there's no reason to make them available in a public API. Also: drop the relevant task from TODO as it's now done. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-15-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit e43e94fa19cf058c4e465fcdbc2f521123058ea6 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:50 2025 +0200 gpio: mmio: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-14-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit ae9a52990b2cd62e0555adad92d8fe9e431d1bac Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:49 2025 +0200 gpio: sodaville: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-13-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 063411108de622a26b36487a711903443b0e864b Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:48 2025 +0200 gpio: spacemit-k1: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Yixun Lan Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-12-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 8e1c8ccc1df8b802a7a1b4beadbd8b87fff1c3b3 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:47 2025 +0200 gpio: sifive: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Samuel Holland Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-11-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit b24489af4500720d8ad57c55111d90e762133c50 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:46 2025 +0200 gpio: menz127: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-10-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 2c1f22fa54fcbf8fbd9c03f5d341c73ef36c6d27 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:45 2025 +0200 gpio: mt7621: use the generic GPIO chip lock for IRQ handling This driver uses its own spinlock in interrupt routines while the generic GPIO chip callbacks use a separate one. This is, of course, racy so use the fact that the lock in generic GPIO chip is also a spinlock and convert the interrupt handling functions in this module to using the provided generic GPIO chip locking API. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-9-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 80fd7e96d669d729d9e01bfa3e2b60ea6b500e20 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:44 2025 +0200 gpio: mt7621: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-8-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit e8bd2a6a5059043a9f13a0723acd48c1291a55ff Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:43 2025 +0200 gpio: brcmstb: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Florian Fainelli Tested-by: Florian Fainelli Acked-by: Doug Berger Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-7-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 36f30f7ffc4b98dbd49deec8599cf810e7006cdf Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:42 2025 +0200 gpio: xgene-sb: use generic GPIO chip register read and write APIs The conversion to using the modernized generic GPIO chip API was incomplete without also converting the direct calls to write/read_reg() callbacks. Use the provided wrappers from linux/gpio/generic.h. Fixes: 38d98a822c14 ("gpio: xgene-sb: use new generic GPIO chip API") Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-6-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit e7a3a1be11d7e786924ed7af3b3411def2e46f21 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:41 2025 +0200 gpio: ath79: use the generic GPIO chip lock for IRQ handling This driver uses its own raw spinlock in interrupt routines while the generic GPIO chip callbacks use a separate one. This is, of course, racy so use the fact that the lock in generic GPIO chip is also a raw spinlock and convert the interrupt handling functions in this module to using the provided generic GPIO chip locking API. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-5-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 551a097118391018ddc4079cbcec6fe4e7d64bc5 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:40 2025 +0200 gpio: ath79: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-4-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 43dffacf6be98fb31aa7790d693adc29276461f0 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:39 2025 +0200 gpio: hlwd: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-3-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 116eadc92b4c47277d660271eac1efd4afd33121 Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:38 2025 +0200 gpio: loongson1: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-2-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 80d7319c7a2a9865dc730422ec7227bfcc92e6bb Author: Bartosz Golaszewski Date: Wed Sep 10 09:12:37 2025 +0200 gpio: loongson1: allow building the module with COMPILE_TEST enabled Increase build coverage by allowing the module to be built with COMPILE_TEST=y. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250910-gpio-mmio-gpio-conv-part4-v2-1-f3d1a4c57124@linaro.org Signed-off-by: Bartosz Golaszewski commit 571c65bb2f4d17198189cf8d161b96f32674642b Author: Bartosz Golaszewski Date: Tue Sep 9 14:28:43 2025 +0200 gpiolib: add a common prefix to GPIO descriptor flags While these flags are private within drivers/gpio/, when looking at the code, it's not really clear they are GPIO-specific. Since these are GPIO descriptor flags, prepend their names with a common "GPIOD" prefix. While at it: update the flags' docs: make spelling consistent, correct outdated information, etc. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250909-rename-gpio-flags-v1-1-bda208a40856@linaro.org Signed-off-by: Bartosz Golaszewski commit 7eee64e8be51f9ff0393b5bd0752a6e8f9252bf9 Author: Bartosz Golaszewski Date: Wed Sep 10 09:25:47 2025 +0200 gpio: use more common syntax for compound literals The (typeof(foo)) construct is unusual in the kernel, use a more typical syntax by explicitly spelling out the type. Link: https://lore.kernel.org/all/20250909-gpio-mmio-gpio-conv-part4-v1-13-9f723dc3524a@linaro.org/ Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250910-make-compound-literals-normal-again-v1-3-076ee7738a0b@linaro.org Signed-off-by: Bartosz Golaszewski commit e36be19823f0e666de2994bb39ab8d8495da6709 Author: Chen-Yu Tsai Date: Thu Aug 14 17:25:08 2025 +0800 arm64: dts: mediatek: mt8188-geralt: Enable first SCP core The first SCP core is used to drive the video decoder and encoders. Signed-off-by: Chen-Yu Tsai Reviewed-by: Fei Shao Link: https://lore.kernel.org/r/20250814092510.211672-1-wenst@chromium.org Signed-off-by: Matthias Brugger commit 0370911565869384f19b35ea9e71ee7a57b48a33 Author: Chen-Yu Tsai Date: Tue Aug 12 17:01:34 2025 +0800 arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model The touchscreen controller used with the original Krabby design is the Elan eKTH6918, which is in the same family as eKTH6915, but supporting a larger screen size with more sense lines. OTOH, the touchscreen controller that actually shipped on the Tentacruel devices is the Elan eKTH6A12NAY. A compatible string was added for it specifically because it has different power sequencing timings. Fix up the touchscreen nodes for both these. This also includes adding a previously missing reset line. Also add "no-reset-on-power-off" since the power is always on, and putting it in reset would consume more power. Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org Signed-off-by: Matthias Brugger commit c881d1c37b2c159d908203dba5c4920bc776046f Author: Chen-Yu Tsai Date: Tue Jun 10 14:34:30 2025 +0800 arm64: dts: mediatek: mt8188: Change efuse fallback compatible to mt8186 The efuse block in the MT8188 contains the GPU speed bin cell, and like the MT8186 one, has the same conversion scheme to work with the GPU OPP binding. This was reflected in a corresponding change to the efuse DT binding. Change the fallback compatible of the MT8188's efuse block from the generic one to the MT8186 one. This also makes GPU DVFS work properly. Fixes: d39aacd1021a ("arm64: dts: mediatek: mt8188: add lvts definitions") Fixes: 50e7592cb696 ("arm64: dts: mediatek: mt8188: Add GPU speed bin NVMEM cells") Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250610063431.2955757-3-wenst@chromium.org Signed-off-by: Matthias Brugger commit 1a1066f553df1777ffa5ede050457e41972f34f4 Author: Paresh Bhagat Date: Wed Aug 13 14:33:00 2025 +0530 arm64: dts: ti: k3-am62d2-evm: Add support for OSPI flash AM62D2 EVM has S28HS512T 64 MiB Octal SPI NOR flash connected to the OSPI interface. Add support for the flash and describe the partition information as per bootloader. Signed-off-by: Paresh Bhagat Reviewed-by: Santhosh Kumar K Link: https://patch.msgid.link/20250813090300.733295-1-p-bhagat@ti.com Signed-off-by: Nishanth Menon commit 5cd40f33273bb41b5eec763bcfc7c9b2e9fe2e64 Author: Paresh Bhagat Date: Wed Sep 3 11:55:13 2025 +0530 arm64: dts: ti: k3-am62d2-evm: Enable USB support Add pinmux configuration for USB1 interface and enable the node for functionality. Also enable data transfer on USB0, on existing power delivery configuration. Co-developed-by: Siddharth Vadapalli Signed-off-by: Siddharth Vadapalli Signed-off-by: Paresh Bhagat Reviewed-by: Hrushikesh Salunke Link: https://patch.msgid.link/20250903062513.813925-3-p-bhagat@ti.com Signed-off-by: Nishanth Menon commit 4c4e48afb6d85c1a8f9fdbae1fdf17ceef4a6f5b Author: Vibhore Vardhan Date: Wed Sep 3 11:55:12 2025 +0530 arm64: dts: ti: k3-am62a-main: Fix main padcfg length The main pad configuration register region starts with the register MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG0 with address 0x000f4000 and ends with the MAIN_PADCFG_CTRL_MMR_CFG0_PADCONFIG150 register with address 0x000f4258, as a result of which, total size of the region is 0x25c instead of 0x2ac. Reference Docs TRM (AM62A) - https://www.ti.com/lit/ug/spruj16b/spruj16b.pdf TRM (AM62D) - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf Fixes: 5fc6b1b62639c ("arm64: dts: ti: Introduce AM62A7 family of SoCs") Cc: stable@vger.kernel.org Signed-off-by: Vibhore Vardhan Signed-off-by: Paresh Bhagat Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250903062513.813925-2-p-bhagat@ti.com Signed-off-by: Nishanth Menon commit 9fdcc5f98141cf2f77e8778bee830190d7b71ced Author: Judith Mendez Date: Mon Sep 8 18:52:07 2025 -0500 arm64: dts: ti: k3-am62p: Update eMMC HS400 STRB value STRB setting for eMMC HS400 have been updated in device datasheet [0], so update for am62p in k3-am62p-main. [0] https://www.ti.com/lit/gpn/am62p Signed-off-by: Judith Mendez Link: https://patch.msgid.link/20250908235207.473628-3-jm@ti.com Signed-off-by: Nishanth Menon commit 7efc354b7fe1ac5e874d0188b3d6be88a3fa0fe4 Author: Judith Mendez Date: Mon Sep 8 18:52:06 2025 -0500 arm64: dts: ti: k3-am62p/j722s: Remove HS400 support from common Since eMMC HS400 has been descoped for J722s due to errata i2478 [0] and is supported for AM62Px device, remove eMMC HS400 support from common-main.dtsi and include only in am62p-main.dtsi. [0] https://www.ti.com/lit/pdf/sprz575 Signed-off-by: Judith Mendez Reviewed-by: Andrew Davis Reviewed-by: Moteen Shah Link: https://patch.msgid.link/20250908235207.473628-2-jm@ti.com Signed-off-by: Nishanth Menon commit 2517e476b819df986fa1fe53927c099032bb72dc Author: Anshul Dalal Date: Thu Aug 14 19:15:30 2025 +0530 arm64: dts: ti: Add support for AM6254atl SiP SK This patch adds the dt for SK-AM62-SIP, which uses the existing SK-AM62 board design with the new AM6254atl SiP. This changes the location of memory node from the board dts to SoC level dtsi (k3-am6254atl in our case). Therefore this patch introduces the new 'k3-am625-sk-common.dtsi' which represents the common hardware used for both 'am625-sk' and 'am6254atl-sk' boards with the inheritance hierarchy modified to: k3-am625-sk.dts: k3-am62 k3-am62x-sk-common | | k3-am625 k3-am625-sk-common | | +-----+------+ | k3-am625-sk k3-am6254atl-sk.dts: k3-am62 | k3-am625 k3-am62x-sk-common | | k3-am6254atl k3-am625-sk-common | | +-------+--------+ | k3-am6254atl-sk Signed-off-by: Anshul Dalal Reviewed-by: Bryan Brattlof Link: https://patch.msgid.link/20250814134531.2743874-5-anshuld@ti.com Signed-off-by: Nishanth Menon commit 7c1d13a14e61ab33eec330cb6cabbddb37eecaa9 Author: Anshul Dalal Date: Thu Aug 14 19:15:29 2025 +0530 arm64: dts: ti: Introduce base support for AM6254atl SiP This patch adds the top level dtsi for AM6254atl SiP which integrates the existing AM625 SoC with 512MiB of DDR in a single package. More information about the package can be found here: https://www.ti.com/lit/ds/symlink/am625sip.pdf Signed-off-by: Anshul Dalal Reviewed-by: Bryan Brattlof Link: https://patch.msgid.link/20250814134531.2743874-4-anshuld@ti.com Signed-off-by: Nishanth Menon commit 3e915577cf0b7d3f9088c398888e5e01e10356d7 Author: Anshul Dalal Date: Thu Aug 14 19:15:28 2025 +0530 dt-bindings: arm: ti: Add binding for AM625 SiP The AM6254atl SiP belongs to the K3 Multicore SoC architecture platform, providing AM625 SoC with 512MiB of integrated DDR in the package. For further information about the package check: https://www.ti.com/lit/ds/symlink/am625sip.pdf Signed-off-by: Anshul Dalal Reviewed-by: Bryan Brattlof Acked-by: Conor Dooley Link: https://patch.msgid.link/20250814134531.2743874-3-anshuld@ti.com Signed-off-by: Nishanth Menon commit e0b9feca7329c495a76891d7766a781dea73787d Author: Anshul Dalal Date: Thu Aug 14 19:15:27 2025 +0530 arm64: dts: ti: k3-am62*: remove SoC dtsi from common dtsi The k3-am62x-sk-common dtsi represents the common hardware used across am62x EVMs which can be configured with various DDR sizes or none (with DDR integrated in the package) based on the specific am62x SoC used. Therefore this patch moves the memory node and the SoC specific k3-am625 dtsi out of sk-common and into the board dts files. No functional change is intended from this patch. The device-tree inheritance is changed as follows: Before: k3-am62 ^ k3-am625 ^ k3-am62x-sk-common ^ am62x EVMs (k3-am625-sk, k3-am62-lp-sk) After: k3-am62 ^ k3-am625 k3-am62x-sk-common ^ ^ am62x EVMs (k3-am625-sk, k3-am62-lp-sk) Signed-off-by: Anshul Dalal Reviewed-by: Bryan Brattlof Link: https://patch.msgid.link/20250814134531.2743874-2-anshuld@ti.com Signed-off-by: Nishanth Menon commit e135eeef0b25d44fe71dc3b71b0106d48d825470 Author: Thorsten Blum Date: Thu Sep 11 23:43:22 2025 +0200 ALSA: aoa: Remove redundant size arguments from strscpy() The size parameter of strscpy() is optional if the destination buffer has a fixed length and strscpy() can automatically determine its size using sizeof(). This makes many explicit size arguments redundant. Remove them to shorten and simplify the code. No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Takashi Iwai commit 00f2bf97544cdc7e5b166d19f896f5eaa2bb02ae Author: Mika Westerberg Date: Fri Aug 29 11:15:45 2025 +0300 MAINTAINERS: Update Michael Jamet's maintainer entries Michael Jamet is about to continue his professional journey outside of Intel and is stepping down as maintainer of Thunderbolt/USB4 subsystem, and the networking driver. Move him from MAINTAINERS to CREDITS. Thank you, Michael! Cc: Michael Jamet Signed-off-by: Mika Westerberg commit 3668be17e5464c835544b84c7a808b7d5cf99ffc Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:31 2025 +0200 arm64: dts: marvell: armada-cp11x: Add default ICU address cells Add missing address-cells 0 to the ICU interrupt node to silence W=1 warning: armada-cp11x.dtsi:547.3-47: Warning (interrupt_map): /cp0-bus/pcie@f2600000:interrupt-map: Missing property '#address-cells' in node /cp0-bus/bus@f2000000/interrupt-controller@1e0000/interrupt-controller@10, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Gregory CLEMENT commit bc2d616d58ab3810ce755e250885cc66dc707209 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:30 2025 +0200 arm64: dts: marvell: armada-37xx: Add default PCI interrup controller address cells Add missing address-cells 0 to the PCI interrupt node to silence W=1 warning: armada-37xx.dtsi:518.4-521.29: Warning (interrupt_map): /soc/pcie@d0070000:interrupt-map: Missing property '#address-cells' in node /soc/pcie@d0070000/interrupt-controller, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Gregory CLEMENT commit a26bc9175f679da37ee3a52669aeb26db7f57738 Author: Beleswar Padhi Date: Mon Sep 8 19:58:26 2025 +0530 arm64: dts: ti: k3-am65-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 AM65 SoCs have multiple programmable remote processors like R5Fs. The TI SDKs for AM65 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-35-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 3ad3ab0bfa577d1f93e7048224c267b32ed4d6a1 Author: Beleswar Padhi Date: Mon Sep 8 19:58:25 2025 +0530 arm64: dts: ti: k3-am64-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 AM64 SoCs have multiple programmable remote processors like R5F, M4F etc. The TI SDKs for AM64 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Tested-by: Wadim Egorov # phycore-am64x Tested-by: Hari Nagalla Reviewed-by: Wadim Egorov # phycore-am64x Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250908142826.1828676-34-b-padhi@ti.com Signed-off-by: Nishanth Menon commit d4ab4a33c8e0a8cd33c8cb70ba3c74dba770c2a4 Author: Beleswar Padhi Date: Mon Sep 8 19:58:24 2025 +0530 arm64: dts: ti: k3-am62a-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 AM62A SoCs have multiple programmable remote processors like R5F, C7x etc. The TI SDKs for AM62A SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Tested-by: Judith Mendez Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250908142826.1828676-33-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 1d6161617c10435e970d3bb3ef5de124b94fe719 Author: Beleswar Padhi Date: Mon Sep 8 19:58:23 2025 +0530 arm64: dts: ti: k3-am62-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 AM62 SoCs have multiple programmable remote processors like R5F, M4F etc. The TI SDKs for AM62 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Tested-by: Wadim Egorov # phycore-am62x Reviewed-by: Wadim Egorov Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250908142826.1828676-32-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 6bd0449be319a29096f3ee7cd415f8b6b28104c7 Author: Beleswar Padhi Date: Mon Sep 8 19:58:22 2025 +0530 arm64: dts: ti: k3-am62p-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 AM62P SoCs have multiple programmable remote processors like R5Fs. The TI SDKs for AM62P SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Tested-by: Judith Mendez Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250908142826.1828676-31-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 3cc04e49cd5d9c5af24eb4357775f35156b19fec Author: Beleswar Padhi Date: Mon Sep 8 19:58:21 2025 +0530 arm64: dts: ti: k3-j722s-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 J722S SoCs have multiple programmable remote processors like R5F, C7x etc. The TI SDKs for J722S SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-30-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 2742d963e1dd7f4a3d0505044323b091daffcddc Author: Beleswar Padhi Date: Mon Sep 8 19:58:20 2025 +0530 arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 J784S4 SoCs have multiple programmable remote processors like R5F, C7x etc. The TI SDKs for J784S4 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. This patch only refactors the C71_3 remote processor related nodes into the new dtsi. All other nodes have been refactored in the previous commit as part of k3-j784s4-j742s2-ti-ipc-firmware-common.dtsi. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-29-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 3dabfaa168d8b3835e210f90da3bf0f10b050fdb Author: Beleswar Padhi Date: Mon Sep 8 19:58:19 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2-ti-ipc-firmware-common: Refactor IPC cfg into new dtsi The TI K3 J784S4/J742S2 SoCs have multiple programmable remote processors like R5F, C7x etc. The TI SDKs for J784S4/J742S2 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-28-b-padhi@ti.com Signed-off-by: Nishanth Menon commit e2581d3e0787a42f6ede8a15a66a93ae4a3ecd6f Author: Beleswar Padhi Date: Mon Sep 8 19:58:18 2025 +0530 arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 J721S2 SoCs have multiple programmable remote processors like R5F, C7x etc. The TI SDKs for J721S2 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-27-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 20ca55168b139c78d4e604a59dbc89403781ee0a Author: Beleswar Padhi Date: Mon Sep 8 19:58:17 2025 +0530 arm64: dts: ti: k3-j721e-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 J721E SoCs have multiple programmable remote processors like R5F, C6x, C7x etc. The TI SDKs for J721E SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-26-b-padhi@ti.com Signed-off-by: Nishanth Menon commit c5b645dbecd6d0b2689fa44eeefe2a2648172dc7 Author: Beleswar Padhi Date: Mon Sep 8 19:58:16 2025 +0530 arm64: dts: ti: k3-j7200-ti-ipc-firmware: Refactor IPC cfg into new dtsi The TI K3 J7200 SoCs have multiple programmable remote processors like R5Fs. The TI SDKs for J7200 SoCs offer sample firmwares which could be run on these cores to demonstrate an "echo" IPC test. Those firmware require certain memory carveouts to be reserved from system memory, timers to be reserved, and certain mailbox configurations for interrupt based messaging. These configurations could be different for a different firmware. While DT is not meant for system configurations, at least refactor these configurations from board level DTS into a dtsi for now. This dtsi for TI IPC firmware is board-independent and can be applied to all boards from the same SoC Family. This gets rid of code duplication and allows more freedom for users developing custom firmware (or no firmware) to utilize system resources better; easily by swapping out this dtsi. To maintain backward compatibility, the dtsi is included in all boards. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-25-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 897117c6bb4b151bd9326773cd6a5acdad4c47b4 Author: Beleswar Padhi Date: Mon Sep 8 19:58:15 2025 +0530 arm64: dts: ti: k3-j721e-beagleboneai64: Switch MAIN R5F clusters to Split-mode Switch the MAIN domain R5F clusters into split mode to maximize the number of R5F processors. The TI IPC firmware for the split processors is already available public. This config aligns with other J721E boards and can be refactored out later. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-24-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 932424a925ce79cbed0a93d36c5f1b69a0128de1 Author: Beleswar Padhi Date: Mon Sep 8 19:58:14 2025 +0530 Revert "arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations" This reverts commit 1a314099b7559690fe23cdf3300dfff6e830ecb1. The C6x carveouts are reversed intentionally. This is due to the requirement to keep the DMA memory region as non-cached, however the minimum granular cache region for C6x is 16MB. So, C66x_0 marks the entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA memory region of C66x_1 as its own, and vice-versa. This was also called out in the original commit which introduced these reversed carveouts: "The minimum granularity on the Cache settings on C66x DSP cores is 16MB, so the DMA memory regions are chosen such that they are in separate 16MB regions for each DSP, while reserving a total of 16 MB for each DSP and not changing the overall DSP remoteproc carveouts." Fixes: 1a314099b755 ("arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations") Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-23-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 79a1778c7819c8491cdbdc1f7e46d478cb84d5cf Author: Beleswar Padhi Date: Mon Sep 8 19:58:13 2025 +0530 Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations" This reverts commit 9f3814a7c06b7c7296cf8c1622078ad71820454b. The C6x carveouts are reversed intentionally. This is due to the requirement to keep the DMA memory region as non-cached, however the minimum granular cache region for C6x is 16MB. So, C66x_0 marks the entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA memory region of C66x_1 as its own, and vice-versa. This was also called out in the original commit which introduced these reversed carveouts: "The minimum granularity on the Cache settings on C66x DSP cores is 16MB, so the DMA memory regions are chosen such that they are in separate 16MB regions for each DSP, while reserving a total of 16 MB for each DSP and not changing the overall DSP remoteproc carveouts." Fixes: 9f3814a7c06b ("arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations") Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-22-b-padhi@ti.com Signed-off-by: Nishanth Menon commit b13fb32f6bde4c0c533fab6e4bc240b75296e810 Author: Beleswar Padhi Date: Mon Sep 8 19:58:12 2025 +0530 arm64: dts: ti: k3-am642-tqma64xxl: Add missing cfg for TI IPC Firmware Currently, only R5F remote processors are enabled for k3-am642-tqma64xxl whereas the M4F in MCU domain is disabled. Enable the M4F remote processor at board level by reserving memory carveouts and assigning mailboxes. While at it, reserve the MAIN domain timers that are used by R5F remote processors for ticks to avoid rproc crashes. This config aligns with other AM64 boards and can be refactored out later. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-21-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 67b98792407f41b369ecd799a4928db24dbb2058 Author: Beleswar Padhi Date: Mon Sep 8 19:58:11 2025 +0530 arm64: dts: ti: k3-am64-phycore-som: Add missing cfg for TI IPC Firmware The k3-am64-phycore SoM enables all R5F and M4F remote processors. Reserve the MAIN domain timers that are used by R5F remote processors for ticks to avoid rproc crashes. This config aligns with other AM64 boards and can be refactored out later. Signed-off-by: Beleswar Padhi Tested-by: Wadim Egorov Link: https://patch.msgid.link/20250908142826.1828676-20-b-padhi@ti.com Signed-off-by: Nishanth Menon commit e85524649959c2fa2477b66a450471df6e1fb725 Author: Beleswar Padhi Date: Mon Sep 8 19:58:10 2025 +0530 arm64: dts: ti: k3-am642-sr-som: Add missing cfg for TI IPC Firmware Currently, only R5F remote processors are enabled for k3-am642-sr SoMs, whereas the M4F in MCU domain is disabled. Enable the M4F remote processor at board level by reserving memory carveouts and assigning mailboxes. While at it, reserve the MAIN domain timers that are used by R5F remote processors for ticks to avoid rproc crashes. This config aligns with other AM64 boards and can be refactored out later. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-19-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 6104984a7d1d8c17c724e799501a1be2a2a35a52 Author: Beleswar Padhi Date: Mon Sep 8 19:58:09 2025 +0530 arm64: dts: ti: k3-am62-pocketbeagle2: Add missing cfg for TI IPC Firmware The wkup_r5fss0_core0_memory_region is used to store the text/data sections of the Device Manager (DM) firmware itself and is necessary for platform boot. Whereas the wkup_r5fss0_core0_dma_memory_region is used for allocating the Virtio buffers needed for IPC with the DM core which could be optional. The labels were incorrectly used in the k3-am62-pocketbeagle2.dts file. Correct the firmware memory region label Currently, only mailbox node is enabled with FIFO assignment for a single M4F remote core. Add the missing carveouts for WKUP R5F remote processor, and enable that by associating to the above carveout and mailbox. This config aligns with other AM62 boards and can be refactored out later. Signed-off-by: Beleswar Padhi Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250908142826.1828676-18-b-padhi@ti.com Signed-off-by: Nishanth Menon commit a49f991e740f5f3917b4023705568aeb817ee773 Author: Beleswar Padhi Date: Mon Sep 8 19:58:08 2025 +0530 arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware The wkup_r5fss0_core0_memory_region is used to store the text/data sections of the Device Manager (DM) firmware itself and is necessary for platform boot. Whereas the wkup_r5fss0_core0_dma_memory_region is used for allocating the Virtio buffers needed for IPC with the DM core which could be optional. The labels were incorrectly used in the k3-am62-verdin.dtsi file. Correct the firmware memory region label. Currently, only mailbox node is enabled with FIFO assignment for a single M4F remote core. However, there are no users of the enabled mailboxes. Add the missing carveouts for WKUP R5F and MCU M4F remote processors, and enable those by associating to the above carveout and mailboxes. This config aligns with other AM62 boards and can be refactored out later. Signed-off-by: Beleswar Padhi Tested-by: Hiago De Franco # Verdin AM62 Acked-by: Francesco Dolcini Link: https://patch.msgid.link/20250908142826.1828676-17-b-padhi@ti.com Signed-off-by: Nishanth Menon commit fc4f6f0146d4c778859042a76b1e932b6334bf96 Author: Beleswar Padhi Date: Mon Sep 8 19:58:07 2025 +0530 arm64: dts: ti: k3-am62p-verdin: Add missing cfg for TI IPC Firmware The wkup_r5fss0_core0_memory_region is used to store the text/data sections of the Device Manager (DM) firmware itself and is necessary for platform boot. Whereas the wkup_r5fss0_core0_dma_memory_region is used for allocating the Virtio buffers needed for IPC with the DM core which could be optional. The labels were incorrectly used in the k3-am62p-verdin.dtsi file. Correct the firmware memory region label. Currently, only mailbox node is enabled with FIFO assignment. However, there are no users of the enabled mailboxes. Add the missing carveouts for WKUP and MCU R5F remote processors, and enable those by associating to the above carveout and mailboxes. This config aligns with other AM62P boards and can be refactored out later. Signed-off-by: Beleswar Padhi Tested-by: Hiago De Franco # Verdin AM62P Acked-by: Francesco Dolcini Link: https://patch.msgid.link/20250908142826.1828676-16-b-padhi@ti.com Signed-off-by: Nishanth Menon commit a564730142d5d23c197ca4b4741fb6a89e6f0c2c Author: Beleswar Padhi Date: Mon Sep 8 19:58:06 2025 +0530 arm64: dts: ti: k3-j721e-beagleboneai64: Add missing cfg for TI IPC FW The TI IPC Firmwares running on J721E SoCs use certain MAIN domain timers as tick. Reserve those at board level DT to avoid remote processor crashes. This config aligns with other J721E boards and can be refactored out later. Signed-off-by: Beleswar Padhi Link: https://patch.msgid.link/20250908142826.1828676-15-b-padhi@ti.com Signed-off-by: Nishanth Menon commit aee0678597c63e5427e91b2e49a6c5ed4951f277 Author: Beleswar Padhi Date: Mon Sep 8 19:58:05 2025 +0530 arm64: dts: ti: k3: Rename rproc reserved-mem nodes to 'memory@addr' Currently, the reserved memory carveouts used by remote processors are named like 'rproc-name--memory-region@addr'. While it is descriptive, the node label already serves that purpose. Rename reserved memory nodes to generic 'memory@addr' to align with the device tree specifications. This is done for all TI K3 based boards. Signed-off-by: Beleswar Padhi Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20250908142826.1828676-14-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 4f1aee4723a796a92f17b23699dc861b582ddfd2 Author: Beleswar Padhi Date: Mon Sep 8 19:58:04 2025 +0530 arm64: dts: ti: k3-am6*-boards: Add label to reserved-memory node Add the label name 'reserved_memory' to the reserved-memory node in all K3 AM6* board level dts files. This is done so that the node can be referenced and extended to add more carveout entries as needed in future refactoring patches. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-13-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 9ca8079eb36b71a86bb5851d9d3b7a49da8e595f Author: Beleswar Padhi Date: Mon Sep 8 19:58:03 2025 +0530 arm64: dts: ti: k3-am62a: Enable Mailbox nodes at the board level Mailbox nodes defined in the top-level AM62A SoC dtsi files are incomplete and may not be functional unless they are extended with a chosen interrupt and connection to a remote processor. As the remote processors depend on memory nodes which are only known at the board integration level, these nodes should only be enabled when provided with the above information. Disable the Mailbox nodes in the dtsi files and only enable the ones that are actually used on a given board. Signed-off-by: Beleswar Padhi Tested-by: Judith Mendez Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-12-b-padhi@ti.com Signed-off-by: Nishanth Menon commit bc590db1b5fe999d056ba66dc1990288c14f1ec3 Author: Beleswar Padhi Date: Mon Sep 8 19:58:02 2025 +0530 arm64: dts: ti: k3-am62: Enable Mailbox nodes at the board level Mailbox nodes defined in the top-level AM62x SoC dtsi files are incomplete and may not be functional unless they are extended with a chosen interrupt and connection to a remote processor. As the remote processors depend on memory nodes which are only known at the board integration level, these nodes should only be enabled when provided with the above information. Disable the Mailbox nodes in the dtsi files and only enable the ones that are actually used on a given board. Signed-off-by: Beleswar Padhi Reviewed-by: Dhruva Gole Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-11-b-padhi@ti.com Signed-off-by: Nishanth Menon commit c3fc9c1c1ac8f64ef333858ea42676889448a248 Author: Beleswar Padhi Date: Mon Sep 8 19:58:01 2025 +0530 arm64: dts: ti: k3-am65: Enable remote processors at board level Remote Processors defined in top-level AM65x SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-10-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 93b4ff5b86e5bc53aeba3a0193597ba31a4e5839 Author: Beleswar Padhi Date: Mon Sep 8 19:58:00 2025 +0530 arm64: dts: ti: k3-am64: Enable remote processors at board level Remote Processors defined in top-level AM64x SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Tested-by: Wadim Egorov # phycore-am64x Tested-by: Hari Nagalla Reviewed-by: Wadim Egorov Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-9-b-padhi@ti.com Signed-off-by: Nishanth Menon commit f927049553dfaa27acc099b21095ee488b199687 Author: Beleswar Padhi Date: Mon Sep 8 19:57:59 2025 +0530 arm64: dts: ti: k3-am62a: Enable remote processors at board level Remote Processors defined in top-level AM62A SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Tested-by: Judith Mendez Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-8-b-padhi@ti.com Signed-off-by: Nishanth Menon commit bdc921171dbe13fdc41589d44217d560299bbd5c Author: Beleswar Padhi Date: Mon Sep 8 19:57:58 2025 +0530 arm64: dts: ti: k3-am62: Enable remote processors at board level Remote Processors defined in top-level AM62x SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Tested-by: Wadim Egorov Reviewed-by: Wadim Egorov Reviewed-by: Dhruva Gole Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-7-b-padhi@ti.com Signed-off-by: Nishanth Menon commit ec158a0883c90528bbc1ec960a9b990d49a34099 Author: Beleswar Padhi Date: Mon Sep 8 19:57:57 2025 +0530 arm64: dts: ti: k3-am62p-j722s: Enable remote processors at board level Remote Processors defined in top-level AM62P-J722S common SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Tested-by: Judith Mendez Reviewed-by: Dhruva Gole Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-6-b-padhi@ti.com Signed-off-by: Nishanth Menon commit fa1b98ddfa1d44a98f70d7480c87f33f8d29c8d7 Author: Beleswar Padhi Date: Mon Sep 8 19:57:56 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2: Enable remote processors at board level Remote Processors defined in top-level J784S4-J742S2 common SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-5-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 368ae64a7188ac06d3cb2ee96975d40e6504e40d Author: Beleswar Padhi Date: Mon Sep 8 19:57:55 2025 +0530 arm64: dts: ti: k3-j721s2: Enable remote processors at board level Remote Processors defined in top-level J721S2 SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-4-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 73d0df7437364feb1a39772eccbb4f1a604cf623 Author: Beleswar Padhi Date: Mon Sep 8 19:57:54 2025 +0530 arm64: dts: ti: k3-j721e: Enable remote processors at board level Remote Processors defined in top-level J721E SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-3-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 7b09167cb7cb09282200903b6371996df4d76bc4 Author: Beleswar Padhi Date: Mon Sep 8 19:57:53 2025 +0530 arm64: dts: ti: k3-j7200: Enable R5F remote processors at board level Remote Processors defined in top-level J7200 SoC dtsi files are incomplete without the memory carveouts and mailbox assignments which are only known at board integration level. Therefore, disable the remote processors at SoC level and enable them at board level where above information is available. Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Link: https://patch.msgid.link/20250908142826.1828676-2-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 00c8fdc2809f05422d919809106f54c23de3cba3 Author: Beleswar Padhi Date: Sat Aug 23 22:01:11 2025 +0530 arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU R5F cores The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi for its MCU domain, but it does not override the firmware-name property for its R5F cores. This causes the wrong firmware binaries to be referenced. Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the firmware-name property with correct names for J742s2. Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family") Signed-off-by: Beleswar Padhi Reviewed-by: Udit Kumar Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com Signed-off-by: Nishanth Menon commit 037e496038f6e4cfb3642a0ffc2db19838d564dd Author: Bryan Brattlof Date: Mon Sep 8 14:15:28 2025 -0500 soc: ti: k3-socinfo: Add information for AM62L SR1.1 The second silicon revision for the AM62L was mainly a ROM revision and therefore this silicon revision is labeled SR1.1 Add a new decode array to properly identify this revision as SR1.1 Signed-off-by: Bryan Brattlof Link: https://patch.msgid.link/20250908-62l-chipid-v1-1-9c7194148140@ti.com Signed-off-by: Nishanth Menon commit cf99b26d3081b1f9961cc213415867706d19a414 Merge: 8d04ea1a92b843 2fd653b9bb5aac Author: Dave Airlie Date: Fri Sep 12 13:37:32 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-09-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-09-09: amdgpu: - Add CRIU support for gem objects - SI UVD fix - SI DPM fixes - Misc code cleanups - RAS updates - GPUVM debugfs fixes - Cyan Skillfish updates - UserQ updates - OEM i2c fix - SMU 13.0.x updates - DPCD probe quirk fix - Make vbios build number available in sysfs - HDCP updates - Brightness curve fixes - eDP updates - Vblank fixes - DCN 3.5 PG fix - PBN calcution fix amdkfd: - Add CRIU support for gem objects - Flexible array fix - P2P topology fix - APU memlimit fixes - Misc code cleanups UAPI: - Add CRIU support for gem objects Proposed userspace: https://github.com/checkpoint-restore/criu/pull/2613 radeon: - Use dev_warn_once() in CS parsers Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250909161928.942785-1-alexander.deucher@amd.com commit 8d04ea1a92b843890b874551959a9b21bc7f30d4 Merge: b1c1c5244838c8 91494dee1091a1 Author: Dave Airlie Date: Fri Sep 12 12:56:19 2025 +1000 Merge tag 'drm-misc-next-2025-09-11' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.18: UAPI Changes: - Provide 'boot_display' attribute on boot-up devices amdxdma: - Add ioctl DRM_IOCTL_AMDXDNA_GET_ARRAY Cross-subsystem Changes: bindings: - Add Mayqueen vendor prefix mayqueen- pci: - vgaarb: Use screen_info helpers Core Changes: ttm: - Add interface to populate buffers Driver Changes: amdgpu: - Pre-populate exported buffers ast: - Clean up detection of DRAM config bochs: - Clean up bridge: - adv7511: Write full Audio infoframe - ite6263: Support vendor-specific infoframes - simple: Add support for Realtek RTD2171 DP-to-HDMI plus DT bindings - Clean up gma500: - Clean up nouveau: - Pre-populate exported buffers panel: - edp: Add support for additonal mt8189 Chromebook panels - lvds: Add DT bindings for EDT ETML0700Z8DHA - Clean up pixpaper: - Add support for Mayqueen Pixpaper plus DT bindings rcar-du: - Use RUNTIME_PM_OPS - Add support for DSI commands vkms: - Support variants of ARGB8888, ARGB16161616, RGB565, RGB888 and P01x - Spport YUV with 16-bit components xe: - Pre-populate exported buffers Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250911091737.GA39831@linux.fritz.box commit 34c2202f5ca2325511a0e0b8802492eec17a2c76 Merge: 9ca01e9226dbbb 30db1b21fa37a2 Author: Mark Brown Date: Fri Sep 12 03:25:40 2025 +0100 spi: axi-spi-engine: improve version checks Merge series from David Lechner : We have a pending major version bump for the axi-spi-engine so to prepare for that, improve the existing version checks for feature enablement. commit b1c1c5244838c8199f83e723597b12ee04aea10d Merge: 6dc1d3c191ac13 70a9b201cfa893 Author: Dave Airlie Date: Fri Sep 12 12:11:00 2025 +1000 Merge tag 'drm-intel-next-2025-09-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Cross-subsystem Changes: - iopoll: Generalize read_poll_timeout() into poll_timeout_us() (Ville) Non-display related: - PREEMPT_RT fix (Sebastian) - Replace DRM_DEBUG_SELFTEST with DRM_KUNIT_TEST (Ruben, Imre) - Some changes oeveral like in RPS, SoC, debugfs targeting display separation (Jani) Display related: - General refactor in favor of intel_display (Suraj) - Prune modes for YUV420 (Suraj) - Reject HBR3 in any eDP Panel (Ankit) - Change AUX DPCD probe address (Imre) - Display Wa fix, additions, and updates (Ankit, Vinod, Nemesa, Suraj, Jouni)) - DP: Fix 2.7 Gbps link training on g4x (Ville) - DP: Adjust the idle pattern handling (Ville) - DP: Shuffle the link training code a bit (Ville) - Don't set/read the DSI C clock divider on GLK (Ville) - Precompute plane SURF address/etc (Ville) - Enable_psr kernel parameter changes (Jouni) - PHY LFPS sending configuration fixes (Jouni) - Fix dma_fence_wait_timeout() return value handling (Aakash) - DP: Fix disabling training pattern (Imre) - Small code clean-ups (Gustavo, Colin, Jani, Juha-Pekka) - Change vblank log from err to debug (Suraj) - More display clean-up towards intel_display split (Jani) - Use the recomended min_hblank values (Arun) - Block hpd during suspend (Dibin) - DSI: Fix overflow issue in pclk parsing (Jouni) - PSR: Do not trigger Frame Change events from frontbuffer flush (Jouni) - VBT cleanups and new fields (Jani, Suraj) - Type-C enabled/disconnected dp-alt sink (Imre) - Optimize panel power-on wait time (Dibin) - Wildcat Lake enabling (Imre, Chaitanya) - DP HDR updates (Chaitanya) - Fix divide by 0 error in i9xx_set_backlight (Suraj) - Fixes for PSR (Jouni) - Remove the encoder check in hdcp enable (Suraj) - Control HDMI output bpc (Lee) - Fix possible overflow on tc power (Mika) - Convert code towards poll_timeout_* (Jani) - Use REG_BIT on FW_BLC_SELF_* macros (Luca) - ALPM LFPS and silence period calculation (Jouni) - Remove power state verification before HW readout (Imre) - Fix HPD mtp_tc_hpd_enable_detection (Ville) - DRAM detection (Ville) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aLtc-gk3jhwcWxZh@intel.com commit dc2f650f7e6857bf384069c1a56b2937a1ee370d Author: Alok Tiwari Date: Wed Sep 10 12:50:26 2025 -0700 udp_tunnel: use netdev_warn() instead of netdev_WARN() netdev_WARN() uses WARN/WARN_ON to print a backtrace along with file and line information. In this case, udp_tunnel_nic_register() returning an error is just a failed operation, not a kernel bug. udp_tunnel_nic_register() can fail due to a memory allocation failure (kzalloc() or udp_tunnel_nic_alloc()). This is a normal runtime error and not a kernel bug. Replace netdev_WARN() with netdev_warn() accordingly. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 4ca6a89f38718d6cd84304e6a26e7ddc90e03356 Author: Johan Hovold Date: Wed Sep 10 15:47:37 2025 +0200 clk: qcom: gcc-sc8280xp: drop obsolete PCIe GDSC comment Drop an obsolete comment about keeping the PCIe GDSCs always-on, something which is no longer the case since commit db382dd55bcb ("clk: qcom: gcc-sc8280xp: Allow PCIe GDSCs to enter retention state"). Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250910134737.19381-1-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson commit 999337afa51d9bd7941f6ace24923ba64690380f Merge: bf2650d0599c99 51e547e8c89c66 Author: Jakub Kicinski Date: Thu Sep 11 19:05:59 2025 -0700 Merge branch 'tcp-destroy-tcp-ao-tcp-md5-keys-in-sk_destruct' Dmitry Safonov says: ==================== tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() On one side a minor/cosmetic issue, especially nowadays when TCP-AO/TCP-MD5 signature verification failures aren't logged to dmesg. Yet, I think worth addressing for two reasons: - unsigned RST gets ignored by the peer and the connection is alive for longer (keep-alive interval) - netstat counters increase and trace events report that trusted BGP peer is sending unsigned/incorrectly signed segments, which can ring alarm on monitoring. ==================== Link: https://patch.msgid.link/20250909-b4-tcp-ao-md5-rst-finwait2-v5-0-9ffaaaf8b236@arista.com Signed-off-by: Jakub Kicinski commit 51e547e8c89c661f6fbede4a28b1d33b13625683 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Sep 9 02:18:51 2025 +0100 tcp: Free TCP-AO/TCP-MD5 info/keys without RCU Now that the destruction of info/keys is delayed until the socket destructor, it's safe to use kfree() without an RCU callback. The socket is in TCP_CLOSE state either because it never left it, or it's already closed and the refcounter is zero. In any way, no one can discover it anymore, it's safe to release memory straight away. Similar thing was possible for twsk already. Reviewed-by: Kuniyuki Iwashima Signed-off-by: Dmitry Safonov Link: https://patch.msgid.link/20250909-b4-tcp-ao-md5-rst-finwait2-v5-2-9ffaaaf8b236@arista.com Signed-off-by: Jakub Kicinski commit 9e472d9e84b11e9f3c429eba97c2a9e74461a884 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Sep 9 02:18:50 2025 +0100 tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() Currently there are a couple of minor issues with destroying the keys tcp_v4_destroy_sock(): 1. The socket is yet in TCP bind buckets, making it reachable for incoming segments [on another CPU core], potentially available to send late FIN/ACK/RST replies. 2. There is at least one code path, where tcp_done() is called before sending RST [kudos to Bob for investigation]. This is a case of a server, that finished sending its data and just called close(). The socket is in TCP_FIN_WAIT2 and has RCV_SHUTDOWN (set by __tcp_close()) tcp_v4_do_rcv()/tcp_v6_do_rcv() tcp_rcv_state_process() /* LINUX_MIB_TCPABORTONDATA */ tcp_reset() tcp_done_with_error() tcp_done() inet_csk_destroy_sock() /* Destroys AO/MD5 keys */ /* tcp_rcv_state_process() returns SKB_DROP_REASON_TCP_ABORT_ON_DATA */ tcp_v4_send_reset() /* Sends an unsigned RST segment */ tcpdump: > 22:53:15.399377 00:00:b2:1f:00:00 > 00:00:01:01:00:00, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 33929, offset 0, flags [DF], proto TCP (6), length 60) > 1.0.0.1.34567 > 1.0.0.2.49848: Flags [F.], seq 2185658590, ack 3969644355, win 502, options [nop,nop,md5 valid], length 0 > 22:53:15.399396 00:00:01:01:00:00 > 00:00:b2:1f:00:00, ethertype IPv4 (0x0800), length 86: (tos 0x0, ttl 64, id 51951, offset 0, flags [DF], proto TCP (6), length 72) > 1.0.0.2.49848 > 1.0.0.1.34567: Flags [.], seq 3969644375, ack 2185658591, win 128, options [nop,nop,md5 valid,nop,nop,sack 1 {2185658590:2185658591}], length 0 > 22:53:16.429588 00:00:b2:1f:00:00 > 00:00:01:01:00:00, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) > 1.0.0.1.34567 > 1.0.0.2.49848: Flags [R], seq 2185658590, win 0, length 0 > 22:53:16.664725 00:00:b2:1f:00:00 > 00:00:01:01:00:00, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) > 1.0.0.1.34567 > 1.0.0.2.49848: Flags [R], seq 2185658591, win 0, options [nop,nop,md5 valid], length 0 > 22:53:17.289832 00:00:b2:1f:00:00 > 00:00:01:01:00:00, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) > 1.0.0.1.34567 > 1.0.0.2.49848: Flags [R], seq 2185658591, win 0, options [nop,nop,md5 valid], length 0 Note the signed RSTs later in the dump - those are sent by the server when the fin-wait socket gets removed from hash buckets, by the listener socket. Instead of destroying AO/MD5 info and their keys in inet_csk_destroy_sock(), slightly delay it until the actual socket .sk_destruct(). As shutdown'ed socket can yet send non-data replies, they should be signed in order for the peer to process them. Now it also matches how AO/MD5 gets destructed for TIME-WAIT sockets (in tcp_twsk_destructor()). This seems optimal for TCP-MD5, while for TCP-AO it seems to have an open problem: once RST get sent and socket gets actually destructed, there is no information on the initial sequence numbers. So, in case this last RST gets lost in the network, the server's listener socket won't be able to properly sign another RST. Nothing in RFC 1122 prescribes keeping any local state after non-graceful reset. Luckily, BGP are known to use keep alive(s). While the issue is quite minor/cosmetic, these days monitoring network counters is a common practice and getting invalid signed segments from a trusted BGP peer can get customers worried. Investigated-by: Bob Gilligan Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Signed-off-by: Dmitry Safonov Link: https://patch.msgid.link/20250909-b4-tcp-ao-md5-rst-finwait2-v5-1-9ffaaaf8b236@arista.com Signed-off-by: Jakub Kicinski commit bf2650d0599c999cf2fdffa721b00e25989918fb Merge: 18282100d70406 dbd91347927dca Author: Jakub Kicinski Date: Thu Sep 11 19:02:53 2025 -0700 Merge branch 'bridge-allow-keeping-local-fdb-entries-only-on-vlan-0' Petr Machata says: ==================== bridge: Allow keeping local FDB entries only on VLAN 0 The bridge FDB contains one local entry per port per VLAN, for the MAC of the port in question, and likewise for the bridge itself. This allows bridge to locally receive and punt "up" any packets whose destination MAC address matches that of one of the bridge interfaces or of the bridge itself. The number of these local "service" FDB entries grows linearly with number of bridge-global VLAN memberships, but that in turn will tend to grow quadratically with number of ports and per-port VLAN memberships. While that does not cause issues during forwarding lookups, it does make dumps impractically slow. As an example, with 100 interfaces, each on 4K VLANs, a full dump of FDB that just contains these 400K local entries, takes 6.5s. That's _without_ considering iproute2 formatting overhead, this is just how long it takes to walk the FDB (repeatedly), serialize it into netlink messages, and parse the messages back in userspace. This is to illustrate that with growing number of ports and VLANs, the time required to dump this repetitive information blows up. Arguably 4K VLANs per interface is not a very realistic configuration, but then modern switches can instead have several hundred interfaces, and we have fielded requests for >1K VLAN memberships per port among customers. FDB entries are currently all kept on a single linked list, and then dumping uses this linked list to walk all entries and dump them in order. When the message buffer is full, the iteration is cut short, and later restarted. Of course, to restart the iteration, it's first necessary to walk the already-dumped front part of the list before starting dumping again. So one possibility is to organize the FDB entries in different structure more amenable to walk restarts. One option is to walk directly the hash table. The advantage is that no auxiliary structure needs to be introduced. With a rough sketch of this approach, the above scenario gets dumped in not quite 3 s, saving over 50 % of time. However hash table iteration requires maintaining an active cursor that must be collected when the dump is aborted. It looks like that would require changes in the NDO protocol to allow to run this cleanup. Moreover, on hash table resize the iteration is simply restarted. FDB dumps are currently not guaranteed to correspond to any one particular state: entries can be missed, or be duplicated. But with hash table iteration we would get that plus the much less graceful resize behavior, where swaths of FDB are duplicated. Another option is to maintain the FDB entries in a red-black tree. We have a PoC of this approach on hand, and the above scenario is dumped in about 2.5 s. Still not as snappy as we'd like it, but better than the hash table. However the savings come at the expense of a more expensive insertion, and require locking during dumps, which blocks insertion. The upside of these approaches is that they provide benefits whatever the FDB contents. But it does not seem like either of these is workable. However we intend to clean up the RB tree PoC and present it for consideration later on in case the trade-offs are considered acceptable. Yet another option might be to use in-kernel FDB filtering, and to filter the local entries when dumping. Unfortunately, this does not help all that much either, because the linked-list walk still needs to happen. Also, with the obvious filtering interface built around ndm_flags / ndm_state filtering, one can't just exclude pure local entries in one query. One needs to dump all non-local entries first, and then to get permanent entries in another run filter local & added_by_user. I.e. one needs to pay the iteration overhead twice, and then integrate the result in userspace. To get significant savings, one would need a very specific knob like "dump, but skip/only include local entries". But if we are adding a local-specific knobs, maybe let's have an option to just not duplicate them in the first place. All this FDB duplication is there merely to make things snappy during forwarding. But high-radix switches with thousands of VLANs typically do not process much traffic in the SW datapath at all, but rather offload vast majority of it. So we could exchange some of the runtime performance for a neater FDB. To that end, in this patchset, introduce a new bridge option, BR_BOOLOPT_FDB_LOCAL_VLAN_0, which when enabled, has local FDB entries installed only on VLAN 0, instead of duplicating them across all VLANs. Then to maintain the local termination behavior, on FDB miss, the bridge does a second lookup on VLAN 0. Enabling this option changes the bridge behavior in expected ways. Since the entries are only kept on VLAN 0, FDB get, flush and dump will not perceive them on non-0 VLANs. And deleting the VLAN 0 entry affects forwarding on all VLANs. This patchset is loosely based on a privately circulated patch by Nikolay Aleksandrov. The patchset progresses as follows: - Patch #1 introduces a bridge option to enable the above feature. Then patches #2 to #5 gradually patch the bridge to do the right thing when the option is enabled. Finally patch #6 adds the UAPI knob and the code for when the feature is enabled or disabled. - Patches #7, #8 and #9 contain fixes and improvements to selftest libraries - Patch #10 contains a new selftest ==================== Link: https://patch.msgid.link/cover.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit dbd91347927dca120e9d904cbcce90bae0c51ec3 Author: Petr Machata Date: Thu Sep 4 19:07:27 2025 +0200 selftests: forwarding: Add test for BR_BOOLOPT_FDB_LOCAL_VLAN_0 Add a selftest to check the operation of this newly-introduced bridge option. Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/62294f96884ab5d341648eef21243fa099a2dee5.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit fa57032941d4b451c7264ebf3ad595bc98e3a9a9 Author: Petr Machata Date: Thu Sep 4 19:07:26 2025 +0200 selftests: net: lib.sh: Don't defer failed commands Usually the autodefer helpers in lib.sh are expected to be run in context where success is the expected outcome. However when using them for feature detection, failure can legitimately occur. But the failed command still schedules a cleanup, which will likely fail again. Instead, only schedule deferred cleanup when the positive command succeeds. This way of organizing the cleanup has the added benefit that now the return code from these functions reflects whether the command passed. Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/af10a5bb82ea11ead978cf903550089e006d7e70.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit ed07c8f2b854e2d0c76ed95de7452fa5c0a3d4c5 Author: Petr Machata Date: Thu Sep 4 19:07:25 2025 +0200 selftests: defer: Introduce DEFER_PAUSE_ON_FAIL The fact that all cleanup (ideally) goes through the defer framework makes debugging of these commands a bit tricky. However, this also gives us a nice point to place a hook along the lines of PAUSE_ON_FAIL. When the environment variable DEFER_PAUSE_ON_FAIL is set, and a cleanup command results in non-zero exit status, show a bit of debuginfo and give the user an opportunity to interrupt the execution altogether. Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/2a07d24568ede6c42e4701657fa0b738e490fe59.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit d89d3b29ce1a081507bf7b0a18405dc6b8e69a21 Author: Petr Machata Date: Thu Sep 4 19:07:24 2025 +0200 selftests: defer: Allow spaces in arguments of deferred commands Currently the way deferred commands are stored and invoked causes any whitespace to act as an argument separator when the command is executed. To make it possible to use spaces in deferred commands, store the commands quoted, and then eval the string prior to execution. Fixes: a6e263f125cd ("selftests: net: lib: Introduce deferred commands") Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/6c2523139a6f99103889c9c9fedcdc66a75441f4.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 21446c06b441b9c993870efae71aef4e9aa72ec7 Author: Petr Machata Date: Thu Sep 4 19:07:23 2025 +0200 net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0 The previous patches introduced a new option, BR_BOOLOPT_FDB_LOCAL_VLAN_0. When enabled, it has local FDB entries installed only on VLAN 0, instead of duplicating them across all VLANs. In this patch, add the corresponding UAPI toggle, and the code for turning the feature on and off. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/ea99bfb10f687fa58091e6e1c2f8acc33f47ca45.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a29aba64e022072eb1388e9bf041fbec6902553e Author: Petr Machata Date: Thu Sep 4 19:07:22 2025 +0200 net: bridge: BROPT_FDB_LOCAL_VLAN_0: Skip local FDBs on VLAN creation When BROPT_FDB_LOCAL_VLAN_0 is enabled, the local FDB entries for the member ports as well as the bridge itself should not be created per-VLAN, but instead only on VLAN 0. Thus when a VLAN is added for a port or the bridge itself, a local FDB entry with the corresponding address should not be added when in the VLAN-0 mode. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/bb13ba01d58ed6d5d700e012c519d38ee6806d22.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 40df3b8e90eec85b0830dfc04d805f7ddbcc929d Author: Petr Machata Date: Thu Sep 4 19:07:21 2025 +0200 net: bridge: BROPT_FDB_LOCAL_VLAN_0: On bridge changeaddr, skip per-VLAN FDBs When BROPT_FDB_LOCAL_VLAN_0 is enabled, the local FDB entries for the bridge itself should not be created per-VLAN, but instead only on VLAN 0. When the bridge address changes, the local FDB entries need to be updated, which is done in br_fdb_change_mac_address(). Bail out early when in VLAN-0 mode, so that the per-VLAN FDB entries are not created. The per-VLAN walk is only done afterwards. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/0bd432cf91921ef7c4ed0e129de1d1cd358c716b.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 4cf5fd84978738acf3d3610c19c81bbe4a083b93 Author: Petr Machata Date: Thu Sep 4 19:07:20 2025 +0200 net: bridge: BROPT_FDB_LOCAL_VLAN_0: On port changeaddr, skip per-VLAN FDBs When BROPT_FDB_LOCAL_VLAN_0 is enabled, the local FDB entries for member ports should not be created per-VLAN, but instead only on VLAN 0. When the member port address changes, the local FDB entries need to be updated, which is done in br_fdb_changeaddr(). Under the VLAN-0 mode, only one local FDB entry will ever be added for a port's address, and that on VLAN 0. Thus bail out of the delete loop early. For the same reason, also skip adding the per-VLAN entries. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/0cf9d41836d2a245b0ce07e1a16ee05ca506cbe9.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 60d6be0931e931e1fb585242d3b391012cd113e3 Author: Petr Machata Date: Thu Sep 4 19:07:19 2025 +0200 net: bridge: BROPT_FDB_LOCAL_VLAN_0: Look up FDB on VLAN 0 on miss When BROPT_FDB_LOCAL_VLAN_0 is enabled, the local FDB entries for the member ports as well as the bridge itself should not be created per-VLAN, but instead only on VLAN 0. That means that br_handle_frame_finish() needs to make two lookups: the primary lookup on an appropriate VLAN, and when that misses, a lookup on VLAN 0. Have the second lookup only accept local MAC addresses. Turning this into a generic second-lookup feature is not the goal. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/8087475009dce360fb68d873b1ed9c80827da302.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit c1164178e9a86f63c2b39a187bd2670783a244b4 Author: Petr Machata Date: Thu Sep 4 19:07:18 2025 +0200 net: bridge: Introduce BROPT_FDB_LOCAL_VLAN_0 The following patches will gradually introduce the ability of the bridge to look up local FDB entries on VLAN 0 instead of using the VLAN indicated by a packet. In this patch, just introduce the option itself, with which the feature will be linked. Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/ab85e33ef41ed19a3deaef0ff7da26830da30642.1757004393.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 18282100d7040614b553f1cad737cb689c04e2b9 Author: Stanislav Fomichev Date: Wed Sep 10 09:24:29 2025 -0700 net: devmem: expose tcp_recvmsg_locked errors tcp_recvmsg_dmabuf can export the following errors: - EFAULT when linear copy fails - ETOOSMALL when cmsg put fails - ENODEV if one of the frags is readable - ENOMEM on xarray failures But they are all ignored and replaced by EFAULT in the caller (tcp_recvmsg_locked). Expose real error to the userspace to add more transparency on what specifically fails. In non-devmem case (skb_copy_datagram_msg) doing `if (!copied) copied=-EFAULT` is ok because skb_copy_datagram_msg can return only EFAULT. Reviewed-by: David Ahern Reviewed-by: Mina Almasry Reviewed-by: Eric Dumazet Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250910162429.4127997-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit a055d3b2ce29f22f9562a75933518ddd3eb38766 Merge: 4094920b19f78f ff78bfe48be8c1 Author: Jakub Kicinski Date: Thu Sep 11 18:52:28 2025 -0700 Merge branch 'wireguard-fixes-for-6-17-rc6' Jason A. Donenfeld says: ==================== wireguard fixes for 6.17-rc6 Please find three small fixes to wireguard: 1) A general simplification to the way wireguard chooses the next available cpu, by making use of cpumask_nth(), and covering an edge case. 2) A cleanup to the selftests kconfig. 3) A fix to the selftests kconfig so that it actually runs again. ==================== Link: https://patch.msgid.link/20250910013644.4153708-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit ff78bfe48be8c1de5a0c88aae109c6659fc89740 Author: Jason A. Donenfeld Date: Wed Sep 10 03:36:44 2025 +0200 wireguard: selftests: select CONFIG_IP_NF_IPTABLES_LEGACY This is required on recent kernels, where it is now off by default. While we're here, fix some stray =m's that were supposed to be =y. Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250910013644.4153708-5-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 30e1a1dfa2283cf21d3361fb846f42c0ce1ee51c Author: David Hildenbrand Date: Wed Sep 10 03:36:43 2025 +0200 wireguard: selftests: remove CONFIG_SPARSEMEM_VMEMMAP=y from qemu kernel config It's no longer user-selectable (and the default was already "y"), so let's just drop it. It was never really relevant to the wireguard selftests either way. Cc: Shuah Khan Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: David Hildenbrand Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250910013644.4153708-4-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 5bd8de20770ca001621bb1aa5eb9a0977d0bd2d9 Author: Yury Norov (NVIDIA) Date: Wed Sep 10 03:36:42 2025 +0200 wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online() The function gets number of online CPUS, and uses it to search for Nth cpu in cpu_online_mask. If id == num_online_cpus() - 1, and one CPU gets offlined between calling num_online_cpus() -> cpumask_nth(), there's a chance for cpumask_nth() to find nothing and return >= nr_cpu_ids. The caller code in __queue_work() tries to avoid that by checking the returned CPU against WORK_CPU_UNBOUND, which is NR_CPUS. It's not the same as '>= nr_cpu_ids'. On a typical Ubuntu desktop, NR_CPUS is 8192, while nr_cpu_ids is the actual number of possible CPUs, say 8. The non-existing cpu may later be passed to rcu_dereference() and corrupt the logic. Fix it by switching from 'if' to 'while'. Suggested-by: Jason A. Donenfeld Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250910013644.4153708-3-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 5551d21284702a5f36791aecc7735870d0423996 Author: Yury Norov [NVIDIA] Date: Wed Sep 10 03:36:41 2025 +0200 wireguard: queueing: simplify wg_cpumask_next_online() wg_cpumask_choose_online() opencodes cpumask_nth(). Use it and make the function significantly simpler. While there, fix opencoded cpu_online() too. Signed-off-by: Yury Norov Reviewed-by: Simon Horman Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250910013644.4153708-2-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 4094920b19f78f3af8c67731fb4ba27973b83468 Author: Gustavo A. R. Silva Date: Tue Sep 9 17:42:39 2025 +0200 geneve: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that `struct ip_tunnel_info` is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: drivers/net/geneve.c:56:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/aMBK78xT2fUnpwE5@kspp Signed-off-by: Jakub Kicinski commit ac36dea3bc85c2cde87e490736708032328dfbdc Author: Alok Tiwari Date: Tue Sep 9 05:26:07 2025 -0700 ipv6: udp: fix typos in comments Correct typos in ipv6/udp.c comments: "execeeds" -> "exceeds" "tacking care" -> "taking care" "measureable" -> "measurable" No functional changes. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250909122611.3711859-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit be30f56386f202530127c1c2ec55b6dd2c9489d1 Merge: e663ad6e06a776 f7460d2989fa7f Author: Jakub Kicinski Date: Thu Sep 11 18:40:10 2025 -0700 Merge branch 'net-af_packet-optimize-retire-operation' Xin Zhao says: ==================== net: af_packet: optimize retire operation In a system with high real-time requirements, the timeout mechanism of ordinary timers with jiffies granularity is insufficient to meet the demands for real-time performance. Meanwhile, the optimization of CPU usage with af_packet is quite significant. Use hrtimer instead of timer to help compensate for the shortcomings in real-time performance. In HZ=100 or HZ=250 system, the update of TP_STATUS_USER is not real-time enough, with fluctuations reaching over 8ms (on a system with HZ=250). This is unacceptable in some high real-time systems that require timely processing of network packets. By replacing it with hrtimer, if a timeout of 2ms is set, the update of TP_STATUS_USER can be stabilized to within 3 ms. ==================== Link: https://patch.msgid.link/20250908104549.204412-1-jackzxcui1989@163.com Signed-off-by: Jakub Kicinski commit f7460d2989fa7fb29a0c6d8b929076521480a124 Author: Xin Zhao Date: Mon Sep 8 18:45:49 2025 +0800 net: af_packet: Use hrtimer to do the retire operation In a system with high real-time requirements, the timeout mechanism of ordinary timers with jiffies granularity is insufficient to meet the demands for real-time performance. Meanwhile, the optimization of CPU usage with af_packet is quite significant. Use hrtimer instead of timer to help compensate for the shortcomings in real-time performance. In HZ=100 or HZ=250 system, the update of TP_STATUS_USER is not real-time enough, with fluctuations reaching over 8ms (on a system with HZ=250). This is unacceptable in some high real-time systems that require timely processing of network packets. By replacing it with hrtimer, if a timeout of 2ms is set, the update of TP_STATUS_USER can be stabilized to within 3 ms. Delete delete_blk_timer field, because hrtimer_cancel will check and wait until the timer callback return and ensure never enter callback again. Simplify the logic related to setting timeout, only update the hrtimer expire time within the hrtimer callback, no longer update the expire time in prb_open_block which is called by tpacket_rcv or timer callback. Reasons why NOT update hrtimer in prb_open_block: 1) It will increase complexity to distinguish the two caller scenario. 2) hrtimer_cancel and hrtimer_start need to be called if you want to update TMO of an already enqueued hrtimer, leading to complex shutdown logic. One side effect of NOT update hrtimer when called by tpacket_rcv is that a newly opened block triggered by tpacket_rcv may be retired earlier than expected. On the other hand, if timeout is updated in prb_open_block, the frequent reception of network packets that leads to prb_open_block being called may cause hrtimer to be removed and enqueued repeatedly. The retire hrtimer expiration is unconditional and periodic. If there are numerous packet sockets on the system, please set an appropriate timeout to avoid frequent enqueueing of hrtimers. Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Link: https://lore.kernel.org/all/20250831100822.1238795-1-jackzxcui1989@163.com/ Signed-off-by: Xin Zhao Link: https://patch.msgid.link/20250908104549.204412-3-jackzxcui1989@163.com Signed-off-by: Jakub Kicinski commit 28d2420d403ada8a5ff1bf2077ef66051b2aa4d7 Author: Xin Zhao Date: Mon Sep 8 18:45:48 2025 +0800 net: af_packet: remove last_kactive_blk_num field kactive_blk_num (K) is only incremented on block close. In timer callback prb_retire_rx_blk_timer_expired, except delete_blk_timer is true, last_kactive_blk_num (L) is set to match kactive_blk_num (K) in all cases. L is also set to match K in prb_open_block. The only case K not equal to L is when scheduled by tpacket_rcv and K is just incremented on block close but no new block could be opened, so that it does not call prb_open_block in prb_dispatch_next_block. This patch modifies the prb_retire_rx_blk_timer_expired function by simply removing the check for L == K. This patch just provides another checkpoint to thaw the might-be-frozen block in any case. It doesn't have any effect because __packet_lookup_frame_in_block() has the same logic and does it again without this patch when detecting the ring is frozen. The patch only advances checking the status of the ring. Suggested-by: Willem de Bruijn Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Link: https://lore.kernel.org/all/20250831100822.1238795-1-jackzxcui1989@163.com/ Signed-off-by: Xin Zhao Link: https://patch.msgid.link/20250908104549.204412-2-jackzxcui1989@163.com Signed-off-by: Jakub Kicinski commit e663ad6e06a776b739d490b51c59c07cb4d767a4 Author: Rob Herring (Arm) Date: Mon Sep 8 18:10:14 2025 -0500 dt-bindings: net: Convert APM XGene MDIO to DT schema Convert the APM XGene MDIO bus binding to DT schema format. It's a straight-forward conversion. Reviewed-by: Jacob Keller Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250908231016.2070305-2-robh@kernel.org Signed-off-by: Jakub Kicinski commit 0b467f5a7f19853d8b7a920468d795e682442b80 Author: Rob Herring (Arm) Date: Mon Sep 8 18:10:13 2025 -0500 dt-bindings: net: Convert apm,xgene-enet to DT schema Convert the APM XGene Ethernet binding to DT schema format. Add the missing apm,xgene2-sgenet and apm,xgene2-xgenet compatibles. Drop "reg-names" as required. Add support for up to 16 interrupts. Reviewed-by: Jacob Keller Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250908231016.2070305-1-robh@kernel.org Signed-off-by: Jakub Kicinski commit a9d517ae99875fd59570a165a9768611d3bfd22b Merge: 43adad382e1fde fd2b2429fbc859 Author: Jakub Kicinski Date: Thu Sep 11 18:34:38 2025 -0700 Merge branch 'net-ethernet-renesas-rcar_gen4_ptp-simplify-register-layout' Niklas Söderlund says: ==================== net: ethernet: renesas: rcar_gen4_ptp: Simplify register layout The daughter driver rcar_gen4_ptp used by both rswitch and rtsn where upstreamed with support for possible different memory layouts on different users. With all Gen4 boards upstream no such setup is documented. There are other issues related to how the rcar_gen4_ptp driver is shared between multiple useres that needs to be cleaned up. But that will be a larger work. So before that get some simple fixes done. Patch 1/3 and 2/3 removes the support to allow different register layouts on different SoCs by looking up offsets at runtime with a much simpler interface. The new interface computes the offsets at compile time. While patch 3/3 is a drive-by patch taking a spurs comment and making a lockdep check of it. There is no intentional functional change in this series just cleaning up in preparation of larger works to follow. ==================== Link: https://patch.msgid.link/20250908154426.3062861-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit fd2b2429fbc859b398385da69c85515851f2c0e5 Author: Niklas Söderlund Date: Mon Sep 8 17:44:26 2025 +0200 net: ethernet: renesas: rcar_gen4_ptp: Use lockdep to verify internal usage Instead of a having a comment that the lock must be held when calling the internal helper add a lockdep check to enforce it. Signed-off-by: Niklas Söderlund Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250908154426.3062861-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 492d816b1793b4f72a458a7261bdbaa1ec1bd2f2 Author: Niklas Söderlund Date: Mon Sep 8 17:44:25 2025 +0200 net: ethernet: renesas: rcar_gen4_ptp: Hide register layout With the support for multiple register layout removed all support structures can be removed from the header file. Covert to a simpler structure using defines for the register offsets. There is no functional change, only switching from looking up offsets at runtime to compile time. Signed-off-by: Niklas Söderlund Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250908154426.3062861-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 4da47931a9240ff44547d30983cb23e26b05d180 Author: Niklas Söderlund Date: Mon Sep 8 17:44:24 2025 +0200 net: ethernet: renesas: rcar_gen4_ptp: Remove different memory layout When upstreaming the Gen4 PTP support for R-Car S4 the possibility for different memory layouts on other Gen4 SoCs was build in. It turns out this is not needed and instead needlessly makes the driver harder to read, remove the support code that would have allowed different memory layouts. This change only deals with the public functions used by other drivers, follow up work will clean up the rcar_gen4_ptp internals. Signed-off-by: Niklas Söderlund Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250908154426.3062861-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e Author: Daniel Palmer Date: Sun Sep 7 15:43:49 2025 +0900 eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range() and from there __pci_ioport_map() for the PCI IO space. If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will always fail and the driver will complain it couldn't map the PIO space and return an error. NO_IOPORT_MAP seems to cover the case where what 8139too is trying to do cannot ever work so make 8139TOO_PIO depend on being it false and avoid creating an unusable driver. Signed-off-by: Daniel Palmer Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp Signed-off-by: Jakub Kicinski commit 2f186dd5585c3afb415df80e52f71af16c9d3655 Author: David Ahern Date: Tue Sep 9 20:58:28 2025 -0600 selftests: Replace sleep with slowwait Replace the sleep in kill_procs with slowwait. Signed-off-by: David Ahern Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org Signed-off-by: Jakub Kicinski commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 Author: David Ahern Date: Tue Sep 9 20:58:27 2025 -0600 selftests: Disable dad for ipv6 in fcnal-test.sh Constrained test environment; duplicate address detection is not needed and causes races so disable it. Signed-off-by: David Ahern Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski commit d103f26a5c8599385acb2d2e01dfbaedb00fdc0a Merge: fc3a2810412c16 1b2e9feb351435 Author: Jakub Kicinski Date: Thu Sep 11 17:50:46 2025 -0700 Merge tag 'wireless-next-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Plenty of things going on, notably: - iwlwifi: major cleanups/rework - brcmfmac: gets AP isolation support - mac80211: gets more S1G support * tag 'wireless-next-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (94 commits) wifi: mwifiex: fix endianness handling in mwifiex_send_rgpower_table wifi: cfg80211: Remove the redundant wiphy_dev wifi: mac80211: fix incorrect comment wifi: cfg80211: update the time stamps in hidden ssid wifi: mac80211: Fix HE capabilities element check wifi: mac80211: add tx_handlers_drop statistics to ethtool wifi: mac80211: fix reporting of all valid links in sta_set_sinfo() wifi: iwlwifi: mld: CHANNEL_SURVEY_NOTIF is always supported wifi: iwlwifi: mld: remove support of iwl_esr_mode_notif version 1 wifi: iwlwifi: mld: remove support from of sta cmd version 1 wifi: iwlwifi: mld: remove support of roc cmd version 5 wifi: iwlwifi: mld: remove support of mac cmd ver 2 wifi: iwlwifi: mld: don't consider phy cmd version 5 wifi: iwlwifi: implement wowlan status notification API update wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list wifi: iwlwifi: add kunit tests for nvm parse wifi: iwlwifi: api: add a flag to iwl_link_ctx_modify_flags wifi: iwlwifi: pcie: move ltr_enabled to the specific transport wifi: iwlwifi: pcie: move pm_support to the specific transport wifi: iwlwifi: rename iwl_finish_nic_init ... ==================== Link: https://patch.msgid.link/20250911100854.20445-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit fc3a2810412c163b5df1b377d332e048860f45db Merge: 5f790208d68fe1 db87bd2ad1f736 Author: Jakub Kicinski Date: Thu Sep 11 17:37:09 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc6). Conflicts: net/netfilter/nft_set_pipapo.c net/netfilter/nft_set_pipapo_avx2.c c4eaca2e1052 ("netfilter: nft_set_pipapo: don't check genbit from packetpath lookups") 84c1da7b38d9 ("netfilter: nft_set_pipapo: use avx2 algorithm for insertions too") Only trivial adjacent changes (in a doc and a Makefile). Signed-off-by: Jakub Kicinski commit 5f790208d68fe1526c751dc2af366c7b552b8631 Author: Heiner Kallweit Date: Wed Sep 10 22:42:47 2025 +0200 net: phy: fixed_phy: remove two function stubs Remove stubs for fixed_phy_set_link_update() and fixed_phy_change_carrier() because all callers (actually just one per function) select config symbol FIXED_PHY. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8729170d-cf39-48d9-aabc-c9aa4acda070@gmail.com Signed-off-by: Jakub Kicinski commit 9ca01e9226dbbb523b49b4e583e1d522977b4fe6 Merge: 2c625f0fe2db4e 6a129b2ca5c533 Author: Mark Brown Date: Fri Sep 12 00:54:56 2025 +0100 support for Amlogic SPI Flash Controller IP Merge series from Xianwei Zhao : This Flash Controller is derived by adding an SPI path to the original raw NAND controller. This controller supports two modes: raw mode and SPI mode. The raw mode has already been implemented in the community (drivers/mtd/nand/raw/meson_nand.c). This submission supports the SPI mode. Add the drivers and bindings corresponding to the SPI Flash Controller. commit 0a27bdb14b028fed30a10cec2f945c38cb5ca4fa Author: Vernon Yang Date: Fri Sep 5 02:25:27 2025 +0800 PCI/AER: Fix NULL pointer access by aer_info The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx will result in kernel panic. Fix it. Signed-off-by: Vernon Yang Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250904182527.67371-1-vernon2gm@gmail.com commit 136d8a6f73fee0686d163dca91fdffb35e25f092 Author: Takashi Sakamoto Date: Fri Sep 12 07:13:11 2025 +0900 firewire: core: remove useless lockdep_assert_held() The bm_work work item should be scheduled after holding fw_card reference counting. At a commit 25feb1a96e21 ("firewire: core: use cleanup function in bm_work"), I misinterpreted it as fw_card spinlock and inserted lockdep_assert_hold() wrongly. This commit removes the useless line. Fixes: 25feb1a96e21 ("firewire: core: use cleanup function in bm_work") Link: https://lore.kernel.org/r/20250911221312.678076-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit ec818caebc0809722f47004db9f74b7ab355c583 Author: Leon Romanovsky Date: Tue Sep 9 16:27:41 2025 +0300 mm/hmm: properly take MMIO path In case peer-to-peer transaction traverses through host bridge, the IOMMU needs to have IOMMU_MMIO flag, together with skip of CPU sync. The latter was handled by provided DMA_ATTR_SKIP_CPU_SYNC flag, but IOMMU flag was missed, due to assumption that such memory can be treated as regular one. Reuse newly introduced DMA attribute to properly take MMIO path. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/998251caf3f9d1a3f6f8205f1f494c707fb4d8fa.1757423202.git.leonro@nvidia.com commit e1d69da24fb8ee02e13dcbc281f510f01332a7f8 Author: Leon Romanovsky Date: Tue Sep 9 16:27:40 2025 +0300 mm/hmm: migrate to physical address-based DMA mapping API Convert HMM DMA operations from the legacy page-based API to the new physical address-based dma_map_phys() and dma_unmap_phys() functions. This demonstrates the preferred approach for new code that should use physical addresses directly rather than page+offset parameters. The change replaces dma_map_page() and dma_unmap_page() calls with dma_map_phys() and dma_unmap_phys() respectively, using the physical address that was already available in the code. This eliminates the redundant page-to-physical address conversion and aligns with the DMA subsystem's move toward physical address-centric interfaces. This serves as an example of how new code should be written to leverage the more efficient physical address API, which provides cleaner interfaces for drivers that already have access to physical addresses. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/d45207f195b8f77d23cc2d571c83197328a86b04.1757423202.git.leonro@nvidia.com commit f7326196a781622b33bfbdabb00f5e72b5fb5679 Author: Leon Romanovsky Date: Tue Sep 9 16:27:39 2025 +0300 dma-mapping: export new dma_*map_phys() interface Introduce new DMA mapping functions dma_map_phys() and dma_unmap_phys() that operate directly on physical addresses instead of page+offset parameters. This provides a more efficient interface for drivers that already have physical addresses available. The new functions are implemented as the primary mapping layer, with the existing dma_map_page_attrs()/dma_map_resource() and dma_unmap_page_attrs()/dma_unmap_resource() functions converted to simple wrappers around the phys-based implementations. In case dma_map_page_attrs(), the struct page is converted to physical address with help of page_to_phys() function and dma_map_resource() provides physical address as is together with addition of DMA_ATTR_MMIO attribute. The old page-based API is preserved in mapping.c to ensure that existing code won't be affected by changing EXPORT_SYMBOL to EXPORT_SYMBOL_GPL variant for dma_*map_phys(). Reviewed-by: Jason Gunthorpe Reviewed-by: Keith Busch Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/54cc52af91777906bbe4a386113437ba0bcfba9c.1757423202.git.leonro@nvidia.com commit bf0ecb3c32396b3518f787d962c575f5a5cf097e Author: Leon Romanovsky Date: Tue Sep 9 16:27:38 2025 +0300 xen: swiotlb: Open code map_resource callback General dma_direct_map_resource() is going to be removed in next patch, so simply open-code it in xen driver. Reviewed-by: Juergen Gross Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/e9c66a92e818f416875441b6711963f9782dbbeb.1757423202.git.leonro@nvidia.com commit 18c9cbb042c930eb37f68df216319a371f4fcb22 Author: Leon Romanovsky Date: Tue Sep 9 16:27:37 2025 +0300 dma-mapping: implement DMA_ATTR_MMIO for dma_(un)map_page_attrs() Make dma_map_page_attrs() and dma_map_page_attrs() respect DMA_ATTR_MMIO. DMA_ATR_MMIO makes the functions behave the same as dma_(un)map_resource(): - No swiotlb is possible - Legacy dma_ops arches use ops->map_resource() - No kmsan - No arch_dma_map_phys_direct() The prior patches have made the internal functions called here support DMA_ATTR_MMIO. This is also preparation for turning dma_map_resource() into an inline calling dma_map_phys(DMA_ATTR_MMIO) to consolidate the flows. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/3660e2c78ea409d6c483a215858fb3af52cd0ed3.1757423202.git.leonro@nvidia.com commit 6eb1e769b2c13a33cb2ca694454a7561d3d72c0a Author: Leon Romanovsky Date: Tue Sep 9 16:27:36 2025 +0300 kmsan: convert kmsan_handle_dma to use physical addresses Convert the KMSAN DMA handling function from page-based to physical address-based interface. The refactoring renames kmsan_handle_dma() parameters from accepting (struct page *page, size_t offset, size_t size) to (phys_addr_t phys, size_t size). The existing semantics where callers are expected to provide only kmap memory is continued here. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/3557cbaf66e935bc794f37d2b891ef75cbf2c80c.1757423202.git.leonro@nvidia.com commit e53d29f957b36ba1666331956c6ccb047bb157d2 Author: Leon Romanovsky Date: Tue Sep 9 16:27:35 2025 +0300 dma-mapping: convert dma_direct_*map_page to be phys_addr_t based Convert the DMA direct mapping functions to accept physical addresses directly instead of page+offset parameters. The functions were already operating on physical addresses internally, so this change eliminates the redundant page-to-physical conversion at the API boundary. The functions dma_direct_map_page() and dma_direct_unmap_page() are renamed to dma_direct_map_phys() and dma_direct_unmap_phys() respectively, with their calling convention changed from (struct page *page, unsigned long offset) to (phys_addr_t phys). Architecture-specific functions arch_dma_map_page_direct() and arch_dma_unmap_page_direct() are similarly renamed to arch_dma_map_phys_direct() and arch_dma_unmap_phys_direct(). The is_pci_p2pdma_page() checks are replaced with DMA_ATTR_MMIO checks to allow integration with dma_direct_map_resource and dma_direct_map_phys() is extended to support MMIO path either. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/bb15a22f76dc2e26683333ff54e789606cfbfcf0.1757423202.git.leonro@nvidia.com commit f9374de14c0e8c36cfb7c68618c07cb155e6f8e6 Author: Leon Romanovsky Date: Tue Sep 9 16:27:34 2025 +0300 iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys() Make iommu_dma_map_phys() and iommu_dma_unmap_phys() respect DMA_ATTR_MMIO. DMA_ATTR_MMIO makes the functions behave the same as iommu_dma_(un)map_resource(): - No swiotlb is possible - No cache flushing is done (ATTR_MMIO should not be cached memory) - prot for iommu_map() has IOMMU_MMIO not IOMMU_CACHE This is preparation for replacing iommu_dma_map_resource() callers with iommu_dma_map_phys(DMA_ATTR_MMIO) and removing iommu_dma_(un)map_resource(). Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/acc255bee358fec9c7da6b2a5904ee50abcd09f1.1757423202.git.leonro@nvidia.com commit 513559f73700966ded094b090c3ecc6dff877ef9 Author: Leon Romanovsky Date: Tue Sep 9 16:27:33 2025 +0300 iommu/dma: rename iommu_dma_*map_page to iommu_dma_*map_phys Rename the IOMMU DMA mapping functions to better reflect their actual calling convention. The functions iommu_dma_map_page() and iommu_dma_unmap_page() are renamed to iommu_dma_map_phys() and iommu_dma_unmap_phys() respectively, as they already operate on physical addresses rather than page structures. The calling convention changes from accepting (struct page *page, unsigned long offset) to (phys_addr_t phys), which eliminates the need for page-to-physical address conversion within the functions. This renaming prepares for the broader DMA API conversion from page-based to physical address-based mapping throughout the kernel. All callers are updated to pass physical addresses directly, including dma_map_page_attrs(), scatterlist mapping functions, and DMA page allocation helpers. The change simplifies the code by removing the page_to_phys() + offset calculation that was previously done inside the IOMMU functions. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/ed172f95f8f57782beae04f782813366894e98df.1757423202.git.leonro@nvidia.com commit 76bb7c49f50ce7687f98eb35e78798584652dd0e Author: Leon Romanovsky Date: Tue Sep 9 16:27:32 2025 +0300 dma-mapping: rename trace_dma_*map_page to trace_dma_*map_phys As a preparation for following map_page -> map_phys API conversion, let's rename trace_dma_*map_page() to be trace_dma_*map_phys(). Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/c0c02d7d8bd4a148072d283353ba227516a76682.1757423202.git.leonro@nvidia.com commit e9e81d86fee63c6d5757841ab557019ddf73786f Author: Leon Romanovsky Date: Tue Sep 9 16:27:31 2025 +0300 dma-debug: refactor to use physical addresses for page mapping Convert the DMA debug infrastructure from page-based to physical address-based mapping as a preparation to rely on physical address for DMA mapping routines. The refactoring renames debug_dma_map_page() to debug_dma_map_phys() and changes its signature to accept a phys_addr_t parameter instead of struct page and offset. Similarly, debug_dma_unmap_page() becomes debug_dma_unmap_phys(). A new dma_debug_phy type is introduced to distinguish physical address mappings from other debug entry types. All callers throughout the codebase are updated to pass physical addresses directly, eliminating the need for page-to-physical conversion in the debug layer. This refactoring eliminates the need to convert between page pointers and physical addresses in the debug layer, making the code more efficient and consistent with the DMA mapping API's physical address focus. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky [mszyprow: added a fixup] Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/56d1a6769b68dfcbf8b26a75a7329aeb8e3c3b6a.1757423202.git.leonro@nvidia.com Link: https://lore.kernel.org/all/20250910052618.GH341237@unreal/ commit c288d657dd5151199d6629c11a940fee33fdd0bd Author: Leon Romanovsky Date: Tue Sep 9 16:27:30 2025 +0300 iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link(). This will replace the hacky use of DMA_ATTR_SKIP_CPU_SYNC to avoid touching the possibly non-KVA MMIO memory. Also correct the incorrect caching attribute for the IOMMU, MMIO memory should not be cachable inside the IOMMU mapping or it can possibly create system problems. Set IOMMU_MMIO for DMA_ATTR_MMIO. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/17ba63991aeaf8a80d5aca9ba5d028f1daa58f62.1757423202.git.leonro@nvidia.com commit eadaa8b255f36ee39ca97d0815c25eeeb1f5d674 Author: Leon Romanovsky Date: Tue Sep 9 16:27:29 2025 +0300 dma-mapping: introduce new DMA attribute to indicate MMIO memory This patch introduces the DMA_ATTR_MMIO attribute to mark DMA buffers that reside in memory-mapped I/O (MMIO) regions, such as device BARs exposed through the host bridge, which are accessible for peer-to-peer (P2P) DMA. This attribute is especially useful for exporting device memory to other devices for DMA without CPU involvement, and avoids unnecessary or potentially detrimental CPU cache maintenance calls. DMA_ATTR_MMIO is supposed to provide dma_map_resource() functionality without need to call to special function and perform branching when processing generic containers like bio_vec by the callers. Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/6f058ec395c5348014860dbc2eed348c17975843.1757423202.git.leonro@nvidia.com commit b9a62320d83863c40973d548dcd379cd6390da20 Merge: 110aa2c74dbd9d 7e2368a21741e2 Author: Marek Szyprowski Date: Fri Sep 12 00:04:09 2025 +0200 Merge tag 'dma-mapping-6.17-2025-09-09' into HEAD dma-mapping fix for Linux 6.17 - one more fix for DMA API debugging infrastructure (Baochen Qiang) commit 3e23fc50890d3f04ec8e3670c6927eb239930136 Author: Petr Vorel Date: Fri Aug 29 18:50:31 2025 +0200 ARM: defconfig: Remove obsolete CONFIG_USB_EHCI_MSM CONFIG_USB_EHCI_MSM was removed long time ago in v4.14-rc6 8b3f863033f9f ("usb: host: remove ehci-msm.c"). Signed-off-by: Petr Vorel Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250829165031.110850-1-petr.vorel@gmail.com Signed-off-by: Bjorn Andersson commit 57c8e9da3dfe606b918d8f193837ebf2213a9545 Author: Abel Vesa Date: Wed Jul 30 19:11:12 2025 +0300 clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk All the other ref clocks provided by this driver have the bi_tcxo as parent. The eDP refclk is the only one without a parent, leading to reporting its rate as 0. So set its parent to bi_tcxo, just like the rest of the refclks. Cc: stable@vger.kernel.org # v6.9 Fixes: 06aff116199c ("clk: qcom: Add TCSR clock driver for x1e80100") Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250730-clk-qcom-tcsrcc-x1e80100-parent-edp-refclk-v1-1-7a36ef06e045@linaro.org Signed-off-by: Bjorn Andersson commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 Author: Nikita Travkin Date: Mon Jul 21 18:28:03 2025 +0500 firmware: qcom: tzmem: disable sc7180 platform When SHM bridge is enabled, assigning RMTFS memory causes the calling core to hang if the system is running in EL1. Disable SHM bridge on sc7180 devices to avoid that hang. Signed-off-by: Nikita Travkin Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250721-sc7180-shm-hang-v1-1-99ad9ffeb5b4@trvn.ru Signed-off-by: Bjorn Andersson commit 42415d163e5df6db799c7de6262d707e402c2c7e Author: Benno Lossin Date: Fri Sep 5 16:00:46 2025 +0200 rust: pin-init: add references to previously initialized fields After initializing a field in an initializer macro, create a variable holding a reference that points at that field. The type is either `Pin<&mut T>` or `&mut T` depending on the field's structural pinning kind. [ Applied fixes to devres and rust_driver_pci sample - Benno] Reviewed-by: Danilo Krummrich Signed-off-by: Benno Lossin commit 1fa516794fdd27b96cee77f8b12ac916b8b6a9a7 Author: Benno Lossin Date: Fri Sep 5 16:05:31 2025 +0200 rust: pin-init: add code blocks to `[try_][pin_]init!` macros Allow writing `_: { /* any number of statements */ }` in initializers to run arbitrary code during initialization. try_init!(MyStruct { _: { if check_something() { return Err(MyError); } }, foo: Foo::new(val), _: { println!("successfully initialized `MyStruct`"); }, }) Tested-by: Alexandre Courbot Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Tested-by: Danilo Krummrich Reviewed-by: Danilo Krummrich Signed-off-by: Benno Lossin commit 619db96daf942dad974c6c8157ed06d52f7bb969 Author: Benno Lossin Date: Fri Sep 5 19:12:07 2025 +0200 rust: pin-init: add pin projections to `#[pin_data]` Make the `#[pin_data]` macro generate a `*Projection` struct that holds either `Pin<&mut Field>` or `&mut Field` for every field of the original struct. Which version is chosen depends on weather there is a `#[pin]` or not respectively. Access to this projected version is enabled through generating `fn project(self: Pin<&mut Self>) -> SelfProjection<'_>`. [ Adapt workqueue to use the new projection instead of its own, custom one - Benno ] Reviewed-by: Gary Guo Reviewed-by: Boqun Feng Signed-off-by: Benno Lossin commit d49c56368c0cc98cdf02ae21dd275eba92f1c333 Author: Benno Lossin Date: Fri Sep 5 19:12:06 2025 +0200 rust: pin-init: rename `project` -> `project_this` in doctest The next commit makes the `#[pin_data]` attribute generate a `project` function that would collide with any existing ones. Signed-off-by: Benno Lossin commit 62a9c709612c1cf0d5684022499f34c56c99b662 Author: Benno Lossin Date: Tue Aug 19 09:22:00 2025 +0200 rust: pin-init: README: add information banner on the rename to `pin-init` Signed-off-by: Benno Lossin commit 3d536277449e4de4609d4f0b8302ae7fd00b04b2 Author: Benno Lossin Date: Mon Aug 18 15:18:44 2025 +0200 rust: pin-init: examples: error: use `Error` in `fn main()` When running this example with no cargo features enabled, the compiler warns on 1.89: error: struct `Error` is never constructed --> examples/error.rs:11:12 | 11 | pub struct Error; | ^^^^^ | = note: `-D dead-code` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(dead_code)]` Thus use the error in the main function to avoid this warning. Signed-off-by: Benno Lossin commit 54d94c422fed9575b74167333c1757847a4e6899 Author: Randy Dunlap Date: Sun Aug 24 15:28:00 2025 -0700 lsm: CONFIG_LSM can depend on CONFIG_SECURITY When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does not need to be visible and settable since builtin_lsm_order is defined in security.o, which is only built when CONFIG_SECURITY=y. So make CONFIG_LSM depend on CONFIG_SECURITY. Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM") Signed-off-by: Randy Dunlap [PM: subj tweak] Signed-off-by: Paul Moore commit a578b54a8ad282dd739e4d1f4e8352fc8ac1c4a0 Merge: 5d87e96a497176 86f2225065be5a Author: Alexei Starovoitov Date: Thu Sep 11 13:00:44 2025 -0700 Merge branch 'bpf-report-arena-faults-to-bpf-streams' Puranjay Mohan says: ==================== bpf: report arena faults to BPF streams Changes in v6->v7: v6: https://lore.kernel.org/all/20250908163638.23150-1-puranjay@kernel.org/ - Added comments about the usage of arena_reg in x86 and arm64 jits. (Alexei) - Used clear_lo32() for clearing the lower 32-bits of user_vm_start. (Alexei) - Moved update of the old tests to use __stderr to a separate commit (Eduard) - Used test__skip() in prog_tests/stream.c (Eduard) - Start a sub-test for read / write Changes in v5->v6: v5: https://lore.kernel.org/all/20250901193730.43543-1-puranjay@kernel.org/ - Introduces __stderr and __stdout for easy testing of bpf streams (Eduard) - Add more test cases for arena fault reporting (subprog and callback) - Fix main_prog_aux usage and return main_prog from find_from_stack_cb (Kumar) - Properly fix the build issue reported by kernel test robot Changes in v4->v5: v4: https://lore.kernel.org/all/20250827153728.28115-1-puranjay@kernel.org/ - Added patch 2 to introducing main_prog_aux for easier access to streams. - Fixed bug in fault handlers when arena_reg == dst_reg - Updated selftest to check test above edge case. - Added comments about the usage of barrier_var() in code and commit message. Changes in v3->v4: v3: https://lore.kernel.org/all/20250827150113.15763-1-puranjay@kernel.org/ - Fixed a build issue when CONFIG_BPF_JIT=y and # CONFIG_BPF_SYSCALL is not set Changes in v2->v3: v2: https://lore.kernel.org/all/20250811111828.13836-1-puranjay@kernel.org/ - Improved the selftest to check the exact fault address - Dropped BPF_NO_KFUNC_PROTOTYPES and bpf_arena_alloc/free_pages() usage - Rebased on bpf-next/master Changes in v1->v2: v1: https://lore.kernel.org/all/20250806085847.18633-1-puranjay@kernel.org/ - Changed variable and mask names for consistency (Yonghong) - Added Acked-by: Yonghong Song on two patches This set adds the support of reporting page faults inside arena to BPF stderr stream. The reported address is the one that a user would expect to see if they pass it to bpf_printk(); Here is an example output from the stderr stream and bpf_printk() ERROR: Arena WRITE access at unmapped address 0xdeaddead0000 CPU: 9 UID: 0 PID: 502 Comm: test_progs Call trace: bpf_stream_stage_dump_stack+0xc0/0x150 bpf_prog_report_arena_violation+0x98/0xf0 ex_handler_bpf+0x5c/0x78 fixup_exception+0xf8/0x160 __do_kernel_fault+0x40/0x188 do_bad_area+0x70/0x88 do_translation_fault+0x54/0x98 do_mem_abort+0x4c/0xa8 el1_abort+0x44/0x70 el1h_64_sync_handler+0x50/0x108 el1h_64_sync+0x6c/0x70 bpf_prog_a64a9778d31b8e88_stream_arena_write_fault+0x84/0xc8 *(page) = 1; @ stream.c:100 bpf_prog_test_run_syscall+0x100/0x328 __sys_bpf+0x508/0xb98 __arm64_sys_bpf+0x2c/0x48 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x48/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Same address is printed by bpf_printk(): 1389.078831: bpf_trace_printk: Read Address: 0xdeaddead0000 To make this possible, some extra metadata has to be passed to the bpf exception handler, so the bpf exception handling mechanism for both x86-64 and arm64 have been improved in this set. The streams selftest has been updated to test this new feature. ==================== Link: https://patch.msgid.link/20250911145808.58042-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 86f2225065be5af2935f374f1a3abebc052c0868 Author: Puranjay Mohan Date: Thu Sep 11 14:58:05 2025 +0000 selftests/bpf: Add tests for arena fault reporting Add selftests for testing the reporting of arena page faults through BPF streams. Two new bpf programs are added that read and write to an unmapped arena address and the fault reporting is verified in the userspace through streams. The added bpf programs need to access the user_vm_start in struct bpf_arena, this is done by casting &arena to struct bpf_arena *, but barrier_var() is used on this ptr before accessing ptr->user_vm_start; to stop GCC from issuing an out-of-bound access due to the cast from smaller map struct to larger "struct bpf_arena" Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250911145808.58042-7-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit edd03fcd7601ce41068c183875c2cd3471a49f9a Author: Puranjay Mohan Date: Thu Sep 11 14:58:04 2025 +0000 selftests: bpf: use __stderr in stream error tests Start using __stderr directly in the bpf programs to test the reporting of may_goto timeout detection and spin_lock dead lock detection. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250911145808.58042-6-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 744eeb2b27c29a61ad13b6b6367636b233e32336 Author: Puranjay Mohan Date: Thu Sep 11 14:58:03 2025 +0000 selftests: bpf: introduce __stderr and __stdout Add __stderr and __stdout to validate the output of BPF streams for bpf selftests. Similar to __xlated, __jited, etc., __stderr/out can be used in the BPF progs to compare a string (regex supported) to the output in the bpf streams. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250911145808.58042-5-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 5c5240d020615f13331f4e2c559186125eddc7d3 Author: Puranjay Mohan Date: Thu Sep 11 14:58:02 2025 +0000 bpf: Report arena faults to BPF stderr Begin reporting arena page faults and the faulting address to BPF program's stderr, this patch adds support in the arm64 and x86-64 JITs, support for other archs can be added later. The fault handlers receive the 32 bit address in the arena region so the upper 32 bits of user_vm_start is added to it before printing the address. This is what the user would expect to see as this is what is printed by bpf_printk() is you pass it an address returned by bpf_arena_alloc_pages(); Signed-off-by: Puranjay Mohan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250911145808.58042-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 70f23546d246563da648baedbb0432ba1d6bb357 Author: Puranjay Mohan Date: Thu Sep 11 14:58:01 2025 +0000 bpf: core: introduce main_prog_aux for stream access BPF streams are only valid for the main programs, to make it easier to access streams from subprogs, introduce main_prog_aux in struct bpf_prog_aux. prog->aux->main_prog_aux = prog->aux, for main programs and prog->aux->main_prog_aux = main_prog->aux, for subprograms. Make bpf_prog_find_from_stack() use the added main_prog_aux to return the mainprog when a subprog is found on the stack. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250911145808.58042-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 0460484244e1fa4a0cdbc9ed76c838fc528134d3 Author: Puranjay Mohan Date: Thu Sep 11 14:58:00 2025 +0000 bpf: arm64: simplify exception table handling BPF loads with BPF_PROBE_MEM(SX) can load from unsafe pointers and the JIT adds an exception table entry for the JITed instruction which allows the exeption handler to set the destination register of the load to zero and continue execution from the next instruction. As all arm64 instructions are AARCH64_INSN_SIZE size, the exception handler can just increment the pc by AARCH64_INSN_SIZE without needing the exact address of the instruction following the the faulting instruction. Simplify the exception table usage in arm64 JIT by only saving the destination register in ex->fixup and drop everything related to the fixup_offset. The fault handler is modified to add AARCH64_INSN_SIZE to the pc. Signed-off-by: Puranjay Mohan Acked-by: Yonghong Song Acked-by: Kumar Kartikeya Dwivedi Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20250911145808.58042-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 4589be8cd0338e6bf0f5b9aaa044442876e78894 Author: James Clark Date: Wed Sep 10 14:30:12 2025 +0100 tools headers: Remove unused arm32 asm/kvm.h copy arm32 KVM was removed in commit 541ad0150ca4 ("arm: Remove 32bit KVM host support"). None of the kvm selftests are compiled for arm32 and it's not indirectly included from anywhere either, so delete it. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Link: https://lore.kernel.org/r/20250910-james-tools-header-cleanup-v1-2-7ae4bedc99e0@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit a85ac2dae6bf8050deaf9839e4c0328756b48720 Author: James Clark Date: Wed Sep 10 14:30:11 2025 +0100 tools headers: Remove unused kvm_perf.h copies These have been unused since commit 162607ea20fa ("perf kvm/{x86,s390}: Remove dependency on uapi/kvm_perf.h") in favour of dynamic discovery. Remove the unused headers to reduce consistency checking overhead and noise. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Link: https://lore.kernel.org/r/20250910-james-tools-header-cleanup-v1-1-7ae4bedc99e0@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 641585bc978e0a1170ca8f12fbb1468b3874a2db Author: Michal Swiatkowski Date: Tue Aug 12 06:23:36 2025 +0200 ixgbe: fwlog support for e610 The device support firmware logging feature. Use libie code to initialize it and allow reading the logs using debugfs. The commands are the same as in ice driver. Look at the description in commit 96a9a9341cda ("ice: configure FW logging") for more info. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit f3b3fc1ff0823b73f6f66b6340e6ebc4b00d2ed3 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:35 2025 +0200 ice, libie: move fwlog code to libie Move whole code from ice_fwlog.c/h to libie/fwlog.c/h. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 4b5f288ab0cdf45baf7925ce0f2ae41a0ed1febc Author: Michal Swiatkowski Date: Tue Aug 12 06:23:34 2025 +0200 ice: reregister fwlog after driver reinit Wrap libie_fwlog_register() by libie_fwlog_reregister(), which checks first if the registration is needed. This simplifies the code and makes the former function static. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 02f44dac8930dc7cc43aa3eba872ce35382f6332 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:33 2025 +0200 ice: prepare for moving file to libie s/ice/libie There is no function for filling default descriptor in libie. Zero descriptor structure and set opcode without calling the function. Make functions that are caled only in ice_fwlog.c static. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 2ab5eb4bf7b6c50e5ab346cd11de3d851dfd7ae6 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:32 2025 +0200 ice: move debugfs code to fwlog This code is only used in fwlog. Moved it there for easier lib creation. There is a circular dependency between debugfs and fwlog. Moving to one file is fixing it. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 413cf5db2fee00fdd69bc62debdbf655f97f4c08 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:31 2025 +0200 libie, ice: move fwlog admin queue to libie Copy the code and: - change ICE_AQC to LIBIE_AQC - change ice_aqc to libie_aqc - move definitions outside the structures Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 57d6ec57089cf2cdd8b0a2e5d3da05af09871482 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:30 2025 +0200 ice: drop driver specific structure from fwlog code In debugfs pass ice_fwlog structure instead of ice_pf. The debgufs dirs specific for fwlog can be stored in fwlog structure. Add debugfs entry point to fwlog api. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 360c46582e88acf57c935e76015f9fc894ab6599 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:29 2025 +0200 ice: check for PF number outside the fwlog code Fwlog can be supported only on PF 0. Check this before calling init/deinit functions. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit dc898f7edd9bd2ce53115ce9fc12ad8dbbf20fd5 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:28 2025 +0200 ice: move out debugfs init from fwlog The root debugfs directory should be available from driver side, not from library. Move it out from fwlog code. Make similar to __fwlog_init() __fwlog_deinit() and deinit debugfs there. In case of ice only fwlog is using debugfs. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit bf59b53218bb0d3e7c9b69a3a8e3c17a3e2bcbc2 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:27 2025 +0200 ice: allow calling custom send function in fwlog Fwlog code needs to communicate with FW. In ice it is done through admin queue command. Allow indirect calling the send function to move the specific admin queue send function from fwlog core code. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 4773761949dec7d47633b624e3c9e4cf0a1af9e8 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:26 2025 +0200 ice: add pdev into fwlog structure and use it for logging Prepare the code to be moved to the library. ice_debug() won't be there so switch to dev_dbg(). Add struct pdev pointer in fwlog to track on which pdev the fwlog was created. Switch the dev passed in dev_warn() to the one stored in fwlog. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit daf82b61ba0996bb270eba65d7e284d4e5ecaa60 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:25 2025 +0200 ice: introduce ice_fwlog structure The new structure is needed to make the fwlog code a library. A goal is to drop ice_hw structure in all fwlog related functions calls. Pass a ice_fwlog pointer across fwlog functions and use it wherever it is possible. Still use &hw->fwlog in debugfs code as it needs changing the value being passed in priv. It will be done in one of the next patches. Reviewed-by: Przemek Kitszel Reviewed-by: Larysa Zaremba Signed-off-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit ad3b33636f0740e7a3708223c9daed5435ea4ac7 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:24 2025 +0200 ice: drop ice_pf_fwlog_update_module() Any other access to fwlog_cfg isn't done through a function. Follow scheme that is used to access other fwlog_cfg elements from debugfs and write to the log_level directly. ice_pf_fwlog_update_module() is called only twice (from one function). Remove it. Reviewed-by: Przemek Kitszel Reviewed-by: Larysa Zaremba Signed-off-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit ffe8200d5c82c19949f23fc1d0fc560119c1bd78 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:23 2025 +0200 ice: move get_fwlog_data() to fwlog file Change the function prototype to receive hw structure instead of pf to simplify the call. Instead of passing whole event pass only msg_buf pointer and length. Make ice_fwlog_ring_full() static as it isn't called from any other context. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit c388ea486f74143c3c5aad060dba7568039e0e13 Author: Michal Swiatkowski Date: Tue Aug 12 06:23:22 2025 +0200 ice: make fwlog functions static ice_fwlog_supported(), ice_fwlog_get() and ice_fwlog_supported() aren't called outside the ice_fwlog.c file. Make it static and move in the file to allow clean build. Drop ice_fwlog_get(). It is called only from ice_fwlog_init() function where the fwlog support is already checked. There is no need to check it again, call ice_aq_fwlog_get() instead. Drop no longer valid comment from ice_fwlog_get_supported(). Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit e414b1005891d74bb0c3d27684c58dfbfbd1754b Author: Kai Huang Date: Tue Sep 9 19:55:53 2025 +1200 x86/virt/tdx: Use precalculated TDVPR page physical address All of the x86 KVM guest types (VMX, SEV and TDX) do some special context tracking when entering guests. This means that the actual guest entry sequence must be noinstr. Part of entering a TDX guest is passing a physical address to the TDX module. Right now, that physical address is stored as a 'struct page' and converted to a physical address at guest entry. That page=>phys conversion can be complicated, can vary greatly based on kernel config, and it is definitely _not_ a noinstr path today. There have been a number of tinkering approaches to try and fix this up, but they all fall down due to some part of the page=>phys conversion infrastructure not being noinstr friendly. Precalculate the page=>phys conversion and store it in the existing 'tdx_vp' structure. Use the new field at every site that needs a tdvpr physical address. Remove the now redundant tdx_tdvpr_pa(). Remove the __flatten remnant from the tinkering. Note that only one user of the new field is actually noinstr. All others can use page_to_phys(). But, they might as well save the effort since there is a pre-calculated value sitting there for them. [ dhansen: rewrite all the text ] Signed-off-by: Kai Huang Signed-off-by: Dave Hansen Reviewed-by: Kiryl Shutsemau Tested-by: Farrah Chen commit ba391a102ec11ab7f5b249e46dcf61ef836a57e7 Author: Daniele Ceraolo Spurio Date: Tue Sep 9 15:36:22 2025 -0700 drm/i915/guc: Include the GuC registers in the error state If GuC hangs, the GuC logs might not contain enough information to understand exactly why the hang occurred. In this case, we need to look at the GuC HW state to try to understand where the GuC is stuck. It is therefore useful to include the GuC HW state in the error capture. The list of registers that are part of the GuC HW state can change based on platform, but it is the same for all platforms from TGL to MTL so we only need to support one version for i915. v2: revised list v3: remove confusing comment, use sizeof(u32) instead of 4 (John) Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250909223621.3782625-2-daniele.ceraolospurio@intel.com commit 7aa8781f379c32c31bd78f1408a31765b2297c43 Author: Chen-Yu Tsai Date: Wed Sep 10 01:09:47 2025 +0800 clk: sunxi-ng: sun6i-rtc: Add A523 specifics The A523's RTC block is backward compatible with the R329's, but it also has a calibration function for its internal oscillator, which would allow it to provide a clock rate closer to the desired 32.768 KHz. This is useful on the Radxa Cubie A5E, which does not have an external 32.768 KHz crystal. Add new compatible-specific data for it. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 2cfff084f03005079f900fe6d0a031f7c508e881 Author: Lad Prabhakar Date: Thu Sep 4 16:55:07 2025 +0100 clk: renesas: r9a09g056: Add clock and reset entries for I3C Add module clock entries for the I3C controller on the RZ/V2N (R9A09G056) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904155507.245744-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 23c59916bafa396265c12112bc94f373ad560b16 Author: Lad Prabhakar Date: Thu Sep 4 16:55:06 2025 +0100 clk: renesas: r9a09g057: Add clock and reset entries for I3C Add module clock entries for the I3C controller on the RZ/V2H(P) (R9A09G057) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250904155507.245744-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5284d0b09d1bdc695256d7240915881d71997899 Author: Duy Nguyen Date: Wed Sep 10 02:01:42 2025 +0000 soc: renesas: Identify R-Car X5H Add support for identifying the R-Car X5H SoC. Signed-off-by: Duy Nguyen Signed-off-by: Huy Bui [Kuninori: tidyup for upstreaming] Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/87ldmnvzei.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven commit 1ed2786e9ef8f16204dc3f30c46412070cb7140e Author: Kuninori Morimoto Date: Wed Sep 10 02:01:37 2025 +0000 dt-bindings: soc: renesas: Document R-Car X5H Ironhide Document the compatible values for the Renesas R-Car X5H (R8A78000) SoC, as used on the Renesas Ironhide board. Signed-off-by: Kuninori Morimoto Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/87ms73vzen.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven commit a24cd110e664396061b0a72930734bf419bf88c4 Author: Biju Das Date: Tue Sep 9 19:07:46 2025 +0100 dt-bindings: clock: renesas,r9a09g047-cpg: Add USB3.0 core clocks Add definitions for USB3.0 core clocks in the R9A09G047 CPG DT bindings header file. Reviewed-by: Geert Uytterhoeven Acked-by: Conor Dooley Signed-off-by: Biju Das Link: https://patch.msgid.link/20250909180803.140939-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 941327ca5ddd45cfc4dd960cbbabed9e2b5cb1b0 Author: Samuel Holland Date: Tue Sep 9 15:41:27 2025 -0700 cache: sifive_ccache: Optimize cache flushes Fence instructions are required only at the beginning and the end of a flush operation, not separately for each cache line being flushed. Speed up cache flushes by about 15% by removing the extra fences. Signed-off-by: Samuel Holland Signed-off-by: Conor Dooley commit 30db1b21fa37a2f37c7f4d71864405a05e889833 Author: David Lechner Date: Fri Aug 15 12:40:03 2025 -0500 spi: axi-spi-engine: use adi_axi_pcore_ver_gteq() Make use of the adi_axi_pcore_ver_gteq() helper to make version checks more readable and robust against a major version bump. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250815-spi-axi-spi-enigne-improve-version-checks-v1-2-13bde357d5b6@baylibre.com Signed-off-by: Mark Brown commit 67a529b7d3c50a56c162476509361f4fe11350dd Author: David Lechner Date: Fri Aug 15 12:40:02 2025 -0500 include: adi-axi-common: add version check function Add a version check function for checking ADI AXI IP core versions. These cores use a semantic versioning scheme, so it is useful to have a version check function that can check the minor version to enable features in driver while maintaining backward compatibility. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250815-spi-axi-spi-enigne-improve-version-checks-v1-1-13bde357d5b6@baylibre.com Signed-off-by: Mark Brown commit 88434448438e4302e272b2a2b810b42e05ea024b Author: Daniele Ceraolo Spurio Date: Fri Sep 5 16:56:33 2025 -0700 drm/xe/guc: Set RCS/CCS yield policy All recent platforms (including all the ones officially supported by the Xe driver) do not allow concurrent execution of RCS and CCS workloads from different address spaces, with the HW blocking the context switch when it detects such a scenario. The DUAL_QUEUE flag helps with this, by causing the GuC to not submit a context it knows will not be able to execute. This, however, causes a new problem: if RCS and CCS queues have pending workloads from different address spaces, the GuC needs to choose from which of the 2 queues to pick the next workload to execute. By default, the GuC prioritizes RCS submissions over CCS ones, which can lead to CCS workloads being significantly (or completely) starved of execution time. The driver can tune this by setting a dedicated scheduling policy KLV; this KLV allows the driver to specify a quantum (in ms) and a ratio (percentage value between 0 and 100), and the GuC will prioritize the CCS for that percentage of each quantum. Given that we want to guarantee enough RCS throughput to avoid missing frames, we set the yield policy to 20% of each 80ms interval. v2: updated quantum and ratio, improved comment, use xe_guc_submit_disable in gt_sanitize Fixes: d9a1ae0d17bd ("drm/xe/guc: Enable WA_DUAL_QUEUE for newer platforms") Signed-off-by: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: John Harrison Cc: Vinay Belgaumkar Reviewed-by: John Harrison Tested-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250905235632.3333247-2-daniele.ceraolospurio@intel.com commit e1899da95f59240ed2d4a51d7a89c8b77c45ff06 Author: Kartik Rajput Date: Thu Aug 28 15:58:03 2025 +0530 arm64: tegra: Add I2C nodes for Tegra264 Add I2C nodes for Tegra264. Signed-off-by: Kartik Rajput Signed-off-by: Thierry Reding commit a555633fd3f1d28a092c6707d9ebc00dfc1190a9 Merge: 8f5ae30d69d754 04f27a0fda6b6b Author: Thierry Reding Date: Thu Sep 11 18:35:11 2025 +0200 Merge branch 'for-6.18/dt-bindings' into for-6.18/arm64/dt commit 5d87e96a4971760c83e554c1d3ca99986d4f9b47 Merge: f85981327a90c5 e59a039119c3ec Author: Alexei Starovoitov Date: Thu Sep 11 09:34:37 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after rc5 Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov commit 73e23d3bd7220847c3b1554ebe29221f84a01e95 Author: Svyatoslav Ryhel Date: Sat Sep 6 09:29:34 2025 +0300 ARM: tegra: add support for ASUS Eee Pad Slider SL101 Factor out common part from ASUS Eee Pad Transformer TF101 device tree into tegra20-asus-transformer-common.dtsi and add device tree fragment for ASUS Eee Pad Slider SL101. Tested-by: Winona Schroeer-Smith # ASUS SL101 Tested-by: Antoni Aloy Torrens # ASUS TF101 Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 3f973d78d176768fa7456def97f0b9824235024f Author: Svyatoslav Ryhel Date: Sat Sep 6 09:29:32 2025 +0300 ARM: tegra: transformer-20: fix audio-codec interrupt Correct audio-codec interrupt should be PX3 while PX1 is used for external microphone detection. Tested-by: Winona Schroeer-Smith # ASUS SL101 Tested-by: Antoni Aloy Torrens # ASUS TF101 Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit cca41614d15ce2bbc2c661362d3eafe53c9990af Author: Svyatoslav Ryhel Date: Sat Sep 6 09:29:31 2025 +0300 ARM: tegra: transformer-20: add missing magnetometer interrupt Add missing interrupt to magnetometer node. Tested-by: Winona Schroeer-Smith # ASUS SL101 Tested-by: Antoni Aloy Torrens # ASUS TF101 Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 93ff9ffaf3434a236d5450d8a29af1433b48a049 Author: Svyatoslav Ryhel Date: Fri Aug 29 15:22:34 2025 +0300 ARM: tegra: Add DFLL clock support for Tegra114 Add DFLL clock node to common Tegra114 device tree along with clocks property to cpu node. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab Author: Jonas Schwöbel Date: Wed Sep 3 19:19:46 2025 +0300 ARM: tegra: p880: set correct touchscreen clipping Existing touchscreen clipping is too small and causes problems with touchscreen accuracy. Signed-off-by: Jonas Schwöbel Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 166e2c0f26c83e8035cbd2a3301390c86de047ce Merge: 8f5ae30d69d754 04f27a0fda6b6b Author: Thierry Reding Date: Thu Sep 11 18:30:35 2025 +0200 Merge branch 'for-6.18/dt-bindings' into for-6.18/arm/dt commit 8e7bd526e83673c2b4931163311cca49796657f8 Author: Svyatoslav Ryhel Date: Fri Aug 29 15:22:32 2025 +0300 clk: tegra: Add DFLL DVCO reset control for Tegra114 The DVCO present in the DFLL IP block has a separate reset line, exposed via the CAR IP block. This reset line is asserted upon SoC reset. Unless something (such as the DFLL driver) deasserts this line, the DVCO will not oscillate, although reads and writes to the DFLL IP block will complete. Based on a3c83ff2 ("clk: tegra: Add DFLL DVCO reset control for Tegra124") Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit c4d7901225435c2a82049588532f7b7a07e06188 Merge: 8f5ae30d69d754 04f27a0fda6b6b Author: Thierry Reding Date: Thu Sep 11 18:29:42 2025 +0200 Merge branch 'for-6.18/dt-bindings' into for-6.18/clk commit 04f27a0fda6b6be104531eeb95d07ef1b3a72af8 Author: Svyatoslav Ryhel Date: Sat Sep 6 09:29:33 2025 +0300 dt-bindings: arm: tegra: Add ASUS TF101G and SL101 Add a compatible for ASUS Eee Pad Transformer TF101G and ASUS Eee Pad Slider SL101. Signed-off-by: Svyatoslav Ryhel Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 7526e6db4703d0fe81b5397939c2aefd5fe8d9bc Author: Svyatoslav Ryhel Date: Fri Aug 29 15:22:31 2025 +0300 dt-bindings: reset: Add Tegra114 CAR header The way that resets are handled on these Tegra devices is that there is a set of peripheral clocks & resets which are paired up. This is because they are laid out in banks within the CAR (clock and reset) controller. In most cases we're referring to those resets, so you'll often see a clock ID used in conjection with the same reset ID for a given IP block. In addition to those peripheral resets, there are a number of extra resets that don't have a corresponding clock and which are exposed in registers outside of the peripheral banks, but still part of the CAR. To support those "special" registers, the TEGRA*_RESET() is used to denote resets outside of the regular peripheral resets. Essentially it defines the offset within the CAR at which special resets start. In the above case, Tegra114 has 5 banks with 32 peripheral resets each. The first special reset, TEGRA114_RESET(0), therefore gets ID 5 * 32 + 0 = 160. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 95c1cfa306087142989bff34ea0e05dcd95ddc58 Author: Michal Wajdeczko Date: Thu Sep 11 00:24:39 2025 +0200 drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation This effectively reverts commit 4c3fe5eae46b ("drm/xe/pf: Limit fair VF LMEM provisioning") since we don't need it any more after non-contig VRAM allocations were fixed. This allows larger LMEM auto-provisioning for VFs, so instead: [ ] GT0: PF: LMEM available(14096M) fair(1 x 8192M) [ ] GT0: PF: VF1 provisioned with 8589934592 (8.00 GiB) LMEM or [ ] GT0: PF: LMEM available(14096M) fair(2 x 4096M) [ ] GT0: PF: VF1..VF2 provisioned with 4294967296 (4.00 GiB) LMEM we may get: [ ] GT0: PF: LMEM available(14096M) fair(1 x 14096M) [ ] GT0: PF: VF1 provisioned with 14780727296 (13.8 GiB) LMEM and [ ] GT0: PF: LMEM available(14096M) fair(2 x 7048M) [ ] GT0: PF: VF1..VF2 provisioned with 7390363648 (6.88 GiB) LMEM Fixes: 1e32ffbc9dc8 ("drm/xe/sriov: support non-contig VRAM provisioning") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250910222439.32869-1-michal.wajdeczko@intel.com commit b9c01adedf38c69abb725a60a05305ef70dbce03 Author: Svyatoslav Ryhel Date: Thu Aug 28 08:50:59 2025 +0300 soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Add missing Tegra114 nvmem cells and fuse lookups which were added for Tegra124+ but omitted for Tegra114. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 531453a36c1391445fffa5721c1153c9f2d64eeb Merge: 76eeb9b8de9880 eddb5ba91b289f Author: Rafael J. Wysocki Date: Thu Sep 11 18:08:45 2025 +0200 Merge tag 'devfreq-next-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Merge devfreq updates for v6.18 from Chanwoo Choi: "- Add support for LPDDR5 for Rockhip RK3588 SoC on rockchip-dfi devfreq driver. - Fix an issue where DDR cycle counts on RK3588/RK3528 with LPDDR4(X) are reported as half by adding a cycle multiplier to the DFI driver on rockchip-dfi devfreq-event driver. - Fix missing error pointer dereference of regulator instance and remove redundant condition on on mtk-cci-devfreq.c devfreq driver." * tag 'devfreq-next-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: rockchip-dfi: add support for LPDDR5 PM / devfreq: rockchip-dfi: double count on RK3588 PM / devfreq: mtk-cci: avoid redundant conditions PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() commit fc55b4cda00aff08ea6dfe86411efa13bdb728c5 Author: Thorsten Blum Date: Wed Sep 3 02:29:50 2025 +0200 KVM: nSVM: Replace kzalloc() + copy_from_user() with memdup_user() Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify svm_set_nested_state(). Return early if an error occurs instead of trying to allocate memory for 'save' when memory allocation for 'ctl' already failed. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250903002951.118912-1-thorsten.blum@linux.dev Signed-off-by: Sean Christopherson commit 669c71f6c6b0034f918430a2fdcf577683d31db6 Author: Svyatoslav Ryhel Date: Tue Sep 9 10:49:57 2025 +0300 dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) Add a compatible for the Xiaomi Mi Pad (A0101) tablet. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit fc02f529a8dbf617f6d211cb693f56a842b6dbe5 Author: Svyatoslav Ryhel Date: Sat Sep 6 16:53:23 2025 +0300 dt-bindings: clock: tegra30: Add IDs for CSI pad clocks Tegra30 has CSI pad clock enable bits embedded into PLLD/PLLD2 registers. Add ids for these clocks. Additionally, move TEGRA30_CLK_CLK_MAX into clk-tegra30 source. Signed-off-by: Svyatoslav Ryhel Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 6b670e53ac6ecd531d90324e9ef87a029d2c98b9 Author: Svyatoslav Ryhel Date: Sat Sep 6 16:53:33 2025 +0300 dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI The avdd-dsi-csi-supply is CSI power supply, it has nothing to do with VI, like same supply is used with DSI and has nothing to do with DC. Move it to correct place. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 960550503965094b0babd7e8c83ec66c8a763b0b Author: Li RongQing Date: Tue Jul 22 19:00:05 2025 +0800 x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated physical CPUs are available") states that when PV_DEDICATED=1 (vCPU has dedicated pCPU), qspinlock should be preferred regardless of PV_UNHALT. However, the current implementation doesn't reflect this: when PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs. This is suboptimal because: 1. Native qspinlocks should outperform virt_spin_lock() for dedicated vCPUs irrespective of HALT exiting 2. virt_spin_lock() should only be preferred when vCPUs may be preempted (non-dedicated case) So reorder the PV spinlock checks to: 1. First handle dedicated pCPU case (disable virt_spin_lock_key) 2. Second check single CPU, and nopvspin configuration 3. Only then check PV_UNHALT support This ensures we always use native qspinlock for dedicated vCPUs, delivering pretty performance gains at high contention levels. Signed-off-by: Li RongQing Reviewed-by: Sean Christopherson Tested-by: Wangyang Guo Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson commit 657bf7048d77c1db6baf0841dd1a65c60d7fc4c7 Author: Sean Christopherson Date: Tue Jul 29 08:39:01 2025 -0700 x86/kvm: Make kvm_async_pf_task_wake() a local static helper Make kvm_async_pf_task_wake() static and drop its export, as the symbol is only referenced from within kvm.c. No functional change intended. Link: https://lore.kernel.org/r/20250729153901.564123-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 0dccbc75e18df85399a71933d60b97494110f559 Author: Sean Christopherson Date: Wed Aug 27 17:52:49 2025 -0700 x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forced variable MTRR range. In most KVM-based setups, legacy devices such as the HPET and TPM are enumerated via ACPI. ACPI enumeration includes a Memory32Fixed entry, and optionally a SystemMemory descriptor for an OperationRegion, e.g. if the device needs to be accessed via a Control Method. If a SystemMemory entry is present, then the kernel's ACPI driver will auto-ioremap the region so that it can be accessed at will. However, the ACPI spec doesn't provide a way to enumerate the memory type of SystemMemory regions, i.e. there's no way to tell software that a region must be mapped as UC vs. WB, etc. As a result, Linux's ACPI driver always maps SystemMemory regions using ioremap_cache(), i.e. as WB on x86. The dedicated device drivers however, e.g. the HPET driver and TPM driver, want to map their associated memory as UC or WC, as accessing PCI devices using WB is unsupported. On bare metal and non-CoCO, the conflicting requirements "work" as firmware configures the PCI hole (and other device memory) to be UC in the MTRRs. So even though the ACPI mappings request WB, they are forced to UC- in the kernel's tracking due to the kernel properly handling the MTRR overrides, and thus are compatible with the drivers' requested WC/UC-. With force WB MTRRs on SNP and TDX guests, the ACPI mappings get their requested WB if the ACPI mappings are established before the dedicated driver code attempts to initialize the device. E.g. if acpi_init() runs before the corresponding device driver is probed, ACPI's WB mapping will "win", and result in the driver's ioremap() failing because the existing WB mapping isn't compatible with the requested WC/UC-. E.g. when a TPM is emulated by the hypervisor (ignoring the security implications of relying on what is allegedly an untrusted entity to store measurements), the TPM driver will request UC and fail: [ 1.730459] ioremap error for 0xfed40000-0xfed45000, requested 0x2, got 0x0 [ 1.732780] tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -12 Note, the '0x2' and '0x0' values refer to "enum page_cache_mode", not x86's memtypes (which frustratingly are an almost pure inversion; 2 == WB, 0 == UC). E.g. tracing mapping requests for TPM TIS yields: Mapping TPM TIS with req_type = 0 WARNING: CPU: 22 PID: 1 at arch/x86/mm/pat/memtype.c:530 memtype_reserve+0x2ab/0x460 Modules linked in: CPU: 22 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.16.0-rc7+ #2 VOLUNTARY Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/29/2025 RIP: 0010:memtype_reserve+0x2ab/0x460 __ioremap_caller+0x16d/0x3d0 ioremap_cache+0x17/0x30 x86_acpi_os_ioremap+0xe/0x20 acpi_os_map_iomem+0x1f3/0x240 acpi_os_map_memory+0xe/0x20 acpi_ex_system_memory_space_handler+0x273/0x440 acpi_ev_address_space_dispatch+0x176/0x4c0 acpi_ex_access_region+0x2ad/0x530 acpi_ex_field_datum_io+0xa2/0x4f0 acpi_ex_extract_from_field+0x296/0x3e0 acpi_ex_read_data_from_field+0xd1/0x460 acpi_ex_resolve_node_to_value+0x2ee/0x530 acpi_ex_resolve_to_value+0x1f2/0x540 acpi_ds_evaluate_name_path+0x11b/0x190 acpi_ds_exec_end_op+0x456/0x960 acpi_ps_parse_loop+0x27a/0xa50 acpi_ps_parse_aml+0x226/0x600 acpi_ps_execute_method+0x172/0x3e0 acpi_ns_evaluate+0x175/0x5f0 acpi_evaluate_object+0x213/0x490 acpi_evaluate_integer+0x6d/0x140 acpi_bus_get_status+0x93/0x150 acpi_add_single_object+0x43a/0x7c0 acpi_bus_check_add+0x149/0x3a0 acpi_bus_check_add_1+0x16/0x30 acpi_ns_walk_namespace+0x22c/0x360 acpi_walk_namespace+0x15c/0x170 acpi_bus_scan+0x1dd/0x200 acpi_scan_init+0xe5/0x2b0 acpi_init+0x264/0x5b0 do_one_initcall+0x5a/0x310 kernel_init_freeable+0x34f/0x4f0 kernel_init+0x1b/0x200 ret_from_fork+0x186/0x1b0 ret_from_fork_asm+0x1a/0x30 The above traces are from a Google-VMM based VM, but the same behavior happens with a QEMU based VM that is modified to add a SystemMemory range for the TPM TIS address space. The only reason this doesn't cause problems for HPET, which appears to require a SystemMemory region, is because HPET gets special treatment via x86_init.timers.timer_init(), and so gets a chance to create its UC- mapping before acpi_init() clobbers things. Disabling the early call to hpet_time_init() yields the same behavior for HPET: [ 0.318264] ioremap error for 0xfed00000-0xfed01000, requested 0x2, got 0x0 Hack around the ACPI gap by forcing the legacy PCI hole to UC when overriding the (virtual) MTRRs for CoCo guest, so that ioremap handling of MTRRs naturally kicks in and forces the ACPI mappings to be UC. Note, the requested/mapped memtype doesn't actually matter in terms of accessing the device. In practically every setup, legacy PCI devices are emulated by the hypervisor, and accesses are intercepted and handled as emulated MMIO, i.e. never access physical memory and thus don't have an effective memtype. Even in a theoretical setup where such devices are passed through by the host, i.e. point at real MMIO memory, it is KVM's (as the hypervisor) responsibility to force the memory to be WC/UC, e.g. via EPT memtype under TDX or real hardware MTRRs under SNP. Not doing so cannot work, and the hypervisor is highly motivated to do the right thing as letting the guest access hardware MMIO with WB would likely result in a variety of fatal #MCs. In other words, forcing the range to be UC is all about coercing the kernel's tracking into thinking that it has established UC mappings, so that the ioremap code doesn't reject mappings from e.g. the TPM driver and thus prevent the driver from loading and the device from functioning. Note #2, relying on guest firmware to handle this scenario, e.g. by setting virtual MTRRs and then consuming them in Linux, is not a viable option, as the virtual MTRR state is managed by the untrusted hypervisor, and because OVMF at least has stopped programming virtual MTRRs when running as a TDX guest. Link: https://lore.kernel.org/all/8137d98e-8825-415b-9282-1d2a115bb51a@linux.intel.com Fixes: 8e690b817e38 ("x86/kvm: Override default caching mode for SEV-SNP and TDX") Cc: stable@vger.kernel.org Cc: Peter Gonda Cc: Vitaly Kuznetsov Cc: Tom Lendacky Cc: Jürgen Groß Cc: Korakit Seemakhupt Cc: Jianxiong Gao Cc: Nikolay Borisov Suggested-by: Binbin Wu Reviewed-by: Binbin Wu Tested-by: Korakit Seemakhupt Link: https://lore.kernel.org/r/20250828005249.39339-1-seanjc@google.com Signed-off-by: Sean Christopherson commit aebc62b3dedce5ef50fc0e945671842f08d41cf6 Author: Sean Christopherson Date: Tue Sep 9 13:28:35 2025 -0700 KVM: selftests: Add support for DIV and IDIV in the fastops test Extend the fastops test coverage to DIV and IDIV, specifically to provide coverage for #DE (divide error) exceptions, as #DE is the only exception that can occur in KVM's fastops path, i.e. that requires exception fixup. Link: https://lore.kernel.org/r/20250909202835.333554-5-seanjc@google.com Signed-off-by: Sean Christopherson commit fe08478b1d51f3a984d0aed3e22e1809634dd232 Author: Sean Christopherson Date: Tue Sep 9 13:28:34 2025 -0700 KVM: selftests: Dedup the gnarly constraints of the fastops tests (more macros!) Add a fastop() macro along with macros to define its required constraints, and use the macros to dedup the innermost guts of the fastop testcases. No functional change intended. Link: https://lore.kernel.org/r/20250909202835.333554-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 9bf5da1ca4275c0403de763547f21f29795f8366 Author: Sean Christopherson Date: Tue Sep 9 13:28:33 2025 -0700 KVM: selftests: Add coverage for 'b' (byte) sized fastops emulation Extend the fastops test to cover instructions that operate on 8-bit data. Support for 8-bit instructions was omitted from the original commit purely due to complications with BT not having a r/m8 variant. To keep the RFLAGS.CF behavior deterministic and not heavily biased to '0' or '1', continue using BT, but cast and load the to-be-tested value into a dedicated 32-bit constraint. Supporting 8-bit operations will allow using guest_test_fastops() as-is to provide full coverage for DIV and IDIV. For divide operations, covering all operand sizes _is_ interesting, because KVM needs provide exception fixup for each size (failure to handle a #DE could panic the host). Link: https://lore.kernel.org/all/aIF7ZhWZxlkcpm4y@google.com Link: https://lore.kernel.org/r/20250909202835.333554-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 7b39b6c76942d42d3eecf0844d0f6a76fb64e805 Author: Sean Christopherson Date: Tue Sep 9 13:28:32 2025 -0700 KVM: selftests: Add support for #DE exception fixup Add support for handling #DE (divide error) exceptions in KVM selftests so that the fastops test can verify KVM correctly handles #DE when emulating DIV or IDIV on behalf of the guest. Morph #DE to 0xff (i.e. to -1) as a mostly-arbitrary vector to indicate #DE, so that '0' (the real #DE vector) can still be used to indicate "no exception". Link: https://lore.kernel.org/r/20250909202835.333554-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 9781c381c159523c6792b1d08d4be6055e0dbd8b Author: Wang Zhaolong Date: Tue Sep 2 17:27:32 2025 +0800 mtd: core: skip badblocks increment for blocks already known bad Repeatedly marking the same eraseblock bad inflates mtd->ecc_stats.badblocks because mtd_block_markbad() unconditionally increments the counter on success, while some implementations (e.g. NAND) return 0 both when the block was already bad and when it has just been marked[1]. Fix by checking if the block is already bad before calling ->_block_markbad() when _block_isbad is available. Only skip the counter increment when we can confirm the block was already bad. In all other cases continue incrementing the counter. This keeps the logic centralized in mtdcore without requiring driver changes. Link: https://lore.kernel.org/all/ef573188-9815-4a6b-bad1-3d8ff7c9b16f@huaweicloud.com/ [1] Signed-off-by: Wang Zhaolong Reviewed-by: Zhihao Cheng Signed-off-by: Miquel Raynal commit 81eb13a19a8eb259b3d9b1fdf5cbf154f71fc1d0 Author: Qianfeng Rong Date: Tue Aug 12 11:58:53 2025 +0800 mtd: use vmalloc_array and vcalloc to simplify code Remove array_size() calls and replace vmalloc(array_size()) with vmalloc_array() and vzalloc(array_size()) with vcalloc() to simplify the code. Compile-tested only. Signed-off-by: Qianfeng Rong Signed-off-by: Miquel Raynal commit e3d2faffdd18a545caccb1d249603cf286289d0f Author: Gabor Juhos Date: Fri Aug 8 12:13:44 2025 +0200 mtd: core: expose ooblayout information via debugfs Add two new debugfs files which allows to determine the OOB layout used by a given MTD device. This can be useful to verify the current layout during driver development without adding extra debug code. The exposed information also makes it easier to analyze NAND dumps without the need of crawling out the layout from the driver code. The content of the new debugfs files is similar to this: # cat /sys/kernel/debug/mtd/mtd0/ooblayout_ecc 0 0 49 1 65 63 # cat /sys/kernel/debug/mtd/mtd0/ooblayout_free 0 49 16 Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal commit 0ee8d7616b7563f53a904acf91db1675937d4196 Author: Colin Ian King Date: Thu Jul 31 10:52:47 2025 +0100 mtd: lpddr: Remove space before newline There is an extraneous space before a newline in a handful of printk messages. Remove the spaces. Signed-off-by: Colin Ian King Signed-off-by: Miquel Raynal commit 0ce34f9e22f478b99e7a669ab286c35373b6c57e Author: Colin Ian King Date: Thu Jul 31 10:46:13 2025 +0100 mtd: jedec_probe: Remove space before newline There is a extraneous space before a newline in a pr_debug message. Remove the space and remove a space after ( and before literal string to clean up checkpatch warning. Signed-off-by: Colin Ian King Signed-off-by: Miquel Raynal commit 948cb194bcb4c01fb4cd029936f0c02b10780394 Author: Arnd Bergmann Date: Wed Jul 30 15:59:24 2025 +0200 mtd: map: add back asm/barrier.h inclusion The mb() macro is used in this header: In file included from include/linux/mtd/qinfo.h:5, from include/linux/mtd/pfow.h:8, from drivers/mtd/lpddr/lpddr_cmds.c:14: include/linux/mtd/map.h: In function 'inline_map_write': include/linux/mtd/map.h:428:9: error: implicit declaration of function 'mb' [-Wimplicit-function-declaration] Fixes: 56eb7c13b97c ("mtd: map: Don't use "proxy" headers") Signed-off-by: Arnd Bergmann Acked-by: Andy Shevchenko Signed-off-by: Miquel Raynal commit 804ebc2bdcc85f30973708835b47ee023a4be003 Author: Kartik Rajput Date: Thu Aug 28 11:29:29 2025 +0530 dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C Tegra264 has 17 generic I2C controllers, two of which are in always-on partition of the SoC. In addition to the features supported by Tegra194 it also supports a SW mutex register to allow sharing the same I2C instance across multiple firmware. Document compatible string "nvidia,tegra264-i2c" for Tegra264 I2C. Signed-off-by: Kartik Rajput Acked-by: Conor Dooley Signed-off-by: Thierry Reding commit 96e048fa11d6aedf4add4c2f93a8d06445948056 Author: Christophe JAILLET Date: Sun Sep 7 12:16:09 2025 +0200 leds: is31fl319x: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 20011 6752 128 26891 690b drivers/leds/leds-is31fl319x.o After: ===== text data bss dec hex filename 19715 6680 128 26523 679b drivers/leds/leds-is31fl319x.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/267aba6eab12be67c297fcd52fcf45a0856338bb.1757240150.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit a377b1be3a0ed51ccabfe22908ebde065848313c Author: Nathan Chancellor Date: Thu Sep 4 18:26:12 2025 -0700 mfd: tps6594: Explicitly include bitfield.h After a recent change that started using FIELD_GET() in tps6594-core.c, there is an error when bitfield.h is not implicitly included, such as when building allmodconfig for ARCH=hexagon: drivers/mfd/tps6594-core.c:767:7: error: call to undeclared function 'FIELD_GET'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 767 | if (FIELD_GET(TPS65224_MASK_EN_PB_VSENSE_CONFIG, pwr_on) == TPS65224_EN_SEL_PB || | ^ Explicitly include bitfield.h to resolve the errors. Reported-by: kernel test robot Fixes: d766ca01c208 ("mfd: tps6594: Add power button functionality") Signed-off-by: Nathan Chancellor Reviewed-by: Michael Walle Closes: https://lore.kernel.org/oe-kbuild-all/202509032356.LGa5hygM-lkp@intel.com/ Link: https://lore.kernel.org/r/20250904-mfd-tps6594-core-fix-bitfield-h-v1-1-5d0f00cfe58f@kernel.org Signed-off-by: Lee Jones commit 010629e00d8494d0ca3893fe802ee0cbec92c021 Author: Varun Gupta Date: Thu Sep 11 16:47:12 2025 +0530 drm/xe: Fix driver reference in FLR comment Rectify the reference of i915 to Xe in a comment. v2: Cosmetic changes. (Karthik) v3: Rephrased the commit message. (Karthik) Signed-off-by: Varun Gupta Reviewed-by: Karthik Poosa Link: https://lore.kernel.org/r/20250911111712.811524-1-varun.gupta@intel.com Signed-off-by: Lucas De Marchi commit 981dd162b63578aee34b5c68795e246734b76d70 Author: Chris Morgan Date: Thu Sep 4 11:05:29 2025 -0500 regulator: bq257xx: Add bq257xx boost regulator driver Add support for the boost regulator found in the Texas Instruments BQ25703. The boost regulator is capable of outputting between 4.48 and 20.8 volts and between 0 and 6.35 amps. Signed-off-by: Chris Morgan Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250904160530.66178-5-macroalpha82@gmail.com Signed-off-by: Lee Jones commit b3cf07851b6c4aa8683557905cd898da9ae8c634 Author: Jinjie Ruan Date: Fri Aug 15 11:06:33 2025 +0800 arm64: entry: Switch to generic IRQ entry Currently, x86, Riscv and Loongarch use the generic entry code, which makes maintainer's work easier and code more elegant. Start converting arm64 to use the generic entry infrastructure from kernel/entry/* by switching it to generic IRQ entry, which removes 100+ lines of duplicate code. arm64 will completely switch to generic entry in a later series. The changes are below: - Remove *enter_from/exit_to_kernel_mode(), and wrap with generic irqentry_enter/exit() as their code and functionality are almost identical. - Define ARCH_EXIT_TO_USER_MODE_WORK and implement arch_exit_to_user_mode_work() to check arm64-specific thread flags "_TIF_MTE_ASYNC_FAULT" and "_TIF_FOREIGN_FPSTATE". So also remove *enter_from/exit_to_user_mode(), and wrap with generic enter_from/exit_to_user_mode() because they are exactly the same. - Remove arm64_enter/exit_nmi() and use generic irqentry_nmi_enter/exit() because they're exactly the same, so the temporary arm64 version irqentry_state can also be removed. - Remove PREEMPT_DYNAMIC code, as generic irqentry_exit_cond_resched() has the same functionality. - Implement arch_irqentry_exit_need_resched() with arm64_preempt_schedule_irq() for arm64 which will allow arm64 to do its architecture specific checks. Tested-by: Ada Couprie Diaz Suggested-by: Ada Couprie Diaz Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 99eb057ccd675b2f0fc71a362553164c65c349a2 Author: Jinjie Ruan Date: Fri Aug 15 11:06:32 2025 +0800 arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() The arm64 entry code only preempts a kernel context upon a return from a regular IRQ exception. The generic entry code may preempt a kernel context for any exception return where irqentry_exit() is used, and so may preempt other exceptions such as faults. In preparation for moving arm64 over to the generic entry code, align arm64 with the generic behaviour by calling arm64_preempt_schedule_irq() from exit_to_kernel_mode(). To make this possible, arm64_preempt_schedule_irq() and dynamic/raw_irqentry_exit_cond_resched() are moved earlier in the file, with no changes. As Mark pointed out, this change will have the following 2 key impact: - " We'll preempt even without taking a "real" interrupt. That shouldn't result in preemption that wasn't possible before, but it does change the probability of preempting at certain points, and might have a performance impact, so probably warrants a benchmark." - " We will not preempt when taking interrupts from a region of kernel code where IRQs are enabled but RCU is not watching, matching the behaviour of the generic entry code. This has the potential to introduce livelock if we can ever have a screaming interrupt in such a region, so we'll need to go figure out whether that's actually a problem. Having this as a separate patch will make it easier to test/bisect for that specifically." Reviewed-by: Ada Couprie Diaz Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 64f4b8b15f1c3c9a4e416fc5b5b4dc354b78e75e Author: Jinjie Ruan Date: Fri Aug 15 11:06:31 2025 +0800 arm64: entry: Refactor preempt_schedule_irq() check code To align the structure of the code with irqentry_exit_cond_resched() from the generic entry code, hoist the need_irq_preemption() and IS_ENABLED() check earlier. And different preemption check functions are defined based on whether dynamic preemption is enabled. Signed-off-by: Jinjie Ruan Reviewed-by: Ada Couprie Diaz Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 3c973c51bfbaf356367afa46b94f9100a7d672f2 Author: Jinjie Ruan Date: Fri Aug 15 11:06:30 2025 +0800 entry: Add arch_irqentry_exit_need_resched() for arm64 Compared to the generic entry code, ARM64 does additional checks when deciding to reschedule on return from interrupt. So introduce arch_irqentry_exit_need_resched() in the need_resched() condition of the generic raw_irqentry_exit_cond_resched(), with a NOP default. This will allow ARM64 to implement the architecture specific version for switching over to the generic entry code. Suggested-by: Ada Couprie Diaz Suggested-by: Mark Rutland Suggested-by: Kevin Brodsky Suggested-by: Thomas Gleixner Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit c74c44c6ae207e196c4c31c4a243abb0811a5974 Author: Jinjie Ruan Date: Fri Aug 15 11:06:29 2025 +0800 arm64: entry: Use preempt_count() and need_resched() helper The generic entry code uses preempt_count() and need_resched() helpers to check if it should do preempt_schedule_irq(). Currently, arm64 use its own check logic, that is "READ_ONCE(current_thread_info()->preempt_count == 0", which is equivalent to "preempt_count() == 0 && need_resched()". In preparation for moving arm64 over to the generic entry code, use these helpers to replace arm64's own code and move it ahead. No functional changes. Reviewed-by: Ada Couprie Diaz Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 77c1953946391e38c1e5120230f8df14f85219a7 Author: Jinjie Ruan Date: Fri Aug 15 11:06:28 2025 +0800 arm64: entry: Rework arm64_preempt_schedule_irq() The generic entry code has the form: | raw_irqentry_exit_cond_resched() | { | if (!preempt_count()) { | ... | if (need_resched()) | preempt_schedule_irq(); | } | } In preparation for moving arm64 over to the generic entry code, align the structure of the arm64 code with raw_irqentry_exit_cond_resched() from the generic entry code. Reviewed-by: Ada Couprie Diaz Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit ee776d68ba47cc8e2022f8c2218f1891a1244197 Author: Jinjie Ruan Date: Fri Aug 15 11:06:27 2025 +0800 arm64: entry: Refactor the entry and exit for exceptions from EL1 The generic entry code uses irqentry_state_t to track lockdep and RCU state across exception entry and return. For historical reasons, arm64 embeds similar fields within its pt_regs structure. In preparation for moving arm64 over to the generic entry code, pull these fields out of arm64's pt_regs, and use a separate structure, matching the style of the generic entry code. No functional changes. Acked-by: Mark Rutland Reviewed-by: Ada Couprie Diaz Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 788b8f6af60b22f78739fc758456b51b2b916dbd Author: Jinjie Ruan Date: Fri Aug 15 11:06:26 2025 +0800 arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() The generic entry code expects architecture code to provide regs_irqs_disabled(regs) function, but arm64 does not have this and provides interrupts_enabled(regs), which has the opposite polarity. In preparation for moving arm64 over to the generic entry code, relace arm64's interrupts_enabled() with regs_irqs_disabled() and update its callers under arch/arm64. For the moment, a definition of interrupts_enabled() is provided for the GICv3 driver. Once arch/arm implement regs_irqs_disabled(), this can be removed. Delete the fast_interrupts_enabled() macro as it is unused and we don't want any new users to show up. No functional changes. Reviewed-by: Ada Couprie Diaz Acked-by: Mark Rutland Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 1cc017b7f9c7b7cd86fdda4aee36b92d91cc2ad2 Author: Chris Morgan Date: Thu Sep 4 11:05:28 2025 -0500 power: supply: bq257xx: Add support for BQ257XX charger Add support for the charger function of the BQ257XX. The device is capable of charging batteries with a layout of 1 to 4 cells in series. Signed-off-by: Chris Morgan Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250904160530.66178-4-macroalpha82@gmail.com Signed-off-by: Lee Jones commit 3b1bbfb5fce3ca9fffc92ac1b053b0cfbb1f322b Author: Chris Morgan Date: Thu Sep 4 11:05:27 2025 -0500 mfd: bq257xx: Add support for BQ25703A core driver The Texas Instruments BQ25703A is an integrated charger manager and boost converter. The MFD driver initializes the device for the regulator driver and power supply driver. Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20250904160530.66178-3-macroalpha82@gmail.com Signed-off-by: Lee Jones commit 76bc2203a46ef704a4cd8003986f6bd74139a367 Author: Chris Morgan Date: Thu Sep 4 11:05:26 2025 -0500 dt-bindings: mfd: ti,bq25703a: Add TI BQ25703A Charger Document the Texas instruments BQ25703A series of charger managers/ buck/boost regulators. Signed-off-by: Chris Morgan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250904160530.66178-2-macroalpha82@gmail.com Signed-off-by: Lee Jones commit b8cf8fda522d5a37f8948ad8a19a1113cc38710f Author: Miklos Szeredi Date: Tue Sep 9 16:30:47 2025 +0200 fanotify: add watchdog for permission events This is to make it easier to debug issues with AV software, which time and again deadlocks with no indication of where the issue comes from, and the kernel being blamed for the deadlock. Then we need to analyze dumps to prove that the kernel is not in fact at fault. The deadlock comes from recursion: handling the event triggers another permission event, in some roundabout way, obviously, otherwise it would have been found in testing. With this patch a warning is printed when permission event is received by userspace but not answered for more than the timeout specified in /proc/sys/fs/fanotify/watchdog_timeout. The watchdog can be turned off by setting the timeout to zero (which is the default). The timeout is very coarse (T <= t < 2T) but I guess it's good enough for the purpose. Overhead should be minimal. Signed-off-by: Miklos Szeredi Reviewed-by: Amir Goldstein Link: https://patch.msgid.link/20250909143053.112171-1-mszeredi@redhat.com Signed-off-by: Jan Kara commit 382cbbe7fb2ae841a7e7b4c40a02f12afc803c69 Author: Fuad Tabba Date: Fri Aug 29 10:51:43 2025 +0100 arm64: sysreg: Add validation checks to sysreg header generation script The gen_sysreg.awk script processes the system register specification in the sysreg text file to generate C macro definitions. The current script will silently accept certain errors in the specification file, leading to incorrect header generation. For example, a Sysreg or SysregFields can be accidentally duplicated, causing its macros to be emitted twice. An Enum can contain duplicate values for different items, which is architecturally incorrect. Add checks to catch these errors at build time. The script now tracks all seen Sysreg and SysregFields definitions and checks for duplicates. It also tracks values within each Enum block to ensure entries are unique. Acked-by: Marc Zyngier Signed-off-by: Fuad Tabba Acked-by: Mark Rutland Signed-off-by: Will Deacon commit f4d4ebc84995178273740f3e601e97fdefc561d2 Author: Fuad Tabba Date: Fri Aug 29 10:51:42 2025 +0100 arm64: sysreg: Correct sign definitions for EIESB and DoubleLock The `ID_AA64MMFR4_EL1.EIESB` field, is an unsigned enumeration, but was incorrectly defined as a `SignedEnum` when introduced in commit cfc680bb04c5 ("arm64: sysreg: Add layout for ID_AA64MMFR4_EL1"). This is corrected to `UnsignedEnum`. Conversely, the `ID_AA64DFR0_EL1.DoubleLock` field, is a signed enumeration, but was incorrectly defined as an `UnsignedEnum`. This is corrected to `SignedEnum`, which wasn't correctly set when annotated as such in commit ad16d4cf0b4f ("arm64/sysreg: Initial unsigned annotations for ID registers"). Signed-off-by: Fuad Tabba Acked-by: Mark Rutland Signed-off-by: Will Deacon commit 2c2529e470627a8de22ec366d2f4c3146fb3fe96 Author: Fuad Tabba Date: Fri Aug 29 10:51:41 2025 +0100 arm64: sysreg: Fix and tidy up sysreg field definitions Fix the value of ID_PFR1_EL1.Security NSACR_RFR to be 0b0010, as per DDI0601/2025-06, which wasn't correctly set when introduced in commit 1224308075f1 ("arm64/sysreg: Convert ID_PFR1_EL1 to automatic generation"). While at it, remove redundant definitions of CPACR_EL12 and RCWSMASK_EL1 and fix some typos. Reviewed-by: Anshuman Khandual Acked-by: Marc Zyngier Signed-off-by: Fuad Tabba Acked-by: Mark Rutland Signed-off-by: Will Deacon commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 Author: Florian Westphal Date: Fri Aug 29 17:01:02 2025 +0200 netfilter: nf_reject: don't reply to icmp error messages tcp reject code won't reply to a tcp reset. But the icmp reject 'netdev' family versions will reply to icmp dst-unreach errors, unlike icmp_send() and icmp6_send() which are used by the inet family implementation (and internally by the REJECT target). Check for the icmp(6) type and do not respond if its an unreachable error. Without this, something like 'ip protocol icmp reject', when used in a netdev chain attached to 'lo', cause a packet loop. Same for two hosts that both use such a rule: each error packet will be replied to. Such situation persist until the (bogus) rule is amended to ratelimit or checks the icmp type before the reject statement. As the inet versions don't do this make the netdev ones follow along. Signed-off-by: Florian Westphal commit 944b6b216c0387ac3050cd8b773819ae360bfb1c Author: Zhang Tengfei Date: Mon Sep 1 21:46:54 2025 +0800 ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable KCSAN reported a data-race on the `ipvs->enable` flag, which is written in the control path and read concurrently from many other contexts. Following a suggestion by Julian, this patch fixes the race by converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. This lightweight approach ensures atomic access and acts as a compiler barrier, preventing unsafe optimizations where the flag is checked in loops (e.g., in ip_vs_est.c). Additionally, the `enable` checks in the fast-path hooks (`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are removed. These are unnecessary since commit 857ca89711de ("ipvs: register hooks only with services"). The `enable=0` condition they check for can only occur in two rare and non-fatal scenarios: 1) after hooks are registered but before the flag is set, and 2) after hooks are unregistered on cleanup_net. In the worst case, a single packet might be mishandled (e.g., dropped), which does not lead to a system crash or data corruption. Adding a check in the performance-critical fast-path to handle this harmless condition is not a worthwhile trade-off. Fixes: 857ca89711de ("ipvs: register hooks only with services") Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 Suggested-by: Julian Anastasov Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ Signed-off-by: Zhang Tengfei Acked-by: Julian Anastasov Signed-off-by: Florian Westphal commit cbd2257dc96e3e46217540fcb095a757ffa20d96 Author: Fernando Fernandez Mancera Date: Tue Sep 2 13:28:08 2025 +0200 netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support Expose the input bridge interface ethernet address so it can be used to redirect the packet to the receiving physical device for processing. Tested with nft command line tool. table bridge nat { chain PREROUTING { type filter hook prerouting priority 0; policy accept; ether daddr de:ad:00:00:be:ef meta pkttype set host ether daddr set meta ibrhwdr accept } } Joint work with Pablo Neira. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit ba941796d7cd1e81f51eed145dad1b47240ff420 Author: Zhen Ni Date: Fri Aug 29 16:36:21 2025 +0800 netfilter: ipset: Remove unused htable_bits in macro ahash_region Since the ahash_region() macro was redefined to calculate the region index solely from HTABLE_REGION_BITS, the htable_bits parameter became unused. Remove the unused htable_bits argument and its call sites, simplifying the code without changing semantics. Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") Signed-off-by: Zhen Ni Reviewed-by: Phil Sutter Signed-off-by: Florian Westphal commit 496a6ed8405ef15f6becc0126bf1577717faf86d Author: Andres Urian Florez Date: Sun Feb 16 19:14:50 2025 -0500 selftest:net: fixed spelling mistakes Fixed spelling errors in test_redirect6() error message and test_port_shadowing() comments Signed-off-by: Andres Urian Florez Reviewed-by: Hangbin Liu Signed-off-by: Florian Westphal commit c7ec58c39b0252e6635dde55e5c708132ab25cfc Author: Wasim Nazir Date: Mon Sep 8 13:49:55 2025 +0530 dt-bindings: eeprom: at24: Add compatible for Giantec GT24C256C The gt24c256c is another 24c256 compatible EEPROM, and does not follow the generic name matching, so add a separate compatible for it. This ensures accurate device-tree representation and enables proper kernel support for systems using this part. Acked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250908-lemans-evk-bu-v4-5-5c319c696a7d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 59ba108806516adeaed51a536d55d4f5e9645881 Author: Rob Herring (Arm) Date: Wed Sep 10 18:36:15 2025 -0500 ASoC: dt-bindings: linux,spdif: Add "port" node The SPDIF receiver/transmitter can be connected to a DAI device via OF graph port. It is already in use and supported. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250910233615.775397-2-robh@kernel.org Signed-off-by: Mark Brown commit 1217b573978482ae7d21dc5c0bf5aa5007b24f90 Author: Alvin Šipraga Date: Wed Sep 10 11:34:06 2025 +0200 ASoC: codecs: pcm1754: add pcm1754 dac driver The Texas Instruments PCM1754[1] is a simple stereo DAC without any digital management interface but soft mute, PCM input format and 44.1 kHz digital de-emphasis can be configured via strapping pins. Only soft mute and PCM input format selection is currently exposed via optional GPIOs in the driver. [1]: https://www.ti.com/product/PCM1754 Signed-off-by: Alvin Šipraga Co-developed-by: Stefan Kerkmann Signed-off-by: Stefan Kerkmann Link: https://patch.msgid.link/20250910-v6-12-topic-pcm1754-v2-2-0917dbe73c65@pengutronix.de Signed-off-by: Mark Brown commit 87c0881bd734a2cea12076716d5d9a050789d4b7 Author: Stefan Kerkmann Date: Wed Sep 10 11:34:05 2025 +0200 ASoC: dt-bindings: ti,pcm1754: add binding documentation The Texas Instruments PCM1754 is a simple stereo DAC without any digital management interface but soft mute, PCM input format and 44.1 kHz digital de-emphasis can be configured via strapping pins. Only soft mute and PCM input format selection is currently exposed via optional GPIOs in the driver. Signed-off-by: Stefan Kerkmann Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250910-v6-12-topic-pcm1754-v2-1-0917dbe73c65@pengutronix.de Signed-off-by: Mark Brown commit 60d2b7899142d56654ba254a454eb282c1d181ca Author: Vinay Belgaumkar Date: Wed Sep 3 16:21:20 2025 -0700 drm/xe/guc: Add SLPC power profile interface GuC has an interface to set a power profile for the SLPC algorithm. Base mode is default and ensures a balanced performance, power_saving mode has conservative up/down thresholds and is suitable for use with apps that typically need to be power efficient. This will result in lower GT frequencies, thus consuming lower power. Selected power profile will be displayed in this format: $ cat power_profile [base] power_saving $ echo power_saving > power_profile $ cat power_profile base [power_saving] v2: Address review comments (Rodrigo) Cc: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250903232120.390190-1-vinay.belgaumkar@intel.com Signed-off-by: Rodrigo Vivi commit cf4fd52e323604ccfa8390917593e1fb965653ee Author: Daniel Almeida Date: Wed Sep 10 10:51:18 2025 -0300 rust: drm: Introduce the Tyr driver for Arm Mali GPUs Add a Rust driver for ARM Mali CSF-based GPUs. It is a port of Panthor and therefore exposes Panthor's uAPI and name to userspace, and the product of a joint effort between Collabora, Arm and Google engineers. The aim is to incrementally develop Tyr with the abstractions that are currently available until it is consider to be in parity with Panthor feature-wise. The development of Tyr itself started in January, after a few failed attempts of converting Panthor piecewise through a mix of Rust and C code. There is a downstream branch that's much further ahead in terms of capabilities than this initial patch. The downstream code is capable of booting the MCU, doing sync VM_BINDS through the work-in-progress GPUVM abstraction and also doing (trivial) submits through Asahi's drm_scheduler and dma_fence abstractions. So basically, most of what one would expect a modern GPU driver to do, except for power management and some other very important adjacent pieces. It is not at the point where submits can correctly deal with dependencies, or at the point where it can rotate access to the GPU hardware fairly through a software scheduler, but that is simply a matter of writing more code. This first patch, however, only implements a subset of the current features available downstream, as the rest is not implementable without pulling in even more abstractions. In particular, a lot of things depend on properly mapping memory on a given VA range, which itself depends on the GPUVM abstraction that is currently work-in-progress. For this reason, we still cannot boot the MCU and thus, cannot do much for the moment. This constitutes a change in the overall strategy that we have been using to develop Tyr so far. By submitting small parts of the driver upstream iteratively, we aim to: a) evolve together with Nova and rvkms, hopefully reducing regressions due to upstream changes (that may break us because we were not there, in the first place) b) prove any work-in-progress abstractions by having them run on a real driver and hardware and, c) provide a reason to work on and review said abstractions by providing a user, which would be tyr itself. Despite its limited feature-set, we offer IGT tests. It is only tested on the rk3588, so any other SoC is probably not going to work at all for now. The skeleton is basically taken from Nova and also rust_platform_driver.rs. Lastly, the name "Tyr" is inspired by Norse mythology, reflecting ARM's tradition of naming their GPUs after Nordic mythological figures and places. Co-developed-by: Beata Michalska Signed-off-by: Beata Michalska Co-developed-by: Carsten Haitzler Signed-off-by: Carsten Haitzler Co-developed-by: Rob Herring Signed-off-by: Rob Herring Link: https://www.collabora.com/news-and-blog/news-and-events/introducing-tyr-a-new-rust-drm-driver.html Signed-off-by: Daniel Almeida Acked-by: Boris Brezillon [aliceryhl: minor Kconfig update on apply] [aliceryhl: s/drm::device::/drm::/] Link: https://lore.kernel.org/r/20250910-tyr-v3-1-dba3bc2ae623@collabora.com Co-developed-by: Alice Ryhl Signed-off-by: Alice Ryhl commit 63f0c6a270be611455b502de1aa7049476c6e1ed Merge: 7704e6be4ed283 25fb0ea986dc10 Author: Greg Kroah-Hartman Date: Thu Sep 11 13:19:17 2025 +0200 Merge tag 'w1-drv-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1 into char-misc-next Krzysztof writes: 1-Wire bus drivers for v6.18 1. Correct missing interrupts in IMX 1-Wire Devicetree bindings. 2. Drop old, dead code from Matrox driver. * tag 'w1-drv-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1: w1: matrox: Remove some deadcode in matrox_w1_remove() dt-bindings: w1: imx: Add an entry for the interrupts property commit f0addd325ef692c92c522a2ba4d9db13fc90e664 Author: Alexander Kurz Date: Mon Aug 11 06:43:58 2025 +0000 mfd: input: rtc: mc13783: Remove deprecated mc13xxx_irq_ack() mc13xxx_irq_ack() got deprecated and became dead code with commit 10f9edaeaa30 ("mfd: mc13xxx: Use regmap irq framework for interrupts"). It should be safe to remove it now. Signed-off-by: Alexander Kurz Acked-by: Alexandre Belloni Acked-by: Uwe Kleine-König Acked-by: Dmitry Torokhov # for input Link: https://lore.kernel.org/r/20250811064358.1659-1-akurz@blala.de Signed-off-by: Lee Jones commit 8c30b0018f9d93391573e091960d257fd9de120a Author: chenmiao Date: Fri Sep 5 18:12:58 2025 +0000 openrisc: Add jump label support Supported a complete jump_label implementation based on the ARM64 and RV64 version and add the CONFIG_JUMP_LABEL=y to the defconfig. Testing was conducted using a dedicated test module jump-label-test, provided in the link below. For detailed steps, please refer to the README also at the provided link. Link: https://github.com/ChenMiaoi/GSoC-2025-Final-Report/tree/main/tests/jump-label-test Test Environment: - Hardware: QEMU emulated OR1K - Kernel Version: 6.17.0-rc3-dirty - Configs: CONFIG_MODULES=y,CONFIG_MODULE_UNLOAD=y - Toolchain: or1k-none-linux-musl-gcc 15.1.0 Test Results: $ insmod jump_label_test.ko [ 32.590000] Jump label performance test module loaded [ 35.250000] Normal branch time: 1241327150 ns (124 ns per iteration) [ 35.250000] Jump label (false) time: 706422700 ns (70 ns per iteration) [ 35.250000] Jump label (true) time: 708913450 ns (70 ns per iteration) $ rmmod jump_label_test.ko [ 72.210000] Jump label test module unloaded The results show approximately 43% improvement in branch performance when using jump labels compared to traditional branches. Link: https://lore.kernel.org/openrisc/aLsZ9S3X0OpKy1RM@antec/T/#u Signed-off-by: chenmiao Signed-off-by: Stafford Horne commit 09a27fc32e3d69be93fdb898690932ad5bc592d8 Author: chenmiao Date: Fri Sep 5 18:12:57 2025 +0000 openrisc: Regenerate defconfigs. Regenerating defconfigs allows subsequent changes to the configs to be related only to the corresponding modifications, without mixing changes from other configs. Signed-off-by: chenmiao Signed-off-by: Stafford Horne commit 9d0cb6d00be891586261a35da7f8c3c956825c39 Author: chenmiao Date: Fri Sep 5 18:12:56 2025 +0000 openrisc: Add R_OR1K_32_PCREL relocation type module support To ensure the proper functioning of the jump_label test module, this patch adds support for the R_OR1K_32_PCREL relocation type for any modules. The implementation calculates the PC-relative offset by subtracting the instruction location from the target value and stores the result at the specified location. Signed-off-by: chenmiao Signed-off-by: Stafford Horne commit 4735037b5d9b0f809c51976c87d737fa2c48fdea Author: chenmiao Date: Fri Sep 5 18:12:55 2025 +0000 openrisc: Add text patching API support Add text patching api's to use in subsequent jump_label implementation. We use a new fixmap FIX_TEXT_POKE0 entry to temporarily override MMU mappings to allow read only text pages to be written to. Previously, __set_fix was marked with __init as it was only used during the EARLYCON stage. Now that TEXT_POKE mappings require post-init usage (e.g., FIX_TEXT_POKE0), keeping __init would cause runtime bugs whenset_fixmap accesses invalid memory. Thus, we remove the __init flag to ensure __set_fix remains valid beyond initialization. A new function patch_insn_write is exposed to allow single instruction patching. Link: https://lore.kernel.org/openrisc/aJIC8o1WmVHol9RY@antec/T/#t Signed-off-by: chenmiao Signed-off-by: Stafford Horne commit 5c6f123c419b6e20f84ac1683089a52f449273aa Author: Yazen Ghannam Date: Mon Sep 8 15:40:36 2025 +0000 x86/mce: Add a clear_bank() helper Add a helper at the end of the MCA polling function to collect vendor and/or feature actions. Start with a basic skeleton for now. Actions for AMD thresholding and deferred errors will be added later. [ bp: Drop the obvious comment too. ] Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit 91af6842e9945d064401ed2d6e91539a619760d1 Author: Yazen Ghannam Date: Mon Sep 8 15:40:35 2025 +0000 x86/mce: Move machine_check_poll() status checks to helper functions There are a number of generic and vendor-specific status checks in machine_check_poll(). These are used to determine if an error should be skipped. Move these into helper functions. Future vendor-specific checks will be added to the helpers. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Reviewed-by: Nikolay Borisov Tested-by: Tony Luck Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit 7eee1e92684507f64ec6a75fecbd27e37174b888 Author: Yazen Ghannam Date: Mon Sep 8 15:40:34 2025 +0000 x86/mce: Separate global and per-CPU quirks Many quirks are global configuration settings and a handful apply to each CPU. Move the per-CPU quirks to vendor init to execute them on each online CPU. Set the global quirks during BSP-only init so they're only executed once and early. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Reviewed-by: Nikolay Borisov Tested-by: Tony Luck Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit a46b2bbe1e36e7faab5010f68324b7d191c5c09f Author: Yazen Ghannam Date: Mon Sep 8 15:40:33 2025 +0000 x86/mce: Do 'UNKNOWN' vendor check early The 'UNKNOWN' vendor check is handled as a quirk that is run on each online CPU. However, all CPUs are expected to have the same vendor. Move the 'UNKNOWN' vendor check to the BSP-only init so it is done early and once. Remove the unnecessary return value from the quirks check. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Reviewed-by: Nikolay Borisov Tested-by: Tony Luck Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit c6e465b8d45a1bc717d196ee769ee5a9060de8e2 Author: Yazen Ghannam Date: Mon Sep 8 15:40:32 2025 +0000 x86/mce: Define BSP-only SMCA init Currently, on AMD systems, MCA interrupt handler functions are set during CPU init. However, the functions only need to be set once for the whole system. Assign the handlers only during BSP init. Do so only for SMCA systems to maintain the old behavior for legacy systems. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit 5adf6f2b9972dbb69f4dd11bae52ba251c64ecb7 Merge: 7f0b763b818064 f7240999deb45f Author: Paolo Abeni Date: Thu Sep 11 12:22:40 2025 +0200 Merge branch 'ipv4-icmp-fix-source-ip-derivation-in-presence-of-vrfs' Ido Schimmel says: ==================== ipv4: icmp: Fix source IP derivation in presence of VRFs Align IPv4 with IPv6 and in the presence of VRFs generate ICMP error messages with a source IP that is derived from the receiving interface and not from its VRF master. This is especially important when the error messages are "Time Exceeded" messages as it means that utilities like traceroute will show an incorrect packet path. Patches #1-#2 are preparations. Patch #3 is the actual change. Patches #4-#7 make small improvements in the existing traceroute test. Patch #8 extends the traceroute test with VRF test cases for both IPv4 and IPv6. Changes since v1 [1]: * Rebase. [1] https://lore.kernel.org/netdev/20250901083027.183468-1-idosch@nvidia.com/ ==================== Link: https://patch.msgid.link/20250908073238.119240-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit f7240999deb45f15c37b357852be2da23c2ea2d3 Author: Ido Schimmel Date: Mon Sep 8 10:32:38 2025 +0300 selftests: traceroute: Add VRF tests Create versions of the existing test cases where the routers generating the ICMP error messages are using VRFs. Check that the source IPs of these messages do not change in the presence of VRFs. IPv6 always behaved correctly, but IPv4 fails when reverting "ipv4: icmp: Fix source IP derivation in presence of VRFs". Without IPv4 change: # ./traceroute.sh TEST: IPv6 traceroute [ OK ] TEST: IPv6 traceroute with VRF [ OK ] TEST: IPv4 traceroute [ OK ] TEST: IPv4 traceroute with VRF [FAIL] traceroute did not return 1.0.3.1 $ echo $? 1 The test fails because the ICMP error message is sent with the VRF device's IP (1.0.4.1): # traceroute -n -s 1.0.1.3 1.0.2.4 traceroute to 1.0.2.4 (1.0.2.4), 30 hops max, 60 byte packets 1 1.0.4.1 0.165 ms 0.110 ms 0.103 ms 2 1.0.2.4 0.098 ms 0.085 ms 0.078 ms # traceroute -n -s 1.0.3.3 1.0.2.4 traceroute to 1.0.2.4 (1.0.2.4), 30 hops max, 60 byte packets 1 1.0.4.1 0.201 ms 0.138 ms 0.129 ms 2 1.0.2.4 0.123 ms 0.105 ms 0.098 ms With IPv4 change: # ./traceroute.sh TEST: IPv6 traceroute [ OK ] TEST: IPv6 traceroute with VRF [ OK ] TEST: IPv4 traceroute [ OK ] TEST: IPv4 traceroute with VRF [ OK ] $ echo $? 0 Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-9-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 2e6428100b1613d85d5442c14ee18c5a47054daf Author: Ido Schimmel Date: Mon Sep 8 10:32:37 2025 +0300 selftests: traceroute: Test traceroute with different source IPs When generating ICMP error messages, the kernel will prefer a source IP that is on the same subnet as the destination IP (see inet_select_addr()). Test this behavior by invoking traceroute with different source IPs and checking that the ICMP error message is generated with a source IP in the same subnet. Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-8-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 5c9c78224fc3045c8ffe1a4c7d25d277e2e02b7b Author: Ido Schimmel Date: Mon Sep 8 10:32:36 2025 +0300 selftests: traceroute: Reword comment Both of the addresses are configured as primary addresses, but the kernel is expected to choose 10.0.1.1/24 as the source IP of the ICMP error message since it is on the same subnet as the destination IP of the message (10.0.1.3/24). Reword the comment to reflect that. Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-7-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 47efbac9b768553331b9459743a29861e0acd797 Author: Ido Schimmel Date: Mon Sep 8 10:32:35 2025 +0300 selftests: traceroute: Use require_command() Use require_command() so that the test will return SKIP (4) when a required command is not present. Before: # ./traceroute.sh SKIP: Could not run IPV6 test without traceroute6 SKIP: Could not run IPV4 test without traceroute $ echo $? 0 After: # ./traceroute.sh TEST: traceroute6 not installed [SKIP] $ echo $? 4 Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com Signed-off-by: Paolo Abeni commit c068ba9d3ded56cb1ba4d5135ee84bf8039bd563 Author: Ido Schimmel Date: Mon Sep 8 10:32:34 2025 +0300 selftests: traceroute: Return correct value on failure The test always returns success even if some tests were modified to fail. Fix by converting the test to use the appropriate library functions instead of using its own functions. Before: # ./traceroute.sh TEST: IPV6 traceroute [FAIL] TEST: IPV4 traceroute [ OK ] Tests passed: 1 Tests failed: 1 $ echo $? 0 After: # ./traceroute.sh TEST: IPv6 traceroute [FAIL] traceroute6 did not return 2000:102::2 TEST: IPv4 traceroute [ OK ] $ echo $? 1 Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-5-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 4a8c416602d97a4e2073ed563d4d4c7627de19cf Author: Ido Schimmel Date: Mon Sep 8 10:32:33 2025 +0300 ipv4: icmp: Fix source IP derivation in presence of VRFs When the "icmp_errors_use_inbound_ifaddr" sysctl is enabled, the source IP of ICMP error messages should be the "primary address of the interface that received the packet that caused the icmp error". The IPv4 ICMP code determines this interface using inet_iif() which in the input path translates to skb->skb_iif. If the interface that received the packet is a VRF port, skb->skb_iif will contain the ifindex of the VRF device and not that of the receiving interface. This is because in the input path the VRF driver overrides skb->skb_iif with the ifindex of the VRF device itself (see vrf_ip_rcv()). As such, the source IP that will be chosen for the ICMP error message is either an address assigned to the VRF device itself (if present) or an address assigned to some VRF port, not necessarily the input or output interface. This behavior is especially problematic when the error messages are "Time Exceeded" messages as it means that utilities like traceroute will show an incorrect packet path. Solve this by determining the input interface based on the iif field in the control block, if present. This field is set in the input path to skb->skb_iif and is not later overridden by the VRF driver, unlike skb->skb_iif. This behavior is consistent with the IPv6 counterpart that already uses the iif from the control block. Reported-by: Andy Roulin Reported-by: Rajkumar Srinivasan Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250908073238.119240-4-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 0d3c4a441686663ad34aa3d6abe8c5317d21e707 Author: Ido Schimmel Date: Mon Sep 8 10:32:32 2025 +0300 ipv4: icmp: Pass IPv4 control block structure as an argument to __icmp_send() __icmp_send() is used to generate ICMP error messages in response to various situations such as MTU errors (i.e., "Fragmentation Required") and too many hops (i.e., "Time Exceeded"). The skb that generated the error does not necessarily come from the IPv4 layer and does not always have a valid IPv4 control block in skb->cb. Therefore, commit 9ef6b42ad6fd ("net: Add __icmp_send helper.") changed the function to take the IP options structure as argument instead of deriving it from the skb's control block. Some callers of this function such as icmp_send() pass the IP options structure from the skb's control block as in these call paths the control block is known to be valid, but other callers simply pass a zeroed structure. A subsequent patch will need __icmp_send() to access more information from the IPv4 control block (specifically, the ifindex of the input interface). As a preparation for this change, change the function to take the IPv4 control block structure as an argument instead of the IP options structure. This makes the function similar to its IPv6 counterpart that already takes the IPv6 control block structure as an argument. No functional changes intended. Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250908073238.119240-3-idosch@nvidia.com Signed-off-by: Paolo Abeni commit cda276bcb9a5c3d53620b3af9c372a87e0f92583 Author: Ido Schimmel Date: Mon Sep 8 10:32:31 2025 +0300 ipv4: cipso: Simplify IP options handling in cipso_v4_error() When __ip_options_compile() is called with an skb, the IP options are parsed from the skb data into the provided IP option argument. This is in contrast to the case where the skb argument is NULL and the options are parsed from opt->__data. Given that cipso_v4_error() always passes an skb to __ip_options_compile(), there is no need to allocate an extra 40 bytes (maximum IP options size). Therefore, simplify the function by removing these extra bytes and make the function similar to ipv4_send_dest_unreach() which also calls both __ip_options_compile() and __icmp_send(). This is a preparation for changing the arguments being passed to __icmp_send(). No functional changes intended. Reviewed-by: Petr Machata Reviewed-by: David Ahern Acked-by: Paul Moore Signed-off-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250908073238.119240-2-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 669ce4984b729ad5b4c6249d4a8721ae52398bfb Author: Yazen Ghannam Date: Mon Sep 8 15:40:31 2025 +0000 x86/mce: Define BSP-only init Currently, MCA initialization is executed identically on each CPU as they are brought online. However, a number of MCA initialization tasks only need to be done once. Define a function to collect all 'global' init tasks and call this from the BSP only. Start with CPU features. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Reviewed-by: Nikolay Borisov Tested-by: Tony Luck Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit cfffcf97997bd35f4a59e035523d1762568bdbad Author: Yazen Ghannam Date: Mon Sep 8 15:40:30 2025 +0000 x86/mce: Set CR4.MCE last during init Set the CR4.MCE bit as the last step during init. This brings the MCA init order closer to what is described in the x86 docs. x86 docs: AMD Intel MCG_CTL MCA_CONFIG MCG_EXT_CTL MCi_CTL MCi_CTL MCG_CTL CR4.MCE CR4.MCE Current Linux: AMD Intel CR4.MCE CR4.MCE MCG_CTL MCG_CTL MCA_CONFIG MCG_EXT_CTL MCi_CTL MCi_CTL Updated Linux: AMD Intel MCG_CTL MCG_CTL MCA_CONFIG MCG_EXT_CTL MCi_CTL MCi_CTL CR4.MCE CR4.MCE The new init flow will match Intel's docs, but there will still be a mismatch for AMD regarding MCG_CTL. However, there is no known issue with this ordering, so leave it for now. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20250908-wip-mca-updates-v6-0-eef5d6c74b9c@amd.com commit 7f0b763b818064b317122b6d5e20c59802615eb2 Merge: db1b6006668623 6bffdc0f88f85c Author: Paolo Abeni Date: Thu Sep 11 12:00:25 2025 +0200 Merge branch 'net-xdp-handle-frags-with-unreadable-memory' Jakub Kicinski says: ==================== net: xdp: handle frags with unreadable memory Make XDP helpers compatible with unreadable memory. This is very similar to how we handle pfmemalloc frags today. Record the info in xdp_buf flags as frags get added and then update the skb once allocated. This series adds the unreadable memory metadata tracking to drivers using xdp_build_skb_from*() with no changes on the driver side - hence the only driver changes here are refactoring. Obviously, unreadable memory is incompatible with XDP today, but thanks to xdp_build_skb_from_buf() increasing number of drivers have a unified datapath, whether XDP is enabled or not. RFC: https://lore.kernel.org/20250812161528.835855-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250905221539.2930285-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 6bffdc0f88f85cd15b261286be4dc3c62ddea7d3 Author: Jakub Kicinski Date: Fri Sep 5 15:15:39 2025 -0700 net: xdp: handle frags with unreadable memory We don't expect frags with unreadable memory to be presented to XDP programs today, but the XDP helpers are designed to be usable whether XDP is enabled or not. Support handling frags with unreadable memory. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250905221539.2930285-3-kuba@kernel.org Acked-by: Stanislav Fomichev Reviewed-by: Alexander Lobakin Signed-off-by: Paolo Abeni commit 1827f773e416842bb0a1be93f313e02591e0b0c2 Author: Jakub Kicinski Date: Fri Sep 5 15:15:38 2025 -0700 net: xdp: pass full flags to xdp_update_skb_shared_info() xdp_update_skb_shared_info() needs to update skb state which was maintained in xdp_buff / frame. Pass full flags into it, instead of breaking it out bit by bit. We will need to add a bit for unreadable frags (even tho XDP doesn't support those the driver paths may be common), at which point almost all call sites would become: xdp_update_skb_shared_info(skb, num_frags, sinfo->xdp_frags_size, MY_PAGE_SIZE * num_frags, xdp_buff_is_frag_pfmemalloc(xdp), xdp_buff_is_frag_unreadable(xdp)); Keep a helper for accessing the flags, in case we need to transform them somehow in the future (e.g. to cover up xdp_buff vs xdp_frame differences). While we are touching call callers - rename the helper to xdp_update_skb_frags_info(), previous name may have implied that it's shinfo that's updated. We are updating flags in struct sk_buff based on frags that got attched. Signed-off-by: Jakub Kicinski Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20250905221539.2930285-2-kuba@kernel.org Acked-by: Stanislav Fomichev Reviewed-by: Alexander Lobakin Signed-off-by: Paolo Abeni commit 1da4cbefed4a2e69ebad81fc9b356cd9b807f380 Author: Tudor Ambarus Date: Mon Sep 8 14:02:00 2025 +0000 firmware: exynos-acpm: fix PMIC returned errno ACPM PMIC command handlers returned a u8 value when they should have returned either zero or negative error codes. Translate the APM PMIC errno to linux errno. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-input/aElHlTApXj-W_o1r@stanley.mountain/ Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Cc: stable@vger.kernel.org Signed-off-by: Tudor Ambarus Signed-off-by: Krzysztof Kozlowski commit dbc2868b7b57fb4caa8e44a69e882dcf8e8d59bf Author: Jens Wiklander Date: Wed Aug 13 08:02:58 2025 +0200 optee: smc abi: dynamic protected memory allocation Add support in the OP-TEE backend driver for dynamic protected memory allocation using the SMC ABI. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 2b78d79cdf963e09ec8b90c55216b6ab5a83dbaf Author: Jens Wiklander Date: Wed Aug 13 08:02:57 2025 +0200 optee: FF-A: dynamic protected memory allocation Add support in the OP-TEE backend driver dynamic protected memory allocation with FF-A. The protected memory pools for dynamically allocated protected memory are instantiated when requested by user-space. This instantiation can fail if OP-TEE doesn't support the requested use-case of protected memory. Restricted memory pools based on a static carveout or dynamic allocation can coexist for different use-cases. We use only dynamic allocation with FF-A. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 0e32abef9fc8a418fbe64d4372c6791e02b5c386 Author: Jens Wiklander Date: Wed Aug 13 08:02:56 2025 +0200 optee: support protected memory allocation Add support in the OP-TEE backend driver for protected memory allocation. The support is limited to only the SMC ABI and for secure video buffers. OP-TEE is probed for the range of protected physical memory and a memory pool allocator is initialized if OP-TEE have support for such memory. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit ab09dd6d9201af9930efd5a5a0cb56a0fea6a169 Author: Jens Wiklander Date: Wed Aug 13 08:02:55 2025 +0200 tee: add tee_shm_alloc_dma_mem() Add tee_shm_alloc_dma_mem() to allocate DMA memory. The memory is represented by a tee_shm object using the new flag TEE_SHM_DMA_MEM to identify it as DMA memory. The allocated memory will later be lent to the TEE to be used as protected memory. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 146bf4e75ecab9759ed78c9d167e860042d627fb Author: Etienne Carriere Date: Wed Aug 13 08:02:54 2025 +0200 tee: new ioctl to a register tee_shm from a dmabuf file descriptor Add a userspace API to create a tee_shm object that refers to a dmabuf reference. Userspace registers the dmabuf file descriptor as in a tee_shm object. The registration is completed with a tee_shm returned file descriptor. Userspace is free to close the dmabuf file descriptor after it has been registered since all the resources are now held via the new tee_shm object. Closing the tee_shm file descriptor will eventually release all resources used by the tee_shm object when all references are released. The new IOCTL, TEE_IOC_SHM_REGISTER_FD, supports dmabuf references to physically contiguous memory buffers. Dmabuf references acquired from the TEE DMA-heap can be used as protected memory for Secure Video Path and such use cases. It depends on the TEE and the TEE driver if dmabuf references acquired by other means can be used. A new tee_shm flag is added to identify tee_shm objects built from a registered dmabuf, TEE_SHM_DMA_BUF. Signed-off-by: Etienne Carriere Signed-off-by: Olivier Masse Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit fdf631ac9ee671c49febdc503f8287a82497f559 Author: Jens Wiklander Date: Wed Aug 13 08:02:53 2025 +0200 tee: refactor params_from_user() Break out the memref handling into a separate helper function. No change in behavior. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit c924c65f52c300ba36373e140a43a8e723c3abdd Author: Jens Wiklander Date: Wed Aug 13 08:02:52 2025 +0200 tee: implement protected DMA-heap Implement DMA heap for protected DMA-buf allocation in the TEE subsystem. Protected memory refers to memory buffers behind a hardware enforced firewall. It is not accessible to the kernel during normal circumstances but rather only accessible to certain hardware IPs or CPUs executing in higher or differently privileged mode than the kernel itself. This interface allows to allocate and manage such protected memory buffers via interaction with a TEE implementation. The protected memory is allocated for a specific use-case, like Secure Video Playback, Trusted UI, or Secure Video Recording where certain hardware devices can access the memory. The DMA-heaps are enabled explicitly by the TEE backend driver. The TEE backend drivers needs to implement protected memory pool to manage the protected memory. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit a6ccb03fb77341df0573c5b3f82f82b4da1b87f5 Author: Jens Wiklander Date: Wed Aug 13 08:02:51 2025 +0200 dma-buf: dma-heap: export declared functions Export the dma-buf heap functions to allow them to be used by the OP-TEE driver. The OP-TEE driver wants to register and manage specific secure DMA heaps with it. Reviewed-by: Sumit Garg Reviewed-by: T.J. Mercier Acked-by: Sumit Semwal Signed-off-by: Jens Wiklander commit 15003d9cc65fe7d4cbc9b25d6dccfc3e58d4d483 Author: Jens Wiklander Date: Wed Aug 13 08:02:50 2025 +0200 optee: sync secure world ABI headers Update the header files describing the secure world ABI, both with and without FF-A. The ABI is extended to deal with protected memory, but as usual backward compatible. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 72136efb875d8438c20b9c8ab72945d474933471 Author: Aaron Ma Date: Sat Aug 23 20:16:47 2025 +0800 drm/i915/backlight: Honor VESA eDP backlight luminance control capability The VESA AUX backlight fails to be enable luminance based backlight mainpulation becaused luminance_set is false by default. Fix it by using luminance support control capabitliy. Fixes: e13af5166a359 ("drm/i915/backlight: Use drm helper to initialize edp backlight") Signed-off-by: Aaron Ma Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250823121647.275834-1-aaron.ma@canonical.com commit db1b6006668623b46a3f6b3fe6b5f030e4c60a42 Author: Marc Harvey Date: Fri Sep 5 04:04:41 2025 +0000 selftests: net: Add tests to verify team driver option set and get. There are currently no kernel tests that verify setting and getting options of the team driver. In the future, options may be added that implicitly change other options, which will make it useful to have tests like these that show nothing breaks. There will be a follow up patch to this that adds new "rx_enabled" and "tx_enabled" options, which will implicitly affect the "enabled" option value and vice versa. The tests use teamnl to first set options to specific values and then gets them to compare to the set values. Signed-off-by: Marc Harvey Link: https://patch.msgid.link/20250905040441.2679296-1-marcharvey@google.com Signed-off-by: Paolo Abeni commit d81b0c3099d02f6c7a4be7a15d33145b3700b159 Author: Alex Bee Date: Sat Sep 6 12:08:10 2025 +0000 arm64: dts: rockchip: enable the Mali GPU on RK3328 boards Add a gpu node to the rock64 board to enable the Mali GPU and move the existing node from roc-pc to the shared roc dtsi to enable it also for the roc-cc board. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Tested-by: Diederik de Haas # Rock64 Link: https://lore.kernel.org/r/20250906120810.1833016-2-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 718efbc6a773dd07047f2ac3d62bbbf3bc4b104f Author: Alex Bee Date: Sat Sep 6 12:08:09 2025 +0000 arm64: dts: rockchip: add GPU powerdomain, opps, and cooling to rk3328 Add GPU powerdomain, opp-table, and cooling map nodes for the Mali GPU on the RK3328 SoC. Opp-table frequencies are sourced from the Rockchip Linux v4.4 vendor kernel while voltages have been derived from practical use and support work: keeping voltage above 1075mV and disabling the 500MHz opp-point avoids instability and crashes. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Tested-by: Diederik de Haas # Rock64 Link: https://lore.kernel.org/r/20250906120810.1833016-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 843367c7ed196bd0806c8776cba108aaf6923b82 Author: Sebastian Reichel Date: Wed Sep 10 15:54:51 2025 +0200 arm64: dts: rockchip: Fix network on rk3576 evb1 board The RK3576 EVB1 has a RTL8211F PHY for each GMAC interface with a dedicated reset line and the 25MHz clock provided by the SoC. The current description results in non-working Ethernet as the clocks are only enabled by the PHY driver, but probing the right PHY driver currently requires that the PHY ID register can be read for automatic identification. This fixes up the network description to get the network functionality working reliably and cleans up usage of deprecated DT properties while at it. Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board") Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250910-rk3576-evb-network-v1-1-68ed4df272a2@collabora.com Signed-off-by: Heiko Stuebner commit 871b0391ccf3feb831e233ba3e972663c057b946 Author: Michael Riesch Date: Wed Sep 3 19:04:55 2025 +0200 arm64: dts: rockchip: add mipi csi-2 dphy nodes to rk3588 The Rockchip RK3588 features two MIPI CSI-2 DPHYs. Add the device tree nodes for them. Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-7-a4f340a7f0cf@collabora.com Signed-off-by: Heiko Stuebner commit 92f96706947e902fd9156cdcdd61c9a44b4b186c Author: Michael Riesch Date: Wed Sep 3 19:04:49 2025 +0200 dt-bindings: soc: rockchip: add rk3588 csidphy grf syscon Add CSIDPHY GRF syscon compatible for the Rockchip RK3588. Acked-by: "Rob Herring (Arm)" Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-1-a4f340a7f0cf@collabora.com Signed-off-by: Heiko Stuebner commit 8e54e493c9926105e771873b151d5eba80fbb856 Author: Xi Pardee Date: Wed Sep 10 14:06:25 2025 -0700 platform/x86:intel/pmc: Enable SSRAM support for Panther Lake Enable Panther Lake platforms to achieve PMC information from Intel PMC SSRAM Telemetry driver and substate requirements data from telemetry region. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20250910210629.11198-6-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a22bc8643889ef5a3c032700f69001fdc457413c Author: Xi Pardee Date: Wed Sep 10 14:06:24 2025 -0700 platform/x86:intel/pmc: Show substate requirement for S0ix blockers Add support to read and show S0ix blocker substate requirements. Starting from Panther Lake, substate requirement data is provided based on S0ix blockers instead of all low power mode requirements. For platforms that support this new feature, add support to display substate requirements based on S0ix blockers. Change the "substate_requirements" attribute of Intel PMC Core driver to show the substate requirements for each S0ix blocker and the corresponding S0ix blocker value. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20250910210629.11198-5-xi.pardee@linux.intel.com [ij: rename pmc_index -> pmc_idx] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 612326e0a87a5c75d35146ee172eb46bcd09089a Author: Xi Pardee Date: Wed Sep 10 14:06:23 2025 -0700 platform/x86:intel/pmc: Improve function to show substate header Refactor pmc_core_substate_req_header_show() to accept a new argument. This is a preparation patch to introduce a new way to show Low Power Mode substate requirement data for platforms starting from Panther Lake. Increased the size for the name column as the Low Power Mode requirement register name is longer in newer platforms. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20250910210629.11198-4-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1e508af6bc4b24a7924b619800f1b138281f0e82 Author: Xi Pardee Date: Wed Sep 10 14:06:22 2025 -0700 platform/x86:intel/pmc: Move telemetry endpoint register handling Move telemetry endpoint handling to pmc_core_get_telem_info(). This is a preparation patch to introduce a new table to obtain Low Power Mode substate requirement data for platforms starting from Panther Lake. Signed-off-by: Xi Pardee Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250910210629.11198-3-xi.pardee@linux.intel.com Signed-off-by: Ilpo Järvinen commit feae929d8e6cb4e8d78a930c8b75326229e6b921 Author: Xi Pardee Date: Wed Sep 10 14:06:21 2025 -0700 platform/x86:intel/pmc: Enable SSRAM support for Lunar Lake Enable Lunar Lake platforms to achieve PMC information from Intel PMC SSRAM Telemetry driver and substate requirements data from telemetry region. Signed-off-by: Xi Pardee Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250910210629.11198-2-xi.pardee@linux.intel.com Signed-off-by: Ilpo Järvinen commit 2ab7713d6e9408587731c186b9a5a208f04a6b33 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:40 2025 +0530 platform/x86/amd/pmf: Add debug logs for pending requests and custom BIOS inputs This patch adds debug logging capabilities to monitor early pending requests and their associated custom BIOS inputs during runtime. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-10-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 62214d942d2bebbed1798eef711dd82aa493a616 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:39 2025 +0530 platform/x86/amd/pmf: Call enact function sooner to process early pending requests Call the amd_pmf_invoke_cmd_enact() function to manage early pending requests and their associated custom BIOS inputs. Add a return statement for cases of failure. The PMF driver will adjust power settings according to custom BIOS inputs after assessing the policy conditions. Also, add a new common routine amd_pmf_handle_early_preq() to handle early BIOS pending requests for both v1 and v2 variants. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-9-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b21ec88340b7e9dbaac13d9902f1e8166932c277 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:38 2025 +0530 platform/x86/amd/pmf: Preserve custom BIOS inputs for evaluating the policies The current code fails to send multiple BIOS input data to the PMF-TA for policy condition evaluation. Only the most recent BIOS input data is properly sent to the PMF-TA, while previous inputs are overwritten with the zeros. To address this issue, the BIOS input data should be stored and passed on to the PMF-TA. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-8-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 04199ef48ac2c5f0985a54171da47a218c37b00f Author: Shyam Sundar S K Date: Mon Sep 1 16:31:37 2025 +0530 platform/x86/amd/pmf: Add custom BIOS input support for AMD_CPU_ID_PS The PMF ACPI Specification (APMF) has been revised to version 1.3 to allow for additional custom BIOS inputs, enabling OEMs to have more precise thermal management of the system. This update includes adding support to the driver using the new data structure received from the BIOS through the existing APMF interfaces. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-7-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4389d38080d72a818de2731663d0b5571f66db31 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:36 2025 +0530 platform/x86/amd/pmf: Add helper to verify BIOS input notifications are enable/disable Implement a helper function to check if BIOS input notifications are enabled or disabled. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-6-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 37336ecb06a81e7c4fb3e89dbb04169c0e523069 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:35 2025 +0530 platform/x86/amd/pmf: Update ta_pmf_action structure member The latest PMF TA has been updated with the additional structure members for internal evaluation. Since this same structure is utilized in the driver, it also needs to be updated on the driver side. Otherwise, there will be a mismatch in the byte sizes when copying data from shared memory. Suggested-by: Yijun Shen Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-5-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ebc68a3451ce419fe2e7a7d3f06df408fb36399e Author: Shyam Sundar S K Date: Mon Sep 1 16:31:34 2025 +0530 platform/x86/amd/pmf: Extend custom BIOS inputs for more policies The existing amd_pmf driver is limited to supporting just two custom BIOS inputs. However, with the updates to the latest PMF TA, there's a requirement to broaden this capacity to handle 10 inputs, aligning with the TA firmware's capabilities. The necessary logic should be implemented to facilitate this expansion of functionality. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-4-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d82e3d2dd0ba019ac6cdd81e47bf4c8ac895cfa0 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:33 2025 +0530 platform/x86/amd/pmf: Fix the custom bios input handling mechanism Originally, the 'amd_pmf_get_custom_bios_inputs()' function was written under the assumption that the BIOS would only send a single pending request for the driver to process. However, following OEM enablement, it became clear that multiple pending requests for custom BIOS inputs might be sent at the same time, a scenario that the current code logic does not support when it comes to handling multiple custom BIOS inputs. To address this, the code logic needs to be improved to not only manage multiple simultaneous custom BIOS inputs but also to ensure it is scalable for future additional inputs. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-3-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f10ea2df9e4d28964e2a02abaf32100953885989 Author: Shyam Sundar S K Date: Mon Sep 1 16:31:32 2025 +0530 platform/x86/amd/pmf: Add support for adjusting PMF PPT and PPT APU thresholds The most recent PMF Trusted Application includes enhanced features that allow for modifications to PMF thermal parameters such as PPT and PPT APU. This update introduces the necessary driver support to utilize these capabilities. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Tested-by: Yijun Shen Reviewed-by: Ilpo Järvinen Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20250901110140.2519072-2-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen commit f001225088b8736f55dd28a4616cdf1b1bdcdd2e Author: Alexander Stein Date: Mon Sep 1 12:04:29 2025 +0200 dt-bindings: arm: fsl: add TQMa91xx SOM series TQMa91xx series is using NXP i.MX91 CPU on an LGA or socketable type board. MBa91xxCA is a starterkit base board for TQMa91xx on an adapter board. Reviewed-by: Frank Li Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 0463d9d492dfc896f61fd6319688e02341fea772 Author: Frank Li Date: Wed Aug 27 17:24:45 2025 -0400 dt-bindings: fsl: fsl,imx7ulp-smc1: Allow clocks and clock-names Allow clocks and clock-names to match existed dts file. 'hsrun_divcore' should be 'hsrun-divcore'. But use '_' to keep old dts back compatible. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx7ulp-com.dtb: clock-controller@40410000 (fsl,imx7ulp-smc1): '#clock-cells', 'clock-names', 'clocks' do not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/arm/freescale/fsl,imx7ulp-pm.yaml# Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Signed-off-by: Shawn Guo commit 76e145f857e9dea47002f23965a21ea35caa8bbd Author: Josua Mayer Date: Sat Aug 23 17:28:21 2025 +0300 dt-bindings: arm: fsl: Add bindings for SolidRun i.MX8MP SoM and boards Add bindings for SolidRun i.MX8M Plus System on Module based boards: - CuBox-M is a complete produc with enclosure including the SoM - HummingBoard Mate/Pro/Pulse/Ripple are evaluation boards with common design but different available interfaces. Signed-off-by: Josua Mayer Acked-by: Rob Herring (Arm) Signed-off-by: Shawn Guo commit 1b2e9feb351435299863b5e7ebeb02634381c883 Author: Stefan Kerkmann Date: Wed Sep 10 15:03:32 2025 +0200 wifi: mwifiex: fix endianness handling in mwifiex_send_rgpower_table The length of the host command is a u16 stored in little endian byte order, which needs byte order conversion to work correctly on big endian systems. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aLqZI4FfOI4iJZtf@stanley.mountain Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support") Signed-off-by: Stefan Kerkmann Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20250910-for-next-v1-1-3ee311706231@pengutronix.de Signed-off-by: Johannes Berg commit ecba852dc9f4993f4f894ea1f352564560e19a3e Author: Qianfeng Rong Date: Wed Aug 27 20:39:13 2025 +0800 media: redrat3: use int type to store negative error codes Change "ret" from u8 to int type in redrat3_enable_detector() to store negative error codes or zero returned by redrat3_send_cmd() and usb_submit_urb() - this better aligns with the coding standards and maintains code consistency. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb Author: Larshin Sergey Date: Tue Jul 29 13:13:32 2025 +0300 media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+f1a69784f6efe748c3bf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1a69784f6efe748c3bf Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") Cc: stable@vger.kernel.org Signed-off-by: Larshin Sergey Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 692a4802435ba7389810b15b476ed360675e38c1 Author: Thomas Hellström Date: Wed Sep 10 17:11:28 2025 +0200 drm/xe: Fix uninitialized return values clang warned about two uninitialized variables used as return values in the exhaustive eviction series. Fix those. Fixes: 1f1541720f65 ("drm/xe: Rework instances of variants of xe_bo_create_locked()") Fixes: 7bcb6e38c14d ("drm/xe/display: Convert __xe_pin_fb_vma()") Cc: Matthew Brost Cc: Jani Nikula Signed-off-by: Thomas Hellström Reviewed-by: Jonathan Cavitt Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250910151128.49693-1-thomas.hellstrom@linux.intel.com commit eba165b2909716c690351d21d9b6b6d95b9e1f59 Author: Shravya KN Date: Mon Sep 8 15:15:16 2025 +0530 RDMA/bnxt_re: Avoid GID level QoS update from the driver The driver inserts a VLAN header into RoCE packets when the traffic was untagged by modifying the existing GID entries. This has caused the firmware to enforce only VLAN-based priority mappings, ignoring other valid priority configurations set via APP TLVs (e.g., DSCP selectors). Driver now has support for selecting the service level (vlan id) and traffic class (dscp) during modify_qp. So no need to override the priority update using the update gid method. Hence removing the code that handles the above operation. Signed-off-by: Shravya KN Link: https://patch.msgid.link/20250908094516.18222-3-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Saravanan Vajravel Reviewed-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit 72d0b87e1e7c34ebb89deae75f5306264578b01f Author: Anantha Prabhu Date: Mon Sep 8 15:15:15 2025 +0530 RDMA/bnxt_re: Update sysfs entries with appropriate data Updated the existing sysfs entries with correct data. This change is to align the behavior with our OOB driver. Added "board_id" sysfs entry which will provide the VPD Part number, if exists. Signed-off-by: Anantha Prabhu Signed-off-by: Saravanan Vajravel Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250908094516.18222-2-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 6603fbf158e9a34eb0961579becee377c1efa1ee Author: Abhijit Gangurde Date: Wed Sep 3 11:46:06 2025 +0530 RDMA/ionic: Add Makefile/Kconfig to kernel build environment Add ionic to the kernel build environment. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-15-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit ea4c399642b85dc30f44d90ee805c6a18fa03062 Author: Abhijit Gangurde Date: Wed Sep 3 11:46:05 2025 +0530 RDMA/ionic: Implement device stats ops Implement device stats operations for hw stats and qp stats. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-14-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 2075bbe8ef03914aa2211035eec45d1d3a5c4ff2 Author: Abhijit Gangurde Date: Wed Sep 3 11:46:04 2025 +0530 RDMA/ionic: Register device ops for miscellaneous functionality Implement idbdev ops for device and port information. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-13-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit b83c62055b6faabb444b2f8f3355420927cc39fd Author: Abhijit Gangurde Date: Wed Sep 3 11:46:03 2025 +0530 RDMA/ionic: Register device ops for datapath Implement device supported verb APIs for datapath. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-12-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit e8521822c733c6deab0f339843cd37cd62c12795 Author: Abhijit Gangurde Date: Wed Sep 3 11:46:02 2025 +0530 RDMA/ionic: Register device ops for control path Implement device supported verb APIs for control path. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-11-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit f3bdbd42702c6b10ebe627828c76ef51c68e4355 Author: Abhijit Gangurde Date: Wed Sep 3 11:46:01 2025 +0530 RDMA/ionic: Create device queues to support admin operations Setup RDMA admin queues using device command exposed over auxiliary device and manage these queues using ida. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-10-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 8d765af51a099884bab37a51e211c7047f67f1f3 Author: Abhijit Gangurde Date: Wed Sep 3 11:46:00 2025 +0530 RDMA/ionic: Register auxiliary module for ionic ethernet adapter Register auxiliary module to create ibdevice for ionic ethernet adapter. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-9-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 83597c841ed53807a99a2ee837a8cbc3541ce62a Author: Abhijit Gangurde Date: Wed Sep 3 11:45:59 2025 +0530 RDMA: Add IONIC to rdma_driver_id definition Define RDMA_DRIVER_IONIC in enum rdma_driver_id. Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-8-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 11016c795eec341e8f087e95dea78189b88057a6 Author: Abhijit Gangurde Date: Wed Sep 3 11:45:58 2025 +0530 net: ionic: Provide doorbell and CMB region information The RDMA device needs information of controller memory bar and doorbell capability to share with user context. Discover CMB regions and express doorbell capabilities on device init. Reviewed-by: Shannon Nelson Co-developed-by: Pablo Cascón Signed-off-by: Pablo Cascón Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-7-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 2dc6a6a6782def51879ff3e739f6e9706d6c1c4f Author: Abhijit Gangurde Date: Wed Sep 3 11:45:57 2025 +0530 net: ionic: Provide interrupt allocation support for the RDMA driver RDMA driver needs an interrupt for an event queue. Export function from net driver to allocate an interrupt. Reviewed-by: Shannon Nelson Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-6-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 0e02faffdb80a95fdd8fb8482eecd3f006441c37 Author: Abhijit Gangurde Date: Wed Sep 3 11:45:56 2025 +0530 net: ionic: Provide RDMA reset support for the RDMA driver The Ethernet driver holds the privilege to execute the device commands. Export the function to execute RDMA reset command for use by RDMA driver. Reviewed-by: Shannon Nelson Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-5-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 089bbf4836c6e6480a6eade64b8ac8b2b5b2da04 Author: Abhijit Gangurde Date: Wed Sep 3 11:45:55 2025 +0530 net: ionic: Export the APIs from net driver to support device commands RDMA driver needs to establish admin queues to support admin operations. Export the APIs to send device commands for the RDMA driver. Reviewed-by: Shannon Nelson Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-4-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 85372e4a493e413f1c1ee1850c51ad2d3a637fff Author: Abhijit Gangurde Date: Wed Sep 3 11:45:54 2025 +0530 net: ionic: Update LIF identity with additional RDMA capabilities Firmware sends the RDMA capability in a response for LIF_IDENTIFY device command. Update the LIF indentify with additional RDMA capabilities used by driver and firmware. Reviewed-by: Shannon Nelson Reviewed-by: Simon Horman Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-3-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit ffad4278c2ac31c91b563036121cdcf4d5dd45ec Author: Abhijit Gangurde Date: Wed Sep 3 11:45:53 2025 +0530 net: ionic: Create an auxiliary device for rdma driver To support RDMA capable ethernet device, create an auxiliary device in the ionic Ethernet driver. The RDMA device is modeled as an auxiliary device to the Ethernet device. Reviewed-by: Shannon Nelson Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit f5b6b4639b3d999c507de349221c48af638c06dc Author: Thorsten Blum Date: Mon Sep 1 17:00:39 2025 +0200 RDMA/bnxt_re: Call strscpy() with correct size argument In bnxt_re_register_ib(), strscpy() is called with the length of the source string rather than the size of the destination buffer. This is fine as long as the destination buffer is larger than the source string, but we should still use the destination buffer size instead to call strscpy() as intended. And since 'node_desc' has a fixed size, we can safely omit the size argument and let strscpy() infer it using sizeof(). Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250901150038.227036-2-thorsten.blum@linux.dev Signed-off-by: Leon Romanovsky commit 2ed096dc41536ded233612ac9f308dcdefebd286 Author: Xichao Zhao Date: Wed Aug 27 20:00:07 2025 +0800 RDMA/core: fix "truely"->"truly" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250827120007.489496-1-zhao.xichao@vivo.com Signed-off-by: Leon Romanovsky commit 490a253cb4893043266622f24153026d454abcdb Author: Qianfeng Rong Date: Tue Aug 26 23:05:56 2025 +0800 RDMA/rdmavt: Use int type to store negative error codes Change 'ret' from u32 to int in alloc_qpn() to store -EINVAL, and remove the 'bail' label as it simply returns 'ret'. Storing negative error codes in an u32 causes no runtime issues, but it's ugly as pants, Change 'ret' from u32 to int type - this change has no runtime impact. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250826150556.541440-1-rongqianfeng@vivo.com Signed-off-by: Leon Romanovsky commit 372fdb5c75b61f038f4abf596abdcf01acbdb7af Author: Edward Srouji Date: Sun Aug 24 17:48:39 2025 +0300 RDMA/mlx5: Fix page size bitmap calculation for KSM mode When using KSM (Key Scatter-gather Memory) access mode, the HW requires the IOVA to be aligned to the selected page size. Without this alignment, the HW may not function correctly. Currently, mlx5_umem_mkc_find_best_pgsz() does not filter out page sizes that would result in misaligned IOVAs for KSM mode. This can lead to selecting page sizes that are incompatible with the given IOVA. Fix this by filtering the page size bitmap when in KSM mode, keeping only page sizes to which the IOVA is aligned to. Fixes: fcfb03597b7d ("RDMA/mlx5: Align mkc page size capability check to PRM") Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20250824144839.154717-1-edwards@nvidia.com Reviewed-by: Michael Guralnik Signed-off-by: Leon Romanovsky commit aae757ec20d23c3c9251227eb5c8ca623afad007 Author: Kalesh AP Date: Fri Aug 22 09:38:01 2025 +0530 RDMA/bnxt_re: Remove unnecessary condition checks The check for "rdev" and "en_dev" pointer validity always return false. Remove them. Reviewed-by: Saravanan Vajravel Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-11-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 6133c13154effc0a4c8f637ce750822f7d05a267 Author: Saravanan Vajravel Date: Fri Aug 22 09:38:00 2025 +0530 RDMA/bnxt_re: Use firmware provided message timeout value Before this patch, we used a hardcoded value of 500 msec as the default value for L2 firmware message response timeout. With this commit, the driver is using the firmware timeout value from the firmware. As part of this change moved bnxt_re_query_hwrm_intf_version() to bnxt_re_setup_chip_ctx() so that timeout value is queries before sending first command. Signed-off-by: Saravanan Vajravel Reviewed-by: Selvin Xavier Reviewed-by: Kashyap Desai Reviewed-by: Bhargava Chenna Marreddy Co-developed-by: Kalesh AP Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-10-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 959d10d642c7e4527edccf01f7b5970a6d838b84 Author: Saravanan Vajravel Date: Fri Aug 22 09:37:59 2025 +0530 RDMA/bnxt_re: Initialize fw with roce_mirror support - Check FW capability for roce_mirror support. - Initialize FW with roce_mirror support. - When modifying QP, use unique GID for sgid incase of RawEth QP. Signed-off-by: Saravanan Vajravel Reviewed-by: Kashyap Desai Reviewed-by: Selvin Xavier Reviewed-by: Anantha Prabhu Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-9-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 7c7511f16512832486518fca3e61b5f5d45e329b Author: Saravanan Vajravel Date: Fri Aug 22 09:37:58 2025 +0530 RDMA/bnxt_re: Add support for flow create/destroy - Added support for create_flow and destroy_flow verbs. These verbs are used on RawEth QP to add a specific flow action. - To support TCP dump on RoCE, added IB_FLOW_ATTR_SNIFFER attribute. - In create_flow verb, driver allocates mirror_vnic and configure it with RawEth QP. Once this is done, driver will enable mirroring. - In destroy_flow, driver will disable mirroring and free the mirror vnic. Signed-off-by: Saravanan Vajravel Reviewed-by: Kashyap Desai Reviewed-by: Selvin Xavier Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-8-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit fd6c9ae7c182344612fc3709ebd837cba6007b83 Author: Saravanan Vajravel Date: Fri Aug 22 09:37:57 2025 +0530 RDMA/bnxt_re: Add support for mirror vnic Added below support: - Querying the pre-reserved mirror_vnic_id - Allocating/freeing mirror_vnic - Configuring mirror vnic to associate it with raw qp These functions will be used in the subsequent patch in this series. Signed-off-by: Saravanan Vajravel Reviewed-by: Kashyap Desai Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-7-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit af7f9d0d5745fb4831c71d981a93f44f8fd3f10d Author: Saravanan Vajravel Date: Fri Aug 22 09:37:56 2025 +0530 RDMA/bnxt_re: Add support for unique GID - RawEth QP requires unique GID so that per function stats_ctx is not polluted by packets mirrored to RoCE vnic. - Added support to add unique GID when RawEth type QP is created. - Added support to destroy unique GID when RawEth type QP is destroyed. - Allocated exclusive stats_ctx to use for RawEth type QP. Signed-off-by: Saravanan Vajravel Reviewed-by: Kashyap Desai Reviewed-by: Selvin Xavier Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-6-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit b5942828ea5f8ba5fcdde71b1ac5473bdb5004e2 Author: Kalesh AP Date: Fri Aug 22 09:37:55 2025 +0530 RDMA/bnxt_re: Refactor stats context memory allocation Moved the stats context allocation logic to a new function. The stats context memory allocation code has been moved from bnxt_qplib_alloc_hwctx() to the newly added bnxt_re_get_stats_ctx() function. Also, the code to send the firmware command has been moved. This patch is in preparation for other patches in this series. There is no functional changes intended. Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-5-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 2419b16a3db539ce5c506a60ee4b85723ce78bd5 Author: Kalesh AP Date: Fri Aug 22 09:37:54 2025 +0530 RDMA/bnxt_re: Refactor hw context memory allocation This patch is in preparation for other patches in this series. There is no functional changes intended. 1. Rename bnxt_qplib_alloc_ctx() to bnxt_qplib_alloc_hwctx(). 2. Rename bnxt_qplib_free_ctx() to bnxt_qplib_free_hwctx(). 3. Reduce the number of arguments of bnxt_qplib_alloc_hwctx() by moving a check outside of it. Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-4-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 8f47f12db518af43bc24f7fd14e4fc84aeb043b6 Author: Saravanan Vajravel Date: Fri Aug 22 09:37:53 2025 +0530 RDMA/bnxt_re: Add data structures for RoCE mirror support Added data structures required for supporting mirroring on RoCE device. Signed-off-by: Saravanan Vajravel Reviewed-by: Selvin Xavier Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 217156bb70afb8e4c9263f7f892bb171ce4b463d Author: Saravanan Vajravel Date: Fri Aug 22 09:37:52 2025 +0530 bnxt_en: Enhance stats context reservation logic When the firmware advertises that the device is capable of supporting port mirroring on RoCE device, reserve one additional stat_ctx. To support port mirroring feature, RDMA driver allocates one stat_ctx for exclusive use in RawEth QP. Signed-off-by: Saravanan Vajravel Reviewed-by: Somnath Kotur Reviewed-by: Kashyap Desai Reviewed-by: Selvin Xavier Reviewed-by: Michael Chan Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250822040801.776196-2-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Jacob Keller Acked-by: Jakub Kicinski Signed-off-by: Leon Romanovsky commit c0da8dc534218b8371c778b184453e8dd5246189 Author: Kalesh AP Date: Thu Aug 14 16:55:55 2025 +0530 RDMA/bnxt_re: Enhance a log message when bnxt_re_register_netdev fails Make a error log message more user friendly. When bnxt_re_register_netdev()() fails, the current log does not convey much information. Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250814112555.221665-10-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Saravanan Vajravel Reviewed-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit bdb978979ed133c47e19099ff2a4ae51e515452b Author: Michael Riesch Date: Wed Sep 3 19:04:54 2025 +0200 phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3588 variant The Rockchip RK3588 MIPI CSI-2 DPHY can be supported using the existing phy-rockchip-inno-csidphy driver, the notable differences being - the control bits in the GRF - the additional reset line Add support for this variant. Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-6-a4f340a7f0cf@collabora.com Signed-off-by: Vinod Koul commit b98775bca99511cc22ab459a2de646cd2fa7241f Author: Shuicheng Lin Date: Tue Aug 19 15:39:51 2025 +0000 drm/xe/tile: Release kobject for the failure path Call kobject_put() for the failure path to release the kobject v2: remove extra newline. (Matt) Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure") Cc: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi commit 40ded2d12b5d999866c2bc4122683355bb17c831 Author: Jan Remmet Date: Wed Sep 10 08:17:39 2025 +0200 arm64: dts: imx8mm-phycore-som: optimize drive strengh Reduce ENET pin drive strength from X6 to X4 to optimize signal quality and reduce potential signal integrity issues. Signed-off-by: Jan Remmet Reviewed-by: Teresa Remmet Signed-off-by: Shawn Guo commit e0c1a76b8d5f765e6555d89964d0189156339075 Author: Primoz Fiser Date: Mon Sep 8 13:17:05 2025 +0200 arm64: dts: freescale: imx93-phycore-som: Remove "fsl,magic-packet" FEC WoL (Wake-on-Lan) functionality depends on using Ethernet PHY in IRQ mode. However, on phyCORE-i.MX93 SoM, polling mode is used instead for the FEC Ethernet PHY. Consequently, WoL is non-functional. Thus disable it by removing "fsl,magic-packet" property. This allows us to save some power during device suspend as PHY is not kept awake. Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit c56b0b3c2465aeef72348272d7bec786c27619ad Author: Fabio Estevam Date: Mon Sep 8 13:44:31 2025 -0300 ARM: dts: imx6sll: Use 'dma-names' 'dma-name' is not a valid property and causes the following dt-schema warning: dma-name: b'rx\x00tx\x00' is not of type 'object', 'integer', 'array', 'boolean', 'null' Fix it by using 'dma-names' instead. Signed-off-by: Fabio Estevam Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 463714763fd1887a6538470132ba51a1a04e8ec2 Author: Primoz Fiser Date: Fri Sep 5 08:55:03 2025 +0200 arm64: dts: freescale: imx93-phyboard-nash: Current sense via iio-hwmon Commit 21179eae56de ("arm64: dts: freescale: imx93-phyboard-nash: Add current sense amplifier") added information about the current sensing circuitry found on the board. Now, lets provide current sense reading also via IIO-hwmon subsystem. This way, SoM current can be read directly via sysfs property more conveniently for the customers. No need for them to manually apply scaling factor calculations anymore. Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit cf0713875422df28f9e76b4410fede952ebad898 Author: Wei Fang Date: Thu Sep 4 10:00:49 2025 +0800 arm64: dts: imx95: add standard PCI device compatible string to NETC Timer PCI devices should have a compatible string based on the vendor and device IDs. So add this compatible string to NETC Timer. Signed-off-by: Wei Fang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 419f47b88d72ba8e197707af4f41976f6508c16c Author: Frank Li Date: Wed Sep 3 16:20:09 2025 -0400 ARM: dts: imx6: change rtc compatible string to st,m41t00 from m41t00 m41t00 compatible is not existing. Change it to st,m41t00 to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-ts7970.dtb: /soc/bus@2100000/i2c@21a0000/rtc@68: failed to match any schema with compatible: ['m41t00'] Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 25d1ef1cfbd230d782b15189963cfcc3286ece16 Author: Frank Li Date: Wed Sep 3 16:20:08 2025 -0400 ARM: dts: imx6: remove undefined linux,default-trigger source Set gpio/off to none for linux,default-trigger. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-phytec-mira-rdk-nand.dtb: user-leds (gpio-leds): user-led1:linux,default-trigger: 'oneOf' conditional failed, one must be fixed: 'gpio' is not one of ['backlight', 'default-on', 'heartbeat', 'disk-activity', 'disk-read', 'disk-write', 'timer', 'pattern', 'audio-micmute', 'audio-mute', 'bluetooth-power', 'flash', 'kbd-capslock', 'mtd', 'nand-disk', 'netdev', 'none', 'rc-feedback', 'torch', 'usb-gadget', 'usb-host', 'usbport'] Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit a863c9bffd00edd96610067377a648ce4eb30242 Author: Frank Li Date: Wed Sep 3 16:20:07 2025 -0400 ARM: dts: imx6ul-pico: add power-supply for vxt,vl050-8048nt-c01 Add power-supply for vxt,vl050-8048nt-c01 to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6ul-pico-dwarf.dtb: panel (vxt,vl050-8048nt-c01): 'power-supply' is a required property Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit ce2e4c237ddd75b689fb6a6e5fa39d514199a0e8 Author: Frank Li Date: Wed Sep 3 16:20:06 2025 -0400 ARM: dts: imx6ul-14x14-evk: add regulator for ov5640 Add required power supply for ov5640. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6ul-14x14-evk.dtb: camera@3c (ovti,ov5640): 'AVDD-supply' is a required property from schema $id: http://devicetree.org/schemas/media/i2c/ovti,ov5640.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 2039db627d348d7263ed7d507e502faf3a088525 Author: Frank Li Date: Wed Sep 3 16:20:05 2025 -0400 ARM: dts: imx6: replace isl,isl12022 with isil,isl12022 for RTC The compatible string isl,isl12022 is typo, it should be isil,isl12022. Fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/imx/imx6dl-ts7970.dtb: /soc/bus@2100000/i2c@21a0000/rtc@6f: failed to match any schema with compatible: ['isl,isl12022'] Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 91c6d75db0c0fbadc70e0b423508440dcef00e6e Author: Frank Li Date: Wed Sep 3 16:20:04 2025 -0400 ARM: dts: imx6: replace gpio-key with gpio-keys compatible string Compatible string 'gpio-key' is not existed. Correct it to 'gpio-keys'. Fix below CHECK_DTBS warnings arch/arm/boot/dts/nxp/imx/imx6ul-phytec-segin-ff-rdk-emmc.dtb: /gpio-keys: failed to match any schema with compatible: ['gpio-key'] Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 688dc0342532464239de99197583ccc9f9d3c64c Author: Frank Li Date: Wed Sep 3 16:20:03 2025 -0400 ARM: dts: imx6: rename i2cmux i2c-mux- Rename i2cmux i2c-mux- to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6q-nitrogen6_max.dtb: i2c2mux (i2c-mux-gpio): $nodename:0: 'i2c2mux' does not match '^(i2c-?)?mux' from schema $id: http://devicetree.org/schemas/i2c/i2c-mux-gpio.yaml Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 9538e88f185fbc037e54827dbec1ea3edbc0c325 Author: Frank Li Date: Wed Sep 3 16:20:02 2025 -0400 ARM: dts: imx6: rename node name flash to eeprom Rename node name flash to eeprom to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6q-b450v3.dtb: flash@0 (atmel,at25): $nodename: 'anyOf' conditional failed, one must be fixed: 'flash@0' does not match '^eeprom@[0-9a-f]{1,2}$' 'flash@0' does not match '^fram@[0-9a-f]{1,2}$' Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 68979d311a55a68c88203e21c5720203cc4111bc Author: Frank Li Date: Wed Sep 3 16:20:01 2025 -0400 ARM: dts: imx6: rename node i2c-gpio to i2c. Rename node name i2c-gpio to i2c to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6ul-tx6ul-0010.dtb: / (karo,imx6ul-tx6ul): i2c-gpio: {'compatible': ['i2c-gpio'], '#address-cells': 1, '#size-cells': 0, 'pinctrl-names': ['default'], 'pinctrl-0': [[68]], 'sda-gpios': [[46, 1, 0]], 'scl-gpios': [[46, 0, 0]], 'clock-frequency': 400000, 'status': ['okay'], 'rtc@68': {'compatible': ['dallas,ds1339'], 'reg': [[104]], 'status': ['disabled']}} is not of type 'array' from schema $id: http://devicetree.org/schemas/gpio/gpio-consumer.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 5058aa3d4d60e3033e6e3d628ea98066f3900e32 Author: Frank Li Date: Wed Sep 3 16:20:00 2025 -0400 ARM: dts: imx6: rename touch screen's node name to touchscreen Rename touch to touchscreen. Rename stmpe_touchscreen to touchscreen. Rename stmpe_adc to adc. Fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/imx/imx7d-nitrogen7.dtb: touch@48 (ti,tsc2004): 'wakeup-gpios' does not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/input/touchscreen/ti,tsc2005.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit f0b73936217487c36e4c2188db6aae457142393b Author: Frank Li Date: Wed Sep 3 16:19:59 2025 -0400 ARM: dts: imx6: remove redundant pinctrl-names Remove redundant pinctrl-name because no pinctrl-0 existed to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-hummingboard.dtb: pwm@2084000 (fsl,imx6q-pwm): 'pinctrl-0' is a dependency of 'pinctrl-names' from schema $id: http://devicetree.org/schemas/pinctrl/pinctrl-consumer.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit e2de44e6f245e03c417e5f5527a79f90be203be2 Author: Frank Li Date: Wed Sep 3 16:19:58 2025 -0400 ARM: dts: imx6qdl-aristainetos2: rename ethernet-phy to ethernet-phy@0 Rename ethernet-phy to ethernet-phy@0 to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/imx/imx6dl-aristainetos2_4.dtb: ethernet@2188000 (fsl,imx6q-fec): mdio: Unevaluated properties are not allowed ('ethernet-phy' was unexpected) Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 220ee5c4c89c6964358ab889e2e4a298f1049a57 Author: Frank Li Date: Wed Sep 3 16:19:57 2025 -0400 ARM: dts: imx6: add interrupt-cells for dlg,da9063 pmic Add interrupt-cells for pmic to fix below CHECK_DTBS warnings: arm/boot/dts/nxp/imx/imx6dl-emcon-avari.dtb: pmic@58 (dlg,da9063): 'interrupt-controller' is a required property from schema $id: http://devicetree.org/schemas/mfd/dlg,da9063.yaml Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 5a5d4c5cc54ddb89c93c4ba612a2d7be943b1471 Author: Frank Li Date: Wed Sep 3 16:19:56 2025 -0400 ARM: dts: imx6: align rtc chip node name to 'rtc' Rename node name ds1672 to rtc to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/imx/imx6dl-gw51xx.dtb: ds1672@68 (dallas,ds1672): $nodename:0: 'ds1672@68' does not match '^rtc(@.*|-([0-9]|[1-9][0-9]+))?$ Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 965661c7c52e36aa497fcdadc3ed478e19222f85 Author: Frank Li Date: Wed Sep 3 16:19:55 2025 -0400 ARM: dts: imx6: add key- prefix for gpio-keys Add key- prefix for gpio-keys and rename button_0 to button-0 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/imx/imx6q-gw51xx.dtb: gpio-keys (gpio-keys): 'eeprom-wp', ... do not match any of the regexes: '^(button|...))$', 'pinctrl-[0-9]+ Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 53f9271ed0de355a32e4d7a08b357d43e8222e08 Author: Frank Li Date: Wed Sep 3 16:19:54 2025 -0400 ARM: dts: imx6: add #address-cells for gsc@20 Add #address-cells for gsc20 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/imx/imx6dl-gw51xx.dtb: gsc@20 (gw,gsc): '#address-cells' is a required property Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit e71db39f0c7c0157177be12de7ae2d2495184da1 Author: Alexander Stein Date: Mon Sep 1 12:04:30 2025 +0200 arm64: dts: freescale: add initial device tree for TQMa91xx/MBa91xxCA This adds support for TQMa91xx module attached to MBa91xxCA board. TQMa91xx is a SOM series using i.MX91 SOC. The SOM features PMIC, RAM, e-MMC and some optional peripherals like SPI-NOR, RTC, EEPROM, gyroscope and secure element. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 0f75caf42baa7cb207573b8d82eedbbce8d4016b Author: Joy Zou Date: Mon Sep 1 18:36:31 2025 +0800 arm64: dts: imx93-11x11-evk: remove fec property eee-broken-1000t The 'eee-broken-1000t' flag disables Energy-Efficient Ethernet (EEE) on 1G links as a workaround for PTP sync issues on older i.MX6 platforms. Remove it since the i.MX93 have not such issue. Reviewed-by: Frank Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit 6772c4cffd87f44ea4ea46d159e9feaeb418c3d0 Author: Joy Zou Date: Mon Sep 1 18:36:30 2025 +0800 arm64: dts: freescale: add i.MX91 11x11 EVK basic support Add i.MX91 11x11 EVK board support. - Enable ADC1. - Enable lpuart1 and lpuart5. - Enable network eqos and fec. - Enable I2C bus and children nodes under I2C bus. - Enable USB and related nodes. - Enable uSDHC1 and uSDHC2. - Enable Watchdog3. Reviewed-by: Frank Li Signed-off-by: Pengfei Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit b0830e7e8c8cf5e7a8d143f90d58f58eb8beed32 Author: Joy Zou Date: Mon Sep 1 18:36:29 2025 +0800 arm64: dts: imx91: add i.MX91 dtsi support The i.MX 91 family features an Arm Cortex-A55 running at up to 1.4GHz, support for modern LPDDR4 memory to enable platform longevity, along with a rich set of peripherals targeting medical, industrial and consumer IoT market segments. The mainly difference between i.MX91 and i.MX93 is as follows: - i.MX91 removed some clocks and modified the names of some clocks. - i.MX91 only has one A core. - i.MX91 has different pinmux. Tested-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit 80ae41949f641b79c47a1b513a58ba9a3d65ab39 Author: Joy Zou Date: Mon Sep 1 18:36:28 2025 +0800 arm64: dts: freescale: rename imx93.dtsi to imx91_93_common.dtsi and modify them The design of i.MX91 platform is very similar to i.MX93 and only some small differences. If the imx91.dtsi include the imx93.dtsi, each add to imx93.dtsi requires an remove in imx91.dtsi for this unique to i.MX93, e.g. NPU. The i.MX91 isn't the i.MX93 subset, if the imx93.dtsi include the imx91.dtsi, the same problem will occur. Common + delta is better than common - delta, so add imx91_93_common.dtsi for i.MX91 and i.MX93, then the imx93.dtsi and imx91.dtsi will include the imx91_93_common.dtsi. Rename imx93.dtsi to imx91_93_common.dtsi and move i.MX93 specific part from imx91_93_common.dtsi to imx93.dtsi. Reviewed-by: Frank Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit 9e7b91e00c190c0fcc7960ba40b134468b5d1bb9 Author: Joy Zou Date: Mon Sep 1 18:36:27 2025 +0800 arm64: dts: freescale: move aliases from imx93.dtsi to board dts The aliases is board level property rather than soc property, so move these to each boards. Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit 8fc7141826470cf92553f71dc7d0a3e262fad67a Author: Josua Mayer Date: Mon Aug 25 20:00:56 2025 +0200 arm64: dts: lx2160a-clearfog-itx: enable pcie nodes for x4 and x8 slots SolidRun Clearfog CX and Honeycomb have LX2160A PEX3 and PEX5 exposed on physical connectors. Vendor U-Boot used to patch status properties such that it went undiscovered these nodes have their status set disabled. Set status okay for pcie3 and pcie5 nodes. Signed-off-by: Josua Mayer Signed-off-by: Shawn Guo commit 1335b32ba1f6a7b145410746caf5b48dcc17c85c Author: Josua Mayer Date: Mon Aug 25 20:00:55 2025 +0200 arm64: dts: lx2160a-cex7: add interrupts for rtc and ethernet phy SolidRun LX2160A CEX-7 module has interrupts wired for both the rtc and ethernet phy. Add description for those interrupts to the rtc and phy nodes. Signed-off-by: Josua Mayer Signed-off-by: Shawn Guo commit a009c0c66ecb451200639c3ec13d806ab03795ed Author: Josua Mayer Date: Sat Aug 23 17:28:22 2025 +0300 arm64: dts: add description for solidrun imx8mp som and cubox-m Add description for the SolidRun i.MX8M Plus based System on Module, and the CuBox-M. The SoM features: - 2x 1Gbps Ethernet with PHY - eMMC - 1/2/3/8GB DDR - MIPI-CSI Camera Connector (not described without specific camera) The CuBox-M is a complete product with enclosure featuring: - 1x 1Gbps RJ45 Ethernet Port - 2x USB-3.0 Type A - HDMI connector - microSD connector - microUSB connector for console (using fdtdi chip) - IR receiver - RTC with backup battery Signed-off-by: Josua Mayer Signed-off-by: Shawn Guo commit 7a35e48fe0ec34f88a28490bb5e4d9308dec2adf Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:19 2025 +0200 arm64: dts: imx8: Use GIC_SPI for interrupt-map for readability Decoding interrupt-map is tricky, because it consists of five components. Use known GIC_SPI define in final interrupt specifier component makes easier to read. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 712a83e213ae09b6d417be81c097908c54f636cc Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:18 2025 +0200 arm64: dts: imx8qxp: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8-ss-hsio.dtsi:71.3-74.28: Warning (interrupt_map): /bus@5f000000/pcie@5f010000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@51a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 9429445d48d59af5d3c56b5427ef1a85b4f9d291 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:17 2025 +0200 arm64: dts: imx8qm: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8qm-ss-hsio.dtsi:83.3-86.28: Warning (interrupt_map): /bus@5f000000/pcie@5f010000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@51a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 32b387ceffa7ca9c14aa6064a8b3788d17b6ae17 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:16 2025 +0200 arm64: dts: imx8mq: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8mq.dtsi:1746.4-1749.43: Warning (interrupt_map): /soc@0/pcie@33800000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@38800000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit faf183a02ed6beea3d0bc5162740294497aa5e80 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:15 2025 +0200 arm64: dts: imx8mp: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8mp.dtsi:2184.4-2187.29: Warning (interrupt_map): /soc@0/pcie@33800000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@38800000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 78d9275da9e26f3f1b3482dbe6069b5bbcd717c8 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:14 2025 +0200 arm64: dts: imx8mm: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8mm.dtsi:1355.4-1358.29: Warning (interrupt_map): /soc@0/pcie@33800000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@38800000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit e4ea1f9d4c9414b532ab541df37cdeac14ee5568 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:13 2025 +0200 arm64: dts: imx8dxl: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: imx8dxl-ss-hsio.dtsi:45.3-48.27: Warning (interrupt_map): /bus@5f000000/pcie@5f010000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@51a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 46961265bdfb9c237cb03ea6b640b8e7588a982a Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:12 2025 +0200 arm64: dts: fsl-ls1046a: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: fsl-ls1046a.dtsi:334.5-346.26: Warning (interrupt_map): /soc/scfg@1570000/interrupt-controller@1ac:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@1400000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 43156dff1596940c381c369ea51a45bbfaba430e Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:11 2025 +0200 arm64: dts: fsl-ls1043a: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: fsl-ls1043a.dtsi:330.5-342.26: Warning (interrupt_map): /soc/scfg@1570000/interrupt-controller@1ac:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@1400000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit da3c9dc9b439ff539a30752811610104512d20ea Author: Krzysztof Kozlowski Date: Fri Aug 22 15:31:10 2025 +0200 arm64: dts: fsl-ls1012a: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: fsl-ls1012a.dtsi:548.4-551.32: Warning (interrupt_map): /soc/pcie@3400000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@1400000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit cc5717bb35c1c1eb5e8f2db37f938c329b8e530a Author: Maud Spierings Date: Fri Aug 22 11:20:06 2025 +0200 arm64: dts: freescale: imx8mp-moduline-display-106: Use phys to replace xceiver-supply Fix the can tranceivers to actually use the new phy description instead of the regulator tweak. Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 95e882c021c8b45c9e7287aceb5637953e1414f8 Author: Richard Hu Date: Fri Aug 22 15:33:09 2025 +0800 arm64: dts: imx8mp: Add TechNexion EDM-G-IMX8M-PLUS SOM on WB-EDM-G carrier board Add support for TechNexion EDM-G-IMX8M-PLUS SOM and WB-EDM-G carrier board. Key interfaces include: - Gigabit Ethernet - USB 3.0 - I2S, UART, SPI, I2C, PWM, GPIO Signed-off-by: Richard Hu Signed-off-by: Ray Chang Signed-off-by: Shawn Guo commit c83b3e212da69b49e1e4a8f9f45162990b941b9e Author: Marco Felsch Date: Thu Aug 21 18:01:37 2025 +0200 arm64: dts: imx8mp: add interconnect for lcdif-hdmi Add the missing interconnect for the lcdif-hdmi. Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit bbe4b2f7d65336073c3ba980a2e4ea971ef7da6c Author: Frank Li Date: Thu Jul 10 15:13:55 2025 -0400 arm64: dts: imx95: Add msi-map for pci-ep device Add msi-map for pci-ep device. Acked-by: Manivannan Sadhasivam Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 8647d8a7709d7619cb26467957b846989c4459d0 Author: Laurent Pinchart Date: Mon Jun 16 04:11:15 2025 +0300 arm64: dts: imx8mp: Add pclk clock and second power domain for the ISP The ISP HDR stitching registers are clocked by the pixel clock, which is gated by the MIPI_CSI2 power domain. Attempting to access those registers with the clock off locks up the system. Fix this by adding the pclk clock and the MIPI_CSI2 secondary power domain. Signed-off-by: Laurent Pinchart Signed-off-by: Shawn Guo commit a22a9e1271fb505f2c85d526d05aad5dde2f50e1 Author: Bence Csókás Date: Mon Aug 25 14:52:09 2025 +0200 ARM: dts: imx6ul-tx6ul: Switch away from deprecated `phy-reset-gpios` The Ethernet PHY's reset GPIO should be specified in the node of the PHY itself, instead of the MAC (`fec`). The latter is deprecated, and was an i.MX-specific extension, incompatible with the new reset controller subsystem. Co-developed-by: Csaba Buday Signed-off-by: Csaba Buday Signed-off-by: Bence Csókás Signed-off-by: Shawn Guo commit 1f24a240974589ce42f70502ccb3ff3f5189d69a Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 19:46:09 2025 +0200 doc: mptcp: fix Netlink specs link The Netlink specs RST files are no longer generated inside the source tree. In other words, the path to mptcp_pm.rst has changed, and needs to be updated to the new location. Fixes: 1ce4da3dd99e ("docs: use parser_yaml extension to handle Netlink specs") Reported-by: Kory Maincent Closes: https://lore.kernel.org/20250828185037.07873d04@kmaincent-XPS-13-7390 Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250909-net-next-mptcp-pm-link-v1-1-0f1c4b8439c6@kernel.org Signed-off-by: Jakub Kicinski commit 8523931a20b780af752327d248c83ec8896f306b Author: Alexander Stein Date: Fri Aug 22 15:49:54 2025 +0200 ARM: dts: mba6ul: Add MicIn routing MicIn is connected to IN3_L. Add routing including the Mic Bias. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 15c068cb214d74a2faca9293b25f454242d0d65e Author: Jakub Kicinski Date: Tue Sep 9 15:38:37 2025 -0700 selftests: net: replace sleeps in fcnal-test with waits fcnal-test.sh already includes lib.sh, use relevant helpers instead of sleeping. Replace sleep after starting nettest as a server with wait_local_port_listen. Reviewed-by: David Ahern Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8b3ce9541129c93958271cc6f6963742f1db0fe7 Author: Alexander Stein Date: Tue Aug 26 16:13:56 2025 +0200 arm64: defconfig: Enable Marvell WiFi-Ex USB driver MBa91xxCA (imx93-tqma9352-mba91xxca.dts) features a soldered, non-pluggable USB attached WiFi module. lsusb says: ID 1286:204e Marvell Semiconductor, Inc. Bluetooth and Wireless LAN Composite Device Enable the corresponding driver. To: Shawn Guo To: Fabio Estevam To: Sascha Hauer Cc: imx@lists.linux.dev Cc: Pengutronix Kernel Team Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 1419c28eb246e181e7b917b1b0b65282201dfc34 Author: Fabio Estevam Date: Fri Aug 22 09:02:41 2025 -0300 dt-bindings: soc: fsl,imx-iomuxc-gpr: Document i.MX53 imx53.dtsi has the following compatible entry: compatible = "fsl,imx53-iomuxc-gpr", "syscon"; Document the "fsl,imx53-iomuxc-gpr" entry to fix the following dt-schema warning: failed to match any schema with compatible: ['fsl,imx53-iomuxc-gpr', 'syscon'] Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 4be708d0c4b10b8f74b2e6bb440d49915ddc4403 Merge: 724b22d38a8339 f6259ba70e7e05 Author: Jakub Kicinski Date: Wed Sep 10 18:09:01 2025 -0700 Merge branch 'tools-ynl-fix-errors-reported-by-ruff' Matthieu Baerts says: ==================== tools: ynl: fix errors reported by Ruff When looking at the YNL code to add a new feature, my text editor automatically executed 'ruff check', and found out at least one interesting error: one variable was used while not being defined. I then decided to fix this error, and all the other ones reported by Ruff. After this series, 'ruff check' reports no more errors with version 0.12.12. ==================== Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-0-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit f6259ba70e7e056ae626b393c908500a5d6e8755 Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:54 2025 +0200 tools: ynl: check for membership with 'not in' It is better to use 'not in' instead of 'not {element} in {collection}' according to Ruff. This is linked to Ruff error E713 [1]: Testing membership with {element} not in {collection} is more readable. Link: https://docs.astral.sh/ruff/rules/not-in-test/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-8-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 10d32b0ddcc142749f6759c0b052a3780903b4df Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:53 2025 +0200 tools: ynl: use 'cond is None' It is better to use the 'is' keyword instead of comparing to None according to Ruff. This is linked to Ruff error E711 [1]: According to PEP 8, "Comparisons to singletons like None should always be done with is or is not, never the equality operators." Link: https://docs.astral.sh/ruff/rules/none-comparison/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-7-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 616129d6b421e3603a1c66bf494b6a95f0128602 Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:52 2025 +0200 tools: ynl: remove unnecessary semicolons These semicolons are not required according to Ruff. Simply remove them. This is linked to Ruff error E703 [1]: A trailing semicolon is unnecessary and should be removed. Link: https://docs.astral.sh/ruff/rules/useless-semicolon/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-6-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 389712b0da1f0af9ef28b3d8f9b18e41f92ade28 Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:51 2025 +0200 tools: ynl: remove unused imports These imports are not used according to Ruff, and can be safely removed. This is linked to Ruff error F401 [1]: Unused imports add a performance overhead at runtime, and risk creating import cycles. They also increase the cognitive load of reading the code. There is one exception with 'YnlDocGenerator' which is added in __all__: it is used by ynl_gen_rst.py. Link: https://docs.astral.sh/ruff/rules/unused-import/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-5-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit d8e0e25406a1208a836b476418c7a85903d047ac Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:50 2025 +0200 tools: ynl: remove f-string without any placeholders 'f-strings' without any placeholders don't need to be marked as such according to Ruff. This 'f' can be safely removed. This is linked to Ruff error F541 [1]: f-strings are a convenient way to format strings, but they are not necessary if there are no placeholder expressions to format. In this case, a regular string should be used instead, as an f-string without placeholders can be confusing for readers, who may expect such a placeholder to be present. Link: https://docs.astral.sh/ruff/rules/f-string-missing-placeholders/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-4-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 02962ddb3936f91780c2e05662e4b20c7b35a2df Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:49 2025 +0200 tools: ynl: remove assigned but never used variable These variables are assigned but never used according to Ruff. They can then be safely removed. This is linked to Ruff error F841 [1]: A variable that is defined but not used is likely a mistake, and should be removed to avoid confusion. Link: https://docs.astral.sh/ruff/rules/unused-variable/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-3-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 287bc89bb41fdb4c9433cbd9bedc240d53ce50ac Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:48 2025 +0200 tools: ynl: avoid bare except This 'except' was used without specifying the exception class according to Ruff. Here, only the ValueError class is expected and handled. This is linked to Ruff error E722 [1]: A bare except catches BaseException which includes KeyboardInterrupt, SystemExit, Exception, and others. Catching BaseException can make it hard to interrupt the program (e.g., with Ctrl-C) and can disguise other problems. Link: https://docs.astral.sh/ruff/rules/bare-except/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-2-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 Author: Matthieu Baerts (NGI0) Date: Tue Sep 9 23:07:47 2025 +0200 tools: ynl: fix undefined variable name This variable used in the error path was not defined according to Ruff. msg_format.attr_set is used instead, presumably the one that was supposed to be used originally. This is linked to Ruff error F821 [1]: An undefined name is likely to raise NameError at runtime. Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl") Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Donald Hunter Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org Signed-off-by: Jakub Kicinski commit 724b22d38a8339dfe5b9f9551ed7ba12c0a66fe1 Author: Russell King (Oracle) Date: Tue Sep 9 16:54:15 2025 +0100 net: stmmac: dwc-qos: use PHY WoL Mark Tegra platforms to use PHY's wake-on-Lan capabilities rather than the stmmac wake-on-Lan. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uw0ff-00000004IQJ-3AMp@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5e38d940a36c419622286251dd0efa96956d0ed5 Author: Ray Chang Date: Fri Aug 22 15:33:08 2025 +0800 dt-bindings: arm: fsl: Add EDM-G-IMX8M-PLUS SOM and WB-EDM-G carrier board Add support for TechNexion EDM-G-IMX8M-PLUS SOM and WB-EDM-G carrier board. Signed-off-by: Ray Chang Signed-off-by: Richard Hu Acked-by: Rob Herring (Arm) Signed-off-by: Shawn Guo commit 9c02ea544ac35a9def5827d30594406947ccd81a Author: Niklas Söderlund Date: Tue Sep 9 10:58:49 2025 +0200 net: sh_eth: Disable WoL if system can not suspend The MAC can't facilitate WoL if the system can't go to sleep. Gate the WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP. Signed-off-by: Niklas Söderlund Reviewed-by: Andrew Lunn Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 38611e5adae32e2546636ba930807f89c04061a1 Author: Saurabh Sengar Date: Mon Sep 8 21:57:10 2025 -0700 net: mana: Remove redundant netdev_lock_ops_to_full() calls NET_SHAPER is always selected for MANA driver. When NET_SHAPER is enabled, netdev_lock_ops_to_full() reduces effectively to only an assert for lock, which is always held in the path when NET_SHAPER is enabled. Remove the redundant netdev_lock_ops_to_full() call. Signed-off-by: Saurabh Sengar Link: https://patch.msgid.link/1757393830-20837-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 01ed2910b220615dd7f291946edf5d0709796ce2 Author: Frank Li Date: Fri Aug 22 10:50:01 2025 -0400 ARM: dts: ls1021a-tsn: Remove redundant #address-cells for ethernet-switch@1 Remove redundant #address-cells and #size-cells for ethernet-switch@1 because children node have not address. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-tsn.dtb: ethernet-switch@1 (nxp,sja1105t): Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected) from schema $id: http://devicetree.org/schemas/net/dsa/nxp,sja1105.yaml# Signed-off-by: Frank Li Reviewed-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit e42a515aff9c42d7164ecd5ae40e63e7e4cfa13e Author: Frank Li Date: Fri Aug 22 10:50:00 2025 -0400 ARM: dts: ls1021a: Rename esdhc@1560000 to mmc@1560000 Rename node name esdhc@1560000 to mmc@1560000 to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-tqmls1021a-mbls1021a-rgb-cdtech-fc21.dtb: esdhc@1560000 (fsl,ls1021a-esdhc): $nodename:0: 'esdhc@1560000' does not match '^mmc(@.*)?$' from schema $id: http://devicetree.org/schemas/mmc/fsl,esdhc.yaml# Signed-off-by: Frank Li Reviewed-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 6067121fbe1ac30c525da6069e0865e91db50541 Author: Frank Li Date: Fri Aug 22 10:49:59 2025 -0400 ARM: dts: ls1021a: Rename 'mdio-mux-emi1' to 'mdio-mux@54' Rename 'mdio-mux-emi1' to 'mdio-mux@54'. Add fallback compatible string mdio-mux. Fix below warning: arch/arm/boot/dts/nxp/ls/ls1021a-qds.dtb: memory-controller@1530000 (fsl,ifc): board-control@3,0: 'oneOf' conditional failed, one must be fixed: 'bank-width', 'device-width', 'mdio-mux-emi1' do not match any of the regexes: '^mdio-mux@[a-f0-9,]+$', 'pinctrl-[0-9]+' Signed-off-by: Frank Li Reviewed-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 5ed941c73b7f501e32610ef0e82affa7ec36a71f Author: Frank Li Date: Fri Aug 22 10:49:58 2025 -0400 ARM: dts: ls1021a: Rename node name nor to flash Rename node name nor to flash to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-twr.dtb: memory-controller@1530000 (fsl,ifc): 'nor@0,0' does not match any of the regexes: '(flash|fpga|board-control|cpld)@[a-f0-9]+(,[a-f0-9]+)+$', '^nand@[a-f0-9]+(,[a-f0-9]+)+$', '^pinctrl-[0-9]+$' Signed-off-by: Frank Li Reviewed-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit d2dab63098bde9a6373eeb4672df806ad62a12da Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:47 2025 +0300 ARM: dts: lpc32xx: Correct PL080 DMA controller device node name Rename PL080 DMA controller device node name to the expected one. The issue was reported by a dt binding checker: dma@31000000: $nodename:0: 'dma@31000000' does not match '^dma-controller(@.*)?$' Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 181ffb8b06848d7f1fd289d2497f5e134f55b09e Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:46 2025 +0300 ARM: dts: lpc32xx: Specify #dma-cells property of PL080 DMA controller For DMA controllers it is required to specify a number of the cells for users. The change eliminates the next build time reported warning: dma@31000000: '#dma-cells' is a required property Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit c4ceb7eeac34db30cd0c85b684b9ab26e9eb3cd2 Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:45 2025 +0300 ARM: dts: lpc32xx: Specify a precise version of the SD/MMC controller IP The SD/MMC controller on NXP LPC32xx SoC is ARM PrimeCell PL180, it is reported by the driver: mmci-pl18x 20098000.sd: mmc0: PL180 manf 41 rev0 at 0x20098000 irq 36,37 (pio) Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 88f55f0a985e3d612c47e754b807a455b92db360 Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:44 2025 +0300 ARM: dts: lpc32xx: Correct SD/MMC controller device node name Change the PL180 SD/MMC controller device node name to the expected 'mmc' one. The change removes a reported warning: sd@20098000: $nodename:0: 'sd@20098000' does not match '^mmc(@.*)?$' Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 2695035dc347a27f16268f8ab8e510a564c96d38 Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:43 2025 +0300 ARM: dts: lpc32xx: Correct motor PWM device tree node name Change once a customly selected 'mpwm' node name in favour of the expected 'pwm' one. The change eliminates a reported warning: mpwm@400e8000: $nodename:0: 'mpwm@400e8000' does not match '^pwm(@.*|-([0-9]|[1-9][0-9]+))?$' Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 65ae9ea77e1f2a20ad2866f99596df7ccdbd3b95 Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:42 2025 +0300 ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells Since commit 4cd2f417a0ac ("dt-bindings: pwm: Convert lpc32xx-pwm.txt to yaml format") both types of PWM controlles on NXP LPC32xx SoC fairly gained 3 cells, reflect it in the platform dtsi file. The change removes a dt binding checker warning: mpwm@400e8000: #pwm-cells:0:0: 3 was expected Cc: Uwe Kleine-König Acked-by: Uwe Kleine-König Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit b17b850da6f9c4440a49d96cded5faa85123aadf Author: Vladimir Zapolskiy Date: Thu Sep 4 21:46:41 2025 +0300 dt-bindings: arm: nxp: lpc: Assign myself as maintainer of NXP LPC32xx platforms Make a formal change to reflect the actual NXP LPC32xx maintainership for the last years. Cc: Roland Stigge Acked-by: Rob Herring (Arm) Reviewed-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 7935b843ce2184164f41c3b5c64e9f52994306f4 Author: Nathan Chancellor Date: Wed Sep 10 13:47:26 2025 -0700 md/md-llbitmap: Use DIV_ROUND_UP_SECTOR_T When building for 32-bit platforms, there are several link (if builtin) or modpost (if a module) errors due to dividends of type 'sector_t' in DIV_ROUND_UP: arm-linux-gnueabi-ld: drivers/md/md-llbitmap.o: in function `llbitmap_resize': drivers/md/md-llbitmap.c:1017:(.text+0xae8): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: drivers/md/md-llbitmap.c:1020:(.text+0xb10): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: drivers/md/md-llbitmap.o: in function `llbitmap_end_discard': drivers/md/md-llbitmap.c:1114:(.text+0xf14): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: drivers/md/md-llbitmap.o: in function `llbitmap_start_discard': drivers/md/md-llbitmap.c:1097:(.text+0x1808): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: drivers/md/md-llbitmap.o: in function `llbitmap_read_sb': drivers/md/md-llbitmap.c:867:(.text+0x2080): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: drivers/md/md-llbitmap.o:drivers/md/md-llbitmap.c:895: more undefined references to `__aeabi_uldivmod' follow Use DIV_ROUND_UP_SECTOR_T instead of DIV_ROUND_UP, which exists to handle this exact situation. Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap") Signed-off-by: Nathan Chancellor Signed-off-by: Jens Axboe commit 91494dee1091a14d91da6bcb39e12a907765c793 Author: Dave Airlie Date: Thu Sep 4 12:16:42 2025 +1000 xe: populate buffers before exporting them. Before exporting a buffer, make sure it has been populated with pages at least once. While discussing cgroups we noticed a problem where you could export a BO to a dma-buf without having it ever being backed or accounted for. This meant in low memory situations or eventually with cgroups, a lower privledged process might cause the compositor to try and allocate a lot of memory on it's behalf and this could fail. At least make sure the exporter has managed to allocate the RAM at least once before exporting the object. This only applies currently to TTM_PL_SYSTEM objects, because GTT objects get populated on first validate, and VRAM doesn't use TT. Cc: Thomas Hellström Signed-off-by: Dave Airlie Reviewed-by: Thomas Hellström Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250904021643.2050497-4-airlied@gmail.com commit 3629e1b22e5ba2475fe2531e59c9446c4979e2f9 Author: Dave Airlie Date: Thu Sep 4 12:16:41 2025 +1000 nouveau: populate buffers before exporting them. Before exporting a buffer, make sure it has been populated with pages at least once. While discussing cgroups we noticed a problem where you could export a BO to a dma-buf without having it ever being backed or accounted for. This meant in low memory situations or eventually with cgroups, a lower privledged process might cause the compositor to try and allocate a lot of memory on it's behalf and this could fail. At least make sure the exporter has managed to allocate the RAM at least once before exporting the object. This only applies currently to TTM_PL_SYSTEM objects, because GTT objects get populated on first validate, and VRAM doesn't use TT. Acked-by: Danilo Krummrich Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250904021643.2050497-3-airlied@gmail.com commit 619ddf57cfddf81ffb75905cc5f533e61206b10c Author: Dave Airlie Date: Thu Sep 4 12:16:40 2025 +1000 amdgpu: populate buffers before exporting them. Before exporting a buffer, make sure it has been populated with pages at least once. While discussing cgroups we noticed a problem where you could export a BO to a dma-buf without having it ever being backed or accounted for. This meant in low memory situations or eventually with cgroups, a lower privledged process might cause the compositor to try and allocate a lot of memory on it's behalf and this could fail. At least make sure the exporter has managed to allocate the RAM at least once before exporting the object. This only applies currently to TTM_PL_SYSTEM objects, because GTT objects get populated on first validate, and VRAM doesn't use TT. Reviewed-by: Christian Koenig Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250904021643.2050497-2-airlied@gmail.com commit 50243079865ae7c150bc54ea3ed59077cdf3da03 Author: Dave Airlie Date: Thu Sep 4 12:16:39 2025 +1000 ttm/bo: add an API to populate a bo before exporting. While discussing cgroups we noticed a problem where you could export a BO to a dma-buf without having it ever being backed or accounted for. This meant in low memory situations or eventually with cgroups, a lower privledged process might cause the compositor to try and allocate a lot of memory on it's behalf and this could fail. At least make sure the exporter has managed to allocate the RAM at least once before exporting the object. This only applies currently to TTM_PL_SYSTEM objects, because GTT objects get populated on first validate, and VRAM doesn't use TT. Reviewed-by: Christian Koenig Cc: Thomas Hellström Cc: Simona Vetter Signed-off-by: Dave Airlie Reviewed-by: Thomas Hellström Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250904021643.2050497-1-airlied@gmail.com commit d2c773159327f4d2f6438acf1ae2ae9ac0ca46a9 Author: Gerald Yang Date: Tue Sep 9 13:10:52 2025 +0000 audit: fix skb leak when audit rate limit is exceeded When configuring a small audit rate limit in /etc/audit/rules.d/audit.rules: -a always,exit -F arch=b64 -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -r 100 And then repeatedly triggering permission denied as a normal user: while :; do cat /proc/1/environ; done We can see the messages in kernel log: [ 2531.862184] audit: rate limit exceeded The unreclaimable slab objects start to leak quickly. With kmemleak enabled, many call traces appear like: unreferenced object 0xffff99144b13f600 (size 232): comm "cat", pid 1100, jiffies 4294739144 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 8540ec4f): kmemleak_alloc+0x4a/0x90 kmem_cache_alloc_node+0x2ea/0x390 __alloc_skb+0x174/0x1b0 audit_log_start+0x198/0x3d0 audit_log_proctitle+0x32/0x160 audit_log_exit+0x6c6/0x780 __audit_syscall_exit+0xee/0x140 syscall_exit_work+0x12b/0x150 syscall_exit_to_user_mode_prepare+0x39/0x80 syscall_exit_to_user_mode+0x11/0x260 do_syscall_64+0x8c/0x180 entry_SYSCALL_64_after_hwframe+0x78/0x80 This shows that the skb allocated in audit_log_start() and queued onto skb_list is never freed. In audit_log_end(), each skb is dequeued from skb_list and passed to __audit_log_end(). However, when the audit rate limit is exceeded, __audit_log_end() simply prints "rate limit exceeded" and returns without processing the skb. Since the skb is already removed from skb_list, audit_buffer_free() cannot free it later, leading to a memory leak. Fix this by freeing the skb when the rate limit is exceeded. Fixes: eb59d494eebd ("audit: add record for multiple task security contexts") Signed-off-by: Gerald Yang [PM: fixes tag, subj tweak] Signed-off-by: Paul Moore commit 70e42a63542e0d82ecfe2ae6c5fb5033a73c8c71 Author: Frank Li Date: Sun Jul 6 14:47:07 2025 -0400 ARM: dts: lpc18xx: add missed arm,num-irq-priority-bits Add missed arm,num-irq-priority-bits to fix below CHECK_DTBS warning: arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: interrupt-controller@e000e100 (arm,armv7m-nvic): 'arm,num-irq-priority-bits' is a required property from schema $id: http://devicetree.org/schemas/interrupt-controller/arm,nvic.yaml# Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit a884b8fc2efd44665cd05a6878aa23345d97a5cb Author: Frank Li Date: Sun Jul 6 14:47:06 2025 -0400 ARM: dts: lpc18xx: add #address-cell and #szie-cell for spi flash controller Add #address-cells and #szie-cells for spi flash controller to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc18xx.dtsi:103.23-112.5: Warning (spi_bus_bridge): /soc/spi@40003000: incorrect #address-cells for SPI bus also defined at arch/arm/boot/dts/nxp/lpc/lpc4350-hitex-eval.dts:452.8-479.3 arch/arm/boot/dts/nxp/lpc/lpc18xx.dtsi:103.23-112.5: Warning (spi_bus_bridge): /soc/spi@40003000: incorrect #size-cells for SPI bus also defined at arch/arm/boot/dts/nxp/lpc/lpc4350-hitex-eval.dts:452.8-479.3 Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 212480c0e7cdfaf22b2cbb2f9144c9f357de2b1a Author: Frank Li Date: Sun Jul 6 14:47:05 2025 -0400 ARM: dts: lpc4357-myd-lpc4357: change node name mdio0 to mdio Change node name mdio0 to mdio to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4357-myd-lpc4357.dtb: ethernet@40010000 (nxp,lpc1850-dwmac): Unevaluated properties are not allowed ('mdio0' was unexpected) from schema $id: http://devicetree.org/schemas/net/nxp,lpc1850-dwmac.yaml Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit caa9c67398d129ec8ab2d1db9a6038d0a35e31df Author: Frank Li Date: Sun Jul 6 14:47:04 2025 -0400 ARM: dts: lpc: change node name 'button[0-9]' to button-[0-9]' Change node name 'button[0-9]' to button-[0-9]' to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4350-hitex-eval.dtb: pca_buttons (gpio-keys-polled): 'button0', ... do not match any of the regexes: '^(button|...', 'pinctrl-[0-9]+' Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 332d4e0092e8cb09f1cc0809260f1215d9371268 Author: Frank Li Date: Sun Jul 6 14:47:03 2025 -0400 ARM: dts: lpc4357-myd-lpc4357: add power-supply for innolux,at070tn92 Add power-supply for innolux,at070tn92 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4357-myd-lpc4357.dtb: panel (innolux,at070tn92): 'power-supply' is a required property Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit fcc5f89e3050e3bb3c25c49c87ea8d3100e2cf34 Author: Frank Li Date: Sun Jul 6 14:47:02 2025 -0400 ARM: dts: lpc: add cfg surfix in pinctrl child node Add cfg surfix in pinctrl child node to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: pinctrl@40086000 (nxp,lpc1850-scu): ssp-pins: 'ssp1_cs', 'ssp1_miso_mosi', 'ssp1_sck' do not match any of the regexes: '^pinctrl-[0-9]+$', '_cfg$' from schema $id: http://devicetree.org/schemas/pinctrl/nxp,lpc1850-scu.yaml# Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 9276abee591ae0a82cc7184653ac8d77d2eb7b88 Author: Frank Li Date: Sun Jul 6 14:47:01 2025 -0400 ARM: dts: lpc: add #address-cells and #size-cells for sram node Add #address-cells and #size-cells for sram node to fix below DTB_CHECK warnings: arch/arm/boot/dts/nxp/lpc/lpc4350-hitex-eval.dtb: sram@2,0 (mmio-sram): '#address-cells' is a required property Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 5460b42b65cd36113114d45e519359f129c7331c Author: Frank Li Date: Sun Jul 6 14:47:00 2025 -0400 ARM: dts: lpc18xx: swap clock-names bic and cui Swap clock-names bic and cui to fix below CHECK_DTB warnings: /home/lizhi/source/linux-upstream-pci/arch/arm/boot/dts/nxp/lpc/lpc4357-ea4357-devkit.dtb: mmc@40004000 (snps,dw-mshc): clock-names:0: 'biu' was expected from schema $id: http://devicetree.org/schemas/mmc/synopsys-dw-mshc.yaml# /home/lizhi/source/linux-upstream-pci/arch/arm/boot/dts/nxp/lpc/lpc4357-ea4357-devkit.dtb: mmc@40004000 (snps,dw-mshc): clock-names:1: 'ciu' was expected Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 4e328041248c5f8a85f576fac16de6118c8d9bec Author: Frank Li Date: Sun Jul 6 14:46:59 2025 -0400 ARM: dts: lpc4350-hitex-eval: change node name flash to flash@0 Change node name 'flash' to 'flash@0' to fix below CHECK_DTB warnings. arch/arm/boot/dts/nxp/lpc/lpc4350-hitex-eval.dtb: flash-controller@40003000 (nxp,lpc1773-spifi): Unevaluated properties are not allowed ('flash' was unexpected) from schema $id: http://devicetree.org/schemas/mtd/nxp,lpc1773-spifi.yaml# Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 3d2a00271e0b425073750b6b2ca51460061d3fdd Author: Frank Li Date: Sun Jul 6 14:46:58 2025 -0400 ARM: dts: lpc18xx: rename node name mmcsd to mmc Change node name mmcsd to mmc to fix CHECK_DTB warnings: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: mmcsd@40004000 (snps,dw-mshc): $nodename:0: 'mmcsd@40004000' does not match '^mmc(@.*)?$' Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit c3ad87de22e57e35b1c516f85aa6ea5c81ec5754 Author: Frank Li Date: Sun Jul 6 14:46:57 2025 -0400 ARM: dts: lpc18xx: rename node name flash-controller to spi Anyway it is SPI controller although intent to connect qspi flash. Rename node name flash-controller to spi to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: flash-controller@40003000 (nxp,lpc1773-spifi): $nodename:0: 'flash-controller@40003000' does not match '^spi(@.*|-([0-9]|[1-9][0-9]+))?$ Signed-off-by: Frank Li Signed-off-by: Vladimir Zapolskiy commit 9adc6669a60a7ec9e5a4b2b524791b0f4b7f3e66 Author: Jens Axboe Date: Wed Sep 10 09:50:30 2025 -0600 io_uring: correct size of overflow CQE calculation If a 32b CQE is required, don't double the size of the overflow struct, just add the size of the io_uring_cqe addition that is needed. This avoids allocating too much memory, as the io_overflow_cqe size includes the list member required to queue them too. Fixes: e26dca67fde1 ("io_uring: add support for IORING_SETUP_CQE_MIXED") Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit b5bad77e1e3c7249e4c0c88f98477e1ee7669b63 Author: Rob Clark Date: Mon Sep 8 12:30:08 2025 -0700 drm/msm/registers: Sync GPU registers from mesa In particular, to pull in a SP_READ_SEL_LOCATION bitfield size fix to fix a7xx GPU snapshot. Sync from mesa commit 15ee3873aa4d ("freedreno/registers: Update GMU register xml"). Cc: Karmjit Mahil Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/673558/ commit 60e9f776b7932d67c88e8475df7830cb9cdf3154 Author: Rob Clark Date: Mon Sep 8 12:30:07 2025 -0700 drm/msm/registers: Generate _HI/LO builders for reg64 The upstream mesa copy of the GPU regs has shifted more things to reg64 instead of seperate 32b HI/LO reg32's. This works better with the "new- style" c++ builders that mesa has been migrating to for a6xx+ (to better handle register shuffling between gens), but it leaves the C builders with missing _HI/LO builders. So handle the special case of reg64, automatically generating the missing _HI/LO builders. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/673559/ commit 29e087f31bb104c3ad71396e3a2f94982f2801d2 Author: Rob Clark Date: Mon Sep 8 12:30:06 2025 -0700 drm/msm/registers: Make TPL1_BICUBIC_WEIGHTS_TABLE an array Synced from mesa commit 77c42c1a5752 ("freedreno/registers: Make TPL1_BICUBIC_WEIGHTS_TABLE an array"). Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/673552/ commit 90528176204b7ae003477e0b37a24d540f26531d Author: Rob Clark Date: Mon Sep 8 12:30:05 2025 -0700 drm/msm/registers: Sync gen_header.py from mesa Sync from mesa commit 04e2140d8be7 ("freedreno/registers: remove python 3.9 dependency for compiling msm"). Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/673556/ commit f03464c638ef10d5a9837d61176463f40e92da42 Author: Rob Clark Date: Mon Sep 8 12:30:04 2025 -0700 drm/msm/registers: Remove license/etc from generated headers Since these generated files are no longer checked in, either in mesa or in the linux kernel, simplify things by dropping the verbose generated comment. These were semi-nerf'd on the kernel side, in the name of build reproducibility, by commit ba64c6737f86 ("drivers: gpu: drm: msm: registers: improve reproducibility"), but in a way that was semi- kernel specific. We can just reduce the divergence between kernel and mesa by just dropping all of this. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/673551/ commit 41534d499e50e23571d6b9960498777d93f817ce Author: Ye Liu Date: Tue Sep 9 09:33:07 2025 +0800 mm/slub: Refactor note_cmpxchg_failure for better readability Use IS_ENABLED() and standard if-else to make the code clearer. Signed-off-by: Ye Liu Reviewed-by: Harry Yoo Reviewed-by: Christoph Lameter (Ampere) Reviewed-by: Anshuman Khandual Signed-off-by: Vlastimil Babka commit ba7a896427cbade13d30f3c7e18c15e8be243c18 Author: Kuan-Wei Chiu Date: Tue Aug 26 14:23:15 2025 +0800 mm/slub: Replace sort_r() with sort() for debugfs stack trace sorting The comparison function used to sort stack trace locations in debugfs never relied on the third argument. Therefore, sort_r() is unnecessary. Switch to sort() with a two-argument comparison function to keep the code simple and aligned with the intended usage. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit e1c4350327b39c9cad27b6c5779b3754384f26c8 Author: Kuan-Wei Chiu Date: Tue Aug 26 14:23:14 2025 +0800 mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal The comparison function cmp_loc_by_count() used for sorting stack trace locations in debugfs currently returns -1 if a->count > b->count and 1 otherwise. This breaks the antisymmetry property required by sort(), because when two counts are equal, both cmp(a, b) and cmp(b, a) return 1. This can lead to undefined or incorrect ordering results. Fix it by updating the comparison logic to explicitly handle the case when counts are equal, and use cmp_int() to ensure the comparison function adheres to the required mathematical properties of antisymmetry. Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces") Reviewed-by: Joshua Hahn Signed-off-by: Kuan-Wei Chiu Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 2e0fd4583d0efcdc260e61a22666c8368f505353 Author: Daniel Almeida Date: Wed Sep 10 14:54:32 2025 -0300 rust: regulator: add devm_enable and devm_enable_optional A lot of drivers only care about enabling the regulator for as long as the underlying Device is bound. This can be easily observed due to the extensive use of `devm_regulator_get_enable` and `devm_regulator_get_enable_optional` throughout the kernel. Therefore, make this helper available in Rust. Also add an example noting how it should be the default API unless the driver needs more fine-grained control over the regulator. Suggested-by: Danilo Krummrich Reviewed-by: Boqun Feng Reviewed-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Signed-off-by: Daniel Almeida Link: https://patch.msgid.link/20250910-regulator-remove-dynamic-v3-2-07af4dfa97cc@collabora.com Signed-off-by: Mark Brown commit b87ecbc54f22382ace1cf41645e8652a4ce44d52 Author: Daniel Almeida Date: Wed Sep 10 14:54:31 2025 -0300 rust: regulator: remove Regulator After some experimenting and further discussion, it is starting to look like Regulator might be a footgun. It turns out that one can get the same behavior by correctly using just Regulator and Regulator, so there is no need to directly expose the manual refcounting ability of Regulator to clients. Remove it while we do not have any other users. Suggested-by: Danilo Krummrich Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Signed-off-by: Daniel Almeida Link: https://patch.msgid.link/20250910-regulator-remove-dynamic-v3-1-07af4dfa97cc@collabora.com Signed-off-by: Mark Brown commit 2bc2694fe20bf06eb73524426e3f4581d7b28923 Author: Sean Christopherson Date: Fri Aug 22 15:05:23 2025 +0800 KVM: TDX: Do not retry locally when the retry is caused by invalid memslot Avoid local retries within the TDX EPT violation handler if a retry is triggered by faulting in an invalid memslot, indicating that the memslot is undergoing a removal process. Faulting in a GPA from an invalid memslot will never succeed, and holding SRCU prevents memslot deletion from succeeding, i.e. retrying when the memslot is being actively deleted will lead to (breakable) deadlock. Opportunistically export kvm_vcpu_gfn_to_memslot() to allow for a per-vCPU lookup (which, strictly speaking, is unnecessary since TDX doesn't support SMM, but aligns the TDX code with the MMU code). Fixes: b0327bb2e7e0 ("KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY") Reported-by: Reinette Chatre Closes: https://lore.kernel.org/all/20250519023737.30360-1-yan.y.zhao@intel.com [Yan: Wrote patch log, comment, fixed a minor error, function export] Signed-off-by: Yan Zhao Link: https://lore.kernel.org/r/20250822070523.26495-1-yan.y.zhao@intel.com [sean: massage changelog, relocate and tweak comment] Signed-off-by: Sean Christopherson commit 3ccbf6f47098f5d5e247d1b7739d0fd90802187b Author: Sean Christopherson Date: Fri Aug 22 15:03:47 2025 +0800 KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault Return -EAGAIN if userspace attempts to delete or move a memslot while also prefaulting memory for that same memslot, i.e. force userspace to retry instead of trying to handle the scenario entirely within KVM. Unlike KVM_RUN, which needs to handle the scenario entirely within KVM because userspace has come to depend on such behavior, KVM_PRE_FAULT_MEMORY can return -EAGAIN without breaking userspace as this scenario can't have ever worked (and there's no sane use case for prefaulting to a memslot that's being deleted/moved). And also unlike KVM_RUN, the prefault path doesn't naturally guarantee forward progress. E.g. to handle such a scenario, KVM would need to drop and reacquire SRCU to break the deadlock between the memslot update (synchronizes SRCU) and the prefault (waits for the memslot update to complete). However, dropping SRCU creates more problems, as completing the memslot update will bump the memslot generation, which in turn will invalidate the MMU root. To handle that, prefaulting would need to handle pending KVM_REQ_MMU_FREE_OBSOLETE_ROOTS requests and do kvm_mmu_reload() prior to mapping each individual. I.e. to fully handle this scenario, prefaulting would eventually need to look a lot like vcpu_enter_guest(). Given that there's no reasonable use case and practically zero risk of breaking userspace, punt the problem to userspace and avoid adding unnecessary complexity to the prefault path. Note, TDX's guest_memfd post-populate path is unaffected as slots_lock is held for the entire duration of populate(), i.e. any memslot modifications will be fully serialized against TDX's flavor of prefaulting. Reported-by: Reinette Chatre Closes: https://lore.kernel.org/all/20250519023737.30360-1-yan.y.zhao@intel.com Debugged-by: Yan Zhao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250822070347.26451-1-yan.y.zhao@intel.com Signed-off-by: Sean Christopherson commit aac057dd623132a1776be37b471e30b4589fdf76 Author: Sean Christopherson Date: Thu Aug 21 14:42:09 2025 -0700 KVM: x86: Move vector_hashing into lapic.c Move the vector_hashing module param into lapic.c now that all usage is contained within the local APIC emulation code. Opportunistically drop the accessor and append "_enabled" to the variable to help capture that it's a boolean module param. No functional change intended. Link: https://lore.kernel.org/r/20250821214209.3463350-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 73473f31a4bf9e19adc6926bba1bdde1c798175d Author: Sean Christopherson Date: Thu Aug 21 14:42:08 2025 -0700 KVM: x86: Make "lowest priority" helpers local to lapic.c Make various helpers for resolving lowest priority IRQs local to lapic.c now that kvm_irq_delivery_to_apic() lives in lapic.c as well. No functional change intended. Link: https://lore.kernel.org/r/20250821214209.3463350-3-seanjc@google.com Signed-off-by: Sean Christopherson commit d4a5d397c7fb1ca967e0da202cac196e7324f4ea Author: Matthew Maurer Date: Thu Sep 4 21:13:58 2025 +0000 samples: rust: Add scoped debugfs sample driver Adds a new sample driver `rust_scoped_debugfs` that demonstrates the use of the scoped debugfs APIs. The driver creates a `control` directory with two write-only files, `create` and `remove`. Writing a name and a series of numbers to `create` will create a new subdirectory under a `dynamic` directory. This new subdirectory will contain files that expose the numbers as atomic values. Writing a name to `remove` will remove the corresponding subdirectory from the `dynamic` directory. This sample serves as an example of how to use the `debugfs::Scope` and `debugfs::ScopedDir` APIs to create and manage debugfs entries that are tied to the lifetime of a data structure. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-7-7d12a165685a@google.com [ Rename "scoped_debugfs" -> "debugfs_scoped", fix up Result<(), Error> -> Result. - Danilo ] Signed-off-by: Danilo Krummrich commit cbf5d9457462c83c1bf851c0b8b04296b037a9dd Author: Sean Christopherson Date: Thu Aug 21 14:42:07 2025 -0700 KVM: x86: Move kvm_irq_delivery_to_apic() from irq.c to lapic.c Move kvm_irq_delivery_to_apic() to lapic.c as it is specific to local APIC emulation. This will allow burying more local APIC code in lapic.c, e.g. the various "lowest priority" helpers. No functional change intended. Link: https://lore.kernel.org/r/20250821214209.3463350-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 661facba437e37c1685606825b9fd59be3f78771 Author: Sean Nyekjaer Date: Tue Sep 9 09:11:11 2025 +0200 iio: imu: inv_icm42600: use guard() to release mutexes Replace explicit mutex_lock() and mutex_unlock() with the guard() macro for cleaner and safer mutex handling. Signed-off-by: Sean Nyekjaer Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit ee8fc40257bc7cf6100fdf0b1cd770dc264f6c2e Author: Dixit Parmar Date: Wed Sep 10 19:36:50 2025 +0530 iio: magnetometer: tmag5273: remove unused IIO_CHAN_INFO_PROCESSED handling The tmag5273 driver does not advertise IIO_CHAN_INFO_PROCESSED in its info_mask_* fields, so the corresponding case in read_raw()/write_raw() is never used. Drop the dead code to reduce unnecessary branches and improve clarity. Signed-off-by: Dixit Parmar Signed-off-by: Jonathan Cameron commit 09579fb72e5412a4e98aee42c8a3ab3d437f8a32 Author: Dixit Parmar Date: Wed Sep 10 19:36:49 2025 +0530 iio: magnetometer: als31300: remove unused IIO_CHAN_INFO_PROCESSED handling The als31300 driver does not advertise IIO_CHAN_INFO_PROCESSED in its info_mask_* fields, so the corresponding case in read_raw() is never used. Drop the dead code to reduce unnecessary branches and improve clarity. Signed-off-by: Dixit Parmar Signed-off-by: Jonathan Cameron commit 7b69cb9a18b1ec4699b36caff44152ee673be18a Author: Gwendal Grignou Date: Wed Sep 3 12:01:02 2025 -0700 Documentation: iio: Remove location attribute The cros-ec specific |location| attribute has been superseded by the generic |label| attribute. Signed-off-by: Gwendal Grignou Signed-off-by: Jonathan Cameron commit 9fd569aa3d70963171846dd674c1c41ff900410f Author: Sean Nyekjaer Date: Mon Sep 1 09:49:16 2025 +0200 iio: imu: inv_icm42600: Use devm_regulator_get_enable() for vdd regulator The vdd regulator is not used for runtime power management, so it does not need explicit enable/disable handling. Use devm_regulator_get_enable() to let the regulator be managed automatically by devm. This simplifies the code by removing the manual enable and cleanup logic. Signed-off-by: Sean Nyekjaer Reviewed-by: David Lechner Link: https://patch.msgid.link/20250901-icm42pmreg-v3-4-ef1336246960@geanix.com Signed-off-by: Jonathan Cameron commit 466f7a2fef2a4e426f809f79845a1ec1aeb558f4 Author: Sean Nyekjaer Date: Mon Sep 1 09:49:15 2025 +0200 iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended Do as in suspend, skip resume configuration steps if the device is already pm_runtime suspended. This avoids reconfiguring a device that is already in the correct low-power state and ensures that pm_runtime handles the power state transitions properly. Fixes: 31c24c1e93c3 ("iio: imu: inv_icm42600: add core of new inv_icm42600 driver") Signed-off-by: Sean Nyekjaer Link: https://patch.msgid.link/20250901-icm42pmreg-v3-3-ef1336246960@geanix.com Cc: Signed-off-by: Jonathan Cameron commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a Author: Sean Nyekjaer Date: Mon Sep 1 09:49:14 2025 +0200 iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), and pm_runtime_enable() from the resume path. These operations are not required here and can interfere with proper pm_runtime state handling, especially when resuming from a pm_runtime suspended state. Fixes: 31c24c1e93c3 ("iio: imu: inv_icm42600: add core of new inv_icm42600 driver") Signed-off-by: Sean Nyekjaer Link: https://patch.msgid.link/20250901-icm42pmreg-v3-2-ef1336246960@geanix.com Cc: Signed-off-by: Jonathan Cameron commit 0792c1984a45ccd7a296d6b8cb78088bc99a212e Author: Sean Nyekjaer Date: Mon Sep 1 09:49:13 2025 +0200 iio: imu: inv_icm42600: Simplify pm_runtime setup Rework the power management in inv_icm42600_core_probe() to use devm_pm_runtime_set_active_enabled(), which simplifies the runtime PM setup by handling activation and enabling in one step. Remove the separate inv_icm42600_disable_pm callback, as it's no longer needed with the devm-managed approach. Using devm_pm_runtime_enable() also fixes the missing disable of autosuspend. Update inv_icm42600_disable_vddio_reg() to only disable the regulator if the device is not suspended i.e. powered-down, preventing unbalanced disables. Also remove redundant error msg on regulator_disable(), the regulator framework already emits an error message when regulator_disable() fails. This simplifies the PM setup and avoids manipulating the usage counter unnecessarily. Fixes: 31c24c1e93c3 ("iio: imu: inv_icm42600: add core of new inv_icm42600 driver") Signed-off-by: Sean Nyekjaer Link: https://patch.msgid.link/20250901-icm42pmreg-v3-1-ef1336246960@geanix.com Cc: Signed-off-by: Jonathan Cameron commit b947d4edfc4fc23a912b0ba160f8af3543b0283b Author: Primoz Fiser Date: Fri Sep 5 08:55:02 2025 +0200 dt-bindings: iio: afe: current-sense-amplifier: Add io-channel-cells The current-sense-amplifier is an IIO provider thus can be referenced by IIO consumers (via "io-channels" property in consumer device node). Such provider is required to describe number of cells used in phandle lookup with "io-channel-cells" property. Signed-off-by: Primoz Fiser Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250905065503.3022107-1-primoz.fiser@norik.com Signed-off-by: Jonathan Cameron commit f29b08cd0b8613c2ca23f691073deb37d4dc055c Author: Christophe JAILLET Date: Sun Sep 7 12:04:48 2025 +0200 iio: adc: PAC1934: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 50985 23992 192 75169 125a1 drivers/iio/adc/pac1934.o After: ===== text data bss dec hex filename 50654 23920 192 74766 1240e drivers/iio/adc/pac1934.o Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/f92033415f43aa02fe862cb952e62b6ded949056.1757239464.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jonathan Cameron commit 106511d280c75908b5252e465ffb57cc66b05a2d Author: Dixit Parmar Date: Sat Sep 6 14:07:57 2025 +0530 iio: magnetometer: add support for Infineon TLV493D 3D Magentic sensor The Infineon TLV493D is a Low-Power 3D Magnetic Sensor. The Sensor applications includes joysticks, control elements (white goods, multifunction knops), or electric meters (anti tampering) and any other application that requires accurate angular measurements at low power consumptions. The Sensor is configured over I2C, and as part of Sensor measurement data it provides 3-Axis magnetic fields and temperature core measurement. The driver supports raw value read and buffered input via external trigger to allow streaming values with the same sensing timestamp. While the sensor has an interrupt pin multiplexed with an I2C SCL pin. But for bus configurations interrupt(INT) is not recommended, unless timing constraints between I2C data transfers and interrupt pulses are monitored and aligned. The Sensor's I2C register map and mode information is described in product User Manual [1]. Datasheet: https://www.infineon.com/assets/row/public/documents/24/49/infineon-tlv493d-a1b6-datasheet-en.pdf Link: https://www.mouser.com/pdfDocs/Infineon-TLV493D-A1B6_3DMagnetic-UserManual-v01_03-EN.pdf [1] Signed-off-by: Dixit Parmar Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250906-tlv493d-sensor-v6_16-rc5-v6-2-b1a62d968353@gmail.com Signed-off-by: Jonathan Cameron commit 8efd9d976652371ada359e717e0bf72ab453a5cf Author: Dixit Parmar Date: Sat Sep 6 14:07:56 2025 +0530 dt-bindings: iio: magnetometer: Infineon TLV493D 3D Magnetic sensor Document the bindings for Infineon TLV493D Low-Power 3D Magnetic Sensor controlled by I2C interface. Main applications includes joysticks, control elements (white goods, multifunction knops), or electric meters (anti- tampering). Drop duplicate entry for infineon,tlv493d from trivial-devices.yaml as its documented in this separate dt-binding file now. Datasheet: https://www.infineon.com/assets/row/public/documents/24/49/infineon-tlv493d-a1b6-datasheet-en.pdf Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250906-tlv493d-sensor-v6_16-rc5-v6-1-b1a62d968353@gmail.com Signed-off-by: Jonathan Cameron commit 28e4b85984ef0b8cef8c99143fa064dd592083f9 Author: Hans de Goede Date: Sun Aug 31 12:48:25 2025 +0200 iio: adc: Add Intel Dollar Cove TI PMIC ADC driver Intel has 2 completely different "Dollar Cove" PMICs for its Bay Trail / Cherry Trail SoCs. One is made by X-Powers and is called the AXP288. The AXP288's GPADC is already supported by the X-Powers AXP288 ADC driver. The other "Dollar Cove" PMIC is made by TI and does not have any clear TI denomination, its MFD driver calls it the "Intel Dollar Cove TI PMIC". Add a driver for the Intel Dollar Cove TI PMIC's general purpose ADC, binding to the "chtdc_ti_adc" MFD cell of the MFD driver. The "cht" in the cell name comes from Cherry Trail, but it turns out that just like the AXP288 the Intel Dollar Cove TI PMIC is also used with both Intel Bay Trail and Intel Cherry Trail SoCs, so this new ADC driver does not include the cht part in its name. This is loosely based on kernel/drivers/iio/adc/iio_dc_ti_gpadc.c from the Acer A1-840 Android kernel source-code archive named: "App. Guide_Acer_20151221_A_A.zip" which is distributed by Acer from the Acer A1-840 support page: https://www.acer.com/us-en/support/product-support/A1-840/downloads Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-7-hansg@kernel.org Signed-off-by: Jonathan Cameron commit c732e60ee10ed0611a59513cbf9c8d35fbe7cf65 Author: Hans de Goede Date: Sun Aug 31 12:48:24 2025 +0200 iio: test: Add KUnit tests for iio_multiply_value() Add KUnit tests for iio_multiply_value(). Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-6-hansg@kernel.org Signed-off-by: Jonathan Cameron commit 05f958d003c9a9a215a5f8687a14534cc1dad271 Author: Hans de Goede Date: Sun Aug 31 12:48:23 2025 +0200 iio: Improve iio_read_channel_processed_scale() precision Before this change iio_read_channel_processed_scale() always assumes that channels which advertise IIO_CHAN_INFO_PROCESSED capability return IIO_VAL_INT on success. Ignoring any fractional values from drivers which return IIO_VAL_INT_PLUS_MICRO / IIO_VAL_INT_PLUS_NANO. These fractional values might become non fractional after scaling so these should be taken into account for better precision. Use the new iio_multiply_value() helper to do proper scaling taking the fractionional values into account. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-5-hansg@kernel.org Signed-off-by: Jonathan Cameron commit cec1aec9c46305743a2d4a1bfb06f6b0374d5ed0 Author: Hans de Goede Date: Sun Aug 31 12:48:22 2025 +0200 iio: consumers: Add an iio_multiply_value() helper function The channel-scale handling in iio_convert_raw_to_processed() in essence does the following: processed = raw * caller-provided-scale * channel-scale Which can also be written as: multiplier = raw * caller-provided-scale iio-value = channel-scale processed = multiplier * iio-value Where iio-value is a set of IIO_VAL_* type + val + val2 integers, being able to handle multiplication of iio-values like this is something which is useful to have in general and, as previous bugfixes to iio_convert_raw_to_processed() have shown, also tricky to implement. Split the iio-value multiplication code from iio_convert_raw_to_processed() out into a new iio_multiply_value() helper. This serves multiple purposes: 1. Having this split out allows writing a KUnit test for this. 2. Having this split out allows re-use to get better precision when scaling values in iio_read_channel_processed_scale(). Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-4-hansg@kernel.org Signed-off-by: Jonathan Cameron commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b Author: Hans de Goede Date: Sun Aug 31 12:48:21 2025 +0200 iio: consumers: Fix offset handling in iio_convert_raw_to_processed() Fix iio_convert_raw_to_processed() offset handling for channels without a scale attribute. The offset has been applied to the raw64 value not to the original raw value. Use the raw64 value so that the offset is taken into account. Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") Cc: Liam Beguin Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org Signed-off-by: Jonathan Cameron commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 Author: Hans de Goede Date: Sun Aug 31 12:48:20 2025 +0200 iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() There is an issue with the handling of negative channel scales in iio_convert_raw_to_processed_unlocked() when the channel-scale is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type: Things work for channel-scale values > -1.0 and < 0.0 because of the use of signed values in: *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); Things will break however for scale values < -1.0. Lets for example say that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5. The result should then be 2 * 10 * -1.5 = -30. channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000, now lets see what gets stored in processed: 1. *processed = raw64 * scale_val * scale; 2. *processed += raw64 * scale_val2 * scale / 1000000LL; 1. Sets processed to 2 * -1 * 10 = -20 2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed And the end result is processed = -20 + 10 = -10, which is not correct. Fix this by always using the abs value of both scale_val and scale_val2 and if either is negative multiply the end-result by -1. Note there seems to be an unwritten rule about negative IIO_VAL_INT_PLUS_[MICRO|NANO] values that: i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx ii. values <= -1.0 are written as val=-xxx val2=xxx But iio_format_value() will also correctly display a third option: iii. values <= -1.0 written as val=-xxx val2=-xxx Since iio_format_value() uses abs(val) when val2 < 0. This fix also makes iio_convert_raw_to_processed() properly handle channel-scales using this third option. Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") Cc: Matteo Martelli Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org Signed-off-by: Jonathan Cameron commit 0f2aeee58425faaa3117944711f8b41f8b42b5da Author: Krzysztof Kozlowski Date: Sat Aug 30 18:48:34 2025 +0200 dt-bindings: iio: adc: samsung,exynos: Drop touchscreen support With last user of touchscreen via ADC (S3C24xx SoC) gone, drop the unused has-touchscreen property and optional touchscreen interrupt for samsung,s3c6410-adc. The samsung,s5pv210-adc is the only platform having two interrupts, so add a constrain for that. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250830-s3c-cleanup-adc-v2-5-4f8299343d32@linaro.org Signed-off-by: Jonathan Cameron commit 4a09265c42350e6494d793191e6dbe59a4dddbe4 Author: Krzysztof Kozlowski Date: Sat Aug 30 18:48:33 2025 +0200 dt-bindings: iio: adc: samsung,exynos: Drop S3C2410 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250830-s3c-cleanup-adc-v2-4-4f8299343d32@linaro.org Signed-off-by: Jonathan Cameron commit 1dfdf4527fd391f653c53b634af9122613c58904 Author: Krzysztof Kozlowski Date: Sat Aug 30 18:48:32 2025 +0200 iio: adc: exynos_adc: Drop platform data support There are no Samsung Exynos SoC ADC driver users which bind via platform ID, thus platform data is never set and can be dropped. Reviewed-by: Andy Shevchenko Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250830-s3c-cleanup-adc-v2-3-4f8299343d32@linaro.org Signed-off-by: Jonathan Cameron commit 1ef28bcc4addc80af5a32c4dafcb830d19341e3f Author: Krzysztof Kozlowski Date: Sat Aug 30 18:48:31 2025 +0200 iio: adc: exynos_adc: Drop touchscreen support With last user of touchscreen via ADC (S3C24xx SoC) gone, drop the remaining code from Samsung SoC ADC driver. Reviewed-by: Andy Shevchenko Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250830-s3c-cleanup-adc-v2-2-4f8299343d32@linaro.org Signed-off-by: Jonathan Cameron commit 117b6c08174f766655cd0eb2de8f761778e3c306 Author: Krzysztof Kozlowski Date: Sat Aug 30 18:48:30 2025 +0200 iio: adc: exynos_adc: Drop S3C2410 support Samsung S3C24xx family of SoCs was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of its compatibles. Reviewed-by: Andy Shevchenko Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250830-s3c-cleanup-adc-v2-1-4f8299343d32@linaro.org Signed-off-by: Jonathan Cameron commit 16647efff258586ed8cd895eda967a9fe54fe05e Author: Ioana Risteiu Date: Tue Aug 26 01:13:52 2025 +0300 iio: adc: update ad7779 to use IIO backend Add a new functionality to ad7779 driver that streams data through data output interface using IIO backend interface. Reviewed-by: Andy Shevchenko Signed-off-by: Ioana Risteiu Link: https://patch.msgid.link/20250825221355.6214-5-Ioana.Risteiu@analog.com Signed-off-by: Jonathan Cameron commit 0568f89d4fb82d98001baeb870e92f43cd1f7317 Author: Yi Tao Date: Wed Sep 10 14:59:35 2025 +0800 cgroup: replace global percpu_rwsem with per threadgroup resem when writing to cgroup.procs The static usage pattern of creating a cgroup, enabling controllers, and then seeding it with CLONE_INTO_CGROUP doesn't require write locking cgroup_threadgroup_rwsem and thus doesn't benefit from this patch. To avoid affecting other users, the per threadgroup rwsem is only used when the favordynmods is enabled. As computer hardware advances, modern systems are typically equipped with many CPU cores and large amounts of memory, enabling the deployment of numerous applications. On such systems, container creation and deletion become frequent operations, making cgroup process migration no longer a cold path. This leads to noticeable contention with common process operations such as fork, exec, and exit. To alleviate the contention between cgroup process migration and operations like process fork, this patch modifies lock to take the write lock on signal_struct->group_rwsem when writing pid to cgroup.procs/threads instead of holding a global write lock. Cgroup process migration has historically relied on signal_struct->group_rwsem to protect thread group integrity. In commit <1ed1328792ff> ("sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem"), this was changed to a global cgroup_threadgroup_rwsem. The advantage of using a global lock was simplified handling of process group migrations. This patch retains the use of the global lock for protecting process group migration, while reducing contention by using per thread group lock during cgroup.procs/threads writes. The locking behavior is as follows: write cgroup.procs/threads | process fork,exec,exit | process group migration ------------------------------------------------------------------------------ cgroup_lock() | down_read(&g_rwsem) | cgroup_lock() down_write(&p_rwsem) | down_read(&p_rwsem) | down_write(&g_rwsem) critical section | critical section | critical section up_write(&p_rwsem) | up_read(&p_rwsem) | up_write(&g_rwsem) cgroup_unlock() | up_read(&g_rwsem) | cgroup_unlock() g_rwsem denotes cgroup_threadgroup_rwsem, p_rwsem denotes signal_struct->group_rwsem. This patch eliminates contention between cgroup migration and fork operations for threads that belong to different thread groups, thereby reducing the long-tail latency of cgroup migrations and lowering system load. With this patch, under heavy fork and exec interference, the long-tail latency of cgroup migration has been reduced from milliseconds to microseconds. Under heavy cgroup migration interference, the multi-CPU score of the spawn test case in UnixBench increased by 9%. tj: Update comment in cgroup_favor_dynmods() and switch WARN_ONCE() to pr_warn_once(). Signed-off-by: Yi Tao Signed-off-by: Tejun Heo commit 477abc2ec889a9dd3eb4ae0adbf6408a569bf2b6 Author: Yi Tao Date: Wed Sep 10 14:59:34 2025 +0800 cgroup: relocate cgroup_attach_lock within cgroup_procs_write_start Later patches will introduce a new parameter `task` to cgroup_attach_lock, thus adjusting the position of cgroup_attach_lock within cgroup_procs_write_start. Between obtaining the threadgroup leader via PID and acquiring the cgroup attach lock, the threadgroup leader may change, which could lead to incorrect cgroup migration. Therefore, after acquiring the cgroup attach lock, we check whether the threadgroup leader has changed, and if so, retry the operation. tj: Minor comment adjustments. Signed-off-by: Yi Tao Signed-off-by: Tejun Heo commit a1ffc8ad3165fa1cf6a60c6a4b4e00dfd6603cf2 Author: Yi Tao Date: Wed Sep 10 14:59:33 2025 +0800 cgroup: refactor the cgroup_attach_lock code to make it clearer Dynamic cgroup migration involving threadgroup locks can be in one of two states: no lock held, or holding the global lock. Explicitly declaring the different lock modes to make the code easier to understand and facilitates future extensions of the lock modes. Signed-off-by: Yi Tao Signed-off-by: Tejun Heo commit 5f0942581dd0218c4449dac0639cf362e943c302 Author: Matthew Maurer Date: Thu Sep 4 21:13:57 2025 +0000 rust: debugfs: Add support for scoped directories Introduces the concept of a `ScopedDir`, which allows for the creation of debugfs directories and files that are tied to the lifetime of a particular data structure. This ensures that debugfs entries do not outlive the data they refer to. The new `Dir::scope` method creates a new directory that is owned by a `Scope` handle. All files and subdirectories created within this scope are automatically cleaned up when the `Scope` is dropped. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-6-7d12a165685a@google.com [ Fix up Result<(), Error> -> Result; fix spurious backtick in doc-comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 6f227d21377c8b86bcacb266ee1f72bc937f4598 Author: Matthew Maurer Date: Thu Sep 4 21:13:56 2025 +0000 samples: rust: Add debugfs sample driver Adds a new sample driver that demonstrates the debugfs APIs. The driver creates a directory in debugfs and populates it with a few files: - A read-only file that displays a fwnode property. - A read-write file that exposes an atomic counter. - A read-write file that exposes a custom struct. This sample serves as a basic example of how to use the `debugfs::Dir` and `debugfs::File` APIs to create and manage debugfs entries. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-5-7d12a165685a@google.com [ Change ACPI ID "LNUXDEBF" to "LNUXBEEF". - Danilo ] Signed-off-by: Danilo Krummrich commit 40ecc49466c8b7f9518c5fbbcfb24cb7e26c36c7 Author: Matthew Maurer Date: Thu Sep 4 21:13:55 2025 +0000 rust: debugfs: Add support for callback-based files Extends the `debugfs` API to support creating files with content generated and updated by callbacks. This is done via the `read_callback_file`, `write_callback_file`, and `read_write_callback_file` methods. These methods allow for more flexible file definition, either because the type already has a `Writer` or `Reader` method that doesn't do what you'd like, or because you cannot implement it (e.g. because it's a type defined in another crate or a primitive type). Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-4-7d12a165685a@google.com [ Fix up Result<(), Error> -> Result. - Danilo ] Signed-off-by: Danilo Krummrich commit 839dc1d15b9ba5318ed145b20efffcfa91c02a3d Author: Matthew Maurer Date: Thu Sep 4 21:13:54 2025 +0000 rust: debugfs: Add support for writable files Extends the `debugfs` API to support creating writable files. This is done via the `Dir::write_only_file` and `Dir::read_write_file` methods, which take a data object that implements the `Reader` trait. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-3-7d12a165685a@google.com [ Fix up Result<()> -> Result. - Danilo ] Signed-off-by: Danilo Krummrich commit 5e40b591cb46c0379d5406fa5548c9b2a3801353 Author: Matthew Maurer Date: Thu Sep 4 21:13:53 2025 +0000 rust: debugfs: Add support for read-only files Extends the `debugfs` API to support creating read-only files. This is done via the `Dir::read_only_file` method, which takes a data object that implements the `Writer` trait. The file's content is generated by the `Writer` implementation, and the file is automatically removed when the returned `File` handle is dropped. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-2-7d12a165685a@google.com [ Fixup build failure when CONFIG_DEBUGFS=n. - Danilo ] Signed-off-by: Danilo Krummrich commit 7f201ca18c825592e392596a2fca2374dd2a4dfe Author: Matthew Maurer Date: Thu Sep 4 21:13:52 2025 +0000 rust: debugfs: Add initial support for directories Adds a `debugfs::Dir` type that can be used to create and remove DebugFS directories. The `Dir` handle automatically cleans up the directory on `Drop`. Signed-off-by: Matthew Maurer Tested-by: Dirk Behme Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250904-debugfs-rust-v11-1-7d12a165685a@google.com Signed-off-by: Danilo Krummrich commit 260435153c90c8e90553e456ec43578834a14a71 Author: Michael Riesch Date: Wed Sep 3 19:04:53 2025 +0200 phy: rockchip: phy-rockchip-inno-csidphy: allow for different reset lines The RK3588 MIPI CSI-2 DPHY variant requires two reset lines. Add support for different sets of reset lines to the phy-rockchip-inno-csidphy driver as preparation for the introduction of the RK3588 variant. Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-5-a4f340a7f0cf@collabora.com Signed-off-by: Vinod Koul commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 Author: Michael Riesch Date: Wed Sep 3 19:04:52 2025 +0200 phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF this offset is perfectly fine (in fact, register 0 is the only one in this register file). Introduce a boolean variable to indicate valid registers and allow writes to register 0. Reviewed-by: Neil Armstrong Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com Signed-off-by: Vinod Koul commit 5072b8e98eef4685a5a9a8bae56072cb65a2ef69 Author: Michael Riesch Date: Wed Sep 3 19:04:51 2025 +0200 dt-bindings: phy: rockchip-inno-csi-dphy: add rk3588 variant The Rockchip RK3588 variant of the CSI-2 DPHY features two reset lines. Add the variant and allow for the additional reset. While at it, fix the description of the first reset in order to avoid confusion. Signed-off-by: Michael Riesch Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-3-a4f340a7f0cf@collabora.com Signed-off-by: Vinod Koul commit c254815b02673cc77a84103c4c0d6197bd90c0ef Author: Michael Riesch Date: Wed Sep 3 19:04:50 2025 +0200 dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 variant) that are powered on by default as they are part of the ALIVE power domain. Remove 'power-domains' from the required properties in order to avoid false positives. Fixes: 22c8e0a69b7f ("dt-bindings: phy: add compatible for rk356x to rockchip-inno-csi-dphy") Cc: stable@kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-2-a4f340a7f0cf@collabora.com Signed-off-by: Vinod Koul commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b Author: Harikrishna Shenoy Date: Thu Aug 7 10:50:02 2025 +0530 phy: cadence: cdns-dphy: Enable lower resolutions in dphy Enable support for data lane rates between 80-160 Mbps cdns dphy as mentioned in TRM [0] by setting the pll_opdiv field to 16. This change enables lower resolutions like 640x480 at 60Hz. [0]: https://www.ti.com/lit/zip/spruil1 (Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions) Reviewed-by: Udit Kumar Reviewed-by: Devarsh Thakkar Signed-off-by: Harikrishna Shenoy Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com Signed-off-by: Vinod Koul commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 Author: Chen-Yu Tsai Date: Tue Sep 9 02:10:57 2025 +0800 arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset setting The external Ethernet PHY has a reset pin that is connected to the SoC. It is missing from the original submission. Add it to complete the description. Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 Author: Chen-Yu Tsai Date: Tue Sep 9 02:10:55 2025 +0800 arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting The external Ethernet PHY has a reset pin that is connected to the SoC. It is missing from the original submission. Add it to complete the description. Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit e4a8db93b5ec9bca1cc66b295544899e3afd5e86 Author: Michael Dege Date: Thu Jul 3 13:07:24 2025 +0200 phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet R-Car S4-8 datasheet Rev.1.20 describes some additional register settings at the end of the initialization. Signed-off-by: Michael Dege Link: https://lore.kernel.org/r/20250703-renesas-serdes-update-v4-2-1db5629cac2b@renesas.com Signed-off-by: Vinod Koul commit d337c557581eeb008a06d66ad72152e871967fa5 Author: Michael Dege Date: Thu Jul 3 13:07:23 2025 +0200 phy: renesas: r8a779f0-ether-serdes: add USXGMII mode The initial driver implementation was limited to SGMII and 1GBit/s. The new mode allows speeds up to 2.5GBit/s on R-Car S4-8 SOCs. Signed-off-by: Michael Dege Link: https://lore.kernel.org/r/20250703-renesas-serdes-update-v4-1-1db5629cac2b@renesas.com Signed-off-by: Vinod Koul commit 8d73829b78ca1a0e6eb93380f3bf5193d58c281c Author: Tom Lendacky Date: Wed Sep 10 17:19:28 2025 +0200 x86/startup/sev: Document the CPUID flow in the boot #VC handler Document the CPUID reading the different SEV guest types do - the SNP one which relies on the presence of a CPUID table and the SEV-ES one, which reads the CPUID supplied by the hypervisor. The intent being to clarify the two back-to-back, similar CPUID invocations. No functional changes. [ bp: Turn into a proper patch. ] Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/fbb24767-0e06-d1d6-36e0-1757d98aca66@amd.com commit f0c6d776f74d1d8bda94f6f042b2919bcd615280 Author: Inochi Amaoto Date: Tue Jul 8 14:30:37 2025 +0800 phy: sophgo: Add USB 2.0 PHY driver for Sophgo CV18XX/SG200X Add USB 2.0 PHY driver for Sophgo CV18XX/SG200X. Currently this driver does not support OTG mode as lack of document. Signed-off-by: Inochi Amaoto Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250708063038.497473-3-inochiama@gmail.com Signed-off-by: Vinod Koul commit cdb2511bf3925ce095c31e1647c12086d34f9cc2 Author: Inochi Amaoto Date: Tue Jul 8 14:30:36 2025 +0800 dt-bindings: phy: Add Sophgo CV1800 USB phy The USB phy of Sophgo CV18XX series SoC needs to sense a pin called "VBUS_DET" to get the right operation mode. If this pin is not connected, it only supports setting the mode manually. Add USB phy bindings for Sophgo CV18XX/SG200X series SoC. Signed-off-by: Inochi Amaoto Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250708063038.497473-2-inochiama@gmail.com Signed-off-by: Vinod Koul commit bf42df09b6aa4ebb596ecba66cf35b75362b55c7 Author: Arnd Bergmann Date: Tue Sep 2 16:03:26 2025 +0200 printk: kunit: support offstack cpumask For large values of CONFIG_NR_CPUS, the newly added kunit test fails to build: kernel/printk/printk_ringbuffer_kunit_test.c: In function 'test_readerwriter': kernel/printk/printk_ringbuffer_kunit_test.c:279:1: error: the frame size of 1432 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Change this to use cpumask_var_t and allocate it dynamically when CONFIG_CPUMASK_OFFSTACK is set. The variable has to be released via a KUnit action wrapper so that it is freed when the test fails and gets aborted. The parameter type is hardcoded to "struct cpumask *" because the macro KUNIT_DEFINE_ACTION_WRAPPER() does not accept an array. But the function does nothing when CONFIG_CPUMASK_OFFSTACK is not set anyway. Fixes: 5ea2bcdfbf46 ("printk: ringbuffer: Add KUnit test") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/all/20250620192554.2234184-1-arnd@kernel.org # v1 [pmladek@suse.com: Correctly handle allocation failures and freeing using KUnit test API.] Link: https://lore.kernel.org/all/20250702095157.110916-3-pmladek@suse.com # v2 Signed-off-by: Petr Mladek commit 2c27aaee934a1b5229152fe33a14f1fdf50da143 Author: Devarsh Thakkar Date: Fri Jul 4 18:29:15 2025 +0530 phy: cadence: cdns-dphy: Update calibration wait time for startup state machine Do read-modify-write so that we re-use the characterized reset value as specified in TRM [1] to program calibration wait time which defines number of cycles to wait for after startup state machine is in bandgap enable state. This fixes PLL lock timeout error faced while using RPi DSI Panel on TI's AM62L and J721E SoC since earlier calibration wait time was getting overwritten to zero value thus failing the PLL to lockup and causing timeout. [1] AM62P TRM (Section 14.8.6.3.2.1.1 DPHY_TX_DPHYTX_CMN0_CMN_DIG_TBIT2): Link: https://www.ti.com/lit/pdf/spruj83 Cc: stable@vger.kernel.org Fixes: 7a343c8bf4b5 ("phy: Add Cadence D-PHY support") Signed-off-by: Devarsh Thakkar Tested-by: Harikrishna Shenoy Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250704125915.1224738-3-devarsht@ti.com Signed-off-by: Vinod Koul commit 284fb19a3ffb1083c3ad9c00d29749d09dddb99c Author: Devarsh Thakkar Date: Fri Jul 4 18:29:14 2025 +0530 phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling PLL lockup and O_CMN_READY assertion can only happen after common state machine gets enabled by programming DPHY_CMN_SSM register, but driver was polling them before the common state machine was enabled which is incorrect. This is as per the DPHY initialization sequence as mentioned in J721E TRM [1] at section "12.7.2.4.1.2.1 Start-up Sequence Timing Diagram". It shows O_CMN_READY polling at the end after common configuration pin setup where the common configuration pin setup step enables state machine as referenced in "Table 12-1533. Common Configuration-Related Setup mentions state machine" To fix this : - Add new function callbacks for polling on PLL lock and O_CMN_READY assertion. - As state machine and clocks get enabled in power_on callback only, move the clock related programming part from configure callback to power_on callback and poll for the PLL lockup and O_CMN_READY assertion after state machine gets enabled. - The configure callback only saves the PLL configuration received from the client driver which will be applied later on in power_on callback. - Add checks to ensure configure is called before power_on and state machine is in disabled state before power_on callback is called. - Disable state machine in power_off so that client driver can re-configure the PLL by following up a power_off, configure, power_on sequence. [1]: https://www.ti.com/lit/zip/spruil1 Cc: stable@vger.kernel.org Fixes: 7a343c8bf4b5 ("phy: Add Cadence D-PHY support") Signed-off-by: Devarsh Thakkar Tested-by: Harikrishna Shenoy Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250704125915.1224738-2-devarsht@ti.com Signed-off-by: Vinod Koul commit c4272905c37930c19b54fa3549b22899122ce69e Author: Davidlohr Bueso Date: Mon Sep 8 09:00:34 2025 -0700 cxl/acpi: Rename CFMW coherency restrictions ACPICA commit 710745713ad3a2543dbfb70e84764f31f0e46bdc This has been renamed in more recent CXL specs, as type3 (memory expanders) can also use HDM-DB for device coherent memory. Link: https://github.com/acpica/acpica/commit/710745713ad3a2543dbfb70e84764f31f0e46bdc Acked-by: Rafael J. Wysocki (Intel) Signed-off-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20250908160034.86471-1-dave@stgolabs.net Signed-off-by: Dave Jiang commit 4dfa64181f23079077c7c1f7e9c342661f66f1d5 Merge: a414408126d13d e99ecbc4c89adf Author: Dave Jiang Date: Wed Sep 10 08:08:15 2025 -0700 Merge branch 'for-6.18/cxl-update-access-coordinates' into cxl-for-next Update the CXL memory hotplug notifier to update the NUMA node access coordinates directly rather than go through the HMAT memory hotplug notifier. commit a414408126d13d6d5b2d2c4e537295771cc256cb Author: Rakuram Eswaran Date: Mon Aug 18 23:23:34 2025 +0530 Documentation/driver-api: Fix typo error in cxl Fixed the following typo errors intersparsed ==> interspersed in Documentation/driver-api/cxl/platform/bios-and-efi.rst Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Gregory Price Link: https://patch.msgid.link/20250818175335.5312-1-rakuram.e96@gmail.com Signed-off-by: Dave Jiang commit 7df7b728c3cff1d61253c39e38e39c33bb4e7d09 Author: Mario Limonciello (AMD) Date: Mon Aug 11 11:26:06 2025 -0500 DRM: Add a new 'boot_display' attribute On systems with multiple GPUs there can be uncertainty which GPU is the primary one used to drive the display at bootup. In some desktop environments this can lead to increased power consumption because secondary GPUs may be used for rendering and never go to a low power state. In order to disambiguate this add a new sysfs attribute 'boot_display' that uses the output of video_is_primary_device() to populate whether the PCI device was used for driving the display. Suggested-by: Manivannan Sadhasivam Acked-by: Manivannan Sadhasivam Link: https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/issues/23 Reviewed-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250811162606.587759-5-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit ad90860bd10ee3ed387077aed88828b139339976 Author: Mario Limonciello (AMD) Date: Mon Aug 11 11:26:05 2025 -0500 fbcon: Use screen info to find primary device On systems with non VGA GPUs fbcon can't find the primary GPU because video_is_primary_device() only checks the VGA arbiter. Add a screen info check to video_is_primary_device() so that callers can get accurate data on such systems. Reviewed-by: Thomas Zimmermann Suggested-by: Thomas Zimmermann Suggested-by: Bjorn Helgaas Reviewed-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250811162606.587759-4-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 337bf13aa9ddab8ae47f2677ab75cf69ae33437b Author: Mario Limonciello (AMD) Date: Mon Aug 11 11:26:04 2025 -0500 PCI/VGA: Replace vga_is_firmware_default() with a screen info check vga_is_firmware_default() checks firmware resources to find the owner framebuffer resources to find the firmware PCI device. This is an open coded implementation of screen_info_pci_dev(). Switch to using screen_info_pci_dev() instead. Acked-by: Bjorn Helgaas Suggested-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250811162606.587759-3-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 6e490dea61b88aac9762c9f79a54aad4ea2e6cd1 Author: Mario Limonciello (AMD) Date: Mon Aug 11 11:26:03 2025 -0500 Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO When compiled without CONFIG_VIDEO the architecture specific implementations of video_is_primary_device() include prototypes and assume that video-common.c will be linked. Guard against this so that the fallback inline implementation that returns false will be used when compiled without CONFIG_VIDEO. Acked-by: Thomas Zimmermann Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506221312.49Fy1aNA-lkp@intel.com/ Link: https://lore.kernel.org/r/20250811162606.587759-2-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 9f5f69d98efbcd4edb1c191cf91418688145e0d5 Author: Marco Crivellari Date: Fri Sep 5 11:02:40 2025 +0200 io_uring: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jens Axboe commit 8577441d4a9c8fb5c6da1cde31708c3abb8d4cf8 Author: Marco Crivellari Date: Fri Sep 5 11:02:39 2025 +0200 io_uring: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jens Axboe commit 0e81960419ad186378b4cb55d7939d03c85262ab Author: Michal Simek Date: Mon Sep 8 15:33:48 2025 +0200 arm64: versal-net: Describe L1/L2/L3/LLC caches Add missing cache layout description. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/f740bf2d0af1e7e50d76196ec050c0fdbeceb049.1757338426.git.michal.simek@amd.com commit 21ad89cfade7724960a02ce675f6cd33f89515ed Author: Michal Simek Date: Tue Sep 2 09:56:21 2025 +0200 arm64: zynqmp: Enable DP in kr260/kv260 revA Enable DP output in both CC (Carrier Cards). Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/3160658ea2c4dd09a1d68918271177cf55437a8f.1756799774.git.michal.simek@amd.com commit eb4a09d8cc31c90adaa12136ffdb7b57a6410873 Author: Michal Simek Date: Tue Sep 2 09:56:20 2025 +0200 arm64: zynqmp: Describe ethernet controllers via aliases on SOM Add ethernet aliases to CC (Carrier card) description to create a connection which is used by U-BOOT (fdt_fixup_ethernet()) for updating local-mac-address in DT. On Kria SOM MAC address is read from i2c eeprom at start and based on it environment variables are created. Without creating aliases U-Boot is not able to inject local-mac-address DT property and OS won't get the same MAC address unless another i2c read is happening in OS. Also aliases are using string not phandle (because of dtso) that's why full path has to be provided but that shouldn't be a big issue because location of ethernet controller is fixed. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/72304150f87fd5e3338e31e2be8cf5d29955cc02.1756799774.git.michal.simek@amd.com commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c Author: Radhey Shyam Pandey Date: Tue Sep 2 09:56:19 2025 +0200 arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB Entry Keyboard) are not enumerated on linux boot due to commit 'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew rate")'. To fix it as a workaround revert to working version and then investigate at board level why drive strength from 12mA to 4mA and slew from fast to slow is not working. Signed-off-by: Radhey Shyam Pandey Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca Author: Quanyang Wang Date: Tue Sep 2 09:56:18 2025 +0200 arm64: zynqmp: Disable coresight by default When secure-boot mode of bootloader is enabled, the registers of coresight are not permitted to access that's why disable it by default. Signed-off-by: Quanyang Wang Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/7e308b8efe977c4912079b4d1b1ab3d24908559e.1756799774.git.michal.simek@amd.com commit 5e302106099efc8a309d92ad84cb37d35d6c3775 Author: Richard Acayan Date: Mon Sep 8 15:28:46 2025 +0300 pinctrl: qcom: Add SDM660 LPASS LPI TLMM The Snapdragon 660 has a Low-Power Island (LPI) TLMM for configuring pins related to audio. Add the driver for this. Also, this driver uses predefined pin_offsets for each pin taken from downstream driver, which does not follow the usual 0x1000 distance between pins and uses an array with predefined offsets that do not follow any regular pattern [1]. [1] https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/LA.UM.7.2.c27-07400-sdm660.0/drivers/pinctrl/qcom/pinctrl-lpi.c#L107 Reviewed-by: Konrad Dybcio Signed-off-by: Richard Acayan Co-developed-by: Nickolay Goppen Signed-off-by: Nickolay Goppen Signed-off-by: Linus Walleij commit 350027a3ef3f30f68a06d87e72f9bcc0dba49fb8 Author: Nickolay Goppen Date: Mon Sep 8 15:28:45 2025 +0300 dt-bindings: pinctrl: qcom: Add SDM660 LPI pinctrl Add bindings for pin controller in SDM660 Low Power Audio SubSystem (LPASS). Reviewed-by: Krzysztof Kozlowski Co-developed-by: Richard Acayan Signed-off-by: Richard Acayan Signed-off-by: Nickolay Goppen Signed-off-by: Linus Walleij commit 18d676ac0cce3e3aaa06f29553e53134e30c5f61 Author: Nickolay Goppen Date: Mon Sep 8 15:28:44 2025 +0300 pinctrl: qcom: lpass-lpi: Add ability to use custom pin offsets By default pin_offset is calculated by formula: LPI_TLMM_REG_OFFSET * pin_id. However not all platforms are using this pin_offset formula (e.g. SDM660 LPASS LPI uses a predefined array of offsets [1]), so extend lpi_pingroup struct with pin_offset field, introduce extended LPI_PINGROUP_OFFSET macro with pin_offet field and introduce LPI_FLAG_USE_PREDEFINED_PIN_OFFSET flag. This adds an ability to use predefined offset for pin if it exists. [1] https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/LA.UM.7.2.c27-07400-sdm660.0/drivers/pinctrl/qcom/pinctrl-lpi.c#L107 Reviewed-by: Konrad Dybcio Signed-off-by: Nickolay Goppen Signed-off-by: Linus Walleij commit 76d2d8f7b6348af5f524b7ed21b5ad7d9686971b Author: Loic Poulain Date: Tue Sep 9 21:46:36 2025 +0200 media: qcom: camss: Add missing header bitfield.h Add the header to prevent erros: >> drivers/media/platform/qcom/camss/camss-vfe-340.c:186:21: error: call to undeclared function 'FIELD_PREP'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 186 | if (bus_status & TFE_BUS_IRQ_MASK_RUP_DONE(i)) | ^ drivers/media/platform/qcom/camss/camss-vfe-340.c:36:40: note: expanded from macro 'TFE_BUS_IRQ_MASK_RUP_DONE' 36 | #define TFE_BUS_IRQ_MASK_RUP_DONE(sc) FIELD_PREP(TFE_BUS_IRQ_MASK_RUP_DONE_MASK, BIT(sc)) | ^ drivers/media/platform/qcom/camss/camss-vfe-340.c:191:21: error: call to undeclared function 'FIELD_PREP'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | if (bus_status & TFE_BUS_IRQ_MASK_BUF_DONE(i)) | ^ drivers/media/platform/qcom/camss/camss-vfe-340.c:38:40: note: expanded from macro 'TFE_BUS_IRQ_MASK_BUF_DONE' 38 | #define TFE_BUS_IRQ_MASK_BUF_DONE(sg) FIELD_PREP(TFE_BUS_IRQ_MASK_BUF_DONE_MASK, BIT(sg)) | ^ 2 errors generated. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509100228.xLeeYzpG-lkp@intel.com/ Signed-off-by: Loic Poulain Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Acked-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6a129b2ca5c533aec89fbeb58470811cc4102642 Author: Xianwei Zhao Date: Wed Sep 10 18:18:27 2025 +0800 MAINTAINERS: Add an entry for Amlogic spifc driver Add Amlogic spi flash controller entry to MAINTAINERS to clarify the maintainers. Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250910-spifc-v6-3-1574aa9baebd@amlogic.com Signed-off-by: Mark Brown commit 4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9 Author: Feng Chen Date: Wed Sep 10 18:18:26 2025 +0800 spi: amlogic: add driver for Amlogic SPI Flash Controller This driver provides support for the SPI mode of the Amlogic Flash Controller. It supports both SPI NOR flash and SPI NAND flash. For SPI NAND, the Host ECC hardware engine can be enabled. The controller implements the SPI-MEM interface and does not support generic SPI. Signed-off-by: Feng Chen Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250910-spifc-v6-2-1574aa9baebd@amlogic.com Signed-off-by: Mark Brown commit 0467d6c99d1c64210ee8c9621cd63b12301cab2e Author: Feng Chen Date: Wed Sep 10 18:18:25 2025 +0800 spi: dt-bindings: add Amlogic A113L2 SFC The Flash Controller is derived by adding an SPI path to the original raw NAND controller. This controller supports two modes: raw mode and SPI mode. The raw mode has already been implemented in the community, and the SPI mode is described here. Add bindings for Amlogic A113L2 SPI Flash Controller. Signed-off-by: Feng Chen Reviewed-by: Conor Dooley Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250910-spifc-v6-1-1574aa9baebd@amlogic.com Signed-off-by: Mark Brown commit 6f4f8abad4f2e4f679d88eae04dcb69b2ad7bd14 Merge: b2422712d15db9 bc4a45f8da56cd Author: Johannes Berg Date: Wed Sep 10 15:08:40 2025 +0200 Merge tag 'iwlwifi-next-2025-09-09' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi features, notably: - unused API cleanups - transport layer cleanups - new APIs support ==================== Signed-off-by: Johannes Berg commit b2422712d15db99c6e11a31a8df53e603604c494 Author: Zheng tan Date: Wed Sep 10 09:55:56 2025 +0800 wifi: cfg80211: Remove the redundant wiphy_dev There is no need to call wiphy_dev again.Simplifying the code makes it more readable. Signed-off-by: Zheng tan Reviewed-by: Arend van Spriel Link: https://patch.msgid.link/20250910015556.219298-1-tanzheng@kylinos.cn Signed-off-by: Johannes Berg commit 691009b7ef08f7c9adee19706c8865a7e4d87037 Author: Miri Korenblit Date: Mon Sep 8 12:27:45 2025 +0300 wifi: mac80211: fix incorrect comment As opposed to what the comment says, we don't count in the skb size of the association request frame the length of the Per STA Profile of the association link. Fix the comment. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250908122652.7022f33b1f33.Iac0d35744df883e8b96d71bbe8da518cc5d514bf@changeid Signed-off-by: Johannes Berg commit 185cc2352cb1ef2178fe4e9a220a73c94007b8bb Author: Miri Korenblit Date: Sun Sep 7 11:51:43 2025 +0300 wifi: cfg80211: update the time stamps in hidden ssid In hidden SSID we have separate BSS entries for the beacon and for the probe response(s). The BSS entry time stamps represent the age of the BSS; when was the last time we heard the BSS. When we receive a beacon of a hidden SSID it means that we heard that BSS, so it makes sense to indicate that in the probe response entries. Do that. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250907115135.712745e498c0.I38186abf5d20dec6f6f2d42d2e1cdb50c6bfea25@changeid Signed-off-by: Johannes Berg commit ea928544f3215fdeac24d66bef85e10bb638b8c1 Author: Ilan Peer Date: Sun Sep 7 11:51:17 2025 +0300 wifi: mac80211: Fix HE capabilities element check The element data length check did not account for the extra octet used for the extension ID. Fix it. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid Signed-off-by: Johannes Berg commit 906a5a8c7152ec2f76280f7224bb13adab64118c Author: Sarika Sharma Date: Fri Aug 22 10:51:10 2025 +0530 wifi: mac80211: add tx_handlers_drop statistics to ethtool Currently tx_handlers_drop statistics are handled only for slow TX path and only at radio level. This also requires CONFIG_MAC80211_DEBUG_COUNTERS to be enabled to account the dropped packets. There is no way to check these stats for fast TX, at interface level and monitor without enabling the debug configuration. Hence, add a new counter at the sdata level to track packets dropped with reason as TX_DROP during transmission for fast path, slow path and other tx management packets. Expose this via ethtool statistics, to improve visibility into transmission failures at interface level and aid debugging and performance monitoring. Place the counter in ethtool with other available tx_* stats for better readability and accurate tracking. Sample output: root@buildroot:~# ethtool -S wlan0 NIC statistics: rx_packets: 5904 rx_bytes: 508122 rx_duplicates: 12 rx_fragments: 5900 rx_dropped: 12 tx_packets: 391487 tx_bytes: 600423383 tx_filtered: 0 tx_retry_failed: 10332 tx_retries: 1548 tx_handlers_drop: 4 .... Co-developed-by: Hari Chandrakanthan Signed-off-by: Hari Chandrakanthan Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250822052110.513804-1-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit e6b84cc2a6fe62b4070d73f2d2d7b2544a11df87 Author: Chen-Yu Tsai Date: Tue Sep 9 02:10:53 2025 +0800 soc: sunxi: sram: register regmap as syscon If the system controller had a ethernet controller glue layer control register, a limited access regmap would be registered and tied to the system controller struct device for the ethernet driver to use. Until now, for the ethernet driver to acquire this regmap, it had to do a of_parse_phandle() + find device + dev_get_regmap() sequence. Since the syscon framework allows a provider to register a custom regmap for its device node, and the ethernet driver already uses syscon for one platform, this provides a much more easier way to pass the regmap. Use of_syscon_register_regmap() to register our regmap with the syscon framework so that consumers can retrieve it that way. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250908181059.1785605-5-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 30849ab484f7397c9902082c7567ca4cd4eb03d3 Author: Chen-Yu Tsai Date: Tue Sep 9 02:10:52 2025 +0800 soc: sunxi: sram: add entry for a523 The A523 has two Ethernet controllers. So in the system controller address space, there are two registers for Ethernet clock delays, one for each controller. Add a new entry for the A523 system controller that allows access to the second register. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250908181059.1785605-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit d32bb69523b86c85fc91d4c8a6d8313639ac1c1c Author: Jean-François Lessard Date: Tue Sep 2 15:04:40 2025 -0400 i2c: core: Use fwnode_for_each_child_node_scoped() Replace the manual __free(fwnode_handle) iterator declaration with the new scoped iterator macro for cleaner, less error-prone code. This eliminates the need for explicit iterator variable declaration with the cleanup attribute, making the code more consistent with other scoped iterator usage patterns in the kernel. Signed-off-by: Jean-François Lessard Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Signed-off-by: Wolfram Sang commit 448097bbd3836d2ee46fa6eabd18661e9a3c8be8 Author: Jean-François Lessard Date: Tue Sep 2 15:04:39 2025 -0400 device property: Add scoped fwnode child node iterators Add scoped versions of fwnode child node iterators that automatically handle reference counting cleanup using the __free() attribute: - fwnode_for_each_child_node_scoped() - fwnode_for_each_available_child_node_scoped() These macros follow the same pattern as existing scoped iterators in the kernel, ensuring fwnode references are automatically released when the iterator variable goes out of scope. This prevents resource leaks and eliminates the need for manual cleanup in error paths. The implementation mirrors the non-scoped variants but uses __free(fwnode_handle) for automatic resource management, providing a safer and more convenient interface for drivers iterating over firmware node children. Signed-off-by: Jean-François Lessard Acked-by: Danilo Krummrich Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Signed-off-by: Wolfram Sang commit e66ae377fe219c98d3d5b8a0d35da4413a5390ca Author: Tiwei Bie Date: Sun Aug 10 13:51:33 2025 +0800 um: Remove unused ipi_pipe field from cpuinfo_um It's no longer used after the removal of the SMP implementation in TT mode by commit 28fa468f5316 ("um: Remove broken SMP support"). While at it, remove the outdated comment. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit be6a0372be581b80a4f0083687d45c30289094ca Author: Tiwei Bie Date: Sun Aug 10 13:51:28 2025 +0800 um: Remove unused cpu_data and current_cpu_data macros These two macros have no users. Remove them. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit a73a9aad8a81934ab50201ba23107fd321612caf Author: Tiwei Bie Date: Sun Aug 10 13:51:27 2025 +0800 um: Stop tracking virtual CPUs via mm_cpumask() In UML, each user address space is represented as a separate stub process on the host. Therefore, user address spaces do not require TLB management on UML virtual CPUs, and it's unnecessary to track which virtual CPUs they have executed on. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit e047f9af9d6948728614f7eea41ba53d5b767e9f Author: Tiwei Bie Date: Wed Aug 27 08:57:03 2025 +0800 um: Centralize stub size calculations Currently, the stub size is calculated in multiple places. Define a macro that performs the calculation so that the code is easier to read and maintain. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit b765d69a1adf83b969f1f0c8353b80c3c18ef2f7 Author: Tiwei Bie Date: Wed Aug 27 08:57:02 2025 +0800 um: Remove outdated comment about STUB_DATA_PAGES STUB_DATA_PAGES is no longer required to be a power of two since commit 91f0a0c5cc5b ("um: Calculate stub data address relative to stub code"). Remove the outdated comment. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 78624eb99e1ab1d16c8a7172ac9c6bdefb7befe3 Author: Tiwei Bie Date: Wed Aug 27 08:57:01 2025 +0800 um: Remove unused offset and child_err fields from stub_data They are no longer used. Remove them. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 4c134c2a5f3db29afe35b2d30e39bb6d867b08da Author: Tiwei Bie Date: Wed Aug 27 08:57:00 2025 +0800 um: Indent time-travel help messages Indent the help messages for time-travel to make them consistent with the format of other help messages. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 725e9d81868fcedaeef775948e699955b01631ae Author: Tiwei Bie Date: Wed Aug 27 08:56:59 2025 +0800 um: Fix help message for ssl-non-raw Add the missing option name in the help message. Additionally, switch to __uml_help(), because this is a global option rather than a per-channel option. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 2cc62ed234f1038abb9601ccfcaeafa31891e3fe Author: Tiwei Bie Date: Wed Aug 27 08:56:58 2025 +0800 um: vector: Fix indentation for help message For consistency with other help messages, use four spaces for indentation instead of a tab plus a space. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 26577cfbe1d6b4b98af916f342f44fd25d13af23 Author: Tiwei Bie Date: Wed Aug 27 08:56:57 2025 +0800 um: Add missing trailing newline to help messages Some help messages are missing a trailing newline. They should end with two newlines, but only one is present. Add the missing newline to make the --help output more readable. Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit a0830785e89da3019a815b51b2073d00bf06e8c1 Author: Johannes Berg Date: Wed Aug 27 21:35:35 2025 +0200 um: virtio-pci: implement .shutdown() We don't want queues stopped since the shutdown can still be doing things with PCI devices, so implement .shutdown() to avoid the generic virtio shutdown. Signed-off-by: Johannes Berg commit 35fae10aaf080c2de06a80463e1129e588600db8 Author: Sinan Nalkaya Date: Wed Aug 27 15:04:18 2025 -0700 um: Support SPARSE_IRQ Motivation: IRQ KUnit tests are going to require CONFIG_SPARSE_IRQ [1] in order to: (a) reliably allocate additional (fake) IRQs and (b) ensure we can test managed affinity, which is only supported with SPARSE_IRQ. It seems that the only thing necessary for ARCH=um is to tell the genirq core to skip over our preallocated NR_IRQS. Tested with: $ ./tools/testing/kunit/kunit.py run [...] [13:55:58] Testing complete. Ran 676 tests: passed: 646, skipped: 30 [...] This compares with pre-patch results: Ran 672 tests: passed: 644, skipped: 28 i.e., we no longer skip tests that 'depend on SPARSE_IRQ', and existing tests all pass. [1] [PATCH v2 4/6] genirq/test: Depend on SPARSE_IRQ https://lore.kernel.org/all/CABVgOSngoD0fh1WEkUCEwSdk0Joypo3dA_Y_SjW+K=nVDnZs3Q@mail.gmail.com/ Signed-off-by: Sinan Nalkaya [Brian: Adapted Sinan's patch; rewrote commit message] Signed-off-by: Brian Norris Tested-by: David Gow Signed-off-by: Johannes Berg commit 702fdf3513b045f596f836d9a4b8672c76f11834 Merge: b69f8c496ea05f 4bf83dd6e3b3b2 Author: Rodrigo Vivi Date: Wed Sep 10 08:01:42 2025 -0400 Merge drm/drm-next into drm-intel-next Catching up with some display dependencies. Signed-off-by: Rodrigo Vivi commit a75fe12fa2e2f96b619f25b8cda1fdef6d616ab1 Author: Yu Kuai Date: Wed Sep 10 16:04:45 2025 +0800 blk-mq: fix stale nr_requests documentation The nr_requests documentation is still the removed single queue, remove it and update to current blk-mq. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 9784041145796994f2b21f4c7e628d7c9db762f4 Author: Yu Kuai Date: Wed Sep 10 16:04:44 2025 +0800 blk-mq: remove blk_mq_tag_update_depth() This helper is not used now. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit b86433721f46d934940528f28d49c1dedb690df1 Author: Yu Kuai Date: Wed Sep 10 16:04:43 2025 +0800 blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is a long term problem, hence allocate memory before freezing queue and free memory after queue is unfreezed. [1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ Fixes: e3a2b3f931f5 ("blk-mq: allow changing of queue depth through sysfs") Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 6293e336f6d7d3f3415346ce34993b3398846166 Author: Yu Kuai Date: Wed Sep 10 16:04:42 2025 +0800 blk-mq-sched: add new parameter nr_requests in blk_mq_alloc_sched_tags() This helper only support to allocate the default number of requests, add a new parameter to support specific number of requests. Prepare to fix potential deadlock in the case nr_requests grow. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit e63200404477456ec60c62dd8b3b1092aba2e211 Author: Yu Kuai Date: Wed Sep 10 16:04:41 2025 +0800 blk-mq: split bitmap grow and resize case in blk_mq_update_nr_requests() No functional changes are intended, make code cleaner and prepare to fix the grow case in following patches. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 7f2799c546dba9e12f9ff4d07936601e416c640d Author: Yu Kuai Date: Wed Sep 10 16:04:40 2025 +0800 blk-mq: cleanup shared tags case in blk_mq_update_nr_requests() For shared tags case, all hctx->sched_tags/tags are the same, it doesn't make sense to call into blk_mq_tag_update_depth() multiple times for the same tags. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 626ff4f8ebcb7207f01e7810acb85812ccf06bd8 Author: Yu Kuai Date: Wed Sep 10 16:04:39 2025 +0800 blk-mq: convert to serialize updating nr_requests with update_nr_hwq_lock request_queue->nr_requests can be changed by: a) switch elevator by updating nr_hw_queues b) switch elevator by elevator sysfs attribute c) configue queue sysfs attribute nr_requests Current lock order is: 1) update_nr_hwq_lock, case a,b 2) freeze_queue 3) elevator_lock, case a,b,c And update nr_requests is seriablized by elevator_lock() already, however, in the case c, we'll have to allocate new sched_tags if nr_requests grow, and do this with elevator_lock held and queue freezed has the risk of deadlock. Hence use update_nr_hwq_lock instead, make it possible to allocate memory if tags grow, meanwhile also prevent nr_requests to be changed concurrently. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit b46d4c447db76e36906ed59ebb9b3ef8f3383322 Author: Yu Kuai Date: Wed Sep 10 16:04:38 2025 +0800 blk-mq: check invalid nr_requests in queue_requests_store() queue_requests_store() is the only caller of blk_mq_update_nr_requests(), and blk_mq_update_nr_requests() is the only caller of blk_mq_tag_update_depth(), however, they all have checkings for nr_requests input by user. Make code cleaner by moving all the checkings to the top function: 1) nr_requests > reserved tags; 2) if there is elevator, 4 <= nr_requests <= 2048; 3) if elevator is none, 4 <= nr_requests <= tag_set->queue_depth; Meanwhile, case 2 is the only case tags can grow and -ENOMEM might be returned. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 8bd7195fea6d9662aa3b32498a3828bfd9b63185 Author: Yu Kuai Date: Wed Sep 10 16:04:37 2025 +0800 blk-mq: remove useless checkings in blk_mq_update_nr_requests() 1) queue_requests_store() is the only caller of blk_mq_update_nr_requests(), where queue is already freezed, no need to check mq_freeze_depth; 2) q->tag_set must be set for request based device, and queue_is_mq() is already checked in blk_mq_queue_attr_visible(), no need to check q->tag_set. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit dc1dd13d44fa4e4d466476c0f3517c1230c237e4 Author: Yu Kuai Date: Wed Sep 10 16:04:36 2025 +0800 blk-mq: remove useless checking in queue_requests_store() blk_mq_queue_attr_visible() already checked queue_is_mq(), no need to check this again in queue_requests_store(). Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 97e8ba31b8f1b743c918bf31586cdc272376226b Author: Caleb Sander Mateos Date: Mon Sep 8 12:45:41 2025 -0600 ublk: consolidate nr_io_ready and nr_queues_ready ublk_mark_io_ready() tracks whether all the ublk_device's I/Os have been fetched by incrementing ublk_queue's nr_io_ready count and incrementing ublk_device's nr_queues_ready count if the whole queue is ready. Simplify the logic by just tracking the total number of fetched I/Os on each ublk_device. When this count reaches nr_hw_queues * queue_depth, the ublk_device is ready to receive I/O. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit e0ed2bca7bef9267da0928a8ed6d1de41f19ecf6 Author: Yu Kuai Date: Wed Sep 10 14:30:56 2025 +0800 md/raid0: convert raid0_make_request() to use bio_submit_split_bioset() Currently, raid0_make_request() will remap the original bio to underlying disks to prevent reordered IO. Now that bio_submit_split_bioset() will put original bio to the head of current->bio_list, it's safe converting to use this helper and bio will still be ordered. CC: Jan Kara Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit b2f5974079d82a4761f002e80601064d4e39a81f Author: Yu Kuai Date: Wed Sep 10 14:30:55 2025 +0800 block: fix ordering of recursive split IO Currently, split bio will be chained to original bio, and original bio will be resubmitted to the tail of current->bio_list, waiting for split bio to be issued. However, if split bio get split again, the IO order will be messed up. This problem, on the one hand, will cause performance degradation, especially for mdraid with large IO size; on the other hand, will cause write errors for zoned block devices[1]. For example, in raid456 IO will first be split by max_sector from md_submit_bio(), and then later be split again by chunksize for internal handling: For example, assume max_sectors is 1M, and chunksize is 512k 1) issue a 2M IO: bio issuing: 0+2M current->bio_list: NULL 2) md_submit_bio() split by max_sector: bio issuing: 0+1M current->bio_list: 1M+1M 3) chunk_aligned_read() split by chunksize: bio issuing: 0+512k current->bio_list: 1M+1M -> 512k+512k 4) after first bio issued, __submit_bio_noacct() will contuine issuing next bio: bio issuing: 1M+1M current->bio_list: 512k+512k bio issued: 0+512k 5) chunk_aligned_read() split by chunksize: bio issuing: 1M+512k current->bio_list: 512k+512k -> 1536k+512k bio issued: 0+512k 6) no split afterwards, finally the issue order is: 0+512k -> 1M+512k -> 512k+512k -> 1536k+512k This behaviour will cause large IO read on raid456 endup to be small discontinuous IO in underlying disks. Fix this problem by placing split bio to the head of current->bio_list. Test script: test on 8 disk raid5 with 64k chunksize dd if=/dev/md0 of=/dev/null bs=4480k iflag=direct Test results: Before this patch 1) iostat results: Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util md0 52430.00 3276.87 0.00 0.00 0.62 64.00 32.60 80.10 sd* 4487.00 409.00 2054.00 31.40 0.82 93.34 3.68 71.20 2) blktrace G stage: 8,0 0 486445 11.357392936 843 G R 14071424 + 128 [dd] 8,0 0 486451 11.357466360 843 G R 14071168 + 128 [dd] 8,0 0 486454 11.357515868 843 G R 14071296 + 128 [dd] 8,0 0 486468 11.357968099 843 G R 14072192 + 128 [dd] 8,0 0 486474 11.358031320 843 G R 14071936 + 128 [dd] 8,0 0 486480 11.358096298 843 G R 14071552 + 128 [dd] 8,0 0 486490 11.358303858 843 G R 14071808 + 128 [dd] 3) io seek for sdx: Noted io seek is the result from blktrace D stage, statistic of: ABS((offset of next IO) - (offset + len of previous IO)) Read|Write seek cnt 55175, zero cnt 25079 >=(KB) .. <(KB) : count ratio |distribution | 0 .. 1 : 25079 45.5% |########################################| 1 .. 2 : 0 0.0% | | 2 .. 4 : 0 0.0% | | 4 .. 8 : 0 0.0% | | 8 .. 16 : 0 0.0% | | 16 .. 32 : 0 0.0% | | 32 .. 64 : 12540 22.7% |##################### | 64 .. 128 : 2508 4.5% |##### | 128 .. 256 : 0 0.0% | | 256 .. 512 : 10032 18.2% |################# | 512 .. 1024 : 5016 9.1% |######### | After this patch: 1) iostat results: Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util md0 87965.00 5271.88 0.00 0.00 0.16 61.37 14.03 90.60 sd* 6020.00 658.44 5117.00 45.95 0.44 112.00 2.68 86.50 2) blktrace G stage: 8,0 0 206296 5.354894072 664 G R 7156992 + 128 [dd] 8,0 0 206305 5.355018179 664 G R 7157248 + 128 [dd] 8,0 0 206316 5.355204438 664 G R 7157504 + 128 [dd] 8,0 0 206319 5.355241048 664 G R 7157760 + 128 [dd] 8,0 0 206333 5.355500923 664 G R 7158016 + 128 [dd] 8,0 0 206344 5.355837806 664 G R 7158272 + 128 [dd] 8,0 0 206353 5.355960395 664 G R 7158528 + 128 [dd] 8,0 0 206357 5.356020772 664 G R 7158784 + 128 [dd] 3) io seek for sdx Read|Write seek cnt 28644, zero cnt 21483 >=(KB) .. <(KB) : count ratio |distribution | 0 .. 1 : 21483 75.0% |########################################| 1 .. 2 : 0 0.0% | | 2 .. 4 : 0 0.0% | | 4 .. 8 : 0 0.0% | | 8 .. 16 : 0 0.0% | | 16 .. 32 : 0 0.0% | | 32 .. 64 : 7161 25.0% |############## | BTW, this looks like a long term problem from day one, and large sequential IO read is pretty common case like video playing. And even with this patch, in this test case IO is merged to at most 128k is due to block layer plug limit BLK_PLUG_FLUSH_SIZE, increase such limit can get even better performance. However, we'll figure out how to do this properly later. [1] https://lore.kernel.org/all/e40b076d-583d-406b-b223-005910a9f46f@acm.org/ Fixes: d89d87965dcb ("When stacked block devices are in-use (e.g. md or dm), the recursive calls") Reported-by: Tie Ren Closes: https://lore.kernel.org/all/7dro5o7u5t64d6bgiansesjavxcuvkq5p2pok7dtwkav7b7ape@3isfr44b6352/ Signed-off-by: Yu Kuai Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0b64682e78f7a53ea863e368b1aa66f05767858d Author: Yu Kuai Date: Wed Sep 10 14:30:54 2025 +0800 block: skip unnecessary checks for split bio Lots of checks are already done while submitting this bio the first time, and there is no need to check them again when this bio is resubmitted after split. Hence open code should_fail_bio() and blk_throtl_bio() that are still necessary from submit_bio_split_bioset(). Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e3290419d9be6cbd7a42c0691504dd66825cabf5 Author: Yu Kuai Date: Wed Sep 10 14:30:53 2025 +0800 blk-crypto: convert to use bio_submit_split_bioset() Unify bio split code, prepare to fix ordering of split IO. Signed-off-by: Yu Kuai Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 6529d41d87827f9a27f6c0c6d34c2b77b250b6c6 Author: Yu Kuai Date: Wed Sep 10 14:30:52 2025 +0800 md/md-linear: convert to use bio_submit_split_bioset() Unify bio split code, prepare to fix reordered split IO. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9e8a5b37c9ea3ae9db9028ea756ececf221d9a5a Author: Yu Kuai Date: Wed Sep 10 14:30:51 2025 +0800 md/raid5: convert to use bio_submit_split_bioset() Unify bio split code, prepare to fix ordering of split IO. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 6fc07785d9b89255bba45fc84475bb32f9737a90 Author: Yu Kuai Date: Wed Sep 10 14:30:50 2025 +0800 md/raid10: convert read/write to use bio_submit_split_bioset() Unify bio split code, prepare to fix ordering of split IO, the error path is modified a bit, however no functional changes are intended: - bio_submit_split_bioset() can fail the original bio directly by split error, set R10BIO_Uptodate in this case to notify raid_end_bio_io() that the original bio is returned already. - set R10BIO_Uptodate and set error value to -EIO is useless now, for r10_bio without R10BIO_Uptodate, -EIO will be returned for original bio. And discard is not handled, because discard is only split for unaligned head and tail, and this can be considered slow path, the reorder here does not matter much. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit deeeab3028afebf2f13428f69dcba9f572f0463b Author: Yu Kuai Date: Wed Sep 10 14:30:49 2025 +0800 md/raid10: add a new r10bio flag R10BIO_Returned The new helper bio_submit_split_bioset() can failed the orginal bio on split errors, prepare to handle this case in raid_end_bio_io(). The flag name is refer to the r1bio flag name. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit a6fcc160d6fd9b4ddd229e351518daee21eecad7 Author: Yu Kuai Date: Wed Sep 10 14:30:48 2025 +0800 md/raid1: convert to use bio_submit_split_bioset() Unify bio split code, and prepare to fix ordering of split IO. Noted that bio_submit_split_bioset() can fail the original bio directly by split error, set R1BIO_Returned in this case to notify raid_end_bio_io() that the original bio is returned already. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 5b38ee5a4a12cfdefd848f7ec09da3e9007ad55f Author: Yu Kuai Date: Wed Sep 10 14:30:47 2025 +0800 md/raid0: convert raid0_handle_discard() to use bio_submit_split_bioset() Unify bio split code, and prepare to fix ordering of split IO Noted commit 319ff40a5427 ("md/raid0: Fix performance regression for large sequential writes") already fix ordering of split IO by remapping bio to underlying disks before resubmitting it, with the respect md_submit_bio() already split it by sectors, and raid0_make_request() will split at most once for unaligned IO. This is a bit hacky and we'll convert this to solution in general later. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e37b5596a19be9a150cb194ec32e78f295a3574b Author: Yu Kuai Date: Wed Sep 10 14:30:46 2025 +0800 block: factor out a helper bio_submit_split_bioset() No functional changes are intended, some drivers like mdraid will split bio by internal processing, prepare to unify bio split codes. Signed-off-by: Yu Kuai Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 06d712d297649f48ebf1381d19bd24e942813b37 Author: Yu Kuai Date: Wed Sep 10 14:30:45 2025 +0800 blk-crypto: fix missing blktrace bio split events trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence. Cc: stable@vger.kernel.org Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption") Signed-off-by: Yu Kuai Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 22f166218f7313e8fe2d19213b5f4b3265f8c39e Author: Yu Kuai Date: Wed Sep 10 14:30:44 2025 +0800 md: fix mssing blktrace bio split events If bio is split by internal handling like chunksize or badblocks, the corresponding trace_block_split() is missing, resulting in blktrace inability to catch BIO split events and making it harder to analyze the BIO sequence. Cc: stable@vger.kernel.org Fixes: 4b1faf931650 ("block: Kill bio_pair_split()") Signed-off-by: Yu Kuai Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit ea3d1f104db60f9d5074b33819ccea3c216e0bee Author: Yu Kuai Date: Wed Sep 10 14:30:43 2025 +0800 blk-mq: add QUEUE_FLAG_BIO_ISSUE_TIME bio->issue_time_ns is initialized for every bio, however, it's only used by blk-iolatency. Add a new queue_flag and only set this flag when blk-iolatency is enabled, so that extra blk_time_get_ns() can be saved for disks that blk-iolatency is not enabled. Signed-off-by: Yu Kuai Signed-off-by: Jens Axboe commit 1f963bdd6420b6080bcfd0ee84a75c96f35545a6 Author: Yu Kuai Date: Wed Sep 10 14:30:42 2025 +0800 block: initialize bio issue time in blk_mq_submit_bio() bio->issue_time_ns is only used by blk-iolatency, which can only be enabled for rq-based disk, hence it's not necessary to initialize the time for bio-based disk. Meanwhile, if bio is split by blk_crypto_fallback_split_bio_if_needed(), the issue time is not initialized for new split bio, this can be fixed as well. Noted the next patch will optimize better that bio issue time will only be used when blk-iolatency is really enabled by the disk. Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption") Signed-off-by: Yu Kuai Signed-off-by: Jens Axboe commit 1733e88874838ddebf7774440c285700865e6b08 Author: Yu Kuai Date: Wed Sep 10 14:30:41 2025 +0800 block: cleanup bio_issue Now that bio->bi_issue is only used by blk-iolatency to get bio issue time, replace bio_issue with u64 time directly and remove bio_issue to make code cleaner. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 3c30d57544bf91d6adaf3cab8474194e4c4404bc Author: Takashi Iwai Date: Wed Sep 10 13:09:29 2025 +0200 ALSA: sparc/dbri: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 4baca4bf866c32ab8a3d67e1ad10aa35d93ae134 Author: Takashi Iwai Date: Wed Sep 10 13:09:28 2025 +0200 ALSA: sparc/cs4231: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 4c680628ad09027d5f1b2ba8393da680e2256570 Author: Takashi Iwai Date: Wed Sep 10 13:09:27 2025 +0200 ALSA: sparc/amd7930: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 02d0aba676ee07481a613a032897528247d31d34 Author: Takashi Iwai Date: Wed Sep 10 13:09:26 2025 +0200 ALSA: usb-audio: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit d5323227325696b6458eae3cf84705f5caa595fb Author: Takashi Iwai Date: Wed Sep 10 13:09:25 2025 +0200 ALSA: usb: fcp: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit bdcdb4e7aa410122baa3496b93e7850dc20a90fa Author: Takashi Iwai Date: Wed Sep 10 13:09:24 2025 +0200 ALSA: line6: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit d20cce1ca598231367c05a55e674d243612f3353 Author: Takashi Iwai Date: Wed Sep 10 13:09:23 2025 +0200 ALSA: ppc: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 97bffca637975c6025b5bc5a3bf9926cc6985eab Author: Takashi Iwai Date: Wed Sep 10 13:09:22 2025 +0200 ALSA: snd_ps3: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit f1998e16b2566514b31a98bad6950ea96042c465 Author: Takashi Iwai Date: Wed Sep 10 13:09:21 2025 +0200 ALSA: parisc: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit b10b93d1930b1db77df70157efd68695ecaf8c9d Author: Takashi Iwai Date: Wed Sep 10 13:09:20 2025 +0200 ALSA: snd-n64: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit f5bf18b076a685a7529dd61e31fc7f9904f5ac56 Author: Takashi Iwai Date: Wed Sep 10 13:09:19 2025 +0200 ALSA: sgio2audio: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 2d7d8e0fa54617a31b840a62541afe9669f38d38 Author: Takashi Iwai Date: Wed Sep 10 13:09:18 2025 +0200 ALSA: arm: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit 56100eed4f1dbe689b759064dd7d2d5b3604c80c Author: Takashi Iwai Date: Wed Sep 10 13:09:17 2025 +0200 ALSA: aoa: Don't split string across lines We shouldn't split a quoted string, as it worsens the grep-ability. Put back to the single line, which also makes checkpatch.pl happier. Signed-off-by: Takashi Iwai commit 207cd1de01e398cd3d9a270bb78f8ca9388267d8 Author: Takashi Iwai Date: Wed Sep 10 13:09:16 2025 +0200 ALSA: aoa: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai commit a2d100c47f4eccb0cb6c2a6a915f2c9e13b54ae7 Author: Johan Hovold Date: Mon Sep 8 17:22:13 2025 +0200 cpuidle: qcom-spm: drop unnecessary initialisations Drop the unnecessary initialisations of the platform device and driver data pointers which are assigned on first use when registering the cpuidle device during probe. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Signed-off-by: Rafael J. Wysocki commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 Author: Johan Hovold Date: Mon Sep 8 17:22:12 2025 +0200 cpuidle: qcom-spm: fix device and OF node leaks at probe Make sure to drop the reference to the saw device taken by of_find_device_by_node() after retrieving its driver data during probe(). Also drop the reference to the CPU node sooner to avoid leaking it in case there is no saw node or device. Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Signed-off-by: Rafael J. Wysocki commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d Author: Sohil Mehta Date: Mon Sep 8 16:06:55 2025 -0700 cpufreq: ondemand: Update the efficient idle check for Intel extended Families IO time is considered busy by default for modern Intel processors. The current check covers recent Family 6 models but excludes the brand new Families 18 and 19. According to Arjan van de Ven, the model check was mainly due to a lack of testing on systems before INTEL_CORE2_MEROM. He suggests considering all Intel processors as having an efficient idle. Extend the IO busy classification to all Intel processors starting with Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19. Use an x86 VFM check and move the function to the header file to avoid using arch-specific #ifdefs in the C file. Signed-off-by: Sohil Mehta Link: https://patch.msgid.link/20250908230655.2562440-1-sohil.mehta@intel.com [ rjw: Added empty line after #include ] Signed-off-by: Rafael J. Wysocki commit 5590db443a40a35d7fba2db12701346be621a19e Author: Kaushlendra Kumar Date: Sat Sep 6 17:23:16 2025 +0530 cpufreq: conservative: Replace sscanf() with kstrtouint() Replace sscanf() with kstrtouint() in all sysfs store functions to improve input validation and security. The kstrtouint() function provides better error detection, overflow protection, and consistent error handling compared to sscanf(). This maintains existing functionality while improving input validation robustness and following kernel coding best practices for string parsing. Signed-off-by: Kaushlendra Kumar Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250906115316.3010384-1-kaushlendra.kumar@intel.com [ rjw: Dropped duplicate paragraph from the changelog ] Signed-off-by: Rafael J. Wysocki commit 12a565af705542c4380e95f4e3a505a2c25ad754 Author: Mateusz Koza Date: Mon Sep 8 15:05:37 2025 +0200 dt-bindings: arm: mediatek: Add grinn,genio-510-sbc Add device tree bindings support for the Grinn GenioSBC-510, a single-board computer based on the MediaTek Genio 510 SoC. More details about the hardware: - https://grinn-global.com/products/grinn-geniosom-510 - https://grinn-global.com/products/grinn-genioboard-edge-ai-sbc Acked-by: Conor Dooley Signed-off-by: Mateusz Koza Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250908130620.2309399-5-mateusz.koza@grinn-global.com Signed-off-by: Matthias Brugger commit 930b6fe1a50c7ba69608230322614c87ea3dd35e Author: Mateusz Koza Date: Mon Sep 8 15:05:35 2025 +0200 dt-bindings: arm: mediatek: Add grinn,genio-700-sbc Add device tree bindings support for the Grinn GenioSBC-700, a single-board computer based on the MediaTek Genio 700 SoC. More details about the hardware: - https://grinn-global.com/products/grinn-geniosom-700 - https://grinn-global.com/products/grinn-genioboard-edge-ai-sbc Acked-by: Conor Dooley Signed-off-by: Mateusz Koza Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250908130620.2309399-3-mateusz.koza@grinn-global.com Signed-off-by: Matthias Brugger commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 Author: Johan Hovold Date: Tue Sep 9 11:56:51 2025 +0200 soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure Make sure to drop the references taken by of_find_device_by_node() when looking up the thermal sensor and opp devices during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver") Cc: Roger Lu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org Signed-off-by: Matthias Brugger commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 Author: Johan Hovold Date: Tue Sep 9 11:56:50 2025 +0200 soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure Make sure to drop the references taken by of_find_device_by_node() when looking up the thermal sensor and opp devices during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine") Cc: Roger Lu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org Signed-off-by: Matthias Brugger commit 3804cef4c59742cf695e7b41a9aabe8d5bb25ca2 Author: Aaron Kling Date: Sat Sep 6 15:16:54 2025 -0500 memory: tegra210: Use bindings for client ids Since the related binding is being added, use that for the client ids instead of hardcoded magic numbers. Signed-off-by: Aaron Kling Signed-off-by: Krzysztof Kozlowski commit 5f5598d945e2a69f764aa5c2074dad73e23bcfcb Author: Aaron Kling Date: Sat Sep 6 15:16:53 2025 -0500 dt-bindings: memory: tegra210: Add memory client IDs Each memory client has unique hardware ID, add these IDs. Signed-off-by: Aaron Kling Signed-off-by: Krzysztof Kozlowski commit 550faad18505aac40a1551a5b467e0a63bf2d639 Author: Aaron Kling Date: Sat Sep 6 15:16:52 2025 -0500 dt-bindings: memory: tegra210: emc: Document OPP table and interconnect These are needed for dynamic frequency scaling of the EMC controller. Signed-off-by: Aaron Kling Signed-off-by: Krzysztof Kozlowski commit 7acbe30813f04cccf7b2e8b571eb7936cfec0a87 Author: Jacek Lawrynowicz Date: Wed Sep 10 10:55:25 2025 +0200 MAINTAINERS: Remove Jacek Lawrynowicz as intel_vpu maintainer Remove myself from the intel_vpu driver maintainer list as I'm moving to another company. Time to let someone else deal with the NPU bugs while I pretend to know what I'm doing elsewhere! Thanks to everyone for the great collaboration (and for putting up with my creative interpretations of what "minor fixes" means). Reviewed-by: Maciej Falkowski Reviewed-by: Karol Wachowski Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250910085526.230458-1-jacek.lawrynowicz@linux.intel.com commit d4dc08c530cbf71fb1c7cddb9d1e7e36bd62e22f Merge: 6b35936f058d0c 043d9c6928b010 Author: Danilo Krummrich Date: Wed Sep 10 11:07:05 2025 +0200 Merge drm-misc-next-2025-08-21 into drm-rust-next We need the DRM Rust changes that went into drm-misc before the existence of the drm-rust tree in here as well. Signed-off-by: Danilo Krummrich commit 7d460636b6402343ca150682f7bae896c4ff2a76 Author: Christoph Hellwig Date: Mon Aug 18 08:10:08 2025 +0200 ntfs3: stop using write_cache_pages Stop using the obsolete write_cache_pages and use writeback_iter directly. Signed-off-by: Christoph Hellwig Signed-off-by: Konstantin Komarov commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 Author: Moon Hee Lee Date: Tue Jul 22 10:40:16 2025 -0700 fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption. syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state. Reject such cases by verifying that the bitmap is not empty when index blocks exist. Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64 Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee Signed-off-by: Konstantin Komarov commit d68318471aa2e16222ebf492883e05a2d72b9b17 Author: Haoxiang Li Date: Tue Jul 15 17:51:20 2025 +0800 fs/ntfs3: Fix a resource leak bug in wnd_extend() Add put_bh() to decrease the refcount of 'bh' after the job is finished, preventing a resource leak. Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Konstantin Komarov commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 Author: Vitaly Grigoryev Date: Mon Aug 25 13:08:55 2025 +0300 fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function. The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure. Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk. Add overflow check for addition operation. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Vitaly Grigoryev Signed-off-by: Konstantin Komarov commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 Author: Tetsuo Handa Date: Tue Sep 2 19:43:24 2025 +0900 ntfs3: pretend $Extend records as regular files Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Signed-off-by: Konstantin Komarov commit 21dc07ac9c25f01ab2023e3e8605861d8fd6e00c Author: Ethan Ferguson Date: Thu Aug 28 16:37:16 2025 -0400 ntfs3: add FS_IOC_SETFSLABEL ioctl Add support for the FS_IOC_SETFSLABEL ioctl. Signed-off-by: Ethan Ferguson Signed-off-by: Konstantin Komarov commit e4dff970091118f2ecf66146d0b286979078b5cc Author: Ethan Ferguson Date: Thu Aug 28 16:37:15 2025 -0400 ntfs3: add FS_IOC_GETFSLABEL ioctl Add support for the FS_IOC_GETFSLABEL ioctl. Signed-off-by: Ethan Ferguson Signed-off-by: Konstantin Komarov commit 80ff677b55b5186b2844a2d4f4c91c01ef836276 Author: Ethan Ferguson Date: Thu Aug 28 16:37:14 2025 -0400 ntfs3: transition magic number to shared constant Use the common FSLABEL_MAX constant instead of a hardcoded magic constant of 256. Signed-off-by: Ethan Ferguson Signed-off-by: Konstantin Komarov commit 5808ae66f22e665c7131816e146548f2d7903ae1 Author: Binbin Zhou Date: Thu Sep 4 21:07:11 2025 +0800 mtd: rawnand: loongson: Add Loongson-2K1000 NAND controller support The Loongson-2K1000 NAND controller is also similar to the Loongson-1C. It supports a maximum capacity of 16GB FLASH per chip with a maximum page size of 8KB, and it supports up to 4 chip selects and 4 RDY signals. The key difference from the Loongson-2K0500 is that it requires explicit configuration of the DMA control route. Typically, it is configured as APBDMA0. Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit 0b1ae6480c3be58ad31afe757cbf1069ae072bb1 Author: Binbin Zhou Date: Thu Sep 4 21:07:10 2025 +0800 dt-bindings: mtd: loongson,ls1b-nand-controller: Document the Loongson-2K1000 NAND controller Add new compatible for the Loongson-2K NAND controller used for Loongson-2K1000 SoC. Reviewed-by: Rob Herring (Arm) Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit e55bbdd4a4b654dfe8ee8649b3be1db82319d6c0 Author: Binbin Zhou Date: Thu Sep 4 21:07:09 2025 +0800 mtd: rawnand: loongson: Add Loongson-2K0500 NAND controller support The Loongson-2K0500 NAND controller is similar to the Loongson-1C. It supports a maximum capacity of 16GB FLASH per chip with a maximum page size of 8KB, and it supports up to 4 chip selects and 4 RDY signals. Its DMA controller is defaulted to APBDMA0. Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit 4a2bab7ccceb14b48e86794b87104248c75aa587 Author: Binbin Zhou Date: Thu Sep 4 21:07:08 2025 +0800 dt-bindings: mtd: loongson,ls1b-nand-controller: Document the Loongson-2K0500 NAND controller Add new compatible for the Loongson-2K NAND controller used for Loongson-2K0500 SoC. Acked-by: Rob Herring (Arm) Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit 7ad5bdf88d7295c295a363a5daf481b283acedc2 Author: Binbin Zhou Date: Thu Sep 4 21:06:35 2025 +0800 mtd: rawnand: loongson: Add nand chip select support The page address register describes the page address of the starting address for NAND read/write/erase operations. According to the manual, it consists of two parts: {chip select, page number} The `chip select` is fixed at 2 bits, and the `page number` is determined based on the actual capacity of the single-chip memory. Therefore we need to determine the `chip select` bits base on the `page number`. For example, for a 1GB capacity chip (2K page size), it has 1M pages. Thus, [19:0] is used to represent the page number, and [21:20] represents the chip select. Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit fb1dd6b6722b5187a4fa7385d0be60b28c0f9936 Author: Keguang Zhang Date: Thu Sep 4 21:06:34 2025 +0800 mtd: rawnand: loongson: Add 6-byte NAND ID reading support Loongson-1C and Loongson-2K SoCs support NAND flash chips with 6-byte ID. However, the current implementation only handles 5-byte ID which can lead to incorrect chip detection. Extend loongson_nand_read_id_type_exec() to support 6-byte NAND ID. Signed-off-by: Keguang Zhang Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit 7a1e3a452a574ef337c4c2cd9202332a1ae9cd94 Author: Binbin Zhou Date: Thu Sep 4 21:06:33 2025 +0800 mtd: rawnand: loongson1: Rename the prefix from ls1x to loongson I am going to introduce the NAND controllers of the Loongson-2K series CPUs, which are similar to Loongson-1. As preparation, rename all prefixes from Loongson1-specific to Loongson-generic. No functional change intended. Signed-off-by: Binbin Zhou Signed-off-by: Miquel Raynal commit eebccbfea4184feb758c104783b870ec4ddb6aec Author: Sarika Sharma Date: Thu Sep 4 16:10:54 2025 +0530 wifi: mac80211: fix reporting of all valid links in sta_set_sinfo() Currently, sta_set_sinfo() fails to populate link-level station info when sinfo->valid_links is initially 0 and sta->sta.valid_links has bits set for links other than link 0. This typically occurs when association happens on a non-zero link or link 0 deleted dynamically. In such cases, the for_each_valid_link(sinfo, link_id) loop only executes for link 0 and terminates early, since sinfo->valid_links remains 0. As a result, only MLD-level information is reported to userspace. Hence to fix, initialize sinfo->valid_links with sta->sta.valid_links before entering the loop to ensure loop executes for each valid link. During iteration, mask out invalid links from sinfo->valid_links if any of sta->link[link_id], sdata->link[link_id], or sinfo->links[link_id] are not present, to report only valid link information. Fixes: 505991fba9ec ("wifi: mac80211: extend support to fill link level sinfo structure") Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250904104054.790321-1-quic_sarishar@quicinc.com [clarify comment] Signed-off-by: Johannes Berg commit 2f572b0def6e90e4a6cf90f3a8cb11d4def7b637 Author: Alexander Stein Date: Fri Jul 18 17:47:22 2025 +0800 dt-bindings: firmware: imx95-scmi: Allow linux,code for protocol@81 BBM protocol supports a single power button, supported by driver imx-sm-bbm-key.c. By default this is KEY_POWER, but can also be overwritten using linux,code. Add a reference to this schema and add linux,code as a supported property. Reviewed-by: Rob Herring (Arm) Signed-off-by: Alexander Stein Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 8cfc8cec1b4da88a47c243a11f384baefd092a50 Author: Edward Adam Davis Date: Wed Sep 10 09:15:27 2025 +0800 media: mc: Clear minor number before put device The device minor should not be cleared after the device is released. Fixes: 9e14868dc952 ("media: mc: Clear minor number reservation at unregistration time") Cc: stable@vger.kernel.org Reported-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=031d0cfd7c362817963f Tested-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 895d3b4b5832edefd2f1fbad9d75c0179f47fe0e Author: Bingbu Cao Date: Tue Sep 9 14:01:53 2025 +0800 media: staging/ipu7: fix isys device runtime PM usage in firmware closing The PM usage counter of isys was bumped up when start camera stream (opening firmware) but it was not dropped after stream stop(closing firmware), it forbids system fail to suspend due to the wrong PM state of ISYS. This patch drop the PM usage counter in firmware close to fix it. Cc: Stable@vger.kernel.org Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver") Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit dada1966cc3c342e3e700cc943b7c947c5e9aa93 Author: Bence Csókás Date: Wed Jul 9 09:28:47 2025 +0200 ARM: dts: imx6-aristainetos2: Replace license text comment with SPDX identifier Replace verbatim license text with a `SPDX-License-Identifier`. The comment header mis-attributes this license to be "X11", but the license text does not include the last line "Except as contained in this notice, the name of the X Consortium shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the X Consortium.". Therefore, this license is actually equivalent to the SPDX "MIT" license (confirmed by text diffing). Cc: Heiko Schocher Signed-off-by: Bence Csókás Reviewed-by: Heiko Schocher Signed-off-by: Shawn Guo commit 4c91b0ee35db07ae017dce067c64364c7e95faae Author: Colin Ian King Date: Tue Sep 9 20:03:56 2025 +0100 gpio: loongson-64bit: Fix a less than zero check on an unsigned int struct field Currently the error check from the call to platform_get_irq is always false because an unsigned int chip->irq.parents[i] is being used to to perform the less than zero error check. Fix this by using the int variable ret to perform the check. Fixes: 03c146cb6cd1 ("gpio: loongson-64bit: Add support for Loongson-2K0300 SoC") Signed-off-by: Colin Ian King Reviewed-by: Huacai Chen Reviewed-by: Yao Zi Link: https://lore.kernel.org/r/20250909190356.870000-1-colin.i.king@gmail.com Signed-off-by: Bartosz Golaszewski commit b2d2c2b8af4321476d58f313c7893b49c30141a4 Author: Alexander Dahl Date: Thu Sep 4 11:14:41 2025 +0200 mtd: rawnand: atmel: Fix pulse read timing for certain flash chips Prevent PMECC errors when reading from AMD/Spansion S34ML02G1 flash on SAM9X60 SoC, after switching to ONFI timing mode 3. From reading the S34ML02G1 and the SAM9X60 datasheets again, it seems like we have to wait tREA after rising RE# before sampling the data. Thus pulse must be at least tREA. The previous approach to set this timing worked on sam9g20 and sama5d2 with the same flash (S34ML02G1), probably because those have a slower mck clock rate and thus the resolution of the timings setup is not as tight as with sam9x60. The approach to fix the issue was carried over from u-boot, which itself got it from at91bootstrap. It has been successfully tested in at91bootstrap, U-Boot and Linux on sam9x60 and sama5d2, for several months here. Link: https://github.com/linux4sam/at91bootstrap/issues/174 Link: https://github.com/linux4sam/at91bootstrap/commit/e2dfd8141d00613a37acee66ef5724f70f34a538 Link: https://lore.kernel.org/u-boot/20240415075755.780653-1-ada@thorsis.com/ Link: https://source.denx.de/u-boot/u-boot/-/commit/344e2f2cd4a407f847b301804f37d036e8a0a10c Cc: Li Bin Signed-off-by: Alexander Dahl Signed-off-by: Miquel Raynal commit dfea8f7183c711f2bf6af7aaef2a07e30b36a367 Author: Xichao Zhao Date: Tue Sep 9 10:06:35 2025 +0800 mtd: nand: ecc: fix "writen"->"written" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Signed-off-by: Miquel Raynal commit 663bfe77b6f70bcb33b2607e16c94fcb1029580e Author: Valerio Setti Date: Mon Sep 8 21:50:03 2025 +0200 arm64: dts: amlogic: gxbb-odroidc2: remove UHS capability for SD card This is meant to resolve reboot not working on this board. The problem is as follows. In order to be able to switch from HS to UHS mode the bus voltage needs to be reduced from 3.3V down to 1.8V and this is achieved by the "vqmmc-supply" regulator. The ROM bootloader is only able to manage the card in HS mode (3.3V) and the switch HS->UHS happen at boottime in the kernel. The problem appears when the reboot command is issued or watchdog expires because in this case the "vqmmc-supply" voltage is not returned back at 3.3V before rebooting the board so the ROM bootloader will be completely stuck. Therefore this commit removes all UHS modes which would cause "vqmmc-summply" to switch from 3.3V to 1.8V. In terms of performance the main drawback of this commit is limiting the SD card bus speed to HS (25 MB/s) instead of UHS DDR50 (50 MB/s). However this comes with the benefit of being able to reboot the board, so it sounds like a reasonable compromise. Reviewed-by: Jerome Brunet Signed-off-by: Valerio Setti Link: https://lore.kernel.org/r/20250908-fix-reboot-v2-1-354d0e57c855@baylibre.com Signed-off-by: Neil Armstrong commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 Author: Xianwei Zhao Date: Thu Jul 17 17:29:54 2025 +0800 dts: arm: amlogic: fix pwm node for c3 Fix reg address for c3 pwm node. Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM") Signed-off-by: Xianwei Zhao Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com Signed-off-by: Neil Armstrong commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 Author: Johan Hovold Date: Fri Jul 25 09:54:29 2025 +0200 firmware: firmware: meson-sm: fix compile-test default Enabling compile testing should not enable every individual driver (we have "allyesconfig" for that). Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org Signed-off-by: Neil Armstrong commit 844150c255c94230aec41f88db8e2875cb97439e Author: Thomas Hellström Date: Mon Sep 8 12:12:46 2025 +0200 drm/xe: Convert pinned suspend eviction for exhaustive eviction Pinned suspend eviction and preparation for eviction validates system memory for eviction buffers. Do that under a validation exclusive lock to avoid interfering with other processes validating system graphics memory. v2: - Avoid gotos from within xe_validation_guard(). - Adapt to signature change of xe_validation_guard(). Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-14-thomas.hellstrom@linux.intel.com commit 1f1541720f651727591411e68c16299de0447b43 Author: Thomas Hellström Date: Mon Sep 8 12:12:45 2025 +0200 drm/xe: Rework instances of variants of xe_bo_create_locked() A common pattern is to create a locked bo, pin it without mapping and then unlock it. Add a function to do that, which internally uses xe_validation_guard(). With that we can remove xe_bo_create_locked_range() and add exhaustive eviction to stolen, pf_provision_vf_lmem and psmi_alloc_object. v4: - New patch after reorganization. v5: - Replace DRM_XE_GEM_CPU_CACHING_WB with 0. (CI) Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-13-thomas.hellstrom@linux.intel.com commit 59eabff2a3524d7f3bf6c24890cd197c4c116fcb Author: Thomas Hellström Date: Mon Sep 8 12:12:44 2025 +0200 drm/xe: Convert xe_bo_create_pin_map() for exhaustive eviction Introduce an xe_bo_create_pin_map_novm() function that does not take the drm_exec paramenter to simplify the conversion of many callsites. For the rest, ensure that the same drm_exec context that was used for locking the vm is passed down to validation. Use xe_validation_guard() where appropriate. v2: - Avoid gotos from within xe_validation_guard(). (Matt Brost) - Break out the change to pf_provision_vf_lmem8 to a separate patch. - Adapt to signature change of xe_validation_guard(). Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-12-thomas.hellstrom@linux.intel.com commit e6108eade1b6d8a5ebe0c872fae646df10b024f8 Author: Thomas Hellström Date: Mon Sep 8 12:12:43 2025 +0200 drm/xe: Convert xe_bo_create_pin_map_at() for exhaustive eviction Most users of xe_bo_create_pin_map_at() and xe_bo_create_pin_map_at_aligned() are not using the vm parameter, and that simplifies conversion. Introduce an xe_bo_create_pin_map_at_novm() function and make the _aligned() version static. Use xe_validation_guard() for conversion. v2: - Adapt to signature change of xe_validation_guard(). (Matt Brost) - Fix up documentation. v4: - Postpone the change to i915_gem_stolen_insert_node_in_range() to a later patch. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-11-thomas.hellstrom@linux.intel.com commit 550a42a8daee1b056f9b3e6c858e57451a5b315a Author: Thomas Hellström Date: Mon Sep 8 12:12:42 2025 +0200 drm/xe: Rename ___xe_bo_create_locked() Don't start external function names with underscores. Rename to xe_bo_init_locked(). Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-10-thomas.hellstrom@linux.intel.com commit eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 Author: Thomas Hellström Date: Mon Sep 8 12:12:41 2025 +0200 drm/xe: Convert xe_dma_buf.c for exhaustive eviction Convert dma-buf migration to XE_PL_TT and dma-buf import to support exhaustive eviction, using xe_validation_guard(). It seems unlikely that the import would result in an -ENOMEM, but convert import anyway for completeness. The dma-buf map_attachment() functionality unfortunately doesn't support passing a drm_exec, which means that foreign devices validating a dma-buf that we exported will not, unless they are xeKMD devices, participate in the exhaustive eviction scheme. v2: - Avoid gotos from within xe_validation_guard(). (Matt Brost) - Adapt to signature change of xe_validation_guard(). (Matt Brost) - Remove an unneeded (void)ret. (Matt Brost) - Fix up an error path. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-9-thomas.hellstrom@linux.intel.com commit 7bcb6e38c14d7d2654555a1b05b2a9a5411c693c Author: Thomas Hellström Date: Mon Sep 8 12:12:40 2025 +0200 drm/xe/display: Convert __xe_pin_fb_vma() Convert __xe_pin_fb_vma() for exhaustive eviction using xe_validation_guard(). v2: - Avoid gotos from within xe_validation_guard(). (Matt Brost) - Adapt to signature change of xe_validation_guard(). (Matt Brost) - Use interruptible waiting, since xe_bo_migrate() already does that. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-8-thomas.hellstrom@linux.intel.com commit c2ae94cf8cd86cd0a417865d194fb6c4cc81bfb1 Author: Thomas Hellström Date: Mon Sep 8 12:12:39 2025 +0200 drm/xe: Convert the CPU fault handler for exhaustive eviction The CPU fault handler may populate bos and migrate, and in doing so might interfere with other tasks validating. Rework the CPU fault handler completely into a fastpath and a slowpath. The fastpath trylocks only the validation lock in read-mode. If that fails, there's a fallback to the slowpath, where we do a full validation transaction. This mandates open-coding of bo locking, bo idling and bo populating, but we still call into TTM for fault finalizing. v2: - Rework the CPU fault handler to actually take part in the exhaustive eviction scheme (Matthew Brost). v3: - Don't return anything but VM_FAULT_RETRY if we've dropped the mmap_lock. Not even if a signal is pending. - Rebase on gpu_madvise() and split out fault migration. - Wait for idle after migration. - Check whether the resource manager uses tts to determine whether to map the tt or iomem. - Add a number of asserts. - Allow passing a ttm_operation_ctx to xe_bo_migrate() so that it's possible to try non-blocking migration. - Don't fall through to TTM on migration / population error Instead remove the gfp_retry_mayfail in mode 2 where we must succeed. (Matthew Brost) v5: - Don't allow faulting in the imported bo case (Matthew Brost) Signed-off-by: Thomas Hellström Reviewed-by: Matthews Brost Link: https://lore.kernel.org/r/20250908101246.65025-7-thomas.hellstrom@linux.intel.com commit 8f25e5abcbfb9cbcd923021774f2e785db3f7f55 Author: Thomas Hellström Date: Mon Sep 8 12:12:38 2025 +0200 drm/xe: Convert existing drm_exec transactions for exhaustive eviction Convert existing drm_exec transactions, like GT pagefault validation, non-LR exec() IOCTL and the rebind worker to support exhaustive eviction using the xe_validation_guard(). v2: - Adapt to signature change in xe_validation_guard() (Matt Brost) - Avoid gotos from within xe_validation_guard() (Matt Brost) - Check error return from xe_validation_guard() v3: - Rebase on gpu_madvise() Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost #v1 Link: https://lore.kernel.org/r/20250908101246.65025-6-thomas.hellstrom@linux.intel.com commit 1710cd5c8c1bac8e48eb02cf1123f27a8b90efee Author: Thomas Hellström Date: Mon Sep 8 12:12:37 2025 +0200 drm/xe: Convert SVM validation for exhaustive eviction Convert SVM validation to support exhaustive eviction, using xe_validation_guard(). v2: - Wrap also xe_vm_range_rebind (Matt Brost) - Adapt to argument changes of xe_validation_guard(). v5: - Rebase on SVM stats. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-5-thomas.hellstrom@linux.intel.com commit a2f2453c2c2647f16b86a805e9b45c1fcd9b8fc9 Author: Thomas Hellström Date: Mon Sep 8 12:12:36 2025 +0200 drm/xe: Convert xe_bo_create_user() for exhaustive eviction Use the xe_validation_guard() to convert xe_bo_create_user() for exhaustive eviction. v2: - Adapt to argument changes of xe_validation_guard() Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost #v1 Link: https://lore.kernel.org/r/20250908101246.65025-4-thomas.hellstrom@linux.intel.com commit c460bc2311dfcdf8380199cc913e5e064b5b063c Author: Thomas Hellström Date: Mon Sep 8 12:12:35 2025 +0200 drm/xe: Introduce an xe_validation wrapper around drm_exec Introduce a validation wrapper xe_validation_guard() as a helper intended to be used around drm_exec transactions what perform validations. Once TTM can handle exhaustive eviction we could remove this wrapper or make it mostly a NO-OP unless other functionality is added to it. Currently the wrapper takes a read lock upon entry and if the transaction hits an OOM, all locks are released and the transaction is retried with a write-lock. If all other validations participate in this scheme, the transaction with the write lock will be the only transaction validating and should have access to all available non-pinned memory. There is currently a problem in that TTM converts -EDEADLOCKS to -ENOMEM, and with ww_mutex slowpath error injections, we can hit -ENOMEMs without having actually ran out of memory. We abuse ww_mutex internals to detect such situations until TTM is fixes to not convert the error code. In the meantime, injecting ww_mutex slowpath -EDEADLOCKs is a good way to test the implementation in the absence of real OOMs. Just introduce the wrapper in this commit. It will be hooked up to the driver in following commits. v2: - Mark class_xe_validation conditional so that the loop is skipped on initialization error. - Argument sanitation (Matt Brost) - Fix conditional execution of xe_validation_ctx_fini() (Matt Brost) - Add a no_block mode for upcoming use in the CPU fault handler. v4: - Update kerneldoc. (Xe CI). Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908101246.65025-3-thomas.hellstrom@linux.intel.com commit 0131514f97890c4699a4d7ca14b720dafefdbc71 Author: Thomas Hellström Date: Mon Sep 8 12:12:34 2025 +0200 drm/xe: Pass down drm_exec context to validation We want all validation (potential backing store allocation) to be part of a drm_exec transaction. Therefore add a drm_exec pointer argument to xe_bo_validate() and ___xe_bo_create_locked(). Upcoming patches will deal with making all (or nearly all) calls to these functions part of a drm_exec transaction. In the meantime, define special values of the drm_exec pointer: XE_VALIDATION_UNIMPLEMENTED: Implementation of the drm_exec transaction has not been done yet. XE_VALIDATION_UNSUPPORTED: Some Middle-layers (dma-buf) doesn't allow the drm_exec context to be passed down to map_attachment where validation takes place. XE_VALIDATION_OPT_OUT: May be used only for kunit tests where exhaustive eviction isn't crucial and the ROI of converting those is very small. For XE_VALIDATION_UNIMPLEMENTED and XE_VALIDATION_OPT_OUT there is also a lockdep check that a drm_exec transaction can indeed start at the location where the macro is expanded. This is to encourage developers to take this into consideration early in the code development process. v2: - Fix xe_vm_set_validation_exec() imbalance. Add an assert that hopefully catches future instances of this (Matt Brost) v3: - Extend to psmi_alloc_object Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost #v3 Link: https://lore.kernel.org/r/20250908101246.65025-2-thomas.hellstrom@linux.intel.com commit a5925a2ce0775374dcbbaf19826b539c2e9eec84 Author: Neil Armstrong Date: Tue Sep 2 10:43:49 2025 +0200 media: iris: add VPU33 specific encoding buffer calculation The VPU33 found in the SM8650 Platform requires some slighly different buffer calculation for encoding to allow working with the latest firwware uploaded on linux-firmware at [1]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=ece445af91bbee49bf0d8b23c2b99b596ae6eac7 Suggested-by: Vikash Garodia Signed-off-by: Neil Armstrong Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 75db90ae067d50f2ee53034c11898c958da31292 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:50 2025 +0530 media: iris: Add support for drain sequence in encoder video device Add support for handling start and stop commands, including the end-of-stream (drain) sequence, in the encoder video device. This enables proper signaling to the firmware and ensures that all pending frames are processed and flushed before completing the stream. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8cefa0ac93a8cb94ff9e16dd5327e14ec5223d28 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:49 2025 +0530 media: iris: Add support for buffer management ioctls for encoder device Implement support for queuing and dequeuing input and output buffers for the encoder video device using the appropriate V4L2 buffer management ioctls. This enables userspace applications to manage streaming buffers required for encoding operations. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd [bod: drop dead code size_enc_single_pipe()] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 61528e86687e3ba520d10a2be40d7e409cea663d Author: Dikshita Agarwal Date: Mon Aug 25 12:30:48 2025 +0530 media: iris: Allocate and queue internal buffers for encoder video device Add support for allocating and queuing internal buffers required by the encoder. The sizes of these buffers are derived from hardware specifications and are essential to meet the encoder's functional and performance requirements. These buffers are not exposed to userspace; they are allocated and managed internally to ensure correct and efficient hardware operation. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd [bod: added sm8750 enc_op_int_buf_tbl enumeration during merge] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit d22037f3fd33e5956ecbc2ee38b42726fa2cc7a0 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:47 2025 +0530 media: iris: Set platform capabilities to firmware for encoder video device Initialize and configure platform-specific capabilities for the encoder in the firmware during stream-on, to tailor encoding behavior to the current session's requirements. Some of these capabilities can also be updated dynamically when V4L2 controls are modified by the client after stream-on. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 92e007ca5ab687b0612accb54acee7ed4adcdb0c Author: Dikshita Agarwal Date: Mon Aug 25 12:30:46 2025 +0530 media: iris: Add V4L2 streaming support for encoder video device Add support for V4L2 streaming operations on the encoder video device. During stream-on, configure mandatory properties on the respective planes and notify the firmware to initiate an encode session. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd [bod: add sm8750 enc/dec declarations during merge process] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6bdfa3f947a735778fc3e76b0762430276b7a3c0 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:45 2025 +0530 media: iris: Add platform-specific capabilities for encoder video device Add platform-specific capabilities for the encoder video device and initialize the corresponding controls in the control handler. This enables proper configuration and handling of encoder-specific features based on platform requirements. Co-developed-by: Wangao Wang Signed-off-by: Wangao Wang Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd [bod: add sm8750 inst_fw_caps_enc/inst_fw_caps_dec] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 4ff586ff28e31be65fd22743e1d45826df54ddf7 Author: Dikshita Agarwal Date: Wed Sep 3 15:35:40 2025 +0530 media: iris: Add support for G/S_PARM for encoder video device Add supports for the G/S_PARM V4L2 ioctls for encoder video device with necessary hooks. This allows userspace to query the current streaming parameters such as frame intervals and set desired streaming parameters primarily the frame rate. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit bed072b48e0ba21fe9e69311dbc1bebcf73ef4aa Author: Dikshita Agarwal Date: Mon Aug 25 12:30:43 2025 +0530 media: iris: Add support for G/S_SELECTION for encoder video device Add support for G/S_SELECTION V4L2 ioctls for the encoder video device with necessary hooks. This allows userspace to query and configure rectangular selection areas such as crop. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f4d3867e0540caf6ef74402996aee9e55c89efaa Author: Dikshita Agarwal Date: Mon Aug 25 12:30:42 2025 +0530 media: iris: Add encoder support for V4L2 event subscription Implement support for V4L2 event subscription on the encoder device by handling the SUBSCRIBE_EVENT and UNSUBSCRIBE_EVENT ioctls with the necessary hooks. This enables userspace applications to subscribe to V4L2 events, allowing asynchronous notification mechanisms. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 87551d96e897e5ee1c81481c99db2b3d3d24ffc5 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:41 2025 +0530 media: iris: Add support for VIDIOC_QUERYCAP for encoder video device Add support for the VIDIOC_QUERYCAP V4L2 iocts for the encoder video device to report core driver capabilities. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a6882431a138ac352a6e20ec3b85f97f84501329 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:40 2025 +0530 media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder Add support for frame size and frame interval enumeration by implementing ENUM_FRAMESIZES/FRAMEINTERVALS V4L2 ioctls for encoder video device with necessary hooks. This allows userspace application to query encoder capabilities and adapt encoding configurations accordingly. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 63357cf8a9c09c527ba8c7f8befe57b3144c45e3 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:39 2025 +0530 media: iris: Add support for ENUM_FMT, S/G/TRY_FMT encoder Add V4L2 format handling support for the encoder by adding implementation of ENUM/S/G/TRY_FMT with necessary hooks. This ensures that the encoder supports format negotiation consistent with V4L2 expectation, enabling userspace applications to configure resolution, pixel format and buffer layout properly. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 5ad964ad5656668399f00c76707f0d063b64a4b1 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:38 2025 +0530 media: iris: Initialize and deinitialize encoder instance structure Introduce initialization and deinitialization for internal encoder instance structure with necessary hooks. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 787c535a9ff5d2daf7c6dbe08a7e660d09105cb4 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:37 2025 +0530 media: iris: Add support for video encoder device Add support for registering a V4L2 encoder video device to the iris driver. The encoder device is registered with the name "qcom-iris-encoder". Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2dbd2645c07df8de04ee37b24f2395800513391e Author: Dikshita Agarwal Date: Mon Aug 25 12:30:36 2025 +0530 media: iris: Fix format check for CAPTURE plane in try_fmt Previously, the format validation relied on an array of supported formats, which only listed formats for the OUTPUT plane. This caused failures when validating formats for the CAPTURE plane. Update the check to validate against the only supported format on the CAPTURE plane, which is NV12. Fixes: fde6161d91bb ("media: iris: Add HEVC and VP9 formats for decoder") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8172f57746d68e5c3c743f725435d75c5a4db1ac Author: Dikshita Agarwal Date: Mon Aug 25 12:30:35 2025 +0530 media: iris: Fix missing LAST flag handling during drain Improve drain handling by ensuring the LAST flag is attached to final capture buffer when drain response is received from the firmware. Previously, the driver failed to attach the V4L2_BUF_FLAG_LAST flag when a drain response was received from the firmware, relying on userspace to mark the next queued buffer as LAST. This update fixes the issue by checking the pending drain status, attaching the LAST flag to the capture buffer received from the firmware (with EOS attached), and returning it to the V4L2 layer correctly. Fixes: d09100763bed ("media: iris: add support for drain sequence") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit dec073dd8452e174a69db8444e0932e6b4f31c99 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:34 2025 +0530 media: iris: Send dummy buffer address for all codecs during drain Firmware can handle a dummy address for buffers with the EOS flag. To ensure consistent behavior across all codecs, update the drain command to always send a dummy buffer address. This makes the drain handling uniform and avoids any codec specific assumptions. Fixes: 478c4478610d ("media: iris: Add codec specific check for VP9 decoder drain handling") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 56a2d85ee8f9b994e5cd17039133218c57c5902b Author: Dikshita Agarwal Date: Mon Aug 25 12:30:33 2025 +0530 media: iris: Allow stop on firmware only if start was issued. For HFI Gen1, the instances substate is changed to LOAD_RESOURCES only when a START command is issues to the firmware. If STOP is called without a prior START, the firmware may reject the command and throw some erros. Handle this by adding a substate check before issuing STOP command to the firmware. Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0fe10666d3b4d0757b7f4671892523855ee68cc8 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:32 2025 +0530 media: iris: Simplify session stop logic by relying on vb2 checks Remove earlier complex conditional checks in the non-streaming path that attempted to verify if stop was called on a plane that was previously started. These explicit checks are redundant, as vb2 already ensures that stop is only called on ports that have been started, maintaining correct buffer state management. Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8a432174ac263fb9dd93d232b99c84e430e6d6b5 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:31 2025 +0530 media: iris: Update vbuf flags before v4l2_m2m_buf_done Update the vbuf flags appropriately in error cases before calling v4l2_m2m_buf_done(). Previously, the flag update was skippied in error scenario, which could result in incorrect state reporting for buffers. Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:30 2025 +0530 media: iris: Always destroy internal buffers on firmware release response Currently, internal buffers are destroyed only if 'PENDING_RELEASE' flag is set when a release response is received from the firmware, which is incorrect. Internal buffers should always be destroyed when the firmware explicitly releases it, regardless of whether the 'PENDING_RELEASE' flag was set by the driver. This is specially important during force-stop scenarios, where the firmware may release buffers without driver marking them for release. Fix this by removing the incorrect check and ensuring all buffers are properly cleaned up. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 65f72c6a8d97c0cbdc785cb9a35dc358dee67959 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:29 2025 +0530 media: iris: Allow substate transition to load resources during output streaming A client (e.g., GST for encoder) can initiate streaming on the capture port before the output port, causing the instance state to transition to OUTPUT_STREAMING. When streaming is subsequently started on the output port, the instance state advances to STREAMING, and the substate should transition to LOAD_RESOURCES. Previously, the code blocked the substate transition to LOAD_RESOURCES if the instance state was OUTPUT_STREAMING. This update modifies the logic to permit the substate transition to LOAD_RESOURCES when the instance state is OUTPUT_STREAMING, thereby supporting this client streaming sequence. Fixes: 547f7b8c5090 ("media: iris: add check to allow sub states transitions") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 4b67ef9b333ed645879b4b1a11e35e019ff4cfea Author: Dikshita Agarwal Date: Mon Aug 25 12:30:28 2025 +0530 media: iris: Fix port streaming handling The previous check to block capture port streaming before output port was incorrect and caused some valid usecase to fail. While removing that check allows capture port to enter streaming independently, it also introduced firmware errors due to premature queuing of DPB buffers before the firmware session was fully started which happens only when streamon is called on output port. Fix this by deferring DPB buffer queuing to the firmware until both capture and output are streaming and state is 'STREAMING'. Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 02a24f13b3a1d9da9f3de56aa5fdb7cc1fe167a2 Author: Dikshita Agarwal Date: Mon Aug 25 12:30:27 2025 +0530 media: iris: Fix memory leak by freeing untracked persist buffer One internal buffer which is allocated only once per session was not being freed during session close because it was not being tracked as part of internal buffer list which resulted in a memory leak. Add the necessary logic to explicitly free the untracked internal buffer during session close to ensure all allocated memory is released properly. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 42e81c262cf57570099a15aeffdffa0876fe15da Author: Dikshita Agarwal Date: Mon Aug 25 12:30:26 2025 +0530 media: iris: Report unreleased PERSIST buffers on session close Add error reporting for unreleased PERSIST internal buffers in iris_check_num_queued_internal_buffers(). This ensures all buffer types are checked and logged if not freed during session close, helping to detect memory leaks and improve driver robustness. No change to buffer lifecycle or allocation logic. Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit cba6aed4223e83ae0f2ed1c0f68d974fd62847bc Author: Dikshita Agarwal Date: Mon Aug 25 12:30:25 2025 +0530 media: iris: Fix buffer count reporting in internal buffer check Initialize the count variable to zero before counting unreleased internal buffers in iris_check_num_queued_internal_buffers(). This prevents stale values from previous iterations and ensures accurate error reporting for each buffer type. Without this initialization, the count could accumulate across types, leading to incorrect log messages. Fixes: d2abb1ff5a3c ("media: iris: Verify internal buffer release on close") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3708a165a98c23cc83216deda88bc7d64ba85527 Author: Rob Herring (Arm) Date: Fri Aug 29 16:13:29 2025 -0500 ARM: dts: aspeed: Drop syscon "reg-io-width" properties The default width is 4 bytes for "syscon" devices, so "reg-io-width" is redundant and can be dropped. Signed-off-by: Rob Herring (Arm) Signed-off-by: Andrew Jeffery commit fea2bfde3d52fbcfc7698c01954bee8b57d42abf Author: Qiang Liu Date: Thu Sep 4 17:35:58 2025 +0800 scsi: bfa: Remove self-assignment code The variable num_cqs is of type u8 and does not require be16_to_cpu conversion, so the redundant code is removed. Signed-off-by: Qiang Liu Signed-off-by: Martin K. Petersen commit d76afd8d2dc43d841b84a9f539b9f84ff79d055c Merge: 7dc0d13d752986 bc5dbf7739594b Author: Martin K. Petersen Date: Tue Sep 9 22:53:10 2025 -0400 Merge patch series "Simplify MCQ resource mapping" Nitin Rawat says: The patch series simplifies the UFS MCQ (Multi Circular Queue) resource mapping in the Qualcomm UFS host controller driver by replacing the complex multi-resource approach with a streamlined single-resource implementation. The current MCQ implementation uses multiple separate resource mappings (RES_UFS, RES_MCQ, RES_MCQ_SQD, RES_MCQ_VS) with dynamic resource allocation, which increases code complexity and potential for resource mapping errors. This approach also doesn't align with the device tree binding specification that defines a single 'mcq' memory region. Replace the multi-resource mapping with a single "mcq" resource that encompasses the entire MCQ configuration space. The doorbell registers (SQD, CQD, SQIS, CQIS) are accessed using predefined offsets relative to the MCQ base address, providing clearer memory layout organization. Tested on Qualcomm platforms SM8650 and SM8750 with UFS MCQ enabled. Changes from v3: 1. Addressed Krzysztof comment to separate device tree and driver patch independently in different patch series. This series caters driver changes. 2. Addressed Manivannan's change to update commit text and remove redundant null check in mcq code. 3. Addressed Manivannan's to Update few offsets as fixed definition instead of enum. Changes from v2: 1. Removed dt-bindings patch as existing binding supports required reg-names format. 2. Added patch to refactor MCQ register dump logic for new resource mapping. 3. Added patch to remove unused ufshcd_res_info structure from UFS core. 4. Changed reg-names from "ufs_mem" to "std" in device tree patches. 5. Reordered patches with driver changes first, then device tree changes. 6. Updated SM8750 MCQ region size from 0x2000 to 0x15000 Signed-off-by: Martin K. Petersen commit bc5dbf7739594b05c673ab3905471257be9921e7 Author: Nitin Rawat Date: Wed Sep 3 13:18:15 2025 +0530 scsi: ufs: ufs-qcom: Refactor MCQ register dump logic Refactor MCQ register dump to align with the new resource mapping. As part of refactor, below changes are done: - Update ufs_qcom_dump_regs() function signature to accept direct base address instead of resource ID enum - Modify ufs_qcom_dump_mcq_hci_regs() to use hba->mcq_base and calculated addresses from MCQ operation info - Replace enum ufshcd_res with direct memory-mapped I/O addresses Additionally remove the ufshcd_res_info structure and associated enum ufshcd_res definitions from the UFS host controller header. These were previously used for MCQ resource mapping but are no longer needed following recent refactoring to use direct base addresses instead of multiple separate resource regions. Signed-off-by: Nitin Rawat Reviewed-by: Bart Van Assche Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit 2b9887b17ebe942cbef7cffc4e19fa2aa5fed4c8 Author: Nitin Rawat Date: Wed Sep 3 13:18:14 2025 +0530 scsi: ufs: ufs-qcom: Streamline UFS MCQ resource mapping The current MCQ resource configuration involves multiple resource mappings and dynamic resource allocation. Simplify the resource mapping by directly mapping the single "mcq" resource from device tree to hba->mcq_base instead of mapping multiple separate resources (RES_UFS, RES_MCQ, RES_MCQ_SQD, RES_MCQ_VS). It also uses predefined offsets for MCQ doorbell registers (SQD, CQD, SQIS, CQIS) relative to the MCQ base,providing clearer memory layout clarity. Additionally update vendor-specific register offset UFS_MEM_CQIS_VS offset from 0x8 to 0x4008 to align with the hardware programming guide. The new approach assumes the device tree provides a single "mcq" resource that encompasses the entire MCQ configuration space, making the driver more maintainable and less prone to resource mapping errors. The change aligns the driver implementation with the device tree binding specification, which defines a single 'mcq' memory region rather than multiple separate regions. Co-developed-by: Ram Kumar Dwivedi Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit 7dc0d13d752986a50f6876806a100c97d3fbdcae Merge: 508e754c693162 2936049277ea3b Author: Martin K. Petersen Date: Tue Sep 9 22:46:47 2025 -0400 Merge patch series "ufs: host: mediatek: Power Management and stability enhancements" Peter Wang says: These patches collectively enhance the UFS host driver's reliability, power management efficiency, and error recovery mechanisms on MediaTek platforms. They address critical issues and introduce optimizations that improve system stability and performance. Signed-off-by: Martin K. Petersen commit 2936049277ea3bfd38d12583755556290b9ea494 Author: Peter Wang Date: Wed Sep 3 10:44:46 2025 +0800 scsi: ufs: host: mediatek: Fix device power control Adjust the timing of device power control to ensure low power mode (LPM) is entered only after VCC is turned off. Prevent VCCQ/VCCQ2 from entering LPM prematurely, ensuring proper power management and device stability. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit 91cad911edd1612ed28f5cfb2d4c53a8824951a5 Author: Peter Wang Date: Wed Sep 3 10:44:45 2025 +0800 scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue Resolve the issue of unbalanced IRQ enablement by setting the 'is_mcq_intr_enabled' flag after the first successful IRQ enablement. Ensure proper tracking of the IRQ state and prevent potential mismatches in IRQ handling. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit d73836cb8535b3078e4d2a57913f301baec58a33 Author: Alice Chao Date: Wed Sep 3 10:44:44 2025 +0800 scsi: ufs: host: mediatek: Fix adapt issue after PA_Init Address the issue where the host does not send adapt to the device after PA_Init success. Ensure the adapt process is correctly initiated for devices with IP version MT6899 and above, resolving communication issues between the host and device. Signed-off-by: Alice Chao Reviewed-by: Peter Wang Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit f29ec85ac4fdd72469c0c5898f47301c7c95ead8 Author: Sanjeev Y Date: Wed Sep 3 10:44:43 2025 +0800 scsi: ufs: host: mediatek: Return error directly on idle wait timeout Optimize the recovery flow by returning an error code immediately if a wait idle timeout occurs, rather than waiting for the link to reach the up state. Shorten the recovery process and improve error handling efficiency when idle state transitions fail. Signed-off-by: Sanjeev Y Reviewed-by: Peter Wang Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit f5ca8d0c7a6388abd5d8023cc682e1543728cc73 Author: Peter Wang Date: Wed Sep 3 10:44:42 2025 +0800 scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes Disable auto-hibern8 during power mode transitions to prevent unintended entry into auto-hibern8. Restore the original auto-hibern8 timer value after completing the power mode change to maintain system stability and prevent potential issues during power state transitions. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit c73cd5e298c5a86cb5cf7019f787dffe9b784294 Author: Peter Wang Date: Wed Sep 3 10:44:41 2025 +0800 scsi: ufs: host: mediatek: Support UFS PHY runtime PM and correct sequence Add support for UFS PHY runtime power management by probing the PHY device and enabling its runtime PM. Ensure the correct sequence of operations during suspend and resume: PHY suspend -> UFS suspend -> UFS resume -> PHY resume. Improve power management efficiency and system stability with this enhancement. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit b2f8abadabea32c49b0d624232016347082b1aa9 Author: Alice Chao Date: Wed Sep 3 10:44:40 2025 +0800 scsi: ufs: host: mediatek: Correct resume flow for LPM and MTCMOS Correct the system resume flow by turning MTCMOS on before setting LPM to false. During system suspend, set LPM to true and turn MTCMOS off. Ensure proper power management and system stability with the updated resume sequence. Signed-off-by: Alice Chao Signed-off-by: Peter Wang Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 77b96ef70b6ba46e3473e5e3a66095c4bc0e93a4 Author: Peter Wang Date: Wed Sep 3 10:44:39 2025 +0800 scsi: ufs: host: mediatek: Correct system PM flow Refine the system power management (PM) flow by skipping low power mode (LPM) and MTCMOS settings if runtime PM is already applied. Prevent redundant operations to ensure a more efficient PM process. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit 15ef3f5aa822f32524cba1463422a2c9372443f0 Author: Peter Wang Date: Wed Sep 3 10:44:38 2025 +0800 scsi: ufs: host: mediatek: Enhance recovery on resume failure Improve the recovery process for failed resume operations. Log the device's power status and return 0 if both resume and recovery fail to prevent I/O hang. Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit faac32d4ece30609f1a0930ca0ae951cf6dc1786 Author: Peter Wang Date: Wed Sep 3 10:44:37 2025 +0800 scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure Improve the recovery process for hibernation exit failures. Trigger the error handler and break the suspend operation to ensure effective recovery from hibernation errors. Activate the error handling mechanism by ufshcd_force_error_recovery and scheduling the error handler work. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 508e754c693162af1fdb6bc00dec0b3237c17462 Author: Gustavo A. R. Silva Date: Mon Sep 8 20:42:01 2025 +0200 scsi: pm80xx: Avoid -Wflex-array-member-not-at-end warnings Comment out unused field 'residual_count' in a couple of structures, and with this, fix the following -Wflex-array-member-not-at-end warnings: drivers/scsi/pm8001/pm8001_hwi.h:342:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/pm8001/pm80xx_hwi.h:561:32: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Jack Wang Reviewed-by: John Garry Signed-off-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen commit 3126b5fd02270380cce833d06f973a3ffb33a69b Author: Palash Kambar Date: Mon Aug 18 09:39:05 2025 +0530 scsi: ufs: ufs-qcom: Align programming sequence of Shared ICE for UFS controller v5 Disabling the AES core in Shared ICE is not supported during power collapse for UFS Host Controller v5.0, which may lead to data errors after Hibern8 exit. To comply with hardware programming guidelines and avoid this issue, issue a sync reset to ICE upon power collapse exit. Hence follow below steps to reset the ICE upon exiting power collapse and align with Hw programming guide. a. Assert the ICE sync reset by setting both SYNC_RST_SEL and SYNC_RST_SW bits in UFS_MEM_ICE_CFG b. Deassert the reset by clearing SYNC_RST_SW in UFS_MEM_ICE_CFG Signed-off-by: Palash Kambar Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit deb105f49879dd50d595f7f55207d6e74dec34e6 Author: Rohan G Thomas Date: Sat Sep 6 10:33:31 2025 +0800 net: phy: marvell: Fix 88e1510 downshift counter errata The 88e1510 PHY has an erratum where the phy downshift counter is not cleared after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN cleared). This can cause the gigabit link to intermittently downshift to a lower speed. Disabling and re-enabling the downshift feature clears the counter, allowing the PHY to retry gigabit link negotiation up to the programmed retry count times before downshifting. This behavior has been observed on copper links. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com Signed-off-by: Jakub Kicinski commit 214da63451bbdf00cbf2347d8f264d39ae938c7e Merge: cf71bdf6863f0a f3164840a136b1 Author: Jakub Kicinski Date: Tue Sep 9 19:28:55 2025 -0700 Merge branch 'ptp-add-pulse-signal-loopback-support-for-debugging' Wei Fang says: ==================== ptp: add pulse signal loopback support for debugging Some PTP devices support looping back the periodic pulse signal for debugging. For example, the PTP device of QorIQ platform and the NETC v4 Timer has the ability to loop back the pulse signal and record the extts events for the loopback signal. So we can make sure that the pulse intervals and their phase alignment are correct from the perspective of the emitting PHC's time base. In addition, we can use this loopback feature as a built-in extts event generator when we have no external equipment which does that. Therefore, add the generic debugfs interfaces to the ptp_clock driver. The first two patch are separated from the previous patch set [1]. The third patch is new added. [1]: https://lore.kernel.org/imx/20250827063332.1217664-1-wei.fang@nxp.com/ #patch 3 and 9 ==================== Link: https://patch.msgid.link/20250905030711.1509648-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f3164840a136b123c8348ca5af4d83d99aa86eb7 Author: Wei Fang Date: Fri Sep 5 11:07:11 2025 +0800 ptp: qoriq: convert to use generic interfaces to set loopback mode Since the generic debugfs interfaces for setting the periodic pulse signal loopback have been added to the ptp_clock driver, so convert the vendor-defined debugfs interfaces to the generic interfaces. Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20250905030711.1509648-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 67ac836373f457aaef918aa6ba96e9c663c57368 Author: Wei Fang Date: Fri Sep 5 11:07:10 2025 +0800 ptp: netc: add the periodic output signal loopback support The NETC Timer supports looping back the output pulse signal of Fiper-n into Trigger-n input, so that users can leverage this feature to validate some other features without external hardware support. For example, users can use it to test external trigger stamp (EXTTS). And users can combine EXTTS with loopback mode to check whether the generation time of PPS is aligned with an integral second of PHC, or the periodic output signal (PTP_CLK_REQ_PEROUT) whether is generated at the specified time. Since ptp_clock_info::perout_loopback() has been added to the ptp_clock driver as a generic interface to enable or disable the periodic output signal loopback, therefore, netc_timer_perout_loopback() is added as a callback of ptp_clock_info::perout_loopback(). Test the generation time of PPS event: $ echo 0 1 > /sys/kernel/debug/ptp0/perout_loopback $ echo 1 > /sys/class/ptp/ptp0/pps_enable $ testptp -d /dev/ptp0 -e 3 external time stamp request okay event index 0 at 63.000000017 event index 0 at 64.000000017 event index 0 at 65.000000017 Test the generation time of the periodic output signal: $ echo 0 1 > /sys/kernel/debug/ptp0/perout_loopback $ echo 0 150 0 1 500000000 > /sys/class/ptp/ptp0/period $ testptp -d /dev/ptp0 -e 3 external time stamp request okay event index 0 at 150.000000014 event index 0 at 151.500000015 event index 0 at 153.000000014 Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250905030711.1509648-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit e096a7cc0be126d9376e549a10d71cf16b1a1c1c Author: Wei Fang Date: Fri Sep 5 11:07:09 2025 +0800 ptp: add debugfs interfaces to loop back the periodic output signal For some PTP devices, they have the capability to loop back the periodic output signal for debugging, such as the ptp_qoriq device. So add the generic interfaces to set the periodic output signal loopback, rather than each vendor having a different implementation. Show how many channels support the periodic output signal loopback: $ cat /sys/kernel/debug/ptp/n_perout_loopback Enable the loopback of the periodic output signal of channel X: $ echo 1 > /sys/kernel/debug/ptp/perout_loopback Disable the loopback of the periodic output signal of channel X: $ echo 0 > /sys/kernel/debug/ptp/perout_loopback Suggested-by: Andrew Lunn Signed-off-by: Wei Fang Link: https://patch.msgid.link/20250905030711.1509648-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 8791b07894ab75361195094828dc56b7ed449c36 Author: Thorsten Blum Date: Fri Sep 5 12:31:45 2025 +0200 scsi: scsi_debug: Replace kzalloc() + copy_from_user() with memdup_user_nul() Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify sdebug_error_write(). No functional changes intended. Signed-off-by: Thorsten Blum Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit cf71bdf6863f0aebd00aeccce313b8833ee9c7f4 Merge: 04d1ff1d75ba76 cdc492746e3f6d Author: Jakub Kicinski Date: Tue Sep 9 19:21:32 2025 -0700 Merge branch 'net-mlx5e-add-pcie-congestion-event-extras' Tariq Toukan says: ==================== net/mlx5e: Add pcie congestion event extras This small series by Dragos covers gaps requested in the initial pcie congestion series [1]: - Make pcie congestion thresholds configurable via devlink. - Add a counter for stale pcie congestion events. [1] https://lore.kernel.org/1752130292-22249-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/1757237976-531416-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit cdc492746e3f6d73a9e6a6a9962c9f1f7b7961b5 Author: Dragos Tatulea Date: Sun Sep 7 12:39:36 2025 +0300 net/mlx5e: Add stale counter for PCIe congestion events This ethtool counter is meant to help with observing how many times the congestion event was triggered but on query there was no state change. This would help to indicate when a work item was scheduled to run too late and in the meantime the congestion state changed back to previous state. While at it, do a driveby typo fix in documentation for pci_bw_inbound_high. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1757237976-531416-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f4053490a6f651476124903dbe0777e3c24ac8cb Author: Dragos Tatulea Date: Sun Sep 7 12:39:35 2025 +0300 net/mlx5e: Make PCIe congestion event thresholds configurable Add devlink driverinit parameters for configuring the thresholds for PCIe congestion events. These parameters are registered only when the firmware supports this feature. Update the mlx5 devlink docs as well on these new params. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1757237976-531416-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 04d1ff1d75ba76d0c5df1513acebf43973788b17 Merge: b90c7ca4f9185c a4c49611cf4f70 Author: Jakub Kicinski Date: Tue Sep 9 19:14:31 2025 -0700 Merge branch 'devlink-mlx5-add-new-parameters-for-link-management-and-sriov-eswitch-configurations' Saeed Mahameed says: ==================== devlink, mlx5: Add new parameters for link management and SRIOV/eSwitch configurations [part] This patch series introduces several devlink parameters improving device configuration capabilities, link management, and SRIOV/eSwitch, by adding NV config boot time parameters. Implement the following parameters: a) total_vfs Parameter: ----------------------- Adds support for managing the number of VFs (total_vfs) and enabling SR-IOV (enable_sriov for mlx5) through devlink. These additions enhance user control over virtualization features directly from standard kernel interfaces without relying on additional external tools. total_vfs functionality is critical for environments that require flexible num VF configuration. b) CQE Compression Type: ------------------------ Introduces a new devlink parameter, cqe_compress_type, to configure the rate of CQE compression based on PCIe bus conditions. This setting provides a balance between compression efficiency and overall NIC performance under different traffic loads. ==================== Link: https://patch.msgid.link/20250907012953.301746-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit a4c49611cf4f7018ee80f02bded12fd4002ef95c Author: Vlad Dumitrescu Date: Sat Sep 6 18:29:46 2025 -0700 net/mlx5: Implement devlink total_vfs parameter Some devices support both symmetric (same value for all PFs) and asymmetric, while others only support symmetric configuration. This implementation prefers asymmetric, since it is closer to the devlink model (per function settings), but falls back to symmetric when needed. Example usage: devlink dev param set pci/0000:01:00.0 name total_vfs value cmode permanent devlink dev reload pci/0000:01:00.0 action fw_activate echo 1 >/sys/bus/pci/devices/0000:01:00.0/remove echo 1 >/sys/bus/pci/rescan cat /sys/bus/pci/devices/0000:01:00.0/sriov_totalvfs Signed-off-by: Vlad Dumitrescu Reviewed-by: Jiri Pirko Tested-by: Kamal Heib Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250907012953.301746-5-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 95a0af146dff5437acb4ea27eacc05aa22c7bb54 Author: Vlad Dumitrescu Date: Sat Sep 6 18:29:45 2025 -0700 net/mlx5: Implement devlink enable_sriov parameter Example usage: devlink dev param set pci/0000:01:00.0 name enable_sriov value {true, false} cmode permanent devlink dev reload pci/0000:01:00.0 action fw_activate echo 1 >/sys/bus/pci/devices/0000:01:00.0/remove echo 1 >/sys/bus/pci/rescan grep ^ /sys/bus/pci/devices/0000:01:00.0/sriov_* Signed-off-by: Vlad Dumitrescu Tested-by: Kamal Heib Reviewed-by: Jiri Pirko Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250907012953.301746-4-saeed@kernel.org Signed-off-by: Jakub Kicinski commit bf2da4799fdb6eb58d9c9541b7dc1096c260499d Author: Saeed Mahameed Date: Sat Sep 6 18:29:44 2025 -0700 net/mlx5: Implement cqe_compress_type via devlink params Selects which algorithm should be used by the NIC in order to decide rate of CQE compression dependeng on PCIe bus conditions. Supported values: 1) balanced, merges fewer CQEs, resulting in a moderate compression ratio but maintaining a balance between bandwidth savings and performance 2) aggressive, merges more CQEs into a single entry, achieving a higher compression rate and maximizing performance, particularly under high traffic loads. Signed-off-by: Saeed Mahameed Reviewed-by: Jiri Pirko Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250907012953.301746-3-saeed@kernel.org Signed-off-by: Jakub Kicinski commit ce0b015e2619ae64b7d33fb24a6b6cadcd70c317 Author: Vlad Dumitrescu Date: Sat Sep 6 18:29:43 2025 -0700 devlink: Add 'total_vfs' generic device param NICs are typically configured with total_vfs=0, forcing users to rely on external tools to enable SR-IOV (a widely used and essential feature). Add total_vfs parameter to devlink for SR-IOV max VF configurability. Enables standard kernel tools to manage SR-IOV, addressing the need for flexible VF configuration. Signed-off-by: Vlad Dumitrescu Tested-by: Kamal Heib Reviewed-by: Jiri Pirko Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250907012953.301746-2-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 5cffc679ad1de542ef8a247b12283cbe57511fc8 Author: Qianfeng Rong Date: Thu Sep 4 21:23:51 2025 +0800 scsi: lpfc: Use int type to store negative error codes Change the 'ret' variable in lpfc_sli4_issue_wqe() from uint32_t to int, as it needs to store either negative error codes or zero returned by lpfc_sli4_wq_put(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit b0aca7ae828560b103016620be7fd4c302da4176 Author: Qianfeng Rong Date: Tue Sep 2 20:50:14 2025 +0800 scsi: target: iscsi: Use int type to store negative value Change the 'ret' variable in iscsit_tmr_task_reassign() from u64 to int, as it needs to store either negative value or zero returned by iscsit_find_cmd_for_recovery(). Storing the negative error codes in unsigned type, or performing equality comparisons (e.g., ret == -2), doesn't cause an issue at runtime [1] but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 Signed-off-by: Qianfeng Rong Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit b90c7ca4f9185c0d31ebbe252a448c42a5983483 Merge: 4ea83b75735118 e2cda6343bfe45 Author: Jakub Kicinski Date: Tue Sep 9 18:57:49 2025 -0700 Merge branch 'mptcp-make-add_addr-retransmission-timeout-adaptive' Matthieu Baerts says: ==================== mptcp: make ADD_ADDR retransmission timeout adaptive Currently, the MPTCP ADD_ADDR notifications are retransmitted after a fixed timeout controlled by the net.mptcp.add_addr_timeout sysctl knob, if the corresponding "echo" packets are not received before. This can be too slow (or too quick), especially with a too cautious default value set to 2 minutes. - Patch 1: make ADD_ADDR retransmission timeout adaptive, using the TCP's retransmission timeout. The corresponding sysctl knob is now used as a maximum value. - Patch 2: now that these ADD_ADDR retransmissions can happen faster, all MPTCP Join subtests checking ADD_ADDR counters accept more ADD_ADDR than expected (if any). This is aligned with the previous behaviour, when the ADD_ADDR RTO was lowered down to 1 second. - Patch 3: Some CIs have reported that some MPTCP Join signalling tests were unstable. It seems that it is due to the time it can take in slow environments to send a bunch of ADD_ADDR notifications and wait each time for their echo reply. Use a longer transfer to avoid such errors. v1: https://lore.kernel.org/d5397026-92eb-4a43-9534-954b43ab9305@kernel.org ==================== Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-0-824cc805772b@kernel.org Signed-off-by: Jakub Kicinski commit e2cda6343bfe459c3331db5afcd675ab333112dd Author: Matthieu Baerts (NGI0) Date: Sun Sep 7 17:32:44 2025 +0200 selftests: mptcp: join: allow more time to send ADD_ADDR When many ADD_ADDR need to be sent, it can take some time to send each of them, and create new subflows. Some CIs seem to occasionally have issues with these tests, especially with "debug" kernels. Two subtests will now run for a slightly longer time: the last two where 3 or more ADD_ADDR are sent during the test. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-3-824cc805772b@kernel.org Signed-off-by: Jakub Kicinski commit 63c31d42cf6f443662f167364baf31f1a8e8bb20 Author: Matthieu Baerts (NGI0) Date: Sun Sep 7 17:32:43 2025 +0200 selftests: mptcp: join: tolerate more ADD_ADDR ADD_ADDR can be retransmitted, and with, the parent commit, these retransmissions can be sent quicker: from 2 minutes to less than one second. To avoid false positives where retransmitted ADD_ADDR causes higher counters than expected, it is required to be more tolerant. Errors are now only reported when fewer ADD_ADDRs have been sent/received, except if no ADD_ADDR are expected. Before the parent commit, the tolerance was present for each tests where the ADD_ADDR could be retransmitted in a reasonable time (1 sec). Now that all tests can have retransmitted ADD_ADDR, it is normal to apply the same tolerance for all tests. An alternative could be to disable the ADD_ADDR retransmissions by default, but that's changing the default kernel behaviour. Plus, ADD_ADDR retransmissions can be required for some tests. To avoid adding exceptions to many tests, it seems better to increase the tolerance. Later, we could add a new MIB counter to identify the ADD_ADDR retransmissions, and remove the tolerance when this counter is available. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-2-824cc805772b@kernel.org Signed-off-by: Jakub Kicinski commit 30549eebc4d84f844c62965f2e1d362bc1accdce Author: Geliang Tang Date: Sun Sep 7 17:32:42 2025 +0200 mptcp: make ADD_ADDR retransmission timeout adaptive Currently the ADD_ADDR option is retransmitted with a fixed timeout. This patch makes the retransmission timeout adaptive by using the maximum RTO among all the subflows, while still capping it at the configured maximum value (add_addr_timeout_max). This improves responsiveness when establishing new subflows. Specifically: 1. Adds mptcp_adjust_add_addr_timeout() helper to compute the adaptive timeout. 2. Uses maximum subflow RTO (icsk_rto) when available. 3. Applies exponential backoff based on retransmission count. 4. Maintains fallback to configured max timeout when no RTO data exists. This slightly changes the behaviour of the MPTCP "add_addr_timeout" sysctl knob to be used as a maximum instead of a fixed value. But this is seen as an improvement: the ADD_ADDR might be sent quicker than before to improve the overall MPTCP connection. Also, the default value is set to 2 min, which was already way too long, and caused the ADD_ADDR not to be retransmitted for connections shorter than 2 minutes. Suggested-by: Matthieu Baerts (NGI0) Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/576 Reviewed-by: Christoph Paasch Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-1-824cc805772b@kernel.org Signed-off-by: Jakub Kicinski commit 4ea83b75735118eac40e6f76495d4a85373bd851 Merge: ce6adea19ad93b 88ca0c738c4159 Author: Jakub Kicinski Date: Tue Sep 9 18:44:07 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== idpf: add XDP support Alexander Lobakin says: Add XDP support (w/o XSk for now) to the idpf driver using the libeth_xdp sublib. All possible verdicts, .ndo_xdp_xmit(), multi-buffer etc. are here. In general, nothing outstanding comparing to ice, except performance -- let's say, up to 2x for .ndo_xdp_xmit() on certain platforms and scenarios. idpf doesn't support VLAN Rx offload, so only the hash hint is available for now. Patches 1-7 are prereqs, without which XDP would either not work at all or work slower/worse/... * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: add XDP RSS hash hint idpf: add support for .ndo_xdp_xmit() idpf: add support for XDP on Rx idpf: use generic functions to build xdp_buff and skb idpf: implement XDP_SETUP_PROG in ndo_bpf for splitq idpf: prepare structures to support XDP idpf: add support for nointerrupt queues idpf: remove SW marker handling from NAPI idpf: add 4-byte completion descriptor definition idpf: link NAPIs to queues idpf: use a saner limit for default number of queues to allocate idpf: fix Rx descriptor ready check barrier in splitq xdp, libeth: make the xdp_init_buff() micro-optimization generic ==================== Link: https://patch.msgid.link/20250908195748.1707057-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit b132e9745e8cd5d383253dc3f21775d6cdea1fd8 Author: Dmitry Baryshkov Date: Sun Sep 7 00:48:52 2025 +0300 dt-bindings: dp-connector: describe separate DP and AUX lines In some cases it's reasonable to describe DP lanes and AUX signal lines separately in the DT. One of the typical reasons is if the source of DP signals can support either USB-C or DP connections. In such a case the transmitter of DP signals have separate ports: one for SS lanes and another one for SBU / AUX signals. Instead of leaving AUX signals from the controller unconnected, add an option to the DT schema to AUX signal lines separately from the main link lanes. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250907-dp-conenctor-sbu-v1-1-de79c0fcd64d@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 3ef9c995fa51a90b08b0cc8d2951acb53c38936c Author: Krzysztof Kozlowski Date: Thu Sep 4 16:24:01 2025 +0200 docs: dt: writing-schema: Describe defining properties in top-level Document established Devicetree bindings maintainers review practice: Properties having differences per each device in the binding, e.g. different constraints for lists or different allowed values, should still be defined in top-level 'properties' section and only customized in 'if:then:'. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250904142400.179955-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit ce6adea19ad93b957190d1a04192519f748bae7b Author: Ido Schimmel Date: Mon Sep 8 10:51:41 2025 +0300 vxlan: Make vxlan_fdb_find_uc() more robust against NPDs first_remote_rcu() can return NULL if the FDB entry points to an FDB nexthop group instead of a remote destination. However, unlike other users of first_remote_rcu(), NPD cannot currently happen in vxlan_fdb_find_uc() as it is only invoked by one driver which vetoes the creation of FDB nexthops. Make the function more robust by making sure the remote destination is only dereferenced if it is not NULL. Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: Wang Liang Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250908075141.125087-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 051b62b71e2e335af963caf5d54a9895f4695096 Author: Vladimir Oltean Date: Mon Sep 8 16:43:13 2025 +0300 net: phy: aquantia: delete aqr_firmware_read_fingerprint() prototype This is a development artifact of commit a76f26f7a81e ("net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C)"). This function name isn't used. Instead we have aqr_build_fingerprint() in aquantia_main.c. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250908134313.315406-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0d0766a47cd2a5dcfe711a6ba373cf4da243b59e Merge: d436b5abba4f80 29838255793588 Author: Jakub Kicinski Date: Tue Sep 9 18:11:26 2025 -0700 Merge branch 'net-phy-fixed_phy-improvements' Heiner Kallweit says: ==================== net: phy: fixed_phy: improvements This series contains a number of improvements. No functional change intended. ==================== Link: https://patch.msgid.link/e81be066-cc23-4055-aed7-2fbc86da1ff7@gmail.com Signed-off-by: Jakub Kicinski commit 2983825579358887a59cd9f76d55d5f54f659ebf Author: Heiner Kallweit Date: Sun Sep 7 00:02:44 2025 +0200 net: phy: fixed_phy: remove struct fixed_mdio_bus Use two separate static variables instead of the struct, this allows to simplify the code. Signed-off-by: Heiner Kallweit Signed-off-by: Jakub Kicinski commit f8db55c8eb8e9d958694bae6958d5a3467caabb2 Author: Heiner Kallweit Date: Sun Sep 7 00:01:52 2025 +0200 net: phy: fixed_phy: add helper fixed_phy_find Factor out the functionality to search for a fixed_phy matching an address. This improves readability of the code. Signed-off-by: Heiner Kallweit Signed-off-by: Jakub Kicinski commit 0625b3bfbb7f5706d83fa1fd3f8a30a5fded108f Author: Heiner Kallweit Date: Sun Sep 7 00:01:02 2025 +0200 net: phy: fixed_phy: remove member no_carrier from struct fixed_phy After the recent removal of gpio support member no_carrier isn't needed any longer. Signed-off-by: Heiner Kallweit Signed-off-by: Jakub Kicinski commit fecf7087f0a32151f146ce6c6a7fd30b4b1a838d Author: Heiner Kallweit Date: Sun Sep 7 00:00:10 2025 +0200 net: phy: fixed_phy: remove unused interrupt support The two callers of __fixed_phy_add() both pass PHY_POLL, so we can remove the irq argument to simplify the function. Signed-off-by: Heiner Kallweit Signed-off-by: Jakub Kicinski commit d436b5abba4f80e968b3ff83be4363c7aedcc799 Author: Alok Tiwari Date: Sun Sep 7 12:25:32 2025 -0700 ipv4: udp: fix typos in comments Correct typos in ipv4/udp.c comments for clarity: "Encapulation" -> "Encapsulation" "measureable" -> "measurable" "tacking care" -> "taking care" No functional changes. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250907192535.3610686-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 1c0353a6df82c0de6e6527b807f6a1b0140bfe8a Author: Jakub Kicinski Date: Sat Sep 6 14:45:35 2025 -0700 selftests: net: speed up pmtu.sh by avoiding unnecessary cleanup The pmtu test takes nearly an hour when run on a debug kernel (10min on a normal kernel, so the debug slow down is quite significant). NIPA tries to ensure all results are delivered by a certain deadline so this prevents it from retrying the test in case of a flake. Looks like one of the slowest operations in the test is calling out to ./openvswitch/ovs-dpctl.py to remove potential leftover OvS interfaces. Check whether the interfaces exist in the first place in sysfs, since it can be done directly in bash it is very fast. This should save us around 20-30% of the test runtime. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250906214535.3204785-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 70bab1937e39fd8f6efc80fd1a8b4da63622dd81 Author: Andrea della Porta Date: Fri Sep 5 11:42:40 2025 +0200 arm64: dts: broadcom: Enable USB devicetree entries for Rpi5 RaspberryPi 5 presents two USB 2.0 and two USB 3.0 ports. Configure and enable the USB nodes in the devicetree. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/c6b17f0f896b5cdd790fc10aeb2b76b71df9b58d.1757065053.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit a12fd5c31b7894b6d1d7206bdefe869b5bed6e22 Author: Jakub Kicinski Date: Mon Sep 8 13:10:21 2025 -0700 selftests: net: run groups from fcnal-test in parallel fcnal-test.sh takes almost hour and a half to finish. The tests are already grouped into ipv4, ipv6 and other. Run those groups separately. Reviewed-by: David Ahern Link: https://patch.msgid.link/20250908201021.270681-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 099381a08db3539c6aab6616c94d7950d74fcd2d Author: Miguel Ojeda Date: Fri Aug 29 21:22:42 2025 +0200 rust: error: improve `to_result` documentation Core functions like `to_result` should have good documentation. Thus improve it, including adding an example of how to perform early returns with it. Reviewed-by: Benno Lossin Reviewed-by: Alexandre Courbot Signed-off-by: Miguel Ojeda commit 58b4aa53606f75c7d6e6cd4710da4d4399e8f667 Author: Miguel Ojeda Date: Fri Aug 29 21:22:41 2025 +0200 rust: error: improve `Error::from_errno` documentation This constructor is public since commit 5ed147473458 ("rust: error: make conversion functions public"), and we will refer to it from the documentation of `to_result` in a later commit. Thus improve its documentation, including adding examples. Reviewed-by: Alexandre Courbot Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit b11aa9565f800fe33369936a1730de2e344ea5ef Author: Andrea della Porta Date: Fri Sep 5 11:42:39 2025 +0200 arm64: dts: broadcom: rp1: Add USB nodes The RaspberryPi 5 has RP1 chipset containing two USB host controller, while presenting two USB 2.0 and two USB 3.0 ports to the outside. Add the relevant USB nodes to the devicetree. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/16d753cb4bf37beb5e9c6f0e03576cf13708f27d.1757065053.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit c33c43f71bda362b292a6e57ac41b64342dc87b3 Author: Ming Wang Date: Tue Sep 9 20:58:40 2025 +0800 irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller On certain Loongson platforms, drivers attempting to request a legacy ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The virtual IRQ descriptor is not fully initialized and lacks a valid irqchip. This issue does not affect ACPI-enumerated devices described in DSDT, as their interrupts are properly mapped via the GSI translation path. This indicates the LPC irqdomain itself is functional but is not correctly handling direct VIRQ-to-HWIRQ mappings. The root cause is the use of irq_domain_create_linear(). This API sets up a domain for dynamic, on-demand mapping, typically triggered by a GSI request. It does not pre-populate the mappings for the legacy VIRQ range (0-15). Consequently, if no ACPI device claims a specific GSI (e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to the LPC domain. A direct call to request_irq(4, ...) then fails because the kernel cannot resolve this VIRQ to a hardware interrupt managed by the LPC controller. The PCH-LPC interrupt controller is an i8259-compatible legacy device that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to support legacy drivers. Fix this by replacing irq_domain_create_linear() with irq_domain_create_legacy(). This API is specifically designed for such controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ mapping for the entire legacy range (0-15) immediately upon domain creation. This ensures that any VIRQ in this range is always resolvable, making direct calls to request_irq() for legacy IRQs function correctly. Signed-off-by: Ming Wang Signed-off-by: Thomas Gleixner commit 0855c764f7e6d58e1f5a502fc26830033ce94dbb Author: Rodrigo Siqueira Date: Sun Aug 24 18:46:41 2025 -0600 drm/amdgpu/vcn: Change amdgpu_vcn_sw_fini return to void The function amdgpu_vcn_sw_fini() returns an integer, but this number is always 0. This commit changes the amdgpu_vcn_sw_fini() return to void, and eliminates all checks to this return across different VCNs. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 3d9752f4f9319110896ee497e23b18897189eb14 Author: Rodrigo Siqueira Date: Sun Aug 24 18:46:40 2025 -0600 drm/amdgpu/vcn: Document IRQ per-instance irq behavior for VCN 4.0.3 When examining the VCN function init, it is common to find a loop that initializes VCN rings, which uses one IRQ per instance. However, VCN 4.0.3 deviates from this pattern, as it includes a distinct field to differentiate instances, which results in a slightly different ring init. This commit makes this difference explicit by using a fixed index when initializing the ring buffer and also adds a comment. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 8b38bf38830a84de70d53ad388268cbbe677118d Author: Prike Liang Date: Fri May 16 16:20:54 2025 +0800 drm/amdgpu: validate userq hw unmap status for destroying userq Before destroying the userq buffer object, it requires validating the userq HW unmap status and ensuring the userq is unmapped from hardware. If the user HW unmap failed, then it needs to reset the queue for reusing. Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 11aaec3566480e6cde0edb8e663c4b5ee32318f5 Author: Srinivasan Shanmugam Date: Wed Aug 20 16:17:52 2025 +0530 drm/amdgpu: Wire up MMIO_REMAP placement and User-visible strings Wire up the conversions and strings for the new MMIO_REMAP placement: * amdgpu_mem_type_to_domain() maps AMDGPU_PL_MMIO_REMAP -> domain * amdgpu_bo_placement_from_domain() accepts the new domain * amdgpu_bo_mem_stats_placement() and amdgpu_bo_print_info() report it * res cursor supports the new placement * fdinfo prints "mmioremap" for the new placement Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 357fe94b66f851c8824415d0168a8a72c4778698 Author: Srinivasan Shanmugam Date: Wed Aug 20 12:48:50 2025 +0530 drm/amdgpu/ttm: Add New AMDGPU_PL_MMIO_REMAP Placement Introduce a kernel-internal TTM placement type AMDGPU_PL_MMIO_REMAP for the HDP flush MMIO remap page Plumbing added: - amdgpu_res_cursor.{first,next}: treat MMIO_REMAP like DOORBELL - amdgpu_ttm_io_mem_reserve(): return BAR bus address + offset for MMIO_REMAP, mark as uncached I/O - amdgpu_ttm_io_mem_pfn(): PFN from register BAR - amdgpu_res_cpu_visible(): visible to CPU - amdgpu_evict_flags()/amdgpu_bo_move(): non-migratable - amdgpu_ttm_tt_pde_flags(): map as SYSTEM - amdgpu_bo_mem_stats_placement(): report AMDGPU_PL_MMIO_REMAP - amdgpu_fdinfo: print “mmioremap” bucket label Cc: Alex Deucher Suggested-by: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 8908fdce0634a623404e9923ed2f536101a39db5 Author: David Rosca Date: Mon Aug 18 09:18:37 2025 +0200 drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time There is no reason to require this to happen on first submitted IB only. We need to wait for the queue to be idle, but it can be done at any time (including when there are multiple video sessions active). Signed-off-by: David Rosca Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit dc8f9f0f45166a6b37864e7a031c726981d6e5fc Author: David Rosca Date: Mon Aug 18 09:06:58 2025 +0200 drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages There can be multiple engine info packages in one IB and the first one may be common engine, not decode/encode. We need to parse the entire IB instead of stopping after finding first engine info. Signed-off-by: David Rosca Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit d426a5b6da2bba04566acfad94b6921141a2bf85 Author: Prike Liang Date: Tue Jun 17 15:37:31 2025 +0800 drm/amdgpu: clean up the amdgpu_userq_active() This is no invocation for amdgpu_userq_active(). Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 28f75f9bcc7da7da12e5dae2ae8d8629a2b2e42e Author: Sathishkumar S Date: Tue Aug 19 16:11:01 2025 +0530 drm/amdgpu/jpeg: Move parse_cs to amdgpu_jpeg.c Rename jpeg_v2_dec_ring_parse_cs to amdgpu_jpeg_dec_parse_cs and move it to amdgpu_jpeg.c as it is shared among jpeg versions. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 1697398555f69b31e939e070b304292513d4c9ff Author: Ray Wu Date: Mon Sep 8 17:21:27 2025 +0800 drm/amd/display: Remove duplicated code [Why&How] Remove duplicated code Reviewed-by: Alex Deucher Reviewed-by: Tom Chung Signed-off-by: Ray Wu Signed-off-by: Alex Deucher commit 219be4711a1ba788bc2a9fafc117139d133e5fea Author: Prike Liang Date: Wed May 14 12:43:57 2025 +0800 drm/amdgpu: validate userq input args This will help on validating the userq input args, and rejecting for the invalid userq request at the IOCTLs first place. Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 056132483724a1ba1ff8823914dace71f8e8938c Author: Srinivasan Shanmugam Date: Wed Aug 20 12:33:29 2025 +0530 drm/amdgpu/uapi: Introduce AMDGPU_GEM_DOMAIN_MMIO_REMAP Add a new GEM domain bit AMDGPU_GEM_DOMAIN_MMIO_REMAP to allow userspace to request the MMIO remap (HDP flush) page via GEM_CREATE. - include/uapi/drm/amdgpu_drm.h: * define AMDGPU_GEM_DOMAIN_MMIO_REMAP * include the bit in AMDGPU_GEM_DOMAIN_MASK v2: Add early reject in amdgpu_gem_create_ioctl() (Alex). Cc: Christian König Suggested-by: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 60df8a5d8f6505974784f7290fdfa94e2aa4e255 Author: Srinivasan Shanmugam Date: Tue Aug 26 15:49:20 2025 +0530 drm/ttm: Bump TTM_NUM_MEM_TYPES to 9 (Prep for AMDGPU_PL_MMIO_REMAP) Increase TTM_NUM_MEM_TYPES from 8 to 9 to accommodate the upcoming AMDGPU_PL_MMIO_REMAP placement. Cc: Alex Deucher Suggested-by: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d97b74a833eba1f4f69f67198fd98ef036c0e5f9 Author: Pratap Nirujogi Date: Wed Sep 3 16:00:24 2025 -0400 drm/amd/amdgpu: Declare isp firmware binary file Declare isp firmware file isp_4_1_1.bin required by isp4.1.1 device. Suggested-by: Alexey Zagorodnikov Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit 27e4dc2c0543fd1808cc52bd888ee1e0533c4a2e Author: Alex Deucher Date: Wed Sep 3 09:11:12 2025 -0400 drm/amd/display: use udelay rather than fsleep This function can be called from an atomic context so we can't use fsleep(). Fixes: 01f60348d8fb ("drm/amd/display: Fix 'failed to blank crtc!'") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4549 Cc: Wen Chen Cc: Fangzhi Zuo Cc: Nicholas Kazlauskas Cc: Harry Wentland Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 4e89d629dc72965ea05a9b5231862ffd9c9dab55 Author: John Olender Date: Fri Sep 5 06:11:28 2025 -0400 drm/amdgpu: Fix NULL ptr deref in amdgpu_device_cache_switch_state() Kaveri has no upstream bridge, therefore parent is NULL. $ lspci -PP ... 00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Kaveri [Radeon R7 Graphics] (rev d4) For comparison, Raphael: $ lspci -PP ... 00:08.1 PCI bridge: Advanced Micro Devices, Inc. [AMD] Raphael/Granite Ridge Internal GPP Bridge to Bus [C:A] ... 00:08.1/0e:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Raphael (rev c5) Fixes: 1dd2fa0e00f1 ("drm/amdgpu: Save and restore switch state") Link: https://lore.kernel.org/amd-gfx/38fe6513-f8a9-4669-8e86-89c54c465611@gmail.com/ Reviewed-by: Candice Li Reviewed-by: Yang Wang Signed-off-by: John Olender Signed-off-by: Alex Deucher commit a525fa37aac36c4591cc8b07ae8957862415fbd5 Author: Alex Deucher Date: Thu Sep 4 12:35:05 2025 -0400 drm/amdgpu: fix a memory leak in fence cleanup when unloading Commit b61badd20b44 ("drm/amdgpu: fix usage slab after free") reordered when amdgpu_fence_driver_sw_fini() was called after that patch, amdgpu_fence_driver_sw_fini() effectively became a no-op as the sched entities we never freed because the ring pointers were already set to NULL. Remove the NULL setting. Reported-by: Lin.Cao Cc: Vitaly Prosyak Cc: Christian König Fixes: b61badd20b44 ("drm/amdgpu: fix usage slab after free") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0d40ea784304358753bfbc8824d2a7d42687bd1e Author: Julia Filipchuk Date: Fri Aug 29 16:46:56 2025 -0700 drm/xe/guc: Recommend GUC v70.49.4 for PTL, BMG UAPI compatibility version 1.24.4 Resolves various BMG, SRIOV issues and adds new PTL features. Signed-off-by: Julia Filipchuk Reviewed-by: Zhanjun Dong Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250829235305.672287-7-julia.filipchuk@intel.com commit acc211539c81b2f2f0d15827dad2bf308b1712d0 Author: Valentina Fernandez Date: Mon Sep 8 12:57:32 2025 +0100 riscv: dts: microchip: add a device tree for Discovery Kit Add a minimal device tree for the Microchip PolarFire SoC Discovery Kit. The Discovery Kit is a cost-optimized board based on PolarFire SoC MPFS095T and features: - 1 GB DDR4x16 - 1x Gigabit Ethernet - 3x UARTs - Raspberry Pi connector - mikroBus connector - microSD card connector Link: https://www.microchip.com/en-us/development-tool/mpfs-disco-kit Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit d6d9d9be2aa407c10911967a3115654b21a5c23d Author: Valentina Fernandez Date: Mon Sep 8 12:57:31 2025 +0100 dt-bindings: riscv: microchip: document Discovery Kit The Discovery Kit (MPFS-DISCO-KIT) is a development board featuring a Microchip PolarFire SoC MPFS095T. Link: https://www.microchip.com/en-us/development-tool/mpfs-disco-kit Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit 02428682b2eb5ff1669e256f8f94ee1511d22ee1 Author: Valentina Fernandez Date: Mon Sep 8 12:57:30 2025 +0100 riscv: dts: microchip: rename icicle kit ccc clock and other minor fixes Rename the Clock Conditioning Circuit (CCC) reference clock to match the fixed clock bindings naming recommendation. Update the reserved memory regions in the Icicle Kit common dtsi to use lowercase hex and drop the redundant status properties from the memory regions, as they are not required. Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit 2775e87c343c0e355512849dd7364b6c09f4f73d Author: Valentina Fernandez Date: Mon Sep 8 12:57:29 2025 +0100 riscv: dts: microchip: add icicle kit with production device With the introduction of the Icicle Kit using the production MPFS250T device, it's necessary to distinguish it from the engineering sample (-es) variant. Engineering samples cannot write to flash from the MSS, as noted in the PolarFire SoC FPGA ES errata. Add a new device tree (mpfs-icicle-kit-prod.dts) for the production board which includes the icicle kit common dtsi and enable the system controller SPI flash, which is only accessible on production silicon. Remove redundant board compatible from fabric dtsi and update board compatibles for v2025.07 release, which includes Mi-V IHC v2 for AMP cluster communication. Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit 87f8ae1d0faebbaaf163ecfd1321432d85ada178 Author: Valentina Fernandez Date: Mon Sep 8 12:57:28 2025 +0100 dt-bindings: riscv: microchip: document icicle kit with production device With the introduction of the Icicle Kit using the production MPFS250T device, it's necessary to distinguish it from the engineering sample (-es) variant. Engineering samples cannot write to flash from the MSS, as noted in the PolarFire SoC FPGA ES errata. Add specific compatibles for the Icicle Kit with Production device (MPFS250T) and Icicle Kit with Engineering Sample (MPFS250T_ES). The icicle kit reference designs in the v2025.07 release include the Mi-V IHC IP v2, used to send/receive data between clusters when using Asymmetric Multiprocessing (AMP) mode. In reference design releases prior to v2025.07, the MI-V IHC subsystem was included as a proof of concept in the design prior to becoming an IP available in the Libero catalog. Among other improvements, the new Mi-V IHC IP v2 includes some changes to the register map. For this reason, make use of a new reference design compatible to denote that v2025.07 reference design releases are not backwards compatible. Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit f401a8ba756e31dcc47d643da8d1363a342da1a8 Author: Valentina Fernandez Date: Mon Sep 8 12:57:27 2025 +0100 riscv: dts: microchip: add common board dtsi for icicle kit variants In preparation for supporting the Icicle Kit with production silicon, add a common board dtsi for the icicle kit with hardware shared by both the engineering sample and production versions. Signed-off-by: Valentina Fernandez Signed-off-by: Conor Dooley commit f44a29784f685804d9970cfb0d3439c9e30981d7 Author: Konstantin Ryabitsev Date: Tue Sep 2 11:44:19 2025 -0400 Documentation: update maintainer-pgp-guide for latest best practices Freshen up the maintainer PGP guide: - Bump minimum GnuPG version requirement from 2.2 to 2.4, since 2.2 is no longer maintained - All major hardware tokens now support Curve25519, so remove outdated ECC support callouts - Update hardware device recommendations (Nitrokey Pro 2 -> Nitrokey 3) - Broaden backup media terminology (USB thumb drive -> external media) - Update wording to follow vale's linter recommendations - Various minor wording improvements for clarity Signed-off-by: Konstantin Ryabitsev Reviewed-by: Paul Barker Signed-off-by: Jonathan Corbet Message-ID: <20250902-pgp-guide-updates-v1-1-62ac7312d3f9@linuxfoundation.org> commit dc896f853e1ae4523a6a45947c8ee89f46b8c93b Author: Jakub Kicinski Date: Thu Sep 4 07:45:33 2025 -0700 docs: submitting-patches: adjust Fixes definition slightly Every now and then people send stylistic patches and use Fixes purely to refer to a commit which added the ugly or unnecessary code. Reword the docs about Fixes. It should hopefully be enough to lead with the word "bug" rather than "issue". We can add more verbiage later, tho, let's try the word swap first. I always feel like the more words the smaller the chance someone will actually read the docs. Signed-off-by: Jakub Kicinski Signed-off-by: Jonathan Corbet Message-ID: <20250904144533.2146576-1-kuba@kernel.org> commit 2d0dbf6e04264fce79de0dd99272949be75ac950 Merge: f874abea20bc38 f2c2f6490085e2 Author: Jonathan Corbet Date: Tue Sep 9 13:40:35 2025 -0600 Merge branch 'renames' into docs-mw From Vegard Nossum: When we rename an .rst file, that also changes the URL for the document at https://docs.kernel.org/ and results in a 404, which can be anonying for people who bookmark URLs and/or follow links from search engines and old changelogs and emails. In order to be able to fearlessly rename individual documentation files and reorganize Documentation/, add two scripts: - tools/docs/gen-renames.py : use git to figure out which .rst files have been renamed - tools/docs/gen-redirects.py : actually generate .html stubs for the locations, redirecting to the new locations The reason for splitting this into two is that trawling git history is slightly slow (on the order of 20-30 seconds on my laptop) whereas just generating the HTML files is very fast. This also allows us to cache the historical renames in Documentation/.renames.txt or add manual fixups as needed. commit f2c2f6490085e29521f87d5464b2cdceff0f0c7a Author: Vegard Nossum Date: Fri Sep 5 16:46:08 2025 +0200 docs: add tools/docs/gen-redirects.py Add a new script and a new documentation 'make' target, htmldocs-redirects. This will generate HTML stub files in the HTML documentation output directory that redirect the browser to the new path. Suggested-by: Konstantin Ryabitsev Suggested-by: Jonathan Corbet Signed-off-by: Vegard Nossum Signed-off-by: Jonathan Corbet Message-ID: <20250905144608.577449-4-vegard.nossum@oracle.com> commit 4b6fba464322f5850dbcce32f3a25eeebf64e770 Author: Vegard Nossum Date: Fri Sep 5 16:46:07 2025 +0200 docs: add Documentation/.renames.txt This is the result of running: scripts/documentation-gen-renames.py --rev v6.17-rc3 > Documentation/.renames.txt This file records renames in the Documentation/ directory so that we can use it to quickly generate HTML redirects from removed paths. Suggested-by: Jonathan Corbet Signed-off-by: Vegard Nossum Signed-off-by: Jonathan Corbet Message-ID: <20250905144608.577449-3-vegard.nossum@oracle.com> commit 2f1c96018b10e6d42280db3a6faa47d80c961b6b Author: Vegard Nossum Date: Fri Sep 5 16:46:06 2025 +0200 docs: add tools/docs/gen-renames.py Add a new script that wraps git to trawl the repository history for renames of .rst files in the Documentation/ directory. Example usage: tools/docs/gen-renames.py --rev v6.17-rc3 > Documentation/.renames.txt The output format is simply: SPACE NEWLINE where neither nor contain the Documentation/ prefix or the .rst suffix. The file is sorted alphabetically. We can suggest rerunning the script for future renames (and squash the resulting change) or rerun it periodically to keep the file up to date. Signed-off-by: Vegard Nossum Signed-off-by: Jonathan Corbet Message-ID: <20250905144608.577449-2-vegard.nossum@oracle.com> commit a33be64b98d0723748d2fab0832b926613e1fce0 Author: Jaegeuk Kim Date: Tue Sep 9 00:26:06 2025 +0000 f2fs: fix wrong layout information on 16KB page This patch fixes to support different block size. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f874abea20bc381ecf3cab6dad56c5ff66d1a5cc Author: Bagas Sanjaya Date: Tue Sep 9 09:21:42 2025 +0700 Documentation: w1: Fix SPDX comment syntax on masters and slaves toctree index Commit e9bb627561535d ("docs: w1: convert to ReST and add to the kAPI group of docs") converts 1-Wire docs to reST alongside with SPDX comment, yet the comment is written in one dot as opposed to two in order to be recognized as comment directive, which spills it into htmldocs output. This issue is partially fixed in d8fb03e1ea64e7 ("docs: w1: Fix SPDX-License-Identifier syntax") as it only touches top-level w1 toctree. Do the same fix on masters and slaves toctrees. Fixes: e9bb62756153 ("docs: w1: convert to ReST and add to the kAPI group of docs") Signed-off-by: Bagas Sanjaya Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Corbet Message-ID: <20250909022142.18007-1-bagasdotme@gmail.com> commit bea3e1d4467bcf292c8e54f080353d556d355e26 Author: Kang Chen Date: Tue Sep 9 11:13:16 2025 +0800 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186 Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290 CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x5f0 mm/kasan/report.c:482 kasan_report+0xca/0x100 mm/kasan/report.c:595 hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186 hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738 vfs_listxattr+0xbe/0x140 fs/xattr.c:493 listxattr+0xee/0x190 fs/xattr.c:924 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x143/0x360 fs/xattr.c:988 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe0e9fae16d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000 Allocated by task 14290: kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4333 [inline] __kmalloc_noprof+0x219/0x540 mm/slub.c:4345 kmalloc_noprof include/linux/slab.h:909 [inline] hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21 hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697 vfs_listxattr+0xbe/0x140 fs/xattr.c:493 listxattr+0xee/0x190 fs/xattr.c:924 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x143/0x360 fs/xattr.c:988 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f When hfsplus_uni2asc is called from hfsplus_listxattr, it actually passes in a struct hfsplus_attr_unistr*. The size of the corresponding structure is different from that of hfsplus_unistr, so the previous fix (94458781aee6) is insufficient. The pointer on the unicode buffer is still going beyond the allocated memory. This patch introduces two warpper functions hfsplus_uni2asc_xattr_str and hfsplus_uni2asc_str to process two unicode buffers, struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively. When ustrlen value is bigger than the allocated memory size, the ustrlen value is limited to an safe size. Fixes: 94458781aee6 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()") Signed-off-by: Kang Chen Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250909031316.1647094-1-k.chen@smail.nju.edu.cn Signed-off-by: Viacheslav Dubeyko commit 43fac1b2f015daedc6046863f7664f3178f0bbe2 Author: Michal Wajdeczko Date: Mon Sep 8 12:20:52 2025 +0200 drm/xe/guc: Don't invoke disable_ct action during replacement During second CT initialization step, known as post_hwconfig, we want to replace previously registered CT disable devm action to make sure it will be invoked prior to releasing underlying BO. But to replace this action we don't need to execute it right away since we know that CT was disabled prior to that late init step and we already assert that. Use devm_remove_action() instead to avoid extra message about 'disabling CT' that could be seen now: [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel disabled ... DEVRES REM ff11000149320940 guc_action_disable_ct (16 bytes) [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel disabled DEVRES ADD ff110001664fc040 guc_action_disable_ct (16 bytes) Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Cc: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908102053.539-3-michal.wajdeczko@intel.com commit 955f3bc4af440bb950c7a1567197aaf6aa2213ae Author: Michal Wajdeczko Date: Mon Sep 8 12:20:51 2025 +0200 drm/xe/guc: Always add CT disable action during second init step On DGFX, during init_post_hwconfig() step, we are reinitializing CTB BO in VRAM and we have to replace cleanup action to disable CT communication prior to release of underlying BO. But that introduces some discrepancy between DGFX and iGFX, as for iGFX we keep previously added disable CT action that would be called during unwind much later. To keep the same flow on both types of platforms, always replace old cleanup action and register new one. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Cc: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908102053.539-2-michal.wajdeczko@intel.com commit 1e5881b168b94871fecd4603633a5fe6a519cbbf Author: Namhyung Kim Date: Sun Sep 7 23:10:50 2025 -0700 perf annotate: Fix title line after return from call The second title line which shows symbol and DSO name is broken after moving to another function at 'callq' instruction. The ui_browser__show_title() is used for the first line which shows global sample count and event name so it doesn't change across the functions. What it needs after processing 'call' instruction is to update the second line onlly. Add a comment and call appropriate function. You can verify the change by pressing ENTER on a 'call' instruction and then ESC. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 7eabedef445a15d39feef1ff094b659327591140 Author: Namhyung Kim Date: Sun Sep 7 23:10:49 2025 -0700 perf annotate: Factor out annotate_browser__show_function_title() It'll be used in other places. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 48330efae9ccf44884af2b2f66fe695447240570 Author: Namhyung Kim Date: Sun Sep 7 23:10:48 2025 -0700 perf annotate: Fix signature of annotate_browser__show() According to convention, the first argument should be 'struct annotate_browser' instead of 'struct ui_brwoser'. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250908061050.27517-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit edf93f2a24de5791bfaa15d82794e38e97c9498c Author: James Clark Date: Mon Sep 8 13:10:21 2025 +0100 perf docs: Update SPE doc to include default instructions group The instructions group is now generated by default so update the doc to reflect this. Also explain the period/downsampling mechanism in more detail. Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ben Gainey Cc: George Wort Cc: Graham Woodward Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Michael Williams Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 9574a447478b5e6f5a31ef8b5f5cf5bbfbbc7157 Author: James Clark Date: Mon Sep 8 13:10:20 2025 +0100 perf arm-spe: Display --itrace period warnings for all sample types Currently we only display the warning when the instructions group is requested. Instructions are on by default, and the period applies to all sample types anyway so always check the options and show the warning. Reword the messages to be more explicit about which flags the warnings apply to. Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ben Gainey Cc: George Wort Cc: Graham Woodward Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Michael Williams Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit bf1af4f6e62878e053d20cd71267aed8dfb3e715 Author: James Clark Date: Mon Sep 8 13:10:19 2025 +0100 perf arm-spe: Downsample all sample types equally The various sample types that are generated are based on the same SPE sample, just placed into different sample type bins. The same sample can be in multiple bins if it has flags set that cause it to be. Currently we're only applying the --itrace interval downsampling to the instruction bin, which means that the sample would appear in one bin but not another if it was skipped due to downsampling. I don't thing anyone would want or expect this, so make this behave consistently by applying the downsampling before generating any sample. You might argue that the "instructions" interval type doesn't make sense to apply to "memory" sample types because it would be skipping every n memory samples, rather than every n instructions. ut the downsampling was already not an instruction interval even for the instruction samples. SPE has a hardware based sampling interval, and the instruction interval was just a convenient way to specify further downsampling. This is hinted at in the warning message shown for intervals greater than 1. This makes SPE diverge from trace technologies like Intel PT and Arm Coresight. In those cases instruction samples can be reduced but all branches are still emitted. This makes sense there, because branches form a complete execution history, and asking to skip branches every n instructions doesn't really make sense. But for SPE, as mentioned above, downsampling the instruction samples already wasn't consistent with trace technologies so we ended up with some middle ground that had no benefit. Now it's possible to reduce the volume of samples in all groups and samples won't be missing from one group but present in another. Reviewed-by: Leo Yan Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ben Gainey Cc: George Wort Cc: Graham Woodward Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Michael Williams Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 80a2d7ea487d9b31d9b78d551aba3bd57642ce97 Author: James Clark Date: Mon Sep 8 13:10:18 2025 +0100 perf arm-spe: Show instruction sample types by default Instruction sample types are enabled in the default itrace options in perf, but this never applied to SPE because the default nanoseconds period isn't supported. This meant that instructions ended up being opt-in by the user only when they requested an instruction based period. Change the default period type to instructions so that instruction samples are generated by default. This can overridden by specifying any --itrace option. This solves a common complaint from users that the unfiltered SPE samples appear to be missing, and only the samples that have memory flags set appear in the various memory groups. Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ben Gainey Cc: George Wort Cc: Graham Woodward Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Michael Williams Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 79b24810a25538df49d809741721ce3e6f342026 Merge: d0d1d522316e91 5ab829f1971dc9 Author: Jens Axboe Date: Tue Sep 9 11:22:20 2025 -0600 Merge tag 'md-6.18-20250909' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into for-6.18/block Pull MD changes from Yu Kuai: "Redundant data is used to enhance data fault tolerance, and the storage method for redundant data vary depending on the RAID levels. And it's important to maintain the consistency of redundant data. Bitmap is used to record which data blocks have been synchronized and which ones need to be resynchronized or recovered. Each bit in the bitmap represents a segment of data in the array. When a bit is set, it indicates that the multiple redundant copies of that data segment may not be consistent. Data synchronization can be performed based on the bitmap after power failure or readding a disk. If there is no bitmap, a full disk synchronization is required. Due to known performance issues with md-bitmap and the unreasonable implementations: - self-managed IO submitting like filemap_write_page(); - global spin_lock I have decided not to continue optimizing based on the current bitmap implementation, this new bitmap is invented without locking from IO fast path and can be used with fast disks. Key features for the new bitmap: - IO fastpath is lockless, if user issues lots of write IO to the same bitmap bit in a short time, only the first write has additional overhead to update bitmap bit, no additional overhead for the following writes; - support only resync or recover written data, means in the case creating new array or replacing with a new disk, there is no need to do a full disk resync/recovery;" * tag 'md-6.18-20250909' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: (24 commits) md/md-llbitmap: introduce new lockless bitmap md/md-bitmap: make method bitmap_ops->daemon_work optional md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER md/md-bitmap: add a new method blocks_synced() in bitmap_operations md/md-bitmap: add a new method skip_sync_blocks() in bitmap_operations md/md-bitmap: delay registration of bitmap_ops until creating bitmap md/md-bitmap: add a new sysfs api bitmap_type md: add a new mddev field 'bitmap_id' md/md-bitmap: support discard for bitmap ops md: factor out a helper raid_is_456() md: add a new parameter 'offset' to md_super_write() md/md-bitmap: introduce CONFIG_MD_BITMAP md: check before referencing mddev->bitmap_ops md/dm-raid: check before referencing mddev->bitmap_ops md/raid5: check before referencing mddev->bitmap_ops md/raid10: check before referencing mddev->bitmap_ops md/raid1: check before referencing mddev->bitmap_ops md/raid1: check bitmap before behind write md/md-bitmap: handle the case bitmap is not enabled before end_sync() md/md-bitmap: handle the case bitmap is not enabled before start_sync() ... commit 30071d58dfcef5da327e2f3b6ce848251814b266 Author: Matt Roper Date: Fri Sep 5 14:56:15 2025 -0700 drm/xe: Never report L3 bank mask for media GT going forward We currently report an L3 bank mask as part of the GT topology on both GTs (primary and media) because a copy of the L3 bank fuse register exists on both GTs (e.g., $gsi_offset + 0x9130 on Xe3). After recent discussions it's come to light that the only known userspace software that uses this part of the uapi (the compute UMD and Mesa) only uses the value reported for the primary GT; the value reported for the media GT is ignored by both projects, and the media UMDs don't have any use for L3 information today. Since we always strive to have our uapi match the specific needs of userspace and not include additional unused baggage, let's officially drop L3 bank reporting on the media GT going forward and only keep it around for the primary GT where it actually gets used. This change will only apply to future platforms (Xe3 and later); even though it would probably be safe to remove it from Xe1/Xe2 as well, we don't want to take any chances with changing existing ABI. Note that we'd already disabled reading/reporting of the L3 bank for the media GT on PTL in commit 9ab440a9d042 ("drm/xe/ptl: L3bank mask is not available on the media GT") because it was discovered that the copy of the fuse registers on the media GT were just reporting a bogus ~0 value rather than an accurate mask. So this is just extending that PTL behavior forward to WCL and other future platforms. Note that we're also free to reinstate this part of the uapi in the future if/when some new userspace consumer emerges that _does_ have a use for media-specific L3 bank masks. Cc: Fei Yang Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250905215614.796247-3-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit be6f43c64ca0f7929904f31c2a034c81093eb5c0 Author: Akhil P Oommen Date: Tue Jul 1 21:50:46 2025 +0530 arm64: dts: qcom: x1e80100: Update GPU OPP table Update the GPU OPP table with new opp levels along with the speedbin configurations. Signed-off-by: Akhil P Oommen Tested-by: Jens Glathe Link: https://lore.kernel.org/r/20250701-x1e-speedbin-b4-v2-3-a8a7e06d39fb@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d0d1d522316e91f2b935a78bbf962b8e529d8c4f Author: Keith Busch Date: Wed Sep 3 13:27:46 2025 -0700 blk-map: provide the bdev to bio if one exists We can now safely provide a block device when extracting user pages for driver and user passthrough commands. Set the bdev so the caller doesn't have to do that later. This has an additional benefit of being able to extract P2P pages in the passthrough path. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit d57447ffb5fadffdba920f2fb933296fb6c5ff57 Author: Keith Busch Date: Wed Sep 3 12:33:17 2025 -0700 blk-mq-dma: bring back p2p request flags We only need to consider data and metadata dma mapping types separately. The request and bio integrity payload have enough flag bits to internally track the mapping type for each. Use these so the caller doesn't need to track them, and provide separete request and integrity helpers to the common code. This will make it easier to scale new mappings, like the proposed MMIO attribute, without burdening the caller to track such things. Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Leon Romanovsky Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 05ceea5d3ec9a1b1d6858ffd4739fdb0ed1b8eaf Author: Keith Busch Date: Wed Sep 3 12:33:16 2025 -0700 blk-integrity: enable p2p source and destination Set the extraction flags to allow p2p pages for the metadata buffer if the block device allows it. Similar to data payloads, ensure the bio does not use merging if we see a p2p page. Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit b475272f03ca5d0c437c8f899ff229b21010ec83 Author: Keith Busch Date: Wed Aug 27 07:12:58 2025 -0700 iov_iter: remove iov_iter_is_aligned No more callers. Signed-off-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Reviewed-by: Mike Snitzer Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 69d7ed5b9ef661230264bfa0db4c96fa25b8efa4 Author: Keith Busch Date: Wed Aug 27 07:12:57 2025 -0700 blk-integrity: use simpler alignment check We're checking length and addresses against the same alignment value, so use the more simple iterator check. Signed-off-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9eab1d4e0d15b633adc170c458c51e8be3b1c553 Author: Keith Busch Date: Wed Aug 27 07:12:56 2025 -0700 block: remove bdev_iter_is_aligned No more callers. Signed-off-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 7eac331869575d81eaa2dd68b19e7468f8fa93cb Author: Keith Busch Date: Wed Aug 27 07:12:55 2025 -0700 iomap: simplify direct io validity check The block layer checks all the segments for validity later, so no need for an early check. Just reduce it to a simple position and total length check, and defer the more invasive segment checks to the block layer. Signed-off-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 5ff3f74e145adc79b49668adb8de276446acf6be Author: Keith Busch Date: Wed Aug 27 07:12:54 2025 -0700 block: simplify direct io validity check The block layer checks all the segments for validity later, so no need for an early check. Just reduce it to a simple position and total length check, and defer the more invasive segment checks to the block layer. Signed-off-by: Keith Busch Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 20a0e6276edba4318c13486df02c31e5f3c09431 Author: Keith Busch Date: Wed Aug 27 07:12:53 2025 -0700 block: align the bio after building it Instead of ensuring each vector is block size aligned while constructing the bio, just ensure the entire size is aligned after it's built. This makes getting bio pages more flexible to accepting device valid io vectors that would otherwise get rejected by alignment checks. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 743bf2e0c49c835cb7c4e4ac7d5a2610587047be Author: Keith Busch Date: Wed Aug 27 07:12:52 2025 -0700 block: add size alignment to bio_iov_iter_get_pages The block layer tries to align bio vectors to the block device's logical block size. Some cases don't have a block device, or we may need to align to something larger, which we can't derive it from the queue limits. Have the caller specify what they want, or allow any length alignment if nothing was specified. Since the most common use case relies on the block device's limits, a helper function is provided. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit fec2e705729dc93de5399d8b139e4746805c3d81 Author: Keith Busch Date: Wed Aug 27 07:12:51 2025 -0700 block: check for valid bio while splitting We're already iterating every segment, so check these for a valid IO lengths at the same time. Individual segment lengths will not be checked on passthrough commands. The read/write command segments must be sized to the dma alignment. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit f85981327a90c51e76f60e073cb6648b2f167226 Author: Jiayuan Chen Date: Tue Sep 9 20:47:04 2025 +0800 selftests/bpf: Fix incorrect array size calculation The loop in bench_sockmap_prog_destroy() has two issues: 1. Using 'sizeof(ctx.fds)' as the loop bound results in the number of bytes, not the number of file descriptors, causing the loop to iterate far more times than intended. 2. The condition 'ctx.fds[0] > 0' incorrectly checks only the first fd for all iterations, potentially leaving file descriptors unclosed. Change it to 'ctx.fds[i] > 0' to check each fd properly. These fixes ensure correct cleanup of all file descriptors when the benchmark exits. Reported-by: Dan Carpenter Signed-off-by: Jiayuan Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250909124721.191555-1-jiayuan.chen@linux.dev Closes: https://lore.kernel.org/bpf/aLqfWuRR9R_KTe5e@stanley.mountain/ commit 3b4296f5893d3a4e19edfc3800cb79381095e55f Merge: 0574c27cbe7973 ff97bc38be343e Author: Jakub Kicinski Date: Tue Sep 9 09:03:51 2025 -0700 Merge tag 'mlx5-rs-fec-ifc' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-09-09 The following pull-request contains a common mlx5 update. * tag 'mlx5-rs-fec-ifc' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add RS FEC histogram infrastructure ==================== Link: https://patch.msgid.link/1757413460-539097-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f8d2c26df98b487d61e582c01804340b96c44e44 Author: Jonathan Cavitt Date: Thu Sep 4 19:30:42 2025 +0000 drm/i915/gt: Fix memory leak in hangcheck selftest In active_engines, if intel_context_create fails, we need to go backwards through all the created contexts to free/put them. However, the way this is currently performed skips the first created context, as if count == 1, then --count returns 0 and exits the while-loop prematurely without performing the intel_context_put on context 0. Fix this by post-decrementing count in the while-loop, rather than pre-decrementing it. This change makes the prior guard against count underflowing unnecessary, as the while-loop exits when count == 0. Signed-off-by: Jonathan Cavitt Cc: Krzysztof Karas Cc: Andi Shyti Cc: Sebastian Brzezinka Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250904193041.12888-2-jonathan.cavitt@intel.com commit 318d441dfe6f40002dedb163f7d0fa493e225f67 Author: Krzysztof Kozlowski Date: Mon Sep 8 10:53:32 2025 +0200 arm64: dts: qcom: sm8650: Drop redundant status from PMK8550 RTC The PMK8550 RTC is always enabled in its DTSI file since commit a791fc19965e ("arm64: dts: qcom: pmk8550: always enable RTC PMIC device"), so drop redundant status=okay in SM8650 boards. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250908085331.56478-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit af7bf2a2bf8fe01b6e2f68af19517a4eec48bdbb Author: Eric Gonçalves Date: Fri Sep 5 19:09:31 2025 +0000 arm64: dts: qcom: add initial support for Samsung Galaxy S20 Add new device support for the Samsung Galaxy S20 phone What works (common dtsi): - SimpleFB - Pstore/ramoops - GPIO keys - UFS - USB Signed-off-by: Eric Gonçalves Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250905190931.27481-4-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit 818045d1658fd4ceec06fb6efa62ed9c5b7f23cf Author: Eric Gonçalves Date: Fri Sep 5 19:09:30 2025 +0000 dt-bindings: arm: qcom: document x1q board binding Add binding for the Samsung Galaxy S20 board, codenamed X1Q, which is based on the Qualcomm Snapdragon 865 SoC. Signed-off-by: Eric Gonçalves Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250905190931.27481-3-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit 194c7636faf8bab8deea3800e168b23319a9c198 Author: Eric Gonçalves Date: Fri Sep 5 19:09:29 2025 +0000 arm64: dts: qcom: sm8250-samsung-r8q: Move common parts to dtsi Move common parts of the device tree to a separate dtsi in preparation for adding other Samsung devices from the S20, Tab S7 or Note 20 families, creating sm8250-samsung-common.dtsi. Also add support for UFS, USB and GPIO keys. Signed-off-by: Eric Gonçalves Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250905190931.27481-2-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit f261f5dddec1acdf60198371048b052febf67cf5 Author: Michal Wajdeczko Date: Fri Sep 5 19:36:25 2025 +0200 drm/xe/debugfs: Don't expose dgfx residencies attributes on VF In addition of checking if we are running on the BATTLEMAGE, we should also check for not being a VF driver, as VFs can't access necessary registers, and doing so leads to: | .. [drm] GT0: VF is trying to read an inaccessible register 0x35b004+0x0 | RIP: 0010:xe_gt_sriov_vf_read32+0x5e2/0x8a0 [xe] | Call Trace: | xe_mmio_read32+0x110/0x280 [xe] | read_residency_counter+0x42/0xd0 [xe] | dgfx_pkg_residencies_show+0x115/0x190 [xe] | .. [drm] Package G2 counter failed to read, ret -19 or | .. [drm] GT0: VF is trying to read an inaccessible register 0x35b004+0x0 | RIP: 0010:xe_gt_sriov_vf_read32+0x5e2/0x8a0 [xe] | Call Trace: | xe_mmio_read32+0x110/0x280 [xe] | read_residency_counter+0x42/0xd0 [xe] | dgfx_pcie_link_residencies_show+0xe7/0x160 [xe] | .. [drm] PCIE LINK L0 RESIDENCY counter failed to read, ret -19 Similarly, there is no point to expose inject_csc_hw_error on VFs, as HW errors support is already disabled for VFs. Bspec: 53221 Signed-off-by: Michal Wajdeczko Cc: Soham Purkait Cc: Rodrigo Vivi Cc: Riana Tauro Reviewed-by: Gustavo Sousa Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250905173625.8398-1-michal.wajdeczko@intel.com commit 6917b595f5cfe0456936620561a2198b45db075f Merge: 843e94cc1ca847 7d083666123a42 Author: Mark Brown Date: Tue Sep 9 16:16:07 2025 +0100 ASoC: renesas: Use guard() for spin locks Merge series from Kuninori Morimoto : Hi Mark, Iwai-san This patch-set follows Iwai-san's guard() update on Renesas drivers. Kuninori Morimoto (4): ASoC: renesas: msiof: Use guard() for spin locks ASoC: renesas: rsnd: Use guard() for spin locks ASoC: renesas: fsi: Use guard() for spin locks ASoC: renesas: rz-ssi: Use guard() for spin locks sound/soc/renesas/fsi.c | 30 ++++++++--------------------- sound/soc/renesas/rcar/core.c | 18 +++++------------ sound/soc/renesas/rcar/msiof.c | 26 ++++++++----------------- sound/soc/renesas/rcar/src.c | 19 ++++++++---------- sound/soc/renesas/rcar/ssi.c | 35 +++++++++++++++++----------------- sound/soc/renesas/rz-ssi.c | 14 ++++---------- 6 files changed, 50 insertions(+), 92 deletions(-) -- 2.43.0 commit 843e94cc1ca84741d3604e7d90daf4415611f4b1 Merge: 1cf87861a2e024 4336efb59ef364 Author: Mark Brown Date: Tue Sep 9 16:16:01 2025 +0100 ASoC: Intel: Fix invalid quirk input mapping Merge series from Takashi Iwai : This is a revised patch set for potential OOB accesses when wild values are passed to quirk option for ASoC Intel drivers. Unlike the v1 previous patchset, invalid quirk values are checked and corrected at log_quirks() in each driver, instead. v1: https://lore.kernel.org/20250415083144.6588-1-tiwai@suse.de Takashi === Takashi Iwai (3): ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 3 files changed, 43 insertions(+), 10 deletions(-) -- 2.50.1 commit d7b1cdc9108f46f47a0899597d6fa270f64dd98c Author: Marco Crivellari Date: Fri Sep 5 10:51:41 2025 +0200 drivers/block: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jens Axboe commit 456cefcb312d90d12dbcf7eaf6b3f7cfae6f622b Author: Marco Crivellari Date: Fri Sep 5 10:51:40 2025 +0200 drivers/block: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jens Axboe commit 51723bf92679427bba09a76fc13e1b0a93b680bc Author: Marco Crivellari Date: Fri Sep 5 10:51:39 2025 +0200 drivers/block: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jens Axboe commit 6214cadd79c610ca903f993c7a6c46a713715e7b Author: Thorsten Blum Date: Mon Sep 8 22:10:20 2025 +0200 block: floppy: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to improve and simplify raw_cmd_copyin(). No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Jens Axboe commit 473a19211c4dc762e6ecab9c3e6583afd3200817 Author: Mohammad Rafi Shaik Date: Fri Aug 22 18:49:02 2025 +0530 arm64: dts: qcom: lemans-evk: Add sound card Add the sound card node with tested playback over max98357a I2S speakers amplifier and I2S mic. Introduce HS (High-Speed) MI2S pin control support. The I2S max98357a speaker amplifier is connected via HS0 and I2S microphones utilize the HS2 interface. Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250822131902.1848802-3-mohammad.rafi.shaik@oss.qualcomm.com [bjorn: Sorted nodes] Signed-off-by: Bjorn Andersson commit 3f2d6cbbf4c46fbb9e9aa6fa25a70b0003471b26 Author: Mohammad Rafi Shaik Date: Fri Aug 22 18:49:01 2025 +0530 arm64: dts: qcom: lemans: Add gpr node Add GPR(Generic Pack router) node along with APM(Audio Process Manager) and PRM(Proxy resource Manager) audio services. Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250822131902.1848802-2-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e696e7aa439f1134ca5f91d6c86b332b72e57d9c Author: Christopher Obbard Date: Thu Aug 14 21:16:19 2025 +0100 arm64: dts: qcom: x1e78100-t14s-oled: Add eDP panel Add the Samsung ATNA40YK20 eDP panel to the device tree for the Snapdragon T14s OLED model. Signed-off-by: Christopher Obbard Tested-by: Jens Glathe Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250814-wip-obbardc-qcom-t14s-oled-panel-v7-1-89966ae886a3@linaro.org Signed-off-by: Bjorn Andersson commit cafb56f78a04c90b41109d077a1b8aef2736980b Author: Renjiang Han Date: Tue Aug 26 16:23:39 2025 +0530 arm64: dts: qcom: qcs615-ride: enable venus node to initialize video codec Enable the venus node to allow the video codec to start working properly by setting its status to "okay". Acked-by: Nicolas Dufresne Reviewed-by: Dmitry Baryshkov Signed-off-by: Renjiang Han Link: https://lore.kernel.org/r/20250826-enable-venus-for-sm6150-v9-2-486d167639a1@quicinc.com Signed-off-by: Bjorn Andersson commit b83d3cc7a59c29918964cc0961dc3fef9ad32b53 Author: Renjiang Han Date: Tue Aug 26 16:23:38 2025 +0530 arm64: dts: qcom: sm6150: add venus node to devicetree Add the venus node to the devicetree for the sm6150 platform to enable video functionality. The sm6150 platform currently lacks video functionality due to the absence of the venus node. Fallback to sc7180 due to the same video core. Reviewed-by: Konrad Dybcio Signed-off-by: Renjiang Han Link: https://lore.kernel.org/r/20250826-enable-venus-for-sm6150-v9-1-486d167639a1@quicinc.com Signed-off-by: Bjorn Andersson commit fc8089535425897b6efacc8531e4b5b63b85b435 Author: Konrad Dybcio Date: Tue Sep 9 10:24:07 2025 +0200 arm64: dts: qcom: x1e80100-romulus: Add WCN7850 Wi-Fi/BT It comes soldered onboard, just like on the QCP. Unfortunately, the rfkill pin is triggered by default, so a workaround is needed to convince the Linux driver to enable the hw, after which it works just fine. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250909-topic-romulus_wifi_pci-v2-1-3dc495d5559f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b69f8c496ea05f80c2bae91a74b48c00c06c524e Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:17 2025 -0400 drm/i915: Remove todo and comments about struct_mutex This patch completes the removal of struct_mutex from the driver. Remove the related TODO item, as the transition away from struct_mutex is now complete. Also clean up references to struct_mutex in i915.rst to avoid outdated documentation. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-10-luiz.mello@estudante.ufscar.br Acked-by: Thomas Zimmermann Signed-off-by: Rodrigo Vivi commit 34ac58ded89dd81fc2f776b19c44bcc48fe9764d Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:16 2025 -0400 drm/i915: Drop unused struct_mutex from drm_i915_private The struct_mutex field in drm_i915_private is no longer used anywhere in the driver. This patch removes it completely to clean up unused code and avoid confusion. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-9-luiz.mello@estudante.ufscar.br Signed-off-by: Rodrigo Vivi commit 9e6651659b8a8686ca16fcefa7739600b047d8c5 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:15 2025 -0400 drm/i915: Clean-up outdated struct_mutex comments The struct_mutex will be removed from the DRM subsystem, as it was a legacy BKL that was only used by i915 driver. After review, it was concluded that its usage was no longer necessary This patch updates various comments in the i915 codebase to either remove or clarify references to struct_mutex, in order to prevent future misunderstandings. * i915_drv.h: Removed the statement that stolen_lock is the inner lock when overlaps with struct_mutex, since struct_mutex is no longer used in the driver. * i915_gem.c: Removed parentheses suggesting usage of struct_mutex, which which is no longer used. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-8-luiz.mello@estudante.ufscar.br Signed-off-by: Rodrigo Vivi commit 5be4fa95ec5ce3039a622517d10327639da29e44 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:14 2025 -0400 drm/i915/display: Remove outdated struct_mutex comments The struct_mutex will be removed from the DRM subsystem, as it was a legacy BKL that was only used by i915 driver. After review, it was concluded that its usage was no longer necessary This patch update a comment about struct_mutex in i915/display, in order to prevent future misunderstandings. * intel_fbc.c: Removed the statement that intel_fbc->lock is the inner lock when overlapping with struct_mutex, since struct_mutex is no longer used anywhere in the driver. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-7-luiz.mello@estudante.ufscar.br Signed-off-by: Rodrigo Vivi commit 9ff39b0468c3e04fee05d4e005d2fc03d28b1538 Author: Imran Shaik Date: Tue Sep 9 15:17:59 2025 +0530 clk: qcom: dispcc-glymur: Constify 'struct qcom_cc_desc' 'struct qcom_cc_desc' is passed to qcom_cc_map() and qcom_cc_really_probe() only as pointer to const, so make the memory const for safety. Suggested-by: Krzysztof Kozlowski Signed-off-by: Imran Shaik Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250909-constify-dispcc-glymur-desc-fix-v1-1-6cb59730863f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit eddb5ba91b289faa15117d4fc1c2fb223f3493c2 Author: Nicolas Frattaroli Date: Fri May 30 15:38:09 2025 +0200 PM / devfreq: rockchip-dfi: add support for LPDDR5 The Rockchip RK3588 SoC can also support LPDDR5 memory. This type of memory needs some special case handling in the rockchip-dfi driver. Add support for it in rockchip-dfi, as well as the needed GRF register definitions. This has been tested as returning both the right cycle count and bandwidth on a LPDDR5 board where the CKR bit is 1. I couldn't test whether the values are correct on a system where CKR is 0, as I'm not savvy enough with the Rockchip tooling to know whether this can be set in the DDR init blob. Downstream has some special case handling for a hardware version where not just the control bits differ, but also the register. Since I don't know whether that hardware version is in any production silicon, it's left unimplemented for now, with an error message urging users to report if they have such a system. There is a slight change of behaviour for non-LPDDR5 systems: instead of writing 0 as the control flags to the control register and pretending everything is alright if the memory type is unknown, we now explicitly return an error. Signed-off-by: Nicolas Frattaroli Reviewed-by: Sascha Hauer Acked-by: Heiko Stuebner Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20250530-rk3588-dfi-improvements-v1-2-6e077c243a95@collabora.com/ commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 Author: Nicolas Frattaroli Date: Fri May 30 15:38:08 2025 +0200 PM / devfreq: rockchip-dfi: double count on RK3588 On RK3588 with LPDDR4X memory, the cycle count as returned by perf stat -a -e rockchip_ddr/cycles/ sleep 1 consistently reads half as much as what the actual DDR frequency is at. For a LPDDR4X module running at 2112MHz, I get more like 1056059916 cycles per second, which is almost bang-on half what it should be. No, I'm not mixing up megatransfers and megahertz. Consulting the downstream driver, this appears to be because the RK3588 hardware specifically (and RK3528 as well, for future reference) needs a multiplier of 2 to get to the correct frequency with everything but LPDDR5. The RK3588's actual memory bandwidth measurements in MB/s are correct however, as confirmed with stress-ng --stream. This makes me think the access counters are not affected in the same way. This tracks with the vendor kernel not multiplying the access counts either. Solve this by adding a new member to the dfi struct, which each SoC can set to whatever they want, but defaults to 1 if left unset by the SoC init functions. The event_get_count op can then use this multiplier if the cycle count is requested. The cycle multiplier is not used in rockchip_dfi_get_event because the vendor driver doesn't use it there either, and we don't do other actual bandwidth unit conversion stuff in there anyway. Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588") Signed-off-by: Nicolas Frattaroli Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/ commit 24af523936b81a479d65ff835e27e1a22afa0bf8 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:13 2025 -0400 drm/i915/gem: Clean-up outdated struct_mutex comments The struct_mutex will be removed from the DRM subsystem, as it was a legacy BKL that was only used by i915 driver. After review, it was concluded that its usage was no longer necessary This patch updates various comments in the i915/gem and i915/gt codebase to either remove or clarify references to struct_mutex, in order to prevent future misunderstandings. * i915_gem_execbuffer.c: Replace reference to struct_mutex with vm->mutex, as noted in the eb_reserve() function, which states that vm->mutex handles deadlocks. * i915_gem_object.c: Change struct_mutex by drm_i915_gem_object->vma.lock. i915_gem_object_unbind() in i915_gem.c states that this lock is who actually protects the unbind. * i915_gem_shrinker.c: The correct lock is actually i915->mm.obj, as already documented in its declaration. * i915_gem_wait.c: The existing comment already mentioned that struct_mutex was no longer necessary. Updated to refer to a generic global lock instead. * intel_reset_types.h: Cleaned up the comment text. Updated to refer to a generic global lock instead. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-6-luiz.mello@estudante.ufscar.br Acked-by: Tvrtko Ursulin Signed-off-by: Rodrigo Vivi commit 1bd3db82e9f39c45ce035ac07e7acd9a4cd2e1d3 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:12 2025 -0400 drm/i915: Replace struct_mutex in intel_guc_log Remove the use of struct_mutex from intel_guc_log.c and replace it with a dedicated lock, guc_lock, defined within the intel_guc_log struct.      The struct_mutex was previously used to protect concurrent access and modification of intel_guc_log->level in intel_guc_log_set_level(). However, it was suggested that the lock should reside within the intel_guc_log struct itself.      Initialize the new guc_lock in intel_guc_log_init_early(), alongside the existing relay.lock. The lock is initialized using drmm_mutex_init(), which also ensures it is properly destroyed when the driver is unloaded. Signed-off-by: Luiz Otavio Mello Suggested-by: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-5-luiz.mello@estudante.ufscar.br Acked-by: Tvrtko Ursulin Signed-off-by: Rodrigo Vivi commit 1bafff0252e3e46286f558ba67d63bc16e8685cd Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:11 2025 -0400 drm/i915: Change mutex initialization in intel_guc_log The intel_guc_log->relay.lock is currently initialized in intel_guc_log_init_early(), but it lacks a corresponding destructor, which can lead to a memory leak. This patch replaces the use of mutex_init() with drmm_mutex_init(), which ensures the lock is properly destroyed when the driver is unloaded. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-4-luiz.mello@estudante.ufscar.br Acked-by: Tvrtko Ursulin Signed-off-by: Rodrigo Vivi commit f50b969bafafb2810a07f376387350c4c0d72a21 Author: Liu Ying Date: Mon Sep 8 14:05:48 2025 +0800 drm/bridge: ite-it6263: Support HDMI vendor specific infoframe IT6263 supports HDMI vendor specific infoframe. The infoframe header and payload are configurable via NULL packet registers. The infoframe is enabled and disabled via PKT_NULL_CTRL register. Add the HDMI vendor specific infoframe support. Signed-off-by: Liu Ying Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250908-it6263-vendor-specific-infoframe-v2-1-3f2ebd9135ad@nxp.com Signed-off-by: Dmitry Baryshkov commit f0e7f358e72b10b01361787134ebcbd9e9aa72d9 Author: Dmitry Baryshkov Date: Wed Sep 3 19:21:29 2025 +0300 drm/bridge: write full Audio InfoFrame Instead of writing the first byte of the infoframe (and hoping that the rest is default / zeroes), hook Audio InfoFrame support into the write_infoframe / clear_infoframes callbacks and use drm_atomic_helper_connector_hdmi_update_audio_infoframe() to write the frame. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250903-adv7511-audio-infoframe-v1-2-05b24459b9a4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 723a170811db366b993437b08f1ca707163f7c84 Author: Dmitry Baryshkov Date: Wed Sep 3 19:21:28 2025 +0300 drm/bridge: adv7511: use update latch for AVI infoframes Instead of disabling and then reenabling AVI infoframe, use the recommended way of updating it on the fly: latch current values using the ADV7511_REG_INFOFRAME_UPDATE register. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250903-adv7511-audio-infoframe-v1-1-05b24459b9a4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 793d31671bdf583c876ac9fa9948bb231c689036 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:10 2025 -0400 drm/i915: Remove struct_mutex in i915_irq.c Remove struct_mutex from ivb_parity_work() function. The ivb_parity_work runs in a workqueue so it cannot race with itself. Also, it is not protecting anything with the other remaining usage of struct_mutex. Signed-off-by: Luiz Otavio Mello Suggested-by: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-3-luiz.mello@estudante.ufscar.br Signed-off-by: Rodrigo Vivi commit 86a9fe82e9b1f43e6d2bc867bf96bb40660d8719 Author: Luiz Otavio Mello Date: Mon Sep 8 09:15:09 2025 -0400 drm/i915: Move struct_mutex to drm_i915_private Move legacy BKL struct_mutex from drm_device to drm_i915_private, which is the last remaining user. Signed-off-by: Luiz Otavio Mello Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250908131518.36625-2-luiz.mello@estudante.ufscar.br Acked-by: Thomas Zimmermann Signed-off-by: Rodrigo Vivi commit a643abb673790c09a4c188a5ee9b064844f5047b Author: Liao Yuanhong Date: Wed Aug 20 21:12:56 2025 +0800 drm/msm/mdp4: remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/670017/ Link: https://lore.kernel.org/r/20250820131300.499727-1-liaoyuanhong@vivo.com Signed-off-by: Dmitry Baryshkov commit 88ec0e01a880e3326794e149efae39e3aa4dbbec Author: Qianfeng Rong Date: Tue Aug 26 17:20:45 2025 +0800 drm/msm/dpu: fix incorrect type for ret Change 'ret' from unsigned long to int, as storing negative error codes in an unsigned long makes it never equal to -ETIMEDOUT, causing logical errors. Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") Signed-off-by: Qianfeng Rong Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/671100/ Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com Signed-off-by: Dmitry Baryshkov commit 721b7f5f75ff255c231e2869428c4673a124115d Author: Akhil P Oommen Date: Tue Sep 2 17:20:03 2025 +0530 drm/msm/a6xx: Add a comment to acd_probe() It is not obvious why we can skip error checking of dev_pm_opp_find_freq_exact() API. Add a comment explaining it. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/672263/ Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-4-f3ec9baed513@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 3f17991488af62265c8335b42585c36cdee5ad05 Author: Akhil P Oommen Date: Tue Sep 2 17:20:02 2025 +0530 drm/msm/adreno: Add a modparam to skip GPU During bringup of a new GPU support, it is convenient to have knob to quickly disable GPU, but keep the display support. This helps to fallback to 'kms_swrast' in case of bootup issues due to GPU. Add a modparam to support this. Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672262/ Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-3-f3ec9baed513@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit f028bcafb6dfb4c2bb656cbff9e6a66222d3d3d7 Author: Akhil P Oommen Date: Tue Sep 2 17:20:00 2025 +0530 drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses drm_gem_obj.gpuva.list, which is not initialized when the drm driver does not support DRIVER_GEM_GPUVA feature. Enable it for msm_kms drm driver to fix the splat seen when msm.separate_gpu_drm=1 modparam is set: [ 9.506020] Unable to handle kernel paging request at virtual address fffffffffffffff0 [ 9.523160] Mem abort info: [ 9.523161] ESR = 0x0000000096000006 [ 9.523163] EC = 0x25: DABT (current EL), IL = 32 bits [ 9.523165] SET = 0, FnV = 0 [ 9.523166] EA = 0, S1PTW = 0 [ 9.523167] FSC = 0x06: level 2 translation fault [ 9.523169] Data abort info: [ 9.523170] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 9.523171] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 9.523172] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 9.523174] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000ad370f000 [ 9.523176] [fffffffffffffff0] pgd=0000000000000000, p4d=0000000ad4787403, pud=0000000ad4788403, pmd=0000000000000000 [ 9.523184] Internal error: Oops: 0000000096000006 [#1] SMP [ 9.592968] CPU: 9 UID: 0 PID: 448 Comm: (udev-worker) Not tainted 6.17.0-rc4-assorted-fix-00005-g0e9bb53a2282-dirty #3 PREEMPT [ 9.592970] Hardware name: Qualcomm CRD, BIOS 6.0.240718.BOOT.MXF.2.4-00515-HAMOA-1 07/18/2024 [ 9.592971] pstate: a1400005 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 9.592973] pc : lookup_vma+0x28/0xe0 [msm] [ 9.592996] lr : get_vma_locked+0x2c/0x128 [msm] [ 9.763632] sp : ffff800082dab460 [ 9.763666] Call trace: [ 9.763668] lookup_vma+0x28/0xe0 [msm] (P) [ 9.763688] get_vma_locked+0x2c/0x128 [msm] [ 9.763706] msm_gem_get_and_pin_iova_range+0x68/0x11c [msm] [ 9.763723] msm_gem_get_and_pin_iova+0x18/0x24 [msm] [ 9.763740] msm_fbdev_driver_fbdev_probe+0xd0/0x258 [msm] [ 9.763760] __drm_fb_helper_initial_config_and_unlock+0x288/0x528 [drm_kms_helper] [ 9.763771] drm_fb_helper_initial_config+0x44/0x54 [drm_kms_helper] [ 9.763779] drm_fbdev_client_hotplug+0x84/0xd4 [drm_client_lib] [ 9.763782] drm_client_register+0x58/0x9c [drm] [ 9.763806] drm_fbdev_client_setup+0xe8/0xcf0 [drm_client_lib] [ 9.763809] drm_client_setup+0xb4/0xd8 [drm_client_lib] [ 9.763811] msm_drm_kms_post_init+0x2c/0x3c [msm] [ 9.763830] msm_drm_init+0x1a8/0x22c [msm] [ 9.763848] msm_drm_bind+0x30/0x3c [msm] [ 9.919273] try_to_bring_up_aggregate_device+0x168/0x1d4 [ 9.919283] __component_add+0xa4/0x170 [ 9.919286] component_add+0x14/0x20 [ 9.919288] msm_dp_display_probe_tail+0x4c/0xac [msm] [ 9.919315] msm_dp_auxbus_done_probe+0x14/0x20 [msm] [ 9.919335] dp_aux_ep_probe+0x4c/0xf0 [drm_dp_aux_bus] [ 9.919341] really_probe+0xbc/0x298 [ 9.919345] __driver_probe_device+0x78/0x12c [ 9.919348] driver_probe_device+0x40/0x160 [ 9.919350] __driver_attach+0x94/0x19c [ 9.919353] bus_for_each_dev+0x74/0xd4 [ 9.919355] driver_attach+0x24/0x30 [ 9.919358] bus_add_driver+0xe4/0x208 [ 9.919360] driver_register+0x60/0x128 [ 9.919363] __dp_aux_dp_driver_register+0x24/0x30 [drm_dp_aux_bus] [ 9.919365] atana33xc20_init+0x20/0x1000 [panel_samsung_atna33xc20] [ 9.919370] do_one_initcall+0x6c/0x1b0 [ 9.919374] do_init_module+0x58/0x234 [ 9.919377] load_module+0x19cc/0x1bd4 [ 9.919380] init_module_from_file+0x84/0xc4 [ 9.919382] __arm64_sys_finit_module+0x1b8/0x2cc [ 9.919384] invoke_syscall+0x48/0x110 [ 9.919389] el0_svc_common.constprop.0+0xc8/0xe8 [ 9.919393] do_el0_svc+0x20/0x2c [ 9.919396] el0_svc+0x34/0xf0 [ 9.919401] el0t_64_sync_handler+0xa0/0xe4 [ 9.919403] el0t_64_sync+0x198/0x19c [ 9.919407] Code: eb0000bf 54000480 d100a003 aa0303e2 (f8418c44) [ 9.919410] ---[ end trace 0000000000000000 ]--- Fixes: 217ed15bd399 ("drm/msm: enable separate binding of GPU and display devices") Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672257/ Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-1-f3ec9baed513@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit cb55f39bf7b1e687b88dc9825c21a7d3454b5acb Author: Krzysztof Kozlowski Date: Mon Sep 8 11:49:51 2025 +0200 drm/msm/dsi/phy: Fix reading zero as PLL rates when unprepared Hardware Programming Guide for DSI PHY says that PLL_SHUTDOWNB and DIGTOP_PWRDN_B have to be asserted for any PLL register access. Whenever dsi_pll_7nm_vco_recalc_rate() or dsi_pll_7nm_vco_set_rate() were called on unprepared PLL, driver read values of zero leading to all sort of further troubles, like failing to set pixel and byte clock rates. Asserting the PLL shutdown bit is done by dsi_pll_enable_pll_bias() (and corresponding dsi_pll_disable_pll_bias()) which are called through the code, including from PLL .prepare() and .unprepare() callbacks. The .set_rate() and .recalc_rate() can be called almost anytime from external users including times when PLL is or is not prepared, thus driver should not interfere with the prepare status. Implement simple reference counting for the PLL bias, so set_rate/recalc_rate will not change the status of prepared PLL. Issue of reading 0 in .recalc_rate() did not show up on existing devices, but only after re-ordering the code for SM8750. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/673416/ Link: https://lore.kernel.org/r/20250908094950.72877-2-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Baryshkov commit d5ad57fc428c1e44335d25c822eb89645f425f32 Author: Krzysztof Kozlowski Date: Tue Sep 9 16:03:32 2025 +0200 dt-bindings: input: qcom,pm8941-pwrkey: Fix formatting of descriptions Property descriptions should indent with two spaces and they do not need to preserve formatting. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250909140331.69756-2-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Torokhov commit 4bd8a6147645480d550242ff816b4c7ba160e5b7 Author: Hans Verkuil Date: Sat Sep 6 12:11:21 2025 +0200 media: vivid: fix disappearing messages The vivid driver supports the message, but if the Vendor ID of the received message didn't match the Vendor ID of the CEC Adapter, then it ignores it (good) and returns 0 (bad). It should return -ENOMSG to indicate that other followers should be asked to handle it. Return code 0 means that the driver handled it, which is wrong in this case. As a result, userspace followers never get the chance to process such a message. Refactor the code a bit to have the function return -ENOMSG at the end, drop the default case, and ensure that the message handlers return 0. That way 0 is only returned if the message is actually handled in the vivid_received() function. Fixes: 812765cd6954 ("media: vivid: add support") Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 9a45e985d4e8dae4226af5a8eddea4c48c62e2ea Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:48 2025 +0200 arm64: dts: qcom: qrb2210-rb1: Enable Venus Enable Venus on the QRB2210 RB1 development board. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20250814085248.2371130-9-jorge.ramirez@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7a37bf31e3a736d86c3c801ec2116fde4fb395ce Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:47 2025 +0200 arm64: dts: qcom: qcm2290: Add Venus video node Add DT entries for the qcm2290 Venus encoder/decoder. Co-developed-by: Loic Poulain Signed-off-by: Loic Poulain Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Konrad Dybcio Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250814085248.2371130-8-jorge.ramirez@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0574c27cbe797329b932f9398959c3b08d41b0ad Author: Jakub Kicinski Date: Thu Sep 4 19:22:54 2025 -0700 eth: fbnic: support persistent NAPI config No shenanigans in this driver, AFAIU, pass the vector index to NAPI registration. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250905022254.2635707-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit dcf6fb89e6f73b6cbb17dfcdf608422c0b7beed6 Author: Vladimir Zapolskiy Date: Wed Sep 3 03:22:53 2025 +0300 media: qcom: camss: remove a check for unavailable CAMSS endpoint Media endpoints are not devices, and there is no valid or sane usecase, when an endpoint on the ISP side is an unavailable device. Signed-off-by: Vladimir Zapolskiy Tested-by: Loic Poulain Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 605af91e90b061665ea774e129d9df3aad42b905 Author: Vladimir Zapolskiy Date: Wed Sep 3 03:22:52 2025 +0300 media: qcom: camss: unconditionally set async notifier of subdevices For sake of simplicity it makes sense to register all CAMSS subdevices from its async notifier, this will cover all possible use cases, even if there is no connected sensors to the CAMSS ISP. Signed-off-by: Vladimir Zapolskiy Tested-by: Loic Poulain Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 17ad461622f4549ab7b21e5fb611e485fea21af2 Author: Vladimir Zapolskiy Date: Wed Sep 3 03:22:51 2025 +0300 media: qcom: camss: remove .link_entities callback There is no potential for a custom .link_entities callback, remove it by replacing with a common camss_link_entities(). Signed-off-by: Vladimir Zapolskiy Tested-by: Loic Poulain Reviewed-by: Bryan O'Donoghue [bod: amended for qcm2290, qcs8300, sa8775p] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit aefd4d698e47db78695b6517b3ec3c9614635baa Author: Vikram Sharma Date: Wed Aug 13 11:07:23 2025 +0530 media: qcom: camss: Enumerate resources for QCS8300 Enumerate csiphy, csid and vfe resources for qcs8300. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 42914692e800df09eaa4d607751c9424f93566da Author: Vikram Sharma Date: Wed Aug 13 11:07:22 2025 +0530 media: qcom: camss: enable vfe 690 for qcs8300 The vfe in qcs8300 is version 690, it is same as vfe used in lemans(sa8775p). vfe gen3 have support for vfe 690. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 950f3d308f8b9f58a083dabd8b83e8d542da4ddf Author: Vikram Sharma Date: Wed Aug 13 11:07:21 2025 +0530 media: qcom: camss: enable csid 690 for qcs8300 The CSID in qcs8300 is version 690, it is same as csid used in lemans(sa8775p). csid gen3 have support for csid 690. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9ca5d17f5e2e63a9b464d27ac4f2d79cf53633ea Author: Vikram Sharma Date: Wed Aug 13 11:07:20 2025 +0530 media: qcom: camss: Add CSIPHY support for QCS8300 QCS8300 uses the same CSIPHY hardware version (v1.3.0) as SA8775P. The only difference between the two platforms is the number of CSIPHY instances: SA8775P has four, while QCS8300 has three. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6adf001b6779aa1c0bebc98e7be87b37072b3049 Author: Vikram Sharma Date: Wed Aug 13 11:07:19 2025 +0530 media: qcom: camss: Add qcs8300 compatible Add CAMSS_8300 enum, QCS8300 compatible and qcs8300 camss driver private data, the private data just include some basic information for now, later changes will enumerate with csiphy, tpg, csid and vfe resources. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 634a2958fae30b9ea2c603e7b12c2729407c8292 Author: Vikram Sharma Date: Wed Aug 13 11:07:18 2025 +0530 media: dt-bindings: Add qcom,qcs8300-camss compatible Add the compatible string "qcom,qcs8300-camss" to support the Camera Subsystem (CAMSS) on the Qualcomm QCS8300 platform. The QCS8300 platform provides: - 2 x VFE (version 690), each with 3 RDI - 5 x VFE Lite (version 690), each with 6 RDI - 2 x CSID (version 690) - 5 x CSID Lite (version 690) - 3 x CSIPHY (version 690) - 3 x TPG Signed-off-by: Vikram Sharma Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit b478527cce8a166be73d9eda62c759aaa030a77e Author: Vikram Sharma Date: Thu Aug 14 15:46:14 2025 +0530 media: qcom: camss: Enumerate resources for lemans(sa8775p) Enumerate csiphy, csid and vfe resources for lemans soc. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e7b59e1d06fb6c3b9c0dc08d4479756654de711e Author: Vikram Sharma Date: Thu Sep 4 15:32:22 2025 +0530 media: qcom: camss: Add support for VFE 690 Add support for VFE 690 found on lemans(SA8775P). This is different from vfe 780 w.r.t few register offsets. It supports two full and five lite VFE. Co-developed-by: Suresh Vankadara Signed-off-by: Suresh Vankadara Co-developed-by: Wenmeng Liu Signed-off-by: Wenmeng Liu Signed-off-by: Vikram Sharma Signed-off-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ed03e99de0fa7999fcef432aa35b9052d1fed9f1 Author: Vikram Sharma Date: Thu Aug 14 15:46:12 2025 +0530 media: qcom: camss: Add support for CSID 690 Add support for CSID 690 found on lemans(sa8775p) soc, This is different from csid 780 w.r.t few register offsets and bit-fields. Signed-off-by: Suresh Vankadara Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7803b63a1640a0a39e3ebad487b33cb2d26e778b Author: Vikram Sharma Date: Thu Aug 14 15:46:11 2025 +0530 media: qcom: camss: Add support for CSIPHY (v1.3.0) Add support for CSIPHY (v1.3.0) found on lemans(sa8775p). This implementation is based on the titan 690 implementation. Co-developed-by: Wenmeng Liu Signed-off-by: Wenmeng Liu Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 5f4ba689e7f329c163cda66d874177da300ad64c Author: Vikram Sharma Date: Thu Aug 14 15:46:10 2025 +0530 media: qcom: camss: Add qcom,sa8775p-camss compatible Add CAMSS_8775P enum, compatible and lemans(sa8775p) camss driver private data, the private data just include some basic information now, later changes will enumerate with csiphy, tpg, csid and vfe resources. Co-developed-by: Suresh Vankadara Signed-off-by: Suresh Vankadara Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8dd22e90331d64bd15adc598a8d41fee2ccf93da Author: Vikram Sharma Date: Thu Aug 14 15:46:09 2025 +0530 media: dt-bindings: Add qcom,sa8775p-camss compatible Add the compatible string "qcom,sa8775p-camss" to support the Camera Subsystem (CAMSS) on the Qualcomm lemans platform. The Lemans(SA8775P) platform provides: - 2 x VFE (version 690), each with 3 RDI - 5 x VFE Lite (version 690), each with 6 RDI - 2 x CSID (version 690) - 5 x CSID Lite (version 690) - 4 x CSIPHY (version 690) - 3 x TPG Lemans is the first Qualcomm SoC to introduce a CSIPHY-based Test Pattern Generator (TPG). Co-developed-by: Wenmeng Liu Signed-off-by: Wenmeng Liu Signed-off-by: Vikram Sharma Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a3dce6e3c85fce34dd7a5a29cbe0dc9550c3d585 Author: Vikram Sharma Date: Thu Aug 14 15:46:08 2025 +0530 media: qcom: camss: Rename camss-vfe-780.c to camss-vfe-gen3.c Rename the file camss-vfe-780.c to camss-vfe-gen3.c to enable reuse of VFE logic across multiple SoCs. The lemans(sa8775p) SoC includes VFE 690, which is very similar to VFE 780, with only minor differences in register bitfields. Rename prepares the codebase for supporting additional SoCs without duplicating VFE logic. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0d6d5f49e0fc8ff23564e0f1f383b3334331ba61 Author: Vikram Sharma Date: Thu Aug 14 15:46:07 2025 +0530 media: qcom: camss: Rename camss-csid-780.c to camss-csid-gen3.c Rename the file camss-csid-780.c to camss-csid-gen3.c to enable reuse of CSID logic across multiple SoCs. The lemans(sa8775p) SoC includes CSID 690, which is functionally very similar to CSID 780, with only minor differences in register bitfields. This rename prepares the codebase for supporting additional SoCs without duplicating CSID logic. Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9e89149a19edb31b8ddbbeec055d22f7ff9d6ddf Author: Loic Poulain Date: Tue Jul 8 10:32:20 2025 +0200 media: qcom: camss: add support for QCM2290 camss The camera subsystem for QCM2290 which is based on Spectra 340. Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ce63fbdf849f52584d9b5d9a4cc23cbc88746c30 Author: Loic Poulain Date: Tue Jul 8 10:32:19 2025 +0200 media: qcom: camss: csiphy-3ph: Add CSIPHY 2ph DPHY v2.0.1 init sequence This is the CSI PHY version found in QCS2290/QCM2290 SoCs. The table is extracted from downstream camera driver. Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f0fc808a466a544420807df2c7a42f7bc322d245 Author: Loic Poulain Date: Tue Jul 8 10:32:18 2025 +0200 media: qcom: camss: Add CSID 340 support Add support for CSID found in QCM2290, it's a simplified gen-2 version. - There is no Test Pattern Generator (moved outside CSID) - There is no subsampling (moved to CAMIF module) Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit acf8d084699e1b5ed7ca0fbc01a6e3f63d10a0df Author: Loic Poulain Date: Tue Jul 8 10:32:17 2025 +0200 media: qcom: camss: Add support for TFE (Spectra 340) Add support for TFE (Thin Front End) found in QCM2290. Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue [bod: made tfe_line_iface_map and tfe_subgroup_line map static] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit cba308979b012664c7fe7c5baa818fcb68e86363 Author: Loic Poulain Date: Tue Jul 8 10:32:21 2025 +0200 dt-bindings: media: Add qcom,qcm2290-camss Add bindings for qcom,qcm2290-camss in order to support the camera subsystem found in the Qualcomm Robotics RB1 Platform (QRB2210). Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski [bod: reordered patch title to dt-bindings: media] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 57429b0fddfe3cea21a56326576451a4a4c2019b Author: Stephan Gerhold Date: Mon Aug 18 11:50:41 2025 +0200 media: iris: Fix firmware reference leak and unmap memory after load When we succeed loading the firmware, we don't want to hold on to the firmware pointer anymore, since it won't be freed anywhere else. The same applies for the mapped memory. Unmapping the memory is particularly important since the memory will be protected after the Iris firmware is started, so we need to make sure there will be no accidental access to this region (even if just a speculative one from the CPU). Almost the same firmware loading code also exists in venus/firmware.c, there it is implemented correctly. Fix this by dropping the early "return ret" and move the call of qcom_scm_pas_auth_and_reset() out of iris_load_fw_to_memory(). We should unmap the memory before bringing the firmware out of reset. Cc: stable@vger.kernel.org Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Signed-off-by: Stephan Gerhold Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit dbd57932f8d0962df3e3e6202009ffc12004bf08 Author: Krzysztof Kozlowski Date: Tue Sep 2 14:45:12 2025 +0200 media: iris: Add support for SM8750 (VPU v3.5) Add support for SM8750 Iris codec with major differences against previous generation SM8650: 1. New clocks and new resets, thus new power up and power down sequences, 2. New WRAPPER_IRIS_VCODEC_VPU_WRAPPER_SPARE_0 register programmed during boot-up Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 1f01a49816a56a2d504cf60fe11ef038dbcf36e5 Author: Krzysztof Kozlowski Date: Mon Aug 4 15:37:39 2025 +0200 media: iris: Split power on per variants Current devices use same power up sequence, but starting with Qualcomm SM8750 (VPU v3.5) the sequence will grow quite a bit, so allow customizing it. No functional change so far for existing devices. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2fbb823a0744665fe6015bd03d435bd334ccecf7 Author: Krzysztof Kozlowski Date: Wed Jul 2 15:41:58 2025 +0200 media: iris: Call correct power off callback in cleanup path Driver implements different callbacks for the power off controller (.power_off_controller): - iris_vpu_power_off_controller, - iris_vpu33_power_off_controller, The generic wrapper for handling power off - iris_vpu_power_off() - calls them via 'iris_platform_data->vpu_ops', so shall the cleanup code in iris_vpu_power_on(). This makes also sense if looking at caller of iris_vpu_power_on(), which unwinds also with the wrapper calling respective platfortm code (unwinds with iris_vpu_power_off()). Otherwise power off sequence on the newer VPU3.3 in error path is not complete. Fixes: c69df5de4ac3 ("media: platform: qcom/iris: add power_off_controller to vpu_ops") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 93fad55aa996eef17a837ed95b1d621ef05d967b Author: Dikshita Agarwal Date: Fri Aug 22 11:23:30 2025 +0530 media: iris: vpu3x: Add MNoC low power handshake during hardware power-off Add the missing write to AON_WRAPPER_MVP_NOC_LPI_CONTROL before reading the LPI status register. Introduce a handshake loop to ensure MNoC enters low power mode reliably during VPU3 hardware power-off with timeout handling. Fixes: 02083a1e00ae ("media: platform: qcom/iris: add support for vpu33") Cc: stable@vger.kernel.org Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Reviewed-by: Bryan O'Donoghue Signed-off-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit fde38008fc4f43db8c17869491870df24b501543 Author: Neil Armstrong Date: Fri Aug 22 11:20:01 2025 +0200 media: iris: fix module removal if firmware download failed Fix remove if firmware failed to load: qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2 qcom-iris aa00000.video-codec: firmware download failed qcom-iris aa00000.video-codec: core init failed then: $ echo aa00000.video-codec > /sys/bus/platform/drivers/qcom-iris/unbind Triggers: genpd genpd:1:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ video_cc_mvs0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#1: sh/542 pc : clk_core_disable+0xa4/0xac lr : clk_core_disable+0xa4/0xac Call trace: clk_core_disable+0xa4/0xac (P) clk_disable+0x30/0x4c iris_disable_unprepare_clock+0x20/0x48 [qcom_iris] iris_vpu_power_off_hw+0x48/0x58 [qcom_iris] iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris] iris_vpu_power_off+0x34/0x84 [qcom_iris] iris_core_deinit+0x44/0xc8 [qcom_iris] iris_remove+0x20/0x48 [qcom_iris] platform_remove+0x20/0x30 device_remove+0x4c/0x80 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ video_cc_mvs0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#2: sh/542 pc : clk_core_unprepare+0xf0/0x110 lr : clk_core_unprepare+0xf0/0x110 Call trace: clk_core_unprepare+0xf0/0x110 (P) clk_unprepare+0x2c/0x44 iris_disable_unprepare_clock+0x28/0x48 [qcom_iris] iris_vpu_power_off_hw+0x48/0x58 [qcom_iris] iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris] iris_vpu_power_off+0x34/0x84 [qcom_iris] iris_core_deinit+0x44/0xc8 [qcom_iris] iris_remove+0x20/0x48 [qcom_iris] platform_remove+0x20/0x30 device_remove+0x4c/0x80 ---[ end trace 0000000000000000 ]--- genpd genpd:0:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ gcc_video_axi0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#4: sh/542 pc : clk_core_disable+0xa4/0xac lr : clk_core_disable+0xa4/0xac Call trace: clk_core_disable+0xa4/0xac (P) clk_disable+0x30/0x4c iris_disable_unprepare_clock+0x20/0x48 [qcom_iris] iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris] iris_vpu_power_off+0x48/0x84 [qcom_iris] iris_core_deinit+0x44/0xc8 [qcom_iris] iris_remove+0x20/0x48 [qcom_iris] platform_remove+0x20/0x30 device_remove+0x4c/0x80 ------------[ cut here ]------------ gcc_video_axi0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#4: sh/542 pc : clk_core_unprepare+0xf0/0x110 lr : clk_core_unprepare+0xf0/0x110 Call trace: clk_core_unprepare+0xf0/0x110 (P) clk_unprepare+0x2c/0x44 iris_disable_unprepare_clock+0x28/0x48 [qcom_iris] iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris] iris_vpu_power_off+0x48/0x84 [qcom_iris] iris_core_deinit+0x44/0xc8 [qcom_iris] iris_remove+0x20/0x48 [qcom_iris] platform_remove+0x20/0x30 device_remove+0x4c/0x80 ---[ end trace 0000000000000000 ]--- Skip deinit if initialization never succeeded. Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Fixes: bb8a95aa038e ("media: iris: implement power management") Cc: stable@vger.kernel.org Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Neil Armstrong Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6d3926a237b68e3bfd3068553e6c3fa3fed1ea1b Author: Krzysztof Kozlowski Date: Sat Aug 23 17:53:50 2025 +0200 dt-bindings: media: qcom,sm8550-iris: Do not reference legacy venus properties The Qualcomm SoC Iris video codec is an evolution of previous Venus and it comes with its own Iris Linux drivers. These new drivers were accepted under condition they actually improve state of afairs, instead of duplicating old, legacy solutions. Unfortunately binding still references common parts of Venus without actual need and benefit. For example Iris does not use fake "video-firmware" device node (fake because there is no actual device underlying it and it was added only to work around some Linux issues with IOMMU mappings). Stop referencing venus-common schema in the new Qualcomm Iris bindings and move all necessary properties, except unused "video-firmware" (no driver usage, no DTS). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring (Arm) Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue [bod: Changed title order to dt-bindings: media] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 49b5feb5214d1fcd79c44ec3c7be17dd48b761e4 Author: Krzysztof Kozlowski Date: Mon Aug 4 15:37:38 2025 +0200 dt-bindings: media: qcom,sm8550-iris: Add SM8750 video codec Add binding for Qualcom SM8750 Iris video codec, which comes with significantly different powering up sequence than previous SM8650, thus different clocks and resets. For consistency keep existing clock and clock-names naming, so the list shares common part. Reviewed-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski [bod: re-ordered patch title to dt-bindings: media] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 088ee3df91ba7058394e92d6daf9bab40c418387 Author: Stephan Gerhold Date: Fri Jul 4 15:38:41 2025 +0200 dt-bindings: media: qcom,sm8550-iris: Add X1E80100 compatible Iris in X1E80100 is pretty much identical to SM8550. We can use the same firmware image and the same definitions in the driver, so just add qcom,x1e80100-iris to the existing list with qcom,sm8550-iris as fallback compatible. Signed-off-by: Stephan Gerhold Reviewed-by: Vikash Garodia Acked-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 1b2263ef329202ab0c2067c2be8af325b8fe7bca Author: Vikash Garodia Date: Fri Sep 5 00:30:03 2025 +0530 MAINTAINERS: Update Vikash Garodia's email address Replace my quicinc.com address with oss.qualcomm.com email in the MAINTAINERS file for both IRIS and VENUS video accelerator drivers. Also update mailmap to ensure proper attribution across historical commits. Signed-off-by: Vikash Garodia Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 246fdc42df9b0ef99e250d3d38083bc75157e7ca Author: Dikshita Agarwal Date: Mon Jul 28 15:13:44 2025 +0530 mailmap: update Dikshita Agarwal's email addresses Add dikshita.agarwal@oss.qualcomm.com as the main address for upstream work. Signed-off-by: Dikshita Agarwal Signed-off-by: Dikshita Agarwal [bod: change .mailmap to mailmap] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 907cef174cd81053beb54003e79b92f89bcd5d67 Author: Dikshita Agarwal Date: Mon Sep 1 13:03:29 2025 +0530 dt-bindings: media: qcom,sm8550-iris: Update Dikshita Agarwal's email address Replace quic_dikshita@quicinc.com by dikshita.agarwal@oss.qualcomm.com. Signed-off-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue [bod: Fixed patch title] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e1684530b163ba6d0eab1c1fa3da873d3557103d Author: Dikshita Agarwal Date: Mon Sep 1 13:03:28 2025 +0530 MAINTAINERS: update Dikshita Agarwal's email addresses Use dikshita.agarwal@oss.qualcomm.com as the main address for kernel work as quic_dikshita@quicinc.com will go away in some time. Signed-off-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit bfdfbdf469b4ca514a83c2d2a51c26d3a22e3d11 Author: Bryan O'Donoghue Date: Wed Jul 16 12:27:07 2025 +0100 MAINTAINERS: Add a media/platform/qcom MAINTAINERS entry Point the MAINTAINERS file to the linuxtv.org patchwork, to me for merging media/platform/qcom and to the media-comitters gitlab. Remove my +R from venus and iris so that get_maintainers.pl lists me for drivers/media/platform/qcom as +M. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c0baf70955e7f865036463fdfc562ffa092f4250 Author: Laurent Pinchart Date: Wed Aug 13 00:46:10 2025 +0300 media: i2c: s5k6a3: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has initially been optional. Both properties were initially set in the upstream DT sources. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property if available or uses a fixed default otherwise, and sets the clock rate. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 5bf86863ddfee547bce59f385e3dd85fecc63440 Author: Laurent Pinchart Date: Wed Aug 13 00:46:09 2025 +0300 media: i2c: s5k5baf: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has always been optional. Both properties were initially set in the upstream DT sources. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property if available or uses a fixed default otherwise, and sets the clock rate. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. For all meaningful purposes, devm_v4l2_sensor_clk_get_legacy() returns -EPROBE_DEFER in situations when the driver would want to defer probing. Replace the hardcoded -EPROBE_DEFER error with propagating the error code from devm_v4l2_sensor_clk_get_legacy(). Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 75b5888a893559ea342715180aad80418a0a52f6 Author: Laurent Pinchart Date: Wed Aug 13 00:46:08 2025 +0300 media: i2c: s5c73m3: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. No DT bindings are available. The "clocks" and "clock-frequency" properties were initially both set in the upstream DT sources. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property if available or uses a fixed default otherwise, and sets the clock rate. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit d2fa1134a48b1e1caa5e4b7f94212d27afa1f586 Author: Laurent Pinchart Date: Wed Aug 13 00:46:07 2025 +0300 media: i2c: ov8856: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports ACPI and OF platforms. The "clocks" and "clock-frequency" properties were initially specified as mandatory in the DT bindings and were both set in the upstream DT sources. The driver retrieves the clock rate from the "clock-frequency" property. On OF platforms, it retrieves the clock and sets its rate. If the rate does not match the expected rate, the driver prints a warning. This is correct behaviour for ACPI, and deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit f2cc0ccab90fd798910198969dbf146d7c0c92e1 Author: Laurent Pinchart Date: Wed Aug 13 00:46:06 2025 +0300 media: i2c: ov8856: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov8856 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 0e14d99c4dbefc0e472b89fdfd5ca3f10f9d21a3 Author: Laurent Pinchart Date: Wed Aug 13 00:46:05 2025 +0300 media: i2c: ov5695: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has never been allowed. The "clocks" property is set in the upstream DT sources and the "clock-frequency" property isn't. The driver retrieves the clock and sets its rate to a fixed value. It then retrieves the rate from the clock, and fails probing if the value doesn't match. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 0f1e46fc82e5d77371a2c3aec75ebe24dd30a13c Author: Laurent Pinchart Date: Wed Aug 13 00:46:04 2025 +0300 media: i2c: ov5645: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has always been optional. Both the "clocks" and "clock-frequency" properties are set in the upstream DT sources. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property, and sets the clock rate to the retrieved rate. If the rate does not match the expected rates, the driver fails probing. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit cd7a9b578356f21332f4492c4c919cc6d5aa3349 Author: Laurent Pinchart Date: Wed Aug 13 00:46:03 2025 +0300 media: i2c: ov2685: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has never been allowed. The "clocks" property has always been set in the upstream DT sources, and the "clock-frequency" never. The driver retrieves the clock, and sets its rate to a fixed value. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit dc1dadf63d451bab761248f19ca7560ec5568836 Author: Laurent Pinchart Date: Wed Aug 13 00:46:02 2025 +0300 media: i2c: ov02a10: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" and "clock-frequency" properties were initially mandatory in the DT bindings. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property, and sets the clock rate to the retrieved rate. If the rate does not match one of the expected rates, the driver fails probing. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit f8f4914ed030eb9411a77cf317607cb4bd52b196 Author: Laurent Pinchart Date: Wed Aug 13 00:46:01 2025 +0300 media: i2c: ov02a10: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov02a10 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 44fec2c00d8c83583f746e15db1becaed2f62754 Author: Laurent Pinchart Date: Wed Aug 13 00:46:00 2025 +0300 media: i2c: imx290: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" and "clock-frequency" properties were initially mandatory in the DT bindings. The driver retrieves the clock, retrieves the clock rate from the "clock-frequency" property, and sets the clock rate to the retrieved rate. If the rate does not match one of the expected rates, the driver fails probing. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit c5b1a92c5bfabe95c0fa2221f8bfddb8d367a1c4 Author: Laurent Pinchart Date: Wed Aug 13 00:45:59 2025 +0300 media: i2c: imx258: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports ACPI and OF platforms. The "clocks" property was not initially specified as mandatory in the DT bindings, and the "clock-frequency" property has never been allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 4b23f780a353df357195ae01cab9aba112daf53c Author: Laurent Pinchart Date: Wed Aug 13 00:45:58 2025 +0300 media: i2c: imx258: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct imx258 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit d2d7488bf53d1ba07e60aa6b6decae001071b9b6 Author: Laurent Pinchart Date: Wed Aug 13 00:45:57 2025 +0300 media: i2c: gc08a3: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" and "clock-frequency" properties were initially mandatory in the DT bindings and were both set in the upstream DT sources. The driver retrieves the clock, retrieves and ignores the clock rate from the clock-frequency property, and sets the clock rate to a fixed value. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 30dbc5316736bb17aa59729e417db45bfface060 Author: Laurent Pinchart Date: Wed Aug 13 00:45:56 2025 +0300 media: i2c: gc05a2: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" and "clock-frequency" properties were initially mandatory in the DT bindings and were both set in the upstream DT sources. The driver retrieves the clock, retrieves and ignores the clock rate from the clock-frequency property, and sets the clock rate to a fixed value. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit fdee212433d2311d324f81d1af3ef3e02ade6c7a Author: Laurent Pinchart Date: Wed Aug 13 00:45:55 2025 +0300 media: i2c: et8ek8: Use V4L2 legacy sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage copying deprecated behaviour for OF platforms in new drivers, and lead to differences in behaviour between drivers. Instead, drivers that need to preserve the deprecated OF behaviour should use the devm_v4l2_sensor_clk_get_legacy() helper. This driver supports OF platforms only. The "clocks" and "clock-frequency" properties were initially mandatory in the DT bindings and were both set in the upstream DT sources. The driver retrieves the clock, retrieves and ignores the clock rate from the clock-frequency property, and sets the clock rate to a fixed value. This is deprecated behaviour for OF. Switch to using the devm_v4l2_sensor_clk_get_legacy() helper. This preserves setting the clock rate on OF platforms. Should support for OF platforms that set the clock rate through clock-frequency be considered unneeded in the future, the driver will only need to switch to devm_v4l2_sensor_clk_get() without any other change. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit cf7ea1d6e563d9a250ccccba26e4189ab1e6b6c4 Author: Laurent Pinchart Date: Wed Aug 13 00:45:54 2025 +0300 media: i2c: et8ek8: Drop support for per-mode external clock frequency The et8ek8 driver supports programming different external clock frequencies for different modes, but in practice all modes use a 9.6MHz external clock. Drop support for this feature and use a hardcoded frequency, in preparation for further refactoring of external clock handling. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit dd235b07b65e123c0fdadc2883b9c16aa4749164 Author: Laurent Pinchart Date: Wed Aug 13 00:45:53 2025 +0300 media: v4l2-common: Add legacy camera sensor clock helper The recently introduced devm_v4l2_sensor_clk_get() helper aims at simplifying sensor drivers by centralizing clock handling code, as well as reducing cargo-cult and deprecated behaviour. A set of drivers implement external clock handling in a non-standard way. This can't be changed as there is a high risk of breaking existing platforms, but keeping the code as-is creates a risk of new drivers copying deprecated behaviour. To fix this, introduce a new devm_v4l2_sensor_clk_get_legacy() helper and use it in those driver. Compared to devm_v4l2_sensor_clk_get(), the new helper takes the "clock-frequency" property into account and sets the external clock rate on OF platforms, and adds the ability to specify a fixed default or fallback clock rate in case the "clock-frequency" property is not present. Signed-off-by: Laurent Pinchart Reviewed-by: Niklas Söderlund Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit bfa626306cf7be5868a24b86cc358879f4d21dc1 Author: Laurent Pinchart Date: Wed Aug 13 00:45:52 2025 +0300 media: i2c: ov9734: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 9f16195e4567d81efbc266f827432267e7c17838 Author: Laurent Pinchart Date: Wed Aug 13 00:45:51 2025 +0300 media: i2c: ov9734: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov9734 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 5b428a40a63daee89e089a56dd27f63f3808ca2a Author: Laurent Pinchart Date: Wed Aug 13 00:45:50 2025 +0300 media: i2c: ov7251: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has always been optional. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match one of the supported rates, the driver fails probing. If a clock is available and the "clock-frequency" property is set, the driver sets the rate of the clock to the value of the property. It does however use the rate initially retrieved from the clock for further calculations, which is a bug if the rates don't match, and would prevent the sensor from functioning properly. We can therefore assume that this case never occurs, and that the driver behaves correctly for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 063f5989718ccba7ecced3f7a73bbb26d8e1b0de Author: Laurent Pinchart Date: Wed Aug 13 00:45:49 2025 +0300 media: i2c: ov5693: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property has always been specified as mandatory in the DT bindings, and the "clock-frequency" property has never been allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit c8ab1727624a54cfbbfbfe039da98f88654b319b Author: Laurent Pinchart Date: Wed Aug 13 00:45:48 2025 +0300 media: i2c: ov5675: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property has always been specified as mandatory in the DT bindings, and the "clock-frequency" property has never been allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 381045e43b7376e4516f5482e478d680fe3c7c05 Author: Laurent Pinchart Date: Wed Aug 13 00:45:47 2025 +0300 media: i2c: ov5675: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov5675 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 2fc0898408b14f2d395a84faa449e4cbede9e714 Author: Laurent Pinchart Date: Wed Aug 13 00:45:46 2025 +0300 media: i2c: ov5670: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property has always been specified as mandatory in the DT bindings, and the "clock-frequency" property has never been allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit be3971e218b908488bb623e2ac9d5eaf003e1c32 Author: Laurent Pinchart Date: Wed Aug 13 00:45:45 2025 +0300 media: i2c: ov5670: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov5670 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit f994b6e7e5800695fcd92ce386b05da1f061c0bd Author: Laurent Pinchart Date: Wed Aug 13 00:45:44 2025 +0300 media: i2c: ov4689: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports OF platforms only. The "clocks" property has always been specified as mandatory in the DT bindings and the "clock-frequency" property has never been allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is deprecated on OF platforms, but behaves correctly on platforms that comply with the DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 853bd2ec1196945fa96221497907b3046ad28d4d Author: Laurent Pinchart Date: Wed Aug 13 00:45:43 2025 +0300 media: i2c: ov2740: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock if present, and retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit fdba8eba02b68973344bc7a4b17ebb7f315509b7 Author: Laurent Pinchart Date: Wed Aug 13 00:45:42 2025 +0300 media: i2c: ov2740: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov2740 and access it from there instead, to simplify the driver. While at it, fix mistakes in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 964ae05b0d6972dcf5df86f30636ca3aef1be9b1 Author: Laurent Pinchart Date: Wed Aug 13 00:45:41 2025 +0300 media: i2c: ov13b10: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock if present, and retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 42bab2cb292dc963156dadce814cc22eae9e73ae Author: Laurent Pinchart Date: Wed Aug 13 00:45:40 2025 +0300 media: i2c: ov13b10: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov13b10 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 9df442485b132571fe17f542aa5957185f10ddf7 Author: Laurent Pinchart Date: Wed Aug 13 00:45:39 2025 +0300 media: i2c: ov13858: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver prints a warning. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 8853d26bfd04db9c78ebd5c349fe3e76c38c640c Author: Laurent Pinchart Date: Wed Aug 13 00:45:38 2025 +0300 media: i2c: ov13858: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov13858 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 5dee9af9c85930decb96f603ff0bdec3158b8f07 Author: Laurent Pinchart Date: Wed Aug 13 00:45:37 2025 +0300 media: i2c: ov08x40: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property is specified as mandatory in the DT bindings and the "clock-frequency" property is not allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 5ff996ee54ad76e7428e85733061285381def607 Author: Laurent Pinchart Date: Wed Aug 13 00:45:36 2025 +0300 media: i2c: ov08x40: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov08x40 and access it from there instead, to simplify the driver. While at it, fix mistakes in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 1e921b267eb709ef76601c4aefb001079c604f18 Author: Laurent Pinchart Date: Wed Aug 13 00:45:35 2025 +0300 media: i2c: ov08d10: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver prints a warning. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 4e2b34c36ce18df7dd44d0612decfd479305f7fb Author: Laurent Pinchart Date: Wed Aug 13 00:45:34 2025 +0300 media: i2c: ov08d10: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov08d10 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 70dbc965b4198bcfb93478c2ab67da4179d0e6ec Author: Laurent Pinchart Date: Wed Aug 13 00:45:33 2025 +0300 media: i2c: ov02e10: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property is specified as mandatory in the DT bindings and the "clock-frequency" property is not allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit d1f4dbef9c950aa809ad48915e9bdbe1dc1d11b9 Author: Laurent Pinchart Date: Wed Aug 13 00:45:32 2025 +0300 media: i2c: ov02e10: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov02e10 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit baa59320ee73d87a138881f57f7e5e9fd8eeadda Author: Laurent Pinchart Date: Wed Aug 13 00:45:31 2025 +0300 media: i2c: ov02c10: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property is specified as mandatory in the DT bindings and the "clock-frequency" property is not allowed. The driver retrieves the clock and its rate if present, and falls back to retrieving the rate from the "clock-frequency" property otherwise. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 963b07259fba46330a93b75c3c6cac804fe8330b Author: Laurent Pinchart Date: Wed Aug 13 00:45:30 2025 +0300 media: i2c: ov02c10: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct ov02c10 and access it from there instead, to simplify the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 60d1c3a2b9baf1e0bcff1333837083c1ee3720a8 Author: Laurent Pinchart Date: Wed Aug 13 00:45:29 2025 +0300 media: i2c: og01a1b: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI and OF platforms. The "clocks" property is specified as mandatory in the DT bindings and the "clock-frequency" property is not allowed. The driver retrieves the clock if present, retrieves the clock rate from the "clock-frequency" property and falls back to retrieving it from the clock. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI, and for OF platforms that comply with the documented DT bindings. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. The behaviour is also unchanged on OF platforms that comply with the DT bindings. Non-compliant platforms are not expected, but any regression could easily be handled by switching to the devm_v4l2_sensor_clk_get_legacy() helper designed to preserve non-compliant behaviour. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 4d58f671944a16314f03d3c0c40ee69058ca02c9 Author: Laurent Pinchart Date: Wed Aug 13 00:45:28 2025 +0300 media: i2c: og01a1b: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct og01a1b and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit eaa7d46d965412956c3ed1aed1213c20290f19c2 Author: Laurent Pinchart Date: Wed Aug 13 00:45:27 2025 +0300 media: i2c: imx335: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 49c6ac166cf77cd53eeda69e8ccdcbe4a57a4fdf Author: Laurent Pinchart Date: Wed Aug 13 00:45:26 2025 +0300 media: i2c: imx355: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct imx355 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 047119e3cd631624e04cf251cbafe13bef3f6373 Author: Laurent Pinchart Date: Wed Aug 13 00:45:25 2025 +0300 media: i2c: imx319: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit df2942622abf3bd1e0550132798e96d93b6562f3 Author: Laurent Pinchart Date: Wed Aug 13 00:45:24 2025 +0300 media: i2c: imx319: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct imx319 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit cff416364c33c9875c247dbafa3b09a454f82275 Author: Laurent Pinchart Date: Wed Aug 13 00:45:23 2025 +0300 media: i2c: imx208: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 5fa4f8665f0514be143bb6ff2b8d2dee60e81c31 Author: Laurent Pinchart Date: Wed Aug 13 00:45:22 2025 +0300 media: i2c: imx208: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct imx208 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 2753de70d7d533916c9b6880f43e6b0426fae321 Author: Laurent Pinchart Date: Wed Aug 13 00:45:21 2025 +0300 media: i2c: hi847: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit f499f2bf6257a38796cc551c578e64dfce2c061a Author: Laurent Pinchart Date: Wed Aug 13 00:45:20 2025 +0300 media: i2c: hi847: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct hi847 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit c674a38906381fb599b95f0da8713f7c108c3e6e Author: Laurent Pinchart Date: Wed Aug 13 00:45:19 2025 +0300 media: i2c: hi556: Use V4L2 sensor clock helper Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate, or modify the clock rate of the external clock programmatically. Both behaviours are valid on a subset of ACPI platforms, but are considered deprecated on OF platforms, and do not support ACPI platforms that implement MIPI DisCo for Imaging. Implementing them manually in drivers is deprecated, as that can encourage cargo-cult and lead to differences in behaviour between drivers. Instead, drivers should use the devm_v4l2_sensor_clk_get() helper. This driver supports ACPI platforms only. It retrieves the clock if present, and retrieves the clock rate from the "clock-frequency" property. If the rate does not match the expected rate, the driver fails probing. This is correct behaviour for ACPI. Switch to using the devm_v4l2_sensor_clk_get() helper. This does not change the behaviour on ACPI platforms that specify a clock-frequency property and don't provide a clock. On ACPI platforms that provide a clock, the clock rate will be set to the value of the clock-frequency property. This should not change the behaviour either as this driver expects the clock to be set to that rate, and wouldn't operate correctly otherwise. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit dfd2fb5b73c27bdeaa2f338b81b2e403e6ea5ab1 Author: Laurent Pinchart Date: Wed Aug 13 00:45:18 2025 +0300 media: i2c: hi556: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct hi556 and access it from there instead, to simplify the driver. While at it, fix a mistake in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 73d31c7626efc54e4293e3c4ab49f849d1a42c68 Author: Laurent Pinchart Date: Wed Aug 13 00:45:17 2025 +0300 media: i2c: ov6650: Drop unused driver The ov6650 driver was introduced in v2.6.37 to support the OMAP1-based Amstrad Delta video phone. The platform still has a board file in the kernel, but support for the camera was dropped in commit ce548396a433 ("media: mach-omap1: board-ams-delta.c: remove soc_camera dependencies") in v5.9. The driver has been unused since as it has received neither ACPI nor DT support. The ov6650 driver is one of the last sensor drivers calling clk_set_rate(). This is deprecated, and calls to the function are being removed to avoid cargo-cult. As the driver is unlikely to ever be used again, drop it instead of trying to avoid call clk_set_rate(). Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit f14eb6a9aa132eb07460bccac7bb74bc379a8b41 Author: Laurent Pinchart Date: Wed Aug 13 00:45:16 2025 +0300 media: i2c: mt9v111: Do not set clock rate manually The driver retrieves the rate of the external at probe time, and then reprograms that clock with the same rate when powering on the device. Setting the clock rate is not needed, drop it. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit b4dd3bbd2eeb60702a8251c50cadd098257c5bfe Author: Laurent Pinchart Date: Wed Aug 13 00:45:15 2025 +0300 media: i2c: mt9v032: Drop support for platform data The last user of the mt9v032 driver through board files and platform data has long been removed. Drop support for platform data from the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 0f8d0da42c2d8479390bc6ac72021425765778b9 Author: Laurent Pinchart Date: Wed Aug 13 00:45:14 2025 +0300 media: i2c: mt9v032: Replace client->dev usage The driver needs to access the struct device in many places, and retrieves it from the i2c_client itself retrieved with v4l2_get_subdevdata(). Store it as a pointer in struct mt9v032 and access it from there instead, to simplify the driver. While at it, fix mistakes in the sort order of include statements. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 55e3c86887ddbd1c676a06dcc9c3cceeb5380008 Author: Laurent Pinchart Date: Wed Aug 13 00:45:13 2025 +0300 media: i2c: mt9v022: Drop unused mt9v022.h header The mt9v022 driver got removed in commit e7eab49132ba ("media: staging/media/soc_camera: remove this driver"), but its platform header file got left behind. Remove it. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit 4e181beb68a67453dadbac89e7440c4a291236dc Author: Laurent Pinchart Date: Wed Aug 13 00:45:12 2025 +0300 dt-bindings: media: imx274: Make clocks property required The sensor requires an external clock, and drivers need to access the clock to retrieve its frequency in order to configure the sensor. This makes usage of the clocks property mandatory for a system to work properly. Mark the clocks and clock-names properties as required, and update the example accordingly. Signed-off-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit ea501438dcd321b058be91eadee1c67b5bec3c8d Author: Laurent Pinchart Date: Wed Aug 13 00:45:11 2025 +0300 dt-bindings: media: imx258: Make clocks property required The sensor requires an external clock, and drivers need to access the clock to retrieve its frequency in order to configure the sensor. This makes usage of the clocks property mandatory for a system to work properly. Mark the property as required. Signed-off-by: Laurent Pinchart Acked-by: Rob Herring (Arm) Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit c7d54dba555aa282d9d1abf8a808621ae20cc6c7 Author: Laurent Pinchart Date: Wed Aug 13 00:45:10 2025 +0300 dt-bindings: media: et8ek8: Deprecate clock-frequency property Usage of the clock-frequency property for camera sensors is discouraged in favour of using assigned-clock-rates (and assigned-clock-parents where needed). Drop the property, and update the example accordingly. Signed-off-by: Laurent Pinchart Acked-by: Rob Herring (Arm) Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit aa1826696a55cb0cbf706b41d7cb5f4e22084206 Author: Laurent Pinchart Date: Wed Aug 13 12:49:23 2025 +0300 dt-bindings: media: Deprecate clock-frequency property for camera sensors Usage of the clock-frequency property for camera sensors is discouraged in favour of using assigned-clock-rates (and assigned-clock-parents where needed). Mark the property as deprecated. Update the examples accordingly. In DT examples where the sensor input clock appears to come from a programmable clock generator, replace clock-frequency by the assigned-clocks and assigned-clock-rates properties. Otherwise, just drop clock-frequency. Signed-off-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Sakari Ailus Reviewed-by: Mehdi Djait Signed-off-by: Hans Verkuil commit fa9e6df636fb8b3b27570f38c53640c9e2b02f79 Author: Hardevsinh Palaniya Date: Fri Aug 29 14:39:51 2025 +0530 media: i2c: add ov2735 image sensor driver Add a v4l2 subdevice driver for the Omnivision OV2735 sensor. The Omnivision OV2735 is a 1/2.7-Inch CMOS image sensor with an active array size of 1920 x 1080. The following features are supported: - Manual exposure an gain control support - vblank/hblank control support - Test pattern support control - Supported resolution: 1920 x 1080 @ 30fps (SGRBG10) Co-developed-by: Himanshu Bhavani Signed-off-by: Himanshu Bhavani Signed-off-by: Hardevsinh Palaniya [Sakari Ailus: Use container_of_const(), fix enum_bus_code condition.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 773bb3066e6debf5b66ce598ec6a989911864d61 Author: Himanshu Bhavani Date: Fri Aug 29 14:39:50 2025 +0530 dt-bindings: media: i2c: Add ov2735 sensor Add bindings for Omnivision OV2735 sensor. Add MAINTAINERS entry for Omnivision OV2735 binding documentation Signed-off-by: Himanshu Bhavani Signed-off-by: Hardevsinh Palaniya Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 25bf2e1925c9d42c0b0c18a92c5ef86a15b90bd6 Author: Vladimir Zapolskiy Date: Fri Aug 29 17:42:42 2025 +0300 media: i2c: Add OmniVision OG0VE1B camera sensor OmniVision OG0VE1B is a monochrome image sensor, which produces frames in 8/10-bit raw output format and supports 640x480, 400x400, 200x200 and 100x100 output image resolution modes. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9acb06945fabc3f8a392674e4c4604bf7657dd29 Author: Vladimir Zapolskiy Date: Fri Aug 29 17:42:41 2025 +0300 dt-bindings: media: i2c: Add OmniVision OG0VE1B camera sensor Add device tree bindings documentation for OmniVision OG0VE1B camera sensor. Reviewed-by: Rob Herring (Arm) Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit fd7cb868e309457400b958eaf05edd19a72d422c Author: Vladimir Zapolskiy Date: Fri Aug 29 17:42:32 2025 +0300 media: i2c: Add OmniVision OV6211 image sensor driver OmniVision OV6211 is a monochrome image sensor, which produces frames in 8/10-bit raw output format and supports 400x400, 200x200 and 100x100 output image resolution modes. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9364790e91fbfb34aa4751e5cafe716079e26b70 Author: Vladimir Zapolskiy Date: Fri Aug 29 17:42:31 2025 +0300 dt-bindings: media: i2c: Add OmniVision OV6211 image sensor Add device tree bindings documentation for OmniVision OV6211 image sensor. Reviewed-by: Rob Herring (Arm) Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c7df6f339af94689fdc433887f9fbb480bf8a4ed Author: Hao Yao Date: Fri Apr 25 12:33:25 2025 +0800 media: ov08x40: Fix the horizontal flip control The datasheet of ov08x40 doesn't match the hardware behavior. 0x3821[2] == 1 is the original state and 0 the horizontal flip enabled. Signed-off-by: Hao Yao Reviewed-by: Hans de Goede Tested-by: Hans de Goede # ThinkPad X1 Carbon Gen 12 & Gen 13 Reviewed-by: Stanislaw Gruszka Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 Author: Vladimir Zapolskiy Date: Sat Aug 23 16:22:06 2025 +0300 media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer The OmniVision OG01A1B image sensor is a monochrome sensor, it supports 8-bit and 10-bit RAW output formats only. That said the planar greyscale Y8/Y10 media formats are more appropriate for the sensor instead of the originally and arbitrary selected SGRBG one, since there is no red, green or blue color components. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bfdcfd008b375dfbc0b19fecd92311dd401da68e Author: Sakari Ailus Date: Fri Aug 29 09:04:41 2025 +0300 media: ov02e10: Remove Jingjing's e-mail address Jingjing's e-mail address no longer works, remove it from the driver. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 80ae11c1a524015e4d9ef25c04fa3aacdcbe3a39 Author: Dan Carpenter Date: Wed Aug 27 16:02:57 2025 +0300 media: ti: j721e-csi2rx: Fix NULL vs IS_ERR() bug in ti_csi2rx_request_max_ppc() The media_entity_remote_source_pad_unique() function never returns NULL, it returns error pointers. Change this check from a NULL check to an IS_ERR() check. Fixes: 31f91c5224cd ("media: ti: j721e-csi2rx: Support multiple pixels per clock") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Reviewed-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a1dcf9a069f7e2b7571bc0aaa4e8a742c6f78fe8 Author: Qianfeng Rong Date: Wed Aug 27 20:39:12 2025 +0800 media: stm32-dcmi: use int type to store negative error codes Change "ret" from unsigned int to int type in dcmi_framesizes_init() and dcmi_graph_notify_bound() to store negative error codes or zero returned by v4l2_subdev_call() and media_create_pad_link() - this better aligns with the coding standards and maintains code consistency. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 27296c1f0027a9b35faa7af71d7490c96409551e Author: Qianfeng Rong Date: Wed Aug 27 20:39:11 2025 +0800 media: raspberrypi: use int type to store negative error codes Use int instead of unsigned int for the 'ret' variable in csi2_init() to store negative error codes or zero returned by media_entity_pads_init(). No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bacd713145443dce7764bb2967d30832a95e5ec8 Author: Qianfeng Rong Date: Wed Aug 27 20:39:10 2025 +0800 media: i2c: mt9v111: fix incorrect type for ret Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() to store negative error codes or zero returned by __mt9v111_hw_reset() and other functions. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. No effect on runtime. Signed-off-by: Qianfeng Rong Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111") Cc: stable@vger.kernel.org Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit da8f23e359166624a504cbeb8263227ca35d38c4 Author: Allen Ballway Date: Wed Jul 23 12:57:35 2025 -0700 media: ov8865: move mode_configure out of state_configure ov8865_mode_configure() only needs to be called on sensor init, but it can be called multiple times from ov8865_state_configure(). Move ov8865_mode_configure() to ov8865_sensor_init(). Signed-off-by: Allen Ballway Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 075710b670d96cf9edca1894abecba7402fe4f34 Author: Hans Verkuil Date: Thu Apr 24 11:27:30 2025 +0200 media: i2c: mt9p031: fix mbus code initialization The mediabus code is device dependent, but the probe() function thought that device_get_match_data() would return the code directly, when in fact it returned a pointer to a struct mt9p031_model_info. As a result, the initial mbus code was garbage. Tested with a BeagleBoard xM and a Leopard Imaging LI-5M03 sensor board. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil Tested-by: Hans Verkuil Fixes: a80b1bbff88b ("media: mt9p031: Refactor format handling for different sensor models") Cc: stable@vger.kernel.org commit 4010eef01debc50facbea76a37b9445c61c379bf Author: Sakari Ailus Date: Sat Jun 28 17:18:01 2025 +0300 media: staging: ipu7: Don't include linux/version.h linux/version.h isn't needed by the driver, don't include it. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6a79e9c91e9e0fb9d4fdcdb288952f62333fa5dc Author: Sakari Ailus Date: Mon Mar 11 13:13:08 2024 +0200 media: mc: Clear minor number reservation at unregistration time Clear the media device's minor number reservation at unregister time as there's no need to keep it reserved for longer. This makes it possible to reserve the same minor right after unregistration. Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Signed-off-by: Hans Verkuil commit fc2aaf2d93a6379e26e7b2cbbf3c6b69b98dc37b Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:46 2025 +0200 media: venus: core: Add qcm2290 DT compatible and resource data Add a qcm2290 compatible binding to the Venus core. The maximum concurrency is video decode at 1920x1080 (FullHD) with video encode at 1280x720 (HD). The driver is not available to firmware versions below 6.0.55 due to an internal requirement for secure buffers. The bandwidth tables incorporate a conservative safety margin to ensure stability under peak DDR and interconnect load conditions. Co-developed-by: Loic Poulain Signed-off-by: Loic Poulain Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a9551290ef3bacab82e8ffa973e7ef407265204c Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:45 2025 +0200 media: venus: core: Sort dt_match alphabetically. Correctly sort the array of venus_dt_match entries. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7998681eb7f4b5721d8772cbf91087a449f0c0da Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:44 2025 +0200 media: venus: hfi_plat_v4: Add capabilities for the 4XX lite core Populate the HFI v4 lite capability set used by the AR50_LITE video core. These capabilities define the supported codec formats and operational limits specific to this streamlined VPU variant. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ba4fdff9201190d0f98bcb4c9b376c8457edfab2 Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:43 2025 +0200 media: venus: Add framework support for AR50_LITE video core The AR50_LITE is a simplified variant of the AR50 video core, designed for power and cost-efficient platforms. It supports hardware-accelerated decoding of H.264, HEVC, and VP9 formats, and provides encoding support for H.264 and HEVC. This commit prepares the framework to enable the AR50_LITE (it does not enable it). Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 85c853b7043657dd5c4965fc7e694b41a8f1ce87 Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:42 2025 +0200 media: venus: Define minimum valid firmware version Add support for specifying the minimum firmware version required for correct operation. When set, the driver compares this value against the version reported by the firmware: if the firmware is older than required, driver initialization will fail. The version check is performed before creating dynamic device tree nodes, to avoid the need for reverting nodes on failure. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 Author: Stephan Gerhold Date: Wed Aug 20 17:16:39 2025 +0200 media: venus: firmware: Use correct reset sequence for IRIS2 When starting venus with the "no_tz" code path, IRIS2 needs the same boot/reset sequence as IRIS2_1. This is because most of the registers were moved to the "wrapper_tz_base", which is already defined for both IRIS2 and IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to make sure that it uses the correct reset sequence. Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was used before commit c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version"). Fixes: c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version") Cc: stable@vger.kernel.org Signed-off-by: Stephan Gerhold Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov [bod: Fixed commit log IRIS -> IRIS2] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c329055587ee5248390e53fd2625438919928e2a Author: Jorge Ramirez-Ortiz Date: Thu Aug 14 10:52:41 2025 +0200 media: dt-bindings: venus: Add qcm2290 dt schema Add a schema for the venus video encoder/decoder on the qcm2290. The order of the IOMMU list is strict: the first two entries correspond to non-secure IOMMUs, and the remaining three to secure IOMMUs. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 935f703d7ecb25d43f519cdd2ca8704fd42ffb9c Author: Hans Verkuil Date: Tue Jun 24 08:47:15 2025 +0200 gpu: drm: display: drm_dp_cec: update Hans' email address Replace hverkuil@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Cc: dri-devel@lists.freedesktop.org Signed-off-by: Mauro Carvalho Chehab commit e765619c7bd57b4b6eb904f6f957e42c62e7e759 Author: Hans Verkuil Date: Tue Jun 24 08:46:18 2025 +0200 media: update Hans Verkuil's email address Replace hverkuil@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit e8c8d961d8ad53d8d104d7474c08d8e4626c7767 Author: Hans Verkuil Date: Tue Jun 24 08:41:15 2025 +0200 media: include: update Hans Verkuil's email address Replace hverkuil@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 9bff72cb99b10ead19ab1e36d240cc54bc4954b1 Author: Hans Verkuil Date: Tue Jun 24 08:39:35 2025 +0200 Documentation: update Hans Verkuil's email address Replace hverkuil@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ce4c356d760f6fb22d69f0c5091542891ba6f394 Author: Hans Verkuil Date: Tue Jun 24 08:36:16 2025 +0200 media: update Hans Verkuil's email address Replace hansverk@cisco.com by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 562e3bfa9f2ba3868a657d668aa56b4f4c5f18ec Author: Hans Verkuil Date: Tue Jun 24 08:34:49 2025 +0200 media: v4l2-core: update Hans Verkuil's email address Replace hverkuil-cisco@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1dd41ad7565940af6e96828230b6b11a8267437a Author: Hans Verkuil Date: Tue Jun 24 08:34:03 2025 +0200 Documentation: media: update Hans Verkuil's email address Replace hverkuil-cisco@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 8bff7f18c5dde939028cbe43d4a046dcb83a9e53 Author: Hans Verkuil Date: Tue Jun 24 08:31:11 2025 +0200 MAINTAINERS: update Hans Verkuil's email addresses Use hverkuil@kernel.org as the main address for kernel work. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 945f50036169714dd30b8cb37370059f2dc924e1 Author: Arnaldo Carvalho de Melo Date: Mon Sep 8 17:36:28 2025 -0300 perf symbols: Handle 'N' symbols in /proc/kallsyms I started seeing this in recent Fedora 42 kernels: # uname -a Linux number 6.16.3-200.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Aug 23 17:02:17 UTC 2025 x86_64 GNU/Linux # # perf test vmlinux 1: vmlinux symtab matches kallsyms : FAILED! # Rust is enabled and these were the symbols causing the above failure, i.e. found in vmlinux but not in /proc/kallsyms: $ grep -w N /proc/kallsyms 0000000000000000 N __pfx__RNCINvNtNtNtCsbDUBuN8AbD4_4core4iter8adapters3map12map_try_foldjNtCs6vVzKs5jPr6_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ 0000000000000000 N _RNCINvNtNtNtCsbDUBuN8AbD4_4core4iter8adapters3map12map_try_foldjNtCs6vVzKs5jPr6_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ $ So accept those 'N' symbols as well. About them, from 'man nm': "N" The symbol is a debugging symbol. "n" The symbol is in a non-data, non-code, non-debug read-only section. Reviewed-by: Ian Rogers Cc: Adrian Hunter Cc: Miguel Ojeda Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 199c9a8d26638845f509b76e3c176c27e7baafd7 Author: Ming Lei Date: Tue Sep 9 20:33:10 2025 +0800 blk-mq: Document tags_srcu member in blk_mq_tag_set structure Add missing documentation for the tags_srcu member that was introduced to defer freeing of tags page_list to prevent use-after-free when iterating tags. Fixes htmldocs warning: WARNING: include/linux/blk-mq.h:536 struct member 'tags_srcu' not described in 'blk_mq_tag_set' Reported-by: Stephen Rothwell Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit d86eaa0f3c56da286853b698b45c8ce404291082 Author: Christoph Hellwig Date: Mon Sep 8 12:56:39 2025 +0200 block: remove the bi_inline_vecs variable sized array from struct bio Bios are embedded into other structures, and at least spare is unhappy about embedding structures with variable sized arrays. There's no real need to the array anyway, we can replace it with a helper pointing to the memory just behind the bio, and with the previous cleanups there is very few site doing anything special with it. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Jens Axboe commit 70a6f71b1a77decfc5b1db426ccbe914b58adb38 Author: Christoph Hellwig Date: Mon Sep 8 12:56:38 2025 +0200 block: add a bio_init_inline helper Just a simpler wrapper around bio_init for callers that want to initialize a bio with inline bvecs. Signed-off-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit 7b77941724628e6171a286edbf04d67a1f1c1459 Author: Christophe JAILLET Date: Sun Sep 7 15:42:17 2025 +0200 drm/xe/hwmon: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 36884 10296 64 47244 b88c drivers/gpu/drm/xe/xe_hwmon.o After: ===== text data bss dec hex filename 36651 10224 64 46939 b75b drivers/gpu/drm/xe/xe_hwmon.o Signed-off-by: Christophe JAILLET Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/989e96369e9e1f8a44b816962917ec76877c912d.1757252520.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lucas De Marchi commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 Author: Eric Dumazet Date: Tue Sep 9 13:22:43 2025 +0000 nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets. Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 Signed-off-by: Eric Dumazet Cc: Mike Christie Cc: Richard W.M. Jones Cc: Jens Axboe Cc: Yu Kuai Cc: linux-block@vger.kernel.org Cc: nbd@other.debian.org Signed-off-by: Jens Axboe commit d9e33b38c89f4cf8c32b8481dbcf3a6cdbba4595 Author: Vignesh Raghavendra Date: Sat Sep 6 00:29:58 2025 +0530 spi: cadence-quadspi: Use BIT() macros where possible Convert few open coded bit shifts to BIT() macro for better readability. No functional changes intended. Signed-off-by: Vignesh Raghavendra Signed-off-by: Santhosh Kumar K Message-ID: <20250905185958.3575037-5-s-k6@ti.com> Signed-off-by: Mark Brown commit 858d4d9e0a9d6b64160ef3c824f428c9742172c4 Author: Santhosh Kumar K Date: Sat Sep 6 00:29:57 2025 +0530 spi: cadence-quadspi: Fix cqspi_setup_flash() The 'max_cs' stores the largest chip select number. It should only be updated when the current 'cs' is greater than existing 'max_cs'. So, fix the condition accordingly. Also, return failure if there are no flash device declared. Fixes: 0f3841a5e115 ("spi: cadence-qspi: report correct number of chip-select") CC: stable@vger.kernel.org Reviewed-by: Pratyush Yadav Reviewed-by: Théo Lebrun Signed-off-by: Santhosh Kumar K Message-ID: <20250905185958.3575037-4-s-k6@ti.com> Signed-off-by: Mark Brown commit 1ad55767e77a853c98752ed1e33b68049a243bd7 Author: Pratyush Yadav Date: Sat Sep 6 00:29:56 2025 +0530 spi: cadence-quadspi: Flush posted register writes before DAC access cqspi_read_setup() and cqspi_write_setup() program the address width as the last step in the setup. This is likely to be immediately followed by a DAC region read/write. On TI K3 SoCs the DAC region is on a different endpoint from the register region. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible that the DAC read/write goes through before the address width update goes through. In this situation if the previous command used a different address width the OSPI command is sent with the wrong number of address bytes, resulting in an invalid command and undefined behavior. Read back the size register to make sure the write gets flushed before accessing the DAC region. Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") CC: stable@vger.kernel.org Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Signed-off-by: Santhosh Kumar K Message-ID: <20250905185958.3575037-3-s-k6@ti.com> Signed-off-by: Mark Brown commit 29e0b471ccbd674d20d4bbddea1a51e7105212c5 Author: Pratyush Yadav Date: Sat Sep 6 00:29:55 2025 +0530 spi: cadence-quadspi: Flush posted register writes before INDAC access cqspi_indirect_read_execute() and cqspi_indirect_write_execute() first set the enable bit on APB region and then start reading/writing to the AHB region. On TI K3 SoCs these regions lie on different endpoints. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible for the AHB write to be executed before the APB write to enable the indirect controller, causing the transaction to be invalid and the write erroring out. Read back the APB region write before accessing the AHB region to make sure the write got flushed and the race condition is eliminated. Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") CC: stable@vger.kernel.org Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Signed-off-by: Santhosh Kumar K Message-ID: <20250905185958.3575037-2-s-k6@ti.com> Signed-off-by: Mark Brown commit e57ae80fe01a2b039c689b2d14fef51b1ebbd7f8 Author: Michal Wajdeczko Date: Fri Sep 5 20:02:25 2025 +0200 drm/xe/debugfs: Make residencies definitions const No need to keep them non-const. Also fix declaration of .name member, as it points to the const string. This translates to: add/remove: 1/0 grow/shrink: 0/2 up/down: 80/-248 (-168) Function old new delta residencies - 80 +80 dgfx_pcie_link_residencies_show 365 263 -102 dgfx_pkg_residencies_show 454 308 -146 Total: Before=2821548, After=2821380, chg -0.01% Signed-off-by: Michal Wajdeczko Cc: Soham Purkait Cc: Jonathan Cavitt Cc: Karthik Poosa Cc: Riana Tauro Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250905180225.8434-1-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 5450abb0dea4f9fb432dea2ca92ea7a9bd25650b Author: Thorsten Blum Date: Fri Sep 5 13:02:23 2025 +0200 s390/hmcdrv: Replace kmalloc() + copy_from_user() with memdup_user_nul() Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify hmcdrv_dev_write(). Remove the manual NUL-termination. No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Alexander Gordeev commit f5507aefc9114ced49d1ee527f63ea12ff5d7751 Author: Thorsten Blum Date: Thu Sep 4 13:40:29 2025 +0200 s390/debug: Replace kmalloc() + copy_from_user() with memdup_user_nul() Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify debug_get_user_string(). Remove the manual NUL-termination. No functional changes intended. Signed-off-by: Thorsten Blum Reviewed-by: Niklas Schnelle Signed-off-by: Alexander Gordeev commit fce99326c9cf5a0e57c4283a61c6b622ef5b0de8 Author: Raag Jadav Date: Mon Sep 8 11:23:20 2025 +0530 drm/xe/i2c: Enable bus mastering Enable bus mastering for I2C controller to support device initiated in-band transactions. Signed-off-by: Raag Jadav Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250908055320.2549722-1-raag.jadav@intel.com Signed-off-by: Lucas De Marchi commit 16c1f659860be36541ab89c2cfd3674fbe706cd7 Author: Frank Wunderlich Date: Wed Jul 9 13:09:49 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: configure switch phys and leds Assign pinctrl to switch phys and leds. Signed-off-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250709111147.11843-14-linux@fw-web.de Signed-off-by: Matthias Brugger commit c1347c688bf1889ba9e974a828f1f0f26717cd04 Author: Frank Wunderlich Date: Wed Jul 9 13:09:48 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: add sfp cages and link to gmac Add SFP cages to Bananapi-R4 board. The 2.5g phy variant only contains the wan-SFP, so add this to common dtsi and the lan-sfp only to the dual-SFP variant. Signed-off-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250709111147.11843-13-linux@fw-web.de Signed-off-by: Matthias Brugger commit 0333aa8fa2d5f0dcc92afcbb38f7b286163dc0cc Author: Frank Wunderlich Date: Wed Jul 9 13:09:47 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: add aliases for ethernet Add aliases for gmacs to allow bootloader setting mac-adresses. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250709111147.11843-12-linux@fw-web.de Signed-off-by: Matthias Brugger commit 32d5a82c5dd60f3f5e34cade74f92f0604cda096 Author: Frank Wunderlich Date: Wed Jul 9 13:09:46 2025 +0200 arm64: dts: mediatek: mt7988: add switch node Add mt7988 builtin mt753x switch nodes. Signed-off-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250709111147.11843-11-linux@fw-web.de Signed-off-by: Matthias Brugger commit 65f0e3970143ec5d24271a51e0bc8c0588383280 Author: Frank Wunderlich Date: Wed Jul 9 13:09:45 2025 +0200 arm64: dts: mediatek: mt7988: add basic ethernet-nodes Add basic ethernet related nodes. Mac1+2 needs pcs (sgmii+usxgmii) to work correctly which will be linked later when driver is merged. Signed-off-by: Daniel Golle Signed-off-by: Frank Wunderlich Link: https://lore.kernel.org/r/20250709111147.11843-10-linux@fw-web.de Signed-off-by: Matthias Brugger commit 93e435336ab4bfb115e546e5a31b895b1ce0b83d Author: Frank Wunderlich Date: Wed Jul 9 13:09:44 2025 +0200 arm64: dts: mediatek: mt7986: add interrupts for RSS and interrupt names Add interrupts for RSS/LRO and names to access them via name instead of index. Signed-off-by: Frank Wunderlich Link: https://lore.kernel.org/r/20250709111147.11843-9-linux@fw-web.de Signed-off-by: Matthias Brugger commit d0c970091abf11805cb629f20760c0e67eb73f82 Author: Frank Wunderlich Date: Wed Jul 9 13:09:43 2025 +0200 arm64: dts: mediatek: mt7986: add sram node Currently sram is allocated in driver via offset from reg of ethernet node. Change it to use a dedicated sram node like mt7988. Signed-off-by: Frank Wunderlich Link: https://lore.kernel.org/r/20250709111147.11843-8-linux@fw-web.de Signed-off-by: Matthias Brugger commit 0da6f7a0ab5322eb6d091a9c89d799adfeae078d Author: Aleksander Jan Bajkowski Date: Sun Sep 7 13:15:09 2025 +0200 arm64: dts: mediatek: add thermal sensor support on mt7981 The temperature sensor in the MT7981 is same as in the MT7986. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250907111742.23195-2-olek2@wp.pl Signed-off-by: Matthias Brugger commit 1383007f85fbb06aac5061b756b1ae4e701fef59 Author: Julien Massot Date: Fri Sep 5 13:51:59 2025 +0200 arm64: dts: mediatek: mt8395-nio-12l: add PMIC and GPIO keys support Add support for PMIC and GPIO keys on the Radxa NIO 12L board: Declare a gpio-keys node for the Volume Up button using GPIO106. Add the corresponding pin configuration in the pinctrl node. Add a mediatek,mt6359-keys subnode under the PMIC to handle the power and home buttons exposed by the MT6359. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Julien Massot Link: https://lore.kernel.org/r/20250905-radxa-nio-12-l-gpio-v3-2-40f11377fb55@collabora.com Signed-off-by: Matthias Brugger commit ba9d484ed3578705fcd24795b800e8e4364afb8c Author: Thomas Gleixner Date: Wed Sep 3 16:04:48 2025 +0200 PCI/MSI: Remove the conditional parent [un]mask logic Now that msi_lib_init_dev_msi_info() overwrites the irq_[un]mask() callbacks when the MSI_FLAG_PCI_MSI_MASK_PARENT flag is set by the parent domain, the conditional [un]mask logic is obsolete. Remove it. Signed-off-by: Thomas Gleixner Tested-by: Marc Zyngier Acked-by: Bjorn Helgaas Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250903135433.444329373@linutronix.de commit f09c1d63e895e1b45248a75656a41df2e8102874 Author: Marc Zyngier Date: Wed Sep 3 16:04:46 2025 +0200 irqchip/msi-lib: Honor the MSI_FLAG_PCI_MSI_MASK_PARENT flag For systems that implement interrupt masking at the interrupt controller level, the MSI library offers MSI_FLAG_PCI_MSI_MASK_PARENT. It indicates that it isn't enough to only unmask the interrupt at the PCI device level, but that the interrupt controller must also be involved. However, the way this is currently done is less than optimal, as the masking/unmasking is done on both sides, always. It would be far cheaper to unmask both at the start of times, and then only deal with the interrupt controller mask, which is cheaper than a round-trip to the PCI endpoint. Now that the PCI/MSI layer implements irq_startup() and irq_shutdown() callbacks, which [un]mask at the PCI level and honor the request to [un]mask the parent, this can be trivially done. Overwrite the irq_mask/unmask() callbacks of the device domain interrupt chip with irq_[un]mask_parent() when the parent domain asks for it. [ tglx: Adopted to the PCI/MSI changes ] Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Marc Zyngier Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250903135433.380783272@linutronix.de commit d22e9b8c96452ae0fead5e26651be66fe298100e Author: Julien Massot Date: Fri Sep 5 15:21:19 2025 +0200 arm64: dts: mediatek: mt8395-nio-12l: Enable UFS UFS is the primary storage for the Radxa NIO 12L. Enable it now that the ufshci and ufsphy nodes are available in the common mt8195 dtsi. Signed-off-by: Julien Massot Link: https://lore.kernel.org/r/20250905-radxa-nio-12l-ufs-v1-1-e2468bfd2c69@collabora.com Signed-off-by: Matthias Brugger commit 0aeb7ed4bcb244862a35f880053cd64d28c6fb04 Author: Rob Herring (Arm) Date: Tue Jul 22 12:11:52 2025 -0500 arm64: dts: mediatek: mt8183: Fix out of range pull values A value of 10 is not valid for "mediatek,pull-down-adv" and "mediatek,pull-up-adv" properties which have defined values of 0-3. It appears the "10" was written as a binary value. The driver only looks at the lowest 2 bits, so the value "10" decimal works out the same as if "2" was used. Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board") Signed-off-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250722171152.58923-2-robh@kernel.org Signed-off-by: Matthias Brugger commit 3374b5fb26b300809ecd6aed9f414987dd17c313 Author: Guoqing Jiang Date: Mon Jul 21 17:59:59 2025 +0800 arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 When test suspend resume with 6.8 based kernel, system can't resume and I got below error which can be also reproduced with 6.16 rc6+ kernel. mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110 mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110 After investigation, looks pcie0 has the same problem as pcie1 as decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1"). Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") Signed-off-by: Guoqing Jiang Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Macpaul Lin Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com Signed-off-by: Matthias Brugger commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 Author: Andreas Kemnade Date: Tue Sep 9 10:02:49 2025 +0200 hwmon: sy7636a: add alias Add module alias to have it autoloaded. Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info Signed-off-by: Guenter Roeck commit 393de14673d60384f8f014b75fe679a69c9110e9 Author: Kurt Borja Date: Mon Sep 8 10:54:52 2025 -0500 hwmon: (sht21) Add devicetree support Add DT support for sht2x chips. Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250908-sht2x-v4-4-bc15f68af7de@gmail.com Signed-off-by: Guenter Roeck commit 7e5969a4d3e794993c9ca8d4026cf31a34b32b30 Author: Kurt Borja Date: Mon Sep 8 10:54:51 2025 -0500 dt-bindings: trivial-devices: Add sht2x sensors Add sensirion,sht2x trivial sensors. Signed-off-by: Kurt Borja Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250908-sht2x-v4-3-bc15f68af7de@gmail.com Signed-off-by: Guenter Roeck commit b9aa93aa5185aee76c4c7a5ba4432b4d0d15f797 Author: Jiri Wiesner Date: Thu Jul 31 18:18:37 2025 +0200 clocksource: Print durations for sync check unconditionally A typical set of messages that gets printed as a result of the clocksource watchdog finding the TSC unstable usually does not contain messages indicating CPUs being ahead of or behind the CPU from which the check is carried out. That fact suggests that the TSC does not experience time skew between CPUs (if the clocksource.verify_n_cpus parameter is set to a negative value) but quantitative information is missing. The cs_nsec_max value printed by the "CPU %d check durations" message actually provides a worst case estimate of the time skew. If all CPUs have been checked, the cs_nsec_max value multiplied by 2 is the maximum possible time skew between the TSCs of any two CPUs on the system. The worst case estimate is derived from two boundary cases: 1. No time is consumed to execute instructions between csnow_begin and csnow_mid while all the cs_nsec_max time is consumed by the code between csnow_mid and csnow_end. In this case, the maximum undetectable time skew of a CPU being ahead would be cs_nsec_max. 2. All the cs_nsec_max time is consumed to execute instructions between csnow_begin and csnow_mid while no time is consumed by the code between csnow_mid and csnow_end. In this case, the maximum undetectable time skew of a CPU being behind would be cs_nsec_max. The worst case estimate assumes a system experiencing a corner case consisting of the two boundary cases. Always print the "CPU %d check durations" message so that the maximum possible time skew measured by the TSC sync check can be compared to the time skew measured by the clocksource watchdog. Signed-off-by: Jiri Wiesner Signed-off-by: Thomas Gleixner Reviewed-by: Paul E. McKenney Link: https://lore.kernel.org/all/aIuXXfdITXdI0lLp@incl commit e5b4ad2183f7ab18aaf7c73a120d17241ee58e97 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:39 2025 +0100 ASoC: cs-amp-lib-test: Add test for getting cal data from HP EFI Add a test case that cs_amp_get_efi_calibration_data() returns data when it is in the HP-specific EFI variable. This uses redirected implementation of cs_amp_get_efi_variable() that only returns data if the passes name and GUID match the HP EFI variable. A simple test case installs this function hook and then checks that calibration data is returned. Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-7-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit b78dd64208a83f66fc21951bd8758281a7d445a5 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:38 2025 +0100 ASoC: cs-amp-lib: Add HP-specific EFI variable for calibration data Search for an HP-specific EFI variable for calibration before falling back to the normal Cirrus Logic EFI variable. Future HP models will use an HP-defined EFI variable for storage of amp calibration data. The content is the same as the normal Cirrus Logic EFI variable. The first step in cs_amp_get_cal_efi_buffer() is to get the size of the EFI variable, so this has been made a loop that walks through an array of possible variables. A small change is needed to the KUnit test, which is included in this patch. Originally the cs_amp_lib_test_get_efi_variable() hook function asserted that the passed name and GUID matched the Cirrus Logic EFI variable. Obviously this will fail because the code now tries the HP definition first. The function has been changed to return EFI_NOT_FOUND instead, which emulates the normal behaviour of trying to get the HP variable on a system that has the Cirrus variable. Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-6-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit 7a4e5f4c663319f1e0c990ca62e3bb8d3d215c93 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:37 2025 +0100 ASoC: cs-amp-lib-test: Add tests for cs_amp_get_vendor_spkid() Add test cases for cs_amp_get_vendor_spkid() for the Lenovo speaker ID UEFI variable. This is a simple set of cases: - EFI variable is not found - EFI variable size is larger than the expect 1 byte - EFI variable has invalid value 0 - Lenovo UEFI variable valid values are interpreted correctly - HP UEFI variable valid values are interpreted correctly Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-5-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit 59255cfa4a0aa3484739ea58d67e02651424ffe3 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:36 2025 +0100 ASoC: cs35l56: Check for vendor-specific speaker ID value Call cs_amp_get_vendor_spkid() to get use a vendor-specific speaker ID value, if one exists. The speaker ID is used to load an appropriate set of firmware files for the speakers, and is usually read from a GPIO. Some manufacturers are instead using a custom UEFI variable for the speaker ID. Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-4-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit 267b9cdee522d03f95acf7c77de91056a4e004b3 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:35 2025 +0100 ASoC: cs-amp-lib: Add handling for Lenovo and HP UEFI speaker ID Add handling of the Lenovo-specific and HP-specific EFI variables for speaker ID. Future Lenovo and HP models will not give the codec driver access to the speaker detect GPIO. Instead, the BIOS will read the GPIO and create an EFI variable with a value indicating the state of the GPIO. The Lenovo and HP EFI variables are both defined to have only two valid values. But the variable name, GUID and values are different. This adds a new exported function cs_amp_get_vendor_spkid(). Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-3-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit 89ace3acf013eebb299290f41b4ac34bf6c62a10 Author: Richard Fitzgerald Date: Tue Sep 9 12:30:34 2025 +0100 ASoC: cs-amp-lib: Rename defines for Cirrus Logic EFI Rename: CS_AMP_CAL_NAME => CIRRUS_LOGIC_CALIBRATION_EFI_NAME CS_AMP_CAL_GUID => CIRRUS_LOGIC_CALIBRATION_EFI_GUID This is to clarify that these are specific to Cirrus Logic, especially the GUID. As defined by the UEFI specification the GUID is a vendor identifier, not an EFI variable identifier. There has been some misunderstanding of the purpose of these, which has led to the Cirrus Logic GUID value being copied and used for other vendor's EFI variables. It is rather strange to have data from another vendor marked with the vendor GUID for Cirrus Logic. Signed-off-by: Richard Fitzgerald Message-ID: <20250909113039.922065-2-rf@opensource.cirrus.com> Signed-off-by: Mark Brown commit d55dd6f5e47dd85ab2086b62f7a747d3f8be0fa0 Author: Bibo Mao Date: Sat Sep 6 14:49:52 2025 +0800 LoongArch: Remove clockevents shutdown call on offlining The clockevents core already detached and unregistered it at this stage. Signed-off-by: Bibo Mao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250906064952.3749122-3-maobibo@loongson.cn commit fe2a449a45b13df1562419e0104b4777b6ea5248 Author: Bibo Mao Date: Sat Sep 6 14:49:51 2025 +0800 tick: Do not set device to detached state in tick_shutdown() tick_shutdown() sets the state of the clockevent device to detached first and the invokes clockevents_exchange_device(), which in turn invokes clockevents_switch_state(). But clockevents_switch_state() returns without invoking the device shutdown callback as the device is already in detached state. As a consequence the timer device is not shutdown when a CPU goes offline. tick_shutdown() does this because it was originally invoked on a online CPU and not on the outgoing CPU. It therefore could not access the clockevent device of the already offlined CPU and just set the state. Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so the hardware device can be accessed. Remove the state set before calling clockevents_exchange_device(), so that the subsequent clockevents_switch_state() handles the state transition and invokes the shutdown callback of the clockevent device. [ tglx: Massaged change log ] Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING") Signed-off-by: Bibo Mao Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn commit ae1bdd23b99f64335c69d546bff99ca39b894c18 Author: Rafael J. Wysocki Date: Fri Sep 5 15:53:54 2025 +0200 cpufreq: intel_pstate: Adjust frequency percentage computations Adjust frequency percentage computations in update_cpu_qos_request() to avoid going above the exact numerical percentage in the FREQ_QOS_MAX case. Signed-off-by: Rafael J. Wysocki Acked-by: Zihuan Zhang Link: https://patch.msgid.link/3395556.44csPzL39Z@rafael.j.wysocki [ rjw: Rename "cpu" to "cpudata" and "cpunum" to "cpu" ] Signed-off-by: Rafael J. Wysocki commit f1bbf5bbf254cba0ae3a46cf4c0a9a6257805b79 Author: Rafael J. Wysocki Date: Fri Sep 5 15:52:54 2025 +0200 cpufreq: intel_pstate: Rearrange freq QoS updates using __free() Move the code from the for_each_possible_cpu() loop in update_qos_request() to a separate function and use __free() for cpufreq policy reference counting in it to avoid having to call cpufreq_cpu_put() repeatedly (or using goto). While at it, rename update_qos_request() to update_qos_requests() because it updates multiple requests in one go. No intentional functional impact. Link: https://lore.kernel.org/linux-pm/CAJZ5v0gN1T5woSF0tO=TbAh+2-sWzxFjWyDbB7wG2TFCOU01iQ@mail.gmail.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Zihuan Zhang Link: https://patch.msgid.link/3026597.e9J7NaK4W3@rafael.j.wysocki [ rjw: Rename "cpu" to "cpudata" and "cpunum" to "cpu" in new code ] Signed-off-by: Rafael J. Wysocki commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 Author: Rafael J. Wysocki Date: Fri Sep 5 15:52:03 2025 +0200 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later. Fixes: da5c504c7aae ("cpufreq: intel_pstate: Implement QoS supported freq constraints") Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Zihuan Zhang Link: https://patch.msgid.link/2255671.irdbgypaU6@rafael.j.wysocki commit 3c3af563b31766f67106c7549ad084a08ef613f2 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:16 2025 +0200 hrtimer: Reorder branches in hrtimer_clockid_to_base() Align the ordering to the one used for hrtimer_bases. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-9-3ae822e5bfbd@linutronix.de commit 009eb5da29a91016e3ebb988e6401e79411be7a1 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:15 2025 +0200 hrtimer: Remove hrtimer_clock_base:: Get_time The get_time() callbacks always need to match the bases clockid. Instead of maintaining that association twice in hrtimer_bases, use a helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-8-3ae822e5bfbd@linutronix.de commit cdea7cdae26995992a766443e1ea862923f2443d Author: Thomas Weißschuh Date: Thu Aug 21 15:28:14 2025 +0200 hrtimer: Use hrtimer_cb_get_time() helper Various other helpers contain open-coded implementations of hrtimer_cb_get_time(). This prevents refactoring the implementation. Reuse the existing helper. For this to work, move hrtimer_cb_get_time() a bit up in the file and also make its argument 'const'. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-7-3ae822e5bfbd@linutronix.de commit 44d7fb8acdf833a97669afeeed40cf27eb1dfc24 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:13 2025 +0200 media: pwm-ir-tx: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to an equivalent higher-level helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Acked-by: Sean Young Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-6-3ae822e5bfbd@linutronix.de commit 645e0644300b0dac3cf31527e93e51172455749a Author: Thomas Weißschuh Date: Thu Aug 21 15:28:12 2025 +0200 ALSA: hrtimer: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to the equivalent helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Acked-by: Takashi Iwai Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-5-3ae822e5bfbd@linutronix.de commit e8875795160b484f691938ce07a381e77821f947 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:11 2025 +0200 lib: test_objpool: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to the equivalent helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-4-3ae822e5bfbd@linutronix.de commit b68b7f3e9b50747b88ba211080d27310430c928b Author: Thomas Weißschuh Date: Thu Aug 21 15:28:10 2025 +0200 sched/core: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to the equivalent helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-3-3ae822e5bfbd@linutronix.de commit 5f531fe9cb489bf63f71f6e5eee6420c57fbc049 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:09 2025 +0200 timers/itimer: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to the equivalent helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-2-3ae822e5bfbd@linutronix.de commit 24fb08dcc40f52cf5f95d2cdaa0c26e33a2f4285 Author: Thomas Weißschuh Date: Thu Aug 21 15:28:08 2025 +0200 posix-timers: Avoid direct access to hrtimer clockbase The field timer->base->get_time is a private implementation detail and should not be accessed outside of the hrtimer core. Switch to the equivalent helpers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250821-hrtimer-cleanup-get_time-v2-1-3ae822e5bfbd@linutronix.de commit 88d3671baf4145b806a737f7923df99a53a74737 Author: Peng Fan Date: Thu Sep 4 18:40:45 2025 +0800 firmware: arm_scmi: imx: Discover MISC board info from the system manager The i.MX SCMI MISC protocol can report board information from the System Manager (SM), including a board name and board-specific attributes. Query this during protocol initialization. If the firmware does not implement BOARD_INFO, handle -EOPNOTSUPP gracefully and continue. Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Message-Id: <20250904-sm-misc-api-v1-v4-4-0bf10eaabdf1@nxp.com> Signed-off-by: Sudeep Holla commit b2a0c13f8b4fc3f6c8b279fdc4395a5fa57dda5d Author: Ryan Chen Date: Mon Sep 8 09:18:12 2025 +0800 irqchip/aspeed-scu-ic: Add support for AST2700 SCU interrupt controllers AST2700 continues the multi-instance SCU interrupt controller model introduced in the AST2600, with four independent interrupt domains (scu-ic0 to 3). Unlike earlier generations which combine interrupt enable and status bits into a single register, AST2700 separates these into distinct IER and ISR registers. Support for this layout is implemented by using register offsets and separate chained IRQ handlers. The variant table is extended to cover AST2700 IC instances, enabling shared initialization logic while preserving support for previous SoCs. [ tglx: Simplified the logic and cleaned up coding style ] Signed-off-by: Ryan Chen Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250908011812.1033858-5-ryan_chen@aspeedtech.com commit ed7240444e82aaaa2245a3cc9b040e4db894a665 Author: Ryan Chen Date: Mon Sep 8 09:18:11 2025 +0800 dt-bindings: interrupt-controller: aspeed: Add AST2700 SCU IC compatibles Add compatible strings for the four SCU interrupt controller instances on the AST2700 SoC (scu-ic0 to 3), following the multi-instance model used on AST2600. Also define interrupt indices in the binding header. Signed-off-by: Ryan Chen Signed-off-by: Thomas Gleixner Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/all/20250908011812.1033858-4-ryan_chen@aspeedtech.com commit 23fc2a41a2c67d622d242b670a10ce8f76a7b68e Author: Ryan Chen Date: Mon Sep 8 09:18:10 2025 +0800 dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles Add SCU interrupt controller compatible strings for the AST2700 SoC: scu-ic0 to 3. This extends the MFD binding to support AST2700-based platforms. Signed-off-by: Ryan Chen Signed-off-by: Thomas Gleixner Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/all/20250908011812.1033858-3-ryan_chen@aspeedtech.com commit 86cd4301c285b5e48f6bb0c1b9eb3bfcaf7315a6 Author: Ryan Chen Date: Mon Sep 8 09:18:09 2025 +0800 irqchip/aspeed-scu-ic: Refactor driver to support variant-based initialization The SCU IC driver handles each AST2600 instance with separate initialization functions and hardcoded register definitions, which is inflexible and creates duplicated code. Consolidate the implementation by introducing a variant-based structure, selected via compatible string, and use a unified init path and MMIO access via of_iomap(). This simplifies the code and prepares for upcoming SoCs like AST2700, which require split register handling. [ tglx: Cleaned up coding style and massaged change log ] Signed-off-by: Ryan Chen Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250908011812.1033858-2-ryan_chen@aspeedtech.com commit 26a9f90b6101ea2c9d6f02802cf6d85108104b90 Author: Nathan Chancellor Date: Mon Sep 8 13:04:18 2025 -0700 objtool: Ignore __pi___cfi_ prefixed symbols When building with CONFIG_CFI_CLANG=y after the recent series to separate the x86 startup code, there are objtool warnings along the lines of: vmlinux.o: warning: objtool: __pi___cfi_startup_64_load_idt() falls through to next function __pi_startup_64_load_idt() vmlinux.o: warning: objtool: __pi___cfi_startup_64_setup_gdt_idt() falls through to next function __pi_startup_64_setup_gdt_idt() vmlinux.o: warning: objtool: __pi___cfi___startup_64() falls through to next function __pi___startup_64() As the comment in validate_branch() states, this is expected, so ignore these symbols in the same way that __cfi_ and __pfx_ symbols are already ignored for the rest of the kernel. Fixes: 7b38dec3c5af ("x86/boot: Create a confined code area for startup code") Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Acked-by: Ard Biesheuvel commit a186120c780e21e4cfd186a925e34f718e30de88 Author: Dan Carpenter Date: Mon Sep 8 10:27:45 2025 +0200 irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() Code in gicv5_its_irq_domain_alloc() has two issues: - it checks the wrong return value/variable when calling gicv5_alloc_lpi() - The cleanup code does not take previous loop iterations into account Fix both issues at once by adding the right gicv5_alloc_lpi() variable check and by reworking the function cleanup code to take into account current and previous iterations. [ lpieralisi: Reworded commit message ] Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Signed-off-by: Dan Carpenter Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/all/20250908082745.113718-4-lpieralisi@kernel.org commit bfcd1fdaae92faa8cae880eb4c3aaaa60c54bf0d Author: Dan Carpenter Date: Mon Sep 8 10:27:44 2025 +0200 irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path The "i" variable in gicv5_its_create_itt_two_level() needs to be signed otherwise it can cause a forever loop in the function's cleanup path. [ lpieralisi: Reworded commit message ] Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Signed-off-by: Dan Carpenter Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/all/20250908082745.113718-3-lpieralisi@kernel.org commit 5a5c48e870ed8d8aa9349be625c72f57bde45a4f Author: Dan Carpenter Date: Mon Sep 8 10:27:43 2025 +0200 irqchip/gic-v5: Delete a stray tab Delete a stray tab that is indenting the code erroneously. [ lpieralisi: Reworded commit message] Signed-off-by: Dan Carpenter Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/all/20250908082745.113718-2-lpieralisi@kernel.org commit aeb8d48ea92e6fd50dd4f973fb8778db86fbcc9f Author: Brett A C Sheffield Date: Wed Sep 3 15:46:01 2025 +0000 selftests: net: add test for ipv6 fragmentation Add selftest for the IPv6 fragmentation regression which affected several stable kernels. Commit a18dfa9925b9 ("ipv6: save dontfrag in cork") was backported to stable without some prerequisite commits. This caused a regression when sending IPv6 UDP packets by preventing fragmentation and instead returning -1 (EMSGSIZE). Add selftest to check for this issue by attempting to send a packet larger than the interface MTU. The packet will be fragmented on a working kernel, with sendmsg(2) correctly returning the expected number of bytes sent. When the regression is present, sendmsg returns -1 and sets errno to EMSGSIZE. Link: https://lore.kernel.org/stable/aElivdUXqd1OqgMY@karahi.gladserv.com Signed-off-by: Brett A C Sheffield Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250903154925.13481-1-bacs@librecast.net Signed-off-by: Paolo Abeni commit 52bdd69671b63d5bdac80ed7fdfbad44e915710b Author: Chen Ni Date: Tue Sep 9 14:59:13 2025 +0800 gpio: loongson-64bit: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250909065913.4011133-1-nichen@iscas.ac.cn Signed-off-by: Bartosz Golaszewski commit fd548b77d5ef185138aa6dbc7aafdc44586bd9b5 Author: Michal Wajdeczko Date: Mon Sep 8 14:30:24 2025 +0200 drm/xe/vf: Move VF CCS debugfs attribute The VF CCS handling is per-device so its debugfs file should not be exposed on per-GT basis. Move it up to the device level. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-8-michal.wajdeczko@intel.com commit 55ddca2a3c0d2808293a7b6ae312a7f7c3a6e089 Author: Michal Wajdeczko Date: Mon Sep 8 14:30:23 2025 +0200 drm/xe/vf: Move VF CCS data to xe_device We only need single set of VF CCS contexts, they are not per-tile as initial implementation might suggest. Move all VF CCS data from xe_tile.sriov.vf to xe_device.sriov.vf. Also rename some structs to align with the usage and fix their kernel-doc. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-7-michal.wajdeczko@intel.com commit e69970083438d7d59599f6f5502d8a87902e70b1 Author: Michal Wajdeczko Date: Mon Sep 8 14:30:22 2025 +0200 drm/xe/bo: Add xe_bo_has_valid_ccs_bb helper This will allow as to drop ugly IS_VF_CCS_BB_VALID macro. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-6-michal.wajdeczko@intel.com commit b179dfd0dbedf314f0f1ba5e038282dfe6dd091e Author: Michal Wajdeczko Date: Mon Sep 8 14:30:21 2025 +0200 drm/xe/vf: Use single check when calling VF CCS functions All xe_sriov_vf_ccs() functions but init() expect to be called when initialization was successful and CCS handling is ready. Update IS_VF_CCS_READY macro and use it as single entry guard. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Cc: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-5-michal.wajdeczko@intel.com commit aa8d9d75ea9ba6cb827ff96228b0204783f1d706 Author: Michal Wajdeczko Date: Mon Sep 8 14:30:20 2025 +0200 drm/xe/vf: Drop IS_VF_CCS_INIT_NEEDED macro We only use this macro once and we can open-code it to explicitly show relevant conditions and avoid duplications. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Reviewed-by: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-4-michal.wajdeczko@intel.com commit 4e5bc50ad207bc9849396593e7e4a0984299a3a0 Author: Michal Wajdeczko Date: Mon Sep 8 14:30:19 2025 +0200 drm/xe/guc: Use proper flag definitions when registering context In H2G action context type is specified in flags dword in bits 2:1. Use generic FIELD_PREP macro instead of misleading BIT logic. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250908123025.747-3-michal.wajdeczko@intel.com commit dd432009f19671f3d474f0db437333433cb1a27d Author: Michal Wajdeczko Date: Mon Sep 8 14:30:18 2025 +0200 drm/xe/guc: Rename xe_guc_register_exec_queue This function is dedicated for use by the VFs, we shouldn't use name that might suggests it's general purpose. While there, update asserts to better reflect intended usage. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Cc: Matthew Brost Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250908123025.747-2-michal.wajdeczko@intel.com commit d67ca09ca39f9605459959004b28c56899e3bca3 Author: Hangbin Liu Date: Tue Sep 2 06:55:58 2025 +0000 hsr: use netdev_master_upper_dev_link() when linking lower ports Unlike VLAN devices, HSR changes the lower device’s rx_handler, which prevents the lower device from being attached to another master. Switch to using netdev_master_upper_dev_link() when setting up the lower device. This could improves user experience, since ip link will now display the HSR device as the master for its ports. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250902065558.360927-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit bc4a45f8da56cd02bc6b861b7a1051a7d7665596 Author: Miri Korenblit Date: Tue Sep 9 06:21:28 2025 +0300 wifi: iwlwifi: mld: CHANNEL_SURVEY_NOTIF is always supported This notification is supported in FW since API 100. Since we don't support any API older than that, we don't need to check whether the notification is supported. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.b43f7da0d63b.I7386aeef5fae70dc4b0901cfb650eeaecb4c1575@changeid commit 9a8a37c14f66eba5c75efa524afe7c983c27b477 Author: Miri Korenblit Date: Tue Sep 9 06:21:27 2025 +0300 wifi: iwlwifi: mld: remove support of iwl_esr_mode_notif version 1 The last FW API that supports version 5 is 99. Since this API is no longer supported on any device that loads iwlmld, we can remove support of it. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.e15a7fa15c70.Ibb8636e826136c8c31931e77f5ffa853372b4301@changeid commit 79c0faefefbcf13991825ad0dba7aa2670fa8253 Author: Miri Korenblit Date: Tue Sep 9 06:21:26 2025 +0300 wifi: iwlwifi: mld: remove support from of sta cmd version 1 The last FW API that supports version 1 is 99. Since this API is no longer supported on any device that loads iwlmld, we can remove support of it. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.4d6689d5c4b2.I5d2bf7302eea8ac7a805f58e4e60e527d6f5b346@changeid commit 9175f32e3f9869fd592158ae1a55c11860d7feed Author: Miri Korenblit Date: Tue Sep 9 06:21:25 2025 +0300 wifi: iwlwifi: mld: remove support of roc cmd version 5 The last FW API that supports version 5 is 97. Since this API is no longer supported on any device that loads iwlmld, we can remove support of it. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.e53bd8553360.I6978c216b52b818b879d076a85c5f9edafcf2e99@changeid commit d243f5c112817762582e33c515aeb7c12d6f8146 Author: Miri Korenblit Date: Tue Sep 9 06:21:24 2025 +0300 wifi: iwlwifi: mld: remove support of mac cmd ver 2 The last FW API that supported ver 2 is API 99 (core 96) Since we no longer support it in any device that loads iwlmld, we can remove support of it. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.a56bf370d31a.Ie1e93654ce9ee52e6ae3fda9bc898d611456ec41@changeid commit e5e8d86eb110838b0a06dc41093f8510e10e7d31 Author: Miri Korenblit Date: Tue Sep 9 06:21:23 2025 +0300 wifi: iwlwifi: mld: don't consider phy cmd version 5 It was planed that iwlmld will be loaded also for HR and GF, which has versions < 6. But eventually it was decided to keep use iwlmvm for those devices, so iwlmld doesn't need to support those versions. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.42501c7b0baa.I207ff53d259cc90781a0082320e2646b35925e5f@changeid commit 639401f62962f982168bad050e27a5af3feff31f Author: Rotem Kerem Date: Tue Sep 9 06:21:22 2025 +0300 wifi: iwlwifi: implement wowlan status notification API update Add per key status indication in the WOWLAN status notification. This update is required for fips. Each key entry now includes a status field. Keys are now processed as follows: 0: no key, ignore entry 1: old, use only metadata 2: new, use key material and metadata While at it, fix tid_offloaded_tx error message to print the actual variable being validated in iwl_mld_handle_wowlan_info_notif. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.0a2e7a62504c.Id195c9c83f9f767d1e3e458468af2d933774daa1@changeid commit c5318e6e1c6436ce35ba521d96975e13cc5119f7 Author: Nidhish A N Date: Tue Sep 9 06:21:21 2025 +0300 wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list Add ASUS to the list of OEMs that are allowed to use the PPAG and TAS feature. Signed-off-by: Nidhish A N Reviewed-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.499af6568e89.Iafb2cb1c83ff82712c0e9d5529f76bc226ed12dd@changeid commit 7a7c52645ce62314cdd69815e9d8fcb33e0042d5 Author: Pagadala Yesu Anjaneyulu Date: Tue Sep 9 06:21:20 2025 +0300 wifi: iwlwifi: add kunit tests for nvm parse nvm flags is part of nvm parse. Add test for VLP AP/CLIENT enable/disable scenarios. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.a7a4713fbfee.Ia0caf8865e63b40826c9b66084bd20438554f15c@changeid commit 59cb902371227c2cd7932a565eda97ac7e4707bf Author: Miri Korenblit Date: Tue Sep 9 06:21:19 2025 +0300 wifi: iwlwifi: api: add a flag to iwl_link_ctx_modify_flags Add a new flag which, when set, will indicate that the UHR parameters in the link command have changed. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.b399aebbc384.I8a5a2728e71d92db67d4a4e0f4c358ca7b16ff51@changeid commit 6a5114d8bf7c55788d96e26592b08053e57b9058 Author: Miri Korenblit Date: Tue Sep 9 06:21:18 2025 +0300 wifi: iwlwifi: pcie: move ltr_enabled to the specific transport Currently it is under iwl_trans, which is the bus agnostic part of the transport. But really it is relevant for pcie only, so move it to the iwl_trans_pcie and export it via an API to the opmode. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.9f9dc80ab06c.I3eeca8b17abeba6ed30f0d681518c81ede0acf30@changeid commit 579c6a6e28a18a6bf90667cb93fbdc3e8aee0466 Author: Miri Korenblit Date: Tue Sep 9 06:21:17 2025 +0300 wifi: iwlwifi: pcie: move pm_support to the specific transport Currently it is under iwl_trans, which is the bus agnostic part of the transport. But really it is relevant for pcie only, so move it to the iwl_trans_pcie and export it via an API to the opmode. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.997193cabd04.Ic6648f040430c94150d0fa11601f50a6a630b862@changeid commit da4234c0c4057f2c6dac5e181a6e2759074611fa Author: Miri Korenblit Date: Tue Sep 9 06:21:16 2025 +0300 wifi: iwlwifi: rename iwl_finish_nic_init The function is called so because for older devices it sets a bit called "init_done". But for the latest devices it sets a different bit, "mac_init". Since this name is not clear anyway, rename it such that it indicates the logic of the newer devices. Also add the 'trans' prefix so iw will be clear from the name that this is a transport API. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.a1de688e574b.Ibd41b0c8f7fbae77026e76dbbc085df3eecec538@changeid commit b7a962584f2e98e5fb995dd6497db880c4dd30e9 Author: Rotem Kerem Date: Tue Sep 9 06:21:15 2025 +0300 wifi: iwlwifi: replace SUPPRESS_CMD_ERROR_ONCE status bit with a boolean Convert STATUS_SUPPRESS_CMD_ERROR_ONCE from a status bit to a simple bool field in struct iwl_trans, as atomicity is not needed. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.b33366c11a45.I75aac05afd8c4d8ef217d03327c1a027d6e7667e@changeid commit 728d92a341bd74de0b803b7a0ed8f730832c0b22 Author: Rotem Kerem Date: Tue Sep 9 06:21:14 2025 +0300 wifi: iwlwifi: add STATUS_FW_ERROR API Add iwl_trans_notify_fw_error() and iwl_trans_is_fw_error() for use by op modes. These helpers provide a clean interface for marking and checking firmware error state. This hides the trans internal implementation details from callers. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909061931.23f5160b3265.Iba325ffa4c6c6f7fc3a702fb6c1827b0857d0db3@changeid commit e82bf7570d5ca3667a9038a3c5a42d451b949d89 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:09 2025 +0200 selftests: vDSO: Drop vdso_test_clock_getres vdso_test_abi provides the exact same functionality, properly uses kselftest.h and explicitly calls into the vDSO without relying on the libc. Drop the pointless testcase. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-8-90f499dd35f8@linutronix.de commit 7262aa781fea89cc388335e9c5c6701d8bb13d42 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:08 2025 +0200 selftests: vDSO: vdso_test_abi: Add tests for clock_gettime64() To be y2038-safe, 32-bit userspace needs to explicitly call the 64-bit safe time APIs. For this the 32-bit vDSOs contains a clock_gettime() variant which always uses 64-bit time types. Also test this vDSO function. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-7-90f499dd35f8@linutronix.de commit 7b87dbf9d8465ad437cd7efacc26215b2c189607 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:07 2025 +0200 selftests: vDSO: vdso_test_abi: Test CPUTIME clocks The structure is already there anyways, so test the CPUTIME clocks, too. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-6-90f499dd35f8@linutronix.de commit 74b408ff06c39238edd66350cd0d4057787fc853 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:06 2025 +0200 selftests: vDSO: vdso_test_abi: Use explicit indices for name array The array relies on the numeric values of the clock IDs. When reading the code it is not obvious that the order is correct. Make the code easier to read by using explicit indices. While at it make the array static. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-5-90f499dd35f8@linutronix.de commit d7516f25a90c554d25847634884179d8be2782c7 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:05 2025 +0200 selftests: vDSO: vdso_test_abi: Drop clock availability tests The test uses the kselftest.h framework and declares in its testplan to always execute 16 testcases. If any of the clockids were not available, the testplan would not be satisfied anymore and the test would fail. Apparently that never happened, so the clockids are always available. Remove the pointless checks. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-4-90f499dd35f8@linutronix.de commit 3afe371d322cdebc6338bbc121cca6944b6c7f2d Author: Thomas Weißschuh Date: Tue Aug 12 07:39:04 2025 +0200 selftests: vDSO: vdso_test_abi: Use ksft_finished() The existing logic is just an open-coded ksft_finished(). Replace it with the real thing. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-3-90f499dd35f8@linutronix.de commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:03 2025 +0200 selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO If AT_SYSINFO_EHDR is missing the whole test needs to be skipped. Currently this results in the following output: TAP version 13 1..16 # AT_SYSINFO_EHDR is not present! This output is incorrect, as "1..16" still requires the subtest lines to be printed, which isn't done however. Switch to the correct skipping functions, so the output now correctly indicates that no subtests are being run: TAP version 13 1..0 # SKIP AT_SYSINFO_EHDR is not present! Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 Author: Thomas Weißschuh Date: Tue Aug 12 07:39:02 2025 +0200 selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper The _rval register variable is meant to be an output operand of the asm statement but is instead used as input operand. clang 20.1 notices this and triggers -Wuninitialized warnings: tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized] 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL' 59 | : "r" (_rval) \ | ^~~~~ tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL' 47 | register long _rval asm ("r3"); \ | ^ It seems the list of input and output operands have been switched around. However as the argument registers are not always initialized they can not be marked as pure inputs as that would trigger -Wuninitialized warnings. Adding _rval as another input and output operand does also not work as it would collide with the existing _r3 variable. Instead reuse _r3 for both the argument and the return value. Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc") Reported-by: kernel test robot Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Christophe Leroy Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/ commit c27334aef6f655ec36c868abfd29a253372b2f29 Merge: 389cca2bde7d44 c2377f1763e9ee Author: Paolo Abeni Date: Tue Sep 9 10:56:04 2025 +0200 Merge branch 'bonding-support-aggregator-selection-based-on-port-priority' Hangbin Liu says: ==================== bonding: support aggregator selection based on port priority This patchset introduces a new per-port bonding option: `ad_actor_port_prio`. It allows users to configure the actor's port priority, which can then be used by the bonding driver for aggregator selection based on port priority. This provides finer control over LACP aggregator choice, especially in setups with multiple eligible aggregators over 2 switches. ==================== Link: https://patch.msgid.link/20250902064501.360822-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit c2377f1763e9ee52a2e7c996a748c7cbca255397 Author: Hangbin Liu Date: Tue Sep 2 06:45:01 2025 +0000 selftests: bonding: add test for LACP actor port priority Add comprehensive selftest to verify: - Per-port actor priority setting via ad_actor_port_prio - Aggregator selection behavior with port_priority ad_select policy Also move cmd_jq helper from forwarding/lib.sh to net/lib.sh for broader reusability across network selftests. Here is the result output # ./bond_lacp_prio.sh TEST: bond 802.3ad (ad_actor_port_prio setting) [ OK ] TEST: bond 802.3ad (ad_actor_port_prio select) [ OK ] TEST: bond 802.3ad (ad_actor_port_prio switch) [ OK ] Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250902064501.360822-4-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit e5a6643435fa4ad1e104323ec7d3e6215e2d832c Author: Hangbin Liu Date: Tue Sep 2 06:45:00 2025 +0000 bonding: support aggregator selection based on port priority Add a new ad_select policy 'port_priority' that uses the per-port actor priority values (set via ad_actor_port_prio) to determine aggregator selection. This allows administrators to influence which ports are preferred for aggregation by assigning different priority values, providing more flexible load balancing control in LACP configurations. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250902064501.360822-3-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 6b6dc81ee7e8ca87c71a533e1d69cf96a4f1e986 Author: Hangbin Liu Date: Tue Sep 2 06:44:59 2025 +0000 bonding: add support for per-port LACP actor priority Introduce a new netlink attribute 'actor_port_prio' to allow setting the LACP actor port priority on a per-slave basis. This extends the existing bonding infrastructure to support more granular control over LACP negotiations. The priority value is embedded in LACPDU packets and will be used by subsequent patches to influence aggregator selection policies. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250902064501.360822-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 38b22cde38aba61eafd752c8a2e43e631014e58a Author: Robert Marko Date: Wed Aug 13 19:44:45 2025 +0200 crypto: atmel-aes: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel crypto, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Herbert Xu Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit c0f4f27de468644bbece454ae44a90e1285392c2 Author: Robert Marko Date: Wed Aug 13 19:44:44 2025 +0200 char: hw_random: atmel: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel HWRNG, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit 788da814b2546bb6984fc4d53b45060d96d3f745 Author: Robert Marko Date: Wed Aug 13 19:44:43 2025 +0200 i2c: at91: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel TWI I2C, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Wolfram Sang Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit cb6f687ecf2eecbe2cba7a2706ce6fb1b1b94642 Author: Robert Marko Date: Wed Aug 13 19:44:42 2025 +0200 spi: atmel: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel SPI, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Mark Brown Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit 9fc0a7e0ee896b1b4e66b1ffe38efe2f4af20891 Author: Robert Marko Date: Wed Aug 13 19:44:41 2025 +0200 tty: serial: atmel: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel USART serial, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Greg Kroah-Hartman Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit 452ed5c724038c269518f9df20599ed5134f36d0 Author: Robert Marko Date: Wed Aug 13 19:44:40 2025 +0200 mfd: at91-usart: Make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel USART, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Acked-by: Daniel Machon Acked-by: Lee Jones Signed-off-by: Nicolas Ferre commit e4aae21c9237ce4f05d40dbdda950f9b92acfd37 Author: Thomas Zimmermann Date: Thu Sep 4 14:09:38 2025 +0200 drm/gma500: Do not clear framebuffer GEM objects during cleanup Gma500 unnecessarily clears the framebuffer's GEM-object pointer before calling drm_framebuffer_cleanup(). Remove this code to make gma500 consistent with the rest of the drivers. The change is cosmetic, as drm_framebuffer_cleanup() does not touch the object pointer on gma500. Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://lore.kernel.org/r/20250904121157.395128-1-tzimmermann@suse.de commit ff97bc38be343e4530e2f140b40cbdce2e09152f Author: Carolina Jubran Date: Wed Sep 3 10:30:00 2025 +0300 net/mlx5: Add RS FEC histogram infrastructure Define the Ports Phy Histogram Configuration Register (PPHCR) to expose RS-FEC histogram bin ranges, and expose a new counter group in the Ports Performance Counters Register (PPCNT) to report the corresponding histogram values. Co-developed-by: Yael Chemla Signed-off-by: Yael Chemla Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1756884600-520195-1-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 389cca2bde7d44f9d681eb5b4065ec6b25b9138f Merge: 9f0730b063b436 a3fb485505caea Author: Paolo Abeni Date: Tue Sep 9 09:33:26 2025 +0200 Merge branch 'support-exposing-raw-cycle-counters-in-ptp-and-mlx5' Tariq Toukan says: ==================== Support exposing raw cycle counters in PTP and mlx5 This series by Carolina adds support in ptp and usage in mlx5 for exposing the raw free-running cycle counter of PTP hardware clocks. This is V2. Find previous one here: https://lore.kernel.org/all/1752556533-39218-1-git-send-email-tariqt@nvidia.com/ Find detailed description by Carolina below [1]. [1] This patch series introduces support for exposing the raw free-running cycle counter of PTP hardware clocks. When the device is in free-running mode, it emits timestamps as raw cycle values instead of nanoseconds. These values may be passed directly to user space through: - fwctl: exposes internal device event records that include raw cycle-based timestamps. - DPDK: retrieves CQEs that contain raw cycle counters, which are passed to user space unmodified. To address this, the series introduces two new ioctl commands that allow userspace to query the device's raw cycle counter together with host time: - PTP_SYS_OFFSET_PRECISE_CYCLES - PTP_SYS_OFFSET_EXTENDED_CYCLES These commands work like their existing counterparts but return the device timestamp in cycle units instead of real-time nanoseconds. This allows user space to collect (cycle, time) pairs and build a mapping between the device’s free-running clock and host time. This can also be useful in the XDP fast path: if a driver inserts the raw cycle value into metadata instead of a real-time timestamp, it can avoid the overhead of converting cycles to time in the kernel. Then userspace can resolve the cycle-to-time mapping using this ioctl when needed. The ioctl enables user space to correlate those with host time, without requiring the PHC to be synchronized, so long as the drift remains stable during collection. Adds the new PTP ioctls and integrates support in ptp_ioctl(): - ptp: Add ioctl commands to expose raw cycle counter values Support for exposing raw cycles in mlx5: - net/mlx5: Extract MTCTR register read logic into helper function - net/mlx5: Support getcyclesx and getcrosscycles ==================== Link: https://patch.msgid.link/1755008228-88881-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit a3fb485505caeadb559029900f5f37a332ae54e0 Author: Carolina Jubran Date: Tue Aug 12 17:17:08 2025 +0300 net/mlx5: Support getcyclesx and getcrosscycles Implement the getcyclesx64 and getcrosscycles callbacks in ptp_info to expose the device’s raw free-running counter. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1755008228-88881-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 96c345c3c54c31abf8ba04c241b8fe26fa0ab022 Author: Carolina Jubran Date: Tue Aug 12 17:17:07 2025 +0300 net/mlx5: Extract MTCTR register read logic into helper function Refactor the MTCTR register reading logic into a dedicated helper to lay the groundwork for the next patch. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1755008228-88881-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit faf23f54d366467bb449a7b2c39b382db9f92e80 Author: Carolina Jubran Date: Tue Aug 12 17:17:06 2025 +0300 ptp: Add ioctl commands to expose raw cycle counter values Introduce two new ioctl commands, PTP_SYS_OFFSET_PRECISE_CYCLES and PTP_SYS_OFFSET_EXTENDED_CYCLES, to allow user space to access the raw free-running cycle counter from PTP devices. These ioctls are variants of the existing PRECISE and EXTENDED offset queries, but instead of returning device time in realtime, they return the raw cycle counter value. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Acked-by: Richard Cochran Link: https://patch.msgid.link/1755008228-88881-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit f770c3d858687252f1270265ba152d5c622e793f Author: Lukas Wunner Date: Thu Sep 4 15:11:09 2025 +0200 xen/manage: Fix suspend error path The device power management API has the following asymmetry: * dpm_suspend_start() does not clean up on failure (it requires a call to dpm_resume_end()) * dpm_suspend_end() does clean up on failure (it does not require a call to dpm_resume_start()) The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related patches for 2.6.27") in June 2008: It removed a call to device_resume() from device_suspend() (which was later renamed to dpm_suspend_start()). When Xen began using the device power management API in May 2008 with commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did not yet exist. But since it was introduced, a call to dpm_resume_end() is missing in the error path of dpm_suspend_start(). Fix it. Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v2.6.27 Reviewed-by: "Rafael J. Wysocki (Intel)" Signed-off-by: Juergen Gross Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de> commit 3fcc8e146935415d69ffabb5df40ecf50e106131 Author: Jason Andryuk Date: Wed Aug 27 20:36:03 2025 -0400 xen/events: Update virq_to_irq on migration VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs are tracked in per-cpu virq_to_irq arrays. Per-domain and global VIRQs must be bound on CPU 0, and bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time Later, the interrupt can migrate, and info->cpu is updated. When calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a different cpu. If bind_virq_to_irq() is called again with CPU 0, the stale irq is returned. There won't be any irq_info for the irq, so things break. Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings to keep them update to date with the current cpu. This ensures the correct virq_to_irq is cleared in __unbind_from_irq(). Fixes: e46cdb66c8fc ("xen: event channels") Cc: stable@vger.kernel.org Signed-off-by: Jason Andryuk Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250828003604.8949-4-jason.andryuk@amd.com> commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e Author: Jason Andryuk Date: Wed Aug 27 20:36:02 2025 -0400 xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in. Cc: stable@vger.kernel.org Signed-off-by: Jason Andryuk Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250828003604.8949-3-jason.andryuk@amd.com> commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a Author: Jason Andryuk Date: Wed Aug 27 20:36:01 2025 -0400 xen/events: Cleanup find_virq() return codes rc is overwritten by the evtchn_status hypercall in each iteration, so the return value will be whatever the last iteration is. This could incorrectly return success even if the event channel was not found. Change to an explicit -ENOENT for an un-found virq and return 0 on a successful match. Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports") Cc: stable@vger.kernel.org Signed-off-by: Jason Andryuk Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com> commit 7095d688de38de197c408f8904cf1c1d8b257dae Author: Baojun Xu Date: Sat Aug 30 14:14:59 2025 +0800 ASoC: tas2781: Add tas2118, tas2x20, tas5825 support Update ti,tas2781.yaml for adding tas2118, tas2x20, tas257x and tas582x. Signed-off-by: Baojun Xu Reviewed-by: Rob Herring (Arm) Signed-off-by: Takashi Iwai commit 7ceb69ca82b1456a66783a1472d6e677e00065a1 Author: Baojun Xu Date: Sat Aug 30 14:14:58 2025 +0800 ASoC: tas2781: Add tas2118, tas2x20, tas5825 support Add tas2020, tas2118, tas2120, tas2320, tas2570, tas2572, tas5825 tas5827 support in tas2781 driver. Tas2118, tas2x20, tas257x have no on-chip DSP, tas582x have on-chip DSP but have no calibration required stereo smart amplifier. Signed-off-by: Baojun Xu Acked-by: Mark Brown Signed-off-by: Takashi Iwai commit f985e105ced10304abd3b2d822994b87c88145f8 Author: Jani Nikula Date: Wed Sep 3 12:04:08 2025 +0300 drm/i915/display: add intel_display_device_present() Add a proper function for display && HAS_DISPLAY(display) to hide indirect struct intel_display access via the macro from a number of places outside of display. This makes struct intel_display * an opaque pointer in these places. All HAS_DISPLAY() usage is now constrained within display. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250903090408.3492875-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit d0236266cbfe12284e05c51f2cd7ec150a23d9f0 Author: Chao Yu Date: Tue Sep 2 20:27:20 2025 +0800 f2fs: clean up error handing of f2fs_submit_page_read() Below two functions should never fail, clean up error handling in their callers: 1) f2fs_grab_read_bio() in f2fs_submit_page_read() 2) bio_add_folio() in f2fs_submit_page_read() Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2f84e99d61946eb2d17bf97c41362ac9a7473008 Author: Chao Yu Date: Tue Sep 2 20:27:19 2025 +0800 f2fs: avoid unnecessary folio_clear_uptodate() for cleanup In error path of __get_node_folio(), if the folio is not uptodate, let's avoid unnecessary folio_clear_uptodate() for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 44749759d5e61479f747f2f5471b161861172aaf Author: Jaegeuk Kim Date: Thu Sep 4 18:08:08 2025 +0000 f2fs: merge FUA command with the existing writes FUA writes can be merged to the existing write IOs. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 01c7344e21c2140e72282d9d16d79a61f840fc20 Author: Junjie Cao Date: Thu Aug 14 14:06:05 2025 +0800 lkdtm: fortify: Fix potential NULL dereference on kmalloc failure Add missing NULL pointer checks after kmalloc() calls in lkdtm_FORTIFY_STR_MEMBER() and lkdtm_FORTIFY_MEM_MEMBER() functions. Signed-off-by: Junjie Cao Link: https://lore.kernel.org/r/20250814060605.5264-1-junjie.cao@intel.com Signed-off-by: Kees Cook commit 854c0dc80e25a408ecf7cf27661c28b8c10c291e Author: Suraj Kandpal Date: Thu Sep 4 10:18:04 2025 +0530 drm/i915/backlight: Disable backlight when using luminance control We just return when using luminance control instead we should be calling the disable helper to get everything cleaned up properly by default. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250904044804.948391-1-suraj.kandpal@intel.com commit 17002412a82feb21be040bd5577789049dfeebe2 Author: Zenm Chen Date: Thu Sep 4 06:31:00 2025 +0800 wifi: rtw89: Add USB ID 2001:3327 for D-Link AX18U rev. A1 Add USB ID 2001:3327 for D-Link AX18U rev. A1 which is a RTL8832BU-based Wi-Fi adapter. Link: https://github.com/morrownr/rtw89/pull/17 Signed-off-by: Zenm Chen Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250903223100.3031-1-zenmchen@gmail.com commit 2ffc73cdb8247dc09b6534c4018681a126c1d5f5 Author: Zenm Chen Date: Tue Sep 2 11:57:55 2025 +0800 wifi: rtw89: Add USB ID 2001:332a for D-Link AX9U rev. A1 Add USB ID 2001:332a for D-Link AX9U rev. A1 which is a RTL8851BU-based Wi-Fi adapter. Only managed mode and AP mode are tested and it works in both. Signed-off-by: Zenm Chen Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250902035755.1969530-1-zenmchen@gmail.com commit 00afddfe4c995efc2fd46ad13a67a764cca597e4 Author: Martin Kaistra Date: Mon Sep 1 14:16:13 2025 +0200 wifi: rtl8xxxu: expose efuse via debugfs The efuse contains the mac address and calibration data. During manufacturing and testing it can be necessary to read and check this data. Add a debugfs interface to make it available to userspace. Signed-off-by: Martin Kaistra Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250901121613.1876109-1-martin.kaistra@linutronix.de commit 9f0730b063b436938ebb6371aecb12ec6ed896e9 Author: Håkon Bugge Date: Fri Sep 5 12:19:57 2025 +0200 rds: ib: Remove unused extern definition In the old days, RDS used FMR (Fast Memory Registration) to register IB MRs to be used by RDMA. A newer and better verbs based registration/de-registration method called FRWR (Fast Registration Work Request) was added to RDS by commit 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode") in 2016. Detection and enablement of FRWR was done in commit 2cb2912d6563 ("RDS: IB: add Fastreg MR (FRMR) detection support"). But said commit added an extern bool prefer_frmr, which was not used by said commit - nor used by later commits. Hence, remove it. Signed-off-by: Håkon Bugge Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250905101958.4028647-1-haakon.bugge@oracle.com Signed-off-by: Jakub Kicinski commit 6e0cca6ba3425f992dd6ad5049c47005dcb18ad8 Merge: 144d0b1c45ea38 fc8f62c827ead7 Author: Jakub Kicinski Date: Mon Sep 8 18:12:10 2025 -0700 Merge branch 'net-stmmac-mdio-cleanups' Russell King says: ==================== net: stmmac: mdio cleanups Clean up the stmmac MDIO code: - provide an address register formatter to avoid repeated code - provide a common function to wait for the busy bit to clear - pre-compute the CR field (mdio clock divider) - move address formatter into read/write functions - combine the read/write functions into a common accessor function - move runtime PM handling into common accessor function - rename register constants to better reflect manufacturer names - move stmmac_clk_csr_set() into stmmac_mdio - make stmmac_clk_csr_set() return the CR field value and remove priv->clk_csr - clean up if() range tests in stmmac_clk_csr_set() - use STMMAC_CSR_xxx definitions in initialisers For Qualcomm QCS9100 Ride R3 board with the AQR115C PHY: Tested-by: Mohd Ayaan Anwar ==================== Link: https://patch.msgid.link/aLmBwsMdW__XBv7g@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fc8f62c827ead74ec6bdf76bc78993e9402968ee Author: Russell King (Oracle) Date: Thu Sep 4 13:11:51 2025 +0100 net: stmmac: use STMMAC_CSR_xxx definitions in platform glue Use the STMMAC_CSR_xxx definitions to initialise plat->clk_csr in the platform glue drivers to make the integer values meaningful. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oh-00000001vpT-0vk2@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 78c91bec8fb977cd509e873f9ef6cb74cfdcbe57 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:46 2025 +0100 net: stmmac: mdio: remove redundant clock rate tests The pattern: ... if (v < A) ... else if (v >= A && v < B) ... can be simplified to: ... if (v < A) ... else if (v < B) ... which makes the string of ifelse more readable. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oc-00000001vpN-0S1A@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 231e2b016fb24ba77009811e2feaf2d2ebe0639b Author: Russell King (Oracle) Date: Thu Sep 4 13:11:40 2025 +0100 net: stmmac: mdio: return clk_csr value from stmmac_clk_csr_set() Return the clk_csr value from stmmac_clk_csr_set() rather than using priv->clk_csr, as this struct member now serves very little purpose. This allows us to remove priv->clk_csr. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oW-00000001vpH-46zf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 661a868937a1cf73bd2de3688394ad2597960991 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:35 2025 +0100 net: stmmac: mdio: move initialisation of priv->clk_csr to stmmac_mdio The only user of priv->clk_csr is the MDIO code, so move its initialisation to stmmac_mdio.c. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oR-00000001vpB-3fbY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3581acbb789ac5539ff771f3af67f8cbc9223ea9 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:30 2025 +0100 net: stmmac: mdio: improve mdio register field definitions Include the register name in the definitions, and use a name which more closely resembles that used in documentation, while still being descriptive. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oM-00000001vp4-3DC5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9b88194a3b68ee8b818d917eac20e5e2f7803ecf Author: Russell King (Oracle) Date: Thu Sep 4 13:11:25 2025 +0100 net: stmmac: mdio: move runtime PM into stmmac_mdio_access() Move the runtime PM handling into the common stmmac_mdio_access() function, rather than having it in the four top-level bus access functions. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oH-00000001voy-2jfU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9b0ed33a4256af56bcb89b575468a7c3b1e5c267 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:20 2025 +0100 net: stmmac: mdio: merge stmmac_mdio_read() and stmmac_mdio_write() stmmac_mdio_read() and stmmac_mdio_write() are virtually identical except for the final read in the stmmac_mdio_read(). Handle this as a flag. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8oC-00000001vos-2JnA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6cb3d67ad624de8c4ef2844386d7e37ccb9042b9 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:15 2025 +0100 net: stmmac: mdio: move stmmac_mdio_format_addr() into read/write Move stmmac_mdio_format_addr() into stmmac_mdio_read() and stmmac_mdio_write(). Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8o7-00000001vom-1pN8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6717746f33abcd12a64f4cf609af19acb3e529ba Author: Russell King (Oracle) Date: Thu Sep 4 13:11:10 2025 +0100 net: stmmac: mdio: provide priv->gmii_address_bus_config Provide a pre-formatted value for the MDIO address register fields which remain constant across the various different transactions rather than recreating the register value from scratch every time. Currently, we only do this for the CR (clock range) field. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8o2-00000001vog-1LyK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9eb633ad1d69930e7ddc9d86bdc30700e2b794eb Author: Russell King (Oracle) Date: Thu Sep 4 13:11:05 2025 +0100 net: stmmac: mdio: provide stmmac_mdio_wait() All the readl_poll_timeout()s follow the same pattern - test a register for a bit being clear every 100us, and timeout after 10ms returning -EBUSY. Wrap this up into a function to avoid duplicating this. This slightly changes the return value for stmmac_mdio_write() if the second readl_poll_timeout() fails - rather than returning -ETIMEDOUT we return -EBUSY matching the stmmac_mdio_read() behaviour. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8nx-00000001voa-0tJ0@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 16e03235d51b016cbb9b2265b77f041b57b1ed54 Author: Russell King (Oracle) Date: Thu Sep 4 13:11:00 2025 +0100 net: stmmac: mdio: provide address register formatter Rather than duplicating the logic for filling the PA (MDIO address), GR (MDIO register/devad), CR (clock range) and GB (busy) fields of the address register in four locations, provide a helper to do this. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1uu8ns-00000001voU-0S7b@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 144d0b1c45ea382c9ff6d7d9c6dfe609ae1ef169 Merge: abcf9f662bc7ec 20d3d26815441d Author: Jakub Kicinski Date: Mon Sep 8 18:06:24 2025 -0700 Merge branch 'ipv6-snmp-avoid-performance-issue-with-ratelimithost' Eric Dumazet says: ==================== ipv6: snmp: avoid performance issue with RATELIMITHOST Addition of ICMP6_MIB_RATELIMITHOST in commit d0941130c9351 ("icmp: Add counters for rate limits") introduced a performance drop in case of DOS (like receiving UDP packets to closed ports). Per netns ICMP6_MIB_RATELIMITHOST tracking uses per-cpu storage and is enough, we do not need per-device and slow tracking for this metric. In v2 of this series, I completed the removal of SNMP_MIB_SENTINEL in all the kernel for consistency. v1: https://lore.kernel.org/20250904092432.113c4940@kernel.org ==================== Link: https://patch.msgid.link/20250905165813.1470708-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 20d3d26815441d03a9a15114729faaa54957baba Author: Eric Dumazet Date: Fri Sep 5 16:58:13 2025 +0000 net: snmp: remove SNMP_MIB_SENTINEL No more user of SNMP_MIB_SENTINEL, we can remove it. Also remove snmp_get_cpu_field[64]_batch() helpers. Signed-off-by: Eric Dumazet Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-10-edumazet@google.com Signed-off-by: Jakub Kicinski commit c73d583e7008336b1fa53275fa3f65aaaba00e6e Author: Eric Dumazet Date: Fri Sep 5 16:58:12 2025 +0000 xfrm: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Signed-off-by: Eric Dumazet Cc: Steffen Klassert Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3a951f95202cfc189f5dd285bbc177dfbe19389d Author: Eric Dumazet Date: Fri Sep 5 16:58:11 2025 +0000 tls: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Signed-off-by: Eric Dumazet Cc: John Fastabend Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 52a33cae6a6faf17345d1b570ecf1f669f7d9648 Author: Eric Dumazet Date: Fri Sep 5 16:58:10 2025 +0000 sctp: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Signed-off-by: Eric Dumazet Cc: Marcelo Ricardo Leitner Reviewed-by: Sabrina Dubroca Acked-by: Xin Long Link: https://patch.msgid.link/20250905165813.1470708-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 35cb2da0abafe148fbb592063259978cdba29c6c Author: Eric Dumazet Date: Fri Sep 5 16:58:09 2025 +0000 mptcp: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Signed-off-by: Eric Dumazet Cc: Mat Martineau Cc: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250905165813.1470708-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit b7b74953f8343ceca86df694322440104110c146 Author: Eric Dumazet Date: Fri Sep 5 16:58:08 2025 +0000 ipv4: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Signed-off-by: Eric Dumazet Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2fab94bcf313480336b0a41eb45a24ffd5087490 Author: Eric Dumazet Date: Fri Sep 5 16:58:07 2025 +0000 ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST Blamed commit added a critical false sharing on a single atomic_long_t under DOS, like receiving UDP packets to closed ports. Per netns ICMP6_MIB_RATELIMITHOST tracking uses per-cpu storage and is enough, we do not need per-device and slow tracking. Fixes: d0941130c9351 ("icmp: Add counters for rate limits") Signed-off-by: Eric Dumazet Cc: Jamie Bainbridge Cc: Abhishek Rawal Link: https://patch.msgid.link/20250905165813.1470708-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit ceac1fb2290d230eb83aff3761058c559440de13 Author: Eric Dumazet Date: Fri Sep 5 16:58:06 2025 +0000 ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore Use ARRAY_SIZE(), so that we know the limit at compile time. Following patch needs this preliminary change. Signed-off-by: Eric Dumazet Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit b7fe8c1be776baa1bec587499e989395c0aee8ef Author: Eric Dumazet Date: Fri Sep 5 16:58:05 2025 +0000 ipv6: snmp: remove icmp6type2name[] This 2KB array can be replaced by a switch() to save space. Before: $ size net/ipv6/proc.o text data bss dec hex filename 6410 624 0 7034 1b7a net/ipv6/proc.o After: $ size net/ipv6/proc.o text data bss dec hex filename 5516 592 0 6108 17dc net/ipv6/proc.o Signed-off-by: Eric Dumazet Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250905165813.1470708-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit bc3f7d0340f7cf32b53e40aeed25ac0c6a0e77e7 Author: Fabio Estevam Date: Sun Sep 7 12:25:13 2025 -0300 dt-bindings: arm: cpus: Document pu-supply The i.MX6Q Reference Manual describes the three digital LDO regulators as follows: "10.4.1.1.1 Digital LDO Regulators The integrated PMU includes three digital LDO regulators: LDO_ARM, LDO_PU, and LDO_SOC. These regulators provide power to the ARM_Core power domain, the combined VPU, IPU and GPU power domain, and the rest of the SoC logic (except always-ON SNVS domain)." imx6dl.dtsi uses the correct names to describe these supplies: arm-supply = <®_arm>; pu-supply = <®_pu>; soc-supply = <®_soc>; 'arm-supply' and 'soc-supply' are already documented, but 'pu-supply' is not. Document the 'pu-supply' property and set it to deprecated. This fixes the following dt-schema warning: cpu@1 (arm,cortex-a9): Unevaluated properties are not allowed ('pu-supply' was unexpected) Signed-off-by: Fabio Estevam Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250907152513.590218-1-festevam@gmail.com Signed-off-by: Rob Herring (Arm) commit abcf9f662bc7ec72b3591d785eccd7dd8c239365 Author: Alok Tiwari Date: Fri Sep 5 09:33:49 2025 -0700 ixgbe: fix typo in function comment for ixgbe_get_num_per_func() Correct a typo in the comment where "PH" was used instead of "PF". The function returns the number of resources per PF or 0 if no PFs are available. Signed-off-by: Alok Tiwari Signed-off-by: Qiang Liu Reviewed-by: Aleksandr Loktionov Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250905163353.3031910-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit bd64723327e33758803f3b6105f4ef0a1e6cebe0 Author: Alok Tiwari Date: Fri Sep 5 09:50:03 2025 -0700 net: mctp: fix typo in comment Correct a typo in af_mctp.c: "fist" -> "first". Signed-off-by: Alok Tiwari Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20250905165006.3032472-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit cc2ec444e461b6ca2bc73cd7cbd06aaf15bdfa1a Author: Marco Crivellari Date: Fri Sep 5 11:06:41 2025 +0200 power: supply: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20250905090641.106297-3-marco.crivellari@suse.com Signed-off-by: Sebastian Reichel commit c4a7748b551e5a06fe9a3862001192b1b5cfe195 Author: Marco Crivellari Date: Fri Sep 5 11:06:40 2025 +0200 power: supply: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20250905090641.106297-2-marco.crivellari@suse.com [rebased patch to cover recent changes] Signed-off-by: Sebastian Reichel commit 7d715345a86941b9e6c8e520b40078692baed4a4 Author: Christophe JAILLET Date: Mon Sep 8 21:35:28 2025 +0200 power: supply: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. As an example: Before: ====== text data bss dec hex filename 35803 9352 384 45539 b1e3 drivers/power/supply/rt9467-charger.o After: ===== text data bss dec hex filename 34792 9008 384 44184 ac98 drivers/power/supply/rt9467-charger.o Signed-off-by: Christophe JAILLET Signed-off-by: Sebastian Reichel commit 2d0ddbb65cef99aab241378b0f4ff2d6ea8c3a5a Author: Michael Kelley Date: Sun Aug 31 09:04:06 2025 -0700 Drivers: hv: Simplify data structures for VMBus channel close message struct vmbus_close_msg is used for sending the VMBus channel close message. It contains a struct vmbus_channel_msginfo, which has a flex array member at the end. The latter's presence in the middle of struct vmbus_close_msg causes warnings when built with -Wflex-array-member-not-at-end. But the struct vmbus_channel_msginfo is unused because the Hyper-V host does not send a response to the channel close message. So remove the struct vmbus_channel_msginfo. Then, since the only remaining field is struct vmbus_channel_close_channel, also remove the containing struct vmbus_close_msg and directly use struct vmbus_channel_close_channel. Besides eliminating unnecessary complexity, these changes resolve the -Wflex-array-member-not-at-end warnings. Signed-off-by: Michael Kelley Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit ac7b0a5cd331862c3d4d49eae71ed93f8f5082f3 Author: Abhishek Tiwari Date: Mon Sep 1 05:00:00 2025 -0700 Drivers: hv: util: Cosmetic changes for hv_utils_transport.c Fix issues reported by checkpatch.pl script for hv_utils_transport.c file - Update pr_warn() calls to use __func__ for consistent logging context. - else should follow close brace '}' No functional changes intended. Signed-off-by: Abhishek Tiwari Reviewed-by: Naman Jain Signed-off-by: Wei Liu commit f26c9306dff818bbf4ef545c5a5ee0eca7149922 Author: Nuno Das Neves Date: Tue Sep 2 16:48:33 2025 -0700 mshv: Add support for a new parent partition configuration Detect booting as an "L1VH" partition. This is a new scenario very similar to root partition where the mshv_root driver can be used to create and manage guest partitions. It mostly works the same as root partition, but there are some differences in how various features are handled. hv_l1vh_partition() is introduced to handle these cases. Add hv_parent_partition() which returns true for either case, replacing some hv_root_partition() checks. Signed-off-by: Nuno Das Neves Acked-by: Wei Liu Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 47691ced158ab3a7ce2189b857b19c0c99a9aa80 Author: Wei Liu Date: Tue Aug 12 19:48:45 2025 +0000 clocksource: hyper-v: Skip unnecessary checks for the root partition The HV_ACCESS_TSC_INVARIANT bit is always zero when Linux runs as the root partition. The root partition will see directly what the hardware provides. The old logic in ms_hyperv_init_platform caused the native TSC clock source to be incorrectly marked as unstable on x86. Fix it. Skip the unnecessary checks in code for the root partition. Add one extra comment in code to clarify the behavior. Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 4cd661c248b6671914ad59e16760bb6d908dfc61 Author: Nuno Das Neves Date: Wed Aug 13 11:20:57 2025 -0700 hyperv: Add missing field to hv_output_map_device_interrupt This field is unused, but the correct structure size is needed when computing the amount of space for the output argument to reside, so that it does not cross a page boundary. Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 95719dfa323709c06ec34cc96e73e0788e19934f Author: Kees Cook Date: Mon Aug 4 09:44:13 2025 -0700 KUnit: ffs: Validate all the __attribute_const__ annotations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute_const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Validate all the __attibute_const__ annotations were found for all architectures by reproducing the specific problem encountered in the original bug report. Build and run tested with everything I could reach with KUnit: $ ./tools/testing/kunit/kunit.py run --arch=x86_64 ffs $ ./tools/testing/kunit/kunit.py run --arch=i386 ffs $ ./tools/testing/kunit/kunit.py run --arch=arm64 --make_options "CROSS_COMPILE=aarch64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=arm --make_options "CROSS_COMPILE=arm-linux-gnueabi-" ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpc ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpc32 ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpcle ffs $ ./tools/testing/kunit/kunit.py run --arch=m68k ffs $ ./tools/testing/kunit/kunit.py run --arch=loongarch ffs $ ./tools/testing/kunit/kunit.py run --arch=s390 --make_options "CROSS_COMPILE=s390x-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=riscv --make_options "CROSS_COMPILE=riscv64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=riscv32 --make_options "CROSS_COMPILE=riscv64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sparc --make_options "CROSS_COMPILE=sparc64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sparc64 --make_options "CROSS_COMPILE=sparc64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=alpha --make_options "CROSS_COMPILE=alpha-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sh --make_options "CROSS_COMPILE=sh4-linux-gnu-" ffs Closes: https://github.com/KSPP/linux/issues/364 Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-17-kees@kernel.org Signed-off-by: Kees Cook commit 07008b9c1cb8cbeb1741c55729639836dccd4a8f Author: Kees Cook Date: Mon Aug 4 09:44:12 2025 -0700 sparc: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to sparc64's implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=sparc defconfig with GCC sparc64-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-16-kees@kernel.org Signed-off-by: Kees Cook commit 945fc9dbd8377e48246de3a5f0104ebe82399eb0 Author: Kees Cook Date: Mon Aug 4 09:44:11 2025 -0700 xtensa: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to Xtensa's implementations of ffs(), __ffs(), fls(), __fls(), ffz() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=xtensa defconfig with GCC xtensa-linux 15.1.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-15-kees@kernel.org Signed-off-by: Kees Cook commit b77fee88bfdfcba2f92c9de2ed1af793c96c46d8 Author: Kees Cook Date: Mon Aug 4 09:44:10 2025 -0700 s390: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to S390's implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=s390 defconfig with GCC s390x-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Heiko Carstens Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-14-kees@kernel.org Signed-off-by: Kees Cook commit 28fc0972e392ed3cfa579f3e3659d615cbac647b Author: Kees Cook Date: Mon Aug 4 09:44:09 2025 -0700 parisc: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to PARISC's implementations of ffs(), __ffs(), and fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=parisc defconfig with GCC hppa-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Helge Deller Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-13-kees@kernel.org Signed-off-by: Kees Cook commit 32913fe7f71e72fb49033df35ec6388ff7b170ff Author: Kees Cook Date: Mon Aug 4 09:44:08 2025 -0700 mips: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to MIPS's implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=mips defconfig with GCC mipsel-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-12-kees@kernel.org Signed-off-by: Kees Cook commit 50c869a6cecabb522f157fa6cc41bca2eb8aecb4 Author: Kees Cook Date: Mon Aug 4 09:44:07 2025 -0700 m68k: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to M68K's implementations of ffs(), __ffs(), fls(), __fls(), and ffz() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=m68k defconfig with GCC m68k-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-11-kees@kernel.org Signed-off-by: Kees Cook commit acfab97bef41324e72784fcfdb6ce7996a8bf548 Author: Kees Cook Date: Mon Aug 4 09:44:06 2025 -0700 openrisc: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to OpenRISC's implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=openrisc defconfig with GCC or1k-linux 15.1.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Stafford Horne Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-10-kees@kernel.org Signed-off-by: Kees Cook commit c51c26e687a649df9a792f71759105e12e5d082f Author: Kees Cook Date: Mon Aug 4 09:44:05 2025 -0700 riscv: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to RISC-V's implementations of variable__ffs(), variable__fls(), and variable_ffs() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=riscv defconfig with GCC riscv64-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Tested-by: Alexandre Ghiti Acked-by: Alexandre Ghiti Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-9-kees@kernel.org Signed-off-by: Kees Cook commit 799776f3360d7505be25adb0d06e28b183c8ad70 Author: Kees Cook Date: Mon Aug 4 09:44:04 2025 -0700 hexagon: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to Hexagon's implementations of fls(), ffs(), __ffs(), __fls(), and ffz() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=hexagon defconfig with Clang 21.0.0git (LLVM=1). Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-8-kees@kernel.org Signed-off-by: Kees Cook commit a8d060ddeed52b4e4d0264b34353f025c421e4b9 Author: Kees Cook Date: Mon Aug 4 09:44:03 2025 -0700 alpha: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to Alpha's implementations of __ffs(), ffs(), fls64(), __fls(), fls(), and ffz() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=alpha defconfig with GCC alpha-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-7-kees@kernel.org Signed-off-by: Kees Cook commit 4251f58f620716163575d6b6f7e6a10d43fb5ca5 Author: Kees Cook Date: Mon Aug 4 09:44:02 2025 -0700 sh: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to SH's implementations of __ffs() and ffz() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=sh defconfig with GCC sh4-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-6-kees@kernel.org Signed-off-by: Kees Cook commit 69057d3db759cc260aee4ab189b76ae91fbc18f9 Author: Kees Cook Date: Mon Aug 4 09:44:01 2025 -0700 powerpc: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to PowerPC's implementations of fls() function. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=powerpc defconfig with GCC powerpc-linux-gnu 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Madhavan Srinivasan Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-5-kees@kernel.org Signed-off-by: Kees Cook commit fca08b748d1773dd9743abc063379664986e276d Author: Kees Cook Date: Mon Aug 4 09:44:00 2025 -0700 x86: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to x86's implementations of variable__ffs(), variable_ffz(), __fls(), variable_ffs(), and fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=x86_64 defconfig with GCC gcc 14.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-4-kees@kernel.org Signed-off-by: Kees Cook commit 4452a0dfc5bddf4df3a945d2e9ecb201d52d164a Author: Kees Cook Date: Mon Aug 4 09:43:59 2025 -0700 csky: Add __attribute_const__ to ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to C-SKY's implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested ARCH=csky defconfig with GCC csky-linux 15.1.0. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-3-kees@kernel.org Signed-off-by: Kees Cook commit 6606c8c7e81886565f5cbdb0c0ce82e280c2b229 Author: Kees Cook Date: Mon Aug 4 09:43:58 2025 -0700 bitops: Add __attribute_const__ to generic ffs()-family implementations While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). Add missing __attribute_const__ annotations to generic implementations of ffs(), __ffs(), fls(), and __fls() functions. These are pure mathematical functions that always return the same result for the same input with no side effects, making them eligible for compiler optimization. Build tested with x86_64 defconfig using GCC 14.2.0, which should validate the implementations when used by ARM, ARM64, LoongArch, Microblaze, NIOS2, and SPARC32 architectures. Link: https://github.com/KSPP/linux/issues/364 [1] Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-2-kees@kernel.org Signed-off-by: Kees Cook commit b3a7bb71bfcd56c8266af8cf2a5dee3802e7a449 Author: Kees Cook Date: Mon Aug 4 09:43:57 2025 -0700 KUnit: Introduce ffs()-family tests Add KUnit tests for ffs()-family bit scanning functions: ffs(), __ffs(), fls(), __fls(), fls64(), __ffs64(), and ffz(). The tests validate mathematical relationships (e.g. ffs(x) == __ffs(x) + 1), and test zero values, power-of-2 patterns, maximum values, and sparse bit patterns. Build and run tested with everything I could reach with KUnit: $ ./tools/testing/kunit/kunit.py run --arch=x86_64 ffs $ ./tools/testing/kunit/kunit.py run --arch=i386 ffs $ ./tools/testing/kunit/kunit.py run --arch=arm64 --make_options "CROSS_COMPILE=aarch64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=arm --make_options "CROSS_COMPILE=arm-linux-gnueabihf-" ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpc ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpc32 ffs $ ./tools/testing/kunit/kunit.py run --arch=powerpcle ffs $ ./tools/testing/kunit/kunit.py run --arch=riscv --make_options "CROSS_COMPILE=riscv64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=riscv32 --make_options "CROSS_COMPILE=riscv64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=s390 --make_options "CROSS_COMPILE=s390x-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=m68k ffs $ ./tools/testing/kunit/kunit.py run --arch=loongarch ffs $ ./tools/testing/kunit/kunit.py run --arch=mips --make_options "CROSS_COMPILE=mipsel-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sparc --make_options "CROSS_COMPILE=sparc64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sparc64 --make_options "CROSS_COMPILE=sparc64-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=alpha --make_options "CROSS_COMPILE=alpha-linux-gnu-" ffs $ ./tools/testing/kunit/kunit.py run --arch=sh --make_options "CROSS_COMPILE=sh4-linux-gnu-" ffs Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250804164417.1612371-1-kees@kernel.org Signed-off-by: Kees Cook commit 00e58ff924b3a684b076f9512fe2753be87b50e1 Author: Kees Cook Date: Thu Sep 4 22:28:41 2025 -0700 PCI: Test for bit underflow in pcie_set_readrq() In preparation for the future commit ("bitops: Add __attribute_const__ to generic ffs()-family implementations"), which allows GCC's value range tracker to see past ffs(), GCC 8 on ARM thinks that it might be possible that "ffs(rq) - 8" used here: v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8); could wrap below 0, leading to a very large value, which would be out of range for the FIELD_PREP() usage: drivers/pci/pci.c: In function 'pcie_set_readrq': include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field ... drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP' v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8); ^~~~~~~~~~ If the result of the ffs() is bounds checked before being used in FIELD_PREP(), the value tracker seems happy again. :) Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/linux-pci/CA+G9fYuysVr6qT8bjF6f08WLyCJRG7aXAeSd2F7=zTaHHd7L+Q@mail.gmail.com/ Acked-by: Bjorn Helgaas Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250905052836.work.425-kees@kernel.org Signed-off-by: Kees Cook commit 21e2e1abd4321a220a11c2963ff60214fd73c3e8 Author: Kuninori Morimoto Date: Fri Jul 18 01:52:01 2025 +0000 arm: omap2: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Reviewed-by: Andy Shevchenko Reviewed-by: Andreas Kemnade Link: https://lore.kernel.org/r/87ikjq5kqm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kevin Hilman commit 7156602d56e5ad689ae11e03680ab6326238b5e3 Author: Neil Armstrong Date: Mon Sep 8 15:04:19 2025 +0200 drm/bridge: simple: add Realtek RTD2171 DP-to-HDMI bridge Add support for the transparent Realtek RTD2171 DP-to-HDMI bridge. Reviewed-by: Dmitry Baryshkov Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250908-topic-x1e80100-hdmi-v3-2-c53b0f2bc2fb@linaro.org Signed-off-by: Dmitry Baryshkov commit 2c4f536c75217476baabbd557a44e8d4c3a2a23a Author: Neil Armstrong Date: Mon Sep 8 15:04:18 2025 +0200 dt-bindings: display: bridge: simple: document the Realtek RTD2171 DP-to-HDMI bridge The Realtek RTD2171 chipset is a transparent DisplayPort 1.4 to HDMI 2.0 bridge. This chipset is usually found in USB-C To HDMI Adapters and Docks, or laptops to provide HDMI display output. Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250908-topic-x1e80100-hdmi-v3-1-c53b0f2bc2fb@linaro.org Signed-off-by: Dmitry Baryshkov commit 2f5f8fb9de095e9b255a89269827f1761c714690 Author: Sean Christopherson Date: Thu Aug 21 14:38:41 2025 -0700 KVM: SEV: Save the SEV policy if and only if LAUNCH_START succeeds Wait until LAUNCH_START fully succeeds to set a VM's SEV/SNP policy so that KVM doesn't keep a potentially stale policy. In practice, the issue is benign as the policy is only used to detect if the VMSA can be decrypted, and the VMSA only needs to be decrypted if LAUNCH_UPDATE and thus LAUNCH_START succeeded. Fixes: 962e2b6152ef ("KVM: SVM: Decrypt SEV VMSA in dump_vmcb() if debugging is enabled") Cc: Tom Lendacky Cc: Kim Phillips Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250821213841.3462339-1-seanjc@google.com Signed-off-by: Sean Christopherson commit c1ead4b4dfe0f643cfc66571ca7d2fa332eddd35 Merge: 75a7b9d29215c5 f777d1112ee597 Author: Arnaldo Carvalho de Melo Date: Mon Sep 8 17:12:46 2025 -0300 Merge remote-tracking branch 'torvalds/master' into perf-tools-next To pick the fixes sent by Namhyung for tools/perf for v6.17-rc5 and get closer to the other tools code that is used by tools/perf. Signed-off-by: Arnaldo Carvalho de Melo commit 665071186ce4af9f83a5d78bcb7a2a3a6b3ecfe7 Author: Alok Tiwari Date: Sun Aug 24 11:16:40 2025 -0700 KVM: selftests: Fix typo in hyperv cpuid test message Fix a typo in hyperv_cpuid.c test assertion log: replace "our of supported range" -> "out of supported range". Signed-off-by: Alok Tiwari Link: https://lore.kernel.org/r/20250824181642.629297-1-alok.a.tiwari@oracle.com Signed-off-by: Sean Christopherson commit f3883b1ea5a8f31df4eba1c2cb5196e3a249a09e Author: Jakub Kicinski Date: Sat Sep 6 14:13:51 2025 -0700 selftests: net: move netlink-dumps back to progs Commit 9bb88c659673 ("selftests: net: test extacks in netlink dumps") moved netlink-dumps from TEST_GEN_PROGS to YNL_GEN_FILES. But _FILES are not for tests, rather for utilities / helpers. Create YNL_GEN_PROGS and include netlink-dumps there. This makes netlink-dumps part of executed tests, again. Link: https://patch.msgid.link/20250906211351.3192412-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 27bc5eaf004c437309dee1b9af24806262631d57 Author: Jakub Kicinski Date: Sat Sep 6 14:13:50 2025 -0700 selftests: net: make the dump test less sensitive to mem accounting Recent changes to make netlink socket memory accounting must have broken the implicit assumption of the netlink-dump test that we can fit exactly 64 dumps into the socket. Handle the failure mode properly, and increase the dump count to 80 to make sure we still run into the error condition if the default buffer size increases in the future. Link: https://patch.msgid.link/20250906211351.3192412-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d5f6bd3ee3f5048f272182dc91675c082773999e Author: Marek Vasut Date: Fri Sep 5 20:42:10 2025 +0200 PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs Currently, the test allocates BAR sizes according to fixed table bar_size. This does not work with controllers which have fixed size BARs that are smaller than the requested BAR size. One such controller is Renesas R-Car V4H PCIe controller, which has BAR4 size limited to 256 bytes, which is much less than one of the BAR size, 131072 currently requested by this test. A lot of controllers drivers in-tree have fixed size BARs, and they do work perfectly fine, but it is only because their fixed size is larger than the size requested by pci-epf-test.c Adjust the test such that in case a fixed size BAR is detected, the fixed BAR size is used, as that is the only possible option. This helps with test failures reported as follows: pci_epf_test pci_epf_test.0: requested BAR size is larger than fixed size pci_epf_test pci_epf_test.0: Failed to allocate space for BAR4 Signed-off-by: Marek Vasut [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20250905184240.144431-1-marek.vasut+renesas@mailbox.org commit 6b35936f058d0cb9171c7be1424b62017b874913 Author: Lyude Paul Date: Mon Sep 8 14:46:38 2025 -0400 rust: drm: gem: Drop Object::SIZE Drive-by fix, it doesn't seem like anything actually uses this constant anymore. Signed-off-by: Lyude Paul Reviewed-by: Danilo Krummrich Reviewed-by: Daniel Almeida Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250908185239.135849-4-lyude@redhat.com Signed-off-by: Alice Ryhl commit 1ed10db60f47306c1fd395f87bf6d443926a9488 Author: Lyude Paul Date: Mon Sep 8 14:46:37 2025 -0400 rust: drm: gem: Add DriverFile type alias Just to reduce the clutter with the File<…> types in gem.rs. Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Acked-by: Danilo Krummrich Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250908185239.135849-3-lyude@redhat.com Signed-off-by: Alice Ryhl commit 6ea42e9146f7ab8e59ffea8aa3300ad6710399dd Author: Lyude Paul Date: Mon Sep 8 14:46:36 2025 -0400 rust: drm: gem: Simplify use of generics Now that my rust skills have been honed, I noticed that there's a lot of generics in our gem bindings that don't actually need to be here. Currently the hierarchy of traits in our gem bindings looks like this: * Drivers implement: * BaseDriverObject (has the callbacks) * DriverObject (has the drm::Driver type) * Crate implements: * IntoGEMObject for Object where T: DriverObject Handles conversion to/from raw object pointers * BaseObject for T where T: IntoGEMObject Provides methods common to all gem interfaces Also of note, this leaves us with two different drm::Driver associated types: * DriverObject::Driver * IntoGEMObject::Driver I'm not entirely sure of the original intent here unfortunately (if anyone is, please let me know!), but my guess is that the idea would be that some objects can implement IntoGEMObject using a different ::Driver than DriverObject - presumably to enable the usage of gem objects from different drivers. A reasonable usecase of course. However - if I'm not mistaken, I don't think that this is actually how things would go in practice. Driver implementations are of course implemented by their associated drivers, and generally drivers are not linked to each-other when building the kernel. Which is to say that even in a situation where we would theoretically deal with gem objects from another driver, we still wouldn't have access to its drm::driver::Driver implementation. It's more likely we would simply want a variant of gem objects in such a situation that have no association with a drm::driver::Driver type. Taking that into consideration, we can assume the following: * Anything that implements BaseDriverObject will implement DriverObject In other words, all BaseDriverObjects indirectly have an associated ::Driver type - so the two traits can be combined into one with no generics. * Not everything that implements IntoGEMObject will have an associated ::Driver, and that's OK. And with this, we now can do quite a bit of cleanup with the use of generics here. As such, this commit: * Removes the generics on BaseDriverObject * Moves DriverObject::Driver into BaseDriverObject * Removes DriverObject * Removes IntoGEMObject::Driver * Add AllocImpl::Driver, which we can use as a binding to figure out the correct File type for BaseObject Leaving us with a simpler trait hierarchy that now looks like this: * Drivers implement: BaseDriverObject * Crate implements: * IntoGEMObject for Object where T: DriverObject * BaseObject for T where T: IntoGEMObject Which makes the code a lot easier to understand and build on :). Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Acked-by: Danilo Krummrich Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250908185239.135849-2-lyude@redhat.com Signed-off-by: Alice Ryhl commit 69001f21ded78131b995af2900ef574b04a59ae2 Author: Cryolitia PukNgae Date: Mon Sep 8 10:25:45 2025 +0800 hwmon: document: add gpd-fan Add GPD fan driver document Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250908-gpd_fan-v9-2-7b4506c03953@uniontech.com Signed-off-by: Guenter Roeck commit 0ab88e2394392f475b8857ac82c0c987841217f8 Author: Cryolitia PukNgae Date: Mon Sep 8 10:25:44 2025 +0800 hwmon: add GPD devices sensor driver Sensors driver for GPD Handhelds that expose fan reading and control via hwmon sysfs. Shenzhen GPD Technology Co., Ltd. manufactures a series of handheld devices. This driver implements these functions through x86 port-mapped IO. Tested-by: Marcin Strągowski Tested-by: someone5678 Tested-by: Justin Weiss Tested-by: Antheas Kapenekakis Tested-by: command_block Tested-by: derjohn Tested-by: Crashdummyy Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250908-gpd_fan-v9-1-7b4506c03953@uniontech.com Signed-off-by: Guenter Roeck commit 2f076a453f75de691a081c89bce31b530153d53b Author: Caleb Sander Mateos Date: Thu Sep 4 11:08:59 2025 -0600 io_uring/rsrc: respect submitter_task in io_register_clone_buffers() io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed a single task submitting to the ctx. Although the documentation only mentions this restriction applying to io_uring_enter() syscalls, commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER") extends it to io_uring_register(). Ensuring only one task interacts with the io_ring_ctx will be important to allow this task to avoid taking the uring_lock. There is, however, one gap in these checks: io_register_clone_buffers() may take the uring_lock on a second (source) io_ring_ctx, but __io_uring_register() only checks the current thread against the *destination* io_ring_ctx's submitter_task. Fail the IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has a registered submitter_task other than the current task. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit a0cce093689859238f923faa83a6735b7e8613c4 Author: Kurt Borja Date: Mon Sep 8 10:54:50 2025 -0500 hwmon: (sht21) Add support for SHT20, SHT25 chips All sht2x chips share the same communication protocol so add support for them. Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250908-sht2x-v4-2-bc15f68af7de@gmail.com Signed-off-by: Guenter Roeck commit 5d4c52bfa8cdc1dc1ff701246e662be3f43a3fe1 Author: Caleb Sander Mateos Date: Thu Sep 4 11:08:58 2025 -0600 io_uring: don't include filetable.h in io_uring.h io_uring/io_uring.h doesn't use anything declared in io_uring/filetable.h, so drop the unnecessary #include. Add filetable.h includes in .c files previously relying on the transitive include from io_uring.h. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 94a28f9ba264b4b93cd1efa97992db59d74e8048 Author: Kurt Borja Date: Mon Sep 8 10:54:49 2025 -0500 hwmon: (sht21) Documentation cleanup Drop extra empty lines and organize sysfs entries in a table. Signed-off-by: Kurt Borja Link: https://lore.kernel.org/r/20250908-sht2x-v4-1-bc15f68af7de@gmail.com Signed-off-by: Guenter Roeck commit 8673e5b22e1e114213d3ca74f415034aed45e528 Author: Wei-Lin Chang Date: Sat Aug 9 21:53:56 2025 +0800 KVM: arm64: ptdump: Don't test PTE_VALID alongside other attributes The attribute masks and test values in the ptdump code are meant for individual attributes, however for stage-2 ptdump we included PTE_VALID while testing for R, W, X, and AF. This led to some confusion and the flipped output for the executable attribute. Remove PTE_VALID from all attribute masks and values so that each test matches only the relevant bits. Additionally, the executable attribute printing is updated to align with stage-1 ptdump, printing "NX" for non-executable regions and "x " for executable ones. Suggested-by: Anshuman Khandual Suggested-by: Mark Rutland Suggested-by: Sebastian Ene Signed-off-by: Wei-Lin Chang Acked-by: Will Deacon Reviewed-by: Anshuman Khandual Signed-off-by: Marc Zyngier commit b5a861a438d1a456952665cf6167969f01209479 Author: E Shattow Date: Wed Sep 3 03:13:36 2025 -0700 riscv: dts: starfive: jh7110-common: drop mmc post-power-on-delay-ms Drop post-power-on-delay-ms from mmc0 mmc1 interfaces. There is no known reason for these properties to continue, testing appears to be fine without them [1]. 1: https://lore.kernel.org/lkml/NT0PR01MB1312E0D9EE9F158A57B77700E63D2@NT0PR01MB1312.CHNPR01.prod.partner.outlook.cn/ Signed-off-by: E Shattow Tested-by: Hal Feng Signed-off-by: Conor Dooley commit 08128670a931a4117f7b93c703d0186c67c9e1e2 Author: E Shattow Date: Wed Sep 3 03:13:35 2025 -0700 riscv: dts: starfive: jh7110-common: drop no-mmc property from mmc1 Relax no-mmc restriction on mmc1 for jh7110 boards. The restriction is only needed to block use of commands that would cause a device to malfunction, which by testing and observation [1] is not any problem. 1: https://lore.kernel.org/lkml/NT0PR01MB1312E0D9EE9F158A57B77700E63D2@NT0PR01MB1312.CHNPR01.prod.partner.outlook.cn/ Signed-off-by: E Shattow Tested-by: Hal Feng Signed-off-by: Conor Dooley commit 162190f2ccdc5964efa2a26e9fc3e56cf80fc29b Author: Per Larsen Date: Wed Aug 20 01:10:10 2025 +0000 KVM: arm64: Bump the supported version of FF-A to 1.2 FF-A version 1.2 introduces the DIRECT_REQ2 ABI. Bump the FF-A version preferred by the hypervisor to enable implementation of the 1.2-only FFA_MSG_SEND_DIRECT_REQ2 and FFA_MSG_SEND_RESP2 messaging interfaces. Co-developed-by: Ayrton Munoz Signed-off-by: Ayrton Munoz Acked-by: Will Deacon Signed-off-by: Per Larsen Signed-off-by: Marc Zyngier commit 3f5952917498e7bb9d227812d4349668f62c413b Author: Per Larsen Date: Wed Aug 20 01:10:09 2025 +0000 KVM: arm64: Mask response to FFA_FEATURE call The minimum size and alignment boundary for FFA_RXTX_MAP is returned in bit[1:0]. Mask off any other bits in w2 when reading the minimum buffer size in hyp_ffa_post_init. Acked-by: Will Deacon Signed-off-by: Per Larsen Signed-off-by: Marc Zyngier commit 8d24683e3e0f93b4bfdb558df50923514042817b Author: Per Larsen Date: Wed Aug 20 01:10:08 2025 +0000 KVM: arm64: Mark optional FF-A 1.2 interfaces as unsupported Mark FF-A 1.2 interfaces as unsupported lest they get proxied. Acked-by: Will Deacon Signed-off-by: Per Larsen Signed-off-by: Marc Zyngier commit 79195f342417ff773048515964707aba3bfe0e41 Author: Per Larsen Date: Wed Aug 20 01:10:07 2025 +0000 KVM: arm64: Mark FFA_NOTIFICATION_* calls as unsupported Prevent FFA_NOTIFICATION_* interfaces from being passed through to TZ. Acked-by: Will Deacon Signed-off-by: Per Larsen Signed-off-by: Marc Zyngier commit 6f4c348b1d5c08f1105e645700962cc4353a8ac9 Author: Per Larsen Date: Wed Aug 20 01:10:06 2025 +0000 KVM: arm64: Use SMCCC 1.2 for FF-A initialization and in host handler SMCCC 1.1 and prior allows four registers to be sent back as a result of an FF-A interface. SMCCC 1.2 increases the number of results that can be sent back to 8 and 16 for 32-bit and 64-bit SMC/HVCs respectively. FF-A 1.0 references SMCCC 1.2 (reference [4] on page xi) and FF-A 1.2 explicitly requires SMCCC 1.2 so it should be safe to use this version unconditionally. Moreover, it is simpler to implement FF-A features without having to worry about compatibility with SMCCC 1.1 and older. SMCCC 1.2 requires that SMC32/HVC32 from aarch64 mode preserves x8-x30 but given that there is no reliable way to distinguish 32-bit/64-bit calls, we assume SMC64 unconditionally. This has the benefit of being consistent with the handling of calls that are passed through, i.e., not proxied. (A cleaner solution will become available in FF-A 1.3.) Update the FF-A initialization and host handler code to use SMCCC 1.2. Signed-off-by: Per Larsen Acked-by: Will Deacon Signed-off-by: Marc Zyngier commit f414269392443f666bd8bef0cb3f0b53d5147be3 Author: Per Larsen Date: Wed Aug 20 01:10:05 2025 +0000 KVM: arm64: Correct return value on host version downgrade attempt Once the hypervisor negotiates the FF-A version with the host, it should remain locked-in. However, it is possible to load FF-A as a module first supporting version 1.1 and then 1.0. Without this patch, the FF-A 1.0 driver will use 1.0 data structures to make calls which the hypervisor will incorrectly interpret as 1.1 data structures. With this patch, negotiation will fail. This patch does not change existing functionality in the case where a FF-A 1.2 driver is loaded after a 1.1 driver; the 1.2 driver will need to use 1.1 in order to proceed. Acked-by: Will Deacon Signed-off-by: Per Larsen Signed-off-by: Marc Zyngier commit 29c2f18d4f3fa444e3b8972b45d548cf521f8f15 Author: Lukas Bulwahn Date: Fri Aug 29 09:04:02 2025 +0200 x86/xen: select HIBERNATE_CALLBACKS more directly The config XEN_SAVE_RESTORE's only purpose is to select HIBERNATE_CALLBACKS, when config XEN is set. The XEN config definition can simply select HIBERNATE_CALLBACKS, though, and the definition of XEN_SAVE_RESTORE can be dropped. So, remove this indirection through XEN_SAVE_RESTORE and select HIBERNATE_CALLBACKS directly. Also, drop the XEN_SAVE_RESTORE from the x86 xen config fragment. No functional change intended with this clean-up. Signed-off-by: Lukas Bulwahn Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250829070402.159390-1-lukas.bulwahn@redhat.com> commit 88ca0c738c4159ce87893782b6dd964b5aa01f6e Author: Alexander Lobakin Date: Tue Aug 26 17:55:07 2025 +0200 idpf: add XDP RSS hash hint Add &xdp_metadata_ops with a callback to get RSS hash hint from the descriptor. Declare the splitq 32-byte descriptor as 4 u64s to parse them more efficiently when possible. Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit aaa3ac6480baeb7d26cd7f2c7886341872ad87b7 Author: Alexander Lobakin Date: Tue Aug 26 17:55:06 2025 +0200 idpf: add support for .ndo_xdp_xmit() Use libeth XDP infra to implement .ndo_xdp_xmit() in idpf. The Tx callbacks are reused from XDP_TX code. XDP redirect target feature is set/cleared depending on the XDP prog presence, as for now we still don't allocate XDP Tx queues when there's no program. Reviewed-by: Maciej Fijalkowski Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit cba102cd719029a10bda1d0ca00ed646796f1f21 Author: Alexander Lobakin Date: Tue Aug 26 17:55:05 2025 +0200 idpf: add support for XDP on Rx Use libeth XDP infra to support running XDP program on Rx polling. This includes all of the possible verdicts/actions. XDP Tx queues are cleaned only in "lazy" mode when there are less than 1/4 free descriptors left on the ring. libeth helper macros to define driver-specific XDP functions make sure the compiler could uninline them when needed. Use __LIBETH_WORD_ACCESS to parse descriptors more efficiently when applicable. It really gives some good boosts and code size reduction on x86_64: XDP only: add/remove: 0/0 grow/shrink: 3/3 up/down: 5/-59 (-54) with XSk: add/remove: 0/0 grow/shrink: 5/6 up/down: 23/-124 (-101) with the most demanding workloads like XSk xmit differing in up to 5-8%. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit a4d755d1040a49014b52de286c5f535e20788aa3 Author: Alexander Lobakin Date: Tue Aug 26 17:55:04 2025 +0200 idpf: use generic functions to build xdp_buff and skb In preparation of XDP support, move from having skb as the main frame container during the Rx polling to &xdp_buff. This allows to use generic and libeth helpers for building an XDP buffer and changes the logics: now we try to allocate an skb only when we processed all the descriptors related to the frame. Store &libeth_xdp_stash instead of the skb pointer on the Rx queue. It's only 8 bytes wider, but contains everything we may need. Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 705457e7211f22c49b410eb25e83cef8a61bd560 Author: Michal Kubiak Date: Tue Aug 26 17:55:03 2025 +0200 idpf: implement XDP_SETUP_PROG in ndo_bpf for splitq Implement loading/removing XDP program using .ndo_bpf callback in the split queue mode. Reconfigure and restart the queues if needed (!!old_prog != !!new_prog), otherwise, just update the pointers. Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit ac8a861f632e68e669ba8fb28645fd118f19a7ab Author: Michal Kubiak Date: Tue Aug 26 17:55:02 2025 +0200 idpf: prepare structures to support XDP Extend basic structures of the driver (e.g. 'idpf_vport', 'idpf_*_queue', 'idpf_vport_user_config_data') by adding members necessary to support XDP. Add extra XDP Tx queues needed to support XDP_TX and XDP_REDIRECT actions without interfering with regular Tx traffic. Also add functions dedicated to support XDP initialization for Rx and Tx queues and call those functions from the existing algorithms of queues configuration. Signed-off-by: Michal Kubiak Co-developed-by: Alexander Lobakin Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit a0c60b07904c2e213400ffbe4df4849c03a976d0 Author: Alexander Lobakin Date: Tue Aug 26 17:55:01 2025 +0200 idpf: add support for nointerrupt queues Currently, queues are associated 1:1 with interrupt vectors as it's assumed queues are always interrupt-driven. For XDP, we want to use Tx queues without interrupts and only do "lazy" cleaning when the number of free elements is <= threshold (closest pow-2 to 1/4 of the ring). In order to use a queue without an interrupt, idpf still needs to have a vector assigned to it to flush descriptors. This vector can be global and only one for the whole vport to handle all its noirq queues. Always request one excessive vector and configure it in non-interrupt mode right away when creating vport, so that it can be used later by queues when needed (not only XDP ones). Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 9d39447051a0decaf90ba520611ee0e4644a94d5 Author: Michal Kubiak Date: Tue Aug 26 17:55:00 2025 +0200 idpf: remove SW marker handling from NAPI SW marker descriptors on completion queues are used only when a queue is about to be destroyed. It's far from hotpath and handling it in the hotpath NAPI poll makes no sense. Instead, run a simple poller after a virtchnl message for destroying the queue is sent and wait for the replies. If replies for all of the queues are received, this means the synchronization is done correctly and we can go forth with stopping the link. Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit cfe5efec9177c42f0c172713151af95a073d3359 Author: Michal Kubiak Date: Tue Aug 26 17:54:59 2025 +0200 idpf: add 4-byte completion descriptor definition In the queue-based scheduling mode, Tx completion descriptor is 4 bytes comparing to 8 bytes in flow-based. Add definition for it and allocate the corresponding amount of memory for the descriptors during the completion queue creation. This does not include handling 4-byte completions during Tx polling, as for now, the only user of QB will be XDP, which has its own routines. Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit bd74a86bc75d35adefbebcec7c3a743d02c06230 Author: Alexander Lobakin Date: Tue Aug 26 17:54:58 2025 +0200 idpf: link NAPIs to queues Add the missing linking of NAPIs to netdev queues when enabling interrupt vectors in order to support NAPI configuration and interfaces requiring get_rx_queue()->napi to be set (like XSk busy polling). As currently, idpf_vport_{start,stop}() is called from several flows with inconsistent RTNL locking, we need to synchronize them to avoid runtime assertions. Notably: * idpf_{open,stop}() -- regular NDOs, RTNL is always taken; * idpf_initiate_soft_reset() -- usually called under RTNL; * idpf_init_task -- called from the init work, needs RTNL; * idpf_vport_dealloc -- called without RTNL taken, needs it. Expand common idpf_vport_{start,stop}() to take an additional bool telling whether we need to manually take the RTNL lock. Suggested-by: Maciej Fijalkowski # helper Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit ea18bcca43f4264809b3136761db523c5ac9f560 Author: Alexander Lobakin Date: Tue Aug 26 17:54:57 2025 +0200 idpf: use a saner limit for default number of queues to allocate Currently, the maximum number of queues available for one vport is 16. This is hardcoded, but then the function calculating the optimal number of queues takes min(16, num_online_cpus()). In order to be able to allocate more queues, which will be then used for XDP, stop hardcoding 16 and rely on what the device gives us[*]. Instead of num_online_cpus(), which is considered suboptimal since at least 2013, use netif_get_num_default_rss_queues() to still have free queues in the pool. [*] With the note: Currently, idpf always allocates `IDPF_MAX_BUFQS_PER_RXQ_GRP` (== 2) buffer queues for each Rx queue and one completion queue for each Tx for best performance. But there was no check whether such number is available, IOW the assumption was not backed by any "harmonizing" / actual checks. Fix this while at it. nr_cpu_ids number of Tx queues are needed only for lockless XDP sending, the regular stack doesn't benefit from that anyhow. On a 128-thread Xeon, this now gives me 32 regular Tx queues and leaves 224 free for XDP (128 of which will handle XDP_TX, .ndo_xdp_xmit(), and XSk xmit when enabled). Note 2: Unfortunately, some CP/FW versions are not able to reconfigure/enable/disable large amount of queues within the minimum timeout (2 seconds). For now, fall back to the default timeout for every operation until this is resolved. Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 2167bb92bdebb187e8b3a102987356ce981b77de Author: Zihuan Zhang Date: Fri Sep 5 21:24:09 2025 +0800 ACPI: processor: thermal: Release policy references using __free() Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang Link: https://patch.msgid.link/20250905132413.1376220-3-zhangzihuan@kylinos.cn [ rjw: Subject and changelog edits, whitespace fixups ] Signed-off-by: Rafael J. Wysocki commit 5bad16482c2a7e788c042d98f3e97d3b2bbc8cc5 Author: Marek Vasut Date: Fri Sep 5 21:16:30 2025 +0200 regulator: dt-bindings: rpi-panel: Split 7" Raspberry Pi 720x1280 v2 binding The 5" and 7" Raspberry Pi 720x1280 Display 2 MCU is a bit more complex than the original Display 1 ATTINY88 and the binding is also a bit more demanding. Split the binding into separate file and fill in required gpio-controller, #gpio-cells and #pwm-cells which must be present for the V2 MCU. Include mention of the 5" panel in the description of Display 2, as the 5" panel uses the same MCU. Fixes: 6d09c6e474bd ("regulator: dt-bindings: rpi-panel: Add regulator for 7" Raspberry Pi 720x1280") Signed-off-by: Marek Vasut Acked-by: Conor Dooley Message-ID: <20250905191637.147141-1-marek.vasut+renesas@mailbox.org> Signed-off-by: Mark Brown commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b Author: Takashi Iwai Date: Tue Sep 2 19:18:21 2025 +0200 ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai Message-ID: <20250902171826.27329-4-tiwai@suse.de> Signed-off-by: Mark Brown commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 Author: Takashi Iwai Date: Tue Sep 2 19:18:20 2025 +0200 ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access. This patch corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") Signed-off-by: Takashi Iwai Message-ID: <20250902171826.27329-3-tiwai@suse.de> Signed-off-by: Mark Brown commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 Author: Takashi Iwai Date: Tue Sep 2 19:18:19 2025 +0200 ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcht_es8316 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") Signed-off-by: Takashi Iwai Message-ID: <20250902171826.27329-2-tiwai@suse.de> Signed-off-by: Mark Brown commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 Author: Alexander Lobakin Date: Tue Aug 26 17:54:56 2025 +0200 idpf: fix Rx descriptor ready check barrier in splitq No idea what the current barrier position was meant for. At that point, nothing is read from the descriptor, only the pointer to the actual one is fetched. The correct barrier usage here is after the generation check, so that only the first qword is read if the descriptor is not yet ready and we need to stop polling. Debatable on coherent DMA as the Rx descriptor size is <= cacheline size, but anyway, the current barrier position only makes the codegen worse. Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") Reviewed-by: Maciej Fijalkowski Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 17d370a70bae277678b6ea82d71ef5892e7aaa97 Author: Alexander Lobakin Date: Tue Aug 26 17:54:55 2025 +0200 xdp, libeth: make the xdp_init_buff() micro-optimization generic Often times the compilers are not able to expand two consecutive 32-bit writes into one 64-bit on the corresponding architectures. This applies to xdp_init_buff() called for every received frame (or at least once per each 64 frames when the frag size is fixed). Move the not-so-pretty hack from libeth_xdp straight to xdp_init_buff(), but using a proper union around ::frame_sz and ::flags. The optimization is limited to LE architectures due to the structure layout. One simple example from idpf with the XDP series applied (Clang 22-git, CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE => -O2): add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-27 (-27) Function old new delta idpf_vport_splitq_napi_poll 5076 5049 -27 The perf difference with XDP_DROP is around +0.8-1% which I see as more than satisfying. Suggested-by: Simon Horman Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 60ef54156148ffaa719845bc5b1fdeafa67763fc Merge: 93a83d044314b0 a857210b104f5c Author: Alexei Starovoitov Date: Mon Sep 8 09:56:59 2025 -0700 Merge branch 'bpf-replace-wq-users-and-add-wq_percpu-to-alloc_workqueue-users' Marco Crivellari says: ==================== Below is a summary of a discussion about the Workqueue API and cpu isolation considerations. Details and more information are available here: "workqueue: Always use wq_select_unbound_cpu() for WORK_CPU_UNBOUND." https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ === Current situation: problems === Let's consider a nohz_full system with isolated CPUs: wq_unbound_cpumask is set to the housekeeping CPUs, for !WQ_UNBOUND the local CPU is selected. This leads to different scenarios if a work item is scheduled on an isolated CPU where "delay" value is 0 or greater then 0: schedule_delayed_work(, 0); This will be handled by __queue_work() that will queue the work item on the current local (isolated) CPU, while: schedule_delayed_work(, 1); Will move the timer on an housekeeping CPU, and schedule the work there. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. === Plan and future plans === This patchset is the first stone on a refactoring needed in order to address the points aforementioned; it will have a positive impact also on the cpu isolation, in the long term, moving away percpu workqueue in favor to an unbound model. These are the main steps: 1) API refactoring (that this patch is introducing) - Make more clear and uniform the system wq names, both per-cpu and unbound. This to avoid any possible confusion on what should be used. - Introduction of WQ_PERCPU: this flag is the complement of WQ_UNBOUND, introduced in this patchset and used on all the callers that are not currently using WQ_UNBOUND. WQ_UNBOUND will be removed in a future release cycle. Most users don't need to be per-cpu, because they don't have locality requirements, because of that, a next future step will be make "unbound" the default behavior. 2) Check who really needs to be per-cpu - Remove the WQ_PERCPU flag when is not strictly required. 3) Add a new API (prefer local cpu) - There are users that don't require a local execution, like mentioned above; despite that, local execution yeld to performance gain. This new API will prefer the local execution, without requiring it. === Introduced Changes by this series === 1) [P 1-2] Replace use of system_wq and system_unbound_wq system_wq is a per-CPU workqueue, but his name is not clear. system_unbound_wq is to be used when locality is not required. Because of that, system_wq has been renamed in system_percpu_wq, and system_unbound_wq has been renamed in system_dfl_wq. 2) [P 3] add WQ_PERCPU to remaining alloc_workqueue() users Every alloc_workqueue() caller should use one among WQ_PERCPU or WQ_UNBOUND. This is actually enforced warning if both or none of them are present at the same time. WQ_UNBOUND will be removed in a next release cycle. === For Maintainers === There are prerequisites for this series, already merged in the master branch. The commits are: 128ea9f6ccfb6960293ae4212f4f97165e42222d ("workqueue: Add system_percpu_wq and system_dfl_wq") 930c2ea566aff59e962c50b2421d5fcc3b98b8be ("workqueue: Add new WQ_PERCPU flag") ==================== Acked-by: Tejun Heo Link: https://patch.msgid.link/20250905085309.94596-1-marco.crivellari@suse.com Signed-off-by: Alexei Starovoitov commit a857210b104f5c186e883d0f2b0eb660349c1e54 Author: Marco Crivellari Date: Fri Sep 5 10:53:09 2025 +0200 bpf: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20250905085309.94596-4-marco.crivellari@suse.com Signed-off-by: Alexei Starovoitov commit 0409819a002165e9471113598323eb72bba17a53 Author: Marco Crivellari Date: Fri Sep 5 10:53:08 2025 +0200 bpf: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20250905085309.94596-3-marco.crivellari@suse.com Signed-off-by: Alexei Starovoitov commit 34f86083a4e1887ada121d2b5c4f47cc038a3356 Author: Marco Crivellari Date: Fri Sep 5 10:53:07 2025 +0200 bpf: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20250905085309.94596-2-marco.crivellari@suse.com Signed-off-by: Alexei Starovoitov commit 93a83d044314b041ffe2bb1d43b8b0cea7f60921 Author: Feng Yang Date: Mon Sep 8 14:08:10 2025 +0800 selftests/bpf: Fix the issue where the error code is 0 The error message printed here only uses the previous err value, which results in it being printed as 0. When bpf_map__attach_struct_ops encounters an error, it uses libbpf_err_ptr(err) to set errno = -err and returns NULL. Therefore, Using -errno can fix this issue. Fix before: run_subtest:FAIL:1019 bpf_map__attach_struct_ops failed for map pro_epilogue: err=0 Fix after: run_subtest:FAIL:1019 bpf_map__attach_struct_ops failed for map pro_epilogue: err=-9 Signed-off-by: Feng Yang Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250908060810.1054341-1-yangfeng59949@163.com commit 80cb2b6edd8368f7e1e8bf2f66aabf57aa7de4b7 Author: Brian Masney Date: Wed Aug 27 13:12:07 2025 -0400 clk: scmi: migrate round_rate() to determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops. The existing scmi_clk_determine_rate() is a noop implementation that lets the firmware round the rate as appropriate. Drop the existing determine_rate implementation and convert the existing round_rate() implementation over to determine_rate(). scmi_clk_determine_rate() was added recently when the clock parent support was added, so it's not expected that this change will regress anything. Reviewed-by: Sudeep Holla Reviewed-by: Peng Fan Tested-by: Peng Fan #i.MX95-19x19-EVK Signed-off-by: Brian Masney commit d8a97749bab7f4e1561ba52e41b576175897b13f Author: Brian Masney Date: Mon Aug 11 08:48:12 2025 -0400 clk: ti: fapll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit 48f8fb402a4f897de78e12956c52c90ab35e4d79 Author: Brian Masney Date: Mon Aug 11 08:48:11 2025 -0400 clk: ti: dra7-atl: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit 7760b3e1729837a814647be524b2b24053324baf Author: Brian Masney Date: Mon Aug 11 08:48:10 2025 -0400 clk: ti: divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit 849804453d5aae560dcec94578ae28d671dba937 Author: Brian Masney Date: Mon Aug 11 08:48:09 2025 -0400 clk: ti: composite: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit e465ad7ef57aa1ec4122fd5b34c182d59629cb91 Author: Brian Masney Date: Mon Aug 11 08:48:08 2025 -0400 clk: ti: dpll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate(). Part of these changes were done using the Coccinelle semantic patch on the cover letter of this series, and the rest of the changes were manually done. omap4_dpll_regm4xen_round_rate() is now only called by omap4_dpll_regm4xen_determine_rate(), so let's merge that functionality into one function. This is needed for another cleanup to completely remove the round_rate() clk ops from the clk core. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit fa55aea3dcdb309d8c4cc307dedd6c9390d8185e Author: Brian Masney Date: Mon Aug 11 08:48:07 2025 -0400 clk: ti: dpll: change error return from ~0 to -EINVAL When the requested rate cannot be achieved, omap2_dpll_round_rate() will return ~0. Let's change this to -EINVAL to make the code a little cleaner to read. This is no functional change. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit ec70154c8a5f69604bb7796fd1fe40d22e9396b5 Author: Brian Masney Date: Mon Aug 11 08:48:06 2025 -0400 clk: ti: dpll: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. Tested-by: Anddreas Kemnade # OMAP3 GTA04, OMAP4 Panda Reviewed-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Brian Masney commit 3b9877b162c9a22d38c081184db48bd8b2e5e8cc Author: Brian Masney Date: Wed Sep 3 11:15:07 2025 -0400 clk: tegra: tegra210-emc: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 13e19a074be46c1c24648a426c77f148ac88e398 Author: Brian Masney Date: Wed Sep 3 11:15:06 2025 -0400 clk: tegra: super: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate(). Note that this change also requires the same migration to drivers/clk/tegra/clk-divider.c. Signed-off-by: Brian Masney commit 65227c79e09c1399c6a2c01b5b0f4652fd7e5aed Author: Brian Masney Date: Wed Sep 3 11:15:05 2025 -0400 clk: tegra: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit e3d1744baa7f81de9e5fd30f26964f27b3a61510 Author: Brian Masney Date: Wed Sep 3 11:15:04 2025 -0400 clk: tegra: periph: divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate(). Note that this change also requires the same migration to drivers/clk/tegra/clk-divider.c. Signed-off-by: Brian Masney commit 3891c3c70012d634963b0203152aef5eeb079d47 Author: Brian Masney Date: Wed Sep 3 11:15:03 2025 -0400 clk: tegra: divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 706000971c7cf18b63f0376a9966c387b096ad54 Author: Brian Masney Date: Wed Sep 3 11:15:02 2025 -0400 clk: tegra: audio-sync: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit b94bc4398beccd329a51052c5e7e84e4670dbcd9 Author: Eric Biggers Date: Sat Sep 6 14:54:17 2025 -0700 crypto: md5 - Implement export_core() and import_core() Since commit 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API"), the recently-added export_core() and import_core() methods in struct shash_alg have effectively become mandatory (even though it is not tested or enforced), since legacy drivers that need a fallback depend on them. Make crypto/md5.c compatible with these legacy drivers by adding export_core() and import_core() methods to it. Fixes: ba8ee22a7f92 ("crypto: md5 - Wrap library and add HMAC support") Link: https://lore.kernel.org/r/20250906215417.89584-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 54e7bb6ade8acd3fb1c486c9f3e2c0dfdc18f84e Author: Eric Biggers Date: Sat Sep 6 14:35:23 2025 -0700 wireguard: kconfig: simplify crypto kconfig selections Simplify the kconfig entry for WIREGUARD: - Drop the selections of the arch-optimized ChaCha20, Poly1305, BLAKE2s, and Curve25519 code. These options no longer exist, as lib/crypto/ now enables the arch-optimized code automatically. - Drop the selection of CRYPTO. This was needed only to make the arch-optimized options visible. lib/crypto/ now handles these options internally, without any dependency on CRYPTO. - Drop the dependency on !KMSAN. This was needed only to avoid selecting arch-optimized code that isn't compatible with KMSAN. lib/crypto/ now handles the !KMSAN dependencies internally. - Add a selection of CRYPTO_LIB_UTILS, since WireGuard directly calls crypto_memneq(). This gets selected indirectly by CRYPTO_LIB_CURVE25519 and CRYPTO_LIB_CHACHA20POLY1305 anyway, but it's best to make this dependency explicit. Link: https://lore.kernel.org/r/20250906213523.84915-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 490b30fbaca2abbd6afa8bdc7e2df329b5d82412 Author: Zhongtian Wu Date: Mon Sep 8 14:37:32 2025 +0800 drm/panel-edp: Add 4 more panels needed by mt8189 Chromebooks Add a few generic edp panels used by mt8189 chromebooks. For BOE-NV140WUM-N44 , the enable timing required 80ms. For CSW-MNE007QB3-1, the hpd_absent timing rquired 80ms, the enable timing required 50ms, the disable timing required 50ms. For CSW-MNE007QS3-6, the enable timing required 50ms. For CMN-N140JCA-ELK, the enable timing required 80ms and disable timing required 50ms. BOE NV140WUM-N44 V8.2 edid-decode (hex): 00 ff ff ff ff ff ff 00 09 e5 6a 0a 00 00 00 00 2e 20 01 04 a5 1e 13 78 03 fb f5 96 5d 5a 91 29 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 61 40 80 04 71 b0 3c 40 30 20 36 00 2d bc 10 00 00 1a 81 33 80 04 71 b0 3c 40 30 20 36 00 2d bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c 4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 56 31 34 30 57 55 4d 2d 4e 34 34 0a 01 7c 02 03 0d 00 68 1a 00 00 01 01 28 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 CSW MNE007QB3-1: edid-decode (hex): 00 ff ff ff ff ff ff 00 0e 77 6e 14 00 00 00 00 00 23 01 04 a5 1e 13 78 07 ee 95 a3 54 4c 99 26 0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20 36 00 2d bc 10 00 00 18 2b 30 80 a0 70 b0 23 40 30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fc 00 4d 4e 45 30 30 37 51 42 33 2d 31 0a 20 01 69 70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04 00 3d 8a 54 cd a4 99 66 62 0f 02 45 54 40 5e 40 5e 00 44 12 78 2e 00 06 00 44 40 5e 40 5e 81 00 20 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 8d 00 e3 05 04 00 e6 06 01 00 60 60 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 90 CSW MNE007QS3-6: edid-decode (hex): 00 ff ff ff ff ff ff 00 0e 77 3f 14 00 00 00 00 00 22 01 04 a5 1e 13 78 03 2c c5 94 5c 59 95 29 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ea 3d 80 c8 70 b0 2e 40 30 20 36 00 2e bd 10 00 00 1a 88 31 80 c8 70 b0 2e 40 30 20 36 00 2e bd 10 00 00 1a 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fc 00 4d 4e 45 30 30 37 51 53 33 2d 36 0a 20 01 80 70 20 79 02 00 81 00 14 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 90 CMN N140JCA-ELK: edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 41 14 00 00 00 00 25 21 01 04 a5 1e 13 78 03 28 65 97 59 54 8e 27 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 a6 00 2d bc 10 00 00 18 35 30 80 a0 70 b0 24 40 30 20 a6 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 31 34 30 4a 43 41 2d 45 4c 4b 0a 20 01 14 02 03 0d 00 68 1a 00 00 01 01 28 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 Reviewed-by: Douglas Anderson Signed-off-by: Zhongtian Wu Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250908063732.764289-1-wuzhongtian@huaqin.corp-partner.google.com commit 1cf87861a2e02432fb68f8bcc8f20a8e42acde59 Author: Alex Tran Date: Mon Sep 1 11:40:07 2025 -0700 ASoC: codecs: tlv320dac33: Convert to use gpiod api Convert driver to use the gpiod api instead of the legacy GPIO interface. Replace power_gpio integer with reset_gpiod descriptor in the dac33 struct. Use devm_gpiod_get_optional() to automatically handle resource cleanup and add proper error checking when setting GPIO values. Signed-off-by: Alex Tran Message-ID: <20250901184008.1249535-2-alex.t.tran@gmail.com> Signed-off-by: Mark Brown commit 960ef523cfe420ae8fdd801f1d12be0fb7ed8719 Author: Alex Tran Date: Mon Sep 1 11:40:06 2025 -0700 ASoC: codecs: tlv320dac33: Add default value for burst_bclkdiv Add default value for field burst_bclkdiv as initializing it to 0 is incorrect, potentially leading to a divide by 0 issue. Valid range is 2-17 per TI datasheet. 8 was chosen as a dummy value. Reference . Signed-off-by: Alex Tran Message-ID: <20250901184008.1249535-1-alex.t.tran@gmail.com> Signed-off-by: Mark Brown commit 06aba2126b414248a34b13584f22a78787c95450 Author: Alex Tran Date: Mon Sep 1 11:40:08 2025 -0700 ASoC: codecs: tlv320dac33: Remove unused struct tlv320dac33_platform_data and header file tlv320dac33-plat.h Remove the tlv320dac33_platform_data struct and header file tlv320dac33-plat.h as they are not used anywhere in the kernel or outside this driver. Signed-off-by: Alex Tran Message-ID: <20250901184008.1249535-3-alex.t.tran@gmail.com> Signed-off-by: Mark Brown commit 32058c38d3b79a28963a59ac0353644dc24775cd Author: Yikang Yue Date: Sat May 3 20:44:34 2025 -0500 fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink The function call new_inode() is a primitive for allocating an inode in memory, rather than planning disk space for it. Therefore, -ENOMEM should be returned as the error code rather than -ENOSPC. To be specific, new_inode()'s call path looks like this: new_inode new_inode_pseudo alloc_inode ops->alloc_inode (hpfs_alloc_inode) alloc_inode_sb kmem_cache_alloc_lru Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), not a lack of disk space. However, the current implementation of hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. This patch fix this by set err to -ENOMEM before the goto statement. BTW, we also noticed that other nested calls within these four functions, like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. But similarly, only -ENOSPC is returned. Addressing these will involve code modifications in other functions, and we plan to submit dedicated patches for these issues in the future. For this patch, we focus on new_inode(). Signed-off-by: Yikang Yue Signed-off-by: Mikulas Patocka commit fd8a620f195e7966d83c367def68818a2cc71177 Author: Su Hui Date: Tue May 27 17:00:08 2025 +0800 hpfs: Replace simple_strtoul with kstrtoint in hpfs_parse_param kstrtoint() is better because simple_strtoul() ignores overflow and the type of 'timeshift' is 'int' rather than 'unsigned long'. Using kstrtoint() is more concise too. Signed-off-by: Su Hui Signed-off-by: Mikulas Patocka commit 2c625f0fe2db4e6a58877ce2318df3aa312eb791 Author: Krzysztof Kozlowski Date: Sat Aug 30 15:26:07 2025 +0200 spi: dt-bindings: samsung: Drop S3C2443 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Message-ID: <20250830132605.311115-4-krzysztof.kozlowski@linaro.org> Acked-by: Rob Herring (Arm) Signed-off-by: Mark Brown commit 6248c95eef941bcf987bdd7c62f5e47275b0dbba Author: Krzysztof Kozlowski Date: Sat Aug 30 15:26:06 2025 +0200 spi: s3c64xx: Drop S3C2443 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles or platform data ID. Signed-off-by: Krzysztof Kozlowski Message-ID: <20250830132605.311115-3-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit bc3a9d217755f65c137f145600f23bf1d6c31ea9 Author: Corey Minyard Date: Wed Aug 20 14:56:50 2025 -0500 ipmi:si: Gracefully handle if the BMC is non-functional If the BMC is not functional, the driver goes into an error state and starts a 1 second timer. When the timer times out, it will attempt a simple message. If the BMC interacts correctly, the driver will start accepting messages again. If not, it remains in error state. If the driver goes into error state, all messages current and pending will return with an error. This should more gracefully handle when the BMC becomes non-operational, as opposed to trying each messages individually and failing them. Signed-off-by: Corey Minyard commit 3bc54ab3b9790ca92f197e9822e486665daa321c Author: Corey Minyard Date: Wed Aug 20 14:09:11 2025 -0500 ipmi: Rename "user_data" to "recv_msg" in an SMI message It's only used to hold the corresponding receive message, so fix the name to make that clear and the type so nothing else can be accidentally assigned to it. Signed-off-by: Corey Minyard commit 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 Author: Corey Minyard Date: Wed Aug 20 14:04:24 2025 -0500 ipmi: Allow an SMI sender to return an error Getting ready for handling when a BMC is non-responsive or broken, allow the sender operation to fail in an SMI. If it was a user-generated message it will return the error. The powernv code was already doing this internally, but the way it was written could result in deep stack descent if there were a lot of messages queued. Have its send return an error in this case. Signed-off-by: Corey Minyard commit abe4918a942e17f997f62b1e12bc8a15d8ff5f7e Author: Corey Minyard Date: Wed Aug 20 13:25:33 2025 -0500 ipmi:si: Move flags get start to its own function It's about to be used from another place, and this looks better, anyway. Signed-off-by: Corey Minyard commit 753bc23d8ffcf5a395a4eef90cf40c8e7dec51fb Author: Corey Minyard Date: Wed Aug 20 13:11:55 2025 -0500 ipmi:si: Merge some if statements Changes resulted in a silly looking piece of logic. Get rid of a goto and use if statements properly. Signed-off-by: Corey Minyard commit bbfb8353cb26acb05b48380f2213d51938f11019 Author: Corey Minyard Date: Thu Aug 7 17:55:44 2025 -0500 ipmi: Set a timer for maintenance mode Now that maintenance mode rejects all messages, there's nothing to run time timer. Make sure the timer is running in maintenance mode. Signed-off-by: Corey Minyard Tested-by: Frederick Lawler commit 627118470fccc61d7763aa667fcab0a9476843f6 Author: Corey Minyard Date: Thu Aug 7 17:55:08 2025 -0500 ipmi: Add a maintenance mode sysfs file So you can see if it's in maintenance mode and see how long is left. Signed-off-by: Corey Minyard Tested-by: Frederick Lawler commit 30f6c9d5451de72ebc52aed6c15031696c6c5bd3 Author: Corey Minyard Date: Thu Aug 7 16:05:24 2025 -0500 ipmi: Disable sysfs access and requests in maintenance mode If the driver goes into any maintenance mode, disable sysfs access until it is done. If the driver goes into reset maintenance mode, disable all messages until it is done. Signed-off-by: Corey Minyard Tested-by: Frederick Lawler commit 281817dffe2855fc0dc07c205b03df630dc6ba38 Author: Thomas Weißschuh Date: Thu Aug 21 09:56:46 2025 +0200 arm64: vdso32: Respect -Werror from kbuild The compiler flags for the compat vDSO are built manually as they are not compatible with the ones from kbuild. CONFIG_WERROR is not respected. Explicitly inherit -Werror from kbuild. Signed-off-by: Thomas Weißschuh Signed-off-by: Will Deacon commit e5feb030d919f296257d628bae57d0494151dc24 Author: Corey Minyard Date: Thu Aug 7 15:54:20 2025 -0500 ipmi: Differentiate between reset and firmware update in maintenance This allows later changes to have different behaviour during a reset verses a firmware update. Signed-off-by: Corey Minyard Tested-by: Frederick Lawler commit 80c4e1948908f725564997c78d10110d9b21a015 Author: Thomas Weißschuh Date: Thu Aug 21 09:56:45 2025 +0200 arm64: vdso32: Stop suppressing warnings These warnings don't seem to trigger anymore. Probably due to the introduction of the vdso/ header namespace. Nowadays these suppression only hide real problems. Re-enable the warnings. Signed-off-by: Thomas Weißschuh Signed-off-by: Will Deacon commit 121f4a7e474393502cd71d63f71df7997cbc2f90 Author: Rob Herring (Arm) Date: Thu Aug 7 08:28:51 2025 -0500 dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: Add missing "clocks" property The ASpeed kcs-bmc nodes have a "clocks" property which isn't documented. It looks like all the LPC child devices have the same clock source and some of the drivers manage their clock. Perhaps it is the parent device that should have the clock, but it's too late for that. Signed-off-by: Rob Herring (Arm) Message-ID: <20250807132852.3291305-1-robh@kernel.org> Signed-off-by: Corey Minyard commit b52da4054ee0bf9ecb44996f2c83236ff50b3812 Author: Corey Minyard Date: Fri Sep 5 11:33:39 2025 -0500 ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive message allocation routine, so all refcouting and user message limit counts are done in that routine. It's a lot cleaner and safer. Reported-by: Gilles BULOZ Closes: https://lore.kernel.org/lkml/aLsw6G0GyqfpKs2S@mail.minyard.net/ Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") Cc: # 4.19 Signed-off-by: Corey Minyard Tested-by: Gilles BULOZ commit 14a41628c470f4aa069075cdcf6ec0138b6cf1da Author: Nikola Z. Ivanov Date: Wed Aug 27 00:49:13 2025 +0300 selftests/arm64: Fix grammatical error in string literals Fix grammatical error in + construct related to memory allocation checks. In essence change "Failed to allocated" to "Failed to allocate". Signed-off-by: Nikola Z. Ivanov Reviewed-by: Mark Brown Reviewed-by: Bagas Sanjaya Signed-off-by: Will Deacon commit 5d09ee1bec870263f4ace439402ea840503b503b Author: Corey Minyard Date: Wed Aug 20 11:03:13 2025 -0500 Revert "ipmi: fix msg stack when IPMI is disconnected" This reverts commit c608966f3f9c2dca596967501d00753282b395fc. This patch has a subtle bug that can cause the IPMI driver to go into an infinite loop if the BMC misbehaves in a certain way. Apparently certain BMCs do misbehave this way because several reports have come in recently about this. Signed-off-by: Corey Minyard Tested-by: Eric Hagberg Cc: # 6.2 commit 8fd8ea2869cfafb3b1d6f95ff49561b13a73438d Author: Corey Minyard Date: Tue Aug 19 13:11:39 2025 -0500 ipmi:msghandler:Change seq_lock to a mutex Dan Carpenter got a Smatch warning: drivers/char/ipmi/ipmi_msghandler.c:5265 ipmi_free_recv_msg() warn: sleeping in atomic context due to the recent rework of the IPMI driver's locking. I didn't realize vfree could block. But there is an easy solution to this, now that almost everything in the message handler runs in thread context. I wanted to spend the time earlier to see if seq_lock could be converted from a spinlock to a mutex, but I wanted the previous changes to go in and soak before I did that. So I went ahead and did the analysis and converting should work. And solve this problem. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202503240244.LR7pOwyr-lkp@intel.com/ Fixes: 3be997d5a64a ("ipmi:msghandler: Remove srcu from the ipmi user structure") Cc: # 6.16 Signed-off-by: Corey Minyard commit 2ea7a5bcc4cfca817b3502b38f97885767730ed8 Author: Juergen Gross Date: Tue Aug 26 16:56:08 2025 +0200 drivers/xen/gntdev: use xen_pv_domain() instead of cached value Eliminate the use_ptemod variable by replacing its use cases with xen_pv_domain(). Instead of passing the xen_pv_domain() return value to gntdev_ioctl_dmabuf_exp_from_refs(), use xen_pv_domain() in that function. Reviewed-by: Jason Andryuk Signed-off-by: Juergen Gross Message-ID: <20250826145608.10352-4-jgross@suse.com> commit 0f4283123fe1e6016296048d0fdcfce615047a13 Author: Juergen Gross Date: Tue Aug 26 16:56:07 2025 +0200 xen: replace XENFEAT_auto_translated_physmap with xen_pv_domain() Instead of testing the XENFEAT_auto_translated_physmap feature, just use !xen_pv_domain() which is equivalent. This has the advantage that a kernel not built with CONFIG_XEN_PV will be smaller due to dead code elimination. Reviewed-by: Jason Andryuk Signed-off-by: Juergen Gross Message-ID: <20250826145608.10352-3-jgross@suse.com> commit 34c605fe53d49886d2741223b12950a33bdf2acf Author: Juergen Gross Date: Tue Aug 26 16:56:06 2025 +0200 xen: rework xen_pv_domain() Rework xen_pv_domain() to no longer use the xen_domain_type variable, but the artificial X86_FEATURE_XENPV cpu feature. On non-x86 architectures xen_pv_domain() can be defined as "0". This has the advantage that a kernel not built with CONFIG_XEN_PV will be smaller due to dead code elimination. Set the X86_FEATURE_XENPV feature very early, as xen_pv_domain() is used rather early, too. Reviewed-by: Jason Andryuk Signed-off-by: Juergen Gross Message-ID: <20250826145608.10352-2-jgross@suse.com> commit 62e8a9fbaad147b65bda9362c2d8a52a86a0bac3 Author: Vivek Yadav Date: Sat Aug 23 23:14:02 2025 -0700 kselftest/arm64: Add parentheses around sizeof for clarity Added parentheses around sizeof to make the expression clearer and improve readability. This change has no functional impact. ``` [command] ./scripts/checkpatch.pl tools/testing/selftests/arm64/fp/sve-ptrace.c [output] WARNING: sizeof *sve should be sizeof(*sve) ``` Signed-off-by: Vivek Yadav Signed-off-by: Will Deacon commit a940568ccde433a0d06aadd4735f7974fd2c59e1 Author: Vivek Yadav Date: Sat Aug 23 23:14:01 2025 -0700 kselftest/arm64: Supress warning and improve readability The comment was correct, but `checkpatch` script flagged it with a warning as shown in the output section. The comment is slightly modified to improve readability, which also suppresses the warning. ``` [command] ./script/checkpatch.pl --strict -f tools/testing/selftests/arm64/fp/fp-stress.c [output] WARNING: Possible repeated word: 'on' ``` Signed-off-by: Vivek Yadav Signed-off-by: Will Deacon commit 3198780eaf37c071052edac109d99bff77e6ce5c Author: Vivek Yadav Date: Sat Aug 23 23:14:00 2025 -0700 kselftest/arm64: Remove extra blank line Remove an unnecessary blank line to improve code style consistency. ``` [command] ./scripts/checkpatch.pl --strict -f [output] CHECK: Please don't use multiple blank lines CHECK: Blank lines aren't necessary before a close brace '}' ``` Signed-off-by: Vivek Yadav Signed-off-by: Will Deacon commit bb12da95a183253b619ca1691d6fd320b7e445e9 Author: Mohammad Rafi Shaik Date: Sat Sep 6 00:53:50 2025 +0530 arm64: dts: qcom: monaco-evk: Add sound card Add the sound card for monaco-evk board and verified playback functionality using the max98357a I2S speaker amplifier and I2S microphones. The max98357a speaker amplifier is connected via High-Speed MI2S HS0 interface, while the microphones utilize the Secondary MI2S interface and also enable required pin controller gpios for audio. Signed-off-by: Mohammad Rafi Shaik Signed-off-by: Umang Chheda Link: https://lore.kernel.org/r/20250905192350.1223812-5-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 89c85214735b633e846d8f6473fa57ba4cc11b81 Author: Mohammad Rafi Shaik Date: Sat Sep 6 00:53:49 2025 +0530 arm64: dts: qcom: qcs8300: Add gpr node Add GPR(Generic Pack router) node along with APM(Audio Process Manager) and PRM(Proxy resource Manager) audio services. Signed-off-by: Mohammad Rafi Shaik Signed-off-by: Umang Chheda Link: https://lore.kernel.org/r/20250905192350.1223812-4-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 117d6bc9326b1ff38591289f9677e273a9a467ae Author: Umang Chheda Date: Sat Sep 6 00:53:48 2025 +0530 arm64: dts: qcom: qcs8300: Add Monaco EVK board Monaco EVK is a single board computer, based on the Qualcomm QCS8300 SoC, with the following features : - Storage: 1 × 128 GB UFS, micro-SD card, EEPROMs for MACs, and eMMC. - Audio/Video, Camera & Display ports. - Connectivity: RJ45 2.5GbE, WLAN/Bluetooth, CAN/CAN-FD. - PCIe ports. - USB & UART ports. On top of Monaco EVK board additional mezzanine boards can be stacked in future. Add support for the following components : - GPI (Generic Peripheral Interface) and QUPv3-0/1 controllers to facilitate DMA and peripheral communication. - TCA9534 I/O expander via I2C to provide 8 additional GPIO lines for extended I/O functionality. - USB1 controller in device mode to support USB peripheral operations. USB OTG mode will be enabled for USB1 controller once the VBUS control based on ID pin is implemented in hd3ss3220.c. - Remoteproc subsystems for supported DSPs such as Audio DSP, Compute DSP and Generic DSP, along with their corresponding firmware. - Configure nvmem-layout on the I2C EEPROM to store data for Ethernet and other consumers. - QCA8081 2.5G Ethernet PHY on port-0 and expose the Ethernet MAC address via nvmem for network configuration. It depends on CONFIG_QCA808X_PHY to use QCA8081 PHY. - Support for the Iris video codec. Written with inputs from : Rakesh Kota - Regulators. Nirmesh Kumar Singh - GPIO expander. Viken Dadhaniya - GPI/QUP. Mohd Ayaan Anwar - Ethernet. Monish Chunara - EEPROM. Vikash Garodia - Iris Video codec. Swati Agarwal - USB. Signed-off-by: Umang Chheda Link: https://lore.kernel.org/r/20250905192350.1223812-3-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 49e55bdbcbe0abf04d7c8c882d69755ecf43d878 Author: Umang Chheda Date: Sat Sep 6 00:53:47 2025 +0530 dt-bindings: arm: qcom: Add Monaco EVK support Introduce new bindings for the Monaco Evaluation Kit (EVK), an IoT board based on the QCS8300 SoC. Signed-off-by: Umang Chheda Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250905192350.1223812-2-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7fd5b4a203cf88d1ad87aff27f9f23aed7b6dbd4 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:37 2025 +0530 arm64: dts: qcom: qcm6490-idp: Add sound card Add the sound card node with tested playback over WSA8835 speakers, digital on-board mics along with wcd9370 headset playabck and record. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-9-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit aa04c298619ff2621691ef1df5e243637d777222 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:36 2025 +0530 arm64: dts: qcom: qcm6490-idp: Add WSA8830 speakers and WCD9370 headset codec Add nodes for WSA8830 speakers and WCD9370 headset codec on qcm6490-idp board and enable lpass macros along with audio support pin controls. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-8-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 48b5ea6de47f58a0b5d1641ea8eb78157666d4a5 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:35 2025 +0530 arm64: dts: qcom: qcs6490-rb3gen2: Add sound card Add the sound card node with tested playback over WSA8835 speakers and digital on-board mics. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250903151337.1037246-7-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b6b4c9f76a8b173a1a1455d181d19b5ab8842a47 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:34 2025 +0530 arm64: dts: qcom: qcs6490-rb3gen2: Add WSA8830 speakers amplifier Add nodes for WSA8830 speakers amplifier on qcs6490-rb3gen2 board. Enable lpass_wsa and lpass_va macros along with pinctrl settings for audio. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-6-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d3c438554c6600fdc49430279e147aae1cb33876 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:33 2025 +0530 arm64: dts: qcom: qcs6490-audioreach: Enable LPASS macros clock settings for audioreach Enable LPASS macros (WSA, VA, RX, TX) and the lpass_tlmm clock required for audioreach functionality. In audioreach solution mclk, npl, and fsgen clocks are managed via the Q6PRM. On SC7280-based boards, the TX CORE clock is used to drive both RX and WSA audio paths following as per hardware design. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-5-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit eec852a4c84259c0fe68aaaed60c26dbf49b4ff2 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:32 2025 +0530 arm64: dts: qcom: sc7280: Add WSA SoundWire and LPASS support Add WSA LPASS macro Codec along with SoundWire controller. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-4-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7c6de7511149da119b3aa9476ce5f746b9a3c786 Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:31 2025 +0530 arm64: dts: qcom: qcs6490-audioreach: Add AudioReach support for QCS6490 Introduce qcs6490-audioreach.dtsi to support AudioReach architecture on QCS6490 platforms. The existing ADSP Bypass DTSI files such as sc7280.dtsi, which is tailored for ADSP Bypass architecture as they lack DSP-specific nodes required for AudioReach. The new qcs6490-audioreach.dtsi file defines nodes for AudioReach specific components such as APM (Audio Process Manager), PRM (Proxy Resource Manager), and GPR (Generic Packet Router). This change enable the audio from the legacy ADSP Bypass solution to the AudioReach framework. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250903151337.1037246-3-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a985fe638344492727528e52416211dda1c391d5 Author: Thomas Weißschuh Date: Thu Aug 21 17:13:03 2025 +0200 kselftest/arm64/gcs: Use nolibc's getauxval() Nolibc now does have getauxval(), use it. Signed-off-by: Thomas Weißschuh Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 740cdafd0d998903c1faeee921028a8a78698be5 Author: Thomas Weißschuh Date: Thu Aug 21 17:13:02 2025 +0200 kselftest/arm64/gcs: Correctly check return value when disabling GCS The return value was not assigned to 'ret', so the check afterwards does not do anything. Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program") Signed-off-by: Thomas Weißschuh Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 7d083666123a425ba9f81dff1a52955b1f226540 Author: Kuninori Morimoto Date: Mon Sep 8 02:10:31 2025 +0000 ASoC: renesas: rz-ssi: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Kuninori Morimoto Message-ID: <87frcx1yp5.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 15583c4dbbf1f3ef44bc5eb8e9936f7069bc61e9 Author: Kuninori Morimoto Date: Mon Sep 8 02:10:25 2025 +0000 ASoC: renesas: fsi: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Kuninori Morimoto Message-ID: <87h5xd1ypa.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 075a730b85e96d3d6f052f04f45c4f8b77fb8d56 Author: Kuninori Morimoto Date: Mon Sep 8 02:10:20 2025 +0000 ASoC: renesas: rsnd: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Kuninori Morimoto Message-ID: <87ikht1ypg.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 16d4b44cf063e90a5495dba26ac9010bb1a77273 Author: Kuninori Morimoto Date: Mon Sep 8 02:08:57 2025 +0000 ASoC: renesas: msiof: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Kuninori Morimoto Message-ID: <87jz291yrr.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 4ea9e8e5066cc14be72a34c30f16a51b10ead279 Author: Qianfeng Rong Date: Tue Aug 19 11:59:34 2025 +0800 soc: qcom: use devm_kcalloc() for array space allocation Replace calls of devm_kzalloc() with devm_kcalloc() in master_stats_probe() for safer memory allocation with built-in overflow protection. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250819035935.434121-1-rongqianfeng@vivo.com Signed-off-by: Bjorn Andersson commit 956f5e5bc80a223cdeaae010bafc17d2ee0c7276 Author: Lucas De Marchi Date: Fri Sep 5 09:22:37 2025 -0700 drm/xe/configfs: Use config_group_put() configfs has a config_group_put() helper that was adopted by commit 88df7939d728 ("drm/xe/configfs: Rename struct xe_config_device"). Another pending work to add psmi later landed in commit afe902848b41 ("drm/xe/configfs: Allow to enable PSMI") and didn't use the helper. Use config_group_put() consistently to hide the inner workings of configfs. No change in behavior since it does exactly the same thing as currently being done. Cc: John Harrison Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250905162236.578117-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi commit 68a74490629eb606ad77a88dd84515f35525e267 Author: Gustavo A. R. Silva Date: Mon Aug 11 22:00:12 2025 +0900 fs: hpfs: Avoid multiple -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with a flexible-array member in the middle of other structs, we use the `struct_group_tagged()` helper to create a new tagged `struct bplus_header_fixed`. This structure groups together all the members of the flexible `struct bplus_header` except the flexible array. As a result, the array is effectively separated from the rest of the members without modifying the memory layout of the flexible structure. We then change the type of the middle struct member currently causing trouble from `struct bplus_header` to `struct bplus_header_fixed`. We also want to ensure that when new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use `static_assert()`. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. This approach avoids having to implement `struct bplus_header_fixed` as a completely separate structure, thus preventing having to maintain two independent but basically identical structures, closing the door to potential bugs in the future. We also use `container_of()` (via a wrapper) whenever we need to retrieve a pointer to the flexible structure, through which we can access the flexible-array member, if necessary. So, with these changes, fix 26 of the following type of warnings: fs/hpfs/hpfs.h:456:23: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/hpfs/hpfs.h:498:23: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mikulas Patocka commit 6341516bc25cef7dff078132905a792790303d59 Author: Akhil P Oommen Date: Mon Sep 8 13:57:09 2025 +0530 drm/msm/a6xx: Enable IFPC on A750 GPU A750 GPU has similar IFPC related configurations like X1-85. Add the IFPC QUIRK to enable IFPC feature. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673386/ Signed-off-by: Rob Clark commit a6a0157cc68ec561392fc81f603b5b9de1a20e4e Author: Akhil P Oommen Date: Mon Sep 8 13:57:08 2025 +0530 drm/msm/a6xx: Enable IFPC on Adreno X1-85 Add the IFPC restore register list and enable IFPC support on Adreno X1-85 gpu. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673384/ Signed-off-by: Rob Clark commit 870d72d000d7d9f788ddc3b079531c313c9d48a8 Author: Akhil P Oommen Date: Mon Sep 8 13:57:07 2025 +0530 drm/msm/a6xx: Make crashstate capture IFPC safe Now with IFPC, GX domain can collapse as soon as GPU becomes IDLE. So add gx_is_on check before accessing any GX registers during crashstate capture and recovery. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673383/ Signed-off-by: Rob Clark commit 62cd0fa6990b03d6618e9031d926a2f672a3d801 Author: Akhil P Oommen Date: Mon Sep 8 13:57:06 2025 +0530 drm/msm/adreno: Disable IFPC when sysprof is active Moving to IFPC state clears the 'Perfcounter Select' register setup by the userspace. So, lets block the IFPC when sysprof is active by using the perfcounter oob signal to the GMU. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673380/ Signed-off-by: Rob Clark commit a242ef4a7577bfd3dbf0b4fb7bf92adca145b0c1 Author: Akhil P Oommen Date: Mon Sep 8 13:57:05 2025 +0530 drm/msm/a6xx: Fix hangcheck for IFPC From the hangcheck handler, KMD checks a few registers in GX domain to see if the GPU made any progress. But it cannot access those registers when IFPC is enabled. Since HW based hang detection is pretty decent, lets rely on it instead of these registers when IFPC is enabled. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673378/ Signed-off-by: Rob Clark commit 365075b7d0b95c737284d6970769e964c7e7052d Author: Akhil P Oommen Date: Mon Sep 8 13:57:04 2025 +0530 drm/msm: Add support for IFPC Add a new quirk to denote IFPC (Inter-Frame Power Collapse) support for a gpu. Based on this flag send the feature ctrl hfi message to GMU to enable IFPC support. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673375/ Signed-off-by: Rob Clark commit 04ca842ef2473120a9587dfe49523c8c243159ea Author: Akhil P Oommen Date: Mon Sep 8 13:57:03 2025 +0530 drm/msm/a6xx: Poll AHB fence status in GPU IRQ handler Even though the GX power domain is kept ON when there is a pending GPU interrupt, there is a small window of potential race with GMU where it may move the AHB fence to 'Drop' mode. Once the GMU sees the pending IRQ, it will move back the fence state to ALLOW mode. Close this race window by polling for AHB fence to ensure that it is in 'Allow' mode. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673377/ Signed-off-by: Rob Clark commit f195421318bd00151b3a111af6f315a25c3438a8 Author: Akhil P Oommen Date: Mon Sep 8 13:57:02 2025 +0530 drm/msm/a6xx: Switch to GMU AO counter CP_ALWAYS_ON counter falls under GX domain which is collapsed during IFPC. So switch to GMU_ALWAYS_ON counter for any CPU reads since it is not impacted by IFPC. Both counters are clocked by same xo clock source. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673373/ Signed-off-by: Rob Clark commit 0e7107a84d391bfab72d7eb96802920b662812c9 Author: Akhil P Oommen Date: Mon Sep 8 13:57:01 2025 +0530 drm/msm/a6xx: Set Keep-alive votes to block IFPC Set Keepalive votes at appropriate places to block IFPC power collapse until we access all the required registers. This is required during gpu IRQ handling and also during preemption. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673369/ Signed-off-by: Rob Clark commit a27d774045566b587bfc1ae9fb122642b06677b8 Author: Akhil P Oommen Date: Mon Sep 8 13:57:00 2025 +0530 drm/msm/adreno: Add fenced regwrite support There are some special registers which are accessible even when GX power domain is collapsed during an IFPC sleep. Accessing these registers wakes up GPU from power collapse and allow programming these registers without additional handshake with GMU. This patch adds support for this special register write sequence. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673368/ Signed-off-by: Rob Clark commit ac9098b1794bc4db463241db7ed090a11dcaa541 Author: Akhil P Oommen Date: Mon Sep 8 13:56:59 2025 +0530 drm/msm: Add an ftrace for gpu register access With IFPC, there is a probability of accessing a GX domain register when it is collapsed, which leads to gmu fence errors. To debug this, we need to trace every gpu register accesses and identify the one just before a gmu fence error. So, add an ftrace to track all gpu register accesses. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673366/ Signed-off-by: Rob Clark commit a477aa67e0a3dafe90da70133272e22cd30cf65f Author: Akhil P Oommen Date: Mon Sep 8 13:56:58 2025 +0530 drm/msm: a6xx: Refactor a6xx_sptprac_enable() A minor refactor to combine the subroutines for legacy a6xx GMUs under a single check. This helps to avoid an unnecessary check and return early from the subroutine for majority of a6xx gpus. Also, document an intermediate unknown low power state which is not exposed by the GMU firmware. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673364/ Signed-off-by: Rob Clark commit f248d5d5159a88ded55329f0b1b463d0f4094228 Author: Akhil P Oommen Date: Mon Sep 8 13:56:57 2025 +0530 drm/msm/a6xx: Fix PDC sleep sequence Since the PDC resides out of the GPU subsystem and cannot be reset in case it enters bad state, utmost care must be taken to trigger the PDC wake/sleep routines in the correct order. The PDC wake sequence can be exercised only after a PDC sleep sequence. Additionally, GMU firmware should initialize a few registers before the KMD can trigger a PDC sleep sequence. So PDC sleep can't be done if the GMU firmware has not initialized. Track these dependencies using a new status variable and trigger PDC sleep/wake sequences appropriately. Cc: stable@vger.kernel.org Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673362/ Signed-off-by: Rob Clark commit ea601501a0afac378d84e109c0e880038f3d6dec Author: Akhil P Oommen Date: Mon Sep 8 13:56:56 2025 +0530 drm/msm/a6xx: Poll additional DRV status A7XX_GEN2 generation has additional TCS slots. Poll the respective DRV status registers before pm suspend. Fixes: 1f8c29e80066 ("drm/msm/a6xx: Add A740 support") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673361/ Signed-off-by: Rob Clark commit 6bf8186d5d551430fdd1c6d5a4a412b30893856f Author: Akhil P Oommen Date: Mon Sep 8 13:56:55 2025 +0530 drm/msm: a6xx: Fix gx_is_on check for a7x family Bitfield definition for REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS register is different in A7XX family. Check the correct bits to see if GX is collapsed on A7XX series. Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support") Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/673358/ Signed-off-by: Rob Clark commit f23e09a60d48195345aabdf007f9c372ed05163f Author: Akhil P Oommen Date: Mon Sep 8 13:56:54 2025 +0530 drm/msm: Update GMU register xml Update GMU register xml with additional definitions for a7x family. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/673356/ Signed-off-by: Rob Clark commit f1f514d730f62fffd8fc160e9fb6df719c7425a7 Author: Barnabás Czémán Date: Wed Sep 3 23:08:24 2025 +0200 dt-bindings: display/msm/gpu: describe A505 clocks Descirbe A505 clocks it is using same clocks like A506. Acked-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Patchwork: https://patchwork.freedesktop.org/patch/672751/ Signed-off-by: Rob Clark commit e05edbcf3a82aa2549b96cfc470907d920a58b97 Author: Dmitry Baryshkov Date: Wed Sep 3 13:51:52 2025 +0300 drm/msm/mdp4: use msm_kms_init_vm() instead of duplicating it Use the msm_kms_init_vm() function to allocate memory manager instead of hand-coding a copy of it. Although MDP4 platforms don't have MDSS device, it's still safe to use the function as all MDP4 devices have IOMMU and the parent of the MDP4 is the root SoC device. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672563/ Signed-off-by: Rob Clark commit 618c11ea0b4a7c42eee9e5699d074c79be104f60 Author: Dmitry Baryshkov Date: Wed Sep 3 13:51:51 2025 +0300 drm/msm: don't return NULL from msm_iommu_new() As we've dropped no-IOMMU support, there is no reason to specially handle the no-IOMMU case inside msm_iommu_new(). Make it return -ENODEV if there is no IOMMU (instead of returning NULL) and simplify all calling sites accordingly. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672561/ Signed-off-by: Rob Clark commit c94fc6d35685587aa0cb9a8d7d7062c73ab04d89 Author: Dmitry Baryshkov Date: Wed Sep 3 13:51:50 2025 +0300 drm/msm: stop supporting no-IOMMU configuration With the switch to GPUVM the msm driver no longer supports the no-IOMMU configurations (even without the actual GPU). Return an error in case we face the lack of the IOMMU. Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672559/ Signed-off-by: Rob Clark commit cc64568b522b64fb8f8c607da9eb4e2d9f72d0cf Author: Dmitry Baryshkov Date: Wed Sep 3 13:51:49 2025 +0300 drm/msm/mdp4: stop supporting no-IOMMU configuration With the switch to GPUVM the msm driver no longer supports the no-IOMMU configurations (even without the actual GPU). Return an error in case we face the lack of the IOMMU for an MDP4 device. Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672557/ Signed-off-by: Rob Clark commit 0584da4515dbb4fec69107ce837eef36a7be5d7d Author: Akhil P Oommen Date: Wed Sep 3 12:49:53 2025 +0530 drm/msm/adreno: Add speedbin data for A623 GPU Add the speedbin mappings for Adreno 623 GPU. Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672462/ Signed-off-by: Rob Clark commit bd9fd5be6bc0836820500f68fff144609fbd85a9 Author: Han Guangjiang Date: Fri Sep 5 18:24:11 2025 +0800 blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs. Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration") Co-developed-by: Liang Jie Signed-off-by: Liang Jie Signed-off-by: Han Guangjiang Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit 50af02425afc72b1b47c4a0a0b9c9bdaa1a1b347 Author: Bala-Vignesh-Reddy Date: Thu Aug 7 17:12:29 2025 +0530 selftests: arm64: Fix -Waddress warning in tpidr2 test Thanks to -Waddress, the compiler warns that the ksft_test_result() invocations in the arm64 tpidr2 selftest are always true. Oops. Fix the test by, err, actually running the test functions. Fixes: 6d80cb73131d ("kselftest/arm64: Convert tpidr2 test to use kselftest.h") Signed-off-by: Bala-Vignesh-Reddy Reviewed-by: Anshuman Khandual Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 7b0604d77a41192316347618cce1d9c795613adb Author: Thorsten Blum Date: Fri Sep 5 12:18:17 2025 +0200 io_uring: Replace kzalloc() + copy_from_user() with memdup_user() Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify io_probe(). No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Jens Axboe commit 473efbc3ca29f725abfb7b323798df596ef41f3e Author: Jens Axboe Date: Mon Sep 8 08:18:15 2025 -0600 io_uring/uring_cmd: fix __io_uring_cmd_do_in_task !CONFIG_IO_URING typo A manual application of this patch resulted in a typo for the stub function __io_uring_cmd_do_in_task(), for the case where CONFIG_IO_URING isn't true. Fix that up. Reported-by: Klara Modin Fixes: df3a7762ee24 ("io_uring/uring_cmd: add io_uring_cmd_tw_t type alias") Signed-off-by: Jens Axboe commit 791d703baddd141dc7b80a69bcd237b6b79150ea Author: Mark Brown Date: Tue Aug 12 15:37:00 2025 +0100 kselftest/arm64: Log error codes in sve-ptrace Use ksft_perror() to report error codes from failing ptrace operations to make it easier to interpret logs when things go wrong. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit c265ae75f900cea4e415230a77b5d152377627dd Author: Pavel Begunkov Date: Mon Sep 8 00:03:00 2025 +0100 io_uring: introduce io_uring querying There are many parameters users might want to query about io_uring like available request types or the ring sizes. This patch introduces an interface for such slow path queries. It was written with several requirements in mind: - Can be used with or without an io_uring instance. Asking for supported setup flags before creating an instance as well as qeurying info about an already created ring are valid use cases. - Should be moderately fast. For example, users might use it to periodically retrieve ring attributes at runtime. As a consequence, it should be able to query multiple attributes in a single syscall. - Backward and forward compatible. - Should be reasobably easy to use. - Reduce the kernel code size for introducing new query types. It's implemented as a new registration opcode IORING_REGISTER_QUERY. The user passes one or more query strutctures linked together, each represented by struct io_uring_query_hdr. The header stores common control fields needed for processing and points to query type specific information. The header contains - The query type - The result field, which on return contains the error code for the query - Pointer to the query type specific information - The size of the query structure. The kernel will only populate up to the size, which helps with backward compatibility. The kernel can also reduce the size, so if the current kernel is older than the inteface the user tries to use, it'll get only the supported bits. - next_entry field is used to chain multiple queries. Apart from common registeration syscall failures, it can only immediately return an error code in case when the headers are incorrect or any other addresses and invalid. That usually mean that the userspace doesn't use the API right and should be corrected. All query type specific errors are returned in the header's result field. As an example, the patch adds a single query type for now, i.e. IO_URING_QUERY_OPCODES, which tells what register / request / etc. opcodes are supported, but there are particular plans to extend it. Note: there is a request probing interface via IORING_REGISTER_PROBE, but it's a mess. It requires the user to create a ring first, it only works for requests, and requires dynamic allocations. Reviewed-by: Martin K. Petersen Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 63805d0a9b9670ade00c4f49e4fe093668b31ba5 Author: Pavel Begunkov Date: Mon Sep 8 00:02:59 2025 +0100 io_uring: add macros for avaliable flags Add constants for supported setup / request / feature flags as well as the feature mask. They'll be used in the next patch. Signed-off-by: Pavel Begunkov Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit da8bc3c81c71eb8906dafca805db1a2639665116 Author: Pavel Begunkov Date: Mon Sep 8 00:02:58 2025 +0100 io_uring: add helper for *REGISTER_SEND_MSG_RING Move handling of IORING_REGISTER_SEND_MSG_RING into a separate function in preparation to growing io_uring_register_blind(). Signed-off-by: Pavel Begunkov Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e Author: Genjian Zhang Date: Fri Aug 15 17:07:32 2025 +0800 null_blk: Fix the description of the cache_size module argument When executing modinfo null_blk, there is an error in the description of module parameter mbps, and the output information of cache_size is incomplete.The output of modinfo before and after applying this patch is as follows: Before: [...] parm: cache_size:ulong [...] parm: mbps:Cache size in MiB for memory-backed device. Default: 0 (none) (uint) [...] After: [...] parm: cache_size:Cache size in MiB for memory-backed device. Default: 0 (none) (ulong) [...] parm: mbps:Limit maximum bandwidth (in MiB/s). Default: 0 (no limit) (uint) [...] Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") Signed-off-by: Genjian Zhang Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 995412e23bb2560a73db444e4c60bf5826b33aaa Author: Ming Lei Date: Sat Aug 30 10:18:23 2025 +0800 blk-mq: Replace tags->lock with SRCU for tag iterators Replace the spinlock in blk_mq_find_and_get_req() with an SRCU read lock around the tag iterators. This is done by: - Holding the SRCU read lock in blk_mq_queue_tag_busy_iter(), blk_mq_tagset_busy_iter(), and blk_mq_hctx_has_requests(). - Removing the now-redundant tags->lock from blk_mq_find_and_get_req(). This change fixes lockup issue in scsi_host_busy() in case of shost->host_blocked. Also avoids big tags->lock when reading disk sysfs attribute `inflight`. Reviewed-by: Hannes Reinecke Signed-off-by: Ming Lei Reviewed-by: Yu Kuai Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 135b8521f21d4d4d4fde74e73b80d8e4d417e20a Author: Ming Lei Date: Sat Aug 30 10:18:22 2025 +0800 blk-mq: Defer freeing flush queue to SRCU callback The freeing of the flush queue/request in blk_mq_exit_hctx() can race with tag iterators that may still be accessing it. To prevent a potential use-after-free, the deallocation should be deferred until after a grace period. With this way, we can replace the big tags->lock in tags iterator code path with srcu for solving the issue. This patch introduces an SRCU-based deferred freeing mechanism for the flush queue. The changes include: - Adding a `rcu_head` to `struct blk_flush_queue`. - Creating a new callback function, `blk_free_flush_queue_callback`, to handle the actual freeing. - Replacing the direct call to `blk_free_flush_queue()` in `blk_mq_exit_hctx()` with `call_srcu()`, using the `tags_srcu` instance to ensure synchronization with tag iterators. Reviewed-by: Hannes Reinecke Reviewed-by: Yu Kuai Signed-off-by: Ming Lei Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit ad0d05dbddc1bf86e92220fea873176de6b12f78 Author: Ming Lei Date: Sat Aug 30 10:18:21 2025 +0800 blk-mq: Defer freeing of tags page_list to SRCU callback Tag iterators can race with the freeing of the request pages(tags->page_list), potentially leading to use-after-free issues. Defer the freeing of the page list and the tags structure itself until after an SRCU grace period has passed. This ensures that any concurrent tag iterators have completed before the memory is released. With this way, we can replace the big tags->lock in tags iterator code path with srcu for solving the issue. This is achieved by: - Adding a new `srcu_struct tags_srcu` to `blk_mq_tag_set` to protect tag map iteration. - Adding an `rcu_head` to `struct blk_mq_tags` to be used with `call_srcu`. - Moving the page list freeing logic and the `kfree(tags)` call into a new callback function, `blk_mq_free_tags_callback`. - In `blk_mq_free_tags`, invoking `call_srcu` to schedule the new callback for deferred execution. The read-side protection for the tag iterators will be added in a subsequent patch. Reviewed-by: Hannes Reinecke Reviewed-by: Yu Kuai Signed-off-by: Ming Lei Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 9ad8e5af327904dcc52e64ee5ab731c7018ffb0f Author: Ming Lei Date: Sat Aug 30 10:18:20 2025 +0800 blk-mq: Pass tag_set to blk_mq_free_rq_map/tags To prepare for converting the tag->rqs freeing to be SRCU-based, the tag_set is needed in the freeing helper functions. This patch adds 'struct blk_mq_tag_set *' as the first parameter to blk_mq_free_rq_map() and blk_mq_free_tags(), and updates all their call sites. This allows access to the tag_set's SRCU structure in the next step, which will be used to free the tag maps after a grace period. No functional change is intended in this patch. Reviewed-by: Hannes Reinecke Reviewed-by: Yu Kuai Signed-off-by: Ming Lei Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit aba19ee71cd7c0253612d6a2a0b3a828ba9ece29 Author: Ming Lei Date: Sat Aug 30 10:18:19 2025 +0800 blk-mq: Move flush queue allocation into blk_mq_init_hctx() Move flush queue allocation into blk_mq_init_hctx() and its release into blk_mq_exit_hctx(), and prepare for replacing tags->lock with SRCU to draining inflight request walking. blk_mq_exit_hctx() is the last chance for us to get valid `tag_set` reference, and we need to add one SRCU to `tag_set` for freeing flush request via call_srcu(). It is safe to move flush queue & request release into blk_mq_exit_hctx(), because blk_mq_clear_flush_rq_mapping() clears the flush request reference int driver tags inflight request table, meantime inflight request walking is drained. Reviewed-by: Hannes Reinecke Reviewed-by: Yu Kuai Signed-off-by: Ming Lei Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit a679e5683d3eef22ca12514ff8784b2b914ebedc Author: Bala-Vignesh-Reddy Date: Fri Aug 8 13:38:30 2025 +0530 selftests: arm64: Check fread return value in exec_target Fix -Wunused-result warning generated when compiled with gcc 13.3.0, by checking fread's return value and handling errors, preventing potential failures when reading from stdin. Fixes compiler warning: warning: ignoring return value of 'fread' declared with attribute 'warn_unused_result' [-Wunused-result] Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") Signed-off-by: Bala-Vignesh-Reddy Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit e0c26569d3ad5a5ad0283b72ec91581bec581845 Author: Brian Masney Date: Mon Aug 11 11:19:46 2025 -0400 clk: fixed-factor: drop round_rate() clk ops This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops. Also all clk drivers that directly calls fixed-factor's round_rate() have been migrated over to determine_rate(). So let's remove the round_rate() clk ops. Reviewed-by: Alexander Sverdlin Signed-off-by: Brian Masney commit d228ece36345d56bb862cc0e5c3575e3097d8dac Author: Brian Masney Date: Mon Aug 11 11:19:43 2025 -0400 clk: divider: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops. Also all clk drivers that directly calls divider's round_rate() have been migrated over to determine_rate(). So let's remove the round_rate() clk ops. Reviewed-by: Alexander Sverdlin Reviewed-by: Geert Uytterhoeven Signed-off-by: Brian Masney commit e7666eae4858ceb72a0499e4e2a78e0296ca1d35 Author: Brian Masney Date: Mon Aug 11 11:19:42 2025 -0400 clk: visconti: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Nobuhiro Iwamatsu Signed-off-by: Brian Masney commit 775e96539dcf980f7f7887feb0732cd7c3e55bc6 Author: Brian Masney Date: Mon Aug 11 11:19:41 2025 -0400 clk: versatile: vexpress-osc: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Linus Walleij Signed-off-by: Brian Masney commit ef6fd5ce7d1d7aacab351219f295757d24a5e414 Author: Brian Masney Date: Mon Aug 11 11:19:40 2025 -0400 clk: versatile: icst: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Linus Walleij Signed-off-by: Brian Masney commit b4d5ebcf69fa99c11ca9489b1a6e290d206bf3f7 Author: Brian Masney Date: Mon Aug 11 11:19:39 2025 -0400 clk: versaclock7: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 7bf7153230f7bb14d9410d998ac083d73405d926 Author: Brian Masney Date: Mon Aug 11 11:19:38 2025 -0400 clk: versaclock5: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Luca Ceresoli Signed-off-by: Brian Masney commit 7a19c341d54c97fdd09c232ce14b4a2fcdd71d9b Author: Brian Masney Date: Mon Aug 11 11:19:37 2025 -0400 clk: ux500: prcmu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Linus Walleij Signed-off-by: Brian Masney commit f32c0f8b9097e8c077b804ca4d2741a4cd90217d Author: Brian Masney Date: Mon Aug 11 11:19:36 2025 -0400 clk: spear: vco-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 2767256c6faab122d3d26e0027be0febdd78f56a Author: Brian Masney Date: Mon Aug 11 11:19:35 2025 -0400 clk: spear: gpt-synth: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 9ea41da306cd5c535c46b0606cc200774d5da952 Author: Brian Masney Date: Mon Aug 11 11:19:34 2025 -0400 clk: spear: frac-synth: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit f705ed70873e166a25b1332d4b4d7bdc4d14bd64 Author: Brian Masney Date: Mon Aug 11 11:19:33 2025 -0400 clk: spear: aux-synth: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit d61a1ba87b64ac994895e4e7134e43dfd810f824 Author: Brian Masney Date: Mon Aug 11 11:19:32 2025 -0400 clk: sp7021: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 25370bf23673af60bd4cbb4ed3b4a22477b51464 Author: Brian Masney Date: Mon Aug 11 11:19:28 2025 -0400 clk: rockchip: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 1952881181e2426fad4c0bdee1b7a9f5090f4928 Author: Brian Masney Date: Mon Aug 11 11:19:26 2025 -0400 clk: rockchip: ddr: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit b6f90511c165a2c546650f26d810280237440cb1 Author: Brian Masney Date: Mon Aug 11 11:19:23 2025 -0400 clk: qcom: regmap-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Note that prior to running the Coccinelle, div_round_ro_rate() was renamed to div_ro_round_rate(). Reviewed-by: Konrad Dybcio Signed-off-by: Brian Masney commit 34848e21cb1b8052a06aa2517e28b6335319a0fa Author: Brian Masney Date: Mon Aug 11 11:19:21 2025 -0400 clk: mvebu: dove-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 27dbfefd16959afb606d7ac62abea08036b8caff Author: Brian Masney Date: Mon Aug 11 11:19:20 2025 -0400 clk: mvebu: cpu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 9a649ab1cf64c9709b43cdfdc37e2ba2f200f5d0 Author: Brian Masney Date: Mon Aug 11 11:19:19 2025 -0400 clk: mvebu: corediv: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 4b76d76f6f7f99fc525663b8d204d8719c37cd88 Author: Brian Masney Date: Mon Aug 11 11:19:18 2025 -0400 clk: mvebu: armada-37xx-periph: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit a540d5d408f65f381a19134d17b55f5e69c48435 Author: Brian Masney Date: Mon Aug 11 11:19:17 2025 -0400 clk: mvebu: ap-cpu-clk: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 5ea721896c36be7aac161a348b9e097758561402 Author: Brian Masney Date: Mon Aug 11 11:19:16 2025 -0400 clk: mstar: msc313-cpupll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Daniel Palmer Signed-off-by: Brian Masney commit e9f039c08cdc9b38665aee9a88ae21f59c09ba8c Author: Brian Masney Date: Mon Aug 11 11:19:15 2025 -0400 clk: microchip: core: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 5c2b6d0fdb637ee840f03127fabcff00a69845dc Author: Brian Masney Date: Mon Aug 11 11:19:14 2025 -0400 clk: mediatek: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 23603ba6eff5b16b6e361ee5d8f1933934bbe619 Author: Brian Masney Date: Mon Aug 11 11:19:13 2025 -0400 clk: hsdk-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit ab0fde4ef51c75f7668e58c3ef889fbe802d7316 Author: Brian Masney Date: Mon Aug 11 11:19:12 2025 -0400 clk: cdce706: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 64613d7fb42f99e955ef4c46b5772b820c3b169d Author: Brian Masney Date: Mon Aug 11 11:19:11 2025 -0400 clk: bm1880: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit e84e82e5760ade3b909254d20ac67b51d26b101b Author: Brian Masney Date: Mon Aug 11 11:19:10 2025 -0400 clk: bcm: iproc-asiu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 8987b993571005d152186b0cde130a03792aae2a Author: Brian Masney Date: Mon Aug 11 11:19:09 2025 -0400 clk: axs10x: pll_clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit fccbfc5d77983b3449e55942a2248b2718cd4be4 Author: Brian Masney Date: Mon Aug 11 11:19:08 2025 -0400 clk: axs10x: i2s_pll_clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 3b8f82ca44ddfb1d78f212313145797c5f4f3158 Author: Brian Masney Date: Mon Aug 11 11:19:07 2025 -0400 clk: apple-nco: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Janne Grunau Signed-off-by: Brian Masney commit 234b3015358e4fd2271d187d216f91a829bd6255 Author: Brian Masney Date: Mon Aug 11 11:19:06 2025 -0400 clk: actions: owl-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 670f7b27117c139e6470ce35c31506ff7147ea72 Author: Brian Masney Date: Mon Aug 11 11:19:05 2025 -0400 clk: actions: owl-factor: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 1b04e12a8bcc3315f1546f2b2a6b2ccca8c4696c Author: Brian Masney Date: Mon Aug 11 11:19:04 2025 -0400 clk: actions: owl-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 151831541ae0f2a5d207a152a510b9ff5e8105cc Author: Brian Masney Date: Mon Aug 11 11:19:03 2025 -0400 clk: actions: owl-composite: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 1547747b55d5d6c045cd94f4c4595b8f38d3b21c Author: Brian Masney Date: Mon Aug 11 11:19:02 2025 -0400 clk: zynq: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 193650c7a87339da14e34b5fe81585535ee77708 Author: Brian Masney Date: Mon Aug 11 11:19:01 2025 -0400 clk: zynqmp: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 5352b65041cbb546d8c4d386762370e6ad0d1f42 Author: Brian Masney Date: Mon Aug 11 11:18:59 2025 -0400 clk: xilinx: xlnx_vcu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 18fdeebb4d1d3d30a0c2994e8150ce1f85e7d8c1 Author: Brian Masney Date: Mon Aug 11 11:18:58 2025 -0400 clk: xilinx: xlnx-clock-wizard: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit f95ed76fbe61ee473ed682f93de3578cf6c60a1a Author: Brian Masney Date: Mon Aug 11 11:18:57 2025 -0400 clk: xgene: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit d616db080a0b9e006c2b3f57a2a8f3bfc67dc8e0 Author: Brian Masney Date: Mon Aug 11 11:18:55 2025 -0400 clk: wm831x: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Richard Fitzgerald Signed-off-by: Brian Masney commit ff03cca71ebd54eba32ba7628bc7b3ee1cc2e79f Author: Brian Masney Date: Mon Aug 11 11:18:54 2025 -0400 clk: vt8500: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 9e3372b2ebac86591a41151bdd073a9942ca9a46 Author: Brian Masney Date: Mon Aug 11 11:18:53 2025 -0400 clk: versaclock3: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit eb785c6f395b98f4d1b6c8e2575e03676711736d Author: Brian Masney Date: Mon Aug 11 11:18:52 2025 -0400 clk: tps68470: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 81c438b53bfdcf915475c14e9e3ad409c665de06 Author: Brian Masney Date: Mon Aug 11 11:18:51 2025 -0400 clk: stm32: stm32mp1: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Gabriel Fernandez Signed-off-by: Brian Masney commit cd1cb38836c0fc597718f300f7d19fcea1117a3c Author: Brian Masney Date: Mon Aug 11 11:18:50 2025 -0400 clk: stm32: stm32-core: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Gabriel Fernandez Signed-off-by: Brian Masney commit 028b0eb1c9e66470f9a15e758a3757d13911919b Author: Brian Masney Date: Mon Aug 11 11:18:49 2025 -0400 clk: stm32f4: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 639baa3ce27f43224a9e7904d85395935dd4b04f Author: Brian Masney Date: Mon Aug 11 11:18:48 2025 -0400 clk: st: clkgen-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Note that prior to running the Coccinelle: - round_rate_stm_pll4600c28() was renamed to stm_pll4600c28_round_rate() - round_rate_stm_pll3200c32() was renamed to stm_pll3200c32_round_rate() Signed-off-by: Brian Masney commit 78d4c18e636833cfd3670ddd96d42d0d21318769 Author: Brian Masney Date: Mon Aug 11 11:18:47 2025 -0400 clk: st: clkgen-fsyn: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit c349d81d6b9a0d5edcfd6183078cd18957fb0ea6 Author: Brian Masney Date: Mon Aug 11 11:18:46 2025 -0400 clk: sprd: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Chunyan Zhang Signed-off-by: Brian Masney commit deb4740a5ff89957309b0479210af7448f1846f2 Author: Brian Masney Date: Mon Aug 11 11:18:45 2025 -0400 clk: sprd: div: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Chunyan Zhang Signed-off-by: Brian Masney commit 19271e0d45221ce5767cd9ba50334f8479f09b3a Author: Brian Masney Date: Mon Aug 11 11:18:44 2025 -0400 clk: sparx5: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 897c23b906cdc271380cef55ea81301f0dd70593 Author: Brian Masney Date: Mon Aug 11 11:18:39 2025 -0400 clk: sophgo: cv18xx-ip: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Alexander Sverdlin Signed-off-by: Brian Masney commit ff04a06db62669d8c4b69ebb02812b2a9f21d4b8 Author: Brian Masney Date: Mon Aug 11 11:18:38 2025 -0400 clk: sifive: sifive-prci: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Note that the changes to the three header files were done by hand. Reviewed-by: Samuel Holland Signed-off-by: Brian Masney commit 3859ce9eeb326ebda5d5dd1ca4db733da6c9891f Author: Brian Masney Date: Mon Aug 11 11:18:37 2025 -0400 clk: si570: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 0d4ccc375673da246050430817f409c392d0ef0b Author: Brian Masney Date: Mon Aug 11 11:18:36 2025 -0400 clk: si544: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 90d00a531ea1d785f98de9dce668915928b0dd52 Author: Brian Masney Date: Mon Aug 11 11:18:35 2025 -0400 clk: si5341: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 6a5626809ca6e6d696bf9e5039e6370d2c128888 Author: Brian Masney Date: Mon Aug 11 11:18:34 2025 -0400 clk: si521xx: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit cf93c12ba4342f5b93ff7dd3dfedb299aa4f2552 Author: Brian Masney Date: Mon Aug 11 11:18:33 2025 -0400 clk: si514: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 6a67550bc4da6f4f852a2593f893db3c9840a9c7 Author: Brian Masney Date: Mon Aug 11 11:18:32 2025 -0400 clk: scpi: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 1c7452aa7577d8b521eae162a5a51d7408902985 Author: Brian Masney Date: Mon Aug 11 11:18:31 2025 -0400 clk: pistachio: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit b46a3d323a5b7942e65025254c13801d0f475f02 Author: Brian Masney Date: Mon Aug 11 11:18:29 2025 -0400 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit cd9e9bbfd93be277e316ee854614e2c4cd502fa8 Author: Brian Masney Date: Mon Aug 11 11:18:28 2025 -0400 clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 215f8aa095a1e3384ab5d84bae6b86cab0e491be Author: Brian Masney Date: Mon Aug 11 11:18:27 2025 -0400 clk: nuvoton: ma35d1-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit b248bd3c0525feb7d0e2d2ca5930e5e95261eb4c Author: Brian Masney Date: Mon Aug 11 11:18:26 2025 -0400 clk: mxs: ref: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 755e4880f950221b6944b33dcab94093940d02b9 Author: Brian Masney Date: Mon Aug 11 11:18:25 2025 -0400 clk: mxs: frac: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit da730b17aae9daa221e6de2c48303b3fb684f683 Author: Brian Masney Date: Mon Aug 11 11:18:24 2025 -0400 clk: mxs: div: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to call div->ops->determine_rate() instead of div->ops->round_rate() was done by hand. Signed-off-by: Brian Masney commit 772e2dc59c9c5ec419b3db8f867c0d65d44a9590 Author: Brian Masney Date: Mon Aug 11 11:18:23 2025 -0400 clk: multiplier: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 4a7aeef18bc568e05962ba7c25f0782970fe5d1d Author: Brian Masney Date: Mon Aug 11 11:18:22 2025 -0400 clk: mmp: frac: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 2ffc3f1f39647e522a19a917ec105a96301c5d74 Author: Brian Masney Date: Mon Aug 11 11:18:21 2025 -0400 clk: mmp: audio: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 7b45988fcf7895b2f044c216e09ba3b68764a24d Author: Brian Masney Date: Mon Aug 11 11:18:20 2025 -0400 clk: milbeaut: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 4f8ccd92870d6be4c11ae4440ee7c3ded4d4bd70 Author: Brian Masney Date: Mon Aug 11 11:18:19 2025 -0400 clk: max9485: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit bb40a2ef4fc9d7cef4b03e1b1906b512d9693dd9 Author: Brian Masney Date: Mon Aug 11 11:18:18 2025 -0400 clk: loongson1: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 94f872e762725deb751e0fc56a9d8fe187945d2b Author: Brian Masney Date: Mon Aug 11 11:18:17 2025 -0400 clk: lmk04832: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 888b3f35c01da7964120e79a9cfae6e1445c3e60 Author: Brian Masney Date: Mon Aug 11 11:18:16 2025 -0400 clk: ingenic: x1000-cgu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Paul Cercueil Signed-off-by: Brian Masney commit 2c52ae540c1f26ac7af86b7fa5a0789889436c2e Author: Brian Masney Date: Mon Aug 11 11:18:15 2025 -0400 clk: ingenic: jz4780-cgu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 93fc8a13df28fb59c3d0aeb8ba65bbd5a72dad0f Author: Brian Masney Date: Mon Aug 11 11:18:14 2025 -0400 clk: ingenic: cgu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Paul Cercueil Signed-off-by: Brian Masney commit d983ced6cfe906468d0c63b1eae2880f4d2639c9 Author: Brian Masney Date: Mon Aug 11 11:18:13 2025 -0400 clk: hisilicon: hi6220-stub: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 97827aa9721844c874cbac54af4b95bad9c21fab Author: Brian Masney Date: Mon Aug 11 11:18:12 2025 -0400 clk: hisilicon: hi3660-stub: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit bd6fede0903245bbe62cc1554ff399250776b34b Author: Brian Masney Date: Mon Aug 11 11:18:11 2025 -0400 clk: hisilicon: hi3660-stub: move comma from declaration of DEFINE_CLK_STUB() When trying to use Coccinelle to make changes inside drivers/clk/, it really does not like the trailing comma at the end of the declaration of DEFINE_CLK_STUB, and fails to process this file. It also looks weird to not have commas to separate the various array members of hi3660_stub_clks. Let's move the trailing comma out of the define so that Coccinelle can be ran against this source file. Signed-off-by: Brian Masney commit 619a6210f398eb4ff170bb3eb070dc578cf1cd0c Author: Brian Masney Date: Mon Aug 11 11:18:10 2025 -0400 clk: hisilicon: clkdivider-hi6220: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 29d6d9e5299dc9fb67cb7176b90984da46cc4f9e Author: Brian Masney Date: Mon Aug 11 11:18:09 2025 -0400 clk: highbank: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 2ffdd7fbf7af47839ae79aeafc3d33138cf1c72f Author: Brian Masney Date: Mon Aug 11 11:18:08 2025 -0400 clk: gemini: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Linus Walleij Signed-off-by: Brian Masney commit b87d7e655a86a0f7a9b1d98070fd8540781f9b73 Author: Brian Masney Date: Mon Aug 11 11:18:07 2025 -0400 clk: fractional-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 986a96226cd3a20836425deb8a281efb8ff37b9d Author: Brian Masney Date: Mon Aug 11 11:18:06 2025 -0400 clk: ep93xx: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Alexander Sverdlin Signed-off-by: Brian Masney commit 2233ab21bc81dadabed0bd4a9392b7b353445965 Author: Brian Masney Date: Mon Aug 11 11:18:05 2025 -0400 clk: cs2000-cp: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit b2b354b075c726ddbd5f2778208392249daa0a39 Author: Brian Masney Date: Mon Aug 11 11:18:04 2025 -0400 clk: cdce925: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit eae23ade8f91ae3f6bbbc0e748787ac0b9d222db Author: Brian Masney Date: Mon Aug 11 11:18:03 2025 -0400 clk: baikal-t1: ccu-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 9c8a3c6ecba07ba37bd12634d1d363be18e8ba60 Author: Brian Masney Date: Mon Aug 11 11:18:02 2025 -0400 clk: baikal-t1: ccu-div: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit a31de1a36e6d2ffa957822e7b7d53bcb2608cb39 Author: Brian Masney Date: Mon Aug 11 11:18:01 2025 -0400 clk: at91: usb: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit fcf97201711822d90cea8132ca631e267f5d8c1f Author: Brian Masney Date: Mon Aug 11 11:18:00 2025 -0400 clk: at91: sam9x60-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 3c117b696a8a9733fe9b8affc5a13536c60ff730 Author: Brian Masney Date: Mon Aug 11 11:17:59 2025 -0400 clk: at91: plldiv: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit a635d6b4c7a89b49085016239a483f3cb26de330 Author: Brian Masney Date: Mon Aug 11 11:17:58 2025 -0400 clk: at91: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 1ddde15e99a2033c8e21a9ab34a72f166c4bd385 Author: Brian Masney Date: Mon Aug 11 11:17:57 2025 -0400 clk: at91: h32mx: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit ae139c6addbe71ce2459a377c7695494311ef62d Author: Brian Masney Date: Mon Aug 11 11:17:56 2025 -0400 clk: at91: audio-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 582de809b052892e1338508374f562e823b29566 Author: Brian Masney Date: Mon Aug 11 11:17:55 2025 -0400 clk: fixed-factor: add determine_rate() ops The round_rate() clk ops is deprecated, and determine_rate() should be used instead. We can't just simply convert this driver over initially since other drivers depend on this. So let's go ahead and add a determine_rate() clk ops. Once all of the drivers have been converted, then the round_rate() clk ops can be dropped. Signed-off-by: Brian Masney commit 9236145ffba286e819a37ce84c3b084127dfa208 Author: Brian Masney Date: Mon Aug 11 11:17:54 2025 -0400 clk: at91: peripheral: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. This driver already has a clk_sam9x5_peripheral_determine_rate() implementation, however it can change the parent rate. The existing round rate does not have this functionality. I could add a check for CLK_SET_RATE_PARENT, and combine the two functions, however there are some other minor differences in the two implementations. I don't have access to this particular hardware. I believe that they could be combined, however it would need to be tested on real hardware. So, let's play it safe and convert the existing round rate implementation to ensure that the driver keeps the same functionality as before. Reviewed-by: Alexander Sverdlin Signed-off-by: Brian Masney commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 Author: Brian Masney Date: Mon Aug 11 11:17:53 2025 -0400 clk: at91: peripheral: fix return value determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate. Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate") Reviewed-by: Alexander Sverdlin Acked-by: Nicolas Ferre Signed-off-by: Brian Masney commit 0f9cf96a01fd8cb690292a5c24fbfda5c6dd47b2 Author: Brian Masney Date: Thu Aug 28 20:38:27 2025 -0400 clk: zynqmp: divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit f7a6bed91a19304465f318fd05b2e04670584580 Author: Brian Masney Date: Thu Aug 28 20:38:26 2025 -0400 clk: x86: cgu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit d4c515a21b238844cfc3108405bbb0f210cf6d3b Author: Brian Masney Date: Thu Aug 28 20:38:25 2025 -0400 clk: sophgo: sg2042-pll: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. The implementation of sg2042_clk_pll_determine_rate() calls sg2042_clk_pll_round_rate(), so this folds the two into a single function. Reviewed-by: Chen Wang Tested-by: Chen Wang # Pioneerbox Signed-off-by: Brian Masney commit 9a3b6993613d3fac3b29e44688b865972ff732fd Author: Brian Masney Date: Thu Aug 28 20:38:24 2025 -0400 clk: sophgo: sg2042-clkgen: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Reviewed-by: Chen Wang Tested-by: Chen Wang # Pioneerbox Signed-off-by: Brian Masney commit e20c5abec9e3f37f52d97fd962007e0346850f65 Author: Brian Masney Date: Thu Aug 28 20:38:22 2025 -0400 clk: rockchip: half-divider: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney commit 0879768df24027dad5810cb81a4c73d8ed070a25 Author: Brian Masney Date: Thu Aug 28 20:38:20 2025 -0400 clk: nxp: lpc32xx: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Note that the changes involving LPC32XX_DEFINE_PLL_OPS were done by hand. Signed-off-by: Brian Masney commit 8742bebb846009af7a22e489fe99aced5e195b51 Author: Dmitry Torokhov Date: Sat Sep 6 09:17:58 2025 -0700 Input: synaptics-rmi4 - add includes for types used in rmi_2d_sensor.h Headers should include definitions for types that they use. Signed-off-by: Dmitry Torokhov commit c6c973dbfa5e34b1572bcd1852adcad1b5d08fab Author: Uros Bizjak Date: Sun Sep 7 20:33:38 2025 +0200 x86/asm: Remove code depending on __GCC_ASM_FLAG_OUTPUTS__ The minimum supported GCC version is 8.1, which supports flag output operands and always defines __GCC_ASM_FLAG_OUTPUTS__ macro. Remove code depending on __GCC_ASM_FLAG_OUTPUTS__ and use the "=@ccCOND" flag output operand directly. Use the equivalent "=@ccz" instead of "=@cce" flag output operand for CMPXCHG8B and CMPXCHG16B instructions. These instructions set a single flag bit - the Zero flag - and "=@ccz" is used to distinguish the CC user from comparison instructions, where set ZERO flag indeed means that the values are equal. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250905121723.GCaLrU04lP2A50PT-B@fat_crate.local commit 890ba82a60cb7a6584968a4ac15546f434afa40b Author: Dmitry Torokhov Date: Sun Aug 17 14:39:06 2025 -0700 Input: spear-keyboard - drop support for platform data There are no in-kernel users of spear kbd_platform_data in the kernel, and the driver supports configuration via device tree, so drop support of static platform data and move properties parsing from OF-specific methods to generic ones. Link: https://lore.kernel.org/r/vppjxui76im26uamznx7evm5lmbe3d6v3oxsa7mqyytykh4zm6@nhlf33v3hp6g Signed-off-by: Dmitry Torokhov commit ca734f54b346db170be20ff3382bc3da8eb65904 Author: Dmitry Torokhov Date: Sun Aug 17 14:53:15 2025 -0700 Input: pxa27x-keypad - drop support for platform data There are no in-kernel users of pxa27x_keypad_platform_data in the kernel, and the driver supports configuration via device tree, so drop support of static platform data and move properties parsing from OF-specific methods to generic ones. Link: https://lore.kernel.org/r/20250817215316.1872689-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 770f82c649502692c74bf13b933cbec9309091bc Author: Dmitry Torokhov Date: Sun Aug 17 14:53:14 2025 -0700 Input: pxa27x-keypad - use BIT, GENMASK, FIELD_GET, etc Instead of using explicit binary values for masks and shifts to do bit operations use appropriate macros. Link: https://lore.kernel.org/r/20250817215316.1872689-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 53e49cbece39dec1c8668aae721a47a1155edb4a Author: Dmitry Torokhov Date: Sun Aug 17 14:53:13 2025 -0700 Input: pxa27x-keypad - replace uint32_t with u32 u32 is preferred way to refer to unsigned 32 bit values in the kernel, use it instead of uint32_t. Link: https://lore.kernel.org/r/20250817215316.1872689-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 3ad2a7b9b15d5072139a20be84adb36776eb6c9b Author: Guenter Roeck Date: Thu Jun 5 16:23:57 2025 -0700 hwmon: Serialize accesses in hwmon core Implement locking in the hardware monitoring core for drivers using the _with_info() API functions. Most hardware monitoring drivers need to support locking to protect against parallel accesses from userspace. With older API functions, such locking had to be implemented in the driver code since sysfs attributes were created by the driver. However, the _with_info() API creates sysfs attributes in the hardware monitoring core. This makes it easy to move the locking primitives into that code. This has the benefit of simplifying driver code while at the same time reducing the risk of incomplete of bad locking implementations in hardware monitoring drivers. While this means that all accesses are forced to be synchronized, this has little if any practical impact since accesses are expected to be low frequency and are typically synchronized from userspace anyway since only a single process is accessing the data. On top of that, many drivers use regmap, which also has its own locking scheme and already serializes accesses. Signed-off-by: Guenter Roeck commit 90bad684e9ac5ae435c2715fab36f6799849e800 Author: Wensheng Wang Date: Tue Aug 5 18:20:20 2025 +0800 hwmon: add MP29502 driver Add support for MPS VR controller mp29502. This driver exposes telemetry and limits value readings and writtings. Signed-off-by: Wensheng Wang Link: https://lore.kernel.org/r/20250805102020.749850-3-wenswang@yeah.net [groeck: Fixed document formatting] Signed-off-by: Guenter Roeck commit 3ec600210849cf122606e24caab85f0b936cf63c Author: Fabien Proriol Date: Mon Jul 7 17:55:08 2025 +0200 power: supply: sbs-charger: Support multiple devices If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail: [ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered [ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger' [ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22 [ 8.151974] Hardware name: ALE AMB (DT) [ 8.155828] Call trace: [ 8.158292] dump_backtrace+0x0/0x1d4 [ 8.161960] show_stack+0x18/0x6c [ 8.165280] dump_stack+0xcc/0x128 [ 8.168687] sysfs_warn_dup+0x60/0x7c [ 8.172353] sysfs_do_create_link_sd+0xf0/0x100 [ 8.176886] sysfs_create_link+0x20/0x40 [ 8.180816] device_add+0x270/0x7a4 [ 8.184311] __power_supply_register+0x304/0x560 [ 8.188930] devm_power_supply_register+0x54/0xa0 [ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger] [ 8.198183] i2c_device_probe+0x2dc/0x2f4 [ 8.202196] really_probe+0xf0/0x510 [ 8.205774] driver_probe_device+0xfc/0x160 [ 8.209960] device_driver_attach+0xc0/0xcc [ 8.214146] __driver_attach+0xc0/0x170 [ 8.218002] bus_for_each_dev+0x74/0xd4 [ 8.221862] driver_attach+0x24/0x30 [ 8.225444] bus_add_driver+0x148/0x250 [ 8.229283] driver_register+0x78/0x130 [ 8.233140] i2c_register_driver+0x4c/0xe0 [ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger] [ 8.242424] do_one_initcall+0x50/0x1b0 [ 8.242434] do_init_module+0x44/0x230 [ 8.242438] load_module+0x2200/0x27c0 [ 8.242442] __do_sys_finit_module+0xa8/0x11c [ 8.242447] __arm64_sys_finit_module+0x20/0x30 [ 8.242457] el0_svc_common.constprop.0+0x64/0x154 [ 8.242464] do_el0_svc+0x24/0x8c [ 8.242474] el0_svc+0x10/0x20 [ 8.242481] el0_sync_handler+0x108/0x114 [ 8.242485] el0_sync+0x180/0x1c0 [ 8.243847] sbs-charger 20-0009: Failed to register power supply [ 8.287934] sbs-charger: probe of 20-0009 failed with error -17 This is mainly because the "name" field of power_supply_desc is a constant. This patch fixes the issue by reusing the same approach as sbs-battery. With this patch, the result is: [ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered [ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered Signed-off-by: Fabien Proriol Signed-off-by: Sebastian Reichel commit 87ebcd8baebf93b9d763dba5ee31e8fda62daec6 Author: Pankaj Patil Date: Fri Sep 5 20:40:20 2025 +0530 pinctrl: qcom: Add glymur pinctrl driver Add TLMM pinctrl driver to support pin configuration with pinctrl framework for Glymur SoC. Reviewed-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Signed-off-by: Pankaj Patil Signed-off-by: Linus Walleij commit ebe397530638859853738ac1fcd082e1a0fdacdc Author: Pankaj Patil Date: Fri Sep 5 20:40:19 2025 +0530 dt-bindings: pinctrl: qcom: Add Glymur pinctrl Add DeviceTree binding for Glymur SoC TLMM block Reviewed-by: Krzysztof Kozlowski Signed-off-by: Pankaj Patil Signed-off-by: Linus Walleij commit 306c8959b5fdfdc3900aebe4e56257a349f5765f Author: Leander Kieweg Date: Mon Aug 18 13:35:29 2025 +0200 drm/tiny/bochs: Convert dev_err() to drm_err() The DRM subsystem has a set of preferred, prefixed logging functions (drm_info, drm_warn, drm_err) which improve debuggability by including the driver and function name in the log output. As part of the ongoing effort to modernize logging calls, convert a dev_err() call in the bochs hardware initialization function to its drm_err() equivalent. This work was suggested by the DRM TODO list. Signed-off-by: Leander Kieweg Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250818113530.187440-1-kieweg.leander@gmail.com commit d0856a6dff57f95cc5d2d74e50880f01697d0cc4 Author: Adam Xue Date: Fri Sep 5 10:41:18 2025 -0700 bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() In mhi_init_irq_setup, the device pointer used for dev_err() was not initialized. Use the pointer from mhi_cntrl instead. Fixes: b0fc0167f254 ("bus: mhi: core: Allow shared IRQ for event rings") Fixes: 3000f85b8f47 ("bus: mhi: core: Add support for basic PM operations") Signed-off-by: Adam Xue [mani: reworded subject/description and CCed stable] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250905174118.38512-1-zxue@semtech.com commit 5f3cec21f6d57336a2cbfa9ee428ac66c77a7211 Author: Jani Nikula Date: Fri Aug 29 20:46:01 2025 +0300 overflow: add range_overflows() and range_end_overflows() Move the range_overflows() and range_end_overflows() along with the _t variants over from drm/i915 and drm/buddy to overflow.h. Cc: Kees Cook Cc: "Gustavo A. R. Silva" Cc: linux-hardening@vger.kernel.org Reviewed-by: Kees Cook Reviewed-by: Jouni Högander Acked-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250829174601.2163064-3-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 59bf37add1d2223d699d1855354277b7330765e4 Author: Jani Nikula Date: Fri Aug 29 20:46:00 2025 +0300 drm/i915: document range_overflows() and range_end_overflows() macros Document the macros in preparation for making them more generally available. Cc: Kees Cook Cc: "Gustavo A. R. Silva" Cc: linux-hardening@vger.kernel.org Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250829174601.2163064-2-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1e4c85167cf672312a178b2af0b058add77e448b Author: Jani Nikula Date: Fri Aug 29 20:45:59 2025 +0300 drm/i915: rename range_overflows_end() to range_end_overflows() Rename range_overflows_end() to range_end_overflows(), along with the _t variant. It's all rather subjective, but I think range_end_overflows() reads better. Cc: Kees Cook Cc: "Gustavo A. R. Silva" Cc: linux-hardening@vger.kernel.org Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250829174601.2163064-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3c0979c64481f07a6bf9c1775601845ac5fa57f3 Author: Mark Brown Date: Wed Jul 23 13:27:45 2025 +0100 arm64/sme: Drop inaccurate documentation of streaming mode switches The SME ABI documentation contains an inaccurate description of the architectural streaming mode entry/exit behaviour, just remove it since this is better documented by the architecture or with the rest of the documentation for the specific software interfaces concerned. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit b39e9199fbe1df6c8c510c52c24b5db35020e705 Author: Sean Parker Date: Thu Sep 4 10:04:26 2025 -0700 pinctrl: qcom: sm8250: Add egpio support This mirrors the egpio support added to sc7280/sm8450/etc. This change is necessary for GPIOs 146 - 179 (34 GPIOs) to be used as normal GPIOs. Signed-off-by: Sean Parker Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit 203a83112e097a501fbe12722b6342787497efe0 Author: Linus Walleij Date: Fri Sep 5 11:21:50 2025 +0200 pinctrl: generic: rename PIN_CONFIG_OUTPUT to LEVEL This generic pin config property is confusingly named so let's rename it to make things clearer. There are already drivers in the tree that use PIN_CONFIG_OUTPUT to *read* the value of an output driven pin, which is a big semantic confusion for the head: are we then reading the setting of the output or the actual value/level that is put out on the pin? We already have PIN_CONFIG_OUTPUT_ENABLE that turns on driver buffers for output, so this can by logical conclusion only drive the voltage level if it should be any different. But if we read the pin, are we then reading the *setting* of the output value or the *actual* value we can see on the line? If the pin has not first been set into output mode with PIN_CONFIG_OUTPUT_ENABLE, but is instead in some input mode or tristate, what will reading this property actually return? Reading the current users reading this property it is clear that what we read is the logical level of the pin as 0 or 1 depending on if it is low or high. Rename it to PIN_CONFIG_LEVEL so it is crystal clear that we set or read the voltage level of the pin and nothing else. Acked-by: Sudeep Holla Signed-off-by: Linus Walleij commit 6c3442b3b692769c9bced80da58e0130b9fa16cc Author: Dan Carpenter Date: Thu Sep 4 21:58:54 2025 +0300 pinctrl: keembay: fix double free in keembay_build_functions() This kfree() was accidentally left over when we converted to devm_ and it would lead to a double free. Delete it. Fixes: 995bc9f4826e ("pinctrl: keembay: release allocated memory in detach path") Signed-off-by: Dan Carpenter Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 83d12f08ddfba09db414b611195af23fdeb70836 Author: Hendrik Hamerlinck Date: Wed Sep 3 12:01:04 2025 +0200 pinctrl: spacemit: fix typo in PRI_TDI pin name The datasheet lists this signal as PRI_TDI, not PRI_DTI. Fix the pin name to match the documentation and JTAG naming convention (TDI = Test Data In). Signed-off-by: Hendrik Hamerlinck Reviewed-by: Yixun Lan Signed-off-by: Linus Walleij commit a6a2f50ab1721343ee2d5d2be888709aa886e3aa Author: Yulin Lu Date: Wed Sep 3 17:19:15 2025 +0800 pinctrl: eswin: Fix regulator error check and Kconfig dependency Smatch reported the following warning in eic7700_pinctrl_probe(): drivers/pinctrl/pinctrl-eic7700.c:638 eic7700_pinctrl_probe() warn: passing zero to 'PTR_ERR' The root cause is that devm_regulator_get() may return NULL when CONFIG_REGULATOR is disabled. In such case, IS_ERR_OR_NULL() triggers PTR_ERR(NULL) which evaluates to 0, leading to passing a success code as an error. However, this driver cannot work without a regulator. To fix this: - Change the check from IS_ERR_OR_NULL() to IS_ERR() - Update Kconfig to explicitly select REGULATOR and REGULATOR_FIXED_VOLTAGE, ensuring that the regulator framework is always available. This resolves the Smatch warning and enforces the correct dependency. Suggested-by: Dan Carpenter Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-gpio/aKRGiZ-fai0bv0tG@stanley.mountain/ Signed-off-by: Yulin Lu Signed-off-by: Linus Walleij commit 657cbf9b24ba9bd35acd86160f115bfd93038229 Author: Ivan T. Ivanov Date: Thu Aug 28 14:47:39 2025 +0200 pinctrl: bcm: Add STB family pin controller driver This driver provide pin muxing and configuration functionality for BCM2712 SoC used by RPi5. According to [1] this chip is an instance of the one used in Broadcom STB product line. [1] https://lore.kernel.org/lkml/f6601f73-cb22-4ba3-88c5-241be8421fc3@broadcom.com/ Cc: Jonathan Bell Cc: Phil Elwell Signed-off-by: Ivan T. Ivanov Reviewed-by: Phil Elwell Signed-off-by: Andrea della Porta [linusw: Enable also for ARCH_BCM2835] Signed-off-by: Linus Walleij commit 07333899650a5d4c785d3257ee4cd278006b1070 Author: Ivan T. Ivanov Date: Thu Aug 28 14:47:38 2025 +0200 dt-bindings: pinctrl: Add support for Broadcom STB pin controller The STB pin controller represents a family whose silicon instances are found e.g. on BCM2712 SoC. In particular, on RaspberryPi 5, there are two separate instantiations of the same IP block which differ in the number of pins that are associated and the pinmux functions for each of those pins. The -aon- variant stands for 'Always On'. Depending on the revision of the BCM2712 (CO or D0), the pin controller instance has slight differences in the register layout. Signed-off-by: Ivan T. Ivanov Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring (Arm) [linusw: Dropped extranous label and fixed whitespace] Signed-off-by: Linus Walleij commit cc85cb96e2e4489826e372cde645b7823c435de0 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:25 2025 +0200 pinctrl: qcom: make the pinmuxing strict The strict flag in struct pinmux_ops disallows the usage of the same pin as a GPIO and for another function. Without it, a rouge user-space process with enough privileges (or even a buggy driver) can request a used pin as GPIO and drive it, potentially confusing devices or even crashing the system. Set it globally for all pinctrl-msm users. Reviewed-by: Konrad Dybcio Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 480dc195240422f78dae2edaa6666f85d56e2ade Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:24 2025 +0200 pinctrl: qcom: mark the `gpio` and `egpio` pins function as non-strict functions Allow pins muxed to the "gpio" or "egpio" function to be requested as GPIOs even if pinmux_ops say the controller should be strict. Reviewed-by: Konrad Dybcio Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit b65803da894ca494a985e4392e5539fb8f858a2d Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:23 2025 +0200 pinctrl: qcom: add infrastructure for marking pin functions as GPIOs Add a helper macro that wraps PINCTRL_GPIO_PINFUNCTION() for pinctrl-msm pin functions and assign the .function_is_gpio() callback in pinmux_ops. Reviewed-by: Konrad Dybcio Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 11aa02d6a9c222260490f952d041dec6d7f16a92 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:22 2025 +0200 pinctrl: allow to mark pin functions as requestable GPIOs The name of the pin function has no real meaning to pinctrl core and is there only for human readability of device properties. Some pins are muxed as GPIOs but for "strict" pinmuxers it's impossible to request them as GPIOs if they're bound to a devide - even if their function name explicitly says "gpio". Add a new field to struct pinfunction that allows to pass additional flags to pinctrl core. While we could go with a boolean "is_gpio" field, a flags field is more future-proof. If the PINFUNCTION_FLAG_GPIO is set for a given function, the pin muxed to it can be requested as GPIO even on strict pin controllers. Add a new callback to struct pinmux_ops - function_is_gpio() - that allows pinmux core to inspect a function and see if it's a GPIO one. Provide a generic implementation of this callback. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 6f6835beab99c770f1cc6de99b3e3b73c333dec7 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:21 2025 +0200 pinctrl: qcom: use generic pin function helpers With the pinmux core no longer duplicating memory used to store the struct pinfunction objects in .rodata, we can now use the existing infrastructure for storing and looking up pin functions in qualcomm drivers. Remove hand-crafted callbacks. Reviewed-by: Konrad Dybcio Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit d57b7979ea4c43655e8772b91cbac0f613419f4a Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:20 2025 +0200 pinctrl: make struct pinfunction a pointer in struct function_desc We currently duplicate the entire struct pinfunction object in pinmux_generic_add_pinfunction(). While this is inevitable when the arguments come in split through pinmux_generic_add_function(), users of pinmux_generic_add_pinfunction() will typically pass addresses of structures in .rodata, meaning we can try to avoid the duplication with the help from kmemdup_const(). To that end: don't wrap the entire struct pinfunction in struct function_desc but rather just store the address. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit fbba4a9e368f6ec521043ae4035edb2b74ed12e4 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:19 2025 +0200 pinctrl: constify pinmux_generic_get_function() With all users of struct function_desc limited to only accessing it using the dedicated function and never modifying it, we can now constify the return value of pinmux_generic_get_function() treewide. Reviewed-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven # renesas Acked-by: Geert Uytterhoeven # renesas Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit f842d3313ba179d4005096357289c7ad09cec575 Author: Siddharth Vadapalli Date: Mon Sep 8 17:38:27 2025 +0530 PCI: j721e: Fix programming sequence of "strap" settings The Cadence PCIe Controller integrated in the TI K3 SoCs supports both Root-Complex and Endpoint modes of operation. The Glue Layer allows "strapping" the Mode of operation of the Controller, the Link Speed and the Link Width. This is enabled by programming the "PCIEn_CTRL" register (n corresponds to the PCIe instance) within the CTRL_MMR memory-mapped register space. The "reset-values" of the registers are also different depending on the mode of operation. Since the PCIe Controller latches onto the "reset-values" immediately after being powered on, if the Glue Layer configuration is not done while the PCIe Controller is off, it will result in the PCIe Controller latching onto the wrong "reset-values". In practice, this will show up as a wrong representation of the PCIe Controller's capability structures in the PCIe Configuration Space. Some such capabilities which are supported by the PCIe Controller in the Root-Complex mode but are incorrectly latched onto as being unsupported are: - Link Bandwidth Notification - Alternate Routing ID (ARI) Forwarding Support - Next capability offset within Advanced Error Reporting (AER) capability Fix this by powering off the PCIe Controller before programming the "strap" settings and powering it on after that. The runtime PM APIs namely pm_runtime_put_sync() and pm_runtime_get_sync() will decrement and increment the usage counter respectively, causing GENPD to power off and power on the PCIe Controller. Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250908120828.1471776-1-s-vadapalli@ti.com commit 071cdf5645e5b423735d34b86a001bf816707ec7 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:18 2025 +0200 pinctrl: keembay: use a dedicated structure for the pinfunction description struct function_desc is a wrapper around struct pinfunction with an additional void *data pointer. We're working towards reducing the usage of struct function_desc in pinctrl drivers - they should only be created by pinmux core and accessed by drivers using pinmux_generic_get_function(). This driver uses the data pointer so in order to stop using struct function_desc, we need to provide an alternative that also wraps the mux mode which is passed to pinctrl core as user data. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:17 2025 +0200 pinctrl: keembay: release allocated memory in detach path Unlike all the other allocations in this driver, the memory for storing the pin function descriptions allocated with kcalloc() and later resized with krealloc() is never freed. Use devres like elsewhere to handle that. While at it - replace krealloc() with more suitable devm_krealloc_array(). Note: the logic in this module is pretty convoluted and could probably use some revisiting, we should probably be able to calculate the exact amount of memory needed in advance or even skip the allocation altogether and just add each function to the radix tree separately. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit ea22f777fc43e55fb9f0d1a1f873cfab29219d8e Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:16 2025 +0200 pinctrl: imx: don't access the pin function radix tree directly The radix tree containing pin function descriptors should not be accessed directly by drivers. There are dedicated functions for it. I suppose this driver does it so that the memory containing the function description is not duplicated but we're going to address that shortly so convert it to using generic pinctrl APIs. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit bd6f4a91401fc9847eef306a593df243c40c9d05 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:15 2025 +0200 pinctrl: mediatek: moore: replace struct function_desc with struct pinfunction struct function_desc is a wrapper around struct pinfunction with an additional void *data pointer. This driver doesn't use the data pointer. We're also working towards reducing the usage of struct function_desc in pinctrl drivers - they should only be created by pinmux core and accessed by drivers using pinmux_generic_get_function(). Replace the struct function_desc objects in this driver with smaller struct pinfunction instances. Reviewed-by: Chen-Yu Tsai Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 7a24f1f5b2147f99d2ffa40dfe137c040cab1fb8 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:14 2025 +0200 pinctrl: mediatek: mt7988: use PINCTRL_PIN_FUNCTION() We have a dedicated initializer macro for defining pin functions for mediatek drivers so use it here. Reviewed-by: Chen-Yu Tsai Reviewed-by: Andy Shevchenko Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 17d4f2a9e6cb224012d85fed52e9794a84fa501d Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:13 2025 +0200 pinctrl: airoha: replace struct function_desc with struct pinfunction struct function_desc is a wrapper around struct pinfunction with an additional void *data pointer. This driver doesn't use the data pointer. We're also working towards reducing the usage of struct function_desc in pinctrl drivers - they should only be created by pinmux core and accessed by drivers using pinmux_generic_get_function(). Replace the struct function_desc objects in this driver with smaller struct pinfunction instances. Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 77377744c29da2198a1d54b222263c64fe7b2f41 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:12 2025 +0200 pinctrl: ingenic: use struct pinfunction instead of struct function_desc struct function_desc is a wrapper around struct pinfunction with an additional void *data pointer. This driver doesn't use the data pointer. We're also working towards reducing the usage of struct function_desc in pinctrl drivers - they should only be created by pinmux core and accessed by drivers using pinmux_generic_get_function(). Replace the struct function_desc objects in this driver with smaller struct pinfunction instances. Acked-by: Paul Cercueil Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit d364d2ad07873dc4991b2a631a8536597272418b Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:11 2025 +0200 devres: provide devm_kmemdup_const() Provide a function similar to devm_strdup_const() but for copying blocks of memory that are likely to be placed in .rodata. Reviewed-by: Andy Shevchenko Acked-by: Greg Kroah-Hartman Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 Author: Bartosz Golaszewski Date: Tue Sep 2 13:59:10 2025 +0200 pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions. Cc: stable@vger.kernel.org Tested-by: Neil Armstrong Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 0fd0f79aec237dd0a18ffdd63fcbf0015c7a3012 Author: Qianfeng Rong Date: Sun Aug 31 16:49:57 2025 +0800 pinctrl: ma35: Use int type to store negative error codes Change the 'ret' variable in ma35_pinctrl_parse_functions() from u32 to int, as it needs to store either negative error codes or zero returned by ma35_pinctrl_parse_groups(). No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Linus Walleij commit decd50c19f2ccce3cbe34f6f59d04b252119329d Author: Qianfeng Rong Date: Sun Aug 31 16:49:56 2025 +0800 pinctrl: armada-37xx: Use int type to store negative error codes In armada_37xx_gpio_direction_output(), the 'ret' variable might store the negative error codes returned by regmap_update_bits(), and in armada_37xx_edge_both_irq_swap_pol(), the 'ret' variable directly stores -1, so the type of the 'ret' variable needs to be changed to int in both cases. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Andrew Lunn Signed-off-by: Linus Walleij commit 4fa9f72d657a76546849068b508a2c82983f8945 Author: Benno Lossin Date: Thu Aug 14 11:30:38 2025 +0200 rust: cpufreq: replace `MaybeUninit::zeroed().assume_init()` with `pin_init::zeroed()` All types in `bindings` implement `Zeroable` if they can, so use `pin_init::zeroed` instead of relying on `unsafe` code. If this ends up not compiling in the future, something in bindgen or on the C side changed and is most likely incorrect. Signed-off-by: Benno Lossin Acked-by: Viresh Kumar Signed-off-by: Miguel Ojeda commit 4846300ba8f9b725594cc2e77785057f536b50c1 Author: Benno Lossin Date: Thu Aug 14 11:30:29 2025 +0200 rust: derive `Zeroable` for all structs & unions generated by bindgen where possible Using the `--with-derive-custom-{struct,union}` option of bindgen, add `#[derive(MaybeZeroable)]` to every struct & union. This makes those types implement `Zeroable` if all their fields implement it. Sadly bindgen doesn't add custom derives to the `__BindgenBitfieldUnit` struct. So manually implement `Zeroable` for that. Signed-off-by: Benno Lossin Reviewed-by: Alice Ryhl [ Formatted comment. - Miguel ] Signed-off-by: Miguel Ojeda commit 3c847e17225aa9481fc3f6c948f5c718dea526f1 Author: Benno Lossin Date: Thu Aug 14 11:30:28 2025 +0200 rust: add `pin-init` as a dependency to `bindings` and `uapi` This allows `bindings` and `uapi` to implement `Zeroable` and use other items from pin-init. Co-developed-by: Miguel Ojeda Signed-off-by: Miguel Ojeda Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291565-Help/topic/Zeroable.20trait.20for.20C.20structs/near/510264158 Signed-off-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Miguel Ojeda commit 0b470321e931432157820ab417f54ec4deb50ffa Author: Jani Nikula Date: Tue Sep 2 20:51:54 2025 +0300 drm/{i915,xe}/panic: pass struct intel_panic to intel_panic_setup() Reduce the struct intel_framebuffer usage within the panic implementation. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/2a016167b1f6f0b432aed0a630f9dbcd07fadb7b.1756835342.git.jani.nikula@intel.com commit 427a3f939aa3d0c77beb34b469d17244f775b14b Author: Jani Nikula Date: Tue Sep 2 20:51:53 2025 +0300 drm/{i915,xe}/panic: convert intel_panic_finish() to struct intel_panic The intel_panic_finish() function really needs the struct intel_panic pointer, not struct intel_framebuffer. Make it so. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/3fdbcbe17e0e90c4a590f2a2486a9ec79a90cf62.1756835342.git.jani.nikula@intel.com commit 729c5f7ffa83391b44939efc26b7ea34a08aea74 Author: Jani Nikula Date: Tue Sep 2 20:51:52 2025 +0300 drm/{i915,xe}/panic: move framebuffer allocation where it belongs The struct intel_framebuffer allocation naturally belongs in intel_fb.c, not hidden inside panic implementation. Separate the panic allocation. Drop the unnecessary struct i915_framebuffer and struct xe_framebuffer types. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/d29f63e0118d002fc8edd368caea7e8185418e17.1756835342.git.jani.nikula@intel.com commit fa48f6335af9b063303d9e9a036514bbdc774d5b Author: Jani Nikula Date: Tue Sep 2 20:51:51 2025 +0300 drm/{i915,xe}/panic: rename struct {i915,xe}_panic_data to struct intel_panic Prepare for better shared interfaces between panic implementations. The struct intel_panic remains an opaque data type, with unique implementations in i915 and xe. This allows us to change the panic data pointer from void * to struct intel_panic *, helping type safety. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/884ffc80c8b5fef1b92956e644a4e559560cc2ba.1756835342.git.jani.nikula@intel.com commit 4e839f2c7bafb18c450af78a1b6fc78e423a2039 Author: Jani Nikula Date: Tue Sep 2 20:51:50 2025 +0300 drm/{i915,xe}/fb: add panic pointer member to struct intel_framebuffer Add a panic data pointer member in struct intel_framebuffer in preparation for breaking the artificial subclassing between intel_framebuffer and panic structures. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/41f42e1de8545409274d54854aa12e0fb390e394.1756835342.git.jani.nikula@intel.com commit 05a85e781ff0e37ccadcac133aa355b81db86ada Author: Jani Nikula Date: Tue Sep 2 20:51:49 2025 +0300 drm/{i915,xe}/panic: rename intel_bo_panic_*() to intel_panic_*() Rename the intel_bo_panic_*() functions according to the functionality, dropping the misleading intel_bo reference. Keep intel_bo_alloc_framebuffer() for now; it'll be refactored later. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/a3be8f8b5e7dd208027a1131e89452d9a214054f.1756835342.git.jani.nikula@intel.com commit 5f54b2196c674adc02a22f99da414b503daccb4c Author: Jani Nikula Date: Tue Sep 2 20:51:48 2025 +0300 drm/{i915,xe}/panic: split out intel_panic.[ch] intel_bo.[ch] is not the appropriate location for the panic functionality. Split out intel_panic.[ch] and xe_panic.c in i915 and xe. Keep the function names for now. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/d98b831a011a028ffd33ce99b0ba62be061ee235.1756835342.git.jani.nikula@intel.com commit cef2c7266feaf15676fb5e47cbb6d7d832b61563 Author: Jani Nikula Date: Tue Sep 2 20:51:47 2025 +0300 drm/i915/fb: add intel_framebuffer_alloc() Add intel_framebuffer_alloc() to hide intel_bo_alloc_framebuffer(), as that doesn't feel like the correct abstraction. Cc: Jocelyn Falempe Cc: Maarten Lankhorst Signed-off-by: Jani Nikula Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/379c306c692c50f6af3b6f2488c213f12627954f.1756835342.git.jani.nikula@intel.com commit 45b95459802afe9b7d7add22db98176749c88d6c Author: Uma Shankar Date: Thu Sep 4 15:23:38 2025 +0530 drm/i915/display: Remove FBC modulo 4 restriction for ADL-P+ WA:22010751166 does not apply past display version 12. Or, in other words, the FBC restriction where FBC is disabled for non-modulo 4 plane sizes (including plane size + yoffset) is fixed from display version 13 and onwards. Relax the restriction for the same. v4: Dropped redundant commit message v3: Update comments for clarity (Jonathan Cavitt) v2: Update the macro for display version check (Vinod) Suggested-by: Vidya Srinivas Signed-off-by: Uma Shankar Reviewed-by: Vinod Govindapillai Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250904095338.300813-2-uma.shankar@intel.com commit d3e25c244d5335ef868983b5dad9d4c06396d67e Author: Peng Fan Date: Thu Sep 4 18:40:44 2025 +0800 firmware: arm_scmi: imx: Support retrieving MISC protocol configuration info The MISC protocol can provide System Manager (SM) configuration information, including platform identifiers and board-specific attributes. Add support to retrieve this information during protocol initialization. If the firmware does not implement the CFG_INFO command, handle -EOPNOTSUPP gracefully and continue without failing init. Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Message-Id: <20250904-sm-misc-api-v1-v4-3-0bf10eaabdf1@nxp.com> Signed-off-by: Sudeep Holla commit cc798b105070a190e2b793d30d0c59aa00299861 Author: Peng Fan Date: Thu Sep 4 18:40:43 2025 +0800 firmware: arm_scmi: imx: Discover MISC build info from the system manager MISC protocol can report System Manager (SM) build information (commit, build date/time, etc.). Discover those information at the init time. If the firmware doesn't support it, ignore -EOPNOTSUPP. Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Message-Id: <20250904-sm-misc-api-v1-v4-2-0bf10eaabdf1@nxp.com> Signed-off-by: Sudeep Holla commit fad32e8ac460198d086c6468dafe47ecbd9d03e8 Author: Hongliang Yang Date: Wed Sep 3 16:47:13 2025 +0800 arm64: dts: cix: add DT nodes for all I2C and I3C ports for sky1 The CIX SKY1 SoC supports the integration of 8 I2C bus controllers and 2 I3C bus controllers. Signed-off-by: Hongliang Yang Signed-off-by: Jun Guo Signed-off-by: Peter Chen commit 30c3ffb880315b907ccd682ed4e17d20f786fdf9 Author: Liao Yuanhong Date: Thu Sep 4 19:26:40 2025 +0800 drm/i915/gvt: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250904112644.350512-1-liaoyuanhong@vivo.com Signed-off-by: Jani Nikula commit 646c0c9e06a6613da5496645344af7e6e0f4ee9d Author: Peng Fan Date: Thu Sep 4 18:40:42 2025 +0800 firmware: arm_scmi: imx: Add documentation for MISC_BOARD_INFO System Manager Firmware supports getting board information, add documentation for this MISC_BOARD_INFO command. Also extends the SYSLOG response to include NOT_SUPPORTED. Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Message-Id: <20250904-sm-misc-api-v1-v4-1-0bf10eaabdf1@nxp.com> Signed-off-by: Sudeep Holla commit 55c771b0d8a70a10d549d5296cf5e3342bef548f Author: Jani Nikula Date: Wed Sep 3 13:10:50 2025 +0300 drm/i915/ddi: abstract figuring out encoder name The encoder name deduction has become a bit cumbersome within intel_ddi_init(). Split it out to a separate function to declutter intel_ddi_init(), even if that means having to use a temp seq buffer for the name. Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250903101050.3671305-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 882569dca6646eb3294ec048d76f9bfea1f3348f Author: Xichao Zhao Date: Wed Aug 20 16:52:00 2025 +0800 PCI: plda: Remove dev_err_probe() when the errno is -ENOMEM The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao [mani: reworded the subject] Signed-off-by: Manivannan Sadhasivam commit c4f8b11bacd562f38c85f4f81a0a4426b267df70 Author: Christophe JAILLET Date: Sun Sep 7 15:32:26 2025 +0200 platform/x86: quickstart: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 7607 2616 64 10287 282f drivers/platform/x86/quickstart.o After: ===== text data bss dec hex filename 7301 2544 64 9909 26b5 drivers/platform/x86/quickstart.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/530b930c981c436c172c0308b348d4ae4ef72800.1757251867.git.christophe.jaillet@wanadoo.fr Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b5a5a16e37c004052e9181de5cff0638d44a4b9b Author: Christophe JAILLET Date: Sun Sep 7 12:09:09 2025 +0200 platform/x86: xiaomi-wmi: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 3520 1112 64 4696 1258 drivers/platform/x86/xiaomi-wmi.o After: ===== text data bss dec hex filename 3069 1040 64 4173 104d drivers/platform/x86/xiaomi-wmi.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/bb5d7a57e11eb580f610276a351a01a993341fb8.1757239732.git.christophe.jaillet@wanadoo.fr Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 512bf60226c621893729605121a396240e84a5d4 Author: Marek Vasut Date: Fri Sep 5 00:27:44 2025 +0200 pinctrl: renesas: r8a779g0: Fix trivial typo in SoC type comment Fix SoC type comment in the PFC table file, replace R8A779A0 likely copy-paste error with R8A779G0. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250904222806.193260-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 9f062fc5b0ff44550088912ab89f9da40226a826 Author: Qianfeng Rong Date: Sun Aug 31 16:49:58 2025 +0800 pinctrl: renesas: Use int type to store negative error codes Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned int to int, as it needs to store either negative error codes or zero returned by sh_pfc_pinconf_set(). No effect on runtime. Signed-off-by: Qianfeng Rong Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com Signed-off-by: Geert Uytterhoeven commit 837afa592c6234be82acb5d23e0a39e9befdaa85 Author: Biju Das Date: Tue Aug 19 09:40:20 2025 +0100 pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt control registers Renesas RZ/G3E supports a power-saving mode where power to most of the SoC components is lost, including the PIN controller. Save and restore the Schmitt control register contents to ensure the functionality is preserved after a suspend/resume cycle. Signed-off-by: Biju Das Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea # on RZ/G3S Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250819084022.20512-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 30247fc3254a4502465ab809d49e2167ace5a6f2 Author: Biju Das Date: Sun Aug 17 15:30:19 2025 +0100 pinctrl: renesas: rzg2l: Fix OEN resume Writing to the PFC_OEN register is controlled by the write protect register (PWPR). Currently the OEN register write in resume() is done without enabling write access in PWPR leading to incorrect operation. Fixes: cd39805be85b ("pinctrl: renesas: rzg2l: Unify OEN handling across RZ/{G2L,V2H,V2N}") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven [geert: Move spin_*lock*() calls inside if-statements] Link: https://lore.kernel.org/20250817143024.165471-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7ea3baa6efe4bb93d11e1c0e6528b1468d7debf6 Author: Jani Nikula Date: Fri Sep 5 13:41:49 2025 +0300 drm/i915/power: fix size for for_each_set_bit() in abox iteration for_each_set_bit() expects size to be in bits, not bytes. The abox mask iteration uses bytes, but it works by coincidence, because the local variable holding the mask is unsigned long, and the mask only ever has bit 2 as the highest bit. Using a smaller type could lead to subtle and very hard to track bugs. Fixes: 62afef2811e4 ("drm/i915/rkl: RKL uses ABOX0 for pixel transfers") Cc: Ville Syrjälä Cc: Matt Roper Cc: stable@vger.kernel.org # v5.9+ Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250905104149.1144751-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 352ccf890a3e91f58bc32503f9afdc161bc2c34a Author: Christian Borntraeger Date: Thu Sep 4 13:39:27 2025 +0200 KVM: s390: improve interrupt cpu for wakeup Turns out that picking an idle CPU for floating interrupts has some negative side effects. The guest will keep the IO workload on its CPU and rather use an IPI from the interrupt CPU instead of moving workload. For example a guest with 2 vCPUs and 1 fio process might run that fio on vcpu1. If after diag500 both vCPUs are idle then vcpu0 is woken up. The guest will then do an IPI from vcpu0 to vcpu1. So lets change the heuristics and prefer the last CPU that went to sleep. This one is likely still in halt polling and can be woken up quickly. This patch shows significant improvements in terms of bandwidth or cpu consumption for fio and uperf workloads and seems to be a net win. Link: https://lore.kernel.org/linux-s390/20250904113927.119306-1-borntraeger@linux.ibm.com/ Reviewed-by: Christoph Schlameuß Signed-off-by: Christian Borntraeger commit e81783899d7d19cad567b68e115fcb37880e427b Author: Greg Kroah-Hartman Date: Mon Sep 8 11:05:16 2025 +0200 Revert "m68k: make HPDCA and HPAPCI bools" This reverts commit 5a66087107b80ac4e58a94f37d9b8d12e22b4071. m68k patches shouldn't go through the tty tree without the m68k maintainer acking them first. Cc: Jiri Slaby (SUSE) Reported-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit 6d0982ae7880f2c4d5fbd1b5f7574ea93d1311ac Author: Liao Yuanhong Date: Wed Sep 3 20:14:52 2025 +0800 PM / devfreq: mtk-cci: avoid redundant conditions While 'if (i <= 0) ... else if (i > 0) ...' is technically equivalent to 'if (i <= 0) ... else ...', the latter is vastly easier to read because it avoids writing out a condition that is unnecessary. Let's drop such unnecessary conditions. Signed-off-by: Liao Yuanhong Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20250903121452.387023-1-liaoyuanhong@vivo.com/ commit 474014cdec1758e1802082b94043189e198c58a4 Author: Christophe JAILLET Date: Sun Sep 7 15:25:38 2025 +0200 gpio: pisosr: Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 8431 1808 192 10431 28bf drivers/gpio/gpio-pisosr.o After: ===== text data bss dec hex filename 8112 1736 192 10040 2738 drivers/gpio/gpio-pisosr.o Signed-off-by: Christophe JAILLET Acked-by: Andrew Davis Link: https://lore.kernel.org/r/01910ebdaba7d8d0cdc4ac60eb70da8e29cb85f1.1757251512.git.christophe.jaillet@wanadoo.fr Signed-off-by: Bartosz Golaszewski commit 03c146cb6cd14fdab2d2c7ab1b4e8035b54df8cc Author: Yao Zi Date: Thu Sep 4 01:34:37 2025 +0000 gpio: loongson-64bit: Add support for Loongson-2K0300 SoC This controller's input and output logic is similar to previous generations of SoCs. Additionally, it's capable of interrupt masking, and could be configured to detect levels and edges, and is supplied with a distinct reset signal. The interrupt functionality is implemented through an irqchip, whose operations are written with previous generation SoCs in mind and could be reused. Since all Loongson SoCs with similar interrupt capability (LS2K1500, LS2K2000) support byte-control mode, these operations are for byte-control mode only for simplicity. Signed-off-by: Yao Zi Reviewed-by: Huacai Chen Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250904013438.2405-3-ziyao@disroot.org Signed-off-by: Bartosz Golaszewski commit 084d01a173f5f41afd326b1dfe73085972530ca7 Author: Yao Zi Date: Thu Sep 4 01:34:36 2025 +0000 dt-bindings: gpio: loongson: Document GPIO controller of LS2K0300 SoC Loongson-2K0300 ships a GPIO controller whose input/output control logic is similar to previous generation of SoCs. Additionally, it acts as an interrupt-controller supporting both level and edge interrupts and has a distinct reset signal. Describe its compatible in devicetree. We enlarge the maximum value of ngpios to 128, since the controller technically supports at most 128 pins, although only 106 are routed out of the package. Properties for interrupt-controllers and resets are introduced and limited as LS2K0300 only. Signed-off-by: Yao Zi Reviewed-by: Krzysztof Kozlowski Reviewed-by: Huacai Chen Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250904013438.2405-2-ziyao@disroot.org Signed-off-by: Bartosz Golaszewski commit d19b1773362adfe8c0d5ccc4faf6aea0249976a6 Author: Henrik Grimler Date: Mon Sep 8 09:26:57 2025 +0200 ARM: dts: samsung: smdk5250: add sromc node The smdk5250 board has an ethernet port which is connected to bank 1 of the SROM controller. Describe it. Signed-off-by: Henrik Grimler Signed-off-by: Krzysztof Kozlowski commit 6016813c888ec7d4a1f592eab3aebf289a42e865 Author: Henrik Grimler Date: Mon Sep 8 09:26:56 2025 +0200 ARM: dts: samsung: exynos5250: describe sromc bank memory map According to public user manual for Exynos 5250 [1], the SROM controller has 4 banks, at same addresses as for example Exynos 5410. Describe the bank memory map of the SoC. [1] https://web.archive.org/web/20130921194458/http://www.samsung.com/global/business/semiconductor/file/product/Exynos_5_Dual_User_Manaul_Public_REV100-0.pdf Signed-off-by: Henrik Grimler Signed-off-by: Krzysztof Kozlowski commit 31f5a855f706f8b14055b6b4df083c3997e42907 Author: Henrik Grimler Date: Mon Sep 8 09:26:55 2025 +0200 ARM: dts: samsung: exynos5410: use multiple tuples for sromc ranges Preferred style is to have comma separated tuples when multiple addresses and sizes are defined in ranges. Therefore, change the format to clarify the node. Signed-off-by: Henrik Grimler Signed-off-by: Krzysztof Kozlowski commit d3e7efad8fbaf0c2d6f039ae074a20c3aa89bd12 Author: Akhilesh Patil Date: Thu Sep 4 20:46:09 2025 +0530 gpio: Kconfig: Update help for GPIO_PCA953X Update help description with supported ICs from gpio-pca953x.c Include missing IC names. Signed-off-by: Akhilesh Patil Link: https://lore.kernel.org/r/aLmtOWjAWPtWe/gH@bhairav-test.ee.iitb.ac.in Signed-off-by: Bartosz Golaszewski commit 86eec88c5bddf9a57bfebe701d9c7a4d439aed9b Author: Joris Verhaegen Date: Fri Sep 5 10:12:56 2025 +0100 ALSA: compress_offload: Add SNDRV_COMPRESS_AVAIL64 ioctl The previous patch introduced a 64-bit timestamp ioctl (SNDRV_COMPRESS_TSTAMP64). To provide a consistent API, this patch adds a corresponding 64-bit version of the SNDRV_COMPRESS_AVAIL ioctl. A new struct snd_compr_avail64 is added to the UAPI, which includes the 64-bit timestamp. The existing ioctl implementation is refactored to handle both the 32-bit and 64-bit variants. Reviewed-by: Miller Liang Tested-by: Joris Verhaegen Signed-off-by: Joris Verhaegen Acked-by: Vinod Koul Reviewed-by: Charles Keepax Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250905091301.2711705-4-verhaegen@google.com commit f20a53974f79619d0ef6c9f17bb8693499fb6ebb Author: Joris Verhaegen Date: Fri Sep 5 10:12:55 2025 +0100 ALSA: compress_offload: Add SNDRV_COMPRESS_TSTAMP64 ioctl The previous patch introduced the internal infrastructure for handling 64-bit timestamps. This patch exposes this capability to user-space. Define the new ioctl command SNDRV_COMPRESS_TSTAMP64, which allows applications to fetch the overflow-safe struct snd_compr_tstamp64. The ioctl dispatch table is updated to handle the new command by calling a new snd_compr_tstamp64 handler, while the legacy path is renamed to snd_compr_tstamp32 for clarity. This patch bumps the SNDRV_COMPRESS_VERSION to 0.4.0. Reviewed-by: Miller Liang Tested-by: Joris Verhaegen Signed-off-by: Joris Verhaegen Reviewed-by: Charles Keepax Acked-by: Mark Brown Acked-by: Vinod Koul Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250905091301.2711705-3-verhaegen@google.com commit 2c92e2fbe9e22cefdae87d8a0d654691ee4c1957 Author: Joris Verhaegen Date: Fri Sep 5 10:12:54 2025 +0100 ALSA: compress_offload: Add 64-bit safe timestamp infrastructure The copied_total field in struct snd_compr_tstamp is a 32-bit value that can overflow on long-running high-bitrate streams, leading to incorrect calculations for buffer availablility. This patch adds a 64-bit safe timestamping mechanism. A new UAPI struct, snd_compr_tstamp64, is added which uses 64-bit types for byte counters. The relevant ops structures across the ASoC and core compress code are updated to use this new struct. ASoC drivers are updated to use u64 counters. Internal timestamps being u64 now, a compatibility function is added to convert the 64-bit timestamp back to the 32-bit format for legacy ioctl callers. Reviewed-by: Miller Liang Tested-by: Joris Verhaegen Signed-off-by: Joris Verhaegen Reviewed-by: Srinivas Kandagatla Reviewed-by: Charles Keepax Acked-by: Mark Brown Acked-by: Vinod Koul Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250905091301.2711705-2-verhaegen@google.com commit 90d8aad11f613e13e1eddc35c0225cce9e54ba94 Author: Jouni Högander Date: Wed Aug 27 09:08:09 2025 +0300 drm/i915/psr: Panel Replay SU cap dpcd read return value Currently return value of drm_dpcd_readb is not checked when reading sink Panel Replay Selective Update capabilities. Fix this and switch to drm_dpcd_read_byte. Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Reviewed-by: Michał Grzelak Link: https://lore.kernel.org/r/20250827060809.2461725-1-jouni.hogander@intel.com commit f3c19e70eb897544160c4b96b9ad6b7d921c9fac Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:16 2025 +0200 gpio: mlxbf3: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-12-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit ab61c8b6138f4987cd1cbe605d6cc698b4902aea Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:15 2025 +0200 gpio: ep93xx: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-11-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit a685ac653958f7249e7503d69f4f3fabb0642f45 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:14 2025 +0200 gpio: ep93xx: order includes alphabetically For better readability and easier maintenance, order the includes alphabetically. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-10-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit 74dcb9473054954fcd8b91f7155aba5af3e4d555 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:13 2025 +0200 gpio: ep93xx: allow building the module with COMPILE_TEST enabled Increase build coverage by allowing the module to be built with COMPILE_TEST=y. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-9-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit fff086ebc554b8f7942e3839a758cb8e8dfc945f Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:12 2025 +0200 gpio: mlxbf: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-8-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit 8bbe11bb2fa378016a7e764c6207f6f5360cc979 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:11 2025 +0200 gpio: tb10x: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-7-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit 682fbb18e14cbb47dd30d2c65053be9d8f39a23c Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:10 2025 +0200 gpio: tb10x: allow building the module with COMPILE_TEST=y Increase build coverage by allowing the module to be built with COMPILE_TEST=y. We need an actual prompt entry in this case so add it. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-6-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit 76e61b03d1228914928eb57e55dcb2c62b6caa0b Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:09 2025 +0200 gpio: tb10x: order includes alphabetically For better readability and easier maintenance, order the includes alphabetically. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-5-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit 59b82bedbfe7452996a7163a9a19ff1239fb86c1 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:08 2025 +0200 gpio: blzp1600: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-4-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit f21c10649acc15802e942ca6ae78cb76657a0639 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:07 2025 +0200 gpio: idt3243x: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-3-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit bd9bfafae0239f9d7187116dace6e0d80d27b678 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:06 2025 +0200 gpio: ixp4xx: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-2-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit b23c22a8d715e6f681381592db377aaabc1a2178 Author: Bartosz Golaszewski Date: Wed Sep 3 10:00:05 2025 +0200 gpio: ixp4xx: allow building the module with COMPILE_TEST enabled Increase build coverage by allowing the module to be built with COMPILE_TEST=y. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250903-gpio-mmio-gpio-conv-part3-v1-1-ff346509f408@linaro.org Signed-off-by: Bartosz Golaszewski commit e10a7cf4f69ecdc42ab4a17deaed86d34e8cb035 Merge: 79d15f23f232f9 76eeb9b8de9880 Author: Bartosz Golaszewski Date: Mon Sep 8 09:16:23 2025 +0200 Merge tag 'v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next Linux 6.17-rc5 commit 4a9fba4d008a0d395407224f18def611ee85ba09 Author: Kalesh AP Date: Thu Aug 14 16:55:54 2025 +0530 RDMA/bnxt_re: Delete always true SGID table check The "sgid_tbl" inside "rdev->qplib_res" is a static memory. Hence, the check always return true. Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250814112555.221665-9-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit dc61e916f1ce4770c98d8dd5857c174b73be8251 Author: Abhishek Mohapatra Date: Thu Aug 14 16:55:53 2025 +0530 RDMA/bnxt_re: Report udp source port for flow_label in bnxt_re_query_qp The firmware doesn't capture the flow_label. Therefore the value that's always returned by qplib_qp->ah.flow_label is 0 whenever a qp is created. And as per IB spec, udp source port can be reported for flow_label. Hence reported udp source port for flow_label in bnxt_re_query_qp by populating the value of qplib_qp->udp_sport into qp_attr->ah_attr.grh.flow_label. Signed-off-by: Abhishek Mohapatra Signed-off-by: Saravanan Vajravel Link: https://patch.msgid.link/20250814112555.221665-8-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit ef56081d1864582a6db50710733416c0510b7826 Author: Vasuthevan Maheswaran Date: Thu Aug 14 16:55:52 2025 +0530 RDMA/bnxt_re: RoCE related hardware counters update Support for new hardware counters added, and existing hardware counters have been modified according to the design documents for compatibility with open-source monitoring agents. Signed-off-by: Vasuthevan Maheswaran Signed-off-by: Saravanan Vajravel Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250814112555.221665-7-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 832fc9e1614e00bb9d7b8350c65b4637a9941cdf Author: Damodharam Ammepalli Date: Thu Aug 14 16:55:51 2025 +0530 RDMA/bnxt_re: Optimize bnxt_qplib_get_dev_attr function Optimize bnxt_qplib_get_dev_attr() by separating out query_version which uses creq notification method to host. Due to serialization of cmdq by firmware, expected latency in response to heavy multi-threaded rdma applications might be observed. This patch separates the version_query logic out of device attribute query and called only during rdma driver init. Signed-off-by: Damodharam Ammepalli Reviewed-by: Hongguang Gao Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250814112555.221665-6-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit ae7990ce1f605d74b41afe0dff8ec8030105c8cc Author: Chenna Arnoori Date: Thu Aug 14 16:55:49 2025 +0530 RDMA/bnxt_re: RoCE Driver Dynamic Debug for HWRM's Add Linux kernel dynamic debug prints to ROCE HWRM's. Dumping request and response buffers for the ROCE HWRM's using print_hex_dump_bytes() to be part of kernel dynmic debug. Signed-off-by: Chenna Arnoori Signed-off-by: Saravanan Vajravel Link: https://patch.msgid.link/20250814112555.221665-4-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 8191e874156ca2e51b31a5880fb050a66177def5 Author: Kashyap Desai Date: Thu Aug 14 16:55:48 2025 +0530 RDMA/bnxt_re: Show srq_limit in fill_res_srq_entry hook Added srq_limit in rdma show resource srq hook. Signed-off-by: Kashyap Desai Signed-off-by: Saravanan Vajravel Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250814112555.221665-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 685e8dae19df73d5400734ee5ad9e96470f9c0b4 Author: Marek Vasut Date: Sun Aug 31 21:04:25 2025 +0200 drm/rcar-du: dsi: Implement DSI command support Implement support for DSI command transfer. Transmission of both Short Packet and Long Packet is implemented, so is command transmission to request response from peripheral device and transmission of non-read command with BTA. The AXI memory access mode is currently not implemented, each transfer is performed purely using controller register interface. Short Packet transfer can transfer up to 2 Bytes of data, Long Packet transfer can transfer up to 16 Bytes of data. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250831190507.327848-1-marek.vasut+renesas@mailbox.org Signed-off-by: Tomi Valkeinen commit b5ddb9ab3d83fe0d93d38de442c45610a5846d06 Author: Geert Uytterhoeven Date: Thu Sep 4 17:31:00 2025 +0200 drm: rcar-du: lvds: Convert to RUNTIME_PM_OPS() Convert the Renesas R-Car Display Unit LVDS driver from SET_RUNTIME_PM_OPS() to RUNTIME_PM_OPS(), and pm_ptr(). This reduces kernel size in case CONFIG_PM is disabled. While DRM_RCAR_LVDS depends on PM, the code may still serve as an example for new drivers. Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/2264ff4f21a7e17384822e0efba176cf78ae184d.1756999823.git.geert+renesas@glider.be Signed-off-by: Tomi Valkeinen commit 94d885eb8ffe15b3eb4abe92e03d852fce8ba81f Author: David Heidelberg Date: Thu Sep 4 22:41:44 2025 +0200 dt-bindings: extcon: linux,extcon-usb-gpio: GPIO must be provided Without providing either ID or VBUS GPIO the driver is not able to operate. Original text binding says: "Either one of id-gpio or vbus-gpio must be present." Fixes: 79a31ce03f41 ("dt-bindings: extcon: convert extcon-usb-gpio.txt to yaml format") Acked-by: Conor Dooley Signed-off-by: David Heidelberg Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250904-yaml-extcon-usb-gpio-v2-1-a5c4afa496c3@ixit.cz/ commit 958bb5a2794b2090593bd7a064e0c2f53dfa20cf Author: Artur Weber Date: Sun Aug 17 10:52:04 2025 +0200 dt-bindings: extcon: rt8973a: Convert DT bindings to YAML Convert the device tree bindings for Richtek RT8973A MUIC to the YAML format. No functional changes. Signed-off-by: Artur Weber Reviewed-by: Rob Herring (Arm) Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250817-rt8973a-dt-bindings-yaml-v1-1-150eb4599dc9@gmail.com/ commit 531f47fd35f4ead8c76d584ef8c546b4cd9cb3b7 Author: Randy Dunlap Date: Thu May 15 16:48:03 2025 -0700 extcon: max14526: depends on I2C to prevent build warning/errors Make EXTCON_MAX14526 depend on I2C to address a kconfig warning and subsequent build errors: WARNING: unmet direct dependencies detected for REGMAP_I2C Depends on [m]: I2C [=m] Selected by [y]: - EXTCON_MAX14526 [=y] && EXTCON [=y] ld: vmlinux.o: in function `max14526_driver_init': extcon-max14526.c:(.init.text+0x77b0e): undefined reference to `i2c_register_driver' ld: vmlinux.o: in function `max14526_driver_exit': extcon-max14526.c:(.exit.text+0x467c): undefined reference to `i2c_del_driver' Fixes: 145af3ddd1cd ("extcon: Add basic support for Maxim MAX14526 MUIC") Signed-off-by: Randy Dunlap Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250515234803.1385375-1-rdunlap@infradead.org/ commit 67c74613f29610b59875a4aae513202db3afe300 Author: Randy Dunlap Date: Tue May 13 14:02:51 2025 -0700 extcon: max14526: avoid defined but not used warning SIMPLE_PM_DEV_OPS() is deprecated according to . Use DEFINE_SIMPLE_PM_DEV_OPS() instead. This avoids a build warning when CONFIG_PM is not enabled: drivers/extcon/extcon-max14526.c:265:12: warning: ‘max14526_resume’ defined but not used [-Wunused-function] 265 | static int max14526_resume(struct device *dev) Fixes: 145af3ddd1cd ("extcon: Add basic support for Maxim MAX14526 MUIC") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/lkml/20250513210252.1139749-1-rdunlap@infradead.org/ Signed-off-by: Chanwoo Choi commit 145af3ddd1cda5c8399c27fe529150aa53b2fcb9 Author: Svyatoslav Ryhel Date: Tue May 6 10:32:16 2025 +0300 extcon: Add basic support for Maxim MAX14526 MUIC The MAX14526 is designed to simplify interface requirements on portable devices by multiplexing common inputs (USB, UART, Microphone, Stereo Audio and Composite Video) on a single micro/mini USB connector. The USB input supports Hi-Speed USB and the audio/video inputs feature negative rail signal operation allowing simple DC coupled accessories. These device allow a single micro/mini USB port to support all the common interfaces on Cellular phones and portable media players over the same external lines. Link: https://lore.kernel.org/lkml/20250506073216.43059-3-clamor95@gmail.com/ Signed-off-by: Svyatoslav Ryhel Signed-off-by: Chanwoo Choi commit de33ea612a36f8415579298899fd0b6c28a45c80 Author: Svyatoslav Ryhel Date: Tue May 6 10:32:15 2025 +0300 dt-bindings: extcon: Document Maxim MAX14526 MUIC Add bindings for Maxim MAX14526 MicroUSB Integrated Circuit. Link: https://lore.kernel.org/lkml/20250506073216.43059-2-clamor95@gmail.com/ Signed-off-by: Svyatoslav Ryhel Reviewed-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit 92bac7d4de9c07933f6b76d8f1c7f8240f911f4f Author: Krzysztof Kozlowski Date: Fri May 9 09:17:04 2025 +0200 extcon: adc-jack: Cleanup wakeup source only if it was enabled Driver in the probe enables wakeup source conditionally, so the cleanup path should do the same - do not release the wakeup source memory if it was not allocated. Link: https://lore.kernel.org/lkml/20250509071703.39442-2-krzysztof.kozlowski@linaro.org/ Reported-by: Christophe JAILLET Closes: https://lore.kernel.org/r/22aaebb7-553b-4571-8a43-58a523241082@wanadoo.fr/ Fixes: 78b6a991eb6c ("extcon: adc-jack: Fix wakeup source leaks on device unbind") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit 8bc70f2ea932976604876756d6d868eca3ac4cbb Author: Jouni Högander Date: Fri Sep 5 10:27:08 2025 +0300 drm/i915/psr: Add poll for checking PSR is idle before starting update We are currently observing crc failures after we started using dsb for PSR updates as well. This seems to happen because PSR HW is still sending couple of updates using old framebuffers on wake-up. Fix this by adding poll ensuring PSR is idle before starting update. v2: pass new_crtc_state->dsb_commit to intel_psr_wait_for_idle_dsb Signed-off-by: Jouni Högander Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250905072708.2659411-5-jouni.hogander@intel.com commit 11b0567ee605e95becc02f858f8f42706687a068 Author: Jouni Högander Date: Fri Sep 5 10:27:07 2025 +0300 drm/i915/psr: New interface adding PSR idle poll into dsb commit We are currently observing crc failures after we started using dsb for PSR updates as well. This seems to happen because PSR HW is still sending couple of updates using old framebuffers on wake-up. This patch is preparing to fix that by adding interface which can be used to add poll ensuring PSR HW is idle into dsb commit. v3: add intel_dsb as a parameter to intel_psr_wait_for_idle_dsb v2: add pass crtc_state->dsb_commit as parameter Signed-off-by: Jouni Högander Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250905072708.2659411-4-jouni.hogander@intel.com commit a0f7f3b1654c28739e1ae338afa354c83946c3d3 Author: Jouni Högander Date: Fri Sep 5 10:27:06 2025 +0300 drm/i915/psr: Add new define for PSR idle timeout Currently we are using value 50ms as timeout for waiting PSR to idle. Add own define for this purpose. Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250905072708.2659411-3-jouni.hogander@intel.com commit 485aaebd738bfd666cf446e3a6166faf4a5dde3f Author: Jouni Högander Date: Fri Sep 5 10:27:05 2025 +0300 drm/i915/psr: Pass intel_crtc_state instead of intel_dp in wait_for_idle This is preparation to add own function for polling PSR being ready for update when doing dsb commit. Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250905072708.2659411-2-jouni.hogander@intel.com commit ce47f81925ed73f9d27b1a01f07afdb031949c68 Author: Nam Cao Date: Wed Aug 13 07:53:50 2025 +0200 PCI: hv: Remove unused parameter of hv_msi_free() The 'info' parameter of hv_msi_free() is unused. Delete it. Signed-off-by: Nam Cao Signed-off-by: Manivannan Sadhasivam Acked-by: Wei Liu commit bb053f816a8bcb0a9135fc4cc611b1cab3d82201 Author: Clément Léger Date: Fri May 23 12:19:31 2025 +0200 RISC-V: KVM: add support for SBI_FWFT_MISALIGNED_DELEG SBI_FWFT_MISALIGNED_DELEG needs hedeleg to be modified to delegate misaligned load/store exceptions. Save and restore it during CPU load/put. Signed-off-by: Clément Léger Reviewed-by: Deepak Gupta Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-15-cleger@rivosinc.com Signed-off-by: Anup Patel commit 6b72fd170592ad3fb14cadfa973908e5d63d27c8 Author: Clément Léger Date: Fri May 23 12:19:30 2025 +0200 RISC-V: KVM: add support for FWFT SBI extension Add basic infrastructure to support the FWFT extension in KVM. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-14-cleger@rivosinc.com Signed-off-by: Anup Patel commit a4bac55d99d37976209e2fc2c32bd3dfc86b0447 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:08 2025 +0900 firewire: core: code refactoring whether root node is cycle master capable The check of cycle master capability in root node is currently just in a condition branch. In this case, the required variable should be within the branch. This commit is just for the purpose. Link: https://lore.kernel.org/r/20250908012108.514698-12-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit cae2d92cdcae3f2f4510feb631661e86a26da55e Author: Takashi Sakamoto Date: Mon Sep 8 10:21:07 2025 +0900 firewire: core: code refactoring to investigate root node for bus manager In the middle of bm_work function, both the value of gap_count and the state of root node are investigated. Current implementation is not a good shape since the investigation is aligned to be flat. This commit refactors the investigation with two large branches. Link: https://lore.kernel.org/r/20250908012108.514698-11-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit ca17601b15d12bc8c435a4068fa2f907501d9305 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:06 2025 +0900 firewire: core: code refactoring to detect both IEEE 1394:1995 IRM and Canon MV5i The detection of IEEE 1394:1995 and Canon MV5i is just required within some of the condition branches. In this case, these check can be capsulated within these branches. This commit refactors the checks. Link: https://lore.kernel.org/r/20250908012108.514698-10-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 8c2d2fcd6b7934c7d694148b542760144a2a1b5a Author: Takashi Sakamoto Date: Mon Sep 8 10:21:05 2025 +0900 firewire: core: refer fw_card member to initiate bus reset under acquiring lock The gap_count member of fw_card structure is referred when initiate bus reset. This reference is done out of acquiring lock. This is not good. This commit takes the reference within the acquiring lock, with additional code refactoring. Link: https://lore.kernel.org/r/20250908012108.514698-9-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 7dc12e84eff7f934e2456a858ad23d3743c69578 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:04 2025 +0900 firewire: core: code refactoring to evaluate transaction result to CSR_BUS_MANAGER_ID The call of bm_work should be done after acquiring spin lock of fw_card. For asynchronous transaction, the lock should be released temporarily due to event waiting. A commit 27310d561622 ("firewire: core: use guard macro to maintain properties of fw_card") applied scoped_guard() to the bm_work function, however it looks hard to follow to the control flow. This commit refactors the spin lock acquisition after the transaction. Link: https://lore.kernel.org/r/20250908012108.514698-8-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit b70a5f33381f7815f4a579f7b9de33f276c9d8f9 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:03 2025 +0900 firewire: ohci: localize transaction data and rcode per condition branch The function local variable, transaction_data, in bm_work function is conditionally used. In the case, the branch-level variable is sometimes useful. This commit uses this idea. Link: https://lore.kernel.org/r/20250908012108.514698-7-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 25feb1a96e21ae37790c109ea2c675061ba11794 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:02 2025 +0900 firewire: core: use cleanup function in bm_work In "bm_work" function, the references to fw_card and fw_node are released at last. This is achieved by using goto statements. For this case, the kernel cleanup framework is available. This commit uses the framework to remove these statements. Link: https://lore.kernel.org/r/20250908012108.514698-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit a2bbb8602dc29a8a3fe4f0377c7b820fba384697 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:01 2025 +0900 firewire: core: add helper functions to access to fw_device data in fw_node structure The data mbmer in fw_node structure is an opaque pointer, while nowadays it is just used to refer to fw_device associated with the fw_node. This commit redefines the opaque pointer to a pointer to fw_device structure, and adds some helper functions to set/get it. Link: https://lore.kernel.org/r/20250908012108.514698-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit cbb13dceec65b6021a4f403d4fa7b237569a1007 Author: Takashi Sakamoto Date: Mon Sep 8 10:21:00 2025 +0900 firewire: ohci: use return value from fw_node_get() The programming pattern, referring after increasing reference count, is supported by fw_node_get(). This commit simplify the programming pattern. Link: https://lore.kernel.org/r/20250908012108.514698-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit c908e072b6932e2d40645f6916c9b4bfe8f3f12f Author: Takashi Sakamoto Date: Mon Sep 8 10:20:59 2025 +0900 firewire: core: utilize cleanup function to release workqueue in error path The helper macro, retain_and_null_ptr(), introduced by a commit 092d00ead733 ("cleanup: Provide retain_and_null_ptr()") in v6.16 kernel, is useful in the error path to release the part of structure member. This commit uses the relatively new function. Link: https://lore.kernel.org/r/20250908012108.514698-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit ada2e4091d20735537fab67d970ffdbb8e9f7672 Author: Takashi Sakamoto Date: Mon Sep 8 10:20:58 2025 +0900 firewire: ohci: use kcalloc() variant for array allocation When allocating the list of isochronous context structure, a kzalloc() variant of managed device API is used. In this case, a kcalloc() variant is available. This commit replaces these lines with devm_kcalloc(). Link: https://lore.kernel.org/r/20250908012108.514698-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit a3a2923aaf7f2cf3aaa4649bddee2f936751825f Author: Wensheng Wang Date: Tue Aug 5 18:20:19 2025 +0800 hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver Add support for MPS VR mp2869/mp2869a,mp29608/mp29608a,mp29612/mp29612a and mp29816/mp29816a/mp29816b/mp29816c controller. This driver exposes telemetry and limit value readings and writtings. Signed-off-by: Wensheng Wang Link: https://lore.kernel.org/r/20250805102020.749850-2-wenswang@yeah.net Signed-off-by: Guenter Roeck commit c97c66e04c2294d59827835e6fd46e0e4a5e2c06 Author: Wensheng Wang Date: Tue Aug 5 18:20:18 2025 +0800 dt-bindings: hwmon: Add MPS mp2869,mp29608,mp29612,mp29816 and mp29502 Add support for MPS mp2869/mp2869a,mp29608/mp29608a,mp29612/mp29612a, mp29816/mp29816a/mp29816b/mp29816c and mp29502 controller. Acked-by: Rob Herring (Arm) Signed-off-by: Wensheng Wang Link: https://lore.kernel.org/r/20250805102020.749850-1-wenswang@yeah.net Signed-off-by: Guenter Roeck commit 552e369db339c4d9f29a5569ec2d661cb4353f40 Author: Christophe JAILLET Date: Sun Sep 7 12:20:20 2025 +0200 hwmon: (nzxt-smart2) Use devm_mutex_init() Use devm_mutex_init() instead of hand-writing it. This saves some LoC, improves readability and saves some space in the generated .o file. Before: ====== text data bss dec hex filename 25878 11329 128 37335 91d7 drivers/hwmon/nzxt-smart2.o After: ===== text data bss dec hex filename 25551 11257 128 36936 9048 drivers/hwmon/nzxt-smart2.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f51fac0871ec7dbe4e28447ee4f774d028a53426.1757240403.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck commit 55cb81254333ab90985a9e861d33c6f8e1cf0118 Author: Maciej Zonski Date: Sat Sep 6 18:17:37 2025 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X870-I GAMING WIFI Add support for ROG STRIX X870-I GAMING WIFI Signed-off-by: Maciej Zonski Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250906161748.219567-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 273bfedc003c40bb0fb471841c62f4fc7063be83 Author: Guenter Roeck Date: Sun Aug 31 17:54:16 2025 -0700 hwmon: (ina238) Add support for INA700 INA700 is register compatible to INA780 but has different current, power, and energy LSB values. While the chip does not directly report the shunt voltage, report it anyway by calculating its value from the current register. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Cc: Christian Kahr Signed-off-by: Guenter Roeck commit 7942ca9a475115b9668e53c2d9cfb57a51d62e04 Author: Guenter Roeck Date: Mon Sep 1 09:02:07 2025 -0700 dt-bindings: hwmon: ti,ina2xx: Add INA700 Add a compatible string for INA700. The chip is register compatible with INA780 but implements different ADC ranges and thus needs a separate compatible entry. Cc: Christian Kahr Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Reviewed-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 248fd3b96d08c2a5736ca8395470544f23fe1f5c Author: Guenter Roeck Date: Sun Aug 31 09:39:53 2025 -0700 hwmon: (ina238) Add support for INA780 INA780 is similar to the other chips in the series, but does not support the shunt voltage register. Shunt voltage limit registers have been renamed to current limit registers, but are otherwise identical. While the chip does not directly report the shunt voltage, report it anyway by calculating its value from the current register. Cc: Chris Packham Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit d153106bd4fd63eb8d3557277a3d4ee5dbbed3b0 Author: Guenter Roeck Date: Sun Aug 31 09:39:53 2025 -0700 hwmon: (ina238) Only configure calibration and shunt registers if needed Prepare for supporting chips with internal shunt resistor by only setting calibration and shunt resistor registers if no current LSB is configured. Do not display a log message during probe if a chip does not have shunt and gain registers since those would otherwise display 0, and a message just indicating that the driver was loaded would be just noise. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 807e315bf9509f4d57eca687c9732ce16c3ef843 Author: Guenter Roeck Date: Mon Sep 1 08:37:15 2025 -0700 hwmon: (ina238) Support active-high alert polarity All chips supported by this driver support configurable active-high alert priority. This is already documented in the devicetree description. Add support for it to the driver. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit cc67b875c9e40ef7628219a37447c477d5324dc1 Author: Guenter Roeck Date: Sun Aug 31 15:06:05 2025 -0700 hwmon: (ina238) Use the energy64 attribute type to report the energy Use the energy64 attribute type instead of locally defined sysfs attributes to report the accumulated energy. No functional change intended. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit e7702d72c3e3fcc6017d29bba420deb04da3e1d6 Author: Guenter Roeck Date: Sun Aug 31 09:34:13 2025 -0700 hwmon: (ina238) Order chip information alphabetically Order chip type enum and chip configuration data alphabetically to simplify adding support for additional chips. No functional change. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit a1d5f8ecb934066220b4cb1b8ba831a8726bf52f Author: Guenter Roeck Date: Sun Aug 31 09:25:16 2025 -0700 hwmon: (ina238) Add support for current limits Since the shunt voltage register and the current register now report the same values, use the shunt voltage limit registers to report and adjust current limits, using the same LSB as the LSB used for the actual current register. Handle current register accuracy differences in separate function to improve code readability. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit b7bce92f2890f6002bd3155c0510bd28b6ead4e1 Author: Guenter Roeck Date: Wed Sep 3 16:08:03 2025 -0700 hwmon: (ina238) Stop using the shunt voltage register Since the value of the current register and the value of the shunt register now match each other, it is no longer necessary to read the shunt voltage register in the first place. Read the current register instead and use it to calculate the shunt voltage. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit bcac89eebefbcf886c2b971de4bf026073e0ee8e Author: Guenter Roeck Date: Wed Sep 3 16:02:48 2025 -0700 hwmon: (ina238) Improve current dynamic range The best possible dynamic range for current measurements is achieved if the shunt register value matches the current register value. Adjust the calibration register as well as fixed and default shunt resistor values accordingly to achieve this range. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 7e420b6a274206f339fe3617943ba1ef9dd1fcb0 Author: Guenter Roeck Date: Sat Aug 30 21:48:29 2025 -0700 hwmon: (ina238) Simplify voltage register accesses Calculate voltage LSB values in the probe function and use throughout the code. Use a single function to read all voltages, independently of the register width. Use the pre-calculated LSB values to convert register values to voltages and do not rely on runtime chip specific code. Use ROUND_CLOSEST functions instead of divide operations to reduce rounding errors. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 4a4fcd611295af96af51574b31f9e19e7505f965 Author: Guenter Roeck Date: Thu Aug 28 17:44:17 2025 -0700 hwmon: (ina238) Pre-calculate current, power, and energy LSB Current, power, and energy LSB do not change during runtime, so we can pre-calculate the respective values. The power LSB can be derived from the current LSB using the equation in the datasheets. Similar, the energy LSB can be derived from the power LSB. Also add support for chips with built-in shunt resistor by providing a chip specific configuration parameter for the current LSB. The relationship of current -> power -> energy LSB values in those chips is the same as in chips with external shunt resistor, so configuration parameters for power and energy LSB are not needed. Use ROUND_CLOSEST functions instead of divide operations to reduce rounding errors. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 40a5da1ec101476dd6abb9cfa181f1b50dc24ad0 Author: Guenter Roeck Date: Sat Aug 30 17:38:51 2025 -0700 hwmon: (ina238) Rework and simplify temperature calculations The temperature register is 16 bit wide for all chips. The decimal point is at the same location (bit 7 = 1 degree C). That means we can use the resolution to calculate temperatures. Do that to simplify the code. There is only a single writeable temperature attribute, and it is very unlikely that the chips supported by this driver will ever require another one. That means checking for that attribute in the write function is unnecessary. Drop the check. Rename the write function from ina238_write_temp() to ina238_write_temp_max() to reflect that a single attribute is written. Also extend the accepted temperature value range to the range supported by the chip registers. Limiting the accepted value range to the temperature range supported by the chip would make it impossible to read an out-of-range limit from the chip and to write the same value back into it. This is undesirable, especially since the maximum temperature register does contain the maximum register value after a chip reset, not the temperature limit supported by the chip. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 8640f9ab1015741e22dff2dd1d6665ad024d5534 Author: Guenter Roeck Date: Mon Sep 1 11:01:53 2025 -0700 hwmon: (ina238) Drop pointless power attribute check on attribute writes There is only a single writeable power attribute, and it is very unlikely that the chips supported by this driver will ever require another one. That means checking for that attribute during runtime is unnecessary. Drop the check. Rename the write function from ina238_write_power() to ina238_write_power_max() to reflect that a single attribute is written. No functional change intended. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit f2711a19651f28b426cf78792822a37f7641f43c Author: Guenter Roeck Date: Fri Sep 5 13:20:04 2025 -0700 hwmon: (ina238) Update documentation and Kconfig entry Update driver documentation and Kconfig entry to list all chips supported by the driver. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 9a8113a5c6eb23aaaafa9bde043b76a22a3a4e44 Author: Guenter Roeck Date: Sun Aug 31 14:53:58 2025 -0700 hwmon: (ina238) Drop platform data support There are no in-tree users of ina2xx platform data. Drop support for it. The driver already supports device properties which can be used as alternative if needed. Also remove reference to the non-existing shunt_resistor sysfs attribute from the driver documentation. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit 0bcd01f757bc06471c82a137eafee281ef1b6e38 Author: Guenter Roeck Date: Wed Aug 28 21:56:57 2024 -0700 hwmon: Introduce 64-bit energy attribute support Many chips require 64-bit variables to display the accumulated energy, even more so since the energy units are micro-Joule. Add new sensor type "energy64" to support reporting the chip energy as 64-bit values. Changing the entire hardware monitoring API is not feasible, and it is only really necessary to support reading 64-bit values for the "energyX_input" attribute. For this reason, keep the API as-is and use type casts on both ends to pass 64-bit pointers when reading the accumulated energy. On the write side (which is only useful for the energyX_enable attribute), keep passing the written value as long. Reviewed-by: Chris Packham Tested-by: Chris Packham # INA780 Signed-off-by: Guenter Roeck commit da0a3cc73a2bffe8faef6227a74e5a2de2e79a0c Author: Marek Vasut Date: Thu Sep 4 22:21:10 2025 +0200 hwmon: (pwm-fan) Implement after shutdown fan settings Add fan-shutdown-percent property, used to describe fan RPM in percent set during shutdown. This is used to keep the fan running at fixed RPM after the kernel shut down, which is useful on hardware that does keep heating itself even after the kernel did shut down, for example from some sort of management core. The current behavior of pwm-fan is to unconditionally stop the fan on shutdown, which is not always the safe and correct thing to do, so let the hardware description include the expected behavior. Signed-off-by: Marek Vasut Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250904202157.170600-2-marek.vasut+renesas@mailbox.org Signed-off-by: Guenter Roeck commit bd48b5a4e8d3e1ac2c1ba1e18ba1350ea2c9eb10 Author: Marek Vasut Date: Thu Sep 4 22:21:09 2025 +0200 dt-bindings: hwmon: pwm-fan: Document after shutdown fan settings Document fan-shutdown-percent property, used to describe fan RPM in percent set during shutdown. This is used to keep the fan running at fixed RPM after the kernel shut down, which is useful on hardware that does keep heating itself even after the kernel did shut down, for example from some sort of management core. Signed-off-by: Marek Vasut Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250904202157.170600-1-marek.vasut+renesas@mailbox.org Signed-off-by: Guenter Roeck commit 8702c8f53d93929a804cd16015e229cb0770b4ec Author: Eugene Shalygin Date: Wed Sep 3 21:17:26 2025 +0200 hwmon: (asus-ec-sensors) add PRIME Z270-A Add support for the PRIME Z270-A board. Tested-by: Jan Philipp Groß Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250903191736.14451-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 5529bc1a2ff047ca94a64d91ec3ed52b01946837 Author: Michael Tandy Date: Wed Sep 3 20:47:36 2025 +0200 hwmon: (asus-ec-sensors) sort declarations Sort all the declarations in the source file. Contributors are asked to insert new entries keeping alphabetical order, but the existing ones were not completely sorted. Signed-off-by: Michael Tandy Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250903184753.5876-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 34c61c198d06b83c1a9da88005e3f4eec85447da Author: Tom Ingleby Date: Tue Sep 2 20:17:56 2025 -0700 hwmon: (asus-ec-sensors) add ROG STRIX Z690-E GAMING WIFI Add support for the ASUS ROG STRIX Z690-E GAMING WIFI Signed-off-by: Tom Ingleby Link: https://lore.kernel.org/r/20250903031800.4173-1-tom@ewsting.com Signed-off-by: Guenter Roeck commit f19617d1478aa595b5e2439847d34f3ac414c836 Author: Guenter Roeck Date: Mon Sep 1 08:59:02 2025 -0700 dt-bindings: hwmon: ti,ina2xx: Update details for various chips ti,maximum-expected-current-microamp, ti,shunt-gain, and shunt-resistor properties are not supported on all chips described in this bindings file. Update the bindings accordingly. Cc: Chris Packham Signed-off-by: Guenter Roeck Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250901155902.2667063-1-linux@roeck-us.net Signed-off-by: Guenter Roeck commit 58639dfde0c29434e902a0efe213b35ede35604e Author: Chris Packham Date: Fri Aug 29 15:05:09 2025 +1200 dt-bindings: hwmon: ti,ina2xx: Add INA780 device Add a compatible string for the INA780 device. Signed-off-by: Chris Packham Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250829030512.1179998-2-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit d41f80bd43e6f613078060f63ad60f98e4773b56 Author: Flaviu Nistor Date: Mon Aug 25 21:02:44 2025 +0300 hwmon: tmp102: Add support for label Add support for label sysfs attribute similar to other hwmon devices. This is particularly useful for systems with multiple sensors on the same board, where identifying individual sensors is much easier since labels can be defined via device tree. Signed-off-by: Flaviu Nistor Link: https://lore.kernel.org/r/20250825180248.1943607-2-flaviu.nistor@gmail.com [groeck: Fixed continuation line alignment] Signed-off-by: Guenter Roeck commit fa1ab48bfe97c86278ddf7fb535bc597e64fd210 Author: Flaviu Nistor Date: Mon Aug 25 21:02:43 2025 +0300 dt-bindings: hwmon: tmp102: Add label property Add support for an optional label property similar to other hwmon devices. This allows, in case of boards with multiple TMP102 sensors, to assign distinct names to each instance. Signed-off-by: Flaviu Nistor Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250825180248.1943607-1-flaviu.nistor@gmail.com [groeck: Dropped unnecessary "|" after "description:"] Signed-off-by: Guenter Roeck commit 402dfbe7ef6bd5d13341a970c47282c7d60cf9a0 Author: Debanil Chowdhury Date: Sun Aug 31 04:45:54 2025 +0000 hwmon: crps: Fix typos in crps.rst documentation Changed a misspelling in crps.rst documentation: "Critial" → "Critical". Found using codespell tool. Signed-off-by: Debanil Chowdhury Link: https://lore.kernel.org/r/20250831045710.6009-1-kerneldev@debanilchowdhury.com Signed-off-by: Guenter Roeck commit aa52d636641bc9b38b033ab3dd1c6c4e059a863d Author: Eugene Shalygin Date: Sat Aug 30 15:12:15 2025 +0200 hwmon: (asus-ec-sensors) refine config description Remove outdated mention of the supported mmotherboard families and add a hint which sensor readings are available via the module. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250830131224.748481-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 9d4388466768c65691e6d554e89a0e57528c9edb Author: Michael Tandy Date: Sat Aug 30 14:00:59 2025 +0200 (asus-ec-sensors) add Pro WS WRX90E-SAGE SE Add support for Pro WS WRX90E-SAGE SE Signed-off-by: Michael Tandy Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250830120121.738223-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit d5c42cb4583c59e24262f0227fe9a0bf35a661e1 Author: Qianfeng Rong Date: Sat Aug 30 17:51:05 2025 +0800 hwmon: (nct6775) Use int type to store negative error codes Change the 'ret' variable from u32 to int in nct6775_asuswmi_read() to store negative error codes or zero; Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250830095105.3271-1-rongqianfeng@vivo.com Signed-off-by: Guenter Roeck commit 468a20df2ba62ab55feabc4e4306e70824bcb26c Author: Dave Hansen Date: Thu Aug 28 13:17:29 2025 -0700 hwmon: (coretemp) Replace x86_model checks with VFM ones Intel CPUs have been using Family 6 for a while. The Family-model checks in the coretemp driver implicitly assume Family 6. With the upcoming Family 18 and 19 models, some of these checks fall apart. While reading the temperature target MSR, cpu_has_tjmax() performs model checks only to determine if a device warning should be printed. Instead of expanding the checks, get rid of the function and print the warning once unconditionally if the MSR read fails. The checks aren't worth preventing a single line warning to dmesg. Update the rest of the x86_model checks with VFM ones to make them more robust. This automatically covers the upcoming Family 18 and 19 as well as any future extended families. Add a code comment to reflect that none of the CPUs in Family 5 or Family 15 set X86_FEATURE_DTHERM. The VFM checks do not impact these CPUs since the driver does not load on them. Signed-off-by: Dave Hansen Signed-off-by: Sohil Mehta Reviewed-by: Dave Hansen Link: https://lore.kernel.org/r/20250828201729.1145420-1-sohil.mehta@intel.com Signed-off-by: Guenter Roeck commit 3d5fcffcdf6266ddf070110eb7d8a6387fd9d291 Author: Grant Peltier Date: Wed Aug 27 17:42:47 2025 -0500 docs: hwmon: add RAA228244 and RAA228246 info to isl68137 documentation The Renesas RAA228244 and RAA228246 are recently released digital multiphase controllers. Signed-off-by: Grant Peltier Link: https://lore.kernel.org/r/ddeaf4d2fd1f9c85302ee9b5bf16cfaecf9b89ad.1756331945.git.grantpeltier93@gmail.com Signed-off-by: Guenter Roeck commit 2190ad55a601da0bf78ae9dc14b26e82a1c4c959 Author: Grant Peltier Date: Wed Aug 27 17:41:36 2025 -0500 hwmon: (pmbus/isl68137) add support for Renesas RAA228244 and RAA228246 The RAA228244 and RAA228246 are both recently released digital dual-output multiphase PWM controllers. Signed-off-by: Grant Peltier Link: https://lore.kernel.org/r/70bb08e291bd57722b1b0edf732cd0017714ef07.1756331945.git.grantpeltier93@gmail.com Signed-off-by: Guenter Roeck commit 5473fccb809a4cb6777572d420c03446d96101b0 Author: Grant Peltier Date: Wed Aug 27 17:44:19 2025 -0500 dt-bindings: hwmon: (pmbus/isl68137) add RAA228244 and RAA228246 support Add device type support for raa228244 and raa228246. Signed-off-by: Grant Peltier Acked-by: Conor Dooley Link: https://lore.kernel.org/r/c0c6e99e51b6fd4c5dbab02e02e4d81abe31f085.1756331945.git.grantpeltier93@gmail.com Signed-off-by: Guenter Roeck commit d9d61f1da35038793156c04bb13f0a1350709121 Author: Chuande Chen Date: Thu Aug 14 13:39:40 2025 +0800 hwmon: (sbtsi_temp) AMD CPU extended temperature range support Many AMD CPUs can support this feature now. We would get a wrong CPU DIE temperature if don't consider this. In low-temperature environments, the CPU die temperature can drop below zero. So many platforms would like to make extended temperature range as their default configuration. Default temperature range (0C to 255.875C). Extended temperature range (-49C to +206.875C). Ref Doc: AMD V3000 PPR (Doc ID #56558). Signed-off-by: Chuande Chen Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com Signed-off-by: Guenter Roeck commit 43c056ac85b60232861005765153707f1b0354b6 Author: David Ober Date: Thu Aug 7 06:32:28 2025 -0400 hwmon: (lenovo-ec-sensors) Update P8 supprt This fixes differences for the P8 system that was initially set to the same thermal values as the P7, also adds in the PSU sensor for all of the supported systems Signed-off-by: David Ober Signed-off-by: David Ober Link: https://lore.kernel.org/r/20250807103228.10465-1-dober6023@gmail.com [groeck: Update subject] Signed-off-by: Guenter Roeck commit f86e7a69ca9a4a9c2147d2bbff4dd7e025f80713 Author: Wolfram Sang Date: Wed Aug 13 21:07:28 2025 +0200 hwmon: (sch56xx-common) don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813190728.3682-2-wsa+renesas@sang-engineering.com Signed-off-by: Guenter Roeck commit e5d1e313d7b6272d6dfda983906d99f97ad9062b Author: Rong Zhang Date: Sun Aug 24 02:04:41 2025 +0800 hwmon: (k10temp) Add device ID for Strix Halo The device ID of Strix Halo Data Fabric Function 3 has been in the tree since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family 0x1a"), but is somehow missing from k10temp_id_table. Add it so that it works out of the box. Tested on Beelink GTR9 Pro Mini PC. Signed-off-by: Rong Zhang Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe Signed-off-by: Guenter Roeck commit fd1a9a68e64fc41bffd8bfbf987a11c53dda4cf2 Author: Aleksander Jan Bajkowski Date: Thu Aug 14 10:04:41 2025 +0200 dt-bindings: hwmon: convert lantiq-cputemp to yaml Convert the Lantiq cpu temperature sensor bindings to yaml format. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250814080708.3054732-1-olek2@wp.pl Signed-off-by: Guenter Roeck commit a6461d2039fac16e7965bf91742f592986803194 Author: Liao Yuanhong Date: Wed Aug 20 21:15:08 2025 +0800 hwmon: (ltc4282) remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250820131509.502007-1-liaoyuanhong@vivo.com Signed-off-by: Guenter Roeck commit 71e5262374e7ccc7e692fc005273f1fe2f74830e Author: Jean Delvare Date: Wed Aug 27 11:13:44 2025 +0200 hwmon: Remove Jean Delvare from maintainers I haven't been active in maintaining the hwmon subsystem in the last decade, so I think it's about time to admit that I do not have the time for this duty and update the MAINTAINERS file to reflect that. I would like to thank Guenter Roeck for taking over and doing an excellent work for so many years. Signed-off-by: Jean Delvare Link: https://lore.kernel.org/r/20250827111344.0debba2a@endymion Signed-off-by: Guenter Roeck commit 1ba272bfdf55a32c1240a629fd8c98eaaa3f8351 Author: ChiShih Tsai Date: Thu Aug 7 06:37:24 2025 +0800 hwmon: (pmbus/adm1275) add sq24905c support Add support for sq24905c which is similar to adm1275 and other chips of the series. Signed-off-by: ChiShih Tsai Link: https://lore.kernel.org/r/20250806223724.1207-3-tomtsai764@gmail.com Signed-off-by: Guenter Roeck commit 3331e5469219d92ea8e9a85fe4fbf679b6aac672 Author: ChiShih Tsai Date: Thu Aug 7 06:37:23 2025 +0800 dt-bindings: hwmon: adm1275: add sq24905c support Add support for sq24905c Hot-Swap Controller and Digital Power Monitor. Acked-by: Krzysztof Kozlowski Signed-off-by: ChiShih Tsai Link: https://lore.kernel.org/r/20250806223724.1207-2-tomtsai764@gmail.com Signed-off-by: Guenter Roeck commit ceb562d109ca6ae3ca77d0367ddd374473acbb2d Author: Dave Hansen Date: Fri Aug 8 10:38:07 2025 -0700 MAINTAINERS: Mark coretemp driver as orphaned This maintainer's email no longer works. Remove it from MAINTAINERS. Also mark the driver as Orphaned for now. Signed-off-by: Dave Hansen Cc: Jean Delvare Cc: Guenter Roeck Cc: linux-hwmon@vger.kernel.org Link: https://lore.kernel.org/r/20250808173807.96D134EA@davehans-spike.ostc.intel.com Signed-off-by: Guenter Roeck commit 3aa72cf03924d04c8d20f8b319df8f73550dd26c Author: Eugene Shalygin Date: Tue Aug 5 22:31:48 2025 +0200 hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI Use mutex from the SIO device rather than the global lock. Signed-off-by: Eugene Shalygin Fixes: 3e538b52157b ("hwmon: (asus-ec-sensors) add ProArt X870E-CREATOR WIFI") Link: https://lore.kernel.org/r/20250805203157.18446-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 15c8317366908c3b5a22573483a3dbbefba3fc38 Author: Jamie Vickery Date: Sat Aug 2 15:09:02 2025 +0200 hwmon: (asus-ec-sensors) Add Z790-I GAMING WIFI Add support for the ROG STRIX Z790-I GAMING WIFI board Signed-off-by: Jamie Vickery Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250802130912.175543-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit fec40c4837a95ae511d9e1b709943b6c243db4d2 Author: Runar Grønås Date: Fri Aug 1 21:50:08 2025 +0200 hwmon: (asus-ec-sensors) Add X670E-I GAMING WIFI Add support for ROG STRIX X670E-I GAMING WIFI Signed-off-by: Runar Grønås Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250801195020.11106-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 83b3354a4ad9a784a3335a2c303c693f521d1e47 Author: Lakshay Piplani Date: Mon Jul 28 09:49:13 2025 +0530 hwmon: (lm75) Add NXP P3T1750 support Add support for lm75 compatible NXP P3T1750 temperature sensor. Signed-off-by: Lakshay Piplani Link: https://lore.kernel.org/r/20250728041913.3754236-2-lakshay.piplani@nxp.com [groeck: Fixed alphabetic order for new chip entries] Signed-off-by: Guenter Roeck commit 6a9b2fb8411e1bc9345f048c8061cfa96f45151f Author: Lakshay Piplani Date: Mon Jul 28 09:49:12 2025 +0530 dt-bindings: hwmon: (lm75) Add binding for NXP P3T1750 Add "nxp,p3t1750" to the lm75 compatible list. Signed-off-by: Lakshay Piplani Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250728041913.3754236-1-lakshay.piplani@nxp.com Signed-off-by: Guenter Roeck commit 0183cb21b8a87e7499a0ef3b94a7df43e266fa44 Author: Nicholas Flintham Date: Mon Jul 28 22:49:10 2025 +0200 hwmon: (asus-ec-sensors) Add ROG STRIX Z790E GAMING WIFI II Add support for the ROG STRIX Z790E GAMING WIFI II board. Signed-off-by: Nicholas Flintham Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250728205133.15487-4-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 32afccb263e48164e4f1596bdf4a9a67468ba330 Author: Dylan Tackoor Date: Mon Jul 28 22:49:09 2025 +0200 hwmon: (asus-ec-sensors) Add B650E-I Add support for ROG STRIX B650E-I GAMING WIFI. Signed-off-by: Dylan Tackoor Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250728205133.15487-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 25b2c02e5b1f834b405a7f3fa6854115c8245d4c Author: Lucas Yunkyu Lee Date: Mon Jul 28 22:49:08 2025 +0200 hwmon: (asus-ec-sensors) Add STRIX B850-I GAMING WIFI Add support for the STRIX B850-I GAMING WIFI Signed-off-by: Lucas Yunkyu Lee Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250728205133.15487-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit f116af2eb51ed9df24911537fda32a033f1c58da Author: Avadhut Naik Date: Tue Jul 29 00:15:43 2025 +0000 hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models Add thermal info support for newer AMD Family 1Ah-based models. Signed-off-by: Avadhut Naik Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com Signed-off-by: Guenter Roeck commit 4710b47988fc028e1eb92b73192cb1ec2a508c65 Author: Shankari Anand Date: Mon Aug 18 18:55:51 2025 +0530 rust: task: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in `task.rs` to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 72b04a8af7fb11e0f12e52985543d7e699fd4406 Author: Miguel Ojeda Date: Fri Aug 1 18:17:52 2025 +0200 rust: prelude: re-export `core::mem::{align,size}_of{,_val}` Rust 1.80.0 added: align_of align_of_val size_of size_of_val from `core::mem` to the prelude [1]. For similar reasons, and to minimize potential confusion when code may work in later versions but not in our current minimum, add it to our prelude too. Link: https://github.com/rust-lang/rust/pull/123168 [1] Link: https://lore.kernel.org/rust-for-linux/CANiq72kOLYR2A95o0ji2mDmEqOKh9e9_60zZKmgF=vZmsW6DRg@mail.gmail.com/ [2] Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Andreas Hindborg Reviewed-by: Daniel Almeida Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 6d65ccac394c7539e710c569e21067f617493171 Author: Onur Özkan Date: Thu Jul 31 23:41:15 2025 +0300 rust: error: add C header links The error codes come from several headers. Thus, add the other header links. Signed-off-by: Onur Özkan Reviewed-by: Daniel Almeida [ Sorted headers. Added line breaks. Reworded commit message. - Miguel ] Signed-off-by: Miguel Ojeda commit 9e3bbbf5f316aee4b9508db70d558a3f5532dcc0 Author: Miguel Ojeda Date: Wed Jul 30 15:07:16 2025 +0200 rust: warn if `srctree/` links do not exist `srctree/` links may point to nonexistent files, e.g. due to renames that missed to update the files or simply because of typos. Since they can be easily checked for validity, do so and print a warning in the file does not exist. This found the following cases already in-tree: warning: srctree/ link to include/linux/blk_mq.h does not exist warning: srctree/ link to include/linux/drm/drm_gem.h does not exist warning: srctree/ link to include/linux/drm/drm_drv.h does not exist warning: srctree/ link to include/linux/drm/drm_ioctl.h does not exist warning: srctree/ link to include/linux/drm/drm_file.h does not exist warning: srctree/ link to include/linux/drm/drm_device.h does not exist Inspired-by: Onur Özkan Link: https://lore.kernel.org/rust-for-linux/CANiq72=xCYA7z7_rxpzzKkkhJs6m7L_xEaLMuArVn3ZAcyeHdA@mail.gmail.com/ Reviewed-by: Onur Özkan Reviewed-by: Daniel Almeida Tested-by: Daniel Almeida Signed-off-by: Miguel Ojeda commit c2783c7cfefd55b1a5be781679cbee5191c0fd87 Author: Miguel Ojeda Date: Wed Jul 30 15:07:15 2025 +0200 rust: drm: fix `srctree/` links These `srctree/` links pointed inside `linux/`, but they are directly under `drm/`. Thus fix them. This cleans a future warning that will check our `srctree/` links. Cc: stable@vger.kernel.org Fixes: a98a73be9ee9 ("rust: drm: file: Add File abstraction") Fixes: c284d3e42338 ("rust: drm: gem: Add GEM object abstraction") Fixes: 07c9016085f9 ("rust: drm: add driver abstractions") Fixes: 1e4b8896c0f3 ("rust: drm: add device abstraction") Fixes: 9a69570682b1 ("rust: drm: ioctl: Add DRM ioctl abstraction") Acked-by: Danilo Krummrich Reviewed-by: Daniel Almeida Signed-off-by: Miguel Ojeda commit 208d7f788e84e80992d7b1c82ff17b620eb1371e Author: Miguel Ojeda Date: Wed Jul 30 15:07:14 2025 +0200 rust: block: fix `srctree/` links This `srctree/` link pointed to a file with an underscore, but the header used a dash instead. Thus fix it. This cleans a future warning that will check our `srctree/` links. Cc: stable@vger.kernel.org Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module") Reviewed-by: Daniel Almeida Signed-off-by: Miguel Ojeda commit 8a7c11af8e59e66d1e962fa863a77e59ef293ea7 Author: Shankari Anand Date: Tue Aug 19 00:40:34 2025 +0530 rust: sync: Update ARef and AlwaysRefCounted imports from sync::aref Update the in-file reference of sync/aref.rs to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit f1d3703fa371332bded4ff174eddb732cef2b1a0 Merge: 76eeb9b8de9880 fe927defbb4f31 Author: Miguel Ojeda Date: Mon Sep 8 00:09:41 2025 +0200 Merge tag 'alloc-next-v6.18-2025-09-04' of https://github.com/Rust-for-Linux/linux into rust-next Pull alloc and DMA updates from Danilo Krummrich: Allocator: - Provide information about the minimum alignment guarantees of 'Kmalloc', 'Vmalloc' and 'KVmalloc'. - Take minimum alignment guarantees of allocators for 'ForeignOwnable' into account. - Remove the 'allocator_test' incl. 'Cmalloc'. Box: - Implement 'Box::pin_slice()', which constructs a pinned slice of elements. Vec: - Simplify KUnit test module name to 'rust_kvec'. - Add doc-test for 'Vec::as_slice()'. - Constify various methods. DMA: - Update 'ARef' and 'AlwaysRefCounted' imports. MISC: - Remove support for unused host '#[test]'s. - Constify 'ArrayLayout::new_unchecked()'. * tag 'alloc-next-v6.18-2025-09-04' of https://github.com/Rust-for-Linux/linux: rust: alloc: remove `allocator_test` rust: kernel: remove support for unused host `#[test]`s rust: alloc: implement Box::pin_slice() rust: alloc: add ARCH_KMALLOC_MINALIGN to bindgen blocklist rust: dma: Update ARef and AlwaysRefCounted imports from sync::aref rust: alloc: take the allocator into account for FOREIGN_ALIGN rust: alloc: specify the minimum alignment of each allocator rust: make `kvec::Vec` functions `const fn` rust: make `ArrayLayout::new_unchecked` a `const fn` rust: alloc: kvec: simplify KUnit test module name to "rust_kvec" rust: alloc: kvec: add doc example for as_slice method commit 42bbc32c7e9e974ae4eb830ae1381cb016133e5c Author: Chukun Pan Date: Fri Aug 1 16:00:25 2025 +0800 arm64: dts: rockchip: Add rk3528 CPU frequency scaling support By default, the CPUs on RK3528 operates at 1.5GHz. Add CPU frequency and voltage mapping to the device tree to enable dynamic scaling via cpufreq. The OPP values come from downstream kernel[1], using a voltage close to the actual frequency. Frequencies below 1.2GHz have been removed due to the same voltage. [1] https://github.com/rockchip-linux/kernel/blob/develop-5.10/arch/arm64/boot/dts/rockchip/rk3528.dtsi Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250801080025.558935-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit fdab01864390db7ef0bea28804c7a3147dc0a386 Author: Marcin Juszkiewicz Date: Fri Sep 5 13:02:30 2025 +0200 arm64: dts: rockchip: enable HDMI Receiver on NanoPC T6 Let enable HDMI input port. Signed-off-by: Marcin Juszkiewicz Link: https://lore.kernel.org/r/579370818ef3b70b57bc5b8846f3b330d091d9a4.1757068166.git.marcin@juszkiewicz.com.pl Signed-off-by: Heiko Stuebner commit 68e1e908cb7682db9fb7f79907f9352435a81c0f Author: Neill Kapron Date: Thu Aug 28 17:03:15 2025 +0000 selinux: enable per-file labeling for functionfs This patch adds support for genfscon per-file labeling of functionfs files as well as support for userspace to apply labels after new functionfs endpoints are created. This allows for separate labels and therefore access control on a per-endpoint basis. An example use case would be for the default endpoint EP0 used as a restricted control endpoint, and additional usb endpoints to be used by other more permissive domains. It should be noted that if there are multiple functionfs mounts on a system, genfs file labels will apply to all mounts, and therefore will not likely be as useful as the userspace relabeling portion of this patch - the addition to selinux_is_genfs_special_handling(). This patch introduces the functionfs_seclabel policycap to maintain existing functionfs genfscon behavior unless explicitly enabled. Signed-off-by: Neill Kapron Acked-by: Stephen Smalley [PM: trim changelog, apply boolean logic fixup] Signed-off-by: Paul Moore commit 44b0a8e433aaad8aac51593a052f043aeb9a18d1 Author: Denzeel Oliva Date: Thu Sep 4 14:07:14 2025 +0000 arm64: dts: exynos990: Enable PERIC0 and PERIC1 clock controllers Add clock controller nodes for PERIC0 and PERIC1 blocks for USI nodes. Signed-off-by: Denzeel Oliva Signed-off-by: Krzysztof Kozlowski commit b3b314ef13e46dce1cdd97a856bd0250dac8feb9 Author: Denzeel Oliva Date: Thu Sep 4 14:07:13 2025 +0000 clk: samsung: exynos990: Add PERIC0 and PERIC1 clock support Add clock controller support for Peripheral Connectivity 0 and 1 blocks. These provide clocks for USI, I2C and UART peripherals. Some clocks need to be marked as critical to prevent system hang when disabled. Signed-off-by: Denzeel Oliva Signed-off-by: Krzysztof Kozlowski commit 43bd82eb33b2ac33232724a8ddb9e07cde492328 Author: Denzeel Oliva Date: Thu Sep 4 14:07:11 2025 +0000 dt-bindings: clock: exynos990: Add PERIC0 and PERIC1 clock units Add clock management unit bindings for PERIC0 and PERIC1 blocks which provide clocks for USI, I2C and UART peripherals. Signed-off-by: Denzeel Oliva Signed-off-by: Krzysztof Kozlowski commit 04f08db52b3f892c85bd92ebbc3a7ca32e4f60f3 Author: Hans Verkuil Date: Tue Jul 22 09:34:36 2025 +0200 media: i2c: tc358743: add support for more infoframe types Add support for SPD, AUDIO, DRM and HDMI InfoFrames. Also add support for ISRC1 and ISRC2 Packet Types and a programmable type for both Packet and InfoFrames. The tc358743 HDMI-to-CSI2 bridge is widely available, and it has quite flexible InfoFrame/Packet Type support, so this makes it a very nice device to capture such data. The ACP (Audio Content Protection) Packet capture data is chosen as the programmable type. ACP is typically only used for protected audio, which is quite rare, so instead it is reprogrammed to capture DRM InfoFrames by default. This can be changed by using the packet_type module option to anything you want, and you can change it on the fly as well. It will be updated whenever VIDIOC_LOG_STATUS is called (it's really a debug feature). Tested on my Raspberry Pi 5. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 0b6cb344829b4b8605a3f6e930b207d47dee1d12 Author: Hans Verkuil Date: Tue Jul 22 09:34:35 2025 +0200 media: v4l2-core: v4l2-dv-timings: support DRM IFs Add support for DRM (Dynamic Range and Mastering) InfoFrames. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ff46e2e7034c78489fa7a6bc35f7c9dd8ab82905 Author: Miaoqian Lin Date: Tue Sep 2 12:09:49 2025 +0800 wifi: iwlwifi: Fix dentry reference leak in iwl_mld_add_link_debugfs The debugfs_lookup() function increases the dentry reference count. Add missing dput() call to release the reference when the "iwlmld" directory already exists. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://patch.msgid.link/20250902040955.2362472-1-linmq006@gmail.com Signed-off-by: Miri Korenblit commit 0d2ab5f922e75d10162e7199826e14df9cfae5cc Author: Gustavo A. R. Silva Date: Wed Aug 27 10:15:54 2025 +0200 wifi: iwlwifi: mei: Remove unused flexible-array member in struct iwl_sap_hdr Remove unused fexible-array member and avoid 14 of the following type of warnings: drivers/net/wireless/intel/iwlwifi/mei/sap.h:318:28: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/aK6-usANI1UPtFVo@kspp Signed-off-by: Miri Korenblit commit b4b34ba66443696cc5f3e95493f9d7597259b728 Author: Liao Yuanhong Date: Tue Aug 19 20:11:51 2025 +0800 wifi: iwlwifi: Remove redundant header files The header file "fw/img.h" is already included on line 9. Remove the redundant include. Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com Signed-off-by: Miri Korenblit commit c67a2470922f03bdecc43ec1ae989b85757c62b6 Author: Yang Li Date: Wed Jul 23 15:05:22 2025 +0800 wifi: iwlwifi: Remove duplicated include in trans.c The header files fw/api/tx.h is included twice in gen1_2/trans.c, so one inclusion of each can be removed. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22932 Signed-off-by: Yang Li Link: https://patch.msgid.link/20250723070522.2195817-1-yang.lee@linux.alibaba.com Signed-off-by: Miri Korenblit commit cb2d6b132a44a140aed3562ef932754d39ddccf3 Author: Eric Biggers Date: Sat Sep 6 14:35:22 2025 -0700 lib/crypto: tests: Enable Curve25519 test when CRYPTO_SELFTESTS Now that the Curve25519 library has been disentangled from CRYPTO, adding CRYPTO_SELFTESTS as a default value of CRYPTO_LIB_CURVE25519_KUNIT_TEST no longer causes a recursive kconfig dependency. Do this, which makes this option consistent with the other crypto KUnit test options in the same file. Link: https://lore.kernel.org/r/20250906213523.84915-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 68546e5632c0b982663af575ae12cc5d81facc91 Author: Eric Biggers Date: Sat Sep 6 14:35:21 2025 -0700 lib/crypto: curve25519: Consolidate into single module Reorganize the Curve25519 library code: - Build a single libcurve25519 module, instead of up to three modules: libcurve25519, libcurve25519-generic, and an arch-specific module. - Move the arch-specific Curve25519 code from arch/$(SRCARCH)/crypto/ to lib/crypto/$(SRCARCH)/. Centralize the build rules into lib/crypto/Makefile and lib/crypto/Kconfig. - Include the arch-specific code directly in lib/crypto/curve25519.c via a header, rather than using a separate .c file. - Eliminate the entanglement with CRYPTO. CRYPTO_LIB_CURVE25519 no longer selects CRYPTO, and the arch-specific Curve25519 code no longer depends on CRYPTO. This brings Curve25519 in line with the latest conventions for lib/crypto/, used by other algorithms. The exception is that I kept the generic code in separate translation units for now. (Some of the function names collide between the x86 and generic Curve25519 code. And the Curve25519 functions are very long anyway, so inlining doesn't matter as much for Curve25519 as it does for some other algorithms.) Link: https://lore.kernel.org/r/20250906213523.84915-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8c06b330e8f79834924305362227e38e4e2469ae Author: Eric Biggers Date: Sat Sep 6 14:35:20 2025 -0700 lib/crypto: curve25519: Move a couple functions out-of-line Move curve25519() and curve25519_generate_public() from curve25519.h to curve25519.c. There's no good reason for them to be inline. Link: https://lore.kernel.org/r/20250906213523.84915-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 643d79e531cc99da0dc5502dfccb6b3b305c65f3 Author: Eric Biggers Date: Sat Sep 6 14:35:19 2025 -0700 lib/crypto: tests: Add Curve25519 benchmark Add a benchmark to curve25519_kunit. This brings it in line with the other crypto KUnit tests and provides an easy way to measure performance. Link: https://lore.kernel.org/r/20250906213523.84915-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit afc4e4a5f122183b38095daba2264123cc86d8ab Author: Eric Biggers Date: Sat Sep 6 14:35:18 2025 -0700 lib/crypto: tests: Migrate Curve25519 self-test to KUnit Move the Curve25519 test from an ad-hoc self-test to a KUnit test. Generally keep the same test logic for now, just translated to KUnit. There's one exception, which is that I dropped the incomplete test of curve25519_generic(). The approach I'm taking to cover the different implementations with the KUnit tests is to just rely on booting kernels in QEMU with different '-cpu' options, rather than try to make the tests (incompletely) test multiple implementations on one CPU. This way, both the test and the library API are simpler. This commit makes the file lib/crypto/curve25519.c no longer needed, as its only purpose was to call the self-test. However, keep it for now, since a later commit will add code to it again. Temporarily omit the default value of CRYPTO_SELFTESTS that the other lib/crypto/ KUnit tests have. It would cause a recursive kconfig dependency, since the Curve25519 code is still entangled with CRYPTO. A later commit will fix that. Link: https://lore.kernel.org/r/20250906213523.84915-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 Author: Andy Yan Date: Mon Aug 18 20:32:59 2025 +0800 power: supply: cw2015: Fix a alignment coding style issue Fix the checkpatch warning: CHECK: Alignment should match open parenthesis Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") Signed-off-by: Andy Yan Signed-off-by: Sebastian Reichel commit c3a49515225e44b2593839a4b3fec70c39dc0c89 Author: Xichao Zhao Date: Wed Aug 20 12:04:41 2025 +0800 power: supply: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Signed-off-by: Sebastian Reichel commit 09e7652ddb688488a2954f1168b7f40e037694a4 Author: Eric Biggers Date: Sat Sep 6 14:35:17 2025 -0700 crypto: curve25519 - Remove unused kpp support Curve25519 has both a library API and a crypto_kpp API. However, the crypto_kpp API for Curve25519 had no users outside crypto/testmgr.c. I.e., no non-test code ever passed "curve25519" to crypto_alloc_kpp(). Remove this unused code. We'll instead focus on the Curve25519 library API (), which is a simpler and easier-to-use API and is the API that is actually being used. Acked-by: Geert Uytterhoeven # m68k Link: https://lore.kernel.org/r/20250906213523.84915-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 77611cd221477700cacd7061baad7e84ebeadd06 Author: Eric Biggers Date: Sat Sep 6 14:35:16 2025 -0700 crypto: testmgr - Remove curve25519 kpp tests Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the tests for the "curve25519" kpp from crypto/testmgr.c. Note that these tests just duplicated lib/crypto/curve25519-selftest.c, which uses the same list of test vectors. So they didn't really provide any additional value. Link: https://lore.kernel.org/r/20250906213523.84915-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit de3ea8e1c55774a2ef116942984815257cbb01a3 Author: Eric Biggers Date: Sat Sep 6 14:35:15 2025 -0700 crypto: x86/curve25519 - Remove unused kpp support Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the unused "curve25519-x86" kpp algorithm. Note that the underlying x86_64 optimized Curve25519 code remains fully supported and accessible via the library API. It's also worth noting that even if the kpp support for Curve25519 comes back later, there is no need for arch-specific kpp glue code like this, as a single kpp algorithm that wraps the library API is sufficient. Link: https://lore.kernel.org/r/20250906213523.84915-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8c44847e2e56a412040c0c70c44d57f6eafc67b3 Author: Eric Biggers Date: Sat Sep 6 14:35:14 2025 -0700 crypto: powerpc/curve25519 - Remove unused kpp support Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the unused "curve25519-ppc64le" kpp algorithm. Note that the underlying PowerPC optimized Curve25519 code remains fully supported and accessible via the library API. It's also worth noting that even if the kpp support for Curve25519 comes back later, there is no need for arch-specific kpp glue code like this, as a single kpp algorithm that wraps the library API is sufficient. Link: https://lore.kernel.org/r/20250906213523.84915-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 11efae10263b88eab7eb81b9c942237109c4a6c8 Author: Eric Biggers Date: Sat Sep 6 14:35:13 2025 -0700 crypto: arm/curve25519 - Remove unused kpp support Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the unused "curve25519-neon" kpp algorithm. Note that the underlying NEON optimized Curve25519 code remains fully supported and accessible via the library API. It's also worth noting that even if the kpp support for Curve25519 comes back later, there is no need for arch-specific kpp glue code like this, as a single kpp algorithm that wraps the library API is sufficient. Link: https://lore.kernel.org/r/20250906213523.84915-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ee289d3abef9f6fd4b6b4c3af1fb6e566ba94ebb Author: Eric Biggers Date: Sat Sep 6 14:35:12 2025 -0700 crypto: hisilicon/hpre - Remove unused curve25519 kpp support Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the unused "hpre-curve25519" kpp algorithm. Cc: Longfang Liu Cc: Zhiqi Song Link: https://lore.kernel.org/r/20250906213523.84915-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d48d4e4f141b38944da3b0a9c21ce6828ec31d83 Author: Qianfeng Rong Date: Thu Aug 14 22:36:53 2025 +0800 power: supply: use max() to improve code Use max() to reduce the code in cw_battery_get_property() and improve its readability. Signed-off-by: Qianfeng Rong Signed-off-by: Sebastian Reichel commit 15a84d15a677533afa55010f1e2052a27fcd854d Author: ChiYuan Huang Date: Thu Aug 14 15:27:41 2025 +0800 power: supply: rt9467: Add properties for VBUS and IBUS reading Since there's the existing ADC function, add properties 'VOLTAGE_NOW' and 'CURRENT_NOW' to report the current VBUS and IBUS value, respectively. Signed-off-by: ChiYuan Huang Signed-off-by: Sebastian Reichel commit fee0904441325d83e7578ca457ec65a9d3f21264 Author: Christopher Ruehl Date: Mon Aug 11 17:22:09 2025 +0200 power: supply: qcom_battmgr: add OOI chemistry The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this update the detection and return the appropriate type. Signed-off-by: Christopher Ruehl Reviewed-by: Dmitry Baryshkov Signed-off-by: Sebastian Reichel commit cb03556acf83b235dfb2e9f86e14f5e5b8a5f1e7 Author: Colin Ian King Date: Thu Aug 7 13:13:49 2025 +0100 power: supply: 88pm860x: make fsm_state array static const, simplify usage Don't populate the read-only array fsm_state on the stack at run time, instead make it static const, this reduces the object code size as the data is placed on the data segment and this removes the need to have code to set the array up on each call. Note that making the size of the strings to a more optimal 11 bytes long does not seem to reduce the overall size. Making the array an array of pointers to the strings increases the code size due to the dereferencing overhead. Simplify the array access with &fsm_state[info->state][0] with the simpler expression fsm_state[info->state] to clean up the code. Original: text data bss dec hex filename 22884 8272 64 31220 79f4 drivers/power/supply/88pm860x_charger.o Patched: text data bss dec hex filename 22695 8368 64 31127 7997 drivers/power/supply/88pm860x_charger.o Difference: text data bss dec -189 +96 0 -93 Reduction of 93 bytes total. gcc version 14.2.0 (x86-64) Signed-off-by: Colin Ian King Signed-off-by: Sebastian Reichel commit 32f350d58544e2529dc8798275684e97f0a2df6f Author: Waqar Hameed Date: Tue Aug 5 11:33:35 2025 +0200 power: supply: Remove error prints for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Signed-off-by: Sebastian Reichel commit 5afce048a9fa6de350110c7078e69b59f5cb3eb6 Author: Miguel García Date: Thu Jul 24 09:41:33 2025 +0200 power: supply: bq2415x: replace deprecated strcpy() with strscpy() strcpy() is deprecated for NUL-terminated strings. Replace it with strscpy() for revstr (local fixed-size buffer). Signed-off-by: Miguel García Signed-off-by: Sebastian Reichel commit 980927603c4b4fa499771bf36f445808d6859a61 Author: Darshan R. Date: Wed Jul 23 07:06:59 2025 +0000 power: supply: gpio-charger: Clean up spacing for better readability Fixed some minor style issues reported by checkpatch.pl. Mainly adjusted the spacing around operators and type casts to match the kernel coding conventions. For example: - Changed `gpios[ndescs-i-1]` to `gpios[ndescs - i - 1]` - Added space in `(u32*)` to make it `(u32 *)` - Cleaned up spacing in a `for` loop No functional changes — just making the code easier to read and consistent with the rest of the kernel. Signed-off-by: Darshan R. Signed-off-by: Sebastian Reichel commit 714380b03d38e1ca8c5d42f2da6292fae082a769 Author: Frank Li Date: Fri Sep 5 12:41:57 2025 -0400 bindings: siox: convert eckelmann,siox-gpio.txt to yaml format Convert eckelmann,siox-gpio.txt to yaml format. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250905164200.599448-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit c2cf36221021090e7b4757774f4e4c563f959fdb Author: Krzysztof Kozlowski Date: Thu Sep 4 10:38:17 2025 +0200 dt-bindings: display: bridge: Reference DAI common schema Several display bridges (e.g. LVDS to HDMI converters) are used as sound Digital Audio Interface (DAI) and have '#sound-dai-cells', thus they should reference dai-common.yaml schema to allow common properties, like DAI name. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250904083816.48076-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 4c48aed6dfcd32ea23e52adc1072405a62facf46 Author: Zijun Hu Date: Wed Sep 3 19:37:22 2025 +0800 driver core: auxiliary bus: Optimize logic of auxiliary_match_id() auxiliary_match_id() repeatedly calculates variable @match_size in the for loop, however, the variable is fixed actually, so it is enough to only calculate the variable once. Besides, the function should return directly if name of the @auxdev does not include '.', but it still iterates over the ID table. Additionally, statement 'dev_name(&auxdev->dev)' is fixed, but may be evaluated more than 3 times. Optimize logic of the function by: - Move the logic calculating the variable out of the for loop - Return NULL directly if @p == NULL - Give the statement an dedicated local variable @auxdev_name Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250903-fix_auxbus-v2-1-3eae8374fd65@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit dfa743da83ab7ba51ec5692d5939ba1bab4b78c1 Author: Drew Fustini Date: Thu Sep 4 12:42:48 2025 -0700 MAINTAINERS: Add RISC-V T-HEAD SoC patchwork Add patchwork entry for RISC-V T-HEAD SoC support. Signed-off-by: Drew Fustini commit cbd676874e64a2122edd03ba6a2406b24779df05 Author: Geoffrey D. Bennett Date: Fri Sep 5 01:23:51 2025 +0930 ALSA: scarlett2: Add Vocaster speaker/headphone mute controls Add support for the speaker and headphone mute controls on Focusrite Vocaster interfaces. Unlike other Focusrite interfaces, these mute controls are per-output, not per-channel. Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/aLm2Dy6+O/eLTGVn@m.b4.vu Signed-off-by: Takashi Iwai commit 400f60b27415f927f8964dd32d1f5baa53782e5f Author: Chandra Mohan Sundar Date: Sat Sep 6 21:51:54 2025 +0530 ALSA: cs4281: Send the PCM period elapsed notification properly As part of spin lock code cleanup using guard(), a new variable (period_elapsed) was introduced. However this variable is never set, causing period elapsed notification to be not sent. Set the value of period_elapsed appropiately. This issue was reported by static coverity analyzer. Fixes: 7a5127c2c8a5a ("ALSA: cs4281: Use guard() for spin locks") Signed-off-by: Chandra Mohan Sundar Link: https://patch.msgid.link/20250906162158.564899-1-chandramohan.explore@gmail.com Signed-off-by: Takashi Iwai commit eca710386972f2a72708b0b2a615eb150d218e18 Author: Claudiu Beznea Date: Wed Aug 27 13:05:41 2025 +0300 driver core: auxiliary bus: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250827100541.926350-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 716cec5fc92f6d4090a54ddb01042bce02b3c771 Author: Gil Fine Date: Sun Aug 31 22:49:30 2025 +0300 driver core: Fix order of the kernel-doc parameters Fix the order of the kernel-doc parameters in device_find_child() and device_for_each_child*() functions to match the actual functions signature. No functional changes. Signed-off-by: Gil Fine Link: https://lore.kernel.org/r/20250831194930.2063390-1-gil.fine@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a86537ad21c7ba587241b0dcdd186f894a69fac7 Author: Danilo Krummrich Date: Fri Aug 29 22:58:57 2025 +0200 driver core: get_dev_from_fwnode(): document potential race Commit 9a4681a485ee ("driver core: Export get_dev_from_fwnode()") made get_dev_from_fwnode() publicly available, but didn't document the guarantees a caller must uphold: get_dev_from_fwnode() obtains a reference count from the device pointer stored in a struct fwnode_handle. While having its own reference count, struct fwnode_handle does not keep a reference count of the device it has a pointer to. Consequently, a caller must guarantee that it is impossible that the last device reference is dropped and the device is released concurrently while calling get_dev_from_fwnode(), otherwise this is a potential UAF and hence a bug. Thus, document this potential race condition for get_dev_from_fwnode(). Cc: Ulf Hansson Cc: Saravana Kannan Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250829205911.33142-1-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2b2d4c744e1ab8b8d41c5c2ccf889f5441e50105 Author: Xichao Zhao Date: Wed Aug 27 19:40:21 2025 +0800 drivers: base: fix "publically"->"publicly" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250827114021.476668-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 7704e6be4ed2835832c445807cdcb2d56d8a8430 Author: Alexander Usyskin Date: Tue Aug 26 15:56:17 2025 +0300 mei: hook mei_device on class device mei_device lifetime was managed by devm procedure of parent device. But such memory is freed on device_del. Mei_device object is used by client object that may be alive after parent device is removed. It may lead to use-after-free if discrete graphics driver unloads mei_gsc auxiliary device while user-space holds open handle to mei character device. Connect mei_device structure lifteme to mei class device lifetime by adding mei_device free to class device remove callback. Move exising parent device pointer to separate field in mei_device to avoid misuse. Allocate character device dynamically and allow to control its own lifetime as it may outlive mei_device structure while character device closes after parent device is removed from the system. Leave power management on parent device as we overwrite pci runtime pm procedure and user-space is expecting it there. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201 Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 76254bc489d39dae9a3427f0984fe64213d20548 Author: Miaoqian Lin Date: Tue Sep 2 16:49:33 2025 +0800 cdx: Fix device node reference leak in cdx_msi_domain_init Add missing of_node_put() call to release the device node reference obtained via of_parse_phandle(). Fixes: 0e439ba38e61 ("cdx: add MSI support for CDX bus") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Acked-by: Nipun Gupta Link: https://lore.kernel.org/r/20250902084933.2418264-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit e28022873c0d051e980c4145f1965cab5504b498 Author: Xion Wang Date: Thu Sep 4 14:37:04 2025 +0800 char: Use list_del_init() in misc_deregister() to reinitialize list pointer Currently, misc_deregister() uses list_del() to remove the device from the list. After list_del(), the list pointers are set to LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs, but does not reset the list head. If misc_deregister() is called more than once on the same device, list_empty() will not return true, and list_del() may be called again, leading to undefined behavior. Replace list_del() with list_del_init() to reinitialize the list head after deletion. This makes the code more robust against double deregistration and allows safe usage of list_empty() on the miscdevice after deregistration. [ Note, this seems to keep broken out-of-tree drivers from doing foolish things. While this does not matter for any in-kernel drivers, external drivers could use a bit of help to show them they shouldn't be doing stuff like re-registering misc devices - gregkh ] Signed-off-by: Xion Wang Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman commit ceda408c0d1d41094ad125332c6fb1d488e61c0c Author: Xion Wang Date: Wed Aug 27 10:41:00 2025 +0800 misc: remove ineffective WARN_ON() check from misc_deregister() The WARN_ON(list_empty(&misc->list)) in misc_deregister() does not catch any practical error conditions: - For statically allocated miscdevice structures, the list pointers are zero-initialized, so list_empty() returns false, not true. - After list_del(), the pointers are set to LIST_POISON1 and LIST_POISON2, so repeated deregistration also fails to trigger the check. Signed-off-by: Xion Wang Link: https://lore.kernel.org/r/20250827024201.21407-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman commit f3ebb77fce24b5573e7accc2ba593ae55bded1d9 Author: Marek Vasut Date: Thu Sep 4 21:57:04 2025 +0200 dt-bindings: input: touchscreen: goodix: Drop 'interrupts' requirement Since commit 409fe0cea366 ("Input: goodix - add support for polling mode") the interrupts property is optional, since at least the Linux kernel driver supports also polling mode. Signed-off-by: Marek Vasut Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250904195727.168152-1-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 Author: Dan Carpenter Date: Thu Aug 7 18:58:23 2025 +0300 PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check that the pointer is valid. Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") Signed-off-by: Dan Carpenter Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ commit c2cc1e60c1afff4f23c22561b57a5d5157dde20d Author: Jie Zhang Date: Wed Sep 3 12:49:52 2025 +0530 dt-bindings: display/msm/gmu: Update Adreno 623 bindings Update Adreno 623's dt-binding to remove smmu_clk which is not required for this GMU. Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/672455/ Signed-off-by: Rob Clark commit 0c5300343d0c622f7852145a763c570fbaf68a48 Author: Akhil P Oommen Date: Fri Aug 22 00:25:26 2025 +0530 drm/msm/adreno: Add speedbins for A663 GPU Add speedbin mappings for A663 GPU. Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/670096/ Signed-off-by: Rob Clark commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 Author: Antonino Maniscalco Date: Thu Aug 21 15:06:34 2025 +0200 drm/msm: make sure to not queue up recovery more than once If two fault IRQs arrive in short succession recovery work will be queued up twice. When recovery runs a second time it may end up killing an unrelated context. Prevent this by masking off interrupts when triggering recovery. Signed-off-by: Antonino Maniscalco Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/670023/ Signed-off-by: Rob Clark commit b4e3429a04e2aaf166270089a01832d80f534da7 Author: Neil Armstrong Date: Fri Jul 25 10:35:39 2025 +0200 drm/msm: adreno: a6xx: enable GMU bandwidth voting for x1e80100 GPU The Adreno GPU Management Unit (GMU) can also scale DDR Bandwidth along the Frequency and Power Domain level, but by default we leave the OPP core scale the interconnect ddr path. Declare the Bus Control Modules (BCMs) and the corresponding parameters in the GPU info struct to allow the GMU to vote for the bandwidth. Reviewed-by: Dmitry Baryshkov Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/665778/ Signed-off-by: Rob Clark commit 9e710a2a2fd97052592bc5cad37bbe2e6968e5ce Author: Rob Clark Date: Thu Jul 17 08:12:01 2025 -0700 drm/msm: Drop unneeded NULL check This is always set in msm_gpu_init(), and can never be NULL. Reported-by: Dan Carpenter Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/664431/ commit 6d6a29a19b232e29b61a14d58b71fefc2e003fa4 Author: Rob Clark Date: Wed Aug 20 17:04:27 2025 -0700 drm/msm: Fix 32b size truncation Somehow we never noticed this when arm64 became a thing, many years ago. v2: also fix npages Signed-off-by: Rob Clark Tested-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/669785/ commit 3a3bef68a6c15d079646a964ebc4dc8bb0aedb06 Author: Rob Clark Date: Wed Aug 20 17:04:26 2025 -0700 drm/msm: Fix missing VM_BIND offset/range validation We need to reject the MAP op if offset+range is larger than the BO size. Reported-by: Connor Abbott Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Tested-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/669781/ commit 278f8904434aa96055e793936b5977c010549e28 Author: Rob Clark Date: Wed Aug 20 17:04:25 2025 -0700 drm/msm: Fix obj leak in VM_BIND error path If we fail a handle-lookup part way thru, we need to drop the already obtained obj references. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Tested-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/669784/ commit 3ce3f569991347d2085925041f4932232da43bcf Author: Rafael J. Wysocki Date: Tue Sep 2 15:45:14 2025 +0200 PM: core: Add two macros for walking device links Add separate macros for walking links to suppliers and consumers of a device to help device links users to avoid exposing the internals of struct dev_links_info in their code and possible coding mistakes related to that. Accordingly, use the new macros to replace open-coded device links list walks in the core power management code. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/1944671.tdWV9SEqCh@rafael.j.wysocki commit fdd9ae23bb989fa9ed1beebba7d3e0c82c7c81ae Author: Rafael J. Wysocki Date: Tue Sep 2 15:43:50 2025 +0200 PM: core: Annotate loops walking device links as _srcu Since SRCU is used for the protection of device link lists, the loops over device link lists in multiple places in drivers/base/power/main.c and in pm_runtime_get_suppliers() should be annotated as _srcu rather than as _rcu which is the case currently. Change the annotations accordingly. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2393512.ElGaqSPkdT@rafael.j.wysocki commit 7328815c5fb0b5bc39dc5c981b18c0008786ab82 Author: Frank Li Date: Thu Sep 4 16:06:37 2025 -0400 dt-bindings: input: convert max11801-ts to yaml format Convert max11801-ts to yaml format. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250904200641.531897-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit 20f2044bae1187f58863c7aa3d07dfc6ba50afec Author: Ian Abbott Date: Thu Aug 21 15:59:14 2025 +0100 comedi: Add new driver for ADLink PCI-7250 series The ADLink PCI-7250, LPCI-7250, and LPCIe-7250 are PCI/PCIe boards with 8 relay outputs and 8 isolated digital inputs. Add a new Comedi driver "adl_pci7250" to support them. It is possible to add up to three PCI-7251 plug-in modules to the PCI-7250, with 8 relay outputs and 8 isolated digital inputs per plug-in module. We cannot reliably detect whether the modules are fitted without changing their state. It is harmless to assume the modules are fitted; they just won't do anything, so the driver allows all 32 relay outputs to be written (and their initial state to be read), and all 32 digital inputs to be read. The LPCI-7250 and LPCIe-7250 are low-profile boards that do not support the plug-in modules, but except for a newer variant of the LPCIe-7250, they cannot be distinguished from the full-height boards by their PCI IDs. For the newer variant of the LPCIe-7250, we can assume that there are no plug-in modules fitted and limit the number of channels accordingly. This newer variant of the LPCIe-7250 uses memory-mapped registers, whereas all the other boards use port-mapped registers. I have tested the PCI-7250. The new variant of the LPCIe-7250 has been tested in an out-of-tree version of the Comedi drivers by someone else. Tested-by: Ian Abbott # PCI-7250 only Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250821145914.10445-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3cc08f9181156585baff92b1a3bba76fb4b14f4b Author: Frank Li Date: Thu Sep 4 15:17:28 2025 -0400 dt-bindings: input: convert semtech,sx8654 to yaml format Convert sx8654.txt to yaml format. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250904191731.528145-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit 618f571af67a876ce23a1dc4eb08e152fcf0d709 Author: Frank Li Date: Thu Sep 4 13:15:41 2025 -0400 dt-bindings: input: exc3000: move eeti,egalax_ts from egalax-ts.txt to eeti,exc3000.yaml Remove legacy binding egalax-ts.txt file. And add compatible string eeti,egalax_ts and wakeup-gpios to eeti,exc3000.yaml. "eeti,egalax_ts" is general compatible string, which is not preferred. But it is compatible with old devices (older than 10 years) and existing driver in drivers/input/touchscreen/egalax_ts.c. Allow address 0x4 for eeti,egalax_ts. Don't require touchscreen-size-x(y) for eeti,egalax_ts. Keep the same restriction for existing compatible string. Fix below DTB_CHECKS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-gw52xx.dtb: /soc/bus@2100000/i2c@21a8000/egalax_ts@4: failed to match any schema with compatible: ['eeti,egalax_ts'] Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250904171543.517650-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit 0c82fd9609a1e4bf1db84b0fd56bc3b2773da179 Author: Thorsten Blum Date: Fri Sep 5 12:32:44 2025 +0200 ibmasm: Replace kzalloc() + copy_from_user() with memdup_user_nul() Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify remote_settings_file_write(). No functional changes intended. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250905103247.423840-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 5f8f84e286f11af4c954c14a57daffc80a1c3510 Author: Max Kellermann Date: Fri Aug 29 11:14:41 2025 +0200 drivers/misc/amd-sbi/Kconfig: select REGMAP_I2C Without CONFIG_REGMAP, rmi-i2c.c fails to build because struct regmap_config is not defined: drivers/misc/amd-sbi/rmi-i2c.c: In function ‘sbrmi_i2c_probe’: drivers/misc/amd-sbi/rmi-i2c.c:57:16: error: variable ‘sbrmi_i2c_regmap_config’ has initializer but incomplete type 57 | struct regmap_config sbrmi_i2c_regmap_config = { | ^~~~~~~~~~~~~ Additionally, CONFIG_REGMAP_I2C is needed for devm_regmap_init_i2c(): ld: drivers/misc/amd-sbi/rmi-i2c.o: in function `sbrmi_i2c_probe': drivers/misc/amd-sbi/rmi-i2c.c:69:(.text+0x1c0): undefined reference to `__devm_regmap_init_i2c' Fixes: 013f7e7131bd ("misc: amd-sbi: Use regmap subsystem") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann Tested-by: Akshay Gupta Reviewed-by: Akshay Gupta Link: https://lore.kernel.org/r/20250829091442.1112106-1-max.kellermann@ionos.com Signed-off-by: Greg Kroah-Hartman commit b0531cdba5029f897da5156815e3bdafe1e9b88d Author: Wang Liang Date: Sat Aug 30 15:50:23 2025 +0800 pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case. Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") Signed-off-by: Wang Liang Reviewed-By: Calvin Owens Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman commit 656a48c49a4a8a3685538dfaa2f37831b8213461 Author: Thorsten Blum Date: Wed Sep 3 22:23:51 2025 +0200 char/adi: Remove redundant less-than-zero check in adi_write() The function parameter 'size_t count' is unsigned and cannot be less than zero. Remove the redundant condition. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250903202350.182446-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 6b26053819dccc664120e07c56f107fb6f72f3fa Author: Colin Ian King Date: Tue Sep 2 12:37:12 2025 +0100 misc: genwqe: Fix incorrect cmd field being reported in error There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this. Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit 53d2bf583c6b6326d751d0f0dceba76109dfb0f9 Author: Xichao Zhao Date: Tue Aug 19 20:17:49 2025 +0800 siox: bus-gpio: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Acked-by: Thorsten Scherer Link: https://lore.kernel.org/r/20250819121749.613584-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 2828c318b3c124a370e2e8844a927734b8b49faf Author: Thorsten Blum Date: Wed Aug 20 12:27:34 2025 +0200 misc: ad525x_dpot: Use str_enabled_disabled() in sysfs_show_reg() Remove hard-coded strings by using the str_enabled_disabled() helper function and silence the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_enabled_disabled(..) Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250820102734.760844-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit d8959245329917f93a6345fd6eef828c646600fb Author: Thorsten Blum Date: Wed Aug 20 12:21:09 2025 +0200 dw-xdata: Use str_write_read() in dw_xdata_start() and dw_xdata_perf() Remove hard-coded strings by using the str_write_read() helper function and silence the following two Coccinelle/coccicheck warnings reported by string_choices.cocci: opportunity for str_write_read(write) opportunity for str_write_read(write) Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250820102108.760382-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit dfb962e214788aa5f6dfe9f2bd4a482294533e3e Author: Markus Heidelberg Date: Fri Aug 15 11:58:38 2025 +0200 eeprom: at25: make FRAM device ID error message more precise The error description would be wrong in case the "size" Devicetree property is missing for an FRAM without device ID. Signed-off-by: Markus Heidelberg Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250815095839.4219-4-m.heidelberg@cab.de Signed-off-by: Greg Kroah-Hartman commit 1b434ed000cd474f074e62e8ab876f87449bb4ac Author: Markus Heidelberg Date: Fri Aug 15 11:58:37 2025 +0200 eeprom: at25: support Cypress FRAMs without device ID Not all FRAM chips have a device ID and implement the corresponding read command. For such chips this led to the following error on module loading: at25 spi2.0: Error: no Cypress FRAM (id 00) The device ID contains the memory size, so devices without this ID are supported now by setting the size manually in Devicetree using the "size" property. Tested with FM25L16B and "size = <2048>;": at25 spi2.0: 2 KByte fm25 fram, pagesize 4096 According to Infineon/Cypress datasheets, these FRAMs have a device ID: FM25V01A FM25V02A FM25V05 FM25V10 FM25V20A FM25VN10 but these do not: FM25040B FM25640B FM25C160B FM25CL64B FM25L04B FM25L16B FM25W256 So all "FM25V*" FRAMs and only these have a device ID. The letter after "FM25" (V/C/L/W) only describes the voltage range, though. Link: https://lore.kernel.org/all/20250401133148.38330-1-m.heidelberg@cab.de/ Signed-off-by: Markus Heidelberg Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250815095839.4219-3-m.heidelberg@cab.de Signed-off-by: Greg Kroah-Hartman commit 534c702c3c234665ca2fe426a9fbb12281e55d55 Author: Markus Heidelberg Date: Fri Aug 15 11:58:36 2025 +0200 dt-bindings: eeprom: at25: use "size" for FRAMs without device ID Not all FRAM chips have a device ID and implement the corresponding read command. Thus the memory size, which is contained in the device ID, cannot be detected and has to be set manually as it is done for EEPROMs. Link: https://lore.kernel.org/all/20250401133148.38330-1-m.heidelberg@cab.de/ Signed-off-by: Markus Heidelberg Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250815095839.4219-2-m.heidelberg@cab.de Signed-off-by: Greg Kroah-Hartman commit b009c1dbfc9854ca4460553170ddb6508fe7dafc Author: Chen Ni Date: Thu Aug 21 16:18:04 2025 +0800 misc: eeprom/m24lr: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/r/20250821081804.3168680-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit b15b7d2a1b09ef5428a8db260251897405a19496 Author: Naman Jain Date: Thu Aug 28 10:12:00 2025 +0530 uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang. For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt. Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens: * The host never sends another message. So the pread() waits forever. * The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever. This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0. Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang. Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX. Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus") Suggested-by: John Starks Signed-off-by: Naman Jain Cc: stable@vger.kernel.org Reviewed-by: Michael Kelley Reviewed-by: Long Li Reviewed-by: Tianyu Lan Tested-by: Tianyu Lan Link: https://lore.kernel.org/r/20250828044200.492030-1-namjain@linux.microsoft.com Signed-off-by: Greg Kroah-Hartman commit ffe64881395b0a1cd395473312da0c9d2604a2e4 Author: Geert Uytterhoeven Date: Thu Sep 4 17:21:12 2025 +0200 uio: uio_pdrv_genirq: Remove dummy PM handling Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. As the Runtime PM callbacks were the only driver-specific PM handling, all PM handling can be removed. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/a5495b6068dd4e40ae7e0fb66b067fd5b5c210b2.1756999260.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 6a84240fffb5d20c8ae04757ef6a50eb5487ccae Author: Geert Uytterhoeven Date: Thu Sep 4 17:20:44 2025 +0200 uio: uio_dmem_genirq: Remove dummy PM handling Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. As the Runtime PM callbacks were the only driver-specific PM handling, all PM handling can be removed. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/121921f66a2baa125ea62be9436e8b5b12a4ad4d.1756999182.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 47625846727b82e4a05f14d988fc5efa2c1d882f Author: Vivian Wang Date: Tue Aug 26 18:34:40 2025 +0800 uio: uio_pdrv_genirq: Remove MODULE_DEVICE_TABLE The struct of_device_id list here is filled in at load time since commit 05c3e0bb5629 ("UIO: allow binding uio_pdrv_genirq.c to devices using command line option"). However, this does not work with MODULE_DEVICE_TABLE, which generates an alias at build time. In this case, it generates the aliases "of:N*T*" and "of:N*T*C*", which matches *any* OF device node, which is obviously not intended. It confuses userspace into loading this module for any OF device, and confuses anyone trying to resolve an OF modalias. Remove this broken MODULE_DEVICE_TABLE. Suggested-by: Emily Fixes: 05c3e0bb5629 ("UIO: allow binding uio_pdrv_genirq.c to devices using command line option") Signed-off-by: Vivian Wang Link: https://lore.kernel.org/r/20250826-uio-no-modalias-v2-1-495afa9e8a5b@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 511d7a35a438d5c37b9870fd4a0acab72b1aaf3e Author: Christophe JAILLET Date: Tue Aug 19 20:58:17 2025 +0200 uio: Constify struct pci_device_id 'struct pci_device_id' is not modified in these drivers. Constifying this structure moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 4073 1336 0 5409 1521 drivers/uio/uio_cif.o After: ===== text data bss dec hex filename 4233 1176 0 5409 1521 drivers/uio/uio_cif.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/114791f85f0f81531ca2169721eac4911dbe0865.1755629302.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit 7cce3d7bce7ff48ae21f367e4bc0fe851c65f103 Author: Michael Straube Date: Sun Aug 24 11:58:30 2025 +0200 staging: rtl8723bs: Hal_EfuseParseAntennaDiversity_8723B is empty The function Hal_EfuseParseAntennaDiversity_8723B is empty, remove it. Signed-off-by: Michael Straube Tested-by: Philipp Hortmann # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5cea88cab622f444a581ebd35664198bbbb1f4e6 Author: Michael Straube Date: Sun Aug 24 11:58:29 2025 +0200 staging: rtl8723bs: remove REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723 The macros REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723 are redundant, both are already defined in header files without the _8723 suffix. Remove them and use the marcos from the header files. rtl8723b_hal.h:138: #define EFUSE_ACCESS_ON 0x69 /* For RTL8723 only. */ hal_com_reg.h:35: #define REG_EFUSE_ACCESS 0x00CF /* Efuse access protection for RTL8723 */ Signed-off-by: Michael Straube Tested-by: Philipp Hortmann # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 236faa3b92d33652233bce1136e043703a71d1d6 Author: Michael Straube Date: Sun Aug 24 11:58:28 2025 +0200 staging: rtl8723bs: remove bWrite from Hal_EfusePowerSwitch The function Hal_EfusePowerSwitch is always called with bWrite set to false. Remove the pWrite parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube Tested-by: Philipp Hortmann # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 009798ff04f752a5d820c9341f1d2269672393f9 Author: Michael Straube Date: Sun Aug 24 11:58:27 2025 +0200 staging: rtl8723bs: remove wrapper Efuse_PowerSwitch The function Efuse_PowerSwitch is just a wrapper around Hal_EfusePowerSwitch. Remove the wrapper and use Hal_EfusePowerSwitch directly. Signed-off-by: Michael Straube Tested-by: Philipp Hortmann # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5ff310ce43b8750e605ded5f81d7c258c9719923 Author: Mohammed GUERMOUD Date: Fri Aug 29 18:02:53 2025 +0100 staging: octeon: Clean up dead code in ethernet-tx.c Remove multiple blocks of non-functional code disabled via '#if 0'. The removed code was a placeholder for incomplete hardware offload features, as indicated by `FIXME` comments. Remove this dead code to simplify the driver. Signed-off-by: Mohammed GUERMOUD Link: https://lore.kernel.org/r/20250829170253.16737-1-mohammed.guermoud@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0bbf8fb9e3e624d44b536de71a93f995b7edc7a5 Author: yingche Date: Fri Aug 29 12:09:06 2025 +0800 staging: rtl8723bs: fix fortify warnings by using struct_group Fix fortify_memcpy_chk warnings in rtw_BIP_verify() and rtw_mgmt_xmitframe_coalesce() functions by using struct_group to access consecutive address fields. Changed memcpy calls to use &hdr->addrs instead of hdr->addr1 when copying 18 bytes (addr1 + addr2 + addr3). This resolves 'detected read beyond size of field' warnings by using the proper struct_group mechanism as suggested by the compiler. Signed-off-by: yingche Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250829040906.895221-1-zxcv2569763104@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9d78ee44a9d717db66156f40856f201c8618f2b0 Author: Qianfeng Rong Date: Tue Aug 26 20:32:01 2025 +0800 staging: gpib: use int type to store negative error codes The "ret" variable is used to store the return from bb_write() returns either zero on success or negative error codes on failure. Storing the error codes in size_t which is an unsigned long, doesn't cause an issue at runtime but it's ugly as pants. Change "ret" from size_t to int type. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250826123208.300145-1-rongqianfeng@vivo.com Signed-off-by: Greg Kroah-Hartman commit 533656d39ffd2468266de5e28bc2c340c230b66d Author: Michael Straube Date: Fri Aug 22 15:54:18 2025 +0200 staging: rtl8723bs: remove include/recv_osdep.h Move still needed function prototypes defined in the recv_osdep.h header to rtw_recv.h and remove the now obsolete recv_osdep.h. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-14-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6009d6fd826d70849e2a0f0a288dbc37b28345d5 Author: Michael Straube Date: Fri Aug 22 15:54:17 2025 +0200 staging: rtl8723bs: remove os_dep/recv_linux.c After previous patches the file os_dep/recv_linux.c is empty now and we can remove it. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-13-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1d7e13c8b7dbfa581ed06088201f22fb9d1216ab Author: Michael Straube Date: Fri Aug 22 15:54:16 2025 +0200 staging: rtl8723bs: rename rtw_os_recv_indicate_pkt Rename rtw_os_recv_indicate_pkt to rtw_recv_indicate_pkt as the _os_ indicates operating system dependent code which is unnecessary for in-tree linux kernel code. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-12-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit cc18433094733778a07b9dfebc86c9ec4f86d477 Author: Michael Straube Date: Fri Aug 22 15:54:15 2025 +0200 staging: rtl8723bs: move rtw_os_recv_indicate_pkt to rtw_recv.c Move the function rtw_os_recv_indicate_pkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-11-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit b870844cd0c9aac60edffd6be08218ffd5afd6fc Author: Michael Straube Date: Fri Aug 22 15:54:14 2025 +0200 staging: rtl8723bs: rename rtw_os_alloc_msdu_pkt Rename rtw_os_alloc_msdu_pkt to rtw_alloc_msdu_pkt as the _os_ indicates operating system dependent code which is unnecessary for in-tree linux kernel code. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-10-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f44d85d5a2e0518289dde7d8f95312207c4998bc Author: Michael Straube Date: Fri Aug 22 15:54:13 2025 +0200 staging: rtl8723bs: move rtw_os_alloc_msdu_pkt to rtw_recv.c Move the function rtw_os_alloc_msdu_pkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 10bcaf9ccce11823089cf11cca54100f0f6bdfae Author: Michael Straube Date: Fri Aug 22 15:54:12 2025 +0200 staging: rtl8723bs: merge rtw_os_recvbuf_resource_free into rtl8723bs_recv.c Merge rtw_os_recvbuf_resource_free into rtl8723bs_init_recv_priv and into rtl8723bs_free_recv_priv to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0ae5ca4fb6150c7f61849436eb53493a2dd69c9b Author: Michael Straube Date: Fri Aug 22 15:54:11 2025 +0200 staging: rtl8723bs: merge rtw_os_recv_resource_free into rtw_recv.c Merge the functionality of rtw_os_recv_resource_free in os_dep/recv_linux.c into _rtw_free_recv_priv in core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit aec747851b73828a84fc8d6a7c02743bbb51ffd9 Author: Michael Straube Date: Fri Aug 22 15:54:10 2025 +0200 staging: rtl8723bs: merge rtw_os_recv_resource_alloc into rtw_recv.c Merge the functionality of rtw_os_recv_resource_alloc into _rtw_init_recv_priv to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit d91ccaaf09a2131d20ac02b2c4d00c7025bd6d97 Author: Michael Straube Date: Fri Aug 22 15:54:09 2025 +0200 staging: rtl8723bs: merge rtw_os_free_recvframe into rtw_recv.c Merge the functionality of rtw_os_free_recvframe in os_dep/recv_linux.c into rtw_free_recvframe in core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9766096c1e0552ebe664865f16b7de61f4e8014f Author: Michael Straube Date: Fri Aug 22 15:54:08 2025 +0200 staging: rtl8723bs: move rtw_handle_tkip_mic_err to rtw_recv.c Move the function rtw_handle_tkip_mic_err from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f97151eb17dcdc8d7a27e05f2ec8c55bbb16c7a9 Author: Michael Straube Date: Fri Aug 22 15:54:07 2025 +0200 staging: rtl8723bs: move rtw_recv_indicatepkt to rtw_recv.c Move the function rtw_recv_indicatepkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0149f27d1a248f013fe36d29bc391c303e853ee0 Author: Michael Straube Date: Fri Aug 22 15:54:06 2025 +0200 staging: rtl8723bs: remove wrapper rtw_init_recv_timer The function rtw_init_recv_timer in os_dep/recv_linux.c is jsut a wrapper around timer_setup. Use timer_setup directly and remove the wrapper to reduce code in the os_dep directory. Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250822135418.118115-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9f1dcadbc90ad7de37ef9f39195eb6777a74472c Author: Michael Straube Date: Sat Aug 23 14:43:21 2025 +0200 staging: rtl8723bs: remove efuse_OneByteWrite The function efuse_OneByteWrite is not used. Remove it and remove related dead code, namely the function Efuse_Write1ByteToFakeContent. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-15-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit ca6e514b8a3f8b1258ec0ce04c219049a2ca4b9b Author: Michael Straube Date: Sat Aug 23 14:43:20 2025 +0200 staging: rtl8723bs: remove bPseudoTest from efuse_OneByteRead The function efuse_OneByteRead is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-14-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4558ec57bfa03b51438696bc971bd0559b759899 Author: Michael Straube Date: Sat Aug 23 14:43:19 2025 +0200 staging: rtl8723bs: clean up variable initializations After previous cleanup patches the variable initializations in hal_EfuseSwitchToBank are messed up a little, but were left as-is to make reviewing easier. For example bRet is initialized to false and immediately set to true. This patch cleans up the variable initializations. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-13-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4d170e2c0d6896f25d09eddb25e9f72da544d99f Author: Michael Straube Date: Sat Aug 23 14:43:18 2025 +0200 staging: rtl8723bs: remove bPseudoTest from hal_EfuseSwitchToBank The function hal_EfuseSwitchToBank is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-12-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 127fae1d910f0cc58af1327a7009dd766820ef98 Author: Michael Straube Date: Sat Aug 23 14:43:17 2025 +0200 staging: rtl8723bs: remove Hal_EfuseGetCurrentSize The function Hal_EfuseGetCurrentSize is not used in the driver code, remove it to get rid of dead code. As Hal_EfuseGetCurrentSize is the only caller of hal_EfuseGetCurrentSize_WiFi and hal_EfuseGetCurrentSize_BT we can remove these two functions as well. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-11-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 254c268bf1d3e9e3b640e29a71e285a511ba7ffc Author: Michael Straube Date: Sat Aug 23 14:43:16 2025 +0200 staging: rtl8723bs: remove bPseudoTest from Hal_GetEfuseDefinition The bPseudoTEst parameter is not used in Hal_GetEfuseDefinition. Remove the unused parameter and adjust the function calls. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-10-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit b907ae0baf83c2b1c24e3ba894bd961e686c45a2 Author: Michael Straube Date: Sat Aug 23 14:43:15 2025 +0200 staging: rtl8723bs: remove wrapper EFUSE_GetEfuseDefinition The function EFUSE_GetEfuseDefinition is just a wrapper around Hal_GetEfuseDefinition. Remove the wrapper and use Hal_GetEfuseDefinition directly. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3d589e3b27a50a7bf2245eb0837eafb2d132af69 Author: Michael Straube Date: Sat Aug 23 14:43:14 2025 +0200 staging: rtl8723bs: remove bPseudoTest from hal_ReadEFuse_BT The function hal_ReadEFuse_BT is always called with bPseudoTest set to false. Remove the pPseudoTest parameter, replace its usage in the function with false, and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0de319271c798f40d1fc26eaaee2a2d5aa1b4f3f Author: Michael Straube Date: Sat Aug 23 14:43:13 2025 +0200 staging: rtl8723bs: remove bPseudoTest from hal_ReadEFuse_WiFi The function hal_ReadEFuse_WiFi is always called with bPseudoTest set to false. Remove the pPseudoTest parameter, replace its usage in the function with false, and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0124378e9ed4fd17b6070e18cf90326d7533eec0 Author: Michael Straube Date: Sat Aug 23 14:43:12 2025 +0200 staging: rtl8723bs: remove bPseudoTest from Hal_ReadEFuse The function Hal_ReadEFuse is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 14fd39484787336f8b1e160e98b723bba78cbe8c Author: Michael Straube Date: Sat Aug 23 14:43:11 2025 +0200 staging: rtl8723bs: remove wrapper efuse_ReadEFuse The function efuse_ReadEFuse is just a wrapper around Hal_ReadEFuse. Remove the wrapper and use Hal_ReadEFuse directly. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit e8605159aec9bc2f272555f9bd9c4bf077dd9d15 Author: Michael Straube Date: Sat Aug 23 14:43:10 2025 +0200 staging: rtl8723bs: remove bPseudoTest from Efuse_ReadAllMap The function Efuse_ReadAllMap is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit fc7ae37d81c5343e38397cf3937a61f451999d6b Author: Michael Straube Date: Sat Aug 23 14:43:09 2025 +0200 staging: rtl8723bs: make Efuse_ReadAllMap static Make the function Efuse_ReadAllMap static and remove its unnecessary forawrd declaration. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 994626b97ec35bb09a5c1a19a62ddfa7643781b7 Author: Michael Straube Date: Sat Aug 23 14:43:08 2025 +0200 staging: rtl8723bs: remove bPseudoTest from EFUSE_ShadowMapUpdate The function EFUSE_ShadowMapUpdate is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250823124321.485910-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 91180c6662774cb8f9b69b9bdde0b57babbe14b0 Author: Liao Yuanhong Date: Tue Aug 19 21:11:54 2025 +0800 staging: gpib: tnt4882: Remove redundant header files The header file is already included on line 12, outside of the #ifdef CONFIG_GPIB_PCMCIA block. It does not need to be included again inside the #ifdef CONFIG_GPIB_PCMCIA block. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250819131203.152724-1-liaoyuanhong@vivo.com Signed-off-by: Greg Kroah-Hartman commit b601e1f41edd4667062aa7cccb4e5199814979a3 Author: Xichao Zhao Date: Fri Sep 5 17:13:21 2025 +0800 tty: remove redundant condition checks Remove redundant condition checks and replace else if with else. Signed-off-by: Xichao Zhao Reviewed-by: Christophe Leroy Link: https://lore.kernel.org/r/20250905091321.437476-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit da7e8b3823962b13e713d4891e136a261ed8e6a2 Author: Zizhi Wo Date: Thu Sep 4 10:39:55 2025 +0800 tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() In vt_ioctl(), the handler for VT_RESIZE always returns 0, which prevents users from detecting errors. Add the missing return value so that errors can be properly reported to users like vt_resizex(). Signed-off-by: Zizhi Wo Link: https://lore.kernel.org/r/20250904023955.3892120-1-wozizhi@huaweicloud.com Signed-off-by: Greg Kroah-Hartman commit 45747017928c7e6ef71f3a09c5610b7026357162 Author: Wang Liang Date: Thu Sep 4 10:33:45 2025 +0800 vt: remove redundant check on vc_mode in con_font_set() Previous commit edab558feba1 ("vt: sort out locking for font handling") move the vc_mode check into console_lock protect, but forget to remove the old check in con_font_set(). Just remove the redundant check. Signed-off-by: Wang Liang Link: https://lore.kernel.org/r/20250904023345.13731-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman commit fc6a5b540c02d1ec624e4599f45a17f2941a5c00 Author: Viken Dadhaniya Date: Wed Sep 3 12:01:36 2025 +0530 serial: qcom-geni: Add DFS clock mode support to GENI UART driver GENI UART driver currently supports only non-DFS (Dynamic Frequency Scaling) mode for source frequency selection. However, to operate correctly in DFS mode, the GENI SCLK register must be programmed with the appropriate DFS index. Failing to do so can result in incorrect frequency selection Add support for Dynamic Frequency Scaling (DFS) mode in the GENI UART driver by configuring the GENI_CLK_SEL register with the appropriate DFS index. This ensures correct frequency selection when operating in DFS mode. Replace the UART driver-specific logic for clock selection with the GENI common driver function to obtain the desired frequency and corresponding clock index. This improves maintainability and consistency across GENI-based drivers. Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20250903063136.3015237-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 5a66087107b80ac4e58a94f37d9b8d12e22b4071 Author: Jiri Slaby (SUSE) Date: Fri Aug 22 12:42:08 2025 +0200 m68k: make HPDCA and HPAPCI bools The only user -- 8250_hp300 -- tests for CONFIG_HPDCA and CONFIG_HPAPCI. It does not test for *_MODULE variants. That means that if someone sets the configs to =m, the code is not compiled at all. There is actually no point having these as tristate. Switch them to bool. Signed-off-by: Jiri Slaby (SUSE) Cc: Geert Uytterhoeven Cc: linux-m68k@lists.linux-m68k.org Link: https://lore.kernel.org/r/20250822104208.751191-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3cf0b3c243e56bc43be560617416c1d9f301f44c Author: Seppo Takalo Date: Wed Aug 27 15:26:56 2025 +0300 tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come into the same input queue. Instead allow sending Modem Status Command without waiting for remote end to respond. Define a new function gsm_modem_send_initial_msc() for this purpose. As MSC is only valid for basic encoding, it does not do anything for advanced or when convergence layer type 2 is used. Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") Signed-off-by: Seppo Takalo Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no Signed-off-by: Greg Kroah-Hartman commit 94fcae6cb1c1dec20a5bd0e324b23057fa4eae09 Author: Zong Jiang Date: Wed Aug 27 20:03:19 2025 +0800 serial: qcom-geni: Fix off-by-one error in ida_alloc_range() The ida_alloc_range() function expects an inclusive range, meaning both the start and end values are valid allocation targets. Passing nr_ports as the upper bound allows allocation of an ID equal to nr_ports, which is out of bounds when used as an index into the port array. Fix this by subtracting 1 from nr_ports in both calls to ida_alloc_range(), ensuring the allocated ID stays within the valid range [start, nr_ports - 1]. This prevents potential out-of-bounds access when the allocated ID is used as an index. Fixes: 9391ab1ed9b3 ("serial: qcom-geni: Make UART port count configurable via Kconfig") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202508180815.R2nDyajs-lkp@intel.com/ Signed-off-by: Zong Jiang Link: https://lore.kernel.org/r/20250827120319.1682835-1-quic_zongjian@quicinc.com Signed-off-by: Greg Kroah-Hartman commit e3fa89f3a768a9c61cf1bfe86b939ab5f36a9744 Author: Claudiu Beznea Date: Wed Aug 27 13:17:47 2025 +0300 serdev: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250827101747.928265-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit aa1020f5cb50ca856fabbd24f6ee40a10aeae89b Author: Xichao Zhao Date: Wed Aug 27 10:45:14 2025 +0800 serial: sc16is7xx: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250827024514.76149-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 23743ba64709a9c137c1b928f8b8e00d846af9cc Author: Calixte Pernot Date: Mon Aug 25 14:56:09 2025 +0200 vt: add support for smput/rmput escape codes Support "\e[?1049h" and "\e[?1049l" escape codes. This patch allows programs to enter and leave alternate screens. This feature is widely available in graphical terminal emulators and mostly used by fullscreen terminal-based user interfaces such as text editors. Most editors such as vim and nano assume this escape code in not supported and will not try to print the escape sequence if TERM=linux. To try out this patch, run `TERM=xterm-256color vim` inside a VT. Signed-off-by: Calixte Pernot Link: https://lore.kernel.org/r/20250825125607.2478-3-calixte.pernot@grenoble-inp.org Signed-off-by: Greg Kroah-Hartman commit cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a Author: Raphael Gallais-Pou Date: Fri Aug 22 16:19:23 2025 +0200 serial: stm32: allow selecting console when the driver is module Console can be enabled on the UART compile as module. Change dependency to allow console mode when the driver is built as module. Fixes: 48a6092fb41fa ("serial: stm32-usart: Add STM32 USART Driver") Cc: stable@vger.kernel.org Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20250822141923.61133-1-raphael.gallais-pou@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 18656ee86fe898932fdfbe5db4a92330ac95fa23 Author: Osama Abdelkader Date: Fri Aug 22 11:56:13 2025 +0200 serial: 8250_core: fix coding style issue Fix a coding style issue in 8250_core.c: - Remove redundant NULL initialization of a global pointer Signed-off-by: Osama Abdelkader Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250822095614.18108-1-osama.abdelkader@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6f9871b3e8c31953978db552c730a7e017e51d19 Author: Liao Yuanhong Date: Tue Sep 2 21:26:08 2025 +0800 usb: gadget: tegra-xudc: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250902132613.84876-1-liaoyuanhong@vivo.com Signed-off-by: Greg Kroah-Hartman commit 0f577e88d9bc14d9ed00515b47fe3f8e9b1c35be Merge: 1bc28f015a19a1 0aa0b0326cc564 Author: Greg Kroah-Hartman Date: Sat Sep 6 15:25:08 2025 +0200 Merge patch series "eUSB2 Double Isochronous IN Bandwidth support" Sakari Ailus says: This series enables support for eUSB2 Double Isochronous IN Bandwidth UVC devices specified in 'USB 2.0 Double Isochronous IN Bandwidth' ECN. In short, it adds support for new integrated USB2 webcams that can send twice the data compared to conventional USB2 webcams. These devices are identified by the device descriptor bcdUSB 0x0220 value. They have an additional eUSB2 Isochronous Endpoint Companion Descriptor, and a zero max packet size in regular isoc endpoint descriptor. Support for parsing that new descriptor was added in commit c749f058b437 ("USB: core: Add eUSB2 descriptor and parsing in USB core") This series adds support to UVC, USB core, and xHCI to identify eUSB2 double isoc devices, and allow and set proper max packet, iso frame desc sizes, bytes per interval, and other values in URBs and xHCI endpoint contexts needed to support the double data rates for eUSB2 double isoc devices. since v4: https://lore.kernel.org/linux-usb/20250812132445.3185026-1-sakari.ailus@linux.intel.com - New patch: use le16_to_cpu() to access endpoint descriptor's wMaxPacketSize field, which is an __le16. This isn't a bugfix as the value was compared to 0. - New patch: add USB device speed check for eUSB2 isochronous endpoint companion parsing. The check is then removed from sites checking the existence of the companion (through companion's bDescriptorType field, which is non-zero for valid descriptors). - New patch: do not parse eUSB2 isoc double BW companion descriptor on interrupt or OUT endpoints. It is not supposed to be found there, according to the ECN. - Rename usb_endpoint_max_isoc_bpi() as usb_endpoint_max_periodic_payload() and move it right after usb_maxpacket(). - Fixed @ep reference in kernel-doc documentation for usb_endpoint_max_periodic_payload(). - In usb_endpoint_max_periodic_payload(), call struct usb_device pointer argument "udev" instead of "dev", to align with naming elsewhere. - Add support for interrupt endpoints in usb_endpoint_max_periodic_payload(); eUSB2 double isoc BW is still limited to isochronous endpoints though. - In usb_endpoint_max_periodic_payload(), remove the separate case for USB_SPEED_HIGH as the check is already done in parsing the eUSB isoc double BW companion, which is checked for. - New patch: use usb_endpoint_max_periodic_payload() in xHCI driver, replacing xhci_get_max_esit_payload(). - Check non-zero bDescriptorType field of ep->eusb2_isoc_ep_comp instead of dwBytesPerInterval value exceeding 3072, where xhci_eusb2_is_isoc_bw_double() was used. This aligns the checks of eUSB2 isochronous double bandwidth support for an endpoint. - New patch: introduce usb_endpoint_is_hs_isoc_double() to figure out whether an endpoint uses isochronous double bandwidth and use the function in the xHCI driver and the usb core. xhci_eusb2_is_isoc_bw_double() is dropped, as well as the MAX_ISOC_XFER_SIZE_HS macro. usb_endpoint_is_hs_isoc_double() also includes check for bcdUSB == 0x220, to anticipate adding support for eUSB2V2. - Merge condition for checking eUSB2 isoc double bw support for xHCI/endpoint in xhci_get_endpoint_mult(). - Improve comment regarding maximum packet size bits 12:11 in xhci_get_endpoint_max_burst(). - Aligned subject prefixes with the recent patches to the same files. since v3: https://lore.kernel.org/linux-usb/20250807055355.1257029-1-sakari.ailus@linux.intel.com/ - Use spaces in aligning macro body for HCC2_EUSB2_DIC() (1st patch). - Move usb_endpoint_max_isoc_bpi() to drivers/usb/core/usb.c (3rd patch). since v2: https://lore.kernel.org/linux-usb/20250711083413.1552423-1-sakari.ailus@linux.intel.com - Use ep->eusb2_isoc_ep_comp.bDescriptorType to determined whether the eUSB2 isochronous endpoint companion descriptor exists. - Clean up eUSB2 double isoc bw maxp calculation. - Drop le16_to_cpu(udev->descriptor.bcdUSB) == 0x220 check from xhci_eusb2_is_isoc_bw_double() -- it's redundant as ep->eusb2_isoc_ep_comp.dwBytesPerInterval will be zero otherwise. - Add kernel-doc documentation for usb_endpoint_max_isoc_bpi(). - Check the endpoint has IN direction in usb_endpoint_max_isoc_bpi() and usb_submit_urb() as a condition for eUSB2 isoc double bw. since v1: https://lore.kernel.org/linux-usb/20250616093730.2569328-2-mathias.nyman@linux.intel.com - Introduce uvc_endpoint_max_isoc_bpi() to obtain maximum bytes per interval value for an endpoint, in a new patch (3rd). This code has been slightly reworked from the instance in the UVC driver, including support for SuperSpeedPlus Isochronous Endpoint Companion. - Use usb_endpoint_max_isoc_bpi() in the UVC driver instead of open-coding eUSB2 support there, also drop now-redundant uvc_endpoint_max_bpi(). - Use u32 for maximum bpi and related information in the UVC driver -- the value could be larger than a 16-bit type can hold. - Assume max in usb_submit_urb() is a natural number as usb_endpoint_maxp() returns only natural numbers (2nd patch). Link: https://lore.kernel.org/r/20250820143824.551777-1-sakari.ailus@linux.intel.com Cc: Sakari Ailus Signed-off-by: Greg Kroah-Hartman commit 0aa0b0326cc5642e97af968d21cbd8836368b707 Author: Tao Q Tao Date: Wed Aug 20 17:38:24 2025 +0300 media: uvcvideo: eUSB2 double isochronous bandwidth support Use usb_endpoint_max_esit_payload() from the USB framework to find the maximum bytes per interval for the endpoint. Consequently this adds eUSB2 isochronous mode and SuperSpeedPlus Isochronous Endpoint Companion support where larger payloads within a service interval are possible. Co-developed-by: Amardeep Rai Signed-off-by: Amardeep Rai Signed-off-by: Tao Q Tao Signed-off-by: Mathias Nyman Co-developed-by: Sakari Ailus Signed-off-by: Sakari Ailus Reviewed-by: Ilpo Järvinen Reviewed-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-10-sakari.ailus@linux.intel.com commit 0666a012d25051d6d2b4e6b2c893e2f074b87d91 Author: Rai, Amardeep Date: Wed Aug 20 17:38:23 2025 +0300 usb: core: support eUSB2 double bandwidth large isoc URB frames eUSB2 double isochronous in bandwidth devices support up to 6 transactions per microframe, and thus doubles the total bytes possible to receive per microframe. Support larger URB isoc frame sizes for eUSB2 double isoc in endpoints. Also usb_endpoint_maxp() returns a natural number so there's no need to assume it could be < 0. Signed-off-by: Rai, Amardeep Reviewed-by: Sakari Ailus Signed-off-by: Mathias Nyman Co-developed-by: Sakari Ailus Signed-off-by: Sakari Ailus Acked-by: Alan Stern Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-9-sakari.ailus@linux.intel.com commit 0c670dc882d31f0423f18899c0e594547b55b76d Author: Rai, Amardeep Date: Wed Aug 20 17:38:22 2025 +0300 usb: xhci: Add host support for eUSB2 double isochronous bandwidth devices Detect eUSB2 double isoc bw capable hosts and devices, and set the proper xhci endpoint context values such as 'Mult', 'Max Burst Size', and 'Max ESIT Payload' to enable the double isochronous bandwidth endpoints. Intel xHC uses the endpoint context 'Mult' field for eUSB2 isoc endpoints even if hosts supporting Large ESIT Payload Capability should normally ignore the mult field. Signed-off-by: Rai, Amardeep Co-developed-by: Kannappan R Signed-off-by: Kannappan R Reviewed-by: Sakari Ailus Co-developed-by: Mathias Nyman Signed-off-by: Mathias Nyman Co-developed-by: Sakari Ailus Signed-off-by: Sakari Ailus Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-8-sakari.ailus@linux.intel.com commit d6725169a9bbcb5bd1dd14b2891b874614c59f52 Author: Sakari Ailus Date: Wed Aug 20 17:38:21 2025 +0300 usb: core: Introduce usb_endpoint_is_hs_isoc_double() Introduce usb_endpoint_is_hs_isoc_double() tell whether an endpoint conforms to USB 2.0 Isochronous Double IN Bandwidth ECN. Signed-off-by: Sakari Ailus Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-7-sakari.ailus@linux.intel.com commit 24b8762e05ed8203dc0b76b62c802aadd487e9aa Author: Sakari Ailus Date: Wed Aug 20 17:38:20 2025 +0300 usb: xhci: Use usb_endpoint_max_periodic_payload() Use the newly added usb_endpoint_max_periodic_payload() to obtain the maximum number of bytes to transfer during a service interval for isochronous and interrupt endpoints. This will replace the xhci-specific xhci_get_max_esit_payload() which is removed as redundant. Signed-off-by: Sakari Ailus Reviewed-by: Mathias Nyman Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-6-sakari.ailus@linux.intel.com commit 20f988320d2718ef28b1f0635acc88c12a216d29 Author: Rai, Amardeep Date: Wed Aug 20 17:38:19 2025 +0300 usb: core: Add a function to get USB version independent periodic payload Add usb_endpoint_max_periodic_payload() to obtain maximum payload bytes in a service interval for isochronous and interrupt endpoints in a USB version independent way. Signed-off-by: Rai, Amardeep Signed-off-by: Mathias Nyman Co-developed-by: Sakari Ailus Signed-off-by: Sakari Ailus Reviewed-by: Hans de Goede Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-5-sakari.ailus@linux.intel.com commit 53d76c6866a0362320b837dd292db4befcac31ba Author: Sakari Ailus Date: Wed Aug 20 17:38:18 2025 +0300 usb: core: eUSB2 companion descriptor is for isoc IN endpoints only The eUSB2 isochronous double bandwidth endpoint descriptor is allowed for the isochronous IN endpoints, according to the ECN. Do not parse these descriptors if they are found in interrupt or OUT endpoints. Signed-off-by: Sakari Ailus Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-4-sakari.ailus@linux.intel.com commit 030ab58b075c04b5286d2787860373dcc30020c6 Author: Sakari Ailus Date: Wed Aug 20 17:38:17 2025 +0300 usb: core: Parse eUSB2 companion descriptors for high speed devices only Check that a device is a high-speed one before proceeding to parse the eUSB2 isochronous endpoint companion descriptors. Signed-off-by: Sakari Ailus Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-3-sakari.ailus@linux.intel.com commit 970076537efd847c6f74ba9ed888b9cdbf71206e Author: Sakari Ailus Date: Wed Aug 20 17:38:16 2025 +0300 usb: core: Use le16_to_cpu() to read __le16 value in usb_parse_endpoint() wMaxPacketSize field in struct usb_endpoint_descriptor is an __le16, use le16_to_cpu() to read it. Signed-off-by: Sakari Ailus Acked-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250820143824.551777-2-sakari.ailus@linux.intel.com commit 1bc28f015a19a10b7a305fc561c1143c34a1e04a Author: Venkat Jayaraman Date: Fri Sep 5 11:44:01 2025 -0700 usb: typec: ucsi: Add check for UCSI version "Power Reading" bit is introduced in UCSI v2.1 and so limit the check for that bit only if version supported is 2.1 or above. Fixes: c851b71fd6cd ("usb: typec: ucsi: Add support for READ_POWER_LEVEL command") Signed-off-by: Venkat Jayaraman Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250905184401.3222530-1-venkat.jayaraman@intel.com Signed-off-by: Greg Kroah-Hartman commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 Author: Chen Yufeng Date: Fri Sep 5 17:48:42 2025 +0800 usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free. Fix: By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget(). A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints"). Signed-off-by: Chen Yufeng Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn Signed-off-by: Greg Kroah-Hartman commit e9c206324eeb213957a567a9d066bdeb355c7491 Author: Miaoqian Lin Date: Wed Sep 3 22:16:13 2025 +0800 usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device, which means the device will be automatically disabled on driver detach through the managed device framework. The manual pci_disable_device() call in the error path is therefore redundant. Found via static anlaysis and this is similar to commit 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload"). Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20250903141613.2535472-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1c208fd306f296a663d1edcced57bd8ef113eb74 Author: Liao Yuanhong Date: Tue Sep 2 21:27:19 2025 +0800 usb: host: xhci-tegra: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250902132720.85504-1-liaoyuanhong@vivo.com Signed-off-by: Greg Kroah-Hartman commit 9d4552da0ae8f056313cc290c0f493f59c6f7eef Author: Steven Rostedt Date: Thu Aug 28 21:55:55 2025 -0400 cdnsp: Remove unused tracepoints Tracepoints that are defined take up around 5K each, even if they are not used. If they are defined and not used, then they waste memory for unused code. Soon unused tracepoints will cause warnings. Remove the unused tracepoints of the cdnsp subsystem. They are: cdnsp_defered_event cdnsp_ep0_halted cdnsp_free_priv_device cdnsp_handle_cmd_flush_ep Signed-off-by: Steven Rostedt (Google) Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250829015650.224063821@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1c15b2f88127d5980747f2f62beb6e1f6e62f883 Author: Steven Rostedt Date: Thu Aug 28 21:55:54 2025 -0400 cdns3: Remove unused tracepoints Tracepoints that are defined take up around 5K each, even if they are not used. If they are defined and not used, then they waste memory for unused code. Soon unused tracepoints will cause warnings. Remove the unused tracepoints of the cdns3 subsystem. They are: cdns3_mapped_request cdns3_map_request cdns3_stream_transfer_split cdns3_stream_transfer_split_next_part Signed-off-by: Steven Rostedt (Google) Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250829015650.053498355@kernel.org Signed-off-by: Greg Kroah-Hartman commit 56429b4a37e710429e20a4f8dc85e96fcbb9f4b7 Author: Steven Rostedt Date: Thu Aug 28 21:55:53 2025 -0400 cdns2: Remove unused tracepoints Tracepoints that are defined take up around 5K each, even if they are not used. If they are defined and not used, then they waste memory for unused code. Soon unused tracepoints will cause warnings. Remove the unused tracepoints of the cdns2 subsystem. They are: cdns2_ep0_enqueue cdns2_ep0_set_config cdns2_ep_queue cdns2_iso_out_ep_disable cdns2_lpm cdns2_mapped_request cdns2_map_request cdns2_may_wakeup Signed-off-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20250829015649.885512884@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2cf8ecd0ae650c1f0e551326bb7f060abf1560d3 Author: Jisheng Zhang Date: Tue Aug 26 07:45:09 2025 +0800 usb: usb251xb: support usage case without I2C control Currently, the usb251xb assumes i2c control. But from HW point of view, the hub supports usage case without any i2c, we only want the gpio controls. Refactor the code so that register writes for configuration are only performed if the device has a i2c_client provided and also register as a platform driver. This allows the driver to be used to manage GPIO based control of the device. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250825234509.1041-4-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit 22fbedf9d9c2d219339620a95a0611c9ddfc397b Author: Jisheng Zhang Date: Tue Aug 26 07:45:08 2025 +0800 usb: usb251xb: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused. Signed-off-by: Jisheng Zhang Reviewed-by: Richard Leitner Link: https://lore.kernel.org/r/20250825234509.1041-3-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit ea32cd911368e32eb770c9078158467845c82b9a Author: Jisheng Zhang Date: Tue Aug 26 07:45:07 2025 +0800 dt-bindings: usb: usb251xb: support usage case without I2C control Currently, the usb251xb assumes i2c control, but from HW point of view, the hub supports usage case without any i2c control, I.E we only want the gpio controls, for example the following dt node: usb-hub { compatible = "microchip,usb2512b"; reset-gpios = <&porta 8 GPIO_ACTIVE_LOW>; }; Modify the dt-binding of usb2512b to support this usage case, and add the usage example to the examples section. Signed-off-by: Jisheng Zhang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250825234509.1041-2-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit 771713aeaca19b4dfb47595bea514859f55747b9 Author: Krzysztof Kozlowski Date: Sun Aug 31 14:22:24 2025 +0200 dt-bindings: usb: s3c2410-usb: Drop entirely S3C2410 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250831122222.50332-4-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit dc60a1cd7a76f2945159a461768010b8154ac8f8 Author: Krzysztof Kozlowski Date: Sun Aug 31 14:22:23 2025 +0200 usb: ohci: s3c2410: Drop support for S3C2410 systems Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. The driver (named s3c2410) is still being used via platform code for S3C64xx platforms. Signed-off-by: Krzysztof Kozlowski Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250831122222.50332-3-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 Author: William Wu Date: Tue Aug 26 18:28:07 2025 +0800 usb: gadget: f_hid: Fix zero length packet transfer Set the hid req->zero flag of ep0/in_ep to true by default, then the UDC drivers can transfer a zero length packet at the end if the hid transfer with size divisible to EPs max packet size according to the USB 2.0 spec. Signed-off-by: William Wu Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com Signed-off-by: Greg Kroah-Hartman commit e271cc0d25015f4be6c88bd7731444644eb352c2 Author: William Wu Date: Fri Aug 22 11:36:09 2025 +0800 usb: gadget: configfs: Correctly set use_os_string at bind Once the use_os_string flag is set to true for some functions (e.g. adb/mtp) which need to response the OS string, and then if we re-bind the ConfigFS gadget to use the other functions (e.g. hid) which should not to response the OS string, however, because the use_os_string flag is still true, so the usb gadget response the OS string descriptor incorrectly, this can cause the USB device to be unrecognizable on the Windows system. An example of this as follows: echo 1 > os_desc/use ln -s functions/ffs.adb configs/b.1/function0 start adbd echo "" > UDC #succeed stop adbd rm configs/b.1/function0 echo 0 > os_desc/use ln -s functions/hid.gs0 configs/b.1/function0 echo "" > UDC #fail to connect on Windows This patch sets the use_os_string flag to false at bind if the functions not support OS Descriptors. Signed-off-by: William Wu Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com Signed-off-by: Greg Kroah-Hartman commit ab96716991f3b7634566bc000d69a66b8b2ecc15 Author: Matthias Schiffer Date: Mon Aug 25 14:49:00 2025 +0200 usb: musb: dsps: use platform_get_irq_byname_optional() for vbus IRQ The vbus IRQ is optional, so no error message should be printed if it is not available. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250825124901.2190539-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 0d7395046bb3e412975bf20bb08b41f34c1cd5da Author: Eric Gonçalves Date: Mon Aug 25 04:17:39 2025 +0000 tools/usb/usbip: fix spelling mistakes in usbipd.c Correct two occurences of 'seperate' typos on comments in lines 399 and 520. Signed-off-by: Eric Gonçalves Link: https://lore.kernel.org/r/20250825041739.8117-1-ghatto404@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1daa7f57b85038eb3a4e6220a9623557a759758c Author: Jihed Chaibi Date: Sun Aug 24 13:23:38 2025 +0200 usb: dt-bindings: ti,twl6030-usb: convert to DT schema Convert the legacy TXT binding for the TWL6030 USB module to the modern YAML DT schema format. This adds formal validation and improves documentation using a conditional schema. The legacy twlxxxx-usb.txt file is no longer needed and is removed. Signed-off-by: Jihed Chaibi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250824112338.64953-3-jihed.chaibi.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7d3f780122bee082f035aeb6a3cf073dc77dbd1f Author: Jihed Chaibi Date: Sun Aug 24 13:23:37 2025 +0200 usb: dt-bindings: ti,twl4030-usb: convert to DT schema Convert the legacy TXT binding for the TWL4030 USB module to the modern YAML DT schema format. This adds formal validation and improves documentation using a conditional schema. Remove the twl4030 section from the obsolete .txt binding file Signed-off-by: Jihed Chaibi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250824112338.64953-2-jihed.chaibi.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit c79bf528738c0e98e0744f7a63c27fab35c93b43 Author: Linus Walleij Date: Wed Aug 20 14:11:01 2025 +0200 dt-bindings: usb: IXP4xx UDC bindings This adds device tree bindings for the IXP4xx USB Device Controller (UDC). Signed-off-by: Linus Walleij Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250820-ixp4xx-udc-bindings-v1-1-640f29140164@linaro.org Signed-off-by: Greg Kroah-Hartman commit 4c9860fbe66177fddb8b7161d6809110d3960a6e Author: Kuen-Han Tsai Date: Fri Aug 22 17:23:46 2025 +0800 usb: dwc3: Refactor dwc3_mode_show Use dwc3_mode_string as the single source of truth for mode-to-string conversion. Signed-off-by: Kuen-Han Tsai Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20250822092411.173519-2-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 55f4ac8f93f4281134dfcf47de7b4588bb6074f2 Author: Kuen-Han Tsai Date: Fri Aug 22 17:23:45 2025 +0800 usb: dwc3: Add trace event for dwc3_set_prtcap Changes to the port capability can be indirectly observed by tracing register writes to DWC3_GCTL. However, this requires interpreting the raw value, which is neither intuitive nor precise for debugging. Monitoring these mode changes is essential for resolving issues related to USB role switching and enumeration. Introduce a dedicated trace event to provide a human-readable log when the port capability is configured. Signed-off-by: Kuen-Han Tsai Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20250822092411.173519-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit b570b346ddd727c4b41743a6a2f49e7217c5317f Author: Xichao Zhao Date: Fri Aug 22 17:22:24 2025 +0800 usb: phy: twl6030: Fix incorrect type for ret In the twl6030_usb_probe(), the variable ret is declared as a u32 type. However, since ret may receive -ENODEV when accepting the return value of omap_usb2_set_comparator().Therefore, its type should be changed to int. Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 5195edb359855d9a6460f19b7c3915a8611fceed Author: Thorsten Blum Date: Thu Aug 28 18:26:24 2025 +0200 usb: storage: realtek_cr: Simplify residue calculation in rts51x_bulk_transport() Simplify the calculation of 'residue' in rts51x_bulk_transport() and avoid unnecessarily reassigning 'residue' to itself. Acked-by: Alan Stern Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250828162623.4840-3-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 811ee632b1f7e543ccaf61d7c241e73c386a6eb2 Author: Petr Vorel Date: Fri Aug 29 18:17:08 2025 +0200 usb: misc: Update link to EHSET pdf doc Obviously file on the website was renamed. Signed-off-by: Petr Vorel Link: https://lore.kernel.org/r/20250829161708.106813-1-petr.vorel@gmail.com Signed-off-by: Greg Kroah-Hartman commit 43ae982cd0ec7fb6fea40fabef2c872e6f9b213d Author: Thorsten Blum Date: Fri Aug 29 19:37:12 2025 +0200 usb: usblp: Use min_t() to improve usblp_read() Use min_t() to improve usblp_read() and avoid calculating 'avail - usblp->readcount' twice. Use min_t(ssize_t,,) instead of min() to avoid a signedness error. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250829173713.56222-1-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 91709d2ce5cdf568b42fcc33473929843ed95cd3 Author: Thorsten Blum Date: Sat Aug 30 13:04:20 2025 +0200 usb: ucsi: stm32: Use min() to improve ucsi_stm32g0_fw_cb() Use min() to improve ucsi_stm32g0_fw_cb() and avoid calculating 'end - data' twice. Signed-off-by: Thorsten Blum Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250830110426.10007-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit daaa574aba6f9c683408b58a7ab2dc775ece2f98 Author: Nam Cao Date: Mon Aug 11 11:28:56 2025 +0200 powerpc/pseries/msi: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/c7a6d8f27fd217021dea4daad777e81a525ae460.1754903590.git.namcao@linutronix.de commit f0ac60e6e311062f1a452d93376055787db4b070 Author: Nam Cao Date: Mon Aug 11 11:28:55 2025 +0200 powerpc/powernv/pci: Switch to use msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/a4c2c363ac7b94fffc79d5b92086135be4c57e06.1754903590.git.namcao@linutronix.de commit cc0cc23babc979e399f34f53e4bccf702a389558 Author: Nam Cao Date: Mon Aug 11 11:28:54 2025 +0200 powerpc/xive: Untangle xive from child interrupt controller drivers xive-specific data is stored in handler_data. This creates a mess, as xive has to rely on child interrupt controller drivers to clean up this data, as was done by 9a014f45688 ("powerpc/pseries/pci: Add a msi_free() handler to clear XIVE data"). Instead, store xive-specific data in chip_data and untangle the child drivers. Signed-off-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/83968073022a4cc211dcbd0faccd20ec05e58c3e.1754903590.git.namcao@linutronix.de commit c2ce2453413d429e302659abc5ace634e873f6f5 Author: Rafael J. Wysocki Date: Thu Aug 28 12:59:24 2025 +0200 driver core/PM: Set power.no_callbacks along with power.no_pm Devices with power.no_pm set are not expected to need any power management at all, so modify device_set_pm_not_required() to set power.no_callbacks for them too in case runtime PM will be enabled for any of them (which in principle may be done for convenience if such a device participates in a dependency chain). Since device_set_pm_not_required() must be called before device_add() or it would not have any effect, it can update power.no_callbacks without locking, unlike pm_runtime_no_callbacks() that can be called after registering the target device. Signed-off-by: Rafael J. Wysocki Cc: stable Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/1950054.tdWV9SEqCh@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman commit 1ad926459970444af1140f9b393f416536e1a828 Author: Rafael J. Wysocki Date: Thu Aug 28 12:56:41 2025 +0200 driver core: faux: Set power.no_pm for faux devices Since faux devices are not supposed to be involved in any kind of power management, set the no_pm flag for all of them. Signed-off-by: Rafael J. Wysocki Cc: stable Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/6206518.lOV4Wx5bFT@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman commit b034baff11d050dd314d5f2645eb52988a93e4a1 Author: Gautam Menghani Date: Wed Aug 13 17:53:18 2025 +0530 powerpc: Remove duplicate definition for ppc_msgsnd_sync() Remove duplicate definition of ppc_msgsnd_sync() introduced in commit b87ac0218355 ("powerpc: Introduce msgsnd/doorbell barrier primitives"). No functional change intended. Signed-off-by: Gautam Menghani Reviewed-by: Ritesh Harjani (IBM) [maddy: Updated commit message to fixed checkpatch.pl warning] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250813122319.62278-1-gautam@linux.ibm.com commit 6dc5d0770dc99d6bf9b786fa3c8fc04be2091648 Author: Thorsten Blum Date: Tue Aug 19 18:58:29 2025 +0200 powerpc/ps3: Use str_write_read() in ps3stor_read_write_sectors() Remove hard-coded strings by using the str_write_read() helper function and silence the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_write_read(write) Signed-off-by: Thorsten Blum Reviewed-by: Geert Uytterhoeven Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250819165829.714344-2-thorsten.blum@linux.dev commit 1da0ca4bdfd2ad7d2ad39d35beb18468e9bf09ef Merge: 2d2664fdd7c705 e5b0d7da941a7d Author: Greg Kroah-Hartman Date: Sat Sep 6 13:27:23 2025 +0200 Merge patch series "Rust support for `struct iov_iter`" Alice Ryhl says: This series adds support for the `struct iov_iter` type. This type represents an IO buffer for reading or writing, and can be configured for either direction of communication. In Rust, we define separate types for reading and writing. This will ensure that you cannot mix them up and e.g. call copy_from_iter in a read_iter syscall. To use the new abstractions, miscdevices are given new methods read_iter and write_iter that can be used to implement the read/write syscalls on a miscdevice. The miscdevice sample is updated to provide read/write operations. Intended for Greg's miscdevice tree. Link: https://lore.kernel.org/r/20250822-iov-iter-v5-0-6ce4819c2977@google.com Signed-off-by: Greg Kroah-Hartman commit e5b0d7da941a7dc1ced09d57b967fdc124f510f8 Author: Lee Jones Date: Fri Aug 22 08:42:36 2025 +0000 samples: rust_misc_device: Expand the sample to support read()ing from userspace A userland application can now operate on the char device with read() in order to consume a locally held buffer. Memory for the buffer is to be provisioned and the buffer populated in its subsequently provided write() counterpart. Signed-off-by: Lee Jones Reviewed-by: Andreas Hindborg Co-developed-by: Alice Ryhl Signed-off-by: Alice Ryhl Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250822-iov-iter-v5-5-6ce4819c2977@google.com commit 39c2745b37dac18c6604083f26caea3fd7e4c50b Author: Alice Ryhl Date: Fri Aug 22 08:42:35 2025 +0000 rust: miscdevice: Provide additional abstractions for iov_iter and kiocb structures These will be used for the read_iter() and write_iter() callbacks, which are now the preferred back-ends for when a user operates on a char device with read() and write() respectively. Co-developed-by: Lee Jones Signed-off-by: Lee Jones Reviewed-by: Andreas Hindborg Signed-off-by: Alice Ryhl Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250822-iov-iter-v5-4-6ce4819c2977@google.com commit 5e15de179a204ce26623d8468283ac04a0dc672f Author: Alice Ryhl Date: Fri Aug 22 08:42:34 2025 +0000 rust: fs: add Kiocb struct This adds a very simple Kiocb struct that lets you access the inner file's private data and the file position. For now, nothing else is supported. Cc: Christian Brauner Reviewed-by: Andreas Hindborg Signed-off-by: Alice Ryhl Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250822-iov-iter-v5-3-6ce4819c2977@google.com commit ce2e0829241ab96af9c8a12b511debc5e3188934 Author: Alice Ryhl Date: Fri Aug 22 08:42:33 2025 +0000 rust: iov: add iov_iter abstractions for ITER_DEST This adds abstractions for the iov_iter type in the case where data_source is ITER_DEST. This will make Rust implementations of fops->read_iter possible. This series only has support for using existing IO vectors created by C code. Additional abstractions will be needed to support the creation of IO vectors in Rust code. These abstractions make the assumption that `struct iov_iter` does not have internal self-references, which implies that it is valid to move it between different local variables. This patch adds an IovIterDest struct that is very similar to the IovIterSource from the previous patch. However, as the methods on the two structs have very little overlap (just getting the length and advance/revert), I do not think it is worth it to try and deduplicate this logic. Reviewed-by: Andreas Hindborg Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250822-iov-iter-v5-2-6ce4819c2977@google.com commit 06cb58b310ea38a8135827f726157df59a95376e Author: Alice Ryhl Date: Fri Aug 22 08:42:32 2025 +0000 rust: iov: add iov_iter abstractions for ITER_SOURCE This adds abstractions for the iov_iter type in the case where data_source is ITER_SOURCE. This will make Rust implementations of fops->write_iter possible. This series only has support for using existing IO vectors created by C code. Additional abstractions will be needed to support the creation of IO vectors in Rust code. These abstractions make the assumption that `struct iov_iter` does not have internal self-references, which implies that it is valid to move it between different local variables. Reviewed-by: Andreas Hindborg Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250822-iov-iter-v5-1-6ce4819c2977@google.com commit e2580413a83680f679904ad2f2c1aa6969876469 Author: Danilo Krummrich Date: Mon Sep 1 17:01:53 2025 +0200 gpu: nova-core: take advantage of pci::Device::unbind() Now that we have pci::Device::unbind() we can unregister the sysmem flush page with a direct access the I/O resource, i.e. without RCU read side critical section. Signed-off-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250901150207.63094-1-dakr@kernel.org Signed-off-by: Alexandre Courbot commit e7a6475cc0c32213e87ec190d90b8f1440ff05ae Author: Christophe Leroy Date: Mon Aug 18 14:42:24 2025 +0200 gpio: mpc5200: Drop legacy-of-mm-gpiochip.h header Remove legacy-of-mm-gpiochip.h header file. The above mentioned file provides an OF API that's deprecated. There is no agnostic alternatives to it and we have to open code the logic which was hidden behind of_mm_gpiochip_add_data(). Note, most of the GPIO drivers are using their own labeling schemas and resource retrieval that only a few may gain of the code deduplication, so whenever alternative is appear we can move drivers again to use that one. [text copied from commit 34064c8267a6 ("powerpc/8xx: Drop legacy-of-mm-gpiochip.h header")] Signed-off-by: Christophe Leroy Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/9652736ef05b94d9113ea5ce7899734ef82343d1.1755520794.git.christophe.leroy@csgroup.eu commit d2ad26e7b67e5a3d73221daf8207e848dd819bd4 Author: Christophe Leroy Date: Mon Aug 18 14:17:35 2025 +0200 powerpc/44x: Drop legacy-of-mm-gpiochip.h header Remove legacy-of-mm-gpiochip.h header file. The above mentioned file provides an OF API that's deprecated. There is no agnostic alternatives to it and we have to open code the logic which was hidden behind of_mm_gpiochip_add_data(). Note, most of the GPIO drivers are using their own labeling schemas and resource retrieval that only a few may gain of the code deduplication, so whenever alternative is appear we can move drivers again to use that one. As a side effect this change fixes a potential memory leak on an error path, if of_mm_gpiochip_add_data() fails. [Text copied from commit 34064c8267a6 ("powerpc/8xx: Drop legacy-of-mm-gpiochip.h header")] Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2f8f16eac72b9ec202b6e593939b44308891a661.1755519343.git.christophe.leroy@csgroup.eu commit 1044dbaf2a77c9e1143753a620d830943da6a193 Author: Christophe Leroy Date: Mon Aug 18 14:17:34 2025 +0200 powerpc/44x: Change GPIO driver to a proper platform driver In order to drop legacy-of-mm-gpiochip dependency, first change the 44x GPIO driver to a proper platform driver. Signed-off-by: Christophe Leroy Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/29d89aa43536714b193d9710301341f838fcb5b7.1755519343.git.christophe.leroy@csgroup.eu commit 7f9bcf13069731fac48d8b44086fab179fbc04c9 Author: Christophe Leroy Date: Mon Aug 18 14:14:36 2025 +0200 powerpc/cpm2: Drop legacy-of-mm-gpiochip.h header Remove legacy-of-mm-gpiochip.h header file. The above mentioned file provides an OF API that's deprecated. There is no agnostic alternatives to it and we have to open code the logic which was hidden behind of_mm_gpiochip_add_data(). Note, most of the GPIO drivers are using their own labeling schemas and resource retrieval that only a few may gain of the code deduplication, so whenever alternative is appear we can move drivers again to use that one. As a side effect this change fixes a potential memory leak on an error path, if of_mm_gpiochip_add_data() fails. [text copied from commit 34064c8267a6 ("powerpc/8xx: Drop legacy-of-mm-gpiochip.h header")] Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2662f24c539db393f11b27f0feae2dc14bb2f08f.1755518891.git.christophe.leroy@csgroup.eu commit 58f5382a482ba7313085de57767bb784f211b475 Author: Christophe Leroy Date: Mon Aug 18 11:26:44 2025 +0200 powerpc/vdso: Include asm/syscalls.h for sys_ni_syscall() Include asm/syscalls.h to get the correct prototype for sys_ni_syscall() Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/e2215a515ae0e21393c50e2f38791a6567cf1dec.1755509195.git.christophe.leroy@csgroup.eu commit 96c79fef228157baddae6574555353535772f109 Author: Christophe Leroy Date: Mon Aug 18 11:24:22 2025 +0200 powerpc/8xx: Remove offset in SPRN_M_TWB SPRN_M_TWB contains the address of task PGD minus an offset which compensates the offset required when accessing the kernel PGDIR. However, since commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") and commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in ITLB misses") kernel PGDIR is not used anymore in hot paths. Remove this offset which was added by commit fde5a9057fcf ("powerpc/8xx: Optimise access to swapper_pg_dir") Signed-off-by: Christophe Leroy [maddy: Fixed checkpatch.pl warning for "pathes"] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/9710d960b512996e64beebfd368cfeaadb28b3ba.1755509047.git.christophe.leroy@csgroup.eu commit a41de5ccff85a0fe45ea1b4078230bf53faa7dc4 Author: Christophe Leroy Date: Tue Jul 1 12:50:07 2025 +0200 arch/powerpc: Remove support for older GCC and binutils Commit 118c40b7b503 ("kbuild: require gcc-8 and binutils-2.30") raised minimum GCC_VERSION and LD_VERSION. Simplify powerpc build accordingly. Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/b6b94cba7492c8581e8d5d25b15962e5ad7a37c2.1751366979.git.christophe.leroy@csgroup.eu commit 0c1da35b0188dd565cec907a16cb5d1bd425e0e4 Author: Saket Kumar Bhaskar Date: Thu Sep 4 15:38:35 2025 +0530 powerpc64/bpf: Implement PROBE_ATOMIC instructions powerpc supports BPF atomic operations using a loop around Load-And-Reserve(LDARX/LWARX) and Store-Conditional(STDCX/STWCX) instructions gated by sync instructions to enforce full ordering. To implement arena_atomics, arena vm start address is added to the dst_reg to be used for both the LDARX/LWARX and STDCX/STWCX instructions. Further, an exception table entry is added for LDARX/LWARX instruction to land after the loop on fault. At the end of sequence, dst_reg is restored by subtracting arena vm start address. bpf_jit_supports_insn() is introduced to selectively enable instruction support as in other architectures like x86 and arm64. Reviewed-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250904100835.1100423-5-skb99@linux.ibm.com commit 45ed2e8b0591eb6211d79f436f76c3af31e626af Author: Saket Kumar Bhaskar Date: Thu Sep 4 15:38:34 2025 +0530 powerpc64/bpf: Introduce bpf_jit_emit_atomic_ops() to emit atomic instructions The existing code for emitting bpf atomic instruction sequences for atomic operations such as XCHG, CMPXCHG, ADD, AND, OR, and XOR has been refactored into a reusable function, bpf_jit_emit_ppc_atomic_op(). It also computes the jump offset and tracks the instruction index for jited LDARX/LWARX to be used in case it causes a fault. Reviewed-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250904100835.1100423-4-skb99@linux.ibm.com commit a2485d06cad3741303b9414e44f9b6d76d3713f2 Author: Saket Kumar Bhaskar Date: Thu Sep 4 15:38:33 2025 +0530 powerpc64/bpf: Implement bpf_addr_space_cast instruction LLVM generates bpf_addr_space_cast instruction while translating pointers between native (zero) address space and __attribute__((address_space(N))). The addr_space=0 is reserved as bpf_arena address space. rY = addr_space_cast(rX, 0, 1) is processed by the verifier and converted to normal 32-bit move: wX = wY. rY = addr_space_cast(rX, 1, 0) : used to convert a bpf arena pointer to a pointer in the userspace vma. This has to be converted by the JIT. PPC_RAW_RLDICL_DOT, a variant of PPC_RAW_RLDICL is introduced to set condition register as well. Reviewed-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250904100835.1100423-3-skb99@linux.ibm.com commit 47c7f3b7038787ee42cb9ed69825e6790dba9410 Author: Saket Kumar Bhaskar Date: Thu Sep 4 15:38:32 2025 +0530 powerpc64/bpf: Implement PROBE_MEM32 pseudo instructions Add support for [LDX | STX | ST], PROBE_MEM32, [B | H | W | DW] instructions. They are similar to PROBE_MEM instructions with the following differences: - PROBE_MEM32 supports store. - PROBE_MEM32 relies on the verifier to clear upper 32-bit of the src/dst register - PROBE_MEM32 adds 64-bit kern_vm_start address (which is stored in _R26 in the prologue). Due to bpf_arena constructions such _R26 + reg + off16 access is guaranteed to be within arena virtual range, so no address check at run-time. - PROBE_MEM32 allows STX and ST. If they fault the store is a nop. When LDX faults the destination register is zeroed. To support these on powerpc, we do tmp1 = _R26 + src/dst reg and then use tmp1 as the new src/dst register. This allows us to reuse most of the code for normal [LDX | STX | ST]. Additionally, bpf_jit_emit_probe_mem_store() is introduced to emit instructions for storing memory values depending on the size (byte, halfword, word, doubleword). Stack layout is adjusted to introduce a new NVR (_R26) and to make BPF_PPC_STACKFRAME quadword aligned (local_tmp_var is increased by 8 bytes). Reviewed-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Saket Kumar Bhaskar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250904100835.1100423-2-skb99@linux.ibm.com commit 5ab829f1971dc99f2aac10846c378e67fc875abc Author: Yu Kuai Date: Fri Aug 29 16:04:26 2025 +0800 md/md-llbitmap: introduce new lockless bitmap Redundant data is used to enhance data fault tolerance, and the storage method for redundant data vary depending on the RAID levels. And it's important to maintain the consistency of redundant data. Bitmap is used to record which data blocks have been synchronized and which ones need to be resynchronized or recovered. Each bit in the bitmap represents a segment of data in the array. When a bit is set, it indicates that the multiple redundant copies of that data segment may not be consistent. Data synchronization can be performed based on the bitmap after power failure or readding a disk. If there is no bitmap, a full disk synchronization is required. Due to known performance issues with md-bitmap and the unreasonable implementations: - self-managed IO submitting like filemap_write_page(); - global spin_lock I have decided not to continue optimizing based on the current bitmap implementation, this new bitmap is invented without locking from IO fast path and can be used with fast disks. For designs and details, see the comments in drivers/md-llbitmap.c. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-12-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 66be318e6659d10e90f487e2610409cef659dbfe Author: Yu Kuai Date: Fri Aug 29 16:04:25 2025 +0800 md/md-bitmap: make method bitmap_ops->daemon_work optional daemon_work() will be called by daemon thread, on the one hand, daemon thread doesn't have strict wake-up time; on the other hand, too much work are put to daemon thread, like handle sync IO, handle failed or specail normal IO, handle recovery, and so on. Hence daemon thread may be too busy to clear dirty bits in time. Make bitmap_ops->daemon_work() optional and following patches will use separate async work to clear dirty bits for the new bitmap. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-11-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan commit c951ccf0bf2df4f39b45dc77998dd71da7a85369 Author: Yu Kuai Date: Fri Aug 29 16:04:24 2025 +0800 md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER This flag is used by llbitmap in later patches to skip raid456 initial recover and delay building initial xor data to first write. https://lore.kernel.org/linux-raid/20250829080426.1441678-10-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai commit a4dd9ba39ba4f86ae8848c63945d443f0569efb1 Author: Yu Kuai Date: Fri Aug 29 16:04:23 2025 +0800 md/md-bitmap: add a new method blocks_synced() in bitmap_operations Currently, raid456 must perform a whole array initial recovery to build initail xor data, then IO to the array won't have to read all the blocks in underlying disks. This behavior will affect IO performance a lot, and nowadays there are huge disks and the initial recovery can take a long time. Hence llbitmap will support lazy initial recovery in following patches. This method is used to check if data blocks is synced or not, if not then IO will still have to read all blocks for raid456. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-9-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai commit f196d72888640e35002ac3511757cefaa9c5e339 Author: Yu Kuai Date: Fri Aug 29 16:04:22 2025 +0800 md/md-bitmap: add a new method skip_sync_blocks() in bitmap_operations This method is used to check if blocks can be skipped before calling into pers->sync_request(), llbitmap will use this method to skip resync for unwritten/clean data blocks, and recovery/check/repair for unwritten data blocks; Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-8-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Xiao Ni Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan commit fb8cc3b0d9db94817a5aae2bcaf78dd079a89e52 Author: Yu Kuai Date: Fri Aug 29 16:04:21 2025 +0800 md/md-bitmap: delay registration of bitmap_ops until creating bitmap Currently bitmap_ops is registered while allocating mddev, this is fine when there is only one bitmap_ops. Delay setting bitmap_ops until creating bitmap, so that user can choose which bitmap to use before running the array. Link: https://lore.kernel.org/linux-raid/20250721171557.34587-7-yukuai@kernel.org Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan Reviewed-by: Xiao Ni commit 180b82c1c7b2c2c5bffc1642239bed36d7e83f76 Author: Yu Kuai Date: Fri Aug 29 16:04:20 2025 +0800 md/md-bitmap: add a new sysfs api bitmap_type The api will be used by mdadm to set bitmap_type while creating new array or assembling array, prepare to add a new bitmap. Currently available options are: cat /sys/block/md0/md/bitmap_type none [bitmap] Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-6-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Reviewed-by: Xiao Ni Reviewed-by: Li Nan commit 300bffa870c5dfaae87c169b1d5edc9c285a81a6 Author: Yu Kuai Date: Fri Aug 29 16:04:19 2025 +0800 md: add a new mddev field 'bitmap_id' Prepare to store the bitmap id selected by user, also refactor mddev_set_bitmap_ops a bit in case the value is invalid. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-5-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan Reviewed-by: Xiao Ni commit ac9dad8faaa7b2a7c7c6de0017f2d7d54525d33c Author: Yu Kuai Date: Fri Aug 29 16:04:18 2025 +0800 md/md-bitmap: support discard for bitmap ops Use two new methods {start, end}_discard in bitmap_ops and a new field 'rw' in struct md_io_clone to handle discard IO, prepare to support new md bitmap. Since all bitmap functions to hanlde write IO are the same, also add typedef to make code cleaner. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-4-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan commit 7797da149d4622bbe803eaee6eaf22a7f62f44ab Author: Yu Kuai Date: Fri Aug 29 16:04:17 2025 +0800 md: factor out a helper raid_is_456() There are no functional changes, the helper will be used by llbitmap in following patches. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-3-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan commit d01acbce391767318c94fb1f6d648cfabb428f9d Author: Yu Kuai Date: Fri Aug 29 16:04:16 2025 +0800 md: add a new parameter 'offset' to md_super_write() The parameter is always set to 0 for now, following patches will use this helper to write llbitmap to underlying disks, allow writing dirty sectors instead of the whole page. Also rename md_super_write to md_write_metadata since there is nothing super-block specific. Link: https://lore.kernel.org/linux-raid/20250829080426.1441678-2-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan commit c27474ac1d4609af3c1c38ccac252c2575b47b9e Author: Yu Kuai Date: Mon Jul 7 09:27:11 2025 +0800 md/md-bitmap: introduce CONFIG_MD_BITMAP Now that all implementations are internal, it's sensible to add a config option for md-bitmap, and it's a good way for isolation. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-16-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 26292657add33b8cb627bd582e7097755e85a3ac Author: Yu Kuai Date: Mon Jul 7 09:27:10 2025 +0800 md: check before referencing mddev->bitmap_ops Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-15-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 0e18745420e332870eabed5a9d7efb45c0283bf0 Author: Yu Kuai Date: Mon Jul 7 09:27:09 2025 +0800 md/dm-raid: check before referencing mddev->bitmap_ops Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-14-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit bb9317b13ade9e5e550aa2efecbd209ff96697ff Author: Yu Kuai Date: Mon Jul 7 09:27:08 2025 +0800 md/raid5: check before referencing mddev->bitmap_ops Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-13-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 969f996243ae1d7b95b95368262f5e3a6e8bb0b4 Author: Yu Kuai Date: Mon Jul 7 09:27:07 2025 +0800 md/raid10: check before referencing mddev->bitmap_ops Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-12-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 8d31ed3b776eb2a4c4397f96dc92643f57e2e447 Author: Yu Kuai Date: Mon Jul 7 09:27:06 2025 +0800 md/raid1: check before referencing mddev->bitmap_ops Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-11-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 20cecae877a634ffc49b4cd7b0f6927209badbab Author: Yu Kuai Date: Mon Jul 7 09:27:05 2025 +0800 md/raid1: check bitmap before behind write behind write rely on bitmap, because the number of IO are recorded in bitmap->behind_writes, and callers rely on bitmap_wait_behind_writes() to wait for IO to be done. However, currently callers doesn't check if bitmap is enabeld before calling into behind methods. Hence if behind write start without bitmap, readers will not wait for slow write IO to be done and old data can be read in some corner cases. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-10-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit bb74b093c33cf20876e23ad8aa0d206b537ccb69 Author: Yu Kuai Date: Mon Jul 7 09:27:04 2025 +0800 md/md-bitmap: handle the case bitmap is not enabled before end_sync() This case can be handled without knowing internal implementation. Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-9-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 5ae58d1500e3fc16df3267fad810955c949afdb2 Author: Yu Kuai Date: Mon Jul 7 09:27:03 2025 +0800 md/md-bitmap: handle the case bitmap is not enabled before start_sync() This case can be handled without knowing internal implementation. Prepare to introduce CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-8-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 110332074dc6ad2f07a3cf9cc45b03adbce0e54f Author: Yu Kuai Date: Mon Jul 7 09:27:02 2025 +0800 md/md-bitmap: add md_bitmap_registered/enabled() helper There are no functional changes, prepare to handle the case that mddev->bitmap_ops can be NULL, which is possible after introducing CONFIG_MD_BITMAP. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-7-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 9c41ead04ec0d3ee54505039879aee20cf495e0a Author: Yu Kuai Date: Mon Jul 7 09:27:01 2025 +0800 md/md-bitmap: add a new parameter 'flush' to bitmap_ops->enabled The method is only used from raid1/raid10 IO path, to check if write bio should be pluged, the parameter is always set to true for now, following patch will use this helper in other context like updating superblock. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-6-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit 9307dbac0ea3fea977677d6c590b49f35a8203fc Author: Yu Kuai Date: Mon Jul 7 09:27:00 2025 +0800 md/md-bitmap: merge md_bitmap_group into bitmap_operations Now that all bitmap implementations are internal, it doesn't make sense to export md_bitmap_group anymore. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-5-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit e57b225c28b270d46c84ec4742607eab4093ae7c Author: Yu Kuai Date: Mon Jul 7 09:26:59 2025 +0800 md/md-bitmap: remove the parameter 'init' for bitmap_ops->resize() It's set to 'false' for all callers, hence it's useless and can be removed. Link: https://lore.kernel.org/linux-raid/20250707012711.376844-3-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni commit eef7336dc6c11f80c08b55b09b24faf124baeb0d Author: Nick Chan Date: Tue Aug 26 20:09:15 2025 +0800 arm64: dts: apple: t8015: Add NVMe nodes Add nodes for NVMe and associated mailbox and sart for Apple A11 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250826-t8015-nvme-v5-4-caee6ab00144@gmail.com Signed-off-by: Sven Peter commit 55a1ed25fa8b6fefbbc61704fd8fb2e4fe8ffc6f Author: Nick Chan Date: Tue Aug 26 20:09:14 2025 +0800 arm64: dts: apple: t8015: Fix PCIE power domains dependencies Fix the dependency topology of PCIE power domain nodes, as required by ANS2 NVME controller. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250826-t8015-nvme-v5-3-caee6ab00144@gmail.com Signed-off-by: Sven Peter commit 04d8ecf37b5e06d16228a4d37d8548c17cf70461 Author: Nick Chan Date: Tue Aug 26 20:09:13 2025 +0800 nvme: apple: Add Apple A11 support Add support for ANS2 NVMe on Apple A11 SoC. This version of ANS2 is less quirky than the one in M1, and does not have NVMMU or Linear SQ. However, it still requires a non-standard 128-byte SQE. Acked-by: Christoph Hellwig Signed-off-by: Nick Chan Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/20250826-t8015-nvme-v5-2-caee6ab00144@gmail.com Signed-off-by: Sven Peter commit 1dd8daf1cd49b9a97544826670163d6083ad32cc Author: Nick Chan Date: Tue Aug 26 20:09:12 2025 +0800 dt-bindings: nvme: apple,nvme-ans: Add Apple A11 Add ANS2 NVMe bindings for Apple A11 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250826-t8015-nvme-v5-1-caee6ab00144@gmail.com Signed-off-by: Sven Peter commit a67677d4e2b80542567f858bb99b95ac24b8e6de Author: Nick Chan Date: Thu Aug 21 23:56:42 2025 +0800 soc: apple: sart: Add SARTv0 support Add support for SARTv0 as found on Apple A11 SoC. Reviewed-by: Sven Peter Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250821-t8015-nvme-v3-5-14a4178adf68@gmail.com Signed-off-by: Sven Peter commit 8409ebe2c3ebd55ddded7950f6089281ab116d51 Author: Nick Chan Date: Thu Aug 21 23:56:41 2025 +0800 soc: apple: sart: Make allow flags SART version dependent SART versions that uses different allow flags will be added. Reviewed-by: Sven Peter Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250821-t8015-nvme-v3-4-14a4178adf68@gmail.com Signed-off-by: Sven Peter commit 940ce882f75b66fe4f0af6da970566ef441de441 Author: Nick Chan Date: Thu Aug 21 23:56:40 2025 +0800 dt-bindings: iommu: apple,sart: Add Apple A11 Add apple,t8015-sart for SARTv0 found on the Apple A11 SoC, which uses a different MMIO layout and is thus incompatible with the previously described versions Reviewed-by: Sven Peter Acked-by: Rob Herring (Arm) Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250821-t8015-nvme-v3-3-14a4178adf68@gmail.com [sven: adjusted commit message] Signed-off-by: Sven Peter commit 886d6981208263b55a1eb8b39c5d00db1544b9bb Author: Zhushuai Yin Date: Sat Aug 30 18:27:57 2025 +0800 crypto: hisilicon/zip - add hashjoin, gather, and UDMA data move features The new version of the hisilicon zip driver supports the hash join and gather features, as well as the data move feature (UDMA), including data copying and memory initialization functions.These features are registered to the uacce subsystem. Signed-off-by: Zhushuai Yin Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit cf79ed6aacd3f7486972efda15a7d03d03ac274e Author: Chenghai Huang Date: Sat Aug 30 18:27:56 2025 +0800 crypto: hisilicon/zip - add lz4 and lz77_only to algorithm sysfs The current hisilicon zip supports the new algorithms lz77_only and lz4. To enable user space to recognize the new algorithm support, add lz77_only and lz4 to the sysfs. Users can now use the new algorithms through uacce. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 35c5097f737a164b3afe23d07698db95061f0db8 Author: Herbert Xu Date: Sat Aug 30 16:52:12 2025 +0800 crypto: ti - Enable compile testing for dthev2 Allow ti dthev2 driver to be compile-tested. Signed-off-by: Herbert Xu Acked-by: T Pratham Signed-off-by: Herbert Xu commit 56e6f77ebd31250757ffbdcbd9baa78ab27895a8 Author: Herbert Xu Date: Sat Aug 30 16:39:15 2025 +0800 crypto: hisilicon/sec2 - Fix false-positive warning of uninitialised qp_ctx Fix the false-positive warning of qp_ctx being unitialised in sec_request_init. The value of ctx_q_num defaults to 2 and is guaranteed to be non-zero. Thus qp_ctx is always initialised. However, the compiler is not aware of this constraint on ctx_q_num. Restructure the loop so that it is obvious to the compiler that ctx_q_num cannot be zero. Signed-off-by: Herbert Xu Reviewed-by: Longfang Liu Signed-off-by: Herbert Xu commit 1544344563376b2a2ae2af5af1db00d6410c18e0 Author: Menglong Dong Date: Fri Aug 29 15:28:44 2025 +0800 rhashtable: Use __always_inline instead of inline Sometimes, the compiler is not clever enough to inline the rhashtable_lookup() for us, even if the "obj_cmpfn" and "key_len" in params is const. This can introduce more overhead. Therefore, use __always_inline for the rhashtable. Signed-off-by: Menglong Dong Signed-off-by: Herbert Xu commit ab315f7288b75c289cf4a81d18d6b21e13022364 Author: Zhang Enpei Date: Wed Aug 27 15:52:36 2025 +0800 crypto: caam - switch to use devm_kmemdup_array() Use devm_kmemdup_array() to avoid multiplication or possible overflows. Signed-off-by: Zhang Enpei Signed-off-by: Herbert Xu commit 8979744aca8096ee5072798dfc1181606919b35d Author: Harsh Jain Date: Mon Aug 25 12:46:59 2025 +0530 crypto: xilinx - Add TRNG driver for Versal Add True Random Number Generator(TRNG) driver for Versal platform. Co-developed-by: Mounika Botcha Signed-off-by: Mounika Botcha Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 9de9040ffc6a3c616a0b4c13c7d4d1c2778cb6ee Author: Mounika Botcha Date: Mon Aug 25 12:46:58 2025 +0530 dt-bindings: crypto: Add node for True Random Number Generator Add TRNG node compatible string and reg properities. Signed-off-by: Mounika Botcha Signed-off-by: Harsh Jain Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 19591f7e781fd1e68228f5b3bee60be6425af886 Author: Eric Biggers Date: Fri Sep 5 20:59:13 2025 -0700 fscrypt: use HMAC-SHA512 library for HKDF For the HKDF-SHA512 key derivation needed by fscrypt, just use the HMAC-SHA512 library functions directly. These functions were introduced in v6.17, and they provide simple and efficient direct support for HMAC-SHA512. This ends up being quite a bit simpler and more efficient than using crypto/hkdf.c, as it avoids the generic crypto layer: - The HMAC library can't fail, so callers don't need to handle errors - No inefficient indirect calls - No inefficient and error-prone dynamic allocations - No inefficient and error-prone loading of algorithm by name - Less stack usage Benchmarks on x86_64 show that deriving a per-file key gets about 30% faster, and FS_IOC_ADD_ENCRYPTION_KEY gets nearly twice as fast. The only small downside is the HKDF-Expand logic gets duplicated again. Then again, even considering that, the new fscrypt_hkdf_expand() is only 7 lines longer than the version that called hkdf_expand(). Later we could add HKDF support to lib/crypto/, but for now let's just do this. Link: https://lore.kernel.org/r/20250906035913.1141532-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c6142e1913de563ab772f7b0e4ae78d6de9cc5b1 Merge: 377373d6880365 a76f26f7a81e5a Author: Jakub Kicinski Date: Fri Sep 5 19:03:41 2025 -0700 Merge branch '10g-qxgmii-for-aqr412c-felix-dsa-and-lynx-pcs-driver' Vladimir Oltean says: ==================== 10G-QXGMII for AQR412C, Felix DSA and Lynx PCS driver Introduce the first user of the "10g-qxgmii" phy-mode, since its introduction from commit 5dfabcdd76b1 ("dt-bindings: net: ethernet-controller: add 10g-qxgmii mode"). The arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso already exists upstream, but has phy-mode = "usxgmii", which comes from the fact that the AQR412(C) PHY does not distinguish between the two modes. Yet, the distinction is crucial for the upcoming SerDes driver for the LS1028A platform. The series is comprised of: - preliminary patches to the Lynx PCS and Felix DSA driver which accept the phy-mode and treat it like "usxgmii" - an ad-hoc whitelisting mechanism in the Aquantia PHY driver based on firmware version, which was agreed upon with Marvell, and which serves as "detection" - in-band auto-negotiation capability reporting and configuration. This makes sure this feature is enabled in the PHY, because the Lynx PCS only works with USXGMII/10G-QXGMII in-band autoneg enabled. Notably, it lacks a device tree update, which will come later, but should not be strictly necessary. The expectation is for the Aquantia PHY driver to pick up "10g-qxgmii" with existing device trees as well, which it does, except for the slightly confusing "configuring for inband/usxgmii link mode" initial message. This changes to "configuring for inband/10g-qxgmii link mode" once phylink gets a chance to pick up the phydev->interface in its pl->link_config.interface. $ ip link set swp3 up mscc_felix 0000:00:00.5 swp3: configuring for inband/usxgmii link mode mscc_felix 0000:00:00.5 swp3: phylink_mac_config: mode=inband/usxgmii/none adv=0000000,00000000,00008000,0002606c pause=04 mscc_felix 0000:00:00.5 swp3: phylink_phy_change: phy interface 10g-qxgmii link 0 mscc_felix 0000:00:00.5 swp3: phylink_phy_change: phy interface 10g-qxgmii link 1 mscc_felix 0000:00:00.5 swp3: phylink_mac_config: mode=inband/10g-qxgmii/none adv=0000000,00000000,00008000,0002606c pause=00 mscc_felix 0000:00:00.5 swp3: Link is Up - 2.5Gbps/Full - flow control off $ ip link set swp3 down mscc_felix 0000:00:00.5 swp3: phylink_phy_change: phy interface 10g-qxgmii link 0 mscc_felix 0000:00:00.5 swp3: Link is Down $ ip link set swp3 up mscc_felix 0000:00:00.5 swp3: configuring for inband/10g-qxgmii link mode mscc_felix 0000:00:00.5 swp3: phylink_mac_config: mode=inband/10g-qxgmii/none adv=0000000,00000000,00008000,0002606c pause=04 mscc_felix 0000:00:00.5 swp3: phylink_phy_change: phy interface 10g-qxgmii link 0 mscc_felix 0000:00:00.5 swp3: phylink_phy_change: phy interface 10g-qxgmii link 1 mscc_felix 0000:00:00.5 swp3: Link is Up - 2.5Gbps/Full - flow control off ==================== Link: https://patch.msgid.link/20250903130730.2836022-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit a76f26f7a81e5adc76b5c3bcb580b7dc1c7d0451 Author: Vladimir Oltean Date: Wed Sep 3 16:07:30 2025 +0300 net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C) The quad port PHYs (AQR4*) have 4 system interfaces, and some of them, like AQR412C, can be used with a special firmware provisioning which multiplexes all ports over a single host-side SerDes lane. The protocol used over this lane is Cisco 10G-QXGMII feature, or "MUSX", as Aquantia seems to call it. One such example is the AQR412C PHY from the NXP SPF-30841 10G-QXGMII add-in card, which uses this firmware file: https://github.com/nxp-qoriq/qoriq-firmware-aquantia/blob/master/AQR-G3_v4.3.C-AQR_NXP_SPF-30841_MUSX_ID40019_VER1198.cld There seems to be no disagreement, including from Marvell FAE, that 10G-QXGMII is reported to the host over MDIO as USXGMII and indistinguishable from it. This includes the registers from the provisioning based on which the firmware configures a single system interface (lane C in the case of SPF-30841) to multiplex all ports - they are also only accessible from the firmware, or over I2C (?!). However, the Linux MAC and especially SerDes drivers may need to know if it is using 1 port per lane (USXGMII) or 4 ports per lane (10G-QXGMII). In the downstream Layerscape SDK we have previously implemented a simpler scheme where for certain PHY interface modes, we trust the device tree and never let the PHY driver overwrite phydev->interface: https://github.com/nxp-qoriq/linux/commit/862694a4961db590c4d8a5590b84791361ca773d but for upstream, a nicer detection method is implemented, where although we can not distinguish USXGMII from 10G-QXGMII per se, we create a whitelist of firmware fingerprints for which USXGMII is translated into 10G-QXGMII. At the time of writing, it is expected that this should only happen for the NXP SPF-30841 card, although extending for more is trivial - just uncomment the phydev_dbg() in aqr_build_fingerprint(). An advantage of this method is that it doesn't strictly require updates to arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso, since the PHY driver will transition from "usxgmii" to "10g-qxgmii". All aqr_translate_interface() callers have also previously called aqr107_probe(), so dereferencing phydev->priv is safe. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit dda916111e296329fd6c8f69dcb19d690660d47a Author: Vladimir Oltean Date: Wed Sep 3 16:07:29 2025 +0300 net: phy: aquantia: create and store a 64-bit firmware image fingerprint Some PHY features cannot be queried through MDIO registers and require alternative driver detection methods. One such feature is 10G-QXGMII (4 ports of up to 2.5G multiplexed over a single SerDes lane), or "MUSX" as it is called by Aquantia/Marvell. The firmware has provisioning to modify some registers which seem inaccessible for read or write over MDIO, which configure an internal mux for MUSX. To the host, over MDIO, the system interface appears indistinguishable from single-port-per-lane USXGMII. Marvell FAE Ziang You recommended a detection method for this feature based on a tuple which should hopefully identify the firmware build uniquely. Most of the tuple items are already printed by aqr107_chip_info(), and an extra set is the misc ID (reg 1.c41d) and the misc version (reg 1.c41e). These are auto-generated by the Marvell firmware tool for formal builds, and should be unique (not my claim). In addition, at least for the builds provided to NXP and redistributed here: https://github.com/nxp-qoriq/qoriq-firmware-aquantia/tree/master these registers are part of the name, for example in AQR-G3_v4.3.C-AQR_NXP_SPF-30841_MUSX_ID40019_VER1198.cld, reg 1.c41d will contain 40019 and reg 1.c41e will contain 1198. Note that according to commit 43429a0353af ("net: phy: aquantia: report PHY details like firmware version"), the "chip may be functional even w/o firmware image." In that case, we can't construct a fingerprint and it will remain zero. That shouldn't imact the use case though. Dereferencing phydev->priv should be ok in all cases: all aqr_gen1_config_init() callers have also previously called aqr107_probe(). Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5d59109d47c00e3e98aba612529b3871e69efb9d Author: Vladimir Oltean Date: Wed Sep 3 16:07:28 2025 +0300 net: phy: aquantia: report and configure in-band autoneg capabilities The Global System Configuration registers for each media side link speed have bit 3 which controls auto-negotiation for the system interface. Since bits 2:0 of the same register indicate the SerDes protocol for the same system interface, it makes sense to filter these registers for the SerDes protocol matching phydev->interface, and to read/write the auto-negotiation bit. However, experimentally, USXGMII in-band auto-negotiation is unaffected by this bit, and instead reacts to bit 3 of register 4.C441 (PHY XS Transmit Reserved Vendor Provisioning 2). Both the Global System Configuration as well as the aforementioned register 4.C441 are documented as PD (Provisioning Defaults), i.e. each PHY firmware may provision its own values. I was initially planning to only read these values and not support changing them (instead just the MAC PCS reconfigures itself, if it can). But there is one problem: Linux expects that the in-band capability is configured the same for all speeds where a given SerDes protocol is used. I was going to add logic that detects mismatched vendor provisioning (in-band autoneg enabled for speed X, disabled for speed Y) and warn about it and return 0 (unknown capabilities). Funnily enough, there is already a known instance where speed 2500 has "autoneg 1" and the lower speeds have "autoneg 0": https://lore.kernel.org/netdev/aJH8n0zheqB8tWzb@FUE-ALEWI-WINX/ I don't think it's worth fighting the battle with inconsistent firmware images built by Aquantia/Marvell, and reporting that to the user, when we have the ability to modify these fields to values that make sense to us. We see the same situation with all the aqr*_get_features() functions which fix up nonsensical supported link modes. Furthermore, altering the in-band auto-negotiation setting can be considered a minor change, compared to changing the SerDes protocol in its entirety, for which we are still not prepared. Testing was done on: - AQR107 (Gen2) in USXGMII mode, as found on the NXP LX2160A-RDB. - AQR112 (Gen3) in USXGMII mode, as found on the NXP SCH-30842 riser card, plugged into LS1028A-QDS. - AQR412C (Gen3) in 10G-QXGMII mode, as found on the NXP SCH-30841 riser card, plugged into the LS1028A-QDS. - AQR115 (Gen4) in SGMII mode, as found on the NXP LS1046A-RDB rev E. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7b0376d0e06358592de4997931a657683d0fa3df Author: Vladimir Oltean Date: Wed Sep 3 16:07:27 2025 +0300 net: phy: aquantia: print global syscfg registers Sometimes people with unknown firmware provisioning post on the mailing lists asking for support. The information collected by aqr_gen2_read_global_syscfg() is sufficiently important to warrant a phydev_dbg() that can easily be turned into a verbose print by the system owner in case some debugging is needed. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6f616757dd306fce4b55131df23737732e347d8f Author: Vladimir Oltean Date: Wed Sep 3 16:07:26 2025 +0300 net: dsa: felix: support phy-mode = "10g-qxgmii" The "usxgmii" phy-mode that the Felix switch ports support on LS1028A is not quite USXGMII, it is defined by the USXGMII multiport specification document as 10G-QXGMII. It uses the same signaling as USXGMII, but it multiplexes 4 ports over the link, resulting in a maximum speed of 2.5G per port. This change is needed in preparation for the lynx-10g SerDes driver on LS1028A, which will make a more clear distinction between usxgmii (supported on lane 0) and 10g-qxgmii (supported on lane 1). These protocols have their configuration in different PCCR registers (PCCRB vs PCCR9). Continue parsing and supporting single-port-per-lane USXGMII when found in the device tree as usual (because it works), but add support for 10G-QXGMII too. Using phy-mode = "10g-qxgmii" will be required when modifying the device trees to specify a "phys" phandle to the SerDes lane. The result when the "phys" phandle is present but the phy-mode is wrong is undefined. The only PHY driver in known use with this phy-mode, AQR412C, will gain logic to transition from "usxgmii" to "10g-qxgmii" in a future change. Prepare the driver by also setting PHY_INTERFACE_MODE_10G_QXGMII in supported_interfaces when PHY_INTERFACE_MODE_USXGMII is there, to prevent breakage with existing device trees. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 76cd8a2ea98a3d779748ec12744aaed0d85fba7b Author: Vladimir Oltean Date: Wed Sep 3 16:07:25 2025 +0300 net: pcs: lynx: support phy-mode = "10g-qxgmii" This is a SerDes protocol with 4 ports multiplexed over a single SerDes lane, each port capable of 10/100/1000/2500. It is used on LS1028A lane 1, connected to the 4 switch ports. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250903130730.2836022-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 377373d6880365310ed0df5dfecf55618b57fb71 Merge: 13a94444fbd668 0c9fbb38e2a96a Author: Jakub Kicinski Date: Fri Sep 5 18:44:43 2025 -0700 Merge branch 'net-stmmac-correctly-populate-ptp_clock_ops-getcrosststamp' Russell King says: ==================== net: stmmac: correctly populate ptp_clock_ops.getcrosststamp While reviewing code in the stmmac PTP driver, I noticed that the getcrosststamp() method is always populated, irrespective of whether it is implemented or not by the stmmac platform specific glue layer. Where a platform specific glue layer does not implement it, the core stmmac driver code returns -EOPNOTSUPP. However, the PTP clock core code uses the presence of the method in ptp_clock_ops to determine whether this facility should be advertised to userspace (see ptp_clock_getcaps()). Moreover, the only platform glue that implements this method is the Intel glue, and for it not to return -EOPNOTSUPP, the CPU has to support X86_FEATURE_ART. This series updates the core stmmac code to only provide the getcrosststamp() method in ptp_clock_ops when the platform glue code provides an implementation, and then updates the Intel glue code to only provide its implementation when the CPU has the necessary X86_FEATURE_ART feature. ==================== Link: https://patch.msgid.link/aLhJ8Gzb0T2qpXBE@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0c9fbb38e2a96ae66c588c95a184183cf09f300c Author: Russell King (Oracle) Date: Wed Sep 3 15:00:56 2025 +0100 net: stmmac: intel: only populate plat->crosststamp when supported To allow the ptp_chardev code to correctly detect whether crosststamps are supported, we need to conditionally populate the .getcrosststamp() method. As the previous patch implements that functionality by detecting whether the platform glue provides a crosststamp() method, arrange for the dwmac-intel code to only populate this if the X86 ART feature is present, rather than testing for it at runtime in intel_crosststamp(). This reflects what other x86 PTP clock drivers do, e.g. ice_ptp_set_funcs_e830(), e1000e_ptp_init(), idpf_ptp_set_caps() etc. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uto2i-00000001seA-0lxv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bb427fb839de80394f6d2c8a969b8ebf9b100d52 Author: Russell King (Oracle) Date: Wed Sep 3 15:00:51 2025 +0100 net: stmmac: ptp: conditionally populate getcrosststamp() method drivers/char/ptp_chardev.c::ptp_clock_getcaps() uses the presence of the getcrosststamp() method to indicate to userspace whether crosststamping is supported or not. Therefore, we should not provide this method unless it is functional. Only set this method pointer in stmmac_ptp_register() if the platform glue provides the necessary functionality. This does not mean that it will be supported (see intel_crosststamp(), which is the only implementation that may have support) but at least we won't be suggesting that it is supported on many platforms where there is no hope. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1uto2d-00000001se4-0JSY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 13a94444fbd66865850533c19c1c9b6fd7a888ae Author: Heiner Kallweit Date: Thu Sep 4 22:26:58 2025 +0200 net: fman: clean up included headers Both headers aren't used in this source code file. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/a6c502bc-1736-4bab-98dc-7e194d490c19@gmail.com Signed-off-by: Jakub Kicinski commit 49590e493b63dd394fc33834287a8bd3594d728b Merge: 8c0b9ed2401b9b ae52c3e846e180 Author: Jakub Kicinski Date: Fri Sep 5 18:16:09 2025 -0700 Merge branch 'sh_eth-pm-related-cleanups' Geert Uytterhoeven says: ==================== sh_eth: PM-related cleanups This patch series contains various cleanups related to power management for the Renesas SH Ethernet driver, as used on Renesas SH, ARM32, and ARM64 platforms. This has been tested on various SoCs (R-Mobile A1, RZ/A1H, RZ/A2M, R-Car H1, R-Car M2-W). ==================== Link: https://patch.msgid.link/cover.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit ae52c3e846e1800f7798a72706e093b97822eff6 Author: Geert Uytterhoeven Date: Thu Sep 4 17:18:58 2025 +0200 sh_eth: Use async pm_runtime_put() There is no stringent need to power down the device immediately after a register read, or after a failed open. Relax power down handling by replacing calls to synchronous pm_runtime_put_sync() by calls to asynchronous pm_runtime_put(). Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Link: https://patch.msgid.link/77562617360e30a47746e53e392905ea312a2f97.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 3406114a303ea37a92dc32be0e75095a78e7a92b Author: Geert Uytterhoeven Date: Thu Sep 4 17:18:57 2025 +0200 sh_eth: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas SuperH Ethernet driver from an open-coded dev_pm_ops structure to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the checks for CONFIG_PM and CONFIG_PM_SLEEP without impacting code size, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Link: https://patch.msgid.link/ee4def57eb68dd2c32969c678ea916d2233636ed.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 86e6257192c8346caa6ebe03e5ec2b85eb8308ab Author: Geert Uytterhoeven Date: Thu Sep 4 17:18:56 2025 +0200 sh_eth: Remove dummy Runtime PM callbacks Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Link: https://patch.msgid.link/ab2a8bb51eb7d02426f4072c27523c8f41ac1ad4.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 8c0b9ed2401b9b3f164c8c94221899a1ace6e9ab Author: Stanislav Fomichev Date: Thu Sep 4 11:27:10 2025 -0700 selftests: ncdevmem: don't retry EFAULT devmem test fails on NIPA. Most likely we get skb(s) with readable frags (why?) but the failure manifests as an OOM. The OOM happens because ncdevmem spams the following message: recvmsg ret=-1 recvmsg: Bad address As of today, ncdevmem can't deal with various reasons of EFAULT: - falling back to regular recvmsg for non-devmem skbs - increasing ctrl_data size (can't happen with ncdevmem's large buffer) Exit (cleanly) with error when recvmsg returns EFAULT. This should at least cause the test to cleanup its state. Signed-off-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250904182710.1586473-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 43a42b85162aa1430556d58bbde05b54786a2c5a Author: Heiner Kallweit Date: Thu Sep 4 08:08:18 2025 +0200 net: phy: fixed_phy: remove link gpio support The only user of fixed_phy gpio functionality was here: arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts Support for the switch on this board was migrated to phylink (DSA - mv88e6xxx) years ago, so the functionality is unused now. Therefore remove it. Note: There is a very small risk that there's out-of-tree users who use link gpio with a switch chip not handled by DSA. However we care about in-tree device trees only. Suggested-by: Russell King (Oracle) Signed-off-by: Heiner Kallweit Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/75295a9a-e162-432c-ba9f-5d3125078788@gmail.com Signed-off-by: Jakub Kicinski commit 8c5795fe55278fa6a656bf4a0398fb22d5079298 Author: Hans de Goede Date: Sun Aug 31 14:29:41 2025 +0200 power: supply: Add new Intel Dollar Cove TI battery driver Intel has 2 completely different "Dollar Cove" PMICs for its Bay Trail / Cherry Trail SoCs. One is made by X-Powers and is called the AXP288. The AXP288's builtin charger and fuel-gauge functions are already supported by the axp288_charger / axp288_fuel_gauge drivers. The other "Dollar Cove" PMIC is made by TI and does not have any clear TI denomination, its MFD driver calls it the "Intel Dollar Cove TI PMIC". The Intel Dollar Cove TI PMIC comes with a coulomb-counters with limited functionality which is intended to work together with an always on micro-controller monitoring it for fuel-gauge functionality. Most devices with the Dollar Cove TI PMIC have full-featured fuel-gauge functionality exposed through ACPI with the information coming from either the embedded-controller or a separate full-featured fuel-gauge IC. But some designs lack this, add a battery-monitoring driver using the PMIC's coulomb-counter combined with the adc-battery-helper for capacity estimation for these designs. Register definitions were taken from kernel/drivers/platform/x86/dc_ti_cc.c from the Acer A1-840 Android kernel source-code archive named: "App. Guide_Acer_20151221_A_A.zip" which is distributed by Acer from the Acer A1-840 support page: https://www.acer.com/us-en/support/product-support/A1-840/downloads Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250831122942.47875-6-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 926b144366c589a0c0c471d02a71590ed24284e0 Author: Hans de Goede Date: Sun Aug 31 14:29:40 2025 +0200 power: supply: adc-battery-helper: Add support for optional charge_finished GPIO Charger ICs often have a status pin which indicates when the charger has finished charging the battery. Sometimes the status of this pin can be read over a GPIO. Add support for optionally reading a charge-finished GPIO and when available use this to determine when to return POWER_SUPPLY_STATUS_FULL. Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250831122942.47875-5-hansg@kernel.org Signed-off-by: Sebastian Reichel commit eede3f72a9658a3c82725ed36723d3189a91b3e5 Author: Hans de Goede Date: Sun Aug 31 14:29:39 2025 +0200 power: supply: ug3105_battery: Put FG in standby on remove and shutdown Put the fuel-gauge in standby mode when the driver is unbound and on system shutdown. This avoids unnecessary battery drain when the system is off. Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250831122942.47875-4-hansg@kernel.org Signed-off-by: Sebastian Reichel commit dcf1e7b73797399f8706226c7ff6ad8f18634db4 Author: Hans de Goede Date: Sun Aug 31 14:29:38 2025 +0200 power: supply: ug3105_battery: Switch to adc-battery-helper Switch ug3105_battery to using the new adc-battery-helper, since the helper's algorithms are a copy of the replaced ug3105_battery code this should not cause any functional differences. Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250831122942.47875-3-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 6a93f54333979c2948e9c1e71ea0b377b486a3f5 Author: Hans de Goede Date: Sun Aug 31 14:29:37 2025 +0200 power: supply: Add adc-battery-helper The TI PMIC used on some Intel Bay/Cherry Trail systems has some builtin fuel-gauge functionality which just like the UG3105 fuel-gauge is not a full featured autonomous fuel-gauge. These fuel-gauges offer accurate current and voltage measurements but their coulomb-counters are intended to work together with an always on micro-controller monitoring the fuel-gauge. Add an adc-battery-helper offering open-circuit-voltage (ocv) and through that capacity estimation for devices where such limited functionality fuel-gauges are exposed directly to Linux. This is a copy of the existing UG3105 estimating code, generalized so that it can be re-used in other drivers. The next commit will replace the UG3105 driver's version of this code with using the adc-battery-helper. The API has been designed for easy integration into existing power-supply drivers. For example this functionality might also be a useful addition to the generic-adc-battery driver. The requirement of needing the adc_battery_helper struct to be the first member of a battery driver's data struct is not ideal. This is a compromise which is necessary to allow directly using the helper's get_property(), external_power_changed() and suspend()/resume() functions as power-supply / suspend-resume callbacks. Reviewed-by: Linus Walleij Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250831122942.47875-2-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 74139a64e8cedb6d971c78d5d17384efeced1725 Author: Miaoqian Lin Date: Tue Sep 2 15:59:43 2025 +0800 ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init Add missing of_node_put() calls to release device node references obtained via of_parse_phandle(). Fixes: 06ee7a950b6a ("ARM: OMAP2+: pm33xx-core: Add cpuidle_ops for am335x/am437x") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20250902075943.2408832-1-linmq006@gmail.com Signed-off-by: Kevin Hilman commit 2fd653b9bb5aacec5d4c421ab290905898fe85a2 Author: Mario Limonciello (AMD) Date: Fri Sep 5 10:36:27 2025 -0500 drm/amd/display: Drop dm_prepare_suspend() and dm_complete() [Why] dm_prepare_suspend() was added in commit 50e0bae34fa6b ("drm/amd/display: Add and use new dm_prepare_suspend() callback") to allow display to turn off earlier in the suspend sequence. This caused a regression that HDMI audio sometimes didn't work properly after resume unless audio was playing during suspend. [How] Drop dm_prepare_suspend() callback. All code in it will still run during dm_suspend(). Also drop unnecessary dm_complete() callback. dm_complete() was used for failed prepare and also for any case of successful resume. The code in it already runs in dm_resume(). This change will introduce more time that the display is turned on during suspend sequence. The compositor can turn it off sooner if desired. Cc: Harry Wentland Reported-by: Przemysław Kopa Closes: https://lore.kernel.org/amd-gfx/1cea0d56-7739-4ad9-bf8e-c9330faea2bb@kernel.org/T/#m383d9c08397043a271b36c32b64bb80e524e4b0f Reported-by: Kalvin Closes: https://github.com/alsa-project/alsa-lib/issues/465 Closes: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4809 Fixes: 50e0bae34fa6b ("drm/amd/display: Add and use new dm_prepare_suspend() callback") Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 64cc12f9798f146f2c616db4885d653741d3b3c1 Author: Dan Carpenter Date: Thu Sep 4 21:58:49 2025 +0300 drm/amdgpu: Fix error codes if copy_to_user() fails The copy_to_user() function returns the number of bytes that it wasn't able to copy, but we should return -EFAULT to the user. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Fixes: f9db1fc52ceb ("drm/amdgpu: Add ioctl to get all gem handles for a process") Reviewed-By: David Francis Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit b7c5334af69d359fcd7a39ed409a08138900ec18 Author: Alex Deucher Date: Tue Sep 2 12:45:34 2025 -0400 drm/radeon: use dev_warn_once() in CS parsers Older GPUs did not support memory protection, so the kernel driver would validate the command submissions (CS) from userspace to avoid the GPU accessing any memory it shouldn't. Change any error messages in that validation to dev_warn_once() to avoid spamming the kernel log in the event of a bad CS. If users see any of these messages they should report them to the user space component, which in most cases is mesa (https://gitlab.freedesktop.org/mesa/mesa/-/issues). Cc: Borislav Petkov (AMD) Acked-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250829171655.GBaLHgh3VOvuM1UfJg@fat_crate.local Signed-off-by: Alex Deucher commit 86b6f02a6d504d035f617d3d5627d2a2099877d4 Author: Srinivasan Shanmugam Date: Sun Aug 31 15:16:04 2025 +0530 drm/amdgpu: Correct misnamed function in amdgpu_gem.c The header comment above amdgpu_gem_list_handles_ioctl referenced drm_amdgpu_gem_list_handles_ioctl. Update the comment to reflect the actual function identifier to avoid misleading prototype warnings. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:1106: warning: expecting prototype for drm_amdgpu_gem_list_handles_ioctl(). Prototype was for amdgpu_gem_list_handles_ioctl() instead Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 476a4e10a3361509b1e436ec49e9a2896052a4b6 Author: Sunil Khatri Date: Mon Aug 18 12:51:25 2025 +0530 drm/amdgpu: print root PD address in PDE format instead of GPU Print PD address of VM root instead of GPU address in the debugfs. On modern GPU's this is what UMR tool expects in the registers as well. Fixes: 719b378d3718 ("drm/amdgpu: add debugfs support for VM pagetable per client") Signed-off-by: Sunil Khatri Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit aba4ead2690ed0bd529fcfeca22de04468f1bad8 Author: Taimur Hassan Date: Fri Aug 29 09:45:27 2025 -0500 drm/amd/display: Promote DC to 3.2.349 This version brings along following updates: - Disable stutter when programming watermarks on dcn32 - Fix pbn_div Calculation Error - Correct sequences and delays for DCN35 PG & RCG - Define interfaces for hubbub perfmance monitoring support - Extend to read eDP general capability 2 - Indicate when custom brightness curves are in use - Dont wait for pipe update during medupdate/highirq - Add HDCP retry_limit control parameter Acked-by: Tom Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 12cdfb61b32a7be581ec5932e0b6a482cb098204 Author: Fangzhi Zuo Date: Tue Apr 8 15:11:43 2025 -0400 drm/amd/display: Fix pbn_div Calculation Error [Why] dm_mst_get_pbn_divider() returns value integer coming from the cast from fixed point, but the casted integer will then be used in dfixed_const to be multiplied by 4096. The cast from fixed point to integer causes the calculation error becomes bigger when multiplied by 4096. That makes the calculated pbn_div value becomes smaller than it should be, which leads to the req_slot number becomes bigger. Such error is getting reflected in 8k30 timing, where the correct and incorrect calculated req_slot 62.9 Vs 63.1. That makes the wrong calculation failed to light up 8k30 after a dock under HBR3 x 4. [How] Restore the accuracy by keeping the fraction part calculated for the left shift operation. Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1bde5584e297921f45911ae874b0175dce5ed4b5 Author: Ovidiu Bunea Date: Mon Aug 25 14:45:33 2025 -0400 drm/amd/display: Correct sequences and delays for DCN35 PG & RCG [why] The current PG & RCG programming in driver has some gaps and incorrect sequences. [how] Added delays after ungating clocks to allow ramp up, increased polling to allow more time for power up, and removed the incorrect sequences. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Charlene Liu Signed-off-by: Ovidiu Bunea Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 3b14fe98939b01aa72707bc3c2617de319839a65 Author: Roman Li Date: Thu Aug 21 15:43:31 2025 -0400 drm/amd/display: Refine error message for vblank init failure [Why] The error message "failed to initialize sw for display support" is used for both DRM device and vblank initialization failures, making it difficult to identify the specific failure during troubleshooting. [How] Update the vblank initialization error message to "failed to initialize vblank for display support" to distinguish it from the DRM device init failure. Reviewed-by: Aurabindo Pillai Signed-off-by: Roman Li Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f74291c1de320c3aa36f053280f30ebdc122576b Author: Wenjing Liu Date: Wed Aug 13 16:18:53 2025 -0400 drm/amd/display: Update dchubbub.h for hubbub perfmon support [why] dchubbub supports performance monitoring for hubbub. The interfaces define the performance monitoring events and their attributes. Reviewed-by: Alvin Lee Signed-off-by: Wenjing Liu Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 215bed54897bae6352e4850a03063739c55f7e9a Author: Allen Li Date: Mon Aug 25 14:23:14 2025 +0800 drm/amd/display: Read DPCD to obtain eDP capability information. [Why & How] Extend to read eDP general capability 2 in detect_edp_sink_caps(). Reviewed-by: Robin Chen Reviewed-by: Wenjing Liu Signed-off-by: Allen Li Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 68f3c044f37d9f50d67417fa8018d9cf16423458 Author: Mario Limonciello Date: Sun Aug 24 15:20:58 2025 -0500 drm/amd/display: Indicate when custom brightness curves are in use [Why] There is a `scale` sysfs attribute that can be used to indicate when non-linear brightness scaling is in use. As Custom brightness curves work by linear interpolation of points the scale is no longer linear. [How] Indicate non-linear scaling when custom brightness curves in use and linear scaling otherwise. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 895b61395eefd28376250778a741f11e12715a39 Author: Ausef Yousof Date: Thu Aug 21 18:11:54 2025 -0400 drm/amd/display: dont wait for pipe update during medupdate/highirq [why&how] control flag for the wait during pipe update wait for vupdate should be set if update type is not fast or med to prevent an invalid sleep operation Reviewed-by: Alvin Lee Signed-off-by: Ausef Yousof Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c2223b26869dde3f7610b5c9766bd5322cfa908f Author: Cruise Hung Date: Fri Aug 22 15:45:03 2025 +0800 drm/amd/display: Add link index in AUX and dpms [Why & How] Add the link index in DP AUX transfer and DPMS functions. Reviewed-by: Wenjing Liu Signed-off-by: Cruise Hung Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9fd2da71c301184d98fe37674ca8d017d1ce6600 Author: Oleh Kuzhylnyi Date: Mon Aug 18 13:19:29 2025 +0200 drm/amd/display: Add HDCP policy control [Why] DM should be able to control HDCP retry limit via configurable parameter. [How] Expose a retry_limit parameter for controlling the maximum number of retries and lift the hardcode out to DM. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aric Cyr Signed-off-by: Oleh Kuzhylnyi Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d6fa8026617896c23cb165f09f1c1d32fe22a3df Author: Lijo Lazar Date: Thu Aug 28 12:50:09 2025 +0530 drm/amdgpu: Add vbios build number interface Fetch VBIOS build number from atom rom image. Add a sysfs interface to read the build number. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit c5f4fb40584ee591da9fa090c6f265d11cbb1acf Author: Fangzhi Zuo Date: Thu Sep 4 15:13:51 2025 -0400 drm/amd/display: Disable DPCD Probe Quirk Disable dpcd probe quirk to native aux. Signed-off-by: Fangzhi Zuo Reviewed-by: Imre Deak Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4500 Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250904191351.746707-1-Jerry.Zuo@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit b842b994ed0678faf73907a67fb13afcd5e50509 Author: Lijo Lazar Date: Thu Aug 28 10:02:35 2025 +0530 drm/amd/pm: Add caching for SystemMetrics table Implement caching separately for SystemMetrics table from PMFW. The same table could be used for multiple interfaces. Hence, cache it internally to avoid multiple queries to the firmware. For SystemMetrics table, 5ms cache interval is sufficient. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit cf32515a70618c0fb2319bd4a855f4d9447940a8 Author: Yang Wang Date: Wed Sep 3 14:29:12 2025 +0800 drm/amd/pm: refine amdgpu pm sysfs node error code v1: Returns different error codes based on the scenario to help the user app understand the AMDGPU device status when an exception occurs. v2: change -NODEV to -EBUSY. Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit bddf30944d42e1fb7f105fad4e5f9e7e86ea871e Author: Qianfeng Rong Date: Thu Sep 4 22:58:00 2025 +0800 drm/amd/pm: use int type to store negative error codes Use int instead of uint32_t for 'ret' variable to store negative error codes or zero returned by other functions. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit a055658793ddce9f2554c0d77e4b404cd0ac4107 Author: Liao Yuanhong Date: Thu Sep 4 19:32:00 2025 +0800 drm/radeon/pm: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 220c7a21cb0a570fd0a44ce71e2e4a3a5f342fde Author: Liao Yuanhong Date: Thu Sep 4 19:31:59 2025 +0800 drm/radeon/radeon_legacy_encoders: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 60d6f01b5a7de4f1475774cc807840a002d601d6 Author: Liao Yuanhong Date: Thu Sep 4 19:31:58 2025 +0800 drm/radeon/dpm: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 7a50377cea5f1f39a91d64eb8c522ee760c91b56 Author: Liao Yuanhong Date: Thu Sep 4 19:31:57 2025 +0800 drm/radeon/atom: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 9ab06ab36d4a84d087e995233fe10d5d9496f908 Author: Liao Yuanhong Date: Thu Sep 4 16:21:13 2025 +0800 drm/amd/pm/powerplay/smumgr: remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Swap variable positions on either side of '==' to enhance readability. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit fa740b115b467f48128c727cd4e19a2b7345a18a Author: Liao Yuanhong Date: Thu Sep 4 16:21:12 2025 +0800 drm/amd/pm/powerplay/hwmgr/ppatomctrl: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Swap variable positions on either side of '!=' to enhance readability. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit db51c5d98b03940d865002adba8a16939dc4c26a Author: Liao Yuanhong Date: Thu Sep 4 16:21:11 2025 +0800 amdgpu/pm/legacy: remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 53c271b9a06ca307c2ce6994877d8d084d031962 Author: Liao Yuanhong Date: Thu Sep 4 15:10:15 2025 +0800 drm/amd/display: Remove redundant ternary operators For ternary operators in the form of "a ? true : false" or "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 54d18bc6003fad33eb901aa5fa3425449e53d5aa Author: Jesse.Zhang Date: Thu Sep 4 09:54:36 2025 +0800 drm/amdgpu/userq: add a detect and reset callback Add a detect and reset callback and add the implementation for mes. The callback will detect all hung queues of a particular ip type (e.g., GFX or compute or SDMA) and reset them. v2: increase reset counter and set fence force completion v3: Removed userq_mutex in mes_userq_detect_and_reset since the driver holds it when calling Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit cbda64f3f58027f68211dda8ea94d52d7e493995 Author: Qianfeng Rong Date: Thu Sep 4 20:36:46 2025 +0800 drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() Use negative error code -EINVAL instead of positive EINVAL in the default case of svm_ioctl() to conform to Linux kernel error code conventions. Fixes: 42de677f7999 ("drm/amdkfd: register svm range") Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 Author: Alex Deucher Date: Fri Jun 27 10:25:09 2025 -0400 drm/amdgpu: don't enable SMU on cyan skillfish Cyan skillfish uses different SMU firmware. Signed-off-by: Alex Deucher commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 Author: Alex Deucher Date: Fri Jun 27 10:21:16 2025 -0400 drm/amdgpu: add support for cyan skillfish gpu_info Some SOCs which are part of the cyan skillfish family rely on an explicit firmware for IP discovery. Add support for the gpu_info firmware. Signed-off-by: Alex Deucher commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 Author: Alex Deucher Date: Fri Jun 27 10:18:46 2025 -0400 drm/amdgpu: add support for cyan skillfish without IP discovery For platforms without an IP discovery table. Signed-off-by: Alex Deucher commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c Author: Alex Deucher Date: Fri Jun 27 10:12:36 2025 -0400 drm/amdgpu: add ip offset support for cyan skillfish For chips that don't have IP discovery tables. Signed-off-by: Alex Deucher commit 38ab33dbea594700c8d6cc81eec0a54e95d3eb2f Author: Srinivasan Shanmugam Date: Sun Aug 31 15:29:56 2025 +0530 drm/amdgpu: Fix function header names in amdgpu_connectors.c Align the function headers for `amdgpu_max_hdmi_pixel_clock` and `amdgpu_connector_dvi_mode_valid` with the function implementations so they match the expected kdoc style. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c:1199: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Returns the maximum supported HDMI (TMDS) pixel clock in KHz. drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c:1212: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Validates the given display mode on DVI and HDMI connectors. Fixes: 585b2f685c56 ("drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)") Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit fa7c99f04f6dd299388e9282812b14e95558ac8e Author: Yifan Zhang Date: Wed Aug 20 16:10:51 2025 +0800 amd/amdkfd: correct mem limit calculation for small APUs Current mem limit check leaks some GTT memory (reserved_for_pt reserved_for_ras + adev->vram_pin_size) for small APUs. Since carveout VRAM is tunable on APUs, there are three case regarding the carveout VRAM size relative to GTT: 1. 0 < carveout < gtt apu_prefer_gtt = true, is_app_apu = false 2. carveout > gtt / 2 apu_prefer_gtt = false, is_app_apu = false 3. 0 = carveout apu_prefer_gtt = true, is_app_apu = true It doesn't make sense to check below limitation in case 1 (default case, small carveout) because the values in the below expression are mixed with carveout and gtt. adev->kfd.vram_used[xcp_id] + vram_needed > vram_size - reserved_for_pt - reserved_for_ras - atomic64_read(&adev->vram_pin_size) gtt: kfd.vram_used, vram_needed, vram_size carveout: reserved_for_pt, reserved_for_ras, adev->vram_pin_size In case 1, vram allocation will go to gtt domain, skip vram check since ttm_mem_limit check already cover this allocation. Signed-off-by: Yifan Zhang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 89923fb7ead4fdd37b78dd49962d9bb5892403e6 Author: Geoffrey McRae Date: Thu Aug 28 22:26:22 2025 +1000 drm/amd/display: remove oem i2c adapter on finish Fixes a bug where unbinding of the GPU would leave the oem i2c adapter registered resulting in a null pointer dereference when applications try to access the invalid device. Fixes: 3d5470c97314 ("drm/amd/display/dm: add support for OEM i2c bus") Cc: Harry Wentland Reviewed-by: Alex Deucher Signed-off-by: Geoffrey McRae Signed-off-by: Alex Deucher commit 276e8beb2a0c390fdac8f11bb58d9fdf95a6d538 Author: Alex Deucher Date: Fri Apr 18 11:35:49 2025 -0400 drm/amdgpu/userq: add force completion helpers Add support for forcing completion of userq fences. This is needed for userq resets and asic resets so that we can set the error on the fence and force completion. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit c5da9e9c023893ece97855097240247a590c0d16 Author: Alex Deucher Date: Wed Apr 16 13:12:40 2025 -0400 drm/amdgpu: add user queue reset source Track resets from user queues. Reviewed-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 724471254ee09949bd99358494e8f38d016616c1 Author: Jesse.Zhang Date: Thu Sep 4 09:50:00 2025 +0800 drm/amdgpu/mes12: implement detect and reset callback Implement support for the hung queue detect and reset functionality. v2: Always use AMDGPU_MES_SCHED_PIPE Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit b28cfc8305f7f58d261d558ea699be14c03537fd Author: Jesse.Zhang Date: Thu Sep 4 09:44:51 2025 +0800 drm/amdgpu/mes11: implement detect and reset callback Implement support for the hung queue detect and reset functionality. Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 78e1222fbf0026de99420bc35c6c12931e0f36ee Author: Jesse.Zhang Date: Thu Sep 4 09:39:34 2025 +0800 drm/amdgpu/mes: add front end for detect and reset hung queue Helper function to detect and reset hung queues. MES will return an array of doorbell indices of which queues are hung and were optionally reset. v2: Clear the doorbell array before detection Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 6abd725fdfc418abdf3aae0a1b19cb483305c723 Author: Jesse.Zhang Date: Sun Aug 3 21:21:42 2025 +0800 drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 This commit implements the actual MES (Micro Engine Scheduler) suspend and resume gang operations for version 12 hardware. Previously these functions were just stubs returning success. v2: Always use AMDGPU_MES_SCHED_PIPE Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Jesse Zhang commit 27322753c8b913fba05250e7b5abb1da31e6ed23 Author: Jihed Chaibi Date: Sat Aug 30 23:59:57 2025 +0200 ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property The dtbs_check validation for am335x-cm-t335.dtb flags an error for an unevaluated 'num-serializer' property in the mcasp0 node. This property is obsolete; it is not defined in the davinci-mcasp-audio schema and is not used by the corresponding (or any) driver. Remove this unused property to fix the schema validation warning. Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com Signed-off-by: Kevin Hilman commit 2318336573c51748bd2089a835242c70be6850cf Author: Jesse.Zhang Date: Tue Aug 5 11:26:15 2025 +0800 drm/amdgpu: Add preempt and restore callbacks to userq funcs Add two new function pointers to struct amdgpu_userq_funcs: - preempt: To handle preemption of user mode queues - restore: To restore preempted user mode queues These callbacks will allow the driver to properly manage queue preemption and restoration when needed, such as during context switching or priority changes. Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 Author: Jihed Chaibi Date: Sat Aug 23 00:50:52 2025 +0200 ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS The ti,keep-vref-on property, defined as a boolean flag in the Device Tree schema, was incorrectly assigned a value (<1>) in the DTS file, causing a validation error: "size (4) error for type flag". Remove the value to match the schema and ensure compatibility with the driver using device_property_read_bool(). This fixes the dtbs_check error. Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com Signed-off-by: Kevin Hilman commit 9658a92fad1889ff92fa4bd668cd61052687245a Author: Jihed Chaibi Date: Sat Aug 23 00:25:30 2025 +0200 ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree schema, was incorrectly assigned a value (<1>) in the DTS file, causing a validation error: "size (4) error for type flag". The driver uses of_property_read_bool(), expecting a boolean. Remove the value to fix the dtbs_check error. Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/ Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com Signed-off-by: Kevin Hilman commit 9df7366a29192f860e9e35a258f0b000b6e4a754 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:54 2025 +0200 ARM: dts: omap: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131651.86569-7-krzysztof.kozlowski@linaro.org Signed-off-by: Kevin Hilman commit 7d7df1bc644a29e880181579994bd2da9fb1a6ce Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:53 2025 +0200 ARM: dts: omap: dm816x: Split 'reg' per entry Multiple entries in 'reg' should be encoded in separate <>. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131651.86569-6-krzysztof.kozlowski@linaro.org Signed-off-by: Kevin Hilman commit 46179394d4e45d561a2c0185774c2f7b88fa7c14 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:52 2025 +0200 ARM: dts: omap: dm814x: Split 'reg' per entry Multiple entries in 'reg' should be encoded in separate <>. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131651.86569-5-krzysztof.kozlowski@linaro.org Signed-off-by: Kevin Hilman commit 045e81d8d7e65baefbd4dea0503ca3330f93f3e6 Author: Yang Xiuwei Date: Sun Aug 17 16:34:49 2025 +0800 ARM: OMAP2+: use IS_ERR_OR_NULL() helper Simplify error handling in OMAP powerdomain, voltage, and VP code by replacing open-coded '!ptr || IS_ERR(ptr)' checks with the combined IS_ERR_OR_NULL() helper. This improves readability and consistency across omap_set_pwrdm_state(), voltdm_get_voltage(), voltdm_scale(), voltdm_reset(), and related functions. No functional change intended. Signed-off-by: Yang Xiuwei Reviewed-by: Andreas Kemnade Link: https://lore.kernel.org/r/20250817083449.2249268-1-yangxiuwei2025@163.com Signed-off-by: Kevin Hilman commit ca8be8fc2c306efb090791835acfb5b33542ca1d Author: Bruno Thomsen Date: Mon Jul 21 19:37:41 2025 +0200 ARM: dts: am33xx-l4: fix UART compatible Fixes the following dtschema check warning: serial@0 (ti,am3352-uart): compatible: 'oneOf' conditional failed, one must be fixed: ['ti,am3352-uart', 'ti,omap3-uart'] is too long 'ti,am3352-uart' is not one of ['ti,am64-uart', 'ti,j721e-uart'] 'ti,am654-uart' was expected from schema $id: http://devicetree.org/schemas/serial/8250_omap.yaml# Signed-off-by: Bruno Thomsen Reviewed-by: Judith Mendez Link: https://lore.kernel.org/r/20250721173741.6369-1-bruno.thomsen@gmail.com Signed-off-by: Kevin Hilman commit 8a6506e1ba0d2b831729808d958aae77604f12f9 Author: Alexander Sverdlin Date: Thu Jul 17 17:27:03 2025 +0200 ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) There is an issue possible where TI AM33xx SoCs do not boot properly after a reset if EMU0/EMU1 pins were used as GPIO and have been driving low level actively prior to reset [1]. "Advisory 1.0.36 EMU0 and EMU1: Terminals Must be Pulled High Before ICEPick Samples The state of the EMU[1:0] terminals are latched during reset to determine ICEPick boot mode. For normal device operation, these terminals must be pulled up to a valid high logic level ( > VIH min) before ICEPick samples the state of these terminals, which occurs [five CLK_M_OSC clock cycles - 10 ns] after the falling edge of WARMRSTn. Many applications may not require the secondary GPIO function of the EMU[1:0] terminals. In this case, they would only be connected to pull-up resistors, which ensures they are always high when ICEPick samples. However, some applications may need to use these terminals as GPIO where they could be driven low before reset is asserted. This usage of the EMU[1:0] terminals may require special attention to ensure the terminals are allowed to return to a valid high-logic level before ICEPick samples the state of these terminals. When any device reset is asserted, the pin mux mode of EMU[1:0] terminals configured to operate as GPIO (mode 7) will change back to EMU input (mode 0) on the falling edge of WARMRSTn. This only provides a short period of time for the terminals to return high if driven low before reset is asserted... If the EMU[1:0] terminals are configured to operate as GPIO, the product should be designed such these terminals can be pulled to a valid high-logic level within 190 ns after the falling edge of WARMRSTn." We've noticed this problem with custom am335x hardware in combination with recently implemented cold reset method (commit 6521f6a195c70 ("ARM: AM33xx: PRM: Implement REBOOT_COLD")). It looks like the problem can affect other HW, for instance AM335x Chiliboard, because the latter has LEDs on GPIO3_7/GPIO3_8 as well. One option would be to check if the pins are in GPIO mode and either switch to output active high, or switch to input and poll until the external pull-ups have brought the pins to the desired high state. But fighting with GPIO driver for these pins is probably not the most straight forward approch in a reboot handler. Fortunately we can easily control pinmuxing here and rely on the external pull-ups. TI recommends 4k7 external pull up resistors [2] and even with quite conservative estimation for pin capacity (1 uF should never happen) the required delay shall not exceed 5ms. [1] Link: https://www.ti.com/lit/pdf/sprz360 [2] Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/866346/am3352-emu-1-0-questions Cc: stable@vger.kernel.org Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250717152708.487891-1-alexander.sverdlin@siemens.com Signed-off-by: Kevin Hilman commit 7c3e113ef09d474c4b076c42f1264c4fa78d1dc8 Author: Krzysztof Kozlowski Date: Thu Jul 17 16:22:13 2025 +0200 ARM: dts: ti: omap4: Use generic "ethernet" as node name Common name for Ethernet controllers is "ethernet", not "eth", also recommended by Devicetree specification in "Generic Names Recommendation". Verified lack of impact using dtx_diff. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717142212.92333-2-krzysztof.kozlowski@linaro.org Signed-off-by: Kevin Hilman commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 Author: Thomas Weißschuh Date: Fri Aug 15 12:41:10 2025 +0200 vdso: Add struct __kernel_old_timeval forward declaration to gettime.h The prototype of __vdso_gettimeofday() uses this struct. However gettime.h's own includes do not provide a definition for it. Add a forward declaration, similar to other used structs. Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de commit ca50b295fd473ef797b69b8538036cca716f3d55 Author: Sakari Ailus Date: Fri Jul 4 10:54:13 2025 +0300 HSI: omap_ssi_port: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075413.3218357-1-sakari.ailus@linux.intel.com Signed-off-by: Sebastian Reichel commit cf423b928f27f5228c7942c1b270988c87b2f25b Author: John Harrison Date: Thu Sep 4 12:57:51 2025 -0700 drm/xe/guc: Fix badly worded error message If a GuC id lookup failed, the error message was 'Not engine present', which is bad in multiple ways - incorrect English and 'engines' are now called 'exec queues' in this context. So fix it. Signed-off-by: John Harrison Reviewed-by: Matt Atwood Link: https://lore.kernel.org/r/20250904195752.3846138-3-John.C.Harrison@Intel.com commit 0b05857dc11c97635e3cc80b231019307ec9d704 Author: John Harrison Date: Thu Sep 4 12:57:50 2025 -0700 drm/xe/guc: Clean up of GuC 'CTL' defines All the field generation for the CTL defines (used for GuC init data) were hand-rolled rather than using FIELD_PREP/REG_GENMASK/BIT macros. Also, there were a bunch of macros defined for verbosity settings that were never used. So fix that all up. Signed-off-by: John Harrison Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250904195752.3846138-2-John.C.Harrison@Intel.com commit 878f33f3907ae2e5751c1a3c4397f37b86e53494 Author: Sunil Khatri Date: Thu Aug 14 13:29:04 2025 +0530 drm/amdgpu: fix the formating for debugfs print Fix the format of debugfs print in the mqd. Need to add a colon so parser can parse it properly. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1e18746381793bef7c715fc5ec5611a422a75c4c Author: Alex Deucher Date: Fri Jun 27 10:09:06 2025 -0400 drm/amd: add more cyan skillfish PCI ids Add additional PCI IDs to the cyan skillfish family. Signed-off-by: Alex Deucher commit 7e0fc7b2b7f7e030f5886fa21e002f2edb6c12be Author: Sunil Khatri Date: Thu Aug 14 13:23:32 2025 +0530 drm/amdgpu: add more information in debugfs to pagetable dump Add more information in the debugfs which is needed to dump a pagetable correctly for userqueues where vmid is not known in the kernel. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f320ed01cf5f2259e2035a56900952cb3cc77e7a Author: Xiang Liu Date: Tue Sep 2 22:13:44 2025 +0800 drm/amdgpu: Correct info field of bad page threshold exceed CPER Correct valid_bits and ms_chk_bits of section info field for bad page threshold exceed CPER to match OOB's behavior. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 36cc7d13178d901982da7a122c883861d98da624 Author: Eric Huang Date: Mon Aug 25 09:50:49 2025 -0400 drm/amdkfd: fix p2p links bug in topology When creating p2p links, KFD needs to check XGMI link with two conditions, hive_id and is_sharing_enabled, but it is missing to check is_sharing_enabled, so add it to fix the error. Signed-off-by: Eric Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 3f36e712a8b17d49c089706e229849d3f745a540 Author: Qianfeng Rong Date: Wed Sep 3 20:21:10 2025 +0800 drm/radeon/ci_dpm: Use int type to store negative error codes Change the 'ret' variable in ci_populate_all_graphic_levels() and ci_populate_all_memory_levels() from u32 to int, as it needs to store either negative error codes or zero returned by other functions. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit 086f66edf9244d8c05b0ddf24631fe7f3472ac45 Author: Liao Yuanhong Date: Wed Sep 3 20:03:50 2025 +0800 drm/amdgpu/vcn: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 9502b09933ed8debe9888c69b10e79e3a2b66800 Author: Liao Yuanhong Date: Wed Sep 3 20:03:49 2025 +0800 drm/amdgpu/jpeg: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 8a4bc4508c6b104210b85f380d3237d3a2582f37 Author: Liao Yuanhong Date: Wed Sep 3 20:03:48 2025 +0800 drm/amdgpu/ih: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 60df3e81d742e95805ca5e32ef336f87ab35dc37 Author: Liao Yuanhong Date: Wed Sep 3 20:03:47 2025 +0800 drm/amdgpu/gmc: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit d261e744af55179fcdd71fa767088421e6dea158 Author: Liao Yuanhong Date: Wed Sep 3 20:03:46 2025 +0800 drm/amdgpu/gfx: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 7670daf65afae2d6d08b300df64c96439e813b3a Author: Liao Yuanhong Date: Wed Sep 3 20:03:45 2025 +0800 drm/amdgpu/amdgpu_cper: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 4320fd9e0d817f63b31dc380a1127335c445083c Author: Colin Ian King Date: Wed Sep 3 09:20:18 2025 +0100 drm/amd/amdgpu: Fix a less than zero check on a uint32_t struct field Currently the error check from the call to mes_v12_inv_tlb_convert_hub_id is always false because a uint32_t struct field hub_id is being used to to perform the less than zero error check. Fix this by using the int variable ret to perform the check. Fixes: 87e65052616c ("drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12") Reviewed-by: Dan Carpenter Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 9d68320b2bca876278856fdc1e8684a7494dd069 Author: Huisong Li Date: Fri Sep 5 16:18:58 2025 +0800 ACPI: processor: idle: Fix function defined but not used warning If CONFIG_ACPI_PROCESSOR_IDLE=n, acpi_processor_register_idle_driver() and acpi_processor_unregister_idle_driver() are never used and the empty stubs of them are not needed. Moreover, they cause the compiler to complain [1], so remove them. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508300519.tZQHY6HA-lkp@intel.com/ [1] Fixes: 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250905081900.663869-2-lihuisong@huawei.com [ rjw: Changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit ba28afbd9eff2a6370f23ef4e6a036ab0cfda409 Author: Yu Kuai Date: Thu Aug 21 14:06:12 2025 +0800 blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth(). The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic. Fix this problem by replacing et->tags with new allocated tags as well. Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1]. [1] https://lore.kernel.org/all/20250815080216.410665-1-yukuai1@huaweicloud.com/ Fixes: f5a6604f7a44 ("block: fix lockdep warning caused by lock dependency in elv_iosched_store") Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Nilay Shroff Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan Link: https://lore.kernel.org/r/20250821060612.1729939-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 7d337eef4affc5e26e0570513168c69ddbc40f92 Author: Yu Kuai Date: Thu Aug 21 14:06:11 2025 +0800 blk-mq: fix elevator depth_updated method Current depth_updated has some problems: 1) depth_updated() will be called for each hctx, while all elevators will update async_depth for the disk level, this is not related to hctx; 2) In blk_mq_update_nr_requests(), if previous hctx update succeed and this hctx update failed, q->nr_requests will not be updated, while async_depth is already updated with new nr_reqeuests in previous depth_updated(); 3) All elevators are using q->nr_requests to calculate async_depth now, however, q->nr_requests is still the old value when depth_updated() is called from blk_mq_update_nr_requests(); Those problems are first from error path, then mq-deadline, and recently for bfq and kyber, fix those problems by: - pass in request_queue instead of hctx; - move depth_updated() after q->nr_requests is updated in blk_mq_update_nr_requests(); - add depth_updated() call inside init_sched() method to initialize async_depth; - remove init_hctx() method for mq-deadline and bfq that is useless now; Fixes: 77f1e0a52d26 ("bfq: update internal depth state when queue depth changes") Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code") Fixes: 42e6c6ce03fd ("lib/sbitmap: convert shallow_depth from one word to the whole sbitmap") Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Reviewed-by: Li Nan Reviewed-by: Nilay Shroff Link: https://lore.kernel.org/r/20250821060612.1729939-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit e12873ee856ffa6f104869b8ea10c0f741606f13 Author: Mykyta Yatsenko Date: Fri Sep 5 15:08:35 2025 +0100 selftests/bpf: Add BPF program dump in veristat Add the ability to dump BPF program instructions directly from veristat. Previously, inspecting a program required separate bpftool invocations: one to load and another to dump it, which meant running multiple commands. During active development, it's common for developers to use veristat for testing verification. Integrating instruction dumping into veristat reduces the need to switch tools and simplifies the workflow. By making this information more readily accessible, this change aims to streamline the BPF development cycle and improve usability for developers. This implementation leverages bpftool, by running it directly via popen to avoid any code duplication and keep veristat simple. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250905140835.1416179-1-mykyta.yatsenko5@gmail.com commit 42c74f6b1c3694892ab92750a60aeb6212d73ac1 Author: Srinivas Pandruvada Date: Wed Sep 3 17:06:07 2025 -0700 cpufreq: intel_pstate: Remove EPB-related code The intel_pstate driver does not enable HWP mode when CPUID.06H:EAX[10] is not set, indicating that EPP (Energy Performance Preference) is not supported by the hardware. When EPP is unavailable, the system falls back to using EPB (Energy Performance Bias) if the feature is supported. However, since the intel_pstate driver will not enable HWP in this scenario, any EPB-related code becomes unreachable and irrelevant. Remove the EPB handling code paths simplifying the driver logic and reducing code size. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250904000608.260817-1-srinivas.pandruvada@linux.intel.com [ rjw: Subject adjustment ] Signed-off-by: Rafael J. Wysocki commit 6fc957185e1691bb6dfa4193698a229db537c2a2 Author: Julia Filipchuk Date: Wed Sep 3 12:00:38 2025 -0700 drm/xe: Extend Wa_13011645652 to PTL-H, WCL Expand workaround to additional graphics architectures. Cc: Vinay Belgaumkar Cc: Stuart Summers Cc: Daniele Ceraolo Spurio Cc: Lucas De Marchi Cc: Thomas Hellström Cc: Rodrigo Vivi Cc: intel-xe@lists.freedesktop.org Cc: # v6.17+ Signed-off-by: Julia Filipchuk Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250903190122.1028373-2-julia.filipchuk@intel.com Signed-off-by: Lucas De Marchi commit 5136380b74f1e562ad96268578f22d8b1a29cb90 Author: Osama Abdelkader Date: Wed Sep 3 21:20:59 2025 +0200 thermal: hwmon: replace deprecated strcpy() with strscpy() Since strcpy() is deprecated and the last user of it in the thermal subsystem is thermal_hwmon_lookup_by_type(), replace strcpy() in that function with strscpy(). Signed-off-by: Osama Abdelkader Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20250903192059.11353-1-osama.abdelkader@gmail.com [ rjw: Changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit 5f2ec3536d7933a804d28d2541e4e918ba32587b Author: Rafael J. Wysocki Date: Wed Sep 3 16:59:47 2025 +0200 cpufreq: intel_pstate: Rearrange variable declaration involving __free() Follow cleanup.h recommendations and define and assign a variable in one statement when __free() is used. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Reviewed-by: Zihuan Zhang Link: https://patch.msgid.link/2251447.irdbgypaU6@rafael.j.wysocki commit c05fa4091863468fd53abf1334c05052eda1ff52 Author: Rafael J. Wysocki Date: Wed Sep 3 16:56:04 2025 +0200 cpufreq: core: Rearrange variable declarations involving __free() Follow cleanup.h recommendations and always define and assign variables in one statement when __free() is used. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://patch.msgid.link/4691667.LvFx2qVVIh@rafael.j.wysocki commit e54ddc44506f018f75e61c76a213227bd67dffb6 Author: Rafael J. Wysocki Date: Wed Sep 3 16:52:45 2025 +0200 thermal: testing: Rearrange variable declarations involving __free() Follow cleanup.h recommendations and always define and assign variables in one statement when __free() is used. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/5934556.DvuYhMxLoT@rafael.j.wysocki commit be82483d1b60baf6747884bd74cb7de484deaf76 Author: Rafael J. Wysocki Date: Tue Sep 2 15:55:45 2025 +0200 PM: sleep: core: Clear power.must_resume in noirq suspend error path If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet. If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume). Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state. Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki commit e5e9b7bd864261f8132abb542afac4758e6232a3 Author: Qianfeng Rong Date: Tue Sep 2 19:45:44 2025 +0800 cpufreq: speedstep-lib: Use int type to store negative error codes Change the return type of the speedstep_get_freqs() function from unsigned int to int because it may return negative error codes. For the same reason, change the 'ret' variables to int type as well. No effect on runtime. Signed-off-by: Qianfeng Rong Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250902114545.651661-4-rongqianfeng@vivo.com Signed-off-by: Rafael J. Wysocki commit b49d70849530f046b1f9a42c963840ca91c60929 Author: Qianfeng Rong Date: Tue Sep 2 19:45:42 2025 +0800 cpufreq: Use int type to store negative error codes Change the 'ret' variable in store_scaling_setspeed() from unsigned int to int, as it needs to store either negative error codes or zero returned by kstrtouint(). No effect on runtime. Signed-off-by: Qianfeng Rong Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250902114545.651661-2-rongqianfeng@vivo.com Signed-off-by: Rafael J. Wysocki commit e90dcba0a350836a5e1a1ac0f65f9e74644d7d3b Merge: 482c57805c722d 0ff51a1fd786f4 Author: Carlos Maiolino Date: Fri Sep 5 20:27:25 2025 +0200 Merge tag 'kconfig-2025-changes_2025-09-05' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-6.18-merge xfs: kconfig and feature changes for 2025 LTS [6.18 v2 2/2] Ahead of the 2025 LTS kernel, disable by default the two features that we promised to turn off in September 2025: V4 filesystems, and the long-broken ASCII case insensitive directories. Since online fsck has not had any major issues in the 16 months since it was merged upstream, let's also turn that on by default. With a bit of luck, this should all go splendidly. Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 482c57805c722d420bce02b0942b4e15911ec115 Merge: 33ddc796ecbd50 07c34f8cef69cb Author: Carlos Maiolino Date: Fri Sep 5 20:26:42 2025 +0200 Merge tag 'fix-scrub-reap-calculations_2025-09-05' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-6.18-merge xfs: improve online repair reap calculations [6.18 v2 1/2] A few months ago, the multi-fsblock untorn writes patchset added a bunch of log intent item helper functions to estimate the number of intent items that could be added to a particular transaction. Those helpers enabled us to compute a safe upper bound on the number of blocks that could be written in an untorn fashion with filesystem-provided out of place writes. Currently, the online fsck code employs static limits on the number of intent items that it's willing to accrue to a single transaction when it's trying to reap what it thinks are the old blocks from a corrupt structure. There have been no problems reported with this approach after years of testing, but static limits are scary and gross because overestimating the intent item limit could result in transaction overflows and dead filesystems; and underestimating causes unnecessary overhead. This series uses the new log intent item size helpers to estimate the limits dynamically based on worst-case per-block repair work vs. the size of the scrub transaction. After several months of testing this, there don't seem to be any problems here either. v2: rearrange patches, add review tags This has been running on the djcloud for months with no problems. Enjoy! Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 97248d05b70edc674f2f2fa835fed33172686b1d Author: Zihuan Zhang Date: Tue Sep 2 15:33:23 2025 +0800 cpufreq: Drop redundant freq_table parameter Since commit e0b3165ba521 ("cpufreq: add 'freq_table' in struct cpufreq_policy"), freq_table has been stored in struct cpufreq_policy instead of being maintained separately. However, several helpers in freq_table.c still take both policy and freq_table as parameters, even though policy->freq_table can always be used. This leads to redundant function arguments and increases the chance of inconsistencies. This patch removes the unnecessary freq_table argument from these functions and updates their callers to only pass policy. This makes the code simpler, more consistent, and avoids duplication. Signed-off-by: Zihuan Zhang Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250902073323.48330-1-zhangzihuan@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 9cd6b43a0f7fc0dfb779c73f4aeb4d3fe8820698 Author: Louis Chauvet Date: Thu Jul 3 09:57:04 2025 +0200 drm/vkms: Add P01* formats The formats NV 12/16/24/21/61/42 were already supported. Add support for: - P010 - P012 - P016 Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-8-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 9e6600e9d3683cdf0196fde7439dba4c50946906 Author: Louis Chauvet Date: Thu Jul 3 09:57:03 2025 +0200 drm/vkms: Create helper macro for YUV formats The callback functions for line conversion are almost identical for semi-planar formats. The generic READ_LINE_YUV_SEMIPLANAR macro generate all the required boilerplate to process a line from a semi-planar format. Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-7-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 7766ae8de472be3e0167cf3652e6ae8d74ef0221 Author: Louis Chauvet Date: Thu Jul 3 09:57:02 2025 +0200 drm/vkms: Change YUV helpers to support u16 inputs for conversion Some YUV format uses 16 bit values, so change the helper function for conversion to support those new formats. Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-6-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 50c58f4f0562504256477ad153463d86500aa337 Author: Louis Chauvet Date: Thu Jul 3 09:57:01 2025 +0200 drm/vkms: Add support for RGB888 formats Add the support for: - RGB888 - BGR888 Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-5-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 39d80cee4207d937daf58179ae3c572bcf541f8a Author: Louis Chauvet Date: Thu Jul 3 09:57:00 2025 +0200 drm/vkms: Add support for RGB565 formats The format RGB565 was already supported. Add the support for: - BGR565 Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-4-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit bac5c590d42ce8a930950da716b7537e60153196 Author: Louis Chauvet Date: Thu Jul 3 09:56:59 2025 +0200 drm/vkms: Add support for ARGB16161616 formats The formats XRGB16161616 and ARGB16161616 were already supported. Add the support for: - ABGR16161616 - XBGR16161616 Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-3-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 985769b8b5c42666be91f5e60aeb93365c934b88 Author: Louis Chauvet Date: Thu Jul 3 09:56:58 2025 +0200 drm/vkms: Add support for ARGB8888 formats The formats XRGB8888 and ARGB8888 were already supported. Add the support for: - XBGR8888 - ABGR8888 - RGBA8888 - BGRA8888 Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-2-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 544f161a88af0370ced87783246418aed63b619c Author: Louis Chauvet Date: Thu Jul 3 09:56:57 2025 +0200 drm/vkms: Create helpers macro to avoid code duplication in format callbacks The callback functions for line conversion are almost identical for some format. The generic READ_LINE macro generate all the required boilerplate to process a line. Two overrides of this macro have been added to avoid duplication of the same arguments every time. Reviewed-by: Maíra Canal Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250703-b4-new-color-formats-v7-1-15fd8fd2e15c@bootlin.com Signed-off-by: Louis Chauvet commit 61221d07e815008ba758995d79fd442b5217f51a Author: Kai Huang Date: Mon Sep 1 18:09:30 2025 +0200 KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs On TDX platforms, during kexec, the kernel needs to make sure there are no dirty cachelines of TDX private memory before booting to the new kernel to avoid silent memory corruption to the new kernel. To do this, the kernel has a percpu boolean to indicate whether the cache of a CPU may be in incoherent state. During kexec, namely in stop_this_cpu(), the kernel does WBINVD if that percpu boolean is true. TDX turns on that percpu boolean on a CPU when the kernel does SEAMCALL, Thus making sure the cache will be flushed during kexec. However, kexec has a race condition that, while remaining extremely rare, would be more likely in the presence of a relatively long operation such as WBINVD. In particular, the kexec-ing CPU invokes native_stop_other_cpus() to stop all remote CPUs before booting to the new kernel. native_stop_other_cpus() then sends a REBOOT vector IPI to remote CPUs and waits for them to stop; if that times out, it also sends NMIs to the still-alive CPUs and waits again for them to stop. If the race happens, kexec proceeds before all CPUs have processed the NMI and stopped[1], and the system hangs. But after tdx_disable_virtualization_cpu(), no more TDX activity can happen on this cpu. When kexec is enabled, flush the cache explicitly at that point; this moves the WBINVD to an earlier stage than stop_this_cpus(), avoiding a possibly lengthy operation at a time where it could cause this race. [1] https://lore.kernel.org/kvm/b963fcd60abe26c7ec5dc20b42f1a2ebbcc72397.1750934177.git.kai.huang@intel.com/ [Make the new function a stub for !CONFIG_KEXEC_CORE. - Paolo] Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Acked-by: Paolo Bonzini Tested-by: Farrah Chen Link: https://lore.kernel.org/all/20250901160930.1785244-8-pbonzini%40redhat.com commit 5f9b5bd0c82925e4a71c5790a37b3142fec946d4 Author: Kai Huang Date: Mon Sep 1 18:09:29 2025 +0200 x86/virt/tdx: Update the kexec section in the TDX documentation TDX host kernel now supports kexec/kdump. Update the documentation to reflect that. Opportunistically, remove the parentheses in "Kexec()" and move this section under the "Erratum" section because the updated "Kexec" section now refers to that erratum. Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Tested-by: Farrah Chen Link: https://lore.kernel.org/all/20250901160930.1785244-7-pbonzini%40redhat.com commit 80804847269eba880dc8c1bc64d70082692f72cd Author: Kai Huang Date: Mon Sep 1 18:09:28 2025 +0200 x86/virt/tdx: Remove the !KEXEC_CORE dependency During kexec it is now guaranteed that all dirty cachelines of TDX private memory are flushed before jumping to the new kernel. The TDX private memory from the old kernel will remain as TDX private memory in the new kernel, but it is OK because kernel read/write to TDX private memory will never cause machine check, except on the platforms with the TDX partial write erratum, which has already been handled. It is safe to allow kexec to work together with TDX now. Remove the !KEXEC_CORE dependency. Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Tested-by: Farrah Chen Link: https://lore.kernel.org/all/20250901160930.1785244-6-pbonzini%40redhat.com commit b18651f70ce0e45d52b9e66d9065b831b3f30784 Author: Kai Huang Date: Mon Sep 1 18:09:27 2025 +0200 x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum Some early TDX-capable platforms have an erratum: A kernel partial write (a write transaction of less than cacheline lands at memory controller) to TDX private memory poisons that memory, and a subsequent read triggers a machine check. On those platforms, the old kernel must reset TDX private memory before jumping to the new kernel, otherwise the new kernel may see unexpected machine check. Currently the kernel doesn't track which page is a TDX private page. For simplicity just fail kexec/kdump for those platforms. Leverage the existing machine_kexec_prepare() to fail kexec/kdump by adding the check of the presence of the TDX erratum (which is only checked for if the kernel is built with TDX host support). This rejects kexec/kdump when the kernel is loading the kexec/kdump kernel image. The alternative is to reject kexec/kdump when the kernel is jumping to the new kernel. But for kexec this requires adding a new check (e.g., arch_kexec_allowed()) in the common code to fail kernel_kexec() at early stage. Kdump (crash_kexec()) needs similar check, but it's hard to justify because crash_kexec() is not supposed to abort. It's feasible to further relax this limitation, i.e., only fail kexec when TDX is actually enabled by the kernel. But this is still a half measure compared to resetting TDX private memory so just do the simplest thing for now. The impact to userspace is the users will get an error when loading the kexec/kdump kernel image: kexec_load failed: Operation not supported This might be confusing to the users, thus also print the reason in the dmesg: [..] kexec: Not allowed on platform with tdx_pw_mce bug. Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Tested-by: Farrah Chen Link: https://lore.kernel.org/all/20250901160930.1785244-5-pbonzini%40redhat.com commit 10df8607bf1a22249d21859f56eeb61e9a033313 Author: Kai Huang Date: Mon Sep 1 18:09:26 2025 +0200 x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL On TDX platforms, dirty cacheline aliases with and without encryption bits can coexist, and the cpu can flush them back to memory in random order. During kexec, the caches must be flushed before jumping to the new kernel otherwise the dirty cachelines could silently corrupt the memory used by the new kernel due to different encryption property. A percpu boolean is used to mark whether the cache of a given CPU may be in an incoherent state, and the kexec performs WBINVD on the CPUs with that boolean turned on. For TDX, only the TDX module or the TDX guests can generate dirty cachelines of TDX private memory, i.e., they are only generated when the kernel does a SEAMCALL. Set that boolean when the kernel does SEAMCALL so that kexec can flush the cache correctly. The kernel provides both the __seamcall*() assembly functions and the seamcall*() wrapper ones which additionally handle running out of entropy error in a loop. Most of the SEAMCALLs are called using the seamcall*(), except TDH.VP.ENTER and TDH.PHYMEM.PAGE.RDMD which are called using __seamcall*() variant directly. To cover the two special cases, add a new __seamcall_dirty_cache() helper which only sets the percpu boolean and calls the __seamcall*(), and change the special cases to use the new helper. To cover all other SEAMCALLs, change seamcall*() to call the new helper. For the SEAMCALLs invoked via seamcall*(), they can be made from both task context and IRQ disabled context. Given SEAMCALL is just a lengthy instruction (e.g., thousands of cycles) from kernel's point of view and preempt_{disable|enable}() is cheap compared to it, just unconditionally disable preemption during setting the boolean and making SEAMCALL. Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Chao Gao Reviewed-by: Rick Edgecombe Tested-by: Farrah Chen Link: https://lore.kernel.org/all/20250901160930.1785244-4-pbonzini%40redhat.com commit 83214a775f33bc9d61c2c284f2ace3f854a4cddb Author: Kai Huang Date: Mon Sep 1 18:09:25 2025 +0200 x86/sme: Use percpu boolean to control WBINVD during kexec TL;DR: Prepare to unify how TDX and SME do cache flushing during kexec by making a percpu boolean control whether to do the WBINVD. -- Background -- On SME platforms, dirty cacheline aliases with and without encryption bit can coexist, and the CPU can flush them back to memory in random order. During kexec, the caches must be flushed before jumping to the new kernel otherwise the dirty cachelines could silently corrupt the memory used by the new kernel due to different encryption property. TDX also needs a cache flush during kexec for the same reason. It would be good to have a generic way to flush the cache instead of scattering checks for each feature all around. When SME is enabled, the kernel basically encrypts all memory including the kernel itself and a simple memory write from the kernel could dirty cachelines. Currently, the kernel uses WBINVD to flush the cache for SME during kexec in two places: 1) the one in stop_this_cpu() for all remote CPUs when the kexec-ing CPU stops them; 2) the one in the relocate_kernel() where the kexec-ing CPU jumps to the new kernel. -- Solution -- Unlike SME, TDX can only dirty cachelines when it is used (i.e., when SEAMCALLs are performed). Since there are no more SEAMCALLs after the aforementioned WBINVDs, leverage this for TDX. To unify the approach for SME and TDX, use a percpu boolean to indicate the cache may be in an incoherent state and needs flushing during kexec, and set the boolean for SME. TDX can then leverage it. While SME could use a global flag (since it's enabled at early boot and enabled on all CPUs), the percpu flag fits TDX better: The percpu flag can be set when a CPU makes a SEAMCALL, and cleared when another WBINVD on the CPU obviates the need for a kexec-time WBINVD. Saving kexec-time WBINVD is valuable, because there is an existing race[*] where kexec could proceed while another CPU is active. WBINVD could make this race worse, so it's worth skipping it when possible. -- Side effect to SME -- Today the first WBINVD in the stop_this_cpu() is performed when SME is *supported* by the platform, and the second WBINVD is done in relocate_kernel() when SME is *activated* by the kernel. Make things simple by changing to do the second WBINVD when the platform supports SME. This allows the kernel to simply turn on this percpu boolean when bringing up a CPU by checking whether the platform supports SME. No other functional change intended. [*] The aforementioned race: During kexec native_stop_other_cpus() is called to stop all remote CPUs before jumping to the new kernel. native_stop_other_cpus() firstly sends normal REBOOT vector IPIs to stop remote CPUs and waits them to stop. If that times out, it sends NMI to stop the CPUs that are still alive. The race happens when native_stop_other_cpus() has to send NMIs and could potentially result in the system hang (for more information please see [1]). Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Tom Lendacky Reviewed-by: Borislav Petkov (AMD) Tested-by: Tom Lendacky Link: https://lore.kernel.org/kvm/b963fcd60abe26c7ec5dc20b42f1a2ebbcc72397.1750934177.git.kai.huang@intel.com/ [1] Link: https://lore.kernel.org/all/20250901160930.1785244-3-pbonzini%40redhat.com commit 744b02f62634b64345d05a8a3f145d56469313b4 Author: Kai Huang Date: Mon Sep 1 18:09:24 2025 +0200 x86/kexec: Consolidate relocate_kernel() function parameters During kexec, the kernel jumps to the new kernel in relocate_kernel(), which is implemented in assembly and both 32-bit and 64-bit have their own version. Currently, for both 32-bit and 64-bit, the last two parameters of the relocate_kernel() are both 'unsigned int' but actually they only convey a boolean, i.e., one bit information. The 'unsigned int' has enough space to carry two bits information therefore there's no need to pass the two booleans in two separate 'unsigned int'. Consolidate the last two function parameters of relocate_kernel() into a single 'unsigned int' and pass flags instead. Only consolidate the 64-bit version albeit the similar optimization can be done for the 32-bit version too. Don't bother changing the 32-bit version while it is working (since assembly code change is required). Signed-off-by: Kai Huang Signed-off-by: Paolo Bonzini Signed-off-by: Dave Hansen Reviewed-by: Tom Lendacky Reviewed-by: Borislav Petkov (AMD) Reviewed-by: David Woodhouse Link: https://lore.kernel.org/all/20250901160930.1785244-2-pbonzini%40redhat.com commit a2be943b46b4a7478ea8ddf9bb8e5251c59fceb7 Author: Marco Crivellari Date: Fri Sep 5 11:13:24 2025 +0200 workqueue: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit f6cfa602d2ba7e5ca9dc65ec4141521aca80bda2 Author: Marco Crivellari Date: Fri Sep 5 11:13:23 2025 +0200 workqueue: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit 4a3e62dfa7b79dc8f759219fe64318ff08e98013 Merge: 7fa33aa3b00175 94a4acfec14615 Author: Tejun Heo Date: Fri Sep 5 07:08:26 2025 -1000 cgroup: Merge branch 'for-6.17-fixes' into for-6.18 Pull for-6.17-fixes to receive 79f919a89c9d ("cgroup: split cgroup_destroy_wq into 3 workqueues") to resolve its conflict with 7fa33aa3b001 ("cgroup: WQ_PERCPU added to alloc_workqueue users"). The latter adds WQ_PERCPU when creating cgroup_destroy_wq and the former splits the workqueue into three. Resolve by applying WQ_PERCPU to the three split workqueues. Signed-off-by: Tejun Heo commit 0d2902dfa31535c08d4976995d5b6890a8f43399 Author: José Expósito Date: Mon Aug 11 12:15:17 2025 +0200 drm/vkms: Assert if vkms_config_create_*() fails Check that the value returned by the vkms_config_create_*() functions is valid. Otherwise, assert and finish the KUnit test. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/aJTL6IFEBaI8gqtH@stanley.mountain/ Signed-off-by: José Expósito Reviewed-by: Louis Chauvet Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250811101529.150716-1-jose.exposito89@gmail.com Signed-off-by: Louis Chauvet commit 7fa33aa3b001758352c8d0abb9f212a5bb9ed46a Author: Marco Crivellari Date: Fri Sep 5 10:54:36 2025 +0200 cgroup: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit d6256771d106172cf7b6e6bfc49f5a1f2ff8c76c Author: Marco Crivellari Date: Fri Sep 5 10:54:35 2025 +0200 cgroup: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit 92b9c2b7a88c07324d70ea877cfe2d90ac823dbf Merge: 9d35d068fb1381 b497e1a1a2b10c Author: Mark Brown Date: Fri Sep 5 17:09:18 2025 +0100 regulator: pf530x: NXP PF530x regulator driver Merge series from Woodrow Douglass : I wrote this driver to read settings and state from the nxp pf530x regulator. Please consider it for inclusion, any criticism is welcome. commit 0ff51a1fd786f47ba435ede6209046959bad54a8 Author: Darrick J. Wong Date: Wed Aug 27 09:31:59 2025 -0700 xfs: enable online fsck by default in Kconfig Online fsck has been a part of upstream for over a year now without any serious problems. Turn it on by default in time for the 2025 LTS kernel, and get rid of the "say N if unsure" messages for the default Y options. Signed-off-by: "Darrick J. Wong" Reviewed-by: Carlos Maiolino commit 07c34f8cef69cb8eeef69c18d6cf0c04fbee3cb3 Author: Darrick J. Wong Date: Tue Apr 8 18:04:57 2025 -0700 xfs: use deferred reaping for data device cow extents Don't roll the whole transaction after every extent, that's rather inefficient. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 21d59d00221e4ecbcb597eec0021c667477d3335 Author: Darrick J. Wong Date: Tue Sep 2 14:38:27 2025 -0700 xfs: remove deprecated sysctl knobs These sysctl knobs were scheduled for removal in September 2025. That time has come, so remove them. Signed-off-by: "Darrick J. Wong" Reviewed-by: Carlos Maiolino commit d5b157e088c9fb72e2f245fd5cd43a373c4de677 Author: Darrick J. Wong Date: Tue Apr 8 16:14:36 2025 -0700 xfs: remove static reap limits from repair.h Delete XREAP_MAX_BINVAL and XREAP_MAX_DEFER_CHAIN because the reap code now calculates those limits dynamically, so they're no longer needed. Move the third limit (XREP_MAX_ITRUNCATE_EFIS) to the one file that uses it. Note that the btree rebuilding code should reserve exactly the number of blocks needed to rebuild a btree, so it is rare that the newbt code will need to add any EFIs to the commit transaction. That's why that static limit remains. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit b9a176e54162f890aaf50ac8a467d725ed2f00df Author: Darrick J. Wong Date: Tue Sep 2 14:33:53 2025 -0700 xfs: remove deprecated mount options These four mount options were scheduled for removal in September 2025, so remove them now. Cc: preichl@redhat.com Signed-off-by: "Darrick J. Wong" Reviewed-by: Carlos Maiolino commit f69260511c69888bdec048153d0d475d4c8b0b3e Author: Darrick J. Wong Date: Wed Aug 27 09:30:58 2025 -0700 xfs: disable deprecated features by default in Kconfig We promised to turn off these old features by default in September 2025. Do so now. Signed-off-by: "Darrick J. Wong" Reviewed-by: Carlos Maiolino commit e4c7eece7676bac436a8f98b91d646a8b55a67af Author: Darrick J. Wong Date: Tue Apr 8 16:14:35 2025 -0700 xfs: compute file mapping reap limits dynamically Reaping file fork mappings is a little different -- log recovery can free the blocks for us, so we only try to process a single mapping at a time. Therefore, we only need to figure out the maximum number of blocks that we can invalidate in a single transaction. The rough calculation here is: nr_extents = (logres - reservation used by any one step) / (space used per binval) Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 74fc66ee17fcd994a49ed80ddba90bc3b7046684 Author: Darrick J. Wong Date: Tue Apr 8 16:14:34 2025 -0700 xfs: compute realtime device CoW staging extent reap limits dynamically Calculate the maximum number of CoW staging extents that can be reaped in a single transaction chain. The rough calculation here is: nr_extents = (logres - reservation used by any one step) / (space used by intents per extent) Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 442bc127d460a807858ef9258e77518b9597eed1 Author: Darrick J. Wong Date: Tue Apr 8 16:14:33 2025 -0700 xfs: compute data device CoW staging extent reap limits dynamically Calculate the maximum number of CoW staging extents that can be reaped in a single transaction chain. The rough calculation here is: nr_extents = (logres - reservation used by any one step) / (space used by intents per extent + space used for a few buffer invalidations) Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit b2311ec6778fcde9d40cd9e22899f8bd594d8465 Author: Darrick J. Wong Date: Tue Apr 8 16:14:33 2025 -0700 xfs: compute per-AG extent reap limits dynamically Calculate the maximum number of extents that can be reaped in a single transaction chain, and the number of buffers that can be invalidated in a single transaction. The rough calculation here is: nr_extents = (logres - reservation used by any one step) / (space used by intents per extent + space used per binval) Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit ef930cc371f033d9ce21292ca577741dfeb8c7f3 Author: Darrick J. Wong Date: Tue Apr 8 16:14:31 2025 -0700 xfs: convert the ifork reap code to use xreap_state Convert the file fork reaping code to use struct xreap_state so that we can reuse the dynamic state tracking code. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 82e374405e85af2ce3149c74766168df14864697 Author: Darrick J. Wong Date: Tue Apr 8 16:14:30 2025 -0700 xfs: prepare reaping code for dynamic limits The online repair block reaping code employs static limits to decide if it's time to roll the transaction or finish the deferred item chains to avoid overflowing the scrub transaction's reservation. However, the use of static limits aren't great -- btree blocks are assumed to be scattered around the AG and the buffers need to be invalidated, whereas COW staging extents are usually contiguous and do not have buffers. We would like to configure the limits dynamically. To get ready for this, reorganize struct xreap_state to store dynamic limits, and add helpers to hide some of the details of how the limits are enforced. Also rename the "xreap roll" functions to include the word "binval" because they only exist to decide when we should roll the transaction to deal with buffer invalidations. No functional changes intended here. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit cd32a0c0dcdf634f2e0e71f41c272e19dece6264 Author: Darrick J. Wong Date: Tue Apr 8 16:14:32 2025 -0700 xfs: use deferred intent items for reaping crosslinked blocks When we're removing rmap records for crosslinked blocks, use deferred intent items so that we can try to free/unmap as many of the old data structure's blocks as we can in the same transaction as the commit. Cc: # v6.6 Fixes: 1c7ce115e52106 ("xfs: reap large AG metadata extents when possible") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 599334572a5a99111015fbbd5152ce4dedc2f8b7 Author: Thomas Hellström Date: Thu Sep 4 18:07:15 2025 +0200 drm/xe: Block exec and rebind worker while evicting for suspend / hibernate When the xe pm_notifier evicts for suspend / hibernate, there might be racing tasks trying to re-validate again. This can lead to suspend taking excessive time or get stuck in a live-lock. This behaviour becomes much worse with the fix that actually makes re-validation bring back bos to VRAM rather than letting them remain in TT. Prevent that by having exec and the rebind worker waiting for a completion that is set to block by the pm_notifier before suspend and is signaled by the pm_notifier after resume / wakeup. It's probably still possible to craft malicious applications that block suspending. More work is pending to fix that. v3: - Avoid wait_for_completion() in the kernel worker since it could potentially cause work item flushes from freezable processes to wait forever. Instead terminate the rebind workers if needed and re-launch at resume. (Matt Auld) v4: - Fix some bad naming and leftover debug printouts. - Fix kerneldoc. - Use drmm_mutex_init() for the xe->rebind_resume_lock (Matt Auld). - Rework the interface of xe_vm_rebind_resume_worker (Matt Auld). Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4288 Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v6.16+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-4-thomas.hellstrom@linux.intel.com commit ebd546fdffddfcaeab08afdd68ec93052c8fa740 Author: Thomas Hellström Date: Thu Sep 4 18:07:14 2025 +0200 drm/xe: Allow the pm notifier to continue on failure Its actions are opportunistic anyway and will be completed on device suspend. Marking as a fix to simplify backporting of the fix that follows in the series. v2: - Keep the runtime pm reference over suspend / hibernate and document why. (Matt Auld, Rodrigo Vivi): Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v6.16+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-3-thomas.hellstrom@linux.intel.com commit cb3d7b3b46b799c96b54f8e8fe36794a55a77f0b Author: Thomas Hellström Date: Thu Sep 4 18:07:13 2025 +0200 drm/xe: Attempt to bring bos back to VRAM after eviction VRAM+TT bos that are evicted from VRAM to TT may remain in TT also after a revalidation following eviction or suspend. This manifests itself as applications becoming sluggish after buffer objects get evicted or after a resume from suspend or hibernation. If the bo supports placement in both VRAM and TT, and we are on DGFX, mark the TT placement as fallback. This means that it is tried only after VRAM + eviction. This flaw has probably been present since the xe module was upstreamed but use a Fixes: commit below where backporting is likely to be simple. For earlier versions we need to open- code the fallback algorithm in the driver. v2: - Remove check for dgfx. (Matthew Auld) - Update the xe_dma_buf kunit test for the new strategy (CI) - Allow dma-buf to pin in current placement (CI) - Make xe_bo_validate() for pinned bos a NOP. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5995 Fixes: a78a8da51b36 ("drm/ttm: replace busy placement with flags v6") Cc: Matthew Brost Cc: Matthew Auld Cc: # v6.9+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-2-thomas.hellstrom@linux.intel.com commit 376358bb9770e5313d22d8784511497096cdb75f Author: Slark Xiao Date: Tue Aug 19 10:00:13 2025 +0800 bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU variants Since there are too many variants available for Foxconn T99W696 modem, and they all share the same configuration, use PCI_ANY_ID as the subsystem device ID to match each possible SKUs and support all of them. Signed-off-by: Slark Xiao [mani: reworded subject/description and dropped the fixes tag] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250819020013.122162-1-slark_xiao@163.com commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd Author: Anderson Nascimento Date: Thu Sep 4 16:09:13 2025 +0200 fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing The function do_fanotify_mark() does not validate if mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns. This causes a NULL pointer dereference in do_fanotify_mark() if the path is not a mount namespace object. Fix this by checking mnt_ns_from_dentry()'s return value before dereferencing it. Before the patch $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 Killed int main(void){ int ffd; ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); if(ffd < 0){ perror("fanotify_init"); exit(EXIT_FAILURE); } printf("Fanotify fd: %d\n",ffd); if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){ perror("fanotify_mark"); exit(EXIT_FAILURE); } return 0; } After the patch $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 fanotify_mark: Invalid argument [ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 [ 25.695006] #PF: supervisor read access in kernel mode [ 25.695012] #PF: error_code(0x0000) - not-present page [ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI [ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not tainted 6.17.0-rc4 #1 PREEMPT(lazy) [ 25.695040] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 [ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203 [ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 [ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000 [ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7 [ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0 [ 25.695201] Call Trace: [ 25.695209] [ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30 [ 25.695222] do_syscall_64+0x82/0x2c0 ... Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns") Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com Signed-off-by: Anderson Nascimento Reviewed-by: Christian Brauner Signed-off-by: Jan Kara commit c593b9d6c446510684da400833f9d632651942f0 Author: Jeff Layton Date: Wed Sep 3 11:23:33 2025 -0400 filelock: add FL_RECLAIM to show_fl_flags() macro Show the FL_RECLAIM flag symbolically in tracepoints. Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") Signed-off-by: Jeff Layton Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org Signed-off-by: Christian Brauner commit e493b83b10af01631948d921f02d4ca8577b5051 Merge: 46582a15c1742f 0c43094f8cc9d3 Author: Christian Brauner Date: Fri Sep 5 15:51:29 2025 +0200 Merge patch "eventpoll: Fix priority inversion problem" Nam Cao says: Hi, This v4 is the follow-up to v3 at: https://lore.kernel.org/linux-fsdevel/20250527090836.1290532-1-namcao@linutronix.de/ which resolves a priority inversion problem. The v3 patch was merged, but then got reverted due to regression. The direction of v3 was wrong in the first place. It changed the eventpoll's event list to be lockless, making the code harder to read. I stared at the patch again, but still couldn't figure out what the bug is. The performance numbers were indeed impressive with lockless, but the numbers are from a benchmark, which is unclear whether it really reflects real workload. This v4 takes a completely different approach: it converts the rwlock to spinlock. Unfortunately, unlike rwlock, spinlock does not allow concurrent readers. This patch therefore reduces the performance numbers. I have some optimization tricks to reduce spinlock contention and bring the numbers back. But Linus appeared and declared that epoll's performance shouldn't be the priority. So I decided not to post those optimization patches. * patches from https://lore.kernel.org/cover.1752581388.git.namcao@linutronix.de: eventpoll: Replace rwlock with spinlock Link: https://lore.kernel.org/cover.1752581388.git.namcao@linutronix.de Signed-off-by: Christian Brauner commit 0c43094f8cc9d3d99d835c0ac9c4fe1ccc62babd Author: Nam Cao Date: Tue Jul 15 14:46:34 2025 +0200 eventpoll: Replace rwlock with spinlock The ready event list of an epoll object is protected by read-write semaphore: - The consumer (waiter) acquires the write lock and takes items. - the producer (waker) takes the read lock and adds items. The point of this design is enabling epoll to scale well with large number of producers, as multiple producers can hold the read lock at the same time. Unfortunately, this implementation may cause scheduling priority inversion problem. Suppose the consumer has higher scheduling priority than the producer. The consumer needs to acquire the write lock, but may be blocked by the producer holding the read lock. Since read-write semaphore does not support priority-boosting for the readers (even with CONFIG_PREEMPT_RT=y), we have a case of priority inversion: a higher priority consumer is blocked by a lower priority producer. This problem was reported in [1]. Furthermore, this could also cause stall problem, as described in [2]. Fix this problem by replacing rwlock with spinlock. This reduces the event bandwidth, as the producers now have to contend with each other for the spinlock. According to the benchmark from https://github.com/rouming/test-tools/blob/master/stress-epoll.c: On 12 x86 CPUs: Before After Diff threads events/ms events/ms 8 7162 4956 -31% 16 8733 5383 -38% 32 7968 5572 -30% 64 10652 5739 -46% 128 11236 5931 -47% On 4 riscv CPUs: Before After Diff threads events/ms events/ms 8 2958 2833 -4% 16 3323 3097 -7% 32 3451 3240 -6% 64 3554 3178 -11% 128 3601 3235 -10% Although the numbers look bad, it should be noted that this benchmark creates multiple threads who do nothing except constantly generating new epoll events, thus contention on the spinlock is high. For real workload, the event rate is likely much lower, and the performance drop is not as bad. Using another benchmark (perf bench epoll wait) where spinlock contention is lower, improvement is even observed on x86: On 12 x86 CPUs: Before: Averaged 110279 operations/sec (+- 1.09%), total secs = 8 After: Averaged 114577 operations/sec (+- 2.25%), total secs = 8 On 4 riscv CPUs: Before: Averaged 175767 operations/sec (+- 0.62%), total secs = 8 After: Averaged 167396 operations/sec (+- 0.23%), total secs = 8 In conclusion, no one is likely to be upset over this change. After all, spinlock was used originally for years, and the commit which converted to rwlock didn't mention a real workload, just that the benchmark numbers are nice. This patch is not exactly the revert of commit a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention"), because git revert conflicts in some places which are not obvious on the resolution. This patch is intended to be backported, therefore go with the obvious approach: - Replace rwlock_t with spinlock_t one to one - Delete list_add_tail_lockless() and chain_epi_lockless(). These were introduced to allow producers to concurrently add items to the list. But now that spinlock no longer allows producers to touch the event list concurrently, these two functions are not necessary anymore. Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") Signed-off-by: Nam Cao Link: https://lore.kernel.org/ec92458ea357ec503c737ead0f10b2c6e4c37d47.1752581388.git.namcao@linutronix.de Tested-by: K Prateek Nayak Cc: stable@vger.kernel.org Reported-by: Frederic Weisbecker Closes: https://lore.kernel.org/linux-rt-users/20210825132754.GA895675@lothringen/ [1] Reported-by: Valentin Schneider Closes: https://lore.kernel.org/linux-rt-users/xhsmhttqvnall.mognet@vschneid.remote.csb/ [2] Signed-off-by: Christian Brauner commit 9e05c8dc4e8bb14bdb86eccff1d07169cfd69df8 Author: Luca Ceresoli Date: Fri Aug 8 16:49:09 2025 +0200 drm/display: bridge-connector: remove unused variable assignment The 'bridge' pointer started being assigned and used within this 'if' scope in commit 0beba3f9d366 ("drm/bridge: connector: add support for HDMI codec framework"). After that, commit 5d04b4188959 ("drm/bridge: split HDMI Audio from DRM_BRIDGE_OP_HDMI") removed the code dereferencing it from the same 'if' scope, but did not remove the assignment. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250808-drm-bridge-alloc-getput-for_each_bridge-v2-2-edb6ee81edf1@bootlin.com Signed-off-by: Luca Ceresoli commit b497e1a1a2b10c4ddb28064fba229365ae03311a Author: Woodrow Douglass Date: Fri Sep 5 08:39:43 2025 -0400 regulator: pf530x: Add a driver for the NXP PF5300 Regulator This driver allows reading some regulator settings and adjusting output voltage. It is based on information from the datasheet at https://www.nxp.com/docs/en/data-sheet/PF5300.pdf Signed-off-by: Woodrow Douglass Message-ID: <20250902-pf530x-v7-2-10eb2542f944@carnegierobotics.com> Signed-off-by: Mark Brown commit f5d15ff664a32593e0152d21ea747fb77e32ce7e Author: Woodrow Douglass Date: Fri Sep 5 08:39:42 2025 -0400 regulator: dt-bindings: nxp,pf530x: Add NXP PF5300/PF5301/PF5302 PMICs Bindings for the pf530x series of voltage regulators Signed-off-by: Woodrow Douglass Reviewed-by: Krzysztof Kozlowski Message-ID: <20250902-pf530x-v7-1-10eb2542f944@carnegierobotics.com> Signed-off-by: Mark Brown commit 629a2b18e8729497eeac5b63e575e0961ca3a4ab Author: Sven Eckelmann Date: Thu Aug 28 20:21:43 2025 +0200 batman-adv: remove includes for extern declarations It is not necessary to include the header for the struct definition for an "extern " declaration. It can simply be dropped from the headers to reduce the number of includes the preprocessor has to process. If needed, it can be added to the actual C source file. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit d5d80ac74f80fab4e2647c1030053d71d8c81bc9 Author: Sven Eckelmann Date: Thu Aug 28 17:58:59 2025 +0200 batman-adv: keep skb crc32 helper local in BLA The batadv_skb_crc32() helper was shared between Bridge Loop Avoidance and Network Coding. With the removal of the network coding feature, it is possible to just move this helper directly to Bridge Loop Avoidance. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 87b95082db32ae1cfe66d04052da8c6b21531110 Author: Sven Eckelmann Date: Thu Aug 28 17:33:48 2025 +0200 batman-adv: remove network coding support The Network Coding feature, introduced in 2013, is based on the master thesis "Inter-Flow Network Coding for Wireless Mesh Networks". It relies on the assumption that neighboring mesh nodes can reliably overhear each other's transmissions in promiscuous mode, allowing packets to be combined to reduce forwarding overhead. This assumption no longer holds for modern wireless mesh networks, which are heterogeneous and make overhearing increasingly unreliable. Factors such as multiple spatial streams, varying data rates, beamforming, and OFDMA all prevent nodes from consistently overhearing each other. The current implementation in batman-adv is not able to detect these conditions and would require a more complex layer beyond its neighbor discovery process to do so. In addition, the feature has been unmaintained for years and is discouraged for use. None of the current maintainers have the required test setup to verify its functionality, and known issues remain in its data structures (reference counting, RCU usage, and cleanup handling). Its continued presence also blocks necessary refactoring of the core originator infrastructure. Remove this obsolete and unmaintained feature. Signed-off-by: Sven Eckelmann Acked-by: Martin Hundebøll Acked-by: Marek Lindner Signed-off-by: Simon Wunderlich commit e89888a1e778db5954e702defc44cfbc4ebe92c2 Author: Simon Wunderlich Date: Thu Aug 28 20:28:30 2025 +0200 batman-adv: Start new development cycle This version will contain all the (major or even only minor) changes for Linux 6.18. The version number isn't a semantic version number with major and minor information. It is just encoding the year of the expected publishing as Linux -rc1 and the number of published versions this year (starting at 0). Signed-off-by: Simon Wunderlich commit 4f901b3dce57d26c6ae869607d2e16296587a250 Author: Sunil V L Date: Mon Aug 18 10:28:07 2025 +0530 iommu/riscv: Add ACPI support RISC-V IO Mapping Table (RIMT) provides the information about the IOMMU to the OS in ACPI. Add support for ACPI in RISC-V IOMMU drivers by using RIMT data. The changes at high level are, a) Register the IOMMU with RIMT data structures. b) Enable probing of platform IOMMU in ACPI way using the ACPIID defined for the RISC-V IOMMU in the BRS spec [1]. Configure the MSI domain if the platform IOMMU uses MSIs. [1] - https://github.com/riscv-non-isa/riscv-brs/blob/main/acpi-id.adoc Signed-off-by: Sunil V L Reviewed-by: Andrew Jones Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250818045807.763922-4-sunilvl@ventanamicro.com Signed-off-by: Joerg Roedel commit cbf4fbc484e1730cbcb5187b923fadc842f632ce Author: Sunil V L Date: Mon Aug 18 10:28:06 2025 +0530 ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id() acpi_iommu_configure_id() currently supports only IORT (ARM) and VIOT. Add support for RISC-V as well. Signed-off-by: Sunil V L Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250818045807.763922-3-sunilvl@ventanamicro.com Signed-off-by: Joerg Roedel commit 8f77295525825086cb43675cd1a4f3716b119d7f Author: Sunil V L Date: Mon Aug 18 10:28:05 2025 +0530 ACPI: RISC-V: Add support for RIMT RISC-V IO Mapping Table (RIMT) is a static ACPI table to communicate IOMMU information to the OS. The spec is available at [1]. The changes at high level are, a) Initialize data structures required for IOMMU/device configuration using the data from RIMT. Provide APIs required for device configuration. b) Provide an API for IOMMU drivers to register the fwnode with RIMT data structures. This API will create a fwnode for PCIe IOMMU. [1] - https://github.com/riscv-non-isa/riscv-acpi-rimt Signed-off-by: Sunil V L Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250818045807.763922-2-sunilvl@ventanamicro.com Signed-off-by: Joerg Roedel commit e520b2520c81c5e4fe1b8ef09cb75c132debe9ac Author: Qianfeng Rong Date: Fri Aug 29 22:02:19 2025 +0800 iommu/omap: Use int type to store negative error codes Change the 'ret' variable from u32 to int to store negative error codes or zero; Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250829140219.121783-1-rongqianfeng@vivo.com Signed-off-by: Joerg Roedel commit c9e70639f5915f2d084a0126e62fe53a52c29cea Author: LiangCheng Wang Date: Tue Sep 2 14:53:20 2025 +0800 drm: tiny: Add support for Mayqueen Pixpaper e-ink panel Introduce a DRM driver for the Mayqueen Pixpaper e-ink display panel, which is controlled via SPI. The driver supports a 122x250 resolution display with XRGB8888 format. Also, add a MAINTAINERS entry for the Pixpaper driver. Signed-off-by: LiangCheng Wang Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250902-drm-v5-3-d77c678c4ae3@gmail.com commit d309c5fdf4a795e587f1852e2caf7f205c1bdffc Author: LiangCheng Wang Date: Tue Sep 2 14:53:19 2025 +0800 dt-bindings: display: Add Mayqueen Pixpaper e-ink panel The binding is for the Mayqueen Pixpaper e-ink display panel, controlled via an SPI interface. Signed-off-by: LiangCheng Wang Reviewed-by: Rob Herring (Arm) Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250902-drm-v5-2-d77c678c4ae3@gmail.com commit 09b26dce32f0d3065e6cfbc1095fc21fd5159921 Author: Wig Cheng Date: Tue Sep 2 14:53:18 2025 +0800 dt-bindings: vendor-prefixes: Add Mayqueen name Mayqueen is a Taiwan-based company primarily focused on the development of arm64 development boards and e-paper displays. Signed-off-by: Wig Cheng Acked-by: Rob Herring (Arm) Acked-by: Krzysztof Kozlowski Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250902-drm-v5-1-d77c678c4ae3@gmail.com commit 87b0a0f6bc14a95101db1502ef0b8a2ddc378e8e Author: Chen Ni Date: Fri Sep 5 15:37:12 2025 +0800 drm/ast: ast_2100: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250905073712.3791260-1-nichen@iscas.ac.cn commit ecf6508923f87e4597228f70cc838af3d37f6662 Author: Hector Martin Date: Tue Aug 26 12:57:18 2025 +0200 iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs These registers exist and at least on the t602x variant the IRQ only clears when theses are cleared. Signed-off-by: Hector Martin Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250826-dart-t8110-stream-error-v1-1-e33395112014@jannau.net Signed-off-by: Joerg Roedel commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb Author: Ashish Kalra Date: Mon Aug 25 21:46:53 2025 +0000 iommu/amd: Skip enabling command/event buffers for kdump After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled. IOMMU command buffers and event buffer registers remain locked and exclusive to the previous kernel. Attempts to enable command and event buffers in the kdump kernel will fail, as hardware ignores writes to the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1. Skip enabling command buffers and event buffers for kdump boot as they are already enabled in the previous kernel. Reviewed-by: Vasant Hegde Tested-by: Sairaj Kodilkar Signed-off-by: Ashish Kalra Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com Signed-off-by: Joerg Roedel commit 8c571019d8a817b701888926529a5d7a826b947b Author: Ashish Kalra Date: Mon Aug 25 21:46:38 2025 +0000 crypto: ccp: Skip SEV and SNP INIT for kdump boot Since SEV or SNP may already be initialized in the previous kernel, attempting to initialize them again in the kdump kernel can result in SNP initialization failures, which in turn lead to IOMMU initialization failures. Moreover, SNP/SEV guests are not run under a kdump kernel, so there is no need to initialize SEV or SNP during kdump boot. Skip SNP and SEV INIT if doing kdump boot. Tested-by: Sairaj Kodilkar Signed-off-by: Ashish Kalra Link: https://lore.kernel.org/r/d884eff5f6180d8b8c6698a6168988118cf9cba1.1756157913.git.ashish.kalra@amd.com Signed-off-by: Joerg Roedel commit 38e5f33ee3596f37ee8d1e694073a17590904004 Author: Ashish Kalra Date: Mon Aug 25 21:46:15 2025 +0000 iommu/amd: Reuse device table for kdump After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled. IOMMU device table register is locked and exclusive to the previous kernel. Attempts to copy old device table from the previous kernel fails in kdump kernel as hardware ignores writes to the locked device table base address register as per AMD IOMMU spec Section 2.12.2.1. This causes the IOMMU driver (OS) and the hardware to reference different memory locations. As a result, the IOMMU hardware cannot process the command which results in repeated "Completion-Wait loop timed out" errors and a second kernel panic: "Kernel panic - not syncing: timer doesn't work through Interrupt-remapped IO-APIC". Reuse device table instead of copying device table in case of kdump boot and remove all copying device table code. Reviewed-by: Vasant Hegde Tested-by: Sairaj Kodilkar Signed-off-by: Ashish Kalra Link: https://lore.kernel.org/r/3a31036fb2f7323e6b1a1a1921ac777e9f7bdddc.1756157913.git.ashish.kalra@amd.com Signed-off-by: Joerg Roedel commit f32fe7cb019861f585b40bff4c3daf237b9af294 Author: Ashish Kalra Date: Mon Aug 25 21:46:01 2025 +0000 iommu/amd: Add support to remap/unmap IOMMU buffers for kdump After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled. IOMMU completion wait buffers (CWBs), command buffers and event buffer registers remain locked and exclusive to the previous kernel. Attempts to allocate and use new buffers in the kdump kernel fail, as hardware ignores writes to the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1. This results in repeated "Completion-Wait loop timed out" errors and a second kernel panic: "Kernel panic - not syncing: timer doesn't work through Interrupt-remapped IO-APIC" The list of MMIO registers locked and which ignore writes after failed SNP shutdown are mentioned in the AMD IOMMU specifications below: Section 2.12.2.1. https://docs.amd.com/v/u/en-US/48882_3.10_PUB Reuse the pages of the previous kernel for completion wait buffers, command buffers, event buffers and memremap them during kdump boot and essentially work with an already enabled IOMMU configuration and re-using the previous kernel’s data structures. Reusing of command buffers and event buffers is now done for kdump boot irrespective of SNP being enabled during kdump. Re-use of completion wait buffers is only done when SNP is enabled as the exclusion base register is used for the completion wait buffer (CWB) address only when SNP is enabled. Reviewed-by: Vasant Hegde Tested-by: Sairaj Kodilkar Signed-off-by: Ashish Kalra Link: https://lore.kernel.org/r/ff04b381a8fe774b175c23c1a336b28bc1396511.1756157913.git.ashish.kalra@amd.com Signed-off-by: Joerg Roedel commit c4dfa0bea23df9a6870df439f2bae43ecbb73822 Author: Sanjay Yadav Date: Thu Sep 4 21:44:23 2025 +0530 drm/xe/migrate: Remove unneeded emit_pte() when copying CCS only In xe_migrate_copy(), when copy_only_ccs is true, we only need two emit_pte() calls one for the BO and one for the raw CCS storage. However, the current implementation issues three emit_pte() calls, resulting in an unnecessary PTE programming job. This fix removes the redundant emit_pte() call to avoid programming the same PTEs twice and reducing overhead during CCS-only migration. v2: Preserve correct behavior on DG2, which requires both CCS and page copies. Signed-off-by: Sanjay Yadav Suggested-by: Matthew Auld Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://lore.kernel.org/r/20250904161423.2448727-1-sanjay.kumar.yadav@intel.com commit 5229bd5f9e3dbc1d97fb76fd022fb66968779ca4 Author: Hector Martin Date: Thu Aug 21 12:16:00 2025 +0200 iommu/apple-dart: Add 4-level page table support The T8110 variant DART implementation on T602x SoCs indicates an IAS of 42, which requires an extra page table level. The extra level is optional, but let's implement it. Later it might be useful to restrict this based on the actual attached devices, since most won't need that much address space anyway. Signed-off-by: Hector Martin Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250821-apple-dart-4levels-v2-3-e39af79daa37@jannau.net Signed-off-by: Joerg Roedel commit 74a0e72f03ffd01b5d88b411f02d9b9861fdb99e Author: Hector Martin Date: Thu Aug 21 12:15:59 2025 +0200 iommu/io-pgtable-dart: Add 4-level page table support DARTs on t602x SoCs are of the t8110 variant but have an IAS of 42, which means optional support for an extra page table level. Refactor the PTE management to support an arbitrary level count, and then calculate how many levels we need for any given configuration. Signed-off-by: Hector Martin Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250821-apple-dart-4levels-v2-2-e39af79daa37@jannau.net Signed-off-by: Joerg Roedel commit 126889008694934f10a385cc05afc0e25b9e75ef Author: Hector Martin Date: Thu Aug 21 12:15:58 2025 +0200 iommu/apple-dart: Make the hw register fields u32s The registers are 32-bit and the offsets definitely don't need 64 bits either, these should've been u32s. Signed-off-by: Hector Martin Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250821-apple-dart-4levels-v2-1-e39af79daa37@jannau.net Signed-off-by: Joerg Roedel commit d3d3b6042751ba2d21f6dc5fffc0b2c16b30ad3a Author: Xichao Zhao Date: Mon Aug 18 15:05:56 2025 +0800 iommu/amd: use str_plural() to simplify the code Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao Reviewed-by: Ankit Soni Link: https://lore.kernel.org/r/20250818070556.458271-1-zhao.xichao@vivo.com Signed-off-by: Joerg Roedel commit 70a9b201cfa893fd0b7125c8f9205d9e12e02ba5 Author: Juha-Pekka Heikkila Date: Fri Sep 5 13:46:26 2025 +0300 drm/i915/display: Avoid divide by zero skl_crtc_allocate_plane_ddb allow iter.data_rate to be zero which could cause divide by zero in skl_allocate_plane_ddb, check against that. Signed-off-by: Juha-Pekka Heikkila Reviewed-by: Suraj Kandpal Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250905104626.1274147-3-juhapekka.heikkila@gmail.com commit 1de89eca2004ebf0858cde504c903430b60f0975 Author: Juha-Pekka Heikkila Date: Fri Sep 5 13:46:25 2025 +0300 drm/i915/display: log fail from intel_sdvo_enable_hotplug Report in log if intel_sdvo_enable_hotplug failed Signed-off-by: Juha-Pekka Heikkila Reviewed-by: Suraj Kandpal Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250905104626.1274147-2-juhapekka.heikkila@gmail.com commit 7d8a7ec813f4ee1ec4b0f94a7ec2a4d4918f43f5 Author: Juha-Pekka Heikkila Date: Fri Sep 5 13:46:24 2025 +0300 drm/i915/display: take out dead code if __waitfor timeout, ret will have -ETIMEDOUT. Then if condition was met, and read_ret will have error that's handled. Then if ret was zero, read_ret was zero ksv_ready must have value. Signed-off-by: Juha-Pekka Heikkila Reviewed-by: Jani Nikula Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250905104626.1274147-1-juhapekka.heikkila@gmail.com commit f4c45db8a10b270bdd4a1644f545576c03ead523 Author: Raphael Gallais-Pou Date: Fri Aug 29 11:13:25 2025 +0200 dt-bindings: panel: lvds: Append edt,etml0700z8dha in panel-lvds List EDT ETML0700Z8DHA in the LVDS panel enumeration. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250829-drm-misc-next-v1-1-fedb48cf50dd@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 0d4a57f08b8320f7f65b54e4ff3ca1f55c6d70b1 Author: Ville Syrjälä Date: Tue Sep 2 16:31:13 2025 +0300 drm/i915/dram: Print memory details even if something went wrong Print the memory details even if the detection failed in some way but we continued the driver initialization anyway. It'll be easier to debug issues if we at least know what the final results were. And while at it also print the number of PSF GV points. Previously we only printed the QGV points. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-9-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit a6d31e18c01211b041d416661b9ccfd75475e01b Author: Ville Syrjälä Date: Tue Sep 2 16:31:12 2025 +0300 drm/i915/dram: Don't call skl_get_dram_info()/skl_get_dram_type() on icl Currently the icl codepaths first determine the memory type from the memory controller registers (via skl_get_dram_info()->skl_get_dram_type()) and then overwrite the results with icl_pcode_read_mem_global_info(). Get rid of the pointless (and potentially incorrect) skl_get_dram_type() stuff. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-8-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 4dfd3a56d653a96dad964c3c6f2444adb3d9c4fe Author: Ville Syrjälä Date: Tue Sep 2 16:31:11 2025 +0300 drm/i915/dram: Fix some spelling around the 16Gb DIMM w/a Use consistent spelling when talking about the 16Gb DIMM w/a. Even currently language is a bit off as the w/a is actually about DIMMs with 16Gb DRAM devices on them, not the total capacity of the whole DIMM. But this language does more or less match how Bspec talks about this stuff. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-7-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 84b72b545c0fe1fc3ecbe80a499f27da1de9a9e5 Author: Ville Syrjälä Date: Tue Sep 2 16:31:10 2025 +0300 drm/i915/dram: Move 16Gb DIMM detection fully to the skl/icl codepaths We are incorrectly applying the 16Gb DIMM w/a (adding 1 extra usec to WM0 latency) on MTL+ even though the w/a is only needed for SKL/ICL. The current way of setting this is up is a bit of a disaster: 1. always set has_16gb_dimms=true for all platforms except BXT/GLK 2. has_16gb_dimms potentially gets overwritten with something else * BXT/GLK don't do anything since we never set has_16gb_dimms to begin with * skl_get_dram_info() overwrites has_16gb_dimms with the actual detection results for SKL/ICL/derivatives * gen12_get_dram_info() (correctly) resets has_16gb_dimms for TGL/ADL/derivatives * xelpdp_get_dram_info() doesn't do anything, leaving has_16gb_dimms incorrectly set for MTL+ Clean up the whole mess by only setting has_16gb_dimms in the SKL/ICL codepaths where we have the actual detection code for it. This avois applying the w/a incorrectly on MTL+. v2: Rewrite commit msg (Jani) Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 115cebc303db60ed7df85366aa10ef2a1780e3b1 Author: Ville Syrjälä Date: Tue Sep 2 16:31:09 2025 +0300 drm/i915/dram: s/wm_lv0.../has_16gb_dimms/ The DRAM code shouldn't know anything about watermarks. Rename wm_lv_0_adjust_needed to has_16gb_dimms. How this gets used is up to the watermark code. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit da548f7e781d3abc6ecbc08cc8b18ffaa3211653 Author: Ville Syrjälä Date: Tue Sep 2 16:31:08 2025 +0300 drm/i915/dram: Pack dram_info better struct dram_info has two holes in the middle. Shuffle things around to plug them. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 413439008ca409da8d46957cf598a125aa32fdd4 Author: Ville Syrjälä Date: Tue Sep 2 16:31:07 2025 +0300 drm/i915/dram: Use intel_dram_type_str() for pnv Replace the hand rolled PNV memory type printk string stuff with intel_dram_type_str(). Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 3a64c199634457f0e159690510321e4778fb45a0 Author: Ville Syrjälä Date: Tue Sep 2 16:31:06 2025 +0300 drm/i915/dram: Populate PNV memory type accurately If PNV doesn't have DDR3 then it has DDR2. Add the appropriate memory type for it. No functional change since we currently only care about the DDR3 vs. not difference. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902133113.18778-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 8d87f08ba08646d21b9d6913fe63c463c9025250 Author: Ville Syrjälä Date: Tue Sep 2 18:39:15 2025 +0300 drm/i915/hpd: Fix mtp_tc_hpd_enable_detection() Set the MTP TC hotplug bits in the correct register. Shouldn't matter really as this only gets used for eDP detection and there should be never eDP on TC ports on current hw. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250902153915.4423-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 2d1e962098e294330a07ab7e91ee0f35121a6964 Author: Michal Wajdeczko Date: Thu Sep 4 16:40:26 2025 +0200 drm/xe: Fix broken kernel-doc for the struct xe_bo Use correct multi-line kernel-doc style if required. Some members were described only in the commit message. Some other members were described using wrong names. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250904144026.7222-1-michal.wajdeczko@intel.com commit 2ce575d6a1be4ef03c804db0f668527af426472c Author: Imre Deak Date: Wed Sep 3 15:21:52 2025 +0300 drm/i915/display: Remove power state verification before HW readout During system resume the display power state verification will print the "power well x state mismatch (refcount 0/enabled 1)" error message from the early resume sequence for a power well left enabled by BIOS. This power well was probably left enabled by BIOS inadvertently, since BIOS versions on current platforms do not leave any display output enabled while resuming from an Sx power state, hence the enabled display power well is unused. In theory however it is possible that BIOS leaves a display output enabled, in that case the enabled power well shouldn't be reported as an error. According to the above, remove the display power state verification from the early resume phase to avoid incorrectly reporting an enabled power well without a power reference as an error. Note: The refcount for any enabled and used power well (i.e. used for an enabled display output) will be acquired following the early resume sequence, after the HW state for display outputs (encoder/crtc etc.) is read out. Any power well enabled but not used (hence not holding a reference) will be disabled after the HW state readout. The display power state will be verified afterwards in intel_power_domains_enable(). Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6012 Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250903122152.2526050-1-imre.deak@intel.com commit 7a9b19cca035d9514ec1bb3d7fb65e56bbd18083 Author: Liao Yuanhong Date: Thu Sep 4 19:27:38 2025 +0800 drm/sti: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Acked-by: Raphaël Gallais-Pou Link: https://lore.kernel.org/r/20250904112738.350652-1-liaoyuanhong@vivo.com Signed-off-by: Raphael Gallais-Pou commit 9e5eb8b49ffe3c173bf7b8c338a57dfa09fb4634 Author: Marco Crivellari Date: Fri Sep 5 11:10:15 2025 +0200 ASoC: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. queue_work() / queue_delayed_work() / mod_delayed_work() will now use the new unbound wq: whether the user still use the old wq a warn will be printed along with a wq redirect to the new one. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Message-ID: <20250905091016.109428-2-marco.crivellari@suse.com> Signed-off-by: Mark Brown commit be585f7ebc99598edf97c3001d0f8d67954ab376 Author: Charles Han Date: Fri Sep 5 17:18:44 2025 +0800 ASoC: codecs: fs210x: Add NULL check in fs210x_register_snd_component Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: 756117701779 ("ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver") Signed-off-by: Charles Han Message-ID: <20250905091845.1559-1-hanchunchao@inspur.com> Signed-off-by: Mark Brown commit dcc38bc5e13701a2401f0873a38e447fefe1a1af Author: Michal Wajdeczko Date: Fri Aug 29 19:19:21 2025 +0200 drm/xe/kunit: Drop xe_wa_test_exit Remove xe_wa_test_exit() as it could crach the KUnit kernel in case of hitting some asserts in xe_wa_test_init() as test->priv could not be pointing to expected data. | # xe_wa_gt: ASSERTION FAILED at drivers/gpu/drm/xe/tests/xe_wa_test.c:34 | Expected ret == 0, but | ret == -19 (0xffffffffffffffed) |Bus error - the host /dev/shm or /tmp mount likely just ran out of space |Kernel panic - not syncing: Kernel mode signal 7 Note that there is no need to call drm_kunit_helper_free_device() since our fake device allocated by drm_kunit_helper_alloc_device() will be cleaned up automatically. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-7-michal.wajdeczko@intel.com commit a9c8517058cc425dc983ad0f22e6dc3b810ff773 Author: Michal Wajdeczko Date: Fri Aug 29 19:19:20 2025 +0200 drm/xe/kunit: Promote fake platform parameter list The list of all known representative platforms defined in xe_wa could be used in more places by other test suites. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-6-michal.wajdeczko@intel.com commit ddbe5aecea846fd8f7510540e720919d5d781bd9 Author: Michal Wajdeczko Date: Fri Aug 29 19:19:19 2025 +0200 drm/xe/kunit: Drop custom struct platform_test_case Custom struct platform_test_case definition in xe_wa is now almost identical to generic struct xe_pci_fake_data defintiion except the .name member, which could be generated by xe_pci_fake_data_desc(). Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-5-michal.wajdeczko@intel.com commit b1ee6558433be01cf15c180aec54cb79ccaa64e8 Author: Michal Wajdeczko Date: Fri Aug 29 19:19:18 2025 +0200 drm/xe/kunit: Introduce xe_pci_fake_data_desc() We already use struct xe_pci_fake_data to provide custom config of the fake PCI device and soon we will be using this struct also as direct parameter for the parameterized Xe KUnit tests. Add function to generate description based on that config data. For platform or subplatform name lookup pciidlist which already have definitions of all supported platforms. Examples: TIGERLAKE TIGERLAKE A0 TIGERLAKE SR-IOV PF ... PANTHERLAKE 30.00(Xe3_LPG) 30.00(Xe3_LPM) PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0 PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0 SR-IOV VF Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-4-michal.wajdeczko@intel.com commit 42367babd859fb75c3737c520f6541d542f19ba5 Author: Michal Wajdeczko Date: Fri Aug 29 19:19:17 2025 +0200 drm/xe/kunit: Update struct xe_pci_fake_data step declarations The struct xe_pci_fake_data has fields that specify graphics and media stepping of the fake PCI device used during KUnit testing. Change definitions of those separate step fields and use existing struct xe_step_info definition that already have required fields. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-3-michal.wajdeczko@intel.com commit 981daf1046ef3776ce63fbf11b0261569e858e46 Author: Michal Wajdeczko Date: Fri Aug 29 19:19:16 2025 +0200 drm/xe: Allow to stub lookup for graphics and media IP In upcoming patch we will want to replace lookup code during the test to relax the strict match that we use in production. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250829171922.572-2-michal.wajdeczko@intel.com commit edb1745fc618ba8ef63a45ce3ae60de1bdf29231 Author: Matthew Auld Date: Fri Aug 29 17:47:16 2025 +0100 drm/xe: improve dma-resv handling for backup object Since the dma-resv is shared we don't need to reserve and add a fence slot fence twice, plus no need to loop through the dependencies. Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250829164715.720735-2-matthew.auld@intel.com commit 7477c4bd20dc1aba02ef2d955591826da24e2b04 Author: Matthew Auld Date: Thu Aug 28 15:24:39 2025 +0100 drm/xe/pt: unify xe_pt_svm_pre_commit with userptr We now use the same notifier lock for SVM and userptr, with that we can combine xe_pt_userptr_pre_commit and xe_pt_svm_pre_commit. v2: (Matt B) - Re-use xe_svm_notifier_lock/unlock for userptr. - Combine svm/userptr handling further down into op_check_svm_userptr. v3: - Only hide the ops if we lack DRM_GPUSVM, since we also need them for userptr. Suggested-by: Matthew Brost Signed-off-by: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-18-matthew.auld@intel.com commit 9e978741488261e117bb50e5dfcf8e4080990958 Author: Matthew Auld Date: Thu Aug 28 15:24:38 2025 +0100 drm/xe/userptr: replace xe_hmm with gpusvm Goal here is cut over to gpusvm and remove xe_hmm, relying instead on common code. The core facilities we need are get_pages(), unmap_pages() and free_pages() for a given useptr range, plus a vm level notifier lock, which is now provided by gpusvm. v2: - Reuse the same SVM vm struct we use for full SVM, that way we can use the same lock (Matt B & Himal) v3: - Re-use svm_init/fini for userptr. v4: - Allow building xe without userptr if we are missing DRM_GPUSVM config. (Matt B) - Always make .read_only match xe_vma_read_only() for the ctx. (Dafna) v5: - Fix missing conversion with CONFIG_DRM_XE_USERPTR_INVAL_INJECT v6: - Convert the new user in xe_vm_madise. Signed-off-by: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Dafna Hirschfeld Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-17-matthew.auld@intel.com commit dd25b995a2711cb135dba9af7670c6debeea7b04 Author: Matthew Auld Date: Thu Aug 28 15:24:37 2025 +0100 drm/xe/vm: split userptr bits into separate file This will simplify compiling out the bits that depend on DRM_GPUSVM in a later patch. Without this we end up littering the code with ifdef checks, plus it becomes hard to be sure that something won't blow at runtime due to something not being initialised, even though it passed the build. Should be no functional change here. Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-16-matthew.auld@intel.com commit 83f706ecbde1dfdc377bafda773fdc57644cd479 Author: Matthew Auld Date: Thu Aug 28 15:24:36 2025 +0100 drm/gpusvm: export drm_gpusvm_pages API Export get/unmap/free pages API. We also need to tweak the SVM init to allow skipping much of the unneeded parts. Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-15-matthew.auld@intel.com commit 6364afd532bcabf4a12bea44c3dd4c291e31a83e Author: Matthew Auld Date: Thu Aug 28 15:24:35 2025 +0100 drm/gpusvm: refactor core API to use pages struct Refactor the core API of get/unmap/free pages to all operate on drm_gpusvm_pages. In the next patch we want to export a simplified core API without needing fully blown svm range etc. Suggested-by: Matthew Brost Signed-off-by: Matthew Auld Cc: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-14-matthew.auld@intel.com commit f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 Author: Matthew Auld Date: Thu Aug 28 15:24:34 2025 +0100 drm/gpusvm: pull out drm_gpusvm_pages substructure Pull the pages stuff from the svm range into its own substructure, with the idea of having the main pages related routines, like get_pages(), unmap_pages() and free_pages() all operating on some lower level structures, which can then be re-used for stuff like userptr. v2: - Move seq into pages struct (Matt B) v3: - Small kernel-doc fixes Suggested-by: Matthew Brost Signed-off-by: Matthew Auld Cc: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-13-matthew.auld@intel.com commit ad70e289ed4b1f87d4f158fd1ad5a3225256929d Author: Matthew Auld Date: Thu Aug 28 15:24:33 2025 +0100 drm/gpusvm: use more selective dma dir in get_pages() If we are only reading the memory then from the device pov the direction can be DMA_TO_DEVICE. This aligns with the xe-userptr code. Using the most restrictive data direction to represent the access is normally a good idea. Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250828142430.615826-12-matthew.auld@intel.com commit c50729c68aaf93611c855752b00e49ce1fdd1558 Author: Matthew Auld Date: Thu Aug 28 15:24:32 2025 +0100 drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas) Reported-by: Thomas Hellström Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250828142430.615826-11-matthew.auld@intel.com commit 9f34032ec0deef58bd0eb7475f1981adfa998648 Author: Yazen Ghannam Date: Mon Aug 25 17:33:03 2025 +0000 x86/mce: Remove __mcheck_cpu_init_early() The __mcheck_cpu_init_early() function was introduced so that some vendor-specific features are detected before the first MCA polling event done in __mcheck_cpu_init_generic(). Currently, __mcheck_cpu_init_early() is only used on AMD-based systems and additional code will be needed to support various system configurations. However, the current and future vendor-specific code should be done during vendor init. This keeps all the vendor code in a common location and simplifies the generic init flow. Move all the __mcheck_cpu_init_early() code into mce_amd_feature_init(). Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Reviewed-by: Nikolay Borisov Tested-by: Tony Luck Link: https://lore.kernel.org/20250825-wip-mca-updates-v5-6-865768a2eef8@amd.com commit 0f134c53246366c00664b640f9edc9be5db255b3 Author: Borislav Petkov Date: Mon Aug 25 17:33:02 2025 +0000 x86/mce: Cleanup bank processing on init Unify the bank preparation into __mcheck_cpu_init_clear_banks(), rename that function to what it does now - prepares banks. Do this so that generic and vendor banks init goes first so that settings done during that init can take effect before the first bank polling takes place. Move __mcheck_cpu_check_banks() into __mcheck_cpu_init_prepare_banks() as it already loops over the banks. The MCP_DONTLOG flag is no longer needed, since the MCA polling function is now called only if boot-time logging should be done. Signed-off-by: Borislav Petkov Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Tested-by: Tony Luck Link: https://lore.kernel.org/20250825-wip-mca-updates-v5-5-865768a2eef8@amd.com commit c4bac5c640e3782bf30c07c4d82042d0202fe224 Author: Yazen Ghannam Date: Tue Jun 24 14:16:03 2025 +0000 x86/mce/amd: Put list_head in threshold_bank The threshold_bank structure is a container for one or more threshold_block structures. Currently, the container has a single pointer to the 'first' threshold_block structure which then has a linked list of the remaining threshold_block structures. This results in an extra level of indirection where the 'first' block is checked before iterating over the remaining blocks. Remove the indirection by including the head of the block list in the threshold_bank structure which already acts as a container for all the bank's thresholding blocks. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Tested-by: Tony Luck Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-8-236dd74f645f@amd.com commit b249288abde5190bb113ea5acef8af4ceac4957c Author: Yazen Ghannam Date: Mon Aug 25 17:33:00 2025 +0000 x86/mce/amd: Remove smca_banks_map The MCx_MISC0[BlkPtr] field was used on legacy systems to hold a register offset for the next MCx_MISC* register. In this way, an implementation-specific number of registers can be discovered at runtime. The MCAX/SMCA register space simplifies this by always including the MCx_MISC[1-4] registers. The MCx_MISC0[BlkPtr] field is used to indicate (true/false) whether any MCx_MISC[1-4] registers are present. Currently, MCx_MISC0[BlkPtr] is checked early and cached to be used during sysfs init later. This is unnecessary as the MCx_MISC0 register is read again later anyway. Remove the smca_banks_map variable as it is effectively redundant, and use a direct register/bit check instead. [ bp: Zap smca_get_block_address() too. ] Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Reviewed-by: Tony Luck Tested-by: Tony Luck Link: https://lore.kernel.org/20250825-wip-mca-updates-v5-3-865768a2eef8@amd.com commit 4d2161b9e8ba64076f520ec2f00eefb00722c15e Author: Yazen Ghannam Date: Tue Jun 24 14:16:01 2025 +0000 x86/mce/amd: Remove return value for mce_threshold_{create,remove}_device() The return values are not checked, so set return type to 'void'. Also, move function declarations to internal.h, since these functions are only used within the MCE subsystem. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-6-236dd74f645f@amd.com commit 9af8b441cf6953f683b825fbf241a979ea7521e8 Author: Yazen Ghannam Date: Tue Jun 24 14:16:00 2025 +0000 x86/mce/amd: Rename threshold restart function It operates per block rather than per bank. So rename it for clarity. No functional changes. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250624-wip-mca-updates-v4-5-236dd74f645f@amd.com commit 5952d80514054d12d2ec72aa111c2e09eb70e881 Author: Harish Chegondi Date: Tue Sep 2 16:42:00 2025 -0700 drm/xe/xe2hpg: Add Wa_18041344222 for Xe2_HPG Add Wa_18041344222 for Xe2_HPG that requires disabling the perf mode for subslice count for eustall sampling when the enabled slices are discontiguous. Bspec: 79483, 56024 Cc: Lucas De Marchi Reviewed-by: Matt Atwood Signed-off-by: Harish Chegondi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/b6a631a13a9fb7360e89d679e0797fae42d5a09e.1756855529.git.harish.chegondi@intel.com Signed-off-by: Lucas De Marchi commit 6ee8adf124102aa679d13b8c3cbe391f544ba90a Author: Harish Chegondi Date: Tue Sep 2 16:41:59 2025 -0700 drm/xe/mcr: Make xe_gt_mcr_get_dss_steering() input gt a const Make gt, input parameter to xe_gt_mcr_get_dss_steering(), a constant. This would allow xe_gt_mcr_get_dss_steering() to be called from functions that have gt as const to struct xe_gt. Cc: Lucas De Marchi Reviewed-by: Matt Atwood Signed-off-by: Harish Chegondi Link: https://lore.kernel.org/r/9dc621a90880f62ac8e2951afea7952277f7eb0e.1756855529.git.harish.chegondi@intel.com Signed-off-by: Lucas De Marchi commit 2c907d852c57551ca5481409da33b67fd3800af3 Author: Liu Ying Date: Fri Aug 29 15:53:14 2025 +0800 drm/panel: lvds: Remove unused members from main structure Since commit 03fa454bb666 ("drm/panel: lvds: Simplify mode parsing"), the width and height members of struct panel_lvds are no longer used. Remove them. No functional change. Signed-off-by: Liu Ying Reviewed-by: Neil Armstrong Reviewed-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20250829-panel-lvds-remove-width-height-v1-1-acecf0c84dc4@nxp.com commit e3ac93e9d916ebae0711a42f524429dad89c4887 Author: Dan Carpenter Date: Fri Sep 5 11:02:14 2025 +0300 wifi: mwifiex: fix double free in mwifiex_send_rgpower_table() The "hostcmd" is freed using cleanup.h, so calling kfree() will lead to a double free. Delete the kfree(). Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support") Signed-off-by: Dan Carpenter Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/aLqZBh5_dSHUb4AE@stanley.mountain Signed-off-by: Johannes Berg commit 33ddc796ecbd50cd6211aa9e9eddbf4567038b49 Author: Marcelo Moreira Date: Wed Aug 27 19:17:07 2025 -0300 xfs: Replace strncpy with memcpy The changes modernizes the code by aligning it with current kernel best practices. It improves code clarity and consistency, as strncpy is deprecated as explained in Documentation/process/deprecated.rst. This change does not alter the functionality or introduce any behavioral changes. Suggested-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Marcelo Moreira Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ebbe7d7bb1eae4db32554562f0e228824ab1f135 Author: Marek Szyprowski Date: Tue Aug 26 15:09:48 2025 +0200 mm: fix lockdep issues in writeback handling Commit 2841808f35ee ("mm: remove BDI_CAP_WRITEBACK_ACCT") removed BDI_CAP_WRITEBACK_ACCT flag and refactored code that depend on it. Unfortunately it also moved some variable intialization out of guarded scope in writeback handling, what triggers a true lockdep warning. Fix this by moving initialization to the proper place. Fixes: 2841808f35ee ("mm: remove BDI_CAP_WRITEBACK_ACCT") Signed-off-by: Marek Szyprowski Acked-by: David Hildenbrand Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 3f29d59e92a96d843c2ff10ebfed92ac26878658 Author: Miklos Szeredi Date: Tue Sep 2 10:22:06 2025 +0200 fuse: add prune notification Some fuse servers need to prune their caches, which can only be done if the kernel's own dentry/inode caches are pruned first to avoid dangling references. Add FUSE_NOTIFY_PRUNE, which takes an array of node ID's to try and get rid of. Inodes with active references are skipped. A similar functionality is already provided by FUSE_NOTIFY_INVAL_ENTRY with the FUSE_EXPIRE_ONLY flag. Differences in the interface are FUSE_NOTIFY_INVAL_ENTRY: - can only prune one dentry - dentry is determined by parent ID and name - if inode has multiple aliases (cached hard links), then they would have to be invalidated individually to be able to get rid of the inode FUSE_NOTIFY_PRUNE: - can prune multiple inodes - inodes determined by their node ID - aliases are taken care of automatically Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 60e1579a0dcf2c432286ef83ee470173d6db2f13 Author: Miklos Szeredi Date: Mon Sep 1 17:09:40 2025 +0200 fuse: remove redundant calls to fuse_copy_finish() in fuse_notify() Remove tail calls of fuse_copy_finish(), since it's now done from fuse_dev_do_write(). No functional change. Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 0b563aad1c0a05dc7d123f68a9f82f79de206dad Author: Miklos Szeredi Date: Mon Sep 1 17:16:26 2025 +0200 fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() In case of FUSE_NOTIFY_RESEND and FUSE_NOTIFY_INC_EPOCH fuse_copy_finish() isn't called. Fix by always calling fuse_copy_finish() after fuse_notify(). It's a no-op if called a second time. Fixes: 760eac73f9f6 ("fuse: Introduce a new notification type for resend pending requests") Fixes: 2396356a945b ("fuse: add more control over cache invalidation behaviour") Cc: # v6.9 Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 0a0fdb98d16e334e259352893462030f15fb887f Author: Miklos Szeredi Date: Tue Aug 26 17:08:19 2025 +0200 fuse: remove FUSE_NOTIFY_CODE_MAX from Constants that change value from version to version have no place in an interface definition. Hopefully this won't break anything. Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 0ca77f8d33e8136b8926775380506f78a8d04811 Merge: 9f8d92a1fbb5a0 d4bc3b11c12b41 Author: Ingo Molnar Date: Fri Sep 5 09:01:42 2025 +0200 Merge branch 'x86/apic' into x86/sev, to resolve conflict Conflicts: arch/x86/include/asm/sev-internal.h Signed-off-by: Ingo Molnar commit d074a40b8828fe29c2bab59d0c4a26c940af7e88 Author: Jouni Högander Date: Fri Aug 29 08:39:28 2025 +0300 drm/i915/alpm: Use actual lfps cycle and silence periods in wake time Currently we are using maximum lfps cycle and silence period times when calculating AUXLess wake time. Use actual values instead. Signed-off-by: Jouni Högander Reviewed-by: Animesh Manna Link: https://lore.kernel.org/r/20250829053929.3585636-5-jouni.hogander@intel.com commit cc2189a97848a41d107c03da6ddd93d94ad27e77 Author: Jouni Högander Date: Fri Aug 29 08:39:27 2025 +0300 drm/i915/alpm: Replace hardcoded LFPS cycle with proper calculation Currently LFPS is hadcoded for different port clocks. Replace this with proper calculation. v2: replace hardcoded 20 with 2 * LFPS_CYCLE_COUNT Signed-off-by: Jouni Högander Reviewed-by: Animesh Manna Link: https://lore.kernel.org/r/20250829053929.3585636-4-jouni.hogander@intel.com commit e9c62c8654875bb583fa07701e3921540550a379 Author: Jouni Högander Date: Fri Aug 29 08:39:26 2025 +0300 drm/i915/alpm: Add own define for LFPS count Add own define for LFPS count and use it for the configuration. This new define will be used for calculating ALPM parameters as well. Signed-off-by: Jouni Högander Reviewed-by: Animesh Manna Link: https://lore.kernel.org/r/20250829053929.3585636-3-jouni.hogander@intel.com commit 3b5b2567f8d2e16f7200ea36f62e00bf79248bfb Author: Jouni Högander Date: Fri Aug 29 08:39:25 2025 +0300 drm/i915/alpm: Calculate silence period Calculate silence period instead of hardcoding it in switch case. Signed-off-by: Jouni Högander Reviewed-by: Animesh Manna Link: https://lore.kernel.org/r/20250829053929.3585636-2-jouni.hogander@intel.com commit 9621eb635ba96514edd0fbfaeeec1fffea294abb Merge: b338cf849ec82a 54728bd535fb38 Author: Martin KaFai Lau Date: Thu Sep 4 21:10:13 2025 -0700 Merge branch 'bpf-next/skb-meta-dynptr' into 'bpf-next/master' Merge skb-meta-dynptr branch into master branch after fixing a compiler warning. No conflict. Signed-off-by: Martin KaFai Lau commit 2dfd8b8de66d9b0ef16d089e4d4525acf2a59cb2 Merge: 02614eee26fbdf 54728bd535fb38 Author: Martin KaFai Lau Date: Thu Sep 4 21:22:00 2025 -0700 Merge branch 'bpf-next/skb-meta-dynptr' into 'bpf-next/net' Merge skb-meta-dynptr branch into net branch after fixing a compiler warning. No conflict. Signed-off-by: Martin KaFai Lau commit 16c610162d1f1c332209de1c91ffb09b659bb65d Author: Eric Dumazet Date: Wed Sep 3 17:48:10 2025 +0000 net: call cond_resched() less often in __release_sock() While stress testing TCP I had unexpected retransmits and sack packets when a single cpu receives data from multiple high-throughput flows. super_netperf 4 -H srv -T,10 -l 3000 & Tcpdump extract: 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0 After analysis, it appears this is because of the cond_resched() call from __release_sock(). When current thread is yielding, while still holding the TCP socket lock, it might regain the cpu after a very long time. Other peer TLP/RTO is firing (multiple times) and packets are retransmit, while the initial copy is waiting in the socket backlog or receive queue. In this patch, I call cond_resched() only once every 16 packets. Modern TCP stack now spends less time per packet in the backlog, especially because ACK are no longer sent (commit 133c4c0d3717 "tcp: defer regular ACK while processing socket backlog") Before: clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19046186 0.0 TcpRetransSegs 1471 0.0 TcpExtTCPTimeouts 1397 0.0 TcpExtTCPLossProbes 1356 0.0 TcpExtTCPDSACKRecv 1352 0.0 TcpExtTCPSpuriousRTOs 114 0.0 TcpExtTCPDSACKRecvSegs 1352 0.0 After: clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19218936 0.0 Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit abfa70b380348cf414e6b40fd485d1dd8d50504a Merge: 69777753a8919b b13592d20b2109 Author: Jakub Kicinski Date: Thu Sep 4 19:13:45 2025 -0700 Merge branch 'tcp-__tcp_close-changes' Eric Dumazet says: ==================== tcp: __tcp_close() changes First patch fixes a rare bug. Second patch adds a corresponding packetdrill test. Third patch is a small optimization. ==================== Link: https://patch.msgid.link/20250903084720.1168904-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b13592d20b210976a0946adf027b7bd9d7734326 Author: Eric Dumazet Date: Wed Sep 3 08:47:20 2025 +0000 tcp: use tcp_eat_recv_skb in __tcp_close() Small change to use tcp_eat_recv_skb() instead of __kfree_skb(). This can help if an application under attack has to close many sockets with unread data. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Link: https://patch.msgid.link/20250903084720.1168904-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8bc316cf3a9e235a11f8424e2cfb2ade1baa94ff Author: Eric Dumazet Date: Wed Sep 3 08:47:19 2025 +0000 selftests/net: packetdrill: add tcp_close_no_rst.pkt This test makes sure we do send a FIN on close() if the receive queue contains data that was consumed. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Link: https://patch.msgid.link/20250903084720.1168904-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 Author: Eric Dumazet Date: Wed Sep 3 08:47:18 2025 +0000 tcp: fix __tcp_close() to only send RST when required If the receive queue contains payload that was already received, __tcp_close() can send an unexpected RST. Refine the code to take tp->copied_seq into account, as we already do in tcp recvmsg(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 69777753a8919b0b8313c856e707e1d1fe5ced85 Author: Colin Foster Date: Wed Sep 3 08:26:10 2025 -0500 smsc911x: add second read of EEPROM mac when possible corruption seen When the EEPROM MAC is read by way of ADDRH, it can return all 0s the first time. Subsequent reads succeed. This is fully reproduceable on the Phytec PCM049 SOM. Re-read the ADDRH when this behaviour is observed, in an attempt to correctly apply the EEPROM MAC address. Signed-off-by: Colin Foster Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com Signed-off-by: Jakub Kicinski commit 3132f0e8ef8982c9f20941b795757c844590eb62 Merge: d9c74e6f8125ef 396a788bca86eb Author: Jakub Kicinski Date: Thu Sep 4 19:01:35 2025 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-03 (ixgbe, igbvf, e1000, e1000e, igb, igbvf, igc) Piotr allows for 2.5Gb and 5Gb autoneg for ixgbe E610 devices. Jedrzej refactors reading of OROM data to be more efficient on ixgbe. Kohei Enju adds reporting of loopback Tx packets and bytes on igbvf. He also removes redundant reporting of Rx bytes. Jacek Kowalski remove unnecessary u16 casts in e1000, e1000e, igb, igc, and ixgbe drivers. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: drop unnecessary casts to u16 / int igc: drop unnecessary constant casts to u16 igb: drop unnecessary constant casts to u16 e1000e: drop unnecessary constant casts to u16 e1000: drop unnecessary constant casts to u16 igbvf: remove redundant counter rx_long_byte_count from ethtool statistics igbvf: add lbtx_packets and lbtx_bytes to ethtool statistics ixgbe: reduce number of reads when getting OROM data ixgbe: add the 2.5G and 5G speeds in auto-negotiation for E610 ==================== Link: https://patch.msgid.link/20250903202536.3696620-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 6dc1d3c191ac139b324d483aff1fc8b0b2d99867 Merge: 4bf83dd6e3b3b2 2a1eea8fd601db Author: Dave Airlie Date: Fri Sep 5 11:45:49 2025 +1000 Merge tag 'drm-misc-next-2025-09-04' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.18: Cross-subsystem Changes: - Update a number of DT bindings for STM32MP25 Arm SoC Core Changes: gem: - Simplify locking for GPUVM panel-backlight-quirks: - Add additional quirks for EDID, DMI, brightness sched: - Fix race condition in trace code - Clean up sysfb: - Clean up Driver Changes: amdgpu: - Give kernel jobs a unique id for better tracing amdxdna: - Improve error reporting bridge: - Improve ref counting on bridge management - adv7511: Provide SPD and HDMI infoframes - it6505: Replace crypto_shash with sha() - synopsys: Add support for DW DPTX Controller plus DT bindings gud: - Replace simple-KMS pipe with regular atomic helpers imagination: - Improve power management - Add support for TH1520 GPU - Support Risc-V architectures ivpu: - Clean up nouveau: - Improve error reporting panthor: - Fail VM bind if BO has offset - Clean up rcar-du: - Make number of lanes configurable rockchip: - Add support for RK3588 DPTX output rocket: - Use kfree() and sizeof() correctly - Test DMA status - Clean up sitronix: - st7571-i2c: Add support for inverted displays and 2-bit grayscale - Clean up stm: - ltdc: Add support support for STM32MP257F-EV1 plus DT bindings tidss: - Convert to kernel's FIELD_ macros v3d: - Improve job management and locking Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250904090932.GA193997@linux.fritz.box commit d9c74e6f8125ef43d0282c12cb788ae4c5290c27 Author: Dave Stevenson Date: Fri Aug 22 12:34:37 2025 +0300 dt-bindings: net: cdns,macb: Add compatible for Raspberry Pi RP1 The Raspberry Pi RP1 chip has the Cadence GEM ethernet controller, so add a compatible string for it. Signed-off-by: Dave Stevenson Signed-off-by: Stanimir Varbanov Reviewed-by: Andrew Lunn Acked-by: Conor Dooley Reviewed-by: Nicolas Ferre Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20250822093440.53941-3-svarbanov@suse.de Signed-off-by: Jakub Kicinski commit c2685729fa5463e5fc493244a2ba7e260217fc76 Author: Caleb Sander Mateos Date: Thu Sep 4 10:12:22 2025 -0600 io_uring: remove WRITE_ONCE() in io_uring_create() There's no need to use WRITE_ONCE() to set ctx->submitter_task in io_uring_create() since no other task can access the io_ring_ctx until a file descriptor is associated with it. So use a normal assignment instead of WRITE_ONCE(). Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250904161223.2600435-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 4c67b73907214994f87cad795195c46fe63c1e1c Author: Min Ma Date: Sat Aug 30 17:12:28 2025 -0700 MAINTAINERS: Update Min Ma's email for AMD XDNA driver I recently left AMD and would like to continue participating in the review and maintenance of the XDNA driver using my personal email address. Signed-off-by: Min Ma Reviewed-by: Lizhi Hou Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250831001228.592-1-mamin506@gmail.com commit 911b1a6443bbdeed25c5459768793953bf846dcb Author: Andrea della Porta Date: Mon Aug 11 16:12:35 2025 +0200 arm64: dts: broadcom: amend the comment about the role of BCM2712 board DTS Current board DTS for Raspberry Pi5 states that bcm2712-rpi-5-b.dts should not be modified and all declarations should go in the overlay board DTS instead (bcm2712-rpi-5-b-ovl-rp1.dts). There's a caveat though: there's currently no infrastructure to reliably reference nodes that have not been declared yet, as is the case when loading those nodes from a runtime overlay. For more details about these limitations see [1] and follow-ups. Change the comment to make it clear which DTS file will host specific nodes, especially the RP1 related nodes which should be customized outside the overlay DTS. Link [1] - https://lore.kernel.org/all/CAMEGJJ3=W8_R0xBvm8r+Q7iExZx8xPBHEWWGAT9ngpGWDSKCaQ@mail.gmail.com/ Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/47f6368a77d6bd846c02942d20c07dd48e0ae7df.1754914766.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 2cb82bf8c160117b4036865e75f9997a84aa6cd7 Author: Andrea della Porta Date: Mon Aug 11 16:12:34 2025 +0200 arm64: dts: broadcom: delete redundant pcie enablement nodes The pcie1 and pcie2 override nodes to enable the respective peripherals are declared both in bcm2712-rpi-5-b.dts and bcm2712-rpi-5-b-ovl-rp1.dts, which makes those declared in the former file redundant. Drop those redundant nodes from the board devicetree. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/2865b787d893fd1dcf816e1c96856711754d612d.1754914766.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit c58466b85b16f139a4afc6163aa57d7445dae806 Author: Danilo Krummrich Date: Thu Aug 28 15:32:18 2025 +0200 MAINTAINERS: rust: dma: add scatterlist files Rename the "DMA MAPPING HELPERS DEVICE DRIVER API [RUST]" maintainers entry to "DMA MAPPING & SCATTERLIST API [RUST]" and add the corresponding scatterlist files. Reviewed-by: Lyude Paul Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250828133323.53311-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 5444799d701cbf3c4b18c88fef8034b35d159615 Author: Danilo Krummrich Date: Thu Aug 28 15:32:17 2025 +0200 samples: rust: dma: add sample code for SGTable Add sample code for allocating and mapping a scatter-gather table (`SGTable`). Reviewed-by: Alexandre Courbot Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Co-developed-by: Abdiel Janulgue Signed-off-by: Abdiel Janulgue Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250828133323.53311-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 05aa6fb1c21d7fb9df735da24096d793223789d5 Author: Danilo Krummrich Date: Thu Aug 28 15:32:16 2025 +0200 rust: scatterlist: Add abstraction for sg_table Add a safe Rust abstraction for the kernel's scatter-gather list facilities (`struct scatterlist` and `struct sg_table`). This commit introduces `SGTable`, a wrapper that uses a generic parameter to provide compile-time guarantees about ownership and lifetime. The abstraction provides two primary states: - `SGTable>`: Represents a table whose resources are fully managed by Rust. It takes ownership of a page provider `P`, allocates the underlying `struct sg_table`, maps it for DMA, and handles all cleanup automatically upon drop. The DMA mapping's lifetime is tied to the associated device using `Devres`, ensuring it is correctly unmapped before the device is unbound. - `SGTable` (or just `SGTable`): A zero-cost representation of an externally managed `struct sg_table`. It is created from a raw pointer using `SGTable::from_raw()` and provides a lifetime-bound reference (`&'a SGTable`) for operations like iteration. The API exposes a safe iterator that yields `&SGEntry` references, allowing drivers to easily access the DMA address and length of each segment in the list. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Co-developed-by: Abdiel Janulgue Signed-off-by: Abdiel Janulgue Link: https://lore.kernel.org/r/20250828133323.53311-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c7081ec661bd2e9bfabe665b72c91698c396792c Author: Danilo Krummrich Date: Thu Aug 28 15:32:15 2025 +0200 rust: dma: add type alias for bindings::dma_addr_t Add a type alias for bindings::dma_addr_t (DmaAddress), such that we do not have to access bindings directly. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Suggested-by: Alice Ryhl Link: https://lore.kernel.org/r/20250828133323.53311-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c2437c43cfb1f7f461669ba3cd74936fe345640b Author: Danilo Krummrich Date: Thu Aug 28 15:32:14 2025 +0200 rust: dma: implement DataDirection Add the `DataDirection` struct, a newtype wrapper around the C `enum dma_data_direction`. This provides a type-safe Rust interface for specifying the direction of DMA transfers. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250828133323.53311-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 779db37373a38f23e2534c7f4ffe8188f5237988 Author: Danilo Krummrich Date: Wed Aug 20 16:53:43 2025 +0200 rust: alloc: kvec: implement AsPageIter for VVec Implement AsPageIter for VVec; this allows to iterate and borrow the backing pages of a VVec. This, for instance, is useful in combination with VVec backing a scatterlist. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250820145434.94745-8-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 9acb4e630c3f3fc070b9962683fdde5ba1c4c70c Author: Danilo Krummrich Date: Wed Aug 20 16:53:42 2025 +0200 rust: alloc: layout: implement ArrayLayout::size() Provide a convenience method for ArrayLayout to calculate the size of the ArrayLayout in bytes. Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Abdiel Janulgue Link: https://lore.kernel.org/r/20250820145434.94745-7-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 671618432f46c553d9b82ad701ac054e16c8d55a Author: Danilo Krummrich Date: Wed Aug 20 16:53:41 2025 +0200 rust: alloc: kbox: implement AsPageIter for VBox Implement AsPageIter for VBox; this allows to iterate and borrow the backing pages of a VBox. This, for instance, is useful in combination with VBox backing a scatterlist. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250820145434.94745-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 866ec3bab19c33a66ad384bc69dff1cd83d7ed12 Author: Danilo Krummrich Date: Wed Aug 20 16:53:40 2025 +0200 rust: page: define trait AsPageIter The AsPageIter trait provides a common interface for types that provide a page iterator, such as VmallocPageIter. Subsequent patches will leverage this to let VBox and VVec provide a VmallocPageIter though this trait. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250820145434.94745-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 7937dca770393d34d1ad217580c5446d2e45417f Author: Danilo Krummrich Date: Wed Aug 20 16:53:39 2025 +0200 rust: alloc: implement VmallocPageIter Introduce the VmallocPageIter type; an instance of VmallocPageIter may be exposed by owners of vmalloc allocations to provide borrowed access to its backing pages. For instance, this is useful to access and borrow the backing pages of allocation primitives, such as Box and Vec, backing a scatterlist. Reviewed-by: Daniel Almeida Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Alice Ryhl Suggested-by: Alice Ryhl Link: https://lore.kernel.org/r/20250820145434.94745-4-dakr@kernel.org [ Drop VmallocPageIter::base_address(), move to allocator/iter.rs and stub VmallocPageIter for allocator_test.rs. - Danilo ] Signed-off-by: Danilo Krummrich commit 222f83d5ab86344010f9e121799202b9ab25375b Author: Tejun Heo Date: Thu Sep 4 11:23:43 2025 -1000 cgroup: Remove unused local variables from cgroup_procs_write_finish() d8b269e009bb ("cgroup: Remove unused cgroup_subsys::post_attach") made $ss and $ssid unused but didn't drop them leading to compilation warnings. Drop them. Signed-off-by: Tejun Heo Cc: Chuyi Zhou commit 75a7b9d29215c5aa813b9620f3c56817918f9f8c Author: Ian Rogers Date: Mon Aug 18 12:04:16 2025 -0700 perf vendor events: Update tigerlake metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-21-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 94ce35cdb626733f0473615fd6337b9bdc44ea84 Author: Ian Rogers Date: Mon Aug 18 12:04:15 2025 -0700 perf vendor events: Update skylake metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-20-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f1980de60459a372301e673fa3185e2ee3c61c1f Author: Ian Rogers Date: Mon Aug 18 12:04:14 2025 -0700 perf vendor events: Update sierraforest metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-19-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 26f4b26f76bd468d5cf36219b5c7d3802be08462 Author: Ian Rogers Date: Mon Aug 18 12:04:13 2025 -0700 perf vendor events: Update sapphirerapids events/metrics Update events from v1.28 to v1.30. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/c6a01e651c7be0dbc7a0e92ea915bb3c7e5970da https://github.com/intel/perfmon/commit/8b3a5b3f8ebf3cc48e29e3b65ecccb37f6fc3e81 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-18-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8d824b469d3272af00b01305d6adba86e2a03a1a Author: Ian Rogers Date: Mon Aug 18 12:04:12 2025 -0700 perf vendor events: Update sandybridge metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-17-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6826aa4ffaef2a084a5036453c4295a110860827 Author: Ian Rogers Date: Mon Aug 18 12:04:11 2025 -0700 perf vendor events: Update rocketlake metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-16-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 59050cb8972dd146641c69db54dee6fd36a84e34 Author: Ian Rogers Date: Mon Aug 18 12:04:10 2025 -0700 perf vendor events: Update meteorlake events/metrics Update events from v1.14 to v1.16. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/c3e91c6e6b39429c57001d4942667f380efe8ea9 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-15-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4a0ca7230d91171cf24470be135263165f83b9ed Author: Ian Rogers Date: Mon Aug 18 12:04:09 2025 -0700 perf vendor events: Update lunarlake events/metrics Update events from v1.14 to v1.17. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/6bdcbce3e9df30ae02bd0ea51fd73bf51ee8aff4 https://github.com/intel/perfmon/commit/1684fa543fd45970759bb72dc3fc00c2ef87c0e8 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-14-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3fdb4ffe6505a8fd79be61bbd001413227964d97 Author: Ian Rogers Date: Mon Aug 18 12:04:08 2025 -0700 perf vendor events: Update jaketown metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-13-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 48a194efa00730a88044f8df300cf8bbfa891449 Author: Ian Rogers Date: Mon Aug 18 12:04:07 2025 -0700 perf vendor events: Update ivybridge/ivytown metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-12-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 55b3a5a7a7d124980289a8fcbe8878975b683574 Author: Ian Rogers Date: Mon Aug 18 12:04:06 2025 -0700 perf vendor events: Update icelake metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-11-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7fcaead09f74bacfbf9433a9b843b8f93f83e3c7 Author: Ian Rogers Date: Mon Aug 18 12:04:05 2025 -0700 perf vendor events: Update haswell metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-10-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0e08908841999354e86e85a38d3ad268a59924b2 Author: Ian Rogers Date: Mon Aug 18 12:04:04 2025 -0700 perf vendor events: Update graniterapids events/metrics Update events from v1.10 to v1.12. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/1684fa543fd45970759bb72dc3fc00c2ef87c0e8 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d5a638022a010a480ec2ac308bcabc68eb1b6d62 Author: Ian Rogers Date: Mon Aug 18 12:04:03 2025 -0700 perf vendor events: Update grandridge metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d9a6bb9e359e6f816c746fc8d6aa0999f4594a0c Author: Ian Rogers Date: Mon Aug 18 12:04:02 2025 -0700 perf vendor events: Update emeraldrapids events/metrics Update events from v1.14 to v1.16. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/9020e49e790349f86141a1f6ef6f009f189a0f48 https://github.com/intel/perfmon/commit/a0567b56185fea4b968391aae344e9d8ed9782d8 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 96e1aba56505e91f222ef2c9a07d71e08ea48e23 Author: Ian Rogers Date: Mon Aug 18 12:04:01 2025 -0700 perf vendor events: Update cascadelakex metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e50ae144a7b77ac2d66fd3cac9d60edd7dcd00d9 Author: Ian Rogers Date: Mon Aug 18 12:04:00 2025 -0700 perf vendor events: Update broadwell metrics Update metrics from TMA 5.0 to 5.1. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3f7f743ec4891d36804103ee81027bcd49b4db4d Author: Ian Rogers Date: Mon Aug 18 12:03:59 2025 -0700 perf vendor events: Update arrowlake events/metrics Update events from v1.09 to v1.12. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/d5b1d2e9ee89035198ab7752e0378acba86907b6 https://github.com/intel/perfmon/commit/b9c162b7c98874321af36a411ee3c2194ea9afeb Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1b728c54fed1e46109c6c8ab8cd866f7577e775f Author: Ian Rogers Date: Mon Aug 18 12:03:58 2025 -0700 perf vendor events: Update alderlake events/metrics Update events from v1.31 to v1.33. Update metrics from TMA 5.0 to 5.1. The event updates come from: https://github.com/intel/perfmon/commit/c504da6cb00e52067206166d2049a0c11af3b650 https://github.com/intel/perfmon/commit/4c18312c1a22eb564f5dbc94b187b59e4383a56a Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Cc: linux-actions@lists.infradead.org Link: https://lore.kernel.org/r/20250818190416.145274-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1a461a62fb422db9cf870a4f184885cc69873b7f Author: Ian Rogers Date: Mon Aug 18 12:03:57 2025 -0700 perf parse-events: Handle fake PMUs in CPU terms The "Parsing of PMU event table metrics with fake PMUs" will test metrics on machines/models that may be missing a PMU, in such a case the fake_pmu should be used to avoid errors. Metrics that get the cpumask from a different PMU, such as "tsc/cpu=cpu_atom/", also need to be resilient in this test. The parse_events_state fake_pmu is set when missing PMUs should be ignored. So that it can be queried, pass it to the config term functions, as well as to get_config_cpu, then ignore failures when fake_pmu is set. Some minor code refactoring to cut down on the indent and remove some redundant checks. Fixes: bd741d80dc65922c ("perf parse-events: Allow the cpu term to be a PMU or CPU range") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: linux-actions@lists.infradead.org Cc: Manivannan Sadhasivam Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Link: https://lore.kernel.org/r/20250818190416.145274-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 43456fdfc014f302fdcbb85903efe9548330dc32 Author: Stanimir Varbanov Date: Fri Aug 22 12:34:40 2025 +0300 arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5 Enable RP1 ethernet DT node for Raspberry Pi 5. Signed-off-by: Stanimir Varbanov Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20250822093440.53941-6-svarbanov@suse.de Signed-off-by: Florian Fainelli commit cbdd3e7613200ee49ae8fa00020c39c4a2e1ee42 Author: Stanimir Varbanov Date: Fri Aug 22 12:34:39 2025 +0300 arm64: dts: rp1: Add ethernet DT node Add macb GEM ethernet DT node. Signed-off-by: Stanimir Varbanov Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20250822093440.53941-5-svarbanov@suse.de Signed-off-by: Florian Fainelli commit 725386ca1949a570d8b73b179518998d399031bf Author: Andrea della Porta Date: Thu Aug 28 15:17:10 2025 +0200 dt-bindings: mmc: Add support for capabilities to Broadcom SDHCI controller The Broadcom BRCMSTB SDHCI Controller device supports Common properties in terms of Capabilities. Reference sdhci-common schema instead of mmc-controller in order for capabilities to be specified in DT nodes avoiding warnings from the DT compiler. Signed-off-by: Andrea della Porta Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/181cc905566f2d9b2e5076295cd285230f81ed07.1756386531.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 72323b141691beeab8809c1dc0b98b1bcf058d88 Author: Ivan T. Ivanov Date: Thu Aug 28 15:17:14 2025 +0200 arm64: dts: broadcom: bcm2712: Add UARTA controller node On RPi5 device Bluetooth chips is connected to UARTA port. Add Bluetooth chips and related pin definitions. With this and firmware already provided by distributions, at least on openSUSE Tumbleweed, this is sufficient to make Bluetooth operational on RPi5 \o/. Signed-off-by: Ivan T. Ivanov Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/35c0da6a741019efefc3c8e405e210a3a8156830.1756386531.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 3ff7ce84e18151578352c2b28320824b42df114b Author: Colin Ian King Date: Thu Sep 4 10:09:04 2025 +0100 perf python: Fix spelling mistake "metics" -> "metrics" There is a spelling mistake in a Python doc string. Fix it. Fixes: d0550be70f7ab84d ("perf python: Add parse_metrics function") Reviewed-by: Ian Rogers Signed-off-by: Colin Ian King Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: kernel-janitors@vger.kernel.org Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250904090904.2782814-1-colin.i.king@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 55ec7b1b97267fd552848e7e3ba70cbbfc1eba73 Author: Ivan T. Ivanov Date: Thu Aug 28 15:17:13 2025 +0200 arm64: dts: broadcom: bcm2712: Add second SDHCI controller node Add SDIO2 node. On RPi5 it is connected to WiFi chip. Add related pin, gpio and regulator definitions and add WiFi node. With this and firmware already provided by distributions, at least on openSUSE Tumbleweed, this is sufficient to make WiFi operational on RPi5 \o/. Signed-off-by: Ivan T. Ivanov Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/4ff3a58e98d90a43deb2448b23754808afc7153b.1756386531.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 72eb12b99d3539060d93191c502e7b7e259ead56 Author: Ivan T. Ivanov Date: Thu Aug 28 15:17:12 2025 +0200 arm64: dts: broadcom: bcm2712: Add one more GPIO node Add GPIO and related interrupt controller nodes and wire one of the lines to power button. Signed-off-by: Ivan T. Ivanov Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/6d311b2f629bbc0e1dd9821e4aa8e5af9f8e5362.1756386531.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 7e1aa57c2d14908c1faf0bcbf3e746dcf650eaa0 Author: Ivan T. Ivanov Date: Thu Aug 28 15:17:11 2025 +0200 arm64: dts: broadcom: bcm2712: Add pin controller nodes Add pin-control devicetree nodes and used them to explicitly define uSD card interface pin configuration. Signed-off-by: Ivan T. Ivanov Reviewed-by: Stefan Wahren Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/5ceba8558e0007a9685f19b51d681d0ce79e7634.1756386531.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 2182fe932dc83eabda207677d4babdd563ae89d6 Author: Andrea della Porta Date: Thu Aug 28 14:47:40 2025 +0200 arm64: defconfig: Enable BCM2712 on-chip pin controller driver Select the on-chip pin controller driver for BCM2712 SoC. On RapsberryPi 5 devices it is primarily needed to operate the bluetooth and WiFi devices, to configure the uSD interface and the power button. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/all/38704a5ab6913845bbf9178170e83004ab3e8fcf.1756372805.git.andrea.porta@suse.com/ Signed-off-by: Florian Fainelli commit 54728bd535fb3899ad51489dc1e05eb5bb53cb95 Author: Jakub Sitnicki Date: Mon Sep 1 15:27:43 2025 +0200 bpf: Return an error pointer for skb metadata when CONFIG_NET=n Kernel Test Robot reported a compiler warning - a null pointer may be passed to memmove in __bpf_dynptr_{read,write} when building without networking support. The warning is correct from a static analysis standpoint, but not actually reachable. Without CONFIG_NET, creating dynptrs to skb metadata is impossible since the constructor kfunc is missing. Silence the false-postive diagnostic message by returning an error pointer from bpf_skb_meta_pointer stub when CONFIG_NET=n. Fixes: 6877cd392bae ("bpf: Enable read/write access to skb metadata through a dynptr") Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/ Reported-by: kernel test robot Suggested-by: Alexei Starovoitov Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250901-dynptr-skb-meta-no-net-v2-1-ce607fcb6091@cloudflare.com commit 3088f485dea2e98c8acb07495759363c5ae546bd Author: Michal Wajdeczko Date: Tue Sep 2 15:17:44 2025 +0200 drm/xe/configfs: Don't expose survivability_mode if not applicable The survivability_mode attribute is applicable only for DGFX and platforms newer than BATTLEMAGE. Use .is_visible() hook to hide this attribute when above conditions are not met. Remove code that was trying to fix such configuration during the runtime. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Riana Tauro Reviewed-by: Lucas De Marchi Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250902131744.5076-4-michal.wajdeczko@intel.com commit 5ef04a7b068cbb828eba226aacb42f880f7924d7 Merge: c975e1dfcc929d d69eb204c255c3 Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc5). No conflicts. Adjacent changes: include/net/sock.h c51613fa276f ("net: add sk->sk_drop_counters") 5d6b58c932ec ("net: lockless sock_i_ino()") Signed-off-by: Jakub Kicinski commit b076d321771204d4b711df99e904dc2efdc78856 Author: Michal Wajdeczko Date: Tue Sep 2 15:17:43 2025 +0200 drm/xe/configfs: Prepare to filter-out configfs attributes Implement empty ops.is_visible hook to allow filtering-out any not supported attributes, as not all of them are applicable on all xe platforms. Since during creation of each new configfs directory we are looking for xe device descriptor to validate that xe driver supports given PCI device, store reference to that descriptor to allow later use while doing attribute filtering. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250902131744.5076-3-michal.wajdeczko@intel.com commit 079a5c83dbd23db7a6eed8f558cf75e264d8a17b Author: Michal Wajdeczko Date: Thu Sep 4 12:35:21 2025 +0200 drm/xe/configfs: Don't touch survivability_mode on fini This is a user controlled configfs attribute, we should not modify that outside the configfs attr.store() implementation. Fixes: bc417e54e24b ("drm/xe: Enable configfs support for survivability mode") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Riana Tauro Reviewed-by: Stuart Summers Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250904103521.7130-1-michal.wajdeczko@intel.com commit 47d9f8212826753c482df8189d18ca212eb5ae73 Author: Andrea Righi Date: Thu Sep 4 20:23:48 2025 +0200 sched_ext: Fix NULL dereference in scx_bpf_cpu_rq() warning When printing the deprecation warning for scx_bpf_cpu_rq(), we may hit a NULL pointer dereference if the kfunc is called before a BPF scheduler is fully attached, for example, when invoked from a BPF timer or during ops.init(): [ 50.752775] BUG: kernel NULL pointer dereference, address: 0000000000000331 ... [ 50.764205] RIP: 0010:scx_bpf_cpu_rq+0x30/0xa0 ... [ 50.787661] Call Trace: [ 50.788398] [ 50.789061] bpf_prog_08f7fd2dcb187aaf_wakeup_timerfn+0x75/0x1a8 [ 50.792477] bpf_timer_cb+0x7e/0x140 [ 50.796003] hrtimer_run_softirq+0x91/0xe0 [ 50.796952] handle_softirqs+0xce/0x3c0 [ 50.799087] run_ksoftirqd+0x3e/0x70 [ 50.800197] smpboot_thread_fn+0x133/0x290 [ 50.802320] kthread+0x115/0x220 [ 50.804984] ret_from_fork+0x17a/0x1d0 [ 50.806920] ret_from_fork_asm+0x1a/0x30 [ 50.807799] Fix this by only printing the warning once the scheduler is fully registered. Fixes: 5c48d88fe0049 ("sched_ext: deprecation warn for scx_bpf_cpu_rq()") Cc: Christian Loehle Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 28fa7f5243c02a812af50707c9805c2b57deceeb Author: Nathan Chancellor Date: Thu Aug 21 13:52:12 2025 -0700 drm/bridge: cdns-dsi: Select VIDEOMODE_HELPERS When no other driver selects CONFIG_VIDEOMODE_HELPERS but CONFIG_DRM_CDNS_DSI is enabled, there is a linker or modpost error: ERROR: modpost: "drm_display_mode_to_videomode" [drivers/gpu/drm/bridge/cadence/cdns-dsi.ko] undefined! Select VIDEOMODE_HELPERS to ensure that this helper function is available to the driver. Fixes: ce4bc5ca7c1d ("drm/bridge: cdns-dsi: Use video mode and clean up cdns_dsi_mode2cfg()") Signed-off-by: Nathan Chancellor Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250821-cdns-videohelpers-v1-1-853e021908cf@kernel.org Signed-off-by: Dmitry Baryshkov commit 2506af5f8109a387a5e8e9e3d7c498480b8033db Author: Michal Wajdeczko Date: Thu Sep 4 00:33:30 2025 +0200 drm/xe/guc: Set upper limit of H2G retries over CTB The GuC communication protocol allows GuC to send NO_RESPONSE_RETRY reply message to indicate that due to some interim condition it can not handle incoming H2G request and the host shall resend it. But in some cases, due to errors, this unsatisfied condition might be final and this could lead to endless retries as it was recently seen on the CI: [drm] GT0: PF: VF1 FLR didn't finish in 5000 ms (-ETIMEDOUT) [drm] GT0: PF: VF1 resource sanitizing failed (-ETIMEDOUT) [drm] GT0: PF: VF1 FLR failed! [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0 [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0 [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0 [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0 To avoid such dangerous loops allow only limited number of retries (for now 50) and add some delays (n * 5ms) to slow down the rate of resending this repeated request. Signed-off-by: Michal Wajdeczko Cc: John Harrison Cc: Matthew Brost Reviewed-by: Stuart Summers Reviewed-by: Julia Filipchuk Link: https://lore.kernel.org/r/20250903223330.6408-1-michal.wajdeczko@intel.com commit 0115d063559fa6d25e41751cf455dda40aa2c856 Author: Srinivas Pandruvada Date: Thu Aug 28 13:15:41 2025 -0700 thermal: intel: selftests: workload_hint: Mask unsupported types The workload hint may contain some other hints which are not defined. So mask out unsupported types. Currently only lower 4 bits of workload type hints are defined. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250828201541.931425-1-srinivas.pandruvada@linux.intel.com [ rjw: Subject cleanup ] Signed-off-by: Rafael J. Wysocki commit 4a1e02b15ac174c3c6d5e358e67c4ba980e7b336 Author: Peter Zijlstra Date: Tue Sep 2 11:20:35 2025 +0200 x86,retpoline: Optimize patch_retpoline() Currently the very common retpoline: "CS CALL __x86_indirect_thunk_r11" is transformed into "CALL *R11; NOP3" for eIBRS/BHI_NO parts. Similarly, paranoid fineibt has: "CALL *R11; NOP". Recognise that CS stuffing can avoid the extra NOP. However, due to prefix decode penalties, make sure to not emit too many CS prefixes. Notably: "CS CALL __x86_indirect_thunk_rax" must not become "CS CS CS CS CALL *RAX". Prefix decode penalties are typically many more cycles than decoding an extra NOP. Additionally, if the retpoline is a tail-call, the "JMP *%\reg" should be followed by INT3 for straight-line-speculation mitigation, since emit_indirect() now has a length argument, move this into emit_indirect() such that other users (paranoid-fineibt) also do this. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250902104627.GM4068168@noisy.programming.kicks-ass.net commit 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5 Author: Peter Zijlstra Date: Mon Sep 1 12:49:58 2025 +0200 x86,ibt: Use UDB instead of 0xEA A while ago [0] FineIBT started using the 0xEA instruction to raise #UD. All existing parts will generate #UD in 64bit mode on that instruction. However; Intel/AMD have not blessed using this instruction, it is on their 'reserved' opcode list for future use. Peter Anvin worked the committees and got use of 0xD6 blessed, it shall be called UDB (per the next SDM or so), and it being a single byte instruction is easy to slip into a single byte immediate -- as is done by this very patch. Reworking the FineIBT code to use UDB wasn't entirely trivial. Notably the FineIBT-BHI1 case ran out of bytes. In order to condense the encoding some it was required to move the hash register from R10D to EAX (thanks hpa!). Per the x86_64 ABI, RAX is used to pass the number of vector registers for vararg function calls -- something that should not happen in the kernel. More so, the kernel is built with -mskip-rax-setup, which should leave RAX completely unused, allowing its re-use. [ For BPF; while the bpf2bpf tail-call uses RAX in its calling convention, that does not use CFI and is unaffected. Only the 'regular' C->BPF transition is covered by CFI. ] The ENDBR poison value is changed from 'OSP NOP3' to 'NOPL -42(%RAX)', this is basically NOP4 but with UDB as its immediate. As such it is still a non-standard NOP value unique to prior ENDBR sites, but now also provides UDB. Per Agner Fog's optimization guide, Jcc is assumed not-taken. That is, the expected path should be the fallthrough case for improved throughput. Since the preamble now relies on the ENDBR poison to provide UDB, the code is changed to write the poison right along with the initial preamble -- this is possible because the ITS mitigation already disabled IBT over rewriting the CFI scheme. The scheme in detail: Preamble: FineIBT FineIBT-BHI1 FineIBT-BHI __cfi_\func: __cfi_\func: __cfi_\func: endbr endbr endbr subl $0x12345678, %eax subl $0x12345678, %eax subl $0x12345678, %eax jne.d32,np \func+3 cmovne %rax, %rdi cs cs call __bhi_args_N jne.d8,np \func+3 \func: \func: \func: nopl -42(%rax) nopl -42(%rax) nopl -42(%rax) Notably there are 7 bytes available after the SUBL; this enables the BHI1 case to fit without the nasty overlapping case it had previously. The !BHI case uses Jcc.d32,np to consume all 7 bytes without the need for an additional NOP, while the BHI case uses CS padding to align the CALL with the end of the preamble such that it returns to \func+0. Caller: FineIBT Paranoid-FineIBT fineibt_caller: fineibt_caller: mov $0x12345678, %eax mov $0x12345678, %eax lea -10(%r11), %r11 cmp -0x11(%r11), %eax nop5 cs lea -0x10(%r11), %r11 retpoline: retpoline: cs call __x86_indirect_thunk_r11 jne fineibt_caller+0xd call *%r11 nop Notably this is before apply_retpolines() which will fix up the retpoline call -- since all parts with IBT also have eIBRS (lets ignore ITS). Typically the retpoline site is rewritten (when still intact) into: call *%r11 nop3 [0] 06926c6cdb95 ("x86/ibt: Optimize the FineIBT instruction sequence") Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250901191307.GI4067720@noisy.programming.kicks-ass.net commit 0b815825b1b0bd6762ca028e9b6631b002efb7ca Author: Kees Cook Date: Wed Sep 3 20:46:45 2025 -0700 x86/cfi: Remove __noinitretpoline and __noretpoline Commit 66f793099a63 ("x86/retpoline: Avoid retpolines for built-in __init functions") disabled retpolines in __init sections (__noinitretpoline) as a precaution against potential issues with retpolines in early boot, but it has not been a problem in practice (i.e. see Clang below). Commit 87358710c1fb ("x86/retpoline: Support retpoline builds with Clang") narrowed this to only GCC, as Clang doesn't have per-function control over retpoline emission. As such, Clang has been booting with retpolines in __init since retpoline support was introduced. Clang KCFI has been instrumenting __init since CFI was introduced. With the introduction of KCFI for GCC, KCFI instrumentation with retpolines disabled means that objtool does not construct .retpoline_sites section entries for the non-retpoline KCFI calls. At boot, the KCFI rehashing code, via __apply_fineibt(), misses all __init KCFI calls (since they are not retpolines), resulting in immediate hash mismatches: all preambles are rehashed (via .cfi_sites) and none of the __init call sites are rehashed. Remove __noinitretpoline since it provides no meaningful utility and creates problems with CFI. Additionally remove __noretpoline since it is now unused. Alternatively, cfi_rand_callers() could walk the .kcfi_traps section which is exactly the list of KCFI instrumentation sites. But it seems better to have as few differences in common instruction sequences between compilers as possible, so better to remove the special handling of retpolines in __init for GCC. Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250904034656.3670313-6-kees@kernel.org commit 026211c40b055485b4c65c10d644a92864623225 Author: Kees Cook Date: Wed Sep 3 20:46:44 2025 -0700 x86/cfi: Add "debug" option to "cfi=" bootparam Add "debug" option for "cfi=" bootparam to get details on early CFI initialization steps so future Kees can find breakage easier. Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250904034656.3670313-5-kees@kernel.org commit 9f303a35d1df27cdc7b895b077985b0e1c4473c2 Author: Kees Cook Date: Wed Sep 3 20:46:43 2025 -0700 x86/cfi: Standardize on common "CFI:" prefix for CFI reports Use a regular "CFI:" prefix for CFI reports during alternatives setup, including reporting when nothing has happened (i.e. CONFIG_FINEIBT=n). Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250904034656.3670313-4-kees@kernel.org commit 24452d9ef17502965021ce5df30f4e184245a5ac Author: Kees Cook Date: Wed Sep 3 20:46:42 2025 -0700 x86/cfi: Document the "cfi=" bootparam options The kernel-parameters.txt didn't have a section for the cfi= options. Add it. Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250904034656.3670313-3-kees@kernel.org commit 628a15e0536abb7658cd243553312d3f65c0aff2 Author: Kees Cook Date: Wed Sep 3 20:46:41 2025 -0700 x86/traps: Clarify KCFI instruction layout Just a nit-picky change to the KCFI indirect call check instruction documentation. The addl offset isn't always -4 (it depends on patchable function entry configuration). Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250904034656.3670313-2-kees@kernel.org commit 038c7dc66e2744e5df57163b8f957745ae10d23e Author: Kees Cook Date: Wed Sep 3 20:46:40 2025 -0700 compiler_types.h: Move __nocfi out of compiler-specific header Prepare for GCC KCFI support and move the __nocfi attribute from compiler-clang.h to compiler_types.h. This was already gated by CONFIG_CFI_CLANG, so this remains safe for non-KCFI GCC builds. Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250904034656.3670313-1-kees@kernel.org commit 2e82368359f63567862a0d438710ddffcb1ace83 Author: Rafael J. Wysocki Date: Mon Aug 25 15:31:53 2025 +0200 thermal: gov_step_wise: Allow cooling level to be reduced earlier The current behavior of the Step-wise thermal governor is to increase the cooling level one step at a time after trip point threshold passing by thermal zone temperature until the temperature stops to rise. Then, nothing is done until the temperature decreases below the (possibly updated) trip point threshold, at which point the cooling level is reduced straight to the applicable minimum. While this generally works, it is not in agreement with the throttling logic description comment in step_wise_manage() any more after some relatively recent changes, and in the case of passive cooling, it may lead to undesirable performance oscillations between high and low levels. For this reason, modify the governor's cooling device state selection function, get_target_state(), to reduce cooling by one level even if the temperature is still above the thermal zone threshold, but the temperature has started to fall down. However, ensure that the cooling level will remain above the applicable minimum in that case to pull the zone temperature further down, possibly until it falls below the trip threshold (which may now be equal to the low temperature of the trip). Doing so should help higher performance to be restored earlier in some cases which is desirable especially for passive trip points with relatively high hysteresis values. Signed-off-by: Rafael J. Wysocki Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/1947735.tdWV9SEqCh@rafael.j.wysocki [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 6b4decef4c9454a9121109788fae761319ea44b4 Author: Rafael J. Wysocki Date: Mon Aug 25 15:28:34 2025 +0200 thermal: gov_step_wise: Clarify cooling logic description comment The cooling logic description comment next to the get_target_state() definition is slightly ambiguous in what it means by "lower cooling state", so clarify that by replacing the ambuguous phrase with "the minimum applicable cooling state". No functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/4690596.LvFx2qVVIh@rafael.j.wysocki commit 28cef1632339ac54253e8eef89726a6e0a349939 Author: Rafael J. Wysocki Date: Mon Aug 25 15:27:46 2025 +0200 thermal: gov_step_wise: Clean up local variable initialization Make the initialization of local variable throttle in thermal_zone_trip_update() more straightforward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/6203592.lOV4Wx5bFT@rafael.j.wysocki commit 57e62089f8e9d0baaba40103b167003ed7170db5 Author: Al Viro Date: Sun Jul 20 15:48:00 2025 -0400 do_nfs4_mount(): switch to vfs_parse_fs_string() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit b28f9eba12a4967eff6e8a1c0512f86f1ac7fa68 Author: Al Viro Date: Sat Jun 28 11:37:30 2025 -0400 change the calling conventions for vfs_parse_fs_string() Absolute majority of callers are passing the 4th argument equal to strlen() of the 3rd one. Drop the v_size argument, add vfs_parse_fs_qstr() for the cases that want independent length. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 56a232d93cea0ba14da5e3157830330756a45b4c Author: Samuel Wu Date: Wed Aug 20 17:42:33 2025 -0700 PM: sleep: Make pm_wakeup_clear() call more clear Move pm_wakeup_clear() to the same location as other functions that do bookkeeping prior to suspend_prepare(). Since calling pm_wakeup_clear() is a prerequisite to setting up for suspend and enabling functionalities of suspend (like aborting during suspend), moving pm_wakeup_clear() higher up the call stack makes its intent more clear and obvious that it is called prior to suspend_prepare(). After this change, there is a slightly larger window when abort events can be registered, but otherwise suspend functionality is the same. Suggested-by: Saravana Kannan Signed-off-by: Samuel Wu Link: https://patch.msgid.link/20250821004237.2712312-2-wusamuel@google.com Reviewed-by: Saravana Kannan [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 8646f111fae02f901ff033a1b6ce0a82eea31560 Merge: b320789d6883cc 05db35963eef7a Author: Rafael J. Wysocki Date: Thu Sep 4 20:38:46 2025 +0200 Merge tag 'opp-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge OPP (operating performance points) updates for 6.18 from Viresh Kumar: "- Add support to find OPP for a set of keys (Krishna Chaitanya Chundru). - Minor optimization to OPP Rust implementation (Onur Özkan)." * tag 'opp-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: Add support to find OPP for a set of keys rust: opp: use to_result for error handling commit c69d79c532f26807cb1f424f6cec475609dd2ded Merge: 1647830388ffea 3e681899cc6e6c Author: Rafael J. Wysocki Date: Thu Sep 4 20:36:55 2025 +0200 Merge tag 'cpufreq-arm-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge CPUFreq updates for 6.18 from Viresh Kumar: "- Minor improvements to Rust Cpumask APIs (Alice Ryhl, Baptiste Lepers, and Shankari Anand). - Minor cleanups and optimizations to various cpufreq drivers (Akhilesh Patil, BowenYu, Dennis Beier, Liao Yuanhong, Zihuan Zhang, Florian Fainelli, Taniya Das, Md Sadre Alam, and Christian Marangi). - Enhancements for TI cpufreq driver (Judith Mendez, and Paresh Bhagat). - Enhancements for mediatek cpufreq driver (Nicolas Frattaroli). - Remove outdated cpufreq-dt.txt (Frank Li). - Update MAINTAINERS for virtual-cpufreq maintainer (Saravana Kannan)." * tag 'cpufreq-arm-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: (28 commits) cpufreq: mediatek: avoid redundant conditions cpufreq/longhaul: handle NULL policy in longhaul_exit cpufreq: tegra186: Use scope-based cleanup helper cpufreq: mediatek: Use scope-based cleanup helper cpufreq: s5pv210: Use scope-based cleanup helper cpufreq: CPPC: Use scope-based cleanup helper cpufreq: brcmstb-avs: Use scope-based cleanup helper dt-bindings: Remove outdated cpufreq-dt.txt arm64: dts: ti: k3-am62p: Fix supported hardware for 1GHz OPP cpufreq: ti: Allow all silicon revisions to support OPPs cpufreq: ti: Support more speed grades on AM62Px SoC cpufreq: ti: Add support for AM62D2 cpufreq: dt-platdev: Blacklist ti,am62d2 SoC rust: opp: update ARef and AlwaysRefCounted imports from sync::aref cpufreq: mediatek-hw: don't use error path on NULL fdvfs cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() rust: cpumask: Mark CpumaskVar as transparent rust: cpumask: rename CpumaskVar::as[_mut]_ref to from_raw[_mut] dt-bindings: cpufreq: cpufreq-qcom-hw: Add QCS615 compatible MAINTAINERS: Add myself as virtual-cpufreq maintainer ... commit b338cf849ec82a3063119c9902c5ae21bc9dccb1 Author: Jiawei Zhao Date: Thu Sep 4 03:05:23 2025 +0000 libbpf: Remove unused args in parse_usdt_note Remove unused 'elf' and 'path' parameters from parse_usdt_note function signature. These parameters are not referenced within the function body and only add unnecessary complexity. The function only requires the note header, data buffer, offsets, and output structure to perform USDT note parsing. Update function declaration, definition, and the single call site in collect_usdt_targets() to match the simplified signature. This is a safe internal cleanup as parse_usdt_note is a static function. Signed-off-by: Jiawei Zhao Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250904030525.1932293-1-phoenix500526@163.com commit cce65107897d699c78373b88f3fe94602f194d0e Author: Rob Herring (Arm) Date: Fri Aug 29 18:04:40 2025 -0500 dt-bindings: gpu: Convert aspeed,ast2400-gfx to DT schema Convert the ASpeed GFX Display Controller binding to DT schema format. There was a duplicate, incomplete binding in mfd which can be dropped. Add the missing 'aspeed,ast2600-gfx' compatible and 'syscon' property. Reviewed-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250829230442.1495926-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 3a351de0d9c86e23b9eca25838b19468aab02f38 Author: Sam van Kampen Date: Fri Aug 29 14:52:22 2025 +0000 ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU Just like the other Vivobooks here, the N6506CU has its keyboard IRQ described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh, causing the internal keyboard not to work. Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix this. Signed-off-by: Sam van Kampen Link: https://patch.msgid.link/20250829145221.2294784-2-sam@tehsvk.net Signed-off-by: Rafael J. Wysocki commit 4405a214df146775338a1e6232701a29024b82e1 Author: Hans de Goede Date: Fri Aug 29 16:27:48 2025 +0200 ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI device in the _DEP dependency list of the ACPI devices for the camera- sensors (which have flags.honor_deps set). These devices are for an Intel Vision CVS chip for which an out of tree driver is available [1]. The camera sensor works fine without a driver being loaded for this ACPI device on the 2 laptops this was tested on: ThinkPad X1 Carbon Gen 12 (Meteor Lake) ThinkPad X1 2-in-1 Gen 10 (Arrow Lake) For now add these HIDs to acpi_ignore_dep_ids[] so that acpi_dev_ready_for_enumeration() will return true once the other _DEP dependencies are met and an i2c_client for the camera sensor will get instantiated. Link: https://github.com/intel/vision-drivers/ [1] Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org Signed-off-by: Rafael J. Wysocki commit 7a9490a1c929e00250f4be7749bd666f19a9c7ef Author: Rafael J. Wysocki Date: Thu Aug 28 13:03:13 2025 +0200 ACPI: fan: Fold two simple functions into their only caller Both acpi_fan_has_fst() and acpi_fan_is_acpi4() are called from one place only, so fold them both into there caller which yields slightly leaner code that is somewhat easier to follow. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3386797.aeNJFYEL58@rafael.j.wysocki commit 3f6b537a13c815f4c93dcc5a0d1c48a8f5619dc0 Author: Rafael J. Wysocki Date: Thu Aug 28 13:02:01 2025 +0200 ACPI: thermal: Get rid of a dummy local variable The second argument of acpi_bus_update_power() can be NULL, so drop the power_state dummy local variable in acpi_thermal_resume() used just for avoiding passing NULL as the second argument to that function. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13851842.uLZWGnKmhe@rafael.j.wysocki commit 4aac453deca0d9c61df18d968f8864c3ae7d3d8d Author: Daniel Tang Date: Thu Aug 28 01:38:14 2025 -0400 ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Previously, after `rmmod acpi_tad`, `modprobe acpi_tad` would fail with this dmesg: sysfs: cannot create duplicate filename '/devices/platform/ACPI000E:00/time' Call Trace: dump_stack_lvl+0x6c/0x90 dump_stack+0x10/0x20 sysfs_warn_dup+0x8b/0xa0 sysfs_add_file_mode_ns+0x122/0x130 internal_create_group+0x1dd/0x4c0 sysfs_create_group+0x13/0x20 acpi_tad_probe+0x147/0x1f0 [acpi_tad] platform_probe+0x42/0xb0 acpi-tad ACPI000E:00: probe with driver acpi-tad failed with error -17 Fixes: 3230b2b3c1ab ("ACPI: TAD: Add low-level support for real time capability") Signed-off-by: Daniel Tang Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/2881298.hMirdbgypa@daniel-desktop3 Cc: 5.2+ # 5.2+ Signed-off-by: Rafael J. Wysocki commit 8181cc2f3f21657392da912eb20ee17514c87828 Author: E Shattow Date: Sat Aug 23 03:01:43 2025 -0700 riscv: dts: starfive: jh7110: bootph-pre-ram hinting needed by boot loader Add bootph-pre-ram hinting to jh7110.dtsi: - CPU interrupt controller(s) - gmac1_rgmii_rxin fixed-clock (dependency of syscrg) - gmac1_rmii_refin fixed-clock (dependency of syscrg) - oscillator - core local interrupt timer - syscrg clock-controller - pllclk clock-controller (dependency of syscrg) - DDR memory controller Signed-off-by: E Shattow Reviewed-by: Hal Feng Reviewed-by: Emil Renner Berthing Signed-off-by: Conor Dooley commit 7114969021ec5c4c0f3df1da3a8790f75dda92e2 Author: E Shattow Date: Sat Aug 23 03:01:42 2025 -0700 riscv: dts: starfive: jh7110: add DMC memory controller Add JH7110 SoC DDR external memory controller. Signed-off-by: E Shattow Reviewed-by: Hal Feng Reviewed-by: Emil Renner Berthing Signed-off-by: Conor Dooley commit f5e36ecc9e4a2a4bcd942ad1e9947e018ffd15b5 Author: E Shattow Date: Sat Aug 23 03:01:41 2025 -0700 dt-bindings: memory-controllers: add StarFive JH7110 SoC DMC Describe JH7110 SoC DDR external memory interface. Signed-off-by: E Shattow Reviewed-by: Krzysztof Kozlowski Reviewed-by: Emil Renner Berthing Signed-off-by: Conor Dooley commit ad7c7f4b9c6c2950778e5bd305392a333de73912 Author: Sebastian Andrzej Siewior Date: Thu Sep 4 16:25:23 2025 +0200 workqueue: Provide a handshake for canceling BH workers While a BH work item is canceled, the core code spins until it determines that the item completed. On PREEMPT_RT the spinning relies on a lock in local_bh_disable() to avoid a live lock if the canceling thread has higher priority than the BH-worker and preempts it. This lock ensures that the BH-worker makes progress by PI-boosting it. This lock in local_bh_disable() is a central per-CPU BKL and about to be removed. To provide the required synchronisation add a per pool lock. The lock is acquired by the bh_worker at the begin while the individual callbacks are invoked. To enforce progress in case of interruption, __flush_work() needs to acquire the lock. This will flush all BH-work items assigned to that pool. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Tejun Heo commit d8b269e009bbc471cb2735b5f737839495efce3b Author: Chuyi Zhou Date: Thu Sep 4 15:45:05 2025 +0800 cgroup: Remove unused cgroup_subsys::post_attach cgroup_subsys::post_attach callback was introduced in commit 5cf1cacb49ae ("cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback") and only cpuset would use this callback to wait for the mm migration to complete at the end of __cgroup_procs_write(). Since the previous patch defer the flush operation until returning to userspace, no one use this callback now. Remove this callback from cgroup_subsys. Signed-off-by: Chuyi Zhou Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 3514309e03222c0ad06cd3fda0f0d2c98e786bf8 Author: Chuyi Zhou Date: Thu Sep 4 15:45:04 2025 +0800 cpuset: Defer flushing of the cpuset_migrate_mm_wq to task_work Now in cpuset_attach(), we need to synchronously wait for flush_workqueue to complete. The execution time of flushing cpuset_migrate_mm_wq depends on the amount of mm migration initiated by cpusets at that time. When the cpuset.mems of a cgroup occupying a large amount of memory is modified, it may trigger extensive mm migration, causing cpuset_attach() to block on flush_workqueue for an extended period. This could be dangerous because cpuset_attach() is within the critical section of cgroup_mutex, which may ultimately cause all cgroup-related operations in the system to be blocked. This patch attempts to defer the flush_workqueue() operation until returning to userspace using the task_work which is originally proposed by tejun[1], so that flush happens after cgroup_mutex is dropped. That way we maintain the operation synchronicity while avoiding bothering anyone else. [1]: https://lore.kernel.org/cgroups/ZgMFPMjZRZCsq9Q-@slm.duckdns.org/T/#m117f606fa24f66f0823a60f211b36f24bd9e1883 Originally-by: Tejun Heo Signed-off-by: Chuyi Zhou Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit c0fb16ef887d364766d03574ec824509939cf9cc Author: Chuyi Zhou Date: Thu Sep 4 15:45:03 2025 +0800 cpuset: Don't always flush cpuset_migrate_mm_wq in cpuset_write_resmask It is unnecessary to always wait for the flush operation of cpuset_migrate_mm_wq to complete in cpuset_write_resmask, as modifying cpuset.cpus or cpuset.exclusive does not trigger mm migrations. The flush_workqueue can be executed only when cpuset.mems is modified. Signed-off-by: Chuyi Zhou Reviewed-by: Michal Koutný Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit c221cbf8dc547eb8489152ac62ef103fede99545 Author: Richard Zhu Date: Wed Aug 20 10:23:28 2025 +0800 PCI: imx6: Enable the Vaux supply if available When the 3.3Vaux supply is present, fetch it at the probe time and keep it enabled for the entire PCIe controller lifecycle so that the link can enter L2 state and the devices can signal wakeup using either Beacon or WAKE# mechanisms. Signed-off-by: Richard Zhu [mani: reworded the subject, description and error message] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20250820022328.2143374-1-hongxing.zhu@nxp.com commit 554f6006c3c050026a0a505dfedfe03407e267e1 Merge: d3e39580981eae dd7ae5b8b3c291 Author: Mark Brown Date: Thu Sep 4 18:03:58 2025 +0100 Improve cs42l43 suspend/IRQ interactions Merge series from Charles Keepax : cs42l43 uses pm_runtime_force_suspend() during system suspend, however this means care must be taken that IRQ handler code isn't running when entering system suspend as force suspend will ignore that the handler is holding a pm reference. Typically the result of this is just a few error messages, but better to improve the handling and ensure that all IRQ processing is synchronised in before system suspend. commit d3e39580981eae66c190bc8487368b0e5c4da773 Merge: 7748328c2fd82e 0ccc1eeda155c9 Author: Mark Brown Date: Thu Sep 4 18:03:54 2025 +0100 ASoC: dt-bindings: Document routing strings for Merge series from Jihed Chaibi : The series adds pin names for the es8316, wm8960, and nau8825 codecs to their respective binding files to improve the user experience for board developers. commit ea5fbbc15906abdef174c88cecfec4b2a0c748b9 Author: Ziyue Zhang Date: Thu Sep 4 14:52:24 2025 +0800 PCI: qcom: Fix macro typo for CURSOR Correct a typo in the macro names GEN3_EQ_FMDC_MAX_PRE_CURSOR_DELTA and GEN3_EQ_FMDC_MAX_POST_CURSOR_DELTA. Signed-off-by: Ziyue Zhang [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20250904065225.1762793-3-ziyue.zhang@oss.qualcomm.com commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 Author: Ziyue Zhang Date: Thu Sep 4 14:52:23 2025 +0800 PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link stability and avoid AER Correctable Errors reported on some platforms (eg. SA8775P). 8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting. This setting is programmed into a group of shadow registers, which can be switched to configure equalization for different speeds by writing 00b, 01b and 10b to `RATE_SHADOW_SEL`. Hence, program equalization registers in a loop using link speed as index, so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s and 32.0 GT/s. Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes") Co-developed-by: Qiang Yu Signed-off-by: Qiang Yu Signed-off-by: Ziyue Zhang [mani: wrapped the warning to fit 100 columns, used post-increment for loop] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com commit 01f3a6d1d59b8e25a6de243b0d73075cf0415eaf Author: Jerome Brunet Date: Mon Aug 25 16:26:37 2025 +0200 clk: amlogic: c3-peripherals: use helper for basic composite clocks Use the composite clock helpers to define simple composite clocks of the c3-peripherals clock controller. This reduces the verbosity of the controller code on these very simple parts, making maintenance simpler. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-12-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 9bada5ff4bf7a057d40ae49eab5d9081535b5f3c Author: Jerome Brunet Date: Mon Aug 25 16:26:36 2025 +0200 clk: amlogic: align s4 and c3 pwm clock descriptions s4 and c3 follow exactly the same structure when it comes to PWM clocks but differ in the way these clocks are described, for no obvious reason. Align the description of the pwm clocks of these SoCs with the composite clock helpers. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-11-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 955e18baeb933096f417ac01d6781380d7c8a374 Author: Jerome Brunet Date: Mon Aug 25 16:26:35 2025 +0200 clk: amlogic: add composite clock helpers Device composite clocks tend to reproduce the usual sel/div/gate arrangement. Add macros to help define simple composite clocks in the system. The idea is _not_ to replace all instances of mux, div or gate with those macros. It is rather to use it for recurring and/or simple composite clocks, reducing controller verbosity where it makes sense. This should help reviews focus on the tricky parts. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-10-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit b7358d14f176a5508d6330dc967b4ce3a5b08684 Author: Jerome Brunet Date: Mon Aug 25 16:26:34 2025 +0200 clk: amlogic: use the common pclk definition Replace marcros defining pclks with the common one, reducing code duplication. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-9-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit aaee6f3bce3fe11ecdb7357a4b5a620205c4ecea Author: Jerome Brunet Date: Mon Aug 25 16:26:33 2025 +0200 clk: amlogic: introduce a common pclk definition All Amlogic peripheral clocks are more or less the same. The only thing that differs is the parent data. Adapt the common pclk definition so it takes clk_parent_data and can be used by all controllers. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-8-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit c3f369363a138638edd33a6f2fa97b6770a97c96 Author: Jerome Brunet Date: Mon Aug 25 16:26:32 2025 +0200 clk: amlogic: pclk explicitly use CLK_IGNORE_UNUSED Every usage of CLK_IGNORE_UNUSED should be explicitly motivated and documented. However, the PCLK macros used by most Amlogic platforms are adding that flag systematically. Because of this, all pclks are marked with CLK_IGNORE_UNUSED, without any form of distinction or motivation. This may have been fine in the early days of CCF but it is not anymore. Just removing the flag is not an option at this stage since it could cause regression on existing platforms. Instead, drop the flag from the macro definition and add it to the each clock definition, for the existing clocks. This makes quite a nasty change but it will make it a lot easier for people to contribute to fixing the problem, clock by clock. It will also prevent new platform from being added with a silent use of the flag. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-7-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit cf03071b7c3f1537dba21a64bcd1559b5201a156 Author: Jerome Brunet Date: Mon Aug 25 16:26:31 2025 +0200 clk: amlogic: drop CLK_SET_RATE_PARENT from peripheral clocks On Amlogic SoCs, the rate of a peripheral clock should not be changed, let alone the rate of the parent PLL. These clocks are meant to be used as provided by the parent PLL. Changing the rate would be dangerous and would likely break a lot of devices running from the same PLL. Don't propagate any rate change request that may come from these clocks and drop the corresponding flag. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-6-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 32ee5475f7e34fbd6539998a4e5f9bd05486672e Author: Jerome Brunet Date: Mon Aug 25 16:26:30 2025 +0200 clk: amlogic: move PCLK definition to clkc-utils clk-regmap was always meant to stay generic, without any amlogic specifics. The hope was that it could move out of the amlogic directory one day. Even if this may actually not become true, it should remain generic. Move the amlogic peripheral clock definition out of clk-regmap header. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-5-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 2aeeb649ead230c37415891c89bade3a8ad9eb0b Author: Jerome Brunet Date: Mon Aug 25 16:26:29 2025 +0200 clk: amlogic: aoclk: use clkc-utils syscon probe The clock related part of aoclk probe function duplicates what the clkc-utils syscon helper does. Factorize this to have a single path to maintain. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-4-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit d7c001bd76b7f7e6c05f615d472b5daadc87b434 Author: Jerome Brunet Date: Mon Aug 25 16:26:28 2025 +0200 clk: amlogic: use probe helper in mmio based controllers Factorize the probe function of the mmio based amlogic clock controllers using the newly introduced probe helper. This removes a fair amount of duplicated code. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-3-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 480197ceece792b887a6f3361080a030eb8e4846 Author: Jerome Brunet Date: Mon Aug 25 16:26:27 2025 +0200 clk: amlogic: add probe helper for mmio based controllers Add a 2nd probe function helper for mmio based controllers, which are getting the memory region from a resource instead of a syscon. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-2-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit e256a6602aa0914ff8a40724505ef2a5314a6e8e Author: Jerome Brunet Date: Mon Aug 25 16:26:26 2025 +0200 clk: amlogic: drop meson-clkcee What is being done by the Amlogic clock controller registration helper for EE controllers could benefit other controllers. As such, having a specific module for this makes little sense. Move the helper function to clkc-utils and rename it to describe what it does, registering syscon based controller, instead of what it serves. Link: https://lore.kernel.org/r/20250825-meson-clk-cleanup-24-v2-1-0f402f01e117@baylibre.com Signed-off-by: Jerome Brunet commit 8e92c9902ff11a1c2aab229a3d7d4c1d7e5b698f Author: Danilo Krummrich Date: Wed Aug 20 16:53:38 2025 +0200 rust: alloc: vmalloc: implement Vmalloc::to_page() Implement an abstraction of vmalloc_to_page() for subsequent use in the AsPageIter implementation of VBox and VVec. Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250820145434.94745-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 467971a908761540cc60b4da22639c440dc05462 Author: Danilo Krummrich Date: Wed Aug 20 16:53:37 2025 +0200 rust: page: implement BorrowedPage Currently, a Page always owns the underlying struct page. However, sometimes a struct page may be owned by some other entity, e.g. a vmalloc allocation. Hence, introduce BorrowedPage to support such cases, until the Ownable solution [1] lands. This is required by the scatterlist abstractions. Acked-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/rust-for-linux/ZnCzLIly3DRK2eab@boqun-archlinux/ [1] Link: https://lore.kernel.org/r/20250820145434.94745-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit cda2b2d647f7e467e53655b56ff430732fb1fa17 Author: Zqiang Date: Thu Sep 4 19:31:33 2025 +0800 workqueue: Remove rcu_read_lock/unlock() in wq_watchdog_timer_fn() The wq_watchdog_timer_fn() is executed in the softirq context, this is already in the RCU read critical section, this commit therefore remove rcu_read_lock/unlock() in wq_watchdog_timer_fn(). Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit fd5081f4ef3325b49d26e41b5976d1f34032ca9b Author: Zqiang Date: Thu Sep 4 19:31:32 2025 +0800 workqueue: Remove redundant rcu_read_lock/unlock() in workqueue_congested() The preempt_disable/enable() has already formed RCU read crtical section, this commit therefore remove rcu_read_lock/unlock() in workqueue_congested(). Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit 2d92ef7da2605fdb01db9b547e99d9ea8790c8eb Merge: 929adf8838f776 88a3bde432b826 Author: Alexei Starovoitov Date: Thu Sep 4 09:05:58 2025 -0700 Merge branch 'selftests-bpf-introduce-experimental-bpf_in_interrupt' Leon Hwang says: ==================== selftests/bpf: Introduce experimental bpf_in_interrupt() Filtering pid_tgid is meanlingless when the current task is preempted by an interrupt. To address this, introduce 'bpf_in_interrupt()' helper function, which allows BPF programs to determine whether they are executing in interrupt context. 'get_preempt_count()': * On x86, '*(int *) bpf_this_cpu_ptr(&__preempt_count)'. * On arm64, 'bpf_get_current_task_btf()->thread_info.preempt.count'. Then 'bpf_in_interrupt()' will be: * If !PREEMPT_RT, 'get_preempt_count() & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_MASK)'. * If PREEMPT_RT, '(get_preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | (bpf_get_current_task_btf()->softirq_disable_cnt & SOFTIRQ_MASK)'. 'bpf_in_interrupt()' runs well when PREEMPT_RT is enabled. But it's difficult for me to test it well because I'm not familiar with PREEMPT_RT. Changes: v2 -> v3: * Address comments from Alexei: * Move bpf_in_interrupt() to bpf_experimental.h. * Add support for arm64. v2: https://lore.kernel.org/bpf/20250825131502.54269-1-leon.hwang@linux.dev/ v1 -> v2: * Fix a build error reported by test bot. ==================== Link: https://patch.msgid.link/20250903140438.59517-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 88a3bde432b8263660793bce84910dd44f46ef25 Author: Leon Hwang Date: Wed Sep 3 22:04:38 2025 +0800 selftests/bpf: Add case to test bpf_in_interrupt() Add a timer test case to test 'bpf_in_interrupt()'. cd tools/testing/selftests/bpf ./test_progs -t timer_interrupt 462 timer_interrupt:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250903140438.59517-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 4b69e31329b6ef22dc80b45d4a865f57c2346d44 Author: Leon Hwang Date: Wed Sep 3 22:04:37 2025 +0800 selftests/bpf: Introduce experimental bpf_in_interrupt() Filtering pid_tgid is meanlingless when the current task is preempted by an interrupt. To address this, introduce 'bpf_in_interrupt()' helper function, which allows BPF programs to determine whether they are executing in interrupt context. 'get_preempt_count()': * On x86, '*(int *) bpf_this_cpu_ptr(&__preempt_count)'. * On arm64, 'bpf_get_current_task_btf()->thread_info.preempt.count'. Then 'bpf_in_interrupt()' will be: * If !PREEMPT_RT, 'get_preempt_count() & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_MASK)'. * If PREEMPT_RT, '(get_preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | (bpf_get_current_task_btf()->softirq_disable_cnt & SOFTIRQ_MASK)'. As for other archs, it can be added support by updating 'get_preempt_count()'. Suggested-by: Alexei Starovoitov Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250903140438.59517-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 929adf8838f7765f0bd57235f0e6f365ff628a0d Author: Hengqi Chen Date: Thu Sep 4 07:57:03 2025 +0000 bpf, arm64: Remove duplicated bpf_flush_icache() The bpf_flush_icache() is done by bpf_arch_text_copy() already. Remove the duplicated one in arch_prepare_bpf_trampoline(). Signed-off-by: Hengqi Chen Acked-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250904075703.49404-1-hengqi.chen@gmail.com Signed-off-by: Alexei Starovoitov commit abc8a952d4aa1cdb72e90df280d1fe6fc50ed631 Author: Rong Tao Date: Wed Sep 3 07:48:36 2025 +0800 selftests/bpf: Test kfunc bpf_strcasecmp Add testsuites for kfunc bpf_strcasecmp. Signed-off-by: Rong Tao Link: https://lore.kernel.org/r/tencent_81A1A0ACC04B68158C57C4D151C46A832B07@qq.com Signed-off-by: Alexei Starovoitov commit 19559e8441843bb36ecc78bb8d5cf82d500352fd Author: Rong Tao Date: Wed Sep 3 07:47:10 2025 +0800 bpf: add bpf_strcasecmp kfunc bpf_strcasecmp() function performs same like bpf_strcmp() except ignoring the case of the characters. Signed-off-by: Rong Tao Acked-by: Yonghong Song Acked-by: Viktor Malik Link: https://lore.kernel.org/r/tencent_292BD3682A628581AA904996D8E59F4ACD06@qq.com Signed-off-by: Alexei Starovoitov commit 525ac69b1eba2d6088339187ddb8e16e96dca638 Merge: c9110e6f7237f4 a85d888768ea0e Author: Alexei Starovoitov Date: Thu Sep 4 09:00:26 2025 -0700 Merge branch 'selftests-bpf-benchmark-all-symbols-for-kprobe-multi' Menglong Dong says: ==================== selftests/bpf: benchmark all symbols for kprobe-multi Add the benchmark testcase "kprobe-multi-all", which will hook all the kernel functions during the testing. This series is separated out from [1]. Changes since V2: * add some comment to attach_ksyms_all, which notes that don't run the testing on a debug kernel Changes since V1: * introduce trace_blacklist instead of copy-pasting strcmp in the 2nd patch * use fprintf() instead of printf() in 3rd patch Link: https://lore.kernel.org/bpf/20250817024607.296117-1-dongml2@chinatelecom.cn/ [1] ==================== Link: https://patch.msgid.link/20250904021011.14069-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit a85d888768ea0e024dcc9d5fb172e7be8fd7d631 Author: Menglong Dong Date: Thu Sep 4 10:10:11 2025 +0800 selftests/bpf: add benchmark testing for kprobe-multi-all For now, the benchmark for kprobe-multi is single, which means there is only 1 function is hooked during testing. Add the testing "kprobe-multi-all", which will hook all the kernel functions during the benchmark. And the "kretprobe-multi-all" is added too. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250904021011.14069-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit adf6b57ce46ce685a65d54397c4389df754b6a99 Author: Menglong Dong Date: Thu Sep 4 10:10:10 2025 +0800 selftests/bpf: skip recursive functions for kprobe_multi Some functions is recursive for the kprobe_multi and impact the benchmark results. So just skip them. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250904021011.14069-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 8bad31edf5490a38dc26163502cd7005a033ee05 Author: Menglong Dong Date: Thu Sep 4 10:10:09 2025 +0800 selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c We need to get all the kernel function that can be traced sometimes, so we move the get_syms() and get_addrs() in kprobe_multi_test.c to trace_helpers.c and rename it to bpf_get_ksyms() and bpf_get_addrs(). Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250904021011.14069-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit c975e1dfcc929dbfde8abfa514494b66f0335006 Author: Alexandra Winter Date: Mon Sep 1 16:58:42 2025 +0200 net/smc: Improve log message for devices w/o pnetid Explicitly state in the log message, when a device has no pnetid. "with pnetid" and "has pnetid" was misleading for devices without pnetid. Signed-off-by: Alexandra Winter Reviewed-by: Dust Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901145842.1718373-3-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 2f509fe6a42cda845890273fe759fb7ba9edad97 Author: Lizhi Hou Date: Tue Sep 2 22:34:02 2025 -0700 accel/amdxdna: Add ioctl DRM_IOCTL_AMDXDNA_GET_ARRAY Add interface for applications to get information array. The application provides a buffer pointer along with information type, maximum number of entries and maximum size of each entry. The buffer may also contain match conditions based on the information type. After the ioctl completes, the actual number of entries and entry size are returned. (see [1], used by driver runtime library) [1] https://github.com/amd/xdna-driver/blob/main/src/shim/host/platform_host.cpp#L337 Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Maciej Falkowski Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250903053402.2103196-1-lizhi.hou@amd.com commit c8ab5e888bb6721e6e084881e6e24ef2678832c3 Author: Lukas Wunner Date: Mon Sep 1 09:44:52 2025 +0200 PCI/AER: Print TLP Log for errors introduced since PCIe r1.1 When reporting an error, the AER driver prints the TLP Header / Prefix Log only for errors enumerated in the AER_LOG_TLP_MASKS macro. The macro was never amended since its introduction in 2006 with commit 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver"). At the time, PCIe r1.1 was the latest spec revision. Amend the macro with errors defined since then to avoid omitting the TLP Header / Prefix Log for newer errors. The order of the errors in AER_LOG_TLP_MASKS follows PCIe r1.1 sec 6.2.7 rather than 7.10.2, because only the former documents for which errors a TLP Header / Prefix is logged. Retain this order. The section number is still 6.2.7 in today's PCIe r7.0. For Completion Timeouts, the TLP Header / Prefix is only logged if the Completion Timeout Prefix / Header Log Capable bit is set in the AER Capabilities and Control register. Introduce a tlp_header_logged() helper to check whether the TLP Header / Prefix Log is populated and use it in the two places which currently match against AER_LOG_TLP_MASKS directly. For Uncorrectable Internal Errors, logging of the TLP Header / Prefix is optional per PCIe r7.0 sec 6.2.7. If needed, drivers could indicate through a flag whether devices are capable and tlp_header_logged() could then check that flag. pcitools introduced macros for newer errors with commit 144b0911cc0b ("ls-ecaps: extend decode support for more fields for AER CE and UE status"): https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/?id=144b0911cc0b Unfortunately some of those macros are overly long: PCI_ERR_UNC_POISONED_TLP_EGRESS PCI_ERR_UNC_DMWR_REQ_EGRESS_BLOCKED PCI_ERR_UNC_IDE_CHECK PCI_ERR_UNC_MISR_IDE_TLP PCI_ERR_UNC_PCRC_CHECK PCI_ERR_UNC_TLP_XLAT_EGRESS_BLOCKED This seems unsuitable for , so shorten to: PCI_ERR_UNC_POISON_BLK PCI_ERR_UNC_DMWR_BLK PCI_ERR_UNC_IDE_CHECK PCI_ERR_UNC_MISR_IDE PCI_ERR_UNC_PCRC_CHECK PCI_ERR_UNC_XLAT_BLK Note that some of the existing macros in do not match exactly with pcitools (e.g. PCI_ERR_UNC_SDES versus PCI_ERR_UNC_SURPDN), so it does not seem mandatory for them to be identical. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/5f707caf1260bd8f15012bb032f7da9a9b898aba.1756712066.git.lukas@wunner.de commit b1763769917723743284389803b4a0e0e09b849b Author: SeonGu Kang Date: Mon Sep 1 10:49:25 2025 +0530 arm64: dts: axis: Add ARTPEC-8 Grizzly dts support Add initial devcie tree for the ARTPEC-8 Grizzly board. The ARTPEC-8 Grizzly is a small board developed by Axis, based on the Axis ARTPEC-8 SoC. Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250901051926.59970-6-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 639f8e36baf1c7c6592ef267f696db981c62c2b6 Author: SungMin Park Date: Mon Sep 1 10:49:24 2025 +0530 arm64: dts: exynos: axis: Add initial ARTPEC-8 SoC support Add initial device tree support for Axis ARTPEC-8 SoC. This SoC contains 4 Cortex-A53 CPUs and several other peripheral IPs. Signed-off-by: SungMin Park Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250901051926.59970-5-ravi.patel@samsung.com Acked-by: Jesper Nilsson Signed-off-by: Krzysztof Kozlowski commit 2aef21a6a60305244ab3508c5d15b24a8ac8e66f Author: Eric Dumazet Date: Thu Sep 4 07:25:37 2025 +0000 audit: init ab->skb_list earlier in audit_buffer_alloc() syzbot found a bug in audit_buffer_alloc() if nlmsg_new() returns NULL. We need to initialize ab->skb_list before calling audit_buffer_free() which will use both the skb_list spinlock and list pointers. Fixes: eb59d494eebd ("audit: add record for multiple task security contexts") Reported-by: syzbot+bb185b018a51f8d91fd2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/68b93e3c.a00a0220.eb3d.0000.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Casey Schaufler Cc: Paul Moore Cc: Eric Paris Cc: audit@vger.kernel.org Signed-off-by: Paul Moore commit 4521438fb076f8a6a52f45b0e508f6ef10ac0c49 Author: Lyude Paul Date: Wed Aug 20 16:26:44 2025 -0400 rust: time: Implement basic arithmetic operations for Delta While rvkms is only going to be using a few of these, since Deltas are basically the same as i64 it's easy enough to just implement all of the basic arithmetic operations for Delta types. Keep in mind there's one quirk here - the kernel has no support for i64 % i64 on 32 bit platforms, the closest we have is i64 % i32 through div_s64_rem(). So, instead of implementing ops::Rem or ops::RemAssign we simply provide Delta::rem_nanos(). Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: FUJITA Tomonori Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250820203704.731588-3-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 22b65a40574e597e1919ca22cc3535c2b541f764 Author: Lyude Paul Date: Wed Aug 20 16:26:43 2025 -0400 rust: time: Implement Add/Sub for Instant In order to copy the behavior rust currently follows for basic arithmetic operations and panic if the result of an addition or subtraction results in a value that would violate the invariants of Instant, but only if the kernel has overflow checking for rust enabled. Signed-off-by: Lyude Paul Reviewed-by: Alice Ryhl Reviewed-by: FUJITA Tomonori Reviewed-by: Andreas Hindborg Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250820203704.731588-2-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 4b0147494275fdbea98305f4ddad7e2def7b556f Author: Lyude Paul Date: Thu Aug 21 15:32:47 2025 -0400 rust: hrtimer: Add HrTimer::expires() Add a simple callback for retrieving the current expiry time for an HrTimer. In rvkms, we use the HrTimer expiry value in order to calculate the approximate vblank timestamp during each emulated vblank interrupt. Signed-off-by: Lyude Paul Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250821193259.964504-8-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 583802cc99bdac95d173aaf1fc58e99993aa1d1d Author: Lyude Paul Date: Thu Aug 21 15:32:46 2025 -0400 rust: time: Add Instant::from_ktime() For implementing Rust bindings which can return a point in time. Signed-off-by: Lyude Paul Reviewed-by: Andreas Hindborg Reviewed-by: Alice Ryhl Reviewed-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250821193259.964504-7-lyude@redhat.com Signed-off-by: Andreas Hindborg commit ac0a7bd27f6593dfe9ea6b65538bebbbd8322241 Author: Lyude Paul Date: Thu Aug 21 15:32:45 2025 -0400 rust: hrtimer: Add forward_now() to HrTimer and HrTimerCallbackContext Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250821193259.964504-6-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 3f2a5ba784b808109cac0aac921213e43143a216 Author: Lyude Paul Date: Thu Aug 21 15:32:44 2025 -0400 rust: hrtimer: Add HrTimerCallbackContext and ::forward() With Linux's hrtimer API, there's a number of methods that can only be called in two situations: * When we have exclusive access to the hrtimer and it is not currently active * When we're within the context of an hrtimer callback context This commit handles the second situation and implements hrtimer_forward() support in the context of a timer callback. We do this by introducing a HrTimerCallbackContext type which is provided to users during the RawHrTimerCallback::run() callback, and then add a forward() function to the type. Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250821193259.964504-5-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 3efb9ce91c5279d7ea73563d1fb136077f52dd2e Author: Lyude Paul Date: Thu Aug 21 15:32:43 2025 -0400 rust: hrtimer: Add HrTimer::raw_forward() and forward() Within the hrtimer API there are quite a number of functions that can only be safely called from one of two contexts: * When we have exclusive access to the hrtimer and the timer is not active. * When we're within the hrtimer's callback context as it is being executed. This commit adds bindings for hrtimer_forward() for the first such context, along with HrTimer::raw_forward() for later use in implementing the hrtimer_forward() in the latter context. Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250821193259.964504-4-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 0e2aab67f2d5716e8db73b6d0719208b44086ed5 Author: Lyude Paul Date: Thu Aug 21 15:32:42 2025 -0400 rust: hrtimer: Add HrTimerInstant Since we want to add HrTimer methods that can accept Instants, we will want to make sure that for each method we are using the correct Clocksource for the given HrTimer. This would get a bit overly-verbose, so add a simple HrTimerInstant type-alias to handle this for us. Signed-off-by: Lyude Paul Reviewed-by: Andreas Hindborg Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250821193259.964504-3-lyude@redhat.com Signed-off-by: Andreas Hindborg commit a984da24e7ac411c95bab7b6c127bae4927f9d03 Author: Lyude Paul Date: Thu Aug 21 15:32:41 2025 -0400 rust: hrtimer: Document the return value for HrTimerHandle::cancel() Just a drive-by fix I noticed: we don't actually document what the return value from cancel() does, so do that. Signed-off-by: Lyude Paul Reviewed-by: Andreas Hindborg Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250821193259.964504-2-lyude@redhat.com Signed-off-by: Andreas Hindborg commit 462272dd734b568f0190d01e24f5257c1a763fae Author: Xichao Zhao Date: Tue Aug 12 16:27:09 2025 +0800 configfs: use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Reviewed-by: Breno Leitao Link: https://lore.kernel.org/r/20250812082709.49796-1-zhao.xichao@vivo.com Signed-off-by: Andreas Hindborg commit 0fec357ad073e555e7553dbc0d32278b0aaa2179 Author: Duje Mihanović Date: Sun Aug 24 18:12:05 2025 +0200 dt-bindings: input: touchscreen: imagis: add missing minItems The binding currently expects exactly 5 keycodes, which matches the chip's theoretical maximum but probably not the number of touch keys on any phone using the IST3032C. Add a minItems value of 2 to prevent dt-validate complaints. Also add another example to make sure the linux,keycodes property is checked. Signed-off-by: Duje Mihanović Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250824-imagis-minitems-v1-1-cea9db55e87f@dujemihanovic.xyz Signed-off-by: Dmitry Torokhov commit a50e7864ca44f519935cdb04796c714eb9d6670c Author: Qianfeng Rong Date: Wed Sep 3 20:34:03 2025 +0800 net: dsa: dsa_loop: use int type to store negative error codes Change the 'ret' variable in dsa_loop_init() from unsigned int to int, as it needs to store either negative error codes or zero returned by mdio_driver_register(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250903123404.395946-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 311942ce763e21dacef7e53996d5a1e19b8adab1 Author: Shang song (Lenovo) Date: Mon Aug 25 23:02:29 2025 -0400 ACPI: PRM: Skip handlers with NULL handler_address or NULL VA If handler_address or mapped VA is NULL, the related buffer address and VA can be ignored, so make acpi_parse_prmt() skip the current handler in those cases. Signed-off-by: Shang song (Lenovo) Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 43181a47263dd9f2bee0afd688a841b09f9b7d12 Author: Borislav Petkov (AMD) Date: Wed Aug 20 15:50:43 2025 +0200 x86/microcode: Add microcode loader debugging functionality Instead of adding ad-hoc debugging glue to the microcode loader each time I need it, add debugging functionality which is not built by default. Simulate all patch handling the loader does except the actual loading of the microcode patch into the hardware. Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250820135043.19048-3-bp@kernel.org commit 3cd4c4f3955bd97470cc8728c28327cffb09f71e Author: Conley Lee Date: Wed Sep 3 16:22:38 2025 +0800 dt-bindings: net: sun4i-emac: add dma support The sun4i EMAC supports DMA for data transmission, so it is necessary to add DMA options to the device tree bindings. Signed-off-by: Conley Lee Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/tencent_4E434174E9D516431365413D1B8047C6BB06@qq.com Signed-off-by: Jakub Kicinski commit 632ff61706473127cdc3b779bf24d368e3856ab3 Author: Borislav Petkov (AMD) Date: Wed Aug 20 15:50:42 2025 +0200 x86/microcode: Add microcode= cmdline parsing Add a "microcode=" command line argument after which all options can be passed in a comma-separated list. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sohil Mehta Reviewed-by: Chang S. Bae Link: https://lore.kernel.org/20250820135043.19048-2-bp@kernel.org commit 855042367e3f1ddc1e896fcd00af9c397d1174cb Author: Sohil Mehta Date: Mon Aug 18 12:01:36 2025 -0700 x86/microcode/intel: Refresh the revisions that determine old_microcode Update the minimum expected revisions of Intel microcode based on the microcode-20250512 (May 2025) release. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/all/20250818190137.3525414-2-sohil.mehta%40intel.com commit 7ee0f223cabe9b9384250024fec577c731cbcf72 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:41 2025 +0200 arm64: dts: toshiba: tmpv7708: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: tmpv7708.dtsi:503.4-507.28: Warning (interrupt_map): /soc/pcie@28400000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@24001000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Reviewed-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20250822133340.312380-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 3d1963e503d752ba33446ad056435c687f6d8d83 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:34:25 2025 +0200 arm64: dts: amazon: alpine-v3: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: alpine-v3.dtsi:342.4-349.33: Warning (interrupt_map): /soc/pcie@fbd00000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@f0800000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Link: https://lore.kernel.org/r/20250822133423.312621-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit b32a24f21283fbc86922006cc7d19fd23f70b8b8 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:34:24 2025 +0200 arm64: dts: amazon: alpine-v2: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: alpine-v2.dtsi:138.4-139.33: Warning (interrupt_map): /soc/pci@fbc00000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@f0200000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Link: https://lore.kernel.org/r/20250822133423.312621-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit d5cb16361f89e7f60da76c7e9e32c72c49db3e82 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:34:17 2025 +0200 arm64: dts: apm: storm: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: apm-storm.dtsi:636.4-639.42: Warning (interrupt_map): /soc/pcie@1f2b0000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@78010000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Link: https://lore.kernel.org/r/20250822133416.312544-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit f00a5dc81744250e7a3f843adfe12d7883282c56 Author: Denzeel Oliva Date: Sun Aug 31 12:13:16 2025 +0000 clk: samsung: exynos990: Add missing USB clock registers to HSI0 These registers are required for proper USB operation and were omitted in the initial clock controller setup. Signed-off-by: Denzeel Oliva Link: https://lore.kernel.org/r/20250831-usb-v2-3-00b9c0559733@gmail.com Signed-off-by: Krzysztof Kozlowski commit d0563d320b6014a8d56170253fe0aec524658b9f Author: Denzeel Oliva Date: Sun Aug 31 12:13:15 2025 +0000 clk: samsung: exynos990: Add LHS_ACEL gate clock for HSI0 and update CLK_NR_TOP Add the LHS_ACEL gate clock to the HSI0 clock controller. This clock is critical for USB functionality and mark it as critical to keep it enabled. Update CLK_NR_TOP to include the new clock. Signed-off-by: Denzeel Oliva Link: https://lore.kernel.org/r/20250831-usb-v2-2-00b9c0559733@gmail.com Signed-off-by: Krzysztof Kozlowski commit eb9bc162775cabfc4cf2b37cb0d3c2c2bf4c4b54 Author: Denzeel Oliva Date: Sun Aug 31 12:13:14 2025 +0000 dt-bindings: clock: exynos990: Add LHS_ACEL clock ID for HSI0 block Add the missing LHS_ACEL clock ID for the HSI0 block. This clock is required for proper USB operation, as without it, USB connections fail with errors like device descriptor read timeouts and address response issues. Signed-off-by: Denzeel Oliva Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250831-usb-v2-1-00b9c0559733@gmail.com Signed-off-by: Krzysztof Kozlowski commit eca86a61aedaa40310135c8799b28187afbc677e Author: SungMin Park Date: Mon Sep 1 10:49:26 2025 +0530 arm64: defconfig: Enable Axis ARTPEC SoC Enable the Axis ARTPEC-8 SoC in arm64 defconfig. Signed-off-by: SungMin Park Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250901051926.59970-7-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 604a932fa924e7b15be47c6208a305f289cfa309 Author: SungMin Park Date: Mon Sep 1 10:49:23 2025 +0530 dt-bindings: arm: axis: Add ARTPEC-8 grizzly board Document the Axis ARTPEC-8 SoC binding and the grizzly board which uses ARTPEC-8 SoC. Signed-off-by: SungMin Park Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250901051926.59970-4-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit cf13bed78c90b2c0fc65774e86d564c868fa2a23 Author: Barnabás Czémán Date: Wed Sep 3 23:08:23 2025 +0200 dt-bindings: firmware: qcom,scm: Add MSM8937 Add compatible for MSM8937. Acked-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250903-msm8937-v9-3-a097c91c5801@mainlining.org Signed-off-by: Bjorn Andersson commit 6be1f55f33f615c3cafee96bc514a74a9fa43885 Author: Daniil Titov Date: Wed Sep 3 23:08:22 2025 +0200 clk: qcom: gcc: Add support for Global Clock controller found on MSM8937 Modify existing MSM8917 driver to support MSM8937 SoC. Override frequencies which are different in this chip. Register all the clocks to the framework for the clients to be able to request for them. Add new variant of GDSC for new chip. Signed-off-by: Daniil Titov Reviewed-by: Dmitry Baryshkov Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250903-msm8937-v9-2-a097c91c5801@mainlining.org Signed-off-by: Bjorn Andersson commit 154691e7c940971ad81b7b41c096bc0f6ae6e1cf Merge: 9524f95c404254 4d32c1f66a768d Author: Bjorn Andersson Date: Thu Sep 4 08:38:00 2025 -0500 Merge branch '20250903-msm8937-v9-1-a097c91c5801@mainlining.org' into clk-for-6.18 Merge the MSM8937 global clock controller binding through a topic branch to allow merging the constants into the DeviceTree branch as well. commit 4d32c1f66a768dd281edadbd244dce1c63c0899d Author: Barnabás Czémán Date: Wed Sep 3 23:08:21 2025 +0200 dt-bindings: clock: qcom: Add MSM8937 Global Clock Controller Add device tree bindings for the global clock controller on Qualcomm MSM8937 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250903-msm8937-v9-1-a097c91c5801@mainlining.org Signed-off-by: Bjorn Andersson commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 Author: Cryolitia PukNgae Date: Wed Sep 3 13:09:48 2025 +0800 ALSA: usb-audio: apply quirk for MOONDROP Quark2 It reports a MIN value -15360 for volume control, but will mute when setting it less than -14208 Tested-by: Guoli An Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com commit 806a38293fc0dfc80e556ec8f389dffc6ea90059 Author: Cryolitia PukNgae Date: Wed Sep 3 13:09:47 2025 +0800 ALSA: usb-audio: apply "mixer_min_mute" quirks on some devices - QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE - QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE Suggested-by: Guoli An Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250903-sound-v1-3-d4ca777b8512@uniontech.com commit 759b5ce3e6e804ee333f0e0da3cf93c38b77b890 Author: Cryolitia PukNgae Date: Wed Sep 3 13:09:46 2025 +0800 ALSA: usb-audio: add quirk QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE The same hardware problem to QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE also occurs on the capture streams on some USB devices. Add a new flag for processing the quirk. Link: https://lore.kernel.org/all/C22C1A172EBB9BD9+eccc2e4a-d21e-4a7d-848c-bbf3982feb94@uniontech.com/ Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250903-sound-v1-2-d4ca777b8512@uniontech.com commit ace1817ab49b3f92b3e965caa63b4a78e69266cd Author: Cryolitia PukNgae Date: Wed Sep 3 13:09:45 2025 +0800 ALSA: usb-audio: rename QUIRK_FLAG_MIXER_MIN_MUTE to QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE As a preparation of introduction QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE Also make it printing an info while applying Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250903-sound-v1-1-d4ca777b8512@uniontech.com commit 9524f95c4042545ee8fc3191b9b89c61a1aca6fb Author: Lukas Bulwahn Date: Tue Sep 2 14:17:54 2025 +0200 clk: qcom: Select the intended config in QCS_DISPCC_615 Commit 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver") adds the config QCS_DISPCC_615, which selects the non-existing config QCM_GCC_615. Probably, this is just a three-letter abbreviation mix-up here, though. There is a config named QCS_GCC_615, and the related config QCS_CAMCC_615 selects that config. Fix the typo and use the intended config name in the select command. Fixes: 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver") Signed-off-by: Lukas Bulwahn Reviewed-by: Imran Shaik Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250902121754.277452-1-lukas.bulwahn@redhat.com Signed-off-by: Bjorn Andersson commit 1e50f5c9965252ed6657b8692cd7366784d60616 Author: Dan Carpenter Date: Tue Sep 2 09:33:36 2025 +0300 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() The devm_clk_hw_get_clk() function doesn't return NULL, it returns error pointers. Update the checking to match. Fixes: 8737ec830ee3 ("clk: qcom: common: Add interconnect clocks support") Signed-off-by: Dan Carpenter Reviewed-by: Imran Shaik Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/aLaPwL2gFS85WsfD@stanley.mountain Signed-off-by: Bjorn Andersson commit 0e56e3369b60506ac030546c8a63a1aef153d486 Author: Brian Masney Date: Thu Aug 28 20:38:21 2025 -0400 clk: qcom: alpha-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Note that prior to running the Coccinelle, clk_alpha_pll_postdiv_round_ro_rate() was renamed to clk_alpha_pll_postdiv_ro_round_rate(). Reviewed-by: Konrad Dybcio Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250828-clk-round-rate-v2-v1-2-b97ec8ba6cc4@redhat.com Signed-off-by: Bjorn Andersson commit d923b9682e12bb63b8a1353110e67869a9bd0ba8 Author: Krzysztof Kozlowski Date: Wed Aug 20 14:48:22 2025 +0200 clk: qcom: milos: Constify 'struct qcom_cc_desc' 'struct qcom_cc_desc' is passed to qcom_cc_map() and qcom_cc_really_probe() only as pointer to const, so make the memory const for safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250820124821.149141-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit c8d4fbc7d2bf4e7c19c99edc0671f86edfff59c7 Author: Robert Marko Date: Wed Aug 13 19:44:39 2025 +0200 arm64: lan969x: Add support for Microchip LAN969x SoC This adds support for the Microchip LAN969x ARMv8-based SoC switch family. Signed-off-by: Robert Marko Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit 76334fe803d9807b9c457f1df55ca5815526b685 Author: Robert Marko Date: Wed Aug 13 19:44:37 2025 +0200 arm64: Add config for Microchip SoC platforms Currently, Microchip SparX-5 SoC is supported and it has its own symbol. However, this means that new Microchip platforms that share drivers need to constantly keep updating depends on various drivers. So, to try and reduce this lets add ARCH_MICROCHIP symbol that drivers could instead depend on. LAN969x is being worked on and it will be added under ARCH_MICROCHIP. Signed-off-by: Robert Marko Acked-by: Daniel Machon Signed-off-by: Nicolas Ferre commit 8ece3173f87df03935906d0c612c2aeda9db92ca Author: Johan Hovold Date: Fri Jul 25 09:40:19 2025 +0200 firmware: meson_sm: fix device leak at probe Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe). Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns. Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") Cc: stable@vger.kernel.org # 5.5 Cc: Carlo Caione Signed-off-by: Johan Hovold Acked-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org Signed-off-by: Neil Armstrong commit 916fa558cb27182933fdfe82d6d84b437e69349c Author: Christian Hewitt Date: Mon May 5 14:37:00 2025 +0000 arm64: dts: amlogic: sm1-bananapi: lower SD card speed for stability Users report being able to boot (u-boot) from SD card but kernel init then fails to mount partitions on the card containing boot media resulting in first-boot failure. System logs show only the probe of the mmc devices: the SD card is seen, but no partitions are found so init fails to mount them and boot stalls. Reducing the speed of the SD card from 50MHz to 35MHz results in complete probing of the card and successful boot. Signed-off-by: Christian Hewitt Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250505143700.4029484-1-christianshewitt@gmail.com Signed-off-by: Neil Armstrong commit e97fdb9b8a0f8bd349de48815694f8a7200e3d62 Author: Anand Moon Date: Mon Aug 25 12:21:51 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic T7 SoC As per T7 datasheet add missing cache information to the Amlogic T7 SoC. - Each Cortex-A53 core has 32 KB of instruction cache and 32 KB of L1 data cache available. - Each Cortex-A73 core has 64 KB of L1 instruction cache and 64 KB of L1 data cache available. - The little (A53) cluster has 256 KB of unified L2 cache available. - The big (A73) cluster has 1 MB of unified L2 cache available. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-12-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit e7f85e6c155aed3e10e698dd05bd04b2d52edb59 Author: Anand Moon Date: Mon Aug 25 12:21:50 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic S922X SoC As per S922X datasheet add missing cache information to the Amlogic S922X SoC. - Each Cortex-A53 core has 32 KB of instruction cache and 32 KB of L1 data cache available. - Each Cortex-A73 core has 64 KB of L1 instruction cache and 64 KB of L1 data cache available. - The little (A53) cluster has 256 KB of unified L2 cache available. - The big (A73) cluster has 1 MB of unified L2 cache available. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-11-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 494c362fa1633bba127045ace8f0eea0b277af28 Author: Anand Moon Date: Mon Aug 25 12:21:49 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic S7 SoC As per S7 datasheet add missing cache information to the Amlogic S7 SoC. ARM Cortex-A55 CPU uses unified L2 cache. - Each Cortex-A55 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 256KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-10-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 6d4ab38a0a21c82076105e4cc37087ef92253c7b Author: Anand Moon Date: Mon Aug 25 12:21:48 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic C3 SoC As per C3 datasheet add missing cache information to the Amlogic C3 SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-9-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 57273dc063d5a80e8cebc20878369099992be01a Author: Anand Moon Date: Mon Aug 25 12:21:47 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic A4 SoC As per A4 datasheet add missing cache information to the Amlogic A4 SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-8-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 2d97773212f8516b2fe3177077b1ecf7b67a4e09 Author: Anand Moon Date: Mon Aug 25 12:21:46 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic A1 SoC As per the A1 datasheet add missing cache information to the Amlogic A1 SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-7-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit fe2c12bc0a8f9e5db87bfbf231658eadef4cdd47 Author: Anand Moon Date: Mon Aug 25 12:21:45 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic GXM SoCS As per the GXM datasheet add missing cache information to the Amlogic GXM SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-6-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 3b6ad2a433672f4ed9e1c90e4ae6b94683d1f1a2 Author: Anand Moon Date: Mon Aug 25 12:21:44 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic AXG SoCS As per the AXG datasheet add missing cache information to the Amlogic AXG SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-5-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit a4428e52babdb682f47f99b0b816e227e51a3835 Author: Anand Moon Date: Mon Aug 25 12:21:43 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic G12A SoCS As per the S905X2 datasheet add missing cache information to the Amlogic G12A SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-4-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit fd7b48b1f91e1830e22e73744e7525af24d8ae25 Author: Anand Moon Date: Mon Aug 25 12:21:42 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic SM1 SoC As per S905X3 datasheet add missing cache information to the Amlogic SM1 SoC. ARM Cortex-A55 CPU uses unified L3 cache instead of L2 cache. - Each Cortex-A55 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 256KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-3-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit d7fc05da8ba28d22fb9bd79d9308f928fcb81c19 Author: Anand Moon Date: Mon Aug 25 12:21:41 2025 +0530 arm64: dts: amlogic: Add cache information to the Amlogic GXBB and GXL SoC As per S905 and S905X datasheet add missing cache information to the Amlogic GXBB and GXL SoC. - Each Cortex-A53 core has 32KB of L1 instruction cache available and 32KB of L1 data cache available. - Along with 512KB Unified L2 cache. Cache memory significantly reduces the time it takes for the CPU to access data and instructions, leading to faster program execution and overall system responsiveness. Signed-off-by: Anand Moon Link: https://lore.kernel.org/r/20250825065240.22577-2-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 79d15f23f232f90bfd8823239fd57b964d053548 Author: Bartosz Golaszewski Date: Wed Sep 3 15:19:03 2025 +0200 gpio: nomadik: wrap a local variable in a necessary ifdef The 'desc' local variable in nmk_gpio_dbg_show_one() is now only used with CONFIG_PINCTRL_NOMADIK enabled so wrap its declaration with an appropriate ifdef. Fixes: ddeb66d2cb10 ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509032125.nXBcPuaf-lkp@intel.com/ Link: https://lore.kernel.org/r/20250903131903.95100-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 59b4c260582a74e641c973d016725e5dca32f300 Author: Xianwei Zhao Date: Thu Jul 17 17:38:38 2025 +0800 arm64: dts: amlogic: C3: Add RTC controller node Add the RTC controller node for C3 SoC family. Signed-off-by: Xianwei Zhao Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250717-rtc-c3-node-v1-2-4f9ae059b8e6@amlogic.com Signed-off-by: Neil Armstrong commit da33df43e5cd49ba8e687fdc78f5d06b5636440b Merge: d3441febbba8b2 df6a44003953fb Author: Bartosz Golaszewski Date: Thu Sep 4 15:05:47 2025 +0200 Merge tag 'gpio/mfd-stmpe-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into gpio/for-next Immutable branch between the MFD and GPIO trees for v6.18-rc1 Allow building the MFD STMPE driver as module. commit df6a44003953fb23ad67f82d299e439e7ff7150a Author: Alexander Stein Date: Tue Aug 19 09:04:57 2025 +0200 mfd: stmpe: Allow building as module Export the core probe and remove function to be used by i2c and spi drivers. Also add necessary module information so the drivers can be built as modules. This reduces footprint of the driver is enabled but unused. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250819070458.1027883-1-alexander.stein@ew.tq-group.com Signed-off-by: Bartosz Golaszewski commit f490253809c8dab4af62e787f5a3ac3d22aa869c Author: Liao Yuanhong Date: Thu Aug 28 20:26:48 2025 +0800 platform/x86/amd/pmf: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250828122649.39574-1-liaoyuanhong@vivo.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c2616c5696e85efb2679499d7260f7766b93cff6 Author: Chen Wang Date: Thu Sep 4 11:01:19 2025 +0800 irqchip/sg2042-msi: Set irq type according to DT configuration Read the device tree configuration and use it to set the interrupt type. Signed-off-by: Chen Wang Signed-off-by: Thomas Gleixner Tested-by: Inochi Amaoto # Sophgo SRD3-10 Link: https://lore.kernel.org/all/b22d2b0a00a96161253435d17b3c66538f3ba1c2.1756953919.git.unicorn_wang@outlook.com commit 8aefd2724451dedea1368d3915ab2dd5ecebc3cb Author: Chen Wang Date: Thu Sep 4 11:00:59 2025 +0800 riscv: sophgo: dts: sg2044: Change msi irq type to IRQ_TYPE_EDGE_RISING Fix msi irq type to be the correct type, although this field is not used yet. Signed-off-by: Chen Wang Signed-off-by: Thomas Gleixner Tested-by: Inochi Amaoto # Sophgo SRD3-10 Link: https://lore.kernel.org/all/c38b9b1682af978473705b7e70b6faaa36fe5024.1756953919.git.unicorn_wang@outlook.com commit a4bd4c330d5deaaa54db3a2ca4d2dd402d3a7248 Author: Chen Wang Date: Thu Sep 4 11:00:37 2025 +0800 riscv: sophgo: dts: sg2042: Change msi irq type to IRQ_TYPE_EDGE_RISING Fix msi irq type to be the correct type, although this field is not used yet. Signed-off-by: Chen Wang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/831c1b650c575380d56ef3e2faed9bee278c9006.1756953919.git.unicorn_wang@outlook.com commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 Author: Christian Bruel Date: Tue Sep 2 11:10:45 2025 +0200 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain. The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified. To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs. Signed-off-by: Christian Bruel Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com commit a191224186ec16a4cb1775b2a647ea91f5c139e1 Author: Srinivas Pandruvada Date: Wed Sep 3 12:11:54 2025 -0700 platform/x86/intel-uncore-freq: Present unique domain ID per package In partitioned systems, the domain ID is unique in the partition and a package can have multiple partitions. Some user-space tools, such as turbostat, assume the domain ID is unique per package. These tools map CPU power domains, which are unique to a package. However, this approach does not work in partitioned systems. There is no architectural definition of "partition" to present to user space. To support these tools, set the domain_id to be unique per package. For compute die IDs, uniqueness can be achieved using the platform info cdie_mask, mirroring the behavior observed in non-partitioned systems. For IO dies, which lack a direct CPU relationship, any unique logical ID can be assigned. Here domain IDs for IO dies are configured after all compute domain IDs. During the probe, keep the index of the next IO domain ID after the last IO domain ID of the current partition. Since CPU packages are symmetric, partition information is same for all packages. The Intel Speed Select driver has already implemented a similar change to make the domain ID unique, with compute dies listed first, followed by I/O dies. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20250903191154.1081159-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a0d6959c345d89d811288a718e3f6b145dcadc8c Author: Mark Pearson Date: Wed Sep 3 13:38:14 2025 -0400 platform/x86: think-lmi: Add extra TC BIOS error messages Add extra error messages that are used by ThinkCenter platforms. Signed-off-by: Kean Ren Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20250903173824.1472244-4-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 07b93b747cb713478991388b3d55c3ce9267e037 Author: Mark Pearson Date: Wed Sep 3 13:38:13 2025 -0400 platform/x86: think-lmi: Certificate support for ThinkCenter ThinkCenter platforms use a different set of GUIDs along with some differences in implementation details for their support of certificate based authentication. Update the think-lmi driver to work correctly on these platforms. Tested on M75q Gen 5. Signed-off-by: Kean Ren Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20250903173824.1472244-3-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c778f7ac13d5e94db821cf8e1078aa318cc15460 Author: Mark Pearson Date: Wed Sep 3 13:38:12 2025 -0400 platform/x86: think-lmi: Add certificate GUID structure Add a certificate GUID structure to make it easier to add different options for other platforms that need different GUIDs. Suggested-by: Ilpo Järvinen Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20250903173824.1472244-2-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7748328c2fd82efed24257b2bfd796eb1fa1d09b Author: Mohammad Rafi Shaik Date: Wed Sep 3 20:43:30 2025 +0530 ASoC: dt-bindings: qcom,lpass-va-macro: Update bindings for clocks to support ADSP Manage clock settings for ADSP solution. On Existing ADSP bypass solutions, the macro and dcodec GDSCs are enabled using power domains in lpass-va-macro which is not applicable for ADSP based platform. Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Krzysztof Kozlowski Message-ID: <20250903151337.1037246-2-mohammad.rafi.shaik@oss.qualcomm.com> Signed-off-by: Mark Brown commit dd7ae5b8b3c291c0206f127a564ae1e316705ca0 Author: Charles Keepax Date: Wed Sep 3 10:45:47 2025 +0100 ASoC: cs42l43: Shutdown jack detection on suspend Fully power down the jack detection on system suspend since the device will not be powered up during. Signed-off-by: Charles Keepax Message-ID: <20250903094549.271068-5-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit a69b4ba19a07896e7e4246446bad002f5fc0dae1 Author: Charles Keepax Date: Wed Sep 3 10:45:46 2025 +0100 ASoC: cs42l43: Disable IRQs in system suspend Currently the MFD driver disables all the IRQs upon entering system suspend, however there are some issues with this approach. As this device uses runtime force suspend. The regmap IRQ handler can run, claim a PM runtime reference and get scheduled, the MFD can then force suspend. When the IRQ thread gets rescheduled it will try to access volatile registers on the suspended device. Furthermore, this race also applies to work queue items scheduled by the IRQ handlers. As the MFD code doesn't know about the individual work queue items, the end drivers must mask their own IRQs and sync in any work queues as part of entering system suspend. Update the code here to do so. Signed-off-by: Charles Keepax Message-ID: <20250903094549.271068-4-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit 149dda5f42a8fa6dacf2cff1d16952de28622d30 Author: Charles Keepax Date: Wed Sep 3 10:45:45 2025 +0100 ASoC: cs42l43: Store IRQ domain in codec private data To support future refactoring store a pointer to the IRQ domain in the codec private data allowing easier access to it outside of probe. Signed-off-by: Charles Keepax Message-ID: <20250903094549.271068-3-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit 638ca7601f41a3f8368811f3185b06e2547b7a0f Author: Charles Keepax Date: Wed Sep 3 10:45:44 2025 +0100 ASoC: cs42l43: Rename system suspend callback and fix debug print There is some confusion around cs42l43_codec_runtime_force_suspend(). This function is the system suspend callback, however the name and the debug print both use the words runtime. Rename the function to the simpler cs42l43_codec_suspend() and correct the debug print. Signed-off-by: Charles Keepax Message-ID: <20250903094549.271068-2-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit 0ccc1eeda155c947d88ef053e0b54e434e218ee2 Author: Jihed Chaibi Date: Wed Sep 3 18:01:19 2025 +0200 ASoC: dt-bindings: wlf,wm8960: Document routing strings (pin names) Add a list of the wm8960 pin names to the binding's description to make it self-contained and improve the user experience for board developers. Signed-off-by: Jihed Chaibi Reviewed-by: Charles Keepax Acked-by: Rob Herring (Arm) Message-ID: <20250903160119.83625-4-jihed.chaibi.dev@gmail.com> Signed-off-by: Mark Brown commit 118ddab8bb4a06fd5e13446d11d69e301044087d Author: Jihed Chaibi Date: Wed Sep 3 18:01:18 2025 +0200 ASoC: dt-bindings: nuvoton,nau8825: Document routing strings Add a list of the nau8825 pin names to the binding's description to make it self-contained and improve the user experience for board developers. Signed-off-by: Jihed Chaibi Acked-by: Rob Herring (Arm) Message-ID: <20250903160119.83625-3-jihed.chaibi.dev@gmail.com> Signed-off-by: Mark Brown commit acd2fa47aac568052bd8321586be64958e3e93b2 Author: Jihed Chaibi Date: Wed Sep 3 18:01:17 2025 +0200 ASoC: dt-bindings: everest,es8316: Document routing strings Add a list of the es8316 pin names to the binding's description to make it self-contained and improve the user experience for board developers. Signed-off-by: Jihed Chaibi Acked-by: Rob Herring (Arm) Message-ID: <20250903160119.83625-2-jihed.chaibi.dev@gmail.com> Signed-off-by: Mark Brown commit 9f8d92a1fbb5a08e17f9d405a1ab27be64096d8c Author: Borislav Petkov (AMD) Date: Wed Sep 3 18:14:54 2025 +0200 x86/sev: Zap snp_abort() It is a silly oneliner anyway. Replace it with its equivalent. No functional changes. Signed-off-by: Borislav Petkov (AMD) commit d4bc3b11c12b41fdb5650f5ad797de97f8dce869 Author: Borislav Petkov (AMD) Date: Wed Sep 3 17:42:05 2025 +0200 x86/apic/savic: Do not use snp_abort() This function is going away so replace the callsites with the equivalent functionality. Add a new SAVIC-specific termination reason. If more granularity is needed there, it will be revisited in the future. Signed-off-by: Borislav Petkov (AMD) commit f7e60f1570b4de044055e4269c30be826ef16a9b Author: Jani Nikula Date: Thu Aug 28 15:21:02 2025 +0300 drm/i915/pps: prefer poll_timeout_us() over read_poll_timeout() Unify on using poll_timeout_us() throughout instead of mixing with readx_poll_timeout(). Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/260fd455df743453f123d96fc01e7ca96a36f0fa.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 54846c2ea78e8a1ce61d2ef604f56f25783d855d Author: Jani Nikula Date: Thu Aug 28 15:21:01 2025 +0300 drm/i915/ddi: prefer poll_timeout_us() over readx_poll_timeout() Unify on using poll_timeout_us() throughout instead of mixing with readx_poll_timeout(). While the latter can be ever so slightly simpler, they are both complicated enough that it's better to unify on one approach only. While at it, better separate the handling of error returns from drm_dp_dpcd_readb() and the actual status byte. This is best achieved by inlining the read_fec_detected_status() function, and switching to drm_dp_dpcd_read_byte(). v2: Use drm_dp_dpcd_read_byte() (Imre) Cc: Imre Deak Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/63b10a36c7ab545c640b24bc8fc007ce2ea74623.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f1415900089f4cfbaa8eb992fb9186e5840f8c34 Author: Jani Nikula Date: Thu Aug 28 15:21:00 2025 +0300 drm/i915/opregion: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 1 ms sleep instead. The timeout remains, being opregion defined, 50 ms by default, and 1500 ms at most. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/63db3a1e1db9e55a18ed322c55f2dffe511a10bb.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 19b31edb0a8da0d0e9406a7ced6bda3b68577d9e Author: Jani Nikula Date: Thu Aug 28 15:20:59 2025 +0300 drm/i915/lspcon: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 5 ms sleep instead. The timeouts remain, being 400 ms or 800 ms, depending on the case. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/4065fa96c0ef6afd51a384f365761d2ca802256b.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit bcd23d8ee01c2abcea782aaf40c74d54a3fdab82 Author: Jani Nikula Date: Thu Aug 28 15:20:58 2025 +0300 drm/i915/dsb: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 100 us sleep instead. The timeout remains at 1 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/979eae02af1184b3756746ace61379dd1947a79b.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7987b7643312f1b63f70da433b23b32e2a85160c Author: Jani Nikula Date: Thu Aug 28 15:20:57 2025 +0300 drm/i915/tc: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 200 us sleep for the 5 ms timeout, and 1000 us sleep for the 500 ms timeout. The timeouts remain the same. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/50cd06b61210f541d5bb52a36af2d8bf059dd3a1.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 46013820f40220ca4ddcf4892401affe41d69747 Author: Jani Nikula Date: Thu Aug 28 15:20:56 2025 +0300 drm/i915/vblank: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 100 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/162dff5862d3213304491a6d2eb31a57346b523e.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 476721f28ee8f97abc89103c89279766167ef95a Author: Jani Nikula Date: Thu Aug 28 15:20:55 2025 +0300 drm/i915/dp: use generic poll_timeout_us() instead of wait_for() in link training Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 500 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/29ab4738758fe844dc1323c4a59d5d6bdcf87308.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 39b555b3eab503a47396d5ef1dcc7e22de2c2e94 Author: Jani Nikula Date: Thu Aug 28 15:20:54 2025 +0300 drm/i915/dp: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 1 ms sleep instead. The timeouts remain, being 500 ms or 1000 ms depending on the case. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/83d3417d4e5af1db13eb4c6eaa48b5f9c12caeb4.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e38e3c50a14c76bf130a688bffd130797b09dfe6 Author: Jani Nikula Date: Thu Aug 28 15:20:53 2025 +0300 drm/i915/power-well: use generic poll_timeout_us() instead of wait_for() for VLV/CHV Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 100 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/c644b7b5611a3c047ea5d3d52acd91830b2fa6b4.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a8eb4cdcedd836b22459b9f6e68b60001bd04bac Author: Jani Nikula Date: Thu Aug 28 15:20:52 2025 +0300 drm/i915/power-well: use generic poll_timeout_us() instead of wait_for() for DKL PHY Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 100 us sleep instead. The timeout remains at 1 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/663c9edf4a98b09121d7200f8d734ebc829da85b.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c698a48e9f8019c01eab83a962289ad4e81db938 Author: Jani Nikula Date: Thu Aug 28 15:20:51 2025 +0300 drm/i915/power: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 100 us sleep instead. The timeout remains at 1 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/900680516b047ae32e3298b5cdbcede0393e0466.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 032a3bd4d673a3efb2575914bd96ea60c9124993 Author: Jani Nikula Date: Thu Aug 28 15:20:50 2025 +0300 drm/i915/cdclk: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 50 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/6d50031411d5517508867d4b595ce90a2b44073b.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7f38db435cf703cc432810362d84ed8be59202ea Author: Jani Nikula Date: Thu Aug 28 15:20:49 2025 +0300 drm/i915/wm: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 3 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/52c80860ea7b98e84f2386ed6cdd761f03190b1e.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 11080a5ea877d7da163a93975559b9607f629d49 Author: Jani Nikula Date: Thu Aug 28 15:20:48 2025 +0300 drm/i915/gmbus: use generic poll_timeout*() instead of wait_for*() Prefer generic poll helpers over i915 custom helpers. The "two tier" wait_for_us() + wait_for() combination appeared without much explanation in commit 4e6c2d58ba86 ("drm/i915: Take forcewake once for the entire GMBUS transaction"). Try to mimic roughly the same with the generic helpers. wait_for_us() with 10 us or shorter timeouts ends up in _wait_for_atomic(). Thus use poll_timeout_us_atomic() for the first try, with the same 2 us timeout and no sleep. For the fallback, the functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 50 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/564b397352c53a1116519fb2d53050c0426bc0dc.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 0399a3368503c75043afbb680071dabc723aa9d7 Author: Jani Nikula Date: Thu Aug 28 15:20:47 2025 +0300 drm/i915/dsi-pll: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 500 us sleep instead. The timeout remains at 20 ms. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/476fcc5aad9e2ddbf6d8c14bd5ff5cbf071c5dca.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 17d56494c1b8f3e61e4ee9a8aedf1e3733a83eaa Author: Jani Nikula Date: Thu Aug 28 15:20:46 2025 +0300 drm/i915/dsi: use generic poll_timeout_us() instead of wait_for_us() Prefer generic poll helpers over i915 custom helpers. The sleep and timeout remain the same as for wait_for_us(). Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/02ebcd2864819b7eaf9cf455aa2b968980a2f671.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e54d34e4b309787fc0d4202a638143490c2fe319 Author: Jani Nikula Date: Thu Aug 28 15:20:45 2025 +0300 drm/i915/hdcp: use generic poll_timeout_us() instead of wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of wait_for(), which used to be 10, 20, 40, ..., 640, and 1280 us. Use an arbitrary constant 100 us sleep instead. The timeout remains at 1 ms. While at it, use the last failing value for debug logging instead of reading it again. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/2871a07337401c25ef3df44073c5e78fedc45e8e.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6f1759df0f83e376b0b40017fa06f081963f5704 Author: Jani Nikula Date: Thu Aug 28 15:20:44 2025 +0300 drm/i915/hdcp: use generic poll_timeout_us() instead of __wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of __wait_for(), which used to be 1, 2, 4, ... 64, and 128 ms in this particular case. Use an arbitrary 100 ms sleep instead. The timeout remains at 5000 ms. Cc: Suraj Kandpal Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/bfc9f941ec1628830644f1419d606e3d085aaba0.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 00cbd55557a98d2ed111967dc5a8e5e8ac5c8dc0 Author: Jani Nikula Date: Thu Aug 28 15:20:43 2025 +0300 drm/i915/hdmi: use generic poll_timeout_us() instead of __wait_for() Prefer generic poll helpers over i915 custom helpers. The functional change is losing the exponentially growing sleep of __wait_for(), which used to be 1, 2, 4, and 8 ms in this particular case. Use an arbitrary constant 4 ms sleep instead. The timeout remains, varying between 20 ms and 3000 ms. Cc: Suraj Kandpal Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/fc3a67f9de0049f415a276bba1c11a4df97e01d6.1756383233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a85ead6d7f74438bc779927fe7b78b0c86addb6b Author: Michal Wajdeczko Date: Fri Aug 29 22:11:03 2025 +0200 drm/xe/debugfs: Move sa_info from gt to tile directory Our drm-based suballocator is implemented per-tile so it is better to show its debug information also per-tile debugfs directory, not under per-gt directory as it is done today. To allow adding more per-tile attributes, prepare necessary helper functions, like we already did for per-gt or per-uc attributes. Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Cc: Lucas De Marchi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250829201106.1263-1-michal.wajdeczko@intel.com commit a304609be24ec94ddb9b18a5cf6357e58466ac5e Author: Luca Coelho Date: Wed Aug 27 13:12:06 2025 +0300 drm/i915: use REG_BIT on FW_BLC_SELF_* macros Use REG_BIT() instead of open coding the shift in the FW_BLC_SELF_* macro definitions to avoid potentially typing them as 'int'. For example, this happens when we pass them to _MASKED_BIT_ENABLE(), because of the typeof() construct there. When we pass 1 << 15 (the FW_BLC_SELF_EN macro), we get typeof(1 << 15), which is 'int'. Then the value becomes negative (-2147450880) and we try to assign it to a 'u32'. In practice this is not a problem though, because when we try to assign -2147450880 to the u32, that becomes 0x80008000, which was the intended result. Link: https://lore.kernel.org/intel-gfx/20250827111109.401604-1-luciano.coelho@intel.com/ Reviewed-by: Jani Nikula Reviewed-by: Andi Shyti Signed-off-by: Luca Coelho commit 03e7ae93c6e32206797c13118659a966ae84a3bb Author: Thomas Zimmermann Date: Tue Aug 26 08:49:25 2025 +0200 drm/ast: Put AST_DRAM_ constants into enum ast_dram_layout The AST_DRAM_ constants belong together, so put them in an enum type. Rename type and variables to 'drm_layout', as there's already another DRAM type in the ast driver (AST_DDR2, AST_DDR3). v2: - avoid compiler warning with switch default (Dan) Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-7-tzimmermann@suse.de commit 6d580cf8093fc640e6e4cef3932ef176f1ea1c87 Author: Thomas Zimmermann Date: Tue Aug 26 08:49:24 2025 +0200 drm/ast: Move DRAM info next to its only user The only place in the ast driver that uses the DRAM type is the P2A DRAM initialization for Gen2 and Gen3 of the chip. Condense the code in ast_get_dram_info() to exactly this use case and move it into the Gen's custom source file. Remove the field dram_type from struct ast_device. The AST_DRAM_ constants are also used in Gen4 POST helpers, but independently from the dram_type field. No changes there. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-6-tzimmermann@suse.de commit db216056a63b9ca415b72963605defad8107d6fc Author: Thomas Zimmermann Date: Tue Aug 26 08:49:23 2025 +0200 drm/ast: Remove unused SCU-MPLL and SCU-STRAP values The ast driver used SCU-MPLL and SCU-STRAP to compute the memory clock. Remove the now unused values. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-5-tzimmermann@suse.de commit e91153028ddba13ec545afcf9b6b350191ee4bf7 Author: Thomas Zimmermann Date: Tue Aug 26 08:49:22 2025 +0200 drm/ast: Remove unused mclk field The memory clock is not necessary for the driver. In default for AST2600 is event incorrect; should be 800 MHz. Remove it. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-4-tzimmermann@suse.de commit dc2a40f44e5fb815c3b4506debfe73ada4ea1640 Author: Thomas Zimmermann Date: Tue Aug 26 08:49:21 2025 +0200 drm/ast: Remove unused dram_bus_width field The DRAM bus width is not necessary for the driver. Remove it. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-3-tzimmermann@suse.de commit a5db45bfe9469e85e416035367ead7e0b94c642c Author: Thomas Zimmermann Date: Tue Aug 26 08:49:20 2025 +0200 drm/ast: Do not print DRAM info Most of the information in the DRAM status output is irrelevant; some is even wrong. Only the DRAM type is used on some older models. Drop the output entirely. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250826065032.344412-2-tzimmermann@suse.de commit b283b70967c0553b66e924f40e1c35b68fa8a1f7 Author: hongyu.chen1 Date: Fri Aug 22 13:39:56 2025 +0800 pmdomain: amlogic: Add support for S6 S7 S7D power domains controller Add support for the S6 S7 S7D power controller, whose registers are in the secure domain and should be accessed via SMC. Signed-off-by: hongyu.chen1 Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250822-pm-s6-s7-s7d-v1-2-82e3f3aff327@amlogic.com Signed-off-by: Ulf Hansson commit 28a88b557ab59e4a492ea5ca1383196d36bf11f8 Merge: ffeebf7587f518 9428fff44f0c58 Author: Ulf Hansson Date: Thu Sep 4 12:24:35 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 9428fff44f0c5823fde733b64a344d7a6eda3873 Author: hongyu.chen1 Date: Fri Aug 22 13:39:55 2025 +0800 dt-bindings: power: add Amlogic S6 S7 S7D power domains Add devicetree binding document and related header file for Amlogic S6 S7 S7D secure power domains. Signed-off-by: hongyu.chen1 Signed-off-by: Xianwei Zhao Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250822-pm-s6-s7-s7d-v1-1-82e3f3aff327@amlogic.com Signed-off-by: Ulf Hansson commit e53f8b12a21c2974b66fa8c706090182da06fff3 Author: Ramya Gnanasekar Date: Fri Jun 6 16:14:36 2025 +0530 wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands Currently, when adding the 6 GHz Band Capabilities element, the channel list of the wiphy is checked to determine if 6 GHz is supported for a given virtual interface. However, in a multi-radio wiphy (e.g., one that has both lower bands and 6 GHz combined), the wiphy advertises support for all bands. As a result, the 6 GHz Band Capabilities element is incorrectly included in mesh beacon and station's association request frames of interfaces operating in lower bands, without verifying whether the interface is actually operating in a 6 GHz channel. Fix this by verifying if the interface operates on 6 GHz channel before adding the element. Note that this check cannot be placed directly in ieee80211_put_he_6ghz_cap() as the same function is used to add probe request elements while initiating scan in which case the interface may not be operating in any band's channel. Signed-off-by: Ramya Gnanasekar Signed-off-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20250606104436.326654-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Johannes Berg commit 0176c9e82e1080952828b3badcdccf51206a8189 Author: Lad Prabhakar Date: Wed Aug 20 21:06:56 2025 +0100 arm64: dts: renesas: rzt2h-n2h-evk-common: Enable EEPROM on I2C0 Enable support for the R1EX24016 EEPROM connected to I2C0 on the Renesas RZ/T2H and RZ/N2H Evaluation Kits. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit fc14be9667ee06301c3fff578357c8d78749bb13 Author: Lad Prabhakar Date: Wed Aug 20 21:06:55 2025 +0100 arm64: dts: renesas: r9a09g087m44-rzt2h-evk: Enable I2C0 and I2C1 support Enable I2C0 and I2C1 on the RZ/N2H evaluation board. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1366c160df036d5596240ea4b36b88afe2cd0d2a Author: Lad Prabhakar Date: Wed Aug 20 21:06:54 2025 +0100 arm64: dts: renesas: rzt2h-n2h-evk-common: Add pinctrl for SCI0 node Add pinctrl for SCI0 node. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 23cb8eb3286d7f2df646eaf7cbcb63b0f1f2ee45 Author: Lad Prabhakar Date: Wed Aug 20 21:06:53 2025 +0100 arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Add user LEDs Add USER LED3-LED11, which are available on RZ/N2H EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 77aae5255c6d2ef4981f7fcedf35333466abcb06 Author: Lad Prabhakar Date: Wed Aug 20 21:06:52 2025 +0100 arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Add user LEDs Add USER LED0-LED8, which are available on RZ/T2H EVK. In addition, move the header file inclusion into the common rzt2h-n2h-evk-common.dtsi, so that both RZ/T2H and RZ/N2H EVK DTS/I files share the same set of bindings. This avoids duplication and keeps the board files consistent. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 965e37ec0f8d4926809526e5ee0916774376f007 Author: Lad Prabhakar Date: Wed Aug 20 21:06:51 2025 +0100 arm64: dts: renesas: r9a09g087: Add pinctrl node Add pinctrl node to RZ/N2H ("R9A09G087") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820200659.2048755-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 09e3a0467375fe7bb19c66eaf5ad3edfd90ea16c Author: Lad Prabhakar Date: Thu Sep 4 08:19:54 2025 +0100 clk: renesas: r9a09g077: Add Ethernet Subsystem core and module clocks Add module and core clocks used by Ethernet Subsystem (Ethernet_SS), Ethernet MAC (GMAC), Ethernet Switch (ETHSW). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250904071954.3176806-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a47f311d6f8265d2340110bd5fe4a1dc41f95e9c Merge: 08eea73dcf608a 0dcfb6fcdd085b Author: Geert Uytterhoeven Date: Thu Sep 4 11:32:33 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag4' into renesas-clk-for-v6.18 Renesas RZ/T2H and RZ/N2H Ethernet Clock DT Binding Definitions Ethernet Clock DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files. commit 08eea73dcf608ac7c794550a0ac7303c1ef1f68a Author: Tommaso Merciai Date: Wed Sep 3 10:27:53 2025 +0200 clk: renesas: rzv2h: Simplify polling condition in __rzv2h_cpg_assert() Replace the ternary operator with a direct boolean comparison to improve code readability and maintainability. The logic remains unchanged. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250903082757.115778-5-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f8c002165ca27d95d3d15e865dd0a47c0a1b14dd Author: Tommaso Merciai Date: Wed Sep 3 10:27:52 2025 +0200 clk: renesas: rzv2h: Re-assert reset on deassert timeout Prevent issues during reset deassertion by re-asserting the reset if a timeout occurs when trying to deassert. This ensures the reset line is in a known state and improves reliability for hardware that may not immediately clear the reset monitor bit. Reviewed-by: Geert Uytterhoeven Signed-off-by: Tommaso Merciai Link: https://lore.kernel.org/20250903082757.115778-4-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f8c5f0dc77d86da36bcbf0684c6747a2937cc3cd Author: Tommaso Merciai Date: Wed Sep 3 10:27:51 2025 +0200 clk: renesas: rzg2l: Re-assert reset on deassert timeout Prevent issues during reset deassertion by re-asserting the reset if a timeout occurs when trying to deassert. This ensures the reset line is in a known state and improves reliability for hardware that may not immediately clear the reset monitor bit. Reviewed-by: Geert Uytterhoeven Signed-off-by: Tommaso Merciai Link: https://lore.kernel.org/20250903082757.115778-3-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 341b0f1b6cba5f4f317f4bb51efa8e9f566ac8e3 Author: Tommaso Merciai Date: Wed Sep 3 10:27:50 2025 +0200 clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert() Combine common code from rzg2l_cpg_assert() and rzg2l_cpg_deassert() into a new __rzg2l_cpg_assert() helper to avoid code duplication. This reduces maintenance effort and improves code clarity. Reviewed-by: Geert Uytterhoeven Signed-off-by: Tommaso Merciai Link: https://lore.kernel.org/20250903082757.115778-2-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0dcfb6fcdd085bbfcdfdcf64a7d4a75c63c108af Author: Lad Prabhakar Date: Thu Sep 4 08:19:53 2025 +0100 dt-bindings: clock: renesas,r9a09g077/87: Add Ethernet clock IDs Add clock definitions for Ethernet (ETCLK A-E) to both R9A09G077 and R9A09G087 SoCs. These definitions are required for describing Ethernet devices in DT. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250904071954.3176806-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 258b37c6e626625fe441e16ab90e6a542a66eaee Author: Thomas Weißschuh Date: Tue Aug 26 08:17:14 2025 +0200 vdso: Gate VDSO_GETRANDOM behind HAVE_GENERIC_VDSO All architectures which want to implement getrandom() in the vDSO need to use the generic vDSO library. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-11-d9b65750e49f@linutronix.de commit bad53ae2dc4296acb8cbcee385e0238cea484100 Author: Thomas Weißschuh Date: Tue Aug 26 08:17:13 2025 +0200 vdso: Drop Kconfig GENERIC_VDSO_TIME_NS All architectures implementing time-related functionality in the vDSO are using the generic vDSO library which handles time namespaces properly. Remove the now unnecessary Kconfig symbol. Enables the use of time namespaces on architectures, which use the generic vDSO but did not enable GENERIC_VDSO_TIME_NS, namely MIPS and arm. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Catalin Marinas Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-10-d9b65750e49f@linutronix.de commit 7b338f6d4e3d6baa057e3505592a86f6410d68ed Author: Thomas Weißschuh Date: Tue Aug 26 08:17:12 2025 +0200 vdso: Drop Kconfig GENERIC_VDSO_DATA_STORE All users of the generic vDSO library also use the generic vDSO datastore. Remove the now unnecessary Kconfig symbol. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Catalin Marinas Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-9-d9b65750e49f@linutronix.de commit bb5bc7bfab06b9a6a2ccecba6dc40783fe9b4231 Author: Thomas Weißschuh Date: Tue Aug 26 08:17:11 2025 +0200 vdso: Drop kconfig GENERIC_COMPAT_VDSO This configuration is never used. Remove it. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Catalin Marinas Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-8-d9b65750e49f@linutronix.de commit 278f1c933c3fab6f249b995a1a13608246b76181 Author: Thomas Weißschuh Date: Tue Aug 26 08:17:10 2025 +0200 vdso: Drop kconfig GENERIC_VDSO_32 This configuration is never used. Remove it. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-7-d9b65750e49f@linutronix.de commit eb3b66aab72c10632865afaf8e46f4667c21ef7d Author: Thomas Weißschuh Date: Tue Aug 26 08:17:09 2025 +0200 riscv: vdso: Untangle Kconfig logic On riscv32 the generic vDSO infrastructure is used but without its time-related functionality. The Kconfig logic to implement this treats HAVE_GENERIC_VDSO as a synonym for GENERIC_GETTIMEOFDAY. This works today due to some underlying issues in how the generic vDSO library works. Some future cleanups will break this logic. Restructure the Kconfig logic, so HAVE_GENERIC_VDSO refers to the generic library in general and GENERIC_GETTIMEOFDAY refers to its time-related functionality. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-6-d9b65750e49f@linutronix.de commit ea1a1fa919a5b4f39fa46073e7b3a19b12521f05 Author: Thomas Weißschuh Date: Tue Aug 26 08:17:08 2025 +0200 time: Build generic update_vsyscall() only with generic time vDSO The generic vDSO can be used without the time-related functionality. In that case the generic update_vsyscall() from kernel/time/vsyscall.c should not be built. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-5-d9b65750e49f@linutronix.de commit f145d6bf8d590954672a4d0581c92e1799e9c8da Author: Thomas Weißschuh Date: Tue Aug 26 08:17:07 2025 +0200 vdso/gettimeofday: Remove !CONFIG_TIME_NS stubs All calls of these functions are already gated behind CONFIG_TIME_NS. The compiler will already optimize them away if time namespaces are disabled. Drop the unnecessary stubs. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-4-d9b65750e49f@linutronix.de commit 7d298d25ce81251068bb4ea1d92813ec764a9fec Author: Thomas Weißschuh Date: Tue Aug 26 08:17:06 2025 +0200 vdso: Move ENABLE_COMPAT_VDSO from core to arm64 The ENABLE_COMAPT_VDSO symbol is only used by arm64 and only for the time-related functionality. There should be no new users, so it doesn't need to be in the generic vDSO code. Move the logic into arm64 architecture-specific code and replace the explicit define by the standard '#ifdef __aarch64__'. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Catalin Marinas Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-3-d9b65750e49f@linutronix.de commit 39f1ee1299c9bab9c87dc3087b9f82f346b8190b Author: Rasmus Villemoes Date: Tue Aug 26 08:17:05 2025 +0200 ARM: VDSO: Remove cntvct_ok global variable The cntvct_ok variable has not had any external user since commit c7a18100bdff ("lib/vdso: Avoid highres update if clocksource is not VDSO capable"). It also only has one user in vdso.c, once during init, so rather than having the caller of patch_vdso() initialize cntvct_ok, just call cntvct_functional() directly and avoid the global variable entirely. Signed-off-by: Rasmus Villemoes Signed-off-by: Thomas Gleixner Reviewed-by: Vincenzo Frascino Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-2-d9b65750e49f@linutronix.de commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed Author: Thomas Weißschuh Date: Tue Aug 26 08:17:04 2025 +0200 vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY When the generic vDSO does not provide time functions, as for example on riscv32, then the time data store is not necessary. Avoid allocating these time data pages when not used. Fixes: df7fcbefa710 ("vdso: Add generic time data storage") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de commit 7a7458ed0df90d4870f902fddc85b4a413ef7de4 Author: Miri Korenblit Date: Wed Sep 3 11:39:04 2025 +0300 wifi: mac80211: reduce the scope of rts_threshold This is only needed within the 'if' scope, not in the function scope. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250903083904.1972284-3-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 937d6aea5c6211fe2c8eb6f99b5baa6887a696c4 Author: Miri Korenblit Date: Wed Sep 3 11:39:03 2025 +0300 wifi: mac80211: reduce the scope of link_id Reduce the scope of the link_id variable in sta_set_sinfo to the 'if' scope. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250903083904.1972284-2-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit d358795df908bb58d95cc85c25ed0424932e393c Author: Wright Feng Date: Sun Aug 17 21:04:35 2025 +0200 wifi: brcmfmac: support AP isolation to restrict reachability between stations hostapd & wpa_supplicant userspace daemons exposes an AP mode specific config file parameter "ap_isolate" to the user, which is used to control low-level bridging of frames between the stations associated in the BSS. In driver, handle this user setting in the newly defined cfg80211_ops function brcmf_cfg80211_change_bss() by enabling "ap_isolate" IOVAR in the firmware. In AP mode, the "ap_isolate" value from the cfg80211 layer represents, 0 = allow low-level bridging of frames between associated stations 1 = restrict low-level bridging of frames to isolate associated stations -1 = do not change existing setting Signed-off-by: Wright Feng Signed-off-by: Chi-hsien Lin Signed-off-by: Gokul Sivakumar [arend: indicate ap_isolate support in struct wiphy::bss_param_support] Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20250817190435.1495094-5-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg commit 4f652a390db4246c5d3c51bf25d03ed0e4178fdc Author: Arend van Spriel Date: Sun Aug 17 21:04:34 2025 +0200 wifi: nl80211: strict checking attributes for NL80211_CMD_SET_BSS Assure user-space only modifies attributes for NL80211_CMD_SET_BSS that are supported by the driver. This stricter checking is only done when user-space commits to it by including NL80211_ATTR_BSS_PARAM. Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20250817190435.1495094-4-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg commit 18abf7a05f1e171a290d8abc3078189ca0fe2db0 Author: Arend van Spriel Date: Sun Aug 17 21:04:33 2025 +0200 wifi: drivers: indicate support for attributes in NL80211_CMD_SET_BSS The command NL80211_CMD_SET_BSS has a number of individual attributes and the driver can advertise which of those it will handle when it is changed by user-space. For drivers providing an empty .change_bss() the callback has been removed. Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20250817190435.1495094-3-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg commit 24185534915b5d926ded098336f47bdcca333aec Author: Arend van Spriel Date: Sun Aug 17 21:04:32 2025 +0200 wifi: nl80211: allow drivers to support subset of NL80211_CMD_SET_BSS The so-called fullmac devices rely on firmware functionality and/or API to change BSS parameters. Today there are limited drivers supporting the nl80211 primitive, but they only handle a subset of the bss parameters passed if any. The mac80211 driver does handle all parameters and stores their configured values. Some of the BSS parameters were already conditional by wiphy->features. For these the wiphy->bss_param_support and wiphy->features fields are silently aligned in wiphy_register(). Maybe better to issue a warning instead when they are misaligned. Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20250817190435.1495094-2-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg commit d0bf06158c39e7129524dd8b43b82aed84d68faa Author: Muna Sinada Date: Fri Aug 15 14:30:11 2025 -0700 wifi: nl80211: Add EHT fixed Tx rate support Add new attributes to support EHT MCS/NSS Tx rates and EHT GI/LTF. Parse EHT fixed MCS/NSS Tx rates and EHT GI/LTF values passed by the userspace, validate and add as part of cfg80211_bitrate_mask. MCS mask is constructed by new function, eht_build_mcs_mask(). Max NSS supported for MCS rates of 7, 9, 11 and 13 is utilized to set MCS bitmask for each NSS. MCS rates 14, and 15 if supported, are set only for NSS = 0. Co-developed-by: Aloka Dixit Signed-off-by: Aloka Dixit Signed-off-by: Muna Sinada Link: https://patch.msgid.link/20250815213011.2704803-1-muna.sinada@oss.qualcomm.com Signed-off-by: Johannes Berg commit 36b75dcb1e25739a3a0975699208c98f4b55d012 Author: Aditya Kumar Singh Date: Tue Aug 12 12:53:30 2025 +0530 wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan request during MLO Commit 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO") introduced a check that rejects scan requests if any link is already beaconing. This works fine when all links share the same radio, but breaks down in multi-radio setups. Consider a scenario where a 2.4 GHz link is beaconing and a scan is requested on a 5 GHz link, each backed by a different physical radio. The current logic still blocks the scan, even though it should be allowed. As a result, interface bring-up fails unnecessarily in valid configurations. Fix this by checking whether the scan is being requested on the same underlying radio as the beaconing link. Only reject the scan if it targets a link that is already beaconing and the NL80211_FEATURE_AP_SCAN is not set. This ensures correct behavior in multi-radio environments and avoids false rejections. Fixes: 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO") Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-3-383ffb6da213@oss.qualcomm.com Signed-off-by: Johannes Berg commit cfb58d5fc964e7e008d8d64c8fa8e9e28e501bc6 Author: Aditya Kumar Singh Date: Tue Aug 12 12:53:29 2025 +0530 wifi: mac80211: simplify return value handling of cfg80211_get_radio_idx_by_chan() In several instances where cfg80211_get_radio_idx_by_chan() is called, redundant checks are performed across function — such as verifying if wiphy->n_radio < 2 or if the returned index is negative. These checks are unnecessary, as the return value can be directly compared. Moreover, the function can be safely called even when radio-level properties are not explicitly advertised since in such case in each call it is going to get same error value. Therefore, simplify the usage of this function across all such cases by removing redundant conditions and relying on the return value directly. Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-2-383ffb6da213@oss.qualcomm.com Signed-off-by: Johannes Berg commit 5f9d5fd8e08968e66d0212f782fc24d76e52800f Author: Aditya Kumar Singh Date: Tue Aug 12 12:53:28 2025 +0530 wifi: cfg80211: fix return value in cfg80211_get_radio_idx_by_chan() If a valid radio index is not found, the function returns -ENOENT. If the channel argument itself is invalid, it returns -EINVAL. However, since the caller only checks for < 0, the distinction between these error codes is not utilized much. Also, handling these two distinct error codes throughout the codebase adds complexity, as both cases must be addressed separately. A subsequent change aims to simplify this by using a single error code for all invalid cases, making error handling more consistent and streamlined. To support this change, update the return value to -EINVAL when a valid radio index is not found. This is still appropriate because, even if the channel argument is structurally valid, the absence of a corresponding radio index implies that the argument is effectively invalid—otherwise, a valid index would have been found. Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-1-383ffb6da213@oss.qualcomm.com Signed-off-by: Johannes Berg commit 1860b1a8257c5d52fbed3093eb9a3e7476619403 Author: Lachlan Hodges Date: Fri Jul 25 23:22:21 2025 +1000 wifi: mac80211: kunit: add kunit tests for S1G PVB decoding Add support for testing the 6 examples mentioned in IEEE80211-2024 Annex L. These tests cover the 3 mandatory decoding modes being block bitmap, single AID and OLB alongside their equivalent inverses. Test output: 1..6 s1g_tim_block_test: Block 0 (ENC=BLOCK, blk_off=0, inverse=0) s1g_tim_block_test: octet 1 (ctrl) : 00000000 (0x00) s1g_tim_block_test: octet 2 (blk-map) : 00000101 (0x05) s1g_tim_block_test: octet 3 (SB 0) : 01000010 (0x42) s1g_tim_block_test: octet 4 (SB 2) : 10100000 (0xa0) ok 1 s1g_tim_block_test s1g_tim_single_test: Block 0 (ENC=SINGLE, blk_off=0, inverse=0) s1g_tim_single_test: octet 1 (ctrl) : 00000001 (0x01) s1g_tim_single_test: octet 2 (single) : 00011111 (0x1f) ok 2 s1g_tim_single_test s1g_tim_olb_test: Block 0 (ENC=OLB, blk_off=0, inverse=0) s1g_tim_olb_test: octet 1 (ctrl) : 00000010 (0x02) s1g_tim_olb_test: octet 2 (len= 9) : 00001001 (0x09) s1g_tim_olb_test: octet 3 (SB 0) : 01000010 (0x42) s1g_tim_olb_test: octet 4 (SB 1) : 10100000 (0xa0) s1g_tim_olb_test: octet 5 (SB 2) : 01000010 (0x42) s1g_tim_olb_test: octet 6 (SB 3) : 10100000 (0xa0) s1g_tim_olb_test: octet 7 (SB 4) : 01000010 (0x42) s1g_tim_olb_test: octet 8 (SB 5) : 10100000 (0xa0) s1g_tim_olb_test: octet 9 (SB 6) : 01000010 (0x42) s1g_tim_olb_test: octet 10 (SB 7) : 10100000 (0xa0) s1g_tim_olb_test: octet 11 (SB 8) : 01000010 (0x42) ok 3 s1g_tim_olb_test s1g_tim_inverse_block_test: Block 0 (ENC=BLOCK, blk_off=0, inverse=1) s1g_tim_inverse_block_test: octet 1 (ctrl) : 00000100 (0x04) s1g_tim_inverse_block_test: octet 2 (blk-map) : 00000101 (0x05) s1g_tim_inverse_block_test: octet 3 (SB 0) : 01000010 (0x42) s1g_tim_inverse_block_test: octet 4 (SB 2) : 10100000 (0xa0) ok 4 s1g_tim_inverse_block_test s1g_tim_inverse_single_test: Block 0 (ENC=SINGLE, blk_off=0, inverse=1) s1g_tim_inverse_single_test: octet 1 (ctrl) : 00000101 (0x05) s1g_tim_inverse_single_test: octet 2 (single) : 00011111 (0x1f) ok 5 s1g_tim_inverse_single_test s1g_tim_inverse_olb_test: Block 0 (ENC=OLB, blk_off=0, inverse=1) s1g_tim_inverse_olb_test: octet 1 (ctrl) : 00000110 (0x06) s1g_tim_inverse_olb_test: octet 2 (len= 9) : 00001001 (0x09) s1g_tim_inverse_olb_test: octet 3 (SB 0) : 01000010 (0x42) s1g_tim_inverse_olb_test: octet 4 (SB 1) : 10100000 (0xa0) s1g_tim_inverse_olb_test: octet 5 (SB 2) : 01000010 (0x42) s1g_tim_inverse_olb_test: octet 6 (SB 3) : 10100000 (0xa0) s1g_tim_inverse_olb_test: octet 7 (SB 4) : 01000010 (0x42) s1g_tim_inverse_olb_test: octet 8 (SB 5) : 10100000 (0xa0) s1g_tim_inverse_olb_test: octet 9 (SB 6) : 01000010 (0x42) s1g_tim_inverse_olb_test: octet 10 (SB 7) : 10100000 (0xa0) s1g_tim_inverse_olb_test: octet 11 (SB 8) : 01000010 (0x42) ok 6 s1g_tim_inverse_olb_test mac80211-s1g-tim: pass:6 fail:0 skip:0 total:6 Totals: pass:6 fail:0 skip:0 total:6 Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250725132221.258217-4-lachlan.hodges@morsemicro.com [make tim_push() void, non-inline] Signed-off-by: Johannes Berg commit e0c47c6229c25b54440fe1f84a0ff533942290b1 Author: Lachlan Hodges Date: Fri Jul 25 23:22:20 2025 +1000 wifi: mac80211: support parsing S1G TIM PVB An S1G TIM PVB has 3 mandatory encoding modes, that being block bitmap, single AID and OBL alongside the ability for each encoding mode to be inverted. Introduce the ability to parse the 3 encoding formats. The implementation specification for the encoding formats can be found in IEEE80211-2024 9.4.2.5. Signed-off-by: Arien Judge Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250725132221.258217-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit ee63609454838ea2b108f96f74a287be72d281ee Author: Lachlan Hodges Date: Fri Jul 25 23:22:19 2025 +1000 wifi: mac80211: support block bitmap S1G TIM encoding An S1G TIM PVB is encoded differently compared to a non-s1g TIM PVB. As the AP dictates which encoding mode it uses, here we only implement block bitmap encoding. This is the default encoding mode used by all current vendor implementations. Additionally, S1G has a maximum AID count of 8192, however we are limiting the current implementation to 1600. This has no resemblence to the standard and is purely an implementation detail. The reason for this is due to the TIM elements maximum length of 255. This allows for, at most, 25 encoded blocks for a PVB encoded with block bitmap. Support for the maximum of 8192 AIDs will require an implementation of page slicing to be added to mac80211. As a result, we perform extra validation on both the STA and AP side when receiving an AID as an S1G interface. Add support for block bitmap encoding for an S1G AP and limit the maximum AID count to 1600 for the current mac80211 implementations. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250725132221.258217-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 7c7de0b9d8dcc839b2b77e1913bb10e312fd8163 Merge: 74e2ef72bd4b25 9b273ee9c084a7 Author: Johannes Berg Date: Thu Sep 4 11:18:26 2025 +0200 Merge tag 'iwlwifi-next-2025-09-03' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next into HEAD Miri Korenblit says: ==================== iwlwifi features, notably: - more cleanups of d3 code - cleanups of the transport layer ==================== Signed-off-by: Johannes Berg commit 34837c444cd42236b2b43ce871f30d83776a3431 Author: Paul Kocialkowski Date: Sun Aug 24 20:07:34 2025 +0200 media: uapi: v4l2-controls: Cleanup codec definitions Move some fields closer to where they are used, add missing tabs and remove an extra newline. Signed-off-by: Paul Kocialkowski Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 9df928c90c109c97bdb565f81d3674224f3d118a Author: Liao Yuanhong Date: Tue Aug 26 22:52:43 2025 +0800 media: chips-media: wave5: Remove redundant ternary operators For ternary operators in the form of a ? true : false, if a itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 73d50aa92f28ee8414fbfde011974fce970b82cc Author: Paul Kocialkowski Date: Thu Aug 28 15:49:18 2025 +0200 media: verisilicon: Explicitly disable selection api ioctls for decoders Call the dedicated v4l2_disable_ioctl helper instead of manually checking whether the current context is an encoder for the selection api ioctls. Signed-off-by: Paul Kocialkowski Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 3d4a87adba78ff86c9421cbd4f0992e34e583b11 Author: Paul Kocialkowski Date: Thu Aug 28 15:58:20 2025 +0200 media: verisilicon: imx8m: Use the default Hantro G1 irq handler The existing imx8m_vpu_g1_irq implementation is an exact copy of the default hantro_g1_irq one. Switch over to it instead of keeping a duplicated implementation. Signed-off-by: Paul Kocialkowski Reviewed-by: Philipp Zabel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit cc621faa9ca9a5dcd56f5b4815e1d8c0e6eb88f9 Merge: 61481d72e15370 da43127a8edc74 Author: Paolo Abeni Date: Thu Sep 4 10:20:05 2025 +0200 Merge branch 'eth-fbnic-support-queue-api-and-zero-copy-rx' Jakub Kicinski says: ==================== eth: fbnic: support queue API and zero-copy Rx Add support for queue API to fbnic, enable zero-copy Rx. Patch 10 is likely of most interest as it adds a new core helper (and touches mlx5). The rest of the patches are fbnic-specific (and relatively boring). Patches 1-3 reshuffle the Rx init/allocation path to better align structures and functions which operate on them. Notably patch 1 moves the page pool pointer to the queue struct (from NAPI). Patch 4 converts the driver to use netmem_ref. The driver has separate and explicit buffer queue for scatter / payloads, so only references to those are converted. Next 5 patches are more boring code shifts. Patch 11 adds unreadable memory support to page pool allocation. Patch 14 finally adds the support for queue API. v2: https://lore.kernel.org/20250829012304.4146195-1-kuba@kernel.org v1: https://lore.kernel.org/20250820025704.166248-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250901211214.1027927-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit da43127a8edc7498cce7b2554533f4027c618933 Author: Jakub Kicinski Date: Mon Sep 1 14:12:14 2025 -0700 eth: fbnic: support queue ops / zero-copy Rx Support queue ops. fbnic doesn't shut down the entire device just to restart a single queue. ./tools/testing/selftests/drivers/net/hw/iou-zcrx.py TAP version 13 1..3 ok 1 iou-zcrx.test_zcrx ok 2 iou-zcrx.test_zcrx_oneshot ok 3 iou-zcrx.test_zcrx_rss # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Acked-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-15-kuba@kernel.org Signed-off-by: Paolo Abeni commit 3812339b6cc95602b5ee08ed1ffb34c21cb7d5e7 Author: Jakub Kicinski Date: Mon Sep 1 14:12:13 2025 -0700 eth: fbnic: don't pass NAPI into pp alloc Queue API may ask us to allocate page pools when the device is down, to validate that we ingested a memory provider binding. Don't require NAPI to be passed to fbnic_alloc_qt_page_pools(), to make calling fbnic_alloc_qt_page_pools() without NAPI possible. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-14-kuba@kernel.org Signed-off-by: Paolo Abeni commit 49c429ec6b624f35d506fdf759be28bf129da560 Author: Jakub Kicinski Date: Mon Sep 1 14:12:12 2025 -0700 eth: fbnic: defer page pool recycling activation to queue start We need to be more careful about when direct page pool recycling is enabled in preparation for queue ops support. Don't set the NAPI pointer, call page_pool_enable_direct_recycling() from the function that activates the queue (once the config can no longer fail). Reviewed-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-13-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8a11010fdd9615e8dbb2f5d562ab88caa8a9516a Author: Jakub Kicinski Date: Mon Sep 1 14:12:11 2025 -0700 eth: fbnic: allocate unreadable page pool for the payloads Allow allocating a page pool with unreadable memory for the payload ring (sub1). We need to provide the queue ID so that the memory provider can match the PP. Use the appropriate page pool DMA sync helper. For unreadable mem the direction has to be FROM_DEVICE. The default is BIDIR for XDP, but obviously unreadable mem is not compatible with XDP in the first place, so that's fine. While at it remove the define for page pool flags. The rxq_idx is passed to fbnic_alloc_rx_qt_resources() explicitly to make it easy to allocate page pools without NAPI (see the patch after the next). Reviewed-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-12-kuba@kernel.org Signed-off-by: Paolo Abeni commit 3ceb08838b576b20108d7facf6baa3dbf792afe9 Author: Jakub Kicinski Date: Mon Sep 1 14:12:10 2025 -0700 net: add helper to pre-check if PP for an Rx queue will be unreadable mlx5 pokes into the rxq state to check if the queue has a memory provider, and therefore whether it may produce unreadable mem. Add a helper for doing this in the page pool API. fbnic will want a similar thing (tho, for a slightly different reason). Reviewed-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-11-kuba@kernel.org Signed-off-by: Paolo Abeni commit 709da681f4dea53993578f4f060f02ccfbeb59c6 Author: Jakub Kicinski Date: Mon Sep 1 14:12:09 2025 -0700 eth: fbnic: split fbnic_fill() Factor out handling a single nv from fbnic_fill() to make it reusable for queue ops. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-10-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8a47d940cf81cf14de48dc80846d29295babffbf Author: Jakub Kicinski Date: Mon Sep 1 14:12:08 2025 -0700 eth: fbnic: split fbnic_enable() Factor out handling a single nv from fbnic_enable() to make it reusable for queue ops. Use a __ prefix for the factored out code. The real fbnic_nv_enable() which will include fbnic_wrfl() will be added with the qops, to avoid unused function warnings. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-9-kuba@kernel.org Signed-off-by: Paolo Abeni commit be2be74af889398f6d0853bb2864b6f1a75aa550 Author: Jakub Kicinski Date: Mon Sep 1 14:12:07 2025 -0700 eth: fbnic: split fbnic_flush() Factor out handling a single nv from fbnic_flush() to make it reusable for queue ops. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-8-kuba@kernel.org Signed-off-by: Paolo Abeni commit cbfc047429ee8a3c726ca44fcc63bd85faa250a2 Author: Jakub Kicinski Date: Mon Sep 1 14:12:06 2025 -0700 eth: fbnic: split fbnic_disable() Factor out handling a single nv from fbnic_disable() to make it reusable for queue ops. Use a __ prefix for the factored out code. The real fbnic_nv_disable() which will include fbnic_wrfl() will be added with the qops, to avoid unused function warnings. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-7-kuba@kernel.org Signed-off-by: Paolo Abeni commit 4ddb17c1a2c2908a17d962fec9adf68864c45b55 Author: Jakub Kicinski Date: Mon Sep 1 14:12:05 2025 -0700 eth: fbnic: request ops lock We'll add queue ops soon so. queue ops will opt the driver into extra locking. Request this locking explicitly already to make future patches smaller and easier to review. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 426e13db369c3682f5b52d5f773207115413876c Author: Jakub Kicinski Date: Mon Sep 1 14:12:04 2025 -0700 eth: fbnic: use netmem_ref where applicable Use netmem_ref instead of struct page pointer in prep for unreadable memory. fbnic has separate free buffer submission queues for headers and for data. Refactor the helper which returns page pointer for a submission buffer to take the high level queue container, create a separate handler for header and payload rings. This ties the "upcast" from netmem to system page to use of sub0 which we know has system pages. Reviewed-by: Mina Almasry Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit b6396b71d196e7451b549d471ed76d3730a16613 Author: Jakub Kicinski Date: Mon Sep 1 14:12:03 2025 -0700 eth: fbnic: move page pool alloc to fbnic_alloc_rx_qt_resources() page pools are now at the ring level, move page pool alloc to fbnic_alloc_rx_qt_resources(), and freeing to fbnic_free_qt_resources(). This significantly simplifies fbnic_alloc_napi_vector() error handling, by removing a late failure point. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 894d4a4ea6cbd82a140121f3e9d402f2fe3f09fc Author: Jakub Kicinski Date: Mon Sep 1 14:12:02 2025 -0700 eth: fbnic: move xdp_rxq_info_reg() to resource alloc Move rxq_info and mem model registration from fbnic_alloc_napi_vector() and fbnic_alloc_nv_resources() to fbnic_alloc_rx_qt_resources(). The rxq_info is now registered later in the process, but that should not cause any issues. rxq_info lives in the fbnic_q_triad (qt) struct so qt init is a more natural place. Encapsulating the logic in the qt functions will also allow simplifying the cleanup in the NAPI related alloc functions in the next commit. Rx does not have a dedicated fbnic_free_rx_qt_resources(), but we can use xdp_rxq_info_is_reg() to tell whether given rxq_info was in use (effectively - if it's a qt for an Rx queue). Having to pass nv into fbnic_alloc_rx_qt_resources() is not great in terms of layering, but that's temporary, pp will move soon.. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit 33478dca2b2302134ac9e6612152649077059569 Author: Jakub Kicinski Date: Mon Sep 1 14:12:01 2025 -0700 eth: fbnic: move page pool pointer from NAPI to the ring struct In preparation for memory providers we need a closer association between queues and page pools. We used to have a page pool at the NAPI level to serve all associated queues but with MP the queues under a NAPI may no longer be created equal. The "ring" structure in fbnic is a descriptor ring. We have separate "rings" for payload and header pages ("to device"), as well as a ring for completions ("from device"). Technically we only need the page pool pointers in the "to device" rings, so adding the pointer to the ring struct is a bit wasteful. But it makes passing the structures around much easier. For now both "to device" rings store a pointer to the same page pool. Using more than one queue per NAPI is extremely rare so don't bother trying to share a single page pool between queues. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250901211214.1027927-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit bffcb127dc4c0a33d363ea7f034a20dafbe22e17 Author: Lukas Bulwahn Date: Tue Jul 15 08:31:34 2025 +0200 MAINTAINERS: merge sections for ROCKCHIP VIDEO DECODER DRIVER Commit d968e50b5c26 ("media: rkvdec: Unstage the driver") moves the driver from staging/media/ to media/platform/rockchip/ and adds a new section ROCKCHIP RKVDEC VIDEO DECODER DRIVER in MAINTAINERS. It seems that it was overlooked that the section ROCKCHIP VIDEO DECODER DRIVER in MAINTAINERS already existed, referring to the same files before the driver was moved as the new section refers to after the driver was moved. So, merge the information from the two sections for ROCKCHIP (RKVDEC) VIDEO DECODER DRIVER into one. This essentially results in adding the maintainer of the previously existing section in the new section and then removing that previously existing section. Signed-off-by: Lukas Bulwahn Reviewed-by: Heiko Stuebner Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit bbcc6d16dea4b5c878d56a8d25daf996c6b8a1d4 Author: Nícolas F. R. A. Prado Date: Fri Jun 6 09:14:22 2025 -0400 media: platform: mtk-mdp3: Add missing MT8188 compatible to comp_dt_ids Commit 4a81656c8eaa ("arm64: dts: mediatek: mt8188: Address binding warnings for MDP3 nodes") caused a regression on the MDP functionality when it removed the MT8195 compatibles from the MDP3 nodes, since the MT8188 compatible was not yet listed as a possible MDP component compatible in mdp_comp_dt_ids. This resulted in an empty output bitstream when using the MDP from userspace, as well as the following errors: mtk-mdp3 14001000.dma-controller: Uninit component inner id 4 mtk-mdp3 14001000.dma-controller: mdp_path_ctx_init error 0 mtk-mdp3 14001000.dma-controller: CMDQ sendtask failed: -22 Add the missing compatible to the array to restore functionality. Fixes: 4a81656c8eaa ("arm64: dts: mediatek: mt8188: Address binding warnings for MDP3 nodes") Cc: stable@vger.kernel.org Signed-off-by: Nícolas F. R. A. Prado Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 91c5d7c849273d14bc4bae1b92666bdb5409294a Author: Niklas Söderlund Date: Thu Aug 28 18:06:54 2025 +0200 media: adv7180: Only validate format in querystd The .querystd callback should not program the device with the detected standard, it should only report the standard to user-space. User-space may then use .s_std to set the standard, if it wants to use it. All that is required of .querystd is to setup the auto detection of standards and report its findings. While at it add some documentation on why this can't happen while streaming and improve the error handling using a scoped guard. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit df2cd073da6ed286e26f88a2f2a6a51140cbf56b Author: Niklas Söderlund Date: Thu Aug 28 18:06:53 2025 +0200 media: adv7180: Only validate format in s_std The .s_std callback should not write the new format directly do the device, it should only store it and have it applied by .s_stream. As .s_stream already calls adv7180_program_std() all that is needed is to check the standard is valid, and store it for .s_stream to program. While at it add a scoped guard to simplify the error handling. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 Author: Niklas Söderlund Date: Thu Aug 28 18:06:52 2025 +0200 media: adv7180: Do not write format to device in set_fmt The .set_fmt callback should not write the new format directly do the device, it should only store it and have it applied by .s_stream. The .s_stream callback already calls adv7180_set_field_mode() so it's safe to remove programming of the device and just store the format and have .s_stream apply it. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a67e0eed501d155b6ceace6b605cdb184b4b6c90 Author: Niklas Söderlund Date: Thu Aug 28 18:06:51 2025 +0200 media: adv7180: Remove the s_power callback The s_power callback is used a bit oddly in adv7180, the callback adv7180_set_power() do not control power to the chip itself, but rather the power to the chips decoder. When the decoder is powered the chip process video data, or if no video source is available freeruns. When the decoder is off the device i2c registers are still powered and the device can be configured. In the current s_power implementation the device starts to transmit video data as soon as it's powered, and the s_stream operation only tracks if s_stream have been called or not. The actual configuration of the device happens when the configuration IOCTLs are called. Sometimes with very odd implementations where the decoder have to first be power off, the device configured, and then unconditionally power on, see adv7180_set_pad_format() for an example. As a first step to remedy this remove the s_power callback altogether and instead completely initialize the device from s_stream. Future work will clean up the IOCTL callbacks that directly configures the device that is also done by init_device(). Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit b918cbcb1f430f345ddcd83b014bfb3ba7a55811 Author: Niklas Söderlund Date: Thu Aug 28 18:06:50 2025 +0200 media: adv7180: Split device initialization and reset The two different tasks of resetting and initializing the devices, and configured the video formats are grouped lumped together in a single function. These two tasks are then only performed at probe time, or when resuming from suspend. Configuration of formats are then done directly by the IOCTL callbacks, such as .set_fmt. Prepare for reworking the driver to only reset the device at probe and resume, and configuring all video formats in .s_stream instead of in each IOCTL callback by splitting the two tasks in two different functions. At this point there is no functional change. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit f55cd3798af82e6a07424c84f797938c18216463 Author: Niklas Söderlund Date: Thu Aug 28 18:06:49 2025 +0200 media: adv7180: Power down decoder when configuring the device Some variants of the chip (ADV7180) have it's decoder powered up after reset, while others (ADV7280, ADV7281, ADV7282, ADV7283) have it powered down. This is tracked by the feature flag ADV7180_FLAG_RESET_POWERED. At probe this flag is used to initialize the state variable powered which keeps track of if the decoder is powered on, or off, for the resume callback. This however misses that the decoder needs to be powered off for some configuration of the device to take hold. So for devices where it's left on (ADV7180) the format configuration at probe time have little effect. This worked as the .set_fmt callback powers down the decoder, updates the format, and powers back on the decoder. Before moving all configuration to .s_stream this needs to be fixed. Instead of tracking if the decoder is powered on or off, use the flag to determine if needs to be powered down after a reset to do the configuration. To keep the behavior consistent with the currents implementation switch the decoder back on for devices where this is the reset behavior. The primary reason for this is that if not done the first 35+ frames or so of the capture session is garbage. To keep the support of starting the decoder when resuming from sleep on devices where the reset behavior is to start with the decoder powered off, use the state variable streaming. If it is set the decoder was powered on when the system suspended so we know to start it again when resuming. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil [hverkuil: fix typo in comment: where -> were] commit dc12a27cd1c954e9a5ac9c0e0fdcbf6e1fa554ee Author: Niklas Söderlund Date: Thu Aug 28 18:06:48 2025 +0200 media: adv7180: Setup controls every time the device is reset The device initialization code resets the whole device, thus the initial controls set at probe are lost as adv7180_init_controls() are called before init_device(). Additionally the controls were never restored after the device where reset coming back from suspend. Solve this by separate the setup of the controls from the creation of them, and always set them up when the device is reset. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6742cc8d7159abf4da9b1817ce8484c0386eb52f Author: Niklas Söderlund Date: Thu Aug 28 18:06:47 2025 +0200 media: adv7180: Use v4l2-ctrls core to handle s_ctrl locking Instead of handling the state lock ourself in .s_ctrl use the v4l2-ctrls core to handle it for us. This will allow us later to use the unlocked __v4l2_ctrl_handler_setup() in initialization code where the state lock is already held. Add a lockdep assert to demonstrate the mutex must be held when setting controls. There is no functional change. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f18491f18077e9f914a23070b827d817ef8954b6 Author: Niklas Söderlund Date: Thu Aug 28 18:06:46 2025 +0200 media: adv7180: Move state mutex handling outside init_device() Future rework to get rid of .s_power requires the state mutex to be held for multiple operations where initializing the device is one of them. Move lock handling outside init_device() but enforce the lock is held with a lockdep_assert_held(). Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 Author: Niklas Söderlund Date: Thu Aug 28 18:06:45 2025 +0200 media: adv7180: Add missing lock in suspend callback The adv7180_set_power() utilizes adv7180_write() which in turn requires the state mutex to be held, take it before calling adv7180_set_power() to avoid tripping a lockdep_assert_held(). Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit 031f2bf0323e7b7408ec968fa90490ab7a11889b Author: Niklas Söderlund Date: Thu Aug 28 18:06:44 2025 +0200 media: adv7180: Move adv7180_set_power() and init_device() Move the two functions adv7180_set_power() and init_device() earlier in the file so they in future changes can be used from .querystd and .s_stream as the driver is reworked to drop the usage of .s_power. While at it fix two style issues in init_device() that checkpatch complains about. - Two cases of indentation issues for function arguments split over multiple lines. - The repetition of the word 'interrupts' in a comment. Apart from these style fixes the functions are moved verbatim and there are no functional changes. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 61481d72e153703df180c46c3d0eb648fe0416b1 Author: Yue Haibing Date: Mon Sep 1 19:48:57 2025 +0800 ipv6: sit: Add ipip6_tunnel_dst_find() for cleanup Extract the dst lookup logic from ipip6_tunnel_xmit() into new helper ipip6_tunnel_dst_find() to reduce code duplication and enhance readability. No functional change intended. On a x86_64, with allmodconfig object size is also reduced: ./scripts/bloat-o-meter net/ipv6/sit.o net/ipv6/sit-new.o add/remove: 5/3 grow/shrink: 3/4 up/down: 1841/-2275 (-434) Function old new delta ipip6_tunnel_dst_find - 1697 +1697 __pfx_ipip6_tunnel_dst_find - 64 +64 __UNIQUE_ID_modinfo2094 - 43 +43 ipip6_tunnel_xmit.isra.cold 79 88 +9 __UNIQUE_ID_modinfo2096 12 20 +8 __UNIQUE_ID___addressable_init_module2092 - 8 +8 __UNIQUE_ID___addressable_cleanup_module2093 - 8 +8 __func__ 55 59 +4 __UNIQUE_ID_modinfo2097 20 18 -2 __UNIQUE_ID___addressable_init_module2093 8 - -8 __UNIQUE_ID___addressable_cleanup_module2094 8 - -8 __UNIQUE_ID_modinfo2098 18 - -18 __UNIQUE_ID_modinfo2095 43 12 -31 descriptor 112 56 -56 ipip6_tunnel_xmit.isra 9910 7758 -2152 Total: Before=72537, After=72103, chg -0.60% Signed-off-by: Yue Haibing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20250901114857.1968513-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni commit 6bec791b2fbe3502994851fdd9b301b02081b89f Merge: 94fc5015ea7e7d 92e913a3df3c45 Author: Paolo Abeni Date: Thu Sep 4 09:43:26 2025 +0200 Merge branch 'net-renesas-rswitch-r-car-s4-add-hw-offloading-for-layer-2-switching' Michael Dege says: ==================== net: renesas: rswitch: R-Car S4 add HW offloading for layer 2 switching The current R-Car S4 rswitch driver only supports port based fowarding. This patch set adds HW offloading for L2 switching/bridgeing. The driver hooks into switchdev. 1. Rename the base driver file to keep the driver name (rswitch.ko) 2. Add setting of default MAC ageing time in hardware. 3. Add the L2 driver extension in a separate file. The HW offloading is automatically configured when a port is added to the bridge device. Usage example: ip link add name br0 type bridge ip link set dev tsn0 master br0 ip link set dev tsn1 master br0 ip link set dev br0 up ip link set dev tsn0 up ip link set dev tsn1 up Layer 2 traffic is now fowarded by HW from port TSN0 to port TSN1. 4. Provides the functionality to set the MAC table ageing time in the Rswitch. Usage example: ip link change dev br0 type bridge ageing 100 v4: https://lore.kernel.org/r/20250828-add_l2_switching-v4-0-89d7108c8592@renesas.com v3: https://lore.kernel.org/r/20250710-add_l2_switching-v3-0-c0a328327b43@renesas.com v2: https://lore.kernel.org/r/20250708-add_l2_switching-v2-0-f91f5556617a@renesas.com v1: https://lore.kernel.org/r/20250704-add_l2_switching-v1-0-ff882aacb258@renesas.com Signed-off-by: Michael Dege Signed-off-by: Nikita Yushchenko ==================== Link: https://patch.msgid.link/20250901-add_l2_switching-v5-0-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni commit 92e913a3df3c4567309bd98d7a3f2fcd5b0d0191 Author: Michael Dege Date: Mon Sep 1 06:58:08 2025 +0200 net: renesas: rswitch: add modifiable ageing time Allow the setting of the MAC table aging in the R-Car S4 Rswitch using the SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME attribute. Signed-off-by: Michael Dege Link: https://patch.msgid.link/20250901-add_l2_switching-v5-4-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni commit b7502b1043de86967ff341819d05e09a8dbe8b2b Author: Michael Dege Date: Mon Sep 1 06:58:07 2025 +0200 net: renesas: rswitch: add offloading for L2 switching Add hardware offloading for L2 switching on R-Car S4. On S4 brdev is limited to one per-device (not per port). Reasoning is that hw L2 forwarding support lacks any sort of source port based filtering, which makes it unusable to offload more than one bridge device. Either you allow hardware to forward destination MAC to a port, or you have to send it to CPU. You can't make it forward only if src and dst ports are in the same brdev. Signed-off-by: Nikita Yushchenko Signed-off-by: Michael Dege Link: https://patch.msgid.link/20250901-add_l2_switching-v5-3-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni commit 622303250c51b8104e23da5f6b3eff65924a80b7 Author: Michael Dege Date: Mon Sep 1 06:58:06 2025 +0200 net: renesas: rswitch: configure default ageing time Enable MAC ageing by setting up the timer and setting the ageging time to the default of 300s. Signed-off-by: Michael Dege Link: https://patch.msgid.link/20250901-add_l2_switching-v5-2-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni commit 5ee21c004c0b9f48744bdbda3dc27c33617994ff Author: Michael Dege Date: Mon Sep 1 06:58:05 2025 +0200 net: renesas: rswitch: rename rswitch.c to rswitch_main.c Adding new functionality to the driver. Therefore splitting into multiple c files to keep them manageable. New functionality will be added to separate files. Reviewed-by: Andrew Lunn Reviewed-by: Niklas Söderlund Reviewed-by: Yoshihiro Shimoda Signed-off-by: Michael Dege Link: https://patch.msgid.link/20250901-add_l2_switching-v5-1-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni commit 2a1eea8fd601db4c52f0d14f8871663b7b052c91 Author: Colin Ian King Date: Wed Sep 3 09:31:06 2025 +0100 drm/sysfb: Remove double assignment to pointer crtc_state The declaration of pointer crtc_state includes an assignment to crtc_state. The double assignment of crtc_state is redundant and can be removed. Fixes: 061963cd9e5b ("drm/sysfb: Blit to CRTC destination format") Signed-off-by: Colin Ian King Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250903083106.2703580-1-colin.i.king@gmail.com commit a08b4dcad9fae495bcd88b91fb3410abf77d268e Author: Andrea Righi Date: Thu Sep 4 07:31:00 2025 +0200 tools/sched_ext: Add compat helper for scx_bpf_cpu_curr() Introduce a compatibility helper that allows BPF schedulers to use scx_bpf_cpu_curr() on older kernels. Fixes: 20b158094a1ad ("sched_ext: Introduce scx_bpf_cpu_curr()") Cc: Christian Loehle Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit fece859855497d444b5efef23d022ab788f14303 Author: Himal Prasad Ghimiray Date: Thu Aug 28 16:19:33 2025 +0530 drm/xe/vm: Fix error handling in xe_vm_query_vmas_attrs_ioctl() copy_to_user() returns the number of bytes not copied on failure, not a negative error code. Update the logic to return -EFAULT instead of the number of bytes to correctly signal the error. Fixes: 418807860e94 ("drm/xe/uapi: Add UAPI for querying VMA count and memory attributes") Cc: Matthew Brost Cc: Dan Carpenter Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250828104933.3839825-3-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 294912f93d0fd4d537b7605d2e5fa6f735794c75 Author: Himal Prasad Ghimiray Date: Thu Aug 28 16:19:32 2025 +0530 drm/xe: Fix indentation in xe_zap_ptes_in_madvise_range Fix misleading indentation around WRITE_ONCE in pte zap loop. No functional change intended. Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Cc: Matthew Brost Cc: Dan Carpenter Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250828104933.3839825-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 3e681899cc6e6c77eca55dd8c7cc57b27868e8a2 Author: Liao Yuanhong Date: Wed Sep 3 20:12:27 2025 +0800 cpufreq: mediatek: avoid redundant conditions While 'if (i <= 0) ... else if (i > 0) ...' is technically equivalent to 'if (i <= 0) ... else ...', the latter is vastly easier to read because it avoids writing out a condition that is unnecessary. Let's drop such unnecessary conditions. Signed-off-by: Liao Yuanhong Signed-off-by: Viresh Kumar commit 8c94db0ae97c72c253a615f990bd466b456e94f6 Author: Svetlana Parfenova Date: Mon Sep 1 20:53:50 2025 +0700 binfmt_elf: preserve original ELF e_flags for core dumps Some architectures, such as RISC-V, use the ELF e_flags field to encode ABI-specific information (e.g., ISA extensions, fpu support). Debuggers like GDB rely on these flags in core dumps to correctly interpret optional register sets. If the flags are missing or incorrect, GDB may warn and ignore valid data, for example: warning: Unexpected size of section '.reg2/213' in core file. This can prevent access to fpu or other architecture-specific registers even when they were dumped. Save the e_flags field during ELF binary loading (in load_elf_binary()) into the mm_struct, and later retrieve it during core dump generation (in fill_note_info()). Kconfig option CONFIG_ARCH_HAS_ELF_CORE_EFLAGS is introduced for architectures that require this behaviour. Signed-off-by: Svetlana Parfenova Link: https://lore.kernel.org/r/20250901135350.619485-1-svetlana.parfenova@syntacore.com Signed-off-by: Kees Cook commit e339a73737d365dc88e1994d561112ef2c21ad88 Author: Eric Biggers Date: Thu Aug 21 13:56:13 2025 -0400 drm/bridge: it6505: Use SHA-1 library instead of crypto_shash Instead of using the "sha1" crypto_shash, simply call the sha1() library function. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250821175613.14717-1-ebiggers@kernel.org Signed-off-by: Chen-Yu Tsai commit 0f084b221e2c5ba16eca85b3d2497f9486bd0329 Author: Yixun Lan Date: Tue Sep 2 20:26:58 2025 +0800 riscv: dts: spacemit: uart: remove sec_uart1 device node sec_uart1 is not available from Linux, and no clock is implemented in CCF framework, thus 'make dtbs_check' will pop up this warning message: serial@f0612000: 'clock-names' is a required property Removing the node from device tree to silence the DT check warning. Link: https://lore.kernel.org/r/20250902-02-k1-uart-clock-v2-1-f146918d44f6@gentoo.org Signed-off-by: Yixun Lan commit 94fc5015ea7e7d267a54a75c5556d8f4dfc3a209 Merge: 21f82062d0f241 13d8f54d92a99c Author: Jakub Kicinski Date: Wed Sep 3 17:28:48 2025 -0700 Merge branch 'net-phy-micrel-add-ptp-support-for-lan8842' Horatiu Vultur says: ==================== net: phy: micrel: Add PTP support for lan8842 The PTP block in lan8842 is the same as lan8814 so reuse all these functions. The first patch of the series just does cosmetic changes such that lan8842 can reuse the function lan8814_ptp_probe. There should not be any functional changes here. While the second patch adds the PTP support to lan8842. ==================== Link: https://patch.msgid.link/20250902121832.3258544-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 13d8f54d92a99c7ce6820a02f448132f58357da3 Author: Horatiu Vultur Date: Tue Sep 2 14:18:32 2025 +0200 net: phy: micrel: Add PTP support for lan8842 It has the same PTP IP block as lan8814, only the number of GPIOs is different, all the other functionality is the same. So reuse the same functions as lan8814 for lan8842. There is a revision of lan8842 called lan8832 which doesn't have the PTP IP block. So make sure in that case the PTP is not initialized. Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250902121832.3258544-3-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit b9e0c62057a8fbbf90182caa19cc460e4aca051b Author: Horatiu Vultur Date: Tue Sep 2 14:18:31 2025 +0200 net: phy: micrel: Introduce function __lan8814_ptp_probe_once Introduce the function __lan8814_ptp_probe_once as this function will be used also by lan8842 driver which has a different number of GPIOs compared to lan8814. This change doesn't have any functional changes. Reviewed-by: Kory Maincent Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250902121832.3258544-2-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 21f82062d0f241e55dd59eb630e8710862cc90b4 Author: Juraj Šarinay Date: Tue Sep 2 13:36:28 2025 +0200 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms An exchange with a NFC target must complete within NCI_DATA_TIMEOUT. A delay of 700 ms is not sufficient for cryptographic operations on smart cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH or 3072-bit RSA. To prevent brute-force attacks, passports and similar documents introduce even longer delays into access control protocols (BAC/PACE). The timeout should be higher, but not too much. The expiration allows us to detect that a NFC target has disappeared. Signed-off-by: Juraj Šarinay Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com Signed-off-by: Jakub Kicinski commit 648d628db536adfd8ae5e61b7a82908af8683918 Merge: 59aec9138f3056 adbe2cfd8a93fd Author: Jakub Kicinski Date: Wed Sep 3 16:51:12 2025 -0700 Merge branch 'net-stmmac-allow-generation-of-flexible-pps-relative-to-mac-time' Gatien Chevallier says: ==================== net: stmmac: allow generation of flexible PPS relative to MAC time When doing some testing on stm32mp2x platforms(MACv5), I noticed that the command previously used with a MACv4 for genering a PPS signal: echo "0 0 0 1 1" > /sys/class/ptp/ptp0/period did not work. This is because the arguments passed through this command must contain the start time at which the PPS should be generated, relative to the MAC system time. For some reason, a time set in the past seems to work with a MACv4. Because passing such an argument is tedious, consider that any time set in the past is an offset regarding the MAC system time. This way, this does not impact existing scripts and the past time use case is handled. Edit: But maybe that's not important and we can just change the default behavior to this. Example to generate a flexible PPS signal that has a 1s period 3s relative to when the command was entered: echo "0 3 0 1 1" > /sys/class/ptp/ptp0/period ==================== Link: https://patch.msgid.link/20250901-relative_flex_pps-v4-0-b874971dfe85@foss.st.com Signed-off-by: Jakub Kicinski commit adbe2cfd8a93fdefb2bd238c1ccd22d2c40e8499 Author: Gatien Chevallier Date: Mon Sep 1 11:16:28 2025 +0200 drivers: net: stmmac: handle start time set in the past for flexible PPS In case the time arguments used for flexible PPS signal generation are in the past, consider the arguments to be a time offset relative to the MAC system time. This way, past time use case is handled and it avoids the tedious work of passing an absolute time value for the flexible PPS signal generation while not breaking existing scripts that may rely on this behavior. Signed-off-by: Gatien Chevallier Link: https://patch.msgid.link/20250901-relative_flex_pps-v4-2-b874971dfe85@foss.st.com Signed-off-by: Jakub Kicinski commit 96c88268b79bc0af2014b8732a438a7afc4fff0d Author: Gatien Chevallier Date: Mon Sep 1 11:16:27 2025 +0200 time: export timespec64_add_safe() symbol Export the timespec64_add_safe() symbol so that this function can be used in modules where computation of time related is done. Signed-off-by: Gatien Chevallier Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20250901-relative_flex_pps-v4-1-b874971dfe85@foss.st.com Signed-off-by: Jakub Kicinski commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b Author: Ricardo B. Marlière Date: Fri Aug 29 16:33:49 2025 -0300 selftests/bpf: Fix count write in testapp_xdp_metadata_copy() Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check") added a new global to xsk_xdp_progs.c, but left out the access in the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will write to the whole bss section, it gets truncated. Fix by writing to skel_rx->bss->count directly. Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check") Signed-off-by: Ricardo B. Marlière Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 Author: Ricardo B. Marlière Date: Thu Aug 28 15:48:30 2025 -0300 selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh Currently, even if some subtests fails, the end result will still yield "ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are any failures. Signed-off-by: Ricardo B. Marlière Signed-off-by: Andrii Nakryiko Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com commit 59aec9138f3056f0f6a521e065fd85853227bf45 Author: Joy Zou Date: Mon Sep 1 18:36:32 2025 +0800 net: stmmac: imx: add i.MX91 support Add i.MX91 specific settings for EQoS. Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Joy Zou Link: https://patch.msgid.link/20250901103632.3409896-7-joy.zou@nxp.com Signed-off-by: Jakub Kicinski commit 225dc96f35afce6ffe3d798ffc0064445847a63b Author: Caleb Sander Mateos Date: Fri Aug 8 09:32:50 2025 -0600 ublk: inline __ublk_ch_uring_cmd() ublk_ch_uring_cmd_local() is a thin wrapper around __ublk_ch_uring_cmd() that copies the ublksrv_io_cmd from user-mapped memory to the stack using READ_ONCE(). This ublksrv_io_cmd is passed by pointer to __ublk_ch_uring_cmd() and __ublk_ch_uring_cmd() is a large function unlikely to be inlined, so __ublk_ch_uring_cmd() will have to load the ublksrv_io_cmd fields back from the stack. Inline __ublk_ch_uring_cmd() into ublk_ch_uring_cmd_local() and load the ublksrv_io_cmd fields into local variables with READ_ONCE(). This allows the compiler to delay loading the fields until they are needed and choose whether to store them in registers or on the stack. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250808153251.282107-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 9f8608fce90fbcd2a98ceefad0bc762423927629 Author: Caleb Sander Mateos Date: Mon Sep 1 19:33:27 2025 -0600 io_uring/cmd: remove unused io_uring_cmd_iopoll_done() io_uring_cmd_iopoll_done()'s only caller was removed in commit 9ce6c9875f3e ("nvme: always punt polled uring_cmd end_io work to task_work"). So remove the unused function too. Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250902013328.1517686-1-csander@purestorage.com Signed-off-by: Jens Axboe commit dd386b0d5e61556927189cd7b59a628d22cb6851 Author: Caleb Sander Mateos Date: Mon Sep 1 19:26:07 2025 -0600 io_uring/uring_cmd: correct io_uring_cmd_done() ret type io_uring_cmd_done() takes the result code for the CQE as a ssize_t ret argument. However, the CQE res field is a s32 value, as is the argument to io_req_set_res(). To clarify that only s32 values can be faithfully represented without truncation, change io_uring_cmd_done()'s ret argument type to s32. Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250902012609.1513123-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 9be5c47908e669db4934ef9c129b28bbc879a8be Author: Abhinav Kumar Date: Wed Sep 3 14:58:18 2025 +0300 dt-bindings: display/msm: expand to support MST On a vast majority of Qualcomm chipsets DisplayPort controller can support several MST streams (up to 4x). To support MST these chipsets use up to 4 stream pixel clocks for the DisplayPort controller and several extra register regions. Expand corresponding region and clock bindings for these platforms and fix example schema files to follow updated bindings. Note: On chipsets that support MST, the number of streams supported can vary between controllers. For example, SA8775P supports 4 MST streams on mdss_dp0 but only 2 streams on mdss_dp1. Signed-off-by: Abhinav Kumar Signed-off-by: Jessica Zhang Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/672585/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-7-7526f0311eaa@oss.qualcomm.com commit 0253f5ef8da491e8e694763c4aa2ac2f48ede932 Author: Abhinav Kumar Date: Wed Sep 3 14:58:17 2025 +0300 dt-bindings: display/msm: drop assigned-clock-parents for dp controller DP controller schema documents assigned-clocks and assigned-clock-parents. However these assignments should not be a part of the ABI: there are no actual requirements on the order of the assignments, MST cases require different number of clocks to be assigned, etc. Instead of fixing up the documentation, drop the assigned-clock-parents and assigned-clocks from the bindings. The generic clock/clock.yaml already covers these properties. Suggested-by: Krzysztof Kozlowski Signed-off-by: Abhinav Kumar Signed-off-by: Jessica Zhang Acked-by: Rob Herring (Arm) Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672586/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-6-7526f0311eaa@oss.qualcomm.com commit 3259ffe5b14d977c52e3e56f31cf07ca21fb314d Author: Abhinav Kumar Date: Wed Sep 3 14:58:16 2025 +0300 dt-bindings: display/msm: dp-controller: add X1E80100 Add X1E80100 to the dp-controller bindings, it has DisplayPort controller similar to other platforms, but it uses its own compatible string. Signed-off-by: Abhinav Kumar Signed-off-by: Jessica Zhang Acked-by: Rob Herring (Arm) Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672578/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-5-7526f0311eaa@oss.qualcomm.com commit 2c97ee44d29e90e0e1687c15bca4f1aa8eff3d78 Author: Abhinav Kumar Date: Wed Sep 3 14:58:15 2025 +0300 dt-bindings: display/msm: qcom,x1e80100-mdss: correct DP addresses Fix c&p error and correct example to use 32-bit addressing (as the rest of the example DT does) instead of 64-bit (as the platform does). It got unnoticed before since DP controller node wasn't validated against DT schema because of the missing compatible. Fixes: 81de267367d4 ("dt-bindings: display/msm: Document MDSS on X1E80100") Signed-off-by: Abhinav Kumar Reviewed-by: Rob Herring (Arm) Signed-off-by: Jessica Zhang Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672574/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-4-7526f0311eaa@oss.qualcomm.com commit afc9e583c0b28f885ef6aa5ef6ea098204c263ed Author: Dmitry Baryshkov Date: Wed Sep 3 14:58:14 2025 +0300 dt-bindings: display/msm: dp-controller: document DP on SM7150 The qcom,sm7150-dp compatible is documented in schema. Mark DisplayPort controller as compatible with SM8350. Fixes: 726eded12dd7 ("dt-bindings: display/msm: Add SM7150 MDSS") Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/672572/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-3-7526f0311eaa@oss.qualcomm.com commit 5484265fd685d752bb75dd8b34f617dd9991ba5c Author: Dmitry Baryshkov Date: Wed Sep 3 14:58:13 2025 +0300 dt-bindings: display/msm: dp-controller: fix fallback for SM6350 Currently SM6350 uses qcom,sm8350-dp as a fallback compatible entry. This works, but adding DP MST support will reveal that this SoC is not fully compatible with SM8350 platform: the former one doesn't provide MST support, while the latter one will get it. DT schema for SM8350 is going to demand MST-related clocks which SM6350 doesn't provide. Add new entry for SM6350 with fallback to SC7180 (which belongs to the same generation and also doesn't have MST support). SC7180 has been supported by the Linux kernel long ago (and long before SM8350 support was added). Fixes: 39086151593a ("dt-bindings: display: msm: dp-controller: document SM6350 compatible") Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/672571/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-2-7526f0311eaa@oss.qualcomm.com commit ac77c8f12edd894e8d3fe732d2b1c6c3de09c1aa Author: Dmitry Baryshkov Date: Wed Sep 3 14:58:12 2025 +0300 dt-bindings: display/msm: dp-controller: allow eDP for SA8775P On Qualcomm SA8775P the DP controller might be driving either a DisplayPort or a eDP sink (depending on the PHY that is tied to the controller). Reflect that in the schema. Acked-by: Rob Herring (Arm) Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/672569/ Link: https://lore.kernel.org/r/20250903-dp_mst_bindings-v8-1-7526f0311eaa@oss.qualcomm.com commit efe504300a1705b71a69382ade4dbe44bea9d457 Author: Taniya Das Date: Mon Aug 25 23:49:14 2025 +0530 clk: qcom: gcc: Add support for Global Clock Controller Add support for Global clock controller for Glymur SoC which would enable the consumers to enable/disable the required clocks. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-7-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ee2d967030fee156ceb2de80ef63ddeb80d60779 Author: Taniya Das Date: Mon Aug 25 23:49:13 2025 +0530 dt-bindings: clock: qcom: document the Glymur Global Clock Controller Add device tree bindings for global clock controller on Glymur SoC. Signed-off-by: Taniya Das Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-6-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2c7a7fe4ec3fc6eddd25b013b6210dbf1f98e5fc Author: Taniya Das Date: Mon Aug 25 23:49:12 2025 +0530 clk: qcom: clk-alpha-pll: Add support for Taycan EKO_T PLL Add clock operations and register offsets to enable control of the Taycan EKO_T PLL, allowing for proper configuration and management of the PLL. Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-5-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ebcb9db98bdab8b7490421355e6705e964b99675 Author: Taniya Das Date: Mon Aug 25 23:49:11 2025 +0530 clk: qcom: rpmh: Add support for Glymur rpmh clocks Add RPMH clock support for the Glymur SoC to allow enable/disable of the clocks. Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-4-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2c1d6ce4f3da622773a7a6be570e4dfbf2cefbb7 Author: Taniya Das Date: Mon Aug 25 23:49:10 2025 +0530 clk: qcom: Add TCSR clock driver for Glymur SoC Add a clock driver for the TCSR clock controller found on Glymur SoC, which provides refclks for PCIE, USB, and UFS subsystems. Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-3-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ae5b84788e5a7876a67f64761b7265529cb5a39a Author: Taniya Das Date: Mon Aug 25 23:49:09 2025 +0530 dt-bindings: clock: qcom: Document the Glymur SoC TCSR Clock Controller The Glymur SoC TCSR block provides CLKREF clocks for EDP, PCIe and USB. Add this to the TCSR clock controller binding together with identifiers for the clocks. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-2-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f9b007a96a89567372a77cbddd24d5ca4be71523 Author: Taniya Das Date: Mon Aug 25 23:49:08 2025 +0530 dt-bindings: clock: qcom-rpmhcc: Add support for Glymur SoCs Add bindings and update documentation compatible for RPMh clock controller on Glymur SoC. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250825-glymur-clock-controller-v5-v5-1-01b8c8681bcd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 24ee9feeb36ccec04ae154b40e2aba6799875cae Merge: a7ddedc84c59a6 077dc4a275790b Author: Jakub Kicinski Date: Wed Sep 3 16:06:44 2025 -0700 Merge tag 'nf-next-25-09-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next 1) prefer vmalloc_array in ebtables, from Qianfeng Rong. 2) Use csum_replace4 instead of open-coding it, from Christophe Leroy. 3+4) Get rid of GFP_ATOMIC in transaction object allocations, those cause silly failures with large sets under memory pressure, from myself. 5) Remove test for AVX cpu feature in nftables pipapo set type, testing for AVX2 feature is sufficient. 6) Unexport a few function in nf_reject infra: no external callers. 7) Extend payload offset to u16, this was restricted to values <=255 so far, from Fernando Fernandez Mancera. * tag 'nf-next-25-09-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_payload: extend offset to 65535 bytes netfilter: nf_reject: remove unneeded exports netfilter: nft_set_pipapo: remove redundant test for avx feature bit netfilter: nf_tables: all transaction allocations can now sleep netfilter: nf_tables: allow iter callbacks to sleep netfilter: nft_payload: Use csum_replace4() instead of opencoding netfilter: ebtables: Use vmalloc_array() to improve code ==================== Link: https://patch.msgid.link/20250902133549.15945-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit a7ddedc84c59a645ef970b992f7cda5bffc70cc0 Author: Onur Özkan Date: Thu Aug 21 12:12:35 2025 +0300 rust: phy: use to_result for error handling Simplifies error handling by replacing the manual check of the return value with the `to_result` helper. Signed-off-by: Onur Özkan Reviewed-by: Elle Rhumsaa Reviewed-by: Trevor Gross Link: https://patch.msgid.link/20250821091235.800-1-work@onurozkan.dev Signed-off-by: Jakub Kicinski commit 69cd99350740a5acc81f46aa5def37808d8d6e78 Author: Krzysztof Kozlowski Date: Tue Sep 2 17:40:53 2025 +0200 dt-bindings: net: renesas,rzn1-gmac: Constrain interrupts Renesas RZN1 GMAC uses three interrupts in in-kernel DTS and common snps,dwmac.yaml binding is flexible, so define precise constraint for this device. Reviewed-by: Lad Prabhakar Signed-off-by: Krzysztof Kozlowski Reviewed-by: Romain Gantois Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250902154051.263156-4-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit f672fcd8e6c411144a06dd07252f24805f229834 Author: Krzysztof Kozlowski Date: Tue Sep 2 17:40:52 2025 +0200 dt-bindings: net: altr,socfpga-stmmac: Constrain interrupts STMMAC on SoCFPGA uses exactly one interrupt in in-kernel DTS and common snps,dwmac.yaml binding is flexible, so define precise constraint for this device. Signed-off-by: Krzysztof Kozlowski Acked-by: Matthew Gerlach Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250902154051.263156-3-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit f38b9334bb5a66c508ca835388364f50777d8010 Merge: a229866f7d650f 017bda80fd0ddd Author: Jakub Kicinski Date: Wed Sep 3 15:16:54 2025 -0700 Merge branch 'tools-ynl-gen-misc-changes' Asbjørn Sloth Tønnesen says: ==================== tools: ynl-gen: misc changes Misc changes to ahead of wireguard ynl conversion, as announced in v1. v1: https://lore.kernel.org/20250901145034.525518-1-ast@fiberby.net ==================== Link: https://patch.msgid.link/20250902154640.759815-1-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 017bda80fd0ddd24ea8cf932c3bd970491e0abc1 Author: Asbjørn Sloth Tønnesen Date: Tue Sep 2 15:46:37 2025 +0000 genetlink: fix typo in comment In this context "not that ..." should properly be "note that ...". Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250902154640.759815-4-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 5fece054451b3f812876a0bf1ba1a752da2cb532 Author: Asbjørn Sloth Tønnesen Date: Tue Sep 2 15:46:36 2025 +0000 tools: ynl-gen: use macro for binary min-len check This patch changes the generated min-len check for binary attributes to use the NLA_POLICY_MIN_LEN() macro, thereby the generated code supports strict policy validation. With this change TypeBinary will always generate a NLA_BINARY attribute policy. This doesn't change any currently generated code, as it isn't used in any specs currently used for generating code. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250902154640.759815-3-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 9f9581ba74a931843c6d807ecfeaff9fb8c1b731 Author: Asbjørn Sloth Tønnesen Date: Tue Sep 2 15:46:35 2025 +0000 netlink: specs: fou: change local-v6/peer-v6 check While updating the binary min-len implementation, I noticed that the only user, should AFAICT be using exact-len instead. In net/ipv4/fou_core.c FOU_ATTR_LOCAL_V6 and FOU_ATTR_PEER_V6 are only used for singular IPv6 addresses, and there are AFAICT no known implementations trying to send more, it therefore appears safe to change it to an exact-len policy. This patch therefore changes the local-v6/peer-v6 attributes to use an exact-len check, instead of a min-len check. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250902154640.759815-2-ast@fiberby.net Signed-off-by: Jakub Kicinski commit b4d15211c4086a8a6d670cdba9649112fed67f86 Author: Taniya Das Date: Fri Aug 29 13:28:04 2025 +0530 clk: qcom: dispcc-glymur: Add support for Display Clock Controller Add driver for Display clock controller (DISPCC) on Qualcomm Glymur SoC. This would enable the display sw driver to enable/disable/request for the display clocks. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250829-glymur-disp-clock-controllers-v1-2-0ce6fabd837c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 781c118c3ece2b546c6c41f617cccb36cb9534f1 Author: Taniya Das Date: Fri Aug 29 13:28:03 2025 +0530 dt-bindings: clock: Add DISPCC and reset controller for GLYMUR SoC Add the device tree bindings for the display clock controller which are required on Qualcomm Glymur SoC. Signed-off-by: Taniya Das Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250829-glymur-disp-clock-controllers-v1-1-0ce6fabd837c@oss.qualcomm.com [bjorn: Dropped unnecessary include in DT example] Signed-off-by: Bjorn Andersson commit a229866f7d650fa4c9059cd17262b21fdd9ee5ba Merge: 0e2a5208cc3ddd 3bd4f98a4e2c60 Author: Jakub Kicinski Date: Wed Sep 3 15:08:22 2025 -0700 Merge branch 'mptcp-misc-features-for-v6-18' Matthieu Baerts says: ==================== mptcp: misc. features for v6.18 This series contains 4 independent new features: - Patch 1: use HMAC-SHA256 library instead of open-coded HMAC. - Patch 2: selftests: check for unexpected fallback counter increments. - Patches 3-4: record subflows in RPS table, for aRFS support. v1: https://lore.kernel.org/20250901-net-next-mptcp-misc-feat-6-18-v1-0-80ae80d2b903@kernel.org ==================== Link: https://patch.msgid.link/20250902-net-next-mptcp-misc-feat-6-18-v2-0-fa02bb3188b1@kernel.org Signed-off-by: Jakub Kicinski commit 3bd4f98a4e2c601895f0ca8844098caedf4717a1 Author: Christoph Paasch Date: Tue Sep 2 23:11:36 2025 +0200 mptcp: record subflows in RPS table Accelerated Receive Flow Steering (aRFS) relies on sockets recording their RX flow hash into the rps_sock_flow_table so that incoming packets are steered to the CPU where the application runs. With MPTCP, the application interacts with the parent MPTCP socket while data is carried over per-subflow TCP sockets. Without recording these subflows, aRFS cannot steer interrupts and RX processing for the flows to the desired CPU. Record all subflows in the RPS table by calling sock_rps_record_flow() for each subflow at the start of mptcp_sendmsg(), mptcp_recvmsg() and mptcp_stream_accept(), by using the new helper mptcp_rps_record_subflows(). It does not by itself improve throughput, but ensures that IRQ and RX processing are directed to the right CPU, which is a prerequisite for effective aRFS. Signed-off-by: Christoph Paasch Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250902-net-next-mptcp-misc-feat-6-18-v2-4-fa02bb3188b1@kernel.org Signed-off-by: Jakub Kicinski commit 929324913e0caabea91b50fa71e41d70b766f7dc Author: Christoph Paasch Date: Tue Sep 2 23:11:35 2025 +0200 net: Add rfs_needed() helper Add a helper to check if RFS is needed or not. Allows to make the code a bit cleaner and the next patch to have MPTCP use this helper to decide whether or not to iterate over the subflows. tun_flow_update() was calling sock_rps_record_flow_hash() regardless of the state of rfs_needed. This was not really a bug as sock_flow_table simply ends up being NULL and thus everything will be fine. This commit here thus also implicitly makes tun_flow_update() respect the state of rfs_needed. Suggested-by: Matthieu Baerts Signed-off-by: Christoph Paasch Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250902-net-next-mptcp-misc-feat-6-18-v2-3-fa02bb3188b1@kernel.org Signed-off-by: Jakub Kicinski commit 3fff72f827ad168343a88ae1c4857a1c17a9c865 Author: Gang Yan Date: Tue Sep 2 23:11:34 2025 +0200 selftests: mptcp: add checks for fallback counters Recently, some mib counters about fallback has been added, this patch provides a method to check the expected behavior of these mib counters during the test execution. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/571 Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250902-net-next-mptcp-misc-feat-6-18-v2-2-fa02bb3188b1@kernel.org Signed-off-by: Jakub Kicinski commit 2d5be5629ce73522d1c739579d6e8e450de8685e Author: Eric Biggers Date: Tue Sep 2 23:11:33 2025 +0200 mptcp: use HMAC-SHA256 library instead of open-coded HMAC Now that there are easy-to-use HMAC-SHA256 library functions, use these in net/mptcp/crypto.c instead of open-coding the HMAC algorithm. Remove the WARN_ON_ONCE() for messages longer than SHA256_DIGEST_SIZE. The new implementation handles all message lengths correctly. The mptcp-crypto KUnit test still passes after this change. Signed-off-by: Eric Biggers Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250902-net-next-mptcp-misc-feat-6-18-v2-1-fa02bb3188b1@kernel.org Signed-off-by: Jakub Kicinski commit 7e5a0fe4e8ae2eb341f8ebbee2b24231a58fc28b Author: Baruch Siach Date: Wed Aug 27 14:37:27 2025 +0300 doc: filesystems: proc: remove stale information from intro Most of the information in the first paragraph of the Introduction/Credits section is outdated. Documentation update suggestions should go to documentation maintainers listed in MAINTAINERS. Remove misleading contact information. Signed-off-by: Baruch Siach Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/cb4987a16ed96ee86841aec921d914bd44249d0b.1756294647.git.baruch@tkos.co.il commit 54dbd2a8e974b900b18639e75f62702a4334ddc0 Author: Leon Romanovsky Date: Wed Sep 3 14:52:56 2025 +0300 PCI/P2PDMA: Reduce scope of pci_has_p2pmem() pci_has_p2pmem() is not used outside of p2pdma.c, and there is no need to export it for use by modules. Signed-off-by: Leon Romanovsky Signed-off-by: Bjorn Helgaas Reviewed-by: Logan Gunthorpe Link: https://patch.msgid.link/d40f3f1decf54c9236bc38b48a6aae612a5c182f.1756900291.git.leon@kernel.org commit 0059f3b82fe713481a1ccfe28ebe6a2489e77df3 Author: Zenghui Yu Date: Wed Aug 27 22:47:38 2025 +0800 docs: admin-guide: Fix typo in nfsroot.rst There is an obvious mistake in nfsroot.rst where pxelinux was wrongly written as pxeliunx. Fix it. Signed-off-by: Zenghui Yu Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250827144738.43361-1-zenghui.yu@linux.dev commit 0e2a5208cc3ddd23560eca909f9b41d17e69fc58 Merge: 1d8f0059091e75 04a3134f88a4bd Author: Jakub Kicinski Date: Wed Sep 3 14:59:40 2025 -0700 Merge tag 'mlx5-psp-ifc' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Saeed Mahameed says: ==================== mlx5 PSP IFC bits This PR has a single patch to add mlx5_ifc PSP related capabilities structures and HW definitions needed for PSP support in mlx5. Link: https://lore.kernel.org/20250828162953.2707727-1-daniel.zahka@gmail.com * tag 'mlx5-psp-ifc' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add PSP capabilities structures and bits ==================== Link: https://patch.msgid.link/20250903063050.668442-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 41c9570e41783648ff9455ea903615406b2bb127 Author: Brian Masney Date: Thu Aug 28 20:38:23 2025 -0400 clk: rp1: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/linux-clk/20250828-clk-round-rate-v2-v1-0-b97ec8ba6cc4@redhat.com/T/#mbb878a331cf0f8930257a356c1d9e2ab458e3efb Signed-off-by: Florian Fainelli commit 5c48d88fe004988ec508923dbdd00549e65f4055 Author: Christian Loehle Date: Wed Sep 3 22:23:11 2025 +0100 sched_ext: deprecation warn for scx_bpf_cpu_rq() scx_bpf_cpu_rq() works on an unlocked rq which generally isn't safe. For the common use-cases scx_bpf_locked_rq() and scx_bpf_cpu_curr() work, so add a deprecation warning to scx_bpf_cpu_rq() so it can eventually be removed. Signed-off-by: Christian Loehle Signed-off-by: Tejun Heo commit 0df41b1b9488f1e85ceb2307639e29ebb1d7ba64 Author: Vegard Nossum Date: Sat Aug 30 19:08:08 2025 +0200 docs: sphinx: remove SPDX/copyright comments from HTML output Use Jinja2 comments instead of HTML comments for the SPDX and copyright lines. This prevents them from appearing in the HTML output, which was never the intention; the HTML output has its own copyright line at the bottom of the document. Signed-off-by: Vegard Nossum Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250830170808.3911151-1-vegard.nossum@oracle.com commit 20b158094a1adc9bbfdcc41780059b5cd8866ad8 Author: Christian Loehle Date: Wed Sep 3 22:23:10 2025 +0100 sched_ext: Introduce scx_bpf_cpu_curr() Provide scx_bpf_cpu_curr() as a way for scx schedulers to check the curr task of a remote rq without assuming its lock is held. Many scx schedulers make use of scx_bpf_cpu_rq() to check a remote curr (e.g. to see if it should be preempted). This is problematic because scx_bpf_cpu_rq() provides access to all fields of struct rq, most of which aren't safe to use without holding the associated rq lock. Signed-off-by: Christian Loehle Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit e0ca169638be12a0a861e3439e6117c58972cd08 Author: Christian Loehle Date: Wed Sep 3 22:23:09 2025 +0100 sched_ext: Introduce scx_bpf_locked_rq() Most fields in scx_bpf_cpu_rq() assume that its rq_lock is held. Furthermore they become meaningless without rq lock, too. Make a safer version of scx_bpf_cpu_rq() that only returns a rq if we hold rq lock of that rq. Also mark the new scx_bpf_locked_rq() as returning NULL as scx_bpf_cpu_rq() should've been too. Signed-off-by: Christian Loehle Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 3f65aa8ede2377c47c11f1c38b44226b8ca60477 Author: Harshit Mogalapalli Date: Sun Aug 31 08:11:18 2025 -0700 Documentation: dev-tools: Fix a typo in autofdo documentation Use "cat /proc/cpuinfo" instead of "cat proc/cpuinfo". Signed-off-by: Harshit Mogalapalli Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250831151118.1274826-1-harshit.m.mogalapalli@oracle.com commit a5bd6ba30b3364354269b81ac55c2edca9a96d6d Author: Tejun Heo Date: Wed Sep 3 11:36:07 2025 -1000 sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations SCX hooks into CPU cgroup controller operations and read-locks scx_cgroup_rwsem to exclude them while enabling and disable schedulers. While this works, it's unnecessarily complicated given that cgroup_[un]lock() are available and thus the cgroup operations can be locked out that way. Drop scx_cgroup_rwsem locking from the tg on/offline and cgroup [can_]attach operations. Instead, grab cgroup_lock() from scx_cgroup_lock(). Drop scx_cgroup_finish_attach() which is no longer necessary. Drop the now unnecessary rcu locking and css ref bumping in scx_cgroup_init() and scx_cgroup_exit(). As scx_cgroup_set_weight/bandwidth() paths aren't protected by cgroup_lock(), rename scx_cgroup_rwsem to scx_cgroup_ops_rwsem and retain the locking there. This is overall simpler and will also allow enable/disable paths to synchronize against cgroup changes independent of the CPU controller. Signed-off-by: Tejun Heo Cc: Peter Zijlstra Acked-by: Andrea Righi commit a4c2ff6e507ebb47761865289772494e717d035a Author: Ranganath V N Date: Wed Sep 3 01:08:22 2025 +0530 Documentation: Fix spelling mistakes Corrected a few spelling mistakes to improve the readability. Signed-off-by: Ranganath V N Acked-by: Rob Herring (Arm) Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250902193822.6349-1-vnranganath.20@gmail.com commit 59ffc9beeb8b332940d36f4b9803352b7f893f5a Author: Stephen Smalley Date: Tue Sep 2 09:11:08 2025 -0400 selinux: fix sel_read_bool() allocation and error handling Switch sel_read_bool() from using get_zeroed_page() and free_page() to a stack-allocated buffer. This also fixes a memory leak in the error path when security_get_bool_value() returns an error. Reported-by: Matthew Wilcox Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit bcb7c2305682c77a8bfdbfe37106b314ac10110f Author: Tejun Heo Date: Wed Sep 3 11:33:28 2025 -1000 sched_ext: Put event_stats_cpu in struct scx_sched_pcpu scx_sched.event_stats_cpu is the percpu counters that are used to track stats. Introduce struct scx_sched_pcpu and move the counters inside. This will ease adding more per-cpu fields. No functional changes. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 0c2b8356e430229efef42b03bd765a2a7ecf73fd Author: Tejun Heo Date: Wed Sep 3 11:33:28 2025 -1000 sched_ext: Move internal type and accessor definitions to ext_internal.h There currently isn't a place to place SCX-internal types and accessors to be shared between ext.c and ext_idle.c. Create kernel/sched/ext_internal.h and move internal type and accessor definitions there. This trims ext.c a bit and makes future additions easier. Pure code reorganization. No functional changes. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 4a1d9d73aabc8f97f48c4f84f936de3b265ffd6f Author: Tejun Heo Date: Wed Sep 3 11:33:28 2025 -1000 sched_ext: Keep bypass on between enable failure and scx_disable_workfn() scx_enable() turns on the bypass mode while enable is in progress. If enabling fails, it turns off the bypass mode and then triggers scx_error(). scx_error() will trigger scx_disable_workfn() which will turn on the bypass mode again and unload the failed scheduler. This moves the system out of bypass mode between the enable error path and the disable path, which is unnecessary and can be brittle - e.g. the thread running scx_enable() may already be on the failed scheduler and can be switched out before it triggers scx_error() leading to a stall. The watchdog would eventually kick in, so the situation isn't critical but is still suboptimal. There is nothing to be gained by turning off the bypass mode between scx_enable() failure and scx_disable_workfn(). Keep bypass on. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit b7975c48695cdc2cc308df342f85ccaf9dac0888 Author: Tejun Heo Date: Wed Sep 3 11:33:28 2025 -1000 sched_ext: Make explicit scx_task_iter_relock() calls unnecessary During tasks iteration, the locks can be dropped using scx_task_iter_unlock() to perform e.g. sleepable allocations. Afterwards, scx_task_iter_relock() has to be called prior to other iteration operations, which is error-prone. This can be easily automated by tracking whether scx_tasks_lock is held in scx_task_iter and re-acquiring when necessary. It already tracks whether the task's rq is locked after all. - Add scx_task_iter->list_locked which remembers whether scx_tasks_lock is held. - Rename scx_task_iter->locked to scx_task_iter->locked_task to better distinguish it from ->list_locked. - Replace scx_task_iter_relock() with __scx_task_iter_maybe_relock() which is automatically called by scx_task_iter_next() and scx_task_iter_stop(). - Drop explicit scx_task_iter_relock() calls. The resulting behavior should be equivalent. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit b65988af71af62b81bbc6af0cbe05b18eaef4da5 Author: Ryan Chung Date: Sun Aug 31 19:17:29 2025 +0900 tracing: fix grammar error in debugging.rst Signed-off-by: Ryan Chung Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250831101736.11519-3-seokwoo.chung130@gmail.com commit d5958c8a09d583273d6713cd9f6da4412a2f45e6 Author: Ryan Chung Date: Sun Aug 31 19:17:28 2025 +0900 tracing: rephrase for clearer documentation Signed-off-by: Ryan Chung Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250831101736.11519-2-seokwoo.chung130@gmail.com commit 4dbe13c78447450ee133fc3399ebcabe27a62164 Merge: b0b4518c992eb5 4fc8728aa34f54 Author: Jens Axboe Date: Wed Sep 3 15:15:43 2025 -0600 Merge tag 'pull-getgeo' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into for-6.18/block Pull struct block_device getgeo changes from Al. "switching ->getgeo() from struct block_device to struct gendisk Signed-off-by: Al Viro " * tag 'pull-getgeo' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: block: switch ->getgeo() to struct gendisk scsi: switch ->bios_param() to passing gendisk scsi: switch scsi_bios_ptable() and scsi_partsize() to gendisk commit 2d503aafdf70357e279ffef42ae18474328cc223 Author: Akhilesh Patil Date: Sat Jul 19 16:44:27 2025 +0530 drivers: firmware: bcm47xx_sprom: fix spelling Fix spelling in bcm47xx_sprom.c as follows, specififc --> specific Signed-off-by: Akhilesh Patil Link: https://lore.kernel.org/r/aHt+Ey5AQ0dsCuB4@bhairav-test.ee.iitb.ac.in Signed-off-by: Florian Fainelli commit a7713a7dd15962c077527eea9a2f56d821ca4a1d Author: Andrea della Porta Date: Mon Jun 23 23:46:28 2025 +0200 clk: rp1: Implement remaining clock tree The RP1 clock generator driver currently defines only the fundamental clocks such as the front PLLs for system, audio and video subsystems and the ethernet clock. Add the remaining clocks to the tree so as to be completed, which means that the following RP1 peripherals could now consume their specific clocks and be enabled to work (provided that the relevant driver changes for each specific peripheral, if any, are committed): - ADC - Audio IN/OUT - DMA controller - I2S - MIPI DPI/DSI - PWM - SDIO - UART - Video Encoder Signed-off-by: Andrea della Porta Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/17e5c6e0c085cfa0bf4b63b639cdc92c6a4c1418.1750714412.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 07bab7b81d8a4de604ae4175978adf37137c35d6 Author: Andrea della Porta Date: Mon Jun 23 23:46:27 2025 +0200 dt-bindings: clock: rp1: Add missing MIPI DSI defines Declare the positional index for the RP1 MIPI clocks. Signed-off-by: Andrea della Porta Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/c20066500908db854aa4816b40e956296bab526a.1750714412.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 484199a02aca6c7ea99501eec2fc73cb808e209d Author: Taishi Shimizu Date: Sun Jul 13 16:18:25 2025 +0900 ARM: dts: BCM5301X: Add support for Buffalo WXR-1750DHP Add initial device tree support for the Buffalo WXR-1750DHP, a consumer Wi-Fi router based on the Broadcom BCM4708A0 SoC. Hardware specifications: * Processor: Broadcom BCM4708A0 dual-core @ 800 MHz * RAM: DDR3 256 MB * Ethernet Switch: Broadcom BCM53011 integrated via SRAB * NAND Flash: 128 MB (8-bit ECC) * SPI Flash: None * Ports: 4 LAN Ports, 1 WAN Port * USB: 1x USB 3.0 Type-A port Signed-off-by: Taishi Shimizu Link: https://lore.kernel.org/r/20250713071826.726682-3-s.taishi14142@gmail.com Signed-off-by: Florian Fainelli commit 279ea197d9bd56d2a4d0058a55fd0eb88626ad6a Author: Taishi Shimizu Date: Sun Jul 13 16:18:24 2025 +0900 dt-bindings: arm: bcm: Add support for Buffalo WXR-1750DHP Add Buffalo WXR-1750DHP under BCM4708 based boards. Signed-off-by: Taishi Shimizu Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250713071826.726682-2-s.taishi14142@gmail.com Signed-off-by: Florian Fainelli commit 278b6cabf18bd804f956b98a2f1068717acdbfe3 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:34:08 2025 +0200 arm64: dts: broadcom: bcm2712: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: bcm2712.dtsi:494.4-497.31: Warning (interrupt_map): /axi/pcie@1000110000:interrupt-map: Missing property '#address-cells' in node /soc@107c000000/interrupt-controller@7fff9000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822133407.312505-2-krzysztof.kozlowski@linaro.org Signed-off-by: Florian Fainelli commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 Author: Alok Tiwari Date: Tue Aug 19 08:04:08 2025 -0700 PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation Fix incorrect argument order in devm_kcalloc() when allocating port->phys. The original call used sizeof(phy) as the number of elements and port->lanes as the element size, which is reversed. While this happens to produce the correct total allocation size with current pointer size and lane counts, the argument order is wrong. Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") Signed-off-by: Alok Tiwari [mani: added Fixes tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com commit 73e4e7087a4545db3c8c4b3fec82c7bef8e2f7b1 Merge: 94b39cb3ad6db9 5cc49b5a36b32a Author: Mark Brown Date: Wed Sep 3 20:15:02 2025 +0100 spi: spi-fsl-dspi: Target mode improvements Merge series from James Clark : Improve usability of target mode by reporting FIFO errors and increasing the buffer size when DMA is used. While we're touching DMA stuff also switch to non-coherent memory, although this is unrelated to target mode. With the combination of the commit to increase the DMA buffer size and the commit to use non-coherent memory, the host mode performance figures are as follows on S32G3: # spidev_test --device /dev/spidev1.0 --bpw 8 --size --cpha --iter 10000000 --speed 10000000 Coherent (4096 byte transfers): 6534 kbps Non-coherent: 7347 kbps Coherent (16 byte transfers): 447 kbps Non-coherent: 448 kbps Just for comparison running the same test in XSPI mode: 4096 byte transfers: 2143 kbps 16 byte transfers: 637 kbps These tests required hacking S32G3 to use DMA in host mode, although the figures should be representative of target mode too where DMA is used. And the other devices that use DMA in host mode should see similar improvements. commit 414bf79debdce9bb682b4f23f87ea97568afa67b Author: Zecheng Li Date: Mon Aug 25 19:54:03 2025 +0000 perf dwarf-aux: Use signed variable types in match_var_offset match_var_offset() compares address offsets to determine if an access falls within a variable's bounds. The offsets involved for those relative to base registers from DW_OP_breg can be negative. The current implementation uses unsigned types (u64) for these offsets, which rejects almost all negative values. Change the signature of match_var_offset() to use signed types (s64). This ensures correct behavior when addr_offset or addr_type are negative. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Link: https://lore.kernel.org/r/20250825195412.223077-2-zecheng@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e117ff1129daa7d63536833f39285e50ad52379d Author: Waiman Long Date: Tue Sep 2 14:15:37 2025 -0400 cgroup/cpuset: Prevent NULL pointer access in free_tmpmasks() Commit 5806b3d05165 ("cpuset: decouple tmpmasks and cpumasks freeing in cgroup") separates out the freeing of tmpmasks into a new free_tmpmask() helper but removes the NULL pointer check in the process. Unfortunately a NULL pointer can be passed to free_tmpmasks() in cpuset_handle_hotplug() if cpuset v1 is active. This can cause segmentation fault and crash the kernel. Fix that by adding the NULL pointer check to free_tmpmasks(). Fixes: 5806b3d05165 ("cpuset: decouple tmpmasks and cpumasks freeing in cgroup") Reported-by: Ashay Jaiswal Closes: https://lore.kernel.org/lkml/20250902-cpuset-free-on-condition-v1-1-f46ffab53eac@quicinc.com/ Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 09be5b1c923082d473a9fc52d6113eb0d9c08b4d Merge: ce1a46b2d6a846 ce57b718006a06 Author: Mark Brown Date: Wed Sep 3 18:58:55 2025 +0100 ASoC: Intel: avs: Adjust platform names Merge series from Cezary Rojewski : This series is a direct follow up to the recent machine-board-registration changes [1]. Initially, a number of smaller patchsets were part of a bigger block of changes. My attempt to split them up to make the review easier was unfortunately not successful [2]. The goal of this series is the same one as with [1] - allow for multiple cards of the same type without workarounds or code duplications. With the machine-board names being unique - thanks to PLATFORM_DEVID_AUTO - platform component names shall be adjusted too so that no misbindings happen. In essence, majority of the changes can be summarized as: simplifying card and dai_link initialization. Actions: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage - for the probe-board mach-context is dropped entirely. The panic [2] is gone [1]: https://lore.kernel.org/linux-sound/20250827142229.869139-1-cezary.rojewski@intel.com/ [2]: https://lore.kernel.org/linux-sound/20250829225532.GA400117@ax162/ commit 396a788bca86ebef419471c73debdc46227972b5 Author: Jacek Kowalski Date: Wed Jul 23 10:55:37 2025 +0200 ixgbe: drop unnecessary casts to u16 / int Remove unnecessary casts of constant values to u16. C's integer promotion rules make them ints no matter what. Additionally drop cast from u16 to int in return statements. Signed-off-by: Jacek Kowalski Suggested-by: Simon Horman Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit d45dda4914e9f675c4af9c61f409cfabe160954d Author: Jacek Kowalski Date: Wed Jul 23 10:55:20 2025 +0200 igc: drop unnecessary constant casts to u16 Remove unnecessary casts of constant values to u16. C's integer promotion rules make them ints no matter what. Signed-off-by: Jacek Kowalski Suggested-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit b45d082d910bb069c3b878426b5a105296b16562 Author: Jacek Kowalski Date: Wed Jul 23 10:55:03 2025 +0200 igb: drop unnecessary constant casts to u16 Remove unnecessary casts of constant values to u16. C's integer promotion rules make them ints no matter what. Additionally replace IGB_MNG_VLAN_NONE with resulting value rather than casting -1 to u16. Signed-off-by: Jacek Kowalski Suggested-by: Simon Horman Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 7e93136459ddf8eaead66745751b1b0d1dda5202 Author: Jacek Kowalski Date: Wed Jul 23 10:54:35 2025 +0200 e1000e: drop unnecessary constant casts to u16 Remove unnecessary casts of constant values to u16. C's integer promotion rules make them ints no matter what. Additionally replace E1000_MNG_VLAN_NONE with resulting value rather than casting -1 to u16. Signed-off-by: Jacek Kowalski Suggested-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit fa8a9346f95a5af3d17717223783b743bf20d4a9 Author: Jacek Kowalski Date: Wed Jul 23 10:54:11 2025 +0200 e1000: drop unnecessary constant casts to u16 Remove unnecessary casts of constant values to u16. C's integer promotion rules make them ints no matter what. Additionally replace E1000_MNG_VLAN_NONE with resulting value rather than casting -1 to u16. Signed-off-by: Jacek Kowalski Suggested-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit d07176252a4312b8010339e6e1b042ac93788ce5 Author: Kohei Enju Date: Tue Aug 19 00:18:27 2025 +0900 igbvf: remove redundant counter rx_long_byte_count from ethtool statistics rx_long_byte_count shows the value of the GORC (Good Octets Received Count) register. However, the register value is already shown as rx_bytes and they always show the same value. Remove rx_long_byte_count as the Intel ethernet driver e1000e did in commit 0a939912cf9c ("e1000e: cleanup redundant statistics counter"). Tested on Intel Corporation I350 Gigabit Network Connection. Reviewed-by: Paul Menzel Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 86526aa57f3f24fbac3f9887af60848f6950e3f9 Author: Kohei Enju Date: Tue Aug 19 00:18:26 2025 +0900 igbvf: add lbtx_packets and lbtx_bytes to ethtool statistics Currently ethtool shows lbrx_packets and lbrx_bytes (Good RX Packets/Octets loopback Count), but doesn't show the TX-side equivalents (lbtx_packets and lbtx_bytes). Add visibility of those missing statistics by adding them to ethtool statistics. In addition, the order of lbrx_bytes and lbrx_packets is not consistent with non-loopback statistics (rx_packets, rx_bytes). Therefore, align the order by swapping positions of lbrx_bytes and lbrx_packets. Tested on Intel Corporation I350 Gigabit Network Connection. Before: # ethtool -S ens5 | grep -E "x_(bytes|packets)" rx_packets: 135 tx_packets: 106 rx_bytes: 16010 tx_bytes: 12451 lbrx_bytes: 1148 lbrx_packets: 12 After: # ethtool -S ens5 | grep -E "x_(bytes|packets)" rx_packets: 748 tx_packets: 304 rx_bytes: 81513 tx_bytes: 33698 lbrx_packets: 97 lbtx_packets: 109 lbrx_bytes: 12090 lbtx_bytes: 12401 Reviewed-by: Paul Menzel Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 08a1af326a80b88324acd73877db81ae927b1219 Author: Jedrzej Jagielski Date: Mon Aug 4 11:41:56 2025 +0200 ixgbe: reduce number of reads when getting OROM data Currently, during locating the CIVD section, the ixgbe driver loops over the OROM area and at each iteration reads only OROM-datastruct-size amount of data. This results in many small reads and is inefficient. Optimize this by reading the entire OROM bank into memory once before entering the loop. This significantly reduces the probing time. Without this patch probing time may exceed over 25s, whereas with this patch applied average time of probe is not greater than 5s. without the patch: [14:12:22] ixgbe: Copyright (c) 1999-2016 Intel Corporation. [14:12:25] ixgbe 0000:21:00.0: Multiqueue Enabled: Rx Queue count = 63, Tx Queue count = 63 XDP Queue count = 0 [14:12:25] ixgbe 0000:21:00.0: 63.012 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x4 link) [14:12:26] ixgbe 0000:21:00.0: MAC: 7, PHY: 27, PBA No: N55484-001 [14:12:26] ixgbe 0000:21:00.0: 20:3a:43:09:3a:12 [14:12:26] ixgbe 0000:21:00.0: Intel(R) 10 Gigabit Network Connection [14:12:50] ixgbe 0000:21:00.0 ens2f0np0: renamed from eth0 with the patch: [14:18:18] ixgbe: Copyright (c) 1999-2016 Intel Corporation. [14:18:19] ixgbe 0000:21:00.0: Multiqueue Enabled: Rx Queue count = 63, Tx Queue count = 63 XDP Queue count = 0 [14:18:19] ixgbe 0000:21:00.0: 63.012 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x4 link) [14:18:19] ixgbe 0000:21:00.0: MAC: 7, PHY: 27, PBA No: N55484-001 [14:18:19] ixgbe 0000:21:00.0: 20:3a:43:09:3a:12 [14:18:19] ixgbe 0000:21:00.0: Intel(R) 10 Gigabit Network Connection [14:18:22] ixgbe 0000:21:00.0 ens2f0np0: renamed from eth0 Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Signed-off-by: Jedrzej Jagielski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 8ee0c91097639520fe8bbd5c96ff36a546c24bdf Author: Piotr Kwapulinski Date: Fri Jul 4 15:06:24 2025 +0200 ixgbe: add the 2.5G and 5G speeds in auto-negotiation for E610 The auto-negotiation limitation for 2.5G and 5G speeds is no longer true for X550 successors like E610 adapter. Enable the 2.5G and 5G speeds in auto-negotiation for E610 at driver load. Reviewed-by: Przemek Kitszel Signed-off-by: Piotr Kwapulinski Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 62ba9a86eac78e21a13b71c36a006d8c99d87270 Author: Clément Le Goffic Date: Fri Jul 11 09:41:23 2025 +0200 ARM: dts: stm32: add Hardware debug port (HDP) on stm32mp15 Add the hdp devicetree node for stm32mp15 SoC family Keep the node disabled as HDP needs the pinctrl SoC configuration to be able to output its mux output signal outside of the SoC, on the SoC pad. This configuration is provided in the board dtsi file through 'pinctrl-*' properties as well as HDP mux configuration. Thus, if needed, HDP should be enabled in board dtsi file. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250711-hdp-upstream-v7-5-faeecf7aaee1@foss.st.com Signed-off-by: Alexandre Torgue commit b3646b905272e14d8bf9173e14b79d4d625cb84d Author: Clément Le Goffic Date: Fri Jul 11 09:41:22 2025 +0200 ARM: dts: stm32: add Hardware debug port (HDP) on stm32mp13 Add the hdp devicetree node for stm32mp13 SoC family. Keep the node disabled as HDP needs the pinctrl SoC configuration to be able to output its mux output signal outside of the SoC, on the SoC pad. This configuration is provided in the board dtsi file through 'pinctrl-*' properties as well as HDP mux configuration. Thus, if needed, HDP should be enabled in board dtsi file. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250711-hdp-upstream-v7-4-faeecf7aaee1@foss.st.com Signed-off-by: Alexandre Torgue commit 0d9673e19c37b2ff334811ee6b7bfc50f21bf95e Author: Antonio Borneo Date: Tue Jun 10 17:23:08 2025 +0200 ARM: dts: stm32: Add leds for CM4 on stm32mp15xx-ed1 and stm32mp15xx-dkx Add to the node m4_rproc the pinctrl property corresponding to the orange LED. The GPIO is reserved for the coprocessor Cortex-M4 and will be ignored by Linux. Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/r/20250610152309.299438-5-antonio.borneo@foss.st.com Signed-off-by: Alexandre Torgue commit fa36b8209ba600828646287ad14e527074b48247 Author: Antonio Borneo Date: Tue Jun 10 17:23:07 2025 +0200 ARM: dts: stm32: Add pinmux for CM4 leds pins The GPIO H7 on boards stm32mp15xx-dkx and the GPIO D8 on boards stm32mp15xx-ed1 are used by the coprocessor Cortex-M4. Linux running on Cortex-A should not use the GPIO and should left it available for the coprocessor. Add two pinmux groups, one for each families of boards, setting the GPIO function as Reserved (RSVD). Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/r/20250610152309.299438-4-antonio.borneo@foss.st.com Signed-off-by: Alexandre Torgue commit ce39a6aa8802e718f9b68bf6892612e4fd7f9d2d Author: Ard Biesheuvel Date: Thu Aug 28 12:22:25 2025 +0200 x86/boot: Get rid of the .head.text section The .head.text section is now empty, so it can be dropped from the linker script. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-46-ardb+git@google.com commit c5c30a37369313d1f8b84e96e6a4397b4e2b4eb8 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:24 2025 +0200 x86/boot: Move startup code out of __head section Move startup code out of the __head section, now that this no longer has a special significance. Move everything into .text or .init.text as appropriate, so that startup code is not kept around unnecessarily. [ bp: Fold in hunk to fix 32-bit CPU hotplug: Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509022207.56fd97f4-lkp@intel.com ] Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-45-ardb+git@google.com commit e7b88bc0051c5062bdd73b58837cf277d0057358 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:23 2025 +0200 efistub/x86: Remap inittext read-execute when needed Recent EFI x86 systems are more strict when it comes to mapping boot images, and require that mappings are either read-write or read-execute. Now that the boot code is being cleaned up and refactored, most of it is being moved into .init.text [where it arguably belongs] but that implies that when booting on such strict EFI firmware, we need to take care to map .init.text (and the .altinstr_aux section that follows it) read-execute as well. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-44-ardb+git@google.com commit 7b38dec3c5af54665a4b29483aa02bd1c1e71cf1 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:22 2025 +0200 x86/boot: Create a confined code area for startup code In order to be able to have tight control over which code may execute from the early 1:1 mapping of memory, but still link vmlinux as a single executable, prefix all symbol references in startup code with __pi_, and invoke it from outside using the __pi_ prefix. Use objtool to check that no absolute symbol references are present in the startup code, as these cannot be used from code running from the 1:1 mapping. Note that this also requires disabling the latent-entropy GCC plugin, as the global symbol references that it injects would require explicit exports, and given that the startup code rarely executes more than once, it is not a useful source of entropy anyway. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-43-ardb+git@google.com commit 749627c3980e4421b709857e979e8aa16a4c7147 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:21 2025 +0200 x86/kbuild: Incorporate boot/startup/ via Kbuild makefile Using core-y is not the correct way to get kbuild to descend into arch/x86/boot/startup. For instance, building an individual object does not work as expected when the pattern rule is local to the Makefile $ make arch/x86/boot/startup/map_kernel.pi.o GEN Makefile CALL /home/ardb/linux/scripts/checksyscalls.sh DESCEND objtool INSTALL libsubcmd_headers make[3]: *** No rule to make target 'arch/x86/boot/startup/map_kernel.pi.o'. Stop. make[2]: *** [/home/ardb/linux/scripts/Makefile.build:461: arch/x86] Error 2 make[1]: *** [/home/ardb/linux/Makefile:2011: .] Error 2 make: *** [/home/ardb/linux/Makefile:248: __sub-make] Error 2 So use obj-y from arch.x86/Kbuild instead, which makes things work as expected. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-42-ardb+git@google.com commit 2578560d2259735d7d51364e7991ea92d85fd56c Author: Ard Biesheuvel Date: Thu Aug 28 12:22:20 2025 +0200 x86/boot: Revert "Reject absolute references in .head.text" This reverts commit faf0ed487415 ("x86/boot: Reject absolute references in .head.text") The startup code is checked directly for the absence of absolute symbol references, so checking the .head.text section in the relocs tool is no longer needed. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-41-ardb+git@google.com commit 296650c8ac4f18e886dd2a606152c00adf527219 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:19 2025 +0200 x86/boot: Check startup code for absence of absolute relocations Invoke objtool on each startup code object individually to check for the absence of absolute relocations. This is needed because this code will be invoked from the 1:1 mapping of memory before those absolute virtual addresses (which are derived from the kernel virtual base address provided to the linker and possibly shifted at boot) are mapped. Only objects built under arch/x86/boot/startup/ have this restriction, and once they have been incorporated into vmlinux.o, this distinction is difficult to make. So force the invocation of objtool for each object file individually, even if objtool is deferred to vmlinux.o for the rest of the build. In the latter case, only pass --noabs and nothing else; otherwise, append it to the existing objtool command line. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-40-ardb+git@google.com commit 0d6e4563fc03d83f948e6a6f7963cc31a4c81914 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:18 2025 +0200 objtool: Add action to check for absence of absolute relocations The x86 startup code must not use absolute references to code or data, as it executes before the kernel virtual mapping is up. Add an action to objtool to check all allocatable sections (with the exception of __patchable_function_entries, which uses absolute references for nebulous reasons) and raise an error if any absolute references are found. Note that debug sections typically contain lots of absolute references too, but those are not allocatable so they will be ignored. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/20250828102202.1849035-39-ardb+git@google.com commit 05ce314ba5155d57c86f8f276cb17f78ac5fb4f0 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:17 2025 +0200 x86/sev: Export startup routines for later use Create aliases that expose routines that are part of the startup code to other code in the core kernel, so that they can be called later as well. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-38-ardb+git@google.com commit d4077e6ad35121b97f3233da5d60763de3d23df9 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:16 2025 +0200 x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object Rename sev-nmi.c to noinstr.c, and move the get/put GHCB routines into it too, which are also annotated as 'noinstr' and suffer from the same problem as the NMI code, i.e., that GCC may ignore the __no_sanitize_address__ function attribute implied by 'noinstr' and insert KASAN instrumentation anyway. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-37-ardb+git@google.com commit 9723dd0c705eb626bac2cd06b83a2c8514ed697a Author: Ard Biesheuvel Date: Thu Aug 28 12:22:15 2025 +0200 x86/sev: Provide PIC aliases for SEV related data objects Provide PIC aliases for data objects that are shared between the SEV startup code and the SEV code that executes later. This is needed so that the confined startup code is permitted to access them. This requires some of these variables to be moved into a source file that is not part of the startup code, as the PIC alias is already implied, and exporting variables in the opposite direction is not supported. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-36-ardb+git@google.com commit f27906b287403af53be26341cf86d73798f15fe8 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:14 2025 +0200 x86/boot: Provide PIC aliases for 5-level paging related constants Provide PIC aliases for the global variables related to 5-level paging, so that the startup code can access them in order to populate the kernel page tables. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-35-ardb+git@google.com commit 68a501d7fd82454525797971c6a0005ceeb93153 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:13 2025 +0200 x86/boot: Drop redundant RMPADJUST in SEV SVSM presence check snp_vmpl will be assigned a non-zero value when executing at a VMPL other than 0, and this is inferred from a call to RMPADJUST, which only works when running at VMPL0. This means that testing snp_vmpl is sufficient, and there is no need to perform the same check again. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-34-ardb+git@google.com commit c54604fb7f2522fec5b97e86103ec49e539e80fe Author: Ard Biesheuvel Date: Thu Aug 28 12:22:12 2025 +0200 x86/sev: Use boot SVSM CA for all startup and init code To avoid having to reason about whether or not to use the per-CPU SVSM calling area when running startup and init code on the boot CPU, reuse the boot SVSM calling area as the per-CPU area for the BSP. Thus, remove the need to make the per-CPU variables and associated state in sev_cfg accessible to the startup code once confined. [ bp: Massage commit message. ] Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-33-ardb+git@google.com commit 00d25566761746ba53934ad3a89ea79923a38d01 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:11 2025 +0200 x86/sev: Pass SVSM calling area down to early page state change API The early page state change API is mostly only used very early, when only the boot time SVSM calling area is in use. However, this API is also called by the kexec finishing code, which runs very late, and potentially from a different CPU (which uses a different calling area). To avoid pulling the per-CPU SVSM calling area pointers and related SEV state into the startup code, refactor the page state change API so the SVSM calling area virtual and physical addresses can be provided by the caller. No functional change intended. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-32-ardb+git@google.com commit d5949ea50c5642ab7e3c4dd6020e23725c079b25 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:10 2025 +0200 x86/sev: Share implementation of MSR-based page state change Both the decompressor and the SEV startup code implement the exact same sequence for invoking the MSR based communication protocol to effectuate a page state change. Before tweaking the internal APIs used in both versions, merge them and share them so those tweaks are only needed in a single place. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-31-ardb+git@google.com commit a5f03880f06a6da6ea5f1d966fffffcb3fc65462 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:09 2025 +0200 x86/sev: Avoid global variable to store virtual address of SVSM area The boottime SVSM calling area is used both by the startup code running from a 1:1 mapping, and potentially later on running from the ordinary kernel mapping. This SVSM calling area is statically allocated, and so its physical address doesn't change. However, its virtual address depends on the calling context (1:1 mapping or kernel virtual mapping), and even though the variable that holds the virtual address of this calling area gets updated from 1:1 address to kernel address during the boot, it is hard to reason about why this is guaranteed to be safe. So instead, take the RIP-relative address of the boottime SVSM calling area whenever its virtual address is required, and only use a global variable for the physical address. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250828102202.1849035-30-ardb+git@google.com commit 37dbd78f98a80e89b5413f4649d0fbd023d99b2f Author: Ard Biesheuvel Date: Thu Aug 28 12:22:08 2025 +0200 x86/sev: Move GHCB page based HV communication out of startup code Both the decompressor and the core kernel implement an early #VC handler, which only deals with CPUID instructions, and full featured one, which can handle any #VC exception. The former communicates with the hypervisor using the MSR based protocol, whereas the latter uses a shared GHCB page, which is configured a bit later during the boot, when the kernel runs from its ordinary virtual mapping, rather than the 1:1 mapping that the startup code uses. Accessing this shared GHCB page from the core kernel's startup code is problematic, because it involves converting the GHCB address provided by the caller to a physical address. In the startup code, virtual to physical address translations are problematic, given that the virtual address might be a 1:1 mapped address, and such translations should therefore be avoided. This means that exposing startup code dealing with the GHCB to callers that execute from the ordinary kernel virtual mapping should be avoided too. So move all GHCB page based communication out of the startup code, now that all communication occurring before the kernel virtual mapping is up relies on the MSR protocol only. As an exception, add a flag representing the need to apply the coherency fix in order to avoid exporting CPUID* helpers because of the code running too early for the *cpu_has* infrastructure. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828102202.1849035-29-ardb+git@google.com commit 9105df0185ea3a89e6651985e829897a8d3a94ae Author: Ian Rogers Date: Mon Aug 18 18:39:41 2025 -0700 perf tp_pmu: Remove unnecessary check The "if" condition is also part of the "while" condition, remove the "if" to reduce the amount of code. Reported-by: Howard Chu Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-12-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a3f4104daa9f4399c295f1269d54491baf60f9be Author: Ian Rogers Date: Mon Aug 18 18:39:40 2025 -0700 perf ilist: Add support for metrics Change tree nodes to having a value of either Metric or PmuEvent, these values have the ability to match searches, be parsed to create evlists and to give a value per CPU and per thread to display. Use perf.metrics to generate a tree of metrics. Most metrics are placed under their metric group, if the metric group name ends with '_group' then the metric group is placed next to the associated metric. Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-11-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 47b3e95728eb4104adca3d4a0ec018fcaa738b82 Author: Ian Rogers Date: Mon Aug 18 18:39:39 2025 -0700 perf python: Add metrics function The metrics function returns a list dictionaries describing metrics as strings mapping to strings, except for metric groups that are a string mapping to a list of strings. For example: ``` >>> import perf >>> perf.metrics()[0] {'MetricGroup': ['Power'], 'MetricName': 'C10_Pkg_Residency', 'PMU': 'default_core', 'MetricExpr': 'cstate_pkg@c10\\-residency@ / TSC', 'ScaleUnit': '100%', 'BriefDescription': 'C10 residency percent per package'} ``` Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-10-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 064647d61c28ab16d3f6a98e30685694198551ac Author: Ian Rogers Date: Mon Aug 18 18:39:38 2025 -0700 perf python: Add evlist compute_metric Add a compute_metric function that computes a metric double value for a given evlist, metric name, CPU and thread. For example: ``` >>> import perf >>> x = perf.parse_metrics("TopdownL1") >>> x.open() >>> x.enable() >>> x.disable() >>> x.metrics() ['tma_bad_speculation', 'tma_frontend_bound', 'tma_backend_bound', 'tma_retiring'] >>> x.compute_metric('tma_bad_speculation', 0, -1) 0.08605342847131037 ``` Committer notes: Initialize thread_idx and cpu_idx to zero as albeit them not possibly coming out unitialized from the loop as mexp would be not NULL only if they were initialized, some older compilers don't notice that and error with: GEN /tmp/build/perf/python/perf.cpython-36m-x86_64-linux-gnu.so /git/perf-6.17.0-rc3/tools/perf/util/python.c: In function ‘pyrf_evlist__compute_metric’: /git/perf-6.17.0-rc3/tools/perf/util/python.c:1363:3: error: ‘thread_idx’ may be used uninitialized in this function [-Werror=maybe-uninitialized] evsel__read_counter(metric_events[i], cpu_idx, thread_idx); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /git/perf-6.17.0-rc3/tools/perf/util/python.c:1389:41: note: ‘thread_idx’ was declared here int ret, cpu = 0, cpu_idx, thread = 0, thread_idx; ^~~~~~~~~~ /git/perf-6.17.0-rc3/tools/perf/util/python.c:1363:3: error: ‘cpu_idx’ may be used uninitialized in this function [-Werror=maybe-uninitialized] evsel__read_counter(metric_events[i], cpu_idx, thread_idx); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /git/perf-6.17.0-rc3/tools/perf/util/python.c:1389:20: note: ‘cpu_idx’ was declared here int ret, cpu = 0, cpu_idx, thread = 0, thread_idx; ^~~~~~~ /git/perf-6.17.0-rc3/tools/perf/util/python.c: At top level: cc1: error: unrecognized command line option ‘-Wno-cast-function-type’ [-Werror] cc1: all warnings being treated as errors error: command 'gcc' failed with exit status 1 cp: cannot stat '/tmp/build/perf/python_ext_build/lib/perf*.so': No such file or directory Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5ffa0246db5adb7839f9506c83554efd069c9142 Author: Ian Rogers Date: Mon Aug 18 18:39:37 2025 -0700 perf python: Add evlist metrics function The function returns a list of the names of metrics within the evlist. For example: ``` >>> import perf >>> perf.parse_metrics("TopdownL1").metrics() ['tma_bad_speculation', 'tma_frontend_bound', 'tma_backend_bound', 'tma_retiring'] ``` Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d0550be70f7ab84dfeff0db163a6bb924f70e2cb Author: Ian Rogers Date: Mon Aug 18 18:39:36 2025 -0700 perf python: Add parse_metrics function Add parse_metrics function that takes a string of metrics and/or metric groups and returns the evlist containing the events and metrics. For example: ``` >>> import perf >>> perf.parse_metrics("TopdownL1") evlist([cpu/TOPDOWN.SLOTS/,cpu/topdown-retiring/,cpu/topdown-fe-bound/, cpu/topdown-be-bound/,cpu/topdown-bad-spec/,cpu/INT_MISC.CLEARS_COUNT/, cpu/INT_MISC.UOP_DROPPING/]) ``` Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 83e5b8f9bf2edfa1aac0d09d994792da594fec56 Author: Ian Rogers Date: Mon Aug 18 18:39:35 2025 -0700 perf ilist: Add new python ilist command The perf ilist command is a textual app [1] similar to perf list. In the top-left pane a tree of PMUs is displayed. Selecting a PMU expands the events within it. Selecting an event displays the `perf list` style event information in the top-right pane. When an event is selected it is opened and the counters on each CPU the event is for are periodically read. The bottom of the screen contains a scrollable set of sparklines showing the events in total and on each CPU. Scrolling below the sparklines shows the same data as raw counts. The sparklines are small graphs where the height of the bar is in relation to maximum of the other counts in the graph. By default the counts are read with an interval of 0.1 seconds (10 times per second). A -I/--interval command line option allows the interval to be changed. The oldest read counts are dropped when the counts fill the line causing the sparkline to move from right to left. A search box can be pulled up with the 's' key. 'n' and 'p' iterate through the search results. As some PMUs have hundreds of events a 'c' key will collapse the events in the current PMU to make navigating the PMUs easier. [1] https://textual.textualize.io/ Committer testing: This needs a bit more polishing, to test it I had to go thru some hops: $ python ilist python: can't open file '/home/acme/git/perf-tools-next/ilist': [Errno 2] No such file or directory $ $ python tools/perf/python/ilist.py Traceback (most recent call last): File "/home/acme/git/perf-tools-next/tools/perf/python/ilist.py", line 8, in from textual import on ModuleNotFoundError: No module named 'textual' $ $ sudo dnf install textual Updating and loading repositories: Repositories loaded. Failed to resolve the transaction: No match for argument: textual You can try to add to command line: --skip-unavailable to skip unavailable packages $ After some searching I installed the 'python3-textual' and it starts, allowing traversing the various pmus and events, see descriptions on the upper right side and a view of the events on the lower half of the screen. Interesting for quickly iterating thru the available events. Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2f20df570e39ccedbf7374a46ae3893705e88d36 Author: Ian Rogers Date: Mon Aug 18 18:39:34 2025 -0700 perf python: Add function returning dictionary of all events on a PMU Allow all events on a PMU to be gathered, similar to how perf list gathers event information. An example usage: ``` $ python Python 3.12.9 (main, Feb 5 2025, 01:31:18) [GCC 14.2.0] on linux >>> import perf >>> for pmu in perf.pmus(): ... print(pmu.events()) ... [{'name': 'mem_load_retired.l3_hit', 'desc': 'Retired load instructions... ``` Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7f1f71a164ade85939dbe6022c5d305e1b1b56fd Author: Ian Rogers Date: Mon Aug 18 18:39:33 2025 -0700 perf python: Add basic PMU abstraction and pmus sequence Add an ability to iterate over PMUs and a basic PMU type then can just show the PMU's name. An example usage: ``` $ python Python 3.12.9 (main, Feb 5 2025, 01:31:18) [GCC 14.2.0] on linux >>> import perf >>> list(perf.pmus()) [pmu(cpu), pmu(breakpoint), pmu(cstate_core), pmu(cstate_pkg), pmu(hwmon_acpitz), pmu(hwmon_ac), pmu(hwmon_bat0), pmu(hwmon_coretemp), pmu(hwmon_iwlwifi_1), pmu(hwmon_nvme), pmu(hwmon_thinkpad), pmu(hwmon_ucsi_source_psy_usbc000_0), pmu(hwmon_ucsi_source_psy_usbc000_0), pmu(i915), pmu(intel_bts), pmu(intel_pt), pmu(kprobe), pmu(msr), pmu(power), pmu(software), pmu(tool), pmu(tracepoint), pmu(uncore_arb), pmu(uncore_cbox_0), pmu(uncore_cbox_1), pmu(uncore_cbox_2), pmu(uncore_cbox_3), pmu(uncore_cbox_4), pmu(uncore_cbox_5), pmu(uncore_cbox_6), pmu(uncore_cbox_7), pmu(uncore_clock), pmu(uncore_imc_free_running_0), pmu(uncore_imc_free_running_1), pmu(uprobe)] ``` Committer testing: One has to set PYTHONPATH to the build directory beforehand: $ export PYTHONPATH=/tmp/build/perf-tools-next/python/ $ python Python 3.13.7 (main, Aug 14 2025, 00:00:00) [GCC 15.2.1 20250808 (Red Hat 15.2.1-1)] on linux >>> import perf >>> list(perf.pmus()) [pmu(cpu), pmu(amd_df), pmu(amd_iommu_0), pmu(amd_l3), pmu(amd_umc_0), pmu(breakpoint), pmu(hwmon_amdgpu), pmu(hwmon_amdgpu), pmu(hwmon_k10temp), pmu(hwmon_nvme), pmu(hwmon_r8169_0_e00_00), pmu(ibs_fetch), pmu(ibs_op), pmu(kprobe), pmu(msr), pmu(power), pmu(power_core), pmu(software), pmu(tool), pmu(tracepoint), pmu(uprobe)] >>> Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6bdf8a5669d00bdd6ab97cb184e7178615b68df8 Author: Ian Rogers Date: Mon Aug 18 18:39:32 2025 -0700 perf python: Improve the tracepoint function if no libtraceevent The tracepoint function just returns the tracepoint id, this doesn't require libtraceevent which is only used for parsing the event format data. Implement the function using the id function in tp_pmu. No current code in perf is using this, the previous code migrated to perf.parse_events, but it feels good to have less ifdef HAVE_LIBTRACEEVENT. Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit c3befab83441afdc631524f4c507bb713aa44bd7 Author: Ian Rogers Date: Mon Aug 18 18:39:31 2025 -0700 perf python: Add more exceptions on error paths Returning NULL will cause the python interpreter to fail but not report an error. If none wants to be returned then Py_None needs returning. Set the error for the cases returning NULL so that more meaningful interpreter behavior is had. Reviewed-by: Howard Chu Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Chun-Tse Shao Cc: Collin Funk Cc: Dr. David Alan Gilbert Cc: Gautam Menghani Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xu Yang Link: https://lore.kernel.org/r/20250819013941.209033-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b39c915a4f365cce6bdc0e538ed95d31823aea8f Author: Ian Rogers Date: Thu Aug 21 09:38:19 2025 -0700 libperf event: Ensure tracing data is multiple of 8 sized Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event. Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized. Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file") Reviewed-by: James Clark Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Collin Funk Cc: Howard Chu Cc: Ingo Molnar Cc: Jan Polensky Cc: Jiri Olsa Cc: Kan Liang Cc: Li Huafei Cc: Mark Rutland Cc: Nam Cao Cc: Peter Zijlstra Cc: Steinar H. Gunderson Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8b93f8933d37591d17c59fd71b18fc61966d9515 Author: Ian Rogers Date: Thu Aug 21 09:38:18 2025 -0700 perf test shell lock_contention: Extra debug diagnostics In test_record_concurrent, as stderr is sent to /dev/null, error messages are hidden. Change this to gather the error messages and dump them on failure. Some minor sh->bash changes to add some more diagnostics in trap_cleanup. Reviewed-by: James Clark Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Collin Funk Cc: Howard Chu Cc: Ingo Molnar Cc: Jan Polensky Cc: Jiri Olsa Cc: Kan Liang Cc: Li Huafei Cc: Mark Rutland Cc: Nam Cao Cc: Peter Zijlstra Cc: Steinar H. Gunderson Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250821163820.1132977-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2354479026d726954ff86ce82f4b649637319661 Author: Ian Rogers Date: Thu Aug 21 09:38:17 2025 -0700 perf evsel: Avoid container_of on a NULL leader An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer. Avoid this with an explicit NULL test. Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader") Reviewed-by: James Clark Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Collin Funk Cc: Howard Chu Cc: Ingo Molnar Cc: Jan Polensky Cc: Jiri Olsa Cc: Kan Liang Cc: Li Huafei Cc: Mark Rutland Cc: Nam Cao Cc: Peter Zijlstra Cc: Steinar H. Gunderson Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 Author: Ian Rogers Date: Thu Aug 21 09:38:16 2025 -0700 perf test trace_btf_enum: Skip if permissions are insufficient Modify test behavior to skip if BPF calls fail with "Operation not permitted". Fixes: d66763fed30f0bd8 ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'") Reviewed-by: James Clark Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Collin Funk Cc: Howard Chu Cc: Ingo Molnar Cc: Jan Polensky Cc: Jiri Olsa Cc: Kan Liang Cc: Li Huafei Cc: Mark Rutland Cc: Nam Cao Cc: Peter Zijlstra Cc: Steinar H. Gunderson Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250821163820.1132977-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 Author: Ian Rogers Date: Thu Aug 21 09:38:15 2025 -0700 perf disasm: Avoid undefined behavior in incrementing NULL Incrementing NULL is undefined behavior and triggers ubsan during the perf annotate test. Split a compound statement over two lines to avoid this. Fixes: 98f69a573c668a18 ("perf annotate: Split out util/disasm.c") Reviewed-by: Collin Funk Reviewed-by: James Clark Reviewed-by: Kuan-Wei Chiu Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Howard Chu Cc: Ingo Molnar Cc: Jan Polensky Cc: Jiri Olsa Cc: Kan Liang Cc: Li Huafei Cc: Mark Rutland Cc: Nam Cao Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Steinar H. Gunderson Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20250821163820.1132977-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a3ae3384be7704fcf41279f13190bd8a11204bea Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:41 2025 +0200 drm: panel-backlight-quirks: Log applied panel brightness quirks Currently, when a panel brightness quirk is applied, there is no log indicating that a quirk was applied. Unwrap the drm device on its own and use drm_info() to log when a quirk is applied. Suggested-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-7-lkml@antheas.dev Acked-by: Alex Deucher Reviewed-by: Mario Limonciello (Correct a missing -1 in the message math) Signed-off-by: Mario Limonciello (AMD) commit bf0365b005d9a486d2ddf0c8ec0a578d0f3aabed Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:40 2025 +0200 drm: panel-backlight-quirks: Add Steam Deck brightness quirk On the SteamOS kernel, Valve universally makes minimum brightness 0 for all devices. SteamOS is (was?) meant for the Steam Deck, so enabling it universally is reasonable. However, it causes issues in certain devices. Therefore, introduce it just for the Steam Deck here. SteamOS kernel does not have a public mirror, but this replaces commit 806dd74bb225 ("amd/drm: override backlight min value from 12 -> 0") in the latest, as of this writing, SteamOS kernel (6.11.11-valve24). See unofficial mirror reconstructed from sources below. Link: https://gitlab.com/evlaV/linux-integration/-/commit/806dd74bb225 Reviewed-by: Robert Beckett Reviewed-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-6-lkml@antheas.dev Signed-off-by: Mario Limonciello (AMD) commit aef10b1138e995ba9aa4357ed78cd05686cabbe1 Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:39 2025 +0200 drm: panel-backlight-quirks: Add brightness mask quirk Certain OLED devices malfunction on specific brightness levels. Specifically, when DP_SOURCE_BACKLIGHT_LEVEL is written to with the first byte being 0x00 and sometimes 0x01, the panel forcibly turns off until the device sleeps again. Below are some examples. This was found by iterating over brighness ranges while printing DP_SOURCE_BACKLIGHT_LEVEL. It was found that the screen would malfunction on specific values, and some of them were collected. Therefore, introduce a quirk where the minor byte of brightness is OR'd with 0x03 to avoid the range of invalid values. This quirk was tested by removing the workarounds and iterating from 0 to 50_000 value ranges with a cadence of 0.2s/it. The range of the panel is 1000...400_000, so the values were slightly interpolated during testing. The custom brightness curve added on 6.15 was disabled. 86016: 10101000000000000 86272: 10101000100000000 87808: 10101011100000000 251648: 111101011100000000 251649: 111101011100000001 86144: 10101000010000000 87809: 10101011100000001 251650: 111101011100000010 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3803 Tested-by: Philip Müller Reviewed-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-5-lkml@antheas.dev Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) commit f7033fab81d82e9a56092bb412886df1d2591ae6 Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:38 2025 +0200 drm: panel-backlight-quirks: Add secondary DMI match Using a single DMI match only allows matching per manufacturer. Introduce a second optional match to allow matching make/model. In addition, make DMI optional to allow matching only by EDID. Tested-by: Philip Müller Reviewed-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-4-lkml@antheas.dev Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) commit 6eee1ef9e59853a49e926d116a004c53a9819dfd Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:37 2025 +0200 drm: panel-backlight-quirks: Convert brightness quirk to generic structure Currently, the brightness quirk is limited to minimum brightness only. Refactor it to a structure, so that more quirks can be added in the future. Reserve 0 value for "no quirk", and use u16 to allow minimum brightness up to 255. Tested-by: Philip Müller Reviewed-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-3-lkml@antheas.dev Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) commit 9931e4be11f2129a20ffd908bc364598a63016f8 Author: Antheas Kapenekakis Date: Fri Aug 29 16:55:36 2025 +0200 drm: panel-backlight-quirks: Make EDID match optional Currently, having a valid panel_id match is required to use the quirk system. For certain devices, we know that all SKUs need a certain quirk. Therefore, allow not specifying ident by only checking for a match if panel_id is non-zero. Tested-by: Philip Müller Reviewed-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250829145541.512671-2-lkml@antheas.dev Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) commit 8ad25ebfa70e86860559b306bbc923c7db4fcac6 Author: Brian Norris Date: Fri Aug 22 11:59:07 2025 -0700 genirq/test: Ensure CPU 1 is online for hotplug test It's possible to run these tests on platforms that think they have a hotpluggable CPU1, but for whatever reason, CPU1 is not online and can't be brought online: # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:210 Expected remove_cpu(1) == 0, but remove_cpu(1) == 1 (0x1) CPU1: failed to boot: -38 # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:214 Expected add_cpu(1) == 0, but add_cpu(1) == -38 (0xffffffffffffffda) Check that CPU1 is actually online before trying to run the test. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Reported-by: Guenter Roeck Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-7-briannorris@chromium.org commit add03fdb9d52411cabb3872fb7692df6f4c67586 Author: Brian Norris Date: Fri Aug 22 11:59:06 2025 -0700 genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions Not all platforms use the generic IRQ migration code, even if they select GENERIC_IRQ_MIGRATION. (See, for example, powerpc / pseries_cpu_disable().) If such platforms don't perform managed shutdown the same way, the interrupt may not actually shut down, and these tests fail: [ 4.357022][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:211 [ 4.357022][ T101] Expected irqd_is_activated(data) to be false, but is true [ 4.358128][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:212 [ 4.358128][ T101] Expected irqd_is_started(data) to be false, but is true [ 4.375558][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:216 [ 4.375558][ T101] Expected irqd_is_activated(data) to be false, but is true [ 4.376088][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:217 [ 4.376088][ T101] Expected irqd_is_started(data) to be false, but is true [ 4.377851][ T1] # irq_cpuhotplug_test: pass:0 fail:1 skip:0 total:1 [ 4.377901][ T1] not ok 4 irq_cpuhotplug_test [ 4.378073][ T1] # irq_test_cases: pass:3 fail:1 skip:0 total:4 Rather than test that PowerPC performs migration the same way as the unterrupt core, just drop the state checks. The point of the test was to ensure that the code kept |depth| balanced, which still can be tested for. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Reported-by: Guenter Roeck Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-6-briannorris@chromium.org commit 0c888bc86d672e551ce5c58b891c8b44f8967643 Author: Brian Norris Date: Fri Aug 22 11:59:05 2025 -0700 genirq/test: Depend on SPARSE_IRQ Some architectures have a static interrupt layout, with a limited number of interrupts. Without SPARSE_IRQ, the test may not be able to allocate any fake interrupts, and the test will fail. (This occurs on ARCH=m68k, for example.) Additionally, managed-affinity is only supported with CONFIG_SPARSE_IRQ=y, so irq_shutdown_depth_test() and irq_cpuhotplug_test() would fail without it. Add a 'SPARSE_IRQ' dependency to avoid these problems. Many architectures 'select SPARSE_IRQ', so this is easy to miss. Notably, this also excludes ARCH=um from running any of these tests, even though some of them might work. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Reported-by: Guenter Roeck Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-5-briannorris@chromium.org commit 988f45467f13c038f73a91f5154b66f278f495d4 Author: Brian Norris Date: Fri Aug 22 11:59:04 2025 -0700 genirq/test: Fail early if interrupt request fails Requesting an interrupt is part of the basic test setup. If it fails, most of the subsequent tests are likely to fail, and the output gets noisy. Use "assert" to fail early. Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-4-briannorris@chromium.org commit 59405c248acea65d534497bbe29f34858b0fdd3c Author: Brian Norris Date: Fri Aug 22 11:59:03 2025 -0700 genirq/test: Factor out fake-virq setup A few things need to be repeated in tests. Factor out the creation of fake interrupts. Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-3-briannorris@chromium.org commit f8a44f9babd054ff19e20a30cab661d716ad5459 Author: Brian Norris Date: Fri Aug 22 11:59:02 2025 -0700 genirq/test: Select IRQ_DOMAIN These tests use irq_domain_alloc_descs() and so require CONFIG_IRQ_DOMAIN. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Reported-by: Guenter Roeck Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: David Gow Link: https://lore.kernel.org/all/20250822190140.2154646-2-briannorris@chromium.org Closes: https://lore.kernel.org/lkml/ded44edf-eeb7-420c-b8a8-d6543b955e6e@roeck-us.net/ commit c9163915a93d40e32c4e4aeb942c0adcb190d72e Author: David Gow Date: Sat Aug 16 17:45:28 2025 +0800 genirq/test: Fix depth tests on architectures with NOREQUEST by default. The new irq KUnit tests fail on some architectures (notably PowerPC and 32-bit ARM), as the request_irq() call fails due to the ARCH_IRQ_INIT_FLAGS containing IRQ_NOREQUEST, yielding the following errors: [10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:88 [10:17:45] Expected ret == 0, but [10:17:45] ret == -22 (0xffffffffffffffea) [10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:90 [10:17:45] Expected desc->depth == 0, but [10:17:45] desc->depth == 1 (0x1) [10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:93 [10:17:45] Expected desc->depth == 1, but [10:17:45] desc->depth == 2 (0x2) By clearing IRQ_NOREQUEST from the interrupt descriptor, these tests now pass on ARM and PowerPC. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Signed-off-by: David Gow Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Tested-by: Brian Norris Reviewed-by: Brian Norris Link: https://lore.kernel.org/all/20250816094528.3560222-2-davidgow@google.com commit 2292c8061c783e6900fcedcee388f69deab765ef Author: Qiuxu Zhuo Date: Wed Sep 3 11:06:48 2025 +0800 EDAC/skx_common: Use topology_physical_package_id() instead of open coding Use topology_physical_package_id() to get the CPU package ID instead of open coding. Suggested-by: Zhang Rui Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250903030648.3285935-1-qiuxu.zhuo@intel.com commit 9a12e2fb3f517d5bd72efa565a8e591e6fff311c Author: Johannes Kirchmair Date: Wed Jan 29 14:51:20 2025 +0100 Input: tsc2007 - prevent overflow in pressure calculation The touch resistance calculation in the tsc2007 driver is prone to overflow if (z2 - z1) is large and also x is reasonably big. This overflow results in the driver emitting input events when very little touch pressure is applied. In these events the x and y coordinates can be substantially off. Avoid the overflow by using u64 when calculating resistance value. Signed-off-by: Johannes Kirchmair Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com Signed-off-by: Dmitry Torokhov commit 673f1244b3d47c9b41cda3473c062bec586387be Author: Wladislav Wiebe Date: Mon Aug 4 11:35:25 2025 +0200 genirq: Add support for warning on long-running interrupt handlers Introduce a mechanism to detect and warn about prolonged interrupt handlers. With a new command-line parameter (irqhandler.duration_warn_us=), users can configure the duration threshold in microseconds when a warning in such format should be emitted: "[CPU14] long duration of IRQ[159:bad_irq_handler [long_irq]], took: 1330 us" The implementation uses local_clock() to measure the execution duration of the generic IRQ per-CPU event handler. Signed-off-by: Wladislav Wiebe Signed-off-by: Thomas Gleixner Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/all/20250804093525.851-1-wladislav.wiebe@nokia.com commit 93674298bede84898742f4f8836666a2bfd0ece4 Author: Masaharu Noguchi Date: Tue Sep 2 00:48:12 2025 +0900 Documentation: fix typo 'Andorid' -> 'Android' in goldfish pipe binding This patch fixes a small typo in the goldfish pipe binding documentation: 'Andorid' -> 'Android'. Signed-off-by: Masaharu Noguchi Link: https://lore.kernel.org/r/20250901154812.570319-1-nogunix@gmail.com Signed-off-by: Rob Herring (Arm) commit 8e322143c30483a646f6e09434ebf0e33b315a4f Author: Krzysztof Kozlowski Date: Sat Aug 30 13:32:39 2025 +0200 dt-bindings: display: samsung: Drop S3C2410 Samsung S3C24xx family of SoCs was removed from Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250830113238.131006-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 0f356eb097c314710060dde9c4fae4fd516bc63a Author: Rob Herring (Arm) Date: Thu Aug 21 13:06:40 2025 -0500 dt-bindings: arm: Add Cortex-A320/A520AE/A720AE cores and PMU Add the recently introduced Cortex-A320/A520AE/A720AE core and PMU compatible strings. Link: https://lore.kernel.org/all/20250821190722.417639-1-robh@kernel.org/ Signed-off-by: Rob Herring (Arm) commit 8b57a0aeccb1d31b82210384b1f2a3226145635f Author: Frank Li Date: Wed Aug 27 17:09:11 2025 -0400 dt-bindings: arm: cpus: Allow fsl,soc-operating-points for i.MX6 The old i.MX6 (over 10 years) chip use fsl,soc-operating-points to get SoC's voltage and frequency information when cpu change frequency. Set fsl,soc-operating-points deprecated. Allow soc-supply property and set it deprecated. Fix bunch of CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6ul-prti6g.dtb: cpu@0 (arm,cortex-a7): Unevaluated properties are not allowed ('fsl,soc-operating-points', 'soc-supply' were unexpected) from schema $id: http://devicetree.org/schemas/arm/cpus.yaml# Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250827210912.92029-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit f0aed6ffb3548a03dab9e608b2bd8ce07af4be9f Author: Harikrishna Shenoy Date: Wed Aug 27 16:55:39 2025 +0530 dt-bindings: display: dsi-controller: add bridge to patternProperties Extend the DSI controller schema to allow bridge child nodes. This makes it possible to describe external bridge devices directly connected as DSI peripherals. Signed-off-by: Harikrishna Shenoy Link: https://lore.kernel.org/r/20250827112539.4001513-1-h-shenoy@ti.com Signed-off-by: Rob Herring (Arm) commit 8a72549c5b276849def80057a4b4789dbdb87ea6 Author: Krzysztof Kozlowski Date: Sat Aug 23 18:32:59 2025 +0200 dt-bindings: interrupt-controller: marvell,cp110-icu: Document address-cells The CP110 ICU children are interrupt controllers and can be referenced in interrupt-map properties (e.g. in arch/arm64/boot/dts/marvell/armada-cp11x.dtsi), thus the nodes should have address-cells property. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250823163258.49648-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 4ed46073274a5b23baf0b992c459762e28faf549 Author: Rob Herring (Arm) Date: Thu Aug 21 17:21:33 2025 -0500 dt-bindings: vendor-prefixes: Add undocumented vendor prefixes Add various vendor prefixes which are in use in compatible strings already. These were found by modifying vendor-prefixes.yaml into a schema to check compatible strings. The added prefixes doesn't include various duplicate prefixes in use such as "lge". Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit a576a849d5f33356e0d8fd3eae4fbaf8869417e5 Author: Lorenzo Pieralisi Date: Tue Aug 5 15:34:43 2025 +0200 of/irq: Convert of_msi_map_id() callers to of_msi_xlate() With the introduction of the of_msi_xlate() function, the OF layer provides an API to map a device ID and retrieve the MSI controller node the ID is mapped to with a single call. of_msi_map_id() is currently used to map a deviceID to a specific MSI controller node; of_msi_xlate() can be used for that purpose too, there is no need to keep the two functions. Convert of_msi_map_id() to of_msi_xlate() calls and update the of_msi_xlate() documentation to describe how the struct device_node pointer passed in should be set-up to either provide the MSI controller node target or receive its pointer upon mapping completion. Signed-off-by: Lorenzo Pieralisi Cc: Thomas Gleixner Cc: Rob Herring Cc: Marc Zyngier Acked-by: Thomas Gleixner Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250805133443.936955-1-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit 0e44780b423afed8c35005b31536a7bb3c52f70f Author: Krzysztof Kozlowski Date: Wed Aug 20 16:17:38 2025 +0200 dt-bindings: display: rockchip,dw-mipi-dsi: Narrow clocks for rockchip,rk3288-mipi-dsi The binding allows in top-level from one to four clocks and each variant narrows the choice, but rockchip,rk3288-mipi-dsi missed the minItems. Reviewed-by: Heiko Stuebner Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250820-dt-bindings-display-v2-3-91e2ccba3d4e@linaro.org Signed-off-by: Rob Herring (Arm) commit 0387040b31aa6606cd9ef726ce4b11c5fa6079db Author: Krzysztof Kozlowski Date: Wed Aug 20 16:17:37 2025 +0200 dt-bindings: display: ti,tdp158: Add missing reg constraint Device can be used over I2C bus, so it documents 'reg' property, however it misses to constrain it to actual I2C address. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250820-dt-bindings-display-v2-2-91e2ccba3d4e@linaro.org Signed-off-by: Rob Herring (Arm) commit 955212b1e4ac3f299c411ccd68cc702e55c4762d Author: Krzysztof Kozlowski Date: Wed Aug 20 16:17:36 2025 +0200 dt-bindings: display: ingenic,jz4780-hdmi: Add missing clock-names The binding references synopsys,dw-hdmi.yaml schema which defines both 'clocks' and 'clock-names' with variable length, therefore we need here also same constraint for 'clock-names' as for 'clocks'. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250820-dt-bindings-display-v2-1-91e2ccba3d4e@linaro.org Signed-off-by: Rob Herring (Arm) commit a6dcff26eb4dcb9178917c8c49b10265ee5f749c Author: Rob Herring Date: Fri Apr 26 14:54:37 2024 -0500 yamllint: Drop excluding quoted values with ',' from checks Strings with commas were excluded from checks because yamllint had false positives for flow style maps and sequences which need quotes when values contain commas. This issue has been fixed as of the 1.34 release, so drop the work-around. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20240426195438.2771968-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 75592f9e178915867829b7ec6eb20125924a4814 Author: Santosh Mahto Date: Wed Aug 20 23:40:13 2025 +0530 docs: devicetree: fix typo in writing-schema.rst Fixes a spelling mistake in writing-schema.rst: "interpretted" → "interpreted" Signed-off-by: Santosh Mahto Link: https://lore.kernel.org/r/20250820181013.17817-1-eisantosh95@gmail.com Signed-off-by: Rob Herring (Arm) commit 81bb4d07edd72a56180e2c8414ead0e63c379502 Author: Krzysztof Kozlowski Date: Mon Aug 18 15:25:35 2025 +0200 docs: dt: writing-bindings: Document node name ABI and simple-mfd Document established Devicetree bindings maintainers review practice: 1. Device node names should not be treated as an ABI, unless for children of a device when documented. There were many patches posted using of_find_node_by_name() or of_node_name_eq() for accessing siblings or completely different nodes. These cases were introducing undocumented ABI, so they are discouraged. 2. 'simple-mfd' means children do not depend on parent device resources. 'simple-bus' is so simple, that even 'reg' properties are not applicable. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250818132534.120217-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 835bdddd028ff57afaee28eb5e4b260f714fd555 Author: Frank Li Date: Tue Aug 19 12:53:16 2025 -0400 dt-bindings: soc: add vf610 reboot syscon controller Add vf610 reboot controller, which used to reboot whole system. Fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/vf/vf610-bk4.dtb: /soc/bus@40000000/src@4006e000: failed to match any schema with compatible: ['fsl,vf610-src', 'syscon'] IC reference manual calls it as system reset controller(SRC), but it is not module as reset controller, which used to reset individual device. SRC works as reboot controller, which reboots whole system. It provides a syscon interface to syscon-reboot. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250819165317.3739366-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit d504bbda8ca689585bdf663514a187dd3c9f0226 Author: Svyatoslav Ryhel Date: Wed Sep 3 06:53:24 2025 -0700 Input: tsc2007 - make interrupt optional In case tsc2007 is used as an ADC sensor there will be no interrupt provided at all, so set up an interrupt only if one is present. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250824091927.105121-3-clamor95@gmail.com Signed-off-by: Dmitry Torokhov commit b0e109a24213b051f53b4ff0fded5c458c2d62b2 Author: Svyatoslav Ryhel Date: Wed Sep 3 06:52:50 2025 -0700 Input: tsc2007 - change warning to debug message if pen GPIO is not defined Since pen GPIO request is optional, there is no reason to throw dev_warn if such GPIO is not defined. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250824091927.105121-2-clamor95@gmail.com Signed-off-by: Dmitry Torokhov commit c1b52451b604b7700419a48cf2f146ebacd9af57 Author: Fabio Estevam Date: Fri Aug 22 18:32:45 2025 -0300 dt-bindings: input: touchscreen: tsc2007: Document 'wakeup-source' The 'wakeup-source' property is used by many devicetree files and is also supported by the tsc2007_core driver. Document it to avoid the following dt-schema warning: 'wakeup-source' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250822213245.125901-1-festevam@gmail.com Signed-off-by: Dmitry Torokhov commit 5cc49b5a36b32a2dba41441ea13b93fb5ea21cfd Author: James Clark Date: Tue Sep 2 13:44:59 2025 +0100 spi: spi-fsl-dspi: Report FIFO overflows as errors In target mode, the host sending more data than can be consumed would be a common problem for any message exceeding the FIFO or DMA buffer size. Cancel the whole message as soon as this condition is hit as the message will be corrupted. Only do this for target mode in a DMA transfer, it's not likely these flags will be set in host mode so it's not worth adding extra checks. In IRQ and polling modes we use the same transfer functions for hosts and targets so the error flags always get checked. This is slightly inconsistent but it's not worth doing the check conditionally because it may catch some host programming errors in the future. Signed-off-by: James Clark Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-7-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit 7d9baf1e530930e28b45805e3855a4a465a9e36e Author: James Clark Date: Tue Sep 2 13:44:58 2025 +0100 spi: spi-fsl-dspi: Increase target mode DMA buffer size When the device is configured as a target, the host won't stop sending data while we're draining the buffer which leads to FIFO underflows and corruption. Increase the DMA buffer size to the maximum words that edma can transfer once to reduce the chance of this happening. In host mode, the driver is able to split up a transfer into smaller chunks so we don't need to increase the size. While in target mode, the length of the transfer is determined by the remote host and can be larger than whatever default buffer size we pick. Keeping the buffer small in host mode avoids wasting memory, but allocating the largest possible in target mode gives the lowest possible chance of dropping any data from the host. While we could allocate per-transfer using the exact size of the transfer, 128K is quite a large allocation and there is a chance it could fail due to memory fragmentation unless it's allocated once at init time. Signed-off-by: Larisa Grigore Signed-off-by: James Clark Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-6-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit fbb618e11fa7976c5295facb28afbf1a08393f51 Author: James Clark Date: Tue Sep 2 13:44:57 2025 +0100 spi: spi-fsl-dspi: Use whole page for DMA buffers dma_alloc_noncoherent() allocations are backed by a full page anyway, so use it all. VF610 devices used to use the full page before commit a957499bd437 ("spi: spi-fsl-dspi: Fix bits-per-word acceleration in DMA mode"), but others still used the FIFO size. After that commit, all devices used the FIFO size. Now all devices use the full page. Signed-off-by: James Clark Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-5-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit 36db0b03d3745700aca4fced26f6eb624f6ea4bc Author: James Clark Date: Tue Sep 2 13:44:56 2025 +0100 spi: spi-fsl-dspi: Use non-coherent memory for DMA Using coherent memory here isn't functionally necessary, we're only either sending data to the device or reading from it. This means explicit synchronizations are only required around those points and the change is fairly trivial. This gives us around a 10% increase in throughput for large DMA transfers and no loss for small transfers. Suggested-by: Arnd Bergmann Reviewed-by: Frank Li Acked-by: Arnd Bergmann Signed-off-by: James Clark Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-4-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit 4850f158c06eeaf4997fc65c47544f2c82ad5a45 Author: James Clark Date: Tue Sep 2 13:44:55 2025 +0100 spi: spi-fsl-dspi: Stub out DMA functions In a later commit we'll use dma_alloc_noncoherent() which isn't stubbed out for builds without CONFIG_DMA_ENGINE and results in the following build error: spi-fsl-dspi.c:(.text+0x644): undefined reference to `dma_free_pages' m68k-linux-ld: spi-fsl-dspi.c:(.text+0x67a): undefined reference to `dma_free_pages' To continue to support devices that only need XSPI mode and so that randconfig builds work, stub out DMA functionality in the DSPI driver. Although older parts of the DMA API have their own stubs, it's intentional that newer parts don't follow the same pattern. Therefore individual drivers should not compile in calls unless CONFIG_DMA_ENGINE is set. Link: https://lore.kernel.org/oe-kbuild-all/202506160036.t9VDxF6p-lkp@intel.com/ Signed-off-by: James Clark Reported-by: kernel test robot Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-3-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit 5484440aa0a98b76e7829cd06dda33cf62830d73 Author: James Clark Date: Tue Sep 2 13:44:54 2025 +0100 spi: fsl-dspi: Store status directly in cur_msg->status This will allow us to return a status from the interrupt handler in a later commit and avoids copying it at the end of dspi_transfer_one_message(). For consistency make polling and DMA modes use the same mechanism. No functional changes intended. Signed-off-by: James Clark Signed-off-by: Vladimir Oltean Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-2-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit bfddd34d67a0402c0476b36fc1b1f373cd5b0054 Author: James Clark Date: Tue Sep 2 13:44:53 2025 +0100 spi: fsl-dspi: Avoid using -EINPROGRESS error code Refactor dspi_rxtx() and dspi_poll() to not return -EINPROGRESS because this isn't actually a status that is ever returned to the core layer but some internal state. Use true/false return value on dspi_rxtx() for this instead. This will help separate internal vs external status for the later change to store the external status directly in cur_msg->status. No functional changes intended. Co-developed-by: Vladimir Oltean Signed-off-by: Vladimir Oltean Signed-off-by: James Clark Reviewed-by: Vladimir Oltean Message-ID: <20250902-james-nxp-spi-dma-v6-1-f7aa2c5e56e2@linaro.org> Signed-off-by: Mark Brown commit d3441febbba8b2963a6d6cfffbc4a0526034e11f Merge: 3be2d43534aab7 9b33bbc084accb Author: Bartosz Golaszewski Date: Wed Sep 3 15:02:48 2025 +0200 Merge tag 'ib-mfd-gpio-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Immutable branch between MFD and GPIO due for the v6.18 merge window Convert GPIO drivers under drivers/mfd/ to using the modernized generic GPIO chip API. commit 94b39cb3ad6db935b585988b36378884199cd5fc Author: Xichao Zhao Date: Wed Sep 3 10:03:47 2025 +0800 spi: mxs: fix "transfered"->"transferred" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Message-ID: <20250903020347.563003-1-zhao.xichao@vivo.com> Signed-off-by: Mark Brown commit 2d3264d9a8ce6c269833aeb6142e94536be2a9f7 Merge: 72243ced3d861f 2215a87b02ad8d Author: Dmitry Torokhov Date: Wed Sep 3 05:23:14 2025 -0700 Merge tag 'ib-mfd-input-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next Sync up with MFD tree to bring in support for tps6594. commit 77111b2c22ef5b368da5c833175b6f7806b39ccb Author: WeiHao Li Date: Sun Aug 31 18:48:52 2025 +0800 clk: rockchip: rk3368: use clock ids for SCLK_MIPIDSI_24M Export the clocks via the newly added clock-ids. Signed-off-by: WeiHao Li Link: https://lore.kernel.org/r/20250831104855.45883-5-cn.liweihao@gmail.com Signed-off-by: Heiko Stuebner commit 4a76a0a889cef284327f265f97edc4ff2f3e11cc Author: WeiHao Li Date: Sun Aug 31 18:48:51 2025 +0800 dt-bindings: clock: rk3368: Add SCLK_MIPIDSI_24M Add a clock id for mipi dsi reference clock, mipi dsi node used it. Signed-off-by: WeiHao Li Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250831104855.45883-4-cn.liweihao@gmail.com Signed-off-by: Heiko Stuebner commit d36bf356068cdb5499b9bc458db9149c0fd938a2 Author: Xichao Zhao Date: Thu Aug 21 17:38:45 2025 +0800 irqchip/renesas-rzg2l: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250821093845.564496-1-zhao.xichao@vivo.com commit 40c26230a1bfdf46f93e4136dbb96d093744c80d Author: Qianfeng Rong Date: Fri Aug 29 21:20:19 2025 +0800 irqchip: Use int type to store negative error codes Change the 'ret' variable from unsigned int to int to store negative error codes or zero returned by other functions. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but assigning negative error codes to unsigned type may trigger a compiler warning when the -Wsign-conversion flag is enabled. Signed-off-by: Qianfeng Rong Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250829132020.82077-1-rongqianfeng@vivo.com commit 54a1726d2e4c0c7b33f4e5ef35fcc118a4d74ea3 Author: Zenghui Yu Date: Wed Sep 3 10:33:19 2025 +0800 irqchip/gic-v5: Remove the redundant ITS cache invalidation An ITS cache invalidation has been performed immediately after programming the L2 DTE in gicv5_its_device_register(). No need to perform it again right after a successful gicv5_its_device_register(). Remove it. Signed-off-by: Zenghui Yu Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/all/20250903023319.1820-1-yuzenghui@huawei.com commit 72243ced3d861f99368ad2edcdce4d71c7108d16 Author: Andreas Kemnade Date: Sat Aug 30 10:53:26 2025 +0200 dt-bindings: input: tsc2007: use comma in filename Use comma between vendor-prefix and chip name as it is common. Signed-off-by: Andreas Kemnade Fixes: 45601c66b5dd ("dt-bindings: input: touchscreen: convert tsc2007.txt to yaml format") Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250830085326.36120-1-akemnade@kernel.org Signed-off-by: Dmitry Torokhov commit 9b33bbc084accb4ebde3c6888758b31e3bdf1c57 Author: Bartosz Golaszewski Date: Mon Aug 11 15:36:17 2025 +0200 mfd: vexpress-sysreg: Use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250811-gpio-mmio-mfd-conv-v1-2-68c5c958cf80@linaro.org Signed-off-by: Lee Jones commit 1efbee6852f1ff698a9981bd731308dd027189fb Author: Bartosz Golaszewski Date: Mon Aug 11 15:36:16 2025 +0200 mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") removed the return value check from the call to gpiochip_add_data() (or rather gpiochip_add() back then and later converted to devres) with no explanation. This function however can still fail, so check the return value and bail-out if it does. Cc: stable@vger.kernel.org Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250811-gpio-mmio-mfd-conv-v1-1-68c5c958cf80@linaro.org Signed-off-by: Lee Jones commit ce1a46b2d6a8465a86f7a6f71beb4c6de83bce5c Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:44 2025 +0100 ASoC: codecs: lpass-wsa-macro: add Codev version 2.9 Add support for lpass wsa codec macro version 2.9, which is available in Qualcomm Glymur SoCs. Its compatible with 2.8 w.r.t register layouts Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Message-ID: <20250902140044.54508-7-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit c73e2c5672dae4f6711cab99cabff9e72cd0591a Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:43 2025 +0100 ASoC: codecs: lpass-macro: add Codec version 2.9 Add support for lpass codec macro version 2.9, which is available in Qualcomm Glymur SoCs. Its compatible with 2.8 w.r.t register layouts. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Message-ID: <20250902140044.54508-6-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit 25436580f025d42bd7ccf3b960f4c405f3c91512 Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:42 2025 +0100 ASoC: dt-bindings: qcom: Add Glymur LPASS wsa and va macro codecs Document compatibles for Qualcomm Glymur SoC macro digital codecs (VA and WSA), compatible with previous generation (SM8550 and SM8650). Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Message-ID: <20250902140044.54508-5-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit 8c7ea98650e644ff61d3774085f732b40d8f7788 Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:41 2025 +0100 ASoC: qcom: x1e80100: add compatible for glymur SoC Add support for glymur SoC based sound card support. Signed-off-by: Srinivas Kandagatla Message-ID: <20250902140044.54508-4-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit 8f48b160e1b8f0c959e25df63994e6204b3794a8 Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:40 2025 +0100 ASoC: dt-bindings: qcom,sm8250: Add glymur sound card Document the bindings for the glymur sound card which is audioreach based architecture. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Message-ID: <20250902140044.54508-3-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit 5ab26b8ca5649e4a16e4b48efe5a0b92299c8f51 Author: Srinivas Kandagatla Date: Tue Sep 2 15:00:39 2025 +0100 ASoC: qcom: x1e80100: set card driver name from match data Sound machine drivers for Qualcomm SoCs can be reused across multiple SoCs. But user space ALSA UCM files depend on the card driver name which should be set per board/SoC. Allow such customization by using driver match data as sound card driver name. Signed-off-by: Srinivas Kandagatla Message-ID: <20250902140044.54508-2-srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Mark Brown commit ce57b718006a069226b5e5d3afe7969acd59154e Author: Cezary Rojewski Date: Tue Sep 2 11:48:53 2025 +0200 ASoC: Intel: avs: ssm4567: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-18-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 6c402acec635969f2a48ff642b84f2eac0054175 Author: Cezary Rojewski Date: Tue Sep 2 11:48:52 2025 +0200 ASoC: Intel: avs: rt5682: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-17-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit b0e52296aa83bdbed0130ff89948bbb0ef1ee024 Author: Cezary Rojewski Date: Tue Sep 2 11:48:51 2025 +0200 ASoC: Intel: avs: rt5663: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-16-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 69fe78271da6d7a8d43edd1797c245d22449256c Author: Cezary Rojewski Date: Tue Sep 2 11:48:50 2025 +0200 ASoC: Intel: avs: rt5514: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-15-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit fffac55850d20c81f386938b4fa29e13cdf66b99 Author: Cezary Rojewski Date: Tue Sep 2 11:48:49 2025 +0200 ASoC: Intel: avs: rt298: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-14-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 210233c24d248e69b5309d651ab4b1021c6631e7 Author: Cezary Rojewski Date: Tue Sep 2 11:48:48 2025 +0200 ASoC: Intel: avs: rt286: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-13-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 1a78108293dfe421255ee0abd69ef73e5c68539a Author: Cezary Rojewski Date: Tue Sep 2 11:48:47 2025 +0200 ASoC: Intel: avs: rt274: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-12-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit a46b3da24cdce85b7fca6f012f68b3857494ade6 Author: Cezary Rojewski Date: Tue Sep 2 11:48:46 2025 +0200 ASoC: Intel: avs: probe: Refactor dai_link creation To allow for multiple instances of the card, move away from static dai_link declaration. While at it, simplify the code as the name of the platform component matches the name of the card's platform_device: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-11-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit ba3684328208129d1d72ec50c417bc8a9213d4c5 Author: Cezary Rojewski Date: Tue Sep 2 11:48:45 2025 +0200 ASoC: Intel: avs: nau8825: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-10-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 31fc544ad8db01e58d671a5c4ec77b211bde3523 Author: Cezary Rojewski Date: Tue Sep 2 11:48:44 2025 +0200 ASoC: Intel: avs: max98927: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-9-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit ed23ac9b300b809616dcfc63765aa5a33af38041 Author: Cezary Rojewski Date: Tue Sep 2 11:48:43 2025 +0200 ASoC: Intel: avs: max98373: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-8-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 314d8f574ae0c8f23f3225e0c75388ef8c565295 Author: Cezary Rojewski Date: Tue Sep 2 11:48:42 2025 +0200 ASoC: Intel: avs: max98357a: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-7-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit d4b60caaef0cb8d23528ef17991bf9abae1ccff7 Author: Cezary Rojewski Date: Tue Sep 2 11:48:41 2025 +0200 ASoC: Intel: avs: i2stest: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-6-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit cd405e6a949723c4b35c44e8b60e7139aa6e3743 Author: Cezary Rojewski Date: Tue Sep 2 11:48:40 2025 +0200 ASoC: Intel: avs: es8336: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-5-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 765ee69f5e237c33795a0b51417f68ce59fd31a1 Author: Cezary Rojewski Date: Tue Sep 2 11:48:39 2025 +0200 ASoC: Intel: avs: dmic: Refactor dai_link creation To allow for multiple instances of the card, move away from static dai_link declaration. While at it, simplify the code as the name of the platform component matches the name of the card's platform_device: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-4-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 7fa2ebe9b7f4a865030e6ea9be33635b4c1b9224 Author: Cezary Rojewski Date: Tue Sep 2 11:48:38 2025 +0200 ASoC: Intel: avs: da7219: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-3-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 0e3448f069646a72698b6f4933baf43daf92a9c0 Author: Cezary Rojewski Date: Tue Sep 2 11:48:37 2025 +0200 ASoC: Intel: avs: hda: Adjust platform name The name of the platform component matches the name of the card's platform_device. This allows for simplifying card and dai_link initialization: - drop mach->mach_params.platform usage - drop snd_soc_fixup_dai_links_platform_name() usage Signed-off-by: Cezary Rojewski Reviewed-by: Amadeusz Sławiński Message-ID: <20250902094853.1231842-2-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 5afa9d2a9bb1410f816e0123846047288b16e4b9 Author: Chia-I Wu Date: Thu Aug 28 13:01:16 2025 -0700 drm/panthor: check bo offset alignment in vm bind Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages. Signed-off-by: Chia-I Wu Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250828200116.3532255-1-olvaffe@gmail.com commit c3c9a75ede23fe2b244d2f1c4ac0c6cc3a4dc100 Author: Thorsten Blum Date: Tue Sep 2 17:48:41 2025 +0200 ALSA: hda/conexant: Fix typos in comments s/OPLC/OLPC/ Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250902154858.86102-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit e9a1d54ed9233b73737052c42115fe593f82ef84 Author: Jouni Högander Date: Mon Sep 1 13:10:33 2025 +0300 drm/i915/bios: Remove unnecessary checks of PSR idle frames in VBT binary PSR idle frames in VBT binary is a 4 bits wide bitfield. Checking if it's below 0 or over 15 doesn't make sense. Remove these checks. Signed-off-by: Jouni Högander Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250901101033.4176277-1-jouni.hogander@intel.com commit 72b7ceca857f38a8ca7c5629feffc63769638974 Author: Shashank A P Date: Mon Sep 1 14:59:00 2025 +0530 fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set. This issue occurs when writeback is triggered due to sync call for an opened file(ie, writeback reason is WB_REASON_SYNC). When f2fs balance is needed at sync path, flush for quota_release_work is triggered. By default quota_release_work is queued to "events_unbound" queue which does not have WQ_MEM_RECLAIM flag. During f2fs balance "writeback" workqueue tries to flush quota_release_work causing kernel panic due to MEM_RECLAIM flag mismatch errors. This patch creates dedicated workqueue with WQ_MEM_RECLAIM flag for work quota_release_work. ------------[ cut here ]------------ WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 check_flush_dependency+0x13c/0x148 Call trace: check_flush_dependency+0x13c/0x148 __flush_work+0xd0/0x398 flush_delayed_work+0x44/0x5c dquot_writeback_dquots+0x54/0x318 f2fs_do_quota_sync+0xb8/0x1a8 f2fs_write_checkpoint+0x3cc/0x99c f2fs_gc+0x190/0x750 f2fs_balance_fs+0x110/0x168 f2fs_write_single_data_page+0x474/0x7dc f2fs_write_data_pages+0x7d0/0xd0c do_writepages+0xe0/0x2f4 __writeback_single_inode+0x44/0x4ac writeback_sb_inodes+0x30c/0x538 wb_writeback+0xf4/0x440 wb_workfn+0x128/0x5d4 process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x11c/0x1b0 ret_from_fork+0x10/0x20 Kernel panic - not syncing: kernel: panic_on_warn set ... Fixes: ac6f420291b3 ("quota: flush quota_release_work upon quota writeback") CC: stable@vger.kernel.org Signed-off-by: Shashank A P Link: https://patch.msgid.link/20250901092905.2115-1-shashank.ap@samsung.com Signed-off-by: Jan Kara commit 98463a8d9c463128d75086516f7f50c3f2a82afb Author: Jani Nikula Date: Tue Sep 2 17:49:29 2025 +0300 drm/i915/power: drop a couple of &i915->drm usages Switch from &i915->drm to display->drm. Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250902144929.3026700-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2215a87b02ad8d353cd3edebd1bed01db2458986 Author: Michael Walle Date: Tue Aug 26 15:46:31 2025 +0200 mfd: tps6594: Add board power-off support Add a system level power-off handler if the "system-power-controller" flag is set for this device in the device tree. A power-off request is triggered by writing the TRIGGER_I2C_0 bit (which is actually just a convention and really depends on the freely programmable FSM). Co-developed-by: Job Sava Signed-off-by: Job Sava Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250826134631.1499936-4-mwalle@kernel.org Signed-off-by: Lee Jones commit d766ca01c208bdf0f36098607efe1e250ccf41c5 Author: Michael Walle Date: Tue Aug 26 15:46:30 2025 +0200 mfd: tps6594: Add power button functionality The PMIC has a multi-function pin PB/EN/VSENSE. If it is configured as push-button (PB), add the corresponding device for it. Co-developed-by: Job Sava Signed-off-by: Job Sava Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250826134631.1499936-3-mwalle@kernel.org Signed-off-by: Lee Jones commit 170031ff27dd7a07fdedee7f3710a19dcdf889bd Author: Job Sava Date: Tue Aug 26 15:46:29 2025 +0200 input: tps6594-pwrbutton: Add power button functionality TPS6594 defines two interrupts for the power button one for push and one for release. This driver is very simple in that it maps the push interrupt to a key input and the release interrupt to a key release. Signed-off-by: Job Sava Signed-off-by: Michael Walle Acked-by: Dmitry Torokhov Link: https://lore.kernel.org/r/20250826134631.1499936-2-mwalle@kernel.org Signed-off-by: Lee Jones commit 0a26e5eb78fb1627beb8e3eb172737f8492d2799 Author: Bjorn Helgaas Date: Mon Aug 25 15:34:23 2025 -0500 jiffies: Remove obsolete SHIFTED_HZ comment b3c869d35b9b ("jiffies: Remove compile time assumptions about CLOCK_TICK_RATE") removed the last definition of SHIFTED_HZ but left behind comments about it. Remove the comments as well. Signed-off-by: Bjorn Helgaas Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250825203425.796034-1-helgaas@kernel.org commit 51e085ee4fdc61d88621e75a1c6f5c4fafb3fe35 Author: Jun Nie Date: Tue Aug 19 09:30:57 2025 +0800 drm/msm/dpu: decide right side per last bit Currently, only one pair of mixers is supported, so a non-zero counter value is sufficient to identify the correct mixer within that pair. However, future implementations may involve multiple mixer pairs. With the current implementation, all mixers within the second pair would be incorrectly selected as right mixer. To correctly select the mixer within a pair, test the least significant bit of the counter. If the least significant bit is not set, select the mixer as left one; otherwise, select the mixer as right one for all pairs. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/669226/ Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-3-2c7a85089db8@linaro.org Signed-off-by: Dmitry Baryshkov commit 4b09db0c13eeb12102827d7d16128c1713319576 Author: Jun Nie Date: Tue Aug 19 09:30:56 2025 +0800 drm/msm/dpu: polish log for resource allocation It is more likely that resource allocation may fail in complex usage case, such as quad-pipe case, than existing usage cases. A resource type ID is printed on failure in the current implementation, but the raw ID number is not explicit enough to help easily understand which resource caused the failure, so add a table to match the type ID to an human readable resource name and use it in the error print. Signed-off-by: Jun Nie Reviewed-by: Jessica Zhang Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/669225/ Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-2-2c7a85089db8@linaro.org Signed-off-by: Dmitry Baryshkov commit 6fc616723bb5fd4289d7422fa013da062b44ae55 Author: Jun Nie Date: Tue Aug 19 09:30:55 2025 +0800 drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current plane is not associated with any SSPP yet. Null pointer is referenced when validating the SSPP of current plane. Skip SSPP validation for current plane. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: SM8650 EV1 rev1 4slam 2et (DT) pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : dpu_plane_is_multirect_capable+0x68/0x90 lr : dpu_assign_plane_resources+0x288/0x410 sp : ffff800093dcb770 x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080 x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200 x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000 x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950 x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438 x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000 Call trace: dpu_plane_is_multirect_capable+0x68/0x90 (P) dpu_crtc_atomic_check+0x5bc/0x650 drm_atomic_helper_check_planes+0x13c/0x220 drm_atomic_helper_check+0x58/0xb8 msm_atomic_check+0xd8/0xf0 drm_atomic_check_only+0x4a8/0x968 drm_atomic_commit+0x50/0xd8 drm_atomic_helper_update_plane+0x140/0x188 __setplane_atomic+0xfc/0x148 drm_mode_setplane+0x164/0x378 drm_ioctl_kernel+0xc0/0x140 drm_ioctl+0x20c/0x500 __arm64_sys_ioctl+0xbc/0xf8 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x30/0xd0 el0t_64_sync_handler+0x144/0x168 el0t_64_sync+0x198/0x1a0 Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1) ---[ end trace 0000000000000000 ]--- Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes") Signed-off-by: Jun Nie Patchwork: https://patchwork.freedesktop.org/patch/669224/ Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org Signed-off-by: Dmitry Baryshkov commit 47a5e9eb3ca0bb67c5d258229823b38cd113ecda Author: Jessica Zhang Date: Wed May 14 16:52:29 2025 -0700 drm/msm/dpu: Drop maxwidth from dpu_lm_sub_blks struct Drop the unused maxwidth field from the dpu_lm_sub_blks struct Signed-off-by: Jessica Zhang Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/653759/ Link: https://lore.kernel.org/r/20250514-max-mixer-width-v1-1-c8ba0d9bb858@oss.qualcomm.com [DB: also handled SM8750 block] Signed-off-by: Dmitry Baryshkov commit 33a7776f9bf748e4b6387d1d579ac0c5eab26785 Author: Nathan Chancellor Date: Tue Sep 2 14:15:50 2025 -0700 drm/tidss: dispc: Explicitly include bitfield.h After a recent series to use FIELD_PREP and FIELD_MODIFY in tidss_dispc.c, there are many errors when bitfield.h is not implicitly included, such as when building allmodconfig for ARCH=hexagon: drivers/gpu/drm/tidss/tidss_dispc.c:1116:2: error: call to undeclared function 'FIELD_MODIFY'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1116 | VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, v, | ^ drivers/gpu/drm/tidss/tidss_dispc.c:631:3: note: expanded from macro 'VP_REG_FLD_MOD' 631 | FIELD_MODIFY((mask), &_reg, (val)); \ | ^ drivers/gpu/drm/tidss/tidss_dispc.c:1140:2: error: call to undeclared function 'FIELD_MODIFY'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1140 | FIELD_MODIFY(DISPC_VP_DSS_OLDI_CFG_MAP_MASK, &oldi_cfg, | ^ drivers/gpu/drm/tidss/tidss_dispc.c:1203:10: error: call to undeclared function 'FIELD_PREP'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1203 | FIELD_PREP(DISPC_VP_TIMING_H_SYNC_PULSE_MASK, hsw - 1) | | ^ ... Explicitly include bitfield.h to resolve the errors. Fixes: 9accc8b10de8 ("drm/tidss: dispc: Get rid of FLD_VAL") Signed-off-by: Nathan Chancellor Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250902-drm-tidss-fix-missing-bitfield-h-v1-1-aaad4a285f98@kernel.org Signed-off-by: Tomi Valkeinen commit 38f9262b05654854954763e4fac13b0ba7fd6a33 Author: Jani Nikula Date: Fri Aug 29 14:33:11 2025 +0300 drm/i915/dp: convert open-coded timeout to poll_timeout_us() Use poll_timeout_us() instead of open-coding the timeout loop. Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250829113311.1930618-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 045bf0f825cf8dd53468e70fa494b06aa17e2d33 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:42 2025 +0200 arm64: dts: exynos8895: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Link: https://lore.kernel.org/r/20250819131641.86520-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 74e2ef72bd4b25ce21c8f309d4f5b91b5df9ff5b Author: Gokul Sivakumar Date: Thu Jul 24 15:41:36 2025 +0530 wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Cypress(Infineon) is not the vendor for this 43752 SDIO WLAN chip, and so has not officially released any firmware binary for it. It is incorrect to maintain this WLAN chip with firmware vendor ID as "CYW". So relabel the chip's firmware Vendor ID as "WCC" as suggested by the maintainer. Fixes: d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization") Fixes: f74f1ec22dc2 ("wifi: brcmfmac: add support for Cypress firmware api") Signed-off-by: Gokul Sivakumar Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250724101136.6691-1-gokulkumar.sivakumar@infineon.com Signed-off-by: Johannes Berg commit 56819d00bc2ebaa6308913c28680da5d896852b8 Author: Stefan Kerkmann Date: Mon Aug 4 16:16:59 2025 +0200 wifi: mwifiex: send world regulatory domain to driver The world regulatory domain is a restrictive subset of channel configurations which allows legal operation of the adapter all over the world. Changing to this domain should not be prevented. Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed Signed-off-by: Stefan Kerkmann Reviewed-by: Jeff Chen Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de Signed-off-by: Johannes Berg commit 7b6f16a258065f85793fb2597a290041c1e3d201 Author: Stefan Kerkmann Date: Mon Aug 4 15:58:27 2025 +0200 wifi: mwifiex: add rgpower table loading support Marvell/NXP Wi-Fi adapters allow fine-grained adjustment of the transmit power levels and various other internal parameters. This is done by sending command streams to the adapter. One storage format of these command streams are the rgpower tables, which consist of multiple command blocks in the following format: command_block_1 = { XX XX LL LL XX XX .. } command_block_n = { XX XX LL LL XX XX XX .. } XX = raw byte as hex chars LL = total length of the "raw" command block These command blocks are parsed into their binary representation and then send to the adapter. The parsing logic was adapted from NXP's mwifiex driver[1]. The rgpower tables matching the currently set regulatory domain are automatically requested and applied. If not found the existing device tree provided power tables are tried as well. [1]: https://github.com/nxp-imx/mwifiex/blob/7a8beaa1605cb0870dc7ba3312c76df91cb0d6cf/mlan/mlan_cmdevt.c#L812 Signed-off-by: Stefan Kerkmann Link: https://patch.msgid.link/20250804-feature-mwifiex-rgpower-table-loading-v1-1-358e70a4d45e@pengutronix.de Signed-off-by: Johannes Berg commit f90caeba1dcacbba5956aa4219b83f8694aa5a79 Author: Gustavo A. R. Silva Date: Mon Aug 11 14:10:39 2025 +0900 wifi: iwlegacy: Remove unused structs and avoid -Wflex-array-member-not-at-end warnings Remove unused structures and avoid the following -Wflex-array-member-not-at-end warnings: drivers/net/wireless/intel/iwlegacy/iwl-spectrum.h:68:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlegacy/iwl-spectrum.h:60:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/aJl7TxeWgLdEKWhg@kspp Signed-off-by: Johannes Berg commit 5b726e9bf9544a349090879a513a5e00da486c14 Author: Aaron Lu Date: Fri Aug 29 16:11:20 2025 +0800 sched/fair: Get rid of throttled_lb_pair() Now that throttled tasks are dequeued and can not stay on rq's cfs_tasks list, there is no need to take special care of these throttled tasks anymore in load balance. Suggested-by: K Prateek Nayak Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Tested-by: Valentin Schneider Tested-by: Matteo Martelli Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250829081120.806-6-ziqianlu@bytedance.com commit eb962f251fbba251a0d34897d6170f7616d70c52 Author: Aaron Lu Date: Fri Aug 29 16:11:19 2025 +0800 sched/fair: Task based throttle time accounting With task based throttle model, the previous way to check cfs_rq's nr_queued to decide if throttled time should be accounted doesn't work as expected, e.g. when a cfs_rq which has a single task is throttled, that task could later block in kernel mode instead of being dequeued on limbo list and accounting this as throttled time is not accurate. Rework throttle time accounting for a cfs_rq as follows: - start accounting when the first task gets throttled in its hierarchy; - stop accounting on unthrottle. Note that there will be a time gap between when a cfs_rq is throttled and when a task in its hierarchy is actually throttled. This accounting mechanism only starts accounting in the latter case. Suggested-by: Chengming Zhou # accounting mechanism Co-developed-by: K Prateek Nayak # simplify implementation Signed-off-by: K Prateek Nayak Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Tested-by: Valentin Schneider Tested-by: Matteo Martelli Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250829081120.806-5-ziqianlu@bytedance.com commit e1fad12dcb66b7f35573c52b665830a1538f9886 Author: Valentin Schneider Date: Fri Aug 29 16:11:18 2025 +0800 sched/fair: Switch to task based throttle model In current throttle model, when a cfs_rq is throttled, its entity will be dequeued from cpu's rq, making tasks attached to it not able to run, thus achiveing the throttle target. This has a drawback though: assume a task is a reader of percpu_rwsem and is waiting. When it gets woken, it can not run till its task group's next period comes, which can be a relatively long time. Waiting writer will have to wait longer due to this and it also makes further reader build up and eventually trigger task hung. To improve this situation, change the throttle model to task based, i.e. when a cfs_rq is throttled, record its throttled status but do not remove it from cpu's rq. Instead, for tasks that belong to this cfs_rq, when they get picked, add a task work to them so that when they return to user, they can be dequeued there. In this way, tasks throttled will not hold any kernel resources. And on unthrottle, enqueue back those tasks so they can continue to run. Throttled cfs_rq's PELT clock is handled differently now: previously the cfs_rq's PELT clock is stopped once it entered throttled state but since now tasks(in kernel mode) can continue to run, change the behaviour to stop PELT clock when the throttled cfs_rq has no tasks left. Suggested-by: Chengming Zhou # tag on pick Signed-off-by: Valentin Schneider Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Tested-by: Valentin Schneider Tested-by: Chen Yu Tested-by: Matteo Martelli Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250829081120.806-4-ziqianlu@bytedance.com commit 7fc2d14392475e368a2a7be458aba4eecdf2439b Author: Valentin Schneider Date: Fri Aug 29 16:11:17 2025 +0800 sched/fair: Implement throttle task work and related helpers Implement throttle_cfs_rq_work() task work which gets executed on task's ret2user path where the task is dequeued and marked as throttled. Signed-off-by: Valentin Schneider Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chengming Zhou Tested-by: Valentin Schneider Tested-by: Matteo Martelli Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250829081120.806-3-ziqianlu@bytedance.com commit 2cd571245b43492867bf1b4252485f3e6647b643 Author: Valentin Schneider Date: Fri Aug 29 16:11:16 2025 +0800 sched/fair: Add related data structure for task based throttle Add related data structures for this new throttle functionality. Tesed-by: K Prateek Nayak Signed-off-by: Valentin Schneider Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chengming Zhou Tested-by: Valentin Schneider Tested-by: Matteo Martelli Link: https://lore.kernel.org/r/20250829081120.806-2-ziqianlu@bytedance.com commit 7bd291abe2da09f59dca81f35a4ec220e5e138a2 Author: Peter Zijlstra Date: Tue Aug 26 11:08:57 2025 +0200 sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig Like many Kconfig symbols, SCHED_{SMT,CLUSTER,MC} are duplicated across arch/*/Kconfig. Try and clean up a little. Suggested-by: Christophe Leroy Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Shrikanth Hegde Tested-by: Shrikanth Hegde # powerpc Link: https://lkml.kernel.org/r/20250826094358.GG3245006@noisy.programming.kicks-ass.net commit 91c614f09abf1d45aac6b475d82a36c704b527ee Author: Peter Zijlstra Date: Tue Aug 26 10:55:55 2025 +0200 sched: Move STDL_INIT() functions out-of-line Since all these functions are address-taken in SDTL_INIT() and called indirectly, it doesn't really make sense for them to be inline. Suggested-by: Christophe Leroy Signed-off-by: Peter Zijlstra (Intel) commit 661f951e371cc134ea31c84238dbdc9a898b8403 Author: Peter Zijlstra Date: Mon Aug 25 12:02:44 2025 +0000 sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() Leon [1] and Vinicius [2] noted a topology_span_sane() warning during their testing starting from v6.16-rc1. Debug that followed pointed to the tl->mask() for the NODE domain being incorrectly resolved to that of the highest NUMA domain. tl->mask() for NODE is set to the sd_numa_mask() which depends on the global "sched_domains_curr_level" hack. "sched_domains_curr_level" is set to the "tl->numa_level" during tl traversal in build_sched_domains() calling sd_init() but was not reset before topology_span_sane(). Since "tl->numa_level" still reflected the old value from build_sched_domains(), topology_span_sane() for the NODE domain trips when the span of the last NUMA domain overlaps. Instead of replicating the "sched_domains_curr_level" hack, get rid of it entirely and instead, pass the entire "sched_domain_topology_level" object to tl->cpumask() function to prevent such mishap in the future. sd_numa_mask() now directly references "tl->numa_level" instead of relying on the global "sched_domains_curr_level" hack to index into sched_domains_numa_masks[]. The original warning was reproducible on the following NUMA topology reported by Leon: $ sudo numactl -H available: 5 nodes (0-4) node 0 cpus: 0 1 node 0 size: 2927 MB node 0 free: 1603 MB node 1 cpus: 2 3 node 1 size: 3023 MB node 1 free: 3008 MB node 2 cpus: 4 5 node 2 size: 3023 MB node 2 free: 3007 MB node 3 cpus: 6 7 node 3 size: 3023 MB node 3 free: 3002 MB node 4 cpus: 8 9 node 4 size: 3022 MB node 4 free: 2718 MB node distances: node 0 1 2 3 4 0: 10 39 38 37 36 1: 39 10 38 37 36 2: 38 38 10 37 36 3: 37 37 37 10 36 4: 36 36 36 36 10 The above topology can be mimicked using the following QEMU cmd that was used to reproduce the warning and test the fix: sudo qemu-system-x86_64 -enable-kvm -cpu host \ -m 20G -smp cpus=10,sockets=10 -machine q35 \ -object memory-backend-ram,size=4G,id=m0 \ -object memory-backend-ram,size=4G,id=m1 \ -object memory-backend-ram,size=4G,id=m2 \ -object memory-backend-ram,size=4G,id=m3 \ -object memory-backend-ram,size=4G,id=m4 \ -numa node,cpus=0-1,memdev=m0,nodeid=0 \ -numa node,cpus=2-3,memdev=m1,nodeid=1 \ -numa node,cpus=4-5,memdev=m2,nodeid=2 \ -numa node,cpus=6-7,memdev=m3,nodeid=3 \ -numa node,cpus=8-9,memdev=m4,nodeid=4 \ -numa dist,src=0,dst=1,val=39 \ -numa dist,src=0,dst=2,val=38 \ -numa dist,src=0,dst=3,val=37 \ -numa dist,src=0,dst=4,val=36 \ -numa dist,src=1,dst=0,val=39 \ -numa dist,src=1,dst=2,val=38 \ -numa dist,src=1,dst=3,val=37 \ -numa dist,src=1,dst=4,val=36 \ -numa dist,src=2,dst=0,val=38 \ -numa dist,src=2,dst=1,val=38 \ -numa dist,src=2,dst=3,val=37 \ -numa dist,src=2,dst=4,val=36 \ -numa dist,src=3,dst=0,val=37 \ -numa dist,src=3,dst=1,val=37 \ -numa dist,src=3,dst=2,val=37 \ -numa dist,src=3,dst=4,val=36 \ -numa dist,src=4,dst=0,val=36 \ -numa dist,src=4,dst=1,val=36 \ -numa dist,src=4,dst=2,val=36 \ -numa dist,src=4,dst=3,val=36 \ ... [ prateek: Moved common functions to include/linux/sched/topology.h, reuse the common bits for s390 and ppc, commit message ] Closes: https://lore.kernel.org/lkml/20250610110701.GA256154@unreal/ [1] Fixes: ccf74128d66c ("sched/topology: Assert non-NUMA topology masks don't (partially) overlap") # ce29a7da84cd, f55dac1dafb3 Signed-off-by: Peter Zijlstra (Intel) Reported-by: Leon Romanovsky Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Reviewed-by: Shrikanth Hegde Tested-by: Valentin Schneider # x86 Tested-by: Shrikanth Hegde # powerpc Link: https://lore.kernel.org/lkml/a3de98387abad28592e6ab591f3ff6107fe01dc1.1755893468.git.tim.c.chen@linux.intel.com/ [2] commit 8fd5485fb4f3d9da3977fd783fcb8e5452463420 Author: Harshit Agarwal Date: Tue Apr 8 04:50:21 2025 +0000 sched/deadline: Fix race in push_dl_task() When a CPU chooses to call push_dl_task and picks a task to push to another CPU's runqueue then it will call find_lock_later_rq method which would take a double lock on both CPUs' runqueues. If one of the locks aren't readily available, it may lead to dropping the current runqueue lock and reacquiring both the locks at once. During this window it is possible that the task is already migrated and is running on some other CPU. These cases are already handled. However, if the task is migrated and has already been executed and another CPU is now trying to wake it up (ttwu) such that it is queued again on the runqeue (on_rq is 1) and also if the task was run by the same CPU, then the current checks will pass even though the task was migrated out and is no longer in the pushable tasks list. Please go through the original rt change for more details on the issue. To fix this, after the lock is obtained inside the find_lock_later_rq, it ensures that the task is still at the head of pushable tasks list. Also removed some checks that are no longer needed with the addition of this new check. However, the new check of pushable tasks list only applies when find_lock_later_rq is called by push_dl_task. For the other caller i.e. dl_task_offline_migration, existing checks are used. Signed-off-by: Harshit Agarwal Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250408045021.3283624-1-harshit@nutanix.com commit b662bc503d95058b1cd640941edc48588849d9ce Author: Darshan Rathod Date: Tue Aug 12 18:06:36 2025 +0530 wifi: brcmfmac: avoid assignment in if/else-if conditions in NVRAM load path The NVRAM selection logic in brcmf_fw_request_nvram_done() used patterns like: if ((data = bcm47xx_nvram_get_contents(&data_len))) free_bcm47xx_nvram = true; else if ((data = brcmf_fw_nvram_from_efi(&data_len))) kfree_nvram = true; This style violates kernel coding style guidelines and triggers checkpatch.pl errors. It also slightly reduces readability. Refactor these cases by separating the assignment and the check, ensuring behavior remains identical while complying with coding standards. Signed-off-by: Darshan Rathod Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250812123636.2142292-1-darshanrathod475@gmail.com Signed-off-by: Johannes Berg commit 1373f94148a5adac2f42c8ba9771105624fe4af0 Author: Miri Korenblit Date: Tue Aug 26 20:25:24 2025 +0300 wifi: mac80211: count reg connection element in the size We currently don't count the reg connection length in the per-link capability length. Fix it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826202512.b14fc82f736b.I03442382e8a07f6f9836bcdac2e22ce8afbe6a21@changeid Signed-off-by: Johannes Berg commit ac36daa83650c26fd55dee1a6ee5144769239911 Author: Lorenzo Bianconi Date: Tue Aug 26 13:54:31 2025 +0200 wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta Since commit '1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO")' mac80211 supports connection monitor for MLO client interfaces. Remove the CONNECTION_MONITOR requirement in ieee80211_register_hw routine. Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250826-remove-conn-mon-check-ieee80211_register_hw-v2-1-5a1e2f038245@kernel.org Signed-off-by: Johannes Berg commit 58febb47b961a91d0d12ee0c1618a7843c0908ce Author: Steven Rostedt Date: Thu Aug 28 22:17:59 2025 -0400 wifi: cfg80211: Remove unused tracepoints Tracepoints that are defined take up around 5K each, even if they are not used. If they are defined and not used, then they waste memory for unused code. Soon unused tracepoints will cause warnings. Remove the unused tracepoints of the cfg80211 subsystem. They are: cfg80211_chandef_dfs_required cfg80211_return_u32 cfg80211_return_uint cfg80211_send_rx_auth Signed-off-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20250828221759.131160ee@batman.local.home Signed-off-by: Johannes Berg commit 4952fb7f53d4c9f007147ffb250c04ed40c959f7 Author: Krzysztof Kozlowski Date: Mon Aug 18 16:37:31 2025 +0200 ARM: dts: stm32: Drop redundant status=okay Device nodes are enabled by default, so remove confusing or duplicated enabling of few nodes. No practical impact, verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20250818143730.244379-2-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Torgue commit 3f2265078156c97941e08a1a3274d76e78128585 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:09 2025 +0200 arm64: dts: stm32: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131707.86657-4-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Torgue commit fc5aa426280e7d98113d8674187464813f712a82 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:08 2025 +0200 ARM: dts: stm32: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131707.86657-3-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Torgue commit 3be2d43534aab7291b59c4e66526f911854aa3a7 Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:40 2025 +0200 gpio: xra1403: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-6-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit 2d71156cfea8391625ea146eff32b3d2ef059345 Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:39 2025 +0200 gpio: mvebu: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-5-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit aaa1279b8b5b46cc42b6175c2bcd83d8ac5fd2b3 Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:38 2025 +0200 gpio: wm8994: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Charles Keepax Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-4-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit 3767426b234f0d7b82ccfa05e53c47c83e0a12c2 Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:37 2025 +0200 gpio: wm831x: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Charles Keepax Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-3-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit ddeb66d2cb10f03a43d97a0ff2c3869d1951c87d Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:36 2025 +0200 gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-2-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit 246b889c704e3209050eb0aa5a3733564aee1b38 Author: Bartosz Golaszewski Date: Tue Aug 26 11:54:35 2025 +0200 gpio: stmpe: don't print out global GPIO numbers in debugfs callbacks In order to further limit the number of references to the GPIO base number stored in struct gpio_chip, replace the global GPIO numbers in the output of debugfs callbacks by hardware offsets. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-dbg-show-base-v1-1-7f27cd7f2256@linaro.org Signed-off-by: Bartosz Golaszewski commit a6f03347debb7c2c6d04cd4be67ed766e19633ba Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:13 2025 +0200 gpio: visconti: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-12-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 656dc0c6f725a29c9e48657ae3db78f9016f518c Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:12 2025 +0200 gpio: vf610: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-11-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit c0378e59a6af2efa470a384b69fd24d3f3f3dd97 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:11 2025 +0200 gpio: hisi: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-10-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit b9dac8251e7e6aa433f54a7da45cb05c66627695 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:10 2025 +0200 gpio: realtek-otto: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-9-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 3ff7ab070b4804aad5b1d3e3d82a793710ef1f27 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:09 2025 +0200 gpio: ftgpio010: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-8-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit cf0257d3ce05259a74265fe0a0bd7de063cc6793 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:08 2025 +0200 gpio: ftgpio010: order includes alphabetically For easier maintenance: put includes in alphabetical order. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-7-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 6821e5d5877ca80b6989dfba2648a7ecbe3d9a64 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:07 2025 +0200 gpio: xgs-iproc: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-6-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 72fdbf35ec7273bb1c885696680e611c47b261b4 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:06 2025 +0200 gpio: mlxbf2: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-5-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 7cb9086790a0de526ee40508a4deaebfd82a5bca Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:05 2025 +0200 gpio: mlxbf2: use dev_err_probe() where applicable Simplify error handling and shrink the code by using dev_err_probe() consistently across the driver. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-4-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit c7357c8b6703d4bc0db6198782fcbf0cf3033844 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:04 2025 +0200 gpio: mxs: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-3-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit d3332dd1f6e2cf82744dbab37d05857e2d028fa0 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:03 2025 +0200 gpio: mxs: order includes alphabetically For easier maintenance: put includes in alphabetical order. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-2-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 38d98a822c143a4a7337d08f50968cbd7b701ca2 Author: Bartosz Golaszewski Date: Tue Aug 26 11:35:02 2025 +0200 gpio: xgene-sb: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250826-gpio-mmio-gpio-conv-part2-v1-1-f67603e4b27e@linaro.org Signed-off-by: Bartosz Golaszewski commit 0b367e60c73c05721cf2156fe8fe077320115ffd Author: Jihed Chaibi Date: Sun Aug 31 00:51:15 2025 +0200 ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property The stm32-i2s binding inherits from the standard audio-graph-port schema for its 'port' subnode, audio-graph-port requires the use of the 'dai-format' property. The stm32mp151c-plyaqm dts file was using the non-standard name 'format'. Correct the property name to 'dai-format' to fix the dtbs_check validation error. Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com Signed-off-by: Alexandre Torgue commit 0586ac82e62b0fdbaa811e4da6e04be157b495f3 Author: Rob Herring (Arm) Date: Fri Aug 29 16:13:17 2025 -0500 ARM: dts: aspeed: Drop "sdhci" compatibles The "sdhci" compatible is not documented nor very useful on its own given the various features and quirks of SDHCI implementations. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250829211318.1335862-1-robh@kernel.org Signed-off-by: Andrew Jeffery commit 8409816b1eb306eb1f6137f83317fc756722d7d0 Author: Dan Carpenter Date: Wed Sep 3 08:52:24 2025 +0300 ALSA: rme32: Fix serialization in snd_rme32_capture_adat_open() We accidentally deleted the wrong line of code when we did the conversion to guard() locks. If the rme32->capture_substream has already been set we should return -EBUSY. Fixes: 8bb75ae244c5 ("ALSA: rme32: Use guard() for spin locks") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aLfXmIQRFTXr5h8O@stanley.mountain Signed-off-by: Takashi Iwai commit 82b13dd5d93d9d170c096f042eb470add22c338c Author: Thorsten Blum Date: Tue Sep 2 10:10:42 2025 +0200 drm/i915: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to improve and simplify set_context_image(), and to silence the following Coccinelle/coccicheck warning reported by memdup_user.cocci: WARNING opportunity for memdup_user No functional changes intended. Signed-off-by: Thorsten Blum Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250902081046.35463-2-thorsten.blum@linux.dev commit 765531faa42ed76d06f959083dae0da3e8c1a529 Author: Mika Kahola Date: Fri Aug 29 13:12:26 2025 +0300 drm/i915/display: Fix possible overflow on tc power domain selection There is a possibility that intel_encoder_to_tc() function returns negative i.e. TC_PORT_NONE (-1) value which may cause tc_port_power_domain() function to overflow. To fix this, let's add additional check that returns invalid power domain i.e. POWER_DOMAIN_INVALID in case tc port equals TC_PORT_NONE. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250829101226.4085757-1-mika.kahola@intel.com commit 61a913644a8c5b6c8bd9da09f78f88e50edfaeb1 Author: Rob Herring (Arm) Date: Fri Aug 15 18:08:39 2025 -0500 ARM: dts: aspeed: Fix/add I2C device vendor prefixes The ASpeed DTS files have various I2C devices with missing or incorrect vendor prefixes in their compatible strings. This hasn't really mattered and doesn't impact ABI compatibility as I2C devices get matched with their vendor prefix stripped. With this, the "maxim,max31790" nodes now validate and have some warnings. Remove the spurious "#address-cells" and "#size-cells" properties to fix the warnings. Signed-off-by: Rob Herring (Arm) [arj: Fix conflicts with fe42f567c387 ("ARM: dts: aspeed: Minor whitespace cleanup")] Signed-off-by: Andrew Jeffery commit 04a3134f88a4bd03001a3093144819523cfca99e Author: Saeed Mahameed Date: Tue Sep 2 22:45:24 2025 -0700 net/mlx5: Add PSP capabilities structures and bits Add mlx5_ifc PSP related capabilities structures and HW definitions needed for PSP support in mlx5. Link: https://lore.kernel.org/netdev/20250828162953.2707727-1-daniel.zahka@gmail.com/ Signed-off-by: Saeed Mahameed commit fe42f567c387964ca5660d66242d30837fc488a2 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:44 2025 +0200 ARM: dts: aspeed: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819131743.86905-2-krzysztof.kozlowski@linaro.org Signed-off-by: Andrew Jeffery commit 4208fac3dce52d4328007028ec88dd5d0e78dcf2 Author: Matthew Brost Date: Fri Aug 29 10:22:32 2025 -0700 drm/xe: Add more SVM GT stats Add more SVM GT stats which give visibility to where time is spent in the SVM page fault handler. Stats include number of faults at a given size, total SVM page fault time, migration time in us, copy time in us, copy kb, get pages time in us, and bind time in us. Will help in tuning SVM for performance. v2: - Include local changes v3: - Add tlb invalidation + valid page fault + per size copy size stats v4: - Ensure gt not NULL when incrementing SVM copy stats - Normalize stats names - Use magic macros to generate increment functions for ranges v7: - Use DEF_STAT_STR (Michal) Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250829172232.1308004-3-matthew.brost@intel.com commit 56e6d568854519ed8e3f57444b8073a32d963fe6 Author: Matthew Brost Date: Fri Aug 29 10:22:31 2025 -0700 drm/xe: Add clearing stats to GT debugfs It helpful to clear GT stats, run a test cases which is being profiled, and look at the results of the stats from the individual test case. Make stats entry writable and upon write clear the stats. v5: - Drop clear_stats debugfs entry (Lucas) v6: - Use xe_gt_stats_clear rather than helper (Michal) - Rework loop in xe_gt_stats_clear (Michal) Signed-off-by: Matthew Brost Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250829172232.1308004-2-matthew.brost@intel.com commit 20ae14024aab6c9b5468e6c056abf397a6fa4aa1 Author: Leo Wang Date: Wed Aug 13 18:04:15 2025 +0800 ARM: dts: aspeed: clemente: add Meta Clemente BMC Add linux device tree entry for Meta Clemente compute-tray BMC using AST2600 SoC. Signed-off-by: Leo Wang Link: https://patch.msgid.link/20250813-add-support-for-meta-clemente-bmc-v11-3-8970d41f88b0@fii-foxconn.com [arj: Fix node ordering and whitespace] Signed-off-by: Andrew Jeffery commit 92a56149f5e60c31d31c7b6060e5270f1cf1b3be Author: Leo Wang Date: Wed Aug 13 18:04:14 2025 +0800 ARM: dts: aspeed: Add NCSI3 and NCSI4 pinctrl nodes Add pinctrl nodes for NCSI3 and NCSI4 to the AST2600 pinctrl description, enabling support for RMII3 and RMII4 interfaces. Signed-off-by: Leo Wang Link: https://patch.msgid.link/20250813-add-support-for-meta-clemente-bmc-v11-2-8970d41f88b0@fii-foxconn.com [arj: Remove 'clemente' from commit subject] Signed-off-by: Andrew Jeffery commit 2c01536aae3e3591f27b945e85fc6b92f789580c Author: Leo Wang Date: Wed Aug 13 18:04:13 2025 +0800 dt-bindings: arm: aspeed: add Meta Clemente board Document the new compatibles used on Meta Clemente. Acked-by: Conor Dooley Signed-off-by: Leo Wang Link: https://patch.msgid.link/20250813-add-support-for-meta-clemente-bmc-v11-1-8970d41f88b0@fii-foxconn.com Signed-off-by: Andrew Jeffery commit 3f3d7dbe3c63716a11211861513222d52655a2cb Author: Peter Yin Date: Thu Aug 28 15:49:53 2025 +0800 ARM: dts: aspeed: harma: add mp5990 Add support for the HSC MP5990 device on the Harma platform. This change updates the device tree to include the MP5990 HSC (Hot Swap Controller), allowing proper configuration and integration with the platform. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250828074955.542711-4-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit c2487598b1fefde51fca06a27111f8630698b0d2 Author: Peter Yin Date: Thu Aug 28 15:49:52 2025 +0800 ARM: dts: aspeed: harma: revise gpio name Update GPIO label definitions in the device tree to reflect the correct power and control signal names. This includes: - Rename "fcb0-activate" to "fcb1-activate" and "fcb2-activate" - Add labels for: - power-p3v3-standby - power-p1v8-good - power-pvdd33-s5 - power-pvdd18-s5 - power-asic-good - power-12v-memory-good - Replace unnamed GPIOs with appropriate labels such as: - irq-pvddcore0-ocp-alert - irq-pvddcore1-ocp-alert Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250828074955.542711-3-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit 7d506a8905590f2741079fb3444be0afacf101b0 Author: Peter Yin Date: Thu Aug 28 15:49:51 2025 +0800 ARM: dts: aspeed: harma: add power monitor support Add INA238 device on I2C bus 4 for the PDB board power monitoring. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250828074955.542711-2-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit 8d6f16f1f082881aa50ea7ae537b604dec647ed6 Author: Tangudu Tilak Tirumalesh Date: Wed Aug 27 12:57:55 2025 -0700 drm/xe: Extend Wa_22021007897 to Xe3 platforms WA 22021007897 should also be applied to Graphics Versions 30.00, 30.01 and 30.03. To make it simple, simply use the range [3000, 3003] that should be ok as there isn't a 3002 and if it's added, the WA list would need to be revisited anyway. Cc: Matt Atwood Cc: Gustavo Sousa Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Matt Atwood Link: https://lore.kernel.org/r/20250827-wa-22021007897-v1-1-96922eb52af4@intel.com Signed-off-by: Lucas De Marchi commit df3a7762ee24ba6a33d4215244e329ca300f4819 Author: Caleb Sander Mateos Date: Tue Sep 2 10:06:56 2025 -0600 io_uring/uring_cmd: add io_uring_cmd_tw_t type alias Introduce a function pointer type alias io_uring_cmd_tw_t for the uring_cmd task work callback. This avoids repeating the signature in several places. Also name both arguments to the callback to clarify what they represent. Signed-off-by: Caleb Sander Mateos Reviewed-by: Keith Busch Link: https://lore.kernel.org/r/20250902160657.1726828-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 8b9c9a2e7da11e50a1109a1f38bca0aecf25b185 Author: Caleb Sander Mateos Date: Tue Sep 2 15:51:07 2025 -0600 io_uring/register: drop redundant submitter_task check For IORING_SETUP_SINGLE_ISSUER io_ring_ctx's, io_register_resize_rings() checks that the current task is the ctx's submitter_task. However, its caller __io_uring_register() already checks this. Drop the redundant check in io_register_resize_rings(). Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250902215108.1925105-1-csander@purestorage.com Signed-off-by: Jens Axboe commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 Author: Qianfeng Rong Date: Tue Sep 2 21:09:30 2025 +0800 block: use int to store blk_stack_limits() return value Change the 'ret' variable in blk_stack_limits() from unsigned int to int, as it needs to store negative value -1. Storing the negative error codes in unsigned type, or performing equality comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 Signed-off-by: Qianfeng Rong Reviewed-by: John Garry Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com Signed-off-by: Jens Axboe commit 1d8f0059091e757973324ae76253c2c059e0810f Merge: 3d95261eeb7495 0dc602a3c7f781 Author: Jakub Kicinski Date: Tue Sep 2 17:45:44 2025 -0700 Merge branch 'net-dsa-lantiq_gswip-prepare-for-supporting-maxlinear-gsw1xx' Daniel Golle says: ==================== net: dsa: lantiq_gswip: prepare for supporting MaxLinear GSW1xx Continue to prepare for supporting the newer standalone MaxLinear GSW1xx switch family by extending the existing lantiq_gswip driver to allow it to support MII interfaces and MDIO bus of the GSW1xx. This series has been preceded by an RFC series which covers everything needed to support the MaxLinear GSW1xx family of switches. Andrew Lunn had suggested to split it into a couple of smaller series and start with the changes which don't yet make actual functional changes or support new features. Everything has been compile and runtime tested on AVM Fritz!Box 7490 (GSWIP version 2.1, VR9 v1.2) Link: https://lore.kernel.org/netdev/aKDhFCNwjDDwRKsI@pidgin.makrotopia.org/ ==================== Link: https://patch.msgid.link/cover.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 0dc602a3c7f781c8358e00d14988eca32d5e95c1 Author: Daniel Golle Date: Sat Aug 30 03:34:48 2025 +0100 net: dsa: lantiq_gswip: move MDIO bus registration to .setup() Instead of registering the switch MDIO bus in the probe() function, move the call to gswip_mdio() into the .setup() DSA switch op, so it can be reused independently of the probe() function. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/2650602042c0bfdc5664b88d59071ed4dca96c26.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 720412c4aebc91fdb6c880353a9465ab36a26614 Author: Daniel Golle Date: Sat Aug 30 03:34:23 2025 +0100 net: dsa: lantiq_gswip: support standard MDIO node name Instead of matching against the child node's compatible string also support locating the node of the device tree node of the MDIO bus in the standard way by referencing the node name ("mdio"). Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Alexander Sverdlin Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/5a9a3d659ef0d8b7eca37fb69ec87ff5a3192820.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 5157820326f34e41d69b6a93d3c1c8302354c024 Author: Daniel Golle Date: Sat Aug 30 03:34:13 2025 +0100 net: dsa: lantiq_gswip: support offset of MII registers The MaxLinear GSW1xx family got a single (R)(G)MII port at index 5 but the registers MII_PCDU and MII_CFG are those of port 0. Allow applying an offset for the port index to access those registers. Signed-off-by: Daniel Golle Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/88145164c1f948e4ae9b04706f408359cf54223c.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 17420a7fe5e260b8f5076b9e9d820da629668f8e Author: Daniel Golle Date: Sat Aug 30 03:33:48 2025 +0100 net: dsa: lantiq_gswip: ignore SerDes modes in phylink_mac_config() We can safely ignore SerDes interface modes 1000Base-X, 2500Base-X and SGMII in phylink_mac_config() as they are being taken care of by the PCS and the SGMII port anyway doesn't have MII_CFG and MII_PCDU registers and hence gswip_phylink_mac_config() is already a no-op apart from outputing a misleading error message. Return early in case of SerDes interface modes to avoid printing that error message. Signed-off-by: Daniel Golle Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/dcb066d6a02e6340314b5ff4f73937757a4f8eb3.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 7a1eaef0a791e017b67c71836f5bb42d669ade28 Author: Daniel Golle Date: Sat Aug 30 03:33:00 2025 +0100 net: dsa: lantiq_gswip: support model-specific mac_select_pcs() Call mac_select_pcs() function if provided in struct gswip_hwinfo. The MaxLinear GSW1xx series got one port wired to a SerDes PCS and PHY which can do 1000Base-X, 2500Base-X and SGMII. Support for the SerDes port will be provided using phylink_pcs, so provide a convenient way for mac_select_pcs() to differ based on the hardware model. Signed-off-by: Daniel Golle Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/7668666aa51e43e7f2a6cbcf36eb5a0a3020998f.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit cb477c30512db29325c0503ba96a6158a61b7e7c Author: Daniel Golle Date: Sat Aug 30 03:32:42 2025 +0100 net: dsa: lantiq_gswip: move to dedicated folder Move the lantiq_gswip driver to its own folder and update MAINTAINERS file accordingly. This is done ahead of extending the driver to support the MaxLinear GSW1xx series of standalone switch ICs, which includes adding a bunch of files. Signed-off-by: Daniel Golle Reviewed-by: Hauke Mehrtens Link: https://patch.msgid.link/a5923dee9a174501b284dc473bdec9dd89c68de1.1756520811.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 30e919570581235907d330f5308e498c12ccb10f Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:37 2025 +0200 PCI: dw-rockchip: Switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over. Like many other Rockchip drivers, pcie-dw-rockchip brings with it its very own flavour of HIWORD_UPDATE. It's occasionally used without a constant mask, which complicates matters. HIWORD_UPDATE_BIT is a confusingly named addition, as it doesn't update the bit, it actually sets all bits in the value to 1. HIWORD_DISABLE_BIT is similarly confusing; it disables several bits at once by using the value as a mask and the inverse of value as the value, and the "disabling only these" effect comes from the hardware actually using the mask. The more obvious approach would've been HIWORD_UPDATE(val, 0) in my opinion. This is part of the motivation why this patch uses hw_bitfield.h's FIELD_PREP_WM16 instead, where possible. FIELD_PREP_WM16 requires a constant bit mask, which isn't possible where the irq number is used to generate a bit mask. For that purpose, we replace it with a more robust macro than what was there but that should also bring close to zero runtime overhead: we actually mask the IRQ number to make sure we're not writing garbage. For the remaining bits, there also are some caveats. For starters, the PCIE_CLIENT_ENABLE_LTSSM and PCIE_CLIENT_DISABLE_LTSSM were named in a manner that isn't quite truthful to what they do. Their modification actually spans not just the LTSSM bit but also another bit, flipping only the LTSSM one, but keeping the other (which according to the TRM has a reset value of 0) always enabled. This other bit is reserved as of the IP version RK3588 uses at least, and I have my doubts as to whether it was meant to be set, and whether it was meant to be set in that code path. Either way, it's confusing. Replace it with just writing either 1 or 0 to the LTSSM bit, using the new FIELD_PREP_WM16 macro from hw_bitfield.h, which grants us the benefit of better compile-time error checking. The change of no longer setting the reserved bit doesn't appear to change the behaviour on RK3568 in RC mode, where it's not marked as reserved. PCIE_CLIENT_RC_MODE/PCIE_CLIENT_EP_MODE was another field that wasn't super clear on what the bit field modification actually is. As far as I can tell, switching to RC mode doesn't actually write the correct value to the field if any of its bits have been set previously, as it only updates one bit of a 4 bit field. Replace it by actually writing the full values to the field, using the new FIELD_PREP_WM16 macro, which grants us the benefit of better compile-time error checking. This patch was tested on RK3588 (PCIe3 x4 controller), RK3576 (PCIe2 x1 controller) and RK3568 (PCIe x2 controller), all in RC mode. Acked-by: Bjorn Helgaas Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit eb0bf4f097c3b9236de1ad7a313f171ce501313a Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:36 2025 +0200 PCI: rockchip: Switch to FIELD_PREP_WM16* macros The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. The Rockchip PCI driver, like many other Rockchip drivers, has its very own definition of HIWORD_UPDATE. Remove it, and replace its usage with either FIELD_PREP_WM16, or two new header local macros for setting/clearing a bit with the high mask, which use FIELD_PREP_WM16_CONST internally. In the process, ENCODE_LANES needed to be adjusted, as FIELD_PREP_WM16* shifts the value for us. That this is equivalent was verified by first making all FIELD_PREP_WM16 instances FIELD_PREP_WM16_CONST, then doing a static_assert() comparing it to the old macro (and for those with parameters, static_asserting for the full range of possible values with the old encode macro). What we get out of this is compile time error checking to make sure the value actually fits in the mask, and that the mask fits in the register, and also generally less icky code that writes shifted values when it actually just meant to set and clear a handful of bits. Acked-by: Bjorn Helgaas Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit a785472bb0c2af5bd713c9f2d7cf45657cb3e7bf Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:35 2025 +0200 net: stmmac: dwmac-rk: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Like many other Rockchip drivers, dwmac-rk has its own HIWORD_UPDATE macro. Its semantics allow us to redefine it as a wrapper to the shared hw_bitfield.h FIELD_PREP_WM16 macros though. Replace the implementation of this driver's very own HIWORD_UPDATE macro with an instance of FIELD_PREP_WM16 from hw_bitfield.h. This keeps the diff easily reviewable, while giving us more compile-time error checking. The related GRF_BIT macro is left alone for now; any attempt to rework the code to not use its own solution here would likely end up harder to review and less pretty for the time being. Signed-off-by: Nicolas Frattaroli Acked-by: Jakub Kicinski Acked-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 3d1ef6e4a154460cb75aacc4d3b77f7212b3c542 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:34 2025 +0200 ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Replace the implementation of this driver's HIWORD_UPDATE macro with an instance of FIELD_PREP_WM16_CONST. The const variant is chosen here because some of the header defines are then used in initializers. This gives us some compile-time error checking, while keeping the diff very small and easy to review. Acked-by: Mark Brown Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 63df37f3fc71dd3587d4d40605e608fa489f5f48 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:33 2025 +0200 drm/rockchip: dw_hdmi: switch to FIELD_PREP_WM16* macros The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Remove this driver's very own HIWORD_UPDATE macro, and replace all instances of it with equivalent instantiations of FIELD_PREP_WM16 or FIELD_PREP_WM16_CONST, depending on whether it's in an initializer. This gives us better error checking, and a centrally agreed upon signature for this macro, to ease in code comprehension. Because FIELD_PREP_WM16/FIELD_PREP_WM16_CONST shifts the value to the mask (like FIELD_PREP et al do), a lot of macro instantiations get easier to read. This was tested on an RK3568 ODROID M1, as well as an RK3399 ROCKPro64. Reviewed-by: Cristian Ciocaltea Tested-by: Cristian Ciocaltea Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit a104de64bfbc616042322c699fe96d05a431caab Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:32 2025 +0200 phy: rockchip-usb: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Remove this driver's HIWORD_UPDATE macro, and replace all instances of it with (hopefully) equivalent FIELD_PREP_WM16 instances. To do this, a few of the defines are being adjusted, as FIELD_PREP_WM16 shifts up the value for us. This gets rid of the icky update(mask, mask) shenanigans. The benefit of using FIELD_PREP_WM16 is that it does more checking of the input, hopefully catching errors. In practice, a shared definition makes code more readable than several different flavours of the same macro, and the shifted value helps as well. I do not have the hardware that uses this particular driver, so it's compile-tested only as far as my own testing goes. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 6fd524c3f85902797067cd41ffd45e91e8e997b7 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:31 2025 +0200 drm/rockchip: inno-hdmi: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. The inno-hdmi driver's own HIWORD_UPDATE macro is instantiated only twice. Remove it, and replace its uses with FIELD_PREP_WM16. Since FIELD_PREP_WM16 shifts the value for us, we replace using the mask as the value by simply using 1 instead. With the new FIELD_PREP_WM16 macro, we gain better error checking and a central shared definition. This has been compile-tested only as I lack hardware this old, but the change is trivial enough that I am fairly certain it's equivalent. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit ad24f6e10a5f518acf45a12dce502f090a8858ed Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:30 2025 +0200 drm/rockchip: dw_hdmi_qp: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Replace this driver's HIWORD_UPDATE with the FIELD_PREP_WM16 macro from hw_bitfield.h. While at it, disambiguate the GRF write to SOC_CON7 by splitting the definition into the individual bitflags. This is done because FIELD_PREP_WM16 shifts the value for us according to the mask, so writing the mask to itself to enable two bits is no longer something that can be done. It should also not be done anyway because it hides the true meaning of those two individual bit flags. HDMI output with this patch has been tested on both RK3588 and RK3576. On the former, with both present HDMI connectors. Reviewed-by: Cristian Ciocaltea Tested-by: Cristian Ciocaltea Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit d6de45fd7f1c8ef9f03fd16a97959e42271c3f78 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:29 2025 +0200 phy: rockchip-samsung-dcphy: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. phy-rockchip-samsung-dcphy is actually an exemplary example, where the similarities to FIELD_PREP were spotted and the driver local macro has the same semantics as the new FIELD_PREP_WM16 hw_bitfield.h macro. Still, get rid of FIELD_PREP_HIWORD now that a shared implementation exists, replacing the two instances of it with FIELD_PREP_WM16. This gives us slightly better error checking; the value is now checked to fit in 16 bits. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 9040ecd0bf9ba0045736525027e30bdf56705b01 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:28 2025 +0200 drm/rockchip: vop2: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Remove VOP2's HIWORD_UPDATE macro from the vop2 header file, and replace all instances in rockchip_vop2_reg.c (the only user of this particular HIWORD_UPDATE definition) with equivalent FIELD_PREP_WM16 instances. This gives us better error checking. Reviewed-by: Cristian Ciocaltea Tested-by: Cristian Ciocaltea Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 1a99efa3a5164c9bb1309fd81c6d235d41f0d727 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:27 2025 +0200 drm/rockchip: dsi: switch to FIELD_PREP_WM16* macros The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Remove this driver's HIWORD_UPDATE macro, and replace instances of it with either FIELD_PREP_WM16 or FIELD_PREP_WM16_CONST, depending on whether they're in an initializer. This gives us better error checking, which already saved me some trouble during this refactor. The driver's HIWORD_UPDATE macro doesn't shift up the value, but expects a pre-shifted value. Meanwhile, FIELD_PREP_WM16 and FIELD_PREP_WM16_CONST will shift the value for us, based on the given mask. So a few things that used to be a HIWORD_UPDATE(VERY_LONG_FOO, VERY_LONG_FOO) are now a somewhat more pleasant FIELD_PREP_WM16(VERY_LONG_FOO, 1). There are some non-trivial refactors here. A few literals needed a UL suffix added to stop them from unintentionally overflowing as a signed long. To make sure all of these cases are caught, and not just the ones where the FIELD_PREP_WM16* macros use such a value as a mask, just mark every literal that's used as a mask as unsigned. Non-contiguous masks also have to be split into multiple FIELD_PREP_WM16* instances, as the macro's checks and shifting logic rely on contiguous masks. This is compile-tested only. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 48d47732c29bf8002f41c275adacd63d033ef6d2 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:26 2025 +0200 phy: rockchip-emmc: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Replace the implementation of the rockchip eMMC PHY driver's HIWORD_UPDATE macro with hw_bitfield.h's FIELD_PREP_WM16. This makes the change more easily reviewable. Signed-off-by: Nicolas Frattaroli Acked-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit dcdcfd83b7b09f653dfddf89af206c6a9d4fbd62 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:25 2025 +0200 drm/rockchip: lvds: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Remove rockchip_lvds.h's own HIWORD_UPDATE macro, and replace all instances of it with hw_bitfield.h's FIELD_PREP_WM16 macro, which gives us more error checking. For the slightly-less-trivial case of the 2-bit width instance, the results were checked during development to match all possible input values (0 to 3, inclusive). Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 7d5f75a9d413de35c376597ead4174081373644b Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:24 2025 +0200 media: synopsys: hdmirx: replace macros with bitfield variants The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Replace the UPDATE macro with bitfield.h's FIELD_PREP, to give us additional error checking. Also, replace the HIWORD_UPDATE macro at the same time with the new FIELD_PREP_WM16 macro in hw_bitfield.h, which also gives us additional error checking. The UPDATE/HIWORD_UPDATE macros are left as wrappers around the replacement macros, in order to not rock the boat too much, and keep the changes easy to review. Yury: drop extra parens around FIELD_PREPs (Dmitry) Signed-off-by: Nicolas Frattaroli Acked-by: Dmitry Osipenko Acked-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 3d95261eeb74958cd496e1875684827dc5d028cc Author: Yue Haibing Date: Mon Sep 1 20:37:26 2025 +0800 ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled, idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is zero, but if one of the values is negative it will in fact return non-zero. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 90fbf6a21ec433b329c207f5ff542a20081b7fa5 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:23 2025 +0200 soc: rockchip: grf: switch to FIELD_PREP_WM16_CONST macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Switch the rockchip grf driver to the FIELD_PREP_WM16_CONST macro, which brings with it more error checking while still being able to be used in initializers. All HIWORD_UPDATE instances and its definition are removed from the driver, as the conversion here is obvious, and static_asserts were used during development to make sure the ones greater than one bit in width were really equivalent. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 47975a878c06691dc9658f0680f850a2d45c9f83 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:22 2025 +0200 mmc: dw_mmc-rockchip: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Switch to the new FIELD_PREP_WM16 macro in hw_bitfield.h, which has error checking. Instead of redefining the driver's HIWORD_UPDATE macro in this case, replace the two only instances of it with the new macro, as I could test that they result in an equivalent value. Acked-by: Ulf Hansson Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit 21368fcbb124d51b5d8bd8fa0a286a23c34a0888 Author: Nicolas Frattaroli Date: Mon Aug 25 10:28:21 2025 +0200 bitmap: introduce hardware-specific bitfield operations Hardware of various vendors, but very notably Rockchip, often uses 32-bit registers where the upper 16-bit half of the register is a write-enable mask for the lower half. This type of hardware setup allows for more granular concurrent register write access. Over the years, many drivers have hand-rolled their own version of this macro, usually without any checks, often called something like HIWORD_UPDATE or FIELD_PREP_HIWORD, commonly with slightly different semantics between them. Clearly there is a demand for such a macro, and thus the demand should be satisfied in a common header file. As this is a convention that spans across multiple vendors, and similar conventions may also have cross-vendor adoption, it's best if it lives in a vendor-agnostic header file that can be expanded over time. Add hw_bitfield.h with two macros: FIELD_PREP_WM16, and FIELD_PREP_WM16_CONST. The latter is a version that can be used in initializers, like FIELD_PREP_CONST. Suggested-by: Yury Norov (NVIDIA) Signed-off-by: Nicolas Frattaroli Acked-by: Jakub Kicinski Acked-by: Heiko Stuebner Signed-off-by: Yury Norov (NVIDIA) commit b0bc64512295f6a613fab42452bd7e2cf72c6b61 Author: Zongmin Zhou Date: Mon Sep 1 13:45:57 2025 +0800 selftests: net: avoid memory leak The buffer be used without free,fix it to avoid memory leak. Signed-off-by: Zongmin Zhou Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901054557.32811-1-min_halo@163.com Signed-off-by: Jakub Kicinski commit 3586018d5c3da14addcd033b6da5a1a209a0992d Author: Chandra Mohan Sundar Date: Mon Sep 1 21:59:19 2025 +0530 net: macb: Validate the value of base_time properly In macb_taprio_setup_replace(), the value of start_time is being compared against zero which would never be true since start_time is an unsigned value. Due to this there is a chance that an incorrect config base time value can be used for computation. Fix by checking the value of conf->base_time directly. This issue was reported by static coverity analyzer. Fixes: 89934dbf169e3 ("net: macb: Add TAPRIO traffic scheduling support") Signed-off-by: Chandra Mohan Sundar Reviewed-by: Vineeth Karumanchi Link: https://patch.msgid.link/20250901162923.627765-1-chandramohan.explore@gmail.com Signed-off-by: Jakub Kicinski commit e2cf2d5baa09248d3d50b73522594b778388e3bc Author: Jakub Kicinski Date: Mon Sep 1 10:31:39 2025 -0700 selftests: drv-net: rss_ctx: make the test pass with few queues rss_ctx.test_rss_key_indir implicitly expects at least 5 queues, as it checks that the traffic on first 2 queues is lower than the remaining queues when we use all queues. Special case fewer queues. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901173139.881070-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4022f92a2e4e9e7d5da06b9389a8dd43950ce1ea Author: Jakub Kicinski Date: Mon Sep 1 10:31:38 2025 -0700 selftests: drv-net: rss_ctx: use Netlink for timed reconfig The rss_ctx test has gotten pretty flaky after I increased the queue count in NIPA 2->3. Not 100% clear why. We get a lot of failures in the rss_ctx.test_hitless_key_update case. Looking closer it appears that the failures are mostly due to startup costs. I measured the following timing for ethtool -X: - python cmd(shell=True) : 150-250msec - python cmd(shell=False) : 50- 70msec - timed in bash : 45- 55msec - YNL Netlink call : 2- 4msec - .set_rxfh callback : 1- 2msec The target in the test was set to 200msec. We were mostly measuring ethtool startup cost it seems. Switch to YNL since it's 100x faster. Lower the pass criteria to 150msec, no real science behind this number but we removed some overhead, drivers which previously passed 200msec should easily pass 150msec now. Separately we should probably follow up on defaulting to shell=False, when script doesn't explicitly ask for True, because the overhead is rather significant. Switch from _rss_key_rand() to random.randbytes(), YNL takes a binary array rather than array of ints. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901173139.881070-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f1f486b841c73e94167956e1885f865cac4e629f Author: Al Viro Date: Thu Aug 21 22:53:06 2025 -0400 finish_automount(): use __free() to deal with dropping mnt on failure same story as with do_new_mount_fc(). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 308a022f41bd3f12ceeda34f6d36bf8f2601d9ae Author: Al Viro Date: Thu Aug 21 22:43:32 2025 -0400 do_new_mount_fc(): use __free() to deal with dropping mnt on failure do_add_mount() consumes vfsmount on success; just follow it with conditional retain_and_null_ptr() on success and we can switch to __free() for mnt and be done with that - unlock_mount() is in the very end. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9bf5d488529b9efa01bd292633482acd10277b90 Author: Al Viro Date: Fri Aug 22 12:59:10 2025 -0400 finish_automount(): take the lock_mount() analogue into a helper finish_automount() can't use lock_mount() - it treats finding something already mounted as "quitely drop our mount and return 0", not as "mount on top of whatever mounted there". It's been open-coded; let's take it into a helper similar to lock_mount(). "something's already mounted" => -EBUSY, finish_automount() needs to distinguish it from the normal case and it can't happen in other failure cases. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6bbbc4a04a10ebdb633501dc87aac5b0d6b80ec8 Author: Al Viro Date: Thu Aug 21 22:40:14 2025 -0400 pivot_root(2): use __free() to deal with struct path in it preparations for making unlock_mount() a __cleanup(); can't have path_put() inside mount_lock scope. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 76dfde13d68a2a6e6c2409407558ee908491df36 Author: Al Viro Date: Thu Aug 21 22:28:51 2025 -0400 do_loopback(): use __free(path_put) to deal with old_path preparations for making unlock_mount() a __cleanup(); can't have path_put() inside mount_lock scope. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 11941610b06820c4af7f1ff12071f159b3bf771d Author: Al Viro Date: Fri Aug 22 13:07:43 2025 -0400 finish_automount(): simplify the ELOOP check It's enough to check that dentries match; if path->dentry is equal to m->mnt_root, superblocks will match as well. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d29da1a8f119130e6fc7d5d71029d402dabe2cb0 Author: Al Viro Date: Tue Aug 19 23:54:39 2025 -0400 move_mount(2): take sanity checks in 'beneath' case into do_lock_mount() We want to mount beneath the given location. For that operation to make sense, location must be the root of some mount that has something under it. Currently we let it proceed if those requirements are not met, with rather meaningless results, and have that bogosity caught further down the road; let's fail early instead - do_lock_mount() doesn't make sense unless those conditions hold, and checking them there makes things simpler. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit c1ab70be88f3135cdb931673aae2afc5d6624b62 Author: Al Viro Date: Wed Aug 20 14:50:09 2025 -0400 do_move_mount(): deal with the checks on old_path early 1) checking that location we want to move does point to root of some mount can be done before anything else; that property is not going to change and having it already verified simplifies the analysis. 2) checking the type agreement between what we are trying to move and what we are trying to move it onto also belongs in the very beginning - do_lock_mount() might end up switching new_path to something that overmounts the original location, but... the same type agreement applies to overmounts, so we could just as well check against the original location. 3) since we know that old_path->dentry is the root of old_path->mnt, there's no point bothering with path_is_overmounted() in can_move_mount_beneath(); it's simply a check for the mount we are trying to move having non-NULL ->overmount. And with that, we can switch can_move_mount_beneath() to taking old instead of old_path, leaving no uses of old_path past the original checks. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a666bbcf7e9c5e0524b60677a0a43a4cddedcefd Author: Al Viro Date: Tue Aug 19 21:34:03 2025 -0400 do_move_mount(): trim local variables Both 'parent' and 'ns' are used at most once, no point precalculating those... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 5423426a79dd4d4422750b063febed40f362afcc Author: Al Viro Date: Tue Aug 26 13:57:42 2025 -0400 switch do_new_mount_fc() to fc_mount() Prior to the call of do_new_mount_fc() the caller has just done successful vfs_get_tree(). Then do_new_mount_fc() does several checks on resulting superblock, and either does fc_drop_locked() and returns an error or proceeds to unlock the superblock and call vfs_create_mount(). The thing is, there's no reason to delay that unlock + vfs_create_mount() - the tests do not rely upon the state of ->s_umount and fc_drop_locked() put_fs_context() is equivalent to unlock ->s_umount put_fs_context() Doing vfs_create_mount() before the checks allows us to move vfs_get_tree() from caller to do_new_mount_fc() and collapse it with vfs_create_mount() into an fc_mount() call. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8281f98a68d3306b2e47e6bb00708525562ccfdf Author: Al Viro Date: Thu Aug 21 21:02:06 2025 -0400 current_chrooted(): use guards here a use of __free(path_put) for dropping fs_root is enough to make guard(mount_locked_reader) fit... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6b6516c56b04d556ce57deab1b8c2833e4af26c6 Author: Al Viro Date: Wed Jul 2 01:39:45 2025 -0400 current_chrooted(): don't bother with follow_down_one() All we need here is to follow ->overmount on root mount of namespace... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2aec880c1cdf1cf2dab931b4dd8744c415311bc9 Author: Al Viro Date: Thu Aug 21 20:48:38 2025 -0400 path_is_under(): use guards ... and document that locking requirements for is_path_reachable(). There is one questionable caller in do_listmount() where we are not holding mount_lock *and* might not have the first argument mounted. However, in that case it will immediately return true without having to look at the ancestors. Might be cleaner to move the check into non-LSTM_ROOT case which it really belongs in - there the check is not always true and is_mounted() is guaranteed. Document the locking environments for is_path_reachable() callers: get_peer_under_root() get_dominating_id() do_statmount() do_listmount() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2605d8684320e6c09e56743e66ecac8ae581b464 Author: Al Viro Date: Wed Aug 20 21:58:03 2025 -0400 mnt_set_expiry(): use guards The reason why it needs only mount_locked_reader is that there's no lockless accesses of expiry lists. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit f80b84358f65167546b6cd58f867ef5669f22f3d Author: Al Viro Date: Wed Aug 20 21:48:35 2025 -0400 has_locked_children(): use guards ... and document the locking requirements of __has_locked_children() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 511db073b2150388dd05258ca2d7045dd0784033 Author: Al Viro Date: Wed Aug 20 21:40:07 2025 -0400 propagate_mnt(): use scoped_guard(mount_locked_reader) for mnt_set_mountpoint() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 6b448d7a7c4848fd6cbe0eee49834df7d25b25f8 Author: Al Viro Date: Wed Aug 20 20:28:35 2025 -0400 check_for_nsfs_mounts(): no need to take locks Currently we are taking mount_writer; what that function needs is either mount_locked_reader (we are not changing anything, we just want to iterate through the subtree) or namespace_shared and a reference held by caller on the root of subtree - that's also enough to stabilize the topology. The thing is, all callers are already holding at least namespace_shared as well as a reference to the root of subtree. Let's make the callers provide locking warranties - don't mess with mount_lock in check_for_nsfs_mounts() itself and document the locking requirements. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 747e91e5b7396eba699989072c61e8fb076bbea4 Author: Al Viro Date: Wed Aug 20 20:24:23 2025 -0400 mnt_already_visible(): use guards clean fit; namespace_shared due to iterating through ns->mounts. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 61e68af33ac7977ea2457a861ab8eeb2406cb3f1 Author: Al Viro Date: Wed Aug 20 20:22:10 2025 -0400 put_mnt_ns(): use guards clean fit; guards can't be weaker due to umount_tree() call. Setting emptied_ns requires namespace_excl, but not anything mount_lock-related. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 550dda45df9e54d6b0cd34456f5987e0c7d7522a Author: Al Viro Date: Wed Aug 20 20:20:44 2025 -0400 mark_mounts_for_expiry(): use guards Clean fit; guards can't be weaker due to umount_tree() calls. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7b99ee2c5c83b2df03c50bb2d61bdceb76189352 Author: Al Viro Date: Wed Aug 20 20:19:05 2025 -0400 do_set_group(): use guards clean fit; namespace_excl to modify propagation graph Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 12cdd1af7a6d123fc4690bae1807d8c90c5c5580 Author: Al Viro Date: Wed Aug 20 20:16:46 2025 -0400 do_change_type(): use guards clean fit; namespace_excl to modify propagation graph Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 4151c3cc58698584e8b0427c40eeda671c3e08c6 Author: Al Viro Date: Wed Aug 20 20:14:22 2025 -0400 __is_local_mountpoint(): use guards clean fit; namespace_shared due to iterating through ns->mounts. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 902e9904672bedcb25c6740d5c1d09e17de807eb Author: Al Viro Date: Wed Aug 20 20:12:47 2025 -0400 __detach_mounts(): use guards Clean fit for guards use; guards can't be weaker due to umount_tree() calls. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 547af12dcd43851a4894ffc3c60e381ab9f0f5e7 Author: Al Viro Date: Sat Aug 23 02:06:57 2025 -0400 fs/namespace.c: allow to drop vfsmount references via __free(mntput) Note that just as path_put, it should never be done in scope of namespace_sem, be it shared or exclusive. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d154f185758994ea2cc2c15575a3653334562184 Author: Al Viro Date: Wed Aug 20 19:54:45 2025 -0400 introduced guards for mount_lock mount_writer: write_seqlock; that's an equivalent of {un,}lock_mount_hash() mount_locked_reader: read_seqlock_excl; these tend to be open-coded. No bulk conversions, please - if nothing else, quite a few places take use mount_writer form when mount_locked_reader is sufficent. It needs to be dealt with carefully. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 360600f8ec635c3d47789ade3d3c120c88981343 Author: Al Viro Date: Wed Aug 20 19:05:21 2025 -0400 fs/namespace.c: fix the namespace_sem guard mess If anything, namespace_lock should be DEFINE_LOCK_GUARD_0, not DEFINE_GUARD. That way we * do not need to feed it a bogus argument * do not get gcc trying to compare an address of static in file variable with -4097 - and, if we are unlucky, trying to keep it in a register, with spills and all such. The same problems apply to grabbing namespace_sem shared. Rename it to namespace_excl, add namespace_shared, convert the existing users: guard(namespace_lock, &namespace_sem) => guard(namespace_excl)() guard(rwsem_read, &namespace_sem) => guard(namespace_shared)() scoped_guard(namespace_lock, &namespace_sem) => scoped_guard(namespace_excl) scoped_guard(rwsem_read, &namespace_sem) => scoped_guard(namespace_shared) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a3fecb9160482367365cc384c59dd220b162b066 Author: Kees Cook Date: Sat Aug 30 19:23:53 2025 -0700 arc: Fix __fls() const-foldability via __builtin_clzl() While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results). For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent. Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug. Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0. Link: https://github.com/KSPP/linux/issues/364 [1] Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3] Signed-off-by: Kees Cook Acked-by: Vineet Gupta Signed-off-by: Yury Norov (NVIDIA) commit bc1a767f695d597de529f4f0c6fff1d55f1b5395 Author: Jakub Kicinski Date: Sat Aug 30 11:43:17 2025 -0700 selftests: net: py: don't default to shell=True Overhead of using shell=True is quite significant. Micro-benchmark of running ethtool --help shows that non-shell run is 2x faster. Runtime of the XDP tests also shows improvement: this patch: 2m34s 2m21s 2m18s 2m18s before: 2m54s 2m36s 2m34s Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20250830184317.696121-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c2e5108649ab8dec599d074b7ea344e61efa5eee Author: Jakub Kicinski Date: Sat Aug 30 11:43:16 2025 -0700 selftests: drv-net: adjust tests before defaulting to shell=False Clean up tests which expect shell=True without explicitly passing that param to cmd(). There seems to be only one such case, and in fact it's better converted to a direct write. Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20250830184317.696121-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5d14bbf9d1d90cb7ca3e46fe2c8a4277572eab94 Author: Eric Dumazet Date: Mon Sep 1 09:31:41 2025 +0000 net_sched: act: remove tcfa_qstats tcfa_qstats is currently only used to hold drops and overlimits counters. tcf_action_inc_drop_qstats() and tcf_action_inc_overlimit_qstats() currently acquire a->tcfa_lock to increment these counters. Switch to two atomic_t to get lock-free accounting. Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20250901093141.2093176-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3016024d7514e953cb3a6715ce29799373512eb4 Author: Eric Dumazet Date: Mon Sep 1 09:26:07 2025 +0000 net_sched: add back BH safety to tcf_lock Jamal reported that we had to use BH safety after all, because stats can be updated from BH handler. Fixes: 3133d5c15cb5 ("net_sched: remove BH blocking in eight actions") Fixes: 53df77e78590 ("net_sched: act_skbmod: use RCU in tcf_skbmod_dump()") Fixes: e97ae742972f ("net_sched: act_tunnel_key: use RCU in tunnel_key_dump()") Fixes: 48b5e5dbdb23 ("net_sched: act_vlan: use RCU in tcf_vlan_dump()") Reported-by: Jamal Hadi Salim Closes: https://lore.kernel.org/netdev/CAM0EoMmhq66EtVqDEuNik8MVFZqkgxFbMu=fJtbNoYD7YXg4bA@mail.gmail.com/ Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20250901092608.2032473-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 23313771c7b99b3b8dba169bc71dae619d41ab56 Author: Breno Leitao Date: Mon Sep 1 03:00:07 2025 -0700 net: selftests: clean up tools/testing/selftests/net/lib/py/utils.py This patch improves the utils.py module by removing unused imports (errno, random), simplifying the fd_read_timeout() function by eliminating unnecessary else clause, and cleaning up code style in the defer class constructor. Additionally, it renames the parameter in rand_port() from 'type' to 'stype' to avoid shadowing the built-in Python name 'type', improving code clarity and preventing potential issues. These changes enhance code readability and maintainability without affecting functionality. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901-fix-v1-1-df0abb67481e@debian.org Signed-off-by: Jakub Kicinski commit e99ecbc4c89adf551cccbbc00b5cb08c50969af6 Author: Dave Jiang Date: Fri Aug 29 15:29:07 2025 -0700 acpi/hmat: Remove now unused hmat_update_target_coordinates() Remove deadcode since CXL no longer calls hmat_update_target_coordinates(). Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250829222907.1290912-5-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 2e454fb8056df6da4bba7d89a57bf60e217463c0 Author: Dave Jiang Date: Fri Aug 29 15:29:06 2025 -0700 cxl, acpi/hmat: Update CXL access coordinates directly instead of through HMAT The current implementation of CXL memory hotplug notifier gets called before the HMAT memory hotplug notifier. The CXL driver calculates the access coordinates (bandwidth and latency values) for the CXL end to end path (i.e. CPU to endpoint). When the CXL region is onlined, the CXL memory hotplug notifier writes the access coordinates to the HMAT target structs. Then the HMAT memory hotplug notifier is called and it creates the access coordinates for the node sysfs attributes. During testing on an Intel platform, it was found that although the newly calculated coordinates were pushed to sysfs, the sysfs attributes for the access coordinates showed up with the wrong initiator. The system has 4 nodes (0, 1, 2, 3) where node 0 and 1 are CPU nodes and node 2 and 3 are CXL nodes. The expectation is that node 2 would show up as a target to node 0: /sys/devices/system/node/node2/access0/initiators/node0 However it was observed that node 2 showed up as a target under node 1: /sys/devices/system/node/node2/access0/initiators/node1 The original intent of the 'ext_updated' flag in HMAT handling code was to stop HMAT memory hotplug callback from clobbering the access coordinates after CXL has injected its calculated coordinates and replaced the generic target access coordinates provided by the HMAT table in the HMAT target structs. However the flag is hacky at best and blocks the updates from other CXL regions that are onlined in the same node later on. Remove the 'ext_updated' flag usage and just update the access coordinates for the nodes directly without touching HMAT target data. The hotplug memory callback ordering is changed. Instead of changing CXL, move HMAT back so there's room for the levels rather than have CXL share the same level as SLAB_CALLBACK_PRI. The change will resulting in the CXL callback to be executed after the HMAT callback. With the change, the CXL hotplug memory notifier runs after the HMAT callback. The HMAT callback will create the node sysfs attributes for access coordinates. The CXL callback will write the access coordinates to the now created node sysfs attributes directly and will not pollute the HMAT target values. A nodemask is introduced to keep track if a node has been updated and prevents further updates. Fixes: 067353a46d8c ("cxl/region: Add memory hotplug notifier for cxl region") Cc: stable@vger.kernel.org Tested-by: Marc Herbert Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250829222907.1290912-4-dave.jiang@intel.com Signed-off-by: Dave Jiang commit b57fc652ca24ada3b0c888327f9944ed21559286 Author: Dave Jiang Date: Fri Aug 29 15:29:05 2025 -0700 drivers/base/node: Add a helper function node_update_perf_attrs() Add helper function node_update_perf_attrs() to allow update of node access coordinates computed by an external agent such as CXL. The helper allows updating of coordinates after the attribute being created by HMAT. Acked-by: David Hildenbrand Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250829222907.1290912-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 65128868bb3b0621d2d8e71f19852675a064b373 Author: Dave Jiang Date: Fri Aug 29 15:29:04 2025 -0700 mm/memory_hotplug: Update comment for hotplug memory callback priorities Add clarification to comment for memory hotplug callback ordering as the current comment does not provide clear language on which callback happens first. Acked-by: David Hildenbrand Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250829222907.1290912-2-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 1e6d36e15b8873fc3ade8b714d35d69efd5e1427 Author: Gustavo A. R. Silva Date: Fri Aug 29 11:58:21 2025 +0200 drm/amdgpu/amdkfd: Avoid a couple hundred -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declarations to the end of the corresponding structures. Notice that `struct dev_pagemap` is a flexible structure, this is a structure that contains a flexible-array member. struct dev_pagemap always has room for at least one range. amdgpu only uses a single range. Therefore no change are needed to the allocation of struct amdgpu_device. Fix 283 of the following type of warnings: 283 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h:111:28: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit d250f14f5f0754ce2d05d9c0ce778e4a51f488b0 Author: James Flowers Date: Sun Aug 31 20:04:59 2025 -0700 net/smc: Replace use of strncpy on NUL-terminated string with strscpy strncpy is deprecated for use on NUL-terminated strings, as indicated in Documentation/process/deprecated.rst. strncpy NUL-pads the destination buffer and doesn't guarantee the destination buffer will be NUL terminated. Signed-off-by: James Flowers Reviewed-by: Simon Horman Reviewed-by: Dust Li Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20250901030512.80099-1-bold.zone2373@fastmail.com Signed-off-by: Jakub Kicinski commit 99502c61e80c18dca754bace42b40fa289a79895 Author: Russell King (Oracle) Date: Sun Aug 31 18:01:51 2025 +0100 net: mvpp2: add xlg pcs inband capabilities Add PCS inband capabilities for XLG in the Marvell PP2 driver, so phylink knows that 5G and 10G speeds have no inband capabilities. Signed-off-by: Russell King (Oracle) Reviewed-by: Daniel Golle Link: https://patch.msgid.link/E1uslR9-00000001OxL-44CD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 23a6037ce76cb44d93cfea23aec5c7f3971227d4 Author: Jay Vosburgh Date: Fri Aug 29 17:08:37 2025 -0700 bonding: Remove support for use_carrier Remove the implementation of use_carrier, the link monitoring method that utilizes ethtool or ioctl to determine the link state of an interface in a bond. Bonding will always behaves as if use_carrier=1, which relies on netif_carrier_ok() to determine the link state of interfaces. To avoid acquiring RTNL many times per second, bonding inspects link state under RCU, but not under RTNL. However, ethtool implementations in drivers may sleep, and therefore this strategy is unsuitable for use with calls into driver ethtool functions. The use_carrier option was introduced in 2003, to provide backwards compatibility for network device drivers that did not support the then-new netif_carrier_ok/on/off system. Device drivers are now expected to support netif_carrier_*, and the use_carrier backwards compatibility logic is no longer necessary. The option itself remains, but when queried always returns 1, and may only be set to 1. Link: https://lore.kernel.org/000000000000eb54bf061cfd666a@google.com Link: https://lore.kernel.org/20240718122017.d2e33aaac43a.I10ab9c9ded97163aef4e4de10985cd8f7de60d28@changeid Signed-off-by: Jay Vosburgh Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/2029487.1756512517@famine Signed-off-by: Jakub Kicinski commit ad83b1da5b786ee2d245e41ce55cb1c71fed7c22 Author: Zhanjun Dong Date: Fri Aug 29 12:04:27 2025 -0400 drm/xe/guc: Increase GuC crash dump buffer size There are platforms already have a maximum dump size of 12KB, to avoid data truncating, increase GuC crash dump buffer size to 16KB. Signed-off-by: Zhanjun Dong Reviewed-by: Stuart Summers Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250829160427.1245732-1-zhanjun.dong@intel.com commit c872b6279cd26762339ff02513e2a3f16149a6f1 Author: Jaegeuk Kim Date: Wed Aug 27 21:50:29 2025 +0000 f2fs: allocate HOT_DATA for IPU writes Let's split IPU writes in hot data area to improve the GC efficiency. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1086237f0a91c7e70eede1bc83ce54f521db64b0 Author: Namhyung Kim Date: Fri Aug 15 20:16:35 2025 -0700 perf annotate: Use a hashmap to save type data It can slowdown annotation browser if objdump is processing large DWARF data. Let's add a hashmap to save the data type info for each line. Note that this is needed for TUI only because stdio only processes each line once. TUI will display the same line whenever it refreshes the screen. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-13-namhyung@kernel.org [ Add lines around an if block and use zfree() in one case, acked by Namhyung ] Signed-off-by: Arnaldo Carvalho de Melo commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e Author: Colin Ian King Date: Tue Sep 2 13:40:50 2025 +0100 drm/amd/amdgpu: Fix missing error return on kzalloc failure Currently the kzalloc failure check just sets reports the failure and sets the variable ret to -ENOMEM, which is not checked later for this specific error. Fix this by just returning -ENOMEM rather than setting ret. Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 98fb1d5596ff0499c784180b2e39a841049c4d90 Author: Timur Kristóf Date: Thu Aug 28 17:11:12 2025 +0200 drm/amd/pm: Print VCE clocks too in si_dpm (v3) They are part of a power state too and should be printed alongside the rest of the data from the power state. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 6df0768c0ddbed8f4be900489a1502f0bd4bde87 Author: Timur Kristóf Date: Thu Aug 28 17:11:11 2025 +0200 drm/amd/pm: Remove wm_low and wm_high fields from amdgpu_crtc (v2) These fields were only used by si_dpm and are not necessary anymore. They also may have been incorrect because: - wm_high was set to the LOW_WATERMARK field of watermark A. - wm_low was not set on DCE 6 and was always zero. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b Author: Timur Kristóf Date: Thu Aug 28 17:11:10 2025 +0200 drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected") This is an ad-hoc DPM fix, necessary because we don't have proper bandwidth calculation for DCE 6. We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into this category. When two high pixel clock displays are connected to Oland, additionally disable shader clock switching, which results in a higher voltage, thereby addressing some visible flickering. v2: Add more comments. v3: Split into two commits for easier review. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 Author: Timur Kristóf Date: Thu Aug 28 17:11:09 2025 +0200 drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) According to pp_pm_compute_clocks the non-DC display code has "issues with mclk switching with refresh rates over 120 hz". The workaround is to disable MCLK switching in this case. Do the same for legacy DPM. Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 Author: Timur Kristóf Date: Thu Aug 28 17:11:08 2025 +0200 drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) Some parts of the code base expect that MCLK switching is turned off when the vblank time is set to zero. According to pp_pm_compute_clocks the non-DC code has issues with MCLK switching with refresh rates over 120 Hz. v3: Add code comment to explain this better. Add an if statement instead of changing the switch_limit. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit ce025130127437dc884c84c254170e27b2ce9309 Author: Timur Kristóf Date: Thu Aug 28 17:11:07 2025 +0200 drm/amd/pm: Adjust si_upload_smc_data register programming (v3) Based on some comments in dm_pp_display_configuration above the crtc_index and line_time fields, these values are programmed to the SMC to work around an SMC hang when it switches MCLK. According to Alex, the Windows driver programs them to: mclk_change_block_cp_min = 200 / line_time mclk_change_block_cp_max = 100 / line_time Let's use the same for the sake of consistency. Previously we used the watermark values, but it seemed buggy as the code was mixing up low/high and A/B watermarks, and was not saving a low watermark value on DCE 6, so mclk_change_block_cp_max would be always zero previously. Split this change off from the previous si_upload_smc_data to make it easier to bisect, in case it causes any issues. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 Author: Timur Kristóf Date: Thu Aug 28 17:11:06 2025 +0200 drm/amd/pm: Fix si_upload_smc_data (v3) The si_upload_smc_data function uses si_write_smc_soft_register to set some register values in the SMC, and expects the result to be PPSMC_Result_OK which is 1. The PPSMC_Result_OK / PPSMC_Result_Failed values are used for checking the result of a command sent to the SMC. However, the si_write_smc_soft_register actually doesn't send any commands to the SMC and returns zero on success, so this check was incorrect. Fix that by not checking the return value, just like other calls to si_write_smc_soft_register. v3: Additionally, when no display is plugged in, there is no need to restrict MCLK switching, so program the registers to zero. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 813d13524a3bdcc5f0253e06542440ca74c2653a Author: Timur Kristóf Date: Thu Aug 28 17:11:05 2025 +0200 drm/amd/pm: Increase SMC timeout on SI and warn (v3) The SMC can take an excessive amount of time to process some messages under some conditions. Background: Sending a message to the SMC works by writing the message into the mmSMC_MESSAGE_0 register and its optional parameter into the mmSMC_SCRATCH0, and then polling mmSMC_RESP_0. Previously the timeout was AMDGPU_MAX_USEC_TIMEOUT, ie. 100 ms. Increase the timeout to 200 ms for all messages and to 1 sec for a few messages which I've observed to be especially slow: PPSMC_MSG_NoForcedLevel PPSMC_MSG_SetEnabledLevels PPSMC_MSG_SetForcedLevels PPSMC_MSG_DisableULV PPSMC_MSG_SwitchToSwState This fixes the following problems on Tahiti when switching from a lower clock power state to a higher clock state, such as when DC turns on a display which was previously turned off. * si_restrict_performance_levels_before_switch would fail (if the user previously forced high clocks using sysfs) * si_set_sw_state would fail (always) It turns out that both of those failures were SMC timeouts and that the SMC actually didn't fail or hang, just needs more time to process those. Add a warning when there is an SMC timeout to make it easier to identify this type of problem in the future. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c Author: Timur Kristóf Date: Thu Aug 28 17:11:04 2025 +0200 drm/amd/pm: Disable ULV even if unsupported (v3) Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode is unsupported, to make sure it is properly turned off. v3: Simplify si_disable_ulv further. Always check the return value of amdgpu_si_send_msg_to_smc. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit c661219cd7be75bb5599b525f16a455a058eb516 Author: Timur Kristóf Date: Thu Aug 28 17:11:03 2025 +0200 drm/amdgpu: Power up UVD 3 for FW validation (v2) Unlike later versions, UVD 3 has firmware validation. For this to work, the UVD should be powered up correctly. When DPM is enabled and the display clock is off, the SMU may choose a power state which doesn't power the UVD, which can result in failure to initialize UVD. v2: Add code comments to explain about the UVD power state and how UVD clock is turned on/off. Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 85705b18ae7674347f8675f64b2b3115fb1d5629 Author: David Francis Date: Wed Feb 19 10:01:32 2025 -0500 drm/amdgpu: Allow kfd CRIU with no buffer objects The kfd CRIU checkpoint ioctl would return an error if trying to checkpoint a process with no kfd buffer objects. This is a normal case and should not be an error. Reviewed-by: Felix Kuehling Signed-off-by: David Francis Signed-off-by: Alex Deucher commit 4d82724f7f2b847eb0454b1aab5450545b39abd4 Author: David Francis Date: Mon Jun 16 09:49:33 2025 -0400 drm/amdgpu: Add mapping info option for GEM_OP ioctl Add new GEM_OP_IOCTL option GET_MAPPING_INFO, which returns a list of mappings associated with a given bo, along with their positions and offsets. Userspace for this and the previous change can be found at: https://github.com/checkpoint-restore/criu/pull/2613 Signed-off-by: David Francis Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f9db1fc52ceb42f4a18506693349316f5e209ba6 Author: David Francis Date: Mon Jun 16 09:47:42 2025 -0400 drm/amdgpu: Add ioctl to get all gem handles for a process Add new ioctl DRM_IOCTL_AMDGPU_GEM_LIST_HANDLES. This ioctl returns a list of bos with their handles, sizes, and flags and domains. This ioctl is meant to be used during CRIU checkpoint and provide information needed to reconstruct the bos in CRIU restore. Userspace for this and the next change can be found at https://github.com/checkpoint-restore/criu/pull/2613 Signed-off-by: David Francis Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0317e0e224bcda9706a70c8bbd5aeb8b10b6ea0a Author: David Francis Date: Tue Aug 12 14:19:18 2025 -0400 drm/amdgpu: Allow more flags to be set on gem create. The GEM create flag AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE specifies that gem memory contains sensitive information and should be cleared to prevent snooping. The COHERENT and UNCACHED gem create flags enable memory features related to sharing memory across devices. For CRIU we need to re-create KFD BOs through the GEM_CREATE IOCTL, so allow those KFD specific flags here as well. This will also aid us in the future and allows to move the KFD components over using the render node for allocations. Signed-off-by: David Francis Reviewed-by: Christian König Signed-off-by: Alex Deucher commit be5590c384f3e57b1b556be0b88ec62246948315 Author: Satyanarayana K V P Date: Tue Sep 2 16:02:57 2025 +0530 drm/xe/vf: Enable CCS save/restore only on supported GUC versions CCS save/restore is supported starting with GuC 70.48.0 (compatibility version 1.23.0). Gate the feature on the GuC firmware version and keep it disabled on older or unsupported versions. Fixes: f3009272ff2e ("drm/xe/vf: Create contexts for CCS read write") Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Daniele Ceraolo Spurio Cc: Andi Shyti Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250902103256.21658-2-satyanarayana.k.v.p@intel.com commit e4980fa6463624cb608c0f49882e11e8d6ccd590 Author: Feng Yang Date: Wed Aug 27 11:28:12 2025 +0800 bpf: Replace kvfree with kfree for kzalloc memory These pointers are allocated by kzalloc. Therefore, replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr() check in kvfree(). This is the remaining unmodified part from [1]. Signed-off-by: Feng Yang Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250811123949.552885-1-rongqianfeng@vivo.com [1] Link: https://lore.kernel.org/bpf/20250827032812.498216-1-yangfeng59949@163.com commit 6417ca85305ecaffef13cf9063ac35da8fba8500 Author: Yuan Chen Date: Fri Aug 29 07:11:07 2025 +0100 bpftool: Add CET-aware symbol matching for x86_64 architectures Adjust symbol matching logic to account for Control-flow Enforcement Technology (CET) on x86_64 systems. CET prefixes functions with a 4-byte 'endbr' instruction, shifting the actual hook entry point to symbol + 4. Signed-off-by: Yuan Chen Signed-off-by: Daniel Borkmann Acked-by: Quentin Monnet Acked-by: Yonghong Song Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com commit 70f32a10ad423fd19e22e71d05d0968e61316278 Author: Yuan Chen Date: Fri Aug 29 07:11:06 2025 +0100 bpftool: Refactor kernel config reading into common helper Extract the kernel configuration file parsing logic from feature.c into a new read_kernel_config() function in common.c. This includes: 1. Moving the config file handling and option parsing code 2. Adding required headers and struct definition 3. Keeping all existing functionality The refactoring enables sharing this logic with other components while maintaining current behavior. This will be used by subsequent patches that need to check kernel config options. Signed-off-by: Yuan Chen Signed-off-by: Daniel Borkmann Acked-by: Quentin Monnet Acked-by: Yonghong Song Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250829061107.23905-2-chenyuan_fl@163.com commit e4c628e91c6ab12f89500a023adfb030f737f3fd Author: Rafael J. Wysocki Date: Wed Aug 13 12:38:58 2025 +0200 ACPI: processor: idle: Eliminate static variable flat_state_cnt Instead of using static variable flat_state_cnt to pass data between functions involved in the _LPI information processing, pass the current number of "flattened" idle states to flatten_lpi_states() and make it return the updated number of those states. At the same time, use a local variable called state_count to store the number of "flattened" idle states found so far in acpi_processor_get_lpi_info(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Sudeep Holla Tested-by: Sudeep Holla Acked-by: lihuisong@huawei.com Link: https://patch.msgid.link/10715991.nUPlyArG6x@rafael.j.wysocki commit eb58738d1546bababc77392968ece9c595b4f737 Author: Rafael J. Wysocki Date: Wed Aug 13 12:36:04 2025 +0200 ACPI: processor: idle: Add module import namespace Add a new module import namespace called ACPI_PROCESSOR_IDLE for functions exported from the non-modular part of the ACPI processor driver to the modular part of it. Export acpi_processor_claim_cst_control() and acpi_processor_evaluate_cst() in that namespace to hide them from unrelated modules. They are also used by the intel_idle driver, but it is non-modular, so it can call them regardless of the way the symbols are exported. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3376499.aeNJFYEL58@rafael.j.wysocki commit 7a8c994cbb2db3c5335cee35fd486557f5aaf7e1 Author: Huisong Li Date: Mon Jul 28 15:06:12 2025 +0800 ACPI: processor: idle: Optimize ACPI idle driver registration Currently, the ACPI idle driver is registered from within a CPU hotplug callback. Although this didn't cause any functional issues, this is questionable and confusing. And it is better to register the cpuidle driver when all of the CPUs have been brought up. So add a new function to initialize acpi_idle_driver based on the power management information of an available CPU and register cpuidle driver in acpi_processor_driver_init(). Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250728070612.1260859-3-lihuisong@huawei.com [ rjw: Added missing inline modifiers ] Signed-off-by: Rafael J. Wysocki commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf Author: Krzysztof Kozlowski Date: Tue Jun 10 16:05:47 2025 +0200 drm/msm/dsi/phy_7nm: Fix missing initial VCO rate Driver unconditionally saves current state on first init in dsi_pll_7nm_init(), but does not save the VCO rate, only some of the divider registers. The state is then restored during probe/enable via msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() -> dsi_7nm_pll_restore_state(). Restoring calls dsi_pll_7nm_vco_set_rate() with pll_7nm->vco_current_rate=0, which basically overwrites existing rate of VCO and messes with clock hierarchy, by setting frequency to 0 to clock tree. This makes anyway little sense - VCO rate was not saved, so should not be restored. If PLL was not configured configure it to minimum rate to avoid glitches and configuring entire in clock hierarchy to 0 Hz. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/657827/ Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org Signed-off-by: Dmitry Baryshkov commit 3bb6433ecb65ab91862e39a9a788beecd38e10de Author: Krzysztof Kozlowski Date: Tue Jun 10 16:05:45 2025 +0200 drm/msm/dsi/phy: Define PHY_CMN_CTRL_0 bitfields Add bitfields for PHY_CMN_CTRL_0 registers to avoid hard-coding bit masks and shifts and make the code a bit more readable. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/657818/ Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-7-ee633e3ddbff@linaro.org Signed-off-by: Dmitry Baryshkov commit b63f008f395ca5f6bc89123db97440bdc19981c4 Author: Krzysztof Kozlowski Date: Tue Jun 10 16:05:44 2025 +0200 drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL According to Hardware Programming Guide for DSI PHY, the retime buffer resync should be done after PLL clock users (byte_clk and intf_byte_clk) are enabled. Downstream also does it as part of configuring the PLL. Driver was only turning off the resync FIFO buffer, but never bringing it on again. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/657823/ Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org Signed-off-by: Dmitry Baryshkov commit 077dc4a275790b09e8a2ce80822ba8970e9dfb99 Author: Fernando Fernandez Mancera Date: Thu Aug 28 14:48:31 2025 +0200 netfilter: nft_payload: extend offset to 65535 bytes In some situations 255 bytes offset is not enough to match or manipulate the desired packet field. Increase the offset limit to 65535 or U16_MAX. In addition, the nla policy maximum value is not set anymore as it is limited to s16. Instead, the maximum value is checked during the payload expression initialization function. Tested with the nft command line tool. table ip filter { chain output { @nh,2040,8 set 0xff @nh,524280,8 set 0xff @nh,524280,8 0xff @nh,2040,8 0xff } } Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit f4f9e05904e11bbc772c031b35d0d25caa21d5e8 Author: Florian Westphal Date: Wed Aug 13 20:43:47 2025 +0200 netfilter: nf_reject: remove unneeded exports These functions have no external callers and can be static. Signed-off-by: Florian Westphal commit 8959f27d39d65d759b0eb3aab248ffac27d531d7 Author: Florian Westphal Date: Sun Aug 24 12:44:39 2025 +0200 netfilter: nft_set_pipapo: remove redundant test for avx feature bit Sebastian points out that avx2 depends on avx, see check_cpufeature_deps() in arch/x86/kernel/cpu/cpuid-deps.c: avx2 feature bit will be cleared when avx isn't available. No functional change intended. Reported-by: Sebastian Andrzej Siewior Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 3d95a2e016abab29ccb6f384576b2038e544a5a8 Author: Florian Westphal Date: Fri Aug 22 10:15:38 2025 +0200 netfilter: nf_tables: all transaction allocations can now sleep Now that nft_setelem_flush is not called with rcu read lock held or disabled softinterrupts anymore this can now use GFP_KERNEL too. This is the last atomic allocation of transaction elements, so remove all gfp_t arguments and the wrapper function. This makes attempts to delete large sets much more reliable, before this was prone to transient memory allocation failures. Signed-off-by: Florian Westphal commit a60a5abe19d6acd9d9ea4c1883745399fb5dc023 Author: Florian Westphal Date: Fri Aug 22 10:15:37 2025 +0200 netfilter: nf_tables: allow iter callbacks to sleep Quoting Sven Auhagen: we do see on occasions that we get the following error message, more so on x86 systems than on arm64: Error: Could not process rule: Cannot allocate memory delete table inet filter It is not a consistent error and does not happen all the time. We are on Kernel 6.6.80, seems to me like we have something along the lines of the nf_tables: allow clone callbacks to sleep problem using GFP_ATOMIC. As hinted at by Sven, this is because of GFP_ATOMIC allocations during set flush. When set is flushed, all elements are deactivated. This triggers a set walk and each element gets added to the transaction list. The rbtree and rhashtable sets don't allow the iter callback to sleep: rbtree walk acquires read side of an rwlock with bh disabled, rhashtable walk happens with rcu read lock held. Rbtree is simple enough to resolve: When the walk context is ITER_READ, no change is needed (the iter callback must not deactivate elements; we're not in a transaction). When the iter type is ITER_UPDATE, the rwlock isn't needed because the caller holds the transaction mutex, this prevents any and all changes to the ruleset, including add/remove of set elements. Rhashtable is slightly more complex. When the iter type is ITER_READ, no change is needed, like rbtree. For ITER_UPDATE, we hold transaction mutex which prevents elements from getting free'd, even outside of rcu read lock section. So build a temporary list of all elements while doing the rcu iteration and then call the iterator in a second pass. The disadvantage is the need to iterate twice, but this cost comes with the benefit to allow the iter callback to use GFP_KERNEL allocations in a followup patch. The new list based logic makes it necessary to catch recursive calls to the same set earlier. Such walk -> iter -> walk recursion for the same set can happen during ruleset validation in case userspace gave us a bogus (cyclic) ruleset where verdict map m jumps to chain that sooner or later also calls "vmap @m". Before the new ->in_update_walk test, the ruleset is rejected because the infinite recursion causes ctx->level to exceed the allowed maximum. But with the new logic added here, elements would get skipped: nft_rhash_walk_update would see elements that are on the walk_list of an older stack frame. As all recursive calls into same map results in -EMLINK, we can avoid this problem by using the new in_update_walk flag and reject immediately. Next patch converts the problematic GFP_ATOMIC allocations. Reported-by: Sven Auhagen Closes: https://lore.kernel.org/netfilter-devel/BY1PR18MB5874110CAFF1ED098D0BC4E7E07BA@BY1PR18MB5874.namprd18.prod.outlook.com/ Signed-off-by: Florian Westphal commit c015e17ba111e1cd2c7180204b006266aa15c263 Author: Christophe Leroy Date: Mon Aug 18 11:48:30 2025 +0200 netfilter: nft_payload: Use csum_replace4() instead of opencoding Open coded calculation can be avoided and replaced by the equivalent csum_replace4() in nft_csum_replace(). Signed-off-by: Christophe Leroy Reviewed-by: Simon Horman Signed-off-by: Florian Westphal commit 46015e6b3ea75297b28d4806564f3f692cf11861 Author: Qianfeng Rong Date: Sun Aug 17 17:15:56 2025 +0800 netfilter: ebtables: Use vmalloc_array() to improve code Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code. vmalloc_array() is also optimized better, uses fewer instructions, and handles overflow more concisely[1]. [1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ Signed-off-by: Qianfeng Rong Signed-off-by: Florian Westphal commit cd8a4cfa6bb43a441901e82f5c222dddc75a18a3 Merge: 48195dd18f0eb1 0c2a02f3c066d4 Author: Paolo Abeni Date: Tue Sep 2 15:18:18 2025 +0200 Merge branch 'e-switch-vport-sharing-delegation' Saeed Mahameed says: ==================== E-Switch vport sharing & delegation An mlx5 E-Switch FDB table can manage vports belonging to other sibling physical functions, such as ECPF (ARM embedded cores) and Host PF (x86). This enables a single source of truth for SDN software to manage network pipelines from one host. While such functionality already exists in mlx5, it is currently limited by static vport allocation, meaning the number of vports shared between multi-host functions must be known pre-boot. This patchset enables delegated/external vports to be discovered dynamically when switchdev mode is enabled, leveraging new firmware capabilities for dynamic vport creation. Adjacent functions that delegate their SR-IOV VFs to sibling PFs, can be dynamically discovered on the sibling PF's switchdev mode enabling, after sriov was enabled on the originating PF, allowing for more flexible and scalable management in multi-host and ECPF-to-host scenarios. The patchset consists of the following changes: - Refactoring of ACL root namespace handling: The storage of vport ACL root namespaces is converted from a linear array to an xarray, allowing dynamic creation of ACLs per individual vport. - Improvements for vhca_id to vport mapping. - Dynamic querying and creation of delegated functions/vports. ==================== Link: https://patch.msgid.link/20250829223722.900629-1-saeed@kernel.org Signed-off-by: Paolo Abeni commit 0c2a02f3c066d4b50ebb66178843df83f33e4f1b Author: Saeed Mahameed Date: Fri Aug 29 15:37:22 2025 -0700 net/mlx5: {DR,HWS}, Use the cached vhca_id for this device The mlx5 driver caches many capabilities to be used by mlx5 layers. In SW and HW steering we can use the cached vhca_id instead of invoking FW commands. Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-8-saeed@kernel.org Signed-off-by: Paolo Abeni commit 5d8ae2c2cfe88a2c7458e18f30df4c655dfa983e Author: Adithya Jayachandran Date: Fri Aug 29 15:37:21 2025 -0700 net/mlx5: E-switch, Set representor attributes for adjacent VFs Adjacent vfs get their devlink port information from firmware, use the information (pfnum, function id) from FW when populating the devlink port attributes. Before: $ devlink port show pci/0000:00:03.0/180225: type eth netdev eth0 flavour pcivf controller 0 pfnum 0 vfnum 49152 external false splittable false function: hw_addr 00:00:00:00:00:00 After: $ devlink port show pci/0000:00:03.0/180225: type eth netdev enp0s3npf0vf2 flavour pcivf controller 0 pfnum 0 vfnum 2 external false splittable false function: hw_addr 00:00:00:00:00:00 Signed-off-by: Adithya Jayachandran Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-7-saeed@kernel.org Signed-off-by: Paolo Abeni commit a0a7002b943997f5a4a9103ab92db388965f7aff Author: Saeed Mahameed Date: Fri Aug 29 15:37:20 2025 -0700 net/mlx5: E-Switch, Register representors for adjacent vports Register representors for adjacent vports dynamically when they are discovered. Dynamically added representors state will now be set to 'REGISTERED' when the representor type was already registered, otherwise they won't be loaded. Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-6-saeed@kernel.org Signed-off-by: Paolo Abeni commit 9984ec9f1f502dc5e19daf4210b221f554ca35db Author: Saeed Mahameed Date: Fri Aug 29 15:37:19 2025 -0700 net/mlx5: E-Switch, Create acls root namespace for adjacent vports Use the new vport acl root namespace add/remove API to create the missing acl root name spaces per each new adjacent function vport. Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-5-saeed@kernel.org Signed-off-by: Paolo Abeni commit 17426c5d4b1db69c0aa34d0bf6a1552cc2c68d95 Author: Adithya Jayachandran Date: Fri Aug 29 15:37:18 2025 -0700 net/mlx5: E-Switch, Add support for adjacent functions vports discovery Adding driver support to query adjacent functions vports, AKA delegated vports. Adjacent functions can delegate their sriov vfs to other sibling PF in the system, to be managed by the eswitch capable sibling PF. E.g, ECPF to Host PF, multi host PF between each other, etc. Only supported in switchdev mode. Signed-off-by: Adithya Jayachandran Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-4-saeed@kernel.org Signed-off-by: Paolo Abeni commit faa6ac53cdaa26f80e4b44e6255a52bd67b83acb Author: Saeed Mahameed Date: Fri Aug 29 15:37:17 2025 -0700 net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch Move the loop that creates the vports ACLs root name spaces to eswitch, since it is the eswitch responsibility to decide when and how many vports ACLs root namespaces to create, in the next patches we will use the fs_core vport ACL root namespace APIs to create/remove root ns ACLs dynamically for dynamically created vports. Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-3-saeed@kernel.org Signed-off-by: Paolo Abeni commit 2e894b99c0172759f89af506cdd898ced0b14e13 Author: Saeed Mahameed Date: Fri Aug 29 15:37:16 2025 -0700 net/mlx5: FS, Convert vport acls root namespaces to xarray Before this patch it was a linear array and could only support a certain number of vports, in the next patches, vport numbers are not bound to a well known limit, thus convert acl root name space storage to xarray. In addition create fs_core public API to add/remove vport acl namespaces as it is the eswitch responsibility to create the vports and their root name spaces for acls, in the next patch we will move mlx5_fs_ingress_acls_{init,cleanup} to eswitch and will use the individual mlx5_fs_vport_{egress,ingresS}_acl_ns_{add,remove} APIs for dynamically create vports. Signed-off-by: Saeed Mahameed Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829223722.900629-2-saeed@kernel.org Signed-off-by: Paolo Abeni commit 727e914bbfbbda9e6efa5cb1abe4e96a949d576f Author: Inochi Amaoto Date: Thu Aug 28 07:09:42 2025 +0800 PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent() For MSI controllers which only support MSI_FLAG_PCI_MSI_MASK_PARENT, the newly added callback irq_startup() and irq_shutdown() for pci_msi[x]_template will not unmask or mask the interrupt when startup() resp. shutdown() is invoked. This prevents the interrupt from being enabled resp. disabled. Invoke irq_[un]mask_parent() in cond_[startup|shutdown]_parent(), when the interrupt has the MSI_FLAG_PCI_MSI_MASK_PARENT flag set. Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") Reported-by: Linux Kernel Functional Testing Reported-by: Nathan Chancellor Reported-by: Wei Fang Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Nathan Chancellor Tested-by: Linux Kernel Functional Testing Tested-by: Jon Hunter Tested-by: Wei Fang Tested-by: Chen Wang # Pioneerbox/SG2042 Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/all/20250827230943.17829-1-inochiama@gmail.com Closes: https://lore.kernel.org/regressions/aK4O7Hl8NCVEMznB@monster/ Closes: https://lore.kernel.org/regressions/20250826220959.GA4119563@ax162/ Closes: https://lore.kernel.org/all/20250827093911.1218640-1-wei.fang@nxp.com/ commit 0e28eab0ca51282e3d14f3e2dba9fc92e3fddbe6 Author: Guodong Xu Date: Fri Aug 22 11:06:33 2025 +0800 riscv: dts: spacemit: Enable PDMA on Banana Pi F3 and Milkv Jupiter Enable the PDMA on the SpacemiT K1-based Banana Pi F3 and Milkv Jupiter boards by setting its status to "okay". Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-7-f5c0eda734cc@riscstar.com Signed-off-by: Yixun Lan commit 81d79ad0ddcaeaf6136abe870b2386bde31b7ed4 Author: Guodong Xu Date: Fri Aug 22 11:06:32 2025 +0800 riscv: dts: spacemit: Add PDMA node for K1 SoC Add PDMA dma-controller node under dma_bus for SpacemiT K1 SoC. The PDMA node is marked as disabled by default, allowing board-specific device trees to enable it as needed. Signed-off-by: Guodong Xu Reviewed-by: Troy Mitchell Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-6-f5c0eda734cc@riscstar.com Signed-off-by: Yixun Lan commit 6746c36c94dd5e6f82801cd844a750a5c3b89979 Author: Xichao Zhao Date: Fri Aug 8 16:42:13 2025 +0800 fsnotify: fix "rewriten"->"rewritten" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250808084213.230592-1-zhao.xichao@vivo.com Signed-off-by: Jan Kara commit d6058316d16ee0d1861c0550051b2492efb54b79 Author: Andrei Lalaev Date: Wed Aug 20 10:47:12 2025 +0200 leds: leds-lp55xx: Use correct address for memory programming Memory programming doesn't work for devices without page support. For example, LP5562 has 3 engines but doesn't support pages, the start address is changed depending on engine number. According to datasheet [1], the PROG MEM register addresses for each engine are as follows: Engine 1: 0x10 Engine 2: 0x30 Engine 3: 0x50 However, the current implementation incorrectly calculates the address of PROG MEM register using the engine index starting from 1: prog_mem_base = 0x10 LP55xx_BYTES_PER_PAGE = 0x20 Engine 1: 0x10 + 0x20 * 1 = 0x30 Engine 2: 0x10 + 0x20 * 2 = 0x50 Engine 3: 0x10 + 0x20 * 3 = 0x70 This results in writing to the wrong engine memory, causing pattern programming to fail. To correct it, the engine index should be decreased: Engine 1: 0x10 + 0x20 * 0 = 0x10 Engine 2: 0x10 + 0x20 * 1 = 0x30 Engine 3: 0x10 + 0x20 * 2 = 0x50 1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function") Signed-off-by: Andrei Lalaev Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com Signed-off-by: Lee Jones commit 74fddd5fbab879a7d039d9fb49af923927a64811 Author: Qunqin Zhao Date: Sat Jul 5 15:20:45 2025 +0800 MAINTAINERS: Add entry for Loongson Security Engine drivers This patch adds an entry for Loongson Security Engine drivers in the list of maintainers. Signed-off-by: Qunqin Zhao Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250705072045.1067-5-zhaoqunqin@loongson.cn Signed-off-by: Lee Jones commit 5c83b07df9c5a6e063328c5b885de79f8e8f0263 Author: Qunqin Zhao Date: Sat Jul 5 15:20:44 2025 +0800 tpm: Add a driver for Loongson TPM device Loongson Security Engine supports random number generation, hash, symmetric encryption and asymmetric encryption. Based on these encryption functions, TPM2 have been implemented in the Loongson Security Engine firmware. This driver is responsible for copying data into the memory visible to the firmware and receiving data from the firmware. Co-developed-by: Yinggang Gu Signed-off-by: Yinggang Gu Signed-off-by: Qunqin Zhao Reviewed-by: Huacai Chen Reviewed-by: Jarkko Sakkinen Link: https://lore.kernel.org/r/20250705072045.1067-4-zhaoqunqin@loongson.cn Signed-off-by: Lee Jones commit 766b2d724c8df071031412eea902b566a0049c31 Author: Qunqin Zhao Date: Sat Jul 5 15:20:43 2025 +0800 crypto: loongson - add Loongson RNG driver support Loongson's Random Number Generator is found inside Loongson Security Engine chip. Co-developed-by: Yinggang Gu Signed-off-by: Yinggang Gu Signed-off-by: Qunqin Zhao Reviewed-by: Huacai Chen Acked-by: Herbert Xu Link: https://lore.kernel.org/r/20250705072045.1067-3-zhaoqunqin@loongson.cn Signed-off-by: Lee Jones commit e551fa3159e3050c26ff010c3b595b45d7eb071a Author: Qunqin Zhao Date: Sat Jul 5 15:20:42 2025 +0800 mfd: Add support for Loongson Security Engine chip controller Loongson Security Engine chip supports RNG, SM2, SM3 and SM4 accelerator engines. This is the base driver for other specific engine drivers. Co-developed-by: Yinggang Gu Signed-off-by: Yinggang Gu Signed-off-by: Qunqin Zhao Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250705072045.1067-2-zhaoqunqin@loongson.cn Signed-off-by: Lee Jones commit 34585dc649fb255b40075dab56af063c1bfc9933 Author: Andreas Hindborg Date: Tue Sep 2 11:55:11 2025 +0200 rnull: add soft-irq completion support rnull currently only supports direct completion. Add option for completing requests across CPU nodes via soft IRQ or IPI. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-17-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 4ec052841a545297a276e833817990f0e13b1b32 Author: Andreas Hindborg Date: Tue Sep 2 11:55:10 2025 +0200 rust: block: add remote completion to `Request` Allow users of rust block device driver API to schedule completion of requests via `blk_mq_complete_request_remote`. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-16-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit bde50e28f7c5fe874112fe9d98e84873548fa8de Author: Andreas Hindborg Date: Tue Sep 2 11:55:09 2025 +0200 rust: block: mq: fix spelling in a safety comment Add code block quotes to a safety comment. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-15-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 90d952fac8ac1aa6cb21aad7010d33af4d309f4a Author: Andreas Hindborg Date: Tue Sep 2 11:55:08 2025 +0200 rust: block: add `GenDisk` private data support Allow users of the rust block device driver API to install private data in the `GenDisk` structure. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-14-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit d969d504bc13b2f0c1f208e009e73f2625b421c0 Author: Andreas Hindborg Date: Tue Sep 2 11:55:07 2025 +0200 rnull: enable configuration via `configfs` Allow rust null block devices to be configured and instantiated via `configfs`. Reviewed-by: Daniel Almeida Reviewed-by: Alice Ryhl Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-13-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit edd8650691c374bdce133af1b25ff4f3496f489f Author: Andreas Hindborg Date: Tue Sep 2 11:55:06 2025 +0200 rnull: move driver to separate directory The rust null block driver is about to gain some additional modules. Rather than pollute the current directory, move the driver to a subdirectory. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-12-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 19c37c91b4a0ff7abfc3dcfe165d1377939469ac Author: Andreas Hindborg Date: Tue Sep 2 11:55:05 2025 +0200 rust: block: add block related constants Add a few block subsystem constants to the rust `kernel::block` name space. This makes it easier to access the constants from rust code. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-11-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 8c32697c4edd4180bc90d367e54fb64490c230c6 Author: Andreas Hindborg Date: Tue Sep 2 11:55:04 2025 +0200 rust: block: remove trait bound from `mq::Request` definition Remove the trait bound `T:Operations` from `mq::Request`. The bound is not required, so remove it to reduce complexity. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-10-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit f52689fcd8a2f78436b57d10ba742455431885a0 Author: Andreas Hindborg Date: Tue Sep 2 11:55:03 2025 +0200 rust: block: remove `RawWriter` `RawWriter` is now dead code, so remove it. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-9-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit c3a54220b54a1bda0662f0e7ab90ffabf5036d50 Author: Andreas Hindborg Date: Tue Sep 2 11:55:02 2025 +0200 rust: block: use `NullTerminatedFormatter` Use the new `NullTerminatedFormatter` to write the name of a `GenDisk` to the name buffer. This new formatter automatically adds a trailing null marker after the written characters, so we don't need to append that at the call site any longer. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-8-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit f4b72f1558be1e2b173b6b1f93c09dc668592a26 Author: Andreas Hindborg Date: Tue Sep 2 11:55:01 2025 +0200 rust: block: normalize imports for `gen_disk.rs` Clean up the import statements in `gen_disk.rs` to make the code easier to maintain. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-7-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 60e1eeed8b53f65ef7919fd3f79cc9b7f20795c5 Author: Andreas Hindborg Date: Tue Sep 2 11:55:00 2025 +0200 rust: configfs: re-export `configfs_attrs` from `configfs` module Re-export `configfs_attrs` from `configfs` module, so that users can import the macro from the `configfs` module rather than the root of the `kernel` crate. Also update users to import from the new path. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-6-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit b1dae0be89278348e2c99ddca820d91292856b10 Author: Andreas Hindborg Date: Tue Sep 2 11:54:59 2025 +0200 rust: str: introduce `kstrtobool` function Add a Rust wrapper for the kernel's `kstrtobool` function that converts common user inputs into boolean values. Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-5-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit cdde7a1951ff0600adc45718ba251559e4d3fd7c Author: Andreas Hindborg Date: Tue Sep 2 11:54:58 2025 +0200 rust: str: introduce `NullTerminatedFormatter` Add `NullTerminatedFormatter`, a formatter that writes a null terminated string to an array or slice buffer. Because this type needs to manage the trailing null marker, the existing formatters cannot be used to implement this type. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-4-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 8c5ac71cf19bc8a2ad5bc905d1fd3191d887d469 Author: Andreas Hindborg Date: Tue Sep 2 11:54:57 2025 +0200 rust: str: expose `str::{Formatter, RawFormatter}` publicly. rnull is going to make use of `str::Formatter` and `str::RawFormatter`, so expose them with public visibility. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-3-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 87482d6d9104d087935592ebbf52b70f8a777c47 Author: Andreas Hindborg Date: Tue Sep 2 11:54:56 2025 +0200 rust: str: allow `str::Formatter` to format into `&mut [u8]`. Improve `Formatter` so that it can write to an array or slice buffer. Reviewed-by: Daniel Almeida Reviewed-by: Alice Ryhl Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-2-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit d5d060d624e34c6ce1748a157cf2391e49af2a54 Author: Andreas Hindborg Date: Tue Sep 2 11:54:55 2025 +0200 rust: str: normalize imports in `str.rs` Clean up imports in `str.rs`. This makes future code manipulation more manageable. Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250902-rnull-up-v6-16-v7-1-b5212cc89b98@kernel.org Signed-off-by: Jens Axboe commit 37500634d0a8f931e15879760fb70f9b6f5d5370 Author: Jens Axboe Date: Tue Sep 2 05:19:42 2025 -0600 io_uring/net: correct type for min_not_zero() cast The kernel test robot reports that after a recent change, the signedness of a min_not_zero() compare is now incorrect. Fix that up and cast to the right type. Fixes: 429884ff35f7 ("io_uring/kbuf: use struct io_br_sel for multiple buffers picking") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509020426.WJtrdwOU-lkp@intel.com/ Signed-off-by: Jens Axboe commit 48195dd18f0eb10879960196925f914ca2600806 Merge: 2fd4161d0d2547 93081d4ed54e72 Author: Paolo Abeni Date: Tue Sep 2 13:13:53 2025 +0200 Merge branch 'add-netc-timer-ptp-driver-and-add-ptp-support-for-i-mx95' Wei Fang says: ==================== Add NETC Timer PTP driver and add PTP support for i.MX95 This series adds NETC Timer PTP clock driver, which supports precise periodic pulse, time capture on external pulse and PTP synchronization. It also adds PTP support to the enetc v4 driver for i.MX95 and optimizes the PTP-related code in the enetc driver. ==================== Link: https://patch.msgid.link/20250829050615.1247468-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 93081d4ed54e72c8e7f99fc69f90edb41bd0e660 Author: Wei Fang Date: Fri Aug 29 13:06:15 2025 +0800 net: enetc: don't update sync packet checksum if checksum offload is used For ENETC v4, the hardware has the capability to support Tx checksum offload. so the enetc driver does not need to update the UDP checksum of PTP sync packets if Tx checksum offload is enabled. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-15-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit f5b9a1cde0a26c17a50402f9c631d86b579aff3c Author: Wei Fang Date: Fri Aug 29 13:06:14 2025 +0800 net: enetc: add PTP synchronization support for ENETC v4 Regarding PTP, ENETC v4 has some changes compared to ENETC v1 (LS1028A), mainly as follows. 1. ENETC v4 uses a different PTP driver, so the way to get phc_index is different from LS1028A. Therefore, enetc_get_ts_info() has been modified appropriately to be compatible with ENETC v1 and v4. 2. The PMa_SINGLE_STEP register has changed in ENETC v4, not only the register offset, but also some register fields. Therefore, two helper functions are added, enetc_set_one_step_ts() for ENETC v1 and enetc4_set_one_step_ts() for ENETC v4. 3. Since the generic helper functions from ptp_clock are used to get the PHC index of the PTP clock, so FSL_ENETC_CORE depends on Kconfig symbol "PTP_1588_CLOCK_OPTIONAL". But FSL_ENETC_CORE can only be selected, so add the dependency to FSL_ENETC, FSL_ENETC_VF and NXP_ENETC4. Perhaps the best approach would be to change FSL_ENETC_CORE to a visible menu entry. Then make FSL_ENETC, FSL_ENETC_VF, and NXP_ENETC4 depend on it, but this is not the goal of this patch, so this may be changed in the future. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-14-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 7776d5e6e349654e4f0ddaef8de8734ad44ab23b Author: Wei Fang Date: Fri Aug 29 13:06:13 2025 +0800 net: enetc: move sync packet modification before dma_map_single() Move sync packet content modification before dma_map_single() to follow correct DMA usage process, even though the previous sequence worked due to hardware DMA-coherence support (LS1028A). But for the upcoming i.MX95, its ENETC (v4) does not support "dma-coherent", so this step is very necessary. Otherwise, the originTimestamp and correction fields of the sent packets will still be the values before the modification. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-13-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit d889abaac29975e1a19d92d33395edb81723c33e Author: Wei Fang Date: Fri Aug 29 13:06:12 2025 +0800 net: enetc: remove unnecessary CONFIG_FSL_ENETC_PTP_CLOCK check The ENETC_F_RX_TSTAMP flag of priv->active_offloads can only be set when CONFIG_FSL_ENETC_PTP_CLOCK is enabled. Similarly, rx_ring->ext_en can only be set when CONFIG_FSL_ENETC_PTP_CLOCK is enabled as well. So it is safe to remove unnecessary CONFIG_FSL_ENETC_PTP_CLOCK check. Signed-off-by: Wei Fang Reviewed-by: Vadim Fedorenko Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-12-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 27dd0eca934763cb8b813cc13a86900302470cc7 Author: Wei Fang Date: Fri Aug 29 13:06:11 2025 +0800 net: enetc: extract enetc_update_ptp_sync_msg() to handle PTP Sync packets Move PTP Sync packet processing from enetc_map_tx_buffs() to a new helper function enetc_update_ptp_sync_msg() to simplify the original function. Prepare for upcoming ENETC v4 one-step support. There is no functional change. It is worth mentioning that ENETC_TXBD_TSTAMP is added to replace 0x3fffffff. Prepare for upcoming ENETC v4 one-step support. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-11-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 19669a57d7a04d2581dc75f6b452ee2a59936942 Author: Wei Fang Date: Fri Aug 29 13:06:10 2025 +0800 net: enetc: save the parsed information of PTP packet to skb->cb Currently, the Tx PTP packets are parsed twice in the enetc driver, once in enetc_xmit() and once in enetc_map_tx_buffs(). The latter is duplicate and is unnecessary, since the parsed information can be saved to skb->cb so that enetc_map_tx_buffs() can get the previously parsed data from skb->cb. Therefore, add struct enetc_skb_cb as the format of the data in the skb->cb buffer to save the parsed information of PTP packet. Use saved information in enetc_map_tx_buffs() to avoid parsing data again. In addition, rename variables offset1 and offset2 in enetc_map_tx_buffs() to corr_off and tstamp_off for better readability. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-10-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit dc331726469d4ac145478c5891ac7117d7a88440 Author: Wei Fang Date: Fri Aug 29 13:06:09 2025 +0800 MAINTAINERS: add NETC Timer PTP clock driver section Add a section entry for NXP NETC Timer PTP clock driver. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-9-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit b1d37b27036a3a547088ba985010eb88cbf16fe2 Author: F.S. Peng Date: Fri Aug 29 13:06:08 2025 +0800 ptp: netc: add external trigger stamp support The NETC Timer is capable of recording the timestamp on receipt of an external pulse on a GPIO pin. It supports two such external triggers. The recorded value is saved in a 16 entry FIFO accessed by TMR_ETTSa_H/L. An interrupt can be generated when the trigger occurs, when the FIFO reaches a threshold or overflows. Signed-off-by: F.S. Peng Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-8-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 671e266835b8a87d6cc2c6db962de23783405dd8 Author: Wei Fang Date: Fri Aug 29 13:06:07 2025 +0800 ptp: netc: add periodic pulse output support NETC Timer has three pulse channels, all of which support periodic pulse output. Bind the channel to a ALARM register and then sets a future time into the ALARM register. When the current time is greater than the ALARM value, the FIPER register will be triggered to count down, and when the count reaches 0, the pulse will be triggered. The PPS signal is also implemented in this way. i.MX95 only has ALARM1 can be used as an indication to the FIPER start down counting, but i.MX943 has ALARM1 and ALARM2 can be used. Therefore, only one channel can work for i.MX95, two channels for i.MX943 as most. In addition, change the PPS channel to be dynamically selected from fixed number (0) because add PTP_CLK_REQ_PEROUT support. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-7-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 91596332ff5de572576f0f93d5079b2bfc5aeae0 Author: Wei Fang Date: Fri Aug 29 13:06:06 2025 +0800 ptp: netc: add PTP_CLK_REQ_PPS support The NETC Timer is capable of generating a PPS interrupt to the host. To support this feature, a 64-bit alarm time (which is a integral second of PHC in the future) is set to TMR_ALARM, and the period is set to TMR_FIPER. The alarm time is compared to the current time on each update, then the alarm trigger is used as an indication to the TMR_FIPER starts down counting. After the period has passed, the PPS event is generated. According to the NETC block guide, the Timer has three FIPERs, any of which can be used to generate the PPS events, but in the current implementation, we only need one of them to implement the PPS feature, so FIPER 0 is used as the default PPS generator. Also, the Timer has 2 ALARMs, currently, ALARM 0 is used as the default time comparator. However, if the time is adjusted or the integer of period is changed when PPS is enabled, the PPS event will not be generated at an integral second of PHC. The suggested steps from IP team if time drift happens: 1. Disable FIPER before adjusting the hardware time 2. Rearm ALARM after the time adjustment to make the next PPS event be generated at an integral second of PHC. 3. Re-enable FIPER. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-6-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 87a201d59963ebf7185dd3c8b59907f329caa28f Author: Wei Fang Date: Fri Aug 29 13:06:05 2025 +0800 ptp: netc: add NETC V4 Timer PTP driver support NETC V4 Timer provides current time with nanosecond resolution, precise periodic pulse, pulse on timeout (alarm), and time capture on external pulse support. And it supports time synchronization as required for IEEE 1588 and IEEE 802.1AS-2020. Inside NETC, ENETC can capture the timestamp of the sent/received packet through the PHC provided by the Timer and record it on the Tx/Rx BD. And through the relevant PHC interfaces provided by the driver, the enetc V4 driver can support PTP time synchronization. In addition, NETC V4 Timer is similar to the QorIQ 1588 timer, but it is not exactly the same. The current ptp-qoriq driver is not compatible with NETC V4 Timer, most of the code cannot be reused, see below reasons. 1. The architecture of ptp-qoriq driver makes the register offset fixed, however, the offsets of all the high registers and low registers of V4 are swapped, and V4 also adds some new registers. so extending ptp-qoriq to make it compatible with V4 Timer is tantamount to completely rewriting ptp-qoriq driver. 2. The usage of some functions is somewhat different from QorIQ timer, such as the setting of TCLK_PERIOD and TMR_ADD, the logic of configuring PPS, etc., so making the driver compatible with V4 Timer will undoubtedly increase the complexity of the code and reduce readability. 3. QorIQ is an expired brand. It is difficult for us to verify whether it works stably on the QorIQ platforms if we refactor the driver, and this will make maintenance difficult, so refactoring the driver obviously does not bring any benefits. Therefore, add this new driver for NETC V4 Timer. Note that the missing features like PEROUT, PPS and EXTTS will be added in subsequent patches. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 61f132ca8c46ffee368a951e516d19d4ae767ea8 Author: Wei Fang Date: Fri Aug 29 13:06:04 2025 +0800 ptp: add helpers to get the phc_index by of_node or dev Some Ethernet controllers do not have an integrated PTP timer function. Instead, the PTP timer is a separated device and provides PTP hardware clock to the Ethernet controller to use. Therefore, the Ethernet controller driver needs to obtain the PTP clock's phc_index in its ethtool_ops::get_ts_info(). Currently, most drivers implement this in the following ways. 1. The PTP device driver adds a custom API and exports it to the Ethernet controller driver. 2. The PTP device driver adds private data to its device structure. So the private data structure needs to be exposed to the Ethernet controller driver. When registering the ptp clock, ptp_clock_register() always saves the ptp_clock pointer to the private data of ptp_clock::dev. Therefore, as long as ptp_clock::dev is obtained, the phc_index can be obtained. So the following generic APIs can be added to the ptp driver to obtain the phc_index. 1. ptp_clock_index_by_dev(): Obtain the phc_index by the device pointer of the PTP device. 2.ptp_clock_index_by_of_node(): Obtain the phc_index by the of_node pointer of the PTP device. Also, we can add another API like ptp_clock_index_by_fwnode() to get the phc_index by fwnode of PTP device. However, this API is not used in this patch set, so it is better to add it when needed. Suggested-by: Vladimir Oltean Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20250829050615.1247468-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit db2d2de1c2a80ba2617246ca1a7b0ffd117e0783 Author: Wei Fang Date: Fri Aug 29 13:06:03 2025 +0800 dt-bindings: net: move ptp-timer property to ethernet-controller.yaml For some Ethernet controllers, the PTP timer function is not integrated. Instead, the PTP timer is a separate device and provides PTP Hardware Clock (PHC) to the Ethernet controller to use, such as NXP FMan MAC, ENETC, etc. Therefore, a property is needed to indicate this hardware relationship between the Ethernet controller and the PTP timer. Since this use case is also very common, it is better to add a generic property to ethernet-controller.yaml. According to the existing binding docs, there are two good candidates, one is the "ptp-timer" defined in fsl,fman-dtsec.yaml, and the other is the "ptimer-handle" defined in fsl,fman.yaml. From the perspective of the name, the former is more straightforward, so move the "ptp-timer" from fsl,fman-dtsec.yaml to ethernet-controller.yaml. Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Reviewed-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250829050615.1247468-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit d6900b8bd362b68c66312ea8200bc0c61c4ef542 Author: Wei Fang Date: Fri Aug 29 13:06:02 2025 +0800 dt-bindings: ptp: add NETC Timer PTP clock NXP NETC (Ethernet Controller) is a multi-function PCIe Root Complex Integrated Endpoint (RCiEP), the Timer is one of its functions which provides current time with nanosecond resolution, precise periodic pulse, pulse on timeout (alarm), and time capture on external pulse support. And also supports time synchronization as required for IEEE 1588 and IEEE 802.1AS-2020. So add device tree binding doc for the PTP clock based on NETC Timer. NETC Timer has three reference clock sources, but the clock mux is inside the IP. Therefore, the driver will parse the clock name to select the desired clock source. If the clocks property is not present, NETC Timer will use the system clock of NETC IP as its reference clock. Because the Timer is a PCIe function of NETC IP, the system clock of NETC is always available to the Timer. Signed-off-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250829050615.1247468-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 5f9bab808180c47426346a4f8f494a642e9f69de Author: Lee Shawn C Date: Mon Sep 1 05:57:21 2025 +0000 drm/i915: compute pipe bpp from link bandwidth management Since intel_fdi_compute_pipe_bpp() is no longer FDI-specific and now applies to all connectors. Move it to intel_link_bw.c, and rename to intel_link_bw_compute_pipe_bpp(). v2: Remove unused header file. Cc: Shankar Uma Cc: Jani Nikula Cc: Imre Deak Cc: Vidya Srinivas Signed-off-by: Lee Shawn C [Imre: Remove unused intel_fdi.h include from intel_hdmi.c] Reviewed-by: Imre Deak Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250901055721.219995-3-shawn.c.lee@intel.com commit 51bfda2e7690805fab08453c8b057de224724fc0 Author: Lee Shawn C Date: Mon Sep 1 05:57:20 2025 +0000 drm/i915/hdmi: add debugfs to contorl HDMI bpc While performing HDMI compliance testing, test equipment may request different bpc output for signal measurement. However, display driver typically determines the maximum available bpc based on HW bandwidth. This change leverages the existing debugfs (intel_force_link_bpp) to manage HDMI bpc, and making it easier to pass HDMI CTS. v2: Using exist variable max_requested_bpc. v3: Extend intel_force_link_bpp to support HDMI as suggested by Imre. v4: Update commit message suggested by Jani. v5: Remove unused header file. Cc: Shankar Uma Cc: Jani Nikula Cc: Imre Deak Cc: Vidya Srinivas Signed-off-by: Lee Shawn C Reviewed-by: Imre Deak Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250901055721.219995-2-shawn.c.lee@intel.com commit fe85a39d8402e64a60ad3b23e190140a71d98dd9 Author: Uwe Kleine-König Date: Tue Jul 1 11:22:37 2025 +0200 backlight: mp3309c: Initialize backlight properties without memset Assigning values to a struct using a compound literal (since C99) also guarantees that all unspecified struct members are empty-initialized, so it properly replaces the memset to zero. The code looks a bit nicer and more idiomatic (though that might be subjective?). The resulting binary is a bit smaller. On ARCH=arm with an allnoconfig + minimal changes to enable the mp3309c driver the difference is 12 bytes. Signed-off-by: Uwe Kleine-König Tested-by: Flavio Suligoi Reviewed-by: Daniel Thompson (RISCstar) Link: https://lore.kernel.org/r/14514a1b0d3df6438aa10bb74f1c4fc2367d9987.1751361465.git.u.kleine-koenig@baylibre.com Signed-off-by: Lee Jones commit 2720c87b76215595a94fb70515438c5b64c360eb Author: Uwe Kleine-König Date: Tue Jul 1 11:22:36 2025 +0200 backlight: mp3309c: Drop pwm_apply_args() pwm_apply_args() sole purpose is to initialize all parameters specified in the device tree for consumers that rely on pwm_config() and pwm_enable(). The mp3309c backlight driver uses pwm_apply_might_sleep() which gets passed the full configuration and so doesn't rely on the default being explicitly applied. Signed-off-by: Uwe Kleine-König Tested-by: Flavio Suligoi Reviewed-by: Daniel Thompson (RISCstar) Link: https://lore.kernel.org/r/2d1075f5dd45c7c135e4326e279468de699f9d17.1751361465.git.u.kleine-koenig@baylibre.com Signed-off-by: Lee Jones commit d37db94b078197ec4be1cadebbfd7bf144e3c5e4 Author: Krzysztof Kozlowski Date: Sat Aug 30 13:16:59 2025 +0200 dt-bindings: pinctrl: samsung: Drop S3C2410 Samsung S3C24xx family of SoCs was removed the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250830111657.126190-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 358253fa8179ab4217ac283b56adde0174186f87 Author: Krzysztof Kozlowski Date: Sat Aug 30 13:16:58 2025 +0200 pinctrl: samsung: Drop unused S3C24xx driver data Drop unused declarations after S3C24xx SoC family removal in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"). Fixes: 1ea35b355722 ("ARM: s3c: remove s3c24xx specific hacks") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250830111657.126190-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 19c5010e8ae23faf7b98fd738ff9970bb9066b78 Author: Krzysztof Kozlowski Date: Mon Aug 11 15:54:03 2025 +0200 dt-bindings: leds: issi,is31fl319x: Drop 'db' suffix duplicating dtschema A common property unit suffix '-db' was added to dtschema, thus in-kernel bindings should not reference the type. Signed-off-by: Krzysztof Kozlowski Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250811-dt-bindings-db-v1-1-457301523bb5@linaro.org Signed-off-by: Lee Jones commit 3279052eab235bfb7130b1fabc74029c2260ed8d Author: Colin Ian King Date: Tue Sep 2 09:32:13 2025 +0100 ASoC: SOF: ipc4-topology: Fix a less than zero check on a u32 Currently the error check from the call to sof_ipc4_get_sample_type is always false because a u32 variable out_ref_type is being used to perform the less than zero check. Fix this by using the int variable ret to perform the check. Fixes: c04c2e829649 ("ASoC: SOF: ipc4-topology: Add support for 8-bit formats") Signed-off-by: Colin Ian King Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20250902083213.2620124-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 572ce546390d1b7c99b16c38cae1b680c716216c Author: Johan Hovold Date: Fri Aug 29 15:21:52 2025 +0200 firmware: arm_scmi: quirk: Prevent writes to string constants The quirk version range is typically a string constant and must not be modified (e.g. as it may be stored in read-only memory). Attempting to do so can trigger faults such as: | Unable to handle kernel write to read-only memory at virtual | address ffffc036d998a947 Update the range parsing so that it operates on a copy of the version range string, and mark all the quirk strings as const to reduce the risk of introducing similar future issues. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220437 Fixes: 487c407d57d6 ("firmware: arm_scmi: Add common framework to handle firmware quirks") Cc: stable@vger.kernel.org # 6.16 Cc: Cristian Marussi Reported-by: Jan Palus Signed-off-by: Johan Hovold Message-Id: <20250829132152.28218-1-johan@kernel.org> [sudeep.holla: minor commit message rewording; switch to cleanup helpers] Signed-off-by: Sudeep Holla commit 72ca981dba5e98c2b1c2956016cc4be934d9fbea Author: Peng Fan Date: Sun Aug 31 14:52:37 2025 +0800 firmware: arm_scmi: Fix function name typo in scmi_perf_proto_ops struct The performance protocol ops table incorrectly referenced power_scale_mw_get instead of the correct power_scale_get. Fix the typo to use the proper function. Signed-off-by: Peng Fan Message-Id: <20250831-scmi-cpufreq-v1-1-493031cf6e9b@nxp.com> Signed-off-by: Sudeep Holla commit 9b7892eaadcd12eacecd90e52c96c35616d747ce Merge: 8a9772ec08f87c 8f57dcf39fd086 Author: Mark Brown Date: Tue Sep 2 11:02:19 2025 +0100 ASoC: qcom: audioreach: fix sparse warnings Merge series from Srinivas Kandagatla : Recent static calibration support patches have excersised new code path exposing some missing checks and also accessing some variables which are of LE type that are accessed directly without converting it to CPU type. Thanks to Dan Carpenter and kernel test robot for reporting this. commit 649c6e1314d43840cbdca854d37ca30423acdb9f Author: Takashi Iwai Date: Tue Sep 2 11:56:35 2025 +0200 ALSA: hda/realtek: Use is_s4_resume() macro Use the given macro for determining the resume state instead of referring to the raw value. Only a cleanup for now. The infrastructure might be changed in future, though. Link: https://patch.msgid.link/20250902095636.21462-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 46582a15c1742ff0dd9d2faffd62672a79603a42 Merge: 998541db0ed257 5554d820f71c72 Author: Christian Brauner Date: Tue Sep 2 11:37:34 2025 +0200 Merge patch series "procfs: make reference pidns more user-visible" Aleksa Sarai says: Ever since the introduction of pid namespaces, procfs has had very implicit behaviour surrounding them (the pidns used by a procfs mount is auto-selected based on the mounting process's active pidns, and the pidns itself is basically hidden once the mount has been constructed). /* pidns mount option for procfs */ This implicit behaviour has historically meant that userspace was required to do some special dances in order to configure the pidns of a procfs mount as desired. Examples include: * In order to bypass the mnt_too_revealing() check, Kubernetes creates a procfs mount from an empty pidns so that user namespaced containers can be nested (without this, the nested containers would fail to mount procfs). But this requires forking off a helper process because you cannot just one-shot this using mount(2). * Container runtimes in general need to fork into a container before configuring its mounts, which can lead to security issues in the case of shared-pidns containers (a privileged process in the pidns can interact with your container runtime process). While SUID_DUMP_DISABLE and user namespaces make this less of an issue, the strict need for this due to a minor uAPI wart is kind of unfortunate. Things would be much easier if there was a way for userspace to just specify the pidns they want. Patch 1 implements a new "pidns" argument which can be set using fsconfig(2): fsconfig(procfd, FSCONFIG_SET_FD, "pidns", NULL, nsfd); fsconfig(procfd, FSCONFIG_SET_STRING, "pidns", "/proc/self/ns/pid", 0); or classic mount(2) / mount(8): // mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc mount("proc", "/tmp/proc", "proc", MS_..., "pidns=/proc/self/ns/pid"); The initial security model I have in this RFC is to be as conservative as possible and just mirror the security model for setns(2) -- which means that you can only set pidns=... to pid namespaces that your current pid namespace is a direct ancestor of and you have CAP_SYS_ADMIN privileges over the pid namespace. This fulfils the requirements of container runtimes, but I suspect that this may be too strict for some usecases. The pidns argument is not displayed in mountinfo -- it's not clear to me what value it would make sense to show (maybe we could just use ns_dname to provide an identifier for the namespace, but this number would be fairly useless to userspace). I'm open to suggestions. Note that PROCFS_GET_PID_NAMESPACE (see below) does at least let userspace get information about this outside of mountinfo. Note that you cannot change the pidns of an already-created procfs instance. The primary reason is that allowing this to be changed would require RCU-protecting proc_pid_ns(sb) and thus auditing all of fs/proc/* and some of the users in fs/* to make sure they wouldn't UAF the pid namespace. Since creating procfs instances is very cheap, it seems unnecessary to overcomplicate this upfront. Trying to reconfigure procfs this way errors out with -EBUSY. * patches from https://lore.kernel.org/20250805-procfs-pidns-api-v4-0-705f984940e7@cyphar.com: selftests/proc: add tests for new pidns APIs procfs: add "pidns" mount option pidns: move is-ancestor logic to helper Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-0-705f984940e7@cyphar.com Signed-off-by: Christian Brauner commit 5554d820f71c72fbe64e12c3d171908c5ef7257d Author: Aleksa Sarai Date: Tue Aug 5 15:45:11 2025 +1000 selftests/proc: add tests for new pidns APIs Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-4-705f984940e7@cyphar.com Signed-off-by: Christian Brauner commit 306734a1c76ce35fa613ea823a31ddbcdbf1eef5 Author: Luca Ceresoli Date: Fri Aug 1 19:05:28 2025 +0200 drm/display: bridge_connector: use drm_bridge_is_last() Simplify code to know whether a bridge is the last in the chain by using drm_bridge_is_last(). Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-6-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit e4cedfd4f0fc839bb3c783d7e827e9755e1af5cf Author: Luca Ceresoli Date: Fri Aug 1 19:05:27 2025 +0200 drm/bridge: add drm_bridge_is_last() Some code needing to know whether a bridge is the last in a chain currently call drm_bridge_get_next_bridge(). However drm_bridge_get_next_bridge() will soon increment the refcount of the returned bridge, which would make such code more annoying to write. In preparation for drm_bridge_get_next_bridge() to increment the refcount, as well as to simplify such code, introduce a simple bool function to tell whether a bridge is the last in the chain. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-5-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit c3183f71c3f1f004a0ca0b84c45c40d8b84dce3d Author: Luca Ceresoli Date: Fri Aug 1 19:05:26 2025 +0200 drm/omapdrm: use drm_bridge_chain_get_last_bridge() Use drm_bridge_chain_get_last_bridge() instead of open coding a loop with two invocations of drm_bridge_get_next_bridge() per iteration. Besides being cleaner and more efficient, this change is necessary in preparation for drm_bridge_get_next_bridge() to get a reference to the returned bridge. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-4-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit 5849eff7f06709c98baa7989806165fe30bd0cbe Author: Luca Ceresoli Date: Fri Aug 1 19:05:25 2025 +0200 drm/bridge: imx93-mipi-dsi: use drm_bridge_chain_get_last_bridge() Use drm_bridge_chain_get_last_bridge() instead of open coding a loop with two invocations of drm_bridge_get_next_bridge() per iteration. Besides being cleaner and more efficient, this change is necessary in preparation for drm_bridge_get_next_bridge() to get a reference to the returned bridge. Reviewed-by: Maxime Ripard Reviewed-by: Liu Ying Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-3-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit d77ad5178e90f5aa4ce6085510b3b2f742abc5f0 Author: Luca Ceresoli Date: Fri Aug 1 19:05:24 2025 +0200 drm/bridge: add drm_bridge_chain_get_last_bridge() Add an equivalent of drm_bridge_chain_get_first_bridge() to get the last bridge. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-2-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit cb86408b1fc2e3f6fe45ebe8509a5404060e01e0 Author: Luca Ceresoli Date: Fri Aug 1 19:05:23 2025 +0200 list: add list_last_entry_or_null() Add an equivalent of list_first_entry_or_null() to obtain the last element of a list. Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250801-drm-bridge-alloc-getput-drm_bridge_get_next_bridge-v2-1-888912b0be13@bootlin.com Signed-off-by: Luca Ceresoli commit fe49652e36bb4337330d24dce7d571a49f824605 Author: Aleksa Sarai Date: Tue Aug 5 15:45:09 2025 +1000 procfs: add "pidns" mount option Since the introduction of pid namespaces, their interaction with procfs has been entirely implicit in ways that require a lot of dancing around by programs that need to construct sandboxes with different PID namespaces. Being able to explicitly specify the pid namespace to use when constructing a procfs super block will allow programs to no longer need to fork off a process which does then does unshare(2) / setns(2) and forks again in order to construct a procfs in a pidns. So, provide a "pidns" mount option which allows such users to just explicitly state which pid namespace they want that procfs instance to use. This interface can be used with fsconfig(2) either with a file descriptor or a path: fsconfig(procfd, FSCONFIG_SET_FD, "pidns", NULL, nsfd); fsconfig(procfd, FSCONFIG_SET_STRING, "pidns", "/proc/self/ns/pid", 0); or with classic mount(2) / mount(8): // mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc mount("proc", "/tmp/proc", "proc", MS_..., "pidns=/proc/self/ns/pid"); As this new API is effectively shorthand for setns(2) followed by mount(2), the permission model for this mirrors pidns_install() to avoid opening up new attack surfaces by loosening the existing permission model. In order to avoid having to RCU-protect all users of proc_pid_ns() (to avoid UAFs), attempting to reconfigure an existing procfs instance's pid namespace will error out with -EBUSY. Creating new procfs instances is quite cheap, so this should not be an impediment to most users, and lets us avoid a lot of churn in fs/proc/* for a feature that it seems unlikely userspace would use. Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-2-705f984940e7@cyphar.com Signed-off-by: Christian Brauner commit 7df87820122acd3204565109f636a1367912655a Author: Aleksa Sarai Date: Tue Aug 5 15:45:08 2025 +1000 pidns: move is-ancestor logic to helper This check will be needed in later patches, and there's no point open-coding it each time. Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-1-705f984940e7@cyphar.com Signed-off-by: Christian Brauner commit 1557c2eb023d9cdf97b4686fd206048c070d4e70 Author: Krzysztof Kozlowski Date: Sat Aug 30 13:32:54 2025 +0200 dt-bindings: arm: samsung: Drop S3C2416 Samsung S3C24xx family of SoCs was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of remaining S3C24xx compatibles. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250830113253.131974-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 4466dd3d719cca113308e8ae539adf7b3d68c985 Author: Qianfeng Rong Date: Fri Aug 29 21:37:48 2025 +0800 dm-pcache: use int type to store negative error codes Change the 'ret' variable from u32 to int to store negative error codes or zero returned by cache_kset_close(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Mikulas Patocka commit 2a06126d1624f0661fac0833e7ee1dbdc636154e Author: Luca Ceresoli Date: Tue Aug 19 11:42:10 2025 +0200 drm/debugfs: bridges_show: show refcount Now that bridges are refcounted, exposing the refcount in debugfs can be useful. Suggested-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250819-drm-bridge-debugfs-removed-v7-1-970702579978@bootlin.com Signed-off-by: Luca Ceresoli commit 02d47e213dce6e2fa197d0cff66e92f1bc55f00f Author: Joanne Koong Date: Fri Aug 29 16:56:27 2025 -0700 fuse: remove fuse_readpages_end() null mapping check Remove extra logic in fuse_readpages_end() that checks against null folio mappings. This was added in commit ce534fb05292 ("fuse: allow splice to move pages"): "Since the remove_from_page_cache() + add_to_page_cache_locked() are non-atomic it is possible that the page cache is repopulated in between the two and add_to_page_cache_locked() will fail. This could be fixed by creating a new atomic replace_page_cache_page() function. fuse_readpages_end() needed to be reworked so it works even if page->mapping is NULL for some or all pages which can happen if the add_to_page_cache_locked() failed." Commit ef6a3c63112e ("mm: add replace_page_cache_page() function") added atomic page cache replacement, which means the check against null mappings can be removed. Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi commit b3c7ab1d2593213c2d3339830b3950a689e83867 Author: Miklos Szeredi Date: Mon Sep 1 10:43:50 2025 +0200 fuse: fix references to fuse.rst -> fuse/fuse.rst Commit 6be0ddb20200 ("Documentation: fuse: Consolidate FUSE docs into its own subdirectory") moved fuse docs to a subdirectory but didn't update references inside the kernel tree. Fixes: 6be0ddb20200 ("Documentation: fuse: Consolidate FUSE docs into its own subdirectory") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508261621.EaNMWVjm-lkp@intel.com/ Signed-off-by: Miklos Szeredi commit dfb84c33079497bf27058b15780e1c7bba4c371b Author: Miklos Szeredi Date: Fri Aug 22 13:10:44 2025 +0200 fuse: allow synchronous FUSE_INIT FUSE_INIT has always been asynchronous with mount. That means that the server processed this request after the mount syscall returned. This means that FUSE_INIT can't supply the root inode's ID, hence it currently has a hardcoded value. There are other limitations such as not being able to perform getxattr during mount, which is needed by selinux. To remove these limitations allow server to process FUSE_INIT while initializing the in-core super block for the fuse filesystem. This can only be done if the server is prepared to handle this, so add FUSE_DEV_IOC_SYNC_INIT ioctl, which a) lets the server know whether this feature is supported, returning ENOTTY othewrwise. b) lets the kernel know to perform a synchronous initialization The implementation is slightly tricky, since fuse_dev/fuse_conn are set up only during super block creation. This is solved by setting the private data of the fuse device file to a special value ((struct fuse_dev *) 1) and waiting for this to be turned into a proper fuse_dev before commecing with operations on the device file. Signed-off-by: Miklos Szeredi commit 998541db0ed257ab0682e4a392d8ced5f2d5ff6b Merge: 7f9d34b0a7cb93 042a60680de431 Author: Christian Brauner Date: Tue Sep 2 10:40:58 2025 +0200 Merge patch series "vfs: if RESOLVE_NO_XDEV passed to openat2, don't *trigger* automounts" Askar Safin says: openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. See this link for full bug report with reproducer: https://lore.kernel.org/linux-fsdevel/20250817075252.4137628-1-safinaskar@zohomail.com/ This patchset fixes the bug. RESOLVE_NO_XDEV logic hopefully becomes more clear: now we immediately fail when we cross mountpoints. * patches from https://lore.kernel.org/20250825181233.2464822-1-safinaskar@zohomail.com: openat2: don't trigger automounts with RESOLVE_NO_XDEV namei: move cross-device check to __traverse_mounts namei: remove LOOKUP_NO_XDEV check from handle_mounts namei: move cross-device check to traverse_mounts Link: https://lore.kernel.org/20250825181233.2464822-1-safinaskar@zohomail.com Signed-off-by: Christian Brauner commit 042a60680de43175eb4df0977ff04a4eba9da082 Author: Askar Safin Date: Mon Aug 25 18:12:33 2025 +0000 openat2: don't trigger automounts with RESOLVE_NO_XDEV openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2 doesn't traverse through automounts, but may still trigger them. (See the link for full bug report with reproducer.) This commit fixes this bug. Link: https://lore.kernel.org/linux-fsdevel/20250817075252.4137628-1-safinaskar@zohomail.com/ Fixes: fddb5d430ad9fa91b49b1 ("open: introduce openat2(2) syscall") Reviewed-by: Aleksa Sarai Cc: stable@vger.kernel.org Signed-off-by: Askar Safin Link: https://lore.kernel.org/20250825181233.2464822-5-safinaskar@zohomail.com Signed-off-by: Christian Brauner commit 8ded1fde0827e52f3962d7931193f5a16d87a52c Author: Askar Safin Date: Mon Aug 25 18:12:32 2025 +0000 namei: move cross-device check to __traverse_mounts This is preparation to RESOLVE_NO_XDEV fix in following commits. Also this commit makes LOOKUP_NO_XDEV logic more clear: now we immediately fail with EXDEV on first mount crossing instead of waiting for very end. No functional change intended Signed-off-by: Askar Safin Link: https://lore.kernel.org/20250825181233.2464822-4-safinaskar@zohomail.com Signed-off-by: Christian Brauner commit 8b966d00b3ece6b1ffa4b6d73d484cf0ecf967e6 Author: Askar Safin Date: Mon Aug 25 18:12:31 2025 +0000 namei: remove LOOKUP_NO_XDEV check from handle_mounts This is preparation to RESOLVE_NO_XDEV fix in following commits. No functional change intended. The only place that ever looks at ND_JUMPED in nd->state is complete_walk() and we are not going to reach it if handle_mounts() returns an error Signed-off-by: Askar Safin Link: https://lore.kernel.org/20250825181233.2464822-3-safinaskar@zohomail.com Signed-off-by: Christian Brauner commit 11c2b7ec2e1865bbc6a65e7d7312a5043e3cc1aa Author: Askar Safin Date: Mon Aug 25 18:12:30 2025 +0000 namei: move cross-device check to traverse_mounts This is preparation to RESOLVE_NO_XDEV fix in following commits. No functional change intended Signed-off-by: Askar Safin Link: https://lore.kernel.org/20250825181233.2464822-2-safinaskar@zohomail.com Signed-off-by: Christian Brauner commit c9f62564252c21d739a5003e9b2d6ad0828aa7bd Author: Krzysztof Kozlowski Date: Sat Aug 30 19:01:11 2025 +0200 mtd: rawnand: s3c2410: Drop driver (no actual S3C64xx user) The s3c2410 NAND driver still supports S3C64xx platform, which in general is supported in the kernel. There are however no references of "s3c6400-nand" platform device ID or "s3c24xx-nand" driver, thus this driver cannot be instantiated for S3C64xx platform and is basically unused. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 6186e80a7440e0f9f45de6275b7f495ea11bd72c Author: Krzysztof Kozlowski Date: Sat Aug 30 19:01:10 2025 +0200 dt-bindings: mtd samsung-s3c2410: Drop S3C2410 support Samsung S3C24xx family of SoCs was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of its compatibles. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit e54a52a28a362cb3a88d7996558f547666ee79e7 Author: Yuanfang Zhang Date: Thu Jul 10 13:27:21 2025 +0800 coresight: add coresight Trace Network On Chip driver Add a driver to support Coresight device Trace Network On Chip (TNOC), which is an integration hierarchy integrating functionalities of TPDA and funnels. It aggregates the trace and transports to coresight trace bus. Compared to current configuration, it has the following advantages: 1. Reduce wires between subsystems. 2. Continue cleaning the infrastructure. 3. Reduce Data overhead by transporting raw data from source to target. +------------------------+ +-------------------------+ | Video Subsystem | |Video Subsystem | | +-------------+ | | +------------+ | | | Video TPDM | | | | Video TPDM | | | +-------------+ | | +------------+ | | | | | | | | v | | v | | +---------------+ | | +-----------+ | | | Video funnel | | | |Video TNOC | | | +---------------+ | | +-----------+ | +------------|-----------+ +------------|------------+ | | v-----+ | +--------------------|---------+ | | Multimedia v | | | Subsystem +--------+ | | | | TPDA | | v | +----|---+ | +---------------------+ | | | | Aggregator TNOC | | | | +----------|----------+ | +-- | | | | | | | | | | | +------v-----+ | | | | Funnel | | | | +------------+ | | +----------------|-------------+ | | | v v +--------------------+ +------------------+ | Coresight Sink | | Coresight Sink | +--------------------+ +------------------+ Current Configuration TNOC Reviewed-by: Leo Yan Signed-off-by: Yuanfang Zhang Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250710-trace-noc-v11-2-f849075c40b8@quicinc.com commit 931c93119d7228f0fd08dc8dfc229d438aacfc11 Author: Yuanfang Zhang Date: Thu Jul 10 13:27:20 2025 +0800 dt-bindings: arm: Add device Trace Network On Chip definition Add a new coresight-tnoc.yaml file to describe the bindings required to define Trace Network On Chip (TNOC) in device trees. TNOC is an integration hierarchy which is a hardware component that integrates the functionalities of TPDA and funnels. It collects trace form subsystems and transfers to coresight sink. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yuanfang Zhang Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250710-trace-noc-v11-1-f849075c40b8@quicinc.com commit fd4ed47e9d6f7ab140fc2f060884c6d430fefca0 Author: Leo Yan Date: Wed Jun 11 15:44:02 2025 +0100 coresight: perf: Use %px for printing pointers Use "%px" to print a pointer, which is better than casting the pointer to unsigned long and printing it with the "%lx" specifier. Note, the printing format will be updated as 64-bit value: # cat /sys/devices/cs_etm/sinks/trbe0 0x000000003744496a This commit dismisses the following smatch warnings: coresight-etm-perf.c:854 etm_perf_sink_name_show() warn: argument 4 to %lx specifier is cast from pointer coresight-etm-perf.c:946 etm_perf_cscfg_event_show() warn: argument 4 to %lx specifier is cast from pointer Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250611-arm_cs_fix_smatch_warning_v1-v1-2-02a66c69b604@arm.com commit 3252ee432e58871f81be211e5ef9630fc51e341f Author: Leo Yan Date: Wed Jun 11 15:44:01 2025 +0100 coresight: stm: Remove redundant NULL checks container_of() cannot return NULL, so the checks for NULL pointers are unnecessary and can be safely removed. As a result, this commit silences the following smatch warnings: coresight-stm.c:345 stm_generic_link() warn: can 'drvdata' even be NULL? coresight-stm.c:356 stm_generic_unlink() warn: can 'drvdata' even be NULL? coresight-stm.c:387 stm_generic_set_options() warn: can 'drvdata' even be NULL? coresight-stm.c:422 stm_generic_packet() warn: can 'drvdata' even be NULL? Signed-off-by: Leo Yan Reviewed-by: Anshuman Khandual Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250611-arm_cs_fix_smatch_warning_v1-v1-1-02a66c69b604@arm.com commit 9ba5502136eea6f3c95ab3c84220916fac89d844 Author: Rob Herring (Arm) Date: Thu Jul 3 13:35:33 2025 -0500 hwtracing: coresight: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250703183534.2075569-1-robh@kernel.org commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 Author: Yuanfang Zhang Date: Mon Jun 30 18:26:19 2025 +0800 coresight: Only register perf symlink for sinks with alloc_buffer Ensure that etm_perf_add_symlink_sink() is only called for devices that implement the alloc_buffer operation. This prevents invalid symlink creation for dummy sinks that do not implement alloc_buffer. Without this check, perf may attempt to use a dummy sink that lacks alloc_buffer operationsu to initialise perf's ring buffer, leading to runtime failures. Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver") Signed-off-by: Yuanfang Zhang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de Author: James Clark Date: Mon Jul 7 10:55:27 2025 +0100 coresight: Fix missing include for FIELD_GET Include the header for FIELD_GET which is only sometimes transitively included on some configs and kernel releases. Reported-by: Linux Kernel Functional Testing Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/ Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits") Signed-off-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org commit 52c0164b2526bce7013fca193e076f6d9eec9c95 Author: James Clark Date: Mon Jun 9 11:19:05 2025 +0100 coresight: trbe: Add ISB after TRBLIMITR write DEN0154 states that hardware will be allowed to ignore writes to TRB* registers while the trace buffer is enabled. Add an ISB to ensure that it's disabled before clearing the other registers. This is purely defensive because it's expected that arm_trbe_disable() would be called before teardown which has the required ISB. Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call") Signed-off-by: James Clark Reviewed-by: Yeoreum Yun Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org commit c2d5d8f247049e22ef0afe8188cf8a6430144a17 Author: Heiko Stuebner Date: Mon Aug 4 13:49:49 2025 +0200 leds: qnap-mcu: Add support for the red and green status LEDs There is one more set of two LEDs on the qnap devices to indicate status. One LED is green, the other is red and while they occupy the same space on the front panel, they cannot be enabled at the same time. But they can interact via blink functions, the MCU can flash them alternately, going red -> green -> red -> ... either in 500ms or 1s intervals. They can of course also blink individually. Add specific LED functions for them and register them on probe. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804114949.3127417-3-heiko@sntech.de Signed-off-by: Lee Jones commit fe4ffdbab4bb3cda1d72b93f7d2c3f7ea3df415d Author: Heiko Stuebner Date: Mon Aug 4 13:49:48 2025 +0200 leds: qnap-mcu: Fix state numbering for USB LED The "@Cx" commands span a number of different functions, from the status and USB LEDs to the buzzer and power button. So change the USB-LED enum to start at 0 and adapt the offset accordingly to not suggest @CD would relate to the USB-LED - while in fact "@CD" is a state of the status LED. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804114949.3127417-2-heiko@sntech.de Signed-off-by: Lee Jones commit cc0bacac6de7763a038550cf43cb94634d8be9cd Author: Tommaso Merciai Date: Fri Aug 1 10:48:22 2025 +0200 dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs The DMAC block on the RZ/G3E SoC is identical to the one found on the RZ/V2H(P) SoC. No driver changes are required, as `renesas,r9a09g057-dmac` will be used as a fallback compatible string on the RZ/G3E SoC. Signed-off-by: Tommaso Merciai Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250801084825.471011-3-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit b2b8af21fec35be417a3199b5a6c354605dd222a Author: Pierre-Eric Pelloux-Prayer Date: Mon Sep 1 14:40:32 2025 +0200 drm/sched: Fix racy access to drm_sched_entity.dependency The drm_sched_job_unschedulable trace point can access entity->dependency after it was cleared by the callback installed in drm_sched_entity_add_dependency_cb, causing: BUG: kernel NULL pointer dereference, address: 0000000000000020 [...] Workqueue: comp_1.1.0 drm_sched_run_job_work [gpu_sched] RIP: 0010:trace_event_raw_event_drm_sched_job_unschedulable+0x70/0xd0 [gpu_sched] To fix this we either need to keep a reference to the fence before setting up the callbacks, or move the trace_drm_sched_job_unschedulable calls into drm_sched_entity_add_dependency_cb where they can be done earlier. Fixes: 76d97c870f29 ("drm/sched: Trace dependencies for GPU jobs") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250901124032.1955-1-pierre-eric.pelloux-prayer@amd.com commit 5e742de97c806a4048418237ef1283e7d71eaf4b Author: Devendra K Verma Date: Thu Aug 21 17:45:05 2025 +0530 dmaengine: dw-edma: Set status for callback_result DMA Engine has support for the callback_result which provides the status of the request and the residue. This helps in determining the correct status of the request and in efficient resource management of the request. The 'callback_result' method is preferred over the deprecated 'callback' method. Signed-off-by: Devendra K Verma Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com Signed-off-by: Vinod Koul commit a33e3b667d2f004fdfae6b442bd4676f6c510abb Author: Rosen Penev Date: Thu Aug 21 15:09:42 2025 -0700 dmaengine: mv_xor: match alloc_wc and free_wc dma_alloc_wc is used but not dma_free_wc. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com Signed-off-by: Vinod Koul commit 5cfe585d8624f7482505183dd0e4c534b061e822 Author: Guodong Xu Date: Fri Aug 22 11:06:31 2025 +0800 dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing Add support for SpacemiT K1 PDMA controller which features 64-bit addressing capabilities. The SpacemiT K1 PDMA extends the descriptor format with additional 32-bit words for high address bits, enabling access to memory beyond 4GB boundaries. The new spacemit_k1_pdma_ops provides necessary 64-bit address handling functions and k1 specific controller configurations. Key changes: - Add ARCH_SPACEMIT dependency to Kconfig - Define new high 32-bit address registers (DDADRH, DSADRH, DTADRH) - Add DCSR_LPAEEN bit for Long Physical Address Extension Enable - Implement 64-bit operations for SpacemiT K1 PDMA Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-5-f5c0eda734cc@riscstar.com Signed-off-by: Vinod Koul commit 35e40bf761fcb24b1355d6a8d48b5b10683fe1a3 Author: Guodong Xu Date: Fri Aug 22 11:06:30 2025 +0800 dmaengine: mmp_pdma: Add operations structure for controller abstraction Introduce mmp_pdma_ops structure to abstract 32-bit addressing operations and enable support for different controller variants. This prepares for adding 64-bit addressing support. The ops structure includes: - Hardware register operations (read/write DDADR, DSADR, DTADR) - Descriptor memory operations (manipulate descriptor structs) - Controller configuration (run bits, DMA mask) Convert existing 32-bit operations to use the new abstraction layer while maintaining backward compatibility. Cc: Dan Carpenter Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-4-f5c0eda734cc@riscstar.com Signed-off-by: Vinod Koul commit fc72462bc6107b8babda05cad5bf8f7daf8bec20 Author: Guodong Xu Date: Fri Aug 22 11:06:29 2025 +0800 dmaengine: mmp_pdma: Add reset controller support Add support to acquire and deassert an optional hardware reset controller during mmp_pdma_probe(). It is optional because in Marvell devices such as "marvell,pdma-1.0" the resets property is not a required property. But in SpacemiT K1 PDMA, "spacemit,k1-pdma" as the dt binding schema file stated, resets is required. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-3-f5c0eda734cc@riscstar.com Signed-off-by: Vinod Koul commit e73a9a13c99c5a55abfdb8c273651509be1eb5bb Author: Guodong Xu Date: Fri Aug 22 11:06:28 2025 +0800 dmaengine: mmp_pdma: Add clock support Add support for retrieving and enabling an optional clock during mmp_pdma_probe(). It is optional because in Marvell devices such as "marvell,pdma-1.0" the clocks property is not a required property. But in SpacemiT K1 PDMA, "spacemit,k1-pdma" as the dt binding schema file stated, clocks is required. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-2-f5c0eda734cc@riscstar.com Signed-off-by: Vinod Koul commit 39ce725e621b256188550492b4b53fb02bfc872e Author: Guodong Xu Date: Fri Aug 22 11:06:27 2025 +0800 dt-bindings: dma: Add SpacemiT K1 PDMA controller Add device tree binding documentation for the SpacemiT K1 PDMA controller. Signed-off-by: Guodong Xu Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250822-working_dma_0701_v2-v5-1-f5c0eda734cc@riscstar.com Signed-off-by: Vinod Koul commit d5df661c9c76cb36d90527349ac6197a4baf2aba Author: Abin Joseph Date: Mon Aug 25 18:34:23 2025 +0530 dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties Remove DMA client section mentioned in the dt-bindings as it is not required to document client bindings in dmaengine bindings. Signed-off-by: Abin Joseph Signed-off-by: Radhey Shyam Pandey Acked-by: Rob Herring Signed-off-by: Abin Joseph Link: https://lore.kernel.org/r/20250825130423.5739-1-abin.joseph@amd.com Signed-off-by: Vinod Koul commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c Author: Nathan Lynch Date: Tue Aug 26 11:07:38 2025 -0500 dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings") inserted new documentation for @desc_free in the middle of @tx_submit's description. Put @tx_submit's description back together, matching the indentation style of the rest of the documentation for dma_async_tx_descriptor. Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings") Reviewed-by: Dave Jiang Signed-off-by: Nathan Lynch Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com Signed-off-by: Vinod Koul commit 38433a6fdfb75d12a90ffff262705e1ecfe88556 Author: Folker Schwesinger Date: Tue Aug 26 20:21:10 2025 +0200 dmaengine: xilinx_dma: Support descriptor setup from dma_vecs The DMAEngine provides an interface for obtaining DMA transaction descriptors from an array of scatter gather buffers represented by struct dma_vec. This interface is used in the DMABUF API of the IIO framework [1][2]. To enable DMABUF support through the IIO framework for the Xilinx DMA, implement callback .device_prep_peripheral_dma_vec() of struct dma_device in the driver. [1]: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API") [2]: 5878853fc938 ("dmaengine: Add API function dmaengine_prep_peripheral_dma_vec()") Signed-off-by: Folker Schwesinger Reviewed-by: Suraj Gupta Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/DCCKQLKOZC06.2H6LJ8RJQJNV2@folker-schwesinger.de Signed-off-by: Vinod Koul commit d9a3e9929452780df16f3414f0d59b5f69d058cf Author: Thomas Andreatta Date: Wed Aug 27 17:24:43 2025 +0200 dmaengine: sh: setup_xref error handling This patch modifies the type of setup_xref from void to int and handles errors since the function can fail. `setup_xref` now returns the (eventual) error from `dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the result, removing the chunks from the queue and marking PM as idle in case of an error. Signed-off-by: Thomas Andreatta Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com Signed-off-by: Vinod Koul commit 07c53a9e970712b1a479dd0ec4adfe184482c22f Author: Andy Yan Date: Fri Aug 22 14:39:54 2025 +0800 arm64: dts: rockchip: Enable DP2HDMI for ROCK 5 ITX The HDMI0(Port next to Headphone Jack) is driven by DP1 on rk3588 via RA620(a dp2hdmi converter). Add related dt nodes to enable it. Note: ROCKCHIP_VOP2_EP_DP1 is defined as 11 in dt-binding header, but it will trigger a dtc warning like "graph node unit address error, expected "b"" if we use it directly after endpoint, so we use "b" instead here. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822063959.692098-11-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 7260b0f1d6a1555a57f6e94db18c932af8e0e714 Author: Andy Yan Date: Fri Aug 22 14:39:53 2025 +0800 arm64: dts: rockchip: Enable DisplayPort for rk3588s Cool Pi 4B Enable the Mini DisplayPort on this board. Note that ROCKCHIP_VOP2_EP_DP0 is defined as 10 in dt-binding header, but it will trigger a dtc warning like "graph node unit address error, expected "a"" if we use it directly after endpoint, so we use "a" instead here. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822063959.692098-10-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 64566e35757faded57a65d65e84b5ca95974ee19 Author: Andy Yan Date: Fri Aug 22 14:39:52 2025 +0800 arm64: dts: rockchip: Add DP1 for rk3588 The DP1 is compliant with the DisplayPort Specification Version 1.4, and share the USBDP combo PHY1 with USB 3.1 HOST1 controller. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250822063959.692098-9-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 680826a5299bbb4cec839a04ac6032be719c4c05 Author: Andy Yan Date: Fri Aug 22 14:39:51 2025 +0800 arm64: dts: rockchip: Add DP0 for rk3588 The DP0 is compliant with the DisplayPort Specification Version 1.4, and share the USBDP combo PHY0 with USB 3.1 HOST0 controller. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250822063959.692098-8-andyshrk@163.com Signed-off-by: Heiko Stuebner commit b944112abef4e52e81b19be44a7bac5b45779ba1 Author: Jonas Karlman Date: Thu Jul 17 10:37:08 2025 +0000 arm64: dts: rockchip: Add FriendlyElec NanoPi Zero2 The NanoPi Zero2 is a small single board computer developed by FriendlyElec, based on the Rockchip RK3528A SoC. Add initial device tree for the FriendlyElec NanoPi Zero2 board. Signed-off-by: Jonas Karlman Tested-by: Yao Zi Link: https://lore.kernel.org/r/20250717103720.2853031-7-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 11100e8f407e99adac2d311803540540b9726699 Author: Jonas Karlman Date: Thu Jul 17 10:37:07 2025 +0000 dt-bindings: arm: rockchip: Add FriendlyElec NanoPi Zero2 The NanoPi Zero2 is small single board computer developed by FriendlyElec, based on the Rockchip RK3528A SoC. Add devicetree binding documentation for the FriendlyElec NanoPi Zero2 board. Signed-off-by: Jonas Karlman Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717103720.2853031-6-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 1c6b12ef9575bc18dad2393e50ca1ebf96f0a0c8 Author: Jonas Karlman Date: Thu Jul 17 10:37:06 2025 +0000 arm64: dts: rockchip: Add ArmSoM Sige1 The Sige1 is a single board computer developed by ArmSoM, based on the Rockchip RK3528A SoC. Add initial device tree for the ArmSoM Sige1 board. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250717103720.2853031-5-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 10e6b1caacb85bb41cacb9271cdb794ae323ee52 Author: Jonas Karlman Date: Thu Jul 17 10:37:05 2025 +0000 dt-bindings: arm: rockchip: Add ArmSoM Sige1 The Sige1 is a single board computer developed by ArmSoM, based on the Rockchip RK3528A SoC. Add devicetree binding documentation for the ArmSoM Sige1 board. Signed-off-by: Jonas Karlman Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717103720.2853031-4-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 5b71b3d9aa61626d6a93ed2f761a748aa2ecfa95 Author: Jonas Karlman Date: Thu Jul 17 10:37:04 2025 +0000 arm64: dts: rockchip: Add Radxa ROCK 2A/2F The ROCK 2A and ROCK 2F is a high-performance single board computer developed by Radxa, based on the Rockchip RK3528A SoC. Add initial device tree for the Radxa ROCK 2A and ROCK 2F boards. Signed-off-by: Jonas Karlman Tested-by: Yao Zi Reviewed-by: Nicolas Frattaroli Tested-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250717103720.2853031-3-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit af13e0089e98a135757ae46f6f9d5a96d33af840 Author: Jonas Karlman Date: Thu Jul 17 10:37:03 2025 +0000 dt-bindings: arm: rockchip: Add Radxa ROCK 2A/2F The ROCK 2A and ROCK 2F is a high-performance single board computer developed by Radxa, based on the Rockchip RK3528A SoC. Add devicetree binding documentation for the Radxa ROCK 2A and ROCK 2F boards. Signed-off-by: Jonas Karlman Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717103720.2853031-2-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit faeb2bede83475fc74230d4ee4f4cc126eb6a444 Author: Heiko Stuebner Date: Thu Aug 28 15:11:07 2025 +0200 dt-bindings: soc: rockchip: add missing clock reference for rk3576-dcphy syscon The rk3576 mipi dcphy syscon controls a clock, so needs to allow the clock property. Add the missing entry in the list for it. Fixes: 0e3f3d7c7ae3 ("dt-bindings: soc: rockchip: add rk3576 mipi dcphy syscon") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508271156.z3wDB6bX-lkp@intel.com/ Acked-by: Conor Dooley Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250828131107.3531769-1-heiko@sntech.de commit c05dac8e54bfd1e3af2e971f01c56f9ddeca4a0f Author: Alex Bee Date: Thu Aug 28 17:16:45 2025 +0000 arm64: dts: rockchip: add USB3 on Beelink A1 Enable USB3 for the Beelink A1 set-top box. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Link: https://lore.kernel.org/r/20250828171645.3830437-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit bdc4d388c6452498ab62ef2564589f40e0c8c262 Author: Alex Bee Date: Thu Aug 28 16:43:00 2025 +0000 arm64: dts: rockchip: add SPDIF audio to Beelink A1 Add the required nodes to enable SPDIF audio output on the Beelink A1 set-top-box. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Link: https://lore.kernel.org/r/20250828164300.3829488-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 981d4978ff09d13690739663b3cd71ad8bb5ad94 Author: Chelsy Ratnawat Date: Sat Aug 30 06:26:33 2025 -0700 dmaengine: Replace zero-length array with flexible-array Documentation/process/deprecated.rst suggests that zero-length and one-element arrays are deprecated, flexible-array members should be used instead. Signed-off-by: Chelsy Ratnawat Link: https://lore.kernel.org/r/20250830132633.1803300-1-chelsyratnawat2001@gmail.com Signed-off-by: Vinod Koul commit ee4b32220a6b41e71512e8804585325e685456ba Author: Satyanarayana K V P Date: Mon Sep 1 12:55:41 2025 +0530 drm/xe/guc: Add devm release action to safely tear down CT When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag, the driver initiates TLB invalidation requests via the CTB mechanism while releasing the BO. However a premature release of the CTB BO can lead to system crashes, as observed in: Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:h2g_write+0x2f3/0x7c0 [xe] Call Trace: guc_ct_send_locked+0x8b/0x670 [xe] xe_guc_ct_send_locked+0x19/0x60 [xe] send_tlb_invalidation+0xb4/0x460 [xe] xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe] ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe] ggtt_node_remove+0x110/0x140 [xe] xe_ggtt_node_remove+0x40/0xa0 [xe] xe_ggtt_remove_bo+0x87/0x250 [xe] Introduce a devm-managed release action during xe_guc_ct_init() and xe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before resource deallocation, preventing the use-after-free scenario. Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Matthew Auld Cc: Summers Stuart Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250901072541.31461-1-satyanarayana.k.v.p@intel.com commit e548e04e619d34c31c98f3b250c2792a0e535278 Author: Suraj Kandpal Date: Tue Aug 19 20:37:29 2025 +0530 drm/i915/hdcp: Remove the encoder check in hdcp enable Remove the intel_encoder NULL check from _intel_hdcp_enable. With all the changes it has gone through this check has become unnecessary since at this point the connector is supposed to have the encoder in it. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250819150729.88561-1-suraj.kandpal@intel.com commit 4bf83dd6e3b3b2a131e357f035b17edaee6f6766 Merge: 83631c7b1f5baf b7a855f488c682 Author: Dave Airlie Date: Tue Sep 2 11:23:39 2025 +1000 Merge tag 'drm-intel-gt-next-2025-09-01' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: - Apply multiple JSL/EHL/Gen7/Gen6 workaround properly at context level (Sebastian) - Protect against overflow in active_engine() (Krzysztof) - Use try_cmpxchg64() in __active_lookup() (Uros) - Enable GuC CT_DEAD output in regular debug builds (John) - Static checker and style fixes (Sebastian) - Selftest improvements (Krzysztof) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://lore.kernel.org/r/aLWZoEZVlBj2d8J9@jlahtine-mobl commit 83631c7b1f5bafb8c6f976c3aab63f2cac962c8e Merge: 14579a6f18506f 1047bd82794a1e Author: Dave Airlie Date: Tue Sep 2 10:05:55 2025 +1000 Merge tag 'drm-xe-next-2025-08-29' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Add madvise interface (Himal Prasad Ghimiray) - Add DRM_IOCTL_XE_VM_QUERY_MEMORY_RANGE_ATTRS to query VMA count and memory attributes (Himal Prasad Ghimiray) - Handle Firmware reported Hardware Errors notifying userspace with device wedged uevent (Riana Tauro) Cross-subsystem Changes: - Add a vendor-specific recovery method to drm device wedged uevent (Riana Tauro) Driver Changes: - Use same directory structure in debugfs as in sysfs (Michal Wajdeczko) - Cleanup and future-proof VRAM region initialization (Piotr Piórkowski) - Add G-states and PCIe link states to debugfs (Soham Purkait) - Cleanup eustall debug messages (Harish Chegondi) - Add SR-IOV support to restore Compression Control Surface (CCS) to Xe2 and later (Satyanarayana K V P) - Enable SR-IOV PF mode by default on supported platforms without needing CONFIG_DRM_XE_DEBUG and mark some platforms behind force_probe as supported (Michal Wajdeczko) - More targeted log messages (Michal Wajdeczko) - Cleanup STEER_SEMAPHORE/MCFG_MCR_SELECTOR usage (Nitin Gote) - Use common code to emit flush (Tvrtko Ursulin) - Add/extend more HW workarounds and tunings for Xe2 and Xe3 (Sk Anirban, Tangudu Tilak Tirumalesh, Nitin Gote, Chaitanya Kumar Borah) - Add a generic dependency scheduler to help with TLB invalidations and future scenarios (Matthew Brost) - Use DRM scheduler for delayed GT TLB invalidations (Matthew Brost) - Error out on incorrect device use in configfs (Michal Wajdeczko, Lucas De Marchi) - Refactor configfs attributes (Michal Wajdeczko / Lucas De Marchi) - Allow configuring future VF devices via configfs (Michal Wajdeczko) - Implement some missing XeLP workarounds (Tvrtko Ursulin) - Generalize WA BB setup/emission and add support for mid context restore BB, aka indirect context (Tvrtko Ursulin) - Prepare the driver to expose mmio regions to userspace in future (Ilia Levi) - Add more GuC load error status codes (John Harrison) - Document DRM_XE_GEM_CREATE_FLAG_DEFER_BACKING (Priyanka Dandamudi) - Disable CSC and RPM on VFs (Lukasz Laguna, Satyanarayana K V P) - Fix oops in xe_gem_fault with PREEMPT_RT (Maarten Lankhorst) - Skip LMTT update if no LMEM was provisioned (Michal Wajdeczko) - Add support to VF migration (Tomasz Lis) - Use a helper for guc_waklv_enable functions (Jonathan Cavitt) - Prepare GPU SVM for migration of THP (Francois Dugast) - Program LMTT directory pointer on all GTs within a tile (Piotr Piórkowski) - Rename XE_WA to XE_GT_WA to better convey its scope vs the device WAs (Matt Atwood) - Allow to match devices on PCI devid/vendorid only (Lucas De Marchi) - Improve PDE PAT index selection (Matthew Brost) - Consolidate ASID allocation in xe_vm_create() vs xe_vm_create_ioctl() (Piotr Piórkowski) - Resize VF BARS to max possible size according to number of VFs (Michał Winiarski) - Untangle vm_bind_ioctl cleanup order (Christoph Manszewski) - Start fixing usage of XE_PAGE_SIZE vs PAGE_SIZE to improve compatibility with non-x86 arch (Simon Richter) - Improve tile vs gt initialization order and accounting (Gustavo Sousa) - Extend WA kunit test to PTL - Ensure data is initialized before transferring to pcode (Stuart Summers) - Add PSMI support for HW validation (Lucas De Marchi, Vinay Belgaumkar, Badal Nilawar) - Improve xe_dma_buf test (Thomas Hellström, Marcin Bernatowicz) - Fix basename() usage in generator with !glibc (Carlos Llamas) - Ensure GT is in C0 during resumes (Xin Wang) - Add TLB invalidation abstraction (Matt Brost, Stuart Summers) - Make MI_TLB_INVALIDATE conditional on migrate (Matthew Auld) - Prepare xe_nvm to be initialized early for future use cases (Riana Tauro) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/nuejxdhnalyok7tzwkrj67dwjgdafwp4mhdejpyyqnrh4f2epq@nlldovuflnbx commit 14579a6f18506fbb3613d509b8291e3d13c13952 Merge: ddcc2bb28878b5 585b2f685c56c5 Author: Dave Airlie Date: Tue Sep 2 09:35:11 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-08-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-08-29: amdgpu: - Replay fixes - RAS updates - VCN SRAM load fixes - EDID read fixes - eDP ALPM support - AUX fixes - Documenation updates - Rework how PTE flags are generated - DCE6 fixes - VCN devcoredump cleanup - MMHUB client id fixes - SR-IOV fixes - VRR fixes - VCN 5.0.1 RAS support - Backlight fixes - UserQ fixes - Misc code cleanups - SMU 13.0.12 updates - Expanded PCIe DPC support - Expanded VCN reset support - SMU 13.0.x Updates - VPE per queue reset support - Cusor rotation fix - DSC fixes - GC 12 MES TLB invalidation update - Cursor fixes - Non-DC TMDS clock validation fix amdkfd: - debugfs fixes - Misc code cleanups - Page migration fixes - Partition fixes - SVM fixes radeon: - Misc code cleanups Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250829190848.1921648-1-alexander.deucher@amd.com commit 2fd4161d0d2547650d9559d57fc67b4e0a26a9e3 Merge: ec0b1eeece2819 51ba2d26bcc61b Author: Jakub Kicinski Date: Mon Sep 1 13:15:17 2025 -0700 Merge branch 'inet-ping-misc-changes' Eric Dumazet says: ==================== inet: ping: misc changes First and third patches improve security a bit. Second patch (ping_hash removal) is a cleanup. Fourth patch uses EXPORT_IPV6_MOD[_GPL]. ==================== Link: https://patch.msgid.link/20250829153054.474201-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 51ba2d26bcc61b65b7bd26346580d016ce8f7fa0 Author: Eric Dumazet Date: Fri Aug 29 15:30:54 2025 +0000 inet: ping: use EXPORT_IPV6_MOD[_GPL]() There is no neeed to export ping symbols when CONFIG_IPV6=y Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250829153054.474201-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 689adb36bd433b24390080606a07d664cca2982e Author: Eric Dumazet Date: Fri Aug 29 15:30:53 2025 +0000 inet: ping: make ping_port_rover per netns Provide isolation between netns for ping idents. Randomize initial ping_port_rover value at netns creation. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250829153054.474201-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 10343e7e6c7c6558217b56fb44a538ad04752adb Author: Eric Dumazet Date: Fri Aug 29 15:30:52 2025 +0000 inet: ping: remove ping_hash() There is no point in keeping ping_hash(). Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Yue Haibing Link: https://patch.msgid.link/20250829153054.474201-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 Author: Eric Dumazet Date: Fri Aug 29 15:30:51 2025 +0000 inet: ping: check sock_net() in ping_get_port() and ping_lookup() We need to check socket netns before considering them in ping_get_port(). Otherwise, one malicious netns could 'consume' all ports. Add corresponding check in ping_lookup(). Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Yue Haibing Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit ec0b1eeece28193e005a6b4b82972565fb5ca2b3 Author: Russell King (Oracle) Date: Fri Aug 29 10:02:29 2025 +0100 net: stmmac: mdio: update runtime PM Commit 3c7826d0b106 ("net: stmmac: Separate C22 and C45 transactions for xgmac") missed a change that happened in commit e2d0acd40c87 ("net: stmmac: using pm_runtime_resume_and_get instead of pm_runtime_get_sync"). Update the two clause 45 functions that didn't get switched to pm_runtime_resume_and_get(). Signed-off-by: Russell King (Oracle) Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E1urv09-00000000gJ1-3SxO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c85ae0240ee9ee9dfbd7e7fd8fc5f3c1c4367491 Author: Praveen Balakrishnan Date: Thu Aug 28 22:11:00 2025 +0100 selftests: net: fix spelling and grammar mistakes Fix several spelling and grammatical mistakes in output messages from the net selftests to improve readability. Only the message strings for the test output have been modified. No changes to the functional logic of the tests have been made. Signed-off-by: Praveen Balakrishnan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250828211100.51019-1-praveen.balakrishnan@magd.ox.ac.uk Signed-off-by: Jakub Kicinski commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 Author: Miroslav Lichvar Date: Thu Aug 28 12:32:53 2025 +0200 ptp: Limit time setting of PTP clocks Networking drivers implementing PTP clocks and kernel socket code handling hardware timestamps use the 64-bit signed ktime_t type counting nanoseconds. When a PTP clock reaches the maximum value in year 2262, the timestamps returned to applications will overflow into year 1667. The same thing happens when injecting a large offset with clock_adjtime(ADJ_SETOFFSET). The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting CLOCK_REALTIME") limited the maximum accepted value setting the system clock to 30 years before the maximum representable value (i.e. year 2232) to avoid the overflow, assuming the system will not run for more than 30 years. Enforce the same limit for PTP clocks. Don't allow negative values and values closer than 30 years to the maximum value. Drivers may implement an even lower limit if the hardware registers cannot represent the whole interval between years 1970 and 2262 in the required resolution. Signed-off-by: Miroslav Lichvar Cc: Richard Cochran Cc: Thomas Gleixner Cc: John Stultz Cc: Arnd Bergmann Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com Signed-off-by: Jakub Kicinski commit 35dface61cfed92bf90f68b38b9f8a1d6c30d7df Author: Geert Uytterhoeven Date: Fri Aug 29 13:27:06 2025 +0200 net: ethernet: qualcomm: QCOM_PPE should depend on ARCH_QCOM The Qualcomm Technologies, Inc. Packet Process Engine (PPE) is only present on Qualcomm IPQ SoCs. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm platform support, Fixes: 353a0f1d5b27606b ("net: ethernet: qualcomm: Add PPE driver for IPQ9574 SoC") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman Link: https://patch.msgid.link/eb7bd6e6ce27eb6d602a63184d9daa80127e32bd.1756466786.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 7051b54fb5aa2d0b77657aef7c272471b36c0327 Author: Kuniyuki Iwashima Date: Fri Aug 29 21:56:38 2025 +0000 tcp: Remove sk->sk_prot->orphan_count. TCP tracks the number of orphaned (SOCK_DEAD but not yet destructed) sockets in tcp_orphan_count. In some code that was shared with DCCP, tcp_orphan_count is referenced via sk->sk_prot->orphan_count. Let's reference tcp_orphan_count directly. inet_csk_prepare_for_destroy_sock() is moved to inet_connection_sock.c due to header dependency. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250829215641.711664-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3379c900320954d768ed9903691fb2520926bbe3 Author: Qianfeng Rong Date: Mon Sep 1 21:57:26 2025 +0800 iio: dac: ad5421: use int type to store negative error codes Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5421_write_unlocked(). Fixes: 5691b23489db ("staging:iio:dac: Add AD5421 driver") Signed-off-by: Qianfeng Rong Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250901135726.17601-3-rongqianfeng@vivo.com Cc: Signed-off-by: Jonathan Cameron commit f9381ece76de999a2065d5b4fdd87fa17883978c Author: Qianfeng Rong Date: Mon Sep 1 21:57:25 2025 +0800 iio: dac: ad5360: use int type to store negative error codes Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to int, as it needs to store either negative error codes or zero returned by ad5360_write_unlocked(). Fixes: a3e2940c24d3 ("staging:iio:dac: Add AD5360 driver") Signed-off-by: Qianfeng Rong Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250901135726.17601-2-rongqianfeng@vivo.com Cc: Signed-off-by: Jonathan Cameron commit ca38943e83c7274a7b03b36c02807ea6d6adaac2 Author: Benjamin Berg Date: Thu Jul 31 22:12:23 2025 +0200 selftests/nolibc: remove outdated comment about construct order The constructor order is not (and should not) be tested. Remove the comment. Fixes: a782d45c867c ("selftests/nolibc: stop testing constructor order") Signed-off-by: Benjamin Berg Link: https://lore.kernel.org/r/20250731201225.323254-3-benjamin@sipsolutions.net Signed-off-by: Thomas Weißschuh commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 Author: Benjamin Berg Date: Thu Jul 31 22:12:22 2025 +0200 selftests/nolibc: fix EXPECT_NZ macro The expect non-zero macro was incorrect and never used. Fix its definition. Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests") Signed-off-by: Benjamin Berg Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net Signed-off-by: Thomas Weißschuh commit 4c2ef951cfe68bcd823d59a9e7ef9e3c16aa3974 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:38 2025 +0200 tools/nolibc: drop wait4() support Not all architectures implement the wait4() syscall. It can be implemented in terms of the waitid() syscall, but that would require some rework of the other wait-related functions in wait.h. As wait4() is non-standard and deprecated, remove it. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-7-4b63f2caaa89@weissschuh.net commit 61a3cf7934b6da3c926cd9961860dd94eb7192ba Author: Thomas Weißschuh Date: Thu Aug 21 17:40:37 2025 +0200 kselftest/arm64: tpidr2: Switch to waitpid() over wait4() wait4() is deprecated, non-standard and about to be removed from nolibc. Switch to the equivalent waitpid() call. Signed-off-by: Thomas Weißschuh Reviewed-by: Mark Brown Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-6-4b63f2caaa89@weissschuh.net commit f11e156e0f1a582744fc04b614599fc8bcfc1da6 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:36 2025 +0200 tools/nolibc: fold llseek fallback into lseek() Align the implementation of the fallback handling inside sys_lseek() with the rest of nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-5-4b63f2caaa89@weissschuh.net commit fbd47de75502c63933016912325582309d72cd03 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:35 2025 +0200 tools/nolibc: remove __nolibc_enosys() fallback from fork functions All architectures have one of the real functions available. The additional fallback to __nolibc_enosys() is superfluous. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-4-4b63f2caaa89@weissschuh.net commit 09adec1f4b446e8788c70022fae41356ee916260 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:34 2025 +0200 tools/nolibc: remove __nolibc_enosys() fallback from dup2() All architectures have one of the real functions available. The additional fallback to __nolibc_enosys() is superfluous. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-3-4b63f2caaa89@weissschuh.net commit 4b6ffb2d87a76b02f63d029533cb3e8c1482f358 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:33 2025 +0200 tools/nolibc: remove __nolibc_enosys() fallback from *at() functions All architectures have had one of the real functions available since Linux 2.6.12. The additional fallback to __nolibc_enosys() is superfluous. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-2-4b63f2caaa89@weissschuh.net commit e6366101ce1fab9e42ae66ff0fed5360fce65bb5 Author: Thomas Weißschuh Date: Thu Aug 21 17:40:32 2025 +0200 tools/nolibc: remove __nolibc_enosys() fallback from time64-related functions These fallbacks where added when no explicit fallbacks for time64 was implemented. Now that these fallbacks are in place, the additional fallback to __nolibc_enosys() is superfluous. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-1-4b63f2caaa89@weissschuh.net commit b22d81ed319cbe2d5b45f605cab18aaf82a66a50 Author: Thomas Weißschuh Date: Sun Aug 24 08:58:46 2025 +0200 tools/nolibc: use tabs instead of spaces for indentation Some lines are using spaces for indentation instead of the standard tabs. Fix them. Signed-off-by: Thomas Weißschuh commit d1ff0e2d13d6ac3a15be7870e15216726b0a809a Author: Thomas Weißschuh Date: Wed Aug 20 10:29:27 2025 +0200 tools/nolibc: avoid error in dup2() if old fd equals new fd dup2() allows both 'old' and 'new' to have the same value, which dup3() does not. If libc dup2() is implemented through the dup3() system call, then it would incorrectly fail in this case. Avoid the error by handling old == new explicitly. Fixes: 30ca20517ac1 ("tools headers: Move the nolibc header from rcutorture to tools/include/nolibc/") Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250820-nolibc-dup2-einval-v2-1-807185a45c56@linutronix.de Signed-off-by: Thomas Weißschuh commit 7bb02685fb5aa8f97568a2beb568a15c5c544454 Author: John Hubbard Date: Fri Aug 29 15:36:32 2025 -0700 rust: pci: inline several tiny functions Several previous commits added Vendor and Class functionality. As part of that, the new functions were inlined where appropriate. But that left this file with inconsistent use of inlining. Fix that by inlining the remaining items that should be. Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-7-jhubbard@nvidia.com Signed-off-by: Danilo Krummrich commit 1b8ac37677d307cd0fc10f6bf9bceae2c282bdb4 Author: John Hubbard Date: Fri Aug 29 15:36:31 2025 -0700 rust: pci: use pci::Vendor instead of bindings::PCI_VENDOR_ID_* Change Device::vendor_id() to return a Vendor type, and change DeviceId::from_id() to accept a Vendor type. Use the new pci::Vendor in the various Rust for Linux callers who were previously using bindings::PCI_VENDOR_ID_*. Doing so also allows removing "use kernel::bindings" entirely from most of the affected files here. Also, mark vendor_id() as inline. Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-6-jhubbard@nvidia.com [ Replace "as a validated vendor" with "as [`Vendor`]". - Danilo ] Signed-off-by: Danilo Krummrich commit 6783d3b08595e932938a244e97d92cda0c0833a1 Author: John Hubbard Date: Fri Aug 29 15:36:30 2025 -0700 gpu: nova-core: avoid probing non-display/compute PCI functions NovaCore has so far been too imprecise about figuring out if .probe() has found a supported PCI PF (Physical Function). By that I mean: .probe() sets up BAR0 (which involves a lot of very careful devres and Device details behind the scenes). And then if it is dealing with a non-supported device such as the .1 audio PF on many GPUs, it fails out due to an unexpected BAR0 size. We have been fortunate that the BAR0 sizes are different. Really, we should be filtering on PCI class ID instead. These days I think we can confidently pick out Nova's supported PF's via PCI class ID. And if not, then we'll revisit. The approach here is to filter on "Display VGA" or "Display 3D", which is how PCI class IDs express "this is a modern GPU's PF". Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-5-jhubbard@nvidia.com Signed-off-by: Danilo Krummrich commit dd3933e9b572aed775fd632ed6124aa67457de72 Author: John Hubbard Date: Fri Aug 29 15:36:29 2025 -0700 rust: pci: add DeviceId::from_class_and_vendor() method Add a new method to create PCI DeviceIds that match both a specific vendor and PCI class. This is more targeted than the existing from_class() method as it filters on both vendor and class criteria. Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-4-jhubbard@nvidia.com [ Minor doc-comment improvements. - Danilo ] Signed-off-by: Danilo Krummrich commit 5e20962a9fc8a0b5b91f0989d3baf03f02bc99cb Author: John Hubbard Date: Fri Aug 29 15:36:28 2025 -0700 rust: pci: provide access to PCI Vendor values This allows callers to write Vendor::SOME_COMPANY instead of bindings::PCI_VENDOR_ID_SOME_COMPANY. New APIs: Vendor::SOME_COMPANY Vendor::from_raw() -- Only accessible from the pci (parent) module. Vendor::as_raw() Vendor: fmt::Display for Vendor Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-3-jhubbard@nvidia.com [ Minor doc-comment improvements, align Debug and Display. - Danilo ] Signed-off-by: Danilo Krummrich commit 03253befa1d1f36b297889c7ce2805c9319814ff Author: Satya Priya Kakitapalli Date: Thu Jul 10 18:30:40 2025 +0530 arm64: dts: qcom: sc8180x: Add video clock controller node Add device node for video clock controller on Qualcomm sc8180x platform. Reviewed-by: Konrad Dybcio Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250710-sc8180x-videocc-dt-v4-2-07a9d9d5e0e6@quicinc.com Signed-off-by: Bjorn Andersson commit e7733b42111ca83a60745b9b9db411ae74811ce9 Author: Bryan O'Donoghue Date: Tue Jul 15 21:26:59 2025 -0300 arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455 Add device trees for both SKUs of the X1E80100 Thena laptop: - Dell Latitude 7455 - Dell Inspiron 14 Plus 7441 Works: - Wi-Fi (WCN7850 hw2.0) - Bluetooth - USB Type-C x2 (with DP alt mode) - USB Type-A - USB Fingerprint reader - eDP Display (with brightness) - NVMe - SDHC (microSD slot) - Keyboard - Touchpad - Touchscreen - Audio (4 Speakers, 2 DMICs, Combo Jack) - Battery Not included: - Camera Signed-off-by: Bryan O'Donoghue Co-developed-by: Val Packett Signed-off-by: Val Packett Reviewed-by: Laurentiu Tudor Reviewed-by: Konrad Dybcio Tested-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250716003139.18543-4-val@packett.cool Signed-off-by: Bjorn Andersson commit f116ec4e149e2b8a36579284af7b0630d7f57723 Author: Bryan O'Donoghue Date: Tue Jul 15 21:26:57 2025 -0300 dt-bindings: arm: qcom: Add Dell Inspiron 14 Plus 7441 Document the X1E80100-based Dell Inspiron 14 Plus 7441 laptop, codename: Thena. Signed-off-by: Bryan O'Donoghue Acked-by: Krzysztof Kozlowski Signed-off-by: Val Packett Reviewed-by: Laurentiu Tudor Tested-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250716003139.18543-2-val@packett.cool Signed-off-by: Bjorn Andersson commit 7a6ad5dd551a20672edceed087408ea6bcbfe8f2 Author: Neil Armstrong Date: Thu Aug 7 18:33:24 2025 +0200 arm64: dts: qcom: sc8280xp-lenovo-thinkpad-x13: Set up 4-lane DP Allow up to 4 lanes for the DisplayPort link from the PHYs to the controllers and allow mode-switch events to reach the QMP Combo PHYs. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov [konrad: reword] Signed-off-by: Konrad Dybcio Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-6-43272d6eca92@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a2dd7cf8477e825b8028b4e36c787cee0f00a033 Author: Cristian Cozzolino Date: Mon Aug 11 23:08:11 2025 +0200 arm64: dts: qcom: msm8953: Add device tree for Billion Capture+ Billion Capture+ (flipkart,rimob) is a smartphone released in 2017, based on Snapdragon 625 (MSM8953) SoC. Add a device tree with initial support for: - GPIO keys - SDHCI (internal and external storage) - USB Device Mode - Regulators - Simple framebuffer Reviewed-by: Konrad Dybcio Signed-off-by: Cristian Cozzolino Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250811-rimob-initial-devicetree-v4-3-b3194f14aa33@protonmail.com Signed-off-by: Bjorn Andersson commit ba4857cc649a7a113252e849fbf12bc282399480 Author: Cristian Cozzolino Date: Mon Aug 11 23:08:10 2025 +0200 dt-bindings: arm: qcom: Add Billion Capture+ Billion Capture+ (flipkart,rimob) is a smartphone based on Qualcomm Snapdragon 625 (MSM8953). Acked-by: Rob Herring (Arm) Signed-off-by: Cristian Cozzolino Link: https://lore.kernel.org/r/20250811-rimob-initial-devicetree-v4-2-b3194f14aa33@protonmail.com Signed-off-by: Bjorn Andersson commit 922e16d1770624e25e2c751a257c88690f121b1c Author: Cristian Cozzolino Date: Mon Aug 11 23:08:09 2025 +0200 dt-bindings: vendor-prefixes: Add Flipkart Add Flipkart to the vendor prefixes. Acked-by: Rob Herring (Arm) Signed-off-by: Cristian Cozzolino Link: https://lore.kernel.org/r/20250811-rimob-initial-devicetree-v4-1-b3194f14aa33@protonmail.com Signed-off-by: Bjorn Andersson commit 8517204c982b1b36db766099a38cf752258dcd06 Author: Vignesh Viswanathan Date: Tue Aug 12 10:22:12 2025 +0530 arm64: dts: qcom: ipq5424: Add reserved memory for TF-A IPQ5424 supports both TZ and TF-A as secure software options and various DDR sizes. In most cases, TF-A or TZ is loaded at the same memory location, but in the 256MB DDR configuration TF-A is loaded at a different region. So, add the reserved memory node for TF-A and keep it disabled by default. During bootup, U-Boot will detect which secure software is running and enable or disable the node accordingly. Signed-off-by: Vignesh Viswanathan Reviewed-by: Konrad Dybcio Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20250812-atf-reserved-mem-v2-1-1adb94a998c1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3d7f446472cb0d9e0dbae0aa09f3647d5649c758 Author: Konrad Dybcio Date: Tue Aug 12 12:48:15 2025 +0200 arm64: dts: qcom: sc7180: Describe on-SoC USB-adjacent data paths USB connector bindings describe a ports subnode, which describes how its High-/SuperSpeed data lines (as well as the SBU pins for Type-C) are connected. On Linux, skipping the graph results in the 'connect_type' sysfs attribute returning 'unknown', instead of 'hotplug' or similar. This in turn is parsed by some operating systems (such as CrOS), to e.g. make security policy decisions. Define ports {} for the DWC controller & the QMPPHY and connect them together for the SS lanes. Leave the DP endpoint unconnected for now, as both Aspire 1 and the Chromebooks (unmerged, see [1]) seem to have a non-trivial topology. Take the creative liberty to add a newline before its ports' subnodes though. [1] https://lore.kernel.org/linux-arm-msm/20240210070934.2549994-23-swboyd@chromium.org/ Suggested-by: Rob Herring (Arm) Closes: https://lore.kernel.org/linux-arm-msm/175462129176.394940.16810637795278334342.robh@kernel.org/ Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250812-topic-7180_qmpphy_ports-v2-1-7dc87e9a1f73@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit efc28845524843f199e420695eab3841299b05d2 Author: Ling Xu Date: Wed Aug 13 08:36:35 2025 +0530 arm64: dts: qcom: lemans: add GDSP fastrpc-compute-cb nodes Add GDSP0 and GDSP1 fastrpc compute-cb nodes for lemans SoC. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Ling Xu Reviewed-by: Ekansh Gupta Link: https://lore.kernel.org/r/20250813030638.1075-3-quic_lxu5@quicinc.com Signed-off-by: Bjorn Andersson commit 036505842076eb8d2d39575628d6e7f7982e8c87 Author: Krishna Kurapati Date: Wed Aug 13 21:39:14 2025 +0530 arm64: dts: qcom: sm8450: Fix address for usb controller node Correct the address in usb controller node to fix the following warning: Warning (simple_bus_reg): /soc@0/usb@a6f8800: simple-bus unit address format error, expected "a600000" Fixes: c5a87e3a6b3e ("arm64: dts: qcom: sm8450: Flatten usb controller node") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508121834.953Mvah2-lkp@intel.com/ Signed-off-by: Krishna Kurapati Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250813160914.2258033-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6657fe9e9f23b1c61d0bcc14a3af732f92fdc19b Author: Eric Gonçalves Date: Fri Aug 15 15:14:26 2025 +0000 arm64: dts: qcom: add initial support for Samsung Galaxy S20 FE Add new device support for the Samsung Galaxy S20 FE 4G/5G (SM-G980/SM-G981B) phone What works: - SimpleFB - Pstore/ramoops Signed-off-by: Eric Gonçalves Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250815151426.32023-3-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit 5fa902fb5716f419915fdb11c6b7e62f5ba7d14f Author: Eric Gonçalves Date: Fri Aug 15 15:14:25 2025 +0000 dt-bindings: arm: qcom: document r8q board binding Add binding for the Samsung Galaxy S20 FE 4G/5G (SM-G980/SM-G981B) board, codenamed R8Q, which is based on the Qualcomm Snapdragon 865 SoC. Signed-off-by: Eric Gonçalves Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250815151426.32023-2-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit d3f600dc452df45f0f404eba65a88f4aecc48b43 Author: Jens Glathe Date: Fri Aug 22 08:44:12 2025 +0200 arm64: dts: qcom: Add Lenovo ThinkBook 16 G7 QOY device tree Device tree for the Lenovo Thinkbook 16 G7 QOY The Laptop is a Snapdragon X1 / X1 Plus (Purwa) based device [1]. Supported features: - USB type-c and type-a ports - Keyboard - Touchpad (all that are described in the dsdt) - Touchscreen (described in the dsdt, no known SKUss) - Display including PWM backlight control - PCIe devices - nvme - SDHC card reader - ath12k WCN7850 Wifi and Bluetooth - ADSP and CDSP - GPIO keys (Lid switch) - Sound via internal speakers / DMIC / USB / headphone jack - DP Altmode with 2 lanes (as all of these still do) - Integrated fingerprint reader (FPC) - Integrated UVC camera - X1-45 GPU Not supported yet: - HDMI port. - EC and some fn hotkeys. Limited support yet: - SDHC card reader is based on the on-chip sdhc_2 controller, but the driver from the Snapdragon Dev Kit is only a partial match. It can do normal slow sd cards, but not UHS-I (SD104) and UHS-II. This work was done without any schematics or non-public knowledge of the device. So, it is based on the existing x1e device trees, dsdt analysis, using HWInfo ARM64, and pure guesswork. It has been confirmed, however, that the device really has 4 NXP PTN3222 eUSB2 repeaters, one of which doesn't have a reset GPIO (eusb5 @43). Co-developed-by: Aleksandrs Vinarskis Signed-off-by: Aleksandrs Vinarskis Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250822-tb16-dt-v12-3-bab6c2986351@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 63727c59a917b6ffdb13d51c251727a3e21d38d9 Author: Jens Glathe Date: Fri Aug 22 08:44:10 2025 +0200 dt-bindings: arm: qcom: Add Lenovo TB16 support Document the x1p-42-100/x1-26-100 variants of the Thinkbook 16 G7 QOY. [1]: https://psref.lenovo.com/syspool/Sys/PDF/ThinkBook/ThinkBook_16_G7_QOY/ThinkBook_16_G7_QOY_Spec.pdf Acked-by: Rob Herring (Arm) Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250822-tb16-dt-v12-1-bab6c2986351@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 1616877626228a6ef05ddae4017c9b0f65803a8b Author: Stephan Gerhold Date: Fri Aug 22 11:29:01 2025 +0200 arm64: dts: qcom: x1e80100-qcp: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: f9a9c11471da ("arm64: dts: qcom: x1e80100-qcp: Enable more support") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-10-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 4b9165960bf2d25817de6f5fda3d2cd07f787927 Author: Stephan Gerhold Date: Fri Aug 22 11:29:00 2025 +0200 arm64: dts: qcom: x1e80100-microsoft-romulus: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: 09d77be56093 ("arm64: dts: qcom: Add support for X1-based Surface Laptop 7 devices") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-9-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit f6470367bdb2cde247cd88864208db998fed03ac Author: Stephan Gerhold Date: Fri Aug 22 11:28:59 2025 +0200 arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: 45247fe17db2 ("arm64: dts: qcom: x1e80100: add Lenovo Thinkpad Yoga slim 7x devicetree") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-8-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 0e94604702eb9f141ef862b10757d67e3880235c Author: Stephan Gerhold Date: Fri Aug 22 11:28:58 2025 +0200 arm64: dts: qcom: x1e80100-hp-omnibook-x14: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: 6f18b8d4142c ("arm64: dts: qcom: x1e80100-hp-x14: dt for HP Omnibook X Laptop 14") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-7-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit a41d23142d8773614cb2745d7b224e5784cc71ab Author: Stephan Gerhold Date: Fri Aug 22 11:28:57 2025 +0200 arm64: dts: qcom: x1e80100-dell-xps13-9345: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: f5b788d0e8cd ("arm64: dts: qcom: Add support for X1-based Dell XPS 13 9345") Tested-by: Aleksandrs Vinarskis # 3K OLED Reviewed-by: Aleksandrs Vinarskis Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-6-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit c95c1ba079f604c504feb8cf7bb038341e2d7805 Author: Stephan Gerhold Date: Fri Aug 22 11:28:56 2025 +0200 arm64: dts: qcom: x1e80100-asus-vivobook-s15: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: d0e2f8f62dff ("arm64: dts: qcom: Add device tree for ASUS Vivobook S 15") Tested-by: Maud Spierings Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-5-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit d1126668533eedebd6130515c7626af1ef808abb Author: Stephan Gerhold Date: Fri Aug 22 11:28:55 2025 +0200 arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: 7d1cbe2f4985 ("arm64: dts: qcom: Add X1E78100 ThinkPad T14s Gen 6") Tested-by: Christopher Obbard Reviewed-by: Christopher Obbard Signed-off-by: Stephan Gerhold Reviewed-by: Neil Armstrong Tested-by: Neil Armstrong # on Lenovo Thinkpad T14s OLED Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-4-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 540020f93b22219690d591fcfd5081ab3d34ad66 Author: Stephan Gerhold Date: Fri Aug 22 11:28:54 2025 +0200 arm64: dts: qcom: x1-crd: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-3-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 35fab4bedcf1fb4a7b2e2f6a5e35b43e9447ad70 Author: Stephan Gerhold Date: Fri Aug 22 11:28:53 2025 +0200 arm64: dts: qcom: x1-asus-zenbook-a14: Add missing pinctrl for eDP HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and bias-disable according to the ACPI DSDT), which is defined as &edp0_hpd_default template in x1e80100.dtsi. Fixes: 6516961352a1 ("arm64: dts: qcom: Add support for X1-based Asus Zenbook A14") Tested-by: Aleksandrs Vinarskis # FHD OLED Reviewed-by: Aleksandrs Vinarskis Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-2-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 6dfa62182c3b2b31b3da5e7e5b87c294dc3ddb5c Author: Stephan Gerhold Date: Fri Aug 22 11:28:52 2025 +0200 arm64: dts: qcom: x1e80100: Add pinctrl template for eDP0 HPD At the moment, we indirectly rely on the boot firmware to set up the pinctrl for the eDP HPD line coming from the internal display. If the boot firmware does not configure the display (e.g. because a different display is selected for output in the UEFI settings), then the display fails to come up and there are several errors in the kernel log: [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout ... Add a new &edp0_hpd_default pinctrl template that can be used by boards to set up the eDP HPD pin correctly. All boards upstream so far need the same configuration; if a board needs a different configuration it can just avoid using this template and define a custom one in the board DT. Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-x1e80100-add-edp-hpd-v2-1-6310176239a6@linaro.org Signed-off-by: Bjorn Andersson commit 2e66c88bb2649133da470d2685646f6536d1e0d5 Author: Neil Armstrong Date: Fri Aug 22 17:56:57 2025 +0200 arm64: dts: qcom: x1e80100: Set up 4-lane DP Allow up to 4 lanes for the DisplayPort link from the PHYs to the controllers now the mode-switch events can reach the QMP Combo PHYs. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-9-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 630c05a1dd350822e9166857ab120c0a7269b57a Author: Neil Armstrong Date: Fri Aug 22 17:56:56 2025 +0200 arm64: dts: qcom: sm8650: Set up 4-lane DP Allow up to 4 lanes for the DisplayPort link from the PHY to the controller now the mode-switch events can reach the QMP Combo PHY. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-8-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit b942e087564b0c1b0bf1c31c1058a59dfd5df841 Author: Neil Armstrong Date: Fri Aug 22 17:56:55 2025 +0200 arm64: dts: qcom: sm8550: Set up 4-lane DP Allow up to 4 lanes for the DisplayPort link from the PHY to the controller now the mode-switch events can reach the QMP Combo PHY. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-7-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 458de584248a5630878ed11ea23188f6007036b2 Author: Neil Armstrong Date: Fri Aug 22 17:56:54 2025 +0200 arm64: dts: qcom: x1e80100: move dp0/1/2 data-lanes to SoC dtsi The connection between the QMP Combo PHY and the DisplayPort controller is fixed in SoC, so move the data-lanes properties in the SoC dtsi. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-6-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 35f549fcf5f1d99997cd865170fd7cb1bb66c1d7 Author: Neil Armstrong Date: Fri Aug 22 17:56:53 2025 +0200 arm64: dts: qcom: sm8650: move dp0 data-lanes to SoC dtsi The connection between the QMP Combo PHY and the DisplayPort controller is fixed in SoC, so move the data-lanes property in the SoC dtsi. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-5-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit bdd235f2df6d5d6cf00cdf474970b1e6d177f2bd Author: Neil Armstrong Date: Fri Aug 22 17:56:52 2025 +0200 arm64: dts: qcom: sm8550: move dp0 data-lanes to SoC dtsi The connection between the QMP Combo PHY and the DisplayPort controller is fixed in SoC, so move the data-lanes property in the SoC dtsi. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-4-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 7b8849178ecf183880dbdf19d853c92d0877a280 Author: Neil Armstrong Date: Fri Aug 22 17:56:51 2025 +0200 arm64: dts: qcom: x1e80100: allow mode-switch events to reach the QMP Combo PHYs Allow mode-switch events to reach the QMP Combo PHYs to support setting the QMP Combo PHY in DP 4Lanes Altmode. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-3-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 6cc36611ac7925a6a6bc64c625b85f80d36fa1a6 Author: Neil Armstrong Date: Fri Aug 22 17:56:50 2025 +0200 arm64: dts: qcom: sm8650: allow mode-switch events to reach the QMP Combo PHY Allow mode-switch events to reach the QMP Combo PHY to support setting the QMP Combo PHY in DP 4Lanes Altmode. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-2-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 99d741245e7a6d8b533511f96fc110a7d89aee1b Author: Neil Armstrong Date: Fri Aug 22 17:56:49 2025 +0200 arm64: dts: qcom: sm8550: allow mode-switch events to reach the QMP Combo PHY Allow mode-switch events to reach the QMP Combo PHY to support setting the QMP Combo PHY in DP 4Lanes Altmode. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822-topic-x1e80100-4lanes-v3-1-5363acad9e32@linaro.org Signed-off-by: Bjorn Andersson commit 19f1395333f80479a3a5fce29e4c7a8255322a9c Author: Krishna Chaitanya Chundru Date: Tue Aug 26 16:32:54 2025 +0530 arm64: dts: qcom: sm8750: Add PCIe PHY and controller node Add PCIe controller and PHY nodes which supports data rates of 8GT/s and x2 lane. Signed-off-by: Krishna Chaitanya Chundru Link: https://lore.kernel.org/r/20250826-pakala-v3-2-721627bd5bb0@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6605a07f441cf1e056ec8ea6e553c893151d5527 Author: André Apitzsch Date: Thu Aug 28 22:25:50 2025 +0200 arm64: dts: qcom: msm8976-longcheer-l9360: Add touch keys The phone has three capacitive buttons on the screen bezel. Enable them by adding the keycodes in the dt. Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20250828-l9360_touch_keys-v1-1-1ce5a279c399@apitzsch.eu Signed-off-by: Bjorn Andersson commit 6e71c5812856d67881572159098f701184c9356a Author: Eric Gonçalves Date: Thu Aug 28 20:49:28 2025 +0000 arm64: dts: qcom: starqltechn: remove extra empty line Remove empty white line ine starqltechn device tree at the end of max77705_charger node. Signed-off-by: Eric Gonçalves Link: https://lore.kernel.org/r/20250828204929.35402-1-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit 73f7dc09f8e363736a3d3509820666e2006ab277 Author: Barnabás Czémán Date: Sat Aug 30 23:13:21 2025 +0200 arm64: dts: qcom: msm8953: add spi_7 Add spi_7 can be found in MSM8953 devices. Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250830-msm8953-spi-fix-v1-3-89950eaf10fe@mainlining.org Signed-off-by: Bjorn Andersson commit 690bc19286407cf1c0fc189910a936261ae1344c Author: Barnabás Czémán Date: Sat Aug 30 23:13:20 2025 +0200 arm64: dts: qcom: msm8953: correct SPI pinctrls SPI pinctrls should handle 4 pins MOSI, MISO, CLK and CS. This change adding the missing pins for pinctrls and correcting CS pins according to downstream sources. Fixes: be69109e93c78 ("arm64: dts: qcom: msm8953: add SPI interfaces") Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250830-msm8953-spi-fix-v1-2-89950eaf10fe@mainlining.org Signed-off-by: Bjorn Andersson commit 4faee358fea854fddba95843c55d9eb9013a4f00 Author: Barnabás Czémán Date: Sat Aug 30 23:13:19 2025 +0200 arm64: dts: qcom: msm8953: fix SPI clocks Fix SPI clocks, accidentally I2C clocks was assigned for SPI interfaces. Fixes: be69109e93c78 ("arm64: dts: qcom: msm8953: add SPI interfaces") Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20250830-msm8953-spi-fix-v1-1-89950eaf10fe@mainlining.org Signed-off-by: Bjorn Andersson commit 38c0af1f3fe437ac2f7a5ddce4f35e0fb8a49aea Author: Guido Günther Date: Sat Aug 30 17:57:29 2025 +0200 arm64: dts: qcom: sdm845-shift-axolotl: set chassis type It's a handset. Signed-off-by: Guido Günther Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/3e04efc06a795a32b0080b2f23a138e139057b02.1756569434.git.agx@sigxcpu.org Signed-off-by: Bjorn Andersson commit 673fa9a42606a755068e7ab6ab92cf61db243149 Author: Jagadeesh Kona Date: Fri Aug 22 11:26:38 2025 +0200 arm64: dts: qcom: sm8650: Additionally manage MXC power domain in camcc Camcc requires both MMCX and MXC rails to be powered ON to configure the camera PLLs on SM8650 platform. Hence add MXC power domain to camcc node on SM8650. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-6-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit 169ccd7cec9b702778ffb58a436f757db23154f2 Author: Vladimir Zapolskiy Date: Fri Aug 22 11:26:37 2025 +0200 arm64: dts: qcom: sm8550: Additionally manage MXC power domain in camcc Camcc requires both MMCX and MXC rails to be powered ON to configure the camera PLLs on SM8550 platform. Hence add MXC power domain to camcc node on SM8550. Fixes: e271b59e39a6f ("arm64: dts: qcom: sm8550: Add camera clock controller") Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Signed-off-by: Vladimir Zapolskiy Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-5-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit ad43a5317a8bda7fd9d6ad5f0b6248ba11900b44 Author: Jagadeesh Kona Date: Fri Aug 22 11:26:36 2025 +0200 arm64: dts: qcom: sm8450: Additionally manage MXC power domain in camcc Camcc requires both MMCX and MXC rails to be powered ON to configure the camera PLLs on SM8450 platform. Hence add MXC power domain to camcc node on SM8450. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-4-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit 086079090571910ead0510e756cea14ff3759d4e Author: Jagadeesh Kona Date: Fri Aug 22 11:26:35 2025 +0200 arm64: dts: qcom: sm8650: Additionally manage MXC power domain in videocc Videocc requires both MMCX and MXC rails to be powered ON to configure the video PLLs on SM8650 platform. Hence add MXC power domain to videocc node on SM8650. Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-3-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit d49e683574537d416aa0fb022d800430e7c045b6 Author: Jagadeesh Kona Date: Fri Aug 22 11:26:34 2025 +0200 arm64: dts: qcom: sm8550: Additionally manage MXC power domain in videocc Videocc requires both MMCX and MXC rails to be powered ON to configure the video PLLs on SM8550 platform. Hence add MXC power domain to videocc node on SM8550. Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-2-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit 235399565582d092ff8fb5757eee63b1367ea6b9 Author: Jagadeesh Kona Date: Fri Aug 22 11:26:33 2025 +0200 arm64: dts: qcom: sm8450: Additionally manage MXC power domain in videocc Videocc requires both MMCX and MXC rails to be powered ON to configure the video PLLs on SM8450 platform. Hence add MXC power domain to videocc node on SM8450. Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250822-topic-sm8x50-upstream-pll-multi-pd-voting-dt-v2-1-28f35728a146@linaro.org Signed-off-by: Bjorn Andersson commit ed78a01887e2257cff0412b640db68b70a2654dc Author: John Hubbard Date: Fri Aug 29 15:36:27 2025 -0700 rust: pci: provide access to PCI Class and Class-related items Allow callers to write Class::STORAGE_SCSI instead of bindings::PCI_CLASS_STORAGE_SCSI, for example. New APIs: Class::STORAGE_SCSI, Class::NETWORK_ETHERNET, etc. Class::from_raw() -- Only callable from pci module. Class::as_raw() ClassMask: Full, ClassSubclass Device::pci_class() Cc: Danilo Krummrich Cc: Elle Rhumsaa Reviewed-by: Alexandre Courbot Signed-off-by: John Hubbard Link: https://lore.kernel.org/r/20250829223632.144030-2-jhubbard@nvidia.com [ Minor doc-comment improvements, align Debug and Display. - Danilo ] Signed-off-by: Danilo Krummrich commit 8f57dcf39fd0864f5f3e6701fe885e55f45d0d3a Author: Srinivas Kandagatla Date: Mon Aug 25 11:12:47 2025 +0100 ASoC: qcom: audioreach: convert to cpu endainess type before accessing Looks like some of the members of module config are accessed directly without converting their endainess to cpu type. Fix this by using le32_to_cpu() where required. Fixes: da9881d00153 ("ASoC: qcom: audioreach: add support for SMECNS module") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508230830.Rkp7HHbG-lkp@intel.com Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250825101247.152619-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 7e67e1c99efa6ecd003d51a42dbe7bd5bad329eb Author: Srinivas Kandagatla Date: Mon Aug 25 11:12:46 2025 +0100 ASoC: qcom: topology: convert to cpu endainess type before accessing Looks like some of the members of module config are accessed directly without converting their endainess to cpu type. Fix this by using le32_to_cpu() where required. Fixes: c7ed4c2debfd ("ASoC: qcom: audioreach: add support for static calibration") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508230741.heXmHeDC-lkp@intel.com Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250825101247.152619-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 8318e04ab2526b155773313b66a1542476ce1106 Author: Srinivas Kandagatla Date: Mon Aug 25 11:12:45 2025 +0100 ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the topology parsing function audioreach_widget_load_module_common() could return NULL or an error pointer. Add missing NULL check so that we do not dereference it. Reported-by: Dan Carpenter Cc: Stable@vger.kernel.org Fixes: 36ad9bf1d93d ("ASoC: qdsp6: audioreach: add topology support") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250825101247.152619-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 88f5d2a477ec64b12e83b488407490bb4a9298f8 Author: Qianfeng Rong Date: Thu Aug 14 22:24:28 2025 +0800 soundwire: Use min() to improve code Use min() to reduce the code in qcom_swrm_xfer_msg() and improve its readability. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250814142428.282639-1-rongqianfeng@vivo.com Signed-off-by: Vinod Koul commit 969bf687c12cd9f64ed9368f0c7429445de7c10b Author: Claudiu Beznea Date: Wed Aug 27 13:15:06 2025 +0300 soundwire: bus: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250827101506.927787-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 356590cd61cf89e2420d5628e35b6e73c6b6a770 Author: Lad Prabhakar Date: Thu Aug 21 16:59:57 2025 +0100 phy: renesas: rcar-gen3-usb2: Fix ID check logic with VBUS valid The existing ID detection logic returned false when both IDDIG and VBUSVALID were set, which caused incorrect role determination in some cases. The condition: !(device && !vbus_valid) did not properly reflect the intended relationship between IDDIG and VBUSVALID signals. Update the logic to: return vbus_valid ? device : !device; This ensures that when VBUS is valid, the role follows the IDDIG value, and when VBUS is not valid, the role is inverted, matching the expected OTG behavior. Fixes: b725741f1c21 ("phy: renesas: rcar-gen3-usb2: Add support for RZ/T2H SoC") Signed-off-by: Lad Prabhakar Link: https://lore.kernel.org/r/20250821155957.1088337-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit 30ee285f1e3cdc88ec7010abeaba0cbed800bdcd Author: Val Packett Date: Tue Jul 15 21:27:00 2025 -0300 firmware: qcom: scm: Allow QSEECOM on Dell Inspiron 7441 / Latitude 7455 Allow these machines to access efivars through qseecom/uefisecapp. Signed-off-by: Val Packett Reviewed-by: Laurentiu Tudor Tested-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250716003139.18543-5-val@packett.cool Signed-off-by: Bjorn Andersson commit b10cac398827b87eac9f1fa0eaf6ef7578467260 Author: Jens Glathe Date: Fri Aug 22 08:44:11 2025 +0200 firmware: qcom: scm: Allow QSEECOM on Lenovo Thinkbook 16 Allow particular machine accessing eg. efivars. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250822-tb16-dt-v12-2-bab6c2986351@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 3d13e378d465e8ae0be1697005342055b07eaf11 Author: Maud Spierings Date: Fri Aug 22 11:20:05 2025 +0200 dt-bindings: phy: ti,tcan104x-can: Document TI TCAN1051 TCAN1051-Q1 Automotive Fault Protected CAN Transceiver with CAN FD It is pretty much identical to the TCAN1042, add the compatible with fallback on the TCAN1042. Signed-off-by: Maud Spierings Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250822-can_phy3-v1-1-73b3ba1690ee@gocontroll.com Signed-off-by: Vinod Koul commit ba1045c76be299896528ac48021501fc9de78512 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:15 2025 +0200 ARM: dts: qcom: Use GIC_SPI for interrupt-map for readability Decoding interrupt-map is tricky, because it consists of five components. Use known GIC_SPI define in final interrupt specifier component makes easier to read. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-15-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 27cc4d100495faa0fa7272ef8fb9fc3e3abc4349 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:14 2025 +0200 ARM: dts: qcom: sdx55: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: qcom-sdx55.dtsi:343.4-346.30: Warning (interrupt_map): /soc/pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@17800000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-14-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 014a53ed24e33cc2cab112ad17df60d15ec97997 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:13 2025 +0200 ARM: dts: qcom: ipq8064: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: qcom-ipq8064.dtsi:1201.4-1204.29: Warning (interrupt_map): /soc/pcie@1b900000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@2000000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-13-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 1e54cf1f383adde02e49ccc9bb0cb9d3b0662a1e Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:12 2025 +0200 ARM: dts: qcom: apq8064: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: qcom-apq8064.dtsi:1353.4-1356.29: Warning (interrupt_map): /soc/pcie@1b500000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@2000000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-12-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 7d75eda45690ce17a2935174a7ed370dfeeb48ef Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:11 2025 +0200 ARM: dts: qcom: ipq4019: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: qcom-ipq4019.dtsi:431.4-434.30: Warning (interrupt_map): /soc/pcie@40000000:interrupt-map: Missing property '#address-cells' in node /soc/interrupt-controller@b000000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-11-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 9a7f144e18dc5f037d85a0f0d99524a574331098 Author: Siddharth Vadapalli Date: Mon Sep 1 17:33:55 2025 +0530 PCI: j721e: Fix module autoloading Commit a2790bf81f0f ("PCI: j721e: Add support to build as a loadable module") added support to build the driver as a loadable module. However, it did not add MODULE_DEVICE_TABLE() which is required for autoloading the driver based on device table when it is built as a loadable module. Fix it by adding MODULE_DEVICE_TABLE. Fixes: a2790bf81f0f ("PCI: j721e: Add support to build as a loadable module") Signed-off-by: Siddharth Vadapalli [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250901120359.3410774-1-s-vadapalli@ti.com commit 91418337a27d800b33d6d391f565b1fa2c7ff75c Author: Kaushlendra Kumar Date: Mon Aug 18 14:21:24 2025 +0530 intel_idle: Remove unnecessary address-of operators Remove redundant address-of operators (&) when assigning the intel_idle() function pointer to the .enter field in cpuidle_state structures.in C, the & is not needed for function names. This change improves code consistency and readability by using the more conventional form without the & operator. No functional change intended. Signed-off-by: Kaushlendra Kumar Reviewed-by: Artem Bityutskiy Link: https://patch.msgid.link/20250818085124.3897921-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 2a0614522885b136e9e650791c794dd49abb5b31 Author: Yu Kuai Date: Mon Aug 11 14:56:28 2025 +0800 brd: use page reference to protect page lifetime As discussed [1], hold rcu for copying data from/to page is too heavy, it's better to protect page with rcu around for page lookup and then grab a reference to prevent page to be freed by discard. [1] https://lore.kernel.org/all/eb41cab3-5946-4fe3-a1be-843dd6fca159@kernel.dk/ Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20250811065628.1829339-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 237bfb76c90b184f57bb18fe35ff366c19393dc8 Author: Dan Carpenter Date: Wed Aug 27 15:00:11 2025 +0200 selftests/futex: Fix futex_wait() for 32bit ARM On 32bit ARM systems gcc-12 will use 32bit timestamps while gcc-13 and later will use 64bit timestamps. The problem is that SYS_futex will continue pointing at the 32bit system call. This makes the futex_wait test fail like this: waiter failed errno 110 not ok 1 futex_wake private returned: 0 Success waiter failed errno 110 not ok 2 futex_wake shared (page anon) returned: 0 Success waiter failed errno 110 not ok 3 futex_wake shared (file backed) returned: 0 Success Instead of compiling differently depending on the gcc version, use the -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 options to ensure that 64bit timestamps are used. Then use ifdefs to make SYS_futex point to the 64bit system call. Signed-off-by: Dan Carpenter Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov (AMD) Reviewed-by: André Almeida Tested-by: Anders Roxell Link: https://lore.kernel.org/20250827130011.677600-6-bigeasy@linutronix.de commit 5fdb877b4916a1eb2b2c85018c2311855893405b Author: Gopi Krishna Menon Date: Wed Aug 27 15:00:10 2025 +0200 selftests/futex: Fix typos and grammar in futex_priv_hash Fix multiple typos and small grammar issues in help text, comments and test messages in the futex_priv_hash test. Signed-off-by: Gopi Krishna Menon Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov (AMD) Reviewed-by: André Almeida Link: https://lore.kernel.org/20250827130011.677600-5-bigeasy@linutronix.de commit f8ef9c24029c85cd0328a9c668283017d8c292ad Author: Nai-Chen Cheng Date: Wed Aug 27 15:00:09 2025 +0200 selftests/futex: Fix format-security warnings in futex_priv_hash Fix format-security warnings by using proper format strings when passing message variables to ksft_exit_fail_msg(), ksft_test_result_pass(), and ksft_test_result_skip() function. Thus prevent potential security issues and eliminate compiler warnings when building with -Wformat-security. Signed-off-by: Nai-Chen Cheng Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250827130011.677600-4-bigeasy@linutronix.de commit d8e2f919997b14665e4509ef9a5278f291598d6e Author: Waiman Long Date: Wed Aug 27 15:00:08 2025 +0200 selftests/futex: Fix some futex_numa_mpol subtests The "Memory out of range" subtest of futex_numa_mpol assumes that memory access outside of the mmap'ed area is invalid. That may not be the case depending on the actual memory layout of the test application. When that subtest was run on an x86-64 system with latest upstream kernel, the test passed as an error was returned from futex_wake(). On another PowerPC system, the same subtest failed because futex_wake() returned 0. Bail out! futex2_wake(64, 0x86) should fail, but didn't Looking further into the passed subtest on x86-64, it was found that an -EINVAL was returned instead of -EFAULT. The -EINVAL error was returned because the node value test with FLAGS_NUMA set failed with a node value of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed because the supposed node number wasn't valid. If that memory location happens to have a very small value (e.g. 0), the test will pass and no error will be returned. Since this subtest is non-deterministic, drop it unless a guard page beyond the mmap region is explicitly set. The other problematic test is the "Memory too small" test. The futex_wake() function returns the -EINVAL error code because the given futex address isn't 8-byte aligned, not because only 4 of the 8 bytes are valid and the other 4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to reflect the reality. [ bp: Massage commit message. ] Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol") Signed-off-by: Waiman Long Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de commit 17926cd770ec837ed27d9856cf07f2da8dda4131 Author: Pratyush Yadav Date: Tue Jul 8 17:16:46 2025 +0800 mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode On Octal DTR capable flashes like Micron Xcella the writes cannot start or end at an odd address in Octal DTR mode. Extra 0xff bytes need to be appended or prepended to make sure the start address and end address are even. 0xff is used because on NOR flashes a program operation can only flip bits from 1 to 0, not the other way round. 0 to 1 flip needs to happen via erases. Signed-off-by: Pratyush Yadav Reviewed-by: Michael Walle Signed-off-by: Luke Wang Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/20250708091646.292-2-ziniu.wang_1@nxp.com commit f156b23df6a84efb2f6686156be94d4988568954 Author: Pratyush Yadav Date: Tue Jul 8 17:16:45 2025 +0800 mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode On Octal DTR capable flashes like Micron Xcella reads cannot start or end at an odd address in Octal DTR mode. Extra bytes need to be read at the start or end to make sure both the start address and length remain even. To avoid allocating too much extra memory, thereby putting unnecessary memory pressure on the system, the temporary buffer containing the extra padding bytes is capped at PAGE_SIZE bytes. The rest of the 2-byte aligned part should be read directly in the main buffer. Signed-off-by: Pratyush Yadav Reviewed-by: Michael Walle Signed-off-by: Luke Wang Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/20250708091646.292-1-ziniu.wang_1@nxp.com commit a69997be443dcc64e6f0d6588f40e06c9b3a39be Author: Liao Yuanhong Date: Wed Aug 20 21:14:15 2025 +0800 drm/ssd130x: Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250820131416.500048-1-liaoyuanhong@vivo.com Signed-off-by: Javier Martinez Canillas commit 100d457c0feadd131083e3ebb64973ac0b8510d6 Author: Marcus Folkesson Date: Mon Jul 21 12:43:36 2025 +0200 drm/st7571-i2c: add support for 2bit grayscale for XRGB8888 Add support for 2bit grayscale and use it for XRGB8888 when grayscale is supported. Reviewed-by: Javier Martinez Canillas Signed-off-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250721-st7571-format-v2-6-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit 8bde81ec684238587decd5ab6b1bf18041814937 Author: Marcus Folkesson Date: Mon Jul 21 12:43:35 2025 +0200 drm/format-helper: introduce drm_fb_xrgb8888_to_gray2() Convert XRGB8888 to 2bit grayscale. It uses drm_fb_xrgb8888_to_gray8() to convert the pixels to gray8 as an intermediate step before converting to gray2. Signed-off-by: Marcus Folkesson Reviewed-by: Javier Martinez Canillas Acked-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250721-st7571-format-v2-5-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit 118e54633ca894748f300c0f582f4ae1b6254f8d Author: Mauro Carvalho Chehab Date: Mon Sep 1 15:21:22 2025 +0200 docs: kernel_include.py: drop some old behavior The old behavior is not using anymore, so let's drop it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/00cdf3cbe2481aac875c543ded14b5eacfe071ec.1756732363.git.mchehab+huawei@kernel.org commit 8dbb1779ae22e5cd84d807b7023d29791f892a02 Author: Mauro Carvalho Chehab Date: Mon Sep 1 15:21:21 2025 +0200 docs: kernel_include.py: fix an issue when O= is used As reported by Stephen, building docs with O= is now broken. Fix it by ensuring that it will seek files under Kernel source tree. The original logic was defined to accept including files under Documentation/output. The new logic doesn't need it anymore for media, but it might still be useful to preserve the previous behavior. So, I ended preserving it. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250901142639.4de35a11@canb.auug.org.au/ Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/da91980ce42f31730dc982920167b2757b9d2769.1756732363.git.mchehab+huawei@kernel.org commit 76cea30ad520238160bf8f5e2f2803fcd7a08d22 Merge: 8f5ae30d69d754 c6ac444ff20ce3 Author: Christian Brauner Date: Mon Sep 1 15:31:40 2025 +0200 Merge patch series "nios2: Add architecture support for clone3" Simon Schuster says: This series adds support for the clone3 system call to the nios2 architecture. This addresses the build-time warning "warning: clone3() entry point is missing, please fix" introduced in 505d66d1abfb9 ("clone3: drop __ARCH_WANT_SYS_CLONE3 macro"). The implementation passes the relevant clone3 tests of kselftest when applied on top of next-20250815: ./run_kselftest.sh TAP version 13 1..4 # selftests: clone3: clone3 ok 1 selftests: clone3: clone3 # selftests: clone3: clone3_clear_sighand ok 2 selftests: clone3: clone3_clear_sighand # selftests: clone3: clone3_set_tid ok 3 selftests: clone3: clone3_set_tid # selftests: clone3: clone3_cap_checkpoint_restore ok 4 selftests: clone3: clone3_cap_checkpoint_restore The series also includes a small patch to kernel/fork.c that ensures that clone_flags are passed correctly on architectures where unsigned long is insufficient to store the u64 clone_flags. It is marked as a fix for stable backporting. As requested, in v2, this series now further tries to correct this type error throughout the whole code base. Thus, it now touches a larger number of subsystems and all architectures. Therefore, another test was performed for ARCH=x86_64 (as a representative for 64-bit architectures). Here, the series builds cleanly without warnings on defconfig with CONFIG_SECURITY_APPARMOR=y and CONFIG_SECURITY_TOMOYO=y (to compile-check the LSM-related changes). The build further successfully passes testing/selftests/clone3 (with the patch from 20241105062948.1037011-1-zhouyuhang1010@163.com to prepare clone3_cap_checkpoint_restore for compatibility with the newer libcap version on my system). * patches from https://lore.kernel.org/20250901-nios2-implement-clone3-v2-0-53fcf5577d57@siemens-energy.com: nios2: implement architecture-specific portion of sys_clone3 arch: copy_thread: pass clone_flags as u64 copy_process: pass clone_flags as u64 across calltree copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-0-53fcf5577d57@siemens-energy.com Signed-off-by: Christian Brauner commit c6ac444ff20ce301020a41e35f1942c6524e0864 Author: Simon Schuster Date: Mon Sep 1 15:09:53 2025 +0200 nios2: implement architecture-specific portion of sys_clone3 This commit adds the sys_clone3 entry point for nios2. An architecture-specific wrapper (__sys_clone3) is required to save and restore additional registers to the kernel stack via SAVE_SWITCH_STACK and RESTORE_SWITCH_STACK. Signed-off-by: Simon Schuster Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-4-53fcf5577d57@siemens-energy.com Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit bbc46b23af5bb934cd1cf066ef4342cee457a24e Author: Simon Schuster Date: Mon Sep 1 15:09:52 2025 +0200 arch: copy_thread: pass clone_flags as u64 With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit, with a new type of u64 for the flags. However, for most consumers of clone_flags the interface was not changed from the previous type of unsigned long. While this works fine as long as none of the new 64-bit flag bits (CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still undesirable in terms of the principle of least surprise. Thus, this commit fixes all relevant interfaces of the copy_thread function that is called from copy_process to consistently pass clone_flags as u64, so that no truncation to 32-bit integers occurs on 32-bit architectures. Signed-off-by: Simon Schuster Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread") Acked-by: Guo Ren (Alibaba Damo Academy) Acked-by: Andreas Larsson # sparc Acked-by: David Hildenbrand Acked-by: Geert Uytterhoeven # m68k Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit edd3cb05c00a040dc72bed20b14b5ba865188bce Author: Simon Schuster Date: Mon Sep 1 15:09:51 2025 +0200 copy_process: pass clone_flags as u64 across calltree With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit, with a new type of u64 for the flags. However, for most consumers of clone_flags the interface was not changed from the previous type of unsigned long. While this works fine as long as none of the new 64-bit flag bits (CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still undesirable in terms of the principle of least surprise. Thus, this commit fixes all relevant interfaces of callees to sys_clone3/copy_process (excluding the architecture-specific copy_thread) to consistently pass clone_flags as u64, so that no truncation to 32-bit integers occurs on 32-bit architectures. Signed-off-by: Simon Schuster Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-2-53fcf5577d57@siemens-energy.com Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 04ff48239f46e8b493571e260bd0e6c3a6400371 Author: Simon Schuster Date: Mon Sep 1 15:09:50 2025 +0200 copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) With the introduction of clone3 in commit 7f192e3cd316 ("fork: add clone3") the effective bit width of clone_flags on all architectures was increased from 32-bit to 64-bit. However, the signature of the copy_* helper functions (e.g., copy_sighand) used by copy_process was not adapted. As such, they truncate the flags on any 32-bit architectures that supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, parisc32, powerpc32, riscv32, x86-32 and xtensa). For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 constant, this triggers an observable bug in kernel selftest clone3_clear_sighand: if (clone_flags & CLONE_CLEAR_SIGHAND) in function copy_sighand within fork.c will always fail given: unsigned long /* == uint32_t */ clone_flags #define CLONE_CLEAR_SIGHAND 0x100000000ULL This commit fixes the bug by always passing clone_flags to copy_sighand via their declared u64 type, invariant of architecture-dependent integer sizes. Fixes: b612e5df4587 ("clone3: add CLONE_CLEAR_SIGHAND") Cc: stable@vger.kernel.org # linux-5.5+ Signed-off-by: Simon Schuster Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-1-53fcf5577d57@siemens-energy.com Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit e61c35157d32b4b422f0a4cbc3c40d04d883a9c9 Author: Marcus Folkesson Date: Mon Jul 21 12:43:34 2025 +0200 drm/st7571-i2c: add support for inverted pixel format Depending on which display that is connected to the controller, an "1" means either a black or a white pixel. The supported formats (R1/R2/XRGB8888) expects the pixels to map against (4bit): 00 => Black 01 => Dark Gray 10 => Light Gray 11 => White If this is not what the display map against, make it possible to invert the pixels. Reviewed-by: Javier Martinez Canillas Signed-off-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250721-st7571-format-v2-4-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit c68f78ae1d86a5eb9632b72f7b4f15912bff5b0f Author: Marcus Folkesson Date: Mon Jul 21 12:43:33 2025 +0200 dt-bindings: display: sitronix,st7567: add optional inverted property Depending on which display that is connected to the controller, an "1" means either a black or a white pixel. The supported format (R1) expects the pixels to map against: 0 => Black 1 => White If this is not what the display map against, the controller has support to invert these values. Signed-off-by: Marcus Folkesson Reviewed-by: Rob Herring (Arm) Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250721-st7571-format-v2-3-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit 2596e9414e5f5917070a6c524d8e307234d3cc18 Author: Marcus Folkesson Date: Mon Jul 21 12:43:32 2025 +0200 dt-bindings: display: sitronix,st7571: add optional inverted property Depending on which display that is connected to the controller, an "1" means either a black or a white pixel. The supported formats (R1/R2/XRGB8888) expects the pixels to map against (4bit): 00 => Black 01 => Dark Gray 10 => Light Gray 11 => White If this is not what the display map against, the controller has support to invert these values. Reviewed-by: Javier Martinez Canillas Signed-off-by: Marcus Folkesson Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250721-st7571-format-v2-2-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit c4baa2d987c025076db8732abf8c44ccb9bcd8df Author: Marcus Folkesson Date: Mon Jul 21 12:43:31 2025 +0200 drm/st7571-i2c: correct pixel data format description The comment describes the pixel data format as stated in the st7571 datasheet, which is not necessary the same as for the connected display. Instead, describe the expected pixel data format which is used for R1/R2/XRGB8888. Reviewed-by: Javier Martinez Canillas Signed-off-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250721-st7571-format-v2-1-159f4134098c@gmail.com Signed-off-by: Javier Martinez Canillas commit ae6f637a456c1de75a582afa9cb6169813e89b83 Author: Krzysztof Kozlowski Date: Sat Aug 30 19:01:12 2025 +0200 ARM: s3c6400_defconfig: Drop MTD_NAND_S3C2410 MTD_NAND_S3C2410 driver was removed from the kernel, so cleanup defconfig as well. Link: https://lore.kernel.org/r/20250830-s3c-cleanup-nand-v1-4-05b99ef990fe@linaro.org Signed-off-by: Krzysztof Kozlowski commit 93296e9d9528f0d87f2cf3fee494599060a0f14a Author: Alexandre Courbot Date: Fri Aug 8 11:46:42 2025 +0900 gpu: nova-core: vbios: store reference to Device where relevant Now that the vbios code uses a non-bound `Device` instance, store an `ARef` to it at construction time so we can use it for logging without having to carry an extra argument on every method for that sole purpose. Reviewed-by: Joel Fernandes Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250808-vbios_device-v1-2-834bbbab6471@nvidia.com Signed-off-by: Alexandre Courbot commit dff11511d1967b9fd82a5b4b60cf5045eaa545b6 Author: Alexandre Courbot Date: Fri Aug 8 11:46:41 2025 +0900 gpu: nova-core: vbios: replace pci::Device with device::Device The passed pci::Device is exclusively used for logging purposes, so it can be replaced by a regular device::Device, which allows us to remove the `as_ref()` indirections at each logging site. Reviewed-by: Joel Fernandes Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250808-vbios_device-v1-1-834bbbab6471@nvidia.com Signed-off-by: Alexandre Courbot commit 9d35d068fb138160709e04e3ee97fe29a6f8615b Author: Qianfeng Rong Date: Fri Aug 29 18:14:11 2025 +0800 regulator: scmi: Use int type to store negative error codes Change the 'ret' variable from u32 to int to store negative error codes or zero returned by of_property_read_u32(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Sudeep Holla Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 773b9202de0127444fc8802a611a19637b7fa12f Author: Krzysztof Kozlowski Date: Sat Aug 30 19:01:09 2025 +0200 mtd: rawnand: s3c2410: Drop S3C2410 support Samsung S3C24xx family of SoCs was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of its compatibles and platform IDs. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 8a9e097def55391273d3042b32350ded1ec83e04 Author: Qianfeng Rong Date: Sat Aug 30 18:06:37 2025 +0800 mtd: rawnand: pl353: Use int type to store negative error codes Change the 'ret' variable from u32 to int in pl35x_nand_probe() to store negative error codes or zero; Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Miquel Raynal commit 9bef84d30f1f724191270044a7d045bfc9d6ad97 Author: Josua Mayer Date: Tue Aug 26 20:32:03 2025 +0200 phy: lynx-28g: check return value when calling lynx_28g_pll_get The lynx_28g_pll_get function may return NULL when called with an unsupported submode argument. This function is only called from the lynx_28g_lane_set_{10gbaser,sgmii} functions, and lynx_28g_set_mode checks available modes before setting a protocol. NXP vendor kernel based on v6.6.52 however is missing any checks and connecting a 2.5/5gbase-t ethernet phy can cause null pointer dereference [1]. Check return value at every invocation and abort in the unlikely error case. Further print a warning message the first time lynx_28g_pll_get returns null, to catch this case should it occur after future changes. [1] [ 127.019924] fsl_dpaa2_eth dpni.4 eth5: dpmac_set_protocol(2500base-x) = -ENOTSUPP [ 127.027451] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 [ 127.036245] Mem abort info: [ 127.039044] ESR = 0x0000000096000004 [ 127.042794] EC = 0x25: DABT (current EL), IL = 32 bits [ 127.048107] SET = 0, FnV = 0 [ 127.051161] EA = 0, S1PTW = 0 [ 127.054301] FSC = 0x04: level 0 translation fault [ 127.059179] Data abort info: [ 127.062059] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 127.067547] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 127.072596] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 127.077907] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020816c9000 [ 127.084344] [0000000000000014] pgd=0000000000000000, p4d=0000000000000000 [ 127.091133] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 127.097390] Modules linked in: cfg80211 rfkill fsl_jr_uio caam_jr dpaa2_caam caamkeyblob_desc crypto_engine caamhash_desc onboard_usb_hub caamalg_desc crct10dif_ce libdes caam error at24 rtc_ds1307 rtc_fsl_ftm_alarm nvmem_layerscape_sfp layerscape_edac_mod dm_mod nfnetlink ip_tables [ 127.122436] CPU: 5 PID: 96 Comm: kworker/u35:0 Not tainted 6.6.52-g3578ef896722 #10 [ 127.130083] Hardware name: SolidRun LX2162A Clearfog (DT) [ 127.135470] Workqueue: events_power_efficient phylink_resolve [ 127.141219] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 127.148170] pc : lynx_28g_set_lane_mode+0x300/0x818 [ 127.153041] lr : lynx_28g_set_lane_mode+0x2fc/0x818 [ 127.157909] sp : ffff8000806f3b80 [ 127.161212] x29: ffff8000806f3b80 x28: 0000000000000000 x27: 0000000000000000 [ 127.168340] x26: ffff29d6c11f3098 x25: 0000000000000000 x24: 0000000000000000 [ 127.175467] x23: ffff29d6c11f31f0 x22: ffff29d6c11f3080 x21: 0000000000000001 [ 127.182595] x20: ffff29d6c11f4c00 x19: 0000000000000000 x18: 0000000000000006 [ 127.189722] x17: 4f4e452d203d2029 x16: 782d657361623030 x15: 3532286c6f636f74 [ 127.196849] x14: 6f72705f7465735f x13: ffffd7a8ff991cc0 x12: 0000000000000acb [ 127.203976] x11: 0000000000000399 x10: ffffd7a8ff9e9cc0 x9 : 0000000000000000 [ 127.211104] x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff29d6c11f3080 [ 127.218231] x5 : 0000000000000000 x4 : 0000000040800030 x3 : 000000000000034c [ 127.225358] x2 : ffff29d6c11f3080 x1 : 000000000000034c x0 : 0000000000000000 [ 127.232486] Call trace: [ 127.234921] lynx_28g_set_lane_mode+0x300/0x818 [ 127.239443] lynx_28g_set_mode+0x12c/0x148 [ 127.243529] phy_set_mode_ext+0x5c/0xa8 [ 127.247356] lynx_pcs_config+0x64/0x294 [ 127.251184] phylink_major_config+0x184/0x49c [ 127.255532] phylink_resolve+0x2a0/0x5d8 [ 127.259446] process_one_work+0x138/0x248 [ 127.263448] worker_thread+0x320/0x438 [ 127.267187] kthread+0x114/0x118 [ 127.270406] ret_from_fork+0x10/0x20 [ 127.273973] Code: 2a1303e1 aa0603e0 97fffd3b aa0003e5 (b9401400) [ 127.280055] ---[ end trace 0000000000000000 ]--- Signed-off-by: Josua Mayer Link: https://lore.kernel.org/r/20250826-lynx-28g-nullptr-v1-1-e4de0098f822@solid-run.com Signed-off-by: Vinod Koul commit 616fe247bdce4e3a23e3ded4b3be951001ed8039 Author: Prashanth K Date: Tue Aug 26 16:22:54 2025 +0530 phy: qcom: m31-eusb2: Fix the error log while enabling clock While enabling clock, we incorrectly log 'ref clk' as 'cfg ahb clk' Fix this since the devicetree bindings mentions it as ref clock. Signed-off-by: Prashanth K Link: https://lore.kernel.org/r/20250826105254.3758803-1-prashanth.k@oss.qualcomm.com Signed-off-by: Vinod Koul commit 0c5375b06060fa40a8f8ce2e926bde125fdf6c3b Author: Liao Yuanhong Date: Thu Aug 28 20:23:57 2025 +0800 phy: rockchip: usbdp: Remove redundant ternary operators Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250828122401.17441-4-liaoyuanhong@vivo.com Signed-off-by: Vinod Koul commit e7ec351347b6325f872b9059453c9c9bf22c159c Author: Liao Yuanhong Date: Thu Aug 28 20:23:56 2025 +0800 phy: renesas: rcar-gen3-usb2: Remove redundant ternary operators Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250828122401.17441-3-liaoyuanhong@vivo.com Signed-off-by: Vinod Koul commit da938e39a81642748db3ec2385e8a53fe03d9bd1 Author: Liao Yuanhong Date: Thu Aug 28 20:23:55 2025 +0800 phy: hisilicon: Remove redundant ternary operators Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250828122401.17441-2-liaoyuanhong@vivo.com Signed-off-by: Vinod Koul commit 8a9772ec08f87c9e45ab1ad2c8d2b8c1763836eb Author: Kuninori Morimoto Date: Tue Aug 26 06:22:26 2025 +0000 ASoC: soc-dapm: rename snd_soc_kcontrol_component() to snd_soc_kcontrol_to_component() We have 2 similar functions, both converts date from snd_kcontrol to snd_soc_component. (A) snd_soc_kcontrol_component() (B) snd_soc_dapm_kcontrol_component() (A) is just wrapper for snd_kcontrol_chip(). (B) is for more complex conversion. Having similar functions is confusable. So (A) will be replaced to original snd_kcontrol_chip(). (B) will be stay, but the function name should be xx_to_xx(). And it is defined at soc-component.h. It should be implemented at soc-dapm.c. This patch renames it to snd_soc_dapm_kcontrol_to_component(), and move to soc-dapm.c. This patch keeps compatible by using define, but old name will be replaced on each drivers and removed from ASoC in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/871poyy53x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f6883f0f03575ecc8c4c5d2a04339bac91eb33d7 Author: Kuninori Morimoto Date: Tue Aug 26 06:22:19 2025 +0000 ASoC: soc-dapm: rename dapm_kcontrol_get_value() to snd_soc_dapm_kcontrol_get_value() dapm_kcontrol_get_value() is global function, adds snd_soc_ prefix This patch keeps compatible by using define, but old name will be replaced on each drivers and removed from ASoC in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87349ey546.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2532041865305594e37c4c22bd650d52ea805ec8 Author: Kuninori Morimoto Date: Tue Aug 26 06:22:12 2025 +0000 ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_dapm() to snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_kcontrol_dapm() is unclear naming, rename it to snd_soc_dapm_kcontrol_to_dapm(). This is prepare for dapm cleanup. This patch keeps compatible by using define, but old name will be replaced on each drivers and removed from ASoC in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874ituy54c.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bbf7a84787d0dc5910d121b025dd5f4dea060768 Author: Kuninori Morimoto Date: Tue Aug 26 06:22:05 2025 +0000 ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_widget() to snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_widget() is unclear naming, rename it to snd_soc_dapm_kcontrol_to_widget(). This is prepare for dapm cleanup. This patch keeps compatible by using define, but old name will be replaced on each drivers and removed from ASoC in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875xeay54j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit df4beac9da5f162770c8563d11cda327d748c20b Author: Nitin Rawat Date: Sat Aug 30 12:33:53 2025 +0530 phy: qcom-qmp-ufs: Add PHY and PLL regulator load Add phy and pll regulator load voting support for all supported platforms by introducing dedicated regulator bulk data arrays with their load values. This ensures stable operation and proper power management for these platforms where regulators are shared between the QMP UFS PHY and other IP blocks by setting appropriate regulator load currents during PHY operations. Signed-off-by: Nitin Rawat Acked-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250830070353.2694-3-nitin.rawat@oss.qualcomm.com Signed-off-by: Vinod Koul commit 0c4916aadb8df892399eec99f775655c31049195 Author: Nitin Rawat Date: Sat Aug 30 12:33:52 2025 +0530 phy: qcom-qmp-ufs: Add regulator load voting for UFS QMP PHY On certain SoCs, power regulators are shared between the QMP UFS PHY and other IP blocks. To ensure proper operation, the regulator framework must be informed of the UFS PHY's load requirements. This is essential because the regulator's operating mode—whether Low Power or High Power—depends on the maximum expected load at any given time, which the regulator driver needs to manage accordingly. To support this, replace devm_regulator_bulk_get() with devm_regulator_bulk_get_const() and inline the qmp_ufs_vreg_init() function. additionally replace the array of regulator names with a bulk regulator data structure, and utilize the init_load_uA field provided by the regulator framework. This ensures that regulator_set_load() is automatically invoked before the first enable operation. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250830070353.2694-2-nitin.rawat@oss.qualcomm.com Signed-off-by: Vinod Koul commit c37adf34a5dc511e017b5a3bab15fe3171269e46 Author: Onur Özkan Date: Thu Aug 21 12:10:01 2025 +0300 rust: file: use to_result for error handling Simplifies error handling by replacing the manual check of the return value with the `to_result` helper. Signed-off-by: Onur Özkan Link: https://lore.kernel.org/20250821091001.28563-1-work@onurozkan.dev Signed-off-by: Christian Brauner commit b8e1684163ae52db90f428965bd9aaff7205c02e Author: Takashi Iwai Date: Fri Aug 29 17:13:33 2025 +0200 ALSA: misc: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-20-tiwai@suse.de commit 69f374931fa4714891cad0a0558b415f80aa7225 Author: Takashi Iwai Date: Fri Aug 29 17:13:32 2025 +0200 ALSA: virtio: Use guard() for spin locks Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-19-tiwai@suse.de commit c07824a14d99c10edd4ec4c389d219af336ecf20 Author: Takashi Iwai Date: Fri Aug 29 17:13:31 2025 +0200 ALSA: ac97bus: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-18-tiwai@suse.de commit 94f8cb2b358ca2acfa489d6a54f8e614d17c0572 Author: Takashi Iwai Date: Fri Aug 29 17:13:30 2025 +0200 ALSA: atmel: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-17-tiwai@suse.de commit 372020ddaa76ba9d18806de90448562ca12ad53e Author: Takashi Iwai Date: Fri Aug 29 17:13:29 2025 +0200 ALSA: pxa2xx: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-16-tiwai@suse.de commit bc58470aa2595bb21937d35572989a68e6b5f679 Author: Takashi Iwai Date: Fri Aug 29 17:13:28 2025 +0200 ALSA: aaci: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-15-tiwai@suse.de commit 1cb6ecbb372002ef9e531c5377e5f60122411e40 Author: Takashi Iwai Date: Fri Aug 29 17:13:27 2025 +0200 ALSA: aoa: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-14-tiwai@suse.de commit 3d10c26fae4ec629a78b1c3189a6f6a0a8c053ba Author: Takashi Iwai Date: Fri Aug 29 17:13:26 2025 +0200 ALSA: sparc: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-13-tiwai@suse.de commit 89008621bb2dcfcb8905f58a64cadcbdb16c9214 Author: Takashi Iwai Date: Fri Aug 29 17:13:25 2025 +0200 ALSA: vxpocket: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-12-tiwai@suse.de commit 2c24032607d6d5f2e1ac3cbd46eaf4722880ba83 Author: Takashi Iwai Date: Fri Aug 29 17:13:24 2025 +0200 ALSA: pdaudiocf: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-11-tiwai@suse.de commit 7b4d15bcdc8bb15d72363f1497e147d570441269 Author: Takashi Iwai Date: Fri Aug 29 17:13:23 2025 +0200 ALSA: at73c213: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-10-tiwai@suse.de commit 3ddf4f97166a9cbea5113c1095d8148fd66bbed9 Author: Takashi Iwai Date: Fri Aug 29 17:13:22 2025 +0200 ALSA: xen: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-9-tiwai@suse.de commit ab770b41630d186b9e51c013e2108a6a5df9be3d Author: Takashi Iwai Date: Fri Aug 29 17:13:21 2025 +0200 ALSA: x86: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-8-tiwai@suse.de commit 10403f910ad2cd18a1f0d7ba5c7c702bbaec0511 Author: Takashi Iwai Date: Fri Aug 29 17:13:20 2025 +0200 ALSA: x86: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-7-tiwai@suse.de commit 826f35b829f43dc62fb847eca6f79e8698b4994d Author: Takashi Iwai Date: Fri Aug 29 17:13:19 2025 +0200 ALSA: synth: Use guard() for preset locks Define a macro for the preset locking/unlocking pairs for soundfont using guard() macro as a further code cleanup. The new macro is put in soundfont.h (and some function renames) along with it for avoiding unnecessary troubles with clang. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-6-tiwai@suse.de commit 59ede7178d402b3bfa0266cbd9ad348d5612c295 Author: Takashi Iwai Date: Fri Aug 29 17:13:18 2025 +0200 ALSA: synth: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-5-tiwai@suse.de commit eff259d5b90508fe09edb172d2d4ec5487edf992 Author: Takashi Iwai Date: Fri Aug 29 17:13:17 2025 +0200 ALSA: synth: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-4-tiwai@suse.de commit cc8c535320913c6476fb068309f2e78c98dc8caf Author: Takashi Iwai Date: Fri Aug 29 17:13:16 2025 +0200 ALSA: i2c: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-3-tiwai@suse.de commit 7a3dc0da931ea7c8a1f2e585a0465131f3c9e556 Author: Takashi Iwai Date: Fri Aug 29 17:13:15 2025 +0200 ALSA: i2c: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829151335.7342-2-tiwai@suse.de commit 95692e3c9fceecb821ba14b41773442d720fceaa Author: Takashi Iwai Date: Fri Aug 29 17:07:17 2025 +0200 ALSA: caiaq: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-10-tiwai@suse.de commit cff7acfe0b8f80653726d31741ca111d56cdbc38 Author: Takashi Iwai Date: Fri Aug 29 17:07:16 2025 +0200 ALSA: bcd2000: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-9-tiwai@suse.de commit e5d3eeb4261a3a288b427201b9a97e4aa8159a3e Author: Takashi Iwai Date: Fri Aug 29 17:07:15 2025 +0200 ALSA: usb: qcom: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. The manual mutex lock/unlock are still left in handle_uaudio_stream_req() and its callee as they have a bit complex locking patterns. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-8-tiwai@suse.de commit 6dcbb0a9a6b50f5cb1c9cbb88914be98777b26a6 Author: Takashi Iwai Date: Fri Aug 29 17:07:14 2025 +0200 ALSA: line6: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. The core code of line6_pcm_release() is factored out, so that it can be covered by guard() nicely, too. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-7-tiwai@suse.de commit ea3bfbbc9a28c6ede618a97af31d99f36d4050e6 Author: Takashi Iwai Date: Fri Aug 29 17:07:13 2025 +0200 ALSA: hiface: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-6-tiwai@suse.de commit 07f55c77b922b21009e12b3bb70c8ef0e07b0eb0 Author: Takashi Iwai Date: Fri Aug 29 17:07:12 2025 +0200 ALSA: hiface: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-5-tiwai@suse.de commit 9e38c362a6d8b69e8760ff5e5614362b09a1b30e Author: Takashi Iwai Date: Fri Aug 29 17:07:11 2025 +0200 ALSA: usx2y: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-4-tiwai@suse.de commit f9435abeb3eee14854d8a7769a626bc983e70d68 Author: Takashi Iwai Date: Fri Aug 29 17:07:10 2025 +0200 ALSA: ua101: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-3-tiwai@suse.de commit 9b99749f2a892e5d92cf985d6a12121e58aa4c50 Author: Takashi Iwai Date: Fri Aug 29 17:07:09 2025 +0200 ALSA: ua101: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150724.6886-2-tiwai@suse.de commit b9526bff42197cc83cdfb64e51822734180258d1 Author: Takashi Iwai Date: Fri Aug 29 17:00:24 2025 +0200 ALSA: serial-u16550: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-14-tiwai@suse.de commit ec339e149e93779ef7ea4cd2fe6f61ea9e823cb3 Author: Takashi Iwai Date: Fri Aug 29 17:00:23 2025 +0200 ALSA: portman2x4: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-13-tiwai@suse.de commit a28d65886b9b80d93d939dd9f02e6e995b4febda Author: Takashi Iwai Date: Fri Aug 29 17:00:22 2025 +0200 ALSA: mts64: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-12-tiwai@suse.de commit 316e0074ecdc1f5723f69c12004bec31ca4cd276 Author: Takashi Iwai Date: Fri Aug 29 17:00:21 2025 +0200 ALSA: mtpav: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-11-tiwai@suse.de commit 55c52cd3118bc400d7364945475f02e905ccca56 Author: Takashi Iwai Date: Fri Aug 29 17:00:20 2025 +0200 ALSA: mpu401: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-10-tiwai@suse.de commit 638c33ef7923a0907ff907e18e2c87f0e7fcbd63 Author: Takashi Iwai Date: Fri Aug 29 17:00:19 2025 +0200 ALSA: dummy: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-9-tiwai@suse.de commit 353fc3e3811aa577956940b04a4c540eb65a9992 Author: Takashi Iwai Date: Fri Aug 29 17:00:18 2025 +0200 ALSA: vx: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-8-tiwai@suse.de commit 72a3017077495a7dfacf1ef9ef83e92bbbd18244 Author: Takashi Iwai Date: Fri Aug 29 17:00:17 2025 +0200 ALSA: opl4: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-7-tiwai@suse.de commit 45451eb5d16d817ab4acf65c137c34f6dd608842 Author: Takashi Iwai Date: Fri Aug 29 17:00:16 2025 +0200 ALSA: opl4: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-6-tiwai@suse.de commit ec6ac1d5e15a14e403630c5fbf8e41daf184ec83 Author: Takashi Iwai Date: Fri Aug 29 17:00:15 2025 +0200 ALSA: opl3: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-5-tiwai@suse.de commit 6a6da5ca9795d59f2e8b851f2b8d2ce8bc536c6e Author: Takashi Iwai Date: Fri Aug 29 17:00:14 2025 +0200 ALSA: opl3: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-4-tiwai@suse.de commit 1ef2cb6b29c2c9c26b490ab5a1e8161923fb7798 Author: Takashi Iwai Date: Fri Aug 29 17:00:13 2025 +0200 ALSA: aloop: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-3-tiwai@suse.de commit ebd9b6c91d4e345b7ded4b56567c46267a45d961 Author: Takashi Iwai Date: Fri Aug 29 17:00:12 2025 +0200 ALSA: aloop: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829150026.6379-2-tiwai@suse.de commit 4b97f8e614ba46a50bd181d40b5a1424411a211a Author: Takashi Iwai Date: Fri Aug 29 16:52:58 2025 +0200 ALSA: wavefront: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-19-tiwai@suse.de commit ec4c3dcf155916e53283f7593a44759d86837726 Author: Takashi Iwai Date: Fri Aug 29 16:52:57 2025 +0200 ALSA: wss: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-18-tiwai@suse.de commit 372b43467aecd97b7c9435b51987a5e958b7d7e2 Author: Takashi Iwai Date: Fri Aug 29 16:52:56 2025 +0200 ALSA: wss: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-17-tiwai@suse.de commit 79112d65276f889a3c5c30ed4595c12e910a9f1f Author: Takashi Iwai Date: Fri Aug 29 16:52:55 2025 +0200 ALSA: sscape: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-16-tiwai@suse.de commit 7b4ac266898ad716c03456d9cc368c2d8592922a Author: Takashi Iwai Date: Fri Aug 29 16:52:54 2025 +0200 ALSA: emu8000: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-15-tiwai@suse.de commit 5487fb09fa55a043120f6f56d4df3a4e9b6e5bd7 Author: Takashi Iwai Date: Fri Aug 29 16:52:53 2025 +0200 ALSA: sb: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-14-tiwai@suse.de commit d994b2ba8f74e3c62110f781799144d228ef2a31 Author: Takashi Iwai Date: Fri Aug 29 16:52:52 2025 +0200 ALSA: sb: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-13-tiwai@suse.de commit 949ffce4af7f33176f271343bff0b72a8b0a64d5 Author: Takashi Iwai Date: Fri Aug 29 16:52:51 2025 +0200 ALSA: opti9xx: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-12-tiwai@suse.de commit 1e012ff2fbe3506b83f4c70ea58071797689fbaa Author: Takashi Iwai Date: Fri Aug 29 16:52:50 2025 +0200 ALSA: opl3sa2: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-11-tiwai@suse.de commit 6aaf6dadd9bf861c1ab1a719d6de02c929a25e0f Author: Takashi Iwai Date: Fri Aug 29 16:52:49 2025 +0200 ALSA: msnd: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-10-tiwai@suse.de commit ae2b22b4677767b6f66047b9af320e2f7c9e04d8 Author: Takashi Iwai Date: Fri Aug 29 16:52:48 2025 +0200 ALSA: gus: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-9-tiwai@suse.de commit 3abb538fffc8af73859f16e6e274962d9b53c907 Author: Takashi Iwai Date: Fri Aug 29 16:52:47 2025 +0200 ALSA: gus: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. As replaced with the guard(mutex), no longer used snd_gf1_mem_lock() is dropped, too. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-8-tiwai@suse.de commit 98ea9c6a06f41ee1d2b158918db9dbf73d6d3493 Author: Takashi Iwai Date: Fri Aug 29 16:52:46 2025 +0200 ALSA: es18xx: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-7-tiwai@suse.de commit e5a5ad81c825f36a46eb56f3cc41a4c4e3714538 Author: Takashi Iwai Date: Fri Aug 29 16:52:45 2025 +0200 ALSA: es1688: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-6-tiwai@suse.de commit 6f5d556a80a9c719b1c1c2b866a283c6133a0f28 Author: Takashi Iwai Date: Fri Aug 29 16:52:44 2025 +0200 ALSA: cs423x: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-5-tiwai@suse.de commit 14ba220697f8603795e82db63f81c5f880102a1f Author: Takashi Iwai Date: Fri Aug 29 16:52:43 2025 +0200 ALSA: cs423x: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-4-tiwai@suse.de commit ca1d5ca2e5022f989e3ef48eb2d678a551fb814f Author: Takashi Iwai Date: Fri Aug 29 16:52:42 2025 +0200 ALSA: cmi8330: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-3-tiwai@suse.de commit 8c6a0bc917b4ba7db9945dacda7cc582af7a335f Author: Takashi Iwai Date: Fri Aug 29 16:52:41 2025 +0200 ALSA: ad1816a: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829145300.5460-2-tiwai@suse.de commit 8c0cb47e2692d7a1c2b56e6b0b9912868a598461 Author: Takashi Iwai Date: Fri Aug 29 16:43:36 2025 +0200 ALSA: ymfpci: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-62-tiwai@suse.de commit dde5decc43de96ff508815e359aef6edcef68634 Author: Takashi Iwai Date: Fri Aug 29 16:43:35 2025 +0200 ALSA: vx222: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-61-tiwai@suse.de commit 9d60b94f13d3d1e7251b86e838920d0b0ad4947f Author: Takashi Iwai Date: Fri Aug 29 16:43:34 2025 +0200 ALSA: via82xx: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-60-tiwai@suse.de commit 62d8070db648c17e10602704e9813d209d9ad994 Author: Takashi Iwai Date: Fri Aug 29 16:43:33 2025 +0200 ALSA: trident: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-59-tiwai@suse.de commit 4f83e1da6e057c13d6e930558d11cb1095b19d3a Author: Takashi Iwai Date: Fri Aug 29 16:43:32 2025 +0200 ALSA: trident: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-58-tiwai@suse.de commit fa670cbaee466c997232d3ddea4bf05b5efa4d78 Author: Takashi Iwai Date: Fri Aug 29 16:43:31 2025 +0200 ALSA: sonicvibes: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-57-tiwai@suse.de commit 8e11f94ea15ddebfcb040e89ff3093746b7e2c79 Author: Takashi Iwai Date: Fri Aug 29 16:43:30 2025 +0200 ALSA: sis7019: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-56-tiwai@suse.de commit e7b99fdddfe873b49f72b27676eeab6ec77f2633 Author: Takashi Iwai Date: Fri Aug 29 16:43:29 2025 +0200 ALSA: sis7019: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-55-tiwai@suse.de commit bd6aa020ec491b3389b2141a5e8ba81248a777a6 Author: Takashi Iwai Date: Fri Aug 29 16:43:28 2025 +0200 ALSA: rme9652: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-54-tiwai@suse.de commit 02699abfbd33ce6cf69fbe2771a7c20f84325481 Author: Takashi Iwai Date: Fri Aug 29 16:43:27 2025 +0200 ALSA: hdspm: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-53-tiwai@suse.de commit d422878cae31fcde30818ea082c23c6bf03fd0e3 Author: Takashi Iwai Date: Fri Aug 29 16:43:26 2025 +0200 ALSA: hdsp: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-52-tiwai@suse.de commit d3424b8bf78593e1751cfa19628aa0008d2e08ce Author: Takashi Iwai Date: Fri Aug 29 16:43:25 2025 +0200 ALSA: rme96: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-51-tiwai@suse.de commit 8bb75ae244c5894ae08e090a52faaca8330fef62 Author: Takashi Iwai Date: Fri Aug 29 16:43:24 2025 +0200 ALSA: rme32: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-50-tiwai@suse.de commit 26e4346cff3a33fed726c074df4719eddd930175 Author: Takashi Iwai Date: Fri Aug 29 16:43:23 2025 +0200 ALSA: pcxhr: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-49-tiwai@suse.de commit 4751026c7923a3bfb95a204a6d3116c759e28691 Author: Takashi Iwai Date: Fri Aug 29 16:43:22 2025 +0200 ALSA: oxygen: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-48-tiwai@suse.de commit 8ecafe5dacc2d98312315b83902ce7b7dbcdfa86 Author: Takashi Iwai Date: Fri Aug 29 16:43:21 2025 +0200 ALSA: oxygen: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-47-tiwai@suse.de commit d1d88d2850a9504fc180b4abce4a03cb9191f3b9 Author: Takashi Iwai Date: Fri Aug 29 16:43:20 2025 +0200 ALSA: nm256: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-46-tiwai@suse.de commit 6c56792a053435b9eee67c07bc4fb0768487a55c Author: Takashi Iwai Date: Fri Aug 29 16:43:19 2025 +0200 ALSA: nm256: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-45-tiwai@suse.de commit 23ab90a965bae0da773893037de1ab4c8df03fde Author: Takashi Iwai Date: Fri Aug 29 16:43:18 2025 +0200 ALSA: mixart: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-44-tiwai@suse.de commit 35dea82a4396ec0b974aae3e8e836a2336873561 Author: Takashi Iwai Date: Fri Aug 29 16:43:17 2025 +0200 ALSA: maestro3: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-43-tiwai@suse.de commit 3023cc514a2f3b43e96e8360c8b0be3b1c8f7501 Author: Takashi Iwai Date: Fri Aug 29 16:43:16 2025 +0200 ALSA: lx6464es: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-42-tiwai@suse.de commit e25667d3f311f7b56d4c4b7294a8c2a6f1cb69d7 Author: Takashi Iwai Date: Fri Aug 29 16:43:15 2025 +0200 ALSA: lola: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-41-tiwai@suse.de commit 18aec9ea320ffc3c66058c1da8f86c413c17ff43 Author: Takashi Iwai Date: Fri Aug 29 16:43:14 2025 +0200 ALSA: lola: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-40-tiwai@suse.de commit aff742c156bb070ac05833f0a8565fa307fa4d13 Author: Takashi Iwai Date: Fri Aug 29 16:43:13 2025 +0200 ALSA: korg1212: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-39-tiwai@suse.de commit 940653fff03a647357efe3ce6e0d89dc2bcbee2e Author: Takashi Iwai Date: Fri Aug 29 16:43:12 2025 +0200 ALSA: korg1212: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-38-tiwai@suse.de commit 220a76bbf750db588c260d3a6b9ae1f9e342ee55 Author: Takashi Iwai Date: Fri Aug 29 16:43:11 2025 +0200 ALSA: intel8x0: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-37-tiwai@suse.de commit d0b8e4190407f90db6fbd0b847e485278c5a71f5 Author: Takashi Iwai Date: Fri Aug 29 16:43:10 2025 +0200 ALSA: ice1712: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-36-tiwai@suse.de commit 9da230b3b2296df9c3d81fe6badab59a81c3d76f Author: Takashi Iwai Date: Fri Aug 29 16:43:09 2025 +0200 ALSA: ice1712: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-35-tiwai@suse.de commit 2b429331f55bf4d39a9be3357b0958d577bf9086 Author: Takashi Iwai Date: Fri Aug 29 16:43:08 2025 +0200 ALSA: fm801: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-34-tiwai@suse.de commit 3ea4db1f202813501f2068003fb512455cf56411 Author: Takashi Iwai Date: Fri Aug 29 16:43:07 2025 +0200 ALSA: es1968: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-33-tiwai@suse.de commit 819107cdebff9037e3dd9249823c81a212d8e528 Author: Takashi Iwai Date: Fri Aug 29 16:43:06 2025 +0200 ALSA: es1968: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-32-tiwai@suse.de commit f9733d65a6617e0ec7985bfbfdca3c49cd8eb379 Author: Takashi Iwai Date: Fri Aug 29 16:43:05 2025 +0200 ALSA: es1938: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-31-tiwai@suse.de commit 1af61c669b1c9ec42a152b8680dcdaf4bee30f09 Author: Takashi Iwai Date: Fri Aug 29 16:43:04 2025 +0200 ALSA: emu10k1x: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-30-tiwai@suse.de commit 3a0c3159f7fc4664aeb3a243bb245b3092b2420a Author: Takashi Iwai Date: Fri Aug 29 16:43:03 2025 +0200 ALSA: emu10k1: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-29-tiwai@suse.de commit 7c4a379e0622e7d8e7eb7dbc76445cdd6306aad8 Author: Takashi Iwai Date: Fri Aug 29 16:43:02 2025 +0200 ALSA: emu10k1: Use guard() for emu1010 FPGA locking The snd_emu1010_fpga_lock() and _unlock() call pairs can be simplified gracefully with the introduction of guard(). Only code refactoring, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-28-tiwai@suse.de commit f44f745f753d55c2f4134b2e53996fdcc5cc7620 Author: Takashi Iwai Date: Fri Aug 29 16:43:01 2025 +0200 ALSA: emu10k1: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-27-tiwai@suse.de commit 9bd92d6673426c0dc99f5f526fb029ee69de8d73 Author: Takashi Iwai Date: Fri Aug 29 16:43:00 2025 +0200 ALSA: echoaudio: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-26-tiwai@suse.de commit 3eda594925f72c6846cf4785e700ab8e26e34bd1 Author: Takashi Iwai Date: Fri Aug 29 16:42:59 2025 +0200 ALSA: echoaudio: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-25-tiwai@suse.de commit be9478bd3afcdd54b29cf4d02b70f04b04888e20 Author: Takashi Iwai Date: Fri Aug 29 16:42:58 2025 +0200 ALSA: ctxfi: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-24-tiwai@suse.de commit e1d4c746bb46127efe541c3fc4b1034faf0a0adf Author: Takashi Iwai Date: Fri Aug 29 16:42:57 2025 +0200 ALSA: ctxfi: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-23-tiwai@suse.de commit e8eca9fec23f6ae66e5a776ea15b89c82da7ab73 Author: Takashi Iwai Date: Fri Aug 29 16:42:56 2025 +0200 ALSA: cs5535audio: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-22-tiwai@suse.de commit 0ba9da2d6f770509d3f1d37df23d2ca31d5df4ae Author: Takashi Iwai Date: Fri Aug 29 16:42:55 2025 +0200 ALSA: cs46xx: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-21-tiwai@suse.de commit 02ba95351a88af7e9baaf477da1cfd647ef1a2c8 Author: Takashi Iwai Date: Fri Aug 29 16:42:54 2025 +0200 ALSA: cs46xx: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-20-tiwai@suse.de commit 7a5127c2c8a5a4d281b34f66d2461bf2efa9bc4f Author: Takashi Iwai Date: Fri Aug 29 16:42:53 2025 +0200 ALSA: cs4281: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-19-tiwai@suse.de commit 40bc78567f63f5543e8cac4113ea493e9938fc3e Author: Takashi Iwai Date: Fri Aug 29 16:42:52 2025 +0200 ALSA: cmipci: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-18-tiwai@suse.de commit d0d95e9bd8153508ce23159abd8a849d53b9fe15 Author: Takashi Iwai Date: Fri Aug 29 16:42:51 2025 +0200 ALSA: cmipci: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-17-tiwai@suse.de commit 22ec1279269f13d794ecb5c81d298a316aa78d28 Author: Takashi Iwai Date: Fri Aug 29 16:42:50 2025 +0200 ALSA: ca0106: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-16-tiwai@suse.de commit 637a3999442d9b7a546b65791cdd7a8c6c082834 Author: Takashi Iwai Date: Fri Aug 29 16:42:49 2025 +0200 ALSA: bt87x: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-15-tiwai@suse.de commit 290adc48a2328e8b380ad19a8b0d74a0aa20f606 Author: Takashi Iwai Date: Fri Aug 29 16:42:48 2025 +0200 ALSA: aw2: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-14-tiwai@suse.de commit ca10ce1caf1922e5fdd62ccaf525d96bd2eeb611 Author: Takashi Iwai Date: Fri Aug 29 16:42:47 2025 +0200 ALSA: aw2: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-13-tiwai@suse.de commit 5f7e725e023ec91aa55d73de1889e1660fd62536 Author: Takashi Iwai Date: Fri Aug 29 16:42:46 2025 +0200 ALSA: atiixp: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-12-tiwai@suse.de commit 9608fe85ff21684c6c00f2658c2806dd4b2295f0 Author: Takashi Iwai Date: Fri Aug 29 16:42:45 2025 +0200 ALSA: atiixp: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-11-tiwai@suse.de commit 7f08b008afbc9bd17c8e3f7d275448417456192a Author: Takashi Iwai Date: Fri Aug 29 16:42:44 2025 +0200 ALSA: ad1889: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-10-tiwai@suse.de commit fe0f9c2e72262bd9fb21ef5083840d51a7677a8e Author: Takashi Iwai Date: Fri Aug 29 16:42:43 2025 +0200 ALSA: als4000: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-9-tiwai@suse.de commit f28745ab9fc57aae02cf800362f76c2f2f89f170 Author: Takashi Iwai Date: Fri Aug 29 16:42:42 2025 +0200 ALSA: als300: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-8-tiwai@suse.de commit d062d6977ea3d8d4e0188ad05e329d9b129f1aa4 Author: Takashi Iwai Date: Fri Aug 29 16:42:41 2025 +0200 ALSA: ens137x: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-7-tiwai@suse.de commit d701303bf465dce024f40f3969ad62ed4621d159 Author: Takashi Iwai Date: Fri Aug 29 16:42:40 2025 +0200 ALSA: ens137x: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-6-tiwai@suse.de commit e96f601e7dd01ae34144839c9757bd9a53e062fc Author: Takashi Iwai Date: Fri Aug 29 16:42:39 2025 +0200 ALSA: azt3328: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-5-tiwai@suse.de commit ee7ddc5c01a9ce3e5de8cce28d6000b495efb53d Author: Takashi Iwai Date: Fri Aug 29 16:42:38 2025 +0200 ALSA: ali5451: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-4-tiwai@suse.de commit fcee249f98d0b84d5d0222b47d30c93bbca08e17 Author: Takashi Iwai Date: Fri Aug 29 16:42:37 2025 +0200 ALSA: ac97: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-3-tiwai@suse.de commit 0a36f7d69dca0fd25ef66acda795b8b2b0228451 Author: Takashi Iwai Date: Fri Aug 29 16:42:36 2025 +0200 ALSA: ac97: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250829144342.4290-2-tiwai@suse.de commit 9f5c33bdddcdb1d83a38cb3ff405dba8c9fde9b8 Author: Xichao Zhao Date: Wed Aug 27 17:44:33 2025 +0800 dm: fix "writen"->"written" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Signed-off-by: Mikulas Patocka commit 24735771774954fa0ebbe0dfa285752647d327f0 Author: Dongsheng Yang Date: Mon Sep 1 05:42:18 2025 +0000 dm-pcache: cleanup: fix coding style report by checkpatch.pl A patch from a few days ago fixed the division issue on 32-bit machines, but it introduced a coding style problem. WARNING: Missing a blank line after declarations + u32 rem; + div_u64_rem(off >> PCACHE_CACHE_SUBTREE_SIZE_SHIFT, cache->n_ksets, &rem); total: 0 errors, 1 warnings, 634 lines checked Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka commit 1f9ad14aef064ced0f60caae60c62b989de25676 Author: Dongsheng Yang Date: Mon Sep 1 05:42:00 2025 +0000 dm-pcache: remove ctrl_lock for pcache_cache_segment The smatch checker reports a “scheduler in atomic context” problem in the following call chain: miss_read_end_req() -> cache_seg_put() -> cache_seg_invalidate() -> cache_seg_gen_increase() -> mutex_lock(&cache_seg->ctrl_lock); In practice, this `mutex_lock` will not actually schedule, because it is only called when `cache_seg_put()` drops the last reference, which is single-threaded. That is also why the issue never shows up during real testing. However, the code is still buggy. The original purpose of `ctrl_lock` was to prevent read/write conflicts on the cache segment control information. Looking at the current usage, all control information accesses are single-threaded: reads only occur during the init phase, where no conflicts are possible, and writes happen once in the init phase (also single-threaded) and once when `cache_seg_put()` drops the last reference (again single-threaded). Therefore, this patch removes `ctrl_lock` entirely and adds comments in the appropriate places to document this logic. Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka commit 27a17e02418e978198513edfb389b65237f4eaf5 Author: Neeraj Upadhyay Date: Thu Aug 28 17:02:24 2025 +0530 x86/sev: Indicate the SEV-SNP guest supports Secure AVIC Now that Secure AVIC support is complete, make it part of to the SNP present features. Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828113225.209174-1-Neeraj.Upadhyay@amd.com commit 952aefeebb3339d8129f7ca7fdb8f4344b6543a7 Author: Neeraj Upadhyay Date: Thu Aug 28 17:01:19 2025 +0530 x86/sev: Prevent SECURE_AVIC_CONTROL MSR interception for Secure AVIC guests The SECURE_AVIC_CONTROL MSR holds the GPA of the guest APIC backing page and bitfields to control enablement of Secure AVIC and whether the guest allows NMIs to be injected by the hypervisor. This MSR is populated by the guest and can be read by the guest to get the GPA of the APIC backing page. The MSR can only be accessed in Secure AVIC mode. Any attempt to access it when not in Secure AVIC mode results in #GP. So, the hypervisor should not intercept it. A #VC exception will be generated otherwise. If this occurs and Secure AVIC is enabled, terminate the guest execution. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828113119.209135-1-Neeraj.Upadhyay@amd.com commit c4074ab87f3483deb15f277f302f199cdb997738 Author: Neeraj Upadhyay Date: Thu Aug 28 16:51:26 2025 +0530 x86/apic: Enable Secure AVIC in the control MSR With all the pieces in place now, enable Secure AVIC in the Secure AVIC Control MSR. Any access to x2APIC MSRs are emulated by the hypervisor before Secure AVIC is enabled in the control MSR. Post Secure AVIC enablement, all x2APIC MSR accesses (whether accelerated by AVIC hardware or trapped as a #VC exception) operate on the vCPU's APIC backing page. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828112126.209028-1-Neeraj.Upadhyay@amd.com commit 7f9d34b0a7cb93d678ee7207f0634dbf79e47fe5 Author: Tetsuo Handa Date: Sat Aug 30 19:01:01 2025 +0900 cramfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/429b3ef1-13de-4310-9a8e-c2dc9a36234a@I-love.SAKURA.ne.jp Acked-by: Nicolas Pitre Signed-off-by: Christian Brauner commit 6b53cf48d9339c75fa51927b0a67d8a6751066bd Author: Michal Wilczynski Date: Fri Aug 22 00:20:18 2025 +0200 drm/imagination: Enable PowerVR driver for RISC-V Several RISC-V boards feature Imagination GPUs that are compatible with the PowerVR driver. An example is the IMG BXM-4-64 GPU on the Lichee Pi 4A board. This commit adjusts the driver's Kconfig dependencies to allow the PowerVR driver to be compiled on the RISC-V architecture. By enabling compilation on RISC-V, we expand support for these GPUs, providing graphics acceleration capabilities and enhancing hardware compatibility on RISC-V platforms. The RISC-V support is restricted to 64-bit systems (RISCV && 64BIT) as the driver currently has an implicit dependency on a 64-bit platform. Add a dependency on MMU to fix a build warning on RISC-V configurations without an MMU. Reviewed-by: Ulf Hansson Reviewed-by: Bartosz Golaszewski Reviewed-by: Matt Coster Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250822-apr_14_for_sending-v13-4-af656f7cc6c3@samsung.com Signed-off-by: Matt Coster commit 337ebfda8a4f2627bf52e200cacf6f3a2f5ccf48 Author: Michal Wilczynski Date: Fri Aug 22 00:20:16 2025 +0200 dt-bindings: gpu: img,powervr-rogue: Add TH1520 GPU support Rework the PowerVR Rogue GPU binding to use an explicit, per variant style for defining power domain properties and add support for the T-HEAD TH1520 SoC's GPU. To improve clarity and precision, the binding is refactored so that power domain items are listed explicitly for each variant [1]. The previous method relied on an implicit, positional mapping between the `power-domains` and `power-domain-names` properties. This change replaces the generic rules with self contained if/then blocks for each GPU variant, making the relationship between power domains and their names explicit and unambiguous. The generic if block for img,img-rogue, which previously required power-domains and power-domain-names for all variants, is removed. Instead, each specific GPU variant now defines its own power domain requirements within a self-contained if/then block, making the schema more explicit. This new structure is then used to add support for the `thead,th1520-gpu`. While its BXM-4-64 IP has two conceptual power domains, the TH1520 SoC integrates them behind a single power gate. The new binding models this with a specific rule that enforces a single `power-domains` entry and disallows the `power-domain-names` property. Link: https://lore.kernel.org/all/4d79c8dd-c5fb-442c-ac65-37e7176b0cdd@linaro.org/ [1] Reviewed-by: Krzysztof Kozlowski Reviewed-by: Matt Coster Reviewed-by: Ulf Hansson Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250822-apr_14_for_sending-v13-2-af656f7cc6c3@samsung.com Signed-off-by: Matt Coster commit e38e8391f30b41c5a24bb46dc6ef4161921e782d Author: Michal Wilczynski Date: Fri Aug 22 00:20:15 2025 +0200 drm/imagination: Use pwrseq for TH1520 GPU power management Update the Imagination PVR DRM driver to leverage the pwrseq framework for managing the complex power sequence of the GPU on the T-HEAD TH1520 SoC. To cleanly separate platform-specific logic from the generic driver, this patch introduces an `init` callback to the `pwr_power_sequence_ops` struct. This allows for different power management strategies to be selected at probe time based on the device's compatible string. A `pvr_device_data` struct, associated with each compatible in the of_device_id table, points to the appropriate ops table (manual or pwrseq). At probe time, the driver now calls the `->init()` op. For pwrseq-based platforms, this callback calls `devm_pwrseq_get("gpu-power")`, deferring probe if the sequencer is not yet available. For other platforms, it falls back to the existing manual clock and reset handling. The runtime PM callbacks continue to call the appropriate functions via the ops table. Signed-off-by: Michal Wilczynski Reviewed-by: Ulf Hansson Reviewed-by: Matt Coster Link: https://lore.kernel.org/r/20250822-apr_14_for_sending-v13-1-af656f7cc6c3@samsung.com Signed-off-by: Matt Coster commit e5bca063c150877c45b88ff134b6ef7a5eae8e7a Author: Greg Kroah-Hartman Date: Sat Aug 30 12:55:39 2025 +0200 fs: remove vfs_ioctl export vfs_ioctl() is no longer called by anything outside of fs/ioctl.c, so remove the global symbol and export as it is not needed. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/2025083038-carving-amuck-a4ae@gregkh Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit c8018325dd3e7c75c19b1e9263c358c4c96214f9 Author: Neeraj Upadhyay Date: Thu Aug 28 16:50:08 2025 +0530 x86/apic: Add kexec support for Secure AVIC Add a apic->teardown() callback to disable Secure AVIC before rebooting into the new kernel. This ensures that the new kernel does not access the old APIC backing page which was allocated by the previous kernel. Such accesses can happen if there are any APIC accesses done during the guest boot before Secure AVIC driver probe is done by the new kernel (as Secure AVIC would have remained enabled in the Secure AVIC control MSR). Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828112008.209013-1-Neeraj.Upadhyay@amd.com commit 43b6687ac8777821973d790ff9e9565a84cf6b98 Author: Neeraj Upadhyay Date: Thu Aug 28 16:46:54 2025 +0530 x86/apic: Handle EOI writes for Secure AVIC guests Secure AVIC accelerates the guest's EOI MSR writes for edge-triggered interrupts. For level-triggered interrupts, EOI MSR writes trigger a #VC exception with an SVM_EXIT_AVIC_UNACCELERATED_ACCESS error code. To complete EOI handling, the #VC exception handler would need to trigger a GHCB protocol MSR write event to notify the hypervisor about completion of the level-triggered interrupt. Hypervisor notification is required for cases like emulated IO-APIC, to complete and clear interrupt in the IO-APIC's interrupt state. However, #VC exception handling adds extra performance overhead for APIC register writes. In addition, for Secure AVIC, some unaccelerated APIC register MSR writes are trapped, whereas others are faulted. This results in additional complexity in #VC exception handling for unaccelerated APIC MSR accesses. So, directly do a GHCB protocol based APIC EOI MSR write from apic->eoi() callback for level-triggered interrupts. Use WRMSR for edge-triggered interrupts, so that hardware re-evaluates any pending interrupt which can be delivered to the guest vCPU. For level-triggered interrupts, re-evaluation happens on return from VMGEXIT corresponding to the GHCB event for APIC EOI MSR write. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111654.208987-1-Neeraj.Upadhyay@amd.com commit 8e3714305ad29866d27aa354f09fd03036f44375 Author: Neeraj Upadhyay Date: Thu Aug 28 16:43:56 2025 +0530 x86/apic: Read and write LVT* APIC registers from HV for SAVIC guests The Hypervisor needs information about the current state of the LVT registers for device emulation and NMIs. So, forward reads and write of these registers to the hypervisor for Secure AVIC enabled guests. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111356.208972-1-Neeraj.Upadhyay@amd.com commit 28bbfad229e4addf9990279c73c07b762b4a04e4 Author: Kishon Vijay Abraham I Date: Thu Aug 28 16:43:15 2025 +0530 x86/sev: Enable NMI support for Secure AVIC Now that support to send NMI IPI and support to inject NMI from the hypervisor has been added, set V_NMI_ENABLE in the VINTR_CTRL field of the VMSA to enable NMI for Secure AVIC guests. [ bp: Zap useless brackets. ] Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111315.208959-1-Neeraj.Upadhyay@amd.com commit 869e36b9660dd72ab960b74c55d7a200c22588d0 Author: Neeraj Upadhyay Date: Thu Aug 28 16:42:43 2025 +0530 x86/apic: Allow NMI to be injected from hypervisor for Secure AVIC Secure AVIC requires the "AllowedNmi" bit in the Secure AVIC Control MSR to be set for an NMI to be injected from the hypervisor. So set it. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111243.208946-1-Neeraj.Upadhyay@amd.com commit 9de196f519a505cf104216d6f1d8688570dacca4 Author: Neeraj Upadhyay Date: Thu Aug 28 16:42:13 2025 +0530 x86/apic: Add support to send NMI IPI for Secure AVIC Secure AVIC introduces a new field in the APIC backing page "NmiReq" that has to be set by the guest to request a NMI IPI through APIC_ICR write. Add support to set NmiReq appropriately to send NMI IPI. Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111213.208933-1-Neeraj.Upadhyay@amd.com commit c77683eccf53428a6934df76702e33c0faf46fe5 Author: Kishon Vijay Abraham I Date: Thu Aug 28 16:41:41 2025 +0530 x86/sev: Initialize VGIF for secondary vCPUs for Secure AVIC Virtual GIF (VGIF) provides masking capability for when virtual interrupts (virtual maskable interrupts, virtual NMIs) can be taken by the guest vCPU. The Secure AVIC hardware reads VGIF state from the vCPU's VMSA. So, set VGIF for secondary CPUs (the configuration for the boot CPU is done by the hypervisor), to unmask delivery of virtual interrupts to the vCPU. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828111141.208920-1-Neeraj.Upadhyay@amd.com commit ea7d792e11e10f502933c39f3836cb73d35dac36 Author: Neeraj Upadhyay Date: Thu Aug 28 16:39:26 2025 +0530 x86/apic: Support LAPIC timer for Secure AVIC Secure AVIC requires the LAPIC timer to be emulated by the hypervisor. KVM already supports emulating the LAPIC timer using hrtimers. In order to emulate it, APIC_LVTT, APIC_TMICT and APIC_TDCR register values need to be propagated to the hypervisor for arming the timer. APIC_TMCCT register value has to be read from the hypervisor, which is required for calibrating the APIC timer. So, read/write all APIC timer registers from/to the hypervisor. Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828110926.208866-1-Neeraj.Upadhyay@amd.com commit 2c6978ea1a85603fe7d401f7bb3a1fbcab21fde2 Author: Neeraj Upadhyay Date: Thu Aug 28 16:38:24 2025 +0530 x86/apic: Add support to send IPI for Secure AVIC Secure AVIC hardware accelerates only Self-IPI, i.e. on WRMSR to APIC_SELF_IPI and APIC_ICR (with destination shorthand equal to Self) registers, hardware takes care of updating the APIC_IRR in the APIC backing page of the vCPU. For other IPI types (cross-vCPU, broadcast IPIs), software needs to take care of updating the APIC_IRR state of the target vCPUs and to ensure that the target vCPUs notice the new pending interrupt. Add new callbacks in the Secure AVIC driver for sending IPI requests. These callbacks update the IRR in the target guest vCPU's APIC backing page. To ensure that the remote vCPU notices the new pending interrupt, reuse the GHCB MSR handling code in vc_handle_msr() to issue APIC_ICR MSR-write GHCB protocol event to the hypervisor. For Secure AVIC guests, on APIC_ICR write MSR exits, the hypervisor notifies the target vCPU by either sending an AVIC doorbell (if target vCPU is running) or by waking up the non-running target vCPU. Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828110824.208851-1-Neeraj.Upadhyay@amd.com commit 8c79a68de1d2d63537f2a318e5a3b27744c835ad Author: Neeraj Upadhyay Date: Thu Aug 28 16:32:43 2025 +0530 x86/apic: Add an update_vector() callback for Secure AVIC Add an update_vector() callback to set/clear the ALLOWED_IRR field in a vCPU's APIC backing page for vectors which are emulated by the hypervisor. The ALLOWED_IRR field indicates the interrupt vectors which the guest allows the hypervisor to inject (typically for emulated devices). Interrupt vectors used exclusively by the guest itself and the vectors which are not emulated by the hypervisor, such as IPI vectors, should not be set by the guest in the ALLOWED_IRR fields. As clearing/setting state of a vector will also be used in subsequent commits for other APIC registers (such as APIC_IRR update for sending IPI), add a common update_vector() in the Secure AVIC driver. [ bp: Massage commit message. ] Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828110255.208779-4-Neeraj.Upadhyay@amd.com commit 90ccf10de527c0c9b117beddd09ee7ac38efaa5b Author: Christian Brauner Date: Mon Sep 1 12:40:38 2025 +0200 inode: fix whitespace issues Fix two minor whitespace issues. Signed-off-by: Christian Brauner commit 37b27bd5d6217b75d315f28b4399aad0a336f299 Author: Josef Bacik Date: Tue Aug 26 11:39:02 2025 -0400 fs: add an icount_read helper Instead of doing direct access to ->i_count, add a helper to handle this. This will make it easier to convert i_count to a refcount later. Signed-off-by: Josef Bacik Link: https://lore.kernel.org/9bc62a84c6b9d6337781203f60837bd98fbc4a96.1756222464.git.josef@toxicpanda.com Signed-off-by: Christian Brauner commit 9e70e985bdc2c6fe7a160e4d59ddd7c0a39bc077 Author: Josef Bacik Date: Tue Aug 26 11:39:03 2025 -0400 fs: rework iput logic Currently, if we are the last iput, and we have the I_DIRTY_TIME bit set, we will grab a reference on the inode again and then mark it dirty and then redo the put. This is to make sure we delay the time update for as long as possible. We can rework this logic to simply dec i_count if it is not 1, and if it is do the time update while still holding the i_count reference. Then we can replace the atomic_dec_and_lock with locking the ->i_lock and doing atomic_dec_and_test, since we did the atomic_add_unless above. Co-developed-by: Mateusz Guzik Signed-off-by: Mateusz Guzik Signed-off-by: Josef Bacik Link: https://lore.kernel.org/be208b89bdb650202e712ce2bcfc407ac7044c7a.1756222464.git.josef@toxicpanda.com Signed-off-by: Christian Brauner commit 60791ef3751cb0ceccd6f5ac98276153745c7980 Author: Neeraj Upadhyay Date: Thu Aug 28 16:32:42 2025 +0530 x86/apic: Add update_vector() callback for APIC drivers Add an update_vector() callback to allow APIC drivers to perform driver specific operations on external vector allocation/teardown on a CPU. This callback will be used by the Secure AVIC APIC driver to configure the vectors which a guest vCPU allows the hypervisor to send to it. As system vectors have fixed vector assignments and are not dynamically allocated, add an apic_update_vector() public API to facilitate update_vector() callback invocation for them. This will be used for Secure AVIC enabled guests to allow the hypervisor to inject system vectors which are emulated by the hypervisor such as APIC timer vector and HYPERVISOR_CALLBACK_VECTOR. While at it, cleanup line break in apic_update_irq_cfg(). Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828110255.208779-3-Neeraj.Upadhyay@amd.com commit 45e2cef568cdf87cb06c9783b45c8f08d1ab1cec Author: Neeraj Upadhyay Date: Thu Aug 28 16:32:41 2025 +0530 x86/apic: Initialize APIC ID for Secure AVIC Initialize the APIC ID in the Secure AVIC APIC backing page with the APIC_ID MSR value read from the hypervisor. CPU topology evaluation later during boot would catch and report any duplicate APIC ID for two CPUs. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828110255.208779-2-Neeraj.Upadhyay@amd.com commit cf87f93847dea607e8a35983cb006ef8493f8065 Author: Jacek Lawrynowicz Date: Fri Aug 8 13:10:14 2025 +0200 accel/ivpu: Make function parameter names consistent Make ivpu_hw_btrs_dct_set_status() and ivpu_fw_boot_params_setup() declaration and definition parameter names consistent. Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250808111014.328607-1-jacek.lawrynowicz@linux.intel.com commit 78f859673c85cc7c18ffdeb659f29cad3f13b580 Author: Jacek Lawrynowicz Date: Fri Aug 8 13:10:44 2025 +0200 accel/ivpu: Remove unused PLL_CONFIG_DEFAULT This change removes the unnecessary condition, makes the code clearer, and silences clang-tidy warning. Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250808111044.328800-1-jacek.lawrynowicz@linux.intel.com commit 1141f2fa2089bce94a4ef6b8ac131b46167b41f9 Merge: b320789d6883cc ad38ea266b8dc6 Author: Arnd Bergmann Date: Mon Sep 1 12:13:10 2025 +0200 Merge tag 'renesas-arm-soc-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/arm Renesas ARM SoC updates for v6.18 - Use the SZ_256K definition. * tag 'renesas-arm-soc-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: rcar-gen2: Use SZ_256K definition Link: https://lore.kernel.org/r/cover.1756468045.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 70757ee5d2bc6da3a31dfbf808d534faa19178bd Author: Jihed Chaibi Date: Sat Aug 30 21:27:45 2025 +0200 ARM: defconfig: pxa: Remove duplicate CONFIG_USB_GPIO_VBUS entry The pxa_defconfig file defines CONFIG_USB_GPIO_VBUS twice, first as built-in ('y') and then as a module ('m'). The kconfig system correctly uses the last definition, but the duplication is confusing. Remove the obsolete configuration to resolve the ambiguity and clean up the configuration. Fixes: 2002f3968714 ("ARM: refresh defconfig files") Signed-off-by: Jihed Chaibi Signed-off-by: Arnd Bergmann commit c51f6fe14cd7e2e0a0e1094d38805dcbbd04a058 Author: Lukas Bulwahn Date: Tue Aug 26 08:32:48 2025 +0200 MAINTAINERS: adjust file entry in DRM ACCEL DRIVER FOR ROCKCHIP NPU Commit a7352c849492 ("dt-bindings: npu: rockchip,rknn: Add bindings") adds the device-tree binding rockchip,rk3588-rknn-core.yaml, whereas the commit ed98261b4168 ("accel/rocket: Add a new driver for Rockchip's NPU") adds the section DRM ACCEL DRIVER FOR ROCKCHIP NPU in MAINTAINERS with a file entry referring to rockchip,rknn-core.yaml. Note that the file entry is missing the part rk3588, compared to the added file above, which it intends to refer to. Adjust the file entry to the intended file name. Fixes: ed98261b4168 ("accel/rocket: Add a new driver for Rockchip's NPU") Signed-off-by: Lukas Bulwahn Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250826063248.32153-1-lukas.bulwahn@redhat.com commit d4c9ab287b38f0a4979abee0ae44bc9986296de7 Merge: b320789d6883cc abd7c0293816a5 Author: Arnd Bergmann Date: Mon Sep 1 12:11:28 2025 +0200 Merge tag 'renesas-arm-defconfig-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/defconfig Renesas ARM defconfig updates for v6.18 - Enable support for the Renesas RZ/T2H serial driver and the RZ/V2H(P) RSPI driver in the ARM64 defconfig. * tag 'renesas-arm-defconfig-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: defconfig: Enable the RZ/V2H(P) RSPI driver arm64: defconfig: Enable Renesas RZ/T2H serial SCI Link: https://lore.kernel.org/r/cover.1756468043.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 09e6d39cc83b18a17857b8d4d6a8902bc87dfbc2 Author: Dan Carpenter Date: Thu Aug 21 15:30:19 2025 +0300 accel/rocket: Fix some error checking in rocket_core_init() The problem is that pm_runtime_get_sync() can return 1 on success so checking for zero doesn't work. Use the pm_runtime_resume_and_get() function instead. The pm_runtime_resume_and_get() function does additional cleanup as well so that's a bonus as well. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Signed-off-by: Dan Carpenter Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/aKcRW6fsRP_o5C_y@stanley.mountain commit 78e399955d352a2387a4b22713385a0c5d737685 Author: Heiko Stuebner Date: Mon Aug 18 20:56:58 2025 +0200 accel/rocket: Check the correct DMA irq status to warn about Right now, the code checks the DMA_READ_ERROR state 2 times, while I guess it was supposed to warn about both read and write errors. Change the 2nd check to look at the write-error flag. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Signed-off-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250818185658.2585696-1-heiko@sntech.de commit ce6b656b5d64d612e9fc1c495eba6a362051c2ca Author: Brigham Campbell Date: Wed Aug 13 10:02:37 2025 -0600 accel/rocket: Fix usages of kfree() and sizeof() Replace usages of kfree() with kvfree() for pointers which were allocated using kvmalloc(), as required by the kernel memory management API. Use sizeof() on the type that a pointer references instead of the pointer itself. In this case, scheds and *scheds both happen to be pointers, so sizeof() will expand to the same value in either case, but using *scheds is more technically correct since scheds is an array of drm_gpu_scheduler *. Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202508120730.PLbjlKbI-lkp@intel.com/ Signed-off-by: Brigham Campbell Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250813-rocket-free-fix-v1-1-51f00a7a1271@brighamcampbell.com Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") commit 503b0ed38ca60cfb5ba101517a680beebd38d377 Author: Heiko Stuebner Date: Thu Aug 14 13:35:19 2025 +0200 accel/rocket: Depend on DRM_ACCEL not just DRM With the current dependency on only DRM, a config of CONFIG_DRM_ACCEL_ROCKET=y is possible, but of course wrong, because without DRM_ACCEL the build- system will never even enter drivers/accel/* . So depend on DRM_ACCEL instead of just DRM. Fixes: ed98261b4168 ("accel/rocket: Add a new driver for Rockchip's NPU") Signed-off-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250814113519.1551855-3-heiko@sntech.de commit c4d24127aaf1c50753c8bcdf050ed39b7c709869 Author: Heiko Stuebner Date: Thu Aug 14 13:35:18 2025 +0200 accel/rocket: Fix indentation of Kconfig entry The general indentation for the Kconfig lines is one tab, so adapt the lines accordingly. The description is correctly indented (1 tab + 2 spaces) so doesn't need changes. Fixes: ed98261b4168 ("accel/rocket: Add a new driver for Rockchip's NPU") Signed-off-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250814113519.1551855-2-heiko@sntech.de commit cc309f979394b5d98b12f7fb25c9219486a9733a Merge: fa93213f42494a 2da2740fb9c8e2 Author: Arnd Bergmann Date: Mon Sep 1 12:09:52 2025 +0200 Merge tag 'renesas-drivers-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.18 - Add syscon/regmap support to the RZ System Controller driver. * tag 'renesas-drivers-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: rz-sysc: Add syscon/regmap support Link: https://lore.kernel.org/r/cover.1756468046.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit fa93213f42494a191dd85bc18cfb5791d5fe5064 Merge: b320789d6883cc c30dcfd4b5a0f0 Author: Arnd Bergmann Date: Mon Sep 1 12:08:58 2025 +0200 Merge tag 'aspeed-6.18-drivers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers Early ASPEED driver updates for 6.18 Two small changes, the most interesting being the addition of the silicon IDs for ASPEED's AST2700 SoC family. * tag 'aspeed-6.18-drivers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: socinfo: Add AST27xx silicon IDs soc: aspeed: Use of_reserved_mem_region_to_resource() for "memory-region" Link: https://lore.kernel.org/r/2d122b5c4a19261148993b66e4b98371a684ba74.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit cea9c89d46c62b5fdc719c60bc7b2e3abd8c0153 Merge: 4e501327bf6888 dee546e1adefd7 Author: Arnd Bergmann Date: Mon Sep 1 12:02:02 2025 +0200 Merge tag 'sti-dt-for-v6.18-round1' of https://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti into soc/dt STi dt fixes: - Drop STiH407/10-B2120 DT boards and bindings. - Remove remaining STiH415/6 reference from STi machine. - Fix phy-names value for stih407-family.dtsi. * tag 'sti-dt-for-v6.18-round1' of https://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti: ARM: sti: drop B2120 board support ARM: sti: removal of stih415/stih416 related entries dt-bindings: arm: sti: drop B2120 board support ARM: dts: sti: rename SATA phy-names Link: https://lore.kernel.org/r/e4703e99-e44e-41d2-b744-a12ed4cb6692@foss.st.com Signed-off-by: Arnd Bergmann commit 4e501327bf68883e96a056abb71f9256e205b709 Merge: 58770c8759ce66 115b557b6f61ca Author: Arnd Bergmann Date: Mon Sep 1 12:00:46 2025 +0200 Merge tag 'renesas-dts-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.18 - Add initial support for the RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs and their evaluation boards, - Add SPI support for the RZ/V2H SoC, - Add DMAC and I3C support for the RZ/G3E SoC, - Add I3C support for the RZ/G3S SoCs, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.18-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (31 commits) arm64: dts: renesas: Minor whitespace cleanup arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1 arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1 arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Enable I2C0 and I2C1 support arm64: dts: renesas: r9a09g077: Add pinctrl node arm64: dts: renesas: r9a09g087: Add DT nodes for SCI channels 1-5 arm64: dts: renesas: r9a09g077: Add DT nodes for SCI channels 1-5 arm64: dts: renesas: r9a09g047: Add I3C node arm64: dts: renesas: r9a08g045: Add I3C node arm64: dts: renesas: sparrow-hawk: Update thermal trip points arm64: dts: renesas: rzg2: Increase CANFD clock rates arm64: dts: renesas: rcar-gen3: Increase CANFD clock rates ARM: dts: renesas: porter: Fix CAN pin group ARM: dts: renesas: r7s72100: Add boot phase tags arm64: dts: renesas: sparrow-hawk: Describe generic SPI NOR support arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 arm64: dts: renesas: r9a09g047: Add DMAC nodes arm64: dts: renesas: r9a09g057h48-kakip: Fix misplaced article arm64: dts: renesas: r9a09g087: Add SDHI nodes arm64: dts: renesas: r9a09g077: Add SDHI nodes ... Link: https://lore.kernel.org/r/cover.1756468048.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 58770c8759ce66d57957f4dc5b3b440a80f251ed Merge: 6c8903cf5f56d4 85ac6b80699320 Author: Arnd Bergmann Date: Mon Sep 1 11:57:26 2025 +0200 Merge tag 'ixp4xx-dts-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/dt IXP4xx DTS updates for v6.18: Add the Actiontec router MI424WR A/C and D device trees. Prerequisite DT bindings have been merged in networking and GPIO git trees: https://lore.kernel.org/netdev/175106401649.2079310.16035106613106076029.git-patchwork-notify@kernel.org/ https://lore.kernel.org/linux-gpio/175614780274.8817.4717113656972710108.b4-ty@linaro.org/ * tag 'ixp4xx-dts-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator: ARM: dts: Add ixp4xx Actiontec MI424WR device trees dt-bindings: arm: ixp4xx: List actiontec devices dt-bindings: Add Actiontec vendor prefix Link: https://lore.kernel.org/r/CACRpkdZoDCXgsTGzUUWABbp_r1Xjv7vp7_NjEnEWzMmDQG+UJQ@mail.gmail.com Signed-off-by: Arnd Bergmann commit d83f1d19c898ac1b54ae64d1c950f5beff801982 Author: Marek Vasut Date: Wed Aug 13 23:08:13 2025 +0200 drm/rcar-du: dsi: Fix 1/2/3 lane support Remove fixed PPI lane count setup. The R-Car DSI host is capable of operating in 1..4 DSI lane mode. Remove the hard-coded 4-lane configuration from PPI register settings and instead configure the PPI lane count according to lane count information already obtained by this driver instance. Configure TXSETR register to match PPI lane count. The R-Car V4H Reference Manual R19UH0186EJ0121 Rev.1.21 section 67.2.2.3 Tx Set Register (TXSETR), field LANECNT description indicates that the TXSETR register LANECNT bitfield lane count must be configured such, that it matches lane count configuration in PPISETR register DLEN bitfield. Make sure the LANECNT and DLEN bitfields are configured to match. Fixes: 155358310f01 ("drm: rcar-du: Add R-Car DSI driver") Cc: stable@vger.kernel.org Signed-off-by: Marek Vasut Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250813210840.97621-1-marek.vasut+renesas@mailbox.org Signed-off-by: Tomi Valkeinen commit 6c8903cf5f56d42edfb3eee72c177144485baca5 Merge: 1b8086f1729b8f 9c66753641765c Author: Arnd Bergmann Date: Mon Sep 1 11:56:43 2025 +0200 Merge tag 'ux500-dts-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-nomadik into soc/dt Ux500 DTS changes for v6.18 - Fix a GPIO hog name. - Move custom wakeup GPIO to a proper GPIO IRQ line rising edge wakeup. * tag 'ux500-dts-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-nomadik: ARM: dts: ste-ux500-samsung: dts bluetooth wakeup interrupt ARM: dts: st: ste-nomadik: Align GPIO hog name with bindings Link: https://lore.kernel.org/r/CACRpkdaGWVe7TNVz_L=gFh3AfzqnEq4rrOLo8x6gXUORA+MMpw@mail.gmail.com Signed-off-by: Arnd Bergmann commit 98da8a4aecf584af011cdc67d9581deb21088f24 Author: Li Jun Date: Tue Aug 19 18:40:38 2025 +0800 PM: hibernate: Fix typo in memory bitmaps description comment Correct 'leave' to 'leaf' in memory bitmaps description comment. Signed-off-by: Li Jun Link: https://patch.msgid.link/20250819104038.1596952-1-lijun01@kylinos.cn [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 5545d56fd1a9b1a3a0ac6b144afce5819f32a31b Author: Qianfeng Rong Date: Sun Aug 17 16:36:36 2025 +0800 PM: hibernate: Use vmalloc_array() and vcalloc() to improve code Remove array_size() calls and replace vmalloc() and vzalloc() with vmalloc_array() and vcalloc() respectively to simplify the code in save_compressed_image() and load_compressed_image(). vmalloc_array() is also optimized better, resulting in less instructions being used, and vmalloc_array() handling overhead is lower [1]. Link: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ [1] Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250817083636.53872-1-rongqianfeng@vivo.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 1b8086f1729b8f22e60ba93676602174a3b0a4fc Merge: 921e41c4465ebc 13587befb34ffa Author: Arnd Bergmann Date: Mon Sep 1 11:55:13 2025 +0200 Merge tag 'nuvoton-arm64-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt Early Nuvoton arm64 devicetree updates for 6.18 Integrate changes from Tomer reworking devicetree pinctrl, reset, and clk nodes for NPCM845-based platforms. * tag 'nuvoton-arm64-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm64: dts: nuvoton: add refclk and update peripheral clocks for NPCM845 arm64: dts: nuvoton: combine NPCM845 reset and clk nodes arm64: dts: nuvoton: npcm845: Add pinctrl groups Link: https://lore.kernel.org/r/bf3734aab62a5fcc8959261551bb4b1fa636efbd.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit 921e41c4465ebc1b658f1d883e8fa9e2bd09dfbe Merge: de0486b39ef479 7686b441c0ad92 Author: Arnd Bergmann Date: Mon Sep 1 11:53:41 2025 +0200 Merge tag 'nuvoton-arm-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt Early Nuvoton ARM devicetree updates for 6.18 So far we have just the one fix from Krzysztof that switches some nodes to use generic names, as recommended by the spec. * tag 'nuvoton-arm-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: nuvoton: Use generic "ethernet" as node name Link: https://lore.kernel.org/r/5e7e5d2cedb3bb232420ad720c857b95d8c02f21.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit de0486b39ef4792b0671042b4581bb7a9a6a247e Merge: c861d0b4fe4791 b785b5d88cc27a Author: Arnd Bergmann Date: Mon Sep 1 11:52:06 2025 +0200 Merge tag 'aspeed-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt Early ASPEED devicetree updates for 6.18 Notable changes: - Meta's Wedge400 and Fuji boards have had parallel devicetrees added for a transition to a new static flash layout. The original layout is deprecated and I anticipate removing related devicetrees in future releases. New platforms: - Darwin (Meta) Darwin is Meta's rack switch platform with an AST2600 BMC integrated for health monitoring purpose. Updates and fixes: - GB200NVL (Nvidia): Networking, I2C, regulators, GPIOs - Wedge400, Fuji (Meta): Fix warnings from devicetree bindings - Use fixed-layout for NVMEM on Asrock platforms - Various: minor fixes for warnings from FSI devicetree bindings * tag 'aspeed-6.18-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: (24 commits) ARM: dts: aspeed: x570d4u: convert NVMEM content to layout syntax ARM: dts: aspeed: romed8hm3: convert NVMEM content to layout syntax ARM: dts: aspeed: e3c256d4i: convert NVMEM content to layout syntax ARM: dts: aspeed: e3c246d4i: convert NVMEM content to layout syntax ARM: dts: aspeed: Add missing "ibm,spi-fsi" compatibles ARM: dts: aspeed: Drop "fsi-master" compatibles ARM: dts: aspeed: Drop "no-gpio-delays" ARM: dts: aspeed: Add Facebook Darwin (AST2600) BMC dt-bindings: arm: aspeed: add Facebook Darwin board ARM: dts: aspeed: facebook-fuji: Include facebook-fuji-data64.dts ARM: dts: aspeed: Add Facebook Fuji-data64 (AST2600) Board dt-bindings: arm: aspeed: add Facebook Fuji-data64 board ARM: dts: aspeed: wedge400: Include wedge400-data64.dts ARM: dts: aspeed: Add Facebook Wedge400-data64 (AST2500) BMC dt-bindings: arm: aspeed: add Facebook Wedge400-data64 board ARM: dts: aspeed: Add facebook-bmc-flash-layout-128-data64.dtsi ARM: dts: aspeed: Move eMMC out of ast2600-facebook-netbmc-common.dtsi ARM: dts: aspeed: Fix DTB warnings in ast2600-facebook-netbmc-common.dtsi ARM: dts: aspeed: fuji: Fix DTB warnings ARM: dts: aspeed: wedge400: Fix DTB warnings ... Link: https://lore.kernel.org/r/cb634cffaf0db9d25fb3062f0eee41e03955321f.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit c861d0b4fe4791a205c3f582e2ee7136247b2ab4 Merge: d407ad36dd3451 4379305ffbc2ee Author: Arnd Bergmann Date: Mon Sep 1 11:51:07 2025 +0200 Merge tag 'apple-soc-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt Apple SoC device tree changes for v6.18, part 1 - Added SMC nodes for M1 and M2 including the PMU GPIO controller and reboot sub-nodes. This now allows to reboot these systems and is required to later enable the power GPIO line for the WiFi board. - Added i2c nodes for A7 - A11 SoCs Signed-off-by: Sven Peter * tag 'apple-soc-dt-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: t600x: Add SMC node arm64: dts: apple: t8112: Add SMC node arm64: dts: apple: t8103: Add SMC node arm64: dts: apple: t8015: Add I2C nodes arm64: dts: apple: t8011: Add I2C nodes arm64: dts: apple: t8010: Add I2C nodes arm64: dts: apple: s8001: Add I2C nodes arm64: dts: apple: s800-0-3: Add I2C nodes arm64: dts: apple: t7001: Add I2C nodes arm64: dts: apple: t7000: Add I2C nodes arm64: dts: apple: s5l8960x: Add I2C nodes Link: https://lore.kernel.org/r/20250816171501.31944-1-sven@kernel.org Signed-off-by: Arnd Bergmann commit d407ad36dd3451220f318af28e4f5813943ad4ce Author: Krzysztof Kozlowski Date: Tue Aug 12 12:41:55 2025 +0200 Documentation/process: maintainer-soc: Use "DTS" instead of "devicetree" Devicetree is a data structure and it is a bit generic term, because some treat Devicetree bindings as Devicetree. What the SoC maintainers profile is mentioning in ABI stability are the Devicetree sources, so DTS files. It is also more common during reviews to refer to these as per "DTS" instead "devicetree". Clarify that by using "DTS" name in few more places. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250812104154.42289-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 1c936e85926dbd417f8ce4c290acee52d085fe0d Author: Javier Martinez Canillas Date: Fri Jul 18 17:25:25 2025 +0200 drm/sitronix/st7571-i2c: Make st7571_panel_data variables static const The kernel test robot reported that sparse gives the following warnings: make C=2 M=drivers/gpu/drm/sitronix/ CC [M] st7571-i2c.o CHECK st7571-i2c.c st7571-i2c.c:1027:26: warning: symbol 'st7567_config' was not declared. Should it be static? st7571-i2c.c:1039:26: warning: symbol 'st7571_config' was not declared. Should it be static? MODPOST Module.symvers LD [M] st7571-i2c.ko Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507180503.nfyD9uRv-lkp@intel.com Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250718152534.729770-1-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit db12ee08726e55c8a1a70c2308f98d121d96edc6 Author: Prathamesh Shete Date: Sat Aug 23 11:24:20 2025 +0530 gpio: tegra186: Add support for Tegra256 Extend the existing Tegra186 GPIO controller driver with support for the GPIO controller found on Tegra256. While the programming model remains the same, the number of pins has slightly changed. Signed-off-by: Prathamesh Shete Link: https://lore.kernel.org/r/20250823055420.24664-2-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski commit eef6dcbc52fa83c392a2f4a52845f347b233a584 Author: Prathamesh Shete Date: Sat Aug 23 11:24:19 2025 +0530 dt-bindings: gpio: Add Tegra256 support Extend the existing Tegra186 GPIO controller device tree bindings with support for the GPIO controller found on Tegra256. The number of pins is slightly different, but the programming model remains the same Add a new header, include/dt-bindings/gpio/tegra256-gpio.h, that defines port IDs as well as the TEGRA256_MAIN_GPIO() helper, both of which are used in conjunction to create a unique specifier for each pin. The OS can reconstruct the port ID and pin from these values to determine the register region for the corresponding GPIO. However, the OS does not use the macro definitions in this file. The symbolic names help associate these GPIO specifiers with the names used in the technical documentation available for the chip. Signed-off-by: Prathamesh Shete Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250823055420.24664-1-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski commit 5d5f08fd0cd970184376bee07d59f635c8403f63 Author: Miaoqian Lin Date: Fri Aug 29 16:30:15 2025 +0800 xtensa: simdisk: add input size check in proc_write_simdisk A malicious user could pass an arbitrarily bad value to memdup_user_nul(), potentially causing kernel crash. This follows the same pattern as commit ee76746387f6 ("netdevsim: prevent bad user input in nsim_dev_health_break_write()") Fixes: b6c7e873daf7 ("xtensa: ISS: add host file-based simulated disk") Fixes: 16e5c1fc3604 ("convert a bunch of open-coded instances of memdup_user_nul()") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Message-Id: <20250829083015.1992751-1-linmq006@gmail.com> Signed-off-by: Max Filippov commit 46104a7d3ccd2acfe508e661393add0615c27a22 Author: Kienan Stewart Date: Tue Feb 18 15:26:39 2025 -0500 kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b ("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts") artifacts required for building out-of-tree kernel modules had $(objtree) prepended to them to prepare for building in other directories. When building external modules for powerpc, arch/powerpc/lib/crtsavres.o is required for certain configurations. This artifact is missing the prepended $(objtree). Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=") Acked-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Signed-off-by: Kienan Stewart Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com commit 3d9c9e1da9886d91c24d97ca20c854c29212b736 Author: Ruben Wauters Date: Sat Jul 19 23:43:10 2025 +0100 powerpc/xmon: replace sizeof calculations with ARRAY_SIZE macro The calculations for operand/opcode/macro numbers are done in an identical manner to the already existing ARRAY_SIZE macro in linux/array_size.h This patch replaces the sizeof calculations with the macro to make the code cleaner and more immediately obvious what it is doing. Signed-off-by: Ruben Wauters Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250719225225.2132-2-rubenru09@aol.com commit a39087905af9ffecaa237a918a2c03a04e479934 Author: Nam Cao Date: Mon Aug 4 12:07:28 2025 +0200 powerpc/powernv/pci: Fix underflow and leak issue pnv_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed. The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken: - One interrupt is not be freed - If "i" is zero, "i - 1" wraps around Correct the number of freed interrupts to "i". Fixes: 0fcfe2247e75 ("powerpc/powernv/pci: Add MSI domains") Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/70f8debe8688e0b467367db769b71c20146a836d.1754300646.git.namcao@linutronix.de commit 3443ff3be6e59b80d74036bb39f5b6409eb23cc9 Author: Nam Cao Date: Mon Aug 4 12:07:27 2025 +0200 powerpc/pseries/msi: Fix potential underflow and leak issue pseries_irq_domain_alloc() allocates interrupts at parent's interrupt domain. If it fails in the progress, all allocated interrupts are freed. The number of successfully allocated interrupts so far is stored "i". However, "i - 1" interrupts are freed. This is broken: - One interrupt is not be freed - If "i" is zero, "i - 1" wraps around Correct the number of freed interrupts to 'i'. Fixes: a5f3d2c17b07 ("powerpc/pseries/pci: Add MSI domains") Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/a980067f2b256bf716b4cd713bc1095966eed8cd.1754300646.git.namcao@linutronix.de commit 4f61d54d2245c15b23ad78a89f854fb2496b6216 Author: Nysal Jan K.A. Date: Thu Jul 31 11:48:53 2025 +0530 powerpc/qspinlock: Add spinlock contention tracepoint Add a lock contention tracepoint in the queued spinlock slowpath. Also add the __lockfunc annotation so that in_lock_functions() works as expected. Signed-off-by: Nysal Jan K.A. Reviewed-by: Shrikanth Hegde Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250731061856.1858898-1-nysal@linux.ibm.com commit 74db6cc331b0da5c48c62b7af68d747ec9af1984 Author: Thomas Huth Date: Fri Aug 1 10:20:07 2025 +0200 powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembler code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This is bad since macros starting with two underscores are names that are reserved by the C language. It can also be very confusing for the developers when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is almost a completely mechanical patch (done with a simple "sed -i" statement), apart from tweaking two comments manually in arch/powerpc/include/asm/bug.h and arch/powerpc/include/asm/kasan.h (which did not have proper underscores at the end) and fixing a checkpatch error about spaces in arch/powerpc/include/asm/spu_csa.h. Signed-off-by: Thomas Huth Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250801082007.32904-3-thuth@redhat.com commit 8e0665eb85394ea9823fb965a73ae9a6265af4b0 Author: Thomas Huth Date: Fri Aug 1 10:20:06 2025 +0200 powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembler code. This is a completely mechanical patch (done with a simple "sed -i" statement). Acked-by: Segher Boessenkool Signed-off-by: Thomas Huth Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250801082007.32904-2-thuth@redhat.com commit 7287177e5abe2472c03f1c78099352c64d1b86fc Author: Maxime Ripard Date: Wed Aug 27 17:12:45 2025 +0200 drm/tidss: dispc: Define field masks being used Now that we have all the accessors taking masks, we can create defines for them and reuse them as needed. It makes the driver easier to read, less prone to consistency issues, and allows to reuse defines when needed. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-14-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 9b74ce7a691750b04ec7d2d7b08490134681c3eb Author: Maxime Ripard Date: Wed Aug 27 17:12:44 2025 +0200 drm/tidss: dispc: Switch OVR_REG_FLD_MOD to using a mask The OVR_REG_FLD_MOD function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change OVR_REG_FLD_MOD to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-13-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 68f7fa24776e2821896dd95ba0cf1a77a302575f Author: Maxime Ripard Date: Wed Aug 27 17:12:43 2025 +0200 drm/tidss: dispc: Switch VP_REG_FLD_MOD to using a mask The VP_REG_FLD_MOD function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change VP_REG_FLD_MOD to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-12-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit b695ff1e7ad418b7525f76fa442f8511ec12f6d9 Author: Maxime Ripard Date: Wed Aug 27 17:12:42 2025 +0200 drm/tidss: dispc: Switch VP_REG_GET to using a mask The VP_REG_GET function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change VP_REG_GET to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-11-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit aeaef1ba6bba76eb256123505bbc01032bfd5caa Author: Maxime Ripard Date: Wed Aug 27 17:12:41 2025 +0200 drm/tidss: dispc: Switch VID_REG_FLD_MOD to using a mask The VID_REG_FLD_MOD function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change VID_REG_FLD_MOD to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-10-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 990e6f28e78fc0a760fb2bd8575e3eaf5067306d Author: Maxime Ripard Date: Wed Aug 27 17:12:40 2025 +0200 drm/tidss: dispc: Switch VID_REG_GET to using a mask The VID_REG_GET function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change VID_REG_GET to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-9-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit e6b571e6ff6b46c5859ebd3364c98ccc4c90fbdb Author: Maxime Ripard Date: Wed Aug 27 17:12:39 2025 +0200 drm/tidss: dispc: Switch REG_FLD_MOD to using a mask The REG_FLD_MOD function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change REG_FLD_MOD to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-8-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 8bd839a3ec2305a2a29706dcbd27632b6d63d9ac Author: Maxime Ripard Date: Wed Aug 27 17:12:38 2025 +0200 drm/tidss: dispc: Switch REG_GET to using a mask The REG_GET function takes the start and end bits as parameter and will generate a mask out of them. This makes it difficult to share the masks between callers, since we now need two arguments and to keep them consistent. Let's change REG_GET to take the mask as an argument instead, and let the caller create the mask. Eventually, this mask will be moved to a define. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-7-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 13925ccb0d6de6e8a75928ea4ac74610c629093a Author: Maxime Ripard Date: Wed Aug 27 17:12:37 2025 +0200 drm/tidss: dispc: Get rid of FLD_MOD The FLD_MOD function is an equivalent to what FIELD_MODIFY + GENMASK provide, so let's drop it and switch to the latter. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-6-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 6e50765b829b68d34cbf45415173b1b1f429b233 Author: Maxime Ripard Date: Wed Aug 27 17:12:36 2025 +0200 drm/tidss: dispc: Get rid of FLD_GET The FLD_GET function is an equivalent to what FIELD_GET + GENMASK provide, so let's drop it and switch to the latter. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-5-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 9accc8b10de87a8989d382231d417827aca61c8f Author: Maxime Ripard Date: Wed Aug 27 17:12:35 2025 +0200 drm/tidss: dispc: Get rid of FLD_VAL The FLD_VAL function is an equivalent to what FIELD_PREP + GENMASK provide, so let's drop it and switch to the latter. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-4-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit db7c13ebf2d4570efcb8bed0d6e772d3805bbb45 Author: Maxime Ripard Date: Wed Aug 27 17:12:34 2025 +0200 drm/tidss: dispc: Switch to GENMASK instead of FLD_MASK The dispc FLD_MASK function is an exact equivalent of the GENMASK macro. Let's convert the dispc driver to the latter. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-3-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit e8e202bcbd06b9a199e431102af1a8ea2088f847 Author: Maxime Ripard Date: Wed Aug 27 17:12:33 2025 +0200 drm/tidss: dispc: Convert accessors to macros The dispc driver uses upper-cased, inlined, functions to provide macro-like accessors to the dispc registers. This is confusing, since upper-case is usually used by macros, and that pattern will create gcc errors later on in this series. Let's switch to macros to make it more consistent, and prevent those errors down the line. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-2-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit d42ce9ea571e528645fcab48a8ef7280331f5872 Author: Maxime Ripard Date: Wed Aug 27 17:12:32 2025 +0200 drm/tidss: dispc: Remove unused OVR_REG_GET The OVR_REG_GET function in the dispc driver is not used anywhere. Let's drop it. Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-1-7689b664cc63@kernel.org Signed-off-by: Tomi Valkeinen commit 73cfd166e045769a1b42d36897accaa6e06b8102 Author: Ruben Wauters Date: Mon Aug 18 20:35:26 2025 +0100 drm/gud: Replace simple display pipe with DRM atomic helpers The simple display pipe is obsolete and the atomic helpers allow for more control over the rendering process. As such, this patch replaces the old simple display pipe system with the newer atomic helpers. As the code is mainly the same, merely replaced with the new atomic system, there should be no change in functionality. Signed-off-by: Ruben Wauters Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250818193553.2162-1-rubenru09@aol.com commit d4ac729964d8967261fe15fdc8f249729f923120 Author: SeonGu Kang Date: Mon Sep 1 10:49:22 2025 +0530 pinctrl: samsung: Add ARTPEC-8 SoC specific configuration Add Axis ARTPEC-8 SoC specific configuration data to enable pinctrl. Signed-off-by: SeonGu Kang Signed-off-by: Priyadarsini G Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250901051926.59970-3-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 03724b3496cb0272a5050a989ebf2494b1ff5a55 Author: SeonGu Kang Date: Mon Sep 1 10:49:21 2025 +0530 dt-bindings: pinctrl: samsung: Add compatible for ARTPEC-8 SoC Document the compatible string for ARTPEC-8 SoC pinctrl block, which is similar to other Samsung SoC pinctrl blocks. Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250901051926.59970-2-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 592532a77b736b5153e0c2e4c74aa50af0a352ab Author: Dennis Beier Date: Sat Aug 30 16:43:59 2025 +0200 cpufreq/longhaul: handle NULL policy in longhaul_exit longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic. This patch adds a check using unlikely() and returns early if the policy is NULL. Bugzilla: #219962 Signed-off-by: Dennis Beier Signed-off-by: Viresh Kumar commit 256576ed6895b81290690ae3e2b9f62eb7c642fc Author: Pierre-Eric Pelloux-Prayer Date: Wed Jun 4 14:28:23 2025 +0200 drm/amdgpu: give each kernel job a unique id Userspace jobs have drm_file.client_id as a unique identifier as job's owners. For kernel jobs, we can allocate arbitrary values - the risk of overlap with userspace ids is small (given that it's a u64 value). In the unlikely case the overlap happens, it'll only impact trace events. Since this ID is traced in the gpu_scheduler trace events, this allows to determine the source of each job sent to the hardware. To make grepping easier, the IDs are defined as they will appear in the trace output. Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Alex Deucher Signed-off-by: Arunpravin Paneer Selvam Link: https://lore.kernel.org/r/20250604122827.2191-1-pierre-eric.pelloux-prayer@amd.com commit 35ded83be0d4a50719463e3fad7438e1339cce0c Author: Liao Yuanhong Date: Thu Aug 28 17:47:17 2025 +0800 wifi: rtw89: 8852bt: Remove redundant off_reverse variables The variable off_reverse and its related code are completely redundant in the function. Remove them to clean the code. Signed-off-by: Liao Yuanhong Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250828094717.599527-1-liaoyuanhong@vivo.com commit a650d86bcaf555f45019f38d5c1d996556141bbe Author: Qianfeng Rong Date: Wed Aug 27 23:06:19 2025 +0800 wifi: rtw89: use int type to store negative error codes The 'ret' variable stores returns from other functions, which return either zero on success or negative error codes on failure. Storing error codes in u32 (an unsigned type) causes no runtime issues but is stylistically inconsistent and very ugly. Change 'ret' from u32 to int - this has no runtime impact. Signed-off-by: Qianfeng Rong Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250827150620.550641-1-rongqianfeng@vivo.com commit e83a2a996b5cbf5398375d9b0b19d2b6bd27a18d Author: Ping-Ke Shih Date: Tue Aug 26 16:54:24 2025 +0800 wifi: rtw89: add getting function of DMA channel v1 The coming RTL8922DE uses new mapping of DMA channel. Add it accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085424.28713-1-pkshih@realtek.com commit 571ce803c28280921cfdbd7a6657d9404ff9ec25 Author: Ping-Ke Shih Date: Tue Aug 26 16:53:39 2025 +0800 wifi: rtw89: abstract getting function of DMA channel The mapping function from QSEL (almost equivalent EDCA queue) to PCI DMA channel. Since coming chips change the definition, abstract this function as a chip_ops. Don't change logic at all. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085339.28512-1-pkshih@realtek.com commit 110f3c11f440d78ef8a181f75456e24e428f69e4 Author: Ping-Ke Shih Date: Tue Aug 26 16:53:32 2025 +0800 wifi: rtw89: pci: add RPP parser v1 The new format contains more information including TX DMA channel, actual TX link and etc. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085332.28463-1-pkshih@realtek.com commit 83d823ab27da7030d25001b7e293059112ee7734 Author: Ping-Ke Shih Date: Tue Aug 26 16:53:24 2025 +0800 wifi: rtw89: pci: abstract RPP parser RPP is short for release report of payload, which carries information assisting TX completion. Since coming chips change the format, abstract the parser ahead. Don't change logic at all. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085324.28414-1-pkshih@realtek.com commit 2d7514829950d6e4ab2fe7b855f21546b3420450 Author: Ping-Ke Shih Date: Tue Aug 26 16:53:18 2025 +0800 wifi: rtw89: pci: add group BD address design The newly designed group BD address is to use the same starting DMA address with offset as below picture: Original DMA memory Group BD address +--------+ (*1) +---------+ (*2) +--------+ | CH 0 -|-------> | | <-------|- CH 0 | <-+--+--+--+ +--------+ | | | | | | | | | CH 1 -|-------> | | | CH 1 -|---+ | | | +--------+ | | | | | | | | CH 2 -|-------> | | | CH 2 -|------+ | | +--------+ | | | | | | | CH 3 -|-------> | | | CH 3 -|---------+ | +--------+ | | | | | | : -|-------> | | | : -|------------+ +--------+ | | +--------+ (*3; offset from CH 0) | CH 8 -|-------> | | <-------|- CH 8 | <-+ +--------+ | | | | | (offset from CH 8) | : -|-------> | | | : -|---+ +--------+ +---------+ +--------+ Compare (*1) and (*2), for original design, each DMA channel has individual DMA address, so it is not necessary to allocate continual DMA address across channels. For group BD address, only two DMA address are set, and each channel set the offset (*3) from base address. The element number and offset of a channel are encoded rather than a raw number, so add a function to translate numbers into hardware format. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085318.28361-1-pkshih@realtek.com commit a86a0fea192cf735c1693cef566d5bb8dc2b49fc Author: Ping-Ke Shih Date: Tue Aug 26 16:52:58 2025 +0800 wifi: rtw89: pci: define TX/RX buffer descriptor pool Buffer descriptor (BD) is a helper of DMA for each ring. The new hardware design expects a continual memory across all rings, so allocate a pool and assign to each ring rather than allocate a buffer for a ring individually. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085258.28308-1-pkshih@realtek.com commit 7bd90ec75e76c60a00fa6f2e6949a2ac4da14e1f Author: Ping-Ke Shih Date: Tue Aug 26 16:51:46 2025 +0800 wifi: rtw89: pci: add struct rtw89_{tx,rx}_rings to put related fields The new hardware design will expect a continual memory region across all rings, so a new field will be added to describe the region. To help the changes, add struct and make changes ahead. Don't change logic at all. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085152.28164-5-pkshih@realtek.com commit d6303028ae55b116c33227a595034b6d55df96c4 Author: Ping-Ke Shih Date: Tue Aug 26 16:51:45 2025 +0800 wifi: rtw89: pci: use RDU status of R_BE_PCIE_DMA_IMR_0_V1 instead for 8922DE The original RDU status of R_BE_HAXI_HIMR00 needs additional IO to get the status. The new WiFi 7 8922DE add the status to R_BE_PCIE_DMA_IMR_0_V1 which is read already, so we can reduce one reading IO. After the changes, interrupt behavior of RTL8922DE in low power mode is the same as normal mode, so remove the configuration function for low power mode. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085152.28164-4-pkshih@realtek.com commit 862132fbfc898ee720b0c431846442961f6b3f64 Author: Ping-Ke Shih Date: Tue Aug 26 16:51:44 2025 +0800 wifi: rtw89: pci: prepare interrupt related registers and functions for 8922DE The 8922DE is very similar to 8922AE except to RDU (RX desc unavailable) registers. The following patch will adjust to read this status from another register to reduce one reading IO, so create a set of functions ahead. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085152.28164-3-pkshih@realtek.com commit 5cc73513f9b2cb9d0c0273ca4256656c8c479318 Author: Ping-Ke Shih Date: Tue Aug 26 16:51:43 2025 +0800 wifi: rtw89: pci: move chip ISR definition out from chip generation The existing WiFi 6 chips can share the same ISR (interrupt status registers), but the coming WiFi 7 chip 8922DE can't share the same definition with existing WiFi 7 chip, so move the definition to an individual struct. Don't change logic at all. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250826085152.28164-2-pkshih@realtek.com commit f46edd92040f2687aa80fe986f1dd214be2b4950 Author: Aleksej Smirnov Date: Fri Aug 22 12:46:24 2025 +0300 wifi: rtl8xxxu: Remove TL-WN722N V2 (0x2357: 0x010c) from untested devices This Wi-Fi dongle has been used for many years now and have had no problems with it. The device is quite old and known, dumping its efuse to the log and asking the user to send the results to Jes.Sorensen@gmail.com on every boot makes little sense. Signed-off-by: Aleksej Smirnov Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/CAAN7eZ7QKEeQgNHEBuZKy4Gqg3oqpGi6BUdOVBOxPN7dedhVJQ@mail.gmail.com commit 18b07c44f245beb03588b00b212b38fce9af7cc9 Author: Viacheslav Dubeyko Date: Fri Aug 15 12:49:19 2025 -0700 hfs: clear offset and space out of valid records in b-tree node Currently, hfs_brec_remove() executes moving records towards the location of deleted record and it updates offsets of moved records. However, the hfs_brec_remove() logic ignores the "mess" of b-tree node's free space and it doesn't touch the offsets out of records number. Potentially, it could confuse fsck or driver logic or to be a reason of potential corruption cases. This patch reworks the logic of hfs_brec_remove() by means of clearing freed space of b-tree node after the records moving. And it clear the last offset that keeping old location of free space because now the offset before this one is keeping the actual offset to the free space after the record deletion. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250815194918.38165-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit a06ec283e125e334155fe13005c76c9f484ce759 Author: Viacheslav Dubeyko Date: Tue Jun 10 16:16:09 2025 -0700 hfs: add logic of correcting a next unused CNID The generic/736 xfstest fails for HFS case: BEGIN TEST default (1 test): hfs Mon May 5 03:18:32 UTC 2025 DEVICE: /dev/vdb HFS_MKFS_OPTIONS: MOUNT_OPTIONS: MOUNT_OPTIONS FSTYP -- hfs PLATFORM -- Linux/x86_64 kvm-xfstests 6.15.0-rc4-xfstests-g00b827f0cffa #1 SMP PREEMPT_DYNAMIC Fri May 25 MKFS_OPTIONS -- /dev/vdc MOUNT_OPTIONS -- /dev/vdc /vdc generic/736 [03:18:33][ 3.510255] run fstests generic/736 at 2025-05-05 03:18:33 _check_generic_filesystem: filesystem on /dev/vdb is inconsistent (see /results/hfs/results-default/generic/736.full for details) Ran: generic/736 Failures: generic/736 Failed 1 of 1 tests The HFS volume becomes corrupted after the test run: sudo fsck.hfs -d /dev/loop50 ** /dev/loop50 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking HFS volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking catalog hierarchy. ** Checking volume bitmap. ** Checking volume information. invalid MDB drNxtCNID Master Directory Block needs minor repair (1, 0) Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000 CBTStat = 0x0000 CatStat = 0x00000000 ** Repairing volume. ** Rechecking volume. ** Checking HFS volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking catalog hierarchy. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled was repaired successfully. The main reason of the issue is the absence of logic that corrects mdb->drNxtCNID/HFS_SB(sb)->next_id (next unused CNID) after deleting a record in Catalog File. This patch introduces a hfs_correct_next_unused_CNID() method that implements the necessary logic. In the case of Catalog File's record delete operation, the function logic checks that (deleted_CNID + 1) == next_unused_CNID and it finds/sets the new value of next_unused_CNID. sudo ./check generic/736 FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0+ #6 SMP PREEMPT_DYNAMIC Tue Jun 10 15:02:48 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/736 33s Ran: generic/736 Passed all 1 tests sudo fsck.hfs -d /dev/loop50 ** /dev/loop50 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking HFS volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking catalog hierarchy. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled appears to be OK Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250610231609.551930-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 9b3d15a758910bb98ba8feb4109d99cc67450ee4 Author: Viacheslav Dubeyko Date: Mon Aug 25 15:51:04 2025 -0700 hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() The syzbot reported issue in hfsplus_delete_cat(): [ 70.682285][ T9333] ===================================================== [ 70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220 [ 70.683640][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.684141][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.684621][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.685048][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.685447][ T9333] do_rmdir+0x964/0xea0 [ 70.685833][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.686260][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.686695][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.687119][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.687646][ T9333] [ 70.687856][ T9333] Uninit was stored to memory at: [ 70.688311][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.688779][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.689231][ T9333] hfsplus_mknod+0x27f/0x600 [ 70.689730][ T9333] hfsplus_mkdir+0x5a/0x70 [ 70.690146][ T9333] vfs_mkdir+0x483/0x7a0 [ 70.690545][ T9333] do_mkdirat+0x3f2/0xd30 [ 70.690944][ T9333] __x64_sys_mkdir+0x9a/0xf0 [ 70.691380][ T9333] x64_sys_call+0x2f89/0x3cf0 [ 70.691816][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.692229][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.692773][ T9333] [ 70.692990][ T9333] Uninit was stored to memory at: [ 70.693469][ T9333] hfsplus_subfolders_inc+0x1c2/0x1d0 [ 70.693960][ T9333] hfsplus_create_cat+0x148e/0x1800 [ 70.694438][ T9333] hfsplus_fill_super+0x21c1/0x2700 [ 70.694911][ T9333] mount_bdev+0x37b/0x530 [ 70.695320][ T9333] hfsplus_mount+0x4d/0x60 [ 70.695729][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.696167][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.696588][ T9333] do_new_mount+0x73e/0x1630 [ 70.697013][ T9333] path_mount+0x6e3/0x1eb0 [ 70.697425][ T9333] __se_sys_mount+0x733/0x830 [ 70.697857][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.698269][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.698704][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.699117][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.699730][ T9333] [ 70.699946][ T9333] Uninit was created at: [ 70.700378][ T9333] __alloc_pages_noprof+0x714/0xe60 [ 70.700843][ T9333] alloc_pages_mpol_noprof+0x2a2/0x9b0 [ 70.701331][ T9333] alloc_pages_noprof+0xf8/0x1f0 [ 70.701774][ T9333] allocate_slab+0x30e/0x1390 [ 70.702194][ T9333] ___slab_alloc+0x1049/0x33a0 [ 70.702635][ T9333] kmem_cache_alloc_lru_noprof+0x5ce/0xb20 [ 70.703153][ T9333] hfsplus_alloc_inode+0x5a/0xd0 [ 70.703598][ T9333] alloc_inode+0x82/0x490 [ 70.703984][ T9333] iget_locked+0x22e/0x1320 [ 70.704428][ T9333] hfsplus_iget+0x5c/0xba0 [ 70.704827][ T9333] hfsplus_btree_open+0x135/0x1dd0 [ 70.705291][ T9333] hfsplus_fill_super+0x1132/0x2700 [ 70.705776][ T9333] mount_bdev+0x37b/0x530 [ 70.706171][ T9333] hfsplus_mount+0x4d/0x60 [ 70.706579][ T9333] legacy_get_tree+0x113/0x2c0 [ 70.707019][ T9333] vfs_get_tree+0xb3/0x5c0 [ 70.707444][ T9333] do_new_mount+0x73e/0x1630 [ 70.707865][ T9333] path_mount+0x6e3/0x1eb0 [ 70.708270][ T9333] __se_sys_mount+0x733/0x830 [ 70.708711][ T9333] __x64_sys_mount+0xe4/0x150 [ 70.709158][ T9333] x64_sys_call+0x2691/0x3cf0 [ 70.709630][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.710053][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.710611][ T9333] [ 70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17 [ 70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.712490][ T9333] ===================================================== [ 70.713085][ T9333] Disabling lock debugging due to kernel taint [ 70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ... [ 70.714159][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Tainted: G B 6.12.0-rc6-dirty #17 [ 70.715007][ T9333] Tainted: [B]=BAD_PAGE [ 70.715365][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.716311][ T9333] Call Trace: [ 70.716621][ T9333] [ 70.716899][ T9333] dump_stack_lvl+0x1fd/0x2b0 [ 70.717350][ T9333] dump_stack+0x1e/0x30 [ 70.717743][ T9333] panic+0x502/0xca0 [ 70.718116][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.718611][ T9333] kmsan_report+0x296/0x2a0 [ 70.719038][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.719859][ T9333] ? __msan_warning+0x96/0x120 [ 70.720345][ T9333] ? hfsplus_subfolders_dec+0x1d7/0x220 [ 70.720881][ T9333] ? hfsplus_delete_cat+0x105d/0x12b0 [ 70.721412][ T9333] ? hfsplus_rmdir+0x13d/0x310 [ 70.721880][ T9333] ? vfs_rmdir+0x5ba/0x810 [ 70.722458][ T9333] ? do_rmdir+0x964/0xea0 [ 70.722883][ T9333] ? __x64_sys_rmdir+0x71/0xb0 [ 70.723397][ T9333] ? x64_sys_call+0xcd8/0x3cf0 [ 70.723915][ T9333] ? do_syscall_64+0xd9/0x1d0 [ 70.724454][ T9333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.725110][ T9333] ? vprintk_emit+0xd1f/0xe60 [ 70.725616][ T9333] ? vprintk_default+0x3f/0x50 [ 70.726175][ T9333] ? vprintk+0xce/0xd0 [ 70.726628][ T9333] ? _printk+0x17e/0x1b0 [ 70.727129][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.727739][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.728324][ T9333] __msan_warning+0x96/0x120 [ 70.728854][ T9333] hfsplus_subfolders_dec+0x1d7/0x220 [ 70.729479][ T9333] hfsplus_delete_cat+0x105d/0x12b0 [ 70.729984][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.730646][ T9333] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.731296][ T9333] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.731863][ T9333] hfsplus_rmdir+0x13d/0x310 [ 70.732390][ T9333] ? __pfx_hfsplus_rmdir+0x10/0x10 [ 70.732919][ T9333] vfs_rmdir+0x5ba/0x810 [ 70.733416][ T9333] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.734044][ T9333] do_rmdir+0x964/0xea0 [ 70.734537][ T9333] __x64_sys_rmdir+0x71/0xb0 [ 70.735032][ T9333] x64_sys_call+0xcd8/0x3cf0 [ 70.735579][ T9333] do_syscall_64+0xd9/0x1d0 [ 70.736092][ T9333] ? irqentry_exit+0x16/0x60 [ 70.736637][ T9333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.737269][ T9333] RIP: 0033:0x7fa9424eafc9 [ 70.737775][ T9333] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.739844][ T9333] RSP: 002b:00007fff099cd8d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000054 [ 70.740760][ T9333] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa9424eafc9 [ 70.741642][ T9333] RDX: 006c6f72746e6f63 RSI: 000000000000000a RDI: 0000000020000100 [ 70.742543][ T9333] RBP: 00007fff099cd8e0 R08: 00007fff099cd910 R09: 00007fff099cd910 [ 70.743376][ T9333] R10: 0000000000000000 R11: 0000000000000202 R12: 0000565430642260 [ 70.744247][ T9333] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.745082][ T9333] The main reason of the issue that struct hfsplus_inode_info has not been properly initialized for the case of root folder. In the case of root folder, hfsplus_fill_super() calls the hfsplus_iget() that implements only partial initialization of struct hfsplus_inode_info and subfolders field is not initialized by hfsplus_iget() logic. This patch implements complete initialization of struct hfsplus_inode_info in the hfsplus_iget() logic with the goal to prevent likewise issues for the case of root folder. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=fdedff847a0e5e84c39f Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250825225103.326401-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd Author: Viacheslav Dubeyko Date: Wed Aug 20 16:06:38 2025 -0700 hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() The syzbot reported issue in hfs_find_set_zero_bits(): ===================================================== BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151 hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408 hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353 __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151 block_write_begin fs/buffer.c:2262 [inline] cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 cont_expand_zero fs/buffer.c:2528 [inline] cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591 hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52 hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494 hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654 notify_change+0x1993/0x1aa0 fs/attr.c:552 do_truncate+0x28f/0x310 fs/open.c:68 do_ftruncate+0x698/0x730 fs/open.c:195 do_sys_ftruncate fs/open.c:210 [inline] __do_sys_ftruncate fs/open.c:215 [inline] __se_sys_ftruncate fs/open.c:213 [inline] __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213 x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354 kmalloc_noprof include/linux/slab.h:905 [inline] hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175 hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337 get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681 get_tree_bdev+0x38/0x50 fs/super.c:1704 hfs_get_tree+0x35/0x40 fs/hfs/super.c:388 vfs_get_tree+0xb0/0x5c0 fs/super.c:1804 do_new_mount+0x738/0x1610 fs/namespace.c:3902 path_mount+0x6db/0x1e90 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427 x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 ===================================================== The HFS_SB(sb)->bitmap buffer is allocated in hfs_mdb_get(): HFS_SB(sb)->bitmap = kmalloc(8192, GFP_KERNEL); Finally, it can trigger the reported issue because kmalloc() doesn't clear the allocated memory. If allocated memory contains only zeros, then everything will work pretty fine. But if the allocated memory contains the "garbage", then it can affect the bitmap operations and it triggers the reported issue. This patch simply exchanges the kmalloc() on kzalloc() with the goal to guarantee the correctness of bitmap operations. Because, newly created allocation bitmap should have all available blocks free. Potentially, initialization bitmap's read operation could not fill the whole allocated memory and "garbage" in the not initialized memory will be the reason of volume coruptions and file system driver bugs. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=773fa9d79b29bd8b6831 Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250820230636.179085-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit c62663a986acee7c4485c1fa9de5fc40194b6290 Author: Viacheslav Dubeyko Date: Mon Aug 18 15:52:52 2025 -0700 hfs: make proper initalization of struct hfs_find_data Potenatially, __hfs_ext_read_extent() could operate by not initialized values of fd->key after hfs_brec_find() call: static inline int __hfs_ext_read_extent(struct hfs_find_data *fd, struct hfs_extent *extent, u32 cnid, u32 block, u8 type) { int res; hfs_ext_build_key(fd->search_key, cnid, block, type); fd->key->ext.FNum = 0; res = hfs_brec_find(fd); if (res && res != -ENOENT) return res; if (fd->key->ext.FNum != fd->search_key->ext.FNum || fd->key->ext.FkType != fd->search_key->ext.FkType) return -ENOENT; if (fd->entrylength != sizeof(hfs_extent_rec)) return -EIO; hfs_bnode_read(fd->bnode, extent, fd->entryoffset, sizeof(hfs_extent_rec)); return 0; } This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250818225252.126427-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 4840ceadef4290c56cc422f0fc697655f3cbf070 Author: Viacheslav Dubeyko Date: Mon Aug 18 15:52:32 2025 -0700 hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() The syzbot reported issue in __hfsplus_ext_cache_extent(): [ 70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195022][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195530][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.195998][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.196458][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.196959][ T9350] cont_write_begin+0x1000/0x1950 [ 70.197416][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.197873][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.198374][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.198892][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.199393][ T9350] vfs_write+0xb0f/0x14e0 [ 70.199771][ T9350] ksys_write+0x23e/0x490 [ 70.200149][ T9350] __x64_sys_write+0x97/0xf0 [ 70.200570][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.201065][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.201506][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.202054][ T9350] [ 70.202279][ T9350] Uninit was created at: [ 70.202693][ T9350] __kmalloc_noprof+0x621/0xf80 [ 70.203149][ T9350] hfsplus_find_init+0x8d/0x1d0 [ 70.203602][ T9350] hfsplus_file_extend+0x6ca/0x1cf0 [ 70.204087][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.204561][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.205074][ T9350] cont_write_begin+0x1000/0x1950 [ 70.205547][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.206017][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.206519][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.207042][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.207552][ T9350] vfs_write+0xb0f/0x14e0 [ 70.207961][ T9350] ksys_write+0x23e/0x490 [ 70.208375][ T9350] __x64_sys_write+0x97/0xf0 [ 70.208810][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.209255][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.209680][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.210230][ T9350] [ 70.210454][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Not tainted 6.12.0-rc5 #5 [ 70.211174][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.212115][ T9350] ===================================================== [ 70.212734][ T9350] Disabling lock debugging due to kernel taint [ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic set ... [ 70.213858][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Tainted: G B 6.12.0-rc5 #5 [ 70.214679][ T9350] Tainted: [B]=BAD_PAGE [ 70.215057][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.215999][ T9350] Call Trace: [ 70.216309][ T9350] [ 70.216585][ T9350] dump_stack_lvl+0x1fd/0x2b0 [ 70.217025][ T9350] dump_stack+0x1e/0x30 [ 70.217421][ T9350] panic+0x502/0xca0 [ 70.217803][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.218294][ Message fromT sy9350] kmsan_report+0x296/slogd@syzkaller 0x2aat Aug 18 22:11:058 ... kernel :[ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic [ 70.220179][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 set ... [ 70.221254][ T9350] ? __msan_warning+0x96/0x120 [ 70.222066][ T9350] ? __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.223023][ T9350] ? hfsplus_file_extend+0x74f/0x1cf0 [ 70.224120][ T9350] ? hfsplus_get_block+0xe16/0x17b0 [ 70.224946][ T9350] ? __block_write_begin_int+0x962/0x2ce0 [ 70.225756][ T9350] ? cont_write_begin+0x1000/0x1950 [ 70.226337][ T9350] ? hfsplus_write_begin+0x85/0x130 [ 70.226852][ T9350] ? generic_perform_write+0x3e8/0x1060 [ 70.227405][ T9350] ? __generic_file_write_iter+0x215/0x460 [ 70.227979][ T9350] ? generic_file_write_iter+0x109/0x5e0 [ 70.228540][ T9350] ? vfs_write+0xb0f/0x14e0 [ 70.228997][ T9350] ? ksys_write+0x23e/0x490 [ 70.229458][ T9350] ? __x64_sys_write+0x97/0xf0 [ 70.229939][ T9350] ? x64_sys_call+0x3015/0x3cf0 [ 70.230432][ T9350] ? do_syscall_64+0xd9/0x1d0 [ 70.230941][ T9350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.231926][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.232738][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.233711][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.234516][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.235398][ T9350] ? __msan_metadata_ptr_for_load_4+0x24/0x40 [ 70.236323][ T9350] ? hfsplus_brec_find+0x218/0x9f0 [ 70.237090][ T9350] ? __pfx_hfs_find_rec_by_key+0x10/0x10 [ 70.237938][ T9350] ? __msan_instrument_asm_store+0xbf/0xf0 [ 70.238827][ T9350] ? __msan_metadata_ptr_for_store_4+0x27/0x40 [ 70.239772][ T9350] ? __hfsplus_ext_write_extent+0x536/0x620 [ 70.240666][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.241175][ T9350] __msan_warning+0x96/0x120 [ 70.241645][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.242223][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.242748][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.243255][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.243878][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 [ 70.244400][ T9350] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 70.244967][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.245531][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.246079][ T9350] cont_write_begin+0x1000/0x1950 [ 70.246598][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.247105][ T9350] ? __pfx_hfsplus_get_block+0x10/0x10 [ 70.247650][ T9350] ? __pfx_hfsplus_write_begin+0x10/0x10 [ 70.248211][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.248752][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.249314][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.249856][ T9350] ? kmsan_internal_set_shadow_origin+0x77/0x110 [ 70.250487][ T9350] vfs_write+0xb0f/0x14e0 [ 70.250930][ T9350] ? __pfx_generic_file_write_iter+0x10/0x10 [ 70.251530][ T9350] ksys_write+0x23e/0x490 [ 70.251974][ T9350] __x64_sys_write+0x97/0xf0 [ 70.252450][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.252924][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.253384][ T9350] ? irqentry_exit+0x16/0x60 [ 70.253844][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.254430][ T9350] RIP: 0033:0x7f7a92adffc9 [ 70.254873][ T9350] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 70.256674][ T9350] RSP: 002b:00007fff0bca3188 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 70.257485][ T9350] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a92adffc9 [ 70.258246][ T9350] RDX: 000000000208e24b RSI: 0000000020000100 RDI: 0000000000000004 [ 70.258998][ T9350] RBP: 00007fff0bca31a0 R08: 00007fff0bca31a0 R09: 00007fff0bca31a0 [ 70.259769][ T9350] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e0d75f8250 [ 70.260520][ T9350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.261286][ T9350] [ 70.262026][ T9350] Kernel Offset: disabled (gdb) l *__hfsplus_ext_cache_extent+0x7d0 0xffffffff8318aef0 is in __hfsplus_ext_cache_extent (fs/hfsplus/extents.c:168). 163 fd->key->ext.cnid = 0; 164 res = hfs_brec_find(fd, hfs_find_rec_by_key); 165 if (res && res != -ENOENT) 166 return res; 167 if (fd->key->ext.cnid != fd->search_key->ext.cnid || 168 fd->key->ext.fork_type != fd->search_key->ext.fork_type) 169 return -ENOENT; 170 if (fd->entrylength != sizeof(hfsplus_extent_rec)) 171 return -EIO; 172 hfs_bnode_read(fd->bnode, extent, fd->entryoffset, The __hfsplus_ext_cache_extent() calls __hfsplus_ext_read_extent(): res = __hfsplus_ext_read_extent(fd, hip->cached_extents, inode->i_ino, block, HFSPLUS_IS_RSRC(inode) ? HFSPLUS_TYPE_RSRC : HFSPLUS_TYPE_DATA); And if inode->i_ino could be equal to zero or any non-available CNID, then hfs_brec_find() could not find the record in the tree. As a result, fd->key could be compared with fd->search_key. But hfsplus_find_init() uses kmalloc() for fd->key and fd->search_key allocation: int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) { ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); if (!ptr) return -ENOMEM; fd->search_key = ptr; fd->key = ptr + tree->max_key_len + 2; } Finally, fd->key is still not initialized if hfs_brec_find() has found nothing. This patch changes kmalloc() on kzalloc() in hfs_find_init() and intializes fd->record, fd->keyoffset, fd->keylength, fd->entryoffset, fd->entrylength for the case if hfs_brec_find() has been found nothing in the b-tree node. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=55ad87f38795d6787521 Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250818225232.126402-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 738d5a51864ed8d7a68600b8c0c63fe6fe5c4f20 Author: Yang Chenzhi Date: Mon Aug 18 22:17:34 2025 +0800 hfs: validate record offset in hfsplus_bmap_alloc hfsplus_bmap_alloc can trigger a crash if a record offset or length is larger than node_size [ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] [ 15.266169] dump_stack_lvl+0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [ 15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225] __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238] __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270] hfsplus_write_begin+0x51/0x100 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289] __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_signal_or_restart+0x89/0x580 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [ 15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] When calling hfsplus_bmap_alloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfs_brec_lenoff ``` len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep); ``` However, if the retrieved offset or length is invalid(i.e. exceeds node_size), the code may end up accessing pages outside the allocated range for this node. This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move is_bnode_offset_valid and check_and_correct_requested_length to hfsplus_fs.h, as they may be required by other functions. Reported-by: syzbot+356aed408415a56543cd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67bcb4a6.050a0220.bbfd1.008f.GAE@google.com/ Signed-off-by: Yang Chenzhi Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250818141734.8559-2-yang.chenzhi@vivo.com Signed-off-by: Viacheslav Dubeyko commit 9282bc905f0949fab8cf86c0f620ca988761254c Author: Yangtao Li Date: Tue Aug 5 10:58:59 2025 -0600 hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() If Catalog File contains corrupted record for the case of hidden directory's type, regard it as I/O error instead of Invalid argument. Signed-off-by: Yangtao Li Reviewed-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250805165905.3390154-1-frank.li@vivo.com Signed-off-by: Viacheslav Dubeyko commit 44fd3e4fc9cdd49c0db170459c3eed9977aae9e7 Author: Yangtao Li Date: Tue Jul 29 10:01:57 2025 -0600 MAINTAINERS: update location of hfs&hfsplus trees Update it at MAINTAINERS file. Signed-off-by: Yangtao Li Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250729160158.2157843-1-frank.li@vivo.com Signed-off-by: Viacheslav Dubeyko commit c822f58a4fab25944ba66768c1d6c563aa6ac077 Author: Neeraj Upadhyay Date: Thu Aug 28 16:32:40 2025 +0530 x86/apic: Populate .read()/.write() callbacks of Secure AVIC driver Add read() and write() APIC callback functions to read and write the x2APIC registers directly from the guest APIC backing page of a vCPU. The x2APIC registers are mapped at an offset within the guest APIC backing page which is the same as their x2APIC MMIO offset. Secure AVIC adds new registers such as ALLOWED_IRRs (which are at 4-byte offset within the IRR register offset range) and NMI_REQ to the APIC register space. When Secure AVIC is enabled, accessing the guest's APIC registers through RD/WRMSR results in a #VC exception (for non-accelerated register accesses) with error code VMEXIT_AVIC_NOACCEL. The #VC exception handler can read/write the x2APIC register in the guest APIC backing page to complete the RDMSR/WRMSR. Since doing this would increase the latency of accessing the x2APIC registers, instead of doing RDMSR/WRMSR based register accesses and handling reads/writes in the #VC exception, directly read/write the APIC registers from/to the guest APIC backing page of the vCPU in read() and write() callbacks of the Secure AVIC APIC driver. [ bp: Massage commit message. ] Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828110255.208779-1-Neeraj.Upadhyay@amd.com commit b8c3c9f5d0505905e21c03731d1665c67053b47e Author: Neeraj Upadhyay Date: Thu Aug 28 12:33:18 2025 +0530 x86/apic: Initialize Secure AVIC APIC backing page With Secure AVIC, the APIC backing page is owned and managed by the guest. Allocate and initialize APIC backing page for all guest CPUs. The NPT entry for a vCPU's APIC backing page must always be present when the vCPU is running in order for Secure AVIC to function. A VMEXIT_BUSY is returned on VMRUN and the vCPU cannot be resumed otherwise. To handle this, notify GPA of the vCPU's APIC backing page to the hypervisor by using the SVM_VMGEXIT_SECURE_AVIC GHCB protocol event. Before executing VMRUN, the hypervisor makes use of this information to make sure the APIC backing page is mapped in the NPT. [ bp: Massage commit message. ] Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828070334.208401-3-Neeraj.Upadhyay@amd.com commit 273be31e5afd31f9de7ca8e5ec5acf1290da90c7 Author: Janne Grunau Date: Sat Aug 23 11:49:48 2025 +0200 arm64: dts: apple: Add devicetreee for t8112-j415 The 15-inch M2 MacBook Air was released a year after the 13-inch one thus missed in initial submission of devicetrees for M2 based devices. It is currently a copy of t8112-j413 with edited identifiers but will eventually differ in a meaningful way. It has for example a different speaker configuration than the 13-inch model. Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-5-6dc0daeb4786@jannau.net Signed-off-by: Sven Peter commit efad8eaf6f2f00460a2227c618ebb7c8e0dca201 Author: Janne Grunau Date: Sat Aug 23 11:49:47 2025 +0200 dt-bindings: arm: apple: Add t8112 j415 compatible This adds the "apple,j415" (MacBook Air (15-inch, M2, 2023) to the apple,t8112 platform. Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Janne Grunau Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-4-6dc0daeb4786@jannau.net Signed-off-by: Sven Peter commit c34e2ec6a84ea3f7a01d8fcd3073f858c4f47605 Author: Hector Martin Date: Sat Aug 23 11:49:46 2025 +0200 arm64: dts: apple: t600x: Add bluetooth device nodes Add bluetooth PCIe device nodes to specify per device brcm,board-type and provide the bootloader filled "local-bd-address" and calibration data. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-3-6dc0daeb4786@jannau.net Signed-off-by: Sven Peter commit 3050713d84f58d2e4ba463c5474092fa6738c527 Author: Hector Martin Date: Sat Aug 23 11:49:45 2025 +0200 arm64: dts: apple: t600x: Add missing WiFi properties Add compatible and antenna-sku properties to the shared node and brcm,board-type property to individuall board device trees. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-2-6dc0daeb4786@jannau.net Signed-off-by: Sven Peter commit 6e08cdd604edcec2c277af17c7d36caf827057ff Author: Janne Grunau Date: Sat Aug 23 11:49:44 2025 +0200 arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused and disabled. Linux' PCI subsystem assigns the ethernet nic from `port02` to bus 02. This results into assigning `pcie0_dart_1` from the disabled port as iommu. The `pcie0_dart_1` instance is disabled and probably fused off (it is on the M2 Pro Mac mini which has a disabled PCIe port as well). Without iommu the ethernet nic is not expected work. Adjusts the "bus-range" and the PCIe devices "reg" property to PCI subsystem's bus number. Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net Signed-off-by: Sven Peter commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 Author: Michael Hennerich Date: Fri Aug 29 12:25:43 2025 +0100 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly. Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers") Signed-off-by: Michael Hennerich Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20250829-adf4350-fix-v2-2-0bf543ba797d@analog.com Cc: Signed-off-by: Jonathan Cameron commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d Author: Michael Hennerich Date: Fri Aug 29 12:25:42 2025 +0100 iio: frequency: adf4350: Fix prescaler usage. The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. When set to 4/5, the maximum RF frequency allowed is 3 GHz. Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. In this context not the RF output frequency is meant - it's the VCO frequency. Therefore move the prescaler selection after we derived the VCO frequency from the desired RF output frequency. This BUG may have caused PLL lock instabilities when operating the VCO at the very high range close to 4.4 GHz. Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers") Signed-off-by: Michael Hennerich Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250829-adf4350-fix-v2-1-0bf543ba797d@analog.com Cc: Signed-off-by: Jonathan Cameron commit ea0484e4b82b3496310a94684dfad5e61421f633 Author: Ravi Patel Date: Mon Aug 25 17:14:32 2025 +0530 dt-bindings: arm: Convert Axis board/soc bindings to json-schema Convert Axis SoC bindings to DT schema format using json-schema. Existing bindings supports ARTPEC-6 SoC and board. Signed-off-by: SungMin Park Signed-off-by: SeonGu Kang Reviewed-by: Rob Herring (Arm) Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250825114436.46882-7-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit bd5336e3f7040f300b01702215b45e6267a400cc Author: Hakyeong Kim Date: Mon Aug 25 17:14:29 2025 +0530 clk: samsung: artpec-8: Add initial clock support for ARTPEC-8 SoC Add initial clock support for Axis ARTPEC-8 SoC which is required for enabling basic clock management. Add clock support for below CMU (Clock Management Unit) blocks in ARTPEC-8 SoC: - CMU_CMU - CMU_BUS - CMU_CORE - CMU_CPUCL - CMU_FSYS - CMU_IMEM - CMU_PERI Signed-off-by: Hakyeong Kim Signed-off-by: Varada Pavani Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250825114436.46882-4-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 80770fccb7f60b0bc795852c154273e511f296a0 Author: Hakyeong Kim Date: Mon Aug 25 17:14:28 2025 +0530 clk: samsung: Add clock PLL support for ARTPEC-8 SoC Add below clock PLL support for Axis ARTPEC-8 SoC platform: - pll_1017x: Integer PLL with mid frequency FVCO (950 to 2400 MHz) This is used in ARTPEC-8 SoC for shared PLL - pll_1031x: Integer/Fractional PLL with mid frequency FVCO (600 to 1200 MHz) This is used in ARTPEC-8 SoC for Audio PLL FOUT calculation for pll_1017x and pll_1031x: FOUT = (MDIV x FIN)/(PDIV x 2^SDIV) for integer PLL FOUT = (((MDIV + KDIV)/65536) x FIN)/(PDIV x 2^SDIV) for fractional PLL Signed-off-by: Hakyeong Kim Signed-off-by: SeonGu Kang Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250825114436.46882-3-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit aac0892caecc753e9dceca2722d58778eff0cfb0 Merge: 8c82bb53669b1e 91f98de42310c7 Author: Krzysztof Kozlowski Date: Sun Aug 31 15:22:23 2025 +0200 Merge branch 'for-v6.18/dt-bindings-clk' into next/clk commit 91f98de42310c70f9a23595b3b20aa305717d955 Author: Hakyeong Kim Date: Mon Aug 25 17:14:27 2025 +0530 dt-bindings: clock: Add ARTPEC-8 clock controller Add dt-schema for Axis ARTPEC-8 SoC clock controller. The Clock Management Unit (CMU) has a top-level block CMU_CMU which generates clocks for other blocks. Add device-tree binding definitions for following CMU blocks: - CMU_CMU - CMU_BUS - CMU_CORE - CMU_CPUCL - CMU_FSYS - CMU_IMEM - CMU_PERI Signed-off-by: Hakyeong Kim Signed-off-by: SeonGu Kang Reviewed-by: Rob Herring (Arm) Signed-off-by: Ravi Patel Link: https://lore.kernel.org/r/20250825114436.46882-2-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 2ca33c502b630a748f91a59b5ebb5cda6d9fc8b9 Author: Ioana Risteiu Date: Tue Aug 26 01:13:51 2025 +0300 iio: adc: extract setup function without backend Refactor probe function by moving the initialization specific to communication without iio-backend into a separate setup function. The purpose of this modification is better code organization. No functional changes intended. Reviewed-by: Andy Shevchenko Signed-off-by: Ioana Risteiu Link: https://patch.msgid.link/20250825221355.6214-4-Ioana.Risteiu@analog.com Signed-off-by: Jonathan Cameron commit a9ee71011a5347dd77887e2c5c2f87f01acd3efb Author: Ioana Risteiu Date: Tue Aug 26 01:13:50 2025 +0300 dt-bindings: iio: adc: add IIO backend support Add the generic io-backends property to the AD7779 binding to enable support for the IIO backend framework. Also add the adi,num-lanes property to set the number of lanes used by AD7779. Reviewed-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ioana Risteiu Link: https://patch.msgid.link/20250825221355.6214-3-Ioana.Risteiu@analog.com Signed-off-by: Jonathan Cameron commit d54d99d034093fd3a357593d9757584868537748 Author: Ioana Risteiu Date: Tue Aug 26 01:13:49 2025 +0300 iio: adc: adi-axi-adc: add axi_adc_num_lanes_set Assign num_lanes_set in the adi_axi_adc_ops to axi_adc_num_lanes_set() to support setting number of lanes used by AXI ADC. This operation is included in the generic structure because the number of lanes is a configurable parameter of the generic AXI ADC IP core, not specific to a device. Reviewed-by: Andy Shevchenko Signed-off-by: Ioana Risteiu Link: https://patch.msgid.link/20250825221355.6214-2-Ioana.Risteiu@analog.com Signed-off-by: Jonathan Cameron commit 25fb0ea986dc10e05f3f4b43cabde4d1853a1fd7 Author: Christophe JAILLET Date: Thu Aug 21 12:02:21 2025 +0200 w1: matrox: Remove some deadcode in matrox_w1_remove() The .remove function can only be called if the .probe() succeeds. So there is no need to keep track of a successful probe in 'found'. Simplify code accordingly. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/458641ad2d7a7adf30a03e70038304f0e6a81ff4.1755770484.git.christophe.jaillet@wanadoo.fr Signed-off-by: Krzysztof Kozlowski commit 9b273ee9c084a7db2978e2101bbb6fc163701c85 Author: Miri Korenblit Date: Thu Aug 28 11:26:01 2025 +0300 wifi: iwlwifi: don't support WH a step This is no longer supported. Fail the probe if such an HW is detected. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.8d484f21a237.I16a30af0b4b964339bd60c3bed854d1028c1fff8@changeid commit 8cab67474b97e613767618a081982da4bab2434d Author: Miri Korenblit Date: Thu Aug 28 11:26:00 2025 +0300 wifi: iwlwifi: mld: remove a TODO This was already done. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.c445b2fc8bce.Ic616d605a4d6f82122466f50022cd046d229de4e@changeid commit 187b114a2ab3d6d83792c659ca3998454446f44e Author: Miri Korenblit Date: Thu Aug 28 11:25:59 2025 +0300 wifi: iwlwifi: carefully select the PNVM source For newer device, and from API 100 (core 97), the PNVM should be taken from the .ucode file, and not from an external .pnvm file. In the current logic, if the PNVM doesn't exist in the .ucode file, we fallback to fetching the .ucode file. This is wrong and hides bugs. This fallback was needed for (a) old devices and (b) for newer devices with an old API. Since we no longer support those old APIs, (b) is not longer relevant. We can, according to the device, select the right PNVM source and fail if we couldn't find the PNVM there. Add clear logic to select the expected PNVM source, and print an error if we couldn't get the PNVM from there. Reviewed-by: Johannes Berg Reviewed-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.7e75d33e3c28.I87fbcd25bbee733d2612206b76c2d8593d0cbd39@changeid commit 0755db9f2605e8dfc24857cf5ac1d9a8d4e91fc5 Author: Miri Korenblit Date: Thu Aug 28 11:25:58 2025 +0300 wifi: iwlwifi: mld: make iwl_mld_rm_vif void Unlike adding/allocating an object, destroying it should always succeed. In addition, the return value of iwl_mld_rm_vif is not even used. Make it a void function. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.418e898e908d.I18cc8d6b55a4e468dd155a40089ebea7de70594c@changeid commit 1a33efe4fc64b8135fe94e22299761cc69333404 Author: Miri Korenblit Date: Thu Aug 28 11:25:57 2025 +0300 wifi: iwlwifi: pcie: remember when interrupts are disabled trans_pcie::fh_mask and hw_mask indicates what are the interrupts are currently enabled (unmasked). When we disable all interrupts, those should be set to 0, so if, for some reason, we get an interrupt even though it was disabled, we will know to ignore. Reviewed-by: Yedidya Ben Shimol Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.e293d6a8385b.I919375e5ad7bd7e4fee4a95ce6ce6978653d6b16@changeid commit 40f6e94d873fe29bd5d987f53772eb8d968b8103 Author: Miri Korenblit Date: Thu Aug 28 11:25:56 2025 +0300 wifi: iwlwifi: mld: support TLC command version 5 A new version of the TLC command was added in order to support the new MCSs intoduced in UHR, and an indication of ELR support. To support the new MCSs, the new version will have MCS bitmaps (ht_rates) of 32 bit and not 16 bit, as in the old version. Change the code to populate the new version of the command, and if the FW requires the old version, copy the content of the new version structure to the old version structure. Note that this doesn't actually set the new MCSs, this will come later. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.032a450cc279.Iecf6570c9fe11d8fbdc0718341ac92506b02d78c@changeid commit df70a9a86eee0d10fdb3fe02099176b5c75e4559 Author: Miri Korenblit Date: Thu Aug 28 11:25:55 2025 +0300 wifi: iwlwifi: gen1_2: move gen specific code to a function The remove function will be called also for gen3 devices, so move out the gen1_2 code to a function that will be called only for gen1/2 devices. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.a584254bcf83.I69d176b94d23f0f34d28733c48964f277a0a67a1@changeid commit 6f2d548e0da60bc414d115f459c0fb2145462f62 Author: Miri Korenblit Date: Thu Aug 28 11:25:54 2025 +0300 wifi: iwlwifi: gen1_2: rename iwl_trans_pcie_op_mode_enter As a new version of this will be added for gen3, rename to iwl_pcie_gen1_2_op_mode_enter to distinguish between the different versions. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.64b3f290c397.I3ae2ca53330a8543bcbac32880824683f919ac74@changeid commit aa9b9865a5534c08ae913fe6621bded5af3c65a6 Author: Miri Korenblit Date: Thu Aug 28 11:25:53 2025 +0300 wifi: iwlwifi: really remove hw_wfpm_id This was meant to be removed, but seems it was re-added to the info structure eventually. Anyway, it is not set or used so remove it. Reviewed-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.78e84f722963.I1bc574a315cd5a587439974ee250887954589321@changeid commit c40e28c47fc4e55e5f523f295f7096e5d9428608 Author: Miri Korenblit Date: Thu Aug 28 11:25:52 2025 +0300 wifi: iwlwifi: remove unneeded jacket indication This is only needed for internal builds. Don't read it. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.13a01468449c.Iab8255539567a82f0b9e0d1b269fababa2e72e61@changeid commit 815cc0c75950d26347d3c7fbeb856251a5bcd0c0 Author: Miri Korenblit Date: Thu Aug 28 11:25:51 2025 +0300 wifi: iwlwifi: don't publish TWT capabilities Due to the echosystem readiness this is not supported for now. Don't publish the capability. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828082601.537908-2-miriam.rachel.korenblit@intel.com commit 35adaa67354ad7aa588acff9594d261dd3304346 Author: Miri Korenblit Date: Thu Aug 28 11:25:50 2025 +0300 wifi: iwlwifi: trans: move dev_cmd_pool to trans specific This pool has different parameters for different devices, move it to the generation specific transport sub-layer. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.faf685de7aa2.I83e31e36d3159aa5c7e6f82a773d9981d3aac70d@changeid commit c8166b218540359146cd2b0ad150fa7e652cb304 Author: Miri Korenblit Date: Thu Aug 28 11:25:49 2025 +0300 wifi: iwlwifi: remove .pnvm files from module info For BZ/GF and SC/GF, we no longer have a .pnvm file, don't declare those Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.74f7fdba4ff6.Ia5e2123471df1fdc3688d8687a8e437388412206@changeid commit 1160c99ed93188a2b47636db0fd5093d189588f1 Author: Johannes Berg Date: Thu Aug 28 11:25:48 2025 +0300 wifi: iwlwifi: acpi: make iwl_guid static This variable is now only used in the same file, so there's no need to expose it. Make it static. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.83ec118cd1fb.I50c8e86fb786488f97e1ff2e115c4166c6b9bee1@changeid commit f53f2bd8fc5f7d986b676a3f80505ba4d6b0b311 Author: Johannes Berg Date: Thu Aug 28 11:25:47 2025 +0300 wifi: iwlwifi: uefi: remove runtime check of constant values There's no need to check an ARRAY_SIZE() at runtime, it's already determined at build time, so could be a BUILD_BUG_ON. However it's not that useful here since the array is defined using UEFI_MAX_DSM_FUNCS, check DSM_FUNC_NUM_FUNCS instead to ensure the array cannot be accessed out-of-band, i.e. ensure the range check there is always good enough. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828111032.cc3c17327ea2.I99c7175be1f72f29b154454fc24978daafad476f@changeid commit a29bf0b10a1a7f51afb91c1ff9edd73b0ca1fd18 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:20 2025 +0200 arm64: dts: socionext: uniphier-pxs3: Add default PCI interrup controller address cells Add missing address-cells 0 to the PCI interrupt node to silence W=1 warning: uniphier-pxs3.dtsi:915.4-918.29: Warning (interrupt_map): /soc@0/pcie@66000000:interrupt-map: Missing property '#address-cells' in node /soc@0/pcie@66000000/legacy-interrupt-controller, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Reviewed-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20250822133318.312232-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 613fb0c8bd49df4fb28bca89aa5363856487096f Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:19 2025 +0200 arm64: dts: socionext: uniphier-ld20: Add default PCI interrup controller address cells Add missing address-cells 0 to the PCI interrupt node to silence W=1 warning: uniphier-ld20.dtsi:941.4-944.29: Warning (interrupt_map): /soc@0/pcie@66000000:interrupt-map: Missing property '#address-cells' in node /soc@0/pcie@66000000/legacy-interrupt-controller, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Reviewed-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20250822133318.312232-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 59abe5c87267f1f3bd627af20355b490b59f9901 Author: Krzysztof Kozlowski Date: Sat Aug 30 11:39:19 2025 +0200 arm64: dts: exynos2200: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node. Value '0' is correct because GIC interrupt controller does not have children. Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250830093918.24619-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 8c82bb53669b1e82435b5a00a170b7c079940b82 Author: Denzeel Oliva Date: Sat Aug 30 16:28:42 2025 +0000 clk: samsung: exynos990: Add DPU_BUS and CMUREF mux/div and update CLKS_NR_TOP Add DPU_BUS and CMUREF mux/div, wire their registers and parents, and update CLKS_NR_TOP. These use the new IDs appended to the bindings to avoid ABI changes. Signed-off-by: Denzeel Oliva Link: https://lore.kernel.org/r/20250830-fix-cmu-top-v5-5-7c62f608309e@gmail.com Signed-off-by: Krzysztof Kozlowski commit 76f1e2ee545b3165e1e24293b59414699118266a Author: Denzeel Oliva Date: Sat Aug 30 16:28:41 2025 +0000 dt-bindings: clock: exynos990: Extend clocks IDs Add missing clock definitions for DPU and CMUREF. Acked-by: Rob Herring (Arm) Signed-off-by: Denzeel Oliva Link: https://lore.kernel.org/r/20250830-fix-cmu-top-v5-4-7c62f608309e@gmail.com Signed-off-by: Krzysztof Kozlowski commit a66dabcd2cb8389fd73cab8896fd727fa2ea8d8b Author: Denzeel Oliva Date: Sat Aug 30 16:28:40 2025 +0000 clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks HSI1/2 PCIe and HSI0 USBDP debug outputs are fixed divide-by-8. OTP also uses 1/8 from oscclk. Replace incorrect div clocks with fixed-factor clocks to reflect hardware. Fixes: bdd03ebf721f ("clk: samsung: Introduce Exynos990 clock controller driver") Signed-off-by: Denzeel Oliva Cc: Link: https://lore.kernel.org/r/20250830-fix-cmu-top-v5-3-7c62f608309e@gmail.com Signed-off-by: Krzysztof Kozlowski commit ce2eb09b430ddf9d7c9d685bdd81de011bccd4ad Author: Denzeel Oliva Date: Sat Aug 30 16:28:39 2025 +0000 clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths Correct several mux/div widths (DSP_BUS, G2D_MSCL, HSI0 USBDP_DEBUG, HSI1 UFS_EMBD, APM_BUS, CPUCL0_DBG_BUS, DPU) to match hardware. Fixes: bdd03ebf721f ("clk: samsung: Introduce Exynos990 clock controller driver") Signed-off-by: Denzeel Oliva Cc: Link: https://lore.kernel.org/r/20250830-fix-cmu-top-v5-2-7c62f608309e@gmail.com Signed-off-by: Krzysztof Kozlowski commit 19b50ab02eddbbd87ec2f0ad4a5bc93ac1c9b82d Author: Denzeel Oliva Date: Sat Aug 30 16:28:38 2025 +0000 clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes Parent select bits for shared PLLs are in PLL_CON0, not PLL_CON3. Using the wrong register leads to incorrect parent selection and rates. Fixes: bdd03ebf721f ("clk: samsung: Introduce Exynos990 clock controller driver") Signed-off-by: Denzeel Oliva Cc: Link: https://lore.kernel.org/r/20250830-fix-cmu-top-v5-1-7c62f608309e@gmail.com Signed-off-by: Krzysztof Kozlowski commit e349241b97a8b1169a4e90375159df4d22061f9a Author: Ard Biesheuvel Date: Thu Aug 28 12:22:07 2025 +0200 x86/sev: Run RMPADJUST on SVSM calling area page to test VMPL Determining the VMPL at which the kernel runs involves performing a RMPADJUST operation on an arbitrary page of memory, and observing whether it succeeds. The use of boot_ghcb_page in the core kernel in this case is completely arbitrary, but results in the need to provide a PIC alias for it. So use boot_svsm_ca_page instead, which already needs this alias for other reasons. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250828102202.1849035-28-ardb+git@google.com commit 7cb7b6de9cb90311a917d65c0228b6aa223dc456 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:06 2025 +0200 x86/sev: Use MSR protocol only for early SVSM PVALIDATE call The early page state change API performs an SVSM call to PVALIDATE each page when running under a SVSM, and this involves either a GHCB page based call or a call based on the MSR protocol. The GHCB page based variant involves VA to PA translation of the GHCB address, and this is best avoided in the startup code, where virtual addresses are ambiguous (1:1 or kernel virtual). As this is the last remaining occurrence of svsm_perform_call_protocol() in the startup code, switch to the MSR protocol exclusively in this particular case, so that the GHCB based plumbing can be moved out of the startup code entirely in a subsequent patch. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250828102202.1849035-27-ardb+git@google.com commit c15a4705d59caeb44f4c373cf04e89041309e568 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:05 2025 +0200 x86/sev: Use MSR protocol for remapping SVSM calling area As the preceding code comment already indicates, remapping the SVSM calling area occurs long before the GHCB page is configured, and so calling svsm_perform_call_protocol() is guaranteed to result in a call to svsm_perform_msr_protocol(). So just call the latter directly. This allows most of the GHCB based API infrastructure to be moved out of the startup code in a subsequent patch. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250828102202.1849035-26-ardb+git@google.com commit 603957ae903e81fb80d3788297c0f58a68802dfc Author: Laurent Pinchart Date: Mon Jun 16 04:11:14 2025 +0300 media: rkisp1: Add support for multiple power domains The ISP instances in the NXP i.MX8MP need two power domains. While single power domains are managed automatically by the device core, support for multiple power domains requires manually attaching to the power domains. Do so based on platform data. Link: https://lore.kernel.org/r/20250616011115.19515-6-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit cb149f7f178b5bd1f1aa254f59553711aa21d8ed Author: Laurent Pinchart Date: Mon Jun 16 04:11:13 2025 +0300 media: rkisp1: Acquire pclk clock on i.MX8MP The ISP instances in the NXP i.MX8MP need the input pixel clock to be enabled in order to access the HDR stitching registers. The clock should ideally be mandatory, but that would break backward compatibility with old DT. Try to acquire it as an optional clock instead. Link: https://lore.kernel.org/r/20250616011115.19515-5-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d91da25f2547efd8c21d2c88a31a15c1e47d6d33 Author: Laurent Pinchart Date: Mon Jun 16 04:11:12 2025 +0300 media: rkisp1: Refactor clocks initialization ISP instances in different SoCs differ in the number of clocks they use, but not in the clock names. Refactor clocks initialization to avoid duplicating the clock names per platform, and lower the total number of clocks from 8 to 4 as no platform uses more than 4 clocks. Use a static assert to ensure at build time that the size of the arrays match. Link: https://lore.kernel.org/r/20250616011115.19515-4-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 4435a7a3fc283011a7b3e9c3b157aac8384333bd Author: Laurent Pinchart Date: Mon Jun 16 04:11:11 2025 +0300 dt-bindings: media: rkisp1: Add second power domain on i.MX8MP In the NXP i.MX8MP, the pclk clock required by the ISP is gated by the MIPI CSI-2 power domain. Add it to the power-domains property, and require specifying power-domain-names accordingly. Link: https://lore.kernel.org/r/20250616011115.19515-3-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Hans Verkuil commit acfaba169385bfa243a10a027f8272a974b2288a Author: Laurent Pinchart Date: Mon Jun 16 04:11:10 2025 +0300 dt-bindings: media: rkisp1: Require pclk clock on i.MX8MP variant The ISP integrated in the NXP i.MX8MP requires the pclk clock to access the HDR stitching registers. Make it mandatory in the DT binding. Link: https://lore.kernel.org/r/20250616011115.19515-2-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Hans Verkuil commit aec0f43f1429641e8a94d54aaecd16527b589486 Author: Laurent Pinchart Date: Thu Aug 21 16:51:23 2025 +0300 media: nxp: imx8-isi: m2m: Delay power up until streamon There's no need to power up the device when userspace opens it. Delay the operation until streamon. Link: https://lore.kernel.org/r/20250821135123.29462-2-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Guoniu Zhou Tested-by: Guoniu Zhou Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 178aa3360220231dd91e7dbc2eb984525886c9c1 Author: Guoniu Zhou Date: Thu Aug 21 16:51:22 2025 +0300 media: nxp: imx8-isi: m2m: Fix streaming cleanup on release If streamon/streamoff calls are imbalanced, such as when exiting an application with Ctrl+C when streaming, the m2m usage_count will never reach zero and the ISI channel won't be freed. Besides from that, if the input line width is more than 2K, it will trigger a WARN_ON(): [ 59.222120] ------------[ cut here ]------------ [ 59.226758] WARNING: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:631 at mxc_isi_channel_chain+0xa4/0x120, CPU#4: v4l2-ctl/654 [ 59.238569] Modules linked in: ap1302 [ 59.242231] CPU: 4 UID: 0 PID: 654 Comm: v4l2-ctl Not tainted 6.16.0-rc4-next-20250704-06511-gff0e002d480a-dirty #258 PREEMPT [ 59.253597] Hardware name: NXP i.MX95 15X15 board (DT) [ 59.258720] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 59.265669] pc : mxc_isi_channel_chain+0xa4/0x120 [ 59.270358] lr : mxc_isi_channel_chain+0x44/0x120 [ 59.275047] sp : ffff8000848c3b40 [ 59.278348] x29: ffff8000848c3b40 x28: ffff0000859b4c98 x27: ffff800081939f00 [ 59.285472] x26: 000000000000000a x25: ffff0000859b4cb8 x24: 0000000000000001 [ 59.292597] x23: ffff0000816f4760 x22: ffff0000816f4258 x21: ffff000084ceb780 [ 59.299720] x20: ffff000084342ff8 x19: ffff000084340000 x18: 0000000000000000 [ 59.306845] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffdb369e1c [ 59.313969] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 59.321093] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 59.328217] x8 : ffff8000848c3d48 x7 : ffff800081930b30 x6 : ffff800081930b30 [ 59.335340] x5 : ffff0000859b6000 x4 : ffff80008193ae80 x3 : ffff800081022420 [ 59.342464] x2 : ffff0000852f6900 x1 : 0000000000000001 x0 : ffff000084341000 [ 59.349590] Call trace: [ 59.352025] mxc_isi_channel_chain+0xa4/0x120 (P) [ 59.356722] mxc_isi_m2m_streamon+0x160/0x20c [ 59.361072] v4l_streamon+0x24/0x30 [ 59.364556] __video_do_ioctl+0x40c/0x4a0 [ 59.368560] video_usercopy+0x2bc/0x690 [ 59.372382] video_ioctl2+0x18/0x24 [ 59.375857] v4l2_ioctl+0x40/0x60 [ 59.379168] __arm64_sys_ioctl+0xac/0x104 [ 59.383172] invoke_syscall+0x48/0x104 [ 59.386916] el0_svc_common.constprop.0+0xc0/0xe0 [ 59.391613] do_el0_svc+0x1c/0x28 [ 59.394915] el0_svc+0x34/0xf4 [ 59.397966] el0t_64_sync_handler+0xa0/0xe4 [ 59.402143] el0t_64_sync+0x198/0x19c [ 59.405801] ---[ end trace 0000000000000000 ]--- Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the v4l2_m2m_ioctl_streamon() and v4l2_m2m_ioctl_streamoff() helpers. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250821135123.29462-1-laurent.pinchart@ideasonboard.com Signed-off-by: Guoniu Zhou Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Tested-by: Guoniu Zhou Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 45854b1e5967b2640792d8249dd73a1163a75039 Author: Guoniu Zhou Date: Fri Aug 15 17:28:51 2025 +0800 media: nxp: imx8-isi: Add suspend/resume support for ISI mem2mem Add suspend/resume support for ISI when work at memory to memory mode. Link: https://lore.kernel.org/r/20250815-isi_m2m-v2-1-32e3720880cc@nxp.com Signed-off-by: Guoniu Zhou Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9a21ffeade25cbf310f5db39a1f9932695dd41bb Author: Laurent Pinchart Date: Thu Aug 14 01:55:01 2025 +0300 media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() The bypass argument to the mxc_isi_channel_chain() function is unused. Drop it. Link: https://lore.kernel.org/r/20250813225501.20762-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 15b5936343099dbf8c31c3c0c9fcd898fd503694 Author: Laurent Pinchart Date: Thu Aug 14 00:24:51 2025 +0300 media: nxp: imx8-isi: Drop mxc_isi_video.is_streaming field The mxc_isi_video.is_streaming field is used to track the streaming status of the video device. The same information is also tracked by the videobuf2 queue. Drop the is_streaming field, and check the queue streaming status instead. Link: https://lore.kernel.org/r/20250813212451.22140-3-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Tested-by: Richard Leitner # i.MX8MP Signed-off-by: Hans Verkuil commit 47773031a148ad7973b809cc7723cba77eda2b42 Author: Richard Leitner Date: Thu Aug 14 00:24:50 2025 +0300 media: nxp: imx8-isi: Fix streaming cleanup on release The current implementation unconditionally calls mxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can lead to situations where any release call (like from a simple "v4l2-ctl -l") may release a currently streaming queue when called on such a device. This is reproducible on an i.MX8MP board by streaming from an ISI capture device using gstreamer: gst-launch-1.0 -v v4l2src device=/dev/videoX ! \ video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \ fakesink While this stream is running, querying the caps of the same device provokes the error state: v4l2-ctl -l -d /dev/videoX This results in the following trace: [ 155.452152] ------------[ cut here ]------------ [ 155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6 [ 157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT [ 157.064369] Hardware name: imx8mp_board_01 (DT) [ 157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi] [ 157.087126] sp : ffff800080003ee0 [ 157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000 [ 157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50 [ 157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000 [ 157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000 [ 157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000 [ 157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38 [ 157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000 [ 157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000 [ 157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200 [ 157.161850] Call trace: [ 157.164296] mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P) [ 157.170319] __handle_irq_event_percpu+0x58/0x218 [ 157.175029] handle_irq_event+0x54/0xb8 [ 157.178867] handle_fasteoi_irq+0xac/0x248 [ 157.182968] handle_irq_desc+0x48/0x68 [ 157.186723] generic_handle_domain_irq+0x24/0x38 [ 157.191346] gic_handle_irq+0x54/0x120 [ 157.195098] call_on_irq_stack+0x24/0x30 [ 157.199027] do_interrupt_handler+0x88/0x98 [ 157.203212] el0_interrupt+0x44/0xc0 [ 157.206792] __el0_irq_handler_common+0x18/0x28 [ 157.211328] el0t_64_irq_handler+0x10/0x20 [ 157.215429] el0t_64_irq+0x198/0x1a0 [ 157.219009] ---[ end trace 0000000000000000 ]--- Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the vb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of the manual cleanup from mxc_isi_video_release(). Link: https://lore.kernel.org/r/20250813212451.22140-2-laurent.pinchart@ideasonboard.com Signed-off-by: Richard Leitner Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Tested-by: Richard Leitner # i.MX8MP Signed-off-by: Hans Verkuil commit c3bf16dbc38109ce7a20da0d3b8fac59fd45ced4 Author: Laurent Pinchart Date: Fri Aug 22 03:27:32 2025 +0300 media: imx-mipi-csis: Initial support for multiple output channels Some CSIS instances feature more than one output channel. Update register macros accordingly, parse the number of channels from the device tree, and update register dumps and event counters to log per-channel data. Support for routing virtual channels and data types to output channels through the subdev internal routing API will come later. Link: https://lore.kernel.org/r/20250822002734.23516-13-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Stefan Klug Signed-off-by: Hans Verkuil commit 362fc3fa78f9fa9fe9417c3c02850d282bd2c791 Author: Laurent Pinchart Date: Fri Aug 22 03:27:31 2025 +0300 dt-bindings: media: nxp,imx-mipi-csi2: Add fsl,num-channels property The CSI-2 receiver can be instantiated with up to four output channels. This is an integration-specific property, specify the number of instantiated channels through a new fsl,num-channels property. The property is optional, and defaults to 1 as only one channel is currently supported by drivers. Using the compatible string to infer the number of channels has been considered, but multiple instances of the same CSIS in the same SoC could conceptually be synthesized with a different number of channels. An explicit property is therefore more appropriate. The only known SoC to have more than one channel is the i.MX8MP. As the binding examples do not cover that SoC, don't update them. Link: https://lore.kernel.org/r/20250822002734.23516-12-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Hans Verkuil commit 06cff2c4e4c35ee96532b6ddd51e78641a3b4b9d Author: Laurent Pinchart Date: Fri Aug 22 03:27:30 2025 +0300 dt-bindings: media: nxp,imx-mipi-csi2: Mark clock-frequency as deprecated Usage of the clock-frequency property, which is already optional, is discouraged in favour of using assigned-clock-rates (and assigned-clock-parents where needed). Mark the property as deprecated, and update the examples accordingly. Link: https://lore.kernel.org/r/20250822002734.23516-11-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Hans Verkuil commit 65673c6e33cf46f220cc5774166b373b3c087739 Author: Laurent Pinchart Date: Fri Aug 22 03:27:29 2025 +0300 media: imx-mipi-csis: Only set clock rate when specified in DT The imx-mipi-csis driver sets the rate of the wrap clock to the value specified in the device tree's "clock-frequency" property, and defaults to 166 MHz otherwise. This is a historical mistake, as clock rate selection should have been left to the assigned-clock-rates property. Honouring the clock-frequency property can't be removed without breaking backwards compatibility, and the corresponding code isn't very intrusive. The 166 MHz default, on the other hand, prevents configuration of the clock rate through assigned-clock-rates, as the driver immediately overwrites the rate. This behaviour is confusing and has cost debugging time. There is little value in a 166 MHz default. All mainline device tree sources that enable the CSIS specify a clock-frequency explicitly, and the default wrap clock configuration on supported platforms is at least as high as 166 MHz. Drop the default, and only set the clock rate manually when the clock-frequency property is specified. Link: https://lore.kernel.org/r/20250822002734.23516-10-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 73f8f404e5d315935e6f30808189c1de9b94fbc0 Author: Laurent Pinchart Date: Fri Aug 22 03:27:28 2025 +0300 media: imx-mipi-csis: Log per-lane start of transmission errors The CSIS has per-line start of transmission error interrupts. Log them all, instead of only the first data lane. Link: https://lore.kernel.org/r/20250822002734.23516-9-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 4ef2703ec8c0774e6615b712eee361b785a28639 Author: Laurent Pinchart Date: Fri Aug 22 03:27:27 2025 +0300 media: imx-mipi-csis: Fix field alignment in register dump Commit 95a1379004cb ("media: staging: media: imx: imx7-mipi-csis: Dump MIPI_CSIS_FRAME_COUNTER_CH0 register") forgot to increase the maximum register name length, resulting in misalignment of names printed in the kernel log. Fix it. Link: https://lore.kernel.org/r/20250822002734.23516-8-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 41af288073f191a0f5890a04c668b19cd13423fe Author: Laurent Pinchart Date: Fri Aug 22 03:27:26 2025 +0300 media: imx-mipi-csis: Use GENMASK for all register field masks Multiple register field mask macros use GENMASK, while other define the mask value manually. Standardize on GENMASK everywhere, as well as on the _MASK suffix to name the macros. This improves consistency and helps with readability. No functional change is intended. Link: https://lore.kernel.org/r/20250822002734.23516-7-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit f0957575e1707bb89102dd0bcc79d274e6964846 Author: Laurent Pinchart Date: Fri Aug 22 03:27:25 2025 +0300 media: imx-mipi-csis: Rename register macros to match reference manual The CSIS driver uses register macro names that do not match the reference manual of the i.MX7[DS] and i.MX8M[MNP] SoCs in which the CSIS is integrated. Rename them to match the documentation, making the code easier to read alongside the reference manuals. One of the misnamed register fields is MIPI_CSIS_INT_SRC_ERR_UNKNOWN, which led to the corresponding event being logged as "Unknown Error". The correct register field name is MIPI_CSIS_INT_SRC_ERR_ID, documented as "Unknown ID error". Update the event description accordingly. While at it, also replace a few *_OFFSET macros with parametric macros for consistency, and add the missing MIPI_CSIS_ISP_RESOL_VRESOL and MIPI_CSIS_ISP_RESOL_HRESOL register field macros. No functional change intended. Link: https://lore.kernel.org/r/20250822002734.23516-6-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit b8135f4c1d257b48ced3d8250384ab371fab88d1 Author: Laurent Pinchart Date: Fri Aug 22 03:27:24 2025 +0300 media: imx-mipi-csis: Shorten name of subdev state variables Rename sd_state to state to standardize the naming of the subdev state variables and help shortening lines. No functional change is intended. Link: https://lore.kernel.org/r/20250822002734.23516-5-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Reviewed-by: Alexander Stein Signed-off-by: Hans Verkuil commit 6b54fe2973a711b6b95e9c10a04c519fd6eab191 Author: Laurent Pinchart Date: Fri Aug 22 03:27:23 2025 +0300 media: imx-mipi-csis: Standardize const keyword placement The const keyword for pointer variables is placed before the type everywhere except in one location. Change it to improve consistency. No functional change is intended. Link: https://lore.kernel.org/r/20250822002734.23516-4-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 0b6b9a0f68817cc92a25267585b30bbb02be61cf Author: Laurent Pinchart Date: Fri Aug 22 03:27:22 2025 +0300 media: imx-mipi-csis: Simplify access to source pad The mipi_csis_calculate_params() function needs to access the pad of the connected source. The pad is already available in csis->source.pad, but the function takes a convoluted path by getting the pad index and indexing the source subdev's pads array. Simplify it. No functional change is intended. Link: https://lore.kernel.org/r/20250822002734.23516-3-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 6234d0df236ab1a71c6bd75e4f5fa15339d5272b Author: Laurent Pinchart Date: Fri Aug 22 03:27:21 2025 +0300 media: v4l2-common: Constify media_pad argument to v4l2_get_link_freq() The v4l2_get_link_freq() macro doesn't modify the pad argument. Make it possible to call it with a const media_pad pointer. Link: https://lore.kernel.org/r/20250822002734.23516-2-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b620462bba6655b47d127db70d18123c7af522d4 Author: Bart Van Assche Date: Fri Aug 29 08:38:16 2025 -0700 scsi: ufs: core: Move the tracing enumeration types into a new file The header file defines constants and data structures related to the UFS standard. Move the enumeration types related to tracing into a new header file because these are not defined in the UFS standard. An intended side effect of this patch is that the tracing enumeration types are no longer visible to UFS host drivers. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250829153841.2201700-1-bvanassche@acm.org Reviewed-by: Avri Altman Signed-off-by: Martin K. Petersen commit e02436d37a47346fdeebe0f65e5d19c0b9f87eec Author: Thorsten Blum Date: Thu Aug 28 18:11:53 2025 +0200 scsi: qla2xxx: Use secs_to_jiffies() instead of msecs_to_jiffies() Use secs_to_jiffies() instead of msecs_to_jiffies() and avoid scaling 'ratov_j' to milliseconds. No functional changes intended. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250828161153.3676-2-thorsten.blum@linux.dev Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 80093afdcc484ed7f96d743283932fb40739fe11 Author: Xichao Zhao Date: Wed Aug 27 20:16:11 2025 +0800 scsi: csiostor: Fix some spelling errors Fix spelling errors in some comments. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250827121611.497547-1-zhao.xichao@vivo.com Signed-off-by: Martin K. Petersen commit 44b6169ada7fe3cf4cb91e6b06019eaa22719f28 Author: Gustavo A. R. Silva Date: Wed Aug 27 08:10:53 2025 +0200 scsi: fc: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end has been introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with a flexible-array member in the middle of multiple other structs, we use the '__struct_group()' helper to create a new tagged 'struct fc_df_desc_fpin_reg_hdr'. This structure groups together all the members of the flexible 'struct fc_df_desc_fpin_reg' except the flexible array. As a result, the array is effectively separated from the rest of the members without modifying the memory layout of the flexible structure. We then change the type of the middle struct members currently causing trouble from 'struct fc_df_desc_fpin_reg' to 'struct fc_df_desc_fpin_reg_hdr'. We also want to ensure that in case new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use '_Static_assert()'. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. This approach avoids having to implement 'struct fc_df_desc_fpin_reg_hdr' as a completely separate structure, thus preventing having to maintain two independent but basically identical structures, closing the door to potential bugs in the future. The above is also done for flexible structures 'struct fc_els_rdf' and 'struct fc_els_rdf_resp' So, with these changes, fix the following warnings: drivers/scsi/lpfc/lpfc_hw4.h:4936:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/lpfc/lpfc_hw4.h:4942:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/lpfc/lpfc_hw4.h:4947:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/aK6hbQLyQlvlySf8@kspp Reviewed-by: Hannes Reinecke Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit bee3554d1a4efbce91d6eca732f41b97272213a5 Author: Qianfeng Rong Date: Tue Aug 26 17:32:42 2025 +0800 scsi: pm8001: Use int instead of u32 to store error codes Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req(). Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com Signed-off-by: Martin K. Petersen commit 9cb76813425956f82cf598c357da0c9f36a1d9a8 Author: Matthew Gerlach Date: Mon Aug 18 09:39:33 2025 -0700 arm64: dts: socfpga: agilex5: enable gmac2 on the Agilex5 dev kit Enable gmac2 on the Agilex5 SOCFGPA Development Kit. The MAC is connected to a RGMII PHY on a daughter card. There are no RGMII clock delays implemented the on PCB. Signed-off-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit 343ea11a2fe32550c1d37b947803f4087a3a94c4 Author: Mun Yew Tham Date: Mon Aug 18 09:39:32 2025 -0700 arm64: dts: Agilex5 Add gmac nodes to DTSI for Agilex5 Add the base device tree nodes for gmac0, gmac1, and gmac2 to the DTSI for the Agilex5 SOCFPGA. Agilex5 has three Ethernet controllers based on Synopsys DWC XGMAC IP version 2.10. Signed-off-by: Mun Yew Tham Signed-off-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit 11e6fb38bde51cba411163f95a32db84d5d220a2 Author: Abinash Singh Date: Tue Aug 26 00:09:40 2025 +0530 scsi: sd: Make sd_revalidate_disk() return void The sd_revalidate_disk() function currently returns 0 for both success and memory allocation failure. Since none of its callers use the return value, this return code is both unnecessary and potentially misleading. Change the return type of sd_revalidate_disk() from int to void and remove all return value handling. This makes the function semantics clearer and avoids confusion about unused return codes. Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Signed-off-by: Abinash Singh Link: https://lore.kernel.org/r/20250825183940.13211-4-abinashsinghlalotra@gmail.com Signed-off-by: Martin K. Petersen commit d842da6924a9518346a2042db0d24bc77500efae Author: Abinash Singh Date: Tue Aug 26 00:09:39 2025 +0530 scsi: sd: Remove redundant printk() after kmalloc() failure The SCSI disk driver prints a warning when kmalloc() fails in sd_revalidate_disk(). This is redundant because the page allocator already reports failures unless __GFP_NOWARN is used. Keeping the extra message only adds noise to the kernel log. Remove the unnecessary sd_printk() call. Control flow is unchanged. Reviewed-by: Damien Le Moal Signed-off-by: Abinash Singh Link: https://lore.kernel.org/r/20250825183940.13211-3-abinashsinghlalotra@gmail.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit b5f717b31b5e478398740db8aee2ecbc4dd72bf3 Author: Abinash Singh Date: Tue Aug 26 00:09:38 2025 +0530 scsi: sd: Fix build warning in sd_revalidate_disk() A build warning was triggered due to excessive stack usage in sd_revalidate_disk(): drivers/scsi/sd.c: In function ‘sd_revalidate_disk.isra’: drivers/scsi/sd.c:3824:1: warning: the frame size of 1160 bytes is larger than 1024 bytes [-Wframe-larger-than=] This is caused by a large local struct queue_limits (~400B) allocated on the stack. Replacing it with a heap allocation using kmalloc() significantly reduces frame usage. Kernel stack is limited (~8 KB), and allocating large structs on the stack is discouraged. As the function already performs heap allocations (e.g. for buffer), this change fits well. Fixes: 804e498e0496 ("sd: convert to the atomic queue limits API") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Abinash Singh Link: https://lore.kernel.org/r/20250825183940.13211-2-abinashsinghlalotra@gmail.com Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 6d55af0f0740bf3d77943425fdafb77dc0fa6bb9 Author: Bharat Uppal Date: Thu Aug 21 11:09:23 2025 +0530 scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend On FSD platform, gating the reference clock (ref_clk) and putting the UFS device in reset by asserting the reset signal during UFS suspend, improves the power savings and ensures the PHY is fully turned off. These operations are added as FSD specific suspend hook to avoid unintended side effects on other SoCs supported by this driver. Co-developed-by: Nimesh Sati Signed-off-by: Nimesh Sati Signed-off-by: Bharat Uppal Link: https://lore.kernel.org/r/20250821053923.69411-1-bharat.uppal@samsung.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 7c873e3f04fd3e245890ddfde261f83d6aaa9ddb Author: Sakari Ailus Date: Thu Aug 28 17:06:17 2025 +0300 iio: dac: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-redundant explicit call to pm_runtime_mark_last_busy(). Also clean up error handling in stm32_dac_set_enable_state(). Signed-off-by: Sakari Ailus Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250828140617.3193288-1-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit dfbbee0907fb30a1dd31ff1a84e1bd34bd824369 Author: David Lechner Date: Thu Aug 28 16:54:55 2025 -0500 iio: adc: ad7124: add clock output support Add support for the AD7124's internal clock output. If the #clock-cells property is present, turn on the internal clock output during probe. If both the clocks and #clock-names properties are present (not allowed by devicetree bindings), assume that an external clock is being used so that we don't accidentally have two outputs fighting each other. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250828-iio-adc-ad7124-proper-clock-support-v3-4-0b317b4605e5@baylibre.com Signed-off-by: Jonathan Cameron commit ed231e253ff23214712c8884165b4eb8a441f573 Author: David Lechner Date: Thu Aug 28 16:54:54 2025 -0500 iio: adc: ad7124: add external clock support Add support for an external clock source to the AD7124 ADC driver. Previously, the driver only supported using the internal clock and had bad devicetree bindings that used a fake clock to essentially select the power mode. This is preserved for backwards compatibility. If the clock is not named "mclk", then we know that the devicetree is using the correct bindings and we can configure the chip to use an external clock source rather than internal. Also drop a redundant comment when configuring the register fields instead of adding more. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250828-iio-adc-ad7124-proper-clock-support-v3-3-0b317b4605e5@baylibre.com Signed-off-by: Jonathan Cameron commit aead8e4cc04612f74c7277de137cc995df280829 Author: David Lechner Date: Thu Aug 28 16:54:53 2025 -0500 iio: adc: ad7124: do not require mclk Make the "mclk" clock optional in the ad7124 driver. The MCLK is an internal counter on the ADC, so it is not something that should be coming from the devicetree. However, existing users may be using this to essentially select the power mode of the ADC from the devicetree. In order to not break those users, we have to keep the existing "mclk" handling, but now it is optional. Now, when the "mclk" clock is omitted from the devicetree, the driver will default to the full power mode. Support for an external clock and dynamic power mode switching can be added later if needed. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250828-iio-adc-ad7124-proper-clock-support-v3-2-0b317b4605e5@baylibre.com Signed-off-by: Jonathan Cameron commit a52bdee13ed77f02dfd902baeb0eae876846672e Author: David Lechner Date: Thu Aug 28 16:54:52 2025 -0500 dt-bindings: iio: adc: adi,ad7124: fix clocks properties Use correct clocks properties for the AD7124 family of ADCs. These ADCs have an internal clock along with an optional external clock that can be connected to the CLK pin. This pin can be wired up 3 ways: 1. Not connected - the internal clock is used. 2. Connected to an external clock (input) - the external clock is used. 3. Connected to the CLK pin on another ADC (output) - the internal clock is used on one and the other is configured for an external clock. The new bindings describe these 3 cases by picking one of the following: 1. Omit both clocks and #clock-cells properties. 2. Include only the clocks property with a phandle to the external clock. 3. Include only the #clock-cells property on the ADC providing the output. The clock-names property is now deprecated and should not be used. The MCLK signal that it refers to is an internal counter in the ADC and therefore does not make sense as a devicetree property as it can't be connected to anything external to the ADC. Since there is only one possible external clock, the clock-names property is not needed anyway. Based on the implementation of the Linux driver, it looks like the "mclk" clock was basically being used as a control to select the power mode of the ADC, which is not something that should be done in the devicetree. Reviewed-by: Rob Herring (Arm) Signed-off-by: David Lechner Link: https://patch.msgid.link/20250828-iio-adc-ad7124-proper-clock-support-v3-1-0b317b4605e5@baylibre.com Signed-off-by: Jonathan Cameron commit 71965cae7db394ff5ba3b2d2befe4e136ceec268 Author: Kuan-Wei Chiu Date: Fri Aug 29 03:19:54 2025 +0800 EDAC: Fix wrong executable file modes for C source files Three EDAC source files were mistakenly marked as executable when adding the EDAC scrub controls. These are plain C source files and should not carry the executable bit. Correcting their modes follows the principle of least privilege and avoids unnecessary execute permissions in the repository. [ bp: Massage commit message. ] Signed-off-by: Kuan-Wei Chiu Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250828191954.903125-1-visitorckw@gmail.com commit 0ffbc876d03c80b83d70aeefac7bbb94a9f4e135 Author: Casey Schaufler Date: Sat Aug 16 10:28:59 2025 -0700 audit: add record for multiple object contexts Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. An example of the MAC_OBJ_CONTEXTS record is: type=MAC_OBJ_CONTEXTS msg=audit(1601152467.009:1050): obj_selinux=unconfined_u:object_r:user_home_t:s0 When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record the "obj=" field in other records in the event will be "obj=?". An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has multiple security modules that may make access decisions based on an object security context. Signed-off-by: Casey Schaufler [PM: subj tweak, audit example readability indents] Signed-off-by: Paul Moore commit eb59d494eebd4c5414728a35cdea6a0ba78ff26e Author: Casey Schaufler Date: Sat Aug 16 10:28:58 2025 -0700 audit: add record for multiple task security contexts Replace the single skb pointer in an audit_buffer with a list of skb pointers. Add the audit_stamp information to the audit_buffer as there's no guarantee that there will be an audit_context containing the stamp associated with the event. At audit_log_end() time create auxiliary records as have been added to the list. Functions are created to manage the skb list in the audit_buffer. Create a new audit record AUDIT_MAC_TASK_CONTEXTS. An example of the MAC_TASK_CONTEXTS record is: type=MAC_TASK_CONTEXTS msg=audit(1600880931.832:113) subj_apparmor=unconfined subj_smack=_ When an audit event includes a AUDIT_MAC_TASK_CONTEXTS record the "subj=" field in other records in the event will be "subj=?". An AUDIT_MAC_TASK_CONTEXTS record is supplied when the system has multiple security modules that may make access decisions based on a subject security context. Refactor audit_log_task_context(), creating a new audit_log_subj_ctx(). This is used in netlabel auditing to provide multiple subject security contexts as necessary. Suggested-by: Paul Moore Signed-off-by: Casey Schaufler [PM: subj tweak, audit example readability indents] Signed-off-by: Paul Moore commit a59076f2669ec23a122549e1f4114e8d4255b632 Author: Casey Schaufler Date: Sat Aug 16 10:28:57 2025 -0700 lsm: security_lsmblob_to_secctx module selection Add a parameter lsmid to security_lsmblob_to_secctx() to identify which of the security modules that may be active should provide the security context. If the value of lsmid is LSM_ID_UNDEF the first LSM providing a hook is used. security_secid_to_secctx() is unchanged, and will always report the first LSM providing a hook. Signed-off-by: Casey Schaufler [PM: subj tweak] Signed-off-by: Paul Moore commit 0a561e3904a92492fee8e02a9f69276e939fd990 Author: Casey Schaufler Date: Sat Aug 16 10:28:56 2025 -0700 audit: create audit_stamp structure Replace the timestamp and serial number pair used in audit records with a structure containing the two elements. Signed-off-by: Casey Schaufler [PM: subj tweak] Signed-off-by: Paul Moore commit 2a91dcd5be9dde3239c87e4309f5878d3e4fb9d2 Author: Alex Bee Date: Thu Aug 28 16:35:01 2025 +0000 ARM: dts: rockchip: add HDMI audio to rk3288-miqi Add the sound and i2s nodes to enable HDMI audio output on the MiQi board. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Link: https://lore.kernel.org/r/20250828163501.3829226-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 2850f6f1ecf2a42c6ae7a6d55874c9eb17eeb622 Author: Alex Bee Date: Thu Aug 28 16:54:21 2025 +0000 ARM: dts: rockchip: add CEC pinctrl to rk3288-miqi Enable CEC control on the HDMI port for MiQi. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Link: https://lore.kernel.org/r/20250828165421.3829740-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 7c50e0cea2549a8d673bad62abf9be82b71e5477 Author: Alex Bee Date: Fri Aug 29 05:45:47 2025 +0000 arm64: dts: rockchip: add IR receiver to rk3328-roc Add the ir-receiver and ir pinctrl nodes to enable the IR receiver on the ROC-RK3328-CC board. Signed-off-by: Alex Bee Signed-off-by: Christian Hewitt Link: https://lore.kernel.org/r/20250829054547.4053558-1-christianshewitt@gmail.com Signed-off-by: Heiko Stuebner commit 096bd8c679185f898cae9933c6a68650fa26ea4f Author: Peter Robinson Date: Fri Aug 29 12:38:24 2025 +0100 arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro Update the wake-up pin and associated interupt details for the Pinephone Pro WiFi module. Details obtained from the published PinephonePro-Schematic-V1.0-20211127.pdf page 19. Signed-off-by: Peter Robinson Link: https://lore.kernel.org/r/20250829113826.2029755-1-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit a874b387213bd80b1288884aeb427cb7599eb5ea Author: Krzysztof Kozlowski Date: Fri Aug 22 14:14:26 2025 +0200 arm64: dts: fsd: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node. Value '0' is correct because GIC interrupt controller does not have children. Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250822121423.228500-7-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit a75d45adb261cbced86701d2512098044a6d310f Author: Krzysztof Kozlowski Date: Fri Aug 22 14:14:25 2025 +0200 arm64: dts: google: gs101: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node. Value '0' is correct because GIC interrupt controller does not have children. Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250822121423.228500-6-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit b3a62f6c3573e448e8b0697a622e7bba0ddf9945 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:14:24 2025 +0200 arm64: dts: exynos5433: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: exynos5433-tm2-common.dtsi:1000.2-41: Warning (interrupt_map): /soc@0/pcie@15700000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@11001000, using 0 as fallbac Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250822121423.228500-5-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 1bc8f09ce98ca8a56f2059c9a8fe26cc351318f0 Author: Ivaylo Ivanov Date: Fri Aug 15 10:05:00 2025 +0300 arm64: dts: exynos2200: define all usi nodes Universal Serial Interface (USI) supports three types of serial interfaces - uart, i2c and spi. Each protocol can work independently and configured using external configuration inputs. As each USI instance has access to 4 pins, there are multiple possible configurations: - the first 2 and the last 2 pins can be i2c (sda/scl) or uart (rx/tx) - the 4 pins can be used for 4 pin uart or spi For each group of 4 pins, there is one usi instance that can access all 4 pins, and a second usi instance that can be used to set the last 2 pins in i2c mode. Such configuration can be achieved by setting the mode property of usiX and usiX_i2c nodes correctly - if usiX is set to take up 2 pins, then usiX_i2c can be set to take the other 2. If usiX is set for 4 pins, then usiX_i2c should be left disabled. Define all the USI nodes from peric0 (usi4), peric1 (usi7-10), peric2 (usi0-6, usi11) and cmgp (usi0-6_cmgp, 2 pin usi7_cmgp) blocks, as well as their respective uart and i2c subnodes. Suffix labels for blocks in CMGP instances with _cmgpX, and follow the naming conventions from the vendor kernel to avoid confusion. Spi support will be added later on. Signed-off-by: Ivaylo Ivanov Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20250815070500.3275491-5-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 0dff00633bbc8566fed6483daddddfa0dfdcf83a Author: Ivaylo Ivanov Date: Fri Aug 15 10:04:59 2025 +0300 arm64: dts: exynos2200: increase the size of all syscons As IP cores are aligned by 0x10000, increase the size of all system register instances to the maximum (0x10000) to allow using accessing registers over the currently set limit. Suggested-by: Sam Protsenko Signed-off-by: Ivaylo Ivanov Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20250815070500.3275491-4-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit ad8ea30db80f825215d071370989b8ac45298a1a Author: Ivaylo Ivanov Date: Fri Aug 15 10:04:58 2025 +0300 arm64: dts: exynos2200: use 32-bit address space for /soc All peripherals on this SoC are mapped under the 32-bit address space (0x0 -> 0x20000000), so enforce that. Suggested-by: Sam Protsenko Signed-off-by: Ivaylo Ivanov Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20250815070500.3275491-3-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 1219992e16689f4937a333c98d90cf80ba91860a Author: Ivaylo Ivanov Date: Fri Aug 15 10:04:57 2025 +0300 arm64: dts: exynos2200: fix typo in hsi2c23 bus pins label The '2' in 'hsi2c23' was missed while making the device tree. Fix that so we can properly reference the node. Signed-off-by: Ivaylo Ivanov Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20250815070500.3275491-2-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 82ab67d762e922bb5df1cbb442e8d4f12c26a7ae Author: Nicolas Ferre Date: Fri Sep 5 11:20:44 2025 +0200 ARM: dts: microchip: sama7d65: add uart3 definition for flexcom3 peripheral Add the definition of uart3 at the side of i2c3 for flexcom3. Signed-off-by: Nicolas Ferre Reviewed-by: Ryan Wanner Link: https://lore.kernel.org/r/20250905092044.25429-1-nicolas.ferre@microchip.com [claudiu.beznea: moved atmel,usart-mode at the end of the node to comply with dts coding style] Signed-off-by: Claudiu Beznea commit 04334f9e8ed2c5763f5633ad53199d12c96fc795 Author: Ryan Wanner Date: Wed Sep 17 14:04:08 2025 -0700 ARM: dts: microchip: sama7d65: Add GPIO buttons and LEDs Add the USER button as a GPIO input as well as add the LEDs and enable the blue LED as a heartbeat. Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/20250917210409.503830-1-Ryan.Wanner@microchip.com Signed-off-by: Nicolas Ferre commit 3cae7d18392feacf04354feac994c1b48eed91af Author: Nicolas Ferre Date: Wed Aug 27 16:54:27 2025 +0200 ARM: at91: pm: save and restore ACR during PLL disable/enable Add a new word in assembly to store ACR value during the calls to at91_plla_disable/at91_plla_enable macros and use it. Signed-off-by: Nicolas Ferre [cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading] Signed-off-by: Cristian Birsan Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com Reviewed-by: Alexandre Belloni Signed-off-by: Claudiu Beznea commit 296302d3d81360e09fa956e9be9edc8223b69a12 Author: Nicolas Ferre Date: Wed Aug 27 16:54:26 2025 +0200 ARM: at91: pm: fix MCKx restore routine The at91_mckx_ps_restore() assembly function is responsible for setting back MCKx system bus clocks after exiting low power modes. Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx to previously saved state. Tmp2 was used without the needed changes in CSS and DIV. Moreover the required bit 7, telling that MCR register's content is to be changed (CMD/write), was not set. Fix function comment to match tmp variables actually used. Signed-off-by: Nicolas Ferre Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com Reviewed-by: Alexandre Belloni [claudiu.beznea: s/sate/state in commit description] Signed-off-by: Claudiu Beznea commit 6a3f890196b31b166a3e3e32735ff5c8116661cc Author: Nicolas Ferre Date: Wed Aug 27 16:54:25 2025 +0200 ARM: at91: pm: fix .uhp_udp_mask specification for current SoCs All SoCs using this structure field .uhp_udp_mask in configuration index 4 don't have the bit 7 specified: sam9x60 nor sam9x75. Remove this bit from the mask definition to match register layout. This mask is used in function at91_pm_verify_clocks(). Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20250827145427.46819-2-nicolas.ferre@microchip.com Reviewed-by: Alexandre Belloni Signed-off-by: Claudiu Beznea commit 914c62f21842420ec4118503e0da815faf0acdfe Author: Takashi Iwai Date: Sat Aug 30 10:03:50 2025 +0200 ALSA: firewire: motu: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250830080351.25600-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 38ac99ff0ab15bf2231058168e988f66740c0785 Author: Takashi Iwai Date: Thu Aug 28 15:27:23 2025 +0200 ALSA: firewire: lib: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-20-tiwai@suse.de commit 8885ab5f215cc99918b4b711c2d8578004ae5481 Author: Takashi Iwai Date: Thu Aug 28 15:27:22 2025 +0200 ALSA: firewire: tascam: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-19-tiwai@suse.de commit cae230e4d0a9a4234e042c8eaa19bb9b11879792 Author: Takashi Iwai Date: Thu Aug 28 15:27:21 2025 +0200 ALSA: firewire: oxfw: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-18-tiwai@suse.de commit 0b8bf8d00f4015f85a9fd5799e39ba10b42fa5e3 Author: Takashi Iwai Date: Thu Aug 28 15:27:19 2025 +0200 ALSA: firewire: fireworks: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-16-tiwai@suse.de commit 05af2f70691b073cee54b6822e0f4f314364de68 Author: Takashi Iwai Date: Thu Aug 28 15:27:18 2025 +0200 ALSA: firewire: fireface: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-15-tiwai@suse.de commit 0385fd947b89e3c027f15fe46cf6cc943c260020 Author: Takashi Iwai Date: Thu Aug 28 15:27:17 2025 +0200 ALSA: firewire: digi00x: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-14-tiwai@suse.de commit 17653c9128ec8a32fefbb052ba841792b5f56c5a Author: Takashi Iwai Date: Thu Aug 28 15:27:16 2025 +0200 ALSA: firewire: dice: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-13-tiwai@suse.de commit 9c2ca41d573c26c5b7b83149f81b2b17076e8d94 Author: Takashi Iwai Date: Thu Aug 28 15:27:15 2025 +0200 ALSA: firewire: bebob: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-12-tiwai@suse.de commit 6061b4accb812e9c5888b64cd1764fece9626ea6 Author: Takashi Iwai Date: Thu Aug 28 15:27:14 2025 +0200 ALSA: firewire: lib: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-11-tiwai@suse.de commit b8ed2b143263625a01c2796e0c636d47804585aa Author: Takashi Iwai Date: Thu Aug 28 15:27:13 2025 +0200 ALSA: firewire: isight: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-10-tiwai@suse.de commit a1c55ef6e959a3336e319e786428ad8cca900f77 Author: Takashi Iwai Date: Thu Aug 28 15:27:12 2025 +0200 ALSA: firewire: fireface: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-9-tiwai@suse.de commit 61a5f22fb15129a90d3be6a32ce8131cb84db002 Author: Takashi Iwai Date: Thu Aug 28 15:27:11 2025 +0200 ALSA: firewire: tascam: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-8-tiwai@suse.de commit 751298f88e0b6a040930c51e57a5e4bd305b276e Author: Takashi Iwai Date: Thu Aug 28 15:27:10 2025 +0200 ALSA: firewire: oxfw: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-7-tiwai@suse.de commit b9ac651964c9a719cd5fba2ec99f3afb6f159232 Author: Takashi Iwai Date: Thu Aug 28 15:27:09 2025 +0200 ALSA: firewire: motu: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-6-tiwai@suse.de commit 760c91a25af4f240d199cf719f008e7a98ab246b Author: Takashi Iwai Date: Thu Aug 28 15:27:08 2025 +0200 ALSA: firewire: fireworks: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-5-tiwai@suse.de commit a4b45e101d14718f534541c6a32ddfb26dc76a6d Author: Takashi Iwai Date: Thu Aug 28 15:27:07 2025 +0200 ALSA: firewire: digi00x: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-4-tiwai@suse.de commit 089843177f35de2d020be6aa35c00a843873a538 Author: Takashi Iwai Date: Thu Aug 28 15:27:06 2025 +0200 ALSA: firewire: dice: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-3-tiwai@suse.de commit 34d988f095f238114968c3fb7cf7fb7e38cb91f9 Author: Takashi Iwai Date: Thu Aug 28 15:27:05 2025 +0200 ALSA: firewire: bebob: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250828132802.9032-2-tiwai@suse.de commit 41eab2a95950682cdc9c5e60cb3457e29f186540 Author: Qianfeng Rong Date: Thu Aug 21 22:27:31 2025 +0800 crypto: hisilicon - use kcalloc() instead of kzalloc() As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Use devm_kcalloc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments #1 Signed-off-by: Qianfeng Rong Reviewed-by: Longfang Liu Signed-off-by: Herbert Xu commit 4c634b6b3c77bba237ee64bca172e73f9cee0cb2 Author: Qianfeng Rong Date: Thu Aug 21 22:20:26 2025 +0800 crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Use kcalloc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Similarly, use size_add() instead of explicit addition for 'uobj_chunk_num + sobj_chunk_num'. Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments #1 Signed-off-by: Qianfeng Rong Reviewed-by: Andy Shevchenko Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit dcd2d5fda2bb3898eca9380c13da1f346de1df6f Author: Chenghai Huang Date: Thu Aug 21 09:38:09 2025 +0800 crypto: hisilicon/zip - enable literal length in stream mode compression In stream mode, the hardware needs to combine the length of the previous literal to calculate the length of the current literal. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 9228facb308157ac0bdd264b873187896f7a9c7a Author: Weili Qian Date: Thu Aug 21 09:38:08 2025 +0800 crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for physical function and a reserved interrupt for virtual function. However, the driver has not registered the reserved interrupt for virtual function. When allocating interrupts, the number of interrupts is allocated based on powers of two, which includes this interrupt. When the system enables GICv4 and the virtual function passthrough to the virtual machine, releasing the interrupt in the driver triggers a warning. The WARNING report is: WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 Therefore, register a reserved interrupt for VF and set the IRQF_NO_AUTOEN flag to avoid that warning. Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers") Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec Author: Zhushuai Yin Date: Thu Aug 21 09:38:07 2025 +0800 crypto: hisilicon/qm - check whether the input function and PF are on the same device Function rate limiting is set through physical function driver. Users configure by providing function information and rate limit values. Before configuration, it is necessary to check whether the provided function and PF belong to the same device. Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") Signed-off-by: Zhushuai Yin Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 1f9128f121a872f27251be60ccccfd98c136d72e Author: Weili Qian Date: Thu Aug 21 09:38:06 2025 +0800 crypto: hisilicon - check the sva module status while enabling or disabling address prefetch After enabling address prefetch, check the sva module status. If all previous prefetch requests from the sva module are not completed, then disable the address prefetch to ensure normal execution of new task operations. After disabling address prefetch, check if all requests from the sva module have been completed. Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching") Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 Author: Chenghai Huang Date: Thu Aug 21 09:38:05 2025 +0800 crypto: hisilicon - re-enable address prefetch after device resuming When the device resumes from a suspended state, it will revert to its initial state and requires re-enabling. Currently, the address prefetch function is not re-enabled after device resuming. Move the address prefetch enable to the initialization process. In this way, the address prefetch can be enabled when the device resumes by calling the initialization process. Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit d4e081510471e79171c4e0a11f6cb608e49bc082 Author: Chenghai Huang Date: Thu Aug 21 09:38:04 2025 +0800 crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations When configuring the high-performance mode register, there is no need to verify whether the register has been successfully enabled, as there is no possibility of a write failure for this register. Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 5cd459ebaae05651eccf04e5969953d1180d9dd2 Author: Liao Yuanhong Date: Wed Aug 20 20:39:23 2025 +0800 hwrng: cn10k - Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Signed-off-by: Herbert Xu commit 8595bcb09b05a6c712c35f03ef701e7785895b51 Author: Liao Yuanhong Date: Wed Aug 20 20:37:52 2025 +0800 crypto: tegra - Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Signed-off-by: Herbert Xu commit ce136503bd9fed595fe0ba6dcae0f5f0f8cec7e3 Author: Liao Yuanhong Date: Wed Aug 20 20:37:02 2025 +0800 crypto: jh7110 - Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Signed-off-by: Liao Yuanhong Signed-off-by: Herbert Xu commit 52f641bc63a46657b1d72d902fcee30ab1233c7b Author: T Pratham Date: Wed Aug 20 14:42:27 2025 +0530 crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC) Add support for ECB and CBC modes in the AES Engine of the DTHE V2 hardware cryptography engine. Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 97d37c0a4477c857f2ddf42b5fe9e4a78ab9db85 Author: T Pratham Date: Wed Aug 20 14:42:26 2025 +0530 dt-bindings: crypto: Add binding for TI DTHE V2 Add DT binding for Texas Instruments DTHE V2 cryptography engine. DTHE V2 is introduced as a part of TI AM62L SoC and can currently be only found in it. Signed-off-by: T Pratham Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 01834444d972163b305a7f81e6bfba6315dced09 Author: Eric Biggers Date: Mon Aug 18 15:47:40 2025 -0700 crypto: arm64/aes - use SHA-256 library instead of crypto_shash In essiv_cbc_set_key(), just use the SHA-256 library instead of crypto_shash. This is simpler and also slightly faster. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 9aa7e045f4af7d33684f00214a6f74e506426546 Author: Edward Adam Davis Date: Mon Aug 18 21:24:17 2025 +0800 crypto: jitter - Mark intermediary memory as clean This is not a leak! The stack memroy is hashed and fed into the entropy pool. We can't recover the original kernel memory from it. Reported-by: syzbot+e8bcd7ee3db6cb5cb875@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e8bcd7ee3db6cb5cb875 Signed-off-by: Edward Adam Davis Signed-off-by: Herbert Xu commit 14f628cb5852dc1fe5f36f889f6869c0299a235e Merge: da24e6b3c251d6 d5f8458e34a331 Author: Takashi Iwai Date: Sat Aug 30 09:42:45 2025 +0200 Merge branch 'for-linus' into for-next Pull 6.17 devel branch for further auto-cleanup updates. Signed-off-by: Takashi Iwai commit 864ecc4a6dade82d3f70eab43dad0e277aa6fc78 Merge: e71aa5a955a705 6ad8de3cefdb6f Author: Jakub Kicinski Date: Fri Aug 29 19:36:34 2025 -0700 Merge branch 'net-add-rcu-safety-to-dst-dev' Eric Dumazet says: ==================== net: add rcu safety to dst->dev Followup of commit 88fe14253e18 ("net: dst: add four helpers to annotate data-races around dst->dev"). Use lockdep enabled helpers to convert our unsafe dst->dev uses one at a time. More to come... ==================== Link: https://patch.msgid.link/20250828195823.3958522-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 Author: Eric Dumazet Date: Thu Aug 28 19:58:23 2025 +0000 ipv4: start using dst_dev_rcu() Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit b62a59c18b692f892dcb8109c1c2e653b2abc95c Author: Eric Dumazet Date: Thu Aug 28 19:58:22 2025 +0000 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() Use RCU to avoid a pair of atomic operations and a potential UAF on dst_dev()->flags. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 50c127a69cd6285300931853b352a1918cfa180f Author: Eric Dumazet Date: Thu Aug 28 19:58:21 2025 +0000 tcp_metrics: use dst_dev_net_rcu() Replace three dst_dev() with a lockdep enabled helper. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 99a2ace61b211b0be861b07fbaa062fca4b58879 Author: Eric Dumazet Date: Thu Aug 28 19:58:20 2025 +0000 net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_dev_net_rcu(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 11709573cc4e48dc34c80fc7ab9ce5b159e29695 Author: Eric Dumazet Date: Thu Aug 28 19:58:19 2025 +0000 ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9085e56501d93af9f2d7bd16f7fcfacdde47b99c Author: Eric Dumazet Date: Thu Aug 28 19:58:18 2025 +0000 ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit b775ecf1655cedbc465fd6699ab18a2bc4e7a352 Author: Eric Dumazet Date: Thu Aug 28 19:58:17 2025 +0000 ipv6: start using dst_dev_rcu() Refactor icmpv6_xrlim_allow() and ip6_dst_hoplimit() so that we acquire rcu_read_lock() a bit longer to be able to use dst_dev_rcu() instead of dst_dev(). __ip6_rt_update_pmtu() and rt6_do_redirect can directly use dst_dev_rcu() in sections already holding rcu_read_lock(). Small changes to use dst_dev_net_rcu() in ip6_default_advmss(), ipv6_sock_ac_join(), ip6_mc_find_dev() and ndisc_send_skb(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 Author: Eric Dumazet Date: Thu Aug 28 19:58:16 2025 +0000 net: dst: introduce dst->dev_rcu Followup of commit 88fe14253e18 ("net: dst: add four helpers to annotate data-races around dst->dev"). We want to gradually add explicit RCU protection to dst->dev, including lockdep support. Add an union to alias dst->dev_rcu and dst->dev. Add dst_dev_net_rcu() helper. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit e71aa5a955a7059a705972e9bcdb074b6fd14696 Merge: 34c21e91192aa1 95fa78830e5b2e Author: Jakub Kicinski Date: Fri Aug 29 19:29:26 2025 -0700 Merge branch 'inet_diag-make-dumps-faster-with-simple-filters' Eric Dumazet says: ==================== inet_diag: make dumps faster with simple filters inet_diag_bc_sk() pulls five cache lines per socket, while most filters only need the two first ones. We can change it to only pull needed cache lines, to make things like "ss -temoi src :21456" much faster. First patches (1-3) are annotating data-races as a first step. ==================== Link: https://patch.msgid.link/20250828102738.2065992-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 95fa78830e5b2eb2041174c7f9549c746e003dd6 Author: Eric Dumazet Date: Thu Aug 28 10:27:38 2025 +0000 inet_diag: avoid cache line misses in inet_diag_bc_sk() inet_diag_bc_sk() pulls five cache lines per socket, while most filters only need the two first ones. Add three booleans to struct inet_diag_dump_data, that are selectively set if a filter needs specific socket fields. - mark_needed /* INET_DIAG_BC_MARK_COND present. */ - cgroup_needed /* INET_DIAG_BC_CGROUP_COND present. */ - userlocks_needed /* INET_DIAG_BC_AUTO present. */ This removes millions of cache lines misses per ss invocation when simple filters are specified on busy servers. offsetof(struct sock, sk_userlocks) = 0xf3 offsetof(struct sock, sk_mark) = 0x20c offsetof(struct sock, sk_cgrp_data) = 0x298 Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250828102738.2065992-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9529320ad64e614cfaf96e6b8e3d8c0a1245160c Author: Eric Dumazet Date: Thu Aug 28 10:27:37 2025 +0000 inet_diag: change inet_diag_bc_sk() first argument We want to have access to the inet_diag_dump_data structure in the following patch. This patch removes duplication in callers. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250828102738.2065992-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4fd84a0aaf2ba125b441aa09d415022385e66bf2 Author: Eric Dumazet Date: Thu Aug 28 10:27:36 2025 +0000 inet_diag: annotate data-races in inet_diag_bc_sk() inet_diag_bc_sk() runs with an unlocked socket, annotate potential races with READ_ONCE(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250828102738.2065992-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8e60447f0831cdcafa2233e5547ee0eba8a5f8da Author: Eric Dumazet Date: Thu Aug 28 10:27:35 2025 +0000 tcp: annotate data-races in tcp_req_diag_fill() req->num_retrans and rsk_timer.expires are read locklessly, and can be changed from tcp_rtx_synack(). Add READ_ONCE()/WRITE_ONCE() annotations. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250828102738.2065992-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9a574257b968426df5c180df1199d4b082f80ff9 Author: Eric Dumazet Date: Thu Aug 28 10:27:34 2025 +0000 inet_diag: annotate data-races in inet_diag_msg_common_fill() inet_diag_msg_common_fill() can run without socket lock. Add READ_ONCE() or data_race() annotations. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250828102738.2065992-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 34c21e91192aa1ff66f9d6cef8132717840d04e6 Author: Parthiban Veerasooran Date: Thu Aug 28 17:15:49 2025 +0530 microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support Introduce support for standard MII ioctl operations in the LAN865x Ethernet driver by implementing the .ndo_eth_ioctl callback. This allows PHY-related ioctl commands to be handled via phy_do_ioctl_running() and enables support for ethtool and other user-space tools that rely on ioctl interface to perform PHY register access using commands like SIOCGMIIREG and SIOCSMIIREG. This feature enables improved diagnostics and PHY configuration capabilities from userspace. Signed-off-by: Parthiban Veerasooran Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250828114549.46116-1-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 2a63607bfda920664aa7171dcca089cd4b273e31 Author: Liao Yuanhong Date: Thu Aug 28 16:39:38 2025 +0800 vsock/test: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250828083938.400872-1-liaoyuanhong@vivo.com Signed-off-by: Jakub Kicinski commit d90e7b56406032a6175e79de3d7e884185f6be71 Author: Mauro Carvalho Chehab Date: Mon Aug 25 14:04:55 2025 +0200 docs: conf.py: drop xindy rule The rule as-is is wrong, as it was inverted. Besides that, after retest building all repos with suggested LaTeX packages given by sphinx-pre-install, I was unable to reproduce the issues I saw with xindy in the past. So, let's just drop. If anyone reports issues with xindy, we may need to readd, but at the right way, e.g. {options}{pkgname}. Reported-by: Akira Yokosawa Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/83068bc31839e7095f1f408e49658362d467797e.1756123459.git.mchehab+huawei@kernel.org commit ec1a37468f15b5fa69ecd01f49a0d818ed559943 Author: Bagas Sanjaya Date: Tue Aug 19 13:12:53 2025 +0700 Documentation: sharedsubtree: Convert notes to note directive While a few of the notes are already in reST syntax, others are left intact (inconsistent). Convert them to reST syntax too. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819061254.31220-6-bagasdotme@gmail.com commit b293fd55a1b8925b9b0578dca88d93eaaa6942c5 Author: Bagas Sanjaya Date: Tue Aug 19 13:12:52 2025 +0700 Documentation: sharedsubtree: Align text The docs make heavy use of lists. As it is currently written, these generate a lot of unnecessary hanging indents since these are not semantically meant to be definition lists by accident. Align text to trim these indents. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819061254.31220-5-bagasdotme@gmail.com commit 570924bf17de3e0c86c0502e8a20f6017e17bbb2 Author: Bagas Sanjaya Date: Tue Aug 19 13:12:51 2025 +0700 Documentation: sharedsubtree: Don't repeat lists with explanation Don't repeat lists only mentioning the items when a corresponding list with item's explanations suffices. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819061254.31220-4-bagasdotme@gmail.com commit a8886b42d57b8280e0c064779d87030266d9c7ce Author: Bagas Sanjaya Date: Tue Aug 19 13:12:50 2025 +0700 Documentation: sharedsubtree: Use proper enumerator sequence for enumerated lists Sphinx does not recognize mixed-letter sequences (e.g. 2a) as enumerator for enumerated lists. As such, lists that use such sequences end up as definition lists instead. Use proper enumeration sequences for this purpose. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819061254.31220-3-bagasdotme@gmail.com commit 69c6739d671df58b9f034b94ac8310f569e2b632 Author: Bagas Sanjaya Date: Tue Aug 19 13:12:49 2025 +0700 Documentation: sharedsubtree: Format remaining of shell snippets as literal code blcoks Fix formatting inconsistency of shell snippets by wrapping the remaining of them in literal code blocks. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819061254.31220-2-bagasdotme@gmail.com commit 050e711a48f18a6ce661ecf1b736dc07534f384a Merge: 8898cf86f04346 d1d31e2739ff06 Author: Linus Walleij Date: Sat Aug 30 00:34:49 2025 +0200 Merge tag 'renesas-pinctrl-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.18 - Add support for Output Enable (OEN) on RZ/G3E, - Add support for the RZ/T2H and RZ/N2H SoCs, - Miscellaneous fixes and improvements. Signed-off-by: Linus Walleij commit 8898cf86f043468d285a474d1614e5cf1a170b16 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:47 2025 -0500 dt-bindings: pinctrl: Convert brcm,iproc-gpio to DT schema Convert the Broadcom iProc/Cygnus GPIO/Pinconf binding to DT schema format. The child node structure is based on the example as there's not any actual .dts files with child nodes. The binding wasn't clear that "reg" can be 1 or 2 entries. The number of "reg" entries doesn't appear to be based on compatible, so no per compatible constraints for it The "brcm,iproc-stingray-gpio" could possibly be dropped. There are no .dts files using it, but the driver uses it. Signed-off-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/20250812203348.733749-1-robh@kernel.org Signed-off-by: Linus Walleij commit 7d1c5e52ec1549adc4394b6e2f38278fc671e522 Author: Mallikarjun Thammanavar Date: Tue Aug 19 12:46:04 2025 +0000 docs: fix spelling and grammar in atomic_writes Fix minor spelling and grammatical issues in the ext4 atomic_writes documentation. Signed-off-by: Mallikarjun Thammanavar Reviewed-by: Randy Dunlap Reviewed-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819124604.8995-1-mallikarjunst09@gmail.com commit 2b31c1c7134a316a0c97da5d7bdbe15552101db3 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:34 2025 -0500 dt-bindings: pinctrl: Convert brcm,bcm2835-gpio to DT schema Convert the Broadcom BCM2835 GPIO (and pinmux) controller binding to DT schema format. The structure of the child nodes wasn't well defined. The schema is based on the .dts users. The legacy binding is a single level of child nodes while the standard binding is 2 levels of child nodes. The "all banks" interrupt is treated as optional following actual users. Signed-off-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/20250812203337.731648-1-robh@kernel.org Signed-off-by: Linus Walleij commit ddfaddc27724fddc07eaf2365ffdd23702f8d8e4 Author: Vivek Alurkar Date: Wed Aug 20 22:16:21 2025 -0700 Fix typo in RAID arrays documentation Changed "write-throuth" to "write-through". Signed-off-by: Vivek Alurkar Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250821051622.8341-2-primalkenja@gmail.com commit e49c93e151803992ed5b0d888d9dd47aa21bc7a0 Merge: 0e58316d6a8772 f7c41911ad7441 Author: Mark Brown Date: Fri Aug 29 23:19:57 2025 +0100 ASoC: SOF: ipc4: Add support for 8-bit and float Merge series from Peter Ujfalusi : This series will add support for various 8-bit and float formats. commit 0e58316d6a877231b3ece367ab9b445cb429b8ba Merge: 0b1d93750f1c77 d57d27171c92e9 Author: Mark Brown Date: Fri Aug 29 23:19:49 2025 +0100 ASoC: SOF: sof-client-probes-ipc4: Query available Merge series from Peter Ujfalusi : This series improves the IPC4 probes implementation by improving the report quality and adds support for querying the available probes on the firmware side. commit 0b1d93750f1c771c92b26832d5a6bdd6641dee03 Merge: 4c14b076e81181 07752abfa5dbf7 Author: Mark Brown Date: Fri Aug 29 23:19:42 2025 +0100 ASoC: SOF: sof-client: Enforce client access scope Merge series from Peter Ujfalusi : Up to this point we had a spoken rule what sof-client can access and what they must not (they cannot use sdev directly), recently there were attempts to break this rule as clients could access sdev via the sof client dev. The series will re-arrange the client device struct to 'hide' the sdev (and the list) from client drivers to prevent abuse. commit 4c14b076e81181ad05531f8cdce609e6c308f720 Merge: 3d439e1ec3368f 5c39bc498f5ff7 Author: Mark Brown Date: Fri Aug 29 23:19:35 2025 +0100 ASoC: SOF: Intel: only detect codecs when HDA DSP Merge series from Peter Ujfalusi : SDW codecs use the global HDaudio WAKEEN/STS to detect wakes since LNL. But the wakeen is handled in the SDW driver. We should filter the bus->codec_mask to only include HDA and IDISP codecs to avoid clearing the wakeen status before it is handled. commit ba653158f40deccb3f79005bf1d5c6c37d45b247 Author: Alperen Aksu Date: Thu Aug 21 13:13:47 2025 +0000 Documentation/filesystems/xfs: Fix typo error Fixed typo error in referring to the section's headline Fixed to correct spelling of "mapping" Signed-off-by: Alperen Aksu Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250821131404.25461-1-aksulperen@gmail.com commit c67a9f492c3c15ef1695c629bf5cc57f674a8e83 Merge: 61578493ca7f9d aebcc3009ed555 Author: Jonathan Corbet Date: Fri Aug 29 15:58:48 2025 -0600 Merge branch 'mauro' into docs-mw Another build series from Mauro: The goal of this series is to drop one of the most ancient and ugliest hack from the documentation build system. Before migrating to Sphinx, the media subsystem already had a very comprehensive uAPI book, together with a build time system to detect and point for any documentation gaps. When migrating to Sphinx, we ported the logic to a Perl script (parse-headers.pl) and Markus came up with a Sphinx extension (kernel_include.py). We also added some files to control how parse-headers produce results, and a Makefile. At the initial Sphinx versions (1.4.1 if I recall correctly), when a new symbol is added to videodev2.h, a new warning were produced at documentatiion time, it the patchset didn't have the corresponding documentation path. While kernel-include is generic, the only user at the moment is the media subsystem. This series gets rid of the Python script, replacing it by a command line script and a class. The parse header class can optionally be used by kernel-include to produce an enriched code that will contain cross-references. As the other conversions, it starts with a bug-compatible version of parse-headers, but the subsequent patches add more functionalities and fix bugs. It should be noticed that modern of Sphinx disabled the cross-reference warnings. So, at the next series, I'll be re-adding it in a controlled way (e.g. just for the references from kernel-include that has an special argument). The script also supports now generating a "toc" output, which will be used at the next series. commit aebcc3009ed55564b74378945206642a372c3e27 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:36 2025 +0200 docs: sphinx: drop parse-headers.pl Now that we have a replacement in place, drop the old version. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/d3a5397df44e53b02fa62f782d1e7ce6e08ed04f.1755872208.git.mchehab+huawei@kernel.org commit 8a298579cdfcfdbcb70bb7af5e30769387494f37 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:35 2025 +0200 scripts: sphinx-build-wrapper: get rid of uapi/media Makefile Now that kernel-include directive supports parsing data structs directly, we can finally get rid of the horrible hack we added to support parsing media uAPI symbols. As a side effect, Documentation/output doesn't have anymore media auto-generated .rst files on it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/5dbb257a4b283697271c9c7b8f4713857e8191c8.1755872208.git.mchehab+huawei@kernel.org commit a49adfab496f7720fcd588d454b36bfb7922051e Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:34 2025 +0200 docs: kernel_include.py: document all supported parameters As we're actually a fork of Sphinx Include, update its docstring to contain the documentation for the actual implemented parameters. Let's use :param: for parameters, as defined at: https://sphinx-rtd-tutorial.readthedocs.io/en/latest/docstrings.html Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/f193160889a2dc296b4df2cc7ebc9934d717ccef.1755872208.git.mchehab+huawei@kernel.org commit 428c1d35118fb755e12a0e5d2745632d4cf3a76e Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:33 2025 +0200 docs: kernel_include.py: remove Include class inheritance While the original code came from the Sphinx Include class, such class is monolithic: it has only one function that does everything, and 3 variables that are used: - required_arguments - optional_arguments - option_spec So, basically those are the only members that remain from the original class, but hey! Those are the same vars that every other Sphinx directive extension has to define! In summary, keeping inheritance here doesn't make much sense. Worse than that, kernel-include doesn't support the current set of options that the original Include class has, but it also has its own set of options. So, let's fill in the argument vars with what it does support, dropping the rest. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a9f2eebf11c6b0c3a2e3bf42e71392cdfd2835d1.1755872208.git.mchehab+huawei@kernel.org commit 4aa578f9c087d58d841e3dfbde1bf57483d9e696 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:32 2025 +0200 docs: kernel_include.py: remove line numbers from parsed-literal When parsed-literal directive is added to rawtext, while cross references will be properly displayed, Sphinx will ignore line numbers. So, it is not worth adding them. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b484fe5fcbf6e5217f112f205fbf54f0bbc3dcca.1755872208.git.mchehab+huawei@kernel.org commit 01dba1680cb4047d4f6e057276f805f93b7eea00 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:31 2025 +0200 docs: kernel_include.py: move apply_range() and add a docstring While not required, better to have caller functions at the end. As apply_range() is now called by xref_text(), move it to be before the latter. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a6ce0fd7c03a01338753fd81ed0c4631f78311d6.1755872208.git.mchehab+huawei@kernel.org commit 4ad9cabc34d1b45ef77fa9c70e446658f6f5934b Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:30 2025 +0200 docs: kernel_include.py: append line numbers to better report errors It is best to point to the original line of code that generated an error than to point to the beginning of a directive. Add support for it. It should be noticed that this won't work for literal or code blocks, as Sphinx will ignore it, pointing to the beginning of the directive. Yet, when the output is known to be in ReST format, like on TOC, this makes the error a lot more easier to be handled. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a0953af8b71e64aaf2e0ba4593ad39e19587d50a.1755872208.git.mchehab+huawei@kernel.org commit e4d91787deffffa64abd397315d4f7e4a3cf02f3 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:29 2025 +0200 docs: kernel_include.py: add support to generate a TOC table When generate-cross-refs is used, instead of just implementing the default of generating a literal block, we can also generate a ReST file as a TOC. The advantage is that, by being a ReST file, missing references will point to the place inside the header file that has the broken link. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/c0d32cd1ef94017e05984b0a38bd2516f7db21e2.1755872208.git.mchehab+huawei@kernel.org commit 9be2a5c3c8b7aad78341677002c428c996cc9570 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:28 2025 +0200 docs: kernel_include.py: move code and literal functions Simplify run() even more by moving the code which handles with code and literal blocks to their own functions. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/78d08dfa3f08adabc30bf93b8a1cde4e19b7bd41.1755872208.git.mchehab+huawei@kernel.org commit 67faed5d213d87f3b5bdfc78a12d1d9d3e7aac46 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:27 2025 +0200 docs: kernel_include.py: remove range restriction for gen docs Originally, parse-readers were generating an output where the first two lines were setting a literal block. The script now gets only the actual parsed data without that, so it is now safe to allow start-line and end-line parameters to be handled. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/5dff693860a6a3faade15c24abdc380f09db468d.1755872208.git.mchehab+huawei@kernel.org commit 3f7f3d494119170dc6636228e8425048effa2931 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:26 2025 +0200 docs: kernel_include.py: move range logic to a separate function Cleanup run() function by moving the range logic to a separate function. Here, I ended checking the current Sphinx implementation, as it has some extra logic for the range check. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/12fa2204a9e7e309ae4b8694a37ebad9327ca634.1755872208.git.mchehab+huawei@kernel.org commit 012e00dda347e72a6079c6d21f0c8f97333cc477 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:25 2025 +0200 docs: kernel_include.py: move rawtext logic to separate functions The run function is too complex. merge run() and _run() into a single function and move the read logic to separate functions. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/04776a94c85b6c931c198a149f08b299c9f571a3.1755872208.git.mchehab+huawei@kernel.org commit 39f5f2fa8c959eb897416e928d12f6aec1e7d5e4 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:24 2025 +0200 docs: kernel_include.py: generate warnings for broken refs In the past, Sphinx used to warn about broken references. That's basically the rationale for adding media uAPI files: to get warnings about missed symbols. This is not true anymore. So, we need to explicitly check them after doctree-resolved event. While here, move setup() to the end, to make it closer to what we do on other extensions. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/73be9a198746421687e2eee916ccf8bf67980b7d.1755872208.git.mchehab+huawei@kernel.org commit 0cb6aee3584604ceecdbc3bcc00d017f9a827873 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:23 2025 +0200 docs: kernel_include.py: allow cross-reference generation kernel_include extension was originally designed to be used by the media comprehensive uAPI documentation, where, instead of simpler kernel-doc markups, the uAPI documentation is enriched with a larger text, with images, complex tables, graphs, etc. There, we wanted to include the much simpler yet documented .h file. This extension is needed to include files from other parts of the Kernel tree outside Documentation, because the original Sphinx include tag doesn't allow going outside of the directory passed via sphinx-build command line. Yet, the cross-references themselves to the full documentation were using a perl script to create cross-references against the comprehensive documentation. As the perl script is now converted to Phython and there is a Python class producing an include-compatible output with cross references, add two optional arguments to kernel_include.py: 1. :generate-cross-refs: If present, instead of reading the file, it calls ParseDataStructs() class, which converts C data structures into cross-references to be linked to ReST files containing a more comprehensive documentation; Don't use it together with :start-line: and/or :end-line:, as filtering input file line range is currently not supported. 2. :exception-file: Used together with :generate-cross-refs:. Points to a file containing rules to ignore C data structs or to use a different reference name, optionally using a different reference type. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/efc39c8e54a2056ae2fdb94d5006fcb19e227198.1755872208.git.mchehab+huawei@kernel.org commit bb979965008793635a630ecdc7a3869c2fccd283 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:22 2025 +0200 docs: kernel_include.py: Update its coding style With the help of tools like black, pylint, autopep8 and flake, improve the code style in preparation for further changes. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/f64c3af47fdfd632bb5f8eb88e3c7d94b0b84a66.1755872208.git.mchehab+huawei@kernel.org commit 319d2a7ebe8ecf3377099a84d49f9b0043242c23 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:21 2025 +0200 docs: uapi: media: Makefile: use parse-headers.py Now that we have a new parser, use it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/7025759744f74058eee55c35e8cd8cb5a2953fca.1755872208.git.mchehab+huawei@kernel.org commit 99198814e5b307d2748f82d12c1c91129f0aead5 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:20 2025 +0200 MAINTAINERS: add files from tools/docs to documentation entry As we now have a tools directory for docs, add it to its corresponding entry. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/87bbb94e442fe747e24f801d7685856b392b2568.1755872208.git.mchehab+huawei@kernel.org commit 242cfe3f774e8a41d0b27d4664247f58d0a8d039 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:19 2025 +0200 tools: docs: parse_data_structs.py: add methods to return output When running it from command line, we want to write an output file, but when used as a class, one may just want the output content returned as a string. Split write_output() on two methods to allow both usecases. Also add an extra method to produce a TOC. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/c98bdec3380aad54178baf2751a2f1fcd128576b.1755872208.git.mchehab+huawei@kernel.org commit cde494660f561909ad44a27037c7155454159136 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:18 2025 +0200 tools: docs: parse-headers.py: move it from sphinx dir As suggested by Jon, we should start having a tools/docs directory, instead of placing everything under scripts. In the specific case of parse-headers.py, the previous location is where we're placing Sphinx extensions, which is not the right place for execs. Move it to tools/docs/parse-headers.py. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0f5ac2d704cffe9834e589b39549d2393e1237ef.1755872208.git.mchehab+huawei@kernel.org commit 37497a4dc5ecd40f861fad3a436978394d1e97fa Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:17 2025 +0200 docs: parse-headers.py: simplify the rules for hashes Normal :ref domain accept either hashes or underscores, but c-domain ones don't. Fix it and remove unneeded places where we opt to disable underscore transformation. Ideally, we should have a rule about the default, or change the way media docs have their references. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0c011090272f7a1068545409222f970ddb1ed431.1755872208.git.mchehab+huawei@kernel.org commit 285b8d3db2bae79c01d604701c3faddb456aca93 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:16 2025 +0200 docs: parse-headers.py: better handle @var arguments The kernel-doc markups inside headers may contain @var markups. With the current rule, this would be converted into: \* @:c:type:`DMX_BUFFER_FLAG_DISCONTINUITY_INDICATOR `\: Fix it adding a non-printed space if needed. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/8d06bb713d6ec8de65179dd93defe479715409b6.1755872208.git.mchehab+huawei@kernel.org commit a2d58c917c3e0d0cd161e343261717dbe96ffe22 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:15 2025 +0200 docs: parse-headers.py: improve --help logic When printing --help, we'd like the name of the files from __doc__ to match the displayed positional arguments at both usage and argument description lines. Use a custom formatter class to convert ``foo`` into ANSI SGR code to bold the argument, if is TTY, and adjust the help text to match the argument names. Here on Plasma, that makes it display it colored, wich is really cool. Yet, I opted for SGR, as the best is to follow the terminal color schema for bold. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/2c1e61d1fb1b2a2838b443beee89c1528831997f.1755872208.git.mchehab+huawei@kernel.org commit 8a5a85be4df1ab0642d4a3610691dbaed443d4d0 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:14 2025 +0200 docs: parse-headers.py: convert parse-headers.pl When the Kernel started to use Sphinx, we had to come up with a solution to parse media headers. On that time, we didn't have much experience with Sphinx extensions. So, we came up with our own script-based solution that were basically implementing a set of rules we used to have at the Makefile. Convert it to Python, keeping it bug-compatible with the original script. While here, try to better document it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/ae5cfa8dff37e280cc9493fc95a51cd0cc0ba127.1755872208.git.mchehab+huawei@kernel.org commit b5698da669401ed3f51add92f80457703f0937e3 Author: Mauro Carvalho Chehab Date: Fri Aug 22 16:19:13 2025 +0200 docs: parse-headers.pl: improve its debug output format Change the --debug logic to help comparing its results with a new python script. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/1064011717951eac257889a3032303c9d4440711.1755872208.git.mchehab+huawei@kernel.org commit 61578493ca7f9d4acd804544f3f5651f5124b12f Author: Bagas Sanjaya Date: Tue Aug 26 09:47:56 2025 +0700 Documentation: ocfs2: Properly reindent filecheck operations list Some of texts in filecheck operations list are indented out of the list. In particular, the third operation is shown not as the third list item but rather as a separate paragraph. Reindent the list so that gets properly rendered as such. Signed-off-by: Bagas Sanjaya Acked-by: Joseph Qi Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250826024756.16073-1-bagasdotme@gmail.com commit 2dddb2792b2ea6571ff44e46a6f7f11400073c9a Author: Alex Tran Date: Wed Aug 27 00:45:25 2025 -0700 docs: driver-api pinctrl cleanup Replace FIXME comments in the pinctrl documentation example with proper cleanup code: - Add devm_pinctrl_put() calls in error paths (pinctrl_lookup_state, pinctrl_select_state) after successful devm_pinctrl_get() - Set foo->p to NULL when devm_pinctrl_get() fails - Add ret variable for cleaner error handling - provides proper example of pinctrl resource management on failure Signed-off-by: Alex Tran Reviewed-by: Linus Walleij Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250827074525.685863-1-alex.t.tran@gmail.com commit f3e82936857b3bd77b824ecd2fa7839dd99ec0c6 Author: Liao Yuanhong Date: Fri Aug 15 21:36:43 2025 +0800 drm/nouveau: Replace redundant return value judgment with PTR_ERR_OR_ZERO() Replace redundant return value judgment with PTR_ERR_OR_ZERO() to enhance code readability. Signed-off-by: Liao Yuanhong Signed-off-by: Lyude Paul Link: https://lore.kernel.org/r/20250815133643.418089-1-liaoyuanhong@vivo.com commit b639c20e748cbe2962fd0c0cef22c0d354842fd5 Author: Liao Yuanhong Date: Thu Aug 28 16:11:30 2025 +0800 f2fs: Use allocate_section_policy to control write priority in multi-devices setups Introduces two new sys nodes: allocate_section_hint and allocate_section_policy. The allocate_section_hint identifies the boundary between devices, measured in sections; it defaults to the end of the device for single storage setups, and the end of the first device for multiple storage setups. The allocate_section_policy determines the write strategy, with a default value of 0 for normal sequential write strategy. A value of 1 prioritizes writes before the allocate_section_hint, while a value of 2 prioritizes writes after it. This strategy addresses the issue where, despite F2FS supporting multiple devices, SOC vendors lack multi-devices support (currently only supporting zoned devices). As a workaround, multiple storage devices are mapped to a single dm device. Both this workaround and the F2FS multi-devices solution may require prioritizing writing to certain devices, such as a device with better performance or when switching is needed due to performance degradation near a device's end. For scenarios with more than two devices, sort them at mount time to utilize this feature. When using this feature with a single storage device, it has almost no impact. However, for configurations where multiple storage devices are mapped to the same dm device using F2FS, utilizing this feature can provide some optimization benefits. Therefore, I believe it should not be limited to just multi-devices usage. Signed-off-by: Liao Yuanhong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4f54dff818d7b5b1d84becd5d90bc46e6233c0d7 Author: Qingfang Deng Date: Thu Aug 28 09:20:17 2025 +0800 pppoe: drop sock reference counting on fast path Now that PPPoE sockets are freed via RCU (SOCK_RCU_FREE), it is no longer necessary to take a reference count when looking up sockets on the receive path. Readers are protected by RCU, so the socket memory remains valid until after a grace period. Convert fast-path lookups to avoid refcounting: - Replace get_item() and sk_receive_skb() in pppoe_rcv() with __get_item() and __sk_receive_skb(). - Rework get_item_by_addr() into __get_item_by_addr() (no refcount and move RCU lock into pppoe_ioctl) - Remove unnecessary sock_put() calls. This avoids cacheline bouncing from atomic reference counting and improves performance on the receive fast path. Signed-off-by: Qingfang Deng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250828012018.15922-2-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 72cdc67e7fa74931b055df3a76852bab551f1a04 Author: Qingfang Deng Date: Thu Aug 28 09:20:16 2025 +0800 pppoe: remove rwlock usage Like ppp_generic.c, convert the PPPoE socket hash table to use RCU for lookups and a spinlock for updates. This removes rwlock usage and allows lockless readers on the fast path. - Mark hash table and list pointers as __rcu. - Use spin_lock() to protect writers. - Readers use rcu_dereference() under rcu_read_lock(). All known callers of get_item() already hold the RCU read lock, so no additional locking is needed. - get_item() now uses refcount_inc_not_zero() instead of sock_hold() to safely take a reference. This prevents crashes if a socket is already in the process of being freed (sk_refcnt == 0). - Set SOCK_RCU_FREE to defer socket freeing until after an RCU grace period. - Move skb_queue_purge() into sk_destruct callback to ensure purge happens after an RCU grace period. Signed-off-by: Qingfang Deng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250828012018.15922-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit ad79935dbc227fad7172dc50970ee579ff21a91e Author: Keguang Zhang Date: Wed Jul 16 19:25:18 2025 +0800 MIPS: configs: Consolidate Loongson1 defconfigs Unify loongson{1b,1c}_defconfig into a single loongson1_defconfig. Enable the following options by default: - CONFIG_SERIAL_OF_PLATFORM - CONFIG_RTC_DRV_LOONGSON - CONFIG_LOONGSON1_APB_DMA - CONFIG_MTD_NAND_LOONGSON1 - CONFIG_SND_LOONGSON1_AC97 Also disable unnecessary options. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 2d18f2343e44317697c5623fb387c90914c377da Author: Keguang Zhang Date: Wed Jul 16 19:25:17 2025 +0800 MIPS: Unify Loongson1 PRID_REV LS1B and LS1C share the same PRID value, so unify them into a single definition: PRID_REV_LOONGSON1. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 85c4354076ca2f84f6473073005174905880e998 Author: Keguang Zhang Date: Wed Jul 16 19:25:16 2025 +0800 MIPS: loongson32: Switch to generic core The generic MIPS core is fully compatible with Loongson-1 SoCs, so migrate Loongson-1 to it. Main changes are: - Merge CPU_LOONGSON1B and CPU_LOONGSON1C into a unified CPU_LOONGSON32, as both are based on the GS232 core. - Consolidate LOONGSON1_LS1B and LOONGSON1_LS1C Kconfig options into MACH_LOONGSON32. - Enable MACH_GENERIC_CORE and remove the legacy custom implementation. - Remove all Loongson-1 platform devices and associated code, which are now obsolete due to Device Tree support. - Misc cleanup. Partially based on earlier work by Jiaxun Yang. Link: https://lore.kernel.org/all/20190411121915.8040-4-jiaxun.yang@flygoat.com/ Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit ec7c2a107a59a60079eff3308e791a3441231f2e Author: Keguang Zhang Date: Wed Jul 16 19:25:15 2025 +0800 MIPS: loongson: Add built-in DTB support Since the current bootloader for Loongson-1 does not support FDT, introduce CONFIG_BUILTIN_DTB_NAME to enable a built-in DTB. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 11741215e287454bd4c6e9a4872790a1a2c0e0ae Author: Keguang Zhang Date: Wed Jul 16 19:25:14 2025 +0800 MIPS: dts: loongson: Add CQ-T300B board Add a device tree for CQ-T300B board. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit cf4b382a92f4fea09f5987e5757b4979fd255cb2 Author: Keguang Zhang Date: Wed Jul 16 19:25:13 2025 +0800 MIPS: dts: loongson: Add Smartloong-1C board Add a device tree for Smartloong-1C board, supporting CPU, clock, INTC, UART, Ethernet, GPIO, USB host, RTC, watchdog, DMA, and NAND. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 9c607077294a25bd597cfcfb3f832707b5b88426 Author: Keguang Zhang Date: Wed Jul 16 19:25:12 2025 +0800 MIPS: dts: loongson: Add LSGZ_1B_DEV board Add a device tree for LSGZ_1B_DEV board. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 6428fcf27f0248b076b381408c98102f88564926 Author: Keguang Zhang Date: Wed Jul 16 19:25:11 2025 +0800 MIPS: dts: loongson: Add LS1B-DEMO board Add a device tree for LS1B-DEMO board, supporting CPU, clock, INTC, UART, Ethernet, GPIO, USB host, RTC, watchdog, DMA, NAND, and AC97. Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit cfbb794c62291cd8249def0d10cae922b717b53e Author: Keguang Zhang Date: Wed Jul 16 19:25:10 2025 +0800 dt-bindings: mips: loongson: Add LS1B-DEMO and CQ-T300B Document two Loongson-1 boards: - loongson,ls1b-demo: a board based on Loongson-1B - loongson,cq-t300b: a board based on Loongson-1C Acked-by: Krzysztof Kozlowski Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be Author: Aleksander Jan Bajkowski Date: Fri Aug 15 14:12:24 2025 +0200 mips: lantiq: danube: rename stp node on EASY50712 reference board This fixes the following warning: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$' from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml# Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 Author: Aleksander Jan Bajkowski Date: Fri Aug 15 14:12:23 2025 +0200 mips: lantiq: xway: sysctrl: rename stp clock Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch changes the clock name from “stp” to “gpio”. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit 51f96bff04b05ee0683471fa33b11cce414e4b56 Author: Thorsten Blum Date: Tue Aug 19 12:24:17 2025 +0200 MIPS: RB532: Replace deprecated strcpy() with memcpy() and strscpy() strcpy() is deprecated; use memcpy() and strscpy() instead. Add the local variable 'size_t len' to keep track of the string lengths and prefer memcpy() over strscpy() when we use the string length to advance the 'cp' pointer. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit b7c1ee2dfe03c106a391cdbcba8d41e23c4b1bcb Author: Thorsten Blum Date: Tue Aug 19 12:23:19 2025 +0200 MIPS: Loongson64: Replace deprecated strcpy() with strscpy_pad() strcpy() is deprecated; use strscpy_pad() instead. strscpy_pad() already copies the source strings and zero-pads the tail of the destination buffers, making the explicit initializations to zero redundant. Remove them to ensure the buffers are only written to once. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit 6a1e6bf933b6216cc3eb731a14cd519c189d3a04 Author: Thorsten Blum Date: Sun Aug 17 20:37:18 2025 +0200 MIPS: generic: Replace deprecated strcpy() in ocelot_detect() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit e34b690f58da12c4301932bb3cf9857879b2396f Author: Thorsten Blum Date: Sun Aug 17 20:37:17 2025 +0200 MIPS: octeon: Replace deprecated strcpy() in octeon_model_get_string_buffer() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit 2c7c8cf656b2712ece061346848664ab5ace72c6 Author: Thorsten Blum Date: Sun Aug 17 20:37:16 2025 +0200 MIPS: octeon: Replace memset(0) + deprecated strcpy() with strscpy_pad() Replace memset(0) followed by the deprecated strcpy() with strscpy_pad() to improve octeon_fdt_set_phy(). This avoids zeroing the memory before copying the string and ensures the destination buffer is only written to once, simplifying the code and improving efficiency. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Justin Stitt Signed-off-by: Thomas Bogendoerfer commit 267ac0a800121dd450d0ed6cdbba9a8712b48c59 Author: Thorsten Blum Date: Sun Aug 17 20:37:15 2025 +0200 MIPS: arc: Replace deprecated strcpy() with memcpy() strcpy() is deprecated; use memcpy() instead. Use pr_debug() instead of printk(KERN_DEBUG) to silence a checkpatch warning. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit 19b32dbba0c7f4ab2fb7349676ffcb40a70be0fa Author: Thorsten Blum Date: Sun Aug 17 20:37:14 2025 +0200 MIPS: txx9: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Geert Uytterhoeven Signed-off-by: Thomas Bogendoerfer commit 5861bb3ea24c8c7ab1d619b59b777a4c56777142 Author: Thorsten Blum Date: Sun Aug 17 20:37:13 2025 +0200 MIPS: sni: Replace deprecated strcpy() in sni_console_setup() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Justin Stitt Signed-off-by: Thomas Bogendoerfer commit 5cd39d00c257ea01eeab4ad36c0d4474e143655e Author: Thorsten Blum Date: Sun Aug 17 20:37:12 2025 +0200 MIPS: sgi-ip32: Replace deprecated strcpy() in plat_mem_setup() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Thomas Bogendoerfer commit e5a6d4a23acfe56749c7543ef55c54b8b903616b Author: Thorsten Blum Date: Sun Aug 17 20:37:11 2025 +0200 MIPS: sgi-ip22: Replace deprecated strcpy() in plat_mem_setup() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Justin Stitt Signed-off-by: Thomas Bogendoerfer commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 Author: Aleksander Jan Bajkowski Date: Tue Aug 12 16:06:04 2025 +0200 mips: lantiq: danube: add model to EASY50712 dts This fixes the following warning: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property from schema $id: http://devicetree.org/schemas/root-node.yaml# Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit d66949a1875352d2ddd52b144333288952a9e36f Author: Aleksander Jan Bajkowski Date: Mon Aug 11 15:34:13 2025 +0200 mips: lantiq: danube: add missing device_type in pci node This fixes the following warning: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml# Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit e8dee66c37085dc9858eb8608bc783c2900e50e7 Author: Aleksander Jan Bajkowski Date: Mon Aug 11 13:58:15 2025 +0200 mips: lantiq: danube: add missing properties to cpu node This fixes the following warnings: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property from schema $id: http://devicetree.org/schemas/cpus.yaml# arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property from schema $id: http://devicetree.org/schemas/cpus.yaml# arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property from schema $id: http://devicetree.org/schemas/mips/cpus.yaml# Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit 1ea149fb5b068c1b7490451d967216ff554628af Author: Aleksander Jan Bajkowski Date: Mon Aug 11 11:20:36 2025 +0200 dt-bindings: mips: cpu: Add MIPS 34Kc Core Document MIPS 34Kc device tree bindings. It is used in the Realtek RTL930x SoC. Signed-off-by: Aleksander Jan Bajkowski Acked-by: Conor Dooley Signed-off-by: Thomas Bogendoerfer commit dba4380504923b9c21d391bc9a3e699d3ba2bab6 Author: Brian Masney Date: Sun Aug 10 18:30:23 2025 -0400 MIPS: Alchemy: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Note that prior to running Coccinelle, alchemy_clk_aux_roundr() was renamed to alchemy_clk_aux_round_rate(). A few minor style cleanups were also done by hand. Signed-off-by: Brian Masney Tested-by: Manuel Lauss Signed-off-by: Thomas Bogendoerfer commit 157f9533f9ffb5d9544515dcfe54e0901d9aa615 Author: Thomas Huth Date: Mon Aug 4 08:56:29 2025 +0200 mips: Replace __ASSEMBLY__ with __ASSEMBLER__ in the mips headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembler code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. Defining such a macro was necessary in the early days of the kernel, since GCC only started providing __ASSEMBLER__ since version 3.0 in 2000 (see https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=f8f769ea4e69 ). However, having two macros can be very confusing nowadays for the developers when switching between userspace and kernelspace coding, or when dealing with uapi headers that should use __ASSEMBLER__ instead. So let's now standardize on the __ASSEMBLER__ macro that is provided by the compilers. This is almost a completely mechanical patch (done with a simple "sed -i" statement), with just one comment tweaked manually in arch/mips/include/asm/cpu.h (that was missing some underscores). Cc: Thomas Bogendoerfer Cc: linux-mips@vger.kernel.org Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Maciej W. Rozycki Signed-off-by: Thomas Huth Signed-off-by: Thomas Bogendoerfer commit 21050b589fb00997256c4ecaeee0cb0e46f30891 Author: Florian Fainelli Date: Tue Jul 29 13:52:13 2025 -0700 MIPS: BMIPS: Properly define memory controller compatible With the DT binding updated with 501be7cecec9 ("dt-bindings: memory-controller: Define fallback compatible") we need to define a proper compatible string for the memory controller node(s). Signed-off-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer commit 3d439e1ec3368fae17db379354bd7a9e568ca0ab Author: Jyri Sarha Date: Fri Aug 29 18:11:01 2025 +0300 ASoC: sof: ipc4-topology: Add support to sched_domain attribute Add SOF_TKN_COMP_SCHED_DOMAIN and connect it to struct snd_sof_widget comp_domain member, with new get_token_comp_domain() function. The logic is such that if the topology attribute is not present in the widget node the corresponding IPC4 extension value is taken from the module's manifest like before. But if the attribute is found and recognized its value overrides what is there in the manifest. Signed-off-by: Jyri Sarha Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Message-ID: <20250829151101.27327-1-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit d23ad54de795ec0054f90ecb03b41e8f2c410f3a Merge: 29828b81a46a3a 9c736ace0666ef Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc4). No conflicts. Adjacent changes: drivers/net/ethernet/intel/idpf/idpf_txrx.c 02614eee26fb ("idpf: do not linearize big TSO packets") 6c4e68480238 ("idpf: remove obsolete stashing code") Signed-off-by: Jakub Kicinski commit 05e75ac35ee9e38f96bbfebf1830ec2cace2e7f8 Author: Geert Uytterhoeven Date: Tue Aug 12 15:54:29 2025 +0200 efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text People not very intimate with EFI may not know the meaning of the OVMF acronym. Write it in full, to help users with making good decisions when configuring their kernels. Fixes: f393a761763c5427 ("efi: add ovmf debug log driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Richard Lyu Acked-by: Gerd Hoffmann Signed-off-by: Ard Biesheuvel commit 093458c58f830d0a713fab0de037df5f0ce24fef Author: Alex Williamson Date: Thu Aug 28 14:36:24 2025 -0600 docs: proc.rst: Fix VFIO Device title formatting Title underline is one character too short. Cc: Alex Mastro Cc: Jonathan Corbet Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250828123035.2f0c74e7@canb.auug.org.au Fixes: 1e736f148956 ("vfio/pci: print vfio-device syspath to fdinfo") Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250828203629.283418-1-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit 362f92286065d9f8282da5def89e173a12191568 Author: Eric Biggers Date: Wed Aug 27 08:11:31 2025 -0700 lib/crypto: tests: Add KUnit tests for BLAKE2s Add a KUnit test suite for BLAKE2s. Most of the core test logic is in the previously-added hash-test-template.h. This commit just adds the actual KUnit suite, commits the generated test vectors to the tree so that gen-hash-testvecs.py won't have to be run at build time, and adds a few BLAKE2s-specific test cases. This is the replacement for blake2s-selftest, which an earlier commit removed. Improvements over blake2s-selftest include integration with KUnit, more comprehensive test cases, and support for benchmarking. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 39ee3970f26d55b57343da392d45117d7f893205 Author: Eric Biggers Date: Wed Aug 27 08:11:30 2025 -0700 lib/crypto: blake2s: Consolidate into single C translation unit As was done with the other algorithms, reorganize the BLAKE2s code so that the generic implementation and the arch-specific "glue" code is consolidated into a single translation unit, so that the compiler will inline the functions and automatically decide whether to include the generic code in the resulting binary or not. Similarly, also consolidate the build rules into lib/crypto/{Makefile,Kconfig}. This removes the last uses of lib/crypto/{arm,x86}/{Makefile,Kconfig}, so remove those too. Don't keep the !KMSAN dependency. It was needed only for other algorithms such as ChaCha that initialize memory from assembly code. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 5d313a7625fabe9b92eaca7c5ce0e6d1019d279a Author: Eric Biggers Date: Wed Aug 27 08:11:29 2025 -0700 lib/crypto: blake2s: Move generic code into blake2s.c Move blake2s_compress_generic() from blake2s-generic.c to blake2s.c. For now it's still guarded by CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC, but this prepares for changing it to a 'static __maybe_unused' function and just using the compiler to automatically decide its inclusion. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 56e48d4e138cb105a17e0f8c257f3bc41b1bd69d Author: Eric Biggers Date: Wed Aug 27 08:11:28 2025 -0700 lib/crypto: blake2s: Always enable arch-optimized BLAKE2s code When support for a crypto algorithm is enabled, the arch-optimized implementation of that algorithm should be enabled too. We've learned this the hard way many times over the years: people regularly forget to enable the arch-optimized implementations of the crypto algorithms, resulting in significant performance being left on the table. Currently, BLAKE2s support is always enabled ('obj-y'), since random.c uses it. Therefore, the arch-optimized BLAKE2s code, which exists for ARM and x86_64, should be always enabled too. Let's do that. Note that the effect on kernel image size is very small and should not be a concern. On ARM, enabling CRYPTO_BLAKE2S_ARM actually *shrinks* the kernel size by about 1200 bytes, since the ARM-optimized blake2s_compress() completely replaces the generic blake2s_compress(). On x86_64, enabling CRYPTO_BLAKE2S_X86 increases the kernel size by about 1400 bytes, as the generic blake2s_compress() is still included as a fallback; however, for context, that is only about a quarter the size of the generic blake2s_compress(). The x86_64 optimized BLAKE2s code uses much less icache at runtime than the generic code. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 126f5d90f6c855b39eebec17f93c2f9d2ce01ebb Author: Eric Biggers Date: Wed Aug 27 08:11:27 2025 -0700 lib/crypto: blake2s: Remove obsolete self-test Remove the original BLAKE2s self-test, since it will be superseded by blake2s_kunit. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 453eda46b7f807f6fc4283f9639085697100ec08 Author: Eric Biggers Date: Wed Aug 27 08:11:26 2025 -0700 lib/crypto: x86/blake2s: Reduce size of BLAKE2S_SIGMA2 Save 480 bytes of .rodata by replacing the .long constants with .bytes, and using the vpmovzxbd instruction to expand them. Also update the code to do the loads before incrementing %rax rather than after. This avoids the need for the first load to use an offset. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 13cecc526d8fe7eeb9b136159738688a1a10cd82 Author: Eric Biggers Date: Wed Aug 27 08:11:25 2025 -0700 lib/crypto: chacha: Consolidate into single module Consolidate the ChaCha code into a single module (excluding chacha-block-generic.c which remains always built-in for random.c), similar to various other algorithms: - Each arch now provides a header file lib/crypto/$(SRCARCH)/chacha.h, replacing lib/crypto/$(SRCARCH)/chacha*.c. The header defines chacha_crypt_arch() and hchacha_block_arch(). It is included by lib/crypto/chacha.c, and thus the code gets built into the single libchacha module, with improved inlining in some cases. - Whether arch-optimized ChaCha is buildable is now controlled centrally by lib/crypto/Kconfig instead of by lib/crypto/$(SRCARCH)/Kconfig. The conditions for enabling it remain the same as before, and it remains enabled by default. - Any additional arch-specific translation units for the optimized ChaCha code, such as assembly files, are now compiled by lib/crypto/Makefile instead of lib/crypto/$(SRCARCH)/Makefile. This removes the last use for the Makefile and Kconfig files in the arm64, mips, powerpc, riscv, and s390 subdirectories of lib/crypto/. So also remove those files and the references to them. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1ae46b6eb5b9a97978fe12a71f5de53ab977297f Author: Eric Biggers Date: Wed Aug 27 08:11:24 2025 -0700 lib/crypto: chacha: Rename libchacha.c to chacha.c Rename libchacha.c to chacha.c to make the naming consistent with other algorithms and allow additional source files to be added to the libchacha module. This file currently contains chacha_crypt_generic(), but it will soon be updated to contain chacha_crypt(). Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 20a1acb68d7a16481b70a693d49c2a42882f57a9 Author: Eric Biggers Date: Wed Aug 27 08:11:23 2025 -0700 lib/crypto: chacha: Rename chacha.c to chacha-block-generic.c Rename chacha.c to chacha-block-generic.c to free up the name chacha.c for the high-level API entry points (chacha_crypt() and hchacha_block()), similar to the other algorithms. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c4b846ff6ecab0427cc7dcccbe0af60b244a6d56 Author: Eric Biggers Date: Wed Aug 27 08:11:22 2025 -0700 lib/crypto: chacha: Remove unused function chacha_is_arch_optimized() chacha_is_arch_optimized() is no longer used, so remove it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9dd6bb667ecccba0e895c920473c14f374d925c5 Author: Eric Biggers Date: Wed Aug 27 08:11:21 2025 -0700 crypto: chacha - register only "-lib" drivers For the "chacha20", "xchacha20", and "xchacha12" skcipher algorithms, instead of registering "*-generic" drivers as well as conditionally registering "*-$(ARCH)" drivers, instead just register "*-lib" drivers. These just use the regular library functions, so they just do the right thing and are fully accelerated when supported by the CPU. This eliminates the need for the ChaCha library to support chacha_crypt_generic() and hchacha_block_generic() as part of its external interface. A later commit will make chacha_crypt_generic() a static function. Since this commit removes several "*-generic" driver names which crypto/testmgr.c expects to exist, update testmgr.c accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8bc48d603c95917f48145f3a5a0fa25172fdba2c Author: Eric Biggers Date: Wed Aug 27 08:11:20 2025 -0700 arm: configs: Remove obsolete assignments to CRYPTO_CHACHA20_NEON Since v6.15, CRYPTO_CHACHA20_NEON is a hidden option and is selected automatically. Therefore, assigning a value to it in a defconfig no longer has any effect. Remove it from all files that did this. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250827151131.27733-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit bef9c755986980eecc18e9cecd847bc3c037aebb Author: Zhihang Shao Date: Fri Aug 29 08:25:13 2025 -0700 lib/crypto: riscv/poly1305: Import OpenSSL/CRYPTOGAMS implementation This is a straight import of the OpenSSL/CRYPTOGAMS Poly1305 implementation for riscv authored by Andy Polyakov. The file 'poly1305-riscv.pl' is taken straight from https://github.com/dot-asm/cryptogams commit 5e3fba73576244708a752fa61a8e93e587f271bb. This patch was tested on SpacemiT X60, with 2~2.5x improvement over generic implementation. Signed-off-by: Chunyan Zhang Signed-off-by: Zhihang Shao [EB: ported to lib/crypto/riscv/] Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250829152513.92459-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b646b782e522da3509e61f971e5502fccb3a3723 Author: Eric Biggers Date: Fri Aug 29 08:25:12 2025 -0700 lib/crypto: poly1305: Consolidate into single module Consolidate the Poly1305 code into a single module, similar to various other algorithms (SHA-1, SHA-256, SHA-512, etc.): - Each arch now provides a header file lib/crypto/$(SRCARCH)/poly1305.h, replacing lib/crypto/$(SRCARCH)/poly1305*.c. The header defines poly1305_block_init(), poly1305_blocks(), poly1305_emit(), and optionally poly1305_mod_init_arch(). It is included by lib/crypto/poly1305.c, and thus the code gets built into the single libpoly1305 module, with improved inlining in some cases. - Whether arch-optimized Poly1305 is buildable is now controlled centrally by lib/crypto/Kconfig instead of by lib/crypto/$(SRCARCH)/Kconfig. The conditions for enabling it remain the same as before, and it remains enabled by default. (The PPC64 one remains unconditionally disabled due to 'depends on BROKEN'.) - Any additional arch-specific translation units for the optimized Poly1305 code, such as assembly files, are now compiled by lib/crypto/Makefile instead of lib/crypto/$(SRCARCH)/Makefile. A special consideration is needed because the Adiantum code uses the poly1305_core_*() functions directly. For now, just carry forward that approach. This means retaining the CRYPTO_LIB_POLY1305_GENERIC kconfig symbol, and keeping the poly1305_core_*() functions in separate translation units. So it's not quite as streamlined I've done with the other hash functions, but we still get a single libpoly1305 module. Note: to see the diff from the arm, arm64, and x86 .c files to the new .h files, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250829152513.92459-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit df220cc5e689213c34a0eec7ef26d25f503c77ae Author: Eric Biggers Date: Fri Aug 29 08:25:11 2025 -0700 lib/crypto: poly1305: Remove unused function poly1305_is_arch_optimized() poly1305_is_arch_optimized() is unused, so remove it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250829152513.92459-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 214ae22e6d4f774f053a8f7d32bd6a9874447b06 Author: Claudiu Beznea Date: Wed Aug 27 13:13:52 2025 +0300 rpmsg: core: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250827101352.927542-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mathieu Poirier commit 2433961962be8b8ff32058763339b818128e8ff0 Author: Christophe JAILLET Date: Sun Aug 24 21:52:37 2025 +0200 remoteproc: k3: Correctly release some resources allocated in k3_rproc_request_mbox() If an error occurs after a successful k3_rproc_request_mbox() call, mbox_free_channel() should be called to avoid a leak. Such a call is missing in the error handling path of k3_dsp_rproc_probe(). It is also missing both in the error handling path of k3_m4_rproc_probe() and in the (in-existent) corresponding remove function. Switch to managed resources to avoid these leaks and simplify the code. Remove the now unneeded mbox_free_channel(). Signed-off-by: Christophe JAILLET Reviewed-by: Beleswar Padhi Tested-by: Beleswar Padhi Link: https://lore.kernel.org/r/df853ede72e9972c464415990b196289680e6acb.1756065142.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mathieu Poirier commit 24de3daf6179bce3710527b8292d7ee6f1b56393 Author: Qianfeng Rong Date: Thu Aug 28 11:39:17 2025 +0800 accel/amdxdna: Use int instead of u32 to store error codes Change the 'ret' variable from u32 to int to store -EINVAL. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may trigger a GCC warning when the -Wsign-conversion flag is enabled. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Signed-off-by: Qianfeng Rong Reviewed-by: Lizhi Hou Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com commit 9ca595f501e48cec41c6c56becda6468a409b8ba Author: Danilo Krummrich Date: Fri Aug 29 09:55:39 2025 +0200 drm/test: drm_exec: use kzalloc() to allocate GEM objects Since commit e7fa80e2932c ("drm_gem: add mutex to drm_gem_object.gpuva") it is possible for test_prepare_array() to exceed a stack frame size of 2048 bytes depending on the exact configuration of the kernel. drivers/gpu/drm/tests/drm_exec_test.c: In function ‘test_prepare_array’: drivers/gpu/drm/tests/drm_exec_test.c:171:1: error: the frame size of 2128 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] 171 | } | ^ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/tests/drm_exec_test.o] Error 1 make[6]: *** Waiting for unfinished jobs.... In order to fix this, allocate the GEM objects in test_prepare_array() with kzalloc(), rather than placing them on the stack. Cc: Alice Ryhl Cc: Christian König Fixes: e7fa80e2932c ("drm_gem: add mutex to drm_gem_object.gpuva") Reviewed-by: Christian König Reviewed-by: Alice Ryhl Reviewed-by: Nirmoy Das Link: https://lore.kernel.org/r/20250829075633.2306-1-dakr@kernel.org [ Use kunit_kzalloc() instead of kzalloc(). - Danilo ] Signed-off-by: Danilo Krummrich commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd Author: Timur Kristóf Date: Thu Aug 28 16:50:36 2025 +0200 drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) Update the legacy (non-DC) display code to respect the maximum pixel clock for HDMI and DVI-D. Reject modes that would require a higher pixel clock than can be supported. Also update the maximum supported HDMI clock value depending on the ASIC type. For reference, see the DC code: check max_hdmi_pixel_clock in dce*_resource.c v2: Fix maximum clocks for DVI-D and DVI/HDMI adapters. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 220b2bd529fa660d7df802a30730373af9345dd8 Author: Taimur Hassan Date: Fri Aug 22 16:17:11 2025 -0500 drm/amd/display: Promote DC to 3.2.348 Summary: * Refactor bounding box values handling * Fix incorrect condition to fail dto clk calculation * Skip check downlink setting for a certain MST branch device * Fix double cursor issue on dcn314 Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Reviewed-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5e610ed48a0df10aabd4fa17d7cee012dddf21e4 Author: Taimur Hassan Date: Fri Aug 22 16:13:17 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.25.0 Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Reviewed-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 16f2e14ee9429586dd58dc7ac1f5fc0755a0a0c6 Author: Fangzhi Zuo Date: Thu Aug 14 14:41:44 2025 -0400 drm/amd/display: Skip Check Runtime Link Setting for Specific Branch Device [why] Read link setting inside mode validation is not always the final downlink setting. It is found true in Synaptics branch device. At bootup, the preferred mode being set right after 1080p is set. It occurred before graphic load. That modeset switch in a short period of time makes the branch device switch back and forth from lower and higher link rate, observed at Synaptics branch device. DP2 RTK hub on the other hand, sticks to highest available downlink rate after bootup. Existing check of runtime downlink setting in mode validation shows asynchronous at branch device link switch, i.e., downlink switch to higher link rate not yet complete when the mode validation tries to probe the downlink setting. That makes mode validation checking downlink setting making wrong decision by pruning modes that should pass the validation after the downlink setting switch is complete. [how] If Synaptics is found at the last branch, skip checking downlink setting at mode validation. Reviewed-by: Wayne Lin Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 645f74f1dc119dad5a2c7bbc05cc315e76883011 Author: Ivan Lipski Date: Wed Aug 20 15:46:52 2025 -0400 drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG [Why&How] ON DCN314, clearing DPP SW structure without power gating it can cause a double cursor in full screen with non-native scaling. A W/A that clears CURSOR0_CONTROL cursor_enable flag if dcn10_plane_atomic_power_down is called and DPP power gating is disabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4168 Reviewed-by: Sun peng (Leo) Li Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 306cbcc6f687d791ab3cc8fbbe30f5286fd0d1e5 Author: Clay King Date: Wed Aug 20 15:04:29 2025 -0400 drm/amd/display: incorrect conditions for failing dto calculations [Why & How] Previously, when calculating dto phase, we would incorrectly fail when phase <=0 without additionally checking for the integer value. This meant that calculations would incorrectly fail when the desired pixel clock was an exact multiple of the reference clock. Reviewed-by: Dillon Varone Signed-off-by: Clay King Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit cf49a454e16675fad59c1080f909a7e51192a494 Author: Austin Zheng Date: Thu Aug 14 09:54:45 2025 -0400 drm/amd/display: Add Component To Handle Bounding Box Values and IP Caps [Why] Bounding box values can be stored in multiple locations. (e.g. PMFW, VBIOS, DMUB). The source and interpretation of these values can vary with DCN revision so there should be a component that can gather these values and translate them accordingly [How] Have component start with the statically defined values as a base. Then update them as needed with DCN-specific logic Guard this component with FPU flags since values need to be in float point. Reviewed-by: Jun Lei Signed-off-by: Austin Zheng Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit de63b05593573cb0106875452c706ebaf6faa8f7 Author: Mario Limonciello Date: Tue Aug 19 11:29:05 2025 -0500 drm/amd/display: Optimize custom brightness curve interpolation [Why] Custom brightness curve works by walking through all data points one by one. When the brightness value is at either extreme this is a lot of data points to walk. This is especially noticeable when moving a brightness slider around how it can lag. [How] Bisect the data points to find the closest for interpolation. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 002a612023c8b105bd3829d81862dee04368d6de Author: Relja Vojvodic Date: Thu Aug 14 11:33:22 2025 -0400 drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting [Why] -Pipe splitting allows for clocks to be reduced, but when using TMDS 420, reduced clocks lead to missed clocks cycles on clock resyncing [How] -Impose a minimum clock when using TMDS 420 Reviewed-by: Chris Park Signed-off-by: Relja Vojvodic Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5eeb16ca727f11278b2917fd4311a7d7efb0bbd6 Author: Alex Deucher Date: Wed Aug 6 10:47:50 2025 -0400 drm/amdgpu: drop hw access in non-DC audio fini We already disable the audio pins in hw_fini so there is no need to do it again in sw_fini. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4481 Cc: oushixiong Signed-off-by: Alex Deucher commit c2fbf72fe3c2d08856e834ca43328a8829a261d8 Author: Mario Limonciello Date: Thu Aug 28 09:37:05 2025 -0500 drm/amd: Re-enable common modes for eDP and LVDS [Why] Although compositors will add their own modes, Xorg won't use it's own modes and will only stick to modes advertised by the driver. This mean a user that used to pick 1024x768 could no longer access it unless the panel's native resolution was 1024x768. [How] Revert commit 6d396e7ac1ce3 ("drm/amd/display: Disable common modes for LVDS") and commit 7948afb46af92 ("drm/amd/display: Disable common modes for eDP"). The panel will still use scaling for any non-native modes due to commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") Reported-by: Marek Marczykowski-Górecki Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250828140856.2887993-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 9f28af76fab0948b59673f69c10aeec47de11c60 Author: Alex Deucher Date: Wed Aug 27 14:24:31 2025 -0400 drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal If the firmware is too old, just warn and return success. Fixes: 27b791514789 ("drm/amdgpu/mes: keep enforce isolation up to date") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4414 Cc: shaoyun.Liu@amd.com Reviewed-by: Shaoyun.liu Signed-off-by: Alex Deucher commit edc9d17ea17b9d4eb7b6474a922364bb23652f9a Author: Lijo Lazar Date: Mon Aug 18 11:44:28 2025 +0530 drm/amd/pm: Make use of __free for cleanup Use __free(kfree) for memory alloc cleanups in SMUv13.0.6 Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 9c0442286f84a5036958b3d8eb00bf0bb070dbd1 Author: Lijo Lazar Date: Thu Aug 14 13:52:50 2025 +0530 drm/amdgpu: Check vcn state before profile switch The patch uses power state of VCN instances for requesting video profile. In idle worker of a vcn instance, when there is no outstanding submisssion or fence, the instance is put to power gated state. When all instances are powered off that means video profile is no longer required. A request is made to turn off video profile. A job submission starts with begin_use of ring, and at that time vcn instance state is changed to power on. Subsequently a check is made for active video profile, and if not active, a request is made. Fixes: 3b669df92c85 ("drm/amdgpu/vcn: adjust workload profile handling") Signed-off-by: Lijo Lazar Reviewed-by: Sathishkumar S Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 37551277dfed796b6749e4fa52bdb62403cfdb42 Author: Mangesh Gadre Date: Mon Aug 25 21:22:30 2025 +0800 drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest Sriov guest side doesn't init ras feature hence the poison irq shouldn't be put during hw fini Signed-off-by: Mangesh Gadre Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 01152c30eef972c5ca3b3eeb14f2984fa48d18c2 Author: Mangesh Gadre Date: Mon Aug 25 21:18:42 2025 +0800 drm/amdgpu: Avoid jpeg v5.0.1 poison irq call trace on sriov guest Sriov guest side doesn't init ras feature hence the poison irq shouldn't be put during hw fini Signed-off-by: Mangesh Gadre Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 89c3503bc6b65493696dd202e0d9f037450d4cbf Author: Yang Wang Date: Mon Aug 25 09:38:32 2025 +0800 drm/amd/amdgpu: unified amdgpu ip block name v1: 1. Unified amdgpu ip block name print with format "{ip_type}_v{major}_{minor}_{rev}" 2. Avoid IP block name conflicts for SMU/PSP ip block v2: Update IP block print format to keep legacy IP block name (Alex) "{ip_type}_v{major}_{minor}_{rev} ({funcs->name})" Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit aab8b689aded255425db3d80c0030d1ba02fe2ef Author: Jesse.Zhang Date: Wed Aug 27 13:29:17 2025 +0800 drm/amdgpu/sdma: bump firmware version checks for user queue support Using the previous firmware could lead to problems with PROTECTED_FENCE_SIGNAL commands, specifically causing register conflicts between MCU_DBG0 and MCU_DBG1. The updated firmware versions ensure proper alignment and unification of the SDMA_SUBOP_PROTECTED_FENCE_SIGNAL value with SDMA 7.x, resolving these hardware coordination issues Fixes: e8cca30d8b34 ("drm/amdgpu/sdma6: add ucode version checks for userq support") Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit c8d6e90abe50377110f92702fbebc6efdd22391d Author: Xiang Liu Date: Wed Aug 27 09:40:27 2025 +0800 drm/amdgpu: Notify pmfw bad page threshold exceeded Notify pmfw when bad page threshold is exceeded, no matter the module parameter 'bad_page_threshold' is set or not. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b1d83546cf55816c60d6e953ebd0dd008f17be9e Author: David (Ming Qiang) Wu Date: Mon Aug 25 15:42:23 2025 -0400 drm/amdgpu/vcn: add instance number to VCN version message For multiple VCN instances case we get multiple lines of the same message like below: amdgpu 0000:43:00.0: amdgpu: Found VCN firmware Version ENC: 1.24 DEC: 9 VEP: 0 Revision: 11 amdgpu 0000:43:00.0: amdgpu: Found VCN firmware Version ENC: 1.24 DEC: 9 VEP: 0 Revision: 11 By adding instance number to the log message for multiple VCN instances, each line will clearly indicate which VCN instance it refers to. Reviewed-by: Alex Deucher Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 010219ccec738e5cd03ea65878d6a61ce404d560 Author: David (Ming Qiang) Wu Date: Mon Aug 25 15:15:42 2025 -0400 drm/amdgpu/vcn: remove unused code in vcn_v4_0.c Reviewed-by: Alex Deucher Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 14570c649aef0e80126b7e12710c65564283aa5f Author: Qianfeng Rong Date: Sat Aug 16 22:23:05 2025 +0800 drm/amd/display: use max() to improve code Use max() to reduce the code and improve readability. No functional changes. Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit 7563e21a977f1e77212ecbe081d632b70689b9f7 Author: Kavithesh A.S Date: Sun Aug 24 01:55:40 2025 +0530 drm/amd/display: Document num_rmcm_3dluts in mpc_color_caps Fix a kernel-doc warning by documenting the num_rmcm_3dluts member of struct mpc_color_caps. v2: improve comment (Melissa) Signed-off-by: Kavithesh A.S Signed-off-by: Alex Deucher commit 03c69957c46ccdd042741c818460332c650f3ccf Author: Yugansh Mittal Date: Sun Aug 24 17:20:51 2025 +0530 drm/amdgpu: atomfirmware.h: fix multiple spelling mistakes This patch corrects several typographical errors in atomfirmware.h. The fixes improve readability and maintain consistency in the codebase. No functional changes are introduced. Corrected terms include: - aligment → alignment - Offest → Offset - defintion → definition - swithing → switching - calcualted → calculated - compability → compatibility - intenal → internal - sequece → sequence - indiate → indicate - stucture → structure - regiser → register Signed-off-by: Yugansh Mittal Signed-off-by: Alex Deucher commit 1047bd82794a1eab64d643f196d09171ce983f44 Author: Thomas Hellström Date: Thu Aug 28 15:48:37 2025 +0200 drm/xe: Fix incorrect migration of backed-up object to VRAM If an object is backed up to shmem it is incorrectly identified as not having valid data by the move code. This means moving to VRAM skips the -EMULTIHOP step and the bo is cleared. This causes all sorts of weird behaviour on DGFX if an already evicted object is targeted by the shrinker. Fix this by using ttm_tt_is_swapped() to identify backed-up objects. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5996 Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: Matthew Brost Cc: Matthew Auld Cc: # v6.15+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250828134837.5709-1-thomas.hellstrom@linux.intel.com commit 7d9bc9bee2778e2da7147aeb3a81427487598493 Author: Maíra Canal Date: Tue Aug 26 11:19:03 2025 -0300 drm/v3d: Protect per-fd reset counter against fd release The per-fd reset counter tracks GPU resets caused by jobs submitted through a specific file descriptor. However, there's a race condition where the file descriptor can be closed while jobs are still running, leading to potential access to freed memory when updating the reset counter. Ensure that the per-fd reset counter is only updated when the file descriptor is still valid, preventing use-after-free scenarios during GPU reset handling. Reviewed-by: Iago Toral Quiroga Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-6-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit 78fe02d090d38393cc00de9d1929e59426f202a4 Author: Maíra Canal Date: Tue Aug 26 11:19:02 2025 -0300 drm/v3d: Synchronous operations can't timeout CPU jobs and CACHE CLEAN jobs execute synchronously once the DRM scheduler starts running them. Therefore, there is no fence to wait on, neither are those jobs able to timeout. Hence, remove the `timedout_job` hook from the CPU and CACHE CLEAN scheduler ops. Reviewed-by: Iago Toral Quiroga Reviewed-by: Melissa Wen Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-5-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit fa6a20c8747041df406d184321a2a49e82d46298 Author: Maíra Canal Date: Tue Aug 26 11:19:01 2025 -0300 drm/v3d: Address race-condition between per-fd GPU stats and fd release When the file descriptor is closed while a job is still running, there's a race condition between the job completion callback and the file descriptor cleanup. This can lead to accessing freed memory when updating per-fd GPU stats, such as the following example: [56120.512903] Unable to handle kernel paging request at virtual address 0000330a92b9688a [56120.520881] Mem abort info: [56120.523687] ESR = 0x0000000096000005 [56120.527454] EC = 0x25: DABT (current EL), IL = 32 bits [56120.532785] SET = 0, FnV = 0 [56120.535847] EA = 0, S1PTW = 0 [56120.538995] FSC = 0x05: level 1 translation fault [56120.543891] Data abort info: [56120.546778] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [56120.552289] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [56120.557362] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [56120.562690] user pgtable: 16k pages, 47-bit VAs, pgdp=0000000023f54000 [56120.569239] [0000330a92b9688a] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [56120.577975] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP CPU: 0 UID: 1000 PID: 1497409 Comm: mpv Not tainted 6.12.37-ncvm5+ #1 Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : v3d_job_update_stats+0x64/0x168 [v3d] lr : v3d_job_update_stats+0x40/0x168 [v3d] sp : ffffc00080003e60 x29: ffffc00080003e60 x28: ffff800002860000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff800002860000 x24: ffff800002630800 x23: ffff800060786000 x22: 0000330a933c31fb x21: 0000000000000001 x20: 0000330a92b96302 x19: ffff800060786b10 x18: 0000000000000000 x17: ffffaf90506a0000 x16: ffffd06fce57c360 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd06f5d0fec40 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000002978dbd535a x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : 0000300001fddf88 x2 : 0000000000000020 x1 : 0000000000010001 x0 : 0000330a92b96872 Call trace: v3d_job_update_stats+0x64/0x168 [v3d] v3d_irq+0x118/0x2e0 [v3d] __handle_irq_event_percpu+0x60/0x220 Fix such an issue by protecting all accesses to `job->file_priv` with the queue's lock. With that, we can clear `job->file_priv` before the V3D per-fd structure is freed and assure that `job->file_priv` exists during the per-fd GPU stats updates. Fixes: e1bc3a13bd77 ("drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`") Reviewed-by: Iago Toral Quiroga Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-4-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit e9d8e027483267a9505f5b6b7f0476b5299743af Author: Maíra Canal Date: Tue Aug 26 11:19:00 2025 -0300 drm/v3d: Replace a global spinlock with a per-queue spinlock Each V3D queue works independently and all the dependencies between the jobs are handled through the DRM scheduler. Therefore, there is no need to use one single lock for all queues. Using it, creates unnecessary contention between different queues that can operate independently. Replace the global spinlock with per-queue locks to improve parallelism and reduce contention between different V3D queues (BIN, RENDER, TFU, CSD). This allows independent queues to operate concurrently while maintaining proper synchronization within each queue. Reviewed-by: Iago Toral Quiroga Reviewed-by: Melissa Wen Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-3-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit 0d3768826d38c0ac740f8b45cd13346630535f2b Author: Maíra Canal Date: Tue Aug 26 11:18:59 2025 -0300 drm/v3d: Store the active job inside the queue's state Instead of storing the queue's active job in four different variables, store the active job inside the queue's state. This way, it's possible to access all active jobs using an index based in `enum v3d_queue`. Reviewed-by: Iago Toral Quiroga Reviewed-by: Melissa Wen Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-2-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit e5e3d7bff7645d2577c56ccc8b110b9b6978aa08 Author: Maíra Canal Date: Tue Aug 26 11:18:58 2025 -0300 drm/v3d: Store a pointer to `struct v3d_file_priv` inside each job Instead of storing a pointer to the DRM file data, store a pointer directly to the private V3D file struct. No functional change, this commit only avoids multiple levels of pointer indirection and makes the code more straightforward. Reviewed-by: Iago Toral Quiroga Reviewed-by: Melissa Wen Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-1-979efc43e490@igalia.com Signed-off-by: Maíra Canal commit db2ab24a341ce89351a1bede37a96a3e3ce1726a Author: Lauri Vasama Date: Wed Aug 27 16:39:00 2025 +0300 Add RWF_NOSIGNAL flag for pwritev2 For a user mode library to avoid generating SIGPIPE signals (e.g. because this behaviour is not portable across operating systems) is cumbersome. It is generally bad form to change the process-wide signal mask in a library, so a local solution is needed instead. For I/O performed directly using system calls (synchronous or readiness based asynchronous) this currently involves applying a thread-specific signal mask before the operation and reverting it afterwards. This can be avoided when it is known that the file descriptor refers to neither a pipe nor a socket, but a conservative implementation must always apply the mask. This incurs the cost of two additional system calls. In the case of sockets, the existing MSG_NOSIGNAL flag can be used with send. For asynchronous I/O performed using io_uring, currently the only option (apart from MSG_NOSIGNAL for sockets), is to mask SIGPIPE entirely in the call to io_uring_enter. Thankfully io_uring_enter takes a signal mask, so only a single syscall is needed. However, copying the signal mask on every call incurs a non-zero performance penalty. Furthermore, this mask applies to all completions, meaning that if the non-signaling behaviour is desired only for some subset of operations, the desired signals must be raised manually from user-mode depending on the completed operation. Add RWF_NOSIGNAL flag for pwritev2. This flag prevents the SIGPIPE signal from being raised when writing on disconnected pipes or sockets. The flag is handled directly by the pipe filesystem and converted to the existing MSG_NOSIGNAL flag for sockets. Signed-off-by: Lauri Vasama Link: https://lore.kernel.org/20250827133901.1820771-1-git@vasama.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 9a98f9e84cfbeaa51af42ba2b8bbbde046c709a7 Author: Josef Bacik Date: Tue Aug 26 11:39:01 2025 -0400 fs: make the i_state flags an enum Adjusting i_state flags always means updating the values manually. Bring these forward into the 2020's and make a nice clean macro for defining the i_state values as an enum, providing __ variants for the cases where we need the bit position instead of the actual value, and leaving the actual NAME as the 1U << bit value. Reviewed-by: Christian Brauner Signed-off-by: Josef Bacik Link: https://lore.kernel.org/0da9348da6ece0dce12fccec07b1dd2b8e4cfdab.1756222464.git.josef@toxicpanda.com Signed-off-by: Christian Brauner commit 2d2664fdd7c705a64284b0c6e2745bbe1c859ce2 Merge: 5b9057cfafaaab e27f158cf1e98d Author: Greg Kroah-Hartman Date: Fri Aug 29 14:58:43 2025 +0200 Merge tag 'peci-next-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwi/linux into char-misc-next Iwona writes: Update peci-next for v6.18-rc1 A small change in peci-npcm driver that removes unneeded 'fast_io' parameter in regmap_config picked up as a part of wider refactoring. * tag 'peci-next-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwi/linux: peci: remove unneeded 'fast_io' parameter in regmap_config commit f4028ef65dc4fe9010bcc017597fe0fea6479097 Author: Dmitry Baryshkov Date: Wed Aug 27 16:29:04 2025 +0300 drm/bridge: adv7511: provide SPD and HDMI infoframes ADV75xx hardware supports sending SPD InfoFrame over the HDMI link. Also it provides support for two generic (Spare) InfoFrames. Use those capabilities to be able to send SPD and HDMI Vendor-Specific Infoframes. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250827-adv7511-infoframes-v1-1-f89b9690f89c@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 07752abfa5dbf7cb4d9ce69fa94dc3b12bc597d9 Author: Peter Ujfalusi Date: Fri Aug 29 13:25:10 2025 +0300 ASoC: SOF: sof-client: Introduce sof_client_dev_entry structure Introduce a new internal structure for wrapping the sof_client_dev and move members away from the client visible struct that they must not access, let alone see (sdev and the list). The changes are mechanical in nature and contained within sof-client core code, no functional change or change in behavior is introduced. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Message-ID: <20250829102510.15159-3-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 850c5dfb17b381f30c4052a68c43da5abc678e74 Author: Peter Ujfalusi Date: Fri Aug 29 13:25:09 2025 +0300 ASoC: SOF: sof-client: Convert sof_client_dev_to_sof_dev into function Remove the sof_client_dev_to_sof_dev() from the header file and add it as a function in sof-client.c to avoid it's use by client drivers. At the same time mark the sdev and list of sof_client_dev as restricted fro core use only. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Message-ID: <20250829102510.15159-2-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit d57d27171c92e9049d5301785fb38de127b28fbf Author: Jyri Sarha Date: Fri Aug 29 12:30:22 2025 +0300 ASoC: SOF: sof-client-probes: Add available points_info(), IPC4 only Add another debugfs file, "probe_points_available", that shows all the available probe points in the SOF FW at the time of query. The probe points are there only when an active SOF stream exists in the system. However, the stream identifiers are persistent in the sense that the same probe point identifiers always appear with the same playback or capture command in the same system configuration. The output, when reading "probe_points_available", may look like this: 0x1000005,0x0,0x100 host-copier.0.playback output buf idx 0 (connected) 0x7,0x0,0x100 gain.1.1 input buf idx 0 (connected) 0x1000007,0x0,0x0 gain.1.1 output buf idx 0 0x3,0x0,0x0 mixin.1.1 input buf idx 0 0x1000003,0x0,0x0 mixin.1.1 output buf idx 0 0x4,0x0,0x0 mixout.2.1 input buf idx 0 0x1000004,0x0,0x0 mixout.2.1 output buf idx 0 0x10007,0x0,0x0 gain.2.1 input buf idx 0 0x1010007,0x0,0x0 gain.2.1 output buf idx 0 0x11,0x0,0x0 smart_amp.2.1 input buf idx 0 0x1000011,0x0,0x0 smart_amp.2.1 output buf idx 0 0x10005,0x0,0x0 dai-copier.SSP.NoCodec-0.playback input buf idx 0 The triplet at the beginning of a line can be copy-pasted as such to "probe_points" debugfs file for adding a probe point. The rest of the line tries to give human readable explanation of what this probe point is. Signed-off-by: Jyri Sarha Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829093022.32094-6-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit b6082647f7222c05d34db94455a4e81981c51da1 Author: Jyri Sarha Date: Fri Aug 29 12:30:21 2025 +0300 ASoC: SOF: sof-client-probes-ipc4: Human readable debugfs "probe_points" The current output of three integers is not very human readable. Use ipc4 functions to describe in more detail what the struct sof_probe_point_desc buffer_id is actually referring to in an ipc4 SOF system. Before this commit the "probe_points" debugfs file could read as: Id: 0x01000004 Purpose: 0 Node id: 0x100 Id: 0x00000006 Purpose: 0 Node id: 0x100 And after in the same situation in an ipc4 system it reads: 0x7,0x0,0x100 gain.1.1 input buf idx 0 (connected) 0x1000005,0x0,0x100 host-copier.0.playback output buf idx 0 (connected) The triplet in the beginning of the line can be used to reinserted the probe point again by writing it into "probe_points" debugfs file, if its first removed by writing the fist number in "probe_points_remove". The last number is ignored when creating a probe point. Signed-off-by: Jyri Sarha Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829093022.32094-5-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit e6cf5e44ce1eed7aa72e7fb0cbff054e3f1dec0d Author: Jyri Sarha Date: Fri Aug 29 12:30:20 2025 +0300 ASoC: SOF: sof-client: Add sof_client_ipc4_find_swidget_by_id() Add sof_client_ipc4_find_swidget_by_id() for finding widgets from SOF client devices. The motivation is to decode probes debugfs output to be more readable. Signed-off-by: Jyri Sarha Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829093022.32094-4-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 782d4613171e271b1e28ee1db9616beb8e6ad8a1 Author: Jyri Sarha Date: Fri Aug 29 12:30:19 2025 +0300 ASoC: SOF: IPC4: Add GET macros for module id and module instance id Add SOF_IPC4_MOD_INSTANCE_GET() and SOF_IPC4_MOD_ID_GET() for getting the ids from ipc4 header presentation. Signed-off-by: Jyri Sarha Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829093022.32094-3-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 4f17845526626deda2cab181db7e19cf9265a0b3 Author: Jyri Sarha Date: Fri Aug 29 12:30:18 2025 +0300 ASoC: SOF: sof-client-probes-ipc4: Implement ipc4_probes_points_info Upgrade the struct sof_probes_ipc_ops points_info() method from dummy implementation to a working implementation. The actual functionality requires that the DSP FW supports the IPC request. The support was just recently added. If its not there an IPC failure is reported in the logs. Signed-off-by: Jyri Sarha Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829093022.32094-2-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit f7c41911ad744177d8289820f01009dc93d8f91c Author: Seppo Ingalsuo Date: Fri Aug 29 13:53:05 2025 +0300 ASoC: SOF: ipc4-topology: Add support for float sample type This patch adds support for FLOAT_LE ALSA type for playback and capture for IPC4 systems. Functions sof_ipc4_update_hw_params(), sof_ipc4_get_valid_bits() and sof_ipc4_get_sample_type() are updated to handle SOF_IPC4_TYPE_FLOAT and SNDRV_PCM_FORMAT_FLOAT_LE. Signed-off-by: Seppo Ingalsuo Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829105305.31818-4-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit c04c2e829649ab8fe5f1cfe5d7cbb34ab0463231 Author: Seppo Ingalsuo Date: Fri Aug 29 13:53:04 2025 +0300 ASoC: SOF: ipc4-topology: Add support for 8-bit formats This patch enables use of 8-bit unsigned, A-law, and mu-law sample formats with IPC4 SOF. The ipc4-topology.h is updated with IPC4 sample types. The purpose is to convert ALSA types to IPC4 types. The functions of_ipc4_update_hw_params(), sof_ipc4_get_valid_bits(), and new function sof_ipc4_get_sample_type() are updated to handle the sample type conversions. The function sof_ipc4_prepare_copier_module() is updated to set the DMA SCS bit for all non 32 bits sample types. The change to function sof_ipc4_get_valid_bits() returns 8 bits for these ALSA formats. The change to function sof_ipc4_prepare_copier_module() is needed to handle properly all non 32-bit formats with SCS bit set. To support playback with new 8 bits types, the sof_ipc4_init_input_audio_fmt() function is updated to get the sample type and use it in search for copier input pin format. To support capture, the sof_ipc4_init_output_audio_fmt() is updated similarly. Since the function uses separate out_ref_type argument, instead of single parameters struct, the out_ref_type needs to be added to every user of the function. Therefore functions sof_ipc4_prepare_copier_module(), sof_ipc4_prepare_gain_module(), sof_ipc4_prepare_mixer_module(), sof_ipc4_prepare_src_module(), and sof_ipc4_prepare_process_module() are updated to set the out_ref_type. Signed-off-by: Seppo Ingalsuo Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Message-ID: <20250829105305.31818-3-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 6ad299a9b968e1c63988e2a327295e522cf6bbf5 Author: Peter Ujfalusi Date: Fri Aug 29 13:53:03 2025 +0300 ASoC: SOF: ipc4-pcm: Add fixup for channels We can have modules in path which can change the number of channels and in this case the BE params needs to be adjusted to configure the DAI according to the copier configuration. Signed-off-by: Peter Ujfalusi Reviewed-by: Seppo Ingalsuo Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Message-ID: <20250829105305.31818-2-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 2e62688d583809e832433f461194334408b10817 Author: Sebastian Andrzej Siewior Date: Wed Aug 27 15:00:07 2025 +0200 selftests/futex: Remove the -g parameter from futex_priv_hash The -g parameter was meant to the test the immutable global hash instead of the private hash which has been made immutable. The global hash is tested as part at the end of the regular test. The immutable private hash been removed. Remove last traces of the immutable private hash. Fixes: 16adc7f136dc1 ("selftests/futex: Remove support for IMMUTABLE") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov (AMD) Reviewed-by: André Almeida Link: https://lore.kernel.org/20250827130011.677600-2-bigeasy@linutronix.de commit 38d1227fa71d96b470172df50e241775a802a8e7 Author: Xichao Zhao Date: Fri Aug 29 17:15:10 2025 +0800 fs: Replace offsetof() with struct_size() in ioctl_file_dedupe_range() When dealing with structures containing flexible arrays, struct_size() provides additional compile-time checks compared to offsetof(). This enhances code robustness and reduces the risk of potential errors. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/20250829091510.597858-1-zhao.xichao@vivo.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 12d7b0f093d39daccb2a4eab0ebc0b3abb08c7f8 Author: Colin Ian King Date: Tue Jul 29 12:21:41 2025 +0100 mips/octeon/smp: Remove space before newline There is an extraneous space before a newline in a pr_info message. Remove it. Signed-off-by: Colin Ian King Signed-off-by: Thomas Bogendoerfer commit da24e6b3c251d6ef6964b78f198f6dfd5385d372 Author: Takashi Iwai Date: Wed Aug 27 10:05:17 2025 +0200 ALSA: seq: oss/rw: Cleanup with guard Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-12-tiwai@suse.de commit 80ccbe91adab52a2b9a0e8b31663d4ec2a914a77 Author: Takashi Iwai Date: Wed Aug 27 10:05:16 2025 +0200 ALSA: seq: oss/synth: Clean up with guard and auto cleanup Use the auto-cleanup for the refcount management of seq_oss_synth object. The explicit call of snd_use_lock_free() is dropped by the magic __free(seq_oss_synth) attribute. Along with that, replace the manual mutex and spin locks with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-11-tiwai@suse.de commit 895a46e034f9aa11779c66f0bb41c51f50b265ef Author: Takashi Iwai Date: Wed Aug 27 10:05:15 2025 +0200 ALSA: seq: oss/midi: Cleanup with guard and auto-cleanup Use the auto-cleanup for the refcount management of seq_oss_midi object. The explicit call of snd_use_lock_free() is dropped by the magic __free(seq_oss_midi) attribute. Along with that, replace the manual mutex and spin locks with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-10-tiwai@suse.de commit 1291fc664d2320af332e0f6b3c28a1a4e125fee9 Author: Takashi Iwai Date: Wed Aug 27 10:05:14 2025 +0200 ALSA: seq: oss: Clean up core code with guard() Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-9-tiwai@suse.de commit 9314e34e37292f2d3d43dcc8a7f54366b4c0811d Author: Takashi Iwai Date: Wed Aug 27 10:05:13 2025 +0200 ALSA: seq: Clean up fifo locking with guard Yet more cleanup, now for seq_fifo.c about its refcount calls; the manual refcount calls (either snd_use_lock_*() or snd_seq_fifo_lock()) are replaced with guard(snd_seq_fifo). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-8-tiwai@suse.de commit 04a86185b7853971786d1d4b375b5544edd8d44d Author: Takashi Iwai Date: Wed Aug 27 10:05:12 2025 +0200 ALSA: seq: Clean up queue locking with auto cleanup Yet more cleanup with the auto-cleanup macro: now we replace the queuefree() calls with the magic pointer attribute __free(snd_seq_queue). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-7-tiwai@suse.de commit 0869afc958a05e8413dfac3c4a6a456bc0b2fd66 Author: Takashi Iwai Date: Wed Aug 27 10:05:11 2025 +0200 ALSA: seq: Clean up port locking with auto cleanup Like the previous change in seq_clientmgr.c, introduce a new auto-cleanup macro for the snd_seq_port_unlock(), and apply it appropriately. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-6-tiwai@suse.de commit 99e16633958b50ab4f9b6d171aca2c7be7bcab8c Author: Takashi Iwai Date: Wed Aug 27 10:05:10 2025 +0200 ALSA: seq: Use auto-cleanup for client refcounting The current code manages the refcount of client in a way like: snd_seq_client *client; client = clientptr(id); .... snd_seq_client_unlock(client); Now we introduce an auto-cleanup macro to manage the unlock implicitly, namely, the above will be replaced like: snd_seq_client *client __free(snd_seq_client) = NULL; client = clientptr(id); and we can forget the unref call. A part of the code in snd_seq_deliver_single_event() is factored out to a function, so that the auto-cleanups can be applied cleanly. This also allows us to replace some left mutex lock/unlock with guard(), and also reduce scoped_guard() to the normal guard(), too. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-5-tiwai@suse.de commit d7cd16143bd8796f526806bfced721bd00dbb43e Author: Takashi Iwai Date: Wed Aug 27 10:05:09 2025 +0200 ALSA: seq: Use guard() for mutex and rwsem locks There are a few manual calls of mutex and rwsem lock/unlock pairs in seq_clientmngr.c, and those can be replaced nicely with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-4-tiwai@suse.de commit e7b318eb97f47c451411c703eebe6fb15e0bd5eb Author: Takashi Iwai Date: Wed Aug 27 10:05:08 2025 +0200 ALSA: seq: Clean up spin lock with guard() Use guard() for spin locks to manage the sequencer client locking. The code about the refcounting was modified with the new snd_seq_client_ref() and *_unref() helpers instead of the ugly goto, too. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-3-tiwai@suse.de commit df2e8107f037a87459ffc0eadb0b19e2611913f9 Author: Takashi Iwai Date: Wed Aug 27 10:05:07 2025 +0200 ALSA: seq: Simplify internal command operation from OSS layer snd_seq_client_ioctl_lock() and *_unlock() are used only from a single function of the OSS layer, and it's just to wrap the call of snd_seq_kernel_client_ctl(). Provide another variant of snd_seq_kernel_client_ctl() that takes the locks internally and drop the ugly snd_seq_client_ioctl_lock() and *_unlock() implementations, instead. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827080520.7544-2-tiwai@suse.de commit cb8fc4337c7e9e8c3431d51c107f32fffd6f2318 Author: Takashi Iwai Date: Wed Aug 27 09:29:05 2025 +0200 ALSA: hda/intel: Use guard() for spinlocks Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-26-tiwai@suse.de commit 3cafe16317761bf4ea94ee6be1616dd873f698fb Author: Takashi Iwai Date: Wed Aug 27 09:29:04 2025 +0200 ALSA: hda/common: Use guard() for spinlocks Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-25-tiwai@suse.de commit 39f374ce54ca239ce02f05c26637917502bd694f Author: Takashi Iwai Date: Wed Aug 27 09:29:03 2025 +0200 ALSA: hda/core: Use guard() for spinlocks Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-24-tiwai@suse.de commit 3a4a4d06f7a69ae081f1c6b969ae0534b0c69539 Author: Takashi Iwai Date: Wed Aug 27 09:29:02 2025 +0200 ALSA: hda/ext: Use guard() for spinlocks Replace the manual spin lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-23-tiwai@suse.de commit ee0b0f5d32fe33562228096ed8edd4999be35092 Author: Takashi Iwai Date: Wed Aug 27 09:29:01 2025 +0200 ALSA: hda/generic: Use auto cleanup for temporary buffers The release of temporary kmalloced buffers can be nicely handled via the standard __free(kfree). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-22-tiwai@suse.de commit 6b12178fa06f534ff973948cffb97587ce8b1265 Author: Takashi Iwai Date: Wed Aug 27 09:29:00 2025 +0200 ALSA: hda/realtek: Use auto cleanup for temporary buffers The release of temporary kmalloced buffers can be nicely handled via the standard __free(kfree). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-21-tiwai@suse.de commit b0550d4c2dd8353f59e06139b8f3045782ce115d Author: Takashi Iwai Date: Wed Aug 27 09:28:59 2025 +0200 ALSA: hda/common: Use auto cleanup for temporary buffers The release of temporary kmalloced buffers can be nicely handled via the standard __free(kfree). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-20-tiwai@suse.de commit 59195f13ee61566091989d9d048b2768671c7b27 Author: Takashi Iwai Date: Wed Aug 27 09:28:58 2025 +0200 ALSA: hda/intel: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-19-tiwai@suse.de commit d2a8792b9747e5a08194957db24491c237740565 Author: Takashi Iwai Date: Wed Aug 27 09:28:57 2025 +0200 ALSA: hda/analog: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-18-tiwai@suse.de commit 2d0a1051de4334bafc4e7d497c48da1abe46bc9d Author: Takashi Iwai Date: Wed Aug 27 09:28:56 2025 +0200 ALSA: hda/generic: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-17-tiwai@suse.de commit 129cb64e39892982beb0059da2037d3f58b27065 Author: Takashi Iwai Date: Wed Aug 27 09:28:55 2025 +0200 ALSA: hda/component: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-16-tiwai@suse.de commit 68e51065315c40c34948d118bc04506209074879 Author: Takashi Iwai Date: Wed Aug 27 09:28:54 2025 +0200 ALSA: hda/cs8409: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-15-tiwai@suse.de commit 6f27e5f029fb665efa53cd3aa9310b915c537495 Author: Takashi Iwai Date: Wed Aug 27 09:28:53 2025 +0200 ALSA: hda/tas2781: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-14-tiwai@suse.de commit d1c374866cb42063303db48d8a6dd340858a4c9c Author: Takashi Iwai Date: Wed Aug 27 09:28:52 2025 +0200 ALSA: hda/cs35l41: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-13-tiwai@suse.de commit ece590486b59d434544c809d4e176fa4056dfcbc Author: Takashi Iwai Date: Wed Aug 27 09:28:51 2025 +0200 ALSA: hda/realtek: Use guard() for mutex locks and COEF locks Replace the manual mutex lock/unlock pairs with guard(). Also, introduce the guard() for coef_mutex_lock() and _unlock() pairs, and replace accordingly, too. The coef_mutex_lock() and *_unlock() are moved to readtek.h as static inline functions along with it. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-12-tiwai@suse.de commit 2387cf78f5fd84b72880ad15a5627f9d91fe9e98 Author: Takashi Iwai Date: Wed Aug 27 09:28:50 2025 +0200 ALSA: hda/hdmi: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-11-tiwai@suse.de commit a56ec9d33ee9c8f61ccc6a54548f34e10415c3d0 Author: Takashi Iwai Date: Wed Aug 27 09:28:49 2025 +0200 ALSA: hda/ca0132: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-10-tiwai@suse.de commit 0a930d8732fc076600c4b346a83d9b0a190aeaf0 Author: Takashi Iwai Date: Wed Aug 27 09:28:48 2025 +0200 ALSA: hda/core: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-9-tiwai@suse.de commit 62dd3851d2450a5fb2259da1f0391b5870e07577 Author: Takashi Iwai Date: Wed Aug 27 09:28:47 2025 +0200 ALSA: hda/common: Use guard() for mutex locks Replace the manual mutex lock/unlock pairs with guard(). Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-8-tiwai@suse.de commit a23160c87986732590e68c1788e9b4929950ef67 Author: Takashi Iwai Date: Wed Aug 27 09:28:46 2025 +0200 ALSA: hda: Use auto cleanup macros for DSP loader locks There are temporary DSP locking/unlocking patterns found in various places, and those can be cleaned up nicely with the guard() macro calling snd_hdac_dsp_lock() and *_unlock(). Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-7-tiwai@suse.de commit 8dad6b3dac2794c52d63b2336138392eddc17936 Author: Takashi Iwai Date: Wed Aug 27 09:28:45 2025 +0200 ALSA: hda/common: Use cleanup macros for PM controls The new macro CLASS(snd_hda_power_pm) can replace the manual snd_hda_power_up_pm() and _down() calls gracefully. A part of the code in codec_exec_verb() is factored out to a function, so that the auto-cleanup can be well scoped. Merely cleanups and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-6-tiwai@suse.de commit cee9102fcdf4d2bff4ea4b46f70cba1ff7c8accb Author: Takashi Iwai Date: Wed Aug 27 09:28:44 2025 +0200 ALSA: hda/realtek: Use cleanup macros for PM controls The new macro CLASS(snd_hda_power_pm) can replace the manual snd_hda_power_up_pm() and _down() calls gracefully. Merely code cleanups and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-5-tiwai@suse.de commit 264145020b243b354668fe0da4de2d6092c13978 Author: Takashi Iwai Date: Wed Aug 27 09:28:43 2025 +0200 ALSA: hda/hdmi: Use cleanup macros for PM controls The new macro CLASS(snd_hda_power_pm) can replace the manual snd_hda_power_up_pm() and _down() calls gracefully. Merely code cleanups and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-4-tiwai@suse.de commit e056e8e14c2e21956974712f737734e453cdb8dc Author: Takashi Iwai Date: Wed Aug 27 09:28:42 2025 +0200 ALSA: hda/ca0132: Use cleanup macros for PM controls The new macro CLASS(snd_hda_power) can replace the manual snd_hda_power_up() and _down() calls as well as the *_pm_*() variants gracefully. Merely code cleanups and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-3-tiwai@suse.de commit 5d8c9c987fbdd65677315198c2b1f35a440d7cdf Author: Takashi Iwai Date: Wed Aug 27 09:28:41 2025 +0200 ALSA: hda: Introduce auto cleanup macros for PM The temporary power up/down of the codec via snd_hda_power_up() and _down() (or snd_hda_power_up_pm() and _down_pm()) is seen in various places. This patch introduces simple auto-cleanup macros for those call patterns, so that the drivers don't have to call the corresponding power-down calls explicitly. Namely, err = snd_hda_power_up(codec); if (err < 0) return err; .... snd_power_down(codec); can drop the *_down() call by replacing with CLASS(snd_hda_power, pm)(codec); if (pm.err < 0) return pm.err; Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250827072916.31933-2-tiwai@suse.de commit 85ac6b806993200fe117f4fd047c74784ec6b515 Author: Linus Walleij Date: Fri Aug 22 19:56:16 2025 +0200 ARM: dts: Add ixp4xx Actiontec MI424WR device trees The Actiontex MI424WR is a pretty widespread home router, made in many different revisions. Revisions A, C and D are based on IXP42x. We add a device tree for the A/C variant and one for the D variant as these differ in the location of the WAN PHY on the MDIO bus, and the ethernet interfaces for the WAN PHY and the DSA switch are switched around. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/20250822-ixp4xx-mi424wr-dts-v2-3-cc804884474d@linaro.org commit 873c5c0a2baf11d7101df3fc7485a0183c8c6c29 Author: Linus Walleij Date: Fri Aug 22 19:56:15 2025 +0200 dt-bindings: arm: ixp4xx: List actiontec devices Add two IXP4xx device families from OpenWrts backlog: Actiontec MI424WR revision A/C and revision D, both of these are IXP4xx devices. Revisions E and later use different chipsets. Acked-by: Conor Dooley Signed-off-by: Linus Walleij Link: https://lore.kernel.org/20250822-ixp4xx-mi424wr-dts-v2-2-cc804884474d@linaro.org commit 400915493f53b10085648b387cdbb4da5612ebfc Author: Linus Walleij Date: Fri Aug 22 19:56:14 2025 +0200 dt-bindings: Add Actiontec vendor prefix Actiontec is a US manufacturer of telecom equipment. Acked-by: Conor Dooley Signed-off-by: Linus Walleij Link: https://lore.kernel.org/20250822-ixp4xx-mi424wr-dts-v2-1-cc804884474d@linaro.org commit 0750649b528ff18d1d68aecb45b34ec22d5ab778 Author: Martin Tůma Date: Tue Aug 26 18:28:29 2025 +0200 media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS Compare the whole v4l2_bt_timings struct, not just the width/height when setting new timings. Timings with the same resolution and different pixelclock can now be properly set. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit 039b9302d64ec35f70c91919cd7bcdbc1aef3707 Author: Jammy Huang Date: Tue Aug 26 10:25:01 2025 +0800 media: aspeed: Allow to capture from SoC display (GFX) ASPEED BMC IC has 2 different display engines. Please find AST2600's datasheet to get detailed information. 1. VGA on PCIe 2. SoC Display (GFX) By default, video engine (VE) will capture video from VGA. This patch adds an option to capture video from GFX with standard ioctl, vidioc_s_input. An enum, aspeed_video_input, is added for this purpose. enum aspeed_video_input { VIDEO_INPUT_VGA = 0, VIDEO_INPUT_GFX, VIDEO_INPUT_MAX }; To test this feature, you will need to enable GFX first. Please refer to ASPEED's SDK_User_Guide, 6.3.x Soc Display driver, for more information. In your application, you will need to use v4l2 ioctl, VIDIOC_S_INPUT, as below to select before start streaming. int rc; struct v4l2_input input; input.index = VIDEO_INPUT_GFX; rc = ioctl(fd, VIDIOC_S_INPUT, &input); if (rc < 0) { ... } Link: https://github.com/AspeedTech-BMC/openbmc/releases Signed-off-by: Jammy Huang Signed-off-by: Hans Verkuil [hverkuil: split up three overly long lines] commit 9842379bf67bb49250e37d289d2f082975adb319 Author: Wolfram Sang Date: Wed Aug 13 18:14:54 2025 +0200 media: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Signed-off-by: Hans Verkuil commit 5e6c90892c24c8e51a69ac0a758fa55ec3dec593 Author: Thomas Weißschuh Date: Mon Aug 11 09:46:49 2025 +0200 media: platform: mtk-mdp3: don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Signed-off-by: Hans Verkuil commit d5d299e7e7f6b4ead31383d4abffca34e4296df0 Author: Arnd Bergmann Date: Fri Aug 8 17:17:55 2025 +0200 media: em28xx: add special case for legacy gpiolib interface The em28xx driver uses the old-style gpio_request_one() interface to switch the lna on the PCTV 290E card. This interface is becoming optional and should no longer be called by portable drivers. As I could not figure out an obvious replacement, select the new GPIOLIB_LEGACY symbol as a workaround. Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c Author: Arnd Bergmann Date: Thu Aug 7 22:54:15 2025 +0200 media: s5p-mfc: remove an unused/uninitialized variable The s5p_mfc_cmd_args structure in the v6 driver is never used, not initialized to anything other than zero, but as of clang-21 this causes a warning: drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 45 | &h2r_args); | ^~~~~~~~ Just remove this for simplicity. Since the function is also called through a callback, this does require adding a trivial wrapper with the correct prototype. Fixes: f96f3cfa0bb8 ("[media] s5p-mfc: Update MFC v4l2 driver to support MFC6.x") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit b4c441310c3baaa7c39a5457e305ca93c7a0400d Author: Chelsy Ratnawat Date: Wed Aug 6 23:09:36 2025 -0700 media: fix uninitialized symbol warnings Initialize variables to fix these smatch warnings drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'protocol'. drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'scancode'. drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'toggle'. drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized symbol 'adc_envelope'. drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized symbol 'lock_status'. drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized symbol 'frame_lines'. drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized symbol 'quality'. drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized symbol 'adc_envelope'. drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized symbol 'lock_status'. drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized symbol 'frame_lines'. drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized symbol 'quality'. drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized symbol 'snr'. drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized symbol 'totalgain'. Signed-off-by: Chelsy Ratnawat Signed-off-by: Hans Verkuil [hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed] commit 481c12018c252f7fc88b4bd05e882b9e1bf260c3 Author: Paul Kocialkowski Date: Tue Aug 5 22:47:18 2025 +0200 media: uapi: Cleanup tab after define in headers Some definitions use a tab after the define keyword instead of the usual single space. Replace it for better consistency. Signed-off-by: Paul Kocialkowski Signed-off-by: Hans Verkuil commit 4247053aaacda75480e1918e0d58a687ae5a266a Author: Paul Kocialkowski Date: Tue Aug 5 22:47:17 2025 +0200 media: uapi: Move colorimetry controls at the end of the file The colorimetry controls class is defined after the stateless codec class at the top of the controls header. It is currently defined in the middle of stateless codec controls. Move the colorimetry controls after the stateless codec controls, at the end of the file. Signed-off-by: Paul Kocialkowski Signed-off-by: Hans Verkuil commit 32d40a571c2dc9009b3be047f66180dc9837e7a1 Author: Colin Ian King Date: Fri Aug 1 17:49:26 2025 +0100 media: b2c2: Remove space before newline There is an extraneous space before a newline in a dprintk message. Remove the space. Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil commit a8513f6a2c8c0f4109dc7bf2b4dfda646ed4a8de Author: Colin Ian King Date: Fri Aug 1 17:00:23 2025 +0100 media: atomisp: Fix incorrect snprintf format specifiers for signed integers There are incorrect %u format specifiers being used to for signed integers, fix this by using %d instead. Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil commit f6762803297aa3a3aa9f7a0450188e8d85cb9597 Author: Thomas Huth Date: Fri Aug 1 16:29:10 2025 +0200 media: pci/ivtv: Replace GPLv2 boilerplate text with SPDX The FSF does not reside in 59 Temple Place anymore, so we should not ask the people to write to that address in case they need a copy of the GPL. Anyway, all other files in this directory already had their boilerplate text replaced by a proper SPDX tag in the earlier commit 1a59d1b8e05ea ("treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156"), so let's do the same in the remaining files now, too. Signed-off-by: Thomas Huth Signed-off-by: Hans Verkuil commit 379e428a4e36931678f2a8fd4550930190494a2e Author: Colin Ian King Date: Thu Jul 24 12:03:18 2025 +0100 media: Kconfig: Fix spelling mistake "Tehnology" -> "Technology" There are spelling mistakes in the DVB_DS3000 and DVB_TS2020 config. Fix them. Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil commit 00899135240c81b3cf8fbc2a4aee2e92234ee0c6 Author: A.T. Jefferies Date: Wed Jul 23 23:17:57 2025 +0000 staging: media: tegra-video: use BIT() macro instead of shift Replace two instances of (1 << X) with BIT(X) in tegra20.c to follow kernel coding style guidelines and improve clarity. The BIT() macro also ensures proper type handling for larger shifts. Signed-off-by: A.T. Jefferies Signed-off-by: Hans Verkuil commit d5d12cc03e501c38925e544abe44d5bfe23dc930 Author: Randy Dunlap Date: Tue Jul 22 17:12:00 2025 -0700 media: cec: extron-da-hd-4k-plus: drop external-module make commands Delete the external-module style Makefile commands. They are not needed for in-tree modules. This is the only Makefile in the kernel tree (aside from tools/ and samples/) that uses this Makefile style. The same files are built with or without this patch. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver") Signed-off-by: Randy Dunlap Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil commit c0d3f6969bb4d72476cfe7ea9263831f1c283704 Author: David Lechner Date: Tue Jul 22 17:05:46 2025 -0500 media: pci: mg4b: fix uninitialized iio scan data Fix potential leak of uninitialized stack data to userspace by ensuring that the `scan` structure is zeroed before use. Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver") Cc: stable@vger.kernel.org Signed-off-by: David Lechner Reviewed-by: Jonathan Cameron Signed-off-by: Hans Verkuil commit faee7aaf8760599a7a6bd2ae3547624edfd15e8b Author: Darshan Rathod Date: Fri Jul 18 14:34:20 2025 +0000 media: b2c2: flexcop: Fix coding style issues The code in flexcop.c has several instances where spaces are missing after commas in function call arguments. This violates the Linux kernel coding style guidelines. This patch cleans up these minor style issues by adding the required spaces. This is a purely stylistic change with no functional impact and improves overall code readability and consistency. Signed-off-by: Darshan Rathod Signed-off-by: Hans Verkuil commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 Author: Thomas Fourier Date: Wed Jul 16 15:26:30 2025 +0200 media: pci: ivtv: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. If the mapping fails, free blanking_ptr and set it to 0. As 0 is a valid DMA address, use blanking_ptr to test if the DMA address is set. Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Signed-off-by: Hans Verkuil commit 9d6b556abf7758aae65447915f1c4f82f0a57df4 Author: Yemike Abhilash Chandra Date: Wed Jul 16 16:49:09 2025 +0530 MAINTAINERS: Update maintainers of TI VPE and CAL Benoit has moved to work in other technical areas, and Yemike Abhilash will maintain these modules instead of him. Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Hans Verkuil commit 6704c672fd19db92d10942b110f8c51034a87511 Author: Dan Carpenter Date: Tue Jul 15 18:00:32 2025 -0500 media: stk1160: Restore deleted comment in stk1160_fill_urb() This comment explains why we return success when usb_alloc_noncoherent() fails and I think it's helpful. It was deleted during a recent refactor, but let's add it back. Signed-off-by: Dan Carpenter Reviewed-by: Xu Yang Signed-off-by: Hans Verkuil commit 419f151de0beb5eb5755ded57766481bddb6ad26 Author: Yunseong Kim Date: Mon Jul 14 22:33:11 2025 +0900 media: vim2m: remove unused CLIP macro The CLIP macro, which was used to clamp color component values to the [0, 255] range, is no longer used anywhere in the vim2m driver. Remove it to clean up the code and avoid confusion. The following issues were reported by checkpatch: ERROR: Macros with complex values should be enclosed in parentheses Signed-off-by: Yunseong Kim Signed-off-by: Hans Verkuil commit 2ac4eff9826d76373450a73aa8f554875ee34193 Author: Dr. David Alan Gilbert Date: Sun Jul 13 18:33:01 2025 +0100 media: pci: zoran: Remove unused debug parameter Nothing has checked the zr36067_debug variable since 2021 after commit efdd0d42e276 ("media: staging: media: zoran: remove detect_guest_activity") It's set as a module parameter, remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil commit 23b53639a793477326fd57ed103823a8ab63084f Author: Thomas Fourier Date: Wed Jul 9 13:35:40 2025 +0200 media: cx18: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. If the mapping fails, dealloc buffers, and return. Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Signed-off-by: Hans Verkuil commit 2dc344f89f7312df5f684492a813d024d34cdf20 Author: Hanne-Lotta Mäenpää Date: Tue Jul 8 18:52:06 2025 +0300 media: Documentation: Improve grammar in DVB API Fix typos and punctuation and improve grammar in documentation. Signed-off-by: Hanne-Lotta Mäenpää Signed-off-by: Hans Verkuil commit a6bc9278073bac7156fd8b2a0e8d5fe70dbe562c Author: Markus Elfring Date: Tue Jun 24 18:02:42 2025 +0200 media: stk1160: Use usb_endpoint_is_isoc_in() rather than duplicating its implementation Reuse existing functionality from usb_endpoint_is_isoc_in() instead of keeping duplicate source code. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Hans Verkuil commit 121c853ed28024ae408b64ef003eb45c4fb7cc70 Author: Chen Ni Date: Wed Jun 18 14:14:30 2025 +0800 media: au0828: Use USB API functions rather than constants Use the function usb_endpoint_dir_in() and usb_endpoint_type() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) == - \(USB_DIR_IN\|0x80\)) + usb_endpoint_dir_in(epd) @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) + usb_endpoint_type(epd) Signed-off-by: Chen Ni Signed-off-by: Hans Verkuil commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 Author: Arnd Bergmann Date: Tue Jun 10 11:31:56 2025 +0200 media: st-delta: avoid excessive stack usage Building with a reduced stack warning limit shows that delta_mjpeg_decode() copies a giant structure to the stack each time but only uses three of its members: drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Open-code the passing of the structure members that are actually used here. Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit f522da9ab56c96db8703b2ea0f09be7cdc3bffeb Author: Bagas Sanjaya Date: Fri Aug 29 14:55:22 2025 +0700 ASoC: doc: Internally link to Writing an ALSA Driver docs ASoC codec and platform driver docs contain reference to writing ALSA driver docs, as an external link. Use :doc: directive for the job instead. Signed-off-by: Bagas Sanjaya Message-ID: <20250829075524.45635-13-bagasdotme@gmail.com> Signed-off-by: Mark Brown commit 5c39bc498f5ff7ef016abf3f16698f3e8db79677 Author: Bard Liao Date: Fri Aug 29 11:29:08 2025 +0300 ASoC: SOF: Intel: only detect codecs when HDA DSP probe SDW codecs use the global HDaudio WAKEEN/STS to detect wakes since LNL. But the wake event is handled in the SDW driver. We should only clear WAKESTS for the HDA and IDISP codecs that was detected when HDA DSP probe. The SoundWire codec will be included in the codec_mask if we read the STATESTS register when a SoundWire codec wake event happens. The commit avoid updating bus->codec_mask in resume to not clear WAKESTS of SoundWire codecs. Signed-off-by: Bard Liao Reviewed-by: Kai Vehmanen Signed-off-by: Peter Ujfalusi Message-ID: <20250829082908.2693-3-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 6158a321c051095024e8306c8996b79e5f7f79b6 Author: Bard Liao Date: Fri Aug 29 11:29:07 2025 +0300 ASoC: SOF: Intel: split codec mask detect and programming UNSOL We only need to detect codec mask in probe, but need to program UNSOL in probe and resume. We will detect codec mask and program UNSOL separately in the follow up commit. Signed-off-by: Bard Liao Reviewed-by: Kai Vehmanen Signed-off-by: Peter Ujfalusi Message-ID: <20250829082908.2693-2-peter.ujfalusi@linux.intel.com> Signed-off-by: Mark Brown commit 7bc0084632dda2907ff1d021dff36ffbdd83468c Author: Zihuan Zhang Date: Wed Aug 27 10:31:55 2025 +0800 cpufreq: tegra186: Use scope-based cleanup helper Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) annotation for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang [ Viresh: Minor changes ] Signed-off-by: Viresh Kumar commit 4aeda901d6896344c5b0b3a8428c4a830007ea85 Author: Zihuan Zhang Date: Wed Aug 27 10:31:52 2025 +0800 cpufreq: mediatek: Use scope-based cleanup helper Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) annotation for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang [ Viresh: Minor changes ] Signed-off-by: Viresh Kumar commit 95102e0cc15688ddffc8da1f15cfec2276fa45e5 Author: Zihuan Zhang Date: Wed Aug 27 10:31:54 2025 +0800 cpufreq: s5pv210: Use scope-based cleanup helper Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) annotation for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang [ Viresh: Minor changes ] Signed-off-by: Viresh Kumar commit c8dc2368b23e1a9f11be4c941e13f3985195d0c9 Author: Zihuan Zhang Date: Wed Aug 27 10:31:49 2025 +0800 cpufreq: CPPC: Use scope-based cleanup helper Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) annotation for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang [ Viresh: Minor changes ] Signed-off-by: Viresh Kumar commit eaa9c1f31aef4d92d0ea6c9ecde33ea08733182a Author: Zihuan Zhang Date: Wed Aug 27 10:31:48 2025 +0800 cpufreq: brcmstb-avs: Use scope-based cleanup helper Replace the manual cpufreq_cpu_put() with __free(put_cpufreq_policy) annotation for policy references. This reduces the risk of reference counting mistakes and aligns the code with the latest kernel style. No functional change intended. Signed-off-by: Zihuan Zhang [ Viresh: Minor changes to commit log ] Signed-off-by: Viresh Kumar commit 4f96c5db61f238e8a957df2b81d6343a5e38ca59 Author: Michal Simek Date: Fri Jul 18 13:24:08 2025 +0200 arm64: zynqmp: Add support for kd240 board The kit is using k24 SOM by default and it is used for motor control and DSP applications. K24 SOM is also possible to used with kv260 and kr260 CC which are also wired in Makefile. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/05ff505c6b6517e3aba983a21454c568c5e86389.1752837842.git.michal.simek@amd.com commit 7030418d4ea3ee50f1be4cefb2c6fe67016ce2ad Author: Michal Simek Date: Fri Jul 18 13:24:07 2025 +0200 arm64: zynqmp: Add support for kr260 board The kit based on K26 SOM is built for robotics and industrial application. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/650ff5407528b8a90867ff1ac072b4112c91c866.1752837842.git.michal.simek@amd.com commit 2b0bff8c69d73cc33fc74c1e197f58ff9c7fd8c2 Author: Michal Simek Date: Fri Jul 18 13:24:06 2025 +0200 dt-bindings: soc: xilinx: Add support for K24, KR260 and KD240 CCs The commit 7a4c31ee877a ("arm64: zynqmp: Add support for Xilinx Kria SOM board") has added support for k26 and kv260 and the commit dbcd27526e6a ("dt-bindings: soc: xilinx: Add support for KV260 CC") has added support for KV260 and this is follow up patch for adding description for k24 SOM, KR260 (robotics platform) and KD240 (driver platform). The bootflow is the same that's why for more information please take a look at above commits. The KD240 kit is based on smaller k24 SOM with only 2GB of memory. Reviewed-by: Rob Herring (Arm) Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/8ff66d0dc4e0de6f239c25d43a2a96b4224305e8.1752837842.git.michal.simek@amd.com commit f4c3831ba8b771d308f6989d40e0d539d5cd69f6 Author: Michal Simek Date: Fri Jul 18 13:50:10 2025 +0200 arm64: zynqmp: Enable PSCI 1.0 TF-A is using PSCI 1.0 version for quite a long time but it was never reflected in DT. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/32be8050838512d4340486227c32f38298ddde57.1752839409.git.michal.simek@amd.com commit 722a3df12e5e56b4d95e77878522c7fbaba19b39 Author: Rohit Visavalia Date: Fri Jul 18 12:45:12 2025 +0200 arm64: zynqmp: Enable DP for zcu100, zcu102, zcu104, zcu111 Upstream DP DT binding enforcing dp-connector and port description to operate properly. Signed-off-by: Rohit Visavalia Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/0ac8df0c942ed9068e0b60a840fee6b9f7df2293.1752835502.git.michal.simek@amd.com commit ea0e0089f7c5a9650f8562e04e20f479689d9dec Author: Michal Simek Date: Fri Jul 18 12:45:11 2025 +0200 arm64: zynqmp: Introduce DP port labels Describe every port by unique label for easier wiring with DT overlays. And also labels help to describe which port is used for what. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/99ec1532d0cce877b1d365ede9bd15a909706637.1752835502.git.michal.simek@amd.com commit 7cf18a364ed2d56cf44769d1a3690aa0bf4d5e9e Author: Vishal Patel Date: Fri Jul 18 12:45:10 2025 +0200 arm64: zynqmp: Fix pwm-fan polarity The correct operating mode for the fan is inversed (1). The previous pwm driver implementation had a bug and the polarity information was propagated incorrectly to the kernel. The normal (0) polarity specified in the device tree was incorrectly clearing the polarity bit in the counter control register. After the bug fix, setting the polarity to inversed (1) in the device tree will clear the polarity bit. Also provide label for custom description based on this SOM. Signed-off-by: Vishal Patel Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/e6dc9ce1e0b97c9d9b073c323cc94a5d7a88b94a.1752835502.git.michal.simek@amd.com commit 0f961857d3437bba9b2e1801085c9c39484d4541 Author: Venkatesh Yadav Abbarapu Date: Fri Jul 18 12:45:09 2025 +0200 arm64: zynqmp: Update the usb5744 hub node as per binding Updating the usb5744 hub node as per the latest upstream DT binding. Signed-off-by: Venkatesh Yadav Abbarapu Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/564a09b84dfdce1e54c93e95f9156150e05b8f43.1752835502.git.michal.simek@amd.com commit c7d5ca726ddc9a4d0e6d31873ffa203ee7803037 Author: Paul Alvin Date: Fri Jul 18 12:45:08 2025 +0200 arm64: zynqmp: Add cap-mmc-hw-reset and no-sd, no-sdio property to eMMC Add "cap-mmc-hw-reset" property to the eMMC DT node to perform the eMMC device hardware reset. Also, add "no-sd", "no-sdio" properties to eMMC DT node to skip unwanted sd, sdio related commands during initialization for eMMC device as this may lead to unnecessary register dump. Signed-off-by: Paul Alvin Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/10132834c0509539b0d01ff5097591cd2e3ae125.1752835501.git.michal.simek@amd.com commit 7044b13e008d7033f2e966603a507401b11f913a Author: Michal Simek Date: Fri Jul 18 12:45:07 2025 +0200 arm64: zynqmp: Remove undocumented arasan,has-mdma property arasan,has-mdma is not described in DT binding that's why remove it. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/6567a0855ad73b5ff01d9945063014fbacdcc845.1752835501.git.michal.simek@amd.com commit 00acd6d441070c5dd2513f4417aed8a918909afb Author: Michal Simek Date: Fri Jul 18 12:45:06 2025 +0200 arm64: zynqmp: Use generic spi@ name in zcu111-revA DT schema requires to use spi@ name for SPI devices that's why fix it. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/95979240cf09929c81a6f74199b0cb7027dd8798.1752835501.git.michal.simek@amd.com commit b60b74f82e3ed4910a5f96a412e89bdd44875842 Author: Harini T Date: Thu Jul 10 11:43:09 2025 +0530 arm64: versal-net: Update rtc calibration value As per the design specification "The 16-bit Seconds Calibration Value represents the number of Oscillator Ticks that are required to measure the largest time period that is less than or equal to 1 second. For an oscillator that is 32.768kHz, this value will be 0x7FFF." Signed-off-by: Harini T Link: https://lore.kernel.org/r/20250710061309.25601-1-harini.t@amd.com Signed-off-by: Michal Simek commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed Author: Li Nan Date: Tue Aug 26 16:48:54 2025 +0800 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning: kernfs: can not remove 'nr_tags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk] kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it. Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") Signed-off-by: Li Nan Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com Signed-off-by: Jens Axboe commit 29828b81a46a3ae55ebc053fce512219172560ba Merge: 15d157c3ad018a e0d2795ab48f68 Author: Jakub Kicinski Date: Thu Aug 28 16:59:21 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: split ice_virtchnl.c git-blame friendly way Przemek Kitszel says: Split ice_virtchnl.c into two more files (+headers), in a way that git-blame works better. Then move virtchnl files into a new subdir. No logic changes. I have developed (or discovered ;)) how to split a file in a way that both old and new are nice in terms of git-blame There was not much discussion on [RFC], so I would like to propose to go forward with this approach. There are more commits needed to have it nice, so it forms a git-log vs git-blame tradeoff, but (after the brief moment that this is on the top) we spend orders of magnitude more time looking at the blame output (and commit messages linked from that) - so I find it much better to see actual logic changes instead of "move xx to yy" stuff (typical for "squashed/single-commit splits"). Cherry-picks/rebases work the same with this method as with simple "squashed/single-commit" approach (literally all commits squashed into one (to have better git-log, but shitty git-blame output). Rationale for the split itself is, as usual, "file is big and we want to extend it". * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: finish virtchnl.c split into rss.c ice: extract virt/rss.c: cleanup - p2 ice: extract virt/rss.c: cleanup - p1 ice: split RSS stuff out of virtchnl.c - copy back ice: split RSS stuff out of virtchnl.c - tmp rename ice: finish virtchnl.c split into queues.c ice: extract virt/queues.c: cleanup - p3 ice: extract virt/queues.c: cleanup - p2 ice: extract virt/queues.c: cleanup - p1 ice: split queue stuff out of virtchnl.c - copy back ice: split queue stuff out of virtchnl.c - tmp rename ice: add virt/ and move ice_virtchnl* files there ==================== Link: https://patch.msgid.link/20250827224641.415806-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit aa943a280e88e3585ed5a06d55e78c4123fcead3 Merge: 1e150869caf2fe 5ff8c11775c744 Author: Nathan Chancellor Date: Thu Aug 28 16:58:51 2025 -0700 Merge patch series "Bump minimum supported version of LLVM for building the kernel to 15.0.0" s390 and x86 have required LLVM 15 since 30d17fac6aae ("scripts/min-tool-version.sh: raise minimum clang version to 15.0.0 for s390") 7861640aac52 ("x86/build: Raise the minimum LLVM version to 15.0.0") respectively. This series bumps the rest of the kernel to 15.0.0 to match, which allows for a decent number of clean ups. On the distros front, we will only leave behind Debian Bookworm and Ubuntu Jammy. In both of those cases, builders / developers can either use the kernel.org toolchains or https://apt.llvm.org to get newer versions that will run on those distributions, if they cannot upgrade. archlinux:latest clang version 20.1.8 debian:oldoldstable-slim Debian clang version 11.0.1-2 debian:oldstable-slim Debian clang version 14.0.6 debian:stable-slim Debian clang version 19.1.7 (3+b1) debian:testing-slim Debian clang version 19.1.7 (3+b1) debian:unstable-slim Debian clang version 19.1.7 (3+b2) fedora:41 clang version 19.1.7 (Fedora 19.1.7-4.fc41) fedora:latest clang version 20.1.8 (Fedora 20.1.8-3.fc42) fedora:rawhide clang version 20.1.8 (Fedora 20.1.8-3.fc43) opensuse/leap:latest clang version 17.0.6 opensuse/tumbleweed:latest clang version 20.1.8 ubuntu:focal clang version 10.0.0-4ubuntu1 ubuntu:jammy Ubuntu clang version 14.0.0-1ubuntu1.1 ubuntu:noble Ubuntu clang version 18.1.3 (1ubuntu1) ubuntu:latest Ubuntu clang version 18.1.3 (1ubuntu1) ubuntu:rolling Ubuntu clang version 20.1.2 (0ubuntu1) ubuntu:devel Ubuntu clang version 20.1.8 (0ubuntu1) Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-0-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 5ff8c11775c744dc5076ce126eb1b3adce0a70ae Author: Nathan Chancellor Date: Thu Aug 21 14:15:49 2025 -0700 KMSAN: Remove tautological checks Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, two KMSAN checks can be cleaned up. CONFIG_HAVE_KMSAN_COMPILER will always be true when using clang so remove the cc-option test and use a simple check for CONFIG_CC_IS_CLANG. CONFIG_HAVE_KMSAN_PARAM_RETVAL will always be true so it can be removed outright. Acked-by: Marco Elver Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-12-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 573ad421cc551eb45d9ac9008395f93c070789b8 Author: Nathan Chancellor Date: Thu Aug 21 14:15:48 2025 -0700 objtool: Drop noinstr hack for KCSAN_WEAK_MEMORY Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, __no_kcsan will always ensure that the thread sanitizer functions are not generated, so remove the check for tsan functions in is_profiling_func() and the always true depends and unnecessary select lines in KCSAN_WEAK_MEMORY. Acked-by: Marco Elver Acked-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-11-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit a817de20091c3cf6de19d7ddf099b0e35003b7d0 Author: Nathan Chancellor Date: Thu Aug 21 14:15:47 2025 -0700 lib/Kconfig.debug: Drop CLANG_VERSION check from DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, the CLANG_VERSION check for older than 14.0.0 is always false, so remove it. Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-10-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 87b28d71396bf17e424ea82d17c537c391c35900 Author: Nathan Chancellor Date: Thu Aug 21 14:15:46 2025 -0700 riscv: Remove ld.lld version checks from many TOOLCHAIN_HAS configs Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, several ld.lld version checks become tautological, as they are always true. Replace them with a simple CONFIG_LD_IS_LLD check. Reviewed-by: Conor Dooley Acked-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-9-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 7ccbe91796d7bb584a00833cb59ef7d4575ba784 Author: Nathan Chancellor Date: Thu Aug 21 14:15:45 2025 -0700 riscv: Unconditionally use linker relaxation Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, CONFIG_RISCV_USE_LINKER_RELAXATION will always be enabled, so it can be removed. Acked-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-8-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 6578a1ff6aa49034489c2701502d1969e6bf12a7 Author: Nathan Chancellor Date: Thu Aug 21 14:15:44 2025 -0700 riscv: Remove version check for LTO_CLANG selects Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, there is no need to check the LLD version before selecting ARCH_SUPPORTS_LTO_CLANG{,_THIN} because it will always be true. Reviewed-by: Kees Cook Reviewed-by: Conor Dooley Acked-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-7-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 488954ca195d03f651208355ed5cac428846ee97 Author: Nathan Chancellor Date: Thu Aug 21 14:15:43 2025 -0700 powerpc: Drop unnecessary initializations in __copy_inst_from_kernel_nofault() Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, the zero initializations of val and suffix added by commit 0d76914a4c99 ("powerpc/inst: Optimise copy_inst_from_kernel_nofault()") to avoid a bogus case of -Wuninitialized can be dropped because the preprocessor condition is always false. Reviewed-by: Kees Cook Reviewed-by: Christophe Leroy Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-6-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit e633c2e78fd1cc9c4b89518b8d12578a7aa529c1 Author: Nathan Chancellor Date: Thu Aug 21 14:15:42 2025 -0700 mips: Unconditionally select ARCH_HAS_CURRENT_STACK_POINTER Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, the selection of ARCH_HAS_CURRENT_STACK_POINTER can be made unconditional since it is always true. Acked-by: Thomas Bogendoerfer Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-5-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 23cb0514208da70c07b3582ecbbe6b3c633a481f Author: Nathan Chancellor Date: Thu Aug 21 14:15:41 2025 -0700 arm64: Remove tautological LLVM Kconfig conditions Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, two sets of always true conditions can be safely removed in the arm64 Kconfig file. Acked-by: Will Deacon Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-4-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 02aba266e391fa90a4dae8822bde72ebdb88c360 Author: Nathan Chancellor Date: Thu Aug 21 14:15:40 2025 -0700 ARM: Clean up definition of ARM_HAS_GROUP_RELOCS Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, the first depends line of ARM_HAS_GROUP_RELOCS is always true, so it can be safely removed. Combine the !COMPILE_TEST dependency into the 'def_bool' line and update the comment as well. Reviewed-by: Kees Cook Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-3-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 65aebf6f5880e7ab692d814ca19f8936d0120364 Author: Nathan Chancellor Date: Thu Aug 21 14:15:39 2025 -0700 arch/Kconfig: Drop always true condition from RANDOMIZE_KSTACK_OFFSET Now that the minimum supported version of LLVM for building the kernel has been bumped to 15.0.0, the second depends line in RANDOMIZE_KSTACK_OFFSET is always true, so it can be removed. Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-2-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 20c0989283564d662dcc4c77252a60b1812b32ca Author: Nathan Chancellor Date: Thu Aug 21 14:15:38 2025 -0700 kbuild: Bump minimum version of LLVM for building the kernel to 15.0.0 s390 and x86 have required LLVM 15 since 30d17fac6aae ("scripts/min-tool-version.sh: raise minimum clang version to 15.0.0 for s390") 7861640aac52 ("x86/build: Raise the minimum LLVM version to 15.0.0") respectively but most other architectures allow LLVM 13.0.1 or newer. In accordance with the recent minimum supported version of GCC bump that happened in 118c40b7b503 ("kbuild: require gcc-8 and binutils-2.30") do the same for LLVM to 15.0.0. Of the supported releases of Arch Linux, Debian, Fedora, and OpenSUSE surveyed in evaluating this bump, this only leaves behind Debian Bookworm (14.0.6) and Ubuntu Jammy (14.0.0). Debian Trixie has 19.1.7 and Ubuntu Noble has 18.1.3 (so there are viable upgrade paths) or users can use apt.llvm.org, which provides even newer packages for those distributions. Reviewed-by: Kees Cook Acked-by: Arnd Bergmann Acked-by: Nicolas Schier Link: https://lore.kernel.org/r/20250821-bump-min-llvm-ver-15-v2-1-635f3294e5f0@kernel.org Signed-off-by: Nathan Chancellor commit 15d157c3ad018a7b9d99d0cf35d6b163e570728e Author: Jakub Kicinski Date: Wed Aug 27 16:43:19 2025 -0700 eth: mlx5: remove Kconfig co-dependency with VXLAN mlx5 has a Kconfig co-dependency on VXLAN, even tho it doesn't call any VXLAN function (unlike mlxsw). Perhaps this dates back to very old days when tunnel ports were fetched directly from VXLAN. Remove the dependency to allow MLX5=y + VXLAN=m kernel configs. But still avoid compiling in the lib/vxlan code if VXLAN=n. Reviewed-by: Saeed Mahameed Link: https://patch.msgid.link/20250827234319.3504852-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 24eb86a8170f129725b56c8a359089ce18ad6d6f Author: Russell King (Oracle) Date: Wed Aug 27 14:27:47 2025 +0100 net: stmmac: mdio: clean up c22/c45 accessor split The C45 accessors were setting the GR (register number) field twice, once with the 16-bit register address truncated to five bits, and then overwritten with the C45 devad. This is harmless since the field was being cleared prior to being updated with the C45 devad, except for the extra work. Remove the redundant code. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1urGBn-00000000DCH-3swS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5309dbc95b02485fb76d760fe471bb3b60362f1f Merge: 2584ed250a3716 53df77e7859042 Author: Jakub Kicinski Date: Thu Aug 28 16:46:25 2025 -0700 Merge branch 'net_sched-extend-rcu-use-in-dump-methods-ii' Eric Dumazet says: ==================== net_sched: extend RCU use in dump() methods (II) Second series adding RCU dump() to three actions First patch removes BH blocking on modules done in the first series. ==================== Link: https://patch.msgid.link/20250827125349.3505302-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 53df77e7859042a92914d664c860f65d9689f88d Author: Eric Dumazet Date: Wed Aug 27 12:53:49 2025 +0000 net_sched: act_skbmod: use RCU in tcf_skbmod_dump() Also storing tcf_action into struct tcf_skbmod_params makes sure there is no discrepancy in tcf_skbmod_act(). No longer block BH in tcf_skbmod_init() when acquiring tcf_lock. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250827125349.3505302-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit e97ae742972f6cb57986a5ebb846048f80b90003 Author: Eric Dumazet Date: Wed Aug 27 12:53:48 2025 +0000 net_sched: act_tunnel_key: use RCU in tunnel_key_dump() Also storing tcf_action into struct tcf_tunnel_key_params makes sure there is no discrepancy in tunnel_key_act(). No longer block BH in tunnel_key_init() when acquiring tcf_lock. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250827125349.3505302-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 48b5e5dbdb234ffc951cacceaec7f8ee37c83b2d Author: Eric Dumazet Date: Wed Aug 27 12:53:47 2025 +0000 net_sched: act_vlan: use RCU in tcf_vlan_dump() Also storing tcf_action into struct tcf_vlan_params makes sure there is no discrepancy in tcf_vlan_act(). No longer block BH in tcf_vlan_init() when acquiring tcf_lock. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250827125349.3505302-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3133d5c15cb568470f4ec3ea9e0599543eecf3ea Author: Eric Dumazet Date: Wed Aug 27 12:53:46 2025 +0000 net_sched: remove BH blocking in eight actions Followup of f45b45cbfae3 ("Merge branch 'net_sched-act-extend-rcu-use-in-dump-methods'") We never grab tcf_lock from BH context in these modules: act_connmark act_csum act_ct act_ctinfo act_mpls act_nat act_pedit act_skbedit No longer block BH when acquiring tcf_lock from init functions. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250827125349.3505302-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2584ed250a371681b353cee89e273b25c31c25d4 Author: Russell King (Oracle) Date: Wed Aug 27 09:54:51 2025 +0100 net: stmmac: minor cleanups to stmmac_bus_clks_config() stmmac_bus_clks_config() doesn't need to repeatedly on dereference priv->plat as this remains the same throughout this function. Not only does this detract from the function's readability, but it could cause the value to be reloaded each time. Use a local variable. Also, the final return can simply return zero, and we can dispense with the initialiser for 'ret'. Signed-off-by: Russell King (Oracle) Reviewed-by: Jacob Keller Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E1urBvf-000000002ii-37Ce@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bafdd920a060eb1bad51c1c70b9850403548252f Author: Russell King (Oracle) Date: Wed Aug 27 09:41:48 2025 +0100 net: stmmac: mdio: use netdev_priv() directly netdev_priv() is an inline function, taking a struct net_device pointer. When passing in the MII bus->priv, which is a void pointer, there is no need to go via a local ndev variable to type it first. Thus, instead of: struct net_device *ndev = bus->priv; struct stmmac_priv *priv; ... priv = netdev_priv(ndev); we can simply do: struct stmmac_priv *priv = netdev_priv(bus->priv); which simplifies the code. Signed-off-by: Russell King (Oracle) Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/E1urBj2-000000002as-0pod@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5e3aae2d3271cf5fd3e37683ff1392dd7bed5389 Author: Sky Huang Date: Wed Aug 27 12:47:55 2025 +0800 net: phy: mtk-2p5ge: Add LED support for MT7988 Add LED support for MT7988's built-in 2.5Gphy. LED hardware has almost the same design with MT7981's/MT7988's built-in GbE. So hook the same helper function here. Before mtk_phy_leds_state_init(), set correct default values of LED0 and LED1. Signed-off-by: Sky Huang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250827044755.3256991-1-SkyLake.Huang@mediatek.com Signed-off-by: Jakub Kicinski commit c158b5a570a188b990ef10ded172b8b93e737826 Author: Jakub Kicinski Date: Wed Aug 27 10:35:58 2025 -0700 selftests: drv-net: rss_ctx: fix the queue count check Commit 0d6ccfe6b319 ("selftests: drv-net: rss_ctx: check for all-zero keys") added a skip exception if NIC has fewer than 3 queues enabled, but it's just constructing the object, it's not actually rising this exception. Before: # Exception| net.lib.py.utils.CmdExitFailure: Command failed: ethtool -X enp1s0 equal 3 hkey d1:cc:77:47:9d:ea:15:f2:b9:6c:ef:68:62:c0:45:d5:b0:99:7d:cf:29:53:40:06:3d:8e:b9:bc:d4:70:89:b8:8d:59:04:ea:a9:c2:21:b3:55:b8:ab:6b:d9:48:b4:bd:4c:ff:a5:f0:a8:c2 not ok 1 rss_ctx.test_rss_key_indir After: ok 1 rss_ctx.test_rss_key_indir # SKIP Device has fewer than 3 queues (or doesn't support queue stats) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250827173558.3259072-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit bbf02c318425e362c88dc3da49da6f95193551c5 Merge: 14cd01c28fb1e7 b8aab4bb958507 Author: Jakub Kicinski Date: Thu Aug 28 16:05:34 2025 -0700 Merge branch 'devmem-io_uring-allow-more-flexibility-for-zc-dma-devices' Dragos Tatulea says: ==================== devmem/io_uring: allow more flexibility for ZC DMA devices For TCP zerocopy rx (io_uring, devmem), there is an assumption that the parent device can do DMA. However that is not always the case: - Scalable Function netdevs [1] have the DMA device in the grandparent. - For Multi-PF netdevs [2] queues can be associated to different DMA devices. The series adds an API for getting the DMA device for a netdev queue. Drivers that have special requirements can implement the newly added queue management op. Otherwise the parent will still be used as before. This series continues with switching to this API for io_uring zcrx and devmem and adds a ndo_queue_dma_dev op for mlx5. The last part of the series changes devmem rx bind to get the DMA device per queue and blocks the case when multiple queues use different DMA devices. The tx bind is left as is. [1] Documentation/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.rst [2] Documentation/networking/multi-pf-netdev.rst ==================== Link: https://patch.msgid.link/20250827144017.1529208-2-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit b8aab4bb9585078012f5b6020454337a47081501 Author: Dragos Tatulea Date: Wed Aug 27 17:40:01 2025 +0300 net: devmem: allow binding on rx queues with same DMA devices Multi-PF netdevs have queues belonging to different PFs which also means different DMA devices. This means that the binding on the DMA buffer can be done to the incorrect device. This change allows devmem binding to multiple queues only when the queues have the same DMA device. Otherwise an error is returned. Signed-off-by: Dragos Tatulea Link: https://patch.msgid.link/20250827144017.1529208-9-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 1b416902cd255f51be37c1b7f7307b9f7027e04f Author: Dragos Tatulea Date: Wed Aug 27 17:40:00 2025 +0300 net: devmem: pre-read requested rx queues during bind Instead of reading the requested rx queues after binding the buffer, read the rx queues in advance in a bitmap and iterate over them when needed. This is a preparation for fetching the DMA device for each queue. This patch has no functional changes besides adding an extra rq index bounds check. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250827144017.1529208-8-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 512c88fb0e884cbb4c495b8f3351a9185d1d50b1 Author: Dragos Tatulea Date: Wed Aug 27 17:39:59 2025 +0300 net: devmem: pull out dma_dev out of net_devmem_bind_dmabuf Fetch the DMA device before calling net_devmem_bind_dmabuf() and pass it on as a parameter. This is needed for an upcoming change which will read the DMA device per queue. This patch has no functional changes. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250827144017.1529208-7-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit f1debf1a2ef44ca1baa15a0cc088cb2be1f95449 Author: Dragos Tatulea Date: Wed Aug 27 17:39:58 2025 +0300 net/mlx5e: add op for getting netdev DMA device For zero-copy (devmem, io_uring), the netdev DMA device used is the parent device of the net device. However that is not always accurate for mlx5 devices: - SFs: The parent device is an auxdev. - Multi-PF netdevs: The DMA device should be determined by the queue. This change implements the DMA device queue API that returns the DMA device appropriately for all cases. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250827144017.1529208-6-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 7c7e94603a76d62efbc4da4d0eb7a221add0ecfa Author: Dragos Tatulea Date: Wed Aug 27 17:39:57 2025 +0300 net: devmem: get netdev DMA device via new API Switch to the new API for fetching DMA devices for a netdev. The API is called with queue index 0 for now which is equivalent with the previous behavior. This patch will allow devmem to work with devices where the DMA device is not stored in the parent device. mlx5 SFs are an example of such a device. Multi-PF netdevs are still problematic (as they were before this change). Upcoming patches will address this for the rx binding. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250827144017.1529208-5-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 59b8b32ac8d469958936fcea781c7f58e3d64742 Author: Dragos Tatulea Date: Wed Aug 27 17:39:56 2025 +0300 io_uring/zcrx: add support for custom DMA devices Use the new API for getting a DMA device for a specific netdev queue. This patch will allow io_uring zero-copy rx to work with devices where the DMA device is not stored in the parent device. mlx5 SFs are an example of such a device. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Reviewed-by: Pavel Begunkov Link: https://patch.msgid.link/20250827144017.1529208-4-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 13d8e05adf9dd06c74fcc6ba42ec4bf780fd557f Author: Dragos Tatulea Date: Wed Aug 27 17:39:55 2025 +0300 queue_api: add support for fetching per queue DMA dev For zerocopy (io_uring, devmem), there is an assumption that the parent device can do DMA. However that is not always the case: - Scalable Function netdevs [1] have the DMA device in the grandparent. - For Multi-PF netdevs [2] queues can be associated to different DMA devices. This patch introduces the a queue based interface for allowing drivers to expose a different DMA device for zerocopy. [1] Documentation/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.rst [2] Documentation/networking/multi-pf-netdev.rst Signed-off-by: Dragos Tatulea Reviewed-by: Pavel Begunkov Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250827144017.1529208-3-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 0b37ac63fc9db7779168ad18d7e6e8ab9df6a40b Author: Dmitry Baryshkov Date: Tue Aug 19 23:32:58 2025 +0300 drm/msm/dpu: use drmm_writeback_connector_init() Use drmm_writeback_connector_init() in order to initialize writeback connector instance. Reviewed-by: Louis Chauvet Reviewed-by: Suraj Kandpal Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/669506/ Link: https://lore.kernel.org/r/20250819-wb-drop-encoder-v3-4-b48a6af7903b@oss.qualcomm.com [DB: fixed commit message] Signed-off-by: Dmitry Baryshkov commit ddcc2bb28878b5e7f7aeeb2b510629960b6714a5 Merge: 1cd0c7afef97c3 5c76c794bf2939 Author: Dave Airlie Date: Fri Aug 29 08:55:29 2025 +1000 Merge tag 'drm-misc-next-2025-08-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.18: UAPI Changes: atomic: - Reallow no-op async page flips Cross-subsystem Changes: hid: - i2c-hid: Make elan touch controllers power on after panel is enabled video: - Improve pixel-format handling for struct screen_info Core Changes: display: - dp: Fix command length Driver Changes: amdxdna: - Fixes bridge: - Add support for Radxa Ra620 plus DT bindings msm: - Fix VMA allocation panel: - ilitek-ili9881c: Refactor mode setting; Add support for Bestar BSD1218-A101KL68 LCD plus DT bindings - lvds: Add support for Ampire AMP19201200B5TZQW-T03 to DT bindings rockchip: - dsi2: Add support for RK3576 plus DT bindings stm: - Clean up logging vesadrm: - Support 8-bit palette mode Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250828065714.GA11906@linux.fritz.box commit 0d7db6f377c4b2bbee5000d886f635d29cc2bdfd Author: Brian Masney Date: Mon Aug 11 06:56:08 2025 -0400 drm/msm/hdmi_pll_8960: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Acked-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Brian Masney Patchwork: https://patchwork.freedesktop.org/patch/667982/ Link: https://lore.kernel.org/r/20250811-drm-clk-round-rate-v2-4-4a91ccf239cf@redhat.com Signed-off-by: Dmitry Baryshkov commit 470085357f77b922c834d38d25e6e2fa290b7cdd Author: Brian Masney Date: Mon Aug 11 06:56:07 2025 -0400 drm/msm/disp/mdp4/mdp4_lvds_pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Acked-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Brian Masney Patchwork: https://patchwork.freedesktop.org/patch/667980/ Link: https://lore.kernel.org/r/20250811-drm-clk-round-rate-v2-3-4a91ccf239cf@redhat.com Signed-off-by: Dmitry Baryshkov commit a38d1fbbc90f5f2ddf632103064efa83d8f332fe Author: Brian Masney Date: Sun Aug 10 18:57:31 2025 -0400 drm/msm/hdmi_phy_8998: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667878/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-7-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit 5beef1fec2afb5414ddadac4a3ab7d00039dba60 Author: Brian Masney Date: Sun Aug 10 18:57:30 2025 -0400 drm/msm/hdmi_phy_8996: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667876/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-6-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit 6e5173e7bf80bdd127b659b210e773695d78d1ea Author: Brian Masney Date: Sun Aug 10 18:57:29 2025 -0400 drm/msm/dsi_phy_7nm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667874/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-5-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit e04baa0b175627428424398623034c13f9decfb3 Author: Brian Masney Date: Sun Aug 10 18:57:28 2025 -0400 drm/msm/dsi_phy_28nm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667872/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-4-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit 267c0a2dfbdb4ba27c7333c37fc56f3d5f05919e Author: Brian Masney Date: Sun Aug 10 18:57:27 2025 -0400 drm/msm/dsi_phy_28nm_8960: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/667870/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-3-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit cc41f29a6b04d8b7ee7cefd77334aeba2598646f Author: Brian Masney Date: Sun Aug 10 18:57:26 2025 -0400 drm/msm/dsi_phy_14nm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/667869/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-2-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit fe3190a3915f3de62ea3bba2dc1d80de0592fa41 Author: Brian Masney Date: Sun Aug 10 18:57:25 2025 -0400 drm/msm/dsi_phy_10nm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to use clamp_t() was done manually. Signed-off-by: Brian Masney Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/667866/ Link: https://lore.kernel.org/r/20250810-drm-msm-phy-clk-round-rate-v2-1-0fd1f7979c83@redhat.com Signed-off-by: Dmitry Baryshkov commit a7d17b4f8bc862dd9222b4506d8e3db0b895a1c7 Author: Jiri Slaby (SUSE) Date: Wed Jul 23 07:55:12 2025 +0200 drm/msm: use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: Marijn Suijten Cc: David Airlie Cc: Simona Vetter Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/665227/ Link: https://lore.kernel.org/r/20250723055512.1800438-1-jirislaby@kernel.org Signed-off-by: Dmitry Baryshkov commit 62b7d68352881609e237b303fa391410ebc583a5 Author: Jessica Zhang Date: Tue May 6 18:38:39 2025 -0700 drm/msm/dpu: Filter modes based on adjusted mode clock Filter out modes that have a clock rate greater than the max core clock rate when adjusted for the perf clock factor This is especially important for chipsets such as QCS615 that have lower limits for the MDP max core clock. Since the core CRTC clock is at least the mode clock (adjusted for the perf clock factor) [1], the modes supported by the driver should be less than the max core clock rate. [1] https://elixir.bootlin.com/linux/v6.12.4/source/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c#L83 Reviewed-by: Dmitry Baryshkov Signed-off-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/652041/ Link: https://lore.kernel.org/r/20250506-filter-modes-v2-1-c20a0b7aa241@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 12c3c6c44d1b0fd17f18522089b12ad269769c00 Author: Colin Ian King Date: Fri Jul 18 14:34:04 2025 +0100 drm/msm: remove extraneous semicolon after a statement There is a statement that has an extraneous semicolon; remove it. Signed-off-by: Colin Ian King Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/664675/ Link: https://lore.kernel.org/r/20250718133404.2047673-1-colin.i.king@gmail.com Signed-off-by: Dmitry Baryshkov commit fd5c9b3c99da614a71119fce1848e66650a6633f Author: Dmitry Baryshkov Date: Fri Jul 4 19:31:55 2025 +0300 dt-bindings: display/msm: describe MDSS on SC8180X Describe the Mobile Display SubSystem (MDSS) unit as present on the SC8180X platform. Reported-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/662498/ Link: https://lore.kernel.org/r/20250704-mdss-schema-v1-3-e978e4e73e14@oss.qualcomm.com commit 275af16d7294e7f8a36370f274d3aa9dd01ad76a Author: Dmitry Baryshkov Date: Fri Jul 4 19:31:54 2025 +0300 dt-bindings: display/msm: describe DPU on SC8180X Describe the Display Processing Unit (DPU) as present on the SC8180X platform. Reported-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/662502/ Link: https://lore.kernel.org/r/20250704-mdss-schema-v1-2-e978e4e73e14@oss.qualcomm.com commit 505441083afb9dde61d6b82bfa9d7cc6ad331e77 Author: Dmitry Baryshkov Date: Fri Jul 4 19:31:53 2025 +0300 dt-bindings: display/msm: dsi-controller-main: add SC8180X Describe the SC8180X-specific compatible for the DSI controller persent on the SoC. While the current DT for SC8180X doesn't use this compatible, all other platforms were updated to have one. This change makes SC8180X follow the lead. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/662495/ Link: https://lore.kernel.org/r/20250704-mdss-schema-v1-1-e978e4e73e14@oss.qualcomm.com commit fb53e8f09fc1e1a343fd08ea4f353f81613975d7 Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:41 2025 -0500 drm/msm: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The original code did not set 'zap_available' to false if of_address_to_resource() failed which seems like an oversight. Signed-off-by: Rob Herring (Arm) Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662275/ Link: https://lore.kernel.org/r/20250703183442.2073717-1-robh@kernel.org [DB: dropped part related to VRAM, no longer applicable] Signed-off-by: Dmitry Baryshkov commit f3b649d7a513f71a31c451bd0825657211366d7f Author: Dmitry Baryshkov Date: Sat Jun 28 06:02:37 2025 +0300 dt-bindings: display/msm/gpu: describe clocks for each Adreno GPU type Rather than having a single list with all possible clocks for A3xx-A5xx define individual Adreno GPU types and corresponding clock lists. Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/661348/ Link: https://lore.kernel.org/r/20250628-rework-msm-gpu-schema-v1-3-89f818c51b6a@oss.qualcomm.com commit cef3a60b30d1697ac796cf22f41531c916329db1 Author: Dmitry Baryshkov Date: Sat Jun 28 06:02:36 2025 +0300 dt-bindings: display/msm/gpu: describe alwayson clock Adreno A506 and A510 have one extra clock, alwayson. Describe it in the schema. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/661352/ Link: https://lore.kernel.org/r/20250628-rework-msm-gpu-schema-v1-2-89f818c51b6a@oss.qualcomm.com commit 86d39a046b59583675a8c9701acc86c02768a433 Author: Dmitry Baryshkov Date: Sat Jun 28 06:02:35 2025 +0300 dt-bindings: display/msm/gpu: account for 7xx GPUs in clocks conditions Handle two cases for Adreno 7xx: - Adreno 702 follows A610 and A619 example and has clocks in the GPU node. - Newer 7xx GPUs use a different pattern for the compatibles and did not match currently. Signed-off-by: Dmitry Baryshkov Acked-by: Konrad Dybcio Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/661351/ Link: https://lore.kernel.org/r/20250628-rework-msm-gpu-schema-v1-1-89f818c51b6a@oss.qualcomm.com commit bffa3a03e787d3e83193c8f3ef0b31d8bf7fb39c Author: Christophe JAILLET Date: Fri Jun 27 19:18:03 2025 +0200 drm/msm/mdp4: Consistently use the "mdp4_" namespace Functions and other stuff all start with "mdp4_", except a few ones that start with "mpd4_" (d and p switched) Make things consistent and use "mdp4_" everywhere. Signed-off-by: Christophe JAILLET Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/661306/ Link: https://lore.kernel.org/r/6b9076268548c52ec371e9ed35fee0dd8fcb46ef.1751044672.git.christophe.jaillet@wanadoo.fr Signed-off-by: Dmitry Baryshkov commit 1e150869caf2fe540dd9c3367e124b59c23228c7 Author: Maxime Thiebaut Date: Fri Aug 22 10:40:03 2025 +0200 extract-vmlinux: Output used decompression method When extract-vmlinux succeeds, it doesn't output which decompression method was found at which offset. Adding this additional output in check_vmlinux() helps troubleshooting and reverse-engineering images. The last check_vmlinux() call was also quoted to accept spaces. Signed-off-by: Maxime Thiebaut Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/X6OQ4pHdpreJtlTnf0tFEb4Uxz8T8gFv_7Yw6tpBK4ZBgHYjJr_URwUwCVynpkb-H8Yjk7DdBF01zY-sfqu_7N5trZQfcd6s_4PtdGlHtlA=@thiebaut.dev Signed-off-by: Nathan Chancellor commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 Author: Da Xue Date: Thu Aug 21 19:33:34 2025 -0400 pinctrl: meson-gxl: add missing i2c_d pinmux Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") Signed-off-by: Da Xue Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer Signed-off-by: Linus Walleij commit e27f158cf1e98d9a541282ef4b36dfa4427bf361 Author: Wolfram Sang Date: Wed Aug 13 18:14:57 2025 +0200 peci: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Reviewed-by: Paul Menzel Link: https://lore.kernel.org/r/20250813161517.4746-12-wsa+renesas@sang-engineering.com Signed-off-by: Iwona Winiarska commit 59f5c92140de48a9ae68db4990c8a53a9ac2492c Merge: 44e51457861edd a37280daa4d583 Author: Mark Brown Date: Thu Aug 28 21:45:09 2025 +0200 ASoC: Intel: avs: Refactor machine-board registration Merge series from Cezary Rojewski : Set of patches all connected to the machine-board registration process and the board_selection.c file. Apart from LOC reduction, allows for multiple cards of the same 'type' e.g.: avs_rt5640, to be present simultanetously without any workarounds or tricks. The last patch improves debugability - helps us (the devs) deal with basic I2S-boards issues out there without forcing the user to constantly switch between debug-friendly and non-debug options. -- Initially I wanted to have the first two patches (new implementation and the follow up cleanup) to be just one patch. However, the git diff, even with --patience does not look good, at least in my opinion. Decided to split the changes into two separate patches to make it easy to review and comment. As the first two patches carry heaviest load, the summary: - provide a unified avs_register_board() wrapper for platform_device_register_data(PLATFORM_DEVID_AUTO). The _AUTO is what makes every device name unique and prevents any naming conflicts to occur when matching components <-> cards in runtime - provide avs_register_board_pdata(), a wrapper one-level above avs_register_board() that takes all custom parameters in its argument list so that the initialization of 'struct avs_mach_pdata' does not need to be repeated in every function like its done today - make use of the two above to write simpler registration functions: 1. init any interface-type-specific values e.g.: SSP port for I2S board 2. call avs_register_board_pdata() 3. register the ASoC component with avs_register_xxx_component() In regard to the last three patches - two are simplifications, no functional changes just LOC reduction and readability. The last one is to improve debug-ability, especially when working in the open field - often we, the devs, find it useful when debugging production systems to run i2s_test (the debug board) without impacting the 'real' board e.g.: avs_rt5640. By default i2s_test is empty so a typical user and their scenarios are not impacted. commit 44e51457861edd47bea0f43fab4ed952fdd901f1 Merge: f43095de82b04a 11f5c5f9e43e90 Author: Mark Brown Date: Thu Aug 28 21:45:00 2025 +0200 ASoC: use int type to store negative error codes Merge series from Qianfeng Rong : The 'ret' variable usually is used to store returns from some functions, which return either zero on success or negative error codes on failure. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. Change "ret" from u32/unsigned int to int type. No effect on runtime. commit f43095de82b04a11f7239fdf9e724d907ea3dc3b Merge: 5b4dcaf851df8c edb5c1f885207d Author: Mark Brown Date: Thu Aug 28 21:44:52 2025 +0200 ASoC: renesas: msiof: Make small adjustments to avoid Merge series from Kuninori Morimoto : Current Renesas MSIOF get unknown error when first used. This patch-set will fixup this issue. commit 03e073bc4dbc3d64ce0beb21fbe793ae7787e062 Author: David Matlack Date: Thu Aug 28 18:58:14 2025 +0000 vfio: selftests: Fix .gitignore for already tracked files Fix the rules in tools/testing/selftests/vfio/.gitignore to not ignore some already tracked files (.gitignore, Makefile, lib/libvfio.mk). This change should be a no-op, since these files are already tracked by git and thus git will not ignore updates to them even though they match the ignore rules in the VFIO selftests .gitignore file. However, they do generate warnings with W=1, as reported by the kernel test robot. $ KBUILD_EXTRA_WARN=1 scripts/misc-check tools/testing/selftests/vfio/.gitignore: warning: ignored by one of the .gitignore files tools/testing/selftests/vfio/Makefile: warning: ignored by one of the .gitignore files tools/testing/selftests/vfio/lib/libvfio.mk: warning: ignored by one of the .gitignore files Fix this by explicitly un-ignoring the tracked files. Fixes: 292e9ee22b0a ("selftests: Create tools/testing/selftests/vfio") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508280918.rFRyiLEU-lkp@intel.com/ Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250828185815.382215-1-dmatlack@google.com Signed-off-by: Alex Williamson commit 793681dc7cc6482484fdeb658f5ac20bf0a570b9 Merge: c42e36a488c7e0 ff9a7857b78482 Author: Mark Brown Date: Thu Aug 28 21:17:53 2025 +0200 add COMPILE_TEST support Merge series from Rosen Penev : Allows the buildbots to test compilation. The driver has nothing architecture specific. commit 9c66753641765cc2f5ee1528a23f3fd2fd77cb93 Author: Alex Tran Date: Sat Aug 23 14:27:32 2025 -0700 ARM: dts: ste-ux500-samsung: dts bluetooth wakeup interrupt Interrupt support on host wakeup gpio for ste-ux500-samsung bluetooth. Signed-off-by: Alex Tran Link: https://lore.kernel.org/r/20250823212732.356620-1-alex.t.tran@gmail.com Signed-off-by: Linus Walleij commit 4ce3d8526d95f414228908048a1313fe322f0d9b Author: Krzysztof Kozlowski Date: Wed Jan 15 22:16:27 2025 +0100 ARM: dts: st: ste-nomadik: Align GPIO hog name with bindings Bindings expect GPIO hog names to end with 'hog' suffix, so correct it to fix dtbs_check warning: ste-nomadik-s8815.dtb: mmcsd-gpio: $nodename:0: 'mmcsd-gpio' does not match '^.+-hog(-[0-9]+)?$' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250115211627.193961-1-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 98857d111c53954aa038fcbc4cf48873e4240f7c Author: Ricardo B. Marlière Date: Thu Aug 28 10:12:33 2025 -0300 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt the usage in test_lirc_mode2_user.c. Signed-off-by: Ricardo B. Marlière Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com commit 4fab69dd1fa52e28bb692afcb159fa8807d6d03f Author: Conor Dooley Date: Wed Aug 27 19:03:44 2025 +0100 dt-bindings: cache: ax45mp: add 2048 as a supported cache-sets value The QiLai implementation of this cache controller uses a cache-sets of 2048, and mandates it in an if/else block - but the definition of the property only permits 1024. Add 2048 as an option, and deny its use outside of the QiLai. Fixes: 51b081cdb9237 ("dt-bindings: cache: add QiLai compatible to ax45mp") Reviewed-by: Ben Zong-You Xie Signed-off-by: Conor Dooley commit 30c2b98aa84c76f2ae60e66dd4ec2d9497713359 Author: Neeraj Upadhyay Date: Thu Aug 28 12:33:17 2025 +0530 x86/apic: Add new driver for Secure AVIC The Secure AVIC feature provides SEV-SNP guests hardware acceleration for performance sensitive APIC accesses while securely managing the guest-owned APIC state through the use of a private APIC backing page. This helps prevent the hypervisor from generating unexpected interrupts for a vCPU or otherwise violate architectural assumptions around the APIC behavior. Add a new x2APIC driver that will serve as the base of the Secure AVIC support. It is initially the same as the x2APIC physical driver (without IPI callbacks), but will be modified as features are implemented. As the new driver does not implement Secure AVIC features yet, if the hypervisor sets the Secure AVIC bit in SEV_STATUS, maintain the existing behavior to enforce the guest termination. [ bp: Massage commit message. ] Co-developed-by: Kishon Vijay Abraham I Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tianyu Lan Link: https://lore.kernel.org/20250828070334.208401-2-Neeraj.Upadhyay@amd.com commit 57a48a2619c5f99d48748f9c34db510efe5ee7c9 Author: Jan Kiszka Date: Mon Jul 28 10:36:56 2025 +0800 dt-bindings: PCI: ti,am65: Extend for use with PVU The Peripheral Virtualization Unit (PVU) on the AM65 SoC is capable of restricting DMA from PCIe devices to specific regions of host memory. Add the optional property "memory-regions" to point to such regions of memory when PVU is used. Since the PVU deals with system physical addresses, utilizing the PVU with PCIe devices also requires setting up the VMAP registers to map the Requester ID of the PCIe device to the CBA Virtual ID, which in turn is mapped to the system physical address. Hence, describe the VMAP registers which are optional unless the PVU shall be used for PCIe. Signed-off-by: Jan Kiszka Signed-off-by: Li Hua Qian [mani: Expanded PVU in description] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250728023701.116963-3-huaqian.li@siemens.com commit b7243862f82a088d6fb7e22a25c7c024818e631d Author: Yannick Fertre Date: Fri Aug 22 16:34:17 2025 +0200 drm/stm: ltdc: handle lvds pixel clock Handle LVDS pixel clock. The LTDC operates with multiple clock domains for register access, requiring all clocks to be provided during read/write operations. This imposes a dependency between the LVDS and LTDC to access correctly all LTDC registers. And because both IPs' pixel rates must be synchronized, the LTDC has to handle the LVDS clock. Signed-off-by: Yannick Fertre Acked-by: Yannick Fertre Acked-by: Philippe Cornu Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-8-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit d80667642b0f43580efd489d627dd24aa10ab98f Author: Yannick Fertre Date: Fri Aug 22 16:34:16 2025 +0200 drm/stm: ltdc: support new hardware version for STM32MP25 SoC STM32MP25 SoC features a new version of the LTDC IP. Add its compatible to the list of device to probe and implement its quirks. This hardware supports a pad frequency of 150MHz and a peripheral bus clock. Signed-off-by: Yannick Fertre Acked-by: Yannick Fertre Acked-by: Philippe Cornu Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-7-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 1b9482f8dfce82af44e261c78777a37f32efe889 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:15 2025 +0200 dt-bindings: arm: stm32: add required #clock-cells property On STM32MP25 SoC, the syscfg peripheral provides a clock to the display subsystem through a multiplexer. Since it only provides a single clock, the cell value is 0. Doing so allows the clock consumers to reach the peripheral and gate the clock accordingly. Reviewed-by: Rob Herring (Arm) Reviewed-by: Yannick Fertre Acked-by: Christophe Roullier Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-6-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 08f6613e274f6cfe4d7d09ac5050d632dbba9342 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:14 2025 +0200 dt-bindings: display: st,stm32mp25-lvds: add power-domains property STM32 LVDS peripheral may be in a power domain. Allow an optional single 'power-domains' entry for STM32 LVDS devices. Acked-by: Rob Herring (Arm) Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-5-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 922e28eec67390686d944d03a12068df1197b393 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:13 2025 +0200 dt-bindings: display: st,stm32mp25-lvds: add access-controllers property access-controllers is an optional property that allows a peripheral to refer to one or more domain access controller(s). This property is added when the peripheral is under the STM32 firewall controller. It allows an accurate representation of the hardware, where the peripheral is connected to a firewall bus. The firewall can then check the peripheral accesses before allowing its device to probe. Acked-by: Rob Herring (Arm) Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-4-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 6b96ffeb81be8e43da7c4ddd0802739e22459519 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:12 2025 +0200 dt-bindings: display: st: add new compatible to LVDS device Update the compatible to accept both "st,stm32mp255-lvds" and st,stm32mp25-lvds" respectively. Default will fall back to "st,stm32mp25-lvds". Acked-by: Krzysztof Kozlowski Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-3-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 81d678332c404384e5e83300376d9be375f6d928 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:11 2025 +0200 dt-bindings: display: st,stm32-ltdc: add access-controllers property access-controllers is an optional property that allows a peripheral to refer to one or more domain access controller(s). This property is added when the peripheral is under the STM32 firewall controller. It allows an accurate representation of the hardware, where the peripheral is connected to a firewall bus. The firewall can then check the peripheral accesses before allowing its device to probe. Acked-by: Rob Herring (Arm) Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-2-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 806d4fec0b80be6964b69947aad928a322fe77e4 Author: Raphael Gallais-Pou Date: Fri Aug 22 16:34:10 2025 +0200 dt-bindings: display: st: add two new compatibles to LTDC device The new STMicroelectronics SoC features a display controller similar to the one used in previous SoCs. Because there is additional registers, and different mandatory clocks it is incompatible with existing IPs. On STM32MP251, the device only needs two clocks while on STM32MP255 it needs four. Add the new names to the list of compatible string and handle each quirks accordingly. Acked-by: Philippe Cornu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-drm-misc-next-v5-1-9c825e28f733@foss.st.com Signed-off-by: Raphael Gallais-Pou commit f2543da14dc2b9bee337f1f9466ab3fedae1cd84 Author: Erick Karanja Date: Thu Aug 28 12:35:55 2025 +0300 PCI: switchtec: Replace manual locks with guard Replace lock/unlock pairs with guards to simplify and tidy up the code. Generated-by: Coccinelle SmPL Signed-off-by: Erick Karanja Signed-off-by: Bjorn Helgaas Reviewed-by: Logan Gunthorpe Link: https://patch.msgid.link/20250828093556.810911-1-karanja99erick@gmail.com commit 53a61a6ca279165dd51f4e3bb5f8b11544915138 Author: Namhyung Kim Date: Fri Aug 15 20:16:34 2025 -0700 perf annotate: Add dso__debuginfo() helper It'd be great if it can get the correct debug information using DSO build-Id not just the path name. Instead of adding new callsites of debuginfo__new(), let's add dso__debuginfo() which can hide the access using the pathname and help the future conversion. Suggested-by: Ian Rogers Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-12-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d69f56545ed53342204136b66b4d10ba80103d14 Author: Namhyung Kim Date: Fri Aug 15 20:16:33 2025 -0700 perf annotate: Hide data-type for stack operation and canary It's mostly unnecessary to print when it has no actual type information like in the stack operations and canary. Let's have them if -v option is given. Before: $ perf annotate --code-with-type ... : 0 0xd640 <_dl_relocate_object>: 0.00 : 0: endbr64 0.00 : 4: pushq %rbp # data-type: (stack operation) 0.00 : 5: movq %rsp, %rbp 0.00 : 8: pushq %r15 # data-type: (stack operation) 0.00 : a: pushq %r14 # data-type: (stack operation) 0.00 : c: pushq %r13 # data-type: (stack operation) 0.00 : e: pushq %r12 # data-type: (stack operation) 0.00 : 10: pushq %rbx # data-type: (stack operation) 0.00 : 11: subq $0xf8, %rsp ... 0.00 : d4: testl %eax, %eax 0.00 : d6: jne 0xf424 0.00 : dc: movq 0xf0(%r14), %rbx # data-type: struct link_map +0xf0 0.00 : e3: testq %rbx, %rbx 0.00 : e6: jne 0xf2dd 0.00 : ec: cmpq $0, 0xf8(%r14) # data-type: struct link_map +0xf8 ... After: : 0 0xd640 <_dl_relocate_object>: 0.00 : 0: endbr64 0.00 : 4: pushq %rbp 0.00 : 5: movq %rsp, %rbp 0.00 : 8: pushq %r15 0.00 : a: pushq %r14 0.00 : c: pushq %r13 0.00 : e: pushq %r12 0.00 : 10: pushq %rbx 0.00 : 11: subq $0xf8, %rsp ... 0.00 : d4: testl %eax, %eax 0.00 : d6: jne 0xf424 0.00 : dc: movq 0xf0(%r14), %rbx # data-type: struct link_map +0xf0 0.00 : e3: testq %rbx, %rbx 0.00 : e6: jne 0xf2dd 0.00 : ec: cmpq $0, 0xf8(%r14) # data-type: struct link_map +0xf8 ... Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-11-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 644bbe59af3d04a0d3b78e8048a35ba68c0dbafd Author: Namhyung Kim Date: Fri Aug 15 20:16:32 2025 -0700 perf annotate: Show warning when debuginfo is not available When user requests data-type annotation but no DWARF info is available, show a warning message about it. Warning: DWARF debuginfo not found. Data-type in this DSO will not be displayed. Please make sure to have debug information. Press any key... Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-10-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1d4374afd000baa59aadb067f195d0fae9bd7f11 Author: Namhyung Kim Date: Fri Aug 15 20:16:31 2025 -0700 perf annotate: Add 'T' hot key to toggle data type display Support data type display with a key press so that users can toggle the output dynamically on TUI. Also display "[Type]" in the title line if it's enabled. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-9-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7dbe89ca3d5496a3232349f9a7edfba6f9061c4c Author: Namhyung Kim Date: Fri Aug 15 20:16:30 2025 -0700 perf annotate: Add --code-with-type support for TUI Until now, the --code-with-type option is available only on stdio. But it was an artifical limitation because of an implemention issue. Implement the same logic in annotation_line__write() for stdio2/TUI and remove the limitation and update the man page. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-8-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e38ea8c41edda61d7b86c94ff052474d0fe5bf9a Author: Namhyung Kim Date: Fri Aug 15 20:16:29 2025 -0700 perf annotate: Return printed number from disasm_line__write() Like other print functions, make disasm_line__write() return the number of printed characters. It'll be used to skip unnecessary operations when the screen is full. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-7-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7736a6fba05837d178caa3c0ced55da77377a7e6 Author: Namhyung Kim Date: Fri Aug 15 20:16:28 2025 -0700 perf annotate: Simplify width calculation in annotation_line__write() The width is updated after each part is printed. It can skip the output processing if the total printed size is bigger than the width. No function changes intended. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-6-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d94d5eb54f9cf21411ad18fa2c7b6082437aa6c5 Author: Namhyung Kim Date: Fri Aug 15 20:16:27 2025 -0700 perf annotate: Pass annotation_print_data to annotation_line__write() It will be used for data type display later. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20250816031635.25318-5-namhyung@kernel.org Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Kan Liang Cc: LKML Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 05a706b157acccc4b2c4063a63dbe38c130cd3fa Author: Namhyung Kim Date: Fri Aug 15 20:16:26 2025 -0700 perf annotate: Remove __annotation_line__write() Get rid of the internal function and convert function arguments into local variables if they are used more than once. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4e3c9dc8b80e3d78be0055ef4ea5111427eab7f7 Author: Namhyung Kim Date: Fri Aug 15 20:16:25 2025 -0700 perf annotate: Remove annotation_print_data.start The start field is to control whether the output shows full address or offset from the function start. But actually it can be changed dynamically in annotation__toggle_full_addr(). The informaiton should be available through struct annotation. Let's use it directly. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f06ba25ec54a3157c5b636483586f152f4478b9a Author: Namhyung Kim Date: Fri Aug 15 20:16:24 2025 -0700 perf annotate: Rename to __hist_entry__tui_annotate() There are three different but similar functions for annotation on TUI. Rename it to __hist_entry__tui_annotate() and make sure it passes 'he'. It's not used for now but it'll be needed for later use. Also remove map_symbol__tui_annotate() which was a simple wrapper. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250816031635.25318-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f4672dc6e9c07643c8c755856ba8e9eb9ca95d0c Author: Qianfeng Rong Date: Thu Aug 28 23:07:01 2025 +0800 regmap: use int type to store negative error codes Change the 'ret' variable from unsigned int to int to store negative error codes or zero returned by regmap_field_read() and regmap_read(), and change '-1' to 'negative errno' in the comments. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Message-ID: <20250828150702.193288-1-rongqianfeng@vivo.com> Signed-off-by: Mark Brown commit 11aa54ba4cfa5390ea47c9a1fc62502abce1f6b9 Author: Harald Freudenberger Date: Wed Aug 13 11:43:50 2025 +0200 s390/pkey: Forward keygenflags to ep11_unwrapkey The pkey ioctl PKEY_CLR2SECK2 describes in the pkey.h header file the parameter 'keygenflags' which is forwarded to the handler functions which actually deal with the clear key to secure key operation. The ep11 handler module function ep11_clr2keyblob() function receives this parameter but does not forward it to the underlying function ep11_unwrapkey() on invocation. So in the end the user of this ioctl could not forward additional key generation flags to the ep11 implementation and thus was unable to modify the key generation process in any way. So now call ep11_unwrapkey() with the real keygenflags instead of 0 and thus the user of this ioctl can for example via keygenflags provide valid combinations of XCP_BLOB_* flags. Suggested-by: Ingo Franzki Signed-off-by: Harald Freudenberger Reviewed-by: Ingo Franzki Signed-off-by: Alexander Gordeev commit b3597eb51aad4a6e985c701c129bd7fc2cf0d682 Author: Heiko Carstens Date: Tue Aug 12 16:58:43 2025 +0200 s390/boot: Add common boot_panic() code Introduce a common boot_panic() helper macro, and use it to get rid of three more or less identical implementations. Signed-off-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit e2e29752357f32feb69a68e9e6e7361405b3f289 Author: Ard Biesheuvel Date: Thu Aug 28 12:22:04 2025 +0200 x86/sev: Separate MSR and GHCB based snp_cpuid() via a callback There are two distinct callers of snp_cpuid(): the MSR protocol and the GHCB page based interface. The snp_cpuid() logic does not care about the distinction, which only matters at a lower level. But the fact that it supports both interfaces means that the GHCB page based logic is pulled into the early startup code where PA to VA conversions are problematic, given that it runs from the 1:1 mapping of memory. So keep snp_cpuid() itself in the startup code, but factor out the hypervisor calls via a callback, so that the GHCB page handling can be moved out. Code refactoring only - no functional change intended. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250828102202.1849035-25-ardb+git@google.com commit 5b4dcaf851df8c414bfc2ac3bf9c65fc942f3be4 Author: Andy Shevchenko Date: Tue Aug 26 15:27:16 2025 +0200 ASoC: amd: acp: Remove (explicitly) unused header The fwnode.h is not supposed to be used by the drivers as it has the definitions for the core parts for different device property provider implementations. Drop it. Note, that fwnode API for drivers is provided in property.h which is included here. Signed-off-by: Andy Shevchenko Message-ID: <20250826132734.278226-1-andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown commit eeb8117f5f1c2e8e625e5cb39dbccd21d395caad Author: Himal Prasad Ghimiray Date: Thu Aug 28 12:45:16 2025 +0530 drm/xe/uapi: Fix kernel-doc formatting for madvise and vma_query Correct kernel-doc formatting issues in the UAPI definitions for madvise and VMA query interfaces to resolve docutils warnings during documentation build. Fixes: 418807860e94 ("drm/xe/uapi: Add UAPI for querying VMA count and memory attributes") Fixes: 231bb0ee7aa5 ("drm/xe/uapi: Add madvise interface") Cc: Matthew Brost Cc: Lucas De Marchi Signed-off-by: Himal Prasad Ghimiray Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250828071516.3838110-1-himal.prasad.ghimiray@intel.com Signed-off-by: Lucas De Marchi commit 11f5c5f9e43e9020bae452232983fe98e7abfce0 Author: Qianfeng Rong Date: Thu Aug 28 15:53:59 2025 +0800 ASoC: qcom: use int type to store negative error codes Change the 'ret' variable from unsigned int to int to store negative error codes or zero returned by regmap_field_write(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Dmitry Baryshkov Message-ID: <20250828075406.386208-4-rongqianfeng@vivo.com> Signed-off-by: Mark Brown commit 784771cdd77091e7e93b78b5de55006295cc7b8e Author: Qianfeng Rong Date: Thu Aug 28 15:53:58 2025 +0800 ASoC: adau1977: use int type to store negative error codes Change the 'ret' variable from unsigned int to int to store negative error codes or zero returned by regmap_update_bits(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Nuno Sá Message-ID: <20250828075406.386208-3-rongqianfeng@vivo.com> Signed-off-by: Mark Brown commit d985b60f47893e8fd43989662111bebe78311cd1 Author: Qianfeng Rong Date: Thu Aug 28 15:53:57 2025 +0800 ASoC: amd: use int type to store negative error codes Change the 'ret' variable from u32 to int to store negative error codes directly or returned by other functions. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Reviewed-by: Mario Limonciello Message-ID: <20250828075406.386208-2-rongqianfeng@vivo.com> Signed-off-by: Mark Brown commit 899fb38dd76dd3ede425bbaf8a96d390180a5d1c Author: Liao Yuanhong Date: Thu Aug 28 20:27:37 2025 +0800 regulator: core: Remove redundant ternary operators For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Message-ID: <20250828122737.43488-1-liaoyuanhong@vivo.com> Signed-off-by: Mark Brown commit ed906b7076d072fc0f1b358c868ff69cab69607c Author: Riana Tauro Date: Mon Aug 25 16:05:37 2025 +0530 drm/xe/nvm: Use root tile mmio To allow initialization of nvm during early probe for future usecases, use root tile instead of root gt to access mmios, as gt is not yet initialized at early probe. v2: fix commit message (Lucas) Signed-off-by: Riana Tauro Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250825103537.2551837-1-riana.tauro@intel.com Signed-off-by: Lucas De Marchi commit 09f90256e8902793f594517ef440698585eb3595 Author: Alexandre Courbot Date: Tue Aug 26 13:07:37 2025 +0900 rust: transmute: add `from_bytes_copy` method to `FromBytes` trait `FromBytes::from_bytes` comes with a few practical limitations: - It requires the bytes slice to have the same alignment as the returned type, which might not be guaranteed in the case of a byte stream, - It returns a reference, requiring the returned type to implement `Clone` if one wants to keep the value for longer than the lifetime of the slice. To overcome these when needed, add a `from_bytes_copy` with a default implementation in the trait. `from_bytes_copy` returns an owned value that is populated using an unaligned read, removing the lifetime constraint and making it usable even on non-aligned byte slices. Reviewed-by: Alice Ryhl Acked-by: Miguel Ojeda Reviewed-by: John Hubbard Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250826-nova_firmware-v2-1-93566252fe3a@nvidia.com Signed-off-by: Alexandre Courbot commit 14cd01c28fb1e77d9bb55bd43fd8df6d584e284a Merge: 84482586b230d7 cee8d21d8091ef Author: Paolo Abeni Date: Thu Aug 28 14:51:09 2025 +0200 Merge branch 'fbnic-synchronize-address-handling-with-bmc' Alexander Duyck says: ==================== fbnic: Synchronize address handling with BMC The fbnic driver needs to communicate with the BMC if it is operating on the RMII-based transport (RBT) of the same port the host is on. To enable this we need to add rules that will route BMC traffic to the RBT/BMC and the BMC and firmware need to configure rules on the RBT side of the interface to route traffic from the BMC to the host instead of the MAC. To enable that this patch set addresses two issues. First it will cause the TCAM to be reconfigured in the event that the BMC was not previously present when the driver was loaded, but the FW sends a notification that the FW capabilities have changed and a BMC w/ various MAC addresses is now present. Second it adds support for sending a message to the firmware so that if the host adds additional MAC addresses the FW can be made aware and route traffic for those addresses from the RBT to the host instead of the MAC. ==================== Link: https://patch.msgid.link/175623715978.2246365.7798520806218461199.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit cee8d21d8091efb83760b7ad8208b4750800c521 Author: Alexander Duyck Date: Tue Aug 26 12:45:07 2025 -0700 fbnic: Push local unicast MAC addresses to FW to populate TCAMs The MACDA TCAM can only be accessed by one entity at a time and as such we cannot have simultaneous reads from the firmware to probe for changes from the host. As such we have to send a message indicating what the state of the MACDA is to the firmware when we updated it so that the firmware can sync up the TCAMs it owns to route BMC packets to the host. To support that we are adding a new message that is invoked when we write the MACDA that will notify the firmware of updates from the host and allow it to sync up the TCAM configuration to match the one on the host side. Signed-off-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://patch.msgid.link/175623750782.2246365.9178255870985916357.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 04a230b27d8f3e2312a6c6d07903bad6d09d133f Author: Alexander Duyck Date: Tue Aug 26 12:45:01 2025 -0700 fbnic: Add logic to repopulate RPC TCAM if BMC enables channel The BMC itself can decide to abandon a link and move onto another link in the event of things such as a link flap. As a result the driver may load with the BMC not present, and then needs to update things to support the BMC being present while the link is up and the NIC is passing traffic. To support this we add support to the watchdog to reinitialize the RPC to support adding the BMC unicast, multicast, and multicast promiscuous filters while the link is up and the NIC owns the link. Signed-off-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://patch.msgid.link/175623750101.2246365.8518307324797058580.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 284a67d59f39c2ac116aebbec1eb6ba6951bc37c Author: Alexander Duyck Date: Tue Aug 26 12:44:54 2025 -0700 fbnic: Pass fbnic_dev instead of netdev to __fbnic_set/clear_rx_mode To make the __fbnic_set_rx_mode and __fbnic_clear_rx_mode calls usable by more points in the code we can make to that they expect a fbnic_dev pointer instead of a netdev pointer. Signed-off-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://patch.msgid.link/175623749436.2246365.6068665520216196789.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit cf79bd4495112d93474ce9fda4564011b982dfe8 Author: Alexander Duyck Date: Tue Aug 26 12:44:47 2025 -0700 fbnic: Move promisc_sync out of netdev code and into RPC path In order for us to support the BMC possibly connecting, disconnecting, and then reconnecting we need to be able to support entities outside of just the NIC setting up promiscuous mode as the BMC can use a multicast promiscuous setup. To support that we should move the promisc_sync code out of the netdev and into the RPC section of the driver so that it is reachable from more paths. Signed-off-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://patch.msgid.link/175623748769.2246365.2130394904175851458.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 0b6da6d3a8d5391ff9da2358ac5afd8b7badd943 Author: Andy Yan Date: Fri Aug 22 14:39:48 2025 +0800 MAINTAINERS: Add entry for DW DPTX Controller bridge Add an entry for the DW DPTX Controller bridge driver. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250822063959.692098-5-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit d68ba7bac9555d05e2f5b310c898b2a5c7eff174 Author: Andy Yan Date: Fri Aug 22 14:39:47 2025 +0800 drm/rockchip: Add RK3588 DPTX output support Add driver extension for Synopsys DesignWare DPTX IP used on Rockchip RK3588 SoC. Signed-off-by: Andy Yan Acked-by: Dmitry Baryshkov Tested-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250822063959.692098-4-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 86eecc3a9c2e06462f6a273fcd24150b6da787de Author: Andy Yan Date: Fri Aug 22 14:39:46 2025 +0800 drm/bridge: synopsys: Add DW DPTX Controller support library The DW DP TX Controller is compliant with the DisplayPort Specification Version 1.4 with the following features: * DisplayPort 1.4a * Main Link: 1/2/4 lanes * Main Link Support 1.62Gbps, 2.7Gbps, 5.4Gbps and 8.1Gbps * AUX channel 1Mbps * Single Stream Transport(SST) * Multistream Transport (MST) * Type-C support (alternate mode) * HDCP 2.2, HDCP 1.3 * Supports up to 8/10 bits per color component * Supports RBG, YCbCr4:4:4, YCbCr4:2:2, YCbCr4:2:0 * Pixel clock up to 594MHz * I2S, SPDIF audio interface Add library with common helpers to make it can be shared with other SoC. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Tested-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250822063959.692098-3-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 2b036b13c8c2cadf7a27036f911ec99742504fce Author: Andy Yan Date: Fri Aug 22 14:39:45 2025 +0800 dt-bindings: display: rockchip: Add schema for RK3588 DPTX Controller The Rockchip RK3588 SoC integrates the Synopsys DesignWare DPTX controller. And this DPTX controller need share a USBDP PHY with the USB 3.0 OTG controller during operation. Signed-off-by: Andy Yan Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250822063959.692098-2-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 6d54d935062e2d4a7d3f779ceb9eeff108d0535d Author: Peter Robinson Date: Wed Aug 27 15:30:37 2025 +0100 arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro Update the wake-up pin and associated interupt details for the Pinebook Pro WiFi module. Signed-off-by: Peter Robinson Link: https://lore.kernel.org/r/20250827143040.1644867-1-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit dfdda0881b353453afc376f7f2bf6a8306fcada3 Author: Anton Kirilov Date: Wed Aug 27 15:22:10 2025 +0100 arm64: dts: rockchip: Enable the NPU on NanoPi R6C/R6S Enable the NPU on FriendlyElec NanoPi R6C/R6S boards. Signed-off-by: Anton Kirilov Link: https://lore.kernel.org/r/20250827142210.2221606-1-anton.kirilov@arm.com Signed-off-by: Heiko Stuebner commit 84482586b230d7491a4df1076627a367c75e1d8e Merge: e2507985862791 a2317231df4b22 Author: Paolo Abeni Date: Thu Aug 28 14:42:02 2025 +0200 Merge branch 'add-si3474-pse-controller-driver' Piotr Kubik says: ==================== Add Si3474 PSE controller driver From: Piotr Kubik These patch series provide support for Skyworks Si3474 I2C Power Sourcing Equipment controller. Based on the TPS23881 driver code. Supported features of Si3474: - get port status, - get port power, - get port voltage, - enable/disable port power Signed-off-by: Piotr Kubik ==================== Link: https://patch.msgid.link/6af537dc-8a52-4710-8a18-dcfbb911cf23@adtran.com Signed-off-by: Paolo Abeni commit a2317231df4b22e6634fe3d8645e7cef848acf49 Author: Piotr Kubik Date: Tue Aug 26 14:41:58 2025 +0000 net: pse-pd: Add Si3474 PSE controller driver Add a driver for the Skyworks Si3474 I2C Power Sourcing Equipment controller. Driver supports basic features of Si3474 IC: - get port status, - get port power, - get port voltage, - enable/disable port power. Only 4p configurations are supported at this moment. Signed-off-by: Piotr Kubik Reviewed-by: Kory Maincent Link: https://patch.msgid.link/9b72c8cd-c8d3-4053-9c80-671b9481d166@adtran.com Signed-off-by: Paolo Abeni commit 7cb4d28e1195da9ebcdd5c2296af2fe3baad5421 Author: Piotr Kubik Date: Tue Aug 26 14:41:44 2025 +0000 dt-bindings: net: pse-pd: Add bindings for Si3474 PSE controller Add the Si3474 I2C Power Sourcing Equipment controller device tree bindings documentation. Signed-off-by: Piotr Kubik Reviewed-by: Krzysztof Kozlowski Reviewed-by: Kory Maincent Link: https://patch.msgid.link/71a67c6f-6fce-49c7-96ec-554602dbd4f1@adtran.com Signed-off-by: Paolo Abeni commit 5f284dc15ca8695d0394414045ac64616a3b0e69 Author: Tianling Shen Date: Mon Aug 25 01:00:13 2025 +0800 mtd: spinand: add support for FudanMicro FM25S01A Add support for FudanMicro FM25S01A SPI NAND. Datasheet: http://eng.fmsh.com/nvm/FM25S01A_ds_eng.pdf Signed-off-by: Tianling Shen Signed-off-by: Miquel Raynal commit 49b9254217048068ae1011619db60a6de5edf7e2 Author: Teng Wu Date: Mon Aug 18 21:52:27 2025 +0800 mtd: spinand: gigadevice: Add continuous read support GD5F1GM9 supports a high-speed Continuous Read (CR) mode which allows the entire memory array to be read out by a single read command without re-issuing the 13h “Page Read to Cache” command for every page. Datasheet summary Feature register B0[3] (NR bit) 1 = Normal Read (default) 0 = Continuous Read (CR) ECC status register 7Ch Normal read: bits [3:0] → ECC status of last page Continuous read: bits [7:4] → accumulated max bit-flips over the whole sequential read operation. Datasheet: https://github.com/WT-886/DATASHEET/blob/main/GD5F1GM9-v1.0.pdf Signed-off-by: Teng Wu Signed-off-by: Miquel Raynal commit 5b5dc7db5a8dc2c221526acf81b323ec1f972d0f Author: Gabor Juhos Date: Mon Aug 11 10:30:42 2025 +0200 mtd: nand: qpic_common: use {cmd,data}_sgl_nitems for sg_init_table() Since commit ddaad4ad774d ("mtd: nand: qpic_common: prevent out of bounds access of BAM arrays"), the {cmd,data}_sgl_nitems members in the 'bam_transaction' structure are containing the number of elements in the cmd/data scatter-gather lists. Change the qcom_clear_bam_transaction() function to use these numbers while reinitializing the sg lists instead of recomputing the number of elements to make it less error prone. Signed-off-by: Gabor Juhos Acked-by: Konrad Dybcio Signed-off-by: Miquel Raynal commit 3ea299d3dccdb8554057d0a87552e7673baea95d Author: Gabor Juhos Date: Mon Aug 11 09:40:40 2025 +0200 mtd: nand: qpic-common: remove a bunch of unused defines A bunch of definitions in the 'nand-qpic-common.h' header became unused after the conversion of the 'qcom_nandc' and 'spi-qpic-snand' drivers to use the FIELD_PREP() macro, so remove those. No functional changes. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal commit 851c4c96db001f51bdad1432aa54549c7fe2c63e Author: Christoph Hellwig Date: Mon Aug 25 13:15:00 2025 +0200 xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr Use the direct I/O alignment reporting from ->getattr instead of reimplementing it. This exposes the relaxation of the memory alignment in the XFS_IOC_DIOINFO info and ensure the information will stay in sync. Note that randholes.c in xfstests has a bug where it incorrectly fails when the required memory alignment is smaller than the pointer size. Round up the reported value as there is a fair chance that this code got copied into various applications. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 0239bd9fa445a21def88f7e76fe6e0414b2a4da0 Author: Andrey Albershteyn Date: Mon Aug 4 14:08:16 2025 +0200 xfs: allow setting file attributes on special files XFS does't have file attributes manipulation ioctls for special files. Changing or reading file attributes is rejected for them in xfs_fileattr_*et(). In XFS, this is necessary to work for project quota directories. When project is set up, xfs_quota opens and calls FS_IOC_SETFSXATTR on every inode in the directory. However, special files are skipped due to open() returning a special inode for them. So, they don't even get to this check. The recently added file_getattr/file_setattr will call xfs_fileattr_*et, on special files. This patch allows reading/changing file attributes on special files. Signed-off-by: Andrey Albershteyn Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8a221004fe5288b66503699a329a6b623be13f91 Author: Andrey Albershteyn Date: Mon Aug 4 14:08:15 2025 +0200 xfs: add .fileattr_set and fileattr_get callbacks for symlinks As there are now file_getattr() and file_setattr(), xfs_quota will call them on special files. These new syscalls call ->fileattr_get/set. Symlink inodes don't have callbacks to set file attributes. This patch adds them. The attribute values combinations are checked in fileattr_set_prepare(). Signed-off-by: Andrey Albershteyn Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8d2f9f5c64f16e0717854fb66d795ebe8c30103b Author: Andrey Albershteyn Date: Mon Aug 4 14:08:14 2025 +0200 xfs: allow renames of project-less inodes Special file inodes cannot have project ID set from userspace and are skipped during initial project setup. Those inodes are left project-less in the project directory. New inodes created after project initialization do have an ID. Creating hard links or renaming those project-less inodes then fails on different ID check. In commit e23d7e82b707 ("xfs: allow cross-linking special files without project quota"), we relaxed the project id checks to allow hardlinking special files with differing project ids since the projid cannot be changed. Apply the same workaround for renaming operations. Signed-off-by: Andrey Albershteyn Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ee1cb9b0e6a80c4f9011e7a9f87e3942a65e6f16 Author: Suma Hegde Date: Thu Aug 7 11:42:03 2025 +0000 platform/x86/amd/hsmp: Replace dev_err() with dev_info() for non-fatal errors Failure in metric table initialization and hwmon registration are non-fatal errors. Hence replace them with dev_info(). Signed-off-by: Suma Hegde Link: https://lore.kernel.org/r/20250807114203.982860-1-suma.hegde@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ba9eddc43f2f05a99d3f7535c9367845aca35904 Author: Wolfram Sang Date: Wed Aug 13 21:13:44 2025 +0200 platform/x86: portwell-ec: don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Reviewed-by: Yen-Chi Huang Tested-by: Yen-Chi Huang Link: https://lore.kernel.org/r/20250813191416.6860-2-wsa+renesas@sang-engineering.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 55df384148396c0503cfc51a9c7177df6a423843 Author: Qianfeng Rong Date: Tue Aug 19 21:51:55 2025 +0800 platform/x86/intel/pmc: use kcalloc() instead of kzalloc() Replace devm_kzalloc() with devm_kcalloc() in pmc_core_get_tgl_lpm_reqs(). As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Using devm_kcalloc() provides built-in overflow protection, making the memory allocation safer when calculating the allocation size compared to explicit multiplication. [1]: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Signed-off-by: Qianfeng Rong Acked-by: David E. Box Link: https://lore.kernel.org/r/20250819135155.338380-1-rongqianfeng@vivo.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6d47b4f08436cb682fb2644e6265a3897fd42a77 Author: Srinivas Pandruvada Date: Tue Aug 19 14:10:34 2025 -0700 platform/x86/intel-uncore-freq: Fix warning in partitioned system A partitioned system configured with only one package and one compute die, warning will be generated for duplicate sysfs entry. This typically occurs during the platform bring-up phase. Partitioned systems expose dies, equivalent to TPMI compute domains, through the CPUID. Each partitioned system must contains at least one compute die per partition, resulting in a minimum of two dies per package. Hence the function topology_max_dies_per_package() returns at least two, and the condition "topology_max_dies_per_package() > 1" prevents the creation of a root domain. In this case topology_max_dies_per_package() will return 1 and root domain will be created for partition 0 and a duplicate sysfs warning for partition 1 as both partitions have same package ID. To address this also check for non zero partition in addition to topology_max_dies_per_package() > 1. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20250819211034.3776284-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Ilpo Järvinen commit faec01b1a4998f3747f55e394409bdcb541af319 Author: Xichao Zhao Date: Wed Aug 20 16:51:01 2025 +0800 platform/x86: x86-android-tablets: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250820085101.395377-1-zhao.xichao@vivo.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 98aadf8e494d2bf66b15d0ef9646ad9fdb6ded15 Author: Gladyshev Ilya Date: Wed Aug 20 20:41:32 2025 +0300 platform/x86: Add WMI driver for Redmibook keyboard This driver implements support for various Fn keys (like Cut) and Xiaomi specific AI button. Reviewed-by: Armin Wolf Signed-off-by: Gladyshev Ilya Link: https://lore.kernel.org/r/20250820174140.41410-1-foxido@foxido.dev [ij: use BIT(8) instead of 0x00000100] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1866c3b93989081770e0a59c671a483eb72ea85b Author: Xi Pardee Date: Tue Aug 26 11:39:43 2025 -0700 platform/x86/intel/pmc: Add Wildcat Lake support to intel_pmc_core Add Wildcat Lake support to intel_pmc_core driver. Signed-off-by: Xi Pardee Link: https://lore.kernel.org/r/20250826183946.802684-2-xi.pardee@linux.intel.com [ij: added #include for BIT()] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c138158e87aaca6da345603a03e5d9e8d90fdd36 Author: Xi Pardee Date: Tue Aug 26 11:39:42 2025 -0700 platform/x86/intel/pmc: Add Wildcat Lake support to Intel PMC SSRAM Telemetry Add Wildcat Lake support to Intel PMC SSRAM Telemetry driver. Signed-off-by: Xi Pardee Link: https://lore.kernel.org/r/20250826183946.802684-1-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 54cf44517550d53960d2fc5f85cf55d668c8889d Author: Yen-Chi Huang Date: Thu Aug 28 13:31:17 2025 +0800 platform/x86: portwell-ec: Add suspend/resume support for watchdog Portwell EC does not disable the watchdog during suspend. To avoid unwanted resets, this patch adds suspend and resume callbacks (pwec_suspend() and pwec_resume()) to the driver. The watchdog is stopped in pwec_suspend() and restarted in pwec_resume() if it was active before suspend. Signed-off-by: Yen-Chi Huang Link: https://lore.kernel.org/r/c9cfe602-c279-4aa4-9932-76f47f26556c@portwell.com.tw [ij: removed extra "3"] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 72031905cf2e36519a98b5becbe62dc10ebb4b97 Author: Christian S. Lima Date: Sun Aug 24 18:31:33 2025 -0300 rust: transmute: Add methods for FromBytes trait The two methods added take a slice of bytes and return those bytes in a specific type. These methods are useful when we need to transform the stream of bytes into specific type. Since the `is_aligned` method for pointer types has been stabilized in `1.79` version and is being used in this patch, I'm enabling the feature. In this case, using this method is useful to check the alignment and avoid a giant boilerplate, such as `(foo.as_ptr() as usize) % core::mem::align_of::() == 0`. Also add `#[allow(clippy::incompatible_msrv)]` where needed until the MSRV is updated to `1.79`. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1119 Reviewed-by: Alice Ryhl Tested-by: Alexandre Courbot Reviewed-by: Alexandre Courbot Signed-off-by: Christian S. Lima Link: https://lore.kernel.org/r/20250824213134.27079-1-christiansantoslima21@gmail.com Acked-by: Miguel Ojeda [acourbot@nvidia.com: minor rewording of commit messages and doccomments] [acourbot@nvidia.com: revert slice implementation removal] [acourbot@nvidia.com: move incompatible_msrv clippy allow closer to site of need] [acourbot@nvidia.com: call the doctest method] Signed-off-by: Alexandre Courbot commit 07188450191da0e3cff6f6d0c42de74d6cdb3602 Author: Colin Ian King Date: Fri Aug 8 11:57:51 2025 +0100 soc: hisilicon: kunpeng_hccs: Fix spelling mistake "decrese" -> "decrease" There is a spelling mistake in a dev_err message. Fix it. Fixes: e3c289c0916e ("soc: hisilicon: kunpeng_hccs: Support low power feature for the specified HCCS type") Signed-off-by: Colin Ian King Reviewed-by: Huisong Li Signed-off-by: Wei Xu commit 12267f831fa6fe679019d09c48089941908b7cf3 Author: Marcin Bernatowicz Date: Thu Aug 14 16:59:50 2025 +0200 drm/xe/tests: Make cross-device dma-buf BOs CPU-visible on small BAR Small-BAR systems (e.g., SR-IOV VFs in VMs) expose only a subset of VRAM via PCI/BAR. Exporting a BO outside that window fails, and the selftests also do CPU fill/verify. Set XE_BO_FLAG_NEEDS_CPU_ACCESS for cross-device variants to force CPU-mappable placement and keep tests reliable. Large-BAR/P2P setups are unaffected. Suggested-by: Matthew Auld Signed-off-by: Marcin Bernatowicz Cc: Matthew Auld Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250814145950.430231-1-marcin.bernatowicz@linux.intel.com Signed-off-by: Michał Winiarski commit e25079858627916b22c4a789005a90a9fae808d8 Merge: c2a756891bb428 b81aa23234d94d Author: Paolo Abeni Date: Thu Aug 28 13:14:52 2025 +0200 Merge branch 'net-better-drop-accounting' Eric Dumazet says: ==================== net: better drop accounting Incrementing sk->sk_drops for every dropped packet can cause serious cache line contention under DOS. Add optional sk->sk_drop_counters pointer so that protocols can opt-in to use two dedicated cache lines to hold drop counters. Convert UDP and RAW to use this infrastructure. Tested on UDP (see patch 4/5 for details) Before: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 615091 0.0 Udp6InErrors 3904277 0.0 Udp6RcvbufErrors 3904277 0.0 After: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 816281 0.0 Udp6InErrors 7497093 0.0 Udp6RcvbufErrors 7497093 0.0 ==================== Link: https://patch.msgid.link/20250826125031.1578842-1-edumazet@google.com Signed-off-by: Paolo Abeni commit b81aa23234d94d99951761d9864061d774633ba9 Author: Eric Dumazet Date: Tue Aug 26 12:50:31 2025 +0000 inet: raw: add drop_counters to raw sockets When a packet flood hits one or more RAW sockets, many cpus have to update sk->sk_drops. This slows down other cpus, because currently sk_drops is in sock_write_rx group. Add a socket_drop_counters structure to raw sockets. Using dedicated cache lines to hold drop counters makes sure that consumers no longer suffer from false sharing if/when producers only change sk->sk_drops. This adds 128 bytes per RAW socket. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250826125031.1578842-6-edumazet@google.com Signed-off-by: Paolo Abeni commit 51132b99f01ce05f8008f0fb189d83eed484bd53 Author: Eric Dumazet Date: Tue Aug 26 12:50:30 2025 +0000 udp: add drop_counters to udp socket When a packet flood hits one or more UDP sockets, many cpus have to update sk->sk_drops. This slows down other cpus, because currently sk_drops is in sock_write_rx group. Add a socket_drop_counters structure to udp sockets. Using dedicated cache lines to hold drop counters makes sure that consumers no longer suffer from false sharing if/when producers only change sk->sk_drops. This adds 128 bytes per UDP socket. Tested with the following stress test, sending about 11 Mpps to a dual socket AMD EPYC 7B13 64-Core. super_netperf 20 -t UDP_STREAM -H DUT -l10 -- -n -P,1000 -m 120 Note: due to socket lookup, only one UDP socket is receiving packets on DUT. Then measure receiver (DUT) behavior. We can see both consumer and BH handlers can process more packets per second. Before: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 615091 0.0 Udp6InErrors 3904277 0.0 Udp6RcvbufErrors 3904277 0.0 After: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 816281 0.0 Udp6InErrors 7497093 0.0 Udp6RcvbufErrors 7497093 0.0 Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250826125031.1578842-5-edumazet@google.com Signed-off-by: Paolo Abeni commit c51613fa276f038bdd18656a57a90ccc5d4e5200 Author: Eric Dumazet Date: Tue Aug 26 12:50:29 2025 +0000 net: add sk->sk_drop_counters Some sockets suffer from heavy false sharing on sk->sk_drops, and fields in the same cache line. Add sk->sk_drop_counters to: - move the drop counter(s) to dedicated cache lines. - Add basic NUMA awareness to these drop counter(s). Following patches will use this infrastructure for UDP and RAW sockets. sk_clone_lock() is not yet ready, it would need to properly set newsk->sk_drop_counters if we plan to use this for TCP sockets. v2: used Paolo suggestion from https://lore.kernel.org/netdev/8f09830a-d83d-43c9-b36b-88ba0a23e9b2@redhat.com/ Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250826125031.1578842-4-edumazet@google.com Signed-off-by: Paolo Abeni commit cb4d5a6eb600a43c2e3ec7f54e06d07aa33d8062 Author: Eric Dumazet Date: Tue Aug 26 12:50:28 2025 +0000 net: add sk_drops_skbadd() helper Existing sk_drops_add() helper is renamed to sk_drops_skbadd(). Add sk_drops_add() and convert sk_drops_inc() to use it. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250826125031.1578842-3-edumazet@google.com Signed-off-by: Paolo Abeni commit f86f42ed2c471da5b061492bb8ab1d3d73c19c58 Author: Eric Dumazet Date: Tue Aug 26 12:50:27 2025 +0000 net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers We want to split sk->sk_drops in the future to reduce potential contention on this field. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250826125031.1578842-2-edumazet@google.com Signed-off-by: Paolo Abeni commit c2a756891bb428104fa8899998ba277042274cdb Author: Jakub Kicinski Date: Mon Aug 25 13:18:28 2025 -0700 uapi: wrap compiler_types.h in an ifdef instead of the implicit strip The uAPI stddef header includes compiler_types.h, a kernel-only header, to make sure that kernel definitions of annotations like __counted_by() take precedence. There is a hack in scripts/headers_install.sh which strips includes of compiler.h and compiler_types.h when installing uAPI headers. While explicit handling makes sense for compiler.h, which is included all over the uAPI, compiler_types.h is only included by stddef.h (within the uAPI, obviously it's included in kernel code a lot). Remove the stripping from scripts/headers_install.sh and wrap the include of compiler_types.h in #ifdef __KERNEL__ instead. This should be equivalent functionally, but is easier to understand to a casual reader of the code. It also makes it easier to work with kernel headers directly from under tools/ Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250825201828.2370083-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 24f028b91ed3329b259874e28b54aa715b008153 Author: Steven Price Date: Fri Aug 15 14:42:24 2025 +0100 drm/panthor: Simplify mmu_hw_do_operation_locked The only callers to mmu_hw_do_operation_locked() pass an 'op' of either AS_COMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT. This means the code paths after that are dead. Removing those paths means the mmu_hw_do_flush_on_gpu_ctrl() function might has well be inlined. Simplify everything by having a switch statement for the type of 'op' (warning if we get an unexpected value) and removing the dead cases. Suggested-by: Daniel Stone Signed-off-by: Steven Price Reviewed-by: Karunika Choo Link: https://lore.kernel.org/r/20250815134226.57703-1-steven.price@arm.com commit 3c8d31b8937a7ee6e5de74f0274810b8705d77ea Author: Alice Ryhl Date: Wed Aug 27 13:38:39 2025 +0000 gpuvm: remove gem.gpuva.lock_dep_map Since all users of gem.gpuva.lock_dep_map now rely on the mutex directly in gpuva, we may remove it. Whether the mutex is used is now tracked by a flag in gpuvm rather than by whether lock_dep_map is null. Note that a GEM object may not be pushed to multiple gpuvms that disagree on the value of this new flag. But that's okay because a single driver should use the same locking scheme everywhere, and a GEM object is driver specific (when a GEM is exported with prime, a new GEM object instance is created from the backing dma-buf). The flag is present even with CONFIG_LOCKDEP=n because the intent is that the flag will also cause vm_bo cleanup to become deferred. However, that will happen in a follow-up patch. Reviewed-by: Boris Brezillon Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250827-gpuva-mutex-in-gem-v3-3-bd89f5a82c0d@google.com [ Use lockdep_is_held() instead of lock_is_held(). - Danilo ] Signed-off-by: Danilo Krummrich commit 69013f52b4b6782db6941f83b6ff1be123bfa9e5 Author: Alice Ryhl Date: Wed Aug 27 13:38:38 2025 +0000 panthor: use drm_gem_object.gpuva.lock instead of gpuva_list_lock Now that drm_gem_object has a dedicated mutex for the gpuva list that is intended to be used in cases that must be fence signalling safe, use it in Panthor. Reviewed-by: Boris Brezillon Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250827-gpuva-mutex-in-gem-v3-2-bd89f5a82c0d@google.com Signed-off-by: Danilo Krummrich commit e7fa80e2932c68c17e7003fdfd01addc123567f7 Author: Alice Ryhl Date: Wed Aug 27 13:38:37 2025 +0000 drm_gem: add mutex to drm_gem_object.gpuva There are two main ways that GPUVM might be used: * staged mode, where VM_BIND ioctls update the GPUVM immediately so that the GPUVM reflects the state of the VM *including* staged changes that are not yet applied to the GPU's virtual address space. * immediate mode, where the GPUVM state is updated during run_job(), i.e., in the DMA fence signalling critical path, to ensure that the GPUVM and the GPU's virtual address space has the same state at all times. Currently, only Panthor uses GPUVM in immediate mode, but the Rust drivers Tyr and Nova will also use GPUVM in immediate mode, so it is worth to support both staged and immediate mode well in GPUVM. To use immediate mode, the GEMs gpuva list must be modified during the fence signalling path, which means that it must be protected by a lock that is fence signalling safe. For this reason, a mutex is added to struct drm_gem_object that is intended to achieve this purpose. Adding it directly in the GEM object both makes it easier to use GPUVM in immediate mode, but also makes it possible to take the gpuva lock from core drm code. As a follow-up, another change that should probably be made to support immediate mode is a mechanism to postpone cleanup of vm_bo objects, as dropping a vm_bo object in the fence signalling path is problematic for two reasons: * When using DRM_GPUVM_RESV_PROTECTED, you cannot remove the vm_bo from the extobj/evicted lists during the fence signalling path. * Dropping a vm_bo could lead to the GEM object getting destroyed. The requirement that GEM object cleanup is fence signalling safe is dubious and likely to be violated in practice. Panthor already has its own custom implementation of postponing vm_bo cleanup. Reviewed-by: Boris Brezillon Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250827-gpuva-mutex-in-gem-v3-1-bd89f5a82c0d@google.com Signed-off-by: Danilo Krummrich commit ed8c952aee4183ac866a83397e12ceb99493c6ad Author: Wolfram Sang Date: Mon Aug 11 20:37:11 2025 +0200 ARM: dts: stm32: use recent scl/sda gpio bindings We have dedictaded bindings for scl/sda nowadays. Switch away from the deprecated plain 'gpios' property. Reviewed-by: Linus Walleij Signed-off-by: Wolfram Sang commit 08468d0bf1ae52ece5394eaca6a6fd3543817f9f Author: Wolfram Sang Date: Mon Aug 11 20:37:10 2025 +0200 ARM: dts: cirrus: ep7211: use recent scl/sda gpio bindings We have dedictaded bindings for scl/sda nowadays. Switch away from the deprecated plain 'gpios' property. Reviewed-by: Linus Walleij Signed-off-by: Wolfram Sang commit a37280daa4d583c7212681c49b285de9464a5200 Author: Cezary Rojewski Date: Wed Aug 27 16:22:29 2025 +0200 ASoC: Intel: avs: Allow i2s test and non-test boards to coexist The i2s_test card serves debug purpose and is not probed by default. Currently i2s_test and non-i2s_test sound cards exclude each other. To increase the test coverage, allow both board types to be probed simultaneously and share the available SSP port pool. As 'i2s_test' module parameter is empty by default and requires manual input from user to activate, there is no impact for standard production scenarios. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Message-ID: <20250827142229.869139-6-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit db41fe9baa8b8bd1a1aa96962dd4294f2a9135c7 Author: Cezary Rojewski Date: Wed Aug 27 16:22:28 2025 +0200 ASoC: Intel: avs: Simplify avs_get_i2s_boards() No functional changes, just code simplification and readability improvements as there is no need to operate on 'struct avs_acpi_boards' if 'struct snd_soc_acpi_mach' is what interests us. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Message-ID: <20250827142229.869139-5-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit a44281b8b58a88ca3020c89fd697fc1cd18a31b4 Author: Cezary Rojewski Date: Wed Aug 27 16:22:27 2025 +0200 ASoC: Intel: avs: Simplify dmi_match_quirk() No functional changes, just code lines reduction. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Message-ID: <20250827142229.869139-4-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 6acfaee44cbe9364a91dcc373fb4e6e395c5b20b Author: Cezary Rojewski Date: Wed Aug 27 16:22:26 2025 +0200 ASoC: Intel: avs: Cleanup duplicate members Switch to the new board registration functions and remove the then-unused code. The SSP-number-check is still important and cannot be just dropped. Move it from avs_register_i2s_board(), which is being removed with this patch, to avs_register_i2s_boards() to maintain sanity when registering a board. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Message-ID: <20250827142229.869139-3-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit 3351e814cb49dff7ef4808f5ebfb299162994118 Author: Cezary Rojewski Date: Wed Aug 27 16:22:25 2025 +0200 ASoC: Intel: avs: New board registration routines To support multiple instances of the same card utilize PLATFORM_DEVID_AUTO when registering new platform devices. This adaptation is also an opportunity to streamline the devices registration - avs_register_board(). All the new functions are equivalents of the existing ones apart from adjusting platform_device_register_data() call with PLATFORM_DEVID_AUTO and code size reduction given the presence of unified register function. Follow up changes will complete the transition and cleanup the duplicate members. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Message-ID: <20250827142229.869139-2-cezary.rojewski@intel.com> Signed-off-by: Mark Brown commit bddf32f16534be69cff99180d16a1c129bfcc226 Author: Chen Ni Date: Thu Aug 28 16:57:08 2025 +0800 drm/vesadrm: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250828085708.3383760-1-nichen@iscas.ac.cn commit 3b6f62b6b5777f56e3fedc45041c2f61645b5204 Author: Ville Syrjälä Date: Tue Aug 26 15:18:59 2025 +0300 iopoll: Reorder the timeout handling in poll_timeout_us() Currently poll_timeout_us() evaluates 'op' and 'cond' twice within the loop, once at the start, and a second time after the timeout check. While it's probably not a big deal to do it twice almost back to back, it does make the macro a bit messy. Simplify the implementation to evaluate the timeout at the very start, then follow up with 'op'/'cond', and finally check if the timeout did in fact happen or not. For good measure throw in a compiler barrier between the timeout and 'op'/'cond' evaluations to make sure the compiler can't reoder the operations (which could cause false positive timeouts). The similar i915 __wait_for() macro already has the barrier, though there it is between the 'op' and 'cond' evaluations, which seems like it could still allow 'op' and the timeout evaluations to get reordered incorrectly. I suppose the ktime_get() might itself act as a sufficient barrier here, but better safe than sorry I guess. Cc: Lucas De Marchi Cc: Dibin Moolakadan Subrahmanian Cc: Imre Deak Cc: David Laight Cc: Geert Uytterhoeven Cc: Matt Wagantall Cc: Dejin Zheng Cc: intel-gfx@lists.freedesktop.org Cc: intel-xe@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Jani Nikula Acked-by: Simona Vetter Signed-off-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250826121859.15497-3-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula commit 563e5eca4ea3b6e1901cbc7cd6dc42731a8d2999 Author: Ville Syrjälä Date: Tue Aug 26 15:18:58 2025 +0300 iopoll: Avoid evaluating 'cond' twice in poll_timeout_us() Currently poll_timeout_us() evaluates 'cond' twice at the end of the success case. This not desirable in case 'cond' itself is expensive. Avoid the double evaluation by tracking the return value in a variable. Need to use a triple undescore '___ret' name to avoid a conflict with an existing double undescore '__ret' variable in the regmap code. Cc: Lucas De Marchi Cc: Dibin Moolakadan Subrahmanian Cc: Imre Deak Cc: David Laight Cc: Geert Uytterhoeven Cc: Matt Wagantall Cc: Dejin Zheng Cc: intel-gfx@lists.freedesktop.org Cc: intel-xe@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Jani Nikula Acked-by: Simona Vetter Signed-off-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250826121859.15497-2-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula commit 9df8043a546d2eb3adfaba920c027c0d701c73a1 Author: Ville Syrjälä Date: Tue Aug 26 15:18:57 2025 +0300 iopoll: Generalize read_poll_timeout() into poll_timeout_us() While read_poll_timeout() & co. were originally introduced just for simple I/O usage scenarios they have since been generalized to be useful in more cases. However the interface is very cumbersome to use in the general case. Attempt to make it more flexible by combining the 'op', 'var' and 'args' parameter into just a single 'op' that the caller can fully specify. For example i915 has one case where one might currently have to write something like: ret = read_poll_timeout(drm_dp_dpcd_read_byte, err, err || (status & mask), 0 * 1000, 200 * 1000, false, aux, DP_FEC_STATUS, &status); which is practically illegible, but with the adjusted macro we do: ret = poll_timeout_us(err = drm_dp_dpcd_read_byte(aux, DP_FEC_STATUS, &status), err || (status & mask), 0 * 1000, 200 * 1000, false); which much easier to understand. One could even combine the 'op' and 'cond' parameters into one, but that might make the caller a bit too unwieldly with assignments and checks being done on the same statement. This makes poll_timeout_us() closer to the i915 __wait_for() macro, with the main difference being that __wait_for() uses expenential backoff as opposed to the fixed polling interval used by poll_timeout_us(). Eventually we might be able to switch (at least most of) i915 to use poll_timeout_us(). v2: Fix typos (Jani) Fix delay_us docs for poll_timeout_us_atomic() (Jani) Cc: Lucas De Marchi Cc: Dibin Moolakadan Subrahmanian Cc: Imre Deak Cc: David Laight Cc: Geert Uytterhoeven Cc: Matt Wagantall Cc: Dejin Zheng Cc: intel-gfx@lists.freedesktop.org Cc: intel-xe@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Jani Nikula Acked-by: Simona Vetter Signed-off-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250826121859.15497-1-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula commit c42e36a488c7e01f833fc9f4814f735b66b2d494 Author: Claudiu Beznea Date: Wed Aug 27 13:16:12 2025 +0300 spi: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Message-ID: <20250827101612.928008-1-claudiu.beznea.uj@bp.renesas.com> Signed-off-by: Mark Brown commit ff9a7857b7848227788f113d6dc6a72e989084e0 Author: Rosen Penev Date: Tue Aug 26 14:24:13 2025 -0700 spi: rb4xx: use devm for clk_prepare_enable Remove the remove function as it no longer does anything useful. Also remove platform_set_drvdata as get becomes completely unused. Signed-off-by: Rosen Penev Message-ID: <20250826212413.15065-4-rosenp@gmail.com> Signed-off-by: Mark Brown commit f18f0ac5331f8f13737e87cc1416837fb5b27b0a Author: Rosen Penev Date: Tue Aug 26 14:24:12 2025 -0700 spi: rb4xx: add COMPILE_TEST support Copy macros from ath79 SPI driver to allow compilation on all platforms and remove ath79 specific header. Signed-off-by: Rosen Penev Message-ID: <20250826212413.15065-3-rosenp@gmail.com> Signed-off-by: Mark Brown commit c73c378dc05ba8060558b9b50e37f3afa4763ea1 Author: Rosen Penev Date: Tue Aug 26 14:24:11 2025 -0700 spi: rb4xx: depend on OF There's no support for non OF platforms. Better to depend on OF explicitly. Also fixes a warning/error about the dt table being unused because of of_match_ptr on non OF platforms. Signed-off-by: Rosen Penev Message-ID: <20250826212413.15065-2-rosenp@gmail.com> Signed-off-by: Mark Brown commit e2ab5f600bb01d3625d667d97b3eb7538e388336 Author: Onur Özkan Date: Thu Aug 21 12:07:20 2025 +0300 rust: regulator: use `to_result` for error handling Simplifies error handling by replacing the manual check of the return value with the `to_result` helper. Signed-off-by: Onur Özkan Reviewed-by: Daniel Almeida Message-ID: <20250821090720.23939-1-work@onurozkan.dev> Signed-off-by: Mark Brown commit b088b6189a4066b97cef459afd312fd168a76dea Author: Chen-Yu Tsai Date: Mon Aug 25 23:11:09 2025 +0800 ASoC: mediatek: common: Switch to for_each_available_child_of_node_scoped() Using for_each_available_child_of_node_scoped() allows us to get rid of of_node_put() calls from early returns or breaks in the loop. It also fixes issues with missing of_node_put() calls. Switch to for_each_available_child_of_node_scoped() in parse_dai_link_info(). Also drop the braces around if blocks now that the inner block is just one statement. Signed-off-by: Chen-Yu Tsai Reviewed-by: Fei Shao Message-ID: <20250825151111.3696404-1-wenst@chromium.org> Signed-off-by: Mark Brown commit edb5c1f885207d1d74e8a1528e6937e02829ee6e Author: Kuninori Morimoto Date: Thu Aug 28 02:22:02 2025 +0000 ASoC: renesas: msiof: start DMAC first MSIOF needs to start DMAC before starting HW. It will get unknown error at 1st using without this patch. Playback: FSERR = 0, FOVF = 0, FUDF = 1 Capture: FSERR = 1, FOVF = 0, FUDF = 0 Signed-off-by: Kuninori Morimoto Message-ID: <87cy8guqwl.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit d092b70d7b54321ff481226fe6bc2a6aaa91519f Author: Kuninori Morimoto Date: Thu Aug 28 02:21:57 2025 +0000 ASoC: renesas: msiof: cleanup status clear method Current MSIOF driver clear status 1) after starting HW, and 2) clear all status. But it should be 1') before starting HW, 2') clear necessary status only. Cleanup it. Signed-off-by: Kuninori Morimoto Message-ID: <87ecswuqwr.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit d3593ac41aaf31db9d6d28cacd584330c769a4a6 Author: Kuninori Morimoto Date: Thu Aug 28 02:21:51 2025 +0000 ASoC: renesas: msiof: tidyup error message The meesage was strange. tidyup it. Signed-off-by: Kuninori Morimoto Message-ID: <87frdcuqww.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 042e57d59b3e7f44014da23e62911ae9b591953a Author: Kuninori Morimoto Date: Thu Aug 28 02:21:46 2025 +0000 ASoC: renesas: msiof: msiof_update_and_wait() checks whether reg was updated msiof_update_and_wait() updates reg and waits until the value was updated. But, if the set value was same as current reg value, no update will be happen. Check the value, and ignore waiting if no update. Signed-off-by: Kuninori Morimoto Message-ID: <87h5xsuqx2.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 81a45cb7ea31a59777af294de590eea66ab80691 Author: Matthew Auld Date: Fri Aug 8 12:04:53 2025 +0100 drm/xe/migrate: make MI_TLB_INVALIDATE conditional When clearing VRAM we should be able to skip invalidating the TLBs if we are only using the identity map to access VRAM (which is the common case), since no modifications are made to PTEs on the fly. Also since we use huge 1G entries within the identity map, there should be a pretty decent chance that the next packet(s) (if also clears) can avoid a tree walk if we don't shoot down the TLBs, like if we have to process a long stream of clears. For normal moves/copies, we usually always end up with the src or dst being system memory, meaning we can't only rely on the identity map and will also need to emit PTEs and so will always require a TLB flush. v2: - Update commit to explain the situation for normal copies (Matt B) - Rebase on latest changes Signed-off-by: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250808110452.467513-2-matthew.auld@intel.com commit 4ef353d546cda466fc39b7daca558d7bcec21c09 Author: Qianfeng Rong Date: Thu Aug 28 16:13:10 2025 +0800 ALSA: lx_core: use int type to store negative error codes Change the 'ret' variable from u16 to int to store negative error codes or zero returned by lx_message_send_atomic(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com Signed-off-by: Takashi Iwai commit f4c75f975cf50fa2e1fd96c5aafe5aa62e55fbe4 Author: Philipp Stanner Date: Wed Aug 13 10:56:55 2025 +0200 drm/sched: Document race condition in drm_sched_fini() In drm_sched_fini() all entities are marked as stopped - without taking the appropriate lock, because that would deadlock. That means that drm_sched_fini() and drm_sched_entity_push_job() can race against each other. This should most likely be fixed by establishing the rule that all entities associated with a scheduler must be torn down first. Then, however, the locking should be removed from drm_sched_fini() alltogether with an appropriate comment. Reported-by: James Flowers Link: https://lore.kernel.org/dri-devel/20250720235748.2798-1-bold.zone2373@fastmail.com/ Reviewed-by: Christian König Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250813085654.102504-2-phasta@kernel.org commit 77a62e557f54ecf6305e7ed6fb05d02e8748bffb Author: Liao Yuanhong Date: Tue Aug 19 22:26:24 2025 +0800 drm/sched/tests: Remove redundant header files The header file is already included on line 8. Remove the redundant include. Fixes: 5a99350794fec ("drm/sched: Add scheduler unit testing infrastructure and some basic tests") Signed-off-by: Liao Yuanhong Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250819142630.368796-1-liaoyuanhong@vivo.com commit ec035aba7d4a9439d7fa6d54b9f9de6ce3fe1716 Author: Tvrtko Ursulin Date: Thu Aug 14 14:36:27 2025 +0100 drm/sched: Remove mention of indirect buffers Indirect buffers are an AMD term describing essentialy a job submitted to the scheduler, just a lower level one. Since scheduler was promoted to be generic long ago, lets replace those references with jobs. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250814133627.2550-1-tvrtko.ursulin@igalia.com commit 5272d45914fff0e68ecb7ee9887f174770236ae3 Author: Miri Korenblit Date: Tue Aug 26 18:55:04 2025 +0300 wifi: iwlwifi: refactor iwl_pnvm_get_from_fs Instead of having an error code or 0 as a return value and passing a pointer to a pointer to be set by this function, change it to return a pointer, and use NULL as an error indication. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.c752988eb0d1.I7b3a9a4f6a8d23663838a1e232f8bfad57c596ce@changeid commit d92185b1259b7cbd6686c4b81effc8d03e70baca Author: Johannes Berg Date: Tue Aug 26 18:55:03 2025 +0300 wifi: iwlwifi: iwl-config: include module.h This file declares a macro using MODULE_FIRMWARE, so it should include module.h to always guarantee it being available. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.82a9e8f37c37.I5f4b310784bd49273ac905a79e8e3e0f39e15107@changeid commit 4b12516640b3c37f9fc9da6949957719e5d3ea0c Author: Miri Korenblit Date: Tue Aug 26 18:55:02 2025 +0300 wifi: iwlwifi: mld: don't modify trans state where not needed In suspend and resume flows, if we had any error we set the transport state to 'FW_ERROR' This was done to avoid sending commands when we shouldn't. In the mentioned flows, we can have a few types of errors: 1. logic errors 2. FW is in error state (can't send commands) 3. FW is misbehaving 4. D3 handshake error In the first, we can still talk to the firmware. In the second - the transport already knows about the FW error, no need to tell it. In the third - we need to treat it as any other FW misbehaviour. There is no reason to have a special handling here. So we only need it for the last type. Change the code to set the tansport state to FW error only in case of a d3 handshake error. While at it, add a comment explaining why the opmode sets the FW error bits. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.44c74ac0eb2a.Ic7369e622d908684f9b25ffc293d14c167c26414@changeid commit 49e58e9b0a4b4ddd42e8d0d341bb11d345cdce8f Author: Miri Korenblit Date: Tue Aug 26 18:55:01 2025 +0300 wifi: iwlwifi: simplify iwl_trans_pcie_d3_resume If iwl_trans_d3_resume succeeded but the hw requested a reset, this will be indicated to the opmode via the iwl_d3_status parameter while the return value will be 0. But the opmode doesn't really care if the resume failed or if a restart is required. It acts the same in both cases (beside different logs, but this can be done in iwl_trans_pcie_d3_resume) This complicates the code for no good reason. Change the iwl_trans_pcie_d3_resume to return an error value also in the case that everything went successfully but a restart is required, and add more logs so we can differentiate between the cases. This makes iwl_d3_status redundant. Remove it as well. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.5fa2d909c75d.Ida19d8d8d73eddf12b30f1d473ea675f415778b2@changeid commit e769f6f27ffe41331e00b69a33aa8a34db4dd830 Author: Miri Korenblit Date: Tue Aug 26 18:55:00 2025 +0300 wifi: iwlwifi: trans: remove STATUS_SUSPENDED We needed this bit to prevent sending host commands when suspended in pseudo mode (in real suspension we can't send commands anyway). Now as pseudo mode is removed, we no longer need it. Remove. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.2642406f0e9f.Ic530fa7901bd6bd9df805c8f892357078377ac8b@changeid commit b2e4bccc55b138616cce9127c78e4eaded240abc Author: Miri Korenblit Date: Tue Aug 26 18:54:59 2025 +0300 wifi: iwlwifi: trans: remove d3 test code This is no longer needed. Remove it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.4742846b17ed.I08c70ac544364d68baae03f830b1e01ce702b06d@changeid commit 6504e3f4c0fad33c63b25a19e3647985fec5e191 Author: Miri Korenblit Date: Tue Aug 26 18:54:58 2025 +0300 wifi: iwlwifi: remove dump file name extension support The options to configure a dump file name extension was added for 2 cases: 1. if we dump because of a missed beacon, we added the mac id and type to the filename. 2. to add the error id of the LMAC/UMAC/TCM/RCM error id to the file name. For 1, there is a bug: in cases in which missed beacon will not trigger a dump (for example in the default preset), and a missed beacon occurred, and eventually there is a dump for a different reason, the dump file name will contain the mac type and id even thought the dump has nothing to do with a missed beacon. Anyway, both cases are no longer required. Remove the code. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.d97f93fd1147.I7d0b056b6f9c38cafc53a0f29e0cf1236e2d2e8c@changeid commit a055bbb7bc91344a82497120a4af3e6e66c0d34f Author: Miri Korenblit Date: Tue Aug 26 18:54:57 2025 +0300 wifi: iwlwifi: mvm: remove d3 test code This is no longer needed. Remove it from mvm, and a later patch will remove it from the transport layer. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.6727aba3f4cf.I5d702f3fd031c52629c9fd8a3f4835c892f7543a@changeid commit 5f708cccde9d1ea61bb50574d361d1c80fc1a248 Author: Johannes Berg Date: Tue Aug 26 18:54:56 2025 +0300 wifi: iwlwifi: add a new FW file numbering scheme Firmware releases follow a "Core N" pattern, but due to some historical accidents, the API number for a Core N has always been N+3. That's confusing for everyone. For future firmware releases the firmware will make new file names that, instead of being named with the API number, will be named with the core number. For example, for the next one for bz/fm it'd be "iwlwifi-bz-b0-fm-c0-c99.ucode" instead of the now expected "iwlwifi-bz-b0-fm-c0-102.ucode". In the driver, represent that as an offset of 1000, and then request the "c" format instead of just "". When looking for older versions, skip from 1099 to 101 (which is core 98.) Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.7bba17bf200b.I33044cf6d97c623c47f765ea467635f01fc88731@changeid commit 7a1f7c5217606698c633102ea1e16317661dc38b Author: Daniel Gabay Date: Tue Aug 26 18:54:55 2025 +0300 wifi: iwlwifi: mld: add few missing hcmd/notif names - SEC_KEY_CMD - REPLY_ERROR - PHY_CONFIGURATION_CMD - BT_CONFIG Signed-off-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.badba3cc8be8.Ic8bc3ed4a1b05e80bbbc08636463a22ccbd8568f@changeid commit 27dc5813065016b1e4e896c67b5d698d46516c8c Author: Somashekhar Puttagangaiah Date: Tue Aug 26 18:54:54 2025 +0300 wifi: iwlwifi: mld: Add debug log for second link When there is a missed beacon scenario its not clear how many times beacon missed, log this data. Signed-off-by: Somashekhar Puttagangaiah Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.70366c88907e.I39b5c121f9884cd572a19bf89f7cca02ce79eb33@changeid commit 80fb870262c81ea6221c4f7346f18a5caa48f6cd Author: Itamar Shalev Date: Tue Aug 26 18:54:53 2025 +0300 wifi: iwlwifi: simplify iwl_poll_prph_bit return value Update iwl_poll_prph_bit to return 0 on success or an error code. Remove timing information from the return value, as it is unused. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.6d5444d553ce.I769146e3ba78e12ccd014b4692492df6aea17ca1@changeid commit bc4043ce7096a5e48bca255003ca58abd5b5b0e2 Author: Itamar Shalev Date: Tue Aug 26 18:54:52 2025 +0300 wifi: iwlwifi: pcie: relocate finish_nic_init logic to gen1_2 Refactor finish_nic_init by moving its logic to the gen1_2 transport layer. Prepares for future gen3 support. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.9fcc48d81435.I13403938219765b79c299ea081e8373d0e007785@changeid commit 14a4aca568f6e78af7564c6fc5f1ecc1a5a32c33 Author: Somashekhar Puttagangaiah Date: Tue Aug 26 18:54:51 2025 +0300 wifi: iwlwifi: mld: trigger mlo scan only when not in EMLSR When beacon loss happens or the RSSI drops, trigger MLO scan only if not in EMLSR. The link switch was meant to be done when we are not in EMLSR and we can try to switch to a better link. If in EMLSR, we exit first and then trigger MLO scan. Signed-off-by: Somashekhar Puttagangaiah Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.f6ae8e3882cf.I60901c16487371b8e62019bd0bf25c45ab23752f@changeid commit da707495680bb429020c15c8f8daa744b08e11c4 Author: Miri Korenblit Date: Tue Aug 26 18:54:50 2025 +0300 wifi: iwlwifi: mld: don't check the cipher on resume On resume, we are iterating all the keys in order to update the PN. Currently we check the cipher of the key we are currently iterating on to decide whether the key is PTK, GTK, IGTK or BIGTK. But we can find the type of the key by the keyidx, and we anyway have to check the keyidx, so just remove the cipher switch case and check only the keyidx instead Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826184046.8c4f9c30242c.Ie34c200f321aae60771476fa9907c333a8a99747@changeid commit d939047d31ff25a49a39667417c2a996caa826f5 Author: Frank Li Date: Wed Aug 27 16:44:01 2025 -0400 dt-bindings: Remove outdated cpufreq-dt.txt The information present in this file is outdated and doesn't serve any purpose with the current design of the driver. Remove the outdated file. Signed-off-by: Frank Li [ Viresh: Rewrite commit log ] Signed-off-by: Viresh Kumar commit 692173de3032b22792d21070238a986163fc29ec Author: Fabio Estevam Date: Sat Aug 23 16:50:21 2025 -0300 dt-bindings: ata: imx: Document 'target-supply' The 'target-supply' property is used by some i.MX devicetree files. Document it to fix the following dt-schema warning: 'target-supply' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Signed-off-by: Damien Le Moal commit 1e50201d3911507744adf5dafd6e25dbffee3692 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:32:40 2025 +0200 dt-bindings: ata: highbank: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Acked-by: Andre Przywara Signed-off-by: Damien Le Moal commit d4854be4ec21dad23907c0fbc3389c3a394ebf67 Merge: ef5ca97293ba4a e9faf4db5f2612 Author: Jakub Kicinski Date: Wed Aug 27 18:56:27 2025 -0700 Merge branch 'eth-fbnic-extend-hw-stats-support' Jakub Kicinski says: ==================== eth: fbnic: Extend hw stats support Mohsin says: Extend hardware stats support for fbnic by adding the ability to reset hardware stats when the device experience a reset due to a PCI error and include MAC stats in the hardware stats reset. Additionally, expand hardware stats coverage to include FEC, PHY, and Pause stats. v1: https://lore.kernel.org/20250822164731.1461754-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250825200206.2357713-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e9faf4db5f26123750676a13682c322ac85064de Author: Mohsin Bashir Date: Mon Aug 25 13:02:06 2025 -0700 eth: fbnic: Add pause stats support Add support to read pause stats for fbnic. Unlike FEC and PCS stats, pause stats won't wrap, do not fetch them under the service task. Since, they are exclusively accessed via the ethtool API, don't include them in fbnic_get_hw_stats(). ]# ethtool -I -a eth0 Pause parameters for eth0: Autonegotiate: on RX: off TX: off Statistics: tx_pause_frames: 0 rx_pause_frames: 0 Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 33c493791bc058af3342e89568008dcccd431b1b Author: Mohsin Bashir Date: Mon Aug 25 13:02:05 2025 -0700 eth: fbnic: Read PHY stats via the ethtool API Provide support to read PHY stats (FEC and PCS) via the ethtool API. ]# ethtool -I --show-fec eth0 FEC parameters for eth0: Supported/Configured FEC encodings: RS Active FEC encoding: RS Statistics: corrected_blocks: 0 uncorrectable_blocks: 0 ]# ethtool -S eth0 --groups eth-phy Standard stats for eth0: eth-phy-SymbolErrorDuringCarrier: 0 Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit df4c5d9a290eec592239d1d9591189b5c4cce9ab Author: Mohsin Bashir Date: Mon Aug 25 13:02:04 2025 -0700 eth: fbnic: Fetch PHY stats from device Add support to fetch PHY stats consisting of PCS and FEC stats from the device. When reading the stats counters, the lo part is read first, which latches the hi part to ensure consistent reading of the stats counter. FEC and PCS stats can wrap depending on the access frequency. To prevent wrapping, fetch these stats periodically under the service task. Also to maintain consistency fetch these stats along with other 32b stats under __fbnic_get_hw_stats32(). Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit bcf54e5d7cd0dccf6378e00f1f6ddff28b9f3989 Author: Mohsin Bashir Date: Mon Aug 25 13:02:03 2025 -0700 eth: fbnic: Reset MAC stats Reset the MAC stats as part of the hardware stats reset to ensure consistency. Currently, hardware stats are reset during device bring-up and upon experiencing PCI errors; however, MAC stats are being skipped during these resets. When fbnic_reset_hw_stats() is called upon recovering from PCI error, MAC stats are accessed outside the rtnl_lock. The only other access to MAC stats is via the ethtool API, which is protected by rtnl_lock. This can result in concurrent access to MAC stats and a potential race. Protect the fbnic_reset_hw_stats() call in __fbnic_pm_attach() with rtnl_lock to avoid this. Note that fbnic_reset_hw_mac_stats() is called outside the hardware stats lock which protects access to the fbnic_hw_stats. This is intentional because MAC stats are fetched from the device outside this lock and are exclusively read via the ethtool API. Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b1161b1863c5f3d592adba5accd6e5c79741720f Author: Mohsin Bashir Date: Mon Aug 25 13:02:02 2025 -0700 eth: fbnic: Reset hw stats upon PCI error Upon experiencing a PCI error, fbnic reset the device to recover from the failure. Reset the hardware stats as part of the device reset to ensure accurate stats reporting. Note that the reset is not really resetting the aggregate value to 0, which may result in a spike for a system collecting deltas in stats. Rather, the reset re-latches the current value as previous, in case HW got reset. Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2ee5c8c0c28e0e3ccfdb842a7b3bd2f98ee7eaf7 Author: Mohsin Bashir Date: Mon Aug 25 13:02:01 2025 -0700 eth: fbnic: Move hw_stats_lock out of fbnic_dev Move hw_stats_lock out of fbnic_dev to a more appropriate struct fbnic_hw_stats since the only use of this lock is to protect access to the hardware stats. While at it, enclose the lock and stats initialization in a single init call. Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825200206.2357713-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ef5ca97293ba4a8fd809ad87230a8ec0a0d42dec Merge: 86b26768167ad0 db9dfc4d30dd84 Author: Jakub Kicinski Date: Wed Aug 27 18:34:55 2025 -0700 Merge branch 'macsec-replace-custom-netlink-attribute-checks-with-policy-level-checks' Sabrina Dubroca says: ==================== macsec: replace custom netlink attribute checks with policy-level checks We can simplify attribute validation a lot by describing the accepted ranges more precisely in the policies, using NLA_POLICY_MAX etc. Some of the checks still need to be done later on, because the attribute length and acceptable range can vary based on values that can't be known when the policy is validated (cipher suite determines the key length and valid ICV length, presence of XPN changes the PN length, detection of duplicate SCIs or ANs, etc). As a bonus, we get a few extack messages from the policy validation. I'll add extack to the rest of the checks (mostly in the genl commands) in an future series. v1: https://lore.kernel.org/netdev/cover.1664379352.git.sd@queasysnail.net ==================== Link: https://patch.msgid.link/cover.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit db9dfc4d30dd844a616cec3a087eaa0a808712d0 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:31 2025 +0200 macsec: replace custom check on IFLA_MACSEC_ENCODING_SA with NLA_POLICY_MAX Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/085bc642136cf3d267ddbb114e6f0c4a9247c797.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b46f5ddb40c877ad9e99c6d95699fb0fbc906ba5 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:30 2025 +0200 macsec: replace custom checks for IFLA_MACSEC_* flags with NLA_POLICY_MAX Those are all off/on flags. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/95707fb36adc1904fa327bc8f4eb055895aa6eff.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b81d1e958867a63a69c24246918e96e106b6ae1c Author: Sabrina Dubroca Date: Tue Aug 26 15:16:29 2025 +0200 macsec: validate IFLA_MACSEC_VALIDATION with NLA_POLICY_MAX Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/629efe0b2150b30abc6472074018cbd521b46578.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 4d844cb1ea1f69f4fdebc6ad02e4025bd426e912 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:28 2025 +0200 macsec: use NLA_POLICY_VALIDATE_FN to validate IFLA_MACSEC_CIPHER_SUITE Unfortunately, since the value of MACSEC_DEFAULT_CIPHER_ID doesn't fit near the others, we can't use a simple range in the policy. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/015e43ade9548c7682c9739087eba0853b3a1331.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 17882d23a6c68769d3fb7b45b2edaf637a58978c Author: Sabrina Dubroca Date: Tue Aug 26 15:16:27 2025 +0200 macsec: replace custom checks on IFLA_MACSEC_ICV_LEN with NLA_POLICY_RANGE The existing checks already force this range. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/398cf16191a634ab343ecd811c481d7bdd44a933.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 35a35279e8ffd60cc2937129dc748d4ba6f4e147 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:26 2025 +0200 macsec: add NLA_POLICY_MAX for MACSEC_OFFLOAD_ATTR_TYPE and IFLA_MACSEC_OFFLOAD This is equivalent to the existing checks allowing either MACSEC_OFFLOAD_OFF or calling macsec_check_offload. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/37e1f1716f1d1d46d3d06c52317564b393fe60e6.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 80810c89d39c73be3f09c657e16a9c7674bd84b9 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:25 2025 +0200 macsec: remove validate_add_rxsc It's not doing much anymore. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/218147f2f11cab885abc86b779dcefcd3208a2f8.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 82f3116132fc12d27e5a4bb7151c8da4f689a083 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:24 2025 +0200 macsec: use NLA_UINT for MACSEC_SA_ATTR_PN MACSEC_SA_ATTR_PN is either a u32 or a u64, we can now use NLA_UINT for this instead of a custom binary type. We can then use a min check within the policy. We need to keep the length checks done in macsec_{add,upd}_{rx,tx}sa based on whether the device is set up for XPN (with 64b PNs instead of 32b). On the dump side, keep the existing custom code as userspace may expect a u64 when using XPN, and nla_put_uint may only output a u32 attribute if the value fits. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/c9d32bd479cd4464e09010fbce1becc75377c8a0.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 15a700a8429ebb2f95c009293689c3fbd2b09ebe Author: Sabrina Dubroca Date: Tue Aug 26 15:16:23 2025 +0200 macsec: use NLA_POLICY_MAX_LEN for MACSEC_SA_ATTR_KEY Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/192227ca0047b643d6530ece0a3679998b010fac.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit d29ae0d7753a0d5bff7d8adfcb18f84008abb261 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:22 2025 +0200 macsec: replace custom checks on MACSEC_SA_ATTR_KEYID with NLA_POLICY_EXACT_LEN The existing checks already specify that MACSEC_SA_ATTR_KEYID must have length MACSEC_KEYID_LEN. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/c4c113328962aae4146183e7a27854e854c796fb.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 8cf22afc152c4aa8506958ddc47f5cb796733582 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:21 2025 +0200 macsec: replace custom checks on MACSEC_SA_ATTR_SALT with NLA_POLICY_EXACT_LEN The existing checks already specify that MACSEC_SA_ATTR_SALT must have length MACSEC_SALT_LEN. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/9699c5fd72322118b164cc8777fadabcce3b997c.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit ae6a8f5abed1675c62f3730bb675d2e544ea9a43 Author: Sabrina Dubroca Date: Tue Aug 26 15:16:20 2025 +0200 macsec: replace custom checks on MACSEC_*_ATTR_ACTIVE with NLA_POLICY_MAX Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/2b07434304c725c72a7d81a8460d0bbe8af384a2.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit d5e0a8cec12c6d3ae8093fb2951c2cba9d5a4bdd Author: Sabrina Dubroca Date: Tue Aug 26 15:16:19 2025 +0200 macsec: replace custom checks on MACSEC_SA_ATTR_AN with NLA_POLICY_MAX Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/22a7820cfc2cbfe5e33f030f1a3276e529cc70dc.1756202772.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 86b26768167ad030b9d4885d484e08a30e6b8df9 Merge: f0c88a0d83b26b 48aa30443e52c9 Author: Jakub Kicinski Date: Wed Aug 27 18:23:04 2025 -0700 Merge branch 'net-prevent-rps-table-overwrite-of-active-flows' Krishna Kumar says: ==================== net: Prevent RPS table overwrite of active flows This series splits the original RPS patch [1] into two patches for net-next. It also addresses a kernel test robot warning by defining rps_flow_is_active() only when aRFS is enabled. I tested v3 with four builds and reboots: two for [PATCH 1/2] with aRFS enabled & disabled, and two for [PATCH 2/2]. There are no code changes in v4 and v5, only documentation. Patch v6 has one line change to keep 'hash' field under #ifdef, and was test built with aRFS=on and aRFS=off. The same two builds were done for v7, along with 15m load testing with aRFS=on to ensure the new changes are correct. The first patch prevents RPS table overwrite for active flows thereby improving aRFS stability. The second patch caches hash & flow_id in get_rps_cpu() to avoid recalculating it in set_rps_cpu(). [1] lore.kernel.org/netdev/20250708081516.53048-1-krikku@gmail.com/ [2] lore.kernel.org/netdev/20250729104109.1687418-1-krikku@gmail.com/ ==================== Link: https://patch.msgid.link/20250825031005.3674864-1-krikku@gmail.com Signed-off-by: Jakub Kicinski commit 48aa30443e52c9666d5cd5e67532e475f212337e Author: Krishna Kumar Date: Mon Aug 25 08:40:05 2025 +0530 net: Cache hash and flow_id to avoid recalculation get_rps_cpu() can cache flow_id and hash as both are required by set_rps_cpu() instead of recalculating them twice. Signed-off-by: Krishna Kumar Link: https://patch.msgid.link/20250825031005.3674864-3-krikku@gmail.com Signed-off-by: Jakub Kicinski commit 97bcc5b6f45425ac56fb04b0893cdaa607ec7e45 Author: Krishna Kumar Date: Mon Aug 25 08:40:04 2025 +0530 net: Prevent RPS table overwrite of active flows This patch fixes an issue where two different flows on the same RXq produce the same hash resulting in continuous flow overwrites. Flow #1: A packet for Flow #1 comes in, kernel calls the steering function. The driver gives back a filter id. The kernel saves this filter id in the selected slot. Later, the driver's service task checks if any filters have expired and then installs the rule for Flow #1. Flow #2: A packet for Flow #2 comes in. It goes through the same steps. But this time, the chosen slot is being used by Flow #1. The driver gives a new filter id and the kernel saves it in the same slot. When the driver's service task runs, it runs through all the flows, checks if Flow #1 should be expired, the kernel returns True as the slot has a different filter id, and then the driver installs the rule for Flow #2. Flow #1: Another packet for Flow #1 comes in. The same thing repeats. The slot is overwritten with a new filter id for Flow #1. This causes a repeated cycle of flow programming for missed packets, wasting CPU cycles while not improving performance. This problem happens at higher rates when the RPS table is small, but tests show it still happens even with 12,000 connections and an RPS size of 16K per queue (global table size = 144x16K = 64K). This patch prevents overwriting an rps_dev_flow entry if it is active. The intention is that it is better to do aRFS for the first flow instead of hurting all flows on the same hash. Without this, two (or more) flows on one RX queue with the same hash can keep overwriting each other. This causes the driver to reprogram the flow repeatedly. Changes: 1. Add a new 'hash' field to struct rps_dev_flow. 2. Add rps_flow_is_active(): a helper function to check if a flow is active or not, extracted from rps_may_expire_flow(). It is further simplified as per reviewer feedback. 3. In set_rps_cpu(): - Avoid overwriting by programming a new filter if: - The slot is not in use, or - The slot is in use but the flow is not active, or - The slot has an active flow with the same hash, but target CPU differs. - Save the hash in the rps_dev_flow entry. 4. rps_may_expire_flow(): Use earlier extracted rps_flow_is_active(). Testing & results: - Driver: ice (E810 NIC), Kernel: net-next - #CPUs = #RXq = 144 (1:1) - Number of flows: 12K - Eight RPS settings from 256 to 32768. Though RPS=256 is not ideal, it is still sufficient to cover 12K flows (256*144 rx-queues = 64K global table slots) - Global Table Size = 144 * RPS (effectively equal to 256 * RPS) - Each RPS test duration = 8 mins (org code) + 8 mins (new code). - Metrics captured on client Legend for following tables: Steer-C: #times ndo_rx_flow_steer() was Called by set_rps_cpu() Steer-L: #times ice_arfs_flow_steer() Looped over aRFS entries Add: #times driver actually programmed aRFS (ice_arfs_build_entry()) Del: #times driver deleted the flow (ice_arfs_del_flow_rules()) Units: K = 1,000 times, M = 1 million times |-------|---------|------| Org Code |---------|---------| | RPS | Latency | CPU | Add | Del | Steer-C | Steer-L | |-------|---------|------|--------|--------|---------|---------| | 256 | 227.0 | 93.2 | 1.6M | 1.6M | 121.7M | 267.6M | | 512 | 225.9 | 94.1 | 11.5M | 11.2M | 65.7M | 199.6M | | 1024 | 223.5 | 95.6 | 16.5M | 16.5M | 27.1M | 187.3M | | 2048 | 222.2 | 96.3 | 10.5M | 10.5M | 12.5M | 115.2M | | 4096 | 223.9 | 94.1 | 5.5M | 5.5M | 7.2M | 65.9M | | 8192 | 224.7 | 92.5 | 2.7M | 2.7M | 3.0M | 29.9M | | 16384 | 223.5 | 92.5 | 1.3M | 1.3M | 1.4M | 13.9M | | 32768 | 219.6 | 93.2 | 838.1K | 838.1K | 965.1K | 8.9M | |-------|---------|------| New Code |---------|---------| | 256 | 201.5 | 99.1 | 13.4K | 5.0K | 13.7K | 75.2K | | 512 | 202.5 | 98.2 | 11.2K | 5.9K | 11.2K | 55.5K | | 1024 | 207.3 | 93.9 | 11.5K | 9.7K | 11.5K | 59.6K | | 2048 | 207.5 | 96.7 | 11.8K | 11.1K | 15.5K | 79.3K | | 4096 | 206.9 | 96.6 | 11.8K | 11.7K | 11.8K | 63.2K | | 8192 | 205.8 | 96.7 | 11.9K | 11.8K | 11.9K | 63.9K | | 16384 | 200.9 | 98.2 | 11.9K | 11.9K | 11.9K | 64.2K | | 32768 | 202.5 | 98.0 | 11.9K | 11.9K | 11.9K | 64.2K | |-------|---------|------|--------|--------|---------|---------| Some observations: 1. Overall Latency improved: (1790.19-1634.94)/1790.19*100 = 8.67% 2. Overall CPU increased: (777.32-751.49)/751.45*100 = 3.44% 3. Flow Management (add/delete) remained almost constant at ~11K compared to values in millions. Signed-off-by: Krishna Kumar Link: https://patch.msgid.link/20250825031005.3674864-2-krikku@gmail.com Signed-off-by: Jakub Kicinski commit f0c88a0d83b26bcfbb3463d3a283bc08007a5ae0 Author: Qianfeng Rong Date: Tue Aug 26 21:50:19 2025 +0800 net: wwan: iosm: use int type to store negative error codes The 'ret' variable in ipc_pcie_resources_request() either stores '-EBUSY' directly or holds returns from pci_request_regions() and ipc_acquire_irq(). Storing negative error codes in u32 causes no runtime issues but is stylistically inconsistent and very ugly. Change 'ret' from u32 to int type - this has no runtime impact. Signed-off-by: Qianfeng Rong Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20250826135021.510767-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 6aff3699906bd1017fd9017bed133681b0eb8a42 Author: Heiner Kallweit Date: Tue Aug 26 21:24:44 2025 +0200 net: phy: fixed_phy: simplify fixed_mdio_read swphy_read_reg() doesn't change the passed struct fixed_phy_status, so we can pass &fp->status directly. Signed-off-by: Heiner Kallweit Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/c49195c7-a3a1-485c-baed-9b33740752de@gmail.com Signed-off-by: Jakub Kicinski commit a6bac1822931bc3c862c07d535ab4192582c023c Author: Qianfeng Rong Date: Tue Aug 26 22:21:59 2025 +0800 amd-xgbe: Use int type to store negative error codes Use int instead of unsigned int for the 'ret' variable to store return values from functions that either return zero on success or negative error codes on failure. Storing negative error codes in an unsigned int causes no runtime issues, but it's ugly as pants, Change 'ret' from unsigned int to int type - this change has no runtime impact. Signed-off-by: Qianfeng Rong Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250826142159.525059-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 330355191a2d9a59137455b774b9a66dd6d068d4 Author: Andre Przywara Date: Mon Aug 25 18:20:55 2025 +0100 net: stmmac: sun8i: drop unneeded default syscon value For some odd reason we were very jealous about the value of the EMAC clock register from the syscon block, insisting on a reset value and only doing read-modify-write operations on that register, even though we pretty much know the register layout. This already led to a basically redundant entry for the H6, which only differs by that value. We seem to have the same situation with the new A523 SoC, which again is compatible to the A64, but has a different syscon reset value. Drop any assumptions about that value, and set or clear the bits that we want to program, from scratch (starting with a value of 0). For the remove() implementation, we just turn on the POWERDOWN bit, and deselect the internal PHY, which mimics the existing code. Signed-off-by: Andre Przywara Reviewed-by: Jernej Skrabec Acked-by: Corentin LABBE Tested-by: Corentin LABBE Tested-by: Paul Kocialkowski Reviewed-by: Paul Kocialkowski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250825172055.19794-1-andre.przywara@arm.com Signed-off-by: Jakub Kicinski commit 737433c6a559c4e8acb065cfe9b6e2ff45ad655c Author: Matt Fleming Date: Wed Aug 27 15:01:49 2025 +0100 selftests/bpf: Add LPM trie microbenchmarks Add benchmarks for the standard set of operations: LOOKUP, INSERT, UPDATE, DELETE. Also include benchmarks to measure the overhead of the bench framework itself (NOOP) as well as the overhead of generating keys (BASELINE). Lastly, this includes a benchmark for FREE (trie_free()) which is known to have terrible performance for maps with many entries. Benchmarks operate on tries without gaps in the key range, i.e. each test begins or ends with a trie with valid keys in the range [0, nr_entries). This is intended to cause maximum branching when traversing the trie. LOOKUP, UPDATE, DELETE, and FREE fill a BPF LPM trie from userspace using bpf_map_update_batch() and run the corresponding benchmark operation via bpf_loop(). INSERT starts with an empty map and fills it kernel-side from bpf_loop(). FREE records the time to free a filled LPM trie by attaching and destroying a BPF prog. NOOP measures the overhead of the test harness by running an empty function with bpf_loop(). BASELINE is similar to NOOP except that the function generates a key. Each operation runs 10,000 times using bpf_loop(). Note that this value is intentionally independent of the number of entries in the LPM trie so that the stability of the results isn't affected by the number of entries. For those benchmarks that need to reset the LPM trie once it's full (INSERT) or empty (DELETE), throughput and latency results are scaled by the fraction of a second the operation actually ran to ignore any time spent reinitialising the trie. By default, benchmarks run using sequential keys in the range [0, nr_entries). BASELINE, LOOKUP, and UPDATE can use random keys via the --random parameter but beware there is a runtime cost involved in generating random keys. Other benchmarks are prohibited from using random keys because it can skew the results, e.g. when inserting an existing key or deleting a missing one. All measurements are recorded from within the kernel to eliminate syscall overhead. Most benchmarks run an XDP program to generate stats but FREE needs to collect latencies using fentry/fexit on map_free_deferred() because it's not possible to use fentry directly on lpm_trie.c since commit c83508da5620 ("bpf: Avoid deadlock caused by nested kprobe and fentry bpf programs") and there's no way to create/destroy a map from within an XDP program. Here is example output from an AMD EPYC 9684X 96-Core machine for each of the benchmarks using a trie with 10K entries and a 32-bit prefix length, e.g. $ ./bench lpm-trie-$op \ --prefix_len=32 \ --producers=1 \ --nr_entries=10000 noop: throughput 74.417 ± 0.032 M ops/s ( 74.417M ops/prod), latency 13.438 ns/op baseline: throughput 70.107 ± 0.171 M ops/s ( 70.107M ops/prod), latency 14.264 ns/op lookup: throughput 8.467 ± 0.047 M ops/s ( 8.467M ops/prod), latency 118.109 ns/op insert: throughput 2.440 ± 0.015 M ops/s ( 2.440M ops/prod), latency 409.290 ns/op update: throughput 2.806 ± 0.042 M ops/s ( 2.806M ops/prod), latency 356.322 ns/op delete: throughput 4.625 ± 0.011 M ops/s ( 4.625M ops/prod), latency 215.613 ns/op free: throughput 0.578 ± 0.006 K ops/s ( 0.578K ops/prod), latency 1.730 ms/op And the same benchmarks using random keys: $ ./bench lpm-trie-$op \ --prefix_len=32 \ --producers=1 \ --nr_entries=10000 \ --random noop: throughput 74.259 ± 0.335 M ops/s ( 74.259M ops/prod), latency 13.466 ns/op baseline: throughput 35.150 ± 0.144 M ops/s ( 35.150M ops/prod), latency 28.450 ns/op lookup: throughput 7.119 ± 0.048 M ops/s ( 7.119M ops/prod), latency 140.469 ns/op insert: N/A update: throughput 2.736 ± 0.012 M ops/s ( 2.736M ops/prod), latency 365.523 ns/op delete: N/A free: N/A Signed-off-by: Matt Fleming Signed-off-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20250827140149.1001557-1-matt@readmodwrite.com Signed-off-by: Alexei Starovoitov commit 40fb9751ccc6e2ad450a2b938d7c8583a34d4a56 Author: Fabio Estevam Date: Tue Aug 26 11:17:36 2025 -0300 dt-bindings: nfc: ti,trf7970a: Restrict the ti,rx-gain-reduction-db values Instead of stating the supported values for the ti,rx-gain-reduction-db property in free text format, add an enum entry that can help validating the devicetree files. Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250826141736.712827-1-festevam@gmail.com Signed-off-by: Jakub Kicinski commit bd27626f482604294792faff8c879a77a86683b0 Merge: 4c229f337e9c38 22b22bf9ee4858 Author: Alexei Starovoitov Date: Wed Aug 27 17:16:22 2025 -0700 Merge branch 'bpf-arm64-support-for-timed-may_goto' Puranjay Mohan says: ==================== bpf, arm64: support for timed may_goto Changes in v2->v3: v2: https://lore.kernel.org/all/20250809204833.44803-1-puranjay@kernel.org/ - Rebased on bpf-next/master - Added Acked-by: tags from Xu and Kumar Changes in v1->v2: v1: https://lore.kernel.org/bpf/20250724125443.26182-1-puranjay@kernel.org/ - Added comment in arch_bpf_timed_may_goto() about BPF_REG_FP setup (Xu Kuohai) This set adds support for the timed may_goto instruction for the arm64. The timed may_goto instruction is implemented by the verifier by reserving 2 8byte slots in the program stack and then calling arch_bpf_timed_may_goto() in a loop with the stack offset of these two slots in BPF_REG_AX. It expects the function to put a timestamp in the first slot and the returned count in BPF_REG_AX is put into the second slot by a store instruction emitted by the verifier. arch_bpf_timed_may_goto() is special as it receives the parameter in BPF_REG_AX and is expected to return the result in BPF_REG_AX as well. It can't clobber any caller saved registers because verifier doesn't save anything before emitting the call. So, arch_bpf_timed_may_goto() is implemented in assembly so the exact registers that are stored/restored can be controlled (BPF caller saved registers here) and it also needs to take care of moving arguments and return values to and from BPF_REG_AX <-> arm64 R0. So, arch_bpf_timed_may_goto() acts as a trampoline to call bpf_check_timed_may_goto() which does the main logic of placing the timestamp and returning the count. All tests that use may_goto instruction pass after the changing some of them in patch 2 #404 stream_errors:OK [...] #406/2 stream_success/stream_cond_break:OK [...] #494/23 verifier_bpf_fastcall/may_goto_interaction_x86_64:SKIP #494/24 verifier_bpf_fastcall/may_goto_interaction_arm64:OK [...] #539/1 verifier_may_goto_1/may_goto 0:OK #539/2 verifier_may_goto_1/batch 2 of may_goto 0:OK #539/3 verifier_may_goto_1/may_goto batch with offsets 2/1/0:OK #539/4 verifier_may_goto_1/may_goto batch with offsets 2/0:OK #539 verifier_may_goto_1:OK #540/1 verifier_may_goto_2/C code with may_goto 0:OK #540 verifier_may_goto_2:OK Summary: 7/16 PASSED, 25 SKIPPED, 0 FAILED ==================== Link: https://patch.msgid.link/20250827113245.52629-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 22b22bf9ee48580f18bc75bd7a53d010e5b8f598 Author: Puranjay Mohan Date: Wed Aug 27 11:32:44 2025 +0000 selftests/bpf: Enable timed may_goto tests for arm64 As arm64 JIT now supports timed may_goto instruction, make sure all relevant tests run on this architecture. Some tests were enabled and other required modifications to work properly on arm64. $ ./test_progs -a "stream*","*may_goto*",verifier_bpf_fastcall #404 stream_errors:OK [...] #406/2 stream_success/stream_cond_break:OK [...] #494/23 verifier_bpf_fastcall/may_goto_interaction_x86_64:SKIP #494/24 verifier_bpf_fastcall/may_goto_interaction_arm64:OK [...] #539/1 verifier_may_goto_1/may_goto 0:OK #539/2 verifier_may_goto_1/batch 2 of may_goto 0:OK #539/3 verifier_may_goto_1/may_goto batch with offsets 2/1/0:OK #539/4 verifier_may_goto_1/may_goto batch with offsets 2/0:OK #539 verifier_may_goto_1:OK #540/1 verifier_may_goto_2/C code with may_goto 0:OK #540 verifier_may_goto_2:OK Summary: 7/16 PASSED, 25 SKIPPED, 0 FAILED Signed-off-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20250827113245.52629-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 16175375da369fcfdcc0127c9ca39b767ae4f885 Author: Puranjay Mohan Date: Wed Aug 27 11:32:43 2025 +0000 bpf, arm64: Add JIT support for timed may_goto When verifier sees a timed may_goto instruction, it emits a call to arch_bpf_timed_may_goto() with a stack offset in BPF_REG_AX (arm64 r9) and expects a count value to be returned in the same register. The verifier doesn't save or restore any registers before emitting this call. arch_bpf_timed_may_goto() should act as a trampoline to call bpf_check_timed_may_goto() with AAPCS64 calling convention. To support this custom calling convention, implement arch_bpf_timed_may_goto() in assembly and make sure BPF caller saved registers are saved and restored, call bpf_check_timed_may_goto with arm64 calling convention where first argument and return value both are in x0, then put the result back into BPF_REG_AX before returning. Signed-off-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20250827113245.52629-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 705609dedea1f61f0a199150994226c83f54c2db Author: Alok Tiwari Date: Tue Aug 26 03:22:15 2025 -0700 net: stmmac: rk: remove incorrect _DLY_DISABLE bit definition The RK3328 GMAC clock delay macros define enable/disable controls for TX and RX clock delay. While the TX definitions are correct, the RXCLK_DLY_DISABLE macro incorrectly clears bit 0. The macros RK3328_GMAC_TXCLK_DLY_DISABLE and RK3328_GMAC_RXCLK_DLY_DISABLE are not referenced anywhere in the driver code. Remove them to clean up unused definitions. No functional change. Signed-off-by: Alok Tiwari Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250826102219.49656-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit f63f21e82ecafd288b100ea161247820bf1e92c4 Author: Aleksander Jan Bajkowski Date: Mon Aug 25 23:09:49 2025 +0200 net: phy: realtek: support for TRIGGER_NETDEV_LINK on RTL8211E and RTL8211F This patch adds support for the TRIGGER_NETDEV_LINK trigger. It activates the LED when a link is established, regardless of the speed. Tested on Orange Pi PC2 with RTL8211E PHY. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250825211059.143231-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit 62242ac510614761c1af644d056c2aedf639f479 Author: Bagas Sanjaya Date: Wed Aug 20 11:34:32 2025 +0700 Documentation: f2fs: Reword title "What is F2FS" is rather a mistitle for the whole f2fs docs, as it implies the overview section (before "Background and design issues" section) and the docs covers beyond that: from mount options to filesystem implementation details. Retitle and add explicit overview section. Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e7822326887897922fda6ba2f8540290cd373ee3 Author: Bagas Sanjaya Date: Wed Aug 20 11:34:31 2025 +0700 Documentation: f2fs: Indent compression_mode option list Indent description text so that compression_mode numbered list gets rendered as such in htmldocs output. Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f4f36fffd8722d801d2bdacefe98d62d33f85537 Author: Bagas Sanjaya Date: Wed Aug 20 11:34:30 2025 +0700 Documentation: f2fs: Wrap snippets in literal code blocks Compression mode code and device aliasing shell snippets are shown in htmldocs output as long-running paragraph instead. Wrap them. Fixes: 602a16d58e9a ("f2fs: add compress_mode mount option") Fixes: 128d333f0dff ("f2fs: introduce device aliasing file") Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f9c97e496293e50f9131196c26f94d29b2d6451d Author: Bagas Sanjaya Date: Wed Aug 20 11:34:29 2025 +0700 Documentation: f2fs: Span write hint table section rows Write hint policy table has two rows which act as section rows: buffered io and direct io, yet these rows are written as normal rows instead. Column-span them. Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f23044152af2614c6fddfa9d975ac1f293b58729 Author: Bagas Sanjaya Date: Wed Aug 20 11:34:28 2025 +0700 Documentation: f2fs: Format compression level subtable Format compression_algorithm subtable as reST table as it does the semantic job rather than normal paragraph. Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4bc6bf7b8830cc403a3cea7f4ef8794831126f54 Author: Bagas Sanjaya Date: Wed Aug 20 11:34:27 2025 +0700 Documentation: f2fs: Separate errors mode subtable errors=%s subtable is shown in htmldocs output as long-running paragraph instead due to missing separator from its previous paragraph. Add it. Fixes: b62e71be2110 ("f2fs: support errors=remount-ro|continue|panic mountoption") Signed-off-by: Bagas Sanjaya Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c18ecd99e0c707ef8f83cace861cbc3162f4fdf1 Author: Chao Yu Date: Sat Aug 23 13:45:34 2025 +0800 f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243 Call Trace: f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306 f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018 vfs_fallocate+0x666/0x7e0 fs/open.c:342 ksys_fallocate fs/open.c:366 [inline] __do_sys_fallocate fs/open.c:371 [inline] __se_sys_fallocate fs/open.c:369 [inline] __x64_sys_fallocate+0xc0/0x110 fs/open.c:369 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e65f8ebe9 w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent truncation range in direct node in f2fs_truncate_hole(). The root cause is: a non-inode dnode may has the same footer.ino and footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE() may return wrong blkaddr count which may be 923 typically, by chance, dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...). count = min(end_offset - dn.ofs_in_node, pg_end - pg_start); This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing passing the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the same footer.ino and footer.nid. Scripts to reproduce: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs touch /mnt/f2fs/foo touch /mnt/f2fs/bar dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8 umount /mnt/f2fs inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb mount /dev/vdb /mnt/f2fs xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k" Cc: stable@kernel.org Reported-by: syzbot+b9c7ffd609c3f09416ab@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68a68e27.050a0220.1a3988.0002.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5c76c794bf29399394ebacaa5af8436b8bed0d46 Author: Dan Carpenter Date: Wed Aug 27 15:57:31 2025 +0300 HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower() Bitwise AND was intended instead of OR. With the current code the condition is always true. Fixes: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled") Signed-off-by: Dan Carpenter Reviewed-by: Douglas Anderson Reviewed-by: Pin-yen Lin Acked-by: Jiri Kosina Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/aK8Au3CgZSTvfEJ6@stanley.mountain commit 4c229f337e9c38ecee8d4ca5bb9006f63217ebdd Merge: d3abefe8974087 69424097ee1061 Author: Andrii Nakryiko Date: Wed Aug 27 15:41:05 2025 -0700 Merge branch 'libbpf-fix-usdt-sib-argument-handling-causing-unrecognized-register-error' Jiawei Zhao says: ==================== libbpf: fix USDT SIB argument handling causing unrecognized register error When using GCC on x86-64 to compile an usdt prog with -O1 or higher optimization, the compiler will generate SIB addressing mode for global array, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation in libbpf cannot parse these two formats, causing `bpf_program__attach_usdt()` to fail with -ENOENT (unrecognized register). This patch series adds support for SIB addressing mode in USDT probes. The main changes include: - add correct handling logic for SIB-addressed arguments in `parse_usdt_arg`. - add an usdt_o2 test case to cover SIB addressing mode. Testing shows that the SIB probe correctly generates 8@(%rcx,%rax,8) argument spec and passes all validation checks. The modification history of this patch series: Change since v1: - refactor the code to make it more readable - modify the commit message to explain why and how Change since v2: - fix the `scale` uninitialized error Change since v3: - force -O2 optimization for usdt.test.o to generate SIB addressing usdt and pass all test cases. Change since v4: - split the patch into two parts, one for the fix and the other for the test Change since v5: - Only enable optimization for x86 architecture to generate SIB addressing usdt argument spec. Change since v6: - Add an usdt_o2 test case to cover SIB addressing mode. - Reinstate the usdt.c test case. Change since v7: - Refactor modifications to __bpf_usdt_arg_spec to avoid increasing its size, achieving better compatibility - Fix some minor code style issues - Refactor the usdt_o2 test case, removing semaphore and adding GCC attribute to force -O2 optimization Change since v8: - Refactor the usdt_o2 test case, using assembly to force SIB addressing mode. Change since v9: - Only enable the usdt_o2 test case on x86_64 and i386 architectures since the SIB addressing mode is only supported on x86_64 and i386. Change since v10: - Replace `__attribute__((optimize("O2")))` with `#pragma GCC optimize("O1")` to fix the issue where the optimized compilation condition works improperly. - Renamed test case usdt_o2 and relevant files name to usdt_o1 in that O1 level optimization is enough to generate SIB addressing usdt argument spec. Change since v11: - Replace `STAP_PROBE1` with `STAP_PROBE_ASM` - Use bit fields instead of bit shifting operations - Merge the usdt_o1 test case into the usdt test case Change since v12: - This patch is same with the v12 but with a new version number. Change since v13(resolve some review comments): - https://lore.kernel.org/bpf/CAEf4BzZWd2zUC=U6uGJFF3EMZ7zWGLweQAG3CJWTeHy-5yFEPw@mail.gmail.com/ - https://lore.kernel.org/bpf/CAEf4Bzbs3hV_Q47+d93tTX13WkrpkpOb4=U04mZCjHyZg4aVdw@mail.gmail.com/ Change since v14: - fix a typo in __bpf_usdt_arg_spec Change since v15(resolve some review comments): - https://lore.kernel.org/bpf/CAEf4BzaxuYijEfQMDFZ+CQdjxLuDZiesUXNA-SiopS+5+VxRaA@mail.gmail.com/ - https://lore.kernel.org/bpf/CAEf4BzaHi5kpuJ6OVvDU62LT5g0qHbWYMfb_FBQ3iuvvUF9fag@mail.gmail.com/ - https://lore.kernel.org/bpf/d438bf3a-a9c9-4d34-b814-63f2e9bb3a85@linux.dev/ ==================== Link: https://patch.msgid.link/20250827053128.1301287-1-phoenix500526@163.com Signed-off-by: Andrii Nakryiko commit 69424097ee1061280dce111ca43b7bc17868413c Author: Jiawei Zhao Date: Wed Aug 27 05:31:28 2025 +0000 selftests/bpf: Enrich subtest_basic_usdt case in selftests to cover SIB handling logic When using GCC on x86-64 to compile an usdt prog with -O1 or higher optimization, the compiler will generate SIB addressing mode for global array, e.g. "1@-96(%rbp,%rax,8)". In this patch: - enrich subtest_basic_usdt test case to cover SIB addressing usdt argument spec handling logic Signed-off-by: Jiawei Zhao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250827053128.1301287-3-phoenix500526@163.com commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 Author: Jiawei Zhao Date: Wed Aug 27 05:31:27 2025 +0000 libbpf: Fix USDT SIB argument handling causing unrecognized register error On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB) addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation in libbpf cannot parse this format, causing `bpf_program__attach_usdt()` to fail with -ENOENT (unrecognized register). This patch fixes this by implementing the necessary changes: - add correct handling for SIB-addressed arguments in `bpf_usdt_arg`. - add adaptive support to `__bpf_usdt_arg_type` and `__bpf_usdt_arg_spec` to represent SIB addressing parameters. Signed-off-by: Jiawei Zhao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com commit fac679df7580979174c90303f004b09cdc6f086f Author: Nirmoy Das Date: Mon Aug 25 14:46:42 2025 -0700 PCI/ACPI: Fix pci_acpi_preserve_config() memory leak pci_acpi_preserve_config() leaks memory by returning early without freeing the ACPI object on success. Fix that by always freeing the obj, which is not needed by the caller. Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()") Signed-off-by: Nirmoy Das Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com commit d3abefe897408718799ae3bd06295b89b870a38e Author: Shubham Sharma Date: Tue Aug 26 18:27:46 2025 +0530 selftests/bpf: Fix typos and grammar in test sources Fix spelling typos and grammar errors in BPF selftests source code. Signed-off-by: Shubham Sharma Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250826125746.17983-1-slopixelz@gmail.com commit 2660b9d477501c3dbb09705640b70d0a80072f0c Author: Nandakumar Edamana Date: Tue Aug 26 09:15:24 2025 +0530 bpf: Add selftest to check the verifier's abstract multiplication Add new selftest to test the abstract multiplication technique(s) used by the verifier, following the recent improvement in tnum multiplication (tnum_mul). One of the newly added programs, verifier_mul/mul_precise, results in a false positive with the old tnum_mul, while the program passes with the latest one. Signed-off-by: Nandakumar Edamana Signed-off-by: Andrii Nakryiko Reviewed-by: Harishankar Vishwanathan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250826034524.2159515-2-nandakumar@nandakumar.co.in commit 1df7dad4d5c49335b72e26d833def960b2de76e3 Author: Nandakumar Edamana Date: Tue Aug 26 09:15:23 2025 +0530 bpf: Improve the general precision of tnum_mul Drop the value-mask decomposition technique and adopt straightforward long-multiplication with a twist: when LSB(a) is uncertain, find the two partial products (for LSB(a) = known 0 and LSB(a) = known 1) and take a union. Experiment shows that applying this technique in long multiplication improves the precision in a significant number of cases (at the cost of losing precision in a relatively lower number of cases). Signed-off-by: Nandakumar Edamana Signed-off-by: Andrii Nakryiko Tested-by: Harishankar Vishwanathan Reviewed-by: Harishankar Vishwanathan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250826034524.2159515-1-nandakumar@nandakumar.co.in commit 6633875250b38b18b8638cf01e695de031c71f02 Author: Lukas Wunner Date: Wed Aug 27 15:41:09 2025 +0200 PCI/AER: Support errors introduced by PCIe r6.0 PCIe r6.0 defined five additional errors in the Uncorrectable Error Status, Mask and Severity Registers (PCIe r7.0 sec 7.8.4.2ff). lspci has been supporting them since commit 144b0911cc0b ("ls-ecaps: extend decode support for more fields for AER CE and UE status"): https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/?id=144b0911cc0b Amend the AER driver to recognize them as well, instead of logging them as "Unknown Error Bit". Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/21f1875b18d4078c99353378f37dcd6b994f6d4e.1756301211.git.lukas@wunner.de commit dc32e9346b26ba33e84ec3034a1e53a9733700f9 Author: Johan Hovold Date: Mon Jul 21 17:36:09 2025 +0200 PCI/pwrctrl: Fix device leak at device stop Make sure to drop the reference to the pwrctrl device taken by of_find_device_by_node() when stopping a PCI device. Fixes: 681725afb6b9 ("PCI/pwrctl: Remove pwrctl device without iterating over all children of pwrctl parent") Signed-off-by: Johan Hovold Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org # v6.13 Link: https://patch.msgid.link/20250721153609.8611-4-johan+linaro@kernel.org commit e24bbbe0780262a21fc8619fe99078a5b8d64b18 Author: Johan Hovold Date: Mon Jul 21 17:36:08 2025 +0200 PCI/pwrctrl: Fix device and OF node leak at bus scan Make sure to drop the references to the pwrctrl OF node and device taken by of_pci_find_child_device() and of_find_device_by_node() respectively when scanning the bus. Fixes: 957f40d039a9 ("PCI/pwrctrl: Move creation of pwrctrl devices to pci_scan_device()") Signed-off-by: Johan Hovold Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org # v6.15 Link: https://patch.msgid.link/20250721153609.8611-3-johan+linaro@kernel.org commit 39f9be6aba3ae4d6fdd4b8554f1184d054d7a713 Author: Johan Hovold Date: Mon Jul 21 17:36:07 2025 +0200 PCI/pwrctrl: Fix device leak at registration Make sure to drop the reference to the pwrctrl device taken by of_find_device_by_node() when registering a PCI device. Fixes: b458ff7e8176 ("PCI/pwrctl: Ensure that pwrctl drivers are probed before PCI client drivers") Signed-off-by: Johan Hovold Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org # v6.13 Link: https://patch.msgid.link/20250721153609.8611-2-johan+linaro@kernel.org commit db16f9d90c1d97a2b5483b4b856625875bffe860 Author: Matthew Brost Date: Tue Aug 26 18:29:11 2025 +0000 drm/xe: Split TLB invalidation code in frontend and backend The frontend exposes an API to the driver to send invalidations, handles sequence number assignment, synchronization (fences), and provides a timeout mechanism. The backend issues the actual invalidation to the hardware (or firmware). The new layering easily allows issuing TLB invalidations to different hardware or firmware interfaces. Normalize some naming while here too. Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-10-stuart.summers@intel.com commit 8443e8c448cfe1082f2bbad41fe6e56e8d3b5bba Author: Matthew Brost Date: Tue Aug 26 18:29:10 2025 +0000 drm/xe: Add helpers to send TLB invalidations Break out the GuC specific code into helpers as part of the process to decouple frontback TLB invalidation code from the backend. Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-9-stuart.summers@intel.com commit 9aff63cf3791e464e4762ca79bd5d5b9643edce6 Author: Matthew Brost Date: Tue Aug 26 18:29:09 2025 +0000 drm/xe: Prep TLB invalidation fence before sending It is a bit backwards to add a TLB invalidation fence to the pending list after issuing the invalidation. Perform this step before issuing the TLB invalidation in a helper function. v2: Make sure the seqno_lock mutex covers the send as well (Matt) Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-8-stuart.summers@intel.com commit 15366239e2130ebe662351c0995590f2af2ba3b3 Author: Matthew Brost Date: Tue Aug 26 18:29:08 2025 +0000 drm/xe: Decouple TLB invalidations from GT Decouple TLB invalidations from the GT by updating the TLB invalidation layer to accept a `struct xe_tlb_inval` instead of a `struct xe_gt`. Also, rename *gt_tlb* to *tlb*. The internals of the TLB invalidation code still operate on a GT, but this is now hidden from the rest of the driver. Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-7-stuart.summers@intel.com commit 6d1e452e0948fd69ec3aeea0e52807152dc93c2d Author: Matthew Brost Date: Tue Aug 26 18:29:07 2025 +0000 drm/xe: Add xe_gt_tlb_invalidation_done_handler Decouple GT TLB seqno handling from G2H handler. v2: - Add kernel doc Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-6-stuart.summers@intel.com commit 594bb930fc7dd40cea72c643047d642fadfc8b68 Author: Matthew Brost Date: Tue Aug 26 18:29:06 2025 +0000 drm/xe: Add xe_tlb_inval structure Extract TLB invalidation state into a structure to decouple TLB invalidations from the GT, allowing the structure to be embedded anywhere in the driver. Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-5-stuart.summers@intel.com commit c697ddcf27bd5c71b89539a9b79b7d078777b394 Author: Matthew Brost Date: Tue Aug 26 18:29:05 2025 +0000 drm/xe: s/tlb_invalidation/tlb_inval tlb_invalidation is a bit verbose leading to ugly wraps in the code, shorten to tlb_inval. Signed-off-by: Stuart Summers Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-4-stuart.summers@intel.com commit 76186a253a4b9eb41c5a83224c14efdf30960a71 Author: Stuart Summers Date: Tue Aug 26 18:29:04 2025 +0000 drm/xe: Cancel pending TLB inval workers on teardown Add a new _fini() routine on the GT TLB invalidation side to handle this worker cleanup on driver teardown. v2: Move the TLB teardown to the gt fini() routine called during gt_init rather than in gt_alloc. This way the GT structure stays alive for while we reset the TLB state. Signed-off-by: Stuart Summers Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-3-stuart.summers@intel.com commit ce5059bf851b7286ec27797d786aab28c8a62e5e Author: Stuart Summers Date: Tue Aug 26 18:29:03 2025 +0000 drm/xe: Move explicit CT lock in TLB invalidation sequence Currently the CT lock is used to cover TLB invalidation sequence number updates. In an effort to separate the GuC back end tracking of communication with the firmware from the front end TLB sequence number tracking, add a new lock here to specifically track those sequence number updates coming in from the user. Apart from the CT lock, we also have a pending lock to cover both pending fences and sequence numbers received from the back end. Those cover interrupt cases and so it makes not to overload those with sequence numbers coming in from new transactions. In that way, we'll employ a mutex here. v2: Actually add the correct lock rather than just dropping it... (Matt) Signed-off-by: Stuart Summers Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250826182911.392550-2-stuart.summers@intel.com commit 2674f1ef29f46ae81464d0ac44b7824deb9de85c Author: Lucas De Marchi Date: Tue Aug 26 08:32:11 2025 -0700 drm/xe/configfs: Block runtime attribute changes Although it's possible to change the attributes in runtime, they have no effect after the driver is already bound to the device. Check for that and return -EBUSY in that case. This should help users understand what's going on when the behavior is not changing even if the value from the configfs is "right", but it got to that state too late. Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250826153210.3068808-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi commit 9f3acb3d9a1872e2fa36af068ca2e93a8a864089 Author: Nipun Gupta Date: Tue Aug 26 10:08:52 2025 +0530 vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ Define dummy MSI related APIs in VFIO CDX driver to build the driver without enabling CONFIG_GENERIC_MSI_IRQ flag. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508070308.opy5dIFX-lkp@intel.com/ Reviewed-by: Nikhil Agarwal Reviewed-by: Alex Williamson Signed-off-by: Nipun Gupta Link: https://lore.kernel.org/r/20250826043852.2206008-2-nipun.gupta@amd.com Signed-off-by: Alex Williamson commit ab1d8dda32e9507ca3bfb6b43661aeaa27f7bd82 Author: Nipun Gupta Date: Tue Aug 26 10:08:51 2025 +0530 cdx: don't select CONFIG_GENERIC_MSI_IRQ x86 does not use CONFIG_GENERIC_MSI_IRQ, and trying to enable it anyway results in a build failure: In file included from include/linux/ssb/ssb.h:10, from drivers/ssb/pcihost_wrapper.c:18: include/linux/gpio/driver.h:41:33: error: field 'msiinfo' has incomplete type 41 | msi_alloc_info_t msiinfo; | ^~~~~~~ In file included from include/linux/kvm_host.h:19, from arch/x86/events/intel/core.c:17: include/linux/msi.h:528:33: error: field 'alloc_info' has incomplete type 528 | msi_alloc_info_t alloc_info; Change the driver to actually build without this symbol and remove the incorrect 'select' statements. Fixes: e8b18c11731d ("cdx: Fix missing GENERIC_MSI_IRQ on compile test") Reviewed-by: Robin Murphy Reviewed-by: Nikhil Agarwal Signed-off-by: Arnd Bergmann Signed-off-by: Nipun Gupta Link: https://lore.kernel.org/r/20250826043852.2206008-1-nipun.gupta@amd.com Signed-off-by: Alex Williamson commit fcf9ae9ec9761802b69294d1b3f98d51f14e5175 Author: Shameer Kolothum Date: Wed Aug 27 15:32:15 2025 +0100 MAINTAINERS: Update Shameer Kolothum's email address Changed jobs and Huawei email is no longer valid. Also, since I no longer have access to HiSilicon hardware, remove myself from HISILICON PCI DRIVER maintainer entry. Acked-by: Jonathan Cameron Signed-off-by: Shameer Kolothum Link: https://lore.kernel.org/r/20250827143215.2311-1-skolothumtho@nvidia.com Signed-off-by: Alex Williamson commit fd134b0f2f8ef9b1b7b0cade8cac4ff831619713 Author: David Matlack Date: Fri Aug 22 21:25:17 2025 +0000 vfio: selftests: Add a script to help with running VFIO selftests Introduce run.sh, a script to help with running VFIO selftests. The script is intended to be used for both humans manually running VFIO selftests, and to incorporate into test automation where VFIO selftests may run alongside other tests. As such the script aims to be hermetic, returning the system to the state it was before the test started. The script takes as input the BDF of a device to use and a command to run (typically the command would be a VFIO selftest). e.g. $ ./run.sh -d 0000:6a:01.0 ./vfio_pci_device_test or $ ./run.sh -d 0000:6a:01.0 -- ./vfio_pci_device_test The script then handles unbinding device 0000:6a:01.0 from its current driver, binding it to vfio-pci, running the test, unbinding from vfio-pci, and binding back to the original driver. When run.sh runs the provided test, it does so by appending the BDF as the last parameter. For example: $ ./run.sh -d 0000:6a:01.0 -- echo hello Results in the following being printed to stdout: hello 0000:6a:01.0 The script also supports a mode where it can break out into a shell so that multiple tests can be run manually. $ ./run.sh -d 0000:6a:01.0 -s $ echo $VFIO_SELFTESTS_BDF $ ./vfio_pci_device_test $ exit Choosing which device to use is up to the user. In the future this script should be extensible to tests that want to use multiple devices. The script can support accepting -d BDF multiple times and parse them into an array, setup all the devices, pass the list of BDFs to the test, and then cleanup all the devices. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-31-dmatlack@google.com Signed-off-by: Alex Williamson commit 8afcbe20476ad238fd1f331f51d721138eff5172 Author: David Matlack Date: Fri Aug 22 21:25:16 2025 +0000 vfio: selftests: Make iommufd the default iommu_mode Now that VFIO selftests support iommufd, make it the default mode. IOMMUFD is the successor to VFIO_TYPE1{,v2}_IOMMU and all new features are being added there, so it's a slightly better fit as the default mode. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-30-dmatlack@google.com Signed-off-by: Alex Williamson commit 61cbfe5014cbc17b376b6a9b2087f39f379a6b86 Author: David Matlack Date: Fri Aug 22 21:25:15 2025 +0000 vfio: selftests: Add iommufd mode Add a new IOMMU mode for using iommufd directly. In this mode userspace opens /dev/iommu and binds it to a device FD acquired through /dev/vfio/devices/vfioX. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-29-dmatlack@google.com Signed-off-by: Alex Williamson commit d1a17495bb878542898d7ca4aa8fde29423a8ee0 Author: David Matlack Date: Fri Aug 22 21:25:14 2025 +0000 vfio: selftests: Add iommufd_compat_type1{,v2} modes Add new IOMMU modes for using iommufd in compatibility mode with VFIO_TYPE1_IOMMU and VFIO_TYPE1v2_IOMMU. In these modes, VFIO selftests will open /dev/iommu and treats it as a container FD (as if it had opened /dev/vfio/vfio) and the kernel translates the container ioctls to iommufd calls transparently. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-28-dmatlack@google.com Signed-off-by: Alex Williamson commit 0969c685ba5b248648533a3313f55a3fd9382a9e Author: David Matlack Date: Fri Aug 22 21:25:13 2025 +0000 vfio: selftests: Add vfio_type1v2_mode Add a new IOMMU mode for using VFIO_TYPE1v2_IOMMU. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-27-dmatlack@google.com Signed-off-by: Alex Williamson commit 892aff147a545fa7c94d98613093afa84faa25b1 Author: David Matlack Date: Fri Aug 22 21:25:12 2025 +0000 vfio: selftests: Replicate tests across all iommu_modes Automatically replicate vfio_dma_mapping_test and vfio_pci_driver_test across all supported IOMMU modes using fixture variants. Both of these tests exercise DMA mapping to some degree so having automatic coverage across all IOMMU modes will help catch bugs. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-26-dmatlack@google.com Signed-off-by: Alex Williamson commit 5df9bd6205114fac04c0f9539fa23f996e22a439 Author: David Matlack Date: Fri Aug 22 21:25:11 2025 +0000 vfio: selftests: Encapsulate IOMMU mode Encapsulate the "IOMMU mode" a test should use behind a new struct. In the future this will be used to support other types of IOMMUs besides VFIO_TYPE1_IOMMU, and allow users to select the mode on the command line. No functional change intended. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-25-dmatlack@google.com Signed-off-by: Alex Williamson commit 118e073ef6a3446862ada27bdca2b8a53447f428 Author: David Matlack Date: Fri Aug 22 21:25:10 2025 +0000 vfio: selftests: Move helper to get cdev path to libvfio Move the helper function to get the VFIO cdev path to libvfio so that it can be used in libvfio in a subsequent commit. No functional change intended. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-24-dmatlack@google.com Signed-off-by: Alex Williamson commit 35b05bd96204bc40a2ca8620bad1a5d139c20060 Author: David Matlack Date: Fri Aug 22 21:25:09 2025 +0000 vfio: selftests: Add driver for Intel DSA Add a driver to VFIO selftests for Intel DSA devices. For now the driver only supports up to 32 batches and 1024 copies per batch, which were the limits of the hardware this commit was tested with. This is sufficient to generate 9+ minutes of DMA memcpys at a rate of over 30 GB/s. This should be plenty to stress test VFIO and the IOMMU. The driver does not yet support requesting interrupt handles, as this commit was not tested against hardware that requires it. Cc: Vinicius Costa Gomes Cc: Dave Jiang Acked-by: Vinicius Costa Gomes Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-23-dmatlack@google.com Signed-off-by: Alex Williamson commit 003e6faf2c8ff1670c35622f11ff6211be563a9e Author: David Matlack Date: Fri Aug 22 21:25:08 2025 +0000 dmaengine: idxd: Allow registers.h to be included from tools/ Allow drivers/dma/idxd/registers.h to be included from userspace in tools/ by adjusting the include path to uapi/linux/idxd.h if __KERNEL__ is not defined. A subsequent commit will use registers.h to implement a userspace driver for Intel DSA devices in tools/testing/selftests/vfio. Acked-by: Vinicius Costa Gomes Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-22-dmatlack@google.com Signed-off-by: Alex Williamson commit 3fe305773bbeb2d946b9fb3c1224c8b00d6755ef Author: David Matlack Date: Fri Aug 22 21:25:07 2025 +0000 tools headers: Import iosubmit_cmds512() Import iosubmit_cmds512() from arch/x86/include/asm/io.h into tools/ so it can be used by VFIO selftests to interact with Intel DSA devices. Also pull in movdir64b() from arch/x86/include/asm/special_insns.h into tools/, which is the underlying instruction used by iosubmit_cmds512(). Changes made when importing: None Acked-by: Vinicius Costa Gomes Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-21-dmatlack@google.com Signed-off-by: Alex Williamson commit 2223587df5c5e935cc6f973f62a9608eef81bec8 Author: David Matlack Date: Fri Aug 22 21:25:06 2025 +0000 vfio: selftests: Add driver for Intel CBDMA Add a driver for the Intel CBDMA device. This driver is based on and named after the Linux driver for this device (drivers/dma/ioat/) and also based on previous work from Peter Shier . The driver aims to be as simple as possible. It uses a single descriptor to issue DMA operations, and only supports the copy operation. For "DMA storms", the driver kicks off the maximum number of maximum-sized DMA operations. On Skylake server parts, this was 2^16-1 copies of size 2M and lasts about 15 seconds. Create symlinks to drivers/dma/ioat/{hw.h,registers.h} to get access to various macros (e.g. IOAT_CHANCMD_RESET) and struct ioat_dma_descriptor. Cc: Dave Jiang Cc: Dan Williams Acked-by: Dave Jiang Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-20-dmatlack@google.com Signed-off-by: Alex Williamson commit b7f086912c1d3ce1e8c2753e0ff329947219d0f6 Author: David Matlack Date: Fri Aug 22 21:25:05 2025 +0000 dmaengine: ioat: Move system_has_dca_enabled() to dma.h Move the function prototype for system_has_dca_enabled() from hw.h to dma.h. This allows hw.h to be included from tools/, which will be used in a subsysequent commit to implement a userspace driver for Intel CBDMA devices in tools/testing/selftests/vfio. No functional change intended. Acked-by: Dave Jiang Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-19-dmatlack@google.com Signed-off-by: Alex Williamson commit dc0e216cf00b74cf61fdc882f8373beb8cdbec5e Author: David Matlack Date: Fri Aug 22 21:25:04 2025 +0000 tools headers: Add symlink to linux/pci_ids.h Add a symlink to include/linux/pci_ids.h to tools/include/. This will be used by VFIO selftests in subsequent commits to match device and vendor IDs. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-18-dmatlack@google.com Signed-off-by: Alex Williamson commit ce5dc9aa72d9c3d6cb14b3a6aab900124999d8d0 Author: David Matlack Date: Fri Aug 22 21:25:03 2025 +0000 tools headers: Import x86 MMIO helper overrides Import the x86-specific overrides for from the kernel headers into tools/include/. Changes made when importing: - Replace CONFIG_X86_64 with __x86_64__. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-17-dmatlack@google.com Signed-off-by: Alex Williamson commit 1f9c8edd6a7e9b0fd914cfeef8ce075307e8e702 Author: David Matlack Date: Fri Aug 22 21:25:02 2025 +0000 tools headers: Import asm-generic MMIO helpers Import the asm-generic MMIO helper functions from the kernel headers into tools/include/. The top-level include is which then includes the arch-specific , which then includes . This layout is chosen to match the kernel header layout and to appease checkpatch.pl (which warns against including or directly). Changes made when importing: - Add missing includes at the top. - Stub out mmiowb_set_pending(). - Stub out _THIS_IP_. - Stub out log_*_mmio() calls. - Drop the CONFIG_64BIT checks, since tools/include/linux/types.h always defines u64. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-16-dmatlack@google.com Signed-off-by: Alex Williamson commit 9bf9b185e3ce76c9fddb4c6edb0ec3334b7649df Author: David Matlack Date: Fri Aug 22 21:25:01 2025 +0000 tools headers: Add stub definition for __iomem Add an empty definition for __iomem so that kernel headers that use __iomem can be imported into tools/include/ with less modifications. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-15-dmatlack@google.com Signed-off-by: Alex Williamson commit fded8da4bc38df6e1475ac5998934c490b96215d Author: David Matlack Date: Fri Aug 22 21:25:00 2025 +0000 vfio: sefltests: Add vfio_pci_driver_test Add a new selftest that tests all driver operations. This test serves both as a demonstration of the driver framework, and also as a correctness test for future drivers. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-14-dmatlack@google.com Signed-off-by: Alex Williamson commit 1b197032ac58b9a17350c086fc151390f32080b2 Author: David Matlack Date: Fri Aug 22 21:24:59 2025 +0000 vfio: selftests: Add driver framework Add a driver framework to VFIO selftests, so that devices can generate DMA and interrupts in a common way that can be then utilized by tests. This will enable VFIO selftests to exercise real hardware DMA and interrupt paths, without needing any device-specific code in the test itself. Subsequent commits will introduce drivers for specific devices. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-13-dmatlack@google.com Signed-off-by: Alex Williamson commit 50d8fe805f75a159551ddb6b04ecdad26ec50221 Author: David Matlack Date: Fri Aug 22 21:24:58 2025 +0000 vfio: selftests: Add a helper for matching vendor+device IDs Add a helper function for matching a device against a given vendor and device ID. This will be used in a subsequent commit to match devices against drivers. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-12-dmatlack@google.com Signed-off-by: Alex Williamson commit 924947804f2b9e564efdc814420d21b239df2dd4 Author: David Matlack Date: Fri Aug 22 21:24:57 2025 +0000 vfio: selftests: Enable asserting MSI eventfds not firing Make it possible to assert that a given MSI eventfd did _not_ fire by adding a helper to mark an eventfd non-blocking. Demonstrate this in vfio_pci_device_test by asserting the MSI eventfd did not fire before vfio_pci_irq_trigger(). Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-11-dmatlack@google.com Signed-off-by: Alex Williamson commit 346cd58f1fb588f8ff193d76cf0bb455446ace03 Author: David Matlack Date: Fri Aug 22 21:24:56 2025 +0000 vfio: selftests: Keep track of DMA regions mapped into the device Keep track of the list of DMA regions that are mapped into the device using a linked list and a new struct vfio_dma_region and use that to add {__,}to_iova() for converting host virtual addresses into IOVAs. This will be used in a subsequent commit to map multiple DMA regions into a device that are then used by drivers. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-10-dmatlack@google.com Signed-off-by: Alex Williamson commit 47f861048ef7034a59431020c5916a43378a8c0c Author: Josh Hilke Date: Fri Aug 22 21:24:55 2025 +0000 vfio: selftests: Validate 2M/1G HugeTLB are mapped as 2M/1G in IOMMU Update vfio dma mapping test to verify that the IOMMU uses 2M and 1G mappings when 2M and 1G HugeTLB pages are mapped into a device respectively. This validation is done by inspecting the contents of the I/O page tables via /sys/kernel/debug/iommu/intel/. This validation is skipped if that directory is not available (i.e. non-Intel IOMMUs). Signed-off-by: Josh Hilke [reword commit message, refactor code] Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-9-dmatlack@google.com Signed-off-by: Alex Williamson commit 751f6b5d06c301b329b699ab2089c9dcb7eebc47 Author: Josh Hilke Date: Fri Aug 22 21:24:54 2025 +0000 vfio: selftests: Add DMA mapping tests for 2M and 1G HugeTLB Add test coverage of mapping 2M and 1G HugeTLB to vfio_dma_mapping_test using a fixture variant. If there isn't enough HugeTLB memory available for the test, just skip them. Signed-off-by: Josh Hilke [switch from command line option to fixture variant] Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-8-dmatlack@google.com Signed-off-by: Alex Williamson commit a0fd0af504f7fe11e2f87e48a1924d7e7f5a0590 Author: Josh Hilke Date: Fri Aug 22 21:24:53 2025 +0000 vfio: selftests: Add test to reset vfio device. Add a test to vfio_pci_device_test which resets the device. If reset is not supported by the device, the test is skipped. Signed-off-by: Josh Hilke Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-7-dmatlack@google.com Signed-off-by: Alex Williamson commit b477e7bcd25ecb4da91bb52d5f980611cc77d543 Author: Josh Hilke Date: Fri Aug 22 21:24:52 2025 +0000 vfio: selftests: Move vfio dma mapping test to their own file Move the dma_map_unmap test from vfio_pci_device_test to a new test: vfio_dma_mapping_test. We are going to add more complex dma mapping tests, so it makes sense to separate this from the vfio pci device test which is more of a sanity check for vfio pci functionality. Signed-off-by: Josh Hilke Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-6-dmatlack@google.com Signed-off-by: Alex Williamson commit 790588f06e9ce58c281faeada453f47361bc06b6 Author: Josh Hilke Date: Fri Aug 22 21:24:51 2025 +0000 vfio: selftests: Test basic VFIO and IOMMUFD integration Add a vfio test suite which verifies that userspace can bind and unbind devices, allocate I/O address space, and attach a device to an IOMMU domain using the cdev + IOMMUfd VFIO interface. Signed-off-by: Josh Hilke Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-5-dmatlack@google.com Signed-off-by: Alex Williamson commit 16eadd7c1277284cfff5b7071910920a2d008251 Author: David Matlack Date: Fri Aug 22 21:24:50 2025 +0000 vfio: selftests: Introduce vfio_pci_device_test Introduce a basic VFIO selftest called vfio_pci_device_test to demonstrate the functionality of the VFIO selftest library and provide some test coverage of basic VFIO operations, including: - Mapping and unmapping DMA - Mapping and unmapping BARs - Enabling, triggering, and disabling MSI and MSI-x - Reading and writing to PCI config space This test should work with most PCI devices, as long as they are bound to vfio-pci. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-4-dmatlack@google.com Signed-off-by: Alex Williamson commit 19faf6fd969c21589b6dd40c35255e4d00d427f8 Author: David Matlack Date: Fri Aug 22 21:24:49 2025 +0000 vfio: selftests: Add a helper library for VFIO selftests Add a basic helper library to be used by VFIO selftests. The basic unit of the library is struct vfio_pci_device, which represents a single PCI device that is bound to the vfio-pci driver. The library currently only supports a single device per group and container, and VFIO IOMMU types. The code in this library was heavily based on prior work done by Raghavendra Rao Ananta , and the VFIO_ASSERT*() macros were written by Vipin Sharma . Separate that Makefile rules for building the library into a separate script so that the library can be built by and linked into KVM selftests in a subsequent commit. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-3-dmatlack@google.com Signed-off-by: Alex Williamson commit 292e9ee22b0adad49c9a6f63708988e32c007da6 Author: David Matlack Date: Fri Aug 22 21:24:48 2025 +0000 selftests: Create tools/testing/selftests/vfio Create the directory tools/testing/selftests/vfio with a stub Makefile and hook it up to the top-level selftests Makefile. This directory will be used in subsequent commits to host selftests for the VFIO subsystem. Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-2-dmatlack@google.com Signed-off-by: Alex Williamson commit 7e2a5b0a9a165a7c51274aa01b18be29491b4345 Author: Alex Deucher Date: Fri Aug 22 12:12:37 2025 -0400 drm/amdgpu/userq: fix error handling of invalid doorbell If the doorbell is invalid, be sure to set the r to an error state so the function returns an error. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 5f976c9939f0d5916d2b8ef3156a6d1799781df1 Author: Jesse.Zhang Date: Tue Aug 26 17:30:58 2025 +0800 drm/amdgpu: update firmware version checks for user queue support The minimum firmware versions required for user queue functionality have been increased to address an issue where the queue privilege state was lost during queue connect operations. The problem occurred because the privilege state was being restored to its initial value at the beginning of the function, overwriting the state that was properly set during the queue connect case. This commit updates the minimum version requirements: - ME firmware from 2390 to 2420 - PFP firmware from 2530 to 2580 - MEC firmware from 2600 to 2650 - MES firmware remains at 120 These updated firmware versions contain the necessary fixes to properly maintain queue privilege state throughout connect operations. Fixes: 61ca97e9590c ("drm/amdgpu: Add fw minimum version check for usermode queue") Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit e82a8d441038d8cb10b63047a9e705c42479d156 Author: Yang Wang Date: Mon Aug 25 12:54:01 2025 +0800 drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode the PPSMC_MSG_GetPptLimit msg is not valid for gfx 11.0.3 on vf mode, so skiped to create power1_cap* hwmon sysfs node. Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ec813f384b1a9df332e86ff46c422e5d2d00217f Author: Alex Deucher Date: Mon Aug 25 09:35:07 2025 -0400 drm/amdgpu/vpe: cancel delayed work in hw_fini We need to cancel any outstanding work at both suspend and driver teardown. Move the cancel to hw_fini which gets called in both cases. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 061a09b4dcc4ebbc8ab8b648f7da697962aae68a Author: David (Ming Qiang) Wu Date: Mon Aug 25 15:12:18 2025 -0400 drm/amdgpu/vcn: remove unused code in vcn_v1_0.c Reviewed-by: Alex Deucher Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 87e65052616c53676a4f9ae3def290fc489215e2 Author: Shaoyun Liu Date: Thu Jul 10 21:42:16 2025 -0400 drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12 From MES version 0x81, it provide the new API INV_TLBS that support invalidate tlbs with PASID. Signed-off-by: Shaoyun Liu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit e86a411b4293a1db58954ce7c99db9903d530b9f Author: Shaoyun Liu Date: Fri Jul 4 12:30:10 2025 -0400 drm/amd/include : Update MES v12 API header(INV_TLBS) The requirement from driver side is to have an API that can do the tlb invalidation on dedicate pasid since driver don't know the vmid and process mapping. Make the API generic to support different tlb invalidation related request. Driver can specify pasid, vmid, hub_id and vm address range need to be invalidated. With this API the old INV_GART in MISC Op can be deprecated. Signed-off-by: Shaoyun Liu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit a7a411e2462675327e07dd35f226c48d236bdbb3 Author: Jesse.Zhang Date: Sat Aug 23 15:00:06 2025 +0800 drm/amdgpu: fix shift-out-of-bounds in amdgpu_debugfs_jpeg_sched_mask_set Fix a UBSAN shift-out-of-bounds warning in amdgpu_debugfs_jpeg_sched_mask_set when the shift exponent reaches or exceeds 32 bits. The issue occurred because a 32-bit integer '1' was being shifted by up to 32 bits, which is undefined behavior. Replace '1' with '1ULL' to ensure 64-bit arithmetic, matching the u64 type of 'val' and preventing the shift overflow. This is consistent with the existing mask calculation that already uses 1ULL. The error manifested as: UBSAN: shift-out-of-bounds in drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c:373:17 shift exponent 32 is too large for 32-bit type 'int' v2: remove debug log Reviewed-by: Lijo Lazar Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 268da6fc8d89f322358750922b626c8fda33043b Author: Nicholas Carbones Date: Fri Aug 15 20:45:14 2025 -0400 drm/amd/display: DC v3.2.347 DC Release v3.2.347 * Firmware releases for multiple asics * CodeQL fixes * Fix for double cursor with 180 degree rotation on large resolutions * Misc bug fixes for DSC, PSR/Replay, DPIA etc. Signed-off-by: Nicholas Carbones Signed-off-by: Aurabindo Pillai Reviewed-by: Leo Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 3dc9c55d9c075b1b1337a2b6234d4c7a99a482ab Author: Taimur Hassan Date: Fri Aug 15 19:23:50 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.24.0 Add two new IPS residency data modes. Signed-off-by: Taimur Hassan Signed-off-by: Aurabindo Pillai Reviewed-by: Leo Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c350d9e2684f5ee9e753b825cf4bc3fbac8fe865 Author: Jack Xiao Date: Mon Aug 25 13:41:23 2025 -0400 Reapply "drm/amdgpu: fix incorrect vm flags to map bo" It should use vm flags instead of pte flags to specify bo vm attributes. This reverts commit 1263ceea2a1327014d9de2858a122f3c27dfa4dd. Reapply this patch with the proper fixes tag. Fixes: 6716a823d18d ("drm/amdgpu: rework how PTE flags are generated v3") Signed-off-by: Jack Xiao Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit be33e8a239aac204d7e9e673c4220ef244eb1ba3 Author: Alex Deucher Date: Mon Aug 25 13:40:22 2025 -0400 Revert "drm/amdgpu: fix incorrect vm flags to map bo" This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f. Revert this to align with 6.17 because the fixes tag was wrong on this commit. Signed-off-by: Alex Deucher commit 6b34e7ed4ba583ee77032a4c850ff97ba16ad870 Author: Dillon Varone Date: Thu Aug 14 12:01:15 2025 -0400 drm/amd/display: Consider sink max slice width limitation for dsc [WHY&HOW] The sink max slice width limitation should be considered for DSC, but was removed in "refactor DSC cap calculations". This patch adds it back and takes the valid minimum between the sink and source. Signed-off-by: Dillon Varone Signed-off-by: Aurabindo Pillai Reviewed-by: Wenjing Liu Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bdbb6a14db574677254cb7846a3774f5fc57e549 Author: Clay King Date: Thu Aug 14 17:01:04 2025 -0400 drm/amd/display: Array offset used before range check Consolidating multiple CodeQL Fixes for alerts with rule id: cpp/offset-use-before-range-check Reviewed-by: Joshua Aberback Signed-off-by: Clay King Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f382e2d0faad0e0d73f626dbd71f2a4fce03975b Author: Yihan Zhu Date: Wed Aug 13 16:05:10 2025 -0400 drm/amd/display: wait for otg update pending latch before clock optimization [WHY & HOW] OTG pending update unlatched will cause system fail, wait OTG fully disabled to avoid this error. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Yihan Zhu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 048ce48c3dc9ddb0026b750001283ecbb2828bde Author: Clay King Date: Thu Aug 14 17:02:45 2025 -0400 drm/amd/display: Incorrect 'not' operator usage Consolidating multiple CodeQL Fixes for alerts with rule id: cpp/incorrect-not-operator-usage Reviewed-by: Joshua Aberback Signed-off-by: Clay King Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9ec77e3a4b8913508bfd10891ce339af05e671ef Author: Clay King Date: Thu Aug 14 16:58:15 2025 -0400 drm/amd/display: Multiplication result converted to larger type Consolidating multiple CodeQL Fixes for alerts with rule id: cpp/integer-multiplication-cast-to-long Reviewed-by: Joshua Aberback Signed-off-by: Clay King Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8a359f0f138d5ac7ceffd21b73279be50e516c0a Author: Ivan Lipski Date: Thu Aug 7 09:45:26 2025 -0400 drm/amd/display: Support HW cursor 180 rot for any number of pipe splits [Why] For the HW cursor, its current position in the pipe_ctx->stream struct is not affected by the 180 rotation, i. e. the top left corner is still at 0,0. However, the DPP & HUBP set_cursor_position functions require rotated position. The current approach is hard-coded for ODM 2:1, thus it's failing for ODM 4:1, resulting in a double cursor. [How] Instead of calculating the new cursor position relatively to the viewports, we calculate it using a viewavable clip_rect of each plane. The clip_rects are first offset and scaled to the same space as the src_rect, i. e. Stream space -> Plane space. In case of a pipe split, which divides the plane into 2 or more viewports, the clip_rect is the union of all the viewports of the given plane. With the assumption that the viewports in HUBP's set_cursor_position are in the Plane space as well, it should produce a correct cursor position for any number of pipe splits. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ivan Lipski Signed-off-by: Leo Li Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit dbe88861742ebdb277aaf8963c9bfb876436106c Author: Reza Amini Date: Tue Aug 12 10:02:45 2025 -0400 drm/amd/display: Decrease stack size in logging path [why] Reducing stack size can avoid stack over flow [how] Make local variables const and static so they are not on the stack. Reviewed-by: Dillon Varone Signed-off-by: Reza Amini Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 90868205b6f21896a62bf99e92ad1fb55eda0e2d Author: Ausef Yousof Date: Wed Jul 30 16:08:10 2025 -0400 drm/amd/display: track dpia support [why&how] initialize a flag to track if we previously supported dpia and write that to boot options Reviewed-by: Nicholas Kazlauskas Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Ausef Yousof Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8b715afa8f2d74e7f3be1d8b2ff23adb53986c1b Author: Cruise Hung Date: Mon Aug 11 21:03:13 2025 +0800 drm/amd/display: Reserve instance index notified by DMUB [Why] Reserve instance index notified by DMUB. [How] Add new variable for instance index. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Cruise Hung Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 88fdd89d1ca2d5e6385ec1f562bdb34c449cab47 Author: Karthi Kandasamy Date: Mon Jul 7 13:28:12 2025 +0200 drm/amd/display: Add control flags to force PSR / replay To change PSR/Replay behavior based on OS preferences, add some config options. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Karthi Kandasamy Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1c65502f813318d48084b33a2c5713d317019dfe Author: Alex Deucher Date: Mon Aug 18 15:19:47 2025 -0400 drm/amdgpu/vpe: add ring reset support Implement ring reset for VPE. Similar to VCN and JPEG, just powergate the the IP to reset it. v2: Properly set per queue reset flag Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit fa064d50b7eee6f40749ff03de7ef99ff4acc8c9 Author: Alex Deucher Date: Wed Aug 13 14:53:50 2025 -0400 drm/amdgpu/vcn: drop extra cancel_delayed_work_sync() We already call this in the hw_fini() methods for all VCN instances, so no need to call it again in amdgpu_vcn_suspend(). Tested-by: David (Ming Qiang) Wu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 Author: Amber Lin Date: Fri Aug 15 14:04:15 2025 -0400 drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption When KFD asks CP to preempt queues, other than preempt CP queues, CP also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout. Currently queue_preemption_timeout_ms is 9000 ms by default but can be configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as 4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to queue_preemption_timeout_ms so in a slow system such as emulator, both CP and SDMA slowness are taken into account. Signed-off-by: Amber Lin Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 181d7dcc584f8ac575ea2b6e51498547186df9f3 Author: Jesse.Zhang Date: Tue Aug 19 09:46:04 2025 +0800 drm/amd/pm: Update SMU v13.0.6 PPT caps initialization Update the conditions for setting the SMU vcn reset caps in the SMU v13.0.6 PPT initialization function. Specifically: - Add support for VCN reset capability for firmware versions 0x00558200 and above when the program version is 0. - Add support for VCN reset capability for firmware versions 0x05551800 and above when the program version is 5. v2: correct the smu mp1 version for program 5 (Lijo) Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Acked-by: Alex Deucher Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 Author: Eric Huang Date: Mon Aug 18 14:22:53 2025 -0400 drm/amdkfd: fix vram allocation failure for a special case When it only allocates vram without va, which is 0, and a SVM range allocated stays in this range, the vram allocation returns failure. It should be skipped for this case from SVM usage check. Signed-off-by: Eric Huang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 7bbfa1b1fa7b91cb805563ebffd1d55df192df05 Author: Sunday Clement Date: Fri May 30 10:58:08 2025 -0400 drm/amdkfd: Allow device error to be logged The addition of a WARN_ON() check in order to return early in the kq_initialize function retroactively causes the default case in the following switch statement to never be executed, preventing dev_err from logging device errors in the kernel. Both logs are now checked in the default case. Signed-off-by: Sunday Clement Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit cbf3a5d67a5bcae620b5315e4891f8c3e939bc79 Author: Rakuram Eswaran Date: Thu Aug 21 08:29:55 2025 +0530 docs: gpu: amdgpu: Fix spelling in amdgpu documentation Fixed following typos reported by Codespell 1. propogated ==> propagated aperatures ==> apertures In Documentation/gpu/amdgpu/debugfs.rst 2. parition ==> partition In Documentation/gpu/amdgpu/process-isolation.rst 3. conections ==> connections In Documentation/gpu/amdgpu/display/programming-model-dcn.rst In addition to above, Fixed wrong bit-partition naming in gpu/amdgpu/process-isolation.rst from "fourth" partition to "third" partition. Reviewed-by: Randy Dunlap Suggested-by: Randy Dunlap Suggested-by: Alexander Deucher Signed-off-by: Rakuram Eswaran Signed-off-by: Alex Deucher commit f117eca965c797c5efb55ee40543cb37b9cb7d23 Author: Brahmajit Das Date: Thu Aug 21 17:31:33 2025 +0530 drm/amd/display: clean-up dead code in dml2_mall_phantom pipe_idx in funtion dml2_svp_validate_static_schedulabilit, although set is never actually used. While building with GCC 16 this gives a warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_mall_phantom.c: In function ‘set_phantom_stream_timing’: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_mall_phantom.c:657:25: warning: variable ‘pipe_idx’ set but not used [-Wunused-but-set-variable=] 657 | unsigned int i, pipe_idx; | ^~~~~~~~ Signed-off-by: Brahmajit Das Signed-off-by: Alex Deucher commit 863a17904a8250aeb2692f703721b70cda8a1c82 Author: Ce Sun Date: Thu Aug 21 16:27:57 2025 +0800 drm/amdgpu: Add support for dpc to the product Add support for dpc to the product Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e68197aa2bbf658a95a927db01c2933c8125bf17 Author: Yifan Zhang Date: Wed Aug 20 14:55:41 2025 +0800 drm/amdgpu: remove redundant AMDGPU_HAS_VRAM AMDGPU_HAS_VRAM is redundant with is_app_apu, as both refer to APUs with no carve-out. Since AMDGPU_HAS_VRAM only occurs once, remove AMDGPU_HAS_VRAM definition. The tmr allocation can be covered with AMDGPU_GEM_DOMAIN_GTT | AMDGPU_GEM_DOMAIN_VRAM in both vram and non vram ASICs. Signed-off-by: Yifan Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit b9dba6a644fc31a7342962bf0a5c0142efd4a2f2 Author: Ce Sun Date: Thu Aug 21 10:59:23 2025 +0800 drm/amdgpu: Add support for dpc to a series of products Add support for dpc to a series of products Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 01479d140686430ce51d01dc4ad4548323bd1232 Author: Kathara Sasikumar Date: Tue Aug 19 21:19:58 2025 +0000 Documentation/gpu/amdgpu: Fix duplicate word in driver-core.rst Remove duplicate word 'and' in driver-core.rst. Signed-off-by: Kathara Sasikumar Signed-off-by: Alex Deucher commit d8442bcad0764c5613e9f8b2356f3e0a48327e20 Author: Ce Sun Date: Wed Aug 20 17:18:57 2025 +0800 drm/amdgpu: Correct the loss of aca bank reg info By polling, poll ACA bank count to ensure that valid ACA bank reg info can be obtained v2: add corresponding delay before send msg to SMU to query mca bank info (Stanley) v3: the loop cannot exit. (Thomas) v4: remove amdgpu_aca_clear_bank_count. (Kevin) v5: continuously inject ce. If a creation interruption occurs at this time, bank reg info will be lost. (Thomas) v5: each cycle is delayed by 100ms. (Tao) Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 0989b764f43d4de2c6665c15165c251d9cfde9c0 Author: Ce Sun Date: Tue Aug 19 14:47:05 2025 +0800 drm/amdgpu: Add a mutex lock to protect poison injection When poison is triggered multiple times, competition will occur. Add a mutex lock to protect poison injection Signed-off-by: Ce Sun Reviewed-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 907813e5d7cadfeafab12467d748705a5309efb0 Author: Ce Sun Date: Thu Aug 7 12:36:05 2025 +0800 drm/amdgpu: Correct the counts of nr_banks and nr_errors Correct the counts of nr_banks and nr_errors Signed-off-by: Ce Sun Reviewed-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 8ed5f8d9fe59cc1b1ac267182c3ce7d2210855f4 Author: Liao Yuanhong Date: Tue Aug 19 22:24:50 2025 +0800 drm/amd/display: Remove redundant header files The header file "dc_stream.h" is already included on line 1507. Remove the redundant include. This is because the header file was initially included towards the latter part of the code. Subsequent commits had to include the header file again earlier in the code. In my opinion, this doesn't count as a fix; it just requires removing the redundant header inclusion. Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit ee6ba1e69dd7d969ab36f16d81c930b1a7fbf61c Author: Liao Yuanhong Date: Tue Aug 19 16:25:21 2025 +0800 drm/amdgpu/fence: Remove redundant 0 value initialization The amdgpu_fence struct is already zeroed by kzalloc(). It's redundant to initialize am_fence->context to 0. Reviewed-by: Christian König Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 22dcb283d63d5677a5875d0002d04d2c61720f78 Author: Hawking Zhang Date: Tue Aug 19 16:21:02 2025 +0800 drm/amdgpu: Allocate psp fw private buffer in vram It's not necessarily to allocate psp firmware private buffer in different memory domain in sriov and bare metal environment Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher commit 7b9110f2897957efd9715b52fc01986509729db3 Author: Alex Deucher Date: Tue Jun 24 11:38:14 2025 -0400 drm/amdgpu/gfx12: set MQD as appriopriate for queue types Set the MQD as appropriate for the kernel vs user queues. Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 063d6683208722b1875f888a45084e3d112701ac Author: Alex Deucher Date: Tue Jun 24 11:37:16 2025 -0400 drm/amdgpu/gfx11: set MQD as appriopriate for queue types Set the MQD as appropriate for the kernel vs user queues. Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 Author: Sneh Mankad Date: Mon Aug 25 11:53:50 2025 +0530 soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a transaction completes. Previously this bit was only cleared when a wake TCS was borrowed as an AMC TCS but not for dedicated AMC TCS. Leaving this bit set for AMC TCS and entering deeper low power modes can generate a false completion IRQ. Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER bit upon receiving a completion IRQ. Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") Signed-off-by: Sneh Mankad Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4c0b26e23c79ecf934a92b2d9a516bffbb61c3e4 Author: Jens Axboe Date: Fri Aug 22 08:19:56 2025 -0600 io_uring: add async data clear/free helpers Futex recently had an issue where it mishandled how ->async_data and REQ_F_ASYNC_DATA is handled. To avoid future issues like that, add a set of helpers that either clear or clear-and-free the async data assigned to a struct io_kiocb. Convert existing manual handling of that to use the helpers. No intended functional changes in this patch. Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit c986f7586b8d3381ab0ce764136c3b951c618381 Author: Jens Axboe Date: Thu Aug 7 14:25:50 2025 -0600 io_uring/zcrx: add support for IORING_SETUP_CQE_MIXED zcrx currently requires the ring to be set up with fixed 32b CQEs, allow it to use IORING_SETUP_CQE_MIXED as well. Signed-off-by: Jens Axboe commit 1e81bf1414127bfeab0a0bcd9f39f42ccb96b6b9 Author: Jens Axboe Date: Thu Aug 7 14:24:18 2025 -0600 io_uring/uring_cmd: add support for IORING_SETUP_CQE_MIXED Certain users of uring_cmd currently require fixed 32b CQE support, which is propagated through IO_URING_F_CQE32. Allow IORING_SETUP_CQE_MIXED to cover that case as well, so not all CQEs posted need to be 32b in size. Signed-off-by: Jens Axboe commit 806ecb209aa86fcc1d92bc9f10323cf773f64d6d Author: Jens Axboe Date: Thu Aug 7 14:22:16 2025 -0600 io_uring/nop: add support for IORING_SETUP_CQE_MIXED This adds support for setting IORING_NOP_CQE32 as a flag for a NOP command, in which case a 32b CQE will be posted rather than a regular one. This is the default if the ring has been setup with IORING_SETUP_CQE32. If the ring has been setup with IORING_SETUP_CQE_MIXED, then 16b CQEs will be posted without this flag set, and 32b CQEs if this flag is set. For the latter case, sqe->off is what will be posted as cqe->big_cqe[0] and sqe->addr is what will be posted as cqe->big_cqe[1]. Signed-off-by: Jens Axboe commit e26dca67fde194340582cfbb0c0bf661825e9e46 Author: Jens Axboe Date: Thu Aug 7 14:14:41 2025 -0600 io_uring: add support for IORING_SETUP_CQE_MIXED Normal rings support 16b CQEs for posting completions, while certain features require the ring to be configured with IORING_SETUP_CQE32, as they need to convey more information per completion. This, in turn, makes ALL the CQEs be 32b in size. This is somewhat wasteful and inefficient, particularly when only certain CQEs need to be of the bigger variant. This adds support for setting up a ring with mixed CQE sizes, using IORING_SETUP_CQE_MIXED. When setup in this mode, CQEs posted to the ring may be either 16b or 32b in size. If a CQE is 32b in size, then IORING_CQE_F_32 is set in the CQE flags to indicate that this is the case. If this flag isn't set, the CQE is the normal 16b variant. CQEs on these types of mixed rings may also have IORING_CQE_F_SKIP set. This can happen if the ring is one (small) CQE entry away from wrapping, and an attempt is made to post a 32b CQE. As CQEs must be contigious in the CQ ring, a 32b CQE cannot wrap the ring. For this case, a single dummy CQE is posted with the SKIP flag set. The application should simply ignore those. Signed-off-by: Jens Axboe commit 3b0dec689a6301845761681b852f9538cb75a1d2 Author: Michal Koutný Date: Wed Aug 27 17:53:00 2025 +0200 selftests: cgroup: Make test_pids backwards compatible The predicates in test expect event counting from 73e75e6fc352b ("cgroup/pids: Separate semantics of pids.events related to pids.max") and the test would fail on older kernels. We want to have one version of tests for all, so detect the feature and skip the test on old kernels. (The test could even switch to check v1 semantics based on the flag but keep it simple for now.) Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller") Signed-off-by: Michal Koutný Tested-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 767b1ed8b980498978c77dc89497602ae3421af5 Author: Morduan Zang Date: Thu Aug 14 19:03:58 2025 +0800 vfio/nvgrace-gpu: fix grammatical error The word "as" in the comment should be replaced with "is", and there is an extra space in the comment. Signed-off-by: Morduan Zang Reviewed-by: Ankit Agrawal Link: https://lore.kernel.org/r/54E1ED6C5A2682C8+20250814110358.285412-1-zhangdandan@uniontech.com Signed-off-by: Alex Williamson commit 473c3af395c904ad5e10897bf482a92c4f3f3650 Author: Xichao Zhao Date: Mon Aug 18 16:52:01 2025 +0800 vfio/pci: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250818085201.510206-1-zhao.xichao@vivo.com Signed-off-by: Alex Williamson commit 1b1d9ca13475cbedf25727ae4b4ead684ae85c03 Author: Alex Williamson Date: Wed Aug 6 11:03:11 2025 -0600 vfio/fsl-mc: Mark for removal The driver has been orphaned for more than a year, mark it for removal. Reviewed-by: Kevin Tian Reviewed-by: Cédric Le Goater Reviewed-by: Jason Gunthorpe Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20250806170314.3768750-2-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit 5012bd2dc6ab0c4499923b3b6c6113def9b0c88b Author: Eric Biggers Date: Fri Aug 15 19:04:57 2025 -0700 lib/crypto: Drop inline from all *_mod_init_arch() functions Drop 'inline' from all the *_mod_init_arch() functions so that the compiler will warn about any bugs where they are unused due to not being wired up properly. (There are no such bugs currently, so this just establishes a more robust convention for the future. Of course, these functions also tend to get inlined anyway, regardless of the keyword.) Link: https://lore.kernel.org/r/20250816020457.432040-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d6b6aac0cdb4b4f81cccc531ed76211d56c17444 Author: Eric Biggers Date: Tue Aug 5 15:28:55 2025 -0700 lib/crypto: tests: Add KUnit tests for MD5 and HMAC-MD5 Add a KUnit test suite for the MD5 library functions, including the corresponding HMAC support. The core test logic is in the previously-added hash-test-template.h. This commit just adds the actual KUnit suite, and it adds the generated test vectors to the tree so that gen-hash-testvecs.py won't have to be run at build time. Link: https://lore.kernel.org/r/20250805222855.10362-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 45df22935bdc6bbddf87f38a57ae7257244cf3cf Author: Krishna Chaitanya Chundru Date: Tue Aug 26 16:32:55 2025 +0530 PCI: qcom: Restrict port parsing only to PCIe bridge child nodes The qcom_pcie_parse_ports() function currently iterates over all available child nodes of the PCIe controller's device tree node. This includes unrelated nodes such as OPP (Operating Performance Points) nodes, which do not contain the expected 'reset' and 'phy' properties. As a result, parsing fails and the driver falls back to the legacy method of parsing the controller node directly. However, this fallback also fails when properties are shifted to the Root Port node, leading to probe failure. Fix this by restricting the parsing logic to only consider child nodes with device_type = "pci", which is the expected and required property for PCIe bridge nodes as per the pci-bus-common.yaml dtschema. Fixes: a2fbecdbbb9d ("PCI: qcom: Add support for parsing the new Root Port binding") Signed-off-by: Krishna Chaitanya Chundru [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250826-pakala-v3-3-721627bd5bb0@oss.qualcomm.com commit 6dd0ca9f2dfaab1bd15895bab16e5496632e53b6 Author: Krishna Chaitanya Chundru Date: Tue Aug 26 16:32:53 2025 +0530 dt-bindings: PCI: qcom,pcie-sm8550: Add SM8750 compatible PCIe controller present in SM8750 SoC is backwards compatible with the controller present in SM8550 SoC. Hence, add the compatible with SM8550 fallback. Signed-off-by: Krishna Chaitanya Chundru [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250826-pakala-v3-1-721627bd5bb0@oss.qualcomm.com commit ffdd27d36265be108827c606c9fbe81a5947547e Author: Qianfeng Rong Date: Tue Aug 19 21:12:33 2025 +0800 PCI: keystone: Use kcalloc() instead of kzalloc() Replace calls of devm_kzalloc() with devm_kcalloc() in ks_pcie_probe(). As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Using devm_kcalloc() provides built-in overflow protection, making the memory allocation safer when calculating the allocation size compared to explicit multiplication. [1]: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Signed-off-by: Qianfeng Rong Signed-off-by: Manivannan Sadhasivam Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250819131235.152967-1-rongqianfeng@vivo.com commit 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 Author: Xin Wang Date: Tue Aug 26 17:06:33 2025 -0700 drm/xe: Ensure GT is in C0 during resumes This patch ensures the gt will be awake for the entire duration of the resume sequences until GuCRC takes over and GT-C6 gets re-enabled. Before suspending GT-C6 is kept enabled, but upon resume, GuCRC is not yet alive to properly control the exits and some cases of instability and corruption related to GT-C6 can be observed. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 Suggested-by: Rodrigo Vivi Signed-off-by: Xin Wang Reviewed-by: Rodrigo Vivi Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037 Link: https://lore.kernel.org/r/20250827000633.1369890-3-x.wang@intel.com Signed-off-by: Rodrigo Vivi commit 1313351e71181a4818afeb8dfe202e4162091ef6 Author: Xin Wang Date: Tue Aug 26 17:06:32 2025 -0700 drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally Move forcewake_get() into xe_gt_idle_enable_c6() to streamline the code and make it easier to use. Suggested-by: Rodrigo Vivi Signed-off-by: Xin Wang Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250827000633.1369890-2-x.wang@intel.com Signed-off-by: Rodrigo Vivi commit 5ffa3d2f43a487f60e9f6f692aa8e22251446755 Author: Christian Bruel Date: Wed Aug 20 09:54:03 2025 +0200 dt-bindings: PCI: Add STM32MP25 PCIe Root Complex bindings Document the bindings for STM32MP25 PCIe Controller configured in root complex mode with one root port. Supports 4 INTx and MSI interrupts from the ARM GICv2m controller. STM32 PCIe may be in a power domain which is the case for the STM32MP25 based boards. Supports WAKE# from wake-gpios Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250820075411.1178729-4-christian.bruel@foss.st.com commit 08383cd479f8212fafee2f557b58cfd48818bee0 Author: Christian Bruel Date: Wed Aug 20 09:54:02 2025 +0200 pinctrl: Add pinctrl_pm_select_init_state helper function If a platform requires an initial pinctrl state during probing, this helper function provides the client with access to the same initial state. eg: xxx_suspend_noirq ... pinctrl_pm_select_sleep_state xxx resume_noirq pinctrl_pm_select_init_state ... pinctrl_pm_select_default_state Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250820075411.1178729-3-christian.bruel@foss.st.com commit 272dad3f84004079328e8f36b2292e7297460ffd Author: Christian Bruel Date: Wed Aug 20 09:54:01 2025 +0200 Documentation: pinctrl: Describe PM helper functions for standard states. Clarify documentation for predefined standard state names 'default', 'init', 'sleep', 'idle' and their associated PM API. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250820075411.1178729-2-christian.bruel@foss.st.com commit 106fc08b30a2ece49a251b053165a83d41d50fd0 Author: Christian Bruel Date: Mon Aug 4 19:09:16 2025 +0200 selftests: pci_endpoint: Skip IRQ test if IRQ is out of range. The pci_endpoint_test tests the entire MSI/MSI-X range, which generates false errors on platforms that do not support the whole range. Skip the test in such cases and report accordingly. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250804170916.3212221-4-christian.bruel@foss.st.com commit 384b1b29481e39aae8eb01240d1edf287c7a4145 Author: Christian Bruel Date: Mon Aug 4 19:09:15 2025 +0200 misc: pci_endpoint_test: Cleanup extra 0 initialization Initialization is not needed as memory is already set to 0 by devm_kzalloc. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250804170916.3212221-3-christian.bruel@foss.st.com commit cc8e391067164f45f89b6132a5aaa18c33a0e32b Author: Christian Bruel Date: Mon Aug 4 19:09:14 2025 +0200 misc: pci_endpoint_test: Skip IRQ tests if irq is out of range The pci_endpoint_test tests the 32-bit MSI range. However, the device might not have all vectors configured. For example, if msi_interrupts is 8 in the ep function space or if the MSI Multiple Message Capable value is configured as 4 (maximum 16 vectors). In this case, do not attempt to run the test to avoid timeouts and directly return the error value. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250804170916.3212221-2-christian.bruel@foss.st.com commit 1e00a12dbb09a7cf173ed60fdbdc33f79a6fff7f Author: Raphael Gallais-Pou Date: Mon Aug 25 15:29:51 2025 +0200 drm/stm: ltdc: unify log system DRM_ERROR and similar are deprecated. Use drm_dev based logging. Link: https://lore.kernel.org/r/20250821130356.883553-1-raphael.gallais-pou@foss.st.com Acked-by: Yannick Fertre Link: https://lore.kernel.org/r/20250825132951.547899-1-raphael.gallais-pou@foss.st.com Signed-off-by: Raphael Gallais-Pou commit f315e030a202012a551eb648fa10cd90bd925b20 Author: Raphael Gallais-Pou Date: Tue Aug 26 13:54:27 2025 +0200 dt-bindings: panel: lvds: Append ampire,amp19201200b5tzqw-t03 in panel-lvds List Ampire AMP19201200B5TZQW-T03 in the LVDS panel enumeration. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250826-drm-misc-next-v1-1-980d0a0592b9@foss.st.com Signed-off-by: Raphael Gallais-Pou commit 4edc575c5582550d0905f39c5e27f1f1f925fffa Author: Krzysztof Kozlowski Date: Mon Aug 18 16:21:39 2025 +0200 dt-bindings: PCI: Correct example indentation DTS example in the bindings should be indented with 2- or 4-spaces, so correct a mixture of different styles to keep consistent 4-spaces. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250818142138.129327-2-krzysztof.kozlowski@linaro.org commit 3ca1b311181072415b6432a169de765ac2034e5a Author: Miklos Szeredi Date: Tue Aug 19 16:44:02 2025 +0200 fuse: zero initialize inode private data This is slightly tricky, since the VFS uses non-zeroing allocation to preserve some fields that are left in a consistent state. Reported-by: Chunsheng Luo Closes: https://lore.kernel.org/all/20250818083224.229-1-luochunsheng@ustc.edu/ Signed-off-by: Miklos Szeredi commit 8c14f2086b94818e4a30e82c810443604f2f5a2b Author: Chunsheng Luo Date: Wed Jul 30 21:06:03 2025 +0800 fuse: remove unused 'inode' parameter in fuse_passthrough_open The 'inode' parameter in fuse_passthrough_open() is never referenced in the function implementation. Signed-off-by: Chunsheng Luo Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 7dbe6442487743ad492d9143f1f404c1f4a05e0e Author: Li RongQing Date: Thu Jul 3 14:47:38 2025 +0800 virtio_fs: fix the hash table using in virtio_fs_enqueue_req() The original commit be2ff42c5d6e ("fuse: Use hash table to link processing request") converted fuse_pqueue->processing to a hash table, but virtio_fs_enqueue_req() was not updated to use it correctly. So use fuse_pqueue->processing as a hash table, this make the code more coherent Co-developed-by: Fushuai Wang Signed-off-by: Fushuai Wang Signed-off-by: Li RongQing Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 2841808f35eebfd07150333f3af3007cb2904a09 Author: Joanne Koong Date: Mon Jul 7 16:46:06 2025 -0700 mm: remove BDI_CAP_WRITEBACK_ACCT There are no users of BDI_CAP_WRITEBACK_ACCT now that fuse doesn't do its own writeback accounting. This commit removes BDI_CAP_WRITEBACK_ACCT. Signed-off-by: Joanne Koong Acked-by: David Hildenbrand Signed-off-by: Miklos Szeredi commit 494d2f508883a6e5c4530e5c6b3c8b2bbfb7318d Author: Joanne Koong Date: Mon Jul 7 16:46:05 2025 -0700 fuse: use default writeback accounting commit 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") removed temp folios for dirty page writeback. Consequently, fuse can now use the default writeback accounting. With switching fuse to use default writeback accounting, there are some added benefits. This updates wb->writeback_inodes tracking as well now and updates writeback throughput estimates after writeback completion. This commit also removes inc_wb_stat() and dec_wb_stat(). These have no callers anymore now that fuse does not call them. Signed-off-by: Joanne Koong Reviewed-by: David Hildenbrand Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit b4da63cea158f050865220a05ab691cfe8fb6450 Author: Li RongQing Date: Sun Jun 15 21:20:39 2025 +0800 virtio_fs: Remove redundant spinlock in virtio_fs_request_complete() Since clear_bit is an atomic operation, the spinlock is redundant and can be removed, reducing lock contention is good for performance. Signed-off-by: Li RongQing Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 6fd26f50857698c6f07a9e6b149247925fadb8fd Author: Joanne Koong Date: Tue May 20 13:16:54 2025 -0700 fuse: remove unneeded offset assignment when filling write pages With the change in aee03ea7ff98 ("fuse: support large folios for writethrough writes"), this old line for setting ap->descs[0].offset is now obsolete and unneeded. This should have been removed as part of aee03ea7ff98. Signed-off-by: Joanne Koong Fixes: aee03ea7ff98 ("fuse: support large folios for writethrough writes") Signed-off-by: Miklos Szeredi commit 14cbb72d7595f3a962a7b206f75a32b1bd9fa335 Author: Sergey Senozhatsky Date: Tue Jun 10 13:52:29 2025 +0900 fuse: use freezable wait in fuse_get_req() Use freezable wait in fuse_get_req() so that it won't block the system from entering suspend: Freezing user space processes failed after 20.009 seconds Call trace: __switch_to+0xcc/0x168 schedule+0x57c/0x1138 fuse_get_req+0xd0/0x2b0 fuse_simple_request+0x120/0x620 fuse_getxattr+0xe4/0x158 fuse_xattr_get+0x2c/0x48 __vfs_getxattr+0x160/0x1d8 get_vfs_caps_from_disk+0x74/0x1a8 __audit_inode+0x244/0x4d8 user_path_at_empty+0x2e0/0x390 __arm64_sys_faccessat+0xdc/0x260 Signed-off-by: Sergey Senozhatsky Signed-off-by: Miklos Szeredi commit dd6a5a71c811289eec234e78cb9ca34d055d2ad5 Author: Sergey Senozhatsky Date: Tue Jun 10 13:52:28 2025 +0900 sched/wait: Add wait_event_state_exclusive() Allows exclusive waits with a custom @state. Signed-off-by: Sergey Senozhatsky Acked-by: Peter Zijlstra (Intel) Signed-off-by: Miklos Szeredi commit 6be0ddb20200c0e45c1e7db4b817fccd04d53f2d Author: Bagas Sanjaya Date: Thu Jun 12 10:22:39 2025 +0700 Documentation: fuse: Consolidate FUSE docs into its own subdirectory All four FUSE docs are currently in upper-level Documentation/filesystems/ directory, but these are distinct as a group of its own. Move them into Documentation/filesystems/fuse/ subdirectory. Signed-off-by: Bagas Sanjaya Acked-by: Jeff Layton Signed-off-by: Miklos Szeredi commit 1a7b13781b0d48312e0ead2585776b0afd1343cd Author: Chen Linxuan Date: Tue Jun 10 10:10:03 2025 +0800 selftests: filesystems: Add functional test for the abort file in fusectl This patch add a simple functional test for the "abort" file in fusectlfs (/sys/fs/fuse/connections/ID/abort). A simple fuse daemon is added for testing. Related discussion can be found in the link below. Link: https://lore.kernel.org/all/CAOQ4uxjKFXOKQxPpxtS6G_nR0tpw95w0GiO68UcWg_OBhmSY=Q@mail.gmail.com/ Signed-off-by: Chen Linxuan Acked-by: Shuah Khan Reviewed-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit e49a6828aba42bfbd4702e0a06aaae6a67f27285 Author: Chen Linxuan Date: Tue Jun 10 10:11:25 2025 +0800 doc: fuse: Add max_background and congestion_threshold As I preparing patches adding selftests for fusectl, I notice that documentation of max_background and congestion_threshold is missing. This patch add some descriptions about these two files. Cc: Amir Goldstein Signed-off-by: Chen Linxuan Signed-off-by: Miklos Szeredi commit 7a37f55af7af868119b4fb69285f5fa03ba8cf35 Author: Miklos Szeredi Date: Tue Aug 5 17:10:56 2025 +0200 fuse: add COPY_FILE_RANGE_64 that allows large copies The FUSE protocol uses struct fuse_write_out to convey the return value of copy_file_range, which is restricted to uint32_t. But the COPY_FILE_RANGE interface supports a 64-bit size copies and there's no reason why copies should be limited to 32-bit. Introduce a new op COPY_FILE_RANGE_64, which is identical, except the number of bytes copied is returned in a 64-bit value. If the fuse server does not support COPY_FILE_RANGE_64, fall back to COPY_FILE_RANGE. Reported-by: Florian Weimer Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/ Signed-off-by: Miklos Szeredi commit 27a7e8b6c58144c8c8bd49765364c93f756abc33 Author: Thomas Zimmermann Date: Tue Aug 26 16:50:25 2025 +0200 drm/sysfb: Do not deref unexisting CRTC state in atomic_disable Do not access CRTC state in drm_sysfb_plane_helper_atomic_disable(). Use format from sysfb device for clearing scanout buffer. This is the behavior from before commit 061963cd9e5b ("drm/sysfb: Blit to CRTC destination format"). When being disabled, the plane has no associated CRTC. Trying to deref the format pointer results in a segmentation fault. An example stack track is shown below. [ 58.948915] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000023: 0000 [#1] SMP KASAN PTI [ 58.959971] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] [...] [ 58.979308] RIP: 0010:drm_sysfb_plane_helper_atomic_disable+0x1af/0x520 [...] [ 59.084227] Call Trace: [ 59.086682] [ 59.088793] ? __pfx_drm_sysfb_plane_helper_atomic_disable+0x10/0x10 [ 59.095155] ? crtc_disable+0xf2/0x5a0 [ 59.098920] drm_atomic_helper_commit_planes+0x848/0x1030 [ 59.104336] drm_atomic_helper_commit_tail+0x41/0xb0 [ 59.109316] commit_tail+0x204/0x330 [ 59.112903] drm_atomic_helper_commit+0x242/0x2e0 [ 59.117618] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 59.122851] drm_atomic_commit+0x1e1/0x290 [ 59.126957] ? drm_atomic_add_affected_connectors+0x266/0x330 [ 59.132714] ? __pfx_drm_atomic_commit+0x10/0x10 [ 59.137343] ? __pfx___drm_printfn_info+0x10/0x10 [ 59.142058] ? drm_atomic_set_crtc_for_connector+0x436/0x630 [ 59.147729] atomic_remove_fb+0x631/0x920 [ 59.151751] ? save_trace+0xcf/0x180 [ 59.155343] ? __pfx_atomic_remove_fb+0x10/0x10 [ 59.159890] ? __pfx___drm_dev_dbg+0x10/0x10 [ 59.164173] drm_framebuffer_remove+0x19a/0x710 Signed-off-by: Thomas Zimmermann Fixes: 061963cd9e5b ("drm/sysfb: Blit to CRTC destination format") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14874 Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: dri-devel@lists.freedesktop.org Reviewed-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250826145044.954396-1-tzimmermann@suse.de commit c2ef7a03f5c8f0a612a8beff666483b725adf8fc Author: Claudiu Beznea Date: Wed Aug 27 13:12:36 2025 +0300 mmc: sdio: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250827101236.927313-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Ulf Hansson commit bc986b1d756482a5ec2d7d9625229d9b9df95ae1 Author: Josef Bacik Date: Thu Aug 21 16:18:21 2025 -0400 fs: stop accessing ->i_count directly in f2fs and gfs2 Instead of accessing ->i_count directly in these file systems, use the appropriate __iget and iput helpers. Signed-off-by: Josef Bacik Link: https://lore.kernel.org/b8e6eb8a3e690ce082828d3580415bf70dfa93aa.1755806649.git.josef@toxicpanda.com Signed-off-by: Christian Brauner commit a6ad54137af92535cfe32e19e5f3bc1bb7dbd383 Merge: 0dc4a751507177 42188667be3878 Author: Paolo Bonzini Date: Wed Aug 27 04:37:40 2025 -0400 Merge branch 'guest-memfd-mmap' into HEAD Add support for host userspace mapping of guest_memfd-backed memory for VM types that do NOT use support KVM_MEMORY_ATTRIBUTE_PRIVATE (which isn't precisely the same thing as CoCo VMs, since x86's SEV-MEM and SEV-ES have no way to detect private vs. shared). mmap() support paves the way for several evolving KVM use cases: * Allows VMMs like Firecracker to run guests entirely backed by guest_memfd [1]. This provides a unified memory management model for both confidential and non-confidential guests, simplifying VMM design. * Enhanced Security via direct map removal: When combined with Patrick's series for direct map removal [2], this provides additional hardening against Spectre-like transient execution attacks by eliminating the need for host kernel direct maps of guest memory. * Lays the groundwork for *restricted* mmap() support for guest_memfd-backed memory on CoCo platforms [3] that permit in-place sharing of guest memory with the host. Signed-off-by: Paolo Bonzini commit 42188667be387867d2bf763d028654cbad046f7b Author: Sean Christopherson Date: Tue Jul 29 15:54:55 2025 -0700 KVM: selftests: Add guest_memfd testcase to fault-in on !mmap()'d memory Add a guest_memfd testcase to verify that a vCPU can fault-in guest_memfd memory that supports mmap(), but that is not currently mapped into host userspace and/or has a userspace address (in the memslot) that points at something other than the target guest_memfd range. Mapping guest_memfd memory into the guest is supposed to operate completely independently from any userspace mappings. Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-25-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a11d7124b4dd4d78bb7f7257abdb33cb5dd924b8 Author: Fuad Tabba Date: Tue Jul 29 15:54:54 2025 -0700 KVM: selftests: guest_memfd mmap() test when mmap is supported Expand the guest_memfd selftests to comprehensively test host userspace mmap functionality for guest_memfd-backed memory when supported by the VM type. Introduce new test cases to verify the following: * Successful mmap operations: Ensure that MAP_SHARED mappings succeed when guest_memfd mmap is enabled. * Data integrity: Validate that data written to the mmap'd region is correctly persistent and readable. * fallocate interaction: Test that fallocate(FALLOC_FL_PUNCH_HOLE) correctly zeros out mapped pages. * Out-of-bounds access: Verify that accessing memory beyond the guest_memfd's size correctly triggers a SIGBUS signal. * Unsupported mmap: Confirm that mmap attempts fail as expected when guest_memfd mmap support is not enabled for the specific guest_memfd instance or VM type. * Flag validity: Introduce test_vm_type_gmem_flag_validity() to systematically test that only allowed guest_memfd creation flags are accepted for different VM types (e.g., GUEST_MEMFD_FLAG_MMAP for default VMs, no flags for CoCo VMs). The existing tests for guest_memfd creation (multiple instances, invalid sizes), file read/write, file size, and invalid punch hole operations are integrated into the new test_with_type() framework to allow testing across different VM types. Cc: James Houghton Cc: Gavin Shan Cc: Shivank Garg Co-developed-by: Ackerley Tng Signed-off-by: Ackerley Tng Signed-off-by: Fuad Tabba Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-24-seanjc@google.com> [Fix default vm_types to use BIT() - Paolo] Signed-off-by: Paolo Bonzini commit 692f6ecf387aff1596ea1d86be7d333a474b7d56 Author: Fuad Tabba Date: Tue Jul 29 15:54:53 2025 -0700 KVM: selftests: Do not use hardcoded page sizes in guest_memfd test Update the guest_memfd_test selftest to use getpagesize() instead of hardcoded 4KB page size values. Using hardcoded page sizes can cause test failures on architectures or systems configured with larger page sizes, such as arm64 with 64KB pages. By dynamically querying the system's page size, the test becomes more portable and robust across different environments. Additionally, build the guest_memfd_test selftest for arm64. Reviewed-by: David Hildenbrand Reviewed-by: Shivank Garg Reviewed-by: Gavin Shan Suggested-by: Gavin Shan Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-23-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3d3a04fad25a6621828518a2abe536142d2c1a7d Author: Fuad Tabba Date: Tue Jul 29 15:54:52 2025 -0700 KVM: Allow and advertise support for host mmap() on guest_memfd files Now that all the x86 and arm64 plumbing for mmap() on guest_memfd is in place, allow userspace to set GUEST_MEMFD_FLAG_MMAP and advertise support via a new capability, KVM_CAP_GUEST_MEMFD_MMAP. The availability of this capability is determined per architecture, and its enablement for a specific guest_memfd instance is controlled by the GUEST_MEMFD_FLAG_MMAP flag at creation time. Update the KVM API documentation to detail the KVM_CAP_GUEST_MEMFD_MMAP capability, the associated GUEST_MEMFD_FLAG_MMAP, and provide essential information regarding support for mmap in guest_memfd. Reviewed-by: David Hildenbrand Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Xiaoyao Li Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-22-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 32e200bd6e4407c31aef0392be041274bfa3f20e Author: Fuad Tabba Date: Tue Jul 29 15:54:51 2025 -0700 KVM: arm64: Enable support for guest_memfd backed memory Now that the infrastructure is in place, enable guest_memfd for arm64. * Select CONFIG_KVM_GUEST_MEMFD in KVM/arm64 Kconfig. * Enforce KVM_MEMSLOT_GMEM_ONLY for guest_memfd on arm64: Ensure that guest_memfd-backed memory slots on arm64 are only supported if they are intended for shared memory use cases (i.e., kvm_memslot_is_gmem_only() is true). This design reflects the current arm64 KVM ecosystem where guest_memfd is primarily being introduced for VMs that support shared memory. Reviewed-by: James Houghton Reviewed-by: Gavin Shan Reviewed-by: Marc Zyngier Acked-by: David Hildenbrand Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-21-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f4e740309ee255a52a60bbc044647a11429250fc Author: Fuad Tabba Date: Tue Jul 29 15:54:50 2025 -0700 KVM: arm64: nv: Handle VNCR_EL2-triggered faults backed by guest_memfd Handle faults for memslots backed by guest_memfd in arm64 nested virtualization triggered by VNCR_EL2. * Introduce is_gmem output parameter to kvm_translate_vncr(), indicating whether the faulted memory slot is backed by guest_memfd. * Dispatch faults backed by guest_memfd to kvm_gmem_get_pfn(). * Update kvm_handle_vncr_abort() to handle potential guest_memfd errors. Some of the guest_memfd errors need to be handled by userspace instead of attempting to (implicitly) retry by returning to the guest. Suggested-by: Marc Zyngier Reviewed-by: Marc Zyngier Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-20-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a7b57e0995927cc5fb8629594e2abf2a6f1000e9 Author: Fuad Tabba Date: Tue Jul 29 15:54:49 2025 -0700 KVM: arm64: Handle guest_memfd-backed guest page faults Add arm64 architecture support for handling guest page faults on memory slots backed by guest_memfd. This change introduces a new function, gmem_abort(), which encapsulates the fault handling logic specific to guest_memfd-backed memory. The kvm_handle_guest_abort() entry point is updated to dispatch to gmem_abort() when a fault occurs on a guest_memfd-backed memory slot (as determined by kvm_slot_has_gmem()). Until guest_memfd gains support for huge pages, the fault granule for these memory regions is restricted to PAGE_SIZE. Reviewed-by: Gavin Shan Reviewed-by: James Houghton Reviewed-by: Marc Zyngier Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-19-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 638ea79669f8a231c248cf9a13ea12e5dce745bf Author: Fuad Tabba Date: Tue Jul 29 15:54:48 2025 -0700 KVM: arm64: Refactor user_mem_abort() Refactor user_mem_abort() to improve code clarity and simplify assumptions within the function. Key changes include: * Immediately set force_pte to true at the beginning of the function if logging_active is true. This simplifies the flow and makes the condition for forcing a PTE more explicit. * Remove the misleading comment stating that logging_active is guaranteed to never be true for VM_PFNMAP memslots, as this assertion is not entirely correct. * Extract reusable code blocks into new helper functions: * prepare_mmu_memcache(): Encapsulates the logic for preparing and topping up the MMU page cache. * adjust_nested_fault_perms(): Isolates the adjustments to shadow S2 permissions and the encoding of nested translation levels. * Update min(a, (long)b) to min_t(long, a, b) for better type safety and consistency. * Perform other minor tidying up of the code. These changes primarily aim to simplify user_mem_abort() and make its logic easier to understand and maintain, setting the stage for future modifications. Reviewed-by: Gavin Shan Reviewed-by: Marc Zyngier Reviewed-by: Tao Chan Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-18-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f029f04ddbec650d9830dbd5dc8c8998d1eef81e Author: Ackerley Tng Date: Tue Jul 29 15:54:47 2025 -0700 KVM: x86/mmu: Handle guest page faults for guest_memfd with shared memory Update the KVM MMU fault handler to service guest page faults for memory slots backed by guest_memfd with mmap support. For such slots, the MMU must always fault in pages directly from guest_memfd, bypassing the host's userspace_addr. This ensures that guest_memfd-backed memory is always handled through the guest_memfd specific faulting path, regardless of whether it's for private or non-private (shared) use cases. Additionally, rename kvm_mmu_faultin_pfn_private() to kvm_mmu_faultin_pfn_gmem(), as this function is now used to fault in pages from guest_memfd for both private and non-private memory, accommodating the new use cases. Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Signed-off-by: Ackerley Tng Co-developed-by: Fuad Tabba Signed-off-by: Fuad Tabba [sean: drop the helper] Signed-off-by: Sean Christopherson Reviewed-by: Xiaoyao Li Message-ID: <20250729225455.670324-17-seanjc@google.com> Signed-off-by: Paolo Bonzini commit b7d97f69edd488b9755ba2858fe7f33e24566500 Author: Sean Christopherson Date: Tue Jul 29 15:54:46 2025 -0700 KVM: x86/mmu: Extend guest_memfd's max mapping level to shared mappings Rework kvm_mmu_max_mapping_level() to consult guest_memfd for all mappings, not just private mappings, so that hugepage support plays nice with the upcoming support for backing non-private memory with guest_memfd. In addition to getting the max order from guest_memfd for gmem-only memslots, update TDX's hook to effectively ignore shared mappings, as TDX's restrictions on page size only apply to Secure EPT mappings. Do nothing for SNP, as RMP restrictions apply to both private and shared memory. Suggested-by: Ackerley Tng Signed-off-by: Sean Christopherson Reviewed-by: David Hildenbrand Reviewed-by: Fuad Tabba Reviewed-by: Xiaoyao Li Message-ID: <20250729225455.670324-16-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a3522ac71f5e1c1a9bacee46663d6e83efb9c325 Author: Sean Christopherson Date: Tue Jul 29 15:54:45 2025 -0700 KVM: x86/mmu: Enforce guest_memfd's max order when recovering hugepages Rework kvm_mmu_max_mapping_level() to provide the plumbing to consult guest_memfd (and relevant vendor code) when recovering hugepages, e.g. after disabling live migration. The flaw has existed since guest_memfd was originally added, but has gone unnoticed due to lack of guest_memfd support for hugepages or dirty logging. Don't actually call into guest_memfd at this time, as it's unclear as to what the API should be. Ideally, KVM would simply use kvm_gmem_get_pfn(), but invoking kvm_gmem_get_pfn() would lead to sleeping in atomic context if guest_memfd needed to allocate memory (mmu_lock is held). Luckily, the path isn't actually reachable, so just add a TODO and WARN to ensure the functionality is added alongisde guest_memfd hugepage support, and punt the guest_memfd API design question to the future. Note, calling kvm_mem_is_private() in the non-fault path is safe, so long as mmu_lock is held, as hugepage recovery operates on shadow-present SPTEs, i.e. calling kvm_mmu_max_mapping_level() with @fault=NULL is mutually exclusive with kvm_vm_set_mem_attributes() changing the PRIVATE attribute of the gfn. Signed-off-by: Sean Christopherson Reviewed-by: David Hildenbrand Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-15-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1c3fdf13703ba6bb006671db72b7a02d2bd58b8b Author: Sean Christopherson Date: Tue Jul 29 15:54:44 2025 -0700 KVM: x86/mmu: Hoist guest_memfd max level/order helpers "up" in mmu.c Move kvm_max_level_for_order() and kvm_max_private_mapping_level() up in mmu.c so that they can be used by __kvm_mmu_max_mapping_level(). Opportunistically drop the "inline" from kvm_max_level_for_order(). No functional change intended. Reviewed-by: Xiaoyao Li Reviewed-by: Ackerley Tng Signed-off-by: Sean Christopherson Reviewed-by: David Hildenbrand Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-14-seanjc@google.com> Signed-off-by: Paolo Bonzini commit d6c840adfebca55d4520244c77467bd16b4ea41e Author: Ackerley Tng Date: Tue Jul 29 15:54:43 2025 -0700 KVM: x86/mmu: Rename .private_max_mapping_level() to .gmem_max_mapping_level() Rename kvm_x86_ops.private_max_mapping_level() to .gmem_max_mapping_level() in anticipation of extending guest_memfd support to non-private memory. No functional change intended. Reviewed-by: Xiaoyao Li Acked-by: David Hildenbrand Signed-off-by: Ackerley Tng Signed-off-by: Fuad Tabba Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-13-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 576d035e2aef52f8d8d3ce29af556d4c6bd2e0fe Author: Fuad Tabba Date: Tue Jul 29 15:54:42 2025 -0700 KVM: guest_memfd: Track guest_memfd mmap support in memslot Add a new internal flag, KVM_MEMSLOT_GMEM_ONLY, to the top half of memslot->flags (which makes it strictly for KVM's internal use). This flag tracks when a guest_memfd-backed memory slot supports host userspace mmap operations, which implies that all memory, not just private memory for CoCo VMs, is consumed through guest_memfd: "gmem only". This optimization avoids repeatedly checking the underlying guest_memfd file for mmap support, which would otherwise require taking and releasing a reference on the file for each check. By caching this information directly in the memslot, we reduce overhead and simplify the logic involved in handling guest_memfd-backed pages for host mappings. Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Xiaoyao Li Acked-by: David Hildenbrand Suggested-by: David Hildenbrand Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-12-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a12578e1477cbfb547256ed8dee6d5142a59cdcd Author: Fuad Tabba Date: Tue Jul 29 15:54:41 2025 -0700 KVM: guest_memfd: Add plumbing to host to map guest_memfd pages Introduce the core infrastructure to enable host userspace to mmap() guest_memfd-backed memory. This is needed for several evolving KVM use cases: * Non-CoCo VM backing: Allows VMMs like Firecracker to run guests entirely backed by guest_memfd, even for non-CoCo VMs [1]. This provides a unified memory management model and simplifies guest memory handling. * Direct map removal for enhanced security: This is an important step for direct map removal of guest memory [2]. By allowing host userspace to fault in guest_memfd pages directly, we can avoid maintaining host kernel direct maps of guest memory. This provides additional hardening against Spectre-like transient execution attacks by removing a potential attack surface within the kernel. * Future guest_memfd features: This also lays the groundwork for future enhancements to guest_memfd, such as supporting huge pages and enabling in-place sharing of guest memory with the host for CoCo platforms that permit it [3]. Enable the basic mmap and fault handling logic within guest_memfd, but hold off on allow userspace to actually do mmap() until the architecture support is also in place. [1] https://github.com/firecracker-microvm/firecracker/tree/feature/secret-hiding [2] https://lore.kernel.org/linux-mm/cc1bb8e9bc3e1ab637700a4d3defeec95b55060a.camel@amazon.com [3] https://lore.kernel.org/all/c1c9591d-218a-495c-957b-ba356c8f8e09@redhat.com/T/#u Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Acked-by: David Hildenbrand Co-developed-by: Ackerley Tng Signed-off-by: Ackerley Tng Signed-off-by: Fuad Tabba Reviewed-by: Xiaoyao Li Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-11-seanjc@google.com> Signed-off-by: Paolo Bonzini commit d1e54dd08f163a9021433020d16a8f8f70ddc41c Author: Fuad Tabba Date: Tue Jul 29 15:54:40 2025 -0700 KVM: x86: Enable KVM_GUEST_MEMFD for all 64-bit builds Enable KVM_GUEST_MEMFD for all KVM x86 64-bit builds, i.e. for "default" VM types when running on 64-bit KVM. This will allow using guest_memfd to back non-private memory for all VM shapes, by supporting mmap() on guest_memfd. Opportunistically clean up various conditionals that become tautologies once x86 selects KVM_GUEST_MEMFD more broadly. Specifically, because SW protected VMs, SEV, and TDX are all 64-bit only, private memory no longer needs to take explicit dependencies on KVM_GUEST_MEMFD, because it is effectively a prerequisite. Suggested-by: Sean Christopherson Signed-off-by: Fuad Tabba Reviewed-by: Xiaoyao Li Reviewed-by: David Hildenbrand Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-10-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 68d189938709a5918d7308eb922c30bcbf16ebb9 Author: Fuad Tabba Date: Tue Jul 29 15:54:39 2025 -0700 KVM: Fix comment that refers to kvm uapi header path The comment that points to the path where the user-visible memslot flags are refers to an outdated path and has a typo. Update the comment to refer to the correct path. Reviewed-by: David Hildenbrand Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Vlastimil Babka Reviewed-by: Xiaoyao Li Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-9-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 69116e01f6fee030db45d269f28f9c300b8dc9d6 Author: Fuad Tabba Date: Tue Jul 29 15:54:38 2025 -0700 KVM: Fix comments that refer to slots_lock Fix comments so that they refer to slots_lock instead of slots_locks (remove trailing s). Reviewed-by: David Hildenbrand Reviewed-by: Ira Weiny Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Vlastimil Babka Reviewed-by: Xiaoyao Li Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-8-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 923310be23b275f730e8869abc783db6296fc043 Author: Fuad Tabba Date: Tue Jul 29 15:54:37 2025 -0700 KVM: Rename kvm_slot_can_be_private() to kvm_slot_has_gmem() Rename kvm_slot_can_be_private() to kvm_slot_has_gmem() to improve clarity and accurately reflect its purpose. The function kvm_slot_can_be_private() was previously used to check if a given kvm_memory_slot is backed by guest_memfd. However, its name implied that the memory in such a slot was exclusively "private". As guest_memfd support expands to include non-private memory (e.g., shared host mappings), it's important to remove this association. The new name, kvm_slot_has_gmem(), states that the slot is backed by guest_memfd without making assumptions about the memory's privacy attributes. Reviewed-by: Ira Weiny Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Vlastimil Babka Reviewed-by: Xiaoyao Li Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-7-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 36cf63bb5df68836e55e2839f8174b404d47670b Author: Fuad Tabba Date: Tue Jul 29 15:54:36 2025 -0700 KVM: Rename CONFIG_KVM_GENERIC_PRIVATE_MEM to CONFIG_HAVE_KVM_ARCH_GMEM_POPULATE The original name was vague regarding its functionality. This Kconfig option specifically enables and gates the kvm_gmem_populate() function, which is responsible for populating a GPA range with guest data. The new name, HAVE_KVM_ARCH_GMEM_POPULATE, describes the purpose of the option: to enable arch-specific guest_memfd population mechanisms. It also follows the same pattern as the other HAVE_KVM_ARCH_* configuration options. This improves clarity for developers and ensures the name accurately reflects the functionality it controls, especially as guest_memfd support expands beyond purely "private" memory scenarios. Temporarily keep KVM_GENERIC_PRIVATE_MEM as an x86-only config so as to minimize churn, and to hopefully make it easier to see what features require HAVE_KVM_ARCH_GMEM_POPULATE. On that note, omit GMEM_POPULATE for KVM_X86_SW_PROTECTED_VM, as regular ol' memset() suffices for software-protected VMs. As for KVM_GENERIC_PRIVATE_MEM, a future change will select KVM_GUEST_MEMFD for all 64-bit KVM builds, at which point the intermediate config will become obsolete and can/will be dropped. Reviewed-by: Ira Weiny Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Vlastimil Babka Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Signed-off-by: Fuad Tabba Reviewed-by: Xiaoyao Li Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 924121eebddcc6f062d1d2d20aafebe95f6fc290 Author: Sean Christopherson Date: Tue Jul 29 15:54:35 2025 -0700 KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y Select KVM_GENERIC_PRIVATE_MEM and KVM_GENERIC_MEMORY_ATTRIBUTES directly from KVM_INTEL_TDX, i.e. if and only if TDX support is fully enabled in KVM. There is no need to enable KVM's private memory support just because the core kernel's INTEL_TDX_HOST is enabled. Reviewed-by: Xiaoyao Li Reviewed-by: David Hildenbrand Signed-off-by: Sean Christopherson Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit b4ff2efb7e780094cf02bff1735b44410d383388 Author: Sean Christopherson Date: Tue Jul 29 15:54:34 2025 -0700 KVM: x86: Select KVM_GENERIC_PRIVATE_MEM directly from KVM_SW_PROTECTED_VM Now that KVM_SW_PROTECTED_VM doesn't have a hidden dependency on KVM_X86, select KVM_GENERIC_PRIVATE_MEM from within KVM_SW_PROTECTED_VM instead of conditionally selecting it from KVM_X86. No functional change intended. Reviewed-by: Xiaoyao Li Reviewed-by: David Hildenbrand Signed-off-by: Sean Christopherson Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1d95f2d307ec384fd8851c5f189c904dd2ea831a Author: Sean Christopherson Date: Tue Jul 29 15:54:33 2025 -0700 KVM: x86: Have all vendor neutral sub-configs depend on KVM_X86, not just KVM Make all vendor neutral KVM x86 configs depend on KVM_X86, not just KVM, i.e. gate them on at least one vendor module being enabled and thus on kvm.ko actually being built. Depending on just KVM allows the user to select the configs even though they won't actually take effect, and more importantly, makes it all too easy to create unmet dependencies. E.g. KVM_GENERIC_PRIVATE_MEM can't be selected by KVM_SW_PROTECTED_VM, because the KVM_GENERIC_MMU_NOTIFIER dependency is select by KVM_X86. Hiding all sub-configs when neither KVM_AMD nor KVM_INTEL is selected also helps communicate to the user that nothing "interesting" is going on, e.g. --- Virtualization Kernel-based Virtual Machine (KVM) support < > KVM for Intel (and compatible) processors support < > KVM for AMD processors support Fixes: ea4290d77bda ("KVM: x86: leave kvm.ko out of the build if no vendor module is requested") Reviewed-by: David Hildenbrand Reviewed-by: Xiaoyao Li Signed-off-by: Sean Christopherson Reviewed-by: Fuad Tabba Message-ID: <20250729225455.670324-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 19a9a1ab5c3dce65fff4ac50700117039c23d525 Author: Fuad Tabba Date: Tue Jul 29 15:54:32 2025 -0700 KVM: Rename CONFIG_KVM_PRIVATE_MEM to CONFIG_KVM_GUEST_MEMFD Rename the Kconfig option CONFIG_KVM_PRIVATE_MEM to CONFIG_KVM_GUEST_MEMFD. The original name implied that the feature only supported "private" memory. However, CONFIG_KVM_PRIVATE_MEM enables guest_memfd in general, which is not exclusively for private memory. Subsequent patches in this series will add guest_memfd support for non-CoCo VMs, whose memory is not private. Renaming the Kconfig option to CONFIG_KVM_GUEST_MEMFD more accurately reflects its broader scope as the main Kconfig option for all guest_memfd-backed memory. This provides clearer semantics for the option and avoids confusion as new features are introduced. Reviewed-by: Ira Weiny Reviewed-by: Gavin Shan Reviewed-by: Shivank Garg Reviewed-by: Vlastimil Babka Reviewed-by: Xiaoyao Li Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Signed-off-by: Fuad Tabba Signed-off-by: Sean Christopherson Message-ID: <20250729225455.670324-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 0dc4a751507177af24a2529d57dbe4a37e45b30c Merge: 1b237f190eb3d3 dce1b33ed7430c Author: Paolo Bonzini Date: Wed Aug 27 04:18:01 2025 -0400 Merge tag 'kvm-x86-fixes-6.17-rc7' of https://github.com/kvm-x86/linux into HEAD * Use array_index_nospec() to sanitize the target vCPU ID when handling PV IPIs and yields as the ID is guest-controlled. * Drop a superfluous cpumask_empty() check when reclaiming SEV memory, as the common case, by far, is that at least one CPU will have entered the VM, and wbnoinvd_on_cpus_mask() will naturally handle the rare case where the set of have_run_cpus is empty. * Rename the is_signed_type() macro in kselftest_harness.h to is_signed_var() to fix a collision with linux/overflow.h. The collision generates compiler warnings due to the two macros having different implementations. commit d2de0f8b5a8266eec4611d6b3f580e49d9bfd46c Author: Takashi Iwai Date: Wed Aug 27 10:06:13 2025 +0200 ALSA: pcm: oss: Use guard() for spin locks Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Link: https://patch.msgid.link/20250827080618.7682-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d3fee10e40a938331e2aae34348691136db31304 Author: Claudiu Beznea Date: Sat Aug 9 17:44:47 2025 +0300 PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because the object of type struct irq_domain_info passed to: msi_create_parent_irq_domain() -> irq_domain_instantiate()() -> __irq_domain_instantiate() has no reference to the parent IRQ domain. Using msi->domain->parent as an argument for generic_handle_domain_irq() leads to below error: "Unable to handle kernel NULL pointer dereference at virtual address" This error was identified while switching the upcoming RZ/G3S PCIe host controller driver to msi_create_parent_irq_domain() (which was using a similar pattern to handle MSIs (see link section)), but it was not tested on hardware using the pcie-rcar-host controller driver due to lack of hardware. Fixes: dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()") Signed-off-by: Claudiu Beznea [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Nam Cao Link: https://lore.kernel.org/all/20250704161410.3931884-6-claudiu.beznea.uj@bp.renesas.com Link: https://patch.msgid.link/20250809144447.3939284-1-claudiu.beznea.uj@bp.renesas.com commit e0d2795ab48f6863cdf98e3a0db184b312514f1f Author: Przemek Kitszel Date: Thu Aug 21 14:03:19 2025 +0200 ice: finish virtchnl.c split into rss.c Move functions out of virt/virtchnl.c to virt/rss.c. Same "git tricks" used as for the split into virt/queues.c that is immediately preceding this split. Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 270251b946a956cee53dacc8866b4795cc5c8925 Author: Przemek Kitszel Date: Thu Aug 21 13:58:51 2025 +0200 ice: extract virt/rss.c: cleanup - p2 Remove remaining portion of the stuff that stays within virtchnl.c, (separate commits to have nicer, removal-only, history). Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 4c2ce64efd0df8bf209c7c3bcb85ae4a62c14be6 Author: Przemek Kitszel Date: Thu Aug 21 13:58:06 2025 +0200 ice: extract virt/rss.c: cleanup - p1 Start removing stuff from virt/rss.c that will be kept in the main virtchnl file. Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 587865a24f3942f311e0e6cb2667ef4ce542ea52 Merge: c762b0a537ac66 2802bb558e0859 Author: Przemek Kitszel Date: Thu Aug 21 14:45:18 2025 +0200 Merge branch 'add-virt/rss.c' into HEAD This effectively copies virtchnl.c as rss.c in a way that both files have the same history of edits. Signed-off-by: Przemek Kitszel commit 2802bb558e0859a2098d10f407a20f77ce289e4d Author: Przemek Kitszel Date: Thu Aug 21 14:40:13 2025 +0200 ice: split RSS stuff out of virtchnl.c - copy back Add copy of virtchnl.c under the original name/location. Now both virt/virtchnl.c and virt/rss.c have the same content, and only the former of the two in use. Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit f4e667eb2ab86fa4ad6f99fe931f13ec3dd827e5 Author: Przemek Kitszel Date: Thu Aug 21 13:51:17 2025 +0200 ice: split RSS stuff out of virtchnl.c - tmp rename Temporary rename of virtchnl.c into rss.c In order to split virtchnl.c in a way that makes it much easier to still blame new file, we do it via multiple git steps. Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit c762b0a537ac66b1f4ca87847030f30b7b07c055 Author: Przemek Kitszel Date: Thu Aug 21 13:18:41 2025 +0200 ice: finish virtchnl.c split into queues.c Move queue configuration functions out of virtchnl.c to queues.c. Technically the move was started by an earlier commit of the series, that was duplicating virtchnl.c as queues.c (what forces git to nicely show blame when asked), followed by a couple of cleanup commits (that removed stuff that is not moved from the new file, again - multiple commits, to avoid git saving on changes lines by reusing removed lines as a content of some kept function), with this final commit actually enabling compilation of the new file, removing stuff from the virtchnl.c, and making some moved functions visible (via static keyword removal). Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit cfee454ca1113a090b85c9834f8b6576a946fd45 Author: Przemek Kitszel Date: Thu Aug 21 11:06:53 2025 +0200 ice: extract virt/queues.c: cleanup - p3 Remove final portion of the stuff that stays within virtchnl.c, (separate commits to have nicer, removal-only, history). Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 3061d214eead8a6fb652bf69135525f394a40e52 Author: Przemek Kitszel Date: Thu Aug 21 11:06:53 2025 +0200 ice: extract virt/queues.c: cleanup - p2 Remove next piece of the content that stays in virtchnl.c, (separate commits to have nicer git history). Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit ce5c0fd759c6b55fec0e266fa28375aff440f26a Author: Przemek Kitszel Date: Thu Aug 21 11:06:21 2025 +0200 ice: extract virt/queues.c: cleanup - p1 Start removing stuff from virt/queues.c that will be kept in the main virtchnl file. Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 60bac7c798574a60a9a4359d3202f300fff46766 Merge: 5de6c855e23e99 879753f3954f9b Author: Przemek Kitszel Date: Thu Aug 21 14:32:09 2025 +0200 Merge branch 'add-virt/queues.c' into HEAD This effectively copies virtchnl.c as queues.c in a way that both files have the same history of edits. Signed-off-by: Przemek Kitszel commit 879753f3954f9b2b51367c9d6f2c4a17148b40b3 Author: Przemek Kitszel Date: Thu Aug 21 11:03:03 2025 +0200 ice: split queue stuff out of virtchnl.c - copy back Add copy of virtchnl.c under the original name/location. Now both virt/virtchnl.c and virt/queues.c have the same content, and only the former of the two is in use. Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 1948b867c1cc1d05e916fa222b9622e79aa46df6 Author: Przemek Kitszel Date: Thu Aug 21 10:57:56 2025 +0200 ice: split queue stuff out of virtchnl.c - tmp rename Temporary rename of virtchnl.c into queues.c In order to split virtchnl.c in a way that makes it much easier to still blame new file, we do it via multiple git steps. Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 61a0ef5921d603e64beef12f4a3bf7bfde409f18 Author: Jouni Högander Date: Tue Aug 26 10:44:57 2025 +0300 drm/i915/psr: Check PSR pause counter in __psr_wait_for_idle_locked PSR work is using __psr_wait_for_idle_locked to ensure PSR exit is completed before continuing to PSR activation. __psr_wait_for_idle_locked is unlocking PSR mutex which allows PSR disable/enable and PSR pause/resume while PSR idle is being wait. PSR enable status is already checked after locking again PSR mutex but PSR pause counter check is missing. Due to this PSR work may continue to PSR activation even PSR is paused. Fix this by checking PSR pause counter in __psr_wait_for_idle_locked after PSR mutex is locked again. Signed-off-by: Jouni Högander Reviewed-by: Jeevan B Link: https://lore.kernel.org/r/20250826074457.1992524-1-jouni.hogander@intel.com commit 93cf798e761036ea357cae1e1c477f2afaa4b5f1 Author: Marie Zhussupova Date: Tue Aug 26 17:13:37 2025 +0800 Documentation: kunit: Document new parameterized test features This patch updates the KUnit docs to show how to use the new parameterized test context to share resources between parameter runs. It documents and show examples of different ways the test user can pass parameter arrays to a parameterized test. Finally, it specifies the parameterized testing terminology. Link: https://lore.kernel.org/r/20250826091341.1427123-8-davidgow@google.com Reviewed-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Marie Zhussupova Signed-off-by: David Gow Signed-off-by: Shuah Khan commit f9687f351ff9ec3bd8b74fd7873d2b5940829a81 Author: Marie Zhussupova Date: Tue Aug 26 17:13:36 2025 +0800 kunit: Add example parameterized test with direct dynamic parameter array setup Introduce example_params_test_with_init_dynamic_arr(). This new KUnit test demonstrates directly assigning a dynamic parameter array, using the kunit_register_params_array() macro, to a parameterized test context. It highlights the use of param_init() and param_exit() for initialization and exit of a parameterized test, and their registration to the test case with KUNIT_CASE_PARAM_WITH_INIT(). Link: https://lore.kernel.org/r/20250826091341.1427123-7-davidgow@google.com Reviewed-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Marie Zhussupova Signed-off-by: David Gow Signed-off-by: Shuah Khan commit a03e3caa0e961cadbab18ed104fb2c20a254c50d Author: Marie Zhussupova Date: Tue Aug 26 17:13:35 2025 +0800 kunit: Add example parameterized test with shared resource management using the Resource API Add example_params_test_with_init() to illustrate how to manage shared resources across a parameterized KUnit test. This example showcases the use of the new param_init() function and its registration to a test using the KUNIT_CASE_PARAM_WITH_INIT() macro. Additionally, the test demonstrates how to directly pass a parameter array to the parameterized test context via kunit_register_params_array() and leveraging the Resource API for shared resource management. Link: https://lore.kernel.org/r/20250826091341.1427123-6-davidgow@google.com Reviewed-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Marie Zhussupova Signed-off-by: David Gow Signed-off-by: Shuah Khan commit b820b9077b7f4008cc44a40261aefa681c63c7d3 Author: Marie Zhussupova Date: Tue Aug 26 17:13:34 2025 +0800 kunit: Enable direct registration of parameter arrays to a KUnit test KUnit parameterized tests currently support two primary methods f or getting parameters: 1. Defining custom logic within a generate_params() function. 2. Using the KUNIT_ARRAY_PARAM() and KUNIT_ARRAY_PARAM_DESC() macros with a pre-defined static array and passing the created *_gen_params() to KUNIT_CASE_PARAM(). These methods present limitations when dealing with dynamically generated parameter arrays, or in scenarios where populating parameters sequentially via generate_params() is inefficient or overly complex. This patch addresses these limitations by adding a new `params_array` field to `struct kunit`, of the type `kunit_params`. The `struct kunit_params` is designed to store the parameter array itself, along with essential metadata including the parameter count, parameter size, and a get_description() function for providing custom descriptions for individual parameters. The `params_array` field can be populated by calling the new kunit_register_params_array() macro from within a param_init() function. This will register the array as part of the parameterized test context. The user will then need to pass kunit_array_gen_params() to the KUNIT_CASE_PARAM_WITH_INIT() macro as the generator function, if not providing their own. kunit_array_gen_params() is a KUnit helper that will use the registered array to generate parameters. The arrays passed to KUNIT_ARRAY_PARAM(,DESC) will also be registered to the parameterized test context for consistency as well as for higher availability of the parameter count that will be used for outputting a KTAP test plan for a parameterized test. This modification provides greater flexibility to the KUnit framework, allowing testers to easily register and utilize both dynamic and static parameter arrays. Link: https://lore.kernel.org/r/20250826091341.1427123-5-davidgow@google.com Reviewed-by: David Gow Reviewed-by: Rae Moar Signed-off-by: Marie Zhussupova [Only output the test plan if using kunit_array_gen_params --David] Signed-off-by: David Gow Signed-off-by: Shuah Khan commit b9a214b5f6aa55870b5678f31084f85c0c11ffdc Author: Marie Zhussupova Date: Tue Aug 26 17:13:33 2025 +0800 kunit: Pass parameterized test context to generate_params() To enable more complex parameterized testing scenarios, the generate_params() function needs additional context beyond just the previously generated parameter. This patch modifies the generate_params() function signature to include an extra `struct kunit *test` argument, giving test users access to the parameterized test context when generating parameters. The `struct kunit *test` argument was added as the first parameter to the function signature as it aligns with the convention of other KUnit functions that accept `struct kunit *test` first. This also mirrors the "this" or "self" reference found in object-oriented programming languages. This patch also modifies xe_pci_live_device_gen_param() in xe_pci.c and nthreads_gen_params() in kcsan_test.c to reflect this signature change. Link: https://lore.kernel.org/r/20250826091341.1427123-4-davidgow@google.com Reviewed-by: David Gow Reviewed-by: Rae Moar Acked-by: Marco Elver Acked-by: Rodrigo Vivi Signed-off-by: Marie Zhussupova [Catch some additional gen_params signatures in drm/xe/tests --David] Signed-off-by: David Gow Signed-off-by: Shuah Khan commit 241423580e5e8d8b10b14b382379f4928b87be17 Author: Marie Zhussupova Date: Tue Aug 26 17:13:32 2025 +0800 kunit: Introduce param_init/exit for parameterized test context management Add (*param_init) and (*param_exit) function pointers to `struct kunit_case`. Users will be able to set them via the new KUNIT_CASE_PARAM_WITH_INIT() macro. param_init/exit will be invoked by kunit_run_tests() once before and once after the parameterized test, respectively. They will receive the `struct kunit` that holds the parameterized test context; facilitating init and exit for shared state. This patch also sets param_init/exit to None in rust/kernel/kunit.rs. Link: https://lore.kernel.org/r/20250826091341.1427123-3-davidgow@google.com Reviewed-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Marie Zhussupova Signed-off-by: David Gow Signed-off-by: Shuah Khan commit 4b59300ba4d2362b02c2a9077047bbabceea67d7 Author: Marie Zhussupova Date: Tue Aug 26 17:13:31 2025 +0800 kunit: Add parent kunit for parameterized test context Currently, KUnit parameterized tests lack a mechanism to share resources across parameter runs because the same `struct kunit` instance is cleaned up and reused for each run. This patch introduces parameterized test context, enabling test users to share resources between parameter runs. It also allows setting up resources that need to be available for all parameter runs only once, which is helpful in cases where setup is expensive. To establish a parameterized test context, this patch adds a parent pointer field to `struct kunit`. This allows resources added to the parent `struct kunit` to be shared and accessible across all parameter runs. In kunit_run_tests(), the default `struct kunit` created is now designated to act as the parameterized test context whenever a test is parameterized. Subsequently, a new `struct kunit` is made for each parameter run, and its parent pointer is set to the `struct kunit` that holds the parameterized test context. Link: https://lore.kernel.org/r/20250826091341.1427123-2-davidgow@google.com Reviewed-by: David Gow Reviewed-by: Rae Moar Signed-off-by: Marie Zhussupova Signed-off-by: David Gow Signed-off-by: Shuah Khan commit 922d1dde441ad1060bc1ec005fd792774a274999 Author: David Gow Date: Wed Jul 30 11:16:24 2025 +0800 kunit: tool: Accept --raw_output=full as an alias of 'all' I can never remember whether --raw_output takes 'all' or 'full'. No reason we can't support both. For the record, 'all' is the recommended, documented option. Link: https://lore.kernel.org/r/20250730031624.1911689-1-davidgow@google.com Signed-off-by: David Gow Reviewed-by: Rae Moar Signed-off-by: Shuah Khan commit 242041164339594ca019481d54b4f68a7aaff64e Merge: f19434dd414e3a fe60065689048e Author: Jakub Kicinski Date: Tue Aug 26 18:11:31 2025 -0700 Merge branch 'ipv6-sr-simplify-and-optimize-hmac-calculations' Eric Biggers says: ==================== ipv6: sr: Simplify and optimize HMAC calculations This series simplifies and optimizes the HMAC calculations in IPv6 Segment Routing. ==================== Link: https://patch.msgid.link/20250824013644.71928-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit fe60065689048edf4df99fffdb180a2166f9a54d Author: Eric Biggers Date: Sat Aug 23 21:36:44 2025 -0400 ipv6: sr: Prepare HMAC key ahead of time Prepare the HMAC key when it is added to the kernel, instead of preparing it implicitly for every packet. This significantly improves the performance of seg6_hmac_compute(). A microbenchmark on x86_64 shows seg6_hmac_compute() (with HMAC-SHA256) dropping from ~1978 cycles to ~1419 cycles, a 28% improvement. The size of 'struct seg6_hmac_info' increases by 128 bytes, but that should be fine, since there should not be a massive number of keys. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250824013644.71928-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 095928e7d80186c524013a5b5d54889fa2ec1eaa Author: Eric Biggers Date: Sat Aug 23 21:36:43 2025 -0400 ipv6: sr: Use HMAC-SHA1 and HMAC-SHA256 library functions Use the HMAC-SHA1 and HMAC-SHA256 library functions instead of crypto_shash. This is simpler and faster. Pre-allocating per-CPU hash transformation objects and descriptors is no longer needed, and a microbenchmark on x86_64 shows seg6_hmac_compute() (with HMAC-SHA256) dropping from ~2494 cycles to ~1978 cycles, a 20% improvement. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250824013644.71928-2-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit f19434dd414e3a1d08ccfbc8f73b5201023aad9d Merge: ee3ae27721fb99 a9d533fbba0d26 Author: Jakub Kicinski Date: Tue Aug 26 17:35:30 2025 -0700 Merge branch 'selftests-drv-net-ncdevmem-fix-error-paths' Jakub Kicinski says: ==================== selftests: drv-net: ncdevmem: fix error paths Make ncdevmem clean up after itself. While at it make sure it sets HDS threshold to 0 automatically. v1: https://lore.kernel.org/20250822200052.1675613-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250825180447.2252977-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a9d533fbba0d266fecde0a1d4ee6382a5b099be0 Author: Jakub Kicinski Date: Mon Aug 25 11:04:47 2025 -0700 selftests: drv-net: ncdevmem: explicitly set HDS threshold to 0 Make sure we set HDS threshold to 0 if the device supports changing it. It's required for ZC. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250825180447.2252977-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6351fadbd5bbcd7ca0bd918c16516245c0903a52 Author: Jakub Kicinski Date: Mon Aug 25 11:04:46 2025 -0700 selftests: drv-net: ncdevmem: restore original HDS setting before exiting Restore HDS settings if we modified them. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250825180447.2252977-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b9f4f952982877bed19176798c6c5ca455f19b33 Author: Jakub Kicinski Date: Mon Aug 25 11:04:45 2025 -0700 selftests: drv-net: ncdevmem: restore old channel config In case changing channel count with provider bound succeeds unexpectedly - make sure we return to original settings. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250825180447.2252977-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6d04b36c73fdbbe2562f50271c4fe505f3dbce70 Author: Jakub Kicinski Date: Mon Aug 25 11:04:44 2025 -0700 selftests: drv-net: ncdevmem: save IDs of flow rules we added In prep for more selective resetting of ntuple filters try to save the rule IDs to a table. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250825180447.2252977-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6925f61714397d71b7cd5ad2e8d8cc30bf302d02 Author: Jakub Kicinski Date: Mon Aug 25 11:04:43 2025 -0700 selftests: drv-net: ncdevmem: remove use of error() Using error() makes it impossible for callers to unwind their changes. Replace error() calls with proper error handling. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250825180447.2252977-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ee3ae27721fb994ac0b4705b5806ce68a5a74c73 Author: Jakub Kicinski Date: Mon Aug 25 10:59:39 2025 -0700 selftests: drv-net: hds: restore hds settings The test currently modifies the HDS settings and doesn't restore them. This may cause subsequent tests to fail (or pass when they should not). Add defer()ed reset handling. Link: https://patch.msgid.link/20250825175939.2249165-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1bec9d0c0046fe4e2bfb6a1c5aadcb5d56cdb0fb Author: Guillaume Nault Date: Mon Aug 25 15:37:43 2025 +0200 ipv4: Convert ->flowi4_tos to dscp_t. Convert the ->flowic_tos field of struct flowi_common from __u8 to dscp_t, rename it ->flowic_dscp and propagate these changes to struct flowi and struct flowi4. We've had several bugs in the past where ECN bits could interfere with IPv4 routing, because these bits were not properly cleared when setting ->flowi4_tos. These bugs should be fixed now and the dscp_t type has been introduced to ensure that variables carrying DSCP values don't accidentally have any ECN bits set. Several variables and structure fields have been converted to dscp_t already, but the main IPv4 routing structure, struct flowi4, is still using a __u8. To avoid any future regression, this patch converts it to dscp_t. There are many users to convert at once. Fortunately, around half of ->flowi4_tos users already have a dscp_t value at hand, which they currently convert to __u8 using inet_dscp_to_dsfield(). For all of these users, we just need to drop that conversion. But, although we try to do the __u8 <-> dscp_t conversions at the boundaries of the network or of user space, some places still store TOS/DSCP variables as __u8 in core networking code. Those can hardly be converted either because the data structure is part of UAPI or because the same variable or field is also used for handling ECN in other parts of the code. In all of these cases where we don't have a dscp_t variable at hand, we need to use inet_dsfield_to_dscp() when interacting with ->flowi4_dscp. Changes since v1: * Fix space alignment in __bpf_redirect_neigh_v4() (Ido). Signed-off-by: Guillaume Nault Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/29acecb45e911d17446b9a3dbdb1ab7b821ea371.1756128932.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit dded99427d1a1e753e9554ebc9f27604154277ca Merge: a0f849c1cc6df0 2d5ccb93bbb4f1 Author: Jakub Kicinski Date: Tue Aug 26 17:24:18 2025 -0700 Merge branch 'expose-burst-period-for-devlink-health-reporter' Mark Bloch says: ==================== Expose burst period for devlink health reporter Shahar writes: -------------------------------------------------------------------------- Currently, the devlink health reporter initiates the grace period immediately after recovering an error, which blocks further recovery attempts until the grace period concludes. Since additional errors are not generally expected during this short interval, any new error reported during the grace period is not only rejected but also causes the reporter to enter an error state that requires manual intervention. This approach poses a problem in scenarios where a single root cause triggers multiple related errors in quick succession - for example, a PCI issue affecting multiple hardware queues. Because these errors are closely related and occur rapidly, it is more effective to handle them together rather than handling only the first one reported and blocking any subsequent recovery attempts. Furthermore, setting the reporter to an error state in this context can be misleading, as these multiple errors are manifestations of a single underlying issue, making it unlike the general case where additional errors are not expected during the grace period. To resolve this, introduce a configurable burst period attribute to the devlink health reporter. This period starts when the first error is recovered and lasts for a user-defined duration. Once this error burst period expires, the grace period begins. After the grace period ends, a new reported error will start the same flow again. Timeline summary: ----|--------|------------------------------/----------------------/-- error is error is burst period grace period reported recovered (recoveries allowed) (recoveries blocked) With burst period, create a time window during which recovery attempts are permitted, allowing all reported errors to be handled sequentially before the grace period starts. Once the grace period begins, it prevents any further error recoveries until it ends. When burst period is set to 0, current behavior is preserved. Design alternatives considered: 1. Recover all queues upon any error: A brute-force approach that recovers all queues on any error. While simple, it is overly aggressive and disrupts unaffected queues unnecessarily. Also, because this is handled entirely within the driver, it leads to a driver-specific implementation rather than a generic one. 2. Per-queue reporter: This design would isolate recovery handling per SQ or RQ, effectively removing interdependencies between queues. While conceptually clean, it introduces significant scalability challenges as the number of queues grows, as well as synchronization challenges across multiple reporters. 3. Error aggregation with delayed handling: Errors arriving during the grace period are saved and processed after it ends. While addressing the issue of related errors whose recovery is aborted as grace period started, this adds complexity due to synchronization needs and contradicts the assumption that no errors should occur during a healthy system’s grace period. Also, this breaks the important role of grace period in preventing an infinite loop of immediate error detection following recovery. In such cases we want to stop. 4. Allowing a fixed burst of errors before starting grace period: Allows a set number of recoveries before the grace period begins. However, it also requires limiting the error reporting window. To keep the design simple, the burst threshold becomes redundant. The burst period design was chosen for its simplicity and precision in addressing the problem at hand. It effectively captures the temporal correlation of related errors and aligns with the original intent of the grace period as a stabilization window where further errors are unexpected, and if they do occur, they indicate an abnormal system state. v3: https://lore.kernel.org/1755111349-416632-1-git-send-email-tariqt@nvidia.com v2: https://lore.kernel.org/1753390134-345154-1-git-send-email-tariqt@nvidia.com v1: https://lore.kernel.org/1752768442-264413-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/20250824084354.533182-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 2d5ccb93bbb4f161ccb677ce0b2ebcfe4a089d62 Author: Shahar Shitrit Date: Sun Aug 24 11:43:54 2025 +0300 net/mlx5e: Set default burst period for TX and RX reporters System errors can sometimes cause multiple errors to be reported to the TX reporter at the same time. For instance, lost interrupts may cause several SQs to time out simultaneously. When dev_watchdog notifies the driver for that, it iterates over all SQs to trigger recovery for the timed-out ones, via TX health reporter. However, grace period allows only one recovery at a time, so only the first SQ recovers while others remain blocked. Since no further recoveries are allowed during the grace period, subsequent errors cause the reporter to enter an ERROR state, requiring manual intervention. To address this, set the TX reporter's default burst period to 0.5 second. This allows the reporter to detect and handle all timed-out SQs within this window before initiating the grace period. To account for the possibility of a similar issue in the RX reporter, its default burst period is also configured. Additionally, while here, align the TX definition prefix with the RX, as these are used only in EN driver. Signed-off-by: Shahar Shitrit Reviewed-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250824084354.533182-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit da0e2197645c8e01bb6080c7a2b86d9a56cc64a9 Author: Shahar Shitrit Date: Sun Aug 24 11:43:53 2025 +0300 devlink: Make health reporter burst period configurable Enable configuration of the burst period — a time window starting from the first error recovery, during which the reporter allows recovery attempts for each reported error. This feature is helpful when a single underlying issue causes multiple errors, as it delays the start of the grace period to allow sufficient time for recovering all related errors. For example, if multiple TX queues time out simultaneously, a sufficient burst period could allow all affected TX queues to be recovered within that window. Without this period, only the first TX queue that reports a timeout will undergo recovery, while the remaining TX queues will be blocked once the grace period begins. Configuration example: $ devlink health set pci/0000:00:09.0 reporter tx burst_period 500 Configuration example with ynl: ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/devlink.yaml \ --do health-reporter-set --json '{ "bus-name": "auxiliary", "dev-name": "mlx5_core.eth.0", "port-index": 65535, "health-reporter-name": "tx", "health-reporter-burst-period": 500 }' Signed-off-by: Shahar Shitrit Reviewed-by: Jiri Pirko Reviewed-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250824084354.533182-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 6a06d8c40510ba1ecf27977f528b1eb74f290a60 Author: Shahar Shitrit Date: Sun Aug 24 11:43:52 2025 +0300 devlink: Introduce burst period for health reporter Currently, the devlink health reporter starts the grace period immediately after handling an error, blocking any further recoveries until it finished. However, when a single root cause triggers multiple errors in a short time frame, it is desirable to treat them as a bulk of errors and to allow their recoveries, avoiding premature blocking of subsequent related errors, and reducing the risk of inconsistent or incomplete error handling. To address this, introduce a configurable burst period for devlink health reporter. Start this period when the first error is handled, and allow recovery attempts for reported errors during this window. Once burst period expires, begin the grace period to block further recoveries until it concludes. Timeline summary: ----|--------|------------------------------/----------------------/-- error is error is burst period grace period reported recovered (recoveries allowed) (recoveries blocked) For calculating the burst period duration, use the same last_recovery_ts as the grace period. Update it on recovery only when the burst period is inactive (either disabled or at the first error). This patch implements the framework for the burst period and effectively sets its value to 0 at reporter creation, so the current behavior remains unchanged, which ensures backward compatibility. A downstream patch will make the burst period configurable. Signed-off-by: Shahar Shitrit Reviewed-by: Jiri Pirko Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250824084354.533182-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 20597fb9436e2e2372ddf782f0bb5ecbe3481068 Author: Shahar Shitrit Date: Sun Aug 24 11:43:51 2025 +0300 devlink: Move health reporter recovery abort logic to a separate function Extract the health reporter recovery abort logic into a separate function devlink_health_recover_abort(). The function encapsulates the conditions for aborting recovery: - When auto-recovery is disabled - When previous error wasn't recovered - When within the grace period after last recovery Signed-off-by: Shahar Shitrit Reviewed-by: Jiri Pirko Reviewed-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250824084354.533182-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d2b007374551ac09db16badde575cdd698f6fc92 Author: Shahar Shitrit Date: Sun Aug 24 11:43:50 2025 +0300 devlink: Move graceful period parameter to reporter ops Move the default graceful period from a parameter to devlink_health_reporter_create() to a field in the devlink_health_reporter_ops structure. This change improves consistency, as the graceful period is inherently tied to the reporter's behavior and recovery policy. It simplifies the signature of devlink_health_reporter_create() and its internal helper functions. It also centralizes the reporter configuration at the ops structure, preparing the groundwork for a downstream patch that will introduce a devlink health reporter burst period attribute whose default value will similarly be provided by the driver via the ops structure. Signed-off-by: Shahar Shitrit Reviewed-by: Jiri Pirko Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250824084354.533182-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb Author: Heiner Kallweit Date: Sat Aug 23 23:25:05 2025 +0200 net: phy: fixed_phy: let fixed_phy_unregister free the phy_device fixed_phy_register() creates and registers the phy_device. To be symmetric, we should not only unregister, but also free the phy_device in fixed_phy_unregister(). This allows to simplify code in users. Note wrt of_phy_deregister_fixed_link(): put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical. Signed-off-by: Heiner Kallweit Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com Signed-off-by: Jakub Kicinski commit 39e94fdce45fa611abf48472873e4ba2f67228a3 Author: Heiner Kallweit Date: Fri Aug 22 22:36:11 2025 +0200 net: phy: fixed: let fixed_phy_add always use addr 0 and remove return value We have only two users of fixed_phy_add(), both use address 0 and ignore the return value. So simplify fixed_phy_add() accordingly. Whilst at it, constify the fixed_phy_status configs. Note: fixed_phy_add() is a legacy function which shouldn't be used in new code, as it's use may be problematic: - No check whether a fixed phy exists already at the given address - If fixed_phy_register() is called afterwards by any other driver, then it will also use phy_addr 0, because fixed_phy_add() ignores the ida which manages address assignment Drivers using a fixed phy created by fixed_phy_add() in platform code, should dynamically create a fixed phy with fixed_phy_register() instead. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/762700e5-a0b1-41af-aa03-929822a39475@gmail.com Signed-off-by: Jakub Kicinski commit 7e484a97f6d5f9cfc524294917555cf87e765d9b Author: Qianfeng Rong Date: Mon Aug 25 22:27:52 2025 +0800 net: hns3: use kcalloc() instead of kzalloc() As noted in the kernel documentation, open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Use devm_kcalloc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20250825142753.534509-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit b4d5cd20507b252c746fa6971d82ac96f3b3e5b7 Author: Christian Marangi Date: Sat Aug 23 15:44:29 2025 +0200 net: phy: as21xxx: better handle PHY HW reset on soft-reboot On soft-reboot, with a reset GPIO defined for an Aeonsemi PHY, the special match_phy_device fails to correctly identify that the PHY needs to load the firmware again. This is caused by the fact that PHY ID is read BEFORE the PHY reset GPIO (if present) is asserted, so we can be in the scenario where the phydev have the previous PHY ID (with the PHY firmware loaded) but after reset the generic AS21xxx PHY is present in the PHY ID registers. To better handle this, skip reading the PHY ID register only for the PHY that are not AS21xxx (by matching for the Aeonsemi Vendor) and always read the PHY ID for the other case to handle both firmware already loaded or an HW reset. Fixes: 830877d89edc ("net: phy: Add support for Aeonsemi AS21xxx PHYs") Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20250823134431.4854-2-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 1abe21ef1adf0c5b6dbb5878c2fa4573df8d29fc Author: Christian Marangi Date: Sat Aug 23 15:44:28 2025 +0200 net: phy: introduce phy_id_compare_vendor() PHY ID helper Introduce phy_id_compare_vendor() PHY ID helper to compare a PHY ID with the PHY ID Vendor using the generic PHY ID Vendor mask. While at it also rework the PHY_ID_MATCH macro and move the mask to dedicated define so that PHY driver can make use of the mask if needed. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250823134431.4854-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 2465bb83e0b44e19ae7e3ad07148db61fbe0e2bf Merge: d0f27ff27c048a 21bce56940549a Author: Alexei Starovoitov Date: Tue Aug 26 16:51:52 2025 -0700 Merge branch 's390-bpf-add-s390-jit-support-for-timed-may_goto' Ilya Leoshkevich says: ==================== s390/bpf: Add s390 JIT support for timed may_goto v1: https://lore.kernel.org/bpf/20250821103256.291412-1-iii@linux.ibm.com/ v1 -> v2: Fix test_stream_errors (caught by CI). This series adds timed may_goto implementation to the s390x JIT. Patch 1 is the implementation itself, patches 2-5 are the associated test changes. ==================== Link: https://patch.msgid.link/20250821113339.292434-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 21bce56940549a2473134b44cd1d8e21da268e1e Author: Ilya Leoshkevich Date: Thu Aug 21 13:25:59 2025 +0200 selftests/bpf: Remove may_goto tests from DENYLIST.s390x The may_goto instruction is now fully supported on s390x, including the timed implementation, so remove the respective test from the denylist. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250821113339.292434-6-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 7197dbcba230c8a869e7f5bd250b8b7c9b3c0fa8 Author: Ilya Leoshkevich Date: Thu Aug 21 13:25:58 2025 +0200 selftests/bpf: Enable timed may_goto verifier tests on s390x Now that the timed may_goto implementation is available on s390x, enable the respective verifier tests. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250821113339.292434-5-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 1e4e6b9e260dffc82fa49c2caa4828540082cb58 Author: Ilya Leoshkevich Date: Thu Aug 21 13:25:57 2025 +0200 selftests/bpf: Add __arch_s390x macro Make it possible to limit certain tests to s390x, just like it's already done for x86_64, arm64, and riscv64. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250821113339.292434-4-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit b68dfcc12a320b85cd33d0d673ea620da08d0aec Author: Ilya Leoshkevich Date: Thu Aug 21 13:25:56 2025 +0200 selftests/bpf: Add a missing newline to the "bad arch spec" message Fix error messages like this one: parse_test_spec:FAIL:569 bad arch spec: 's390x'process_subtest:FAIL:1153 Can't parse test spec for program 'may_goto_simple' Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250821113339.292434-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit b8efa810c1db201dece99e4113229e5ecc00db5c Author: Ilya Leoshkevich Date: Thu Aug 21 13:25:55 2025 +0200 s390/bpf: Add s390 JIT support for timed may_goto The verifier provides an architecture-independent implementation of the may_goto instruction, which is currently used on s390x, but it has a downside: there is no way to prevent progs using it from running for a very long time. The solution to this problem is an alternative timed implementation, which requires architecture-specific bits. Its availability is signaled to the verifier by bpf_jit_supports_timed_may_goto() returning true. The verifier then emits a call to arch_bpf_timed_may_goto() using a non-standard calling convention. This function must act as a trampoline for bpf_check_timed_may_goto(). Implement bpf_jit_supports_timed_may_goto(), account for the special calling convention in the BPF_CALL implementation, and implement arch_bpf_timed_may_goto(). Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250821113339.292434-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit d738e1be2b2b4364403babc43ae7343d45e99d41 Author: Chaitanya Kumar Borah Date: Fri Aug 22 05:55:12 2025 +0530 drm/xe/wcl: Extend L3bank mask workaround The commit 9ab440a9d042 ("drm/xe/ptl: L3bank mask is not available on the media GT") added a workaround to ignore the fuse register that L3 bank availability as it did not contain valid values. Same is true for WCL therefore extend the workaround to cover it. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Dnyaneshwar Bhadane Link: https://lore.kernel.org/r/20250822002512.1129144-1-chaitanya.kumar.borah@intel.com Signed-off-by: Gustavo Sousa commit 0354e81b7bd629f9c3379c9524e988ebc504fa25 Author: Vlastimil Babka Date: Mon Aug 25 17:00:37 2025 +0200 scripts/misc-check: update export checks for EXPORT_SYMBOL_FOR_MODULES() The module export checks are looking for EXPORT_SYMBOL_GPL_FOR_MODULES() which was renamed to EXPORT_SYMBOL_FOR_MODULES(). Update the checks. Fixes: 6d3c3ca4c77e ("module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES") Signed-off-by: Vlastimil Babka Reviewed-by: Daniel Gomez Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250825-export_modules_fix-v1-1-5c331e949538@suse.cz Signed-off-by: Nathan Chancellor commit 6380b1ceba7783ccd2c7fb2e003412c1b8bb4235 Author: Lizhi Hou Date: Tue Aug 26 10:19:51 2025 -0700 accel/amdxdna: Fix incorrect type used for a local variable drivers/accel/amdxdna/aie2_pci.c:794:13: sparse: sparse: incorrect type in assignment (different address spaces) Fixes: c8cea4371e5e ("accel/amdxdna: Add a function to walk hardware contexts") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508230855.0b9efFl6-lkp@intel.com/ Reviewed-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250826171951.801585-1-lizhi.hou@amd.com commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 Author: Uros Bizjak Date: Mon Jun 16 11:52:57 2025 +0200 x86/vdso: Fix output operand size of RDPID RDPID instruction outputs to a word-sized register (64-bit on x86_64 and 32-bit on x86_32). Use an unsigned long variable to store the correct size. LSL outputs to 32-bit register, use %k operand prefix to always print the 32-bit name of the register. Use RDPID insn mnemonic while at it as the minimum binutils version of 2.30 supports it. [ bp: Merge two patches touching the same function into a single one. ] Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com commit ba8ee22a7f924ba10571b31f8a2e5aa1cf479308 Author: Eric Biggers Date: Tue Aug 5 15:28:54 2025 -0700 crypto: md5 - Wrap library and add HMAC support Reimplement crypto/md5.c on top of the new MD5 library functions. Also add support for HMAC-MD5, again just wrapping the library functions. This closely mirrors crypto/sha1.c. Link: https://lore.kernel.org/r/20250805222855.10362-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a1848f6e382145e0200843549f24f5af4b5c8136 Author: Eric Biggers Date: Tue Aug 5 15:28:53 2025 -0700 lib/crypto: sparc/md5: Migrate optimized code into library Instead of exposing the sparc-optimized MD5 code via sparc-specific crypto_shash algorithms, instead just implement the md5_blocks() library function. This is much simpler, it makes the MD5 library functions be sparc-optimized, and it fixes the longstanding issue where the sparc-optimized MD5 code was disabled by default. MD5 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/sparc/crypto/md5_glue.c to lib/crypto/sparc/md5.h, view this commit with 'git show -M10'. Link: https://lore.kernel.org/r/20250805222855.10362-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 09371e1349c9bb34ac030973c7867016a8a8914d Author: Eric Biggers Date: Tue Aug 5 15:28:52 2025 -0700 lib/crypto: powerpc/md5: Migrate optimized code into library Instead of exposing the powerpc-optimized MD5 code via powerpc-specific crypto_shash algorithms, instead just implement the md5_blocks() library function. This is much simpler, it makes the MD5 library functions be powerpc-optimized, and it fixes the longstanding issue where the powerpc-optimized MD5 code was disabled by default. MD5 still remains available through crypto_shash, but individual architectures no longer need to handle it. Link: https://lore.kernel.org/r/20250805222855.10362-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit cddd17868a8069f583a4fd6a2cc7b2a9ea15c26c Author: Eric Biggers Date: Tue Aug 5 15:28:51 2025 -0700 mips: cavium-octeon: Move octeon-crypto.c into parent dir Since octeon-crypto.c is the only remaining source file in arch/mips/cavium-octeon/crypto/, move it into its parent directory arch/mips/cavium-octeon/. Then remove the directory arch/mips/cavium-octeon/crypto/, including its Makefile. Link: https://lore.kernel.org/r/20250805222855.10362-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c9e5ac0ab9d1235f1a91852ec3d3c5c5f3e8ba0e Author: Eric Biggers Date: Tue Aug 5 15:28:50 2025 -0700 lib/crypto: mips/md5: Migrate optimized code into library Instead of exposing the mips-optimized MD5 code via mips-specific crypto_shash algorithms, instead just implement the md5_blocks() library function. This is much simpler, it makes the MD5 library functions be mips-optimized, and it fixes the longstanding issue where the mips-optimized MD5 code was disabled by default. MD5 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/mips/cavium-octeon/crypto/octeon-md5.c to lib/crypto/mips/md5.h, view this commit with 'git show -M10'. Link: https://lore.kernel.org/r/20250805222855.10362-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e164461349444ad27873e4ab2f492eb4465dbbb0 Author: Eric Biggers Date: Tue Aug 5 15:28:49 2025 -0700 lib/crypto: md5: Add MD5 and HMAC-MD5 library functions Add library functions for MD5, including HMAC support. The MD5 implementation is derived from crypto/md5.c. This closely mirrors the corresponding SHA-1 and SHA-2 changes. Like SHA-1 and SHA-2, support for architecture-optimized MD5 implementations is included. I originally proposed dropping those, but unfortunately there is an AF_ALG user of the PowerPC MD5 code (https://lore.kernel.org/r/c4191597-341d-4fd7-bc3d-13daf7666c41@csgroup.eu/), and dropping that code would be viewed as a performance regression. We don't add new software algorithm implementations purely for AF_ALG, as escalating to kernel mode merely to do calculations that could be done in userspace is inefficient and is completely the wrong design. But since this one already existed, it gets grandfathered in for now. An objection was also raised to dropping the SPARC64 MD5 code because it utilizes the CPU's direct support for MD5, although it remains unclear that anyone is using that. Regardless, we'll keep these around for now. Note that while MD5 is a legacy algorithm that is vulnerable to practical collision attacks, it still has various in-kernel users that implement legacy protocols. Switching to a simple library API, which is the way the code should have been organized originally, will greatly simplify their code. For example: MD5: drivers/md/dm-crypt.c (for lmk IV generation) fs/nfsd/nfs4recover.c fs/ecryptfs/ fs/smb/client/ net/{ipv4,ipv6}/ (for TCP-MD5 signatures) HMAC-MD5: fs/smb/client/ fs/smb/server/ (Also net/sctp/ if it continues using HMAC-MD5 for cookie generation. However, that use case has the flexibility to upgrade to a more modern algorithm, which I'll be proposing instead.) As usual, the "md5" and "hmac(md5)" crypto_shash algorithms will also be reimplemented on top of these library functions. For "hmac(md5)" this will provide a faster, more streamlined implementation. Link: https://lore.kernel.org/r/20250805222855.10362-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit bce5816672ec27085489f096ec27739a4a233b7b Author: Eric Biggers Date: Thu Jul 31 15:36:51 2025 -0700 lib/crypto: sha512: Use underlying functions instead of crypto_simd_usable() Since sha512_kunit tests the fallback code paths without using crypto_simd_disabled_for_test, make the SHA-512 code just use the underlying may_use_simd() and irq_fpu_usable() functions directly instead of crypto_simd_usable(). This eliminates an unnecessary layer. Link: https://lore.kernel.org/r/20250731223651.136939-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 640d31ea83c6f67133d47df9a0973f3281c91cf4 Author: Eric Biggers Date: Thu Jul 31 15:35:10 2025 -0700 lib/crypto: sha256: Use underlying functions instead of crypto_simd_usable() Since sha256_kunit tests the fallback code paths without using crypto_simd_disabled_for_test, make the SHA-256 code just use the underlying may_use_simd() and irq_fpu_usable() functions directly instead of crypto_simd_usable(). This eliminates an unnecessary layer. While doing this, also add likely() annotations, and fix a minor inconsistency where the static keys in the sha256.h files were in a different place than in the corresponding sha1.h and sha512.h files. Link: https://lore.kernel.org/r/20250731223510.136650-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3df0bee9c5b94ca9e3e2ff0f4c4e9886eac86055 Author: Andrew Davis Date: Thu Aug 14 10:39:40 2025 -0500 remoteproc: wkup_m3: Use devm_rproc_add() helper Use the device lifecycle managed add function. This helps prevent mistakes like deleting out of order in cleanup functions and forgetting to delete on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814153940.670564-4-afd@ti.com Signed-off-by: Mathieu Poirier commit 9b84eec6f3b78795ab57f9c2c808948e12d18bad Author: Andrew Davis Date: Thu Aug 14 10:39:39 2025 -0500 remoteproc: wkup_m3: Use devm_rproc_alloc() helper Use the device lifecycle managed allocation function. This helps prevent mistakes like freeing out of order in cleanup functions and forgetting to free on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814153940.670564-3-afd@ti.com Signed-off-by: Mathieu Poirier commit 642f8c01e31dd2918e9e655f29846326bf7fad4c Author: Andrew Davis Date: Thu Aug 14 10:39:38 2025 -0500 remoteproc: wkup_m3: Use devm action to call PM runtime put sync This helps prevent mistakes like putting out of order in cleanup functions and forgetting to put sync on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814153940.670564-2-afd@ti.com Signed-off-by: Mathieu Poirier commit 433570ee392f2f8f792a454bc2d34a4d3ce8d47d Author: Miri Korenblit Date: Thu Aug 21 20:47:26 2025 +0300 wifi: iwlwifi: mld: don't validate keys state on resume When resuming, we iterate over all the (installed) keys to update the PNs. If we find a key with an unexpected cipher we disconnect. But there is no reason for us to validate the internal key state specifically on resume, it should be the same as it was before the suspend. Remove the 'unhandled_cipher' from the iteration data. Also remove the num_keys indication as it is not really needed. If no keys were installed before the suspend, we will have num_of_gtk_rekeys = 0 and we will return early anyway. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.fb7e3bd4a967.I7eb24756ee27ad7b6731c0fb5dce5acb5d986694@changeid commit 370fc69ed95ea3547dc106fb0508651fd4478412 Author: Miri Korenblit Date: Thu Aug 21 20:47:25 2025 +0300 wifi: iwlwifi: mld: rename iwl_mld_set_key_rx_seq This function should only be used for group keys. For pairwise keys we have iwl_mld_update_ptk_rx_seq. Make that clear from the name. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.ebf93a07905a.I8380b5cf9f6095b3a0b35fe4b7d56c544b921600@changeid commit 457b2a881f7b920112b0107bf2fdc373e748c7f4 Author: Miri Korenblit Date: Thu Aug 21 20:47:24 2025 +0300 wifi: iwlwifi: mld: refactor iwl_mld_add_all_rekeys This receives iwl_mld_resume_key_iter_data, but it really only needs the mld object. Pass that instead. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.1d12ab0b5699.I201044d175b979520970090153de4d622652f86d@changeid commit e7e14d8e39d0a3fb4d90ced6b928cb53eb6dd4c0 Author: Miri Korenblit Date: Thu Aug 21 20:47:23 2025 +0300 wifi: iwlwifi: mld: don't consider old versions of PPAG There is a utility function, iwl_fill_ppag_table, to fill the PPAG table according the version of the FW API and on of the BIOS table. But this function handles really old APIs that iwlmld will not support. Also, iwlmvm will no longer have new APIs of PPAG (because it is loaded on frozen devices only). So in the next versions we might introdue regressions to iwlmvm. Simply fill the PPAG table separately in iwlmld code, without using this utility. Reviewed-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.35698eb46b67.Ie77dc9c3ee8275d1c2e4eafa27f1c7899c2660ce@changeid commit 0a477ddb6ec60127b39aa04c582ed2881fd58104 Author: Miri Korenblit Date: Thu Aug 21 20:47:22 2025 +0300 wifi: iwlwifi: make ppag versioning clear We used to have in iwl_ppag_table_cmd v2, that covered multiple FW versions of the command (2-6), so we just called it v2, and v3 for FW version 7. This is a bit confusing, and now v2 actually covers only FW version 5. Rename v2 to v5 and v3 to v7 so we don't have a different versioning than the FW has. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.e1240c6889e5.If7898bdf9ef70eed9c12484c03a3cc4f27635682@changeid commit 86adc88438156912535ed424033e700f7cb78990 Author: Miri Korenblit Date: Thu Aug 21 20:47:21 2025 +0300 Reapply "wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions" This reverts commit da75f183fea0 ("wifi: iwlwifi: Revert "wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions""). Now as we no longer support the FWs that required some old versions, this can be reapplied. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821174726.2425334-4-miriam.rachel.korenblit@intel.com commit 8788f6b3c664c83441039a453a0ec9cd27bf4859 Author: Miri Korenblit Date: Thu Aug 21 20:47:20 2025 +0300 wifi: iwlwifi: bump MIN API in HR/GF/BZ/SC/DR Stop supporting API 98. Since API 99 will not be released, bump to 100. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821174726.2425334-3-miriam.rachel.korenblit@intel.com commit 17e580918d24a7fc9e635f269855bbd35c03c5f9 Author: Miri Korenblit Date: Thu Aug 21 20:47:19 2025 +0300 wifi: iwlwifi: mvm: remove a function declaration iwl_mvm_average_dbm_values was removed, but the declaration wasn't. Remove it now. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821174726.2425334-2-miriam.rachel.korenblit@intel.com commit 205a7309cccd34ad49c2b6b1b59b907c12395d6c Author: Miri Korenblit Date: Thu Aug 21 20:47:18 2025 +0300 wifi: iwlwifi: mld/mvm: set beacon protection capability in wowlan config Although the FW knows if a BIGTK was installed and can conclude from that the beacon protection capability, the specific component of the FW that is responsible for rekeying while in wowlan, doesn't know what keys were installed. So we need to tell that the FW when we go to wowlan, otherwise it will ignore the BIGTK rekey, if such occurs. Set this bit when needed. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.d3968487865e.I784f564ab85f618f26d3f082197a384bb219e07c@changeid commit 6a1adca41f86b8c234068e5b3e961065a4a2d873 Author: Miri Korenblit Date: Thu Aug 21 20:47:17 2025 +0300 wifi: iwlwifi: mvm/mld: correctly retrieve the keyidx from the beacon key->icv_len already includes the pn length and the keyidx length. In fact it is the size of the MMIE, so subtracting it from the overall length will actually bring us to the beggining of the MMIE and not of the keyidx inside it. Also, we also need to consider a 16 byte long MIC. Fix the code to correctly retrieve the keyidx. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.e0aea411cd2a.I4220348147541a1478b02389475426047ecf84bc@changeid commit 8925c7876c20b6c2b57512856e5b8100d2339d77 Author: Miri Korenblit Date: Thu Aug 21 20:47:16 2025 +0300 wifi: iwlwifi: mld: track BIGTK per link We track the BIGTKs installed for beacon protection purposes. But in MLO we will have a different BIGTK per link. Track the BIGTK per-link and not per-vif. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.0392769d3abb.I5d8e232d663e3ca8fc23de12dd8534cb076cabb9@changeid commit 33d958b39ad0ca5f3741d11b092e94137ef0b13e Author: Miri Korenblit Date: Thu Aug 21 20:47:15 2025 +0300 wifi: iwlwifi: mld: support MLO rekey on resume When resuming from wowlan, update mac80211 on rekeys of MLO group keys and set the PN for those keys. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.fae2b42fbbfc.I7fcba97b6424577e49f7295f0c40b7d294ab56d8@changeid commit 9e7f13d27de963394ca326d02326091eae696e4b Author: Miri Korenblit Date: Thu Aug 21 20:47:14 2025 +0300 wifi: iwlwifi: mvm: cleanup cipher lookup in resume We used to lookup the ciphers of the mcast keys, but this was beacuse it was required for ieee80211_get_rekey_add. Now as this API no longer needs the cipher as an argument, we can remove the cipher lookups. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.937cbf5fd26e.I5d92258a9d63a39ee3acb02a72a2af9984993018@changeid commit 2f72134320654a54eab44f9aaf81a385196de906 Author: Miri Korenblit Date: Thu Aug 21 20:47:13 2025 +0300 wifi: iwlwifi: mld: cleanup cipher lookup in resume We used to lookup the ciphers of the mcast keys, but this was beacuse it was required for ieee80211_get_rekey_add. Now as this API no longer needs the cipher as an argument, we can remove the cipher lookups. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.0650021c587b.Iae55243b575248cb4cc0b416f7f63092b5803219@changeid commit 2510e2047c6b1aaf76fbcf012256988d15402391 Author: Pagadala Yesu Anjaneyulu Date: Thu Aug 21 20:47:12 2025 +0300 wifi: iwlwifi: mvm: remove MLO code Now as we have iwlmld, which is the op-mode that will be loaded for EHT capable devices, there is no need for EHT features in iwlmvm. This change removes: - The logic of entering and exiting EMLSR - Link selection - MLO scan - relevant Kunit tests - related debugfs entries Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250821204455.933bb1a12e42.I3d017c30ffc2a29bc12ff0270562bcfb234c0785@changeid commit 461edcf73eec57bc0006fbb5209f5012c514c58b Author: Andrew Davis Date: Thu Aug 14 10:39:37 2025 -0500 remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper Use device life-cycle managed runtime enable function to simplify probe and exit paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814153940.670564-1-afd@ti.com Signed-off-by: Mathieu Poirier commit ac4393af3cb66c371fafc894a14e795f70a7c5e0 Author: Andrew Davis Date: Thu Aug 14 09:08:35 2025 -0500 remoteproc: keystone: Use devm_rproc_add() helper Use the device lifecycle managed add function. This helps prevent mistakes like deleting out of order in cleanup functions and forgetting to delete on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814140835.651652-5-afd@ti.com Signed-off-by: Mathieu Poirier commit 49493852bd80109db5bdc02c2eb86751ec0d4906 Author: Andrew Davis Date: Thu Aug 14 09:08:34 2025 -0500 remoteproc: keystone: Use devm_gpiod_get() helper Use device life-cycle managed GPIO get function to simplify probe and exit paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814140835.651652-4-afd@ti.com Signed-off-by: Mathieu Poirier commit a2ab9cd283ce7daf1b634260a73618733af9d99f Author: Andrew Davis Date: Thu Aug 14 09:08:33 2025 -0500 remoteproc: keystone: Use devm action to call PM runtime put sync This helps prevent mistakes like putting out of order in cleanup functions and forgetting to put sync on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814140835.651652-3-afd@ti.com Signed-off-by: Mathieu Poirier commit db0427a8a595d0e4880043f9dff8e99c061e5d55 Author: Andrew Davis Date: Thu Aug 14 09:08:32 2025 -0500 remoteproc: keystone: Use devm_pm_runtime_enable() helper Use device life-cycle managed runtime enable function to simplify probe and exit paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814140835.651652-2-afd@ti.com Signed-off-by: Mathieu Poirier commit 01e4ed11c5d4120a47ffc3b15dd9050e922cde53 Author: Andrew Davis Date: Thu Aug 14 09:08:31 2025 -0500 remoteproc: keystone: Use devm action to release reserved memory This helps prevent mistakes like freeing out of order in cleanup functions and forgetting to free on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814140835.651652-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 8d33a030c566e1f105cd5bf27f37940b6367f3be Author: Zheng Qixing Date: Tue Aug 26 15:42:04 2025 +0800 dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes: BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0 The issue can be triggered as below: T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3) Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps. Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences. Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion") Cc: stable@vger.kernel.org Signed-off-by: Zheng Qixing Signed-off-by: Mikulas Patocka commit 7f597c2cdb9d3263a6fce07c4fc0a9eaa8e8fc43 Author: Zheng Qixing Date: Tue Aug 26 15:42:03 2025 +0800 dm: fix queue start/stop imbalance under suspend/load/resume races When suspend and load run concurrently, before q->mq_ops is set in blk_mq_init_allocated_queue(), __dm_suspend() skip dm_stop_queue(). As a result, the queue's quiesce depth is not incremented. Later, once table load has finished and __dm_resume() runs, which triggers q->quiesce_depth ==0 warning in blk_mq_unquiesce_queue(): Call Trace: dm_start_queue+0x16/0x20 [dm_mod] __dm_resume+0xac/0xb0 [dm_mod] dm_resume+0x12d/0x150 [dm_mod] do_resume+0x2c2/0x420 [dm_mod] dev_suspend+0x30/0x130 [dm_mod] ctl_ioctl+0x402/0x570 [dm_mod] dm_ctl_ioctl+0x23/0x30 [dm_mod] Fix this by explicitly tracking whether the request queue was stopped in __dm_suspend() via a new DMF_QUEUE_STOPPED flag. Only call dm_start_queue() in __dm_resume() if the queue was actually stopped. Fixes: e70feb8b3e68 ("blk-mq: support concurrent queue quiesce/unquiesce") Cc: stable@vger.kernel.org Signed-off-by: Zheng Qixing Signed-off-by: Mikulas Patocka commit 7183e39ac915ec047586a755746cae5b79f5f93c Author: Andrew Davis Date: Thu Aug 14 08:55:32 2025 -0500 remoteproc: da8xx: Use devm_rproc_add() helper Use the device lifecycle managed add function. This helps prevent mistakes like deleting out of order in cleanup functions and forgetting to delete on error paths. As this now makes the IRQ free ordered correctly, we can drop that from the remove() callback, which is now empty and can also be removed. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814135532.638040-3-afd@ti.com Signed-off-by: Mathieu Poirier commit 16689f33e5addec4a61cd4c102900a154349dc2a Author: Andrew Davis Date: Thu Aug 14 08:55:31 2025 -0500 remoteproc: da8xx: Use devm action to release reserved memory This helps prevent mistakes like freeing out of order in cleanup functions and forgetting to free on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814135532.638040-2-afd@ti.com Signed-off-by: Mathieu Poirier commit d1f51a4f953da4ada15fa585c800ca98d627ce47 Author: Riana Tauro Date: Tue Aug 26 12:04:17 2025 +0530 drm/xe/xe_hw_error: Add fault injection to trigger csc error handler Add a debugfs fault handler to trigger csc error handler that wedges the device and enables runtime survivability mode. v2: add debugfs only for bmg (Umesh) v3: do not use csc_fault attribute if debugfs is not enabled v4: rebase Cc: Lucas De Marchi Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250826063419.3022216-11-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit a7df563b45b03ac8aa480051cce8d49d7b489ec6 Author: Riana Tauro Date: Tue Aug 26 12:04:16 2025 +0530 drm/xe/xe_hw_error: Handle CSC Firmware reported Hardware errors Add support to handle CSC firmware reported errors. When CSC firmware errors are encoutered, a error interrupt is received by the GFX device as a MSI interrupt. Device Source control registers indicates the source of the error as CSC The HEC error status register indicates that the error is firmware reported Depending on the type of error, the error cause is written to the HEC Firmware error register. On encountering such CSC firmware errors, the graphics device is non-recoverable from driver context. The only way to recover from these errors is firmware flash. System admin/userspace is notified of the necessity of firmware flash with a combination of vendor-specific drm device edged uevent, dmesg logs and runtime survivability sysfs. It is the responsiblity of the consumer to verify all the actions and then trigger a firmware flash using tools like fwupd. $ udevadm monitor --property --kernel monitor will print the received events for: KERNEL - the kernel uevent KERNEL[754.709341] change /devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/card0 (drm) ACTION=change DEVPATH=/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/card0 SUBSYSTEM=drm WEDGED=vendor-specific DEVNAME=/dev/dri/card0 DEVTYPE=drm_minor SEQNUM=5973 MAJOR=226 MINOR=0 Logs xe 0000:03:00.0: [drm] *ERROR* [Hardware Error]: Tile0 reported NONFATAL error 0x20000 xe 0000:03:00.0: [drm] *ERROR* [Hardware Error]: NONFATAL: HEC Uncorrected FW FD Corruption error reported, bit[2] is set xe 0000:03:00.0: Runtime Survivability mode enabled xe 0000:03:00.0: [drm] *ERROR* CRITICAL: Xe has declared device 0000:03:00.0 as wedged. IOCTLs and executions are blocked. Only a rebind may clear the failure Please file a _new_ bug report at https://gitlab.freedesktop.org/drm/xe/kernel/issues/new xe 0000:03:00.0: [drm] device wedged, needs recovery xe 0000:03:00.0: Firmware flash required, Please refer to the userspace documentation for more details! Runtime survivability Sysfs: /sys/bus/pci/devices//survivability_mode v2: use vendor recovery method with runtime survivability (Christian, Rodrigo, Raag) v3: move declare wedged to runtime survivability mode (Rodrigo) v4: update commit message Signed-off-by: Riana Tauro Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250826063419.3022216-10-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 0a2a873d615a39e8a87d3f15285ed888341ddce8 Author: Riana Tauro Date: Tue Aug 26 12:04:15 2025 +0530 drm/xe: Add support to handle hardware errors Gfx device reports two classes of errors: uncorrectable and correctable. Depending on the severity uncorrectable errors are further classified Non-Fatal and Fatal. Correctable and Non-Fatal errors: These errors are reported as MSI. Bits in the Master Interrupt Register indicate the class of the error. The source of the error is then read from the Device Error Source Register. Fatal errors: These are reported as PCIe errors When a PCIe error is asserted, the OS will perform a SBR (Secondary Bus reset) which causes the driver to reload. The error registers are sticky and the values are maintained through SBR. Add basic support to handle these errors. Bspec: 50875, 53073, 53074, 53075, 53076 v2: Format commit message (Umesh) v3: fix documentation (Stuart) Cc: Stuart Summers Co-developed-by: Himal Prasad Ghimiray Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Riana Tauro Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250826063419.3022216-9-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit f646c9f9371b28b8f93e619fe003415f6aaeb416 Author: Riana Tauro Date: Tue Aug 26 12:04:14 2025 +0530 drm/xe/doc: Document device wedged and runtime survivability Add documentation for vendor specific device wedged recovery method and runtime survivability. v2: fix documentation (Raag) v3: add userspace tool for firmware update (Raag) v4: use consistent documentation (Raag) v5: add more documentation Signed-off-by: Riana Tauro Reviewed-by: Rodrigo Vivi Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250826063419.3022216-8-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit a2ca0633a0fef925a0d8125d8f3e4495a5ecb310 Author: Riana Tauro Date: Tue Aug 26 12:04:13 2025 +0530 drm/xe/xe_survivability: Add support for Runtime survivability mode Certain runtime firmware errors can cause the device to be in a unusable state requiring a firmware flash to restore normal operation. Runtime Survivability Mode indicates firmware flash is necessary by wedging the device and exposing survivability mode sysfs. The below sysfs is an indication that device is in survivability mode /sys/bus/pci/devices//survivability_mode v2: Fix kernel-doc (Umesh) v3: Add user friendly dmesg (Frank) Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250826063419.3022216-7-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 41ff795aff53613d4184a35bbfae11a15caf07c5 Author: Riana Tauro Date: Tue Aug 26 12:04:12 2025 +0530 drm/xe/xe_survivability: Refactor survivability mode Refactor survivability mode code to support both boot and runtime survivability. Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250826063419.3022216-6-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 60439ac3f23549ff272e626bd78502123086eaa5 Author: Riana Tauro Date: Tue Aug 26 12:04:11 2025 +0530 drm/xe: Add a helper function to set recovery method Add a helper function to set recovery method. The recovery method can be set before declaring the device wedged and sending the drm wedged uevent. If no method is set, default unbind/re-bind method will be set. v2: fix documentation (Raag) Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250826063419.3022216-5-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 90fdcf5f89e9288c153923f16a60e6f7da18ba76 Author: Riana Tauro Date: Tue Aug 26 12:04:10 2025 +0530 drm/xe: Set GT as wedged before sending wedged uevent Userspace should be notified after setting the device as wedged. Re-order function calls to set gt wedged before sending uevent. Cc: Matthew Brost Suggested-by: Raag Jadav Signed-off-by: Riana Tauro Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250826063419.3022216-4-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 9c857a9d84e01332d031b55c4e38a66daecbae73 Author: Riana Tauro Date: Tue Aug 26 12:04:09 2025 +0530 drm: Add a vendor-specific recovery method to drm device wedged uevent Address the need for a recovery method (firmware flash on Firmware errors) introduced in the later patches of Xe KMD. Whenever XE KMD detects a firmware error, a firmware flash is required to recover the device to normal operation. The initial proposal to use 'firmware-flash' as a recovery method was not applicable to other drivers and could cause multiple recovery methods specific to vendors to be added. To address this a more generic 'vendor-specific' method is introduced, guiding users to refer to vendor specific documentation and system logs for detailed vendor specific recovery procedure. Add a recovery method 'WEDGED=vendor-specific' for such errors. Vendors must provide additional recovery documentation if this method is used. It is the responsibility of the consumer to refer to the correct vendor specific documentation and usecase before attempting a recovery. For example: If driver is XE KMD, the consumer must refer to the documentation of 'Device Wedging' under 'Documentation/gpu/xe/'. v2: fix documentation (Raag) v3: add more details to commit message (Sima, Rodrigo, Raag) add an example script to the documentation (Raag) v4: use consistent naming (Raag) v5: fix commit message v6: add more documentation Cc: André Almeida Cc: Christian König Cc: David Airlie Cc: Simona Vetter Cc: Maxime Ripard Signed-off-by: Riana Tauro Reviewed-by: Rodrigo Vivi Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250826063419.3022216-3-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 38fc73b8c7d692a099ddda37b700eeb330a03ff1 Author: Riana Tauro Date: Tue Aug 26 12:04:08 2025 +0530 drm/xe: Add documentation for Xe Device Wedging Add documentation for Xe Device Wedging so that file can be referenced in following patches. Signed-off-by: Riana Tauro Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250826063419.3022216-2-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 604642fc148b5d98fbe5f55e4c2688f9ee0b5868 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:32:14 2025 +0200 dt-bindings: gpio: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Acked-by: Yixun Lan Link: https://lore.kernel.org/r/20250821083213.46642-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bartosz Golaszewski commit 8003235b10e54c1be57374c6224751b39750f16c Author: Dmitry Torokhov Date: Sun Aug 17 14:30:20 2025 -0700 Documentation: gpio: add documentation about using software nodes Introduce documentation regarding use of software nodes to describe GPIOs on legacy boards that have not been converted to device tree. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Dmitry Torokhov Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/tnaaz2qlk5jpbonfle7uy7pb54qx6ixwuczfbkwtxxwpj7hwas@y7a2rwko3k6c Signed-off-by: Bartosz Golaszewski commit d0f27ff27c048a3bdc49877255a7e7f8b49f5603 Author: Tiezhu Yang Date: Tue Aug 26 14:50:57 2025 +0800 selftests/bpf: Remove entries from config.{arch} already present in config `config.{arch}` had entries already present in `config`. When generating the config used by vmtest, concatenate the `config` file with the `config.{arch}` one, making those entries duplicated, so remove those duplications. Use the following command to get the differences: $ comm -1 -2 <(sort tools/testing/selftests/bpf/config.x86_64) <(sort tools/testing/selftests/bpf/config) $ comm -1 -2 <(sort tools/testing/selftests/bpf/config.aarch64) <(sort tools/testing/selftests/bpf/config) $ comm -1 -2 <(sort tools/testing/selftests/bpf/config.riscv64) <(sort tools/testing/selftests/bpf/config) $ comm -1 -2 <(sort tools/testing/selftests/bpf/config.ppc64el) <(sort tools/testing/selftests/bpf/config) $ comm -1 -2 <(sort tools/testing/selftests/bpf/config.s390x) <(sort tools/testing/selftests/bpf/config) This is similar with commit 7a42af4b94f1 ("selftests/bpf: Remove entries from config.s390x already present in config"). Signed-off-by: Tiezhu Yang Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250826065057.11415-1-yangtiezhu@loongson.cn commit 369259d5104d613164a8da64848aafe9dc9fa976 Author: Krzysztof Kozlowski Date: Thu May 1 16:33:24 2025 +0200 extcon: qcom-spmi-misc: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-4-7af77802cbea@linaro.org/ Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit 6f982d55f8c5d1e9189906a2a352dba8de421f5f Author: Krzysztof Kozlowski Date: Thu May 1 16:33:23 2025 +0200 extcon: fsa9480: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-3-7af77802cbea@linaro.org/ Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit 93ccf3f2f22ceaa975b462156f98527febee4fe5 Author: Krzysztof Kozlowski Date: Thu May 1 16:33:22 2025 +0200 extcon: axp288: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-2-7af77802cbea@linaro.org/ Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f Author: Krzysztof Kozlowski Date: Thu May 1 16:33:21 2025 +0200 extcon: adc-jack: Fix wakeup source leaks on device unbind Device can be unbound, so driver must also release memory for the wakeup source. Do not use devm interface, because it would change the order of cleanup. Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/ Acked-by: MyungJoo Ham Signed-off-by: Krzysztof Kozlowski Signed-off-by: Chanwoo Choi commit b3a333f8ac1645b5f6a9d5f0a33c8523c1cedb94 Author: Colin Ian King Date: Tue Aug 26 09:17:12 2025 +0100 USB: serial: oti6858: remove extranenous ; after comment There is a redundant semicolon after a comment, remove it. Signed-off-by: Colin Ian King Signed-off-by: Johan Hovold commit 66edbb1e32eede16b261a90014451d67119fc875 Author: Frank Li Date: Wed Aug 20 12:49:45 2025 -0400 dt-bindings: gpio: Move fsl,mxs-pinctrl.txt into gpio-mxs.yaml Move mxs-pinctrl part into gpio-mxs.yaml and add pinctrl examples to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/mxs/imx28-xea.dtb: pinctrl@80018000 (fsl,imx28-pinctrl): 'auart0-2pins@0', 'auart0@0', ... 'usb1@1' do not match any of the regexes: 'gpio@[0-9]+$', 'pinctrl-[0-9]+' Signed-off-by: Frank Li Reviewed-by: Linus Walleij Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250820164946.3782702-1-Frank.Li@nxp.com Signed-off-by: Bartosz Golaszewski commit cdbd2acef252a17693558e3f7b51a29beb99edef Author: Šerif Rami Date: Mon Aug 25 09:25:57 2025 +0200 ALSA: usb-audio: us144mkii: Fixes for handshake, MIDI out and cleanup Add a handshake value of 0x32, which is required when the device was previously used by another OS with the official drivers. Correct the last byte of the MIDI output protocol to 0xe0. Also, remove the unused DRIVER_VERSION macro. Signed-off-by: Šerif Rami Link: https://patch.msgid.link/20250825072557.7670-1-ramiserifpersia@gmail.com Signed-off-by: Takashi Iwai commit 7399c13f619f33dc8bdce838f3c83e88a18765ee Author: Thomas Zimmermann Date: Mon Jul 14 17:13:09 2025 +0200 drm/vesadrm: Support DRM_FORMAT_C8 Add support for DRM_FORMAT_C8 to vesadrm. The new pixel-format description PIXEL_FORMAT_C8 describes the layout. Vesadrm's helpers vesadrm_fill_palette_lut() and vesadrm_load_palette_lut() set the hardware palette according to the CRTC's output format. The driver emulates XRGB8888 by converting the source buffer to RGB332 and using the resulting 256 colors as index into the hardware palette. The hardware palette converts back to RGB during scanout. This has no overhead compared to other format conversion, but allows common userspace, such as Wayland compositors, to operate on the display. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-10-tzimmermann@suse.de commit 1adb35c2523fcd06cf1c24d788d6a958a24bc143 Author: Thomas Zimmermann Date: Mon Jul 14 17:13:08 2025 +0200 drm/vesadrm: Prepare color management for palette-based framebuffers Distiguish between component-based formats and 'the rest' in vesadrm's color management. Scanout buffers with component-based format allow for gamma correction. Palette-based formats (i.e., 'the rest') require palette setup. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-9-tzimmermann@suse.de commit cbc383cea0942cd827c6f1a3408793ac3a97ea00 Author: Thomas Zimmermann Date: Mon Jul 14 17:13:07 2025 +0200 drm/vesadrm: Rename vesadrm_set_gamma_lut() to vesadrm_set_color_lut() Rename vesadrm's gamma helpers in preparation of the upcoming support for color palettes. Gamma correction and color palettes share the same hardware features, but the driver's old naming only indicated support for gamma LUTs. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-8-tzimmermann@suse.de commit b3c7edd5e50e0e92ead8794b084e92d89002dd6f Author: Thomas Zimmermann Date: Mon Jul 14 17:13:06 2025 +0200 drm/format-helper: Add XRGB8888-to-RGB332 to drm_fb_blit() List the conversion from XRGB8888-to-RGB332 in drm_fb_blit(), so that drivers based on sysfb-helpers can use it. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-7-tzimmermann@suse.de commit 7ff61177b7116825085587f007dcdfd042c7b33b Author: Thomas Zimmermann Date: Mon Jul 14 17:13:05 2025 +0200 drm/color-mgmt: Prepare for RGB332 palettes Add helper drm_crtc_fill_palette_332(), which fills palettes with RGB332 color data. Each color in RGB332 format serves as an index into an 8-bit palette that stores the corresponding component-based colors. Vesadrm will use the new helper to emulate RGB formats on top of framebuffers in C8 format. v2: - add comments on bit operations (Javier) Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-6-tzimmermann@suse.de commit 061963cd9e5b60672695e9a592be440469a6bf72 Author: Thomas Zimmermann Date: Mon Jul 14 17:13:04 2025 +0200 drm/sysfb: Blit to CRTC destination format Use the color format stored in struct drm_sysfb_crtc_state for color-format conversion instead of the scanout-buffer format announced by firmware. Currently, both values are identical. This will allow drivers to modify the CRTC's input format to a certain extend. Specifically, vesadrm will be able to display RGB framebuffers when the scanout buffer is of C8 format. With color- format conversion to RGB332 and correct setup of the C8 palette, displaying XRGB8888-based buffers under C8 can be achieved. v2: - refer to RGB332 as CRTC input format Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-5-tzimmermann@suse.de commit 31eea29d727ce35b747e68c6be350ca07b7ecd9b Author: Thomas Zimmermann Date: Mon Jul 14 17:13:03 2025 +0200 drm/sysfb: Find screen_info format with helpers Convert drm_sysfb_get_format_si() to lookup the screen_info color format as struct pixel_format with screen_info_pixel_format(). Then search the list of given formats for the screen_info format with pixel_format_equal(). Replaces custom code with helpers. The pixel-compare helper pixel_format_equal() also handles indexed color formats. Prepares for sysfb drivers to support color palettes. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-4-tzimmermann@suse.de commit d6d05e2af796ca25094f80a73d8841505d54368b Author: Thomas Zimmermann Date: Mon Jul 14 17:13:02 2025 +0200 video: screen_info: Add pixel-format helper for linear framebuffers Add screen_info_pixel_format(), which converts a screen_info's information about the color format to struct pixel_format. The encoding within the screen_info structure is complex and therefore prone to errors. Later patches will convert callers to use the pixel format. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-3-tzimmermann@suse.de commit cff5fb82733c4f1acda458ffd2bb5c948fb59bd6 Author: Thomas Zimmermann Date: Mon Jul 14 17:13:01 2025 +0200 video: pixel_format: Add compare helpers Add helpers that compare two pixel-format descriptions against each other. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250714151513.309475-2-tzimmermann@suse.de commit 16ed389227651330879e17bd83d43bd234006722 Author: Josh Poimboeuf Date: Wed Aug 20 14:03:43 2025 -0400 perf: Skip user unwind if the task is a kernel thread If the task is not a user thread, there's no user stack to unwind. Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250820180428.930791978@kernel.org commit d77e3319e31098a6cb97b7ce4e71ba676e327fd7 Author: Josh Poimboeuf Date: Wed Aug 20 14:03:42 2025 -0400 perf: Simplify get_perf_callchain() user logic Simplify the get_perf_callchain() user logic a bit. task_pt_regs() should never be NULL. Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://lore.kernel.org/r/20250820180428.760066227@kernel.org commit 90942f9fac05702065ff82ed0bade0d08168d4ea Author: Steven Rostedt Date: Wed Aug 20 14:03:41 2025 -0400 perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL To determine if a task is a kernel thread or not, it is more reliable to use (current->flags & (PF_KTHREAD|PF_USER_WORKERi)) than to rely on current->mm being NULL. That is because some kernel tasks (io_uring helpers) may have a mm field. Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250820180428.592367294@kernel.org commit 153f9e74dec230f2e070e16fa061bc7adfd2c450 Author: Josh Poimboeuf Date: Wed Aug 20 14:03:40 2025 -0400 perf: Have get_perf_callchain() return NULL if crosstask and user are set get_perf_callchain() doesn't support cross-task unwinding for user space stacks, have it return NULL if both the crosstask and user arguments are set. Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250820180428.426423415@kernel.org commit e649bcda25b5ae1a30a182cc450f928a0b282c93 Author: Josh Poimboeuf Date: Wed Aug 20 14:03:39 2025 -0400 perf: Remove get_perf_callchain() init_nr argument The 'init_nr' argument has double duty: it's used to initialize both the number of contexts and the number of stack entries. That's confusing and the callers always pass zero anyway. Hard code the zero. Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20250820180428.259565081@kernel.org commit 3c14917953a51a22f4fa7e13dfc13a4ec09bf348 Author: Mingming Cao Date: Thu Aug 21 06:02:15 2025 -0700 ibmvnic: Increase max subcrq indirect entries with fallback POWER8 support a maximum of 16 subcrq indirect descriptor entries per H_SEND_SUB_CRQ_INDIRECT call, while POWER9 and newer hypervisors support up to 128 entries. Increasing the max number of indirect descriptor entries improves batching efficiency and reduces hcall overhead, which enhances throughput under large workload on POWER9+. Currently, ibmvnic driver always uses a fixed number of max indirect descriptor entries (16). send_subcrq_indirect() treats all hypervisor errors the same: - Cleanup and Drop the entire batch of descriptors. - Return an error to the caller. - Rely on TCP/IP retransmissions to recover. - If the hypervisor returns H_PARAMETER (e.g., because 128 entries are not supported on POWER8), the driver will continue to drop batches, resulting in unnecessary packet loss. In this patch: Raise the default maximum indirect entries to 128 to improve ibmvnic batching on morden platform. But also gracefully fall back to 16 entries for Power 8 systems. Since there is no VIO interface to query the hypervisor’s supported limit, vnic handles send_subcrq_indirect() H_PARAMETER errors: - On first H_PARAMETER failure, log the failure context - Reduce max_indirect_entries to 16 and allow the single batch to drop. - Subsequent calls automatically use the correct lower limit, avoiding repeated drops. The goal is to optimizes performance on modern systems while handles falling back for older POWER8 hypervisors. Performance shows 40% improvements with MTU (1500) on largework load. Signed-off-by: Mingming Cao Reviewed-by: Brian King Reviewed-by: Haren Myneni Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250821130215.97960-1-mmc@linux.ibm.com Signed-off-by: Paolo Abeni commit 07ca488d688c9736778467b5fd78ed89f5311a03 Author: Yue Haibing Date: Wed Aug 20 20:30:07 2025 +0800 octeontx2-af: Remove unused declarations Commit 1845ada47f6d ("octeontx2-af: cn10k: Add RPM LMAC pause frame support") remove cgx_lmac_[s|g]et_pause_frm() and leave these unused. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20250820123007.1705047-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni commit c65ee1b1ffc68e274d6c1cebdf9df09407d180fd Author: Jouni Högander Date: Fri Aug 22 13:58:46 2025 +0300 drm/i915/psr: Do not unnecessarily remove underrun on idle PSR WA We are currently removing underrun on idle PSR WA even if it's not applied. Fix this by checking pkg_c_latency_used on PSR exit as well. Fixes: 9b1795e9b0ae ("drm/i915/psr: Underrun on idle PSR wa only when pkgc latency > delayed vblank") Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Link: https://lore.kernel.org/r/20250822105846.1023631-1-jouni.hogander@intel.com commit b06578497e6f32fa181235f5a64746c7d40259e6 Author: Chelsy Ratnawat Date: Sun Aug 24 08:13:16 2025 -0700 thunderbolt: Use string choices helpers Use string_choices.h helpers instead of hard-coded strings. Signed-off-by: Chelsy Ratnawat Signed-off-by: Mika Westerberg commit 418807860e94eb9c2fe07a6f5bf67de4c59a97e4 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:01:04 2025 +0530 drm/xe/uapi: Add UAPI for querying VMA count and memory attributes Introduce the DRM_IOCTL_XE_VM_QUERY_MEMORY_RANGE_ATTRS ioctl to allow userspace to query memory attributes of VMAs within a user specified virtual address range. Userspace first calls the ioctl with num_mem_ranges = 0, sizeof_mem_ranges_attr = 0 and vector_of_vma_mem_attr = NULL to retrieve the number of memory ranges (vmas) and size of each memory range attribute. Then, it allocates a buffer of that size and calls the ioctl again to fill the buffer with memory range attributes. This two-step interface allows userspace to first query the required buffer size, then retrieve detailed attributes efficiently. v2 (Matthew Brost) - Use same ioctl to overload functionality v3 - Add kernel-doc v4 - Make uapi future proof by passing struct size (Matthew Brost) - make lock interruptible (Matthew Brost) - set reserved bits to zero (Matthew Brost) - s/__copy_to_user/copy_to_user (Matthew Brost) - Avod using VMA term in uapi (Thomas) - xe_vm_put(vm) is missing (Shuicheng) v5 - Nits - Fix kernel-doc Cc: Matthew Brost Cc: Shuicheng Lin Cc: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-21-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit e80b05b09f0e38aabcd5185dc292db0eff7e6e22 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:01:03 2025 +0530 drm/xe: Enable madvise ioctl for xe Ioctl enables setting up of memory attributes in user provided range. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-20-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit a2eb8aec3ebe474ce0fe0b6ebb18aade8c1a5c00 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:01:02 2025 +0530 drm/xe: Reset VMA attributes to default in SVM garbage collector Restore default memory attributes for VMAs during garbage collection if they were modified by madvise. Reuse existing VMA if fully overlapping; otherwise, allocate a new mirror VMA. v2 (Matthew Brost) - Add helper for vma split - Add retry to get updated vma v3 - Rebase on gpuvm layer Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-19-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 58dc430d89ae2cf41a8919ac99c36c4a17a3fdc3 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:01:01 2025 +0530 drm/xe/vm: Add helper to check for default VMA memory attributes Introduce a new helper function `xe_vma_has_default_mem_attrs()` to determine whether a VMA's memory attributes are set to their default values. This includes checks for atomic access, PAT index, and preferred location. Also, add a new field `default_pat_index` to `struct xe_vma_mem_attr` to track the initial PAT index set during the first bind. This helps distinguish between default and user-modified pat index, such as those changed via madvise. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-18-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 002f817d61ce2cfb0be850c3a6036adfbb4fd5e9 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:01:00 2025 +0530 drm/xe/madvise: Skip vma invalidation if mem attr are unchanged If a VMA within the madvise input range already has the same memory attribute as the one requested by the user, skip PTE zapping for that VMA to avoid unnecessary invalidation. v2 (Matthew Brost) - fix skip_invalidation for new attributes - s/u32/bool - Remove unnecessary assignment for kzalloc'ed Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-17-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 293032eec4baa04374d62dd44de61e355296ad32 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:59 2025 +0530 drm/xe/bo: Update atomic_access attribute on madvise Update the bo_atomic_access based on user-provided input and determine the migration to smem during a CPU fault v2 (Matthew Brost) - Avoid cpu unmapping if bo is already in smem - check atomics on smem too for ioctl - Add comments v3 - Avoid migration in prefetch v4 (Matthew Brost) - make sanity check function bool - add assert for smem placement - fix doc v5 (Matthew Brost) - NACK atomic fault with DRM_XE_ATOMIC_CPU Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-16-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 072e299982635aa8d96683071930e3bf0a1c1a2f Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:58 2025 +0530 drm/xe/bo: Add attributes field to xe_bo A single BO can be linked to multiple VMAs, making VMA attributes insufficient for determining the placement and PTE update attributes of the BO. To address this, an attributes field has been added to the BO. Reviewed-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250821173104.3030148-15-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit c1bb69a2e8e2d55c3725e304d8b8fd189ee43fbe Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:57 2025 +0530 drm/xe/svm: Consult madvise preferred location in prefetch When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC, prefetch svm ranges to preferred location provided by madvise. v2 (Matthew Brost) - Fix region, devmem_fd usages - consult madvise is applicable for other vma's too. v3 - Fix atomic handling v4 - Fix xe_svm_range_validate to check for DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC too. Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-14-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit fa1a82c985dba642de66f0a1918fc531007bf90f Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:56 2025 +0530 drm/xe/uapi: Add flag for consulting madvise hints on svm prefetch Introduce flag DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC to ensure prefetching in madvise-advised memory regions v2 (Matthew Brost) - Add kernel-doc v3 (Matthew Brost) - Fix kernel-doc Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250821173104.3030148-13-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 18d36fd6d13b295ebf111de2651bb398fcd1a040 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:55 2025 +0530 drm/xe/svm: Support DRM_XE_SVM_MEM_RANGE_ATTR_PAT memory attribute This attributes sets the pat_index for the svm used vma range, which is utilized to ascertain the coherence. v2 (Matthew Brost) - Pat index sanity check Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-12-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit a894c27407402b6f980876603e1fa66470555ff6 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:54 2025 +0530 drm/xe/madvise: Update migration policy based on preferred location When the user sets the valid devmem_fd as a preferred location, GPU fault will trigger migration to tile of device associated with devmem_fd. If the user sets an invalid devmem_fd the preferred location is current placement(smem) only. v2(Matthew Brost) - Default should be faulting tile - remove devmem_fd used as region v3 (Matthew Brost) - Add migration_policy - Fix return condition - fix migrate condition v4 -Rebase v5 - Add check for userptr and bo based vmas Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-11-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit d6db171167f886d5f173c67044e413e14b02c880 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:53 2025 +0530 drm/xe/svm: Add svm ranges migration policy on atomic access If the platform does not support atomic access on system memory, and the ranges are in system memory, but the user requires atomic accesses on the VMA, then migrate the ranges to VRAM. Apply this policy for prefetch operations as well. v2 - Drop unnecessary vm_dbg v3 (Matthew Brost) - fix atomic policy - prefetch shouldn't have any impact of atomic - bo can be accessed from vma, avoid duplicate parameter v4 (Matthew Brost) - Remove TODO comment - Fix comment - Dont allow gpu atomic ops when user is setting atomic attr as CPU v5 (Matthew Brost) - Fix atomic checks - Add userptr checks Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-10-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit ada7486c5668db542a7d361268df931aca5b726a Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:52 2025 +0530 drm/xe: Implement madvise ioctl for xe This driver-specific ioctl enables UMDs to control the memory attributes for GPU VMAs within a specified input range. If the start or end addresses fall within an existing VMA, the VMA is split accordingly. The attributes of the VMA are modified as provided by the users. The old mappings of the VMAs are invalidated, and TLB invalidation is performed if necessary. v2(Matthew brost) - xe_vm_in_fault_mode can't be enabled by Mesa, hence allow ioctl in non fault mode too - fix tlb invalidation skip for same ranges in multiple op - use helper for tlb invalidation - use xe_svm_notifier_lock/unlock helper - s/lockdep_assert_held/lockdep_assert_held_write - Add kernel-doc v3(Matthew Brost) - make vfunc fail safe - Add sanitizing input args before vfunc v4(Matthew Brost/Shuicheng) - Make locks interruptable - Error handling fixes - vm_put fixes v5(Matthew Brost) - Flush garbage collector before any locking. - Add check for null vma Cc: Matthew Brost Cc: Shuicheng Lin Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-9-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 6ca463ef0d97a20eba559e699f0f6c4dd71e5011 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:51 2025 +0530 drm/xe/svm: Add xe_svm_ranges_zap_ptes_in_range() for PTE zapping Introduce xe_svm_ranges_zap_ptes_in_range(), a function to zap page table entries (PTEs) for all SVM ranges within a user-specified address range. -v2 (Matthew Brost) Lock should be called even for tlb_invalidation v3(Matthew Brost) - Update comment - s/notifier->itree.start/drm_gpusvm_notifier_start - s/notifier->itree.last + 1/drm_gpusvm_notifier_end - use WRITE_ONCE Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-8-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 6ad887f378c858ef3f721d5c1d8dad17842cc58b Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:50 2025 +0530 drm/xe: Allow CPU address mirror VMA unbind with gpu bindings for madvise In the case of the MADVISE ioctl, if the start or end addresses fall within a VMA and existing SVM ranges are present, remove the existing SVM mappings. Then, continue with ops_parse to create new VMAs by REMAP unmapping of old one. v2 (Matthew Brost) - Use vops flag to call unmapping of ranges in vm_bind_ioctl_ops_parse - Rename the function v3 - Fix doc v4 - check if range is already in garbage collector (Matthew Brost) Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-7-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 186b526abd6c20713d0dc9992ad736027e866a8d Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:49 2025 +0530 drm/xe/svm: Split system allocator vma incase of madvise call If the start or end of input address range lies within system allocator vma split the vma to create new vma's as per input range. v2 (Matthew Brost) - Add lockdep_assert_write for vm->lock - Remove unnecessary page aligned checks - Add kerrnel-doc and comments - Remove unnecessary unwind_ops and return v3 - Fix copying of attributes v4 - Nit fixes v5 - Squash identifier for madvise in xe_vma_ops to this patch v6/v7/v8 - Rebase on drm_gpuvm changes Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-6-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 29c39c56a08b238d1a069cd0e16adfbef30c4968 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:48 2025 +0530 drm/xe/vma: Modify new_vma to accept struct xe_vma_mem_attr as parameter This change simplifies the logic by ensuring that remapped previous or next VMAs are created with the same memory attributes as the original VMA. By passing struct xe_vma_mem_attr as a parameter, we maintain consistency in memory attributes. -v2 *dst = *src (Matthew Brost) -v3 (Matthew Brost) Drop unnecessary helper pass attr ptr as input to new_vma and vma_create Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-5-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 11974fe8c7eac3ee3f35dfe6696f097284bd67eb Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:47 2025 +0530 drm/xe/vma: Move pat_index to vma attributes The PAT index determines how PTEs are encoded and can be modified by madvise. Therefore, it is now part of the vma attributes. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-4-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 99a89e4e2d0c4e806af3dea4538c1fc9b208df3b Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:46 2025 +0530 drm/xe/vm: Add attributes struct as member of vma The attribute of xe_vma will determine the migration policy and the encoding of the page table entries (PTEs) for that vma. This attribute helps manage how memory pages are moved and how their addresses are translated. It will be used by madvise to set the behavior of the vma. v2 (Matthew Brost) - Add docs v3 (Matthew Brost) - Add uapi references - 80 characters line wrap Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250821173104.3030148-3-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 231bb0ee7aa5d1f0d077d3a30663f8ffd6860fa3 Author: Himal Prasad Ghimiray Date: Thu Aug 21 23:00:45 2025 +0530 drm/xe/uapi: Add madvise interface This commit introduces a new madvise interface to support driver-specific ioctl operations. The madvise interface allows for more efficient memory management by providing hints to the driver about the expected memory usage and pte update policy for gpuvma. v2 (Matthew/Thomas) - Drop num_ops support - Drop purgeable support - Add kernel-docs - IOWR/IOW v3 (Matthew/Thomas) - Reorder attributes - use __u16 for migration_policy - use __u64 for reserved in unions - Avoid usage of vma Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821173104.3030148-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 05db35963eef7a55f1782190185cb8ddb9d923b7 Author: Krishna Chaitanya Chundru Date: Wed Aug 20 13:58:47 2025 +0530 OPP: Add support to find OPP for a set of keys Some clients, such as PCIe, may operate at the same clock frequency across different data rates by varying link width. In such cases, frequency alone is not sufficient to uniquely identify an OPP. To support these scenarios, introduce a new API dev_pm_opp_find_key_exact() that allows OPP lookup with different set of keys like freq, level & bandwidth. Signed-off-by: Krishna Chaitanya Chundru [ Viresh: Minor cleanups ] Signed-off-by: Viresh Kumar commit 22763c35c635466545c0cea825da01c72becbcea Author: Onur Özkan Date: Thu Aug 21 12:16:05 2025 +0300 rust: opp: use to_result for error handling Simplifies error handling by replacing the manual check of the return value with the `to_result` helper. Signed-off-by: Onur Özkan Reviewed-by: Elle Rhumsaa Signed-off-by: Viresh Kumar commit 9d527c4f1417f5cf16dc50ff081f2be8562631f6 Merge: 41be792f5baaf9 1cd0c7afef97c3 Author: Lucas De Marchi Date: Mon Aug 25 22:08:34 2025 -0700 Merge drm/drm-next into drm-xe-next Sync with drm-misc-next which is necessary for changes in gpuvm and gpusvm that will be used in xe. Signed-off-by: Lucas De Marchi commit 41be792f5baaf90d744a9a9e82994ce560ca9582 Author: Carlos Llamas Date: Mon Aug 25 15:57:42 2025 +0000 drm/xe: switch to local xbasename() helper Commit b0a2ee5567ab ("drm/xe: prepare xe_gen_wa_oob to be multi-use") introduced a call to basename(). The GNU version of this function is not portable and fails to build with alternative libc implementations like musl or bionic. This causes the following build error: drivers/gpu/drm/xe/xe_gen_wa_oob.c:130:12: error: assignment to ‘const char *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 130 | fn = basename(fn); | ^ While a POSIX version of basename() could be used, it would require a separate header plus the behavior differs from GNU version in that it might modify its argument. Not great. Instead, implement a local xbasename() helper based on strrchr() that provides the same functionality and avoids portability issues. Fixes: b0a2ee5567ab ("drm/xe: prepare xe_gen_wa_oob to be multi-use") Suggested-by: Lucas De Marchi Reviewed-by: Tiffany Yang Signed-off-by: Carlos Llamas Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250825155743.1132433-1-cmllamas@google.com Signed-off-by: Lucas De Marchi commit ffdf968762e4fb3cdae54e811ec3525e67440a60 Author: Matthew Brost Date: Mon Aug 25 08:28:41 2025 -0700 drm/xe: Don't trigger rebind on initial dma-buf validation On the first validate of an imported dma-buf (initial bind), the device has no GPU mappings, so a rebind is unnecessary. Rebinding here is harmful in multi-GPU setups and for VMs using preempt-fence mode, as it would evict in-flight GPU work. v2: - Drop dma_buf_validated, check for XE_PL_SYSTEM (Thomas) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250825152841.3837378-1-matthew.brost@intel.com commit d6477ee38ccfbeaed885733c13f41d9076e2f94a Author: Francisco Gutierrez Date: Wed Jul 23 18:35:43 2025 +0000 scsi: pm80xx: Fix race condition caused by static variables Eliminate the use of static variables within the log pull implementation to resolve a race condition and prevent data gaps when pulling logs from multiple controllers in parallel, ensuring each operation is properly isolated. Signed-off-by: Francisco Gutierrez Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com Signed-off-by: Martin K. Petersen commit f4c227cc977f842855ab10de60aa4cd5dd644025 Merge: 4223bf833c8495 8e4f0b1ebcf218 Author: Alexei Starovoitov Date: Mon Aug 25 18:52:17 2025 -0700 Merge branch 'bpf-introduce-and-use-rcu_read_lock_dont_migrate' Menglong Dong says: ==================== bpf: introduce and use rcu_read_lock_dont_migrate migrate_disable() and rcu_read_lock() are used to together in many case in bpf. However, when PREEMPT_RCU is not enabled, rcu_read_lock() will disable preemption, which indicate migrate_disable(), so we don't need to call it in this case. In this series, we introduce rcu_read_lock_dont_migrate and rcu_read_unlock_migrate, which will call migrate_disable and migrate_enable only when PREEMPT_RCU enabled. And use rcu_read_lock_dont_migrate in bpf subsystem. Changes since V2: * make rcu_read_lock_dont_migrate() more compatible by using IS_ENABLED() Changes since V1: * introduce rcu_read_lock_dont_migrate() instead of rcu_migrate_disable() + rcu_read_lock() ==================== Link: https://patch.msgid.link/20250821090609.42508-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 8e4f0b1ebcf2180ab594f204f01279a666dadf3b Author: Menglong Dong Date: Thu Aug 21 17:06:09 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for trampoline.c Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in trampoline.c to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-8-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 427a36bb5504e0fb33398a4ccd523fce95514d83 Author: Menglong Dong Date: Thu Aug 21 17:06:08 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for bpf_prog_run_array_cg() Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in bpf_prog_run_array_cg to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-7-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit cf4303b70dfa0163753e9b03ca78e5122727d4b8 Author: Menglong Dong Date: Thu Aug 21 17:06:07 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for bpf_task_storage_free() Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in bpf_task_storage_free to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-6-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 68748f0397a356122bf9cf33ef77cabbff9c3e51 Author: Menglong Dong Date: Thu Aug 21 17:06:06 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for bpf_iter_run_prog() Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in bpf_iter_run_prog to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-5-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit f2fa9b906911407ca99d14aa9f4353fda7566bbc Author: Menglong Dong Date: Thu Aug 21 17:06:05 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for bpf_inode_storage_free() Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in bpf_inode_storage_free to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 8c0afc7c9c112eb6884bc7e443247f242b6d8a3e Author: Menglong Dong Date: Thu Aug 21 17:06:04 2025 +0800 bpf: use rcu_read_lock_dont_migrate() for bpf_cgrp_storage_free() Use rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() in bpf_cgrp_storage_free to obtain better performance when PREEMPT_RCU is not enabled. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250821090609.42508-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 1b93c03fb319d72a1f5f4723abd5df15ce40f4e2 Author: Menglong Dong Date: Thu Aug 21 17:06:03 2025 +0800 rcu: add rcu_read_lock_dont_migrate() migrate_disable() is called to disable migration in the kernel, and it is often used together with rcu_read_lock(). However, with PREEMPT_RCU disabled, it's unnecessary, as rcu_read_lock() will always disable preemption, which will also disable migration. Introduce rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate(), which will do the migration enable and disable only when PREEMPT_RCU. Signed-off-by: Menglong Dong Reviewed-by: Paul E. McKenney Link: https://lore.kernel.org/r/20250821090609.42508-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit e5e11f666d5c35086b89544bf1c512ccc80f1b9c Merge: 00f4699872d0e2 80a403427d35f6 Author: Martin K. Petersen Date: Mon Aug 25 21:40:27 2025 -0400 Merge patch series "mpi3mr: bug fixes and minor updates" Chandrakanth Patil says: This series contains mpi3mr driver fixes and minor updates. Link: https://lore.kernel.org/r/20250820084138.228471-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 80a403427d35f6c7d3706d1006f1115672199465 Author: Chandrakanth Patil Date: Wed Aug 20 14:11:38 2025 +0530 scsi: mpi3mr: Update driver version to 8.15.0.5.50 Bump driver version to 8.15.0.5.50 to match the latest release. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 4af864784d8000b67b4279e68283d9f3bf420c05 Author: Chandrakanth Patil Date: Wed Aug 20 14:11:37 2025 +0530 scsi: mpi3mr: Fix premature TM timeouts on virtual drives Task Management to virtual drives may timeout prematurely when using a static default timeout. Read Abort and Reset timeouts from Device Page 0 and apply the maximum of the firmware value and the default. This fixes premature TM failures on virtual drives. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit a4ca63001e1a8ac0b3e4a3333c6a49c8425be476 Author: Chandrakanth Patil Date: Wed Aug 20 14:11:36 2025 +0530 scsi: mpi3mr: Update MPI headers to revision 37 Sync MPI header files to revision 37 to match current firmware/spec definitions. No functional change. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-5-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit b7b2176e30fc8e57664e5a8a23387af66eb7f72b Author: Chandrakanth Patil Date: Wed Aug 20 14:11:35 2025 +0530 scsi: mpi3mr: Fix I/O failures during controller reset I/Os can race with controller reset and fail. Block requests at the mid layer when reset starts using scsi_host_block(), and resume with scsi_host_unblock() after reset completes. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 Author: Chandrakanth Patil Date: Wed Aug 20 14:11:34 2025 +0530 scsi: mpi3mr: Fix controller init failure on fault during queue creation Firmware can enter a transient fault while creating operational queues. The driver fails the load immediately. Add a retry loop that checks controller status and history bit after queue creation. If either indicates a fault, retry init up to a set limit before failing. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit d6c8e8b7c98c3cb326515ef4bc5c57e16ac5ae4e Author: Chandrakanth Patil Date: Wed Aug 20 14:11:33 2025 +0530 scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed During enclosure reboot or expander reset, firmware may report a link speed of 0 in "Device Add" events while the link is still coming up. The driver drops such devices, leaving them missing even after the link recovers. Fix this by treating link speed 0 as 1.5 Gbps during device addition so the device is exposed to the OS. The actual link speed will be updated later when link-up events arrive. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20250820084138.228471-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed Author: Bitterblue Smith Date: Tue Aug 19 21:46:02 2025 +0300 wifi: rtw88: Use led->brightness_set_blocking for PCI too Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by using the brightness_set_blocking member of struct led_classdev for PCI devices too. This one is allowed to sleep. bad: scheduling from the idle thread! nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary) nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE nix kernel: Hardware name: [REDACTED] nix kernel: Call Trace: nix kernel: nix kernel: dump_stack_lvl+0x63/0x90 nix kernel: dequeue_task_idle+0x2d/0x50 nix kernel: __schedule+0x191/0x1310 nix kernel: ? xas_load+0x11/0xd0 nix kernel: schedule+0x2b/0xe0 nix kernel: schedule_preempt_disabled+0x19/0x30 nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0 nix kernel: rtw_led_set+0x27/0x60 [rtw_core] nix kernel: led_blink_set_nosleep+0x56/0xb0 nix kernel: led_trigger_blink+0x49/0x80 nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] nix kernel: call_timer_fn+0x2f/0x140 nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] nix kernel: __run_timers+0x21a/0x2b0 nix kernel: run_timer_softirq+0x8e/0x100 nix kernel: handle_softirqs+0xea/0x2c0 nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5 nix kernel: __irq_exit_rcu+0xdc/0x100 nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90 nix kernel: nix kernel: nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20 nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450 nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0> nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246 nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000 nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400 nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003 nix kernel: ? cpuidle_enter_state+0xbc/0x450 nix kernel: cpuidle_enter+0x32/0x50 nix kernel: do_idle+0x1b1/0x210 nix kernel: cpu_startup_entry+0x2d/0x30 nix kernel: start_secondary+0x118/0x140 nix kernel: common_startup_64+0x13e/0x141 nix kernel: Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED") Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com commit ebea22c7f1b2f06f4ff0719d76bd19830cf25c9f Author: Ching-Te Ku Date: Tue Aug 19 11:44:28 2025 +0800 wifi: rtw89: coex: Limit Wi-Fi scan slot cost to avoid A2DP glitch When Wi-Fi is scanning at 2.4GHz, PTA will abort almost all the BT request. Once the Wi-Fi slot stay too long, BT audio device can not get enough data, audio glitch will happened. This patch limit 2.4Ghz Wi-Fi slot to 80ms while Wi-Fi is scanning to avoid audio glitch. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250819034428.26307-5-pkshih@realtek.com commit d47c1c6f321c115e9adc0f3e8c347b36060b440b Author: Ping-Ke Shih Date: Tue Aug 19 11:44:27 2025 +0800 wifi: rtw89: 8852c: update firmware crash trigger type for newer firmware The newer firmware (after 0.27.128.0) uses trigger type 1. Add an entry accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250819034428.26307-4-pkshih@realtek.com commit f0f3bf4b370cbd72a3dc63cb3a359677c4c27263 Author: Po-Hao Huang Date: Tue Aug 19 11:44:26 2025 +0800 wifi: rtw89: 8852a: report average RSSI to avoid unnecessary scanning 8852A uses single antenna during power save, when the loss between two antennas is too large, previous logic induces greater RSSI variation. Report the average beacon RSSI for connected AP to get more stable RSSI and less unnecessary scanning. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250819034428.26307-3-pkshih@realtek.com commit 4367000c0e33e0bf24e2b872ccb49527a20f87e5 Author: Po-Hao Huang Date: Tue Aug 19 11:44:25 2025 +0800 wifi: rtw89: 8852a: report per-channel noise level by get_survey ops To optimize roaming decisions, report per-channel noise levels during scans so supplicant can have a better view of the current channel condition. This allows it to prefer the APs operating on channels with lower noise levels. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250819034428.26307-2-pkshih@realtek.com commit df534e757321ae6efe848a6a787098c22a390ac6 Author: David Yang Date: Sun Aug 24 09:30:03 2025 +0800 net: phylink: remove stale an_enabled from doc state->an_enabled was removed by commit 4ee9b0dcf09f ("net: phylink: remove an_enabled") but is left in mac_config() doc, so clean it. Signed-off-by: David Yang Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250824013009.2443580-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 6d45984b97d1a5034caf323c0b814297e066a537 Merge: ee6960bdbb7449 382a4d9cb6dc07 Author: Jakub Kicinski Date: Mon Aug 25 17:53:40 2025 -0700 Merge branch 'tcp-follow-up-for-dccp-removal' Kuniyuki Iwashima says: ==================== tcp: Follow up for DCCP removal. As I mentioned in [0], TCP still has code for DCCP. This series cleans up such leftovers. [0]: https://patch.msgid.link/20250410023921.11307-3-kuniyu@amazon.com v1: https://lore.kernel.org/20250821061540.2876953-1-kuniyu@google.com ==================== Link: https://patch.msgid.link/20250822190803.540788-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 382a4d9cb6dc07643345e15c49738088a727d29b Author: Kuniyuki Iwashima Date: Fri Aug 22 19:07:01 2025 +0000 tcp: Move TCP-specific diag functions to tcp_diag.c. tcp_diag_dump() / tcp_diag_dump_one() is just a wrapper of inet_diag_dump_icsk() / inet_diag_dump_one_icsk(), respectively. Let's inline them in tcp_diag.c and move static callees as well. Note that inet_sk_attr_size() is merged into tcp_diag_get_aux_size(), and we remove inet_diag_handler.idiag_get_aux_size() accordingly. While at it, BUG_ON() is replaced with DEBUG_NET_WARN_ON_ONCE(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250822190803.540788-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f1241200cd66b3e25fd2a44dd961d9720e965aa1 Author: Kuniyuki Iwashima Date: Fri Aug 22 19:07:00 2025 +0000 tcp: Don't pass hashinfo to inet_diag helpers. These inet_diag functions required struct inet_hashinfo because they are shared by TCP and DCCP: * inet_diag_dump_icsk() * inet_diag_dump_one_icsk() * inet_diag_find_one_icsk() DCCP has gone, and we don't need to pass hashinfo down to them. Let's fetch net->ipv4.tcp_death_row.hashinfo directly in the first 2 functions. Note that inet_diag_find_one_icsk() don't need hashinfo since the previous patch. We will move TCP-specific functions to tcp_diag.c in the next patch. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250822190803.540788-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit cb16f4b6c73df4be16b74099f826fea30ef72426 Author: Kuniyuki Iwashima Date: Fri Aug 22 19:06:59 2025 +0000 tcp: Don't pass hashinfo to socket lookup helpers. These socket lookup functions required struct inet_hashinfo because they are shared by TCP and DCCP. * __inet_lookup_established() * __inet_lookup_listener() * __inet6_lookup_established() * inet6_lookup_listener() DCCP has gone, and we don't need to pass hashinfo down to them. Let's fetch net->ipv4.tcp_death_row.hashinfo directly in the above 4 functions. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250822190803.540788-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 8150f3a44b17cded59c4cfb71efd59f0a293c48e Author: Kuniyuki Iwashima Date: Fri Aug 22 19:06:58 2025 +0000 tcp: Remove hashinfo test for inet6?_lookup_run_sk_lookup(). Commit 6c886db2e78c ("net: remove duplicate sk_lookup helpers") started to check if hashinfo == net->ipv4.tcp_death_row.hashinfo in __inet_lookup_listener() and inet6_lookup_listener() and stopped invoking BPF sk_lookup prog for DCCP. DCCP has gone and the condition is always true. Let's remove the hashinfo test. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250822190803.540788-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 2d842b6c670b9bffee7c16cda284eb49644d8169 Author: Kuniyuki Iwashima Date: Fri Aug 22 19:06:57 2025 +0000 tcp: Remove timewait_sock_ops.twsk_destructor(). Since DCCP has been removed, sk->sk_prot->twsk_prot->twsk_destructor is always tcp_twsk_destructor(). Let's call tcp_twsk_destructor() directly in inet_twsk_free() and remove ->twsk_destructor(). While at it, tcp_twsk_destructor() is un-exported. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250822190803.540788-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9db0163e3cad57a36ac335308c17550c6911b7df Author: Kuniyuki Iwashima Date: Fri Aug 22 19:06:56 2025 +0000 tcp: Remove sk_protocol test for tcp_twsk_unique(). Commit 383eed2de529 ("tcp: get rid of twsk_unique()") added sk->sk_protocol test in __inet_check_established() and __inet6_check_established() to remove twsk_unique() and call tcp_twsk_unique() directly. DCCP has gone, and the condition is always true. Let's remove the sk_protocol test. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250822190803.540788-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ee6960bdbb74499516261b84eadb19acc01cb361 Merge: 3d1b3f4ffc0aca a7cc1aa151e3a9 Author: Jakub Kicinski Date: Mon Aug 25 17:16:03 2025 -0700 Merge branch 'net-airoha-add-ppe-support-for-rx-wlan-offload' Lorenzo Bianconi says: ==================== net: airoha: Add PPE support for RX wlan offload Introduce the missing bits to airoha ppe driver to offload traffic received by the MT76 driver (wireless NIC) and forwarded by the Packet Processor Engine (PPE) to the ethernet interface. v2: https://lore.kernel.org/20250822-airoha-en7581-wlan-rx-offload-v2-0-8a76e1d3fec2@kernel.org v1: https://lore.kernel.org/20250819-airoha-en7581-wlan-rx-offload-v1-0-71a097e0e2a1@kernel.org ==================== Link: https://patch.msgid.link/20250823-airoha-en7581-wlan-rx-offload-v3-0-f78600ec3ed8@kernel.org Signed-off-by: Jakub Kicinski commit a7cc1aa151e3a9c0314b995f06102f7763d3bd71 Author: Lorenzo Bianconi Date: Sat Aug 23 09:56:04 2025 +0200 net: airoha: Introduce check_skb callback in ppe_dev ops Export airoha_ppe_check_skb routine in ppe_dev ops. check_skb callback will be used by the MT76 driver in order to offload the traffic received by the wlan NIC and forwarded to the ethernet one. Add rx_wlan parameter to airoha_ppe_check_skb routine signature. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250823-airoha-en7581-wlan-rx-offload-v3-3-f78600ec3ed8@kernel.org Signed-off-by: Jakub Kicinski commit f45fc18b6de04483643e8aa2ab97737abfe03d59 Author: Lorenzo Bianconi Date: Sat Aug 23 09:56:03 2025 +0200 net: airoha: Add airoha_ppe_dev struct definition Introduce airoha_ppe_dev struct as container for PPE offload callbacks consumed by the MT76 driver during flowtable offload for traffic received by the wlan NIC and forwarded to the wired one. Add airoha_ppe_setup_tc_block_cb routine to PPE offload ops for MT76 driver. Rely on airoha_ppe_dev pointer in airoha_ppe_setup_tc_block_cb signature. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250823-airoha-en7581-wlan-rx-offload-v3-2-f78600ec3ed8@kernel.org Signed-off-by: Jakub Kicinski commit 524a43c3a0c17fa0a1223eea36751dcba55e5530 Author: Lorenzo Bianconi Date: Sat Aug 23 09:56:02 2025 +0200 net: airoha: Rely on airoha_eth struct in airoha_ppe_flow_offload_cmd signature Rely on airoha_eth struct in airoha_ppe_flow_offload_cmd routine signature and in all the called subroutines. This is a preliminary patch to introduce flowtable offload for traffic received by the wlan NIC and forwarded to the ethernet one. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250823-airoha-en7581-wlan-rx-offload-v3-1-f78600ec3ed8@kernel.org Signed-off-by: Jakub Kicinski commit 3d1b3f4ffc0aca15a0ebce0c71163b42a87efff2 Author: Daniel Golle Date: Fri Aug 22 18:38:49 2025 +0100 net: phy: mxl-86110: add basic support for MxL86111 PHY Add basic support for the MxL86111 PHY which in addition to the features of the MxL86110 also comes with an SGMII interface. Setup the interface mode and take care of in-band-an. Currently only RGMII-to-UTP and SGMII-to-UTP modes are supported while the PHY would also support RGMII-to-1000Base-X, including automatic selection of the Fiber or UTP link depending on the presence of a link partner. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/707fd83ec0e11ea620d37f2125a394e9dd1b27fa.1755884175.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit befbdee4ba8966410b0c8a1a38ab07e13c8331f2 Author: Daniel Golle Date: Fri Aug 22 18:38:39 2025 +0100 net: phy: mxl-86110: fix indentation in struct phy_driver The .led_hw_control_get and .led_hw_control_set ops are indented with spaces instead of tabs, unlike the rest of the values of the PHY's struct phy_driver instance. Use tabs instead of spaces resulting in a uniform indentation style. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/b9b7336ae309facc5e73874c62e64492fd749cc6.1755884175.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 29c10aeb316072aacb9ef4d0ebd6e0c9b0461ed3 Author: Daniel Golle Date: Fri Aug 22 18:38:27 2025 +0100 net: phy: mxl-86110: add basic support for led_brightness_set op Add support for forcing each connected LED to be always on or always off by implementing the led_brightness_set() op. This is done by modifying the COM_EXT_LED_GEN_CFG register to enable force-mode and forcing the LED either on or off. When calling the led_hw_control_set() force-mode is again disabled for that LED. Implement mxl86110_modify_extended_reg() locked helper instead of manually acquiring and releasing the MDIO bus lock for single __mxl86110_modify_extended_reg() calls. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/58eeefc8c24e06cd2110d3cefbd4236b1a4f44a2.1755884175.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit b8844aab519a154808dbce15a132f3e8f1c34af6 Author: Qingfang Deng Date: Fri Aug 22 09:25:47 2025 +0800 ppp: remove rwlock usage In struct channel, the upl lock is implemented using rwlock_t, protecting access to pch->ppp and pch->bridge. As previously discussed on the list, using rwlock in the network fast path is not recommended. This patch replaces the rwlock with a spinlock for writers, and uses RCU for readers. - pch->ppp and pch->bridge are now declared as __rcu pointers. - Readers use rcu_dereference_bh() under rcu_read_lock_bh(). - Writers use spin_lock() to update. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20250822012548.6232-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 60c481d4caa569001c708d4e9622d19650b6bedc Author: Yue Haibing Date: Fri Aug 22 14:40:51 2025 +0800 ipv6: mcast: Add ip6_mc_find_idev() helper Extract the same code logic from __ipv6_sock_mc_join() and ip6_mc_find_dev(), also add new helper ip6_mc_find_idev() to reduce redundancy and enhance readability. No functional changes intended. Signed-off-by: Yue Haibing Reviewed-by: Dawid Osuchowski Link: https://patch.msgid.link/20250822064051.2991480-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 411d7d70cdbb5d96c37d9c4101d8546319962c78 Author: Oleksij Rempel Date: Fri Aug 22 11:25:55 2025 +0200 net: usb: lan78xx: add support for generic net selftests via ethtool Integrate generic net_selftest framework by wiring up .get_strings, .get_sset_count, and .self_test ethtool ops. This enables execution of standard self-tests using `ethtool -t ` on LAN78xx devices. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250822092555.2888870-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit e887a196568fa1e68c673ccbdc78754b73b65fbe Merge: 3ad9655422733e 9bd999eb35cfcc Author: Jakub Kicinski Date: Mon Aug 25 16:21:01 2025 -0700 Merge branch 'tcp-annotate-data-races-around-icsk_retransmits-and-icsk_probes_out' Eric Dumazet says: ==================== tcp: annotate data-races around icsk_retransmits and icsk_probes_out icsk->icsk_retransmits is read locklessly from inet_sk_diag_fill(), tcp_get_timestamping_opt_stats, get_tcp4_sock() and get_tcp6_sock(). icsk->icsk_probes_out is read locklessly from inet_sk_diag_fill(), get_tcp4_sock() and get_tcp6_sock(). Add corresponding READ_ONCE()/WRITE_ONCE() annotations. ==================== Link: https://patch.msgid.link/20250822091727.835869-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9bd999eb35cfcc404fb640712f9023f51a303cbe Author: Eric Dumazet Date: Fri Aug 22 09:17:26 2025 +0000 tcp: annotate data-races around icsk->icsk_probes_out icsk->icsk_probes_out is read locklessly from inet_sk_diag_fill(), get_tcp4_sock() and get_tcp6_sock(). Add corresponding READ_ONCE()/WRITE_ONCE() annotations. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250822091727.835869-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit e6f178be3c12cd6b8fb1b81dd0b9118e0a0d0333 Author: Eric Dumazet Date: Fri Aug 22 09:17:25 2025 +0000 tcp: annotate data-races around icsk->icsk_retransmits icsk->icsk_retransmits is read locklessly from inet_sk_diag_fill(), tcp_get_timestamping_opt_stats, get_tcp4_sock() and get_tcp6_sock(). Add corresponding READ_ONCE()/WRITE_ONCE() annotations. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250822091727.835869-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3ad9655422733e0ba67512b3ddce638aee31c0c7 Merge: 7f052126ff38f4 bd0d9e751b9bea Author: Jakub Kicinski Date: Mon Aug 25 16:07:17 2025 -0700 Merge branch 'net-ipv4-allow-directed-broadcast-routes-to-use-dst-hint' Oscar Maes says: ==================== net: ipv4: allow directed broadcast routes to use dst hint Currently, ip_extract_route_hint uses RTN_BROADCAST to decide whether to use the route dst hint mechanism. This check is too strict, as it prevents directed broadcast routes from using the hint, resulting in poor performance during bursts of directed broadcast traffic. This series fixes this, and adds a new selftest to ensure this does not regress. Link to v2: https://lore.kernel.org/20250814140309.3742-1-oscmaes92@gmail.com ==================== Link: https://patch.msgid.link/20250819174642.5148-1-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit bd0d9e751b9beaaefb1cff012f41dc2098a932e3 Author: Oscar Maes Date: Tue Aug 19 19:46:42 2025 +0200 selftests: net: add test for dst hint mechanism with directed broadcast addresses Add a test for ensuring that the dst hint mechanism is used for directed broadcast addresses. This test relies on mausezahn for sending directed broadcast packets. Additionally, a high GRO flush timeout is set to ensure that packets will be received as lists. The test determines if the hint mechanism was used by checking the in_brd statistic using lnstat. Signed-off-by: Oscar Maes Link: https://patch.msgid.link/20250819174642.5148-3-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit 1b8c5fa0cb35efd08f07f700e6d78a541ebabe26 Author: Oscar Maes Date: Tue Aug 19 19:46:41 2025 +0200 net: ipv4: allow directed broadcast routes to use dst hint Currently, ip_extract_route_hint uses RTN_BROADCAST to decide whether to use the route dst hint mechanism. This check is too strict, as it prevents directed broadcast routes from using the hint, resulting in poor performance during bursts of directed broadcast traffic. Fix this in ip_extract_route_hint and modify ip_route_use_hint to preserve the intended behaviour. Signed-off-by: Oscar Maes Reviewed-by: David Ahern Link: https://patch.msgid.link/20250819174642.5148-2-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit 7f052126ff38f497cc8721f0b0e99aa201cd5a7f Author: Krzysztof Kozlowski Date: Thu Aug 21 10:30:40 2025 +0200 dt-bindings: net: Drop vim style annotation Bindings files should not carry markings of editor setup, so drop vim style annotation. No functional impact. Signed-off-by: Krzysztof Kozlowski Acked-by: Gabriel Somlo Link: https://patch.msgid.link/20250821083038.46274-4-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit bc2741b032f8bbf2e46085ba9c674c094f396253 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:30:39 2025 +0200 dt-bindings: net: litex,liteeth: Correct example indentation DTS example in the bindings should be indented with 2- or 4-spaces, so correct a mixture of different styles to keep consistent 4-spaces. Signed-off-by: Krzysztof Kozlowski Acked-by: Gabriel Somlo Link: https://patch.msgid.link/20250821083038.46274-3-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit e79012967b26134f507efe93ec4b4e6c13d92950 Author: Alessandro Ratti Date: Fri Aug 22 16:03:40 2025 +0200 selftests: rtnetlink: skip tests if tools or feats are missing Some rtnetlink selftests assume the presence of ifconfig and iproute2 support for the `proto` keyword in `ip address` commands. These assumptions can cause test failures on modern systems (e.g. Debian Bookworm) where: - ifconfig is not installed by default - The iproute2 version lacks support for address protocol This patch improves test robustness by: - Skipping kci_test_promote_secondaries if ifconfig is missing - Skipping do_test_address_proto if ip address help does not mention proto These changes ensure the tests degrade gracefully by reporting SKIP instead of FAIL when prerequisites are not met, improving portability across systems. Reviewed-by: Hangbin Liu Signed-off-by: Alessandro Ratti Link: https://patch.msgid.link/20250822140633.891360-2-alessandro@0x65c.net Signed-off-by: Jakub Kicinski commit 6e8e6baf16ce7d2310959ae81d0194a56874e0d2 Merge: 992e9f53a0db0b 8a7576d220c1d0 Author: Jakub Kicinski Date: Mon Aug 25 15:15:51 2025 -0700 Merge branch 'net-dsa-lantiq_gswip-prepare-for-supporting-new-features' Daniel Golle says: ==================== net: dsa: lantiq_gswip: prepare for supporting new features Prepare for supporting the newer standalone MaxLinear GSW1xx switch family by refactoring the existing lantiq_gswip driver. This is the first of a total of 3 series and doesn't yet introduce any functional changes, but rather just makes the driver more flexible, so new hardware and features can be supported in future. This series has been preceded by an RFC series which covers everything needed to support the MaxLinear GSW1xx family of switches. Andrew Lunn had suggested to start with the 8 patches now submitted as they prepare but don't yet introduce any functional changes. Everything has been compile and runtime tested on AVM Fritz!Box 7490 (GSWIP version 2.1, VR9 v1.2) Link: https://lore.kernel.org/aKDhFCNwjDDwRKsI@pidgin.makrotopia.org ==================== Link: https://patch.msgid.link/cover.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 8a7576d220c1d01a96fe2e7e537315013a71159e Author: Daniel Golle Date: Fri Aug 22 17:12:21 2025 +0100 net: dsa: lantiq_gswip: store switch API version in priv Store the switch API version in struct gswip_priv. As the hardware has the 'major/minor' version bytes in the wrong order preventing numerical comparisons the version to be stored in gswip_priv is constructed in such a way that the REV field is the most significant byte and the MOD field the least significant byte. Also provide a conveniance macro to allow comparing the stored version of the hardware against the already defined GSWIP_VERSION_* macros. This is done in order to prepare supporting newer features such as 4096 VLANs and per-port configurable learning which are only available starting from specific hardware versions. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/eddb51ae8d0b2046ca91906e93daad7be5af56d7.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 1ccc407285e284393f85b6c39f52e11b04a0694b Author: Daniel Golle Date: Fri Aug 22 17:12:13 2025 +0100 net: dsa: lantiq_gswip: make DSA tag protocol model-specific While the older Lantiq / Intel which are currently supported all use the DSA_TAG_GSWIP tagging protocol, newer MaxLinear GSW1xx modules use another 8-byte tagging protocol. Move the tag protocol information to struct gswip_hw_info to make it possible for new models to specify a different tagging protocol. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/841281b62fdb472048fa98fbad6c88dfbf512825.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 2e5311d3782fbdb6f858fd8975eb57e8a8344d57 Author: Daniel Golle Date: Fri Aug 22 17:12:06 2025 +0100 net: dsa: lantiq_gswip: load model-specific microcode Load microcode as specified in struct hw_info instead of relying on a single array of instructions. This is done in preparation to allow loading different microcode for the MaxLinear GSW1xx family. Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/486d95c085913d506745fbe4a0ab5d1ebdc3ed63.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit dc6156976d2efd95173b81ef468e03236780a652 Author: Daniel Golle Date: Fri Aug 22 17:11:57 2025 +0100 net: dsa: lantiq_gswip: introduce bitmap for MII ports Instead of relying on hard-coded numbers for MII ports, introduce a bitmap for MII ports. This is done in order to prepare for supporting MaxLinear GSW1xx ICs which got a different layout of ports. Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/019fc8ed06f2317976eac143320d1dc046e8f392.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 476c001a554dd577073a1b9e8a7ff0889632d31f Author: Daniel Golle Date: Fri Aug 22 17:11:48 2025 +0100 net: dsa: lantiq_gswip: move definitions to header Introduce header file and move register definitions as well as the definitions struct gswip_hw_info and struct gswip_priv there. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/551c72c93131cd200b38340741e68ff21793ba0b.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 2bec1c3836990d1159d2fe113f3ffddb48b9e040 Author: Daniel Golle Date: Fri Aug 22 17:11:39 2025 +0100 net: dsa: lantiq_gswip: prepare for more CPU port options The MaxLinear GSW1xx series of switches support using either the (R)(G)MII interface on port 5 or the SGMII interface on port 4 to be used as CPU port. Prepare for supporting them by defining a mask of allowed CPU ports instead of a single port. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/879c66672d26fe49c1f5d9aa40d8ebc0f31885ab.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit fa1439a865830ec3b599114e7cc907f5ad126b07 Author: Daniel Golle Date: Fri Aug 22 17:11:30 2025 +0100 net: dsa: lantiq_gswip: deduplicate dsa_switch_ops The two instances of struct dsa_switch_ops differ only by their .phylink_get_caps op. Instead of having two instances of dsa_switch_ops, rather just have a pointer to the phylink_get_caps function in struct gswip_hw_info. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/03d72eceeb3faecdbe03ce58aab40861cf6b77c1.1755878232.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit d02c71cba7bba453d233a49497412ddbf2d44871 Author: Brian Masney Date: Mon Aug 11 11:18:43 2025 -0400 clk: spacemit: ccu_pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Haylen Chu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250811-clk-for-stephen-round-rate-v1-51-b3bf97b038dc@redhat.com Signed-off-by: Yixun Lan commit 56737edda7db58549550776092da12fe03600399 Author: Brian Masney Date: Mon Aug 11 11:18:42 2025 -0400 clk: spacemit: ccu_mix: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Haylen Chu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250811-clk-for-stephen-round-rate-v1-50-b3bf97b038dc@redhat.com Signed-off-by: Yixun Lan commit b4a7b0d2c4485d11d37dec721709660f3967efcf Author: Brian Masney Date: Mon Aug 11 11:18:41 2025 -0400 clk: spacemit: ccu_ddn: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Haylen Chu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250811-clk-for-stephen-round-rate-v1-49-b3bf97b038dc@redhat.com Signed-off-by: Yixun Lan commit a728ce8ffbd27954fdb2826dcc15a6576e574b83 Author: Xichao Zhao Date: Wed Aug 13 19:50:58 2025 +0800 binfmt_elf: Replace offsetof() with struct_size() in fill_note_info() When dealing with structures containing flexible arrays, struct_size() provides additional compile-time checks compared to offsetof(). This enhances code robustness and reduces the risk of potential errors. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250813115058.635742-1-zhao.xichao@vivo.com Signed-off-by: Kees Cook commit d4399e6eb27a803b73d17fe984448a823b4d3a30 Author: Andy Shevchenko Date: Mon Aug 25 18:32:57 2025 +0200 floppy: Sort headers alphabetically Sorting headers alphabetically helps locating duplicates, and makes it easier to figure out where to insert new headers. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250825163545.39303-4-andriy.shevchenko@linux.intel.com Signed-off-by: Jens Axboe commit 8e7ee0f6fa33934373c1c37e8cfb71cff2acea09 Author: Andy Shevchenko Date: Mon Aug 25 18:32:56 2025 +0200 floppy: Replace custom SZ_64K constant There are only two headers using the K_64 custom constant. Moreover, its usage tangles a code because the constant is defined in the C file, while users are in the headers. Replace it with well defined SZ_64K from sizes.h. Acked-by: Helge Deller Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250825163545.39303-3-andriy.shevchenko@linux.intel.com Signed-off-by: Jens Axboe commit d74968780bf287958e2815be5f088dd6c7b7aa19 Author: Andy Shevchenko Date: Mon Aug 25 18:32:55 2025 +0200 floppy: Remove unused CROSS_64KB() macro from arch/ code Since the commit 3d86739c6343 ("floppy: always use the track buffer") the CROSS_64KB() is not used by the driver, remove the leftovers. Acked-by: Helge Deller #parisc Acked-by: Geert Uytterhoeven # m68k Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250825163545.39303-2-andriy.shevchenko@linux.intel.com Signed-off-by: Jens Axboe commit f5d10e6915d80f7f4c4ed445a8b8ba4a5ee79318 Author: Bart Van Assche Date: Mon Aug 25 08:14:24 2025 -0700 block: Move a misplaced comment in queue_wb_lat_store() blk_mq_quiesce_queue() does not wait for pending I/O to finish. Freezing a queue waits for pending I/O to finish. Hence move the comment that refers to waiting for pending I/O above the call that freezes the request queue. This patch moves this comment back to the position where it was when this comment was introduced. See also commit c125311d96b1 ("blk-wbt: don't maintain inflight counts if disabled"). Cc: Christoph Hellwig Cc: Nilay Shroff Signed-off-by: Bart Van Assche Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250825151424.1653910-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit a12b74d2bd4724ee1883bc97ec93eac8fafc8d3c Author: Matthias Schiffer Date: Mon Aug 25 14:11:38 2025 +0200 ASoC: tlv320aic32x4: use dev_err_probe() for regulators Avoid error messages like the following when the regulators have not been probed yet: tlv320aic32x4 0-0018: Missing supply 'iov' tlv320aic32x4 0-0018: Failed to setup regulators Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Message-ID: <20250825121139.2150099-1-alexander.stein@ew.tq-group.com> Signed-off-by: Mark Brown commit a16a3cb07140a094ffd918290cef76135876b532 Author: Bartosz Golaszewski Date: Fri Aug 15 13:17:33 2025 +0200 gpio: sim: don't use GPIO base in debugfs output We're in the process of removing unneeded references to the global GPIO base number treewide. Use the HW offset instead of the base number. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250815111733.79283-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 38623d532c99ebd926f4eebb7c7de19cb7e5aef4 Author: Linus Walleij Date: Fri Aug 22 17:46:28 2025 +0200 gpio: mmio: Add compatible for the ixp4xx eb MMIO The IXP4xx expansion bus can have simple memory-mapped GPIO on it. Using the proper device tree bindings, support probing this directly from the device tree. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250822-ixp4xx-eb-mmio-gpio-v2-3-bd2edd4a9c74@linaro.org Signed-off-by: Bartosz Golaszewski commit 1f3c076063f03999c351c0725adf744ef5660733 Author: Linus Walleij Date: Fri Aug 22 17:46:27 2025 +0200 dt-bindings: gpio-mmio: Add MMIO for IXP4xx expansion bus This expansion is a simple MMIO-mapped GPIO device but the bus has a number of additional properties that we need to bring in using a reference to the bus child node schema. Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250822-ixp4xx-eb-mmio-gpio-v2-2-bd2edd4a9c74@linaro.org Signed-off-by: Bartosz Golaszewski commit 545908a9fb9c01e1bd7afe040f5623f561d50ea0 Author: Linus Walleij Date: Fri Aug 22 17:46:26 2025 +0200 dt-bindings: gpio-mmio: Support hogs We use hogs on some MMIO GPIO controllers so make sure the bindings support this using a pattern property. Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250822-ixp4xx-eb-mmio-gpio-v2-1-bd2edd4a9c74@linaro.org Signed-off-by: Bartosz Golaszewski commit 39c87887606e5197723616c909d1f3054792f0dd Author: Chelsy Ratnawat Date: Sat Aug 23 15:03:11 2025 -0700 ACPI: Use str_low_high() helper in two places Replace hard-coded string choices with the str_low_high() helper in two places in the ACPI code. Signed-off-by: Chelsy Ratnawat Link: https://patch.msgid.link/20250823220311.2035533-1-chelsyratnawat2001@gmail.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 149139ddcb99583fdec8d1eaf7dada41e5896101 Author: Kaushlendra Kumar Date: Fri Aug 22 11:49:46 2025 +0530 ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(), it should be free with ACPI_FREE() rather than with kfree(), so use the former instead of the latter for freeing it. Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20250822061946.472594-1-kaushlendra.kumar@intel.com [ rjw: Subject and changelog rewrite ] Signed-off-by: Rafael J. Wysocki commit 2c98144fc832b35c4e9293a3bfc518608d6f5145 Author: Chen Ridong Date: Mon Aug 25 03:23:52 2025 +0000 cpuset: add helpers for cpus read and cpuset_mutex locks cpuset: add helpers for cpus_read_lock and cpuset_mutex locks. Replace repetitive locking patterns with new helpers: - cpuset_full_lock() - cpuset_full_unlock() This makes the code cleaner and ensures consistent lock ordering. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit ada00d51622822b151e1b8cc2bc85a20d2191349 Author: Chen Ridong Date: Mon Aug 25 03:23:51 2025 +0000 cpuset: separate tmpmasks and cpuset allocation logic The original alloc_cpumasks() served dual purposes: allocating cpumasks for both temporary masks (tmpmasks) and cpuset structures. This patch: 1. Decouples these allocation paths for better code clarity 2. Introduces dedicated alloc_tmpmasks() and dup_or_alloc_cpuset() functions 3. Maintains symmetric pairing: - alloc_tmpmasks() ↔ free_tmpmasks() - dup_or_alloc_cpuset() ↔ free_cpuset() Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 5806b3d05165568eee665399d3c04349c151a0b9 Author: Chen Ridong Date: Mon Aug 25 03:23:50 2025 +0000 cpuset: decouple tmpmasks and cpumasks freeing in cgroup Currently, free_cpumasks() can free both tmpmasks and cpumasks of a cpuset (cs). However, these two operations are not logically coupled. To improve code clarity: 1. Move cpumask freeing to free_cpuset() 2. Rename free_cpumasks() to free_tmpmasks() This change enforces the single responsibility principle. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 8d2a75589599fd8cd5c542c8052642445652ca5e Author: Tiffany Yang Date: Fri Aug 22 19:21:28 2025 -0700 cgroup: Fix 64-bit division in cgroup.stat.local Fix the following build error for 32-bit systems: arm-linux-gnueabi-ld: kernel/cgroup/cgroup.o: in function `cgroup_core_local_stat_show': >> kernel/cgroup/cgroup.c:3781:(.text+0x28f4): undefined reference to `__aeabi_uldivmod' arm-linux-gnueabi-ld: (__aeabi_uldivmod): Unknown destination type (ARM/Thumb) in kernel/cgroup/cgroup.o >> kernel/cgroup/cgroup.c:3781:(.text+0x28f4): dangerous relocation: unsupported relocation Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508230604.KyvqOy81-lkp@intel.com/ Signed-off-by: Tiffany Yang Cc: Tejun Heo Signed-off-by: Tejun Heo commit 2aa35b24ad12fb960d30e9e282f768e1a0af9291 Author: Qianfeng Rong Date: Thu Aug 21 15:22:09 2025 +0800 RDMA/erdma: Use vcalloc() instead of vzalloc() Replace vzalloc() with vcalloc() in vmalloc_to_dma_addrs(). As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Use vcalloc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. [1]: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Link: https://patch.msgid.link/r/20250821072209.510348-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Reviewed-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 Author: Mario Limonciello (AMD) Date: Wed Aug 20 12:09:26 2025 -0500 ACPI: video: force native for Lenovo 82K8 Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec. Add a quirk to prevent using it. Reported-by: Wilson Alvarez Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512 Tested-by: Wilson Alvarez Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 992e9f53a0db0bec0b24778e822807ee609fbd3f Author: Jakub Kicinski Date: Fri Aug 22 12:56:45 2025 -0700 selftests: drv-net: xdp: make sure we're actually testing native XDP Kernel tries to be helpful and attach the XDP program in generic mode if the driver has no BPF ndo at all. Since the xdp.py tests all have "native" in their names this can be quite confusing. Force native / "drv" attachment. Note that netdevsim re-uses the generic handler as its "native" handler, so we'll maintain the test coverage of the generic mode that way. No need to test both explicitly, I reckon. Link: https://patch.msgid.link/20250822195645.1673390-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a50522c805a6c575c80f41b04706e084d814e116 Author: Chelsy Ratnawat Date: Fri Aug 22 05:43:39 2025 -0700 bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions Use sysfs_emit() instead of snprintf()/sprintf() when writing to sysfs buffers, as recommended by the kernel documentation. Signed-off-by: Chelsy Ratnawat Acked-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250822124339.1739290-1-chelsyratnawat2001@gmail.com Signed-off-by: Christophe Leroy commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae Author: Salah Triki Date: Mon Aug 25 10:34:35 2025 +0100 bus: fsl-mc: Check return value of platform_get_resource() platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference. Fixes: 6305166c8771 ("bus: fsl-mc: Add ACPI support for fsl-mc") Cc: stable@vger.kernel.org Signed-off-by: Salah Triki Acked-by: Ioana Ciornei Link: https://lore.kernel.org/r/aKwuK6TRr5XNYQ8u@pc Signed-off-by: Christophe Leroy commit 444b02ce3f5cd4ba4cc06f3f0166a1b1ed73aadf Merge: b1c92cdf5af319 fb4b9f13718c60 Author: Jakub Kicinski Date: Mon Aug 25 10:54:18 2025 -0700 Merge branch 'aquantia-phy-driver-consolidation-part-1' Vladimir Oltean says: ==================== Aquantia PHY driver consolidation - part 1 This started out as an effort to add some new features hinging on the VEND1_GLOBAL_CFG_* registers, but I quickly started to notice that the Aquantia PHY driver has a large code base, but individual PHYs only implement arbitrary subsets of it. The table below lists the PHYs known to me to have the VEND1_GLOBAL_CFG_* registers. PHY Access from Access from aqr107_read_rate() aqr113c_fill_interface_modes() ------------------------------------------------------------------ AQR107 y n AQCS109 y n AQR111 y n AQR111B0 y n AQR112 y n AQR412 y n AQR113 y y AQR113C y y AQR813 y n AQR114C y n AQR115C y y Maybe you're wondering, after reading this, why don't more Aquantia PHYs populate phydev->possible_interfaces based on the registers that they are known to have? And why do AQR114C and AQR115C, PHYs from the same generation, just having different max speeds, differ in this behaviour? And why does AQR813, the 8-port variant of AQR113, not call aqr113c_config_init(), but aqr107_config_init()? I did wonder, and I don't know either, but I suspect it has to do with developers not wanting to break what they can't test, and only touching what they are interested in. Multiplied at a large enough scale, this tends to result in unmaintainable code. The tendency might also be encouraged by the slightly strange and inconsistent naming scheme in this driver. The set proposes a naming scheme based on generations, and feature inheritance from Gen X to Gen X+1. This helps fill in missing software functionalities where the hardware feature should be present. I had to put a hard stop at 15 patches, so I've picked the more meaningful functions to consolidate, rather than going through the entire driver. Depending on review feedback, I can do more or I can stop. Furthermore, the set adds generation-appropriate support for two more PHY IDs: AQR412 and AQR115, and fixes the improper reporting of AQR412C as AQR412. The changes were tested on AQR107, AQR112, AQR412C and AQR115. ==================== Link: https://patch.msgid.link/20250821152022.1065237-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit fb4b9f13718c60aa76c702cc25bfbe24b4b1d0b8 Author: Camelia Groza Date: Thu Aug 21 18:20:22 2025 +0300 net: phy: aquantia: add support for AQR115 AQR115 is similar to the already supported AQR115C, having speeds up to 2.5Gbps. In fact, the two differ only in the FCBGA package size (7x11mm vs 7x7mm for the Compact variant). So it makes sense that the feature set is identical for the 2 drivers. This PHY is present on the newest PCB revision E (v4.0) of the NXP LS1046A-RDB, having replaced the RTL8211FS SGMII PHY going to fm1-mac5. Signed-off-by: Camelia Groza Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-16-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9dfe80a8157ba5bb403b46f8cdfed2affe716c6b Author: Vladimir Oltean Date: Thu Aug 21 18:20:21 2025 +0300 net: phy: aquantia: promote AQR813 and AQR114C to aqr_gen4_config_init() I'm not sure whether there is any similar real-life problem on AQR813 and AQR114C as were seen on the PHYs that these commit were written for: - a7f3abcf6357 ("net: phy: aquantia: only poll GLOBAL_CFG regs on aqr113, aqr113c and aqr115c") - bed90b06b681 ("net: phy: aquantia: clear PMD Global Transmit Disable bit during init") but the inconsistency in handling between PHYs of the same generation is striking. Apart from different firmware builds with different provisioning, the only difference between these PHYs should be the max link speed and/or the number of ports. Let's try and see if there's any problem if all PHYs from the same generation use the same config_init() method. Cc: Bartosz Golaszewski Cc: Robert Marko Cc: Paweł Owoc Cc: Christian Marangi Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-15-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 3c904dd67f50c5aed78d38dc72d8631ff3976217 Author: Vladimir Oltean Date: Thu Aug 21 18:20:20 2025 +0300 net: phy: aquantia: rename aqr113c_config_init() to aqr_gen4_config_init() aqr113c_config_init() is called by AQR113, AQR113C, AQR115C, all Gen4 PHYs. Thus, rename this to aqr_gen4_config_init(). Currently, aqr113c_config_init() calls aqr_gen2_config_init(). Since we've established that these are Gen4 PHYs, it makes sense to inherit the Gen3 feature set as well. Currently, aqr_gen3_config_init() just calls aqr_gen2_config_init(), so we can safely make this extra modification and expect no functional change. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-14-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ed1106f7f9269f583137cce5917621b2781e5c95 Author: Vladimir Oltean Date: Thu Aug 21 18:20:19 2025 +0300 net: phy: aquantia: reimplement aqcs109_config_init() as aqr_gen2_config_init() I lack documentation for AQCS109, but from commit 99c864667c9f ("net: phy: aquantia: add support for AQCS109"), it is known that "From software point of view, it should be almost equivalent to AQR107." Based on further conjecture of the device numbering scheme, I am treating it as similar to AQR109 (a Gen2 PHY capable of to 2.5G). Its current instructions are also present in other init sequences as below: - aqr_wait_reset_complete() ... aqr107_chip_info() as well as aqr107_set_downshift() are in aqr_gen1_config_init() - aqr_gen2_fill_interface_modes() is in aqr_gen2_config_init() So it would be good to centralize this implementation by just calling aqr_gen2_config_init(). In practice this completes support for the following features, which are present on AQR109 already: - Potentially reverse MDI lane order via "marvell,mdi-cfg-order" - Restore polarity of active-high and active-low LEDs after reset. Cc: Nikita Yushchenko Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-13-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 2d9503217520880c80c58ee380d2a8bf7311dd49 Author: Vladimir Oltean Date: Thu Aug 21 18:20:18 2025 +0300 net: phy: aquantia: call aqr_gen3_config_init() for AQR112 and AQR412(C) The AQrate Gen3 PHYs are AQR111(C), AQR112(C), and their multi-port variants, like AQR411(C), AQR412(C). Currently, AQR112, AQR412 and AQR412C are Gen3 PHYs supported by the driver which have no config_init() implementation. I have hardware and documentation that confirms they are compatible with the operations done in aqr_gen2_config_init(), a Gen2-level function. This is needed as a preparation for reading cached registers in aqr_gen2_read_status(), which is a function that these PHYs already call. The initial reading is done from: aqr_gen2_config_init() -> aqr_gen2_fill_interface_modes() -> aqr_gen2_read_global_syscfg() thus the need for them to also call aqr_gen2_config_init(), in order for the cached register values to be available. In expectation of Gen3-specific features, introduce aqr_gen3_config_init() which calls aqr_gen2_config_init(). Also modify the AQR111 silicon variants to call their generation-appropriate init function. No functional change for these, hence the minor mention. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-12-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 02a7f5a92545ef99fc503fd8a86a686d29ce0974 Author: Vladimir Oltean Date: Thu Aug 21 18:20:17 2025 +0300 net: phy: aquantia: call aqr_gen2_fill_interface_modes() for AQCS109 I don't have documentation or hardware to test, but according to commit 99c864667c9f ("net: phy: aquantia: add support for AQCS109"), "From software point of view, it should be almost equivalent to AQR107." I am relatively confident that the GLOBAL_CFG registers read by aqr_gen2_fill_interface_modes() are supported, because aqr_gen2_read_status(), currently used by AQCS109, also reads them, and I'm unaware of any reported problem. The change is necessary because a future patch will introduce a requirement for all aqr_gen2_read_status() callers to have previously called aqr_gen2_read_global_syscfg(). This is done through aqr_gen2_fill_interface_modes(). Cc: Nikita Yushchenko Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-11-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit c03c97e55f6291b05a9b8cf7e5eafe2432182606 Author: Vladimir Oltean Date: Thu Aug 21 18:20:16 2025 +0300 net: phy: aquantia: merge and rename aqr105_read_status() and aqr107_read_status() aqr105_read_status() and aqr107_read_status() are very similar. In fact, they are identical, save from a code snippet accessing a Gen2 feature (rate adaptation), placed at the end of aqr107_read_rate(), and absent from aqr105_read_rate(). The code structure is: aqr105_read_status() aqr107_read_status() -> aqr105_read_rate() -> aqr107_read_rate() After the recent change "net: phy: aquantia: use cached GLOBAL_CFG registers in aqr107_read_rate()", it is absolutely trivial to restructure the code as follows: aqr_gen2_read_status() -> aqr_gen1_read_status() -> Gen2-specific stuff (read GLOBAL_CFG registers to set rate_matching) Doing so reduces code duplication. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-10-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 832b63c70ef0fa40747627c78c5b849dbe6e6615 Author: Vladimir Oltean Date: Thu Aug 21 18:20:15 2025 +0300 net: phy: aquantia: use cached GLOBAL_CFG registers in aqr107_read_rate() aqr107_read_rate() - called from aqr107_read_status() even periodically if there is no PHY IRQ - currently reads GLOBAL_CFG registers to determine what kind of rate adaptation is in use for the current phydev->speed. However, GLOBAL_CFG registers are runtime invariants, so accessing the slow MDIO bus is unnecessary. Reimplement aqr107_read_rate() by reading from the priv->global_cfg[i].rade_adapt variables (where i is the entry corresponding to the current phydev->speed). Making this change also helps disentangle the code delta between aqr105_read_rate() and aqr107_read_rate(). They are now identical up to the code snippet which iterates over priv->global_cfg[]. This will help eliminate the duplicate code in the upcoming patch. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-9-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6fa022088b60338cf995c9238fe16bcea5c27484 Author: Vladimir Oltean Date: Thu Aug 21 18:20:14 2025 +0300 net: phy: aquantia: remove handling for get_rate_matching(PHY_INTERFACE_MODE_NA) After commit 7642cc28fd37 ("net: phylink: fix PHY validation with rate adaption"), the API contract changed and PHY drivers are no longer required to respond to the .get_rate_matching() method for PHY_INTERFACE_MODE_NA. This was later followed up by documentation commit 6d4cfcf97986 ("net: phy: Update documentation for get_rate_matching"). As such, handling PHY_INTERFACE_MODE_NA in the Aquantia PHY driver implementation of this method is unnecessary and confusing. Remove it. Cc: Sean Anderson Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250821152022.1065237-8-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 08048ba4285eef925cf0dc9dbcef150d31b32ce6 Author: Vladimir Oltean Date: Thu Aug 21 18:20:13 2025 +0300 net: phy: aquantia: save a local shadow of GLOBAL_CFG register values Currently, aqr_gen2_fill_interface_modes() reads VEND1_GLOBAL_CFG_* registers to populate phydev->supported_interfaces. But this is not the only place which needs to read these registers. There is also aqr107_read_rate(). Based on the premise that these values are statically set by firmware and the driver only needs to read them, the proposal is to read them only once, at config_init() time, and use the cached values also in aqr107_read_rate(). This patch only refactors the aqr_gen2_fill_interface_modes() code to save the registers to driver memory, and to populate supported_interfaces based on that. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ab1dfcb5bce1f32807eb7110ca7e98c2afb72041 Author: Vladimir Oltean Date: Thu Aug 21 18:20:12 2025 +0300 net: phy: aquantia: fill supported_interfaces for all aqr_gen2_config_init() callers Since aqr_gen2_config_init() and aqr_gen2_fill_interface_modes() refer to the feature set common to the same generation, it means all callers of aqr_gen2_config_init() also support the Global System Configuration registers at addresses 1E.31B -> 1E.31F, and these should be read by the driver to figure out the list of supported interfaces for phylink. This affects the following PHYs supported by this driver: - Gen2: AQR107 - Gen3: AQR111, AQR111B0 - Gen4: AQR114C, AQR813. AQR113C, a Gen4 PHY, has unmodified logic after this change, because currently, the aqr_gen2_fill_interface_modes() call is chained after aqr_gen2_config_init(), and after this patch, it is tail-called from the latter function, leading to the same code flow. At the same time, move aqr_gen2_fill_interface_modes() upwards of its new caller, aqr_gen2_config_init(), to avoid a forward declaration. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9731bcf202e653e63a4bcae2a6e82d3c3528e438 Author: Vladimir Oltean Date: Thu Aug 21 18:20:11 2025 +0300 net: phy: aquantia: rename some aqr107 functions according to generation Establish a more intuitive function naming convention in this driver. A GenX PHY must only call aqr_genY_ functions, where Y <= X. Loosely speaking, aqr107_ is representative of Gen2 and above, except for: - aqr107_config_init() - aqr107_suspend() - aqr107_resume() - aqr107_wait_processor_intensive_op() which are also called by AQR105, so these are renamed to Gen1. Actually aqr107_config_init() is renamed to aqr_gen1_config_init() when called by AQR105, and aqr_gen2_config_init() when called by all other PHYs. The Gen2 function calls the Gen1 function, so there is no functional change. This prefaces further Gen2-specific initialization steps which must be omitted for AQR105. These will be added to aqr_gen2_config_init(). In fact, many PHY drivers call an aqr*_config_init() beneath their generation's feature set: AQR114C is a Gen4 PHY which calls aqr_gen2_config_init(), even though AQR113C, also a Gen4 PHY which differs only in maximum link speed, calls the richer aqr113c_config_init() which also sets phydev->possible_interfaces. Many of the more subtle inconsistencies of this kind will be fixed up in later changes. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250821152022.1065237-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5433fbc3adcd2b27aadbf76dd35520ff22cdc356 Author: Vladimir Oltean Date: Thu Aug 21 18:20:10 2025 +0300 net: phy: aquantia: reorder AQR113C PMD Global Transmit Disable bit clearing with supported_interfaces Introduced in commit bed90b06b681 ("net: phy: aquantia: clear PMD Global Transmit Disable bit during init"), the clearing of MDIO_PMA_TXDIS plus the call to aqr107_wait_processor_intensive_op() are only by chance placed between aqr107_config_init() and aqr107_fill_interface_modes(). In other words, aqr107_fill_interface_modes() does not depend in any way on these 2 operations. I am only 90% sure of that, and I intend to move aqr107_fill_interface_modes() to be a part of aqr107_config_init() in the future. So to isolate the issue for blame attribution purposes, make these 2 functions adjacent to each other again. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250821152022.1065237-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit a31b1c1591e8296060a0a2ad69b1f936f953cd96 Author: Vladimir Oltean Date: Thu Aug 21 18:20:09 2025 +0300 net: phy: aquantia: merge aqr113c_fill_interface_modes() into aqr107_fill_interface_modes() I'm unsure whether intentionate or not, but I think the (partially observed) naming convention in this driver is that function prefixes denote the earliest generation when a feature is available. In case of aqr107_fill_interface_modes(), that means that the GLOBAL_CFG registers are a Gen2 feature. Supporting evidence: the AQR105, a Gen1 PHY, does not have these registers, thus the function is not named aqr105_*. Based on this inferred naming scheme, I am proposing a refinement of commit a7f3abcf6357 ("net: phy: aquantia: only poll GLOBAL_CFG regs on aqr113, aqr113c and aqr115c") which introduced aqr113c_fill_interface_modes(), suggesting this may be a Gen4 PHY feature. The long-term goal is for aqr107_config_init() to tail-call aqr107_fill_interface_modes(), such that the latter function is also called by AQR107 itself, and many other PHY drivers. Currently it can't, because aqr113c_config_init() calls aqr107_config_init() and then aqr113c_fill_interface_modes(). So this would lead to a duplicate call to aqr107_fill_interface_modes() for AQR113C. Centralize the reading of GLOBAL_CFG registers in the AQR107 method, and create a boolean, set to true by AQR113C, which tests whether waiting for a non-zero value in the GLOBAL_CFG_100M register is necessary. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250821152022.1065237-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7cd3597b8f6fcad8c62d04a20f9da46d3f37b36e Author: Vladimir Oltean Date: Thu Aug 21 18:20:08 2025 +0300 net: phy: aquantia: rename AQR412 to AQR412C and add real AQR412 I have noticed from schematics and firmware images that the PHY for which I've previously added support in commit 973fbe68df39 ("net: phy: aquantia: add AQR112 and AQR412 PHY IDs") is actually an AQR412C, not AQR412. These are actually PHYs from the same generation, and Marvell documents them as differing only in the size of the FCCSP package: 19x19 mm for the AQR412, vs 14x12mm for the Compact AQR412C. I don't think there is any point in backporting this to stable kernels, since the PHYs are identical in capabilities, and no functional difference is expected regardless of how the PHY is identified. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250821152022.1065237-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 Author: Patrisious Haddad Date: Wed Aug 13 15:41:19 2025 +0300 RDMA/mlx5: Fix vport loopback forcing for MPV device Previously loopback for MPV was supposed to be permanently enabled, however other driver flows were able to over-ride that configuration and disable it. Add force_lb parameter that indicates that loopback should always be enabled which prevents all other driver flows from disabling it. Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org Signed-off-by: Patrisious Haddad Reviewed-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 Author: Or Har-Toov Date: Wed Aug 13 15:39:56 2025 +0300 RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count The mlx5 driver currently derives max_qp_wr directly from the log_max_qp_sz HCA capability: props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); However, this value represents the number of WQEs in units of Basic Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size of a WQE can vary depending on transport type and features (e.g., atomic operations, UMR, LSO), the actual number of WQEs can be significantly smaller than the WQEBB count suggests. This patch introduces a conservative estimation of the worst-case WQE size — considering largest segments possible with 1 SGE and no inline data or special features. It uses this to derive a more accurate max_qp_wr value. Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling") Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org Reported-by: Chuck Lever Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/ Signed-off-by: Or Har-Toov Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d9e6e85b7beb2aeb8defac2f705b23532ddb25d4 Author: Yishai Hadas Date: Wed Aug 13 15:36:01 2025 +0300 RDMA/mlx5: Enable Data-Direct with Relaxed Ordering Relaxed Ordering can improve performance in certain scenarios. Enable it in the Data-Direct use case as well. Link: https://patch.msgid.link/r/1221dcdda8061ba5f6bc3519044083c7438b257e.1755088503.git.leon@kernel.org Signed-off-by: Yishai Hadas Reviewed-by: Gal Shalom Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a214365140cc3009f07d4e14a8b481fd3dc41d31 Author: Andy Shevchenko Date: Thu Jul 10 15:15:28 2025 +0300 rculist: move list_for_each_rcu() to where it belongs The list_for_each_rcu() relies on the rcu_dereference() API which is not provided by the list.h. At the same time list.h is a low-level basic header that must not have dependencies like RCU, besides the fact of the potential circular dependencies in some cases. With all that said, move RCU related API to the rculist.h where it belongs. Signed-off-by: Andy Shevchenko Reviewed-by: Simona Vetter Reviewed-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) Signed-off-by: "Paul E. McKenney" commit 0e9e7023df282c7ec41e3f79e803c8feb49fcbe0 Merge: 61399e0c541056 de117fe3f50f96 Author: Paul E. McKenney Date: Mon Aug 25 10:10:18 2025 -0700 Merge branch 'doc.2025.08.20a' into HEAD RCU documentation updates: * Update whatisRCU.rst for recent RCU API additions * Add RCU guards to checklist.rst * Requirements.rst: Abide by conventions of kernel documentation * Fix formatting/typo issues in torture.rst and index.rst * Fix dead URLs in RTFP.txt commit 5e088248375d171b80c643051e77ade6b97bc386 Author: Xichao Zhao Date: Mon Aug 25 15:36:09 2025 +0800 exec: Fix incorrect type for ret In the setup_arg_pages(), ret is declared as an unsigned long. The ret might take a negative value. Therefore, its type should be changed to int. Signed-off-by: Xichao Zhao Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20250825073609.219855-1-zhao.xichao@vivo.com Signed-off-by: Kees Cook commit cbdd16b818eef876dd2de9d503fe7397a0666cbe Author: Pin-yen Lin Date: Mon Aug 18 19:49:34 2025 +0800 HID: i2c-hid: Make elan touch controllers power on after panel is enabled Introduce a new HID quirk to indicate that this device has to be enabled after the panel's backlight is enabled, and update the driver data for the elan devices to enable this quirk. This cannot be a I2C HID quirk because the kernel needs to acknowledge this before powering up the device and read the VID/PID. When this quirk is enabled, register .panel_enabled()/.panel_disabling() instead for the panel follower. Also rename the *panel_prepare* functions into *panel_follower* because they could be called in other situations now. Fixes: bd3cba00dcc63 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens") Fixes: d06651bebf99e ("HID: i2c-hid: elan: Add elan-ekth6a12nay timing") Reviewed-by: Douglas Anderson Signed-off-by: Pin-yen Lin Acked-by: Jiri Kosina Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250818115015.2909525-2-treapking@chromium.org commit 2eb22214c132374e11e681c44d7879c91f67f614 Author: Pin-yen Lin Date: Mon Aug 18 19:49:33 2025 +0800 drm/panel: Allow powering on panel follower after panel is enabled Some touch controllers have to be powered on after the panel's backlight is enabled. To support these controllers, introduce .panel_enabled() and .panel_disabling() to panel_follower_funcs and use them to power on the device after the panel and its backlight are enabled. Signed-off-by: Pin-yen Lin Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250818115015.2909525-1-treapking@chromium.org commit 127d874a7df05b30e937951864b18fb11babff95 Author: Andrew Davis Date: Thu Aug 14 08:55:30 2025 -0500 remoteproc: da8xx: Use devm_rproc_alloc() helper Use the device lifecycle managed allocation function. This helps prevent mistakes like freeing out of order in cleanup functions and forgetting to free on error paths. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20250814135532.638040-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 00f4699872d0e2f5d4c5593fcf0a6814472c302b Author: Qiang Liu Date: Tue Aug 19 10:30:06 2025 +0800 scsi: aic94xx: Remove redundant code Assigning ssp_task.retry_count to itself has no effect. Signed-off-by: Qiang Liu Link: https://lore.kernel.org/r/20250819023006.15216-1-liuqiangneo@163.com Signed-off-by: Martin K. Petersen commit 1e736f1489563470b58ede3fae5274a624280cf1 Author: Alex Mastro Date: Mon Aug 4 12:44:31 2025 -0700 vfio/pci: print vfio-device syspath to fdinfo Print the PCI device syspath to a vfio device's fdinfo. This enables tools to query which device is associated with a given vfio device fd. This results in output like below: $ cat /proc/"$SOME_PID"/fdinfo/"$VFIO_FD" | grep vfio vfio-device-syspath: /sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/0000:e2:05.0/0000:e8:00.0 Signed-off-by: Alex Mastro Reviewed-by: Amit Machhiwal Tested-by: Amit Machhiwal Link: https://lore.kernel.org/r/20250804-show-fdinfo-v4-1-96b14c5691b3@fb.com Signed-off-by: Alex Williamson commit b8db5517fe5265d68abbceb3200fba1aecac4d5f Author: Xichao Zhao Date: Mon Aug 18 16:24:51 2025 +0800 PNP: isapnp: use str_plural() to simplify the code Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250818082451.497935-1-zhao.xichao@vivo.com Signed-off-by: Rafael J. Wysocki commit 13bdfb53aa04eeb8022af87288c5bc0a5d13a834 Author: Uros Bizjak Date: Mon Jun 16 10:56:30 2025 +0200 x86/sgx: Use ENCLS mnemonic in Current minimum required version of binutils is 2.30, which supports ENCLS instruction mnemonic. Replace the byte-wise specification of ENCLS with this proper mnemonic. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jarkko Sakkinen Link: https://lore.kernel.org/20250616085716.158942-1-ubizjak@gmail.com commit 6c2a7d221f4cd8110646b448d5ebb89db6676472 Author: Sakari Ailus Date: Mon Aug 25 16:54:01 2025 +0300 iio: temperature: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Crt Mori Link: https://patch.msgid.link/20250825135401.1765847-13-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 4cba0d0d588c1503498c1bbd75ebdfe04caafbc1 Author: Sakari Ailus Date: Mon Aug 25 16:54:00 2025 +0300 iio: proximity: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-12-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit dfb68a8ebb2e8d9af6e356ae0806bfd8e854ab44 Author: Sakari Ailus Date: Mon Aug 25 16:53:59 2025 +0300 iio: pressure: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-11-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit e3c3e49567ef023733fba150ad72a553127aea64 Author: Sakari Ailus Date: Mon Aug 25 16:53:58 2025 +0300 iio: magnetometer: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Also drop checking for errors on pm_runtime_put_autosuspend() in bmc150_magn_set_power_state(). Signed-off-by: Sakari Ailus Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250825135401.1765847-10-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit e15f23dd5305d123b571aeee56415d9e90f06ca4 Author: Sakari Ailus Date: Mon Aug 25 16:53:57 2025 +0300 iio: light: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250825135401.1765847-9-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 00a3c4be1bba3c48ea602b62c8fcd58b565e524c Author: Sakari Ailus Date: Mon Aug 25 16:53:56 2025 +0300 iio: imu: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-8-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 4c0a7ad785f228743c41733fcb200eb799696e71 Author: Sakari Ailus Date: Mon Aug 25 16:53:55 2025 +0300 iio: gyro: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Linus Walleij Reviewed-by: Rui Miguel Silva Link: https://patch.msgid.link/20250825135401.1765847-7-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 3997872020ff11dc556b9873d458f33d7a649e31 Author: Sakari Ailus Date: Mon Aug 25 16:53:53 2025 +0300 iio: common: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-5-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 4a0f3759313324205a0476e08b3bd4a0fe3b24f7 Author: Sakari Ailus Date: Mon Aug 25 16:53:52 2025 +0300 iio: chemical: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-4-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit d5b9423b39dced8ab126679925a6c88fb514a70c Author: Sakari Ailus Date: Mon Aug 25 16:53:51 2025 +0300 iio: adc: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Linus Walleij Acked-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250825135401.1765847-3-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 358db735b172d95be85c388a950c9793bfd63e95 Author: Sakari Ailus Date: Mon Aug 25 16:53:50 2025 +0300 iio: accel: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250825135401.1765847-2-sakari.ailus@linux.intel.com Signed-off-by: Jonathan Cameron commit 8e5442f3935d269f15b0b9a0d77cdf1cf3bd006f Author: Michael Margolin Date: Thu Jul 3 18:23:14 2025 +0000 RDMA/efa: Extend admin timeout error print Add command id to the printed message for additional debug information. Link: https://patch.msgid.link/r/20250703182314.16442-1-mrgolin@amazon.com Reviewed-by: Yonatan Nachum Signed-off-by: Michael Margolin Signed-off-by: Jason Gunthorpe commit ac46f5b6c6614668727732e117842c9fa7a42c19 Author: Maciej Strozek Date: Mon Aug 11 14:45:05 2025 +0100 ACPICA: Add SoundWire File Table (SWFT) signature The File Download (FDL) process of SoundWire Class Audio (SDCA) driver, which provides code/data which may be required by an SDCA device, utilizes SWFT to obtain that code/data. There is a single SWFT for the system, and SWFT can contain multiple files (information about the file as well as its binary contents). The SWFT has a standard ACPI Descriptor Table Header, followed by SoundWire File definitions as described in Discovery and Configuration (DisCo) Specification for SoundWire® Link: https://github.com/acpica/acpica/commit/18c96022 Signed-off-by: Maciej Strozek Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250811134505.1162661-1-mstrozek@opensource.cirrus.com Signed-off-by: Rafael J. Wysocki commit 91812d3843409c235f336f32f1c37ddc790f1e03 Author: Jonathan Santos Date: Sun Aug 24 01:10:03 2025 -0300 iio: adc: ad7768-1: use devm_regulator_get_enable_read_voltage() Use devm_regulator_get_enable_read_voltage() function as a standard and concise way of reading the voltage from the regulator and keep the regulator enabled. Replace the regulator descriptor with the direct voltage value in the device struct. Reviewed-by: Nuno Sá Reviewed-by: Marcelo Schmitt Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/20250824041003.9727-1-Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 0467ed880a17c276c52e442c2454c7c16973a902 Author: Maciej S. Szmigiero Date: Sun Aug 3 21:18:12 2025 +0200 ACPI: PM: Add HP EliteBook 855 G7 WWAN modem power resource quirk This laptop (and possibly similar models too) has power resource called "GP12.PXP_" for its Intel XMM7360 WWAN modem. For this power resource to turn ON power for the modem it needs certain internal flag called "ONEN" to be set: Method (_ON, 0, NotSerialized) // _ON_: Power On { If (^^^LPCB.EC0.ECRG) { If ((ONEN == Zero)) { Return (Zero) } (..) } } This flag only gets set from this power resource _OFF method, while the actual modem power gets turned off during suspend by "GP12.PTS" method called from the global _PTS (Prepare To Sleep) method. In fact, this power resource _OFF method implementation just sets the aforementioned flag: Method (_OFF, 0, NotSerialized) // _OFF: Power Off { OFEN = Zero ONEN = One } Upon hibernation finish, the kernel tries to set this power resource back ON since its _STA method returns 0 and the resource is still considered in use as it is declared as required for D0 for both the modem ACPI device (GP12.PWAN) and its parent PCIe port ACPI device object (GP12). But the _ON method won't do anything since that "ONEN" flag is not set. Overall, this means the modem is dead after hibernation finish until the laptop is rebooted since the modem power has been cut by _PTS and its PCI configuration was lost and not able to be restored. The easiest way to workaround this issue is to call this power resource _OFF method before calling the _ON method to make sure the "ONEN" flag gets properly set. This makes the modem alive once again after hibernation finish - with properly restored PCI configuration space. Since this platform does *not* support S3 the fact that acpi_resume_power_resources() is also called during resume from S3 is not a problem there. Do the DMI based quirk matching and quirk flag initialization just once - in acpi_power_resources_init() function. This way the whole resume path overhead of this change on other systems amounts to simple hp_eb_gp12pxp_quirk flag comparison. Signed-off-by: Maciej S. Szmigiero Link: https://patch.msgid.link/c6ff6931c5d27592052f30339de1b9cc298c43f0.1754243159.git.mail@maciej.szmigiero.name [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 3bc3dc166dd23404bb2091292cd4e17f87678ca6 Author: Maciej S. Szmigiero Date: Sun Aug 3 21:18:11 2025 +0200 ACPI: PM: Add power resource init function This way DMI based quirk matching and quirk flag initialization can be done just once - in the newly introduced acpi_power_resources_init() function, which is similar to existing acpi_*_init() functions. Convert the single already existing DMI match-based quirk in this ACPI power resource handler ("leave unused power resources on" quirk) to such one-time initialization in acpi_power_resources_init() function instead of re-running that DMI match each time acpi_turn_off_unused_power_resources() gets called. Signed-off-by: Maciej S. Szmigiero Link: https://patch.msgid.link/b173a6987f0b35597fd82400cb28f289786e03d0.1754243159.git.mail@maciej.szmigiero.name Signed-off-by: Rafael J. Wysocki commit 6e29c30d8ddea6109ea7e0b9f17e7841df0794ea Author: Andrew Davis Date: Thu Jun 19 15:57:22 2025 -0500 rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table Module aliases are used by userspace to identify the correct module to load for a detected hardware. The currently supported RPMSG device IDs for this module include "rpmsg-raw", but the module alias is "rpmsg_chrdev". Use the helper macro MODULE_DEVICE_TABLE(rpmsg) to export the correct supported IDs. And while here, to keep backwards compatibility we also add the other ID "rpmsg_chrdev" so that it is also still exported as an alias. This has the side benefit of adding support for some legacy firmware which still uses the original "rpmsg_chrdev" ID. This was the ID used for this driver before it was upstreamed (as reflected by the module alias). Signed-off-by: Andrew Davis Acked-by: Hari Nagalla Tested-by: Hari Nagalla Link: https://lore.kernel.org/r/20250619205722.133827-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 6bbf77bb22565332744c74e9806f8fb50402d73e Author: Biju Das Date: Wed Aug 20 11:30:51 2025 +0100 clk: renesas: r9a09g047: Add GPT clocks and resets Add clock and reset entries for the Renesas RZ/G3E GPT{0,1} IPs. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250820103053.93382-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8306bcaba06dfa658e3dd852e930b0154cb46c9f Author: Srinivas Pandruvada Date: Mon Aug 25 06:23:15 2025 -0700 thermal: intel: int340x: Add module parameter to change slider offset SoC slider value is set by the user (or the default when user has not modified it). To enhance power efficiency dynamically, the firmware can optionally auto-adjust the slider value based on the current workload. This adjustment is governed by an additional parameter known as the "slider offset". This offset permits the firmware to increase the slider value up to and including "SoC slider + slider offset". Add a module parameter to specify this "slier offset" value. By default, the SoC slider offset is set to 0. This means that SoC is not allowed to switch slider position. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250825132315.75521-5-srinivas.pandruvada@linux.intel.com [ rjw: Comment and module param description adjustments ] Signed-off-by: Rafael J. Wysocki commit 4a64a748e45cded20443ad54826ac78b3967de15 Author: Srinivas Pandruvada Date: Mon Aug 25 06:23:14 2025 -0700 thermal: intel: int340x: Add module parameter for balanced Slider By default, the SoC slider value for the "balanced" platform profile is set to 3. This update introduces a new module parameter, allowing users to modify this default value. The module parameter can be specified during load time to set a custom slider value for the "balanced" profile. If the module parameter is not specified at load time and is updated later, the new value will only take effect after the next write of "balanced" to the sysfs "profile" attribute. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250825132315.75521-4-srinivas.pandruvada@linux.intel.com [ rjw: Minor adjustments of module param description ] Signed-off-by: Rafael J. Wysocki commit 018d046a1a2cdf917bd8e3b6a3fdab6ce7aa698b Author: Srinivas Pandruvada Date: Mon Aug 25 06:23:13 2025 -0700 thermal: intel: int340x: Enable power slider interface for Panther Lake Set the PROC_THERMAL_FEATURE_SOC_POWER_SLIDER feature flag in proc_thermal_pci_ids[] for Panther Lake to enable power slider interface. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250825132315.75521-3-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 0d50f4d6ec5a8fedfd7169417b25672cadd0e652 Author: Srinivas Pandruvada Date: Mon Aug 25 06:23:12 2025 -0700 thermal: intel: int340x: Add support for power slider Add support for system wide energy performance preference using a SoC slider interface defined via processor thermal PCI device MMIO space. Using Linux platform-profile class API, register a new platform profile. Provide three platform power profile choices: "performance", "balanced" and "low-power". Profile sysfs is located at: /sys/class/platform-profile/platform-profile-* where attribute "name" is presented as "SoC Power Slider". At boot by default the slider is set to balanced mode. This profile is changed by user space based on user preference via power profile daemon or directly writing to the "profile" sysfs attribute. Add a CPU model specific processor thermal device feature PROC_THERMAL_FEATURE_SOC_POWER_SLIDER. When enabled for a CPU model, slider interface is registered. During system suspend callback save slider register and restore during resume callback. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250825132315.75521-2-srinivas.pandruvada@linux.intel.com [ rjw: Removal of redundant outer parens from one expression ] Signed-off-by: Rafael J. Wysocki commit 94ce55046c3625380afd2a612237619c11dae6ad Author: Keith Busch Date: Wed Aug 13 08:31:53 2025 -0700 nvme-pci: convert metadata mapping to dma iter Aligns data and metadata to the similar dma mapping scheme and removes one more user of the scatter-gather dma mapping. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-10-kbusch@meta.com Signed-off-by: Jens Axboe commit f0887e2a52d4ef3f246e508bd1d947dc13988643 Author: Keith Busch Date: Wed Aug 13 08:31:52 2025 -0700 nvme-pci: create common sgl unmapping helper This can be reused by metadata sgls once that starts using the blk-mq dma api. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-9-kbusch@meta.com Signed-off-by: Jens Axboe commit c16b52a0a095888efdd5d76f7194caf2a4752256 Author: Keith Busch Date: Wed Aug 13 08:31:51 2025 -0700 blk-integrity: use iterator for mapping sg Modify blk_rq_map_integrity_sg to use the blk-mq mapping iterator. This produces more efficient code and converges the integrity mapping implementations to reduce future maintenance burdens. The function implementation moves from blk-integrity.c to blk-mq-dma.c in order to use the types and functions private to that file. Signed-off-by: Keith Busch Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250813153153.3260897-8-kbusch@meta.com Signed-off-by: Jens Axboe commit fec9b16dc5550191fd85af118271ea00e8dcc5f8 Author: Keith Busch Date: Wed Aug 13 08:31:50 2025 -0700 blk-mq-dma: add scatter-less integrity data DMA mapping Similar to regular data, introduce more efficient integrity mapping helpers that does away with the scatterlist structure. This uses the block mapping iterator to add IOVA segments if IOMMU is enabled, or maps directly if not. This also supports P2P segements if integrity data ever wants to allocate that type of memory. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-7-kbusch@meta.com Signed-off-by: Jens Axboe commit e2be2ba6d27d5c74f3bd458b64d1ad34a8a75bd8 Author: Keith Busch Date: Wed Aug 13 08:31:49 2025 -0700 blk-mq-dma: move common dma start code to a helper In preparing for dma mapping integrity metadata, move the common dma setup to a helper. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-6-kbusch@meta.com Signed-off-by: Jens Axboe commit 7092639031a1bd5320ab827e8f665350f332b7ce Author: Keith Busch Date: Wed Aug 13 08:31:48 2025 -0700 blk-mq: remove REQ_P2PDMA flag It's not serving any particular purpose. pci_p2pdma_state() already has all the appropriate checks, so the config and flag checks are not guarding anything. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-5-kbusch@meta.com Signed-off-by: Jens Axboe commit 92fb75fd14b041038e30bc725ab4c1e625243573 Author: Keith Busch Date: Wed Aug 13 08:31:47 2025 -0700 blk-mq-dma: require unmap caller provide p2p map type In preparing for integrity dma mappings, we can't rely on the request flag because data and metadata may have different mapping types. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-4-kbusch@meta.com Signed-off-by: Jens Axboe commit dae75dead2359edd7c55e1964e0edf7d03535b31 Author: Keith Busch Date: Wed Aug 13 08:31:46 2025 -0700 blk-mq-dma: provide the bio_vec array being iterated This will make it easier to add different sources of the bvec array, like for upcoming integrity support, rather than assume to use the bio's bi_io_vec. It also makes iterating "special" payloads more in common with iterating normal payloads. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-3-kbusch@meta.com Signed-off-by: Jens Axboe commit 7a6fc1634cea6f220228a69b1c0210e6b8b1aaf0 Author: Keith Busch Date: Wed Aug 13 08:31:45 2025 -0700 blk-mq-dma: create blk_map_iter type The req_iterator happens to have a similar fields to what the dma iterator needs, but we're not necessarily iterating a request's bi_io_vec. Create a new type that can be amended for additional future use. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250813153153.3260897-2-kbusch@meta.com Signed-off-by: Jens Axboe commit 16428e2449ab96cce27be6ab17b750b404c76c7c Author: Laurent Pinchart Date: Wed Aug 20 17:00:21 2025 +0300 media: mc: Improve unconnected pads debugging message in link exploration When exploring links, a message is printed to indicate unconnected pads being added. The message prints the entity name only. Print the origin pad number as well to help with debugging pipeline start issues. While at it, get the entity name from origin->entity instead of local->entity. Both point to the same entity, but the former conveys the meaning better. Signed-off-by: Laurent Pinchart Acked-by: Sakari Ailus Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit eec81250219a209b863f11d02128ec1dd8e20877 Author: Laurent Pinchart Date: Wed Aug 20 17:00:20 2025 +0300 media: mc: Fix MUST_CONNECT handling for pads with no links Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") expanded the meaning of the MUST_CONNECT flag to require an enabled link in all cases. To do so, the link exploration code was expanded to cover unconnected pads, in order to reject those that have the MUST_CONNECT flag set. The implementation was however incorrect, ignoring unconnected pads instead of ignoring connected pads. Fix it. Reported-by: Martin Kepplinger-Novaković Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de Reported-by: Maud Spierings Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Laurent Pinchart Tested-by: Maud Spierings Tested-by: Martin Kepplinger-Novaković Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 80eaf32672871bd2623ce6ba13ffc1f018756580 Author: Chandra Mohan Sundar Date: Mon Aug 18 15:01:57 2025 +0530 media: stm32-csi: Fix dereference before NULL check In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while assigning a value to the 'src_pad'. However the same value is being checked against NULL at a later point of time indicating that there are chances that the value can be NULL. Move the dereference after the NULL check. Fixes: e7bad98c205d1 ("media: v4l: Convert the users of v4l2_get_link_freq to call it on a pad") Cc: stable@vger.kernel.org Signed-off-by: Chandra Mohan Sundar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9d108d226224b91ad11e7cfcf846c2a1721b466d Author: Krzysztof Kozlowski Date: Mon Aug 18 17:00:26 2025 +0200 media: i2c: imx: Add note to prevent buggy code re-use Multiple Sony IMX sensor drivers have mixed up logical and line level for XCLR signal. They call it a reset signal (it indeed behaves like that), but drivers assert the reset to operate which is clearly incorrect and relies on incorrect DTS. People in discussions copy existing poor code and claim they can repeat same mistake, so add a note to prevent that. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 Author: Benjamin Mugnier Date: Mon Aug 18 15:50:58 2025 +0200 media: i2c: vd55g1: Fix duster register address The duster register needs to be disabled on test patterns. While the code is correctly doing so, the register address contained a typo, thus not disabling the duster correctly. Fix the typo. Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor") Signed-off-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 01a80b6649e69e4889b8521de022d3ee4bc5cb6f Author: Bingbu Cao Date: Fri Aug 15 17:20:37 2025 +0800 media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release IPU7 ISYS and PSYS auxiliary devices are released after ipu7_bus_del_devices(), so driver can not reference the MMU devices from ISYS and PSYS auxiliary devices, so move the MMUs cleanup before releasing the auxiliary devices. Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") Signed-off-by: Bingbu Cao [Sakari Ailus: Drop extra newline.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8abb489f9aa181882ece7c24712ad39cbb9dab81 Author: Bingbu Cao Date: Fri Aug 15 17:20:36 2025 +0800 media: staging/ipu7: Don't set name for IPU7 PCI device Driver better not dev_set_name() to change the PCI device name, so remove it. Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 283f7638c26c0f36e4ef5e147884e241b24fbebd Author: Bingbu Cao Date: Fri Aug 15 17:20:35 2025 +0800 media: staging/ipu7: convert to use pci_alloc_irq_vectors() API pci_enable_msi() is a deprecated API, thus switch to use modern pci_alloc_irq_vectors(). Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 31f91c5224cdfa505b91edb6a92c3c468e6a3d1d Author: Jai Luthra Date: Mon Aug 11 13:50:18 2025 +0530 media: ti: j721e-csi2rx: Support multiple pixels per clock Add support for negotiating the highest possible pixel mode (from single, dual, quad) with the Cadence CSI2RX bridge. This is required to drain the Cadence stream FIFOs without overflowing when the source is operating at a high link-frequency [1]. Also, update the Kconfig as this introduces a hard build-time dependency on the Cadence CSI2RX driver, even for a COMPILE_TEST. [1] Section 12.6.1.4.8.14 CSI_RX_IF Programming Restrictions of AM62 TRM Link: https://www.ti.com/lit/pdf/spruj16 Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7b78fa862296f8931e42ecaec3703e307e4044d2 Author: Jai Luthra Date: Mon Aug 11 13:50:17 2025 +0530 media: cadence: cdns-csi2rx: Support multiple pixels per clock cycle The output pixel interface is a parallel bus (32 bits), which supports sending multiple pixels (1, 2 or 4) per clock cycle for smaller pixel widths like RAW8-RAW16. Dual-pixel and Quad-pixel modes can be a requirement if the export rate of the Cadence IP in Single-pixel mode maxes out before the maximum supported DPHY-RX frequency, which is the case with TI's integration of this IP [1]. So, we export a function that lets the downstream hardware block request a higher pixel-per-clock on a particular output pad. We check if we can support the requested pixels per clock given the known maximum for the currently configured format. If not, we set it to the highest feasible value and return this value to the caller. [1] Section 12.6.1.4.8.14 CSI_RX_IF Programming Restrictions of AM62 TRM Link: https://www.ti.com/lit/pdf/spruj16 Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4d09706dfa0c57b01ff45005166eb6acefee8835 Author: Jai Luthra Date: Mon Aug 11 13:50:16 2025 +0530 media: cadence: csi2rx: Implement get_fwnode_pad op Use v4l2_subdev_get_fwnode_pad_1_to_1() as the get_fwnode_pad operation. Cadence CSI2RX maps port numbers and pad indices 1:1. Reviewed-by: Changhuang Liang Reviewed-by: Devarsh Thakkar Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3e743cd0a73246219da117ee99061aad51c4748c Author: Jai Luthra Date: Mon Aug 11 13:50:15 2025 +0530 media: ti: j721e-csi2rx: Fix source subdev link creation We don't use OF ports and remote-endpoints to connect the CSI2RX bridge and this device in the device tree, thus it is wrong to use v4l2_create_fwnode_links_to_pad() to create the media graph link between the two. It works out on accident, as neither the source nor the sink implement the .get_fwnode_pad() callback, and the framework helper falls back on using the first source and sink pads to create the link between them. Instead, manually create the media link from the first source pad of the bridge to the first sink pad of the J721E CSI2RX. Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") Cc: stable@vger.kernel.org Reviewed-by: Devarsh Thakkar Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 929f2b69bebd860e389cc24e1f00183f53a79197 Author: Jai Luthra Date: Mon Aug 11 13:50:14 2025 +0530 media: ti: j721e-csi2rx: Use fwnode_get_named_child_node Simplify notifier registration logic. Instead of first getting the device node, get the fwnode of the child directly. Reviewed-by: Devarsh Thakkar Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 072799db233f9de90a62be54c1e59275c2db3969 Author: Jai Luthra Date: Mon Aug 11 13:50:13 2025 +0530 media: ti: j721e-csi2rx: Use devm_of_platform_populate Ensure that we clean up the platform bus when we remove this driver. This fixes a crash seen when reloading the module for the child device with the parent not yet reloaded. Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") Cc: stable@vger.kernel.org Reviewed-by: Devarsh Thakkar Tested-by: Yemike Abhilash Chandra (on SK-AM68) Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bdc9776dac860cae7f61e2b48929f87597306644 Author: Sakari Ailus Date: Thu Aug 21 14:56:49 2025 +0300 media: v4l2-common: Update v4l2_get_link_freq() documentation Document that v4l2_get_link_freq() obtains the link frequency primarily by calling the get_mbus_config sub-device pad operation. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 683342ce3c0dae068bf0ee157ee12c13088193f7 Author: Sakari Ailus Date: Mon Aug 18 16:49:39 2025 +0300 media: v4l2-common: Drop the workaround from v4l2_get_link_freq() Remove the workaround that allowed calling v4l2_get_link_freq() on the control handler. Signed-off-by: Sakari Ailus Reviewed-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2fbc015e12fcb91efd656bd071edcb3336495725 Author: Sakari Ailus Date: Mon Aug 18 16:44:07 2025 +0300 media: amlogic: c3-mipi-csi2: Call v4l2_get_link_freq() on source pad Call v4l2_get_link_freq() on the source pad so we can remove the workaround that allows calling it on a control handler. Signed-off-by: Sakari Ailus Reviewed-by: Jacopo Mondi Reviewed-by: Keke Li Tested-by: Keke Li Signed-off-by: Hans Verkuil commit 8cf320f3f4bf1adf90c785776a1f68fda765ee81 Author: Sakari Ailus Date: Wed Jan 22 11:24:13 2025 +0200 media: uapi: Documentation: Improve column width hints for examples Use less arbitrary widths for the columns in metadata layout examples. Signed-off-by: Sakari Ailus Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit f687d3785d2b6e1cf960d71c0c72bc6472f2e8aa Author: Liao Yuanhong Date: Wed Aug 13 17:47:46 2025 +0800 media: imx296: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Reviewed-by: Kieran Bingham Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e Author: Tomi Valkeinen Date: Fri Aug 8 11:59:15 2025 +0300 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try(). Signed-off-by: Tomi Valkeinen Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/ Cc: stable@vger.kernel.org Reviewed-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 880c2395eb9c72938ae65bdb785d28426884d72f Author: André Apitzsch Date: Mon Jun 30 21:05:25 2025 +0200 media: i2c: imx214: Separate legacy link frequency check from PLL calculation Make it easier to drop the legacy support from the driver later. Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit db967cc41fecd3d115a987934dc00de208f7959f Author: André Apitzsch Date: Mon Jun 30 21:05:24 2025 +0200 media: i2c: imx214: Move imx214_pll_update to imx214_ctrls_init It is more logical to call the PLL update in imx214_ctrls_init(). So let's move it there. Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8bd24a43ccb719d26f7af4a2935a9228a68f785e Author: André Apitzsch Date: Mon Jun 30 21:05:23 2025 +0200 media: i2c: imx214: Use __free(fwnode_handle) Use the __free(fwnode_handle) hook to free the endpoint when the function exits to simplify the error path. Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 84aa4d2f59d2db4d96ec633bc4197f2b08d4f14f Author: André Apitzsch Date: Mon Jun 30 21:05:22 2025 +0200 media: i2c: imx214: Drop dev argument from imx214_parse_fwnode() The device can be accessed from struct imx214. Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6f1882872c51decceace4b902c07a3c3d1ef1a63 Author: André Apitzsch Date: Mon Jun 30 21:05:21 2025 +0200 media: i2c: imx214: Remove unneeded parentheses The parentheses are not needed to calculate bit_rate_mbps. Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5ae507400652f16a001c7c169c4732ead0b4e54e Author: Julien Massot Date: Fri Jul 4 11:28:24 2025 +0200 media: i2c: vgxy61: Report stream using frame descriptors Add support for .get_frame_desc() to report CSI-2 virtual channel and data type information. This allows CSI-2 receivers to properly interpret the stream without inferring the data type from the pixel format. Signed-off-by: Julien Massot Reviewed-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9db72db296c4e6bb5e901adcd557212e0ee2df26 Author: Mathis Foerst Date: Mon Jul 14 09:59:27 2025 +0200 media: mt9m114: Set pad-slew-rate The MT9M114 supports the different slew rates (0 to 7) on the output pads. At the moment, this is hardcoded to 7 (the fastest rate). The user might want to change this values due to EMC requirements. Read the 'slew-rate' from the DT and configure the pad slew rates of the output pads accordingly in mt9m114_initialize(). Remove the hardcoded slew rate setting from the mt9m114_init table. Signed-off-by: Mathis Foerst Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b541288c515d91424e74055a7b2ef344446a92f7 Author: Mathis Foerst Date: Mon Jul 14 09:59:26 2025 +0200 media: mt9m114: Allow set_selection while streaming The current implementation does not apply changes to the crop- configuration of the sensor immediately if the sensor is in streaming state. The user has to stop and restart the stream for the changes to be applied. This can be undesirable e.g. in a calibration usecase where the user wants to see the impact of his changes in a live video stream. Under the condition that the width & height of the cropped image area does not change, the changed cropping configuration can be applied to the pixel-array immediately without disturbing the IFP. Call mt9m114_configure_pa() in mt9m114_pa_set_selection() if the sensor is in streaming state and the size of the cropping rectangle didn't change, issue a CONFIG_CHANGE to apply the changes immediately. Signed-off-by: Mathis Foerst Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit efe0832f57bd8a7155a63f3375353c27e3967959 Author: Colin Ian King Date: Tue Jul 29 08:00:21 2025 +0100 media: i2c: ov5648: make read-only arrays regs and values static const Don't populate the read-only arrays regs and values on the stack at run time, instead make them static const. Signed-off-by: Colin Ian King Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3c5ca0a48bb02c9639de9adf3325f85b9cd11af2 Author: Biju Das Date: Fri Aug 1 06:34:22 2025 +0100 media: rzg2l-cru: Drop function pointer to configure CSI Drop function pointer to configure CSI to avoid code duplication by checking the presence of vc select register in rzg2l_cru_info. After this change, limit the scope of the rzg2l_cru_csi2_setup() to static. Signed-off-by: Biju Das Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6b4d053182aa2bf011e35484a16fbea1b6711765 Author: Shravan Chippa Date: Tue Jun 24 12:24:38 2025 +0530 media: i2c: imx334: add support for additional test patterns Added support for three additional test patterns in the IMX334 driver: Black and Grey Bars, Black Color, and White Color. Signed-off-by: Shravan Chippa [Sakari Ailus: Fix hexadecimal value.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit fda55673ecdabf25f5ecc61b5ab17239257ac252 Author: Zhang Shurong Date: Tue Jun 24 16:27:24 2025 +0800 media: rj54n1cb0c: Fix memleak in rj54n1_probe() rj54n1_probe() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak. Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") Signed-off-by: Zhang Shurong Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1eb1d48cd67d5c886eb346aa2d1646997fa2f32c Author: Sakari Ailus Date: Sat Jun 28 16:44:21 2025 +0300 media: ov02c10: Don't include linux/version.h linux/version.h isn't needed by the driver, don't include it. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1e72afb5146a254aca47ff148950462e81cfeaa5 Author: Hans de Goede Date: Sat May 17 13:41:06 2025 +0200 media: Move gc0310 sensor drivers to drivers/media/i2c/ The atomisp gc0310 sensor driver has now been fully converted to a standard v4l2 sensor driver. Move it to drivers/media/i2c/ to reflect this. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 55ad04a652789464c522c9d7d0a1cbf76bfb5273 Author: Sakari Ailus Date: Tue Jun 18 13:42:25 2024 +0300 media: vim2m: Remove compilation conditional to CONFIG_MEDIA_CONTROLLER MEDIA_CONTROLLER is selected for vim2m already since commit 016baa59bf9f ("media: Kconfig: Don't expose the Request API option"). Also remove the related #ifdefs. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 34290a6f9de555180b54b971531fca24c3fcadc9 Author: Sakari Ailus Date: Fri Aug 8 11:23:20 2025 +0300 media: MAINTAINERS: Change rcar-jpu maintainer Assign the driver to Nikita as discussed on LMML. Signed-off-by: Sakari Ailus Acked-by: Nikita Yushchenko Signed-off-by: Hans Verkuil commit 4eacb83c193c1e544e9e9f8516c888584e3088f8 Author: Sakari Ailus Date: Fri Sep 6 09:24:31 2024 +0300 media: Documentation: Move streams documentation one level up While streams can be found within pads, they do deserve their own documentation section on the same level than pads. Move them one level up. Signed-off-by: Sakari Ailus Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f5a2826cd50c6fd1af803812d1d910a64ae8e0a1 Author: Sakari Ailus Date: Wed May 21 11:06:16 2025 +0300 media: ipu6: isys: Set embedded data type correctly for metadata formats The IPU6 ISYS driver supported metadata formats but was missing correct embedded data type in the receiver configuration. Add it now. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2747711fc56b99a66cd3d5e3a484d65eaec9c4ab Author: Sakari Ailus Date: Thu Aug 7 12:13:13 2025 +0300 media: MAINTAINERS: Remove Stanislaw from IVCS and IPU6 reviewers Stanislaw's e-mail no longer works so remove him from IVSC and IPU6 driver reviewers. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8a14120d2abf9af2be29172bd1f3d4ce24b97e3e Author: Laurent Pinchart Date: Tue Aug 5 00:41:27 2025 +0300 media: staging/ipu7: Use v4l2_ctrl_subdev_subscribe_event() The ipu7-isys driver uses v4l2_ctrl_subscribe_event() to handle control event subscription on a subdev. While this works, it is the wrong API. Use the subdev-specific v4l2_ctrl_subdev_subscribe_event() helper instead. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 59951994be5f2bbe00ad0167c83fcf5df70fc3a9 Author: Laurent Pinchart Date: Tue Aug 5 00:41:26 2025 +0300 media: ipu6: isys: Use v4l2_ctrl_subdev_subscribe_event() The ipu6-isys driver uses v4l2_ctrl_subscribe_event() to handle control event subscription on a subdev. While this works, it is the wrong API. Use the subdev-specific v4l2_ctrl_subdev_subscribe_event() helper instead. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a7067c7302f67f62e5bf41f948bde06d85c47625 Author: Sakari Ailus Date: Thu Oct 10 12:07:17 2024 +0300 media: Documentation: Reword split of sensor driver to two classes The sensor drivers do not configure the output size of the sensors but the entire internal pipeline. Reflect this in the documentation. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Signed-off-by: Hans Verkuil commit c95c1ea8f50963abd85d0321b161e3dd14cdabb0 Author: Sakari Ailus Date: Fri Nov 8 14:36:03 2024 +0200 media: Documentation: Add a hyphen to list-based Add a hyphen to list-based for uniform spelling in camera-sensor.rst. Signed-off-by: Sakari Ailus Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Signed-off-by: Hans Verkuil commit 6ee42dfc2951d33717adebe235a4a09ee4eb0c83 Author: Laurent Pinchart Date: Sat Aug 2 00:19:33 2025 +0300 media: staging: imx: Drop custom .unsubscribe_event() handler The csi_unsubscribe_event() function simply calls v4l2_event_unsubscribe(), forwarding its arguments. Replace it with the v4l2_event_subdev_unsubscribe() helper that performs exactly the same operation. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ed1390e5af8c0ead2bf4f62737363fdfa01a8340 Author: Laurent Pinchart Date: Sat Aug 2 00:19:32 2025 +0300 media: staging: atomisp: Drop custom .unsubscribe_event() handler The isp_subdev_unsubscribe_event() function simply calls v4l2_event_unsubscribe(), forwarding its arguments. Replace it with the v4l2_event_subdev_unsubscribe() helper that performs exactly the same operation. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1182d0dde240670bf35f2855777ec9b2a48ed15a Author: Laurent Pinchart Date: Sat Aug 2 00:19:31 2025 +0300 media: omap3isp: Drop custom .unsubscribe_event() handler The ccdc_unsubscribe_event() and omap3isp_stat_unsubscribe_event() functions simply call v4l2_event_unsubscribe(), forwarding their arguments. Replace them with the v4l2_event_subdev_unsubscribe() helper that performs exactly the same operation. Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5195b777552d2e2fa735c6cad75797efa132bd60 Author: Laurent Pinchart Date: Tue Jul 29 02:50:10 2025 +0300 media: v4l2-subdev: Make struct v4l2_subdev_stream_config private The v4l2_subdev_stream_config structure holds configuration data for a stream. It was meant to be used internally only, but already found its way into the ds90ub913 driver. Now that the driver has been fixed, make the structure private to v4l2-subdev.c to avoid using it by accident. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 49cec2b5a316ce2669e17ce1d458a8dfc1157f09 Author: Laurent Pinchart Date: Tue Jul 29 02:50:09 2025 +0300 media: staging/ipu7: Disallow source multiplexing The IPU7 ISYS driver can't capture multiple streams on the same video device. Disallow source multiplexing in the routes of the internal subdev to reflect that limitation. As a result we can hardcode the source stream to 0, simplifying the driver. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit adc276c419148a1813fcff859ceb03f2409eeae7 Author: Laurent Pinchart Date: Tue Jul 29 02:50:08 2025 +0300 media: i2c: ds90ub913: Stop accessing streams configs directly The v4l2_subdev_stream_config structure will be made private. Stop accessing it directly, iterate over routes instead to initialize formats. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 955c993d27858009436d4f56243f1ec0074e86ff Author: Nai-Chen Cheng Date: Mon Aug 4 01:49:55 2025 +0800 staging: media: ipu3: use string_choices API instead of ternary operator Use string_choices API instead of manually determining the output using ternary operator to improve code readability and consistency. This also fixes cocci warning. Signed-off-by: Nai-Chen Cheng Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 0125d9e1b3a2c0fd5a5adeb56ed5a415f4bc9fa2 Author: Sakari Ailus Date: Wed Nov 29 16:15:45 2023 +0200 media: vimc: Don't explicitly set bus_info The platform device name is already set by V4L2 and MC frameworks for media device bus_info and V4L2 querycap bus_info fields. Don't do it in the driver. Acked-by: Shuah Khan Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4c4e17f2701316e0cac16e19366056f464feded5 Author: Jerome Brunet Date: Wed Jul 2 17:25:59 2025 +0200 clk: amlogic: naming consistency alignment Amlogic clock controller drivers are all doing the same thing, more or less. Yet, over the years, tiny (and often pointless) differences have emerged. This makes reviews more difficult, allows some errors to slip through and make it more difficult to exploit SoC commonalities, leading to code duplication. This change enforce, wherever possible, a consistent and predictable scheme when it comes to code organisation and naming, The scheme chosen is what was used the most already, to try and minimise the size of the ugly resulting diff. Here are some of the rules applied: - Aligning clock names, variable names and IDs. - ID cannot change (used in DT) - Variable names w/ SoC name prefixes - Clock names w/o SoC name prefixes, except pclks for historic reasons - Composite clock systematic naming : mux: X_sel, div:X_div, gate:X - Parent table systematically named with the same name as the clock and a '_parents' suffix - Group various tables next to the related clock - etc ... Doing so removes what would otherwise show up as unrelated diff in following changes. It will allow to introduce common definitions for peripheral clocks, probe helpers, composite clocks, etc ... making further review and maintenance easier. Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-1-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-2-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-3-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-4-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-5-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-6-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-7-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-8-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-9-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-10-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-11-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-12-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-13-e163c9a1fc21@baylibre.com Link: https://lore.kernel.org/r/20250702-meson-clk-cleanup-24-v1-14-e163c9a1fc21@baylibre.com Reviewed-by: Chuan Liu # For c3 and s4 [jbrunet: squashed all naming alignment changes together] Signed-off-by: Jerome Brunet commit 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 Author: Dongsheng Yang Date: Tue Aug 12 08:24:52 2025 +0000 dm-pcache: add persistent cache target in device-mapper This patch introduces dm-pcache, a new DM target that places a DAX- capable persistent-memory device in front of any slower block device and uses it as a high-throughput, low-latency cache. Design highlights ----------------- - DAX data path – data is copied directly between DRAM and the pmem mapping, bypassing the block layer’s overhead. - Segmented, crash-consistent layout - all layout metadata are dual-replicated CRC-protected. - atomic kset flushes; key replay on mount guarantees cache integrity even after power loss. - Striped multi-tree index - Multi‑tree indexing for high parallelism. - overlap-resolution logic ensures non-intersecting cached extents. - Background services - write-back worker flushes dirty keys in order, preserving backing-device crash consistency. This is important for checkpoint in cloud storage. - garbage collector reclaims clean segments when utilisation exceeds a tunable threshold. - Data integrity – optional CRC32 on cached payload; metadata always protected. Comparison with existing block-level caches --------------------------------------------------------------------------------------------------------------------------------- | Feature | pcache (this patch) | bcache | dm-writecache | |----------------------------------|---------------------------------|------------------------------|---------------------------| | pmem access method | DAX | bio (block I/O) | DAX | | Write latency (4 K rand-write) | ~5 µs | ~20 µs | ~5 µs | | Concurrency | multi subtree index | global index tree | single tree + wc_lock | | IOPS (4K randwrite, 32 numjobs) | 2.1 M | 352 K | 283 K | | Read-cache support | YES | YES | NO | | Deployment | no re-format of backend | backend devices must be | no re-format of backend | | | | reformatted | | | Write-back ordering | log-structured; | no ordering guarantee | no ordering guarantee | | | preserves app-IO-order | | | | Data integrity checks | metadata + data CRC(optional) | metadata CRC only | none | --------------------------------------------------------------------------------------------------------------------------------- Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka commit ec6f613ef376410753173f8236bad5f07a86503a Author: Uros Bizjak Date: Mon Aug 11 15:23:03 2025 +0200 fs: Use try_cmpxchg() in sb_init_done_wq() Use !try_cmpxchg() instead of cmpxchg(*ptr, old, new) != old. The x86 CMPXCHG instruction returns success in the ZF flag, so this change saves a compare after CMPXCHG. No functional change intended. Signed-off-by: Uros Bizjak Link: https://lore.kernel.org/20250811132326.620521-1-ubizjak@gmail.com Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Christian Brauner commit 14498ca7e0f18cd73ab0010cbfbf9413a9f0a96f Author: Uros Bizjak Date: Mon Aug 11 14:52:38 2025 +0200 fs: Use try_cmpxchg() in start_dir_add() Use try_cmpxchg() instead of cmpxchg(*ptr, old, new) == old. The x86 CMPXCHG instruction returns success in the ZF flag, so this change saves a compare after CMPXCHG (and related move instruction in front of CMPXCHG). Note that the value from *ptr should be read using READ_ONCE() to prevent the compiler from merging, refetching or reordering the read. No functional change intended. Signed-off-by: Uros Bizjak Link: https://lore.kernel.org/20250811125308.616717-1-ubizjak@gmail.com Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Christian Brauner commit 681386fe5365591d044fe03d7ae05e5419a78d83 Author: Dixit Parmar Date: Fri Aug 22 09:19:58 2025 +0530 iio: temperature: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-10-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit 1f6fcf7fb4ca49c19960b9545f9cd352ac2b7a31 Author: Dixit Parmar Date: Fri Aug 22 09:19:57 2025 +0530 iio: proximity: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-9-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit b5e04043b45067d3a5992588c862f62099afae75 Author: Dixit Parmar Date: Fri Aug 22 09:19:56 2025 +0530 iio: pressure: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-8-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit 368e8718875f17ac38dc7e1019b170aaee703289 Author: Dixit Parmar Date: Fri Aug 22 09:19:55 2025 +0530 iio: potentiostat: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-7-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit bdba20f5e642046b84c288d89a9443b3139b7981 Author: Dixit Parmar Date: Fri Aug 22 09:19:54 2025 +0530 iio: light: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-6-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit fba366e66b15f2261d269ec6bcb73cb2ab7d599f Author: Dixit Parmar Date: Fri Aug 22 09:19:53 2025 +0530 iio: humidity: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-5-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit fc3a8049293cef455fc585cfd36892e3992aeb14 Author: Dixit Parmar Date: Fri Aug 22 09:19:52 2025 +0530 iio: health: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-4-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit eeca066c9d990450017d141e993cf051aac2c430 Author: Dixit Parmar Date: Fri Aug 22 09:19:51 2025 +0530 iio: dac: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-3-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit c7979dbdc7be870c15a050ab0c6f6646ded73967 Author: Dixit Parmar Date: Fri Aug 22 09:19:50 2025 +0530 iio: adc: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-2-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit 9c6674035ea3d49f687c43e4a26146719ef6e414 Author: Dixit Parmar Date: Fri Aug 22 09:19:49 2025 +0530 iio: accel: Drop unnecessary -ENOMEM messages The drivers do not require their own error messages for error -ENOMEM, memory allocation failures. So remove the dev_err() messages from the probe(). Signed-off-by: Dixit Parmar Link: https://patch.msgid.link/20250822-enomam_logs-v1-1-db87f2974552@gmail.com Signed-off-by: Jonathan Cameron commit 1315cc2dbd5034f566e20ddce4d675cb9e6d4ddd Author: Sean Anderson Date: Mon Jul 14 20:30:58 2025 -0400 iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK AMS_ALARM_THR_DIRECT_MASK should be bit 0, not bit 1. This would cause hysteresis to be enabled with a lower threshold of -28C. The temperature alarm would never deassert even if the temperature dropped below the upper threshold. Fixes: d5c70627a794 ("iio: adc: Add Xilinx AMS driver") Signed-off-by: Sean Anderson Reviewed-by: O'Griofa, Conall Tested-by: Erim, Salih Acked-by: Erim, Salih Link: https://patch.msgid.link/20250715003058.2035656-1-sean.anderson@linux.dev Cc: Signed-off-by: Jonathan Cameron commit feb500c7ae7a198db4d2757901bce562feeefa5e Author: Sean Anderson Date: Mon Jul 14 20:28:47 2025 -0400 iio: xilinx-ams: Unmask interrupts after updating alarms To convert level-triggered alarms into edge-triggered IIO events, alarms are masked when they are triggered. To ensure we catch subsequent alarms, we then periodically poll to see if the alarm is still active. If it isn't, we unmask it. Active but masked alarms are stored in current_masked_alarm. If an active alarm is disabled, it will remain set in current_masked_alarm until ams_unmask_worker clears it. If the alarm is re-enabled before ams_unmask_worker runs, then it will never be cleared from current_masked_alarm. This will prevent the alarm event from being pushed even if the alarm is still active. Fix this by recalculating current_masked_alarm immediately when enabling or disabling alarms. Fixes: d5c70627a794 ("iio: adc: Add Xilinx AMS driver") Signed-off-by: Sean Anderson Reviewed-by: O'Griofa, Conall Tested-by: Erim, Salih Acked-by: Erim, Salih Link: https://patch.msgid.link/20250715002847.2035228-1-sean.anderson@linux.dev Cc: Signed-off-by: Jonathan Cameron commit 5c2bf13c9ae951d63c97b367f4e7989d4913dcf3 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:31:51 2025 +0200 dt-bindings: iio: adi,ltc2664: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250821083150.46554-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit a20b83cf45be2057f3d073506779e52c7fa17f94 Author: Simon Schuster Date: Thu Aug 21 12:37:07 2025 +0200 nios2: ensure that memblock.current_limit is set when setting pfn limits On nios2, with CONFIG_FLATMEM set, the kernel relies on memblock_get_current_limit() to determine the limits of mem_map, in particular for max_low_pfn. Unfortunately, memblock.current_limit is only default initialized to MEMBLOCK_ALLOC_ANYWHERE at this point of the bootup, potentially leading to situations where max_low_pfn can erroneously exceed the value of max_pfn and, thus, the valid range of available DRAM. This can in turn cause kernel-level paging failures, e.g.: [ 76.900000] Unable to handle kernel paging request at virtual address 20303000 [ 76.900000] ea = c0080890, ra = c000462c, cause = 14 [ 76.900000] Kernel panic - not syncing: Oops [ 76.900000] ---[ end Kernel panic - not syncing: Oops ]--- This patch fixes this by pre-calculating memblock.current_limit based on the upper limits of the available memory ranges via adjust_lowmem_bounds, a simplified version of the equivalent implementation within the arm architecture. Signed-off-by: Simon Schuster Signed-off-by: Andreas Oetken Signed-off-by: Dinh Nguyen commit e6d8afd2ca731105bf7eba69a61c668fead9cf48 Author: Thomas Huth Date: Fri Mar 14 08:09:52 2025 +0100 nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Dinh Nguyen Signed-off-by: Thomas Huth Signed-off-by: Dinh Nguyen commit 331b05b12d25cd2d2f2d7c4114e9ee15146dafd0 Author: Thomas Huth Date: Fri Mar 14 08:09:51 2025 +0100 nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Dinh Nguyen Signed-off-by: Thomas Huth Signed-off-by: Dinh Nguyen commit 60ad9a07319283e6e1094cef3e972e754315c024 Author: Junjie Cao Date: Wed Aug 20 08:47:55 2025 +0800 iio: core: switch info_mask fields to unsigned long to match find_bit helpers for_each_set_bit()/find_*_bit() expect arrays of unsigned long (see include/linux/find.h), but industrialio-core passed const long * into iio_device_add_info_mask_type{,_avail}(). These masks are used purely as bit arrays and are populated via BIT() (1UL << n). Switch the info_mask_* fields and the corresponding function parameters to unsigned long so the types match the helpers. This removes sparse warnings about signedness mismatches (seen with 'make C=1' CF='-Wsparse-all') without changing behavior or struct layout. No functional change intended. Suggested-by: Jonathan Cameron Signed-off-by: Junjie Cao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250820004755.69627-1-junjie.cao@intel.com Signed-off-by: Jonathan Cameron commit 56f548840ed90c30269f29c3bdf6037a8a9414a6 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:55 2025 +0200 gpio: ge: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-14-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 90ab7050358ffd3311c23b1697df2ba3c8f840c6 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:54 2025 +0200 gpio: mpc8xxx: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-13-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 67e4be48f409ba70738eef3c195a81455f526f83 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:53 2025 +0200 gpio: grgpio: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-12-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit ebd63ab0f20f4e1960191da6989797ac78fedc4c Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:52 2025 +0200 gpio: rda: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-11-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 728e0ca4e196d65e00775ea3f7a49ce008fbd3a7 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:51 2025 +0200 gpio: amdpt: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-10-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 84bebb7e7ed000a2c4786094698536a3a3f67083 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:50 2025 +0200 gpio: dwapb: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-9-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 4ba2193ce0b94c28ec2095a1bb79353c82214d35 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:49 2025 +0200 gpio: loongson-64bit: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-8-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 9215a4fb59425588233d3362e886dc156c1739af Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:48 2025 +0200 gpio: ts4800: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-7-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit ac1eca3ab9fc4d17b59da12597c671df7739f934 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:47 2025 +0200 gpio: ts4800: use dev_err_probe() Use dev_err_probe() where applicable. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-6-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 8a8e9a1a9272f262699960ca2782de87ea69dd32 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:46 2025 +0200 gpio: ts4800: use generic device properties Avoid pulling in linux/of.h by using the generic device properties. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-5-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit d6307707d50b468d614a80daf60ead8b7036f156 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:45 2025 +0200 gpio: ts4800: remove the unnecessary call to platform_set_drvdata() There's no corresponding call to platform_get_drvdata() or dev_get_drvdata(). Remove the call to platform_set_drvdata() from .probe(). Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-4-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 13ba232ed8455a5decb187d509a0d326fd326b19 Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:44 2025 +0200 gpio: hisi: use the BGPIOF_UNREADABLE_REG_DIR flag There's no reason for this driver to touch the gpio-mmio internals, we have a dedicated flag passed to bgpio_init() indicating to the module that the DIR register is unreadable. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-3-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 16397871b6e35fa46a2bec27b3558f93b050c6fc Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:43 2025 +0200 gpio: generic: provide helpers for reading and writing registers Provide helpers wrapping the read_reg() and write_reg() callbacks of the generic GPIO API that are called directly by many users. This is done to hide their implementation ahead of moving them into the separate generic GPIO struct. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-2-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 6e376f245f19feeadddafb2c3fa5fbd6469ecdfe Author: Bartosz Golaszewski Date: Mon Aug 25 11:48:42 2025 +0200 gpio: generic: provide to_gpio_generic_chip() Provide a helper allowing to convert a struct gpio_chip address to the struct gpio_generic_chip that wraps it. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250825-gpio-mmio-gpio-conv-v1-1-356b4b1d5110@linaro.org Signed-off-by: Bartosz Golaszewski commit 21feb435be9b19a0be8b2c44a9efb7a5296c9a66 Author: Frank Li Date: Mon Aug 18 16:00:13 2025 -0400 dt-bindings: iio: adc: max1238: Add #io-channel-cells property Add #io-channel-cells property with a constant value of 1 because it is multi-channel ADC. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-iot.dtb: adc@35 (maxim,max1239): '#io-channel-cells' does not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/iio/adc/maxim,max1238.yaml# Signed-off-by: Frank Li Acked-by: Conor Dooley Link: https://patch.msgid.link/20250818200014.3700738-1-Frank.Li@nxp.com Signed-off-by: Jonathan Cameron commit dc757dc1572d579c2634c05d0a03c5676227c571 Author: Cryolitia PukNgae Date: Thu Aug 21 15:52:36 2025 +0800 iio: imu: bmi270: Match PNP ID found on newer GPD firmware GPD devices originally used BMI160 sensors with the "BMI0160" PNP ID. When they switched to BMI260 sensors in newer hardware, they reused the existing Windows driver which accepts both "BMI0160" and "BMI0260" IDs. Consequently, they kept "BMI0160" in DSDT tables for new BMI260 devices, causing driver mismatches in Linux. 1. GPD updated BIOS v0.40+[1] for newer devices to report "BMI0260" for BMI260 sensors to avoid loading the bmi160 driver on Linux. While this isn't Bosch's VID; 2. Bosch's official Windows driver uses "BMI0260" as a compatible ID 3. We're seeing real devices shipping with "BMI0260" in DSDT The DSDT excerpt of GPD G1619-04 with BIOS v0.40: Scope (_SB.I2CC) { Device (BMA2) { Name (_ADR, Zero) // _ADR: Address Name (_HID, "BMI0260") // _HID: Hardware ID Name (_CID, "BMI0260") // _CID: Compatible ID Name (_DDN, "Accelerometer") // _DDN: DOS Device Name Name (_UID, One) // _UID: Unique ID Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings { Name (RBUF, ResourceTemplate () { I2cSerialBusV2 (0x0069, ControllerInitiated, 0x00061A80, AddressingMode7Bit, "\\_SB.I2CC", 0x00, ResourceConsumer, , Exclusive, ) }) Return (RBUF) /* \_SB_.I2CC.BMA2._CRS.RBUF */ } # omit some noise } } Link: http://download.softwincn.com/WIN%20Max%202024/Max2-7840-BIOS-V0.41.zip #1 Signed-off-by: Cryolitia PukNgae Reviewed-by: Andy Shevchenko Acked-by: Alex Lanzano Link: https://patch.msgid.link/20250821-bmi270-gpd-acpi-v4-1-5279b471d749@uniontech.com Signed-off-by: Jonathan Cameron commit 3c63ba1c430af1c0dcd68dd36f2246980621dcba Author: Aleksandar Gerasimovski Date: Mon Aug 11 13:09:04 2025 +0000 iio/adc/pac1934: fix channel disable configuration There are two problems with the chip configuration in this driver: - First, is that writing 12 bytes (ARRAY_SIZE(regs)) would anyhow lead to a config overflow due to HW auto increment implementation in the chip. - Second, the i2c_smbus_write_block_data write ends up in writing unexpected value to the channel_dis register, this is because the smbus size that is 0x03 in this case gets written to the register. The PAC1931/2/3/4 data sheet does not really specify that block write is indeed supported. This problem is probably not visible on PAC1934 version where all channels are used as the chip is properly configured by luck, but in our case whenusing PAC1931 this leads to nonfunctional device. Fixes: 0fb528c8255b (iio: adc: adding support for PAC193x) Suggested-by: Rene Straub Signed-off-by: Aleksandar Gerasimovski Reviewed-by: Marius Cristea Link: https://patch.msgid.link/20250811130904.2481790-1-aleksandar.gerasimovski@belden.com Cc: Signed-off-by: Jonathan Cameron commit c48156d111f00efd4cf6de57d710166d87ee2c5f Merge: 5893165a27e7d1 051f7141673aa1 Author: Bartosz Golaszewski Date: Mon Aug 25 11:42:44 2025 +0200 Merge branch 'ib-gpio_generic_chip_init' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into gpio/for-next Convert GPIO drivers under drivers/pinctrl/ to using the new generic GPIO chip API. commit ccef0530e60dc59b36cac1cae2d9a7d7f86ca99f Author: Qianfeng Rong Date: Tue Aug 19 20:50:17 2025 +0800 iio: common: scmi_iio: use kcalloc() instead of kzalloc() Replace calls of devm_kzalloc() with devm_kcalloc() in scmi_alloc_iiodev() and scmi_iio_set_sampling_freq_avail() for safer memory allocation with built-in overflow protection. Similarly, use array_size() instead of explicit multiplication for 'sensor->sensor_info->intervals.count * 2'. Signed-off-by: Qianfeng Rong Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250819125017.635182-1-rongqianfeng@vivo.com Signed-off-by: Jonathan Cameron commit a4ee7e220c1a83e18ac32e5a3a70461e1accd652 Author: Xing Guo Date: Tue Aug 19 14:56:34 2025 +0800 docs: iio: Fix unexpected indentation for adxl345. Resolved the following building error: Documentation/iio/adxl345.rst:161: ERROR: Unexpected indentation. [docutils] Fixes: fdcb9cb9178a ("docs: iio: add documentation for adxl345 driver") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250818124124.5b978e64@canb.auug.org.au Signed-off-by: Xing Guo Link: https://patch.msgid.link/20250819065634.1154322-1-higuoxing@gmail.com Signed-off-by: Jonathan Cameron commit 46809b9f43b406b7a13c091275e56e611d4e5de4 Author: Ben Collins Date: Fri Aug 22 09:23:54 2025 -0400 iio: mcp9600: Add support for thermocouple-type dt-bindings documentation for this driver claims to support thermocouple-type, but the driver does not actually make use of the property. Implement usage of the property to configure the chip for the selected thermocouple-type. Signed-off-by: Ben Collins Reviewed-by: David Lechner Link: https://patch.msgid.link/20250822-upstream-changes-v8-5-40bb1739e3e2@watter.com Signed-off-by: Jonathan Cameron commit 5efd60c974a2c2647a2ce87fb2e396011274cfed Author: Ben Collins Date: Fri Aug 22 09:23:53 2025 -0400 iio: mcp9600: Recognize chip id for mcp9601 The current driver works with mcp9601, but emits a warning because it does not recognize the chip id. MCP9601 is a superset of MCP9600. The drivers works without changes on this chipset. However, the 9601 chip supports open/closed-circuit detection if wired properly, so we'll need to be able to differentiate between them. Moved "struct mcp9600_data" up in the file since a later patch will need it and chip_info before the declarations. Signed-off-by: Ben Collins Reviewed-by: David Lechner Link: https://patch.msgid.link/20250822-upstream-changes-v8-4-40bb1739e3e2@watter.com Signed-off-by: Jonathan Cameron commit 74cae3eb72a07da8f9d623c19d7b74dd028d3861 Author: Ben Collins Date: Fri Aug 22 09:23:52 2025 -0400 iio: mcp9600: White space and fixed width cleanup Make tabs consistent for register definitions and also fix width to byte size. Signed-off-by: Ben Collins Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250822-upstream-changes-v8-3-40bb1739e3e2@watter.com Signed-off-by: Jonathan Cameron commit f6a52403fd2c1b581d4f78d79def57b803f29635 Author: Ben Collins Date: Fri Aug 22 09:23:51 2025 -0400 dt-bindings: iio: mcp9600: Add microchip,mcp9601 and add constraints Add microchip,mcp9601 compatible in addition to the original microchip,mcp9600 to designate support between these two chips. The current dt-binding has open-circuit and short-circuit as interrupt names, but these are only supported in mcp9601. The OC and SC detection requires that mcp9601 VSENSE be wired up, which not only enables the OC SC interrupts, but also the OC and SC status register bits. Add a microchip,vsense boolean to show the chip is wired for this support. Add constraints so this feature only applies if the mcp9601 compatible is selected. Signed-off-by: Ben Collins Reviewed-by: Krzysztof Kozlowski Reviewed-by: David Lechner Link: https://patch.msgid.link/20250822-upstream-changes-v8-2-40bb1739e3e2@watter.com Signed-off-by: Jonathan Cameron commit 894751730a0d1674e43167b187e6605371667c8b Author: Mohammad Rafi Shaik Date: Thu Aug 21 10:19:07 2025 +0530 dt-bindings: pinctrl: qcom,sc7280-lpass-lpi-pinctrl: Document the clock property Document the clock property in sc7280 LPASS LPI pinctrl node. Clock settings required for Audioreach solution. The existing SC7280 platform only supports non-ADSP audio solutions. To enable audio functionality on ADSP with the AudioReach solution. additional core and audio hardware clocks must be configured. Without these clocks, the ADSP will crash. Signed-off-by: Mohammad Rafi Shaik Co-developed-by: Prasad Kumpatla Signed-off-by: Prasad Kumpatla Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250821044914.710044-3-quic_pkumpatl@quicinc.com Signed-off-by: Linus Walleij commit 1b558e14f3c17dc29ce2e8cd0b8bd385e108734b Author: Thomas Gleixner Date: Thu Jul 31 16:12:19 2025 +0200 x86/apic: Make the ISR clearing sane apic_pending_intr_clear() is fundamentally voodoo programming. It's primary purpose is to clear stale ISR bits in the local APIC, which would otherwise lock the corresponding interrupt priority level. The comments and the implementation claim falsely that after clearing the stale ISR bits, eventually stale IRR bits would be turned into ISR bits and can be cleared as well. That's just wishful thinking because: 1) If interrupts are disabled, the APIC does not propagate an IRR bit to the ISR. 2) If interrupts are enabled, then the APIC propagates the IRR bit to the ISR and raises the interrupt in the CPU, which means that code _cannot_ observe the ISR bit for any of those IRR bits. Rename the function to reflect the purpose and make exactly _one_ attempt to EOI the pending ISR bits and add comments why traversing the pending bit map in low to high priority order is correct. Instead of trying to "clear" IRR bits, simply print a warning message when the IRR is not empty. Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/871ppwih4s.ffs@tglx commit 5de6c855e23e99d76c143ee2a29766e7f7f9fe65 Author: Przemek Kitszel Date: Wed Aug 20 12:39:20 2025 +0200 ice: add virt/ and move ice_virtchnl* files there Introduce virt/ directory to collect virtchnl files. We are going to implement a few sizable extensions soon, each of them increasing virt/ size, so it looks sensible to introduce a new dir. Suggested-by: Jacob Keller Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit d6d389646a35daae9fc1f21fe9221dcb7b3cc41f Author: Ben Collins Date: Fri Aug 22 09:23:50 2025 -0400 dt-bindings: iio: mcp9600: Set default 3 for thermocouple-type As is already documented in this file, Type-K is the default, so make that explicit in the dt-bindings. Signed-off-by: Ben Collins Reviewed-by: Krzysztof Kozlowski Reviewed-by: David Lechner Link: https://patch.msgid.link/20250822-upstream-changes-v8-1-40bb1739e3e2@watter.com Signed-off-by: Jonathan Cameron commit 1f53971032a582dc8bcc7d26acfcfe2bf1ae51d6 Author: Xichao Zhao Date: Thu Aug 21 16:06:51 2025 +0800 iio: temperature: mlx90635: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Acked-by: Crt Mori Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-8-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 7216d7b9beb87f4afd62d737f024254ca3c0746c Author: Xichao Zhao Date: Thu Aug 21 16:06:50 2025 +0800 iio: proximity: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-7-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 660586969ea3add4a2a29437d89ef5a6d87a5aaa Author: Xichao Zhao Date: Thu Aug 21 16:06:49 2025 +0800 iio: light: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-6-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit d3a7db87dad680b87473bd5d79139142cb88bbde Author: Xichao Zhao Date: Thu Aug 21 16:06:48 2025 +0800 iio: imu: bmi323: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-5-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit e407199c961f229463c9ede59d319182a2d58904 Author: Xichao Zhao Date: Thu Aug 21 16:06:47 2025 +0800 iio: chemical: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Gustavo Silva # for ens160 Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-4-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 3a4cdd1155de2c7d90a35d67b779774045e4cbb1 Author: Xichao Zhao Date: Thu Aug 21 16:06:46 2025 +0800 iio: adc: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Martin Blumenstingl # meson_saradc Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-3-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 666a22bb31e48ec467b77ec61fe1630a18ea0c2d Author: Xichao Zhao Date: Thu Aug 21 16:06:45 2025 +0800 iio: accel: msa311: Remove dev_err_probe() if error is -ENOMEM The dev_err_probe() doesn't do anything when the error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250821080723.525379-2-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 3f33d1530c2c9576b57ecd220bfa7e527184a80b Author: Salih Erim Date: Wed Aug 20 11:05:19 2025 +0100 MAINTAINERS: Update xilinx-ams driver maintainers Anand left AMD/Xilinx some time ago. Salih and Connall are new maintainers of xilinx-ams driver. Signed-off-by: Salih Erim Acked-by: Rob Herring (Arm) Acked-by: Michal Simek Acked-by: O'Griofa, Conall Link: https://patch.msgid.link/20250820100519.2272509-1-salih.erim@amd.com Signed-off-by: Jonathan Cameron commit 086e410063be831d2a5622aa313b459122b02942 Author: Salah Triki Date: Tue Aug 19 16:00:53 2025 +0100 staging: iio: adc: ad7816: Drop unnecessary dev_set_drvdata() call Remove the call to `dev_set_drvdata()` and the associated comment since private data is never read. Signed-off-by: Salah Triki Reviewed-by: David Lechner Link: https://patch.msgid.link/aKSRpTuwA0P-ZaUS@pc Signed-off-by: Jonathan Cameron commit d20a8a8ecdb7c3807bdd738338930f0796678cd4 Author: Dan Carpenter Date: Tue Aug 19 18:02:53 2025 +0300 iio: proximity: vl53l0x-i2c: Fix error code in probe() Commit 65e8202f0322 ("iio: Remove error prints for devm_add_action_or_reset()") accidentally introduced a bug where we returned "ret" but the error code was stored in "error" if devm_add_action_or_reset() failed. Using two variables to store error codes is unnecessary and confusing. Delete the "error" variable and use "ret" everywhere instead. Fixes: 65e8202f0322 ("iio: Remove error prints for devm_add_action_or_reset()") Signed-off-by: Dan Carpenter Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/aKSSHTdJf5QoYiRx@stanley.mountain Signed-off-by: Jonathan Cameron commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8 Author: Thomas Hellström Date: Thu Aug 21 16:30:45 2025 +0200 drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer. Signed-off-by: Thomas Hellström Fixes: 06951c2ee72d ("drm/xe: Use NULL PTEs as scratch PTEs") Cc: Brian Welty Cc: Rodrigo Vivi Cc: Lucas De Marchi Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821143045.106005-4-thomas.hellstrom@linux.intel.com commit b5dd1505a31c5cbe62ec50a70e9c9a7bd2a8f703 Author: Thomas Hellström Date: Thu Aug 21 16:30:44 2025 +0200 drm/xe/tests/xe_dma_buf: Set the drm_object::dma_buf member This member is set when exporting using prime. However the xe_gem_prime_export() alone doesn't set it, since it's done later in the prime export flow. For the test, set it manually and remove the hack that set it temporarily when it was really needed. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821143045.106005-3-thomas.hellstrom@linux.intel.com commit 0a51bf3e54dd8b77e6f1febbbb66def0660862d2 Author: Thomas Hellström Date: Thu Aug 21 16:30:43 2025 +0200 drm/xe/vm: Don't pin the vm_resv during validation The pinning has the odd side-effect that unlocking *any* resv during validation triggers an "unlocking pinned lock" warning. Cc: Matthew Brost Fixes: 9d5558649f68 ("drm/xe: Rework eviction rejection of bound external bos") Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821143045.106005-2-thomas.hellstrom@linux.intel.com commit 5b9057cfafaaabc3c91a4e3e3bec024651737e66 Merge: 73c94172e27819 1b237f190eb3d3 Author: Greg Kroah-Hartman Date: Mon Aug 25 09:20:17 2025 +0200 Merge 6.17-rc3 into char-misc-next We need the char/misc/iio fixes in here as well to build on. Signed-off-by: Greg Kroah-Hartman commit b71763a0a3305b685e0378b7f7a4c4c16d4c66ba Merge: 349a64256534aa 1b237f190eb3d3 Author: Greg Kroah-Hartman Date: Mon Aug 25 09:18:23 2025 +0200 Merge 6.17-rc3 into driver-core-next We need the driver core and rust fixes in here as well to build on top of. Signed-off-by: Greg Kroah-Hartman commit 3474a19736f39516cffced66dcfb818be6abf2f4 Merge: d15fbd3ea75bc8 1b237f190eb3d3 Author: Greg Kroah-Hartman Date: Mon Aug 25 09:16:46 2025 +0200 Merge 6.17-rc3 into usb-next We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit 9cc10041e9fe7f32c4817e3cdd806ff1986d266c Author: Jouni Högander Date: Thu Aug 21 07:59:17 2025 +0300 drm/i915/psr: Check drm_dp_dpcd_read return value on PSR dpcd init Currently we are ignoriong drm_dp_dpcd_read return values when reading PSR and Panel Replay capability DPCD register. Rework intel_psr_dpcd a bit to take care of checking the return value. v2: use drm_dp_dpcd_read_data Signed-off-by: Jouni Högander Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250821045918.17757-1-jouni.hogander@intel.com commit 8ae04fe9ffc93d6bc3bc63ac08375427d69cee06 Author: Zbigniew Kempczyński Date: Wed Aug 20 10:39:04 2025 +0200 drm/xe/xe_sync: avoid race during ufence signaling Marking ufence as signalled after copy_to_user() is too late. Worker thread which signals ufence by memory write might be raced with another userspace vm-bind call. In map/unmap scenario unmap may still see ufence is not signalled causing -EBUSY. Change the order of marking / write to user-fence fixes this issue. Fixes: 977e5b82e090 ("drm/xe: Expose user fence from xe_sync_entry") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5536 Signed-off-by: Zbigniew Kempczyński Cc: Matthew Brost Cc: Matthew Auld Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250820083903.2109891-2-zbigniew.kempczynski@intel.com commit 2dbb3d70af6003dbf3c248cc01e36d7df142543a Author: Suraj Kandpal Date: Thu Aug 21 09:56:53 2025 +0530 drm/i915/edp: eDP Data Overrride We need override certain link rates in favour of the next available higher link rate. The Link rates that need to be overridden are indicated by a mask in VBT. To make sure these modes are skipped we don't add them in them in the sink rates array. --v2 -Update the link rates after we have a final set of link rates [Ankit] -Break this patch up [Ankit] -Optimize the assingment during loop [Ankit] --v3 -Add protection against broken VBTs [Jani] --v4 -Fix build errors -Create a seprate function to check if edp data override is selected and using the correct vbt --v5 -Use correct number to check the num of edp rates [Ankit] --v6 -No seprate function check if vbt is broken in the reject rate function [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250821042653.269227-4-suraj.kandpal@intel.com commit 835a0d544defa05d2425496d16d006b147df5bde Author: Suraj Kandpal Date: Thu Aug 21 09:56:52 2025 +0530 drm/i915/bios: Add function to check if edp data override is needed Add a function that helps identify if the rate provided needs to be overridden. For this we need a function that compares the rate provided and bitmask of rates provided in VBT. --v2 -Rename functions [Jani] -Return the mask instead of parsing it in function [Jani] -Move the declaration in header [Jani] --v3 -Change function name to depict what the function does [Ankit] --v4 -Lets not use hweight [Ankit] Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250821042653.269227-3-suraj.kandpal@intel.com commit 4d33c77cf2c3e8842c2f722e1efb6010b021dbc0 Author: Suraj Kandpal Date: Thu Aug 21 09:56:51 2025 +0530 drm/i915/vbt: Add eDP Data rate overrride field in VBT Add edp_data_rate_override field VBT which gives us a mask of rates which needs to be skipped in favour of subsequent higher rate. --v2 -Rename vbt field [Jani] -Fix comment to 263+ [Jani] -Use BIT_U32 [Jani] -Fix the bits assignment in vbt [Jani] --v3 -Add a mask which represents all link rates [Ankit] Bspec: 20124 Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250821042653.269227-2-suraj.kandpal@intel.com commit f840737d1746398c2993be34bfdc80bdc19ecae2 Author: Xichao Zhao Date: Tue Aug 19 19:26:54 2025 +0800 ASoC: SOF: imx: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Laurentiu Mihalcea Message-ID: <20250819112654.588527-1-zhao.xichao@vivo.com> Signed-off-by: Mark Brown commit bc017f28b1c6c3d44c3631f8f6d152b7e703e990 Author: Shengjiu Wang Date: Wed Aug 20 11:16:41 2025 +0800 ASoC: imx-hdmi: remove cpu_pdev related code If a defer probe happens for the cpu device, the return value for cpu_pdev "ret = -EINVAL" breaks defer probe. As the cpus->dai_name can be replaced by cpus->of_node, to simplify the code, remove related code for cpu_pdev. Fixes: 6a5f850aa83a ("ASoC: fsl: Add imx-hdmi machine driver") Signed-off-by: Shengjiu Wang Message-ID: <20250820031641.2158261-1-shengjiu.wang@nxp.com> Signed-off-by: Mark Brown commit 1cd0c7afef97c3192edc92774a62d36b2a0bf2e0 Merge: dd489c01c39717 043d9c6928b010 Author: Dave Airlie Date: Mon Aug 25 06:38:18 2025 +1000 Merge tag 'drm-misc-next-2025-08-21' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.18: Core Changes: bridge: - Support Content Protection property gpuvm: - Support madvice in Xe driver mipi: - Add more multi-read/write helpers for improved error handling Driver Changes: amdxdna: - Refactoring wrt. hardware contexts bridge: - display-connector: Improve DP display detection panel: - Fix includes in various drivers panthor: - Add support for Mali G710, G510, G310, Gx15, Gx20, Gx25 - Improve cache flushing Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250821073822.GA45904@2a02-2454-fd5e-fd00-8f09-b5f-980b-a7ef.dyn6.pyur.net commit 89a885972140ea68d3f55457d23d0da2350c96ac Author: Jens Axboe Date: Thu Aug 7 14:13:36 2025 -0600 io_uring/trace: support completion tracing of mixed 32b CQEs Check for IORING_CQE_F_32 as well, not just if the ring was setup with IORING_SETUP_CQE32 to only support big CQEs. Signed-off-by: Jens Axboe commit 82ceb7fcc5fff5377b24c45c9b3c06bc98f91b55 Author: Jens Axboe Date: Thu Aug 7 14:09:57 2025 -0600 io_uring/fdinfo: handle mixed sized CQEs Ensure that the CQ ring iteration handles differently sized CQEs, not just a fixed 16b or 32b size per ring. These CQEs aren't possible just yet, but prepare the fdinfo CQ ring dumping for handling them. Signed-off-by: Jens Axboe commit b69458735d826f0676585623d028a0fd474f3e4f Author: Jens Axboe Date: Thu Aug 7 14:08:14 2025 -0600 io_uring: add UAPI definitions for mixed CQE postings This adds the CQE flags related to supporting a mixed CQ ring mode, where both normal (16b) and big (32b) CQEs may be posted. No functional changes in this patch. Signed-off-by: Jens Axboe commit d0201c4436c53412146d526855c585fa9d54ca13 Author: Jens Axboe Date: Thu Aug 7 14:01:46 2025 -0600 io_uring: remove io_ctx_cqe32() helper It's pretty pointless and only used for the tracing helper, get rid of it. Signed-off-by: Jens Axboe commit e5c717e7953b688049cdc2a2a474e4905e0da3c0 Author: Caleb Sander Mateos Date: Thu Aug 21 10:33:08 2025 -0600 io_uring/cmd: consolidate REQ_F_BUFFER_SELECT checks io_uring_cmd_prep() checks that REQ_F_BUFFER_SELECT is set in the io_kiocb's flags iff IORING_URING_CMD_MULTISHOT is set in the SQE's uring_cmd_flags. Consolidate the IORING_URING_CMD_MULTISHOT and !IORING_URING_CMD_MULTISHOT branches into a single check that the IORING_URING_CMD_MULTISHOT flag matches the REQ_F_BUFFER_SELECT flag. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250821163308.977915-4-csander@purestorage.com Signed-off-by: Jens Axboe commit 3484f530f8d9da08b71d1e604dcd4ab8868d9919 Author: Caleb Sander Mateos Date: Thu Aug 21 10:33:07 2025 -0600 io_uring/cmd: deduplicate uring_cmd_flags checks io_uring_cmd_prep() currently has two checks for whether IORING_URING_CMD_FIXED and IORING_URING_CMD_MULTISHOT are both set in uring_cmd_flags. Remove the second check. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250821163308.977915-3-csander@purestorage.com Signed-off-by: Jens Axboe commit 620a50c927004f5c9420a7ca9b1a55673dbf3941 Author: Ming Lei Date: Thu Aug 21 12:02:07 2025 +0800 io_uring: uring_cmd: add multishot support Add UAPI flag IORING_URING_CMD_MULTISHOT for supporting multishot uring_cmd operations with provided buffer. This enables drivers to post multiple completion events from a single uring_cmd submission, which is useful for: - Notifying userspace of device events (e.g., interrupt handling) - Supporting devices with multiple event sources (e.g., multi-queue devices) - Avoiding the need for device poll() support when events originate from multiple sources device-wide The implementation adds two new APIs: - io_uring_cmd_select_buffer(): selects a buffer from the provided buffer group for multishot uring_cmd - io_uring_mshot_cmd_post_cqe(): posts a CQE after event data is pushed to the provided buffer Multishot uring_cmd must be used with buffer select (IOSQE_BUFFER_SELECT) and is mutually exclusive with IORING_URING_CMD_FIXED for now. The ublk driver will be the first user of this functionality: https://github.com/ming1/linux/commits/ublk-devel/ Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250821040210.1152145-3-ming.lei@redhat.com [axboe: fold in fix for !CONFIG_IO_URING] Signed-off-by: Jens Axboe commit d589bcddaa3f8b1668499c3f0466863df3abe37a Author: Ming Lei Date: Thu Aug 21 12:02:06 2025 +0800 io-uring: move `struct io_br_sel` into io_uring_types.h Move `struct io_br_sel` into io_uring_types.h and prepare for supporting provided buffer on uring_cmd. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250821040210.1152145-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit fe524b06843c19cf8d0025b644d56c4c31e60bc9 Author: Jens Axboe Date: Wed Aug 20 20:03:41 2025 -0600 io_uring/kbuf: check for ring provided buffers first in recycling This is the most likely of paths if a provided buffer is used, so offer it up first and push the legacy buffers to later. Link: https://lore.kernel.org/r/20250821020750.598432-14-axboe@kernel.dk Signed-off-by: Jens Axboe commit e973837b54024f070b2b48c7ee9725548548257a Author: Jens Axboe Date: Wed Aug 20 20:03:40 2025 -0600 io_uring: remove async/poll related provided buffer recycles These aren't necessary anymore, get rid of them. Link: https://lore.kernel.org/r/20250821020750.598432-13-axboe@kernel.dk Signed-off-by: Jens Axboe commit 5fda51255439addd1c9059098e30847a375a1008 Author: Jens Axboe Date: Wed Aug 20 20:03:39 2025 -0600 io_uring/kbuf: switch to storing struct io_buffer_list locally Currently the buffer list is stored in struct io_kiocb. The buffer list can be of two types: 1) Classic/legacy buffer list. These don't need to get referenced after a buffer pick, and hence storing them in struct io_kiocb is perfectly fine. 2) Ring provided buffer lists. These DO need to be referenced after the initial buffer pick, as they need to get consumed later on. This can be either just incrementing the head of the ring, or it can be consuming parts of a buffer if incremental buffer consumptions has been configured. For case 2, io_uring needs to be careful not to access the buffer list after the initial pick-and-execute context. The core does recycling of these, but it's easy to make a mistake, because it's stored in the io_kiocb which does persist across multiple execution contexts. Either because it's a multishot request, or simply because it needed some kind of async trigger (eg poll) for retry purposes. Add a struct io_buffer_list to struct io_br_sel, which is always on stack for the various users of it. This prevents the buffer list from leaking outside of that execution context, and additionally it enables kbuf to not even pass back the struct io_buffer_list if the given context isn't appropriately locked already. This doesn't fix any bugs, it's simply a defensive measure to prevent any issues with reuse of a buffer list. Link: https://lore.kernel.org/r/20250821020750.598432-12-axboe@kernel.dk Signed-off-by: Jens Axboe commit 461382a51fb83a9c4b7c50e1f10d3ca94edff25e Author: Jens Axboe Date: Wed Aug 20 20:03:38 2025 -0600 io_uring/net: use struct io_br_sel->val as the send finish value Currently a pointer is passed in to the 'ret' in the send mshot handler, but since we already have a value field in io_br_sel, just use that. This is also in preparation for needing to pass in struct io_br_sel to io_send_finish() anyway. Link: https://lore.kernel.org/r/20250821020750.598432-11-axboe@kernel.dk Signed-off-by: Jens Axboe commit 58d815091890e83aa2f83a9cce1fdfe3af02c7b4 Author: Jens Axboe Date: Wed Aug 20 20:03:37 2025 -0600 io_uring/net: use struct io_br_sel->val as the recv finish value Currently a pointer is passed in to the 'ret' in the receive handlers, but since we already have a value field in io_br_sel, just use that. This is also in preparation for needing to pass in struct io_br_sel to io_recv_finish() anyway. Link: https://lore.kernel.org/r/20250821020750.598432-10-axboe@kernel.dk Signed-off-by: Jens Axboe commit 429884ff35f75a8ac3e8f822f483e220e3ea6394 Author: Jens Axboe Date: Wed Aug 20 20:03:36 2025 -0600 io_uring/kbuf: use struct io_br_sel for multiple buffers picking The networking side uses bundles, which is picking multiple buffers at the same time. Pass in struct io_br_sel to those helpers. Link: https://lore.kernel.org/r/20250821020750.598432-9-axboe@kernel.dk Signed-off-by: Jens Axboe commit d8e1dec2f860ee40623609aa6c4f22e1ee45605d Author: Jens Axboe Date: Wed Aug 20 20:03:35 2025 -0600 io_uring/rw: recycle buffers manually for non-mshot reads The mshot side of reads already does this, but the regular read path does not. This leads to needing recycling checks sprinkled in various spots in the "go async" path, like arming poll. In preparation for getting rid of those, ensure that read recycles appropriately. Link: https://lore.kernel.org/r/20250821020750.598432-8-axboe@kernel.dk Signed-off-by: Jens Axboe commit ab6559bdbb08f6bee606435cd014fc5ba0f7b750 Author: Jens Axboe Date: Wed Aug 20 20:03:34 2025 -0600 io_uring/kbuf: introduce struct io_br_sel Rather than return addresses directly from buffer selection, add a struct around it. No functional changes in this patch, it's in preparation for storing more buffer related information locally, rather than in struct io_kiocb. Link: https://lore.kernel.org/r/20250821020750.598432-7-axboe@kernel.dk Signed-off-by: Jens Axboe commit 1b5add75d7c894c62506c9b55f1d9eaadae50ef1 Author: Jens Axboe Date: Wed Aug 20 20:03:33 2025 -0600 io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers Rather than have this implied being in the io_kiocb, pass it in directly so it's immediately obvious where these users of ->buf_list are coming from. Link: https://lore.kernel.org/r/20250821020750.598432-6-axboe@kernel.dk Signed-off-by: Jens Axboe commit b22743f29b7d3dc68c68f9bd39a1b2600ec6434e Author: Jens Axboe Date: Wed Aug 20 20:03:32 2025 -0600 io_uring/net: clarify io_recv_buf_select() return value It returns 0 on success, less than zero on error. Link: https://lore.kernel.org/r/20250821020750.598432-5-axboe@kernel.dk Signed-off-by: Jens Axboe commit 15ba5e51e689ceb1c2e921c5180a70c88cfdc8e9 Author: Jens Axboe Date: Wed Aug 20 20:03:31 2025 -0600 io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases A previous commit used io_net_kbuf_recyle() for any network helper that did IO and needed partial retry. However, that's only needed if the opcode does buffer selection, which isnt support for sendzc, sendmsg_zc, or sendmsg. Just remove them - they don't do any harm, but it is a bit confusing when reading the code. Link: https://lore.kernel.org/r/20250821020750.598432-4-axboe@kernel.dk Signed-off-by: Jens Axboe commit 5e73b402cbbea51bcab90fc5ee6c6d06af76ae1b Author: Jens Axboe Date: Wed Aug 20 20:03:30 2025 -0600 io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments Picking multiple buffers always requires the ring lock to be held across the operation, so there's no need to pass in the issue_flags to io_put_kbufs(). On the single buffer side, if the initial picking of a ring buffer was unlocked, then it will have been committed already. For legacy buffers, no locking is required, as they will simply be freed. Link: https://lore.kernel.org/r/20250821020750.598432-3-axboe@kernel.dk Signed-off-by: Jens Axboe commit ab3ea6eac5f45669b091309f592c4ea324003053 Author: Pavel Begunkov Date: Thu Aug 14 15:40:57 2025 +0100 io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 92a96b0a227e91dc42475265a1ce766b6cd044fa Author: Pavel Begunkov Date: Sun Aug 17 23:09:18 2025 +0100 io_uring: add request poisoning Poison various request fields on free. __io_req_caches_free() is a slow path, so can be done unconditionally, but gate it on kasan for io_req_add_to_cache(). Note that some fields are logically retained between cache allocations and can't be poisoned in io_req_add_to_cache(). Ideally, it'd be replaced with KASAN'ed caches, but that can't be enabled because of some synchronisation nuances. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5052d5cf1359e9057ec311788c12997406fdb2fc Author: Michal Wilczynski Date: Fri Aug 22 00:20:17 2025 +0200 riscv: dts: thead: th1520: Add IMG BXM-4-64 GPU node Add a device tree node for the IMG BXM-4-64 GPU present in the T-HEAD TH1520 SoC used by the Lichee Pi 4A board. This node enables support for the GPU using the drm/imagination driver. By adding this node, the kernel can recognize and initialize the GPU, providing graphics acceleration capabilities on the Lichee Pi 4A and other boards based on the TH1520 SoC. Add fixed clock gpu_mem_clk, as the MEM clock on the T-HEAD SoC can't be controlled programatically. Reviewed-by: Ulf Hansson Reviewed-by: Drew Fustini Reviewed-by: Bartosz Golaszewski Acked-by: Matt Coster Signed-off-by: Michal Wilczynski Signed-off-by: Drew Fustini commit fe927defbb4f31c15a52f0372d7f5d608f161086 Author: Miguel Ojeda Date: Sat Aug 16 23:19:00 2025 +0200 rust: alloc: remove `allocator_test` Given we do not have tests that rely on it anymore, remove `allocator_test`, which simplifies the complexity of the build. In particular, it avoids potential issues with `rusttest`, such as the one fixed at [1], where a public function was added to `Kmalloc` and used elsewhere, but it was not added to `Cmalloc`; or trivial issues like a missing import [2] due to not many people testing that target. The only downside is that we cannot use it in the `macros`' crate examples anymore, but we did not feel a need for that so far, and anyway we could support that by running those within the kernel too, which we may do regardless. Link: https://lore.kernel.org/rust-for-linux/20250816204215.2719559-1-ojeda@kernel.org/ [1] Link: https://lore.kernel.org/rust-for-linux/20250816210214.2729269-1-ojeda@kernel.org/ [2] Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250816211900.2731720-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 17d5efcbfe6f3da23afb79d84c27cefb2b3f331a Author: Miguel Ojeda Date: Sat Jul 26 20:07:50 2025 +0200 rust: kernel: remove support for unused host `#[test]`s Since commit 028df914e546 ("rust: str: convert `rusttest` tests into KUnit"), we do not have anymore host `#[test]`s that run in the host. Moreover, we do not plan to add any new ones -- tests should generally run within KUnit, since there they are built the same way the kernel does. While we may want to have some way to define tests that can also be run outside the kernel, we still want to test within the kernel too [1], and thus would likely use a custom syntax anyway to define them. Thus simplify the `rusttest` target by removing support for host `#[test]`s for the `kernel` crate. This still maintains the support for the `macros` crate, even though we do not have any such tests there. Link: https://lore.kernel.org/rust-for-linux/CABVgOS=AKHSfifp0S68K3jgNZAkALBr=7iFb=niryG5WDxjSrg@mail.gmail.com/ [1] Signed-off-by: Miguel Ojeda Reviewed-by: Danilo Krummrich Reviewed-by: David Gow Link: https://lore.kernel.org/r/20250726180750.2735836-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 55b48e23f5c4b6f5ca9b7ab09599b17dcf501c10 Author: Pan Chuang Date: Tue Aug 5 17:29:22 2025 +0800 genirq/devres: Add error handling in devm_request_*_irq() devm_request_threaded_irq() and devm_request_any_context_irq() currently don't print any error message when interrupt registration fails. This forces each driver to implement redundant error logging - over 2,000 lines of error messages exist across drivers. Additionally, when upper-layer functions propagate these errors without logging, critical debugging information is lost. Add devm_request_result() helper to unify error reporting via dev_err_probe(), Use it in devm_request_threaded_irq() and devm_request_any_context_irq() printing device name, IRQ number, handler functions, and error code on failure automatically. Co-developed-by: Yangtao Li Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250805092922.135500-2-panchuang@vivo.com commit 8ff1c16c753e293c3ba20583cb64f81ea7b9a451 Author: Bibo Mao Date: Mon Aug 4 16:19:46 2025 +0800 irqchip/loongson-eiointc: Add multiple interrupt pin routing support The eiointc interrupt controller supports 256 interrupt vectors at most, and the interrupt handler gets the interrupt status from the base register group EIOINTC_REG_ISR at the interrupt specific offset. It needs to read the register group EIOINTC_REG_ISR four times to get all 256 interrupt vectors status. Eiointc registers including EIOINTC_REG_ISR are software emulated for VMs, so there will be VM-exits when accessing eiointc registers. Introduce a method to make the eiointc interrupt controller route to different CPU interrupt pins for every 64 interrupt vectors. The interrupt handler can then reduce the read to one specific EIOINTC_REG_ISR register instead of all four, which reduces VM exits. [ tglx: Massage change log ] Signed-off-by: Bibo Mao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250804081946.1456573-3-maobibo@loongson.cn commit 7fb83eb664e9b3a0438dd28859e9f0fd49d4c165 Author: Bibo Mao Date: Mon Aug 4 16:19:45 2025 +0800 irqchip/loongson-eiointc: Route interrupt parsed from bios table Interrupt controller eiointc routes interrupts to CPU interface IP0 - IP7. It is currently hard-coded that eiointc routes interrupts to the CPU starting from IP1, but it should base that decision on the parent interrupt, which is provided by ACPI or DTS. Retrieve the parent's hardware interrupt number and store it in the descriptor of the eointc instance, so that the routing function can utilize it for the correct route settings. [ tglx: Massaged change log ] Signed-off-by: Bibo Mao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250804081946.1456573-2-maobibo@loongson.cn commit b3d7fb3fb2227259aa2fc54916cc808614f3ac24 Author: Jimmy Hon Date: Mon Aug 11 21:57:55 2025 -0500 arm64: dts: rockchip: enable NPU on OPI5/5B The NPU on the Orange Pi 5/5B uses the same regulator for both the sram-supply and the npu's supply. Enable all the NPU bits. Also add the regulator as a domain-supply to the pd_npu power domain. Signed-off-by: Jimmy Hon Link: https://lore.kernel.org/r/20250812025755.2078-2-honyuenkwun@gmail.com Signed-off-by: Heiko Stuebner commit 34f7620912bb0f881a23dfea529e69fd2e8fdcf2 Author: Alexey Charkov Date: Wed Aug 13 00:30:25 2025 +0400 arm64: dts: rockchip: Add Bluetooth on rk3576-evb1-v10 Add device tree nodes to enable Bluetooth in the Ampak AP6275P module found on Rockchip RK3576 EVB1 and connected over a UART link. Note that this doesn't enable the out-of-band PCM connection. It's routed to SAI2 M0 pins in case anyone wishes to add it. Tested-by: Pavel Zhovner Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-3-d13c83422971@gmail.com Signed-off-by: Heiko Stuebner commit ebf8183ad08afc4fcabe1379a5098354829d950d Author: Alexey Charkov Date: Wed Aug 13 00:30:24 2025 +0400 arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10 Add device tree nodes to enable the onboard Ampak AP6275P WiFi chip connected over a PCIe link on Rockchip RK3576 EVB1. It takes an external 32 kHz clock from the RTC chip and requires the WIFI_REG_ON signal to be enabled before the bus is enumerated to initialize properly. Tested-by: Pavel Zhovner Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-2-d13c83422971@gmail.com Signed-off-by: Heiko Stuebner commit 0adaae77862932a19cc14c086d7fd15ec0ef7703 Author: Alexey Charkov Date: Wed Aug 13 00:30:23 2025 +0400 arm64: dts: rockchip: Add RTC on rk3576-evb1-v10 Add the I2C connected RTC chip to the Rockchip RK3576 EVB1 board. Apart from the realtime clock functionality, it also provides a 32 kHz clock source for the onboard WiFi chip. Tested-by: Pavel Zhovner Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-1-d13c83422971@gmail.com Signed-off-by: Heiko Stuebner commit bb9ef44f05c9558d58e3c9da141e93af1aa11c1f Author: Chukun Pan Date: Mon Aug 18 18:00:09 2025 +0800 arm64: dts: rockchip: Add HINLINK H66K The HINLINK H66K is a development board with the Rockchip RK3568 SoC. It has the following features: - 2/4GB LPDDR4 - 1x HDMI Type A - 3.5mm jack with mic - 1x PCIE 2.0 WiFi slot - 1x USB 3.0, 2x USB 2.0 - 2x 2.5GbE RTL8125B Ethernet - MicroSD card slot / eMMC 32GB Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250818100009.170202-5-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 86a504b82f8d0e34f99ab9607712e7942c919fa3 Author: Chukun Pan Date: Mon Aug 18 18:00:08 2025 +0800 arm64: dts: rockchip: Add HINLINK H68K The HINLINK H68K is a development board with the Rockchip RK3568 SoC. It has the following features: - 2/4GB LPDDR4 - 1x HDMI Type A - 3.5mm jack with mic - 1x PCIE 2.0 WiFi slot - 1x USB 3.0, 2x USB 2.0 - 2x 1GbE RTL8211F Ethernet - 2x 2.5GbE RTL8125B Ethernet - MicroSD card slot / eMMC 32GB Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250818100009.170202-4-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 4bef07b79ab1ef7d963eaa2c37948030e418d538 Author: Chukun Pan Date: Mon Aug 18 18:00:07 2025 +0800 dt-bindings: arm: rockchip: Add HINLINK H66K / H68K The HINLINK H66K/H68K are 2.5GbE SBC based on the RK3568 SoC. Add devicetree binding documentation for them. Signed-off-by: Chukun Pan Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250818100009.170202-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 7d11b8c260ea68ce8f420ad467b04b21ea34b011 Author: Chukun Pan Date: Mon Aug 18 18:00:06 2025 +0800 dt-bindings: vendor-prefixes: Add HINLINK Add vendor prefix for HINLINK, which is an SBC manufacturer. Link: https://www.hinlink.cn/ Signed-off-by: Chukun Pan Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250818100009.170202-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit adecf78df945f4c7a1d29111b0002827f487df51 Author: Inochi Amaoto Date: Mon Aug 11 08:26:32 2025 +0800 irqchip/sifive-plic: Respect mask state when setting affinity plic_set_affinity() always calls plic_irq_enable(), which clears up the priority setting even the interrupt is only masked. This unmasks the interrupt unexpectly. Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid changing the priority setting. Suggested-by: Thomas Gleixner Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Nam Cao # VisionFive 2 Tested-by: Chen Wang # Pioneerbox Reviewed-by: Nam Cao Reviewed-by: Chen Wang Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/ commit 9c059700fee595142676a9bbaff6e40e3fcd9cbb Author: Sebastian Reichel Date: Mon Aug 18 19:18:40 2025 +0200 arm64: dts: rockchip: Enable RK3576 watchdog The RK3576 watchdog does not need any board specific resources, so let's enable it by default just like we do for RK3588. Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250818-rk3576-watchdog-v1-1-28f82e01029c@kernel.org Signed-off-by: Heiko Stuebner commit b92ff23b12046f70f7f41f1e57e77c498dec35d7 Author: Fushuai Wang Date: Mon Aug 11 14:47:01 2025 +0800 irqchip/sifive-plic: Use for_each_present_cpu() instead of for_each_cpu() Replace the open coded for_each_cpu(cpu, cpu_present_mask) loop with the more readable and equivalent for_each_present_cpu(cpu) macro. Signed-off-by: Fushuai Wang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250811064701.2906-1-wangfushuai@baidu.com commit 51548c36b37d0e84bd43a5f20bcbc36f70e61c5a Author: Waqar Hameed Date: Thu Aug 7 15:21:08 2025 +0200 counter: ti-ecap-capture: Use devm_pm_runtime_enable() There is no need to register a manual `devm` action for `pm_runtime_disable()` when `devm_pm_runtime_enable()` exists. It does the same thing (but also calls `pm_runtime_dont_use_autosuspend()`, which should be fine here). Moreover, when `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, the call to `dev_err_probe()` is useless. Note that `devm_pm_runtime_enable()` has a tail call to `devm_add_action_or_reset()` and thus returns that value. Therefore, replace `dev_err_probe()` with the returning value. Signed-off-by: Waqar Hameed Acked-by: Andrew Davis Link: https://lore.kernel.org/r/pnda54bjmij.a.out@axis.com Signed-off-by: William Breathitt Gray commit 36ee9770a8b24c71805760cb160c25ef91192823 Author: William Breathitt Gray Date: Sun Jun 15 23:27:47 2025 +0900 counter: Alphabetize component_id sysfs attributes Documentation list Prefer alphabetical order for the component_id sysfs attributes list in the Counter ABI Documentation file. This should make it easier for users to locate a component_id attribute in the list and its respective Documentation entry. Suggested-by: David Lechner Link: https://lore.kernel.org/r/20250615-alphabetize-component_id-doc-v1-1-4c5943b41198@kernel.org Signed-off-by: William Breathitt Gray commit c536e00d58dc8db3e1e430a8e6830bc22d2a38e3 Author: Troy Mitchell Date: Mon Aug 11 21:40:34 2025 +0800 clk: spacemit: fix sspax_clk Hardware Requirement: BIT[3] of this register must be set if need to select i2s_bclk as SSPA parent clock, to solve this, introduces a new SSPAx_I2S_BCLK clock as the virtual gate clock. Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Suggested-by: Yao Zi Reviewed-by: Haylen Chu Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20250811-k1-clk-i2s-v5-2-ebadd06e1e91@linux.spacemit.com Signed-off-by: Yixun Lan commit 7d50d9bf1cd00d6bab0abf3b01d5d261aa6a2b04 Author: Troy Mitchell Date: Mon Aug 11 21:40:33 2025 +0800 dt-bindings: clock: spacemit: CLK_SSPA_I2S_BCLK for SSPA In order to use the virtual clock SSPAx_I2S_BCLK in the device tree and register it in the driver, this patch introduces the macro definition. Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Acked-by: Rob Herring (Arm) Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20250811-k1-clk-i2s-v5-1-ebadd06e1e91@linux.spacemit.com Signed-off-by: Yixun Lan commit eba84c94f9597a82f143997bfacc75e5b27a37de Author: Hendrik Hamerlinck Date: Thu Aug 21 17:26:19 2025 +0200 riscv: dts: spacemit: add UART resets for Soc K1 The UARTs in the SpacemiT K1 device tree are probed by the 8250_of driver, but without reset lines they remain non-functional. Add reset control entries so that the UARTs can operate when mapped to devices. UART0 is already de-asserted by the bootloader, but include its reset as well to avoid relying on bootloader state. Tested on Orange Pi RV2 and Banana Pi BPI-F3 boards, with UART9 enabled and verified functional. Signed-off-by: Hendrik Hamerlinck Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250821152619.597051-1-hendrik.hamerlinck@hammernet.be Signed-off-by: Yixun Lan commit 67b2c15d8fb3c1447a23358075e4f336d40d9797 Author: Sebastian Reichel Date: Tue Aug 19 16:50:13 2025 +0200 arm64: dts: rockchip: add USB-C support for ROCK 5B/5B+/5T Add hardware description for the USB-C port in the Radxa ROCK 5 Model B family. This describes the OHCI, EHCI and XHCI USB parts. The DisplayPort AltMode is only partially described, as bindings for the necessary DisplayPort controller are still being reviewed. Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250819-rock5bp-for-upstream-v4-1-7a2365ce7176@kernel.org Signed-off-by: Heiko Stuebner commit 5487086c4dad869af0eeca0ee24d1ba5fe382b3c Author: Kyle Petryszak Date: Tue Aug 19 21:30:12 2025 -0500 arm64: dts: rockchip: Add green power LED to rk3588s-rock-5a The Radxa ROCK 5A board includes a green power LED that is defined in the vendor device tree but is missing from the upstream kernel DTS file. This causes the LED to be uncontrollable from the operating system, as no entry is created for it under /sys/class/leds. This patch adds the missing node to the leds block, creating a "green:power" device and allowing the LED to be controlled by the kernel. Signed-off-by: Kyle Petryszak Link: https://lore.kernel.org/r/175565703702.6.15498212790604388615.862782045@projectinitiative.io Signed-off-by: Heiko Stuebner commit 178879625f0f10ff708728087d91a5fe79990ce2 Author: Jonas Karlman Date: Thu Aug 21 21:18:41 2025 +0000 arm64: dts: rockchip: Enable more power domains for RK3528 Describe device power-domains and enable the PD_RKVENC, PD_VO and PD_VPU power-domains on RK3528. The PD_RKVDEC is used by RKVDEC and DDRPHY CRU, and is kept disabled to prevent a full system reset trying to read the rate of the SCMI_CLK_DDR clock. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250821211843.3051349-2-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 3dc7ba3548acbfb657614db4ca70d9878bdfca23 Author: Maud Spierings Date: Sat Aug 23 14:43:52 2025 +0200 arm64: dts: rockchip: Enable the NPU on the orangepi 5 boards Enable the NPU and the PMIC that powers it. Signed-off-by: Maud Spierings Reviewed-by: Ondřej Jirman Link: https://lore.kernel.org/r/20250823-orangepi5-v1-3-ae77dd0e06d7@hotmail.com Signed-off-by: Heiko Stuebner commit ccc7f16ea2e33366f7b7005daad81e316f8cb6e4 Author: Maud Spierings Date: Sat Aug 23 14:43:51 2025 +0200 arm64: dts: rockchip: Enable HDMI receiver on orangepi 5 plus Enable support for the HDMI input port found on the orangepi 5 plus. Signed-off-by: Maud Spierings Reviewed-by: Ondřej Jirman Link: https://lore.kernel.org/r/20250823-orangepi5-v1-2-ae77dd0e06d7@hotmail.com Signed-off-by: Heiko Stuebner commit 2f8c7b179f283876871b9359be3ed947c9c56b56 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:10 2025 +0200 arm64: dts: qcom: Use GIC_SPI for interrupt-map for readability Decoding interrupt-map is tricky, because it consists of five components. Use known GIC_SPI define in final interrupt specifier component makes easier to read. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-10-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 9c18757804e66304ed0287ed874a3575c7cb77e4 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:09 2025 +0200 arm64: dts: qcom: sm8350: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: sm8350.dtsi:1554.4-1557.30: Warning (interrupt_map): /soc@0/pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-9-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 3e17f489e3f46ffe21d3d9d769b75ddf24905707 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:08 2025 +0200 arm64: dts: qcom: sm8250: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: sm8250.dtsi:2166.4-2169.30: Warning (interrupt_map): /soc@0/pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-8-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit d0054c3e5b8f737cda22c4b7625b8979fa3c8310 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:07 2025 +0200 arm64: dts: qcom: sm8150: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: sm8150.dtsi:1869.4-1872.30: Warning (interrupt_map): /soc@0/pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-7-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit b8159aaf5ece22de52276d75b8b7d5ec517fe207 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:06 2025 +0200 arm64: dts: qcom: sm6150: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: sm6150.dtsi:1122.4-1125.30: Warning (interrupt_map): /soc@0/pcie@1c08000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-6-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 6cfdee6dca1e5073b52eda54fceb193a80651576 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:05 2025 +0200 arm64: dts: qcom: sc8180x: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: sc8180x.dtsi:1743.4-1746.30: Warning (interrupt_map): /soc@0/pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-5-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 0325653b1adeb8f47dd46874e4fe8ec894a3bbb0 Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:04 2025 +0200 arm64: dts: qcom: qcs404: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: qcs404.dtsi:1496.4-1499.30: Warning (interrupt_map): /soc@0/pcie@10000000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@b000000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-4-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit d434b7198a115a54c5f28bdffb6b77196c85758c Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:03 2025 +0200 arm64: dts: qcom: msm8996: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: msm8996.dtsi:1931.5-1934.31: Warning (interrupt_map): /soc@0/bus@0/pcie@600000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@9bc0000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-3-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 0eb765666714ea310439107bab3182430cc4d11d Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:02 2025 +0200 arm64: dts: qcom: lemans: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: lemans.dtsi:7623.3-7626.29: Warning (interrupt_map): /pcie@1c00000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@17a00000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-2-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit dc3f005e6b1f5b49ff70b98164badd664978d60e Author: Krzysztof Kozlowski Date: Fri Aug 22 14:04:01 2025 +0200 arm64: dts: qcom: ipq5424: Add default GIC address cells Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: ipq5424.dtsi:961.4-964.30: Warning (interrupt_map): /soc@0/pcie@50000000:interrupt-map: Missing property '#address-cells' in node /soc@0/interrupt-controller@f200000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822-dts-interrupt-address-cells-v1-1-d54d44b74460@linaro.org Signed-off-by: Bjorn Andersson commit 6dcc44fc695b11bf4e654774a7c865abf96a2af3 Author: Stephan Gerhold Date: Tue Aug 19 12:45:23 2025 +0200 arm64: dts: qcom: x1e80100-qcp: Fix swapped USB MP repeaters The &eusb3_repeater belongs to the first port of the USB MP controller and the &eusb6_repeater belongs to the second. This is obvious if one looks at e.g. the CRD or the Dell XPS where only the second port of the USB MP is used: They only have the &eusb6_repeater and already specify it for the &usb_mp_hsphy1. Swap them to set the correct repeater for each of the USB ports. Fixes: 9f53c3611960 ("arm64: dts: qcom: x1e78100-qcp: Enable Type-A USB ports labeled 3 and 4/6") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250819-x1e80100-fix-usb-mp-repeaters-v1-4-0f8c186458d3@linaro.org Signed-off-by: Bjorn Andersson commit d5d72e326762c24f2fbc48e5f223cb674cecad1a Author: Stephan Gerhold Date: Tue Aug 19 12:45:22 2025 +0200 arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix swapped USB MP repeaters The &eusb3_repeater belongs to the first port of the USB MP controller and the &eusb6_repeater belongs to the second. This is obvious if one looks at e.g. the CRD or the Dell XPS where only the second port of the USB MP is used: They only have the &eusb6_repeater and already specify it for the &usb_mp_hsphy1. Swap them to set the correct repeater for each of the USB ports. Fixes: c0c46eea2444 ("arm64: dts: qcom: x1e80100-vivobook-s15: Enable USB-A ports") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250819-x1e80100-fix-usb-mp-repeaters-v1-3-0f8c186458d3@linaro.org Signed-off-by: Bjorn Andersson commit c3994b495111bd0ae663c63fc96a869678d03e6c Author: Stephan Gerhold Date: Tue Aug 19 12:45:21 2025 +0200 arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix swapped USB MP repeaters The &eusb3_repeater belongs to the first port of the USB MP controller and the &eusb6_repeater belongs to the second. This is obvious if one looks at e.g. the CRD or the Dell XPS where only the second port of the USB MP is used: They only have the &eusb6_repeater and already specify it for the &usb_mp_hsphy1. Swap them to set the correct repeater for each of the USB ports. Fixes: ffbf3a8be766 ("arm64: dts: qcom: x1e78100-t14s: Enable support for both Type-A USB ports") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250819-x1e80100-fix-usb-mp-repeaters-v1-2-0f8c186458d3@linaro.org Signed-off-by: Bjorn Andersson commit 59a4b94a8c46c71f6c7aac00c21dc781b525fd6d Author: Stephan Gerhold Date: Tue Aug 19 12:45:20 2025 +0200 arm64: dts: qcom: x1e001de-devkit: Fix swapped USB MP repeaters The &eusb3_repeater belongs to the first port of the USB MP controller and the &eusb6_repeater belongs to the second. This is obvious if one looks at e.g. the CRD or the Dell XPS where only the second port of the USB MP is used: They only have the &eusb6_repeater and already specify it for the &usb_mp_hsphy1. Swap them to set the correct repeater for each of the USB ports. Fixes: d12fbd11c5a3 ("arm64: dts: qcom: x1e001de-devkit: Enable support for both Type-A USB ports") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250819-x1e80100-fix-usb-mp-repeaters-v1-1-0f8c186458d3@linaro.org Signed-off-by: Bjorn Andersson commit 41b9f3dae105a3e54c3d94e8c0d67f857109e8fd Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:19 2025 +0200 arm64: dts: qcom: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250819131717.86713-4-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 4f97774ac2ee37d29adfd9732009729e1cbf7bdf Author: Neil Armstrong Date: Wed Aug 20 11:49:23 2025 +0200 arm64: dts: qcom: sm8550: add PPI interrupt partitions for the ARM PMUs The PMUs shares the same per-cpu (PPI) interrupt, so declare the proper interrupt partition maps and use the 4th interrupt cell to pass the partition phandle for each ARM PMU node. Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250820-topic-sm8550-upstream-pmu-ppi-4-cells-v1-2-a8915672e996@linaro.org Signed-off-by: Bjorn Andersson commit 40db99f1b6aaf47064aa3891c92eae01da215d6e Author: Neil Armstrong Date: Wed Aug 20 11:49:22 2025 +0200 arm64: dts: qcom: sm8550: switch to interrupt-cells 4 to add PPI partitions The ARM PMUs shares the same per-cpu (PPI) interrupt, so we need to switch to interrupt-cells = <4> in the GIC node to allow adding an interrupt partition map phandle as the 4th cell value for GIC_PPI interrupts. Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250820-topic-sm8550-upstream-pmu-ppi-4-cells-v1-1-a8915672e996@linaro.org Signed-off-by: Bjorn Andersson commit 013632a410873d2ac538deb981780407917b2200 Author: Krzysztof Kozlowski Date: Wed Aug 20 16:12:34 2025 +0200 arm64: dts: qcom: sm8750-mtp: Add speaker Soundwire port mapping Add appropriate mappings of Soundwire ports of WSA883x speaker to correctly map the Speaker ports to the WSA macro ports. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250820141233.216713-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 316294bb6695a43a9181973ecd4e6fb3e576a9f7 Author: Stephan Gerhold Date: Thu Aug 21 10:15:09 2025 +0200 arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees Reading the hardware registers of the &slimbam on RB3 reveals that the BAM supports only 23 pipes (channels) and supports 4 EEs instead of 2. This hasn't caused problems so far since nothing is using the extra channels, but attempting to use them would lead to crashes. The bam_dma driver might warn in the future if the num-channels in the DT are wrong, so correct the properties in the DT to avoid future regressions. Cc: stable@vger.kernel.org Fixes: 27ca1de07dc3 ("arm64: dts: qcom: sdm845: add slimbus nodes") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250821-sdm845-slimbam-channels-v1-1-498f7d46b9ee@linaro.org Signed-off-by: Bjorn Andersson commit 69f0611c8937e343d4ef9b8349d9dd39aceb1636 Author: Shashank Maurya Date: Thu Aug 21 23:24:28 2025 +0530 arm64: dts: qcom: lemans-evk: Enable Display Port Lemans EVK board has two mini-DP connectors, connected to EDP0 and EDP1 phys. Other EDP phys are available on expansion connectors for the mezzanine boards. Enable EDP0 and EDP1 along with their corresponding PHYs. Signed-off-by: Shashank Maurya Signed-off-by: Prahlad Valluru Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250821-enable-iq9-dp-v3-1-8c3a719e3b9a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e2f4e0f1410d737061523852614ce492a9471265 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:18 2025 +0200 ARM: dts: qcom: apq8064-mako: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250819131717.86713-3-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit bcafdbaff25930db6c8866056e0f4071dc71ca97 Author: Trevor Woerner Date: Tue Aug 19 19:16:30 2025 -0400 ARM: defconfig: cleanup orphaned CONFIGs Drop CONFIG_ARCH_MSM8X60 and CONFIG_ARCH_MSM8960 which were removed in commit 99497df59427 ("ARM: qcom: merge remaining subplatforms into sensible Kconfig entry"). Drop CONFIG_ARCH_MSM8916 and CONFIG_ARCH_MSM8974 which were removed in commit 85148df36835 ("ARM: qcom: drop most of 32-bit ARCH_QCOM subtypes"). Signed-off-by: Trevor Woerner Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250819231652.15938-1-twoerner@gmail.com Signed-off-by: Bjorn Andersson commit 72e9f68bf1a0d55174bba13fba2d8d37fd3355e1 Author: Prasad Kumpatla Date: Thu Aug 21 21:36:18 2025 +0530 soc: qcom: pd-mapper: Add SM8750 compatible Add support for the Qualcomm SM8750 SoC to the protection domain mapper. SM8750 shares the same protection domain configuration as SM8550, so reuse the existing SM8550 domain data. Signed-off-by: Prasad Kumpatla Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250821160618.1037157-2-quic_pkumpatl@quicinc.com Signed-off-by: Bjorn Andersson commit fecc6e0b0260279cd1508903db62f370ef4530d4 Author: Taniya Das Date: Thu Aug 14 14:25:24 2025 +0530 arm64: dts: qcom: qcs615: Add CPU scaling clock node Add cpufreq-hw node to support CPU frequency scaling. Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250814-qcs615-mm-cpu-dt-v6-v6-2-a06f69928ab5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f9c36698db91780eed4ee3a90794bda2a4252166 Author: Taniya Das Date: Thu Aug 14 14:25:23 2025 +0530 arm64: dts: qcom: qcs615: Add clock nodes for multimedia clock Add support for video, camera, display and gpu clock controller nodes for QCS615 platform. Reviewed-by: Konrad Dybcio Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250814-qcs615-mm-cpu-dt-v6-v6-1-a06f69928ab5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit be541b843114d5c92f89b367b51f5dfb76a99124 Author: Dmitry Baryshkov Date: Sat Aug 16 17:00:20 2025 +0300 arm64: dts: qcom: sm6150: move standard clocks to SoC dtsi Follow the example of all other platforms and reference standard clocks (XO, sleep) from the SoC DT even if they are defined in the board DT file. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250816-qcs615-move-clocks-v1-1-bc5665d6e1c3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d7d28bcc2038bd66a4f5912b8e1b162f5ba6faa8 Author: Dmitry Baryshkov Date: Fri Aug 15 18:46:04 2025 +0300 arm64: dts: qcom: use DT label for DSI outputs Instead of keeping a copy of the DT tree going down to the DSI output endpoint use the label to reference it directly, making DTs less error-prone. Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250815-msm-dsi-outs-v2-1-3662704e833f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a300bbd90c3b3c43b1668e1923cd170fc8d5fc89 Author: Gabor Juhos Date: Tue Jul 1 12:10:13 2025 +0200 arm64: dts: qcom: ipq9574-rdp433: remove unused 'sdc-default-state' Since commit 8140d10568a8 ("arm64: dts: qcom: ipq9574: Remove eMMC node"), the 'sdc-default-state' pinctrl state is not used so remove that. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250701-rdp433-remove-sdc-state-v1-1-ca0f156a42d5@gmail.com Signed-off-by: Bjorn Andersson commit 40f7b64fac9d7d37b8db750909321fa2b0b7eda3 Author: Kamal Wadhwa Date: Fri Jun 20 20:59:57 2025 +0530 arm64: dts: qcom: sm8550: Correct the min/max voltages for vreg_l6n_3p3 Voltage regulator 'vreg_l6n_3p3' max-microvolt prop is currently configured at 3304000uV in different sm8550 board files. However this is not a valid voltage value for 'pmic5_pldo502ln' type voltage regulators. Check below the max value(3200mV) in the regulator summary for min/max used as 2800mV/3304mV in DT:- logs: [ 0.294781] vreg_l6n_3p3: Setting 2800000-3304000uV regulator summary: regulator use open bypass opmode voltage current min max --------------------------------------------------------------------- .. vreg_l6n_3p3 0 0 0 normal 2800mV 0mA 2800mV 3200mV .. Correct the min/max value to 3200000uV, as that is the closest valid value to 3.3V and Hardware team has also confirmed that its good to support the consumers(camera sensors) of this regulator. Reviewed-by: Neil Armstrong Signed-off-by: Kamal Wadhwa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250620-sm8550-correct-vreg_l6n_3p3-vol-v2-1-b397f3e91d7b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cb2347ed822f77c6b04011ee3140f7483d206018 Author: Casey Connolly Date: Thu Jun 19 16:55:10 2025 +0200 arm64: dts: qcom: sdm845-oneplus-*: set constant-charge-current-max-microamp Set the maximum constant charge current to use for this battery. While the battery is likely comfortably capable of 4A or so, OnePlus didn't include a secondary charger IC for parallel charging (instead they have their proprietary Dash Charging). It's possible that this value could be safely increased after some testing (and when we have support for modelling the charger as a cooling device properly), but for now this value is acceptable. This is references from qcom,usb-icl-ua property in the downstream vendor devicetree. Signed-off-by: Casey Connolly Link: https://lore.kernel.org/r/20250619-smb2-smb5-support-v1-2-ac5dec51b6e1@linaro.org Signed-off-by: Bjorn Andersson commit c6fa3429cf3ccd806a4059706ebd0f2221b5b965 Author: Gabor Juhos Date: Wed Jun 18 22:14:09 2025 +0200 arm64: dts: qcom: ipq9574: use 'pcie' as node name for 'pcie0' The PCI controller at address 28000000 supports PCIe only, so use 'pcie' as node name for that. This ensures that all PCIe controller instance nodes are using the same name. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250618-ipq9574-pcie0-name-v1-1-f0a8016ea504@gmail.com Signed-off-by: Bjorn Andersson commit 013d01811a1ea4ce0f676e4110f94c80271586b9 Author: Pengyu Luo Date: Thu Jun 12 15:57:24 2025 +0800 arm64: dts: qcom: sc8280xp: Enable GPI DMA Enable GPI DMA for sc8280xp based devices. Signed-off-by: Pengyu Luo Link: https://lore.kernel.org/r/20250612075724.707457-4-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 71b12166a2be511482226b21105f1952cd8b7fa5 Author: Pengyu Luo Date: Thu Jun 12 15:57:23 2025 +0800 arm64: dts: qcom: sc8280xp: Describe GPI DMA controller nodes SPI on SC8280XP requires DMA (GSI) mode to function properly. Without it, SPI controllers fall back to FIFO mode, which causes: [ 0.901296] geni_spi 898000.spi: error -ENODEV: Failed to get tx DMA ch [ 0.901305] geni_spi 898000.spi: FIFO mode disabled, but couldn't get DMA, fall back to FIFO mode ... [ 45.605974] goodix-spi-hid spi0.0: SPI transfer timed out [ 45.605988] geni_spi 898000.spi: Can't set CS when prev xfer running [ 46.621555] spi_master spi0: failed to transfer one message from queue [ 46.621568] spi_master spi0: noqueue transfer failed [ 46.621577] goodix-spi-hid spi0.0: spi transfer error: -110 [ 46.621585] goodix-spi-hid spi0.0: probe with driver goodix-spi-hid failed with error -110 Therefore, describe GPI DMA controller nodes for qup{0,1,2}, and describe DMA channels for SPI and I2C, UART is excluded for now, as it does not yet support this mode. Note that, since there is no public schematic, this is derived from Windows drivers. The drivers do not expose any DMA channel mask information, so all available channels are enabled. Signed-off-by: Pengyu Luo Link: https://lore.kernel.org/r/20250612075724.707457-3-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit b9a185198f96259311543b30d884d8c01da913f7 Author: Aleksandrs Vinarskis Date: Tue Jul 1 20:35:53 2025 +0200 arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default pm8010 is a camera specific PMIC, and may not be present on some devices. These may instead use a dedicated vreg for this purpose (Dell XPS 9345, Dell Inspiron..) or use USB webcam instead of a MIPI one alltogether (Lenovo Thinbook 16, Lenovo Yoga..). Disable pm8010 by default, let platforms that actually have one onboard enable it instead. Cc: stable@vger.kernel.org Fixes: 2559e61e7ef4 ("arm64: dts: qcom: x1e80100-pmics: Add the missing PMICs") Reviewed-by: Bryan O'Donoghue Reviewed-by: Johan Hovold Reviewed-by: Konrad Dybcio Signed-off-by: Aleksandrs Vinarskis Link: https://lore.kernel.org/r/20250701183625.1968246-2-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 340e57306a4aeaaa64f294553caa25453cc4c48d Author: Dmitry Baryshkov Date: Fri Jul 4 19:31:56 2025 +0300 arm64: dts: qcom: sc8180x: modernize MDSS device definition Follow the lead of other platforms and update DT description of the MDSS device: - Use generic node names (dislpay-subsystem, display-controller, phy) instead of the platform-specific ones (mdss, mdp, dsi-phy) - Add platform-specific compatible string to DSI controllers. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250704-mdss-schema-v1-4-e978e4e73e14@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e0d48bea315a4beef9e76c8d6ba7bc95948582cc Author: Raymond Hackley Date: Tue Jul 8 12:21:42 2025 +0000 ARM: dts: qcom: msm8226-samsung-ms013g: Add touch keys Touch keys feature on Galaxy Grand 2 is provided by Zinitix touchscreen. Add property linux,keycodes to enable touch keys. Signed-off-by: Raymond Hackley Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250708122118.157791-1-raymondhackley@protonmail.com Signed-off-by: Bjorn Andersson commit d9f1c08cf2648184c58eb57159232b5f0b818bbf Author: Nickolay Goppen Date: Fri Aug 15 19:56:52 2025 +0300 clk: qcom: gcc-sdm660: Add missing LPASS/CDSP vote clocks For the proper functioning of SMMUs related to the audio/compute DSPs, it makes sense that the clocks and power domains they rely on for communication should be online. Add the vote clocks & GDSCs that, when enabled, ensure all such requirements are met, through various internal mechanisms. Co-developed-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Signed-off-by: Nickolay Goppen Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250815-gcc-sdm660-vote-clocks-and-gdscs-v1-2-c5a8af040093@yandex.ru Signed-off-by: Bjorn Andersson commit 9a834bfe4b976babbfe39c08230cf6413a52d506 Merge: 5a5f478ed7c739 ab6d91d141a801 Author: Bjorn Andersson Date: Sat Aug 23 20:39:28 2025 -0500 Merge branch '20250815-gcc-sdm660-vote-clocks-and-gdscs-v1-1-c5a8af040093@yandex.ru' into clk-for-6.18 Merge the addition of a few missing clock defines for the SDM660 global clock controller, in order to allow them to be used in the DeviceTree branch as well. commit ab6d91d141a801dadf9eed7860b2ea09c9268149 Author: Nickolay Goppen Date: Fri Aug 15 19:56:51 2025 +0300 dt-bindings: clock: gcc-sdm660: Add LPASS/CDSP vote clocks/GDSCs Add defines for the missing clocks, which are required to power up the related remote processors. Co-developed-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Signed-off-by: Nickolay Goppen Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250815-gcc-sdm660-vote-clocks-and-gdscs-v1-1-c5a8af040093@yandex.ru Signed-off-by: Bjorn Andersson commit 7ee4a5a2ec3748facfb4ca96e4cce6cabbdecab2 Author: Inochi Amaoto Date: Thu Aug 14 07:28:34 2025 +0800 irqchip/sg2042-msi: Set MSI_FLAG_MULTI_PCI_MSI flags for SG2044 The MSI controller on SG2044 has the ability to allocate multiple PCI MSI interrupts. So the PCIe controller driver can use this feature if the hardware supports multiple PCI MSI interrupts. Add the MSI_FLAG_MULTI_PCI_MSI flag to the supported_flags of SG2044 msi_parent_ops to enable this functionality. Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Link: https://lore.kernel.org/all/20250813232835.43458-5-inochiama@gmail.com commit 9d8c41816bac518b4824f83b346ae30a1be83f68 Author: Inochi Amaoto Date: Thu Aug 14 07:28:33 2025 +0800 irqchip/sg2042-msi: Fix broken affinity setting When using NVME on SG2044, the NVME drvier always complains about "I/O tag XXX (XXX) QID XX timeout, completion polled", which is caused by the broken affinity setting mechanism of the sg2042-msi driver. The PLIC driver can only the set the affinity when enabled, but the sg2042-msi driver invokes the affinity setter in disabled state, which causes the change to be lost. Cure this by implementing the irq_startup()/shutdown() callbacks, which allow to startup (enabled) the underlying PLIC first. Fixes: e96b93a97c90 ("irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller") Reported-by: Han Gao Suggested-by: Thomas Gleixner Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Link: https://lore.kernel.org/all/20250813232835.43458-4-inochiama@gmail.com commit 54f45a30c0d0153d2be091ba2d683ab6db6d1d5b Author: Inochi Amaoto Date: Thu Aug 14 07:28:32 2025 +0800 PCI/MSI: Add startup/shutdown for per device domains As the RISC-V PLIC cannot apply affinity settings without invoking irq_enable(), it will make the interrupt unavailble when used as an underlying interrupt chip for the MSI controller. Implement the irq_startup() and irq_shutdown() callbacks for the PCI MSI and MSI-X templates. For chips that specify MSI_FLAG_PCI_MSI_STARTUP_PARENT, the parent startup and shutdown functions are invoked. That allows the interrupt on the parent chip to be enabled if the interrupt has not been enabled during allocation. This is necessary for MSI controllers which use PLIC as underlying parent interrupt chip. Suggested-by: Thomas Gleixner Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/all/20250813232835.43458-3-inochiama@gmail.com commit 7a721a2fee2bce01af26699a87739db8ca8ea3c8 Author: Inochi Amaoto Date: Thu Aug 14 07:28:31 2025 +0800 genirq: Add irq_chip_(startup/shutdown)_parent() As the MSI controller on SG2044 uses PLIC as the underlying interrupt controller, it needs to call irq_enable() and irq_disable() to startup/shutdown interrupts. Otherwise, the MSI interrupt can not be startup correctly and will not respond any incoming interrupt. Introduce irq_chip_startup_parent() and irq_chip_shutdown_parent() to allow the interrupt controller to call the irq_startup()/irq_shutdown() callbacks of the parent interrupt chip. In case the irq_startup()/irq_shutdown() callbacks are not implemented for the parent interrupt chip, this will fallback to irq_chip_enable_parent() or irq_chip_disable_parent(). Suggested-by: Thomas Gleixner Signed-off-by: Inochi Amaoto Signed-off-by: Thomas Gleixner Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Link: https://lore.kernel.org/all/20250813232835.43458-2-inochiama@gmail.com Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/ commit 3c716487936aa54083c130d46ad5747769695e09 Author: Sebastian Andrzej Siewior Date: Thu Aug 14 18:59:49 2025 +0200 genirq: Remove GENERIC_IRQ_LEGACY IA64 is gone and with it the last GENERIC_IRQ_LEGACY user. Remove GENERIC_IRQ_LEGACY. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250814165949.hvtP03r4@linutronix.de commit e278e39b014d789fb670695d422ff33c3ef56040 Author: Brian Masney Date: Mon Aug 11 11:19:31 2025 -0400 clk: samsung: pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250811-clk-for-stephen-round-rate-v1-99-b3bf97b038dc@redhat.com Signed-off-by: Krzysztof Kozlowski commit 05c58c9415d1369387aedd28518fd0fdaeabd178 Author: Brian Masney Date: Mon Aug 11 11:19:30 2025 -0400 clk: samsung: cpu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250811-clk-for-stephen-round-rate-v1-98-b3bf97b038dc@redhat.com Signed-off-by: Krzysztof Kozlowski commit efe927b9702643a1d80472664c2642f0304cb608 Author: Dmitry Baryshkov Date: Sat Aug 23 03:12:00 2025 +0300 drm/msm: fix msm_gem_vma_new() allocations for managed GPUVMs Since commit 3309323241fb ("drm/gpuvm: Kill drm_gpuva_init()") MSM driver fails to init, failing with "[drm:msm_gpu_init] *ERROR* could not allocate memptrs: -22" errors. The mentioned commit reworked the function, but didn't take into account that op_map is initialized at the top of the function, while ranges might change if GPUVM is managed by the kernel. Move op_mode initialization after finalizing all addresses and right before the drm_gpuva_init_from_op() call. Reported-by: Danct12 Fixes: 3309323241fb ("drm/gpuvm: Kill drm_gpuva_init()") Suggested-by: Rob Clark Reviewed-by: Rob Clark Acked-by: Rob Clark Link: https://lore.kernel.org/r/20250823-msm-fix-gpuvm-init-v1-1-e199cd5b1983@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit a901f493d06631091bf1f644fdbb5cb4f566645d Author: Takashi Sakamoto Date: Sat Aug 23 12:09:54 2025 +0900 firewire: ohci: remove module-local workqueue Now module-local workqueue has been replaced by a threaded IRQ handler. This commit removes the workqueue and the associated work item accordingly. Link: https://lore.kernel.org/r/20250823030954.268412-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 61efd0e1afb24f8a71cff80f7600ff7556378c53 Author: Takashi Sakamoto Date: Sat Aug 23 12:09:53 2025 +0900 firewire: ohci: use threaded IRQ handler to handle SelfIDComplete event The first step maintaining the bus topology is to handle SelfIDComplete event. This event occurs after initiating bus reset when 1394 OHCI link layer is enabled, or when the bus topology changes (e.g. when a device is added). Because enumeration of the selfID sequence can take some time, it should be processed in a bottom half. Currently, this is done in a module-local workqueue with the WQ_MEM_RECLAIM flag, to allow invocation during memory reclaim paths. A threaded IRQ handler is a preferable alternative, as it eliminates the need to manage workqueue attributes manually. Although SelfIDComplete events are not so frequent in normal usage, handling them correctly is critical for proper bus topology management. This commit switches SelfIDComplete handling to a threaded IRQ handler. Link: https://lore.kernel.org/r/20250823030954.268412-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 696968262aeee51e1c0529c3c060ddd180702e02 Author: Takashi Sakamoto Date: Sat Aug 23 12:09:52 2025 +0900 firewire: ohci: move self_id_complete tracepoint after validating register The value of OHCI1394_SelfIDCount register includes an error-indicating bit. It is safer to place the tracepoint probe after validating the register value. Link: https://lore.kernel.org/r/20250823030954.268412-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit fee2e558b4884df08fad8dd0e5e12466dce89996 Author: Nick Chan Date: Thu Aug 21 23:56:39 2025 +0800 soc: apple: mailbox: Add Apple A11 and T2 mailbox support Add ASC mailbox support for Apple A11 and T2 SoCs, which is used for coprocessors in the system. Reviewed-by: Sven Peter Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250821-t8015-nvme-v3-2-14a4178adf68@gmail.com Signed-off-by: Sven Peter commit 32299eb03414cbb475ce3068b64db6d306df5b88 Author: Nick Chan Date: Thu Aug 21 23:56:38 2025 +0800 dt-bindings: mailbox: apple,mailbox: Add ASC mailboxes on Apple A11 and T2 Add bindings for ASC mailboxes as found on Apple A11 and T2 SoCs. These mailboxes are used for coprocessors including Secure Enclave Processor (SEP), the NVMe coprocessor and the system management controller. Acked-by: Rob Herring (Arm) Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250821-t8015-nvme-v3-1-14a4178adf68@gmail.com Signed-off-by: Sven Peter commit 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 Author: Nalivayko Sergey Date: Tue Jul 15 18:48:15 2025 +0300 net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734 Call Trace: p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 This happens because of a race condition between: - The 9p client sending an invalid flush request and later cleaning it up; - The 9p client in p9_read_work() canceled all pending requests. Thread 1 Thread 2 ... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ... spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ... Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD. Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: afd8d6541155 ("9P: Add cancelled() to the transport functions.") Cc: stable@vger.kernel.org Signed-off-by: Nalivayko Sergey Message-ID: <20250715154815.3501030-1-Sergey.Nalivayko@kaspersky.com> [updated the check from status == RECV || status == ERROR to status != SENT] Signed-off-by: Dominique Martinet commit c04db81cd0288dfc68b7a0f7d09bd49b40bba451 Author: Dominique Martinet Date: Sun Jun 22 22:39:56 2025 +0900 net/9p: Fix buffer overflow in USB transport layer A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers. The issue occurs because: - usb9pfs_rx_header() validates only the declared size in packet header - usb9pfs_rx_complete() uses req->actual (actual received bytes) for memcpy This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy). Add validation in usb9pfs_rx_complete() to ensure req->actual does not exceed the buffer capacity before copying data. Reported-by: Yuhao Jiang Closes: https://lkml.kernel.org/r/20250616132539.63434-1-danisjiang@gmail.com Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Cc: stable@vger.kernel.org Message-ID: <20250622-9p-usb_overflow-v3-1-ab172691b946@codewreck.org> Signed-off-by: Dominique Martinet commit c667c54c5875bf57641cd3bedc2cae66f2f08854 Author: Tingmao Wang Date: Sun Apr 6 17:18:44 2025 +0100 fs/9p: Add p9_debug(VFS) in d_revalidate This was a useful debugging / validation aid, and can explain why a GETATTR request is made. Signed-off-by: Tingmao Wang Message-ID: <00829a99549e33d26139fa4d756c466629f13e00.1743956147.git.m@maowtm.org> Signed-off-by: Dominique Martinet commit 0172a934747f21d2fca4870ec84518c97f5178fc Author: Tingmao Wang Date: Sun Apr 6 17:18:43 2025 +0100 fs/9p: Invalidate dentry if inode type change detected in cached mode This is an extension of the last commit to cached mode as well. While server-side changes when using cached mode is not expected, when it does happen we can get things like -EOPNOTSUPP. With this change at least when we realize the inode has updated (for example after a `touch` on the client), we can get a new one. Signed-off-by: Tingmao Wang Message-ID: <01afd3c77d5cda181780dc931baa8f3fc54562c8.1743956147.git.m@maowtm.org> Signed-off-by: Dominique Martinet commit 290434474c332a2ba9c8499fe699c7f2e1153280 Author: Tingmao Wang Date: Sun Apr 6 17:18:42 2025 +0100 fs/9p: Refresh metadata in d_revalidate for uncached mode too Currently if another process keeps a file open, due to existing dentry in the dcache, other processes will not see updated metadata of that file if it is changed on the server, even in uncached mode. This can also manifest as -ENODATA when reading a file that has shrunk on the server (even if it's re-opened in another process), or -ENOTSUPP if the file has changed type (e.g. regular file to directory) on the server. We can end up in a situation where both `readdir` or `read` fails until the file is closed by all processes using it. This commit fixes that, and invalidates the dentry altogether if the inode type is changed (for uncached mode). Signed-off-by: Tingmao Wang Message-ID: Signed-off-by: Dominique Martinet commit b1c92cdf5af3198e8fbc1345a80e2a1dff386c02 Merge: 2fa1369db3efa9 40477b8bb04876 Author: Jakub Kicinski Date: Fri Aug 22 17:07:52 2025 -0700 Merge branch 'net-wangxun-complete-ethtool-coalesce-options' Jiawen Wu says: ==================== net: wangxun: complete ethtool coalesce options Support to use adaptive RX coalescing. Change the default RX coalesce usecs and limit the range of parameters for various types of devices, according to their hardware design. ==================== Link: https://patch.msgid.link/20250821023408.53472-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 40477b8bb04876940b2045a47a48b31e8c69c553 Author: Jiawen Wu Date: Thu Aug 21 10:34:08 2025 +0800 net: wangxun: support to use adaptive RX/TX coalescing Support to turn on/off adaptive RX/TX coalesce. When adaptive coalesce is on, use DIM algorithm for a dynamic interrupt moderation. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250821023408.53472-5-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 5f43f2171abb4ad326f861ea3f00b7d0afbf6675 Author: Jiawen Wu Date: Thu Aug 21 10:34:07 2025 +0800 net: wangxun: cleanup the code in wx_set_coalesce() Cleanup the code for the next patch to add adaptive RX coalesce. Signed-off-by: Jiawen Wu Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250821023408.53472-4-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit fd4aa243f154a80bbeb3dd311d2114eeb538f479 Author: Jiawen Wu Date: Thu Aug 21 10:34:06 2025 +0800 net: wangxun: limit tx_max_coalesced_frames_irq Add limitation on tx_max_coalesced_frames_irq as 0 ~ 65535, because 'wx->tx_work_limit' is declared as a member of type u16. Signed-off-by: Jiawen Wu Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250821023408.53472-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 6d3f753c9ce164d88675fef57d0dab9cff4ec86c Author: Jiawen Wu Date: Thu Aug 21 10:34:05 2025 +0800 net: ngbe: change the default ITR setting Change the default RX/TX ITR for wx_mac_em devices from 20K to 7K, which is an experience value from out-of-tree ngbe driver, to get higher performance on some platforms with weak single-core performance. TCP_SRTEAM test on Phytium 2000+ shows that the throughput of 64-Byte packets is increased from 350.53Mbits/s to 395.92Mbits/s. Signed-off-by: Jiawen Wu Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250821023408.53472-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 2fa1369db3efa946c0bf05b62779f3a709fd696c Merge: 5c829c3b0df02e a5a90346bb126c Author: Jakub Kicinski Date: Fri Aug 22 17:05:09 2025 -0700 Merge branch 'net-hinic3-add-a-driver-for-huawei-3rd-gen-nic-management-interfaces' Fan Gong says: ==================== net: hinic3: Add a driver for Huawei 3rd gen NIC - management interfaces This is the 2/3 patch of the patch-set described below. The patch-set contains driver for Huawei's 3rd generation HiNIC Ethernet device that will be available in the future. This is an SRIOV device, designed for data centers. Initially, the driver only supports VFs. Following the discussion over RFC01, the code will be submitted in separate smaller patches where until the last patch the driver is non-functional. The RFC02 submission contains overall view of the entire driver but every patch will be posted as a standalone submission. ==================== Link: https://patch.msgid.link/cover.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit a5a90346bb126c4e7ef90eaee1389794479d0592 Author: Fan Gong Date: Wed Aug 20 17:31:25 2025 +0800 hinic3: Interrupt request configuration Configure interrupt request initialization. It allows driver to receive packets and management information from HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/37615d5d87ced741e522cd966948d11ec87e4ad6.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit a8255ea56aee994cd21d9f73f140126a31f9b388 Author: Fan Gong Date: Wed Aug 20 17:31:24 2025 +0800 hinic3: Mailbox management interfaces Add mailbox management interfaces initialization. It enables mailbox to communicate with event queues from HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/3ce856068d23a0bbce74157e16f701c58ebbb1ce.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 2742e06e2d42dec533be2fb8dc54fadb294c70b1 Author: Fan Gong Date: Wed Aug 20 17:31:23 2025 +0800 hinic3: Mailbox framework Add mailbox framework initialization. It allows driver to send commands to HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/084f22f0155aaa713fa583205d540cb2bf3c3c2d.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit bef7c33c67542879fbce27eb2884b5bf2b2520f7 Author: Fan Gong Date: Wed Aug 20 17:31:22 2025 +0800 hinic3: TX & RX Queue coalesce interfaces Add TX RX queue coalesce interfaces initialization. It configures the parameters of tx & tx msix coalesce. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20bdb94d91e5dcbb3257b7486830ea4109922169.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 16a6fce06757f34e00dc1c6d33b29d958525e872 Author: Fan Gong Date: Wed Aug 20 17:31:21 2025 +0800 hinic3: Command Queue interfaces Add Command Queue interfaces initialization. It enables communictaion and operation with HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/6a3ce147e1b4623f84407b9796eade137ddcf9dc.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit db03a1ced61c4b9297996c67cc4b8ade9fdb7cd1 Author: Fan Gong Date: Wed Aug 20 17:31:20 2025 +0800 hinic3: Command Queue framework Add Command Queue framework initialization. It is used to set the related table items of the driver and obtain the HW configuration. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/1aeed56de39078bde8fff4597d7aa22d350058fc.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit c4bbfd9b0d3241ab4a0b6b0095659037ad136d46 Author: Fan Gong Date: Wed Aug 20 17:31:19 2025 +0800 hinic3: Complete Event Queue interfaces Add complete event queue interfaces initialization. It informs that driver should handle the messages from HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/837837f13b96c7155644428a329d5d47b7242153.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit a4511307be8659c482e792feefe671e891cff59d Author: Fan Gong Date: Wed Aug 20 17:31:18 2025 +0800 hinic3: Async Event Queue interfaces Add async event queue interfaces initialization. It allows driver to handle async events reported by HW. Co-developed-by: Xin Guo Signed-off-by: Xin Guo Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/553ebd562b61cd854a2beb25c3d4d98ad3073db0.1755673097.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 5c829c3b0df02e86cc5dc11082201d31bfe552ef Merge: 718d6e8669cb8c bcb28bee987a1e Author: Jakub Kicinski Date: Fri Aug 22 16:44:39 2025 -0700 Merge branch 'rds-fix-semantic-annotations' Ujwal Kundur says: ==================== rds: Fix semantic annotations This patchset addresses all semantic warnings flagged by Sparse for net/rds. v1:https://lore.kernel.org/20250810171155.3263-1-ujwal.kundur@gmail.com ==================== Link: https://patch.msgid.link/20250820175550.498-1-ujwal.kundur@gmail.com Signed-off-by: Jakub Kicinski commit bcb28bee987a1e161eaa5cc4cf2fb0e21306d4a7 Author: Ujwal Kundur Date: Wed Aug 20 23:25:50 2025 +0530 rds: Fix endianness annotations for RDS extension headers Per the RDS 3.1 spec [1], RDS extension headers EXTHDR_NPATHS and EXTHDR_GEN_NUM are be16 and be32 values respectively, exchanged during normal operations over-the-wire (RDS Ping/Pong). This contrasts their declarations as host endian unsigned ints. Fix the annotations across occurrences. Flagged by Sparse. [1] https://oss.oracle.com/projects/rds/dist/documentation/rds-3.1-spec.html Signed-off-by: Ujwal Kundur Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250820175550.498-5-ujwal.kundur@gmail.com Signed-off-by: Jakub Kicinski commit 77907a068717fbefb25faf01fecca553aca6ccaa Author: Ujwal Kundur Date: Wed Aug 20 23:25:49 2025 +0530 rds: Fix endianness annotation for RDS_MPATH_HASH jhash_1word accepts host endian inputs while rs_bound_port is a be16 value (sockaddr_in6.sin6_port). Use ntohs() for consistency. Flagged by Sparse. Signed-off-by: Ujwal Kundur Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com Signed-off-by: Jakub Kicinski commit 92b925297a2f233e0b16694df7b524360b8abb93 Author: Ujwal Kundur Date: Wed Aug 20 23:25:48 2025 +0530 rds: Fix endianness annotation of jhash wrappers __ipv6_addr_jhash (wrapper around jhash2()) and __inet_ehashfn (wrapper around jhash_3words()) work with u32 (host endian) values but accept big endian inputs. Declare the local variables as big endian to avoid unnecessary casts. Flagged by Sparse. Signed-off-by: Ujwal Kundur Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250820175550.498-3-ujwal.kundur@gmail.com Signed-off-by: Jakub Kicinski commit 9308987803bbf289d088d5266c5c3598e3fb3ddf Author: Ujwal Kundur Date: Wed Aug 20 23:25:47 2025 +0530 rds: Replace POLLERR with EPOLLERR Both constants are 1<<3, but EPOLLERR uses the correct annotations. Flagged by Sparse. Signed-off-by: Ujwal Kundur Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250820175550.498-2-ujwal.kundur@gmail.com Signed-off-by: Jakub Kicinski commit 718d6e8669cb8cf4deda8b69950b8f8c62dbbcaa Merge: 02614eee26fbdf 9217146fee4957 Author: Jakub Kicinski Date: Fri Aug 22 15:59:00 2025 -0700 Merge branch 'tcp-user_mss-and-tcp_maxseg-series' Eric Dumazet says: ==================== tcp: user_mss and TCP_MAXSEG series Annotate data-races around tp->rx_opt.user_mss and make TCP_MAXSEG lockless. ==================== Link: https://patch.msgid.link/20250821141901.18839-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9217146fee49575dfe4ac9416587392fc31171f1 Author: Eric Dumazet Date: Thu Aug 21 14:19:01 2025 +0000 tcp: lockless TCP_MAXSEG option setsockopt(TCP_MAXSEG) writes over a field that does not need socket lock protection anymore. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250821141901.18839-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit d5ffba0f254d29a13908d4510762b31d4247a94c Author: Eric Dumazet Date: Thu Aug 21 14:19:00 2025 +0000 tcp: annotate data-races around tp->rx_opt.user_mss This field is already read locklessly for listeners, next patch will make setsockopt(TCP_MAXSEG) lockless. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250821141901.18839-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3d5c0c21d86fed05caeae43549e0c13ddd203c31 Author: Heiko Stuebner Date: Mon Jul 7 18:49:05 2025 +0200 arm64: dts: rockchip: add vcc3v3-lcd-s0 regulator to roc-rk3576-pc This fixed regulator is described by the schematics as being part of the baseboard and its output supply is then routed to the 30pin DSI connector on the board. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-13-heiko@sntech.de commit e51828f80df99a2899e263b750cada6426f14c92 Author: Heiko Stuebner Date: Mon Jul 7 18:49:04 2025 +0200 arm64: dts: rockchip: add the dsi controller to rk3576 The RK3576 comes with one DSI2 controllers based on the same newer Synopsis IP as the ones on the RK3588. Add the necessary node for it. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-12-heiko@sntech.de commit 21bc1a7fcea4635a49f6b2eff3e4c661e80e8f43 Author: Heiko Stuebner Date: Mon Jul 7 18:49:03 2025 +0200 arm64: dts: rockchip: add mipi-dcphy to rk3576 Add the MIPI-DC-phy node to the RK3576, that will be used by the one DSI2 controller and hopefully in some future also for camera input. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-11-heiko@sntech.de commit 0e3f3d7c7ae3dec5ff52325915e3efcbce652a82 Author: Heiko Stuebner Date: Mon Jul 7 18:49:00 2025 +0200 dt-bindings: soc: rockchip: add rk3576 mipi dcphy syscon RK3576 CSI and DSI support requires the GRF for its DC-PHY. The "general register files" provide additional setting-bits outside the regular ip-block reg-space. Acked-by: "Rob Herring (Arm)" Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-8-heiko@sntech.de commit b6f11f114759a088acf44e86b5cd72f24de85d44 Author: Guochun Huang Date: Mon Jul 7 18:49:02 2025 +0200 drm/rockchip: dsi2: add support rk3576 Add the necessary specific bits to support the rk3576-variant of the DW-DSI2 controller. Signed-off-by: Guochun Huang [adapted from the vendor-kernel for mainline] Reviewed-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-10-heiko@sntech.de commit f05530bdaf42aa0e6bb4cde76ba6a081cf473d44 Author: Heiko Stuebner Date: Mon Jul 7 18:49:01 2025 +0200 dt-bindings: display: rockchip: Add rk3576 to RK3588 DW DSI2 controller schema The rk3576 controller is based on the same newer Synopsis IP as the one found in the rk3588. Its external setting bits in the GRF are different though, so it needs its own distinct compatible. Acked-by: "Rob Herring (Arm)" Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-9-heiko@sntech.de commit 38dbbbb41c515d72b0a82fde3cec450d068f5e94 Author: Heiko Stuebner Date: Mon Jul 7 18:48:59 2025 +0200 drm/panel: ilitek-ili9881c: Add Bestar BSD1218-A101KL68 support Add support for the Bestar BSD1218-A101KL68 panel. The init table comes from the Firefly BSP ([1]). [1] https://gitlab.com/firefly-linux/kernel/-/blob/rk3588/firefly/arch/arm64/boot/dts/rockchip/aio-3588l-mipi101-BSD1218-A101KL68.dtsi Reviewed-by: Neil Armstrong Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-7-heiko@sntech.de commit 157ba8c6742931a617a34555c27dd10b36385cf3 Author: Heiko Stuebner Date: Mon Jul 7 18:48:58 2025 +0200 dt-bindings: display: ili9881c: Add Bestar BSD1218-A101KL68 LCD panel Document the compatible value for Bestar BSD1218-A101KL68 LCD panels that are based around the ili9881c controller. Acked-by: "Rob Herring (Arm)" Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-6-heiko@sntech.de commit 8e484ff181b177ea2e86e537fd7a5c8f9d7532ad Author: Heiko Stuebner Date: Mon Jul 7 18:48:57 2025 +0200 dt-bindings: vendor-prefixes: Add prefix for Shenzhen Bestar Electronic Add the prefix for Bestar, named in full both on Panelook.com and their display datasheets as Shenzhen Bestar Electronic Technology Co., Ltd. which produces at least DSI displays and maybe more. Acked-by: "Rob Herring (Arm)" Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-5-heiko@sntech.de commit 9002f55ee4480f23bd2ce91fb5fca536ce31717e Author: Heiko Stuebner Date: Mon Jul 7 18:48:56 2025 +0200 drm/panel: ilitek-ili9881c: convert (un-)prepare to mipi_dsi_multi_context This saves some lines for error handling. For the address mode change, that value is always an u8, so switching to dcs_write_buffer function should be appropriate. Reviewed-by: Neil Armstrong Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-4-heiko@sntech.de commit 5efa82492066fcb32308210fb3f0b752af74334f Author: Heiko Stuebner Date: Mon Jul 7 18:48:55 2025 +0200 drm/panel: ilitek-ili9881c: move display_on/_off dcs calls to (un-)prepare At least for panel-bridges, the atomic_enable call is defined as being called right after the preceding element in the display pipe is enabled. It is also stated that "The bridge can assume that the display pipe (i.e. clocks and timing signals) feeding it is running when this callback is called" This means the DSI controller driving this display would have already switched over to video-mode from command mode and thus dcs functions should not be called anymore at this point. This caused a non-working display for me, when trying to enable the rk3576 dsi controller using a display using this controller. Therefore move the display_on/off calls the more appropriate prepare/unprepare callbacks. Reviewed-by: Neil Armstrong Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-3-heiko@sntech.de commit 6c66eba502709a78281333187c1add7b71f7201f Author: Heiko Stuebner Date: Mon Jul 7 18:48:54 2025 +0200 drm/panel: ilitek-ili9881c: turn off power-supply when init fails The prepare function turns on the power-supply regulator first, when preparing the display. But in an error case, just returns the error code, but does not power off the regulator again, fix that. Reviewed-by: Neil Armstrong Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250707164906.1445288-2-heiko@sntech.de commit 67fe7be7dffd0e27bcba472777d34b59b90f7330 Author: Paul Moore Date: Tue Aug 19 15:52:47 2025 -0400 MAINTAINERS: add the associated Rust helper to the CREDENTIALS section Acked-by: Miguel Ojeda Acked-by: Alice Ryhl Signed-off-by: Paul Moore commit 9c7419568b28855274d6d1dac1684f6627da9547 Author: Paul Moore Date: Thu Aug 14 17:56:07 2025 -0400 MAINTAINERS: add the associated Rust helper to the LSM section Suggested-by: Benno Lossin Signed-off-by: Paul Moore commit 1647830388ffea4d7a39c1a5f7692925e9d8351d Author: Zihuan Zhang Date: Fri Aug 22 15:04:24 2025 +0800 cpufreq: simplify setpolicy/target check in driver verification cpufreq drivers are supposed to use either ->setpolicy() or ->target()/->target_index(). Simplify the existing check by collapsing it into a single boolean expression: (!!driver->setpolicy == (driver->target_index || driver->target)) This is a readability/maintainability cleanup and keeps the semantics unchanged. No functional change intended. Signed-off-by: Zihuan Zhang Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250822070424.166795-3-zhangzihuan@kylinos.cn Signed-off-by: Rafael J. Wysocki commit e9e124501f0d7ea2caea94711efe50fe081a11ea Author: Zihuan Zhang Date: Fri Aug 22 15:04:23 2025 +0800 cpufreq: use strlen() for governor name comparison Most kernel code using strncasecmp()/strncmp() passes strlen("xxx") as the length argument. cpufreq_parse_policy() previously used CPUFREQ_NAME_LEN (16), which is longer than the actual strings ("performance" is 11 chars, "powersave" is 9 chars). This patch switches to strlen() for the comparison, making the matching slightly more permissive (e.g., "powersavexxx" will now also match "powersave"). While this is unlikely to cause functional issues, it aligns cpufreq with common kernel style and makes the behavior more intuitive. Signed-off-by: Zihuan Zhang Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250822070424.166795-2-zhangzihuan@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 Author: Huisong Li Date: Mon Jul 28 15:06:11 2025 +0800 ACPI: processor: idle: Fix memory leak when register cpuidle device failed The cpuidle device's memory is leaked when cpuidle device registration fails in acpi_processor_power_init(). Free it as appropriate. Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com [ rjw: Changed the order of the new statements, added empty line after if () ] [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 13dda74a164b570d93d412e812dc80549506410f Author: Lucas De Marchi Date: Thu Aug 21 09:18:07 2025 -0700 drm/xe/configfs: Dump custom settings when binding Device configuration using configfs could be prepared long time prior the driver load. Currently all the xe configfs entries are for things that are important to have in the log if a non-default value is being used. Add a info-level message about that with the individual entries that are different than the default. Based on previous patch by Michal Wajdeczko. Cc: Michal Wajdeczko Cc: John Harrison Reviewed-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250821-psmi-v5-12-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 66b21c338e6f05a980fae76c221d7aea4f1538c2 Author: Lucas De Marchi Date: Thu Aug 21 09:18:06 2025 -0700 drm/xe/configfs: Minor fixes to documentation Add a few missing punctuation and line breaks and make the syntax for code snippets common to all of them. Reviewed-by: Dnyaneshwar Bhadane Link: https://lore.kernel.org/r/20250821-psmi-v5-11-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit e2b33fce5eb08b37e38188b219a32c105cdc606e Author: Lucas De Marchi Date: Thu Aug 21 09:18:05 2025 -0700 drm/xe/configfs: Improve documentation steps The steps are roughly: 1. Load the module without binding to the device 2. Configure the desired device 3. Bind the device Move the binding part to the "Create devices" since it's not exclusive to the survivability_mode attribute and better document the steps. Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250821-psmi-v5-10-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 3eb2280f6aa424bc99d59ff91ca741d6e240caee Author: Lucas De Marchi Date: Thu Aug 21 09:18:04 2025 -0700 drm/xe/configfs: Use tree-like output in documentation When documenting the directories, use an output similar to the `tree` command and add VFs and missing attributes. Reviewed-by: Dnyaneshwar Bhadane Link: https://lore.kernel.org/r/20250821-psmi-v5-9-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 734197a933cd2fb4adac7213fd1fc4df284cae14 Author: Lucas De Marchi Date: Thu Aug 21 09:18:03 2025 -0700 drm/xe/configfs: Use guard() for dev->lock Instead of the manual lock()/unlock() pattern, use guard() which will make things easier for handling errors or early returns. Reviewed-by: Dnyaneshwar Bhadane Link: https://lore.kernel.org/r/20250821-psmi-v5-8-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit afe902848b417da81f60b3d15cbae40a67286dbf Author: Lucas De Marchi Date: Thu Aug 21 09:18:02 2025 -0700 drm/xe/configfs: Allow to enable PSMI Now that additional WAs are in place and it's possible to allocate buffers through debugfs, add the configfs attribute to turn PSMI on. Cc: Matt Roper Cc: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250821-psmi-v5-7-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 49245b49614870a0a135468be1bd0a6e0006a128 Author: Lucas De Marchi Date: Thu Aug 21 09:18:01 2025 -0700 drm/xe/configfs: Simplify kernel doc From the caller perspective reading the documentation, there's no need to be so specific about everything the function is doing/checking. Just document the functionality a caller cares about. Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250821-psmi-v5-6-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 95b3899b4d25a49abf830ee1bc97940a7c1c7e97 Author: Vinay Belgaumkar Date: Thu Aug 21 09:18:00 2025 -0700 drm/xe/psmi: Add Wa_16023683509 This WA ensures GuC will restore the media MCFG registers at C6 exit. Signed-off-by: Vinay Belgaumkar Reviewed-by: Matt Atwood Link: https://lore.kernel.org/r/20250821-psmi-v5-5-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 29042df3acdc7364af1c251b2a05f7c1c8fe0401 Author: Badal Nilawar Date: Thu Aug 21 09:17:59 2025 -0700 drm/xe/psmi: Add Wa_14020001231 Enable Wa 14020001231 to block psmi interrupts during C6 entry exit flow. It's only enabled if PSMI is enabled in runtime. Signed-off-by: Badal Nilawar Reviewed-by: Matt Atwood Link: https://lore.kernel.org/r/20250821-psmi-v5-4-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit d67b1dfad00d7c28155a434b2a8a0012adc1b458 Author: Lucas De Marchi Date: Thu Aug 21 09:17:58 2025 -0700 drm/xe/rtp: Add match for psmi Add match to be used on WAs for only enabling workarounds if psmi is intended to be used. Reviewed-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250821-psmi-v5-3-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit aaa0c1f50a3d3fc1624360eaeb7fe69af62f7107 Author: Lucas De Marchi Date: Thu Aug 21 09:17:57 2025 -0700 drm/xe/psmi: Add debugfs interface for PSMI Requirement for PSMI capture is to have a physically contiguous buffer. All the needed configuration is done by the userspace tool directly to the GPU via mmio access. This interface only support allocating from VRAM regions. For integrated devices, the PSMI buffer is in SYSTEM memory and should be allocated by userspace using hugetlbfs. Here we add the ability to allocate a region of physically contiguous memory by writing to debugfs file (listed below). For multi-tile devices, the capture tool requires ability to allocate a capture buffer per tile (VRAM region) and so user can specify a region_mask. The tool then can mmap the buffers via direct mmap of the PCIBAR via sysfs. To support the capture tool, 3 new debugfs entries are added: psmi_capture_addr - physical address per VRAM region's capture buffer psmi_capture_region_mask - select which region(s) to allocate a buffer psmi_capture_size - size of current capture buffer Writing psmi_capture_size will allocate new buffer of requested size per region after freeing any current buffers. Cc: Matt Roper Cc: Vinay Belgaumkar Original-author: Brian Welty Reviewed-by: Vinay Belgaumkar # v2 Link: https://lore.kernel.org/r/20250821-psmi-v5-2-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit efeb036ffd2a0d1c1afba3d74bd5965825d1a646 Author: Lucas De Marchi Date: Thu Aug 21 09:17:56 2025 -0700 drm/xe/psmi: Add GuC flag to enable PSMI PSMI allows to capture data from the GPU useful for early validation. From the kernel side there isn't much to be done, just a few things: 1) Toggle the feature support in GuC 2) Enable some additional WAs 3) Allocate buffers Here is the first step, with the next ones to follow. For now everything is disabled through a check in configfs that is currently hardcoded to disabled. Cc: Matt Roper Cc: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250821-psmi-v5-1-34ab7550d3d8@intel.com Signed-off-by: Lucas De Marchi commit 4223bf833c8495e40ae2886acbc0ecbe88fa6306 Author: Tao Chen Date: Tue Aug 19 20:56:38 2025 +0800 bpf: Remove preempt_disable in bpf_try_get_buffers Now BPF program will run with migration disabled, so it is safe to access this_cpu_inc_return(bpf_bprintf_nest_level). Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf") Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250819125638.2544715-1-chen.dylane@linux.dev commit d47cc4dea17391c99b943fa8d70a279e906b2843 Author: Eric Biggers Date: Mon Aug 11 13:16:15 2025 -0700 bpf: Use sha1() instead of sha1_transform() in bpf_prog_calc_tag() Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for bpf_prog_calc_tag() to implement the SHA-1 padding itself. No functional change; the computed tags remain the same. Signed-off-by: Eric Biggers Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250811201615.564461-1-ebiggers@kernel.org commit 76397d42e248335aa41acbf0af6d096220605202 Author: Siddharth Vadapalli Date: Tue Aug 19 16:27:00 2025 +0530 arm64: dts: ti: k3-am69-sk: Switch to PCIe Multilink + USB configuration The SERDES0 instance of SERDES on the AM69 SoC is a Cadence Torrent SERDES and it has 4 lanes which are allocated in the following manner: Lane0 and Lane1 to PCIe1 Lane2 to PCIe3 Lane3 to USB0 Until [0], the Cadence Torrent SERDES driver only supported configuring the SERDES for a PCIe + USB configuration whereby all lanes of the SERDES configured for PCIe will operate at the same speed. As a result, PCIe1 and PCIe3 instances of PCIe will either fall down to a common speed based on the PCIe peers that they are each connected to, or, the PCIe link could fail to be setup. Since [0] enables support for PCIe Multilink + USB configuration, it is now possible for the SERDES lanes allocated to PCIe1 and PCIe3 to link up and operate at different speeds. USB continues to remain functional. Hence, update the 'serdes0' node as well as the 'pcie1_rc' and 'pcie3_rc' nodes to switch to the PCIe Multilink + USB configuration that is now supported by the Cadence Torrent SERDES driver. [0]: commit 351e07e6b2ec ("phy: cadence-torrent: Add PCIe multilink + USB with same SSC register config for 100 MHz refclk") Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250819105717.372893-1-s-vadapalli@ti.com Signed-off-by: Nishanth Menon commit 04f1c432b7ae38415a1cf374f39954d5a612c23a Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:10 2025 +0200 arm64: dts: ti: k3-j721s2: Add default PCI interrupt controller address cells Add missing address-cells 0 to the PCI interrupt node to silence W=1 warning: k3-j721s2-main.dtsi:1431.3-1434.29: Warning (interrupt_map): /bus@100000/pcie@2910000:interrupt-map: Missing property '#address-cells' in node /bus@100000/pcie@2910000/interrupt-controller, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250822133309.312189-2-krzysztof.kozlowski@linaro.org Signed-off-by: Nishanth Menon commit 44189ccdfc2c96af4b06303c265030cda0e0bf51 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:55 2025 +0200 arm64: dts: ti: k3-am6548: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819131651.86569-8-krzysztof.kozlowski@linaro.org Signed-off-by: Nishanth Menon commit 0fdd3240fe5a9bf4785e40506bf86b7e16546b83 Author: Kendall Willis Date: Tue Aug 19 14:54:53 2025 -0500 firmware: ti_sci: Enable abort handling of entry to LPM The PM co-processor (device manager or DM) adds the ability to abort entry to a low power mode by clearing the mode selection in the latest version of its firmware (11.01.09) [1]. Enable the ti_sci driver to support the LPM abort call which clears the low power mode selection of the DM. This fixes an issue where failed system suspend attempts would cause subsequent suspends to fail. After system suspend completes, regardless of if system suspend succeeds or fails, the ->complete() hook in TI SCI will be called. In the ->complete() hook, a message will be sent to the DM to clear the current low power mode selection. Clearing the low power mode selection unconditionally will not cause any error in the DM. [1] https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html Signed-off-by: Kendall Willis Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20250819195453.1094520-1-k-willis@ti.com Signed-off-by: Nishanth Menon commit 73b81fcb12df1051bd169e488245f8bf4c37bc93 Author: Andy Yan Date: Fri Aug 22 14:39:50 2025 +0800 drm/bridge: simple-bridge: Add support for radxa ra620 The RA620 is an active DP to HDMI converter chip, basically no software is involved to drive it. Add it to simple bridge to make it can be find by the drm bridge chain. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822063959.692098-7-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 480a76c64f4f6a7f8d4aa2ac86cd2178687716b9 Author: Andy Yan Date: Fri Aug 22 14:39:49 2025 +0800 dt-bindings: display: simple-bridge: Add ra620 compatible RA620 is a DP to HDMI bridge converter from RADXA, which first found be used on ROCK 5 ITX. This chip can be used without involving software. Signed-off-by: Andy Yan Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822063959.692098-6-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 7b281a4582c4408add22cc99f221886b50dd0548 Author: Tiffany Yang Date: Thu Aug 21 18:37:53 2025 -0700 cgroup: selftests: Add tests for freezer time Test cgroup v2 freezer time stat. Freezer time accounting should be independent of other cgroups in the hierarchy and should increase iff a cgroup is CGRP_FREEZE (regardless of whether it reaches CGRP_FROZEN). Skip these tests on systems without freeze time accounting. Signed-off-by: Tiffany Yang Cc: Michal Koutný Signed-off-by: Tejun Heo commit afa3701c0e45ecb9e4d160048ca4e353c7489948 Author: Tiffany Yang Date: Thu Aug 21 18:37:52 2025 -0700 cgroup: cgroup.stat.local time accounting There isn't yet a clear way to identify a set of "lost" time that everyone (or at least a wider group of users) cares about. However, users can perform some delay accounting by iterating over components of interest. This patch allows cgroup v2 freezing time to be one of those components. Track the cumulative time that each v2 cgroup spends freezing and expose it to userland via a new local stat file in cgroupfs. Thank you to Michal, who provided the ASCII art in the updated documentation. To access this value: $ mkdir /sys/fs/cgroup/test $ cat /sys/fs/cgroup/test/cgroup.stat.local freeze_time_total 0 Ensure consistent freeze time reads with freeze_seq, a per-cgroup sequence counter. Writes are serialized using the css_set_lock. Signed-off-by: Tiffany Yang Cc: Tejun Heo Cc: Michal Koutný Signed-off-by: Tejun Heo commit 02614eee26fbdfd73b944769001cefeff6ed008c Author: Eric Dumazet Date: Mon Aug 18 19:59:34 2025 +0000 idpf: do not linearize big TSO packets idpf has a limit on number of scatter-gather frags that can be used per segment. Currently, idpf_tx_start() checks if the limit is hit and forces a linearization of the whole packet. This requires high order allocations that can fail under memory pressure. A full size BIG-TCP packet would require order-7 alocation on x86_64 :/ We can move the check earlier from idpf_features_check() for TSO packets, to force GSO in this case, removing the cost of a big copy. This means that a linearization will eventually happen with sizes smaller than one MSS. __idpf_chk_linearize() is renamed to idpf_chk_tso_segment() and moved to idpf_lib.c Signed-off-by: Eric Dumazet Cc: Przemek Kitszel Cc: Jacob Keller Cc: Madhu Chittim Cc: Pavan Kumar Linga Cc: Willem de Bruijn Cc: Andrew Lunn Reviewed-by: Joshua Hay Tested-by: Brian Vazquez Acked-by: Tony Nguyen Link: https://patch.msgid.link/20250818195934.757936-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 045f6a6e4dbaa0ecdee43bc2362676ff62ba5456 Author: Thomas Huth Date: Fri Aug 1 10:45:31 2025 +0200 x86/mtrr: Remove license boilerplate text with bad FSF address The Free Software Foundation does not reside in "675 Mass Ave, Cambridge" anymore, so no need to mention that address in the source code here. But instead of updating the address to their current location, just drop the license boilerplate text and use a proper SPDX license identifier instead. The text talks about the "GNU *Library* General Public License" and "any later version", so LGPL-2.0+ is the right choice here. [ bp: Massage commit message. ] Signed-off-by: Thomas Huth Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250801084531.34089-1-thuth@redhat.com commit b065bd213caf6d35b57c5089d6507d7e8598a586 Author: Xaver Hugl Date: Fri Aug 22 17:28:49 2025 +0200 drm: re-allow no-op changes on non-primary planes in async flips Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip") unintentionally disallowed no-op changes on non-primary planes that the driver doesn't allow async flips on. This broke async flips for compositors that disable the cursor plane in every async atomic commit. To fix that, change drm_atomic_set_property to again only run atomic_async_check if the plane would actually be changed by the atomic commit. Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263 Signed-off-by: Xaver Hugl Reviewed-by: André Almeida Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org [andrealmeid: fix checkpatch warning] Signed-off-by: André Almeida commit 966f504977e3a04fcadbaf199e3302e95e8958b7 Author: Uros Bizjak Date: Mon Jun 16 10:35:57 2025 +0200 x86/asm: Use RDPKRU and WRPKRU mnemonics in Current minimum required version of binutils is 2.30, which supports RDPKRU and WRPKRU instruction mnemonics. Replace the byte-wise specification of RDPKRU and WRPKRU with these proper mnemonics. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/20250616083611.157740-1-ubizjak@gmail.com commit 2515d2b9ab4108c11a0b23935e68de27abb8b2a7 Author: Stuart Summers Date: Tue Aug 19 20:10:54 2025 +0000 drm/xe/pcode: Initialize data0 for pcode read routine There are two registers filled in when reading data from pcode besides the mailbox itself. Currently, we allow a NULL value for the second of these two (data1) and assume the first is defined. However, many of the routines that are calling this function assume that pcode will ignore the value being passed in and so leave that first value (data0) defined but uninitialized. To be safe, make sure this value is always initialized to something (0 generally) in the event pcode behavior changes and starts using this value. v2: Fix sob/author Signed-off-by: Stuart Summers Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250819201054.393220-1-stuart.summers@intel.com Signed-off-by: Rodrigo Vivi commit 0780f54ab129b28e2b29689c95ad579a9db04fab Author: Paul Chaignon Date: Wed Aug 20 15:19:13 2025 +0200 selftests/bpf: Tests for is_scalar_branch_taken tnum logic This patch adds tests for the new jeq and jne logic in is_scalar_branch_taken. The following shows the first test failing before the previous patch is applied. Once the previous patch is applied, the verifier can use the tnum values to deduce that instruction 7 is dead code. 0: call bpf_get_prandom_u32#7 ; R0_w=scalar() 1: w0 = w0 ; R0_w=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff)) 2: r0 >>= 30 ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=3,var_off=(0x0; 0x3)) 3: r0 <<= 30 ; R0_w=scalar(smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000)) 4: r1 = r0 ; R0_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000)) R1_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000)) 5: r1 += 1024 ; R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000400,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000)) 6: if r1 != r0 goto pc+1 ; R0_w=scalar(id=1,smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000000,var_off=(0x400; 0xc0000000)) R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000)) 7: r10 = 0 frame pointer is read only Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/550004f935e2553bdb2fb1f09cbde7d0452112d0.1755694148.git.paul.chaignon@gmail.com commit f41345f47fb267a9c95ca710c33448f8d0d81d83 Author: Paul Chaignon Date: Wed Aug 20 15:18:06 2025 +0200 bpf: Use tnums for JEQ/JNE is_branch_taken logic In the following toy program (reg states minimized for readability), R0 and R1 always have different values at instruction 6. This is obvious when reading the program but cannot be guessed from ranges alone as they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]). 0: call bpf_get_prandom_u32#7 ; R0_w=scalar() 1: w0 = w0 ; R0_w=scalar(var_off=(0x0; 0xffffffff)) 2: r0 >>= 30 ; R0_w=scalar(var_off=(0x0; 0x3)) 3: r0 <<= 30 ; R0_w=scalar(var_off=(0x0; 0xc0000000)) 4: r1 = r0 ; R1_w=scalar(var_off=(0x0; 0xc0000000)) 5: r1 += 1024 ; R1_w=scalar(var_off=(0x400; 0xc0000000)) 6: if r1 != r0 goto pc+1 Looking at tnums however, we can deduce that R1 is always different from R0 because their tnums don't agree on known bits. This patch uses this logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE. This change has a tiny impact on complexity, which was measured with the Cilium complexity CI test. That test covers 72 programs with various build and load time configurations for a total of 970 test cases. For 80% of test cases, the patch has no impact. On the other test cases, the patch decreases complexity by only 0.08% on average. In the best case, the verifier needs to walk 3% less instructions and, in the worst case, 1.5% more. Overall, the patch has a small positive impact, especially for our largest programs. Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Acked-by: Shung-Hsi Yu Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com commit d0fd848949eece04a3b935f5a80566fb013428c3 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:37 2025 +0200 ARM: dts: microchip: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20250819131736.86862-2-krzysztof.kozlowski@linaro.org Signed-off-by: Claudiu Beznea commit 70bb21cbc8c704c664b5d3ea417f3e35376fc229 Author: Yao Zi Date: Mon Jul 28 10:29:48 2025 +0000 arm64: dts: rockchip: Add naneng-combphy for RK3528 Rockchip RK3528 ships a naneng-combphy that is shared by PCIe and USB 3.0 controllers. Describe it and the pipe-phy grf which it depends on. Signed-off-by: Yao Zi Link: https://lore.kernel.org/r/20250728102947.38984-8-ziyao@disroot.org Signed-off-by: Heiko Stuebner commit 86e6815b316ec0ea8c4bb3c16a033219a52b6060 Author: Yu-cheng Yu Date: Fri Jun 6 13:10:35 2025 -0400 x86/mm: Change cpa_flush() to call flush_kernel_range() directly The function cpa_flush() calls __flush_tlb_one_kernel() and flush_tlb_all(). Replacing that with a call to flush_tlb_kernel_range() allows cpa_flush() to make use of INVLPGB or RAR without any additional changes. Initialize invlpgb_count_max to 1, since flush_tlb_kernel_range() can now be called before invlpgb_count_max has been initialized to the value read from CPUID. [riel: remove now unused __cpa_flush_tlb] Signed-off-by: Yu-cheng Yu Signed-off-by: Rik van Riel Signed-off-by: Dave Hansen Acked-by: Dave Hansen Link: https://lore.kernel.org/all/20250606171112.4013261-4-riel%40surriel.com commit cd31182c80e8ec02dacd1d56b91c31e5c7d2c580 Merge: a7bd7215806374 bbd885b193cc8a Author: Jakub Kicinski Date: Fri Aug 22 07:46:31 2025 -0700 Merge branch 'selftests-test-xdp_tx-for-single-buffer' Dimitri Daskalakis says: ==================== selftests: Test XDP_TX for single-buffer Ensure single buffer XDP functions correctly by covering the following cases: 1) Zero size payload 2) Full MTU 3) Single buffer packets through a multi-buffer XDP program These changes were tested with netdevsim and fbnic. # ./ksft-net-drv/drivers/net/xdp.py TAP version 13 1..10 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_sb ok 6 xdp.test_xdp_native_tx_mb # Failed run: pkt_sz 2048, offset 1. Last successful run: pkt_sz 1024, offset 256. Reason: Adjustment failed ok 7 xdp.test_xdp_native_adjst_tail_grow_data ok 8 xdp.test_xdp_native_adjst_tail_shrnk_data # Failed run: pkt_sz 512, offset -256. Last successful run: pkt_sz 512, offset -128. Reason: Adjustment failed ok 9 xdp.test_xdp_native_adjst_head_grow_data # Failed run: pkt_sz (2048) > HDS threshold (1536) and offset 64 > 48 ok 10 xdp.test_xdp_native_adjst_head_shrnk_data # Totals: pass:10 fail:0 xfail:0 xpass:0 skip:0 error:0 ==================== Link: https://patch.msgid.link/20250821014023.1481662-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit bbd885b193cc8a651e18eef74f0e094acbc802b8 Author: Dimitri Daskalakis Date: Wed Aug 20 18:40:23 2025 -0700 selftests: drv-net: xdp: Validate single-buff XDP_TX in multi-buff mode Validate that drivers with multi-buff XDP programs properly reinitialize xdp_buff between packets. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20250821014023.1481662-4-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit d06d70eb6af441c59ec8fc71df0c47427321318b Author: Dimitri Daskalakis Date: Wed Aug 20 18:40:22 2025 -0700 selftests: drv-net: xdp: Add a single-buffer XDP_TX test. Test single-buffer XDP_TX for packets with various payload sizes. Update the socat TX command to generate packets with 0 length payloads. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20250821014023.1481662-3-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 91aacd8ceffe6f07b324c5548c6efd763ae0e278 Author: Dimitri Daskalakis Date: Wed Aug 20 18:40:21 2025 -0700 selftests: drv-net: xdp: Extract common XDP_TX setup/validation. In preparation of single-buffer XDP_TX tests, refactor common test code into the _test_xdp_native_tx method. Add support for multiple payload sizes, and additional validation for RX packet count. Pass the -n flag to echo to avoid adding an extra byte into the TX packet. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20250821014023.1481662-2-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 01fb93a363e0583a3ce48098aca5ab9825a5b790 Author: Adrian Hunter Date: Tue Aug 19 18:58:11 2025 +0300 x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present Avoid clearing reclaimed TDX private pages unless the platform is affected by the X86_BUG_TDX_PW_MCE erratum. This significantly reduces VM shutdown time on unaffected systems. Background KVM currently clears reclaimed TDX private pages using MOVDIR64B, which: - Clears the TD Owner bit (which identifies TDX private memory) and integrity metadata without triggering integrity violations. - Clears poison from cache lines without consuming it, avoiding MCEs on access (refer TDX Module Base spec. 1348549-006US section 6.5. Handling Machine Check Events during Guest TD Operation). The TDX module also uses MOVDIR64B to initialize private pages before use. If cache flushing is needed, it sets TDX_FEATURES.CLFLUSH_BEFORE_ALLOC. However, KVM currently flushes unconditionally, refer commit 94c477a751c7b ("x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages") In contrast, when private pages are reclaimed, the TDX Module handles flushing via the TDH.PHYMEM.CACHE.WB SEAMCALL. Problem Clearing all private pages during VM shutdown is costly. For guests with a large amount of memory it can take minutes. Solution TDX Module Base Architecture spec. documents that private pages reclaimed from a TD should be initialized using MOVDIR64B, in order to avoid integrity violation or TD bit mismatch detection when later being read using a shared HKID, refer April 2025 spec. "Page Initialization" in section "8.6.2. Platforms not Using ACT: Required Cache Flush and Initialization by the Host VMM" That is an overstatement and will be clarified in coming versions of the spec. In fact, as outlined in "Table 16.2: Non-ACT Platforms Checks on Memory" and "Table 16.3: Non-ACT Platforms Checks on Memory Reads in Li Mode" in the same spec, there is no issue accessing such reclaimed pages using a shared key that does not have integrity enabled. Linux always uses KeyID 0 which never has integrity enabled. KeyID 0 is also the TME KeyID which disallows integrity, refer "TME Policy/Encryption Algorithm" bit description in "Intel Architecture Memory Encryption Technologies" spec version 1.6 April 2025. So there is no need to clear pages to avoid integrity violations. There remains a risk of poison consumption. However, in the context of TDX, it is expected that there would be a machine check associated with the original poisoning. On some platforms that results in a panic. However platforms may support "SEAM_NR" Machine Check capability, in which case Linux machine check handler marks the page as poisoned, which prevents it from being allocated anymore, refer commit 7911f145de5fe ("x86/mce: Implement recovery for errors in TDX/SEAM non-root mode") Improvement By skipping the clearing step on unaffected platforms, shutdown time can improve by up to 40%. On platforms with the X86_BUG_TDX_PW_MCE erratum (SPR and EMR), continue clearing because these platforms may trigger poison on partial writes to previously-private pages, even with KeyID 0, refer commit 1e536e1068970 ("x86/cpu: Detect TDX partial write machine check erratum") Signed-off-by: Adrian Hunter Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Acked-by: Kai Huang Acked-by: Vishal Annapurve Link: https://lore.kernel.org/all/20250819155811.136099-4-adrian.hunter%40intel.com commit a27b008a5d7e8c49740dfd4b560cd2d1abe722e4 Author: Adrian Hunter Date: Tue Aug 19 18:58:10 2025 +0300 x86/tdx: Tidy reset_pamt functions tdx_quirk_reset_paddr() was renamed to reflect that, in fact, the clearing is necessary only for hardware with a certain quirk. That is dealt with in a subsequent patch. Rename reset_pamt functions to contain "quirk" to reflect the new functionality, and remove the now misleading comment. Signed-off-by: Adrian Hunter Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Acked-by: Kai Huang Acked-by: Vishal Annapurve Link: https://lore.kernel.org/all/20250819155811.136099-3-adrian.hunter%40intel.com commit 94272b084a745940e076a170d8193ac3427292e6 Author: Adrian Hunter Date: Tue Aug 19 18:58:09 2025 +0300 x86/tdx: Eliminate duplicate code in tdx_clear_page() tdx_clear_page() and reset_tdx_pages() duplicate the TDX page clearing logic. Rename reset_tdx_pages() to tdx_quirk_reset_paddr() and create tdx_quirk_reset_page() to call tdx_quirk_reset_paddr() and be used in place of tdx_clear_page(). The new name reflects that, in fact, the clearing is necessary only for hardware with a certain quirk. That is dealt with in a subsequent patch but doing the rename here avoids additional churn. Note reset_tdx_pages() is slightly different from tdx_clear_page() because, more appropriately, it uses mb() in place of __mb(). Except when extra debugging is enabled (kcsan at present), mb() just calls __mb(). Signed-off-by: Adrian Hunter Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Rick Edgecombe Acked-by: Kai Huang Acked-by: Sean Christopherson Acked-by: Vishal Annapurve Link: https://lore.kernel.org/all/20250819155811.136099-2-adrian.hunter%40intel.com commit d8b483ba4336470805cc04c3a263ddc126c90175 Author: Xiaoyao Li Date: Wed Jul 9 22:10:35 2025 +0800 MAINTAINERS: Add KVM mail list to the TDX entry KVM is the primary user of TDX within the kernel, and it is KVM that provides support for running TDX guests. Add the KVM mailing list to the TDX entry so that KVM people can be informed of proposed changes and updates related to TDX. Signed-off-by: Xiaoyao Li Signed-off-by: Dave Hansen Acked-by: Sean Christopherson Link: https://lore.kernel.org/all/20250709141035.70299-1-xiaoyao.li%40intel.com commit 957e3855407d943577695531931e8aec938733d2 Author: Kiryl Shutsemau Date: Tue Jul 8 13:19:21 2025 +0300 MAINTAINERS: Add Rick Edgecombe as a TDX reviewer Rick worked extensively to enable TDX in KVM. He will continue to work on TDX and should be involved in discussions regarding TDX. Add Rick as a TDX reviewer. Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20250708101922.50560-3-kirill.shutemov%40linux.intel.com commit 81e39b6d89b5148480f607f93a88cd16f7df6f4a Author: Kiryl Shutsemau Date: Tue Jul 8 13:19:20 2025 +0300 MAINTAINERS: Update the file list in the TDX entry. This includes files that were previously missed in the TDX entry file list and makes it more future-proof. Most importantly, this now covers the recently added KVM enabling. [ dhansen: move from explicit files to "tdx" filename match ] Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20250708101922.50560-2-kirill.shutemov%40linux.intel.com commit 9a0352dd45225597cb8d4a4d79cf5b53f3609ae3 Author: Qianfeng Rong Date: Thu Aug 21 21:41:17 2025 +0800 refscale: Use kcalloc() instead of kzalloc() Use kcalloc() in main_func() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Signed-off-by: Paul E. McKenney commit 3e15cccf3ea272ae40942e8a5a741bb69a56f654 Author: Qianfeng Rong Date: Thu Aug 21 21:41:16 2025 +0800 rcutorture: Use kcalloc() instead of kzalloc() Use kcalloc() in rcu_torture_writer() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Change sizeof(ulo[0]) and sizeof(rgo[0]) to sizeof(*ulo) and sizeof(*rgo), as this is more consistent with coding conventions. Signed-off-by: Qianfeng Rong Signed-off-by: Paul E. McKenney commit de117fe3f50f962d927b17b8de6632ee197b70ae Author: Nikil Paul S Date: Tue Aug 19 18:05:46 2025 +0000 docs: rcu: Replace multiple dead OLS links in RTFP.txt This patch updates several dead OLS links in RTFP.txt, replacing them with working copies hosted on kernel.org. Originally posted as part of a 2-patch series, this is now being sent as a standalone v4 patch to avoid confusion. Signed-off-by: Nikil Paul S Signed-off-by: Paul E. McKenney commit 14b0a12a70414f7a3119e9d661a8bcab42492b8e Author: Paul E. McKenney Date: Tue Aug 19 08:38:06 2025 -0700 doc: Fix typo in RCU's torture.rst documentation s/you// Reported-by: Randy Dunlap Signed-off-by: Paul E. McKenney commit 9832258da7f1bc2051c536a2068e880d49570de2 Author: Bagas Sanjaya Date: Tue Aug 19 08:26:20 2025 +0700 Documentation: RCU: Retitle toctree index toctree index title ("RCU concepts") is rather a misnomer: RCU concepts is already described in rcu.rst, whereas the toctree suggests that the docs themes about handbook on RCU subsystem instead. Edit the title to reflect the fact. Signed-off-by: Bagas Sanjaya Signed-off-by: Paul E. McKenney commit 326b16baed677edcc706ee44791716a610a8edf0 Author: Bagas Sanjaya Date: Tue Aug 19 08:26:19 2025 +0700 Documentation: RCU: Reduce toctree depth toctree index for RCU currently has maximum depth of 3. Since no docs currently use more than 3 section heading levels, this effectively spills the entire docs hierarchy. Tidy up by reducing toctree depth to 2 (only showing docs title and second-level sections). Signed-off-by: Bagas Sanjaya Signed-off-by: Paul E. McKenney commit 8495e00fe654962bdd83dd6ca8f32918c50f3454 Author: Bagas Sanjaya Date: Tue Aug 19 07:45:59 2025 +0700 Documentation: RCU: Wrap kvm-remote.sh rerun snippet in literal code block Unlike other kvm*.sh snippets in RCU torture test documentation, kvm-remote.sh rerun snippet isn't formatted as literal code block, causing it to be definition list instead in htmldocs output. Wrap it like the rest. Fixes: 0c208a793022 ("doc: Update torture.rst") Signed-off-by: Bagas Sanjaya Signed-off-by: Paul E. McKenney Reviewed-by: Randy Dunlap commit f12343013022a92fff0cf22cb7b22b9c909cdbf5 Author: Liao Yuanhong Date: Wed Aug 20 20:40:11 2025 +0800 pds_fwctl: Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Link: https://patch.msgid.link/r/20250820124011.474224-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Brett Creeley Signed-off-by: Jason Gunthorpe commit 90741cc5bebd7671be43959f5cbbc32700867a50 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:34 2025 +0200 arm64: dts: marvell: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Gregory CLEMENT commit d20a5d96eddb95b4faa33247ec653a580c48fdfa Author: Uros Bizjak Date: Mon Jun 16 10:30:41 2025 +0200 x86/idle: Use MONITORX and MWAITX mnemonics in Current minimum required version of binutils is 2.30, which supports MONITORX and MWAITX instruction mnemonics. Replace the byte-wise specification of MONITORX and MWAITX with these proper mnemonics. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250616083056.157460-1-ubizjak@gmail.com commit 5be502174bf0f5d0aafaab57fa4512723d6d2973 Author: Xin Li (Intel) Date: Fri Aug 22 00:16:44 2025 -0700 x86/entry/fred: Push __KERNEL_CS directly Push __KERNEL_CS directly, rather than moving it into RAX and then pushing RAX. No functional changes. Suggested-by: H. Peter Anvin (Intel) Signed-off-by: Xin Li (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250822071644.1405268-1-xin@zytor.com commit 4b43f2bcc84dd550c1a847318db02165d2829573 Author: Jisheng Zhang Date: Fri Aug 15 09:34:13 2025 +0800 mmc: dw_mmc-rockchip: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-39-jszhang@kernel.org Signed-off-by: Ulf Hansson commit eddc91781aadb4f7de2026dda83558a458fc7fd9 Author: Jisheng Zhang Date: Fri Aug 15 09:34:12 2025 +0800 mmc: dw_mmc-pci: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-38-jszhang@kernel.org Signed-off-by: Ulf Hansson commit b6a668e0f1c453a32013d047c5cd9a46d3ef54a0 Author: Jisheng Zhang Date: Fri Aug 15 09:34:11 2025 +0800 mmc: dw_mmc-k3: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-37-jszhang@kernel.org Signed-off-by: Ulf Hansson commit a01c660c8f7da8d4c0c220aa7880471a9c1921ef Author: Jisheng Zhang Date: Fri Aug 15 09:34:10 2025 +0800 mmc: dw_mmc: exynos: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-36-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 9ae88dc98d93fc8d283e85d7d6dd4091af7e5086 Author: Jisheng Zhang Date: Fri Aug 15 09:34:09 2025 +0800 mmc: via-sdmmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-35-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 1d955e4affecc6e14d04e77741c53c9bf7095b5e Author: Jisheng Zhang Date: Fri Aug 15 09:34:08 2025 +0800 mmc: sdhci-msm: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-34-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 2f7c7a18c352bf5fc9c44a034162be6dfd242f31 Author: Jisheng Zhang Date: Fri Aug 15 09:34:07 2025 +0800 mmc: mtk-sd: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-33-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 8a40405a5f18adb6065762b651bac9a71aa1119c Author: Jisheng Zhang Date: Fri Aug 15 09:34:06 2025 +0800 mmc: wmt-sdmmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-32-jszhang@kernel.org Signed-off-by: Ulf Hansson commit a120f2175d0f10e985fd7eb6007119f8ed53e083 Author: Jisheng Zhang Date: Fri Aug 15 09:34:05 2025 +0800 mmc: toshsd: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-31-jszhang@kernel.org Signed-off-by: Ulf Hansson commit b2af65aee264a496c766ea595ecdb3f2c610b8b5 Author: Jisheng Zhang Date: Fri Aug 15 09:34:04 2025 +0800 mmc: sh_mmicf: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-30-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 7aa59bfe06875cc4c3cb5c04eed2cdf6f6288153 Author: Jisheng Zhang Date: Fri Aug 15 09:34:03 2025 +0800 mmc: sdhci-tegra: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-29-jszhang@kernel.org Signed-off-by: Ulf Hansson commit dc8b0e5766804c58d02c1caf6e11c7db718c18f1 Author: Jisheng Zhang Date: Fri Aug 15 09:34:02 2025 +0800 mmc: sdhci-st: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Reviewed-by: Patrice Chotard Link: https://lore.kernel.org/r/20250815013413.28641-28-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 693223205b27e3876eba103fa13bf6ed35197067 Author: Jisheng Zhang Date: Fri Aug 15 09:34:01 2025 +0800 mmc: sdhci-sprd: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-27-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 02517359c9da7f07c2bafd1e152866142ac1d709 Author: Jisheng Zhang Date: Fri Aug 15 09:34:00 2025 +0800 mmc: sdhci-spear: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20250815013413.28641-26-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 550c5a8d9a48ee99e0737e14418ceb7d0fa28d59 Author: Jisheng Zhang Date: Fri Aug 15 09:33:59 2025 +0800 mmc: sdhci-s3c: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-25-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 1c6316a5ce4ab6775d24f4a0aa24c5cfe274e2b8 Author: Jisheng Zhang Date: Fri Aug 15 09:33:58 2025 +0800 mmc: sdhci-cadence: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-24-jszhang@kernel.org Signed-off-by: Ulf Hansson commit d8d84cf91a1bbfd117649cb677cadcfcb5ed9e65 Author: Jisheng Zhang Date: Fri Aug 15 09:33:57 2025 +0800 mmc: sdhci-omap: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-23-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 7340c260d0f4ffc2f4068f9c80d1d198f1df9cad Author: Jisheng Zhang Date: Fri Aug 15 09:33:56 2025 +0800 mmc: sdhci-of-esdhc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-22-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 6b66e69da2df7472d6fc6feca2b8c5e25d3857bb Author: Jisheng Zhang Date: Fri Aug 15 09:33:55 2025 +0800 mmc: sdhci-of-at91: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-21-jszhang@kernel.org Signed-off-by: Ulf Hansson commit bb7b1709873facacd9f1267c3e79a578d55c3699 Author: Jisheng Zhang Date: Fri Aug 15 09:33:54 2025 +0800 mmc: sdhci-of-arasan: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-20-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 1072eaf162d6247f10ac33d79c89cdb3ce775ccb Author: Jisheng Zhang Date: Fri Aug 15 09:33:53 2025 +0800 mmc: sdhci-esdhc-imx: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Reviewed-by: Haibo Chen Link: https://lore.kernel.org/r/20250815013413.28641-19-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 1e4f1d8cc1211c87d5bc384c187174bed772d7d6 Author: Jisheng Zhang Date: Fri Aug 15 09:33:52 2025 +0800 mmc: sdhci-brcmstb: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-18-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 5861ff20fda6aeddc837fd9e10d09e288e089565 Author: Jisheng Zhang Date: Fri Aug 15 09:33:51 2025 +0800 mmc: sdhci_am654: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-17-jszhang@kernel.org Signed-off-by: Ulf Hansson commit f94509c94254d932dd7b1e6730032f512476af0b Author: Jisheng Zhang Date: Fri Aug 15 09:33:50 2025 +0800 mmc: sdhci-acpi: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250815013413.28641-16-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 99a44c327f68db78f48343ba6ad48ef06d91fb6f Author: Jisheng Zhang Date: Fri Aug 15 09:33:49 2025 +0800 mmc: rtsx_usb_sdmmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-15-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 8e8214d98b5ffdc0368112b3dd3a709cdbffcd19 Author: Jisheng Zhang Date: Fri Aug 15 09:33:48 2025 +0800 mmc: omap_hsmmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-14-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 79565d5b3019d007ef76ee3b94e9cdc7b49b38b2 Author: Jisheng Zhang Date: Fri Aug 15 09:33:47 2025 +0800 mmc: mxs-mmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-13-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 773a98f84dbb837b1f9a96be01826c769dc176b4 Author: Jisheng Zhang Date: Fri Aug 15 09:33:46 2025 +0800 mmc: mmci: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-12-jszhang@kernel.org Signed-off-by: Ulf Hansson commit aa18042bd1bd7a752ea9657074ee3c19d8666624 Author: Jisheng Zhang Date: Fri Aug 15 09:33:45 2025 +0800 mmc: davinci_mmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-11-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 8f50276e733a2e4ca5c5adace8bfc80d9493af50 Author: Jisheng Zhang Date: Fri Aug 15 09:33:44 2025 +0800 mmc: cb710-mmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. At the same time, replace the platform_driver's .suspend and .resume usage with modern device_driver's .pm usage. Signed-off-by: Jisheng Zhang Acked-by: Michał Mirosław Link: https://lore.kernel.org/r/20250815013413.28641-10-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 3d3c95796a31808515c26279961ddc6e8a655254 Author: Jisheng Zhang Date: Fri Aug 15 09:33:43 2025 +0800 mmc: au1xmmc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. At the same time, replace the platform_driver's .suspend and .resume usage with modern device_driver's .pm usage. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-9-jszhang@kernel.org Signed-off-by: Ulf Hansson commit ce4b13cb3001ccb2636ecee94febf81b031c32a2 Author: Jisheng Zhang Date: Fri Aug 15 09:33:42 2025 +0800 mmc: atmel: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-8-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 5d6f42f6c455aea0a32eb6444c21b05e4cd049a0 Author: Jisheng Zhang Date: Fri Aug 15 09:33:41 2025 +0800 mmc: alcor: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-7-jszhang@kernel.org Signed-off-by: Ulf Hansson commit f98ad5c31c0fa02795ea005ddf2a4d4b38409127 Author: Jisheng Zhang Date: Fri Aug 15 09:33:40 2025 +0800 mmc: sunxi: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-6-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 4129dbbb53d7cec08a959aaaf3300394dfdc15cc Author: Jisheng Zhang Date: Fri Aug 15 09:33:39 2025 +0800 mmc: sdhci-pxav3: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-5-jszhang@kernel.org Signed-off-by: Ulf Hansson commit a013431a806ed8d39b6f4b9ecbf3c4ce66581f5b Author: Jisheng Zhang Date: Fri Aug 15 09:33:38 2025 +0800 mmc: sdhci-xenon: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250815013413.28641-4-jszhang@kernel.org Signed-off-by: Ulf Hansson commit fc39a30c6ddb122ae687e4360f3578eca6749276 Author: Jisheng Zhang Date: Fri Aug 15 09:33:37 2025 +0800 mmc: sdhci-of-dwcmshc: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Tested-by: Drew Fustini # for TH1520 on LPi4a Link: https://lore.kernel.org/r/20250815013413.28641-3-jszhang@kernel.org Signed-off-by: Ulf Hansson commit fc232394c09a0a50a1d33b231f4b579a58d4688f Author: Jisheng Zhang Date: Fri Aug 15 09:33:36 2025 +0800 mmc: sdhci: add some simple inline functions for !CONFIG_PM In next commits, we will switch to the modern PM macros. Signed-off-by: Jisheng Zhang Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250815013413.28641-2-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 533c62f5c1d5a52807bdd434a44e3cbc6e77b416 Author: Oleksij Rempel Date: Thu Aug 21 15:07:51 2025 +0200 mmc: core: add undervoltage handler for MMC/eMMC devices Add infrastructure to handle regulator undervoltage events for MMC/eMMC cards. When an undervoltage is detected, the new handler performs a controlled emergency suspend using a short power-off notification, skipping the cache flush to maximize the chance of a safe shutdown. After the operation, the card is marked as removed to prevent further I/O and possible data corruption. This is implemented by introducing MMC_POWEROFF_UNDERVOLTAGE to the mmc_poweroff_type enum and refactoring the suspend logic into an internal __mmc_suspend() helper that allows the caller to skip the cache flush if required. The undervoltage handler is registered as a bus operation and invoked from the core undervoltage path. If power-off notification is not supported by the card, the handler falls back to sleep or deselecting the card. Additionally, update the shutdown path to avoid redundant shutdown steps if the card is already removed Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20250821130751.2089587-3-o.rempel@pengutronix.de Signed-off-by: Ulf Hansson commit 3202d6ed9368fc1e842fda73727553ae614633f8 Author: Oleksij Rempel Date: Thu Aug 21 15:07:50 2025 +0200 mmc: core: Add infrastructure for undervoltage handling Implement the core infrastructure to allow MMC bus types to handle REGULATOR_EVENT_UNDER_VOLTAGE events from power regulators. This is primarily aimed at allowing devices like eMMC to perform an emergency shutdown to prevent data corruption when a power failure is imminent. This patch introduces: - A new 'handle_undervoltage' function pointer to 'struct mmc_bus_ops'. Bus drivers (e.g., for eMMC) can implement this to define their emergency procedures. - A workqueue ('uv_work') in 'struct mmc_supply' to handle the event asynchronously in a high-priority context. - A new function 'mmc_handle_undervoltage()' which is called from the workqueue. It stops the host queue to prevent races with card removal, checks for the bus op, and invokes the handler. - Functions to register and unregister the regulator notifier, intended to be called by bus drivers like 'mmc_attach_mmc' when a compatible card is detected. The notifier is only registered for the main vmmc supply, as undervoltage handling for vqmmc or vqmmc2 is not required at this time. Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20250821130751.2089587-2-o.rempel@pengutronix.de Signed-off-by: Ulf Hansson commit 6fb942b85a1ab9728a4551d4161ec6fd6fab94f3 Author: Dan Carpenter Date: Thu Aug 21 15:32:49 2025 +0300 mmc: rtsx_usb_sdmmc: Fix uninitialized variable issue If rtsx_usb_get_card_status() fails then "val" isn't initialized. Move the use of "val" until after the error checking. Fixes: d2e6fb2c31a0 ("misc: rtsx: usb card reader: add OCP support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aKcR8QD81TjVqIhl@stanley.mountain Signed-off-by: Ulf Hansson commit 1f69220b0998b609000c6ea1783772fdaecaec56 Author: Dan Carpenter Date: Thu Aug 21 15:32:25 2025 +0300 mmc: mmc_spi: remove unnecessary check in mmc_spi_setup_data_message() An earlier commit changed the outer if statement from "if (multiple || write) {" to "if (write) {" so now we know that "write" is true and no longer need to check. Delete the unnecessary check. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aKcR2ea747xkw_it@stanley.mountain Signed-off-by: Ulf Hansson commit 9674f9e325e4b13f54ab108affe9928a3088d9c1 Author: Duje Mihanović Date: Thu Aug 21 13:20:36 2025 +0200 mmc: sdhci-pxav3: add state_uhs pinctrl setting Different bus clocks require different pinctrl states to remain stable. Add support for selecting between a default and UHS state according to the bus clock. Acked-by: Adrian Hunter Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250821-pxav3-uhs-v4-2-bb588314f3c3@dujemihanovic.xyz Signed-off-by: Ulf Hansson commit 5a22df198bd3f515dfd9ff064a81f41567427dfc Author: Duje Mihanović Date: Thu Aug 21 13:20:35 2025 +0200 dt-bindings: mmc: sdhci-pxa: add state_uhs pinctrl On the pxav3 controller, increasing the drive strength of the data pins might be required to maintain stability on fast bus clocks (above 100 MHz). Add a state_uhs pinctrl to allow this. Reviewed-by: Rob Herring (Arm) Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250821-pxav3-uhs-v4-1-bb588314f3c3@dujemihanovic.xyz Signed-off-by: Ulf Hansson commit 5a796a700ff8a26b8c17bfa5b789dd24ce19c3b6 Author: Xu Yang Date: Thu Aug 21 19:08:28 2025 +0800 arm64: dts: imx95: add fsl,phy-tx-vref-tune-percent tuning properties for USB3 PHY Add it to improve USB signal quality. Signed-off-by: Xu Yang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 58c4544f1c3f0a1ac07e2d3173cf52593f07fa4b Author: Frank Li Date: Tue Aug 19 15:44:09 2025 -0400 ARM: dts: vfxxx: add arm,num-irq-priority-bits for nvic Add arm,num-irq-priority-bits(4) for nvic to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/vf/vf610m4-colibri.dtb: interrupt-controller@e000e100 (arm,armv7m-nvic): 'arm,num-irq-priority-bits' is a required property from schema $id: http://devicetree.org/schemas/interrupt-controller/arm,nvic.yaml# Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e479b8477f99448db3728ac08f140cedf1ac9ec4 Author: Frank Li Date: Tue Aug 19 15:44:07 2025 -0400 ARM: dts: vf610: add grp surfix to pinctrl Add grp surfix for pinctrl to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dtb: pinctrl@40048000 (fsl,vf610-iomuxc): i2c0grp-gpio: {'fsl,pins': [[144, 0, 0, 0, 12738, 148, 0, 0, 0, 12738]], 'phandle': 19} is not of type 'array' from schema $id: http://devicetree.org/schemas/gpio/gpio-consumer.yaml# Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e00664c9c6f94efef9b91b5c296a8d978efd056a Author: Fabio Estevam Date: Tue Aug 19 16:40:18 2025 -0300 ARM: dts: vf: Change the NAND controller node name fsl,vf610-nfc.yaml references nand-controller.yaml, which only allows the node to be 'nand-controller'. Change it accordingly to fix the following dt-schema warning: $nodename:0: 'nand@400e0000' does not match '^nand-controller(@.*)?' Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit d4c743c5b7b42550a5eab0d9ab63ba7511f7e21e Author: Fabio Estevam Date: Tue Aug 19 16:34:05 2025 -0300 ARM: dts: vf: Change the pinctrl node name fsl,vf610-iomuxc.yaml references pinctrl.yaml, which only allows the node to be either 'pinctrl' or 'pinmux'. Change the node name to 'pinctrl' to fix the following dt-schema warning: iomuxc@40048000' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b Author: Xiao Liang Date: Sun Aug 17 00:30:15 2025 +0800 padata: Reset next CPU when reorder sequence wraps around When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: Signed-off-by: Xiao Liang Signed-off-by: Herbert Xu commit 56a50e37fee038d004866e5a2c479706d6034017 Author: Yunseong Kim Date: Sat Aug 16 14:30:29 2025 +0000 crypto: ccp - Fix typo in psp_populate_hsti function name The function "psp_poulate_hsti" was misspelled. This patch corrects the typo to "psp_populate_hsti" in both the function definition and its call site within psp_init_hsti(). Signed-off-by: Yunseong Kim Reviewed-by: Mario Limonciello > --- Signed-off-by: Herbert Xu commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e Author: Thorsten Blum Date: Mon Aug 11 11:24:57 2025 +0200 crypto: octeontx2 - Call strscpy() with correct size argument In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length of the source string rather than the size of the destination buffer. This is fine as long as the destination buffer is larger than the source string, but we should still use the destination buffer size instead to call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer, we can safely omit the size argument and let strscpy() infer it using sizeof(). Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups") Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 11d5674fc2e5e75ccaa13685a909c14e033544b7 Author: Herbert Xu Date: Mon Aug 11 12:44:00 2025 +0800 crypto: hash - Make HASH_MAX_DESCSIZE a bit more obvious Move S390_SHA_CTX_SIZE into crypto/hash.h so that the derivation of HASH_MAX_DESCSIZE is less cryptic. Signed-off-by: Herbert Xu commit 22df6943dcdddcb2b833a8fb4d30813cde5be4d7 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:18:02 2025 +0200 arm64: dts: freescale: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit 9270fe91e9d2fd2323941825f5103a4ee58abe4c Author: Krzysztof Kozlowski Date: Tue Aug 19 15:18:01 2025 +0200 ARM: dts: nxp: imx6ull: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 3d25ef32f140533a1f954ec4c6e6b33ea9b08983 Author: Luke Wang Date: Mon Aug 18 09:25:41 2025 +0800 arm64: dts: imx95-15x15-evk: Change pinctrl settings for usdhc2 The drive strength is too high for SDR104 mode. Change the drive strength to X3 as hardware team recommends. Signed-off-by: Luke Wang Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit fd7053e82fa6f915a36b4fd5a901e5e2174a6dbd Author: Peng Fan Date: Mon Aug 18 09:25:40 2025 +0800 arm64: dts: imx95-19x19-evk: Add pf09 and pf53 thermal zones System Manager supports reading out pf09 and pf53 temperature and SCMI Agent could get the values through SCMI sensor protocol. So add the nodes to allow Linux to get the temperature. Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 72961e143de68d7b229d275329a37b9c99e8925e Author: Peng Fan Date: Mon Aug 18 09:25:39 2025 +0800 arm64: dts: imx95-19x19-evk: Add pca9632 node Add an I2C controlled 4-bit LED driver PCA9632 under lpi2c3. Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 0898ed6832f5ce977e2a2c3d1556b156f2bc7502 Author: Richard Zhu Date: Mon Aug 18 09:25:38 2025 +0800 arm64: dts: imx95-19x19-evk: Add Tsettle delay in m2 regulator M.2 device only can be enabled after all Power Rails reach their minimum operating voltage (PCI Express M.2 Specification r5.1 3.1.4 Power-up Timing). Set a delay equal to the max value of Tsettle in m2 regulator. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 06d59feccdedee2888e98e43e13a9e0382745979 Author: Peng Fan Date: Mon Aug 18 09:25:37 2025 +0800 arm64: dts: imx95-evk: Update alias Add i2c, gpio, mmc, serial alias for 15x15 EVK and add lpuart5 serial alias for 19x19 EVK. Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 530141de4d6598f88924c5b2c4d9ee7b7c72db77 Author: Peng Fan Date: Mon Aug 18 09:25:36 2025 +0800 arm64: dts: imx95: Add coresight nodes Add etf, etm, etr, funnel nodes for coresight. Signed-off-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit c1288a46af3e5a6bac0ef67f0268ea893b9a7317 Author: Peng Fan Date: Mon Aug 18 09:25:35 2025 +0800 arm64: dts: imx95: Add OCOTP node Add OCOTP node to allow reading fuse using nvmem API Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 9b541c18a8cfbf9f01d3dc5e794104cda1708329 Author: Peng Fan Date: Mon Aug 18 09:25:34 2025 +0800 arm64: dts: imx95: Add more V2X MUs Add more MUs for V2X communication Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 770fcc6856e986b4dc976d22e64083a4a772a69f Author: Peng Fan Date: Mon Aug 18 09:25:33 2025 +0800 arm64: dts: imx95: Add LMM/CPU nodes Add SCMI LMM and CPU nodes for managing Logical Machine and CPU. Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 289948aa706dca8ca67167cdd95f1901aca8f32a Author: Peng Fan Date: Mon Aug 18 09:25:32 2025 +0800 arm64: dts: imx95: Add System Counter node Add System Counter node to support cpuidle when arm generic timer stops Reviewed-by: Frank Li Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 Author: Joy Zou Date: Mon Aug 18 09:25:31 2025 +0800 arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87, and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them. Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes") Signed-off-by: Joy Zou Signed-off-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 3557df14346ddb4d17a87d5de08e72db2ee823c2 Author: Geert Uytterhoeven Date: Wed Aug 13 17:44:46 2025 +0200 arm64: dts: freescale: Switch to hp-det-gpios Replace the deprecated "hp-det-gpio" property by "hp-det-gpios" in Freescale Generic ASoC Sound Card device nodes. Signed-off-by: Geert Uytterhoeven Signed-off-by: Shawn Guo commit 3784c3819b201daa886cfe8aeabd7b765d382b29 Author: Alexander Stein Date: Tue Aug 12 08:13:38 2025 +0200 ARM: dts: ls1021a: rename rcpm as wakeup-control from power-control Invoke power-domain.yaml if node name as 'power-control'. Rcpm actually are not power domain controller. It just control wakeup capability. So rename it as wakeup-control. Implements the same change as commit e39f567e1c38c ("arm64: dts: layerscape: rename rcpm as wakeup-control from power-control") for arm64 layerscapes. While at it, also remove superfluous #power-domain-cells Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 395a9013890309fa47ea16f5d82791d90d54d6fa Author: Alexander Dahl Date: Mon Aug 11 08:38:54 2025 +0200 arm64: dts: imx8dxl-ss-conn: Disable USB3 nodes The i.MX 8DualXLite/8SoloXLite has a different connectivity memory map than the generic i.MX8 has. One conflicting resource is usb, where the imx8dxl has a second usb2 phy @5b110000, while the generic imx8 dtsi has one usb2 phy and one usb3 phy, and the usb3otg @5b110000. When including both imx8dxl-ss-conn.dtsi and imx8-ss-conn.dtsi as done in imx8dxl.dtsi this leads to a duplicate unit-address warning. The usb3otg node was introduced after the initial imx8dxl support with commit a8bd7f155126 ("arm64: dts: imx8qxp: add cadence usb3 support") and since then leads to warnings like this (when built with W=2): DTC arch/arm64/boot/dts/freescale/imx8dxl-evk.dtb …/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi:148.24-182.4: Warning (unique_unit_address): /bus@5b000000/usb@5b110000: duplicate unit-address (also used in node /bus@5b000000/usbphy@5b110000) also defined at …/arch/arm64/boot/dts/freescale/imx8dxl-ss-hsio.dtsi:41.23-50.4 also defined at …/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts:645.8-653.3 Delete usb3 related nodes at dxl to fix above warning. Signed-off-by: Alexander Dahl Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 7bb41e072a9c64c5cf2f5a8ef2989102f6c29b17 Author: Joy Zou Date: Wed Aug 6 19:41:16 2025 +0800 arm64: defconfig: enable i.MX91 pinctrl Enable i.MX91 pinctrl driver for booting the system. Reviewed-by: Frank Li Signed-off-by: Pengfei Li Signed-off-by: Joy Zou Signed-off-by: Shawn Guo commit 6351806e5cd3290de6914327a7359e6f4a9e9a5f Author: Pengfei Li Date: Wed Aug 6 19:41:09 2025 +0800 dt-bindings: arm: fsl: add i.MX91 11x11 evk board Add the board imx91-11x11-evk in the binding document. Signed-off-by: Pengfei Li Signed-off-by: Joy Zou Acked-by: Conor Dooley Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 48d86413d807c2db285f3bacfa26d9d211608439 Author: Daniel Lezcano Date: Thu Jul 31 16:01:41 2025 +0200 arm64: dts: s32g399a-rdb3: Enable the SWT watchdog The SWT0 is directly connected to the reset line and only one instance is useful for its purpose. Let's enable it on the s32g399a-rdb3. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit 6db84f04274571be0ed7aad394625aa86c101fd0 Author: Daniel Lezcano Date: Thu Jul 31 16:01:40 2025 +0200 arm64: dts: s32g3: Add the Software Timer Watchdog (SWT) nodes Referred in the documentation as the Software Timer Watchdog (SWT), the s32g3 has 12 watchdogs. The number of watchdogs is designed to allow dedicating one watchdog per Cortex-M7/A53 present on the SoC. Add the SWT nodes in the device tree. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit 88a1e2d86540f3753ef51b44830ec6254411ef19 Author: Daniel Lezcano Date: Thu Jul 31 16:01:39 2025 +0200 arm64: dts: s32g274-rd2: Enable the SWT watchdog The SWT0 is directly connected to the reset line and only one instance is useful for its purpose. Let's enable it for the s32g274-rd2. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit efb4d287f1c00d402a9e83f768dd7b3ce888cd02 Author: Daniel Lezcano Date: Thu Jul 31 16:01:38 2025 +0200 arm64: dts: s32g2: Add the Software Timer Watchdog (SWT) nodes Referred in the documentation as the Software Timer Watchdog (SWT), the s32g2 has 7 watchdogs. The number of watchdogs is designed to allow dedicating one watchdog per Cortex-M7/A53 present on the SoC. Add the SWT nodes in the device tree. Signed-off-by: Daniel Lezcano Signed-off-by: Shawn Guo commit 7c4ad77ccaab2e91057f4b4f1391f76e3d01a525 Author: Daniel Lezcano Date: Thu Jul 31 16:01:37 2025 +0200 arm64: dts: s32g399a-rdb3: Enable the STM timers The platform has 8 CPUs, and the Linux STM timer driver is instantiated per CPU. Enable 8 STM timers that can be used as replacements for the ARM architected timers. The remaining STM timers are not useful to the Linux kernel and provide no benefit, so they are left disabled. Enable STM0 to STM6 and STM8 on the s32g399a-rdb3 platform. STM7 is skipped, as it differs slightly from the others and requires an additional property to be properly handled by the driver. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit 13c0e302a97e9d7d79ae65b051661c68c0b18d87 Author: Daniel Lezcano Date: Thu Jul 31 16:01:36 2025 +0200 arm64: dts: s32g3: Add the System Timer Module nodes The s32g3 has a STM module containing 12 timers. Each timer has a dedicated interrupt and share the same clock. Add the STM0->STM11 nodes for the s32g3 SoC. The STM7 node is not added because it is slightly different and needs an extra property which will be added later when supported by the driver. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit 6aa892c0f180a9a19d407ebe26b66a18a291fc83 Author: Daniel Lezcano Date: Thu Jul 31 16:01:35 2025 +0200 arm64: dts: s32g274-rd2: Enable the STM timers Enable the timers STM0 -> STM3 on the s32g274-rd2 The platform has 4 CPUs, and the Linux STM timer driver is instantiated per CPU. Enable 4 STM timers that can be used as replacements for the ARM architected timers. The remaining STM timers are not useful to the Linux kernel and provide no benefit, so they are left disabled. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit 0f03b751b9e35398513d63d2bb7342564157c938 Author: Daniel Lezcano Date: Thu Jul 31 16:01:34 2025 +0200 arm64: dts: s32g2: Add the System Timer Module nodes The s32g2 has a STM module containing 8 timers. Each timer has a dedicated interrupt and share the same clock. Add the timers STM0->STM6 nodes for the s32g2 SoC. The STM7 node is not added because it is slightly different and needs an extra property which will be added later when supported by the driver. Signed-off-by: Daniel Lezcano Cc: Ghennadi Procopciuc Cc: Thomas Fossati Signed-off-by: Shawn Guo commit f434ec2200667d5362bd19f93a498d9b3f121588 Author: Judith Mendez Date: Mon Aug 18 14:26:32 2025 -0500 arm64: dts: ti: k3-am62p: Fix supported hardware for 1GHz OPP The 1GHz OPP is supported on speed grade "O" as well according to the device datasheet [0], so fix the opp-supported-hw property to support this speed grade for 1GHz OPP. [0] https://www.ti.com/lit/gpn/am62p Fixes: 76d855f05801 ("arm64: dts: ti: k3-am62p: add opp frequencies") Cc: stable@vger.kernel.org Signed-off-by: Judith Mendez Signed-off-by: Viresh Kumar commit 37f846830b510121c5364ba7bd23e3d77a83ff9b Author: Judith Mendez Date: Mon Aug 18 14:26:31 2025 -0500 cpufreq: ti: Allow all silicon revisions to support OPPs More silicon revisions are being defined for AM62x, AM62Px, and AM62ax SoCs. These silicon may also support currently establishes OPPs, so remove the revision limitation in ti-cpufreq and thus determine if an OPP applies with speed grade efuse parsing. Signed-off-by: Judith Mendez Signed-off-by: Viresh Kumar commit f8d63d7e60e8912b5ded72319c305765b0a6322f Author: Judith Mendez Date: Mon Aug 18 14:26:30 2025 -0500 cpufreq: ti: Support more speed grades on AM62Px SoC As the AM62Px SoC family matures more speed grades are being defined. Add support for speed grades U and T which both support all currently established OPPs. Signed-off-by: Judith Mendez Signed-off-by: Viresh Kumar commit 7a399ce67e981f5f28afc1ff50772acd1f4e7bbf Author: Mario Limonciello (AMD) Date: Thu Aug 21 09:49:11 2025 -0500 pinctrl: amd: Don't access irq_data's hwirq member directly There is an irqd_to_hwirq() intended to get the hwirq number. Switch all use to it. Suggested-by: Andy Shevchenko Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/20250821144942.2463014-1-superm1@kernel.org Signed-off-by: Linus Walleij commit 54b962fa14dc82a625436fcbcee7b3f2067a4f6d Author: Mario Limonciello (AMD) Date: Thu Aug 14 13:34:30 2025 -0500 pinctrl: amd: Add PM debugging message for turning on/off wakes The GPIOs for devices not in _AEI/_EVT such as touchpad or touchscreen won't have wakeup turned on until the suspend sequence starts. Due to code in amd_gpio_suspend_hibernate_common() masking the interrupt can make this difficult to follow what's going on. Add an explicit debugging message to tell when that was turned on/off. Signed-off-by: Mario Limonciello (AMD) Link: https://lore.kernel.org/20250814183430.3887973-2-superm1@kernel.org Signed-off-by: Linus Walleij commit c08e42c9a40ab634a7b762838977854ee3503b3d Author: Nikola Z. Ivanov Date: Thu Aug 21 23:01:32 2025 +0300 selftests/alsa: remove 0/NULL global variable assignment Remove 0/NULL global variable assignment in mixer-test.c and pcm-test.c Signed-off-by: Nikola Z. Ivanov Reviewed-by: Mark Brown Link: https://patch.msgid.link/20250821200132.1218850-1-zlatistiv@gmail.com Signed-off-by: Takashi Iwai commit a0000b40dacd17ac0f1d7d59bdbbdd0639781165 Author: Jacky Bai Date: Fri Jul 25 15:04:30 2025 +0800 arm64: dts: freescale: Add dma err irq info on imx94 Add the err irq info for edma2 and edma4. These two err irq are connected to the GIC directly, not irqsteer. Signed-off-by: Jacky Bai Signed-off-by: Shawn Guo commit db48d7b37e90ccdc7e4ed8e67597e0dcf985ff04 Author: Matthias Schiffer Date: Fri Jul 25 08:24:51 2025 +0200 arm64: dts: ls1012a: add DTS for TQMLS1012al module with MBLS1012AL board Add initial support for TQMLS1012AL module mounted on MBLS1012AL. It supports UART1 for console, PCIe, I2C, USB, µSD card (default), SATA and QSPI. There is an alternative ordering option which provides an eMMC instead of an SD card. This uses a different DT instead. Due missing Packet Forwarding Engine (PFE) driver support, there is no support for Ethernet so far. Signed-off-by: Max Merchel Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 255ca339320d6295d678398b54973dddc792e2d2 Author: Matthias Schiffer Date: Fri Jul 25 08:24:50 2025 +0200 dt-bindings: arm: fsl: add TQMLS1012AL TQMLS1012AL is a SOM using NXP LS1012A CPU. MBLS1012AL is a carrier reference design. [1] https://www.tq-group.com/en/products/tq-embedded/qoriq-layerscape/tqmls1012al Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit e9b7e94e91a2c6c55185feaeba89d2c754be88ae Author: Alexander Stein Date: Fri Jul 25 08:16:32 2025 +0200 ARM: dts: ls1021a-tqmals1021a-mbsl1021a: Remove superfluous compatible The touchscreen compatible in the overlays has one extra entry. Remove it to fix the dtbs_check warning: touchscreen@38 (edt,edt-ft5406): compatible: ['edt,edt-ft5406', 'edt,edt-ft5x06'] is too long Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 80c454859ff170924a77b9d412cf380d236ae407 Author: Alexander Stein Date: Fri Jul 25 08:16:31 2025 +0200 ARM: dts: ls1021a-tqmals1021a: Remove superfluous address and size cells for qflash The jedec SPI-NOR flash node itself has no partitions, but the partitions subnode. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 0185641721b89c965e3df2afb9a6a42618c74d38 Author: Alexander Stein Date: Fri Jul 25 08:13:35 2025 +0200 ARM: dts: ls1021a: remove undocumented 'big-endian' for memory-controller node According to binding doc mmc/fsl,esdhc.yaml and driver drivers/mmc/host/sdhci-of-esdhc.c, default is big-endian, should use little-endian for little-endian system. Remove 'big-endian' to fix below warning: esdhc@1560000 (fsl,ls1021a-esdhc): Unevaluated properties are not allowed ('big-endian', 'bus-width' were unexpected) Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit f4b4c014dfaafc56c0ca2c4d0a9f3461e36209df Author: Alexander Stein Date: Fri Jul 25 08:13:34 2025 +0200 ARM: dts: ls1021a: remove property 'snps,host-vbus-glitches' Commit 7e0685a0c4c27 ("arm64: dts: ls1012a: fix DWC3 USB VBUS glitch issue") erroneously added this to ls1021a as well. Despite that apparently the workaround has already been applied unconditional at commit a6ba1e453174 ("usb: dwc3: apply snps,host-vbus-glitches workaround unconditionally") Remove it to fix CHECK_DTBS warning: usb@3100000 (snps,dwc3): Unevaluated properties are not allowed ('snps,host-vbus-glitches' was unexpected) Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit cfcfea8eb91e9dcf51ee4f4766d6b393237f750a Author: Alexander Stein Date: Fri Jul 25 08:13:33 2025 +0200 ARM: dts: ls1021a: Fix watchdog node There is a dedicated compatible for ls1021a. Using it also fixes the warning regarding big-endian: arch/arm/boot/dts/nxp/ls/ls1021a-tqmls1021a-mbls1021a.dtb: watchdog@2ad0000 (fsl,imx21-wdt): big-endian: False schema does not allow True Also remove clock-names which is neither used nor specified. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 00f63c4db083edddabb14a577e25b108c24a2a78 Author: Alexander Stein Date: Fri Jul 25 08:13:32 2025 +0200 ARM: dts: ls1021a: remove undocumented 'big-endian' for memory-controller node According to binding doc memory-controllers/fsl/fsl,ddr.yaml and driver drivers/edac/fsl_ddr_edac.c, default is big-endian, should use little-endian for little-endian system. Remove 'big-endian' to fix below warning: arch/arm/boot/dts/nxp/ls/ls1021a-tqmls1021a-mbls1021a.dtb: memory-controller@1080000 (fsl,qoriq-memory-controller): 'big-endian' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 4df36c41090370c31c5e16d796830b2782fc71fa Author: Alexander Stein Date: Fri Jul 25 08:13:31 2025 +0200 ARM: dts: ls1021a: Remove superfluous address and size cells for queue-group queue-group nodes don't need them anyway as they are inherited from the corresponding ethernet nodes. Fixes the dtbs_check warning: ethernet@2d10000 (fsl,etsec2): queue-group@2d10000: '#address-cells', '#size-cells' do not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit eb55cf46957499b3e3b1e0c0836e48457740b2dd Author: Alexander Stein Date: Fri Jul 25 08:13:30 2025 +0200 ARM: dts: ls1021a: Add reg property to enet nodes Add missing reg property to enet nodes. This fixes the dtbs_check warning: Warning (unit_address_vs_reg): /soc/ethernet@2d10000: node has a unit name, but no reg or ranges property Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 4a3a18ce49b635c17d07657753b5405f5519f5f2 Author: Alexander Stein Date: Fri Jul 25 08:13:29 2025 +0200 ARM: dts: ls1021a: Fix FTM node RTC nodes are supposed to be named rtc@. Also remove reg-names which is neither used nor specified. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 2fe896e7fed00d11ff35148309aeb2309c2dcade Author: Alexander Stein Date: Fri Jul 25 08:13:28 2025 +0200 ARM: dts: ls1021a: Fix sai DMA order According to bindings Rx DMA channel comes first if Rx & Tx is used. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit b0187936b87b18e7d2141dba035b1881754d172a Author: Alexander Stein Date: Fri Jul 25 08:13:27 2025 +0200 ARM: dts: ls1021a: Fix qspi node unit address 0x8390000 is reserved memory, but 0x8380000 is the QSPI base address in RM. But register have offset of 0x8000, so first 'reg' entry address is used for node unit address. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit e18f0f68dba5d9d52cde99c360edcb6113fbb295 Author: Alexander Stein Date: Fri Jul 25 08:13:26 2025 +0200 ARM: dts: ls1021a: Fix gic node unit address Although the GIC base address stated in RM is 0x1400000, the first address being used is 0x1401000. This is similar to imx6ul.dtsi where the GIC base address in the RM is 0xa00000 but 0xa01000 being used in DTS. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit c94737568b290e0547bff344046f02df49ed6373 Author: Frieder Schrempf Date: Mon Jul 21 12:05:46 2025 +0200 arm64: dts: imx93-kontron: Fix USB port assignment The assignment of the USB ports is wrong and needs to be swapped. The OTG (USB-C) port is on the first port and the host port with the onboard hub is on the second port. Signed-off-by: Frieder Schrempf Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") Signed-off-by: Shawn Guo commit f3e011388dd08d15e0414e3b6b974f946305e7af Author: Annette Kobou Date: Mon Jul 21 12:05:45 2025 +0200 arm64: dts: imx93-kontron: Fix GPIO for panel regulator The regulator uses the wrong GPIO. Fix this. Signed-off-by: Annette Kobou Signed-off-by: Frieder Schrempf Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") Signed-off-by: Shawn Guo commit 3daaf3d026d86a401121cc37fce03890bd32a10d Author: Frieder Schrempf Date: Mon Jul 21 12:05:44 2025 +0200 arm64: dts: imx93-kontron: Add RTC interrupt signal The RTC INT ouptut is connected to a GPIO. Add the interrupt so it can be used by the RTC driver. Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 384de84ae08b2e71aaf3432f412f97d979f1ac7e Author: Frieder Schrempf Date: Mon Jul 21 12:05:43 2025 +0200 arm64: dts: imx8mp-kontron: Fix USB hub reset The latest hardware revision uses GPIO_B_2 as reset for the USB hub. Fix this and remove the pinctrl as we already have this in the OSM-S devicetree. Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 0153bcd37c61fdfd4953bc3e2953f00a19577e2a Author: Frieder Schrempf Date: Mon Jul 21 12:05:42 2025 +0200 arm64: dts: imx8mp-kontron: Fix GPIO labels for latest BL board Hardware rev 3 changed a few signals. Reflect these changes in the GPIO labels. * digital IOs were moved to GPIO expander * remove labels for unused signals * add labels for TFT, CSI and USB hub IOs Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit f1b27d420b6ff0feed64208e28b033d7b931ceb1 Author: Annette Kobou Date: Mon Jul 21 12:05:41 2025 +0200 arm64: dts: imx8mp-kontron: Fix CAN_ADDR0 and CAN_ADDR1 GPIOs Some signal assignments were modified between hardware revisions 1 and 2: Revision 1: - SPI_A_WP -> CAN_ADDR0 - SPI_A_HOLD -> CAN_ADDR1 Revision 2 and later: - SPI_A_SDI -> CAN_ADDR0 - SPI_A_SDO -> CAN_ADDR1 Fix the labels and add the missing pinctrls. Signed-off-by: Annette Kobou Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 5971fb6bacafd0b8d9086d084472b8d737dfb903 Author: Frieder Schrempf Date: Mon Jul 21 12:05:40 2025 +0200 arm64: dts: imx8mm-kontron: Name USB regulators according to OSM scheme Use the names from the OSM specification. Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit b00b83913a50217331e26334c4f9eb50e6a746e9 Author: Frieder Schrempf Date: Mon Jul 21 12:05:39 2025 +0200 arm64: dts: imx8mm-kontron: Sort reg nodes alphabetically Sort the regulator nodes alphabetically. Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit ebd53ca845cae4c6b7960e20b0a5730bf34c2857 Author: Oualid Derouiche Date: Mon Jul 21 12:05:38 2025 +0200 arm64: dts: imx8mm-kontron: Add Sitronix touch controller in DL devicetree Some new panels have the Sitronix touch instead of Goodix. Support them by adding a node for the new controller. The bootloader needs to detect the correct controller and enable/disable the nodes accordingly. To make this easier add labels for both nodes. Signed-off-by: Oualid Derouiche Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 371a63c1920112524cc88b585113ffc664a19391 Author: Eberhard Stoll Date: Mon Jul 21 12:05:37 2025 +0200 arm64: dts: imx8mm-kontron: Use GPIO for RS485 transceiver control For this IP the correct control of the CTS signal for transceiver direction switching is difficult and - maybe also buggy - in the driver. Especially the bootup requires special handling for most hardware implementations. Therefore we simply use a GPIO now, which is fully under software control and which is not problematic on bootup. Signed-off-by: Eberhard Stoll Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 4fc4ff0240e6ecbdb33c2a716091ae81e88e3e5d Author: Frieder Schrempf Date: Mon Jul 21 12:05:36 2025 +0200 arm64: dts: imx8mm-kontron: Remove unused regulator This regulator is not used anywhere and is not available in hardware. Remove it. Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit cd565458c66653dade942d60f17d60ed7ac30004 Author: Annette Kobou Date: Mon Jul 21 12:05:35 2025 +0200 arm64: dts: imx8mm-kontron: Add overlay for LTE extension board This is an addon for the BL i.MX8MM that features an LTE modem, a TPM module, some LEDs and a pushbutton. Signed-off-by: Annette Kobou Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 1a9480e4fe7b18109793cfd7e9cf49e596661351 Author: Shengjiu Wang Date: Fri Aug 15 18:23:17 2025 +0800 arm64: dts: imx8mn-evk: support more sample rates for wm8524 card The wm8524 codec is connected to the SAI interface. There are two audio plls on i.MX8MN, one pll can be the clock source of 44kHz series rates, another pll can be clock source of 48kHz series rates. Previously it only supported 48kHz series rates, with this change the supported rates will include 44kHz series rates, from 8kHz to 192kHz. Signed-off-by: Shengjiu Wang Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit c1477b3efb6143815f20cf4e5c27c3e936e73640 Author: Shengjiu Wang Date: Fri Aug 15 18:23:16 2025 +0800 arm64: dts: imx8mq-evk: support more sample rates for wm8524 card The wm8524 codec is connected to the SAI interface. There are two audio plls on i.MX8MQ, one pll can be the clock source of 44kHz series rates, another pll can be clock source of 48kHz series rates. Previously it only supported 48kHz series rates, with this change the supported rates will include 44kHz series rates, from 8kHz to 192kHz. As commit 17cc308b1833 ("ASoC: wm8524: enable constraints when sysclk is configured.") make wm8524 release the constraint when codec's sysclk is not configured, so configure the cpu dai's sysclk to support more rates with the 'clocks' property removed. Add mclk-fs property for the sysclk ratio, which is required by calculating the sysclk, 256 is a common ratio for audio. 'system-clock-direction-out' is a required property after commit 5725bce709db ("ASoC: simple-card-utils: Unify clock direction by clk_direction") to specify the clock direction. Signed-off-by: Shengjiu Wang Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 6aa41c8833c7871d9c94d3f56586a9dca42e94f5 Author: Shengjiu Wang Date: Fri Aug 15 18:23:15 2025 +0800 arm64: dts: imx8mm-evk: support more sample rates for wm8524 card The wm8524 codec is connected to the SAI interface. There are two audio plls on i.MX8MM, one pll can be the clock source of 44kHz series rates, another pll can be clock source of 48kHz series rates. Previously it only supported 48kHz series rates, with this change the supported rates will include 44kHz series rates, from 8kHz to 192kHz. As commit 17cc308b1833 ("ASoC: wm8524: enable constraints when sysclk is configured.") make wm8524 release the constraint when codec's sysclk is not configured, so configure the cpu dai's sysclk to support more rates with the 'clocks' property removed. Add mclk-fs property for the sysclk ratio, which is required by calculating the sysclk, 256 is a common ratio for audio. 'system-clock-direction-out' is a required property after commit 5725bce709db ("ASoC: simple-card-utils: Unify clock direction by clk_direction") to specify the clock direction. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit fb43a9e696e1ecba8781b5ea601db07802f50a9f Author: Frank Li Date: Mon Aug 18 14:38:13 2025 -0400 dt-bindings: input: convert lpc32xx-key.txt to yaml format Convert lpc32xx-key.txt to yaml format. Additional changes: - set maximum of key-row(column) to 4. - add ref to matrix-keymap.yaml. Reviewed-by: Vladimir Zapolskiy Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250818183814.3603308-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit a7bd72158063740212344fad5d99dcef45bc70d6 Author: Hariprasad Kelam Date: Wed Aug 20 12:16:25 2025 +0530 Octeontx2-af: Broadcast XON on all channels The NIX block receives traffic from multiple channels, including: MAC block (RPM) Loopback module (LBK) CPT block RPM | ----------------- LBK --| NIX | ----------------- | CPT Due to a hardware errata, CN10k and earlier Octeon silicon series, the hardware may incorrectly assert XOFF on certain channels during reset. As a workaround, a write operation to the NIX_AF_RX_CHANX_CFG register can be performed to broadcast XON signals on the affected channels Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250820064625.1464361-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 8748368c3d92f7bdef67c90d3f62ab92083b3677 Author: Takashi Sakamoto Date: Thu Aug 21 09:30:17 2025 +0900 firewire: ohci: remove obsolete module-level debug parameter The module-level debug parameter was added in v2.6.26 by a commit ad3c0fe8b8d16 ("firewire: debug interrupt events"). Its functionality has long been superseded by tracepoints. This commit removes the module parameter, bye. Link: https://lore.kernel.org/r/20250821003017.186752-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 6354cc95193696f1698e01ef6884f0fd9d613a6a Author: Takashi Sakamoto Date: Thu Aug 21 09:30:16 2025 +0900 firewire: ohci: remove obsolete debug logging for AT/AR results Between v6.11 and v6.12, a set of tracepoints was added to record asynchronous communication events: - firewire:async_phy_inbound - firewire:async_phy_outbound_initiate - firewire:async_phy_outbound_complete - firewire:async_response_inbound - firewire:async_response_outbound_initiate - firewire:async_response_outbound_complete - firewire:async_request_inbound - firewire:async_request_outbound_initiate - firewire:async_request_outbound_complete These tracepoints cover the functionality of the existing debug logging. This commit removes the logging. Link: https://lore.kernel.org/r/20250821003017.186752-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit c579f1fe08cc34c7f0af8df44d2badfee53eb7e7 Author: Takashi Sakamoto Date: Thu Aug 21 09:30:15 2025 +0900 firewire: ohci: remove obsolete debug logging for selfID sequence A commit 677ceae19073 ("firewire: core: add tracepoints event for self_id_sequence") added the "firewire:self_id_sequence" event in v6.11. A commit 526e21a2aa6f ("firewire: ohci: add tracepoints event for data of Self-ID DMA") added the "firewire_ohci:self_id_complete" event in v6.12. These tracepoints replace the equivalent debug logging. This commit removes the logging. Link: https://lore.kernel.org/r/20250821003017.186752-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 82b523f369c9f279c98d04475283283e01030405 Author: Takashi Sakamoto Date: Thu Aug 21 09:30:14 2025 +0900 firewire: ohci: remove obsolete debug logging for IRQ events A commit 0d8914165dd1 ("firewire: ohci: add tracepoints event for hardIRQ event") added "firewire_ohci:irqs" event in v6.11, which can provide equivalent information to the existing debug logging. This commit removes the logging. Link: https://lore.kernel.org/r/20250821003017.186752-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 331c24e6ce814af2af74bac648d1ac1708873e9c Author: Alexandre Courbot Date: Fri Aug 1 22:24:10 2025 +0900 rust: transmute: add `as_bytes_mut` method to `AsBytes` trait Types that implement both `AsBytes` and `FromBytes` can be safely modified as a slice of bytes. Add a `as_bytes_mut` method for that purpose. [acourbot@nvidia.com: use fully qualified `core::mem::size_of_val` to build with Rust 1.78.] Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Reviewed-by: Gary Guo Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250801-as_bytes-v5-2-975f87d5dc85@nvidia.com Signed-off-by: Alexandre Courbot commit 1db476d294c031c38d3e5cbc4d41faf6dfd77ffb Author: Alexandre Courbot Date: Fri Aug 1 22:24:09 2025 +0900 rust: transmute: add `as_bytes` method for `AsBytes` trait Every type that implements `AsBytes` should be able to provide its byte representation. Introduce the `as_bytes` method that returns the implementer as a stream of bytes, and provide a default implementation that should be suitable for any type that satisfies `AsBytes`'s safety requirements. [acourbot@nvidia.com: use fully qualified `core::mem::size_of_val` to build with Rust 1.78.] Reviewed-by: Danilo Krummrich Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250801-as_bytes-v5-1-975f87d5dc85@nvidia.com Signed-off-by: Alexandre Courbot commit 99e7f8e83a9c5a56ca20c4948b6126248c82c67d Author: Alexandre Courbot Date: Thu Aug 21 13:49:32 2025 +0900 gpu: nova-core: falcon: align DMA transfers to 256 bytes Falcon DMA transfers are done in 256 bytes increments, and the method responsible for initiating the transfer checked that the required length was indeed a multiple of 256. While correct, this also requires callers to specifically account for this limitation of DMA transfers, and we had for instance the fwsec code performing a seemingly arbitrary (and potentially overflowing) upwards alignment of the DMEM load size to match this requirement. Let's move that alignment into the loading code itself instead: since it is working in terms of number of transfers, we can turn this upwards alignment into a non-overflowing operation, and check that the requested transfer remains into the limits of the DMA object. This also allows us to remove a DMA-specific constant in the fwsec code. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250821-falcondma_256b-v2-1-83e8647a24b5@nvidia.com Signed-off-by: Danilo Krummrich commit 62d7f40503bc6ac645784e35d4b1a48381237fe3 Author: Mina Almasry Date: Mon Aug 18 21:05:07 2025 +0000 gve: support unreadable netmem Declare PP_FLAG_ALLOW_UNREADABLE_NETMEM to turn on unreadable netmem support in GVE. We also drop any net_iov packets where header split is not enabled. We're unable to process packets where the header landed in unreadable netmem. Use page_pool_dma_sync_netmem_for_cpu in lieu of dma_sync_single_range_for_cpu to correctly handle unreadable netmem that should not be dma-sync'd. Disable rx_copybreak optimization if payload is unreadable netmem as that needs access to the payload. Signed-off-by: Mina Almasry Signed-off-by: Ziwei Xiao Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250818210507.3781705-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit c3439666d1bd788b47fcba5edd42fed034caaaf2 Merge: dac72136aa6b56 456010c8b99e65 Author: Jakub Kicinski Date: Thu Aug 21 17:23:26 2025 -0700 Merge tag 'nf-next-25-08-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next First patch gets rid of refcounting for dying list dumping, use a cookie value instead of keeping the object around. Remaining patches extend nftables pipapo (concatenated ranges) set type. Make the AVX2 optimized version available from the control plane as well, then use it during insert. This gives a nice speedup for large sets. All from myself. On PREEMPT_RT, we can't rely on local_bh_disable to protect the access to the percpu scratch maps. Use nested-BH locking for this, From Sebastian Siewior. * tag 'nf-next-25-08-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_set_pipapo: Use nested-BH locking for nft_pipapo_scratch netfilter: nft_set_pipapo: Store real pointer, adjust later. netfilter: nft_set_pipapo: use avx2 algorithm for insertions too netfilter: nft_set_pipapo_avx2: split lookup function in two parts netfilter: nft_set_pipapo_avx2: Drop the comment regarding protection netfilter: ctnetlink: remove refcounting in dying list dumping ==================== Link: https://patch.msgid.link/20250820144738.24250-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit dac72136aa6b565b8c088d55ad986b530154b4f8 Author: Russell King (Oracle) Date: Wed Aug 20 15:30:40 2025 +0100 net: stmmac: fix stmmac_simple_pm_ops build errors The kernel test robot reports that various drivers have an undefined reference to stmmac_simple_pm_ops. This is caused by EXPORT_SYMBOL_GPL_SIMPLE_DEV_PM_OPS() defining the struct as static and omitting the export when CONFIG_PM=n, unlike DEFINE_SIMPLE_PM_OPS() which still defines the struct non-static. Switch to using DEFINE_SIMPLE_PM_OPS() + EXPORT_SYMBOL_GPL(), which means we always define stmmac_simple_pm_ops, and it will always be visible for dwmac-* to reference whether modular or built-in. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508132051.a7hJXkrd-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202508132158.dEwQdick-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202508140029.V6tDuUxc-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202508161406.RwQuZBkA-lkp@intel.com/ Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uojpo-00BMoL-4W@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a3b6b329e6a0d25d788a6345ea9d29bb7292ae36 Merge: 4dba4a936ffb9f 5e91879a7a4e9a Author: Jakub Kicinski Date: Thu Aug 21 15:51:46 2025 -0700 Merge branch 'net-remove-the-use-of-dev_err_probe' Xichao Zhao says: ==================== net: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. ==================== Link: https://patch.msgid.link/20250820085749.397586-1-zhao.xichao@vivo.com Signed-off-by: Jakub Kicinski commit 5e91879a7a4e9a0e6d914cb03549944848ed428d Author: Xichao Zhao Date: Wed Aug 20 16:57:49 2025 +0800 net: dsa: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250820085749.397586-3-zhao.xichao@vivo.com Signed-off-by: Jakub Kicinski commit ed1e7e22571c29ccb4069c8eb92bf1ad1fbcc95c Author: Xichao Zhao Date: Wed Aug 20 16:57:48 2025 +0800 net: hibmcge: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250820085749.397586-2-zhao.xichao@vivo.com Signed-off-by: Jakub Kicinski commit 4dba4a936ffb9fdfbacd6f82259f0daf1c83779b Merge: a9af709fda7eda 7e1371023accc4 Author: Jakub Kicinski Date: Thu Aug 21 15:37:15 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-08-21 We've added 9 non-merge commits during the last 3 day(s) which contain a total of 13 files changed, 1027 insertions(+), 27 deletions(-). The main changes are: 1) Added bpf dynptr support for accessing the metadata of a skb, from Jakub Sitnicki. The patches are merged from a stable branch bpf-next/skb-meta-dynptr. The same patches have also been merged into bpf-next/master. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: Cover metadata access from a modified skb clone selftests/bpf: Cover read/write to skb metadata at an offset selftests/bpf: Cover write access to skb metadata via dynptr selftests/bpf: Cover read access to skb metadata via dynptr selftests/bpf: Parametrize test_xdp_context_tuntap selftests/bpf: Pass just bpf_map to xdp_context_test helper selftests/bpf: Cover verifier checks for skb_meta dynptr type bpf: Enable read/write access to skb metadata through a dynptr bpf: Add dynptr type for skb metadata ==================== Link: https://patch.msgid.link/20250821191827.2099022-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit ee9a6691935490dc39605882b41b9452844d5e4e Merge: f51fe3b7e48ca8 c6e23912855d48 Author: Jonathan Corbet Date: Thu Aug 21 14:09:21 2025 -0600 Merge branch 'mauro-pdf' into docs-mw Here it is the second version of the PDF series. I opted to split one of the patches in 3, to have a clearer changelog and description. Also, archlinux LXC image download started working again, so I added an extra patch addressing texlive packae dependencies. This series is taking me a way more time than antecipated. This series as 3 goals: 1. Fix a pre-Sphinx 1.7 PDF variable that got renamed, but our Makefile still uses the old one that is not supported since Sphinx 1.7; 2. Fix broken or incomplete texlive dependencies on several distros; 4. "modernize" conf.py to solve font conflicts related to UTF-8 and non-UTF fonts from [T1]{fontenc} LaTeX package. Using fontenc with xelatex is problematic, as documented at https://www.sphinx-doc.org/en/master/latex.html Please notice that: - It doesn't pretend to fix all PDF issues. It focus only at the above; - there are still distros where PDF builds fail either partially or as a hole. On my checks, those are due to problematic texlive packages shipped on such distros; - it doesn't touch/address/alter anyhing related to kfigure.py. as such, it doesn't touch/change/improve/drop anything with regards ImageMagick and/or Inkscape. commit c6e23912855d4848883080200e09551b6dcbc7df Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:50 2025 +0200 scripts/sphinx-pre-install: fix Archlinux PDF dependencies There are some missing packages causing PDF build to fail on Archlinux and add latexmk (from texlive-binextra package). Yet, at least today, PDF builds are failing on a very late stage, when trying to run xdvipdfmx: $ xdvipdfmx -E -o "peci.pdf" "peci.xdv" xdvipdfmx:fatal: Unrecognized paper format: # Simply write the paper name. See man 1 paper and "paper --no-size --all" for possible values Despite its message, even using a very simple document like: \def\sphinxdocclass{report} \documentclass[a4paper,11pt,english]{sphinxmanual} \begin{document} Test \end{document} or even: \def\sphinxdocclass{report} \documentclass{sphinxmanual} \begin{document} Test \end{document} Is causing xdvipdfmx to complain about geometry. As Archlinux is a rolling release distro, maybe I got it on a bad day. So, let's fix it in the hope that soon enough someone would fix the issues there. Such broken scenario happens with those packages installed: texlive-basic 2025.2-1 texlive-bin 2025.2-1 texlive-binextra 2025.2-1 texlive-fontsrecommended 2025.2-1 texlive-langchinese 2025.2-1 texlive-langcjk 2025.2-1 texlive-latex 2025.2-1 texlive-latexextra 2025.2-1 texlive-latexrecommended 2025.2-1 texlive-pictures 2025.2-1 texlive-xetex 2025.2-1 python-docutils 1:0.21.2-3 python-sphinx 8.2.3-1 python-sphinx-alabaster-theme 1.0.0-4 python-sphinxcontrib-applehelp 2.0.0-3 python-sphinxcontrib-devhelp 2.0.0-4 python-sphinxcontrib-htmlhelp 2.1.0-3 python-sphinxcontrib-jsmath 1.0.1-19 python-sphinxcontrib-qthelp 2.0.0-3 python-sphinxcontrib-serializinghtml 2.0.0-3 Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/574d902f7691861e18339217f42409850ee58791.1755763127.git.mchehab+huawei@kernel.org commit 4509d36ceea288a78bb256416d9ca38d3298c7cb Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:49 2025 +0200 scripts: sphinx-pre-install: fix PDF dependencies for gentoo Package fonts are wrong. Fix it. With that, most PDF files now builds. PDF docs: --------- PASSED: dev-tools: pdf/dev-tools.pdf PASSED: tools: pdf/tools.pdf PASSED: filesystems: pdf/filesystems.pdf PASSED: w1: pdf/w1.pdf PASSED: maintainer: pdf/maintainer.pdf PASSED: process: pdf/process.pdf PASSED: isdn: pdf/isdn.pdf PASSED: fault-injection: pdf/fault-injection.pdf PASSED: iio: pdf/iio.pdf PASSED: scheduler: pdf/scheduler.pdf PASSED: staging: pdf/staging.pdf PASSED: fpga: pdf/fpga.pdf PASSED: power: pdf/power.pdf PASSED: leds: pdf/leds.pdf PASSED: edac: pdf/edac.pdf PASSED: PCI: pdf/PCI.pdf PASSED: firmware-guide: pdf/firmware-guide.pdf PASSED: cpu-freq: pdf/cpu-freq.pdf PASSED: mhi: pdf/mhi.pdf PASSED: wmi: pdf/wmi.pdf PASSED: timers: pdf/timers.pdf PASSED: accel: pdf/accel.pdf PASSED: hid: pdf/hid.pdf FAILED: userspace-api: Build failed (FAILED) PASSED: spi: pdf/spi.pdf PASSED: networking: pdf/networking.pdf PASSED: virt: pdf/virt.pdf PASSED: nvme: pdf/nvme.pdf FAILED: translations: Build failed (FAILED) PASSED: input: pdf/input.pdf PASSED: tee: pdf/tee.pdf PASSED: doc-guide: pdf/doc-guide.pdf PASSED: cdrom: pdf/cdrom.pdf FAILED: gpu: Build failed (FAILED) FAILED: i2c: Build failed (FAILED) FAILED: RCU: Build failed (FAILED) PASSED: watchdog: pdf/watchdog.pdf PASSED: usb: pdf/usb.pdf PASSED: rust: pdf/rust.pdf PASSED: crypto: pdf/crypto.pdf PASSED: kbuild: pdf/kbuild.pdf PASSED: livepatch: pdf/livepatch.pdf PASSED: mm: pdf/mm.pdf PASSED: locking: pdf/locking.pdf PASSED: infiniband: pdf/infiniband.pdf PASSED: driver-api: pdf/driver-api.pdf PASSED: bpf: pdf/bpf.pdf PASSED: devicetree: pdf/devicetree.pdf PASSED: block: pdf/block.pdf PASSED: target: pdf/target.pdf FAILED: arch: Build failed (FAILED) PASSED: pcmcia: pdf/pcmcia.pdf PASSED: scsi: pdf/scsi.pdf PASSED: netlabel: pdf/netlabel.pdf PASSED: sound: pdf/sound.pdf PASSED: security: pdf/security.pdf PASSED: accounting: pdf/accounting.pdf PASSED: admin-guide: pdf/admin-guide.pdf FAILED: core-api: Build failed (FAILED) PASSED: fb: pdf/fb.pdf PASSED: peci: pdf/peci.pdf PASSED: trace: pdf/trace.pdf PASSED: misc-devices: pdf/misc-devices.pdf PASSED: kernel-hacking: pdf/kernel-hacking.pdf PASSED: hwmon: pdf/hwmon.pdf Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/1ccbac9fd1f4e598dda82e775b64768ec3696248.1755763127.git.mchehab+huawei@kernel.org commit c71c5d6dcb34423c0f15c146240b25a0e78f65aa Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:48 2025 +0200 scripts: sphinx-pre-install: fix pdf dependencies for Mageia 9 On Mageia 9, two packages are missing. Add them. With that, all PDF packages now build: Mageia 9: --------- PASSED: OS detection: Mageia 9 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx Sphinx 8.1.3 PASSED: Sphinx package: Sphinx Sphinx 6.1.3 PASSED: Clean documentation: Build time: 0:00, return code: 0 PASSED: Build HTML documentation: Build time: 5:17, return code: 0 PASSED: Build PDF documentation: Build time: 14:28, return code: 0 PDF docs: --------- PASSED: dev-tools: pdf/dev-tools.pdf PASSED: tools: pdf/tools.pdf PASSED: filesystems: pdf/filesystems.pdf PASSED: w1: pdf/w1.pdf PASSED: maintainer: pdf/maintainer.pdf PASSED: process: pdf/process.pdf PASSED: isdn: pdf/isdn.pdf PASSED: fault-injection: pdf/fault-injection.pdf PASSED: iio: pdf/iio.pdf PASSED: scheduler: pdf/scheduler.pdf PASSED: staging: pdf/staging.pdf PASSED: fpga: pdf/fpga.pdf PASSED: power: pdf/power.pdf PASSED: leds: pdf/leds.pdf PASSED: edac: pdf/edac.pdf PASSED: PCI: pdf/PCI.pdf PASSED: firmware-guide: pdf/firmware-guide.pdf PASSED: cpu-freq: pdf/cpu-freq.pdf PASSED: mhi: pdf/mhi.pdf PASSED: wmi: pdf/wmi.pdf PASSED: timers: pdf/timers.pdf PASSED: accel: pdf/accel.pdf PASSED: hid: pdf/hid.pdf PASSED: userspace-api: pdf/userspace-api.pdf PASSED: spi: pdf/spi.pdf PASSED: networking: pdf/networking.pdf PASSED: virt: pdf/virt.pdf PASSED: nvme: pdf/nvme.pdf PASSED: translations: pdf/translations.pdf PASSED: input: pdf/input.pdf PASSED: tee: pdf/tee.pdf PASSED: doc-guide: pdf/doc-guide.pdf PASSED: cdrom: pdf/cdrom.pdf PASSED: gpu: pdf/gpu.pdf PASSED: i2c: pdf/i2c.pdf PASSED: RCU: pdf/RCU.pdf PASSED: watchdog: pdf/watchdog.pdf PASSED: usb: pdf/usb.pdf PASSED: rust: pdf/rust.pdf PASSED: crypto: pdf/crypto.pdf PASSED: kbuild: pdf/kbuild.pdf PASSED: livepatch: pdf/livepatch.pdf PASSED: mm: pdf/mm.pdf PASSED: locking: pdf/locking.pdf PASSED: infiniband: pdf/infiniband.pdf PASSED: driver-api: pdf/driver-api.pdf PASSED: bpf: pdf/bpf.pdf PASSED: devicetree: pdf/devicetree.pdf PASSED: block: pdf/block.pdf PASSED: target: pdf/target.pdf PASSED: arch: pdf/arch.pdf PASSED: pcmcia: pdf/pcmcia.pdf PASSED: scsi: pdf/scsi.pdf PASSED: netlabel: pdf/netlabel.pdf PASSED: sound: pdf/sound.pdf PASSED: security: pdf/security.pdf PASSED: accounting: pdf/accounting.pdf PASSED: admin-guide: pdf/admin-guide.pdf PASSED: core-api: pdf/core-api.pdf PASSED: fb: pdf/fb.pdf PASSED: peci: pdf/peci.pdf PASSED: trace: pdf/trace.pdf PASSED: misc-devices: pdf/misc-devices.pdf PASSED: kernel-hacking: pdf/kernel-hacking.pdf PASSED: hwmon: pdf/hwmon.pdf Summary ======= PASSED - Mageia 9 (7 tests) Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/bd6e03c79b890ad0168493cdb4cdaf610bbc8c45.1755763127.git.mchehab+huawei@kernel.org commit b51f8c12d16bcf29496ebaf1d7cf3587ca28ba0a Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:47 2025 +0200 scripts: sphinx-pre-install: fix dependencies for OpenMandriva The dependeny list for OpenMandriva is wrong. Update it. Yet, on my tests with OpenMandriva LX 4.3, the texlive packages are broken: xelatex can't build anything there, as it lacks xelatex.sfm. Yet, this could be a problem at the way I created the container. Just in case, add a note about that. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/669e759ba366328e5c8d5b14a591ba45a1f58176.1755763127.git.mchehab+huawei@kernel.org commit b2d5d61c1371dc6e0ddda69a0a2c921e3ceb928e Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:46 2025 +0200 scripts: sphinx-pre-install: fix PDF dependencies for openSuse The dependencies are outdated: both versions need texlive-dejavu fonts. Also, for PDF generation, python311-Sphinx-latex is required. With that, all PDF files are now tuilt on both: openSUSE Leap 15.6: ------------------- PASSED: OS detection: openSUSE Leap 15.6 SKIPPED (Sphinx Sphinx 7.2.6): System packages SKIPPED (Sphinx already installed either as venv or as native package): Sphinx on venv SKIPPED (Sphinx already installed either as venv or as native package): Sphinx package PASSED: Clean documentation: Build time: 0:00, return code: 0 PASSED: Build HTML documentation: Build time: 5:29, return code: 0 PASSED: Build PDF documentation: Build time: 13:45, return code: 0 openSUSE Tumbleweed: -------------------- PASSED: OS detection: openSUSE Tumbleweed SKIPPED (Sphinx Sphinx 8.2.3): System packages SKIPPED (Sphinx already installed either as venv or as native package): Sphinx on venv SKIPPED (Sphinx already installed either as venv or as native package): Sphinx package PASSED: Clean documentation: Build time: 0:00, return code: 0 PASSED: Build HTML documentation: Build time: 4:33, return code: 0 PASSED: Build PDF documentation: Build time: 13:18, return code: 0 Summary ======= PASSED - openSUSE Leap 15.6 (7 tests) PASSED - openSUSE Tumbleweed (7 tests) Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/d78457376f9dfd24cb7ac3a32895c654412715f3.1755763127.git.mchehab+huawei@kernel.org commit 9ff5c2f51da284906c2f89e7d594f31be69e7abe Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:45 2025 +0200 scripts: sphinx-pre-install: add missing gentoo pdf dependencies There are two packages that are required to build PDF at gentoo: dev-texlive/texlive-latexextra media-fonts/lm Place latex_dependencies on a list to make it easier to maintain and add the missing ones. With that, most PDF documents now build on Gentoo: Gentoo Base System release 2.17: -------------------------------- PASSED: OS detection: Gentoo Base System release 2.17 SKIPPED (Sphinx Sphinx 8.2.3): System packages SKIPPED (Sphinx already installed either as venv or as native package): Sphinx on venv SKIPPED (Sphinx already installed either as venv or as native package): Sphinx package PASSED: Clean documentation: Build time: 0:00, return code: 0 PASSED: Build HTML documentation: Build time: 5:28, return code: 0 PARTIAL: Build PDF documentation: Test failed (Build time: 9:19, return code: 2) PDF docs: --------- PASSED: dev-tools: pdf/dev-tools.pdf PASSED: tools: pdf/tools.pdf PASSED: filesystems: pdf/filesystems.pdf PASSED: w1: pdf/w1.pdf PASSED: maintainer: pdf/maintainer.pdf PASSED: process: pdf/process.pdf PASSED: isdn: pdf/isdn.pdf PASSED: fault-injection: pdf/fault-injection.pdf PASSED: iio: pdf/iio.pdf PASSED: scheduler: pdf/scheduler.pdf PASSED: staging: pdf/staging.pdf PASSED: fpga: pdf/fpga.pdf PASSED: power: pdf/power.pdf PASSED: leds: pdf/leds.pdf PASSED: edac: pdf/edac.pdf PASSED: PCI: pdf/PCI.pdf PASSED: firmware-guide: pdf/firmware-guide.pdf PASSED: cpu-freq: pdf/cpu-freq.pdf PASSED: mhi: pdf/mhi.pdf PASSED: wmi: pdf/wmi.pdf PASSED: timers: pdf/timers.pdf PASSED: accel: pdf/accel.pdf PASSED: hid: pdf/hid.pdf FAILED: userspace-api: Build failed (FAILED) PASSED: spi: pdf/spi.pdf PASSED: networking: pdf/networking.pdf PASSED: virt: pdf/virt.pdf PASSED: nvme: pdf/nvme.pdf FAILED: translations: Build failed (FAILED) PASSED: input: pdf/input.pdf PASSED: tee: pdf/tee.pdf PASSED: doc-guide: pdf/doc-guide.pdf PASSED: cdrom: pdf/cdrom.pdf FAILED: gpu: Build failed (FAILED) FAILED: i2c: Build failed (FAILED) FAILED: RCU: Build failed (FAILED) PASSED: watchdog: pdf/watchdog.pdf PASSED: usb: pdf/usb.pdf PASSED: rust: pdf/rust.pdf PASSED: crypto: pdf/crypto.pdf PASSED: kbuild: pdf/kbuild.pdf PASSED: livepatch: pdf/livepatch.pdf PASSED: mm: pdf/mm.pdf PASSED: locking: pdf/locking.pdf PASSED: infiniband: pdf/infiniband.pdf PASSED: driver-api: pdf/driver-api.pdf PASSED: bpf: pdf/bpf.pdf PASSED: devicetree: pdf/devicetree.pdf PASSED: block: pdf/block.pdf PASSED: target: pdf/target.pdf FAILED: arch: Build failed (FAILED) PASSED: pcmcia: pdf/pcmcia.pdf PASSED: scsi: pdf/scsi.pdf PASSED: netlabel: pdf/netlabel.pdf PASSED: sound: pdf/sound.pdf PASSED: security: pdf/security.pdf PASSED: accounting: pdf/accounting.pdf PASSED: admin-guide: pdf/admin-guide.pdf FAILED: core-api: Build failed (FAILED) PASSED: fb: pdf/fb.pdf PASSED: peci: pdf/peci.pdf PASSED: trace: pdf/trace.pdf PASSED: misc-devices: pdf/misc-devices.pdf PASSED: kernel-hacking: pdf/kernel-hacking.pdf PASSED: hwmon: pdf/hwmon.pdf Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0ac8d6b7484aaf930917c8edde53742d425e7e8f.1755763127.git.mchehab+huawei@kernel.org commit 4e9a563f0774fdd6f1bd68235314b4b8298fc0a9 Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:44 2025 +0200 scripts: sphinx-pre-install: fix PDF build issues on Ubuntu PDF output with current Debian-based distros require other packages for it to work. The main one is pzdr.tfm. Without that, \sphinxhyphen{} won't work, affecting multiple docs. For CJK, tex-gyre is required. Add the missing packages to the list. After the change, all PDF files build on latest Ubuntu: Ubuntu 25.04: ------------- PASSED: OS detection: Ubuntu 25.04 SKIPPED (Sphinx Sphinx 8.1.3): System packages SKIPPED (Sphinx already installed either as venv or as native package): Sphinx on venv SKIPPED (Sphinx already installed either as venv or as native package): Sphinx package PASSED: Clean documentation: Build time: 0:00, return code: 0 PASSED: Build HTML documentation: Build time: 3:28, return code: 0 PASSED: Build PDF documentation: Build time: 11:08, return code: 0 PDF docs: --------- PASSED: dev-tools: pdf/dev-tools.pdf PASSED: tools: pdf/tools.pdf PASSED: filesystems: pdf/filesystems.pdf PASSED: w1: pdf/w1.pdf PASSED: maintainer: pdf/maintainer.pdf PASSED: process: pdf/process.pdf PASSED: isdn: pdf/isdn.pdf PASSED: fault-injection: pdf/fault-injection.pdf PASSED: iio: pdf/iio.pdf PASSED: scheduler: pdf/scheduler.pdf PASSED: staging: pdf/staging.pdf PASSED: fpga: pdf/fpga.pdf PASSED: power: pdf/power.pdf PASSED: leds: pdf/leds.pdf PASSED: edac: pdf/edac.pdf PASSED: PCI: pdf/PCI.pdf PASSED: firmware-guide: pdf/firmware-guide.pdf PASSED: cpu-freq: pdf/cpu-freq.pdf PASSED: mhi: pdf/mhi.pdf PASSED: wmi: pdf/wmi.pdf PASSED: timers: pdf/timers.pdf PASSED: accel: pdf/accel.pdf PASSED: hid: pdf/hid.pdf PASSED: userspace-api: pdf/userspace-api.pdf PASSED: spi: pdf/spi.pdf PASSED: networking: pdf/networking.pdf PASSED: virt: pdf/virt.pdf PASSED: nvme: pdf/nvme.pdf PASSED: translations: pdf/translations.pdf PASSED: input: pdf/input.pdf PASSED: tee: pdf/tee.pdf PASSED: doc-guide: pdf/doc-guide.pdf PASSED: cdrom: pdf/cdrom.pdf PASSED: gpu: pdf/gpu.pdf PASSED: i2c: pdf/i2c.pdf PASSED: RCU: pdf/RCU.pdf PASSED: watchdog: pdf/watchdog.pdf PASSED: usb: pdf/usb.pdf PASSED: rust: pdf/rust.pdf PASSED: crypto: pdf/crypto.pdf PASSED: kbuild: pdf/kbuild.pdf PASSED: livepatch: pdf/livepatch.pdf PASSED: mm: pdf/mm.pdf PASSED: locking: pdf/locking.pdf PASSED: infiniband: pdf/infiniband.pdf PASSED: driver-api: pdf/driver-api.pdf PASSED: bpf: pdf/bpf.pdf PASSED: devicetree: pdf/devicetree.pdf PASSED: block: pdf/block.pdf PASSED: target: pdf/target.pdf PASSED: arch: pdf/arch.pdf PASSED: pcmcia: pdf/pcmcia.pdf PASSED: scsi: pdf/scsi.pdf PASSED: netlabel: pdf/netlabel.pdf PASSED: sound: pdf/sound.pdf PASSED: security: pdf/security.pdf PASSED: accounting: pdf/accounting.pdf PASSED: admin-guide: pdf/admin-guide.pdf PASSED: core-api: pdf/core-api.pdf PASSED: fb: pdf/fb.pdf PASSED: peci: pdf/peci.pdf PASSED: trace: pdf/trace.pdf PASSED: misc-devices: pdf/misc-devices.pdf PASSED: kernel-hacking: pdf/kernel-hacking.pdf PASSED: hwmon: pdf/hwmon.pdf Reported-by: Akira Yokosawa Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b5e2e0df68b377b148fdbdd721f6c1cbefe6f861.1755763127.git.mchehab+huawei@kernel.org commit d242e2569f10e03dea1d13d54b45d8bb5bbeb614 Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:43 2025 +0200 docs: conf.py: extra cleanups and fixes Makes it more adehent with modern Sphinx LaTeX build setup as defined at: https://www.sphinx-doc.org/en/master/latex.html There, it suggests: 1) to add: 'printindex' “printindex” call, the last thing in the file. Override if you want to generate the index differently, append some content after the index, or change the font. As LaTeX uses two-column mode for the index it is often advisable to set this key to r'\footnotesize\raggedright\printindex'. This indeed solved a corner case on a distro where the index was not properly generated. 2) to add at the main example: \PassOptionsToPackage{svgnames}{xcolor} 3) I got a corner case on one of the distros was using xindy to produce indexes. This ended causing the build logic to incorretly try to use T1 fontenc, which is not UTF-8 compatible. This patch adds: \PassOptionsToPackage{xindy}{language=english,codepage=utf8,noautomatic} to cover such case. It should be noticed that, as the config doesn't have \usepackage{xindy}, this will be used only if latexmk ends using xindy. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/08d16c2ad817910eb5606842f776d3f77d83282f.1755763127.git.mchehab+huawei@kernel.org commit d3265de62fb7e9f30c6ad1195d0bf12edcf3d20f Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:42 2025 +0200 docs: conf.py: fix some troubles for LaTeX output While PDF docs work fine on RPM-based distros, it causes conflicts on Debian & friends. There are multiple root causes here: - the latex_elements still resambles the one from Sphinx 1.x times, where font configurations were stored under "preamble". It doesn't follow the current recommended way from Sphinx documentation: https://www.sphinx-doc.org/en/master/latex.html - instead of setting the main font, from where other fonts are derivated, it sets romanfont; - "fontenc" is not set. This allows the *.tex output file to contain an UTF-8 incompatible fontset: \usepackage[T1]{fontenc} Address such issues to help preventing incompatible usage of both T1 font and UTF-8 ones that comes from DejaVu font family. On some distros, this even generate a LaTeX font warning about corrupted NFSS tables like this (I got it when running it in interactive mode): Package: fontenc 2021/04/29 v2.0v Standard LaTeX package LaTeX Font Info: Trying to load font information for T1+lmr on input line 11 6. LaTeX Font Info: No file T1lmr.fd. on input line 116. LaTeX Font Warning: Font shape `T1/lmr/m/n' undefined (Font) using `T1/lmr/m/n' instead on input line 116. ! Corrupted NFSS tables. wrong@fontshape ...message {Corrupted NFSS tables} error@fontshape else let f... l.116 ...\familydefault\seriesdefault\shapedefault Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/8104ce56a5ea3509fbb56a8163b779d38a6aaa9c.1755763127.git.mchehab+huawei@kernel.org commit e7880da7ed881c160a60784b6e011ad8b16aeb33 Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:41 2025 +0200 docs: conf.py: use dedent and r-strings for LaTeX macros Instead of adding extra weird indentation at the tex file, use dedent(). While here, also use r-strings, to make easier to make its content identical to the .tex output. While here, also merge "preamble" that was added on two separate parts of the code (in the past, there were some version-specific checks). No functional changes, just cosmetic ones. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0d245fbd872ab3ec21bd8fe78b01340ba77ce365.1755763127.git.mchehab+huawei@kernel.org commit 9fd4e4ce7e937e4a750a5dc49bd285641e977c5e Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:40 2025 +0200 docs: conf.py: rename some vars at latex_documents logic Currently, the logic uses fn and doc vars, but they don't properly describe what such vars do. Make them clearer: - fname: points to the file name to search (index.rst); - doc: contains the name of the LaTeX or PDF doc to be produced. With that, the checks for SPHINXDIRS and for subdirs will be more coherent. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b030d9bc53550905adbe9367b2a3915d7331b4c5.1755763127.git.mchehab+huawei@kernel.org commit 280fa75c2cf51793313400d5e3737d5c3131dd5b Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:39 2025 +0200 docs: conf.py: fix doc name with SPHINXDIRS When SPHINXDIRS is used, the current logic produces a wrong list of files, as it will not pick the SPHINXDIRS directory, picking instead their children. Add a rule to detect it and create the PDF doc with the right name. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/183f630643eacf414cfa8d892f03dd1b1055c21e.1755763127.git.mchehab+huawei@kernel.org commit f62ed7688cfe1a09b61776216380b56221a17c5c Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:38 2025 +0200 docs: conf.py: better handle latex documents The original logic assumed that app.srcdir is identical to the current working dir. This is the case for a normal build, but, when SPHINXDIRS="some dir" is used, this is not the case anymore. Adjust the logic to fill the LaTeX documents considering app.srcdir, in a way that it will work properly on all cases. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/de23b35a770210950c609deaa32b98cb3673a53a.1755763127.git.mchehab+huawei@kernel.org commit 30c33b62eb875e9840e151f8ba2f7d2558d7e3ba Author: Mauro Carvalho Chehab Date: Thu Aug 21 10:16:37 2025 +0200 docs: Makefile: Fix LaTeX paper size settings According with: https://www.sphinx-doc.org/en/master/latex.html The variable that handles paper size changed during version 1.5, as pointed at: https://www.sphinx-doc.org/en/master/changes/1.5.html Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/c50db42ead36010fd42ce1e6a2b9da766c11927b.1755763127.git.mchehab+huawei@kernel.org commit f51fe3b7e48ca81a9cee15c0146e4fb7d3000d3a Author: Sebastian Andrzej Siewior Date: Fri Aug 15 11:38:57 2025 +0200 Documentation: Add real-time to core-api The documents explain the design concepts behind PREEMPT_RT and highlight key differences necessary to achieve it. It also include a list of requirements that must be fulfilled to support PREEMPT_RT on a given architecture. Signed-off-by: Sebastian Andrzej Siewior [jc: tweaked "how they differ" section head] Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250815093858.930751-4-bigeasy@linutronix.de commit 17224c1d2574d29668c4879e1fbf36d6f68cd22b Author: Rafael J. Wysocki Date: Wed Aug 13 12:26:35 2025 +0200 cpuidle: governors: menu: Rearrange main loop in menu_select() Reduce the indentation level in the main loop of menu_select() by rearranging some checks and assignments in it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/2389215.ElGaqSPkdT@rafael.j.wysocki commit 03cf825911c95f39d77d2a60b35fe5b4a33115b1 Author: Xichao Zhao Date: Wed Aug 13 15:54:33 2025 +0800 powercap: idle_inject: use us_to_ktime() where appropriate Convert values in microseconds to ktime using us_to_ktime() instead of multiplying them by NSEC_PER_USEC and using ns_to_ktime() for the conversion. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250813075433.464786-1-zhao.xichao@vivo.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 349a64256534aa2c73787b22f7bc0517a211cdab Author: FUJITA Tomonori Date: Thu Aug 21 09:20:55 2025 +0900 rust: Add read_poll_timeout function Add read_poll_timeout function which polls periodically until a condition is met, an error occurs, or the timeout is reached. The C's read_poll_timeout (include/linux/iopoll.h) is a complicated macro and a simple wrapper for Rust doesn't work. So this implements the same functionality in Rust. The C version uses usleep_range() while the Rust version uses fsleep(), which uses the best sleep method so it works with spans that usleep_range() doesn't work nicely with. The sleep_before_read argument isn't supported since there is no user for now. It's rarely used in the C version. Reviewed-by: Andreas Hindborg Reviewed-by: Fiona Behrens Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Reviewed-by: Daniel Almeida Tested-by: Daniel Almeida Reviewed-by: Alice Ryhl Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250821002055.3654160-3-fujita.tomonori@gmail.com [ Fix a minor typo and add missing backticks. - Danilo ] Signed-off-by: Danilo Krummrich commit df595059d54383c42607b59f1f9ea74dade280fe Author: Dmitry Torokhov Date: Wed Aug 6 11:16:51 2025 -0700 Input: include export.h in modules using EXPORT_SYMBOL*() A number of modules in the input subsystem use EXPORT_SYMBOL() and friends without explicitly including the corresponding header . While the build currently succeeds due to this header being pulled in transitively, this is not guaranteed to be the case in the future. Let's add the explicit include to make the dependencies clear and prevent future build breakage. Signed-off-by: Dmitry Torokhov commit c07329a66cad285faff6c11aaa10eefe1abcfc47 Author: Wolfram Sang Date: Wed Aug 13 18:14:52 2025 +0200 Input: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-7-wsa+renesas@sang-engineering.com Signed-off-by: Dmitry Torokhov commit 2ec25d34169580922fc6e398fb0cb2591d19349c Author: Dmitry Torokhov Date: Tue Jul 1 21:29:15 2025 -0700 Input: move input_bits_to_string() to input-compat.c The input_bits_to_string() function has special handling for compat tasks, formatting the output as a sequence of 32-bit hex values. To better isolate compatibility-related code, move it from drivers/input/input.c to drivers/input/input-compat.c. No functional change intended. Signed-off-by: Dmitry Torokhov commit 6da752f55bc48fe2cf12ed208ab10295d796c2dd Author: David Disseldorp Date: Tue Aug 19 13:05:51 2025 +1000 initramfs_test: add filename padding test case Confirm that cpio filenames with multiple trailing zeros (accounted for in namesize) extract successfully. Signed-off-by: David Disseldorp Acked-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-9-ddiss@suse.de [nathan: Fix duplicate filesize initialization, reported at https://lore.kernel.org/202508200304.wF1u78il-lkp@intel.com/] Signed-off-by: Nathan Chancellor commit f41c808c43883d3d7b46e7742a93127acb81d60b Author: Sebastian Andrzej Siewior Date: Fri Aug 15 11:38:56 2025 +0200 Documentation: locking: Add local_lock_nested_bh() to locktypes local_lock_nested_bh() is used within networking where applicable. Document why it is used and how it behaves. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250815093858.930751-3-bigeasy@linutronix.de commit 9256019241c9afdd7b27d4b97e9568f5721d97e3 Author: Sebastian Andrzej Siewior Date: Fri Aug 15 11:38:55 2025 +0200 Documentation: seqlock: Add a SPDX license identifier Add a SPDX identifier. The majority of the document has been written by Ahmed S. Darwish. Cc: Ahmed S. Darwish Acked-by: Ahmed S. Darwish Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250815093858.930751-2-bigeasy@linutronix.de commit 41ecad8b233bf480a1f39b76462dcb2c2d3cdfed Author: Raphael Pinsonneault-Thibeault Date: Mon Aug 18 14:19:34 2025 -0400 docs: fix trailing whitespace error and remove repeated words in propagate_umount.txt in Documentation/filesystems/propagate_umount.txt: line 289: remove whitespace on blank line line 315: remove duplicate "that" line 364: remove duplicate "in" Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250818181934.55491-2-rpthibeault@gmail.com commit 4b051897df2375414587a245ecb9bb1a4d26b3b8 Merge: c12e371a31d6a8 c17b750b3ad9f4 Author: Dmitry Torokhov Date: Thu Aug 21 11:46:49 2025 -0700 Merge tag 'v6.17-rc2' into HEAD Sync up with mainline to bring in changes to include/linux/sprintf.h commit a9af709fda7edafa17e072bffe610d9e7ed7a5df Merge: e5b71dd3ad0e3b 6439a0e64c355d Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc3). No conflicts or adjacent changes. Signed-off-by: Jakub Kicinski commit 21aeabb68258ce17b91af113a768760b3a491d93 Author: Hengqi Chen Date: Thu Aug 21 03:02:54 2025 +0000 selftests/bpf: Use vmlinux.h for BPF programs Some of the bpf test progs still use linux/libc headers. Let's use vmlinux.h instead like the rest of test progs. This will also ease cross compiling. Signed-off-by: Hengqi Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250821030254.398826-1-hengqi.chen@gmail.com commit f49e1be19542487921e82b29004908966cb99d7c Author: Dapeng Mi Date: Wed Aug 20 10:30:32 2025 +0800 perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() Along with the introduction Perfmon v6, pmu counters could be incontinuous, like fixed counters on CWF, only fixed counters 0-3 and 5-7 are supported, there is no fixed counter 4 on CWF. To accommodate this change, archPerfmonExt CPUID (0x23) leaves are introduced to enumerate the true-view of counters bitmap. Current perf code already supports archPerfmonExt CPUID and uses counters-bitmap to enumerate HW really supported counters, but x86_pmu_show_pmu_cap() still only dumps the absolute counter number instead of true-view bitmap, it's out-dated and may mislead readers. So dump counters true-view bitmap in x86_pmu_show_pmu_cap() and opportunistically change the dump sequence and words. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20250820023032.17128-8-dapeng1.mi@linux.intel.com commit 2676dbf9f4fb7f6739d1207c0f1deaf63124642a Author: Dapeng Mi Date: Wed Aug 20 10:30:31 2025 +0800 perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK ICL_FIXED_0_ADAPTIVE is missed to be added into INTEL_FIXED_BITS_MASK, add it. With help of this new INTEL_FIXED_BITS_MASK, intel_pmu_enable_fixed() can be optimized. The old fixed counter control bits can be unconditionally cleared with INTEL_FIXED_BITS_MASK and then set new control bits base on new configuration. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Tested-by: Yi Lai Link: https://lore.kernel.org/r/20250820023032.17128-7-dapeng1.mi@linux.intel.com commit 9b3e119784bc3671fde5043001a5c9a607c7d920 Author: Dapeng Mi Date: Wed Aug 20 10:30:30 2025 +0800 perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) Macro GLOBAL_CTRL_EN_PERF_METRICS is defined to 48 instead of BIT_ULL(48), it's inconsistent with other similar macros. This leads to this macro is quite easily used wrongly since users thinks it's a bit-mask just like other similar macros. Thus change GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) and eliminate this potential misuse. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Tested-by: Yi Lai Link: https://lore.kernel.org/r/20250820023032.17128-6-dapeng1.mi@linux.intel.com commit 0c5caea762de31a85cbcce65d978cec83449f699 Author: Dapeng Mi Date: Wed Aug 20 10:30:29 2025 +0800 perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag IA32_PERF_CAPABILITIES.PEBS_TIMING_INFO[bit 17] is introduced to indicate whether timed PEBS is supported. Timed PEBS adds a new "retired latency" field in basic info group to show the timing info. Please find detailed information about timed PEBS in section 8.4.1 "Timed Processor Event Based Sampling" of "Intel Architecture Instruction Set Extensions and Future Features". This patch adds PERF_CAP_PEBS_TIMING_INFO flag and KVM module leverages this flag to expose timed PEBS feature to guest. Moreover, opportunistically refine the indents and make the macros share consistent indents. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Tested-by: Yi Lai Link: https://lore.kernel.org/r/20250820023032.17128-5-dapeng1.mi@linux.intel.com commit 43796f30507802d93ead2dc44fc9637f34671a89 Author: Dapeng Mi Date: Wed Aug 20 10:30:27 2025 +0800 perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, sometimes the below "unchecked MSR access error" is seen when accessing IA32_PMC_x_CFG_B MSRs. [ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30) [ 55.611280] Call Trace: [ 55.611282] [ 55.611284] ? intel_pmu_config_acr+0x87/0x160 [ 55.611289] intel_pmu_enable_acr+0x6d/0x80 [ 55.611291] intel_pmu_enable_event+0xce/0x460 [ 55.611293] x86_pmu_start+0x78/0xb0 [ 55.611297] x86_pmu_enable+0x218/0x3a0 [ 55.611300] ? x86_pmu_enable+0x121/0x3a0 [ 55.611302] perf_pmu_enable+0x40/0x50 [ 55.611307] ctx_resched+0x19d/0x220 [ 55.611309] __perf_install_in_context+0x284/0x2f0 [ 55.611311] ? __pfx_remote_function+0x10/0x10 [ 55.611314] remote_function+0x52/0x70 [ 55.611317] ? __pfx_remote_function+0x10/0x10 [ 55.611319] generic_exec_single+0x84/0x150 [ 55.611323] smp_call_function_single+0xc5/0x1a0 [ 55.611326] ? __pfx_remote_function+0x10/0x10 [ 55.611329] perf_install_in_context+0xd1/0x1e0 [ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10 [ 55.611333] __do_sys_perf_event_open+0xa76/0x1040 [ 55.611336] __x64_sys_perf_event_open+0x26/0x30 [ 55.611337] x64_sys_call+0x1d8e/0x20c0 [ 55.611339] do_syscall_64+0x4f/0x120 [ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e On PTL, GP counter 0 and 1 doesn't support auto counter reload feature, thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR which requires to enable auto counter reload on GP counter 0. The root cause of causing this issue is the check for auto counter reload (ACR) counter mask from user space is incorrect in intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter mask from user space could be set into hw.config1 and then written into CFG_B MSRs and trigger the MSR access warning. e.g., User may create a perf event with ACR counter mask (config2=0xcb), and there is only 1 event created, so "cpuc->n_events" is 1. The correct check condition should be "i + idx >= cpuc->n_events" instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise, the counter mask would traverse twice and an invalid "cpuc->assign[1]" bit (bit 0) is set into hw.config1 and cause MSR accessing error. Besides, also check if the ACR counter mask corresponding events are ACR events. If not, filter out these counter mask. If a event is not a ACR event, it could be scheduled to an HW counter which doesn't support ACR. It's invalid to add their counter index in ACR counter mask. Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as user could set any invalid ACR counter mask and the warning message could mislead users. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 Author: Dapeng Mi Date: Wed Aug 20 10:30:26 2025 +0800 perf/x86/intel: Use early_initcall() to hook bts_init() After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")' is introduced, x86_pmu.bts would initialized in bts_init() which is hooked by arch_initcall(). Whereas init_hw_perf_events() is hooked by early_initcall(). Once the core PMU is initialized, nmi watchdog initialization is called immediately before bts_init() is called. It leads to the BTS buffer is not really initialized since bts_init() is not called and x86_pmu.bts is still false at that time. Worse, BTS buffer would never be initialized then unless all core PMU events are freed and reserve_ds_buffers() is called again. Thus aligning with init_hw_perf_events(), use early_initcall() to hook bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog initialization. Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com commit e173287b5d2119971fc329473a020171836d14c9 Author: Qianfeng Rong Date: Tue Aug 5 10:50:00 2025 +0800 uprobes: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Signed-off-by: Peter Zijlstra (Intel) Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250805025000.346647-1-rongqianfeng@vivo.com commit 9ffc7a635c35ad61349a36e9f52d46df9ba67dc3 Author: Jiri Olsa Date: Sun Jul 20 13:21:31 2025 +0200 selftests/seccomp: validate uprobe syscall passes through seccomp Adding uprobe checks into the current uretprobe tests. All the related tests are now executed with attached uprobe or uretprobe or without any probe. Renaming the test fixture to uprobe, because it seems better. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250720112133.244369-22-jolsa@kernel.org commit 89d1d8434d246c96309a6068dfcf9e36dc61227b Author: Jiri Olsa Date: Sun Jul 20 13:21:30 2025 +0200 seccomp: passthrough uprobe systemcall without filtering Adding uprobe as another exception to the seccomp filter alongside with the uretprobe syscall. Same as the uretprobe the uprobe syscall is installed by kernel as replacement for the breakpoint exception and is limited to x86_64 arch and isn't expected to ever be supported in i386. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250720112133.244369-21-jolsa@kernel.org commit 52718438af2ac8323aeea41b6f59da0962cb73b6 Author: Jiri Olsa Date: Thu Aug 21 16:15:57 2025 +0200 selftests/bpf: Fix uprobe syscall shadow stack test Now that we have uprobe syscall working properly with shadow stack, we can remove testing limitations for shadow stack tests and make sure uprobe gets properly optimized. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821141557.13233-1-jolsa@kernel.org commit 3abf4298c6139cf10a41472d87b2f608666302b0 Author: Jiri Olsa Date: Sun Jul 20 13:21:29 2025 +0200 selftests/bpf: Change test_uretprobe_regs_change for uprobe and uretprobe Changing the test_uretprobe_regs_change test to test both uprobe and uretprobe by adding entry consumer handler to the testmod and making it to change one of the registers. Making sure that changed values both uprobe and uretprobe handlers propagate to the user space. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-20-jolsa@kernel.org commit 275eae6789864904a7319fbb4e993734a0fb4310 Author: Jiri Olsa Date: Sun Jul 20 13:21:28 2025 +0200 selftests/bpf: Add uprobe_regs_equal test Changing uretprobe_regs_trigger to allow the test for both uprobe and uretprobe and renaming it to uprobe_regs_equal. We check that both uprobe and uretprobe probes (bpf programs) see expected registers with few exceptions. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-19-jolsa@kernel.org commit 875e1705ad9962f2642d098d6bfaabfa6f9c7ace Author: Jiri Olsa Date: Sun Jul 20 13:21:27 2025 +0200 selftests/bpf: Add optimized usdt variant for basic usdt test Adding optimized usdt variant for basic usdt test to check that usdt arguments are properly passed in optimized code path. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-18-jolsa@kernel.org commit c11661bd9adf6831a75bb79299de793039dd8b9b Author: Jiri Olsa Date: Sun Jul 20 13:21:26 2025 +0200 selftests/bpf: Add uprobe syscall sigill signal test Make sure that calling uprobe syscall from outside uprobe trampoline results in sigill signal. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-17-jolsa@kernel.org commit c8be59667cf17f281adc9a9387d7a0de60268fcd Author: Jiri Olsa Date: Sun Jul 20 13:21:25 2025 +0200 selftests/bpf: Add hit/attach/detach race optimized uprobe test Adding test that makes sure parallel execution of the uprobe and attach/detach of optimized uprobe on it works properly. By default the test runs for 500ms, which is adjustable by using BPF_SELFTESTS_UPROBE_SYSCALL_RACE_MSEC env variable. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-16-jolsa@kernel.org commit d5c86c3370100620fa9c2e8dc9350c354b30ddb4 Author: Jiri Olsa Date: Sun Jul 20 13:21:24 2025 +0200 selftests/bpf: Add uprobe/usdt syscall tests Adding tests for optimized uprobe/usdt probes. Checking that we get expected trampoline and attached bpf programs get executed properly. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-15-jolsa@kernel.org commit 7932c4cf577187dec42ddfba0aba26434cecab0c Author: Jiri Olsa Date: Sun Jul 20 13:21:23 2025 +0200 selftests/bpf: Rename uprobe_syscall_executed prog to test_uretprobe_multi Renaming uprobe_syscall_executed prog to test_uretprobe_multi to fit properly in the following changes that add more programs. Plus adding pid filter and increasing executed variable. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-14-jolsa@kernel.org commit 4e7005223e6dab882646d96d0e2aa84a5dd07b56 Author: Jiri Olsa Date: Sun Jul 20 13:21:22 2025 +0200 selftests/bpf: Reorg the uprobe_syscall test function Adding __test_uprobe_syscall with non x86_64 stub to execute all the tests, so we don't need to keep adding non x86_64 stub functions for new tests. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-13-jolsa@kernel.org commit 17c3b001576452fda8fd19d664a93a988b309780 Author: Jiri Olsa Date: Sun Jul 20 13:21:21 2025 +0200 selftests/bpf: Import usdt.h from libbpf/usdt project Importing usdt.h from libbpf/usdt project. Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250720112133.244369-12-jolsa@kernel.org commit 354492a0e1bc4a408e26ebe14166bd1064182439 Author: Peter Zijlstra Date: Wed Aug 20 19:49:56 2025 +0200 uprobes/x86: Add SLS mitigation to the trampolines It is trivial; no reason not to. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123657.277506098@infradead.org commit 60ed85b7e46983725954103beaca5ca41816cd58 Author: Peter Zijlstra Date: Thu Aug 21 13:48:48 2025 +0200 uprobes/x86: Make asm style consistent The asm syntax in uretprobe_trampoline and uprobe_trampoline differs in the use of operand size suffixes. Make them consistent and remove all size suffixes. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123657.163417243@infradead.org commit f349ec80865dfeaf8a33feae6b4a500db039c69c Author: Peter Zijlstra Date: Wed Aug 20 14:28:34 2025 +0200 uprobes/x86: Fix uprobe syscall vs shadow stack The uprobe syscall stores and strips the trampoline stack frame from the user context, to make it appear similar to an exception at the original instruction. It then restores the trampoline stack when it can exit using sysexit. Make sure to match the regular stack manipulation with shadow stack operations such that regular and shadow stack don't get out of sync and causes trouble. This enables using the optimization when shadow stack is in use. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123657.055790090@infradead.org commit 7c2bfc183b05103287cc32ad68184f7d4312c06d Author: Peter Zijlstra Date: Wed Aug 20 12:55:14 2025 +0200 uprobes/x86: Accept more NOP forms Instead of only accepting the x86_64 nop5 chosen by the kernel, accept any x86_64 NOP or NOPL instruction that is 5 bytes. Notably, the x86_64 nop5 pattern is valid in 32bit apps and could get compiler generated when build for i686 (which introduced NOPL). Since the trampoline is x86_64 only, make sure to limit to x86_64 code. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123656.935559566@infradead.org commit fd54052b60cf6e73cf918fd8653cd7a5c84b0cc3 Author: Peter Zijlstra Date: Wed Aug 20 12:37:22 2025 +0200 uprobes/x86: Optimize is_optimize() Make is_optimized() return a tri-state and avoid return through argument. This simplifies things a little. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123656.823296198@infradead.org commit 985e820b72e0a89746f51c072ed10caf78890244 Author: Peter Zijlstra Date: Wed Aug 20 12:28:36 2025 +0200 uprobes/x86: Add struct uretprobe_syscall_args Like uprobe_syscall_args; keep things consistent. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250821123656.705837806@infradead.org commit ba2bfc97b4629b10bd8d02b36e04f3932a04cac4 Author: Jiri Olsa Date: Sun Jul 20 13:21:20 2025 +0200 uprobes/x86: Add support to optimize uprobes Putting together all the previously added pieces to support optimized uprobes on top of 5-byte nop instruction. The current uprobe execution goes through following: - installs breakpoint instruction over original instruction - exception handler hit and calls related uprobe consumers - and either simulates original instruction or does out of line single step execution of it - returns to user space The optimized uprobe path does following: - checks the original instruction is 5-byte nop (plus other checks) - adds (or uses existing) user space trampoline with uprobe syscall - overwrites original instruction (5-byte nop) with call to user space trampoline - the user space trampoline executes uprobe syscall that calls related uprobe consumers - trampoline returns back to next instruction This approach won't speed up all uprobes as it's limited to using nop5 as original instruction, but we plan to use nop5 as USDT probe instruction (which currently uses single byte nop) and speed up the USDT probes. The arch_uprobe_optimize triggers the uprobe optimization and is called after first uprobe hit. I originally had it called on uprobe installation but then it clashed with elf loader, because the user space trampoline was added in a place where loader might need to put elf segments, so I decided to do it after first uprobe hit when loading is done. The uprobe is un-optimized in arch specific set_orig_insn call. The instruction overwrite is x86 arch specific and needs to go through 3 updates: (on top of nop5 instruction) - write int3 into 1st byte - write last 4 bytes of the call instruction - update the call instruction opcode And cleanup goes though similar reverse stages: - overwrite call opcode with breakpoint (int3) - write last 4 bytes of the nop5 instruction - write the nop5 first instruction byte We do not unmap and release uprobe trampoline when it's no longer needed, because there's no easy way to make sure none of the threads is still inside the trampoline. But we do not waste memory, because there's just single page for all the uprobe trampoline mappings. We do waste frame on page mapping for every 4GB by keeping the uprobe trampoline page mapped, but that seems ok. We take the benefit from the fact that set_swbp and set_orig_insn are called under mmap_write_lock(mm), so we can use the current instruction as the state the uprobe is in - nop5/breakpoint/call trampoline - and decide the needed action (optimize/un-optimize) based on that. Attaching the speed up from benchs/run_bench_uprobes.sh script: current: usermode-count : 152.604 ± 0.044M/s syscall-count : 13.359 ± 0.042M/s --> uprobe-nop : 3.229 ± 0.002M/s uprobe-push : 3.086 ± 0.004M/s uprobe-ret : 1.114 ± 0.004M/s uprobe-nop5 : 1.121 ± 0.005M/s uretprobe-nop : 2.145 ± 0.002M/s uretprobe-push : 2.070 ± 0.001M/s uretprobe-ret : 0.931 ± 0.001M/s uretprobe-nop5 : 0.957 ± 0.001M/s after the change: usermode-count : 152.448 ± 0.244M/s syscall-count : 14.321 ± 0.059M/s uprobe-nop : 3.148 ± 0.007M/s uprobe-push : 2.976 ± 0.004M/s uprobe-ret : 1.068 ± 0.003M/s --> uprobe-nop5 : 7.038 ± 0.007M/s uretprobe-nop : 2.109 ± 0.004M/s uretprobe-push : 2.035 ± 0.001M/s uretprobe-ret : 0.908 ± 0.001M/s uretprobe-nop5 : 3.377 ± 0.009M/s I see bit more speed up on Intel (above) compared to AMD. The big nop5 speed up is partly due to emulating nop5 and partly due to optimization. The key speed up we do this for is the USDT switch from nop to nop5: uprobe-nop : 3.148 ± 0.007M/s uprobe-nop5 : 7.038 ± 0.007M/s Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20250720112133.244369-11-jolsa@kernel.org commit 56101b69c9190667f473b9f93f8b6d8209aaa816 Author: Jiri Olsa Date: Sun Jul 20 13:21:19 2025 +0200 uprobes/x86: Add uprobe syscall to speed up uprobe Adding new uprobe syscall that calls uprobe handlers for given 'breakpoint' address. The idea is that the 'breakpoint' address calls the user space trampoline which executes the uprobe syscall. The syscall handler reads the return address of the initial call to retrieve the original 'breakpoint' address. With this address we find the related uprobe object and call its consumers. Adding the arch_uprobe_trampoline_mapping function that provides uprobe trampoline mapping. This mapping is backed with one global page initialized at __init time and shared by the all the mapping instances. We do not allow to execute uprobe syscall if the caller is not from uprobe trampoline mapping. The uprobe syscall ensures the consumer (bpf program) sees registers values in the state before the trampoline was called. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20250720112133.244369-10-jolsa@kernel.org commit 91440ff4cafad4c86322a612e523f7f021a493e7 Author: Jiri Olsa Date: Sun Jul 20 13:21:18 2025 +0200 uprobes/x86: Add mapping for optimized uprobe trampolines Adding support to add special mapping for user space trampoline with following functions: uprobe_trampoline_get - find or add uprobe_trampoline uprobe_trampoline_put - remove or destroy uprobe_trampoline The user space trampoline is exported as arch specific user space special mapping through tramp_mapping, which is initialized in following changes with new uprobe syscall. The uprobe trampoline needs to be callable/reachable from the probed address, so while searching for available address we use is_reachable_by_call function to decide if the uprobe trampoline is callable from the probe address. All uprobe_trampoline objects are stored in uprobes_state object and are cleaned up when the process mm_struct goes down. Adding new arch hooks for that, because this change is x86_64 specific. Locking is provided by callers in following changes. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20250720112133.244369-9-jolsa@kernel.org commit 18a111256a0b4fedfe47101f084441a84d7e357a Author: Jiri Olsa Date: Sun Jul 20 13:21:17 2025 +0200 uprobes: Add do_ref_ctr argument to uprobe_write function Making update_ref_ctr call in uprobe_write conditional based on do_ref_ctr argument. This way we can use uprobe_write for instruction update without doing ref_ctr_offset update. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Masami Hiramatsu (Google) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-8-jolsa@kernel.org commit ec46350fe1e2338f42ee84974c36b25afe8ba53a Author: Jiri Olsa Date: Sun Jul 20 13:21:16 2025 +0200 uprobes: Add is_register argument to uprobe_write and uprobe_write_opcode The uprobe_write has special path to restore the original page when we write original instruction back. This happens when uprobe_write detects that we want to write anything else but breakpoint instruction. Moving the detection away and passing it to uprobe_write as argument, so it's possible to write different instructions (other than just breakpoint and rest). Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Masami Hiramatsu (Google) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-7-jolsa@kernel.org commit f8b7c528b4fb7018d12b6bb63bb52576cfc73697 Author: Jiri Olsa Date: Sun Jul 20 13:21:15 2025 +0200 uprobes: Add nbytes argument to uprobe_write Adding nbytes argument to uprobe_write and related functions as preparation for writing whole instructions in following changes. Also renaming opcode arguments to insn, which seems to fit better. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Masami Hiramatsu (Google) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-6-jolsa@kernel.org commit 33d7b2beaf34a3c0f6406bc76f6e1b1755150ad9 Author: Jiri Olsa Date: Sun Jul 20 13:21:14 2025 +0200 uprobes: Add uprobe_write function Adding uprobe_write function that does what uprobe_write_opcode did so far, but allows to pass verify callback function that checks the memory location before writing the opcode. It will be used in following changes to implement specific checking logic for instruction update. The uprobe_write_opcode now calls uprobe_write with verify_opcode as the verify callback. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Masami Hiramatsu (Google) Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-5-jolsa@kernel.org commit 82afdd05a16a424409682e06a53d6afcda038d30 Author: Jiri Olsa Date: Sun Jul 20 13:21:13 2025 +0200 uprobes: Make copy_from_page global Making copy_from_page global and adding uprobe prefix. Adding the uprobe prefix to copy_to_page as well for symmetry. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-4-jolsa@kernel.org commit 0f07b7919d679050d354d3279faa74bdc7ce17a0 Author: Jiri Olsa Date: Sun Jul 20 13:21:12 2025 +0200 uprobes: Rename arch_uretprobe_trampoline function We are about to add uprobe trampoline, so cleaning up the namespace. Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-3-jolsa@kernel.org commit 7769cb177b23142b83f22abd06e492cc25157893 Author: Jiri Olsa Date: Sun Jul 20 13:21:11 2025 +0200 uprobes: Remove breakpoint in unapply_uprobe under mmap_write_lock Currently unapply_uprobe takes mmap_read_lock, but it might call remove_breakpoint which eventually changes user pages. Current code writes either breakpoint or original instruction, so it can go away with read lock as explained in here [1]. But with the upcoming change that writes multiple instructions on the probed address we need to ensure that any update to mm's pages is exclusive. [1] https://lore.kernel.org/all/20240710140045.GA1084@redhat.com/ Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andrii Nakryiko Acked-by: Masami Hiramatsu (Google) Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20250720112133.244369-2-jolsa@kernel.org commit 4cc7dce79725689d8dd229e13c857aeb97b1c7cf Author: Randy Dunlap Date: Tue Aug 19 00:54:56 2025 -0700 docs: sysctl: add a few more top-level /proc/sys entries Add a few missing directories under /proc/sys. Fix punctuation and doubled words. Signed-off-by: Randy Dunlap Cc: Rik van Riel Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Reviewed-by: Rik van Riel Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819075456.113623-1-rdunlap@infradead.org commit 915fb5caad7e569329e376dd7dd9a22afbd27636 Author: Mehdi Ben Hadj Khelifa Date: Tue Aug 19 09:49:00 2025 +0100 docs: Corrected typo in trace/events -Changed 'Dyamically' to 'Dynamically' in trace/events.rst under sections 7.1 and 7.3 Signed-off-by: Mehdi Ben Hadj Khelifa Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819085040.974388-1-mehdi.benhadjkhelifa@gmail.com commit e5b71dd3ad0e3be3c3d243c49e5eec37eb795397 Author: Cryolitia PukNgae Date: Tue Aug 19 10:45:57 2025 +0800 selftests: net: fix memory leak in tls.c To free memory and close fd after use Suggested-by: Jun Zhan Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20250819-memoryleak-v1-1-d4c70a861e62@uniontech.com Signed-off-by: Jakub Kicinski commit e56878b4770ba237cf487c881a59a779016f93de Author: Bartlomiej Kubik Date: Tue Aug 19 13:35:51 2025 +0200 docs: kernel-parameters: typo fix and add missing SPDX-License tag Fix documentation issues by removing a duplicated word and adding the missing SPDX-License identifier. Signed-off-by: Bartlomiej Kubik Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250819113551.34356-1-kubik.bartlomiej@gmail.com commit af4ed17fa0c4789b8d0f035a4c21abfa63b7e902 Author: Bagas Sanjaya Date: Wed Aug 20 12:04:16 2025 +0700 Documentation: driver-api: usb: Limit toctree depth toctree index in USB driver api docs currently spoils the entire docs headings due to lack of :maxdepth: option. Add the option to limit toctree depth to 1, mirroring usb subsystem docs in Documentation/usb/index.rst. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250820050416.25219-1-bagasdotme@gmail.com commit 168a4742aff1da4166ce12e294b2094126cac2b9 Author: Albin Babu Varghese Date: Wed Aug 20 15:47:15 2025 -0400 Documentation: conf.py: remove repeated word in comment Remove a repeated "are" from a comment in conf.py Signed-off-by: Albin Babu Varghese Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250820194714.130513-2-albinbabuvarghese20@gmail.com commit bc2b2062682a7f8d828b0020e37a84a9234f03a6 Author: Michal Wajdeczko Date: Mon Aug 18 21:20:32 2025 +0200 drm/xe/kunit: Extend platform generator with PTL Our list of typical platforms used to generate test device objects does not contain any PANTHERLAKE. Add one. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250818192032.633-1-michal.wajdeczko@intel.com commit a311fce2b694599cede76c5d7a0905336bc09803 Author: Nikunj A Dadhania Date: Tue Aug 19 16:48:33 2025 -0700 KVM: SVM: Enable Secure TSC for SNP guests Add support for Secure TSC, allowing userspace to configure the Secure TSC feature for SNP guests. Use the SNP specification's desired TSC frequency parameter during the SNP_LAUNCH_START command to set the mean TSC frequency in KHz for Secure TSC enabled guests. Always use kvm->arch.arch.default_tsc_khz as the TSC frequency that is passed to SNP guests in the SNP_LAUNCH_START command. The default value is the host TSC frequency. The userspace can optionally change the TSC frequency via the KVM_SET_TSC_KHZ ioctl before calling the SNP_LAUNCH_START ioctl. Introduce the read-only MSR GUEST_TSC_FREQ (0xc0010134) that returns guest's effective frequency in MHZ when Secure TSC is enabled for SNP guests. Disable interception of this MSR when Secure TSC is enabled. Note that GUEST_TSC_FREQ MSR is accessible only to the guest and not from the hypervisor context. Co-developed-by: Ketan Chaturvedi Signed-off-by: Ketan Chaturvedi Reviewed-by: Kai Huang Reviewed-by: Tom Lendacky Signed-off-by: Nikunj A Dadhania [sean: contain Secure TSC to sev.c] Link: https://lore.kernel.org/r/20250819234833.3080255-9-seanjc@google.com [sean: return -EINVAL if TSC frequency is '0'] Signed-off-by: Sean Christopherson commit f7b1f0c1620db689e085569035a659340a3209c3 Author: Sean Christopherson Date: Tue Aug 19 16:48:32 2025 -0700 KVM: SEV: Fold sev_es_vcpu_reset() into sev_vcpu_create() Fold the remaining line of sev_es_vcpu_reset() into sev_vcpu_create() as there's no need for a dedicated RESET hook just to init a mutex, and the mutex should be initialized as early as possible anyways. No functional change intended. Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-8-seanjc@google.com Signed-off-by: Sean Christopherson commit baf6ed177290db5873f318626970fa7fd4060579 Author: Sean Christopherson Date: Tue Aug 19 16:48:31 2025 -0700 KVM: SEV: Set RESET GHCB MSR value during sev_es_init_vmcb() Set the RESET value for the GHCB "MSR" during sev_es_init_vmcb() instead of sev_es_vcpu_reset() to allow for dropping sev_es_vcpu_reset() entirely. Note, the call to sev_init_vmcb() from sev_migrate_from() also kinda sorta emulates a RESET, but sev_migrate_from() immediately overwrites ghcb_gpa with the source's current value, so whether or not stuffing the GHCB version is correct/desirable is moot. No functional change intended. Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 3d4e882e3439593b406fa226bcdd48c92d2222a6 Author: Sean Christopherson Date: Tue Aug 19 16:48:30 2025 -0700 KVM: SEV: Move init of SNP guest state into sev_init_vmcb() Move the initialization of SNP guest state from svm_vcpu_reset() into sev_init_vmcb() to reduce the number of paths that deal with INIT/RESET for SEV+ vCPUs from 4+ to 1. Plumb in @init_event as necessary. Opportunistically check for an SNP guest outside of sev_snp_init_protected_guest_state() so that sev_init_vmcb() is consistent with respect to checking for SEV-ES+ and SNP+ guests. No functional change intended. Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 34bd82aab15b8b9e8e9d923267283c84aa8c2789 Author: Sean Christopherson Date: Tue Aug 19 16:48:29 2025 -0700 KVM: SVM: Move SEV-ES VMSA allocation to a dedicated sev_vcpu_create() helper Add a dedicated sev_vcpu_create() helper to allocate the VMSA page for SEV-ES+ vCPUs, and to allow for consolidating a variety of related SEV+ code in the near future. No functional change intended. Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 7b59c73fd611eae87e60e8bb0ab83a1475d8a3a7 Author: Nikunj A Dadhania Date: Tue Aug 19 16:48:28 2025 -0700 x86/cpufeatures: Add SNP Secure TSC The Secure TSC feature for SEV-SNP allows guests to securely use the RDTSC and RDTSCP instructions, ensuring that the parameters used cannot be altered by the hypervisor once the guest is launched. For more details, refer to the AMD64 APM Vol 2, Section "Secure TSC". Acked-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Tested-by: Vaishali Thakkar Signed-off-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 00f0b959ffb094ea677ca24a0bd14d300a3013a0 Author: Nikunj A Dadhania Date: Tue Aug 19 16:48:27 2025 -0700 KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests Require a minimum GHCB version of 2 when starting SEV-SNP guests through KVM_SEV_INIT2. When a VMM attempts to start an SEV-SNP guest with an incompatible GHCB version (less than 2), reject the request early rather than allowing the guest kernel to start with an incorrect protocol version and fail later with GHCB_SNP_UNSUPPORTED guest termination. Not enforcing the minimum version typically causes the guest to request termination with GHCB_SNP_UNSUPPORTED error code: kvm_amd: SEV-ES guest requested termination: 0x0:0x2 Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version") Cc: Thomas Lendacky Cc: Sean Christopherson Cc: Michael Roth Signed-off-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c78af20374a1c9c230cc535857d2af3de5d4442c Author: Nikunj A Dadhania Date: Tue Aug 19 16:48:26 2025 -0700 KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it Remove the GHCB_VERSION_DEFAULT macro and open code it with '2'. The macro is used conditionally and is not a true default. KVM ABI does not advertise/emumerates the default GHCB version. Any future change to this macro would silently alter the ABI and potentially break existing deployments that rely on the current behavior. Additionally, move the GHCB version assignment earlier in the code flow and update the comment to clarify that KVM_SEV_INIT2 defaults to version 2, while KVM_SEV_INIT forces version 1. No functional change intended. Cc: Thomas Lendacky Cc: Michael Roth Suggested-by: Sean Christopherson Signed-off-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/20250819234833.3080255-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 3f13bcc886fc034113cb75cb32b8d9db1216b846 Author: Lizhi Hou Date: Wed Aug 20 16:38:17 2025 -0700 Documentation: accel: amdxdna: Update compiler information The compiler information is outdated. Update it to the latest. Reviewed-by: Maciej Falkowski Reviewed-by: Alex Deucher Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250820233817.4050006-1-lizhi.hou@amd.com commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 Author: Takashi Iwai Date: Thu Aug 21 17:17:50 2025 +0200 ALSA: usb-audio: Add validation of UAC2/UAC3 effect units Just add fixed struct size validations for UAC2 and UAC3 effect units. The descriptor has a variable-length array, so it should be validated with a proper function later once when the unit is really parsed and used by the driver (currently only referred partially for the input terminal parsing). Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 8ea3449574bde797d8e266fb0d6c2154f8e99c49 Merge: 0c5e2ae204eca7 8410fe81093ff2 Author: Takashi Iwai Date: Thu Aug 21 17:10:48 2025 +0200 Merge branch 'for-linus' into for-next commit 07cf71bf25cd4e5735ff13468e7b86f02c3665cb Author: Jakub Kicinski Date: Tue Aug 19 19:56:50 2025 -0700 net: page_pool: add page_pool_get() There is a page_pool_put() function but no get equivalent. Having multiple references to a page pool is quite useful. It avoids branching in create / destroy paths in drivers which support memory providers. Use the new helper in bnxt. Acked-by: Jesper Dangaard Brouer Reviewed-by: Dragos Tatulea Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250820025704.166248-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 842aedc3907deb154eedb88c7e4c3278c9b33701 Author: FUJITA Tomonori Date: Thu Aug 21 09:20:54 2025 +0900 rust: Add cpu_relax() helper Add cpu_relax() helper in preparation for supporting read_poll_timeout(). Reviewed-by: Alice Ryhl Reviewed-by: Andreas Hindborg Reviewed-by: Daniel Almeida Acked-by: Miguel Ojeda Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250821002055.3654160-2-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit 73c94172e278197fbed9f6a7b7550edc5bc1fbad Author: Carlos Llamas Date: Thu Aug 21 13:55:21 2025 +0000 netlink: specs: binder: replace underscores with dashes in names The usage of underscores is no longer allowed for the 'name' format in the yaml spec. Instead, dashes should be used. This fixes the build issue reported by Thorsten that showed up on linux-next. Note this change has no impact on C code. Cc: Jakub Kicinski Reported-by: Thorsten Leemhuis Closes: https://lore.kernel.org/all/e21744a4-0155-40ec-b8c1-d81b14107c9f@leemhuis.info/ Fixes: 63740349eba7 ("binder: introduce transaction reports via netlink") Signed-off-by: Carlos Llamas Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20250821135522.2878772-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 61ce50fd8196c8782b9620bb60d33649ec429f64 Author: Dan Carpenter Date: Thu Aug 21 15:30:54 2025 +0300 drm/panel: jdi-lpm102a188a: Fix error code in jdi_panel_prepare() If the mipi_dsi_dual() macro fails, the error code is stored in dsi_ctx.accum_err. Propagate that error back to the caller instead of returning success as the current code does. Fixes: a6adf47d30cc ("drm/panel: jdi-lpm102a188a: Fix bug and clean up driver") Signed-off-by: Dan Carpenter Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/aKcRfq8xBrFmhqmO@stanley.mountain commit ac9eea3d08c25fb213deb113d246ff5dadb31fbc Author: Alice Ryhl Date: Mon Aug 11 12:14:56 2025 +0200 rust: alloc: implement Box::pin_slice() Add a new constructor to Box to facilitate Box creation from a pinned slice of elements. This allows to efficiently allocate memory for e.g. slices of structrures containing spinlocks or mutexes. Such slices may be used in kmemcache like or zpool API implementations. Signed-off-by: Alice Ryhl Signed-off-by: Vitaly Wool Link: https://lore.kernel.org/r/20250811101456.2901694-1-vitaly.wool@konsulko.se [ Add empty lines after struct definitions in the example; end sentences with a period. - Danilo ] Signed-off-by: Danilo Krummrich commit 96481012628c2d9a03fb758763ad7bff786203eb Author: Raphael Gallais-Pou Date: Fri Mar 28 12:41:48 2025 +0100 drm: of: fix documentation reference Documentation/devicetree/bindings/graph.txt content has move directly to the dt-schema repo in commit 4b52be0ce6ad ("dt-bindings: Remove plain text OF graph binding"). Point to the YAML of the official repo instead of the old file. Signed-off-by: Raphael Gallais-Pou Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250328114148.260322-1-rgallaispou@gmail.com Signed-off-by: Raphael Gallais-Pou commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 Author: Junnan Wu Date: Tue Aug 12 15:53:43 2025 +0800 firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a standalone driver”), the VirtIO transport probes independently. During scmi_virtio_probe, scmi_probe() is called, which intune invokes scmi_protocol_acquire() that sends a message over the virtqueue and waits for a reply. Previously, DRIVER_OK was only set after scmi_vio_probe, in the core virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device Initialization): | The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK. Some type-1 hypervisors block available-buffer notifications until the driver is marked OK. In such cases, scmi_vio_probe stalls in scmi_wait_for_reply(), and the probe never completes. Resolve this by setting DRIVER_OK immediately after the device-specific setup, so scmi_probe() can safely send notifications. Note after splitting the transports into modules, the probe sequence changed a bit. We can no longer rely on virtio_device_ready() being called by the core in virtio_dev_probe(), because scmi_vio_probe() doesn’t complete until the core SCMI stack runs scmi_probe(), which immediately issues the initial BASE protocol exchanges. Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver") Signed-off-by: Junnan Wu Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com> Signed-off-by: Sudeep Holla commit 224dcf2968cad72adabd4f8258291d6675bc301e Author: Christophe JAILLET Date: Tue Jul 29 21:15:04 2025 +0200 firmware: arm_scmi: Constify struct scmi_transport_ops Mark struct scmi_transport_ops as const since this driver never modifies it. Constifying moves it to read-only memory, improving hardening - especially important for structures with function pointers. x86_64 (allmodconfig) size diff: Before: text data bss dec hex filename 6907 680 48 7635 1dd3 drivers/firmware/arm_scmi/transports/optee.o After: text data bss dec hex filename 6987 576 48 7611 1dbb drivers/firmware/arm_scmi/transports/optee.o Signed-off-by: Christophe JAILLET Message-Id: <881be6ad61037ed95d5e750a2565fd9840120a08.1753816459.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Sudeep Holla commit abd658d3e7332bc88ae910664c7d5f4e116d6bde Author: Christophe JAILLET Date: Tue Jul 29 21:15:03 2025 +0200 firmware: arm_scmi: Constify struct scmi_voltage_proto_ops Constify struct scmi_voltage_proto_ops since the driver never modifies it. Placing it in read-only memory (.rodata) improves hardening, particularly because it contains function pointers. x86_64 (allmodconfig) size impact: Before: text data bss dec hex filename 13142 1808 0 14950 3a66 drivers/firmware/arm_scmi/voltage.o After: text data bss dec hex filename 13238 1712 0 14950 3a66 drivers/firmware/arm_scmi/voltage.o Signed-off-by: Christophe JAILLET Message-Id: <2091660c072dd2d5599897243a5d69e89d46ed4d.1753816459.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Sudeep Holla commit a4d5f63d4384533101e0308fb2e9ac16bacc446c Author: Nikunj Kela Date: Wed Jul 30 14:30:00 2025 -0700 dt-bindings: firmware: arm,scmi: Allow multiple instances Enable multiple SCMI instances by appending an instance-number suffix to the 'scmi' node name. The SCMI spec assumes a single SCMI platform, but in practice its responsibilities may be split across several SCMI platform/server instances. However, only one instance can serve as the system-wide (true) SCMI platform. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Cristian Marussi Signed-off-by: Nikunj Kela Signed-off-by: Deepti Jaggi Message-Id: <20250730-8255-scmi-v6-1-a7d8ba19aded@quicinc.com> Signed-off-by: Sudeep Holla commit d234f3aef5928c2f0d692cf43768ecced0abd672 Author: Shankari Anand Date: Wed Aug 20 16:58:46 2025 +0530 gpu: nova-core: Update ARef imports from sync::aref Update call sites in nova-core to import `ARef` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. [acourbot@nvidia.com: use standard prefix for nova-core.] Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250820112846.9665-1-shankari.ak0208@gmail.com Signed-off-by: Alexandre Courbot commit ae7c0996c0e0f7d3bd3665020e1fbb4d99b7373e Author: Uros Bizjak Date: Tue Aug 19 10:57:52 2025 +0200 x86/kconfig: Remove CONFIG_AS_AVX512 Commit 5f5305dea066 ("raid6: skip avx512 checks") and commit bc23fe6dc172 ("crypto: x86 - Remove CONFIG_AS_AVX512 handling") removed all uses of CONFIG_AS_AVX512. Remove check for assembler support of AVX-512 instructions. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250819085855.333380-4-ubizjak@gmail.com commit e084e9f8151f1d37b085317752d36b4fa2fec9b9 Author: Uros Bizjak Date: Tue Aug 19 10:57:51 2025 +0200 crypto: x86 - Remove CONFIG_AS_VPCLMULQDQ Current minimum required version of binutils is 2.30, which supports VPCLMULQDQ instruction mnemonics. Remove check for assembler support of VPCLMULQDQ instructions and all relevant macros for conditional compilation. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Acked-by: Herbert Xu Link: https://lore.kernel.org/20250819085855.333380-3-ubizjak@gmail.com commit d78e48ebe04e9566f8ecbf51471e80da3adbceeb Author: Krzysztof Kozlowski Date: Thu Aug 21 10:31:01 2025 +0200 ASoC: dt-bindings: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250821083100.46340-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit f0883b9c395ecdf7e66a58b6027fd35056cf152c Merge: 8f5ae30d69d754 8a3d00dde63a33 Author: Christian Brauner Date: Thu Aug 21 13:58:13 2025 +0200 Merge patch series "Move fscrypt and fsverity info out of struct inode" Eric Biggers says: This is a cleaned-up implementation of moving the i_crypt_info and i_verity_info pointers out of 'struct inode' and into the fs-specific part of the inode, as proposed previously by Christian at https://lore.kernel.org/r/20250723-work-inode-fscrypt-v4-0-c8e11488a0e6@kernel.org/ The high-level concept is still the same: fs/crypto/ and fs/verity/ locate the pointer by adding an offset to the address of struct inode. The offset is retrieved from fscrypt_operations or fsverity_operations. I've cleaned up a lot of the details, including: - Grouped changes into patches differently - Rewrote commit messages and comments to be clearer - Adjusted code formatting to be consistent with existing code - Removed unneeded #ifdefs - Improved choice and location of VFS_WARN_ON_ONCE() statements - Added missing kerneldoc for ubifs_inode::i_crypt_info - Moved field initialization to init_once functions when they exist - Improved ceph offset calculation and removed unneeded static_asserts - fsverity_get_info() now checks IS_VERITY() instead of v_ops - fscrypt_put_encryption_info() no longer checks IS_ENCRYPTED(), since I no longer think it's actually correct there. - verity_data_blocks() now keeps doing a raw dereference - Dropped fscrypt_set_inode_info() - Renamed some functions - Do offset calculation using int, so we don't rely on unsigned overflow - And more. * patches from https://lore.kernel.org/20250810075706.172910-1-ebiggers@kernel.org: fsverity: check IS_VERITY() in fsverity_cleanup_inode() fs: remove inode::i_verity_info btrfs: move verity info pointer to fs-specific part of inode f2fs: move verity info pointer to fs-specific part of inode ext4: move verity info pointer to fs-specific part of inode fsverity: add support for info in fs-specific part of inode fs: remove inode::i_crypt_info ceph: move crypt info pointer to fs-specific part of inode ubifs: move crypt info pointer to fs-specific part of inode f2fs: move crypt info pointer to fs-specific part of inode ext4: move crypt info pointer to fs-specific part of inode fscrypt: add support for info in fs-specific part of inode fscrypt: replace raw loads of info pointer with helper function Link: https://lore.kernel.org/20250810075706.172910-1-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 8a3d00dde63a339d31d1fdeead24ddfd4d459c70 Author: Eric Biggers Date: Sun Aug 10 00:57:06 2025 -0700 fsverity: check IS_VERITY() in fsverity_cleanup_inode() Since getting the address of the fsverity_info has gotten a bit more expensive, make fsverity_cleanup_inode() check for IS_VERITY() instead. This avoids adding more overhead to non-verity files. This assumes that verity info is never set when !IS_VERITY(), which is currently true, but add a VFS_WARN_ON_ONCE() that asserts that. (This of course defeats the optimization, but only when CONFIG_VFS_DEBUG=y.) Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-14-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 818c659ac164e4e4639ceaedaccbdfebb1ef63b5 Author: Eric Biggers Date: Sun Aug 10 00:57:05 2025 -0700 fs: remove inode::i_verity_info Now that all fsverity-capable filesystems store the pointer to fsverity_info in the filesystem-specific part of the inode structure, inode::i_verity_info is no longer needed. Update fsverity_info_addr() to no longer support the fallback to inode::i_verity_info. Finally, remove inode::i_verity_info itself, and move the forward declaration of struct fsverity_info from fs.h (which no longer needs it) to fsverity.h. The end result of the migration to the filesystem-specific pointer is memory savings on CONFIG_FS_VERITY=y kernels for all filesystems that don't support fsverity. Specifically, their in-memory inodes are now smaller by the size of a pointer: either 4 or 8 bytes. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-13-ebiggers@kernel.org Signed-off-by: Christian Brauner commit fcafdd4210658986470208230253ba5cdc6107a0 Author: Eric Biggers Date: Sun Aug 10 00:57:04 2025 -0700 btrfs: move verity info pointer to fs-specific part of inode Move the fsverity_info pointer into the filesystem-specific part of the inode by adding the field btrfs_inode::i_verity_info and configuring fsverity_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_verity_info, saving memory and improving cache efficiency on filesystems that don't support fsverity. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-12-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 1f66cef4a9a3033b76db08de25eb017ddc6967e6 Author: Eric Biggers Date: Sun Aug 10 00:57:03 2025 -0700 f2fs: move verity info pointer to fs-specific part of inode Move the fsverity_info pointer into the filesystem-specific part of the inode by adding the field f2fs_inode_info::i_verity_info and configuring fsverity_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_verity_info, saving memory and improving cache efficiency on filesystems that don't support fsverity. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-11-ebiggers@kernel.org Signed-off-by: Christian Brauner commit c9fff804b59c5495db944ddf84e1f963967cc361 Author: Eric Biggers Date: Sun Aug 10 00:57:02 2025 -0700 ext4: move verity info pointer to fs-specific part of inode Move the fsverity_info pointer into the filesystem-specific part of the inode by adding the field ext4_inode_info::i_verity_info and configuring fsverity_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_verity_info, saving memory and improving cache efficiency on filesystems that don't support fsverity. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-10-ebiggers@kernel.org Acked-by: Theodore Ts'o Signed-off-by: Christian Brauner commit 2a7349add18e5915cd87251af5f98db1772b6131 Author: Eric Biggers Date: Sun Aug 10 00:57:01 2025 -0700 fsverity: add support for info in fs-specific part of inode Add an inode_info_offs field to struct fsverity_operations, and update fs/verity/ to support it. When set to a nonzero value, it specifies the offset to the fsverity_info pointer within the filesystem-specific part of the inode structure, to be used instead of inode::i_verity_info. Since this makes inode::i_verity_info no longer necessarily used, update comments that mentioned it. This is a prerequisite for a later commit that removes inode::i_verity_info, saving memory and improving cache efficiency on filesystems that don't support fsverity. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-9-ebiggers@kernel.org Signed-off-by: Christian Brauner commit ab90c2d2476c4dd6deddd089c7e83b858d135783 Author: Eric Biggers Date: Sun Aug 10 00:57:00 2025 -0700 fs: remove inode::i_crypt_info Now that all fscrypt-capable filesystems store the pointer to fscrypt_inode_info in the filesystem-specific part of the inode structure, inode::i_crypt_info is no longer needed. Update fscrypt_inode_info_addr() to no longer support the fallback to inode::i_crypt_info. Finally, remove inode::i_crypt_info itself along with the now-unnecessary forward declaration of fscrypt_inode_info. The end result of the migration to the filesystem-specific pointer is memory savings on CONFIG_FS_ENCRYPTION=y kernels for all filesystems that don't support fscrypt. Specifically, their in-memory inodes are now smaller by the size of a pointer: either 4 or 8 bytes. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-8-ebiggers@kernel.org Signed-off-by: Christian Brauner commit bbe395ded3ef2a2aecfc90372bda2b3e3ed8f2ee Author: Eric Biggers Date: Sun Aug 10 00:56:59 2025 -0700 ceph: move crypt info pointer to fs-specific part of inode Move the fscrypt_inode_info pointer into the filesystem-specific part of the inode by adding the field ceph_inode_info::i_crypt_info and configuring fscrypt_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_crypt_info, saving memory and improving cache efficiency with filesystems that don't support fscrypt. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-7-ebiggers@kernel.org Signed-off-by: Christian Brauner commit e1add70aaa5ea469980a60a1747ab9863fec2124 Author: Eric Biggers Date: Sun Aug 10 00:56:58 2025 -0700 ubifs: move crypt info pointer to fs-specific part of inode Move the fscrypt_inode_info pointer into the filesystem-specific part of the inode by adding the field ubifs_inode::i_crypt_info and configuring fscrypt_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_crypt_info, saving memory and improving cache efficiency with filesystems that don't support fscrypt. Note that the initialization of ubifs_inode::i_crypt_info to NULL on inode allocation is handled by the memset() in ubifs_alloc_inode(). Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-6-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 7afb71ee92de72f54877b06a31d46614edcaad24 Author: Eric Biggers Date: Sun Aug 10 00:56:57 2025 -0700 f2fs: move crypt info pointer to fs-specific part of inode Move the fscrypt_inode_info pointer into the filesystem-specific part of the inode by adding the field f2fs_inode_info::i_crypt_info and configuring fscrypt_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_crypt_info, saving memory and improving cache efficiency with filesystems that don't support fscrypt. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-5-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 80e07df424e583d4124be6059be54080e4c4cb64 Author: Eric Biggers Date: Sun Aug 10 00:56:56 2025 -0700 ext4: move crypt info pointer to fs-specific part of inode Move the fscrypt_inode_info pointer into the filesystem-specific part of the inode by adding the field ext4_inode_info::i_crypt_info and configuring fscrypt_operations::inode_info_offs accordingly. This is a prerequisite for a later commit that removes inode::i_crypt_info, saving memory and improving cache efficiency with filesystems that don't support fscrypt. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-4-ebiggers@kernel.org Signed-off-by: Theodore Ts'o Signed-off-by: Christian Brauner commit 93221de31a8df6710e02328f82dc68d7ab4ad9e6 Author: Eric Biggers Date: Sun Aug 10 00:56:55 2025 -0700 fscrypt: add support for info in fs-specific part of inode Add an inode_info_offs field to struct fscrypt_operations, and update fs/crypto/ to support it. When set to a nonzero value, it specifies the offset to the fscrypt_inode_info pointer within the filesystem-specific part of the inode structure, to be used instead of inode::i_crypt_info. Since this makes inode::i_crypt_info no longer necessarily used, update comments that mentioned it. This is a prerequisite for a later commit that removes inode::i_crypt_info, saving memory and improving cache efficiency with filesystems that don't support fscrypt. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-3-ebiggers@kernel.org Signed-off-by: Christian Brauner commit 6c9468aad215a198742c8375b0415e42521c905c Author: Eric Biggers Date: Sun Aug 10 00:56:54 2025 -0700 fscrypt: replace raw loads of info pointer with helper function Add and use a helper function fscrypt_get_inode_info_raw(). It loads an inode's fscrypt info pointer using a raw dereference, which is appropriate when the caller knows the key setup already happened. This eliminates most occurrences of inode::i_crypt_info in the source, in preparation for replacing that with a filesystem-specific field. Co-developed-by: Christian Brauner Signed-off-by: Eric Biggers Link: https://lore.kernel.org/20250810075706.172910-2-ebiggers@kernel.org Signed-off-by: Christian Brauner commit ee97f1fe67c0dff62549c6d8e8a7784431e65d46 Author: Andrea della Porta Date: Tue Aug 12 10:46:39 2025 +0200 dt-bindings: pinctrl: rp1: Describe groups for RP1 pin controller The DT binding for RP1 pin controller currently lacks the group definitions. Add groups enumeration to the schema. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250812084639.13442-1-andrea.porta@suse.com Signed-off-by: Linus Walleij commit a90d6f4aa0bb1dabae4be04955938c86ad7d3489 Author: Qianfeng Rong Date: Tue Aug 19 22:39:35 2025 +0800 pinctrl: sunxi: use kcalloc() instead of kzalloc() Use devm_kcalloc() in init_pins_table() and prepare_function_table() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Acked-by: Chen-Yu Tsai Link: https://lore.kernel.org/20250819143935.372084-5-rongqianfeng@vivo.com Signed-off-by: Linus Walleij commit 42311ea58302d340339369a39eb84c6bfb703750 Author: Qianfeng Rong Date: Tue Aug 19 22:39:34 2025 +0800 pinctrl: qcom: sc8180x: use kcalloc() instead of kzalloc() Use devm_kcalloc() in sc8180x_pinctrl_add_tile_resources() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/20250819143935.372084-4-rongqianfeng@vivo.com Signed-off-by: Linus Walleij commit ae666486ee3baf97571df837ed8acd9e05d015bf Author: Qianfeng Rong Date: Tue Aug 19 22:39:33 2025 +0800 pinctrl: pinctrl-zynqmp: use kcalloc() instead of kzalloc() Use devm_kcalloc() in versal_pinctrl_prepare_pin_desc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Acked-by: Michal Simek Link: https://lore.kernel.org/20250819143935.372084-3-rongqianfeng@vivo.com Signed-off-by: Linus Walleij commit 2092b3b278be03f73a2438a9d14e2ac472eec033 Author: Qianfeng Rong Date: Tue Aug 19 22:39:32 2025 +0800 pinctrl: microchip-sgpio: use kcalloc() instead of kzalloc() Use devm_kcalloc() in microchip_sgpio_register_bank() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/20250819143935.372084-2-rongqianfeng@vivo.com Signed-off-by: Linus Walleij commit 4aa8961b1b9c7498550b41168a91cf1558133dd3 Author: Val Packett Date: Sun Jul 6 17:42:24 2025 -0300 drm/dp: drm_edp_backlight_set_level: do not always send 3-byte commands At least some panels using the LSB register are not happy with the unconditional increase of the command buffer to 3 bytes. With the BOE NE14QDM in my Dell Latitude 7455, the recent patches for luminance based brightness have introduced a regression: the brightness range stopped being contiguous and became nonsensical (it probably was interpreting the last 2 bytes of the buffer and not the first 2). Change from using a fixed sizeof() to a length variable that's only set to 3 when luminance is used. Let's leave the default as 2 even for the single-byte version, since that's how it worked before. Fixes: f2db78e37fe7 ("drm/dp: Modify drm_edp_backlight_set_level") Signed-off-by: Val Packett Tested-by: Abel Vesa Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250706204446.8918-1-val@packett.cool Signed-off-by: Dmitry Baryshkov commit 7c8c76272e1732c63aab760b0b656f00bdc67050 Author: Jouni Högander Date: Fri Aug 15 11:45:34 2025 +0300 drm/i915/psr: Check pause counter before continuing to PSR activation Currently intel_psr_work is re-activating PSR even when pause_counter > 0 which is incorrect. Fix this by checking pause_counter before re-activating PSR. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14822 Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250815084534.1637030-4-jouni.hogander@intel.com commit 73b60be7f62f1edfef7aac4783878932b2b59ad9 Author: Jouni Högander Date: Fri Aug 15 11:45:33 2025 +0300 drm/i915/psr: Do not activate disabled PSR on irq_aux_error Currently intel_psr_work is continuing to activation of PSR which was just disabled when irq_aux_error == true. Fix this by skipping everything else than intel_psr_handle_irq in intel_psr_work when irq_aux_error == true. Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250815084534.1637030-3-jouni.hogander@intel.com commit f9ad930c52a8d7e945b65776e379ed327cf3b904 Author: Jouni Högander Date: Fri Aug 15 11:45:32 2025 +0300 drm/i915/psr: drm_WARN_ON when activating disabled PSR Add drm_WARN_ON for scenario where PSR is activated while it is disabled. Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250815084534.1637030-2-jouni.hogander@intel.com commit ae76e8d2c27e714b1258f803de8b03e003a04df2 Merge: d051b1f9df3470 ad5cef7ef01c23 Author: Paolo Abeni Date: Thu Aug 21 12:38:43 2025 +0200 Merge branch 'add-ppe-driver-for-qualcomm-ipq9574-soc' Luo Jie says: ==================== Add PPE driver for Qualcomm IPQ9574 SoC The PPE (packet process engine) hardware block is available in Qualcomm IPQ chipsets that support PPE architecture, such as IPQ9574 and IPQ5332. The PPE in the IPQ9574 SoC includes six Ethernet ports (6 GMAC and 6 XGMAC), which are used to connect with external PHY devices by PCS. The PPE also includes packet processing offload capabilities for various networking functions such as route and bridge flows, VLANs, different tunnel protocols and VPN. It also includes an L2 switch function for bridging packets among the 6 Ethernet ports and the CPU port. The CPU port enables packet transfer between the Ethernet ports and the ARM cores in the SoC, using the Ethernet DMA. This patch series is the first part of a three part series that will together enable Ethernet function for IPQ9574 SoC. While support is initially being added for IPQ9574 SoC, the driver will be easily extendable to enable Ethernet support for other IPQ SoC such as IPQ5332. The driver can also be extended later for adding support for L2/L3 network offload features that the PPE can support. The functionality to be enabled by each of the three series (to be posted sequentially) is as below: Part 1: The PPE patch series (this series), which enables the platform driver, probe and initialization/configuration of different PPE hardware blocks. Part 2: The PPE MAC patch series, which enables the phylink operations for the PPE Ethernet ports. Part 3: The PPE EDMA patch series, which enables the Rx/Tx Ethernet DMA and netdevice driver for the 6 PPE Ethernet ports. A more detailed description of the functions enabled by part 1 is below: 1. Initialize PPE device hardware functions such as buffer management, queue management, scheduler and clocks in order to bring up PPE device. 2. Enable platform driver and probe functions 3. Register debugfs file to provide access to various PPE packet counters. These statistics are recorded by the various hardware process counters, such as port RX/TX, CPU code and hardware queue counters. 4. A detailed introduction of PPE along with the PPE hardware diagram in the first two patches (dt-bindings and documentation). Below is a reference to an earlier RFC discussion with the community about enabling Ethernet driver support for Qualcomm IPQ9574 SoC. This writeup can help provide a higher level architectural view of various other drivers that support the PPE such as clock and PCS drivers. Topic: RFC: Advice on adding support for Qualcomm IPQ9574 SoC Ethernet. https://lore.kernel.org/linux-arm-msm/d2929bd2-bc9e-4733-a89f-2a187e8bf917@quicinc.com/ Signed-off-by: Luo Jie ==================== Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-0-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit ad5cef7ef01c23346ffb1bcd7d9163b1f1e60097 Author: Luo Jie Date: Mon Aug 18 21:14:38 2025 +0800 MAINTAINERS: Add maintainer for Qualcomm PPE driver Add maintainer entry for PPE (Packet Process Engine) driver supported for Qualcomm IPQ SoCs. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-14-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit a2a7221dbd2b177145858daabda0070ff5d2b7e7 Author: Luo Jie Date: Mon Aug 18 21:14:37 2025 +0800 net: ethernet: qualcomm: Add PPE debugfs support for PPE counters The PPE hardware counters maintain counters for packets handled by the various functional blocks of PPE. They help in tracing the packets passed through PPE and debugging any packet drops. The counters displayed by this debugfs file are ones that are common for all Ethernet ports, and they do not include the counters that are specific for a MAC port. Hence they cannot be displayed using ethtool. The per-MAC counters will be supported using "ethtool -S" along with the netdevice driver. The PPE hardware various type counters are made available through the debugfs files under directory "/sys/kernel/debug/ppe/". Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-13-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 8cc72c6c9236ebdf5d245924574e70546ecdda15 Author: Lei Wei Date: Mon Aug 18 21:14:36 2025 +0800 net: ethernet: qualcomm: Initialize PPE L2 bridge settings Initialize the L2 bridge settings for the PPE ports to only enable L2 frame forwarding between CPU port and PPE Ethernet ports. The per-port L2 bridge settings are initialized as follows: For PPE CPU port, the PPE bridge TX is enabled and FDB learning is disabled. For PPE physical ports, the default L2 forwarding action is initialized to forward to CPU port only. L2/FDB learning and forwarding will not be enabled for PPE physical ports yet, since the port's VSI (Virtual Switch Instance) and VSI membership are not yet configured, which are required for FDB forwarding. The VSI and FDB forwarding will later be enabled when switchdev is enabled. Signed-off-by: Lei Wei Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-12-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit fa99608a9a9e0a967b8d6e8ee53c8c1596447b2b Author: Luo Jie Date: Mon Aug 18 21:14:35 2025 +0800 net: ethernet: qualcomm: Initialize PPE queue to Ethernet DMA ring mapping Configure the selected queues to map with an Ethernet DMA ring for the packet to receive on ARM cores. As default initialization, all queues assigned to CPU port 0 are mapped to the EDMA ring 0. This configuration is later updated during Ethernet DMA initialization. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-11-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 1c46c3c0075cd411a50b72e3a4002828cddf7b6d Author: Luo Jie Date: Mon Aug 18 21:14:34 2025 +0800 net: ethernet: qualcomm: Initialize PPE RSS hash settings The PPE RSS hash is generated during PPE receive, based on the packet content (3 tuples or 5 tuples) and as per the configured RSS seed. The hash is then used to select the queue to transmit the packet to the ARM CPU. This patch initializes the RSS hash settings that are used to generate the hash for the packet during PPE packet receive. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-10-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 8821bb0f626253ee9f59124daa4d2a1289e7b7da Author: Luo Jie Date: Mon Aug 18 21:14:33 2025 +0800 net: ethernet: qualcomm: Initialize PPE port control settings Configure the default action as drop when the packet size is more than the configured MTU of physical port. Also enable port specific counters in PPE. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-9-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 73d05bdaf01eb2a5c4b1408417a8763f8a026af6 Author: Luo Jie Date: Mon Aug 18 21:14:32 2025 +0800 net: ethernet: qualcomm: Initialize PPE service code settings PPE service code is a special code (0-255) that is defined by PPE for PPE's packet processing stages, as per the network functions required for the packet. For packet being sent out by ARM cores on Ethernet ports, The service code 1 is used as the default service code. This service code is used to bypass most of packet processing stages of the PPE before the packet transmitted out PPE port, since the software network stack has already processed the packet. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-8-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 7a23a8af179dacc538b52b594b6b399cd64885c9 Author: Luo Jie Date: Mon Aug 18 21:14:31 2025 +0800 net: ethernet: qualcomm: Initialize PPE queue settings Configure unicast and multicast hardware queues for the PPE ports to enable packet forwarding between the ports. Each PPE port is assigned with a range of queues. The queue ID selection for the packet is decided by the queue base and queue offset that is configured based on the internal priority and the RSS hash value of the packet. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-7-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 331227983814fa89d7e9f3356da89de223d414c1 Author: Luo Jie Date: Mon Aug 18 21:14:30 2025 +0800 net: ethernet: qualcomm: Initialize the PPE scheduler settings The PPE scheduler settings determine the priority of scheduling the packet across the different hardware queues per PPE port. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-6-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 806268dc7efdf281cb6822fcc8d573e26d39e95d Author: Luo Jie Date: Mon Aug 18 21:14:29 2025 +0800 net: ethernet: qualcomm: Initialize PPE queue management for IPQ9574 QM (queue management) configurations decide the length of PPE queues and the queue depth for these queues which are used to drop packets in events of congestion. There are two types of PPE queues - unicast queues (0-255) and multicast queues (256-299). These queue types are used to forward different types of traffic, and are configured with different lengths. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-5-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 8a971df98c4ef73cbd3dd42cf4ecd0f8bc9d97f2 Author: Luo Jie Date: Mon Aug 18 21:14:28 2025 +0800 net: ethernet: qualcomm: Initialize PPE buffer management for IPQ9574 The BM (Buffer Management) config controls the pause frame generated on the PPE port. There are maximum 15 BM ports and 4 groups supported, all BM ports are assigned to group 0 by default. The number of hardware buffers configured for the port influence the threshold of the flow control for that port. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-4-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 353a0f1d5b27606b1f24185fd68c79b9ff4915db Author: Luo Jie Date: Mon Aug 18 21:14:27 2025 +0800 net: ethernet: qualcomm: Add PPE driver for IPQ9574 SoC The PPE (Packet Process Engine) hardware block is available on Qualcomm IPQ SoC that support PPE architecture, such as IPQ9574. The PPE in IPQ9574 includes six integrated Ethernet MAC for 6 PPE ports, buffer management, queue management and scheduler functions. The MACs can connect with the external PHY or switch devices using the UNIPHY PCS block available in the SoC. The PPE also includes various packet processing offload capabilities such as L3 routing and L2 bridging, VLAN and tunnel processing offload. It also includes Ethernet DMA function for transferring packets between ARM cores and PPE Ethernet ports. This patch adds the base source files and Makefiles for the PPE driver such as platform driver registration, clock initialization, and PPE reset routines. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-3-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 6b9f301985a35997338b0a0429859b49aff7f352 Author: Lei Wei Date: Mon Aug 18 21:14:26 2025 +0800 docs: networking: Add PPE driver documentation for Qualcomm IPQ9574 SoC Add description and high-level diagram for PPE, driver overview and module enable/debug information. Signed-off-by: Lei Wei Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-2-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 1898fc572118a65aa0d927dd5ff4b7e1a0140ddd Author: Luo Jie Date: Mon Aug 18 21:14:25 2025 +0800 dt-bindings: net: Add PPE for Qualcomm IPQ9574 SoC The PPE (packet process engine) hardware block is available in Qualcomm IPQ chipsets that support PPE architecture, such as IPQ9574. The PPE in the IPQ9574 SoC includes six Ethernet ports (6 GMAC and 6 XGMAC), which are used to connect with external PHY devices by PCS. It includes an L2 switch function for bridging packets among the 6 Ethernet ports and the CPU port. The CPU port enables packet transfer between the Ethernet ports and the ARM cores in the SoC, using the Ethernet DMA. The PPE also includes packet processing offload capabilities for various networking functions such as route and bridge flows, VLANs, different tunnel protocols and VPN. The PPE switch is modeled according to the Ethernet switch schema, with additional properties defined for the switch node for interrupts, clocks, resets, interconnects and Ethernet DMA. The switch port node is extended with additional properties for clocks and resets. Reviewed-by: Rob Herring (Arm) Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250818-qcom_ipq_ppe-v8-1-1d4ff641fce9@quicinc.com Signed-off-by: Paolo Abeni commit 4593311290006793a38a9cbd91d4a65b63cd7b76 Author: Uros Bizjak Date: Tue Aug 19 10:57:50 2025 +0200 crypto: X86 - Remove CONFIG_AS_VAES Current minimum required version of binutils is 2.30, which supports VAES instruction mnemonics. Remove check for assembler support of VAES instructions and all relevant macros for conditional compilation. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Acked-by: Herbert Xu Link: https://lore.kernel.org/20250819085855.333380-2-ubizjak@gmail.com commit e7d1ce96f149d70b3cc75cdf9ac529cf91e9c564 Merge: 5d0702dc9c2f67 d2d7a96b29ea6a Author: Ulf Hansson Date: Thu Aug 21 11:08:21 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit d051b1f9df3470bbd74eab7d80845b022ca089b2 Merge: 38dad812bb5006 5a774b64cd6a00 Author: Paolo Abeni Date: Thu Aug 21 10:42:32 2025 +0200 Merge branch 'net-phy-micrel-add-support-for-lan8842' Horatiu Vultur says: ==================== net: phy: micrel: Add support for lan8842 Add support for LAN8842 which supports industry-standard SGMII. While add this the first 3 patches in the series cleans more the driver, they should not introduce any functional changes. ==================== Link: https://patch.msgid.link/20250818075121.1298170-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 5a774b64cd6a008f016119782a5d3f30ed0bf3b7 Author: Horatiu Vultur Date: Mon Aug 18 09:51:21 2025 +0200 net: phy: micrel: Add support for lan8842 The LAN8842 is a low-power, single port triple-speed (10BASE-T/ 100BASE-TX/ 1000BASE-T) ethernet physical layer transceiver (PHY) that supports transmission and reception of data on standard CAT-5, as well as CAT-5e and CAT-6, Unshielded Twisted Pair (UTP) cables. The LAN8842 supports industry-standard SGMII (Serial Gigabit Media Independent Interface) providing chip-to-chip connection to a Gigabit Ethernet MAC using a single serialized link (differential pair) in each direction. There are 2 variants of the lan8842. The one that supports timestamping (lan8842) and one that doesn't have timestamping (lan8832). Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250818075121.1298170-5-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit d471793a9b67bbe3d7198ff695004190fd7b6bc7 Author: Horatiu Vultur Date: Mon Aug 18 09:51:20 2025 +0200 net: phy: micrel: Replace hardcoded pages with defines The functions lan_*_page_reg gets as a second parameter the page where the register is. In all the functions the page was hardcoded. Replace the hardcoded values with defines to make it more clear what are those parameters. Reviewed-by: Russell King (Oracle) Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250818075121.1298170-4-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit a0de636ed7a264a329c6a9c7d50727af02138536 Author: Horatiu Vultur Date: Mon Aug 18 09:51:19 2025 +0200 net: phy: micrel: Introduce lanphy_modify_page_reg As the name suggests this function modifies the register in an extended page. It has the same parameters as phy_modify_mmd. This function was introduce because there are many places in the code where the registers was read then the value was modified and written back. So replace all this code with this function to make it clear. Reviewed-by: Russell King (Oracle) Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250818075121.1298170-3-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 54e974c71524c1bc2c5f158d9178b9c3e999e1be Author: Horatiu Vultur Date: Mon Aug 18 09:51:18 2025 +0200 net: phy: micrel: Start using PHY_ID_MATCH_MODEL Start using PHY_ID_MATCH_MODEL for all the drivers. While at this add also PHY_ID_KSZ8041RNLI to micrel_tbl. It is safe to change the current of 0x00fffff0 to PHY_ID_MATCH_MODEL because all the micrel PHYs have in MSB a value of 0. Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250818075121.1298170-2-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 278033a225e13ec21900f0a92b8351658f5377f2 Author: Lichen Liu Date: Fri Aug 15 20:14:59 2025 +0800 fs: Add 'initramfs_options' to set initramfs mount options When CONFIG_TMPFS is enabled, the initial root filesystem is a tmpfs. By default, a tmpfs mount is limited to using 50% of the available RAM for its content. This can be problematic in memory-constrained environments, particularly during a kdump capture. In a kdump scenario, the capture kernel boots with a limited amount of memory specified by the 'crashkernel' parameter. If the initramfs is large, it may fail to unpack into the tmpfs rootfs due to insufficient space. This is because to get X MB of usable space in tmpfs, 2*X MB of memory must be available for the mount. This leads to an OOM failure during the early boot process, preventing a successful crash dump. This patch introduces a new kernel command-line parameter, initramfs_options, which allows passing specific mount options directly to the rootfs when it is first mounted. This gives users control over the rootfs behavior. For example, a user can now specify initramfs_options=size=75% to allow the tmpfs to use up to 75% of the available memory. This can significantly reduce the memory pressure for kdump. Consider a practical example: To unpack a 48MB initramfs, the tmpfs needs 48MB of usable space. With the default 50% limit, this requires a memory pool of 96MB to be available for the tmpfs mount. The total memory requirement is therefore approximately: 16MB (vmlinuz) + 48MB (loaded initramfs) + 48MB (unpacked kernel) + 96MB (for tmpfs) + 12MB (runtime overhead) ≈ 220MB. By using initramfs_options=size=75%, the memory pool required for the 48MB tmpfs is reduced to 48MB / 0.75 = 64MB. This reduces the total memory requirement by 32MB (96MB - 64MB), allowing the kdump to succeed with a smaller crashkernel size, such as 192MB. An alternative approach of reusing the existing rootflags parameter was considered. However, a new, dedicated initramfs_options parameter was chosen to avoid altering the current behavior of rootflags (which applies to the final root filesystem) and to prevent any potential regressions. Also add documentation for the new kernel parameter "initramfs_options" This approach is inspired by prior discussions and patches on the topic. Ref: https://www.lightofdawn.org/blog/?viewDetailed=00128 Ref: https://landley.net/notes-2015.html#01-01-2015 Ref: https://lkml.org/lkml/2021/6/29/783 Ref: https://www.kernel.org/doc/html/latest/filesystems/ramfs-rootfs-initramfs.html#what-is-rootfs Signed-off-by: Lichen Liu Link: https://lore.kernel.org/20250815121459.3391223-1-lichliu@redhat.com Tested-by: Rob Landley Signed-off-by: Christian Brauner commit 38dad812bb500648dc14a0733b293d5b778750e6 Merge: 833e43171b00ca 40653f280b2640 Author: Paolo Abeni Date: Thu Aug 21 10:18:46 2025 +0200 Merge tag 'mlx5-next-vhca-id' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Saeed Mahameed says: ==================== mlx5-next-vhca-id A preparation patchset for adjacent function vports. Adjacent functions can delegate their SR-IOV VFs to sibling PFs, allowing for more flexible and scalable management in multi-host and ECPF-to-host scenarios. Adjacent vports can be managed by the management PF via their unique vhca id and can't be managed by function index as the index can conflict with the local vports/vfs. This series provides: - Use the cached vcha id instead of querying it every time from fw - Query hca cap using vhca id instead of function id when FW supports it - Add HW capabilities and required definitions for adjacent function vports * tag 'mlx5-next-vhca-id' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: {rdma,net}/mlx5: export mlx5_vport_get_vhca_id net/mlx5: E-Switch, Set/Query hca cap via vhca id net/mlx5: E-Switch, Cache vport vhca id on first cap query net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports ==================== Link: https://patch.msgid.link/20250815194901.298689-1-saeed@kernel.org Signed-off-by: Paolo Abeni commit 833e43171b00caef456a7128718e43453f77b2e7 Author: Thorsten Blum Date: Fri Aug 15 17:33:33 2025 +0200 net: pktgen: Use min()/min_t() to improve pktgen_finalize_skb() Use min() and min_t() to improve pktgen_finalize_skb() and avoid calculating 'datalen / frags' twice. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250815153334.295431-3-thorsten.blum@linux.dev Signed-off-by: Paolo Abeni commit 9db115e231a665e82429ea63e2efda4abd4390fe Author: Wolfgang Birkner Date: Tue Jul 15 16:13:10 2025 +0200 ARM: dts: imx6ulz-bsh-smm-m2: fix resume via console Despite the current configuration being compliant with the technical reference manual (TRM), testing on the system showed that resuming from suspend via UART4 (used as the console) fails unless any other UART is also enabled. In our use case, UART2 is enabled to ensure reliable resume when UART4 is used as the console. Signed-off-by: Wolfgang Birkner Signed-off-by: Dario Binacchi Acked-by: Peng Fan Signed-off-by: Shawn Guo commit 5bf5090bbfb611b30d3d8d896853640c946833ed Author: Laurentiu Mihalcea Date: Mon Jul 14 11:13:46 2025 -0400 arm64: dts: imx: add dts for the imx8ulp evk9 board Add DTS for the i.MX8ULP EVK9 board. Some notable differences from the i.MX8ULP EVK board include: 1) M.2 header uses SAI6 instead of SAI5. 2) Ethernet transceiver chip (KSZ8081RNB) uses different pads. 3) USB0 ID/OC signals are tied to different pads. 4) USB1 ID/OC signals are tied to different pads. 5) EVK9 board integrates the 9.4x9.4mm SoC package, while the EVK board integrates the 15x15mm package. Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 74403d260a4b5c12c15c1862c3df5b17b803549a Author: Laurentiu Mihalcea Date: Mon Jul 14 11:13:45 2025 -0400 dt-bindings: arm: fsl: add i.MX8ULP EVK9 board Add DT compatible string for the i.MX8ULP EVK9 board. Signed-off-by: Laurentiu Mihalcea Acked-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 411053cb6657a3cf8db50a2d004a112070ca14b2 Author: Fabio Estevam Date: Tue Aug 19 09:13:44 2025 -0300 dt-bindings: w1: imx: Add an entry for the interrupts property There is an interrupt line connected to the one-wire block on the i.MX51 and i.MX53. Add an entry for the interrupt property to avoid the following dt-schema warning: 'interrupts' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250819121344.2765940-1-festevam@gmail.com Signed-off-by: Krzysztof Kozlowski commit 706c3c02eecd41dc675e9102b3719661cd3e30e2 Author: Xichao Zhao Date: Tue Aug 19 20:09:27 2025 +0800 tty: serial: Modify the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Make the following two changes: (1) Replace -ENOMEM with -ENOSPC in max3100_probe(). (2) Just return -ENOMEM instead in max310x_probe(). Signed-off-by: Xichao Zhao Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250819120927.607744-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit d15fbd3ea75bc893b46e9f4df6f9469db0f93897 Author: Xichao Zhao Date: Tue Aug 19 19:24:51 2025 +0800 usb: typec: mux: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Romain Gantois Link: https://lore.kernel.org/r/20250819112451.587817-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 1f43a3401debb9d06aa434ec6fecae676963d6f3 Author: Qianfeng Rong Date: Tue Aug 19 17:01:24 2025 +0800 usb: typec: qcom-pmic-typec: use kcalloc() instead of kzalloc() Replace devm_kzalloc() with devm_kcalloc() in qcom_pmic_typec_pdphy_probe() and qcom_pmic_typec_port_probe() for safer memory allocation with built-in overflow protection. Signed-off-by: Qianfeng Rong Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250819090125.540682-1-rongqianfeng@vivo.com Signed-off-by: Greg Kroah-Hartman commit 11c09b55b3d36f5cfa15873e2e0f1e04166bcfd4 Author: Suraj Kandpal Date: Tue Aug 19 21:34:39 2025 +0530 drm/i915/backlight: Fix divide by 0 error in i9xx_set_backlight pwm_level_max maybe 0 we do throw a warning but move ahead with execution which may later cause a /0 error. --v2 -return if the warn_on gets hit [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250819160438.145734-1-suraj.kandpal@intel.com commit 136d029662cdde77d3e4db5c07de655f35f0239f Author: Rakuram Eswaran Date: Wed Aug 20 21:56:13 2025 +0530 Documentation/staging: Fix typo and incorrect citation in crc32.rst In Documentation/staging/crc32.rst, below errors have been corrected: 1. Line 37: from "to being" to "to bring" 2. Line 119: Incorrect citation date: It must be August 1988 instead of August 1998 Signed-off-by: Rakuram Eswaran Link: https://lore.kernel.org/r/20250820162615.6942-1-rakuram.e96@gmail.com Signed-off-by: Eric Biggers commit 62a2b3502573091dc5de3f9acd9e47f4b5aac9a1 Author: Yury Norov (NVIDIA) Date: Mon Aug 18 13:28:05 2025 -0400 net: openvswitch: Use for_each_cpu() where appropriate Due to legacy reasons, openswitch code opencodes for_each_cpu() to make sure that CPU0 is always considered. Since commit c4b2bf6b4a35 ("openvswitch: Optimize operations for OvS flow_stats."), the corresponding flow->cpu_used_mask is initialized such that CPU0 is explicitly set. So, switch the code to using plain for_each_cpu(). Suggested-by: Ilya Maximets Signed-off-by: Yury Norov (NVIDIA) Acked-by: Ilya Maximets Link: https://patch.msgid.link/20250818172806.189325-1-yury.norov@gmail.com Signed-off-by: Jakub Kicinski commit a5c10aa3d1ba643385534b5d40c8a67497f904b6 Author: Kuniyuki Iwashima Date: Tue Aug 19 23:14:57 2025 +0000 selftests/net: packetdrill: Support single protocol test. Currently, we cannot write IPv4 or IPv6 specific packetdrill tests as ksft_runner.sh runs each .pkt file for both protocols. Let's support single protocol test by checking --ip_version in the .pkt file. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250819231527.1427361-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a6d4f25888b83b8300aef28d9ee22765c1cc9b34 Author: Eric Dumazet Date: Tue Aug 19 17:40:30 2025 +0000 net: set net.core.rmem_max and net.core.wmem_max to 4 MB SO_RCVBUF and SO_SNDBUF have limited range today, unless distros or system admins change rmem_max and wmem_max. Even iproute2 uses 1 MB SO_RCVBUF which is capped by the kernel. Decouple [rw]mem_max and [rw]mem_default and increase [rw]mem_max to 4 MB. Before: $ sysctl net.core.rmem_default net.core.rmem_max net.core.wmem_default net.core.wmem_max net.core.rmem_default = 212992 net.core.rmem_max = 212992 net.core.wmem_default = 212992 net.core.wmem_max = 212992 After: $ sysctl net.core.rmem_default net.core.rmem_max net.core.wmem_default net.core.wmem_max net.core.rmem_default = 212992 net.core.rmem_max = 4194304 net.core.wmem_default = 212992 net.core.wmem_max = 4194304 Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250819174030.1986278-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2a2e6e53756fe476f8e3237fc66e37d5431757cf Merge: 781bf2cc0616d4 5be7cb805bd9a6 Author: Jakub Kicinski Date: Wed Aug 20 19:34:11 2025 -0700 Merge branch 'bnxt_en-updates-for-net-next' Michael Chan says: ==================== bnxt_en: Updates for net-next The first patch is the FW interface update, followed by 3 patches to support the expanded pcie v2 structure for ethtool -d. The last patch adds a Hyper-V PCI ID for the 5760X chips (Thor2). v1: https://lore.kernel.org/20250818004940.5663-1-michael.chan@broadcom.com ==================== Link: https://patch.msgid.link/20250819163919.104075-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5be7cb805bd9a6680b863a1477dbc6e7986cc223 Author: Pavan Chebbi Date: Tue Aug 19 09:39:19 2025 -0700 bnxt_en: Add Hyper-V VF ID VFs of the P7 chip family created by Hyper-V will have the device ID of 0x181b. Reviewed-by: Somnath Kotur Reviewed-by: Kalesh AP Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250819163919.104075-6-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5a4cf42322a0260c7391a3e64d288861e43de673 Author: Shruti Parab Date: Tue Aug 19 09:39:18 2025 -0700 bnxt_en: Add pcie_ctx_v2 support for ethtool -d Add support to dump the expanded v2 struct that contains PCIE read/write latency and credit histogram data. Reviewed-by: Kalesh AP Reviewed-by: Andy Gospodarek Signed-off-by: Shruti Parab Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250819163919.104075-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit b530173d3c8adbe2921240cd3bce06053ab47d27 Author: Shruti Parab Date: Tue Aug 19 09:39:17 2025 -0700 bnxt_en: Add pcie_stat_len to struct bp Add this length field to capture the length of the pcie stats structure supported by the FW. This length will be determined in bnxt_ethtool_init(). The minimum of this FW length and the length known to the driver will determine the actual ethtool -d length. Suggested-by: Kalesh AP Reviewed-by: Andy Gospodarek Reviewed-by: Kalesh AP Signed-off-by: Shruti Parab Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250819163919.104075-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 1cc174d33a1f9acfd840014b6ded874aa12edc6c Author: Shruti Parab Date: Tue Aug 19 09:39:16 2025 -0700 bnxt_en: Refactor bnxt_get_regs() Separate the code that sends the FW message to retrieve pcie stats into a new helper function. The caller of the helper will call hwrm_req_hold() beforehand and so the caller will call hwrm_req_drop() in all cases afterwards. This helper will be useful when adding the support for the larger struct pcie_ctx_hw_stats_v2. Signed-off-by: Shruti Parab Signed-off-by: Michael Chan Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20250819163919.104075-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5f8a4f34f6dcf4b64c3cbcfd4aa5a8d7dbcd268d Author: Michael Chan Date: Tue Aug 19 09:39:15 2025 -0700 bnxt_en: hsi: Update FW interface to 1.10.3.133 The major change is struct pcie_ctx_hw_stats_v2 which has new latency histograms added. Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250819163919.104075-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 781bf2cc0616d44cc4a63bab3664a54b221bdc14 Author: Hangbin Liu Date: Tue Aug 19 07:47:49 2025 +0000 selftests: rtnetlink: print device info on preferred_lft test failure Even with slowwait used to avoid system sleep in the preferred_lft test, failures can still occur after long runtimes. Print the device address info when the test fails to provide better troubleshooting data. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250819074749.388064-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit eacb6e408dc861fb93baf10d6837204a3b39e915 Author: Hangbin Liu Date: Tue Aug 19 07:33:48 2025 +0000 selftests: net: bpf_offload: print loaded programs on mismatch The test sometimes fails due to an unexpected number of loaded programs. e.g FAIL: 2 BPF programs loaded, expected 1 File "/usr/libexec/kselftests/net/./bpf_offload.py", line 940, in progs = bpftool_prog_list(expected=1) File "/usr/libexec/kselftests/net/./bpf_offload.py", line 187, in bpftool_prog_list fail(True, "%d BPF programs loaded, expected %d" % File "/usr/libexec/kselftests/net/./bpf_offload.py", line 89, in fail tb = "".join(traceback.extract_stack().format()) However, the logs do not show which programs were actually loaded, making it difficult to debug the failure. Add printing of the loaded programs when a mismatch is detected to help troubleshoot such errors. The list is printed on a new line to avoid breaking the current log format. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250819073348.387972-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 6b4b1d577e1fe8a4e436a250e098b5c247d978d9 Author: Alex Tran Date: Mon Aug 18 19:52:27 2025 -0700 selftests/net/socket.c: removed warnings from unused returns socket.c: In function ‘run_tests’: socket.c:59:25: warning: ignoring return value of ‘strerror_r’ \ declared with attribute ‘warn_unused_result’ [-Wunused-result] 59 | strerror_r(-s->expect, err_string1, ERR_STRING_SZ); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ socket.c:60:25: warning: ignoring return value of ‘strerror_r’ \ declared with attribute ‘warn_unused_result’ [-Wunused-result] 60 | strerror_r(errno, err_string2, ERR_STRING_SZ); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ socket.c:73:33: warning: ignoring return value of ‘strerror_r’ \ declared with attribute ‘warn_unused_result’ [-Wunused-result] 73 | strerror_r(errno, err_string1, ERR_STRING_SZ); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ changelog: v2 - const char* messages and fixed patch warnings of max 75 chars per line Signed-off-by: Alex Tran Link: https://patch.msgid.link/20250819025227.239885-1-alex.t.tran@gmail.com Signed-off-by: Jakub Kicinski commit 8f2c72f2252cf228879de0224d5055470fc20c06 Author: Pengtao He Date: Tue Aug 19 10:15:51 2025 +0800 net: avoid one loop iteration in __skb_splice_bits If *len is equal to 0 at the beginning of __splice_segment it returns true directly. But when decreasing *len from a positive number to 0 in __splice_segment, it returns false. The __skb_splice_bits needs to call __splice_segment again. Recheck *len if it changes, return true in time. Reduce unnecessary calls to __splice_segment. Signed-off-by: Pengtao He Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250819021551.8361-1-hept.hept.hept@gmail.com Signed-off-by: Jakub Kicinski commit 5467e85508fd106443311eb7973ef588b4ef8bb6 Author: David Disseldorp Date: Tue Aug 19 13:05:50 2025 +1000 gen_init_cpio: add -a as reflink optimization As described in buffer-format.rst, the existing initramfs.c extraction logic works fine if the cpio filename field is padded out with trailing zeros, with a caveat that the padded namesize can't exceed PATH_MAX. Add filename zero-padding logic to gen_init_cpio, which can be triggered via the new -a parameter. Performance and storage utilization is improved for Btrfs and XFS workloads, as copy_file_range can reflink the entire source file into a filesystem block-size aligned destination offset within the cpio archive. Btrfs benchmarks run on 6.15.8-1-default (Tumbleweed) x86_64 host: > truncate --size=2G /tmp/backing.img > /sbin/mkfs.btrfs /tmp/backing.img ... Sector size: 4096 (CPU page size: 4096) ... > sudo mount /tmp/backing.img mnt > sudo chown $USER mnt > cd mnt mnt> dd if=/dev/urandom of=foo bs=1M count=20 && cat foo >/dev/null ... mnt> echo "file /foo foo 0755 0 0" > list mnt> perf stat -r 10 gen_init_cpio -o unaligned_btrfs list ... 0.023496 +- 0.000472 seconds time elapsed ( +- 2.01% ) mnt> perf stat -r 10 gen_init_cpio -o aligned_btrfs -a 4096 list ... 0.0010010 +- 0.0000565 seconds time elapsed ( +- 5.65% ) mnt> /sbin/xfs_io -c "fiemap -v" unaligned_btrfs unaligned_btrfs: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..40967]: 695040..736007 40968 0x1 mnt> /sbin/xfs_io -c "fiemap -v" aligned_btrfs aligned_btrfs: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..7]: 26768..26775 8 0x0 1: [8..40967]: 269056..310015 40960 0x2000 2: [40968..40975]: 26776..26783 8 0x1 mnt> /sbin/btrfs fi du unaligned_btrfs aligned_btrfs Total Exclusive Set shared Filename 20.00MiB 20.00MiB 0.00B unaligned_btrfs 20.01MiB 8.00KiB 20.00MiB aligned_btrfs XFS benchmarks run on same host: > sudo umount mnt && rm /tmp/backing.img > truncate --size=2G /tmp/backing.img > /sbin/mkfs.xfs /tmp/backing.img ... = reflink=1 ... data = bsize=4096 blocks=524288, imaxpct=25 ... > sudo mount /tmp/backing.img mnt > sudo chown $USER mnt > cd mnt mnt> dd if=/dev/urandom of=foo bs=1M count=20 && cat foo >/dev/null ... mnt> echo "file /foo foo 0755 0 0" > list mnt> perf stat -r 10 gen_init_cpio -o unaligned_xfs list ... 0.011069 +- 0.000469 seconds time elapsed ( +- 4.24% ) mnt> perf stat -r 10 gen_init_cpio -o aligned_xfs -a 4096 list ... 0.001273 +- 0.000288 seconds time elapsed ( +- 22.60% ) mnt> /sbin/xfs_io -c "fiemap -v" unaligned_xfs unaligned_xfs: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..40967]: 106176..147143 40968 0x0 1: [40968..65023]: 147144..171199 24056 0x801 mnt> /sbin/xfs_io -c "fiemap -v" aligned_xfs aligned_xfs: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..7]: 120..127 8 0x0 1: [8..40967]: 192..41151 40960 0x2000 2: [40968..40975]: 236728..236735 8 0x0 3: [40976..106495]: 236736..302255 65520 0x801 The alignment is best-effort; a stderr message is printed if alignment can't be achieved due to PATH_MAX overrun, with fallback to non-padded filename. This allows it to still be useful for opportunistic alignment, e.g. on aarch64 Btrfs with 64K block-size. Alignment failure messages provide an indicator that reordering of the cpio-manifest may be beneficial. Archive read performance for reflinked initramfs images may suffer due to the effects of fragmentation, particularly on spinning disks. To mitigate excessive fragmentation, files with lengths less than data_align aren't padded. Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-8-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 7c1f14f6e8e7f288350faec02b3fbc25971da289 Author: David Disseldorp Date: Tue Aug 19 13:05:49 2025 +1000 docs: initramfs: file data alignment via name padding The existing cpio extraction logic reads (maximum PATH_MAX) name_len bytes from the archive into the collected name buffer and ensures that the trailing byte is a null-terminator. This allows the actual file name to be shorter than name_len, with the name string simply zero-terminated prior to the last byte. Initramfs generators, such as dracut-cpio[1], can take advantage of name zero-padding to align file data segments within the archive to filesystem block boundaries. Block boundary alignment may allow the copy_file_range syscall to reflink archive source and destination extents. Link: https://github.com/dracutdevs/dracut/commit/300e4b116c624bca1b9e7251708b1ae656fe9157 [1] Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-7-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 9135564db4904e82a3207bd2d134ca64ce618047 Author: David Disseldorp Date: Tue Aug 19 13:05:48 2025 +1000 gen_initramfs.sh: use gen_init_cpio -o parameter gen_init_cpio can now write to a file directly, so use it when gen_initramfs.sh is called with -o (e.g. usr/Makefile invocation). Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-6-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 348ff9e3c1cf1a4124be1c94937dfc131bf6be29 Author: David Disseldorp Date: Tue Aug 19 13:05:47 2025 +1000 gen_init_cpio: avoid duplicate strlen calls We determine the filename length for the cpio header, so shouldn't recalculate it when writing out the filename. Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-5-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 97169cd6d95b338f2dbf5d3154b7d2233fce7d8a Author: David Disseldorp Date: Tue Aug 19 13:05:46 2025 +1000 gen_init_cpio: attempt copy_file_range for file data The copy_file_range syscall can improve copy performance by cloning extents between cpio archive source and destination files. Existing read / write based copy logic is retained for fallback in case the copy_file_range syscall is unsupported or unavailable due to cross-filesystem EXDEV, etc. Clone or reflink, as opposed to copy, of source file extents into the output cpio archive may (e.g. on Btrfs and XFS) require alignment of the output to the filesystem block size. This could be achieved by inserting padding entries into the cpio archive manifest. Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-4-ddiss@suse.de Signed-off-by: Nathan Chancellor commit ae18b94099b04264b32e33b057114024bc72c993 Author: David Disseldorp Date: Tue Aug 19 13:05:45 2025 +1000 gen_init_cpio: support -o parameter This is another preparatory change to allow for reflink-optimized cpio archives with file data written / cloned via copy_file_range(). The output file is truncated prior to write, so that it maps to usr/gen_initramfs.sh usage. It may make sense to offer an append option in future, for easier archive concatenation. Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-3-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 1400227773201918f270dda48f20afcd613d9bc3 Author: David Disseldorp Date: Tue Aug 19 13:05:44 2025 +1000 gen_init_cpio: write to fd instead of stdout stream In preparation for more efficient archiving using copy_file_range(), switch from writing archive data to stdout to using STDOUT_FILENO and I/O via write(), dprintf(), etc. Basic I/O error handling is added to cover cases such as ENOSPC. Partial writes are treated as errors. Signed-off-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250819032607.28727-2-ddiss@suse.de Signed-off-by: Nathan Chancellor commit 1046be1db620d00eb390a94ac7b67109e0beeff5 Author: Gustavo Sousa Date: Mon Aug 18 15:15:47 2025 -0300 drm/xe: Use for_each_gt to define gt_count We are currently bumping gt_count as we define GTs for each tile. While that works with our current code, there are reasons to improve that: * That section of the code is dedicated to define each tile's set of GTs and their respective info. The gt_count can be seen as a device level property. While it is fair to bump it as we define each GT, we can also focus on the GT themselves and count after we are done with the definitions. * More *importantly*, gt_count should reflect the number of GTs that we would get when looping over them with for_each_gt(). Bumping gt_count the way we are currently doing makes that value not really connected to for_each_gt(). This could bite us in the future if in the loop gets extra checks that are not accounted for in each existing "gt_count++". As such, let's use for_each_gt() and extract the calculation of gt_count into a separate block, just after we define the set of GTs for each tile. Reviewed-by: Jonathan Cavitt Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250818-gt_count-improvements-v4-2-ee12870c6f57@intel.com Signed-off-by: Gustavo Sousa commit 97a18f8349423371650996fc506dfd6cc4d3e1ad Author: Gustavo Sousa Date: Mon Aug 18 15:15:46 2025 -0300 drm/xe: Probe for tile count during device info initialization The function mmio_multi_tile_setup() does not look like the proper location for probing for the number of existing tiles in the hardware. It should not be that function's responsibility and such information should instead be already available when it gets called. The fact that we need to adjust gt_count is a symptom of that. Move probing of available tile count to a dedicated function named xe_info_probe_tile_count() and call it from xe_info_init(), which seems like a more appropriate place for that. With that move, we no longer need to (and shouldn't) adjust gt_count as a part of xe_info_probe_tile_count(), as that field will be initialized later in xe_info_init(). v4: - Only probe for tile count if the default tile_count != 1 (just like was done in mmio_multi_tile_setup()). (CI) v3: - Unchanged. v2: - Use KUnit static stub so that we do not try to query hardware when running KUnit tests. (CI) - Tweak last paragraph of commit message to make it clearer. (Jonathan) Reviewed-by: Jonathan Cavitt Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250818-gt_count-improvements-v4-1-ee12870c6f57@intel.com Signed-off-by: Gustavo Sousa commit 907912c1daa7d87ec179ab35f6326e98233ae03a Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:29 2025 +0800 PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets The PCI capability/extended capability offsets are not guaranteed to be the same across all SoCs integrating the Cadence PCIe IP. Use the cdns_pcie_find_{ext}_capability() APIs to find the capabilities, which avoids hardcoding the offsets in the driver. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250813144529.303548-7-18255117159@163.com commit 18ac51ae9df925292a4d8ca6550a199924ae9e17 Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:28 2025 +0800 PCI: cadence: Implement capability search using PCI core APIs The PCI core now provides generic PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros to search for PCI capabilities, using config accessors we supply. Use them in the CDNS driver to add cdns_pcie_find_capability() and cdns_pcie_find_ext_capability() interfaces. Signed-off-by: Hans Zhang <18255117159@163.com> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250813144529.303548-6-18255117159@163.com commit 3a33020d22bff1650af59314b6faea7efb04bf89 Author: Hans Zhang <18255117159@163.com> Date: Tue Aug 19 22:58:28 2025 +0800 PCI: dwc: ep: Implement capability search using PCI core APIs The PCI core now provides generic PCI_FIND_NEXT_CAP() macros to search for PCI capabilities, using config accessors we supply. Use them in the DWC EP driver to implement dw_pcie_ep_find_capability() instead of duplicating the algorithm. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250819145828.438541-1-18255117159@163.com commit 78e097fbca719ce3dbca8f81a6c339a8e0e41d1c Author: Cryolitia PukNgae Date: Wed Aug 20 17:22:42 2025 +0800 libbpf: Add documentation to version and error API functions Add documentation for the following API functions: - libbpf_major_version() - libbpf_minor_version() - libbpf_version_string() - libbpf_strerror() Signed-off-by: Cryolitia PukNgae Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250820-libbpf-doc-1-v1-1-13841f25a134@uniontech.com commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc Author: Sungho Kim Date: Wed Aug 20 19:57:14 2025 +0900 PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call The error handling path in pci_p2pdma_add_resource() contains a bug in its `pgmap_free` label. Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`, which is a pointer to a member field within the `p2p_pgmap` struct, not the base pointer of the allocation. Correct the bug by passing the correct base pointer, `p2p_pgmap`, to devm_kfree(). Signed-off-by: Sungho Kim Signed-off-by: Bjorn Helgaas Reviewed-by: Logan Gunthorpe Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai commit f9a4c582e508c210d1e8e70493a69c6e5708476c Author: Hiago De Franco Date: Wed Aug 6 14:48:17 2025 -0300 remoteproc: k3: Remove remote processor mailbox ping As of today, pinging the remote processor during k3_rproc_request_mbox() does not have any functional effect. This behavior was originally based on the OMAP remoteproc driver, where the idea was to send messages such as suspend requests (among others) to the remote processor, but this was never upstreamed. Currently, the ping message has no effect in upstream usage and causes an unread message to remain in the mailbox, which ultimately prevents the system from entering suspend mode: Freezing remaining freezable tasks completed (elapsed 0.001 seconds) printk: Suspending console(s) (use no_console_suspend to debug) omap-mailbox 29000000.mailbox: fifo 1 has unexpected unread messages omap-mailbox 29000000.mailbox: PM: dpm_run_callback(): platform_pm_suspend returns -16 omap-mailbox 29000000.mailbox: PM: failed to suspend: error -16 The ping is only replied if the remote core firmware is capable of doing it, otherwise the unread message stays into the mailbox. Remove the ping and fix the suspend issue. Suggested-by: Andrew Davis Signed-off-by: Hiago De Franco Acked-by: Andrew Davis Link: https://lore.kernel.org/r/20250806-v1-fix-am62-hmp-suspend-v1-1-1c4a81bb5dde@toradex.com Signed-off-by: Mathieu Poirier commit c4c432dfb00fcb69d56cc9778f527cce71cec9bb Author: Shengjiu Wang Date: Tue Jul 22 15:52:25 2025 +0800 remoteproc: imx_dsp_rproc: Add support of recovery and coredump process When enabled FW recovery, but is broken because software reset is missed in this recovery flow. So move software reset from imx_dsp_runtime_resume() to .load() and clear memory before loading firmware to make recovery work. Add call rproc_coredump_set_elf_info() to initialize the elf info for coredump, otherwise coredump will report error "ELF class is not set". Fixes: ec0e5549f358 ("remoteproc: imx_dsp_rproc: Add remoteproc driver for DSP on i.MX") Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://lore.kernel.org/r/20250722075225.544319-1-shengjiu.wang@nxp.com Signed-off-by: Mathieu Poirier commit 865052d16a42a71679029d7545af809a63b42c66 Merge: 23d7a7e36f52f0 96bcb34df55f7f Author: Mark Brown Date: Wed Aug 20 20:07:12 2025 +0100 ASoC: Use kcalloc() instead of kzalloc() Merge series from Qianfeng Rong : Replace devm_kzalloc() with devm_kcalloc() in sound/soc. As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow. Using devm_kcalloc() provides built-in overflow protection, making the memory allocation safer when calculating the allocation size compared to explicit multiplication. [1]: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments commit d33b01d793d91e0c9db5a7360bab35da0cb8a453 Author: Akira Yokosawa Date: Wed Jul 23 17:59:10 2025 +0900 rcu: docs: Requirements.rst: Abide by conventions of kernel documentation Here is a list of conventions applied here: - Don't mark up function names, to be taken care of by the automarkup extension. Just say func(). - Instead of ".. code-block:: none", just say "::". - Mark inline literals by a pair of ``xxxx``. Don't use rust doc's dialect of `yyyy`. - Instead of emphasizing headings by **strong emphasis**, use sub-level title adornments, in this case "^^^^^^^^^^" and make them proper sub-sections under "Hotplug CPU". Signed-off-by: Akira Yokosawa Cc: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) Signed-off-by: Paul E. McKenney commit 820f8da73dfeccf32e7b6580b4c41d0d3e2c2e02 Author: Paul E. McKenney Date: Tue Jul 15 12:19:33 2025 -0700 doc: Add RCU guards to checklist.rst Also note that RCU guards can be easier to use. Signed-off-by: Paul E. McKenney commit 46e2c5d604c7de1083ddf7a5f53edcf2eb3f4d12 Author: Paul E. McKenney Date: Tue Jul 15 12:10:05 2025 -0700 doc: Update whatisRCU.rst for recent RCU API additions Bring this file kicking and screaming into the year 2025! [ paulmck: Apply feedback from Bagas Sanjaya. ] Signed-off-by: Paul E. McKenney commit a35da57357221a989e59ced9407ba4f2d4d6d2d2 Author: Uros Bizjak Date: Tue Aug 19 10:57:49 2025 +0200 crypto: x86 - Remove CONFIG_AS_GFNI Current minimum required version of binutils is 2.30, which supports GFNI instruction mnemonics. Remove check for assembler support of GFNI instructions and all relevant macros for conditional compilation. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Acked-by: Herbert Xu Link: https://lore.kernel.org/20250819085855.333380-1-ubizjak@gmail.com commit 23d7a7e36f52f03cefa67b73ed14d701100168bb Merge: 132e098ef9b607 c232495d28ca09 Author: Mark Brown Date: Wed Aug 20 18:51:37 2025 +0100 ASoC: dt-bindings: Convert TI TWL4030 sound Merge series from Jihed Chaibi : This series converts the legacy TXT bindings for the TI TWL4030 sound-related modules to the modern YAML DT schema format. This work was previously part of a larger series but is now being sent as a focused submission for the ASoC subsystem. commit f1a49c1b112b899643b01a5b86cf642a09a01cb6 Author: Jaegeuk Kim Date: Mon Aug 11 23:50:25 2025 +0000 f2fs: show the list of donation files This patch introduces a proc entry to show the currently enrolled donation files. - "File path" indicates a file. - "Status" a. "Donated" means the file is registed in the donation list by fadvise(offset, length, POSIX_FADV_NOREUSE) b. "Evicted" means the donated pages were reclaimed. - "Offset (kb)" and "Length (kb) show the registered donation range. - "Cached pages (kb)" shows the amount of cached pages in the inode page cache. For example, # of files : 2 File path Status Donation offset (kb) Donation size (kb) File cached size (kb) --- /local/test2 Donated 0 1048576 2097152 /local/test Evicted 0 1048576 1048576 Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ff11d8701b77e303593fd86cf9ef74ef3ac4048e Author: Chao Yu Date: Mon Aug 18 10:09:39 2025 +0800 f2fs: fix to allow removing qf_name The mount behavior changed after commit d18535132523 ("f2fs: separate the options parsing and options checking"), let's fix it. [Scripts] mkfs.f2fs -f /dev/vdb mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs quotacheck -uc /mnt/f2fs umount /mnt/f2fs mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs mount|grep f2fs mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs mount|grep f2fs dmesg [Before commit] mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... mount#2: ...,quota,jqfmt=vfsold,... kmsg: no output [After commit] mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... mount#2: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... kmsg: "user quota file already specified" [After patch] mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... mount#2: ...,quota,jqfmt=vfsold,... kmsg: "remove qf_name aquota.user" Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") Cc: Hongbo Li Signed-off-by: Chao Yu Reviewed-by: Hongbo Li Signed-off-by: Jaegeuk Kim commit 930a9a6ee8e7ffa20af4bffbfc2bbd21d83bf81c Author: Chao Yu Date: Mon Aug 18 10:09:38 2025 +0800 f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot reported a f2fs bug as below: Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)} RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284 Call Trace: f2fs_check_quota_consistency fs/f2fs/super.c:1188 [inline] f2fs_check_opt_consistency+0x1378/0x2c10 fs/f2fs/super.c:1436 __f2fs_remount fs/f2fs/super.c:2653 [inline] f2fs_reconfigure+0x482/0x1770 fs/f2fs/super.c:5297 reconfigure_super+0x224/0x890 fs/super.c:1077 do_remount fs/namespace.c:3314 [inline] path_mount+0xd18/0xfe0 fs/namespace.c:4112 do_mount fs/namespace.c:4133 [inline] __do_sys_mount fs/namespace.c:4344 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4321 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The direct reason is f2fs_check_quota_consistency() may suffer null-ptr-deref issue in strcmp(). The bug can be reproduced w/ below scripts: mkfs.f2fs -f /dev/vdb mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs quotacheck -uc /mnt/f2fs/ umount /mnt/f2fs mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs umount /mnt/f2fs So, before old_qname and new_qname comparison, we need to check whether they are all valid pointers, fix it. Reported-by: syzbot+d371efea57d5aeab877b@syzkaller.appspotmail.com Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") Closes: https://lore.kernel.org/linux-f2fs-devel/689ff889.050a0220.e29e5.0037.GAE@google.com Cc: Hongbo Li Signed-off-by: Chao Yu Reviewed-by: Hongbo Li Signed-off-by: Jaegeuk Kim commit 4978f0a5ee239e66b2633725ecc81d3b43c2a7a5 Author: Chao Yu Date: Mon Aug 11 19:41:23 2025 +0800 f2fs: clean up w/ get_left_section_blocks() Introduce get_left_section_blocks() for cleanup, no logic changes. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 248a99832499036b330d471336b8765ef0e14cb4 Author: Soham Metha Date: Wed Aug 13 01:45:15 2025 +0530 docs: f2fs: fixed spelling mistakes in documentation found/fixed the following typos - deivces -> devices - substracting -> subtracting in `Documentation/ABI/testing/sysfs-fs-f2fs` Signed-off-by: Soham Metha Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2141879369681ff899a6a0857eef8bded785a5b5 Author: Chunhai Guo Date: Thu Aug 7 21:35:01 2025 +0800 f2fs: add reserved nodes for privileged users This patch allows privileged users to reserve nodes via the 'reserve_node' mount option, which is similar to the existing 'reserve_root' option. "-o reserve_node=" means nodes are reserved for privileged users only. Signed-off-by: Chunhai Guo Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 00798cd24f014fe55cbcdfeac4bab19ad6cd2bcb Author: Liao Yuanhong Date: Fri Aug 8 17:48:01 2025 +0800 f2fs: Add bggc_io_aware to adjust the priority of BG_GC when issuing IO Currently, we have encountered some issues while testing ZUFS. In situations near the storage limit (e.g., 50GB remaining), and after simulating fragmentation by repeatedly writing and deleting data, we found that application installation and startup tests conducted after idling for a few minutes take significantly longer several times that of traditional UFS. Tracing the operations revealed that the majority of I/Os were issued by background GC, which blocks normal I/O operations. Under normal circumstances, ZUFS indeed requires more background GC and employs a more aggressive GC strategy. However, I aim to find a way to minimize the impact on regular I/O operations under these near-limit conditions. To address this, I have introduced a bggc_io_aware feature, which controls the prioritization of background GC in the presence of I/Os. This switch can be adjusted at the framework level to implement different strategies. If set to AWARE_ALL_IO, all background GC operations will be skipped during active I/O issuance. The default option remains consistent with the current strategy, ensuring no change in behavior. Signed-off-by: Liao Yuanhong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 80b6d1d2535a343e43d658777a46f1ebce8f3413 Author: Chao Yu Date: Thu Aug 7 12:00:26 2025 +0800 f2fs: dump more information for f2fs_{enable,disable}_checkpoint() Changes as below: - print more logs for f2fs_{enable,disable}_checkpoint() - account and dump time stats for f2fs_enable_checkpoint() Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4bc347779698b5e67e1514bab105c2c083e55502 Author: Chao Yu Date: Thu Aug 7 12:00:25 2025 +0800 f2fs: add timeout in f2fs_enable_checkpoint() During f2fs_enable_checkpoint() in remount(), if we flush a large amount of dirty pages into slow device, it may take long time which will block write IO, let's add a timeout machanism during dirty pages flush to avoid long time block in f2fs_enable_checkpoint(). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8fc6056dcf79937c46c97fa4996cda65956437a9 Author: Chao Yu Date: Thu Aug 7 10:44:31 2025 +0800 f2fs: fix to detect potential corrupted nid in free_nid_list As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2e8f4c2b2bb12fc3d40762f1bb778e95c6ddbc93 Author: Chao Yu Date: Thu Aug 7 09:48:35 2025 +0800 f2fs: fix to clear unusable_cap for checkpoint=enable mount -t f2fs -o checkpoint=disable:10% /dev/vdb /mnt/f2fs/ mount -t f2fs -o remount,checkpoint=enable /dev/vdb /mnt/f2fs/ kernel log: F2FS-fs (vdb): Adjust unusable cap for checkpoint=disable = 204440 / 10% If we has assigned checkpoint=enable mount option, unusable_cap{,_perc} parameters of checkpoint=disable should be reset, then calculation and log print could be avoid in adjust_unusable_cap_perc(). Fixes: 1ae18f71cb52 ("f2fs: fix checkpoint=disable:%u%%") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1daede86fef9e9890c5781541ad4934c776858c5 Author: Colin Ian King Date: Wed Jul 30 17:27:12 2025 +0100 dmaengine: ppc4xx: Remove space before newline There is a extraneous space before a newline in pr_err and dev_dbg messages. Remove the spaces. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250730162712.2086439-1-colin.i.king@gmail.com Signed-off-by: Vinod Koul commit c937969a503ebf45e0bebafee4122db22b0091bd Author: Anil S Keshavamurthy Date: Fri Aug 1 14:59:35 2025 -0700 dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms A new IAA device ID, 0xfd2d, is introduced across all Wildcat Lake family platforms. Add the device ID to the IDXD driver. Signed-off-by: Anil S Keshavamurthy Signed-off-by: Vinicius Costa Gomes Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250801215936.188555-1-vinicius.gomes@intel.com Signed-off-by: Vinod Koul commit 847164d47098f55e99503819300b36cca20cb4f7 Author: Thorsten Blum Date: Mon Aug 11 00:58:59 2025 +0200 dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() Replace memset(0) followed by strscpy() with strscpy_pad() to improve idxd_load_iaa_device_defaults(). This avoids zeroing the memory before copying the strings and ensures the destination buffers are only written to once, simplifying the code and improving efficiency. Signed-off-by: Thorsten Blum Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250810225858.2953-2-thorsten.blum@linux.dev Signed-off-by: Vinod Koul commit 7a430af7d135be5042f14987bce16f6b40a3f694 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:07 2025 -0500 dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" Add the undocumented NVIDIA APBDMA compatibles and "clock-names" which are already in use. There doesn't appear to be any per compatible differences. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250812203308.727731-1-robh@kernel.org Signed-off-by: Vinod Koul commit 72dd8b2914b5db1dccf902971c2ea6b541711b28 Author: Abin Joseph Date: Tue Jul 22 12:32:55 2025 +0530 dmaengine: zynqmp_dma: Add shutdown operation support Add shutdown callback to ensure that DMA operations are properly stopped and resources are released during system shutdown or kexec operations. Fix incorrect PM state handling in the remove function that was causing clock disable warnings during the shutdown operations, which was not implemented earlier. The original logic used pm_runtime_enabled() check after calling the pm_runtime_disable(), would always evaluate to true after the disable call, which leads to unconditionally calling the runtime_suspend regardless of the device's actual power state. During shutdown, the device may already be suspended with clock disabled from the autosuspend timer, causing the clock framework to warn about the double-disable attempt. The pm_runtime_active() function checks the actual device power state rather than the PM subsystem's enabled/disabled status. ensuring the runtime_suspend is only called when the device is in active power state. This prevents clock warnings during shutdown while maintaining proper cleanup during normal remove operations. Signed-off-by: Abin Joseph Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/20250722070255.28944-1-abin.joseph@amd.com Signed-off-by: Vinod Koul commit 4184f0190792aea06553af963741a24cc9b47689 Author: Chen-Yu Tsai Date: Wed Aug 13 01:59:27 2025 +0800 arm64: dts: allwinner: a527: cubie-a5e: Add LEDs The Radxa Cubie A5E has a 3-color LED. The green and blue LEDs are wired to GPIO pins on the SoC, and the green one is lit by default to serve as a power indicator. The red LED is wired to the M.2 slot. Add device nodes for the green and blue LEDs. A default "heartbeat" trigger is set for the green power LED, though in practice it might be better if it were inverted, i.e. lit most of the time. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20250812175927.2199219-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 38404274bbee1f0001a490c0dc98aac32a4d7c9d Author: Akhilesh Patil Date: Thu Jul 24 16:05:07 2025 +0530 phy: ingenic: use core driver model helper to handle probe errors Use core driver model helper dev_err_probe() defined at drivers/base/core.c in driver probe path to propagate errors. standardize and improve the code of deferred probe error handling using this helper for ingenic usb phy driver. Inspired by, commit a787e5400a1ce ("driver core: add device probe log helper") Signed-off-by: Akhilesh Patil Cc: Andrzej Hajda Link: https://lore.kernel.org/r/aIIMW971BYsIk4As@bhairav-test.ee.iitb.ac.in Signed-off-by: Vinod Koul commit ce489635960a6a3fcb0abe0918994f2d8deb02ed Author: Yongxing Mou Date: Wed Jul 30 15:27:25 2025 +0800 dt-bindings: phy: Add eDP PHY compatible for QCS8300 Add compatible string for the supported eDP PHY on QCS8300 platform. QCS8300 have the same eDP PHY with SA8775P. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yongxing Mou Link: https://lore.kernel.org/r/20250730072725.1433360-1-quic_yongmou@quicinc.com Signed-off-by: Vinod Koul commit 5f54134428b48261151c725c64b40be54e373345 Author: Lad Prabhakar Date: Fri Aug 8 22:52:09 2025 +0100 phy: renesas: rcar-gen3-usb2: Move debug print after register value is updated Relocate the debug print in rcar_gen3_enable_vbus_ctrl() to appear after the `val` variable is assigned and updated based on the VBUS state. This ensures that the debug log reflects the actual register value being written, improving debugging accuracy. Signed-off-by: Lad Prabhakar Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250808215209.3692744-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit b725741f1c21e8507a58ae86c5a80ca383f96852 Author: Lad Prabhakar Date: Fri Aug 8 22:52:08 2025 +0100 phy: renesas: rcar-gen3-usb2: Add support for RZ/T2H SoC Add initial support for the Renesas RZ/T2H SoC to the R-Car Gen3 USB2 PHY driver. The RZ/T2H SoC requires configuration of additional hardware-specific bits for proper VBUS level control and OTG operation. Introduce the `vblvl_ctrl` flag in the SoC-specific driver data to enable handling of VBUS level selection logic using `VBCTRL.VBLVL` bits. This is required for managing the VBUS status detection and drive logic based on SoC-specific needs. Signed-off-by: Lad Prabhakar Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250808215209.3692744-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit 4b7aa47e4c2c921b9511389bf42a4e30d64373e6 Author: Lad Prabhakar Date: Fri Aug 8 22:52:07 2025 +0100 phy: renesas: rcar-gen3-usb2: Allow SoC-specific OBINT bits via phy_data Update the PHY driver to support SoC-specific OBINT enable bits by introducing the `obint_enable_bits` field in the `rcar_gen3_phy_drv_data` structure. This allows each SoC to specify bits required. Signed-off-by: Lad Prabhakar Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250808215209.3692744-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit f75806d26318c08ddb79652cce89086e4da17257 Author: Lad Prabhakar Date: Fri Aug 8 22:52:06 2025 +0100 phy: renesas: rcar-gen3-usb2: store drvdata pointer in channel Store the SoC-specific driver data pointer (struct rcar_gen3_phy_drv_data) directly in struct rcar_gen3_chan instead of copying individual flags into separate channel members. Obtain the drvdata with of_device_get_match_data() in probe and assign it to channel->phy_data. Update all call sites to reference `channel->phy_data->*` for SoC-specific behaviour (for example no_adp_ctrl and utmi_ctrl). Remove the redundant soc_no_adp_ctrl and utmi_ctrl fields from struct rcar_gen3_chan. This simplifies the probe path, reduces duplication, and makes it easier to extend the driver with additional platform-specific fields in the future. Signed-off-by: Lad Prabhakar Link: https://lore.kernel.org/r/20250808215209.3692744-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit ab9c8aeb2d208381a7c948ea2f753cbe8a451502 Author: Lad Prabhakar Date: Fri Aug 8 22:52:05 2025 +0100 dt-bindings: phy: renesas,usb2-phy: Add RZ/T2H and RZ/N2H support Document the USB2 PHY controller for the Renesas RZ/T2H (r9a09g077) and RZ/N2H (r9a09g087) SoCs. These SoCs share the same PHY block, which is similar to the one on RZ/G2L but differs in clocks, resets, and register bits. To account for these differences, a new compatible string `renesas,usb2-phy-r9a09g077` is introduced. The RZ/N2H SoC uses the same PHY as RZ/T2H, so it reuses the RZ/T2H compatible string as a fallback. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250808215209.3692744-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit 896277138c1344cf9f5c415298f048ee29da274d Author: Neil Armstrong Date: Thu Aug 7 18:33:23 2025 +0200 phy: qcom: qmp-combo: register a typec mux to change the QMPPHY_MODE Register a typec mux in order to change the PHY mode on the Type-C mux events depending on the mode and the svid when in Altmode setup. The DisplayPort phy should be left enabled if is still powered on by the DRM DisplayPort controller, so bail out until the DisplayPort PHY is not powered off. The Type-C Mode/SVID only changes on plug/unplug, and USB SAFE states will be set in between of USB-Only, Combo and DisplayPort Only so this will leave enough time to the DRM DisplayPort controller to turn of the DisplayPort PHY. Signed-off-by: Neil Armstrong [konrad: renaming, rewording, bug fixes] Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-5-43272d6eca92@oss.qualcomm.com Signed-off-by: Vinod Koul commit dd331112c0adaebbc8fc767fc805da4a641576db Author: Neil Armstrong Date: Thu Aug 7 18:33:22 2025 +0200 phy: qcom: qmp-combo: introduce QMPPHY_MODE Introduce an enum for the QMP Combo PHY modes, use it in the QMP commmon phy init function and default to COMBO mode. Signed-off-by: Neil Armstrong [konrad: some renaming and rewording] Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-4-43272d6eca92@oss.qualcomm.com Signed-off-by: Vinod Koul commit 86390472554b2e8fb4cba16a139cade94be58f72 Author: Neil Armstrong Date: Thu Aug 7 18:33:21 2025 +0200 phy: qcom: qmp-combo: store DP phy power state Switching the PHY Mode requires the DisplayPort PHY to be powered off, keep track of the DisplayPort phy power state. Reviewed-by: Dmitry Baryshkov Signed-off-by: Neil Armstrong Signed-off-by: Konrad Dybcio Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-3-43272d6eca92@oss.qualcomm.com Signed-off-by: Vinod Koul commit 5daf1bbc73e249075373e030e7221f46c175e04b Author: Konrad Dybcio Date: Thu Aug 7 18:33:20 2025 +0200 phy: qcom: qmp-combo: Rename 'mode' to 'phy_mode' There are a numbers of ""modes"" involved: USB mode, Type-C mode (with its altmodes), phy_mode and QMP_PHY mode (DP/combo/USB/off). Rename the generic sounding 'mode' to 'phy_mode' to hopefully make the code easier to follow. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Reviewed-by: Neil Armstrong Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-2-43272d6eca92@oss.qualcomm.com Signed-off-by: Vinod Koul commit 3bad7fe22796a420c6e16b591c37ed1bd6cc2a30 Author: Neil Armstrong Date: Thu Aug 7 18:33:19 2025 +0200 dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp: Reference usb-switch.yaml to allow mode-switch The QMP USB3/DP Combo PHY can work in 3 modes: - DisplayPort Only - USB3 Only - USB3 + DisplayPort Combo mode In order to switch between those modes, the PHY needs to receive Type-C events, allow marking to the phy with the mode-switch property in order to allow the PHY to Type-C events. Reference usb-switch.yaml as a simpler way to allow the mode-switch property instead of duplicating the property definition. Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Tested-by: Neil Armstrong # on Lenovo Thinkpad T14S Link: https://lore.kernel.org/r/20250807-topic-4ln_dp_respin-v4-1-43272d6eca92@oss.qualcomm.com Signed-off-by: Vinod Koul commit a8f9de937dbf7bdabda72bd0c51e201e550129c2 Author: Chen Ni Date: Thu Aug 14 09:39:43 2025 +0800 phy: rockchip: naneng-combphy: Convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250814013943.2905307-1-nichen@iscas.ac.cn Signed-off-by: Vinod Koul commit 5d0702dc9c2f6700140b7366dd9ec6c78cde3aa1 Author: Biju Das Date: Wed Aug 20 11:48:01 2025 +0100 mmc: renesas_sdhi: Replace magic number '0xff' in renesas_sdhi_set_clock() Replace the magic number '0xff' with CLK_CTL_DIV_MASK macro for finding actual clock in renesas_sdhi_set_clock(). Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250820104808.94562-1-biju.das.jz@bp.renesas.com Signed-off-by: Ulf Hansson commit dd7ddd082206f675e967c205df2a35b9c4e64949 Author: Nathan Chancellor Date: Tue Aug 19 10:28:49 2025 -0700 mmc: sdhci-cadence: Fix -Wuninitialized in sdhci_cdns_tune_blkgap() Clang warns (or errors with CONFIG_WERROR=y): drivers/mmc/host/sdhci-cadence.c:297:9: error: variable 'hrs37_mode' is uninitialized when used here [-Werror,-Wuninitialized] 297 | writel(hrs37_mode, hrs37_reg); | ^~~~~~~~~~ drivers/mmc/host/sdhci-cadence.c:291:16: note: initialize the variable 'hrs37_mode' to silence this warning 291 | u32 hrs37_mode; | ^ | = 0 A previous revision assigned SDHCI_CDNS_HRS37_MODE_MMC_HS200 to hrs37_mode in a switch statement but the final revision moved to a simple if statement. Pass that as the value to writel() and remove hrs37_mode, clearing up the warning. Fixes: 60613a8b9b81 ("mmc: sdhci-cadence: implement multi-block read gap tuning") Signed-off-by: Nathan Chancellor Tested-by: Benoît Monin Link: https://lore.kernel.org/r/20250819-mmc-sdhci-cadence-fix-uninit-hrs37_mode-v1-1-94aa2d0c438a@kernel.org Signed-off-by: Ulf Hansson commit 03777dbd8c9d825fc6f792e4e85be9e4ce4c7f8f Author: Lukas Bulwahn Date: Wed Jul 23 09:12:11 2025 +0200 x86/kconfig: Drop unused and needless config X86_64_SMP As part of 38a4968b3190 ("x86/percpu/64: Remove INIT_PER_CPU macros"), the only use of the config option X86_64_SMP in the kernel tree is removed. As this config option X86_64_SMP is just equivalent to X86_64 && SMP, the source code in the tree just uses that expression in the few places where needed. Note further that this option cannot be explicitly enabled or disabled when configuring the kernel build configuration. Drop this needless and unused config option. No functional change. Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250723071211.622802-1-lukas.bulwahn@redhat.com commit e1e1e77f7df7cbee959ba024e5475907fe561c98 Author: Wolfram Sang Date: Wed Aug 13 18:14:58 2025 +0200 phy: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-13-wsa+renesas@sang-engineering.com Signed-off-by: Vinod Koul commit 776cc2ec155cfc066087436a6afc86fe52bd5365 Author: Jiri Slaby (SUSE) Date: Wed Jul 23 08:26:31 2025 +0200 EDAC/altera: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Acked-by: Dinh Nguyen Link: https://lore.kernel.org/20250723062631.1830757-1-jirislaby@kernel.org commit 75c21418beb92382dda164fdc2554610b49ed441 Author: Andre Przywara Date: Tue Aug 19 01:15:22 2025 +0100 phy: sun4i-usb: drop num_phys assumption So far we set a number of expected Allwinner USB PHY instances for any given compatible string, and would fail if we do not find every PHY described properly in the DT (missing reset/PMU/clocks). This is somewhat redundant, as the DT only describes the resources for the implemented PHYs, but goes in line with being strict about firmware descriptions, and rather fixing things in the driver code, based on the compatible string. However this causes issues when we make a mistake, like we did recently on the A523: there are actually three USB PHYs, not two, as we assumed. Changing the number in the driver and the compatible string would cause all kinds of compatibility issues, both with older and newer DTs. To avoid problems with newer kernels and older or newer DTs, we can change the driver code to deduce the number of PHY instances from what's described in the DT. This has the added advantage of not requiring new compatible strings for new SoCs when just the number of PHYs change, which already happened and might occur again in the future. Drop the num_phys member from the config struct, and remove the fixed number of PHYs from each SoC's config description. Then enumerate the usb_reset properties for all of the maximum four PHY instances, and just stop once we cannot find such a property anymore. The binding describes the reset property as mandatory for each PHY instance, and each DT in the kernel tree matches exactly the num_phys value in the current driver code, so we can rely on that. Apart from being more future proof, this will solve the A523 mishap: Older DTs would just describe two PHYs, whereas newer ones would feature all three of them. In any case we would get a valid number, matching the other nodes in the DT. Older kernels would always enumerate two PHYs, which at least does not cause any regressions. Signed-off-by: Andre Przywara Link: https://lore.kernel.org/r/20250819001522.13011-1-andre.przywara@arm.com Signed-off-by: Vinod Koul commit 6627be03d3e1195b22172554191365378c3460e7 Author: Nitin Gote Date: Tue Aug 19 11:41:51 2025 +0530 drm/xe/tuning: Apply "Disable NULL query for Anyhit Shader" to Xe2 Extend the "Disable NULL query for Anyhit Shader" tuning to Xe2 (graphics version 2000+) platforms, in addition to Xe3. This sets the DIS_NULL_QUERY bit in RT_CTRL to disable null query for Anyhit shaders on both Xe2 and Xe3. This is a change in behavior that can regress a userspace not prepared for it. However it's not feasible to change dynamically the option per client or per exec queue via an opt-in flag. Mesa is already prepared for that and it got propagated to their stable versions. Even if it was possible, at this point adding a flag would mean mesa would also need to propagate such a flag to their stable versions, otherwise the previous fix would not be used. Signed-off-by: Nitin Gote Acked-by: Tapani Pälli Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35044 Reviewed-by: Lucas De Marchi Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35044 Link: https://lore.kernel.org/r/20250819061151.1272622-1-nitin.r.gote@intel.com Signed-off-by: Lucas De Marchi commit 043d9c6928b010be7902a01b5cdfa7d754535b1a Author: Hsin-Yi Wang Date: Tue Aug 12 16:17:59 2025 +0800 drm/bridge: anx7625: register content protect property Set the `support_hdcp` bit to enable the connector to register content protection during initialization. Signed-off-by: Hsin-Yi Wang Reviewed-by: Sean Paul Signed-off-by: Fei Shao Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250812082135.3351172-3-fshao@chromium.org commit 407a2fab3c99c40ad1acedaf028e8222da1f0433 Author: Hsin-Yi Wang Date: Tue Aug 12 16:17:58 2025 +0800 drm_bridge: register content protect property Some bridges can update HDCP status based on userspace requests if they support HDCP. The HDCP property is created after connector initialization and before registration, just like other connector properties. Add the content protection property to the connector if a bridge supports HDCP. Signed-off-by: Hsin-Yi Wang Reviewed-by: Sean Paul Signed-off-by: Fei Shao Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250812082135.3351172-2-fshao@chromium.org commit 669bc57e7016cf9d1a9eedb2a984c4fb4fd67f3d Author: Juergen Christ Date: Mon Aug 11 17:22:53 2025 +0200 s390/bitops: Optimize inlining GCC inlining heuristics prevent code growth due to inlining into cold paths. This causes GCC to emit a partially specialized version of __flogr for non-constant input for all occurrences on cold paths. This happens since the overhead seen during inlining includes setting up a union register_pair, calling flogr, and extracting and casting the result. This overhead is not removed until the function is lowered into RTL. But this happens after inlining. For -ftrivial-var-auto-init=zero builds, an additional initialization of the union register_pair adds another statement to be inlinined. This is unneeded since the even register is initialized anyway and the odd register is not an input register. It is only marked as such since the whole pair has to be marked as a read/write output register. Mark the union register_pair as uninitialized to get rid of this statement. This, however, does not change the code since the initialization happens when part of the register pair is written. Nevertheless, GCC function size approximation during inlining is reduced by one statement. Force inlining of flogr and also flatten some other functions that should be leaf functions but are called in cold context, like, e.g., __init functions. Acked-by: Heiko Carstens Signed-off-by: Juergen Christ Signed-off-by: Alexander Gordeev commit de88e74889a30bd9ff4047726021cde857348b4b Author: Heiko Carstens Date: Mon Aug 4 17:08:54 2025 +0200 s390/bitops: Slightly optimize ffs() and fls64() Use a simpler algorithm to calculate the result of ffs() and fls64(). This generates slightly better code and increases readability. Kernel image size is reduced by ~3kb (gcc 15.1.0 + defconfig). Suggested-by: Nina Schoetterl-Glausch Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit f9de6cdf4cf8c932ee94f6e25cd7434a97c78bf3 Author: Sumanth Korikkar Date: Fri Aug 8 14:46:44 2025 +0200 s390/sclp: Move memory hotplug code for better modularity To improve readability and prepare for future extensions, move the memory hotplug code to a separate file. In addtion to it, add required headers in sclp_mem.c and remove unnecessary headers in sclp_cmd.c Acked-by: Heiko Carstens Signed-off-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit efe89a30f70753d861340a20365812e93d34a0de Author: Sumanth Korikkar Date: Fri Aug 8 14:46:43 2025 +0200 s390/sclp: Refactor sclp_cmd.c To improve readability, refactor sclp_cmd.c: * Move defines and structures to the beginning. * Reverse x-mas tree usage. * Remove spaces after casting to eliminate checkpatch warnings. * Remove unnecessary comments. * Reframe certain comments. * Convert all unsigned long long to unsigned long since unsigned long long is a leftover from the 31/32-bit era. * Use correct format specifiers. * Add braces to for loops with bodies containing more than one line. * Sort header files and remove unnecessary ones. * Use __packed and __aligned instead of __attribute((packed, aligned(8))) in structures. Acked-by: Heiko Carstens Signed-off-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit c232495d28ca092d0c39b10e35d3d613bd2414ab Author: Jihed Chaibi Date: Tue Aug 19 22:13:02 2025 +0200 ASoC: dt-bindings: omap-twl4030: convert to DT schema Convert the legacy TXT binding for the OMAP TWL4030 sound card to the modern YAML DT schema format. This adds formal validation and improves documentation. Acked-by: Mark Brown Signed-off-by: Jihed Chaibi Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250819201302.80712-3-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 04113322406b4763677922f80ba5ab44a8dae7bb Author: Jihed Chaibi Date: Tue Aug 19 22:13:01 2025 +0200 ASoC: dt-bindings: ti,twl4030-audio: convert to DT schema Convert the TWL4030 audio module bindings from txt to YAML format and move them to the sound subsystem bindings directory. This patch also refines the schema by adding an enum constraint for ti,enable-vibra and updates the example to remove irrelevant I2C clock-frequency property. Signed-off-by: Jihed Chaibi Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250819201302.80712-2-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 96bcb34df55f7fee99795127c796315950c94fed Author: Qianfeng Rong Date: Wed Aug 20 20:34:20 2025 +0800 ASoC: test-component: Use kcalloc() instead of kzalloc() Use devm_kcalloc() in test_driver_probe() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250820123423.470486-4-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 3b6f4bd6cda2797b0d999a129376c112d41604f4 Author: Qianfeng Rong Date: Wed Aug 20 20:34:19 2025 +0800 ASoC: fsl: Use kcalloc() instead of kzalloc() Use devm_kcalloc() in fsl_sai_read_dlcfg() and imx_audmux_probe() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250820123423.470486-3-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 45441b933cdfb7a018674049f269d7a1bc1688df Author: Qianfeng Rong Date: Wed Aug 20 20:34:18 2025 +0800 ASoC: codecs: Use kcalloc() instead of kzalloc() Use devm_kcalloc() in fs_parse_scene_tables() and pcmdev_gain_ctrl_add() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250820123423.470486-2-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 2693227c1150d58bf82ef45a394a554373be5286 Author: Mykyta Yatsenko Date: Tue Aug 19 22:51:19 2025 +0100 libbpf: Export bpf_object__prepare symbol Add missing LIBBPF_API macro for bpf_object__prepare function to enable its export. libbpf.map had bpf_object__prepare already listed. Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load") Signed-off-by: Mykyta Yatsenko Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com commit b5bbbb70e5f5e1b14b2d5e3d88b8e18cd99f986d Author: Ilya Leoshkevich Date: Tue Aug 19 12:20:38 2025 +0200 s390/bpf: Use direct calls and jumps where possible After the V!=R rework (commit c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces")), all kernel code and related data are allocated within a 4G region, making it possible to use relative addressing in BPF code more extensively. Convert as many indirect calls and jumps to direct calls as possible, namely: * BPF_CALL * __bpf_tramp_enter() * __bpf_tramp_exit() * __bpf_prog_enter() * __bpf_prog_exit() * fentry * fmod_ret * fexit * BPF_TRAMP_F_CALL_ORIG without BPF_TRAMP_F_ORIG_STACK * Trampoline returns without BPF_TRAMP_F_SKIP_FRAME and BPF_TRAMP_F_ORIG_STACK The following indirect calls and jumps remain: * Prog returns * Trampoline returns with BPF_TRAMP_F_SKIP_FRAME or BPF_TRAMP_F_ORIG_STACK * BPF_TAIL_CALL * BPF_TRAMP_F_CALL_ORIG with BPF_TRAMP_F_ORIG_STACK As a result, only one usage of call_r1() remains, so inline it. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250819102116.252203-1-iii@linux.ibm.com commit 456010c8b99e65231160d4c706122ac5502fbcff Author: Sebastian Andrzej Siewior Date: Mon Aug 18 13:02:13 2025 +0200 netfilter: nft_set_pipapo: Use nested-BH locking for nft_pipapo_scratch nft_pipapo_scratch is a per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Add a local_lock_t to the data structure and use local_lock_nested_bh() for locking. This change adds only lockdep coverage and does not alter the functional behaviour for !PREEMPT_RT. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Florian Westphal commit 6aa67d5706f031f24cd486d8df7dc7fddca62b22 Author: Sebastian Andrzej Siewior Date: Fri Aug 15 18:09:35 2025 +0200 netfilter: nft_set_pipapo: Store real pointer, adjust later. The struct nft_pipapo_scratch is allocated, then aligned to the required alignment and difference (in bytes) is then saved in align_off. The aligned pointer is used later. While this works, it gets complicated with all the extra checks if all member before map are larger than the required alignment. Instead of saving the aligned pointer, just save the returned pointer and align the map pointer in nft_pipapo_lookup() before using it. The alignment later on shouldn't be that expensive. With this change, the align_off can be removed and the pointer can be passed to kfree() as is. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Florian Westphal commit 84c1da7b38d9ad8fadd5b0b76034a41f7761e404 Author: Florian Westphal Date: Fri Aug 15 16:36:58 2025 +0200 netfilter: nft_set_pipapo: use avx2 algorithm for insertions too Always prefer the avx2 implementation if its available. This greatly improves insertion performance (each insertion checks if the new element would overlap with an existing one): time nft -f - < Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Florian Westphal commit 416e53e39516714057d7d06d561e49d1a89fa524 Author: Florian Westphal Date: Fri Aug 15 16:36:57 2025 +0200 netfilter: nft_set_pipapo_avx2: split lookup function in two parts Split the main avx2 lookup function into a helper. This is a preparation patch: followup change will use the new helper from the insertion path if possible. This greatly improves insertion performance when avx2 is supported. Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit d11b26402a33f5c45389e0a288430c457434c9cd Author: Sebastian Andrzej Siewior Date: Fri Aug 15 18:09:36 2025 +0200 netfilter: nft_set_pipapo_avx2: Drop the comment regarding protection The comment claims that the kernel_fpu_begin_mask() below protects access to the scratch map. This is not true because the access is only protected by local_bh_disable() above. Remove the misleading comment. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Florian Westphal commit 08d07f25fd5e2ca3d32444f8c41e9e6e59e8a54e Author: Florian Westphal Date: Fri Aug 15 14:55:49 2025 +0200 netfilter: ctnetlink: remove refcounting in dying list dumping There is no need to keep the object alive via refcount, use a cookie and then use that as the skip hint for dump resumption. Unlike the two earlier, similar patches in this file, this is a cleanup without intended side effects. Signed-off-by: Florian Westphal commit 2f44bb65f28f5f058fe4ab9bc81e5fde5575c473 Author: Thomas Zimmermann Date: Tue Aug 12 10:25:09 2025 +0200 drm/panel: panel-samsung-s6e88a0-ams427ap24: Fix includes Include to declare device_property_read_bool() and to declare struct of_device_id. Avoids the dependency on the backlight header to include both. Signed-off-by: Thomas Zimmermann Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250812082509.227879-1-tzimmermann@suse.de commit 38580d1e7f18230b10e8ba6d9a44a9fcc532f47f Author: Athul Raj Kollareth Date: Wed Aug 13 11:51:05 2025 +0530 drm/virtio: clean up minor codestyle issues Fix codestyle warnings and errors generated by CHECKPATCH in virtio source files. Signed-off-by: Athul Raj Kollareth Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250813062109.5326-1-krathul3152@gmail.com commit b5af45302ebc141662b2b60c713c9202e88c943c Author: Paresh Bhagat Date: Wed Aug 20 14:03:31 2025 +0530 cpufreq: ti: Add support for AM62D2 Add support for TI K3 AM62D2 SoC to read speed and revision values from hardware and pass to OPP layer. AM62D shares the same configuations as AM62A so use existing am62a7_soc_data. Signed-off-by: Paresh Bhagat Signed-off-by: Viresh Kumar commit fa40cbe1c86b6626d548cf2eb555bee4eea7566c Author: Paresh Bhagat Date: Wed Aug 20 14:03:30 2025 +0530 cpufreq: dt-platdev: Blacklist ti,am62d2 SoC Add ti,am62d2 SoC to the blacklist as the ti-cpufreq driver will handle creating the cpufreq-dt platform device after it completes and ensure it is not created twice. Signed-off-by: Paresh Bhagat Signed-off-by: Viresh Kumar commit 1e17ed83261ee7aa80c488461ed0f4e7a4f82660 Merge: dab74906423c5a dd489c01c39717 Author: Maxime Ripard Date: Wed Aug 20 09:33:06 2025 +0200 Merge drm/drm-next into drm-misc-next Bring v6.17-rc2 in to unstuck for-linux-next. Signed-off-by: Maxime Ripard commit 07e7ccd804dc2aac6f3f96129a86b02391b5002d Author: Lad Prabhakar Date: Tue Aug 12 18:17:20 2025 +0100 clk: renesas: r9a09g077: Add module clocks for SCI1-SCI5 Add asynchronous core clocks and module clocks for SCI channels 1 through 5 on the RZ/T2H SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250812171720.3245851-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 54653bb3ec83d1f717adab6108db82a3966d19ee Author: Brian Masney Date: Mon Aug 11 11:19:25 2025 -0400 clk: renesas: rzv2h: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. Signed-off-by: Brian Masney Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250811-clk-for-stephen-round-rate-v1-93-b3bf97b038dc@redhat.com Signed-off-by: Geert Uytterhoeven commit 58afc207832f750e692f5e72656fa551cacb9e3a Author: Brian Masney Date: Mon Aug 11 11:19:24 2025 -0400 clk: renesas: rzg2l: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250811-clk-for-stephen-round-rate-v1-92-b3bf97b038dc@redhat.com Signed-off-by: Geert Uytterhoeven commit 8933612860fd0087a0e27dfca01106a98ccc334a Author: Claudiu Beznea Date: Wed Aug 6 12:21:29 2025 +0300 clk: renesas: r9a07g04[34]: Use tabs instead of spaces Use tabs instead of spaces in the CRU clock descriptions to match the formatting used in the rest of the clock definitions. Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806092129.621194-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0f078d37aeeefa197f4ffff6acd677cd3220a070 Author: Claudiu Beznea Date: Wed Aug 6 12:21:28 2025 +0300 clk: renesas: r9a07g043: Add MSTOP for RZ/G2UL Add MSTOP configuration for all the module clocks on the RZ/G2UL based SoCs (RZ/G2UL, RZ/Five). Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806092129.621194-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 56de5e305d4ba25eed5740b338f7ecb8cf342aa6 Author: Claudiu Beznea Date: Wed Aug 6 12:21:27 2025 +0300 clk: renesas: r9a07g044: Add MSTOP for RZ/G2L Add MSTOP configuration for all the module clocks on the RZ/G2L based SoCs (RZ/G2L, RZ/G2LC, RZ/V2L). Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806092129.621194-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f0cb3463d0244765ab66792a88dc5e2152c130e1 Author: Claudiu Beznea Date: Wed Aug 6 12:21:26 2025 +0300 clk: renesas: r9a08g045: Add MSTOP for GPIO The GPIO module also supports MSTOP. Add it in the description of the gpio clock. Fixes: c49695952746 ("clk: renesas: r9a08g045: Drop power domain instantiation") Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806092129.621194-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 45bf4bff2814b78dc2a98e692f7e49399e2d2ce1 Author: Lad Prabhakar Date: Mon Aug 4 21:26:43 2025 +0100 clk: renesas: r9a09g077: Add USB core and module clocks Add module and core clocks used by USB. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250804202643.3967484-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 845d5c1a3218466e3a2bb4924ac2c58dc879996b Merge: 059db30b32e968 5293e8f2a85434 Author: Geert Uytterhoeven Date: Wed Aug 20 09:16:19 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag3' into renesas-clk-for-v6.18 Renesas RZ/T2H and RZ/N2H USB_CLK and Pin Control DT Binding Definitions USB_CLK Clock and Pin Control DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files. commit 059db30b32e968fdbf6e416411fb78d481ff94bd Author: Tommaso Merciai Date: Fri Aug 1 10:48:21 2025 +0200 clk: renesas: r9a09g047: Add DMAC clocks and resets Add clock and reset entries for the Renesas RZ/G3E DMAC IPs. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250801084825.471011-2-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6b234eda88d781d244094836afc37c90b57832f3 Author: Claudiu Beznea Date: Fri Jul 4 19:14:02 2025 +0300 clk: renesas: r9a08g045: Add PCIe clocks and resets Add clocks and resets for the PCIe IP available on the Renesas RZ/G3S SoC. The clkl1pm clock is required for PCIe link power management (PM) control and should be enabled based on the state of the CLKREQ# pin. Therefore, mark it as a no_pm clock to allow the PCIe driver to manage it during link PM transitions. Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704161410.3931884-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 148bda0cfeae913b1212c4c683e6d3f6ae1a5e69 Author: Wolfram Sang Date: Mon Jun 30 21:21:31 2025 +0200 clk: renesas: r9a08g045: Add I3C clocks and resets Extracted from the BSP driver and rebased. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250630192438.38311-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit b8dc2302544b66367bedec19ee16477ff5a25a92 Author: Krzysztof Kozlowski Date: Mon Aug 18 16:24:03 2025 +0200 pinctrl: stm32: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250818142402.132008-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 115b557b6f61ca279a4754b20b8686039fdb5234 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:20 2025 +0200 arm64: dts: renesas: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250819131619.86396-2-krzysztof.kozlowski@linaro.org Signed-off-by: Geert Uytterhoeven commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 Author: Marek Vasut Date: Wed Aug 6 21:28:04 2025 +0200 arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1 The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the change in IO voltage. Since the VDDQ18_25_AVB power rail is shared, all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to be configured the same way. As the EVTA1 boards are from a limited run and generally not available, update the DT to make it compatible with EVTB1 IO voltage settings. Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 Author: Marek Vasut Date: Mon Jul 28 01:58:11 2025 +0200 arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1 Invert the polarity of microSD voltage selector on Retronix R-Car V4H Sparrow Hawk board. The voltage selector was not populated on prototype EVTA1 boards, and is implemented slightly different on EVTB1 boards. As the EVTA1 boards are from a limited run and generally not available, update the DT to make it compatible with EVTB1 microSD voltage selector. Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit d1d31e2739ff063da1e85cd9b44316ca5cccdba8 Author: Lad Prabhakar Date: Fri Aug 8 14:30:17 2025 +0100 pinctrl: renesas: rzt2h: Add support for RZ/N2H The Renesas RZ/N2H (R9A09G087) SoC shares a similar pin controller architecture with the RZ/T2H (R9A09G077) SoC, differing primarily in the number of supported pins: 576 on RZ/N2H versus 729 on RZ/T2H. Add the necessary pin configuration data and compatible string to enable support for the RZ/N2H SoC in the RZ/T2H pinctrl driver. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250808133017.2053637-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 34d4d093077a5c60d452a2f42d0c1a08e55b8614 Author: Thierry Bultel Date: Fri Aug 8 14:30:16 2025 +0100 pinctrl: renesas: Add support for RZ/T2H Add a pin control and GPIO driver for the Renesas RZ/T2H (R9A09G077) SoC. Signed-off-by: Thierry Bultel Co-developed-by: Lad Prabhakar Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250808133017.2053637-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 2da2740fb9c8e26b6b5e20d74f2ed1d49824236d Author: John Madieu Date: Mon Aug 18 18:28:47 2025 +0200 soc: renesas: rz-sysc: Add syscon/regmap support The RZ/G3E system controller has various registers that control or report some properties specific to individual IPs. The regmap is registered as a syscon device to allow these IP drivers to access the registers through the regmap API. As other RZ SoCs might have custom read/write callbacks or max-offsets, register a custom regmap configuration. [claudiu.beznea: - do not check the match->data validity in rz_sysc_probe() as it is always valid - dinamically allocate regmap_cfg] Signed-off-by: John Madieu Signed-off-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea # on RZ/G3S Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250818162859.9661-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0c5e2ae204eca74e4ccbaffc8125c3b41de9c9b8 Author: Šerif Rami Date: Tue Aug 19 20:51:33 2025 +0200 ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete() The smatch tool reported a potential null pointer dereference in tascam_midi_in_urb_complete(). The 'tascam' variable, derived from 'urb->context', was checked for nullity in one place, but dereferenced without a check in several other places. This patch fixes the issue by adding a null check at the beginning of the function. If 'tascam' is null, the function now safely exits. This prevents any potential crashes from null pointer dereferences. It also fixes a latent bug where 'usb_put_urb()' could be called twice for the same URB on submission failure, which would lead to a use-after-free error. Fixes: 67afec157fe6 ("ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202508192109.lcMrINK1-lkp@intel.com/ Signed-off-by: Šerif Rami Link: https://patch.msgid.link/20250819185133.10464-1-ramiserifpersia@gmail.com Signed-off-by: Takashi Iwai commit 9b1795e9b0ae6d8b2c50987048170f77d0dc0300 Author: Jouni Högander Date: Mon May 19 10:52:23 2025 +0300 drm/i915/psr: Underrun on idle PSR wa only when pkgc latency > delayed vblank Underrun on idle PSR workaround (Wa_16025596647) is supposed to be applied only when pkg c latency > delayed vblank. Currently we are applying it always when other criterias are met. Fix this by adding new boolean flag which is supposed to be set when calculating watermark levels and pkgc latency > delayed vblank is detected. currently this scenario is blocked but might be added later. Due to this add also TODO comment into skl_max_wm_level_for_vblank. Bspec: 74151 Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Link: https://lore.kernel.org/r/20250519075223.443266-1-jouni.hogander@intel.com commit dab74906423c5a0e41dfd4cefc3758d351ccc51e Author: Himal Prasad Ghimiray Date: Tue Aug 19 21:50:58 2025 +0530 drm/gpusvm: Make drm_gpusvm_for_each_* macros public The drm_gpusvm_for_each_notifier, drm_gpusvm_for_each_notifier_safe and drm_gpusvm_for_each_range_safe macros are useful for locating notifiers and ranges within a user-specified range. By making these macros public, we enable broader access and utility for developers who need to leverage them in their implementations. v2 (Matthew Brost) - drop inline __drm_gpusvm_range_find - /s/notifier_iter_first/drm_gpusvm_notifier_find Signed-off-by: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250819162058.2777306-5-himal.prasad.ghimiray@intel.com commit baf1638c095686ad970aecee4ca9446c1de18dad Author: Himal Prasad Ghimiray Date: Tue Aug 19 21:50:57 2025 +0530 drm/gpuvm: Introduce drm_gpuvm_madvise_ops_create This ops is used to iterate over GPUVA's in the user-provided range and split the existing sparse VMA's if the start or end of the input range lies within it. The operations can create up to 2 REMAPS and 2 MAPs. The primary use case is for drivers to assign attributes to GPU VAs in the specified range without performing unmaps or merging mappings, supporting fine-grained control over sparse va's. Cc: Danilo Krummrich Cc: Matthew Brost Cc: Boris Brezillon Cc: Signed-off-by: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Acked-by: Danilo Krummrich Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250819162058.2777306-4-himal.prasad.ghimiray@intel.com commit 3309323241fbb3c1da885e6b84bdf95e9708e4bb Author: Boris Brezillon Date: Tue Aug 19 21:50:56 2025 +0530 drm/gpuvm: Kill drm_gpuva_init() drm_gpuva_init() only has one internal user, and given we are about to add new optional fields, it only add maintenance burden for no real benefit, so let's kill the thing now. Cc: Danilo Krummrich Cc: Rob Clark Signed-off-by: Boris Brezillon Acked-by: Danilo Krummrich Reviewed-by: Matthew Brost Signed-off-by: Himal Prasad Ghimiray Reviewed-by: Rob Clark Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250819162058.2777306-3-himal.prasad.ghimiray@intel.com commit 000a45dce7adc13e45b2925b383e39f32e5f3004 Author: Boris Brezillon Date: Tue Aug 19 21:50:55 2025 +0530 drm/gpuvm: Pass map arguments through a struct We are about to pass more arguments to drm_gpuvm_sm_map[_ops_create](), so, before we do that, let's pass arguments through a struct instead of changing each call site every time a new optional argument is added. Cc: Danilo Krummrich Cc: Brendan King Cc: Matt Coster Cc: Boris Brezillon Cc: Caterina Shablia Cc: Rob Clark Cc: Matthew Brost Cc: Co-developed-by: Himal Prasad Ghimiray Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Boris Brezillon Acked-by: Danilo Krummrich Reviewed-by: Matthew Brost Reviewed-by: Rob Clark Reviewed-by: Matt Coster # imagination/pvr_vm.c Acked-by: Matt Coster Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250819162058.2777306-2-himal.prasad.ghimiray@intel.com commit e88ef677623eaf7a4c30b5fe905e7138838d13d2 Author: Shankari Anand Date: Fri Aug 15 23:15:21 2025 +0530 rust: opp: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in `opp.rs` to import ARef and AlwaysRefCounted from sync::aref instead of types. This aligns with the ongoing effort to move ARef and AlwaysRefCounted to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Signed-off-by: Viresh Kumar commit 72907ea795e0bf261def10595d19ded441b90d9f Author: Nicolas Frattaroli Date: Tue Aug 19 13:21:42 2025 +0200 cpufreq: mediatek-hw: don't use error path on NULL fdvfs The IS_ERR_OR_NULL check for priv->fdvfs is inappropriate, and should be an IS_ERR check instead, as a NULL value here would propagate it to PTR_ERR. In practice, there is no problem here, as devm_of_iomap cannot return NULL in any circumstance. However, it causes a Smatch static checker warning. Fix the warning by changing the check from IS_ERR_OR_NULL to IS_ERR. Fixes: 32e0d669f3ac ("cpufreq: mediatek-hw: Add support for MT8196") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-pm/aKQubSEXH1TXQpnR@stanley.mountain/ Signed-off-by: Nicolas Frattaroli Signed-off-by: Viresh Kumar commit bc9dc8de130e3fd208cf489788ecb998069ce6bf Author: Bence Csókás Date: Wed Jul 9 09:32:44 2025 +0200 ARM: dts: imx6-display5: Replace license text comment with SPDX identifier Replace verbatim license text with a `SPDX-License-Identifier`. The comment header mis-attributes this license to be "X11", but the license text does not include the last line "Except as contained in this notice, the name of the X Consortium shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the X Consortium.". Therefore, this license is actually equivalent to the SPDX "MIT" license (confirmed by text diffing). Cc: Lukasz Majewski Signed-off-by: Bence Csókás Acked-by: Lukasz Majewski Signed-off-by: Shawn Guo commit 21179eae56de418ea360e31f1b69f66fc16aa4e3 Author: Primoz Fiser Date: Mon Jul 14 12:36:24 2025 +0200 arm64: dts: freescale: imx93-phyboard-nash: Add current sense amplifier There is a current sensing circuitry on the phyBOARD-Nash-i.MX93 capable of measuring input current consumption of the phyCORE-i.MX93 SoM @ 3.3V. Circuity consists of MAX4372 current-sense amplifier (50V/V) with two 70 mOhm shunts resistors in parallel configuration (effective R = 35 mOhm) connected to the SoC internal 12-bit ADC channel #1 (Vref = 1.8V) via voltage divider with ratio of 1/2. This results in a current scaling factor of 0.502232142 mA/LSB. Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit d1c1400bd3b8b436df3bc49d6b420b3184f7dda4 Author: Goran Rađenović Date: Wed Jul 16 17:48:06 2025 +0200 arm64: dts: imx8mp: Add initial support for Ultratronik imx8mp-ultra-mach-sbc board Add initial device tree support for the Ultratronik Ultra-MACH SBC based on the NXP i.MX8M Plus SoC with 2GB LPDDR4. The board features: - 1 x USB 2.0 Host - 1 x USB 2.0 via USB-C - Debug UART + 1 x UART + 1 x USART - SD card and eMMC support - 2 x Ethernet (RJ45) - HDMI This initial DTS enables basic board support for booting via SD card or eMMC. Signed-off-by: Goran Rađenović Signed-off-by: Shawn Guo commit e0a4a651f7c8f274be0a937e8ac31c782c4af7ee Author: Goran Rađenović Date: Wed Jul 16 17:48:04 2025 +0200 MAINTAINERS: Add i.MX8MP Ultra-MACH SBC to ULTRATRONIK BOARD SUPPORT The i.MX8MP-based Ultra-MACH SBC is supported by Ultratronik, and its device tree has been added under arch/arm64/boot/dts/freescale/. To ensure proper maintainer coverage and notification of relevant changes, add the imx8mp-ultra-mach-sbc.dts file to the existing ULTRATRONIK BOARD SUPPORT section. This follows the established pattern already used for the STM32MP157C- based Ultra-FLY SBC. Signed-off-by: Goran Rađenović Signed-off-by: Shawn Guo commit 566c269873c642856bceced2add800d2ce8b8c94 Author: Goran Rađenović Date: Wed Jul 16 17:48:05 2025 +0200 dt-bindings: arm: imx8mp: Add Ultratronik Ultra-MACH SBC Document the Ultratronik Ultra-MACH SBC, based on the NXP i.MX8MP SoC. This board is manufactured by Ultratronik GmbH and uses the compatible string "ux,imx8mp-ultra-mach-sbc". Acked-by: Krzysztof Kozlowski Signed-off-by: Goran Rađenović Signed-off-by: Shawn Guo commit c3199adbe4ffffc7b6536715e0290d1919a45cd9 Merge: f9ca2820f51867 d5a253702add0d Author: Jakub Kicinski Date: Tue Aug 19 19:36:29 2025 -0700 Merge branch 'sctp-convert-to-use-crypto-lib-and-upgrade-cookie-auth' Eric Biggers says: ==================== sctp: Convert to use crypto lib, and upgrade cookie auth This series converts SCTP chunk and cookie authentication to use the crypto library API instead of crypto_shash. This is much simpler (the diffstat should speak for itself), and also faster too. In addition, this series upgrades the cookie authentication to use HMAC-SHA256. I've tested that kernels with this series applied can continue to communicate using SCTP with older ones, in either direction, using any choice of None, HMAC-SHA1, or HMAC-SHA256 chunk authentication. ==================== Link: https://patch.msgid.link/20250818205426.30222-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit d5a253702add0da3e1e19252ae2a251ee24b486d Author: Eric Biggers Date: Mon Aug 18 13:54:26 2025 -0700 sctp: Stop accepting md5 and sha1 for net.sctp.cookie_hmac_alg The upgrade of the cookie authentication algorithm to HMAC-SHA256 kept some backwards compatibility for the net.sctp.cookie_hmac_alg sysctl by still accepting the values 'md5' and 'sha1'. Those algorithms are no longer actually used, but rather those values were just treated as requests to enable cookie authentication. As requested at https://lore.kernel.org/netdev/CADvbK_fmCRARc8VznH8cQa-QKaCOQZ6yFbF=1-VDK=zRqv_cXw@mail.gmail.com/ and https://lore.kernel.org/netdev/20250818084345.708ac796@kernel.org/ , go further and start rejecting 'md5' and 'sha1' completely. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-6-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 2f3dd6ec901f29aef5fff3d7a63b1371d67c1760 Author: Eric Biggers Date: Mon Aug 18 13:54:25 2025 -0700 sctp: Convert cookie authentication to use HMAC-SHA256 Convert SCTP cookies to use HMAC-SHA256, instead of the previous choice of the legacy algorithms HMAC-MD5 and HMAC-SHA1. Simplify and optimize the code by using the HMAC-SHA256 library instead of crypto_shash, and by preparing the HMAC key when it is generated instead of per-operation. This doesn't break compatibility, since the cookie format is an implementation detail, not part of the SCTP protocol itself. Note that the cookie size doesn't change either. The HMAC field was already 32 bytes, even though previously at most 20 bytes were actually compared. 32 bytes exactly fits an untruncated HMAC-SHA256 value. So, although we could safely truncate the MAC to something slightly shorter, for now just keep the cookie size the same. I also considered SipHash, but that would generate only 8-byte MACs. An 8-byte MAC *might* suffice here. However, there's quite a lot of information in the SCTP cookies: more than in TCP SYN cookies. So absent an analysis that occasional forgeries of all that information is okay in SCTP, I errored on the side of caution. Remove HMAC-MD5 and HMAC-SHA1 as options, since the new HMAC-SHA256 option is just better. It's faster as well as more secure. For example, benchmarking on x86_64, cookie authentication is now nearly 3x as fast as the previous default choice and implementation of HMAC-MD5. Also just make the kernel always support cookie authentication if SCTP is supported at all, rather than making it optional in the build. (It was sort of optional before, but it didn't really work properly. E.g., a kernel with CONFIG_SCTP_COOKIE_HMAC_MD5=n still supported HMAC-MD5 cookie authentication if CONFIG_CRYPTO_HMAC and CONFIG_CRYPTO_MD5 happened to be enabled in the kconfig for other reasons.) Acked-by: Xin Long Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-5-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit bf40785fa437c1752117df2edb3220e9c37d98a6 Author: Eric Biggers Date: Mon Aug 18 13:54:24 2025 -0700 sctp: Use HMAC-SHA1 and HMAC-SHA256 library for chunk authentication For SCTP chunk authentication, use the HMAC-SHA1 and HMAC-SHA256 library functions instead of crypto_shash. This is simpler and faster. There's no longer any need to pre-allocate 'crypto_shash' objects; the SCTP code now simply calls into the HMAC code directly. As part of this, make SCTP always support both HMAC-SHA1 and HMAC-SHA256. Previously, it only guaranteed support for HMAC-SHA1. However, HMAC-SHA256 tended to be supported too anyway, as it was supported if CONFIG_CRYPTO_SHA256 was enabled elsewhere in the kconfig. Acked-by: Xin Long Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-4-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit dd91c79e4f58fbe2898dac84858033700e0e99fb Author: Eric Biggers Date: Mon Aug 18 13:54:23 2025 -0700 sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 490a9591b5feb40b91052bbb0e6bc038ed8490ff Author: Eric Biggers Date: Mon Aug 18 13:54:22 2025 -0700 selftests: net: Explicitly enable CONFIG_CRYPTO_SHA1 for IPsec xfrm_policy.sh, nft_flowtable.sh, and vrf-xfrm-tests.sh use 'ip xfrm' with SHA-1, either 'auth sha1' or 'auth-trunc hmac(sha1)'. That requires CONFIG_CRYPTO_SHA1, which CONFIG_INET_ESP intentionally doesn't select (as per its help text). Previously, the config for these tests relied on CONFIG_CRYPTO_SHA1 being selected by the unrelated option CONFIG_IP_SCTP. Since CONFIG_IP_SCTP is being changed to no longer do that, instead add CONFIG_CRYPTO_SHA1 to the configs explicitly. Reported-by: Paolo Abeni Closes: https://lore.kernel.org/r/766e4508-aaba-4cdc-92b4-e116e52ae13b@redhat.com Suggested-by: Florian Westphal Acked-by: Xin Long Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250818205426.30222-2-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 36def5f2b958113b9009144fb54b0cee2c11afb5 Author: Christoph Stoidner Date: Sat May 24 13:23:15 2025 +0200 arm64: dts: freescale: imx93-phycore-som: Delay the phy reset by a gpio According to the datasheet the phy needs to be held in reset until the reference clock got stable. Even though no issue was observed, fix this as the software should always comply with the specification. Use gpio4 23, which is connected to the phy reset pin. On the same pin RX_ER was used before, but this signal is optional and can be dropped. Note: This comes into effect with the phyCOREs SOM hardware revision 4. In revisions before, this gpio is not connected, and the phy reset is managed with the global hardware reset circuit. Signed-off-by: Christoph Stoidner Reviewed-by: Andrew Lunn Signed-off-by: Shawn Guo commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b Author: Thomas Fourier Date: Fri Jul 25 10:31:06 2025 +0200 scsi: myrs: Fix dma_alloc_coherent() error check Check for NULL return value with dma_alloc_coherent(), because DMA address is not always set by dma_alloc_coherent() on failure. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit e79aa10e288c617c12ac4eb3fe7962f5c644b8fe Author: Qianfeng Rong Date: Fri Aug 15 20:16:05 2025 +0800 scsi: lpfc: use min() to improve code Use min_t() to reduce the code in lpfc_sli4_driver_resource_setup() and lpfc_nvme_prep_io_cmd(), and improve readability. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250815121609.384914-4-rongqianfeng@vivo.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit 0138c16872bdda6b5113dec1cde5f93815c9f75c Author: Qianfeng Rong Date: Fri Aug 15 20:16:04 2025 +0800 scsi: hpsa: use min()/min_t() to improve code Use min()/min_t() to reduce the code in complete_scsi_command() and hpsa_vpd_page_supported(), and improve readability. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250815121609.384914-3-rongqianfeng@vivo.com Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit b5940feda3dc7a12133c6589e463d2b3b6c7fe96 Author: Bart Van Assche Date: Tue Aug 19 08:43:49 2025 -0700 scsi: ufs: core: Reduce the size of struct ufshcd_lrb The size of the data structures that are used in the hot path matters for performance (IOPS). Hence this patch that reduces the size of struct ufshcd_lrb on 64-bit systems by 16 bytes. The size of this data structure is reduced from 152 to 136 bytes. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250819154356.2256952-1-bvanassche@acm.org Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit cb7cc0cfb38cf50c902caadee0e0e87fc38490aa Author: Bart Van Assche Date: Tue Aug 19 08:39:50 2025 -0700 scsi: ufs: core: Only collect timestamps if monitoring is enabled Every ktime_get() call in the hot path has a measurable impact on IOPS. Hence, only collect timestamps if the monitoring functionality is enabled. See also commit 1d8613a23f3c ("scsi: ufs: core: Introduce HBA performance monitor sysfs nodes"). Cc: Can Guo Cc: Bean Huo Cc: Daejun Park Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250819153958.2255907-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f9ca2820f51867aba6a55c64fcd264d1efd69449 Merge: 5c69e0b395c1ff bf64002c94fc33 Author: Jakub Kicinski Date: Tue Aug 19 19:21:01 2025 -0700 Merge branch 'net-memcg-gather-memcg-code-under-config_memcg' Kuniyuki Iwashima says: ==================== net-memcg: Gather memcg code under CONFIG_MEMCG. This series converts most sk->sk_memcg access to helper functions under CONFIG_MEMCG and finally defines sk_memcg under CONFIG_MEMCG. This is v5 of the series linked below but without core changes that decoupled memcg and global socket memory accounting. I will defer the changes to a follow-up series that will use BPF to store a flag in sk->sk_memcg. Overview of the series: patch 1 is a trivial fix for MPTCP patch 2 ~ 9 move sk->sk_memcg accesses to a single place patch 10 moves sk_memcg under CONFIG_MEMCG v4: https://lore.kernel.org/20250814200912.1040628-1-kuniyu@google.com v3: https://lore.kernel.org/20250812175848.512446-1-kuniyu@google.com v2: https://lore.kernel.org/20250811173116.2829786-1-kuniyu@google.com v1: https://lore.kernel.org/20250721203624.3807041-1-kuniyu@google.com ==================== Link: https://patch.msgid.link/20250815201712.1745332-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bf64002c94fc330b996bc438f3d1b6bd3d781659 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:18 2025 +0000 net: Define sk_memcg under CONFIG_MEMCG. Except for sk_clone_lock(), all accesses to sk->sk_memcg is done under CONFIG_MEMCG. As a bonus, let's define sk->sk_memcg under CONFIG_MEMCG. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Roman Gushchin Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b2ffd10cddde47cc6830e4981e91e3215def62b1 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:17 2025 +0000 net-memcg: Pass struct sock to mem_cgroup_sk_under_memory_pressure(). We will store a flag in the lowest bit of sk->sk_memcg. Then, we cannot pass the raw pointer to mem_cgroup_under_socket_pressure(). Let's pass struct sock to it and rename the function to match other functions starting with mem_cgroup_sk_. Note that the helper is moved to sock.h to use mem_cgroup_from_sk(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Roman Gushchin Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bb178c6bc08525d758a57775458d644304011bf8 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:16 2025 +0000 net-memcg: Pass struct sock to mem_cgroup_sk_(un)?charge(). We will store a flag in the lowest bit of sk->sk_memcg. Then, we cannot pass the raw pointer to mem_cgroup_charge_skmem() and mem_cgroup_uncharge_skmem(). Let's pass struct sock to the functions. While at it, they are renamed to match other functions starting with mem_cgroup_sk_. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Roman Gushchin Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 43049b0db03823c2cd003ca7d3dddcd3924da8dc Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:15 2025 +0000 net-memcg: Introduce mem_cgroup_sk_enabled(). The socket memcg feature is enabled by a static key and only works for non-root cgroup. We check both conditions in many places. Let's factorise it as a helper function. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Roman Gushchin Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f7161b234f2ec7f18999009c4becc04eeb6b12a7 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:14 2025 +0000 net-memcg: Introduce mem_cgroup_from_sk(). We will store a flag in the lowest bit of sk->sk_memcg. Then, directly dereferencing sk->sk_memcg will be illegal, and we do not want to allow touching the raw sk->sk_memcg in many places. Let's introduce mem_cgroup_from_sk(). Other places accessing the raw sk->sk_memcg will be converted later. Note that we cannot define the helper as an inline function in memcontrol.h as we cannot access any fields of struct sock there due to circular dependency, so it is placed in sock.h. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Roman Gushchin Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bd4aa2337374dd04b8627efd26227ebd49f69285 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:13 2025 +0000 net: Clean up __sk_mem_raise_allocated(). In __sk_mem_raise_allocated(), charged is initialised as true due to the weird condition removed in the previous patch. It makes the variable unreliable by itself, so we have to check another variable, memcg, in advance. Also, we will factorise the common check below for memcg later. if (mem_cgroup_sockets_enabled && sk->sk_memcg) As a prep, let's initialise charged as false and memcg as NULL. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:12 2025 +0000 net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. Initially, trace_sock_exceed_buf_limit() was invoked when __sk_mem_raise_allocated() failed due to the memcg limit or the global limit. However, commit d6f19938eb031 ("net: expose sk wmem in sock_exceed_buf_limit tracepoint") somehow suppressed the event only when memcg failed to charge for SK_MEM_RECV, although the memcg failure for SK_MEM_SEND still triggers the event. Let's restore the event for SK_MEM_RECV. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e2afa83296bbac40829624b508492b562a21e4d4 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:11 2025 +0000 tcp: Simplify error path in inet_csk_accept(). When an error occurs in inet_csk_accept(), what we should do is only call release_sock() and set the errno to arg->err. But the path jumps to another label, which introduces unnecessary initialisation and tests for newsk. Let's simplify the error path and remove the redundant NULL checks for newsk. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 1068b48ed10805b61be0668cd774af97163479a7 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:10 2025 +0000 mptcp: Use tcp_under_memory_pressure() in mptcp_epollin_ready(). Some conditions used in mptcp_epollin_ready() are the same as tcp_under_memory_pressure(). We will modify tcp_under_memory_pressure() in the later patch. Let's use tcp_under_memory_pressure() instead. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 68889dfd547bd8eabc5a98b58475d7b901cf5129 Author: Kuniyuki Iwashima Date: Fri Aug 15 20:16:09 2025 +0000 mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n. When sk_alloc() allocates a socket, mem_cgroup_sk_alloc() sets sk->sk_memcg based on the current task. MPTCP subflow socket creation is triggered from userspace or an in-kernel worker. In the latter case, sk->sk_memcg is not what we want. So, we fix it up from the parent socket's sk->sk_memcg in mptcp_attach_cgroup(). Although the code is placed under #ifdef CONFIG_MEMCG, it is buried under #ifdef CONFIG_SOCK_CGROUP_DATA. The two configs are orthogonal. If CONFIG_MEMCG is enabled without CONFIG_SOCK_CGROUP_DATA, the subflow's memory usage is not charged correctly. Let's move the code out of the wrong ifdef guard. Note that sk->sk_memcg is freed in sk_prot_free() and the parent sk holds the refcnt of memcg->css here, so we don't need to use css_tryget(). Fixes: 3764b0c5651e3 ("mptcp: attach subflow socket to parent cgroup") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Matthieu Baerts (NGI0) Acked-by: Shakeel Butt Link: https://patch.msgid.link/20250815201712.1745332-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6f4b10226b6b1e7d1ff3cdb006cf0f6da6eed71e Author: Gustavo A. R. Silva Date: Wed Aug 13 16:07:44 2025 -0400 scsi: qla2xxx: Fix memcpy() field-spanning write issue purex_item.iocb is defined as a 64-element u8 array, but 64 is the minimum size and it can be allocated larger. This makes it a standard empty flex array. This was motivated by field-spanning write warnings during FPIN testing: https://lore.kernel.org/linux-nvme/20250709211919.49100-1-bgurney@redhat.com/ > kernel: memcpy: detected field-spanning write (size 60) of single field > "((uint8_t *)fpin_pkt + buffer_copy_offset)" > at drivers/scsi/qla2xxx/qla_isr.c:1221 (size 44) I removed the outer wrapper from the iocb flex array, so that it can be linked to 'purex_item.size' with '__counted_by'. These changes remove the default minimum 64-byte allocation, requiring further changes. In 'struct scsi_qla_host' the embedded 'default_item' is now followed by '__default_item_iocb[QLA_DEFAULT_PAYLOAD_SIZE]' to reserve space that will be used as 'default_item.iocb'. This is wrapped using the 'TRAILING_OVERLAP()' macro helper, which effectively creates a union between flexible-array member 'default_item.iocb' and '__default_item_iocb'. Since 'struct pure_item' now contains a flexible-array member, the helper must be placed at the end of 'struct scsi_qla_host' to prevent a '-Wflex-array-member-not-at-end' warning. 'qla24xx_alloc_purex_item()' is adjusted to no longer expect the default minimum size to be part of 'sizeof(struct purex_item)', the entire flexible array size is added to the structure size for allocation. This also slightly changes the layout of the purex_item struct, as 2-bytes of padding are added between 'size' and 'iocb'. The resulting size is the same, but iocb is shifted 2-bytes (the original 'purex_item' structure was padded at the end, after the 64-byte defined array size). I don't think this is a problem. Tested-by: Bryan Gurney Co-developed-by: Chris Leech Signed-off-by: Chris Leech Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20250813200744.17975-10-bgurney@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 6b5da52a1825d600cdee1dd8bf90e95fa12620f0 Author: Qianfeng Rong Date: Wed Aug 6 20:46:33 2025 +0800 scsi: scsi_debug: Use vcalloc() to simplify code Use vcalloc() instead of vmalloc() followed by bitmap_zero() to simplify the function sdebug_add_store(). Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250806124633.383426-3-rongqianfeng@vivo.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit daedd69abfee3a871b3a8791ffe20b398e055b87 Author: Qianfeng Rong Date: Wed Aug 6 20:46:32 2025 +0800 scsi: ipr: Use vmalloc_array() to simplify code Use vmalloc_array() instead of vmalloc() to simplify the function ipr_alloc_dump(). Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250806124633.383426-2-rongqianfeng@vivo.com Signed-off-by: Martin K. Petersen commit e115d3d70ecc674df2e716e7030893424fa110fb Author: Cryolitia PukNgae Date: Wed Aug 6 11:13:16 2025 +0800 scsi: hpsa: Fix incorrect comment format Comments should not have a leading plus sign. Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250806-scsi_typo-v1-1-ec353a303b31@uniontech.com Signed-off-by: Martin K. Petersen commit f9f20d02639f93f7edde64e045605726fad3a303 Merge: dc60a408a1dc29 03f69351b63ea9 Author: Martin K. Petersen Date: Tue Aug 19 21:50:44 2025 -0400 Merge patch series "scsi: pm80xx: Fix expander support" Niklas Cassel says: Hello all, Some recent patches broke expander support for the pm80xx driver. The first two patches in this series make sure that expanders work with the pm80xx driver again. It also fixes a bug in pm8001_abort_task() that was found through code review. There is also some patches that make the pm80xx driver more robust, so it is less likely that the expander support will break again in the future. There is also some minor changes to some other libsas drivers to make use of the new dev_parent_is_expander() helper. Please test and review. Kind regards, Niklas Link: https://lore.kernel.org/r/20250814173215.1765055-12-cassel@kernel.org Signed-off-by: Martin K. Petersen commit 5c69e0b395c1ffb37fd6fbdbd428353fc0894005 Merge: 8beead2d155077 fe404279765121 Author: Jakub Kicinski Date: Tue Aug 19 18:33:09 2025 -0700 Merge branch 'stmmac-stop-silently-dropping-bad-checksum-packets' Oleksij Rempel says: ==================== stmmac: stop silently dropping bad checksum packets this series reworks how stmmac handles receive checksum offload (CoE) errors on dwmac4. At present, when CoE is enabled, the hardware silently discards any frame that fails checksum validation. These packets never reach the driver and are not accounted in the generic drop statistics. They are only visible in the stmmac-specific counters as "payload error" or "header error" packets, which makes it harder to debug or monitor network issues. Following discussion [1], the driver is reworked to propagate checksum error information up to the stack. With these changes, CoE stays enabled, but frames that fail hardware validation are no longer dropped in hardware. Instead, the driver marks them with CHECKSUM_NONE so the network stack can validate, drop, and properly account them in the standard drop statistics. [1] https://lore.kernel.org/all/20250625132117.1b3264e8@kernel.org/ ==================== Link: https://patch.msgid.link/20250818090217.2789521-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit fe4042797651215ca9acd83035122b5e940acf2e Author: Oleksij Rempel Date: Mon Aug 18 11:02:17 2025 +0200 net: stmmac: dwmac4: stop hardware from dropping checksum-error packets Tell the MAC not to discard frames that fail TCP/IP checksum validation. By default, when the hardware checksum engine (CoE) is enabled, dwmac4 silently drops any packet where the offload engine detects a checksum error. These frames are not reported to the driver and are not counted in any statistics as dropped packets. Set the MTL_OP_MODE_DIS_TCP_EF bit when initializing the Rx channel so that all packets are delivered, even if they failed hardware checksum validation. CoE remains enabled, but instead of dropping such frames, the driver propagates the error status and marks the skb with CHECKSUM_NONE. This allows the stack to verify and drop the packet while updating statistics. This change follows the decision made in the discussion: Link: https://lore.kernel.org/all/20250625132117.1b3264e8@kernel.org/ It depends on the previous patches that added proper error propagation in the Rx path. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250818090217.2789521-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 644b8437ccef9e7444164d8c4409933565928371 Author: Oleksij Rempel Date: Mon Aug 18 11:02:16 2025 +0200 net: stmmac: dwmac4: report Rx checksum errors in status Propagate hardware checksum failures from the descriptor parser to the caller. Currently, dwmac4_wrback_get_rx_status() updates stats when the Rx descriptor signals an IP header or payload checksum error, but it does not reflect this in its return value. The higher-level stmmac_rx() code therefore cannot tell that hardware checksum validation failed. Set the csum_none flag in the returned status when either RDES1_IP_HDR_ERROR or RDES1_IP_PAYLOAD_ERROR is present. This aligns dwmac4 with enh_desc_coe_rdes0() and lets stmmac_rx() mark the skb as CHECKSUM_NONE for software verification. This is a preparatory step for disabling the hardware filter that drops frames which do not pass checksum validation. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250818090217.2789521-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit ee0aace5f844ef59335148875d05bec8764e71e8 Author: Oleksij Rempel Date: Mon Aug 18 11:02:15 2025 +0200 net: stmmac: Correctly handle Rx checksum offload errors The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype. However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignored at this stage. This could cause corrupt packets to be passed up the network stack as valid. This patch corrects the logic by checking the `csum_none` status flag, which is set when the hardware reports a checksum error. If this flag is set, skb->ip_summed is now correctly set to CHECKSUM_NONE, ensuring the kernel's network stack will perform its own validation and properly handle the corrupt packet. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250818090217.2789521-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 8beead2d155077e78a671c2986df88eb2696b159 Merge: 3a752e67800106 021f989c863b40 Author: Jakub Kicinski Date: Tue Aug 19 18:11:18 2025 -0700 Merge branch 'there-are-a-cleancode-and-a-parameter-check-for-hns3-driver' Jijie Shao says: ==================== There are a cleancode and a parameter check for hns3 driver This patchset includes: 1. a parameter check omitted from fix code in net branch https://lore.kernel.org/all/20250723072900.GV2459@horms.kernel.org/ 2. a small clean code ==================== Link: https://patch.msgid.link/20250815100414.949752-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 021f989c863b40613d1a7595e6f88524fd5a531a Author: Jijie Shao Date: Fri Aug 15 18:04:14 2025 +0800 net: hns3: change the function return type from int to bool hclge_only_alloc_priv_buff() only return true or false, So, change the function return type from integer to boolean. Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20250815100414.949752-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit e16e973c576f89be26837778a5566ab9c4231852 Author: Jijie Shao Date: Fri Aug 15 18:04:13 2025 +0800 net: hns3: add parameter check for tx_copybreak and tx_spare_buf_size Since the driver always enables tx bounce buffer, there are minimum values for `copybreak` and `tx_spare_buf_size`. This patch will check and reject configurations with values smaller than these minimums. Closes: https://lore.kernel.org/all/20250723072900.GV2459@horms.kernel.org/ Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20250815100414.949752-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 3a752e67800106a5c42d802d67e06c60aa71d07b Author: Markus Stockhausen Date: Fri Aug 15 04:20:09 2025 -0400 net: phy: realtek: enable serdes option mode for RTL8226-CG The RTL8226-CG can make use of the serdes option mode feature to dynamically switch between SGMII and 2500base-X. From what is known the setup sequence is much simpler with no magic values. Convert the exiting config_init() into a helper that configures the PHY depending on generation 1 or 2. Call the helper from two separated new config_init() functions. Finally convert the phy_driver specs of the RTL8226-CG to make use of the new configuration and switch over to the extended read_status() function to dynamically change the interface according to the serdes mode. Remark! The logic could be simpler if the serdes mode could be set before all other generation 2 magic values. Due to missing RTL8221B test hardware the mmd command order was kept. Tested on Zyxel XGS1210-12. Signed-off-by: Markus Stockhausen Link: https://patch.msgid.link/20250815082009.3678865-1-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski commit 09bde6fdcd752b4512e7b554a3259e4f6b77c6d1 Author: Miguel García Date: Tue Aug 19 00:02:03 2025 +0200 ipv6: ip6_gre: replace strcpy with strscpy for tunnel name Replace the strcpy() call that copies the device name into tunnel->parms.name with strscpy(), to avoid potential overflow and guarantee NULL termination. This uses the two-argument form of strscpy(), where the destination size is inferred from the array type. Destination is tunnel->parms.name (size IFNAMSIZ). Tested in QEMU (Alpine rootfs): - Created IPv6 GRE tunnels over loopback - Assigned overlay IPv6 addresses - Verified bidirectional ping through the tunnel - Changed tunnel parameters at runtime (`ip -6 tunnel change`) Signed-off-by: Miguel García Link: https://patch.msgid.link/20250818220203.899338-1-miguelgarciaroman8@gmail.com Signed-off-by: Jakub Kicinski commit 9efd5152e32bb446752ead726a4621a50a95c11f Merge: 0e041220ea0645 a890348adcc993 Author: Jakub Kicinski Date: Tue Aug 19 17:53:30 2025 -0700 Merge branch 'net-convert-to-skb_dstref_steal-and-skb_dstref_restore' Stanislav Fomichev says: ==================== net: Convert to skb_dstref_steal and skb_dstref_restore To diagnose and prevent issues similar to [0], emit warning (CONFIG_DEBUG_NET) from skb_dst_set and skb_dst_set_noref when overwriting non-null reference-counted entry. Two new helpers are added to handle special cases where the entry needs to be reset and restored: skb_dstref_steal/skb_dstref_restore. The bulk of the patches in the series converts manual _skb_refst manipulations to these new helpers. 0: https://lore.kernel.org/netdev/20250723224625.1340224-1-sdf@fomichev.me/T/#u ==================== Link: https://patch.msgid.link/20250818154032.3173645-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit a890348adcc993f48d1ae38f1174dc8de4c3c5ac Author: Stanislav Fomichev Date: Mon Aug 18 08:40:32 2025 -0700 net: Add skb_dst_check_unset To prevent dst_entry leaks, add warning when the non-NULL dst_entry is rewritten. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-8-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 3e31075a119409613627517f205edd86a7f89d7b Author: Stanislav Fomichev Date: Mon Aug 18 08:40:31 2025 -0700 chtls: Convert to skb_dst_reset Going forward skb_dst_set will assert that skb dst_entry is empty during skb_dst_set. skb_dstref_steal is added to reset existing entry without doing refcnt. Chelsio driver is doing extra dst management via skb_dst_set(NULL). Replace these calls with skb_dstref_steal. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-7-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit da3b9d493ba27c710f4812f1d0a98846f3043f94 Author: Stanislav Fomichev Date: Mon Aug 18 08:40:30 2025 -0700 staging: octeon: Convert to skb_dst_drop Instead of doing dst_release and skb_dst_set, do skb_dst_drop which should do the right thing. Acked-by: Greg Kroah-Hartman Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-6-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit e97e6a1830ddb5885ba312e56b6fa3aa39b5f47e Author: Stanislav Fomichev Date: Mon Aug 18 08:40:29 2025 -0700 net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers Going forward skb_dst_set will assert that skb dst_entry is empty during skb_dst_set. skb_dstref_steal is added to reset existing entry without doing refcnt. skb_dstref_restore should be used to restore the previous entry. Convert icmp_route_lookup and ip_options_rcv_srr to these helpers. Add extra call to skb_dstref_reset to icmp_route_lookup to clear the ip_route_input entry. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-5-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 15488d4d8dc10a575f32cc692b6c9aa99f66bc7b Author: Stanislav Fomichev Date: Mon Aug 18 08:40:28 2025 -0700 netfilter: Switch to skb_dstref_steal to clear dst_entry Going forward skb_dst_set will assert that skb dst_entry is empty during skb_dst_set. skb_dstref_steal is added to reset existing entry without doing refcnt. Switch to skb_dstref_steal in ip[6]_route_me_harder and add a comment on why it's safe to skip skb_dstref_restore. Acked-by: Florian Westphal Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-4-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit c829aab21ed55d9e38346604259aa3ff88d17274 Author: Stanislav Fomichev Date: Mon Aug 18 08:40:27 2025 -0700 xfrm: Switch to skb_dstref_steal to clear dst_entry Going forward skb_dst_set will assert that skb dst_entry is empty during skb_dst_set. skb_dstref_steal is added to reset existing entry without doing refcnt. Switch to skb_dstref_steal in __xfrm_route_forward and add a comment on why it's safe to skip skb_dstref_restore. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit c3f0c02997c7f8489fec259e28e0e04e9811edac Author: Stanislav Fomichev Date: Mon Aug 18 08:40:26 2025 -0700 net: Add skb_dstref_steal and skb_dstref_restore Going forward skb_dst_set will assert that skb dst_entry is empty during skb_dst_set to prevent potential leaks. There are few places that still manually manage dst_entry not using the helpers. Convert them to the following new helpers: - skb_dstref_steal that resets dst_entry and returns previous dst_entry value - skb_dstref_restore that restores dst_entry previously reset via skb_dstref_steal Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250818154032.3173645-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 0e041220ea064585d3d667b70e03bad0f31f86bb Merge: 51992f99f068fb b0ac6d3b56a238 Author: Jakub Kicinski Date: Tue Aug 19 17:50:35 2025 -0700 Merge branch 'net-speedup-some-nexthop-handling-when-having-a-lot-of-nexthops' Christoph Paasch says: ==================== net: Speedup some nexthop handling when having A LOT of nexthops Configuring a very large number of nexthops is fairly possible within a reasonable time-frame. But, certain netlink commands can become extremely slow. This series addresses some of these, namely dumping and removing nexthops. v1: https://lore.kernel.org/20250724-nexthop_dump-v1-1-6b43fffd5bac@openai.com ==================== Link: https://patch.msgid.link/20250816-nexthop_dump-v2-0-491da3462118@openai.com Signed-off-by: Jakub Kicinski commit b0ac6d3b56a2384db151696cfda2836a8a961b6d Author: Christoph Paasch Date: Sat Aug 16 16:12:49 2025 -0700 net: When removing nexthops, don't call synchronize_net if it is not necessary When removing a nexthop, commit 90f33bffa382 ("nexthops: don't modify published nexthop groups") added a call to synchronize_rcu() (later changed to _net()) to make sure everyone sees the new nexthop-group before the rtnl-lock is released. When one wants to delete a large number of groups and nexthops, it is fastest to first flush the groups (ip nexthop flush groups) and then flush the nexthops themselves (ip -6 nexthop flush). As that way the groups don't need to be rebalanced. However, `ip -6 nexthop flush` will still take a long time if there is a very large number of nexthops because of the call to synchronize_net(). Now, if there are no more groups, there is no point in calling synchronize_net(). So, let's skip that entirely by checking if nh->grp_list is empty. This gives us a nice speedup: BEFORE: ======= $ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops real 1m45.345s user 0m0.001s sys 0m0.005s $ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops real 3m10.430s user 0m0.002s sys 0m0.004s AFTER: ====== $ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops real 0m17.545s user 0m0.003s sys 0m0.003s $ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops real 0m35.823s user 0m0.002s sys 0m0.004s Signed-off-by: Christoph Paasch Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com Signed-off-by: Jakub Kicinski commit 5236f57e7c033d869fe8f2080a977ea47882b26f Author: Christoph Paasch Date: Sat Aug 16 16:12:48 2025 -0700 net: Make nexthop-dumps scale linearly with the number of nexthops When we have a (very) large number of nexthops, they do not fit within a single message. rtm_dump_walk_nexthops() thus will be called repeatedly and ctx->idx is used to avoid dumping the same nexthops again. The approach in which we avoid dumping the same nexthops is by basically walking the entire nexthop rb-tree from the left-most node until we find a node whose id is >= s_idx. That does not scale well. Instead of this inefficient approach, rather go directly through the tree to the nexthop that should be dumped (the one whose nh_id >= s_idx). This allows us to find the relevant node in O(log(n)). We have quite a nice improvement with this: Before: ======= --> ~1M nexthops: $ time ~/libnl/src/nl-nh-list | wc -l 1050624 real 0m21.080s user 0m0.666s sys 0m20.384s --> ~2M nexthops: $ time ~/libnl/src/nl-nh-list | wc -l 2101248 real 1m51.649s user 0m1.540s sys 1m49.908s After: ====== --> ~1M nexthops: $ time ~/libnl/src/nl-nh-list | wc -l 1050624 real 0m1.157s user 0m0.926s sys 0m0.259s --> ~2M nexthops: $ time ~/libnl/src/nl-nh-list | wc -l 2101248 real 0m2.763s user 0m2.042s sys 0m0.776s Signed-off-by: Christoph Paasch Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250816-nexthop_dump-v2-1-491da3462118@openai.com Signed-off-by: Jakub Kicinski commit 51992f99f068fba966a680a9ac118b815f2fe08e Author: Jakub Kicinski Date: Fri Aug 15 16:15:13 2025 -0700 selftests: drv-net: ncdevmem: make configure_channels() support combined channels ncdevmem tests that the kernel correctly rejects attempts to deactivate queues with MPs bound. Make the configure_channels() test support combined channels. Currently it tries to set the queue counts to rx N tx N-1, which only makes sense for devices which have IRQs per ring type. Most modern devices used combined IRQs/channels with both Rx and Tx queues. Since the math is total Rx == combined+Rx setting Rx when combined is non-zero will be increasing the total queue count, not decreasing as the test intends. Note that the test would previously also try to set the Tx ring count to Rx - 1, for some reason. Which would be 0 if the device has only 2 queues configured. With this change (device with 2 queues): setting channel count rx:1 tx:1 YNL set channels: Kernel error: 'requested channel counts are too low for existing memory provider setting (2)' Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250815231513.381652-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit eddc821f98afaa13ecd09b02b73ac5946387ffcc Author: Jakub Kicinski Date: Fri Aug 15 15:41:00 2025 -0700 selftests: drv-net: tso: increase the retransmit threshold We see quite a few flakes during the TSO test against virtualized devices in NIPA. There's often 10-30 retransmissions during the test. Sometimes as many as 100. Set the retransmission threshold at 1/4th of the wire frame target. Link: https://patch.msgid.link/20250815224100.363438-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a95dcf3d67430493554a9fe3a3a8717c21554508 Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:34 2025 +0800 EDAC/skx_common: Remove unused *NUM*_IMC macros There are no references to the *NUM*_IMC macros, so remove them. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-8-qiuxu.zhuo@intel.com commit f7a29a37373baa0bd0823a5d55e97dc7f75a4dab Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:33 2025 +0800 EDAC/i10nm: Reallocate skx_dev list if preconfigured cnt != runtime cnt Ideally, read the present DDR memory controller count first and then allocate the skx_dev list using this count. However, this approach requires adding a significant amount of code similar to skx_get_all_bus_mappings() to obtain the PCI bus mappings for the first socket and use these mappings along with the related PCI register offset to read the memory controller count. Given that the Granite Rapids CPU is the only one that can detect the count of memory controllers at runtime (other CPUs use the count in the configuration data), to reduce code complexity, reallocate the skx_dev list only if the preconfigured count of DDR memory controllers differs from the count read at runtime for Granite Rapids CPU. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-7-qiuxu.zhuo@intel.com commit 91ded20fa2fefe2620b0abb998838312ea8bbfd2 Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:32 2025 +0800 EDAC/skx_common: Remove redundant upper bound check for res->imc The following upper bound check for the memory controller physical index decoded by ADXL is the only place where use the macro 'NUM_IMC' is used: res->imc > NUM_IMC - 1 Since this check is already covered by skx_get_mc_mapping(), meaning no memory controller logical index exists for an invalid memory controller physical index decoded by ADXL, remove the redundant upper bound check so that the definition for 'NUM_IMC' can be cleaned up (in another patch). Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-6-qiuxu.zhuo@intel.com commit 43060ca5332462903f57c2ff9b49b69124618070 Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:31 2025 +0800 EDAC/skx_common: Make skx_dev->imc[] a flexible array The current skx->imc[NUM_IMC] array of memory controller instances is sized using the macro NUM_IMC. Each time EDAC support is added for a new CPU, NUM_IMC needs to be updated to ensure it is greater than or equal to the number of memory controllers for the new CPU. This approach is inconvenient and results in memory waste for older CPUs with fewer memory controllers. To address this, make skx->imc[] a flexible array and determine its size from configuration data or at runtime. Suggested-by: Tony Luck Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-5-qiuxu.zhuo@intel.com commit 30b47b71fdc0091db5a4fa9503ad630aeb0ab3eb Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:30 2025 +0800 EDAC/skx_common: Swap memory controller index mapping The current mapping of memory controller indices is from physical index [1] to logical index [2], as show below: skx_dev->imc[pmc].mc_mapping = lmc Since skx_dev->imc[] is an array of present memory controller instances, mapping memory controller indices from logical index to physical index, as show below, is more reasonable. This is also a preparatory step for making skx_dev->imc[] a flexible array. skx_dev->imc[lmc].mc_mapping = pmc Both mappings are equivalent. No functional changes intended. [1] Indices for memory controllers include both those present to the OS and those disabled by BIOS. [2] Indices for memory controllers present to the OS. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-4-qiuxu.zhuo@intel.com commit 59cfc06a874e01633865d0b05eba47b09b8b3a8f Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:29 2025 +0800 EDAC/skx_common: Move mc_mapping to be a field inside struct skx_imc The mc_mapping and imc fields of struct skx_dev have the same size, NUM_IMC. Move mc_mapping to be a field inside struct skx_imc to prepare for making the imc array of memory controller instances a flexible array. No functional changes intended. Suggested-by: Tony Luck Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-3-qiuxu.zhuo@intel.com commit 219af5dfce98fe254335ea79c2bf98428c38370c Author: Qiuxu Zhuo Date: Thu Jul 31 22:55:28 2025 +0800 EDAC/{skx_common,skx}: Use configuration data, not global macros Use model-specific configuration data for the number of memory controllers per socket, channels per memory controller, and DIMMs per channel as intended, instead of relying on global macros for maximum values. No functional changes intended. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250731145534.2759334-2-qiuxu.zhuo@intel.com commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff Author: Qiuxu Zhuo Date: Wed Aug 6 14:57:07 2025 +0800 EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 shift exponent -66 is negative ... __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] skx_register_mci+0x159/0x220 [skx_edac_common] i10nm_init+0xcb0/0x1ff0 [i10nm_edac] ... This occurs because some BIOS may disable a memory controller if there aren't any memory DIMMs populated on this memory controller. The DIMMMTR register of this disabled memory controller contains the invalid value ~0, resulting in the call trace above. Fix this call trace by skipping DIMM enumeration on a disabled memory controller. Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support") Reported-by: Jose Jesus Ambriz Meza Reported-by: Chia-Lin Kao (AceLan) Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/ Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Tested-by: Chia-Lin Kao (AceLan) Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com commit f1f2a22b8683d7ac38821d4508d4549a2f0c0a0a Author: Shankari Anand Date: Fri Aug 15 21:47:06 2025 +0530 rust: drm: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in drm to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Reviewed-by: Elle Rhumsaa Link: https://lore.kernel.org/r/20250815161706.1324860-1-shankari.ak0208@gmail.com Signed-off-by: Danilo Krummrich commit 71b69f817e91b588030d7d47ddbdc4857a92eb4e Author: Kyle Manna Date: Tue Aug 19 09:17:39 2025 -0700 EDAC/ie31200: Add two more Intel Alder Lake-S SoCs for EDAC support Host Device IDs (DID0) correspond to: * Intel Core i7-12700K * Intel Core i5-12600K See documentation: * 12th Generation Intel® Core™ Processors Datasheet * Volume 1 of 2, Doc. No.: 655258, Rev.: 011 * https://edc.intel.com/output/DownloadPdfDocument?id=8297 (PDF) Signed-off-by: Kyle Manna Signed-off-by: Tony Luck Reviewed-by: Qiuxu Zhuo Link: https://lore.kernel.org/r/20250819161739.3241152-1-kyle@kylemanna.com commit 046c56178a73ad7883fc38e6caa0474025c0fe86 Author: Shankari Anand Date: Sat Aug 16 17:14:09 2025 +0530 rust,cred: update AlwaysRefCounted import to sync::aref Update the import of `AlwaysRefCounted` in `cred.rs` to use `sync::aref` instead of `types`. This is part of the ongoing effort to move `ARef` and `AlwaysRefCounted` to the `sync` module for better modularity. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Acked-by: Serge Hallyn Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl [PM: subj tweak] Signed-off-by: Paul Moore commit 3d9ab61f53cdf72fed737c66652a8aad9d27504c Author: Salah Triki Date: Fri Jul 25 06:07:01 2025 +0100 thermal: intel: int340x: Remove redundant acpi_has_method() call acpi_evaluate_object() returns an error if the needed method does not exist, so remove an unnecessary acpi_has_method() call preceding it. Signed-off-by: Salah Triki Link: https://patch.msgid.link/aIMQ9RFciI8jmmAh@pc [ rjw: Subject adjustment ] Signed-off-by: Rafael J. Wysocki commit c5746dc1898a1bd5518a03081dc7e380569e269d Author: Zihuan Zhang Date: Fri Jul 25 12:14:50 2025 +0800 cpufreq: Avoid calling get_governor() for first policy When a cpufreq driver registers the first policy, it may attempt to initialize the policy governor from `last_governor`. However, this is meaningless for the first policy instance, because `last_governor` is only updated when policies are removed (e.g. during CPU offline). The `last_governor` mechanism is intended to restore the previously used governor across CPU hotplug events. For the very first policy, there is no "previous governor" to restore, so calling get_governor(last_governor) is unnecessary and potentially confusing. Skip looking up `last_governor` when registering the first policy. Instead, it directly uses the default governor after all governors have been registered and are available. This avoids meaningless lookups, reduces unnecessary module reference handling, and simplifies the initial policy path. Signed-off-by: Zihuan Zhang Acked-by: Viresh Kumar Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20250725041450.68754-1-zhangzihuan@kylinos.cn [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit c26675447faff8c4ddc1dc5d2cd28326b8181aaf Author: Chao Gao Date: Mon Aug 11 19:55:13 2025 -0700 KVM: x86: Zero XSTATE components on INIT by iterating over supported features Tweak the code a bit to facilitate resetting more xstate components in the future, e.g., CET's xstate-managed MSRs. No functional change intended. Suggested-by: Sean Christopherson Tested-by: Mathias Krause Tested-by: John Allen Signed-off-by: Chao Gao Tested-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250812025606.74625-6-chao.gao@intel.com Signed-off-by: Sean Christopherson commit 41f6710f99f4337924e3929e8e7a51c74f800b91 Author: Sean Christopherson Date: Mon Aug 11 19:55:12 2025 -0700 KVM: x86: Manually clear MPX state only on INIT Don't manually clear/zero MPX state on RESET, as the guest FPU state is zero allocated and KVM only does RESET during vCPU creation, i.e. the relevant state is guaranteed to be all zeroes. Opportunistically move the relevant code into a helper in anticipation of adding support for CET shadow stacks, which also has state that is zeroed on INIT. Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Signed-off-by: Chao Gao Tested-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250812025606.74625-5-chao.gao@intel.com Signed-off-by: Sean Christopherson commit c2aa58b226abf5ac6d355fb1f3b7c4284a7b5cab Author: Yang Weijiang Date: Mon Aug 11 19:55:11 2025 -0700 KVM: x86: Add kvm_msr_{read,write}() helpers Wrap __kvm_{get,set}_msr() into two new helpers for KVM usage and use the helpers to replace existing usage of the raw functions. kvm_msr_{read,write}() are KVM-internal helpers, i.e. used when KVM needs to get/set a MSR value for emulating CPU behavior, i.e., host_initiated == %true in the helpers. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Signed-off-by: Chao Gao Tested-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250812025606.74625-4-chao.gao@intel.com Signed-off-by: Sean Christopherson commit db07f3d0eb19663d8fb61b40c19b26703c9a1b1a Author: Sean Christopherson Date: Mon Aug 11 19:55:10 2025 -0700 KVM: x86: Use double-underscore read/write MSR helpers as appropriate Use the double-underscore helpers for emulating MSR reads and writes in he no-underscore versions to better capture the relationship between the two sets of APIs (the double-underscore versions don't honor userspace MSR filters). No functional change intended. Signed-off-by: Chao Gao Tested-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250812025606.74625-3-chao.gao@intel.com Signed-off-by: Sean Christopherson commit d2dcf25a4cf2d9058a866c2237884287209b8d19 Author: Yang Weijiang Date: Mon Aug 11 19:55:09 2025 -0700 KVM: x86: Rename kvm_{g,s}et_msr()* to show that they emulate guest accesses Rename kvm_{g,s}et_msr_with_filter() kvm_{g,s}et_msr() to kvm_emulate_msr_{read,write} __kvm_emulate_msr_{read,write} to make it more obvious that KVM uses these helpers to emulate guest behaviors, i.e., host_initiated == false in these helpers. Suggested-by: Sean Christopherson Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Signed-off-by: Chao Gao Tested-by: Rick Edgecombe Link: https://lore.kernel.org/r/20250812025606.74625-2-chao.gao@intel.com Signed-off-by: Sean Christopherson commit d90ebf5a06ecc6d4d7f72d12c5029519af8f838d Author: Xin Li Date: Tue Aug 5 13:22:24 2025 -0700 KVM: x86: Advertise support for the immediate form of MSR instructions Advertise support for the immediate form of MSR instructions to userspace if the instructions are supported by the underlying CPU, and KVM is using VMX, i.e. is running on an Intel-compatible CPU. For SVM, explicitly clear X86_FEATURE_MSR_IMM to ensure KVM doesn't over- report support if AMD-compatible CPUs ever implement the immediate forms, as SVM will likely require explicit enablement in KVM. Signed-off-by: Xin Li (Intel) [sean: massage changelog] Link: https://lore.kernel.org/r/20250805202224.1475590-7-seanjc@google.com Signed-off-by: Sean Christopherson commit ec93675a325191c95bc322a4471c2f194f7211fc Author: Xin Li Date: Tue Aug 5 13:22:23 2025 -0700 KVM: VMX: Support the immediate form of WRMSRNS in the VM-Exit fastpath Add support for handling "WRMSRNS with an immediate" VM-Exits in KVM's fastpath. On Intel, all writes to the x2APIC ICR and to the TSC Deadline MSR are non-serializing, i.e. it's highly likely guest kernels will switch to using WRMSRNS when possible. And in general, any MSR written via WRMSRNS is probably worth handling in the fastpath, as the entire point of WRMSRNS is to shave cycles in hot paths. Signed-off-by: Xin Li (Intel) [sean: rewrite changelog, split rename to separate patch] Link: https://lore.kernel.org/r/20250805202224.1475590-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 885df2d2109a60f84d84639ce6d95a91045f6c45 Author: Xin Li Date: Tue Aug 5 13:22:22 2025 -0700 KVM: x86: Add support for RDMSR/WRMSRNS w/ immediate on Intel Add support for the immediate forms of RDMSR and WRMSRNS (currently Intel-only). The immediate variants are only valid in 64-bit mode, and use a single general purpose register for the data (the register is also encoded in the instruction, i.e. not implicit like regular RDMSR/WRMSR). The immediate variants are primarily motivated by performance, not code size: by having the MSR index in an immediate, it is available *much* earlier in the CPU pipeline, which allows hardware much more leeway about how a particular MSR is handled. Intel VMX support for the immediate forms of MSR accesses communicates exit information to the host as follows: 1) The immediate form of RDMSR uses VM-Exit Reason 84. 2) The immediate form of WRMSRNS uses VM-Exit Reason 85. 3) For both VM-Exit reasons 84 and 85, the Exit Qualification field is set to the MSR index that triggered the VM-Exit. 4) Bits 3 ~ 6 of the VM-Exit Instruction Information field are set to the register encoding used by the immediate form of the instruction, i.e. the destination register for RDMSR, and the source for WRMSRNS. 5) The VM-Exit Instruction Length field records the size of the immediate form of the MSR instruction. To deal with userspace RDMSR exits, stash the destination register in a new kvm_vcpu_arch field, similar to cui_linear_rip, pio, etc. Alternatively, the register could be saved in kvm_run.msr or re-retrieved from the VMCS, but the former would require sanitizing the value to ensure userspace doesn't clobber the value to an out-of-bounds index, and the latter would require a new one-off kvm_x86_ops hook. Don't bother adding support for the instructions in KVM's emulator, as the only way for RDMSR/WRMSR to be encountered is if KVM is emulating large swaths of code due to invalid guest state, and a vCPU cannot have invalid guest state while in 64-bit mode. Signed-off-by: Xin Li (Intel) [sean: minor tweaks, massage and expand changelog] Link: https://lore.kernel.org/r/20250805202224.1475590-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 87a877de367d835b527d1086f75727123ef85fc4 Author: Xin Li Date: Tue Aug 5 13:22:21 2025 -0700 KVM: x86: Rename handle_fastpath_set_msr_irqoff() to handle_fastpath_wrmsr() Rename the WRMSR fastpath API to drop "irqoff", as that information is redundant (the fastpath always runs with IRQs disabled), and to prepare for adding a fastpath for the immediate variant of WRMSRNS. No functional change intended. Signed-off-by: Xin Li (Intel) [sean: split to separate patch, write changelog] Link: https://lore.kernel.org/r/20250805202224.1475590-4-seanjc@google.com Signed-off-by: Sean Christopherson commit ec400f6c2f2703cb6c698dd00b28cfdb8ee5cdcc Author: Sean Christopherson Date: Tue Aug 5 13:22:20 2025 -0700 KVM: x86: Rename local "ecx" variables to "msr" and "pmc" as appropriate Rename "ecx" variables in {RD,WR}MSR and RDPMC helpers to "msr" and "pmc" respectively, in anticipation of adding support for the immediate variants of RDMSR and WRMSRNS, and to better document what the variables hold (versus where the data originated). No functional change intended. Link: https://lore.kernel.org/r/20250805202224.1475590-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 3c7cb84145336721eddc86982532df84bbc80853 Author: Xin Li Date: Tue Aug 5 13:22:19 2025 -0700 x86/cpufeatures: Add a CPU feature bit for MSR immediate form instructions The immediate form of MSR access instructions are primarily motivated by performance, not code size: by having the MSR number in an immediate, it is available *much* earlier in the pipeline, which allows the hardware much more leeway about how a particular MSR is handled. Use a scattered CPU feature bit for MSR immediate form instructions. Suggested-by: Borislav Petkov (AMD) Signed-off-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250805202224.1475590-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 6c3d4b917995a17f515943ccd39ba11b81753b0d Author: Sean Christopherson Date: Tue Aug 5 12:05:26 2025 -0700 KVM: x86: Add a fastpath handler for INVD Add a fastpath handler for INVD so that the common fastpath logic can be trivially tested on both Intel and AMD. Under KVM, INVD is always: (a) intercepted, (b) available to the guest, and (c) emulated as a nop, with no side effects. Combined with INVD not having any inputs or outputs, i.e. no register constraints, INVD is the perfect instruction for exercising KVM's fastpath as it can be inserted into practically any guest-side code stream. Link: https://lore.kernel.org/r/20250805190526.1453366-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 8bb8b60c95c55c13f9924f3f090232e14d035d43 Author: Sean Christopherson Date: Tue Aug 5 12:05:25 2025 -0700 KVM: x86: Push acquisition of SRCU in fastpath into kvm_pmu_trigger_event() Acquire SRCU in the VM-Exit fastpath if and only if KVM needs to check the PMU event filter, to further trim the amount of code that is executed with SRCU protection in the fastpath. Counter-intuitively, holding SRCU can do more harm than good due to masking potential bugs, and introducing a new SRCU-protected asset to code reachable via kvm_skip_emulated_instruction() would be quite notable, i.e. definitely worth auditing. E.g. the primary user of kvm->srcu is KVM's memslots, accessing memslots all but guarantees guest memory may be accessed, accessing guest memory can fault, and page faults might sleep, which isn't allowed while IRQs are disabled. Not acquiring SRCU means the (hypothetical) illegal sleep would be flagged when running with PROVE_RCU=y, even if DEBUG_ATOMIC_SLEEP=n. Note, performance is NOT a motivating factor, as SRCU lock/unlock only adds ~15 cycles of latency to fastpath VM-Exits. I.e. overhead isn't a concern _if_ SRCU protection needs to be extended beyond PMU events, e.g. to honor userspace MSR filters. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 3eced8b07bb984a3bd2959f0644c14929c848c3b Author: Sean Christopherson Date: Tue Aug 5 12:05:24 2025 -0700 KVM: x86/pmu: Rename check_pmu_event_filter() to pmc_is_event_allowed() Rename check_pmu_event_filter() to make its polarity more obvious, and to connect the dots to is_gp_event_allowed() and is_fixed_event_allowed(). No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 8709656514c1106933befcdefdcc5fd9bc013ed2 Author: Sean Christopherson Date: Tue Aug 5 12:05:23 2025 -0700 KVM: x86/pmu: Drop redundant check on PMC being locally enabled for emulation Drop the check on a PMC being locally enabled when triggering emulated events, as the bitmap of passed-in PMCs only contains locally enabled PMCs. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 58baa649ea09e7b719d0ef51aba894d63c2bb64f Author: Sean Christopherson Date: Tue Aug 5 12:05:22 2025 -0700 KVM: x86/pmu: Drop redundant check on PMC being globally enabled for emulation When triggering PMC events in response to emulation, drop the redundant checks on a PMC being globally and locally enabled, as the passed in bitmap contains only PMCs that are locally enabled (and counting the right event), and the local copy of the bitmap has already been masked with global_ctrl. No true functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-15-seanjc@google.com Signed-off-by: Sean Christopherson commit e630bb52d27f4191324d3443ecb2b115d7fb14b2 Author: Sean Christopherson Date: Tue Aug 5 12:05:21 2025 -0700 KVM: x86/pmu: Open code pmc_event_is_allowed() in its callers Open code pmc_event_is_allowed() in its callers, as kvm_pmu_trigger_event() only needs to check the event filter (both global and local enables are consulted outside of the loop). No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 6b6f1adc43320494197ddbefbe933faea21e2d10 Author: Sean Christopherson Date: Tue Aug 5 12:05:20 2025 -0700 KVM: x86/pmu: Rename pmc_speculative_in_use() to pmc_is_locally_enabled() Rename pmc_speculative_in_use() to pmc_is_locally_enabled() to better capture what it actually tracks, and to show its relationship to pmc_is_globally_enabled(). While neither AMD nor Intel refer to event selectors or the fixed counter control MSR as "local", it's the obvious name to pair with "global". As for "speculative", there's absolutely nothing speculative about the checks. E.g. for PMUs without PERF_GLOBAL_CTRL, from the guest's perspective, the counters are "in use" without any qualifications. No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 5dfd498bad5f07b7419b5f834d95f7b61e767048 Author: Sean Christopherson Date: Tue Aug 5 12:05:19 2025 -0700 KVM: x86/pmu: Calculate set of to-be-emulated PMCs at time of WRMSRs Calculate and track PMCs that are counting instructions/branches retired when the PMC's event selector (or fixed counter control) is modified instead evaluating the event selector on-demand. Immediately recalc a PMC's configuration on writes to avoid false negatives/positives when KVM skips an emulated WRMSR, which is guaranteed to occur before the main run loop processes KVM_REQ_PMU. Out of an abundance of caution, and because it's relatively cheap, recalc reprogrammed PMCs in kvm_pmu_handle_event() as well. Recalculating in response to KVM_REQ_PMU _should_ be unnecessary, but for now be paranoid to avoid introducing easily-avoidable bugs in edge cases. The code can be removed in the future if necessary, e.g. in the unlikely event that the overhead of recalculating to-be-emulated PMCs is noticeable. Note! Deliberately don't check the PMU event filters, as doing so could result in KVM consuming stale information. Tracking which PMCs are counting branches/instructions will allow grabbing SRCU in the fastpath VM-Exit handlers if and only if a PMC event might be triggered (to consult the event filters), and will also allow the upcoming mediated PMU to do the right thing with respect to counting instructions (the mediated PMU won't be able to update PMCs in the VM-Exit fastpath). Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 43f5bea2639ccca59541f33d62342543b4461937 Author: Sean Christopherson Date: Tue Aug 5 12:05:18 2025 -0700 KVM: x86/pmu: Add wrappers for counting emulated instructions/branches Add wrappers for triggering instruction retired and branch retired PMU events in anticipation of reworking the internal mechanisms to track which PMCs need to be evaluated, e.g. to avoid having to walk and check every PMC. Opportunistically bury "struct kvm_pmu_emulated_event_selectors" in pmu.c. No functional change intended. Link: https://lore.kernel.org/r/20250805190526.1453366-11-seanjc@google.com Signed-off-by: Sean Christopherson commit a3e80bf73ee1f89ad4ccd53dd4f2654e23e72529 Author: Sean Christopherson Date: Tue Aug 5 12:05:17 2025 -0700 KVM: x86/pmu: Move kvm_init_pmu_capability() to pmu.c Move kvm_init_pmu_capability() to pmu.c so that future changes can access variables that have no business being visible outside of pmu.c. kvm_init_pmu_capability() is called once per module load, there's is zero reason it needs to be inlined. No functional change intended. Cc: Dapeng Mi Cc: Sandipan Das Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250805190526.1453366-10-seanjc@google.com Signed-off-by: Sean Christopherson commit d618fb4e43a0287a54551aa01be58c75ac668671 Author: Sean Christopherson Date: Tue Aug 5 12:05:16 2025 -0700 KVM: x86: Fold WRMSR fastpath helpers into the main handler Fold the per-MSR WRMSR fastpath helpers into the main handler now that the IPI path in particular is relatively tiny. In addition to eliminating a decent amount of boilerplate, this removes the ugly -errno/1/0 => bool conversion (which is "necessitated" by kvm_x2apic_icr_write_fast()). Opportunistically drop the comment about IPIs, as the purpose of the fastpath is hopefully self-evident, and _if_ it needs more documentation, the documentation (and rules!) should be placed in a more central location. No functional change intended. Link: https://lore.kernel.org/r/20250805190526.1453366-9-seanjc@google.com Signed-off-by: Sean Christopherson commit aa2e4f029341c0b56645d49cd5959946cdab31b9 Author: Sean Christopherson Date: Tue Aug 5 12:05:15 2025 -0700 KVM: x86: Unconditionally grab data from EDX:EAX in WRMSR fastpath Always grab EDX:EAX in the WRMSR fastpath to deduplicate and simplify the case statements, and to prepare for handling immediate variants of WRMSRNS in the fastpath (the data register is explicitly provided in that case). There's no harm in reading the registers, as their values are always available, i.e. don't require VMREADs (or similarly slow operations). No real functional change intended. Cc: Xin Li Link: https://lore.kernel.org/r/20250805190526.1453366-8-seanjc@google.com Signed-off-by: Sean Christopherson commit aebcbb60977323c21c8d89eb4298e454f8e89299 Author: Sean Christopherson Date: Tue Aug 5 12:05:14 2025 -0700 KVM: x86: Acquire SRCU in WRMSR fastpath iff instruction needs to be skipped Acquire SRCU in the WRMSR fastpath if and only if an instruction needs to be skipped, i.e. only if the fastpath succeeds. The reasoning in commit 3f2739bd1e0b ("KVM: x86: Acquire SRCU read lock when handling fastpath MSR writes") about "avoid having to play whack-a-mole" seems sound, but in hindsight unconditionally acquiring SRCU does more harm than good. While acquiring/releasing SRCU isn't slow per se, the things that are _protected_ by kvm->srcu are generally safe to access only in the "slow" VM-Exit path. E.g. accessing memslots in generic helpers is never safe, because accessing guest memory with IRQs disabled is unless unsafe (except when kvm_vcpu_read_guest_atomic() is used, but that API should never be used in emulation helpers). In other words, playing whack-a-mole is actually desirable in this case, because every access to an asset protected by kvm->srcu warrants further scrutiny. Link: https://lore.kernel.org/r/20250805190526.1453366-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 0a94b2042419f7896f5d362465731506e43bc319 Author: Sean Christopherson Date: Tue Aug 5 12:05:13 2025 -0700 KVM: x86: Unconditionally handle MSR_IA32_TSC_DEADLINE in fastpath exits Drop the fastpath VM-Exit requirement that KVM can use the hypervisor timer to emulate the APIC timer in TSC deadline mode. I.e. unconditionally handle MSR_IA32_TSC_DEADLINE WRMSRs in the fastpath. Restricting the fastpath to *maybe* using the VMX preemption timer is ineffective and unnecessary. If the requested deadline can't be programmed into the VMX preemption timer, KVM will fall back to hrtimers, i.e. the restriction is ineffective as far as preventing any kind of worst case scenario. But guarding against a worst case scenario is completely unnecessary as the "slow" path, start_sw_tscdeadline() => hrtimer_start(), explicitly disables IRQs. In fact, the worst case scenario is when KVM thinks it can use the VMX preemption timer, as KVM will eat the overhead of calling into vmx_set_hv_timer() and falling back to hrtimers. Opportunistically limit kvm_can_use_hv_timer() to lapic.c as the fastpath code was the only external user. Stating the obvious, this allows handling MSR_IA32_TSC_DEADLINE writes in the fastpath on AMD CPUs. Link: https://lore.kernel.org/r/20250805190526.1453366-6-seanjc@google.com Signed-off-by: Sean Christopherson commit aeeb4c7fff525e0fd71ec28162b713b8cb1ec943 Author: Sean Christopherson Date: Tue Aug 5 12:05:12 2025 -0700 KVM: x86: Drop semi-arbitrary restrictions on IPI type in fastpath Drop the restrictions on fastpath IPIs only working for fixed IRQs with a physical destination now that the fastpath is explicitly limited to "fast" delivery. Limiting delivery to a single physical APIC ID guarantees only one vCPU will receive the event, but that isn't necessary "fast", e.g. if the targeted vCPU is the last of 4096 vCPUs. And logical destination mode or shorthand (to self) can also be fast, e.g. if only a few vCPUs are being targeted. Lastly, there's nothing inherently slow about delivering an NMI, INIT, SIPI, SMI, etc., i.e. there's no reason to artificially limit fastpath delivery to fixed vector IRQs. Link: https://lore.kernel.org/r/20250805190526.1453366-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 777414340085711cafd3807a72c531107c0ff7f6 Author: Sean Christopherson Date: Tue Aug 5 12:05:11 2025 -0700 KVM: x86: Only allow "fast" IPIs in fastpath WRMSR(X2APIC_ICR) handler Explicitly restrict fastpath ICR writes to IPIs that are "fast", i.e. can be delivered without having to walk all vCPUs, and that target at most 16 vCPUs. Artificially restricting ICR writes to physical mode guarantees at most one vCPU will receive in IPI (because x2APIC IDs are read-only), but that delivery might not be "fast". E.g. even if the vCPU exists, KVM might have to iterate over 4096 vCPUs to find the right one. Limiting delivery to fast IPIs aligns the WRMSR fastpath with kvm_arch_set_irq_inatomic() (which also runs with IRQs disabled), and will allow dropping the semi-arbitrary restrictions on delivery mode and type. Link: https://lore.kernel.org/r/20250805190526.1453366-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 15daa58e78cef70945324db162d1afbf3f493fb6 Author: Sean Christopherson Date: Tue Aug 5 12:05:10 2025 -0700 KVM: x86: Add kvm_icr_to_lapic_irq() helper to allow for fastpath IPIs Extract the code for converting an ICR message into a kvm_lapic_irq structure into a local helper so that a fast-only IPI path can share the conversion logic. No functional change intended. Link: https://lore.kernel.org/r/20250805190526.1453366-3-seanjc@google.com Signed-off-by: Sean Christopherson commit cc63f918a215a24a72992295566cab5f8f89b08e Author: Yury Norov Date: Sat Jul 19 21:58:45 2025 -0400 kvm: x86: simplify kvm_vector_to_index() Use find_nth_bit() and make the function almost a one-liner. Signed-off-by: Yury Norov Signed-off-by: Sean Christopherson commit 1f0654dc75b8b4945988f802e4e532ff722ecce7 Author: Ewan Hai Date: Mon Aug 18 04:30:34 2025 -0400 KVM: x86: allow CPUID 0xC000_0000 to proceed on Zhaoxin CPUs Bypass the Centaur-only filter for the CPUID signature leaf so that processing continues when the CPU vendor is Zhaoxin. Signed-off-by: Ewan Hai Link: https://lore.kernel.org/r/20250818083034.93935-1-ewanhai-oc@zhaoxin.com Signed-off-by: Sean Christopherson commit 49be82d4ad2ea3329c77b9e6010507baf1c66134 Author: Thomas Huth Date: Mon Jul 28 17:28:43 2025 +0200 arch/x86/kvm/ioapic: Remove license boilerplate with bad FSF address The Free Software Foundation does not reside in "59 Temple Place" anymore, so we should not mention that address in the source code here. But instead of updating the address to their current location, let's rather drop the license boilerplate text here and use a proper SPDX license identifier instead. The text talks about the "GNU *Lesser* General Public License" and "any later version", so LGPL-2.1+ is the right choice here. Signed-off-by: Thomas Huth Link: https://lore.kernel.org/r/20250728152843.310260-1-thuth@redhat.com Signed-off-by: Sean Christopherson commit 0910dd7c9ad45a2605c45fd2bf3d1bcac087687c Author: Sean Christopherson Date: Tue Aug 5 12:05:09 2025 -0700 KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [] __schedule+0x1e2/0xed0 softirqs last enabled at (30570): [] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290 __might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm] __do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons). Fixes: b439eb8ab578 ("Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250805190526.1453366-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 68e61f6fd65610e73b17882f86fedfd784d99229 Author: Sean Christopherson Date: Fri Jul 11 10:27:46 2025 -0700 KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 Emulate PERF_CNTR_GLOBAL_STATUS_SET when PerfMonV2 is enumerated to the guest, as the MSR is supposed to exist in all AMD v2 PMUs. Fixes: 4a2771895ca6 ("KVM: x86/svm/pmu: Add AMD PerfMonV2 support") Cc: stable@vger.kernel.org Cc: Sandipan Das Link: https://lore.kernel.org/r/20250711172746.1579423-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 7cbb14d361bd562fd6e2b3a96c13d5567fd3067a Author: Qianfeng Rong Date: Fri Aug 8 15:45:32 2025 +0800 KVM: TDX: Remove redundant __GFP_ZERO Remove the redundant __GFP_ZERO flag from kcalloc() since kcalloc() inherently zeroes memory. Signed-off-by: Qianfeng Rong Reviewed-by: Kai Huang Link: https://lore.kernel.org/r/20250808074532.215098-1-rongqianfeng@vivo.com Signed-off-by: Sean Christopherson commit cf6a8401b6a12c3bdd54c7414af28625ec6450da Author: Qianfeng Rong Date: Thu Aug 7 22:49:43 2025 +0800 KVM: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250807144943.581663-1-rongqianfeng@vivo.com Signed-off-by: Sean Christopherson commit 481ee0fcbb9a0f0706d6d29de9570d1048aff631 Author: E Shattow Date: Tue Jul 29 07:11:35 2025 -0700 riscv: dts: starfive: jh7110-common: drop no-sdio property from mmc1 Relax no-sdio restriction on mmc1 for jh7110 boards. Property was introduced for StarFive VisionFive2 dts to configure mmc1 for SD Card but this is not necessary, the restriction is only needed to block use of commands that would cause a device to malfunction. Signed-off-by: E Shattow Signed-off-by: Conor Dooley commit 8efe8816a7ddc98a733ca3326ae8794750bbbd34 Author: Danilo Krummrich Date: Mon Aug 18 20:08:48 2025 +0200 rust: alloc: add ARCH_KMALLOC_MINALIGN to bindgen blocklist For some architectures, such as X86_64, ARCH_KMALLOC_MINALIGN is not resolvable for bindgen. E.g. due to being defined as __alignof__(unsigned long long). Hence, we have to create a rust helper, i.e. let the C compiler evaluate the expression and store it in a const. However, if for other architectures, such as arm64, ARCH_KMALLOC_MINALIGN does evaluate to something that can be directly processed by bindgen, we end up with multiple definitions of ARCH_KMALLOC_MINALIGN in the generated bindings. error[E0428]: the name `ARCH_KMALLOC_MINALIGN` is defined multiple times --> /builddir/build/BUILD/kernel-6.17.0-build/kernel-next-20250818/linux-6.17.0-0.0.next.20250818.423.vanilla.fc44.aarch64/rust/bindings/bindings_generated.rs:134545:1 | 9622 | pub const ARCH_KMALLOC_MINALIGN: u32 = 8; | ----------------------------------------- previous definition of the value `ARCH_KMALLOC_MINALIGN` here ... 134545 | pub const ARCH_KMALLOC_MINALIGN: usize = 8; | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `ARCH_KMALLOC_MINALIGN` redefined here | = note: `ARCH_KMALLOC_MINALIGN` must be defined only once in the value namespace of this module To fix this up, add ARCH_KMALLOC_MINALIGN to the blocklist of bindgen, such that we always only generate the symbol from the rust helper. Reported-by: Thorsten Leemhuis Closes: https://lore.kernel.org/all/8aa05f08-ef6e-4dfe-9453-beaab7b3cb98@leemhuis.info/ Fixes: 1b1a946dc2b5 ("rust: alloc: specify the minimum alignment of each allocator") Tested-by: Thorsten Leemhuis Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250818180923.192042-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 65391feb042b2b2cfc4263d64d41a66ef4a7e03e Author: Sean Christopherson Date: Thu Jun 26 10:16:01 2025 -0700 KVM: VMX: Add host MSR read/write helpers to consolidate preemption handling Add host MSR read/write helpers to consolidate preemption handling to prepare for adding FRED RSP0 access functions without duplicating the preemption handling code. Signed-off-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250626171601.2293914-1-xin@zytor.com Signed-off-by: Sean Christopherson commit a1f2418c3eea05a2a11ec76a1913e9e8e77039ff Author: Xin Li Date: Mon Jul 14 18:25:17 2025 -0700 KVM: VMX: Fix an indentation Fix an indentation by replacing 8 spaces with a tab. While at it, add empty lines before and after for better readability. Signed-off-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250715012517.694429-1-xin@zytor.com Signed-off-by: Sean Christopherson commit e750f85391286a4c8100275516973324b621a269 Author: Sean Christopherson Date: Tue Jul 15 12:06:38 2025 -0700 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reported-by: syzbot+cc2032ba16cc2018ca25@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68790db4.a00a0220.3af5df.0020.GAE@google.com Fixes: 8a76d7f25f8f ("KVM: x86: Add x86 callback for intercept check") Cc: stable@vger.kernel.org Cc: Jim Mattson Link: https://lore.kernel.org/r/20250715190638.1899116-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 05f297c3e39f62f579458a59ab1b1c8bf3fc1c51 Author: Gopi Krishna Menon Date: Wed Aug 13 21:17:51 2025 +0530 KVM: selftests: fix minor typo in cpumodel_subfuncs Specifically, fix spelling of "available" in main function. Signed-off-by: Gopi Krishna Menon Link: https://lore.kernel.org/r/20250813154751.5725-1-krishnagopi487@gmail.com Signed-off-by: Sean Christopherson commit b875b97017050b92c64273178a0b0d282ea67874 Merge: c1dd310f1d76b4 27848c082ba0b2 Author: Mark Brown Date: Tue Aug 19 18:45:38 2025 +0100 spi: Remove the use of dev_err_probe() Merge series from Xichao Zhao : The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. commit 132e098ef9b60760ef9ef0c0eefc80c52cb498fb Merge: 9963b1fde2b6a9 da9881d00153cc Author: Mark Brown Date: Tue Aug 19 18:45:33 2025 +0100 ASoC: qcom: audioreach: cleanup and calibration Merge series from srinivas.kandagatla@oss.qualcomm.com: Sorry to resend this series once again, as some of the patches seems to be dropped/rejected by email client from previous send. This patchset: - cleans up some of the audioreach tokens which are unused - adds missing documentation - add support for static calibration support which is required for ECNS an speaker protection support. Tested this with Single Mic ECNS on SM8450 platform. commit 9963b1fde2b6a9a2cb488f2b96427f73f566550d Merge: 7ed3723d612c20 2a55135201d5e2 Author: Mark Brown Date: Tue Aug 19 16:54:00 2025 +0100 ASoC: Intel: avs: Code cleanups and separation Merge series from Cezary Rojewski : Set of patches that brings no new functionality but makes it easier to maintain and read the avs-driver code. There is one 'fix' among them - the third patch, described below. First, debug-related code - mainly the data-probing feature - is mixed with non-debug PCM code. Separate it into debug.h and update the pcm.c file. Next, as the probing-board is not tied to any topology file, it shall not using struct avs_soc_component descriptor but the basic struct snd_soc_component one. While on the first sight this is just bump in LOCs, runtime is simplified as no topology checks and related code will be engaged. With probing-board addressed and debug code relocated: - address the component-teardown issues when the componet->name points to a string which is shared by multiple components and/or machine boards. devm_kstrdup() makes this go away. - streamline the naming scheme for the functions engaged in the components registration. This is purely a readability improvement. commit 7ed3723d612c200839820cea8a9ee86cbaa858a8 Merge: d5020c1ce3764e daf855f76a1210 Author: Mark Brown Date: Tue Aug 19 16:53:55 2025 +0100 ASoC: es8323: power and mixer controls cleanup and Merge series from Shimrra Shai : This is a revision of a previous patch submission of mine wherein one part was accepted and one part was not. It was originally phrased for a particular device using the ES8323 CODEC, and I was advised to make the mixer controls user-selectable so it was not tied to the needs of any specific device. This submission brings the DAC and mixer controls for basic audio playback on this CODEC into line with the DAPM infrastructure and enables their operation through the standard mixer interface. commit ec0be3cdf40b5302248f3fb27a911cc630e8b855 Author: Javier Carrasco Date: Tue Aug 19 12:25:43 2025 +0800 regulator: consumer.rst: document bulk operations The current consumer documentation does not include bulk operations, providing an example of how to acquire multiple regulators by calling regulator_get() multiple times. That solution is valid and slightly simpler for a small amount of regulators, but it does not scale well. Document the bulk operations to get, enable and disable regulators. Signed-off-by: Javier Carrasco Link: https://patch.msgid.link/20250819-reg_consumer_doc-v1-1-b631fc0d35a3@gmail.com Signed-off-by: Mark Brown commit f7f804633c91f0fbf03eefbae39eec2205191a82 Author: Dan Carpenter Date: Mon Aug 18 15:30:14 2025 +0300 regulator: rt5133: Fix IS_ERR() vs NULL bug in rt5133_validate_vendor_info() The "priv->cdata" pointer isn't an error pointer; this should be a NULL check instead. Otherwise it leads to a NULL pointer dereference in the caller, rt5133_probe(). Fixes: 714165e1c4b0 ("regulator: rt5133: Add RT5133 PMIC regulator Support") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aKMc1oK-7yY4cD3K@stanley.mountain Signed-off-by: Mark Brown commit cec6e40a02ef66e28208dc808cd28cce418efc1d Author: Krzysztof Kozlowski Date: Tue Aug 19 15:15:50 2025 +0200 riscv: dts: microchip: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley commit d5020c1ce3764e73dd6634f462cf6723d185bac2 Merge: a46e95c81e3a28 cf65182247761f Author: Mark Brown Date: Tue Aug 19 16:38:30 2025 +0100 Handle shared reset GPIO for WSA883x speakers Merge series from Mohammad Rafi Shaik : On some Qualcomm platforms such as QCS6490-RB3Gen2, the multiple WSA8830/WSA8835 speakers share a common reset (shutdown) GPIO. To handle such cases, use the reset controller framework along with the "reset-gpio" driver. Tested on: - QCS6490-RB3Gen2 commit e2bcf62a2e78f8d7e95485c0347bccfba3c5e459 Author: Sean Christopherson Date: Wed Aug 6 15:51:59 2025 -0700 KVM: selftests: Move Intel and AMD module param helpers to x86/processor.h Move the x86 specific helpers for getting kvm_{amd,intel} module params to x86 where they belong. Expose the module-agnostic helpers globally, there is nothing secret about the logic. Link: https://lore.kernel.org/r/20250806225159.1687326-1-seanjc@google.com Signed-off-by: Sean Christopherson commit a585b87614511e4272305bb5acf406f19f7dcade Author: James Houghton Date: Fri Jul 11 00:17:42 2025 +0000 KVM: selftests: Fix signedness issue with vCPU mmap size check Check that the return value of KVM_GET_VCPU_MMAP_SIZE is non-negative before comparing with sizeof(kvm_run). If KVM_GET_VCPU_MMAP_SIZE fails, it will return -1, and `-1 > sizeof(kvm_run)` is true, so the ASSERT passes. There are no other locations in tools/testing/selftests/kvm that make the same mistake. Signed-off-by: James Houghton Link: https://lore.kernel.org/r/20250711001742.1965347-1-jthoughton@google.com Signed-off-by: Sean Christopherson commit a57750909580a4e3f7278ea6c13336677ea46af6 Author: Vipin Sharma Date: Mon Jul 7 22:47:16 2025 +0000 KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock Use MMU read lock to recover TDP MMU NX huge pages. To prevent concurrent modification of the list of potential huge pages, iterate over the list under tdp_mmu_pages_lock protection and unaccount the page before dropping the lock. Zapping under MMU read lock unblocks vCPUs which are waiting for MMU read lock, which solves a guest jitter issue on Windows VMs which were observing an increase in network latency. Do not zap an SPTE if: - The SPTE is a root page. - The SPTE does not point at the SP's page table. If the SPTE does not point at the SP's page table, then something else has change the SPTE, so KVM cannot safely zap it. Warn if zapping SPTE fails and current SPTE is still pointing to same page table, as it should be impossible for the CMPXCHG to fail due to all other write scenarios being mutually exclusive. There is always a race between dirty logging, vCPU faults, and NX huge page recovery for backing a gfn by an NX huge page or an executable small page. Unaccounting sooner during the list traversal increases the window of that race, but functionally, it is okay. Accounting doesn't protect against iTLB multi-hit bug, it is there purely to prevent KVM from bouncing a gfn between two page sizes. The only downside is that a vCPU will end up doing more work in tearing down all the child SPTEs. This should be a very rare race. Suggested-by: Sean Christopherson Signed-off-by: Vipin Sharma Co-developed-by: James Houghton Signed-off-by: James Houghton Link: https://lore.kernel.org/r/20250707224720.4016504-4-jthoughton@google.com [sean: clean up kvm_mmu_sp_dirty_logging_enabled() and the changelog] Signed-off-by: Sean Christopherson commit 62105564226e5711cc117769ff7874970b126efe Author: Vipin Sharma Date: Mon Jul 7 22:47:15 2025 +0000 KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose kvm_tdp_mmu_zap_sp() is only used for NX huge page recovery, so rename it to kvm_tdp_mmu_zap_possible_nx_huge_page(). In a future commit, this function will be changed to include logic specific to NX huge page recovery. Signed-off-by: Vipin Sharma Signed-off-by: James Houghton https://lore.kernel.org/r/20250707224720.4016504-3-jthoughton@google.com Signed-off-by: Sean Christopherson commit 6777885605e1538bd8126360c62669c4615690c1 Author: Vipin Sharma Date: Mon Jul 7 22:47:14 2025 +0000 KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU Track possible NX huge pages for the TDP MMU separately from Shadow MMUs in anticipation of doing recovery for the TDP MMU while holding mmu_lock for read instead of write. Use a small structure to hold the list of pages along with the number of pages/entries in the list, as relying on kvm->stat.nx_lpage_splits to calculating the number of pages to recover would result in over-zapping when both TDP and Shadow MMUs are active. Suggested-by: Sean Christopherson Suggested-by: David Matlack Signed-off-by: Vipin Sharma Co-developed-by: James Houghton Signed-off-by: James Houghton Link: https://lore.kernel.org/r/20250707224720.4016504-2-jthoughton@google.com [sean: rewrite changelog, use #ifdef instead of dummy KVM_TDP_MMU #define] Signed-off-by: Sean Christopherson commit 81fedb39a9f0da301a11c7a3b81d91c3b9024462 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 14:08:47 2025 +0200 PCI: mediatek-gen3: Add support for MediaTek MT8196 SoC Introduce support for the PCI-Express Gen3 controller found in the MT8196 (and MT6991) SoC by adding a compatible string and platform specific data. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250703120847.121826-4-angelogioacchino.delregno@collabora.com commit 0106b6c114cf8b77d801d9e280b221f8b4d5595b Author: AngeloGioacchino Del Regno Date: Thu Jul 3 14:08:46 2025 +0200 dt-bindings: PCI: mediatek-gen3: Add support for MT6991/MT8196 Add compatible strings for MT8196 and MT6991 (which are fully compatible between each other) and clock definitions. These new SoCs don't have tl_96m and tl_32k clocks, but need an AHB to APB bus clock and a low power clock. Signed-off-by: AngeloGioacchino Del Regno [mani: changed 'maxItems' to 'minItems' for reset] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250703120847.121826-3-angelogioacchino.delregno@collabora.com commit a895dc47ceba63feb711905440585cf2b16e9ce2 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 14:08:45 2025 +0200 PCI: mediatek-gen3: Implement sys clock ready time setting In preparation to add support for the PCI-Express Gen3 controller found in newer MediaTek SoCs, such as the Dimensity 9400 MT6991 and the MT8196 Chromebook SoC, add the definition for the PCIE Resource Control register and a new sys_clk_rdy_time_us variable in platform data. If sys_clk_rdy_time_us is found (> 0), set the new value in the aforementioned register only after configuring the controller to RC mode, as this may otherwise be reset. Overriding the register defaults for SYS_CLK_RDY_TIME allows to work around sys_clk_rdy signal glitching in MT6991 and MT8196. Signed-off-by: AngeloGioacchino Del Regno [mani: used FIELD_MODIFY() to simplify mask and update] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250703120847.121826-2-angelogioacchino.delregno@collabora.com commit da114122b83149d1f1db0586b1d67947b651aa20 Author: Chaoyi Chen Date: Fri Aug 15 10:35:15 2025 +0800 net: ethernet: stmmac: dwmac-rk: Make the clk_phy could be used for external phy For external phy, clk_phy should be optional, and some external phy need the clock input from clk_phy. This patch adds support for setting clk_phy for external phy. Signed-off-by: David Wu Signed-off-by: Chaoyi Chen Link: https://patch.msgid.link/20250815023515.114-1-kernel@airkyi.com Signed-off-by: Paolo Abeni commit 0283b8f134e499a51bb972403eb47cda6b960f7c Author: Jakub Kicinski Date: Thu Aug 14 18:33:14 2025 -0700 selftests: drv-net: test the napi init state Test that threaded state (in the persistent NAPI config) gets updated even when NAPI with given ID is not allocated at the time. This test is validating commit ccba9f6baa90 ("net: update NAPI threaded config even for disabled NAPIs"). Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250815013314.2237512-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit fe2e8f17a56fe14915cd6b709e9f56a16029f104 Author: Fange Zhang Date: Mon Aug 18 12:41:23 2025 +0800 pinctrl: sx150x: Make the driver tristate Set PINCTRL_SX150X config option as a tristate and add MODULE_DEVICE_TABLE()/MODULE_LICENSE() to export appropriate information. Signed-off-by: Fange Zhang Link: https://lore.kernel.org/20250818-modularize-sx150x-gpio-expander-v1-1-c2a027200fed@oss.qualcomm.com Signed-off-by: Linus Walleij commit 730ff06d3f5cc2ce0348414b78c10528b767d4a3 Author: Dipayaan Roy Date: Thu Aug 14 07:04:10 2025 -0700 net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency. This patch enhances RX buffer handling in the mana driver by allocating pages from a page pool and slicing them into MTU-sized fragments, rather than dedicating a full page per packet. This approach is especially beneficial on systems with large base page sizes like 64KB. Key improvements: - Proper integration of page pool for RX buffer allocations. - MTU-sized buffer slicing to improve memory utilization. - Reduce overall per Rx queue memory footprint. - Automatic fallback to full-page buffers when: * Jumbo frames are enabled (MTU > PAGE_SIZE / 2). * The XDP path is active, to avoid complexities with fragment reuse. Testing on VMs with 64KB pages shows around 200% throughput improvement. Memory efficiency is significantly improved due to reduced wastage in page allocations. Example: We are now able to fit 35 rx buffers in a single 64kb page for MTU size of 1500, instead of 1 rx buffer per page previously. Tested: - iperf3, iperf2, and nttcp benchmarks. - Jumbo frames with MTU 9000. - Native XDP programs (XDP_PASS, XDP_DROP, XDP_TX, XDP_REDIRECT) for testing the XDP path in driver. - Memory leak detection (kmemleak). - Driver load/unload, reboot, and stress scenarios. Reviewed-by: Jacob Keller Reviewed-by: Saurabh Sengar Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20250814140410.GA22089@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni commit 7138017038c42feb682445407974ed736e1ff308 Merge: 60613a8b9b8187 99d7ab8db9d823 Author: Ulf Hansson Date: Tue Aug 19 14:34:17 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 60613a8b9b8187d789750423132ad7664ca448c9 Author: Benoît Monin Date: Mon Aug 18 16:02:51 2025 +0200 mmc: sdhci-cadence: implement multi-block read gap tuning The controller suspends the clock between blocks when reading from the MMC as part of its flow-control, called read block gap. At higher clock speed and with IO delay between the controller and the MMC, this clock pause can happen too late, during the read of the next block and trigger a read error. To prevent this, the delay can be programmed for each mode via the pair of registers HRS37/38. This delay is obtained during tuning, by trying a multi-block read and increasing the delay until the read succeeds. For now, the tuning is only done in HS200, as the read error has only been observed at that speed. Acked-by: Adrian Hunter Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-6-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit 99e6cc80d5ce5af5781f84d20e4f3478d66ee8ee Author: Benoît Monin Date: Mon Aug 18 16:02:50 2025 +0200 mmc: core: add mmc_read_tuning Provide a function to the MMC hosts to read some blocks of data as part of their tuning. This function only returns the status of the read operation, not the data read. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-5-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit f33bba9b6442fdc092ecc3b1555bc4cdbb9962bb Author: Benoît Monin Date: Mon Aug 18 16:02:49 2025 +0200 mmc: block: use mmc_card cmd23 helpers Use the dedicated helpers for CMD23 card support. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-4-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit e5af5f5478d2e8ad6edc5bccd43b7d581177fe41 Author: Benoît Monin Date: Mon Aug 18 16:02:48 2025 +0200 mmc: mmc_test: use mmc_card cmd23 helpers Use mmc_card_can_cmd23 instead of using a local and partial implementation, and check for the CMD23 quirk with mmc_card_blk_no_cmd23. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-3-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit 05849fc5d842ece65a537c7492cf8dc038d15d57 Author: Benoît Monin Date: Mon Aug 18 16:02:47 2025 +0200 mmc: card: add mmc_card_blk_no_cmd23 Add a helper to check for the missing CMD23 quirk, similar to other quirk helpers. Also reorder the helpers to match the order of the quirk bits defined in include/linux/mmc/card.h. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-2-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit 18f7439fa171f798f2ff8aa69611db41f658242a Author: Benoît Monin Date: Mon Aug 18 16:02:46 2025 +0200 mmc: core: add mmc_card_can_cmd23 Add a dedicated helper to check for CMD23 support for MMC card, similar to mmc_host_can_cmd23 for the host, as it is easy to get the check wrong. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/20250818-mobileye-emmc-for-upstream-4-v4-1-34ecb3995e96@bootlin.com Signed-off-by: Ulf Hansson commit ff1bd1190e746a0ba2c6db7b84c3f677fdf1dad1 Author: Wolfram Sang Date: Wed Aug 13 18:14:56 2025 +0200 mmc: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-11-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 40c3c7dec7cca43af1dd5d0b72499dac87d1c07b Author: Xichao Zhao Date: Tue Aug 12 17:29:08 2025 +0800 mmc: meson-mx-sdhc: use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250812092908.101867-1-zhao.xichao@vivo.com Signed-off-by: Ulf Hansson commit d2e6fb2c31a07f34e5e7533df11431cb0d2ecf9f Author: Ricky Wu Date: Tue Aug 12 11:08:11 2025 +0800 misc: rtsx: usb card reader: add OCP support This patch adds support for Over Current Protection (OCP) to the Realtek USB card reader driver. The OCP mechanism protects the hardware by detecting and handling current overload conditions. This implementation includes: - Register configurations to enable OCP monitoring. - Handling of OCP interrupt events and associated error reporting. - Card power management changes in response to OCP triggers. This enhancement improves the robustness of the driver when operating in environments where electrical anomalies may occur, particularly with SD and MS card interfaces. Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/20250812030811.2426112-1-ricky_wu@realtek.com Signed-off-by: Ulf Hansson commit b65e630a55a490a0269ab1e4a282af975848064c Author: Jiayi Li Date: Mon Aug 4 10:48:25 2025 +0800 memstick: Add timeout to prevent indefinite waiting Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures. Signed-off-by: Jiayi Li Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson commit 709fe7aa5aaf8047b528561a0082db8a3a29010c Author: Biju Das Date: Wed Jul 30 17:46:15 2025 +0100 mmc: renesas_sdhi: Enable 64-bit polling mode Enable 64-bit polling mode for R-Car gen3 and RZ/G2L SoCs. Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250730164618.233117-3-biju.das.jz@bp.renesas.com Signed-off-by: Ulf Hansson commit 74f44ad07d1063933c237a7db16f6a4036643d60 Author: Biju Das Date: Wed Jul 30 17:46:14 2025 +0100 mmc: tmio: Add 64-bit read/write support for SD_BUF0 in polling mode As per the RZ/{G2L,G3E} HW manual SD_BUF0 can be accessed by 16/32/64 bits. Most of the data transfer in SD/SDIO/eMMC mode is more than 8 bytes. During testing it is found that, if the DMA buffer is not aligned to 128 bit it fallback to PIO mode. In such cases, 64-bit access is much more efficient than the current 16-bit. Tested-by: Wolfram Sang Reviewed-by: Wolfram Sang Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250730164618.233117-2-biju.das.jz@bp.renesas.com Signed-off-by: Ulf Hansson commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 Author: Biju Das Date: Sun Jun 29 21:38:56 2025 +0100 mmc: host: renesas_sdhi: Fix the actual clock Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111). On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch: clock: 50000000 Hz actual clock: 200000000 Hz After the fix: clock: 50000000 Hz actual clock: 50000000 Hz Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com Signed-off-by: Ulf Hansson commit fef12d9f5bcf7e2b19a7cf1295c6abd5642dd241 Author: Rex Chen Date: Mon Jul 28 17:22:30 2025 +0900 mmc: mmc_spi: multiple block read remove read crc ack For multiple block read, the current implementation, transfer packet includes cmd53 + cmd53 response + block nums*(1byte token + block length bytes payload + 2bytes CRC + 1byte transfer), the last 1byte transfer of every block is not needed, so remove it. Why doesn't multiple block read need CRC ack? For read operation, host side get the payload and CRC value, then will only check the CRC value to confirm if the data is correct or not, but not send CRC ack to card. If the data is correct, save it, or discard it and retransmit if data is error, so the last 1byte transfer of every block make no sense. What's the side effect of this 1byte transfer? As the SPI is full duplex, if add this redundant 1byte transfer, SDIO card side take it as the token of next block, then all the next sub blocks sequence distort. Signed-off-by: Rex Chen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250728082230.1037917-3-rex.chen_1@nxp.com Signed-off-by: Ulf Hansson commit fec40f44afdabcbc4a7748e4278f30737b54bb1a Author: Rex Chen Date: Mon Jul 28 17:22:29 2025 +0900 mmc: core: SPI mode remove cmd7 SPI mode doesn't support cmd7, so remove it in mmc_sdio_alive() and confirm if sdio is active by checking CCCR register value is available or not. Signed-off-by: Rex Chen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250728082230.1037917-2-rex.chen_1@nxp.com Signed-off-by: Ulf Hansson commit ec205a929257e766117bc541b8b27b7797b2a19a Author: Da Xue Date: Thu Aug 14 14:12:36 2025 -0400 pinctrl: meson-g12a: add GPIOC_7 pcie_clkreqn pinmux Amlogic G12 exposes PCIe clock request signal on GPIOC_7 pinmux func 1 Add the relevant pinmux and pin groups Signed-off-by: Da Xue Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/20250814181236.1956731-1-da@libre.computer Signed-off-by: Linus Walleij commit ffeebf7587f518a3717fad308cf735adbbcaba97 Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:45 2025 +0200 pmdomain: mediatek: Convert all SoCs to new style regmap retrieval Add the bus_prot_blocks handle and declare num_bus_prot_blocks to allow all of the currently supported AArch64 MediaTek SoCs to use the new style regmap retrieval in the driver when a new style devicetree declaring the mediatek,bus-protection phandle(s) in the main power controller node is found. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-10-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit 9d02c94342b35a94c4f1feecf94aa68e1565e6af Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:44 2025 +0200 pmdomain: mediatek: Add support for RTFF Hardware in MT8196/MT6991 New generation SoCs use a new RTFF Hardware to save power during operation of various IPs, other than managing isolation of the internal buck converters during powerup/down of power domains. Since some of the power domains need different RTFF handling, add a new scpys_rtff_type enumeration and hold the value for each power domain in struct scpsys_domain_data. If RTFF HW is available, the RTFF additional power sequences are handled in scpsys_ctl_pwrseq_{on,off}(). Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-9-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit 16d861d2bce8b1d28b6d94ffbfcdaa9cf833542b Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:43 2025 +0200 pmdomain: mediatek: Add support for modem power sequences Add support for the modem power domains by adding its specific power sequence in functions scpsys_modem_pwrseq_{on,off}() and call them if the flag MTK_SCPD_MODEM_PWRSEQ is present. While at it, since some SoC models need to skip setting/clearing the PWR_RST_B_BIT, also add a MTK_SCPD_SKIP_RESET_B flag for that. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-8-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit 0e8e6b5f6a31a3d001ab83f7af9394fccd4bb569 Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:42 2025 +0200 pmdomain: mediatek: Move ctl sequences out of power_on/off functions In preparation to support power domains of new SoCs and the modem power domains for both new and already supported chips, move the generic control power sequences out of the scpsys_power_on() and scpsys_power_off() and put them in new scpsys_ctl_pwrseq_on(), scpsys_ctl_pewseq_off() functions. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-7-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit ad4bbdc59b75edf7f3bda836136a1f2bace427b8 Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:41 2025 +0200 pmdomain: mediatek: Handle SoCs with inverted SRAM power-down bits Some SoCs, and even some subsystems in the same SoC, may have the logic for SRAM power-down inverted, as in, setting the bit means "power down" and unsetting means "power up": this is because some hardware subsystems use this as a power-lock indication and some use this as a power down one (for example, usually, the modem ss has it inverted!). In preparation for adding support for power domains with inverted SRAM_PDN bits, add a new MTK_SCPD_SRAM_PDN_INVERTED flag and check for it in scpsys_sram_enable() and scpsys_sram_disable(). Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-6-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit c29345fa5f66bea0790cf2219f57b974d4fc177b Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:40 2025 +0200 pmdomain: mediatek: Refactor bus protection regmaps retrieval In preparation to add support for new generation SoCs like MT8196, MT6991 and other variants, which require to set bus protection on different busses than the ones found on legacy chips, and to also simplify and reduce memory footprint of this driver, refactor the mechanism to retrieve and use the bus protection regmaps. This is done by removing the three pointers to struct regmap from struct scpsys_domain (allocated for each power domain) and moving them to the main struct scpsys (allocated per driver instance) as an array of pointers to regmap named **bus_prot. That deprecates the old devicetree properties to grab phandles to the three predefined busses (infracfg, infracfg-nao and smi) and replaces it with the base property "access-controllers" that is meant to be an array of phandles holding the same busses where required (for now - for legacy SoCs). The new bus protection phandles are indexed by the bus_prot_index member of struct scpsys, used to map "bus type" (ex.: infra, smi, etc) to the specific *bus_prot[x] element. While the old per-power-domain regmap pointers were removed, the support for old devicetree was retained by still checking if the new property (in DT) and new-style declaration (in SoC specific platform data) are both present at probe time. If those are not present, a lookup for the old properties will be done in all of the children of the power controller, and pointers to regmaps will be retrieved with the old properties, but then will be internally remapped to follow the new style regmap anyway as to let this driver benefit of the memory footprint reduction. Finally, it was necessary to change macros in mtk-pm-domains.h and in mt8365-pm-domains.h to make use of the new style bus protection declaration, as the actual HW block is now recognized not by flags but by its own scpsys_bus_prot_block enumeration. The BUS_PROT_(STA)_COMPONENT_{INFRA,INFRA_NAO,SMI} flags were also removed since they are now unused, and because that enumeration was initially meant to vary the logic of bus protection and not the bus where work is performed, anyway! Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250805074746.29457-5-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit d10c98587bffad1d1dab5e5bbbc3e0e42c5ac646 Merge: 33d000ba6d723f 29a799917947d2 Author: Ulf Hansson Date: Tue Aug 19 14:11:37 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 29a799917947d24c55e8902ef29f5cb52195682c Author: AngeloGioacchino Del Regno Date: Tue Aug 5 09:47:39 2025 +0200 dt-bindings: power: mediatek: Document access-controllers property Allow specifying access-controllers in the main power controller node and deprecate the old mediatek,infracfg, mediatek,infracfg-nao and mediatek,smi properties located in the children. This is done in order to both simplify the power controller nodes and in preparation for adding support for new generation SoCs like MT8196/MT6991 and other variants, which will need to set protection on new busses. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250805074746.29457-4-angelogioacchino.delregno@collabora.com Signed-off-by: Ulf Hansson commit 33d000ba6d723f9f584cc99b6c8c43d9b18f95ba Merge: 87660a84bb2897 d8f3ae7b38fea5 Author: Ulf Hansson Date: Tue Aug 19 14:09:38 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 9a96082f99453a3c0f5ea7a70d19a66dbfbd55bc Author: Wolfram Sang Date: Wed Aug 13 18:14:59 2025 +0200 pinctrl: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/20250813161517.4746-14-wsa+renesas@sang-engineering.com Signed-off-by: Linus Walleij commit 27848c082ba0b22850fd9fb7b185c015423dcdc7 Author: Xichao Zhao Date: Tue Aug 19 17:20:43 2025 +0800 spi: s3c64xx: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Reviewed-by: Tudor Ambarus Link: https://patch.msgid.link/20250819092044.549464-7-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 67259af78219bdbdea00491f32b1c0971a33401e Author: Xichao Zhao Date: Tue Aug 19 17:20:42 2025 +0800 spi: pxa2xx: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250819092044.549464-6-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 2bee48c9d1cd1749922d0e2df54330c924e14a0e Author: Xichao Zhao Date: Tue Aug 19 17:20:41 2025 +0800 spi: mt65xx: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250819092044.549464-5-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 2aade32d1ffc5f91cc447ed6387c0f619fb980c3 Author: Xichao Zhao Date: Tue Aug 19 17:20:40 2025 +0800 spi: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250819092044.549464-4-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 0d00ebc6b869f4df67c05522bc1e8d01d1c7daa7 Author: Xichao Zhao Date: Tue Aug 19 17:20:39 2025 +0800 spi: SPISG: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250819092044.549464-3-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 2a5d410916d3a8dcac06f72494f252314e933cfb Author: Xichao Zhao Date: Tue Aug 19 17:20:38 2025 +0800 spi: spi_amd: Remove the use of dev_err_probe() The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250819092044.549464-2-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit c1dd310f1d76b4b13f1854618087af2513140897 Author: Qianfeng Rong Date: Tue Aug 19 12:02:38 2025 +0800 spi: SPISG: Use devm_kcalloc() in aml_spisg_clk_init() Replace calls of devm_kzalloc() with devm_kcalloc() in aml_spisg_clk_init() for safer memory allocation with built-in overflow protection, and replace sizeof(struct clk_div_table) with sizeof(*tbl) to shorten the line. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250819040239.434863-1-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit da9881d00153cc6d3917f6b74144b1d41b58338c Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:51 2025 +0100 ASoC: qcom: audioreach: add support for SMECNS module This patch adds support for Single Mic ECNS module, used for echo cancellation. It also makes use of audioreach_set_module_config to load the calibration data for this module from ASoC tplg file. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 97a719fe7d7001d361490b44985f8b4c7ea6ef98 Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:50 2025 +0100 ASoC: qcom: audioreach: sort modules based on hex ids Sort the module defines based on its hex ids. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 0f5787df78799c7c8a7dbd2de5ff15250d8d3a4e Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:49 2025 +0100 ASoC: qcom: audioreach: fix typos in I2S_INTF_TYPE Fix spelling mistakes in I2S_INTF_TYPE defines. Reported-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit c7ed4c2debfd192f6071f4ab33c092d419abb941 Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:48 2025 +0100 ASoC: qcom: audioreach: add support for static calibration This change adds support for static calibration data via ASoC topology file. This static calibration data could include binary blob of data that is required by specific module and is not part of topology tokens. Reason for adding this support is to allow loading module specific data that can not be part of the tplg tokens, example, Echo and Noise cancelling module needs a blob of calibration data to function correctly. This support is also one of the building block for adding speaker protection support. Tested this with Single Mic ECNS(Echo and Noise Cancellation). tplg can now contain this calibration data like: SectionWidget."stream2.SMECNS_V224" { ... data [ ... "stream2.SMECNS_V224_cfg_data" ] } SectionData."stream2.SMECNS_V224_cfg_data" { words "0x00000330, 0x01001006,0x00000000,0x00000000, 0x00004145,0x08001026,0x00000004,0x00000000, ..." } } Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit f07b81b573b28e5cae5c1482001ad0d6c0b7c051 Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:47 2025 +0100 ASoC: qcom: audioreach: add documentation for i2s interface type Add documentation of possible values for I2S interface types, currently this is only documented for DMA module. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 12cc0ff3cdd95f2bc0ffdc63bcd9da231eb33199 Author: Srinivas Kandagatla Date: Tue Aug 19 11:01:46 2025 +0100 ASoC: qcom: audioreach: deprecate AR_TKN_U32_MODULE_[IN/OUT]_PORTS Deprecate usage of AR_TKN_U32_MODULE_IN_PORTS and AR_TKN_U32_MODULE_OUT_PORTS as the connectivity of modules is taken care by AR_TKN_U32_MODULE_SRC_OP_PORT_ID* and AR_TKN_U32_MODULE_DST_IN_PORT_ID* Also this property is never used in the drivers. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819100151.1294047-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit da664c6db895f70c2be8c3dd371c273b6f8b920f Merge: 8f5ae30d69d754 d00f5232851c48 Author: Christian Brauner Date: Tue Aug 19 13:38:26 2025 +0200 Merge patch series "Improve pid_nr_ns()" In various places pid_nr_ns() can be called with a NULL pointer. Fix those up and improve pid_nr_ns() callers. Link: https://lore.kernel.org/20250802022123.3536934-1-gxxa03070307@gmail.com Signed-off-by: Christian Brauner commit d00f5232851c4895db8f0228881c31608feaab30 Author: Oleg Nesterov Date: Sun Aug 10 19:36:20 2025 +0200 pid: change task_state() to use task_ppid_nr_ns() to simplify the code. Note that only tpid and max_fds really need rcu_read_lock(), we could move task_ppid_nr_ns/task_tgid_nr_ns/task_numa_group_id/get_task_cred outside of rcu read section. Signed-off-by: Oleg Nesterov Link: https://lore.kernel.org/20250810173620.GA20007@redhat.com Signed-off-by: Christian Brauner commit b1afcaddd6c8475ee346a60525f9504965673e0c Author: Oleg Nesterov Date: Sun Aug 10 19:36:15 2025 +0200 pid: change bacct_add_tsk() to use task_ppid_nr_ns() to simplify the code. Signed-off-by: Oleg Nesterov Link: https://lore.kernel.org/20250810173615.GA20000@redhat.com Signed-off-by: Christian Brauner commit abdfd4948e45c51b19162cf8b3f5003f8f53c9b9 Author: Oleg Nesterov Date: Sun Aug 10 19:36:04 2025 +0200 pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers task_pid_vnr(another_task) will crash if the caller was already reaped. The pid_alive(current) check can't really help, the parent/debugger can call release_task() right after this check. This also means that even task_ppid_nr_ns(current, NULL) is not safe, pid_alive() only ensures that it is safe to dereference ->real_parent. Change __task_pid_nr_ns() to ensure ns != NULL. Originally-by: 高翔 Link: https://lore.kernel.org/all/20250802022123.3536934-1-gxxa03070307@gmail.com/ Signed-off-by: Oleg Nesterov Link: https://lore.kernel.org/20250810173604.GA19991@redhat.com Signed-off-by: Christian Brauner commit 006568ab4c5ca2309ceb36fa553e390b4aa9c0c7 Author: gaoxiang17 Date: Sat Aug 2 10:21:23 2025 +0800 pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) { Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns. For example: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000 [0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000 pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __task_pid_nr_ns+0x74/0xd0 lr : __task_pid_nr_ns+0x24/0xd0 sp : ffffffc08001bd10 x29: ffffffc08001bd10 x28: ffffffd4422b2000 x27: 0000000000000001 x26: ffffffd442821168 x25: ffffffd442821000 x24: 00000f89492eab31 x23: 00000000000000c0 x22: ffffff806f5693c0 x21: ffffff806f5693c0 x20: 0000000000000001 x19: 0000000000000000 x18: 0000000000000000 x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 00000000023a1adc x14: 0000000000000003 x13: 00000000007ef6d8 x12: 001167c391c78800 x11: 00ffffffffffffff x10: 0000000000000000 x9 : 0000000000000001 x8 : ffffff80816fa3c0 x7 : 0000000000000000 x6 : 49534d702d535449 x5 : ffffffc080c4c2c0 x4 : ffffffd43ee128c8 x3 : ffffffd43ee124dc x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffffff806f5693c0 Call trace: __task_pid_nr_ns+0x74/0xd0 ... __handle_irq_event_percpu+0xd4/0x284 handle_irq_event+0x48/0xb0 handle_fasteoi_irq+0x160/0x2d8 generic_handle_domain_irq+0x44/0x60 gic_handle_irq+0x4c/0x114 call_on_irq_stack+0x3c/0x74 do_interrupt_handler+0x4c/0x84 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c account_kernel_stack+0x60/0x144 exit_task_stack_account+0x1c/0x80 do_exit+0x7e4/0xaf8 ... get_signal+0x7bc/0x8d8 do_notify_resume+0x128/0x828 el0_svc+0x6c/0x70 el0t_64_sync_handler+0x68/0xbc el0t_64_sync+0x1a8/0x1ac Code: 35fffe54 911a02a8 f9400108 b4000128 (b9405a69) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt Signed-off-by: gaoxiang17 Link: https://lore.kernel.org/20250802022123.3536934-1-gxxa03070307@gmail.com Reviewed-by: Baoquan He Signed-off-by: Christian Brauner commit 96d6bc84742f9e08b70bd1193da32cf0f09a0058 Author: Liao Yuanhong Date: Tue Aug 12 15:54:44 2025 +0800 pinctrl: equilibrium: Remove redundant semicolons Remove unnecessary semicolons. Fixes: 1948d5c51dba4 ("pinctrl: Add pinmux & GPIO controller driver for a new SoC") Signed-off-by: Liao Yuanhong Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/20250812075444.8310-1-liaoyuanhong@vivo.com Signed-off-by: Linus Walleij commit 73861970938ad1323eb02bbbc87f6fbd1e5bacca Author: Tetsuo Handa Date: Wed Aug 13 00:17:44 2025 +0900 minixfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/ec982681-84b8-4624-94fa-8af15b77cbd2@I-love.SAKURA.ne.jp Signed-off-by: Christian Brauner commit 76196742f49ed5e6b12804c8777c4c11a173289e Author: Alice Ryhl Date: Mon Jul 14 12:46:37 2025 +0000 pid: add Rust files to MAINTAINERS This files is maintained by Christian Brauner, thus add it to the relevant MAINTAINERS entry. Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/20250714124637.1905722-2-aliceryhl@google.com Acked-by: Miguel Ojeda Signed-off-by: Christian Brauner commit 542baf77f092b435ddd2b340e82dbb7b14559d56 Author: Aaron Kling Date: Tue Aug 12 16:24:41 2025 -0500 pinctrl: tegra: Add Tegra186 pinmux driver This is based on Nvidia's downstream 5.10 driver, rewritten to match the mainline Tegra194 pinmux driver. Signed-off-by: Aaron Kling Link: https://lore.kernel.org/20250812-tegra186-pinctrl-v3-2-115714eeecb1@gmail.com Signed-off-by: Linus Walleij commit eed8e4c07d85c8955a44502bc1f61e4155c94051 Author: Shankari Anand Date: Thu Aug 14 15:31:01 2025 +0530 rust: fs: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in the fs subsystem to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Acked-by: Alice Ryhl Signed-off-by: Shankari Anand Link: https://lore.kernel.org/20250814100101.304408-1-shankari.ak0208@gmail.com Signed-off-by: Christian Brauner commit 15e3363af00a9e5b4f5c10b17940733a8613ef57 Author: Aaron Kling Date: Tue Aug 12 16:24:40 2025 -0500 dt-bindings: pinctrl: Document Tegra186 pin controllers Tegra186 contains two pin controllers. Document their compatible strings and describe the list of pins and functions that they provide. Reviewed-by: Rob Herring (Arm) Signed-off-by: Aaron Kling Link: https://lore.kernel.org/20250812-tegra186-pinctrl-v3-1-115714eeecb1@gmail.com Signed-off-by: Linus Walleij commit eef32050636a3390724dfe532ab9af9d58c854c3 Author: Andrea della Porta Date: Tue Aug 12 11:26:18 2025 +0200 pinctrl: rp1: Add regmap ranges to RP1 gpio controller The current gpio driver for RP1 shows only the very first register from sysfs, e.g.: $ cat /sys/kernel/debug/regmap/1f000d0000.gpio-rp1-pinctrl/registers 0: 0abe0000 Add the correct ranges to the regmap configuration. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/20250812092618.14270-1-andrea.porta@suse.com Signed-off-by: Linus Walleij commit 44d454fcffa8b08d6d66df132121c1d387fa85db Author: Thomas Weißschuh Date: Mon Aug 11 11:13:36 2025 +0200 sysfs: remove attribute_group::bin_attrs_new This transitional field is now unused and unnecessary. Remove it. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250811-sysfs-const-bin_attr-final-v4-2-7b6053fd58bb@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 1d6249c1ce826fcf03c695973095eb4a50fb7fd2 Author: Thomas Weißschuh Date: Mon Aug 11 11:13:35 2025 +0200 sysfs: remove bin_attribute::read_new/write_new() These transitional fields are now unused and unnecessary. Remove them and their logic in the sysfs core. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250811-sysfs-const-bin_attr-final-v4-1-7b6053fd58bb@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 8e7e265d558e0257d6dacc78ec64aff4ba75f61e Author: Charalampos Mitrodimas Date: Sat Aug 16 14:14:37 2025 +0000 debugfs: fix mount options not being applied Mount options (uid, gid, mode) are silently ignored when debugfs is mounted. This is a regression introduced during the conversion to the new mount API. When the mount API conversion was done, the parsed options were never applied to the superblock when it was reused. As a result, the mount options were ignored when debugfs was mounted. Fix this by following the same pattern as the tracefs fix in commit e4d32142d1de ("tracing: Fix tracefs mount options"). Call debugfs_reconfigure() in debugfs_get_tree() to apply the mount options to the superblock after it has been created or reused. As an example, with the bug the "mode" mount option is ignored: $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test $ mount | grep debugfs_test debugfs on /tmp/debugfs_test type debugfs (rw,relatime) $ ls -ld /tmp/debugfs_test drwx------ 25 root root 0 Aug 4 14:16 /tmp/debugfs_test With the fix applied, it works as expected: $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test $ mount | grep debugfs_test debugfs on /tmp/debugfs_test type debugfs (rw,relatime,mode=666) $ ls -ld /tmp/debugfs_test drw-rw-rw- 37 root root 0 Aug 2 17:28 /tmp/debugfs_test Fixes: a20971c18752 ("vfs: Convert debugfs to use the new mount API") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220406 Cc: stable@vger.kernel.org Reviewed-by: Eric Sandeen Signed-off-by: Charalampos Mitrodimas Link: https://lore.kernel.org/20250816-debugfs-mount-opts-v3-1-d271dad57b5b@posteo.net Signed-off-by: Christian Brauner commit bba95412064207ea3a0ea1776daec6480e5f8b0f Author: Shankari Anand Date: Sat Aug 16 17:53:23 2025 +0530 rust: pid_namespace: update AlwaysRefCounted imports from sync::aref Update call sites in `pid_namespace.rs` to import `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to `sync`. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://lore.kernel.org/20250816122323.11657-1-shankari.ak0208@gmail.com Reviewed-by: Benno Lossin Signed-off-by: Christian Brauner commit 5141ae32d4b8971d7b689854fd47a200e695bda3 Author: Nino Zhang Date: Mon Aug 18 23:26:41 2025 +0800 staging: rtl8723bs: fix coding style issues in core/rtw_mlme.c Fix blank line issues in coding style: - Remove unnecessary blank lines after an open brace '{'. - Remove unnecessary blank lines before a closing brace '}'. - Add missing blank lines after variable declarations. - Add blank lines after function, struct, union, and enum declarations. Signed-off-by: Nino Zhang Link: https://lore.kernel.org/r/20250818152641.106740-1-ninozhang001@gmail.com Signed-off-by: Greg Kroah-Hartman commit 834a2d0155d15832cd13a688b4f2f1d0b7c1b855 Author: Luke Yang Date: Thu Aug 14 15:01:36 2025 -0400 staging: gpib: tidy-up comments Improve comment readability: - "//comment" -> "// comment" - Align comments vertically in columns - Enforce consistency between "// comments" and "/* comments */" Signed-off-by: Luke Yang Link: https://lore.kernel.org/r/aJ4ykOs_MmjnQdPa@luyang-thinkpadp1gen7.toromso.csb Signed-off-by: Greg Kroah-Hartman commit 8a61a53b07f23ff12330086b293b6b492d35b8a0 Author: Carlos Llamas Date: Sun Jul 27 18:29:08 2025 +0000 binder: add tracepoint for netlink reports Add a tracepoint to capture the same details that are being sent through the generic netlink interface during transaction failures. This provides a useful debugging tool to observe the events independently from the netlink listeners. Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250727182932.2499194-6-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit f37b55ded8ed35424ebb91a4d012527071e1f601 Author: Li Li Date: Sun Jul 27 18:29:07 2025 +0000 binder: add transaction_report feature entry Add "transaction_report" to the binderfs feature list, to help userspace determine if the "BINDER_CMD_REPORT" generic netlink api is supported by the binder driver. Signed-off-by: Li Li Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250727182932.2499194-5-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 63740349eba78f242bcbf60d5244d7f2b2600853 Author: Li Li Date: Sun Jul 27 18:29:06 2025 +0000 binder: introduce transaction reports via netlink Introduce a generic netlink multicast event to report binder transaction failures to userspace. This allows subscribers to monitor these events and take appropriate actions, such as stopping a misbehaving application that is spamming a service with huge amount of transactions. The multicast event contains full details of the failed transactions, including the sender/target PIDs, payload size and specific error code. This interface is defined using a YAML spec, from which the UAPI and kernel headers and source are auto-generated. Signed-off-by: Li Li Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250727182932.2499194-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 5cd0645b43c7edf55518272a6c69230a5c631729 Author: Carlos Llamas Date: Sun Jul 27 18:29:05 2025 +0000 binder: add t->is_async and t->is_reply Replace the t->need_reply flag with the more descriptive t->is_async and and t->is_reply flags. The 'need_reply' flag was only used for debugging purposes and the new flags can be used to distinguish between the type of transactions too: sync, async and reply. For now, only update the logging in print_binder_transaction_ilocked(). However, the new flags can be used in the future to replace the current patterns and improve readability. e.g.: - if (!reply && !(tr->flags & TF_ONE_WAY)) + if (t->is_async) This patch is in preparation for binder's generic netlink implementation and no functional changes are intended. Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250727182932.2499194-3-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 4afc5bf0a1849f0ed3ea1d9fd9d0e79b23a67f96 Author: Carlos Llamas Date: Sun Jul 27 18:29:04 2025 +0000 binder: pre-allocate binder_transaction Move the allocation of 'struct binder_transaction' to the beginning of the binder_transaction() function, along with the initialization of all the members that are known at that time. This minor refactoring helps to consolidate the usage of transaction information at later points. This patch is in preparation for binder's generic netlink implementation and no functional changes are intended. Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250727182932.2499194-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 800348aa34b2bc40d558bb17b6719c51fac0b6de Author: Thorsten Blum Date: Fri Aug 15 23:37:44 2025 +0200 kcsan: test: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Justin Stitt Signed-off-by: Marco Elver commit bb7aa579efd68c905159b03b255d1437f9f4201b Author: Abd-Alrhman Masalkhi Date: Thu Jul 17 06:39:34 2025 +0000 ABI: sysfs: add documentation for ST M24LR EEPROM and control interface Add sysfs ABI documentation for the STMicroelectronics M24LR device, covering both the control interface (e.g., unlock, password update, UID, total sectors, and SSS entries) and EEPROM access via the nvmem subsystem. Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/r/20250717063934.5083-4-abd.masalkhi@gmail.com Signed-off-by: Greg Kroah-Hartman commit cd5c5e0231c538a5d2d4a73f3b3ffc77ff08449c Author: Abd-Alrhman Masalkhi Date: Thu Jul 17 06:39:33 2025 +0000 eeprom: add driver for ST M24LR series RFID/NFC EEPROM chips adds support for STMicroelectronics M24LRxx devices, which expose two separate I2C addresses: one for system control and one for EEPROM access. The driver implements both a sysfs-based interface for control registers (e.g. UID, password authentication) and an nvmem provider for EEPROM access. Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/r/20250717063934.5083-3-abd.masalkhi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 46b4ddd2c4951c073a16bbf271221240fe2584e5 Author: Abd-Alrhman Masalkhi Date: Thu Jul 17 06:39:32 2025 +0000 dt-bindings: eeprom: Add ST M24LR support Add support for STMicroelectronics M24LR RFID/NFC EEPROM chips. These devices use two I2C addresses: the primary address provides access to control and system parameter registers, while the secondary address is used for EEPROM access. Signed-off-by: Abd-Alrhman Masalkhi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717063934.5083-2-abd.masalkhi@gmail.com Signed-off-by: Greg Kroah-Hartman commit c585a4ad322c9aa64263aeb8004a523d0151b1c3 Author: Xichao Zhao Date: Mon Aug 11 20:23:58 2025 +0800 hpet: Use str_plural() to simplify the code Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250811122358.542190-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman commit 0e805e8b007d42502dbb7b883cae4794890a40ff Author: Nai-Chen Cheng Date: Wed Aug 6 14:27:11 2025 +0800 greybus: svc: use string choice helpers instead of ternary operator Replace ternary operator with str_enabled_disabled() helper to improve code readability and consistency. Generated using Coccinelle semantic patch. Signed-off-by: Nai-Chen Cheng Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/20250806-greybus-string-choices-v1-1-3e1c91048b62@gmail.com Signed-off-by: Greg Kroah-Hartman commit 51ad6d97151c88976a93cdc023d6cd27dce48c38 Author: Zijun Hu Date: Mon Jul 14 23:34:19 2025 +0800 sparc: kernel: apc: Remove macro APC_MINOR definition Macro APC_MINOR is defined as MISC_DYNAMIC_MINOR to request dynamic minor, but its name 'APC_MINOR' looks like fixed minor. Remove the macro definition and directly use MISC_DYNAMIC_MINOR instead. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-8-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit d7f8d0758b975db8406c91cf242d46cd9611ba3e Author: Zijun Hu Date: Mon Jul 14 23:34:18 2025 +0800 char: misc: Register fixed minor EISA_EEPROM_MINOR in linux/miscdevice.h Move fixed minor EISA_EEPROM_MINOR definition to linux/miscdevice.h. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-7-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 Author: Zijun Hu Date: Mon Jul 14 23:34:17 2025 +0800 char: misc: Does not request module for miscdevice with dynamic minor misc_open() may request module for miscdevice with dynamic minor, which is meaningless since: - The dynamic minor allocated is unknown in advance without registering miscdevice firstly. - Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor. Fix by only requesting module for miscdevice with fixed minor. Acked-by: Thadeu Lima de Souza Cascardo Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 52e2bb5ff089d65e2c7d982fe2826dc88e473d50 Author: Zijun Hu Date: Mon Jul 14 23:34:16 2025 +0800 char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor For miscdevice who wants dynamic minor, it may fail to be registered again without reinitialization after being de-registered, which is illustrated by kunit test case miscdev_test_dynamic_reentry() newly added. There is a real case found by cascardo when a part of minor range were contained by range [0, 255): 1) wmi/dell-smbios registered minor 122, and acpi_thermal_rel registered minor 123 2) unbind "int3400 thermal" driver from its device, this will de-register acpi_thermal_rel 3) rmmod then insmod dell_smbios again, now wmi/dell-smbios is using minor 123 4) bind the device to "int3400 thermal" driver again, acpi_thermal_rel fails to register. Some drivers may reuse the miscdevice structure after they are deregistered If the intention is to allocate a dynamic minor, if the minor number is not reset to MISC_DYNAMIC_MINOR before calling misc_register(), it will try to register a previously dynamically allocated minor number, which may have been registered by a different driver. One such case is the acpi_thermal_rel misc device, registered by the int3400 thermal driver. If the device is unbound from the driver and later bound, if there was another dynamic misc device registered in between, it would fail to register the acpi_thermal_rel misc device. Other drivers behave similarly. Actually, this kind of issue is prone to happen if APIs misc_register()/misc_deregister() are invoked by driver's probe()/remove() separately. Instead of fixing all the drivers, just reset the minor member to MISC_DYNAMIC_MINOR in misc_deregister() in case it was a dynamically allocated minor number, as error handling of misc_register() does. Cc: Thadeu Lima de Souza Cascardo Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-5-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 2334668aaf410382412b8c81f7014283f3e80354 Author: Zijun Hu Date: Mon Jul 14 23:34:15 2025 +0800 char: misc: Add a case to test registering miscdevice again without reinitialization For miscdevice who wants dynamic minor, add a cast to test if it can be successfully registered again without reinitialization: 1) Provide Both miscdevice @dev_A and @dev_B want to request dynamic minor by initializing their minor to MISC_DYNAMIC_MINOR. 2) Register then de-register @dev_A. 3) Register @dev_B. 4) Register @dev_A again without reinitialization. 5) Check if @dev_A can be successfully registered. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-4-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit f5597840ac907858ad2a462b00e4a68fd199121e Author: Zijun Hu Date: Mon Jul 14 23:34:14 2025 +0800 char: misc: Disallow registering miscdevice whose minor > MISC_DYNAMIC_MINOR Currently, It is allowed to register miscdevice with minor > 255 which is defined by macro MISC_DYNAMIC_MINOR, and cause: - Chaos regarding division and management of minor codes. - Registering failure if the minor was allocated to other dynamic request. Fortunately, in-kernel users have not had such usage yet. Fix by refusing to register miscdevice whose minor > 255. Also bring in a very simple minor code space division and management: < 255 : Fixed minor code == 255 : Indicator to request dynamic minor code > 255 : Dynamic minor code requested, 1048320 minor codes totally And all fixed minors allocated should be registered in 'linux/miscdevice.h' Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-3-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit f4e47affdb2edb99834dfd03f5ea8a899bbb98f0 Author: Zijun Hu Date: Mon Jul 14 23:34:13 2025 +0800 char: misc: Adapt and add test cases for simple minor space division Adapt and add test cases for next change which regards minor whose value > macro MISC_DYNAMIC_MINOR as invalid parameter when register miscdevice, hence get a simple minor space division below: < MISC_DYNAMIC_MINOR: fixed minor code == MISC_DYNAMIC_MINOR: indicator to request dynamic minor code > MISC_DYNAMIC_MINOR: dynamic minor code requested Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-2-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 8ac646d6dfbf8e42bdb31b71e03a7984557ab1b1 Author: Zijun Hu Date: Mon Jul 14 23:34:12 2025 +0800 char: misc: Move drivers/misc/misc_minor_kunit.c to drivers/char/ drivers/misc/misc_minor_kunit.c is to test APIs defined in drivers/char/misc.c, but is not in the same directory as the later. Move misc_minor_kunit.c to drivers/char/. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-1-2ed949665bde@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 9e57dbcbde250acab44205ee4cc897c4a87c56d9 Author: Shankari Anand Date: Mon Aug 18 18:58:06 2025 +0530 rust: miscdevice: update ARef import to sync::aref Update the import of `ARef` in misc_device sample to use `sync::aref` instead of `types`. This is part of the ongoing effort to move `ARef` and `AlwaysRefCounted` to the `sync` module for better modularity and type organization. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250818132806.134248-1-shankari.ak0208@gmail.com Signed-off-by: Greg Kroah-Hartman commit 89fb7d737f9a3467406c9729609319a8d633e97a Author: Thorsten Blum Date: Wed Aug 13 20:01:08 2025 +0200 misc: hisi_hikey_usb: Use str_enabled_disabled() in hub_power_ctrl() Remove hard-coded strings by using the str_enabled_disabled() helper function and silence the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_enabled_disabled(value) Signed-off-by: Thorsten Blum Acked-by: John Stultz Link: https://lore.kernel.org/r/20250813180108.209096-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 82bfe76853762a7d2b7d699da0e5dbd094f8f998 Author: Geert Uytterhoeven Date: Wed Aug 13 15:05:15 2025 +0200 misc: apds990x: Drop superfluous return statement Drop a return statement that immediately follows another return statement, and thus is never executed. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/673e667895603b1a1b1ae8ec89e333ac15f4412b.1755090287.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 807221d3c5ff6e3c91ff57bc82a0b7a541462e20 Author: Ricky Wu Date: Tue Aug 12 14:35:21 2025 +0800 misc: rtsx_pci: Add separate CD/WP pin polarity reversal support Previously, the Card Detect (CD) and Write Protect (WP) pins shared the same reverse polarity setting in the configuration space. This meant both signals were reversed together, without the ability to configure them individually. This patch introduces two new parameters: sd_cd_reverse_en – enable reverse polarity for the CD pin. sd_wp_reverse_en – enable reverse polarity for the WP pin. With this change, the controller can now support: 1.Reversing both CD and WP pins together (original behavior). 2.Reversing CD and WP pins separately (newly added behavior), if supported by the configuration space. This provides greater flexibility when dealing with devices that have independent polarity requirements for CD and WP pins. Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/20250812063521.2427696-1-ricky_wu@realtek.com Signed-off-by: Greg Kroah-Hartman commit 6e6fe5a99048c020594d815a1c0f8ad183073e66 Author: Colin Ian King Date: Thu Jul 24 11:54:22 2025 +0100 misc: Fix spelling mistake "STMicroeletronics" -> "STMicroelectronics" There is are spelling mistakes in the SENSORS_LIS3_SPI and SENSORS_LIS3_I2C Kconfig. Fix them. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724105422.140186-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit a8bdd935d1ddb7186358fb60ffe84253e85340c8 Author: Lorenzo Bianconi Date: Thu Aug 14 09:51:16 2025 +0200 net: airoha: Add wlan flowtable TX offload Introduce support to offload the traffic received on the ethernet NIC and forwarded to the wireless one using HW Packet Processor Engine (PPE) capabilities. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250814-airoha-en7581-wlan-tx-offload-v1-1-72e0a312003e@kernel.org Signed-off-by: Paolo Abeni commit faba66cfcef6374020d2ac7bed091b2793eefeec Author: Xichao Zhao Date: Tue Aug 12 16:12:43 2025 +0800 pinctrl: bcm: use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/20250812081243.22659-1-zhao.xichao@vivo.com Signed-off-by: Linus Walleij commit 244ada9cb7a86ecbfbe17dc02eb269a162aa64a3 Merge: 6089970b077fde d739ce4bebf4c7 Author: Paolo Abeni Date: Tue Aug 19 12:13:05 2025 +0200 Merge branch 'net-macb-add-taprio-traffic-scheduling-support' Vineeth Karumanchi says: ==================== net: macb: Add TAPRIO traffic scheduling support Implement Time-Aware Traffic Scheduling (TAPRIO) offload support for Cadence MACB/GEM ethernet controllers to enable IEEE 802.1Qbv compliant time-sensitive networking (TSN) capabilities. Key features implemented: - Complete TAPRIO qdisc offload infrastructure with TC_SETUP_QDISC_TAPRIO - Hardware-accelerated time-based gate control for multiple queues - Enhanced Scheduled Traffic (ENST) register configuration and management - Gate state scheduling with configurable start times, on/off intervals - Support for cycle-time based traffic scheduling with validation - Hardware capability detection via MACB_CAPS_QBV flag - Robust error handling and parameter validation - Queue-specific timing register programming (ENST_START_TIME, ENST_ON_TIME, ENST_OFF_TIME) Changes include: - Add enst_ns_to_hw_units(): Converts nanoseconds to hardware units - Add enst_max_hw_interval(): Returns max interval for given speed - Add macb_taprio_setup_replace() for TAPRIO configuration - Add macb_taprio_destroy() for cleanup and reset - Add macb_setup_tc() as TC offload entry point - Enable NETIF_F_HW_TC feature for QBV-capable hardware - Add ENST register offsets to queue configuration The implementation validates timing constraints against hardware limits, supports per-queue gate mask configuration, and provides comprehensive logging for debugging and monitoring. Hardware registers are programmed atomically with proper locking to ensure consistent state. Tested on Xilinx Versal platforms with QBV-capable MACB controllers. Signed-off-by: Vineeth Karumanchi ==================== Link: https://patch.msgid.link/20250814071058.3062453-1-vineeth.karumanchi@amd.com Signed-off-by: Paolo Abeni commit d739ce4bebf4c708020a900548e36d005236388f Author: Vineeth Karumanchi Date: Thu Aug 14 12:40:58 2025 +0530 net: macb: Add capability-based QBV detection and Versal support The 'exclude_qbv' bit in the designcfg_debug1 register varies across MACB/GEM IP revisions, making direct probing unreliable for detecting QBV support. This patch introduces a capability-based approach for consistent QBV feature identification across the IP family. Platform support updates: - Establish foundation for QBV detection in TAPRIO implementation - Enable MACB_CAPS_QBV for Xilinx Versal platform configuration - Fix capability line wrapping, ensuring code stays within 80 columns Signed-off-by: Vineeth Karumanchi Link: https://patch.msgid.link/20250814071058.3062453-3-vineeth.karumanchi@amd.com Signed-off-by: Paolo Abeni commit 89934dbf169e358b57c2b394bb51a57d3f259dc0 Author: Vineeth Karumanchi Date: Thu Aug 14 12:40:57 2025 +0530 net: macb: Add TAPRIO traffic scheduling support Implement Time-Aware Traffic Scheduling (TAPRIO) offload support for Cadence MACB/GEM ethernet controllers to enable IEEE 802.1Qbv compliant time-sensitive networking (TSN) capabilities. Key Features: 1. Enhanced Scheduled Traffic (ENST) Register Management - Per-queue ENST registers: ENST_START_TIME, ENST_ON_TIME, ENST_OFF_TIME - Centralized control via ENST_CONTROL for gate enable/disable - Infrastructure enhancements: * Extended macb_queue structure with ENST timing control registers * Mapped ENST register offsets into queue management framework * Introduced macb_queue_enst_config for per-entry TC configuration - Timing conversion utility: * enst_ns_to_hw_units(): Converts nanoseconds to hardware units * Timing values are programmed as hardware units based on link speed * Conversion formula: time_bytes = time_ns / divisor * Speed-specific divisors: 1Gbps=8, 100Mbps=80, 10Mbps=800 - Hardware limit utility: * enst_max_hw_interval(): Returns max interval for given speed 2. TAPRIO Configuration via "tc qdisc replace" - macb_taprio_setup_replace(): Configures TAPRIO hardware offload - Parameter validation checks performed: * TC entry limit validation against available hardware queues * Base time non-negativity enforcement * Speed-adaptive timing constraint verification * Cycle time vs. total gate time consistency checks * Single-queue gate mask enforcement per scheduling entry - Programming sequence: * GEM doesn't support changing ENST registers if ENST is enabled, hence disable ENST before programming * Atomic timing register configuration (START_TIME, ON_TIME, OFF_TIME) * Enable queues via ENST_CONTROL 3. TAPRIO Cleanup via "tc qdisc destroy" - macb_taprio_destroy(): Safely removes TAPRIO configuration - Restores default queue behavior - Cleanup steps: * Reset TC state * Disable ENST * Clear timing registers * Ensure atomic updates with locking 4. Traffic Control Offload Infrastructure - macb_setup_taprio(): TAPRIO command dispatcher * Verifies hardware support * Handles runtime suspend state - macb_setup_tc(): TC_SETUP_QDISC_TAPRIO entry point - Supports REPLACE and DESTROY operations Tested on Xilinx Versal platforms with QBV-capable MACB controllers. Signed-off-by: Vineeth Karumanchi Link: https://patch.msgid.link/20250814071058.3062453-2-vineeth.karumanchi@amd.com Signed-off-by: Paolo Abeni commit 87660a84bb2897344a368aabe990789cdced5954 Author: Wolfram Sang Date: Wed Aug 13 18:15:00 2025 +0200 pmdomain: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-15-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit a83a7a7b205018a436cbdbd9676cfaaf01773f47 Author: Joy Zou Date: Wed Aug 6 19:41:18 2025 +0800 pmdomain: imx93-blk-ctrl: mask DSI and PXP PD domain register on i.MX91 The i.MX91 is derived from i.MX93, but there is no DSI and PXP in i.MX91, Add skip_mask in struct imx93_blk_ctrl_data, then skip DSI and PXP for i.MX91 Soc. Signed-off-by: Joy Zou Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250806114119.1948624-11-joy.zou@nxp.com Signed-off-by: Ulf Hansson commit 88f9d89871014559557ecc9b9ae9c9c0821a6e96 Author: Joy Zou Date: Wed Aug 6 19:41:17 2025 +0800 pmdomain: imx93-blk-ctrl: use ARRAY_SIZE() instead of hardcode number Optimize i.MX93 num_clks hardcode with ARRAY_SIZE(). Reviewed-by: Frank Li Signed-off-by: Joy Zou Link: https://lore.kernel.org/r/20250806114119.1948624-10-joy.zou@nxp.com Signed-off-by: Ulf Hansson commit d3b76c18af95ff8da8666e6e9962b9f5ba4d3006 Merge: 31f799ae091bb5 91d7789fd016e0 Author: Ulf Hansson Date: Tue Aug 19 11:49:45 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 91d7789fd016e0616913313b3306b83f8a608489 Author: Joy Zou Date: Wed Aug 6 19:41:10 2025 +0800 dt-bindings: soc: imx-blk-ctrl: add i.MX91 blk-ctrl compatible Add new compatible string "fsl,imx91-media-blk-ctrl" for i.MX91, which has different input clocks compared to i.MX93. Update the clock-names list and handle it in the if-else branch accordingly. Keep the same restriction for the existed compatible strings. Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Signed-off-by: Joy Zou Link: https://lore.kernel.org/r/20250806114119.1948624-3-joy.zou@nxp.com Signed-off-by: Ulf Hansson commit 6f21672c42fc432d69d8fd51e5d8cea145d5be5b Author: Lad Prabhakar Date: Tue Aug 12 21:03:39 2025 +0100 arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Enable I2C0 and I2C1 support Enable I2C0 and I2C1 on the RZ/T2H evaluation board. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250812200344.3253781-9-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c11ef17a6535539fb42d516de1bc6622b50ed242 Merge: 98340bf91dd9e8 5293e8f2a85434 Author: Geert Uytterhoeven Date: Tue Aug 19 11:42:30 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag3' into renesas-dts-for-v6.18 Renesas RZ/T2H and RZ/N2H USB_CLK and Pin Control DT Binding Definitions USB_CLK Clock and Pin Control DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files. commit 4b4dbf0f261811cf05ec91aa5de5cc652b6f5a1e Merge: dca2f73cf19fed 051f7141673aa1 Author: Linus Walleij Date: Tue Aug 19 11:41:49 2025 +0200 Merge branch 'ib-gpio_generic_chip_init' into devel commit 051f7141673aa112a9c4119e1b5e0d0f580951f3 Author: Bartosz Golaszewski Date: Mon Aug 11 17:02:04 2025 +0200 pinctrl: wpcm450: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250811-gpio-mmio-pinctrl-conv-v1-5-a84c5da2be20@linaro.org Signed-off-by: Linus Walleij commit 9e546aa9d5e032cd89529cd377631a60b0dfe35a Author: Bartosz Golaszewski Date: Mon Aug 11 17:02:03 2025 +0200 pinctrl: npcm7xx: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250811-gpio-mmio-pinctrl-conv-v1-4-a84c5da2be20@linaro.org Signed-off-by: Linus Walleij commit d2e9afca3a40eb4fe39ef0654e89cc19b2e0a939 Author: Bartosz Golaszewski Date: Mon Aug 11 17:02:02 2025 +0200 pinctrl: npcm8xx: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250811-gpio-mmio-pinctrl-conv-v1-3-a84c5da2be20@linaro.org Signed-off-by: Linus Walleij commit 658cd189d793d56c1f80841da6a8b5d2d7c72aa3 Author: Bartosz Golaszewski Date: Mon Aug 11 17:02:01 2025 +0200 pinctrl: equilibrium: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250811-gpio-mmio-pinctrl-conv-v1-2-a84c5da2be20@linaro.org Signed-off-by: Linus Walleij commit 4bcff9c05b9db73aa2cfe911e948b24151858ce7 Author: Bartosz Golaszewski Date: Mon Aug 11 17:02:00 2025 +0200 pinctrl: stm32: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250811-gpio-mmio-pinctrl-conv-v1-1-a84c5da2be20@linaro.org Signed-off-by: Linus Walleij commit 98340bf91dd9e8f08f25364edd8819ee903c1b84 Author: Thierry Bultel Date: Tue Aug 12 21:03:34 2025 +0100 arm64: dts: renesas: r9a09g077: Add pinctrl node Add pinctrl node to RZ/T2H ("R9A09G077") SoC DTSI. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250812200344.3253781-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 41e194978510a9910be2ed7b4d8b4edb61671a90 Author: Lad Prabhakar Date: Tue Aug 12 21:03:33 2025 +0100 arm64: dts: renesas: r9a09g087: Add DT nodes for SCI channels 1-5 The RZ/N2H SoC exposes six SCI controllers; sci0 was already present in the SoC DTSI. Add the remaining SCI nodes (sci1-sci5). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250812200344.3253781-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit be5d60d94b982d46a734750d93624bd85a1c7089 Author: Lad Prabhakar Date: Tue Aug 12 21:03:32 2025 +0100 arm64: dts: renesas: r9a09g077: Add DT nodes for SCI channels 1-5 The RZ/T2H SoC exposes six SCI controllers; sci0 was already present in the SoC DTSI. Add the remaining SCI nodes (sci1-sci5). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250812200344.3253781-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6fb1e70e7a918969573bc5258975456bb7165cc0 Author: Tommaso Merciai Date: Thu Aug 7 17:14:36 2025 +0200 arm64: dts: renesas: r9a09g047: Add I3C node Add the I3C node to RZ/G3E SoC DTSI. Signed-off-by: Tommaso Merciai Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250807151434.5241-8-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit cd09e96fbac54fa962750c8cecea4d3d5e7e72ae Author: Quynh Nguyen Date: Thu Aug 7 17:14:35 2025 +0200 arm64: dts: renesas: r9a08g045: Add I3C node Add the I3C node to RZ/G3S SoC DTSI. Signed-off-by: Quynh Nguyen [wsa: adapted to upstream driver, moved bus frequencies to board file] Signed-off-by: Wolfram Sang Reviewed-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250807151434.5241-7-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit 31f799ae091bb5254085520a41ecc060dc667e01 Author: Dmitry Baryshkov Date: Fri Jul 18 19:13:42 2025 +0300 pmdomain: qcom: rpmpd: switch to RPMPD_* indices Use generic RPMPD_* defines for power domain instead of using platform-specific defines for the platforms that use shared indices. Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-rework-rpmhpd-rpmpd-v1-4-eedca108e540@oss.qualcomm.com Signed-off-by: Ulf Hansson commit d9f0633867711cff87c5604a4f90daa8ab986e4f Author: Šerif Rami Date: Tue Aug 19 09:51:17 2025 +0200 ALSA: usb-audio: us144mkii: Use le16_to_cpu() for product ID comparison The `us144mkii.c` driver was generating sparse warnings due to direct comparisons of `dev->descriptor.idProduct` (a `__le16` type) with integer constants. This commit resolves these warnings by explicitly converting `idProduct` to a CPU-endian integer using `le16_to_cpu()` before comparison. This ensures correct handling of endianness and eliminates the sparse warnings: - `restricted __le16 degrades to integer` Fixes: dee1bcf28a3d ("ALSA: usb-audio: Add initial driver for TASCAM US-144MKII") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508190811.tjQJZI1X-lkp@intel.com/ Signed-off-by: Šerif Rami Link: https://patch.msgid.link/20250819075118.9221-1-ramiserifpersia@gmail.com Signed-off-by: Takashi Iwai commit 94838f383a050e124c044e74a954777b8f2e6c17 Author: Dmitry Baryshkov Date: Fri Jul 18 19:13:41 2025 +0300 dt-bindings: power: qcom-rpmpd: add generic bindings for RPM power domains Some of the Qualcomm RPM PD controllers use a common set of indices for power domains. Add generic indices for Qualcomm RPM power domain controllers. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-rework-rpmhpd-rpmpd-v1-3-eedca108e540@oss.qualcomm.com Signed-off-by: Ulf Hansson commit e6e1e3b6b8f9b9b78aa0dccdde431145cefb05f5 Author: Dmitry Baryshkov Date: Fri Jul 18 19:13:40 2025 +0300 dt-bindings: power: qcom-rpmpd: sort out entries After removing RPMh PD indices, it becomes obvious that several entries don't follow the alphabetic sorting order. Move them in order to keep the file sorted. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-rework-rpmhpd-rpmpd-v1-2-eedca108e540@oss.qualcomm.com Signed-off-by: Ulf Hansson commit dcb8d01b65fb5a891ddbbedcbe6eff0b8ec37867 Author: Dmitry Baryshkov Date: Fri Jul 18 19:13:39 2025 +0300 dt-bindings: power: qcom-rpmpd: split RPMh domains definitions Historically both RPM and RPMh domain definitions were a part of the same, qcom-rpmpd.h header. Now as we have a separate header for RPMh definitions, qcom,rpmhpd.h, move all RPMh power domain definitions to that header. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Reviewed-by: Konrad Dybcio Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-rework-rpmhpd-rpmpd-v1-1-eedca108e540@oss.qualcomm.com Signed-off-by: Ulf Hansson commit 499cbe0f2fb0641cf07a1a8ac9f7317674295fea Author: Christoph Hellwig Date: Mon Aug 18 06:58:21 2025 +0200 dm error: mark as DM_TARGET_PASSES_INTEGRITY Mark dm error as DM_TARGET_PASSES_INTEGRITY so that it can be stacked on top of PI capable devices. The claim is strictly speaking as lie as dm error fails all I/O and doesn't pass anything on, but doing the same for integrity I/O work just fine :) This helps to make about two dozen xfstests test cases pass on PI capable devices. Signed-off-by: Christoph Hellwig Signed-off-by: Mikulas Patocka commit c7c61bc417b0334c4feb2bac455c17bf36c5891b Author: Bagas Sanjaya Date: Fri Aug 15 15:03:13 2025 +0700 dm-vdo: Promote dm-vdo title to title heading dm-vdo docs currently has no explicit title heading but instead there are multiple section headings as top-level heading. As such, these sections are rendered as titles and inflates number of entries in the toctree index. Promote the first section heading ("dm-vdo") to title heading. Fixes: 04bf7ac646ab ("dm: add documentation for dm-vdo target") Signed-off-by: Bagas Sanjaya Signed-off-by: Mikulas Patocka commit a86f1b4047a9ccaa5a0e691e7cf52928b68f4595 Author: Soham Metha Date: Wed Aug 13 02:19:47 2025 +0530 docs: device-mapper: fixed spelling mistakes in documentation found/fixed the following typos - flushs -> flushes in `Documentation/admin-guide/device-mapper/delay.rst` Signed-off-by: Soham Metha Signed-off-by: Mikulas Patocka commit 31a9403b0d5450aa2595e2fbb8f6091f097906ab Author: Qianfeng Rong Date: Mon Aug 11 20:36:36 2025 +0800 dm bufio: remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Also update comments to clarify the flag semantics. Signed-off-by: Qianfeng Rong Signed-off-by: Mikulas Patocka commit d4f00a584b1536f6655ae31641a3dd4c7a80b63c Author: Mikulas Patocka Date: Mon Aug 11 13:13:28 2025 +0200 dm-ima: drop a useless argument The "gfp_t flags" is always GFP_KERNEL, so it can be removed. Signed-off-by: Mikulas Patocka commit c3797175b3673b3a38d59991f7bf4762bce016dd Author: Qianfeng Rong Date: Wed Aug 6 20:27:04 2025 +0800 dm: use vmalloc_array() to simplify code Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code. Signed-off-by: Qianfeng Rong Signed-off-by: Mikulas Patocka commit a3191475d17c19826fff712cbd057032cb079399 Author: Dmitry Antipov Date: Tue Aug 5 13:35:41 2025 +0300 dm-ima: more strlen() drops Following commit ebbd17695e9e ("dm: ima: avoid extra calls to strlen()"), convert 'dm_ima_alloc_and_copy_capacity_str()' to return the number of characters emitted by 'scnprintf()' and simplify the users accordingly. Compile tested only. Signed-off-by: Dmitry Antipov Reviewed-by: Hou Tao Signed-off-by: Mikulas Patocka commit 5d1c82943f3beaa8b97eb11d865239cbab88e527 Author: Shubham Sharma Date: Sun Aug 10 17:00:08 2025 +0530 docs: device-mapper: fix typos in delay.rst and vdo-design.rst Fixed the following typos in device-mapper documentation: - explicitely -> explicitly - approriate -> appropriate Signed-off-by: Shubham Sharma Signed-off-by: Mikulas Patocka commit 6089970b077fdec6f80b502e875d7a5b3f95cdf9 Merge: 38e14673925db0 7fedb8f2677e89 Author: Paolo Abeni Date: Tue Aug 19 10:51:20 2025 +0200 Merge branch 'eth-fbnic-add-xdp-support-for-fbnic' Mohsin Bashir says: ==================== eth: fbnic: Add XDP support for fbnic This patch series introduces basic XDP support for fbnic. To enable this, it also includes preparatory changes such as making the HDS threshold configurable via ethtool, updating headroom for fbnic, tracking frag state in shinfo, and prefetching the first cacheline of data. V3: https://lore.kernel.org/netdev/20250812220150.161848-1-mohsin.bashr@gmail.com/ V2: https://lore.kernel.org/netdev/20250811211338.857992-1-mohsin.bashr@gmail.com/ V1: https://lore.kernel.org/netdev/20250723145926.4120434-1-mohsin.bashr@gmail.com/ ==================== Link: https://patch.msgid.link/20250813221319.3367670-1-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 7fedb8f2677e89d6a39f238fe7428eaf7646ba58 Author: Mohsin Bashir Date: Wed Aug 13 15:13:19 2025 -0700 eth: fbnic: Report XDP stats via ethtool Add support to collect XDP stats via ethtool API. We record packets and bytes sent, and packets dropped on the XDP_TX path. ethtool -S eth0 | grep xdp | grep -v "0" xdp_tx_queue_13_packets: 2 xdp_tx_queue_13_bytes: 16126 Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-10-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 5213ff086344394ddb586298ad1d408c93406621 Author: Mohsin Bashir Date: Wed Aug 13 15:13:18 2025 -0700 eth: fbnic: Collect packet statistics for XDP Add support for XDP statistics collection and reporting via rtnl_link and netdev_queue API. For XDP programs without frags support, fbnic requires MTU to be less than the HDS threshold. If an over-sized frame is received, the frame is dropped and recorded as rx_length_errors reported via ip stats to highlight that this is an error. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-9-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 168deb7b31b2e2f578726093c8a133f8e36c0b86 Author: Mohsin Bashir Date: Wed Aug 13 15:13:17 2025 -0700 eth: fbnic: Add support for XDP_TX action Add support for XDP_TX action and cleaning the associated work. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-8-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit cf4facfb132af01c3c1bf0fab7685b3db17446ea Author: Mohsin Bashir Date: Wed Aug 13 15:13:16 2025 -0700 eth: fbnic: Add support for XDP queues Add support for allocating XDP_TX queues and configuring ring support. FBNIC has been designed with XDP support in mind. Each Tx queue has 2 submission queues and one completion queue, with the expectation that one of the submission queues will be used by the stack, and the other by XDP. XDP queues are populated by XDP_TX and start from index 128 in the TX queue array. The support for XDP_TX is added in the next patch. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-7-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 1b0a3950dbd4fa278dc33401a4faba2a23307a16 Author: Mohsin Bashir Date: Wed Aug 13 15:13:15 2025 -0700 eth: fbnic: Add XDP pass, drop, abort support Add basic support for attaching an XDP program to the device and support for PASS/DROP/ABORT actions. In fbnic, buffers are always mapped as DMA_BIDIRECTIONAL. The BPF program pointer can be read either on a per-packet basis or on a per-NAPI poll basis. Both approaches are functionally equivalent, in the current code. Stick to per-packet as it limits number of arguments we need to pass around. On the XDP hot path, check that packets with fragments are only allowed when multi-buffer support is enabled for the XDP program. Ideally, this check should not be necessary because ndo_bpf verifies that for XDP programs without multi-buff support, MTU is less than the hds_thresh. However, the MTU currently does not enforce the receive size which would require cleaning up the data path and bouncing the link. For practical reasons, prioritize the ability to enter and exit BPF mode with different MTU sizes without requiring a full reconfig. Testing: Hook a simple XDP program that passes all the packets destined for a specific port iperf3 -c 192.168.1.10 -P 5 -p 12345 Connecting to host 192.168.1.10, port 12345 [ 5] local 192.168.1.9 port 46702 connected to 192.168.1.10 port 12345 [ ID] Interval Transfer Bitrate Retr Cwnd - - - - - - - - - - - - - - - - - - - - - - - - - [SUM] 1.00-2.00 sec 3.86 GBytes 33.2 Gbits/sec 0 XDP_DROP: Hook an XDP program that drops packets destined for a specific port iperf3 -c 192.168.1.10 -P 5 -p 12345 ^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [SUM] 0.00-0.00 sec 0.00 Bytes 0.00 bits/sec 0 sender [SUM] 0.00-0.00 sec 0.00 Bytes 0.00 bits/sec receiver iperf3: interrupt - the client has terminated XDP with HDS: - Validate XDP attachment failure when HDS is low ~] ethtool -G eth0 hds-thresh 512 ~] sudo ip link set eth0 xdpdrv obj xdp_pass_12345.o sec xdp ~] Error: fbnic: MTU too high, or HDS threshold is too low for single buffer XDP. - Validate successful XDP attachment when HDS threshold is appropriate ~] ethtool -G eth0 hds-thresh 1536 ~] sudo ip link set eth0 xdpdrv obj xdp_pass_12345.o sec xdp - Validate when the XDP program is attached, changing HDS thresh to a lower value fails ~] ethtool -G eth0 hds-thresh 512 ~] netlink error: fbnic: Use higher HDS threshold or multi-buf capable program - Validate HDS thresh does not matter when xdp frags support is available ~] ethtool -G eth0 hds-thresh 512 ~] sudo ip link set eth0 xdpdrv obj xdp_pass_mb_12345.o sec xdp.frags Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-6-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 9064ab485f04df40e7f0838245849e2e4c5159d9 Author: Mohsin Bashir Date: Wed Aug 13 15:13:14 2025 -0700 eth: fbnic: Prefetch packet headers on Rx Issue a prefetch for the start of the buffer on Rx to try to avoid cache miss on packet headers. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-5-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 61f9a066c3099264f40737d134c7921567f85072 Author: Mohsin Bashir Date: Wed Aug 13 15:13:13 2025 -0700 eth: fbnic: Use shinfo to track frags state on Rx Remove local fields that track frags state and instead store this information directly in the shinfo struct. This change is necessary because the current implementation can lead to inaccuracies in certain scenarios, such as when using XDP multi-buff support. Specifically, the XDP program may update nr_frags without updating the local variables, resulting in an inconsistent state. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-4-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 0cf5a39720d09793f9cc5a8ec6bb026e6b20e883 Author: Mohsin Bashir Date: Wed Aug 13 15:13:12 2025 -0700 eth: fbnic: Update Headroom Fbnic currently reserves a minimum of 64B headroom, but this is insufficient for inserting additional headers (e.g., IPV6) via XDP, as only 24 bytes are available for adjustment. To address this limitation, increase the headroom to a larger value while ensuring better page use. Although the resulting headroom (192B) is smaller than the recommended value (256B), forcing the headroom to 256B would require aligning to 256B (as opposed to the current 128B), which can push the max headroom to 511B. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-3-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 2b30fc01a6c788ed4a799ed8a6f42ed9ac82417f Author: Mohsin Bashir Date: Wed Aug 13 15:13:11 2025 -0700 eth: fbnic: Add support for HDS configuration Add support for configuring the header data split threshold. For fbnic, the tcp data split support is enabled all the time. Fbnic supports a maximum buffer size of 4KB. However, the reservation for the headroom, tailroom, and padding reduce the max header size accordingly. ethtool_hds -g eth0 Ring parameters for eth0: Pre-set maximums: ... HDS thresh: 3584 Current hardware settings: ... HDS thresh: 1536 Verify hds tests in ksft-net-drv are passing ksft-net-drv]# ./drivers/net/hds.py TAP version 13 1..13 ok 1 hds.get_hds ok 2 hds.get_hds_thresh ok 3 hds.set_hds_disable # SKIP disabling of HDS not supported by ... ... ... ok 12 hds.ioctl_set_xdp ok 13 hds.ioctl_enabled_set_xdp \# Totals: pass:12 fail:0 xfail:0 xpass:0 skip:1 error:0 Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250813221319.3367670-2-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 30359c239ba8394c8e774151d26914db18dc4976 Author: Hans de Goede Date: Fri Jul 25 23:52:59 2025 +0200 platform/x86: int3472: Increase ov08x40 handshake GPIO delay to 45 ms On HP laptops with an ov08x40 sensor the 25 ms delay coming from Intel's out of tree drivers is not enough. Testing has confirmed that 45 ms does work. Add a quirk to the int3472_gpio_map[] to increase the delay to 45 ms to fix probing of the ov08x40 sensor failing on these laptops. Note this only impacts laptops which actually use an ov08x40 sensor with a handshake GPIO. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2333331 Signed-off-by: Hans de Goede Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250725215259.402796-4-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f11f8948a826afba66355302ba7e4b3e36333038 Author: Hans de Goede Date: Fri Jul 25 23:52:58 2025 +0200 platform/x86: int3472: Rework regulator enable-time handling Instead of hardcoding the regulator enable-time for INT3472_GPIO_TYPE- POWER_ENABLE and -HANDSHAKE, make int3472_get_con_id_and_polarity() set the enable-time. This will allow overriding the enable time through quirks in the int3472_gpio_map[]. Signed-off-by: Hans de Goede Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250725215259.402796-3-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b33b696f86f6d17c9083d69a13d7f32380d818d3 Author: Hans de Goede Date: Fri Jul 25 23:52:57 2025 +0200 platform/x86: int3472: Convert int3472_gpio_map to use C99 initializers Convert int3472_gpio_map to use C99 initializers to make it clearer which struct field is set to which value. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250725215259.402796-2-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0492e13eb819008e0ce7570a7e152559e9a89a4e Author: Jani Nikula Date: Mon Aug 18 13:07:28 2025 +0300 drm/i915/dram: move fsb_freq and mem_freq to dram info Store fsb_freq and mem_freq in dram info the same way we do for other memory info on later platforms for a slightly more unified approach. This allows us to remove fsb_freq, mem_freq and is_ddr3 members from struct drm_i915_private and struct xe_device. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/a38c4b105ba9098fa0b128cb86cd4eb63bcc27e8.1755511595.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 10e656f8c4a6b99f905bf024712c4d56882bb6a9 Author: Jani Nikula Date: Mon Aug 18 13:07:27 2025 +0300 drm/i915/dram: bypass fsb/mem freq detection on dg2 and no display Non-display now calls the intel_fsb_freq() and intel_mem_freq() functions, so we don't have to have the frequencies initialized for dg2 or non-display cases. This is in preparation for unifying the pre-gen9 handling in dram info. DG2 remains a special case as described in commit 5eb6bf0b44e7 ("drm/i915/dg2: Don't read DRAM info"). v2: Rebase Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/7bfed06d431354f3918ea73d43a2ec8ed9426a76.1755511595.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6c9f41d8fa808f9020fbd64f74cf872080f2cd74 Author: Jani Nikula Date: Mon Aug 18 13:07:26 2025 +0300 drm/i915/rps: use intel_fsb_freq() and intel_mem_freq() The rps init only happens once, so it's not important to use the cached versions, and we can drop the dependency on them. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/6f3b703f7cb5605bf139cbe27697c1d4ffe7e719.1755511595.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6e977fe781a1d1cc003415ba32de18191e255150 Author: Jani Nikula Date: Mon Aug 18 13:07:25 2025 +0300 drm/i915/dram: add intel_mem_freq() Add a more generic intel_mem_freq() function instead of platform specific ones. Expose it for future use outside of intel_dram.c. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/602103b290a92ba26d581eeb595ba5e707eb5bc4.1755511595.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e0b1bbed5e48efe353a2f1381cc37ea092eb98b7 Author: Jani Nikula Date: Mon Aug 18 13:07:24 2025 +0300 drm/i915/dram: add intel_fsb_freq() and use it Add a more generic intel_fsb_freq() function instead of platform specific ones. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/c5b77311c5f64b7163c86a042b7d023c07a685e2.1755511595.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1d409b0a77ee55ae2062d74fb8c0148cb663bfb8 Author: Jani Nikula Date: Mon Aug 18 10:16:05 2025 +0300 drm/i915/switcheroo: check for NULL before dereferencing Both i915_switcheroo_set_state() and i915_switcheroo_can_switch() check for i915 == NULL. Commit d2e184f8e16a ("drm/i915/switcheroo: pass display to HAS_DISPLAY()") started dereferencing it before the NULL check. Fix it. Fixes: d2e184f8e16a ("drm/i915/switcheroo: pass display to HAS_DISPLAY()") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202508160035.hmzuKiww-lkp@intel.com/ Cc: Gustavo Sousa Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250818071605.2541523-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit bf7a6a67050f5d59a674ecc3ecd06d6b09cfec49 Author: Vincent Li Date: Mon Aug 18 09:51:13 2025 -0700 bpftool: Add kernel.kptr_restrict hint for no instructions From bpftool's github repository issue [0]: When a Linux distribution has the kernel.kptr_restrict set to 2, bpftool prog dump jited returns "no instructions returned". This message can be puzzling to bpftool users who are not familiar with kernel BPF internals, so add a small hint for bpftool users to check the kernel.kptr_restrict setting similar to the DUMP_XLATED case. Outside of kernel.kptr_restrict, no instructions could also be returned in case the JIT was disabled. Signed-off-by: Vincent Li Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://github.com/libbpf/bpftool/issues/184 [0] Link: https://lore.kernel.org/bpf/20250818165113.15982-1-vincent.mc.li@gmail.com commit 0f051749c804b5a4f485013c0e3c932e1dd9f70b Author: Krishna Chaitanya Chundru Date: Sat Aug 9 15:29:17 2025 +0530 phy: qcom-qmp-pcie: add dual lane PHY support for SM8750 The PCIe Gen3 x2 PHY for SM8750 uses new phy, add the required registers and offsets for this phy. Signed-off-by: Krishna Chaitanya Chundru Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250809-pakala-v1-2-abf1c416dbaa@oss.qualcomm.com Signed-off-by: Vinod Koul commit edafd4f3fd52a614c5cee2684559367eac2286dc Author: Krishna Chaitanya Chundru Date: Sat Aug 9 15:29:16 2025 +0530 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Document the SM8750 QMP PCIe PHY Gen3 x2 Document the QMP PCIe PHY on the SM8750 platform. Signed-off-by: Krishna Chaitanya Chundru Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250809-pakala-v1-1-abf1c416dbaa@oss.qualcomm.com Signed-off-by: Vinod Koul commit ba49a4643cf53c6e9582b4a31142b67f5829cd82 Author: Chaitanya Kumar Borah Date: Wed Jul 30 11:25:23 2025 +0530 drm/i915/dp: Set min_bpp limit to 30 in HDR mode Update intel_dp_compute_config_limits() to use a minimum of 30 bits per pixel when the connector is in HDR mode (specifically, when EOTF is SMPTE ST2084), aligning with HDR display requirements. To support this, the function now takes a drm_connector_state instead of an intel_connector, and the required updates are made in all call sites, including MST handling. This ensures sufficient bitdepth for HDR content to avoid banding. If the required bandwidth for 30 bpp cannot be supported, the driver will either fall back to DSC or reject the mode during atomic check if DSC is not supported. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250730055523.2214966-3-chaitanya.kumar.borah@intel.com commit 2e9da93d604ef66b2ed6c5df7b7bfda3a187e71c Author: Chaitanya Kumar Borah Date: Wed Jul 30 11:25:22 2025 +0530 drm/i915/dp: Refactor intel_dp_in_hdr_mode() for broader reuse The intel_dp_in_hdr_mode() helper was previously defined in intel_dp_aux_backlight.c but is generally useful beyond that context. Move the function to intel_dp.c and declare it in intel_dp.h to make it accessible to other DP-related code paths that need to check HDR metadata state. This is a pure refactor with no functional change and prepares for a follow-up patch that uses this helper. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250730055523.2214966-2-chaitanya.kumar.borah@intel.com commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 Author: Florian Fainelli Date: Mon Aug 18 08:50:48 2025 -0700 cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() Broadcom STB platforms were early adopters (2017) of the SCMI framework and as a result, not all deployed systems have a Device Tree entry where SCMI protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the CPU Device Tree node(s) referencing protocol 0x13 as their clock provider. This was clarified in commit e11c480b6df1 ("dt-bindings: firmware: arm,scmi: Extend bindings for protocol@13") in 2023. For those platforms, we allow the checks done by scmi_dev_used_by_cpus() to continue, and in the event of not having done an early return, we key off the documented compatible string and give them a pass to continue to use scmi-cpufreq. Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") Signed-off-by: Florian Fainelli Reviewed-by: Sudeep Holla Signed-off-by: Viresh Kumar commit cf0ed173d27a2a832642aa441eb28a4dca53fd19 Author: Akhil P Oommen Date: Mon Jun 23 19:42:07 2025 +0530 arm64: defconfig: Enable X1P42100 GPUCC driver In order to enable GPU support in X1P42100-CRD and other similar laptops with Snapdragon X1P42100 SoC, enable X1P42100 GPUCC driver as a module. Signed-off-by: Akhil P Oommen Link: https://lore.kernel.org/r/20250623-x1p-adreno-v4-2-d2575c839cbb@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 13650cd32cfc640fbd49f0424640f64d57335d4c Author: Krzysztof Kozlowski Date: Mon Aug 18 14:38:52 2025 +0200 soc: qcom: icc-bwmon: Fix handling dev_pm_opp_find_bw_*() errors The ISR calls dev_pm_opp_find_bw_ceil(), which can return EINVAL, ERANGE or ENODEV, and if that one fails with ERANGE, then it tries again with floor dev_pm_opp_find_bw_floor(). In theory, following error paths are possible: 1. First dev_pm_opp_find_bw_ceil() failed with an error different than ERANGE, 2. Any error from second dev_pm_opp_find_bw_floor(). However in practice this would mean that there are no suitable OPPs at all, which is already being checked in the drivers probe() function. This is impossible condition. Relying however in the interrupt handler bwmon_intr_thread() on preconditions checked in probe() is not easy to follow from code readability and is very difficult to handle in static analysis, thus let's make the code just obvious to silence warning reported by Smatch: icc-bwmon.c:693 bwmon_intr_thread() error: 'target_opp' dereferencing possible ERR_PTR() Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aJTNEQsRFjrFknG9@stanley.mountain/ Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250818123851.111326-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 03f69351b63ea9583bd91c60a83d0a8573ea29fb Author: Niklas Cassel Date: Thu Aug 14 19:32:25 2025 +0200 scsi: pm80xx: Use pm80xx_get_local_phy_id() to access phy array While the current code is perfectly fine (because we verify that the device is directly attached before using attached_phy to index the pm8001_ha->phy array), let's use the pm80xx_get_local_phy_id() helper anyway, to reduce the chance that someone will copy paste this pattern to other parts of the driver. Note that in this specific case, we still need to keep the check that the device is not behind an expander, because we do not want to clear attached_phy of the expander if a device behind the expander disappears (as that would disable all the other devices behind the expander). However, if it is the expander itself that disappears, attached_phy will be cleared, just like it would for any other directly attached device. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-22-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: Igor Pylypiv Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit ad70c6bc776b53e61c8db6533c833aff0ff5da8b Author: Niklas Cassel Date: Thu Aug 14 19:32:24 2025 +0200 scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, you cannot use attached_phy to index the pm8001_ha->phy array, without first verifying that the device is directly attached. Use the pm80xx_get_local_phy_id() helper to make sure that we use the local phy id to index the array, regardless if the device is directly attached or not. Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.") Reviewed-by: Igor Pylypiv Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit b4ec98303f9fc9b1da0053106716db6a7e002d8b Author: Niklas Cassel Date: Thu Aug 14 19:32:23 2025 +0200 scsi: pm80xx: Add helper function to get the local phy id Avoid duplicated code by adding a helper to get the local phy id. No functional changes intended. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-20-cassel@kernel.org Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 35e388696c3f3b6bf70e2010873c5e0c1d37d579 Author: Niklas Cassel Date: Thu Aug 14 19:32:22 2025 +0200 scsi: pm80xx: Use dev_parent_is_expander() helper Make use of the dev_parent_is_expander() helper. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-19-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Reviewed-by: Igor Pylypiv Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit 3adf779489839516d61c3ead08cc148a7374b581 Author: Niklas Cassel Date: Thu Aug 14 19:32:21 2025 +0200 scsi: mvsas: Use dev_parent_is_expander() helper Make use of the dev_parent_is_expander() helper. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-18-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit ad6ae22927a7ed411d892d80934610c49882a378 Author: Niklas Cassel Date: Thu Aug 14 19:32:20 2025 +0200 scsi: isci: Use dev_parent_is_expander() helper Make use of the dev_parent_is_expander() helper. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-17-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit 0c0188dd200e4709da72cc3d65c012f34030b950 Author: Niklas Cassel Date: Thu Aug 14 19:32:19 2025 +0200 scsi: hisi_sas: Use dev_parent_is_expander() helper Make use of the dev_parent_is_expander() helper. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-16-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit e5eb72c92eb724aa14c50c7d92d1a576dd50d7e6 Author: Niklas Cassel Date: Thu Aug 14 19:32:18 2025 +0200 scsi: libsas: Add dev_parent_is_expander() helper Many libsas drivers check if the parent of the device is an expander. Create a helper that the libsas drivers will use in follow up commits. Suggested-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-15-cassel@kernel.org Reviewed-by: Damien Le Moal Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 251be2f6037fb7ab399f68cd7428ff274133d693 Author: Niklas Cassel Date: Thu Aug 14 19:32:17 2025 +0200 scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached. Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") Reviewed-by: Igor Pylypiv Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit eeee1086073e0058243c8554738271561bde81f1 Author: Niklas Cassel Date: Thu Aug 14 19:32:16 2025 +0200 scsi: pm80xx: Restore support for expanders Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke support for expanders. After the commit, devices behind an expander are no longer detected. Simply reverting the commit restores support for devices behind an expander. Instead of reverting the commit (and reintroducing a helper to get the port), get the port directly from the lldd_port pointer in struct asd_sas_port. Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") Suggested-by: Igor Pylypiv Reviewed-by: Igor Pylypiv Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit dc60a408a1dc29974bc82239b07b70c5f7fcfd31 Author: Bart Van Assche Date: Wed Aug 13 10:10:41 2025 -0700 scsi: ufs: core: Improve IOPS Measurements have shown that IOPS improve by 2% - 3% on my UFS 4 test setup every time a ktime_get() call is removed from the UFS driver command processing path. Hence this patch that modifies ufshcd_clk_scaling_start_busy() such that ktime_get() is only called if the returned value will be used. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250813171049.3399387-1-bvanassche@acm.org Reviewed-by: Bean Huo Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 33319e8fd7ac2631eef89c770940fa5f96a93063 Author: Liao Yuanhong Date: Mon Aug 18 14:42:19 2025 +0800 wifi: rtw89: 8852bt: Simplify unnecessary if-else conditions in _dpk_onoff() Some simple if-else logic can be simplified using the ! operator to improve code readability. Signed-off-by: Liao Yuanhong Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250818064219.448066-1-liaoyuanhong@vivo.com commit ec0b44736b1d22b763ee94f1aee856f9e793f3fe Author: Bitterblue Smith Date: Mon Aug 11 18:33:28 2025 +0300 wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver for RTL8188SU. The r8712u driver from staging used to handle this ID. Closes: https://lore.kernel.org/linux-wireless/ee0acfef-a753-4f90-87df-15f8eaa9c3a8@gmx.de/ Cc: stable@vger.kernel.org Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/f147b2ab-4505-435a-aa32-62964e4f1f1e@gmail.com commit e798f2ac6040f46a04795d7de977341fa9aeabae Author: Bitterblue Smith Date: Mon Aug 11 18:32:55 2025 +0300 wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver for RTL8188SU. The r8712u driver from staging used to handle this ID. Closes: https://lore.kernel.org/linux-wireless/ee0acfef-a753-4f90-87df-15f8eaa9c3a8@gmx.de/ Cc: stable@vger.kernel.org Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/2e5e2348-bdb3-44b2-92b2-0231dbf464b0@gmail.com commit 38e14673925db05c506c427c87b22e62109c46b9 Merge: 5883cb32fcea44 5e5b39aa6f82e7 Author: Jakub Kicinski Date: Mon Aug 18 18:10:14 2025 -0700 Merge branch 'net-stmmac-eee-and-wol-cleanups' Russell King says: ==================== net: stmmac: EEE and WoL cleanups This series contains a series of cleanup patches for the EEE and WoL code in stmmac, prompted by issues raised during the last three weeks. ==================== Link: https://patch.msgid.link/aJ8avIp8DBAckgMc@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5e5b39aa6f82e74a2b4caa79005b2e673f657809 Author: Russell King (Oracle) Date: Fri Aug 15 12:32:21 2025 +0100 net: stmmac: explain the phylink_speed_down() call in stmmac_release() The call to phylink_speed_down() looks odd on the face of it. Add a comment to explain why this call is there. phylink_speed_up() is always called in __stmmac_open(), and already has a comment. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1umsfV-008vKv-1O@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6a9a6ce962292b2cf31049f02a9360ca2ef25676 Author: Russell King (Oracle) Date: Fri Aug 15 12:32:15 2025 +0100 net: stmmac: add helpers to indicate WoL enable status Add two helpers to abstract the WoL enable status at the PHY and MAC to make the code easier to read. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1umsfP-008vKp-U1@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d09413dd2577953f671136d572932b91a0293db4 Author: Russell King (Oracle) Date: Fri Aug 15 12:32:10 2025 +0100 net: stmmac: use core wake IRQ support The PM core provides management of wake IRQs along side setting the device wake enable state. In order to use this, we need to register the interrupt used to wakeup the system using devm_pm_set_wake_irq() or dev_pm_set_wake_irq(). The core will then enable or disable IRQ wake state on this interrupt as appropriate, depending on the device_set_wakeup_enable() state. device_set_wakeup_enable() does not care about having balanced enable/disable calls. Make use of this functionality, rather than explicitly managing the IRQ enable state in the set_wol() ethtool op. This removes the IRQ wake state management from stmmac. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1umsfK-008vKj-Pw@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f17bd297bb833e6f1cae9d3cadad8f334bc3cb8b Author: Russell King (Oracle) Date: Fri Aug 15 12:32:05 2025 +0100 net: stmmac: remove unnecessary "stmmac: wakeup enable" print Printing "stmmac: wakeup enable" to the kernel log isn't useful - it doesn't identify the adapter, and is effectively nothing more than a debugging print. This information can be discovered by looking at /sys/device.../power/wakeup as the device_set_wakeup_enable() call updates this sysfs file. Reviewed-by: Andrew Lunn Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1umsfF-008vKc-Kt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b181306e5e6877f4330081821437ae10ee4a10f6 Author: Russell King (Oracle) Date: Fri Aug 15 12:32:00 2025 +0100 net: stmmac: remove redundant WoL option validation The core ethtool API validates the WoL options passed from userspace against the support which the driver reports from its get_wol() method, returning EINVAL if an unsupported mode is requested. Therefore, there is no need for stmmac to implement its own validation. Remove this unnecessary code. See ethnl_set_wol() in net/ethtool/wol.c and ethtool_set_wol() in net/ethtool/ioctl.c. Reviewed-by: Andrew Lunn Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1umsfA-008vKW-H1@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 49b97bc52affb8c800a3b266c8d64482f7b5caf2 Author: Russell King (Oracle) Date: Fri Aug 15 12:31:55 2025 +0100 net: stmmac: remove write-only mac->pmt mac_device_info->pmt is only ever written, nothing reads it. Remove this struct member. Reviewed-by: Andrew Lunn Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1umsf5-008vKQ-DT@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6d598e856d10317412898cb841ee9df5779bc57d Author: Russell King (Oracle) Date: Fri Aug 15 12:31:50 2025 +0100 net: stmmac: remove unnecessary checks in ethtool eee ops Phylink will check whether the MAC supports the LPI methods in struct phylink_mac_ops, and return -EOPNOTSUPP if the LPI capabilities are not provided. stmmac doesn't provide LPI capabilities if priv->dma_cap.eee is not set. Therefore, checking the state of priv->dma_cap.eee in the ethtool ops and returning -EOPNOTSUPP is redundant - let phylink handle this. Reviewed-by: Andrew Lunn Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1umsf0-008vKK-A3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bf02a01d1dd5bfe76ad8db3b588a39ecac96ebee Author: Kuan-Chung Chen Date: Mon Aug 11 20:40:01 2025 +0800 wifi: rtw89: fix group frames loss when connected to non-transmitted BSSID When STA connects to AP with dot11MultiBSSIDImplemented set to true, the layout of the TIM element's Partial Virtual Bitmap changes. Bits 1 to (2^n - 1) are used to indicate buffered group addressed frames (e.g., broadcast/multicast) for non-transmitted BSSIDs. Fix the interpretation of this field to ensure group addressed frames are correctly received. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811124001.15774-1-pkshih@realtek.com commit c4c16c88e78417424b4e3f33177e84baf0bc9a99 Author: Kuan-Chung Chen Date: Mon Aug 11 20:39:50 2025 +0800 wifi: rtw89: fix BSSID comparison for non-transmitted BSSID For non-transmitted connections, beacons are received from the transmitted BSSID. Fix this to avoid missing beacon statistics. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123950.15697-1-pkshih@realtek.com commit 46ac5412e406f63149f199e38279f21f87f3701a Author: Chih-Kang Chang Date: Mon Aug 11 20:39:34 2025 +0800 wifi: rtw89: 8852c: check LPS H2C command complete by C2H reg instead of done ack 8852C after FW 0.27.128.0 driver check LPS H2C command received by FW using C2H reg instead of done ack. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123934.15614-1-pkshih@realtek.com commit 5b2341efbb7af974925985f7798321fe92b4f8af Author: Kuan-Chung Chen Date: Mon Aug 11 20:39:13 2025 +0800 wifi: rtw89: 8851b: rfk: update TX wideband IQK Adjust TX wideband calibration from 1 to 2 loop gain settings. This can reflect in better performance in 5 GHz medium-high attenuation environments. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123913.15524-1-pkshih@realtek.com commit b521685da35ebf091e51f9ea9ad2896a4ddb6e98 Author: Kuan-Chung Chen Date: Mon Aug 11 20:37:40 2025 +0800 wifi: rtw89: 8851b: rfk: update IQK TIA setting With the new TIA setting of RX IQK, unstable RX throughput can be avoided, especially in medium-high attenuation environments. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123744.15361-5-pkshih@realtek.com commit 38846585f9df9af1f7261d85134a5510fc079458 Author: Kuan-Chung Chen Date: Mon Aug 11 20:37:39 2025 +0800 wifi: rtw89: wow: remove notify during WoWLAN net-detect In WoWLAN net-detect mode, the firmware periodically performs scans and sends scan reports via C2H, which driver does not need. These unnecessary C2H events cause firmware watchdog timeout, leading to unexpected wakeups and SER 0x2599 on 8922AE. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123744.15361-4-pkshih@realtek.com commit 194b7ce982471468569299991b110049c4617163 Author: Kuan-Chung Chen Date: Mon Aug 11 20:37:38 2025 +0800 wifi: rtw89: debug: add beacon_info debugfs Add debugfs beacon_info to display the information of beacon tracking. The screenshot as below: [Beacon info] count: 15 interval: 100 dtim: 1 raw rssi: 146 hw rate: 0 length: 407 [Distribution] tbtt 00 - 04: 26 05 - 09: 5 10 - 14: 1 15 - 19: 0 20 - 24: 0 25 - 29: 0 drift 0: 9 1: 7 2: 3 3: 3 4: 4 5: 1 6: 1 7: 2 8: 1 11: 1 lower bound: 0 upper bound: 10 outlier count: 1 [Tracking] tbtt offset: 20 bcn timeout: 19 Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123744.15361-3-pkshih@realtek.com commit d360551f265e3c942ce06cd6f4d2f7f67741bcbd Author: Kuan-Chung Chen Date: Mon Aug 11 20:37:37 2025 +0800 wifi: rtw89: introduce beacon tracking to improve connection stability In ideal scenario, AP's beacon should transmit at the Target Beacon Transmission Time (TBTT). However, in practice, beacon may be slightly off-schedule. This beacon "drift" prevents the firmware from receiving beacon at the expected TBTT, leading to connection disruptions. To address this, we introduce beacon tracking mechanism to enhance overall connection stability. This mechanism executes the following steps in each cycle (2 seconds): 1) Based on the last 32 received beacons, compute the minimum TBTT offset to use for the next cycle 2) Using the same 32 beacons, calculate the drift of each. A histogram is plotted, and outliers are identified using a boxplot. 3) According to the statistical results from the second step, a maximum receive window size (beacon timeout) is selected to cover approximately 80% of the beacons and applied to the next cycle. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250811123744.15361-2-pkshih@realtek.com commit 5c42715e63a3cd1c69107402aefa136e3a324fab Merge: dbe99ea541f023 7f7a958a6a2c9f Author: Martin KaFai Lau Date: Mon Aug 18 17:52:13 2025 -0700 Merge branch 'bpf-next/skb-meta-dynptr' into 'bpf-next/master' Merge 'skb-meta-dynptr' branch into 'master' branch. No conflict. Signed-off-by: Martin KaFai Lau commit 7e1371023accc40423ee27264480307a1ca70aa6 Merge: bab3ce404553de 7f7a958a6a2c9f Author: Martin KaFai Lau Date: Mon Aug 18 17:58:21 2025 -0700 Merge branch 'bpf-next/skb-meta-dynptr' into 'bpf-next/net' Merge 'skb-meta-dynptr' branch into 'net' branch. No conflict. Signed-off-by: Martin KaFai Lau commit 5883cb32fcea4471da242c9147427038625eee04 Author: Vishal Badole Date: Sat Aug 16 19:49:41 2025 +0530 amd-xgbe: Configure and retrieve 'tx-usecs' for Tx coalescing Ethtool has advanced with additional configurable options, but the current driver does not support tx-usecs configuration using Ethtool. Add support to configure and retrieve 'tx-usecs' using ethtool, which specifies the wait time before servicing an interrupt for Tx coalescing. Signed-off-by: Vishal Badole Acked-by: Shyam Sundar S K Link: https://patch.msgid.link/20250816141941.126054-1-Vishal.Badole@amd.com Signed-off-by: Jakub Kicinski commit 8e33dc6f787a6193a8b0164876fdcf0617a58616 Merge: ab4ee77ed9bddf dad3280591abde Author: Jakub Kicinski Date: Mon Aug 18 17:49:54 2025 -0700 Merge branch 'net-use-vmalloc_array-to-simplify-code' Qianfeng Rong says: ==================== net: use vmalloc_array() to simplify code Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code and maintain consistency with existing kmalloc_array() usage. vmalloc_array() is also optimized better, resulting in less instructions being used [1]. [1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ ==================== Link: https://patch.msgid.link/20250816090659.117699-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit dad3280591abde4c100e8185e3e47bfe72ae53c5 Author: Qianfeng Rong Date: Sat Aug 16 17:06:54 2025 +0800 ppp: use vmalloc_array() to simplify code Remove array_size() calls and replace vmalloc() with vmalloc_array() in bsd_alloc(). vmalloc_array() is also optimized better, resulting in less instructions being used. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250816090659.117699-4-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit fce214586f99fe971a78ff1342cc331eecc74855 Author: Qianfeng Rong Date: Sat Aug 16 17:06:53 2025 +0800 nfp: flower: use vmalloc_array() to simplify code Remove array_size() calls and replace vmalloc() with vmalloc_array() in nfp_flower_metadata_init(). vmalloc_array() is also optimized better, resulting in less instructions being used. Place 'NFP_FL_STATS_ELEM_RS' with the sizeof() parameter as the second argument to vmalloc_array() to avoid -Wcalloc-transposed-args compilation warnings. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250816090659.117699-3-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 4490d075c2d989f3403059cbd30775ae21dbd754 Author: Qianfeng Rong Date: Sat Aug 16 17:06:52 2025 +0800 eth: intel: use vmalloc_array() to simplify code Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code and maintain consistency with existing kmalloc_array() usage. vmalloc_array() is also optimized better, resulting in less instructions being used. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250816090659.117699-2-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit ab4ee77ed9bddfc1c3461b42ef4875068928d2e6 Author: Jakub Kicinski Date: Fri Aug 15 09:52:42 2025 -0700 docs: netdev: refine the clean-up patch examples We discourage sending trivial patches to clean up checkpatch warnings. There are other tools which lead to patches of similarly low value like some coccicheck warnings. The warnings are useful for new code but fixing them in the existing code base is a waste of review time. Broaden the example given in the doc a little bit. Link: https://patch.msgid.link/20250815165242.124240-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b55f7295d600b4cd487ef2e9332e30d6933be78c Author: Eric Biggers Date: Thu Aug 14 19:07:05 2025 -0700 ppp: mppe: Use SHA-1 library instead of crypto_shash Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20250815020705.23055-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 1fb39d4c23b1e2b16bfd46261f4e83d42c1ff0a4 Author: Li RongQing Date: Fri Aug 15 09:56:19 2025 +0800 eth: nfp: Remove u64_stats_update_begin()/end() for stats fetch This place is fetching the stats, u64_stats_update_begin()/end() should not be used, and the fetcher of stats is in the same context as the updater of the stats, so don't need any protection Signed-off-by: Li RongQing Link: https://patch.msgid.link/20250815015619.2713-1-lirongqing@baidu.com Signed-off-by: Jakub Kicinski commit 661bfb4699f8cb283014861d3fc35195df4eead0 Author: Eric Biggers Date: Thu Aug 14 19:23:29 2025 -0700 nfc: s3fwrn5: Use SHA-1 library instead of crypto_shash Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250815022329.28672-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 05f8b341d50ac7a4330dd09c788f86052876b0bb Merge: a510980e740cc5 a7fe8b266f6596 Author: Jakub Kicinski Date: Mon Aug 18 17:26:12 2025 -0700 Merge branch 'net-dsa-move-ks8995-phy-driver-to-dsa' Linus Walleij says: ==================== net: dsa: Move ks8995 "phy" driver to DSA After we concluded that the KS8995 is a DSA switch, see commit a0f29a07b654a50ebc9b070ef6dcb3219c4de867 it is time to move the driver to it's right place under DSA. Developing full support for the custom tagging, but we can make sure the driver does the job it did as a "phy", act as a switch with individually represented ports. This patch series achieves that first step so the current device tree bindings produces working set-ups and paves the way for custom tagging. ==================== Link: https://patch.msgid.link/20250813-ks8995-to-dsa-v1-0-75c359ede3a5@linaro.org Signed-off-by: Jakub Kicinski commit a7fe8b266f659624309c69208be0410584bb9980 Author: Linus Walleij Date: Wed Aug 13 23:43:06 2025 +0200 net: dsa: ks8995: Add basic switch set-up We start to extend the KS8995 driver by simply registering it as a DSA device and implementing a few switch callbacks for STP set-up and such to begin with. No special tags or other advanced stuff: we use DSA_TAG_NONE and rely on the default set-up in the switch with the special DSA tags turned off. This makes the switch wire up properly to all its PHY's and simple bridge traffic works properly. After this the bridge DT bindings are respected, ports and their PHYs get connected to the switch and react appropriately through the phylib when cables are plugged in etc. Tested like this in a hacky OpenWrt image: Bring up conduit interface manually: ixp4xx_eth c8009000.ethernet eth0: eth0: link up, speed 100 Mb/s, full duplex spi-ks8995 spi0.0: enable port 0 spi-ks8995 spi0.0: set KS8995_REG_PC2 for port 0 to 06 spi-ks8995 spi0.0 lan1: configuring for phy/mii link mode spi-ks8995 spi0.0 lan1: Link is Up - 100Mbps/Full - flow control rx/tx PING 169.254.1.1 (169.254.1.1): 56 data bytes 64 bytes from 169.254.1.1: seq=0 ttl=64 time=1.629 ms 64 bytes from 169.254.1.1: seq=1 ttl=64 time=0.951 ms I also tested SSH from the device to the host and it works fine. It also works fine to ping the device from the host and to SSH into the device from the host. This brings the ks8995 driver to a reasonable state where it can be used from the current device tree bindings and the existing device trees in the kernel. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250813-ks8995-to-dsa-v1-4-75c359ede3a5@linaro.org Signed-off-by: Jakub Kicinski commit d3f2b604a1f92d9ee63dfd5a2313e0024d184682 Author: Linus Walleij Date: Wed Aug 13 23:43:05 2025 +0200 net: dsa: ks8995: Delete sysfs register access There is some sysfs file to read and write registers randomly in the ks8995 driver. The contemporary way to achieve the same thing is to implement regmap abstractions, if needed. Delete this and implement regmap later if we want to be able to inspect individual registers. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250813-ks8995-to-dsa-v1-3-75c359ede3a5@linaro.org Signed-off-by: Jakub Kicinski commit ccf29cb84972f97c98ac31f7d6fb1680dc5d3816 Author: Linus Walleij Date: Wed Aug 13 23:43:04 2025 +0200 net: dsa: ks8995: Add proper RESET delay According to the datasheet we need to wait 100us before accessing any registers in the KS8995 after a reset de-assertion. Add this delay, if and only if we obtained a GPIO descriptor, otherwise it is just a pointless delay. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250813-ks8995-to-dsa-v1-2-75c359ede3a5@linaro.org Signed-off-by: Jakub Kicinski commit 60cbe71fdba16d39de24bd71e1638810da5ae7ee Author: Linus Walleij Date: Wed Aug 13 23:43:03 2025 +0200 net: dsa: Move KS8995 to the DSA subsystem By reading the datasheets for the KS8995 it is obvious that this is a 100 Mbit DSA switch. Let us start the refactoring by moving it to the DSA subsystem to preserve development history. Verified that the chip still probes the same after this patch provided CONFIG_HAVE_NET_DSA, CONFIG_NET_DSA and CONFIG_DSA_KS8995 are selected. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250813-ks8995-to-dsa-v1-1-75c359ede3a5@linaro.org Signed-off-by: Jakub Kicinski commit a510980e740cc58be5733d4c15b22c7822e84c71 Author: Russell King (Oracle) Date: Wed Aug 13 12:21:19 2025 +0100 dt-bindings: net: realtek,rtl82xx: document wakeup-source property The RTL8211F PHY has two modes for a single INTB/PMEB pin: 1. INTB mode, where it signals interrupts to the CPU, which can include wake-on-LAN events. 2. PMEB mode, where it only signals a wake-on-LAN event, which may either be a latched logic low until software manually clears the WoL state, or pulsed mode. In the case of (1), there is no way to know whether the interrupt to which the PHY is connected is capable of waking the system. In the case of (2), there would be no interrupt property in the PHY's DT description, and thus there is nothing to describe whether the pin is even wired to anything such as a power management controller. There is a "wakeup-source" property which can be applied to any device - see Documentation/devicetree/bindings/power/wakeup-source.txt Case 1 above matches example 2 in this document, and case 2 above matches example 3. Therefore, it seems reasonable to make use of this existing specification, albiet it hasn't been converted to YAML. Document the wakeup-source property in the device description, which will indicate that the PHY has been wired up in such a way that it can wake the system from a low power state. We will use this in a rewrite of the existing broken Wake-on-Lan code that was merged during the 6.16 merge window to support case 1. Case 2 can be added to the driver later without needing to further alter the DT description. To be clear, the existing Wake-on-Lan code that was recently merged has multiple functional issues. Signed-off-by: Russell King (Oracle) Acked-by: Conor Dooley Link: https://patch.msgid.link/E1um9Xj-008kBx-72@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b826bf795564ddef6402cf2cb522ae035bd117ae Author: Russell King (Oracle) Date: Wed Aug 13 11:04:45 2025 +0100 net: phy: realtek: fix RTL8211F wake-on-lan support Implement Wake-on-Lan for RTL8211F correctly. The existing implementation has multiple issues: 1. It assumes that Wake-on-Lan can always be used, whether or not the interrupt is wired, and whether or not the interrupt is capable of waking the system. This breaks the ability for MAC drivers to detect whether the PHY WoL is functional. 2. switching the interrupt pin in the .set_wol() method to PMEB mode immediately silences link-state interrupts, which breaks phylib when interrupts are being used rather than polling mode. 3. the code claiming to "reset WOL status" was doing nothing of the sort. Bit 15 in page 0xd8a register 17 controls WoL reset, and needs to be pulsed low to reset the WoL state. This bit was always written as '1', resulting in no reset. 4. not resetting WoL state results in the PMEB pin remaining asserted, which in turn leads to an interrupt storm. Only resetting the WoL state in .set_wol() is not sufficient. 5. PMEB mode does not allow software detection of the wake-up event as there is no status bit to indicate we received the WoL packet. 6. across reboots of at least the Jetson Xavier NX system, the WoL configuration is preserved. Fix all of these issues by essentially rewriting the support. We: 1. clear the WoL event enable register at probe time. 2. detect whether we can support wake-up by having a valid interrupt, and the "wakeup-source" property in DT. If we can, then we mark the MDIO device as wakeup capable, and associate the interrupt with the wakeup source. 3. arrange for the get_wol() and set_wol() implementations to handle the case where the MDIO device has not been marked as wakeup capable (thereby returning no WoL support, and refusing to enable WoL support.) 4. avoid switching to PMEB mode, instead using INTB mode with the interrupt enable, reconfiguring the interrupt enables at suspend time, and restoring their original state at resume time (we track the state of the interrupt enable register in .config_intr() register.) 5. move WoL reset from .set_wol() to the suspend function to ensure that WoL state is cleared prior to suspend. This is necessary after the PME interrupt has been enabled as a second WoL packet will not re-raise a previously cleared PME interrupt. 6. when a PME interrupt (for wakeup) is asserted, pass this to the PM wakeup so it knows which device woke the system. This fixes WoL support in the Realtek RTL8211F driver when used on the nVidia Jetson Xavier NX platform, and needs to be applied before stmmac patches which allow these platforms to forward the ethtool WoL commands to the Realtek PHY. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1um8Ld-008jxD-Mc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7f059e47326746ceebe2a984bd6124459df3b458 Author: Akhilesh Patil Date: Sat Aug 16 11:49:54 2025 +0530 fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() Use kvfree() to free memory allocated by kvzalloc() instead of kfree(). Avoid potential memory management issue considering kvzalloc() can internally choose to use either kmalloc() or vmalloc() based on memory request and current system memory state. Hence, use more appropriate kvfree() which automatically determines correct free method to avoid potential hard to debug memory issues. Fix this issue discovered by running spatch static analysis tool using coccinelle script - scripts/coccinelle/api/kfree_mismatch.cocci Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw") Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in Signed-off-by: Akhilesh Patil Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Signed-off-by: Jason Gunthorpe commit c567bc5fc68c4388c00e11fc65fd14fe86b52070 Author: Icenowy Zheng Date: Sat Aug 16 17:11:13 2025 +0800 clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL The AXI crossbar of TH1520 has no proper timeout handling, which means gating AXI clocks can easily lead to bus timeout and thus system hang. Set all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are ungated by default on system reset. In addition, convert all current CLK_IGNORE_UNUSED usage to CLK_IS_CRITICAL to prevent unwanted clock gating. Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 8fede7ff692cc06791269cd7c68b2bd2f62af159 Author: Icenowy Zheng Date: Sat Aug 16 17:11:12 2025 +0800 clk: thead: support changing DPU pixel clock rate The DPU pixel clock rate corresponds to the required dot clock of the display mode, so it needs to be tweakable. Add support to change it, by adding generic divider setting code, arming the code to the dpu0/dpu1 clocks, and setting the pixel clock connected to the DPU (after a gate) to CLK_SET_RATE_PARENT to propagate it to the dividers. Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 56a48c1833aa1ede82cc3833d73750597eccfdb0 Author: Icenowy Zheng Date: Sat Aug 16 17:11:11 2025 +0800 clk: thead: add support for enabling/disabling PLLs The 2nd control word of T-Head TH1520 PLLs contains a bit to put the VCO into reset state, which means disabling the PLL. Some PLLs are put to disabled state by the bootloader, and the clock driver should be able to enable them. Add support for enabling/disabling PLLs. PLLs other than DPU ones are set CLK_IS_CRITICAL to prevent killing the system -- they're meant to drive CPU or system buses (even the GMAC/Video ones are driving arbitrary buses). Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit c51a37ffea3813374a8f7955abbba6da25357388 Author: Michal Wilczynski Date: Sat Aug 16 17:11:10 2025 +0800 clk: thead: Correct parent for DPU pixel clocks The dpu0_pixelclk and dpu1_pixelclk gates were incorrectly parented to the video_pll_clk. According to the TH1520 TRM, the "dpu0_pixelclk" should be sourced from "DPU0 PLL DIV CLK". In this driver, "DPU0 PLL DIV CLK" corresponds to the `dpu0_clk` clock, which is a divider whose parent is the `dpu0_pll_clk`. This patch corrects the clock hierarchy by reparenting `dpu0_pixelclk` to `dpu0_clk`. By symmetry, `dpu1_pixelclk` is also reparented to its correct source, `dpu1_clk`. Fixes: 50d4b157fa96 ("clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC") Reported-by: Icenowy Zheng Signed-off-by: Michal Wilczynski [Icenowy: add Drew's R-b and rebased atop ccu_gate refactor] Reviewed-by: Drew Fustini Signed-off-by: Icenowy Zheng Signed-off-by: Drew Fustini commit 9e99b992c8874f323091d50a5e4727bbd138192d Author: Icenowy Zheng Date: Sat Aug 16 16:44:45 2025 +0800 clk: thead: th1520-ap: fix parent of padctrl0 clock The padctrl0 clock seems to be a child of the perisys_apb4_hclk clock, gating the later makes padctrl0 registers stuck too. Fix this relationship. Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Reviewed-by: Troy Mitchell Signed-off-by: Drew Fustini commit aaa75cbd5d4f63e4edf8b74118d367361dcf92f7 Author: Icenowy Zheng Date: Sat Aug 16 16:44:44 2025 +0800 clk: thead: th1520-ap: describe gate clocks with clk_gate Similar to previous situation of mux clocks, the gate clocks of clk-th1520-ap drivers are also using a helper that creates a temporary struct clk_hw and abandons the struct clk_hw in struct ccu_common, which prevents clock gates to be clock parents. Do the similar refactor of dropping struct ccu_common and directly use struct clk_gate here. This patch mimics the refactor done on struct ccu_mux in 54edba916e29 ("clk: thead: th1520-ap: Describe mux clocks with clk_mux"). Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit b7a855f488c6825e3dc06e78c49326491bef6f98 Author: Sebastian Brzezinka Date: Mon Aug 11 09:12:45 2025 +0000 drm/i915/gt: Relocate Gen6 context-specific workaround CACHE_MODE_0 register should be saved and restored as part of the context, not during engine reset. Move the related workaround (RC_OP_FLUSH_ENABLE) from rcs_engine_wa_init() to gen6_ctx_workarounds_init() for Gen6 platforms. This ensures the WA is applied during context initialisation. CM0_STC_EVICT_DISABLE_LRA_SNB is also Gen6-specific, but it does not stick when applied in context, so it remains in engine init. BSPEC: 11322 Signed-off-by: Sebastian Brzezinka Reviewed-by: Andi Shyti Reviewed-by: Krzysztof Karas Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/f493bab389e51b2faf7c9a439724e9ea9ca04053.1754902406.git.sebastian.brzezinka@intel.com commit 77a16455fae43e304e6adaf83da5b2ba6f3ad1ad Author: Sebastian Brzezinka Date: Mon Aug 11 09:12:39 2025 +0000 drm/i915/gt: Relocate Gen7 context-specific workarounds CACHE_MODE_1 and CACHE_MODE_0 register should be saved and restored as part of the context, not during engine reset. Move the related workarounds (RC_OP_FLUSH_ENABLE, PIXEL_SUBSPAN_COLLECT_OPT_DISABLE) from rcs_engine_wa_init() to gen7_ctx_workarounds_init() for Gen7 platforms. This ensures the WA is applied during context initialisation. BSPEC: 11322, 11323 Signed-off-by: Sebastian Brzezinka Reviewed-by: Andi Shyti Reviewed-by: Krzysztof Karas Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/06cf152803ab0050e09c521ac2fc3637549860b3.1754902406.git.sebastian.brzezinka@intel.com commit c9932f0d604e4c8f2c6018e598a322acb43c68a2 Author: Sebastian Brzezinka Date: Mon Aug 11 09:12:31 2025 +0000 drm/i915/gt: Relocate compression repacking WA for JSL/EHL CACHE_MODE_0 registers should be saved and restored as part of the context, not during engine reset. Move the related workaround (Disable Repacking for Compression) from rcs_engine_wa_init() to icl_ctx_workarounds_init() for Jasper Lake and Elkhart Lake platforms. This ensures the WA is applied during context initialisation. BSPEC: 11322 Fixes: 0ddae025ab6c ("drm/i915: Disable compression tricks on JSL") Closes: Fixes: 0ddae025ab6c ("drm/i915: Disable compression tricks on JSL") Signed-off-by: Sebastian Brzezinka Cc: stable@vger.kernel.org # v6.13+ Reviewed-by: Andi Shyti Reviewed-by: Krzysztof Karas Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/4feaa24094e019e000ceb6011d8cd419b0361b3f.1754902406.git.sebastian.brzezinka@intel.com commit 645cc7863da5de700547d236697dffd6760cf051 Author: Timur Kristóf Date: Sat Aug 2 17:51:53 2025 +0200 drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. On DCE 6, DP audio was not working. However, it worked when an HDMI monitor was also plugged in. Looking at dce_aud_wall_dto_setup it seems that the main difference is that we use DTO1 when only DP is plugged in. When programming DTO1, it uses audio_dto_source_clock_in_khz which is set from get_dp_ref_freq_khz The dce60_get_dp_ref_freq_khz implementation looks incorrect, because DENTIST_DISPCLK_CNTL seems to be always zero on DCE 6, so it isn't usable. I compared dce60_get_dp_ref_freq_khz to the legacy display code, specifically dce_v6_0_audio_set_dto, and it turns out that in case of DCE 6, it needs to use the display clock. With that, DP audio started working on Pitcairn, Oland and Cape Verde. However, it still didn't work on Tahiti. Despite having the same DCE version, Tahiti seems to have a different audio device. After some trial and error I realized that it works with the default display clock as reported by the VBIOS, not the current display clock. The patch was tested on all four SI GPUs: * Pitcairn (DCE 6.0) * Oland (DCE 6.4) * Cape Verde (DCE 6.0) * Tahiti (DCE 6.0 but different) The testing was done on Samsung Odyssey G7 LS28BG700EPXEN on each of the above GPUs, at the following settings: * 4K 60 Hz * 1080p 60 Hz * 1080p 144 Hz Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit e3bd536580fe553d5768673660b1745ff1bb3b91 Author: Qianfeng Rong Date: Sat Aug 16 22:37:51 2025 +0800 drm/radeon: Use vmalloc_array and vcalloc to simplify code Use vcalloc() and vmalloc_array() to simplify the functions radeon_gart_init(). vmalloc_array() is also optimized better, resulting in less instructions being used. Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit 3856a53db6620f29dda1b42af678698c0ccc6504 Author: Rodrigo Siqueira Date: Sat Aug 16 10:27:27 2025 -0600 drm/amdgpu/vcn: Remove unnecessary check The function amdgpu_vcn_sysfs_reset_mask_init already returns 0, which makes the check of the result unnecessary in the vcn_v4_0_3_sw_init(). Just return the amdgpu_vcn_sysfs_reset_mask_init directly. Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 027e7acc7e17802ebf28e1edb88a404836ad50d6 Author: Timur Kristóf Date: Thu Jul 31 11:43:52 2025 +0200 drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 For later VBIOS versions, the fractional feedback divider is calculated as the remainder of dividing the feedback divider by a factor, which is set to 1000000. For reference, see: - calculate_fb_and_fractional_fb_divider - calc_pll_max_vco_construct However, in case of old VBIOS versions that have set_pixel_clock_v3, they only have 1 byte available for the fractional feedback divider, and it's expected to be set to the remainder from dividing the feedback divider by 10. For reference see the legacy display code: - amdgpu_pll_compute - amdgpu_atombios_crtc_program_pll This commit fixes set_pixel_clock_v3 by dividing the fractional feedback divider passed to the function by 100000. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 249d4bc5f1935f04bb45b3b63c0f8922565124f7 Author: Timur Kristóf Date: Thu Jul 31 11:43:51 2025 +0200 drm/amd/display: Don't print errors for nonexistent connectors When getting the number of connectors, the VBIOS reports the number of valid indices, but it doesn't say which indices are valid, and not every valid index has an actual connector. If we don't find a connector on an index, that is not an error. Considering these are not actual errors, don't litter the logs. Fixes: 60df5628144b ("drm/amd/display: handle invalid connector indices") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 33e0227ee96e62d034781e91f215e32fd0b1d512 Author: Timur Kristóf Date: Thu Jul 31 11:43:50 2025 +0200 drm/amd/display: Don't warn when missing DCE encoder caps On some GPUs the VBIOS just doesn't have encoder caps, or maybe not for every encoder. This isn't really a problem and it's handled well, so let's not litter the logs with it. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 8107432dff37db26fcb641b6cebeae8981cd73a0 Author: Timur Kristóf Date: Thu Jul 31 11:43:49 2025 +0200 drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs Also needed by DCE 6. This way the code that gathers this info can be shared between different DCE versions and doesn't have to be repeated. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 4ab09785f8d5d03df052827af073d5c508ff5f63 Author: Timur Kristóf Date: Thu Jul 31 11:43:48 2025 +0200 drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs dce110_fill_display_configs is shared between DCE 6-11, and finding the first CRTC and its line time is relevant to DCE 6 too. Move the code to find it from DCE 11 specific code. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 1ae45b5d4f371af8ae51a3827d0ec9fe27eeb867 Author: Timur Kristóf Date: Thu Jul 31 11:43:47 2025 +0200 drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% Adjust the nominal (and performance) clocks for DCE 8-10, and set them to 625 MHz, which is the value used by the legacy display code in amdgpu_atombios_get_clock_info. This was tested with Hawaii, Tonga and Fiji. These GPUs can output 4K 60Hz (10-bit depth) at 625 MHz. The extra 15% clock was added as a workaround for a Polaris issue which uses DCE 11, and should not have been used on DCE 8-10 which are already hardcoded to the highest possible display clock. Unfortunately, the extra 15% was mistakenly copied and kept even on code paths which don't affect Polaris. This commit fixes that and also adds a check to make sure not to exceed the maximum DCE 8-10 display clock. Fixes: 8cd61c313d8b ("drm/amd/display: Raise dispclk value for Polaris") Fixes: dc88b4a684d2 ("drm/amd/display: make clk mgr soc specific") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit dd489c01c3971778c417630f328460021fc8fc61 Merge: c17b750b3ad9f4 0070851095d295 Author: Dave Airlie Date: Tue Aug 19 06:58:56 2025 +1000 Merge tag 'drm-misc-next-2025-08-14' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.18: UAPI Changes: - Add DRM_IOCTL_GEM_CHANGE_HANDLE for reassigning GEM handles - Document DRM_MODE_PAGE_FLIP_EVENT Cross-subsystem Changes: fbcon: - Add missing declarations in fbcon.h Core Changes: bridge: - Fix ref counting panel: - Replace and remove mipi_dsi_generic_write_{seq/_chatty}() sched: - Fixes Rust: - Drop Opaque<> from ioctl arguments Driver Changes: amdxdma: - Support buffers allocated by user space - Streamline PM interfaces - Fixes bridge: - cdns-dsi: Various improvements to mode setting - Support Solomon SSD2825 plus DT bindings - Support Waveshare DSI2DPI plus DT bindings gud: - Fixes ivpu: - Fixes nouveau: - Use GSP firmware by default - Fixes panel: - panel-edp: Support mt8189 Chromebooks; Support BOE NV140WUM-N64; Support SHP LQ134Z1; Fixes - panel-simple: Support Olimex LCD-OLinuXino-5CTS plus DT bindings - Support Samsung AMS561RA01 - Support Hydis HV101HD1 plus DT bindings panthor: - Print task/pid on errors - Fixes renesas: - convert to RUNTIME_PM_OPS repaper: - Use shadow-plane helpers rocket: - Add driver for Rockchip NPU plus DT bindings sharp-memory: - Use shadow-plane helpers simpledrm: - Use of_reserved_mem_region_to_resource() helper tidss: - Use crtc_ fields for programming display mode - Remove other drivers from aperture v3d: - Support querying nubmer of GPU resets for KHR_robustness vmwgfx: - Fixes Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250814072454.GA18104@linux.fritz.box commit 427980c1cbd22bb256b9385f5ce73c0937562408 Author: Timur Kristóf Date: Thu Jul 31 11:43:46 2025 +0200 drm/amd/display: Don't overclock DCE 6 by 15% The extra 15% clock was added as a workaround for a Polaris issue which uses DCE 11, and should not have been used on DCE 6 which is already hardcoded to the highest possible display clock. Unfortunately, the extra 15% was mistakenly copied and kept even on code paths which don't affect Polaris. This commit fixes that and also adds a check to make sure not to exceed the maximum DCE 6 display clock. Fixes: 8cd61c313d8b ("drm/amd/display: Raise dispclk value for Polaris") Fixes: dc88b4a684d2 ("drm/amd/display: make clk mgr soc specific") Fixes: 3ecb3b794e2c ("drm/amd/display: dc/clk_mgr: add support for SI parts (v2)") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 27b16364ea126dc74105f151e9f64ac9e06eb268 Author: Xichao Zhao Date: Fri Aug 8 10:52:09 2025 +0800 drm/amd/display: replace min/max nesting with clamp() The clamp() macro explicitly expresses the intent of constraining a value within bounds.Therefore, replacing min(max(a, b), c) with clamp(val, lo, hi) can improve code readability. Signed-off-by: Xichao Zhao Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5599b214c4afcb4bfe213e67336ce8e8dbb0d5ab Author: Liao Yuanhong Date: Wed Aug 6 20:41:20 2025 +0800 drm/amd/display: Use swap() to simplify code Replace the original swapping logic with swap() to improve readability and remove temporary variables Signed-off-by: Liao Yuanhong Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8a614ddfad1f3d2baa45b6520688b2032f280a7d Author: Xichao Zhao Date: Thu Jul 31 15:54:50 2025 +0800 drm/amd/display: Clean up coding style Adjust whitespace around operators to improve code readability and comply with kernel coding style guidelines. These changes are purely stylistic and introduce no functional modifications. Signed-off-by: Xichao Zhao Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5e43eb3cd731649c4f8b9134f857be62a416c893 Author: Chenyuan Yang Date: Wed Jul 23 21:36:41 2025 -0500 drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 ("drm/amd/display: Add null pointer check for get_first_active_display()"). Fixes: 2deade5ede56 ("drm/amd/display: Remove hdcp display state with mst fix") Signed-off-by: Chenyuan Yang Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c9ec952216d3a520d4e066491a78743eabb3ce7c Author: Taimur Hassan Date: Fri Aug 8 17:25:32 2025 -0500 drm/amd/display: Promote DC to 3.2.346 This version brings along following updates: - Fix Xorg desktop unresponsive on Replay panel - [FW Promotion] Release 0.1.23.0 - Avoid a NULL pointer dereference - Attach privacy screen to DRM connector - Setup Second Stutter Watermark Implementation - Align LSDMA commands fields - Delete unused functions - Optimize amdgpu_dm_atomic_commit_tail() - Add primary plane to commits for correct VRR handling - Refactor DPP enum for backwards compatibility. - Add LSDMA Linear Sub Window Copy support Acked-by: Sun peng (Leo) Li Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 34d66bc7ff10e146a4cec76cf286979740a10954 Author: Tom Chung Date: Fri Jul 18 18:25:08 2025 +0800 drm/amd/display: Fix Xorg desktop unresponsive on Replay panel [WHY & HOW] IPS & self-fresh feature can cause vblank counter resets between vblank disable and enable. It may cause system stuck due to wait the vblank counter. Call the drm_crtc_vblank_restore() during vblank enable to estimate missed vblanks by using timestamps and update the vblank counter in DRM. It can make the vblank counter increase smoothly and resolve this issue. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Sun peng (Leo) Li Signed-off-by: Tom Chung Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit eac4c502119313e2c10a8a5dca099c973dc178bd Author: Taimur Hassan Date: Fri Aug 8 17:25:15 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.23.0 1. Fix loop counter. 2. Check whether rb->capacity is 0. Acked-by: Sun peng (Leo) Li Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1e5e8d672fec9f2ab352be121be971877bff2af9 Author: Mario Limonciello Date: Thu Jul 24 15:00:43 2025 -0500 drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a928f8d542ccd1e40e101cffc923ff33e36bf147 Author: Mario Limonciello Date: Thu Jul 24 13:01:09 2025 -0500 drm/amd/display: Attach privacy screen to DRM connector [WHY] If a system has a privacy screen advertised by a driver it should be included in the DRM connector for the eDP panel. [HOW] Detect statically declared privacy screens when creating eDP connector and attach privacy screen DRM properties. Reviewed-by: Harry Wentland Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d728fd03e5f2117853d91b3626d434a97fe896d1 Author: Austin Zheng Date: Tue Aug 5 15:18:02 2025 -0400 drm/amd/display: Setup Second Stutter Watermark Implementation [WHY & HOW] Setup initial changes required to program another set of watermarks for a 2nd stutter mode. The 2nd stutter mode will be lower power but have higher enter/exit latencies. PMFW to choose which stutter mode to use based on stutter efficiences to see if original stutter (LP1) or low power stutter (LP2) will result in better power savings. Reviewed-by: Alvin Lee Signed-off-by: Austin Zheng Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 421507ad489b90fe81ae3c5fef60f6cd98093eb3 Author: Rafal Ostrowski Date: Tue Aug 5 14:53:37 2025 +0200 drm/amd/display: Align LSDMA commands fields [WHY] DC LSDMA functions had to remember to extract 1 from several fields to be compliant with DMUB LSDMA commands interface. Now this logic is moved to DMUB. [HOW] Moved extraction by 1 in several fields of LSDMA commands to DMUB. Changed DC to not do it. Reviewed-by: Alvin Lee Signed-off-by: Rafal Ostrowski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit de0f5be79182c6ac53133d750cc965fe9621f57b Author: Clay King Date: Wed Jul 30 10:23:19 2025 -0400 drm/amd/display: Delete unused functions [WHAT] Removing unused code Reviewed-by: Joshua Aberback Signed-off-by: Clay King Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 63a16df7eb58f0ef699c9f08f3276791261b853a Author: Mario Limonciello Date: Tue Jul 29 18:08:24 2025 +0530 drm/amd/display: Optimize amdgpu_dm_atomic_commit_tail() [WHY] The first two loops of for_each_oldnew_connector_in_state() both operate on an HDCP queue. If one isn't setup then each connector is iterated but skipped TWICE. This is wasteful for the majority of cases. [HOW] Combine the two HDCP related loops of for_each_oldnew_connector_in_state() and check for the HDCP workqueue before even running either of them. This should avoid running the functions in most cases, and if HDCP is setup only run once. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bdd34a647e842695f86294efa442f5c4d162d705 Author: Lohita Mudimela Date: Thu Jul 17 16:43:36 2025 +0530 drm/amd/display: Refactor DPP enum for backwards compatibility [WHY] Conflict for enum type in DPP source files. [HOW] Refactor DPP source files to resolve the enum conflicts. Reviewed-by: Ilya Bakoulin Reviewed-by: Martin Leung Signed-off-by: Lohita Mudimela Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f3358399ce7151179a898bf02c1f3b68f2c4ef36 Author: Rafal Ostrowski Date: Fri Jul 11 13:13:27 2025 +0200 drm/amd/display: Add LSDMA Linear Sub Window Copy support [WHAT] Add support for LSDMA Linear Sub Window Copy command. Reviewed-by: Alvin Lee Signed-off-by: Rafal Ostrowski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e73f759d2e98c729ca6f98dad4ca6d7b9120e576 Author: Qianfeng Rong Date: Fri Aug 15 11:56:03 2025 +0800 security: use umax() to improve code Use umax() to reduce the code in update_mmap_min_addr() and improve its readability. Signed-off-by: Qianfeng Rong [PM: subj line tweak] Signed-off-by: Paul Moore commit 788c57f4766bd5802af9918ea350053a91488c60 Author: Jorge Marques Date: Mon Aug 18 16:44:23 2025 +0200 docs: iio: ad3552r: Fix malformed code-block directive Missing required double dot and line break. Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver") Signed-off-by: Jorge Marques Reviewed-by: David Lechner Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com Signed-off-by: Jonathan Cameron commit 4340feb4972e80f84ef2dff4383578f11c415e3f Author: Matti Vaittinen Date: Mon Aug 18 11:13:05 2025 +0300 iio: adc: adc128s052: Support ROHM BD7910[0,1,2,3] The ROHM BD79100, BD79101, BD79102, BD79103 are very similar ADCs as the ROHM BD79104. The BD79100 has only 1 channel. BD79101 has 2 channels and the BD79102 has 4 channels. Both BD79103 and BD79104 have 4 channels, and, based on the data sheets, they seem identical from the software point-of-view. Signed-off-by: Matti Vaittinen Reviewed-by: David Lechner Link: https://patch.msgid.link/bb7a775fd1a6135889a72ae63c45e2a4347a2aa5.1755504346.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 9e9b0b97b0c76e378c8cb407b62a79b5053993a5 Author: Matti Vaittinen Date: Mon Aug 18 11:12:52 2025 +0300 iio: adc: adc128s052: Rename channel structs The adc128s052 can be used to drive a few other ADCs but the TI's ADCs it was originally intended for. The TI's IC variants model numbers don't (trivially) explain the channel configuration (for a reader working with other than TI's ICs). Rename the channel configuration structures to explicitly explain they are used for simple ADCs, having 2, 4 or 8 channels. Signed-off-by: Matti Vaittinen Reviewed-by: David Lechner Link: https://patch.msgid.link/e737f2b416e25d8e4e734e2765b0e21a3f0ae0bb.1755504346.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 7fe5b83fbcefb100c4fcec034a4a55507cd493e2 Author: Matti Vaittinen Date: Mon Aug 18 11:12:39 2025 +0300 iio: adc: adc128s052: Simplify matching chip_data The adc128s052 driver supports a few different ICs. IC specific configuration data is stored in an array. IC data, residing in a specific point of the array, is pointed from the SPI device match data. There is no need to have the chip config data structures in an array and splitting them out of an array has at least following benefits: - Chip-specific structures can be named after the chips they support. This makes referring them a tad cleaner, compared to using a generic array name with a numerical index. - Avoid all potential 'out of bounds' errors which can result if the array is changed. Split the chip configuration data array to individual structures. Signed-off-by: Matti Vaittinen Reviewed-by: David Lechner Link: https://patch.msgid.link/943b6f4852ff0944eeaa0366cbe3b5aaf440cf23.1755504346.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit f1bbfc405e3d36545f4fd1931c3e1d32396d1b63 Author: Matti Vaittinen Date: Mon Aug 18 11:12:22 2025 +0300 dt-bindings: iio: adc: Add BD7910[0,1,2,3] The ROHM BD79100, BD79101, BD79102, BD79103 are very similar ADCs as the ROHM BD79104. The BD79100 has only 1 channel. BD79101 has 2 channels and the BD79102 has 4 channels. Both BD79103 and BD79104 have 4 channels, and, based on the data sheets, they seem identical from the software point-of-view. Signed-off-by: Matti Vaittinen Acked-by: Conor Dooley Reviewed-by: David Lechner Link: https://patch.msgid.link/0874c5933cf56430b9440d19ff46f746e4897952.1755504346.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit f5accfde5d02a7c485c38c04e2204f3b4a7b847d Merge: 9fd5f18c0b3837 90179609efa421 Author: Mark Brown Date: Mon Aug 18 19:06:40 2025 +0100 spi: use min_t() to improve code Merge series from Qianfeng Rong : Use min_t() to reduce the code and improve readability. No functional changes. commit b85bb2d677153d990924d31be9416166d22382eb Author: Simon Richter Date: Mon Aug 18 15:47:35 2025 +0900 drm/xe: Make page size consistent in loop If PAGE_SIZE != XE_PAGE_SIZE (which is currently locked behind CONFIG_BROKEN), this would generate the wrong number of PDEs. Since these PDEs are consumed by the GPU, the GPU page size needs to be used. Signed-off-by: Simon Richter Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250818064806.2835-1-Simon.Richter@hogyros.de commit 75a6b4595daa569bbc2899eef40372fc013b2d73 Author: Randy Dunlap Date: Tue Aug 12 15:35:02 2025 -0700 kconfig: qconf/xconfig: show the OptionsMode radio button setting at startup When qconf (xconfig) exits, it saves the current Option settings for Show Name, Show Debug Info, and Show {Normal|All|Prompt} Options. When it is next run, it loads these Option settings from its config file. It correctly shows the flag settings for Show Name and Show Debug Info, but it does not show which of the 3 Show...Options is set. This can lead to confusing output, e.g., if the user thinks that xconfig is in Show All Options mode but kconfig options which have an unmet dependency are still being listed. Add code to show the radio button for the current Show...Options mode during startup so that it will reflect the current config setting. Signed-off-by: Randy Dunlap Tested-by: Nicolas Schier Acked-by: Nicolas Schier Link: https://lore.kernel.org/r/20250812223502.1356426-1-rdunlap@infradead.org Signed-off-by: Nathan Chancellor commit 35883b030c5f19f12c7fe53319c93cb740e476be Author: Thorsten Blum Date: Mon Aug 11 18:16:48 2025 +0200 kconfig: nconf: Format and print 'line' without a temporary copy Use "%.*s" as the format specifier and supply the 'line' length 'len' to mvwprintw() to format and print each line without making a temporary copy. Remove the temporary buffer. Signed-off-by: Thorsten Blum Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250811161650.37428-2-thorsten.blum@linux.dev Signed-off-by: Nathan Chancellor commit 2d0ec4a9319c5207fdd2359e8543ef35012e8d4e Author: Thomas Weißschuh Date: Wed Aug 13 07:43:40 2025 +0200 kbuild: userprogs: avoid duplication of flags inherited from kernel The duplication makes maintenance harder. Changes need to be done in two places and the lines will grow overly long. Use an intermediary variable instead. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Acked-by: Masahiro Yamada Link: https://lore.kernel.org/r/20250813-kbuild-userprogs-bits-v1-1-2d9f7f411083@linutronix.de Signed-off-by: Nathan Chancellor commit 7f7a958a6a2c9f0e2e82eaffdb5965238c735591 Merge: 8f5ae30d69d754 403fae59781fdd Author: Martin KaFai Lau Date: Mon Aug 18 10:29:43 2025 -0700 Merge branch 'add-a-dynptr-type-for-skb-metadata-for-tc-bpf' Jakub Sitnicki says: ==================== Add a dynptr type for skb metadata for TC BPF TL;DR ----- This is the first step in an effort which aims to enable skb metadata access for all BPF programs which operate on an skb context. By skb metadata we mean the custom metadata area which can be allocated from an XDP program with the bpf_xdp_adjust_meta helper [1]. Network stack code accesses it using the skb_metadata_* helpers. Changelog --------- Changes in v7: - Make dynptr read-only for cloned skbs for now. (Martin) - Extend tests for skb clones to cover writes to metadata. - Drop Jesse's review stamp for patch 2 due to an update. - Link to v6: https://lore.kernel.org/r/20250804-skb-metadata-thru-dynptr-v6-0-05da400bfa4b@cloudflare.com Changes in v6: - Enable CONFIG_NET_ACT_MIRRED for bpf selftests to fix CI failure - Switch from u32 to matchall classifier, which bpf selftests already use - Link to v5: https://lore.kernel.org/r/20250731-skb-metadata-thru-dynptr-v5-0-f02f6b5688dc@cloudflare.com Changes in v5: - Invalidate skb payload and metadata slices on write to metadata. (Martin) - Drop redundant bounds check in bpf_skb_meta_*(). (Martin) - Check for unexpected flags in __bpf_dynptr_write(). (Martin) - Fold bpf_skb_meta_{load,store}_bytes() into callers. - Add a test for metadata access when an skb clone has been modified. - Drop Eduard's Ack for patch 3. Patch updated. - Keep Eduard's Ack for patches 4-8. - Add Jesse's stamp from an internal review. - Link to v4: https://lore.kernel.org/r/20250723-skb-metadata-thru-dynptr-v4-0-a0fed48bcd37@cloudflare.com Changes in v4: - Kill bpf_dynptr_from_skb_meta_rdonly. Not needed for now. (Marin) - Add a test to cover passing OOB offsets to dynptr ops. (Eduard) - Factor out bounds checks from bpf_dynptr_{read,write,slice}. (Eduard) - Squash patches: bpf: Enable read access to skb metadata with bpf_dynptr_read bpf: Enable write access to skb metadata with bpf_dynptr_write bpf: Enable read-write access to skb metadata with dynptr slice - Kept Eduard's Acks for v3 on unchanged patches. - Link to v3: https://lore.kernel.org/r/20250721-skb-metadata-thru-dynptr-v3-0-e92be5534174@cloudflare.com Changes in v3: - Add a kfunc set for skb metadata access. Limited to TC BPF. (Martin) - Drop patches related to skb metadata access outside of TC BPF: net: Clear skb metadata on handover from device to protocol selftests/bpf: Cover lack of access to skb metadata at ip layer selftests/bpf: Count successful bpf program runs - Link to v2: https://lore.kernel.org/r/20250716-skb-metadata-thru-dynptr-v2-0-5f580447e1df@cloudflare.com Changes in v2: - Switch to a dedicated dynptr type for skb metadata (Andrii) - Add verifier test coverage since we now touch its code - Add missing test coverage for bpf_dynptr_adjust and access at an offset - Link to v1: https://lore.kernel.org/r/20250630-skb-metadata-thru-dynptr-v1-0-f17da13625d8@cloudflare.com Overview -------- Today, the skb metadata is accessible only by the BPF TC ingress programs through the __sk_buff->data_meta pointer. We propose a three step plan to make skb metadata available to all other BPF programs which operate on skb objects: 1) Add a dynptr type for skb metadata (this patch set) This is a preparatory step, but it also stands on its own. Here we enable access to the skb metadata through a bpf_dynptr, the same way we can already access the skb payload today. As the next step (2), we want to relocate the metadata as skb travels through the network stack in order to persist it. That will require a safe way to access the metadata area irrespective of its location. This is where the dynptr [2] comes into play. It solves exactly that problem. A dynptr to skb metadata can be backed by a memory area that resides in a different location depending on the code path. 2) Persist skb metadata past the TC hook (future) Having the metadata in front of the packet headers as the skb travels through the network stack is problematic - see the discussion of alternative approaches below. Hence, we plan to relocate it as necessary past the TC hook. Where to relocate it? We don't know yet. There are a couple of options: (i) move it to the top of skb headroom, or (ii) allocate dedicated memory for it. They are not mutually exclusive. The right solution might be a mix. When to relocate it? That is also an open question. It could be done during device to protocol handover or lazily when headers get pushed or headroom gets resized. 3) skb dynptr for sockops, sk_lookup, etc. (future) There are BPF program types don't operate on __sk_buff context, but either have, or could have, access to the skb itself. As a final touch, we want to provide a way to create an skb metadata dynptr for these program types. TIMTOWDI -------- Alternative approaches which we considered: * Keep the metadata always in front of skb->data We think it is a bad idea for two reasons, outlined below. Nevertheless we are open to it, if necessary. 1) Performance concerns It would require the network stack to move the metadata on each header pull/push - see skb_reorder_vlan_header() [3] for an example. While doable, there is an expected performance overhead. 2) Potential for bugs In addition to updating skb_push/pull and pskp_expand_head, we would need to audit any code paths which operate on skb->data pointer directly without going through the helpers. This creates a "known unknown" risk. * Design a new custom metadata area from scratch We have tried that in Arthur's patch set [4]. One of the outcomes of the discussion there was that we don't want to have two places to store custom metadata. Hence the change of approach to make the existing custom metadata area work. -jkbs [1] https://docs.ebpf.io/linux/helper-function/bpf_xdp_adjust_meta/ [2] https://docs.ebpf.io/linux/concepts/dynptrs/ [3] https://elixir.bootlin.com/linux/v6.16-rc6/source/net/core/skbuff.c#L6211 [4] https://lore.kernel.org/all/20250422-afabre-traits-010-rfc2-v2-0-92bcc6b146c9@arthurfabre.com/ ==================== Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-0-8a39e636e0fb@cloudflare.com Signed-off-by: Martin KaFai Lau commit 403fae59781fddc699af761f38ed024d3245096b Author: Jakub Sitnicki Date: Thu Aug 14 11:59:35 2025 +0200 selftests/bpf: Cover metadata access from a modified skb clone Demonstrate that, when processing an skb clone, the metadata gets truncated if the program contains a direct write to either the payload or the metadata, due to an implicit unclone in the prologue, and otherwise the dynptr to the metadata is limited to being read-only. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-9-8a39e636e0fb@cloudflare.com commit bd1b51b319788cbc5769a44f0081a1cb012f8ae4 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:34 2025 +0200 selftests/bpf: Cover read/write to skb metadata at an offset Exercise r/w access to skb metadata through an offset-adjusted dynptr, read/write helper with an offset argument, and a slice starting at an offset. Also check for the expected errors when the offset is out of bounds. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-8-8a39e636e0fb@cloudflare.com commit ed93360807801e7f69b74efec98a1bd674ba035e Author: Jakub Sitnicki Date: Thu Aug 14 11:59:33 2025 +0200 selftests/bpf: Cover write access to skb metadata via dynptr Add tests what exercise writes to skb metadata in two ways: 1. indirectly, using bpf_dynptr_write helper, 2. directly, using a read-write dynptr slice. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-7-8a39e636e0fb@cloudflare.com commit 153f6bfd489076309227413e9221960712336369 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:32 2025 +0200 selftests/bpf: Cover read access to skb metadata via dynptr Exercise reading from SKB metadata area in two new ways: 1. indirectly, with bpf_dynptr_read(), and 2. directly, with bpf_dynptr_slice(). Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-6-8a39e636e0fb@cloudflare.com commit dd9f6cfb4ef4394c2afd1e2b564af25aff151bc8 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:31 2025 +0200 selftests/bpf: Parametrize test_xdp_context_tuntap We want to add more test cases to cover different ways to access the metadata area. Prepare for it. Pull up the skeleton management. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-5-8a39e636e0fb@cloudflare.com commit 6dfd5e01e1a7728e162f721cd8adf5ecd24fbc80 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:30 2025 +0200 selftests/bpf: Pass just bpf_map to xdp_context_test helper Prepare for parametrizing the xdp_context tests. The assert_test_result helper doesn't need the whole skeleton. Pass just what it needs. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-4-8a39e636e0fb@cloudflare.com commit 0e74eb4d57f00e6103ac23ce2312766c25ad88f6 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:29 2025 +0200 selftests/bpf: Cover verifier checks for skb_meta dynptr type dynptr for skb metadata behaves the same way as the dynptr for skb data with one exception - writes to skb_meta dynptr don't invalidate existing skb and skb_meta slices. Duplicate those the skb dynptr tests which we can, since bpf_dynptr_from_skb_meta kfunc can be called only from TC BPF, to cover the skb_meta dynptr verifier checks. Also add a couple of new tests (skb_data_valid_*) to ensure we don't invalidate the slices in the mentioned case, which are specific to skb_meta dynptr. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-3-8a39e636e0fb@cloudflare.com commit 6877cd392baecf816c2ba896a9d42874628004a5 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:28 2025 +0200 bpf: Enable read/write access to skb metadata through a dynptr Now that we can create a dynptr to skb metadata, make reads to the metadata area possible with bpf_dynptr_read() or through a bpf_dynptr_slice(), and make writes to the metadata area possible with bpf_dynptr_write() or through a bpf_dynptr_slice_rdwr(). Note that for cloned skbs which share data with the original, we limit the skb metadata dynptr to be read-only since we don't unclone on a bpf_dynptr_write to metadata. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-2-8a39e636e0fb@cloudflare.com commit 89d912e494f786e79f69ed9d567a8842c71dbb03 Author: Jakub Sitnicki Date: Thu Aug 14 11:59:27 2025 +0200 bpf: Add dynptr type for skb metadata Add a dynptr type, similar to skb dynptr, but for the skb metadata access. The dynptr provides an alternative to __sk_buff->data_meta for accessing the custom metadata area allocated using the bpf_xdp_adjust_meta() helper. More importantly, it abstracts away the fact where the storage for the custom metadata lives, which opens up the way to persist the metadata by relocating it as the skb travels through the network stack layers. Writes to skb metadata invalidate any existing skb payload and metadata slices. While this is more restrictive that needed at the moment, it leaves the door open to reallocating the metadata on writes, and should be only a minor inconvenience to the users. Only the program types which can access __sk_buff->data_meta today are allowed to create a dynptr for skb metadata at the moment. We need to modify the network stack to persist the metadata across layers before opening up access to other BPF hooks. Once more BPF hooks gain access to skb_meta dynptr, we will also need to add a read-only variant of the helper similar to bpf_dynptr_from_skb_rdonly. skb_meta dynptr ops are stubbed out and implemented by subsequent changes. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Reviewed-by: Jesse Brandeburg Link: https://patch.msgid.link/20250814-skb-metadata-thru-dynptr-v7-1-8a39e636e0fb@cloudflare.com commit 9fd5f18c0b38378f83a425b874bd76bf7ad40cf9 Merge: 48124569bbc6bf 0056b410355713 Author: Mark Brown Date: Mon Aug 18 18:28:08 2025 +0100 spi: offload-trigger: followup Merge series from David Lechner : This cleans up a few loose ends from the series that added the ADI Util Sigma-Delta SPI driver [1]. [1]: https://lore.kernel.org/linux-spi/20250701-iio-adc-ad7173-add-spi-offload-support-v3-0-42abb83e3dac@baylibre.com/ commit 27758d8c2583d10472b745a43ff86fef96c11ef7 Author: Thomas Weißschuh Date: Thu Aug 14 12:14:46 2025 +0200 kbuild: enable -Werror for hostprogs The hostprog compilers and linkers do not share the regular compiler flags, so they are not affected by CONFIG_WERROR or W=e. As hostprogs are used during the bootstrap of the build, they can't depend on kconfig options. Enable -Werror unconditionally. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/rust-for-linux/CANiq72k-PdSH2BNgbq=X+FhpyEErifSCKfO5ObXz6bu9_J8+fA@mail.gmail.com/ Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-6-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit e6a9530b3ee7407b70b60e4df70688db0d239e1a Author: Dave Jiang Date: Mon Aug 18 08:39:53 2025 -0700 cxl: Fix emit of type resource_size_t argument for validate_region_offset() 0day reported warnings of: drivers/cxl/core/region.c:3664:25: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Wformat=] drivers/cxl/core/region.c:3671:37: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Wformat=] Replace %#llx with %pr to emit resource_size_t arguments. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508160513.NAZ9i9rQ-lkp@intel.com/ Cc: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20250818153953.3658952-1-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 37c52167b007d9d0bb8c5ed53dd6efc4969a1356 Author: David Sterba Date: Wed Aug 13 12:00:52 2025 +0200 docs: Remove remainders of reiserfs Reiserfs has been removed in 6.13, there are still some mentions in the documentation about it and the tools. Remove those that don't seem relevant anymore but keep references to reiserfs' r5 hash used by some code. There's one change in a script scripts/selinux/install_policy.sh but it does not seem to be relevant either. Signed-off-by: David Sterba Acked-by: Paul Moore Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813100053.1291961-1-dsterba@suse.com commit 4e18a0b090f067173dd937ad446b9e199c70a7c8 Merge: fea71fe1f060a7 29fe206065f378 Author: Jonathan Corbet Date: Mon Aug 18 10:40:16 2025 -0600 Merge branch 'bjorn' into docs-mw A big set of typo fixes from Bjorn Helgaas commit 29fe206065f3784397252c7f6aa28dc6d413fb94 Author: Bjorn Helgaas Date: Wed Aug 13 15:05:04 2025 -0500 Documentation: Fix trace typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-9-helgaas@kernel.org commit 3dae66aec6b0bd847e5056fb5174dfc325162734 Author: Bjorn Helgaas Date: Wed Aug 13 15:05:03 2025 -0500 Documentation: Fix power typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-8-helgaas@kernel.org commit e855d7e5e2e9ed311930d557f7ed033e200fcdef Author: Bjorn Helgaas Date: Wed Aug 13 15:05:02 2025 -0500 Documentation: Fix networking typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-7-helgaas@kernel.org commit 81fd803b5a5da3fad0140163091e12b3ac2ae484 Author: Bjorn Helgaas Date: Wed Aug 13 15:05:01 2025 -0500 Documentation: Fix filesystems typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-6-helgaas@kernel.org commit 8900f9ad90c05d0c44a21786cfef08061230f5b7 Author: Bjorn Helgaas Date: Wed Aug 13 15:05:00 2025 -0500 Documentation: Fix core-api typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-5-helgaas@kernel.org commit c349216707362a8c2376995296cb55604d4c0ee9 Author: Bjorn Helgaas Date: Wed Aug 13 15:04:59 2025 -0500 Documentation: Fix admin-guide typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-4-helgaas@kernel.org commit aa7acf34c50b991702a0d052aa2b99b434e8a01c Author: Bjorn Helgaas Date: Wed Aug 13 15:04:58 2025 -0500 Documentation: Fix RCU typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-3-helgaas@kernel.org commit c676a536f6b5d4c423ff66a2aa27b6c4141e4895 Author: Bjorn Helgaas Date: Wed Aug 13 15:04:57 2025 -0500 Documentation: Fix PCI typos Fix typos. Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250813200526.290420-2-helgaas@kernel.org commit cf65182247761f7993737b710afe8c781699356b Author: Mohammad Rafi Shaik Date: Fri Aug 15 22:53:53 2025 +0530 ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers On some Qualcomm platforms such as QCS6490-RB3Gen2, the multiple WSA8830/WSA8835 speaker amplifiers share a common reset (shutdown) GPIO. To handle such scenario, use the reset controller framework and its "reset-gpio" driver to handle such case. This allows proper handling of all WSA883x speaker amplifiers on QCS6490-RB3Gen2 board. Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250815172353.2430981-3-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Mark Brown commit 126750523eac0ea79df672d9771eb483f7497b16 Author: Mohammad Rafi Shaik Date: Fri Aug 15 22:53:52 2025 +0530 ASoC: dt-bindings: qcom,wsa8830: Add reset-gpios for shared line On Qualcomm platforms such as QCS6490-RB3Gen2, the WSA883x speaker amplifiers share the SD_N GPIO line between two speakers, thus requires coordinated control when asserting the GPIO. Linux supports shared GPIO handling via the "reset-gpios" property, which can be used to specify either the powerdown or reset GPIOs. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Mohammad Rafi Shaik Link: https://patch.msgid.link/20250815172353.2430981-2-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Mark Brown commit fea71fe1f060a722f7cb26aeca27d36d9370916d Author: Bagas Sanjaya Date: Thu Aug 14 08:20:46 2025 +0700 Documentation: ktap: Separate first bullet list items The first bullet list items are shown in htmldocs output as combined with previous paragraph due to missing blank line separator. Add it. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814012046.21235-3-bagasdotme@gmail.com commit 359ad700eb8b563461819b6227b021b280e37e3e Author: Bagas Sanjaya Date: Thu Aug 14 08:20:45 2025 +0700 Documentation: ktap: Correct "its" spelling Fix possessive adjective "its" spelling. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814012046.21235-2-bagasdotme@gmail.com commit 1d8125e27323d8a378cb38f88a6c5a0d7fdb2f6c Author: Jonathan Corbet Date: Thu Aug 14 09:40:35 2025 -0600 docs: kdoc: remove redundant comment stripping By the time stuff gets to create_parameter_list(), comments have long since been stripped out, so we do not need to do it again here. Acked-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-8-corbet@lwn.net commit e5d91662fcbac251dd17f04dbacf4d997939316e Author: Jonathan Corbet Date: Thu Aug 14 09:40:34 2025 -0600 docs: kdoc: tighten up the pointer-to-function case Tighten up the code and remove an unneeded regex operation. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-7-corbet@lwn.net commit bf6b310d1b7e31a1cd6951eb75608a1d2876c04a Author: Jonathan Corbet Date: Thu Aug 14 09:40:33 2025 -0600 docs: kdoc: tighten up the array-of-pointers case Simplify one gnarly regex and remove another altogether; add a comment describing what is going on. There will be no #-substituted commas in this case, so don't bother trying to put them back. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-6-corbet@lwn.net commit 8f05fbc5afb86f0d4dcae33f3cb0cda561d4d93e Author: Jonathan Corbet Date: Thu Aug 14 09:40:32 2025 -0600 docs: kdoc: add a couple more comments in create_parameter_list() Make what the final code is doing a bit more clear to slow readers like me. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-5-corbet@lwn.net commit 05d72fe07242a8e4535aa52e0858f9198e668a41 Author: Jonathan Corbet Date: Thu Aug 14 09:40:31 2025 -0600 docs: kdoc: clean up the create_parameter_list() "first arg" logic The logic for finding the name of the first in a series of variable names is somewhat convoluted and, in the use of .extend(), actively buggy. Document what is happening and simplify the logic. Acked-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-4-corbet@lwn.net commit f51b42b99e1d35698e0277337fde2c15ccc29a2b Author: Jonathan Corbet Date: Thu Aug 14 09:40:30 2025 -0600 docs: kdoc: tidy up space removal in create_parameter_list() Remove a redundant test and add a comment describing what the space removal is doing. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-3-corbet@lwn.net commit 670ec7333a2c4823ac777b70f045cf731525ae5e Author: Jonathan Corbet Date: Thu Aug 14 09:40:29 2025 -0600 docs: kdoc: remove dead code create_parameter_list() tests an argument against the same regex twice, in two different locations; remove the pointless extra tests and the never-executed error cases that go with them. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814154035.328769-2-corbet@lwn.net commit 6cf5f13ef3f1c032b48fddd4f0f9108236c7762a Author: Ranganath V N Date: Fri Aug 15 00:13:03 2025 +0530 Documentation: Fix driver-api typos Corrected a few spelling mistakes functionalty ==> functionality in Documentation/driver-api/cxl/devices/device-types.rst adjascent ==> adjacent in Documentation/driver-api/cxl/platform/example-configurations/one-dev-per-hb.rst succeessful ==> successful in Documentation/driver-api/thermal/exynos_thermal_emulation.rst Signed-off-by: Ranganath V N Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250814184304.20448-1-vnranganath.20@gmail.com commit 6865cb19082140a07da356f57d52168aec38340c Author: Vivek Yadav Date: Sat Aug 16 01:24:52 2025 -0700 docs: remove a duplicated word from kernel-parameters.txt Fix kernel-doc warning in kernel-parameters.txt WARNING: Possible repeated word: 'is' Signed-off-by: Vivek Yadav Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250816082452.219009-1-vivekyadav1207731111@gmail.com commit ed14c74ddf4932a2505afae30dac7639c96bcb0c Author: Nikola Z. Ivanov Date: Sat Aug 16 22:00:28 2025 +0300 docs: Replace dead links to spectre side channel white papers The papers are published by Intel, AMD and MIPS. Signed-off-by: Nikola Z. Ivanov Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250816190028.55573-1-zlatistiv@gmail.com commit aa81d55a5997b190660e21e72177f1542c4e3d59 Author: Christoph Manszewski Date: Wed Aug 13 12:12:31 2025 +0200 drm/xe: Untangle vm_bind_ioctl cleanup order Change the resource cleanup order to align with reverse allocation order. Cc: Matthew Brost Signed-off-by: Christoph Manszewski Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250813101231.196632-3-christoph.manszewski@intel.com commit a01b704527c28a2fd43a17a85f8996b75ec8492a Author: Christoph Manszewski Date: Wed Aug 13 12:12:30 2025 +0200 drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Signed-off-by: Christoph Manszewski Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250813101231.196632-2-christoph.manszewski@intel.com commit fce343d8546e47053b47c30f23dd0ac4729b2f66 Author: Iris Shi <0.0@owo.li> Date: Mon Aug 18 17:47:48 2025 +0800 Documentation/sphinx: Fix typo in automarkup.py "whan" -> "when" Signed-off-by: Iris Shi <0.0@owo.li> Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/8e5ddb7d-8faf-314f-b1b1-2d15d6900862@owo.li commit dca2f73cf19fedd7bc38fa6a0eb50fea63cd0214 Author: Thomas Richard Date: Mon Aug 11 15:25:53 2025 +0200 pinctrl: Add pin controller driver for AAEON UP boards This enables the pin control support of the onboard FPGA on AAEON UP boards. This FPGA acts as a level shifter between the Intel SoC pins and the pin header, and also as a mux or switch. +---------+ +--------------+ +---+ | | | | | | PWM0 | \ | | H | |----------|------ \-----|-------------| E | | I2C0_SDA | | | A | Intel SoC |----------|------\ | | D | | GPIO0 | \------|-------------| E | |----------|------ | | R | | | FPGA | | | ----------+ +--------------+ +---+ For most of the pins, the FPGA opens/closes a switch to enable/disable the access to the SoC pin from a pin header. Each switch, has a direction flag that is set depending the status of the SoC pin. For some other pins, the FPGA acts as a mux, and routes one pin (or the other one) to the header. The driver also provides a GPIO chip. It requests SoC pins in GPIO mode, and drives them in tandem with FPGA pins (switch/mux direction). This commit adds support only for UP Squared board. Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/20250811-aaeon-up-board-pinctrl-support-v9-10-29f0cbbdfb30@bootlin.com Signed-off-by: Linus Walleij commit c8cea4371e5eca30cda8660aabb337747dabc51d Author: Lizhi Hou Date: Fri Aug 15 10:16:34 2025 -0700 accel/amdxdna: Add a function to walk hardware contexts Walking hardware contexts created by a process is duplicated in multiple spots. Add a function, amdxdna_hwctx_walk(), and replace all spots. hwctx_srcu and dev_lock are good enough to protect hardware context list. Remove hwctx_lock. Reviewed-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250815171634.3417487-1-lizhi.hou@amd.com commit dbe99ea541f023d73abf5730c1477ba96111ef83 Author: Anton Protopopov Date: Sat Aug 16 15:15:54 2025 +0000 bpf: Add a verbose message when the BTF limit is reached When a BPF program which is being loaded reaches the map limit (MAX_USED_MAPS) or the BTF limit (MAX_USED_BTFS) the -E2BIG is returned. However, in the former case there is an accompanying verifier verbose message, and in the latter case there is not. Add a verbose message to make the behaviour symmetrical. Reported-by: Kevin Sheldrake Signed-off-by: Anton Protopopov Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250816151554.902995-1-a.s.protopopov@gmail.com commit 236152dd9b1675a35eee912e79e6c57ca6b6732f Author: Chi Zhang Date: Thu Aug 7 14:20:38 2025 +0800 pinctrl: single: fix bias pull up/down handling in pin_config_set In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias() which writes the register. However, the subsequent operations continue using the stale 'data' value from before the register write, effectively causing the bias clear operation to be overwritten and not take effect. Fix this by reading the 'data' value from the register after calling pcs_pinconf_clear_bias(). This bug seems to have existed when this code was first merged in commit 9dddb4df90d1 ("pinctrl: single: support generic pinconf"). Signed-off-by: Chi Zhang Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com Signed-off-by: Linus Walleij commit 694a97ee25581630f70773d160fcc2364afe98c8 Author: Hendrik Hamerlinck Date: Tue Aug 5 17:07:01 2025 +0200 pinctrl: spacemit: remove extra line in debug output The debug output for spacemit_pinconf_dbg_show() prints an extra newline at the end. This is redundant as pinconf_pins_show() in pinconf.c already adds a newline in its for loop. Remove the newline to avoid the extra line in the output. Example current output: $ cat /sys/kernel/debug/pinctrl/d401e000.pinctrl/pinconf-pins Pin config settings per pin Format: pin (name): configs pin 0 (GPIO_00): , bias pull disabled, io type (Fixed/1V8), drive strength (32 mA), register (0x1041) pin 1 (GPIO_01): slew rate (0x0), bias pull disabled, io type (Fixed/1V8), drive strength (32 mA), register (0x1041) pin 2 (GPIO_02): slew rate (0x0), bias pull disabled, io type (Fixed/1V8), drive strength (32 mA), register (0x1041) ... Signed-off-by: Hendrik Hamerlinck Reviewed-by: Yixun Lan Link: https://lore.kernel.org/20250805150701.129113-1-hendrik.hamerlinck@hammernet.be Signed-off-by: Linus Walleij commit 65fe705367efc3e06ccfa2a3a107081d8e69f70e Author: Julien Massot Date: Fri Aug 1 13:18:09 2025 +0200 dt-bindings: pinctrl: mediatek: mt8183: Allow gpio-line-names Add support for the 'gpio-line-names' property in the MT8183 pinctrl binding. This allows naming the GPIOs, which is already done in several device trees (e.g. mt8183-kukui-jacuzzi.dtsi, mt8183-kukui-kakadu.dtsi, mt8183-kukui-krane.dtsi), but was previously generating DT schema warnings. Signed-off-by: Julien Massot Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250801-mtk-dtb-warnings-v1-7-6ba4e432427b@collabora.com Signed-off-by: Linus Walleij commit 26178b713f2b3f5bc411ed8316d1635615896111 Author: Masami Hiramatsu (Google) Date: Wed Jul 30 16:46:52 2025 +0900 x86/insn: Add XOP prefix instructions decoder support Support decoding AMD's XOP prefix encoded instructions. These instructions are introduced for Bulldozer micro architecture, and not supported on Intel's processors. But when compiling kernel with CONFIG_X86_NATIVE_CPU on some AMD processor (e.g. -march=bdver2), these instructions can be used. Closes: https://lore.kernel.org/all/871pq06728.fsf@wylie.me.uk/ Reported-by: Alan J. Wylie Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Borislav Petkov (AMD) Tested-by: Alan J. Wylie Link: https://lore.kernel.org/175386161199.564247.597496379413236944.stgit@devnote2 commit 52ff2b840bc723f3be1f096f8017c78e0515858c Author: Ovidiu Panait Date: Sun Aug 17 20:13:50 2025 +0300 staging: axis-fifo: fix maximum TX packet length check Since commit 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation"), write() operations with packets larger than 'tx_fifo_depth - 4' words are no longer rejected with -EINVAL. Fortunately, the packets are not actually getting transmitted to hardware, otherwise they would be raising a 'Transmit Packet Overrun Error' interrupt, which requires a reset of the TX circuit to recover from. Instead, the request times out inside wait_event_interruptible_timeout() and always returns -EAGAIN, since the wake up condition can never be true for these packets. But still, they unnecessarily block other tasks from writing to the FIFO and the EAGAIN return code signals userspace to retry the write() call, even though it will always fail and time out. According to the AXI4-Stream FIFO reference manual (PG080), the maximum valid packet length is 'tx_fifo_depth - 4' words, so attempting to send larger packets is invalid and should not be happening in the first place: > The maximum packet that can be transmitted is limited by the size of > the FIFO, which is (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. Therefore, bring back the old behavior and outright reject packets larger than 'tx_fifo_depth - 4' with -EINVAL. Add a comment to explain why the check is necessary. The dev_err() message was removed to avoid cluttering the dmesg log if an invalid packet is received from userspace. Fixes: 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation") Cc: stable@vger.kernel.org Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250817171350.872105-1-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit 850047b19741490631855a475ccaa3ed29316039 Author: Thomas Weißschuh Date: Sat Jul 19 17:38:29 2025 +0200 selftests/nolibc: always compile the kernel with GCC LLVM/clang can not build the kernel for all architectures supported by nolibc. The current setup uses the same compiler to build the kernel as is used for nolibc-test. This prevents using the full qemu-system tests for LLVM builds. Instead always build the kernel with GCC. For the nolibc testsuite the kernel does not need to be built with LLVM. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250719-nolibc-llvm-system-v1-3-1730216ce171@weissschuh.net commit 1a5b40317dcbcd5e498cc8d2b3e5f48755bab322 Author: Thomas Weißschuh Date: Sat Jul 19 17:38:28 2025 +0200 selftests/nolibc: don't pass CC to toplevel Makefile The toplevel Makefile is capable of calculating CC from CROSS_COMPILE and/or ARCH. Stop passing the unnecessary variable. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250719-nolibc-llvm-system-v1-2-1730216ce171@weissschuh.net commit 32042f638cb839b4eb4a76b5dfc7c0a412327a6d Author: Thomas Weißschuh Date: Sat Jul 19 17:38:27 2025 +0200 selftests/nolibc: deduplicate invocations of toplevel Makefile Various targets of the testsuite call back into the toplevel kernel Makefile. These calls use various parameters and are quite long. Introduce a common variable to make future changes smaller and the lines shorter. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250719-nolibc-llvm-system-v1-1-1730216ce171@weissschuh.net commit 2be3fd903a6775ce21b2a138950aab09d0998427 Author: Thomas Weißschuh Date: Mon Aug 18 16:02:04 2025 +0200 selftests/nolibc: be more specific about variables affecting nolibc-test Only one of these variables is used. $CC is preferred over $CROSS_COMPILE. Make this clear in the help message. Suggested-by: Willy Tarreau Link: https://lore.kernel.org/lkml/20250817093905.GA14213@1wt.eu/ Signed-off-by: Thomas Weißschuh commit dee546e1adefd75acf0d69ddc04dc9627d745986 Author: Raphael Gallais-Pou Date: Sun Jul 13 15:27:30 2025 +0200 ARM: sti: drop B2120 board support B2120 boards are internal boards which never were commercialised. Drop them. Signed-off-by: Raphael Gallais-Pou Signed-off-by: Patrice Chotard commit 6bbe133ee8327c0a8faa0673fee839e814bb7672 Author: Alain Volmat Date: Sun Jul 13 15:27:29 2025 +0200 ARM: sti: removal of stih415/stih416 related entries ST's STiH415 and STiH416 platforms have already been removed since a while. Remove some remaining bits within the mach-sti. Signed-off-by: Alain Volmat Reviewed-by: Patrice Chotard Signed-off-by: Raphael Gallais-Pou Signed-off-by: Patrice Chotard commit cefbc3109932d7a34040b4d87746af1d36567358 Author: Raphael Gallais-Pou Date: Sun Jul 13 15:27:28 2025 +0200 dt-bindings: arm: sti: drop B2120 board support B2120 boards are internal boards which never were commercialised. Remove them from bindings. Signed-off-by: Raphael Gallais-Pou Acked-by: Krzysztof Kozlowski Signed-off-by: Patrice Chotard commit 5ae2da6bddebcb2e0331d1cea0db81dd812babe2 Author: Raphael Gallais-Pou Date: Sun Jul 13 16:24:24 2025 +0200 ARM: dts: sti: rename SATA phy-names Stick to the documentation and rename both SATA phy-names properties to what is expected. Signed-off-by: Raphael Gallais-Pou Reviewed-by: Patrice Chotard Signed-off-by: Patrice Chotard commit d87fdb1f27d7b1f3309bba00955f0aa1cd19b33e Author: Fushuai Wang Date: Mon Aug 18 11:23:44 2025 +0800 bpf: Replace get_next_cpu() with cpumask_next_wrap() The get_next_cpu() function was only used in one place to find the next possible CPU, which can be replaced by cpumask_next_wrap(). Signed-off-by: Fushuai Wang Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250818032344.23229-1-wangfushuai@baidu.com commit 12741630350c6ba250ffd480dbb0bbab7e8ac80a Author: Ilya Leoshkevich Date: Wed Aug 13 14:06:31 2025 +0200 selftests/bpf: Clobber a lot of registers in tailcall_bpf2bpf_hierarchy tests Clobbering a lot of registers and stack slots helps exposing tail call counter overwrite bugs in JITs. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250813121016.163375-5-iii@linux.ibm.com commit bc3905a71f02511607d3ccf732360580209cac4c Author: Ilya Leoshkevich Date: Wed Aug 13 14:06:30 2025 +0200 s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call graph is as follows: entry() subprog_tail() trampoline() fentry() the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG return to entry() The problem is that the rest of subprog_tail() increments the tail call counter, but the trampoline discards the incremented value. This results in an astronomically large number of tail calls. Fix by making the trampoline write the incremented tail call counter back. Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 Author: Ilya Leoshkevich Date: Wed Aug 13 14:06:29 2025 +0200 s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is as follows: entry() subprog_tail() bpf_tail_call_static(0) -> entry + tail_call_start subprog_tail() bpf_tail_call_static(0) -> entry + tail_call_start entry() copies its tail call counter to the subprog_tail()'s frame, which then increments it. However, the incremented result is discarded, leading to an astronomically large number of tail calls. Fix by writing the incremented counter back to the entry()'s frame. Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com commit eada40e057fc1842358d9daca3abe5cacb21e8a1 Author: Ilya Leoshkevich Date: Wed Aug 13 14:06:28 2025 +0200 s390/bpf: Do not write tail call counter into helper and kfunc frames Only BPF functions make use of the tail call counter; helpers and kfuncs ignore and most likely also clobber it. Writing it into these functions' frames is pointless and misleading, so do not do it. Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250813121016.163375-2-iii@linux.ibm.com commit 894af4a1cde61c3401f237184fb770f72ff12df8 Author: Peter Zijlstra Date: Sat Apr 12 13:56:01 2025 +0200 objtool: Validate kCFI calls Validate that all indirect calls adhere to kCFI rules. Notably doing nocfi indirect call to a cfi function is broken. Apparently some Rust 'core' code violates this and explodes when ran with FineIBT. All the ANNOTATE_NOCFI_SYM sites are prime targets for attackers. - runtime EFI is especially henous because it also needs to disable IBT. Basically calling unknown code without CFI protection at runtime is a massice security issue. - Kexec image handover; if you can exploit this, you get to keep it :-) Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103441.496787279@infradead.org commit 28d11e4548b75d0960429344f12d5f6cc9cee25b Author: Sean Christopherson Date: Thu May 1 11:10:39 2025 -0700 x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y Now that FRED provides C-code entry points for handling IRQs, use the FRED infrastructure for forwarding IRQs even if FRED is fully disabled, e.g. isn't supported in hardware. Avoiding the non-FRED assembly trampolines into the IDT handlers for IRQs eliminates the associated non-CFI indirect call (KVM performs a CALL by doing a lookup on the IDT using the IRQ vector). Keep NMIs on the legacy IDT path, as the FRED NMI entry code relies on FRED's architectural behavior with respect to NMI blocking, i.e. doesn't jump through the myriad hoops needed to deal with IRET "unexpectedly" unmasking NMIs. KVM's NMI path already makes a direct CALL to C-code, i.e. isn't problematic for CFI. KVM does make a short detour through assembly code to build the stack frame, but the "FRED entry from KVM" path does the same. Force FRED for 64-bit kernels if KVM_INTEL is enabled, as the benefits of eliminating the IRQ trampoline usage far outwieghts the code overhead for FRED. Suggested-by: Peter Zijlstra Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250714103441.381946911@infradead.org commit deed19b9b28724bd32e85063c60718c0a6803906 Author: Josh Poimboeuf Date: Fri Jun 6 13:04:25 2025 +0200 x86/fred: Play nice with invoking asm_fred_entry_from_kvm() on non-FRED hardware Modify asm_fred_entry_from_kvm() to allow it to be invoked by KVM even when FRED isn't fully enabled, e.g. when running with CONFIG_X86_FRED=y on non-FRED hardware. This will allow forcing KVM to always use the FRED entry points for 64-bit kernels, which in turn will eliminate a rather gross non-CFI indirect call that KVM uses to trampoline IRQs by doing IDT lookups. The point of asm_fred_entry_from_kvm() is to bridge between C (vmx:handle_external_interrupt_irqoff()) and more C (__fred_entry_from_kvm()) while changing the calling context to appear like an interrupt (pt_regs). Making the whole thing bound by C ABI. All that remains for non-FRED hardware is to restore RSP (to undo the redzone and alignment). However the trivial change would result in code like: push %rbp mov %rsp, %rbp sub $REDZONE, %rsp and $MASK, %rsp PUSH_AND_CLEAR_REGS push %rbp POP_REGS pop %rbp <-- *objtool fail* mov %rbp, %rsp pop %rbp ret And this will confuse objtool something wicked -- it gets confused by the extra pop %rbp, not realizing the push and pop preserve the value. Rather than trying to each objtool about this, recognise that since the code is bound by C ABI on both ends and interrupts are not allowed to change pt_regs (only exceptions are) it is sufficient to PUSH_REGS in order to create pt_regs, but there is no reason to POP_REGS -- provided the callee-saved registers are preserved. So avoid clearing callee-saved regs and skip POP_REGS. [Original patch by Sean; much of this version by Josh; Changelog, comments and final form by Peterz] Originally-by: Sean Christopherson Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103441.245417052@infradead.org commit 2d1435b742156f6d4adc8b9ab0f24b35d879266e Author: Sean Christopherson Date: Fri May 2 07:24:01 2025 -0700 x86/fred: Install system vector handlers even if FRED isn't fully enabled Install the system vector IRQ handlers for FRED even if FRED isn't fully enabled in hardware. This will allow KVM to use the FRED IRQ path even on non-FRED hardware, which in turn will eliminate a non-CFI indirect CALL (KVM currently invokes the IRQ handler via an IDT lookup on the vector). [sean: extract from diff, drop stub, write changelog] Signed-off-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250714103441.121251108@infradead.org commit c8ed0812646e1335c80a8f204c1b92b2f9d76119 Author: Peter Zijlstra Date: Sat Apr 12 13:55:55 2025 +0200 x86/hyperv: Use direct call to hypercall-page Instead of using an indirect call to the hypercall page, use a direct call instead. This avoids all CFI problems, including the one where the hypercall page doesn't have IBT on. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Michael Kelley Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103441.011387946@infradead.org commit 0e20f1f4c2cb77130cfe903a058a08883645dc4b Author: Peter Zijlstra Date: Sat Apr 12 13:55:49 2025 +0200 x86/hyperv: Clean up hv_do_hypercall() What used to be a simple few instructions has turned into a giant mess (for x86_64). Not only does it use static_branch wrong, it mixes it with dynamic branches for no apparent reason. Notably it uses static_branch through an out-of-line function call, which completely defeats the purpose, since instead of a simple JMP/NOP site, you get a CALL+RET+TEST+Jcc sequence in return, which is absolutely idiotic. Add to that a dynamic test of hyperv_paravisor_present, something which is set once and never changed. Replace all this idiocy with a single direct function call to the right hypercall variant. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Michael Kelley Tested-by: Michael Kelley Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.897136093@infradead.org commit a1d34a444ce8c9a6ec4376247f80f0b777c6d3fe Author: Peter Zijlstra Date: Sat Apr 26 12:55:35 2025 +0200 KVM: x86: Remove fastops No more FASTOPs, remove the remains. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.751192860@infradead.org commit 77892e1fef34db650aa3de4be1d27267ca7f1330 Author: Peter Zijlstra Date: Sat Apr 26 13:07:14 2025 +0200 KVM: x86: Convert em_salc() to C Implement the SALC (Set AL if Carry) instruction in C. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.634145269@infradead.org commit 2d82acd7d6a7eba2ed2bf84ab7440c1ad7c27958 Author: Peter Zijlstra Date: Sat Apr 26 12:47:50 2025 +0200 KVM: x86: Introduce EM_ASM_3WCL Replace the FASTOP3WCL instructions. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.513865075@infradead.org commit af4fe07aa1e07610d3208a85210b896c87e2105e Author: Peter Zijlstra Date: Sat Apr 26 12:40:12 2025 +0200 KVM: x86: Introduce EM_ASM_1SRC2 Replace the FASTOP1SRC2*() instructions. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.394654786@infradead.org commit 67e944aff63cb6b9c236d9cc2b4d870aeefd306f Author: Peter Zijlstra Date: Sat Apr 26 12:34:42 2025 +0200 KVM: x86: Introduce EM_ASM_2CL Replace the FASTOP2CL instructions. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.251039692@infradead.org commit 975e51783cfd0abc303817e8bf1ab2f630834c2a Author: Peter Zijlstra Date: Sat Apr 26 12:30:37 2025 +0200 KVM: x86: Introduce EM_ASM_2W Replace the FASTOP2W instructions. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.142923581@infradead.org commit 2df2b52c98db03c10ebe93fa270b1e2baf47f8a0 Author: Peter Zijlstra Date: Sat Apr 26 12:52:05 2025 +0200 KVM: x86: Introduce EM_ASM_2R Replace the FASTOP2R instruction. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103440.024933524@infradead.org commit b26deb0cad4af9f522496fd25dc3ebca759e65a4 Author: Peter Zijlstra Date: Sat Apr 26 12:25:21 2025 +0200 KVM: x86: Introduce EM_ASM_2 Replace the FASTOP2 instructions. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103439.903697475@infradead.org commit 6204aea36b74cd2001a142e92e492e301597eafb Author: Peter Zijlstra Date: Sat Apr 26 11:51:49 2025 +0200 KVM: x86: Introduce EM_ASM_1 Replace fastops with C based stubs. There are a bunch of problems with the current fastop infrastructure, most all related to their special calling convention, which bypasses the normal C-ABI. There are two immediate problems with this at present: - it relies on RET preserving EFLAGS; whereas C-ABI does not. - it circumvents compiler based control-flow-integrity checking because its all asm magic. The first is a problem for some mitigations where the x86_indirect_return_thunk needs to include non-trivial work that clobbers EFLAGS (eg. the Skylake call depth tracking thing). The second is a problem because it presents a 'naked' indirect call on kCFI builds, making it a prime target for control flow hijacking. Additionally, given that a large chunk of virtual machine performance relies on absolutely avoiding vmexit these days, this emulation stuff just isn't that critical for performance anymore. As such, replace the fastop calls with normal C functions using the 'execute' member. As noted by Paolo: this code was performance critical for pre-Westmere (2010) and only when running big real mode code. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103439.773781574@infradead.org commit 0cb6f1e436accba7882bb3115408d1474c1e14af Author: Peter Zijlstra Date: Fri Dec 1 18:53:40 2023 +0100 KVM: x86: Implement test_cc() in C Current test_cc() uses the fastop infrastructure to test flags using SETcc instructions. However, int3_emulate_jcc() already fully implements the flags->CC mapping, use that. Removes a pile of gnarly asm. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Sean Christopherson Link: https://lkml.kernel.org/r/20250714103439.637049932@infradead.org commit 90179609efa421b1ccc7d8eafbc078bafb25777c Author: Qianfeng Rong Date: Fri Aug 15 16:21:17 2025 +0800 spi: spl022: use min_t() to improve code Use min_t() to reduce the code in setup_dma_scatter() and improve its readability. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250815082118.586422-4-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 1bdc716023a78c2c41fdcb3fc37f09da1be4b7df Author: Qianfeng Rong Date: Fri Aug 15 16:21:16 2025 +0800 spi: npcm-fiu: use min_t() to improve code Use min_t() to reduce the code in npcm_fiu_read() and improve its readability. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250815082118.586422-3-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit a750050349ea138e3e86c66a8a41de736619b9de Author: Qianfeng Rong Date: Fri Aug 15 16:21:15 2025 +0800 spi: spi-fsl-lpspi: use min_t() to improve code Use min_t() to reduce the code in fsl_lpspi_setup_transfer() and improve its readability. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250815082118.586422-2-rongqianfeng@vivo.com Reviewed-by: Frank Li Signed-off-by: Mark Brown commit 0056b410355713556d8a10306f82e55b28d33ba8 Author: David Lechner Date: Fri Aug 15 11:44:01 2025 -0500 spi: offload trigger: adi-util-sigma-delta: clean up imports Clean up imports using include-what-you-use principles. Suggested-by: Andy Shevchenko Signed-off-by: David Lechner Link: https://patch.msgid.link/20250815-spi-offload-trigger-followup-v1-2-8ec5413a8383@baylibre.com Signed-off-by: Mark Brown commit 07826c02eda9da406524bd50cd3fd321be8c9447 Author: David Lechner Date: Fri Aug 15 11:44:00 2025 -0500 MAINTAINERS: merge TRIGGER SOURCE sections Merge all of Documentation/devicetree/bindings/trigger-source/* as a single entry. In the previous merge cycle, there was a merge conflict between the IIO and SPI trees and we ended up with the current state, but the intention was to have a single entry for all trigger-source bindings. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250815-spi-offload-trigger-followup-v1-1-8ec5413a8383@baylibre.com Signed-off-by: Mark Brown commit 550bc517e59347b3b1af7d290eac4fb1411a3d4e Author: Qianfeng Rong Date: Sun Aug 17 22:23:27 2025 +0800 regulator: bd718x7: Use kcalloc() instead of kzalloc() Replace calls of 'devm_kzalloc(dev, count * sizeof([type]), flags)' with 'devm_kcalloc(dev, count, sizeof([type]), flags)' in setup_feedback_loop() for safer memory allocation with built-in overflow protection. Signed-off-by: Qianfeng Rong Reviewed-by: Matti Vaittinen Link: https://patch.msgid.link/20250817142327.174531-1-rongqianfeng@vivo.com Signed-off-by: Mark Brown commit 2a55135201d5e24b80b7624880ff42eafd8e320c Author: Cezary Rojewski Date: Mon Aug 18 12:41:26 2025 +0200 ASoC: Intel: avs: Streamline register-component function names Word 'component' is commonly used in ASoC when referring to any component, regardless if it is a platform-type or codec-type component. Reword all avs_xxx_platform_register() to match the scheme present in ASoC's core. In case of avs_soc_component_register(), the name is simplified. Summary: - avs_xxx_platform_register() -> avs_register_xxx_component() - avs_soc_component_register() -> avs_register_component() Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250818104126.526442-5-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 4dee5c1cc439b0d5ef87f741518268ad6a95b23d Author: Cezary Rojewski Date: Mon Aug 18 12:41:25 2025 +0200 ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250818104126.526442-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit df36e5c197f31a105b8c8a70f13ebdf3a4c019d5 Author: Cezary Rojewski Date: Mon Aug 18 12:41:24 2025 +0200 ASoC: Intel: avs: Drop pcm.h dependency for probes The 'probe' machine board is not a typical one, it serves debug purpose only and does not expect any kind of topology. The topology descriptor pointer (acomp->tplg) is the only reason an avs-driver component would utilize the pcm.c helpers and be described by a 'struct avs_soc_component' instance rather than 'struct snd_soc_component' one. Cut the line linking probes.c with pcm.h to avoid confusing readers. And with that link gone, constify the component-driver again. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250818104126.526442-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 62dc545be11d956419a21724de3810930db20d43 Author: Cezary Rojewski Date: Mon Aug 18 12:41:23 2025 +0200 ASoC: Intel: avs: Separate debug symbols Make it clear what is part of debug functionality and what is not by separating debug symbols away from the common header file. Apart from changing avs_probe_platform_register() to return -ENOTSUPP when CONFIG_DEBUG_FS is disabled, status quo is achieved. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250818104126.526442-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit daf855f76a1210ceed9541f71ac5dd9be02018a6 Author: Shimrra Shai Date: Thu Aug 14 23:20:23 2025 -0500 ASoC: es8323: enable DAPM power widgets for playback DAC This part might not be needed for resubmission as it was already accepted on the previous submission of this patch, but since the whole series was not accepted due to that I had retained and expanded the initialization in the probe routine I'm not sure if I should submit it again. Signed-off-by: Shimrra Shai Link: https://patch.msgid.link/20250815042023.115485-4-shimrrashai@gmail.com Signed-off-by: Mark Brown commit 7e39ca4056d11fef6b90aedd9eeeb3e070d3ce9f Author: Shimrra Shai Date: Thu Aug 14 23:20:22 2025 -0500 ASoC: es8323: add proper left/right mixer controls via DAPM Add proper DAC and mixer controls to DAPM; no initialization in es8323_probe. Signed-off-by: Shimrra Shai Link: https://patch.msgid.link/20250815042023.115485-3-shimrrashai@gmail.com Signed-off-by: Mark Brown commit 33bc29123d26f7caa7d11f139e153e39104afc6c Author: Shimrra Shai Date: Thu Aug 14 23:20:21 2025 -0500 ASoC: es8323: remove DAC enablement write from es8323_probe Remove initialization of the DAC and mixer enablement bits from the es8323_probe routine. This really should be handled by the DAPM subsystem. Signed-off-by: Shimrra Shai Link: https://patch.msgid.link/20250815042023.115485-2-shimrrashai@gmail.com Signed-off-by: Mark Brown commit 5c5f2221821a4371b5f33347538c3b87c01c8779 Author: Raviteja Laggyshetty Date: Thu Aug 14 14:54:21 2025 +0000 interconnect: qcom: add glymur interconnect provider driver Add driver for the Qualcomm interconnect buses found in glymur based platforms. The topology consists of several NoCs that are controlled by a remote processor that collects the aggregated bandwidth for each master-slave pairs. Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Signed-off-by: Raviteja Laggyshetty Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250814-glymur-icc-v2-3-596cca6b6015@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 2c1afbf36c0296314a1cee6cea00b5b73fabfc4e Author: Raviteja Laggyshetty Date: Thu Aug 14 14:54:20 2025 +0000 interconnect: qcom: icc-rpmh: increase MAX_PORTS to support four QoS ports Update the MAX_PORTS value to 4 to program four QoS ports available on the Glymur SoC's interconnect master node. Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Signed-off-by: Raviteja Laggyshetty Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250814-glymur-icc-v2-2-596cca6b6015@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 4d2604833e8ea79e77de98aa97a94b94a9733962 Author: Carlos Llamas Date: Sun Aug 17 13:50:34 2025 +0000 binder: remove MODULE_LICENSE() The MODULE_LICENSE() macro is intended for drivers that can be built as loadable modules. The binder driver is always built-in, using this macro here is unnecessary and potentially confusing. Remove it. Cc: Salvatore Bonaccorso Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20250817135034.3692902-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit c33aca6c44c081b6aaff8f203d408688859a81fb Author: Borislav Petkov (AMD) Date: Sun Jun 22 18:19:43 2025 +0200 MAINTAINERS: EDAC: Drop inactive reviewers I know y'all busy with other stuff and don't have time for EDAC review. Signed-off-by: Borislav Petkov (AMD) Acked-by: James Morse Link: https://lore.kernel.org/20250622161943.4700-1-bp@kernel.org commit 0caebd1658bbb3796bec4e3449876742d29701ab Author: Alexander Stein Date: Fri Jul 25 08:01:51 2025 +0200 dt-bindings: mmc: fsl,esdhc: Add explicit reference to mmc-controller-common Even though it is referenced by mmc/mmc-controller.yaml it still raises the warning: esdhc@1560000 (fsl,ls1021a-esdhc): Unevaluated properties are not allowed ('bus-width' was unexpected) Adding an explicit reference fixes this. Signed-off-by: Alexander Stein Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250725060152.262094-1-alexander.stein@ew.tq-group.com Signed-off-by: Ulf Hansson commit 4591511daba4e7e9a8452b116c3f7ea5718c60ce Author: Colin Ian King Date: Thu Jul 31 10:41:16 2025 +0100 mmc: davinci: Remove space before newline There is a extraneous space before a newline in a dev_err message. Remove the space. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250731094116.2163061-1-colin.i.king@gmail.com Signed-off-by: Ulf Hansson commit d76ae3c79ca9044191f2e2a8c85326869a72fa39 Author: Colin Ian King Date: Thu Jul 24 12:28:17 2025 +0100 mmc: Kconfig: Fix spelling mistake "referrered" -> "referred" There are two spelling mistakes in the config. Fix them. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724112817.142784-1-colin.i.king@gmail.com Signed-off-by: Ulf Hansson commit 5f755ba95ae10fd4fa28d64345056ffc18d12c5a Author: Erick Shepherd Date: Thu Jul 24 13:53:54 2025 -0500 mmc: sdhci: Disable SD card clock before changing parameters Per the SD Host Controller Simplified Specification v4.20 §3.2.3, change the SD card clock parameters only after first disabling the external card clock. Doing this fixes a spurious clock pulse on Baytrail and Apollo Lake SD controllers which otherwise breaks voltage switching with a specific Swissbit SD card. This change is limited to Intel host controllers to avoid an issue reported on ARM64 devices. Signed-off-by: Kyle Roeschley Signed-off-by: Brad Mouring Signed-off-by: Erick Shepherd Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250724185354.815888-1-erick.shepherd@ni.com Signed-off-by: Ulf Hansson commit 7d5c3cac1f395324673e9ec32b65e4f6ff23fcb9 Author: Fenglin Wu Date: Tue Jul 29 12:51:23 2025 +0800 leds: flash: leds-qcom-flash: Add a separate register map for PMI8998 The 3-channel flash module in PMI8998 has several registers different than the others, such as: torch_clamp. Add different register fields for it. Signed-off-by: Fenglin Wu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-2-9b83816437a3@oss.qualcomm.com Signed-off-by: Lee Jones commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 Author: Fenglin Wu Date: Tue Jul 29 12:51:22 2025 +0800 leds: flash: leds-qcom-flash: Update torch current clamp setting There is a register to clamp the flash current per LED channel when safety timer is disabled. It needs to be updated according to the maximum torch LED current setting to ensure the torch current won't be clamped unexpectedly. Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") Signed-off-by: Fenglin Wu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com Signed-off-by: Lee Jones commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb Author: Len Bao Date: Sun Jul 27 07:56:45 2025 +0000 leds: max77705: Function return instead of variable assignment Coverity noticed that assigning value -EINVAL to 'ret' in the if statement is useless because 'ret' is overwritten a few lines later. However, after inspect the code, this warning reveals that we need to return -EINVAL instead of the variable assignment. So, fix it. Coverity-id: 1646104 Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support") Signed-off-by: Len Bao Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us Signed-off-by: Lee Jones commit f4fc2d87aa167e3da5333c3db6cf702db1f98c05 Author: Colin Ian King Date: Thu Jul 24 12:20:30 2025 +0100 leds: Kconfig: Fix spelling mistake "limitiation" -> "limitation" There is a spelling mistake in the LEDS_BD2606MVV config. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724112030.142121-1-colin.i.king@gmail.com Signed-off-by: Lee Jones commit 758e743362cdc0cc45d8717431b2eabf29084ef1 Author: Pawel Zalewski Date: Wed Jul 23 11:02:08 2025 +0100 leds: leds-is31fl32xx: Add support for is31fl3236a Also add an additional and optional control register for setting the output PWM frequency to 22kHz. The default is 3kHz and this option puts the operational frequency outside of the audible range. Signed-off-by: Pawel Zalewski Link: https://lore.kernel.org/r/20250723-leds-is31fl3236a-v6-3-210328058625@thegoodpenguin.co.uk Signed-off-by: Lee Jones commit 1a713bd3b0c60d826bdde633919bedc1fd38df4d Author: Inbaraj E Date: Thu Aug 14 19:39:33 2025 +0530 clk: samsung: fsd: Add clk id for PCLK and PLL in CAM_CSI block Add clock id for PCLK and PLL. These clock id will be used for operation of CSI driver. PCLK is AXI2APB clock used for register access. PLL clock is main clock source for CAM_CSI block. Signed-off-by: Inbaraj E Link: https://lore.kernel.org/r/20250814140943.22531-3-inbaraj.e@samsung.com Signed-off-by: Krzysztof Kozlowski commit 5576d8098052952a6c95af86ad3dcb341554ac75 Author: Inbaraj E Date: Thu Aug 14 19:39:32 2025 +0530 dt-bindings: clock: Add CAM_CSI clock macro for FSD CAM_CSI block has ACLK, PCLK and PLL clocks. PCLK id is already assigned. To use PCLK and PLL clock in driver add id macro for CAM_CSI_PLL and CAM_CSI_PCLK. Signed-off-by: Inbaraj E Link: https://lore.kernel.org/r/20250814140943.22531-2-inbaraj.e@samsung.com Signed-off-by: Krzysztof Kozlowski commit 9471de64c9cc15a74e11eaa0c6156fe866ec11c3 Author: Marek Vasut Date: Fri Aug 15 01:34:57 2025 +0200 arm64: dts: renesas: sparrow-hawk: Update thermal trip points Since the Sparrow Hawk has a smaller PCB than the White Hawk, it tends to generate more heat. To prevent potential damage to the board, adjust the temperature trip points. Add four "passive" trip points which increasingly throttle the CPU to prevent overheating. The first trip point at 68°C disables the 1.8 GHz and 1.7 GHz modes and limits the CPU to 1.5 GHz frequency. The second trip point at 72°C disables the 1.5 GHz mode and limits the CPU to 1.0 GHz frequency. The third trip point at 76°C uses thermal-idle to start inserting idle cycles into the CPU instruction stream to cool the CPU cores down. The fourth and last trip point at 80°C disables the 1.0 GHz mode and limits the CPU to 500 MHz frequency. In case the SoC heats up further, in case either of the thermal sensors readings passes the 100°C, a thermal shutdown is triggered to prevent any damage to the hardware. Reviewed-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Signed-off-by: Marek Vasut Link: https://lore.kernel.org/20250814233529.191874-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 57875e1526987524efe5001ad6d198a4b145f54f Author: Geert Uytterhoeven Date: Wed Aug 13 15:37:04 2025 +0200 arm64: dts: renesas: rzg2: Increase CANFD clock rates Currently, all RZ/G2 .dtsi files configure the CANFD core clocks to 40 MHz, which limits CAN-FD data transfer rates to 4 Mbps. However, all RZ/G2 SoCs support CANFD clock rates up to 80 MHz. Now the R-Car CAN-FD driver has gained support for Transceiver Delay Compensation, increase all appropriate CANFD clock rates to the documented maximum, to support data rates up to 8 Mbps. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/0dd1c17135707587e9e9d6d68b2eaa1921fbcb7a.1755090456.git.geert+renesas@glider.be commit c222f860910f82fad2d63d8608f922e9704866c0 Author: Geert Uytterhoeven Date: Wed Aug 13 15:37:03 2025 +0200 arm64: dts: renesas: rcar-gen3: Increase CANFD clock rates Currently, all R-Car Gen3 .dtsi files configure the CANFD core clocks to 40 MHz, which limits CAN-FD data transfer rates to 4 Mbps. However, all R-Car Gen3 SoCs except for R-Car D3 support CANFD clock rates up to 80 MHz. Now the R-Car CAN-FD driver has gained support for Transceiver Delay Compensation, increase all appropriate CANFD clock rates to the documented maximum, to support data rates up to 8 Mbps. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/d1ca3cd184193084b6de4332d47d0aee1923f6a6.1755090456.git.geert+renesas@glider.be commit 287066b295051729fb08c3cff12ae17c6fe66133 Author: Geert Uytterhoeven Date: Fri Jun 27 15:49:48 2025 +0200 ARM: dts: renesas: porter: Fix CAN pin group According to the schematics, the CAN transceiver is connected to pins GP7_3 and GP7_4, which correspond to CAN0 data group B. Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be commit 14fcd7361ed1c74dad4062313f2863b643409f6f Author: Satyanarayana K V P Date: Tue Aug 12 22:06:13 2025 +0530 drm/xe/pm: Disable RPM for SR-IOV VFs VFs without native PCIe Power Management (PM) capabilities inherit their PF's power state as per PCIe specifications(§5.10.1 PCIe Base Spec 7.0). Enabling Runtime Power Management (RPM) for these VFs trigger unnecessary driver suspend/resume operations that ultimately perform no PCI-level power transition. Since VFs without PM capabilities cannot independently enter low-power states, the existing RPM workflow becomes redundant: 1. Driver executes full suspend/resume sequence 2. PCI PM transition step becomes no-op 3. VF power state remains tied to PF's status Disabling RPM for VFs eliminates this redundant processing while maintaining proper power management through PF dependency. This optimization ensures VFs follow their PF's power state without superfluous runtime handling. Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Michał Winiarski Cc: Anshuman Gupta Cc: Rodrigo Vivi Cc: Maarten Lankhorst Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250812163613.9954-1-satyanarayana.k.v.p@intel.com Signed-off-by: Rodrigo Vivi commit cc8b221172eff821c54d1012bc0c3414638b86cf Author: Raag Jadav Date: Thu Aug 14 14:48:45 2025 +0530 drm/xe/i2c: Introduce xe_i2c_present() In preparation of wider usecases which require checking for I2C controller presence, introduce xe_i2c_present() helper. v2: Doc fix (Riana) Suggested-by: Riana Tauro Signed-off-by: Raag Jadav Reviewed-by: Heikki Krogerus Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250814091845.1356135-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi commit 26d48cc203e1c4d79b0bb6c7e2cdcaea5f548971 Author: Chandra Mohan Sundar Date: Sat Aug 16 19:07:55 2025 +0530 iio: adc: ad7768-1: Remove logically dead code The clamp macro returns a value within the specified range. In ad7768_set_freq(), the value returned from clamp() is checked against zero, which is not possible since the value would always be between 50 and 1024000. Removed the 'if' check. This issue was reported by static coverity analyser as logically dead code. Signed-off-by: Chandra Mohan Sundar Link: https://patch.msgid.link/20250816133757.98624-1-chandramohan.explore@gmail.com Signed-off-by: Jonathan Cameron commit 35e3d0cd8e89d811b915593cbd8d9891d21d4a1a Author: Qianfeng Rong Date: Sat Aug 16 20:05:09 2025 +0800 iio: imu: inv_icm42600: use min() to improve code Use min() to reduce code in inv_icm42600_buffer_update_fifo_period() and inv_icm42600_buffer_update_watermark(), and improve readability. Signed-off-by: Qianfeng Rong Reviewed-by: David Lechner Link: https://patch.msgid.link/20250816120510.355835-1-rongqianfeng@vivo.com Signed-off-by: Jonathan Cameron commit 292cb391479d50f4379a0abab34324de92c82a92 Author: Dmitry Torokhov Date: Wed Aug 13 23:03:52 2025 -0700 software node: Constify node_group in registration functions The software_node_register_node_group() and software_node_unregister_node_group() functions take in essence an array of pointers to software_node structs. Since the functions do not modify the array declare the argument as constant, so that static arrays can be declared as const and annotated as __initconst. Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/2zny5grbgtwbplynxffxg6dkgjgqf45aigwmgxio5stesdr3wi@gf2zamk5amic Signed-off-by: Greg Kroah-Hartman commit 2c6a28f3ef729ed2d5b174b4e0f33172fb286bab Author: Nathan Chancellor Date: Thu Aug 14 18:31:42 2025 -0700 x86/Kconfig: Clean up LLVM version checks in IBT configurations The minimum supported version of LLVM for building the x86 kernel was bumped to 15.0.0 in 7861640aac52 ("x86/build: Raise the minimum LLVM version to 15.0.0"), so the checks for Clang 14.0.0 and ld.lld 14.0.0 or newer will always been true. Clean them up. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-6-ff7f19457523@kernel.org commit 7cd9f5d6c5a3f31d2b282d31ddc4d78ff83a5c08 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:56 2025 +0200 s390/char/con3270: use tty_port_tty guard() Having the new tty_port_tty guard, use it in tty3270_resize(). This makes the code easier to read. The winsize is now defined in the scope and initialized immediately, so that it's obvious. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250814072456.182853-17-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit e730c373b6ff16a177e132859bf6ea4dbb15105f Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:55 2025 +0200 tty/vt: use guard()s Having all the new guards, use them in the vt code. This improves readability, makes error handling easier, and marks locked portions of code explicit. A local free_page_ptr __free guard is introduced for __get_free_page/free_page (with proper casts). This could be made public in include/. But I am not sure if there are more possible users, so keeping completely private here. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-16-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2fe16088c3c77cd96e64363927ddc98f66de8e8b Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:54 2025 +0200 tty/vt: use guard()s in con_font_set/get() and con_{set,get}_unimap() Having all the new guards, use them in the 8250_rsa code. This improves readability, makes error handling easier, and marks locked portions of code explicit. The new __free()-annotated declarations are moved to the allocation points as is preferred: https://lore.kernel.org/all/CAHk-=wjvh_LUpa=864joG2JJXs3+viO-kLzLidR2JLyMr4MNwA@mail.gmail.com/ Except font_data in con_font_get(). The scope in there would not match the expected lifetime. But the declaration is moved closer. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-15-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 54faf0473b15b762404d33d38cf613388ef94142 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:53 2025 +0200 serial: 8250_rsa: use guard()s Having all the new guards, use them in the 8250_rsa code. This improves readability, makes error handling easier, and marks locked portions of code explicit. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-14-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7345b07f3c03778bb480736062cdba09d902fd99 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:52 2025 +0200 serial: 8250_omap: use guard()s Having all the new guards, use them in the 8250_omap code. This improves readability, makes error handling easier, and marks locked portions of code explicit. For this to work, UART_CAP_RPM has to be set to up->capabilities a bit earlier. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-13-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 302c8145e68f4bef1770472fa5114e923472db7b Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:51 2025 +0200 serial: 8250_omap: extract omap_8250_set_termios_atomic() To use guard()s easily in omap_8250_set_termios(), split it into atomic and non-atomic part. The former can be easily guarded -- without a need of indenting or moving code. omap_8250_set_termios() would likely profit from a cleanup similar to one in serial8250_do_set_termios() in commit cdc4a3e0b235 ("serial: 8250: extract serial8250_set_fcr()") and earlier. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-12-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9a2225f2a7214cc04a03a09768b19215a3fe4c16 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:50 2025 +0200 serial: 8250_core: use guard() in serial_unlink_irq_chain() Having all the new guards, use them in the 8250 code. This improves readability, makes error handling easier, and marks locked portions of code explicit. serial_unlink_irq_chain() is done separately here because with the guard() used, those BUG_ON()s can be switched WARN_ON()s as we can actually handle the conditions and return (despite something went really wrong). Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-11-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit b339809edda15939e7d46b429c420c2bfe4ad946 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:49 2025 +0200 serial: 8250: use guard()s Having all the new guards, use them in the 8250 code. This improves readability, makes error handling easier, and marks locked portions of code explicit. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-10-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 56609c0500514d35c7e35adca3bfe6f0061785bf Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:48 2025 +0200 serial: serial_core: use guard()s Having all the new guards, use them in the serial_core code. This improves readability, makes error handling easier, and marks locked portions of code explicit. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 793b450112964f6d460a6ef1beff077d2e617ebd Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:47 2025 +0200 mxser: use guard()s Having all the new guards, use them in the mxser code. This improves readability, makes error handling easier, and marks locked portions of code explicit. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-8-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 81600e92a0ececef093ab85f4b56be7468412e76 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:46 2025 +0200 mxser: use tty_port_tty guard() in mxser_port_isr() Use scoped_guard() and reorder the function. This is done separately from the other changes, as it is slighly more intrusive: scoped_guard() handles the have-tty case and returns. The non-tty case is done at the end of the function. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 88d65e22c8bf7a4b6d61098d67727d14f1c5930f Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:45 2025 +0200 tty: tty_port: use guard()s Having all the new guards, use them in the tty_port code. This improves readability, makes error handling easier, and marks locked portions of code explicit. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9f8da7b2f90cb5fb4c585d5e8aa89dfd724bd377 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:44 2025 +0200 serial: 8250: introduce RPM guard()s Having this, guards like these work: guard(serial8250_rpm)(up); or scoped_guard(serial8250_rpm, up) { ... } See e.g. "serial: 8250: use guard()s" later in this series. And make them available to anyone (EXPORT + put in 8250.h) as drivers open code this anyway. The _tx ones are not defined as they would have no user. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0fd60b689b0dacce659253ec15cb3d3bf660e30b Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:43 2025 +0200 serial: introduce uart_port_lock() guard()s Having this, guards like these work: guard(uart_port_lock_irq)(&up->port); or scoped_guard(uart_port_lock_irqsave, port) { ... } See e.g. "serial: 8250: use guard()s" later in this series. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit e8398b8aed50382c21fcec77e80a5314e7c45c25 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:42 2025 +0200 tty: introduce tty_port_tty guard() Having this, guards like these work: scoped_guard(tty_port_tty, port) tty_wakeup(scoped_tty()); See e.g. "tty_port: use scoped_guard()" later in this series. The definitions depend on CONFIG_TTY. It's due to tty_kref_put(). On !CONFIG_TTY, it is an inline and its declaration would conflict. The guards are not needed in that case, of course. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4847d1187402a5027d9a04393f12d52a5a1d7f98 Author: Jiri Slaby (SUSE) Date: Thu Aug 14 09:24:41 2025 +0200 console: introduce console_lock guard()s Having this, guards like these work: guard(console_lock)(); or scoped_guard(console_lock) { ... } See e.g. "vc_screen: use guard()s" later in this series. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250814072456.182853-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 337927d9895a800a63ffe852616ab05f5d304971 Author: Nathan Chancellor Date: Thu Aug 14 18:31:41 2025 -0700 x86/build: Remove cc-option from -mskip-rax-setup This has been supported in GCC since 5.1 and clang since 14.0. Now that x86 requires LLVM 15 or newer since 7861640aac52 ("x86/build: Raise the minimum LLVM version to 15.0.0"), this flag can be unconditionally added, saving a compiler invocation. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=fbe575b652f5bdcc459f447a0e6f0e059996d4ef Link: https://github.com/llvm/llvm-project/commit/a9fba2be35db674971382e38b99a31403444d9bf Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-5-ff7f19457523@kernel.org commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 Author: raub camaioni Date: Fri Aug 15 09:07:21 2025 -0400 usb: gadget: f_ncm: Fix MAC assignment NCM ethernet This fix is already present in f_ecm.c and was never propagated to f_ncm.c When creating multiple NCM ethernet devices on a composite usb gadget device each MAC address on the HOST side will be identical. Having the same MAC on different network interfaces is bad. This fix updates the MAC address inside the ncm_strings_defs global during the ncm_bind call. This ensures each device has a unique MAC. In f_ecm.c ecm_string_defs is updated in the same way. The defunct MAC assignment in ncm_alloc has been removed. Signed-off-by: raub camaioni Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com Signed-off-by: Greg Kroah-Hartman commit 23cd838a178a81183da9db6cb3390bb540b000a5 Author: Sakari Ailus Date: Fri Aug 15 14:31:21 2025 +0300 USB: Check no positive return values from pm_runtime_resume_and_get() pm_runtime_resume_and_get() always returns a negative error code or zero; there's no need to check for positive values such as returned by pm_runtime_get_sync(). Simply drop the check. Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250815113121.925641-1-sakari.ailus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c851b71fd6cdbf3000bf0a2354592a0f09db3ba3 Author: Venkat Jayaraman Date: Thu Aug 14 09:30:28 2025 -0700 usb: typec: ucsi: Add support for READ_POWER_LEVEL command Add support for UCSI READ_POWER_LEVEL command as per UCSI specification v2.1 and above to debugfs. Following power related fields will be exposed as files in debugfs:- peak_current (Peak current), avg_current (Average current) and vbus_voltage (VBUS voltage) These files will be updated either when a READ_POWER_LEVEL command is sent from OS or when a device is connected. Reviewed-by: Heikki Krogerus Signed-off-by: Venkat Jayaraman Link: https://lore.kernel.org/r/20250814163028.18058-1-venkat.jayaraman@intel.com Signed-off-by: Greg Kroah-Hartman commit 1201f6fb5bfdbd10985ac3c8f49ef8f4f88b5c94 Author: Thomas Weißschuh Date: Thu Jul 31 10:00:31 2025 +0200 tools/nolibc: fix error return value of clock_nanosleep() clock_nanosleep() returns a positive error value. Unlike other libc functions it *does not* return -1 nor set errno. Fix the return value and also adapt nanosleep(). Fixes: 7c02bc4088af ("tools/nolibc: add support for clock_nanosleep() and nanosleep()") Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250731-nolibc-clock_nanosleep-ret-v1-1-9e4af7855e61@linutronix.de Signed-off-by: Thomas Weißschuh commit 0a42d732c136d3466cd19fafa7317d3004430318 Author: Nathan Chancellor Date: Thu Aug 14 18:31:40 2025 -0700 x86/build: Remove cc-option from -mno-fp-ret-in-387 This has been supported in GCC for forever and clang gained support for it as an alias of '-mno-x87' in LLVM 14. Now that x86 requires LLVM 15 or newer since 7861640aac52 ("x86/build: Raise the minimum LLVM version to 15.0.0"), this flag can be unconditionally added, saving a compiler invocation. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://github.com/llvm/llvm-project/commit/a9fba2be35db674971382e38b99a31403444d9bf Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-4-ff7f19457523@kernel.org commit 487fe3a936b0b84ef09fa324b4c01d059886f951 Author: Nathan Chancellor Date: Thu Aug 14 18:31:39 2025 -0700 x86/build: Clean up stack alignment flags in CC_FLAGS_FPU The minimum supported version of GCC to build the x86 kernel was bumped to GCC 8.1 in a3e8fe814ad1 ("x86/build: Raise the minimum GCC version to 8.1"). Prior to GCC 7.1, '-mpreferred-stack-boundary=3' was not allowed with '-msse', so areas of the kernel that needed floating point had a different alignment. Now that GCC > 7.1 is mandatory, there is no need to have a different value of '-mpreferred-stack-boundary' from the rest of the kernel, so remove this handling from CC_FLAGS_FPU. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=34fac449e121be97dd073c5428cc855367b2872c Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-3-ff7f19457523@kernel.org commit 1ab10737fcc9cc7aca6f3d49911c0fd953dc5aed Author: Jonathan Cameron Date: Sat Aug 2 17:44:36 2025 +0100 iio: light: Simple conversions to iio_push_to_buffers_with_ts() This new function allows for runtime checks on the provided source buffer being of sufficient size to accommodate the enabled channel data layout and the naturally aligned s64 timestamp (which is non obvious and a frequent source of bugs in the past). This patch includes the remaining simple cases for light sensor drivers. Cc: Mudit Sharma Cc: Jiri Kosina Cc: Srinivas Pandruvada Cc: Javier Carrasco Cc: Matti Vaittinen Reviewed-by: Matti Vaittinen Acked-by: Srinivas Pandruvada Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-17-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 2bbaf41ac9f70092bbd48d779a176d2ee6a0131f Author: Jonathan Cameron Date: Sat Aug 2 17:44:35 2025 +0100 iio: light: vl6180: Use iio_push_to_buffers_with_ts() to allow source size runtime check Use iio_push_to_buffers_with_ts() to allow source size runtime check. Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Cc: Abhash Jha Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-16-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 19487b50ac7f26c0287d65bb697a4a3aca616d9b Author: Jonathan Cameron Date: Sat Aug 2 17:44:34 2025 +0100 iio: light: vcnl4000: Use a structure to make buffer arrangement explicit. Removes the need for comments to describe the buffer passed to iio_push_to_buffers_with_timestamp(). Reviewed-by: Mårten Lindahl Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-15-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 66c556aa8358cd71979da9738a810e6074918daa Author: Jonathan Cameron Date: Sat Aug 2 17:44:33 2025 +0100 iio: light: tcs3472: Use iio_push_to_buffers_with_ts() to allow source size runtime check Use iio_push_to_buffers_with_ts() to allow source size runtime check. Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-14-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 7cacdd9380e4f8e3dd8cbb410f79061fb078ccdb Author: Jonathan Cameron Date: Sat Aug 2 17:44:32 2025 +0100 iio: light: tcs3414: Use iio_push_to_buffers_with_ts() to allow source size runtime check Use iio_push_to_buffers_with_ts() to allow source size runtime check. Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-13-jic23@kernel.org Signed-off-by: Jonathan Cameron commit cb8453db633071ae2b8fefd4be37d74e925d16f5 Author: Jonathan Cameron Date: Sat Aug 2 17:44:31 2025 +0100 iio: light: st_uvis25: Use iio_push_to_buffers_with_ts() to allow source size runtime check Use iio_push_to_buffers_with_ts() to allow source size runtime check. Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-12-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 596081d33bd872e5148439f2da0172fcc56d956f Author: Jonathan Cameron Date: Sat Aug 2 17:44:30 2025 +0100 iio: light: max44000: Use iio_push_to_buffers_with_ts() to allow source size runtime check Use iio_push_to_buffers_with_ts() to allow source size runtime check. Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-11-jic23@kernel.org Signed-off-by: Jonathan Cameron commit f0ffec3b4fa7e430f92302ee233c79aeb021fe14 Author: Jonathan Cameron Date: Sat Aug 2 17:44:29 2025 +0100 iio: light: isl29125: Use iio_push_to_buffers_with_ts() to allow source size runtime check Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-10-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 656c45811d33b07f0bfcd8bd803976c73a6951cc Author: Jonathan Cameron Date: Sat Aug 2 17:44:28 2025 +0100 iio: light: adjd_s311: Use iio_push_to_buffers_with_ts() to allow source size runtime check Also move the structure used as the source to the stack as it is only 16 bytes and not the target of an DMA or similar. Reviewed-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-9-jic23@kernel.org Signed-off-by: Jonathan Cameron commit ea85f5e2391dd551cea30863d4806d3264a8ec38 Author: Jonathan Cameron Date: Sat Aug 2 17:44:27 2025 +0100 iio: light: acpi-als: Use iio_push_to_buffers_with_ts() to allow runtime source size check This function allows for runtime detection of undersized storage which can be non obvious due to the injection of a timestamp within the helper. Cc: Gwendal Grignou Link: https://patch.msgid.link/20250802164436.515988-8-jic23@kernel.org Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko commit 783efeb58fefb13911a3f47d6e38a32780359f10 Author: Jonathan Cameron Date: Sat Aug 2 17:44:26 2025 +0100 iio: light: acpi-als: Use a structure for layout of data to push to buffer. Using a structure makes the padding and alignment rules explicit, removing the need for a comment. Also move the storage to the stack as it is only 16 bytes. Cc: Gwendal Grignou Link: https://patch.msgid.link/20250802164436.515988-7-jic23@kernel.org Signed-off-by: Jonathan Cameron Reviewed-by: Andy Shevchenko commit 8ffc13805971d81e9c605abec8f223d704f0a61a Author: Nuno Sá Date: Mon Aug 11 17:13:33 2025 +0100 iio: dac: ad5791: drop unused member of struct ad5791_state The regulator pointers reg_vdd and reg_vss are no longer used. So drop them. Signed-off-by: Nuno Sá Reviewed-by: David Lechner Link: https://patch.msgid.link/20250811-ad5791-drop-unused-v1-1-3412fbf3ba36@analog.com Signed-off-by: Jonathan Cameron commit f1c675141a5f29f8936ca5f8299511200346831b Author: Akshay Bansod Date: Mon Aug 11 22:26:40 2025 +0530 iio: st_lsm6dsx: Replace scnprintf() with sysfs_emit() Update the sysfs interface for sampling frequency and scale attributes. Replace `scnprintf()` with `sysfs_emit_at()` which is PAGE_SIZE-aware and recommended for use in sysfs. Signed-off-by: Akshay Bansod Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250811165641.1214347-1-akbansd@gmail.com Signed-off-by: Jonathan Cameron commit 12c9b09e981ab14ebec8e4eefa946cbd26dd306b Author: Haibo Chen Date: Tue Aug 12 16:04:23 2025 +0800 iio: adc: imx93_adc: load calibrated values even calibration failed ADC calibration might fail because of the noise on reference voltage. To avoid calibration fail, need to meet the following requirement: ADC reference voltage Noise < 1.8V * 1/2^ENOB For the case which the ADC reference voltage on board do not meet the requirement, still load the calibrated values, so ADC can also work but maybe not that accurate. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Reviewed-by: Primoz Fiser Link: https://patch.msgid.link/20250812-adc-v2-2-0260833f13b8@nxp.com Signed-off-by: Jonathan Cameron commit 6830d3ed4d641691fc93611040f363b821df2fec Author: Haibo Chen Date: Tue Aug 12 16:04:22 2025 +0800 iio: adc: imx93_adc: keep one style of the hex values Use capital letters consistently for hex values. Signed-off-by: Haibo Chen Reviewed-by: Frank Li Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250812-adc-v2-1-0260833f13b8@nxp.com Signed-off-by: Jonathan Cameron commit e819000c692ab8c27b8cbbb386180e2f1d2e23b0 Author: Ben Collins Date: Tue Aug 12 07:12:58 2025 -0400 iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR iio_format_list() sets a stride across the val array of 1 for INT type, and 2 for all others. Add IIO_VAL_CHAR so it also gets a stride of 1 assuming val is an array of integers with char type values. No drivers currently use this, but I found this issue adding an avail callback for IIO_INFO_THERMOCOUPLE_TYPE for a driver I'm working on. Signed-off-by: Ben Collins Reviewed-by: David Lechner Link: https://patch.msgid.link/vidvwybkm3vwmtopihyaj6tlvswwa5ixmgptfzpk5ujl2ixjjb@olz6275ftabs Signed-off-by: Jonathan Cameron commit 26f0675fba4360516ee717ecc5ea099fe6819f1b Author: Krzysztof Kozlowski Date: Tue Aug 12 15:24:46 2025 +0200 dt-bindings: iio: Replace bouncing Analog emails Emails to stefan.popa@analog.com and alexandru.tachici@analog.com bounce permanently: Remote Server returned '550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup' so replace them with Marcelo Schmitt and Nuno Sá (listed alphabetically by first name) from Analog where appropriate. Acked-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Acked-by: Nuno Sá Acked-by: Marcelo Schmitt Link: https://patch.msgid.link/20250812132445.75398-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit ea9b042129275b084d13ef2f571ffd439ed47533 Author: Xichao Zhao Date: Wed Aug 13 15:55:56 2025 +0800 iio: adc: ti-tsc2046: use us_to_ktime() where appropriate Given scan_interval_us and time_per_scan_us are both in usecs, it makes more sense to use us_to_ktime() helper rather than converting to nanosecs as needed for ns_to_ktime(). Signed-off-by: Xichao Zhao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250813075556.466872-1-zhao.xichao@vivo.com Signed-off-by: Jonathan Cameron commit 946bfea3657a3b569ce1e59b29014ef5eb8c6c30 Author: Akshay Jindal Date: Thu Aug 14 09:15:43 2025 +0530 iio: light: ltr390: Add device powerdown functionality via devm api Use devm_add_action_or_reset() to do cleanup when the device is removed. Signed-off-by: Akshay Jindal Link: https://patch.msgid.link/20250814034544.93331-1-akshayaj.lkd@gmail.com Signed-off-by: Jonathan Cameron commit 7c1ece9b7063987582531501e935a5619788e38a Author: Andrew Davis Date: Wed Aug 13 17:58:38 2025 -0500 iio: health: afe4404: Do not store dev pointer in device struct The device *dev is only used in probe(), so no need to store it in the device local data struct. In all the places in probe() we did use that, just use a new local variable for the same. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20250813225840.576305-4-afd@ti.com Signed-off-by: Jonathan Cameron commit a57d6b855041ecb9c45b5b973a18d1fff611b95f Author: Andrew Davis Date: Wed Aug 13 17:58:35 2025 -0500 iio: health: afe4403: Do not store dev pointer in device struct The device *dev is only used in probe(), so no need to store it in the device local data struct. In all the places in probe() we did use that, just use a new local variable for the same. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20250813225840.576305-1-afd@ti.com Signed-off-by: Jonathan Cameron commit 2c748d2783a0ce7259901dee17b83a273fc54d4a Author: Wolfram Sang Date: Wed Aug 13 18:14:51 2025 +0200 iio: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://patch.msgid.link/20250813161517.4746-6-wsa+renesas@sang-engineering.com Signed-off-by: Jonathan Cameron commit 9125457108ab3ed21ed0a6dc61bbd9cfeaac1c42 Author: Matti Vaittinen Date: Mon Aug 11 11:52:34 2025 +0300 MAINTAINERS: A driver for simple 1-channel SPI ADCs Add undersigned as a maintainer for the ad7476.c which supports a few simple 1-channel ADC connected to SPI. Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/b952b543547523951ca87dcac86ba7a00a1c7673.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 6c27bf9bbfb72ccdd4821551ae8a28fe47c4e878 Author: Matti Vaittinen Date: Mon Aug 11 11:52:22 2025 +0300 iio: adc: ad7476: Support ROHM BD79105 The ROHM BD79105 is a simple 16-bit ADC accessible via SPI*. The BD79105 has a CONVSTART pin, which must be set high to start the ADC conversion. Unlike with the ad7091 and ad7091r which also have a CONVSTART pin, the BD79105 requires that the pin must remain high also for the duration of the SPI access. (*) Couple of words about the SPI. The BD79105 has pins named as CONVSTART, SCLK, DIN and DOUT. For the curious reader, DIN is not SPI ISO. DIN is a signal which can be used as a chip-select. When DIN is pulled low, the ADC will output the completed measurement via DOUT as SCLK is clocked. According to the data-sheet, the DIN can also be used for daisy-chaining multiple ADCs. Furthermore, DOUT can be used also for a 'data-ready' -IRQ. These modes aren't supported by this driver. Support reading ADC scale and data from the BD79105 using SPI, when DIN is used as a chip-select. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/6ee06d551256db9213ccbe72f44cfe9452717716.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 261b90763fc4d51637abd44ae248a6183fc2de4d Author: Matti Vaittinen Date: Mon Aug 11 11:52:04 2025 +0300 dt-bindings: iio: adc: ad7476: Add ROHM bd79105 The ROHM BD79105 is a simple, 16-bit, 1-channel ADC with a 'CONVSTART' pin used to start the ADC conversion. Other than the 'CONVSTART', there are 3 supply pins (one used as a reference), analog inputs, ground and communication pins. It's worth noting that the pin somewhat confusingly labeled as 'DIN', is a pin which should be used as a chip-select. The IC does not have any writable registers. The device is designed so that the output pin can, in addition to outputting the data, be used as a 'data-ready'-IRQ. There are cases where the IRQ can't be used (because it is delivered via SPI data-line). Hence, some systems may use a GPIO for polling the data readiness. Add a compatible for the bd79105 and add the data-ready GPIO to the binding. Signed-off-by: Matti Vaittinen Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/3f70f68665225be3091f8a0412e74037b6a2a88e.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 260bb98ce3df870ef3d73361f6918463bc88a5b6 Author: Matti Vaittinen Date: Mon Aug 11 11:51:50 2025 +0300 dt-bindings: iio: adc: ad7476: Drop redundant prop: true The ad7476 supports a few variants with different power-supplies and control GPIOs. The binding first unconditionally introduces all the properties, and later sets them 'true' or 'false' based on the combatible. The 'true' seems to be implied by the initial property introduction so the 'true' -branches in later conditional handling (based on the compatible) can be omitted. Drop the redundant true -branches. Signed-off-by: Matti Vaittinen Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/bee66444bf628ba9a34a02738a1842e2abc14290.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 27ec39c7090a8ad954426acf7121b4b5f2ec0043 Author: Matti Vaittinen Date: Mon Aug 11 11:51:39 2025 +0300 iio: adc: ad7476: Conditionally call convstart The ad7476 supports two IC variants which may have a 'convstart' -GPIO for starting the conversion. Currently the driver calls a function which tries to access the GPIO for all of the IC variants, whether they support 'convstart' or not. This is not an error because this function returns early if GPIO information is not populated. We can do a tad better by calling this function only for the ICs which have the 'convstart' by providing a function pointer to the convstart function from the chip_info structure, and calling this function only for the ICs which have the function pointer set. This does also allow to support ICs which require different convstart handling than the currently supported ICs. Call convstart function only on the ICs which can support it and allow IC-specific convstart functions for the ICs which require different handling. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/9760cde888fac7335c17d7ab63d5fb2e7c59ac51.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 84977a7af821014f880efd9e8e0edbf0aa17f80f Author: Matti Vaittinen Date: Mon Aug 11 11:51:28 2025 +0300 iio: adc: ad7476: Drop convstart chan_spec The ad7476 driver defines separate chan_spec structures for operation with and without convstart GPIO. At quick glance this may seem as if the driver did provide more than 1 data-channel to users - one for the regular data, other for the data obtained with the convstart GPIO. The only difference between the 'convstart' and 'non convstart' -channels is presence / absence of the BIT(IIO_CHAN_INFO_RAW) in channel's flags. We can drop the convstart channel spec, and related convstart macro, by allocating a mutable per driver instance channel spec and adding the flag in probe if needed. This will simplify the driver with the cost of added memory consumption. Assuming there aren't systems with very many ADCs and very few resources, this tradeoff seems worth making. Simplify the driver by dropping the 'convstart' channel spec and allocating the channel spec for each driver instance. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/cd7c72e3ee00f279d3381873f54e0c5b75b5ad11.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 0be6a47ec4505df0731ad943ee427b84e4c2a5fb Author: Matti Vaittinen Date: Mon Aug 11 11:51:17 2025 +0300 iio: adc: ad7476: use *_cansleep GPIO APIs The ad7476 driver supports ADCs which require a GPIO pin to be used to start conversion. The GPIO line status seems to be always toggled from a process context, either from the user-initiated "raw-read conversion", or from a threaded IRQ handler. Furthermore, these ICs are connected via SPI bus, which is usually implemented in a way that the access to the device can sleep. The GPIO here is toggled from the same context which is reading the results over SPI. Thus it seems very likely these GPIOs are toggled from a context which can sleep. Swap the gpiod_set_value() to gpiod_set_value_cansleep() accordinlgy. Suggested-by: Nuno Sá Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/a2d4b77e9739662797a1609f436b7f9807e1ac67.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 5e6847a02e44be0fa8e61d081d64666f6748793e Author: Matti Vaittinen Date: Mon Aug 11 11:51:06 2025 +0300 iio: adc: ad7476: Use correct channel for bit info The ad7476 supports ADCs which use separate GPIO for starting the conversion. For such devices, the driver uses different channel information if the GPIO is found. The bit information is still always used from the original (non 'convstart') channels. This has not been causing problems because the bit information for the 'convstart' -channel and the 'normal' -channel is identical. It, however, will cause issues if an IC has different characteristics for an 'convstart' -channel and regular channel. Furthermore, this will cause problems if a device always requires the convstart GPIO and thus only defines the convstart channel. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/70619e39023bc497ef68cc1eff11943ab68cbdf8.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 1003d539930177b552e48881c1805fd2bc20066a Author: Matti Vaittinen Date: Mon Aug 11 11:50:55 2025 +0300 iio: adc: ad7476: Use mV for internal reference The ad7476 supports some ICs with an internal reference voltage. For those ICs the reference voltage has been hard-coded as micro volts, but the value which is later used in code needs to be milli volts. This results the need to divide hard coded voltage by 1000 before using it. Simplify code by changing the hard-coded voltage to millivolts and by dropping the division. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/1c26529fcc039a3ce8b5a336948229ec727ee281.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 72e42b4849c8f0a29ae679eaa4e191cd7698c463 Author: Matti Vaittinen Date: Mon Aug 11 11:50:41 2025 +0300 iio: adc: ad7476: Simplify scale handling The ad7476 driver supports variants with different amount of supply regulators. On some variants there is only VCC, which is used as a reference voltage. Others have separate VREF regulator, and some rely on internal VREF. Some have both internal VREF and option to connect external one. The ad7476 driver reads the regulator voltage only when the user asks to get the scale. This means the driver needs to do some dancing while picking the correct reference regulator (or internal reference), and store it for the later use. According to the discussion [1] variable voltage references are rare, making it hard to justify the added complexity for supporting those. Drop the support for the variable voltage references and simplify things by using the managed regulator get and enable interfaces. Link: https://lore.kernel.org/linux-iio/20250331122247.05c6b09d@jic23-huawei/ #1 Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: $URL #1 Link: https://patch.msgid.link/4a497cc5ac0f6506c1c94d10849e0ae1cacf1191.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 79ca9bf90c8ac9f4f3560aa50dcf37d59d218c76 Author: Matti Vaittinen Date: Mon Aug 11 11:50:27 2025 +0300 iio: adc: ad7476: Simplify chip type detection The ad7476 driver uses a table of structures for defining the IC variant specific data. Table is indexed using enum values, which are picked by SPI ID. Having the table and an enum adds extra complexity and may encourage adding IC specific quircks in the code, instead of centralizing the IC differences in one place, the chip-info. Simplify this by dropping the table and using individual structures for the IC specific data, and storing the IC specific structure's address directly in the SPI ID data. Finally, switch to the spi_get_device_match_data() and add a check for the return value. Signed-off-by: Matti Vaittinen Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/9e179bb3ba52303448ae4a559c1f011acd3f2fa6.1754901948.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit c1d7b8fe67e6b05a4a521d00ddc015811cb29b61 Author: Erick Setubal Bacurau Date: Fri Aug 15 09:00:01 2025 +0200 docs: iio: bno055: Correct wording in driver documentation Fix typos and improve wording in the bno055 driver documentation. Signed-off-by: Erick Setubal Bacurau Reviewed-by: Bagas Sanjaya Link: https://patch.msgid.link/20250815070001.55185-1-erick.setubal@gmx.de Signed-off-by: Jonathan Cameron commit 4c0cdcf130a7b69a8a43167fb3b4183f7edfd60e Author: Andreas Klinger Date: Mon Jul 28 09:54:46 2025 +0200 MAINTAINER: add maintainer for veml6046x00 Add maintainer for Vishay veml6046x00 RGBIR color sensor driver and dt binding. Signed-off-by: Andreas Klinger Link: https://patch.msgid.link/20250728075447.338725-4-ak@it-klinger.de Signed-off-by: Jonathan Cameron commit 4bfb29e8be7338ad33b905a7ce11fd26d0139287 Author: Andreas Klinger Date: Mon Jul 28 09:54:45 2025 +0200 iio: light: add support for veml6046x00 RGBIR color sensor Add Vishay VEML6046X00 high accuracy RGBIR color sensor. This sensor provides three colour (red, green and blue) as well as one infrared (IR) channel through I2C. Support direct and buffered mode. An optional interrupt for signaling green colour threshold underflow or overflow is not supported so far. Signed-off-by: Andreas Klinger Link: https://patch.msgid.link/20250728075447.338725-3-ak@it-klinger.de Signed-off-by: Jonathan Cameron commit 7e2d03d00475b1a560e7e8f166b7534f4ade8fff Author: Andreas Klinger Date: Mon Jul 28 09:54:44 2025 +0200 dt-bindings: iio: light: veml6046x00: add color sensor Add a new compatible for Vishay high accuracy RGBIR color sensor veml6046x00. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andreas Klinger Link: https://patch.msgid.link/20250728075447.338725-2-ak@it-klinger.de Signed-off-by: Jonathan Cameron commit 65e8202f03224d56896202610a5875060bb775d9 Author: Waqar Hameed Date: Tue Aug 5 11:33:33 2025 +0200 iio: Remove error prints for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/pndectqm7te.a.out@axis.com Signed-off-by: Jonathan Cameron commit b515c701bbdfa453e2e57ae542863f1baf2c35b1 Author: Stefano Manni Date: Thu Aug 7 09:48:50 2025 +0200 iio: adc: ad799x: add reference voltage to ad7994 AD7994 supports external reference voltage on REFIN pin so if a vref-supply has been defined it shall be used. Signed-off-by: Stefano Manni Reviewed-by: Andy Shevchenko Reviewed-by: David Lechner Link: https://patch.msgid.link/20250807074850.130831-3-stefano.manni@gmail.com Signed-off-by: Jonathan Cameron commit ed187a201be15f7ea4200dc32a6b07de87e21f19 Author: Stefano Manni Date: Thu Aug 7 09:48:49 2025 +0200 iio: adc: ad799x: add reference voltage capability to chip_info If the chip supports an external reference voltage on REFIN pin then the "vref-supply" regulator may be used. This commit partially refactors 6b104e7895ab16b9b7f466c5f2ca282b87f661e8 to add the capability of the chip to have an external voltage reference and then remove the ugly conditional check on chip id. Suggested-by: Andy Shevchenko Signed-off-by: Stefano Manni Acked-by: Andy Shevchenko Reviewed-by: David Lechner Link: https://patch.msgid.link/20250807074850.130831-2-stefano.manni@gmail.com Signed-off-by: Jonathan Cameron commit d2d75e25262e4d6e5aa453a89c60742e6808cdbb Author: Nuno Sá Date: Fri Aug 8 17:12:33 2025 +0100 iio: imu: adis16475: remove extra line Remove extra line before adis16475_probe(). Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20250808-adis15475-extraline-v1-1-e3259a466e95@analog.com Signed-off-by: Jonathan Cameron commit f01701a8545f55d01a0e5f15c3dc67a7977fddc9 Author: Marcelo Schmitt Date: Fri Aug 8 16:02:03 2025 -0300 MAINTAINERS: Update max30208 maintainership Update MAX30208 temperature sensor driver maintainer. The previous maintainer's email bounces and no longer works. Also mark the driver as supported. Reported-by: Dave Hansen Closes: https://lore.kernel.org/linux-iio/20250808174901.4556B33A@davehans-spike.ostc.intel.com/ Signed-off-by: Marcelo Schmitt Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250808190203.7493-1-marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit ee6ef19778fd7604ddf6c3a3e307c0f36748f70c Author: Lothar Rubusch Date: Sun Jul 27 21:00:14 2025 +0000 docs: iio: describe inactivity and free-fall detection on the ADXL345 Describe the inactivity detection additionally using the free-fall register. Due to the controversial discussions on the mailing list, this section of the documentation will be committed separately to allow for a more focused and detailed elaboration of the topic. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-8-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit fdcb9cb9178ac3066cf907fe5d74ad3c856c2d46 Author: Lothar Rubusch Date: Sun Jul 27 21:00:13 2025 +0000 docs: iio: add documentation for adxl345 driver The documentation describes the ADXL345 driver, IIO interface, interface usage and configuration. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-7-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit f6f22950d925c5e42ac5aeadafafcfc3c5c7b360 Author: Lothar Rubusch Date: Sun Jul 27 21:00:12 2025 +0000 iio: accel: adxl345: extend inactivity time for less than 1s Inactivity and free-fall events are essentially the same type of sensor events. Therefore, inactivity detection (normally set for periods between 1 and 255 seconds) can be extended for shorter durations to support free-fall detection. For periods shorter than 1 second, the driver automatically configures the threshold and duration using the free-fall register. For periods longer than 1 second, it uses the inactivity threshold and duration using the inactivity registers. When using the free-fall register, the link bit is not set, which means auto-sleep cannot be enabled if activity detection is also active. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-6-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 31f7679bb69abfd3a0175608f8b0ee721cea8544 Author: Lothar Rubusch Date: Sun Jul 27 21:00:11 2025 +0000 iio: accel: adxl345: add coupling detection for activity/inactivity Enable AC/DC coupling configuration for activity and inactivity detection by setting the AC/DC bit. Extend existing magnitude-based detection with adaptive AC-coupled mode. Use DC-coupled mode to compare acceleration samples directly against configured thresholds. Use AC-coupled mode to compare samples against a reference taken at the start of activity detection. Implement DC-coupled events using MAG, and AC-coupled events using MAG_ADAPTIVE. Expose configuration of thresholds and periods via separate sysfs handles. Note that both coupling modes share the same sensor registers, so activity or inactivity detection cannot be configured for both AC and DC simultaneously. Apply the most recently configured mode. Simplify event handling and support adaptive AC-coupling. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-5-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 8a1536cc4a1c8cf83d9f49a5cafa6cec62d9ff7b Author: Lothar Rubusch Date: Sun Jul 27 21:00:10 2025 +0000 iio: accel: adxl345: add inactivity feature Add support for the sensor’s inactivity feature in the driver. When both activity and inactivity detection are enabled, the sensor sets a link bit that ties the two functions together. This also enables auto-sleep mode, allowing the sensor to automatically enter sleep state upon detecting inactivity. Inactivity detection relies on a configurable threshold and a specified time period. If sensor measurements remain below the threshold for the defined duration, the sensor transitions to the inactivity state. When an Output Data Rate (ODR) is set, the inactivity time period is automatically adjusted to a sensible default. Higher ODRs result in shorter inactivity timeouts, while lower ODRs allow longer durations-within reasonable upper and lower bounds. This is important because features like auto-sleep operate effectively only between 12.5 Hz and 400 Hz. These defaults are applied when the sample rate is modified, but users can override them by explicitly setting a custom inactivity timeout. Similarly, configuring the g-range provides default threshold values for both activity and inactivity detection. These are implicit defaults meant to simplify configuration, but they can also be manually overridden as needed. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-4-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 66a1af6d8a636bc7f6bb5ee0ae6b8d4b12631280 Author: Lothar Rubusch Date: Sun Jul 27 21:00:09 2025 +0000 iio: accel: adxl345: add activity event feature Enable the sensor to detect activity and trigger interrupts accordingly. Activity events are determined based on a threshold, which is initialized to a sensible default during probe. This default value is adopted from the legacy ADXL345 input driver to maintain consistent behavior. The combination of activity detection, ODR configuration, and range settings lays the groundwork for the activity/inactivity hysteresis mechanism, which will be implemented in a subsequent patch. As such, portions of this patch prepare switch-case structures to support those upcoming changes. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit c6eac16025eb9760132b5cc5e70d9ae109801593 Author: Lothar Rubusch Date: Sun Jul 27 21:00:08 2025 +0000 iio: accel: adxl345: simplify tap suppress bit Simplify setting the tap suppress bit by applying regmap_assign_bit(). As a result, the defines can be reorganized for better clarity. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250727210014.27766-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 73c8b83b4aedae07b3c45379fe14be5a2734cbca Author: Rodrigo Gobbi Date: Fri Aug 1 19:10:00 2025 -0300 dt-bindings: iio: pressure: add invensense,icp10100 There is no txt file for it, add yaml for invensense,icp10100 which is already used in the driver. Also, document other compatibles for ICP-101xx family and add invensense,icp10100 as a fallback. Acked-by: Jean-Baptiste Maneyrol Signed-off-by: Rodrigo Gobbi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250801221424.132305-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jonathan Cameron commit 9da51431c33230a46fec5ddc0a7a3a848c393f7b Author: Akshay Jindal Date: Mon Jul 28 21:44:41 2025 +0530 iio: light: ltr390: Add debugfs register access support Add support for debugfs_reg_access through the driver's iio_info structure to enable low-level register read/write access for debugging. Signed-off-by: Akshay Jindal Link: https://patch.msgid.link/20250728161445.13261-1-akshayaj.lkd@gmail.com Signed-off-by: Jonathan Cameron commit 33c52b2d85b7c04386b1dda1428c0160ec29169e Author: David Lechner Date: Thu Jul 10 17:39:53 2025 -0500 iio: ABI: alphabetize filter types Put the filter types in alphabetical order by name. This makes it easier to find a specific filter type when looking through the documentation. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250710-iio-adc-ad7137-add-filter-support-v1-4-acffe401c4d2@baylibre.com Signed-off-by: Jonathan Cameron commit e4be2f593daba5881ad65e1ed1d5924b7248ff75 Author: Nuno Sá Date: Fri Jul 25 07:32:55 2025 +0100 iio: buffer: buffer-cb: drop double initialization of demux list Drop the call to INIT_LIST_HEAD(&cb_buff->buffer.demux_list). That's already done in iio_buffer_init(&cb_buff->buffer). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250725-iio-minor-cleanup-v1-1-4e561372142e@analog.com Signed-off-by: Jonathan Cameron commit 329cb8be151948d3462a99f204725dcbdeb61623 Author: David Lechner Date: Thu Jul 10 17:22:00 2025 -0500 iio: adc: ad7173: add SPI offload support Enable SPI offload support for the AD7173 ADC driver. The scan_type used for SPI offload is assuming that we are using the ad411x_ad717x HDL project [1] which always stores data words in 32-bits. Link: https://analogdevicesinc.github.io/hdl/projects/ad411x_ad717x/index.html [1] Reviewed-by: Andy Shevchenko Signed-off-by: David Lechner Link: https://patch.msgid.link/20250710-iio-adc-ad7173-add-spi-offload-support-v4-1-536857c4e043@baylibre.com Signed-off-by: Jonathan Cameron commit 9ae68c9bb12a3a6cc7df59f9ee3ff5879d97cda9 Author: Krzysztof Kozlowski Date: Sun Jul 13 17:59:55 2025 +0200 iio: adc: ti-adc12138: Simplify with devm_clk_get_enabled() Driver is getting clock and almost immediately enabling it, with the devm_request_irq() as the only relevant code executed between, thus the probe path and cleanups can be simplified with devm_clk_get_enabled(). Move devm_request_irq() earlier, so the interrupt handler will be registered before clock is enabled. This might be important in case regulator supplies are enabled by other device driver and this device raises interrupt immediately after clock sarts ticking. The change does not reverse cleanup paths - first regulator will be disabled, then clock and finally interrupt handler freed. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250713-iio-clk-get-enabled-v1-1-70abc1f9ce6c@linaro.org Signed-off-by: Jonathan Cameron commit 49baeed7b3ba82a10749fefdb6144a3817b7ad75 Author: Colin Ian King Date: Mon Jul 21 16:03:09 2025 +0100 iio: light: vl6180: remove space before \n newline There is an extraneous space before a newline in a dev_err_probe message. Remove it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250721150310.2601679-1-colin.i.king@gmail.com Signed-off-by: Jonathan Cameron commit 0a84f5105b405d8506707d244f225b040dfb04f4 Author: Krzysztof Kozlowski Date: Thu Jul 24 13:13:49 2025 +0200 dt-bindings: iio: light: Simplify interrupts property in the example dynaimage,al3010 and dynaimage,al3320a are I2C devices, so their interrupts are not routed to GIC and rarely first interrupt cell is <0>. This looks like copy-paste from some SoC block, so drop it and also for readability use known defines instead of hard-coding interrupt flag. Signed-off-by: Krzysztof Kozlowski Reviewed-by: David Heidelberg Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250724111345.47889-8-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit 971255565074b160d5d05d6b0d9e6f70cbb7c4a9 Author: Krzysztof Kozlowski Date: Thu Jul 24 13:13:48 2025 +0200 dt-bindings: iio: adc: samsung,exynos-adc: Use correct IRQ level in example The interrupt line to GIC is IRQ_TYPE_LEVEL_HIGH, so use that instead of "none". Also replace the hard-coded GIC_SPI flag. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Reviewed-by: Sam Protsenko Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250724111345.47889-7-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit 1c3e87983cf0d71139afe88db440e3a42ea34ebe Author: Krzysztof Kozlowski Date: Thu Jul 24 13:13:47 2025 +0200 dt-bindings: iio: adc: Replace hard-coded GPIO/IRQ flag with a define For readability use known defines instead of hard-coding GPIO or interrupt flag. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Acked-by: Matti Vaittinen Link: https://patch.msgid.link/20250724111345.47889-6-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit 07306551cb76d61b02391d26a2e85c7711e92e1c Author: Krzysztof Kozlowski Date: Thu Jul 24 13:13:46 2025 +0200 dt-bindings: iio: Drop unused header includes in examples Drop includes of headers which example code does not use. No functional impact. Signed-off-by: Krzysztof Kozlowski Reviewed-by: David Heidelberg Acked-by: Matti Vaittinen Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250724111345.47889-5-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit cddbb2f9e46e08968089ee21cb9bc80ad7306140 Author: Colin Ian King Date: Thu Jul 24 11:47:43 2025 +0100 iio: magnetometer: Fix spelling mistake "Magenetometer" -> "Magnetometer" There is a spelling mistake in the HID_SENSOR_MAGNETOMETER_3D Kconfig, fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250724104743.139892-1-colin.i.king@gmail.com Signed-off-by: Jonathan Cameron commit 972b1d5dee9eaa31ec8c20cfbea369f30bab416b Author: David Lechner Date: Mon Jul 21 17:12:47 2025 -0500 iio: adc: ti-adc081c: use individual model structures instead of array Change the ti-adc081c driver to use individual model structures instead of an array. This reduces the verbosity of the code. Also, the data is now const as it should have been in the first place. The ADCxx1C_MODEL() macro is dropped to be consistent with similar model definitions in other drivers. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250721-iio-const-data-11-v2-1-c3fec12511ee@baylibre.com Signed-off-by: Jonathan Cameron commit 97b262d24ae28b1e86586a927c8be9df9747fb56 Author: David Lechner Date: Mon Jul 21 18:16:34 2025 -0500 iio: accel: bma180: use stack allocated buffer for scan Move the scan struct to the stack instead of being in the driver state struct. The buffer is only used in a single function and does not need to be DMA-safe so it does not need to exist outside of that function's scope. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250721-iio-use-more-iio_declare_buffer_with_ts-v2-1-f8fb11b8add8@baylibre.com Signed-off-by: Jonathan Cameron commit c9100ef6db6ec437d2f64e294ae50a8ec4b16856 Author: David Lechner Date: Mon Jul 21 17:21:08 2025 -0500 iio: proximity: srf08: use stack allocated scan buffer Use a stack allocated scan struct in srf08_trigger_handler(). Since the scan buffer isn't used outside of this function and doesn't need to be DMA-safe, it doesn't need to be in struct srf08_data. We can also eliminate an extra local variable for the return value of srf08_read_ranging() by using scan.chan directly. Reviewed-by: Andreas Klinger Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250721-iio-use-more-iio_declare_buffer_with_ts-6-v2-1-8b66e5b4e75a@baylibre.com Signed-off-by: Jonathan Cameron commit 5335f93d28143b6288ca6d8cec1f05b033c456c1 Author: David Lechner Date: Tue Jul 22 14:35:02 2025 -0500 iio: proximity: sx9500: use stack allocated struct for scan data Use a stack-allocated struct in sx9500_trigger_handler() to hold the IIO buffer scan data. Since the scan buffer isn't used outside of this function, it doesn't need to be in struct sx9500_data. By always allocating enough space for the maximum number of channels, we can avoid having to reallocate the buffer each time buffered reads are enabled. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-use-more-iio_declare_buffer_with_ts-4-v2-1-9e566f3a4c6a@baylibre.com Signed-off-by: Jonathan Cameron commit b76c739c3d11d1dacc8efe7fa873bee28ac991f1 Author: David Lechner Date: Tue Jul 22 16:52:38 2025 -0500 iio: fix iio_push_to_buffers_with_ts() typo Replace iio_push_to_buffer_with_ts() with iio_push_to_buffers_with_ts() in some documentation comments in iio.h. The latter is the correct name of the function, the former doesn't exist. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-fix-iio_push_to_buffer_with_ts-typo-v1-1-6ac9efb856d3@baylibre.com Signed-off-by: Jonathan Cameron commit ff2501ff5c329a1a8bb0715e033d3b8af1e76de2 Author: David Lechner Date: Tue Jul 22 17:26:39 2025 -0500 iio: proximity: vl53l0x-i2c: use stack allocated scan struct Use a stack allocated struct for the scan data instead of using the driver state to store the struct. The scan data is not used outside of the interrupt handler function so the struct does not need to exist outside of that scope. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-proximity-vl53l0x-i2c-use-stack-allocated-scan-struct-v1-1-42f127a6834f@baylibre.com Signed-off-by: Jonathan Cameron commit 8e7a21e103d7192ae267045cca79290f31333910 Author: David Lechner Date: Tue Jul 22 17:34:45 2025 -0500 iio: proximity: pulsedlight-lidar-lite-v2: use stack allocated scan struct Use a stack allocated struct for the scan data instead of using the driver state to store the struct. The scan data is not used outside of the interrupt handler function so the struct does not need to exist outside of that scope. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-proximity-pulsedlight-lidar-lite-v2-use-stack-allocated-scan-struct-v1-1-4c253339b941@baylibre.com Signed-off-by: Jonathan Cameron commit f235ec59343b2a7cb5844a5656aca6360829ca4b Author: David Lechner Date: Tue Jul 22 17:39:17 2025 -0500 iio: proximity: mb1232: use stack allocated scan struct Use a stack allocated struct for the scan data instead of using the driver state to store the struct. The scan data is not used outside of the interrupt handler function so the struct does not need to exist outside of that scope. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-proximity-mb1232-use-stack-allocated-scan-struct-v1-1-b4ef77e9ddea@baylibre.com Signed-off-by: Jonathan Cameron commit 83d76bf0360f7041d03d8f70301b0a8f96c9c872 Author: Jonas Karlman Date: Wed Jul 23 08:56:45 2025 +0000 dt-bindings: iio: adc: rockchip-saradc: Allow use of a power-domain The SARADC controller in most Rockchip SoCs are part of power domains that are always powered on, i.e. PD_BUS or PD_PERI. These always powered on power domains have typically not been described in the device tree. Because these power domains have been left out of the device tree there has not been any real need to properly describe the power domain of the SARADC controller. On RK3528 the SARADC controller is part of the PD_VPU power domain. Add support to describe an optional power-domains for the SARADC controller in Rockchip SoCs. Signed-off-by: Jonas Karlman Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250723085654.2273324-4-jonas@kwiboo.se Signed-off-by: Jonathan Cameron commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f Author: Rodrigo Gobbi Date: Thu Jul 17 19:13:49 2025 -0300 iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register avg sample info is a bit field coded inside the following bits: 5,6,7 and 8 of a device status register. Channel num info the same, but over bits: 1, 2 and 3. Mask both values in order to avoid touching other register bits, since the first info (avg sample), came from DT. Signed-off-by: Rodrigo Gobbi Reviewed-by: David Lechner Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jonathan Cameron commit 34c065fe1d0dbb08073d83559d3173bb4f17dcc5 Author: Qianfeng Rong Date: Fri Aug 8 15:44:26 2025 +0800 crypto: ccp - Remove redundant __GFP_ZERO Remove the redundant __GFP_ZERO flag from kzalloc() since kzalloc() inherently zeroes memory. Signed-off-by: Qianfeng Rong Reviewed-by: Mario Limonciello Signed-off-by: Herbert Xu commit d2236198839ca57610d1f7be7c61fb8c95f2fca6 Author: David Sterba Date: Thu Aug 7 13:44:44 2025 +0200 lib/lzo: add unlikely hints to overrun checks The NEED_* macros do an implicit goto in case the safety bounds checks fail. Add the unlikely hints as this is the error case and not a hot path. The final assembly is slightly shorter and some jumps got reordered according to the hints. text data bss dec hex filename 2294 16 0 2310 906 pre/lzo1x_decompress_safe.o 2277 16 0 2293 8f5 post/lzo1x_decompress_safe.o text data bss dec hex filename 3444 48 0 3492 da4 pre/lzo1x_compress_safe.o 3372 48 0 3420 d5c post/lzo1x_compress_safe.o Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit 817fcdbd4ca29834014a5dadbe8e11efeb12800c Author: Xichao Zhao Date: Thu Jul 31 20:17:27 2025 +0800 hwrng: timeriomem - Use us_to_ktime() where appropriate It is better to replace ns_to_ktime() with us_to_ktime(), which can make the code clearer. Signed-off-by: Xichao Zhao Signed-off-by: Herbert Xu commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 Author: Arnd Bergmann Date: Tue Jul 29 17:28:00 2025 +0200 hwrng: nomadik - add ARM_AMBA dependency Compile-testing this driver is only possible when the AMBA bus driver is available in the kernel: x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be specified for the COMPILE_TEST case. Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") Signed-off-by: Arnd Bergmann Signed-off-by: Herbert Xu commit ed53a5050f42a3243a7ed8dfa49030e54034b952 Author: Michael Roth Date: Mon Jul 28 18:43:03 2025 -0500 crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length The SNP_VLEK_LOAD IOCTL currently fails due to sev_cmd_buffer_len() returning the default expected buffer length of 0 instead of the correct value, which would be sizeof(struct sev_user_data_snp_vlek_load). Add specific handling for SNP_VLEK_LOAD so the correct expected size is returned. Reported-by: Diego GonzalezVillalobos Cc: Diego GonzalezVillalobos Fixes: 332d2c1d713e ("crypto: ccp: Add the SNP_VLEK_LOAD command") Signed-off-by: Michael Roth Signed-off-by: Herbert Xu commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 Author: Thomas Fourier Date: Mon Jul 28 14:03:30 2025 +0200 crypto: keembay - Add missing check after sg_nents_for_len() sg_nents_for_len() returns an int which is negative in case of error. Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit 3ed63344657a48b19be6f4a697d94a436c0c7edc Author: Vijay Sundar Selvamani Date: Fri Jul 25 10:09:30 2025 +0100 crypto: qat - add command queue telemetry counters for GEN6 Add slice-specific command queue counters for QAT GEN6 devices to monitor utilization metrics, including wait time, execution duration, and release events. Update the documentation to reflect the new command queue counter functionality. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 9ea349e4b94114f9fd8f01102b7db66edd9bd026 Author: Vijay Sundar Selvamani Date: Fri Jul 25 10:09:29 2025 +0100 crypto: qat - add ring buffer idle telemetry counter for GEN6 Add a new performance counter that measures the average ring buffer idle duration. This metric is now included in the telemetry counters exposed via debugfs for QAT GEN6 devices. Update the documentation to reflect the new idle duration counter Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 81109696f09cf4c712366323f657d9879a40c626 Author: Colin Ian King Date: Thu Jul 24 11:57:54 2025 +0100 crypto: stm32 - Fix spelling mistake "STMicrolectronics" -> "STMicroelectronics" There is a spelling mistake in the module description text. Fix it. Signed-off-by: Colin Ian King Acked-by: Maxime Méré Signed-off-by: Herbert Xu commit c9760b0fca6bfa250c02e14bfe81c542f3626a72 Author: Ashish Kalra Date: Mon Jul 21 14:13:55 2025 +0000 crypto: ccp - Add support to enable CipherTextHiding on SNP_INIT_EX To enable ciphertext hiding, it must be specified in the SNP_INIT_EX command as part of SNP initialization. Modify the sev_platform_init_args structure, which is used as input to sev_platform_init(), to include a field that, when non-zero, indicates that ciphertext hiding should be enabled and specifies the maximum ASID that can be used for an SEV-SNP guest. Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Kim Phillips Signed-off-by: Herbert Xu commit 45d59bd4a3e0f0475b3646e8b9936d34794e503d Author: Ashish Kalra Date: Mon Jul 21 14:13:27 2025 +0000 crypto: ccp - Introduce new API interface to indicate SEV-SNP Ciphertext hiding feature Implement an API that checks the overall feature support for SEV-SNP ciphertext hiding. This API verifies both the support of the SEV firmware for the feature and its enablement in the platform's BIOS. Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Kim Phillips Signed-off-by: Herbert Xu commit 33cfb80d1910b41d1a25cef89b159c945aff0f24 Author: Ashish Kalra Date: Mon Jul 21 14:13:10 2025 +0000 crypto: ccp - Add support for SNP_FEATURE_INFO command The FEATURE_INFO command provides hypervisors with a programmatic means to learn about the supported features of the currently loaded firmware. This command mimics the CPUID instruction relative to sub-leaf input and the four unsigned integer output values. To obtain information regarding the features present in the currently loaded SEV firmware, use the SNP_FEATURE_INFO command. Cache the SNP platform status and feature information from CPUID 0x8000_0024 in the sev_device structure. If SNP is enabled, utilize this cached SNP platform status for the API major, minor and build version. Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Kim Phillips Signed-off-by: Herbert Xu commit 459daec42ea0cf5e276dfb82e90ed91e2db45d9e Author: Ashish Kalra Date: Mon Jul 21 14:12:51 2025 +0000 crypto: ccp - Cache SEV platform status and platform state Cache the SEV platform status into sev_device structure and use this cached SEV platform status for api_major/minor/build. The platform state is unique between SEV and SNP and hence needs to be tracked independently. Remove the state field from sev_device structure and instead track SEV state from the cached SEV platform status. Suggested-by: Tom Lendacky Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Kim Phillips Signed-off-by: Herbert Xu commit 450bbe43ef90a213d66fac1def64050d9d9ada8e Author: Ashish Kalra Date: Mon Jul 21 14:12:32 2025 +0000 crypto: ccp - New bit-field definitions for SNP_PLATFORM_STATUS command Define new bit-field definitions returned by SNP_PLATFORM_STATUS command such as new capabilities like SNP_FEATURE_INFO command availability, ciphertext hiding enabled and capability. Reviewed-by: Tom Lendacky Signed-off-by: Ashish Kalra Reviewed-by: Kim Phillips Signed-off-by: Herbert Xu commit 5ff74f5f71f83cce3c920cd17940df0fe0401865 Author: Eric Biggers Date: Fri Aug 15 19:02:40 2025 -0700 lib/crc: Drop inline from all *_mod_init_arch() functions Drop 'inline' from all the *_mod_init_arch() functions so that the compiler will warn about any bugs where they are unused due to not being wired up properly. (There are no such bugs currently, so this just establishes a more robust convention for the future. Of course, these functions also tend to get inlined anyway, regardless of the keyword.) Link: https://lore.kernel.org/r/20250816020240.431545-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit bab3ce404553de56242d7b09ad7ea5b70441ea41 Merge: 8159572936392b 28f073b38372b9 Author: Jakub Kicinski Date: Fri Aug 15 18:13:41 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: implement SRIOV VF Active-Active LAG Dave Ertman says: Implement support for SRIOV VFs over an Active-Active link aggregate. The same restrictions apply as are in place for the support of Active-Backup bonds. - the two interfaces must be on the same NIC - the FW LLDP engine needs to be disabled - the DDP package that supports VF LAG must be loaded on device - the two interfaces must have the same QoS config - only the first interface added to the bond will have VF support - the interface with VFs must be in switchdev mode With the additional requirement of - the version of the FW on the NIC needs to have VF Active/Active support The balancing of traffic between the two interfaces is done on a queue basis. Taking the queues allocated to all of the VFs as a whole, one half of them will be distributed to each interface. When a link goes down, then the queues allocated to the down interface will migrate to the active port. When the down port comes back up, then the same queues as were originally assigned there will be moved back. Patch 1 cleans up void pointer casts Patch 2 utilizes bool over u8 when appropriate Patch 3 adds a driver prefix to a LAG define Patch 4 pre-move a function to reduce delta in implementation patch Patch 5 cleanup variable initialization in declaration block Patch 6 cleanup capability parsing for LAG feature Patch 7 is the implementation of the new functionality * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: Implement support for SRIOV VFs across Active/Active bonds ice: cleanup capabilities evaluation ice: Cleanup variable initialization in LAG code ice: move LAG function in code to prepare for Active-Active ice: Add driver specific prefix to LAG defines ice: replace u8 elements with bool where appropriate ice: Remove casts on void pointers in LAG code ==================== Link: https://patch.msgid.link/20250814230855.128068-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3ec85602f86c694b605ffc1977cad1f56fe1749e Merge: abdaf49be5424d 7f8fa9d370c11b Author: Andrii Nakryiko Date: Fri Aug 15 16:50:15 2025 -0700 Merge branch 'libbpf-fix-reuse-of-devmap' Yureka Lilian says: ==================== libbpf: fix reuse of DEVMAP changes in v3: - instead of setting BPF_F_RDONLY_PROG on both sides, just clear BPF_F_RDONLY_PROG in map_info.map_flags as suggested by Andrii Nakryiko - in the test, use ASSERT_* instead of CHECK - shorten the test by using open_and_load from the skel - in the test, drop NULL check before unloading/destroying bpf objs - start the commit messages with "libbpf" and "selftests/bpf" respectively instead of just "bpf" changes in v2: - preserve compatibility with older kernels - add a basic selftest covering the re-use of DEVMAP maps ==================== Link: https://patch.msgid.link/20250814180113.1245565-2-yuka@yuka.dev Signed-off-by: Andrii Nakryiko commit 7f8fa9d370c11ba2fb296598267e14d3bfe4ea11 Author: Yureka Lilian Date: Thu Aug 14 20:01:13 2025 +0200 selftests/bpf: Add test for DEVMAP reuse The test covers basic re-use of a pinned DEVMAP map, with both matching and mismatching parameters. Signed-off-by: Yureka Lilian Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250814180113.1245565-4-yuka@yuka.dev commit 6c6b4146deb12d20f42490d5013f2043df942161 Author: Yureka Lilian Date: Thu Aug 14 20:01:12 2025 +0200 libbpf: Fix reuse of DEVMAP Previously, re-using pinned DEVMAP maps would always fail, because get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, but BPF_F_RDONLY_PROG being set on a map during creation is invalid. Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from get_map_info when checking for compatibility with an existing DEVMAP. The same problem is handled in a third-party ebpf library: - https://github.com/cilium/ebpf/issues/925 - https://github.com/cilium/ebpf/pull/930 Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") Signed-off-by: Yureka Lilian Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev commit abdaf49be5424db74e19d167c10d7dad79a0efc2 Author: Tao Chen Date: Thu Aug 14 20:14:29 2025 +0800 bpf: Remove migrate_disable in kprobe_multi_link_prog_run Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run called all the way from graph tracer, which disables preemption in function_graph_enter_regs, as Jiri and Yonghong suggested, there is no need to use migrate_disable. As a result, some overhead may will be reduced. And add cant_sleep check for __this_cpu_inc_return. Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev commit 326d2519811200da0e301dce3e93389dadd197a4 Author: Rob Herring (Arm) Date: Thu Aug 14 08:51:56 2025 -0500 dt-bindings: powerpc: Drop duplicate fsl/mpic.txt The chrp,open-pic binding schema already supports the "fsl,mpic" compatible. Add a couple of missing properties and support for 4 "#interrupt-cells" to the chrp,open-pic binding, so fsl/mpic.txt can be removed. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250814135157.2747346-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 47829efa1cf42993e5bea2b4aea7e1cfcf8bd438 Author: Rob Herring (Arm) Date: Tue Aug 12 13:14:20 2025 -0500 dt-bindings: perf: Convert apm,xgene-pmu to DT schema Convert the Applied Micro X-Gene PMU binding to DT schema format. It is a straightforward conversion. Link: https://lore.kernel.org/r/20250812181422.68286-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 38f9f4f5f8828e43c549fd07b70fe5bc4c2ef2f6 Author: Rob Herring (Arm) Date: Wed Aug 6 16:27:32 2025 -0500 dt-bindings: arm: Convert marvell,berlin to DT schema Reviewed-by: Jisheng Zhang Link: https://lore.kernel.org/r/20250806212733.1633662-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit eb0e3f301d6ee7c813556fa6ca714e436f5235b0 Author: Sascha Hauer Date: Wed Jul 16 18:06:30 2025 -0700 dt-bindings: arm: cpus: Add edac-enabled property Some ARM Cortex CPUs including A72 have Error Detection And Correction (EDAC) support on their L1 and L2 caches. That functionality is in implementation defined registers, so using it is not safe in virtualized environments or when EL3 already uses these registers. Add a edac-enabled flag which can be explicitly set when EDAC can be used. [ bp: Massage commit message. ] Signed-off-by: Sascha Hauer Signed-off-by: Vijay Balakrishna Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/1752714390-27389-3-git-send-email-vijayb@linux.microsoft.com commit fb13ae067ad7f07df2bdc374aa911ff58dfd19ce Author: Sascha Hauer Date: Wed Jul 16 18:06:29 2025 -0700 EDAC: Add EDAC driver for ARM Cortex A72 cores The driver is designed to support error detection and reporting for Cortex A72 cores, specifically within their L1 and L2 cache systems. The errors are detected by reading CPU/L2 memory error syndrome registers. Unfortunately there is no robust way to inject errors into the caches, so this driver doesn't contain any code to actually test it. It has been tested though with code taken from an older version [1] of this driver. For reasons stated in thread [1], the error injection code is not suitable for mainline, so it is removed from the driver. [1] https://lore.kernel.org/all/1521073067-24348-1-git-send-email-york.sun@nxp.com/#t [ bp: minor touchups. ] Signed-off-by: Sascha Hauer Co-developed-by: Vijay Balakrishna Signed-off-by: Vijay Balakrishna Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/1752714390-27389-2-git-send-email-vijayb@linux.microsoft.com commit d87208128a3330c0eab18301ab39bdb419647730 Author: Nathan Chancellor Date: Thu Aug 14 18:31:38 2025 -0700 x86/build: Remove cc-option from stack alignment flags '-mpreferred-stack-boundary' (the GCC option) and '-mstack-alignment' (the clang option) have been supported in their respective compilers for some time, so it is unnecessary to check for support for them via cc-option. '-mpreferred-stack-boundary=3' had a restriction on '-mno-sse' until GCC 7.1 but that is irrelevant for most of the kernel, which includes '-mno-sse'. Move to simple Kconfig checks to avoid querying the compiler for the flags that it supports. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-2-ff7f19457523@kernel.org commit 7e25d84f460c59322bf01dfeb1fb4745b488f714 Author: Shankari Anand Date: Thu Aug 14 16:11:33 2025 +0530 rust: dma: Update ARef and AlwaysRefCounted imports from sync::aref Update call sites in the dma subsystem to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://lore.kernel.org/r/20250814104133.350093-1-shankari.ak0208@gmail.com Signed-off-by: Danilo Krummrich commit 1e180614b3608e1cb0f81753b2172af253d58a52 Author: Shankari Anand Date: Thu Aug 14 16:16:15 2025 +0530 rust: driver-core: Update ARef and AlwaysRefCounted imports from sync::aref Update call sites in the driver-core files and its related samples to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://lore.kernel.org/r/20250814104615.355106-1-shankari.ak0208@gmail.com Signed-off-by: Danilo Krummrich commit 27f94b71532203b079537180924023a5f636fca1 Author: Konrad Dybcio Date: Tue Jul 8 12:28:42 2025 +0200 arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode 2290 was found in the field to also require this quirk, as long & high-bandwidth workloads (e.g. USB ethernet) are consistently able to crash the controller otherwise. The same change has been made for a number of SoCs in [1], but QCM2290 somehow escaped the list (even though the very closely related SM6115 was there). Upon a controller crash, the log would read: xhci-hcd.12.auto: xHCI host not responding to stop endpoint command xhci-hcd.12.auto: xHCI host controller not responding, assume dead xhci-hcd.12.auto: HC died; cleaning up Add snps,parkmode-disable-ss-quirk to the DWC3 instance in order to prevent the aforementioned breakage. [1] https://lore.kernel.org/all/20240704152848.3380602-1-quic_kriskura@quicinc.com/ Cc: stable@vger.kernel.org Reported-by: Rob Clark Fixes: a64a0192b70c ("arm64: dts: qcom: Add initial QCM2290 device tree") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250708-topic-2290_usb-v1-1-661e70a63339@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c80d79720647ed77ebc0198abd5a0807efdaff0b Author: Matt Bobrowski Date: Fri Aug 15 12:12:14 2025 +0000 bpf/selftests: Fix test_tcpnotify_user Based on a bisect, it appears that commit 7ee988770326 ("timers: Implement the hierarchical pull model") has somehow inadvertently broken BPF selftest test_tcpnotify_user. The error that is being generated by this test is as follows: FAILED: Wrong stats Expected 10 calls, got 8 It looks like the change allows timer functions to be run on CPUs different from the one they are armed on. The test had pinned itself to CPU 0, and in the past the retransmit attempts also occurred on CPU 0. The test had set the max_entries attribute for BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was likely to be in range. With the change to allow timers to run on other CPUs, the current CPU tasked with performing the retransmit might be bumped and in turn fall out of range, as the event will be filtered out via __bpf_perf_event_output() using: if (unlikely(index >= array->map.max_entries)) return -E2BIG; A possible change would be to explicitly set the max_entries attribute for perf_event_map in test_tcpnotify_kern.c to a value that's at least as large as the number of CPUs. As it turns out however, if the field is left unset, then the libbpf will determine the number of CPUs available on the underlying system and update the max_entries attribute accordingly in map_set_def_max_entries(). A further problem with the test is that it has a thread that continues running up until the program exits. The main thread cleans up some LIBBPF data structures, while the other thread continues to use them, which inevitably will trigger a SIGSEGV. This can be dealt with by telling the thread to run for as long as necessary and doing a pthread_join on it before exiting the program. Finally, I don't think binding the process to CPU 0 is meaningful for this test any more, so get rid of that. Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") Signed-off-by: Matt Bobrowski Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com commit 8159572936392b514e404bab2d60e47cebd5acfe Author: Thorsten Blum Date: Thu Aug 14 20:05:14 2025 +0200 net: Space: Replace memset(0) + strscpy() with strscpy_pad() Replace memset(0) followed by strscpy() with strscpy_pad() to improve netdev_boot_setup_add(). This avoids zeroing the memory before copying the string and ensures the destination buffer is only written to once, simplifying the code and improving efficiency. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250814180514.251000-2-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit e63b162ef43eeb774edcb688bbf141bb468af485 Merge: d0f110773d776f 520369ef43a850 Author: Jakub Kicinski Date: Fri Aug 15 12:29:09 2025 -0700 Merge branch 'net-mlx5-support-disabling-host-pfs' Tariq Toukan says: ==================== net/mlx5: Support disabling host PFs This small series by Daniel adds support for disabling host PFs. If device is capable and configured, the driver won't access vports of disabled host functions. ==================== Link: https://patch.msgid.link/1755112796-467444-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 520369ef43a8504f9d54ee219bb6c692d2e40028 Author: Daniel Jurgens Date: Wed Aug 13 22:19:56 2025 +0300 net/mlx5: Support disabling host PFs Some devices support disabling the physical function on the host. When this is configured the vports for the host functions do not exist. This patch checks if host functions are enabled before trying to access their vports. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1755112796-467444-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 9e84de72aef9bcf0e751a0bff3ac91b0cf52366f Author: Daniel Jurgens Date: Wed Aug 13 22:19:55 2025 +0300 net/mlx5: Query to see if host PF is disabled The host PF can be disabled, query firmware to check if the host PF of this function exists. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1755112796-467444-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d0f110773d776f919f93ba2e7dc254f80a7297b2 Author: Heiner Kallweit Date: Wed Aug 13 21:18:03 2025 +0200 net: phy: fixed: remove usage of a faux device A struct mii_bus doesn't need a parent, so we can simplify the code and remove using a faux device. Only difference is the following in sysfs under /sys/class/mdio_bus: old: fixed-0 -> '../../devices/faux/Fixed MDIO bus/mdio_bus/fixed-0' new: fixed-0 -> ../../devices/virtual/mdio_bus/fixed-0 Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/e9426bb9-f228-4b99-bc09-a80a958b5a93@gmail.com Signed-off-by: Jakub Kicinski commit 40653f280b2640e5caa94eeedee43e0f1df97704 Author: Saeed Mahameed Date: Mon Jun 16 17:28:20 2025 -0700 {rdma,net}/mlx5: export mlx5_vport_get_vhca_id vhca id is already cached in the vport structure no need to query on every mlx5 layer, use the mlx5_vport_get_vhca_id, where possible. Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Signed-off-by: Alexei Lazar Reviewed-by: Feng Liu Reviewed-by: Tariq Toukan commit 1baf30426553efb3ac518b0e9d5c1c3f8ed7762a Author: Saeed Mahameed Date: Mon Jun 16 15:07:59 2025 -0700 net/mlx5: E-Switch, Set/Query hca cap via vhca id Dynamically created vports require vhca id as input to set/query other vport hca cap, when FW is capable and the vhca id of a vport is valid use it instead of the local function id. Signed-off-by: Saeed Mahameed Signed-off-by: Adithya Jayachandran Reviewed-by: Parav Pandit Reviewed-by: Feng Liu Reviewed-by: William Tu Reviewed-by: Mark Bloch commit 864c05b9bc4077c99730512babc991a9d92730e0 Author: Saeed Mahameed Date: Sat Jun 14 02:29:41 2025 -0700 net/mlx5: E-Switch, Cache vport vhca id on first cap query We need vhca_id to set up the vhca_id to vport mapping for every vport, for that we query the firmware in mlx5_esw_vport_vhca_id_set, and it is redundant since in esw_vport_setup, we already query hca caps which has the vhca_id, cache it there and save 2 extra fw queries per vport. Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Signed-off-by: Alexei Lazar Reviewed-by: Feng Liu commit 2335b3f56690f76ac34b972fcaef368bab1f76f2 Author: Saeed Mahameed Date: Mon Jun 16 23:41:53 2025 -0700 net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports Next patches will implement the discovery and creation of adjacent functions vports, this patch introduces the hardware structures definitions needed for the driver implementation. Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Reviewed-by: Jack Morgenstein Signed-off-by: Alexei Lazar commit bb9749f32ad38cf343e6650a34125be6aacd65d1 Author: Alice Ryhl Date: Mon Aug 11 12:31:51 2025 +0000 rust: alloc: take the allocator into account for FOREIGN_ALIGN When converting a Box into a void pointer, the allocator might guarantee a higher alignment than the type itself does, and in that case it is guaranteed that the void pointer has that higher alignment. This is quite useful when combined with the XArray, which you can only create using a ForeignOwnable whose FOREIGN_ALIGN is at least 4. This means that you can now always use a Box with the XArray no matter the alignment of T. Reviewed-by: Benno Lossin Signed-off-by: Alice Ryhl Acked-by: Liam R. Howlett Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250811-align-min-allocator-v2-2-3386cc94f4fc@google.com Signed-off-by: Danilo Krummrich commit 1b1a946dc2b535785663742f9e4f15fd64bece60 Author: Alice Ryhl Date: Mon Aug 11 12:31:50 2025 +0000 rust: alloc: specify the minimum alignment of each allocator The kernel's allocators sometimes provide a higher alignment than the end-user requested, so add a new constant on the Allocator trait to let the allocator specify what its minimum guaranteed alignment is. This allows the ForeignOwnable trait to provide a more accurate value of FOREIGN_ALIGN when using a pointer type such as Box, which will be useful with certain collections such as XArray that store its own data in the low bits of pointers. Reviewed-by: Benno Lossin Signed-off-by: Alice Ryhl Acked-by: Liam R. Howlett Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250811-align-min-allocator-v2-1-3386cc94f4fc@google.com [ Add helper for ARCH_KMALLOC_MINALIGN; remove cast to usize. - Danilo ] Signed-off-by: Danilo Krummrich commit b6a37d1d4694111895248b771513153ccace606a Author: Alistair Popple Date: Wed Jul 30 11:34:17 2025 +1000 rust: Add several miscellaneous PCI helpers Add bindings to obtain a PCI device's resource start address, bus/ device function, revision ID and subsystem device and vendor IDs. These will be used by the nova-core GPU driver which is currently in development. Reviewed-by: Alexandre Courbot Cc: Danilo Krummrich Cc: Bjorn Helgaas Cc: Krzysztof Wilczyński Cc: Miguel Ojeda Cc: Alex Gaynor Cc: Boqun Feng Cc: Gary Guo Cc: Björn Roy Baron Cc: Benno Lossin Cc: Andreas Hindborg Cc: Alice Ryhl Cc: Trevor Gross Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Cc: John Hubbard Cc: Alexandre Courbot Cc: linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Alistair Popple Link: https://lore.kernel.org/r/20250730013417.640593-2-apopple@nvidia.com Signed-off-by: Danilo Krummrich commit cd58b0b11d2160b174f82b71eb3847457aedaeca Author: Alistair Popple Date: Wed Jul 30 11:34:16 2025 +1000 rust: Update PCI binding safety comments and add inline compiler hint Update the safety comments to be consistent with other safety comments in the PCI bindings. Also add an inline compiler hint. Suggested-by: Danilo Krummrich Cc: Danilo Krummrich Cc: Bjorn Helgaas Cc: Krzysztof Wilczyński Cc: Miguel Ojeda Cc: Alex Gaynor Cc: Boqun Feng Cc: Gary Guo Cc: Björn Roy Baron Cc: Benno Lossin Cc: Andreas Hindborg Cc: Alice Ryhl Cc: Trevor Gross Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Cc: John Hubbard Cc: Alexandre Courbot Cc: linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Alistair Popple Link: https://lore.kernel.org/r/20250730013417.640593-1-apopple@nvidia.com Signed-off-by: Danilo Krummrich commit b0d73ad126957df989c26d78bd4747a270244dd0 Author: Abhinav Ananthu Date: Tue Aug 12 09:01:02 2025 +0530 rust: pci: use c_* types via kernel prelude Update PCI FFI callback signatures to use `c_` from the prelude, instead of accessing it via `kernel::ffi::`. Signed-off-by: Abhinav Ananthu Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250812033101.5257-1-abhinav.ogl@gmail.com Signed-off-by: Danilo Krummrich commit 4005dac6573128d6e7b46c4ed43df1b23dab7765 Author: Abhinav Ananthu Date: Tue Aug 12 13:21:10 2025 +0530 rust: auxiliary: Use `c_` types from prelude instead of Update auxiliary FFI callback signatures to reference the `c_` types provided by the kernel prelude, rather than accessing them via `kernel::ffi::`. Signed-off-by: Abhinav Ananthu Link: https://lore.kernel.org/r/20250812075109.4099-1-abhinav.ogl@gmail.com Signed-off-by: Danilo Krummrich commit f87de6919dc126f22c7b5bf92e378f0346f190a8 Author: Onur Özkan Date: Sun Jul 20 12:48:38 2025 +0300 rust: make `kvec::Vec` functions `const fn` Makes various `kvec::Vec` functions `const fn` to allow compile-time evaluation. Signed-off-by: Onur Özkan Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250720094838.29530-4-work@onurozkan.dev Signed-off-by: Danilo Krummrich commit 8d3e8057eeadab134a71d6a495d6f1b6818144fe Author: Onur Özkan Date: Sun Jul 20 12:48:37 2025 +0300 rust: make `ArrayLayout::new_unchecked` a `const fn` Makes `ArrayLayout::new_unchecked` a `const fn` to allow compile-time evaluation. Signed-off-by: Onur Özkan Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250720094838.29530-3-work@onurozkan.dev Signed-off-by: Danilo Krummrich commit bd80c4d6e4b0f3060b00d9d2337c595c6bb1c88f Author: Thomas Weißschuh Date: Wed Aug 13 08:32:13 2025 +0200 kunit: tool: Parse skipped tests from kselftest.h Skipped tests reported by kselftest.h use a different format than KTAP, there is no explicit test name. Normally the test name is part of the free-form string after the SKIP keyword: ok 3 # SKIP test: some reason Extend the parser to handle those correctly. Use the free-form string as test name instead. Link: https://lore.kernel.org/r/20250813-kunit-kselftesth-skip-v1-1-57ae3de4f109@linutronix.de Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 29128da29dbabfe567c0133bf069052d2d5d588c Author: Thomas Weißschuh Date: Wed Aug 13 08:28:30 2025 +0200 kunit: Always descend into kunit directory during build For kbuild to properly clean up these build artifacts in the subdirectory, even after CONFIG_KUNIT changed do disabled, the directory needs to be processed always. Pushing the special logic for hook.o into the kunit Makefile also makes the logic easier to understand. Link: https://lore.kernel.org/r/20250813-kunit-always-descend-v1-1-7bbd387ff13b@linutronix.de Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 7de0eebbb4c3bb44c296f66679ad37480139dc6e Author: Wang Liang Date: Thu Aug 14 12:23:55 2025 +0800 net: bridge: remove unused argument of br_multicast_query_expired() Since commit 67b746f94ff3 ("net: bridge: mcast: make sure querier port/address updates are consistent"), the argument 'querier' is unused, just get rid of it. Signed-off-by: Wang Liang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250814042355.1720755-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit d2fa0ec6e0aea6ffbd41939d0c7671db16991ca4 Author: Chenglei Xie Date: Thu Aug 7 16:52:34 2025 -0400 drm/amdgpu: refactor bad_page_work for corner case handling When a poison is consumed on the guest before the guest receives the host's poison creation msg, a corner case may occur to have poison_handler complete processing earlier than it should to cause the guest to hang waiting for the req_bad_pages reply during a VF FLR, resulting in the VM becoming inaccessible in stress tests. To fix this issue, this patch refactored the mailbox sequence by seperating the bad_page_work into two parts req_bad_pages_work and handle_bad_pages_work. Old sequence: 1.Stop data exchange work 2.Guest sends MB_REQ_RAS_BAD_PAGES to host and keep polling for IDH_RAS_BAD_PAGES_READY 3.If the IDH_RAS_BAD_PAGES_READY arrives within timeout limit, re-init the data exchange region for updated bad page info else timeout with error message New sequence: req_bad_pages_work: 1.Stop data exhange work 2.Guest sends MB_REQ_RAS_BAD_PAGES to host Once Guest receives IDH_RAS_BAD_PAGES_READY event handle_bad_pages_work: 3.re-init the data exchange region for updated bad page info Signed-off-by: Chenglei Xie Reviewed-by: Shravan Kumar Gande Signed-off-by: Alex Deucher commit fc4e990a326e608eb8937eba737908c660b7a410 Author: Qiang Liu Date: Tue Aug 12 20:30:21 2025 +0800 drm/amdgpu: remove duplicated argument wptr_va The duplicate judgment of wptr_va could be removed to simplify the logic Signed-off-by: Qiang Liu Signed-off-by: Alex Deucher commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 Author: Srinivasan Shanmugam Date: Wed Aug 13 12:14:01 2025 +0530 drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set_cursor_attributes() currently dereferences the `stream` pointer and nested members `stream->ctx->dc->current_state` without checking for NULL. All callers of these functions, such as in `dcn30_apply_idle_power_optimizations()` and `amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks before calling these functions. Fixes below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() error: we previously assumed 'stream' could be null (see line 334) drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c 327 bool dc_stream_program_cursor_attributes( 328 struct dc_stream_state *stream, 329 const struct dc_cursor_attributes *attributes) 330 { 331 struct dc *dc; 332 bool reset_idle_optimizations = false; 333 334 dc = stream ? stream->ctx->dc : NULL; ^^^^^^ The old code assumed stream could be NULL. 335 --> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) { ^^^^^^ The refactor added an unchecked dereference. drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c 313 bool dc_stream_set_cursor_attributes( 314 struct dc_stream_state *stream, 315 const struct dc_cursor_attributes *attributes) 316 { 317 bool result = false; 318 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. This function used to check for if stream as NULL and return false at the start. Probably we should add that back. Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic") Reported-by: Dan Carpenter Cc: Alex Hung Cc: Alvin Lee Cc: Ray Wu Cc: Dillon Varone Cc: Aurabindo Pillai Cc: Roman Li Cc: ChiaHsuan Chung Cc: Harry Wentland Cc: Daniel Wheeler Cc: Tom Chung Cc: Wenjing Liu Cc: Jun Lei Signed-off-by: Srinivasan Shanmugam Reviewed-by: Dillon Varone Signed-off-by: Alex Deucher commit 300d3e2d478d0d60dd60ab4800319b6257abf926 Author: Alexandre Demers Date: Tue Aug 12 20:46:25 2025 -0400 drm/radeon: fix typos Various small typos found around. Signed-off-by: Alexandre Demers Signed-off-by: Alex Deucher commit 54f7f3ca982af73512e5dfd541fe20dc72673180 Author: Alex Deucher Date: Fri Aug 8 13:12:07 2025 -0400 drm/amdgpu/swm14: Update power limit logic Take into account the limits from the vbios. Ported from the SMU13 code. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4352 Reviewed-by: Jesse Zhang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 8a358aaa5d171512c07e8eb87b4600ebc844e6c7 Author: Lijo Lazar Date: Tue Aug 12 13:21:49 2025 +0530 drm/amd/pm: Free SMUv13.0.6 resources on failure Free the resources allocated if smu_v13_0_12_tables_init fails. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Fixes: 5bf93e1d6efd ("drm/amd/pm: Add caching to SMUv13.0.12 temp metric") Signed-off-by: Alex Deucher commit 655d6403ad143feffb2d747b9eb9a0ce4e12b713 Author: Jesse.Zhang Date: Wed Aug 13 10:55:44 2025 +0800 drm/amd/vcn: Add late_init callback for VCN v4.0.3 reset handling This change reorganizes VCN reset capability detection by: 1. Moving reset mask configuration from sw_init to new late_init phase 2. Adding vcn_v4_0_3_late_init() to properly check for per-queue reset support 3. Only setting soft full reset mask as fallback when per-queue reset isn't supported 4. Removing TODO comment now that queue reset support is implemented V2: Removed unrelated changes. Keep amdgpu_get_soft_full_reset_mask in place and remove TODO comment. (Alex) v3: set the flags at one place (all in late_init) (Lijo) Suggested-by: Alex Deucher Signed-off-by: Ruili Ji Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 0ed704d058cec7643a716a21888d58c7d03f2c3e Author: Kent Russell Date: Mon Jul 21 14:06:36 2025 -0400 drm/amdkfd: Handle lack of READ permissions in SVM mapping HMM assumes that pages have READ permissions by default. Inside svm_range_validate_and_map, we add READ permissions then add WRITE permissions if the VMA isn't read-only. This will conflict with regions that only have PROT_WRITE or have PROT_NONE. When that happens, svm_range_restore_work will continue to retry, silently, giving the impression of a hang if pr_debug isn't enabled to show the retries.. If pages don't have READ permissions, simply unmap them and continue. If they weren't mapped in the first place, this would be a no-op. Since x86 doesn't support write-only, and PROT_NONE doesn't allow reads or writes anyways, this will allow the svm range validation to continue without getting stuck in a loop forever on mappings we can't use with HMM. Signed-off-by: Kent Russell Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 9d20f37a106f30f0d867e2f8521788f88dd9ed49 Author: Jesse.Zhang Date: Wed Aug 13 10:40:18 2025 +0800 drm/amd/pm: Add VCN reset support for SMU v13.0.6 This commit implements VCN reset capability for SMU v13.0.6 with the following changes: 1. Added new PPSMC message ID (0x5B) for VCN reset in SMU firmware interface 2. Extended SMU capabilities to include VCN_RESET support 3. Implemented VCN reset support check: - Added smu_v13_0_6_reset_vcn_is_supported() function 4. Updated SMU v13.0.6 PPT functions to include VCN reset operations v2: clean up debug info (Alex) v3: remove unsupported message and split smu v13.0.6 changes to a separate patch (Lijo) v4: simply the function (smu_v13_0_6_reset_vcn_is_supported) (Lijo) Suggested-by: Alex Deucher Signed-off-by: Ruili Ji Signed-off-by: Jesse Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 37b9257be7cdab4d84958202f499e3c8b66abeb8 Author: Jesse.Zhang Date: Wed Aug 13 10:36:58 2025 +0800 drm/amd/pm: Add VCN reset support check capability This change introduces infrastructure to check whether VCN reset is supported by the SMU firmware. Key changes include: 1. Added new functions to query VCN reset support: - amdgpu_dpm_reset_vcn_is_supported() - smu_reset_vcn_is_supported() - pptable_funcs.reset_vcn_is_supported callback 2. Implemented proper locking in the DPM layer with mutex protection 3. Maintained consistency with existing SDMA reset support checks The new capability allows callers to check for VCN reset support before attempting the operation, preventing unnecessary attempts on unsupported platforms. v2: clean up debug info(Alex) Suggested-by: Alex Deucher Signed-off-by: Ruili Ji Signed-off-by: Jesse Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 859958a7faefe5b7742b7b8cdbc170713d4bf158 Author: Heng Zhou Date: Wed Aug 13 11:18:04 2025 +0800 drm/amdgpu: fix nullptr err of vm_handle_moved If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL. So, such kind of amdgpu_bo_va should be updated separately before amdgpu_vm_handle_moved. Signed-off-by: Heng Zhou Reviewed-by: Kasiviswanathan, Harish Signed-off-by: Alex Deucher commit 3a75edf93aaec4a3178bdae64723fb41992398f2 Author: Eric Huang Date: Thu Aug 7 14:23:11 2025 -0400 drm/amdkfd: set uuid for each partition in topology Currently each kfd compute partition/node is sharing the same uuid of AID, which doen't meet the CUDA spec for visible device, so corresponding XCD id for each partition in smu has been assigned to xcp, and exposed to kfd topology. v2: add NULL check (Lijo) Signed-off-by: Eric Huang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 5c8d5e2619f7d2985adfe45608dc942ca8151aa3 Author: Qianfeng Rong Date: Tue Aug 12 16:31:49 2025 +0800 drm/amd/display: Use boolean context for pointer null checks Replace "out == 0" with "!out" for pointer comparison to improve code readability and conform to coding style. Signed-off-by: Qianfeng Rong Signed-off-by: Alex Deucher commit 90b810dd859c0df9db2290da1ac5842e5f031267 Author: Liao Yuanhong Date: Tue Aug 12 15:50:14 2025 +0800 drm/amd/display: Remove redundant semicolons Remove unnecessary semicolons. Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") Signed-off-by: Liao Yuanhong Signed-off-by: Alex Deucher commit 3e03525ce15cb9fc633b3d0266866020e22ce5e6 Author: Xichao Zhao Date: Tue Aug 12 11:16:03 2025 +0800 drm/radeon: replace min/max nesting with clamp() The clamp() macro explicitly expresses the intent of constraining a value within bounds.Therefore, replacing min(max(a, b), c) and max(min(a,b),c) with clamp(val, lo, hi) can improve code readability. Reviewed-by: Christian König Signed-off-by: Xichao Zhao Signed-off-by: Alex Deucher commit 0ec417aa85467c6fad0563621b74868be0faf00d Author: Šerif Rami Date: Thu Aug 14 19:22:22 2025 +0200 ALSA: usb-audio: Add infrastructure for TASCAM US-144MKII This commit adds Kconfig and Makefile entries for TASCAM US-144MKII USB audio/MIDI interface support. It includes the configuration option and links new driver files. The Kconfig entry for US-144MKII is added. The Makefile is updated to compile new driver components. The US-122L driver's device ID table is adjusted to remove the US-144MKII entry, as it will now be handled by its dedicated driver. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-8-ramiserifpersia@gmail.com commit fdd1a1ae55b15b3ed0f9d026b995fd00bef68a0c Author: Šerif Rami Date: Thu Aug 14 19:22:21 2025 +0200 ALSA: usb-audio: us144mkii: Add deep sleep command Add a deep sleep vendor command to be sent during suspend, allowing the device to enter a lower power state. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-7-ramiserifpersia@gmail.com commit 67afec157fe63d37f0d8f46fbe11a61364718ece Author: Šerif Rami Date: Thu Aug 14 19:22:20 2025 +0200 ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls This patch adds the remaining features to the driver: MIDI I/O and ALSA mixer controls. A raw MIDI device is created, supporting one input and one output port. The implementation handles the device-specific 9-byte packet format for both sending and receiving MIDI data, using bulk URBs and workqueues for processing. ALSA kcontrols are added to the mixer interface, allowing user-space control over the audio routing matrix (e.g., selecting analog/digital sources for capture channels, and routing playback streams to different outputs). A read-only control to display the current sample rate is also included. Finally, the stub routing functions are replaced with the full logic to apply the user-selected mixer settings to the audio streams. With this commit, the driver is feature-complete. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-6-ramiserifpersia@gmail.com commit c1bb0c13e430623c26543baae5bb9ae21139db87 Author: Šerif Rami Date: Thu Aug 14 19:22:19 2025 +0200 ALSA: usb-audio: us144mkii: Implement audio capture and decoding This patch adds the full audio capture data path. It allocates and manages bulk URBs to receive audio data from the device. The incoming data is in a custom multiplexed format. A workqueue is used to offload the decoding process from the interrupt context. The `capture_urb_complete` handler copies raw data into a ring buffer and schedules the work. The `tascam_capture_work_handler` then reads from this buffer, decodes the data into standard S32_LE samples, and copies it to the ALSA capture buffer. The PCM trigger is updated to manage the submission of capture URBs, and the feedback handler now also advances the capture stream pointer to keep it synchronized with playback. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-5-ramiserifpersia@gmail.com commit a2a2210f2c2e65a39631e4be727f1f9cc155171a Author: Šerif Rami Date: Thu Aug 14 19:22:18 2025 +0200 ALSA: usb-audio: us144mkii: Implement audio playback and feedback This patch implements the full audio playback data path. It introduces the allocation, submission, and completion handling for isochronous playback and feedback URBs. The feedback URB completion handler is the core of the driver's clocking mechanism. It reads the number of samples consumed by the device and uses a pattern-based algorithm to adjust the size of outgoing playback packets. This keeps the host and device synchronized and prevents xruns. The patch also adds the necessary vendor and UAC control messages to configure the device's sample rate. The PCM trigger is updated to start and stop the playback and feedback URBs. Basic suspend and resume handlers are included to manage stream state across power cycles. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-4-ramiserifpersia@gmail.com commit 5c8c10796e274d1b5bb48756a45a6f2e865b30f2 Author: Šerif Rami Date: Thu Aug 14 19:22:17 2025 +0200 ALSA: usb-audio: us144mkii: Add PCM core infrastructure This patch adds the ALSA PCM device infrastructure. It creates a new PCM device with one playback and one capture stream. The hardware capabilities (formats, rates, channels) are defined in `tascam_pcm_hw`. The core PCM operations (`snd_pcm_ops`) for both playback and capture are implemented, including open, close, hw_params, prepare, and pointer callbacks. The trigger callback is a stub for now. This commit allows user-space applications to interact with the ALSA device, but no audio will be streamed yet. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-3-ramiserifpersia@gmail.com commit dee1bcf28a3dd13ddb2e9200407864f73e9c4d63 Author: Šerif Rami Date: Thu Aug 14 19:22:16 2025 +0200 ALSA: usb-audio: Add initial driver for TASCAM US-144MKII This patch introduces a new driver for the TASCAM US-144MKII USB audio/MIDI interface. It includes the basic driver structure for probing and disconnecting from the USB device. It correctly identifies the device using its VID/PID, performs the necessary initial handshake, and sets the required USB interface alternate settings to prepare the device for operation. At this point, no ALSA devices (PCM or MIDI) are created. This commit forms the foundational skeleton upon which audio and MIDI functionality will be built. Signed-off-by: Šerif Rami Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250814172222.9448-2-ramiserifpersia@gmail.com commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 Author: Dmitry Baryshkov Date: Sat Aug 2 13:40:35 2025 +0300 drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts Detecting the monitor for DisplayPort targets is more complicated than just reading the HPD pin level: it requires reading the DPCD in order to check what kind of device is attached to the port and whether there is an actual display attached. In order to let DRM framework handle such configurations, disable DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so it is valid for the bridge to report HPD events. Currently inside the kernel there are only two targets which list hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and arm64/qcom/sa8295p-adp. Both should be fine with this change. Cc: Bjorn Andersson Cc: Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org Acked-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 646dc268ec25810e7d6aebef1a58ad837b4378d5 Author: Sakari Ailus Date: Fri Jul 4 10:54:11 2025 +0300 drm/panfrost: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250704075411.3218059-1-sakari.ailus@linux.intel.com commit f8f59a2c05dc16d19432e3154a9ac7bc385f4b92 Author: Miklos Szeredi Date: Wed Aug 13 17:11:05 2025 +0200 copy_file_range: limit size if in compat mode If the process runs in 32-bit compat mode, copy_file_range results can be in the in-band error range. In this case limit copy length to MAX_RW_COUNT to prevent a signed overflow. Reported-by: Florian Weimer Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/ Signed-off-by: Miklos Szeredi Link: https://lore.kernel.org/20250813151107.99856-1-mszeredi@redhat.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 15769d9478bdb3e09184c5adbab6e2d2dfcbf1b1 Author: Qianfeng Rong Date: Sun Aug 3 18:22:42 2025 +0800 fs-writeback: Remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/20250803102243.623705-5-rongqianfeng@vivo.com Signed-off-by: Christian Brauner commit 13120abdb0d70431fb0c0cda29bec184aee782a6 Author: Tomasz Pakuła Date: Wed Aug 13 22:10:05 2025 +0200 HID: pidff: Reduce PID_EFFECT_OPERATION spam Keep track of effect's loop_count to reduce the spam of ffb play commands coming from some games. This should speed up normal magnitude etc updates and slightly increase max possible FFB refresh rate. Helps games like Dirt Rally 2.0, F1 2023, WRC from KT Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 5b9cae8c6472e44702b2c19e78055248fab94043 Author: Tomasz Pakuła Date: Wed Aug 13 22:10:04 2025 +0200 HID: universal-pidff: clang-format pass Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit ae42428fb4e3d2eed344f0d6fcfa778bc8b8f80a Author: Tomasz Pakuła Date: Wed Aug 13 22:10:03 2025 +0200 HID: pidff: clang-format pass Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 63cc21dd8be7cff663309750bb609d5b2e888c8b Author: Tomasz Pakuła Date: Wed Aug 13 22:10:02 2025 +0200 HID: pidff: Define all cardinal directions Will be used by ff-effect based autocentering Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 82b2496227337b4651f32f336645ccc4c14054a3 Author: Tomasz Pakuła Date: Wed Aug 13 22:10:01 2025 +0200 HID: pidff: Remove Anssi's email address from info msg Some users might try to contact him about issues and he's no longer active when it comes to the driver development/fixes. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit c2dc9f0b368c08c34674311cf78407718d5715a7 Author: Tomasz Pakuła Date: Wed Aug 13 22:10:00 2025 +0200 HID: pidff: PERMISSIVE_CONTROL quirk autodetection Fixes force feedback for devices built with MMOS firmware and many more not yet detected devices. Update quirks mask debug message to always contain all 32 bits of data. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit c774a9d78dba045e6d044e7a7e4fbb6deb0e9cbf Author: Tomasz Pakuła Date: Wed Aug 13 22:09:59 2025 +0200 HID: pidff: Separate check for infinite duration It will be used in a few more places so this makes sure it will always work the same. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 7fbaa031b94182a9c9e58310935a2f74265ef78d Author: Tomasz Pakuła Date: Wed Aug 13 22:09:58 2025 +0200 HID: pidff: Rework pidff_upload_effect One of the more complicated functions. Expunge some of the logic to separate functions (FF -> PID id conversion) Add a macro for envelope check to make it more readable in the upload function. All this made it possible to to expunge common code from the big switch statement and reduce the overall function size considerably. Now it can fit on one screen. Move the effect_cout logic from report functions to upload/erase functions. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 1abfcd86e38c3466acefd0069bf6b3c2514fb886 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:57 2025 +0200 HID: pidff: Update debug messages Signed-off-by: Tomasz Pakuła Better indicate what operation is requested on a given effect (play or stop). Previously, we only had the info about requesting playback but this could be misleading when the looop count is 0. Add debug print that shows what device control command was actually sent to the device. Print out its hex hid usage. Make field_index const to make sure it won't be changed by mistake later. Signed-off-by: Jiri Kosina commit 1d72e7bd340b552160df0baca1a85fd1992abe49 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:56 2025 +0200 HID: pidff: Add support for AXES_ENABLE field AXES_ENABLE can be used in place of DIRECTION_ENABLE to indicate, which FFB-enabled axes will be affected by a given effect. EFFECT_DIRECTION enables all and uses the first direction only while AXES_ENABLE is a bitmask and bit indexes are the same as the defined GD usages in the EFFECT_DIRECTION array. Each axis can have it's own direction in this case. Search for AXES_ENABLE, set AXES_ENABLE for all axes if DIRECTION_ENABLE is not used. Search for specific axes in the direction array. Save their indexes. This let us know what axes are actually available on the device and which bit in the AXES_ENABLE field corresponds to which axis. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit b974b372a9b0aa409ccf05dae8a267d4486f37b4 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:55 2025 +0200 HID: pidff: Simplify HID field/usage searching logic Some deduplication and splitting into separate functions. This is now way easier to comprehend and parse mentally. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e Author: Tomasz Pakuła Date: Wed Aug 13 22:09:54 2025 +0200 HID: pidff: Better quirk assigment when searching for fields Assign quirks directly when they're discovered. Way easier to understand without relying on return values. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit c7ad7812fb8c9319a5148b3c8f14b0b0b3d7e015 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:53 2025 +0200 HID: pidff: Treat PID_REQUIRED_REPORTS as count, not max It's naming suggests it's a count of the records required by the USB PID standard and this driver. Signed-off-by: Tomasz Pakuła Reviewed-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit 8de2cef6d0de8cdddee8d653a18791525af26fad Author: Tomasz Pakuła Date: Wed Aug 13 22:09:52 2025 +0200 HID: pidff: Use ARRAY_SIZE macro instead of sizeof Could lead to issues when arrays won't be 8 bit fields Signed-off-by: Tomasz Pakuła Reviewed-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit 6513cfdd838e18c9d2289b0d19474936e37ee5cb Author: Tomasz Pakuła Date: Wed Aug 13 22:09:51 2025 +0200 HID: pidff: Remove unneeded debug All the envelope settings work correctly and even if we wanted to debug something about the envelope report, we would not only need the attack level but it's length and fade properties to have a full image. Signed-off-by: Tomasz Pakuła Reviewed-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit a02c78f708515b236086bf0a9ad4ac7884e78546 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:50 2025 +0200 HID: pidff: Remove unhelpful pidff_set_actuators helper Abstracts away too little of the functionality and replaces a nice, defined value with a magic bool. There's no actual need for it. Signed-off-by: Tomasz Pakuła Reviewed-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit f345a4798dab800159b09d088e7bdae0f16076c3 Author: Tomasz Pakuła Date: Wed Aug 13 22:09:49 2025 +0200 HID: pidff: Use direction fix only for conditional effects The already fixed bug in SDL only affected conditional effects. This should fix FFB in Forza Horizion 4/5 on Moza Devices as Forza Horizon flips the constant force direction instead of using negative magnitude values. Changing the direction in the effect directly in pidff_upload_effect() would affect it's value in further operations like comparing to the old effect and/or just reading the effect values in the user application. This, in turn, would lead to constant PID_SET_EFFECT spam as the effect direction would constantly not match the value that's set by the application. This way, it's still transparent to any software/API. Only affects conditional effects now so it's better for it to explicitly state that in the name. If any HW ever needs fixed direction for other effects, we'll add more quirks. Signed-off-by: Tomasz Pakuła Reviewed-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit 2eb676f1410dd7c3aa91534cbf86dfb1dee3bc7c Author: Bjorn Andersson Date: Fri Aug 15 08:51:32 2025 -0500 Revert "arm64: dts: qcom: sm8450: add initial device tree for Samsung Galaxy S22" This reverts commit 46952305d2b6 ("arm64: dts: qcom: sm8450: add initial device tree for Samsung Galaxy S22"), as the merged version had been superseded and received further feedback. Signed-off-by: Bjorn Andersson commit 63e0b17ae79a4365e874d7e2ff3816db2e6d55b5 Author: Jani Nikula Date: Thu Aug 14 16:24:45 2025 +0300 drm/i915/bo: remove unnecessary include intel_bo.c doesn't need intel_display_types.h for anything. Remove. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/20250814132445.1573035-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 448f97fba9013ffa13f5dd82febd18836b189499 Author: Thomas Gleixner Date: Tue Aug 12 12:39:13 2025 +0200 perf: Convert mmap() refcounts to refcount_t The recently fixed reference count leaks could have been detected by using refcount_t and refcount_t would have mitigated the potential overflow at least. Now that the code is properly structured, convert the mmap() related mmap_count variants over to refcount_t. No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104020.071507932@infradead.org commit 59741451b49ce9964a9758c19d6f7df2a1255c75 Author: Peter Zijlstra Date: Tue Aug 12 12:39:12 2025 +0200 perf: Identify the 0->1 transition for event::mmap_count Needed because refcount_inc() doesn't allow the 0->1 transition. Specifically, this is the case where we've created the RB, this means there was no RB, and as such there could not have been an mmap. Additionally we hold mmap_mutex to serialize everything. This must be the first. Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250812104019.956479989@infradead.org commit d23a6dbc0a71741eb7b141fdc04e31360fba46ef Author: Peter Zijlstra Date: Tue Aug 12 12:39:11 2025 +0200 perf: Use scoped_guard() for mmap_mutex in perf_mmap() Mostly just re-indent noise. Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.838047976@infradead.org commit 5d299897f1e36025400ca84fd36c15925a383b03 Author: Peter Zijlstra Date: Tue Aug 12 12:39:10 2025 +0200 perf: Split out the RB allocation Move the RB buffer allocation branch into its own function. Originally-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.722214699@infradead.org commit 191759e5ea9f6995171ed2ffcc41a2377f946a3a Author: Peter Zijlstra Date: Tue Aug 12 12:39:09 2025 +0200 perf: Make RB allocation branch self sufficient Ensure @rb usage doesn't extend out of the branch block. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.605285302@infradead.org commit 2aee37682391332d26c01e703170e0d9358c7252 Author: Peter Zijlstra Date: Tue Aug 12 12:39:08 2025 +0200 perf: Split out the AUX buffer allocation Move the AUX buffer allocation branch into its own function. Originally-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.494205648@infradead.org commit 8558dca9fbdf825edf30b5fb74fbbbf3e6ba5dce Author: Peter Zijlstra Date: Tue Aug 12 12:39:07 2025 +0200 perf: Reflow to get rid of aux_success label Mostly re-indent noise needed to get rid of that label. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.362581570@infradead.org commit b33a51564e3eb6c468979f9f08d9b4ad8451bed7 Author: Peter Zijlstra Date: Tue Aug 12 12:39:06 2025 +0200 perf: Use guard() for aux_mutex in perf_mmap() After duplicating the common code into the rb/aux branches is it possible to use a simple guard() for the aux_mutex. Making the aux branch self-contained. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.246250452@infradead.org commit 41b80e1d74bdef5e48ea63d186244b9f6f82a4da Author: Peter Zijlstra Date: Tue Aug 12 12:39:05 2025 +0200 perf: Remove redundant aux_unlock label unlock and aux_unlock are now identical, remove the aux_unlock one. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.131293512@infradead.org commit 4118994b33bb628dd9aeb941c5af6f950f1dea90 Author: Peter Zijlstra Date: Tue Aug 12 12:39:04 2025 +0200 perf: Move common code into both rb and aux branches if (cond) { A; } else { B; } C; into if (cond) { A; C; } else { B; C; } Notably C has a success branch and both A and B have two places for success. For A (rb case), duplicate the success case because later patches will result in them no longer being identical. For B (aux case), share using goto (cleaned up later). Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104019.016252852@infradead.org commit 3821f258686691cf12bbfc636ab22fa2b049dc86 Author: Peter Zijlstra Date: Tue Aug 12 12:39:03 2025 +0200 perf: Merge consecutive conditionals in perf_mmap() if (cond) { A; } else { B; } if (cond) { C; } else { D; } into: if (cond) { A; C; } else { B; D; } Notably the conditions are not identical in form, but are equivalent. Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104018.900078502@infradead.org commit 86a0a7c59845e7093c9c73a7115c9d86349499d1 Author: Peter Zijlstra Date: Tue Aug 12 12:39:02 2025 +0200 perf: Move perf_mmap_calc_limits() into both rb and aux branches if (cond) { A; } else { B; } C; into if (cond) { A; C; } else { B; C; } Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104018.781244099@infradead.org commit 1ea3e3b0dadc06c5e6c1bdf5312e70ee861b1ba0 Author: Thomas Gleixner Date: Tue Aug 12 12:39:01 2025 +0200 perf: Split out VM accounting Similarly to the mlock limit calculation the VM accounting is required for both the ringbuffer and the AUX buffer allocations. To prepare for splitting them out into separate functions, move the accounting into a helper function. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104018.660347811@infradead.org commit 81e026ca47b386e4213c1beff069038a3ba8bb76 Author: Thomas Gleixner Date: Tue Aug 12 12:39:00 2025 +0200 perf: Split out mlock limit handling To prepare for splitting the buffer allocation out into separate functions for the ring buffer and the AUX buffer, split out mlock limit handling into a helper function, which can be called from both. No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104018.541975109@infradead.org commit e8c4f6ee8eeed8e02800bed6afb9aa22fc3476a1 Author: Thomas Gleixner Date: Tue Aug 12 12:38:59 2025 +0200 perf: Remove redundant condition for AUX buffer size It is already checked whether the VMA size is the same as nr_pages * PAGE_SIZE, so later checking both: aux_size == vma_size && aux_size == nr_pages * PAGE_SIZE is redundant. Remove the vma_size check as nr_pages is what is actually used in the allocation function. That prepares for splitting out the buffer allocation into separate functions, so that only nr_pages needs to be handed in. No functional change. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250812104018.424519320@infradead.org commit f9c67b019bc3c0324ee42c0dbfbb2d55726d751e Author: Karunika Choo Date: Thu Aug 7 17:26:33 2025 +0100 drm/panthor: Add support for Mali-Gx20 and Mali-Gx25 GPUs This patch adds firmware binary and GPU model naming support for Mali-Gx20 and Mali-Gx25 GPUs. Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-8-karunika.choo@arm.com commit dd11c7dec74b0e125b75def169a53f3c86f35d6d Author: Karunika Choo Date: Thu Aug 7 17:26:32 2025 +0100 drm/panthor: Make MMU cache maintenance use FLUSH_CACHES command As the FLUSH_MEM and FLUSH_PT MMU_AS commands are deprecated in GPUs from Mali-Gx20 onwards, this patch adds support for performing cache maintenance via the FLUSH_CACHES command in GPU_COMMAND in place of FLUSH_MEM and FLUSH_PT commands. Mali-Gx10 and Mali-Gx15 GPUs also has support for the FLUSH_CACHES command and will also use this by default going forward. Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-7-karunika.choo@arm.com commit e322a4844811b54477b7072eb40dc9e402a1725d Author: Karunika Choo Date: Thu Aug 7 17:26:31 2025 +0100 drm/panthor: Serialize GPU cache flush operations In certain scenarios, it is possible for multiple cache flushes to be requested before the previous one completes. This patch introduces the cache_flush_lock mutex to serialize these operations and ensure that any requested cache flushes are completed instead of dropped. Reviewed-by: Liviu Dudau Co-developed-by: Dennis Tsiang Signed-off-by: Dennis Tsiang Signed-off-by: Karunika Choo Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-6-karunika.choo@arm.com commit 3b1dc21d6d800cb86c1ef0c97968f5c783343f2b Author: Karunika Choo Date: Thu Aug 7 17:26:30 2025 +0100 drm/panthor: Add support for Mali-Gx15 family of GPUs Mali-Gx15 introduces a new GPU_FEATURES register that provides information about GPU-wide supported features. The register value will be passed on to userspace via gpu_info. Additionally, Mali-Gx15 presents an 'Immortalis' naming variant depending on the shader core count and presence of Ray Intersection feature support. This patch adds: - support for correctly identifying the model names for Mali-Gx15 GPUs. - arch 11.8 FW binary support Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-5-karunika.choo@arm.com commit 2c0d0a81c0ad5a7271177b016014360c331ad62c Author: Karunika Choo Date: Thu Aug 7 17:26:29 2025 +0100 drm/panthor: Add support for Mali-G710, Mali-G510 and Mali-G310 This patch adds GPU model name and FW binary support for Mali-G710, Mali-G510, and Mali-G310. Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-4-karunika.choo@arm.com commit c012663b178c4e6fb0179c2816fb0a270f080b59 Author: Karunika Choo Date: Thu Aug 7 17:26:28 2025 +0100 drm/panthor: Simplify getting the GPU model name This patch replaces the panthor_model structure with a simple switch case based on the product_id which is in the format of: ((arch_major << 24) | product_major) This simplifies comparison and allows extending of the function to accommodate naming differences based on supported GPU features. Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-3-karunika.choo@arm.com commit 94332524b5ccf9cfcb3c6184f1b9d6be65c6aad6 Author: Karunika Choo Date: Thu Aug 7 17:26:27 2025 +0100 drm/panthor: Add panthor_hw and move gpu_info initialization into it This patch introduces panthor_hw and moves the initialization of the gpu_info struct into panthor_hw.c in preparation of handling future GPU register and naming changes. Future GPU support can be added by extending panthor_gpu_info_init() with the necessary register reads behind GPU architecture version guards if the change is minor. For more complex changes, the function can be forked and the appropriate function will need to be called based on the GPU architecture version. Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Signed-off-by: Karunika Choo Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250807162633.3666310-2-karunika.choo@arm.com commit 5d6d30eca4dd1c9e8515a8d4b13106205d5c0ec4 Author: Nathan Chancellor Date: Thu Aug 14 18:31:37 2025 -0700 x86/build: Remove cc-option for GCC retpoline flags The minimum supported version of GCC to build the x86 kernel was bumped to GCC 8.1 in a3e8fe814ad1 ("x86/build: Raise the minimum GCC version to 8.1"). '-mindirect-branch' and '-mindirect-branch-register' were first supported in GCC 8.1, so there is no need to call cc-option to inquire if it is supported. Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=da99fd4a3ca06b43b08ba8d96dab84e83ac90aa7 Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d543c04b795f8af4ebe5b3d5f38156ef4e5734f1 Link: https://lore.kernel.org/20250814-x86-min-ver-cleanups-v1-1-ff7f19457523@kernel.org commit dc0fe956144d9ba906bc6b2fe35b3cd54e1bfdb0 Author: Pu Lehui Date: Sat Jul 19 09:17:30 2025 +0000 selftests/bpf: Enable arena atomics tests for RV64 Enable arena atomics tests for RV64. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-11-pulehui@huaweicloud.com commit fb7cefabae8117c203155ef169a386bec43bbba9 Author: Pu Lehui Date: Sat Jul 19 09:17:29 2025 +0000 riscv, bpf: Add support arena atomics for RV64 Add arena atomics support for RMW atomics and load-acquire and store-release instructions. Non-Zacas cmpxchg is implemented via loop, which is not currently supported because it requires more complex extable and loop logic. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-10-pulehui@huaweicloud.com commit b18f4aae6a5db5ada5aba02b43dbdd3909e5f87c Author: Pu Lehui Date: Sat Jul 19 09:17:28 2025 +0000 riscv, bpf: Add ex_insn_off and ex_jmp_off for exception table handling Add ex_insn_off and ex_jmp_off fields to struct rv_jit_context so that add_exception_handler() does not need to be immediately followed by the instruction to add the exception table. ex_insn_off indicates the offset of the instruction to add the exception table, and ex_jmp_off indicates the offset to jump over the faulting instruction. This is to prepare for adding the exception table to atomic instructions later, because some atomic instructions need to perform zext or other operations. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-9-pulehui@huaweicloud.com commit 1c0196b878a69927449d649163388ad63cafcacb Author: Pu Lehui Date: Sat Jul 19 09:17:27 2025 +0000 riscv, bpf: Optimize cmpxchg insn with Zacas support Optimize cmpxchg instruction with amocas.w and amocas.d Zacas instructions. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-8-pulehui@huaweicloud.com commit de39d2c4cdb68ece47ff9609dd5c9e87b918d1bd Author: Pu Lehui Date: Sat Jul 19 09:17:26 2025 +0000 riscv, bpf: Add Zacas instructions Add Zacas instructions introduced by [0] to reduce code size and improve performance of RV64 JIT. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://github.com/riscvarchive/riscv-zacas/releases/download/v1.0/riscv-zacas.pdf [0] Link: https://lore.kernel.org/bpf/20250719091730.2660197-7-pulehui@huaweicloud.com commit 5090b339eeb3417baa940d690923e630e077d8f8 Author: Pu Lehui Date: Sat Jul 19 09:17:25 2025 +0000 riscv, bpf: Add rv_ext_enabled macro for runtime detection extentsion Add rv_ext_enabled macro to check whether the runtime detection extension is enabled. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-6-pulehui@huaweicloud.com commit ec74ae56626bad5707d677d3bf05a1e3350a971e Author: Pu Lehui Date: Sat Jul 19 09:17:24 2025 +0000 riscv: Separate toolchain support dependency from RISCV_ISA_ZACAS RV64 bpf is going to support ZACAS instructions. Let's separate toolchain support dependency from RISCV_ISA_ZACAS. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-5-pulehui@huaweicloud.com commit 01422a4f2c78c69febeafb9110d013f2bb46c58f Author: Pu Lehui Date: Sat Jul 19 09:17:23 2025 +0000 riscv, bpf: Extract emit_ldx() helper There's a lot of redundant code related to load into register operations, let's extract emit_ldx() to make code more compact. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-4-pulehui@huaweicloud.com commit d92c11a6b55b16a679c8533119ee77baf098cb4e Author: Pu Lehui Date: Sat Jul 19 09:17:22 2025 +0000 riscv, bpf: Extract emit_st() helper There's a lot of redundant code related to store from immediate operations, let's extract emit_st() to make code more compact. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-3-pulehui@huaweicloud.com commit 02fc01adec1c4b107fed08c30ac979b62136998f Author: Pu Lehui Date: Sat Jul 19 09:17:21 2025 +0000 riscv, bpf: Extract emit_stx() helper There's a lot of redundant code related to store from register operations, let's extract emit_stx() to make code more compact. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250719091730.2660197-2-pulehui@huaweicloud.com commit 7c79b8aa91413f6ce2e6b18d02689db615085c95 Author: Jani Nikula Date: Fri Aug 1 15:28:32 2025 +0300 drm/i915/audio: drop irq enabled check from LPE audio setup There shouldn't be anything requiring irqs to be enabled at the point of LPE audio setup. Regardless, we've never hit the warning, as irqs are always enabled at the time LPE audio is initialized. Drop the superfluous warning, and the dependency on i915_drv.h. Fix style a bit while at it. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/20250801122832.249985-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 60b006b7cf0dd5e8ee99bd77fb4573e1a3956035 Author: Uros Bizjak Date: Thu Aug 14 07:43:26 2025 +0100 drm/i915/active: Use try_cmpxchg64() in __active_lookup() Replace this pattern in __active_lookup(): cmpxchg64(*ptr, old, new) == old ... with the simpler and faster: try_cmpxchg64(*ptr, &old, new) The x86 CMPXCHG instruction returns success in the ZF flag, so this change saves a compare after the CMPXCHG. The patch also improves the explanation of what the code really does. cmpxchg64() will *succeed* for the winner of the race and try_cmpxchg64() nicely documents this fact. No functional change intended. Signed-off-by: Uros Bizjak Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: David Airlie Cc: Simona Vetter Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250814064326.95519-1-tvrtko.ursulin@igalia.com commit a75b8d198c55e9eb5feb6f6e155496305caba2dc Author: Sean Young Date: Wed Jul 16 15:24:54 2025 +0100 media: imon: Remove unused defines These defines were used for devices now supported by the imon_raw driver. Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 7019553ab850ce1d3f0e512e16d14ab153f91c04 Author: Tetsuo Handa Date: Fri Jul 18 01:04:00 2025 +0900 media: imon: grab lock earlier in imon_ir_change_protocol() Move mutex_trylock() in imon_ir_change_protocol() to the beginning, for memcpy() which modifies ictx->usb_tx_buf should be protected by ictx->lock. Also, verify at the beginning of send_packet() that ictx->lock is held in case send_packet() is by error called from imon_ir_change_protocol() when mutex_trylock() failed due to concurrent requests. Signed-off-by: Tetsuo Handa Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit eecd203ada43a4693ce6fdd3a58ae10c7819252c Author: Tetsuo Handa Date: Thu Jul 17 23:21:55 2025 +0900 media: imon: make send_packet() more robust syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1]. First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls). Alan Stern commented [2] that In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away. but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed. Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb). Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task). Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds. Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1] Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2] Signed-off-by: Tetsuo Handa Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 4f4098c57e139ad972154077fb45c3e3141555dd Author: Ma Ke Date: Fri Jul 18 17:50:54 2025 +0800 media: lirc: Fix error handling in lirc_register() When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count. Found by code review. Cc: stable@vger.kernel.org Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi") Signed-off-by: Ma Ke Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 9f4f591cd5a410f4203a9c104f92d467945b7d7e Author: Miguel García Date: Thu Aug 14 21:32:17 2025 +0200 xfrm: xfrm_user: use strscpy() for alg_name Replace the strcpy() calls that copy the canonical algorithm name into alg_name with strscpy() to avoid potential overflows and guarantee NULL termination. Destination is alg_name in xfrm_algo/xfrm_algo_auth/xfrm_algo_aead (size CRYPTO_MAX_ALG_NAME). Tested in QEMU (BusyBox/Alpine rootfs): - Added ESP AEAD (rfc4106(gcm(aes))) and classic ESP (sha256 + cbc(aes)) - Verified canonical names via ip -d xfrm state - Checked IPComp negative (unknown algo) and deflate path Signed-off-by: Miguel García Signed-off-by: Steffen Klassert commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec Author: Charalampos Mitrodimas Date: Tue Aug 12 15:51:25 2025 +0000 net: ipv6: fix field-spanning memcpy warning in AH output Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about writes beyond the 16-byte address fields. memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16) WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439 The warnings are false positives as the extension headers are intentionally placed after the IPv6 header in memory. Fix by properly copying addresses and extension headers separately, and introduce helper functions to avoid code duplication. Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c Signed-off-by: Charalampos Mitrodimas Signed-off-by: Steffen Klassert commit 0988099646cfc6c72a4448cad39d4ee22ad457a7 Author: Alexandre Courbot Date: Fri Jul 18 16:26:24 2025 +0900 gpu: nova-core: register: add support for relative array registers Add support for declaring arrays of registers available from a variable base. This is effectively a combination of the relative and array registers features. nova-core does not make much use of this yet, but it will become helpful to have for GSP boot. Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-19-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit ec2f6c81d2a16a93d882488062e8e09e2f1d6865 Author: Alexandre Courbot Date: Fri Jul 18 16:26:23 2025 +0900 gpu: nova-core: falcon: use register arrays for FUSE registers FUSE registers are an array of 16 consecutive registers. Use the newly available register array feature to define them properly and improve the code using them. Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-18-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 20ed4a8695b277c296e3a30306ef8551903e1e04 Author: Alexandre Courbot Date: Fri Jul 18 16:26:22 2025 +0900 gpu: nova-core: register: add support for register arrays Having registers that can be interpreted identically in a contiguous I/O area (or at least, following a given stride) is a common way to organize registers, and is used by NVIDIA hardware. Thus, add a way to simply and safely declare such a layout using the register!() macro. Build-time bound-checking is effective for array accesses performed with a constant. For cases where the index cannot be known at compile time, `try_` variants of the accessors are also made available that return `EINVAL` if the access is out-of-bounds. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-17-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit e617f3a3702ca1ca2a498edbad0b12ceadc27321 Author: Alexandre Courbot Date: Fri Jul 18 16:26:21 2025 +0900 gpu: nova-core: falcon: add distinct base address for PFALCON2 Falcon engines have two distinct register bases: `PFALCON` and `PFALCON2`. So far we assumed that `PFALCON2` was located at `PFALCON + 0x1000` because that is the case of most engines, but there are exceptions (NVDEC uses `0x1c00`). Fix this shortcoming by leveraging the redesigned relative registers definitions to assign a distinct `PFalcon2Base` base address to each falcon engine. Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-16-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit af10924fc471d1c693b8689249f53ea10b0519b7 Author: Alexandre Courbot Date: Fri Jul 18 16:26:20 2025 +0900 gpu: nova-core: register: redesign relative registers The relative registers are currently very unsafe to use: callers can specify any constant as the base address for access, meaning they can effectively interpret any I/O address as any relative register. Ideally, valid base addresses for a family of registers should be explicitly defined in the code, and could only be used with the relevant registers This patch changes the relative register declaration from e.g.: register!(CPU_CTL @ +0x0000010, "CPU core control" { 0:0 start as bool, "Start the CPU core"; }); into: register!(CPU_CTL @ CpuCtlBase[0x10], "CPU core control" { 0:0 start as bool, "Start the CPU core"; }); Where `CpuCtlBase` is the name of a ZST used as a parameter of the `RegisterBase<>` trait to define a trait unique to a class of register. This specialized trait is then implemented for every type that provides a valid base address, enabling said types to be passed as the base address provider for the register's I/O accessor methods. This design thus makes it impossible to pass an unexpected base address to a relative register, and, since the valid bases are all known at compile-time, also guarantees that all I/O accesses are done within the valid bounds of the I/O range. [acourbot@nvidia.com: add example in the commit log.] Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-15-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit c6bc4225279d9a6eff8aafc94347183b2babc52a Author: Alexandre Courbot Date: Fri Jul 18 16:26:19 2025 +0900 gpu: nova-core: register: use #[inline(always)] for all methods These methods should always be inlined, so use the strongest compiler hint that exists to maximize the chance they will indeed be. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-14-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit fcdce54d645a0779892faaed1209105350e15d92 Author: Alexandre Courbot Date: Fri Jul 18 16:26:18 2025 +0900 gpu: nova-core: register: split @io rule into fixed and relative versions We used the same @io rule with different patterns to define both the fixed and relative I/O accessors. This can be confusing as the matching rules are very similar. Since all call sites know which version they want to call, split @io into @io_fixed and @io_relative to remove any ambiguity. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-13-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 3fa145bef533f899ed6de641fe99c70028e28481 Author: Alexandre Courbot Date: Fri Jul 18 16:26:17 2025 +0900 gpu: nova-core: register: generate correct `Default` implementation The `Default` implementation of a register should be the aggregate of the default values of all its fields, and not simply be zeroed. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-12-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 6ecd6b73e0845e2a1ba0d4da273c7cc7c21c88db Author: Alexandre Courbot Date: Fri Jul 18 16:26:16 2025 +0900 gpu: nova-core: register: improve `Debug` implementation Now that we have an internal rule to dispatch field information where needed, use it to generate a better `Debug` implementation where the raw hexadecimal value of the register is displayed, as well as the `Debug` values of its individual fields. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-11-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 7a9cb3dfb07d3e29c0eeebb26b11a34a19a889a4 Author: Alexandre Courbot Date: Fri Jul 18 16:26:15 2025 +0900 gpu: nova-core: register: add fields dispatcher internal rule Fields are complex and cumbersome to match in a rule, and were only captured in order to generate the field accessors. However, there are other places (like the `Debug` and `Default` implementations) where we would benefit from having access to at least some of the field information, but refrained from doing so because it would have meant matching the whole fields in a rule more complex than we need. Introduce a new `@fields_dispatcher` internal rule that captures all the field information and passes it to `@field_accessors`. It does not provide any functional change in itself, but allows us to reuse the captured field information partially to provide better `Debug` and `Default` implementations in following patches. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-10-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 9b2379f02423801d372bc588d38b62a1fa6cd05f Author: Alexandre Courbot Date: Fri Jul 18 16:26:14 2025 +0900 gpu: nova-core: register: add missing doccomments for fixed registers I/O accessors Add the missing doccomments for these accessors, as having a bit of inline documentation is always helpful. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-9-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit e40d2b26167200b99fa4fb1df15d4c870489c82e Author: Alexandre Courbot Date: Fri Jul 18 16:26:13 2025 +0900 gpu: nova-core: register: fix documentation and indentation Fix a few documentation inconsistencies, and harmonize indentation where possible. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-8-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 036c5fa25020d8b1619a96dabbcf9b156f4329bb Author: Alexandre Courbot Date: Fri Jul 18 16:26:12 2025 +0900 gpu: nova-core: register: move OFFSET declaration to I/O impl block The OFFSET const is an I/O property, and having to pass it to the @common rule makes it impossible to make I/O optional, as we want to get to eventually. Thus, move OFFSET to the I/O impl block so it is not needed by the @common rule anymore. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-7-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit b567daf4ea4e4565118436aca51d12adf8ab3e12 Author: Alexandre Courbot Date: Fri Jul 18 16:26:11 2025 +0900 gpu: nova-core: register: remove `try_` accessors for relative registers Relative registers are always accessed using a literal base, meaning their validity can always be checked at compile-time. Thus remove the `try_` accessors that have no purpose. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-6-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 4f7f8f847d4a9c2460ecd43a702e51ac31919e2f Author: Alexandre Courbot Date: Fri Jul 18 16:26:10 2025 +0900 gpu: nova-core: register: simplify @leaf_accessor rule The `$type` metavariable is not used in the @leaf_accessor rule, so remove it. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-5-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit cb2607f3b27087120c15c13f57f1a950251445c9 Author: Alexandre Courbot Date: Fri Jul 18 16:26:09 2025 +0900 gpu: nova-core: register: improve documentation for basic registers Reword parts of the documentation that were a bit heavy to read, and harmonize/fix the examples. The relative registers section is about to be redesigned and its documentation rewritten, so do not touch this part. Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-4-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit c5aeb264b6b27c52fc6c9ef3b50eaaebff5d9b60 Author: Alexandre Courbot Date: Fri Jul 18 16:26:08 2025 +0900 gpu: nova-core: register: allow fields named `offset` `offset` is a common field name, yet using it triggers a build error due to the conflict between the uppercased field constant (which becomes `OFFSET` in this case) containing the bitrange of the field, and the `OFFSET` constant constaining the offset of the register. Fix this by adding `_RANGE` the field's range constant to avoid the name collision. [acourbot@nvidia.com: fix merge conflict due to switch from `as u32` to `u32::from`.] Reported-by: Timur Tabi Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-3-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit da810279506c6b5748b9533a5547f8abc1044c16 Merge: c393614e081f7c 5863638598f5e4 Author: Martin K. Petersen Date: Thu Aug 14 22:56:02 2025 -0400 Merge patch series "ufs: host: mediatek: Provide features and fixes in MediaTek platforms" peter.wang@mediatek.com says: This series fixes some defects and provide features in MediaTek UFS drivers. Link: https://lore.kernel.org/r/20250811131423.3444014-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit c393614e081f7c20921e76f73e87cba73dbca6a4 Merge: 8f5ae30d69d754 149009f2dc6f78 Author: Martin K. Petersen Date: Thu Aug 14 22:55:21 2025 -0400 Merge patch series "dt-bindings: ufs: qcom: Split SC7180, SM8650 and similar into separate file" Krzysztof Kozlowski says: The binding for Qualcomm SoC UFS controllers grew and it will grow further. It already includes several conditionals, partially for difference in handling encryption block (ICE, either as phandle or as IO address space) but it will further grow for MCQ. See also: https://lore.kernel.org/r/20250730082229.23475-1-quic_rdwivedi@quicinc.com The SM8650 is first SoC coming with MCQ, which was missing in the binding. Document this as well. Best regards, Krzysztof Link: https://lore.kernel.org/r/20250731-dt-bindings-ufs-qcom-v2-0-53bb634bf95a@linaro.org Signed-off-by: Martin K. Petersen commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 Author: Alice Chao Date: Mon Aug 11 21:11:26 2025 +0800 scsi: ufs: host: mediatek: Fix invalid access in vccqx handling Add a NULL check before accessing the 'vccqx' pointer to prevent invalid memory access. This ensures that the function safely handles cases where 'vccq' and 'vccq2' are not initialized, improving the robustness of the power management code. Signed-off-by: Alice Chao Reviewed-by: Peter Wang Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 Author: Peter Wang Date: Mon Aug 11 21:11:25 2025 +0800 scsi: ufs: host: mediatek: Change reset sequence for improved stability Modify the reset sequence to ensure that the device reset pin is set low before the host is disabled. This change enhances the stability of the reset process by ensuring the correct order of operations. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit bacb96ce06c05804fae4bfd38c4058b6d4c423b3 Author: Peter Wang Date: Mon Aug 11 21:11:24 2025 +0800 scsi: ufs: host: mediatek: Fix UniPro setting for MT6989 Set the UniPro attribute 0xD09E[4] bit to enable the 1144 functions specifically for the MT6989 platform. This adjustment ensures proper functionality and compatibility with the MT6989 hardware. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-9-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit f1617ecf18aaf222482f683f44ab4b155976539d Author: Peter Wang Date: Mon Aug 11 21:11:23 2025 +0800 scsi: ufs: host: mediatek: Optimize power mode change handling Optimize the power mode change process by skipping the adaptation setting toggle if the requested power mode configuration is already applied. This enhancement reduces unnecessary operations, improving efficiency during power mode transitions. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-8-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 979feee0cf43b32d288931649d7c6d9a5524ea55 Author: Alice Chao Date: Mon Aug 11 21:11:22 2025 +0800 scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change Assign power mode userdata settings before transitioning to FASTAUTO power mode. This ensures that default timeout values are set for various parameters, enhancing the reliability and performance of the power mode change process. Signed-off-by: Alice Chao Reviewed-by: Peter Wang Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 7212d624f8638f8ea8ad1ecbb80622c7987bc7a1 Author: Peter Wang Date: Mon Aug 11 21:11:21 2025 +0800 scsi: ufs: host: mediatek: Fix PWM mode switch issue Address a failure in switching to PWM mode by ensuring proper configuration of power modes and adaptation settings. The changes include checks for SLOW_MODE and adjustments to the desired working mode and adaptation configuration based on the device's power mode and hardware version. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-6-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 86a678a25108705657e2f3bb00c42f9e5e5d692b Author: Peter Wang Date: Mon Aug 11 21:11:20 2025 +0800 scsi: ufs: host: mediatek: Fine-tune clock scaling Disable clock scaling for UFS versions below 4.0. Clock scaling is unnecessary for these versions, and this change ensures that the feature is only enabled for compatible UFS versions. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-5-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit f91c6c70d103a619c58aa02bddf3c27c6433556a Author: Peter Wang Date: Mon Aug 11 21:11:19 2025 +0800 scsi: ufs: host: mediatek: Add debug information for Auto-Hibern8 Enhance the clock gating logic by adding debug information for the Auto-Hibern8 (AHIT) register. This additional logging aids in troubleshooting by providing insights into the AHIT configuration when the clock is not turned off as expected. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-4-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit aa86602a483ba48f51044fbaefa1ebbf6da194a4 Author: Peter Wang Date: Mon Aug 11 21:11:18 2025 +0800 scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration Move the configuration of the Auto-Hibern8 (AHIT) timer from the post-link stage to the 'fixup_dev_quirks' function. This change allows setting the AHIT based on the vendor requirements: (a) Samsung: 3.5 ms (b) Micron: 2 ms (c) Others: 1 ms Additionally, the clock gating timer is adjusted based on the AHIT scale, with a maximum setting of 10 ms. This ensures that the clock gating delay is appropriately configured to match the AHIT settings. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-3-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 6c00c493a344b65fb0a356cb3f328a647085687b Author: Peter Wang Date: Mon Aug 11 21:11:17 2025 +0800 scsi: ufs: host: mediatek: Simplify variable usage Simplify the code by using 'info->vcc' instead of 'hba->vreg_info.vcc', as they refer to the same value. This change improves code readability. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250811131423.3444014-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 149009f2dc6f781f490a13264eaa565281e4d490 Author: Krzysztof Kozlowski Date: Thu Jul 31 09:15:54 2025 +0200 scsi: ufs: qcom: dt-bindings: Split SM8650 and similar The binding for Qualcomm SoC UFS controllers grew and it will grow further. Split SM8650 and SM8750 UFS controllers which: 1. Do not reference ICE as IO address space, but as phandle, 2. Have same order of clocks. 3. Have MCQ I/O address space. Document that MCQ address space as optional to maintain backwards compatibility and because Linux drivers can operate perfectly fine without it (thus without MCQ feature). Linux driver already uses "mcq" as possible name for "reg-names" property. The split allows easier review and maintenance of the binding. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250731-dt-bindings-ufs-qcom-v2-3-53bb634bf95a@linaro.org Reviewed-by: Rob Herring (Arm) Acked-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit 655c8f511926250e0da9e8b1a9b8f1cf2c173b41 Author: Krzysztof Kozlowski Date: Thu Jul 31 09:15:53 2025 +0200 scsi: ufs: qcom: dt-bindings: Split SC7180 and similar The binding for Qualcomm SoC UFS controllers grew and it will grow further. Split SC7180 and several other devices which: 1. Do not reference ICE as I/O address space, but as a phandle, 2. Have same order of clocks (SC7180 has one clock less than SC7280 and other variants in split binding). The split allows easier review and maintenance of the binding. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250731-dt-bindings-ufs-qcom-v2-2-53bb634bf95a@linaro.org Reviewed-by: Rob Herring (Arm) Signed-off-by: Martin K. Petersen commit 7f224967aee7d5ad88b6db76ca161be622ae7b34 Author: Krzysztof Kozlowski Date: Thu Jul 31 09:15:52 2025 +0200 scsi: ufs: qcom: dt-bindings: Split common part to qcom,ufs-common.yaml The binding for Qualcomm SoC UFS controllers grew and it will grow further. It already includes several conditionals, partially for difference in handling encryption block (ICE, either as phandle or as I/O address space) but it will further grow for MCQ. Prepare for splitting this one big binding into several ones for common group of devices by defining common part for all Qualcomm UFS schemas. This only moves code, no functional impact expected. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250731-dt-bindings-ufs-qcom-v2-1-53bb634bf95a@linaro.org Reviewed-by: Rob Herring (Arm) Signed-off-by: Martin K. Petersen commit be3536a4bdda53ff5a91b7e542b167d12bddb317 Author: Alexandre Courbot Date: Fri Jul 18 16:26:07 2025 +0900 gpu: nova-core: register: add missing space in register!() A space was missing between arguments in this invocation. [acourbot@nvidia.com: use more descriptive commit title] Reviewed-by: Daniel Almeida Reviewed-by: Boqun Feng Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-2-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit bab8dea259100a99e047fd11a48940b229d30031 Author: Hendrik Hamerlinck Date: Wed Aug 13 11:22:40 2025 +0200 riscv: dts: spacemit: Add OrangePi RV2 board device tree Add initial device tree support for the OrangePi RV2 board [1]. The board is described as using the Ky X1 SoC, which, based on available downstream sources and testing, appears to be identical or very closely related to the SpacemiT K1 SoC [2]. The device tree is adapted from the OrangePi vendor tree [3], and similar integration can be found in the Banana Pi kernel tree [4], confirming SoC compatibility. The main difference with the current Banana Pi BPI-F3 tree is that status led is using GPIO_ACTIVE_LOW. This minimal device tree enables booting into a serial console with UART output and a blinking LED. Link: http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-RV2.html [1] Link: https://www.spacemit.com/en/key-stone-k1 [2] Link: https://github.com/BPI-SINOVOIP/pi-linux/blob/linux-6.6.63-k1/arch/riscv/boot/dts/spacemit/k1-x_orangepi-rv2.dts [3] Link: https://github.com/orangepi-xunlong/linux-orangepi/tree/orange-pi-6.6-ky [4] Signed-off-by: Hendrik Hamerlinck Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250813092240.180333-3-hendrik.hamerlinck@hammernet.be Signed-off-by: Yixun Lan commit f10512e2c44e6ee3242314d43102acab7340e2d3 Author: Hendrik Hamerlinck Date: Wed Aug 13 11:22:39 2025 +0200 dt-bindings: riscv: spacemit: Add OrangePi RV2 board Document the compatible string for the OrangePi RV2 board [1]. The board is described as using the Ky X1 SoC, which, based on available downstream sources and testing, appears to be identical or very closely related to the SpacemiT K1 SoC [2]. Link: http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-RV2.html [1] Link: https://www.spacemit.com/en/key-stone-k1 [2] Signed-off-by: Hendrik Hamerlinck Reviewed-by: Yixun Lan Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250813092240.180333-2-hendrik.hamerlinck@hammernet.be Signed-off-by: Yixun Lan commit 5e04ff729f93fff16ec760e9cd7b72499963663f Author: John Hubbard Date: Fri Jul 18 16:26:06 2025 +0900 gpu: nova-core: register: minor grammar and spelling fixes There is only one top-level macro in this file at the moment, but the "macros.rs" file name allows for more. Change the wording so that it will remain valid even if additional macros are added to the file. Fix a couple of spelling errors and grammatical errors, and break up a run-on sentence, for clarity. Cc: Alexandre Courbot Cc: Danilo Krummrich Signed-off-by: John Hubbard Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Link: https://lore.kernel.org/r/20250718-nova-regs-v2-1-7b6a762aa1cd@nvidia.com Signed-off-by: Alexandre Courbot commit 88250d40ed59d2b3c2dff788e9065caa7eb4dba0 Merge: 6398d8a856fb8b 61730ac10ba90c Author: Jakub Kicinski Date: Thu Aug 14 17:54:02 2025 -0700 Merge branch 'net-dsa-b53-mmap-add-bcm63268-gphy-power-control' Kyle Hendry says: ==================== net: dsa: b53: mmap: Add bcm63268 GPHY power control The gpio controller on the bcm63268 has a register for controlling the gigabit phy power. These patches disable low power mode when enabling the gphy port. This is based on an earlier patch series here: https://lore.kernel.org/20250306053105.41677-1-kylehendrydev@gmail.com I have created a new series since many of the changes were included in the ephy control patches: https://lore.kernel.org/20250724035300.20497-1-kylehendrydev@gmail.com ==================== Link: https://patch.msgid.link/20250814002530.5866-1-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit 61730ac10ba90c52563861a0119504f6a9be9868 Author: Kyle Hendry Date: Wed Aug 13 17:25:28 2025 -0700 net: dsa: b53: mmap: Implement bcm63268 gphy power control Add check for gphy in enable/disable phy calls and set power bits in gphy control register. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250814002530.5866-3-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit 7f95f04fe1903a31b61085e3ab1b4730f9d72941 Author: Kyle Hendry Date: Wed Aug 13 17:25:27 2025 -0700 net: dsa: b53: mmap: Add gphy port to phy info for bcm63268 Add gphy mask to bcm63xx phy info struct and add data for bcm63268 Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250814002530.5866-2-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit 6398d8a856fb8be01f53cf84b481b3cdac978607 Author: Xichao Zhao Date: Tue Aug 12 14:50:26 2025 +0800 sfc: replace min/max nesting with clamp() The clamp() macro explicitly expresses the intent of constraining a value within bounds.Therefore, replacing min(max(a, b), c) with clamp(val, lo, hi) can improve code readability. Signed-off-by: Xichao Zhao Reviewed-by: Joe Damato Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250812065026.620115-1-zhao.xichao@vivo.com Signed-off-by: Jakub Kicinski commit 6a18b85ca7d84486613d1857e49a656522bbe77c Merge: f09fc24dd9a5ec 51ca1e67f41600 Author: Jakub Kicinski Date: Thu Aug 14 17:45:39 2025 -0700 Merge branch 'bridge-redirect-to-backup-port-when-port-is-administratively-down' Ido Schimmel says: ==================== bridge: Redirect to backup port when port is administratively down Patch #1 amends the bridge to redirect to the backup port when the primary port is administratively down and not only when it does not have a carrier. See the commit message for more details. Patch #2 extends the bridge backup port selftest to cover this case. ==================== Link: https://patch.msgid.link/20250812080213.325298-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 51ca1e67f416000bfd9a2a49c868538e744a317e Author: Ido Schimmel Date: Tue Aug 12 11:02:13 2025 +0300 selftests: net: Test bridge backup port when port is administratively down Test that packets are redirected to the backup port when the primary port is administratively down. With the previous patch: # ./test_bridge_backup_port.sh [...] TEST: swp1 administratively down [ OK ] TEST: No forwarding out of swp1 [ OK ] TEST: Forwarding out of vx0 [ OK ] TEST: swp1 administratively up [ OK ] TEST: Forwarding out of swp1 [ OK ] TEST: No forwarding out of vx0 [ OK ] [...] Tests passed: 89 Tests failed: 0 Without the previous patch: # ./test_bridge_backup_port.sh [...] TEST: swp1 administratively down [ OK ] TEST: No forwarding out of swp1 [ OK ] TEST: Forwarding out of vx0 [FAIL] TEST: swp1 administratively up [ OK ] TEST: Forwarding out of swp1 [ OK ] [...] Tests passed: 85 Tests failed: 4 Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250812080213.325298-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b Author: Ido Schimmel Date: Tue Aug 12 11:02:12 2025 +0300 bridge: Redirect to backup port when port is administratively down If a backup port is configured for a bridge port, the bridge will redirect known unicast traffic towards the backup port when the primary port is administratively up but without a carrier. This is useful, for example, in MLAG configurations where a system is connected to two switches and there is a peer link between both switches. The peer link serves as the backup port in case one of the switches loses its connection to the multi-homed system. In order to avoid flooding when the primary port loses its carrier, the bridge does not flush dynamic FDB entries pointing to the port upon STP disablement, if the port has a backup port. The above means that known unicast traffic destined to the primary port will be blackholed when the port is put administratively down, until the FDB entries pointing to it are aged-out. Given that the current behavior is quite weird and unlikely to be depended on by anyone, amend the bridge to redirect to the backup port also when the primary port is administratively down and not only when it does not have a carrier. The change is motivated by a report from a user who expected traffic to be redirected to the backup port when the primary port was put administratively down while debugging a network issue. Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit f09fc24dd9a5ec989dfdde7090624924ede6ddc7 Author: Jakub Kicinski Date: Tue Aug 12 07:20:54 2025 -0700 selftests: drv-net: wait for carrier On fast machines the tests run in quick succession so even when tests clean up after themselves the carrier may need some time to come back. Specifically in NIPA when ping.py runs right after netpoll_basic.py the first ping command fails. Since the context manager callbacks are now common NetDrvEpEnv gets an ip link up call as well. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250812142054.750282-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit df979273bd716a93ca9ffa8f84aeb205c9bf2ab6 Author: Vladimir Oltean Date: Wed Aug 13 10:44:54 2025 +0300 net: phy: mscc: report and configure in-band auto-negotiation for SGMII/QSGMII The following Vitesse/Microsemi/Microchip PHYs, among those supported by this driver, have the host interface configurable as SGMII or QSGMII: - VSC8504 - VSC8514 - VSC8552 - VSC8562 - VSC8572 - VSC8574 - VSC8575 - VSC8582 - VSC8584 All these PHYs are documented to have bit 7 of "MAC SerDes PCS Control" as "MAC SerDes ANEG enable". Out of these, I could test the VSC8514 quad PHY in QSGMII. This works both with the in-band autoneg on and off, on the NXP LS1028A-RDB and T1040-RDB boards. Notably, the bit is sticky (survives soft resets), so giving Linux the tools to read and modify this settings makes it robust to changes made to it by previous boot layers (U-Boot). Signed-off-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250813074454.63224-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 20e1b75b38fd51ad7fb215943cd80fd78d1e767b Author: Vladimir Oltean Date: Wed Aug 13 21:10:23 2025 +0300 net: dsa: realtek: remove unnecessary file, dentry, inode declarations These are present since commit d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") and never needed. Apparently the driver was not cleaned up sufficiently for submission. Signed-off-by: Vladimir Oltean Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250813181023.808528-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit eeea7688632e0c697f66bdd71708c8faf36f6540 Author: Yue Haibing Date: Wed Aug 13 20:55:26 2025 +0800 net/sched: Use TC_RTAB_SIZE instead of magic number Replace magic number with TC_RTAB_SIZE to make it more informative. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20250813125526.853895-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 4b6dc4c891cc270699c3214557621df7df7c05cc Author: Liao Yuanhong Date: Wed Aug 13 17:50:24 2025 +0800 ptp: ptp_clockmatrix: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250813095024.559085-1-liaoyuanhong@vivo.com Signed-off-by: Jakub Kicinski commit 9b96c60d70fc30a6680fbd711187ca54ae117ca4 Merge: c6f68f69416d09 41a6e8ab186427 Author: Jakub Kicinski Date: Thu Aug 14 17:35:23 2025 -0700 Merge branch 'devlink-port-attr-cleanup' Parav Pandit says: ==================== devlink port attr cleanup patch-1 removes the return 0 check at several places and simplfies patch-2 constifies the attributes and moves the checks early caller ==================== Link: https://patch.msgid.link/20250813094417.7269-1-parav@nvidia.com Signed-off-by: Jakub Kicinski commit 41a6e8ab18642741437da932c2f5762b185e928c Author: Parav Pandit Date: Wed Aug 13 12:44:17 2025 +0300 devlink/port: Check attributes early and constify Constify the devlink port attributes to indicate they are read only and does not depend on anything else. Therefore, validate it early before setting in the devlink port. Reviewed-by: Jiri Pirko Signed-off-by: Parav Pandit Link: https://patch.msgid.link/20250813094417.7269-3-parav@nvidia.com Signed-off-by: Jakub Kicinski commit 0ebc0bcd0aa0037019aac996c50166c7baf44ff8 Author: Parav Pandit Date: Wed Aug 13 12:44:16 2025 +0300 devlink/port: Simplify return checks Drop always returning 0 from the helper routine and simplify its callers. Reviewed-by: Jiri Pirko Signed-off-by: Parav Pandit Link: https://patch.msgid.link/20250813094417.7269-2-parav@nvidia.com Signed-off-by: Jakub Kicinski commit c6f68f69416d0950965e5744489382ccebdc72b4 Author: Dan Carpenter Date: Wed Aug 13 08:51:22 2025 +0300 nfc: pn533: Delete an unnecessary check The "rc" variable is set like this: if (IS_ERR(resp)) { rc = PTR_ERR(resp); We know that "rc" is negative so there is no need to check. Signed-off-by: Dan Carpenter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/aJwn2ox5g9WsD2Vx@stanley.mountain Signed-off-by: Jakub Kicinski commit 34167f1a024d2c5abae0b0325a6d0b8257160f86 Author: Markus Stockhausen Date: Wed Aug 13 01:44:07 2025 -0400 net: phy: realtek: convert RTL8226-CG to c45 only Short: Convert the RTL8226-CG to c45 so it can be used in its Realtek based ecosystems. Long: The RTL8226-CG can be mainly found on devices of the Realtek Otto switch platform. Devices like the Zyxel XGS1210-12 are based on it. These implement a hardware based phy polling in the background to update SoC status registers. The hardware provides 4 smi busses where phys are attached to. For each bus one can decide if it is polled in c45 or c22 mode. See https://svanheule.net/realtek/longan/register/smi_glb_ctrl With this setting the register access will be limited by the hardware. This is very complex (including caching and special c45-over-c22 handling). But basically it boils down to "enable protocol x and SoC will disable register access via protocol y". Mainline already gained support for the rtl9300 mdio driver in commit 24e31e474769 ("net: mdio: Add RTL9300 MDIO driver"). It covers the basic features, but a lot effort is still needed to understand hardware properly. So it runs a simple setup by selecting the proper bus mode during startup. /* Put the interfaces into C45 mode if required */ glb_ctrl_mask = GENMASK(19, 16); for (i = 0; i < MAX_SMI_BUSSES; i++) if (priv->smi_bus_is_c45[i]) glb_ctrl_val |= GLB_CTRL_INTF_SEL(i); ... err = regmap_update_bits(regmap, SMI_GLB_CTRL, glb_ctrl_mask, glb_ctrl_val); To avoid complex coding later on, it limits access by only providing either c22 or c45: bus->name = "Realtek Switch MDIO Bus"; if (priv->smi_bus_is_c45[mdio_bus]) { bus->read_c45 = rtl9300_mdio_read_c45; bus->write_c45 = rtl9300_mdio_write_c45; } else { bus->read = rtl9300_mdio_read_c22; bus->write = rtl9300_mdio_write_c22; } Because of these limitations the existing RTL8226 phy driver is not working at all on Realtek switches. Convert the driver to c45-only. Luckily the RTL8226 seems to support proper MDIO_PMA_EXTABLE flags. So standard function genphy_c45_pma_read_abilities() can call genphy_c45_pma_read_ext_abilities() and 10/100/1000 is populated right. Thus conversion is straight forward. Outputs before - REMARK: For this a "hacked" bus was used that toggles the mode for each c22/c45 access. But that is slow and produces unstable data in the SoC status registers). Settings for lan9: Supported ports: [ TP MII ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full 2500baseT/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: Yes Supported FEC modes: Not reported Advertised link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full 2500baseT/Full Advertised pause frame use: Symmetric Receive-only Advertised auto-negotiation: Yes Advertised FEC modes: Not reported Speed: Unknown! Duplex: Unknown! (255) Port: Twisted Pair PHYAD: 24 Transceiver: external Auto-negotiation: on MDI-X: Unknown Supports Wake-on: d Wake-on: d Link detected: no Outputs with this commit: Settings for lan9: Supported ports: [ TP ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full 2500baseT/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: Yes Supported FEC modes: Not reported Advertised link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full 2500baseT/Full Advertised pause frame use: Symmetric Receive-only Advertised auto-negotiation: Yes Advertised FEC modes: Not reported Speed: Unknown! Duplex: Unknown! (255) Port: Twisted Pair PHYAD: 24 Transceiver: external Auto-negotiation: on MDI-X: Unknown Supports Wake-on: d Wake-on: d Link detected: no Signed-off-by: Markus Stockhausen Link: https://patch.msgid.link/20250813054407.1108285-1-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski commit 355b82c54c122e59487c52c084a146101bedc2c8 Author: Jijie Shao Date: Wed Aug 13 20:45:42 2025 +0800 net: phy: motorcomm: Add support for PHY LEDs on YT8521 Add minimal LED controller driver supporting the most common uses with the 'netdev' trigger. Signed-off-by: Jijie Shao Tested-by: Heiko Stuebner Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250813124542.3450447-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit c4f72d3747acfeb53131f3bd70bf7439a2ccf72f Merge: f24775c325900a 47459937be8031 Author: Jakub Kicinski Date: Thu Aug 14 17:26:37 2025 -0700 Merge tag 'docs/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-docs Mauro Carvalho Chehab says: ==================== add a generic yaml parser integrated with Netlink specs generation - An YAML parser Sphinx plugin, integrated with Netlink YAML doc parser. The patch content is identical to my v10 submission: https://lore.kernel.org/cover.1753718185.git.mchehab+huawei@kernel.org * tag 'docs/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-docs: sphinx: parser_yaml.py: fix line numbers information docs: parser_yaml.py: fix backward compatibility with old docutils docs: parser_yaml.py: add support for line numbers from the parser tools: netlink_yml_parser.py: add line numbers to parsed data MAINTAINERS: add netlink_yml_parser.py to linux-doc docs: netlink: remove obsolete .gitignore from unused directory tools: ynl_gen_rst.py: drop support for generating index files docs: uapi: netlink: update netlink specs link docs: use parser_yaml extension to handle Netlink specs docs: sphinx: add a parser for yaml files for Netlink specs tools: ynl_gen_rst.py: cleanup coding style docs: netlink: index.rst: add a netlink index file tools: ynl_gen_rst.py: Split library from command line tool docs: netlink: netlink-raw.rst: use :ref: instead of :doc: ==================== Link: https://patch.msgid.link/20250812113329.356c93c2@foz.lan Signed-off-by: Jakub Kicinski commit 28f073b38372b99d8d33ff5e63897d28419bda20 Author: Dave Ertman Date: Mon Jun 16 13:03:23 2025 +0200 ice: Implement support for SRIOV VFs across Active/Active bonds This patch implements the software flows to handle SRIOV VF communication across an Active/Active link aggregate. The same restrictions apply as are in place for the support of Active/Backup bonds. - the two interfaces must be on the same NIC - the FW LLDP engine needs to be disabled - the DDP package that supports VF LAG must be loaded on device - the two interfaces must have the same QoS config - only the first interface added to the bond will have VF support - the interface with VFs must be in switchdev mode With the additional requirement of - the version of the FW on the NIC needs to have VF Active/Active support This requirement is indicated in the capabilities struct associated with the NVM loaded on the NIC. The balancing of traffic between the two interfaces is done on a queue basis. Taking the queues allocated to all of the VFs as a whole, one half of them will be distributed to each interface. When a link goes down, then the queues allocated to the down interface will migrate to the active port. When the down port comes back up, then the same queues as were originally assigned there will be moved back. Co-developed-by: Marcin Szycik Signed-off-by: Marcin Szycik Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 5fbc0dbb92d639d10a5386ad0ae87a54680a04be Author: Brigham Campbell Date: Wed Jul 30 21:23:43 2025 -0600 drm/panel: novatek-nt35560: Clean up driver Update driver to use the "multi" variants of MIPI functions which facilitate improved error handling and cleaner driver code. Remove information from a comment which was made obsolete by commit 994ea402c767 ("drm/panel: Rename Sony ACX424 to Novatek NT35560"), which determined that this driver supports the Novatek NT35560 panel controller. Reviewed-by: Douglas Anderson Signed-off-by: Brigham Campbell Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731032343.1258366-4-me@brighamcampbell.com commit ffc23a204a5f2e763a8cc8a8cfefe0027a6f0ec3 Author: Brigham Campbell Date: Wed Jul 30 21:23:42 2025 -0600 drm: Add MIPI read_multi func and two write macros Create mipi_dsi_dcs_read_multi(), which accepts a mipi_dsi_multi_context struct for improved error handling and cleaner panel driver code. Create mipi_dsi_dcs_write_var_seq_multi() and mipi_dsi_generic_write_var_seq_multi() macros which allow MIPI panel drivers to write non-constant data to display controllers. Reviewed-by: Douglas Anderson Signed-off-by: Brigham Campbell Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731032343.1258366-3-me@brighamcampbell.com commit 51c285baa3fa04b95843da8e2f9895138ea64dd4 Author: Paul E. McKenney Date: Wed Aug 13 20:41:04 2025 -0700 rcutorture: Delay forward-progress testing until boot completes Forward-progress testing can hog CPUs, which is not a great thing to do before boot has completed. This commit therefore makes the CPU-hotplug operations hold off until boot has completed. Signed-off-by: Paul E. McKenney commit 6e9c48b3e34b8ade2e6881c8b1f3838f5c2ab804 Author: Paul E. McKenney Date: Wed Aug 13 20:16:29 2025 -0700 torture: Delay CPU-hotplug operations until boot completes CPU-hotplug operations invoke stop-machine, which can hog CPUs, which is not a great thing to do before boot has completed. This commit therefore makes the CPU-hotplug operations hold off until boot has completed. Signed-off-by: Paul E. McKenney commit 9a316fe3adcac5655303958faef0e2cb1fedca1d Author: Paul E. McKenney Date: Wed Aug 6 16:35:26 2025 -0700 rcutorture: Delay rcutorture readers and writers until boot completes The rcutorture writers and (especially) readers are the biggest CPU hogs of the bunch, so this commit therefore makes them wait until boot has completed. This makes the current setting of the boot_ended local variable dead code, so while in the area, this commit removes that as well. Signed-off-by: Paul E. McKenney commit 1b0f583843287275298a559c14e10769fd771cec Author: Paul E. McKenney Date: Wed Aug 6 16:07:33 2025 -0700 rcutorture: Suppress "Writer stall state" reports during boot When rcutorture is running on only the one boot-time CPU while that CPU is busy invoking initcall() functions, the added load is quite likely to unduly delay the RCU grace-period kthread, rcutorture readers, and much else besides. This can result in rcu_torture_stats_print() reporting rcutorture writer stalls, which are not really a bug in that environment. After all, one CPU can only do so much. This commit therefore suppresses rcutorture writer stalls while the kernel is booting, that is, while rcu_inkernel_boot_has_ended() continues returning false. Signed-off-by: Paul E. McKenney commit b930ff84f3072df7ab3b0f1cd3a8bb5d02ec4dec Author: Paul E. McKenney Date: Wed Aug 6 15:59:32 2025 -0700 torture: Announce kernel boot status at torture-test startup Sometimes a given system takes surprisingly long to boot, for example, in one recent case, 70 seconds instead of three seconds. It would be good to fix these slow-boot issues, but it would also be good for the torture tests to announce that the system was still booting at the start of the test. Especially for tests that have a greater probability of false positives when run in the single-CPU boot-time environment. Yes, those tests should defend themselves, but we should also make this situation easier to diagnose. This commit therefore causes torture_print_module_parms() to print "still booting" at the end of its printk() that dumps out the values of its module parameters. Signed-off-by: Paul E. McKenney commit bd89367e05e8cf55eacf8627b0b3ed55b938d6fd Author: Paul E. McKenney Date: Wed Jul 16 09:10:35 2025 -0700 torture: Add --do-normal parameter to torture.sh help text The --do-normal parameter was missing from the torture.sh script's help text, so this commit adds it. Hopefully better late than never! Signed-off-by: Paul E. McKenney commit e95f6ccdbc71663b9f4b24a166e85bd8e6720318 Author: Paul E. McKenney Date: Thu Jul 10 16:41:53 2025 -0700 rcutorture: Fix jitter.sh spin time An embarrassing syntax error in jitter.sh makes for fixed spin time. This commit therefore makes it be variable, as intended, albeit with very coarse-grained adjustment. Signed-off-by: Paul E. McKenney commit cacadb630375b8c30ca4d0300812178bb884c0b0 Author: Paul E. McKenney Date: Wed Jul 16 09:19:39 2025 -0700 srcu: Add guards for notrace variants of SRCU-fast readers This adds the usual scoped_guard(srcu_fast_notrace, &my_srcu) and guard(srcu_fast_notrace)(&my_srcu). Signed-off-by: Paul E. McKenney Reviewed-by: Joel Fernandes Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: commit 7e2a2d060da4860af37e1000dc62a30a1551d9e8 Author: Paul E. McKenney Date: Wed Jul 16 09:12:16 2025 -0700 srcu: Add srcu_read_lock_fast_notrace() and srcu_read_unlock_fast_notrace() This commit adds no-trace variants of the srcu_read_lock_fast() and srcu_read_unlock_fast() functions for tracing use. [ paulmck: Apply notrace feedback from Joel Fernandes, Steven Rostedt, and Mathieu Desnoyers. ] [ paulmck: Apply excess-notrace feedback from Boqun Feng. ] Link: https://lore.kernel.org/all/20250721162433.10454-1-paulmck@kernel.org Signed-off-by: Paul E. McKenney Reviewed-by: Joel Fernandes Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: commit f39494089aaa1022008eee245fb83ef1ae911b6d Author: Paul E. McKenney Date: Tue Jul 15 21:09:13 2025 -0700 srcu: Move rcu_is_watching() checks to srcu_read_{,un}lock_fast() The rcu_is_watching() warnings are currently in the SRCU-tree implementations of __srcu_read_lock_fast() and __srcu_read_unlock_fast(). However, this makes it difficult to create _notrace variants of srcu_read_lock_fast() and srcu_read_unlock_fast(). This commit therefore moves these checks to srcu_read_lock_fast(), srcu_read_unlock_fast(), srcu_down_read_fast(), and srcu_up_read_fast(). Signed-off-by: Paul E. McKenney Reviewed-by: Joel Fernandes Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: commit 42d590d100f2e47e47d974a902b9ed610e464824 Author: Zqiang Date: Wed Aug 13 21:30:02 2025 +0800 rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() The per-CPU rcu_data structure's ->defer_qs_iw field is initialized by IRQ_WORK_INIT_HARD(), which means that the subsequent invocation of rcu_preempt_deferred_qs_handler() will always be executed with interrupts disabled. This commit therefore removes the local_irq_save/restore() operations from rcu_preempt_deferred_qs_handler() and adds a call to lockdep_assert_irqs_disabled() in order to enable lockdep to diagnose mistaken invocations of this function from interrupts-enabled code. Signed-off-by: Zqiang Signed-off-by: Paul E. McKenney commit 7fdc1d1b02e471c2ad4292705265706e003430a0 Author: Raviteja Laggyshetty Date: Thu Aug 14 14:54:19 2025 +0000 dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Glymur SoC Document the RPMh Network-On-Chip Interconnect in Glymur platform. Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Raviteja Laggyshetty Link: https://lore.kernel.org/r/20250814-glymur-icc-v2-1-596cca6b6015@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 704e5dd1c02371dfc7d22e1520102b197a3b628b Author: Niklas Schnelle Date: Thu Aug 7 15:55:40 2025 +0200 powerpc/eeh: Use result of error_detected() in uevent Ever since uevent support was added for AER and EEH with commit 856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it reported PCI_ERS_RESULT_NONE as uevent when recovery begins. Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") subsequently amended AER to report the actual return value of error_detected(). Make the same change to EEH to align it with AER and s390. Suggested-by: Lukas Wunner Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/ Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Reviewed-by: Kuppuswamy Sathyanarayanan Acked-by: Mahesh Salgaonkar Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 Author: Niklas Schnelle Date: Thu Aug 7 15:55:39 2025 +0200 s390/pci: Use pci_uevent_ers() in PCI recovery Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by EEH and AER PCIe recovery routines. Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com commit bbf7d0468d0da71d76cc6ec9bc8a224325d07b6b Author: Niklas Schnelle Date: Thu Aug 7 15:55:38 2025 +0200 PCI/AER: Fix missing uevent on recovery when a reset is requested Since commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") AER uses the result of error_detected() as parameter to pci_uevent_ers(). As pci_uevent_ers() however does not handle PCI_ERS_RESULT_NEED_RESET this results in a missing uevent for the beginning of recovery if drivers request a reset. Fix this by treating PCI_ERS_RESULT_NEED_RESET as beginning recovery. Fixes: 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250807-add_err_uevents-v5-1-adf85b0620b0@linux.ibm.com commit 539b06e9e0d805aec5f8f7407483c90c71a13209 Author: Chen Ni Date: Tue Jul 29 10:27:35 2025 +0800 clk: clk-axi-clkgen: remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250729022735.1437560-1-nichen@iscas.ac.cn Signed-off-by: Stephen Boyd commit a1e1c10878d7ea5147bef02a068061a9c3e1461a Author: Liao Yuanhong Date: Wed Aug 13 17:40:03 2025 +0800 clk: tegra: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250813094003.552308-1-liaoyuanhong@vivo.com Signed-off-by: Stephen Boyd commit 8ffc9f234fdf332310015d507ae22db9a2820d37 Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:27 2025 +0800 PCI: dwc: Implement capability search using PCI core APIs The PCI core now provides generic PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros to search for PCI capabilities, using config accessors we supply. Use them in the DWC driver to implement dw_pcie_find_capability() and dw_pcie_find_ext_capability() instead of duplicating the algorithm. Signed-off-by: Hans Zhang <18255117159@163.com> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250813144529.303548-5-18255117159@163.com commit 8e40210788636619404871df07445fa4590138b4 Author: Alexander Aring Date: Thu Aug 14 11:22:14 2025 -0400 dlm: check for undefined release_option values Checking on all undefined release_option values to return -EINVAL in case a user is providing them to dlm_release_lockspace(). Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 8d90041a0d285044b89629f539ca0685e156848b Author: Alexander Aring Date: Thu Aug 14 11:22:13 2025 -0400 dlm: handle release_option as unsigned Future patches will introduce a invalid argument check for undefined values. All values for release_option are positive integer values to not check on negative values as well we just change the parameter to unsigned int. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit a8abcff174f7f9ce4587c6451b1a2450d01f52c9 Author: Alexander Aring Date: Thu Aug 14 11:22:12 2025 -0400 dlm: move to rinfo for all middle conversion cases Since commit f74dacb4c8116 ("dlm: fix recovery of middle conversions") we introduced additional debugging information if we hit the middle conversion by using log_limit(). The DLM log_limit() functionality requires a DLM debug option being enabled. As this case is so rarely and excempt any potential introduced new issue with recovery we switching it to log_rinfo() ad this is ratelimited under normal DLM loglevel. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 452d90def2dce8513d75981a4dc48e94e65ff54b Author: Alexander Aring Date: Thu Aug 14 11:22:11 2025 -0400 dlm: handle invalid lockspace member remove Since commit de7b4869b4ecf ("dlm: add new configfs entry release_recover for lockspace members") we are moving lockspace members into a gone list before removing them to get additional removing attributes from configfs. There is still a very unlikely possibility when find_config_node() returns NULL, then for some reason the node wasn't marked as gone but it was removed. We will just handle this case and drop an error to observe if this case can ever happen. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/gfs2/aJ2Ssuh8xlsTutrA@stanley.mountain/T/#u Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 4d909bf1a53eb1e2e4d523a8d6f66532ac1bae0b Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:26 2025 +0800 PCI: Refactor extended capability search into PCI_FIND_NEXT_EXT_CAP() Move the extended Capability search logic into a PCI_FIND_NEXT_EXT_CAP() macro that accepts a config space accessor function as an argument. This enables controller drivers to perform Capability discovery using their early access mechanisms prior to full device initialization while sharing the Capability search code. Convert the existing PCI core extended Capability search implementation to use PCI_FIND_NEXT_EXT_CAP(). Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Tested-by: Niklas Schnelle Link: https://patch.msgid.link/20250813144529.303548-4-18255117159@163.com commit 3c02084d8fa521192ea19722b1e5efae8096d939 Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:25 2025 +0800 PCI: Refactor capability search into PCI_FIND_NEXT_CAP() The PCI Capability search functionality is duplicated across the PCI core and several controller drivers. The core's current implementation requires fully initialized PCI device and bus structures, which prevents controller drivers from using it during early initialization phases before these structures are available. Move the Capability search logic into a PCI_FIND_NEXT_CAP() macro that accepts a config space accessor function as an argument. This enables controller drivers to perform Capability discovery using their early access mechanisms prior to full device initialization while sharing the Capability search code. Convert the existing PCI core Capability search implementation to use PCI_FIND_NEXT_CAP(). Controller drivers can later use this with their early access mechanisms while maintaining the existing protection against infinite loops through preserved TTL checks. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Tested-by: Niklas Schnelle Link: https://patch.msgid.link/20250813144529.303548-3-18255117159@163.com commit 37d1ade89606875c9cd6eb3b4ee416b7e1800fc4 Author: Hans Zhang <18255117159@163.com> Date: Wed Aug 13 22:45:24 2025 +0800 PCI: Clean up __pci_find_next_cap_ttl() readability Refactor the __pci_find_next_cap_ttl() to improve code clarity: - Replace magic number 0x40 with PCI_STD_HEADER_SIZEOF. - Use ALIGN_DOWN() for position alignment instead of manual bitmask. - Extract PCI capability fields via FIELD_GET() with standardized masks. - Add necessary headers (linux/align.h). No functional changes intended. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Tested-by: Niklas Schnelle Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250813144529.303548-2-18255117159@163.com commit c123519bffd29e6320d3a8c4977f9e5a86d6b83d Author: Arnd Bergmann Date: Thu Aug 7 09:22:37 2025 +0200 clk: npcm: select CONFIG_AUXILIARY_BUS There are very rare randconfig builds that turn on this driver but don't already select CONFIG_AUXILIARY_BUS from another driver, and this results in a build failure: arm-linux-gnueabi-ld: drivers/clk/clk-npcm8xx.o: in function `npcm8xx_clock_driver_init': clk-npcm8xx.c:(.init.text+0x18): undefined reference to `__auxiliary_driver_register' Select the bus here, as all other clk drivers using it do. Fixes: e0b255df027e ("clk: npcm8xx: add clock controller") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250807072241.4190376-1-arnd@kernel.org Signed-off-by: Stephen Boyd commit 4239b174c2fc8307a1939ebaf51118109935a8fc Author: Wolfram Sang Date: Wed Aug 13 18:14:48 2025 +0200 clk: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-3-wsa+renesas@sang-engineering.com Signed-off-by: Stephen Boyd commit f24775c325900a683085c305fc9a403c490e667d Merge: 875c541ea680d0 63467137ecc0ff Author: Jakub Kicinski Date: Thu Jul 17 10:56:56 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc2). No conflicts. Adjacent changes: drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c d7a276a5768f ("net: stmmac: rk: convert to suspend()/resume() methods") de1e963ad064 ("net: stmmac: rk: put the PHY clock on remove") Signed-off-by: Jakub Kicinski commit 01ce6aa56caa9dc7b240828ed40df8180df7afb7 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:25 2025 -0500 dt-bindings: interrupt-controller: Convert hisilicon,mbigen-v2 to DT schema Convert the HiSilicon MBIGEN binding to DT schema format. It's a straight-forward conversion. Link: https://lore.kernel.org/r/20250812203327.730393-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 5de28cf4ae21aebb6a5af09c96d1fad9eb03f2f8 Author: Rob Herring (Arm) Date: Tue Aug 12 13:14:27 2025 -0500 dt-bindings: arm/cpus: Add missing Applied Micro CPU compatibles "apm,potenza" and "apm,strega" CPU compatibles have been in use for some time. Link: https://lore.kernel.org/r/20250812181428.69490-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 3f0ff4cc6ffb43ea250fdf69d9f7ae8e5a05f1f9 Author: Thomas Weißschuh Date: Thu Aug 14 12:14:45 2025 +0200 kbuild: respect CONFIG_WERROR for userprogs The userprogs compiler and linker do not share the regular compiler flags. Make sure they also fail on warnings with CONFIG_WERROR and W=e. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-5-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit ec4a3992bc0b5b659eceb44a9f8582b26f2c8489 Author: Thomas Weißschuh Date: Thu Aug 14 12:14:44 2025 +0200 kbuild: respect CONFIG_WERROR for linker and assembler The linker and assembler do not share the compiler flags. Make sure they also fail on warnings with CONFIG_WERROR and W=e. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-4-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit 592b571f20c5b905c47a1370210456f9f90ce04f Author: Miguel Ojeda Date: Thu Aug 14 12:14:43 2025 +0200 kbuild: rust: move `-Dwarnings` handling to `Makefile.extrawarn` Following commit e88ca24319e4 ("kbuild: consolidate warning flags in scripts/Makefile.extrawarn"), move `-Dwarnings` handling into `Makefile.extrawarn` like C's `-Werror`. No functional change intended. Signed-off-by: Miguel Ojeda Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-3-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit e7a10929c574cf30981a8e19ef39bc35e63e8b46 Author: Thomas Weißschuh Date: Thu Aug 14 12:14:42 2025 +0200 kbuild: unify W=e and CONFIG_WERROR The two mechanisms have the same effect, unify their implementation. Also avoid spurious rebuilds when switching between the two. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-2-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit f852ce052a8b78d6fade371bd1fad583541e78fa Author: Thomas Weißschuh Date: Thu Aug 14 12:14:41 2025 +0200 kbuild: align W=e with CONFIG_WERROR CONFIG_WERROR sets KBUILD_CPPFLAGS while W=e would only set KBUILD_CFLAGS. As a preparation to unify the two mechanism, align their effects. While at it, add some alignment whitespace to prepare for later additions to the list of changed variables. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250814-kbuild-werror-v2-1-c01e596309d2@linutronix.de Signed-off-by: Nathan Chancellor commit fb2f2a86f0cd9690357b9bb67af00d386a7e819f Author: Dave Ertman Date: Mon Jun 16 13:03:21 2025 +0200 ice: cleanup capabilities evaluation When evaluating the capabilities field, the ICE_AQC_BIT_ROCEV2_LAG and ICE_AQC_BIT_SRIOV_LAG defines were both not using the BIT operator, instead simply setting a hex value that set the correct bits. While not inaccurate, this method is misleading, and when it is expanded in the following implementation it becomes even more confusing. Switch to using the BIT() operator to clarify what is being checked. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Marcin Szycik Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 148c8cb32b2f4a32c4b47998da20f2fd62cc38ca Author: Dave Ertman Date: Mon Jun 16 13:03:20 2025 +0200 ice: Cleanup variable initialization in LAG code In preparation for implementing SRIOV Active-Active LAG support, cleanup several unneeded variable initializations in declaration blocks. Also move a couple of variable initializations into declaration block that should be there. Reviewed-by: Przemek Kitszel Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit b2e97152df79ab4670ab47de34f2df5bd6b86005 Author: Dave Ertman Date: Mon Jun 16 13:03:19 2025 +0200 ice: move LAG function in code to prepare for Active-Active In the SRIOV LAG Active-Active, the functions ice_lag_cfg_pf_fltr's and ice_lag_config_eswitch's content are moved to earlier locations in the source file. Also, ice_lag_cfg_pf_fltr is renamed, and its flow is changed. To reduce the delta in the larger patch, move the original functions to their new location so that only functional changes are needed in the larger patch. Reviewed-by: Przemek Kitszel Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit a66b3b537d2133e8980e49d68b3573b5aec23699 Author: Dave Ertman Date: Mon Jun 16 13:03:18 2025 +0200 ice: Add driver specific prefix to LAG defines A define in the LAG code is missing a driver specific prefix. Add a prefix to the define. Also shorten a defines name and move to a more logical place. Reviewed-by: Przemek Kitszel Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 5b35b83d0d759e8313e0dd921fb9b9ac947c2585 Author: Dave Ertman Date: Mon Jun 16 13:03:17 2025 +0200 ice: replace u8 elements with bool where appropriate In preparation for the new LAG functionality implementation, there are a couple of existing LAG elements of the capabilities struct that should be bool instead of u8. Since we are adding a new element to this struct that should also be a bool, fix the existing LAG u8 in this patch and eliminate !! operators where possible. Reviewed-by: Przemek Kitszel Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit ba7fad179699dbbd3dfdc9ca5594d7f3c425a2a2 Author: Dave Ertman Date: Mon Jun 16 13:03:16 2025 +0200 ice: Remove casts on void pointers in LAG code This series will be touching on the LAG code in the ice driver, to prevent moving or propagating casting on void pointers, clean them up first. This also allows for moving the variable initialization into the variable declaration. Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 27fce9e8c6f031b526bf471e1076abca31473464 Author: Niklas Cassel Date: Thu Aug 14 17:21:20 2025 +0200 PCI: endpoint: Drop superfluous pci_epc_features initialization struct pci_epc_features has static storage duration, so all struct members are zero initialized implicitly. Thus, remove explicit zero initialization for features that are *not* supported so we don't have to touch existing drivers as new features are added. Signed-off-by: Niklas Cassel [bhelgaas: squash together, expand commit log rationale] Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven #rcar-ep, rcar-gen4 Link: https://patch.msgid.link/20250814152119.1562063-16-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-17-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-18-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-19-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-20-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-21-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-22-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-23-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-24-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-25-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-26-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-27-cassel@kernel.org Link: https://patch.msgid.link/20250814152119.1562063-28-cassel@kernel.org commit a46e95c81e3a28926ab1904d9f754fef8318074d Author: Dr. David Alan Gilbert Date: Wed Jun 25 14:32:56 2025 +0100 ASoC: wl1273: Remove The wl1273 FM radio is on Arnd's unused driver list: https://lore.kernel.org/lkml/a15bb180-401d-49ad-a212-0c81d613fbc8@app.fastmail.com/ Remove the codec component. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250625133258.78133-3-linux@treblig.org Signed-off-by: Mark Brown commit 2412f16c9afa7710778fc032139a6df38b68fd7c Author: Sakari Ailus Date: Thu Aug 14 16:50:07 2025 +0300 media: v4l2-common: Improve devm_v4l2_sensor_clk_get() documentation Remove the extra leading period and provide more elaborate explanation for why devm_v4l2_sensor_clk_get() is only allowed to be used on camera sensor devices. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f56fbb6a1b36da1d481d7ce8245f7bedad3aa863 Author: Rob Herring (Arm) Date: Wed Aug 6 16:28:11 2025 -0500 dt-bindings: arm: Drop obsolete cavium-thunder2.txt The binding is already converted to schema and is located in Documentation/devicetree/bindings/arm/bcm/brcm,vulcan-soc.yaml. Link: https://lore.kernel.org/r/20250806212812.1634740-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 6b8c52b41be4b3940f38b037cc953505aeb5768c Author: Rob Herring (Arm) Date: Wed Aug 6 16:27:40 2025 -0500 dt-bindings: arm: Convert cavium,thunder-88xx to DT schema Convert Cavium Thunder-88xx boards to DT schema format. There's not any defined board compatibles in this case. Link: https://lore.kernel.org/r/20250806212741.1633917-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit f93dd842719b123cfad6385a32acf6386a3c7659 Author: Rob Herring (Arm) Date: Thu Aug 7 16:45:07 2025 -0500 dt-bindings: display: Drop duplicate ti,opa362 binding The "ti,opa362" binding is already supported in simple-bridge.yaml, so remove the old binding doc. Acked-by: Conor Dooley Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250807214508.4174167-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 258384d8ce365dddd6c5c15204de8ccd53a7ab0a Author: Shimrra Shai Date: Wed Aug 13 20:49:19 2025 -0500 ASoC: es8323: enable DAPM power widgets for playback DAC and output Enable DAPM widgets for power and volume control of playback. Signed-off-by: Shimrra Shai Link: https://patch.msgid.link/20250814014919.87170-1-shimrrashai@gmail.com Signed-off-by: Mark Brown commit d578faf7096affc036fd16333f1bfbe4991a22f7 Author: Wolfram Sang Date: Wed Aug 13 18:15:07 2025 +0200 ASoC: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://patch.msgid.link/20250813161517.4746-22-wsa+renesas@sang-engineering.com Signed-off-by: Mark Brown commit 7bf9e646af9a0ceac57b27e62b71f750af096c2c Author: Shuming Fan Date: Thu Aug 14 17:21:53 2025 +0800 ASoC: rt1321: Add RT1321 amplifier support This patch supported RT1321 amplifier. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250814092153.2733592-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 6d068f1ae2a2f713d7f21a9a602e65b3d6b6fc6d Author: Colin Ian King Date: Thu Aug 14 08:33:26 2025 +0100 regulator: rt5133: Fix spelling mistake "regualtor" -> "regulator" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250814073326.17644-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 1527cd3b89f0db8d71828f86a64dc901415f9be1 Author: Wolfram Sang Date: Wed Aug 13 18:15:02 2025 +0200 reset: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Acked-by: Drew Fustini # for reset-th1520.c Link: https://lore.kernel.org/r/20250813161517.4746-17-wsa+renesas@sang-engineering.com Signed-off-by: Philipp Zabel commit d342031a523835d5cbf959f74663ee405acefb2c Author: Icenowy Zheng Date: Wed Aug 13 16:17:16 2025 +0800 reset: th1520: add resets for display pipeline The VO subsystem of TH1520 contains a few resets for the display pipeline -- display, MIPI DSI and HDMI controllers. Add support for them to the reset-th1520 driver. Signed-off-by: Icenowy Zheng Reviewed-by: Philipp Zabel Link: https://lore.kernel.org/r/20250813081716.2181843-3-uwu@icenowy.me Signed-off-by: Philipp Zabel commit f443d7c9ed4642489d2f73a35e86df6228f65dfc Author: Icenowy Zheng Date: Wed Aug 13 16:17:15 2025 +0800 dt-bindings: reset: thead,th1520-reset: add more VOSYS resets VOSYS contains more resets for a display pipeline, includes ones for the display controller (called DPU in the manual), the HDMI controller and 2 MIPI DSI controllers. Allocate IDs for these resets in the dt binding header file. Now all peripheral related VOSYS reset controls are here, only the bus matrix / IOPMP ones are missing, which shouldn't be messed with. Signed-off-by: Icenowy Zheng Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250813081716.2181843-2-uwu@icenowy.me Signed-off-by: Philipp Zabel commit 9c50f99c135384a4c1918e267c706f196820b214 Author: Ryan Chen Date: Tue Jul 8 13:29:08 2025 +0800 reset: aspeed: register AST2700 reset auxiliary bus device The AST2700 reset driver is registered as an auxiliary device due to reset and clock controller share the same register region. Signed-off-by: Ryan Chen Reviewed-by: Philipp Zabel Link: https://lore.kernel.org/r/20250708052909.4145983-3-ryan_chen@aspeedtech.com Signed-off-by: Philipp Zabel commit 6e273caeacf0ec4a438f9cd22ecf9b77414e429d Author: Kyle Hendry Date: Tue Jul 15 16:46:02 2025 -0700 reset: bcm6345: add support for bcm63xx ephy control register The ephy control register on bcm63xx SoCs contain bits for resetting individual internal phys. Use the existing bcm6345-reset driver to set bits. Signed-off-by: Kyle Hendry Link: https://lore.kernel.org/r/20250715234605.36216-2-kylehendrydev@gmail.com Signed-off-by: Philipp Zabel commit a341bcfbfa74a00ddb741bbfe9a7c08c63382235 Author: Kyle Hendry Date: Tue Jul 15 16:46:03 2025 -0700 dt-bindings: reset: add compatible for bcm63xx ephy control Add compatible string for bcm63xx ephy control. Signed-off-by: Kyle Hendry Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250715234605.36216-3-kylehendrydev@gmail.com Signed-off-by: Philipp Zabel commit ada8faab6395fa1df9febda8f8ff17576aa177c2 Author: Jani Nikula Date: Wed Aug 6 19:55:16 2025 +0300 drm/i915/display: drop __to_intel_display() usage All the places that use __to_intel_display() now get passed a struct intel_display pointer, and the transitional adaptation macro has served its purpose. Remove the macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/d2c4a5aab3d69cec6f0640eed157a97531bd72f2.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7e757092373ccf147e23f46d1167718680db8ec6 Author: Jani Nikula Date: Wed Aug 6 19:55:15 2025 +0300 drm/i915/reg: separate VLV_DSPCLK_GATE_D from DSPCLK_GATE_D All the places that use DSPCLK_GATE_D are specific to certain platforms, and the parametrization of it to support VLV/CHV MMIO display base isn't really buying us anything. Add a separate macro for VLV_DSPCLK_GATE_D and use it. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/ac16d9d5192595944bf9bcf70aa721b504bc90c0.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 85cac9ff650dd6d20d7589c1577aeaa7ef62d944 Author: Jani Nikula Date: Wed Aug 6 19:55:14 2025 +0300 drm/i915/gvt: convert mmio table to struct intel_display Underneath, the register macros really expect a struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/ef50b08c9bf6066201c86dc7e0f08f008c7c47d5.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 240e3c640cd13988ce90b913e3d8643385feb6fa Author: Jani Nikula Date: Wed Aug 6 19:55:13 2025 +0300 drm/i915/uncore: pass display to HAS_FPGA_DBG_UNCLAIMED() Underneath, HAS_FPGA_DBG_UNCLAIMED() really expects struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/e8cda779e192095dfa35d618f88bf7bfa526ac06.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 8d588c01d1fd4e0e9345f43eb9182634f6b08792 Author: Jani Nikula Date: Wed Aug 6 19:55:12 2025 +0300 drm/i915/drv: pass display to HAS_DISPLAY() Underneath, HAS_DISPLAY() really expects a struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/e1789e82d876eabef550abf537ca5dd2b71cbe6c.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d2e184f8e16ab85876ddcc0779358fbfe5162414 Author: Jani Nikula Date: Wed Aug 6 19:55:11 2025 +0300 drm/i915/switcheroo: pass display to HAS_DISPLAY() Underneath, HAS_DISPLAY() really expects a struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/c9828991eb8870c45271141bf0912880a3a65c44.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a1a8c68cdac0ec0d2c0f29d1155bff686bb55ac3 Author: Jani Nikula Date: Wed Aug 6 19:55:10 2025 +0300 drm/i915/gem: pass display to HAS_DISPLAY() Underneath, HAS_DISPLAY() really expects a struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/79c87f75771a1d120cdd35dcfd6b380620ce99f1.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e3929f84a1b3a6e65855c38c53001eb7b34e3955 Author: Jani Nikula Date: Wed Aug 6 19:55:09 2025 +0300 drm/i915/gmch: pass display to DISPLAY_VER() Underneath, DISPLAY_VER() really expects struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/1f951102b3d073fd58c5211f399750aa80b51548.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7eb949663bbc09c057dff987908c55297725d426 Author: Jani Nikula Date: Wed Aug 6 19:55:08 2025 +0300 drm/i915/dram: pass display to macros that expect display Underneath, the HAS_DISPLAY() and DISPLAY_VER() macros really expect struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/ee8bba57924629f97945b9cf05727ae7c0dfb8fd.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 8f7528425ca5f5d0d126ca32a4e793a84fee8afd Author: Jani Nikula Date: Wed Aug 6 19:55:07 2025 +0300 drm/i915/irq: pass display to macros that expect display Underneath, the HAS_PCH_NOP(), DISPLAY_VER(), HAS_FBC(), and HAS_HOTPLUG() macros really expect a struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/de3302dd9ebc21226a9dadcbcdeeaf01e57186be.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 0418dfd86144662bae9360e8c7899cf928bbf04e Author: Jani Nikula Date: Wed Aug 6 19:55:06 2025 +0300 drm/i915/clockgating: pass display to DSPCNTR and DSPSURF register macros Underneath, the macros expect struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/014410b59845b401950faff992540ea9b32ac213.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 077ad673d986c041f43aadf57e5ca5829a36ffc9 Author: Jani Nikula Date: Wed Aug 6 19:55:05 2025 +0300 drm/i915/clockgating: pass display to HAS_PCH_*() macros Underneath, the HAS_PCH_*() macros expect struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/824750abaf4587501d61dce964b36542d93931f7.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3a28f5c19d4d555363aeb99986bb3761d1cc29a4 Author: Jani Nikula Date: Wed Aug 6 19:55:04 2025 +0300 drm/i915/clockgating: pass display to for_each_pipe() Underneath, for_each_pipe() really expects struct intel_display. Switch to it in preparation for removing the transitional __to_intel_display() macro. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/1abcd9b4429a25eb40c30691c876d3db089b1cf2.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5064edaa3446abe8bc649e0c206cc1c4897fd6a9 Author: Jani Nikula Date: Wed Aug 6 19:55:03 2025 +0300 drm/i915/fb: pass display to HAS_GMCH() and DISPLAY_VER() Convert some leftover i915 usages to struct intel_display. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/8a209e3f60039986794123e6b1631185c9234f8f.1754499175.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 21ecdf45f1cdf0267fb4260333494fed26683e9d Author: Jani Nikula Date: Wed Aug 6 19:55:02 2025 +0300 drm/i915/display: pass display to HAS_PCH_*() macros Convert some leftover i915 usages to struct intel_display. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/c521c9fa8b7d2c9a04d472f6c541a41822f76327.1754499174.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9391ab1ed9b3fe0d1af7d7858d9bf42f476628c8 Author: Zong Jiang Date: Tue Aug 12 13:48:19 2025 +0800 serial: qcom-geni: Make UART port count configurable via Kconfig Replace the hardcoded GENI_UART_PORTS macro with a new Kconfig option SERIAL_QCOM_GENI_UART_PORTS to allow platforms to configure the maximum number of UART ports supported by the driver at build time. This improves flexibility for platforms that require more than the previously fixed number of UART ports, and avoids unnecessary allocation for unused ports. Signed-off-by: Zong Jiang Link: https://lore.kernel.org/r/20250812054819.3748649-3-quic_zongjian@quicinc.com Signed-off-by: Greg Kroah-Hartman commit c3e7966c60745f87a0b73672a85c920099f90a7e Author: Zong Jiang Date: Tue Aug 12 13:48:18 2025 +0800 serial: qcom-geni: Dynamically allocate UART ports Replace the static allocation of UART ports with dynamic allocation using devm_kzalloc. This change removes the fixed-size array and instead allocates each UART port structure on demand during probe, improving memory efficiency and scalability. Signed-off-by: Zong Jiang Link: https://lore.kernel.org/r/20250812054819.3748649-2-quic_zongjian@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 8672b18cde548748ac04a3aa247369ac2d4c2985 Author: Brian Masney Date: Sun Aug 10 18:14:25 2025 -0400 tty: serial: mvebu-uart: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250810-tty-round-rate-v1-1-849009f3bdfd@redhat.com Signed-off-by: Greg Kroah-Hartman commit bd673d2b714106fdac67e65f7d399a66893d0936 Author: Abinash Singh Date: Thu Aug 7 03:21:34 2025 +0530 serial: 8250_platform: Reduce stack usage in serial8250_probe_platform() The function serial8250_probe_platform() in 8250_platform.c triggered a frame size warning: drivers/tty/serial/8250/8250_platform.c: In function ‘serial8250_probe_platform.isra’: drivers/tty/serial/8250/8250_platform.c:201:1: warning: the frame size of 1184 bytes is larger than 1024 bytes [-Wframe-larger-than=] This patch reduces the stack usage by dynamically allocating the `uart` structure using kzalloc(), rather than placing it on the stack. This eliminates the overflow warning and improves kernel robustness. Signed-off-by: Abinash Singh Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250806215134.4921-3-abinashsinghlalotra@gmail.com Signed-off-by: Greg Kroah-Hartman commit d9b7679611d320db4f4436f0281a7797f2e06e15 Author: Abinash Singh Date: Thu Aug 7 03:21:33 2025 +0530 serial: 8250_platform: Reduce stack usage in serial8250_probe_acpi() The function serial8250_probe_acpi() in 8250_platform.c triggered a frame size warning: drivers/tty/serial/8250/8250_platform.c: In function ‘serial8250_probe_acpi’: drivers/tty/serial/8250/8250_platform.c:152:1: warning: the frame size of 1160 bytes is larger than 1024 bytes [-Wframe-larger-than=] This patch reduces the stack usage by dynamically allocating the `uart` structure using kzalloc(), rather than placing it on the stack. This eliminates the overflow warning and improves kernel robustness. Signed-off-by: Abinash Singh Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250806215134.4921-2-abinashsinghlalotra@gmail.com Signed-off-by: Greg Kroah-Hartman commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 Author: Dan Carpenter Date: Thu Aug 7 18:54:37 2025 +0300 serial: max310x: Add error checking in probe() Check if devm_i2c_new_dummy_device() fails. Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 3fc36ae6abd263a5cbf93b2f5539eccc1fc753f7 Author: Thomas Bogendoerfer Date: Fri Jul 25 15:40:17 2025 +0200 tty: serial: ip22zilog: Use platform device for probing After commit 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") serial drivers need to provide a device in struct uart_port.dev otherwise an oops happens. To fix this issue for ip22zilog driver switch driver to a platform driver and setup the serial device in sgi-ip22 code. Signed-off-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20250725134018.136113-1-tsbogend@alpha.franken.de Signed-off-by: Greg Kroah-Hartman commit cbd3baeffbc08052ce7dc53f11bf5524b4411056 Author: Jani Nikula Date: Tue Aug 5 14:56:56 2025 +0300 drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access Commit 8d9908e8fe9c ("drm/i915/display: remove small micro-optimizations in irq handling") not only removed the optimizations, it also enabled wakeref asserts for the GEN11_GU_MISC_IIR access. Silence the asserts by wrapping the access inside intel_display_rpm_assert_{block,unblock}(). Reported-by: "Jason A. Donenfeld" Closes: https://lore.kernel.org/r/aG0tWkfmxWtxl_xc@zx2c4.com Fixes: 8d9908e8fe9c ("drm/i915/display: remove small micro-optimizations in irq handling") Cc: stable@vger.kernel.org # v6.13+ Suggested-by: Ville Syrjälä Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250805115656.832235-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 875c541ea680d0df2de3e666d8125bee08c1bc1b Merge: 40e819747b45fd 26dbe030ff0893 Author: Paolo Abeni Date: Thu Aug 14 11:40:21 2025 +0200 Merge branch 'net-ethtool-support-including-flow-label-in-the-flow-hash-for-rss' Jakub Kicinski says: ==================== net: ethtool: support including Flow Label in the flow hash for RSS Add support for using IPv6 Flow Label in Rx hash computation and therefore RSS queue selection. v3: https://lore.kernel.org/20250724015101.186608-1-kuba@kernel.org v2: https://lore.kernel.org/20250722014915.3365370-1-kuba@kernel.org RFC: https://lore.kernel.org/20250609173442.1745856-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250811234212.580748-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 26dbe030ff08930bb243af3c66dd3b7e7bb8406d Author: Jakub Kicinski Date: Mon Aug 11 16:42:12 2025 -0700 selftests: drv-net: add test for RSS on flow label Add a simple test for checking that RSS on flow label works, and that its rejected for IPv4 flows. # ./tools/testing/selftests/drivers/net/hw/rss_flow_label.py TAP version 13 1..2 ok 1 rss_flow_label.test_rss_flow_label ok 2 rss_flow_label.test_rss_flow_label_6only # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250811234212.580748-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit 46c0faa46378ee54404383629641857476dc77f7 Author: Jakub Kicinski Date: Mon Aug 11 16:42:11 2025 -0700 eth: bnxt: support RSS on IPv6 Flow Label It appears that the bnxt FW API has the relevant bit for Flow Label hashing. Plumb in the support. Obey the capability bit. Signed-off-by: Jakub Kicinski Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250811234212.580748-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0afbfdc0f64a8525624b317a99050082be08ceb2 Author: Jakub Kicinski Date: Mon Aug 11 16:42:10 2025 -0700 eth: fbnic: support RSS on IPv6 Flow Label Support IPv6 Flow Label hashing. Use both inner and outer IPv6 header's Flow Label if both headers are detected. Flow Label is unlike normal header fields, by enabling it user accepts the unstable hash and possible reordering. Because of that I think it's reasonable to hash over all Flow Labels we can find, even tho we don't hash over all L3 addresses. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250811234212.580748-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit f22cc6f766f84496b260347d4f0d92cf95f30699 Author: Jakub Kicinski Date: Mon Aug 11 16:42:09 2025 -0700 net: ethtool: support including Flow Label in the flow hash for RSS Some modern NICs support including the IPv6 Flow Label in the flow hash for RSS queue selection. This is outside the old "Microsoft spec", but was included in the OCP NIC spec: [ ] RSS include flow label in the hash (configurable) https://www.opencompute.org/w/index.php?title=Core_Offloads#Receive_Side_Scaling RSS Flow Label hashing allows TCP Protective Load Balancing (PLB) to recover from receiver congestion / overload. Rx CPU/queue hotspots are relatively common for data ingest workloads, and so far we had to try to detect the condition at the RPC layer and reopen the connection. PLB lets us change the Flow Label and therefore Rx CPU on RTO, with minimal packet reordering. PLB reaction times are much faster, and can happen at any point in the connection, not just at RPC boundaries. Due to the nature of host processing (relatively long queues, other kernel subsystems masking IRQs for 100s of msecs) the risk of reordering within the host is higher than in the network. But for applications which need it - it is far preferable to potentially persistent overload of subset of queues. It is expected that the hash communicated to the host may change if the Flow Label changes. This may be surprising to some host software, but I don't expect the devices can compute two Toeplitz hashes, one with the Flow Label for queue selection and one without for the rx hash communicated to the host. Besides, changing the hash may potentially help to change the path thru host queues. User can disable NETIF_F_RXHASH if they require a stable flow hash. The name RXH_IP6_FL was chosen based on what we call Flow Label variables in IPv6 processing (fl). I prefer fl_lbl but that appears to be an fbnic-only spelling. We could spell out RXH_IP6_FLOW_LABEL but existing RXH_ defines are a lot more terse. Willem notes [1] that Flow Label is defined as identifying the flow and therefore including both the flow label _and_ the L4 header fields is not generally necessary. But it should not hurt so it's not explicitly prevented if the driver supports hashing on both at the same time. Link: https://lore.kernel.org/68483433b45e2_3cd66f29440@willemb.c.googlers.com.notmuch [1] Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250811234212.580748-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 40e819747b45fd254ab99cfe39ba8787d6bbd33d Author: Brian Masney Date: Sun Aug 10 18:24:14 2025 -0400 net: cadence: macb: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate(). Signed-off-by: Brian Masney Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250810-net-round-rate-v1-1-dbb237c9fe5c@redhat.com Signed-off-by: Paolo Abeni commit 5893165a27e7d1f318aa91f0cd84e795dab7460d Author: Wolfram Sang Date: Wed Aug 13 18:14:49 2025 +0200 gpio: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-4-wsa+renesas@sang-engineering.com Signed-off-by: Bartosz Golaszewski commit 4a31a043fc16d72b662251b75b183e25e2fa9e47 Author: Thorsten Blum Date: Wed Aug 13 23:00:57 2025 +0200 ALSA: hda: Improve local variable data type in print_device_list() Use 'unsigned int' instead of 'int' for the local variable 'devlist_len' because snd_hda_get_devices() returns an 'unsigned int' and the length cannot be negative. Update the print format specifier and the if condition accordingly. Reformat calling snd_hda_codec_read() to fit in a single line while we're at it. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250813210059.215912-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit c308bb4190a8f6f09270b541457d6ae905d2f7bc Author: Thorsten Blum Date: Wed Aug 13 22:55:02 2025 +0200 ALSA: hda: Use min() to simplify snd_hda_get_devices() Use min() to simplify snd_hda_get_devices() and improve its readability. Change the function parameter 'max_devices' from 'int' to 'unsigned int' to avoid a min() signedness error. Update all related local variables and the function's return type to 'unsigned int' accordingly. No functional changes intended. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250813205507.215658-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 0070851095d2954567510777976e40275f81ca1b Author: Geert Uytterhoeven Date: Wed Jul 9 20:43:25 2025 +0200 drm: renesas: rz-du: mipi_dsi: Convert to RUNTIME_PM_OPS() Convert the Renesas RZ/G2L MIPI DSI Encoder driver from SET_RUNTIME_PM_OPS() to RUNTIME_PM_OPS() and pm_ptr(). This lets us drop the __maybe_unused annotations from its runtime suspend and resume callbacks, and reduces kernel size in case CONFIG_PM is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://lore.kernel.org/r/cdfc1b8ec9e62553654639b9e9026bfed8dd07d1.1752086582.git.geert+renesas@glider.be commit 5d03847175e81e86d4865456c15638faaf7c0634 Author: Lukas Wunner Date: Tue Aug 12 15:42:29 2025 +0200 thunderbolt: Use is_pciehp instead of is_hotplug_bridge The thunderbolt driver sets up device link dependencies from hotplug ports to the Host Router (aka Native Host Interface, NHI). When resuming from system sleep, this allows the Host Router to re-establish tunnels to attached Thunderbolt devices before the hotplug ports resume. To identify the hotplug ports, the driver utilizes the is_hotplug_bridge flag which also encompasses ACPI slots handled by the ACPI hotplug driver. Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is more apt to identify them with the is_pciehp flag. Similarly, hotplug ports on older Thunderbolt controllers have broken MSI support and are quirked to use legacy INTx interrupts instead. The quirk identifies them with is_hotplug_bridge, even though all affected ports are also matched by is_pciehp. So use is_pciehp here as well. Signed-off-by: Lukas Wunner Acked-by: Bjorn Helgaas Signed-off-by: Mika Westerberg commit 23fca458f6ab18927e50c2134fb7b60297f18b4e Author: Baptiste Lepers Date: Tue Aug 12 16:42:11 2025 +0200 rust: cpumask: Mark CpumaskVar as transparent Unsafe code in CpumaskVar's methods assumes that the type has the same layout as `bindings::cpumask_var_t`. This is not guaranteed by the default struct representation in Rust, but requires specifying the `transparent` representation. Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions") Signed-off-by: Baptiste Lepers Reviewed-by: Alice Ryhl Signed-off-by: Viresh Kumar commit daad2ef99145215fac1cab196811e3e03ef8bc9f Author: Alice Ryhl Date: Wed Aug 13 07:54:31 2025 +0000 rust: cpumask: rename CpumaskVar::as[_mut]_ref to from_raw[_mut] The prefix as_* shouldn't be used for constructors. For further motivation, see commit 2f5606afa4c2 ("device: rust: rename Device::as_ref() to Device::from_raw()"). Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Yury Norov (NVIDIA) Signed-off-by: Viresh Kumar commit 5d8a9c8401648d338d072a488d455ed4611c5d4b Author: Wolfram Sang Date: Wed Aug 13 18:15:04 2025 +0200 soc: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-19-wsa+renesas@sang-engineering.com Signed-off-by: Bjorn Andersson commit 3b5ca25ecfa85098c7015251a0e7c78a8ff392e5 Merge: acfea936107313 e2068f74b97653 Author: Jakub Kicinski Date: Wed Aug 13 18:26:18 2025 -0700 Merge branch 'net-don-t-use-pk-through-printk-or-tracepoints' Thomas Weißschuh says: ==================== net: Don't use %pK through printk or tracepoints In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe. ==================== Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-0-2e2fdc7d3f2c@linutronix.de Signed-off-by: Jakub Kicinski commit e2068f74b97653356ad7d6ce456db1f5b7fb575e Author: Thomas Weißschuh Date: Mon Aug 11 11:43:19 2025 +0200 net/mlx5: Don't use %pK through tracepoints In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through tracepoints. They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe. Signed-off-by: Thomas Weißschuh Reviewed-by: Aleksandr Loktionov Reviewed-by: Tariq Toukan Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-2-2e2fdc7d3f2c@linutronix.de Signed-off-by: Jakub Kicinski commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 Author: Thomas Weißschuh Date: Mon Aug 11 11:43:18 2025 +0200 ice: Don't use %pK through printk or tracepoints In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe. Signed-off-by: Thomas Weißschuh Acked-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de Signed-off-by: Jakub Kicinski commit acfea9361073134e828fddbd5f8201d428d7a7b1 Author: Andre Carvalho Date: Tue Aug 12 20:38:23 2025 +0100 selftests: netconsole: Validate interface selection by MAC address Extend the existing netconsole cmdline selftest to also validate that interface selection can be performed via MAC address. The test now validates that netconsole works with both interface name and MAC address, improving test coverage. Suggested-by: Breno Leitao Reviewed-by: Breno Leitao Signed-off-by: Andre Carvalho Link: https://patch.msgid.link/20250812-netcons-cmdline-selftest-v2-1-8099fb7afa9e@gmail.com Signed-off-by: Jakub Kicinski commit 3051f49b0e03b1a5a2f8a70dbc4ae5bf3759bcb7 Author: Waqar Hameed Date: Tue Aug 12 14:13:58 2025 +0200 net: enetc: Remove error print for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Joe Damato Link: https://patch.msgid.link/pnd1ppghh4p.a.out@axis.com Signed-off-by: Jakub Kicinski commit 30f7d4099fb6736712338bd3e41433db796ec869 Author: Jiawen Wu Date: Tue Aug 12 17:37:25 2025 +0800 net: libwx: cleanup VF register macros Adjust the order of VF regitser macros, make it elegant. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/778899EE1D862EC2+20250812093725.58821-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit a57384110dc633856216fc254680923905391d67 Author: Miguel García Date: Tue Aug 12 10:22:44 2025 +0200 tun: replace strcpy with strscpy for ifr_name Replace the strcpy() calls that copy the device name into ifr->ifr_name with strscpy() to avoid potential overflows and guarantee NULL termination. Destination is ifr->ifr_name (size IFNAMSIZ). Tested in QEMU (BusyBox rootfs): - Created TUN devices via TUNSETIFF helper - Set addresses and brought links up - Verified long interface names are safely truncated (IFNAMSIZ-1) Signed-off-by: Miguel García Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250812082244.60240-1-miguelgarciaroman8@gmail.com Signed-off-by: Jakub Kicinski commit 5e88777a382480d0b1f7eafb6d0fb680ec7a40bb Author: Ido Schimmel Date: Tue Aug 12 10:18:10 2025 +0300 selftests: forwarding: Add a test for FDB activity notification control Test various aspects of FDB activity notification control: * Transitioning of an FDB entry from inactive to active state. * Transitioning of an FDB entry from active to inactive state. * Avoiding the resetting of an FDB entry's last activity time (i.e., "updated" time) using the "norefresh" keyword. Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250812071810.312346-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 96326447d466ca62b713f660cfc73ef7879151a0 Author: Lorenzo Bianconi Date: Tue Aug 12 06:57:23 2025 +0200 net: mediatek: wed: Introduce MT7992 WED support to MT7988 SoC Introduce the second WDMA RX ring in WED driver for MT7988 SoC since the Mediatek MT7992 WiFi chipset supports two separated WDMA rings. Add missing MT7988 configurations to properly support WED for MT7992 in MT76 driver. Co-developed-by: Rex Lu Signed-off-by: Rex Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250812-mt7992-wed-support-v3-1-9ada78a819a4@kernel.org Signed-off-by: Jakub Kicinski commit 4d18083d6b2c02e89d833c92c3fb79e2fe1e6795 Author: Wang Liang Date: Tue Aug 12 09:59:29 2025 +0800 vsock: use sizeof(struct sockaddr_storage) instead of magic value Previous commit 230b183921ec ("net: Use standard structures for generic socket address structures.") use 'struct sockaddr_storage address;' to replace 'char address[MAX_SOCK_ADDR];'. The macro MAX_SOCK_ADDR is removed by commit 01893c82b4e6 ("net: Remove MAX_SOCK_ADDR constant"). The comment in vsock_getname() is outdated, use sizeof(struct sockaddr_storage) instead of magic value 128. Signed-off-by: Wang Liang Link: https://patch.msgid.link/20250812015929.1419896-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit b9970c4d2a34dee5ffd7c2937a631ade8c0a809d Merge: fdbe93b7f0f86c bfd9d893edfa82 Author: Jakub Kicinski Date: Wed Aug 13 16:27:44 2025 -0700 Merge branch 'refine-stmmac-code' Tiezhu Yang says: ==================== Refine stmmac code Here are three small patches to refine stmmac code when debugging and testing the problem "Failed to reset the dma". ==================== Link: https://patch.msgid.link/20250811073506.27513-1-yangtiezhu@loongson.cn Signed-off-by: Jakub Kicinski commit bfd9d893edfa8278064c4e914e29cf98e290532e Author: Tiezhu Yang Date: Mon Aug 11 15:35:06 2025 +0800 net: stmmac: Return early if invalid in loongson_dwmac_fix_reset() If the MAC controller does not connect to any PHY interface, there is a missing clock, then the DMA reset fails. For this case, the DMA_BUS_MODE_SFT_RESET bit is 1 before software reset, just print an error message which gives a hint the PHY clock is missing, and then return -EINVAL immediately to avoid waiting for the timeout when the DMA reset fails in loongson_dwmac_fix_reset(). With this patch, for the normal end user, the computer start faster with reducing boot time for 2 seconds on the specified mainboard. Signed-off-by: Tiezhu Yang Link: https://patch.msgid.link/20250811073506.27513-4-yangtiezhu@loongson.cn Signed-off-by: Jakub Kicinski commit 139235103f6039c2c77cb8f51cb2e7e610fe0114 Author: Tiezhu Yang Date: Mon Aug 11 15:35:05 2025 +0800 net: stmmac: Change first parameter of fix_soc_reset() In order to use netdev_err() to print message in the callback function of fix_soc_reset(), change fix_soc_reset() to have "struct stmmac_priv *" as its first parameter. This is preparation for later patch, no functionality change. Suggested-by: Andrew Lunn Signed-off-by: Tiezhu Yang Link: https://patch.msgid.link/20250811073506.27513-3-yangtiezhu@loongson.cn Signed-off-by: Jakub Kicinski commit 6896c2449a1858acb643014894d01b3a1223d4e5 Author: Tiezhu Yang Date: Mon Aug 11 15:35:04 2025 +0800 net: stmmac: Check stmmac_hw_setup() in stmmac_resume() stmmac_hw_setup() may return 0 on success and an appropriate negative integer as defined in errno.h file on failure, just check it and then return early if failed in stmmac_resume(). Signed-off-by: Tiezhu Yang Reviewed-by: Maxime Chevallier Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn Signed-off-by: Jakub Kicinski commit 07866544e410e4c895a729971e4164861b41fad5 Author: Amery Hung Date: Tue Aug 12 10:50:39 2025 -0700 selftests/bpf: Copy test_kmods when installing selftest Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory") consolidated the Makefile of test_kmods. However, since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel modules required by bpf selftests are now missing from kselftest_install when "make install". Fix it by adding test_kmod to TEST_GEN_FILES. Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory") Signed-off-by: Amery Hung Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 Author: Thomas Weißschuh Date: Mon Aug 11 14:08:04 2025 +0200 bpf: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de commit ed07a76be7baa0bb164b152116486e4d9fed50dc Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:47 2025 -0500 drm/simpledrm: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Reviewed-by: Javier Martinez Canillas Acked-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250703183447.2073902-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 3da01ffe1aeaa0d427ab5235ba735226670a80d9 Author: Xin Li (Intel) Date: Tue Jul 15 23:33:20 2025 -0700 x86/fred: Remove ENDBR64 from FRED entry points The FRED specification has been changed in v9.0 to state that there is no need for FRED event handlers to begin with ENDBR64, because in the presence of supervisor indirect branch tracking, FRED event delivery does not enter the WAIT_FOR_ENDBRANCH state. As a result, remove ENDBR64 from FRED entry points. Then add ANNOTATE_NOENDBR to indicate that FRED entry points will never be used for indirect calls to suppress an objtool warning. This change implies that any indirect CALL/JMP to FRED entry points causes #CP in the presence of supervisor indirect branch tracking. Credit goes to Jennifer Miller and other contributors from Arizona State University whose research shows that placing ENDBR at entry points has negative value thus led to this change. Note: This is obviously an incompatible change to the FRED architecture. But, it's OK because there no FRED systems out in the wild today. All production hardware and late pre-production hardware will follow the FRED v9 spec and be compatible with this approach. [ dhansen: add note to changelog about incompatibility ] Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code") Signed-off-by: Xin Li (Intel) Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Reviewed-by: Andrew Cooper Link: https://lore.kernel.org/linux-hardening/Z60NwR4w%2F28Z7XUa@ubun/ Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250716063320.1337818-1-xin%40zytor.com commit faab3ae329a6efb96995aeb72a68a99f664fed38 Author: Paul E. McKenney Date: Mon Jun 23 12:39:55 2025 -0700 rcu: Document that rcu_barrier() hurries lazy callbacks This commit adds to the rcu_barrier() kerneldoc header stating that this function hurries lazy callbacks and that it does not normally result in additional RCU grace periods. Signed-off-by: Paul E. McKenney commit 8ba38a7a9a699905b84fa97578a8291010dec273 Author: Kiryl Shutsemau Date: Tue Jun 24 17:59:18 2025 +0300 x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall page fault, but the CPU does not report X86_PF_INSTR if neither X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled. X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for early P4 processors that did not support this feature. Instead of explicitly checking for X86_PF_INSTR, compare the fault address to RIP. On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal to fault address but X86_PF_INSTR is absent. [ dhansen: flesh out code comments ] Originally-by: Dave Hansen Reported-by: Andrew Cooper Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Andrew Cooper Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com commit 6b70896bbdadb4dc7f5f551241aaa076727e7ee4 Merge: 8f5ae30d69d754 53ec9169db1345 Author: Linus Walleij Date: Wed Aug 13 23:45:07 2025 +0200 Merge tag 'gpio-aggregator-refactoring-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into devel Immutable branch for the pinctrl tree to pull from Refactor the gpio-aggregator module as a prerequisite for merging the pin controller driver for AAEON UP boards. Signed-off-by: Linus Walleij commit 48124569bbc6bfda1df3e9ee17b19d559f4b1aa3 Author: Wolfram Sang Date: Wed Aug 13 18:15:05 2025 +0200 spi: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://patch.msgid.link/20250813161517.4746-20-wsa+renesas@sang-engineering.com Signed-off-by: Mark Brown commit 152a09361bb2b0679277406be43d797d05e2104b Author: Jerome Brunet Date: Thu Jul 31 14:49:01 2025 +0200 Documentation: PCI: endpoint: Document BAR assignment It is now possible to assign BARs while creating a vNTB endpoint function. Update the documentation accordingly. Suggested-by: Bjorn Helgaas Signed-off-by: Jerome Brunet Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250731-vntb-doc-v1-1-95a0e0cd28d0@baylibre.com commit 1ad82f9db13d85667366044acdfb02009d576c5a Author: Dan Carpenter Date: Fri Aug 1 20:03:35 2025 +0300 misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") added NO_BAR (-1) to the pci_barno enum which, in practical terms, changes the enum from an unsigned int to a signed int. If the user passes a negative number in pci_endpoint_test_ioctl() then it results in an array underflow in pci_endpoint_test_bar(). Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") Signed-off-by: Dan Carpenter Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/aIzzZ4vc6ZrmM9rI@suswa commit b8d762c9830538c743066cbfb1f8c8a40f8e9d58 Author: Thomas Weißschuh Date: Wed Aug 13 08:17:00 2025 +0200 kbuild: uapi: upgrade check_declarations() warning to error No problematic declarations exist anymore. Make sure it stays this way. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250813-kbuild-hdrtest-fixes-v2-5-8a7921ca3a03@linutronix.de Signed-off-by: Nathan Chancellor commit c3a9d74ee413bdb3007b39e62418f9757a0642e6 Author: Thomas Weißschuh Date: Wed Aug 13 08:16:59 2025 +0200 kbuild: uapi: upgrade check_sizetypes() warning to error No problematic type usages exist anymore. Make sure it stays this way. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250813-kbuild-hdrtest-fixes-v2-4-8a7921ca3a03@linutronix.de Signed-off-by: Nathan Chancellor commit 24b1bd64ee4030a306f74811c346db4042f4c98a Author: Thomas Weißschuh Date: Wed Aug 13 08:16:58 2025 +0200 kbuild: uapi: upgrade warning on asm/types.h inclusion to error No usages of '#include in the UAPI headers exist anymore. Make sure it stays this way. Add a semicolon to the end of the previous printf call to keep the syntax valid. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250813-kbuild-hdrtest-fixes-v2-3-8a7921ca3a03@linutronix.de Signed-off-by: Nathan Chancellor commit 3788d69db18d310afa9892642520fb9b47edf829 Author: Thomas Weißschuh Date: Wed Aug 13 08:16:57 2025 +0200 kbuild: uapi: fail header test on compiler warnings Compiler warnings also indicate issues with the headers. Make sure they don't go unnoticed. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250813-kbuild-hdrtest-fixes-v2-2-8a7921ca3a03@linutronix.de Signed-off-by: Nathan Chancellor commit d4b7080be277ca400b443ac211b79450f4befddc Author: Thomas Weißschuh Date: Wed Aug 13 08:16:56 2025 +0200 kbuild: uapi: rerun header tests when headers_check.pl changes If the checks change they need to be rerun. Add a Makefile dependency so this happens. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://lore.kernel.org/r/20250813-kbuild-hdrtest-fixes-v2-1-8a7921ca3a03@linutronix.de Signed-off-by: Nathan Chancellor commit ab81f2f79c683c94bac622aafafbe8232e547159 Author: Geert Uytterhoeven Date: Wed Aug 13 17:56:25 2025 +0200 PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto err_regulator_free" by the actual freeing, as there will never be a need again for a second user of this label. Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots") Signed-off-by: Geert Uytterhoeven Signed-off-by: Bjorn Helgaas Tested-by: Marek Vasut # V4H Sparrow Hawk Reviewed-by: Manivannan Sadhasivam Reviewed-by: Marek Vasut Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be commit 0e62438e476494a1891a8822b9785bc6e73e9c3f Author: Liao Yuanhong Date: Wed Aug 13 17:39:01 2025 +0800 ASoC: Intel: sst: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250813093903.551388-1-liaoyuanhong@vivo.com Signed-off-by: Mark Brown commit 6793ca9a43c8c9262802af3e6096df0fa2dcaa6c Author: David Lechner Date: Mon Aug 11 17:17:01 2025 -0500 dt-bindings: clock: adi,axi-clkgen: add clock-output-names property Add an optional `clock-output-names` property to the ADI AXI Clock Generator binding. This is already being used in the Linux driver and real-world dtbs, so we should document it to allow for correct binding validation. Signed-off-by: David Lechner Link: https://lore.kernel.org/r/20250811-dt-bindings-clk-axi-clkgen-add-clock-output-names-property-v1-1-f02727736aa7@baylibre.com Reviewed-by: Nuno Sá Acked-by: Conor Dooley Signed-off-by: Stephen Boyd commit bedeb73fb9848df572bd6e06bcac3bb374cd0e5b Author: Rob Herring (Arm) Date: Mon Aug 4 12:53:03 2025 -0500 dt-bindings: clock: Remove unused fujitsu,mb86s70-crg11 binding The fujitsu,mb86s70-crg11 binding is unused. The driver for it was removed in 2017. It's not used for Synquacer DT either like some other mb86s70 bindings are. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804175304.3423965-1-robh@kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit cc4a7a21e815f81f782506d9f554ff2158e70ce8 Author: Lukas Wunner Date: Wed Aug 13 07:11:05 2025 +0200 PCI/ERR: Remove remnants of .link_reset() callback Back in 2017, commit 2fd260f03b6a ("PCI/AER: Remove unused .link_reset() callback") removed .link_reset() from struct pci_error_handlers, but left a few code comments behind which still mention it. Remove them. The code comments in the SolarFlare Ethernet drivers point out that no .mmio_enabled() callback is needed because the driver's .error_detected() callback always returns PCI_ERS_RESULT_NEED_RESET, which causes pcie_do_recovery() to skip .mmio_enabled(). That's not quite correct because efx_io_error_detected() does return PCI_ERS_RESULT_RECOVERED under certain conditions and then .mmio_enabled() would indeed be called if it were implemented. Remove this misleading portion of the code comment as well. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1d72a891a7f57115e78a73046e776f7e0c8cd68f.1755008151.git.lukas@wunner.de commit 45bc82563d5505327d97963bc54d3709939fa8f8 Author: Lukas Wunner Date: Wed Aug 13 07:11:04 2025 +0200 PCI/ERR: Update device error_state already after reset After a Fatal Error has been reported by a device and has been recovered through a Secondary Bus Reset, AER updates the device's error_state to pci_channel_io_normal before invoking its driver's ->resume() callback. By contrast, EEH updates the error_state earlier, namely after resetting the device and before invoking its driver's ->slot_reset() callback. Commit c58dc575f3c8 ("powerpc/pseries: Set error_state to pci_channel_io_normal in eeh_report_reset()") explains in great detail that the earlier invocation is necessitated by various drivers checking accessibility of the device with pci_channel_offline() and avoiding accesses if it returns true. It returns true for any other error_state than pci_channel_io_normal. The device should be accessible already after reset, hence the reasoning is that it's safe to update the error_state immediately afterwards. This deviation between AER and EEH seems problematic because drivers behave differently depending on which error recovery mechanism the platform uses. Three drivers have gone so far as to update the error_state themselves, presumably to work around AER's behavior. For consistency, amend AER to update the error_state at the same recovery steps as EEH. Drop the now unnecessary workaround from the three drivers. Keep updating the error_state before ->resume() in case ->error_detected() or ->mmio_enabled() return PCI_ERS_RESULT_RECOVERED, which causes ->slot_reset() to be skipped. There are drivers doing this even for Fatal Errors, e.g. mhi_pci_error_detected(). Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/4517af6359ffb9d66152b827a5d2833459144e3f.1755008151.git.lukas@wunner.de commit 9011f0667c93df2034f2ff33eae37ddf9bdd0ef9 Author: Lukas Wunner Date: Wed Aug 13 07:11:03 2025 +0200 PCI/ERR: Notify drivers on failure to recover According to Documentation/PCI/pci-error-recovery.rst, the following shall occur on failure to recover from a PCIe Uncorrectable Error: STEP 6: Permanent Failure ------------------------- A "permanent failure" has occurred, and the platform cannot recover the device. The platform will call error_detected() with a pci_channel_state_t value of pci_channel_io_perm_failure. The device driver should, at this point, assume the worst. It should cancel all pending I/O, refuse all new I/O, returning -EIO to higher layers. The device driver should then clean up all of its memory and remove itself from kernel operations, much as it would during system shutdown. Sathya notes that AER does not call error_detected() on failure and thus deviates from the document (as well as EEH, for which the document was originally added). Most drivers do nothing on permanent failure, but the SCSI drivers and a number of Ethernet drivers do take advantage of the notification to flush queues and give up resources. Amend AER to notify such drivers and align with the documentation and EEH. Link: https://lore.kernel.org/r/f496fc0f-64d7-46a4-8562-dba74e31a956@linux.intel.com/ Suggested-by: Sathyanarayanan Kuppuswamy Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/ec212d4d4f5c65d29349df33acdc9768ff8279d1.1755008151.git.lukas@wunner.de commit 1cbc5e25fb70e942a7a735a1f3d6dd391afc9b29 Author: Lukas Wunner Date: Wed Aug 13 07:11:02 2025 +0200 PCI/ERR: Fix uevent on failure to recover Upon failure to recover from a PCIe error through AER, DPC or EDR, a uevent is sent to inform user space about disconnection of the bridge whose subordinate devices failed to recover. However the bridge itself is not disconnected. Instead, a uevent should be sent for each of the subordinate devices. Only if the "bridge" happens to be a Root Complex Event Collector or Integrated Endpoint does it make sense to send a uevent for it (because there are no subordinate devices). Right now if there is a mix of subordinate devices with and without pci_error_handlers, a BEGIN_RECOVERY event is sent for those with pci_error_handlers but no FAILED_RECOVERY event is ever sent for them afterwards. Fix it. Fixes: 856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v4.16+ Link: https://patch.msgid.link/68fc527a380821b5d861dd554d2ce42cb739591c.1755008151.git.lukas@wunner.de commit d0a2dee7d4585a7ebab45bf63eebeb8b6944e88f Author: Lukas Wunner Date: Wed Aug 13 07:11:01 2025 +0200 PCI/AER: Allow drivers to opt in to Bus Reset on Non-Fatal Errors When Advanced Error Reporting was introduced in September 2006 by commit 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver"), it sought to adhere to the recovery flow and callbacks specified in Documentation/PCI/pci-error-recovery.rst. That document had been added in January 2006, when Enhanced Error Handling (EEH) was introduced for PowerPC with commit 065c6359071c ("[PATCH] PCI Error Recovery: documentation"). However the AER driver deviates from the document in that it never performs a Secondary Bus Reset on Non-Fatal Errors, but always on Fatal Errors. By contrast, EEH allows drivers to opt in or out of a Bus Reset regardless of error severity, by returning PCI_ERS_RESULT_NEED_RESET or PCI_ERS_RESULT_CAN_RECOVER from their ->error_detected() callback. If all drivers agree that they can recover without a Bus Reset, EEH skips it. Should one of them request a Bus Reset, it overrides all other drivers. This inconsistency between EEH and AER seems problematic because drivers need to be aware of and cope with it. The file Documentation/PCI/pcieaer-howto.rst hints at a rationale for always performing a Bus Reset on Fatal Errors: "Fatal errors [...] cause the link to be unreliable. [...] This [reset_link] callback is used to reset the PCIe physical link when a fatal error happens. If an error message indicates a fatal error, [...] performing link reset at upstream is necessary." There's no such rationale provided for never performing a Bus Reset on Non-Fatal Errors. The "xe" driver has a need to attempt a reset of local units on graphics cards upon a Non-Fatal Error. If that is insufficient for recovery, the driver wants to opt in to a Bus Reset. Accommodate such use cases and align AER more closely with EEH by performing a Bus Reset in pcie_do_recovery() if drivers request it and the faulting device's channel_state is pci_channel_io_normal. The AER driver sets this channel_state for Non-Fatal Errors. For Fatal Errors, it uses pci_channel_io_frozen. This limits the deviation from Documentation/PCI/pci-error-recovery.rst and EEH to the unconditional Bus Reset on Fatal Errors. pcie_do_recovery() is also invoked by the Downstream Port Containment and Error Disconnect Recover drivers. They both set the channel_state to pci_channel_io_frozen, hence pcie_do_recovery() continues to always invoke the ->reset_subordinates() callback in their case. That is necessary because the callback brings the link back up at the containing Downstream Port. There are two behavioral changes resulting from this commit: First, if channel_state is pci_channel_io_normal and one of the affected drivers returns PCI_ERS_RESULT_NEED_RESET from its ->error_detected() callback, a Bus Reset will now be performed. There are drivers doing this and although it would be possible to avoid a behavioral change by letting them return PCI_ERS_RESULT_CAN_RECOVER instead, the impression I got from examination of all drivers is that they actually expect or want a Bus Reset (cxl_error_detected() is a case in point). In any case, if they can cope with a Bus Reset on Fatal Errors, they shouldn't have issues with a Bus Reset on Non-Fatal Errors. Second, if channel_state is pci_channel_io_frozen and all affected drivers return PCI_ERS_RESULT_CAN_RECOVER from ->error_detected(), their ->mmio_enabled() callback is now invoked prior to performing a Bus Reset, instead of afterwards. This actually makes sense: For example, drivers/scsi/sym53c8xx_2/sym_glue.c dumps debug registers in its ->mmio_enabled() callback. Doing so after reset right now captures the post-reset state instead of the faulting state, which is useless. There is only one other driver which implements ->mmio_enabled() and returns PCI_ERS_RESULT_CAN_RECOVER from ->error_detected() for channel_state pci_channel_io_frozen, drivers/scsi/ipr.c (IBM Power RAID). It appears to only be used on EEH platforms. So the second behavioral change is limited to these two drivers. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/28fd805043bb57af390168d05abb30898cf4fc58.1755008151.git.lukas@wunner.de commit 4c70fb2624ab1588faa58dcd407d4c61d64b288d Author: Chen Ridong Date: Wed Aug 13 08:29:01 2025 +0000 cpuset: remove redundant CS_ONLINE flag The CS_ONLINE flag was introduced prior to the CSS_ONLINE flag in the cpuset subsystem. Currently, the flag setting sequence is as follows: 1. cpuset_css_online() sets CS_ONLINE 2. css->flags gets CSS_ONLINE set ... 3. cgroup->kill_css sets CSS_DYING 4. cpuset_css_offline() clears CS_ONLINE 5. css->flags clears CSS_ONLINE The is_cpuset_online() check currently occurs between steps 1 and 3. However, it would be equally safe to perform this check between steps 2 and 3, as CSS_ONLINE provides the same synchronization guarantee as CS_ONLINE. Since CS_ONLINE is redundant with CSS_ONLINE and provides no additional synchronization benefits, we can safely remove it to simplify the code. Signed-off-by: Chen Ridong Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 37533933bfe92cd5a99ef4743f31dac62ccc8de0 Author: Wolfram Sang Date: Wed Aug 13 18:15:01 2025 +0200 regulator: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://patch.msgid.link/20250813161517.4746-16-wsa+renesas@sang-engineering.com Signed-off-by: Mark Brown commit 7513cc391400ef1b27c422b251c2444097ed1ce7 Author: Rob Herring (Arm) Date: Mon Aug 4 17:20:08 2025 -0500 dt-bindings: clock: Convert silabs,si570 to DT schema Convert the Silicon Labs SI570 binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804222010.4082782-1-robh@kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit b02011c8c61f1e61d6b4edf6a9e24620c965d376 Author: Rob Herring (Arm) Date: Mon Aug 4 17:20:32 2025 -0500 dt-bindings: clock: Convert silabs,si5341 to DT schema Convert the Silicon Labs SI5341 binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804222034.4083410-1-robh@kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit d903f5c60a0ea95aa03d5158d38bb057da6eae3e Author: Rob Herring (Arm) Date: Mon Aug 4 17:20:40 2025 -0500 dt-bindings: clock: Convert silabs,si514/544 to DT schema Convert the Silicon Labs SI514 and SI544 bindings to DT schema format. Combine the bindings into a single schema as they are the same. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804222042.4083656-1-robh@kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit a55498c7d8a651ca5c7b8169e84d48af77e60723 Author: Hui Zhu Date: Thu Jul 31 10:50:07 2025 +0800 rust: alloc: kvec: simplify KUnit test module name to "rust_kvec" Remove redundant "_kunit" suffix from test module name. The naming is now consistent with other Rust components as the test context is already implied by the #[kunit_tests] macro and test module location. Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Hui Zhu Reviewed-by: David Gow Link: https://lore.kernel.org/r/4eb554c3bf03dd4f9e6dea659497938baab61dba.1753929369.git.zhuhui@kylinos.cn Signed-off-by: Danilo Krummrich commit 7cedf7345cce7a12c28cce8df0bdc8a62d4ca438 Author: Hui Zhu Date: Thu Jul 31 10:50:06 2025 +0800 rust: alloc: kvec: add doc example for as_slice method Add a practical usage example to the documentation of KVec::as_slice() showing how to: Create a new KVec. Push elements into it. Convert to a slice via as_slice(). Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Hui Zhu Reviewed-by: Alice Ryhl Reviewed-by: Kunwu Chan Reviewed-by: David Gow Link: https://lore.kernel.org/r/4e7f396f38ed8a780f863384bfc3d7de135ef3ea.1753929369.git.zhuhui@kylinos.cn Signed-off-by: Danilo Krummrich commit 46ab4278e9bbb16e3dc8cec52fcdcadc95936a89 Author: Shankari Anand Date: Wed Jul 16 14:39:41 2025 +0530 drm: nova: update ARef import from sync::aref Update nova to import `ARef` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://lore.kernel.org/r/20250716090941.811418-1-shankari.ak0208@gmail.com [ Alter subject and commit message to be nova specific. - Danilo ] Signed-off-by: Danilo Krummrich commit 0bbc2548ea85e6bda835a08c6d47d46435945cda Merge: a49eebfa8ba1a9 6170b1eacac881 Author: Jonathan Corbet Date: Wed Aug 13 10:19:50 2025 -0600 Merge branch 'pre-install' into docs-mw Mauro says: that's the second version of the patch series which converts sphinx-pre-install to Python. The core patches are basically the same as on v1, but it has lots of fixes over the original script after testing sphinx-install on 22 distros. Please notice that I have a separate patch series addressing issues that are specific to PDF generation. Test Results Summary: ==================== PASSED - AlmaLinux release 9.6 (Sage Margay) (4 tests) PASSED - Amazon Linux release 2023 (Amazon Linux) (4 tests) PASSED - Arch Linux (4 tests) PASSED - CentOS Stream release 9 (4 tests) PASSED - Debian GNU/Linux 12 (4 tests) PASSED - Devuan GNU/Linux 5 (4 tests) PASSED - Fedora release 42 (Adams) (4 tests) PASSED - Gentoo Base System release 2.17 (4 tests) PASSED - Kali GNU/Linux 2025.2 (4 tests) PASSED - Mageia 9 (4 tests) PASSED - Linux Mint 22 (4 tests) PASSED - openEuler release 25.03 (4 tests) PARTIAL - OpenMandriva Lx 4.3 (4 tests) ensurepip package doesn't exist there. So, venv install failed. Installed via package worked PASSED - openSUSE Leap 15.6 (4 tests) PASSED - openSUSE Tumbleweed (4 tests) PASSED - Oracle Linux Server release 9.6 (4 tests) FAILED - Red Hat Enterprise Linux release 8.10 (Ootpa) (4 tests) I couldn't test properly, as it requires a repository under paywall. I suspect It should work fine PARTIAL - Rocky Linux release 8.9 (Green Obsidian) (4 tests) Install via package didn't work. Instaling via venv works. PASSED - Rocky Linux release 9.6 (Blue Onyx) (4 tests) PARTIAL - Springdale Open Enterprise Linux release 9.2 (Parma) (4 tests) Failed to install ImageMagick (affects pdf only) PASSED - Ubuntu 24.04.2 LTS (4 tests) PASSED - Ubuntu 25.04 (4 tests) In short, I expect that, for all the above, the script will properly recommend the right packages to have sphinx-build working. A more detailed list of tests that passed/failed and detected Sphinx versions can be seeing below: AlmaLinux release 9.6 (Sage Margay): ------------------------------------ PASSED: OS detection: AlmaLinux release 9.6 (Sage Margay) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Amazon Linux release 2023 (Amazon Linux): ----------------------------------------- PASSED: OS detection: Amazon Linux release 2023 (Amazon Linux) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Arch Linux: ----------- PASSED: OS detection: Arch Linux PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 CentOS Stream release 9: ------------------------ PASSED: OS detection: CentOS Stream release 9 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Debian GNU/Linux 12: -------------------- PASSED: OS detection: Debian GNU/Linux 12 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 5.3.0 Devuan GNU/Linux 5: ------------------- PASSED: OS detection: Devuan GNU/Linux 5 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 5.3.0 Fedora release 42 (Adams): -------------------------- PASSED: OS detection: Fedora release 42 (Adams) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 Gentoo Base System release 2.17: -------------------------------- PASSED: OS detection: Gentoo Base System release 2.17 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 Kali GNU/Linux 2025.2: ---------------------- PASSED: OS detection: Kali GNU/Linux 2025.2 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 Mageia 9: --------- PASSED: OS detection: Mageia 9 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 6.1.3 PASSED: Sphinx package: Sphinx 6.1.3 Linux Mint 22: -------------- PASSED: OS detection: Linux Mint 22 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.1.3 PASSED: Sphinx package: Sphinx 4.3.2 openEuler release 25.03: ------------------------ PASSED: OS detection: openEuler release 25.03 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 OpenMandriva Lx 4.3: -------------------- PASSED: OS detection: OpenMandriva Lx 4.3 FAILED: System packages: Error: Unable to find a match: ensurepip FAILED: Sphinx on venv: Installation failed PASSED: Sphinx package: Sphinx 4.3.2 openSUSE Leap 15.6: ------------------- PASSED: OS detection: openSUSE Leap 15.6 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 7.2.6 openSUSE Tumbleweed: -------------------- PASSED: OS detection: openSUSE Tumbleweed PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 Oracle Linux Server release 9.6: -------------------------------- PASSED: OS detection: Oracle Linux Server release 9.6 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Red Hat Enterprise Linux release 8.10 (Ootpa): ---------------------------------------------- PASSED: OS detection: Red Hat Enterprise Linux release 8.10 (Ootpa) FAILED: System packages: Error: Unable to find a match: google-noto-sans-cjk-ttc-fonts librsvg2-tools texlive-amscls texlive-amsfonts texlive-amsmath texlive-anyfontsize texlive-capt-of texlive-cmap texlive-collection-fontsrecommended texlive-collection-latex texlive-ec texlive-eqparbox texlive-euenc texlive-fancybox texlive-fancyvrb texlive-float texlive-fncychap texlive-framed texlive-luatex85 texlive-mdwtools texlive-multirow texlive-needspace texlive-oberdiek texlive-parskip texlive-polyglossia texlive-psnfss texlive-tabulary texlive-threeparttable texlive-titlesec texlive-tools texlive-ucs texlive-upquote texlive-wrapfig texlive-xecjk texlive-xetex-bin FAILED: Sphinx on venv: No Sphinx version detected FAILED: Sphinx package: No Sphinx version detected Rocky Linux release 8.9 (Green Obsidian): ----------------------------------------- PASSED: OS detection: Rocky Linux release 8.9 (Green Obsidian) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 FAILED: Sphinx package: No Sphinx version detected Rocky Linux release 9.6 (Blue Onyx): ------------------------------------ PASSED: OS detection: Rocky Linux release 9.6 (Blue Onyx) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Springdale Open Enterprise Linux release 9.2 (Parma): ----------------------------------------------------- PASSED: OS detection: Springdale Open Enterprise Linux release 9.2 (Parma) FAILED: System packages: Error: Problem: package ImageMagick-6.9.13.25-1.el9.x86_64 requires libMagickCore-6.Q16.so.7()(64bit), but none of the providers can be installed - package ImageMagick-6.9.13.25-1.el9.x86_64 requires libMagickWand-6.Q16.so.7()(64bit), but none of the providers can be installed - package ImageMagick-6.9.13.25-1.el9.x86_64 requires ImageMagick-libs(x86-64) = 6.9.13.25-1.el9, but none of the providers can be installed - conflicting requests - nothing provides libraw_r.so.23()(64bit) needed by ImageMagick-libs-6.9.13.25-1.el9.x86_64 PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Ubuntu 24.04.2 LTS: ------------------- PASSED: OS detection: Ubuntu 24.04.2 LTS PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 7.2.6 Ubuntu 25.04: ------------- PASSED: OS detection: Ubuntu 25.04 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 Summary ======= PASSED - AlmaLinux release 9.6 (Sage Margay) (4 tests) PASSED - Amazon Linux release 2023 (Amazon Linux) (4 tests) PASSED - Arch Linux (4 tests) PASSED - CentOS Stream release 9 (4 tests) PASSED - Debian GNU/Linux 12 (4 tests) PASSED - Devuan GNU/Linux 5 (4 tests) PASSED - Fedora release 42 (Adams) (4 tests) PASSED - Gentoo Base System release 2.17 (4 tests) PASSED - Kali GNU/Linux 2025.2 (4 tests) PASSED - Mageia 9 (4 tests) PASSED - Linux Mint 22 (4 tests) PASSED - openEuler release 25.03 (4 tests) FAILED - OpenMandriva Lx 4.3 (4 tests) PASSED - openSUSE Leap 15.6 (4 tests) PASSED - openSUSE Tumbleweed (4 tests) PASSED - Oracle Linux Server release 9.6 (4 tests) FAILED - Red Hat Enterprise Linux release 8.10 (Ootpa) (4 tests) FAILED - Rocky Linux release 8.9 (Green Obsidian) (4 tests) PASSED - Rocky Linux release 9.6 (Blue Onyx) (4 tests) FAILED - Springdale Open Enterprise Linux release 9.2 (Parma) (4 tests) PASSED - Ubuntu 24.04.2 LTS (4 tests) PASSED - Ubuntu 25.04 (4 tests) (base) mchehab@foz /new_devel/mchehab_scripts $ ktap_reader.py /tmp/test_logs/* AlmaLinux release 9.6 (Sage Margay): ------------------------------------ PASSED: OS detection: AlmaLinux release 9.6 (Sage Margay) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Amazon Linux release 2023 (Amazon Linux): ----------------------------------------- PASSED: OS detection: Amazon Linux release 2023 (Amazon Linux) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Arch Linux: ----------- PASSED: OS detection: Arch Linux PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 CentOS Stream release 9: ------------------------ PASSED: OS detection: CentOS Stream release 9 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Debian GNU/Linux 12: -------------------- PASSED: OS detection: Debian GNU/Linux 12 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 5.3.0 Devuan GNU/Linux 5: ------------------- PASSED: OS detection: Devuan GNU/Linux 5 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 5.3.0 Fedora release 42 (Adams): -------------------------- PASSED: OS detection: Fedora release 42 (Adams) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 Gentoo Base System release 2.17: -------------------------------- PASSED: OS detection: Gentoo Base System release 2.17 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 Kali GNU/Linux 2025.2: ---------------------- PASSED: OS detection: Kali GNU/Linux 2025.2 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 Mageia 9: --------- PASSED: OS detection: Mageia 9 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 6.1.3 PASSED: Sphinx package: Sphinx 6.1.3 Linux Mint 22: -------------- PASSED: OS detection: Linux Mint 22 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.1.3 PASSED: Sphinx package: Sphinx 4.3.2 openEuler release 25.03: ------------------------ PASSED: OS detection: openEuler release 25.03 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 OpenMandriva Lx 4.3: -------------------- PASSED: OS detection: OpenMandriva Lx 4.3 FAILED: System packages: Error: Unable to find a match: ensurepip PARTIAL: Sphinx on venv: Installation failed PASSED: Sphinx package: Sphinx 4.3.2 openSUSE Leap 15.6: ------------------- PASSED: OS detection: openSUSE Leap 15.6 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 7.2.6 openSUSE Tumbleweed: -------------------- PASSED: OS detection: openSUSE Tumbleweed PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.2.3 Oracle Linux Server release 9.6: -------------------------------- PASSED: OS detection: Oracle Linux Server release 9.6 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Red Hat Enterprise Linux release 8.10 (Ootpa): ---------------------------------------------- PASSED: OS detection: Red Hat Enterprise Linux release 8.10 (Ootpa) FAILED: System packages: Error: Unable to find a match: google-noto-sans-cjk-ttc-fonts librsvg2-tools texlive-amscls texlive-amsfonts texlive-amsmath texlive-anyfontsize texlive-capt-of texlive-cmap texlive-collection-fontsrecommended texlive-collection-latex texlive-ec texlive-eqparbox texlive-euenc texlive-fancybox texlive-fancyvrb texlive-float texlive-fncychap texlive-framed texlive-luatex85 texlive-mdwtools texlive-multirow texlive-needspace texlive-oberdiek texlive-parskip texlive-polyglossia texlive-psnfss texlive-tabulary texlive-threeparttable texlive-titlesec texlive-tools texlive-ucs texlive-upquote texlive-wrapfig texlive-xecjk texlive-xetex-bin PARTIAL: Sphinx on venv: No Sphinx version detected PARTIAL: Sphinx package: No Sphinx version detected Rocky Linux release 8.9 (Green Obsidian): ----------------------------------------- PASSED: OS detection: Rocky Linux release 8.9 (Green Obsidian) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PARTIAL: Sphinx package: No Sphinx version detected Rocky Linux release 9.6 (Blue Onyx): ------------------------------------ PASSED: OS detection: Rocky Linux release 9.6 (Blue Onyx) PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Springdale Open Enterprise Linux release 9.2 (Parma): ----------------------------------------------------- PASSED: OS detection: Springdale Open Enterprise Linux release 9.2 (Parma) FAILED: System packages: Error: Problem: package ImageMagick-6.9.13.25-1.el9.x86_64 requires libMagickCore-6.Q16.so.7()(64bit), but none of the providers can be installed - package ImageMagick-6.9.13.25-1.el9.x86_64 requires libMagickWand-6.Q16.so.7()(64bit), but none of the providers can be installed - package ImageMagick-6.9.13.25-1.el9.x86_64 requires ImageMagick-libs(x86-64) = 6.9.13.25-1.el9, but none of the providers can be installed - conflicting requests - nothing provides libraw_r.so.23()(64bit) needed by ImageMagick-libs-6.9.13.25-1.el9.x86_64 PASSED: Sphinx on venv: Sphinx 7.4.7 PASSED: Sphinx package: Sphinx 3.4.3 Ubuntu 24.04.2 LTS: ------------------- PASSED: OS detection: Ubuntu 24.04.2 LTS PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 7.2.6 Ubuntu 25.04: ------------- PASSED: OS detection: Ubuntu 25.04 PASSED: System packages: Packages installed PASSED: Sphinx on venv: Sphinx 8.2.3 PASSED: Sphinx package: Sphinx 8.1.3 commit 6170b1eacac881af5732af78f33b76bd560c441b Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:56 2025 +0200 scripts: sphinx-pre-install: some adjustments related to venv While nothing was really needed for virtualenv to work on most distros, we had an issue with OpenMandriva. While checking for it, it was noticed that there was no check if python-virtualenv was installed. This didn't solve the issues we faced there: at least with the half-broken OpenMandriva Lx 4.0 docker container we used, ensurepip was not available anywhere, causing venv to fail. Add a distro-specific note about that. Note: at least at the time we did our tests, OpenMandriva Lx 4.0 docker was shipped with wrong dnf repositories. Also, there was no repos available for it anymore. So, we had to do some hacks to upgrade to 4.3 before being able to run any tests. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/e3a0e5eccd50eb506846e3e8487a2d9124ef83e2.1754992972.git.mchehab+huawei@kernel.org commit 491a99511eaf333855caf28170cfb3f6f4460b54 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:55 2025 +0200 scripts: sphinx-pre-install: add a warning for Debian-based distros On Some Debian-based distros, ImageMagick package has a broken policy that causes LaTeX to fail while building docs. Add a note about that. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/628d01784e8c24e3d93c69c436f12398e00165b3.1754992972.git.mchehab+huawei@kernel.org commit 9f51a1d6966760dadf62ff1f62c614a342fb7e62 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:54 2025 +0200 scripts: sphinx-pre-install: add support for RHEL8-based distros On RHEL8, only installing with a venv is supported, as there's no Sphinx package using Python 3.7 or upper. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/bcdde20edab07be6bf447eac18eecdd88c7f947c.1754992972.git.mchehab+huawei@kernel.org commit df4d2f966354297c94ba5e198533cc31548a12a8 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:53 2025 +0200 scripts: sphinx-pre-install: update mandatory system deps To build docs, gcc is not needed. Also, Kernel can be built nowadays with clang. So, drop it. On the other hand, which is needed. Add a system dependency for it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/4ec979e4692c9e4acd6c31424c0e2f4bf5b80e71.1754992972.git.mchehab+huawei@kernel.org commit 29e71d96837dd49ab2f35f3524a1ceda0ff21ea7 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:52 2025 +0200 scripts: sphinx-pre-install.pl: get rid of the old script All features were ported to the Python version. Plus, it supports more variants and contain fixes. So, drop the old version. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/6900872e6b89b7ff304e70f5d1c23cbb3c757d28.1754992972.git.mchehab+huawei@kernel.org commit d43cd965f3a646d22851192c659b787dba311d87 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:51 2025 +0200 docs: Makefile: switch to the new scripts/sphinx-pre-install.py Now that we have a better, improved Python script, use it when checking for documentation build dependencies. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/79508fb071512c33e807f5411bbff1904751b5d3.1754992972.git.mchehab+huawei@kernel.org commit 24a34b3b453dc8fff0366a28c472b603f98a5c20 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:50 2025 +0200 scripts: sphinx-pre-install: rework install command logic Cleanup the code to remove some redundancy and to let it be clearer about the command install instructions. Ensure that special instructions will be shown only once, before the actual install command. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a6120449d9cc14346e867d1ef8944ae28ddbf3f6.1754992972.git.mchehab+huawei@kernel.org commit 8b45effaa2ce2790e3b391e1ac4bb668e0d37560 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:49 2025 +0200 scripts: sphinx-pre-install: fix several codingstyle issues Address most pylint issues. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/5139b18535e1436e4b1773706224a9ec3a386697.1754992972.git.mchehab+huawei@kernel.org commit 6d5f4f3da1a82786650d38067bb4c5e4ed84dc61 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:48 2025 +0200 scripts: sphinx-pre-install: add docstring documentation This program is somewhat complex. Add some docstring documentation, explaining what each function and class is supposed to do. Most of the focus here were to describe the ancillary functions used to detect dependency needs. The main SphinxDependencyChecker still requires a lot of care, and probably need to be reorganized to clearly split the 4 types of output it produces: - Need to upgrade Python binary; - System install needs; - Virtual env install needs; - Python install needs via system packages, to run Sphinx natively. Yet, for now, I'm happy of having it a lot better documented than its Perl version. - While here, rename a parameter to have its usage better documented. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0cadab2cab3f78ae6d9f378e92a45125fbc5188f.1754992972.git.mchehab+huawei@kernel.org commit f477c6d71d3947ab8f2e9e7d5fd8448f7a26c1ab Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:47 2025 +0200 scripts: sphinx-pre-install: add documentation for the ancillary classes. While here, rename a parameter to have its usage better documented. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/7421112b14edf5c21cc4cf0f2ee320fcaf874b40.1754992972.git.mchehab+huawei@kernel.org commit fb22e438b23eabd828a0ca1076be5ecf9b0262db Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:46 2025 +0200 scripts: sphinx-pre-install: move get_system_release() The code at get_system_release() is actually a helper function, independent from the actual Sphinx verification checker. Move it to MissingCheckers class, where other checkers are present. With that, the entire distro-specific handler logic, with all its complexity is confined at SphinxDependencyChecker class. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/4b42a85bbb6575bb34a58cf66019038c4afa1d5b.1754992972.git.mchehab+huawei@kernel.org commit 9bb5f0dc18d037635f4c5075747de1e47493b538 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:45 2025 +0200 scripts: sphinx-pre-install: add more generic checkers on a class Better organize the code by moving the more generic methods to MissingCheckers. Such class contain only binary and package dependent missing checkers, but no distro-specific data or code. All distro-specific data/code remains at SphinxDependencyChecker class. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/11a252fe816bd7c85583d26ade0666eb2b481bf0.1754992972.git.mchehab+huawei@kernel.org commit 1e9ba3b6d4cef8b1b87d6226ab7026c9745cc1d7 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:44 2025 +0200 scripts: sphinx-pre-install: move ancillary checkers to a separate class The code there are just a bunch of static functions that are used by the main class. group them altogether to better organize the code. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/e2671eb14fae7a8510f5305ac44ad8063e237a5f.1754992972.git.mchehab+huawei@kernel.org commit 2cab00fb178a31bca45adc1ff5f0994679d116a4 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:43 2025 +0200 scripts: sphinx-pre-install: move missing logic to a separate class Better manage dependencies by placing them on a distro-independent class. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/f4f5bf276e07dc494f5dc83c4c2d087be7f790e6.1754992972.git.mchehab+huawei@kernel.org commit 272f5e0390dd9b5f62b480eae482a67d2493630e Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:42 2025 +0200 scripts: sphinx-pre-install: better handle RHEL-based distros Better implement support for RHEL-based distros. While here, get rid of a Fedora 28 support which cause troubles with server distros. Also, get rid of yum, as RHEL8 already suppords dnf, and this is not the minimal version we may still support. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/4d1b27d3a381f011e150bb50176babba83af9e1a.1754992972.git.mchehab+huawei@kernel.org commit 9ecda2e10101537e97bcb2b05049e58306ac4e1b Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:41 2025 +0200 scripts: sphinx-pre-install: convert is_optional to a class When is_optional was added in Perl, it was a boolean. With time, it ended becoming a sort of enum, which makes the module harder to maintain. Convert it to a enum-like class and add more options to it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/42290a24f3b1dbea9ebe19747cf5622bb2f2cf5c.1754992972.git.mchehab+huawei@kernel.org commit 8cd256524a920782268a0dd7e3e0404c34bfc65f Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:40 2025 +0200 scripts: sphinx-pre-install: better handle Python min version Don't do any recommendations about Sphinx install with too old python versions. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/013aeb848ecc3f6b69b4518cf3d335bd2353b6e1.1754992972.git.mchehab+huawei@kernel.org commit 6db1d3977baf7ac895033624897d38fb60cbe3f7 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:39 2025 +0200 scripts: sphinx-pre-install: adjust a warning message There is one extra space at the first line. Also, as now we only support Python 3.4+, update the text. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/74a17edd70364ca623a54b62bd97a344bb474988.1754992972.git.mchehab+huawei@kernel.org commit 1ad72e9dfa5ef24ca489b7cbaa5f6f85b1fe87d8 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:38 2025 +0200 scripts: sphinx-pre-install: move package instructions to a new func Currently, if Python < 3.7, package install will fail. That happens with OpenSuse Leap and RHEL-based ver 8 distros. OpenSuse allows installing Sphinx with Python 3.11, but RHEL-based distros don't. Prepare to recomend only venv on such cases. For now, just split the recomendation on a new function that will check for a paramtere to be called. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/4fb2181c960e89774309a833f80209a1a3ab10d2.1754992972.git.mchehab+huawei@kernel.org commit fb08659be07e646f8103449e02d5e58b32c284d9 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:37 2025 +0200 scripts: sphinx-pre-install: fix OpenMandriva support OpenMandriva Lx 4.3 has different package names for ImageMagick and yaml. Fix them to ensure that system setup will pass. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0b4e7aa88c96e6a5b8f2e6f381b3e21124680d33.1754992972.git.mchehab+huawei@kernel.org commit 1a7da749f18335d7996df3004225ca7418a1052d Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:36 2025 +0200 scripts: sphinx-pre-install: improve Gentoo package deps logic It took me a lot of time, but I guess understand now what it takes to install a package on Gentoo. Handling dependencies is a nightmare, as Gentoo refuses to emerge some packages if there's no package.use file describing them. To make it worse, compilation flags shall also be present there for some packages. If USE is not perfect, error/warning messages like those are shown: gnome-base/librsvg dev-texlive/texlive-xetex media-fonts/dejavu dev-python/pyyaml ... !!! The following binary packages have been ignored due to non matching USE: =media-gfx/graphviz-12.2.1-r1 X pdf -python_single_target_python3_13 qt6 svg =media-gfx/graphviz-12.2.1-r1 X pdf python_single_target_python3_12 -python_single_target_python3_13 qt6 svg =media-gfx/graphviz-12.2.1-r1 X pdf qt6 svg =media-gfx/graphviz-12.2.1-r1 X pdf -python_single_target_python3_10 qt6 svg =media-gfx/graphviz-12.2.1-r1 X pdf -python_single_target_python3_10 python_single_target_python3_12 -python_single_target_python3_13 qt6 svg =media-fonts/noto-cjk-20190416 X =app-text/texlive-core-2024-r1 X cjk -xetex =app-text/texlive-core-2024-r1 X -xetex =app-text/texlive-core-2024-r1 -xetex =dev-libs/zziplib-0.13.79-r1 sdl If emerge is allowed, it will simply ignore the above packages, creating an incomplete installation, which will later fail when one tries to build docs with images or build PDFs. After the fix, command line commands to produce the needed USE chain will be emitted, if they don't exist yet. sudo su -c 'echo "media-gfx/graphviz" > /etc/portage/package.use/graphviz' sudo su -c 'echo "media-gfx/imagemagick" > /etc/portage/package.use/imagemagick' sudo su -c 'echo "media-libs/harfbuzz icu" > /etc/portage/package.use/media-libs' sudo su -c 'echo "media-fonts/noto-cjk" > /etc/portage/package.use/media-fonts' sudo su -c 'echo "app-text/texlive-core xetex" > /etc/portage/package.use/texlive' sudo su -c 'echo "dev-libs/zziplib sdl" > /etc/portage/package.use/zziblib' The new logic tries to be smart enough to detect for missing files and missing arguments. Yet, as Gentoo seems to require users to manage those package.use files by hand, the logic isn't perfect: users may still need to verify for conflicts on different use files. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/365fe5e7d568da932dcffde65f48f2c1256cb773.1754992972.git.mchehab+huawei@kernel.org commit 42e3f9f360e70bea4ee7d4e895f042d86ee11500 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:35 2025 +0200 scripts: sphinx-pre-install: remove Scientific Linux According with its website: https://scientificlinux.org/ Scientific Linux reached end of life in June 30, 2024. Also, it was based on RHEL 7, which is not compatible with our build system anymore. So, drop support for it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/dde5e0c95017022840f8a522ce44759e51f52aa1.1754992972.git.mchehab+huawei@kernel.org commit e53e6d395fe036bb2c24dc79dc728e9a82ee0b82 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:34 2025 +0200 scripts: sphinx-pre-install: fix rhel recomendations Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/393a299a850ba9d94c6a8965e78db4da2dbf7e37.1754992972.git.mchehab+huawei@kernel.org commit 8b18e86f6c0063e33096bf84ffcd9fb9ced4844d Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:33 2025 +0200 scripts: sphinx-pre-install: fix Leap support for rsvg-convert There is a test logic meant to be for Leap, renaming rsvg-convert package. Well, at least on latest Leap releases, this is wrong, causing install to fail. Drop it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/6fcc94533d860e2f6f4f2c7d6ceb6cca70f48bb6.1754992972.git.mchehab+huawei@kernel.org commit cccc5389811a34eccbd0f531c89d284f1cebdd70 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:32 2025 +0200 scripts: sphinx-pre-install: add a missing f-string marker I forgot one f-string marker, with turned to be affecting 3 lines, because of cut-and-paste ;-) Use the proper f-string marker to print Sphinx version at the hint lines. Yet, we don't want to print as a tuple, so call ver_str() for it. Ideally, we would be placing it directly at the f-string, but Python 3.6 f-string support was pretty much limited. Only 3.12 (PEP 701) makes it similar to Perl, allowing expressions inside it. It sounds that function call itself was introduced on 3.7. As we explicitly want this one to run on 3.6, as latest Leap comes with it, we can't use function calls on f-string. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b0ad1795446b17a00ba2dd83f366e784253668e6.1754992972.git.mchehab+huawei@kernel.org commit 637fa6b38113fddca7da2f0507f709f46a44047a Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:31 2025 +0200 scripts: sphinx-pre-install: output Python and docutils version Specially when debugging issues, knowing the versions is important. Add it to the script output. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/96142ec916b9064c859b200639c3595115080322.1754992972.git.mchehab+huawei@kernel.org commit 8f6f54c464d7fccfb8da46ca0afcb0860e6d73bb Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:30 2025 +0200 scripts: sphinx-pre-install: cleanup rhel support Rhel < 8.0 is not supported anymore. Drop support for it. Rhel 8 is problematic: at least on the tests I did with a docker repo, it didn't work, but it could be due to the issue that it is actually different than a real One. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/62fe8ab243ad39f4964f1f74b965e43dc8f10e23.1754992972.git.mchehab+huawei@kernel.org commit 12bdcf898977172a93fc30668f8918da83c51f86 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:29 2025 +0200 scripts: sphinx-pre-install: only show portage hints once On gentoo, doesn't repeat instructions about how to enable portage. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/d4e7ef1d5e1f0412eb9f9ae4913dc64c0821e002.1754992972.git.mchehab+huawei@kernel.org commit 94a161d998a103346088d97da6d1cfec4df97ddc Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:28 2025 +0200 scripts: sphinx-pre-install: Address issues with OpenSUSE Tumbleweed On Tumbleweed, package names are named after python-313*, as it also has older python versions on it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/fe0b5f7c18d7b32e0229c0890371e1441ffea294.1754992972.git.mchehab+huawei@kernel.org commit 582b0f95c92e0a0ec79d23ed434786251bd4378b Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:27 2025 +0200 scripts: sphinx-pre-install: fix support for gentoo Some gentoo packages have changes. Fix it. While here, improve emerge portage use logic. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/283987633aae7d99e0eff41e24eb6285c1b6b335.1754992972.git.mchehab+huawei@kernel.org commit c5ffae0fa965884d09458002e3d990c039602809 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:26 2025 +0200 scripts: sphinx-pre-install: fix opensuse Leap hint for PyYAML On Leap, the name of the package is python311-PyYAML. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/0266c5e28e136c62de33d2d7f7d5e69b273e0d01.1754992972.git.mchehab+huawei@kernel.org commit 2cb4877b74349e33be9e209fbcce6114c9a38b9f Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:25 2025 +0200 scripts: sphinx-pre-install: Address issues with OpenSUSE Leap 15.x On openSUSE Leap 15.6, which is the current LTS version, has two Sphinx packages. The normal one requires Python 3.6, which we don't support anymore. However, it also has Python 3.11 with a newer Sphinx version (7.2.6). Suggest the newer version: Detected OS: openSUSE Leap 15.6. ERROR: at least python 3.7 is required to build the kernel docs Warning: python version is not supported. Warning: better to also install "convert". Warning: better to also install "dot". ERROR: please install "yaml", otherwise, build won't work. You should run: sudo zypper install --no-recommends ImageMagick graphviz python311-pyyaml Sphinx needs to be installed either: 1) via pip/pypi with: Currently not possible. Please upgrade Python to a newer version and run this script again 2) As a package with: sudo zypper install --no-recommends python311-Sphinx Please note that Sphinx >= 3.0 will currently produce false-positive warning when the same name is used for more than one type (functions, structs, enums,...). This is known Sphinx bug. For more details, see: https://github.com/sphinx-doc/sphinx/pull/8313 Can't build as 2 mandatory dependencies are missing Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a1600e292b63f96f40163e350238812158ebd6c2.1754992972.git.mchehab+huawei@kernel.org commit f25bf12afc03ce88ca82fd2ed67fbee5c1ed0cd8 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:24 2025 +0200 scripts: sphinx-pre-install: drop support for old virtualenv Up to Python 3.2, the virtual environment were created via virtualenv binary. As we dropped support for such old version, clean up the code. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/31afe394bcfd8f7e450263c1922d2c73b91d36d8.1754992972.git.mchehab+huawei@kernel.org commit ea5dd67722c1ac8ae65ae5a9390452931890f52e Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:23 2025 +0200 scripts: sphinx-pre-install: drop obsolete routines Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/afb97854f05b0852f4c6c1fcee102e9697c14cd8.1754992972.git.mchehab+huawei@kernel.org commit 728648b6a5faa1d6be1e90c04a71481ba33fd08d Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:22 2025 +0200 scripts: sphinx-pre-install: run on a supported version The scripts/sphinx-pre-install is used to detect problems at the system environment and adjust it to build the Kernel documentation. If the version is too old, it won't run, though. Check if the version which started the script is valid. If not, seek for a new one that is compatible with documentation build. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/76627055a7f82f6a79296ddbd873fa5ac8f82a1d.1754992972.git.mchehab+huawei@kernel.org commit 56a8767751c4bd2b93ba8840a78eccae7018d57c Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:21 2025 +0200 scripts: sphinx-pre-install: Make it compatible with Python 3.6 The minimal version requirements we have is 3.9. Yet, the script which detects it is this one. So, let's try supporting an old version here, as we may want to suggest to upgrade Python version to build the docs. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/39d6e27a047bc3cc8208ac5e11fe6ba44faff9c4.1754992972.git.mchehab+huawei@kernel.org commit ca9087f50772aa5794dd655ff5a0719dd4b83b1f Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:20 2025 +0200 scripts: sphinx-pre-install: Convert script to Python Port scripts/sphinx-pre-install to Python. That allows a better maintainance of the file. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/8d236079545aff796900bde4cdaaf79411d04074.1754992972.git.mchehab+huawei@kernel.org commit a9c50a51e0129057dbaf58fbaf7ba1a8a69e9b21 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:19 2025 +0200 scripts: sphinx-pre-install: rename it to scripts/sphinx-pre-install.pl That helps us to later replace the scripts. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/08d9a32a5aaf3784fef016594efe505d7c5a2697.1754992972.git.mchehab+huawei@kernel.org commit 7bb184222e9fa8b839247c3a1cb1bcf628e519a5 Author: Mauro Carvalho Chehab Date: Tue Aug 12 17:52:18 2025 +0200 scripts: sphinx-pre-install: fix version check for Fedora The script is now picking the wrong version. Fix it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/9d1e5c9906534e2bae586f891770066346463146.1754992972.git.mchehab+huawei@kernel.org commit 70d00858645c0fb72ac63cf61c784b600aa9ea50 Author: Dan Carpenter Date: Wed Aug 13 08:38:08 2025 +0300 audit: add a missing tab Someone got a bit carried away deleting tabs. Add it back. Signed-off-by: Dan Carpenter Signed-off-by: Paul Moore commit 113e9a284d4372322da90c05f1dc36e0a52e5fca Author: Thorsten Blum Date: Wed Aug 13 12:34:16 2025 +0200 ALSA: hda: Improve local variable data type in snd_hda_get_num_devices() Use 'int' instead of 'unsigned int' because the local variable 'parm' can be negative. While an unsigned integer is harmless in practice due to the implicit type conversion, it's safer and more idiomatic to use a signed integer to properly check for -1. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250813103418.164110-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 96c08ff80b8fce45e49fee5eba4b40b1654eb5aa Author: Dan Carpenter Date: Wed Aug 6 14:46:12 2025 +0300 tty: sysrq: delete unnecessary check This code checks if (write) is true twice in a row. It's more readable to delete the first check. Signed-off-by: Dan Carpenter Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/aJNAhHtKkhWjosDV@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit aff8436ed97b99cd27f192d9a71ac2b1aa7b9d03 Author: Takashi Iwai Date: Mon Aug 11 12:13:55 2025 +0200 ALSA: usb-audio: Use auto-cleanup for shutdown locks Introduce an auto-cleanup macro for the temporary shutdown locks for USB-audio, and replace the manual lock/unlock pairs with it. Namely, the former err = snd_usb_lock_shutdown(chip); if (err < 0) return err; .... snd_usb_unlock_shutdown(chip); is replaced with CLASS(snd_usb_lock, pm)(chip); if (pm.err < 0) return pm.err; .... with the automatic unlocking. Link: https://patch.msgid.link/20250811101647.8637-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae Author: Komal Bajaj Date: Thu Jul 31 14:31:32 2025 +0530 usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls EUD_MODE_MANAGER2 register is mapped to a memory region that is marked as read-only for operating system running at EL1, enforcing access restrictions that prohibit direct memory-mapped writes via writel(). Attempts to write to this region from HLOS can result in silent failures or memory access violations, particularly when toggling EUD (Embedded USB Debugger) state. To ensure secure register access, modify the driver to use qcom_scm_io_writel(), which routes the write operation to Qualcomm Secure Channel Monitor (SCM). SCM has the necessary permissions to access protected memory regions, enabling reliable control over EUD state. SC7280, the only user of EUD is also affected, indicating that this could never have worked on a properly fused device. Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") Signed-off-by: Melody Olvera Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Souradeep Chowdhury Signed-off-by: Komal Bajaj Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 738812440b3c9083188191caa62ef950cf1ed9ed Author: Rob Herring (Arm) Date: Thu Aug 7 16:43:50 2025 -0500 dt-bindings: usb: Drop duplicate nvidia,tegra20-ehci.txt The nvidia,tegra20-ehci binding is already documented in ci-hdrc-usb2.yaml, so drop the old text binding. Signed-off-by: "Rob Herring (Arm)" Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250807214351.4172243-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman commit 186e8f2bdba551f3ae23396caccd452d985c23e3 Author: Dan Carpenter Date: Thu Aug 7 18:55:00 2025 +0300 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it. Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit aeb0169217ebf91b65927c7ce5f27318b2059aa4 Author: Krishna Kurapati Date: Tue Jul 29 14:57:08 2025 +0530 usb: dwc3: qcom: Remove extcon functionality from glue layer Historically Qualcomm DWC3 glue driver supported both extcon and usb-role-switch kinds of notifications. When Bjorn contributed [1] the flattened representation for the DWC3 host controller, he also kept both extcon and usb-role-switch support in the flattened driver & bindings. Currently there are no in-kernel users for flattened DWC3 and extcon. As device's DT needs to be manually converted from legacy to the flat DWC3 representation, we can drop (legacy / deprecated) extcon support from the new DWC3 glue driver, significantly simplifying the code. This potentially affects flattening effort for the following platforms: Platforms currently using linux,extcon-usb-gpio device that need to switch to gpio-usb-b-connector: - apq8096-db820c, - msm8996-sony-xperia-tone-dora Platforms currently using linux,extcon-usb-gpio device that need to switch to gpio-usb-c-connector (not supported at this moment) or to implement typec support - msm8996-sony-xperia-tone-kagura - msm8996-sony-xperia-tone-keyaki - msm8998-fxtec-pro1 - msm8998-sony-xperia-yoshino-lilac - msm8998-sony-xperia-yoshino-maple - msm8998-sony-xperia-yoshino-poplar - sda660-inforce-ifc6560 - sdm630-sony-xperia-nile-discovery - sdm630-sony-xperia-nile-pioneer - sdm630-sony-xperia-nile-voyager - sdm660-xiaomi-lavender - sm6125-sony-xperia-seine-pdx201 - sm6125-xiaomi-ginkgo - sm6125-xiaomi-laurel-sprout Platforms using TI TUSB320L chip need to switch to represent the USB-C connector properly (and to have a typec-class driver for the TUSB320L chip): - msm8996-xiaomi-gemini - msm8996pro-xiaomi-natrium - msm8996pro-xiaomi-scoprpio Commit message suggested by Dmitry Baryshkov. [1]: https://lore.kernel.org/all/20250414-dwc3-refactor-v7-0-f015b358722d@oss.qualcomm.com/ Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250729092708.3628187-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 4b58e0638c4b0f4b80c87b1c711b065eca559551 Author: Waqar Hameed Date: Tue Aug 5 11:33:37 2025 +0200 usb: misc: eud: Remove error print for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/pndo6sukt8u.a.out@axis.com Signed-off-by: Greg Kroah-Hartman commit b12daf363f3d4ded1c12d01ab7c45b6179c586ab Author: Dominique Martinet Date: Fri Aug 1 16:52:02 2025 +0900 USB: lower "Device is not authorized for usage" message to info This message is not a useful error in practice: - when using tools such as usbguard, the message is always printed but it does not presume anything regarding the actual device acceptance (later 'authorized to connect' message is at info level, and not displayed on console) - this can be a source of flood if a usb device connection is flaky - ... and it is only displayed as the result of an admin action (modifying authorized_default), working as intended, so not likely to be an error. This is still useful to know when looking at usb devices problems, so info seems appropriate for this class of messages together with the later eventual authorized message. Signed-off-by: Dominique Martinet Link: https://lore.kernel.org/r/20250801-usb-auth-v1-1-a59bfdf0293f@atmark-techno.com Signed-off-by: Greg Kroah-Hartman commit 015709748ca921975ac1c91b40f664ca8c370eb6 Author: Lad Prabhakar Date: Tue Aug 5 12:47:30 2025 +0100 usb: renesas_usbhs: Add support for RZ/T2H SoC Add support for the Renesas RZ/T2H (r9a09g077) SoC by adding a compatible string to the usbhs_of_match table. The USBHS controller on the RZ/T2H is functionally similar to the one found on the RZ/G2L. While there are minor differences in register fields (for example, the AWAIT[8:13] bits in SYSCFG1 register), the current driver does not configure these, allowing reuse of the existing usbhs_rzg2l_plat_info for the RZ/T2H. Signed-off-by: Lad Prabhakar Link: https://lore.kernel.org/r/20250805114730.2491238-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit e58ebd14a5f15eccf3dd45edf4bc900b346096bf Author: Lad Prabhakar Date: Tue Aug 5 12:47:29 2025 +0100 dt-bindings: usb: renesas,usbhs: Add RZ/T2H and RZ/N2H support Document the USBHS controller for the Renesas RZ/T2H (r9a09g077) and RZ/N2H (r9a09g087) SoCs. While the USBHS block is similar to the one found on the RZ/G2L SoC, it differs slightly in terms of interrupt configuration, clock/reset requirements, and register bit definitions. Due to these differences, a new compatible string `renesas,usbhs-r9a09g077` is introduced for the RZ/T2H SoC. The USBHS controller on the RZ/N2H (r9a09g087) SoC is identical to that on the RZ/T2H, so it uses the `renesas,usbhs-r9a09g077` compatible string as a fallback. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250805114730.2491238-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 784ad808ae864490b93db0f650b8b6417eb7ce68 Author: Prashanth K Date: Fri Jul 25 11:51:58 2025 +0530 usb: dwc3: qcom: Add shutdown handler Currently during system reboot, SMMU disables its translations while devices like USB may still be actively using DMA buffers. This can lead to NOC errors and system crashes due to invalid memory access. Address this by adding a shutdown callback to dwc3-qcom, which ensures proper teardown of UDC stack and prevents DWC3 controller from accessing memory after SMMU translation is disabled. Reuse the existing remove callback for this purpose. Signed-off-by: Prashanth K Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20250725062158.2418961-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 20b3c9a403ee23e57a7e6bf5370ca438c3cd2e99 Author: Rob Herring (Arm) Date: Wed Aug 6 16:28:23 2025 -0500 dt-bindings: arm: Convert ti,keystone to DT schema Signed-off-by: Rob Herring (Arm) Reviewed-by: Andrew Davis Link: https://lore.kernel.org/r/20250806212824.1635084-1-robh@kernel.org Signed-off-by: Nishanth Menon commit a5039648f86424885aae37f03dc39bc9cb972ecb Author: Thomas Weißschuh Date: Mon Aug 11 09:48:30 2025 +0200 soc: ti: pruss: don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de Signed-off-by: Nishanth Menon commit 47a32605c6e7f283f373b56e9caf97c56b7e5634 Author: Brandon Brnich Date: Fri Aug 8 10:55:55 2025 -0500 arm64: dts: ti: k3-j722s-main: Add E5010 JPEG Encoder This adds node for E5010 JPEG Encoder which is a stateful JPEG Encoder present in J722s SoC, supporting baseline encoding of semiplanar based YUV420 and YUV422 raw video formats to JPEG encoding, with resolutions supported from 64x64 to 8kx8k. Signed-off-by: Brandon Brnich Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250808155555.2632451-1-b-brnich@ti.com Signed-off-by: Nishanth Menon commit 260221b2a053a30e30575fa90c326590e8fb0c76 Author: Yuri Martins Date: Tue Aug 12 01:56:06 2025 +0000 staging: vc04_services/vchiq-mmal: fix typos in comments Fix three spelling mistakes found in comments across the vchiq-mmal driver component: - recived -> received - servie -> service - enque -> enqueues Signed-off-by: Yuri Martins Link: https://lore.kernel.org/r/20250812015524.64413-1-yurimartins2004@hotmail.com Signed-off-by: Greg Kroah-Hartman commit 9307cad31efcfe3446847ee34effaaa5c4930fa8 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:28:04 2025 +0530 arm64: dts: ti: k3-am62a-main: Add CSI2 interrupts property Add interrupts property for CDNS CSI2RX. Interrupt IDs are taken from the AM62A TRM [0]. Interrupt Line | Source Interrupt ---------------------------|---------------------------------- GICSS0_COMMON_0_SPI_IN_175 | CSI_RX_IF0_COMMON_0_CSI_ERR_IRQ_0 GICSS0_COMMON_0_SPI_IN_173 | CSI_RX_IF0_COMMON_0_CSI_IRQ_0 [0]: https://www.ti.com/lit/pdf/spruj16 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-8-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit e5b264e0a201254a38836b794ff362e8400f3df7 Author: Ovidiu Panait Date: Mon Aug 11 11:54:17 2025 +0300 staging: axis-fifo: use unique identifiers in device names Axis-fifo devices use physical addresses in their name, for example 'axis_fifo_0x43c00000'. This is generally frowned upon and it does not follow the usual naming scheme that uses unique identifiers. Therefore, use ida_alloc()/ida_free() to implement unique identifiers for axis-fifo device names (i.e. axis_fifo0, axis_fifo1, etc.). Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250811085417.2641674-2-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit 96ba5ce55ec192ca28446d4045dfd501270769b3 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:28:03 2025 +0530 arm64: dts: ti: k3-am62-main: Add CSI2 interrupts property Add interrupts property for CDNS CSI2RX. Interrupt IDs are taken from the AM62 TRM [0]. Interrupt Line | Source Interrupt ---------------|-------------------------- gicss0.spi.175 | csi_rx_if.0.csi_err_irq.0 gicss0.spi.173 | csi_rx_if.0.csi_irq.0 [0]: https://www.ti.com/lit/pdf/spruiv7 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-7-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit 772cc597174486b85585ed02a74cc332ba25de01 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:28:02 2025 +0530 arm64: dts: ti: k3-j722s-main: Add CSI2 interrupts property Add interrupts property for CDNS CSI2RX. Interrupt IDs are taken from the J722S TRM [0]. Interrupt Line | Source Interrupt -------------------|------------------------- GICSS0_SPI_IN_178 | CSI_RX_IF1_CSI_ERR_IRQ_0 GICSS0_SPI_IN_179 | CSI_RX_IF1_CSI_IRQ_0 GICSS0_SPI_IN_219 | CSI_RX_IF2_CSI_ERR_IRQ_0 GICSS0_SPI_IN_232 | CSI_RX_IF2_CSI_IRQ_0 GICSS0_SPI_IN_249 | CSI_RX_IF3_CSI_ERR_IRQ_0 GICSS0_SPI_IN_250 | CSI_RX_IF3_CSI_IRQ_0 [0]: https://www.ti.com/lit/zip/sprujb3 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-6-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit 347866a21ff447e868305426c294395b2cee68a7 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:28:01 2025 +0530 arm64: dts: ti: k3-am62p-j722s-common-main: Add CSI2 interrupts property Add interrupts property for CDNS CSI2RX. Interrupt IDs are taken from the J722S TRM [0]. Interrupt Line | Source Interrupt -------------------|------------------------- GICSS0_SPI_IN_175 | CSI_RX_IF0_CSI_ERR_IRQ_0 GICSS0_SPI_IN_173 | CSI_RX_IF0_CSI_IRQ_0 [0]: https://www.ti.com/lit/zip/sprujb3 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-5-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit 6e5187d82d9b20eb72938deda625a1976148241c Author: Michael Straube Date: Mon Aug 11 09:09:06 2025 +0200 staging: rtl8723bs: remove unnecessary forward declarations Remove unnecessary forward declarations of static functions to improve readability. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250811070906.27232-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 265dca4380753af9aa9480c7c201c820d6e7905e Author: Michael Straube Date: Mon Aug 11 09:09:05 2025 +0200 staging: rtl8723bs: use crypto_xor_cpy Use the in-kernel function crypto_xor_cpy instead of the custom function bitwise_xor, as using in-kernel functions is preferred over custom implementations. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250811070906.27232-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 84ba1f67c6169e4533aa109888accbbccef25705 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:28:00 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2-main-common: Add CSI2 interrupts property Add interrupts property for CSI2RX. Interrupt IDs are taken from the J784S4 TRM [0]. Interrupt Line | Source Interrupt --------------------|------------------------- GIC500SS_SPI_IN_185 | CSI_RX_IF0_CSI_ERR_IRQ_0 GIC500SS_SPI_IN_184 | CSI_RX_IF0_CSI_IRQ_0 GIC500SS_SPI_IN_189 | CSI_RX_IF1_CSI_ERR_IRQ_0 GIC500SS_SPI_IN_188 | CSI_RX_IF1_CSI_IRQ_0 GIC500SS_SPI_IN_193 | CSI_RX_IF2_CSI_ERR_IRQ_0 GIC500SS_SPI_IN_192 | CSI_RX_IF2_CSI_IRQ_0 [0]: https://www.ti.com/lit/zip/spruj52 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-4-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit 33b34bfa4f22216845f5fd738d320e78d75cf1ff Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:27:59 2025 +0530 arm64: dts: ti: k3-j721e-main: Add CSI2 interrupts property Add interrupts property for CSI2RX. Interrupt IDs are taken from the J721E TRM [0]. Interrupt Line | Source Interrupt ------------------|------------------------- GIC500_SPI_IN_185 | CSI_RX_IF0_CSI_ERR_IRQ_0 GIC500_SPI_IN_184 | CSI_RX_IF0_CSI_IRQ_0 GIC500_SPI_IN_189 | CSI_RX_IF1_CSI_ERR_IRQ_0 GIC500_SPI_IN_188 | CSI_RX_IF1_CSI_IRQ_0 [0]: http://www.ti.com/lit/pdf/spruil1 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-3-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit 94801d4bf1ed9277462ebe1afaf8323664fd6a85 Author: Yemike Abhilash Chandra Date: Fri Aug 8 15:27:58 2025 +0530 arm64: dts: ti: k3-j721s2-main: Add CSI2 interrupts property Add interrupts property for CDNS CSI2RX. Interrupt IDs are taken from the J721S2 TRM [0]. Interrupt Line | Source Interrupt --------------------|----------------------------- GIC500SS_SPI_IN_185 | CSI_RX_IF0_CSI_ERR_IRQ_OUT_0 GIC500SS_SPI_IN_184 | CSI_RX_IF0_CSI_IRQ_OUT_0 GIC500SS_SPI_IN_189 | CSI_RX_IF1_CSI_ERR_IRQ_OUT_0 GIC500SS_SPI_IN_188 | CSI_RX_IF1_CSI_IRQ_OUT_0 [0]: https://www.ti.com/lit/zip/spruj28 Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Udit Kumar Reviewed-by: Jared McArthur Link: https://lore.kernel.org/r/20250808095804.544298-2-y-abhilashchandra@ti.com Signed-off-by: Nishanth Menon commit f13db4f77d54a6db644f09a168919ad1b3432f52 Author: Wadim Egorov Date: Tue Aug 5 11:00:21 2025 +0200 arm64: dts: ti: k3-am62a-phycore-som: Add 1.4GHz opp entry The phyCORE-AM62Ax is capable of supplying 0v85 to the VDD_CORE which allows the Cortex-A53s to operate at 1.4GHz according to chapter 7.5 of the SoC's data sheet[0]. Append the 1.4Ghz entry to the OPP table to enable this OPP [0] https://www.ti.com/lit/ds/symlink/am62a3.pdf Signed-off-by: Wadim Egorov Link: https://lore.kernel.org/r/20250805090021.1407753-2-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit 6aa4c1a38cf10c9760f81d456b7f92ff157e5f83 Author: Wadim Egorov Date: Mon Aug 4 12:54:50 2025 +0200 arm64: dts: ti: k3-am642-phyboard-electra: Add ti,pa-stats property Add ti,pa-stats phandles. This is a phandle to PA_STATS syscon regmap and will be used to dump IET related statistics for ICSSG Driver. Signed-off-by: Wadim Egorov Link: https://lore.kernel.org/r/20250804105450.2322647-1-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit 11b9e4517bfa8edecbef0acfcad1bdca4f4a4192 Author: Jayesh Choudhary Date: Wed Jul 16 11:31:14 2025 +0530 arm64: dts: ti: k3-am68-sk: Enable DSI on DisplayPort-0 Enable DSI support for AM68-SK platform. Add DT node for DSI2eDP bridge. The DSI to eDP bridge is sn65dsi86 on the board. Add the endpoint nodes to describe connection from: DSS => DSI => SN65DSI86 bridge => DisplayPort-0 Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-8-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 2bca9f69225e8c6e3c270f20c69a1460761f9bd2 Author: Jayesh Choudhary Date: Wed Jul 16 11:31:13 2025 +0530 arm64: dts: ti: k3-j721s2-common-proc-board: Enable DisplayPort-1 Enable DSI display for J721S2 EVM. Add the endpoint nodes to describe connection from: DSS => DSI Bridge => DSI to eDP bridge => DisplayPort-1 Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-7-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 3c29300dcef587df697750e99f6375e2ca8907fb Author: Rahul T R Date: Wed Jul 16 11:31:12 2025 +0530 arm64: dts: ti: k3-j721s2-som-p0: Add DSI to eDP Add DT nodes for DSI to eDP bridge. The DSI to eDP bridge used is SN65DSI86 on SOM. Signed-off-by: Rahul T R Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-6-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 722a128adaf97fc2ecb64610a482f1399b3f4c2a Author: Jayesh Choudhary Date: Wed Jul 16 11:31:11 2025 +0530 arm64: dts: ti: k3-j721s2-common-proc-board: Add main_i2c4 instance Add dt node for main_i2c4 instance along with required pinmuxing. Also add the gpio expander 'exp4' required by display connector. Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-5-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 19a4472e591d9945f4983d052adf7d7fa67efcce Author: Rahul T R Date: Wed Jul 16 11:31:10 2025 +0530 arm64: dts: ti: k3-j721s2-main: Add DSI & DSI PHY Add DT nodes for DPI to DSI Bridge and DSI Phy. The DSI bridge is Cadence DSI and the PHY is a Cadence DPHY with TI wrapper. Signed-off-by: Rahul T R [j-choudhary@ti.com: disable dsi and dphy nodes, rename dphy node] Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-4-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit a5ed774877a38f2feeb45f0c2cd16184b47b476b Author: Jayesh Choudhary Date: Wed Jul 16 11:31:09 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2-evm-common: Enable DisplayPort-1 Enable DSI display for J784S4 EVM. Add DT node for DSI-to-eDP bridge. The DSI to eDP bridge is SN65DSI86 on the board. Add the endpoint nodes to describe connection from: DSS => DSI => SN65DSI86 bridge => DisplayPort-1 Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-3-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 09449e48be7390ebc53812ab898d669e3832c704 Author: Jayesh Choudhary Date: Wed Jul 16 11:31:08 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2-main-common: Add DSI & DSI PHY Add DT nodes for DPI to DSI Bridge and DSI Phy. The DSI bridge is Cadence DSI and the PHY is a Cadence DPHY with TI wrapper. Signed-off-by: Jayesh Choudhary Tested-by: Harikrishna Shenoy Reviewed-by: Harikrishna Shenoy Reviewed-by: Udit Kumar Link: https://lore.kernel.org/r/20250716060114.52122-2-j-choudhary@ti.com Signed-off-by: Nishanth Menon commit 632633d095b6fc09ee38fd786778c02a003a8e67 Author: Imre Deak Date: Fri Aug 8 13:49:31 2025 +0530 drm/i915/wcl: Add display device info Add device info for wildcat lake. WCL has 3 pipes and 2 TC ports. Suggested-by: Gustavo Sousa Signed-off-by: Imre Deak Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250808081931.4101388-2-chaitanya.kumar.borah@intel.com Signed-off-by: Gustavo Sousa commit 9465dd7c400d47439d3446de5b3f1ecfb5ea1bc6 Author: Chaitanya Kumar Borah Date: Fri Aug 8 13:49:30 2025 +0530 drm/i915/display: Add power well mapping for WCL WCL has 3 pipes and two TC ports, create power well mapping to reflect HW. Rest remains similar to Xe3 power well configuration. v2: Remove TC3/4 ports as they do not exist. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250808081931.4101388-1-chaitanya.kumar.borah@intel.com Signed-off-by: Gustavo Sousa commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 Author: Geert Uytterhoeven Date: Wed Aug 13 15:07:18 2025 +0200 regmap: Remove superfluous check for !config in __regmap_init() The first thing __regmap_init() do is check if config is non-NULL, so there is no need to check for this again later. Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 380e6896c2234b677c6f8ab1bfb7621645708cc1 Author: Mehdi Djait Date: Thu Jun 26 15:34:39 2025 +0200 media: i2c: ov2680: Use the v4l2 helper for obtaining the clock Use the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 51d79d123b615ac83aa0f4bad988c2c6a29bf986 Author: Mehdi Djait Date: Thu Jun 26 15:34:38 2025 +0200 media: i2c: vgxy61: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 19248489e86eee761bbb76aa2446fb4da0aa9470 Author: Mehdi Djait Date: Thu Jun 26 15:34:37 2025 +0200 media: i2c: vd56g3: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e55df3c6602722991dfaae4232b560c07b29a38a Author: Mehdi Djait Date: Thu Jun 26 15:34:36 2025 +0200 media: i2c: vd55g1: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7f5af01769c4099b2716d6997da10dedad289a4f Author: Mehdi Djait Date: Thu Jun 26 15:34:35 2025 +0200 media: i2c: s5k6a3: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2db026f2e90b6fdda0d2ab3a340d3855e49f965f Author: Mehdi Djait Date: Thu Jun 26 15:34:34 2025 +0200 media: i2c: s5k5baf: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 54ec6f9c6f60562f8da5a9e3e55506d5cd5162b0 Author: Mehdi Djait Date: Thu Jun 26 15:34:33 2025 +0200 media: i2c: s5c73m3: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1808dd608f856b4cae1dd42c4bdc83fdef215b47 Author: Mehdi Djait Date: Thu Jun 26 15:34:32 2025 +0200 media: i2c: ov9650: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f9f6ebba712ece9e61d99f7d092891e026926bfa Author: Mehdi Djait Date: Thu Jun 26 15:34:31 2025 +0200 media: i2c: ov9640: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 220150677061268d1e33ca27e5cf03823636dcbd Author: Mehdi Djait Date: Thu Jun 26 15:34:30 2025 +0200 media: i2c: ov9282: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c5f46dd95202218f36d9c275d99f44afbd0a9b88 Author: Mehdi Djait Date: Thu Jun 26 15:34:29 2025 +0200 media: i2c: ov8865: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5ee9d47242c27f023248870eddcb721eaddfe9e5 Author: Mehdi Djait Date: Thu Jun 26 15:34:28 2025 +0200 media: i2c: ov8858: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4be64122c8da26a3bb698c5c8a38acfcd7de0b1b Author: Mehdi Djait Date: Thu Jun 26 15:34:27 2025 +0200 media: i2c: ov8856: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f3c4ae273390a2b484e974d41e88c75b69766c88 Author: Mehdi Djait Date: Thu Jun 26 15:34:26 2025 +0200 media: i2c: ov7740: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c6e79ddd0006cc1c42a4eabebb22a6e363c5d4bd Author: Mehdi Djait Date: Thu Jun 26 15:34:25 2025 +0200 media: i2c: ov6650: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 197b2c2484cf088b80242d9379b6bc2a8abc5df2 Author: Mehdi Djait Date: Thu Jun 26 15:34:24 2025 +0200 media: i2c: ov64a40: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e3ed4873e9923c6added068cab4ad4eb616407d9 Author: Mehdi Djait Date: Thu Jun 26 15:34:23 2025 +0200 media: i2c: ov5695: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 85f809c2af15fc715a5747cfd2aa9853882f66e6 Author: Mehdi Djait Date: Thu Jun 26 15:34:22 2025 +0200 media: i2c: ov5648: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f801ccf74011e0f6f35a71a8cc5f1a0cf63ccc24 Author: Mehdi Djait Date: Thu Jun 26 15:34:21 2025 +0200 media: i2c: ov5647: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1e8faa6626b66842c14c7cf13acfb385c800118b Author: Mehdi Djait Date: Thu Jun 26 15:34:20 2025 +0200 media: i2c: ov5645: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 76d5e67d54331b48462d35286a4bc44faaba4c72 Author: Mehdi Djait Date: Thu Jun 26 15:34:19 2025 +0200 media: i2c: ov5640: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e830bc33f6fdea0390fa7c813df9733beabb2d7b Author: Mehdi Djait Date: Thu Jun 26 15:34:18 2025 +0200 media: i2c: ov2685: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 33df67eb771d8e807792ee3b62b230842552cc5f Author: Mehdi Djait Date: Thu Jun 26 15:34:17 2025 +0200 media: i2c: ov2659: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 52b0a078fab8625501f20e3eb4bf6c1c346c59ec Author: Mehdi Djait Date: Thu Jun 26 15:34:16 2025 +0200 media: i2c: ov02a10: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6e4674fc4c19ebee9181159f0ac412f9c84dbc50 Author: Mehdi Djait Date: Thu Jun 26 15:34:15 2025 +0200 media: i2c: mt9v111: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3faab75678bb42ec04ffa08a4e2c133b474a08fc Author: Mehdi Djait Date: Thu Jun 26 15:34:14 2025 +0200 media: i2c: mt9v032: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e49ee5d80be194901b5b0672dbe400df6ae8716b Author: Mehdi Djait Date: Thu Jun 26 15:34:13 2025 +0200 media: i2c: mt9t112: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d1360982c3e437fc900970f9b0f6f576de3d7947 Author: Mehdi Djait Date: Thu Jun 26 15:34:12 2025 +0200 media: i2c: mt9p031: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b9342c89ca608789182a4fdbe7635088a377e67a Author: Mehdi Djait Date: Thu Jun 26 15:34:11 2025 +0200 media: i2c: mt9m114: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2e15ccbb1d68af68923e948d1266770114df2f52 Author: Mehdi Djait Date: Thu Jun 26 15:34:10 2025 +0200 media: i2c: mt9m111: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ad2089b72798a75423ad4b830fa62dfb5c434451 Author: Mehdi Djait Date: Thu Jun 26 15:34:09 2025 +0200 media: i2c: mt9m001: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 180ea10775458a2f46e1f300f3765da03a1d9362 Author: Mehdi Djait Date: Thu Jun 26 15:34:08 2025 +0200 media: i2c: imx415: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Reviewed-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e1d824320d82eb2d65eba9424fc0da067b65506e Author: Mehdi Djait Date: Thu Jun 26 15:34:07 2025 +0200 media: i2c: imx412: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ae40acaed0384a6c50ff6da5b171ae075d819aec Author: Mehdi Djait Date: Thu Jun 26 15:34:06 2025 +0200 media: i2c: imx335: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 69a30d67d0726ddac2a14423e58bbb1390d51347 Author: Mehdi Djait Date: Thu Jun 26 15:34:05 2025 +0200 media: i2c: imx334: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8dacf792b85f0b8d5a26e6677bebe3e81755e941 Author: Mehdi Djait Date: Thu Jun 26 15:34:04 2025 +0200 media: i2c: imx296: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d78dc79d1c8c3b0d5578df9e4cf03844ede8da19 Author: Mehdi Djait Date: Thu Jun 26 15:34:03 2025 +0200 media: i2c: imx290: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c3032c14d3c2f719601bdcdd7fae76df6178786d Author: Mehdi Djait Date: Thu Jun 26 15:34:02 2025 +0200 media: i2c: imx283: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 33cce53627a5e06e7a48a5684dc3849f399ca74a Author: Mehdi Djait Date: Thu Jun 26 15:34:01 2025 +0200 media: i2c: imx219: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c3b36a4cc9cceba7c1fe07edf6ca95985244134b Author: Mehdi Djait Date: Thu Jun 26 15:34:00 2025 +0200 media: i2c: imx214: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9c54f6a9eccd617807e5f761f81ea8abfb3e4684 Author: Mehdi Djait Date: Thu Jun 26 15:33:59 2025 +0200 media: i2c: hi846: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 374e55cf087613663440719b08166b6686b36bcc Author: Mehdi Djait Date: Thu Jun 26 15:33:58 2025 +0200 media: i2c: gc2145: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4475c7764ab589d59c75b01ff9f14116e42379d7 Author: Mehdi Djait Date: Thu Jun 26 15:33:57 2025 +0200 media: i2c: gc08a3: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit da47267d99609fdc759ad45a5937ff9b54535fe7 Author: Mehdi Djait Date: Thu Jun 26 15:33:56 2025 +0200 media: i2c: gc05a2: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2e47c27270e9b6deae90808930d3f71c9b270441 Author: Mehdi Djait Date: Thu Jun 26 15:33:55 2025 +0200 media: i2c: et8ek8: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 46fa6e200d9842f697093eef5a43dcc9d6b2dfc8 Author: Mehdi Djait Date: Thu Jun 26 15:33:54 2025 +0200 media: i2c: ar0521: Use the v4l2 helper for obtaining the clock devm_clk_get() fails on ACPI-based platforms, where firmware does not provide a direct reference to the clock producer. Replace devm_clk_get() with the new v4l2 helper devm_v4l2_sensor_clk_get() that works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Acked-by: Krzysztof Hałasa Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e2b1ebd72c81ca7bcceb0ed2cea2200978b6e975 Author: Mehdi Djait Date: Thu Jun 26 15:33:53 2025 +0200 Documentation: media: camera-sensor: Mention v4l2_devm_sensor_clk_get() for obtaining the clock Add the new v4l2 helper devm_v4l2_sensor_clk_get() to Documentation. the helper works on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Mehdi Djait Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2d240b124cc9df62ccccee6054bc3d1d19018758 Author: Mehdi Djait Date: Mon Jul 14 15:23:56 2025 +0200 media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR Both ACPI and DT-based systems are required to obtain the external camera sensor clock using the new devm_v4l2_sensor_clk_get() helper function. Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is enabled. Signed-off-by: Mehdi Djait Reviewed-by: Arnd Bergmann Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7ecb662b717a34305beacf71e9fadd1559b4b9ee Author: Mehdi Djait Date: Mon Jul 7 16:32:53 2025 +0200 media: v4l2-common: Add a helper for obtaining the clock producer Introduce a helper for v4l2 sensor drivers on both DT- and ACPI-based platforms to retrieve a reference to the clock producer from firmware. This helper behaves the same as devm_clk_get() except where there is no clock producer like in ACPI-based platforms. For ACPI-based platforms the function will read the "clock-frequency" ACPI _DSD property and register a fixed frequency clock with the frequency indicated in the property. This function also handles the special ACPI-based system case where: . The clock-frequency _DSD property is present. . A reference to the clock producer is present, where the clock is provided by a camera sensor PMIC driver (e.g. int3472/tps68470.c) In this case try to set the clock-frequency value to the provided clock. Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Signed-off-by: Mehdi Djait Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit dfb2a4f76ff7f60d6e2a55b6a973dd42930adf50 Author: Eric Biggers Date: Fri Aug 1 16:55:41 2025 -0700 tee: Use SHA-1 library instead of crypto_shash Use the SHA-1 library functions instead of crypto_shash. This is simpler and faster. Change uuid_v5() to return void, since it can no longer fail. Signed-off-by: Eric Biggers Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit dcf101872d03a2394ed5f5aa5b2b036080285e3c Author: Imre Deak Date: Tue Aug 5 10:37:00 2025 +0300 drm/i915/tc: Debug print the pin assignment and max lane count Debug print the TypeC pin assignment and max lane count value during HW readout and after resetting the TypeC mode. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-20-imre.deak@intel.com Signed-off-by: Imre Deak commit 24d1cdacac11ddc3388714c5f82d31a480659ac7 Author: Imre Deak Date: Tue Aug 5 10:36:59 2025 +0300 drm/i915/tc: Cache the pin assignment value Cache the pin assignment value. This is more consistent with the way the max lane count value is tracked and a bit more efficient than reading out the same value from HW each time it's queried. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-19-imre.deak@intel.com Signed-off-by: Imre Deak commit cca7c083a3f622164a3615ed243e6a5ccdd1dd10 Author: Imre Deak Date: Tue Aug 5 10:36:58 2025 +0300 dmc/i915/tc: Report pin assignment NONE in TBT-alt mode The pin assignment is only relevant in case the PHY is owned by the display, that is in legacy and DP-alt mode. In TBT-alt mode the PHY is owned by the TBT FW/driver and so the pin assignment/configuration is managed by those components. A follow-up change will cache the pin assignment value in all the TypeC modes - querying this by calling get_pin_assignment() - prepare for that here, by reporting pin assignment NONE in the TBT-alt mode. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-18-imre.deak@intel.com Signed-off-by: Imre Deak commit 76ed3b0226db373ce033291077c1c20e1eaf5d2d Author: Imre Deak Date: Tue Aug 5 10:36:57 2025 +0300 drm/i915/tc: Pass intel_tc_port to internal lane mask/count helpers Pass the intel_tc_port pointer instead of intel_digital_port to all lane mask and count query helpers internal to intel_tc.c, to avoid the redundant intel_digital_port -> intel_tc_port conversions. While at it shorten the function names, keeping the intel_tc_port_ prefix only for exported functions and use the mtl_, icl_ prefixes making it clear which platforms a given query function is specific for. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-17-imre.deak@intel.com Signed-off-by: Imre Deak commit 70435fce3225631011f36ec9b0dd1f8c9e90e986 Author: Imre Deak Date: Tue Aug 5 10:36:56 2025 +0300 drm/i915/tc: Handle non-TC encoders when getting the pin assignment For consistency, handle the case where intel_tc_port_get_pin_assignment() is called for a non-TypeC encoder, returning the default NONE pin assignment value, similarly to how this is done in intel_tc_port_max_lane_count(). Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-16-imre.deak@intel.com Signed-off-by: Imre Deak commit c96ba5883df7fabc5df34e1486df538d514f4c12 Author: Imre Deak Date: Tue Aug 5 10:36:55 2025 +0300 drm/i915/tc: Unify the way to get the max lane count value on MTL+ Unify the way to get the max lane count value on all MTL+ platforms, reducing the code duplication. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-15-imre.deak@intel.com Signed-off-by: Imre Deak commit faf4f2a0264dd5bf3845e3dcff742d93e42ac47a Author: Imre Deak Date: Tue Aug 5 10:36:54 2025 +0300 drm/i915/tc: Unify the way to get the pin assignment on all platforms Unify the way to get the pin assignment on all platforms. This removes the duplication in the helper functions in this and a follow-up change. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-14-imre.deak@intel.com Signed-off-by: Imre Deak commit 7b6503c500fbab7f47e59d78f4e5f268d4962438 Author: Imre Deak Date: Tue Aug 5 10:36:53 2025 +0300 drm/i915/tc: Validate the pin assignment on all platforms Validate the pin assignment on ICL-TGL, similarly to how this is done on MTL+. ICL supports all the pin assignments, while TGL+ supports only the NONE, C, D, E pin assignments. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-13-imre.deak@intel.com Signed-off-by: Imre Deak commit 08d4fb9548d777fa1a7099beeade8888598f1323 Author: Imre Deak Date: Tue Aug 5 10:36:52 2025 +0300 drm/i915/tc: Handle pin assignment NONE on all platforms For consistency, handle pin assignment NONE on all platforms similarly to LNL+. On earlier platforms the driver doesn't actually see this pin assignment - as it's not valid on a connected DP-alt PHY - however it's a valid HW setting even on those platforms, for instance in legacy mode. Handle this pin assignment on earlier platforms as well, so that the way to query the pin assignment can be unified by a follow-up change. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-12-imre.deak@intel.com Signed-off-by: Imre Deak commit 4ae33f0a5d1cef2830c364fd7dd6260ebfda9abd Author: Imre Deak Date: Tue Aug 5 10:36:51 2025 +0300 drm/i915/tc: Pass pin assignment value around using the pin assignment enum Pass around the pin assignment value via the corresponding enum instead of a plain integer. While at it rename intel_tc_port_get_pin_assignment_mask() to intel_tc_port_get_pin_assignment(), since the value returned is not a mask. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-11-imre.deak@intel.com Signed-off-by: Imre Deak commit 6eaec941df17d3690b0be455f69f2cf64dea70a4 Author: Imre Deak Date: Tue Aug 5 10:36:50 2025 +0300 drm/i915/tc: Add an enum for the TypeC pin assignment Add an enum for the TypeC pin assignment, which is a better way to pass its value around than a plain integer. While at it add a description for each pin assignment, based on the DP and DP Alt mode Standards, opting for more details to ease any future debugging related to a given pin assignment and the cables / sink types used. Reviewed-by: Mika Kahola [Imre: s/deined/defined in pin assignment enum documentation.] Link: https://lore.kernel.org/r/20250805073700.642107-10-imre.deak@intel.com Signed-off-by: Imre Deak commit f1ecaa7a6ef06e2843f7c6638db5dbd12a405866 Author: Imre Deak Date: Tue Aug 5 10:36:49 2025 +0300 drm/i915/tc: Move asserting the power state after reading TCSS_DDI_STATUS Move asserting the expected TC cold power state and the read out register value right after reading the TCSS_DDI_STATUS register, similarly to how this is done with the other PORT_TX_DFLEXDPSP and PORT_TX_DFLEXPA1 PHY registers. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-9-imre.deak@intel.com Signed-off-by: Imre Deak commit 45d424856a074ea58c5a853e11bd0388a56a6951 Author: Imre Deak Date: Tue Aug 5 10:36:48 2025 +0300 drm/i915/tc: Move getting the power domain before reading DFLEX registers Move getting the required display power domain right before reading the PORT_TX_DFLEXDPSP and PORT_TX_DFLEXPA1 registers, similarly to how this is done while reading the other TCSS_DDI_STATUS PHY register. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-8-imre.deak@intel.com Signed-off-by: Imre Deak commit aaf01f66e0ee688f0df7eb941914c78fdecf1edd Author: Imre Deak Date: Tue Aug 5 10:36:47 2025 +0300 drm/i915/tc: Use the cached max lane count value Use the PHY's cached max lane count value on all platforms similarly to LNL+. On LNL+ using the cached value is mandatory - since the corresponding HW register field can get cleared by the time the value is queried - on earlier platforms there isn't a problem with using the HW register instead. Having a uniform way to query the value still makes sense and it's also a bit more efficient, so do that. Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250805073700.642107-7-imre.deak@intel.com Signed-off-by: Imre Deak commit 9c45f95222beecd6a284fd1284d54dd7a772cf59 Author: Gabor Juhos Date: Fri Aug 8 19:15:01 2025 +0200 spi: spi-qpic-snand: handle 'use_ecc' parameter of qcom_spi_config_cw_read() During raw read, neither the status of the ECC correction nor the erased state of the codeword gets checked by the qcom_spi_read_cw_raw() function, so in case of raw access reading the corresponding registers via DMA is superfluous. Extend the qcom_spi_config_cw_read() function to evaluate the existing (but actually unused) 'use_ecc' parameter, and configure reading only the flash status register when ECC is not used. With the change, the code gets in line with the corresponding part of the config_nand_cw_read() function in the qcom_nandc driver. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20250808-qpic-snand-handle-use_ecc-v1-1-67289fbb5e2f@gmail.com Signed-off-by: Mark Brown commit 211dc59b7bb5ea0a6ea29072f04a4498c7ab046b Author: Fushuai Wang Date: Mon Aug 11 14:25:34 2025 +0800 IB/hfi1: Use for_each_online_cpu() instead of for_each_cpu() Replace the opencoded for_each_cpu(cpu, cpu_online_mask) loop with the more readable and equivalent for_each_online_cpu(cpu) macro. Signed-off-by: Fushuai Wang Link: https://patch.msgid.link/20250811062534.1041-1-wangfushuai@baidu.com Signed-off-by: Leon Romanovsky commit 44d69d3cf2e8047c279cbb9708f05e2c43e33234 Author: Konstantin Taranov Date: Tue Jul 29 02:00:18 2025 -0700 RDMA/mana_ib: Drain send wrs of GSI QP Drain send WRs of the GSI QP on device removal. In rare servicing scenarios, the hardware may delete the state of the GSI QP, preventing it from generating CQEs for pending send WRs. Since WRs submitted to the GSI QP hold CM resources, the device cannot be removed until those WRs are completed. This patch marks all pending send WRs as failed, allowing the GSI QP to release the CM resources and enabling safe device removal. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1753779618-23629-1-git-send-email-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky commit 4d674c478dc51fe241376e215861d15f1a3a9dc4 Author: Boshi Yu Date: Fri Jul 25 13:53:54 2025 +0800 RDMA/erdma: Use dma_map_page to map scatter MTT buffer Each high-level indirect MTT entry is assumed to point to exactly one page of the low-level MTT buffer, but dma_map_sg may merge contiguous physical pages when mapping. To avoid extra overhead from splitting merged regions, use dma_map_page to map the scatter MTT buffer page by page. Reviewed-by: Cheng Xu Signed-off-by: Boshi Yu Link: https://patch.msgid.link/20250725055410.67520-2-boshiyu@linux.alibaba.com Signed-off-by: Leon Romanovsky commit a3c9d0fcd3715541bbf97da2ddde9d032e2fe6d5 Author: Mark Zhang Date: Mon Jun 30 13:52:35 2025 +0300 RDMA/ucma: Support write an event into a CM Enable user-space to inject an event into a CM through it's event channel. Two new events are added and supported: RDMA_CM_EVENT_USER and RDMA_CM_EVENT_INTERNAL. With these 2 events a new event parameter "arg" is supported, which is passed from sender to receiver transparently. With this feature an application is able to write an event into a CM channel with a new user-space rdmacm API. For example thread T1 could write an event with the API: rdma_write_cm_event(cm_id, RDMA_CM_EVENT_USER, status, arg); and thread T2 could receive the event with rdma_get_cm_event(). Signed-off-by: Mark Zhang Reviewed-by: Vlad Dumitrescu Link: https://patch.msgid.link/fdf49d0b17a45933c5d8c1d90605c9447d9a3c73.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 810f874eda8e492701ba3623aa298caad61bb47c Author: Mark Zhang Date: Mon Jun 30 13:52:34 2025 +0300 RDMA/ucma: Support query resolved service records Enable user-space to query resolved service records through a ucma command when a RDMA_CM_EVENT_ADDRINFO_RESOLVED event is received. Signed-off-by: Or Har-Toov Signed-off-by: Mark Zhang Reviewed-by: Vlad Dumitrescu Link: https://patch.msgid.link/1090ee7c00c3f8058c4f9e7557de983504a16715.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit a6404823fe20e06d4061bc63e0295b7165af4c14 Author: Mark Zhang Date: Mon Jun 30 13:52:33 2025 +0300 RDMA/cma: Support IB service record resolution Add new UCMA command and the corresponding CMA implementation. Userspace can send this command to request service resolution based on service name or ID. On a successful resolution, one or multiple service records are returned, the first one will be used as destination address by default. Two new CM events are added and returned to caller accordingly: - RDMA_CM_EVENT_ADDRINFO_RESOLVED: Resolve succeeded; - RDMA_CM_EVENT_ADDRINFO_ERROR: Resolve failed. Internally two new CM states are added: - RDMA_CM_ADDRINFO_QUERY: CM is in the process of IB service resolution; - RDMA_CM_ADDRINFO_RESOLVED: CM has finished the resolve process. With these new states, beside existing state transfer processes, 2 new processes are supported: 1. The default address is used: RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDRINFO_QUERY -> RDMA_CM_ADDRINFO_RESOLVED -> RDMA_CM_ROUTE_QUERY 2. To use a different address: RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDRINFO_QUERY-> RDMA_CM_ADDRINFO_RESOLVED -> RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_RESOLVED -> RDMA_CM_ROUTE_QUERY In the 2nd case, resolve_addrinfo returns multiple records, a user could call rdma_resolve_addr() with the one that is not the first. Signed-off-by: Or Har-Toov Signed-off-by: Mark Zhang Reviewed-by: Vlad Dumitrescu Link: https://patch.msgid.link/b6e82ad75522a13b5efe4ff86da0e465aab04cc2.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit a892a3e74fb4f6ef040659297603abf11ccf29a7 Author: Mark Zhang Date: Mon Jun 30 13:52:32 2025 +0300 RDMA/sa_query: Support IB service records resolution Add an SA query API ib_sa_service_rec_get() to support building and sending SA query MADs that ask for service records with a specific name or ID, and receiving and parsing responses from the SM. Signed-off-by: Or Har-Toov Signed-off-by: Mark Zhang Reviewed-by: Vlad Dumitrescu Link: https://patch.msgid.link/9af6c82f3a3a9d975115a33235fb4ffc7c8edb21.1751279793.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit ef5fcdb7300abafd610fd8f815e77dd687eced65 Author: Mark Zhang Date: Mon Jun 30 13:52:31 2025 +0300 RDMA/sa_query: Add RMPP support for SA queries Register GSI mad agent with RMPP support and add rmpp_callback for SA queries. This is needed for querying more than one service record in one query. Signed-off-by: Or Har-Toov Signed-off-by: Mark Zhang Reviewed-by: Vlad Dumitrescu Link: https://patch.msgid.link/81dbcb48682e1838dc40f381cdcc0dc63f25f0f1.1751279793.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 714165e1c4b0d5b8c6d095fe07f65e6e7047aaeb Author: Jeff Chang Date: Wed Aug 13 10:08:51 2025 +0800 regulator: rt5133: Add RT5133 PMIC regulator Support RT5133 is a highly-integrated chip. It includes 8 LDOs and 3 GPOs that can be used to drive output high/low purpose. The dependency of the GPO block is internally LDO1 Voltage. Signed-off-by: Jeff Chang Link: https://patch.msgid.link/20250813020910.2977555-2-jeff_chang@richtek.com Signed-off-by: Mark Brown commit d0de6895095356f1cc2d5f9825df220f10d34cee Author: Jeff Chang Date: Wed Aug 13 10:08:50 2025 +0800 regulator: dt-bindings: Add Richtek RT5133 Support Add bindings for Richtek RT5133 IC Controlled PMIC Signed-off-by: Jeff Chang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250813020910.2977555-1-jeff_chang@richtek.com Signed-off-by: Mark Brown commit f7439a723e5aa5b35c76355e1b9b2cd1108f656e Author: Liao Yuanhong Date: Wed Aug 13 17:48:55 2025 +0800 platform/chrome: wilco_ec: Remove redundant semicolons Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong Link: https://lore.kernel.org/r/20250813094858.557742-1-liaoyuanhong@vivo.com Signed-off-by: Tzung-Bi Shih commit 8abbbbb588f1f1bf95ae56c1531a17520ce487e2 Author: Gustavo A. R. Silva Date: Mon Aug 11 22:27:22 2025 +0900 platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warning: drivers/platform/chrome/cros_ec.c:106:40: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/aJnvuv334M7TljoB@kspp Signed-off-by: Tzung-Bi Shih commit 6b12afac75fc3dbe735c05716cf99a965927a8fa Author: Thomas Zimmermann Date: Tue Aug 12 10:10:32 2025 +0200 drm/panel: panel-summit: Include and Include to declare device_property_read_u32() and to declare struct of_device_id. Avoids the dependency on the backlight header to include it. Signed-off-by: Thomas Zimmermann Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250812081118.221103-1-tzimmermann@suse.de commit 1ebc27248ea0b81f0023ca28894ac40183b86b7c Author: Dibin Moolakadan Subrahmanian Date: Thu Aug 7 13:54:02 2025 +0530 drm/i915/display: Optimize panel power-on wait time The current wait_panel_status() uses intel_de_wait(), which internally on Xe platforms calls xe_mmio_wait32(). xe_mmio_wait32() increases poll interval exponentially. This exponential poll interval increase causes unnessory delays during resume or power-on when the panel becomes ready earlier, but polling is delayed due to backoff. Replace intel_de_wait() with read_poll_timeout() + intel_de_read() to actively poll the register at a fixed 10ms interval up to a 5 second timeout. This allows poll to exit early when panel is ready. Changes in v2: Replaced two-phase intel_de_wait() with read_poll_timeout() + intel_de_read() Changes in v3: - Add poll_interval_ms argument 'wait_panel_status' function. - Modify 'wait_panel_status' callers with proper poll interval Changes in v4: - Change 'wait_panel_off' poll interval to 10ms Changes in v5: - Dropped poll_interval_ms parameter,use fixed polling interval of 10ms (Jani Nikula) Changes in v6: - Removed goto in error path Signed-off-by: Dibin Moolakadan Subrahmanian Link: https://lore.kernel.org/r/20250807082402.79018-1-dibin.moolakadan.subrahmanian@intel.com Signed-off-by: Jani Nikula commit 942e54a372b44da3ffb0191b4d289d476256c861 Author: Tomi Valkeinen Date: Wed Apr 16 14:06:30 2025 +0300 drm/tidss: Remove early fb Add a call to drm_aperture_remove_framebuffers() to drop the possible early fb (simplefb). Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250416-tidss-splash-v1-2-4ff396eb5008@ideasonboard.com Signed-off-by: Tomi Valkeinen commit aaa76d1cbd73a7e8ddb9d92423b017eb98d2b335 Author: Mika Westerberg Date: Mon Aug 11 10:02:34 2025 +0300 thunderbolt: Use Linux Foundation IDs for XDomain discovery There are other vendors now that have their own USB4 host router hardware so using the Intel donated IDs may confuse users. For this reason switch to use USB IDs provided by the Linux Foundation for XDomain discovery. Link: https://lore.kernel.org/linux-usb/20250722175026.1994846-1-Raju.Rangoju@amd.com/ Cc: Raju Rangoju Acked-by: Greg Kroah-Hartman Reviewed-by: Mario Limonciello (AMD) > Signed-off-by: Mika Westerberg commit 852bb7c08c134162b7063d1fdf9b1cc1ba839d0c Author: Colin Ian King Date: Wed Jul 2 09:48:44 2025 +0100 drm/tidss: remove redundant assignment to variable ret The assignment of zero to variable is redundant as the following continue statement loops back to the start of the loop where ret is assigned a new value from the return to the call to get_parent_dss_vp. Remove assignment. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250702084844.966199-1-colin.i.king@gmail.com Signed-off-by: Tomi Valkeinen commit cfb29225db20c56432a8525366321c0c09edfb2e Author: Jayesh Choudhary Date: Tue Jun 24 13:34:02 2025 +0530 drm/tidss: Set crtc modesetting parameters with adjusted mode TIDSS uses crtc_* fields to propagate its registers and set the clock rates. So set the CRTC modesetting timing parameters with the adjusted mode when needed, to set correct values. Cc: Tomi Valkeinen Signed-off-by: Jayesh Choudhary Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com Signed-off-by: Tomi Valkeinen commit e28c1117deda5a80df14b579170c1a90fc82bf5f Author: Igor Belwon Date: Thu Jul 10 18:50:09 2025 +0200 arm64: dts: exynos990-r8s: Enable USB Enable both the USB PHY as well as the DWC3 controller nodes. Since we do not have any PMIC for USB implemented yet, use dummy regulators until we do. Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250710-resends-july-exynos990-dt-v2-5-55033f73d1b0@mentallysanemainliners.org Signed-off-by: Krzysztof Kozlowski commit 32532687a9ce2f1c5556e082f957200a81ba0ad7 Author: Igor Belwon Date: Thu Jul 10 18:50:08 2025 +0200 arm64: dts: exynos990-c1s: Enable USB Enable both the USB PHY as well as the DWC3 controller nodes. Since we do not have any PMIC for USB implemented yet, use dummy regulators until we do. Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250710-resends-july-exynos990-dt-v2-4-55033f73d1b0@mentallysanemainliners.org Signed-off-by: Krzysztof Kozlowski commit 707181264badf4f82c78c18348684cd06db31ce0 Author: Igor Belwon Date: Thu Jul 10 18:50:07 2025 +0200 arm64: dts: exynos990-x1s-common: Enable USB The x1s family uses a shared USB configuration. Enable both the USB PHY as well as the DWC3 controller. Since we do not have any PMIC for USB implemented yet, use dummy regulators until we do. Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250710-resends-july-exynos990-dt-v2-3-55033f73d1b0@mentallysanemainliners.org Signed-off-by: Krzysztof Kozlowski commit d3830b5b0db59d0b8e33083462e4c0dd021ed300 Author: Igor Belwon Date: Thu Jul 10 18:50:06 2025 +0200 arm64: dts: exynos990: Add USB nodes Add USB controller and USB PHY controller nodes for use in the Exynos990 SoC. This SoC supports USB full-speed, high-speed and super-speed modes. Due to the inability to test PIPE3, USB super-speed is not enabled, and the USB PHY is only configured for UTMI+ operation for now. Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250710-resends-july-exynos990-dt-v2-2-55033f73d1b0@mentallysanemainliners.org Signed-off-by: Krzysztof Kozlowski commit ad211501fff48d0cda35dd187aa7e356a4fb5581 Author: Igor Belwon Date: Thu Jul 10 18:50:05 2025 +0200 arm64: dts: exynos990: Enable watchdog timer Enable the two watchdog timer clusters (cl0, cl2) present on the Exynos990 SoC. Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250710-resends-july-exynos990-dt-v2-1-55033f73d1b0@mentallysanemainliners.org Signed-off-by: Krzysztof Kozlowski commit 1aba1eab0bd896928ae20dbf1f60a175a6e1ad0f Author: Florian Fainelli Date: Tue Jul 29 13:52:12 2025 -0700 dt-bindings: memory: Update brcmstb-memc-ddr binding with older chips The older MIPS-based chips incorporated a memory controller with the revision A.0.0, update the binding to list that compatible. Signed-off-by: Florian Fainelli Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250729205213.3392481-2-florian.fainelli@broadcom.com Signed-off-by: Krzysztof Kozlowski commit 3b745d0b3dc18cd1e6344c97d61b3b1872c57219 Author: Sam Protsenko Date: Thu Jul 31 18:45:32 2025 -0500 arm64: dts: exynos: Add Ethernet node for E850-96 board The E850-96 board has a hard-wired LAN9514 chip which acts as a USB hub and Ethernet bridge. It's being discovered dynamically when the USB bus gets enumerated, but the corresponding Ethernet device tree node is still needed for the bootloader to pass the MAC address through. Add LAN9514 nodes as described in [1]. 'local-mac-address' property (in the 'ethernet' node) is used for MAC address handover from the bootloader to Linux. [1] Documentation/devicetree/bindings/net/microchip,lan95xx.yaml Signed-off-by: Sam Protsenko Link: https://lore.kernel.org/r/20250731234532.12903-1-semen.protsenko@linaro.org Signed-off-by: Krzysztof Kozlowski commit 6744085079e785dae5f7a2239456135407c58b25 Author: Zhen Ni Date: Wed Aug 6 10:55:38 2025 +0800 memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak. Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base. This issue was detected by smatch static analysis: drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn: 'srom->reg_base' from of_iomap() not released on lines: 155. Fixes: 8ac2266d8831 ("memory: samsung: exynos-srom: Add support for bank configuration") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://lore.kernel.org/r/20250806025538.306593-1-zhen.ni@easystack.cn Signed-off-by: Krzysztof Kozlowski commit 148547000cfc1ba8cec02857268333d08724b9cc Author: Dan Carpenter Date: Wed Aug 13 08:38:27 2025 +0300 gpio: aggregator: Fix off by one in gpiochip_fwd_desc_add() The "> chip->ngpio" comparison here needs to be ">= chip->ngpio", otherwise it leads to an out of bounds access. The fwd->valid_mask bitmap only has chip->ngpio bits and the fwd->descs[] array has that same number of elements. These values are set in devm_gpiochip_fwd_alloc(). Fixes: c44ce91b8ada ("gpio: aggregator: refactor the code to add GPIO desc in the forwarder") Signed-off-by: Dan Carpenter Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/aJwk0yBSCccGCjX3@stanley.mountain Signed-off-by: Bartosz Golaszewski commit 7070f55f294745c5a3c033623b76309f3512be67 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:21 2025 +0300 drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST While the cdns-dsi does not support DSI burst mode, the burst mode is essentially DSI event mode with more versatile clocking and timings. Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests MIPI_DSI_MODE_VIDEO_BURST. In my particular use case, this allows the use of ti-sn65dsi83 driver. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 2f73f8983280782077dfa9247e978003efeb5af5 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:20 2025 +0300 drm/bridge: cdns-dsi: Tune adjusted_mode->clock according to dsi needs The driver currently expects the pixel clock and the HS clock to be compatible, but the DPHY PLL doesn't give very finely grained rates. This often leads to the situation where the pipeline just fails, as the resulting HS clock is just too off. We could change the driver to do a better job on adjusting the DSI blanking values, hopefully getting a working pipeline even if the pclk and HS clocks are not exactly compatible. But that is a bigger work. What we can do easily is to see in .atomic_check() what HS clock rate we can get, based on the pixel clock rate, and then convert the HS clock rate back to pixel clock rate and ask that rate from the crtc. If the crtc has a good PLL (which is the case for TI K3 SoCs), this will fix any issues wrt. the clock rates. If the crtc cannot provide the requested clock, well, we're no worse off with this patch than what we have at the moment. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-14-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit ca3e6fc131836c4956de454996df52feb6c19af8 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:19 2025 +0300 drm/bridge: cdns-dsi: Fix event mode The timings calculation gets it wrong for DSI event mode, resulting in too large hbp value. Fix the issue by taking into account the pulse/event mode difference. Tested-by: Parth Pancholi Reviewed-by: Jayesh Choudhary Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-13-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit ce4bc5ca7c1de554c3d8c95aa2dddce6cbcef14e Author: Tomi Valkeinen Date: Wed Jul 23 13:05:18 2025 +0300 drm/bridge: cdns-dsi: Use video mode and clean up cdns_dsi_mode2cfg() The driver does all the calculations and programming with video timings (hftp, hbp, etc.) instead of the modeline values (hsync_start, ...). Thus it makes sense to use struct videomode instead of struct drm_display_mode internally. Switch to videomode and do some cleanups in cdns_dsi_mode2cfg() along the way. Tested-by: Parth Pancholi Reviewed-by: Aradhya Bhatia Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-12-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit eea4f89b6461294ed6bea1d3285bb3f79c09a041 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:17 2025 +0300 drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value The driver tries to calculate the value for REG_WAKEUP_TIME. However, the calculation itself is not correct, and to add on it, the resulting value is almost always larger than the field's size, so the actual result is more or less random. According to the docs, figuring out the value for REG_WAKEUP_TIME requires HW characterization and there's no way to have a generic algorithm to come up with the value. That doesn't help at all... However, we know that the value must be smaller than the line time, and, at least in my understanding, the proper value for it is quite small. Testing shows that setting it to 1/10 of the line time seems to work well. All video modes from my HDMI monitor work with this algorithm. Hopefully we'll get more information on how to calculate the value, and we can then update this. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-11-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit e948bcaf7dd5719d17a0d3843250ed00a6b27ba5 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:16 2025 +0300 drm/bridge: cdns-dsi: Adjust mode to negative syncs The Cadence DSI requires negative syncs from the incoming video signal, but at the moment that requirement is not expressed in any way. If the crtc decides to use positive syncs, things break down. Use the adjusted_mode in atomic_check to set the sync flags to negative ones. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-10-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit c92765d52da9d2d1a4f867433b0ee5faf82815e4 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:15 2025 +0300 drm/bridge: cdns-dsi: Drop cdns_dsi_adjust_phy_config() cdns_dsi_adjust_phy_config() is called from cdns_dsi_check_conf(), which is called from .atomic_check(). It checks the DSI htotal and adjusts it to align on the DSI lane boundary by changing hfp and then recalculating htotal and HS clock rate. This has a few problems. First is the fact that the whole thing is not needed: we do not need to align on the lane boundary. The whole frame is sent in HS mode, and it is fine if the line's last byte clock tick fills, say, only 2 of the 4 lanes. The next line will just continue from there. Assuming the DSI timing values have been calculated to match the incoming DPI stream, and the HS clock is compatible with the DPI pixel clock, the "uneven" DSI lines will even out when multiple lines are being sent. But we could do the align, aligning is not a problem as such. However, adding more bytes to the hfp, as the function currently does, makes the DSI line time longer, so the function then adjusts the HS clock rate. This is where things fail: we don't know what rates we can get from the HS clock, and at least in TI K3 SoC case the rates are quite coarsely grained. Thus small adjustment to hfp will lead to a big change in HS clock rate, and things break down. We could do a loop here, adjusting hfp, adjusting clock, checking clock rate, adjusting hfp again, etc., but considering that the whole adjustment shouldn't be needed at all, it's easier to just remove the function. Something like this function should be added back later, when adding burst mode support, but that's a bigger change and I don't think this function would help that work in any way. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-9-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 3d97dc02a0869d2c8cff8ebb480c44ceff188157 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:14 2025 +0300 drm/bridge: cdns-dsi: Update htotal in cdns_dsi_mode2cfg() cdns_dsi_mode2cfg() calculates the dsi timings, but for some reason doesn't set the htotal based on those timings. It is set only later, in cdns_dsi_adjust_phy_config(). As cdns_dsi_mode2cfg() is the logical place to calculate it, let's move it there. Especially as the following patch will remove cdns_dsi_adjust_phy_config(). Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-8-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit bcd6808aff4029a7df690cf4c9911e5cc826098d Author: Tomi Valkeinen Date: Wed Jul 23 13:05:13 2025 +0300 drm/bridge: cdns-dsi: Drop checks that shouldn't be in .mode_valid() The docs say about mode_valid(): "it is not allowed to look at anything else but the passed-in mode, and validate it against configuration-invariant hardware constraints" We're doing a lot more than just looking at the mode. The main issue here is that we're doing checks based on the pixel clock, before we know what the pixel clock from the crtc actually is. So, drop the cdns_dsi_check_conf() call from .mode_valid(). Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-7-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 644696a4c48b27d99ff68fa6fee4efcf3910eef5 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:12 2025 +0300 drm/bridge: cdns-dsi: Remove broken fifo emptying check The driver checks if "DPI(HFP) > DSI(HSS+HSA+HSE+HBP)", and rejects the mode if not. However, testing shows that this doesn't hold at all. I can set the hfp to very small values, with no errors. The feedback from the HW team also was that the check is not right, although it's not clear if there's a way to validate the FIFO emptying. The check rejects quite a lot of modes, apparently for no good reason, so drop the check. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-6-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 2325e509ae3c688ad6fb2b84ec4cef2861e89542 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:11 2025 +0300 drm/bridge: cdns-dsi: Drop crtc_* code With recent change the cdns_dsi_check_conf() is always called with mode_valid_check = true. We can thus remove all the code related to the "false" paths. Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-5-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 661598d90ca430832e42d81d1a031dc255e85068 Author: Tomi Valkeinen Date: Wed Jul 23 13:05:10 2025 +0300 drm/bridge: cdns-dsi: Remove extra line at the end of the file Remove extra line at the end of the file. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-4-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 478306edc23eec4f0ec24a46222485910c66212d Author: Tomi Valkeinen Date: Wed Jul 23 13:05:09 2025 +0300 drm/tidss: Use the crtc_* timings when programming the HW Use the crtc_* fields from drm_display_mode, instead of the "logical" fields. This shouldn't change anything in practice, but afaiu the crtc_* fields are the correct ones to use here. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit f7e831db2d021a6e27ab6a89d4ca42613db2dc8b Author: Tomi Valkeinen Date: Wed Jul 23 13:05:08 2025 +0300 drm/tidss: Fix missing includes and struct decls Fix missing includes and struct declarations. Even if these don't cause any compile issues at the moment, it's good to have them correct. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-2-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 Author: Aradhya Bhatia Date: Wed Jul 23 13:05:07 2025 +0300 drm/bridge: cdns-dsi: Fix the _atomic_check() Use the "adjusted_mode" for the dsi configuration check, as that is the more appropriate display_mode for validation, and later bridge enable. Also, fix the mode_valid_check parameter from false to true, as the dsi configuration check is taking place during the check-phase, and the crtc_* mode values are not expected to be populated yet. Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()") Signed-off-by: Aradhya Bhatia Reviewed-by: Tomi Valkeinen Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 4fc8728aa34f54835b72e4db0f3db76a72948b65 Author: Al Viro Date: Tue May 21 22:19:55 2024 -0400 block: switch ->getgeo() to struct gendisk Instances are happier that way and it makes more sense anyway - the only part of the result that is related to partition we are given is the start sector, and that has been filled in by the caller. Everything else is a function of the disk. Only one instance (DASD) is ever looking at anything other than bdev->bd_disk and that one is trivial to adjust. Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Acked-by: Jens Axboe Signed-off-by: Al Viro commit 3eb50369c09efb0f668a7f568a7e6f7cf4194cde Author: Al Viro Date: Tue May 21 23:22:01 2024 -0400 scsi: switch ->bios_param() to passing gendisk Instances are passed struct block_device *bdev argument; the only thing it is used for (if it's used in the first place) is bdev->bd_disk. Might as well pass that in the first place... Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Acked-by: Jens Axboe Signed-off-by: Al Viro commit 1fd143c24fb621f063f913cb1e48cc688c7eca15 Author: Al Viro Date: Tue May 21 23:08:31 2024 -0400 scsi: switch scsi_bios_ptable() and scsi_partsize() to gendisk Both helpers are reading the partition table of the disk specified by block_device of some partition on it; result depends only upon the disk in question, so we might as well pass the struct gendisk instead. Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Acked-by: Jens Axboe Signed-off-by: Al Viro commit ce872bce1140eec07ed624e537687244a5c01397 Author: Luca Weiss Date: Wed Jul 9 16:55:17 2025 +0200 phy: qualcomm: phy-qcom-eusb2-repeater: Add support for PMIV0104 Add support for the eUSB2 repeater found on the PMIV0104. There is no default init table for this PMIC, just the board-specific tuning parameters are used on top of the default tuning values. Reviewed-by: Abel Vesa Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-4-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul commit 5edc4054655009691deb79142af1ffe5aba0a224 Author: Luca Weiss Date: Wed Jul 9 16:55:16 2025 +0200 dt-bindings: phy: qcom,snps-eusb2-repeater: Add compatible for PMIV0104 Add a dt-bindings compatible string for the Qualcomm's PMIV0104 PMIC. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-3-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul commit 08bde1e7c71396fcf96b0410b1c4cb6bee5b8741 Author: Luca Weiss Date: Wed Jul 9 16:55:15 2025 +0200 phy: qualcomm: phy-qcom-eusb2-repeater: Support tune-res-fsdif prop Support reading the FS Differential TX Output Resistance Tuning from devicetree and writing the register, as required on some boards. Reviewed-by: Abel Vesa Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-2-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul commit 791cfbe1c56076c9d3bcf856b5175bfbc9c5a2d4 Author: Luca Weiss Date: Wed Jul 9 16:55:14 2025 +0200 dt-bindings: phy: qcom,snps-eusb2-repeater: Document qcom,tune-res-fsdif Document the FS Differential TX Output Resistance Tuning value found on the eUSB2 repeater on Qualcomm PMICs. The tuning values have special meanings, being different offsets of the resistance to the default value in Ohms but the exact meaning is not relevant here, as the correct tuning is determined by hardware engineers to make sure the electrical properties are as expected. Signed-off-by: Luca Weiss Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-1-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul commit 8eb3a6f7a1881d2cfd4f7d741e263ce6999bcbc9 Author: Johan Hovold Date: Thu Jul 24 17:48:23 2025 +0200 phy: ti: omap-control: drop unused module alias Since commit 4fd06af96b93 ("usb: phy: omap-control: Get rid of platform data") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-12-johan@kernel.org Signed-off-by: Vinod Koul commit a27576076b6befd634154715220298a97ad4b24a Author: Johan Hovold Date: Thu Jul 24 17:48:22 2025 +0200 phy: ti: dm816x-usb: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-11-johan@kernel.org Signed-off-by: Vinod Koul commit dbe76a96ad784fbb1872a92999479bf9d02b900e Author: Johan Hovold Date: Thu Jul 24 17:48:21 2025 +0200 phy: ti: ti-pipe3: drop unused module alias Since commit 918ee0d21ba4 ("usb: phy: omap-usb3: Don't use omap_get_control_dev()") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-10-johan@kernel.org Signed-off-by: Vinod Koul commit 9cbc01aad21fcdff6a2139c2d8656a8ec61a79e4 Author: Johan Hovold Date: Thu Jul 24 17:48:20 2025 +0200 phy: ti: omap-usb2: drop unused module alias Since commit 478b6c7436c2 ("usb: phy: omap-usb2: Don't use omap_get_control_dev()") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-9-johan@kernel.org Signed-off-by: Vinod Koul commit 824cdd26af27479458ae3472c64b4ebd31c1d82d Author: Johan Hovold Date: Thu Jul 24 17:48:19 2025 +0200 phy: samsung: usb2: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-8-johan@kernel.org Signed-off-by: Vinod Koul commit c6986f867a330ff58ded64bda47484f20b7e2ef2 Author: Johan Hovold Date: Thu Jul 24 17:48:18 2025 +0200 phy: samsung: exynos5-usbdrd: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-7-johan@kernel.org Signed-off-by: Vinod Koul commit bd86f188b4e698b04416160495a8387785a0f021 Author: Johan Hovold Date: Thu Jul 24 17:48:17 2025 +0200 phy: qualcomm: ipq806x-usb: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-6-johan@kernel.org Signed-off-by: Vinod Koul commit 48d420835fab3df9ae4afbce65d96ab9f485ff04 Author: Johan Hovold Date: Thu Jul 24 17:48:16 2025 +0200 phy: hisilicon: hi6220-usb: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-5-johan@kernel.org Signed-off-by: Vinod Koul commit 3531c467843812ca87c5349cd4c5b35cdfbd63df Author: Johan Hovold Date: Thu Jul 24 17:48:15 2025 +0200 phy: cadence: Sierra: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-4-johan@kernel.org Signed-off-by: Vinod Koul commit b05d249ecef55bdf9a6da4cd4ec4ba469df5c0ba Author: Johan Hovold Date: Thu Jul 24 17:48:14 2025 +0200 phy: broadcom: brcm-usb: drop unused module alias Since commit 9d5f51dcdb64 ("phy: usb: Add support for new Synopsys USB controller on the 7211b0") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-3-johan@kernel.org Signed-off-by: Vinod Koul commit 09d1b78cdec9a615d16610b3ba235988eaafec28 Author: Johan Hovold Date: Thu Jul 24 17:48:13 2025 +0200 phy: broadcom: brcm-sata: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724154823.15998-2-johan@kernel.org Signed-off-by: Vinod Koul commit bbcca4fac873c66388c687eeecd9ca6b12b601b7 Author: Yao Zi Date: Mon Jul 28 10:29:47 2025 +0000 phy: rockchip: naneng-combphy: Add RK3528 support Rockchip RK3528 integrates one naneng-combphy that is able to operate in PCIe and USB3 mode. The control logic is similar to previous variants of naneng-combphy but the register layout is apparently different from the RK3568 one. Signed-off-by: Yao Zi Reviewed-by: Heiko Stuebner Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250728102947.38984-7-ziyao@disroot.org Signed-off-by: Vinod Koul commit b3bbc6afcff50e2fd4d51dd64929e62d66fdc814 Author: Yao Zi Date: Mon Jul 28 10:29:46 2025 +0000 phy: rockchip: naneng-combphy: Add SoC prefix to register definitions All supported variants of naneng-combphy follow a register layout similar to the RK3568 variant with some exceptions of SoC-specific registers. Add RK3568 prefix for the common set of registers and the corresponding SoC prefix for SoC-specific registers, making usage of definitions clear and preparing for future COMBPHY variants with a different register layout. Signed-off-by: Yao Zi Reviewed-by: Heiko Stuebner Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250728102947.38984-6-ziyao@disroot.org Signed-off-by: Vinod Koul commit b6c02cba32b9902b2b51dee740f1d3af8271820a Author: Yao Zi Date: Mon Jul 28 10:29:45 2025 +0000 dt-bindings: phy: rockchip: naneng-combphy: Add RK3528 variant Rockchip RK3528 ships one naneng-combphy which operates in either PCIe or USB 3 mode. Document its compatible string. Signed-off-by: Yao Zi Acked-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250728102947.38984-5-ziyao@disroot.org Signed-off-by: Vinod Koul commit 43a9fade69799bd10e315e87cdc60a3f75b85414 Author: Yao Zi Date: Mon Jul 28 10:29:44 2025 +0000 dt-bindings: phy: rockchip: naneng-combphy: Add power-domains property Though isn't described in existing devicetrees, most Rockchip combphys belong to a specific power-domain of the SoC. Taking RK3588 as example, combphy 0 and combphy 2 belong to the PD_BUS domain. Document the power-domains property to allow describing the information correctly in devicetree. Signed-off-by: Yao Zi Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250728102947.38984-4-ziyao@disroot.org Signed-off-by: Vinod Koul commit 4ca28157bd52dfa6df665f8854d754cc03f45acf Author: Yao Zi Date: Mon Jul 28 10:29:43 2025 +0000 dt-bindings: soc: rockchip: Add RK3528 pipe-phy GRF syscon Add compatible string for pipe-phy GRF found on RK3528 SoC, which controls misc settings for the integrated naneng-combphy. Signed-off-by: Yao Zi Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250728102947.38984-3-ziyao@disroot.org Signed-off-by: Vinod Koul commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 Author: Jonas Karlman Date: Wed Jul 23 07:23:22 2025 +0000 phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 The boot firmware may disable the U3 port early during boot and leave it up to the controller or PHY driver to re-enable U3 when needed. The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, something the Rockchip Naneng Combo PHY driver never does for RK3568. This may result in USB 3.0 ports being limited to only using USB 2.0 or in special cases not working at all on RK3568. Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled when a PHY with PHY_TYPE_USB3 mode is used. Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se Signed-off-by: Vinod Koul commit 8209b3f79703b8ff09f84a79c46ead0df7260d9f Author: Johan Hovold Date: Thu Jul 24 15:16:23 2025 +0200 phy: ti: omap-usb2: enable compile testing Nothing seems to prevent the driver from being built on non-TI platforms so enable compile testing for wider build coverage. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724131623.2662-1-johan@kernel.org Signed-off-by: Vinod Koul commit 497e78c7a3a069f4fc62ef501d067fea27db6af4 Author: Jai Luthra Date: Mon Feb 24 18:10:05 2025 +0530 phy: cadence: cdns-dphy-rx: Add runtime PM support Enable runtime power management for the device. The PHY framework handles calling pm_runtime_(get|put)_sync when powering on/off this device. Signed-off-by: Jai Luthra Link: https://lore.kernel.org/r/20250224-cdns_phy_pm-v1-1-0fe2c544cc87@ideasonboard.com Signed-off-by: Vinod Koul commit 2674eb7114ff37a7da55767860d49642eba39329 Author: Tomi Valkeinen Date: Wed Jul 23 13:01:29 2025 +0300 phy: cdns-dphy: Remove leftover code The code in cdns-dphy has probably been part of a DSI driver in the past. Remove DSI defines and variables which are not used or do not actually do anything. Also rename cdns_dsi_get_dphy_pll_cfg() to cdns_dphy_get_pll_cfg(), i.e. drop the "dsi", as it's not relevant here. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Acked-by: Vinod Koul Tested-by: Jayesh Choudhary Reviewed-by: Devarsh Thakkar Signed-off-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250723-cdns-dphy-hs-clk-rate-fix-v1-2-d4539d44cbe7@ideasonboard.com Signed-off-by: Vinod Koul commit 689a54acb56858c85de8c7285db82b8ae6dbf683 Author: Tomi Valkeinen Date: Wed Jul 23 13:01:28 2025 +0300 phy: cdns-dphy: Store hs_clk_rate and return it The DPHY driver does not return the actual hs_clk_rate, so the DSI driver has no idea what clock was actually achieved. Set the realized hs_clk_rate to the opts struct, so that the DSI driver gets it back. Reviewed-by: Aradhya Bhatia Tested-by: Parth Pancholi Tested-by: Jayesh Choudhary Acked-by: Vinod Koul Reviewed-by: Devarsh Thakkar Signed-off-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250723-cdns-dphy-hs-clk-rate-fix-v1-1-d4539d44cbe7@ideasonboard.com Signed-off-by: Vinod Koul commit 078f1a7eb48eef9b3cb78bcd2254356f3a332358 Author: Laurent Pinchart Date: Sun Aug 10 04:30:58 2025 +0300 media: staging: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. The standard practice is to name it 'void *priv' in drivers. Many drivers still name it 'void *fh', and a few use more exotic names. Replace those more exotic names with 'void *priv' in all media staging drivers. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5396f5ae0e7b210ee5098c257ccb1c3fdd4bd04f Author: Laurent Pinchart Date: Sun Aug 10 04:30:57 2025 +0300 media: v4l2: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. The standard practice is to name it 'void *priv' in drivers. Many drivers still name it 'void *fh', and a few use more exotic names. Replace those more exotic names with 'void *priv' in all media drivers. Signed-off-by: Laurent Pinchart Acked-by: Jai Luthra Signed-off-by: Hans Verkuil commit 9d05191c4ed31bb817c03a1b7028ed81fefa8bfb Author: Laurent Pinchart Date: Sun Aug 10 04:30:56 2025 +0300 media: v4l2-core: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. Rename it from 'void *fh' to 'void *priv' in the V4L2 core, to avoid misconceptions. While at it, align function arguments in include/media/v4l2-mem2mem.h. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ad46aef5550a7600617aa156d788a01ad5c78b4d Author: Laurent Pinchart Date: Sun Aug 10 04:30:55 2025 +0300 media: v4l2-pci-skeleton: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. Rename it to 'void *priv', to avoid misconceptions. This is particularly important in the v4l2-pci-skeleton driver, as it is meant to be a base for new drivers. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 0960b6937bd99d775b3a7220135ecc546bfb9623 Author: Laurent Pinchart Date: Sun Aug 10 04:30:54 2025 +0300 media: uvcvideo: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. Rename it from 'void *fh' to 'void *priv', to avoid misconceptions. This is particularly important in the uvcvideo driver, as it is widely used and can be taken as an example for new drivers. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit bb74fac758d46edddad56c66ae593a41b1553a2b Author: Laurent Pinchart Date: Sun Aug 10 04:30:53 2025 +0300 media: test-drivers: Rename second ioctl handlers argument to 'void *priv' The second argument to the ioctl handlers is not a file handle any more. Rename it from 'void *fh' to 'void *priv', to avoid misconceptions. This is particularly important in test drivers as they are meant to be used as reference implementations. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 35c0ae6d7a2f9b61644c38836929a27a86bcaa1d Author: Laurent Pinchart Date: Sun Aug 10 04:30:52 2025 +0300 media: v4l2-ioctl: Push NULL fh argument down to ioctl wrappers As ioctl handlers do not expect a priv argument anymore, start pushing the NULL pointer down from __video_do_ioctl() to the ioctl wrappers. This paves the way to dropping the void *priv argument to ioctl handlers themselves. Changes to ioctl wrappers have been generated with the following coccinelle semantic patch: @ioctl@ identifier v4l2_ioctls; identifier ioctl; identifier fn; identifier debug; expression flags; @@ struct v4l2_ioctl_info v4l2_ioctls[] = { ..., IOCTL_INFO(ioctl, fn, debug, flags), ..., }; @depends on ioctl@ identifier ioctl.fn; identifier ops; identifier file; identifier fh; identifier arg; identifier handler; expression list args; @@ -int fn(const struct v4l2_ioctl_ops *ops, struct file *file, void *fh, void *arg) +int fn(const struct v4l2_ioctl_ops *ops, struct file *file, void *arg) { <... - ops->handler(file, fh, args) + ops->handler(file, NULL, args) ...> } Manual changes have been added to handle the calls to v4l_[gs]_selection(), drop the fh argument in the v4l2_ioctl_info structure definition and in the DEFINE_V4L_STUB_FUNC() macro, and stop passing NULL to the wrappers in __video_do_ioctl() Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 0f1a7facb64abe5104c3eb235824ea8d6296474d Author: Laurent Pinchart Date: Sun Aug 10 04:30:51 2025 +0300 media: v4l2-ioctl: Stop passing fh pointer to ioctl handlers Now that all drivers access the v4l2_fh from the file structure, there is no need to pass it as an explicit argument to ioctl handlers. Set the argument to NULL in the __video_do_ioctl() function, and rename the 'fh' argument in the ioctl handler declarations to 'priv' indicate it does not contain a file handle. The argument could be removed altogether with a mechanical change (probably using coccinelle), but there are plans to pass a new argument to the ioctl handlers in the near future. The tree-wide change to remove the argument, only to add another one soon after, would be too much churn. While at it, fix argument alignment in vidioc_try_fmt_vid_out_overlay(). Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d2683099c456c82894d214175862a14bc13bbd09 Author: Jacopo Mondi Date: Sun Aug 10 04:30:50 2025 +0300 media: staging: imx: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ee7aa3dff32e1745bd501b0d442f347aa111d04f Author: Jacopo Mondi Date: Sun Aug 10 04:30:49 2025 +0300 media: usb: uvc: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 536a8cdb4a5217dc3ce7d81ba67bc96e07cdba05 Author: Jacopo Mondi Date: Sun Aug 10 04:30:48 2025 +0300 media: usb: hdpvr: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 9ba9d11544f994095d60e68339a1bf203ec4a474 Author: Jacopo Mondi Date: Sun Aug 10 04:30:47 2025 +0300 media: ivtv: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. While at it remove the only left user of fh2id() and remove the macro completely. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7b9eb53e8591b67f816fc4ccc57321a9e0c97004 Author: Jacopo Mondi Date: Sun Aug 10 04:30:46 2025 +0300 media: cx18: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 61699f3a2e6f3064a5816374145e3b0cbba4c552 Author: Jacopo Mondi Date: Sun Aug 10 04:30:45 2025 +0300 media: omap3isp: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. While at it remove the only left user of to_isp_video_fh() and remove the macro completely. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7f7c478871170785a5789959402a3e3435273899 Author: Laurent Pinchart Date: Sun Aug 10 04:30:44 2025 +0300 media: hantro: Access v4l2_fh from file->private_data To prepare for the introduction of video_device_state as second argument of the v4l2_ioctl_ops handler, access the v4l2_fh from file->private_data instead of using void *priv. The file->private_data is initialized to point to the v4l2_fh by the usage of v4l2_fh_init() in the v4l2_file_operations.open() handler. Signed-off-by: Laurent Pinchart Reviewed-by: Paul Kocialkowski Acked-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit ecdcfa456e6f6048666c7dd56a0c9b95e50312a5 Author: Jacopo Mondi Date: Sun Aug 10 04:30:43 2025 +0300 media: stm32: dma2d: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 1b2135910747f573027b5c220f0ede98484fcf6a Author: Jacopo Mondi Date: Sun Aug 10 04:30:42 2025 +0300 media: st: delta: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c3db0cdea470798c958915a2571de10e145334cc Author: Jacopo Mondi Date: Sun Aug 10 04:30:41 2025 +0300 media: bdisp: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit fede1dac719e080f922b52ef36fbb124dc1a2386 Author: Jacopo Mondi Date: Sun Aug 10 04:30:40 2025 +0300 media: s5p-mfc: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 4df43d4997ac34e371b2c08e8c506507da1652b2 Author: Laurent Pinchart Date: Sun Aug 10 04:30:39 2025 +0300 media: s5p-mfc: Store s5p_mfc_ctx in vb2_queue.drv_priv The driver stores a pointer to a v4l2_fh in the vb2_queue.drv_priv, which it then has to cast to a s5p_mfc_ctx pointer in all vb2 queue operations. Store the pointer to the s5p_mfc_ctx instead to avoid the cast. While at it, use the vb2_get_drv_priv() helper to access the field. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 52e6cd6aaa6bcac2647188518801d525e267edef Author: Jacopo Mondi Date: Sun Aug 10 04:30:38 2025 +0300 media: s5p-jpeg: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Reviewed-by: Andrzej Pietrasiewicz Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d21431099b75ec70a33e3d7be3f0fa17d30da05e Author: Jacopo Mondi Date: Sun Aug 10 04:30:37 2025 +0300 media: s5p-g2d: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 223171b22e866ede054c9949b0a83ab2e5ae8951 Author: Jacopo Mondi Date: Sun Aug 10 04:30:36 2025 +0300 media: s3c-camif: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh from the file * in all ioctl handlers. The v4l2_fh pointer is used to keep track of which user owns the streaming queue. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 3aafbde78bc67ae1321645a91f092da60dea205a Author: Jacopo Mondi Date: Sun Aug 10 04:30:35 2025 +0300 media: exynos4-is: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9d612344a2fc4d59a8c0b8c72bbfb774ae181e2b Author: Jacopo Mondi Date: Sun Aug 10 04:30:34 2025 +0300 media: exynos-gsc: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit aa099b1129a834d508761a9af18c6bf5f78b057d Author: Jacopo Mondi Date: Sun Aug 10 04:30:33 2025 +0300 media: rockchip: rkvdec: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Reviewed-by: Detlev Casanova Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 3cf9bbb526534f8f1c96b3ca81bf162e0ffb633c Author: Jacopo Mondi Date: Sun Aug 10 04:30:32 2025 +0300 media: rockhip: rga: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 8fbb206557ce7dd4f4881251d8c963421c5f064e Author: Jacopo Mondi Date: Sun Aug 10 04:30:31 2025 +0300 media: renesas: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Reviewed-by: Kieran Bingham Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit cdc569967504fc1c9db7a1302e6d9ef4e4422553 Author: Jacopo Mondi Date: Sun Aug 10 04:30:30 2025 +0300 media: nxp: mx2: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit f048bf7d755dc836c61ef38b905887b65dee79bd Author: Jacopo Mondi Date: Sun Aug 10 04:30:29 2025 +0300 media: imx-isi: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 8be69363d852a355323a715fdfb558c6ea132cca Author: Jacopo Mondi Date: Sun Aug 10 04:30:28 2025 +0300 media: imx-jpeg: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Reviewed-by: Ming Qian Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Hans Verkuil commit 25fe47cdc9098760b493a7aa3e032eb0f1c14f7a Author: Jacopo Mondi Date: Sun Aug 10 04:30:27 2025 +0300 media: tegra-vde: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 50363fc1feb87f48163bfa1cd431b46db917d0ad Author: Jacopo Mondi Date: Sun Aug 10 04:30:26 2025 +0300 media: mtk: vcodec: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. While at modify mtk_vcodec_enc_get_chip_name() to accept a ctx instead of a raw void *. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 698c41290e8dafc5a9089f0bec147a7dcd0c6849 Author: Jacopo Mondi Date: Sun Aug 10 04:30:25 2025 +0300 media: mtk: mdp3: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 59879e77deed1b31c698e60e96767099c73077e0 Author: Jacopo Mondi Date: Sun Aug 10 04:30:24 2025 +0300 media: mtk_mdp_m2m: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 966579c979a9f9702e52a63eaf42a0612ef6feb4 Author: Jacopo Mondi Date: Sun Aug 10 04:30:23 2025 +0300 media: mtk: jpeg: Access v4l2_fh from file->private_data The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 94f55f5eead078a499e401759a36b7e2c12f4a48 Author: Jacopo Mondi Date: Sun Aug 10 04:30:22 2025 +0300 media: m2m-deinterlace: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d0169457bc76e1220531356c574732a1124ee9e3 Author: Jacopo Mondi Date: Sun Aug 10 04:30:21 2025 +0300 media: wave5: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit a7f90007c2495c29909be4ae05e006b6a24844bb Author: Jacopo Mondi Date: Sun Aug 10 04:30:20 2025 +0300 media: coda: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit e732b1221dbdf8b54ab5c85f06012962001f2c48 Author: Jacopo Mondi Date: Sun Aug 10 04:30:19 2025 +0300 media: meson-ge2d: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 334f228752c2f8d3d4c74bc360527197819ddcc5 Author: Jacopo Mondi Date: Sun Aug 10 04:30:18 2025 +0300 media: allegro: Access v4l2_fh from file The v4l2_fh associated with an open file handle is now guaranteed to be available in file->private_data, initialised by v4l2_fh_add(). Access the v4l2_fh, and from there the driver-specific structure, from the file * in all ioctl handlers. While at it remove the only left user of fh_to_channel() and remove the macro completely. Signed-off-by: Jacopo Mondi Reviewed-by: Michael Tretter Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ae76d82230844d8d7cbbcf3e3a9dd7228a7cb994 Author: Jacopo Mondi Date: Sun Aug 10 04:30:17 2025 +0300 media: v4l2-ioctl: Access v4l2_fh from private_data Now that it is guaranteed that file->private_data is set to point to the 'struct v4l2_fh' initialised by v4l2_fh_add() the v4l2-ioctl layer can be modified to retrieve the v4l2_fh pointer from the file *. As the __video_do_ioctl() function, that calls all the handlers modified by this patch goes as: static long __video_do_ioctl(struct file *file, unsigned int cmd, void *arg) { void *fh = file->private_data; ... ret = info->func(ops, file, fh, arg); } This patch introduces no functional changes and makes it possible to remove in future the 'fh' argument to all ioctl handlers. Signed-off-by: Jacopo Mondi Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6b79b21e7d2cfc5e31ce00869526f31ae0f93959 Author: Jacopo Mondi Date: Sun Aug 10 04:30:16 2025 +0300 media: zoran: Rename __fh to fh Unless there is a good reason to do so, naming variable with double underscore is generally not a good idea. Rename the (mostly unused) __fh argument to ioctl handlers to fh. Signed-off-by: Jacopo Mondi Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit dc322d13cf417552b59e313e809a6da40b8b36ef Author: Jacopo Mondi Date: Sun Aug 10 04:30:15 2025 +0300 media: zoran: Remove zoran_fh structure The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), but the structure stayed by mistake. It is now used in a single location, assigned from a void pointer and then recast to a void pointer, without being every accessed. Drop it. Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") Signed-off-by: Jacopo Mondi Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit bb4d6be205dae94aa2d3c3a1ad814dad90d4fd62 Author: Laurent Pinchart Date: Sun Aug 10 04:30:14 2025 +0300 media: Drop V4L2_FL_USES_V4L2_FH checks Now that all drivers use v4l2_fh, we can drop the V4L2_FL_USES_V4L2_FH checks through the V4L2 core. To ensure that all new drivers use v4l2_fh, keep setting the V4L2_FL_USES_V4L2_FH flag in v4l2_fh_init(), and verify it is set after the .open() file operation returns. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit b3d945ba42dd640255492a523baeb6b6946a99bf Author: Laurent Pinchart Date: Sun Aug 10 04:30:13 2025 +0300 media: v4l2-dev: Make open and release file operations mandatory All V4L2 drivers implement the open and release file operations. As all new drivers will need to use v4l2_fh, this situation won't change. Make those two file operation mandatory at registration time. This allows simplifying v4l2_open() and v4l2_release(). Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5410bad3326f3557a7d996b19fa4adc2c70b3c0e Author: Laurent Pinchart Date: Sun Aug 10 04:30:12 2025 +0300 media: v4l2-ctrls: Move v4l2_fh retrieval after V4L2_FL_USES_V4L2_FH check The v4l2_ctrl_log_status() function retrieves the v4l2_fh from the file with file_to_v4l2_fh() before checking the V4L2_FL_USES_V4L2_FH to see if the device makes use of v4l2_fh. While this doesn't cause any practical issue given the current implementation of file_to_v4l2_fh(), it is cleaner to retrieve the v4l2_fh after checking the flag. This could prevent future issues if the implementation of file_to_v4l2_fh() changes. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5c17eace98188614ab03b25784a39b9a9cda6e35 Author: Laurent Pinchart Date: Sun Aug 10 04:30:11 2025 +0300 media: staging: ipu7: isys: Don't set V4L2_FL_USES_V4L2_FH manually The V4L2_FL_USES_V4L2_FH flag is set by v4l2_fh_init(). It is not meant to be set manually by drivers. Drop it from the ipu7-isys driver. Signed-off-by: Laurent Pinchart Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 04eff11469b29f9d1e8ce9b8cc9c86817a2ae92c Author: Laurent Pinchart Date: Sun Aug 10 04:30:10 2025 +0300 media: ipu6: isys: Don't set V4L2_FL_USES_V4L2_FH manually The V4L2_FL_USES_V4L2_FH flag is set by v4l2_fh_init(). It is not meant to be set manually by drivers. Drop it from the ipu6-isys driver. Signed-off-by: Laurent Pinchart Reviewed-by: Bingbu Cao Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 277966749f46bc6292c4052b4e66a554f193a78a Author: Laurent Pinchart Date: Sun Aug 10 04:30:09 2025 +0300 media: Reset file->private_data to NULL in v4l2_fh_del() Multiple drivers that use v4l2_fh and call v4l2_fh_del() manually reset the file->private_data pointer to NULL in their video device .release() file operation handler. Move the code to the v4l2_fh_del() function to avoid direct access to file->private_data in drivers. This requires adding a file pointer argument to the function. Changes to drivers have been generated with the following coccinelle semantic patch: @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - filp->private_data = NULL; ... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ...> } @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ... - filp->private_data = NULL; ...> } @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ...> } Manual changes have been applied to Documentation/ to update the usage patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the v4l2_fh_del() prototype and reset file->private_data, and to include/media/v4l2-fh.h to update the v4l2_fh_del() function prototype and its documentation. Additionally, white space issues have been fixed manually in drivers/usb/gadget/function/uvc_v4l2.c Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 47f4b1acb4d505b1e7e81d8e0ebce774422b8c2e Author: Laurent Pinchart Date: Sun Aug 10 04:30:08 2025 +0300 media: Set file->private_data in v4l2_fh_add() All the drivers that use v4l2_fh and call v4l2_fh_add() manually store a pointer to the v4l2_fh instance in file->private_data in their video device .open() file operation handler. Move the code to the v4l2_fh_add() function to avoid direct access to file->private_data in drivers. This requires adding a file pointer argument to the function. Changes to drivers have been generated with the following coccinelle semantic patch: @@ expression fh; identifier filp; identifier open; type ret; @@ ret open(..., struct file *filp, ...) { <... - filp->private_data = fh; ... - v4l2_fh_add(fh); + v4l2_fh_add(fh, filp); ...> } @@ expression fh; identifier filp; identifier open; type ret; @@ ret open(..., struct file *filp, ...) { <... - v4l2_fh_add(fh); + v4l2_fh_add(fh, filp); ... - filp->private_data = fh; ...> } Manual changes have been applied to Documentation/ to update the usage patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the v4l2_fh_add() prototype set file->private_data, and to include/media/v4l2-fh.h to update the v4l2_fh_add() function prototype and its documentation. Additionally, white space issues have been fixed manually in drivers/media/platform/nvidia/tegra-vde/v4l2.c, drivers/media/platform/rockchip/rkvdec/rkvdec.c, drivers/media/v4l2-core/v4l2-fh.c and drivers/staging/most/video/video.c. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 32eab51811051c23a1b9dfd6024e0b41b7a64261 Author: Laurent Pinchart Date: Sun Aug 10 04:30:07 2025 +0300 media: qcom: venus: Pass file pointer to venus_close_common() In preparation for a tree-wide rework automated with coccinelle that will need to access a struct file pointer in the venus_close_common() function, pass it from the callers. There is not functional change yet. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 99c414252648c9e59b3cdfda5916f156d1cee00e Author: Laurent Pinchart Date: Sun Aug 10 04:30:06 2025 +0300 media: qcom: iris: Drop unused argument to iris_get_inst() The second argument to the iris_get_inst() function is never used. Drop it. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 61a08386dcf48c708f42da9917a28f5ffe0701f6 Author: Laurent Pinchart Date: Sun Aug 10 04:30:05 2025 +0300 media: qcom: iris: Set file->private_data in iris_v4l2_fh_(de)init() In preparation for a tree-wide rework automated with coccinelle that will affect file->private_data, v4l2_fh_add() and v4l2_fh_del(), move setting file->private_data from the callers to the iris_v4l2_fh_init() and iris_v4l2_fh_deinit() functions. There is not functional change yet. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c284b5ab97a6ad8bdac9375dff0115ea49088c38 Author: Laurent Pinchart Date: Sun Aug 10 04:30:04 2025 +0300 media: qcom: iris: Pass file pointer to iris_v4l2_fh_(de)init() In preparation for a tree-wide rework automated with coccinelle that will need to access a struct file pointer in the iris_v4l2_fh_init() and iris_v4l2_fh_deinit() functions, pass it from the callers. There is not functional change yet. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit b2eeb35c6137c8b04b6cb1b4b272e269c63e99d1 Author: Laurent Pinchart Date: Sun Aug 10 04:30:03 2025 +0300 media: chips-media: wave5: Pass file pointer to wave5_cleanup_instance() In preparation for a tree-wide rework automated with coccinelle that will need to access a struct file pointer in the wave5_cleanup_instance() function, pass it from the callers. There is not functional change yet. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9c7ee499483d493152d5fd7cf477754099af14ed Author: Jacopo Mondi Date: Sun Aug 10 04:30:02 2025 +0300 media: camss: Remove custom .release fop() The 'file->private_data' pointer is reset in the vb2_fop_release() call path. For this reason a custom handler for the .release file operation is not needed and the driver can use vb2_fop_release() directly. Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit caa5c3439af793a727a9dcb69b1fdec7ece66302 Author: Laurent Pinchart Date: Sun Aug 10 04:30:01 2025 +0300 media: camss: Replace .open() file operation with v4l2_fh_open() The custom video_open() function in the camss driver open-codes the v4l2_fh_open() helper, with an additional mutex that protects the whole function. Given that the function does not modify any data guarded by the lock, there's no need for using the mutex and the function can be replaced by v4l2_fh_open(). Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ff9c50a4a92ac72e42c132ef08bd50b5fa933b68 Author: Jacopo Mondi Date: Sun Aug 10 04:30:00 2025 +0300 media: rzg2l-cru: Do not set file->private_data The RZ G2/L CRU driver sets file->private_data to the driver-specific structure, but the following call to v4l2_fh_open() overwrites it with a pointer to the just allocated v4l2_fh. Remove the mis-leading assignment in the driver. Signed-off-by: Jacopo Mondi Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil commit 78b2c8a6cd2fed89ad98213558531a7db52a0eea Author: Jacopo Mondi Date: Sun Aug 10 04:29:59 2025 +0300 media: rcar-vin: Do not set file->private_data The R-Car VIN driver sets file->private_data to the driver-specific structure, but the following call to v4l2_fh_open() overwrites it with a pointer to the just allocated v4l2_fh. Remove the mis-leading assignment in the driver. Signed-off-by: Jacopo Mondi Reviewed-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit bbe4debfaa6a16f11064d5c40ef6d468dad4398d Author: Laurent Pinchart Date: Sun Aug 10 04:29:58 2025 +0300 media: v4l2-fh: Move piece of documentation to correct function The paragraph in the v4l2_fh_del() documentation that indicates the function sets filp->private_data was added in the wrong place. It is meant for v4l2_fh_open(). Move it to where it belongs. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 1b847fa1bc9509150433aa16a1a1d3bac8a2bd38 Author: Laurent Pinchart Date: Sun Aug 10 04:29:57 2025 +0300 media: visl: Drop visl_v4l2fh_to_ctx() function The visl_v4l2fh_to_ctx() function is unused. Drop it. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd Author: Laurent Pinchart Date: Sun Aug 10 04:29:56 2025 +0300 media: amphion: Delete v4l2_fh synchronously in .release() The v4l2_fh initialized and added in vpu_v4l2_open() is delete and cleaned up when the last reference to the vpu_inst is released. This may happen later than at vpu_v4l2_close() time. Not deleting and cleaning up the v4l2_fh when closing the file handle to the video device is not ideal, as the v4l2_fh will still be present in the video device's fh_list, and will store a copy of events queued to the video device. There may also be other side effects of keeping alive an object that represents an open file handle after the file handle is closed. The v4l2_fh instance is embedded in the vpu_inst structure, and is accessed in two different ways: - in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2 events to the file handle ; and - through the driver to access the v4l2_fh.m2m_ctx pointer. The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and v4l2_fh_exit(). It is set to NULL by the driver when closing the file handle, in vpu_v4l2_close(). The vpu_notify_eos() and vpu_notify_source_change() functions are called in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change() respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is therefore a guarantee that no new event will be queued to the v4l2_fh after vpu_v4l2_close() destroys the m2m_ctx. The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(), which is guaranteed to be called for all queued buffers when vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called later. It is therefore safe to assume that the driver will not touch the v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close() destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh synchronously in vpu_v4l2_close(). Signed-off-by: Laurent Pinchart Reviewed-by: Ming Qian Signed-off-by: Hans Verkuil commit 5d1e54bb4dc6741284a3ed587e994308ddee2f16 Author: Laurent Pinchart Date: Sun Aug 10 04:29:55 2025 +0300 media: amphion: Make some vpu_v4l2 functions static Some functions defined in vpu_v4l2.c are never used outside of that compilation unit. Make them static. Signed-off-by: Laurent Pinchart Reviewed-by: Ming Qian Signed-off-by: Hans Verkuil commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc Author: Laurent Pinchart Date: Sun Aug 10 04:29:54 2025 +0300 media: pci: ivtv: Don't create fake v4l2_fh The ivtv driver has a structure named ivtv_open_id that models an open file handle for the device. It embeds a v4l2_fh instance for file handles that correspond to a V4L2 video device, and stores a pointer to that v4l2_fh in struct ivtv_stream to identify which open file handle owns a particular stream. In addition to video devices, streams can be owned by ALSA PCM devices. Those devices do not make use of the v4l2_fh instance for obvious reasons, but the snd_ivtv_pcm_capture_open() function still initializes a "fake" v4l2_fh for the sole purpose of using it as an open file handle identifier. The v4l2_fh is not properly destroyed when the ALSA PCM device is closed, leading to possible resource leaks. Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not accessed, only the pointer value is used for comparison. Replace it with a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and don't initialize the v4l2_fh for ALSA PCM devices. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4416df03ddf28566bb7c0169d9bd1e696d567899 Author: Laurent Pinchart Date: Sun Aug 10 04:29:53 2025 +0300 media: Replace file->private_data access with custom functions Accessing file->private_data manually to retrieve the v4l2_fh pointer is error-prone, as the field is a void * and will happily cast implicitly to any pointer type. Replace all remaining locations that read the v4l2_fh pointer directly from file->private_data and cast it to driver-specific file handle structures with driver-specific functions that use file_to_v4l2_fh() and perform the same cast. No functional change is intended, this only paves the way to remove direct accesses to file->private_data and make V4L2 drivers safer. Other accesses to the field will be addressed separately. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 72517d9f76fe3b14a5f73ce5491e722c229a14bf Author: Laurent Pinchart Date: Sun Aug 10 04:29:52 2025 +0300 media: nvidia: tegra-vde: Replace file->private_data access Accessing file->private_data manually to retrieve the v4l2_fh pointer is error-prone, as the field is a void * and will happily cast implicitly to any pointer type. The tegra-vde driver accesses file->private_data in the tegra_open() function, right after setting the field to &ctx->fh. Replace the accesses with usage of &ctx->fh. No functional change is intended, this only paves the way to remove direct accesses to file->private_data and make V4L2 drivers safer. Other accesses to the field will be addressed separately. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 8003313d388f11cfcaaa88a731f113afda171887 Author: Laurent Pinchart Date: Sun Aug 10 04:29:51 2025 +0300 media: Replace file->private_data access with file_to_v4l2_fh() Accessing file->private_data manually to retrieve the v4l2_fh pointer is error-prone, as the field is a void * and will happily cast implicitly to any pointer type. Replace all remaining locations that read the v4l2_fh pointer directly from file->private_data with usage of the file_to_v4l2_fh() function. The change was generated manually. No functional change is intended, this only paves the way to remove direct accesses to file->private_data and make V4L2 drivers safer. Other accesses to the field will be addressed separately. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 618882c92681de18e9bd99d2a88bb21c897283f3 Author: Laurent Pinchart Date: Sun Aug 10 04:29:50 2025 +0300 media: Wrap file->private_data access with a helper function Accessing file->private_data manually to retrieve the v4l2_fh pointer is error-prone, as the field is a void * and will happily convert implicitly to any pointer type. To avoid direct access to file->private_data, introduce a new inline function that retrieves the v4l2_fh pointer, and use it to replace common access patterns through the kernel. Changes to drivers have been generated with the following coccinelle semantic patch: @@ struct file *filp; identifier fh; @@ - struct v4l2_fh *fh = filp->private_data; + struct v4l2_fh *fh = file_to_v4l2_fh(filp); Manual changes have been applied to Documentation/ to update the usage patterns, and to include/media/v4l2-fh.h to add the new function. While at it, fix a typo in the title of v4l2-fh.rst: the file describes the "file handles" API, not "file handlers". No functional change is intended, this only paves the way to remove direct accesses to file->private_data and make V4L2 drivers safer. Other accesses to the field will be addressed separately. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 0fd7155307bebb7daf946abae0ee8e50d20819ed Author: Laurent Pinchart Date: Sun Aug 10 04:29:49 2025 +0300 media: staging: most: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The most driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7b6cf051dff7b35299ce52b0b00d6e21e656fb4f Author: Laurent Pinchart Date: Sun Aug 10 04:29:48 2025 +0300 media: usb: uvcvideo: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The uvcvideo driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4a538a1c5f728641b8e3c89f73f92c2bbf7a553e Author: Laurent Pinchart Date: Sun Aug 10 04:29:47 2025 +0300 media: usb: pvrusb2: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The pvrusb2 driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. While at it, drop unneeded structure forward declarations. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit b22ac2e4a96bcf63ecfa0b786f75d0173c8808de Author: Laurent Pinchart Date: Sun Aug 10 04:29:46 2025 +0300 media: usb: hdpvr: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The hdpvr driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. No extensive driver refactoring is required, as file->private_data is only used to check if a file handle is the owner of the device by comparing pointer values. The private_data pointer is actually compared to a struct v4l2_fh pointer, which happens to be the first field of the hdpvr_fh structure. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 597944ffa034223e5a7da380eb7b302c5ba64b79 Author: Laurent Pinchart Date: Sun Aug 10 04:29:45 2025 +0300 media: ti: vpe: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The ti-vpe driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5d8d523d3652970be0c13c08dedfab47feed4033 Author: Laurent Pinchart Date: Sun Aug 10 04:29:44 2025 +0300 media: imagination: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The e5010-jpeg-enc driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2ce99accf39b1e4fd979a70093711edeb7c979b4 Author: Laurent Pinchart Date: Sun Aug 10 04:29:43 2025 +0300 media: pci: saa7164: Store v4l2_fh pointer in file->private_data Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The saa7164 instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. This also fixes a bug in the vidioc_g_std() in saa7164-vbi.c that casts the private_data void pointer to a saa7164_encoder_fh instead of a saa7164_vbi_fh. The bug has no practical consequence as the two structures are identical. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 103b0cfc9ab6ae920289223f402ec5e868e3a872 Author: Dr. David Alan Gilbert Date: Wed Jun 25 14:32:55 2025 +0100 media: radio-wl1273: Remove The wl1273 FM radio is on Arnd's unused driver list: https://lore.kernel.org/lkml/a15bb180-401d-49ad-a212-0c81d613fbc8@app.fastmail.com/ remove the radio component itself. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit fdbe93b7f0f86c943351ceab26c8fad548869f91 Merge: 7ceff083ee04ad b3ef7bdec66fb1 Author: Jakub Kicinski Date: Tue Aug 12 18:58:33 2025 -0700 Merge branch 'net-airoha-introduce-npu-callbacks-for-wlan-offloading' Lorenzo Bianconi says: ==================== net: airoha: Introduce NPU callbacks for wlan offloading Similar to wired traffic, EN7581 SoC allows to offload traffic to/from the MT76 wireless NIC configuring the NPU module via the Netfilter flowtable. This series introduces the necessary NPU callback used by the MT7996 driver in order to enable the offloading. MT76 support has been posted as RFC in [0] in order to show how the APIs are consumed. ==================== Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-0-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit b3ef7bdec66fb1813e865fd39d179a93cefd2015 Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:42 2025 +0200 net: airoha: Add airoha_offload.h header Move NPU definitions to airoha_offload.h in include/linux/soc/airoha/ in order to allow the MT76 driver to access the callback definitions. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-7-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit 29c4a3ce508961a02d185ead2d52699b16d82c6d Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:41 2025 +0200 net: airoha: npu: Enable core 3 for WiFi offloading NPU core 3 is responsible for WiFi offloading so enable it during NPU probe. Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-6-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit a1740b16c83729d908c760eaa821f27b51e58a13 Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:40 2025 +0200 net: airoha: npu: Read NPU wlan interrupt lines from the DTS Read all NPU wlan IRQ lines from the NPU device-tree node. NPU module fires wlan irq lines when the traffic to/from the WiFi NIC is not hw accelerated (these interrupts will be consumed by the MT76 driver in subsequent patches). This is a preliminary patch to enable wlan flowtable offload for EN7581 SoC. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-5-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit 03b7ca3ee5e1b700c462aed5b6cb88f616d6ba7f Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:39 2025 +0200 net: airoha: npu: Add wlan irq management callbacks Introduce callbacks used by the MT76 driver to configure NPU SoC interrupts. This is a preliminary patch to enable wlan flowtable offload for EN7581 SoC with MT76 driver. Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-4-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit f97fc66185b2004ad5f393f78b3e645009ddd1d0 Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:38 2025 +0200 net: airoha: npu: Add wlan_{send,get}_msg NPU callbacks Introduce wlan_send_msg() and wlan_get_msg() NPU wlan callbacks used by the wlan driver (MT76) to initialize NPU module registers in order to offload wireless-wired traffic. This is a preliminary patch to enable wlan flowtable offload for EN7581 SoC with MT76 driver. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-3-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit 564923b02c1d2fe02ee789f9849ff79979b63b9f Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:37 2025 +0200 net: airoha: npu: Add NPU wlan memory initialization commands Introduce wlan_init_reserved_memory callback used by MT76 driver during NPU wlan offloading setup. This is a preliminary patch to enable wlan flowtable offload for EN7581 SoC with MT76 driver. Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-2-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit cebd717d8f010a9897105434dbc6bdbd85693596 Author: Lorenzo Bianconi Date: Mon Aug 11 17:31:36 2025 +0200 dt-bindings: net: airoha: npu: Add memory regions used for wlan offload Document memory regions used by Airoha EN7581 NPU for wlan traffic offloading. The brand new added memory regions do not introduce any backward compatibility issues since they will be used just to offload traffic to/from the MT76 wireless NIC and the MT76 probing will not fail if these memory regions are not provide, it will just disable offloading via the NPU module. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250811-airoha-en7581-wlan-offlaod-v7-1-58823603bb4e@kernel.org Signed-off-by: Jakub Kicinski commit 7ceff083ee04ade9083c74a5120ddb5a6f06a6da Merge: 0a529da8cfe313 c378c497f3fe8d Author: Jakub Kicinski Date: Tue Aug 12 18:27:44 2025 -0700 Merge branch 'selftests-drv-net-improve-zerocopy-tests' Jakub Kicinski says: ==================== selftests: drv-net: improve zerocopy tests A few tweaks to the devmem test to make it more "NIPA-compatible". We still need a fix to make sure that the test sets hds threshold to 0. Taehee is presumably already/still working on that: https://lore.kernel.org/20250702104249.1665034-1-ap420073@gmail.com so I'm not including my version. # ./tools/testing/selftests/drivers/net/hw/devmem.py TAP version 13 1..3 ok 1 devmem.check_rx ok 2 devmem.check_tx ok 3 devmem.check_tx_chunks # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 ==================== Link: https://patch.msgid.link/20250811231334.561137-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c378c497f3fe8dc8f08b487fce49c3d96e4cada8 Author: Jakub Kicinski Date: Mon Aug 11 16:13:34 2025 -0700 selftests: drv-net: devmem: flip the direction of Tx tests The Device Under Test should always be the local system. While the Rx test gets this right the Tx test is sending from remote to local. So Tx of DMABUF memory happens on remote. These tests never run in NIPA since we don't have a compatible device so we haven't caught this. Reviewed-by: Joe Damato Reviewed-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250811231334.561137-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6e9a12f85a7567bb9a41d5230468886bd6a27b20 Author: Jakub Kicinski Date: Mon Aug 11 16:13:33 2025 -0700 selftests: net: terminate bkg() commands on exception There is a number of: with bkg("socat ..LISTEN..", exit_wait=True) uses in the tests. If whatever is supposed to send the traffic fails we will get stuck in the bkg(). Try to kill the process in case of exception, to avoid the long wait. A specific example where this happens is the devmem Tx tests. Reviewed-by: Joe Damato Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250811231334.561137-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 424e96de30230aac2061f941961be645cf0070d5 Author: Jakub Kicinski Date: Mon Aug 11 16:13:32 2025 -0700 selftests: drv-net: devmem: add / correct the IPv6 support We need to use bracketed IPv6 addresses for socat. Reviewed-by: Joe Damato Reviewed-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250811231334.561137-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a94e9cf79ceee04c3e2d042fdf417b8c235c6117 Author: Jakub Kicinski Date: Mon Aug 11 16:13:31 2025 -0700 selftests: drv-net: devmem: remove sudo from system() calls The general expectations for network HW selftests is that they will be run as root. sudo doesn't seem to work on NIPA VMs. While it's probably something solvable in the setup I think we should remove the sudos. devmem is the only networking test using sudo. Reviewed-by: Joe Damato Reviewed-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250811231334.561137-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 27e5b560a86e479bef247a1327182d155ed0bad6 Author: Jakub Kicinski Date: Mon Aug 11 16:13:30 2025 -0700 selftests: drv-net: add configs for zerocopy Rx Looks like neither IO_URING nor UDMABUF are enabled even tho iou-zcrx.py and devmem.py (respectively) need those. IO_URING gets enabled by default but UDMABUF is missing. Reviewed-by: Joe Damato Reviewed-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250811231334.561137-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0a529da8cfe31361c1ef6a0661329745928c1dba Merge: c88c6b2db71e0e d6e1f2272960cd Author: Jakub Kicinski Date: Tue Aug 12 18:04:56 2025 -0700 Merge branch 'net-stmmac-improbe-suspend-resume-architecture' Russell King says: ==================== net: stmmac: improbe suspend/resume architecture This series improves the stmmac suspend/resume architecture by providing a couple of method hooks in struct plat_stmmacenet_data which are called by core code, and thus are available for any of the platform glue drivers, whether using a platform or PCI device. As these methods are called by core code, we can also provide a simple PM ops structure also in the core code for converted glue drivers to use. The remainder of the patches convert the various drivers. ==================== Link: https://patch.msgid.link/aJo7kvoub5voHOUQ@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d6e1f2272960cdb5081e9318d6a04de478d80400 Author: Russell King (Oracle) Date: Mon Aug 11 19:51:24 2025 +0100 net: stmmac: mediatek: convert to resume() method Convert mediatek to use the resume() platform method rather than the init() platform method as mediatek_dwmac_init() is only called from the resume paths. This will ensure that in a future commit, mediatek_dwmac_init() won't be called when probing the main part of the stmmac driver. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXcC-008grN-Hc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c7308b2f3d0d045005bc9d2110ac5d5085a4fe0c Author: Russell King (Oracle) Date: Mon Aug 11 19:51:19 2025 +0100 net: stmmac: stm32: convert to suspend()/resume() methods Convert stm32 to use the new suspend() and resume() methods rather than implementing these in custom wrappers around the main driver's suspend/resume methods. This allows this driver to use the stmmac simple PM ops structure. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXc7-008grH-Dh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d7a276a5768ffe4f3dbcb0a2d9d037f117b53784 Author: Russell King (Oracle) Date: Mon Aug 11 19:51:14 2025 +0100 net: stmmac: rk: convert to suspend()/resume() methods Convert rk to use the new suspend() and resume() methods rather than implementing these in custom wrappers around the main driver's suspend/resume methods. This allows this driver to use the simmac simple PM ops structure. We can further simplify the driver as there is no need to track whether the device was suspended, we only need to check whether the device is wakeup capable in the resume method. This is because the resume method will only be called after the suspend method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXc2-008grB-9k@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c91918a1e9767fc40488f69436f61af90221615b Author: Russell King (Oracle) Date: Mon Aug 11 19:51:09 2025 +0100 net: stmmac: pci: convert to suspend()/resume() methods Convert pci to use the new suspend() and resume() methods rather than implementing these in custom wrappers around the main driver's suspend/resume methods. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXbx-008gr4-5H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 38772638d6d1989655f5a05b273dc62a026e0ef1 Author: Russell King (Oracle) Date: Mon Aug 11 19:51:04 2025 +0100 net: stmmac: loongson: convert to suspend()/resume() methods Convert loongson to use the new suspend() and resume() methods rather than implementing these in custom wrappers around the main driver's suspend/resume methods. This allows this driver to use the stmmac simple PM ops structure. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXbs-008gqy-16@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 062b428017332adf8cee09612db2ae0495b4eb4e Author: Russell King (Oracle) Date: Mon Aug 11 19:50:58 2025 +0100 net: stmmac: intel: convert to suspend()/resume() methods Convert intel to use the new suspend() and resume() methods rather than implementing these in custom wrappers around the main driver's suspend/resume methods. This allows this driver to use the stmmac simple PM ops structure. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1ulXbm-008gqs-P9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b51f34bc85e3b8c24f091a8e216b28213758021d Author: Russell King (Oracle) Date: Mon Aug 11 19:50:53 2025 +0100 net: stmmac: platform: legacy hooks for suspend()/resume() methods Add legacy hooks for the suspend() and resume() methods to forward these calls to the init() and exit() methods when the platform code hasn't populated the two former methods. This allows us to get rid of stmmac_pltfr_suspend() and stmmac_pltfr_resume(). Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1ulXbh-008gql-LO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7e84b3fae58c5425c324277268cad431ad181599 Author: Russell King (Oracle) Date: Mon Aug 11 19:50:48 2025 +0100 net: stmmac: provide a set of simple PM ops Several drivers will want to make use of simple PM operations, so provide these from the core driver. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1ulXbc-008gqf-GJ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 07bbbfe7addf5b032e04f3c38f0b183d067a3f0d Author: Russell King (Oracle) Date: Mon Aug 11 19:50:43 2025 +0100 net: stmmac: add suspend()/resume() platform ops Add suspend/resume platform operations, which, when populated, override the init/exit platform operations when we suspend and resume. These suspend()/resume() methods are called by core code, and thus are designed to support any struct device, not just platform devices. This allows them to be used by the PCI drivers we have. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1ulXbX-008gqZ-Bb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c88c6b2db71e0e19a4cf5a009611abb798a89f05 Merge: b1987f1e05b7dd 1838731f1072ce Author: Jakub Kicinski Date: Tue Aug 12 17:58:35 2025 -0700 Merge branch 'selftest-af_unix-enable-wall-and-wflex-array-member-not-at-end' Kuniyuki Iwashima says: ==================== selftest: af_unix: Enable -Wall and -Wflex-array-member-not-at-end. This series fix 4 warnings caught by -Wall and -Wflex-array-member-not-at-end. ==================== Link: https://patch.msgid.link/20250811215432.3379570-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 1838731f1072ce859ae3350547de4792f365760c Author: Kuniyuki Iwashima Date: Mon Aug 11 21:53:04 2025 +0000 selftest: af_unix: Add -Wall and -Wflex-array-member-not-at-end to CFLAGS. -Wall and -Wflex-array-member-not-at-end caught some warnings that will be fixed in later patches. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250811215432.3379570-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit fd9faac372cc5f95ca537be5e3daf044c87ffae1 Author: Kuniyuki Iwashima Date: Mon Aug 11 21:53:07 2025 +0000 selftest: af_unix: Silence -Wall warning for scm_pid.c. -Wall found 2 unused variables in scm_pid.c: scm_pidfd.c: In function ‘parse_cmsg’: scm_pidfd.c:140:13: warning: unused variable ‘data’ [-Wunused-variable] 140 | int data = 0; | ^~~~ scm_pidfd.c: In function ‘cmsg_check_dead’: scm_pidfd.c:246:15: warning: unused variable ‘client_pid’ [-Wunused-variable] 246 | pid_t client_pid; | ^~~~~~~~~~ Let's remove these variables. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250811215432.3379570-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9a58d8e68252af07138a2530a22f081ef0b070c1 Author: Kuniyuki Iwashima Date: Mon Aug 11 21:53:06 2025 +0000 selftest: af_unix: Silence -Wflex-array-member-not-at-end warning for scm_rights.c. scm_rights.c has no problem in functionality, but when compiled with -Wflex-array-member-not-at-end, it shows this warning: scm_rights.c: In function ‘__send_fd’: scm_rights.c:275:32: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 275 | struct cmsghdr cmsghdr; | ^~~~~~~ Let's silence it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250811215432.3379570-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 942224e6baca0d1bdd1801e935f3544f2df37baf Author: Kuniyuki Iwashima Date: Mon Aug 11 21:53:05 2025 +0000 selftest: af_unix: Silence -Wflex-array-member-not-at-end warning for scm_inq.c. scm_inq.c has no problem in functionality, but when compiled with -Wflex-array-member-not-at-end, it shows this warning: scm_inq.c:15:24: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 15 | struct cmsghdr cmsghdr; | ^~~~~~~ Let's silence it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250811215432.3379570-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b1987f1e05b7dd2e08b51967cc187dbe8092cbd9 Merge: 75f26257667588 4aeb452c237afa Author: Jakub Kicinski Date: Tue Aug 12 17:32:44 2025 -0700 Merge branch 'netconsole-reuse-netpoll_parse_ip_addr-in-configfs-helpers' Breno Leitao says: ==================== netconsole: reuse netpoll_parse_ip_addr in configfs helpers This patchset refactors the IP address parsing logic in the netconsole driver to eliminate code duplication and improve maintainability. The changes centralize IPv4 and IPv6 address parsing into a single function (netpoll_parse_ip_addr). For that, it needs to teach netpoll_parse_ip_addr() to handle strings with newlines, which is the type of string coming from configfs. Background The netconsole driver currently has duplicate IP address parsing logic in both local_ip_store() and remote_ip_store() functions. This duplication increases the risk of inconsistencies and makes the code harder to maintain. Benefits * Reduced code duplication: ~40 lines of duplicate parsing logic eliminated * Improved robustness: Centralized parsing reduces the chance of inconsistencies * Easier to maintain: Code follow more the netdev way v3: https://lore.kernel.org/20250723-netconsole_ref-v3-0-8be9b24e4a99@debian.org v2: https://lore.kernel.org/20250721-netconsole_ref-v2-0-b42f1833565a@debian.org v1: https://lore.kernel.org/20250718-netconsole_ref-v1-0-86ef253b7a7a@debian.org ==================== Link: https://patch.msgid.link/20250811-netconsole_ref-v4-0-9c510d8713a2@debian.org Signed-off-by: Jakub Kicinski commit 4aeb452c237afa6d7e8d09185bca6e34454ca333 Author: Breno Leitao Date: Mon Aug 11 11:13:28 2025 -0700 netconsole: use netpoll_parse_ip_addr in local_ip_store Replace manual IP address parsing with a call to netpoll_parse_ip_addr in remote_ip_store(), simplifying the code and reducing the chance of errors. The error message got removed, since it is not a good practice to pr_err() if used pass a wrong value in configfs. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 60cb69214148fbe7fc50239c28e4d052eec6ae61 Author: Breno Leitao Date: Mon Aug 11 11:13:27 2025 -0700 netconsole: use netpoll_parse_ip_addr in local_ip_store Replace manual IP address parsing with a call to netpoll_parse_ip_addr in local_ip_store(), simplifying the code and reducing the chance of errors. Also, remove the pr_err() if the user enters an invalid value in configfs entries. pr_err() is not the best way to alert user that the configuration is invalid. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 364213b736e313fab963b272ebe5a2ffeb888831 Author: Breno Leitao Date: Mon Aug 11 11:13:26 2025 -0700 netconsole: add support for strings with new line in netpoll_parse_ip_addr The current IP address parsing logic fails when the input string contains a trailing newline character. This can occur when IP addresses are provided through configfs, which contains newlines in a const buffer. Teach netpoll_parse_ip_addr() how to ignore newlines at the end of the IPs. Also, simplify the code by: * No need to check for separators. Try to parse ipv4, if it fails try ipv6 similarly to ceph_pton() * If ipv6 is not supported, don't call in6_pton() at all. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250811-netconsole_ref-v4-2-9c510d8713a2@debian.org Signed-off-by: Jakub Kicinski commit fa38524ca5a783aa0cfc8ffa5730c5012edfccf4 Author: Breno Leitao Date: Mon Aug 11 11:13:25 2025 -0700 netconsole: move netpoll_parse_ip_addr() earlier for reuse Move netpoll_parse_ip_addr() earlier in the file to be reused in other functions, such as local_ip_store(). This avoids duplicate address parsing logic and centralizes validation for both IPv4 and IPv6 string input. No functional changes intended. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250811-netconsole_ref-v4-1-9c510d8713a2@debian.org Signed-off-by: Jakub Kicinski commit 75f26257667588260d067fa022ebd6ac39b4a9c1 Author: Florian Fainelli Date: Mon Aug 11 09:59:21 2025 -0700 net: mdio: mdio-bcm-unimac: Refine incorrect clock message In light of a81649a4efd3 ("net: mdio: mdio-bcm-unimac: Correct rate fallback logic"), it became clear that the warning should be specific to the MDIO controller instance, and there should be further information provided to indicate what is wrong, whether the requested clock frequency or the rate calculation. Clarify the message accordingly. Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20250811165921.392030-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit b3ba7d929ce197ff2651046798b94bd62eb0e680 Author: Thorsten Blum Date: Mon Aug 11 18:40:38 2025 +0200 net/sched: Remove redundant memset(0) call in reset_policy() The call to nla_strscpy() already zero-pads the tail of the destination buffer which makes the additional memset(0) call redundant. Remove it. Signed-off-by: Thorsten Blum Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250811164039.43250-1-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit d9412f08e25a5b66f9021739c090cc9b8f1089b1 Merge: 733c4e9bcec9c4 c3dd67681c70cc Author: Dave Jiang Date: Tue Aug 12 16:23:07 2025 -0700 Merge branch 'for-6.18/cxl-poison-inject' into cxl-for-next Add support to allow expert users to inject and clear poison for the CXL subsystem by writing a System Physical Address (SPA) to a debugfs file. commit c3dd67681c70cc95cc2c889b1b58a1667bb1c48b Author: Alison Schofield Date: Mon Aug 4 01:00:13 2025 -0700 cxl/region: Add inject and clear poison by region offset Add CXL region debugfs attributes to inject and clear poison based on an offset into the region. These new interfaces allow users to operate on poison at the region level without needing to resolve Device Physical Addresses (DPA) or target individual memdevs. The implementation uses a new helper, region_offset_to_dpa_result() that applies decoder interleave logic, including XOR-based address decoding when applicable. Note that XOR decodes rely on driver internal xormaps which are not exposed to userspace. So, this support is not only a simplification of poison operations that could be done using existing per memdev operations, but also it enables this functionality for XOR interleaved regions for the first time. New debugfs attributes are added in /sys/kernel/debug/cxl/regionX/: inject_poison and clear_poison. These are only exposed if all memdevs participating in the region support both inject and clear commands, ensuring consistent and reliable behavior across multi-device regions. If tracing is enabled, these operations are logged as cxl_poison events in /sys/kernel/tracing/trace. The ABI documentation warns users of the significant risks that come with using these capabilities. A CXL Maturity Map update shows this user flow is now supported. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/f3fd8628ab57ea79704fb2d645902cd499c066af.1754290144.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit 25a0207828bc52f1ebb6588f9417eb43ca4960a3 Author: Alison Schofield Date: Mon Aug 4 01:00:12 2025 -0700 cxl/core: Add locked variants of the poison inject and clear funcs The core functions that validate and send inject and clear commands to the memdev devices require holding both the dpa_rwsem and the region_rwsem. In preparation for another caller of these functions that must hold the locks upon entry, split the work into a locked and unlocked pair. Consideration was given to moving the locking to both callers, however, the existing caller is not in the core (mem.c) and cannot access the locks. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/1d601f586975195733984ca63d1b5789bbe8690f.1754290144.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit dc181170491bda9944f95ca39017667fe7fd767d Author: Alison Schofield Date: Mon Aug 4 01:00:11 2025 -0700 cxl/region: Introduce SPA to DPA address translation Add infrastructure to translate System Physical Addresses (SPA) to Device Physical Addresses (DPA) within CXL regions. This capability will be used by follow-on patches that add poison inject and clear operations at the region level. The SPA-to-DPA translation process follows these steps: 1. Apply root decoder transformations (SPA to HPA) if configured. 2. Extract the position in region interleave from the HPA offset. 3. Extract the DPA offset from the HPA offset. 4. Use position to find endpoint decoder. 5. Use endpoint decoder to find memdev and calculate DPA from offset. 6. Return the result - a memdev and a DPA. It is Step 1 above that makes this a driver level operation and not work we can push to user space. Rather than exporting the XOR maps for root decoders configured with XOR interleave, the driver performs this complex calculation for the user. Steps 2 and 3 follow the CXL Spec 3.2 Section 8.2.4.20.13 Implementation Note: Device Decode Logic. These calculations mirror much of the logic introduced earlier in DPA to SPA translation, see cxl_dpa_to_hpa(), where the driver needed to reverse the spec defined 'Device Decode Logic'. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/422f0e27742c6ca9a11f7cd83e6ba9fa1a8d0c74.1754290144.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit b83ee9614a3ec196111f0ae54335b99700f78b45 Author: Alison Schofield Date: Mon Aug 4 01:00:10 2025 -0700 cxl: Define a SPA->CXL HPA root decoder callback for XOR Math When DPA->SPA translation was introduced, it included a helper that applied the XOR maps to do the CXL HPA -> SPA translation for XOR region interleaves. In preparation for adding SPA->DPA address translation, introduce the reverse callback. The root decoder callback is defined generically and not all usages may be self inverting like this XOR function. Add another root decoder callback that is the spa_to_hpa function. Update the existing cxl_xor_hpa_to_spa() with a name that reflects what it does without directionality: cxl_apply_xor_maps(), a generic parameter: addr replaces hpa, and code comments stating that the function supports the translation in either direction. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/79d9d72230c599cae94d7221781ead6392ae6d3f.1754290144.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit 524b2b76f365fb90a7f894ac17261ea760464e2c Author: Alison Schofield Date: Mon Aug 4 01:00:09 2025 -0700 cxl: Move hpa_to_spa callback to a new root decoder ops structure The root decoder's HPA to SPA translation logic was implemented using a single function pointer. In preparation for additional per-decoder callbacks, convert this into a struct cxl_rd_ops and move the hpa_to_spa pointer into it. To avoid maintaining a static ops instance populated with mostly NULL pointers, allocate the ops structure dynamically only when a platform requires overrides (e.g. XOR interleave decoding). The setup can be extended as additional callbacks are added. Co-developed-by: Dave Jiang Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/818530c82c351a9c0d3a204f593068dd2126a5a9.1754290144.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit bf0c2a84df9fb0f7779eb24c30198ef93f292e66 Author: Qianfeng Rong Date: Mon Aug 11 20:39:49 2025 +0800 bpf: Replace kvfree with kfree for kzalloc memory The 'backedge' pointer is allocated with kzalloc(), which returns physically contiguous memory. Using kvfree() to deallocate such memory is functionally safe but semantically incorrect. Replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr() check in kvfree(). Signed-off-by: Qianfeng Rong Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250811123949.552885-1-rongqianfeng@vivo.com commit f7cc3caea0005972162813e24892c49f2364f2fd Author: Andrii Nakryiko Date: Fri Jun 6 14:48:40 2025 -0700 .gitignore: ignore compile_commands.json globally compile_commands.json can be used with clangd to enable language server protocol-based assistance. For kernel itself this can be built with scripts/gen_compile_commands.py, but other projects (e.g., libbpf, or BPF selftests) can benefit from their own compilation database file, which can be generated successfully using external tools, like bear [0]. So, instead of adding compile_commands.json to .gitignore in respective individual projects, let's just ignore it globally anywhere in Linux repo. While at it, remove exactly such a local .gitignore rule under tools/power/cpupower. [0] https://github.com/rizsotto/Bear Reviewed-by: Nathan Chancellor Suggested-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Reviewed-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250606214840.3165754-1-andrii@kernel.org Signed-off-by: Nathan Chancellor commit c93c59baa5ab57e94b874000cec56e26611b7a23 Author: Paul Chaignon Date: Mon Aug 11 20:58:20 2025 +0200 bpf: Tidy verifier bug message Yonghong noticed that error messages for potential verifier bugs often have a '(1)' at the end. This is happening because verifier_bug_if(cond, env, fmt, args...) prints "(" #cond ")\n" as part of the message and verifier_bug() is defined as: #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args) Hence, verifier_bug() always ends up displaying '(1)'. This small patch fixes it by having verifier_bug_if conditionally call verifier_bug instead of the other way around. Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs") Reported-by: Yonghong Song Signed-off-by: Paul Chaignon Signed-off-by: Andrii Nakryiko Tested-by: Eduard Zingerman Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com commit 3e2b799008a78c21c648328bed9f566335f0394e Author: Qianfeng Rong Date: Mon Aug 4 20:27:30 2025 +0800 bpf: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250804122731.460158-1-rongqianfeng@vivo.com commit c12e371a31d6a835d28330d582e953ae94c2e3e2 Author: Dmitry Torokhov Date: Sun Jun 29 23:03:37 2025 -0700 Input: tca8418_keypad - switch to using module_i2c_driver() With kernel supporting deferred probing there is no longer need to play games with different initcall levels trying to influence probe order. Switch the driver to use standard module_i2c_driver() to register the driver. Link: https://lore.kernel.org/r/dhb2wzrhspbjh2gbt3iny7odsrpq2bbqldq276zuxwc4bnhgbl@qkbxj6yrihqv Signed-off-by: Dmitry Torokhov commit 534b9bdeb4b80d843ca9f924524d4d103ad6605e Author: Dmitry Torokhov Date: Sun Jun 29 22:52:45 2025 -0700 Input: tca6416-keypad - remove the driver This input driver predates proper GPIO driver for the chip and now can be replaced with the generic gpio-keys. Remove the driver. Link: https://lore.kernel.org/r/ajfsei3keh4jjasd4lshjicgqixew7bak3cmty3suoliskzgz4@vj3ijycfxy4i Signed-off-by: Dmitry Torokhov commit 733c4e9bcec9c481afee3891218277d9ecd06599 Author: Nai-Chen Cheng Date: Tue Aug 12 00:49:46 2025 +0800 cxl/region: use str_enabled_disabled() instead of ternary operator Replace ternary operator with str_enabled_disabled() helper to enhance code readability and consistency. [dj: Fix spelling in commit log and subject. ] Signed-off-by: Nai-Chen Cheng Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20250812-cxl-region-string-choices-v1-1-50200b0bc782@gmail.com Signed-off-by: Dave Jiang commit 22fb4ad898853323f4943de3e0dc555915547ccc Author: Xichao Zhao Date: Mon Aug 11 20:25:19 2025 +0800 cxl/hdm: Use str_plural() to simplify the code Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20250811122519.543554-1-zhao.xichao@vivo.com Signed-off-by: Dave Jiang commit a3daf184bd85d7c08ce948a79bb0e4cac2203923 Author: Mel Henning Date: Mon Aug 11 17:32:33 2025 -0400 drm/nouveau: Improve message for missing firmware This is inteded to address concerns that users might get cryptic error messages or a failure to boot if they set nouveau.config=NvGspRm=0 on the kernel command line and their gpu requires gsp (Ada or newer). With this patch, that configuration results in error messages like this: nouveau 0000:01:00.0: gsp: Failed to load required firmware for device. nouveau 0000:01:00.0: gsp ctor failed: -22 nouveau 0000:01:00.0: probe with driver nouveau failed with error -22 When nouveau fails to load like this, we still fall back to the generic framebuffer device, so users will still have limited graphical output. Signed-off-by: Mel Henning Signed-off-by: Lyude Paul Link: https://lore.kernel.org/r/20250811213843.4294-4-mhenning@darkrefraction.com commit 2e308a935fa1307ea802bf65d8cc8507244d3b23 Author: Mel Henning Date: Mon Aug 11 17:32:32 2025 -0400 drm/nouveau: Remove nvkm_gsp_fwif.enable This struct element is no longer used. Signed-off-by: Mel Henning Reviewed-by: Ben Skeggs Signed-off-by: Lyude Paul Link: https://lore.kernel.org/r/20250811213843.4294-3-mhenning@darkrefraction.com commit e0ed674acbac5635494fc7b278abc9505eaa8e71 Author: Mel Henning Date: Mon Aug 11 17:32:31 2025 -0400 drm/nouveau: Remove DRM_NOUVEAU_GSP_DEFAULT config This option was originally intoduced because the GSP code path was not well tested and we wanted to leave it up to distros which code path they shipped by default. By now though, the GSP path is probably better tested than the old firmware eg. Fedora ships GSP by default and we generally run CTS on GSP. We've always been GSP-only on Ada and later. So, this path removes the option and effectively sets the option to always on. We still fall back to the old firmware if GSP is not found. This change only affects Turing and Ampere. Users can still set nouveau.config=NvGspRm=0 on the kernel command line to force using the old firmware on Turing/Ampere. Signed-off-by: Mel Henning Reviewed-by: Ben Skeggs Signed-off-by: Lyude Paul Link: https://lore.kernel.org/r/20250811213843.4294-2-mhenning@darkrefraction.com commit bab4ab484a6ca170847da9bffe86f1fa90df4bbe Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:55 2025 -0500 ASoC: dt-bindings: Convert brcm,bcm2835-i2s to DT schema Convert the Broadcom BCM2835 I2S/PCM binding to DT schema format. It's a straightforward conversion. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250812203356.735234-1-robh@kernel.org Signed-off-by: Mark Brown commit 86e3d52bd3e919181d5f7e5107065d16e694c8d8 Author: Eric Dumazet Date: Mon Aug 11 14:52:52 2025 +0000 phonet: add __rcu annotations Removes following sparse errors. make C=2 net/phonet/socket.o net/phonet/af_phonet.o CHECK net/phonet/socket.c net/phonet/socket.c:619:14: error: incompatible types in comparison expression (different address spaces): net/phonet/socket.c:619:14: struct sock [noderef] __rcu * net/phonet/socket.c:619:14: struct sock * net/phonet/socket.c:642:17: error: incompatible types in comparison expression (different address spaces): net/phonet/socket.c:642:17: struct sock [noderef] __rcu * net/phonet/socket.c:642:17: struct sock * net/phonet/socket.c:658:17: error: incompatible types in comparison expression (different address spaces): net/phonet/socket.c:658:17: struct sock [noderef] __rcu * net/phonet/socket.c:658:17: struct sock * net/phonet/socket.c:677:25: error: incompatible types in comparison expression (different address spaces): net/phonet/socket.c:677:25: struct sock [noderef] __rcu * net/phonet/socket.c:677:25: struct sock * net/phonet/socket.c:726:21: warning: context imbalance in 'pn_res_seq_start' - wrong count at exit net/phonet/socket.c:741:13: warning: context imbalance in 'pn_res_seq_stop' - wrong count at exit CHECK net/phonet/af_phonet.c net/phonet/af_phonet.c:35:14: error: incompatible types in comparison expression (different address spaces): net/phonet/af_phonet.c:35:14: struct phonet_protocol const [noderef] __rcu * net/phonet/af_phonet.c:35:14: struct phonet_protocol const * net/phonet/af_phonet.c:474:17: error: incompatible types in comparison expression (different address spaces): net/phonet/af_phonet.c:474:17: struct phonet_protocol const [noderef] __rcu * net/phonet/af_phonet.c:474:17: struct phonet_protocol const * net/phonet/af_phonet.c:486:9: error: incompatible types in comparison expression (different address spaces): net/phonet/af_phonet.c:486:9: struct phonet_protocol const [noderef] __rcu * net/phonet/af_phonet.c:486:9: struct phonet_protocol const * Signed-off-by: Eric Dumazet Acked-by: Rémi Denis-Courmont Link: https://patch.msgid.link/20250811145252.1007242-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f8262b8dadfa635cc8f203c40eb0b75b8625f44c Author: Krzysztof Kozlowski Date: Mon Aug 11 16:22:36 2025 +0200 dt-bindings: nfc: ti,trf7970a: Drop 'db' suffix duplicating dtschema A common property unit suffix '-db' was added to dtschema, thus in-kernel bindings should not reference the type. Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Link: https://patch.msgid.link/20250811142235.170407-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 11b99886d1948503ccc3f24548b3dfb7ff0a5261 Author: Colin Ian King Date: Mon Aug 11 12:12:11 2025 +0100 net: stmmac: make variable data a u32 Make data a u32 instead of an unsigned long, this way it is explicitly the same width as the operations performed on it and the same width as a writel store, and it cleans up sign extention warnings when 64 bit static analysis is performed on the code. Signed-off-by: Colin Ian King Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250811111211.1646600-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit 63fe077c21d323cbc8d56114e9139bbadab33ce5 Author: Thorsten Blum Date: Mon Aug 11 11:34:40 2025 +0200 caif: Replace memset(0) + strscpy() with strscpy_pad() Replace memset(0) followed by strscpy() with strscpy_pad() to improve cfctrl_linkup_request(). This avoids zeroing the memory before copying the string and ensures the destination buffer is only written to once, simplifying the code and improving efficiency. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250811093442.5075-2-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit e0ab61faba808bbb00728b2e33e09e534732e80f Merge: bc4c0a48bdad7f 7792232a4ea1a8 Author: Jakub Kicinski Date: Tue Aug 12 14:05:46 2025 -0700 Merge branch 'net-remove-redundant-__gfp_nowarn' Qianfeng Rong says: ==================== net: remove redundant __GFP_NOWARN (part) Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. ==================== Link: https://patch.msgid.link/20250810072944.438574-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 7792232a4ea1a8b6fe34d0d99a1e02aac185e633 Author: Qianfeng Rong Date: Sun Aug 10 15:29:41 2025 +0800 RDS: remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250810072944.438574-3-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 526c2530cbf84428a0a2b5ca7800986c0912ac35 Author: Qianfeng Rong Date: Sun Aug 10 15:29:40 2025 +0800 tcp: cdg: remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250810072944.438574-2-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski commit 9e293d47bfb9e812196670f2deeefc8b9d0226e4 Merge: fa479132845e94 8f5ae30d69d754 Author: Martin KaFai Lau Date: Mon Aug 11 16:15:41 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Cross merge bpf/master after 6.17-rc1. No conflict. Signed-off-by: Martin KaFai Lau commit 8a013ec9cb7af9921656c0e78c73510c9e4a0cc1 Author: Thorsten Blum Date: Tue Aug 12 13:50:35 2025 +0200 cgroup: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Tejun Heo commit a49eebfa8ba1a90cbe01371f852b8da805d3aa55 Author: Akshaykumar Gunari Date: Thu Aug 7 20:21:19 2025 +0530 docs: arm: stm32: fix typo "busses" -> "buses" Fix the spelling of "busses" to the preferred form "buses" in STM32 ARM architecture documentation. Signed-off-by: Akshaykumar Gunari Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807145119.2214-1-akshaygunari@gmail.com commit 70d476b63a1494337f2b9fec1e9b1cab2e6116d3 Author: Gopi Krishna Menon Date: Sun Aug 10 16:42:48 2025 +0530 Documentation/rv: Fix minor typo in monitor_synthesis page Specifically, fix spelling of "practice" Signed-off-by: Gopi Krishna Menon Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250810111249.93181-1-krishnagopi487@gmail.com commit 0e6bb6888791656c3973f26da3288323524573c0 Author: Gopi Krishna Menon Date: Mon Aug 11 05:23:44 2025 +0530 docs: folio_queue: Fix minor typo in folio_queue page Specifically, fix typo 'hese'-> 'these' Signed-off-by: Gopi Krishna Menon Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250810235346.4153-1-krishnagopi487@gmail.com commit 6bed0a50235aaeae2c33f3cfee5ffa5d040be570 Author: Dongliang Mu Date: Tue Aug 12 13:07:10 2025 +0800 MAINTAINERS: add File entry for scripts/checktransupdate.py to DOCUMENTATION As suggested by Nathan, add a File entry for scripts/checktransupdate.py to the DOCUMENTATION section to maintain this script. Link: https://lore.kernel.org/all/20250811212446.GA924610@ax162/ Signed-off-by: Dongliang Mu Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250812050711.2515173-1-dzm91@hust.edu.cn commit 377c2b3c46c6ff33cb6559b98c44e22f1ff9fefc Author: Miguel Ojeda Date: Fri Jul 25 22:28:40 2025 +0200 MAINTAINERS: add "DEVICE I/O & IRQ [RUST]" entry This entry will handle device I/O patches and abstractions (such as memory-mapped IO and system resources series [1]), as well as IRQ ones (such as the `request_irq` series [2]). Patches will flow through driver-core, at least for the time being. Danilo, Alice and Daniel will maintain it. Cc: Danilo Krummrich Cc: Alice Ryhl Cc: Daniel Almeida Link: https://lore.kernel.org/rust-for-linux/20250717-topics-tyr-platform_iomem-v15-0-beca780b77e3@collabora.com/ [1] Link: https://lore.kernel.org/rust-for-linux/20250715-topics-tyr-request_irq2-v7-0-d469c0f37c07@collabora.com/ [2] Signed-off-by: Miguel Ojeda Acked-by: Daniel Almeida Acked-by: Alice Ryhl Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250725202840.2251768-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 29e16fcd67ee5b1d0417a657294cf96fdf2f8df9 Author: Alice Ryhl Date: Mon Aug 11 13:03:45 2025 -0300 rust: irq: add &Device argument to irq callbacks When working with a bus device, many operations are only possible while the device is still bound. The &Device type represents a proof in the type system that you are in a scope where the device is guaranteed to still be bound. Since we deregister irq callbacks when unbinding a device, if an irq callback is running, that implies that the device has not yet been unbound. To allow drivers to take advantage of that, add an additional argument to irq callbacks. Signed-off-by: Alice Ryhl Reviewed-by: Boqun Feng Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-7-0485dcd9bcbf@collabora.com Signed-off-by: Danilo Krummrich commit 9b6d4fb9804febb1ae75e7259bb475cea58e28a7 Author: Daniel Almeida Date: Mon Aug 11 13:03:44 2025 -0300 rust: pci: add irq accessors These accessors can be used to retrieve a irq::Registration or a irq::ThreadedRegistration from a pci device. Alternatively, drivers can retrieve an IrqRequest from a bound PCI device for later use. These accessors ensure that only valid IRQ lines can ever be registered. Reviewed-by: Alice Ryhl Tested-by: Joel Fernandes Tested-by: Dirk Behme Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-6-0485dcd9bcbf@collabora.com Signed-off-by: Danilo Krummrich commit 17e70f0c549f4a19da7d681d60b552901833f8f3 Author: Daniel Almeida Date: Mon Aug 11 13:03:43 2025 -0300 rust: platform: add irq accessors These accessors can be used to retrieve a irq::Registration and irq::ThreadedRegistration from a platform device by index or name. Alternatively, drivers can retrieve an IrqRequest from a bound platform device for later use. These accessors ensure that only valid IRQ lines can ever be registered. Reviewed-by: Alice Ryhl Tested-by: Joel Fernandes Tested-by: Dirk Behme Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-5-0485dcd9bcbf@collabora.com [ Remove expect(dead_code) from IrqRequest::new(), re-format macros and macro invocations to not exceed 100 characters line length. - Danilo ] Signed-off-by: Danilo Krummrich commit 577a49cf285da98b885318b82b328074e38bee73 Merge: 2115dc3e3376b7 47459937be8031 Author: Jonathan Corbet Date: Tue Aug 12 12:23:57 2025 -0600 Merge tag 'docs/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-docs into mauro Mauro says: As discussed at: https://lore.kernel.org/all/20250610101331.62ba466f@foz.lan/ changeset f061c9f7d058 ("Documentation: Document each netlink family") added a logic which generates *.rst files inside $(srctree). This is bad when O= is used. A recent change renamed the yaml files used by Netlink, revealing a bad side effect: as "make cleandocs" don't clean the produced files and symbols appear duplicated for people that don't build the kernel from scratch. This series adds an yaml parser extension and uses an index file with glob for *. We opted to write such extension in a way that no actual yaml conversion code is inside it. This makes it flexible enough to handle other types of yaml files in the future. The actual yaml conversion logic were placed at netlink_yml_parser.py. As requested by YNL maintainers, this version has netlink_yml_parser.py inside tools/net/ynl/pyynl/ directory. I don't like mixing libraries with binaries, nor to have Python libraries spread all over the Kernel. IMO, the best is to put all of them on a common place (scripts/lib, python/lib, lib/python, ...) but, as this can be solved later, for now let's keep it this way. commit a985ecc2bec87dba544f8487b84d6523dcbb321b Author: Jani Nikula Date: Tue Jul 29 14:17:09 2025 +0300 drm/i915/connector: make intel_connector_init() static intel_connector_init() is only used in intel_connector.c. Make it static. Reviewed-by: Dibin Moolakadan Subrahmanian Link: https://lore.kernel.org/r/46443c16f9cbff039cd3c830871289ab17110905.1753787803.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b4892169025f6753e4e1a72a94ab43fbc7dd4e47 Author: Jani Nikula Date: Tue Jul 29 14:17:08 2025 +0300 drm/i915/display: add intel_dig_port_alloc() Add a common allocator function for struct intel_digital_port, with some member default initialization to deduplicate them from everywhere else. This is similar to intel_connector_alloc(). At least for now, place this in intel_encoder.[ch]. We don't have a dedicated file for dig port stuff, and there wouldn't be much to add there anyway. A digital port is a sort of subclass of encoder, so the location isn't far off the mark. Reviewed-by: Dibin Moolakadan Subrahmanian Link: https://lore.kernel.org/r/4d2da1a40698f85014140f586405b19795437e81.1753787803.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f101c13a8720c73e67f8f9d511fbbeda95bcedb1 Author: Liu01 Tong Date: Mon Aug 11 14:52:37 2025 +0800 drm/amdgpu: fix task hang from failed job submission during process kill During process kill, drm_sched_entity_flush() will kill the vm entities. The following job submissions of this process will fail, and the resources of these jobs have not been released, nor have the fences been signalled, causing tasks to hang and timeout. Fix by check entity status in amdgpu_vm_ready() and avoid submit jobs to stopped entity. v2: add amdgpu_vm_ready() check before amdgpu_vm_clear_freed() in function amdgpu_cs_vm_handling(). Signed-off-by: Liu01 Tong Signed-off-by: Lin.Cao Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 135d40523244dcad3c64eb2ce131cf018db5cff4 Author: Daniel Almeida Date: Mon Aug 11 13:03:42 2025 -0300 rust: irq: add support for threaded IRQs and handlers This patch adds support for threaded IRQs and handlers through irq::ThreadedRegistration and the irq::ThreadedHandler trait. Threaded interrupts are more permissive in the sense that further processing is possible in a kthread. This means that said execution takes place outside of interrupt context, which is rather restrictive in many ways. Registering a threaded irq is dependent upon having an IrqRequest that was previously allocated by a given device. This will be introduced in subsequent patches. Tested-by: Joel Fernandes Tested-by: Dirk Behme Reviewed-by: Alice Ryhl Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-4-0485dcd9bcbf@collabora.com [ Add now available intra-doc links back in. - Danilo ] Signed-off-by: Danilo Krummrich commit 0851d34a8cc3a0a43acd79a5c4980d45c6471aab Author: Daniel Almeida Date: Mon Aug 11 13:03:41 2025 -0300 rust: irq: add support for non-threaded IRQs and handlers This patch adds support for non-threaded IRQs and handlers through irq::Registration and the irq::Handler trait. Registering an irq is dependent upon having a IrqRequest that was previously allocated by a given device. This will be introduced in subsequent patches. Tested-by: Joel Fernandes Tested-by: Dirk Behme Reviewed-by: Alice Ryhl Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-3-0485dcd9bcbf@collabora.com [ Remove expect(dead_code) from Flags::into_inner(), add expect(dead_code) to IrqRequest::new(), fix intra-doc links. - Danilo ] Signed-off-by: Danilo Krummrich commit b08425fa77ad2f305fe57a33dceb456be03b653f Author: Jack Xiao Date: Mon Aug 11 15:20:55 2025 +0800 drm/amdgpu: fix incorrect vm flags to map bo It should use vm flags instead of pte flags to specify bo vm attributes. Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file") Signed-off-by: Jack Xiao Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit d38eaf27de1b8584f42d6fb3f717b7ec44b3a7a1 Author: YiPeng Chai Date: Tue Aug 12 09:17:58 2025 +0800 drm/amdgpu: fix vram reservation issue The vram block allocation flag must be cleared before making vram reservation, otherwise reserving addresses within the currently freed memory range will always fail. Fixes: c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu") Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 57af162bfc8c05332a28c4d458d246cc46d2746d Author: Geoffrey McRae Date: Tue Jul 8 13:53:40 2025 +1000 drm/amdkfd: return -ENOTTY for unsupported IOCTLs Some kfd ioctls may not be available depending on the kernel version the user is running, as such we need to report -ENOTTY so userland can determine the cause of the ioctl failure. Signed-off-by: Geoffrey McRae Acked-by: Alex Deucher Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 065e23170a1e09bc9104b761183e59562a029619 Author: Frank Min Date: Tue Aug 5 22:30:54 2025 +0800 drm/amdgpu: Add PSP fw version check for fw reserve GFX command The fw reserved GFX command is only supported starting from PSP fw version 0x3a0e14 and 0x3b0e0d. Older versions do not support this command. Add a version guard to ensure the command is only used when the running PSP fw meets the minimum version requirement. This ensures backward compatibility and safe operation across fw revisions. Fixes: a3b7f9c306e1 ("drm/amdgpu: reclaim psp fw reservation memory region") Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d543489aa1f141901a078dd84daaa16fcab0cf7f Author: Lijo Lazar Date: Thu Jul 17 16:35:29 2025 +0530 drm/amdgpu: Add description for partition commands Add string description for partition commands. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 746680ec6696585e30db3e18c93a63df9cbec39c Author: Daniel Almeida Date: Mon Aug 11 13:03:40 2025 -0300 rust: irq: add flags module Manipulating IRQ flags (i.e.: IRQF_*) will soon be necessary, specially to register IRQ handlers through bindings::request_irq(). Add a kernel::irq::Flags for that purpose. Reviewed-by: Alice Ryhl Tested-by: Joel Fernandes Tested-by: Dirk Behme Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-2-0485dcd9bcbf@collabora.com [ Use expect(dead_code) for into_inner(), fix broken intra-doc link and typo. - Danilo ] Signed-off-by: Danilo Krummrich commit 1f54d5e5cd2a03cb6dd8326db576f8763f9b6785 Author: Daniel Almeida Date: Mon Aug 11 13:03:39 2025 -0300 rust: irq: add irq module Add the IRQ module. Future patches will then introduce support for IRQ registrations and handlers. Reviewed-by: Alice Ryhl Tested-by: Joel Fernandes Tested-by: Dirk Behme Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250811-topics-tyr-request_irq2-v9-1-0485dcd9bcbf@collabora.com Signed-off-by: Danilo Krummrich commit f20e70a341dd67ac4aca23f93b6acdca6779e69d Author: Qianfeng Rong Date: Thu Aug 7 22:05:45 2025 +0800 selinux: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Acked-by: Stephen Smalley [PM: fixed horizontal spacing / alignment, line wraps] Signed-off-by: Paul Moore commit 77abf70ee126d40dba9ada0a4ccb4c7743f6a3e6 Author: Sricharan Ramabadhran Date: Mon Aug 11 14:39:54 2025 +0530 arm64: dts: qcom: ipq5424: Enable cpufreq Add the qfprom, cpu clocks, A53 PLL and cpu-opp-table required for CPU clock scaling. Signed-off-by: Sricharan Ramabadhran [ Added interconnect related entries, fix dt-bindings errors ] Reviewed-by: Konrad Dybcio Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20250811090954.2854440-5-quic_varada@quicinc.com Signed-off-by: Bjorn Andersson commit e320c42bf6ac5576316e04e8c82365eafc2c546c Merge: a8a5ea012471dd c17ccefb611fdb Author: Bjorn Andersson Date: Tue Aug 12 12:01:13 2025 -0500 Merge branch '20250811090954.2854440-2-quic_varada@quicinc.com' into HEAD Merge the IPQ5424 application subsystem clock binding, in order to get access to the necessary clock constants for CPUfreq. commit 8b63fee9f62361a7d96394611ba05734ec21e2eb Author: Shuming Fan Date: Fri Jul 25 18:11:00 2025 +0800 soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers This patch added SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20250725101100.1106673-1-shumingf@realtek.com Signed-off-by: Vinod Koul commit 6f4f4ca5caf73de5e86329547d4527b3e0c08488 Author: Alexander Aring Date: Wed Jul 23 11:21:56 2025 -0400 dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release When dlm_lockspace_release() is passed DLM_RELEASE_RECOVER, it tells the dlm to handle the release/leave as if the node had failed, i.e. perform recovery steps for a failed node, like recover_slot(). When DLM_RELEASE_RECOVER is set: - dlm_release_lockspace() includes RELEASE_RECOVER=1 in the OFFLINE uevent sent to userspace. - userspace/dlm_controld sends a message to all lockspace members indicating that the subsequent node removal should be handled as if the node had failed. - when dlm_controld on all nodes receives the new message, it sets the release_recover configfs entry to 1 for the node. - when the dlm/kernel next performs recovery and removes the node, it will see that release_recover has been set, and will perform recovery steps for the node as if it had failed, e.g. the recover_slot() callback is called to notify the fs. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit de7b4869b4ecf5790b0e7875c5522d43d7a61d79 Author: Alexander Aring Date: Wed Jul 23 11:21:55 2025 -0400 dlm: add new configfs entry release_recover for lockspace members A new configfs entry is added for a lockspace member: /config/dlm//spaces//nodes//release_recover release_recover can be set to 1 by userspace (dlm_controld process) prior to removing the lockspace member (rmdir of the ). This tells the kernel to handle the removed member as if it had failed, i.e. recovery steps for a failed node should be perfomed, as opposed to the recovery steps for a node doing a controlled leave. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 5665374c7246159dbca1a80a0b54ad27e3379bcb Author: Alexander Aring Date: Wed Jul 23 11:21:54 2025 -0400 dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace RELEASE_RECOVER=0|1 is passed to user space as part of the OFFLINE uevent for leaving a lockspace, and used by subsequent patches. RELEASE_RECOVER=1 tells user space that the release_lockspace/leave should be handled by the remaining lockspace members as if the leaving node had failed. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit bea90085dcb0f9a75748e73d723bde557a5ebf1a Author: Alexander Aring Date: Wed Jul 23 11:21:53 2025 -0400 dlm: use defines for force values in dlm_release_lockspace Clarify the use of the force parameter by renaming it to "release_option" and adding defines (with descriptions) for each of the accepted values. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit a8a5ea012471dd19ea9cb4d668c27ac678e84a3e Author: Stephan Gerhold Date: Wed Jul 9 12:08:58 2025 +0200 arm64: dts: qcom: x1e80100: Add videocc Add the video clock controller for X1E80100, similar to sm8550.dtsi. It provides the needed clocks/power domains for the iris video codec. Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-6-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit 6af515c9f3ccec3eb8a262ca86bef2c499d07951 Author: Alexander Aring Date: Wed Jul 23 11:21:52 2025 -0400 dlm: check for defined force value in dlm_lockspace_release Force values over 3 are undefined, so don't treat them as 3. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 4e4afd6bb9657d7cf23f6becf23706882b9822c0 Author: Taniya Das Date: Wed Jul 2 14:34:30 2025 +0530 arm64: defconfig: Enable QCS615 clock controllers Enable the QCS615 display, video, camera and graphics clock controller for their respective functionalities on the Qualcomm QCS615 ride platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-10-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit d6111177f6504b013d0424657e131ae9a36ab5e2 Author: Mrinmay Sarkar Date: Tue Jun 17 17:08:20 2025 +0530 arm64: dts: qcom: sa8775p: Remove max link speed property for PCIe EP The maximum link speed was previously restricted to Gen3 due to the absence of Gen4 equalization support in the driver. As Gen4 equalization is already supported by the PCIe controller driver, remove the max-link-speed property. Signed-off-by: Mrinmay Sarkar Link: https://lore.kernel.org/r/20250617-update_phy-v5-2-2df83ed6a373@quicinc.com Signed-off-by: Bjorn Andersson commit 46952305d2b64e9a2498c53046a832b51c93e5a8 Author: Eric Gonçalves Date: Sun Jun 15 20:44:38 2025 +0000 arm64: dts: qcom: sm8450: add initial device tree for Samsung Galaxy S22 Adds new device support for the Samsung Galaxy S22 (SM-S901E) phone Working features: - simple-framebuffer - side buttons - storage - usb Signed-off-by: Eric Gonçalves Link: https://lore.kernel.org/r/20250615204438.1130213-2-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit ebfe5797ac3e6e9fb56340b6b228d2747fdec912 Author: Eric Gonçalves Date: Sun Jun 15 20:44:37 2025 +0000 dt-bindings: arm: qcom: document r0q board binding Adds compatible for the Samsung Galaxy S22 (SM-S901E) (r0q), based on the Snapdragon 8 Gen 1 SoC. Signed-off-by: Eric Gonçalves Link: https://lore.kernel.org/r/20250615204438.1130213-1-ghatto404@gmail.com Signed-off-by: Bjorn Andersson commit 4ea55ecb4990aa4142ddae5f713289f4101f046f Author: Luca Weiss Date: Wed Jun 11 18:33:18 2025 +0200 arm64: dts: qcom: sdm632-fairphone-fp3: Enable display and GPU Add the description for the display panel found on this phone. Unfortunately the LCDB module on PMI632 isn't yet supported upstream so we need to use a dummy regulator-fixed in the meantime. And with this done we can also enable the GPU and set the zap shader firmware path. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250611-fp3-display-v4-4-ef67701e7687@lucaweiss.eu Signed-off-by: Bjorn Andersson commit d56ddcee0101a4b948be0d388e91f5f38f14d448 Author: Kathiravan Thirumoorthy Date: Tue Aug 12 16:02:41 2025 +0530 arm64: dts: qcom: ipq5424: Describe the 4-wire UART SE QUPv3 in IPQ5424 consists of six Serial Engines (SEs). Describe the first SE, which supports a 4-wire UART configuration suitable for applications such as HS-UART. Note that the required initialization for this SE is not handled by the bootloader. Therefore, add the SE node in the device tree but keep it reserved. Enable it once Linux gains support for configuring the SE, allowing to use in relevant RDPs. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250812-ipq5424_hsuart-v4-1-f1faa7704ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d06f389c8519cc4438e38627ae3d63aa573fa49a Merge: 54401b5d9fb7da 2d86d2585ab929 Author: Mark Brown Date: Tue Aug 12 16:30:20 2025 +0100 gpiolib: fence off legacy interfaces Merge series from Arnd Bergmann : Commit 678bae2eaa81 ("gpiolib: make legacy interfaces optional") was merged for linux-6.17, so now it is possible to use the legacy interfaces conditionally and eventually have the support left out of the kernel whenever it is not needed. I created six patches to force-enable CONFIG_GPIOLIB_LEGACY on the few (mostly ancient) platforms that still require this, plus a set of patches to either add the corresponding Kconfig dependencies that make the device drivers conditional on that symbol, or change them to no longer require it. The final patch ends up turning the Kconfig symbol off by default, which of course depends on everything else getting merged first to avoid build errors. I would suggest that patches 1-20 can just get merged through the respective maintainer trees independently when they are deemed ready, and the final patch can wait another merge window. commit 54401b5d9fb7da010b91ee47d3d8eb70b685d182 Merge: e896f262b3bd72 2291a2186305fa Author: Mark Brown Date: Tue Aug 12 16:30:15 2025 +0100 ASoC: codecs: Add support for FourSemi FS2104/5S Merge series from Nick Li : The FS2104/5S are Inductor-Less, Stereo, Closed-Loop, Digital Input Class-D Power Amplifiers with Enhanced Signal Processing. FS2104 can deliver 2x15W into 4ohm BTL speaker loads, FS2105S can deliver 2x30W into 8ohm BTL speaker loads. Most functions have been built and tested on EVB boards: ARMv8-A, Linux version 6.16.0-rc6-v8 commit e896f262b3bd721b35263e4ee8f876f35a569369 Merge: 3a9c44f9532f22 595b7f155b9264 Author: Mark Brown Date: Tue Aug 12 16:30:11 2025 +0100 ASoC: Intel: avs: Conditional path support Merge series from Cezary Rojewski : The code presented here is a lighter version of what was initially discussed in 2021 [1]. Later, we've had a more general discussion [2] "what if the feature was part of the ASoC core instead?". The discussion turned towards leaving a simplified version within the avs/, so here is the final outcome. What's removed when compared to the older [1] version? - conditional path priorities - conditional path overriding The background: Conditional path (condpath) helps facilitate modern audio usecases such as Echo Cancellations and Noise Reduction. These are not invoked by the means of userspace application opening an endpoint (FrontEnd) but are a "side effect" of selected PCMs running simultaneously e.g.: if both Speaker (source) and Microphone Array (sink) are running, reference data from the Speaker and take it into account when processing capture for better voice command detection ratio. Which PCMs are needed for given conditional path to be spawned is determinated by the driver when registering the condpath. Two patches implement the feature: 1) update the topology parser to acknowledge the new tuples 2) update the path-creation and functions that participate in the PCM-runtime e.g.: run/pause. The runtime update is needed to keep streaming sane - all the path operations shall be synchronized when a condpath is being spawned or its status is about to change. [1]: https://lore.kernel.org/alsa-devel/20211208111301.1817725-21-cezary.rojewski@intel.com/ [2]: https://lore.kernel.org/linux-sound/20240821101816.1494541-1-cezary.rojewski@intel.com/ commit 3a9c44f9532f2297a3a795165ce8ee9d0b2762c0 Merge: 8c02c8353460f8 cf25eb8eae91bc Author: Mark Brown Date: Tue Aug 12 16:30:05 2025 +0100 ASoC: unpack snd_soc_component_xxx_bias_level() Merge series from Kuninori Morimoto : Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. This is prepare patch for it. commit 393d69df0fda903dc41e071fef76baf485510672 Author: Pushpendra Singh Date: Wed Jul 2 05:31:20 2025 +0530 arm64: dts: qcom: sc7280: Add support for two additional DDR frequencies The SC7280 SoC now supports two additional frequencies. This patch add those frequencies to the BWMON OPP table and updates the frequency mapping table accordingly. These changes do not impact existing platforms, as the updated mapping only affects the highest OPP. On any given platform, this will continue to vote for the maximum available OPP. Signed-off-by: Pushpendra Singh Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250702000120.2902158-1-quic_pussin@quicinc.com Signed-off-by: Bjorn Andersson commit 9cdb77e3103a449ee54f397d29321a5d4157bcb7 Author: Bjorn Andersson Date: Mon Aug 11 22:11:35 2025 -0500 arm64: dts: qcom: sc7280: Add MDSS_CORE reset to mdss Like on other platforms, if the OS does not support recovering the state left by the bootloader it needs access to MDSS_CORE, so that it can clear the MDSS configuration. Until now it seems no version of the bootloaders have done so, but e.g. the Particle Tachyon ships with a bootloader that does leave the display in a state that results in a series of iommu faults. So let's provide the reset, to allow the OS to clear that state. Signed-off-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250811-sc7280-mdss-reset-v1-3-83ceff1d48de@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c46d34c0441e8033b3b3eebd86d20dd15d683020 Merge: f8328b7549e1fa 039a504cda2cb6 Author: Bjorn Andersson Date: Tue Aug 12 10:05:32 2025 -0500 Merge branch '20250811-sc7280-mdss-reset-v1-1-83ceff1d48de@oss.qualcomm.com' into arm64-for-6.18 Merge the addition of reset constants to the SC7280 display clock controller binding, so we can use it in the MDSS node. commit 5a5f478ed7c7394dadb65a96f409e0749caefed5 Author: Bjorn Andersson Date: Mon Aug 11 22:11:34 2025 -0500 clk: qcom: dispcc-sc7280: Add dispcc resets Like many other platforms the sc7280 display clock controller provides a couple of resets for the display subsystem. In particular the MDSS_CORE_BCR is useful to reset the display subsystem to a known state during boot, so add these. Signed-off-by: Bjorn Andersson Reviewed-by: Taniya Das Link: https://lore.kernel.org/r/20250811-sc7280-mdss-reset-v1-2-83ceff1d48de@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ccdba33f5c32bca06f5186eedeb15944f84db996 Merge: be477c3924f808 039a504cda2cb6 Author: Bjorn Andersson Date: Tue Aug 12 09:58:37 2025 -0500 Merge branch '20250811-sc7280-mdss-reset-v1-1-83ceff1d48de@oss.qualcomm.com' into clk-for-6.18 Merge the addition of reset constants to the SC7280 display clock controller binding through a topic branch to allow it to be included in the DeviceTree branch as well. commit 039a504cda2cb69354387aa453391ec89a9e0e49 Author: Bjorn Andersson Date: Mon Aug 11 22:11:33 2025 -0500 dt-bindings: clock: dispcc-sc7280: Add display resets Like other platforms the sc7280 display clock controller provides a couple of resets, add the defines to allow referring to them. Signed-off-by: Bjorn Andersson Reviewed-by: Taniya Das Link: https://lore.kernel.org/r/20250811-sc7280-mdss-reset-v1-1-83ceff1d48de@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f8328b7549e1faff45e32ab2ecc2573b90604e76 Author: Bjorn Andersson Date: Mon Aug 11 22:16:29 2025 -0500 arm64: dts: qcom: sc7280: Describe the first PCIe controller and PHY Only one PCIe controller has been described so far, but the SC7280 has two controllers/phys. Describe the second one as well. Signed-off-by: Bjorn Andersson Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250811-sc7280-pcie0-v1-1-6093e5b208f9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 274f3264edad37a3b87f454c376decd89a0d5cb4 Merge: b832b19318534b 6b7e2aa50bdaf8 Author: Mark Brown Date: Tue Aug 12 14:31:37 2025 +0100 spi: spi-qpic-snand: cleanup 'qpic_ecc' structure Merge series from Gabor Juhos : The series consist of two small patches to clean up the qpic_ecc structure in the spi-qpic-snand driver. The first one removes an unused member from the structure, whereas the second reduces code duplication and removes another two members from the same. commit 32a4d1b98e6663101fd0abfaf151c48feea7abb1 Author: Michał Winiarski Date: Tue May 27 14:06:37 2025 +0200 drm/xe/pf: Set VF LMEM BAR size LMEM is partitioned between multiple VFs and we expect that the more VFs we have, the less LMEM is assigned to each VF. This means that we can achieve full LMEM BAR access without the need to attempt full VF LMEM BAR resize via pci_resize_resource(). Always try to set the largest possible BAR size that allows to fit the number of enabled VFs and inform the user in case the resize attempt is not successful. Signed-off-by: Michał Winiarski Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250527120637.665506-7-michal.winiarski@intel.com Signed-off-by: Lucas De Marchi commit ca994e8922f25f7fed2075098f185cf198109eaa Merge: 30e0c3f43a4146 8f5ae30d69d754 Author: Lucas De Marchi Date: Tue Aug 12 05:58:37 2025 -0700 Merge drm/drm-next into drm-xe-next Bring v6.17-rc1 to propagate commits from other subsystems, particularly PCI, which has some new functions needed for SR-IOV integration. Signed-off-by: Lucas De Marchi commit b31e3bd7447a6e826c27bd2b1eeb26b8af73551c Author: Liu Song Date: Thu Jul 24 10:38:16 2025 +0800 HID: uclogic: Use str_true_false() helper Remove hard-coded strings by using the str_true_false() helper function. Signed-off-by: Liu Song Signed-off-by: Jiri Kosina commit 1860b13beca829c056179c63530eebfec9a3efb4 Author: Liu Song Date: Thu Jul 24 10:36:26 2025 +0800 HID: Intel-thc-hid: Intel-thc: Use str_true_false() helper Remove hard-coded strings by using the str_true_false() helper function. Signed-off-by: Liu Song Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit a84eeacbf9325fd7f604b80f246aaba157730cd5 Author: Jeongjun Park Date: Thu Jul 17 20:26:43 2025 +0900 HID: steelseries: refactor probe() and remove() steelseries_srws1_probe() still does not use devm_kzalloc() and devm_led_classdev_register(), so there is a lot of code to safely manage heap, which reduces readability and may cause memory leaks due to minor patch mistakes in the future. Therefore, it should be changed to use devm_kzalloc() and devm_led_classdev_register() to easily and safely manage heap. Also, the current steelseries driver mainly checks sd->quriks to determine which product a specific HID device is, which is not the correct way. remove(), unlike probe(), does not receive struct hid_device_id as an argument, so it must check hdev unconditionally to know which product it is. However, since struct steelseries_device and struct steelseries_srws1_data have different structures, if SRWS1 is removed in remove(), converts hdev->dev, which is initialized to struct steelseries_srws1_data, to struct steelseries_device and uses it. This causes various memory-related bugs as completely unexpected values exist in member variables of the structure. Therefore, in order to modify probe() and remove() to work properly, Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be modified to check hdev->product when determining HID device product. Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox") Signed-off-by: Jeongjun Park Signed-off-by: Jiri Kosina commit eb9bb4c5b521853d29b79197f412c5c533a6483c Merge: eccd3d9753d48c 9a200cbdb54349 Author: Mark Brown Date: Tue Aug 12 12:06:23 2025 +0100 rust: regulator: relax a few constraints on Merge series from Daniel Almeida : This series implement two related changes to address a bit of an oversight on my end on the initial patch for the Regulator abstraction. Note that this is not a fix, as it just relaxes the constraints on the previous code as it is safe to do so. Patch 1 removes some needless &mut self for functions that already provide their own locking on the C side. Patch 2 implements Send and Sync. In particular, there is no reason for Regulator not to be Send, and as discussed above, it is naturally Sync. commit eccd3d9753d48cc3e873eeda5b0e271454aa08ac Merge: a54ef14188519a 162e23657e5379 Author: Mark Brown Date: Tue Aug 12 12:06:18 2025 +0100 regulator: add new PMIC PF0900 support Merge series from Joy Zou : Add binding document and driver. Signed-off-by: Joy Zou --- Changes in v3: binding part - change regulator node names into lowercase. - add more description for nxp,i2c-crc-enable. - remove the unnecessary nxp,dvs-run/standby-voltage property. These changes come from review comments: https://lore.kernel.org/imx/e9f38e38-7df7-4d19-b5c0-2f18aeebcc78@kernel.org/ - add regulator-state-mem property for example. driver part - convert to use maple tree register cache. - change of_match_ptr() name to lowercase since dt-binding changed. - add more nxp,i2c-crc-enable description for commit message. - remove the of_parse_cb and dvs from pf0900_regulators since the unnecessary property nxp,dvs-run/standby-voltage removed. - add set_suspend_enable/disable/voltage for the SW regulator_ops. the run/standby voltage can be adjusted via the API which regulator driver provides is recommended. These changes come from binding review comments: https://lore.kernel.org/imx/e9f38e38-7df7-4d19-b5c0-2f18aeebcc78@kernel.org/ - add bitfield.h header due to build issue. - correct the sw4 id. - add PF0900 prefix for short macro define in order to avoid duplication. - merge the same mask define in order to simplify code. - Link to v2: https://lore.kernel.org/r/20250721-b4-pf09-v2-v2-0-e2c568548032@nxp.com Changes in v2: binding part - modify the binding file name to match compatible string. - add one space for dt_binding_check warning. - remove unnecessary quotes from "VAON". - remove the unnecessary empty line. - move unevaluatedProperties after the $ref. - move additionalProperties after regulator type. - remove unnecessary regulator description driver part - modify the copyright comment block to C++ style. - add reg_read/write for regmap_bus. - remove original pf0900_pmic_read/write. - remove many regulator operations. - use regmap_read replace pf0900_pmic_read. - use regmap_update_bits and regmap_write_bits replace pf0900_pmic_write. - move the code from pf0900.h to pf0900-regulator.c and delete the header file. - remove unmask status interrupts and add unmask regulator interrupts. - remove many interrupts check warning print from irq_handler. - add notifier for regulator event. - remove unused macro define. - add PF0900 prefix for IRQ macro define in order to avoid duplication. - use GENMASK() and BIT() to replace mask marco define - remove redundant enum pf0900_chip_type. - remove redundant print info and comments. - add dvs property present check because this property is optional. - remove ret == -EINVAL check from sw_set_dvs() function. - Link to v1: https://lore.kernel.org/imx/20250617102025.3455544-1-joy.zou@nxp.com/ --- Joy Zou (2): dt-bindings: regulator: add PF0900 regulator yaml regulator: pf0900: Add PMIC PF0900 support .../devicetree/bindings/regulator/nxp,pf0900.yaml | 163 ++++ drivers/regulator/Kconfig | 8 + drivers/regulator/Makefile | 1 + drivers/regulator/pf0900-regulator.c | 975 +++++++++++++++++++++ 4 files changed, 1147 insertions(+) --- base-commit: 84b92a499e7eca54ba1df6f6c6e01766025943f1 change-id: 20250714-b4-pf09-v2-91cdee6d1272 Best regards, -- Joy Zou commit b832b19318534bb4f1673b24d78037fee339c679 Author: Thomas Weißschuh Date: Mon Aug 11 14:10:21 2025 +0200 spi: loopback-test: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de Signed-off-by: Mark Brown commit 528a813a5d98702cc6fd51983484cf7eec9ebcac Author: Liao Yuanhong Date: Tue Aug 12 11:38:17 2025 +0800 spi: mtk-snfi: Remove redundant semicolons Remove unnecessary semicolons. Fixes: 764f1b7481645 ("spi: add driver for MTK SPI NAND Flash Interface") Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250812033817.487565-3-liaoyuanhong@vivo.com Signed-off-by: Mark Brown commit 0ecc0e17f05bbb953b6ea3812e78bab224f08595 Author: Liao Yuanhong Date: Tue Aug 12 11:38:16 2025 +0800 spi: bcm2835: Remove redundant semicolons Remove unnecessary semicolons after comments. Fixes: 3ecd37edaa2a6 ("spi: bcm2835: enable dma modes for transfers meeting certain conditions") Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250812033817.487565-2-liaoyuanhong@vivo.com Signed-off-by: Mark Brown commit 8c02c8353460f8630313aef6810f34e134a3c1ee Author: Mahdi Khosravi Date: Mon Aug 11 11:09:40 2025 +0300 ASoC: dt-bindings: realtek,alc5623: convert to DT schema Convert alc5623 audio codec binding to DT schema. Also add "realtek,alc5621" to the compatible list for existing use in kirkwood-t5325.dts. Signed-off-by: Mahdi Khosravi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250811080940.7909-1-mmk1776@gmail.com Signed-off-by: Mark Brown commit bdf0f2c84332f1e1b9dc3b267061e263bfaff097 Author: Xichao Zhao Date: Mon Aug 11 15:04:18 2025 +0800 ASoC: fix "dependant"->"dependent" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250811070418.352104-1-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 30e0c3f43a414616e0b6ca76cf7f7b2cd387e1d4 Author: Piotr Piórkowski Date: Mon Aug 11 12:43:58 2025 +0200 drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create Currently, ASID assignment for user VMs and page-table BO accounting for client memory tracking are performed in xe_vm_create_ioctl. To consolidate VM object initialization, move this logic to xe_vm_create. v2: - removed unnecessary duplicate BO tracking code - using the local variable xef to verify whether the VM is being created by userspace Suggested-by: Matthew Auld Signed-off-by: Piotr Piórkowski Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250811104358.2064150-3-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 9337166fa1d80f7bb7c7d3a8f901f21c348c0f2a Author: Piotr Piórkowski Date: Mon Aug 11 12:43:57 2025 +0200 drm/xe: Assign ioctl xe file handler to vm in xe_vm_create In several code paths, such as xe_pt_create(), the vm->xef field is used to determine whether a VM originates from userspace or the kernel. Previously, this handler was only assigned in xe_vm_create_ioctl(), after the VM was created by xe_vm_create(). However, xe_vm_create() triggers page table creation, and that function assumes vm->xef should be already set. This could lead to incorrect origin detection. To fix this problem and ensure consistency in the initialization of the VM object, let's move the assignment of this handler to xe_vm_create. v2: - take reference to the xe file object only when xef is not NULL - release the reference to the xe file object on the error path (Matthew) Fixes: 7f387e6012b6 ("drm/xe: add XE_BO_FLAG_PINNED_LATE_RESTORE") Signed-off-by: Piotr Piórkowski Cc: Matthew Auld Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250811104358.2064150-2-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 78a474b5a31a25e0a77e50df42be925f7cb575e6 Author: Krzysztof Kozlowski Date: Mon Aug 11 15:54:04 2025 +0200 dt-bindings: phy: fsl,imx8mq-usb: Drop 'db' suffix duplicating dtschema A common property unit suffix '-db' was added to dtschema, thus in-kernel bindings should not reference the type. Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250811-dt-bindings-db-v1-2-457301523bb5@linaro.org Signed-off-by: Vinod Koul commit 6cb52cba474b2bec1a3018d3dbf75292059a29a1 Author: Imre Deak Date: Mon Aug 11 11:01:52 2025 +0300 drm/i915/icl+/tc: Convert AUX powered WARN to a debug message The BIOS can leave the AUX power well enabled on an output, even if this isn't required (on platforms where the AUX power is only needed for an AUX access). This was observed at least on PTL. To avoid the WARN which would be triggered by this during the HW readout, convert the WARN to a debug message. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-6-imre.deak@intel.com commit afc4e84388079f4d5ba05271632b7a4d8d85165c Author: Imre Deak Date: Mon Aug 11 11:01:51 2025 +0300 drm/i915/lnl+/tc: Use the cached max lane count value Use the cached max lane count value on LNL+, to account for scenarios where this value is queried after the HW cleared the corresponding pin assignment value in the TCSS_DDI_STATUS register after the sink got disconnected. For consistency, follow-up changes will use the cached max lane count value on other platforms as well and will also cache the pin assignment value in a similar way. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-5-imre.deak@intel.com commit 33cf70bc0fe760224f892bc1854a33665f27d482 Author: Imre Deak Date: Mon Aug 11 11:01:50 2025 +0300 drm/i915/lnl+/tc: Fix max lane count HW readout On LNL+ for a disconnected sink the pin assignment value gets cleared by the HW/FW as soon as the sink gets disconnected, even if the PHY ownership got acquired already by the BIOS/driver (and hence the PHY itself is still connected and used by the display). During HW readout this can result in detecting the PHY's max lane count as 0 - matching the above cleared aka NONE pin assignment HW state. For a connected PHY the driver in general (outside of intel_tc.c) expects the max lane count value to be valid for the video mode enabled on the corresponding output (1, 2 or 4). Ensure this by setting the max lane count to 4 in this case. Note, that it doesn't matter if this lane count happened to be more than the max lane count with which the PHY got connected and enabled, since the only thing the driver can do with such an output - where the DP-alt sink is disconnected - is to disable the output. v2: Rebased on change reading out the pin configuration only if the PHY is connected. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-4-imre.deak@intel.com commit 3e32438fc406761f81b1928d210b3d2a5e7501a0 Author: Imre Deak Date: Mon Aug 11 11:01:49 2025 +0300 drm/i915/icl+/tc: Cache the max lane count value The PHY's pin assignment value in the TCSS_DDI_STATUS register - as set by the HW/FW based on the connected DP-alt sink's TypeC/PD pin assignment negotiation - gets cleared by the HW/FW on LNL+ as soon as the sink gets disconnected, even if the PHY ownership got acquired already by the driver (and hence the PHY itself is still connected and used by the display). This is similar to how the PHY Ready flag gets cleared on LNL+ in the same register. To be able to query the max lane count value on LNL+ - which is based on the above pin assignment - at all times even after the sink gets disconnected, the max lane count must be determined and cached during the PHY's HW readout and connect sequences. Do that here, leaving the actual use of the cached value to a follow-up change. v2: Don't read out the pin configuration if the PHY is disconnected. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-3-imre.deak@intel.com commit 89f4b196ee4b056e0e8c179b247b29d4a71a4e7e Author: Imre Deak Date: Mon Aug 11 11:01:48 2025 +0300 drm/i915/lnl+/tc: Fix handling of an enabled/disconnected dp-alt sink The TypeC PHY HW readout during driver loading and system resume determines which TypeC mode the PHY is in (legacy/DP-alt/TBT-alt) and whether the PHY is connected, based on the PHY's Owned and Ready flags. For the PHY to be in DP-alt or legacy mode and for the PHY to be in the connected state in these modes, both the Owned (set by the BIOS/driver) and the Ready (set by the HW) flags should be set. On ICL-MTL the HW kept the PHY's Ready flag set after the driver connected the PHY by acquiring the PHY ownership (by setting the Owned flag), until the driver disconnected the PHY by releasing the PHY ownership (by clearing the Owned flag). On LNL+ this has changed, in that the HW clears the Ready flag as soon as the sink gets disconnected, even if the PHY ownership was acquired already and hence the PHY is being used by the display. When inheriting the HW state from BIOS for a PHY connected in DP-alt mode on which the sink got disconnected - i.e. in a case where the sink was connected while BIOS/GOP was running and so the sink got enabled connecting the PHY, but the user disconnected the sink by the time the driver loaded - the PHY Owned but not Ready state must be accounted for on LNL+ according to the above. Do that by assuming on LNL+ that the PHY is connected in DP-alt mode whenever the PHY Owned flag is set, regardless of the PHY Ready flag. This fixes a problem on LNL+, where the PHY TypeC mode / connected state was detected incorrectly for a DP-alt sink, which got connected and then disconnected by the user in the above way. v2: Rename tc_phy_in_legacy_or_dp_alt_mode() to tc_phy_owned_by_display(). (Luca, Jani) Cc: Jani Nikula Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Reviewed-by: Luca Coelho [Imre: Add one-liner function documentation for tc_phy_owned_by_display()] Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-2-imre.deak@intel.com commit 5846154126541b27281fbc9aba0c8ee97e22597b Author: Akhilesh Patil Date: Fri Aug 8 11:09:18 2025 +0530 wifi: rtw89: 8852bt: Use standard helper for string choice Use standard helper str_on_off() defined at string_choices.h in _dpk_information() to improve code reusability. Reduce hardcoding of repeated use of the same strings to save code space. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202507282341.drTGfLWA-lkp@intel.com/ Signed-off-by: Akhilesh Patil Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/aJWNhu9bAkcjEyb4@bhairav-test.ee.iitb.ac.in commit 04a2de8cfc95076d6c65d4d6d06d0f9d964a2105 Author: Ping-Ke Shih Date: Mon Aug 4 09:22:34 2025 +0800 wifi: rtw89: add dummy C2H handlers for BCN resend and update done Two C2H events are not listed, and driver throws MAC c2h class 0 func 6 not support MAC c2h class 1 func 3 not support Since the implementation in vendor driver does nothing, add two dummy functions for them. Reported-by: Bitterblue Smith Closes: https://lore.kernel.org/linux-wireless/d2d62793-046c-4b55-93ed-1d1f43cff7f2@gmail.com/ Reviewed-by: Sean Anderson Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250804012234.8913-3-pkshih@realtek.com commit 7e1c44fe4c2e1e01fa47d9490893d95309a99687 Author: Ping-Ke Shih Date: Mon Aug 4 09:22:33 2025 +0800 wifi: rtw89: print just once for unknown C2H events When driver receives new or unknown C2H events, it print out messages repeatedly once events are received, like rtw89_8922ae 0000:81:00.0: PHY c2h class 2 not support To avoid the thousands of messages, use rtw89_info_once() instead. Also, print out class/func for unknown (undefined) class. Reported-by: Sean Anderson Closes: https://lore.kernel.org/linux-wireless/20250729204437.164320-1-sean.anderson@linux.dev/ Reviewed-by: Sean Anderson Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250804012234.8913-2-pkshih@realtek.com commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 Author: Bitterblue Smith Date: Fri Aug 1 23:08:24 2025 +0300 wifi: rtw88: Lock rtwdev->mutex before setting the LED Some users report that the LED blinking breaks AP mode somehow. Most likely the LED code and the dynamic mechanism are trying to access the hardware registers at the same time. Fix it by locking rtwdev->mutex before setting the LED and unlocking it after. Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking") Closes: https://github.com/lwfinger/rtw88/issues/305 Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com commit 58de1f91e033b1fface8d8948984583125f93736 Author: Ping-Ke Shih Date: Thu Jul 24 08:48:15 2025 +0800 wifi: rtw88: sdio: use indirect IO for device registers before power-on The register REG_SYS_CFG1 is used to determine chip basic information as arguments of following flows, such as download firmware and load PHY parameters, so driver read the value early (before power-on). However, the direct IO is disallowed before power-on, or it causes wrong values, which driver recognizes a chip as a wrong type RF_1T1R, but actually RF_2T2R, causing driver warns: rtw88_8822cs mmc1:0001:1: unsupported rf path (1) Fix it by using indirect IO before power-on. Reported-by: Piotr Oniszczuk Closes: https://lore.kernel.org/linux-wireless/699C22B4-A3E3-4206-97D0-22AB3348EBF6@gmail.com/T/#t Suggested-by: Bitterblue Smith Tested-by: Piotr Oniszczuk Reviewed-by: Martin Blumenstingl Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250724004815.7043-1-pkshih@realtek.com commit 906cbdc1fffa3b18992108c8bda66de058285daa Author: Jani Nikula Date: Mon Aug 11 18:25:50 2025 +0300 drm/i915/vbt: add missing DSI VBT defs Add some missing DSI VBT definitions. Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/17e0f38391314aceff12619a04829c3e36fa26b7.1754925923.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 745b597a79301c999324a9f9b943d0cb9140f9cb Author: Jani Nikula Date: Mon Aug 11 18:25:49 2025 +0300 drm/i915/vbt: flip bta_enabled to bta_disable The meaning is disable, so flip the member name. Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/180079eca346edc1671c164da2ca7f428c2ba1de.1754925923.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit aa0c02f04369b7080515a5be4c9b9a70c88306c2 Author: Jani Nikula Date: Mon Aug 11 18:25:48 2025 +0300 drm/i915/vbt: add anonymous structs to group DSI VBT defs The grouping of DSI VBT definitions is hard to follow and match against the spec. Use anonymous structs and add comments with the spec description. Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/f57ca596aefa3ef0b4ce1f36452410cf745acddd.1754925923.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f3c65a8e9b09f66042e418674283db8675a445a8 Author: Jani Nikula Date: Mon Aug 11 18:25:47 2025 +0300 drm/i915/vbt: split up DSI VBT defs to a separate file The DSI VBT definitions have ended up in intel_bios.h, because intel_vbt_defs.h is supposed to be internal to intel_bios.c, but the DSI VBT definitions are needed in more places. Split out the DSI VBT definitions to intel_dsi_vbt_defs.h. This will also help keep the definitions in sync with IGT. Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/84417e0141f98ae8f8c7a66e9002c3e99c9ed3db.1754925923.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 256feb5be482315a91c1bd1a1808276f57ef76dd Author: Marek Vasut Date: Wed Aug 6 17:04:27 2025 +0200 ARM: dts: renesas: r7s72100: Add boot phase tags bootph-all as phase tag was added to dt-schema (dtschema/schemas/bootph.yaml) to describe various node usage during boot phases with DT. Add bootph-all for all nodes that are used in the bootloader on Renesas RZ/A1 SoCs. All SoCs require BSC bus, PFC pin control, and OSTM0 timer access during all stages of the boot process, those are marked using bootph-all property, and so is the SoC bus node which contains the PFC and OSTM IPs. Each board console UART is also marked as bootph-all to make it available in all stages of the boot process. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806150448.9669-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 95319aaa3ffc680cab9abe6e7197299561e890de Author: Marek Vasut Date: Wed Aug 6 17:00:36 2025 +0200 arm64: dts: renesas: sparrow-hawk: Describe generic SPI NOR support Retronix R-Car V4H Sparrow Hawk EVTA1 is populated with Spansion S25FS512S, EVTB1 is populated with Winbond W77Q51NW. Describe the SPI NOR using the generic "jedec,spi-nor" compatible, because both FLASHes can be auto-detected based on their built-in IDs. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806150048.9364-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit ae014fbc99c7f986ee785233e7a5336834e39af4 Author: Biju Das Date: Fri Aug 1 13:19:53 2025 +0100 arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we are deleting a wrong and nonexistent node. Fixing the wrong node would invoke a dtb warning message, as channel0 is a required property. Disable CAN-FD channel0 instead of deleting the node. Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c44c51bc3566412075c66e0064e17c0c9cb5a638 Author: Tommaso Merciai Date: Fri Aug 1 10:48:23 2025 +0200 arm64: dts: renesas: r9a09g047: Add DMAC nodes Add nodes for the DMAC IPs found on the Renesas RZ/G3E SoC. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250801084825.471011-4-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0a0e0852f3f339afdc75ff62750eae3857437231 Author: Geert Uytterhoeven Date: Thu Jul 31 10:36:59 2025 +0200 arm64: dts: renesas: r9a09g057h48-kakip: Fix misplaced article Move the article "the" before the full name of the board. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/280176885acf46d117a0ab9a02c314e2b5cf250f.1753950938.git.geert+renesas@glider.be commit deab74707654cbfcd4b1e984d8f64479145b6895 Author: Lad Prabhakar Date: Mon Jul 7 16:35:33 2025 +0100 arm64: dts: renesas: r9a09g087: Add SDHI nodes Add the SDHI0-SDHI1 nodes to the RZ/N2H ("R9A09G087") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250707153533.287832-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c5dbcd94fc78d67b6c0a7e55615ae2019300956f Author: Lad Prabhakar Date: Mon Jul 7 16:35:32 2025 +0100 arm64: dts: renesas: r9a09g077: Add SDHI nodes Add the SDHI0-SDHI1 nodes to the RZ/T2H ("R9A09G077") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250707153533.287832-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1977f7d0d180621c11af26e96be29cc4e772dcc4 Author: Lad Prabhakar Date: Mon Jul 7 16:35:31 2025 +0100 arm64: dts: renesas: r9a09g087: Add I2C controller nodes The Renesas RZ/N2H ("R9A09G087") SoC includes three I2C (RIIC) channels. Add device tree nodes for all three I2C controllers to the RZ/N2H SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250707153533.287832-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1335a89bbc8ac5b0310db9457018c261816e61cc Author: Lad Prabhakar Date: Mon Jul 7 16:35:30 2025 +0100 arm64: dts: renesas: r9a09g077: Add I2C controller nodes The Renesas RZ/T2H ("R9A09G077") SoC includes three I2C (RIIC) channels. Add device tree nodes for all three I2C controllers to the RZ/T2H SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250707153533.287832-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit fb357dbadbebc7a9ca3c5ef26f6c792b0e8e1278 Author: Thomas Zimmermann Date: Tue Jul 15 14:24:42 2025 +0200 fbcon: Add necessary include statements and forward declarations Make the header self contained for including. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Link: https://lore.kernel.org/r/20250715122643.137027-6-tzimmermann@suse.de commit efea7a57370b956ef612dc603faa2df9126cc3ed Author: Takashi Iwai Date: Mon Aug 11 10:20:18 2025 +0200 ALSA: usb-audio: Replace manual mutex/spinlock with guard() This is another code cleanup by replacing the manual mutex or spinlock with guard() macros. usb_audio_disconnect() is slightly refactored (split to another function) to apply guard() cleanly, but the rest are rather straightforward conversions. No functional changes but only code refactoring. Link: https://patch.msgid.link/20250811082019.31052-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6ff0d95774f0c728f96b8f78367318e95e09ee64 Author: Takashi Iwai Date: Mon Aug 11 10:22:29 2025 +0200 ALSA: 6fire: Clean ups with guard() Simple code cleanups with the guard() for spinlock and mutex. No functional changes. Link: https://patch.msgid.link/20250811082231.31498-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 43d4940c944c20f41dde2e091284646367c10c60 Author: Takashi Iwai Date: Mon Aug 11 10:15:00 2025 +0200 ALSA: usb: scarlett2: Clean ups with guard() and __free() There are lots of manual mutex lock/unlock and temporary kmalloc/kfree patterns found in mixer_scalett2.c. Let's simplify the code with the recent lock guard() and auto cleanup with __free(). Only code refactoring, and there should be no actual behavior change. Link: https://patch.msgid.link/20250811081502.30768-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 47459937be8031aae6aaa17ac5f60985f7c9e1bd Author: Mauro Carvalho Chehab Date: Thu Jul 10 18:36:40 2025 +0200 sphinx: parser_yaml.py: fix line numbers information As reported by Donald, this code: rst_parser = RSTParser() rst_parser.parse('\n'.join(result), document) breaks line parsing. As an alternative, I tested a variant of it: rst_parser.parse(result, document) but still line number was not preserved. As Donald noted, standard Parser classes don't have a direct mechanism to preserve line numbers from ViewList(). So, instead, let's use a mechanism similar to what we do already at kerneldoc.py: call the statemachine mechanism directly there. I double-checked when states and statemachine were introduced: both were back in 2002. I also tested doc build with docutils 0.16 and 0.21.2. It worked with both, so it seems to be stable enough for our needs. Reported-by: Donald Hunter Closes: https://lore.kernel.org/linux-doc/m24ivk78ng.fsf@gmail.com/T/#u Signed-off-by: Mauro Carvalho Chehab commit d90555ef0603935529837e490d5acc8436297c56 Author: Mauro Carvalho Chehab Date: Thu Jun 19 14:55:33 2025 +0200 docs: parser_yaml.py: fix backward compatibility with old docutils As reported by Akira, older docutils versions are not compatible with the way some Sphinx versions send tab_width. Add a code to address it. Reported-by: Akira Yokosawa Closes: https://lore.kernel.org/linux-doc/598b2cb7-2fd7-4388-96ba-2ddf0ab55d2a@gmail.com/ Tested-by: Akira Yokosawa Signed-off-by: Mauro Carvalho Chehab commit 0b24dfdd12f4ca3ef5efa0cfaad3fc14f5b3fbf1 Author: Mauro Carvalho Chehab Date: Tue Jun 17 17:54:03 2025 +0200 docs: parser_yaml.py: add support for line numbers from the parser Instead of printing line numbers from the temp converted ReST file, get them from the original source. Signed-off-by: Mauro Carvalho Chehab commit ad06a878a328f230e9bf62ec0042eea1798d2cb0 Author: Mauro Carvalho Chehab Date: Tue Jun 17 17:28:04 2025 +0200 tools: netlink_yml_parser.py: add line numbers to parsed data When something goes wrong, we want Sphinx error to point to the right line number from the original source, not from the processed ReST data. Signed-off-by: Mauro Carvalho Chehab commit 778756819af1e5aca9e3c9f77a3c4cfb4b2a5fb8 Author: Mauro Carvalho Chehab Date: Fri Jun 13 13:02:01 2025 +0200 MAINTAINERS: add netlink_yml_parser.py to linux-doc The documentation build depends on the parsing code at ynl_gen_rst.py. Ensure that changes to it will be c/c to linux-doc ML and maintainers by adding an entry for it. This way, if a change there would affect the build, or the minimal version required for Python, doc developers may know in advance. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Breno Leitao Reviewed-by: Donald Hunter commit 6abc773747a80dfcbf8aa05fce7bb8d5d815fdb3 Author: Mauro Carvalho Chehab Date: Tue Jun 10 10:44:45 2025 +0200 docs: netlink: remove obsolete .gitignore from unused directory The previous code was generating source rst files under Documentation/networking/netlink_spec/. With the Sphinx YAML parser, this is now gone. So, stop ignoring *.rst files inside netlink specs directory. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit dc2f50796a78061480a658e2b7c2ebacc4c8d84e Author: Mauro Carvalho Chehab Date: Tue Jun 17 09:34:39 2025 +0200 tools: ynl_gen_rst.py: drop support for generating index files As we're now using an index file with a glob, there's no need to generate index files anymore. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit 11d137aaef802fb2a22b917b4d91e800141140c7 Author: Mauro Carvalho Chehab Date: Thu Jun 12 15:27:39 2025 +0200 docs: uapi: netlink: update netlink specs link With the recent parser_yaml extension, and the removal of the auto-generated ReST source files, the location of netlink specs changed. Update uAPI accordingly. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit 1ce4da3dd99e98bd4a8b396c291041080e0fe85e Author: Mauro Carvalho Chehab Date: Thu Jun 12 10:34:30 2025 +0200 docs: use parser_yaml extension to handle Netlink specs Instead of manually calling ynl_gen_rst.py, use a Sphinx extension. This way, no .rst files would be written to the Kernel source directories. We are using here a toctree with :glob: property. This way, there is no need to touch the netlink/specs/index.rst file every time a new Netlink spec is added/renamed/removed. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit bb1e3629b2e684e03adb21d75c7839f3afeb488e Author: Mauro Carvalho Chehab Date: Thu Jun 12 09:58:56 2025 +0200 docs: sphinx: add a parser for yaml files for Netlink specs Add a simple sphinx.Parser to handle yaml files and add the the code to handle Netlink specs. All other yaml files are ignored. The code was written in a way that parsing yaml for different subsystems and even for different parts of Netlink are easy. All it takes to have a different parser is to add an import line similar to: from doc_generator import YnlDocGenerator adding the corresponding parser somewhere at the extension: netlink_parser = YnlDocGenerator() And then add a logic inside parse() to handle different doc outputs, depending on the file location, similar to: if "/netlink/specs/" in fname: msg = self.netlink_parser.parse_yaml_file(fname) Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit 3a3b8a144754858b59f108c7dc80eb613bf6fe64 Author: Mauro Carvalho Chehab Date: Fri Jun 13 16:09:05 2025 +0200 tools: ynl_gen_rst.py: cleanup coding style Cleanup some coding style issues pointed by pylint and flake8. No functional changes. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Breno Leitao Reviewed-by: Donald Hunter commit beaea9c4ba2d8ef1b10223dc3a75a7d7be3e5cd9 Author: Mauro Carvalho Chehab Date: Thu Jun 12 10:34:30 2025 +0200 docs: netlink: index.rst: add a netlink index file Instead of generating the index file, use glob to automatically include all data from yaml. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit f25f39e6d26644aeeef72433f67fc6d9e638c800 Author: Mauro Carvalho Chehab Date: Thu Jun 12 08:27:00 2025 +0200 tools: ynl_gen_rst.py: Split library from command line tool As we'll be using the Netlink specs parser inside a Sphinx extension, move the library part from the command line parser. While here, change the code which generates an index file to parse inputs from both .rst and .yaml extensions. With that, the tool can easily be tested with: tools/net/ynl/pyynl/ynl_gen_rst.py -x -o Documentation/netlink/specs/foo.rst Without needing to first generate a temp directory with the rst files. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit dd5d5a11bacb2eb0e00e0f6a9bc919afed2ec751 Author: Mauro Carvalho Chehab Date: Tue Jun 10 11:42:30 2025 +0200 docs: netlink: netlink-raw.rst: use :ref: instead of :doc: Currently, rt documents are referred with: Documentation/userspace-api/netlink/netlink-raw.rst: :doc:`rt-link<../../networking/netlink_spec/rt-link>` Documentation/userspace-api/netlink/netlink-raw.rst: :doc:`tc<../../networking/netlink_spec/tc>` Documentation/userspace-api/netlink/netlink-raw.rst: :doc:`tc<../../networking/netlink_spec/tc>` Having :doc: references with relative paths doesn't always work, as it may have troubles when O= is used. Also that's hard to maintain, and may break if we change the way rst files are generated from yaml. Better to use instead a reference for the netlink family. So, replace them by Sphinx cross-reference tag that are created by ynl_gen_rst.py. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 Author: Chia-I Wu Date: Tue Jun 10 16:58:25 2025 -0700 drm/bridge: it6505: select REGMAP_I2C Fix aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe': ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c' Signed-off-by: Chia-I Wu Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com Signed-off-by: Chen-Yu Tsai commit e98329896b5639f8437af8ff9316f20cb50d9187 Author: Taniya Das Date: Wed Jul 2 14:43:09 2025 +0530 dt-bindings: cpufreq: cpufreq-qcom-hw: Add QCS615 compatible Document compatible for cpufreq hardware on Qualcomm QCS615 platform. Signed-off-by: Taniya Das Acked-by: Krzysztof Kozlowski Signed-off-by: Viresh Kumar commit 57e85e21b2729849407c9f851e30b2ff0f07523b Author: Saravana Kannan Date: Mon Aug 11 14:51:01 2025 -0700 MAINTAINERS: Add myself as virtual-cpufreq maintainer Forgot to update the MAINTAINERS file in the initial patch that landed the driver. Add myself as the maintainer for this driver. Signed-off-by: Saravana Kannan Signed-off-by: Viresh Kumar commit be477c3924f80809871df12f72d80d405d482ba2 Author: Satya Priya Kakitapalli Date: Thu Jul 10 18:30:39 2025 +0530 dt-bindings: clock: qcom,videocc: Add sc8180x compatible The sc8180x video clock controller block is identical to that of sm8150. Add a new compatible string for sc8180x videocc and use sm8150 as fallback. Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250710-sc8180x-videocc-dt-v4-1-07a9d9d5e0e6@quicinc.com Signed-off-by: Bjorn Andersson commit ce4d078469792d865b05f1687bca2eb24b77d84a Author: Luca Weiss Date: Fri Aug 1 15:40:59 2025 +0200 arm64: dts: qcom: sm6350: Add rpmh-stats node The qcom_stats driver allows querying sleep stats from various remoteprocs. Add a node to enable it. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250801-sm6350-rpmh-stats-v1-1-f1fb649d1095@fairphone.com Signed-off-by: Bjorn Andersson commit c183cebe69d0c02a3483d18b6953b29ff790c643 Author: Luca Weiss Date: Fri Aug 1 15:51:06 2025 +0200 arm64: dts: qcom: qcm6490-fairphone-fp5: Enable USB audio offload support Enable USB audio offloading which allows to play audio via a USB-C headset with lower power consumption and enabling some other features. This can be used like the following: $ amixer -c0 cset name='USB_RX Audio Mixer MultiMedia1' On $ aplay --device=plughw:0,0 test.wav Compared to regular playback to the USB sound card no xhci-hcd interrupts appear during playback, instead the ADSP will be handling the USB transfers. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250801-fp5-usb-audio-offload-v1-2-240fc213d3d3@fairphone.com Signed-off-by: Bjorn Andersson commit 55863887fa1c536568dba6cb10b2cefc2b0e24cc Author: Luca Weiss Date: Fri Aug 1 15:51:05 2025 +0200 arm64: dts: qcom: sc7280: Add q6usbdai node Add a node for q6usb which handles USB audio offloading, allowing to play audio via a USB-C headset with lower power consumption and enabling some other features. We also need to set num-hc-interrupters for the dwc3 for the q6usb to be able to use its sideband interrupter. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250801-fp5-usb-audio-offload-v1-1-240fc213d3d3@fairphone.com Signed-off-by: Bjorn Andersson commit afde4d8ea536964b7b7fe83cc6736e28475b6135 Author: Dmitry Baryshkov Date: Thu Jul 24 15:23:43 2025 +0300 arm64: dts: qcom: sc7180-acer-aspire1: drop deprecated DP supplies DP supplies were migrated to the corresponding DP PHY. Drop them from the DP controller node. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-move-edp-endpoints-v1-5-6ca569812838@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c361adf09dfc77c62da4c0d548a8c8d50eb9c71d Author: Dmitry Baryshkov Date: Thu Jul 24 15:23:42 2025 +0300 arm64: dts: qcom: move data-lanes to the DP-out endpoint Support for the data-lanes declaration in the DP node is deprecated. Move them to the corresponding endpoint as recommended by the current DP bindings. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-move-edp-endpoints-v1-4-6ca569812838@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 91329efd132bf58aaecb33c07a4e566d9e95ff71 Author: Dmitry Baryshkov Date: Thu Jul 24 15:23:41 2025 +0300 arm64: dts: qcom: x1e80100: add empty mdss_dp3_out endpoint Follow the example of other DP controllers and also eDP controller on SC7280 and move mdss_dp3_out endpoint declaration to the SoC DTSI. This slightly reduces the boilerplate in the platform DT files and also reduces the difference between DP and eDP controllers. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-move-edp-endpoints-v1-3-6ca569812838@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit caaba55bb751133433c1b0806f5ce6b88359f0f7 Author: Dmitry Baryshkov Date: Thu Jul 24 15:23:40 2025 +0300 arm64: dts: qcom: sc8280xp: add empty mdss*_dp*_out endpoints Follow the example of other DP controllers and also eDP controller on SC7280 and move all mdss[01]_dp[0123]_out endpoints declaration to the SoC DTSI. This slightly reduces the boilerplate in the platform DT files and also reduces the difference between DP and eDP controllers. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-move-edp-endpoints-v1-2-6ca569812838@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 45cca0f3c8208d210751ec91edf778a18336df88 Author: Dmitry Baryshkov Date: Thu Jul 24 15:23:39 2025 +0300 arm64: dts: qcom: sc8180x: add empty mdss_edp_out endpoint Follow the example of other DP controllers and also eDP controller on SC7280 and move mdss_edp_out endpoint declaration to the SoC DTSI. This slightly reduces the boilerplate in the platform DT files and also reduces the difference between DP and eDP controllers. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-move-edp-endpoints-v1-1-6ca569812838@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb Author: Wake Liu Date: Sat Aug 9 14:20:13 2025 +0800 selftests/net: Ensure assert() triggers in psock_tpacket.c The get_next_frame() function in psock_tpacket.c was missing a return statement in its default switch case, leading to a compiler warning. This was caused by a `bug_on(1)` call, which is defined as an `assert()`, being compiled out because NDEBUG is defined during the build. Instead of adding a `return NULL;` which would silently hide the error and could lead to crashes later, this change restores the original author's intent. By adding `#undef NDEBUG` before including , we ensure the assertion is active and will cause the test to abort if this unreachable code is ever executed. Signed-off-by: Wake Liu Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com Signed-off-by: Jakub Kicinski commit 67e980f58dd71d9483d5af683558f5913b1c95ae Author: Nemesa Garg Date: Thu Aug 7 17:08:55 2025 +0530 drm/i915/scaler: Fix condition for WA_14011503117 As scaler_state can never be null so no need to check this, only check if scaler_id is less than 0 or not. v2: Add scaler_id check [Jani] v3: Modify commit message[Suraj] Fixes: 73309ed9d598 ("drm/i915/display: WA_14011503117") Signed-off-by: Nemesa Garg Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250807113855.3175435-1-nemesa.garg@intel.com commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df Author: Wake Liu Date: Thu Aug 7 16:09:32 2025 +0800 selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 The `__WORDSIZE` macro, defined in the non-standard `` header, is a GNU extension and not universally available with all toolchains, such as Clang when used with musl libc. This can lead to build failures in environments where this header is missing. The intention of the code is to determine the bit width of a C `long`. Replace the non-portable `__WORDSIZE` with the standard and portable `sizeof(long) * 8` expression to achieve the same result. This change also removes the inclusion of the now-unused `` header. Signed-off-by: Wake Liu Signed-off-by: Jakub Kicinski commit a42938e80357a13f8b8592111e63f2e33a919863 Author: Xichao Zhao Date: Fri Aug 8 16:37:01 2025 +0800 zonefs: correct some spelling mistakes Trivial fix to spelling mistake in comment text. (1) fix "unwriten"->"unwritten" (2) fix "writen"->"written" Signed-off-by: Xichao Zhao Signed-off-by: Damien Le Moal commit f0370265b1d7fc169956927aa62c3abc375743b5 Author: Ziyue Zhang Date: Fri Jul 25 18:22:31 2025 +0800 arm64: dts: qcom: sa8775p: add link_down reset for pcie SA8775p supports 'link_down' reset on hardware, so add it for both pcie0 and pcie1, which can provide a better user experience. Reviewed-by: Konrad Dybcio Reviewed-by: Johan Hovold Signed-off-by: Ziyue Zhang Link: https://lore.kernel.org/r/20250725102231.3608298-4-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d41fb878adf64ef5dc4b4c25419e875483f62fe2 Author: Ziyue Zhang Date: Fri Jul 25 18:22:30 2025 +0800 arm64: dts: qcom: sa8775p: remove aux clock from pcie phy The gcc_aux_clk is used by the PCIe Root Complex (RC) and is not required by the PHY. The correct clock for the PHY is gcc_phy_aux_clk, which this patch uses to replace the incorrect reference. The distinction between AUX_CLK and PHY_AUX_CLK is important: AUX_CLK is typically used by the controller, while PHY_AUX_CLK is required by certain PHYs—particularly Gen4 QMP PHYs—for internal operations such as clock gating and power management. Some non-Gen4 Qualcomm PHYs also use PHY_AUX_CLK, but they do not require AUX_CLK. This change ensures proper clock configuration and avoids unnecessary dependencies. Signed-off-by: Ziyue Zhang Reviewed-by: Johan Hovold Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes") Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250725102231.3608298-3-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 Author: Jens Reidel Date: Sun Jul 27 01:56:46 2025 +0200 soc: qcom: smem: Fix endian-unaware access of num_entries Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer. Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian. Signed-off-by: Jens Reidel Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org Signed-off-by: Bjorn Andersson commit d72cb0551d113a0a42e12dcdfdad78ade2c63f50 Author: Krishna Kurapati Date: Mon Jul 28 09:28:12 2025 +0530 arm64: dts: qcom: sc7280: Flatten usb controller nodes Flatten usb controller nodes and update to using latest bindings and flattened driver approach. Signed-off-by: Krishna Kurapati Reviewed-by: Konrad Dybcio Tested-by: Konrad Dybcio # FP5 Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250728035812.2762957-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 642af3f3d59003657483d60bb6b7229a43ff56e7 Author: Konrad Dybcio Date: Mon Jul 28 11:33:52 2025 +0200 arm64: dts: qcom: sc7280-chrome-common: Remove duplicate node sc7280.dtsi already includes the very same definition (bar 'memory@' vs 'video@', which doesn't matter). Remove the duplicate to fix a lot of dtbs W=1 warning instances (unique_unit_address_if_enabled). Signed-off-by: Konrad Dybcio Acked-by: Douglas Anderson Link: https://lore.kernel.org/r/20250728-topic-chrome_dt_fixup-v1-1-1fc38a95d5ea@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1d363a6cf8a2627f31bc3609a0fa9d85dfb0d9dc Author: Loic Poulain Date: Mon Jul 28 11:34:26 2025 +0200 arm64: dts: qcom: qcm2290: Enable HS eMMC timing modes The host controller supports HS200/HS400 and HS400 enhanced strobe mode. On RB1, this improves Linux eMMC read speed, from ~170MB/s to 300MB/s. Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250728093426.1413379-1-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d15cb624a60ab0119ec1b92d0a94f1cc305019e5 Author: Ling Xu Date: Tue Jul 29 08:42:59 2025 +0530 arm64: dts: qcom: sm6150: Add ADSP and CDSP fastrpc nodes Add ADSP and CDSP fastrpc nodes for SM6150 platform. Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250729031259.4190916-1-quic_lxu5@quicinc.com Signed-off-by: Bjorn Andersson commit c2e07613b8d40f0ac60dd9b28c0dd15f9a298c11 Author: Neil Armstrong Date: Tue Jul 29 16:40:53 2025 +0200 arm64: dts: qcom: sm8650: Add ACD levels for GPU Update GPU node to include acd level values. Signed-off-by: Neil Armstrong Reviewed-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250729-topic-sm8650-upstream-gpu-acd-level-v1-1-258090038a41@linaro.org Signed-off-by: Bjorn Andersson commit dc231840dca64793da7a80ff156fa1d99584f3ea Author: Sumit Garg Date: Wed Jul 30 18:52:30 2025 +0530 arm64: dts: qcom: qcm2290: Add TCSR download mode address Allow configuration of download mode via qcom_scm driver via specifying download mode register address in the TCSR space. It is especially useful for a clean watchdog reset without entry into download mode. The problem remained un-noticed until now since error reporting for missing download mode configuration feature was explicitly suppressed. Signed-off-by: Sumit Garg Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250730132230.247727-1-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson commit f72f3aac4a9a990701455a4759a49393cd5802d6 Author: David Heidelberg Date: Fri Aug 1 10:21:40 2025 +0200 arm64: dts: qcom: sdm845-oneplus: Deduplicate shared entries Use the definition for qcom,msm-id and put them into the common dtsi. Signed-off-by: David Heidelberg Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250801-sdm845-msmid-v2-2-9f44d125ee44@ixit.cz Signed-off-by: Bjorn Andersson commit 285fee8c65efd7969f9376ed9798afece9a0ccc9 Author: David Heidelberg Date: Fri Aug 1 10:21:39 2025 +0200 arm64: dts: qcom: sdm845*: Use definition for msm-id For all boards it's QCOM_ID_SDM845 except Dragonboard, where it's QCOM_ID_SDA845. Except for OnePlus 6 / 6T, which is handled in following commit. Signed-off-by: David Heidelberg Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250801-sdm845-msmid-v2-1-9f44d125ee44@ixit.cz Signed-off-by: Bjorn Andersson commit 8839b8e6e849e209b52bf0ae4d0770d89c036b0e Author: Richard Acayan Date: Mon Jun 30 18:41:59 2025 -0400 arm64: dts: qcom: sdm670-google-sargo: enable charger The Pixel 3a has a rechargeable 3000 mAh battery. Describe it and enable its charging controller in PM660. Signed-off-by: Richard Acayan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250630224158.249726-2-mailingradian@gmail.com Signed-off-by: Bjorn Andersson commit 93109afda01593c2ddadb4ec1c42b3bdf695ee2a Author: Aleksandrs Vinarskis Date: Mon Jun 30 22:54:11 2025 +0200 arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Enable HBR3 on external DPs When no link frequencies are set, msm/dp driver defaults to HBR2 speed. Explicitly list supported frequencies including HBR3/8.1Gbps for all external DisplayPort(s). Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250630205514.14022-3-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 60fdba1dccd81420bbe8da0d7483b4f28c7fa833 Author: Aleksandrs Vinarskis Date: Mon Jun 30 22:54:10 2025 +0200 arm64: dts: qcom: x1-crd: Enable HBR3 on external DPs When no link frequencies are set, msm/dp driver defaults to HBR2 speed. Explicitly list supported frequencies including HBR3/8.1Gbps for all external DisplayPort(s). Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250630205514.14022-2-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 3b51739fa2001b047359e11afd755ae5e189b7db Author: Philipp Stanner Date: Thu Aug 7 09:07:57 2025 +0200 MAINTAINERS: Add website of Nova GPU driver The Nova GPU driver has a sub-website on the Rust-for-Linux website which so far was missing from the respective section in MAINTAINERS. Add the Nova website. Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250807070756.103816-2-phasta@kernel.org Signed-off-by: Alexandre Courbot commit 2872c8982c80e22f9a7fc4db7d8f0e8188ab4cd7 Author: Rhys Lloyd Date: Fri Jul 18 00:36:25 2025 -0700 gpu: nova-core: vbios: change PmuLookupTableEntry to use size_of Annotate the PmuLookupTableEntry with an `#[repr(C, packed)]` attribute. Removes another magic number by making the struct the same size as the data it needs to read, allowing the use of `size_of::()` [acourbot@nvidia.com: remove `dead_code` expect to fix `unfulfilled_lint_expectations` lint] Reviewed-by: Alexandre Courbot Signed-off-by: Rhys Lloyd Link: https://lore.kernel.org/r/20250718073633.194032-3-krakow20@gmail.com Signed-off-by: Alexandre Courbot commit 0f85b6c1cb5746180b2bf674a436a48e6722e7ed Author: Rhys Lloyd Date: Fri Jul 18 00:36:24 2025 -0700 gpu: nova-core: vbios: use size_of instead of magic number 12 is identical to the value of `size_of::()`, so use the latter instead. [acourbot@nvidia.com: remove `dead_code` expect to fix `unfulfilled_lint_expectations` lint] Reviewed-by: Alexandre Courbot Signed-off-by: Rhys Lloyd Link: https://lore.kernel.org/r/20250718073633.194032-2-krakow20@gmail.com Signed-off-by: Alexandre Courbot commit fdf913d0c44f330e83905e7f1ab738dc63b2b82c Author: Adam Honse Date: Wed Jun 18 23:45:44 2025 +0200 ARM: dts: qcom: msm8974-samsung-hlte: Add touchkey support Add support for the touchkeys on the Samsung Galaxy Note 3 (hlte). Signed-off-by: Adam Honse Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250618-hlte-touchkey-v2-1-2cf188b57e31@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 3f9e5d74d1943a9f98c814970b709098a1108845 Author: Shinjo Park Date: Fri Jun 13 21:42:53 2025 +0200 ARM: dts: qcom: pm8921: add vibrator device node Use the same definition as pm8058.dtsi. Since vibrator is used only by some devices, disable it by default and let it be enabled explicitly. Signed-off-by: Shinjo Park Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250613194253.20080-1-peremen@gmail.com Signed-off-by: Bjorn Andersson commit d2f146b3dfbcc2550b9c805b49dab53b4babf2e8 Author: Antony Kurniawan Soemardi Date: Sun Jun 22 18:26:50 2025 +0000 ARM: dts: qcom: add device tree for Sony Xperia SP Add initial device tree support for the Sony Xperia SP (codename: sony-huashan), a smartphone based on the Qualcomm MSM8960T SoC. There are two variants of the Xperia SP, one without LTE and one with LTE. This device tree should work for both variants, though it has only been tested on the non-LTE variant. The following are currently supported: - Serial console support via gsbi8 - GPIO keys for volume up/down buttons - PM8921 keypad with camera focus/capture keys - eMMC (sdcc1) and micro SD card (sdcc3) support - USB OTG support Other hardware features are not yet implemented. Booting notes: Booting a kernel requires using the Sony ELF boot image format, which embeds the kernel, ramdisk, RPM firmware, and cmdline. This can be created using the `mkelf` tool. For example: python2 mkelf.py -o boot.img \ kernel+dtb@0x80208000 \ ramdisk.img@0x81900000 \ RPM.bin@0x00020000,rpm \ cmdline.txt@cmdline The resulting `boot.img` can then be flashed via fastboot. A detailed guide, including an alternative method, is available at: https://wiki.postmarketos.org/wiki/Sony_Xperia_SP_(sony-huashan) Signed-off-by: Antony Kurniawan Soemardi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250623-msm8960-sdcard-v2-5-340a5e8f7df0@smankusors.com Signed-off-by: Bjorn Andersson commit 3a99873d8b9f6c1ec027987fff7b32eab9273316 Author: Antony Kurniawan Soemardi Date: Sun Jun 22 18:26:47 2025 +0000 dt-bindings: arm: qcom: add Sony Xperia SP Document the Sony Xperia SP (huashan), which uses the MSM8960T SoC. The MSM8960T is a variant of the MSM8960 featuring an upgraded GPU (Adreno 320 instead of Adreno 225) and a slightly overclocked CPU (1.7GHz instead of 1.5GHz). Signed-off-by: Antony Kurniawan Soemardi Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250623-msm8960-sdcard-v2-4-340a5e8f7df0@smankusors.com Signed-off-by: Bjorn Andersson commit 27738c3003bf3b124527c9ed75e1e0d0c013c101 Author: Timur Tabi Date: Fri Aug 8 14:13:40 2025 -0500 drm/nouveau: always set RMDevidCheckIgnore for GSP-RM Always set the RMDevidCheckIgnore registry key for GSP-RM so that it will continue support newer variants of already supported GPUs. GSP-RM maintains an internal list of PCI IDs of GPUs that it supports, and checks if the current GPU is on this list. While the actual GPU architecture (as specified in the BOOT_0/BOOT_42 registers) determines how to enable the GPU, the PCI ID is used for the product name, e.g. "NVIDIA GeForce RTX 5090". Unfortunately, if there is no match, GSP-RM will refuse to initialize, even if the device is fully supported. Nouveau will get an error return code, but by then it's too late. This behavior may be corrected in a future version of GSP-RM, but that does not help Nouveau today. Fortunately, GSP-RM supports an undocumented registry key that tells it to ignore the mismatch. In such cases, the product name returned will be a blank string, but otherwise GSP-RM will continue. Unlike Nvidia's proprietary driver, Nouveau cannot update to newer firmware versions to keep up with every new hardware release. Instead, we can permanently set this registry key, and GSP-RM will continue to function the same with known hardware. Signed-off-by: Timur Tabi Link: https://lore.kernel.org/r/20250808191340.1701983-1-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit 5433560caa5e7e677a8d4310bbec08312be765b4 Author: Laurent Pinchart Date: Thu Jul 10 20:47:08 2025 +0300 arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Replace clock-frequency in camera sensor node The clock-frequency for camera sensors has been deprecated in favour of the assigned-clocks and assigned-clock-rates properties. Replace it in the device tree. Signed-off-by: Laurent Pinchart Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250710174808.5361-13-laurent.pinchart@ideasonboard.com Signed-off-by: Bjorn Andersson commit ad9abc9ba4046360f23a410f74ef78e646c08aa1 Author: Stephan Gerhold Date: Mon Jul 14 13:48:15 2025 +0200 arm64: dts: qcom: x1e80100-crd: Add USB multiport fingerprint reader The X1E80100 CRD has a Goodix fingerprint reader connected to the USB multiport controller on eUSB6. All other ports (including USB super-speed pins) are unused. Set it up in the device tree together with the NXP PTN3222 repeater. Signed-off-by: Stephan Gerhold Reviewed-by: Johan Hovold Tested-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250714-x1e80100-crd-fp-v2-1-3246eb02b679@linaro.org Signed-off-by: Bjorn Andersson commit c5a87e3a6b3ed051466a20cb954be1c138199c56 Author: Krishna Kurapati Date: Tue Jul 15 10:57:39 2025 +0530 arm64: dts: qcom: sm8450: Flatten usb controller node Flatten usb controller node and update to using latest bindings and flattened driver approach. Reviewed-by: Konrad Dybcio Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20250715052739.3831549-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f578e5f0b8b5f81e19e5f97a95e9cadf4e9c699d Author: Krishna Kurapati Date: Tue Jul 15 10:57:38 2025 +0530 arm64: dts: qcom: sm8450-qrd: add pmic glink node Add the pmic glink node linked with the DWC3 USB controller switched to OTG mode and tagged with usb-role-switch. Signed-off-by: Krishna Kurapati Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250715052739.3831549-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d81448d49cb26d9255479c7c74de03a257b5c528 Author: Sayali Lokhande Date: Wed Jul 16 14:21:25 2025 +0530 arm64: dts: qcom: qcs8300-ride: Enable SDHC1 node Enable sdhc1 support for qcs8300 ride platform. Signed-off-by: Sayali Lokhande Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250716085125.27169-3-quic_sayalil@quicinc.com Signed-off-by: Bjorn Andersson commit 43b8556e82f38cc2e7a66c9dd44d1104be4fe73c Author: Sayali Lokhande Date: Wed Jul 16 14:21:24 2025 +0530 arm64: dts: qcom: qcs8300: Add eMMC support Add eMMC support for qcs8300 board. Signed-off-by: Sayali Lokhande Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250716085125.27169-2-quic_sayalil@quicinc.com Signed-off-by: Bjorn Andersson commit bae72efa3ca6674ff99668b00290376babae10f5 Author: Konrad Dybcio Date: Wed Jul 16 12:16:08 2025 +0200 dt-bindings: arm: qcom: Remove sdm845-cheza Cheza was a prototype board, used mainly by the ChromeOS folks. Almost no working devices are known to exist, and the small amount of remaining ones are not in use anymore. Remove the compatible strings reserved for it, as, quite frankly, Cheza is no more. Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20250716-topic-goodnight_cheza-v2-2-6fa8d3261813@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5e4ca587f56319c3c9800b9d1a97443b9c364a15 Author: Konrad Dybcio Date: Wed Jul 16 12:16:07 2025 +0200 arm64: dts: qcom: Remove sdm845-cheza boards Cheza was a prototype board, used mainly by the ChromeOS folks, whose former efforts on making linux-arm-msm better we greatly appreciate. There are close to zero known-working devices at this point in time (see the link below) and it was never productized. Remove it to ease maintenance burden. Link: https://lore.kernel.org/linux-arm-msm/5567e441-055d-443a-b117-ec16b53dc059@oss.qualcomm.com/ Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20250716-topic-goodnight_cheza-v2-1-6fa8d3261813@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 754dbf164acd4d22dd7a5241b1880f54546d68f2 Author: Christopher Orr Date: Tue Aug 5 21:27:55 2025 -0400 drm/panel-edp: Add SHP LQ134Z1 panel for Dell XPS 9345 Introduce high-res OLED panel for the Dell XPS 9345 These timings were selected based on Alex Vinarkskis' commit, (6b3815c6815f07acc7eeffa8ae734d1a1c0ee817) for the LQ134N1 and seem to work fine for the high-res OLED panel on the 9345. The raw edid for this SHP panel is: 00 ff ff ff ff ff ff 00 4d 10 8f 15 00 00 00 00 2e 21 01 04 b5 1d 12 78 03 0f 95 ae 52 43 b0 26 0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 fd d7 00 a0 a0 40 fc 66 30 20 36 00 20 b4 10 00 00 18 00 00 00 fd 00 1e 78 cc cc 38 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 37 31 4d 31 81 4c 51 31 33 34 5a 31 00 00 00 00 00 02 41 0c 32 01 01 00 00 0b 41 0a 20 20 01 ea 70 20 79 02 00 20 00 13 8c 52 19 8f 15 00 00 00 00 2e 17 07 4c 51 31 33 34 5a 31 21 00 1d 40 0b 08 07 00 0a 40 06 88 e1 fa 51 3d a4 b0 66 62 0f 02 45 54 d0 5f d0 5f 00 34 13 78 26 00 09 06 00 00 00 00 00 41 00 00 22 00 14 d9 6f 08 05 ff 09 9f 00 2f 00 1f 00 3f 06 5d 00 02 00 05 00 25 01 09 d9 6f 08 d9 6f 08 1e 78 80 81 00 0b e3 05 80 00 e6 06 05 01 6a 6a 39 00 00 00 00 00 00 58 90 Signed-off-by: Christopher Orr Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/aJKvm3SlhLGHW4qn@jander commit 5816bf4273edb32716a88c796e0b04f0e12962eb Author: Blaise Boscaccy Date: Tue Jul 22 14:21:34 2025 -0700 lsm,selinux: Add LSM blob support for BPF objects This patch introduces LSM blob support for BPF maps, programs, and tokens to enable LSM stacking and multiplexing of LSM modules that govern BPF objects. Additionally, the existing BPF hooks used by SELinux have been updated to utilize the new blob infrastructure, removing the assumption of exclusive ownership of the security pointer. Signed-off-by: Blaise Boscaccy [PM: dropped local variable init, style fixes] Signed-off-by: Paul Moore commit e5bc887413e513a2cb658370dd09fa9e1702fb3b Author: Paul Moore Date: Wed Aug 6 17:17:07 2025 -0400 lsm: use lsm_blob_alloc() in lsm_bdev_alloc() Convert the lsm_bdev_alloc() function to use the lsm_blob_alloc() helper like all of the other LSM security blob allocators. Reviewed-by: Casey Schaufler Acked-by: Serge Hallyn Signed-off-by: Paul Moore commit bc6776fab8455762089274d469a67d104e3b96ae Author: Shivnandan Kumar Date: Wed Jul 16 14:25:47 2025 +0200 arm64: dts: qcom: sm8750: Add BWMONs Add the CPU BWMONs for SM8750 SoCs. Notably, the one related to cluster0 requires that it's mapped with the nE memory attribute. This is specific to a single instance, on this platform only and should not be mimicked elsewhere. Signed-off-by: Shivnandan Kumar [konrad: add nonposted-mmio where necessary, re-sort nodes] Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250716-8750_cpubwmon-v4-2-12212098e90f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e2ec684f82536d62e0d60663ed3689455a9b0b9f Author: Arseniy Velikanov Date: Wed Jul 16 18:10:41 2025 +0400 arm64: dts: sm8250-xiaomi-pipa: Update battery info Added max design microvolt. Merged battery info into one node, since pmic fuel-gauge uses mixed info about dual-cell battery. Reviewed-by: Luka Panio Signed-off-by: Arseniy Velikanov Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250716141041.24507-3-me@adomerle.pw Signed-off-by: Bjorn Andersson commit 56197c8737b88d300cda97cd71b64b8a93cf6f70 Author: Arseniy Velikanov Date: Wed Jul 16 18:10:40 2025 +0400 arm64: dts: qcom: sm8250-xiaomi-pipa: Drop unused bq27z561 It looks like the fuel gauge is not connected to the battery, it reports nonsense info. Downstream kernel uses pmic fg. Reviewed-by: Luka Panio Signed-off-by: Arseniy Velikanov Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250716141041.24507-2-me@adomerle.pw Signed-off-by: Bjorn Andersson commit 92d05aceadbd799b416ad08bf2f741a096bf3e56 Author: Arseniy Velikanov Date: Wed Jul 16 18:10:39 2025 +0400 arm64: dts: qcom: sm8250-xiaomi-pipa: Drop nonexistent pm8009 pmic PM8009 was erroneously added since this device doesn't actually have it. It triggers a big critical error at boot, so we're drop it. Fixes: 264beb3cbd0d ("arm64: dts: qcom: sm8250-xiaomi-pipa: Add initial device tree") Reviewed-by: Luka Panio Signed-off-by: Arseniy Velikanov Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250716141041.24507-1-me@adomerle.pw Signed-off-by: Bjorn Andersson commit 474aa14da0e160f2f3fb002b64b8363ae91f9590 Author: Krzysztof Kozlowski Date: Wed Jul 16 18:24:13 2025 +0200 dt-bindings: arm: qcom-soc: Document new Milos and Glymur SoCs Extend the schema enforcing correct SoC-block naming to cover Milos (compatibles already accepted by some maintainers for next release) and Glymur (posted on mailing lists [1]) SoCs. Link: https://lore.kernel.org/linux-devicetree/20250716152017.4070029-1-pankaj.patil@oss.qualcomm.com/ [1] Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250716162412.27471-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit a6c4d92fcc74b4402d1ecdf6f4a7304a37a69ada Author: Luca Weiss Date: Thu Jul 17 08:54:46 2025 +0200 dt-bindings: soc: qcom,rpmh-rsc: Remove double colon from description No double colon is necessary in the description. Fix it. Reported-by: Rob Herring Closes: https://lore.kernel.org/lkml/20250625150458.GA1182597-robh@kernel.org/ Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-bindings-double-colon-v1-3-c04abc180fcd@fairphone.com Signed-off-by: Bjorn Andersson commit fba47ba8c8a8ffa9d8ad1836396837a998bb5153 Author: Ziyue Zhang Date: Thu Jul 17 15:27:46 2025 +0800 arm64: dts: qcom: qcs615: Set LDO12A regulator to HPM to avoid boot hang On certain platforms (e.g., QCS615), consumers of LDO12A—such as PCIe, UFS, and eMMC—may draw more than 10mA of current during boot. This can exceed the regulator's limit in Low Power Mode (LPM), triggering current limit protection and causing the system to hang. To address this, there are two possible approaches: a) Set the regulator's initial mode to High Performance Mode (HPM) in the device tree. b) Keep the default LPM setting and have each consumer driver explicitly set its current load. Since some regulators are shared among multiple consumers, and setting the current must be coordinated across all of them, we will initially adopt option a by setting the regulator to HPM. We can later migrate to option b when the timing is appropriate and all consumer drivers are ready. Signed-off-by: Ziyue Zhang Signed-off-by: Tingguo Cheng Link: https://lore.kernel.org/r/20250717072746.987298-1-quic_ziyuzhan@quicinc.com Signed-off-by: Bjorn Andersson commit 84f3849d0526b22589dd5b4a5634ed4235a6ccf9 Author: Krishna Chaitanya Chundru Date: Thu Jul 17 16:10:57 2025 +0530 arm64: dts: qcom: qcs6490-rb3gen2: Add missing clkreq pinctrl property Add the missing clkreq pinctrl entry to the PCIe1 node. This ensures proper configuration of the CLKREQ# signal, which is needed for proper functioning of PCIe ASPM. Signed-off-by: Krishna Chaitanya Chundru Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250717-clkreq-v1-1-5a82c7e8e891@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5ca3d42384a66bcb66f91d75da16ec9e9f053aab Author: George Moussalem Date: Mon Jul 21 10:04:36 2025 +0400 arm64: dts: qcom: Update IPQ5018 xo_board_clk to use fixed factor clock The xo_board_clk is fixed to 24 MHZ, which is routed from WiFi output clock 96 MHZ (also being the reference clock of CMN PLL) divided by 4 to the analog block routing channel. Update the xo_board_clk nodes in the board DTS files to use clock-div/clock-mult accordingly. Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250721-ipq5018-cmn-pll-v5-2-4cbf3479af65@outlook.com Signed-off-by: Bjorn Andersson commit c006b249c54441dd8a3a493c7c87158f441f8178 Author: George Moussalem Date: Mon Jul 21 10:04:35 2025 +0400 arm64: dts: ipq5018: Add CMN PLL node Add CMN PLL node for enabling output clocks to the networking hardware blocks on IPQ5018 devices. The reference clock of CMN PLL is routed from XO to the CMN PLL through the internal WiFi block. .XO (48 MHZ) --> WiFi (multiplier/divider)--> 96 MHZ to CMN PLL. Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250721-ipq5018-cmn-pll-v5-1-4cbf3479af65@outlook.com Signed-off-by: Bjorn Andersson commit ed5789ba7c2ce548f01ebbdbd7488dd9cccc4513 Author: George Moussalem Date: Mon Jul 21 10:23:15 2025 +0400 arm64: dts: qcom: ipq5018: Add crypto nodes IPQ5018 uses Qualcomm QCE crypto engine v5.1 which is already supported. So let's add the dts nodes for its DMA v1.7.4 and QCE itself. Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250721-ipq5018-crypto-v3-1-b9cd9b0ef147@outlook.com Signed-off-by: Bjorn Andersson commit bf258fdaa2bcbafa04bf1ad646e8ed42e13033cb Author: George Moussalem Date: Mon Jul 21 10:30:46 2025 +0400 arm64: dts: qcom: ipq5018: add PRNG node PRNG inside of IPQ5018 is already supported, so let's add the node for it. Signed-off-by: George Moussalem Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250721-ipq5018-prng-v1-1-474310e0575d@outlook.com Signed-off-by: Bjorn Andersson commit bebacd802b51fae87e04a0f2b6eeb66ac259c14e Author: Raviteja Laggyshetty Date: Tue Jul 22 05:50:39 2025 +0000 arm64: dts: qcom: qcs8300: Add EPSS l3 interconnect provider node and CPUCP OPP tables to scale DDR/L3 Add Epoch Subsystem (EPSS) L3 interconnect provider node and OPP tables required to scale DDR and L3 per freq-domain on QCS8300 platform. As QCS8300 and SA8775P SoCs have same EPSS hardware, added SA8775P compatible as fallback for QCS8300 EPSS device node. Reviewed-by: Konrad Dybcio Co-developed-by: Imran Shaik Signed-off-by: Imran Shaik Signed-off-by: Raviteja Laggyshetty Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250722055039.135140-2-raviteja.laggyshetty@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit df758a868dbc90cae98044d52a9d753575f50cfa Author: Qiang Yu Date: Tue Jul 22 17:11:51 2025 +0800 arm64: dts: qcom: x1e80100-qcp: enable pcie3 x8 slot for X1E80100-QCP Add perst, wake and clkreq sideband signals and required regulators in PCIe3 controller and PHY device tree node. Describe the voltage rails of the x8 PCI slots for PCIe3 port. Signed-off-by: Qiang Yu Signed-off-by: Wenbin Yao Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250722091151.1423332-4-quic_wenbyao@quicinc.com Signed-off-by: Bjorn Andersson commit 6facfaff0fe3b4d5903bed6164eb5e60ee6cdb8f Author: Qiang Yu Date: Tue Jul 22 17:11:50 2025 +0800 arm64: dts: qcom: x1e80100: add bus topology for PCIe domain 3 Add pcie3_port node to represent the PCIe bridge of PCIe3 so that PCI slot voltage rails can be described under this node in the board's dts. Signed-off-by: Qiang Yu Signed-off-by: Wenbin Yao Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250722091151.1423332-3-quic_wenbyao@quicinc.com Signed-off-by: Bjorn Andersson commit f93e5882134a314760d47536d93b57fbd32d0da1 Author: Krzysztof Kozlowski Date: Thu Jul 24 15:24:37 2025 +0200 dt-bindings: arm: qcom: Drop redundant free-form SoC list The schema and Devicetree specification defines how list of top-level compatibles should be created, thus first paragraph explaining this is completely redundant. The list of SoCs is redundant as well, because the schema lists them. On the other hand, Linux kernel should not be place to store marketing names of some company products, so such list is irrelevant here. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250724132436.77160-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 Author: Marcos Del Sol Vives Date: Sun Jul 6 01:32:08 2025 +0200 PCI: Disable MSI on RDC PCI to PCIe bridges RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do not support MSIs. If enabled, interrupts generated by PCIe devices never reach the processor. I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs need to be disabled for them. Signed-off-by: Marcos Del Sol Vives Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet commit 1d33d9e46c08e952853e821ab8e0b46cb248bc1f Author: Colin Ian King Date: Thu Jul 31 11:00:17 2025 +0100 PCI: hotplug: Clean up spaces in messages Remove extraneous space before newline in messages. Signed-off-by: Colin Ian King [bhelgaas: squash into one patch, commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250731100017.2165781-1-colin.i.king@gmail.com Link: https://patch.msgid.link/20250731101036.2167812-1-colin.i.king@gmail.com commit a22250fe933dbd1da9a9683506ae3f489ccc579d Author: Ilpo Järvinen Date: Tue Jun 10 14:48:02 2025 +0300 PCI: Add Extended Tag + MRRS quirk for Xeon 6 When bifurcated to x2, Xeon 6 Root Port performance is sensitive to the configuration of Extended Tags, Max Read Request Size (MRRS), and 10-Bit Tag Requester (note: there is currently no 10-Bit Tag support in the kernel). While those can be configured to the recommended values by FW, kernel may decide to overwrite the initial values. Add a quirk that disallows enabling Extended Tags and setting MRRS larger than 128B for devices under Xeon 6 Root Ports if the Root Port is bifurcated to x2. Use the host bridge's enable_device hook to overwrite MRRS if it's set to >128B for the device to be enabled. The earlier attempts to implement this quirk polluted PCI core code with the checks necessary to support this quirk. Using the enable_device hook keeps the quirk well-contained, away from the PCI core code. Suggested-by: Lukas Wunner Link: https://cdrdv2.intel.com/v1/dl/getContent/837176 Signed-off-by: Ilpo Järvinen [bhelgaas: 2x -> x2, rename quirk] Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Reviewed-by: Dan Williams Link: https://patch.msgid.link/20250610114802.7460-1-ilpo.jarvinen@linux.intel.com commit c763fae8c4231e426033f62c21be60db4b6659a9 Author: Ilpo Järvinen Date: Tue Jun 10 13:58:20 2025 +0300 PCI: Clean up pci_scan_child_bus_extend() loop pci_scan_child_bus_extend() open-codes device number iteration in the for loop. Convert to use PCI_DEVFN() and add PCI_MAX_NR_DEVS (there seems to be no pre-existing define for this purpose). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250610105820.7126-3-ilpo.jarvinen@linux.intel.com commit aa84931ba7f989c263a79a3a962524b5830d0e64 Author: Ilpo Järvinen Date: Tue Jun 10 13:58:19 2025 +0300 PCI: Clean up early_dump_pci_device() Convert 256 to PCI_CFG_SPACE_SIZE and 4 to sizeof(u32) and avoid i / 4 construct by changing the iteration. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250610105820.7126-2-ilpo.jarvinen@linux.intel.com commit 24b2d3c452e5f3facaf9c664aaaa9fc7fa4bc6bb Author: Ilpo Järvinen Date: Tue Jun 10 13:58:18 2025 +0300 PCI: Use header type defines in pci_setup_device() Replace literals with PCI_HEADER_TYPE_* defines in pci_setup_device(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20250610105820.7126-1-ilpo.jarvinen@linux.intel.com commit cb69daf085b5974fef2df9789f8c1b35e78e7913 Author: Nick Hu Date: Fri Aug 1 15:01:12 2025 +0800 dt-bindings: riscv: Add SiFive vendor extensions description Add description for SiFive vendor extensions "xsfcflushdlone", "xsfpgflushdlone" and "xsfcease". This is used in the SBI implementation [1]. Link: https://lore.kernel.org/opensbi/20250708074940.10904-1-nick.hu@sifive.com/ [1] Signed-off-by: Nick Hu Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit c2a0c5156a40c40edb0cce80ce11c97ab39c67e3 Author: Eric Biggers Date: Mon Aug 11 11:26:31 2025 -0700 lib/crc: Use underlying functions instead of crypto_simd_usable() Since crc_kunit now tests the fallback code paths without using crypto_simd_disabled_for_test, make the CRC code just use the underlying may_use_simd() and irq_fpu_usable() functions directly instead of crypto_simd_usable(). This eliminates an unnecessary layer. Take the opportunity to add likely() and unlikely() annotations as well. Link: https://lore.kernel.org/r/20250811182631.376302-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 842ec21357f15ff722695dd87daf99823f297185 Author: Eric Biggers Date: Mon Aug 11 11:26:30 2025 -0700 lib/crc: crc_kunit: Test CRC computation in interrupt contexts Test that if CRCs are computed in task, softirq, and hardirq context concurrently, then all results are as expected. Implement this using kunit_run_irq_test() which is also used by the lib/crypto/ tests. As with the corresponding lib/crypto/ tests, the purpose of this is to test fallback code paths and to exercise edge cases in the architecture's support for in-kernel FPU/SIMD/vector. Remove the code from crc_test() that sometimes disabled interrupts, as that was just an incomplete attempt to achieve similar test coverage. Link: https://lore.kernel.org/r/20250811182631.376302-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b41dc83f0790fd3488a45b31de0b0c3af7d441fe Author: Eric Biggers Date: Mon Aug 11 11:26:29 2025 -0700 kunit, lib/crypto: Move run_irq_test() to common header Rename run_irq_test() to kunit_run_irq_test() and move it to a public header so that it can be reused by crc_kunit. Link: https://lore.kernel.org/r/20250811182631.376302-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8def31f8c1e1f3d28e4ee3dcf6818a74c9a9a2f7 Author: Krzysztof Kozlowski Date: Sun Jul 27 21:36:53 2025 +0200 arm64: dts: qcom: sm8650: Sort nodes by unit address Qualcomm DTS uses sorting of MMIO nodes by the unit address, so move few nodes in SM8650 DTSI to fix that. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250727193652.4029-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 1a67f85c690658a35cac41c070df33e3e5a72868 Author: Val Packett Date: Sun May 25 06:53:33 2025 -0300 dt-bindings: arm: qcom: Add Dell Latitude 7455 Document the X1E80100-based Dell Latitude 7455 laptop. Signed-off-by: Val Packett Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525095341.12462-3-val@packett.cool Signed-off-by: Bjorn Andersson commit 8d2a8e8dc448f218b36b3b9f3790c9c0dfaa2b74 Author: George Moussalem Date: Thu May 1 13:20:52 2025 +0400 arm64: dts: qcom: ipq5018: Add SPI nand support Add QPIC SPI NAND support for IPQ5018 SoC. Signed-off-by: George Moussalem Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250501-ipq5018-spi-qpic-snand-v1-2-31e01fbb606f@outlook.com Signed-off-by: Bjorn Andersson commit 25197809e78c5ff521353acce00406cc2b4bbc16 Author: Bartosz Golaszewski Date: Mon Aug 11 17:06:50 2025 +0200 arm64: dts: qcom: sdm845-samsung-starqltechn: fix GPIO lookup flags for i2c SDA and SCL The I2C GPIO bus driver enforces the SDA and SCL pins as open-drain outputs but the lookup flags in the DTS don't reflect that triggering warnings from GPIO core. Add the appropriate flags. Reviewed-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250811-qcom-gpio-lookup-open-drain-v1-3-b5496f80e047@linaro.org Signed-off-by: Bjorn Andersson commit f07f492773b70efe01f9966703fef658b428f17b Author: Bartosz Golaszewski Date: Mon Aug 11 17:06:49 2025 +0200 arm64: dts: qcom: qrb4210-rb2: fix GPIO lookup flags for i2c SDA and SCL The I2C GPIO bus driver enforces the SDA and SCL pins as open-drain outputs but the lookup flags in the DTS don't reflect that triggering warnings from GPIO core. Add the appropriate flags. Reported-by: Alexey Klimov Reviewed-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250811-qcom-gpio-lookup-open-drain-v1-2-b5496f80e047@linaro.org Signed-off-by: Bjorn Andersson commit b2659ddbc2999e8b56edbcd12251b3e469bd0bca Author: Bartosz Golaszewski Date: Mon Aug 11 17:06:48 2025 +0200 arm64: dts: qcom: qrb2210-rb1: fix GPIO lookup flags for i2c SDA and SCL The I2C GPIO bus driver enforces the SDA and SCL pins as open-drain outputs but the lookup flags in the DTS don't reflect that triggering warnings from GPIO core. Add the appropriate flags. Tested-by: Alexey Klimov Reported-by: Alexey Klimov Reviewed-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250811-qcom-gpio-lookup-open-drain-v1-1-b5496f80e047@linaro.org Signed-off-by: Bjorn Andersson commit 35e0b432d5ca73b7498398d7eb369c5665cc3ab1 Author: Luca Weiss Date: Wed Jun 25 11:11:25 2025 +0200 arm64: dts: qcom: pmk8550: Correct gpio node name The reg for the GPIOs is 0xb800 and not 0x8800, so fix this copy-paste mistake. Fixes: e9c0a4e48489 ("arm64: dts: qcom: Add PMK8550 pmic dtsi") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250625-pmk8550-gpio-name-v1-1-58402849f365@fairphone.com Signed-off-by: Bjorn Andersson commit b5634bf97913756c208bb29f6061ee39154458cf Author: Yu Zhang(Yuriy) Date: Sun Jul 27 18:22:37 2025 +0800 arm64: dts: qcom: qcs615-ride: Enable WiFi/BT nodes Enable WiFi/BT on qcs615-ride by adding a node for the PMU module of the WCN6855 and assigning its LDO power outputs to the existing WiFi/BT module. Signed-off-by: Yu Zhang (Yuriy) Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250727-615-v7-2-2adb6233bbb9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e13555a3e17b572609901c0f1992f03243a45121 Author: Yu Zhang(Yuriy) Date: Sun Jul 27 18:22:36 2025 +0800 arm64: dts: qcom: qcs615: add a PCIe port for WLAN Add an original PCIe port for WLAN. This port will be referenced and supplemented by specific WLAN devices. Signed-off-by: Yu Zhang (Yuriy) Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250727-615-v7-1-2adb6233bbb9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 414be2b5a79de8694db1e26a3ea63a2aee5957ad Author: Krishna chaitanya chundru Date: Fri Jul 25 19:23:46 2025 +0800 arm64: dts: qcom: qcs615-ride: Enable PCIe interface Add platform configurations in devicetree for PCIe, board related gpios, PMIC regulators, etc. Reviewed-by: Konrad Dybcio Signed-off-by: Krishna chaitanya chundru Signed-off-by: Ziyue Zhang Link: https://lore.kernel.org/r/20250725112346.614316-3-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 718cc7542a000e2911c8d18878ba2eac5f29e744 Author: Krishna chaitanya chundru Date: Fri Jul 25 19:23:45 2025 +0800 arm64: dts: qcom: qcs615: enable pcie Add configurations in devicetree for PCIe0, including registers, clocks, interrupts and phy setting sequence. Add PCIe lane equalization preset properties for 8 GT/s. Signed-off-by: Krishna chaitanya chundru Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Signed-off-by: Ziyue Zhang Link: https://lore.kernel.org/r/20250725112346.614316-2-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f5f2b835e316df29b89e28ed7e467df473932e8d Author: George Moussalem Date: Mon Jun 30 16:35:02 2025 +0400 arm64: dts: qcom: ipq5018: Add GE PHY to internal mdio bus The IPQ5018 SoC contains an internal GE PHY, always at phy address 7. As such, let's add the GE PHY node to the SoC dtsi. The LDO controller found in the SoC must be enabled to provide constant low voltages to the PHY. The mdio-ipq4019 driver already has support for this, so adding the appropriate TCSR register offset. In addition, the GE PHY outputs both the RX and TX clocks to the GCC which gate controls them and routes them back to the PHY itself. So let's create two DT fixed clocks and register them in the GCC node. Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250630-ipq5018-ge-phy-v6-3-01be06378c15@outlook.com Signed-off-by: Bjorn Andersson commit 1e2261a669a9596ba435c6fe524e026bac0f0e2f Author: George Moussalem Date: Mon Jun 30 16:35:01 2025 +0400 arm64: dts: qcom: ipq5018: Add MDIO buses IPQ5018 contains two mdio buses of which one bus is used to control the SoC's internal GE PHY, while the other bus is connected to external PHYs or switches. There's already support for IPQ5018 in the mdio-ipq4019 driver, so let's simply add the mdio nodes for them. Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250630-ipq5018-ge-phy-v6-2-01be06378c15@outlook.com Signed-off-by: Bjorn Andersson commit e5612530e325897da9a70dc78828d6ff2138ae32 Author: Luo Jie Date: Tue Jun 10 18:35:21 2025 +0800 arm64: dts: qcom: Update IPQ5424 xo_board to use fixed factor clock xo_board is fixed to 24 MHZ, which is routed from WiFi output clock 48 MHZ (also being the reference clock of CMN PLL) divided 2 by analog block routing channel. Reviewed-by: Konrad Dybcio Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20250610-qcom_ipq5424_cmnpll-v3-4-ceada8165645@quicinc.com Signed-off-by: Bjorn Andersson commit 682c9d0e788b2e35ece1cbae5448bec1dadaf9af Author: Luo Jie Date: Tue Jun 10 18:35:20 2025 +0800 arm64: dts: qcom: ipq5424: Add CMN PLL node Add CMN PLL node for enabling output clocks to the networking hardware blocks on IPQ5424 devices. The reference clock of CMN PLL is routed from XO to the CMN PLL through the internal WiFi block. .XO (48 MHZ or 96 MHZ or 192 MHZ)-->WiFi (multiplier/divider)--> 48 MHZ to CMN PLL. Reviewed-by: Konrad Dybcio Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20250610-qcom_ipq5424_cmnpll-v3-3-ceada8165645@quicinc.com Signed-off-by: Bjorn Andersson commit 5ce2aa520d3f87e54338a3874a76139ad6341bc2 Author: Luca Weiss Date: Thu May 1 08:48:51 2025 +0200 arm64: dts: qcom: sm7225-fairphone-fp4: Enable USB audio offload support Enable USB audio offloading which allows to play audio via a USB-C headset with lower power consumption and enabling some other features. This can be used like the following: $ amixer -c0 cset name='USB_RX Audio Mixer MultiMedia1' On $ aplay --device=plughw:0,0 test.wav Compared to regular playback to the USB sound card no xhci-hcd interrupts appear during playback, instead the ADSP will be handling the USB transfers. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250501-fp4-usb-audio-offload-v2-5-30f4596281cd@fairphone.com Signed-off-by: Bjorn Andersson commit bbc5a9b5d9d91e9159be95856363979829ec0b80 Author: Luca Weiss Date: Thu May 1 08:48:50 2025 +0200 arm64: dts: qcom: sm6350: Add q6usbdai node Add a node for q6usb which handles USB audio offloading, allowing to play audio via a USB-C headset with lower power consumption and enabling some other features. We also need to set num-hc-interrupters for the dwc3 for the q6usb to be able to use its sideband interrupter. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250501-fp4-usb-audio-offload-v2-4-30f4596281cd@fairphone.com Signed-off-by: Bjorn Andersson commit 6a5e9b9738a32229e2673d4eccfcbfe2ef3a1ab4 Author: Viken Dadhaniya Date: Mon Jun 30 12:13:38 2025 +0530 arm64: dts: qcom: qcs615: add missing dt property in QUP SEs Add the missing required-opps and operating-points-v2 properties to several I2C, SPI, and UART nodes in the QUP SEs. Fixes: f6746dc9e379 ("arm64: dts: qcom: qcs615: Add QUPv3 configuration") Cc: stable@vger.kernel.org Signed-off-by: Viken Dadhaniya Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250630064338.2487409-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ebf6fc452ad61f79d801f68f8298c7d00796c580 Author: Jens Glathe Date: Tue Jun 24 08:46:00 2025 +0200 arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support To enable Bluetooth pwrseq appears to be required for the WCN7850. Add the nodes from QCP, add the TODO hint for vreg_wcn_0p95 and vreg_wcn_1p9 Add uart14 for the BT interface. Tested-by: Anthony Ruhier Signed-off-by: Jens Glathe Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250624-slim7x-bt-v3-1-7ada18058419@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 1aa0b4e364361ccaf047a34308527ccf7441feef Author: Akhil P Oommen Date: Mon Jun 23 19:42:09 2025 +0530 arm64: dts: qcom: x1p42100: Add GPU support X1P42100 SoC has a new GPU called Adreno X1-45 which is a smaller version of Adreno X1-85 GPU. Describe this new GPU and also add the secure gpu firmware path that should used for X1P42100 CRD. Tested-by: Jens Glathe Reviewed-by: Konrad Dybcio Tested-by: Aleksandrs Vinarskis # x1-26-100 Signed-off-by: Akhil P Oommen Link: https://lore.kernel.org/r/20250623-x1p-adreno-v4-4-d2575c839cbb@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 71ef5e99e925fc4e3f8bfd071a546c4dd6b45825 Author: Konrad Dybcio Date: Sat Jun 14 21:05:22 2025 +0200 arm64: dts: qcom: sm8250: Drop venus-enc/decoder node Commit 687bfbba5a1c ("media: venus: Add support for static video encoder/decoder declarations") invalidates these empty nodes. Get rid of them. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250614-topic-encdec-v1-4-f974c3e9cb43@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit dce1122f076c7f4acc809cd2c9b7e3ed3fe19a4c Author: Konrad Dybcio Date: Sat Jun 14 21:05:21 2025 +0200 arm64: dts: qcom: sdm845: Drop venus-enc/decoder node Commit 687bfbba5a1c ("media: venus: Add support for static video encoder/decoder declarations") invalidates these empty nodes. Get rid of them. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250614-topic-encdec-v1-3-f974c3e9cb43@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1f67c23f98bd64d4034898af5a149304a09080be Author: Konrad Dybcio Date: Sat Jun 14 21:05:20 2025 +0200 arm64: dts: qcom: sc7180: Drop venus-enc/decoder node Commit 687bfbba5a1c ("media: venus: Add support for static video encoder/decoder declarations") invalidates these empty nodes. Get rid of them. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250614-topic-encdec-v1-2-f974c3e9cb43@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8ff47ada5e95577fdb8a1da903d37c75636808e6 Author: Konrad Dybcio Date: Sat Jun 14 21:05:19 2025 +0200 arm64: dts: qcom: msm8916: Drop venus-enc/decoder node Commit 687bfbba5a1c ("media: venus: Add support for static video encoder/decoder declarations") invalidates these empty nodes. Get rid of them. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250614-topic-encdec-v1-1-f974c3e9cb43@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9af4e5351229a4364030c6102babc6af831fbb84 Author: Dmitry Baryshkov Date: Wed Jun 4 16:40:29 2025 +0300 arm64: dts: qcom: rename qcs615.dtsi to sm6150.dtsi The established practice is to have the base DTSI file named after the base SoC name (see examples of qrb5165-rb5.dts vs sm8250.dtsi, qrb2210-rb1.dts vs qcm2290.dtsi, qrb4210-rb2.dts vs sm4250.dtsi vs sm6115.dtsi). Rename the SoC dtsi file accordingly and add "qcom,sm6150" as a fallback compat string. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250604-qcs615-sm6150-v1-2-2f01fd46c365@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3e0252ea5d91ac21c6b606f71f42733b526646df Author: Dmitry Baryshkov Date: Wed Jun 4 16:40:28 2025 +0300 dt-bindings: arm: qcom: add qcom,sm6150 fallback compatible to QCS615 QCS615 SoC is based on the earlier mobile chip SM6150. Add corresponding compatible string to follow established practice for IoT chips. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250604-qcs615-sm6150-v1-1-2f01fd46c365@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0403e42f2fbb43fe38d645fb399727327e1002c6 Author: Dmitry Baryshkov Date: Mon Jun 2 10:23:35 2025 +0300 arm64: dts: qcom: sa8775p: rename bus clock to follow the bindings DT bindings for the DPU SA8775P declare the first clock to be "nrt_bus", not just "bus". Fix the DT file accordingly. Fixes: 2f39d2d46c73 ("arm64: dts: qcom: sa8775p: add display dt nodes for MDSS0 and DPU") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250602-sa8775p-fix-dts-v1-1-f9f6271b33a3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c02716951e665181aecf59c663622689a576bccb Author: Dmitry Baryshkov Date: Sun Jun 8 19:16:05 2025 +0300 arm64: dts: qcom: sdm850-lenovo-yoga-c630: add routing for second USB connector On Lenovo Yoga C630 second (left) Type-C port is not connected to the SoC directly. Instead it has a USB hub, which also powers on the onboard USB camera. Describe these signal lines properly. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250608-c630-ports-v1-1-e4951db96efa@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e2a01c3b1033ae39c2153ab5e84ae7167016826c Author: Dmitry Baryshkov Date: Wed Jun 18 20:49:53 2025 +0300 arm64: dts: qcom: sar2130p: use defines for DSI PHY clocks Use defined IDs to reference DSI PHY clocks instead of using raw numbers. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250618-sar2130p-fix-mdss-v1-3-78c2fb9e9fba@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b1f622224b8e5da3d08dac33ad76b0672c21eded Author: Dmitry Baryshkov Date: Wed Jun 18 20:49:52 2025 +0300 arm64: dts: qcom: sar2130p: correct VBIF region size for MDSS Correct the VBIF region size for the display device on the SAR1230P platform. Fixes: 541d0b2f4dcd ("arm64: dts: qcom: sar2130p: add display nodes") Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/all/c14dfd37-7d12-40c3-8281-fd0a7410813e@oss.qualcomm.com/ Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250618-sar2130p-fix-mdss-v1-2-78c2fb9e9fba@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5bde57b9cd3c769f5f4c85c021c37e2d151ca228 Author: Dmitry Baryshkov Date: Wed Jun 18 20:49:51 2025 +0300 arm64: dts: qcom: sar2130p: use TAG_ALWAYS for MDSS's mdp0-mem path Switch the main memory interconnect of the MDSS device to use QCOM_ICC_TAG_ALWAYS instead of _ACTIVE_ONLY. Fixes: 541d0b2f4dcd ("arm64: dts: qcom: sar2130p: add display nodes") Suggested-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250618-sar2130p-fix-mdss-v1-1-78c2fb9e9fba@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e08d75e4834cb9a6224bfa090fce0e6259113d7a Author: Dmitry Baryshkov Date: Sat Jun 21 21:20:02 2025 +0300 arm64: dts: qcom: sdm845: rename DisplayPort labels Rename DP labels to have mdss_ prefix, so that corresponding device nodes are grouped together. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250621-sdm845-dp-rename-v1-1-6f7f13443b43@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 450a80623e3b8bb5dae59e0d56046fc3d0a88f3b Author: Sricharan Ramabadhran Date: Thu Jun 12 10:46:14 2025 +0400 arm64: dts: qcom: ipq5018: Add tsens node IPQ5018 has tsens V1.0 IP with 5 sensors, though 4 are in use. There is no RPM, so tsens has to be manually enabled. Adding the tsens and nvmem nodes and adding 4 thermal sensors (zones). The critical trip temperature is set to 120'C with an action to reboot. In addition, adding a cooling device to the CPU thermal zone which uses CPU frequency scaling. Reviewed-by: Dmitry Baryshkov Signed-off-by: Sricharan Ramabadhran Signed-off-by: George Moussalem Reviewed-by: Konrad Dybcio [bjorn: Added tsens-v1 fallback compatible, per binding] Link: https://lore.kernel.org/r/20250612-ipq5018-tsens-v13-2-a210f3683240@outlook.com commit de68c05189cc4508c3ac4e1e44da1ddb16b1bceb Author: Andrea Righi Date: Mon Aug 4 13:04:49 2025 +0200 tools/sched_ext: Receive updates from SCX repo Receive tools/sched_ext updates form https://github.com/sched-ext/scx to sync userspace bits: - basic BPF arena allocator abstractions, - additional process flags definitions, - fixed is_migration_disabled() helper, - separate out user_exit_info BPF and user space code. This also fixes the following warning when building the selftests: tools/sched_ext/include/scx/common.bpf.h:550:9: warning: 'likely' macro redefined [-Wmacro-redefined] 550 | #define likely(x) __builtin_expect(!!(x), 1) | ^ Co-developed-by: Cheng-Yang Chou Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 94c29677640312fcfab261bddc1006bc43efe4ba Author: Wojciech Siudy Date: Tue Jun 3 14:47:21 2025 +0200 i2c: muxes: pca954x: Reset if (de)select fails If the channel selection or deselection times out, it indicates a failure in the mux's I2C subsystem. Without sending a reset pulse, a power-on-reset of the entire device would be required to restore communication. The datasheet specifies a minimum hold time of 4 ns for the reset pulse, but due to the path's capacitance and themux having its own clock, it is recommended to extend this to approximately 1 us. Since reset controller is used, there is no need to take care of other devices sharing the same reset line. Signed-off-by: Wojciech Siudy [wsa: removed superfluous prinout, unneeded braces and fixed indent] Signed-off-by: Wolfram Sang commit 690de2902dca98aec96de004428c020ca902f047 Author: Wojciech Siudy Date: Tue Jun 3 14:47:20 2025 +0200 i2c: muxes: pca954x: Use reset controller only Fallback to legacy reset-gpios is no more needed, because the framework can use reset-gpios properity now as well. Signed-off-by: Wojciech Siudy [wsa: fixed whitespace issue] Signed-off-by: Wolfram Sang commit 0e6608d4938eb209616e8673c95364bb2a7d55bd Author: Qianfeng Rong Date: Sun Aug 3 18:22:40 2025 +0800 fscrypt: Remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250803102243.623705-3-rongqianfeng@vivo.com Signed-off-by: Eric Biggers commit 2115dc3e3376b7bd5021950b45eebbcd992e9be9 Author: Bart Van Assche Date: Thu Jul 24 08:34:42 2025 -0700 docs: filesystems: sysfs: Recommend sysfs_emit() for new code only The advantages of converting existing sysfs show() methods to sysfs_emit() and sysfs_emit_at() do not outweigh the risk of introducing bugs. Hence recommend sysfs_emit() and sysfs_emit_at() only for new implementations of show() methods. Cc: Greg Kroah-Hartman Cc: James Bottomley Cc: Martin K. Petersen Signed-off-by: Bart Van Assche Reviewed-by: Martin K. Petersen Acked-by: Greg Kroah-Hartman Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250724153449.2433395-1-bvanassche@acm.org commit 3fa1095979393d5b178264cc1bdfb473e80ab774 Author: Kathiravan Thirumoorthy Date: Fri May 2 18:47:49 2025 +0530 dt-bindings: sram: qcom,imem: Document IPQ5424 compatible Add compatible for Qualcomm's IPQ5424 IMEM. Acked-by: Rob Herring (Arm) Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20250502-wdt_reset_reason-v3-1-b2dc7ace38ca@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1f590377eb3c2680cb1101fa1a6a1f20a5fc4002 Author: Ranganath V N Date: Sat Jul 26 12:06:44 2025 +0530 Documentation: Fix minor typos Corrected a few spelling errors and improved the phrasing changes since v1: --corrected as per review Signed-off-by: Ranganath V N Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250726063645.4156-1-vnranganath.20@gmail.com commit 7069b5296e968d0e7d5fd6b825f221f0d766f3ea Author: Štěpán Němec Date: Tue Jul 29 20:40:36 2025 +0200 docs: admin-guide: update to current minimum pipe size default The pipe size limit used when the fs.pipe-user-pages-soft sysctl value is reached was increased from one to two pages in commit 46c4c9d1beb7; update the documentation to match the new reality. Fixes: 46c4c9d1beb7 ("pipe: increase minimum default pipe size to 2 pages") Signed-off-by: Štěpán Němec Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250729-pipedoc-v2-1-18b8e735a9c6@smrk.net commit cbba5038ee29f16f583978d6debe486503693c70 Author: Chao Yu Date: Tue Aug 5 14:29:12 2025 +0800 f2fs: clean up f2fs_truncate_partial_cluster() Clean up codes as below: - avoid unnecessary "err > 0" check condition - use "1 << log_cluster_size" instead of F2FS_I(inode)->i_cluster_size No logic changes. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 Author: Chao Yu Date: Wed Aug 6 14:11:06 2025 +0800 f2fs: fix to zero data after EOF for compressed file correctly generic/091 may fail, then it bisects to the bad commit ba8dac350faf ("f2fs: fix to zero post-eof page"). What will cause generic/091 to fail is something like below Testcase #1: 1. write 16k as compressed blocks 2. truncate to 12k 3. truncate to 20k 4. verify data in range of [12k, 16k], however data is not zero as expected Script of Testcase #1 mkfs.f2fs -f -O extra_attr,compression /dev/vdb mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc sync truncate -s $((12*1024)) /mnt/f2fs/file truncate -s $((20*1024)) /mnt/f2fs/file dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 od /mnt/f2fs/data umount /mnt/f2fs Analisys: in step 2), we will redirty all data pages from #0 to #3 in compressed cluster, and zero page #3, in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop all page cache post eof, includeing dirtied page #3, in step 4) when we read data from page #3, it will decompressed cluster and extra random data to page #3, finally, we hit the non-zeroed data post eof. However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just let the issue be reproduced easily, w/o the commit, it can reproduce this bug w/ below Testcase #2: 1. write 16k as compressed blocks 2. truncate to 8k 3. truncate to 12k 4. truncate to 20k 5. verify data in range of [12k, 16k], however data is not zero as expected Script of Testcase #2 mkfs.f2fs -f -O extra_attr,compression /dev/vdb mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc sync truncate -s $((8*1024)) /mnt/f2fs/file truncate -s $((12*1024)) /mnt/f2fs/file truncate -s $((20*1024)) /mnt/f2fs/file echo 3 > /proc/sys/vm/drop_caches dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 od /mnt/f2fs/data umount /mnt/f2fs Anlysis: in step 2), we will redirty all data pages from #0 to #3 in compressed cluster, and zero page #2 and #3, in step 3), we will truncate page #3 in page cache, in step 4), expand file size, in step 5), hit random data post eof w/ the same reason in Testcase #1. Root Cause: In f2fs_truncate_partial_cluster(), after we truncate partial data block on compressed cluster, all pages in cluster including the one post eof will be dirtied, after another tuncation, dirty page post eof will be dropped, however on-disk compressed cluster is still valid, it may include non-zero data post eof, result in exposing previous non-zero data post eof while reading. Fix: In f2fs_truncate_partial_cluster(), let change as below to fix: - call filemap_write_and_wait_range() to flush dirty page - call truncate_pagecache() to drop pages or zero partial page post eof - call f2fs_do_truncate_blocks() to truncate non-compress cluster to last valid block Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") Reported-by: Jan Prusakowski Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb Author: Chao Yu Date: Tue Aug 5 14:29:10 2025 +0800 f2fs: fix to avoid overflow while left shift operation Should cast type of folio->index from pgoff_t to loff_t to avoid overflow while left shift operation. Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1bd119da0b93d6d61891edf2b9d036800aba687f Author: Daniel Lee Date: Mon Aug 4 23:52:27 2025 -0700 f2fs: add sysfs entry for effective lookup mode This commit introduces a new read-only sysfs entry at /sys/fs/f2fs//effective_lookup_mode. This entry displays the actual directory lookup mode F2FS is currently using. This is needed for debugging and verification, as the behavior is determined by both on-disk flags and mount options. Signed-off-by: Daniel Lee Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4fff5db420fef91d439f87f6c0d439ef291b3dd2 Author: Kim Tae Hyun Date: Sat Aug 2 21:58:01 2025 +0900 docs: update physical memory documentation by adding N_GENERIC_INITIATOR to enum node_states While reading physical_memory.rst, I noticed that N_GENERIC_INITIATOR has not been update from the node_states list, even though it's already added in commit 894c26a1c274b8eafbb4b1dad67e70e51a106061. Signed-off-by: Kim Tae Hyun Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250802125801.10068-1-kimth0312@gmail.com commit 632f0b6c3e32758e5c93d4e3c2860a3708b9853e Author: Daniel Lee Date: Mon Aug 4 23:52:26 2025 -0700 f2fs: add lookup_mode mount option For casefolded directories, f2fs may fall back to a linear search if a hash-based lookup fails. This can cause severe performance regressions. While this behavior can be controlled by userspace tools (e.g. mkfs, fsck) by setting an on-disk flag, a kernel-level solution is needed to guarantee the lookup behavior regardless of the on-disk state. This commit introduces the 'lookup_mode' mount option to provide this kernel-side control. The option accepts three values: - perf: (Default) Enforces a hash-only lookup. The linear fallback is always disabled. - compat: Enables the linear search fallback for compatibility with directory entries from older kernels. - auto: Determines the mode based on the on-disk flag, preserving the userspace-based behavior. Signed-off-by: Daniel Lee Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 76bb6a72bc1daa3d973395349f366231768f8877 Author: mason.zhang Date: Thu Jul 31 23:19:17 2025 +0800 f2fs: add error checking in do_write_page() Otherwise, the filesystem may unaware of potential file corruption. Signed-off-by: mason.zhang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e75ce117905d2830976a289e718470f3230fa30a Author: Chao Yu Date: Thu Jul 31 14:03:38 2025 +0800 f2fs: fix condition in __allow_reserved_blocks() If reserve_root mount option is not assigned, __allow_reserved_blocks() will return false, it's not correct, fix it. Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 57e74035ad5e427ed301c2dc28e2b07a1d523175 Author: Chao Yu Date: Thu Jul 31 13:34:05 2025 +0800 f2fs: add time stats of checkpoint for debug checkpoint was blocked for 18643 ms Step 0: 0 ms Step 1: 38 ms Step 2: 63 ms Step 3: 4 ms Step 4: 0 ms Step 5: 0 ms Step 6: 9 ms Step 7: 0 ms Step 8: 18277 ms Step 9: 249 ms Cc: Jan Prusakowski Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3fcf228b6494e707aef960bad33461a513f16721 Author: Chao Yu Date: Thu Jul 31 13:34:04 2025 +0800 f2fs: dump more information when checkpoint was blocked for long time generic/299 w/ mode=lfs will cause long time latency of checkpoint, let's dump more information once we hit case. CP merge: - Queued : 0 - Issued : 1 - Total : 1 - Cur time : 9765(ms) - Peak time : 9765(ms) F2FS-fs (vdc): blocked on checkpoint for 9765 ms CPU: 11 UID: 0 PID: 237 Comm: kworker/u128:29 Tainted: G O 6.16.0-rc3+ #409 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: writeback wb_workfn (flush-253:32) Call Trace: dump_stack_lvl+0x6e/0xa0 f2fs_issue_checkpoint+0x268/0x280 f2fs_write_node_pages+0x6a/0x2c0 do_writepages+0xd0/0x170 __writeback_single_inode+0x56/0x4c0 writeback_sb_inodes+0x22a/0x550 __writeback_inodes_wb+0x4c/0xf0 wb_writeback+0x300/0x400 wb_workfn+0x3de/0x500 process_one_work+0x230/0x5c0 worker_thread+0x1da/0x3d0 kthread+0x10d/0x250 ret_from_fork+0x164/0x190 ret_from_fork_asm+0x1a/0x30 Cc: Jan Prusakowski Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3feaa8a469ccb14e8adf69ae3235785182905bfc Author: Osama Albahrani Date: Mon Aug 4 18:25:14 2025 +0300 docs: aoe: Remove trailing whitespace Fix `ERROR: trailing whitespace` errors from scripts/checkpatch.pl Signed-off-by: Osama Albahrani Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250804152516.16493-1-osalbahr@gmail.com commit 119996c9a4be91f70779efe0a4f178356820249a Author: Geert Uytterhoeven Date: Thu Aug 7 09:36:01 2025 +0200 Documentation/printf: Use literal fwnode_handle When looking for fwnode_handle in the printk format documentation, it is only found in the Chinese translation: $ git grep fwnode_handle -- Documentation/*printk-formats.rst Documentation/translations/zh_CN/core-api/printk-formats.rst:用于打印fwnode_handles的消息。默认情况下是打印完整的节点名称，包括路径。 This happens because the original documentation talks about "fwnode handles", without mentioning the actual type name. Signed-off-by: Geert Uytterhoeven Tested-by: Kunwu Chan Reviewed-by: Kunwu Chan Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Fixes: 3bd32d6a2ee62db3 ("lib/vsprintf: Add %pfw conversion specifier for printing fwnode names") Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/07262c55e82fc4a3e3dbe7c45713b14955271e7f.1754552156.git.geert+renesas@glider.be commit bc20c56e98e0bd08e89f4fe327f4f14994d339b5 Author: Mauro Carvalho Chehab Date: Tue Jul 29 18:43:04 2025 +0200 docs: changes: better document Python needs Python is listed as an optional dependency, but this is not true, as: 1) arm (multi_v7_defconfig and other defconfigs) and arm64 defconfig needs it due to DRM_MSM dependencies; 2) CONFIG_LTO_CLANG runs a python script at scripts/Makefile.vmlinux_o; 3) kernel-doc is called during compilation when some DRM options like CONFIG_DRM_I915_WERROR are enabled; 4) allyesconfig/allmodconfig will enable CONFIG_* dependencies that needs it; 5) besides DRM, other subsystems seem to have logic calling *.py scripts. So, better document that and change the dependency from optional to mandatory to reflect the current needs. Signed-off-by: Mauro Carvalho Chehab Acked-by: Rob Herring (Arm) Acked-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b03b95b8d09358e81e4f27942839191f49b0ba80.1753806485.git.mchehab+huawei@kernel.org commit fc973dcd73f242480c61eccb1aa7306adafd2907 Author: Mauro Carvalho Chehab Date: Tue Jul 29 18:43:03 2025 +0200 docs: kernel-doc: avoid script crash on ancient Python While we do need at least 3.6 for kernel-doc to work, and at least 3.7 for it to output functions and structs with parameters at the right order, let the python binary be compatible with legacy versions. The rationale is that the Kernel build nowadays calls kernel-doc with -none on some places. Better not to bail out when older versions are found. With that, potentially this will run with python 2.7 and 3.2+, according with vermin: $ vermin --no-tips -v ./scripts/kernel-doc Detecting python files.. Analyzing using 24 processes.. 2.7, 3.2 /new_devel/v4l/docs/scripts/kernel-doc Minimum required versions: 2.7, 3.2 3.2 minimal requirement is due to argparse. The minimal version I could check was version 3.4 (using anaconda). Anaconda doesn't support 3.2 or 3.3 anymore, and 3.2 doesn't even compile (I tested compiling Python 3.2 on Fedora 42 and on Fedora 32 - no show). With 3.4, the script didn't crash and emitted the right warning: $ conda create -n py34 python=3.4 $ conda activate py34 python --version Python 3.4.5 $ python ./scripts/kernel-doc --none include/media Error: Python 3.6 or later is required by kernel-doc $ conda deactivate $ python --version Python 3.13.5 $ python ./scripts/kernel-doc --none include/media (no warnings and script ran properly) Supporting 2.7 is out of scope, as it is EOL for 5 years, and changing shebang to point to "python" instead of "python3" would have a wider impact. I did some extra checks about the differences from 3.2 and 3.4, and didn't find anything that would cause troubles: grep -rE "yield from|asyncio|pathlib|async|await|enum" scripts/kernel-doc Also, it doesn't use "@" operator. So, I'm confident that it should run (producing the exit warning) since Python 3.2. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/87d55e76b0b1391cb7a83e3e965dbddb83fa9786.1753806485.git.mchehab+huawei@kernel.org commit 136c374d8c80378d2982a46b2adabfc007299641 Author: Thomas Zimmermann Date: Fri Jun 27 17:23:09 2025 +0200 drm/sharp-memory: Do not access GEM-DMA vaddr directly Use DRM's shadow-plane helper to map and access the GEM object's buffer within kernel address space. Encapsulates the vmap logic in the GEM-DMA helpers. The sharp-memory driver currently reads the vaddr field from the GME buffer object directly. This only works because GEM code 'automagically' sets vaddr. Shadow-plane helpers perform the same steps, but with correct abstraction behind drm_gem_vmap(). The shadow-plane state provides the buffer address in kernel address space and the format-conversion state. v2: - fix typo in commit description Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250627152327.8244-1-tzimmermann@suse.de commit c585c1b29a52e4c556565fc7c4bb767781894b57 Author: Thomas Zimmermann Date: Fri Jun 27 17:24:08 2025 +0200 drm/repaper: Do not access GEM-DMA vaddr directly Use DRM's shadow-plane helper to map and access the GEM object's buffer within kernel address space. Encapsulates the vmap logic in the GEM-DMA helpers. The repaper driver currently reads the vaddr field from the GME buffer object directly. This only works because GEM code 'automagically' sets vaddr. Shadow-plane helpers perform the same steps, but with correct abstraction behind drm_gem_vmap(). The shadow-plane state provides the buffer address in kernel address space and the format-conversion state. v2: - fix typo in commit description Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250627152422.8399-1-tzimmermann@suse.de commit 45f5d1dc6ff3b2b80e92071b507bee77c86f6ad6 Author: Antony Kurniawan Soemardi Date: Sun Jun 22 18:26:44 2025 +0000 ARM: dts: qcom: msm8960: disable gsbi1 and gsbi5 nodes in msm8960 dtsi Not all devices use gsbi1 and gsbi5, so these nodes should be disabled in the SoC dtsi, following the existing pattern used for gsbi3. The upstream samsung-expressatt and msm8960-cdp devices already have status "okay" for these nodes, so this change should not break existing functionality. This eliminates the following error messages when gsbi nodes are not configured in the board's device tree: [ 1.109723] gsbi 16000000.gsbi: missing mode configuration [ 1.109797] gsbi 16000000.gsbi: probe with driver gsbi failed with error -22 (Note: Xperia SP doesn't use gsbi5) Signed-off-by: Antony Kurniawan Soemardi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250623-msm8960-sdcard-v2-3-340a5e8f7df0@smankusors.com Signed-off-by: Bjorn Andersson commit 12bf7cfb5ad4e278ac555f209f2b18d81fb4783f Author: Antony Kurniawan Soemardi Date: Sun Jun 22 18:26:41 2025 +0000 ARM: dts: qcom: msm8960: add gsbi8 and its serial configuration The LTE variant of the MSM8960 SoC has a gsbi8 node used for the serial console. That's if the downstream kernel is to be believed, as Xperia SP has a serial console on gsbi8 even on the non-LTE variant. Signed-off-by: Antony Kurniawan Soemardi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250623-msm8960-sdcard-v2-2-340a5e8f7df0@smankusors.com Signed-off-by: Bjorn Andersson commit b261da9e9ed8d7bfae7f34940a338750900e9b09 Author: Antony Kurniawan Soemardi Date: Sun Jun 22 18:26:38 2025 +0000 ARM: dts: qcom: msm8960: add sdcc3 pinctrl states Adds sdcc3-default-state and sdcc3-sleep-state pinctrl states for MSM8960. These are required for devices like Sony Xperia SP to ensure micro SD card functionality, though they are a no-op on the Samsung Galaxy Express. Tested-by: Rudraksha Gupta Signed-off-by: Antony Kurniawan Soemardi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250623-msm8960-sdcard-v2-1-340a5e8f7df0@smankusors.com Signed-off-by: Bjorn Andersson commit 17593a69b75f098280ad88b625f2d8c5bfe4c6a1 Author: Matthew Auld Date: Fri Aug 8 11:34:56 2025 +0100 drm/xe: rework PDE PAT index selection For non-leaf paging structures we end up selecting a random index between [0, 3], depending on the first user if the page-table is shared, since non-leaf structures only have two bits in the HW for encoding the PAT index, and here we are just passing along the full user provided index, which can be an index as large as ~31 on xe2+. The user provided index is meant for the leaf node, which maps the actual BO pages where we have more PAT bits, and not the non-leaf nodes which are only mapping other paging structures, and so only needs a minimal PAT index range. Also the chosen index might need to consider how the driver mapped the paging structures on the host side, like wc vs wb, which is separate from the user provided index. With that move the PDE PAT index selection under driver control. For now just use a coherent index on platforms with page-tables that are cached on host side, and incoherent otherwise. Using a coherent index could potentially be expensive, and would be overkill if we know the page-table is always uncached on host side. v2 (Stuart): - Add some documentation and split into separate helper. BSpec: 59510 Signed-off-by: Matthew Auld Cc: Stuart Summers Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250808103455.462424-2-matthew.auld@intel.com commit 7b41f6f9371b90052c99afd655140c8f6bfb18cf Merge: 8f5ae30d69d754 e282303e718b20 Author: Jonathan Corbet Date: Mon Aug 11 10:29:07 2025 -0600 Merge branch 'dump-struct' into docs-mw In my ongoing effort to truly understand our new kernel-doc, I continue to make changes to improve the code, and to try to make the understanding task easier for the next person. These patches focus on dump_struct() in particular, which starts out at nearly 300 lines long - to much to fit into my little brain anyway. Hopefully the result is easier to manage. There are no changes in the rendered docs. commit e282303e718b2007b3db77c6db75ecaf4419a1af Author: Jonathan Corbet Date: Thu Aug 7 15:16:39 2025 -0600 docs: kdoc: a few final dump_struct() touches Add a couple more comments so that each phase of the process is now clearly marked. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-13-corbet@lwn.net commit 23c47b09315935df140ca5ce2ddddb85453ed64d Author: Jonathan Corbet Date: Thu Aug 7 15:16:38 2025 -0600 docs: kdoc: extract output formatting from dump_struct() The last thing done in dump_struct() is to format the structure for printing. That, too, is a separate activity; split it out into its own function. dump_struct() now fits in a single, full-hight editor screen. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-12-corbet@lwn.net commit e6dd4e2a5ca1c1e2fb168249532da1d95b5b24af Author: Jonathan Corbet Date: Thu Aug 7 15:16:37 2025 -0600 docs: kdoc: further rewrite_struct_members() cleanup Get rid of some redundant checks, and generally tighten up the code; no logical change. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-11-corbet@lwn.net commit a8c4b0a8f1969e5ee0e8abb62cde8f0d7bcc2009 Author: Jonathan Corbet Date: Thu Aug 7 15:16:36 2025 -0600 docs: kdoc: Some rewrite_struct_members() commenting Add comments to rewrite_struct_members() describing what it is actually doing, and reformat/comment the main struct_members regex so that it is (more) comprehensible to humans. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-10-corbet@lwn.net commit fb20e610393b02a832a0bf4964e12c20a7ffa2f8 Author: Jonathan Corbet Date: Thu Aug 7 15:16:35 2025 -0600 docs: kdoc: remove an extraneous strip() call ...the variable in question was already strip()ed at the top of the loop. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-9-corbet@lwn.net commit f8208676c1c85c0b91e726954c05f5859b890ccb Author: Jonathan Corbet Date: Thu Aug 7 15:16:34 2025 -0600 docs: kdoc: rework the rewrite_struct_members() main loop Adopt a more Pythonic form for the main loop of this function, getting rid of the "while True:" construction and making the actual loop invariant explicit. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-8-corbet@lwn.net commit 77e3c875f0a83d9192079e88d8569ac36c6b6bea Author: Jonathan Corbet Date: Thu Aug 7 15:16:33 2025 -0600 docs: kdoc: split struct-member rewriting out of dump_struct() The massive loop that massages struct members shares no data with the rest of dump_struct(); split it out into its own function. Code movement only, no other changes. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-7-corbet@lwn.net commit 0f7344129434a6b44d4abb5080a9d67dd734ee07 Author: Jonathan Corbet Date: Thu Aug 7 15:16:32 2025 -0600 docs: kdoc: split top-level prototype parsing out of dump_struct() Move the initial split of the prototype into its own function in the ongoing effort to cut dump_struct() down to size. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-6-corbet@lwn.net commit 64cf83bcd3217a9583caeb404ff136366a46705c Author: Jonathan Corbet Date: Thu Aug 7 15:16:31 2025 -0600 docs: kdoc: move the prefix transforms out of dump_struct() dump_struct is one of the longest functions in the kdoc_parser class, making it hard to read and reason about. Move the definition of the prefix transformations out of the function, join them with the definition of "attribute" (which was defined at the top of the file but only used here), and reformat the code slightly for shorter line widths. Just code movement in the end. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-5-corbet@lwn.net commit 5fd513f01169ae93d202b8c30f0837096664e7d7 Author: Jonathan Corbet Date: Thu Aug 7 15:16:30 2025 -0600 docs: kdoc: backslashectomy in kdoc_parser A lot of the regular expressions in this file have extraneous backslashes that may have been needed in Perl, but aren't helpful here. Take them out to reduce slightly the visual noise. Escaping of (){}[] has been left in place, even when unnecessary, for visual clarity. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-4-corbet@lwn.net commit 259feba4dde78f165b03e231ea9985dfe600c202 Author: Jonathan Corbet Date: Thu Aug 7 15:16:29 2025 -0600 docs: kdoc: Move a regex line in dump_struct() The complex struct_members regex was defined far from its use; bring the two together. Remove some extraneous backslashes while making the move. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-3-corbet@lwn.net commit 6656ae4df1a6ad6dfb5c4ce4c76136a42abb9bf4 Author: Jonathan Corbet Date: Thu Aug 7 15:16:28 2025 -0600 docs: kdoc: consolidate the stripping of private struct/union members There were two locations duplicating the logic of stripping private members and associated comments; coalesce them into one, and add some comments describing what's going on. Output change: we now no longer add extraneous white space around macro definitions. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250807211639.47286-2-corbet@lwn.net commit 2f7b168323c22faafb1fbf94ef93b7ce5efc15c6 Author: Marko Mäkelä Date: Sat Aug 2 12:55:46 2025 +0300 clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf Rework nss_port5 to use the new multiple configuration implementation and correctly fix the clocks for this port under some corner case. In OpenWrt, this patch avoids intermittent dmesg errors of the form nss_port5_rx_clk_src: rcg didn't update its configuration. This is a mechanical, straightforward port of commit e88f03230dc07aa3293b6aeb078bd27370bb2594 ("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf") to gcc-ipq6018, with two conflicts resolved: different frequency of the P_XO clock source, and only 5 Ethernet ports. This was originally developed by JiaY-shi . Link: https://lore.kernel.org/all/20231220221724.3822-4-ansuelsmth@gmail.com/ Signed-off-by: Marko Mäkelä Tested-by: Marko Mäkelä Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250802095546.295448-1-marko.makela@iki.fi Signed-off-by: Bjorn Andersson commit 6ef38b0c16c20701fb8a06d2d2114080fbc785ad Author: Konrad Dybcio Date: Sat Aug 2 13:44:44 2025 +0200 clk: qcom: Remove double-space after assignment operator This is an oddly common hiccup across clk/qcom.. Remove it in hopes to reduce spread through copy-paste. Signed-off-by: Konrad Dybcio Reviewed-by: Imran Shaik Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250802-topic-clk_qc_doublespace-v1-1-2cae59ba7d59@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 60a63913fd69bae76a3420c97ef40e865792a5b8 Author: Yijie Yang Date: Mon Aug 4 09:37:05 2025 +0800 firmware: qcom: scm: Allow QSEECOM on HAMOA-IOT-EVK Add the Hamoa-IoT-EVK board to the list to enable access to EFI variables. Signed-off-by: Yijie Yang Link: https://lore.kernel.org/r/20250804-hamoa_initial-v4-2-19edbb28677b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6b7e2aa50bdaf88cd4c2a5e2059a7bf32d85a8b1 Author: Gabor Juhos Date: Sun Aug 10 16:38:51 2025 +0200 spi: spi-qpic-snand: remove 'clr*status' members of struct 'qpic_ecc' In the qcom_spi_ecc_init_ctx_pipelined() function, the 'clrflashstatus' and the 'clrreadstatus' members of the ECC context gets initialized with constant values. Then these values are used by several functions to set the corresponding members in the register cache. Because the values are never modified, change the code to set the those directly in the register cache by the qcom_spi_ecc_init_ctx_pipelined() function, and remove the repetitive code from the other functions to reduce code duplication. Also, remove the respective members from the 'qpic_ecc' structure as those became unused due to the change. No functional changes intended. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250810-qpic-snand-qpic_ecc-cleanup-v1-2-33a6b2bcbc67@gmail.com Signed-off-by: Mark Brown commit fbec18dc9940a89e094bae890b8dc0af00ddc4ff Author: Gabor Juhos Date: Sun Aug 10 16:38:50 2025 +0200 spi: spi-qpic-snand: remove unused 'dev' member of struct 'qpic_ecc' The 'dev' member of the 'qpic_ecc' structure is never used in the code so remove that. No functional changes. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20250810-qpic-snand-qpic_ecc-cleanup-v1-1-33a6b2bcbc67@gmail.com Signed-off-by: Mark Brown commit d4e8dc8e8b34771b0a3d474d243bcfcbddef8612 Author: Tianjia Zhang Date: Tue Jul 29 17:10:44 2025 +0800 selinux: use a consistent method to get full socket from skb In order to maintain code consistency and readability, skb_to_full_sk() is used to get full socket from skb. Signed-off-by: Tianjia Zhang Acked-by: Stephen Smalley Signed-off-by: Paul Moore commit 5f9383bd4168eaf88a673d3eac5d8935a2202846 Author: Yue Haibing Date: Wed Jul 23 20:23:04 2025 +0800 selinux: Remove unused function selinux_policycap_netif_wildcard() This is unused since commit a3d3043ef24a ("selinux: get netif_wildcard policycap from policy instead of cache"). Signed-off-by: Yue Haibing Acked-by: Stephen Smalley Signed-off-by: Paul Moore commit ce8370e2e62a903e18be7dd0e0be2eee079501e1 Author: Richard Guy Briggs Date: Wed Aug 6 17:04:07 2025 -0400 audit: record fanotify event regardless of presence of rules When no audit rules are in place, fanotify event results are unconditionally dropped due to an explicit check for the existence of any audit rules. Given this is a report from another security sub-system, allow it to be recorded regardless of the existence of any audit rules. To test, install and run the fapolicyd daemon with default config. Then as an unprivileged user, create and run a very simple binary that should be denied. Then check for an event with ausearch -m FANOTIFY -ts recent Link: https://issues.redhat.com/browse/RHEL-9065 Signed-off-by: Richard Guy Briggs Signed-off-by: Paul Moore commit df1145b56c6f92696acec7730694a19fb4c8a174 Author: Kieran Moy Date: Sat Jul 5 15:48:10 2025 +0800 audit: fix typo in auditfilter.c comment Correct the misspelling of "searching" (was "serarching") in the function documentation for audit_update_lsm_rules. Found via code inspection, no functional impact. Signed-off-by: Kieran Moy Signed-off-by: Paul Moore commit d8c09d7b55da39a10c8fd7f2b3a3f88f5f55764c Author: Thorsten Blum Date: Fri Jul 18 22:37:34 2025 +0200 audit: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Paul Moore commit c5055d0c8eddfb89ed895ae0642e2a2a0804143d Author: Casey Schaufler Date: Wed Jul 16 14:27:30 2025 -0700 audit: fix indentation in audit_log_exit() Fix two indentation errors in audit_log_exit(). Signed-off-by: Casey Schaufler [PM: subject tweak] Signed-off-by: Paul Moore commit fb6c2d16a46e6366cc154ade97dd466a9f595537 Author: Ruben Wauters Date: Tue Jul 22 00:22:03 2025 +0100 drm/gud: Remove unnecessary logging The debug logging in gud_disconnect() adds zero detail and is unnecessary, as it only prints the function name. The same functionality can be achieved by using ftrace, and is highlighted by checkpatch, stating the same. This patch removes the debug log in the gud_disconnect() function. Signed-off-by: Ruben Wauters Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250721232210.12578-1-rubenru09@aol.com commit 3bf7097bfdd4cf43874d7d41689957bc0d581d47 Author: Mukesh Ojha Date: Thu Aug 7 13:13:11 2025 +0530 soc: qcom: mdt_loader: Remove unused parameter fw_name in qcom_mdt_bins_are_split() seems unused now, it may have used in the past for logging it but due to code refactor this parameter is unused now. Signed-off-by: Mukesh Ojha Reviewed-by: Jeff Johnson Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250807074311.2381713-3-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0daf35da397b083ea0ea5407196bb6bd210530ec Author: Mukesh Ojha Date: Thu Aug 7 13:13:10 2025 +0530 soc: qcom: mdt_loader: Remove pas id parameter pas id is not used in qcom_mdt_load_no_init() and it should not be used as it is non-PAS specific function and has no relation to PAS specific mechanism. Reviewed-by: Dikshita Agarwal Acked-by: Jeff Johnson # drivers/net/wireless/ath/ath12k/ahb.c Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250807074311.2381713-2-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit aaf5aae37aec74e2dd888d871e258c16f37df041 Author: Mukesh Ojha Date: Thu Aug 7 13:13:09 2025 +0530 soc: qcom: mdt_loader: Remove unused parameter commit f4e526ff7e38e ("soc: qcom: mdt_loader: Extract PAS operations") move pas specific code from __qcom_mdt_load() to a separate function qcom_mdt_pas_init() after which the pas_init variable became unused in __qcom_mdt_load(). Remove pas_init argument from __qcom_mdt_load(). Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20250807074311.2381713-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 Author: Brahmajit Das Date: Mon Aug 11 14:51:25 2025 +0530 drm/radeon/r600_cs: clean up of dead code in r600_cs GCC 16 enables -Werror=unused-but-set-variable= which results in build error with the following message. drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] 1411 | unsigned offset, i, level; | ^~~~~ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 level although is set, but in never used in the function r600_texture_size. Thus resulting in dead code and this error getting triggered. Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") Acked-by: Christian König Signed-off-by: Brahmajit Das Signed-off-by: Alex Deucher commit 388b68aef7319cfee7511b99826c46e951e2f1bd Author: Cryolitia PukNgae Date: Wed Aug 6 11:34:18 2025 +0800 drm/amdgpu: fix incorrect comment format Comments should not have a leading plus sign. Acked-by: Christian König Signed-off-by: Cryolitia PukNgae Signed-off-by: Alex Deucher commit 8d6593c192de6e51102ca7d797756a5003f08cd3 Author: Taimur Hassan Date: Sun Aug 3 18:38:31 2025 -0500 drm/amd/display: Promote DC to 3.2.345 This version brings along following update: -Fix close and open lid may cause eDP remaining blank -Fix frequently disabling/enabling OTG may cause incorrect configuration of OTG Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 121fcf3c871181edce0708a49d2397cedd6ad21f Author: Mukesh Ojha Date: Thu Aug 7 18:14:51 2025 +0530 firmware: qcom: scm: preserve assign_mem() error return value When qcom_scm_assign_mem() fails, the error value is currently being overwritten after it is logged, resulting in the loss of the original error code. Fix this by retaining and returning the original error value as intended. Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250807124451.2623019-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7552bee9dd1f2f60ad0fb286b346ba6809e56f07 Author: Taimur Hassan Date: Sun Aug 3 16:12:50 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.22.0 Add a new command for Panel Replay. Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ad335b5fc9ed1cdeb33fbe97d2969b3a2eedaf3e Author: Danny Wang Date: Thu Jul 24 13:58:21 2025 +0800 drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off [WHY&HOW] The user closed the lid while the system was powering on and opened it again before the “apply_seamless_boot_optimization” was set to false, resulting in the eDP remaining blank. Reset the “apply_seamless_boot_optimization” to false when dpms off. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Danny Wang Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e7496c15d830689cc4fc666b976c845ed2c5ed28 Author: TungYu Lu Date: Tue Jul 15 16:56:59 2025 +0800 drm/amd/display: Wait until OTG enable state is cleared [Why] Customer reported an issue that OS starts and stops device multiple times during driver installation. Frequently disabling and enabling OTG may prevent OTG from being safely disabled and cause incorrect configuration upon the next enablement. [How] Add a wait until OTG_CURRENT_MASTER_EN_STATE is cleared as a short term solution. Reviewed-by: Dillon Varone Signed-off-by: TungYu Lu Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c31f486bc8dd6f481adcb9cca4a6e1837b8cf127 Author: Vitaly Prosyak Date: Thu Aug 7 16:37:25 2025 -0400 drm/amdgpu: add to custom amdgpu_drm_release drm_dev_enter/exit User queues are disabled before GEM objects are released (protecting against user app crashes). No races with PCI hot-unplug (because drm_dev_enter prevents cleanup if iewdevice is being removed). Cc: Christian König Cc: Alex Deucher Reviewed-by: Christian König Signed-off-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit 1dd2fa0e00f17b909ff0fab92c1c48c2d7911c15 Author: Lijo Lazar Date: Sat Jun 28 10:50:25 2025 +0530 drm/amdgpu: Save and restore switch state During a DPC error kernel waits for the link to be active before notifying downstream devices. On certain platforms with Broadcom switch in synthetiic mode, switch responds with values even though the link is not fully ready. The config space restoration done by pcie port driver for SWUS/DS of dGPU is thus not effective as the switch is still doing internal enumeration. As a workaround, save state of SWUS/DS device in driver. Add additional check to see if link is active and restore the values during DPC error callbacks. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 5bf83c54bab5eb15a2749c6c52b6f96d425490bc Author: Sricharan Ramabadhran Date: Mon Aug 11 14:39:52 2025 +0530 clk: qcom: apss-ipq5424: Add ipq5424 apss clock controller CPU on Qualcomm ipq5424 is clocked by huayra PLL with RCG support. Add support for the APSS PLL, RCG and clock enable for ipq5424. The PLL, RCG register space are clubbed. Hence adding new APSS driver for both PLL and RCG/CBC control. Also the L3 cache has a separate pll and needs to be scaled along with the CPU and is modeled as an ICC clock. [ Removed clock notifier, moved L3 pll to icc-clk, used existing alpha pll structure ] Co-developed-by: Md Sadre Alam Signed-off-by: Md Sadre Alam Signed-off-by: Sricharan Ramabadhran Signed-off-by: Varadarajan Narayanan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250811090954.2854440-3-quic_varada@quicinc.com Signed-off-by: Bjorn Andersson commit fa5b839b178371ab0a68c32c239de2d9ff103d3c Merge: 8f5ae30d69d754 c17ccefb611fdb Author: Bjorn Andersson Date: Mon Aug 11 10:05:54 2025 -0500 Merge branch '20250811090954.2854440-2-quic_varada@quicinc.com' into clk-for-6.18 Merge IPQ5424 APSS clock controller binding through topic branch, to make available the introduced constants to DeviceTree branch as well. commit c17ccefb611fdb346eef9be6bfbd0bfd04afa204 Author: Sricharan Ramabadhran Date: Mon Aug 11 14:39:51 2025 +0530 dt-bindings: clock: ipq5424-apss-clk: Add ipq5424 apss clock controller The CPU core in ipq5424 is clocked by a huayra PLL with RCG support. The RCG and PLL have a separate register space from the GCC. Also the L3 cache has a separate pll and needs to be scaled along with the CPU. Co-developed-by: Md Sadre Alam Signed-off-by: Md Sadre Alam Signed-off-by: Sricharan Ramabadhran [ Added interconnect related changes ] Reviewed-by: Krzysztof Kozlowski Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20250811090954.2854440-2-quic_varada@quicinc.com Signed-off-by: Bjorn Andersson commit 77e1f16b930221b427ec24c634703388a64175af Author: Neil Armstrong Date: Mon Aug 11 14:25:18 2025 +0200 arm64: dts: qcom: sm8650: Flatten the USB nodes Transition the USB controllers found in the SM8650 SoC to the newly introduced, flattened representation of the Qualcomm USB block. The reg and interrupts properties from the usb child node are merged with their counterpart in the outer node, remaining properties and child nodes are simply moved. Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250811-topic-sm8x50-usb-flatten-v2-2-0bbb3ac292e4@linaro.org Signed-off-by: Bjorn Andersson commit 33450878adfc9d6bfd9cd2da2135b7fd33f2a4fe Author: Neil Armstrong Date: Mon Aug 11 14:25:17 2025 +0200 arm64: dts: qcom: sm8550: Flatten the USB nodes Transition the USB controllers found in the SM8550 SoC to the newly introduced, flattened representation of the Qualcomm USB block. The reg and interrupts properties from the usb child node are merged with their counterpart in the outer node, remaining properties and child nodes are simply moved. Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250811-topic-sm8x50-usb-flatten-v2-1-0bbb3ac292e4@linaro.org Signed-off-by: Bjorn Andersson commit edb660ad79ffe81a982c2eca02360a6ffac83e46 Author: Lucas De Marchi Date: Fri Aug 8 10:41:08 2025 -0700 drm/intel/pciids: Add match on vendor/id only All our PCI ID macros match on the PCI class besides the vendor and devid, even for devices that may or may not have display. This may not work going forward, so add a simple INTEL_PCI_DEVICE that matches only on vendor/device IDs. Cc: Jani Nikula Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250808-intel-pci-device-v1-1-ce3545d86502@intel.com Signed-off-by: Lucas De Marchi commit d301eb950da59f962bafe874cf5eb6d61a85b2c2 Author: Karthik Poosa Date: Sat Aug 9 00:23:10 2025 +0530 drm/xe/hwmon: Add SW clamp for power limits writes Clamp writes to power limits powerX_crit/currX_crit, powerX_cap, powerX_max, to the maximum supported by the pcode mailbox when sysfs-provided values exceed this limit. Although the pcode already performs clamping, values beyond the pcode mailbox's supported range get truncated, leading to incorrect critical power settings. This patch ensures proper clamping to prevent such truncation. v2: - Address below review comments. (Riana) - Split comments into multiple sentences. - Use local variables for readability. - Add a debug log. - Use u64 instead of unsigned long. v3: - Change drm_dbg logs to drm_info. (Badal) v4: - Rephrase the drm_info log. (Rodrigo, Riana) - Rename variable max_mbx_power_limit to max_supp_power_limit, as limit is same for platforms with and without mailbox power limit support. Signed-off-by: Karthik Poosa Fixes: 92d44a422d0d ("drm/xe/hwmon: Expose card reactive critical power") Fixes: fb1b70607f73 ("drm/xe/hwmon: Expose power attributes") Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250808185310.3466529-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit ad38ea266b8dc6e15e0d2a14a9d8543345fdba44 Author: Geert Uytterhoeven Date: Thu Jul 31 10:37:45 2025 +0200 ARM: shmobile: rcar-gen2: Use SZ_256K definition Use SZ_256K instead of calculating the same value. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/c54097a263eb3e451e5e223609a3630d4409dcdd.1753951039.git.geert+renesas@glider.be commit abd7c0293816a5fa5766710d2e7b576384fdec4d Author: Fabrizio Castro Date: Tue Jun 24 20:23:03 2025 +0100 arm64: defconfig: Enable the RZ/V2H(P) RSPI driver Enable the Renesas RZ/V2H(P) RSPI driver for the benefit of RZ/V2H(P) based platforms. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250624192304.338979-6-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 3fe8685424e3a351b151f37e71f0e5f2f3e3fe79 Author: Thierry Bultel Date: Thu May 15 16:18:25 2025 +0200 arm64: defconfig: Enable Renesas RZ/T2H serial SCI Selects RZ/T2H (aka r9a09g077) SCI (serial) specific code, as used on the RZ/T2H and RZ/N2H EVKs. Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Bultel Link: https://lore.kernel.org/20250515141828.43444-11-thierry.bultel.yh@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1e5f0fb41fccf5ecbb5506551790335c9578e320 Author: Askar Safin Date: Mon Aug 11 04:52:23 2025 +0000 vfs: fs/namespace.c: remove ms_flags argument from do_remount ...because it is not used Signed-off-by: Askar Safin Link: https://lore.kernel.org/20250811045444.1813009-1-safinaskar@zohomail.com Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner commit 38f7b4a6a0510bc9b578b2bbf31e434d84b3244b Merge: 6ec4b94e8e959b 53ec9169db1345 Author: Bartosz Golaszewski Date: Mon Aug 11 15:52:16 2025 +0200 Merge tag 'gpio-aggregator-refactoring-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into gpio/for-next Immutable branch for the pinctrl tree to pull from Refactor the gpio-aggregator module as a prerequisite for merging the pin controller driver for AAEON UP boards. commit ecb0605364465c051ff4744f3a848ef084b44769 Author: Tetsuo Handa Date: Mon Aug 11 15:50:28 2025 +0900 vfs: show filesystem name at dump_inode() Commit 8b17e540969a ("vfs: add initial support for CONFIG_DEBUG_VFS") added dump_inode(), but dump_inode() currently reports only raw pointer address. Comment says that adding a proper inode dumping routine is a TODO. However, syzkaller concurrently tests multiple filesystems, and several filesystems started calling dump_inode() due to hitting VFS_BUG_ON_INODE() added by commit af153bb63a33 ("vfs: catch invalid modes in may_open()") before a proper inode dumping routine is implemented. Show filesystem name at dump_inode() so that we can find which filesystem has passed an invalid mode to may_open() from syzkaller's crash reports. Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/ceaf4021-65cc-422e-9d0e-6afa18dd8276@I-love.SAKURA.ne.jp Signed-off-by: Christian Brauner commit 8a1d9e20c73dd5d003c9957c9c151dd657e64183 Merge: 560c633d378a0c 5293e8f2a85434 Author: Geert Uytterhoeven Date: Mon Aug 11 15:49:43 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag3' into renesas-pinctrl-for-v6.18 Renesas RZ/T2H and RZ/N2H USB_CLK and Pin Control DT Binding Definitions USB_CLK Clock and Pin Control DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files. commit 5293e8f2a854344ef9aba2391b44c7a437889ebb Author: Lad Prabhakar Date: Fri Aug 8 14:30:15 2025 +0100 dt-bindings: pinctrl: renesas: Document RZ/T2H and RZ/N2H SoCs Document the pin and GPIO controller IP for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, and add the shared DTSI header file used by both the bindings and the driver. The RZ/T2H SoC supports 729 pins, while RZ/N2H supports 576 pins. Both share the same controller architecture; separate compatible strings are added for each SoC to distinguish them. Co-developed-by: Thierry Bultel Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250808133017.2053637-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8a5a0294f40a50e5be83e9b7ebbc15b546f64e41 Author: Lad Prabhakar Date: Mon Aug 4 21:26:42 2025 +0100 dt-bindings: clock: renesas,r9a09g077/87: Add USB_CLK clock ID Add the USB clock (USB_CLK) definition for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. USB_CLK is used as the reference clock for USB PHY layer. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250804202643.3967484-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 53ec9169db1345f04174febb90f88a871fc28d9e Author: Thomas Richard Date: Mon Aug 11 15:25:52 2025 +0200 lib/string_choices: Add str_input_output() helper Add str_input_output() helper to return 'input' or 'output' string literal. Also add the inversed variant str_output_input(). Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-9-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 60e92c1009c7c6abd4a9d0caf33a8cba5d09f67c Author: Thomas Richard Date: Mon Aug 11 15:25:51 2025 +0200 gpio: aggregator: add possibility to attach data to the forwarder Add a data pointer to store private data in the forwarder. Reviewed-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-8-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit b31c68fd851e74526ad963362ea205eb97b9a710 Author: Thomas Richard Date: Mon Aug 11 15:25:50 2025 +0200 gpio: aggregator: handle runtime registration of gpio_desc in gpiochip_fwd Add request() callback to check if the GPIO descriptor was well registered in the gpiochip_fwd before using it. This is done to handle the case where GPIO descriptor is added at runtime in the forwarder. If at least one GPIO descriptor was not added before the forwarder registration, we assume the forwarder can sleep as if a GPIO is added at runtime it may sleep. Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-7-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 6e986f8852f56cf9214ea2ec02b4b432e201d02c Author: Thomas Richard Date: Mon Aug 11 15:25:49 2025 +0200 gpio: aggregator: export symbols of the GPIO forwarder library Export all symbols and create header file for the GPIO forwarder library. It will be used in the next changes. Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-6-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit b94cf35db606453c64e5da13c56cc6f8cabc6a33 Author: Thomas Richard Date: Mon Aug 11 15:25:48 2025 +0200 gpio: aggregator: update gpiochip_fwd_setup_delay_line() parameters Remove useless parameters of gpiochip_fwd_setup_delay_line(). Reviewed-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-5-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 10d022efe2c4bb2020a07b2e4d94b658ce30aca4 Author: Thomas Richard Date: Mon Aug 11 15:25:47 2025 +0200 gpio: aggregator: refactor the forwarder registration part Add a new function gpiochip_fwd_register(), which finalizes the initialization of the forwarder and registers the corresponding gpiochip. Reviewed-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-4-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit c44ce91b8ada680074aa976e61fcef5633e6f086 Author: Thomas Richard Date: Mon Aug 11 15:25:46 2025 +0200 gpio: aggregator: refactor the code to add GPIO desc in the forwarder Create a dedicated function to add a GPIO desc in the forwarder. Instead of saving a GPIO descs array pointer, now the GPIO descs are passed one by one to the forwarder which registers them in its own array. So after the call of gpiochip_fwd_create(), the passed array can be free. Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-3-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 871c7cd54830c0bda15513238ea9d46fc1cae991 Author: Thomas Richard Date: Mon Aug 11 15:25:45 2025 +0200 gpio: aggregator: move GPIO forwarder allocation in a dedicated function Move the GPIO forwarder allocation and static initialization in a dedicated function. Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-2-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 181fe022ecf8a8e85def0e94852c631c59a8b3f6 Author: Thomas Richard Date: Mon Aug 11 15:25:44 2025 +0200 gpiolib: add support to register sparse pin range Add support to register for GPIO<->pin mapping using a list of non consecutive pins. The core already supports sparse pin range (pins member of struct pinctrl_gpio_range), but it was not possible to register one. If pins is not NULL the core uses it, otherwise it assumes that a consecutive pin range was registered and it uses pin_base. The function gpiochip_add_pin_range() which allocates and fills the struct pinctrl_gpio_range was renamed to gpiochip_add_pin_range_with_pins() and the pins parameter was added. Two new functions were added, gpiochip_add_pin_range() and gpiochip_add_sparse_pin_range() to register a consecutive or sparse pins range. Both use gpiochip_add_pin_range_with_pins(). Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20250811-aaeon-up-board-pinctrl-support-v9-1-29f0cbbdfb30@bootlin.com Signed-off-by: Bartosz Golaszewski commit 59304e7b80b4554fae6f1df0f518bd341a0fedc9 Author: Linus Walleij Date: Wed Aug 6 01:03:08 2025 +0200 dt-bindings: arm: Spell out acronym When I authored these bindings I had no idea what "AEM" stood for. Now I know: it means "Architecture Envelope Model". Detail this in the bindings. Signed-off-by: Linus Walleij Acked-by: Conor Dooley Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250806-aem-dt-bind-v1-1-d14676dfb027@linaro.org Signed-off-by: Rob Herring (Arm) commit a678ec17f57c97e9bdcb81f67f9af73ae72b3422 Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:23 2025 -0500 dt-bindings: fsi: Convert aspeed,ast2400-cf-fsi-master to DT schema Convert the ASpeed Coldfire offloaded GPIO FSI master. Drop the "fsi-master" compatible as it has not be used consistently and doesn't represent anything. Acked-by: Eddie James Link: https://lore.kernel.org/r/20250731-dt-fsi-cleanups-v1-6-e7b695a29fc3@kernel.org Signed-off-by: Rob Herring (Arm) commit 17c66b1037aa52277d42c942db76672a1298858e Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:22 2025 -0500 dt-bindings: fsi: Convert fsi-master-gpio to DT schema Convert the GPIO-based FSI master binding to DT schema format. Drop the "fsi-master" compatible as it has not be used consistently and doesn't represent anything. Acked-by: Eddie James Link: https://lore.kernel.org/r/20250731-dt-fsi-cleanups-v1-5-e7b695a29fc3@kernel.org Signed-off-by: Rob Herring (Arm) commit da8dd0a9378ebfec9fbc813a963203ad0cb94ce2 Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:21 2025 -0500 MAINTAINERS: Add FSI bindings to FSI subsystem entry Maintainers of a subsystem should also be the maintainer for corresponding DT bindings. Add the FSI bindings to the FSI subsystem entry. Acked-by: Eddie James Link: https://lore.kernel.org/r/20250731-dt-fsi-cleanups-v1-4-e7b695a29fc3@kernel.org Signed-off-by: Rob Herring (Arm) commit a54ef14188519a0994d0264f701f5771815fa11e Author: Rob Herring (Arm) Date: Thu Aug 7 16:44:57 2025 -0500 regulator: dt-bindings: Clean-up active-semi,act8945a duplication The active-semi,act8945a binding is documented in multiple places. The charger child node is documented in regulator/active-semi,act8945a.yaml and power/supply/active-semi,act8945a-charger.yaml. An old text binding is in mfd/act8945a.txt. Update the regulator/active-semi,act8945a.yaml with the additional descriptions and constraints from power/supply/active-semi,act8945a-charger.yaml, and then remove it and mfd/act8945a.txt. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250807214459.4173892-1-robh@kernel.org Signed-off-by: Mark Brown commit bb2441402392ef1f49563be68e8f0dcb127ac965 Author: Dzmitry Sankouski Date: Tue Aug 5 22:40:56 2025 +0300 regulator: add s2dos05 regulator support S2DOS05 has 1 buck and 4 LDO regulators, used for powering panel/touchscreen. Signed-off-by: Dzmitry Sankouski Link: https://patch.msgid.link/20250805-starqltechn_integration_upstream-v8-1-09d8a321fafe@gmail.com Signed-off-by: Mark Brown commit f6cc4140e161831e5796f099f5abc3af953ae2b8 Author: Liao Yuanhong Date: Thu Aug 7 20:39:49 2025 +0800 regulator: tps6524x: Remove unnecessary memset devm_kzalloc() has already been initialized to full 0 space, there is no need to use memset() to initialize again. Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250807123949.495193-1-liaoyuanhong@vivo.com Signed-off-by: Mark Brown commit c072d2b49507420edd57ba3d87690ab81ef5273a Author: Rob Herring (Arm) Date: Fri Jul 25 15:06:26 2025 -0500 scripts/dtc: Update to upstream version v1.7.2-35-g52f07dcca47c This adds the following commits from upstream: 52f07dcca47c dtc: Add informative error for stray identifier 9cabae6b0351 checks: Fix detection of 'i2c-bus' node 605dc044c3fe New helper to add markers 7da5d106c740 fdtput: Fix documentation about existing nodes 53c63dd421d7 dtdiff: Use input format dtb for dtbo files 84d9dd2fcbc8 dtc: Add data_insert_data function 97011d1f4e98 meson: use override_find_program/override_dependency b841391bbd08 srcpos: Define srcpos_free e0b7749c26a9 Add alloc_marker ecb21febfdd3 meson: port python bindings to build natively via meson and meson-python 7ebfcac8520e Makefile: deprecate in favor of Meson f4c53f4ebf78 Use __ASSEMBLER__ instead of __ASSEMBLY__ 205fbef17b7b Fix some typos da85f91931e5 Remove duplicated words in documentation and comments dd1b3e532d22 meson: support building libfdt without static library 1ccd232709d4 meson: don't build test programs by default ce1d8588880a tests: When building .so from -O asm output mark as non-executable stack 915daadbb62d Start with empty __local_fixups__ and __fixups__ nodes 4ea851f5a44d Let get_subnode() not return deleted nodes 175d2a564c47 Use build_root_node() instead of open-coding it 18f4f305fdd7 build: fix -Dtools=false build 267efc7d4694 checks: Warn about missing #address-cells for interrupt parents 755db115355b libfdt: Add fdt_setprop_namelen_string() bdca8612009e libfdt: Add fdt_setprop_namelen() 0f69cedc08fc libfdt_internal: fdt_find_string_len_() 56b2b30c5bd0 libfdt: add fdt_get_property_namelen_w() 1e8c5f60e127 Add clang-format config 6f183c7d9246 checks: Relax avoid_unnecessary_addr_size check to allow child ranges properties 66c7d0e6f4f3 tests/sw_tree1.c: fix unitialized saveptr 9a969f3b70b0 pylibfdt/libfdt.i: fix backwards compatibility of return values 4292b072a23a .github/workflows: update ubuntu runner to supported version 1c745a9bd169 libfdt: Remove fdt parameter from overlay_fixup_one_phandle b3bbee6b1242 libfdt: Move the SBOM authors section d1656730abfb Add a SBOM file in CycloneDX format b75515af4576 libfdt: Remove extra semi-colons outside functions 2d10aa2afe35 Bump version to v1.7.2 48795c82bdb6 pylibfdt: Don't emit warnings from swig generate C code 838f11e830e3 fdtoverlay: provide better error message for missing `/__symbols__` d1e2384185c5 pylibfdt/libfdt.i: Use SWIG_AppendOutput 18aa49a9f68d Escape spaces in depfile with backslashes. f9968fa06921 libfdt.h: whitespace consistency fixups 9b5f65fb3d8d libfdt.h: typo and consistency fixes 99031e3a4a6e Bump version to v1.7.1 3d5e376925fd setup: Move setting of srcdir down to the bottom e277553b9880 setup: Collect top-level code together 7e5a88984081 setup: Move version and full_description into a function 78b6a85c113b Tidy up some pylint warnings 3501d373f0a2 Require Python 3 The added include of string.h in libfdt_internal.h breaks the kernel overriding libfdt_env.h with its own string functions, so it is dropped. An upstream fix is pending. Signed-off-by: Rob Herring (Arm) commit c6871d56b52ec177b8b8bd891fa0cbbd004b646d Author: Chen Ni Date: Tue Jul 29 12:00:44 2025 +0800 regulator: tps6594-regulator: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20250729040044.1851988-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 6ec4b94e8e959b4201ca0bfc43fa50dc946d10cb Author: Geert Uytterhoeven Date: Mon Aug 11 15:00:01 2025 +0200 gpio: TODO: remove the task for converting to the new line setters The task is complete, but this was not reflected in the TODO file. Fixes: d9d87d90cc0b10cd ("treewide: rename GPIO set callbacks back to their original names") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/417af7e5a110c527eb759289bd5d2fd6885f4e01.1754917104.git.geert+renesas@glider.be Signed-off-by: Bartosz Golaszewski commit d140f3ba76ac98faad7f9b37ef5a3dcbd57f59e2 Author: Patrice Chotard Date: Thu Aug 7 09:34:09 2025 +0200 memory: stm32_omm: Fix req2ack update test If "st,omm-req2ack-ns" property is found and its value is not 0, the current test doesn't allow to compute and set req2ack value, Fix this test. Fixes: 8181d061dcff ("memory: Add STM32 Octo Memory Manager driver") Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20250807-upstream_omm_fix_req2ack_test_condition-v2-1-d7df4af2b48b@foss.st.com Cc: Signed-off-by: Krzysztof Kozlowski commit 573015dfa63c73a653d8bf93930b18d75f9732aa Merge: bfa8ee11dc13b6 df579e471111b9 Author: Christian Brauner Date: Fri Aug 8 15:52:47 2025 +0200 Merge patch series "fscontext: do not consume log entries when returning -EMSGSIZE" Aleksa Sarai says: Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case. Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read. * patches from https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-0-8d91d6242dc3@cyphar.com: selftests/filesystems: add basic fscontext log tests fscontext: do not consume log entries when returning -EMSGSIZE Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-0-8d91d6242dc3@cyphar.com Signed-off-by: Christian Brauner commit bfa8ee11dc13b63041b90cc16d694f69c4747490 Merge: 5e6de2a72ef4af 807602d8cfc8b6 Author: Christian Brauner Date: Fri Aug 8 15:24:00 2025 +0200 Merge patch series "vfs: output mount_too_revealing() errors to fscontext" Aleksa Sarai says: It makes little sense for fsmount() to output the warning message when mount_too_revealing() is violated to kmsg. Instead, the warning should be output (with a "VFS" prefix) to the fscontext log. In addition, include the same log message for mount_too_revealing() when doing a regular mount for consistency. With the newest fsopen()-based mount(8) from util-linux, the error messages now look like # mount -t proc proc /tmp mount: /tmp: fsmount() failed: VFS: Mount too revealing. dmesg(1) may have more information after failed mount system call. which could finally result in mount_too_revealing() errors being easier for users to detect and understand. * patches from https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-0-534b9b4d45bb@cyphar.com: vfs: output mount_too_revealing() errors to fscontext fscontext: add custom-prefix log helpers Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-0-534b9b4d45bb@cyphar.com Signed-off-by: Christian Brauner commit df579e471111b9f8691d75c980f59cc085fa97a3 Author: Aleksa Sarai Date: Thu Aug 7 03:55:24 2025 +1000 selftests/filesystems: add basic fscontext log tests Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-2-8d91d6242dc3@cyphar.com Signed-off-by: Christian Brauner commit 72d271a7baa7062cb27e774ac37c5459c6d20e22 Author: Aleksa Sarai Date: Thu Aug 7 03:55:23 2025 +1000 fscontext: do not consume log entries when returning -EMSGSIZE Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case. Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read. Fixes: 007ec26cdc9f ("vfs: Implement logging through fs_context") Cc: David Howells Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-1-8d91d6242dc3@cyphar.com Signed-off-by: Christian Brauner commit 5e6de2a72ef4af32a45b3f301faee0208e2b98f0 Merge: 8f5ae30d69d754 92becd1701a835 Author: Christian Brauner Date: Thu Jul 31 13:20:12 2025 +0200 Merge patch series "fs: Remove old mount API helpers" Pedro Falcato says: This patchset contains a very small cleanup, where we remove mount_nodev (unused since 6.15) and mount_bdev (unused since f2fs converted their mount API usage, still in -next). While we're at it, we also get to removing some stale mount API docs. * patches from https://lore.kernel.org/20250723132156.225410-1-pfalcato@suse.de: docs/vfs: Remove mentions to the old mount API helpers fs: Remove mount_bdev fs: Remove mount_nodev Link: https://lore.kernel.org/20250723132156.225410-1-pfalcato@suse.de Signed-off-by: Christian Brauner commit 807602d8cfc8b63e2c645fbbc66c8e82479ee311 Author: Aleksa Sarai Date: Wed Aug 6 16:07:06 2025 +1000 vfs: output mount_too_revealing() errors to fscontext It makes little sense for fsmount() to output the warning message when mount_too_revealing() is violated to kmsg. Instead, the warning should be output (with a "VFS" prefix) to the fscontext log. In addition, include the same log message for mount_too_revealing() when doing a regular mount for consistency. With the newest fsopen()-based mount(8) from util-linux, the error messages now look like # mount -t proc proc /tmp mount: /tmp: fsmount() failed: VFS: Mount too revealing. dmesg(1) may have more information after failed mount system call. which could finally result in mount_too_revealing() errors being easier for users to detect and understand. Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-2-534b9b4d45bb@cyphar.com Signed-off-by: Christian Brauner commit 92becd1701a835d0807fa1f5c03b43762af27444 Author: Pedro Falcato Date: Wed Jul 23 14:21:56 2025 +0100 docs/vfs: Remove mentions to the old mount API helpers Now that mount_bdev(), mount_nodev() and mount_single() have all been removed, remove mentions to them in vfs.rst. While we're at it, redirect people looking for mount API docs to mount_api.rst (which documents the newer API). Signed-off-by: Pedro Falcato Link: https://lore.kernel.org/20250723132156.225410-4-pfalcato@suse.de Signed-off-by: Christian Brauner commit ad7fe23b4b0dc0c26187df92a5649948ef7049fa Author: Aleksa Sarai Date: Wed Aug 6 16:07:05 2025 +1000 fscontext: add custom-prefix log helpers Sometimes, errors associated with an fscontext come from the VFS or otherwise outside of the filesystem driver itself. However, the default logging of errorfc will always prefix the message with the filesystem name. So, add some *fcp() wrappers that allow for custom prefixes to be used when emitting information to the fscontext log. Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-1-534b9b4d45bb@cyphar.com Signed-off-by: Christian Brauner commit f7d161c2804f3ad36bdc3222cb93c8fee67be98c Author: Pedro Falcato Date: Wed Jul 23 14:21:55 2025 +0100 fs: Remove mount_bdev mount_bdev has no in-tree users ever since f2fs adopted the new mount API. Remove it. Signed-off-by: Pedro Falcato Link: https://lore.kernel.org/20250723132156.225410-3-pfalcato@suse.de Signed-off-by: Christian Brauner commit 56ecfd9175b999dfc303ac6a0f9ea4bd1bee49d7 Author: Pedro Falcato Date: Wed Jul 23 14:21:54 2025 +0100 fs: Remove mount_nodev mount_nodev has had no in-tree users since cc0876f817d6 ("vfs: Convert devpts to use the new mount API"). Remove it. Signed-off-by: Pedro Falcato Link: https://lore.kernel.org/20250723132156.225410-2-pfalcato@suse.de Signed-off-by: Christian Brauner commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 Author: Thomas Weißschuh Date: Tue Aug 5 14:38:08 2025 +0200 fs: always return zero on success from replace_fd() replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug. To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero. Suggested-by: Al Viro Link: https://lore.kernel.org/lkml/20250801220215.GS222315@ZenIV/ Fixes: 173817151b15 ("fs: Expand __receive_fd() to accept existing fd") Fixes: 42eb0d54c08a ("fs: split receive_fd_replace from __receive_fd") Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/20250805-fix-receive_fd_replace-v3-1-b72ba8b34bac@linutronix.de Signed-off-by: Christian Brauner commit f7d812357e40ef3ce1c0dcdd929590f1dbc6c344 Author: Xichao Zhao Date: Fri Aug 8 16:37:58 2025 +0800 fs: fix "writen"->"written" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/20250808083758.229563-1-zhao.xichao@vivo.com Signed-off-by: Christian Brauner commit 4e021920812d164bb02c30cc40e08a3681b1c755 Author: Kriish Sharma Date: Wed Jul 30 20:18:53 2025 +0000 fs: document 'name' parameter for name_contains_dotdot() The kernel-doc for name_contains_dotdot() was missing the @name parameter description, leading to a warning during make htmldocs. Add the missing documentation to resolve this warning. Signed-off-by: Kriish Sharma Link: https://lore.kernel.org/20250730201853.8436-1-kriish.sharma2006@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 17e8b7e08fa8bf7a936f70444a42a88750410251 Author: Christoph Hellwig Date: Thu Jul 24 09:48:54 2025 +0200 fs: mark file_remove_privs_flags static file_remove_privs_flags is only used inside of inode.c, mark it static. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250724074854.3316911-1-hch@lst.de Signed-off-by: Christian Brauner commit 15a04f94f42973d85afa2df66f1d18e0bca3385c Author: Thiago Becker Date: Thu Jul 24 17:35:16 2025 -0300 locks: Remove the last reference to EXPORT_OP_ASYNC_LOCK. Commit b875bd5b381e ("exportfs: Remove EXPORT_OP_ASYNC_LOCK") removed all references to EXPORT_OP_ASYNC_LOCK, but one lasted in the comments for fs/locks.c. Remove it. Signed-off-by: Thiago Becker Link: https://lore.kernel.org/20250724203516.153616-1-tbecker@redhat.com Signed-off-by: Christian Brauner commit 08c51f5bddc81c8c97c1eb11861b0dc009e5ccd8 Merge: 1bf30a45653d14 8f5ae30d69d754 Author: Thomas Zimmermann Date: Mon Aug 11 14:37:45 2025 +0200 Merge drm/drm-next into drm-misc-n Updating drm-misc-next to the state of v6.17-rc1. Begins a new release cycle. Signed-off-by: Thomas Zimmermann commit 3bffbe0497f9e3c7d80f22d9d0f60c984d42ab6d Author: Chen Ni Date: Tue Jul 29 11:16:31 2025 +0800 platform/x86: wmi-capdata01: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250729031631.1644740-1-nichen@iscas.ac.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1ccc2e20fe1d3b91395de8ca9ce0efe070287534 Author: Darshan Rathod Date: Fri Aug 1 16:17:05 2025 +0530 platform/x86: dell_rbu: fix assignment in if condition warning Refactor to remove assignments from inside if conditions, as required by kernel coding style. This improves code readability and resolves checkpatch.pl warnings: ERROR: do not use assignment in if condition Signed-off-by: Darshan Rathod Link: https://lore.kernel.org/r/20250801104705.1824495-1-darshanrathod475@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b26fc701a25195134ff0327709a0421767c4c7b2 Author: Dan Carpenter Date: Fri Aug 1 16:34:37 2025 +0300 PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() There is a typo so we accidentally return positive EINVAL instead of negative -EINVAL. Add the missing '-' character. Fixes: 6aceb36f17ab ("PCI: xgene-msi: Restructure handler setup/teardown") Signed-off-by: Dan Carpenter Signed-off-by: Manivannan Sadhasivam Acked-by: Marc Zyngier Link: https://patch.msgid.link/aIzCbVd93ivPinne@stanley.mountain commit 57a75fa9d56e310e883e4377205690e88c05781b Author: Dan Carpenter Date: Fri Aug 1 16:34:45 2025 +0300 PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg() The pci_epc_get() function returns error pointers. It never returns NULL. Update the check to match. Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller") Signed-off-by: Dan Carpenter Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/aIzCdV8jyBeql-Oa@stanley.mountain commit 2291a2186305faaf8525d57849d8ba12ad63f5e7 Author: Nick Li Date: Mon Aug 11 18:46:10 2025 +0800 MAINTAINERS: Add entry for FourSemi audio amplifiers Add entry for FourSemi maintainer and related files Signed-off-by: Nick Li Link: https://patch.msgid.link/B9209BC5189B8946+20250811104610.8993-6-nick.li@foursemi.com Signed-off-by: Mark Brown commit 75611770177965ae902c87c96eace07542beff07 Author: Nick Li Date: Mon Aug 11 18:46:09 2025 +0800 ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver The FS2104/5S are FourSemi digital audio amplifiers with I2C control. They are Inductor-Less, Stereo, Closed-Loop, Digital Input Class-D Power Amplifiers with Enhanced Signal Processing. Signed-off-by: Nick Li Link: https://patch.msgid.link/75A0F7CC495E9662+20250811104610.8993-5-nick.li@foursemi.com Signed-off-by: Mark Brown commit e0bbbcaceba1cf47751f264d0dbe36206eab0ef0 Author: Nick Li Date: Mon Aug 11 18:46:08 2025 +0800 ASoC: codecs: Add library for FourSemi audio amplifiers This patch adds firmware loading and parsing support for FourSemi audio amplifiers. The library handles firmware file (*.bin) generated by the FourSemi tuning tool, which contains: - Register initialization settings - DSP effect parameters - Multi-scene sound effect switching configurations(optional) The firmware is required for proper initialization and configuration of FourSemi amplifier devices. Signed-off-by: Nick Li Link: https://patch.msgid.link/77822D0108CCC1D0+20250811104610.8993-4-nick.li@foursemi.com Signed-off-by: Mark Brown commit fd90680da7e2d92e50ad72dfd4ea601098ab3493 Author: Nick Li Date: Mon Aug 11 18:46:07 2025 +0800 ASoC: dt-bindings: Add FS2104/5S audio amplifiers Add a DT schema for describing FourSemi FS2104/5S audio amplifiers which support both I2S and I2C interface. Signed-off-by: Nick Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/350C011186D85903+20250811104610.8993-3-nick.li@foursemi.com Signed-off-by: Mark Brown commit 243167e96939630b7d0d7f61be926d327e14a017 Author: Nick Li Date: Mon Aug 11 18:46:06 2025 +0800 dt-bindings: vendor-prefixes: Add Shanghai FourSemi Semiconductor Co.,Ltd Add vendor prefix for Shanghai FourSemi Semiconductor Co.,Ltd Link: https://en.foursemi.com/ Signed-off-by: Nick Li Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/EA25BCF08F8BA128+20250811104610.8993-2-nick.li@foursemi.com Signed-off-by: Mark Brown commit 1d0156c8b230ca74272708a3206684e6d6157302 Author: Sai Krishna Musham Date: Thu Aug 7 13:10:19 2025 +0530 PCI: amd-mdb: Add support for PCIe RP PERST# signal handling Add support for handling the AMD Versal Gen 2 MDB PCIe Root Port PERST# signal via a GPIO by parsing the new PCIe bridge node to acquire the reset GPIO. If the bridge node is not found, fall back to acquiring it from the PCIe host bridge node. As part of this, update the interrupt controller node parsing to use of_get_child_by_name() instead of of_get_next_child(), since the PCIe host bridge node now has multiple children. This ensures the correct node is selected during initialization. Signed-off-by: Sai Krishna Musham Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250807074019.811672-3-sai.krishna.musham@amd.com commit 0b9275edc3543d0d2d03313a7c8de5157d61b189 Author: Sai Krishna Musham Date: Thu Aug 7 13:10:18 2025 +0530 dt-bindings: PCI: amd-mdb: Add example usage of reset-gpios for PCIe RP PERST# Update the device tree binding example to include usage of the `reset-gpios` property in PCIe Root Port (RP) bridge node for PERST# signal handling. Signed-off-by: Sai Krishna Musham Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250807074019.811672-2-sai.krishna.musham@amd.com commit d96ac5bdc52b271b4f8ac0670a203913666b8758 Author: Marek Vasut Date: Wed Aug 6 21:25:18 2025 +0200 PCI: rcar-gen4: Fix PHY initialization R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 Figure 104.3b Initial Setting of PCIEC(example), middle of the figure indicates that fourth write into register 0x148 [2:0] is 0x3 or GENMASK(1, 0). The current code writes GENMASK(11, 0) which is a typo. Fix the typo. Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250806192548.133140-1-marek.vasut+renesas@mailbox.org commit add7b05aeeb417c86239e6731a168e6c46b83279 Author: Qiang Yu Date: Tue Jul 22 17:11:49 2025 +0800 PCI: qcom: Select PCI Power Control Slot driver Select the pwrctrl driver, which is utilized to manage the power supplies of the devices connected to the standard PCI slots conforming to specification like PCIe CEM. This ensures that the voltage rails of the standard PCI slots on some platforms eg. X1E80100-QCP can be correctly turned on/off if they are described in PCIe Root Port device tree node. Signed-off-by: Qiang Yu Signed-off-by: Wenbin Yao [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250722091151.1423332-2-quic_wenbyao@quicinc.com commit c494de2e00fb06d5b62708a91d7dda701abc52f4 Author: Fabrizio Castro Date: Tue Jun 24 20:23:04 2025 +0100 arm64: dts: renesas: r9a09g057: Add RSPI nodes Add nodes for the RSPI IPs found in the Renesas RZ/V2H(P) SoC. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250624192304.338979-7-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 8d0b6ca38f942292d9c1ae557150c58eaae63052 Author: Paul Barker Date: Tue Jun 17 18:19:57 2025 +0100 arm64: dts: renesas: Add initial support for the RZ/N2H EVK Add an initial device tree file for the Renesas RZ/N2H Evaluation Board (EVK). Signed-off-by: Paul Barker Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617171957.162145-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bddf6ae4f51755b31ad85906331f4bd4ded7632c Author: Paul Barker Date: Tue Jun 17 18:19:56 2025 +0100 arm64: dts: renesas: Add DTSI for R9A09G087M44 variant of RZ/N2H Add the device tree source include file for the R9A09G087M44 variant of the Renesas RZ/N2H SoC, which features a 4-core configuration. Signed-off-by: Paul Barker Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617171957.162145-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8989230e80113e2bd2f322fba6922f9a3252e9c0 Author: Paul Barker Date: Tue Jun 17 18:19:55 2025 +0100 arm64: dts: renesas: Refactor RZ/T2H EVK device tree The RZ/T2H EVK and RZ/N2H EVK are very similar boards. As there is so much overlap between these parts, common device tree entries are moved to the new file rzt2h-n2h-evk-common.dtsi. Signed-off-by: Paul Barker Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617171957.162145-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4b3d31f0b81fefae5874467081496467af0f05a7 Author: Lad Prabhakar Date: Tue Jun 17 18:19:54 2025 +0100 arm64: dts: renesas: Add initial SoC DTSI for the RZ/N2H SoC Add the initial SoC DTSI for the Renesas RZ/N2H ("R9A09G087") SoC, below is the list of blocks added: - EXT CLKs - 4x CA55 - SCIF - CPG - GIC - ARMv8 Timer Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617171957.162145-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a38f991fa19cb0d9375a95e04ccc93e7aaed4d34 Author: Thierry Bultel Date: Tue Jun 17 17:28:10 2025 +0100 arm64: dts: renesas: Add initial support for the Renesas RZ/T2H eval board Add the initial device tree for the RZ/T2H evaluation board. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617162810.154332-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d17b34744f5e4299109801c0a151e5dd31d76936 Author: Thierry Bultel Date: Tue Jun 17 17:28:09 2025 +0100 arm64: dts: renesas: Add initial support for the Renesas RZ/T2H SoC Add the initial dtsi for the RZ/T2H SoC: - GIC - ARMv8-timer - CPG clock - SCI0 UART also add arch/arm64/boot/dts/renesas/r9a09g077m44.dtsi, that keeps all 4 CPUs enabled, for consistency with later support of -m24 and -m04 SoC revisions, that only have 2 and 1 Cortex-A55, respectively, and that will use /delete-node/ to disable the missing CPUs. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617162810.154332-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 560c633d378a0cf34afcd66c99321d6306a7e937 Author: Lad Prabhakar Date: Wed Aug 6 20:55:55 2025 +0100 pinctrl: renesas: rzg2l: Drop oen_read and oen_write callbacks Remove oen_read and oen_write callbacks from rzg2l_pinctrl_data as all SoCs now use the same rzg2l_read_oen() and rzg2l_write_oen() functions directly. Change rzg2l_read_oen() return type to int for proper error reporting and update callers to handle errors consistently. This simplifies the code by removing redundant callbacks and ensures uniform OEN handling across all supported SoCs. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-8-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 54ac76e13ace31cf732bf5261811ef5af67022b7 Author: Lad Prabhakar Date: Wed Aug 6 20:55:54 2025 +0100 pinctrl: renesas: rzg2l: Add PFC_OEN support for RZ/G3E SoC Add support for configuring the PFC_OEN register on the RZ/G3E SoC to enable output-enable control for specific pins. On this SoC, certain pins such as TXC_TXCLK need to support switching between input and output modes depending on the PHY interface mode (e.g., MII vs RGMII). This functionality maps to the 'output-enable' property in the device tree and requires explicit control via the PFC_OEN register. This change updates the r9a09g047_variable_pin_cfg array to mark PB1, PE1, PL0, PL1, PL2, and PL4 with the PIN_CFG_OEN flag to indicate output-enable support. A new helper, rzg3e_pin_to_oen_bit(), is introduced to map these pin names to their respective OEN bit positions, and the corresponding callbacks are wired into the RZ/G3E SoC configuration using the generic rzg2l_read_oen() and rzg2l_write_oen() accessors. Additionally, the GPIO configuration for the PB, PE, and PL ports is updated to use the variable port pack macro, enabling per-pin configuration necessary for OEN handling. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit cd39805be85b8ff45b0ad2715d8de48dbe404cee Author: Lad Prabhakar Date: Wed Aug 6 20:55:53 2025 +0100 pinctrl: renesas: rzg2l: Unify OEN handling across RZ/{G2L,V2H,V2N} Unify the OEN handling on RZ/V2H(P) and RZ/V2N SoCs by reusing the existing rzg2l_read_oen and rzg2l_write_oen functions from RZ/G2L. Add a pin_to_oen_bit callback in rzg2l_pinctrl_data to look up per-pin OEN bit positions, and introduce an oen_pwpr_lock flag in the hwcfg to manage PWPR locking on SoCs that require it (RZ/V2H(P) family). Remove the hardcoded PFC_OEN define and obsolete per-SoC OEN helpers. Also drop redundant checks for the OEN offset in the suspend/resume paths, as all supported SoCs now provide a valid offset through the `regs.oen` field. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit dd0d40d8f4ac8c2cb5967fdb2e1efa70cfc0c9ee Author: Lad Prabhakar Date: Wed Aug 6 20:55:52 2025 +0100 pinctrl: renesas: rzg2l: Remove OEN ops for RZ/G3E The RZ/G3E pin controller does not advertise PIN_CFG_OEN capability, so there is no valid mapping for output-enable bits on this SoC. Remove the oen_read and oen_write callbacks from the RZ/G3E driver data to defer OEN support until PIN_CFG_OEN support is added. This is a preparatory change for future unification of OEN handling across the driver. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a3455a0c24834eaa20f032b214d53b1607d60073 Author: Lad Prabhakar Date: Wed Aug 6 20:55:51 2025 +0100 pinctrl: renesas: rzg2l: Unify OEN access by making pin-to-bit mapping configurable Refactor the RZG2L pinctrl driver to support reuse of the common rzg2l_read_oen() and rzg2l_write_oen() helpers across SoCs with different output-enable (OEN) bit mappings. Introduce a new `pin_to_oen_bit` callback in `struct rzg2l_pinctrl_data` to allow SoCs to provide custom logic for mapping a pin to its OEN bit. Update the generic OEN read/write paths to use this callback when present. With this change, SoCs like RZ/G3S can reuse the common OEN handling code by simply supplying their own `pin_to_oen_bit` implementation. The previously duplicated `rzg3s_oen_read()` and `rzg3s_oen_write()` functions are now removed. This improves maintainability and prepares the driver for supporting future SoCs with minimal duplication. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 27c76cc93c6c2ee6c0d7fec6dedc1214a977e66f Author: Lad Prabhakar Date: Wed Aug 6 20:55:50 2025 +0100 pinctrl: renesas: rzg2l: Parameterize OEN register offset Prepare for supporting SoCs with varying OEN register locations by parameterizing the OEN offset in the rzg2l driver. Introduce an `oen` field in the rzg2l_register_offsets structure and update rzg2l_read_oen(), rzg2l_write_oen(), suspend/resume caching, and SoC hwcfg entries to use this offset instead of the hard-coded ETH_MODE value. As part of this change, rename the field `eth_mode` in the register cache to `oen` to better reflect its general purpose and decouple the naming from a specific register. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250806195555.1372317-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d Author: Lad Prabhakar Date: Wed Jul 9 17:08:13 2025 +0100 pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() rzg3s_oen_read() returns a u32 value, but previously propagated a negative error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large positive value due to unsigned conversion. This caused incorrect output-enable reporting for certain pins. Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported as "output enabled" in the pinconf-pins debugfs file. With this fix, only P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the hardware manual. Fix this by returning 0 when the OEN bit lookup fails, treating the pin as output-disabled by default. Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8d81298d87f4a864ab8c786e82ca196a5001a531 Author: Philipp Zabel Date: Mon Jul 28 11:52:37 2025 +0200 MAINTAINERS: Use https:// protocol for Reset Controller Framework tree Use https:// protocol, the git.pengutronix.de server does not support git:// anymore. Reported-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250728095237.494132-1-p.zabel@pengutronix.de Signed-off-by: Philipp Zabel commit 110aa2c74dbd9de862afc8546d1b9be4c86f9eb0 Author: Qianfeng Rong Date: Tue Aug 5 10:32:22 2025 +0800 swiotlb: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250805023222.332920-1-rongqianfeng@vivo.com commit 9f683dfe8099639f9ac859287744a9ed1c3698a0 Author: Petr Tesarik Date: Thu Jul 10 10:38:29 2025 +0200 dma-direct: clean up the logic in __dma_direct_alloc_pages() Convert a goto-based loop to a while() loop. To allow the simplification, return early when allocation from CMA is successful. As a bonus, this early return avoids a repeated dma_coherent_ok() check. No functional change. Signed-off-by: Petr Tesarik Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250710083829.1853466-1-ptesarik@suse.com commit 0d1e68fb1efd2fe951d68cf05460e3672d4a846d Author: Waqar Hameed Date: Tue Aug 5 11:33:33 2025 +0200 gpio: twl4030: Remove error print for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Link: https://lore.kernel.org/r/pndjz3im7te.a.out@axis.com Signed-off-by: Bartosz Golaszewski commit 7ce73ee6dc5977fd9dbe8194e7e8073a2f9a50fb Author: Li Jun Date: Thu Jul 31 17:16:37 2025 +0800 gpio: aggregator: fix macros coding style error These changes just fix Linux Kernel Coding Style, no functional improve. -Macros with complex values should be enclosed in parentheses Signed-off-by: Li Jun Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250731091637.595136-1-lijun01@kylinos.cn Signed-off-by: Bartosz Golaszewski commit 03db20aaa3ba3998b5a025e243b04e33b5bdefa5 Author: Alexander Stein Date: Mon Jul 28 08:05:43 2025 +0200 gpio: stmpe: Allow to compile as a module Add the necessary boilerplate to also make this driver modular. Keep the subsys_initcall to not change registration order for built-in. Also add OF match table for module autoloading. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250728060544.18169-1-alexander.stein@ew.tq-group.com Signed-off-by: Bartosz Golaszewski commit 187a3426a664737381a70a3fca3b8108f2300de9 Author: Ivaylo Ivanov Date: Wed Jul 30 10:27:30 2025 +0300 dt-bindings: soc: samsung: usi: add samsung,exynos2200-usi compatible Add samsung,exynos2200-usi dedicated compatible for representing the USI of Samsung Exynos 2200 SoC. Signed-off-by: Ivaylo Ivanov Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20250730072730.1882549-1-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 1bce3444df79910512587a1f18022c396e9430b5 Author: Heiko Stuebner Date: Fri Jun 20 22:17:15 2025 +0200 arm64: dts: rockchip: convert rk3528 power-domains to dt-binding constants Now that the binding head has been merged, convert the power-domain ids back to these constants for easier handling. Reviewed-by: Jonas Karlman Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250620201715.1572609-1-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 3af6a83fc85033e44ce5cd0e1de54dc20b7e15af Author: Nicolas Frattaroli Date: Mon Jul 21 11:17:37 2025 +0200 arm64: dts: rockchip: enable NPU on ROCK 5B The NPU on the ROCK5B uses the same regulator for both the sram-supply and the npu's supply. Add this regulator, and enable all the NPU bits. Also add the regulator as a domain-supply to the pd_npu power domain. v8: - Remove notion of top core (Robin Murphy) Signed-off-by: Nicolas Frattaroli Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-10-77ebd484941e@tomeuvizoso.net Signed-off-by: Heiko Stuebner commit 640366d644b1e282771a09c72be37162b6eda438 Author: Tomeu Vizoso Date: Mon Jul 21 11:17:36 2025 +0200 arm64: dts: rockchip: Enable the NPU on quartzpro64 Enable the nodes added in a previous commit to the rk3588s device tree. v2: - Split nodes (Sebastian Reichel) - Sort nodes (Sebastian Reichel) - Add board regulators (Sebastian Reichel) v8: - Remove notion of top core (Robin Murphy) Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-9-77ebd484941e@tomeuvizoso.net Signed-off-by: Heiko Stuebner commit a31dfc060a747f08705ace36d8de006bc13318fa Author: Tomeu Vizoso Date: Mon Jul 21 11:17:35 2025 +0200 arm64: dts: rockchip: Add nodes for NPU and its MMU to rk3588-base See Chapter 36 "RKNN" from the RK3588 TRM (Part 1). The IP is divided in three cores, programmed independently. The first core though is special, being able to delegate work to the other cores. The IOMMU of the first core is also special in that it has two subunits (read/write?) that need to be programmed in sync. v2: - Have one device for each NPU core (Sebastian Reichel) - Have one device for each IOMMU (Sebastian Reichel) - Correctly sort nodes (Diederik de Haas) - Add rockchip,iommu compatible to IOMMU nodes (Sebastian Reichel) v3: - Adapt to a split of the register block in the DT bindings (Nicolas Frattaroli) v4: - Adapt to changes in bindings v6: - pclk and npu clocks are needed by all clocks (Rob Herring) v8: - Remove notion of top core (Robin Murphy) Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-8-77ebd484941e@tomeuvizoso.net Signed-off-by: Heiko Stuebner commit 6d64bceb97a1c93b3cc2131f7e023ef2f9cf33f2 Author: Nicolas Frattaroli Date: Mon Jul 21 11:17:34 2025 +0200 arm64: dts: rockchip: add pd_npu label for RK3588 power domains The NPU of the RK3588 has an external supply. This supply also affects the power domain of the NPU, not just the NPU device nodes themselves. Since correctly modelled boards will want the power domain to be aware of the regulator so that it doesn't always have to be on, add a label to the NPU power domain node so board files can reference it. Signed-off-by: Nicolas Frattaroli Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-7-77ebd484941e@tomeuvizoso.net Signed-off-by: Heiko Stuebner commit f4ee43ae6ea8c509d470f20e7b446adf5a167dba Author: Baojun Xu Date: Sun Aug 10 20:23:58 2025 +0800 ALSA: hda: Add TAS5825 support Add TAS5825 support in TI's HDA driver. TAS5825 is an on-chip DSP, but no calibration is required, and no global address support smart amplifier devices. Signed-off-by: Baojun Xu Acked-by: Mark Brown Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250810122358.1575-1-baojun.xu@ti.com commit 03714939b1e65e4456b69d2cb0c6d2555c7aaa76 Author: Colin Ian King Date: Fri Aug 8 11:46:21 2025 +0100 ALSA: hda: Fix spelling mistake "dismatch" -> "mismatch" There is a spelling mistake (or neologism of dis and match) in a dev_err message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250808104621.829448-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai commit 78b72897a5c8bb9d3b51fc6494a1eb09265487a4 Author: Peter Griffin Date: Thu Jul 17 17:22:36 2025 +0100 soc: samsung: exynos-pmu: Enable CPU Idle for gs101 Register cpu pm notifiers for gs101 which call the gs101_cpu_pmu_online/offline callbacks which in turn program the ACPM C2 hint. This hint is required to actually enter the C2 idle state in addition to the PSCI calls due to limitations in the el3mon/ACPM firmware. A couple of corner cases are handled, namely when the system is rebooting or suspending we ignore the request. Additionally the request is ignored if the CPU is in CPU hot plug. Some common code is refactored so that it can be called from both the CPU hot plug callbacks and CPU PM notifier taking into account that CPU PM notifiers are called with IRQs disabled whereas CPU hotplug callbacks are not. Additionally due to CPU PM notifiers using raw_spinlock the locking is updated to use raw_spinlock variants, this includes updating the pmu_regs regmap to use .use_raw_spinlock = true and additionally creating and registering a custom pmu-intr-gen regmap instead of using the regmap provided by syscon. Note: this patch has a runtime dependency on adding 'local-timer-stop' dt property to the CPU nodes. This informs the time framework to switch to a broadcast timer as the local timer will be shutdown. Without that DT property specified the system hangs in early boot with this patch applied. Signed-off-by: Peter Griffin Link: https://lore.kernel.org/r/20250717-gs101-cpuidle-v7-1-33d51770114b@linaro.org Signed-off-by: Krzysztof Kozlowski commit 2b5066a3a19a2870f353f8783f1ee63e61b8e371 Author: Md Sadre Alam Date: Wed Aug 6 16:58:06 2025 +0530 cpufreq: qcom-nvmem: Enable cpufreq for ipq5424 IPQ5424 have different OPPs available for the CPU based on SoC variant. This can be determined through use of an eFuse register present in the silicon. Added support for ipq5424 on nvmem driver which helps to determine OPPs at runtime based on the eFuse register which has the CPU frequency limits. opp-supported-hw dt binding can be used to indicate the available OPPs for each limit. nvmem driver also creates the "cpufreq-dt" platform_device after passing the version matching data to the OPP framework so that the cpufreq-dt handles the actual cpufreq implementation. Signed-off-by: Md Sadre Alam Signed-off-by: Sricharan Ramabadhran Reviewed-by: Konrad Dybcio [ Changed '!=' based check to '==' based check ] Signed-off-by: Varadarajan Narayanan Signed-off-by: Viresh Kumar commit a4053badacf3699023527392c947314b074f5e0e Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:43 2025 +0200 arm64: dts: rockchip: Add thermal trim OTP and tsadc nodes Thanks to Heiko's work getting OTP working on the RK3576, we can specify the thermal sensor trim values which are stored there now, and with my driver addition to rockchip_thermal, we can make use of these. Add them to the devicetree for the SoC. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-7-b6e9efbf1015@collabora.com Signed-off-by: Heiko Stuebner commit 15e8ba9d8b14ae6de415186622379f5f4dcfd141 Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:42 2025 +0200 arm64: dts: rockchip: Add thermal nodes to RK3576 Add the TSADC node to the RK3576. Additionally, add everything the TSADC needs to function, i.e. thermal zones, their trip points and maps, as well as adjust the CPU cooling-cells property. The polling-delay properties are set to 0 as we do have interrupts for this TSADC on this particular SoC, though the polling-delay-passive properties are set to 100 for the thermal zones that have a passive cooling device, as otherwise the thermal throttling behaviour never unthrottles. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-6-b6e9efbf1015@collabora.com Signed-off-by: Heiko Stuebner commit 6294d0590d5f65725e505b89978895bd04b55650 Author: Chaoyi Chen Date: Thu Jul 31 14:24:15 2025 +0800 arm64: dts: rockchip: Enable eMMC on rk3576-evb1-v10 Some rk3576-evb1 boards use eMMC instead of UFS. Enable eMMC for it. Signed-off-by: Chaoyi Chen Link: https://lore.kernel.org/r/20250731062415.212-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner commit 6f36b1fdb80dd1fdd24742af4ca435f76f73dfe9 Author: Chukun Pan Date: Sun Aug 10 18:00:20 2025 +0800 arm64: dts: rockchip: set LAN LEDs to default-off on Radxa E52C The NICs have default-trigger of "netdev" in order to show up as LAN/WAN connected, so their default-state should be set to "off". Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250810100020.445053-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 16d39e2bf96075dc266fdcf0f2507fc075c33676 Author: BowenYu Date: Wed Jul 30 11:06:49 2025 +0800 cpufreq: Remove unused parameter in cppc_perf_from_fbctrs() Remove the unused parameter cppc_cpudata* cpu_data in cppc_perf_from_fbctrs(). Signed-off-by: BowenYu Signed-off-by: Viresh Kumar commit 91ec67fa33250059a0c52bbf3148302f364a6e99 Author: Anton Kirilov Date: Thu Aug 7 18:00:11 2025 +0100 arm64: dts: rockchip: Enable HDMI audio output for NanoPi R6C/R6S Enable HDMI audio output for FriendlyElec NanoPi R6C/R6S boards. Signed-off-by: Anton Kirilov Link: https://lore.kernel.org/r/20250807170012.88178-1-anton.kirilov@arm.com Signed-off-by: Heiko Stuebner commit 17bd9599f07ff700b9fb7d15dfa1f1de42947a54 Author: Akhilesh Patil Date: Sat Aug 9 19:46:58 2025 +0530 cpufreq: armada-37xx: use max() to calculate target_vm Use max() macro while calculating target_vm to simplify and improve the armada-37xx-cpufreq driver code. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202503251256.rrl65HgY-lkp@intel.com/ Reported-by: Yang Ruibin <11162571@vivo.com> Closes: https://lore.kernel.org/lkml/2c55fb07-b29e-43e0-8697-f75d1f0df89a@vivo.com/ Signed-off-by: Akhilesh Patil Signed-off-by: Viresh Kumar commit 8640689f17fd550c3e89d2b47ecb02536c58baf3 Author: Christian Marangi Date: Sat Aug 9 13:28:30 2025 +0200 cpufreq: airoha: Add support for AN7583 SoC New Airoha AN7583 SoC use the same exact logic to control the CPU frequency. Add the Device compatible to the block list for cpufreq-dt-plat and to the Airoha CPUFreq driver compatible list. Signed-off-by: Christian Marangi Signed-off-by: Viresh Kumar commit 32e0d669f3ac9574862a64a56c9a6dff675f8600 Author: Nicolas Frattaroli Date: Wed Jul 16 19:51:25 2025 +0200 cpufreq: mediatek-hw: Add support for MT8196 The MT8196 SoC uses DVFS to set a desired target frequency for each CPU core. It also uses slightly different register offsets. Add support for it, which necessitates reworking how the mmio regs are acquired, as mt8196 has the fdvfs register before the performance domain registers. I've verified with both `sysbench cpu run` and `head -c 10G \ /dev/urandom | pigz -p 8 -c - | pv -ba > /dev/null` that we don't just get a higher reported clock frequency, but that the observed performance also increases, by a factor of 2.64 in an 8 thread sysbench test. Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Viresh Kumar commit 35eb6b78854d2e9671ce8ee6b735aa0114c48da8 Author: Nicolas Frattaroli Date: Wed Jul 16 19:51:24 2025 +0200 cpufreq: mediatek-hw: Separate per-domain and per-instance data As it stood, the mediatek cpufreq driver could get away with never really having a private driver instance struct. This is because all data was stored in the per-domain structs. However, this complicates matters when actual per-instance data like the variant struct is introduced. Instead of having a pointer to it for every domain, have a pointer to a global "priv" struct that can be extended over time, and rename the "data" struct to "domain" to distinguish its purpose better. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Viresh Kumar commit 2f5178abb9f5164061b9cbbb5dd860f4d206b03a Author: Nicolas Frattaroli Date: Wed Jul 16 19:51:23 2025 +0200 cpufreq: mediatek-hw: Refactor match data into struct While the driver could get away with having the per-compatible match data just be an array of the reg offsets, the only thing it used it for right now, this doesn't really allow it to be extended in any meaningful way if some other per-variant information needs to be communicated. In preparation of adding support for hybrid "FDVFS" for MT8196, refactor the code to make the DT match data a struct, which currently only contains a single member: the reg offsets. This will allow this struct to be extended with other members for other hardware variants. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Viresh Kumar commit 62498af7b1082d76031f98e4c3d6fb2b9af47772 Author: Nicolas Frattaroli Date: Wed Jul 16 19:51:22 2025 +0200 dt-bindings: cpufreq: Add mediatek,mt8196-cpufreq-hw binding The MediaTek MT8196 SoC has new cpufreq hardware, with added memory register ranges to control Dynamic-Voltage-Frequency-Scaling. The DVFS hardware is controlled through a set of registers referred to as "FDVFS". They set the target frequency the DVFS hardware should aim for for each performance domain. Instead of working around the old binding and its already established meanings for the reg items, add a new binding. The FDVFS register memory region is at the beginning, which allows us to easily expand this binding for future SoCs which may have more than 3 performance domains. Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Viresh Kumar commit 032c59c1d3cd456053339fb95f6ee8e68c5ad1e2 Author: Tzung-Bi Shih Date: Mon Jul 21 04:44:51 2025 +0000 platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev The fops doesn't really need to hold a reference to struct cros_ec_dev. Remove the references from the fops. No functional changes. Link: https://lore.kernel.org/r/20250721044456.2736300-4-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 432418bf27ababad360d4c07d2efcd235107a971 Author: Tzung-Bi Shih Date: Mon Jul 21 04:44:49 2025 +0000 platform/chrome: cros_ec_chardev: Remove redundant struct field `ec_dev` in the `struct chardev_data` is unused. Remove the field and the whole struct as well. Link: https://lore.kernel.org/r/20250721044456.2736300-2-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 0eff12ce88e1e77c465cbaa22d450fd268cd9b74 Author: Eric Biggers Date: Thu Jul 31 12:25:45 2025 -0700 thunderbolt: Use HMAC-SHA256 library instead of crypto_shash Use the hmac_sha256_usingrawkey() library function instead of the "hmac(sha256)" crypto_shash. This is simpler and faster. As a cleanup, change the input data parameters from "challenge, sizeof(hmac)" to "challenge, sizeof(challenge)", so that the size is being taken of the correct buffer. This is not a functional change, since it happens that sizeof(hmac) == sizeof(challenge). Replace the selection of CRYPTO and CRYPTO_HASH with CRYPTO_LIB_SHA256 and CRYPTO_LIB_UTILS. The latter is needed for crypto_memneq() which was previously being pulled in via CRYPTO. Signed-off-by: Eric Biggers Signed-off-by: Mika Westerberg commit dced755df3bc49e417ee4de45eec89bf5570b192 Author: Eric Biggers Date: Thu Jul 31 12:25:44 2025 -0700 thunderbolt: Compare HMAC values in constant time To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq(). Fixes: f67cf491175a ("thunderbolt: Add support for Internal Connection Manager (ICM)") Signed-off-by: Eric Biggers Signed-off-by: Mika Westerberg commit 5f5743e5b599bafe2ec5df2d33f616217a778135 Author: Ovidiu Panait Date: Fri Aug 8 23:48:30 2025 +0300 staging: axis-fifo: remove unnecessary dev_set_drvdata() calls Remove unnecessary dev_set_drvdata() calls - driver_data will be set to NULL in device_unbind_cleanup() at driver exit time. This allows us to remove the 'err_initial' label, simplifying the probe function a bit. Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250808204831.2618122-1-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit 498a14ce8e898eac7d55977625dc93c1e918e1d5 Author: Jannik Rehkemper Date: Thu Aug 7 20:54:37 2025 +0200 staging: rtl8723bs: fix checkpatch spaces preferred around that Added spaces where prefered or required by the checkpatch.pl script to adhere codestyle. Signed-off-by: Jannik Rehkemper Link: https://lore.kernel.org/r/20250807185436.853318-2-jannik@jrehkemper.de Signed-off-by: Greg Kroah-Hartman commit c158e7c293836f55a5cf1bc24f062573c13c5b1d Author: Michael Straube Date: Fri Aug 1 10:31:31 2025 +0200 staging: rtl8723bs: move rtw_reset_securitypriv to core/rtw_mlme.c Move the function rtw_reset_securitypriv from os_dep/mlme_linux.c to core/rtw_mlme.c to reduce code in the os_dep directory. The file os_dep/mlme_linux.c is finally empty now and we can remove it. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 522440e4176a67339c2e9a9db2a5d87cd87e656f Author: Michael Straube Date: Fri Aug 1 10:31:30 2025 +0200 staging: rtl8723bs: move rtw_report_sec_ie to core/rtw_mlme.c Move the function rtw_report_sec_ie from os_dep/mlme_linux.c to core/rtw_mlme.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7bb7804420b7a728ca990ff4872e7b5ba44ea780 Author: Michael Straube Date: Fri Aug 1 10:31:29 2025 +0200 staging: rtl8723bs: merge rtw_os_indicate_disconnect into rtw_indicate_disconnect Merge the functionality of the function rtw_os_indicate_disconnect into the function rtw_indicate_disconnect to reduce code in the os_dep directory. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit ff059535aa64677d80c4c3c7b99e983989108c68 Author: Michael Straube Date: Fri Aug 1 10:31:28 2025 +0200 staging: rtl8723bs: merge rtw_os_indicate_connect into rtw_indicate_connect Merge the functionality of the function rtw_os_indicate_connect into the function rtw_indicate_connect to reduce code in the os_dep directory. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit eec9d92d080d324b390ad55514199c1b1298ea18 Author: Michael Straube Date: Fri Aug 1 10:31:27 2025 +0200 staging: rtl8723bs: remove wrapper init_addba_retry_timer The function init_addba_retry_timer is just a wrapper around timer_setup. Remove the wrapper and use timer_setup directly. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 472646fce339a3a4af144cf458f3ac16a3c30d13 Author: Michael Straube Date: Fri Aug 1 10:31:26 2025 +0200 staging: rtl8723bs: move rtw_init_mlme_timer to core/rtw_mlme.c Move the function rtw_init_mlme_timer from os_dep/mlme_linux.c to core/rtw_mlme.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6f9ada0a6916c80a3d0e7ed11c773b51b227f2e0 Author: Michael Straube Date: Fri Aug 1 10:31:25 2025 +0200 staging: rtl8723bs: move init_mlme_ext_timer to core/rtw_mlme_ext.c Move the function init_mlme_ext_timer from os_dep/mlme_linux.c to core/rtw_mlme_ext.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7c0480fd766efced3a3df25b202f6914135576a7 Author: Michael Straube Date: Fri Aug 1 10:31:24 2025 +0200 staging: rtl8723bs: remove wrapper rtw_os_indicate_scan_done The function rtw_os_indicate_scan_done is just a wrapper around rtw_cfg80211_indicate_scan_done. Use rtw_cfg80211_indicate_scan_done directly and remove the wrapper. Signed-off-by: Michael Straube Tested-by: Hans de Goede Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250801083131.82915-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 08a2e17462dc3b78693124530396eadd380badee Author: Zhuoheng Li Date: Tue Aug 5 10:38:16 2025 +0800 staging: rtl8723bs: fix space-before-tab warnings Fixes multiple coding style issues reported by checkpatch.pl: "WARNING: please, no space before tabs". This patch only adjusts whitespace indentation without changing functionality. Signed-off-by: Zhuoheng Li Link: https://lore.kernel.org/r/20250805023816.3741-1-15620332615@163.com Signed-off-by: Greg Kroah-Hartman commit 4a9e0777bf0beb00c6e96cf311bd7c4c255ab341 Author: Len Bao Date: Sun Jul 27 10:10:47 2025 +0000 staging: octeon: Use 'u64' instead of 'uint64_t' in union cvmx_pip_wqe_word2 In the kernel type 'u64' is preferred over type 'uint64_t'. So, refactor the 'union cvmx_pip_wqe_word2' to use the former. At the same time, take advantage of this to align the bits quantity to improve readability. Also, separate the structs with blank lines to gain readability. Signed-off-by: Len Bao Link: https://lore.kernel.org/r/20250727101052.41181-1-len.bao@gmx.us Signed-off-by: Greg Kroah-Hartman commit 520c9fde09b557559fe512cc5b2ba689cd08567e Author: Bruce Qin Date: Thu Jul 24 21:25:33 2025 +0200 staging: rtl8723bs: fix if-statement alignment and line continuation in rtw_ap.c This patch fixes several style issues in a multiline if-statement: - Moved '&&' to the end of the previous line to follow logical continuation style - Fixed indentation to align with the opening parenthesis of the expression - Avoided ending a line with an open parenthesis '(' - Moved closing ')' to the end of the last expression line (as suggested by the maintainer) These changes improve readability and conform to Linux kernel coding conventions. No functional changes. Signed-off-by: Bruce Qin Link: https://lore.kernel.org/r/20250724192533.21141-1-bqn9090@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5225c689dd9048b67ddf3044da68cc17ab1aa04e Author: Ali Nasrolahi Date: Thu Jul 24 21:28:19 2025 +0330 staging: rtl8723bs: fix comment formatting in basic_types.h This patch fixes several block comment formatting issues in basic_types.h to comply with the Linux kernel coding style. Changes include: - Aligning comment markers with asterisks in multi-line comments - Reformatting long lines for better readability - Improving consistency in comment structure - Fixing typos in comments These changes improve readability and remove checkpatch.pl warnings. No functional changes introduced. Signed-off-by: Ali Nasrolahi Link: https://lore.kernel.org/r/20250724175819.29142-1-A.Nasrolahi01@gmail.com Signed-off-by: Greg Kroah-Hartman commit 684339e80a9392cf8d331479d0942682ba0bb5ac Author: Rob Herring (Arm) Date: Fri Aug 1 15:07:27 2025 -0500 dt-bindings: PCI: Add missing "#address-cells" to interrupt controllers An interrupt-controller node which is the parent provider for "interrupt-map" needs an "#address-cells" property. This fixes "interrupt_map" warnings in new dtc. Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250801200728.3252036-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 99ea5a0d6bc820b15727cea006561ede7339bb79 Author: Wasim Nazir Date: Sun Aug 3 16:31:12 2025 +0530 arm64: dts: qcom: Add lemans evaluation kit (EVK) initial board support Lemans EVK is an IoT board without safety monitoring feature of Safety Island(SAIL) subsystem. Lemans EVK is single board supporting these peripherals: - Storage: 2 × 128 GB UFS, micro-SD card, EEPROMs for MACs, eMMC on mezzanine card - Audio/Video, Camera & Display ports - Connectivity: RJ45 2.5GbE, WLAN/Bluetooth, CAN/CAN-FD - Sensors: IMU - PCIe ports - USB & UART ports On top of lemans EVK board additional mezzanine boards can be stacked in future. Implement basic features like uart/ufs to enable 'boot to shell'. Co-developed-by: Rakesh Kota Signed-off-by: Rakesh Kota Co-developed-by: Sayali Lokhande Signed-off-by: Sayali Lokhande Reviewed-by: Konrad Dybcio Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-9-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e9d84a1f8bfe85b6c406c4a088e537d4a5f83a87 Author: Wasim Nazir Date: Sun Aug 3 16:31:11 2025 +0530 dt-bindings: arm: qcom: lemans: Add bindings for Lemans Evaluation Kit (EVK) Introduce new bindings for the Lemans EVK, an IoT board without safety features. Signed-off-by: Wasim Nazir Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250803110113.401927-8-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b4feac9e034fe1a609619cb7feb55217fd5d6583 Author: Wasim Nazir Date: Sun Aug 3 16:31:10 2025 +0530 arm64: dts: qcom: lemans: Fix dts inclusion for IoT boards and update memory map IoT boards currently inherit the automotive memory map, which is not suitable for their configuration. This leads to incorrect memory layout and inclusion of unnecessary carveouts. Use lemans.dtsi as the base for IoT boards to apply the correct memory map. Include additional DTSI files as needed to complete the board configuration. Update 'model' string to represent these boards as 'lemans'. Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-7-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d39e1d737bdb0242e1d70345bb1ecfc8382289ce Author: Wasim Nazir Date: Sun Aug 3 16:31:09 2025 +0530 arm64: dts: qcom: lemans: Rename sa8775p-pmics.dtsi to lemans-pmics.dtsi The existing PMIC DTSI file is named sa8775p-pmics.dtsi, which does not align with the updated naming convention for Lemans platform components. This inconsistency can lead to confusion and misalignment with other platform-specific files. Rename the file to lemans-pmics.dtsi to reflect the platform naming convention and improve clarity. Signed-off-by: Wasim Nazir Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250803110113.401927-6-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 76326da895b889f7f0b20e5ba5cc47b836521f44 Author: Wasim Nazir Date: Sun Aug 3 16:31:08 2025 +0530 arm64: dts: qcom: lemans: Refactor ride/ride-r3 boards based on daughter cards Ride/Ride-r3 boards used with lemans and derivatives: - Are composed of multiple daughter cards (SoC-card, display, camera, ethernet, pcie, sensor, front & backplane, WLAN & BT). - Across lemans & its derivatives, SoM is changing. - Across Ride & Ride-r3 board, ethernet card is changing. Excluding the differences all other cards i.e SoC-card, display, camera, PCIe, sensor, front & backplane are same across Ride/Ride-r3 boards used with lemans and derivatives. Describe all the common cards in lemans-ride-common so that it can be reused for all the variants of ride & ride-r3 platforms in lemans and derivatives. Nacked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-5-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4c0c97b95a9b05e3886c3453492a465507d5c09b Author: Wasim Nazir Date: Sun Aug 3 16:31:07 2025 +0530 arm64: dts: qcom: lemans: Separate out ethernet card for ride & ride-r3 Ride & Ride-r3 in lemans/lemans-auto uses different ethernet cards with different phy capabilities. Separate out the ethernet card information from main board so that it can be reused for all the variants of ride & ride-r3 platforms in lemans/lemans-auto. Lemans/lemans-auto Ride uses 1G phy while Lemans/lemans-auto Ride-r3 uses 2.5G phy. Introduce ethernet cards with 1G & 2.5G phy capabilities respectively: *-88ea1512.dtsi is for 2x 1G - SGMII (Marvell 88EA1512-B2) phy *-aqr115c.dtsi is for 2x 2.5G - HSGMII (Marvell AQR115c) phy Nacked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-4-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 24dc241bddcde97f4099b5b8ebb3b211d5e7122c Author: Wasim Nazir Date: Sun Aug 3 16:31:06 2025 +0530 arm64: dts: qcom: lemans: Update memory-map for IoT platforms The "automotive" memory map is the special case for the Lemans configuration described by this dtsi, move it aside and use the IoT memory map as the baseline. Introduce "lemans-auto" as a derivative of "lemans" that retains the old automotive memory map to support legacy use cases. As part of the IoT memory map updates: - Introduce new carveouts for gunyah_md and pil_dtb. Adjust the size and base address of the PIL carveout to accommodate these changes. - Increase the size of the video/camera PIL carveout without affecting existing functionality. - Reduce the size of the trusted apps carveout to meet IoT-specific requirements. - Remove audio_mdf_mem, tz_ffi_mem, and their corresponding SCM references, as they are not required for IoT platforms. Co-developed-by: Pratyush Brahma Signed-off-by: Pratyush Brahma Co-developed-by: Prakash Gupta Signed-off-by: Prakash Gupta Nacked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-3-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c7724332e0ac88168723f4140cef4c8ba92f87e0 Author: Wasim Nazir Date: Sun Aug 3 16:31:05 2025 +0530 arm64: dts: qcom: Rename sa8775p SoC to "lemans" SA8775P, QCS9100 and QCS9075 are all variants of the same die, collectively referred to as lemans. Most notably, the last of them has the SAIL (Safety Island) fused off, but remains identical otherwise. In an effort to streamline the codebase, rename the SoC DTSI, moving away from less meaningful numerical model identifiers. Reviewed-by: Konrad Dybcio Nacked-by: Krzysztof Kozlowski Signed-off-by: Wasim Nazir Link: https://lore.kernel.org/r/20250803110113.401927-2-wasim.nazir@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 633ffe23173d947e4075ecf419889a59e6851ea9 Author: Dmitry Baryshkov Date: Fri Jul 18 18:25:41 2025 +0300 arm64: dts: qcom: sm8550: stop using SoC-specific genpd indices The SM8550 has switched to RPMHPD_* indices for RPMh power domains, however commit e271b59e39a6 ("arm64: dts: qcom: sm8550: Add camera clock controller") brought some more old-style indices. Convert all of them to use common RPMh PD indices. Fixes: e271b59e39a6 ("arm64: dts: qcom: sm8550: Add camera clock controller") Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250718-fix-rpmhpd-abi-v2-4-0059edb9ddb3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c48aa92720dc1b883982b1b7e110429d2e316c22 Author: Dmitry Baryshkov Date: Fri Jul 18 18:25:40 2025 +0300 arm64: dts: qcom: sm8250: stop using SoC-specific genpd indices The SM8250 has switched to RPMHPD_* indices for RPMh power domains, however commit 86a9264b6c56 ("arm64: dts: qcom: sm8250: Add interconnects and power-domains to QUPs") brought some more old-style indices. Convert all of them to use common RPMh PD indices. Fixes: 86a9264b6c56 ("arm64: dts: qcom: sm8250: Add interconnects and power-domains to QUPs") Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250718-fix-rpmhpd-abi-v2-3-0059edb9ddb3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1d517444b21e49bb049dc1ca9df0281ba5203c86 Author: Dmitry Baryshkov Date: Fri Jul 18 18:25:39 2025 +0300 arm64: dts: qcom: sm8150: use correct PD for DisplayPort controller Commit 5dd110c90a50 ("arm64: dts: qcom: sm8150: add DisplayPort controller") specified SM8250_MMCX (= 6) for the DisplayPort power domain, however on SM8150 this indices maps to SM8150_MX_AO (= 6). Use correct indice instead (SM8150_MMCX = 9). Fixes: 5dd110c90a50 ("arm64: dts: qcom: sm8150: add DisplayPort controller") Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-fix-rpmhpd-abi-v2-2-0059edb9ddb3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3ede313b5ec41bf1064fc35a168618eaee0d8e98 Author: Dmitry Baryshkov Date: Fri Jul 18 18:25:38 2025 +0300 arm64: dts: qcom: sa8775p: fix RPMh power domain indices On SA8775P power domains device doesn't use unufied (RPMHPD_foo) ABI, but it uses SoC-specific indices (SA8775P_foo). Consequently, all DSP on that platform are referencing random PDs instead of the expected ones. Correct indices used for that platform. Fixes: df54dcb34ff2 ("arm64: dts: qcom: sa8775p: add ADSP, CDSP and GPDSP nodes") Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250718-fix-rpmhpd-abi-v2-1-0059edb9ddb3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 13587befb34ffa5d605196494c243420e045f28e Author: Tomer Maimon Date: Sun Jul 6 16:42:07 2025 +0300 arm64: dts: nuvoton: add refclk and update peripheral clocks for NPCM845 Add a 25 MHz fixed-clock node (refclk) in the NPCM845-EVB board device tree to represent the external reference clock used by the NPCM845 reset and clock controller. Update peripherals (timer0, watchdog0-2) in the NPCM845 device tree to reference this refclk directly instead of the previous clock controller output (NPCM8XX_CLK_REFCLK). Depends-on: arm64: dts: nuvoton: Combine NPCM845 reset and clk nodes Signed-off-by: Tomer Maimon Link: https://patch.msgid.link/20250706134207.2168184-3-tmaimon77@gmail.com Signed-off-by: Andrew Jeffery commit 2e6028f8faf07e896ea4c2603adb4b06e8cb92fa Author: Tomer Maimon Date: Sun Jul 6 16:42:06 2025 +0300 arm64: dts: nuvoton: combine NPCM845 reset and clk nodes Combine the NPCM845 reset and clock controller nodes into a single node with compatible "nuvoton,npcm845-reset" in nuvoton-common-npcm8xx.dtsi, using the auxiliary device framework to provide clock functionality. Update the register range to 0xC4 to cover the shared reset and clock registers at 0xf0801000. Remove the separate nuvoton,npcm845-clk node, as the reset driver now handles clocks via an auxiliary device. Signed-off-by: Tomer Maimon Link: https://patch.msgid.link/20250706134207.2168184-2-tmaimon77@gmail.com Signed-off-by: Andrew Jeffery commit 91f8329e67b482faa1646609f457ea0f74b93a53 Author: Tomer Maimon Date: Sun Jul 6 18:35:51 2025 +0300 arm64: dts: nuvoton: npcm845: Add pinctrl groups Add 64 missing pinctrl groups to the NPCM845 device tree source file to support additional pinmux configurations defined in the npcm845-pinctrl driver. This enhances the pinmux configuration for the NPCM845 SoC, enabling further hardware pin functionalities. Signed-off-by: Tomer Maimon Link: https://patch.msgid.link/20250706153551.2180052-1-tmaimon77@gmail.com Signed-off-by: Andrew Jeffery commit 7686b441c0ad921211b0a69977bad746d18e4b33 Author: Krzysztof Kozlowski Date: Thu Jul 17 16:23:02 2025 +0200 ARM: dts: nuvoton: Use generic "ethernet" as node name Common name for Ethernet controllers is "ethernet", not "eth", also recommended by Devicetree specification in "Generic Names Recommendation". Verified lack of impact using dtx_diff. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250717142301.92548-2-krzysztof.kozlowski@linaro.org Signed-off-by: Andrew Jeffery commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 Author: Ryan Chen Date: Thu Aug 7 08:52:08 2025 +0800 soc: aspeed: socinfo: Add AST27xx silicon IDs Extend the ASPEED SoC info driver to support AST27XX silicon IDs. Signed-off-by: Ryan Chen Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com Signed-off-by: Andrew Jeffery commit c5313eea3e623c81ecf7dd8fe09e6ccf904e4a36 Author: Rob Herring (Arm) Date: Thu Jul 3 13:35:07 2025 -0500 soc: aspeed: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_address_to_resource() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250703183508.2074735-1-robh@kernel.org Signed-off-by: Andrew Jeffery commit b785b5d88cc27a521ea22b3afd85804c4c321d4a Author: Tan Siewert Date: Sun Aug 3 17:19:40 2025 +0200 ARM: dts: aspeed: x570d4u: convert NVMEM content to layout syntax The used bindings syntax has been deprecated and doesn't work properly anymore. Use the newer (and non-deprecated) fixed-layout approach. See commit bd912c991d2e ("dt-bindings: nvmem: layouts: add fixed-layout") for details. Signed-off-by: Tan Siewert Reviewed-by: Zev Weiss Link: https://patch.msgid.link/20250803151949.68618-4-tan@siewert.io Signed-off-by: Andrew Jeffery commit 1f5ab37b75afbfad686c56c010b2ba93a096ca87 Author: Tan Siewert Date: Sun Aug 3 17:19:39 2025 +0200 ARM: dts: aspeed: romed8hm3: convert NVMEM content to layout syntax The used bindings syntax has been deprecated and doesn't work properly anymore. Use the newer (and non-deprecated) fixed-layout approach. See commit bd912c991d2e ("dt-bindings: nvmem: layouts: add fixed-layout") for details. Signed-off-by: Tan Siewert Reviewed-by: Zev Weiss Link: https://patch.msgid.link/20250803151949.68618-3-tan@siewert.io Signed-off-by: Andrew Jeffery commit 2660d172a346a5f6fabc8b4e07fb57751d0b2fd7 Author: Tan Siewert Date: Sun Aug 3 17:19:38 2025 +0200 ARM: dts: aspeed: e3c256d4i: convert NVMEM content to layout syntax The used bindings syntax has been deprecated and doesn't work properly anymore. Use the newer (and non-deprecated) fixed-layout approach. See commit bd912c991d2e ("dt-bindings: nvmem: layouts: add fixed-layout") for details. Signed-off-by: Tan Siewert Reviewed-by: Zev Weiss Link: https://patch.msgid.link/20250803151949.68618-2-tan@siewert.io Signed-off-by: Andrew Jeffery commit 5bf96232edfaa83984d7637f83dae75a9a9670eb Author: Tan Siewert Date: Sun Aug 3 17:19:37 2025 +0200 ARM: dts: aspeed: e3c246d4i: convert NVMEM content to layout syntax The used bindings syntax has been deprecated and doesn't work properly anymore. Use the newer (and non-deprecated) fixed-layout approach. See commit bd912c991d2e ("dt-bindings: nvmem: layouts: add fixed-layout") for details. Signed-off-by: Tan Siewert Reviewed-by: Zev Weiss Link: https://patch.msgid.link/20250803151949.68618-1-tan@siewert.io Signed-off-by: Andrew Jeffery commit 608e2990e67c0e367cc87a86301f2e57b9fffc7e Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:20 2025 -0500 ARM: dts: aspeed: Add missing "ibm,spi-fsi" compatibles The "ibm,spi-fsi" compatible is missing or incorrect in various nodes. The incorrect cases used the "ibm,fsi2spi" compatible by mistake which is the parent node of the actual SPI controller nodes. Signed-off-by: Rob Herring (Arm) Acked-by: Eddie James Link: https://patch.msgid.link/20250731-dt-fsi-cleanups-v1-3-e7b695a29fc3@kernel.org Signed-off-by: Andrew Jeffery commit b1ccd095b8ac4c843cf6bf15d9f6aadd8ae1195d Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:19 2025 -0500 ARM: dts: aspeed: Drop "fsi-master" compatibles The "fsi-master" compatible has been used inconsistently on FSI masters. It doesn't have any real use or meaning, so it's easier to drop it everywhere than add it where missing. It is also not documented by any schemas (only .txt bindings). Signed-off-by: Rob Herring (Arm) Acked-by: Eddie James Link: https://patch.msgid.link/20250731-dt-fsi-cleanups-v1-2-e7b695a29fc3@kernel.org [arj: Drop hunk affecting removed swift platform] Signed-off-by: Andrew Jeffery commit 3ca621af06072aeffbaf845a407e5ff6e22c79b4 Author: Rob Herring (Arm) Date: Thu Jul 31 17:12:18 2025 -0500 ARM: dts: aspeed: Drop "no-gpio-delays" The "no-gpios-delays" property only applies to the "fsi-master-gpio" binding and not the "aspeed,ast2[45]00-cf-fsi-master" binding. It doesn't really make sense either as the timing is controlled by the offloaded firmware. Signed-off-by: Rob Herring (Arm) Acked-by: Eddie James Link: https://patch.msgid.link/20250731-dt-fsi-cleanups-v1-1-e7b695a29fc3@kernel.org Signed-off-by: Andrew Jeffery commit 88950abacd5b9b8215125609dcf9449d8031417a Author: Tao Ren Date: Sun Jul 27 22:56:15 2025 -0700 ARM: dts: aspeed: Add Facebook Darwin (AST2600) BMC Add initial device tree for the Meta (Facebook) Darwin AST2600 BMC. Darwin is Meta's rack switch platform with an AST2600 BMC integrated for health monitoring purpose. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-14-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 0ae11080995f30cfb8362d5680e361da04fa6f79 Author: Tao Ren Date: Sun Jul 27 22:56:14 2025 -0700 dt-bindings: arm: aspeed: add Facebook Darwin board Document the new compatibles used on Meta/Facebook Darwin board. Signed-off-by: Tao Ren Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250728055618.61616-13-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit b0f294fdfc3e472839a9bc0dc91f2322e27e38ef Author: Tao Ren Date: Sun Jul 27 22:56:13 2025 -0700 ARM: dts: aspeed: facebook-fuji: Include facebook-fuji-data64.dts Include "facebook-fuji-data64.dts" in facebook-fuji dts to avoid duplicated code. Fuji-data64 and Fuji are identical except the BMC flash layout. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-12-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 1bc26258369e020d27ef11d1efd7ff82b0a9192f Author: Tao Ren Date: Sun Jul 27 22:56:12 2025 -0700 ARM: dts: aspeed: Add Facebook Fuji-data64 (AST2600) Board Introduce fuji-data64.dts to extend Meta/Facebook Fuji BMC's data0 partition without breaking the existing users. Fuji-data64.dts is copied from fuji.dts with below changes: - updating model/compatible strings. - updating FMC flash0' data0 partition to 64MB. - removing mac3. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-11-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 36296b06cd50e790d1769bb1299670b5c83ba3a7 Author: Tao Ren Date: Sun Jul 27 22:56:11 2025 -0700 dt-bindings: arm: aspeed: add Facebook Fuji-data64 board Document the new compatibles used on Meta/Facebook Fuji-data64 board. Signed-off-by: Tao Ren Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250728055618.61616-10-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit fe0e2fbb6a7801883df3567b1e89b834c0969998 Author: Tao Ren Date: Sun Jul 27 22:56:10 2025 -0700 ARM: dts: aspeed: wedge400: Include wedge400-data64.dts Include "wedge400-data64.dts" in wedge400 dts to avoid duplicated code. Wedge400-data64 and Wedge400 are identical except the BMC flash layout. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-9-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 2baf3b61f05cedd470b460a3b6fd1bcabd02be51 Author: Tao Ren Date: Sun Jul 27 22:56:09 2025 -0700 ARM: dts: aspeed: Add Facebook Wedge400-data64 (AST2500) BMC Add wedge400-data64.dts to extend wedge400's data0 partition from 8MB to 64MB smoothly. wedge400-data64.dts is copied from wedge400.dts with below changes: - updating model/compatible strings. - updating flash0 partition. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-8-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 83656699ba3ab61a86b83daf4579cb5598d68c55 Author: Tao Ren Date: Sun Jul 27 22:56:08 2025 -0700 dt-bindings: arm: aspeed: add Facebook Wedge400-data64 board Document the new compatibles used on Meta/Facebook Wedge400-data64 board. Signed-off-by: Tao Ren Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250728055618.61616-7-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit e1b5c5f54797a61073e564278e7dbefb469c1c50 Author: Tao Ren Date: Sun Jul 27 22:56:07 2025 -0700 ARM: dts: aspeed: Add facebook-bmc-flash-layout-128-data64.dtsi Add facebook-bmc-flash-layout-128-data64.dts (with 64MB datastore) to be used by Meta Network BMC platforms. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-6-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit c11f9190f9d6a08953d5346c016a29c42ddb17dd Author: Tao Ren Date: Sun Jul 27 22:56:06 2025 -0700 ARM: dts: aspeed: Move eMMC out of ast2600-facebook-netbmc-common.dtsi Move eMMC entries from ast2600-facebook-netbmc-common.dtsi to each platform because eMMC is removed from future Meta/Facebook AST2600 Network BMC platforms. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-5-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit dc4717e34f6942628f26dc19c831a8dfecc76c31 Author: Tao Ren Date: Sun Jul 27 22:56:05 2025 -0700 ARM: dts: aspeed: Fix DTB warnings in ast2600-facebook-netbmc-common.dtsi Fix deprecated spi-gpio properties in ast2600-facebook-netbmc-common.dtsi. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-4-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 78831e53bb2162809f4ed6d2463bbea947c70b24 Author: Tao Ren Date: Sun Jul 27 22:56:04 2025 -0700 ARM: dts: aspeed: fuji: Fix DTB warnings Remove redundant adm1278 properties from fuji dts. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-3-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit fc6c8ccfaa142bbfd981ed3afb9ed894d7980dba Author: Tao Ren Date: Sun Jul 27 22:56:03 2025 -0700 ARM: dts: aspeed: wedge400: Fix DTB warnings Fix the deprecated spi-gpio properties in wedge400 dts. Signed-off-by: Tao Ren Link: https://patch.msgid.link/20250728055618.61616-2-rentao.bupt@gmail.com Signed-off-by: Andrew Jeffery commit 2b4e0d787dcd7fb936b0b2f2d095a5ef3754351d Author: Willie Thai Date: Thu Jul 17 09:52:13 2025 +0000 ARM: dts: aspeed: nvidia: gb200nvl: Enable MAC0 for BMC network Upstream-Status: Inappropriate Bad devices Signed-off-by: Deepak Kodihalli Signed-off-by: Ed Tanous Signed-off-by: Willie Thai Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250717-update-gb200nvl-dts-for-new-hardware-v3-4-f28145c55c98@nvidia.com Signed-off-by: Andrew Jeffery commit 2193aed6024c5766375a25f84f267053819090d0 Author: Willie Thai Date: Thu Jul 17 09:52:12 2025 +0000 ARM: dts: aspeed: nvidia: gb200nvl: Repurpose the HMC gpio pin Repurpose the HMC reset pin to FPGA reset pin. This change is according to hardware change. Signed-off-by: Deepak Kodihalli Signed-off-by: Ed Tanous Signed-off-by: Willie Thai Link: https://patch.msgid.link/20250717-update-gb200nvl-dts-for-new-hardware-v3-3-f28145c55c98@nvidia.com Signed-off-by: Andrew Jeffery commit 63d2e5dd62ab4002be544bbe109d7516a1377d37 Author: Willie Thai Date: Thu Jul 17 09:52:11 2025 +0000 ARM: dts: aspeed: nvidia: gb200nvl: Enable i2c3 bus Enable i2c3 bus for telemetry fetching purpose. Signed-off-by: Deepak Kodihalli Signed-off-by: Ed Tanous Signed-off-by: Willie Thai Link: https://patch.msgid.link/20250717-update-gb200nvl-dts-for-new-hardware-v3-2-f28145c55c98@nvidia.com Signed-off-by: Andrew Jeffery commit b20d199da7be0602013e88123e9fe1b17f22a4cb Author: Willie Thai Date: Thu Jul 17 09:52:10 2025 +0000 ARM: dts: aspeed: nvidia: gb200nvl: Add VCC Supply Add Vcc supply to avoid probing the devices before they have power. Signed-off-by: Deepak Kodihalli Signed-off-by: Ed Tanous Signed-off-by: Willie Thai Link: https://patch.msgid.link/20250717-update-gb200nvl-dts-for-new-hardware-v3-1-f28145c55c98@nvidia.com Signed-off-by: Andrew Jeffery commit a1d0b0ae65ae3f32597edfbb547f16c75601cd87 Author: Gabor Juhos Date: Fri Aug 8 15:15:32 2025 +0200 spi: spi-qpic-snand: avoid double assignment in qcom_spi_probe() The snandc->dev pointer is being assigned twice in the qcom_spi_probe() function. Remove the second assignment as that uses the same pointer value than the first one. No functional changes. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250808-qpic-snand-double-assign-fix-v2-1-1a3d0ed0d404@gmail.com Signed-off-by: Mark Brown commit 91e5722baaea06c1f1b105e9e3fd6645dbdd938b Author: Manikandan Muralidharan Date: Wed Jul 30 15:40:15 2025 +0530 spi: atmel: Add support for handling GCLK as a clock source The SPI peripheral clock is typically used to derive the serial clock (SPCK) via the FLEX_SPI_CSRx.SCBR field. However, on platforms like the SAM9X7 SoC, where the peripheral clock can reach up to 266 MHz, this may exceed the SCBR limit, causing SPI transfers to fail. This patch adds support for using the SPI Generic Clock (GCLK) as an alternative and more flexible clock source for SPCK generation. The FLEX_SPI_MR.BRSRCCLK bit is updated accordingly to select between the peripheral clock and GCLK. Signed-off-by: Manikandan Muralidharan Link: https://patch.msgid.link/20250730101015.323964-3-manikandan.m@microchip.com Signed-off-by: Mark Brown commit a673ebd0a2a587f3d6b923d59d363fc9e8a9f920 Author: Manikandan Muralidharan Date: Wed Jul 30 15:40:14 2025 +0530 spi: dt-bindings: atmel,at91rm9200-spi: Add support for optional 'spi_gclk' clock Update the Atmel SPI DT binding to support an optional programmable SPI generic clock 'spi_gclk', in addition to the required 'spi_clk'. Signed-off-by: Manikandan Muralidharan Link: https://patch.msgid.link/20250730101015.323964-2-manikandan.m@microchip.com Signed-off-by: Mark Brown commit 379f819733f28b5aa1802f3ede442f08b7275f4e Author: Manikandan Muralidharan Date: Wed Jul 30 15:40:13 2025 +0530 spi: atmel: simplify MR register update in cs_activate() simplified the MR register configuration by updating only the PCS field using SPI_BFINS() instead of rewriting the entire register. Avoids code duplication. Signed-off-by: Manikandan Muralidharan Link: https://patch.msgid.link/20250730101015.323964-1-manikandan.m@microchip.com Signed-off-by: Mark Brown commit f1ac30a862cc5d53392d59f42b513e79948acb18 Author: Darshan R Date: Mon Jul 28 12:41:04 2025 +0000 spi: sunplus: sp7021: Clean up coding style This patch tidies up minor coding style deviations within the Sunplus SP7021 SPI driver, ensuring closer adherence to established kernel coding guidelines. Specifically, it addresses: - Correction of a whitespace inconsistency before a comma in `writel()` calls. - Alignment of function parameter indentation for `struct spi_transfer *xfer` in `sp7021_spi_host_transfer_one()` and `sp7021_spi_target_transfer_one()`. While purely cosmetic, these adjustments contribute to improved code readability and maintainability, making future development and review easier. Signed-off-by: Darshan R. Link: https://patch.msgid.link/20250728124104.6370-1-rathod.darshan.0896@gmail.com Signed-off-by: Mark Brown commit 692abf80ce8443a4ded8cade25a1acf772436293 Author: Waqar Hameed Date: Tue Aug 5 11:33:37 2025 +0200 spi: nxp-fspi: Remove error print for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/pndqzxqkt8u.a.out@axis.com Signed-off-by: Mark Brown commit 162e23657e5379f07c6404dbfbf4367cb438ea7d Author: Joy Zou Date: Thu Jul 31 18:44:42 2025 +0800 regulator: pf0900: Add PMIC PF0900 support The PF0900 is a power management integrated circuit (PMIC) optimized for high performance i.MX9x based applications. It features five high efficiency buck converters, three linear and one vaon regulators. It provides low quiescent current in Standby and low power off Modes. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507221720.jxsGRfcE-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202506181134.0Hkvy7CK-lkp@intel.com/ Signed-off-by: Joy Zou Link: https://patch.msgid.link/20250731-b4-pf09-v2-v3-2-4c2659516582@nxp.com Signed-off-by: Mark Brown commit 82f0907931f016c04bcb992f764bd65992c7008e Author: Joy Zou Date: Thu Jul 31 18:44:41 2025 +0800 dt-bindings: regulator: add PF0900 regulator yaml Add device binding doc for PF0900 PMIC driver. Can not get the I2C_CRC_EN config by reading register. If the PMIC OTP_I2C_CRC_EN is enable, need to add the nxp,i2c-crc-enable property. Signed-off-by: Joy Zou Link: https://patch.msgid.link/20250731-b4-pf09-v2-v3-1-4c2659516582@nxp.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Mark Brown commit 9a200cbdb54349909a42b45379e792e4b39dd223 Author: Daniel Almeida Date: Tue Jul 29 14:31:41 2025 -0300 rust: regulator: implement Send and Sync for Regulator Sending a &Regulator to another thread is safe, as the regulator core will properly handle the locking for us. Additionally, there are no restrictions that prevents sending a Regulator to another thread. Given these two facts, implement Send and Sync. Signed-off-by: Daniel Almeida Link: https://patch.msgid.link/20250729-regulator-send-sync-v1-2-8bcbd546b940@collabora.com Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Signed-off-by: Mark Brown commit f7fbf3091f4cc4133574852f655593e1613d1af0 Author: Daniel Almeida Date: Tue Jul 29 14:31:40 2025 -0300 rust: regulator: remove needless &mut from member functions Regulator functions like "regulator_enable()" and "regulator_disable()" already provide their own locking through "regulator_lock_dependent()", so we can safely call the Rust API with a shared reference. This was already the case with Regulator::set_voltage() on the Rust side, but it was forgotten for Regulator::enable() and Regulator::disable(). Signed-off-by: Daniel Almeida Link: https://patch.msgid.link/20250729-regulator-send-sync-v1-1-8bcbd546b940@collabora.com Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Signed-off-by: Mark Brown commit 886f42ce96e7ce80545704e7168a9c6b60cd6c03 Author: Luis Henriques Date: Mon Jul 28 16:08:29 2025 +0100 regmap: mmio: Add missing MODULE_DESCRIPTION() There were already several commits to add module descriptions to regmap modules. But this one was still missing: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-mmio.o Signed-off-by: Luis Henriques Link: https://patch.msgid.link/20250728150829.11890-1-luis@igalia.com Signed-off-by: Mark Brown commit 3059067fd3378a5454e7928c08d20bf3ef186760 Author: Xichao Zhao Date: Tue Aug 5 17:04:31 2025 +0800 ASoC: cs48l32: Use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Link: https://patch.msgid.link/20250805090431.117114-1-zhao.xichao@vivo.com Signed-off-by: Mark Brown commit 2399f3bd31595adfbc9bf38d6699b0a2ff36aee0 Author: Shuming Fan Date: Fri Aug 8 13:57:19 2025 +0800 ASoC: rt721: add some vendor registers This patch added some vendor registers to read for debugging. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250808055719.1110808-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 9d6a51651faa577e5d2be9d67915b7621c5c589a Author: Waqar Hameed Date: Tue Aug 5 11:33:32 2025 +0200 ASoC: SOF: imx: Remove error print for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/pndpldam7tf.a.out@axis.com Signed-off-by: Mark Brown commit 8ed2dca4df2297177e0edcb7e0c72ef87f3fd81a Author: Terry Cheong Date: Wed Jul 23 17:20:11 2025 +0800 ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks The SND_JACK_AVOUT is a more specific jack type for HDMI and DisplayPort. Updatae the MediaTek drivers to use such jack type, allowing system to determine the device type based on jack event. Signed-off-by: Terry Cheong Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250723-mtk-hdmi-v1-1-4ff945eb6136@chromium.org Signed-off-by: Mark Brown commit e83dcd139e776ebb86d5e88e13282580407278e4 Author: Shenghao Ding Date: Sun Aug 3 21:11:10 2025 +0800 ASoC: tas2781: Add keyword "init" in profile section Since version 0x105, the keyword 'init' was introduced into the profile, which is used for chip initialization, particularly to store common settings for other non-initialization profiles. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250803131110.1443-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit 32dffd4c3e3129e3d9bb378af8d80bb57dc3038b Author: Chancel Liu Date: Fri Aug 8 15:17:41 2025 +0900 ASoC: dmaengine_pcm: Add port_window_size to DAI dma data struct The port_window_size is a struct member of dma slave channel runtime config. It's the length of the register area in words the data need to be accessed on the device side. It is only used for devices which is using an area instead of a single register to send or receive the data. Typically the DMA loops in this area in order to transfer the data. It's useful for cases that reading/writing multiple registers in DMA transactions. Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20250808061741.187414-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 605d902bb6b6f5b12a5baeaca0dc359ced7685cb Author: Rob Herring (Arm) Date: Thu Aug 7 16:43:57 2025 -0500 ASoC: dt-bindings: Drop imx-audio-sgtl5000.txt The "fsl,imx-audio-sgtl5000" binding is already covered by fsl-asoc-card.yaml, so remove the old text binding. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250807214358.4172451-1-robh@kernel.org Acked-by: Conor Dooley Signed-off-by: Mark Brown commit 2d86d2585ab929a143d1e6f8963da1499e33bf13 Author: Arnd Bergmann Date: Fri Aug 8 17:18:05 2025 +0200 ASoC: pxa: add GPIOLIB_LEGACY dependency The pxa27x platform uses the legacy gpiolib interfaces, including in its sound drivers: sound/arm/pxa2xx-ac97-lib.c: In function 'pxa2xx_ac97_hw_probe': sound/arm/pxa2xx-ac97-lib.c:374:23: error: implicit declaration of function 'gpio_request_one' [-Wimplicit-function-declaration] 374 | ret = gpio_request_one(reset_gpio, GPIOF_OUT_INIT_HIGH, Make sure we don't select those drivers for compile-testing unless we are building for a pxa27x system, or CONFIG_GPIOLIB_LEGACY is already enabled. The SND_PXA_SOC_SSP driver accidentally used a dependency on PLAT_PXA, which includes both ARCH_PXA and ARCH_MMP, but it is only used on the former. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250808151822.536879-21-arnd@kernel.org Signed-off-by: Mark Brown commit 5383d67e2430822fa7bd20dcbbebbd8ae808e386 Author: Arnd Bergmann Date: Fri Aug 8 17:17:52 2025 +0200 ASoC: add GPIOLIB_LEGACY dependency where needed In order to make the legacy gpiolib interfaces such as gpio_request() optional, mark the three ASoC driver that rely on it today with a dependency on the new Kconfig symbol. The tlv320dac33 and ak4641 drivers have no in-tree users, while the uda1380 driver is theoretically referened by two lpc3250 based boards, but neither of them work because of the legacy gpiolib dependency. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250808151822.536879-9-arnd@kernel.org Signed-off-by: Mark Brown commit cf25eb8eae91bcae9b2065d84b0c0ba0f6d9dd34 Author: Kuninori Morimoto Date: Wed Aug 6 04:42:05 2025 +0000 ASoC: soc-component: unpack snd_soc_component_init_bias_level() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. This patch unpack component wrapper to cleanup it. This patch keeps compatible by using define, but old name will be replaced on each drivers and removed from ASoC in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87y0rx6oyx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7509e7e4288976e3028a6e8482d979ca77f584a7 Author: Kuninori Morimoto Date: Wed Aug 6 04:41:55 2025 +0000 ASoC: soc-component: unpack snd_soc_component_get_bias_level() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. This patch unpack component wrapper to cleanup it. The function will be kept by using macro for a while, but will be replaced/cleanuped in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87zfcd6oz0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7b900b5878a910d60ecfa67448bbe81e4e2bb8b7 Author: Kuninori Morimoto Date: Wed Aug 6 04:41:51 2025 +0000 ASoC: soc-component: unpack snd_soc_component_force_bias_level() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. This patch unpack component wrapper to cleanup it. The function will be kept by using macro for a while, but will be replaced/cleanuped in the future. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/871ppp83jk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e93703687cd75a0c7d330e15a3d9ff20b12f3d1d Author: Kuninori Morimoto Date: Wed Aug 6 04:41:46 2025 +0000 ASoC: soc-dapm: move snd_soc_dapm_init_bias_level() to soc-dpcm Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Because dapm will not be used on user driver in the future, Let's move snd_soc_dapm_init_bias_level() to soc-dpcm.c Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/8734a583jp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 40229ea9fa437d6a1feb86be9dd419e843ec754c Author: Kuninori Morimoto Date: Wed Aug 6 04:41:41 2025 +0000 ASoC: soc-dapm: move snd_soc_dapm_get_bias_level() to soc-dpcm Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Because dapm will not be used on user driver in the future, Let's move snd_soc_dapm_get_bias_level() to soc-dpcm.c Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874iul83ju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 595b7f155b926460a00776cc581e4dcd01220006 Author: Cezary Rojewski Date: Tue Jul 29 15:06:33 2025 +0200 ASoC: Intel: avs: Conditional-path support Compared to standard paths, conditional paths are not invoked by the means of FE being opened by userspace and thus their variant selection is not FE/BE audio format based. These are a side effect of standard path creation if specific criteria are met. Algorithm is implemented to walk on all existing runtime paths and match them against conditions provided by topology. These conditions are based on source and sink path formats, rather than formats provided from userspace app or present on the codec. If match is found, new path is created and tied to those which brought it into existence: source and sink path. If any of its parents perishes, so does the conditional path. Conditional paths are used to enable any complex, modern audio scenario which involves usage of KPB, AEC and WoV modules and more. Signed-off-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250729130633.310388-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 8bcfcb3bd3e38b8f3bb7e5eb3acb4120500994a0 Author: Cezary Rojewski Date: Tue Jul 29 15:06:32 2025 +0200 ASoC: Intel: avs: Parse conditional path tuples Conditional paths need information about their source and sink paths to be created which is then stored to keep track of who their parents are. That information allows to change their state accordingly to what is currently happening to their parent paths. Signed-off-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250729130633.310388-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 5da3a0b0106e855b2c81cdac77b24d1170417370 Merge: 8f5ae30d69d754 13d0fe84a21465 Author: Mark Brown Date: Sun Aug 10 21:02:46 2025 +0100 Merge existing fixes from spi/for-6.17 into new branch commit ec437f9ba3335ffa14b3d0774d267059636d4778 Author: Sven Peter Date: Thu Jun 12 21:11:26 2025 +0000 soc: apple: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-2-0e6f9cb512c1@kernel.org Signed-off-by: Sven Peter commit 4379305ffbc2eebe3de673fc965145d441c89b8f Author: Hector Martin Date: Tue Jun 10 15:29:51 2025 +0000 arm64: dts: apple: t600x: Add SMC node Signed-off-by: Hector Martin Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-10-556cafd771d3@kernel.org Signed-off-by: Sven Peter commit 49765a617a54837910b26978bb0dc01908a673e2 Author: Hector Martin Date: Tue Jun 10 15:29:50 2025 +0000 arm64: dts: apple: t8112: Add SMC node Signed-off-by: Hector Martin Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-9-556cafd771d3@kernel.org Signed-off-by: Sven Peter commit 6101fe95b1ee551b7f5d03a9edd80edc7d446be9 Author: Hector Martin Date: Tue Jun 10 15:29:49 2025 +0000 arm64: dts: apple: t8103: Add SMC node Signed-off-by: Hector Martin Reviewed-by: Linus Walleij Reviewed-by: Sven Peter Signed-off-by: Russell King (Oracle) Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-8-556cafd771d3@kernel.org Signed-off-by: Sven Peter commit e1313c2185d22c2f8db508db61d3e2c0e62193d7 Author: Nick Chan Date: Tue Jun 10 21:45:28 2025 +0800 arm64: dts: apple: t8015: Add I2C nodes Add I2C nodes for Apple A11 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-9-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 1d16ae50cb1bdcfe15319d946e3418dcbdcd8509 Author: Nick Chan Date: Tue Jun 10 21:45:27 2025 +0800 arm64: dts: apple: t8011: Add I2C nodes Add I2C nodes for Apple A10X SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-8-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 9f286293541e20c904ce59ad7ea26f8b6cab126a Author: Nick Chan Date: Tue Jun 10 21:45:26 2025 +0800 arm64: dts: apple: t8010: Add I2C nodes Add I2C nodes for Apple A10 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-7-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit baf703b08374b10cd4d3dbbf7410569fee2e8cb1 Author: Nick Chan Date: Tue Jun 10 21:45:25 2025 +0800 arm64: dts: apple: s8001: Add I2C nodes Add I2C nodes for Apple A9 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-6-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 5bee6cb9d9df55125eddd63345054ff08a0d44e9 Author: Nick Chan Date: Tue Jun 10 21:45:24 2025 +0800 arm64: dts: apple: s800-0-3: Add I2C nodes Add I2C nodes for Apple A9 SoC. There is actually an i2c3 on this SoC but the SCL and SDA lines appears to be not connected and no peripherals are expected to be connected to it, so there is no node for it. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-5-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit a56771d333edb1d1d5631e296fb2b021a39b3940 Author: Nick Chan Date: Tue Jun 10 21:45:23 2025 +0800 arm64: dts: apple: t7001: Add I2C nodes Add I2C nodes for Apple A8X SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-4-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 5b1ab37ccc605f20e5309f7ba45eea2aec6054d1 Author: Nick Chan Date: Tue Jun 10 21:45:22 2025 +0800 arm64: dts: apple: t7000: Add I2C nodes Add I2C nodes for Apple A8 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-3-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 68e01988b2088ff5b8152cc7a8576e2b7930621a Author: Nick Chan Date: Tue Jun 10 21:45:21 2025 +0800 arm64: dts: apple: s5l8960x: Add I2C nodes Add I2C nodes for Apple A7 SoC. Signed-off-by: Nick Chan Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-2-a5a71080fba9@gmail.com Signed-off-by: Sven Peter commit 317be9c64215f264740c6dffb0a44216960875b2 Author: Krzysztof Karas Date: Tue Aug 5 11:41:42 2025 +0000 drm/i915/gt: Protect against overflow in active_engine() It is unlikely, but possible for the first call to intel_context_create() to fail with -ENOMEM, which would result in entering the following code block and decrementing "count", when it is set to 0 (initial condition in the for loop). Protect from overflowing the variable by checking for 0 value of "count" before entering the loop. Signed-off-by: Krzysztof Karas Reviewed-by: Sebastian Brzezinka Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/pogr74jktdqehrfap4tjky23ees4x7erh5dwgg5jb2n522cfkw@kpnxe4qzx4pj commit 1bf30a45653d14b0d88b5ca3c72e0ecf030d9c88 Author: Philipp Stanner Date: Fri Aug 1 09:45:32 2025 +0200 drm/nouveau: Remove surplus struct member struct nouveau_channel contains the member 'accel_done' and a forgotten TODO which hints at that mechanism being removed in the "near future". Since that variable is read nowhere anymore, this "near future" is now. Remove the variable and the TODO. Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250801074531.79237-2-phasta@kernel.org Signed-off-by: Danilo Krummrich commit 6510b62fe9303aaf48ff136ff69186bcfc32172d Author: Seyediman Seyedarab Date: Thu Jul 24 15:59:13 2025 -0400 drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() snprintf() returns the number of characters that *would* have been written, which can overestimate how much you actually wrote to the buffer in case of truncation. That leads to 'data += this' advancing the pointer past the end of the buffer and size going negative. Switching to scnprintf() prevents potential buffer overflows and ensures consistent behavior when building the output string. Signed-off-by: Seyediman Seyedarab Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com Signed-off-by: Danilo Krummrich commit f768ebbba9110846c9f986a96109d70154d60b5d Author: Krzysztof Karas Date: Wed Jul 30 07:40:18 2025 +0000 drm/i915/selftests: Do not leak vm_area_struct on early return This structure may be leaked on early failure paths, so include vm_munmap() call in them to avoid that. Suggested-by: Chris Wilson Signed-off-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/d8277e3af09c388fa5dfbf5c9bb3985ae0b191a2.1753859971.git.krzysztof.karas@intel.com commit c4d0f59ded1efbf0004dfdfffb9050caba234993 Author: Krzysztof Karas Date: Wed Jul 30 07:39:23 2025 +0000 drm/i915/selftests: Do not overwrite error code after intel_context_migrate_clear() call Currently this function's error code is stored in err variable, which, if a i915_request is present, will be immediately overwritten by return from dma_resv_reserve_fences(). Call DMA functions only if intel_context_migrate_clear() succeeded. Suggested-by: Matthew Auld Signed-off-by: Krzysztof Karas Reviewed-by: Sebastian Brzezinka Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/c0348e052bcb2870acdc15d60f5389fbdf4ef886.1753859971.git.krzysztof.karas@intel.com commit 9f8aa0bcd1f35baefe083adfa26bc6f9f68f652b Author: Satyanarayana K V P Date: Fri Aug 8 13:06:28 2025 +0530 drm/xe/vf: Refactor CCS save/restore to use default migration context Previously, CCS save/restore operations created separate migration contexts with new VM memory allocations, resulting in significant overhead. This commit eliminates redundant context creation reusing the default migration context by registering new execution queues for CCS save and restore on the existing migrate VM. Signed-off-by: Satyanarayana K V P Suggested-by: Matthew Brost Cc: Michal Wajdeczko Cc: John Harrison Reviewed-by: Matthew Brost Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250808073628.32745-2-satyanarayana.k.v.p@intel.com commit 342d1f84320994ab72a6ca96e18f2985868e1cbd Author: Matt Atwood Date: Thu Aug 7 14:42:24 2025 -0700 drm/xe: Update function names for GT specific workarounds Now that there distinctly different OOB functions, update the names to reflect the IPs they interact with. Signed-off-by: Matt Atwood Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250807214224.32728-2-matthew.s.atwood@intel.com Signed-off-by: Rodrigo Vivi commit 4d5c98eb77fe518944465d96e69de8aa6e9a5c99 Author: Matt Atwood Date: Thu Aug 7 14:42:23 2025 -0700 drm/xe: rename XE_WA to XE_GT_WA Now that there are two types of wa tables and infrastructure, be more concise in the naming of GT wa macros. v2: update the documentation Signed-off-by: Matt Atwood Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250807214224.32728-1-matthew.s.atwood@intel.com Signed-off-by: Rodrigo Vivi commit 80944d334182ce5eb27d00e2bf20a88bfc32dea1 Author: Thomas Hellström Date: Tue Aug 5 09:48:42 2025 +0200 drm/xe: Defer buffer object shrinker write-backs and GPU waits When the xe buffer-object shrinker allows GPU waits and write-back, (typically from kswapd), perform multiple passes, skipping subsequent passes if the shrinker number of scanned objects target is reached. 1) Without GPU waits and write-back 2) Without write-back 3) With both GPU-waits and write-back This is to avoid stalls and costly write- and readbacks unless they are really necessary. v2: - Don't test for scan completion twice. (Stuart Summers) - Update tags. Reported-by: melvyn Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5557 Cc: Summers Stuart Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: # v6.15+ Signed-off-by: Thomas Hellström Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250805074842.11359-1-thomas.hellstrom@linux.intel.com commit fa479132845e94b60068fad01c2a9979b3efe2dc Author: Li Jun Date: Wed Jul 30 18:50:19 2025 +0800 bpf: Standardize function declaration style 'noinlne' after 'int' cause "ERROR: inline keyword should sit between storage class and type" by checkpatch.pl - Standardize function declaration style by moving 'noinline' modifier - Fix asm volatile statement formatting Signed-off-by: Li Jun Link: https://lore.kernel.org/r/20250730105019.436235-1-lijun01@kylinos.cn Signed-off-by: Alexei Starovoitov commit 15a3b798a0264aa160072754a3847f7585694ff9 Merge: 911c0359d8f6da 77620d1267392b Author: Alexei Starovoitov Date: Thu Aug 7 09:17:03 2025 -0700 Merge branch 'bpf-use-vrealloc-in-bpf_patch_insn_data' Eduard Zingerman says: ==================== bpf: use vrealloc() in bpf_patch_insn_data() Function bpf_patch_insn_data() uses vzalloc/vfree pair to allocate memory for updated insn_aux_data. These operations are expensive for big programs where a lot of rewrites happen, e.g. for pyperf180 test case. The pair can be replaced with a call to vrealloc in order to reduce the number of actual memory allocations. Perf stat w/o this patch: $ perf stat -B --all-kernel -r10 -- ./veristat -q pyperf180.bpf.o ... 2201.25 msec task-clock # 0.973 CPUs utilized ( +- 2.20% ) 188 context-switches # 85.406 /sec ( +- 9.29% ) 15 cpu-migrations # 6.814 /sec ( +- 5.64% ) 5 page-faults # 2.271 /sec ( +- 3.27% ) 4315057974 instructions # 1.28 insn per cycle # 0.33 stalled cycles per insn ( +- 0.03% ) 3366141387 cycles # 1.529 GHz ( +- 0.21% ) 1420810964 stalled-cycles-frontend # 42.21% frontend cycles idle ( +- 0.23% ) 1049956791 branches # 476.981 M/sec ( +- 0.03% ) 60591781 branch-misses # 5.77% of all branches ( +- 0.07% ) 2.2632 +- 0.0527 seconds time elapsed ( +- 2.33% ) Perf stat with this patch: 1227.15 msec task-clock # 0.963 CPUs utilized ( +- 2.27% ) 170 context-switches # 138.532 /sec ( +- 5.62% ) 2 cpu-migrations # 1.630 /sec ( +- 33.37% ) 5 page-faults # 4.074 /sec ( +- 4.47% ) 3312254304 instructions # 2.17 insn per cycle # 0.15 stalled cycles per insn ( +- 0.03% ) 1528944717 cycles # 1.246 GHz ( +- 0.31% ) 501475146 stalled-cycles-frontend # 32.80% frontend cycles idle ( +- 0.50% ) 730426891 branches # 595.222 M/sec ( +- 0.03% ) 17372363 branch-misses # 2.38% of all branches ( +- 0.16% ) 1.2744 +- 0.0301 seconds time elapsed ( +- 2.36% ) Changelog: v1: https://lore.kernel.org/bpf/20250806200928.3080531-1-eddyz87@gmail.com/T/#t v1 -> v2: - added missing memset(0) in adjust_insn_aux_data(), this fixes CI failure reported in [1]. [1] https://github.com/kernel-patches/bpf/actions/runs/16787563163/job/47542309875 ==================== Link: https://patch.msgid.link/20250807010205.3210608-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 77620d1267392b1a34bfc437d2adea3006f95865 Author: Eduard Zingerman Date: Wed Aug 6 18:02:05 2025 -0700 bpf: use realloc in bpf_patch_insn_data Avoid excessive vzalloc/vfree calls when patching instructions in do_misc_fixups(). bpf_patch_insn_data() uses vzalloc to allocate new memory for env->insn_aux_data for each patch as follows: struct bpf_prog *bpf_patch_insn_data(env, ...) { ... new_data = vzalloc(... O(program size) ...); ... adjust_insn_aux_data(env, new_data, ...); ... } void adjust_insn_aux_data(env, new_data, ...) { ... memcpy(new_data, env->insn_aux_data); vfree(env->insn_aux_data); env->insn_aux_data = new_data; ... } The vzalloc/vfree pair is hot in perf report collected for e.g. pyperf180 test case. It can be replaced with a call to vrealloc in order to reduce the number of actual memory allocations. This is a stop-gap solution, as bpf_patch_insn_data is still hot in the profile. More comprehansive solutions had been discussed before e.g. as in [1]. [1] https://lore.kernel.org/bpf/CAEf4BzY_E8MSL4mD0UPuuiDcbJhh9e2xQo2=5w+ppRWWiYSGvQ@mail.gmail.com/ Suggested-by: Alexei Starovoitov Signed-off-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Tested-by: Anton Protopopov Link: https://lore.kernel.org/r/20250807010205.3210608-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit cb070a8156c16383cad5e4d9f678b7273f0208cd Author: Eduard Zingerman Date: Wed Aug 6 18:02:04 2025 -0700 bpf: removed unused 'env' parameter from is_reg64 and insn_has_def32 Parameter 'env' is not used by is_reg64() and insn_has_def32() functions. Remove the parameter to make it clear that neither function depends on 'env' state, e.g. env->insn_aux_data. Signed-off-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250807010205.3210608-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e Author: Matthew Auld Date: Thu Jul 31 10:38:11 2025 +0100 drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if there is one) has already been put() prior to this, so doing a fence_wait could lead to UAF. Tweak the flow to do to the put() until after we do the wait. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc Author: Matthew Auld Date: Thu Jul 31 10:38:10 2025 +0100 drm/xe/migrate: don't overflow max copy size With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the dimensions of the copy can easily exceed the S16_MAX limit of the copy command leading to the following assert: xe 0000:03:00.0: [drm] Assertion `size / pitch <= ((s16)(((u16)~0U) >> 1))` failed! platform: BATTLEMAGE subplatform: 1 graphics: Xe2_HPG 20.01 step A0 media: Xe2_HPM 13.01 step A1 tile: 0 VRAM 10.0 GiB GT: 0 type 1 WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe] To fix this account for the pitch when calculating the number of current bytes to copy. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-7-matthew.auld@intel.com commit 38b34e928a08ba594c4bbf7118aa3aadacd62fff Author: Matthew Auld Date: Thu Jul 31 10:38:09 2025 +0100 drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XE_CAHELINE_BYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the stack, and the only alignment requirement here is that it's naturally aligned to u8, and not XE_CACHELINE_BYTES. If the bounce buffer is also misaligned we then recurse back into the function again, however the new bounce buffer might also not be aligned, and might never be until we eventually blow through the stack, as we keep recursing. Instead of using the stack use kmalloc, which should respect the power-of-two alignment request here. Fixes a kernel panic when triggering this path through eudebug. v2 (Stuart): - Add build bug check for power-of-two restriction - s/EINVAL/ENOMEM/ Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Stuart Summers Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-6-matthew.auld@intel.com commit 46fb38cb20c0d185a6391ab524b23e0e0219c41f Author: Jouni Högander Date: Fri Aug 1 09:29:05 2025 +0300 drm/i915/psr: Do not trigger Frame Change events from frontbuffer flush We want to get rid of triggering "Frame Change" events from frontbuffer flush calls. We are about to move using TRANS_PUSH register for this on LunarLake and onwards. Touching TRANS_PUSH register from fronbuffer flush would be problematic as it's written by DSB as well. Fix this by using intel_psr_exit when flush or invalidate is done on LunarLake and onwards. This is not possible on AlderLake and MeteorLake due to HW bug in PSR2 disable. This patch is also fixing problems with cursor plane where cursor is disappearing or duplicate cursor is seen on the screen. v2: Commit message updated Bspec: 68927, 68934, 66624 Reported-by: Janna Martl Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5522 Fixes: 411ad63877bb ("drm/i915/psr: Use SFF_CTL on invalidate/flush for LunarLake onwards") Tested-by: Janna Martl Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250801062905.564453-1-jouni.hogander@intel.com commit 5fe8d1dba706ee5234acef29c4410ade89170193 Author: Jouni Högander Date: Thu Aug 7 07:26:35 2025 +0300 drm/i915/dsi: Fix overflow issue in pclk parsing Parsed divider p will overflow and is considered being valid in case pll_ctl == 0. Fix this by checking divider p before decreasing it. Also small improvement is made by using fls() instead of custom loop. v2: use fls() and check parsed divider Signed-off-by: Jouni Högander Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250807042635.2491537-1-jouni.hogander@intel.com commit f9b5bf76ea719a115502f9c1b20ab534ccd8194b Author: Jani Nikula Date: Tue Jul 29 12:57:39 2025 +0300 drm/i915: use drm->debugfs_root for creating debugfs files Since commit 0b30d57acafc ("drm/debugfs: rework debugfs directory creation v5") we should be using drm->debugfs_root instead of minor->debugfs_root for creating debugfs files. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/ba8a2a7ec10e54b4d0a96926ef20c96e268c0b94.1753782998.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c5b9077eca39c3615f5e73bbb8493eaef9ceef3a Author: Jani Nikula Date: Tue Jul 29 12:57:38 2025 +0300 drm/i915/gvt: use drm->debugfs_root for creating debugfs files Since commit 0b30d57acafc ("drm/debugfs: rework debugfs directory creation v5") we should be using drm->debugfs_root instead of minor->debugfs_root for creating debugfs files. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/482a3516e00b2885cd62f872ad09f51a9d8176b4.1753782998.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 39896c529454763fb7d40ecb2657ad9f65c462ee Author: Jani Nikula Date: Tue Jul 29 12:57:37 2025 +0300 drm/i915/display: use drm->debugfs_root for creating debugfs files Since commit 0b30d57acafc ("drm/debugfs: rework debugfs directory creation v5") we should be using drm->debugfs_root instead of minor->debugfs_root for creating debugfs files. As a rule of thumb, use a local variable when there are two or more uses, otherwise just have the single reference inline. Drop drm/drm_file.h include where possible. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/e8268546ec2a2941a3dc43c2fdc60f678dc03fce.1753782998.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 911c0359d8f6da3ffdeee52886f820fbf1c7fa5c Merge: f3af62b6cee8af ba7000f1c360f3 Author: Martin KaFai Lau Date: Wed Aug 6 13:39:59 2025 -0700 Merge branch 'allow-struct_ops-to-create-map-id-to' Amery Hung says: ==================== This patchset allows struct_ops implementors to get map id from kdata in reg(), unreg() and update() so that they create an id to struct_ops instance mapping. This in turn allows struct_ops kfuncs to refer to the calling instance without passing a pointer to the struct_ops. The selftest provides an end-to-end example. Some struct_ops users extend themselves with other bpf programs, which also need to call struct_ops kfuncs. For example, scx_layered uses syscall bpf programs as a scx_layered specific control plane and uses tracing programs to get additional information for scheduling [0]. The kfuncs may need to refer to the struct_ops instance and perform jobs accordingly. To allow calling struct_ops kfuncs referring to specific instances from different program types and context (e.g., struct_ops, tracing, async callbacks), the traditional way is to pass the struct_ops pointer to kfuncs. This patchset provides an alternative way, through a combination of bpf map id and global variable. First, a struct_ops implementor will use the map id of the struct_ops map as the id of an instance. Then, it needs to maintain an id to instance mapping: inserting a new mapping during reg() and removing it during unreg(). The map id can be acquired by calling bpf_struct_ops_id(). v1 -> v2 Add bpf_struct_ops_id() instead of using bpf_struct_ops_get() [0] https://github.com/sched-ext/scx/blob/main/scheds/rust/scx_layered/src/bpf/main.bpf.c ==================== Link: https://patch.msgid.link/20250806162540.681679-1-ameryhung@gmail.com Signed-off-by: Martin KaFai Lau commit ba7000f1c360f34286f48bd5e670cefbab77ce8f Author: Amery Hung Date: Wed Aug 6 09:25:40 2025 -0700 selftests/bpf: Test multi_st_ops and calling kfuncs from different programs Test multi_st_ops and demonstrate how different bpf programs can call a kfuncs that refers to the struct_ops instance in the same source file by id. The id is defined as a global vairable and initialized before attaching the skeleton. Kfuncs that take the id can hide the argument with a macro to make it almost transparent to bpf program developers. The test involves two struct_ops returning different values from .test_1. In syscall and tracing programs, check if the correct value is returned by a kfunc that calls .test_1. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250806162540.681679-4-ameryhung@gmail.com commit eeb52b6279cfebae07703f772621fb9d5972e541 Author: Amery Hung Date: Wed Aug 6 09:25:39 2025 -0700 selftests/bpf: Add multi_st_ops that supports multiple instances Current struct_ops in bpf_testmod only support attaching single instance. Add multi_st_ops that supports multiple instances. The struct_ops uses map id as the struct_ops id and will reject attachment with an existing id. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250806162540.681679-3-ameryhung@gmail.com commit d87a513d093726d121dd5c816e26803111a259d0 Author: Amery Hung Date: Wed Aug 6 09:25:38 2025 -0700 bpf: Allow struct_ops to get map id by kdata Add bpf_struct_ops_id() to enable struct_ops implementors to use struct_ops map id as the unique id of a struct_ops in their subsystem. A subsystem that wishes to create a mapping between id and struct_ops instance pointer can update the mapping accordingly during bpf_struct_ops::reg(), unreg(), and update(). Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250806162540.681679-2-ameryhung@gmail.com commit ad69d62588cd6bf8cddaff5e3e2eb1b8dd876d35 Author: Piotr Piórkowski Date: Tue Aug 5 11:18:50 2025 +0200 drm/xe/pf: Program LMTT directory pointer on all GTs within a tile Previously, the LMTT directory pointer was only programmed for primary GT within a tile. However, to ensure correct Local Memory access by VFs, the LMTT configuration must be programmed on all GTs within the tile. Lets program the LMTT directory pointer on every GT of the tile to guarantee proper LMEM access across all GTs on VFs. HSD: 18042797646 Bspec: 67468 Signed-off-by: Piotr Piórkowski Cc: Michal Wajdeczko Cc: Michał Winiarski Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250805091850.1508240-1-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 111821e4b5a3105c42c7c99f4abd4d8af9f64248 Author: Sathishkumar S Date: Tue Aug 5 21:35:10 2025 +0530 drm/amdgpu/vcn: Hold pg_lock before vcn power off Acquire vcn_pg_lock before changes to vcn power state and release it after power off in idle work handler. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c Author: Sathishkumar S Date: Tue Aug 5 21:28:25 2025 +0530 drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff Acquire jpeg_pg_lock before changes to jpeg power state and release it after power off from idle work handler. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 0b4d79dafae6a5b626037b4a5dafaf9f09cc1945 Author: Lijo Lazar Date: Mon Aug 4 13:53:21 2025 +0530 drm/amdgpu: Assign unique id to compute partition Assign unique id to compute partition. This is the unique id of the first XCD instance belonging to the partition. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 6fa821685464e786f43a66d18756cc909a9cb961 Author: Lijo Lazar Date: Mon Aug 4 13:36:52 2025 +0530 drm/amd/pm: Add unique ids for SMUv13.0.12 SOCs Fetch and store the unique ids for AIDs/XCDs in SMUv13.0.12 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit aae94897b6661a2a4b1de2d328090fc388b3e0af Author: Alex Deucher Date: Mon Aug 4 11:40:20 2025 -0400 drm/amdgpu: add missing vram lost check for LEGACY RESET Legacy resets reset the memory controllers so VRAM contents may be unreliable after reset. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 62eedd150fa11aefc2d377fc746633fdb1baeb55 Author: Alex Deucher Date: Wed Jul 30 11:16:05 2025 -0400 drm/amdgpu/discovery: fix fw based ip discovery We only need the fw based discovery table for sysfs. No need to parse it. Additionally parsing some of the board specific tables may result in incorrect data on some boards. just load the binary and don't parse it on those boards. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441 Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit 9d693917949122e2018d7d1377327557f708101b Author: Srinivasan Shanmugam Date: Wed Aug 6 18:15:22 2025 +0530 drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' Add a NULL check for acrtc->dm_irq_params.stream before accessing its members. Fixes below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:623 dm_vupdate_high_irq() warn: variable dereferenced before check 'acrtc->dm_irq_params.stream' (see line 615) 614 if (vrr_active) { 615 bool replay_en = acrtc->dm_irq_params.stream->link->replay_settings.replay_feature_enabled; ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 616 bool psr_en = acrtc->dm_irq_params.stream->link->psr_settings.psr_feature_enabled; ^^^^^^^^^^^^^^^^^^^^^^^^^^^ New dereferences 617 bool fs_active_var_en = acrtc->dm_irq_params.freesync_config.state 618 == VRR_STATE_ACTIVE_VARIABLE; 619 620 amdgpu_dm_crtc_handle_vblank(acrtc); 621 622 /* BTR processing for pre-DCE12 ASICs */ 623 if (acrtc->dm_irq_params.stream && ^^^^^^^^^^^^^^^^^^^^^^^^^^^ But the existing code assumed it could be NULL. Someone is wrong. 624 adev->family < AMDGPU_FAMILY_AI) { 625 spin_lock_irqsave(&adev_to_drm(adev)->event_lock, flags); Fixes: 6d31602a9f57 ("drm/amd/display: more liberal vmin/vmax update for freesync") Reported-by: Dan Carpenter Cc: Alex Hung Cc: Aurabindo Pillai Cc: Roman Li Cc: ChiaHsuan Chung Cc: Harry Wentland Cc: Ray Wu Cc: Daniel Wheeler Cc: Nicholas Kazlauskas Signed-off-by: Srinivasan Shanmugam Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 5bf93e1d6efd801a5337142669c951ded83ad008 Author: Lijo Lazar Date: Wed Aug 6 14:29:41 2025 +0530 drm/amd/pm: Add caching to SMUv13.0.12 temp metric Add table caching logic to temperature metrics tables in SMUv13.0.12 Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 476060020f86e2cb713ef0ed956d950b64544858 Author: Lijo Lazar Date: Wed Aug 6 12:52:47 2025 +0530 drm/amd/pm: Add cache logic for temperature metric Add caching logic for baseboard and gpuboard temperature metrics tables. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 615471b860d628f7e7d9ffdf4b92477493e0a31c Author: Lijo Lazar Date: Wed Aug 6 11:49:59 2025 +0530 drm/amd/pm: Remove cache logic from SMUv13.0.12 Remove caching logic of temperature metrics from SMUv13.0.12. The caching logic needs to be moved to a higher level. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 10c12aae4ed6d2561bb5fcf0bf06656c7f07da5c Author: Lijo Lazar Date: Mon Aug 4 13:29:05 2025 +0530 drm/amd/pm: Add unique ids for SMUv13.0.6 SOCs Fetch and store the unique ids for AIDs/XCDs in SMUv13.0.6 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 589ea8a1fd6cc4d194f5472f358dbdcee954a2dc Author: Lijo Lazar Date: Mon Aug 4 13:13:06 2025 +0530 drm/amdgpu: Add helpers to set/get unique ids Add a struct to store unique id information for each type. Add helper to fetch the unique id. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 892bac995bab7379aeca607a5dd592ecc7d98021 Author: Lijo Lazar Date: Thu Jul 24 13:05:12 2025 +0530 drm/amdgpu: Prevent hardware access in dpc state Don't allow hardware access while in dpc state. Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher commit 1a0e57eb96c3fca338665ffd7d9b59f351e5fea7 Author: Lijo Lazar Date: Tue Aug 5 17:40:09 2025 +0530 drm/amdgpu/vcn: Fix double-free of vcn dump buffer The buffer is already freed as part of amdgpu_vcn_reg_dump_fini(). The issue is introduced by below patch series. Fixes: de55cbff5ce9 ("drm/amdgpu/vcn: Add regdump helper functions") Signed-off-by: Lijo Lazar Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher commit c5c62160a540db7d7e746e498fea91c35507d775 Author: Lijo Lazar Date: Wed Jul 23 10:43:00 2025 +0530 drm/amdgpu: Log reset source during recovery To get more context, add reset source to identify the source of gpu recovery - job timeout, RAS, HWS hang etc. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit b3505c2c486b36ea70889375dd0a64920f505f1f Author: Xiang Liu Date: Mon Aug 4 22:46:30 2025 +0800 drm/amdgpu: Generate BP threshold exceed CPER once threshold exceeded The bad pages threshold exceed CPER should be generated once threshold exceeded, no matter the bad_page_threshold setted or not. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d9f6a0704364589d3856da454a0f78be64cc9b8c Author: Asad Kamal Date: Sat Aug 2 04:32:29 2025 +0800 drm/amd/pm: Enable temperature metrics caps Enable temperature metrics caps for smu_v13_0_12 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 25e82f2e2c598164a02873f330f04fd62423da8b Author: Asad Kamal Date: Sat Aug 2 04:29:06 2025 +0800 drm/amd/pm: Add temperature metrics sysfs entry Add temperature metrics sysfs entry to expose gpuboard/baseboard temperature metrics v2: Removed unused function, rename functions(Lijo) v3: Remove unnecessary initialization Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 33074558ec8481a54b16e76dd79c9beff4f673bd Author: Asad Kamal Date: Sat Aug 2 04:26:13 2025 +0800 drm/amd/pm: Fetch and fill temperature metrics Fetch system metrics table to fill gpuboard/baseboard temperature metrics data for smu_v13_0_12 v2: Remove unnecessary checks, used separate metrics time for temperature metrics table(Lijo) v3: Use cached values for back to back system metrics query(Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 793ff2bafeb10e2b584d77ef0689d50ac13fd4c6 Author: Asad Kamal Date: Sat Aug 2 02:41:50 2025 +0800 drm/amd/pm: Update pmfw header for smu_v13_0_12 Update pmfw header for smu_v13_0_12 with system temperature metrics table Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 775c7e8e4d57022dd9e6f16eefc31abfda090aba Author: Asad Kamal Date: Sat Aug 2 02:10:12 2025 +0800 drm/amd/pm: Add smu interface for temp metrics Add smu interface to get baseboard/gpuboard temperature metrics v2: Rename is_support to is_supported(Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 83953ec1fedf37b900bded05ced31e6b7858cca3 Author: Asad Kamal Date: Sat Aug 2 01:48:09 2025 +0800 drm/amd/pm: Add dpm interface for temp metrics Add dpm interface to get gpuboard/baseboard temperature metrics v2: Add temperature metrics support check(Lijo) v3: Return error code in case of operation not supported(Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e9c840d4505d5049da1873acf93744d384b12a0b Author: Aurabindo Pillai Date: Tue Aug 5 10:02:07 2025 -0400 drm/amd/display: Fix vupdate_offload_work doc Fix the following warning in struct documentation: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h:168: warning: expecting prototype for struct dm_vupdate_work. Prototype was for struct vupdate_offload_work instead Fixes: c210b757b400 ("drm/amd/display: fix dmub access race condition") Reported-by: Stephen Rothwell Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit bd6093e2f1601c0c83906f5115a2efb6b93050b1 Author: James Zhu Date: Wed May 28 12:38:58 2025 -0400 drm/amdkfd: return migration pages from copy function dst MIGRATE_PFN_VALID bit and src MIGRATE_PFN_MIGRATE bit should always be set when migration success. cpage includes src MIGRATE_PFN_MIGRATE bit set and MIGRATE_PFN_VALID bit unset pages for both ram and vram when memory is only allocated without being populated before migration, those ram pages should be counted as migrate pages and those vram pages should not be counted as migrate pages. Here migration pages refer to how many vram pages involved. -v2 use dst to check MIGRATE_PFN_VALID bit (suggested-by Philip) -v3 add warning when vram pages is less than migration pages return migration pages directly from copy function -v4 correct comments and copy function return mpage (suggested-by Felix) Signed-off-by: James Zhu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 5c15a05b52553ad99c68a661b832aff3eeb2a7b7 Author: James Zhu Date: Wed May 28 11:51:18 2025 -0400 drm/amdkfd: remove unused code upages is assigned under cpages = 0, so it isn't really used in this function. Signed-off-by: James Zhu Reviewed-by: Philip.Yang Signed-off-by: Alex Deucher commit 6ec7120dec937559135a914a3da02a590421bba3 Author: Lijo Lazar Date: Thu Jul 24 11:13:27 2025 +0530 drm/amd/pm: Add priority messages for SMU v13.0.6 Certain messages will processed with high priority by PMFW even if it hasn't responded to a previous message. Send the priority message regardless of the success/fail status of the previous message. Add support on SMUv13.0.6 and SMUv13.0.12 Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 91c4fd416463a68dbc2c02ba7b960be9c2486183 Author: Lijo Lazar Date: Thu Jul 24 12:58:10 2025 +0530 drm/amdgpu: Set dpc status appropriately Set the dpc status based on hardware state. Also, clear the status before reinitialization after a successful reset. Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher commit 0333052d90683d88531558dcfdbf2525cc37c233 Author: Amber Lin Date: Thu Jul 31 20:45:00 2025 -0400 drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. Signed-off-by: Amber Lin Reviewed-by: Eric Huang Signed-off-by: Alex Deucher commit 32f73741d6ee41fd5db8791c1163931e313d0fdc Author: Lijo Lazar Date: Fri Jul 18 18:50:58 2025 +0530 drm/amdgpu: Wait for bootloader after PSPv11 reset Some PSPv11 SOCs take a longer time for PSP based mode-1 reset. Instead of checking for C2PMSG_33 status, add the callback wait_for_bootloader. Wait for bootloader to be back to steady state is already part of the generic mode-1 reset flow. Increase the retry count for bootloader wait and also fix the mask to prevent fake pass. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 66f92d1035db75c8da6b362b7eca3fe76704f61f Author: Ethan Carter Edwards Date: Fri Aug 1 21:38:16 2025 -0400 drm/amdgpu/gfx9.4.3: remove redundant repeated nested 0 check The repeated checks on grbm_soft_reset are unnecessary. Remove them. Signed-off-by: Ethan Carter Edwards Signed-off-by: Alex Deucher commit 90e1d0324af6ed4750e6c86bca4e19956f61ca2b Author: Ethan Carter Edwards Date: Fri Aug 1 21:45:41 2025 -0400 drm/amdgpu/gfx9: remove redundant repeated nested 0 check The repeated checks on grbm_soft_reset are unnecessary. Remove them. Signed-off-by: Ethan Carter Edwards Signed-off-by: Alex Deucher commit 8802ec0eba9887cf2799710aa39d112312213f58 Author: Ethan Carter Edwards Date: Fri Aug 1 21:41:42 2025 -0400 drm/amdgpu/gfx10: remove redundant repeated nested 0 check The repeated checks on grbm_soft_reset are unnecessary. Remove them. Signed-off-by: Ethan Carter Edwards Signed-off-by: Alex Deucher commit 9ed3d7bdf2dcdf1a1196630fab89a124526e9cc2 Author: Xaver Hugl Date: Fri Aug 1 00:49:51 2025 +0200 amdgpu/amdgpu_discovery: increase timeout limit for IFWI init With a timeout of only 1 second, my rx 5700XT fails to initialize, so this increases the timeout to 2s. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3697 Signed-off-by: Xaver Hugl Signed-off-by: Alex Deucher commit 1b392348de8ffc340545c62079645cb4695f5602 Author: Alexandre Demers Date: Sat Aug 2 22:27:31 2025 -0400 Documentation: Remove VCE support from OLAND's features OLAND doesn't support VCE at all, but it does support UVD (3 or 4, depending of the sources). Signed-off-by: Alexandre Demers Signed-off-by: Alex Deucher commit d2b48f2b30f25997a1ae1ad0cefac68c25f8c330 Author: Lizhi Hou Date: Sun Aug 3 12:14:50 2025 -0700 accel/amdxdna: Unify pm and rpm suspend and resume callbacks The suspend and resume callbacks for pm and runtime pm should be same. During suspending, it needs to stop all hardware contexts first. And the hardware contexts will be restarted after the device is resumed. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Maciej Falkowski Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250803191450.1568851-1-lizhi.hou@amd.com commit 979f61633d069d761da606bef5efec42d33509e2 Author: Francois Dugast Date: Tue Aug 5 15:59:07 2025 +0200 drm/xe/svm: Migrate folios when possible The DMA mapping can now correspond to a folio (order > 0), so move the iterator by the number of pages in the folio in order to migrate all pages at once. This requires forcing contiguous memory for SVM BOs, which greatly simplifies the code and enables 2MB device page support, allowing a major performance improvement. Negative effects like extra eviction are unlikely as SVM BOs have a maximal size of 2MB. v2: - Improve commit message (Matthew Brost) - Fix increment, chunk, assert match (Matthew Brost) Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250805140028.599361-7-francois.dugast@intel.com Signed-off-by: Francois Dugast commit 321d42032567e6ccbcec971b5547ae8ee1d4b861 Author: Francois Dugast Date: Tue Aug 5 15:59:06 2025 +0200 drm/xe/migrate: Populate struct drm_pagemap_addr array Workaround to ensure all addresses are populated in the array as this is expected when creating the copy batch. This is required because the migrate layer does not support 2MB GPU pages yet. A proper fix will come in a follow-up. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250805140028.599361-6-francois.dugast@intel.com Signed-off-by: Francois Dugast commit ddeda6136038b4b313bb6f9b44f2d363e1233814 Author: Francois Dugast Date: Tue Aug 5 15:59:05 2025 +0200 drm/pagemap: Allocate folios when possible If the order is greater than zero, allocate a folio when populating the RAM PFNs instead of allocating individual pages one after the other. For example if 2MB folios are used instead of 4KB pages, this reduces the number of calls to the allocation API by 512. v2: - Use page order instead of extra argument (Matthew Brost) - Allocate with folio_alloc() (Matthew Brost) - Loop for mpages and free_pages based on order (Matthew Brost) v3: - Fix loops in drm_pagemap_migrate_populate_ram_pfn() (Matthew Brost) v4: - Use folio_trylock(), set local variable to NULL (Matthew Brost) Cc: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250805140028.599361-5-francois.dugast@intel.com Signed-off-by: Francois Dugast commit d755ff6063852cbd43c666726b69333d33d0d379 Author: Francois Dugast Date: Tue Aug 5 15:59:04 2025 +0200 drm/pagemap: DMA map folios when possible If the page is part of a folio, DMA map the whole folio at once instead of mapping individual pages one after the other. For example if 2MB folios are used instead of 4KB pages, this reduces the number of DMA mappings by 512. The folio order (and consequently, the size) is persisted in the struct drm_pagemap_device_addr to be available at the time of unmapping. v2: - Initialize order variable (Matthew Brost) - Set proto and dir for completeness (Matthew Brost) - Do not populate drm_pagemap_addr, document it (Matthew Brost) - Add and use macro NR_PAGES(order) (Matthew Brost) Cc: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250805140028.599361-4-francois.dugast@intel.com Signed-off-by: Francois Dugast commit f35a6cdf8a6d69f2fb35ece202a09f13fe7c87b2 Author: Francois Dugast Date: Tue Aug 5 15:59:03 2025 +0200 drm/pagemap: Use struct drm_pagemap_addr in mapping and copy functions This struct embeds more information than just the DMA address. This will help later to support folio orders greater than zero. At this point, there is no functional change as the only struct member used is addr. In Xe, adapt to the new drm_gpusvm_devmem_ops type signatures using struct drm_pagemap_addr, as well as the internal xe SVM functions implementing those operations. The use of this struct is propagated to xe_migrate as it makes indexed accesses to the next DMA address but they are no longer contiguous. v2: - Rename drm_pagemap_device_addr to drm_pagemap_addr (Matthew Brost) - Squash with patch for Xe (Matthew Brost) - Set proto and dir for completeness (Matthew Brost) - Assess DMA map protocol (Matthew Brost) Cc: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250805140028.599361-3-francois.dugast@intel.com Signed-off-by: Francois Dugast commit 81aa3c7c62049b42959bd4054c3a3ed34b2d5bf4 Author: Francois Dugast Date: Tue Aug 5 15:59:02 2025 +0200 drm/pagemap: Rename drm_pagemap_device_addr to drm_pagemap_addr Rename this struct to the more generic name drm_pagemap_addr so it can be used in a broader context, such as DMA mappings of CPU memory. Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250805140028.599361-2-francois.dugast@intel.com Signed-off-by: Francois Dugast commit b5de222cb0394e21ced9e7e7cc48415636ae782f Author: Jani Nikula Date: Thu Jul 31 12:19:22 2025 +0300 drm/i915/display: keep forward declarations together Adhere to prevalent style. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/2c74fa7f2b7d5ecf8247aa5bff05d104ad60cf9e.1753953530.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1a449b5882e93beca3ae580d20cb52b9e7c8a765 Author: Jani Nikula Date: Thu Jul 31 12:19:21 2025 +0300 drm/i915/display: make struct __intel_global_objs_state opaque With struct __intel_global_objs_state only being accessed in intel_global_state.c, we can make it opaque. The double underscore to indicate internal becomes redundant, drop it. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/06cc4d1c506e3a5b1cc50e01c4bd1135bbf0f7bd.1753953530.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6098dcfa5d1d997083978ed53c31116220bc14bf Author: Jani Nikula Date: Thu Jul 31 12:19:20 2025 +0300 drm/i915/display: hide global state iterators, remove unused for_each_{new,old,oldnew}_global_obj_in_state() are only used within intel_global_state.c, hide them there. intel_for_each_global_obj() is unused, remove it. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/a23212d9298423d8971d6ad62f961386f7f927cc.1753953530.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dbdea37add132a0f5d96006ea01fa73280984b88 Author: Joseph Guo Date: Wed Aug 6 10:33:34 2025 +0900 drm: bridge: Add waveshare DSI2DPI unit driver Waveshare touchscreen consists of a DPI panel and a driver board. The waveshare driver board consists of ICN6211 and a MCU to convert DSI to DPI and control the backlight. This driver treats the MCU and ICN6211 board as a whole unit. It can support all resolution waveshare DSI2DPI based panel, the timing table should come from 'panel-dpi' panel in the device tree. Signed-off-by: Joseph Guo Suggested-by: Liu Ying Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250806-waveshare-v3-3-fd28e01f064f@nxp.com commit 80b0eb11f8e0a504078c3b405b54cddaf535ff97 Author: Joseph Guo Date: Wed Aug 6 10:33:33 2025 +0900 dt-bindings: display: panel: Add waveshare DPI panel support Add dt-binding documentation for waveshare DPI panel Signed-off-by: Joseph Guo Suggested-by: Liu Ying Acked-by: Rob Herring (Arm) Acked-by: Liu Ying Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250806-waveshare-v3-2-fd28e01f064f@nxp.com commit 01048738d6b618fc1dba564b38b3df06b0937eb0 Author: Joseph Guo Date: Wed Aug 6 10:33:32 2025 +0900 dt-bindings: display: bridge: Add waveshare DSI2DPI unit support Add dt-binding documentation for waveshare DSI2DPI unit Signed-off-by: Joseph Guo Suggested-by: Liu Ying Reviewed-by: Rob Herring (Arm) Acked-by: Liu Ying Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250806-waveshare-v3-1-fd28e01f064f@nxp.com commit cdaecac4fbcb2680e0c4e89f772f20b5bf132ea6 Author: Suraj Kandpal Date: Wed Aug 6 08:38:56 2025 +0530 drm/i915/scaler: Fix WA_14011503117 This introduces and uses a variable id which is just uninitialized. What really needs to be used is the scaler_id. Fixes: 73309ed9d598 ("drm/i915/display: WA_14011503117") Signed-off-by: Suraj Kandpal Reviewed-by: Nemesa Garg Link: https://lore.kernel.org/r/20250806030856.3514127-1-suraj.kandpal@intel.com commit ca0ed3b10f5dba790808107896c568cc037a74f4 Author: Michal Wajdeczko Date: Thu Jul 31 23:21:45 2025 +0200 drm/xe/configfs: Allow adding configurations for future VFs Since we are expecting that all configuration directory names will match some of the existing devices, we can't provide any configuration for the VFs until they are actually enabled. But we can relax that restriction by just checking if there is a PF device that could create given VF. This is easy since all our PF devices are always present at function 0 and we can query PF device for number of VFs it could support. Then for some system with PF device at 0000:00:02.0 we can add configs for all VFs: /sys/kernel/config/xe/ ├── 0000:00:02.0 │   └── ... ├── 0000:00:02.1 │   └── ... ├── 0000:00:02.2 │   └── ... : └── 0000:00:02.7 └── ... Signed-off-by: Michal Wajdeczko Cc: John Harrison Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731212145.179898-1-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit b4687422c322e5afc0f5d9425b29080c06dc17b9 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:38 2025 +0200 drm/xe/configfs: Only allow configurations for supported devices Since we already lookup for the real PCI device before we allow to create its directory config, we might also check if the found device matches our driver PCI ID list. This will prevent creation of the directory configs for the unsupported devices. Signed-off-by: Michal Wajdeczko Cc: John Harrison Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-11-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 737a72d7e0231123ae3f1578845d9a23b6d02a60 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:36 2025 +0200 drm/xe/configfs: Keep default device config settings together For easier maintenance add a placeholder where we can keep all default device configuration settings in one place. Signed-off-by: Michal Wajdeczko Reviewed-by: John Harrison Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-9-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 3c643f6216215c7e4e30f7a647024a20847b27af Author: Michal Wajdeczko Date: Thu Jul 31 21:33:35 2025 +0200 drm/xe/configfs: Reintroduce struct xe_config_device This time it will hold just pure configuration parameters, without any configfs related stuff. This will help us define defaults data without wasting space for unneeded data. Signed-off-by: Michal Wajdeczko Reviewed-by: John Harrison Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-8-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit ae3184d5f980d92377545ba58030e47ce48dd09f Author: Michal Wajdeczko Date: Thu Jul 31 21:33:34 2025 +0200 drm/xe/configfs: Rename configfs_find_group() helper This helper name shouldn't suggest that it iss a part of the core configfs API family. While around switch to use different helper to release a reference. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-7-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 88df7939d728a90ddb722c8113a4529948b3d2ef Author: Michal Wajdeczko Date: Thu Jul 31 21:33:33 2025 +0200 drm/xe/configfs: Rename struct xe_config_device Rename it to struct xe_config_group_device to better match its purpose. It will also help us to reintroduce in the upcoming patch the same struct name but this time to hold only configuration data. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-6-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit c4b1dde0630e40fa773b1613495d4df4955f44b4 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:32 2025 +0200 drm/xe/configfs: Drop redundant init() error message There is no need to print separate error message since we will also print one in xe_init(). Also drop temporary variable, which was likely just taken from the example code. Signed-off-by: Michal Wajdeczko Reviewed-by: John Harrison Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-5-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit b90613fb02179a01c6042d8a952e2c68e81d3cf7 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:31 2025 +0200 drm/xe/configfs: Destroy xe_configfs.su_mutex on exit/error While mutex_destroy() is NOP when CONFIG_DEBUG_MUTEXES is not enabled, we should still call it. While around, drop a trailing line. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-4-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 823301c847bd9c57dd8f7c684046778281744c77 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:30 2025 +0200 drm/xe: Print module init abort code We should provide a hint to the user why the module refused to load. This will also allow us to drop individual error messages from init steps. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-3-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 90759cddaceab1a7cfd0128d9421abf2d9288d09 Author: Michal Wajdeczko Date: Thu Jul 31 21:33:29 2025 +0200 drm/xe: Simplify module initialization code There is no need to have extra checks and WARN() in the helpers as instead of an index of the entry with function pointers, we can pass pointer to the entry which we prepare directly in the main loop, that is guaranteed to be valid. add/remove: 0/0 grow/shrink: 0/4 up/down: 0/-180 (-180) Function old new delta xe_exit 109 79 -30 cleanup_module 109 79 -30 xe_init 248 188 -60 init_module 248 188 -60 Total: Before=2774145, After=2773965, chg -0.01% Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Rodrigo Vivi Reviewed-by: John Harrison Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250731193339.179829-2-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 7c9de25efa7677acd4feae905165571be05b6f29 Author: Jonathan Cavitt Date: Mon Jul 28 19:48:06 2025 +0000 drm/xe/xe_guc_ads: Consolidate guc_waklv_enable functions Presently, multiple versions of the guc_waklv_enable_.* function exist, all with different numbers of dwords added to the klv_entry array. This is not extensible, and more duplicates of the function will need to be created if it ever becomes necessary to support 3 or more dwords per wa in the future. Consolidate the disparate guc_waklv_enable functions into a single guc_waklv_enable function that can take an arbitrary number of dword values. v2: - Update length value properly (Shuicheng) v3: (Harrison) - Use data as a term instead of dwords or arr - Reformat warning message to use hex values - Eliminate need for kzalloc and klv_entry array - Reorder function parameters to fix line wrapping v4: - Miscellaneous formatting fixes (Cavitt) v5: (Harrison) - s/data_range/data_len_dw - Use data_len_dw to calculate size for xe_map_memcpy_to Suggested-by: Daniele Ceraolo Spurio Signed-off-by: Jonathan Cavitt Cc: Lucas De Marchi Cc: Shuicheng Lin Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250728194806.68176-2-jonathan.cavitt@intel.com Signed-off-by: Lucas De Marchi commit 73309ed9d598d35576431c4691813e080980df68 Author: Nemesa Garg Date: Fri Aug 1 18:28:35 2025 +0530 drm/i915/display: WA_14011503117 Mask the ERR_FATAL_MASK before scaler initialization. After enabling the scaler and waiting for one frame, unmask the previously masked bits, PS_ECC and ERR_FATAL_MASK Unmasking of ERR_FATAL_MASK bit is use for validation purpose. There is no functional impact. v2: Remove intel_display_need_wa[Jani] Optimize the ecc_unmask call[Animesh] v3: Add intel_display_wa[Jani] Signed-off-by: Nemesa Garg Reviewed-by: Animesh Manna Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250801125835.2337614-1-nemesa.garg@intel.com commit 1c2efae2f855e348d772c071c8c30217d8a0dbae Author: Lijo Lazar Date: Mon Aug 4 10:34:06 2025 +0530 drm/amd/pm: Make static table support conditional Add PMFW version check for static table support on SMU v13.0.6 VFs. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 58364f01db4a155356f92cce1474761d7a0eda3d Author: Xiang Liu Date: Thu Jul 31 14:54:50 2025 +0800 drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest Sriov guest side doesn't init ras feature hence the poison irq shouldn't be put during hw fini. [25209.468816] Call Trace: [25209.468817] [25209.468818] ? srso_alias_return_thunk+0x5/0x7f [25209.468820] ? show_trace_log_lvl+0x28e/0x2ea [25209.468822] ? show_trace_log_lvl+0x28e/0x2ea [25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] [25209.468936] ? show_regs.part.0+0x23/0x29 [25209.468939] ? show_regs.cold+0x8/0xd [25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.469038] ? __warn+0x8c/0x100 [25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.469135] ? report_bug+0xa4/0xd0 [25209.469138] ? handle_bug+0x39/0x90 [25209.469140] ? exc_invalid_op+0x19/0x70 [25209.469142] ? asm_exc_invalid_op+0x1b/0x20 [25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] [25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] [25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq") Signed-off-by: Xiang Liu Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 Author: Xiang Liu Date: Thu Jul 31 14:28:26 2025 +0800 drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest Sriov guest side doesn't init ras feature hence the poison irq shouldn't be put during hw fini. [25209.467154] Call Trace: [25209.467156] [25209.467158] ? srso_alias_return_thunk+0x5/0x7f [25209.467162] ? show_trace_log_lvl+0x28e/0x2ea [25209.467166] ? show_trace_log_lvl+0x28e/0x2ea [25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] [25209.467300] ? show_regs.part.0+0x23/0x29 [25209.467303] ? show_regs.cold+0x8/0xd [25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.467403] ? __warn+0x8c/0x100 [25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.467503] ? report_bug+0xa4/0xd0 [25209.467508] ? handle_bug+0x39/0x90 [25209.467511] ? exc_invalid_op+0x19/0x70 [25209.467513] ? asm_exc_invalid_op+0x1b/0x20 [25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] [25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu] [25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] [25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] [25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq") Signed-off-by: Xiang Liu Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 5c2b3226d00b5da63080ad0387481f66a024c635 Author: Lijo Lazar Date: Thu Jul 24 12:52:56 2025 +0530 drm/amdgpu: Add wrapper function for dpc state Use wrapper functions to set/indicate dpc status. Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher commit 9b331f0f60832c01939b4c46f66d24eca3917c3d Author: Lijo Lazar Date: Fri Aug 1 23:42:01 2025 +0530 drm/amd/pm: Allow static metrics table query in VF Allow statics metrics table to be queried on SMUv13.0.6 SOCs in VF mode. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 92e2449241516c95aab95eea91faecd0fa2b7ed5 Author: Jesse.Zhang Date: Mon Aug 4 08:43:15 2025 +0800 drm/amdgpu: Update SDMA firmware version check for user queue support This commit fixes a firmware version check for enabling user queue support in SDMA v7.0. The previous version check (7836028) was incorrect and could lead to issues with PROTECTED_FENCE_SIGNAL commands causing register conflicts between MCU_DBG0 and MCU_DBG1. Fixes: 8c011408ed84 ("drm/amdgpu/sdma7: add ucode version checks for userq support") Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be Author: Lijo Lazar Date: Fri Jul 11 12:18:04 2025 +0530 drm/amd/pm: Use cached metrics data on arcturus Cached metrics data validity is 1ms on arcturus. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit e87577ef6daa0cfb10ca139c720f0c57bd894174 Author: Lijo Lazar Date: Fri Jul 11 12:15:45 2025 +0530 drm/amd/pm: Use cached metrics data on aldebaran Cached metrics data validity is 1ms on aldebaran. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 582bf7c5158dce16f7dc5b8345b7876bd8031224 Author: Lijo Lazar Date: Fri Jul 18 09:25:21 2025 +0530 drm/amdgpu: Add NULL check for asic_funcs If driver load fails too early, asic_funcs pointer remains unassigned. Add NULL check to sanitize unwind path. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 712d98c7da689447596e388b4fb05ec4fa74d70c Author: Taimur Hassan Date: Fri Jul 25 17:14:58 2025 -0500 drm/amd/display: Promote DC to 3.2.344 Summary: * Add interface to log hw state when underflow happens * Fix hubp programming of 3dlut fast load * Avoid Read Remote DPCD Many Times * More liberal vmin/vmax update for freesync * Fix dmub access race condition Acked-by: Sun peng (Leo) Li Signed-off-by: Taimur Hassan Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5dc0ec782ef17ed10b87fa0962388040a86602c8 Author: Muhammad Ahmed Date: Thu Jul 24 21:50:25 2025 -0400 drm/amd/display: Adding interface to log hw state when underflow happens [why] Will help us better debug underflow issues. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Muhammad Ahmed Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 20ea30a793f29fd9026406dc4de3c8d17da120c2 Author: Ryan Seto Date: Thu Jul 24 14:57:52 2025 -0400 drm/amd/display: Toggle for Disable Force Pstate Allow on Disable [Why & How] In theory, driver should be able to support disabling force pstate allow after hardware release however this behavior is not tested yet. Introducing a new toggle to disable the force on the fly. Reviewed-by: Dillon Varone Signed-off-by: Ryan Seto Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e63e9f8b3d1c5d17fa4db9241905a8baf1e4bda8 Author: Reza Amini Date: Mon Jul 14 16:22:38 2025 -0400 drm/amd/display: Fixing hubp programming of 3dlut fast load [why] HUBP needs to know the size of the lut's destination in MPC. This is currently defaulted to 17, and needs to be set for specific lut size. [how] Define and apply the missing hubp field. Taking this opportunity to consolidate the programming of 3dlut into a hubp and mpc function. Reviewed-by: Krunoslav Kovac Signed-off-by: Reza Amini Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3df957517f8c17cd6c9be9c5a12979caf653a763 Author: Jingwen Zhu Date: Mon Jul 14 16:18:19 2025 +0800 drm/amd/display: limited pll vco w/a v2 [Why/How] The w/a will cause reboot black screen issue. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Jingwen Zhu Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fa5f99ee7260e067e4e3c1350243471862fad11c Author: Fangzhi Zuo Date: Wed Jul 9 21:42:54 2025 -0400 drm/amd/display: Avoid Read Remote DPCD Many Times Reading remote dpcd is time consuming. Instead of reading each byte one by one, read 16 bytes together. Reviewed-by: ChiaHsuan (Tom) Chung Signed-off-by: Fangzhi Zuo Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6ec8a5cbec751625133461600d0d4950ffd3a214 Author: Mario Limonciello Date: Sun Jul 20 23:39:41 2025 -0500 drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value" This reverts commit 66abb996999de0d440a02583a6e70c2c24deab45. This broke custom brightness curves but it wasn't obvious because of other related changes. Custom brightness curves are always from a 0-255 input signal. The correct fix was to fix the default value which was done by [1]. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4412 Link: https://lore.kernel.org/amd-gfx/0f094c4b-d2a3-42cd-824c-dc2858a5618d@kernel.org/T/#m69f875a7e69aa22df3370b3e3a9e69f4a61fdaf2 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2e72fdba8a32ce062a86571edff4592710c26215 Author: Paul Hsieh Date: Wed Jul 23 11:51:42 2025 +0800 drm/amd/display: update dpp/disp clock from smu clock table [Why] The reason some high-resolution monitors fail to display properly is that this platform does not support sufficiently high DPP and DISP clock frequencies [How] Update DISP and DPP clocks from the smu clock table then DML can filter these mode if not support. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Paul Hsieh Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6d31602a9f57a7bb3c6c8dbde1d00af67e250a3f Author: Aurabindo Pillai Date: Wed Apr 16 11:26:54 2025 -0400 drm/amd/display: more liberal vmin/vmax update for freesync [Why] FAMS2 expects vmin/vmax to be updated in the case when freesync is off, but supported. But we only update it when freesync is enabled. [How] Change the vsync handler such that dc_stream_adjust_vmin_vmax() its called irrespective of whether freesync is enabled. If freesync is supported, then there is no harm in updating vmin/vmax registers. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3546 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Aurabindo Pillai Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Roman Li Reviewed-by: ChiaHsuan Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c210b757b400959577a5a17b783b5959b82baed8 Author: Aurabindo Pillai Date: Mon Jul 21 11:03:39 2025 -0400 drm/amd/display: fix dmub access race condition Accessing DC from amdgpu_dm is usually preceded by acquisition of dc_lock mutex. Most of the DC API that DM calls are under a DC lock. However, there are a few that are not. Some DC API called from interrupt context end up sending DMUB commands via a DC API, while other threads were using DMUB. This was apparent from a race between calls for setting idle optimization enable/disable and the DC API to set vmin/vmax. Offload the call to dc_stream_adjust_vmin_vmax() to a thread instead of directly calling them from the interrupt handler such that it waits for dc_lock. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Aurabindo Pillai Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fd20627c74993cf4d81e3848f2833c7198c884d7 Author: Duncan Ma Date: Tue Jul 22 12:22:15 2025 -0400 drm/amd/display: Adjust AUX-less ALPM setting [Why & How] Change ACDS period to support LTTPR. Reviewed-by: Charlene Liu Signed-off-by: Duncan Ma Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9dd8e2ba268c636c240a918e0a31e6feaee19404 Author: Siyang Liu Date: Fri Jul 4 11:16:22 2025 +0800 drm/amd/display: fix a Null pointer dereference vulnerability [Why] A null pointer dereference vulnerability exists in the AMD display driver's (DC module) cleanup function dc_destruct(). When display control context (dc->ctx) construction fails (due to memory allocation failure), this pointer remains NULL. During subsequent error handling when dc_destruct() is called, there's no NULL check before dereferencing the perf_trace member (dc->ctx->perf_trace), causing a kernel null pointer dereference crash. [How] Check if dc->ctx is non-NULL before dereferencing. Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello (Updated commit text and removed unnecessary error message) Signed-off-by: Siyang Liu Signed-off-by: Roman Li Reviewed-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 82594ac858e863b5203df951b6ed198e6fb9628c Author: Mangesh Gadre Date: Mon Jul 21 23:32:34 2025 +0800 drm/amdgpu: Initialize vcn v5_0_1 ras function Initialize vcn v5_0_1 ras function Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit cc7bfba95966251b254cb970c21627124da3b7f4 Author: Michel Dänzer Date: Wed Jul 30 10:09:02 2025 +0200 drm/amd/display: Add primary plane to commits for correct VRR handling amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for the primary plane. If a commit affects a CRTC but not its primary plane, it would previously not trigger a refresh cycle or affect LFC, violating current UAPI semantics. Fixes e.g. atomic commits affecting only the cursor plane being limited to the minimum refresh rate. Don't do this for the legacy cursor ioctls though, it would break the UAPI semantics for those. Suggested-by: Xaver Hugl Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034 Signed-off-by: Michel Dänzer Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit ba5e322b2617157edb757055252a33587b6729e0 Author: Yunxiang Li Date: Fri Jul 25 12:56:35 2025 -0400 drm/amdgpu: skip mgpu fan boost for multi-vf On multi-vf setup if the VM have two vf assigned, perhaps from two different gpus, mgpu fan boost will fail. Signed-off-by: Yunxiang Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 01fa9758c8498d8930df56eca36c88ba3e9493d4 Author: Mangesh Gadre Date: Tue Jul 22 00:27:52 2025 +0800 drm/amdgpu: Initialize jpeg v5_0_1 ras function Initialize jpeg v5_0_1 ras function Signed-off-by: Mangesh Gadre Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 8e8e08c831f088ed581444c58a635c49ea1222ab Author: Xiang Liu Date: Wed Jul 30 11:07:43 2025 +0800 drm/amdgpu: Skip poison aca bank from UE channel Avoid GFX poison consumption errors logged when fatal error occurs. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 4d22db6d070ed3934f02ed15391283f6feb258ad Author: Arnd Bergmann Date: Mon Jul 14 10:16:25 2025 +0200 drm/amdgpu: fix link error for !PM_SLEEP When power management is not enabled in the kernel build, the newly added hibernation changes cause a link failure: arm-linux-gnueabi-ld: drivers/gpu/drm/amd/amdgpu/amdgpu_drv.o: in function `amdgpu_pmops_thaw': amdgpu_drv.c:(.text+0x1514): undefined reference to `pm_hibernate_is_recovering' Make the power management code in this driver conditional on CONFIG_PM and CONFIG_PM_SLEEP Fixes: 530694f54dd5 ("drm/amdgpu: do not resume device in thaw for normal hibernation") Signed-off-by: Arnd Bergmann Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250714081635.4071570-1-arnd@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d Author: Alex Deucher Date: Fri Jun 27 10:10:31 2025 -0400 drm/amd/display: add more cyan skillfish devices Add PCI IDs to support display probe for cyan skillfish family of SOCs. Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit e932f4779a2d329841bb9ca70bb80a4bb2d707b6 Author: Alex Deucher Date: Fri Jul 18 15:53:21 2025 -0400 drm/amdgpu: update mmhub 3.3 client id mappings Update the client id mapping so the correct clients get printed when there is a mmhub page fault. v2: fix typos spotted by David Wu. v3: fix additional typo spotted by David. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505 Author: Alex Deucher Date: Fri Jul 18 15:52:04 2025 -0400 drm/amdgpu: update mmhub 3.0.1 client id mappings Update the client id mapping so the correct clients get printed when there is a mmhub page fault. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 26a63590fea63e0b462f3db6860fd454b088897b Author: Sathishkumar S Date: Fri Jul 18 13:23:53 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN2_5 Use generic vcn devcoredump helper functions for VCN2_5 and VCN2_6 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 53c4be7a59dfbc5f6581727e536b62a322a21a36 Author: Sathishkumar S Date: Fri Jul 18 13:15:00 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN2_0_0 Use generic vcn devcoredump helper functions for VCN2_0_0 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit b2d532b588b313e882ee9b9169c9f31f743747dc Author: Sathishkumar S Date: Fri Jul 18 13:08:00 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN3_0 Use generic vcn devcoredump helper functions for VCN3_0 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 69cc37647b3ba8aa8b4fdbde34598ce56281bf0d Author: Sathishkumar S Date: Fri Jul 18 12:57:04 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN4_0_3 Use generic vcn devcoredump helper functions for VCN4_0_3 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 793b97c4ad33a3c35739c8ac59ecfdae22a4cb18 Author: Sathishkumar S Date: Fri Jul 18 12:38:49 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN4_0_5 Use generic vcn devcoredump helper functions for VCN4_0_5 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 4e011af912fb51e1b0d12f22e6d6b883b6a700e7 Author: Sathishkumar S Date: Fri Jul 18 12:18:30 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN4_0_0 Use generic vcn devcoredump helper functions for VCN4_0_0 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit f4c3be28d55cb544133f0d8bff2564041dba719e Author: Sathishkumar S Date: Fri Jul 18 00:27:50 2025 +0530 drm/amdgpu/vcn: Register dump cleanup in VCN5 Use generic vcn devcoredump helper functions for VCN5 Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 08e27c9d9209ec4daaba3aa9b7c69e9c75be3eee Author: Stanley.Yang Date: Mon Jul 28 19:49:24 2025 +0800 drm/amdgpu: Add new error code for VCN/JPEG new chain Add VIDS and JPEG8/9 S|D chain error code for VCN/JPEG v5.0.1. Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b1b29aa88f5367d0367c8eeef643635bc6009a9a Author: Stanley.Yang Date: Mon Jul 28 19:33:50 2025 +0800 drm/amdgpu: Fix vcn v5.0.1 poison irq call trace Why: [13014.890792] Call Trace: [13014.890793] [13014.890795] ? show_trace_log_lvl+0x1d6/0x2ea [13014.890799] ? show_trace_log_lvl+0x1d6/0x2ea [13014.890800] ? vcn_v5_0_1_hw_fini+0xe9/0x110 [amdgpu] [13014.890872] ? show_regs.part.0+0x23/0x29 [13014.890873] ? show_regs.cold+0x8/0xd [13014.890874] ? amdgpu_irq_put+0xc6/0xe0 [amdgpu] [13014.890934] ? __warn+0x8c/0x100 [13014.890936] ? amdgpu_irq_put+0xc6/0xe0 [amdgpu] [13014.890995] ? report_bug+0xa4/0xd0 [13014.890999] ? handle_bug+0x39/0x90 [13014.891001] ? exc_invalid_op+0x19/0x70 [13014.891003] ? asm_exc_invalid_op+0x1b/0x20 [13014.891005] ? amdgpu_irq_put+0xc6/0xe0 [amdgpu] [13014.891065] ? amdgpu_irq_put+0x63/0xe0 [amdgpu] [13014.891124] vcn_v5_0_1_hw_fini+0xe9/0x110 [amdgpu] [13014.891189] amdgpu_ip_block_hw_fini+0x3b/0x78 [amdgpu] [13014.891309] amdgpu_device_fini_hw+0x3c1/0x479 [amdgpu] How: Add omitted vcn poison irq get call. Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit de55cbff5ce93c316b0113535752e43079761f2c Author: Sathishkumar S Date: Thu Jul 17 11:30:52 2025 +0530 drm/amdgpu/vcn: Add regdump helper functions Add generic helper functions for vcn devcoredump support which can be re-used for all vcn versions. Signed-off-by: Sathishkumar S Acked-by: Leo Liu Signed-off-by: Alex Deucher commit e6c2b0f23221ed43c4cc6f636e9ab7862954d562 Author: Meng Li Date: Fri May 9 13:44:24 2025 +0800 drm/amd/amdgpu: Release xcp drm memory after unplug Add a new API amdgpu_xcp_drm_dev_free(). After unplug xcp device, need to release xcp drm memory etc. Co-developed-by: Jiang Liu Signed-off-by: Jiang Liu Signed-off-by: Meng Li Acked-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit ed76936c6b10b547c6df4ca75412331e9ef6d339 Author: YuanShang Date: Wed Jul 23 16:44:49 2025 +0800 drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job The field job->vm is used in function amdgpu_job_run to get the page table re-generation counter and decide whether the job should be skipped. Specifically, function amdgpu_vm_generation checks if the VM is valid for this job to use. For instance, if a gfx job depends on a cancelled sdma job from entity vm->delayed, then the gfx job should be skipped. Fixes: 26c95e838e63 ("drm/amdgpu: set the VM pointer to NULL in amdgpu_job_prepare") Signed-off-by: YuanShang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cc51bbc7d7a7ff63de3e095e3681e78fe63ddda6 Author: Mario Limonciello Date: Tue Jul 15 16:24:20 2025 -0500 drm/amd: Use drm_*() macros instead of DRM_*() for amdgpu_cs Some of the IOCTL messages can be called for different GPUs and it might not be obvious which one called them from a problem. Using the drm_*() macros the correct device will be shown in the messages. Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250715212420.2254925-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 130c7ed88f62f72bd99db69e634a5f0ac10a2362 Author: Yunshui Jiang Date: Thu Jul 24 09:37:53 2025 +0800 drm/amdgpu: use kmalloc_array() instead of kmalloc() Use kmalloc_array() instead of kmalloc() with multiplication. kmalloc_array() is a safer way because of its multiply overflow check. Signed-off-by: Yunshui Jiang Signed-off-by: Alex Deucher commit 46b0e6b9d749cfa891e6969d6565be1131c53aa2 Author: Sathishkumar S Date: Mon Jul 28 18:27:06 2025 +0530 drm/amdgpu: Fix unintended error log in VCN5_0_0 The error log is supposed to be gaurded under if failure condition. Fixes: faab5ea08367 ("drm/amdgpu: Check vcn sram load return value") Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 35222b5934ec8d762473592ece98659baf6bc48e Author: Timur Kristóf Date: Tue Jul 22 17:58:30 2025 +0200 drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. Apparently, both DCE 6.0 and 6.4 have 3 PLLs, but PLL0 can only be used for DP. Make sure to initialize the correct amount of PLLs in DC for these DCE versions and use PLL0 only for DP. Also, on DCE 6.0 and 6.4, the PLL0 needs to be powered on at initialization as opposed to DCE 6.1 and 7.x which use a different clock source for DFS. The following functions were used as reference from the old radeon driver implementation of DCE 6.x: - radeon_atom_pick_pll - atombios_crtc_set_disp_eng_pll Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6 Author: Timur Kristóf Date: Tue Jul 22 17:58:29 2025 +0200 drm/amd/display: Don't overwrite dce60_clk_mgr dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr with the dce_clk_mgr, causing incorrect behaviour on DCE6. Fix it by removing the extra dce_clk_mgr_construct. Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs") Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit da467352296f8e50c7ab7057ead44a1df1c81496 Author: Ce Sun Date: Sat Jul 26 20:16:24 2025 +0800 drm/amdgpu: Effective health check before reset Move amdgpu_device_health_check into amdgpu_device_gpu_recover to ensure that if the device is present can be checked before reset The reason is: 1.During the dpc event, the device where the dpc event occurs is not present on the bus 2.When both dpc event and ATHUB event occur simultaneously,the dpc thread holds the reset domain lock when detecting error,and the gpu recover thread acquires the hive lock.The device is simultaneously in the states of amdgpu_ras_in_recovery and occurs_dpc,so gpu recover thread will not go to amdgpu_device_health_check.It waits for the reset domain lock held by the dpc thread, but dpc thread has not released the reset domain lock.In the dpc callback slot_reset,to obtain the hive lock, the hive lock is held by the gpu recover thread at this time.So a deadlock occurred Signed-off-by: Ce Sun Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 21c0ffa612c98bcc6dab5bd9d977a18d565ee28e Author: Ce Sun Date: Sun Jul 27 12:06:55 2025 +0800 drm/amdgpu: Avoid rma causes GPU duplicate reset Try to ensure poison creation handle is completed in time to set device rma value. Signed-off-by: Ce Sun Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 8f0245ee95c5ba65a2fe03f60386868353c6a3a0 Author: Xiang Liu Date: Wed Jul 23 14:28:35 2025 +0800 drm/amdgpu: Update IPID value for bad page threshold CPER Update the IPID register value for bad page threshold CPER according to the latest definition. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 70e33073d941b4fc1e773769bd7d72220c14d41d Author: Srinivasan Shanmugam Date: Mon Jul 21 19:04:34 2025 +0530 drm/amdgpu: Fix kdoc style in amdgpu_fence.c The initial comment block before amdgpu_fence_driver_guilty_force_completion() incorrectly used '/**' but is not a kernel-doc comment, causing build warnings. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:742: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Kernel queue reset handling Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit a578f2a58c3ab38f0643b1b6e7534af860233cb1 Author: David Yat Sin Date: Wed Jul 16 22:04:28 2025 +0000 drm/amdkfd: Fix checkpoint-restore on multi-xcc GPUs with multi-xcc have multiple MQDs per queue. This patch saves and restores all the MQDs within the partition. Signed-off-by: David Yat Sin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 8f249ba6ec607313c2dd5d6c8f99ad647c99af02 Author: Alex Deucher Date: Mon Jul 28 11:21:19 2025 -0400 Documentation: add RDNA4 dGPUs Add RDNA4 dGPUs to the dGPU table. Link: https://www.amd.com/en/products/graphics/desktops/radeon/9000-series/amd-radeon-rx-9070xt.html Link: https://www.amd.com/en/products/graphics/desktops/radeon/9000-series/amd-radeon-rx-9070.html Link: https://www.amd.com/en/products/graphics/desktops/radeon/9000-series/amd-radeon-rx-9060xt.html Link: https://www.amd.com/en/products/graphics/desktops/radeon/9000-series/amd-radeon-rx-9060xt-8gb.html Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 810a8809ccc69a67af74f3bd63f4d99da08049e7 Author: Alex Deucher Date: Mon Jul 28 11:15:40 2025 -0400 Documentation: update APU and dGPU tables with MP0/1 info Add MP1 for APUs and MP0 and MP1 details for dGPUs. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3905 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 4e9526924d09057a9ba854305e17eded900ced82 Author: Mario Limonciello Date: Thu Jul 24 22:12:22 2025 -0500 drm/amd: Restore cached manual clock settings during resume If the SCLK limits have been set before S3 they will not be restored. The limits are however cached in the driver and so they can be restored by running a commit sequence during resume. Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250725031222.3015095-3-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 26a609e053a6fc494403e95403bc6a2470383bec Author: Mario Limonciello Date: Thu Jul 24 22:12:21 2025 -0500 drm/amd: Restore cached power limit during resume The power limit will be cached in smu->current_power_limit but if the ASIC goes into S3 this value won't be restored. Restore the value during SMU resume. Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 8e3967a71e6fca9c871f98b9289b59c82b88b729 Author: Perry Yuan Date: Mon Jul 7 10:45:28 2025 +0800 drm/amdgpu: Fix build error when CONFIG_SUSPEND is disabled The variable `pm_suspend_target_state` is conditionally defined only when `CONFIG_SUSPEND` is enabled (see `include/linux/suspend.h`). Directly referencing it without guarding by `#ifdef CONFIG_SUSPEND` causes build failures when suspend functionality is disabled (e.g., `CONFIG_SUSPEND=n`). Reviewed-by: Lijo Lazar Signed-off-by: Perry Yuan Signed-off-by: Alex Deucher commit 6716a823d18d422c356c2cd0c087f46d84c9e713 Author: Christian König Date: Fri Jun 6 14:13:37 2025 +0200 drm/amdgpu: rework how PTE flags are generated v3 Previously we tried to keep the HW specific PTE flags in each mapping, but for CRIU that isn't sufficient any more since the original value is needed for the checkpoint procedure. So rework the whole handling, nuke the early mapping function, keep the UAPI flags in each mapping instead of the HW flags and translate them to the HW flags while filling in the PTEs. Only tested on Navi 23 for now, so probably needs quite a bit of more work. v2: fix KFD and SVN handling v3: one more SVN fix pointed out by Felix v4: squash in gfx12 fix from David Signed-off-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit bcddb12c027434fdf0491c1a05a3fe4fd2263d71 Author: Tangudu Tilak Tirumalesh Date: Thu Jul 31 22:01:44 2025 +0000 drm/xe: Extend wa_13012615864 to additional Xe2 and Xe3 platforms Extend WA 13012615864 to Graphics Versions 20.01,20.02,20.04 and 30.03. Signed-off-by: Tangudu Tilak Tirumalesh Signed-off-by: Jonathan Cavitt Cc: Matt Roper Cc: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250731220143.72942-2-jonathan.cavitt@intel.com Signed-off-by: Rodrigo Vivi commit cf9710a0a2ed490bd3c6933ecfc22556894a1df4 Author: Hugo Villeneuve Date: Mon Jul 21 11:28:15 2025 -0400 drm/panel: sitronix-st7703: fix typo in comments Fix typo in comments: souch -> such. Signed-off-by: Hugo Villeneuve Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250721152818.1891212-1-hugo@hugovil.com commit 05efa7f1d14febf0cd230c4950abfa6add1344a2 Author: Chen Ni Date: Tue Jul 29 13:42:14 2025 +0800 drm/panel: himax-hx8279: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Dmitry Baryshkov Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250729054214.2264377-1-nichen@iscas.ac.cn commit 125459e19ec654924e472f3ff5aeea40358dbebf Author: Brigham Campbell Date: Wed Jul 30 21:23:41 2025 -0600 drm/panel: novatek-nt35560: Fix invalid return value Fix bug in nt35560_set_brightness() which causes the function to erroneously report an error. mipi_dsi_dcs_write() returns either a negative value when an error occurred or a positive number of bytes written when no error occurred. The buggy code reports an error under either condition. Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") Reviewed-by: Douglas Anderson Reviewed-by: Neil Armstrong Signed-off-by: Brigham Campbell Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com commit fdb4e289d2d6fd172591d802db71cef3134c1cf8 Author: Svyatoslav Ryhel Date: Thu Jul 17 16:57:52 2025 +0300 drm: panel: Add support for Hydis HV101HD1 MIPI DSI panel HV101HD1-1E1 is a color active matrix TFT LCD module using amorphous silicon TFT's (Thin Film Transistors) as an active switching devices. This module has a 10.1 inch diagonally measured active area with HD resolutions (1366 horizontal by 768 vertical pixel array). Signed-off-by: Svyatoslav Ryhel Reviewed-by: David Heidelberg Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250717135752.55958-3-clamor95@gmail.com commit bd068333ef090d63a7cf952d70040e768b0aa4cf Author: Svyatoslav Ryhel Date: Thu Jul 17 16:57:51 2025 +0300 dt-bindings: display: panel: Document Hydis HV101HD1 DSI panel Hydis HV101HD1 is a 2-lane 1366x768 MIPI DSI panel found in ASUS VivoTab RT TF600T tablet. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250717135752.55958-2-clamor95@gmail.com commit 640d512caa64b569e58a08b540d9c400e1aa8f94 Author: Akhilesh Patil Date: Thu Jul 24 21:38:32 2025 +0530 drm: panel: orisetech: improve error handling during probe Use dev_err_probe() helper as directed by core driver model to handle driver probe error. Use standard helper defined at drivers/base/core.c to maintain code consistency. Inspired by, commit a787e5400a1ce ("driver core: add device probe log helper") Signed-off-by: Akhilesh Patil Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/aIJagJ/RnhSCtb2t@bhairav-test.ee.iitb.ac.in commit 368ea3f33f01b618bd645aa61b673f92e9aae767 Author: Colin Ian King Date: Thu Jul 24 12:23:58 2025 +0100 drm/panel: Kconfig: Fix spelling mistake "pannel" -> "panel" There is a spelling mistake in the LEDS_BD2606MVV config. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724112358.142351-1-colin.i.king@gmail.com commit 47d7953d8e1e774265ec2c79e37871af97abadb2 Author: Kaustabh Chakraborty Date: Mon Jul 21 20:09:00 2025 +0530 drm: panel: add support for Samsung AMS561RA01 panel with S6E8AA5X01 controller Samsung AMS561RA01 is an AMOLED panel, using the Samsung S6E8AA5X01 MIPI DSI controller. Implement a basic panel driver for such panels. The driver also initializes a backlight device, which works by changing the panel's gamma values and aid brightness levels appropriately, with the help of look-up tables acquired from downstream kernel sources. Signed-off-by: Kaustabh Chakraborty Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250721-panel-samsung-s6e8aa5x01-v5-2-1a315aba530b@disroot.org commit f3e1caef597e7f29dd2326dae7fa5964ae46c91d Author: Kaustabh Chakraborty Date: Mon Jul 21 20:08:59 2025 +0530 dt-bindings: display: panel: document Samsung AMS561RA01 panel with S6E8AA5X01 controller Samsung AMS561RA01 is an AMOLED panel, using the Samsung S6E8AA5X01 MIPI DSI panel controller. Document the compatible and devicetree properties of this hardware. It has a reset GPIO and two voltage regulators. Acked-by: Conor Dooley Signed-off-by: Kaustabh Chakraborty Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250721-panel-samsung-s6e8aa5x01-v5-1-1a315aba530b@disroot.org commit 26232780077b3e6147fabb6111afd0bd9a60f973 Author: Paul Kocialkowski Date: Wed Jul 2 10:22:30 2025 +0200 drm/panel: simple: Add Olimex LCD-OLinuXino-5CTS support Add support for the Olimex LCD-OLinuXino-5CTS, a 5-inch TFT LCD panel with a mode operating at 33.3 MHz. Signed-off-by: Paul Kocialkowski Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250702082230.1291953-2-paulk@sys-base.io commit 1da71a08080bb5cf5601f237e94c3dd5cede446b Author: Paul Kocialkowski Date: Wed Jul 2 10:22:29 2025 +0200 dt-bindings: display: simple: Add Olimex LCD-OLinuXino-5CTS Add the Olimex LCD-OLinuXino-5CTS, a 5-inch TFT LCD panel. Signed-off-by: Paul Kocialkowski Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250702082230.1291953-1-paulk@sys-base.io commit ba180a362128cb71d16c3f0ce6645448011d2607 Author: Tomasz Lis Date: Sat Aug 2 05:10:45 2025 +0200 drm/xe/vf: Rebase exec queue parallel commands during migration recovery Parallel exec queues have an additional command streamer buffer which holds a GGTT reference to data within context status. The GGTT references have to be fixed after VF migration. v2: Properly handle nop entry, verify if parsing goes ok v3: Improve error/warn logging, add propagation of errors, give names to magic offsets Signed-off-by: Tomasz Lis Cc: Michal Winiarski Reviewed-by: Michał Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-9-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit 168b5867318bff761c9095d12115c302c483d66a Author: Tomasz Lis Date: Sat Aug 2 05:10:44 2025 +0200 drm/xe/vf: Refresh utilization buffer during migration recovery The WA buffer we use to capture context utilization contains GGTT references. This means its instructions have to be either fixed or re-emitted during VF post-migration recovery. This patch adds re-emitting content of the utilization WA BB during the recovery. The way we write to vram requires scratch buffer to be used before the whole block is memcopied. We are re-using a scratch buffer introduced in earlier part of the recovery. This is not a performance optimization, but a necessity to avoid creating dependencies between locks. v2: Notable rebase after "Prepare WA BB setup for more users" patch v3: Added error propagation Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Reviewed-by: Michal Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-8-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit a0dda25d24e636df5c30a9370464b7cebc709faf Author: Tomasz Lis Date: Sat Aug 2 05:10:43 2025 +0200 drm/xe/vf: Post migration, repopulate ring area for pending request The commands within ring area allocated for a request may contain references to GGTT. These references require update after VF migration, in order to continue any preempted LRCs, or jobs which were emitted to the ring but not sent to GuC yet. This change calls the emit function again for all such jobs, as part of post-migration recovery. v2: Moved few functions to better files v3: Take job_list_lock v4: Rephrased comments Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Reviewed-by: Michal Winiarski Cc: Jonathan Cavitt Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250802031045.1127138-7-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit 30d137ddcee514d3ee5a498713628bd50d41e87b Author: Tomasz Lis Date: Sat Aug 2 05:10:42 2025 +0200 drm/xe/vf: Rebase MEMIRQ structures for all contexts after migration All contexts require an update of state data, as the data includes GGTT references to memirq-related buffers. Default contexts need these references updated as well, because they are not refreshed when a new context is created from them. The way we write to vram requires scratch buffer to be used before the whole block is memcopied. Since using kalloc() within specific recovery functions would lead to unintended relations between locks, we are allocating the buffer earlier, before any locks are taken. The same buffer will be used for other steps of the recovery. v2: Update addresses by xe_lrc_write_ctx_reg() rather than set_memory_based_intr() v3: Renamed parameter, reordered parameters in some functs v4: Check if have MEMIRQ, move `xe_gt*` funct to proper file v5: Revert back to requiring scratch buffer, but allocate it earlier this time Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Acked-by: Satyanarayana K V P Reviewed-by: Michal Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-6-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit b46ef766737c4ecc11aad9742fd7f70f8f922246 Author: Tomasz Lis Date: Sat Aug 2 05:10:41 2025 +0200 drm/xe/vf: Rebase HWSP of all contexts after migration All contexts require an update due to GGTT range shift, as that affects their HWSP. The HW status page of a context contains GGTT references, which need to be shifted to a new range (or re-computed using the previously updated vma nodes). The references include ring start address and indirect state address. v2: move some functions to better matched files v3: Add missing kerneldocs v4: Style fix Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Acked-by: Satyanarayana K V P Reviewed-by: Michal Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-5-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit a0840b1ce95e37a1a870a3e794ed25c69080cecf Author: Tomasz Lis Date: Sat Aug 2 05:10:40 2025 +0200 drm/xe: Block reset while recovering from VF migration Resetting GuC during recovery could interfere with the recovery process. Such reset might be also triggered without justification, due to migration taking time, rather than due to the workload not progressing. Doing GuC reset during the recovery would cause exit of RESFIX state, and therefore continuation of GuC work while fixups are still being applied. To avoid that, reset needs to be blocked during the recovery. This patch blocks the reset during recovery. Reset request in that time range will be stalled, and unblocked only after GuC goes out of RESFIX state. In case a reset procedure already started while the recovery is triggered, there isn't much we can do - we cannot wait for it to finish as it involves waiting for hardware, and we can't be sure at which exact point of the reset procedure the GPU got switched. Therefore, the rare cases where migration happens while reset is in progress, are still dangerous. Resets are not a part of the standard flow, and cause unfinished workloads - that will happen during the reset interrupted by migration as well, so it doesn't diverge that much from what normally happens during such resets. v2: Introduce a new atomic for reset blocking, as we cannot reuse `stopped` atomic (that could lead to losing a workload). v3: Switched atomic functs to ones which include proper barriers Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Reviewed-by: Michal Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-4-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit f1193b864c08213d90e50c20ec3aaf8a413607b6 Author: Tomasz Lis Date: Sat Aug 2 05:10:39 2025 +0200 drm/xe/vf: Pause submissions during RESFIX fixups While applying post-migration fixups to VF, GuC will not respond to any commands. This means submissions have no way of finishing. To avoid acquiring additional resources and then stalling on hardware access, pause the submission work. This will decrease the chance of depleting resources, and speed up the recovery. v2: Commented xe_irq_resume() call v3: Typo fix Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Reviewed-by: Michał Winiarski Link: https://lore.kernel.org/r/20250802031045.1127138-3-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit d47cc89d810d7ec19fbb34331551a3439da99c01 Author: Tomasz Lis Date: Sat Aug 2 05:10:38 2025 +0200 drm/xe/sa: Avoid caching GGTT address within the manager Non-virtualized resources require fixups after SRIOV VF migration. Caching GGTT references rather than re-computing them from the underlying Buffer Object is something we want to avoid, as such code would require additional fixup step and additional locking around all the places where the address is accessed. This change removes the cached GPU address from the Sub-Allocation Manager, and introduces a function which recomputes and returns the address instead. v2: renamed xe_sa_manager_gpu_addr(), added kerneldoc Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250802031045.1127138-2-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit 6e2c8fbc66a002c90bf9aa217ec2ffb52b027154 Author: Dibin Moolakadan Subrahmanian Date: Thu Jul 24 14:09:27 2025 +0530 drm/{i915,xe}/display: Block hpd during suspend It has been observed that during `xe_display_pm_suspend()` execution, an HPD interrupt can still be triggered, resulting in `dig_port_work` being scheduled. The issue arises when this work executes after `xe_display_pm_suspend_late()`, by which time the display is fully suspended. This can lead to errors such as "DC state mismatch", as the dig_port work accesses display resources that are no longer available or powered. To address this, introduce 'intel_encoder_block_all_hpds' and 'intel_encoder_unblock_all_hpds' functions, which iterate over all encoders and block/unblock HPD respectively. These are used to: - Block HPD IRQs before calling 'intel_hpd_cancel_work' in suspend and shutdown - Unblock HPD IRQs after 'intel_hpd_init' in resume This will prevent 'dig_port_work' being scheduled during display suspend. Continuation of previous patch discussion: https://patchwork.freedesktop.org/patch/663964/ Changes in v2: - Add 'intel_encoder_block_all_hpds' to 'xe_display_pm_shutdown'.(Imre Deak) - Add 'intel_hpd_cancel_work' to 'xe_display_fini_early' to cancel any HPD pending work at late driver removal. (Imre Deak) Changes in v3: - Move 'intel_encoder_block_all_hpds' after intel_dp_mst_suspend in 'xe_display_pm_shutdown'.(Imre Deak) Signed-off-by: Dibin Moolakadan Subrahmanian Reviewed-by: Imre Deak Reviewed-by: Maarten Lankhorst Acked-by: Jani Nikula Acked-by: Rodrigo Vivi Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250724083928.2298199-1-dibin.moolakadan.subrahmanian@intel.com commit 0521a868222ffe636bf202b6e9d29292c1e19c62 Author: Simon Richter Date: Sat Aug 2 11:40:36 2025 +0900 Mark xe driver as BROKEN if kernel page size is not 4kB This driver, for the time being, assumes that the kernel page size is 4kB, so it fails on loong64 and aarch64 with 16kB pages, and ppc64el with 64kB pages. Signed-off-by: Simon Richter Reviewed-by: Thomas Hellström Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Thomas Hellström Link: https://lore.kernel.org/r/20250802024152.3021-1-Simon.Richter@hogyros.de commit 1faa0d62a19bb8a4b9022b603472e7127974cb55 Author: Akhilesh Patil Date: Fri Jul 18 21:00:13 2025 +0530 drivers: tee: improve sysfs interface by using sysfs_emit() Replace scnprintf() with sysfs_emit() while formatting buffer that is passed to userspace as per the recommendation in Documentation/filesystems/sysfs.rst. sysfs _show() callbacks should use sysfs_emit() or sysfs_emit_at() while returning values to the userspace. This change does not impact functionality, but aligns with sysfs interface usage guidelines for the tee driver. Signed-off-by: Akhilesh Patil Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 7b4106517fe651fdb4dd3a0c341a68e9c63d85dd Author: Jani Nikula Date: Thu Jul 31 14:12:14 2025 +0300 drm/xe: fix stale comment about unordered_wq usage Display has switched to its own workqueue, no longer using xe->unordered_wq. Reviewed-by: Gustavo Sousa Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250731111214.1130130-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4274a2b75696115f5a5d026a93a3a56f0f99c928 Author: Jani Nikula Date: Thu Jul 31 15:36:16 2025 +0300 drm/xe/compat: stop including i915_utils.h from compat i915_drv.h Expose the places that need i915_utils.h, and include it where needed. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/6338c8524e600e048b56c5484624cfb51ed49d1d.1753965351.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 0cc207494fdce38977c3fc82b6e826ca4d6d6c9f Author: Jani Nikula Date: Thu Jul 31 15:36:15 2025 +0300 drm/xe/compat: remove unused platform macros After refactors, a lot of platform macros have become unused. Remove them before new users have a chance to pop up. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/4507b49ead12c997de4615fa6ec277e666e5226a.1753965351.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 904eef7dd0aecd71f7c3b264439275cb9cdab6af Author: Arun R Murthy Date: Wed Jul 30 16:03:20 2025 +0530 drm/i915/display: Use the recomended min_hblank values Use recommended values as per wa_14021694213 to compare with the calculated value and choose minimum of them. v2: corrected checkpatch warning and retain the restriction for min_hblank (Jani) v3: use calculated value to compare with recomended value and choose minimum of them (Imre) v4: As driver supported min bpc is 8, omit the condition check for bpc6 with ycbcr420. Added a note for the same (Imre) v5: Add a warn for the unexpected case of 6bpc + uhbr + ycbcr420 v6: Reworded the comments and check fo anything < compressed bpp 8(Imre) v7: Fix checkpatch warning. (Ankit) Bspec: 74379 Signed-off-by: Arun R Murthy Reviewed-by: Imre Deak Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250730-min_hblank-v7-1-179360220ced@intel.com commit d9c1b06f3553977c50017e7ab40f8cecf80a30c9 Author: Brigham Campbell Date: Sat Aug 2 13:25:47 2025 -0600 accel/rocket: Fix undeclared const rocket_pm_ops Fix sparse warning regarding an undeclared const rocket_pm_ops, which is used in rocket_drv.c. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508030021.uwdr4P08-lkp@intel.com/ Signed-off-by: Brigham Campbell Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250802-fix-rockchip-npu-build-v1-2-fb0f0dacb3fe@brighamcampbell.com commit 218b15a3e9755c9cae79941b4bec22a4e8ad8758 Author: Brigham Campbell Date: Sat Aug 2 13:25:46 2025 -0600 accel/rocket: Fix Rockchip NPU compilation Replace DRM_GPU_SCHED_STAT_NOMINAL with GPU_DRM_SCHED_STAT_RESET, in accordance with commit 0a5dc1b67ef5 ("drm/sched: Rename DRM_GPU_SCHED_STAT_NOMINAL to DRM_GPU_SCHED_STAT_RESET") Pass extra parameter to drm_sched_job_init, as required by commit 2956554823ce ("drm/sched: Store the drm client_id in drm_sched_fence") Signed-off-by: Brigham Campbell Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250802-fix-rockchip-npu-build-v1-1-fb0f0dacb3fe@brighamcampbell.com commit f3af62b6cee8af9f07012051874af2d2a451f0e5 Author: Tao Chen Date: Wed Jul 23 22:44:42 2025 +0800 bpftool: Add bash completion for token argument This commit updates the bash completion script with the new token argument. $ bpftool token help list show Reviewed-by: Quentin Monnet Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250723144442.1427943-3-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit b7f6400849162b918020c5d10d5b7f378afbf470 Author: Tao Chen Date: Wed Jul 23 22:44:41 2025 +0800 bpftool: Add bpftool-token manpage Add bpftool-token manpage with information and examples of token-related commands. Suggested-by: Quentin Monnet Reviewed-by: Quentin Monnet Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250723144442.1427943-2-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 2d812311c2b28cc9096e29862a957aeb32bfdb76 Author: Tao Chen Date: Wed Jul 23 22:44:40 2025 +0800 bpftool: Add bpf_token show Add `bpftool token show` command to get token info from bpffs in /proc/mounts. Example plain output for `token show`: token_info /sys/fs/bpf/token allowed_cmds: map_create prog_load allowed_maps: allowed_progs: kprobe allowed_attachs: xdp token_info /sys/fs/bpf/token2 allowed_cmds: map_create prog_load allowed_maps: allowed_progs: kprobe allowed_attachs: xdp Example json output for `token show`: [{ "token_info": "/sys/fs/bpf/token", "allowed_cmds": ["map_create", "prog_load"], "allowed_maps": [], "allowed_progs": ["kprobe"], "allowed_attachs": ["xdp"] }, { "token_info": "/sys/fs/bpf/token2", "allowed_cmds": ["map_create", "prog_load"], "allowed_maps": [], "allowed_progs": ["kprobe"], "allowed_attachs": ["xdp"] }] Reviewed-by: Quentin Monnet Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250723144442.1427943-1-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit e56f416c8eb9e7a02610e687232dd8dee30e8060 Merge: a6923c06a3b2e2 78418114178220 Author: Alexei Starovoitov Date: Fri Aug 1 18:00:46 2025 -0700 Merge branch 'task-local-data' Amery Hung says: ==================== Task local data v6 -> v7 - Fix typos and improve the clarity of the cover letter (Emil) - Some variable naming changes to make it less confusing (Emil) - Add retry in tld_obj_init() as bpf_task_storage_get_recur() with BPF_LOCAL_STORAGE_GET_F_CREATE can fail if the task local storage is also being modified by other threads on the same CPU. This can be especially easy to trigger in CI VM that only has two CPUs. Adding bpf_preempt_{disable,enable} around bpf_task_storage_get() does not solve the problem as other threads competing for the percpu counter lock in task local storage may not limit to bpf helpers. Some may be calling bpf_task_storage_free() when threads exit. There is no good max retry under heavy contention. For the 1st selftest in this set, the max retry to guarantee success grows linearly with the thread count. A proposal is to remove the percpu counter by changing locks in bpf_local_storage to rqspinlock. An alternative is to reduce the probability of failure by allowing bpf syscall and struct_ops programs to use bpf_task_storage_get() instead of the _recur version by modifying bpf_prog_check_recur(). This does not solve the problem in tracing programs though. v6: https://lore.kernel.org/bpf/20250717164842.1848817-1-ameryhung@gmail.com/ * Overview * This patchset introduces task local data, an abstract storage type shared between user space and bpf programs for storing data specific to each task, and implements a library to access it. The goal is to provide an abstraction + implementation that is efficient in data sharing and easy to use. The motivating use case is user space hinting with sched_ext. * Motivating use case * CPU schedulers can potentially make a better decision with hints from user space process. To support experimenting user space hinting with sched_ext, there needs a mechanism to pass a "per-task hint" from user space to the bpf scheduler "efficiently". A bpf feature, UPTR [0], supported by task local storage is introduced to serve the needs. It allows pinning a user space page to the kernel through a special field in task local storage map. This patchset further builds an abstraction on top of it to allow user space and bpf programs to easily share per-task data. * Design * Task local data is built on top of task local storage map and UPTR to achieve fast per-task data sharing. UPTR is a type of special field supported in task local storage map value. A user page assigned to a UPTR will be pinned to the kernel when the map is updated. Therefore, user space programs can update data that will be seen by bpf programs without syscalls. Additionally, unlike most bpf maps, task local data does not require a static map value definition. This design is driven by sched_ext, which would like to allow multiple developers to share a storage without the need to explicitly agree on the layout of it. While a centralized layout definition would have worked, the friction of synchronizing it across different repos is not desirable. This simplify code base management and makes experimenting easier. * Introduction to task local data library * Task local data library provides simple APIs for user space and bpf through two header files, task_local_data.h and task_local_data.bpf.h, respectively. The diagram below illustrates the basic usage. First, an entry of data in task local data, we call it a TLD, needs to be defined in the user space through TLD_DEFINE_KEY() with information including the size and the name. The macro will define a global variable key of opaque type tld_key_t associated with the TLD and initialize it. Then, the user space program can locate the TLD by passing the key to tld_get_data() in different thread, where fd is the file descriptor of the underlying task local storage map. The API returns a pointer to the TLD specific to the calling thread and will remain valid until the thread exits. Finally, user space programs can directly read/write the TLD without bpf syscalls. To use task local storage on the bpf side, struct tld_keys, needs to be defined first. The structure that will be used to create tld_key_map should contain the keys to the TLDs used in a bpf program. In the bpf program, tld_init_object() first needs to be called to initialize a struct tld_object variable on the stack. Then, tld_get_data() can be called to get a pointer to the TLD similar to the user space. The API will use the name to lookup task local data and cache the key in task local storage map, tld_key_map, to speed up subsequent access. The size of the TLD is also needed to prevent out-of-bound access in bpf. ┌─ Application ───────────────────────────────────────────────────────┐ │ TLD_DEFINE_KEY(kx, "X", 4); ┌─ library A ─────────────────────┐│ │ │ void func(...) ││ │ int main(...) │ { ││ │ { │ tld_key_t ky; ││ │ int *x; │ bool *y; ││ │ │ ││ │ x = tld_get_data(fd, kx); │ ky = tld_create_key("Y", 1);││ │ if (x) *x = 123; │ y = tld_get_data(fd, ky); ││ │ ┌────────┤ if (y) *y = true; ││ │ │ └─────────────────────────────────┘│ └───────┬─────────────────│───────────────────────────────────────────┘ V V + ─ Task local data ─ ─ ─ ─ ─ + ┌─ BPF program ──────────────────────┐ | ┌─ tld_data_map ──────────┐ | │ struct tld_object obj; │ | │ BPF Task local storage │ | │ bool *y; │ | │ │ | │ int *x; │ | │ tld_data_u __uptr *data │ | │ │ | │ tld_meta_u __uptr *meta │ | │ if (tld_init_object(task, &obj)) │ | └─────────────────────────┘ | │ return 0; │ | ┌─ tld_key_map ───────────┐ | │ │ | │ BPF Task local storage │ | │ x = tld_get_data(&obj, kx, "X", 4);│ | │ │ |<─┤ if (x) /* do something */ │ | │ tld_key_t kx; │ | │ │ | │ tld_key_t ky; │ | │ y = tld_get_data(&obj, ky, "Y", 1);│ | └─────────────────────────┘ | │ if (y) /* do something */ │ + ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ + └────────────────────────────────────┘ * Implementation * Task local data defines the storage to be a task local storage map with two UPTRs pointing to tld_data_u and tld_meta_u. tld_data_u, individual to each thread, contains TLD data and the starting offset of data in a page. tld_meta_u, shared by threads in a process, consists of the TLD counts, total size of TLDs and tld_metadata for each TLD. tld_metadata contains the name and the size of a TLD. struct tld_data_u { u64 start; char data[PAGE_SIZE - sizeof(u64)]; }; struct tld_meta_u { u8 cnt; u16 size; struct metadata metadata[TLD_DATA_CNT]; }; Both user space and bpf API follow the same protocol when accessing task local data. A pointer to a TLD is located using a key. The key is effectively the offset of a TLD in tld_data_u->data. To define a new TLD, the user space API TLD_DEFINE_KEY() iterates tld_meta_u->metadata until an empty slot is found and then update it. It also adds up sizes of prior TLDs to derive the offset (i.e., key). Then, to locate a TLD, tld_get_data() can simply return tld_data_u->data + offset. To locate a TLD in bpf programs, an API with the same name as the user space, tld_get_data() can be called. It takes more effort in the first invocation as it fetches the key by name. Internal helper, __tld_fetch_key() will iterate tld_meta_u->metadata until the name is found. Then, the offset is cached as key in another task local storage map, tld_key_map. When the search fails, the current TLD count is cached instead to skip searching metadata entries that has been searched in future invocation. The detail of task local data operations can be found in patch 1. * Misc * The metadata can potentially use run-length encoding for names to reduce memory wastage and support save more TLDs. I have a version that works, but the selftest takes a bit longer to finish. More investigation needed to find the root cause. I will save this for the future when there is a need to store more than 63 TLDs. [0] https://lore.kernel.org/bpf/20241023234759.860539-1-martin.lau@linux.dev/ --- v5 -> v6 - Address Andrii's comment - Fix verification failure in no_alu32 - Some cleanup v5: https://lore.kernel.org/bpf/20250627233958.2602271-1-ameryhung@gmail.com/ v4 -> v5 - Add an option to free memory on thread exit to prevent memory leak - Add an option to reduce memory waste if the allocator can use just enough memory to fullfill aligned_alloc() (e.g., glibc) - Tweak bpf API - Remove tld_fetch_key() as it does not work in init_tasl - tld_get_data() now tries to fetch key if it is not cached yet - Optimize bpf side tld_get_data() - Faster fast path - Less code - Use stdatomic.h in user space library with seq_cst order - Introduce TLD_DEFINE_KEY() as the default TLD creation API for easier memory management. - TLD_DEFINE_KEY() can consume memory up to a page and no memory is wasted since their size is known before per-thread data allocation. - tld_create_key() can only use up to TLD_DYN_DATA_SIZE. Since tld_create_key can run any time even after per-thread data allocation, it is impossible to predict the total size. A configurable size of memory is allocated on top of the total size of TLD_DEFINE_KEY() to accommodate dynamic key creation. - Add tld prefix to all macros - Replace map_update(NO_EXIST) in __tld_init_data() with cmpxchg() - No more +1,-1 dance on the bpf side - Reduce printf from ASSERT in race test - Try implementing run-length encoding for name and decide to save it for the future v4: https://lore.kernel.org/bpf/20250515211606.2697271-1-ameryhung@gmail.com/ v3 -> v4 - API improvements - Simplify API - Drop string obfuscation - Use opaque type for key - Better documentation - Implementation - Switch to dynamic allocation for per-task data - Now offer as header-only libraries - No TLS map pinning; leave it to users - Drop pthread dependency - Add more invalid tld_create_key() test - Add a race test for tld_create_key() v3: https://lore.kernel.org/bpf/20250425214039.2919818-1-ameryhung@gmail.com/ --- ==================== Link: https://patch.msgid.link/20250730185903.3574598-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 784181141782204f6dbbeadf01780e81da5fcb29 Author: Amery Hung Date: Wed Jul 30 11:58:55 2025 -0700 selftests/bpf: Test concurrent task local data key creation Test thread-safety of tld_create_key(). Since tld_create_key() does not rely on locks but memory barriers and atomic operations to protect the shared metadata, the thread-safety of the function is non-trivial. Make sure concurrent tld_key_create(), both valid and invalid, can not race and corrupt metatada, which may leads to TLDs not being thread- specific or duplicate TLDs with the same name. Signed-off-by: Amery Hung Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20250730185903.3574598-5-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 120f1a950e495d9751fdb5c8b7852d94546dcd03 Author: Amery Hung Date: Wed Jul 30 11:58:54 2025 -0700 selftests/bpf: Test basic task local data operations Test basic operations of task local data with valid and invalid tld_create_key(). For invalid calls, make sure they return the right error code and check that the TLDs are not inserted by running tld_get_data(" value_not_exists") on the bpf side. The call should a null pointer. For valid calls, first make sure the TLDs are created by calling tld_get_data() on the bpf side. The call should return a valid pointer. Finally, verify that the TLDs are indeed task-specific (i.e., their addresses do not overlap) with multiple user threads. This done by writing values unique to each thread, reading them from both user space and bpf, and checking if the value read back matches the value written. Signed-off-by: Amery Hung Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20250730185903.3574598-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 31e838e1cdf4c4088fee8154ce8c12713ebfb2da Author: Amery Hung Date: Wed Jul 30 11:58:53 2025 -0700 selftests/bpf: Introduce task local data Task local data defines an abstract storage type for storing task- specific data (TLD). This patch provides user space and bpf implementation as header-only libraries for accessing task local data. Task local data is a bpf task local storage map with two UPTRs: - tld_meta_u, shared by all tasks of a process, consists of the total count and size of TLDs and an array of metadata of TLDs. A TLD metadata contains the size and name. The name is used to identify a specific TLD in bpf programs. - u_tld_data points to a task-specific memory. It stores TLD data and the starting offset of data in a page. Task local design decouple user space and bpf programs. Since bpf program does not know the size of TLDs in compile time, u_tld_data is declared as a page to accommodate TLDs up to a page. As a result, while user space will likely allocate memory smaller than a page for actual TLDs, it needs to pin a page to kernel. It will pin the page that contains enough memory if the allocated memory spans across the page boundary. The library also creates another task local storage map, tld_key_map, to cache keys for bpf programs to speed up the access. Below are the core task local data API: User space BPF Define TLD TLD_DEFINE_KEY(), tld_create_key() - Init TLD object - tld_object_init() Get TLD data tld_get_data() tld_get_data() - TLD_DEFINE_KEY(), tld_create_key() A TLD is first defined by the user space with TLD_DEFINE_KEY() or tld_create_key(). TLD_DEFINE_KEY() defines a TLD statically and allocates just enough memory during initialization. tld_create_key() allows creating TLDs on the fly, but has a fix memory budget, TLD_DYN_DATA_SIZE. Internally, they all call __tld_create_key(), which iterates tld_meta_u->metadata to check if a TLD can be added. The total TLD size needs to fit into a page (limit of UPTR), and no two TLDs can have the same name. If a TLD can be added, u_tld_meta->cnt is increased using cmpxchg as there may be other concurrent __tld_create_key(). After a successful cmpxchg, the last available tld_meta_u->metadata now belongs to the calling thread. To prevent other threads from reading incomplete metadata while it is being updated, tld_meta_u->metadata->size is used to signal the completion. Finally, the offset, derived from adding up prior TLD sizes is then encapsulated as an opaque object key to prevent user misuse. The offset is guaranteed to be 8-byte aligned to prevent load/store tearing and allow atomic operations on it. - tld_get_data() User space programs can pass the key to tld_get_data() to get a pointer to the associated TLD. The pointer will remain valid for the lifetime of the thread. tld_data_u is lazily allocated on the first call to tld_get_data(). Trying to read task local data from bpf will result in -ENODATA during tld_object_init(). The task-specific memory need to be freed manually by calling tld_free() on thread exit to prevent memory leak or use TLD_FREE_DATA_ON_THREAD_EXIT. - tld_object_init() (BPF) BPF programs need to call tld_object_init() before calling tld_get_data(). This is to avoid redundant map lookup in tld_get_data() by storing pointers to the map values on stack. The pointers are encapsulated as tld_object. tld_key_map is also created on the first time tld_object_init() is called to cache TLD keys successfully fetched by tld_get_data(). bpf_task_storage_get(.., F_CREATE) needs to be retried since it may fail when another thread has already taken the percpu counter lock for the task local storage. - tld_get_data() (BPF) BPF programs can also get a pointer to a TLD with tld_get_data(). It uses the cached key in tld_key_map to locate the data in tld_data_u->data. If the cached key is not set yet (<= 0), __tld_fetch_key() will be called to iterate tld_meta_u->metadata and find the TLD by name. To prevent redundant string comparison in the future when the search fail, the tld_meta_u->cnt is stored in the non-positive range of the key. Next time, __tld_fetch_key() will be called only if there are new TLDs and the search will start from the newly added tld_meta_u->metadata using the old tld_meta_u-cnt. Signed-off-by: Amery Hung Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20250730185903.3574598-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 86de56487e5f0017ffd5930b0dbd9dda43048849 Author: Amery Hung Date: Wed Jul 30 11:58:52 2025 -0700 bpf: Allow syscall bpf programs to call non-recur helpers Allow syscall programs to call non-recur helpers too since syscall bpf programs runs in process context through bpf syscall, BPF_PROG_TEST_RUN, and cannot run recursively. bpf_task_storage_{get,set} have "_recur" versions that call trylock instead of taking the lock directly to avoid deadlock when called by bpf programs that run recursively. Currently, only bpf_lsm, bpf_iter, struct_ops without private stack are allow to call the non-recur helpers since they cannot be recursively called in another bpf program. Signed-off-by: Amery Hung Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20250730185903.3574598-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit f8b99c61a8ac1dc94520fea7d5660ae09a047c9f Author: Colin Ian King Date: Fri Aug 1 17:46:58 2025 +0100 drm/i915/bw: Remove space before newline There is an extraneous space before a newline in a drm_dbg_kms message. Remove the space. Signed-off-by: Colin Ian King Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801164658.2438212-1-colin.i.king@gmail.com Signed-off-by: Rodrigo Vivi commit 9fd9f221440024b7451678898facfb34af054310 Author: Michal Wajdeczko Date: Fri Aug 1 16:28:22 2025 +0200 drm/xe/pf: Don't resume device from restart worker The PF's restart worker shouldn't attempt to resume the device on its own, since its goal is to finish PF and VFs reprovisioning on the recently reset GuC. Take extra RPM reference while scheduling a work and release it from the worker or when we cancel a work. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801142822.180530-4-michal.wajdeczko@intel.com commit c6c86441c465ea440dfb5039f1c26e629a6fd64c Author: Michal Wajdeczko Date: Fri Aug 1 16:28:21 2025 +0200 drm/xe/pf: Make sure PF is ready to configure VFs The PF driver might be resumed just to configure VFs, but since it is doing some asynchronous GuC reconfigurations after fresh reset, we should wait until all pending works are completed. This is especially important in case of LMEM provisioning, since we also need to update the LMTT and send invalidation requests to all GuCs, which are expected to be already in the VGT mode. Fixes: 68ae022278a1 ("drm/xe/pf: Force GuC virtualization mode") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Cc: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801142822.180530-3-michal.wajdeczko@intel.com commit a424353937c24554bb242a6582ed8f018b4a411c Author: Michal Wajdeczko Date: Fri Aug 1 16:28:20 2025 +0200 drm/xe/pf: Disable PF restart worker on device removal We can't let restart worker run once device is removed, since other data that it might want to access could be already released. Explicitly disable worker as part of device cleanup action. Fixes: a4d1c5d0b99b ("drm/xe/pf: Move VFs reprovisioning to worker") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Cc: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801142822.180530-2-michal.wajdeczko@intel.com commit b52f8d7a8f38629e3a9d1d372f2fe43e3a27d6b2 Author: Michal Wajdeczko Date: Fri Aug 1 16:44:18 2025 +0200 drm/xe/pf: Skip LMTT update if no LMEM was provisioned During VF unprovisioning, if VF was not provisioned with LMEM, there is no need to trigger LMTT update, as VF LMTT was never set. This will spare us sending full TLB invalidation requests. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801144418.180584-1-michal.wajdeczko@intel.com commit 1fdc4c381ff765479d76ccf3134717c430c871b8 Author: Balasubramani Vivekanandan Date: Fri Aug 1 10:53:56 2025 +0530 drm/xe/devcoredump: Defer devcoredump initialization during probe Doing devcoredump initializing before GT though look harmless, it leads to problem during driver unbind. Because of this order, GT/Engine release functions will be called before xe devcoredump release function (xe_driver_devcoredump_fini) leading to the following kernel crash[1] because the devcoredump functions might still use GT/Engine datastructures after those are freed. The following crash is observed while running the IGT xe_wedged@wedged-at-any-timeout. The test forces a wedged state by submitting a workload which hangs. Then does a unbind/rebind of the driver to recover from the wedged state. The hanged workload leads to a devcoredump. The following crash is noticed when the devcoredump capture races with the driver unbind. During driver unbind, the release function hw_engine_fini() will be called which assigns NULL to hwe->gt. But the same data structure is accessed during the coredump capture in the function xe_engine_snapshot_print by reading snapshot->hwe->gt. With this patch, we make sure the devcoredump is stopped before deinitializing the core driver functions. [1]: BUG: kernel NULL pointer dereference, address: 0000000000000000 Workqueue: events_unbound xe_devcoredump_deferred_snap_work [xe] RIP: 0010:xe_engine_snapshot_print+0x47/0x420 [xe] Call Trace: ? drm_printf+0x64/0x90 __xe_devcoredump_read+0x23f/0x2d0 [xe] ? __pfx___drm_printfn_coredump+0x10/0x10 ? __pfx___drm_puts_coredump+0x10/0x10 xe_devcoredump_deferred_snap_work+0x17a/0x190 [xe] process_one_work+0x22e/0x6f0 worker_thread+0x1e8/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x11f/0x250 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 v2: Detailed commit description (Rodrigo) v3: FIXME added (Rodrigo, Stuart) Fixes: 4209d635a823 ("drm/xe: Remove devcoredump during driver release") Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731061300.14320-1-balasubramani.vivekanandan@intel.com Signed-off-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250801052356.21885-1-balasubramani.vivekanandan@intel.com Signed-off-by: Rodrigo Vivi commit 7d3a5962d74ee7ce2d0051d4d1e106c06b432ce8 Author: Dan Carpenter Date: Fri Aug 1 16:32:35 2025 +0300 drm/xe/vf: Fix IS_ERR() vs NULL check in xe_sriov_vf_ccs_init() The xe_migrate_alloc() function returns NULL on error. It doesn't return error pointers. Update the checking to match. Fixes: a843b9894705 ("drm/xe/vf: Fix VM crash during VF driver release") Signed-off-by: Dan Carpenter Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/aIzB8-Y6wtZvfNQT@stanley.mountain Signed-off-by: Rodrigo Vivi commit 13a5a04ffd639602a4e705a3d6c38a5989989640 Author: Jani Nikula Date: Thu Jul 31 13:05:14 2025 +0300 drm/i915/dsi: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/1fe3d5ac314dd644573e9f59941e4c7f1d57b05d.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5a37f08d49594b77e3344afaae30e4bca2c1abc6 Author: Jani Nikula Date: Thu Jul 31 13:05:13 2025 +0300 drm/i915/pch: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/67e0afa2c0c5ad39b9108af15d0496394e674518.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6d13a797bb3b0101a17c276644128d57f24d86b1 Author: Jani Nikula Date: Thu Jul 31 13:05:12 2025 +0300 drm/i915/power: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/154b681d9545b26453920b155656a65ce685da2a.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit cc2cce4a8a1fbc5856139b27e1f7138220e395f0 Author: Jani Nikula Date: Thu Jul 31 13:05:11 2025 +0300 drm/i915/cdclk: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/fadd74e9450afff5e32bf921b192f19ea1629fff.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7c8d0cbe9808078063adf7112d2c7f9b836bc73d Author: Jani Nikula Date: Thu Jul 31 13:05:10 2025 +0300 drm/i915/dpll: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/d8c381524d721e01228b76b71080c6e4ccc528e9.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7327b40c644487182969060894b2be952e2c4ab0 Author: Jani Nikula Date: Thu Jul 31 13:05:09 2025 +0300 drm/i915/ddi: use intel_de_wait_custom() instead of wait_for_us() Prefer the register read specific wait function over i915 wait_for_us(). v2: Wait for bits to clear in mtl_ddi_disable_d2d() Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/232a554db6a327974c06f2491311b28f865467b9.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit be001a68f075ec7b697e1c252b6659f3ab2a30de Author: Jani Nikula Date: Thu Jul 31 13:05:08 2025 +0300 drm/i915/hdmi: use intel_de_wait_for_set() instead of wait_for() Prefer the register read specific wait function over i915 wait_for(). Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/c5d3044114b4464799a2fded18cda7946d95c4f6.1753956266.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 82928cc1c2b2be16ea6ee9e23799ca182e1cd37c Author: Aleksandrs Vinarskis Date: Thu Jul 31 23:55:10 2025 +0200 drm/panel-edp: Add BOE NV140WUM-N64 Timings taken from NV140WUM-N41. It is found in some arm64 laptops, eg. Asus Zenbook A14 UX3407QA. The raw edid of the panel is: 00 ff ff ff ff ff ff 00 09 e5 f6 0c 00 00 00 00 10 22 01 04 a5 1e 13 78 07 8e 95 a6 52 4c 9d 26 0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 5d 30 80 a0 70 b0 28 40 30 20 36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fe 00 3d 4c 33 30 20 20 20 20 20 20 20 20 ff 00 00 00 fc 00 4e 56 31 34 30 57 55 4d 2d 4e 36 34 0a 01 f8 70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04 88 66 ea 51 cc 74 9d 66 52 0f 02 35 54 40 5e 40 5e 00 44 12 78 22 00 14 7f 5c 02 85 7f 07 9f 00 2f 00 1f 00 af 04 27 00 02 00 05 00 2b 00 0c 27 00 28 3b 00 00 27 00 28 2f 00 00 2e 00 06 00 44 40 5e 40 5e 81 00 1e 72 1a 00 00 03 71 28 3c 00 00 60 ff 60 ff 3c 00 00 00 00 e3 05 04 00 e6 06 01 01 60 60 ff 00 00 00 00 00 00 00 00 00 de 90 Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731215635.206702-4-alex.vinarskis@gmail.com commit d7c2aad1254a1b4e6d76947cbdd18813b02a0e24 Author: Aleksandrs Vinarskis Date: Thu Jul 31 23:55:09 2025 +0200 dt-bindings: display: panel: samsung,atna40ct06: document ATNA40CT06 The Samsung ATNA40CT06 panel is a 14" AMOLED eDP panel. It is similar to the ATNA33XC20 except that it is larger and has a different resolution. It is found in some arm64 laptops, eg. Asus Zenbook A14 UX3407QA. Raw panel edid: 00 ff ff ff ff ff ff 00 4c 83 0d 42 00 00 00 00 00 22 01 04 b5 1e 13 78 02 0c f1 ae 52 3c b9 23 0c 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 88 00 2e bd 10 00 00 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 00 41 54 4e 41 34 30 43 54 30 36 2d 30 20 01 7d 70 20 79 02 00 20 00 0c 4c 83 00 0d 42 00 00 00 00 00 22 00 21 00 1d ca 0b 5e 07 80 07 b0 04 00 e1 fa 51 cb 13 b9 3d d2 0c 01 45 54 40 5e d0 60 18 10 23 78 26 00 09 07 06 03 00 00 00 50 00 00 22 00 14 8d 5a 02 85 7f 07 9f 00 2f 00 1f 00 af 04 23 00 07 00 07 00 81 00 0b e3 05 80 00 e6 06 05 01 74 60 02 2e 00 06 00 45 40 5e d0 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 90 Acked-by: Krzysztof Kozlowski Signed-off-by: Aleksandrs Vinarskis Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731215635.206702-3-alex.vinarskis@gmail.com commit d680a7959b9d7cce9526b1b391cc7b13e313a096 Author: Aleksandrs Vinarskis Date: Thu Jul 31 23:55:08 2025 +0200 dt-bindings: display: panel: samsung,atna40cu11: document ATNA40CU11 The Samsung ATNA40CU11 panel is a 14" AMOLED eDP panel. It is similar to the ATNA33XC20 except that it is larger and has a different resolution. It is found in some arm64 laptops, eg. Asus Zenbook A14 UX3407RA. Raw panel edid: 00 ff ff ff ff ff ff 00 4c 83 9d 41 00 00 00 00 00 20 01 04 b5 1e 13 78 03 cf d1 ae 51 3e b6 23 0b 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 cb fe 40 64 b0 08 38 77 20 08 88 00 2e bd 10 00 00 1b 00 00 00 fd 00 30 78 da da 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 00 41 54 4e 41 34 30 43 55 31 31 2d 30 20 01 2a 70 20 79 02 00 20 00 0c 4c 83 00 9d 41 00 00 00 00 00 20 00 21 00 1d b8 0b 6c 07 40 0b 08 07 00 ee ea 50 ec d3 b6 3d 42 0b 01 45 54 40 5e d0 60 18 10 23 78 26 00 09 07 06 03 00 00 00 50 00 00 22 00 14 e7 f3 09 85 3f 0b 63 00 1f 00 07 00 07 07 17 00 07 00 07 00 81 00 1f 73 1a 00 00 03 03 30 78 00 a0 74 02 60 02 78 00 00 00 00 8d e3 05 80 00 e6 06 05 01 74 60 02 00 00 00 00 00 91 90 Acked-by: Krzysztof Kozlowski Signed-off-by: Aleksandrs Vinarskis Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731215635.206702-2-alex.vinarskis@gmail.com commit 518867b09394217d13f6e05f704450bd9d2c8eeb Author: Cong Yang Date: Thu Jul 31 18:59:39 2025 +0800 drm/panel-edp: Add edp panels used by mt8189 Chromebooks Add a few generic edp panels used by mt8189 chromebooks, most of them use the same general enable timing 50ms. For BOE-NV116WHM-N4B and BOE-NV116WHM-T01 CMN-N140JCA-ELP the enable timing required 80ms. For CMN-N116BCA-EAK, the enable timing required 200ms and disable timing required 50ms. For CMN-N116BCL-EAK and CMN-N122JCA-ENK the enable timing required 80ms and disable timing required 50ms. For TMA-TL140VDMS03-01, the enable timing required 50ms and the disable timing required 100ms. AUO B122UAN01.0: edid-decode (hex): 00 ff ff ff ff ff ff 00 06 af a4 04 00 00 00 00 31 20 01 04 a5 1a 10 78 03 54 c5 9d 54 55 8f 25 22 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 fa 3c 80 b8 70 b0 24 40 10 10 3e 00 06 a4 10 00 00 18 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 41 55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 42 31 32 32 55 41 4e 30 31 2e 30 20 0a 01 7c AUO B116XAK02.0: edid-decode (hex): 00 ff ff ff ff ff ff 00 06 af b0 52 00 00 00 00 2e 21 01 04 95 1a 0e 78 03 5b 35 9f 59 55 8e 26 25 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 5d 1c 56 a0 50 00 19 30 30 20 46 00 00 90 10 00 00 18 00 00 00 fd 00 28 3c 30 30 07 01 0a 20 20 20 20 20 20 00 00 00 fe 00 41 55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 42 31 31 36 58 41 4b 30 32 2e 30 20 0a 00 bd AUO B140UAN08.5: edid-decode (hex): 00 ff ff ff ff ff ff 00 06 af ba 8b 00 00 00 00 10 23 01 04 a5 1e 13 78 03 7c f2 90 57 59 93 29 1d 51 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 26 3d 80 b8 70 b0 28 40 10 10 3e 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 41 55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fc 00 42 31 34 30 55 41 4e 30 38 2e 35 20 0a 01 29 70 20 79 02 00 22 00 14 7b 63 02 85 7f 07 b7 00 0f 80 0f 00 af 04 27 00 02 00 0d 00 25 01 09 7b 63 02 7b 63 02 28 3c 80 2b 00 0c 27 00 28 3b 00 00 27 00 28 3b 00 00 81 00 15 74 1a 00 00 03 01 28 3c 00 00 60 51 60 51 3c 00 00 00 00 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 90 AUO B140UAX01.2: edid-decode (hex): 00 ff ff ff ff ff ff 00 06 af ba cd 00 00 00 00 32 23 01 04 a5 1e 13 78 02 ca 31 9b 5c 58 8d 26 21 4f 52 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 60 3f 80 a0 70 b0 64 40 30 20 96 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4e 4e 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 41 55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fc 00 42 31 34 30 55 41 58 30 31 2e 32 20 0a 00 46 BOE NV116WHM-N4B: edid-decode (hex): 00 ff ff ff ff ff ff 00 09 e5 45 0d 00 00 00 00 1f 22 01 04 95 1a 0e 78 03 0b 55 9a 5f 58 95 28 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 09 1e 56 dc 50 00 28 30 30 20 36 00 00 90 10 00 00 1a 00 00 00 fd 00 28 3c 30 30 08 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fc 00 4e 56 31 31 36 57 48 4d 2d 4e 34 42 0a 01 c1 70 20 79 02 00 81 00 15 74 1a 00 00 03 01 28 3c 00 00 4b 51 4b 51 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 90 BOE NV116WHM-T01: edid-decode (hex): 00 ff ff ff ff ff ff 00 09 e5 df 0d 00 00 00 00 01 1c 01 04 95 1a 0e 78 0a 81 15 96 59 5a 9a 29 1f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 6b 1b 56 64 50 00 1e 30 26 18 44 00 00 90 10 00 00 1a ef 15 56 64 50 00 1e 30 26 18 44 00 00 90 10 00 00 00 00 00 00 fe 00 42 4f 45 20 48 46 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 56 31 31 36 57 48 32 2d 4d 30 30 0a 00 83 CMN N116BCL-EAK: edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 5f 11 00 00 00 00 08 22 01 04 95 1a 0e 78 03 46 a5 9c 5b 53 8b 24 1d 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e6 1e 56 e2 50 00 3c 30 30 20 a6 00 00 90 10 00 00 1a 00 00 00 fd 00 28 3c 32 32 08 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 4e 31 31 36 42 43 4c 2d 45 41 4b 0a 20 01 9b 70 20 79 02 00 25 01 09 fc 34 01 fc 34 01 28 3c 80 81 00 10 72 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 90 CMN N122JCA-ENK: edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 4c 12 00 00 00 00 11 20 01 04 a5 1a 10 78 03 0a f5 9e 5c 52 8b 24 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 a6 00 06 a4 10 00 00 18 00 00 00 fd 00 28 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 4e 31 32 32 4a 43 41 2d 45 4e 4b 0a 20 00 fd CMN N140JCA-ELP: edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae a8 14 00 00 00 00 1d 23 01 04 a5 1e 13 78 03 28 65 97 59 54 8e 27 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 a6 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 00 4e 31 34 30 4a 43 41 2d 45 4c 50 0a 20 01 c2 70 20 79 02 00 25 01 09 94 5a 02 94 5a 02 28 3c 80 81 00 15 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 90 CMN N116BCA-EAK: edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 02 74 00 00 00 00 2a 22 01 04 95 1a 0e 78 03 67 75 98 59 53 90 27 1c 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 da 1d 56 e2 50 00 20 30 30 20 a6 00 04 8c 10 00 00 1a 00 00 00 fd 00 28 3c 30 30 08 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 4e 31 31 36 42 43 41 2d 45 41 4b 0a 20 00 ba CSW MNE007QS5-2: edid-decode (hex): 00 ff ff ff ff ff ff 00 0e 77 62 14 00 00 00 00 10 23 01 04 a5 1e 13 78 03 1c 2e 93 5f 58 95 28 1f 4f 58 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ea 3d 80 c8 70 b0 2e 40 30 20 36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 53 4f 54 20 54 39 0a 20 20 20 20 20 00 00 00 fc 00 4d 4e 45 30 30 37 51 53 35 2d 32 0a 20 01 8e 70 20 79 02 00 81 00 15 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d 90 CSW MNE007QB2-2: edid-decode (hex): 00 ff ff ff ff ff ff 00 0e 77 68 14 00 00 00 00 00 23 01 04 a5 1e 13 78 03 90 e0 90 5e 59 86 25 14 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 fc 00 4d 4e 46 33 30 37 51 42 32 2d 32 0a 20 00 00 00 fe 00 43 53 4f 54 20 54 33 0a 20 20 20 20 20 00 9a TMA TM140VDXP01-04: edid-decode (hex): 00 ff ff ff ff ff ff 00 51 a1 11 08 00 00 00 00 1a 22 01 04 a5 1e 13 78 03 83 3d 98 5b 57 8d 28 1f 4e 53 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 6d 3d 80 a0 70 b0 3c 40 30 20 36 00 2d bc 10 00 00 1a 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd 00 28 3c 4c 4c 10 01 0a 20 20 20 20 20 20 00 00 00 fc 00 54 4d 31 34 30 56 44 58 50 30 31 0a 20 01 f7 70 20 79 02 00 25 00 09 41 66 02 41 66 02 28 3c 80 81 00 14 73 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ae 90 TMA TL140VDMS03-01: edid-decode (hex): 00 ff ff ff ff ff ff 00 51 a1 94 20 00 00 00 00 0b 23 01 04 a5 1e 13 78 03 47 5a 9e 53 5e 8b 28 23 54 53 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 03 3e 80 a0 70 b0 48 40 30 20 66 0c 2e bd 10 00 00 1e 00 00 00 fd 00 28 3c 4d 4d 10 01 0a 20 20 20 20 20 20 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 00 54 4c 31 34 30 56 44 4d 53 30 33 0a 20 01 9c 70 20 79 02 00 20 00 0c 00 00 00 94 20 00 00 00 00 0b 19 00 21 00 1d c8 0b 5d 07 80 07 b0 04 00 48 c9 55 48 a5 90 7b 42 21 02 45 54 00 00 00 00 00 00 12 78 26 00 09 02 00 00 00 00 00 01 00 00 2b 00 06 04 00 28 3b 00 00 81 00 14 73 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ae 90 Signed-off-by: Cong Yang Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250731105939.2692654-1-yangcong5@huaqin.corp-partner.google.com commit 934452cbb16e1e3609ba52acb48c503b9aaf3154 Author: Robert Mader Date: Fri Jul 18 14:14:42 2025 +0200 drm/vkms: Add writeback encoders as possible clones Since commit 41b4b11da0215 ("drm: Add valid clones check") setting the `possible_clones` values is a hard requirement for cloning. `vkms` supports cloning for writeback connectors in order to capture CRTC content, however that broke with said commit. Writeback connectors are created on a per-CRTC basis, thus mark every non-writeback connector that is compatible with a given CRTC as possible clone - and vice-versa. Using a default configuration, the corresponding `drm_info` output changes from: ├───Encoders │ ├───Encoder 0 │ │ ├───Object ID: 40 │ │ ├───Type: virtual │ │ ├───CRTCS: {0} │ │ └───Clones: {0} │ └───Encoder 1 │ ├───Object ID: 41 │ ├───Type: virtual │ ├───CRTCS: {0} │ └───Clones: {1} into: ├───Encoders │ ├───Encoder 0 │ │ ├───Object ID: 44 │ │ ├───Type: virtual │ │ ├───CRTCS: {0} │ │ └───Clones: {0, 1} │ └───Encoder 1 │ ├───Object ID: 50 │ ├───Type: virtual │ ├───CRTCS: {0} │ └───Clones: {0, 1} Fixes: dbd9d80c1b2e ("drm/vkms: Add support for writeback") Signed-off-by: Robert Mader Reviewed-by: Louis Chauvet Link: https://lore.kernel.org/r/20250718121442.490634-1-robert.mader@collabora.com [fixed Fixes line and changed to: to into: to avoid checkpatch warnings] Signed-off-by: Louis Chauvet commit 1cda3c755bb7770be07d75949bb0f45fb88651f6 Author: Maarten Lankhorst Date: Tue Jul 15 17:20:58 2025 +0200 drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options enabled. The panic happens after core_hotunplug unbind-rebind finishes. Presumably what happens is that a process mmaps, unlocks because of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left, causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since there was nothing left to populate, and then oopses in "mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource is NULL. It's convoluted, but fits the data and explains the oops after the test exits. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250715152057.23254-2-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 55023abe6a2921a8916b623c24208e1971b88729 Author: Svyatoslav Ryhel Date: Wed Jul 30 08:54:24 2025 +0300 drm: bridge: Add support for Solomon SSD2825 RGB/DSI bridge SSD2825 is a cost-effective MIPI Bridge Chip solution targeting mainly smartphones. It can convert 24bit RGB interface into 4-lane MIPI-DSI interface to drive display modules of up to 800 x 1366, while supporting AMOLED, a-si LCD or LTPS panel technologies for smartphone applications. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250730055424.6718-3-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit 784c99331c8d54a51d4f3e772c81f7fb82b7a1f8 Author: Svyatoslav Ryhel Date: Wed Jul 30 08:54:23 2025 +0300 dt-bindings: display: bridge: Document Solomon SSD2825 Add bindings for Solomon SSD2825 MIPI master bridge chip that connects an application processor with traditional parallel LCD interface and an LCD driver with MIPI slave interface. The SSD2825 supports both parallel RGB interface and serial SPI interface. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250730055424.6718-2-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit 552dbba1caaf0cb40ce961806d757615e26ec668 Author: Lukasz Laguna Date: Tue Jul 29 14:34:37 2025 +0200 drm/xe/vf: Disable CSC support on VF CSC is not accessible by VF drivers, so disable its support flag on VF to prevent further initialization attempts. Fixes: e02cea83d32d ("drm/xe/gsc: add Battlemage support") Signed-off-by: Lukasz Laguna Cc: Alexander Usyskin Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250729123437.5933-1-lukasz.laguna@intel.com commit 82dde0407ab126f8413fd6c51429e5057ced5ba2 Author: Vinod Govindapillai Date: Tue Jul 29 15:46:48 2025 +0300 drm/i915/fbc: fix the implementation of wa_18038517565 As per the wa_18038517565, we need to disable FBC compressor clock gating before enabling FBC and enable after disabling FBC. Placing the enabling of clock gating in the fbc deactivate function can make the above wa logic go wrong in case of frontbuffer rendering FBC mechanism. FBC deactivate can get called during fb invalidate and then the corresponding FBC activate can get called without properly disabling the clock gating and can result in compression stalled. So move the enable clock gating at the end of one FBC session after FBC is completely disabled for a pipe. Bspec: 74212, 72197, 69741, 65555 Fixes: 010363c46189 ("drm/i915/display: implement wa_18038517565") Signed-off-by: Vinod Govindapillai Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250729124648.288497-1-vinod.govindapillai@intel.com commit a843b9894705d5d171e97f167fc5290f6a3ecaee Author: Satyanarayana K V P Date: Tue Jul 29 17:37:20 2025 +0530 drm/xe/vf: Fix VM crash during VF driver release The VF CCS save/restore series (patchwork #149108) has a dependency on the migration framework. A recent migration update in commit d65ff1ec8535 ("drm/xe: Split xe_migrate allocation from initialization") caused a VM crash during XE driver release for iGPU devices. Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b83: 0000 [#1] SMP NOPTI RIP: 0010:xe_lrc_ring_head+0x12/0xb0 [xe] Call Trace: xe_sriov_vf_ccs_fini+0x1e/0x40 [xe] devm_action_release+0x12/0x30 release_nodes+0x3a/0x120 devres_release_all+0x96/0xd0 device_unbind_cleanup+0x12/0x80 device_release_driver_internal+0x23a/0x280 device_release_driver+0x12/0x20 pci_stop_bus_device+0x69/0x90 pci_stop_and_remove_bus_device+0x12/0x30 pci_iov_remove_virtfn+0xbd/0x130 sriov_disable+0x42/0x100 pci_disable_sriov+0x34/0x50 xe_pci_sriov_configure+0xf71/0x1020 [xe] Update the VF CCS migration initialization sequence to align with the new migration framework changes, resolving the release-time crash. Fixes: f3009272ff2e ("drm/xe/vf: Create contexts for CCS read write") Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Matthew Auld Cc: Piotr Piórkowski Reviewed-by: Piotr Piórkowski Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250729120720.13990-1-satyanarayana.k.v.p@intel.com commit b0c9bfbab925ac6385d4d06a134fd89cadf771fe Author: Johannes Nixdorf Date: Fri Jul 25 18:31:19 2025 +0200 selftests/seccomp: Add a test for the WAIT_KILLABLE_RECV fast reply race If WAIT_KILLABLE_RECV was specified, and an event is received, the tracee's syscall is not supposed to be interruptible. This was not properly ensured if the reply was sent too fast, and an interrupting signal was received before the reply was processed on the tracee side. Add a test for this, that consists of: - a tracee with a timer that keeps sending it signals while repeatedly running a traced syscall in a loop, - a tracer that repeatedly handles all syscalls from the tracee in a loop, and - a shared pipe between both, on which the tracee sends one byte per syscall attempted and the tracer reads one byte per syscall handled. If the syscall for the tracee is restarted after the tracer received the event for it due to this bug, the tracee will not have sent a second token on the pipe, which the tracer will notice and fail the test. The tests also uses SECCOMP_IOCTL_NOTIF_ADDFD with SECCOMP_ADDFD_FLAG_SEND for the reply, as the fix for the bug has an additional code path change for handling addfd, which would not be exercised by a simple SECCOMP_IOCTL_NOTIF_SEND, and it is possible to fix the bug while leaving the same race intact for the addfd case. This test is not guaranteed to reproduce the bug on every run, but the parameters (signal frequency and number of repeated syscalls) have been chosen so that on my machine this test: - takes ~0.8s in the good case (+1s in the failure case), and - detects the bug in 999 of 1000 runs. Signed-off-by: Johannes Nixdorf Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-2-cf8b9d139596@nixdorf.dev Signed-off-by: Kees Cook commit cce436aafc2abad691fdd37de63ec8a4490b42ce Author: Johannes Nixdorf Date: Fri Jul 25 18:31:18 2025 +0200 seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an event to the tracer, and starts to wait interruptibly. With SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting and is subsequently interrupted, the tracee begins to wait again uninterruptibly (but killable). This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a condition to begin waiting again. In this case the tracee is interrupted even though the tracer already acted on its behalf. This breaks the assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, namely that the tracer can be sure the syscall is not interrupted or restarted on the tracee after it is received on the tracer. Fix this by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to switch to uninterruptible waiting. With the condition changed the loop in seccomp_do_user_notification() would exit immediately after deciding that noninterruptible waiting is required if the operation already reached SECCOMP_NOTIFY_REPLIED, skipping the code that processes pending addfd commands first. Prevent this by executing the remaining loop body one last time in this case. Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") Reported-by: Ali Polatel Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 Signed-off-by: Johannes Nixdorf Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev Signed-off-by: Kees Cook commit 85c23f28905cf20a86ceec3cfd7a0a5572c9eb13 Author: Brigham Campbell Date: Mon Jul 21 19:53:11 2025 -0600 drm: docs: Update task from drm TODO list Update TODO item from drm documentation to contain more applicable information regarding the removal of deprecated MIPI DSI functions and no longer reference functions which have already been removed from the kernel. Reviewed-by: Douglas Anderson Signed-off-by: Brigham Campbell Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250722015313.561966-5-me@brighamcampbell.com commit 79b6bb18f849818140dd351f6e76a097efe99e9f Author: Brigham Campbell Date: Mon Jul 21 19:53:10 2025 -0600 drm: Remove unused MIPI write seq and chatty functions Remove the deprecated mipi_dsi_generic_write_seq() and mipi_dsi_generic_write_chatty() functions now that they are no longer used. Reviewed-by: Douglas Anderson Signed-off-by: Brigham Campbell Reviewed-by: Dmitry Baryshkov Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250722015313.561966-4-me@brighamcampbell.com commit a6adf47d30cccaf3c1936ac9de94948c140e17dd Author: Brigham Campbell Date: Mon Jul 21 19:53:09 2025 -0600 drm/panel: jdi-lpm102a188a: Fix bug and clean up driver Fix bug in unprepare() which causes the function's return value to be that of the last mipi "enter sleep mode" command. Update driver to use the "multi" variant of MIPI functions in order to facilitate improved error handling and remove the panel's dependency on deprecated MIPI functions. Use the new mipi_dsi_dual macro to reduce code duplication. Reviewed-by: Douglas Anderson Reviewed-by: Diogo Ivo Tested-by: Diogo Ivo Signed-off-by: Brigham Campbell Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250722015313.561966-3-me@brighamcampbell.com commit d94a2a00d2b8878678607c2969fee3b4e59126cb Author: Brigham Campbell Date: Mon Jul 21 19:53:08 2025 -0600 drm: Create mipi_dsi_dual* macros Create mipi_dsi_dual, mipi_dsi_dual_dcs_write_seq_multi, and mipi_dsi_dual_generic_write_seq_multi macros for panels which are driven by two parallel serial interfaces. This allows for the reduction of code duplication in drivers for these panels. Remove mipi_dsi_dual_dcs_write_seq_multi definition from panel-novatek-nt36523.c to avoid the duplicate definition. Make novatek driver pass mipi_dsi_context struct as a pointer. Reviewed-by: Dmitry Baryshkov Signed-off-by: Brigham Campbell Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250722015313.561966-2-me@brighamcampbell.com commit d6a0311c37b0955d3b2e15137f40c65c9aeb8f20 Author: Michal Wajdeczko Date: Fri Jul 25 11:05:08 2025 +0200 drm/xe/hw_engine_group: Don't use drm_warn to catch missed case Since hwe->class is an enumeration we can rely on the compiler to catch any unhandled engine class case at compile time thanks to [-Werror=switch]. Any unexpected use of a special CLASS_MAX enum case can be guarded by our xe_gt_assert() instead, which will be compiled-out on the production builds. Signed-off-by: Michal Wajdeczko Cc: Francois Dugast Cc: Matthew Brost Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250725090508.571-1-michal.wajdeczko@intel.com commit b116bd3ad3a7b9ee3144ab70497b25b915b904c3 Author: Jani Nikula Date: Mon Jul 28 13:21:13 2025 +0300 drm/i915/display: remove superfluous includes Commit f7a9dc796567 ("drm/i915/scaler: Use intel_display as argument to skl_scaler_max_src_size") added superfluous includes. Remove them. Cc: Suraj Kandpal Cc: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250728102113.238730-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4df0bd5eb497c59e14924452026d6d70505706b5 Author: Priyanka Dandamudi Date: Mon Jul 28 10:03:36 2025 +0530 drm/xe/uapi: Add documentation for DRM_XE_GEM_CREATE_FLAG_DEFER_BACKING Add documentation for drm_xe_gem_create structure flag DRM_XE_GEM_CREATE_FLAG_DEFER_BACKING. v2: Modified to be in a more generalised way. Signed-off-by: Priyanka Dandamudi Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20250728043336.3319521-1-priyanka.dandamudi@intel.com Signed-off-by: Tejas Upadhyay commit 45fbb51050e72723c2bdcedc1ce32305256c70ed Author: John Harrison Date: Fri Jul 25 19:43:37 2025 -0700 drm/xe/guc: Add more GuC load error status codes The GuC load process will abort if certain status codes (which are indicative of a fatal error) are reported. Otherwise, it keeps waiting until the 'success' code is returned. New error codes have been added in recent GuC releases, so add support for aborting on those as well. v2: Shuffle HWCONFIG_START to the front of the switch to keep the ordering as per the enum define for clarity (review feedback by Jonathan). Also add a description for the basic 'invalid init data' code which was missing. Signed-off-by: John Harrison Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250726024337.4056272-1-John.C.Harrison@Intel.com commit 9f1f7cd467358e27205af0076e2f7b435a588893 Author: Yann Dirson Date: Sun Jul 20 16:13:17 2025 +0200 drm/amdgpu: fix module parameter description Fix dcdebugmask description. Signed-off-by: Yann Dirson Signed-off-by: Alex Deucher commit c2aa3089ad7e7fec3ec4a58d8d0904b5e9b392a1 Author: Yann Dirson Date: Sun Jul 20 16:13:16 2025 +0200 Documentation/amdgpu: fix 'in the amdgfx' formulation Clarify the mailing list. Signed-off-by: Yann Dirson Signed-off-by: Alex Deucher commit 216e4cff54c8719b2aed2f60833e1e84e041c574 Author: Amber Lin Date: Thu Jul 17 11:39:58 2025 -0400 drm/amdgpu: Add chain runlists support to GC9.4.2 Starting from MEC v97, GC 9.4.2 supports chain runlists of XNACK+/XNACK- processes. Signed-off-by: Amber Lin Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit c5fc24f126786dddcfdb87ac24afbecb1e4dd30d Author: Taimur Hassan Date: Fri Jul 18 19:26:12 2025 -0500 drm/amd/display: Promote DAL to 3.2.343 Summary: * Fix caching streams for LT automation * Fix DMUB command alignment * Disabling DSC power gating on DCN314 * Add debugfs for Replay * Add debug option for BW allocation mode * Removal of unnecessary includes for faster compilation * Refactor of code, including adding SPDX license to amdgpu_dm Acked-by: Sun peng (Leo) Li Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f5b69101f956f5b89605a13cb15f093a7906f2a1 Author: Michael Strauss Date: Thu Jul 17 16:18:58 2025 -0400 drm/amd/display: Cache streams targeting link when performing LT automation [WHY] Last LT automation update can cause crash by referencing current_state and calling into dc_update_planes_and_stream which may clobber current_state. [HOW] Cache relevant stream pointers and iterate through them instead of relying on the current_state. Reviewed-by: Wenjing Liu Signed-off-by: Michael Strauss Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 327aba7f558187e451636c77a1662a2858438dc9 Author: Ovidiu Bunea Date: Tue Jul 15 17:26:39 2025 -0400 drm/amd/display: Fix dmub_cmd header alignment [why & how] Header misalignment in struct dmub_cmd_replay_copy_settings_data and struct dmub_alpm_auxless_data causes incorrect data read between driver and dmub. Fix the misalignment and ensure that everything is aligned to 4-byte boundaries. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 640cd296f5877d20db9d4fbf6441eee114c1cb97 Author: Ray Wu Date: Wed Jun 11 14:02:25 2025 +0800 drm/amd/display: Add Replay residency in debugfs [Why] Users can access the replay residency to get PHY off percentage [How] Start capture residency: sudo echo 1 /sys/kernel/debug/dri/0/eDP-1/replay_residency Stop and Get replay residency: sudo cat /sys/kernel/debug/dri/0/eDP-1/replay_residency Reviewed-by: ChiaHsuan (Tom) Chung Signed-off-by: Ray Wu Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e3419e1e44b87d4176fb98679a77301b1ca40f63 Author: Michael Strauss Date: Wed Mar 19 18:04:01 2025 -0400 drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration [WHY] In the worst case, AUX intra-hop done can take hundreds of milliseconds as each retimer in a link might have to wait a full AUX_RD_INTERVAL to send LT abort downstream. [HOW] Wait 300ms for each retimer in a link to allow time to propagate a LT abort without infinitely waiting on intra-hop done. For no-retimer case, keep the max duration at 10ms. Reviewed-by: Wenjing Liu Signed-off-by: Michael Strauss Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9a885f1193efa4802504624b2df3aa5eaaa44a56 Author: Cruise Hung Date: Tue Jul 15 16:36:44 2025 +0800 drm/amd/display: Add debug option to control BW Allocation mode [Why & How] Add debug option to control BW Allocation mode. Reviewed-by: Meenakshikumar Somasundaram Reviewed-by: PeiChen (Pei-Chen) Huang Signed-off-by: Cruise Hung Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 7af124772fcf8422a55efa3a4d64484835db3beb Author: Relja Vojvodic Date: Mon Jul 14 11:56:50 2025 -0400 drm/amd/display: Allow for sharing of some link and audio link functions [Why&How] Allow for sharing of some link and audio link functions by removing static keyword from function definitions. Expose those functions in the HWSEQ header. Reviewed-by: Alvin Lee Signed-off-by: Relja Vojvodic Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9571dbaf98c8cb09ec1fa9721d94043b3ab7e740 Author: Chiang, Richard Date: Tue Jul 15 21:59:54 2025 +0800 drm/amd/display: Remove update_planes_and_stream_v1 sequence [Why]/How] Remove the update_planes_and_stream_v1 sequence to make the logic the same. Reviewed-by: Charlene Liu Signed-off-by: Chiang, Richard Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0352e5fab959208b9aba6c9c1020e813b8346472 Author: Mario Limonciello Date: Wed Jul 16 15:53:43 2025 -0500 drm/amd/display: Rename dcn31 string shown to user [Why] DCN31 isn't a product, but DCN312 is. Matching against documentation users might not understand the code. [How] Change DCN 3.1 string to be DCN 3.1.2. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fa7cad4901931f0280a12f0bb375eda0294c6200 Author: Duncan Ma Date: Wed Dec 4 12:35:05 2024 -0500 drm/amd/display: Add eDP AUXless ALPM [Why & How] Add AUX-less ALPM capability check and initialization Reviewed-by: Charlene Liu Signed-off-by: Duncan Ma Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 048bd938342835dd50363186cdb6f270a20f7aae Author: Mario Limonciello Date: Fri Jun 27 16:53:39 2025 -0500 drm/amd/display: Remove unnecessary includes [Why] Extra includes aren't needed for compilation and can slow down the preprocessor. [How] Drop unneeded includes. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 29a5adc5e14c5f8682b0276ef44847f47f5fdf5e Author: Mario Limonciello Date: Fri Jun 27 16:55:03 2025 -0500 drm/amd/display: Remove unnecessary whitespace [Why] Whitespace before a new line is unnecessary. [How] Remove whitespace. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c491b1a2569e74ee57640494cc1ead2fa4072070 Author: Mario Limonciello Date: Sun Jul 6 09:55:58 2025 -0500 drm/amd/display: Drop unused include [Why] Extra includes slow down compile time. [How] Drop unnecessary include. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2efe08a1a98bc797f12242beab9a3e3cc351d0b3 Author: Mario Limonciello Date: Fri Jun 27 16:58:26 2025 -0500 drm/amd/display: Add missing SPDX license identifier [Why] All files should be properly classified. [How] Add missing SPDX-License-Identifier. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b86cba11889ec4b784bfffc0a9424e1aa5eea56b Author: Ovidiu Bunea Date: Thu Jul 17 10:41:41 2025 -0400 drm/amd/display: Revert "Add a config flag for limited_pll_vco" This reverts commit 82139760dcf7829ae2ca3f70442be9b53a0aff40. [why & how] DMUB header changes should be submitted to firmware branch first and allowed to propagate to driver. Currently, this change breaks linux builds so need to revert it until it's ready. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 82139760dcf7829ae2ca3f70442be9b53a0aff40 Author: Jingwen Zhu Date: Mon Jul 14 16:18:19 2025 +0800 drm/amd/display: Add a config flag for limited_pll_vco [Why/How] Added a new config flag to pass to the DMUB during boot. This workaround will solves black screen issue on reboot. Reviewed-by: Hansen Dsouza Signed-off-by: Jingwen Zhu Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414 Author: Michael Strauss Date: Wed Feb 12 14:08:08 2025 -0500 drm/amd/display: Move setup_stream_attribute [WHY] If symclk RCO is enabled, stream encoder may not be receiving an ungated clock by the time we attempt to set stream attributes when setting dpms on. Since the clock is gated, register writes to the stream encoder fail. [HOW] Move set_stream_attribute call into enable_stream, just after the point where symclk32_se is ungated. Logically there is no need to set stream attributes as early as is currently done in link_set_dpms_on, so this should have no impact beyond the RCO fix. Reviewed-by: Ovidiu (Ovi) Bunea Signed-off-by: Michael Strauss Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 72b4aabdf1b0dd1096b55251e09ffe865e2e4877 Author: Alvin Lee Date: Fri Jul 11 15:23:35 2025 -0400 drm/amd/display: Add comma to last entry of enum for consistency [Why&How] Add comma to last entry of enum for consistency. Reviewed-by: Jun Lei Signed-off-by: Alvin Lee Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d0e164f72e6a16e64f660023dc7ad25b31b8b08d Author: Cruise Hung Date: Wed Jul 9 19:04:31 2025 +0800 drm/amd/display: Remove check DPIA HPD status for BW Allocation [Why & How] Link hpd_status is for embedded DPIA only. Do not check hpd_status for BW allocation logic. Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Cruise Hung Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 04112dce53fc52438c8a1fb2b5ac779b6daeca5e Author: Karthi Kandasamy Date: Thu Jun 26 15:10:01 2025 +0200 drm/amd/display: Add DC EDID read policy struct [Why & How] Add a struct to allow DMs that utilize the EDID parser in DC to modify the default settings. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Karthi Kandasamy Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1cf1205ef2685cf43db3785706b017d1e54e0bec Author: Srinivasan Shanmugam Date: Thu Jul 24 13:02:18 2025 +0530 drm/amd/display: Reduce Stack Usage by moving 'audio_output' into 'stream_res' v4 The function `dp_retrain_link_dp_test` currently allocates a large audio_output array on the stack, causing the stack frame size to exceed the compiler limit (1080 bytes > 1024 bytes). This change prevents stack overflow issues: amdgpu/../display/dc/link/accessories/link_dp_cts.c:65:13: warning: stack frame size (1080) exceeds limit (1024) in 'dp_retrain_link_dp_test' [-Wframe-larger-than] static void dp_retrain_link_dp_test(struct dc_link *link, v2: Move audio-related data like `audio_output` is kept "per pipe" to manage the audio for that specific display pipeline/display output path (stream). (Wenjing) v3: Update in all the places where `build_audio_output` is currently called with a separate audio_output variable on the stack & wherever `audio_output` is passed to other functions `dce110_apply_single_controller_ctx_to_hw()` & `dce110_setup_audio_dto()` (like `az_configure`, `wall_dto_setup`) replace with usage of `pipe_ctx->stream_res.audio_output` to centralize audio data per pipe. v4: Remove empty lines before `build_audio_output`. (Alex) Fixes: 9c6669c2e21a ("drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO") Cc: Wayne Lin Cc: George Shen Cc: Michael Strauss Cc: Alvin Lee Cc: Ray Wu Cc: Wenjing Liu Cc: Harry Wentland Cc: Tom Chung Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Wenjing Liu Signed-off-by: Alex Deucher commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325 Author: Lijo Lazar Date: Fri Jul 25 10:21:10 2025 +0530 drm/amdgpu: Update external revid for GC v9.5.0 Use different external revid for GC v9.5.0 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 3fc96f60b61cebf8649f557b5134795fbdb00e12 Author: YiPeng Chai Date: Tue Jul 22 14:17:29 2025 +0800 drm/amdgpu: add critical address check for bad page retirement Add critical address check for bad page retirement. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit faab5ea0836733ef1c8e83cf6b05690a5c9066be Author: Sathishkumar S Date: Sun Jul 13 01:28:02 2025 +0530 drm/amdgpu: Check vcn sram load return value Log an error when vcn sram load fails in indirect mode and return the same error value. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 9d1ac25c7f830e0132aa816393b1e9f140e71148 Author: Lijo Lazar Date: Tue Jul 8 13:17:18 2025 +0530 drm/amdgpu: Update supported modes for GC v9.5.0 For GC v9.5.0 SOCs, both CPX and QPX compute modes are also supported in NPS2 mode. Signed-off-by: Lijo Lazar Acked-by: Mangesh Gadre Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit f3486918979030f8982e1af901561dbd6e2cd1bc Author: YiPeng Chai Date: Thu Jul 24 15:34:29 2025 +0800 drm/amdgpu: support ras critical address check Support ras critical address check. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d45c5e6845a76169ef3d6076f0f04487e5776905 Author: Tao Zhou Date: Fri Jul 4 17:12:24 2025 +0800 drm/amdgpu: adjust the update of RAS bad page number One eeprom record may not map to unit number of bad pages, the accurate bad page number is gotten after bad page address check. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2b17c240e8cd9ac61d3c82277fbed27edad7f002 Author: Tao Zhou Date: Wed Jul 2 16:16:02 2025 +0800 drm/amdgpu: add range check for RAS bad page address Exclude invalid bad pages. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit a813437c33842c4e28a0656a9d8f20c3a8d35d6d Author: YiPeng Chai Date: Wed Jul 16 11:16:20 2025 +0800 drm/amdgpu: add command to check address validity Add command to check address validity and remove unused command codes. v2: The command interface adds new parameters to support multiple check address strategies. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 020ad3a4ed62e5e8d97db27008c1e470f91bfd8d Author: YiPeng Chai Date: Thu Jul 10 13:51:57 2025 +0800 drm/amdgpu: query the allocated vram address block info The bad pages that need to be retired are not all allocated in the same poison consumption process, so an interface is needed to query the processes that allocate the bad pages. By killing all the processes that allocate the bad pages, the bad pages can be reserved immediately. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit def57ea33fb79d72c9bd3a4216f2bb77e768d7ca Author: Taimur Hassan Date: Sun Jul 13 12:42:07 2025 -0500 drm/amd/display: Promote DAL to 3.2.342 This version brings along following fixes: - Fix divide by zero when calculating min ODM factor - Ensure committing streams is seamless when transitioning between topologies - Fix condition for setting timing_adjust_pending - Update DMUB tiled to tiled copy command Acked-by: Tom Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9dd3146ff7c126f03b784116b5c3581977f3acd1 Author: Taimur Hassan Date: Sun Jul 13 11:28:43 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.19.0 Update DMUB related command structure. Acked-by: Tom Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 34c9cd82dc62641b9038815ebc1a397f24d5a6e2 Author: Mario Limonciello Date: Wed Jun 25 10:23:13 2025 -0500 drm/amd/display: Drop unnecessary 'rc' variable in amdgpu_dm_backlight_get_level() [Why] amdgpu_dm_backlight_get_level() returns a boolean value but is assigned to a variable named 'rc' which is generally used for return codes. This can be confusing while looking at the code for other issues. [How] Drop the variable and just look directly at the return value of amdgpu_dm_backlight_get_level() in the if statement. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ca74cc428f2b9d0170c56b473dbcfd7fa01daf2d Author: Clay King Date: Mon Jul 7 13:21:30 2025 -0400 drm/amd/display: ensure committing streams is seamless [Why] When transitioning between topologies such as multi-display to single display ODM 2:1, pipes might not be freed before use. [How] In dc_commit_streams, commit an additional, minimal transition if original transition is not seamless to ensure pipes are freed. Reviewed-by: Alvin Lee Signed-off-by: Clay King Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 92f68f6a1b297633159a3f3759e4dfc7e5b58abb Author: Gabe Teeger Date: Wed Jul 9 14:12:22 2025 -0400 drm/amd/display: Revert Add HPO encoder support to Replay This reverts commits: commit 1f26214d268b ("drm/amd/display: Add HPO encoder support to Replay") commit 3bfce48b109f ("drm/amd/display: Add support for Panel Replay on DP1 eDP (panel_inst=1)") due to visual confirm issue. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Gabe Teeger Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1a6a3374ecb9899ccf0d209b5783a796bdba8cec Author: Aurabindo Pillai Date: Wed Jun 25 10:11:22 2025 -0400 drm/amd/display: fix condition for setting timing_adjust_pending timing_adjust_pending is used to defer certain programming sequences when OTG timing is about to be changed, like with VRR. Insufficient checking for timing change in this case caused a regression which reduces PSR Replay residency. Reviewed-by: Tom Chung Signed-off-by: Aurabindo Pillai Signed-off-by: Robin Chen Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 19f76f2390be5abe8d5ed986780b73564ba2baca Author: Ostrowski Rafal Date: Tue Jun 24 14:13:53 2025 +0200 drm/amd/display: Update tiled to tiled copy command [Why & How] Tiled command rect dimensions is 1 based, do rect_x/y - 1 internally Reviewed-by: Alvin Lee Signed-off-by: Ostrowski Rafal Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit eff8d30ac842fb118abc425c262424d75a658f95 Author: Taimur Hassan Date: Wed Jul 9 14:31:41 2025 -0500 drm/amd/display: Promote DAL to 3.2.341 This version brings along following fixes: - Fixes for DCN401, DCN32 - Initial support of SmartMux - Improvements for Replay, IPS, and IPS2 - Refactor of DSC Reviewed-by: Martin Leung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3f92c7b329ef3685af8c0c19dba7566d7414fd77 Author: Taimur Hassan Date: Mon Jul 7 12:38:00 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.18.0 Add new mode in struct ips_residency_mode Acked-by: Tom Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 33f8f321e7aa7715ce19560801ee5223ba8b9a7d Author: Colin Ian King Date: Mon Jun 23 23:35:26 2025 +0100 drm/vmwgfx: fix missing assignment to ts The assignment to ts is missing on the call to ktime_to_timespec64. Fix this by adding the missing assignment. Fixes: db6a94b26354 ("drm/vmwgfx: Implement dma_fence_ops properly") Signed-off-by: Colin Ian King Reviewed-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250623223526.281398-1-colin.i.king@gmail.com commit 6c57634d734ac8b8f6fdadb58964ea2b010e5307 Author: Suraj Kandpal Date: Thu Jul 24 15:59:54 2025 +0530 drm/i915/vblank: Change log from err to debug Let Potential update error just be a log instead of a big error we already have Atomic Update error log which shouts out if something really goes wrong. --v2 -Fix typo in commit message [Mitul] Signed-off-by: Suraj Kandpal Reviewed-by: Mitul Golani Link: https://lore.kernel.org/r/20250724102954.2573715-1-suraj.kandpal@intel.com commit 1ffcf8b8ae8a786b61350ee082b6c82846a31e53 Author: Ilia Levi Date: Mon Jul 14 15:26:58 2025 +0300 drm/xe: Support for mmap-ing mmio regions Allow the driver to expose hardware register spaces to userspace through GEM objects with fake mmap offsets. This can be useful for userspace-firmware communication, debugging, etc. v2: Minor doc fix (CI) v3: Enforce MAP_SHARED (Tejas) Add fault handler with dummy page (Tejas, Matt Auld) Store physical address instead of xe_mmio in the GEM object (MattB) v4: Separate xe_mmio_gem from xe_mmio and make it private (MattB) Signed-off-by: Ilia Levi Reviewed-by: Matthew Brost Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250714122658.1803-1-ilia.levi@intel.com Signed-off-by: Lucas De Marchi commit a7352c849492a30b5d8491fcb9314ab376a3942f Author: Tomeu Vizoso Date: Mon Jul 21 11:17:33 2025 +0200 dt-bindings: npu: rockchip,rknn: Add bindings Add the bindings for the Neural Processing Unit IP from Rockchip. v2: - Adapt to new node structure (one node per core, each with its own IOMMU) - Several misc. fixes from Sebastian Reichel v3: - Split register block in its constituent subblocks, and only require the ones that the kernel would ever use (Nicolas Frattaroli) - Group supplies (Rob Herring) - Explain the way in which the top core is special (Rob Herring) v4: - Change required node name to npu@ (Rob Herring and Krzysztof Kozlowski) - Remove unneeded items: (Krzysztof Kozlowski) - Fix use of minItems/maxItems (Krzysztof Kozlowski) - Add reg-names to list of required properties (Krzysztof Kozlowski) - Fix example (Krzysztof Kozlowski) v5: - Rename file to rockchip,rk3588-rknn-core.yaml (Krzysztof Kozlowski) - Streamline compatible property (Krzysztof Kozlowski) v6: - Remove mention to NVDLA, as the hardware is only incidentally related (Kever Yang) - Mark pclk and npu clocks as required by all clocks (Rob Herring) v7: - Remove allOf section, not needed now that all nodes require 4 clocks (Heiko Stübner) v8: - Remove notion of top core (Robin Murphy) Signed-off-by: Sebastian Reichel Reviewed-by: Krzysztof Kozlowski Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Reviewed-by: Rob Herring (Arm) Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-6-77ebd484941e@tomeuvizoso.net commit 525ad89dd90434d529b76a87b1c653a69fedc416 Author: Tomeu Vizoso Date: Mon Jul 21 11:17:32 2025 +0200 accel/rocket: Add IOCTLs for synchronizing memory accesses The NPU cores have their own access to the memory bus, and this isn't cache coherent with the CPUs. Add IOCTLs so userspace can mark when the caches need to be flushed, and also when a writer job needs to be waited for before the buffer can be accessed from the CPU. Initially based on the same IOCTLs from the Etnaviv driver. v2: - Don't break UABI by reordering the IOCTL IDs (Jeff Hugo) v3: - Check that padding fields in IOCTLs are zero (Jeff Hugo) v6: - Fix conversion logic to make sure we use DMA_BIDIRECTIONAL when needed (Lucas Stach) v8: - Always sync BOs in both directions (Robin Murphy) Reviewed-by: Jeff Hugo Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-5-77ebd484941e@tomeuvizoso.net commit 0810d5ad88a18f1e6d549853a388ad0316f74e36 Author: Tomeu Vizoso Date: Mon Jul 21 11:17:31 2025 +0200 accel/rocket: Add job submission IOCTL Using the DRM GPU scheduler infrastructure, with a scheduler for each core. Userspace can decide for a series of tasks to be executed sequentially in the same core, so SRAM locality can be taken advantage of. The job submission code was initially based on Panfrost. v2: - Remove hardcoded number of cores - Misc. style fixes (Jeffrey Hugo) - Repack IOCTL struct (Jeffrey Hugo) v3: - Adapt to a split of the register block in the DT bindings (Nicolas Frattaroli) - Make use of GPL-2.0-only for the copyright notice (Jeff Hugo) - Use drm_* logging functions (Thomas Zimmermann) - Rename reg i/o macros (Thomas Zimmermann) - Add padding to ioctls and check for zero (Jeff Hugo) - Improve error handling (Nicolas Frattaroli) v6: - Use mutexes guard (Markus Elfring) - Use u64_to_user_ptr (Jeff Hugo) - Drop rocket_fence (Rob Herring) v7: - Assign its own IOMMU domain to each client, for isolation (Daniel Stone and Robin Murphy) v8: - Use reset lines to reset the cores (Robin Murphy) - Use the macros to compute the values for the bitfields (Robin Murphy) - More descriptive name for the IRQ (Robin Murphy) - Simplify job interrupt handing (Robin Murphy) - Correctly acquire a reference to the IOMMU (Robin Murphy) - Specify the size of the embedded structs in the IOCTLs for future extensibility (Rob Herring) - Expose only 32 bits for the address of the regcmd BO (Robin Murphy) Tested-by: Heiko Stuebner Reviewed-by: Jeff Hugo Signed-off-by: Tomeu Vizoso Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-4-77ebd484941e@tomeuvizoso.net commit 658ebeac33517bd3169d4b65ed801e9065d0211a Author: Tomeu Vizoso Date: Mon Jul 21 11:17:30 2025 +0200 accel/rocket: Add IOCTL for BO creation This uses the SHMEM DRM helpers and we map right away to the CPU and NPU sides, as all buffers are expected to be accessed from both. v2: - Sync the IOMMUs for the other cores when mapping and unmapping. v3: - Make use of GPL-2.0-only for the copyright notice (Jeff Hugo) v6: - Use mutexes guard (Markus Elfring) v7: - Assign its own IOMMU domain to each client, for isolation (Daniel Stone and Robin Murphy) v8: - Correctly acquire a reference to the IOMMU (Robin Murphy) - Allocate DMA address ourselves with drm_mm (Robin Murphy) - Use refcount_read (Heiko Stuebner) - Remove superfluous dma_sync_sgtable_for_device (Robin Murphy) Reviewed-by: Jeffrey Hugo Tested-by: Heiko Stuebner Signed-off-by: Tomeu Vizoso Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-3-77ebd484941e@tomeuvizoso.net commit ed98261b41687323ffa02ca20fef1e60b38fd1aa Author: Tomeu Vizoso Date: Mon Jul 21 11:17:29 2025 +0200 accel/rocket: Add a new driver for Rockchip's NPU This initial version supports the NPU as shipped in the RK3588 SoC and described in the first part of its TRM, in Chapter 36. This NPU contains 3 independent cores that the driver can submit jobs to. This commit adds just hardware initialization and power management. v2: - Split cores and IOMMUs as independent devices (Sebastian Reichel) - Add some documentation (Jeffrey Hugo) - Be more explicit in the Kconfig documentation (Jeffrey Hugo) - Remove resets, as these haven't been found useful so far (Zenghui Yu) - Repack structs (Jeffrey Hugo) - Use DEFINE_DRM_ACCEL_FOPS (Jeffrey Hugo) - Use devm_drm_dev_alloc (Jeffrey Hugo) - Use probe log helper (Jeffrey Hugo) - Introduce UABI header in a later patch (Jeffrey Hugo) v3: - Adapt to a split of the register block in the DT bindings (Nicolas Frattaroli) - Move registers header to its own commit (Thomas Zimmermann) - Misc. cleanups (Thomas Zimmermann and Jeff Hugo) - Make use of GPL-2.0-only for the copyright notice (Jeff Hugo) - PM improvements (Nicolas Frattaroli) v4: - Use bulk clk API (Krzysztof Kozlowski) v6: - Remove mention to NVDLA, as the hardware is only incidentally related (Kever Yang) - Use calloc instead of GFP_ZERO (Jeff Hugo) - Explicitly include linux/container_of.h (Jeff Hugo) - pclk and npu clocks are now needed by all cores (Rob Herring) v7: - Assign its own IOMMU domain to each client, for isolation (Daniel Stone and Robin Murphy) v8: - Kconfig: fix depends to be more explicit about Rockchip, and remove superfluous selects (Robin Murphy) - Use reset lines to reset the cores (Robin Murphy) - Reference count the module - Set dma_set_max_seg_size - Correctly acquire a reference to the IOMMU (Robin Murphy) - Remove notion of top core (Robin Murphy) Reviewed-by: Robert Foss Tested-by: Heiko Stuebner Reviewed-by: Jeff Hugo Signed-off-by: Tomeu Vizoso Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-2-77ebd484941e@tomeuvizoso.net commit 5fc2bfddb0ae6c6ebd5e690014abf551c6b29bfd Author: Tomeu Vizoso Date: Mon Jul 21 11:17:28 2025 +0200 accel/rocket: Add registers header A XML file was generated with the data from the TRM, and then this header was generated from it. The canonical location for the XML file is the Mesa3D repository. v3: - Make use of GPL-2.0-only for the copyright notice (Jeff Hugo) v8: - Remove full MIT license blob, to match other files with the same licensing arrangement in the kernel Reviewed-by: Robert Foss Tested-by: Heiko Stuebner Reviewed-by: Jeff Hugo Signed-off-by: Tomeu Vizoso Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721-6-10-rocket-v9-1-77ebd484941e@tomeuvizoso.net commit ca33cd271ef9b27acddf96742eef136d0f4caaa5 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:53 2025 +0100 drm/xe/xelp: Add Wa_18022495364 Add Wa_18022495364 as a context workaround batch buffer workaround. Signed-off-by: Tvrtko Ursulin Reviewed-by: Lucas De Marchi Cc: Matt Roper Link: https://lore.kernel.org/r/20250711160153.49833-9-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit e8372edec948318934c71542e939d1a8fb8fabcf Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:52 2025 +0100 drm/xe/xelp: Implement Wa_16010904313 Add XeLP workaround 16010904313. The description calls for it to be emitted as the indirect context buffer workaround for render and compute, and from the workaround batch buffer for the other engines. Therefore we plug into the previously added respective top level emission functions. The actual command streamer programming sequence differs from what is described in the PRM, in that it assumes the listed LRCA offset was supposed to actually refer to the location of the CTX_TIMESTAMP register instead of LRCA + 0x180c (which is in GPR space). Latter appears to make more sense under the assumption that multiple writes are helping with restoring the CTX_TIMESTAMP register content from the saved context state. Signed-off-by: Tvrtko Ursulin Reviewed-by: Lucas De Marchi Cc: Matt Roper Link: https://lore.kernel.org/r/20250711160153.49833-8-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit c79291f7332465e0651afd07020ebc19eda78ed4 Author: Carl Vanderlip Date: Mon Jul 21 15:08:10 2025 -0700 MAINTAINERS: Update email address for Carl Vanderlip Qualcomm is changing open source email address policy. LKML and other busy mailing lists use the oss.qualcomm.com domain. Signed-off-by: Carl Vanderlip Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250721220811.962509-1-carl.vanderlip@oss.qualcomm.com commit 4af5de27d3a9ba19b7f61ac2fa0d6d35ee876c95 Author: Gustavo Sousa Date: Thu Jul 17 17:59:15 2025 -0300 drm/i915/display: Remove unused declarations of intel_io_* Declarations for both intel_io_mmio_fw_write and intel_io_reg_write were added with commit 01389846f7d6 ("drm/i915: Plumb 'dsb' all way to the plane hooks"), but they never got used. Let's remove them. Cc: Ville Syrjälä Signed-off-by: Gustavo Sousa Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250717-drop-unused-intel_io-declarations-v1-1-bdea2c749571@intel.com Signed-off-by: Lucas De Marchi commit c143db7dba1d3a4edce36c89c50e54dd856d7c41 Author: Imre Deak Date: Thu Jul 24 21:29:00 2025 +0300 drm/i915/dp: Fix disabling training pattern at end of UHBR link training The Fixed: commit below overlooked the fact that intel_dp_link_train_all_phys() is only used for non-UHBR link rates, but intel_dp_stop_link_train() is used for both non-UHBR and UHBR link rates. Hence, after removing the disabling of the training pattern from intel_dp_stop_link_train(), the commit missed adding this back to the end of UHBR link training in intel_dp_128b132b_link_train(). This left the sink in link training mode at the end of an UHBR rate link training. Fix things by disabling the training pattern at the end of UHBR link training as well. Cc: Ville Syrjälä Fixes: 11fab5a2a1ad ("drm/i915/dp: Clear DPCD training pattern before transmitting the idle pattern") Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250724182900.160891-1-imre.deak@intel.com commit 9b807f0bb0d0f4b029e56dd2daa4a5e6d87fab61 Author: Michal Wajdeczko Date: Tue Jul 22 16:10:56 2025 +0200 drm/xe/configfs: Use pci_name() for lookup There is no need to manually build PCI device name from BDF data, since it was already prepared and assigned and can be accessed by calling pci_name() function. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250722141059.30707-4-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 400a6da1e967c4f117e4757412df06dcfaea0e6a Author: Michal Wajdeczko Date: Tue Jul 22 16:10:55 2025 +0200 drm/xe/configfs: Enforce canonical device names While we expect config directory names to match PCI device name, currently we are only scanning provided names for domain, bus, device and function numbers, without checking their format. This would pass slightly broken entries like: /sys/kernel/config/xe/ ├── 0000:00:02.0000000000000 │   └── ... ├── 0000:00:02.0x │   └── ... ├── 0: 0: 2. 0 │   └── ... └── 0:0:2.0 └── ... To avoid such mistakes, check if the name provided exactly matches the canonical PCI device address format, which we recreated from the parsed BDF data. Also simplify scanf format as it can't really catch all formatting errors. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250722141059.30707-3-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 0bdd05c2a82bbf2419415d012fd4f5faeca7f1af Author: Michal Wajdeczko Date: Tue Jul 22 16:10:54 2025 +0200 drm/xe/configfs: Fix pci_dev reference leak We are using pci_get_domain_bus_and_slot() function to verify if the given config directory name matches any existing PCI device, but we missed to call matching pci_dev_put() to release reference. While around, also change error code in case of no device match, to make it more specific than generic formatting error. Fixes: 16280ded45fb ("drm/xe: Add configfs to enable survivability mode") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250722141059.30707-2-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 16d2a92e7ec8c7828069f86a0aa7974acafb7e57 Author: Imre Deak Date: Thu Jul 24 12:02:37 2025 +0300 drm/i915: Fix selecting CONFIG_DRM_KUNIT_TEST in debug builds Selecting an option which depends on other options only works if the dependencies are guaranteed to be selected (as these dependencies will not be automatically selected). CONFIG_DRM_KUNIT_TEST depends on DRM, MMU and KUNIT the first two of which are guaranteed to be selected for i915, but the last one is not. Hence, selecting CONFIG_DRM_KUNIT_TEST in i915 debug builds may result in CONFIG_DRM_KUNIT_TEST being selected without the CONFIG_KUNIT dependency being selected. This causes at least the following compile error: drivers/gpu/drm/tests/drm_bridge_test.c: In function ‘drm_test_bridge_alloc_init’: drivers/gpu/drm/tests/drm_bridge_test.c:449:21: error: implicit declaration of function ‘kunit_device_register’; did you mean ‘root_device_register’? [-Werror=implicit-function-declaration] 449 | priv->dev = kunit_device_register(test, "drm-bridge-dev"); Fix the above by selecting CONFIG_DRM_KUNIT_TEST only if CONFIG_KUNIT is also selected. Fixes: 17133255a322 ("drm/i915: replace DRM_DEBUG_SELFTEST with DRM_KUNIT_TEST") Cc: Ruben Wauters Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250724090237.92040-1-imre.deak@intel.com commit f98de826b418885a21ece67f0f5b921ae759b7bf Author: Shuicheng Lin Date: Thu Jul 24 19:38:55 2025 +0000 drm/xe/hw_engine_group: Avoid call kfree() for drmm_kzalloc() Memory allocated with drmm_kzalloc() should not be freed using kfree(), as it is managed by the DRM subsystem. The memory will be automatically freed when the associated drm_device is released. These 3 group pointers are allocated using drmm_kzalloc() in hw_engine_group_alloc(), so they don't require manual deallocation. Fixes: 67979060740f ("drm/xe/hw_engine_group: Fix potential leak") Cc: Michal Wajdeczko Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250724193854.1124510-2-shuicheng.lin@intel.com commit 51330ba66caa29c1a73408fada7f824b36b3238f Author: Matthew Brost Date: Thu Jul 24 12:12:16 2025 -0700 drm/xe: Remove unused GT TLB invalidation trace points Remove unused GT TLB invalidation trace points after converting to used GT TLB invalidation jobs. The trace points removed were used during early bring up of unstable driver, with a stable driver no need to replace with new tracepoints. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-8-matthew.brost@intel.com commit b8d5779eee382003b26b1a147071adf08c5d294c Author: Matthew Brost Date: Thu Jul 24 12:12:15 2025 -0700 drm/xe: Use GT TLB invalidation jobs in PT layer Rather than open-coding GT TLB invalidations in the PT layer, use GT TLB invalidation jobs. The real benefit is that GT TLB invalidation jobs use a single dma-fence context, allowing the generated fences to be squashed in dma-resv/DRM scheduler. v2: - s/;;/; (checkpatch) - Move ijob/mjob job push after range fence install v3: - Remove extra newline (Stuart) - Set ijob/mjob near creation (Stuart) - Add comment back in (Stuart) Suggested-by: Thomas Hellström Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-7-matthew.brost@intel.com commit dba89840a920ffcab7a722299510f89d7800d79b Author: Matthew Brost Date: Thu Jul 24 12:12:14 2025 -0700 drm/xe: Add GT TLB invalidation jobs Add GT TLB invalidation jobs which issue GT TLB invalidations. Built on top of Xe generic dependency scheduler. v2: - Fix checkpatch v3: - Fix kernel doc in xe_gt_tlb_inval_job_alloc_dep, xe_gt_tlb_inval_job_push - Use IS_ERR_OR_NULL in xe_gt_tlb_inval_job_put - Squash migrate lock / unlock helpers into this patch (Stuart) Suggested-by: Thomas Hellström Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-6-matthew.brost@intel.com commit 535c445eb94c9abce3350aa61424fc34b8138ee8 Author: Matthew Brost Date: Thu Jul 24 12:12:13 2025 -0700 drm/xe: Add dependency scheduler for GT TLB invalidations to bind queues Add a generic dependency scheduler for GT TLB invalidations, used to schedule jobs that issue GT TLB invalidations to bind queues. v2: - Use shared GT TLB invalidation queue for dep scheduler - Break allocation of dep scheduler into its own function - Add define for max number tlb invalidations - Skip media if not present Suggested-by: Thomas Hellström Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-5-matthew.brost@intel.com commit ada51219489f53f9f35833c3d0d8a4fe3f4c5705 Author: Matthew Brost Date: Thu Jul 24 12:12:12 2025 -0700 drm/xe: Create ordered workqueue for GT TLB invalidation jobs No sense to schedule GT TLB invalidation jobs in parallel which target the same GT given these all contend on the same lock, create ordered workqueue for GT TLB invalidation jobs. v3: - Fix type in commmit message (Stuart) Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-4-matthew.brost@intel.com commit 69f187d446c94f66d413819f16e2725b7c31f378 Author: Matthew Brost Date: Thu Jul 24 12:12:11 2025 -0700 drm/xe: Add generic dependecy jobs / scheduler Add generic dependecy jobs / scheduler which serves as wrapper for DRM scheduler. Useful when we want delay a generic operation until a dma-fence signals. Existing use cases could be destroying of resources based fences / dma-resv, the preempt rebind worker, and pipelined GT TLB invalidations. Written in such a way it could be moved to DRM subsystem if needed. v3: - Remove unnecessary cast (Staurt) Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-3-matthew.brost@intel.com commit c3ead4ecfc4c02806aa1c202a595ee3ecb2c039a Author: Matthew Brost Date: Thu Jul 24 12:12:10 2025 -0700 drm/xe: Explicitly mark migration queues with flag Rather than inferring if an exec queue is a migration queue for a flag, explicitly mark migration queues with a flag. Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250724191216.4076566-2-matthew.brost@intel.com commit d72779c29d82c6e371cea8b427550bd6923c2577 Author: Sk Anirban Date: Wed Jul 16 15:46:23 2025 +0530 drm/xe/ptl: Apply Wa_16026007364 As part of this WA GuC will save and restore value of two XE3_Media control registers that were not included in the HW power context. Signed-off-by: Sk Anirban Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250716101622.3421480-2-sk.anirban@intel.com Signed-off-by: Lucas De Marchi commit a98cdd979c2b529363be502cb057aea79e65fbf7 Author: Tvrtko Ursulin Date: Thu Jul 24 14:16:58 2025 +0100 drm/xe: Use emit_flush_imm_ggtt helper instead of open coding Helper is already there so lets just use it. Signed-off-by: Tvrtko Ursulin Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250724131711.74291-2-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit a313d9059f00adefdadc6c5612c104bbd78a4808 Author: Nitin Gote Date: Wed Jul 23 19:40:39 2025 +0530 drm/xe: Rename MCFG_MCR_SELECTOR to STEER_SEMAPHORE The register at offset 0xfd0 was incorrectly named MCFG_MCR_SELECTOR, likely copied from i915. According to the hardware specification (Bspec), this register is actually called STEER_SEMAPHORE. Rename the register definition and update its usage in xe_gt_mcr.c to match the official hardware documentation. No functional changes. v2: Add Bspec reference (Tejas) Bspec: 67113 Signed-off-by: Nitin Gote Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250723141039.3848390-1-nitin.r.gote@intel.com Signed-off-by: Lucas De Marchi commit c8bdf3165fccadac12d670e94ea4a9a893a5a813 Author: Sebastian Brzezinka Date: Fri Jul 18 10:28:19 2025 +0000 drm/i915: Replace empty conditional with continue in eb_relocate_vma() Simplifies the control flow by replacing an empty `if (likely(offset == 0))` block with a `continue` statement. This improves readability and avoids unnecessary nesting. Signed-off-by: Sebastian Brzezinka Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250718102752.684975-4-sebastian.brzezinka@intel.com commit bf91bac3ef027852b3e7698af6a00e4df124072c Author: Sebastian Brzezinka Date: Fri Jul 18 10:28:04 2025 +0000 drm/i915: Add braces around the else block in clflush_write32() According to the kernel coding style, if only one branch of a conditional statement is a single statement, braces should still be used in both branches. Signed-off-by: Sebastian Brzezinka Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250718102752.684975-2-sebastian.brzezinka@intel.com commit 159afd92bae8153bdd8d8b34aea0d463fe19c978 Author: Michal Wajdeczko Date: Wed Jul 23 19:56:39 2025 +0200 drm/xe/guc: Clear whole g2h_fence during initialization The struct g2h_fence must be explicitly initializated using the g2h_fence_init() function to avoid trash values in its members, but we missed to update this helper function with the new member. To fix that and avoid any future mistakes, memset the whole struct first, then update remaining non-zero members. Fixes: 94de94d24ea8 ("drm/xe/guc: Cancel ongoing H2G requests when stopping CT") Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Cc: Lukasz Laguna Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250723175639.206875-1-michal.wajdeczko@intel.com commit 538b27a09af974f2c5e7d358a24af7a722fa4bfc Author: Michal Wajdeczko Date: Wed Jul 23 15:30:15 2025 +0200 drm/xe: Make GGTT TLB invalidation failure message GT oriented GGTT TLB invalidation is performed on the specific GT, thus any failure message shall be also GT specific. And to help investigate any unexpected failures, promote message from warn level to WARN to get full call stack of this unlikely case. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250723133015.206601-1-michal.wajdeczko@intel.com commit e48123c607a0db8b9ad02f83c8c3d39918dbda06 Author: Chia-I Wu Date: Thu Jul 17 23:38:16 2025 -0700 panthor: dump task pid and comm on gpu errors It is useful to know which tasks cause gpu errors. Signed-off-by: Chia-I Wu Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250718063816.1452123-4-olvaffe@gmail.com commit 33b9cb6dcda2520600ac4fec725946af32c2e586 Author: Chia-I Wu Date: Thu Jul 17 23:38:15 2025 -0700 panthor: save task pid and comm in panthor_group We would like to report them on gpu errors. We choose to save the info on panthor_group_create rather than on panthor_open because, when the two differ, we are more interested in the task that created the group. Signed-off-by: Chia-I Wu Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250718063816.1452123-3-olvaffe@gmail.com commit 78ededb610138ede03c35232f1d5cd0251a6a469 Author: Chia-I Wu Date: Thu Jul 17 23:38:14 2025 -0700 panthor: set owner field for driver fops It allows us to get rid of manual try_module_get / module_put. Signed-off-by: Chia-I Wu Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250718063816.1452123-2-olvaffe@gmail.com commit 6983ea9cd720fdd409b4944caf9605731323bb8d Author: Michal Wajdeczko Date: Tue Jul 22 20:26:18 2025 +0200 drm/xe: Enable SR-IOV for TGL While we don't have official CI SR-IOV coverage for the Tigerlake platforms, we were using this platform for the feature enabling and Xe driver already has all required changes to support it. Since TGL platforms are guarded by the xe.require_force_probe flag enable SR-IOV feature on them, like we recently did for ADL/ATSM. Suggested-by: Lucas De Marchi Signed-off-by: Michal Wajdeczko Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250722182618.30811-5-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 2e761039985271a69bf6eada8f236701f8594638 Author: Michal Wajdeczko Date: Tue Jul 22 20:26:17 2025 +0200 drm/xe: Enable SR-IOV for ADL/ATSM We were already testing those two platforms for a while on our CI, but enabling flag (has_sriov) was only available on the topic branch and only for builds with CONFIG_DRM_XE_DEBUG config. Since those two platforms are guarded by the another enabling flag (require_force_probe) and we believe our SR-IOV support for them is at sufficient level to start enjoying the feature, turn on the SR-IOV enabling flag unconditionally. Suggested-by: Lucas De Marchi Signed-off-by: Michal Wajdeczko Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250722182618.30811-4-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit a2b461bd6f3b36bded0a74178dec0e58e4714d3d Author: Michal Wajdeczko Date: Tue Jul 22 20:26:16 2025 +0200 drm/xe/pf: Enable SR-IOV PF mode by default We already claim official support for SR-IOV PF/VF modes on PTL and BMG platforms, but by default we start the Xe driver on those platforms in non-virtualized mode (native) since we still have max_vfs modparam set to disable creation of the VFs. It's time to let the Xe driver support SR-IOV PF mode by default. We were already testing this on our CI, which was relying on the patch that was enabling it for CONFIG_DRM_XE_DEBUG used by our CI. Signed-off-by: Michal Wajdeczko Cc: Thomas Hellstrom Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250722182618.30811-3-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi commit 1511d3c4d2bb30f784924a877f3cef518bb73077 Author: Langyan Ye Date: Wed Jul 23 15:25:13 2025 +0800 drm/panel-edp: Add 50ms disable delay for four panels Add 50ms disable delay for NV116WHM-N49, NV122WUM-N41, and MNC207QS1-1 to satisfy T9+T10 timing. Add 50ms disable delay for MNE007JA1-2 as well, since MNE007JA1-2 copies the timing of MNC207QS1-1. Specifically, it should be noted that the MNE007JA1-2 panel was added by someone who did not have the panel documentation, so they simply copied the timing from the MNC207QS1-1 panel. Adding an extra 50 ms of delay should be safe. Fixes: 0547692ac146 ("drm/panel-edp: Add several generic edp panels") Fixes: 50625eab3972 ("drm/edp-panel: Add panel used by T14s Gen6 Snapdragon") Signed-off-by: Langyan Ye Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250723072513.2880369-1-yelangyan@huaqin.corp-partner.google.com commit 4d3bbe9dd28c0a4ca119e4b8823c5f5e9cb3ff90 Author: Lucas De Marchi Date: Tue Jul 22 12:52:08 2025 -0700 drm/xe: Fix build without debugfs When CONFIG_DEBUG_FS is off, drivers/gpu/drm/xe/xe_gt_debugfs.o is not built and build fails on some setups with: ld: drivers/gpu/drm/xe/xe_gt.o: in function `xe_fault_inject_gt_reset': drivers/gpu/drm/xe/xe_gt.h:27:(.text+0x1659): undefined reference to `gt_reset_failure' ld: drivers/gpu/drm/xe/xe_gt.h:27:(.text+0x1c16): undefined reference to `gt_reset_failure' collect2: error: ld returned 1 exit status Do not use the gt_reset_failure attribute if debugfs is not enabled. Fixes: 8f3013e0b222 ("drm/xe: Introduce fault injection for gt reset") Cc: Himal Prasad Ghimiray Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250722-xe-fix-build-fault-v1-1-157384d50987@intel.com Signed-off-by: Lucas De Marchi commit 916ee4704a8653910f10c65c2b5d6699dfac5df8 Author: Satyanarayana K V P Date: Tue Jul 22 17:35:06 2025 +0530 drm/xe/vf: Register CCS read/write contexts with Guc Register read write contexts with newly added flags with GUC and enable the context immediately after registration. Re-register the context with Guc when resuming from runtime suspend as soft reset is applied to Guc during xe_pm_runtime_resume(). Make Ring head=tail while unbinding device to avoid issues with VF pause after device is unbinded. Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Maarten Lankhorst Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250722120506.6483-4-satyanarayana.k.v.p@intel.com commit 864690cf4dd62482b6dd049d82c509886c904303 Author: Satyanarayana K V P Date: Tue Jul 22 17:35:05 2025 +0530 drm/xe/vf: Attach and detach CCS copy commands with BO Attach CCS read/write copy commands to BO for old and new mem types as NULL -> tt or system -> tt. Detach the CCS read/write copy commands from BO while deleting ttm bo from xe_ttm_bo_delete_mem_notify(). Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Matthew Auld Cc: Michał Winiarski Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250722120506.6483-3-satyanarayana.k.v.p@intel.com commit f3009272ff2ec0498426001e4dd2a12c50234e08 Author: Satyanarayana K V P Date: Tue Jul 22 17:35:04 2025 +0530 drm/xe/vf: Create contexts for CCS read write Create two LRCs to handle CCS meta data read / write from CCS pool in the VM. Read context is used to hold GPU instructions to be executed at save time and write context is used to hold GPU instructions to be executed at the restore time. Allocate batch buffer pool using suballocator for both read and write contexts. Migration framework is reused to create LRCAs for read and write. Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Michał Winiarski Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250722120506.6483-2-satyanarayana.k.v.p@intel.com commit 92e34a5241ddf4b084df20e6953275d16f156aa8 Author: Dmitry Baryshkov Date: Sat Jul 19 13:58:13 2025 +0300 drm/display: bridge-connector: correct CEC bridge pointers in drm_bridge_connector_init The bridge used in drm_bridge_connector_init() for CEC init does not correctly point to the required HDMI CEC bridge, which can lead to errors during CEC initialization. Fixes: 65a2575a68e4 ("drm/display: bridge-connector: hook in CEC notifier support") Fixes: a74288c8ded7 ("drm/display: bridge-connector: handle CEC adapters") Reported-by: Luca Ceresoli Closes: http://lore.kernel.org/r/20250718164156.194702d9@booty/ Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250719-fix-cec-bridges-v1-1-a60b1333c87d@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 9a220e065914b67b55d3d0ab91c3e215742fdd73 Author: Lukasz Laguna Date: Thu Jul 17 17:54:20 2025 +0200 drm/xe/vf: Don't register I2C devices if VF VF drivers can't access I2C devices, so skip their registration when running as VF. Signed-off-by: Lukasz Laguna Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250717155420.25298-1-lukasz.laguna@intel.com Signed-off-by: Rodrigo Vivi commit c571cb70e1ed43ee543c70151e61a001ab2eefa2 Author: Luca Ceresoli Date: Wed Jul 9 17:59:39 2025 +0200 drm/bridge: display-connector: put the bridge obtained by drm_bridge_get_prev_bridge() The bridge returned by drm_bridge_get_prev_bridge() is refcounted. Put it when done. To keep the code clean and future-proof use a scope-based free. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250709-drm-bridge-alloc-getput-drm_bridge_get_prev_bridge-v1-3-34ba6f395aaa@bootlin.com Signed-off-by: Luca Ceresoli commit d4eecb4c24dc160f4a003c804602c746fb8fec58 Author: Luca Ceresoli Date: Wed Jul 9 17:59:38 2025 +0200 drm/bridge: select_bus_fmt_recursive(): put the bridge obtained by drm_bridge_get_prev_bridge() The bridge returned by drm_bridge_get_prev_bridge() is refcounted. Put it when done. select_bus_fmt_recursive() has several return points, and ensuring drm_bridge_put() is always called in the right place would be error-prone (especially with future changes to the select_bus_fmt_recursive() code) and make code uglier. Instead use a scope-based free, which is future-proof and a lot cleaner. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250709-drm-bridge-alloc-getput-drm_bridge_get_prev_bridge-v1-2-34ba6f395aaa@bootlin.com Signed-off-by: Luca Ceresoli commit 9b75346e3c2b8ecb5b90b132c2fc185ddd30ecf3 Author: Luca Ceresoli Date: Wed Jul 9 17:59:37 2025 +0200 drm/bridge: get the bridge returned by drm_bridge_get_prev_bridge() drm_bridge_get_prev_bridge() returns a bridge pointer that the caller could hold for a long time. Increment the refcount of the returned bridge and document it must be put by the caller. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250709-drm-bridge-alloc-getput-drm_bridge_get_prev_bridge-v1-1-34ba6f395aaa@bootlin.com Signed-off-by: Luca Ceresoli commit cdb16039515a5ac4d2c923f7a651cf19a803a3fe Author: Aakash Deep Sarkar Date: Tue Jul 8 07:45:40 2025 +0000 drm/i915/display: Fix dma_fence_wait_timeout() return value handling dma_fence_wait_timeout returns a long type but the driver is only using the lower 32 bits of the retval and discarding the upper 32 bits. This is particularly problematic if there are already signalled or stub fences on some of the hw planes. In this case the dma_fence_wait_timeout function will immediately return with timeout value MAX_SCHEDULE_TIMEOUT (0x7fffffffffffffff) since the fence is already signalled. If the driver only uses the lower 32 bits of this return value then it'll interpret it as an error code (0xFFFFFFFF or (-1)) and skip the wait on the remaining fences. This issue was first observed in the xe driver with the Android compositor where the GPU composited layer was not properly waited on when there were stub fences in other overlay planes resulting in visual artifacts. Fixes: d59cf7bb73f3c ("drm/i915/display: Use dma_fence interfaces instead of i915_sw_fence") Signed-off-by: Aakash Deep Sarkar Reviewed-by: Matthew Brost Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250708074540.1948068-1-aakash.deep.sarkar@intel.com commit 46c366851a0b2159bdb97afcac04e5dec0cf09e8 Author: Jacek Lawrynowicz Date: Tue Jul 22 12:04:21 2025 +0200 MAINTAINERS: Add new intel_vpu maintainer Add Karol as a new intel_vpu maintainer. Reviewed-by: Maciej Falkowski Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250722100421.500984-1-jacek.lawrynowicz@linux.intel.com commit 8921dce70d46e3156b5a0b21675f5ac90903d81d Author: Jouni Högander Date: Tue Jul 22 15:56:18 2025 +0300 drm/i915/display: Set C10_VDR_CTRL_MSGBUS_ACCESS before phy reg read According to C10 VDR Register programming sequence we need set C10_VDR_CTRL_MSGBUS_ACCESS before accessing PHY internal registers from MsgBus. v2: set C10_VDR_CTRL_MSGBUS_ACCESS once for all owned lanes Bspec: 68962 Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Suggested-by: Gustavo Sousa Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-5-jouni.hogander@intel.com commit cf433f94f188782166598300c4c05274fd13c5a7 Author: Jouni Högander Date: Tue Jul 22 15:56:17 2025 +0300 drm/i915/display: Ensure phy is accessible on lfps configuration Ensure phy is accessible on lfps configuration by adding intel_cx0_phy_transaction_begin/end around it. Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Suggested-by: Gustavo Sousa Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-4-jouni.hogander@intel.com commit d487ed7e2b4ab3126239ab93324405eb1e45ccf5 Author: Jouni Högander Date: Tue Jul 22 15:56:16 2025 +0300 drm/i915/display: Avoid unnecessarily calling intel_cx0_get_owned_lane_mask Currently we are always calling intel_cx0_get_owned_lane_mask when intel_lnl_mac_transmit_lfps is called. Avoid this in cases where it's not needed. Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-3-jouni.hogander@intel.com commit 8265ce0e0e15ba435eb2af72f2b821e203ebcdb9 Author: Jouni Högander Date: Tue Jul 22 15:56:15 2025 +0300 drm/i915/display: Write PHY_CMN1_CONTROL only when using AUXLess ALPM We are seeing "dmesg-warn/abort - *ERROR* PHY * failed after 3 retries" since we started configuring LFPS sending. According to Bspec Configuring LFPS sending is needed only when using AUXLess ALPM. This patch avoids these failures by configuring LFPS sending only when using AUXLess ALPM. Bspec: 68849 Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-2-jouni.hogander@intel.com commit 176f44a5ec0b074aaf44852db77d0c183c36696d Author: Zhanjun Dong Date: Mon Jul 21 17:45:20 2025 -0400 drm/xe/uc: Fix missing unwind goto Fix missing unwind goto on error handling. Fixes: b2c4ac219fa4 ("drm/xe/uc: Disable GuC communication on hardware initialization error") Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250721214520.954014-1-zhanjun.dong@intel.com commit 5982a539cdcedcf1a87709c01125e1596eee2c9a Author: Salah Triki Date: Sat Jul 19 07:33:36 2025 +0100 accel/amdxdna: Delete pci_free_irq_vectors() The device is managed so pci_free_irq_vectors() is called automatically no need to do it manually. Reviewed-by: Jacek Lawrynowicz Signed-off-by: Salah Triki Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/aHs8QAfUlFeNp7qL@pc commit bd72d4acda1069579b35123e3cc0b21ec1193a21 Author: Lizhi Hou Date: Wed Jul 16 09:44:14 2025 -0700 accel/amdxdna: Support user space allocated buffer Enhance DRM_IOCTL_AMDXDNA_CREATE_BO to accept user space allocated buffer pointer. The buffer pages will be pinned in memory. Unless the CAP_IPC_LOCK is enabled for the application process, the total pinned memory can not beyond rlimit_memlock. Reviewed-by: Jacek Lawrynowicz Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250716164414.112091-1-lizhi.hou@amd.com commit 956f82e529dd283382f080273ed3b8db1e978699 Author: Luca Ceresoli Date: Tue Jul 8 17:48:22 2025 +0200 drm/probe-helper: put the bridge returned by drm_bridge_chain_get_first_bridge() The bridge returned by drm_bridge_chain_get_first_bridge() is refcounted. Put it when done. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-alloc-getput-drm_bridge_chain_get_first_bridge-v9-5-db1ba3df7f58@bootlin.com Signed-off-by: Luca Ceresoli commit c26c844390e1384c49dd9a395c3bab268dcb5bea Author: Luca Ceresoli Date: Tue Jul 8 17:48:21 2025 +0200 drm/atomic-helper: put the bridge returned by drm_bridge_chain_get_first_bridge() The bridge returned by drm_bridge_chain_get_first_bridge() is refcounted. Put it when done. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-alloc-getput-drm_bridge_chain_get_first_bridge-v9-4-db1ba3df7f58@bootlin.com Signed-off-by: Luca Ceresoli commit a73ddcba33ed8fe8f2bd5be4de88125b06df96b4 Author: Luca Ceresoli Date: Tue Jul 8 17:48:20 2025 +0200 drm/mxsfb: put the bridge returned by drm_bridge_chain_get_first_bridge() The bridge returned by drm_bridge_chain_get_first_bridge() is refcounted. Put it when done. Use a scope-based free action to catch all the code paths. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-alloc-getput-drm_bridge_chain_get_first_bridge-v9-3-db1ba3df7f58@bootlin.com Signed-off-by: Luca Ceresoli commit 8fa5909400f377351836419223c33f1131f0f7d3 Author: Luca Ceresoli Date: Tue Jul 8 17:48:19 2025 +0200 drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge() drm_bridge_chain_get_first_bridge() returns a bridge pointer that the caller could hold for a long time. Increment the refcount of the returned bridge and document it must be put by the caller. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-alloc-getput-drm_bridge_chain_get_first_bridge-v9-2-db1ba3df7f58@bootlin.com Signed-off-by: Luca Ceresoli commit 4d2d28776ae3ad7aa95328d28aff220b0ec6202d Author: Luca Ceresoli Date: Tue Jul 8 17:48:18 2025 +0200 drm/bridge: add a cleanup action for scope-based drm_bridge_put() invocation Many functions get a drm_bridge pointer, only use it in the function body (or a smaller scope such as a loop body), and don't store it. In these cases they always need to drm_bridge_put() it before returning (or exiting the scope). Some of those functions have complex code paths with multiple return points or loop break/continue. This makes adding drm_bridge_put() in the right places tricky, ugly and error prone in case of future code changes. Others use the bridge pointer in the return statement and would need to split the return line to fit the drm_bridge_put, which is a bit annoying: -return some_thing(bridge); +ret = some_thing(bridge); +drm_bridge_put(bridge); +return ret; To make it easier for all of them to put the bridge reference correctly without complicating code, define a scope-based cleanup action to be used with __free(). Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-alloc-getput-drm_bridge_chain_get_first_bridge-v9-1-db1ba3df7f58@bootlin.com Signed-off-by: Luca Ceresoli commit ac6e050e69811c5c2057d519362c7b173a915542 Author: Maarten Lankhorst Date: Wed Jul 16 12:56:36 2025 +0200 accel/ivpu: Remove lockdep_assert_irqs_disabled() This breaks on PREEMPT_RT, and should be unneeded since lockdep can track irq disabled status itself. Link: https://lore.kernel.org/r/20250715165919.33754-1-dev@lankhorst.se Reviewed-by: Jacek Lawrynowicz Signed-off-by: Maarten Lankhorst commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 Author: Langyan Ye Date: Mon Jul 21 14:16:27 2025 +0800 drm/panel-edp: Add disable to 100ms for MNB601LS1-4 For the MNB601LS1-4 panel, the T9+T10 timing does not meet the requirements of the specification, so disable is set to 100ms. Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4") Signed-off-by: Langyan Ye Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com commit 94febfb5bcfb6ccf02283cc07bf58927c119afca Author: Beata Michalska Date: Thu Jun 26 18:23:13 2025 +0200 rust: drm: Drop the use of Opaque for ioctl arguments With the Opaque, the expectations are that Rust should not make any assumptions on the layout or invariants of the wrapped C types. That runs rather counter to ioctl arguments, which must adhere to certain data-layout constraints. By using Opaque, ioctl handlers are forced to use unsafe code where none is actually needed. This adds needless complexity and maintenance overhead, brining no safety benefits. Drop the use of Opaque for ioctl arguments as that is not the best fit here. Signed-off-by: Beata Michalska Reviewed-by: Boqun Feng Reviewed-by: Daniel Almeida Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250626162313.2755584-1-beata.michalska@arm.com Signed-off-by: Danilo Krummrich commit 17133255a32275f0f042f7f432f332ff1cf5e57d Author: Ruben Wauters Date: Tue Jul 1 12:54:51 2025 +0100 drm/i915: replace DRM_DEBUG_SELFTEST with DRM_KUNIT_TEST DRM_DEBUG_SELFTEST was removed in commit fc8d29e298cf (drm: selftest: convert drm_mm selftest to KUnit) and all functions under it were converted to KUnit, under the DRM_KUNIT_TEST option This conversion however did not occur in the Kconfig.debug file in the i915 directory. This patch replaces the select for DRM_DEBUG_SELFTEST, an option that no longer exists, with the correct select, DRM_KUNIT_TEST. Signed-off-by: Ruben Wauters Link: https://lore.kernel.org/r/20250701115511.5445-1-rubenru09@aol.com Signed-off-by: Rodrigo Vivi commit 6c9e64e83b22405622d1f47417cdb0d20d49ca35 Author: Dan Carpenter Date: Fri Jul 18 16:23:05 2025 -0500 drm/xe: Fix an IS_ERR() vs NULL bug in xe_tile_alloc_vram() The xe_vram_region_alloc() function returns NULL on error. It never returns error pointers. Update the error checking to match. Fixes: 4b0a5f5ce784 ("drm/xe: Unify the initialization of VRAM regions") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/5449065e-9758-4711-b706-78771c0753c4@sabinyo.mountain Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi commit f9cc4616ba70681e0f10e6872d7372aaa479bb13 Author: Jouni Högander Date: Tue Jul 15 13:55:09 2025 +0300 drm/i915/psr: Add enable_panel_replay module parameter Add new module parameter enable_panel_replay. This can be used to enable/disable Panel Replay. 0=disabled, 1=enabled. -1=use per-chip default (default). Signed-off-by: Jouni Högander Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250715105509.4146806-4-jouni.hogander@intel.com commit 8b6c828bb7b9c3263223f7cfd33d92f010610bd7 Author: Jouni Högander Date: Tue Jul 15 13:55:08 2025 +0300 drm/i915/psr: Ignore enable_psr parameter on Panel Replay Currently we are disabling Panel Replay if enable_psr != -1. Lets ignore enable_psr completely on Panel Replay. Signed-off-by: Jouni Högander Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250715105509.4146806-3-jouni.hogander@intel.com commit d12a58c2f179425093b707696ad00509e03df03c Author: Jouni Högander Date: Tue Jul 15 13:55:07 2025 +0300 drm/i915/psr: Do not disable Early Transport when enable_psr is set Current approach is that Early Transport is disabled in case enable_psr module parameter is set. Let's ignore enable_psr parameter when choosing if Early Transport can be used. Signed-off-by: Jouni Högander Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250715105509.4146806-2-jouni.hogander@intel.com commit 01e1575609f100e5a47640491591108e0198e273 Author: Ville Syrjälä Date: Thu Jul 17 20:13:52 2025 +0300 drm/i915: Don't pass crtc_state to foo_plane_ctl() & co. The *_plane_ctl() functions only consider the state of the plane (the state of the crtc is handled by the corresponding *_plane_ctl_crtc()), and thus they don't need the crtc_state at all. Don't pass it in. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717171353.23090-7-ville.syrjala@linux.intel.com commit a9298b3bfebc6cacca3363a884dde14bf05f14d2 Author: Ville Syrjälä Date: Thu Jul 17 20:13:51 2025 +0300 drm/i915: Remove unused dpt_total_entries() dpt_total_entries() is not used anywhere. Remove it. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717171353.23090-6-ville.syrjala@linux.intel.com commit c6ab589feebf81e11b784fe1b4e81208019e72c7 Author: Ville Syrjälä Date: Thu Jul 17 20:13:50 2025 +0300 drm/i915: Use i915_vma_offset() in intel_dpt_offset() Replace the open coded vma mm node stuff in intel_dpt_offset() with i915_vma_offset(). This will also include the VT-d guard in the result. Granted that should always be 0 for DPT, but it seems prudent to include that in our DPT vma offset check anyway. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717171353.23090-5-ville.syrjala@linux.intel.com commit 44ebdab4b6d878c435da7385b38d2329f8a411d3 Author: Ville Syrjälä Date: Thu Jul 17 20:13:49 2025 +0300 drm/i915: Move the intel_dpt_offset() check into intel_plane_pin_fb() Now that we handle all the other vma offset stuff in intel_plane_pin_fb() it seems more proper to do the dpt_vma offset check there as well. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717171353.23090-4-ville.syrjala@linux.intel.com commit bc0c7fd732a89acac4194ae1f4686de63b32138a Author: Ville Syrjälä Date: Sat Jul 19 20:53:54 2025 +0300 drm/i915: Nuke intel_plane_ggtt_offset() We don't really need the extra intel_plane_ggtt_offset() wrapper anymore. Get rid of it. v2: Deal with reuse_vma() hacks Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717171353.23090-3-ville.syrjala@linux.intel.com commit 971eb92b0460ca2afe581e60e3c8d863563ae38c Author: Ville Syrjälä Date: Thu Jul 17 23:32:16 2025 +0300 drm/i915: Precompute plane SURF address Currently we pre-compute the plane surface/base address partially (only for cursor_needs_physical cases) in intel_plane_pin_fb() and finish the calculation in the plane->update_arm(). Let's just precompute the whole thing instead. One benefit is that we get rid of all the vma offset stuff from the low level plane code. Another use I have in mind is including the surface address in the plane tracepoints, which should make it easier to analyze display faults. v2: Deal with xe reuse_vma() hacks v3: use intel_plane_ggtt_offset() still in reuse_vma() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250717203216.31258-1-ville.syrjala@linux.intel.com commit 615c8ec48621f5c157fef3633d6e4be81d7a370f Author: Ville Syrjälä Date: Fri Jul 18 14:29:28 2025 +0300 drm/i915/dsi: Don't set/read the DSI C clock divider on GLK GLK doesn't use the DSI C clock at all, no need to program the divider for it. Bspec even says: "Do not program this field". However looks like some firmware versions program this and some do not. In order to avoid bogus fastset mismatches we should also filter it out during readout. v2: Clear all the DSI C clock bits during readout (Jani) Adjust platform checks for new style, and add has_dsic_clock() while at it. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250718112928.27669-1-ville.syrjala@linux.intel.com commit 4b5514f786dd790ec0d3e2fe66cea7fd2f36bdf3 Author: Harish Chegondi Date: Fri Jul 18 13:29:47 2025 -0700 drm/xe: Remove unnecessary EU stall debug message The EU stall debug message may cause CI to complain on unsupported platforms. Remove it. Cc: Ashutosh Dixit Signed-off-by: Harish Chegondi Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://lore.kernel.org/r/dfb6a080b3442d481c567489aabe47e72f3e784c.1752870172.git.harish.chegondi@intel.com commit ca2a6abdaee43808034cdb218428d2ed85fd3db8 Author: Jann Horn Date: Wed Nov 13 22:03:39 2024 +0100 drm/panthor: Fix memory leak in panthor_ioctl_group_create() When bailing out due to group_priority_permit() failure, the queue_args need to be freed. Fix it by rearranging the function to use the goto-on-error pattern, such that the success case flows straight without indentation while error cases jump forward to cleanup. Cc: stable@vger.kernel.org Fixes: 5f7762042f8a ("drm/panthor: Restrict high priorities on group_create") Signed-off-by: Jann Horn Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20241113-panthor-fix-gcq-bailout-v1-1-654307254d68@google.com commit 36caa026b28a49aa91495698350ce46577293e9d Author: Tvrtko Ursulin Date: Wed Jul 16 09:51:17 2025 +0100 drm/sched: Avoid double re-lock on the job free path Currently the job free work item will lock sched->job_list_lock first time to see if there are any jobs, free a single job, and then lock again to decide whether to re-queue itself if there are more finished jobs. Since drm_sched_get_finished_job() already looks at the second job in the queue we can simply add the signaled check and have it return the presence of more jobs to be freed to the caller. That way the work item does not have to lock the list again and repeat the signaled check. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Maíra Canal Cc: Matthew Brost Cc: Philipp Stanner Reviewed-by: Maíra Canal Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250716085117.56864-1-tvrtko.ursulin@igalia.com commit 0864197382fa7c8c2641bff0f36355bf4bd76398 Author: David Francis Date: Thu Jul 17 10:35:56 2025 -0400 drm: Move drm_gem ioctl kerneldoc to uapi file The drm_gem ioctls were documented in internal file drm_gem.c instead of uapi header drm.h. Move them there and change to appropriate kerneldoc formatting. Signed-off-by: David Francis Reviewed-by: Simona Vetter Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250717143556.857893-3-David.Francis@amd.com commit 53096728b8910c6916ecc6c46a5abc5c678b58d9 Author: David Francis Date: Thu Jul 17 10:35:55 2025 -0400 drm: Add DRM prime interface to reassign GEM handle CRIU restore of drm buffer objects requires the ability to create or import a buffer object with a specific gem handle. Add new drm ioctl DRM_IOCTL_GEM_CHANGE_HANDLE, which takes the gem handle of an object and moves that object to a specified new gem handle. This ioctl needs to call drm_prime_remove_buf_handle, but that function acquires the prime lock, which the ioctl needs to hold for other purposes. Make drm_prime_remove_buf_handle not acquire the prime lock, and change its other caller to reflect this. The rest of the kernel patches required to enable CRIU can be found at https://lore.kernel.org/dri-devel/20250617194536.538681-1-David.Francis@amd.com/ v2 - Move documentation to UAPI headers v3 - Always return 0 on success Signed-off-by: David Francis Acked-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250717143556.857893-2-David.Francis@amd.com commit 976d608d6f8404475ac8e133a713395defa14f41 Author: Ville Syrjälä Date: Thu Jul 10 23:17:18 2025 +0300 drm/i915/dp: Make .set_idle_link_train() mandatory Everyone implements the .set_idle_link_train() hook now. Just make it mandatory. Tested-by: Imre Deak Reviewed-by: Imre Deak Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-8-ville.syrjala@linux.intel.com commit 071dcf12bca55c8640d8be5389d0e5251887a174 Author: Ville Syrjälä Date: Thu Jul 10 23:17:17 2025 +0300 drm/i915/dp: Implement .set_idle_link_train() for everyone All platforms are capable of explicitly transmitting the idle pattern. Implement it for everyone (so far it as implemented only for HSW+). The immediate benefit is that we gain the possibility of implementing the POST_LT_ADJ_REQ sequence for all platforms. Another potential future use would be a pseudo port sync mode on pre-BDW where we attempt to sync up multiple ports/pipes by trying to turn on the transcoders at the same time, and switching the links to normal pixel transmission at the same time. I'm not 100% sure the hardware is guaranteed to transmit the required number of idle patterns (5) when switching away from training pattern (either via explicit idle pattern, or straight to the normal pixel output). Would be nice to confirm that at some point, but for now let's assume it happens correctly in both cases. v2: Elaborate a bit more on the min required idle patterns Tested-by: Imre Deak Reviewed-by: Imre Deak Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-7-ville.syrjala@linux.intel.com commit 4cd073be84c1240b077813cf2766992cd78d8d64 Author: Ville Syrjälä Date: Thu Jul 10 23:17:16 2025 +0300 drm/i915/dp: Move intel_dp_training_pattern() Move intel_dp_training_pattern() upwards to avoid the forward declaration for the POST_LT_ADJ_REQ stuff. Tested-by: Imre Deak Reviewed-by: Imre Deak Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-6-ville.syrjala@linux.intel.com commit b840bb0b7ec279660002afc83217c435e6896870 Author: Ville Syrjälä Date: Thu Jul 10 23:17:15 2025 +0300 drm/i915/dp: Have intel_dp_get_adjust_train() tell us if anything changed In order to implement the POST_LT_ADJ_REQ sequence we need to know whether the sink actually requested a changed to the vswing/pre-emph values. Tested-by: Imre Deak Reviewed-by: Imre Deak Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-5-ville.syrjala@linux.intel.com commit 11fab5a2a1ad78d12f23cee209f1705f6d7ca281 Author: Ville Syrjälä Date: Thu Jul 10 23:17:14 2025 +0300 drm/i915/dp: Clear DPCD training pattern before transmitting the idle pattern We are supposed to switch off the training pattern in DPCD before we start transmitting the idle pattern. For LTTPRs we do that correctly, but for the sink DPRX we only do this correctly for some platforms. On pre-HSW (where we don't implement the .set_idle_link_train() hook), we directly switch from transmitting the training pattern to normal pixel transmission (the hardware should hopefully guarantee that the minimum number of required idle patters will be transmitted during this transition). The DPCD write correctly precedes the actual switch away from the training pattern. For HSW+ we start transmitting the idle pattern earlier, and only switch off the DPCD training pattern after we switch from the idle pattern to normal pixel transmission. Adjust the code to disable the DPCD training pattern before we start transmitting the idle pattern. v2: Tweak the commit message a bit Tested-by: Imre Deak Reviewed-by: Imre Deak Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-4-ville.syrjala@linux.intel.com commit f0da19347bccee1c20091e9fd597a2f197792021 Author: Ville Syrjälä Date: Thu Jul 10 23:17:13 2025 +0300 drm/i915/dp: Don't switch to idle pattern before disable on pre-hsw For some reason we are switching over to the idle pattern before disabling the DP port on pre-hsw. AFAICS this has never been part of the documented sequence (and on hsw+ the spec explicitly says not to do this). Get rid of it. The code goes all the way back to commit 5eb08b69f510 ("drm/i915: enable DisplayPort support on IGDNG"), and it was accompanied by a 17ms delay which got changed to vbl wait in commit ab527efc2fea ("drm/i915: use wait_for_vblank instead of msleep(17)"), and was later completely removed in commit 93c9c19b3d25 ("drm/i915: remove unexplained vblank wait in the DP off code"). Smoke tested on g4x/snb/chv. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-3-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak commit a8b874694db5cae7baaf522756f87acd956e6e66 Author: Ville Syrjälä Date: Thu Jul 10 23:17:12 2025 +0300 drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x On g4x we currently use the 96MHz non-SSC refclk, which can't actually generate an exact 2.7 Gbps link rate. In practice we end up with 2.688 Gbps which seems to be close enough to actually work, but link training is currently failing due to miscalculating the DP_LINK_BW value (we calcualte it directly from port_clock which reflects the actual PLL outpout frequency). Ideas how to fix this: - nudge port_clock back up to 270000 during PLL computation/readout - track port_clock and the nominal link rate separately so they might differ a bit - switch to the 100MHz refclk, but that one should be SSC so perhaps not something we want While we ponder about a better solution apply some band aid to the immediate issue of miscalculated DP_LINK_BW value. With this I can again use 2.7 Gbps link rate on g4x. Cc: stable@vger.kernel.org Fixes: 665a7b04092c ("drm/i915: Feed the DPLL output freq back into crtc_state") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-2-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak commit b9a572f471993d3e8bf874fcb57f331d66650440 Author: Simon Ser Date: Thu May 1 11:29:51 2025 +0000 drm: document DRM_MODE_PAGE_FLIP_EVENT interactions with atomic It's not obvious off-hand which CRTCs will get a page-flip event when using this flag in an atomic commit, because it's all implicitly implied based on the contents of the atomic commit. Document requirements for using this flag and how to request an event for a CRTC. Note, because prepare_signaling() runs right after drm_atomic_set_property() calls, page-flip events are not delivered for CRTCs pulled in later by DRM core (e.g. on modeset by drm_atomic_helper_check_modeset()) or the driver (e.g. other CRTCs sharing a DP-MST connector). v2: fix cut off sentence in commit message (Pekka) Signed-off-by: Simon Ser Reviewed-by: Simona Vetter Cc: Ville Syrjälä Cc: Pekka Paalanen Cc: David Turner Cc: Daniel Stone Link: https://lore.kernel.org/r/20250501112945.6448-1-contact@emersion.fr commit 487579fd8524c58dc237904c1b1d9e7c89e53378 Author: Soham Purkait Date: Wed Jul 16 15:44:12 2025 +0530 drm/xe/xe_debugfs: Exposure of G-State and pcie link state residency counters through debugfs Add debug nodes, "dgfx_pkg_residencies" for G-states (G2, G6, G8, G10, ModS) and "dgfx_pcie_link_residencies" for PCIe link states(L0, L1, L1.2) residency counters. v1: - Expose all G-State residency counter values under dgfx_pkg_residencies. (Anshuman) - Include runtime_get/put. (Riana) v2: - Move offset macros to drm/xe/regs/xe_pmt. (Riana) v3: - Include debugfs node "dgfx_pcie_link_residencies" for pcie link residency counter values. (Anshuman) v4: - Include check for BMG and add helper function for repetitive code. (Riana) - Add for loop and local struct to avoid repetition. (Riana) - Use "drm_debugfs_create_files" to create debugfs. (Karthik) v5: - Reorder commits to reflect the correct dependency hierarchy. (Jonathan) - Simplification of commit message and rectified register offset.(Karthik) - Error handling and return before printing. (Riana) v6: - Remove check for DGFX as BMG is discrete. (Karthik) - Rearrange residency offsets in ascending order. (Riana) v7: - Squash the macros into the patch they are used in. (Lucas) Signed-off-by: Soham Purkait Reviewed-by: Jonathan Cavitt Reviewed-by: Karthik Poosa Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250716101412.3062780-2-soham.purkait@intel.com Signed-off-by: Rodrigo Vivi commit 769c153cfc3c6669c7b318f66c2b21ec3951fb4a Author: Maíra Canal Date: Fri Jul 11 12:18:32 2025 -0300 drm/v3d: Add parameter to retrieve the number of GPU resets per-fd The GL extension KHR_robustness uses the number of global and per-context GPU resets to learn about graphics resets that affect a GL context. This commit introduces a new V3D parameter to retrieve the number of GPU resets triggered by jobs submitted through a file descriptor. To retrieve this information, user-space must use DRM_V3D_PARAM_CONTEXT_RESET_COUNTER. Reviewed-by: Iago Toral Quiroga Link: https://lore.kernel.org/r/20250711-v3d-reset-counter-v1-2-1ac73e9fca2d@igalia.com Signed-off-by: Maíra Canal commit 5774b3cfdedb3624ef0d2c82cccbfd61bcb60fd5 Author: Maíra Canal Date: Fri Jul 11 12:18:31 2025 -0300 drm/v3d: Add parameter to retrieve the global number of GPU resets The GL extension KHR_robustness uses the number of global and per-context GPU resets to learn about graphics resets that affect a GL context. This commit introduces a new V3D parameter to retrieve the global number of GPU resets that have happened since the driver was probed. To retrieve this information, user-space must use DRM_V3D_PARAM_GLOBAL_RESET_COUNTER. Reviewed-by: Iago Toral Quiroga Link: https://lore.kernel.org/r/20250711-v3d-reset-counter-v1-1-1ac73e9fca2d@igalia.com Signed-off-by: Maíra Canal commit 7565fd5dcb0bd6ad843b8d0acbaa9efea5b481a9 Author: Ankit Nautiyal Date: Tue Jul 15 19:52:11 2025 +0530 drm/i915/gmbus: Add Wa_16025573575 for PTL/WCL for bit-bashing As per Wa_16025573575 for PTL/WCL, set the GPIO masks bit before starting bit-bashing and maintain value through the bit-bashing sequence. After the bit-bashing sequence is done, clear the GPIO masks bits. v2: -Use new helper for display workarounds. (Jani) -Use a separate if-block for the workaround. (Gustavo) v3: -Document the workaround details in intel_display_wa.c -Extend the workaround to WCL too. (Gustavo) v4: -Fix the platform check. (Gustavo) -Avoid read when preserve bits are 0. (Gustavo) Signed-off-by: Ankit Nautiyal Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250715142211.3145299-1-ankit.k.nautiyal@intel.com commit 5c30a6e12ce87a1e6ff1d179f1afb9f97e0a1346 Author: Ankit Nautiyal Date: Fri Jul 11 09:48:59 2025 +0530 drm/i915/display_wa: Add helpers to check wa Introduce a generic helper to check display workarounds using an enum. Convert Wa_16023588340 to use the new interface, simplifying WA checks and making future additions easier. v2: Use drm_WARN instead of MISSING_CASE and simplify intel_display_wa macro. (Jani) v3: Print Missing wa number, instead of enum value. (Gustavo, Jani) Suggested-by: Jani Nikula Signed-off-by: Ankit Nautiyal Reviewed-by: Jani Nikula Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250711041901.1607823-2-ankit.k.nautiyal@intel.com commit 2650bc4007c15e05f995f472b4fc89e793162bc4 Author: Tvrtko Ursulin Date: Wed Jul 16 09:48:17 2025 +0100 drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test The "skip reset" test waits for the timeout handler to run for the duration of 2 * MOCK_TIMEOUT, and because the mock scheduler opted to remove the "skip reset" flag once it fires, this gives opportunity for the timeout handler to run twice. Second time the job will be removed from the mock scheduler job list and the drm_mock_sched_advance() call in the test will fail. Fix it by making the "don't reset" flag persist for the lifetime of the job and add a new flag to verify that the code path had executed as expected. Signed-off-by: Tvrtko Ursulin Fixes: 1472e7549f84 ("drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG") Cc: Maíra Canal Cc: Philipp Stanner Reviewed-by: Maíra Canal Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250716084817.56797-1-tvrtko.ursulin@igalia.com commit 4b0a5f5ce7849aab7a67ba9f113ed75626f6de36 Author: Piotr Piórkowski Date: Mon Jul 14 20:48:18 2025 +0200 drm/xe: Unify the initialization of VRAM regions Currently in the drivers we have defined VRAM regions per device and per tile. Initialization of these regions is done in two completely different ways. To simplify the logic of the code and make it easier to add new regions in the future, let's unify the way we initialize VRAM regions. v2: - fix doc comments in struct xe_vram_region - remove unnecessary includes (Jani) v3: - move code from xe_vram_init_regions_managers to xe_tile_init_noalloc (Matthew) - replace ioremap_wc to devm_ioremap_wc for mapping VRAM BAR (Matthew) - Replace the tile id parameter with vram region in the xe_pf_begin function. v4: - remove tile back pointer from struct xe_vram_region - add new back pointers: xe and migarte to xe_vram_region Signed-off-by: Piotr Piórkowski Cc: Stuart Summers Cc: Matthew Auld Cc: Jani Nikula Reviewed-by: Matthew Auld # rev3 Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250714184818.89201-6-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit d65ff1ec85355959e4ca452fba458687e4da583a Author: Piotr Piórkowski Date: Mon Jul 14 20:48:17 2025 +0200 drm/xe: Split xe_migrate allocation from initialization Currently, xe_migrate_init handled both allocation and initialization, Lets moves allocation to xe_tile_alloc via a new xe_migrate_alloc function, and keep initialization in xe_migrate_init. This will allow the migration pointers to be passed to other structures before full initialization. Also replaces devm_kzalloc with drmm_kzalloc for better DRM-managed memory. Signed-off-by: Piotr Piórkowski Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250714184818.89201-5-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit 7a20b4f558f4291161f71a5b7384262db9ccd6b0 Author: Piotr Piórkowski Date: Mon Jul 14 20:48:16 2025 +0200 drm/xe: Move struct xe_vram_region to a dedicated header Let's move the xe_vram_region structure to a new header dedicated to VRAM to improve modularity and avoid unnecessary dependencies when only VRAM-related structures are needed. v2: Fix build if CONFIG_DRM_XE_DEVMEM_MIRROR is enabled v3: Fix build if CONFIG_DRM_XE_DISPLAY is enabled v4: Move helper to get tile dpagemap to xe_svm.c Signed-off-by: Piotr Piórkowski Suggested-by: Jani Nikula Reviewed-by: Satyanarayana K V P # rev3 Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250714184818.89201-4-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit f92cfd72d9a650f90260c54accd840c6500c4c3a Author: Piotr Piórkowski Date: Mon Jul 14 20:48:15 2025 +0200 drm/xe: Use dynamic allocation for tile and device VRAM region structures In future platforms, we will need to represent the device and tile VRAM regions in a more dynamic way, so let's abandon the static allocation of these structures and start use a dynamic allocation. v2: - Add a helpers for accessing fields of the xe_vram_region structure v3: - Add missing EXPORT_SYMBOL_IF_KUNIT for xe_vram_region_actual_physical_size Signed-off-by: Piotr Piórkowski Cc: Stuart Summers Cc: Matthew Auld Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250714184818.89201-3-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit 922ae875230be91c7f05f2aa90d176b6693e2601 Author: Piotr Piórkowski Date: Mon Jul 14 20:48:14 2025 +0200 drm/xe: Use devm_ioremap_wc for VRAM mapping and drop manual unmap Let's replace the manual call to ioremap_wc function with devm_ioremap_wc function, ensuring that VRAM mappings are automatically released when the driver is detached. Since devm_ioremap_wc registers the mapping with the device's managed resources, the explicit iounmap call in vram_fini is no longer needed, so let's remove it. Signed-off-by: Piotr Piórkowski Suggested-by: Matthew Auld Reviewed-by: Matthew Auld Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250714184818.89201-2-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit bf81505f7dba467c17097315864790f9f7dca08a Author: Michal Wajdeczko Date: Mon Jul 14 21:36:45 2025 +0200 drm/xe: Move debugfs GT attributes under tile directory While in sysfs we are correctly trying to reflect the hardware architecture and we expose GT attributes in per tile hierarchy, in debugfs we expose GT attributes at flat level, without tiles. Create debugfs directories to represent each tile and move GT attributes under matching parent tile directory. To not break existing debugfs tools, create symlink under old location: /sys/kernel/debug/dri/0000:00:02.0/ ├── ... ├── gt0 -> tile0/gt0 ├── gt1 -> tile0/gt1 ├── tile0 │   ├── gt0 │   │   ├── ... │   ├── gt1 │   │   ├── ... Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250714193645.763-1-michal.wajdeczko@intel.com commit 2f264d58cc805a3cefc6b98097f90fbc388136ef Author: Dan Carpenter Date: Tue Jul 15 17:59:44 2025 -0500 drm/xe: Fix a NULL vs IS_ERR() bug in xe_i2c_register_adapter() The fwnode_create_software_node() function returns error pointers. It never returns NULL. Update the checks to match. Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Signed-off-by: Dan Carpenter Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/65825d00-81ab-4665-af51-4fff6786a250@sabinyo.mountain Signed-off-by: Rodrigo Vivi commit 308dc9b27874d0e8a0258869b9e681b0fdd2e579 Author: Ashutosh Dixit Date: Tue Jul 15 11:14:22 2025 -0700 drm/xe/oa: Fix static checker warning about null gt There is a static checker warning that gt returned by xe_device_get_gt can be NULL and that is being dereferenced. Use xe_root_mmio_gt instead, which is equivalent and cannot return a NULL gt 0. Fixes: 10d42ef34bce ("drm/xe/oa: Assign hwe for OAM_SAG") Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250715181422.2807624-1-ashutosh.dixit@intel.com commit ed5461daa150b037e36b8202381da1ef85d6b16b Author: Raag Jadav Date: Tue Jul 15 03:25:03 2025 +0530 drm/xe: Don't fail probe on unsupported mailbox command If the device is running older pcode firmware, it is possible that newer mailbox commands are not supported by it. The sysfs attributes aren't useful in that case, but we shouldn't fail driver probe because of it. As of now, it is unknown if we can distinguish unsupported commands before attempting them. But until we figure out a way to do that, fix the regressions. v2: Add debug message (Lucas) Fixes: cdc36b66cd41 ("drm/xe: Expose fan control and voltage regulator version") Signed-off-by: Raag Jadav Tested-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250714215503.2897748-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi commit 8a643df55f3a9c034cf8d1942c25a6eb08d57d9d Author: Sebastian Andrzej Siewior Date: Mon Jul 14 17:39:48 2025 +0200 drm/i915: Don't check for atomic context on PREEMPT_RT The !in_atomic() check in _wait_for_atomic() triggers on PREEMPT_RT because the uncore::lock is a spinlock_t and does not disable preemption or interrupts. Changing the uncore:lock to a raw_spinlock_t doubles the worst case latency on an otherwise idle testbox during testing. Ignore _WAIT_FOR_ATOMIC_CHECK() on PREEMPT_RT. Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/all/20211006164628.s2mtsdd2jdbfyf7g@linutronix.de/ Signed-off-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250714153954.629393-4-bigeasy@linutronix.de Signed-off-by: Maarten Lankhorst commit bba9aa41654036534d86b198f5647a9ce15ebd7f Author: Imre Deak Date: Wed Jul 9 00:23:31 2025 +0300 drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET Commit a40c5d727b81 ("drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") stopped using the DPCD_REV register for DPCD probing, since this results in link training failures at least when using an Intel Barlow Ridge TBT hub at UHBR link rates (the DP_INTRA_HOP_AUX_REPLY_INDICATION never getting cleared after the failed link training). Since accessing DPCD_REV during link training is prohibited by the DP Standard, LANE0_1_STATUS (0x202) was used instead, as it falls within the Standard's valid register address range (0x102-0x106, 0x202-0x207, 0x200c-0x200f, 0x2216) and it fixed the link training on the above TBT hub. However, reading the LANE0_1_STATUS register also has a side-effect at least on a Novatek eDP panel, as reported on the Closes: link below, resulting in screen flickering on that panel. One clear side-effect when doing the 1-byte probe reads from LANE0_1_STATUS during link training before reading out the full 6 byte link status starting at the same address is that the panel will report the link training as completed with voltage swing 0. This is different from the normal, flicker-free scenario when no DPCD probing is done, the panel reporting the link training complete with voltage swing 2. Using the TRAINING_PATTERN_SET register for DPCD probing doesn't have the above side-effect, the panel will link train with voltage swing 2 as expected and it will stay flicker-free. This register is also in the above valid register range and is unlikely to have a side-effect as that of LANE0_1_STATUS: Reading LANE0_1_STATUS is part of the link training CR/EQ sequences and so it may cause a state change in the sink - even if inadvertently as I suspect in the case of the above Novatek panel. As opposed to this, reading TRAINING_PATTERN_SET is not part of the link training sequence (it must be only written once at the beginning of the CR/EQ sequences), so it's unlikely to cause any state change in the sink. As a side-note, this Novatek panel also lacks support for TPS3, while claiming support for HBR2, which violates the DP Standard (the Standard mandating TPS3 for HBR2). Besides the Novatek panel (PSR 1), which this change fixes, I also verified the change on a Samsung (PSR 1) and an Analogix (PSR 2) eDP panel as well as on the Intel Barlow Ridge TBT hub. Note that in the drm-tip tree (targeting the v6.17 kernel version) the i915 and xe drivers keep DPCD probing enabled only for the panel known to require this (HP ZR24w), hence those drivers in drm-tip are not affected by the above problem. Cc: Ville Syrjälä Cc: Jani Nikula Fixes: a40c5d727b81 ("drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") Reported-and-tested-by: Paul Menzel Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14558 Reviewed-by: Jonathan Cavitt Acked-by: Thomas Zimmermann Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250708212331.112898-1-imre.deak@intel.com commit 21c586d9233a1f258e8d437466c441d50885d30f Author: Ankit Nautiyal Date: Thu Jul 10 10:50:41 2025 +0530 drm/i915/dp: Add device specific quirk to limit eDP rate to HBR2 Some ICL/TGL platforms with combo PHY ports suffer from signal integrity issues at HBR3. While certain systems include a Parade PS8461 mux to mitigate this, its presence cannot be reliably detected. Furthermore, broken or missing VBT entries make it unsafe to rely on VBT for enforcing link rate limits. To address this introduce a device specific quirk to cap the eDP link rate to HBR2 (540000 kHz). This will override any higher advertised rates from the sink or DPCD for specific devices. Currently, the quirk is added for Dell XPS 13 7390 2-in-1 which is reported in gitlab issue #5969 [1]. [1] https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969 v2: Align the quirk with the intended quirk name and refactor the condition to use min(). (Jani) v3: Use condition `rate > 540000`. Drop extra parentheses. (Ville) Cc: Jani Nikula Cc: Ville Syrjälä Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969 Reviewed-by: Ville Syrjälä Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250710052041.1238567-3-ankit.k.nautiyal@intel.com commit 8c9006283e4b767003b2d11182d6e90f8b184c3d Author: Ankit Nautiyal Date: Thu Jul 10 10:50:40 2025 +0530 Revert "drm/i915/dp: Reject HBR3 when sink doesn't support TPS4" This reverts commit 584cf613c24a4250d9be4819efc841aa2624d5b6. Commit 584cf613c24a ("drm/i915/dp: Reject HBR3 when sink doesn't support TPS4") introduced a blanket rejection of HBR3 link rate when the sink does not support TPS4. While this was intended to address instability observed on certain eDP panels [1], there seem to be edp panels that do not follow the specification. These eDP panels do not advertise TPS4 support, but require HBR3 to operate at their fixed native resolution [2]. As a result, the change causes blank screens on such panels. Apparently, Windows driver does not enforce this restriction, and the issue is not seen there. Therefore, revert the commit to restore functionality for such panels, and align behaviour with Windows driver. [1] https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969 [2] https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14517 v2: Update the commit message with better justification. (Ville) Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14517 Acked-by: Jani Nikula Reviewed-by: Ville Syrjälä Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250710052041.1238567-2-ankit.k.nautiyal@intel.com commit 3347b55f2c6c4bebc7a07343448416e5678b8b5c Author: Suraj Kandpal Date: Tue Jul 8 10:03:28 2025 +0530 drm/i915/xe3lpd: Prune modes for YUV420 We only support resolution up to 4k for single pipe when using YUV420 format so we prune these modes and restrict the plane size at src. This is because pipe scaling will not support YUV420 scaling for hwidth > 4096. --v2 -Use output format to check [Ville] -Add Bspec references -Modify commit messge to point to why this is needed --v3 -Use a function skl_scaler_mode_valid which is routed throug intel_pfit_mode_valid [Ville] -Combine the check conditons [Jonathan] --v4 -mode_valid functions should return drm_mode_status [Jani] --v5 -Use skl_scaler_max_src_size [Ankit] Bspec: 49247, 50441 Signed-off-by: Suraj Kandpal Reviewed-by: Jonathan Cavitt #v2 Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250708043328.1086192-2-suraj.kandpal@intel.com commit f7a9dc796567b2f1562f83373a5f134a20db25e9 Author: Suraj Kandpal Date: Tue Jul 8 10:03:27 2025 +0530 drm/i915/scaler: Use intel_display as argument to skl_scaler_max_src_size skl_scaler_max_src_size has really no use of intel_crtc other than deriving intel_display. Let's just pass intel_display to it directly. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250708043328.1086192-1-suraj.kandpal@intel.com commit d18d7989e3da1f2753d49cb24d916f357e340f76 Author: Petr Mladek Date: Wed Jul 2 11:51:57 2025 +0200 printk: kunit: Fix __counted_by() in struct prbtest_rbdata __counted_by() has to point to a variable which defines the size of the related array. The code must never access the array beyond this limit. struct prbtest_rbdata currently stores the length of the string. And the code access the array beyond the limit when writing or reading the trailing '\0'. Store the size of the string, including the trailing '\0' if we wanted to keep __counted_by(). Consistently use "_size" suffix when the trailing '\0' is counted. Note that MAX_RBDATA_TEXT_SIZE was originally used to limit the text length. When touching the code, make sure that @text_size produced by get_random_u32_inclusive() stays within the limits. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/eaea66b9-266a-46e7-980d-33f40ad4b215@sabinyo.mountain Suggested-by: Thomas Weißschuh Reviewed-by: John Ogness Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20250702095157.110916-4-pmladek@suse.com Signed-off-by: Petr Mladek commit 254e8fb5e67643a19a8dd6e142262ec83b30c3c7 Author: Petr Mladek Date: Wed Jul 2 11:51:55 2025 +0200 printk: ringbuffer: Explain why the KUnit test ignores failed writes The KUnit test ignores prb_reserve() failures on purpose. It tries to push the ringbuffer beyond limits. Note that it is a know problem that writes might fail in this situation. printk() tries to prevent this problem by: + allocating big enough data buffer, see log_buf_add_cpu(). + allocating enough descriptors by using small enough average record, see PRB_AVGBITS. + storing the record with disabled interrupts, see vprintk_store(). Also the amount of printk() messages is always somehow bound in practice. And they are serialized when they are printed from many CPUs on purpose, for example, when printing backtraces. Reviewed-by: John Ogness Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20250702095157.110916-2-pmladek@suse.com Signed-off-by: Petr Mladek commit 4e65d104129e8be001d561410f6402135f6f8a45 Author: John Harrison Date: Fri Jun 13 20:02:22 2025 -0700 drm/i915/guc: Enable CT_DEAD output in regular debug builds There is a sporadic failure to enable CTs ocurring in CI on one specific machine that can't be reproduced locally. The driver already supports dumping out a whole bunch of GuC related debug info on such a failure but only when the verbose GuC debug config option is enabled. It would be preferable to not enable all the verbose debug output. So just bump the CT_DEAD code to regular I915 debug level rather than GUC debug level, at least temporarily for CI. To prevent excessive spam in other parts of CI, also add a check against doing a CT_DEAD dump during an error injection test. No point in dumping large amounts of 'why did this fail' info when the fail is deliberately induced. v2: Revert accidentally enabling some other verbose debug output. Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250614030222.105601-1-John.C.Harrison@Intel.com commit 5ea2bcdfbf46fc3aac239ea371a9561053cc977a Author: Thomas Weißschuh Date: Thu Jun 12 08:29:07 2025 +0200 printk: ringbuffer: Add KUnit test The KUnit test validates the correct operation of the ringbuffer. A separate dedicated ringbuffer is used so that the global printk ringbuffer is not touched. Co-developed-by: John Ogness Signed-off-by: John Ogness Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20250612-printk-ringbuffer-test-v3-1-550c088ee368@linutronix.de Signed-off-by: Petr Mladek commit d679c2e1e8d96f71f85e2ef3877407d264212cc3 Author: Eugen Hristev Date: Fri Jan 17 10:42:28 2025 +0200 pstore/zone: rewrite some comments for better understanding Rewrite some comments to make it more clear and easier to understand; fix typos. Signed-off-by: Eugen Hristev Link: https://lore.kernel.org/r/20241224154405.295840-1-eugen.hristev@linaro.org Link: https://lore.kernel.org/r/20250117084228.3218024-1-eugen.hristev@linaro.org Signed-off-by: Kees Cook